@softr/sdk 0.0.64-alpha.0 → 0.0.64

package/dist/auth/isomorphic.d.ts

@@ -2,8 +2,6 @@ import { User } from "./user.js";
 import { Formatting } from "../formatting.js";
 import { Permissions } from "./permissions.js";
 import { SoftrContext } from "./context.js";
-import * as react0 from "react";
-import { ReactNode } from "react";
 import * as _tanstack_react_start0 from "@tanstack/react-start";
 
 //#region src/auth/isomorphic.d.ts
@@ -56,62 +54,5 @@ declare function initialSoftrContext(): SoftrContext;
  * }
  */
 declare function useCurrentUser(): User | null;
-/** Which ways in this app offers, each named for the `auth` call it unlocks. */
-type AuthOptions = {
-  /** `auth.signIn` */
-  password: boolean;
-  /** `auth.sendSignInCode`, then `auth.signInWithCode` */
-  emailCode: boolean;
-  /** `auth.signInWithMagicLink` */
-  magicLink: boolean;
-  /** `auth.signInWithGoogle`, with the client id to start Google sign-in with. */
-  google: {
-    clientId: string;
-  } | null;
-  /** `auth.signUp`, then `auth.confirmSignUp` */
-  signUp: boolean;
-  /** The builder asked for strong passwords whenever a visitor sets one. */
-  strongPasswords: boolean;
-};
-/**
- * Loads the app's {@link AuthOptions}. Call it from the auth layout's loader
- * and hand the result to {@link AuthSettingsProvider}.
- *
- * @example
- * export const Route = createFileRoute("/_auth")({
- *   loader: () => getAuthSettings(),
- *   staleTime: 60_000,
- * })
- */
-declare const getAuthSettings: _tanstack_react_start0.OptionalFetcher<undefined, undefined, Promise<AuthOptions>>;
-/**
- * Makes the auth options readable with {@link useAuthSettings} anywhere below.
- *
- * @example
- * function AuthLayout() {
- *   const authSettings = Route.useLoaderData()
- *   return (
- *     <AuthSettingsProvider value={authSettings}>
- *       <Outlet />
- *     </AuthSettingsProvider>
- *   )
- * }
- */
-declare function AuthSettingsProvider({
-  value,
-  children
-}: {
-  value: AuthOptions;
-  children?: ReactNode;
-}): react0.JSX.Element;
-/**
- * Which ways in this app offers. Requires an {@link AuthSettingsProvider}
- * above it.
- *
- * @example
- * const options = useAuthSettings()
- * return options.password && <PasswordForm />
- */
-declare function useAuthSettings(): AuthOptions;
 //#endregion
-export { AuthOptions, AuthSettingsProvider, getAuthSettings, getSoftrContext, initialSoftrContext, softrAuthMiddleware, useAuthSettings, useCurrentUser };
+export { getSoftrContext, initialSoftrContext, softrAuthMiddleware, useCurrentUser };

package/dist/auth/isomorphic.js

@@ -1,20 +1,17 @@
-import { assert, panic, requireDefined } from "../assertions.js";
+import { assert, panic } from "../assertions.js";
 import { readUserTimezone, writeCookies } from "../cookies.js";
 import { sessionConfig } from "./config.js";
 import { clearSession, makeSessionDataCookie, readSessionData, readSessionToken } from "./session.js";
 import { makePlatform } from "./platform.js";
 import { defaultFormatting, resolveFormatting } from "../formatting.js";
 import { readLocaleSettings } from "../locale-settings.js";
-import { settings } from "./methods/settings.js";
 import { bootErrorMiddleware } from "../boot-error.js";
 import { pwaMiddleware } from "../pwa.js";
-import { createContext, useContext } from "react";
 import { createMiddleware, createServerFn, getGlobalStartContext } from "@tanstack/react-start";
 import { getRequestHeader } from "@tanstack/react-start/server";
 import { rootRouteId, useRouteContext } from "@tanstack/react-router";
-import { jsx } from "react/jsx-runtime";
 
-//#region src/auth/isomorphic.tsx
+//#region src/auth/isomorphic.ts
 /**
 * Resolves the Softr visitor, their permissions and the app's formatting for
 * every request, so that `getSoftrContext` and the route guards have something
@@ -32,8 +29,10 @@ function softrAuthMiddleware() {
 	return createMiddleware({ type: "request" }).middleware([bootErrorMiddleware(), pwaMiddleware()]).server(async ({ next }) => {
 		async function getSession() {
 			const token = readSessionToken();
-			const cached = readSessionData(token);
-			if (cached !== null) return cached;
+			if (process.env.NODE_ENV === "production") {
+				const cached = readSessionData(token);
+				if (cached !== null) return cached;
+			}
 			const result = await makePlatform(sessionConfig().applicationId).session(token);
 			if (!result.ok) panic(result.message);
 			const session = result.data;
@@ -44,11 +43,11 @@ function softrAuthMiddleware() {
 			writeCookies([makeSessionDataCookie(session, token)]);
 			return session;
 		}
-		const [{ user, permissions }, settings$1] = await Promise.all([getSession(), readLocaleSettings()]);
+		const [{ user, permissions }, settings] = await Promise.all([getSession(), readLocaleSettings()]);
 		return next({ context: {
 			user,
 			permissions,
-			formatting: resolveFormatting(settings$1, getRequestHeader("accept-language") ?? null, readUserTimezone())
+			formatting: resolveFormatting(settings, getRequestHeader("accept-language") ?? null, readUserTimezone())
 		} });
 	});
 }
@@ -97,61 +96,6 @@ function useCurrentUser() {
 		select: (context) => context.user
 	});
 }
-/**
-* Loads the app's {@link AuthOptions}. Call it from the auth layout's loader
-* and hand the result to {@link AuthSettingsProvider}.
-*
-* @example
-* export const Route = createFileRoute("/_auth")({
-*   loader: () => getAuthSettings(),
-*   staleTime: 60_000,
-* })
-*/
-const getAuthSettings = createServerFn({ method: "GET" }).handler(async () => {
-	const raw = await settings();
-	const on = (method) => raw.loginEnabled && raw.authenticationMethods.includes(method);
-	const emailMethods = on("EMAIL") ? raw.emailAuth?.loginMethods ?? [] : [];
-	const clientId = raw.googleAuth?.clientId?.trim();
-	return {
-		password: emailMethods.includes("PASSWORD"),
-		emailCode: emailMethods.includes("EMAIL_CODE"),
-		magicLink: on("MAGIC_LINK"),
-		google: on("GOOGLE") && clientId ? { clientId } : null,
-		signUp: raw.loginEnabled && (raw.signUpPolicy === "OPEN_TO_PUBLIC" || raw.signUpPolicy === "DOMAIN_RESTRICTED"),
-		strongPasswords: on("EMAIL") && (raw.emailAuth?.strongPasswords ?? false)
-	};
-});
-const AuthSettingsContext = createContext(null);
-/**
-* Makes the auth options readable with {@link useAuthSettings} anywhere below.
-*
-* @example
-* function AuthLayout() {
-*   const authSettings = Route.useLoaderData()
-*   return (
-*     <AuthSettingsProvider value={authSettings}>
-*       <Outlet />
-*     </AuthSettingsProvider>
-*   )
-* }
-*/
-function AuthSettingsProvider({ value, children }) {
-	return /* @__PURE__ */ jsx(AuthSettingsContext.Provider, {
-		value,
-		children
-	});
-}
-/**
-* Which ways in this app offers. Requires an {@link AuthSettingsProvider}
-* above it.
-*
-* @example
-* const options = useAuthSettings()
-* return options.password && <PasswordForm />
-*/
-function useAuthSettings() {
-	return requireDefined(useContext(AuthSettingsContext), "useAuthSettings needs an AuthSettingsProvider above it.");
-}
 
 //#endregion
-export { AuthSettingsProvider, getAuthSettings, getSoftrContext, initialSoftrContext, softrAuthMiddleware, useAuthSettings, useCurrentUser };
+export { getSoftrContext, initialSoftrContext, softrAuthMiddleware, useCurrentUser };

package/dist/auth/methods/signup.js

@@ -17,7 +17,6 @@ async function signUp(details) {
 		if (result.status === 409) return authError("emailTaken", result.message);
 		if (result.status === 429) return authError("tooManyAttempts", result.message);
 		if (result.status === 400) return authError("invalidDetails", result.message);
-		if (result.status === 401 && result.message === "Email domain not allowed") return authError("emailDomainNotAllowed", result.message);
 		if (result.status >= 500) panic(`Expected the sign-up code to be emailed, but got ${result.status}: ` + result.message);
 		throw new Error(`${result.message}. Check SOFTR_APPLICATION_ID and that the app allows sign-up.`);
 	}

package/dist/auth/methods/social.js

@@ -22,7 +22,6 @@ async function signInWithGoogle(credentials) {
 	const result = await makePlatform(sessionConfig().applicationId).signInWithGoogle(credentials);
 	if (!result.ok) {
 		if (result.status === 429) return authError("tooManyAttempts", result.message);
-		if (result.status === 400 && result.message.startsWith("Emails with ") && result.message.endsWith(" domain is not allowed to signup.")) return authError("emailDomainNotAllowed", result.message);
 		if (result.status === 400 || result.status === 401) return authError("invalidCredentials", result.message);
 		if (result.status >= 500) panic(`Expected Google sign-in to succeed, but got ${result.status}: ` + result.message);
 		throw new Error(`${result.message}. Check SOFTR_APPLICATION_ID and that the app allows Google sign-in.`);

package/dist/auth/methods/utils.d.ts

@@ -10,6 +10,6 @@ type AuthError = {
   code: AuthErrorCode;
   message: string;
 };
-type AuthErrorCode = "invalidCredentials" | "tooManyAttempts" | "emailTaken" | "invalidDetails" | "invalidCode" | "notAuthenticated" | "emailDomainNotAllowed" | "linkExpired";
+type AuthErrorCode = "invalidCredentials" | "tooManyAttempts" | "emailTaken" | "invalidDetails" | "invalidCode" | "notAuthenticated";
 //#endregion
 export { AuthError, Result };

package/dist/auth/platform.js

@@ -6,35 +6,8 @@ import { userSchema } from "./user.js";
 import { z } from "zod";
 
 //#region src/auth/platform.ts
-const authSettingsSchema = z.object({
-	loginEnabled: z.boolean(),
-	authenticationMethods: z.array(z.enum([
-		"EMAIL",
-		"SSO",
-		"GOOGLE",
-		"MAGIC_LINK"
-	])),
-	signUpPolicy: z.enum([
-		"DISABLED",
-		"OPEN_TO_PUBLIC",
-		"DOMAIN_RESTRICTED"
-	]).nullable(),
-	sessionExpirationDays: z.number().nullable(),
-	inactivityTimeoutMinutes: z.number().nullable(),
-	emailAuth: z.object({
-		loginMethods: z.array(z.enum(["PASSWORD", "EMAIL_CODE"])),
-		strongPasswords: z.boolean(),
-		emailCodeExpirationMinutes: z.number().nullable()
-	}).nullable(),
-	googleAuth: z.object({
-		clientId: z.string().nullable(),
-		userType: z.enum(["INTERNAL", "EXTERNAL"]).nullable()
-	}).nullable(),
-	sso: z.object({ type: z.enum(["SAML", "OPEN_ID"]).nullable() }).nullable()
-});
 function makePlatform(applicationId) {
 	return {
-		authSettings: () => request(`/v1/vibe/applications/${applicationId}/users/auth-settings`, { method: "GET" }, authSettingsSchema),
 		session: async (token) => {
 			const result = await request(`/v1/vibe/applications/${applicationId}/users/session`, {
 				method: "GET",
@@ -126,33 +99,6 @@ function makePlatform(applicationId) {
 				challengeToken: z.string()
 			}).nullish()
 		})),
-		forgotPassword: (body) => request(`/v1/vibe/applications/${applicationId}/users/forgot-password`, {
-			method: "POST",
-			json: body
-		}, z.null()),
-		checkPasswordToken: (body) => request(`/v1/vibe/applications/${applicationId}/users/set-password/check`, {
-			method: "POST",
-			json: body
-		}, z.object({ email: z.string() })),
-		setPassword: (body) => request(`/v1/vibe/applications/${applicationId}/users/set-password`, {
-			method: "POST",
-			json: body
-		}, z.object({
-			status: z.enum(["AUTHENTICATED", "MFA_REQUIRED"]),
-			session: z.object({
-				jwt: z.string(),
-				user: userSchema,
-				permissions: permissionsSchema
-			}).nullish(),
-			mfa: z.object({
-				action: z.enum([
-					"VERIFICATION_REQUIRED",
-					"SETUP_REQUIRED",
-					"SETUP_OPTIONAL"
-				]),
-				challengeToken: z.string()
-			}).nullish()
-		})),
 		sendSignUpCode: (body) => request(`/v1/vibe/applications/${applicationId}/users/sign-up/send-code`, {
 			method: "POST",
 			json: body

package/dist/auth/server.d.ts

@@ -2,8 +2,6 @@ import { confirmAuthenticatorSetup, removeAuthenticator, resetAuthenticator, sen
 import { sendSignInCode, signInWithCode } from "./methods/code.js";
 import { signInWithMagicLink } from "./methods/magicLink.js";
 import { signIn, signOut } from "./methods/password.js";
-import { checkPasswordLink, requestPasswordReset, setPasswordWithLink } from "./methods/passwordLink.js";
-import { settings } from "./methods/settings.js";
 import { confirmSignUp, signUp } from "./methods/signup.js";
 import { signInWithGoogle } from "./methods/social.js";
 import "@tanstack/react-start/server-only";
@@ -22,9 +20,6 @@ declare const auth: {
   signInWithCode: typeof signInWithCode;
   signInWithGoogle: typeof signInWithGoogle;
   signInWithMagicLink: typeof signInWithMagicLink;
-  requestPasswordReset: typeof requestPasswordReset;
-  checkPasswordLink: typeof checkPasswordLink;
-  setPasswordWithLink: typeof setPasswordWithLink;
   startAuthenticatorSetup: typeof startAuthenticatorSetup;
   confirmAuthenticatorSetup: typeof confirmAuthenticatorSetup;
   skipAuthenticatorSetup: typeof skipAuthenticatorSetup;
@@ -32,7 +27,6 @@ declare const auth: {
   sendAuthenticatorResetCode: typeof sendAuthenticatorResetCode;
   resetAuthenticator: typeof resetAuthenticator;
   removeAuthenticator: typeof removeAuthenticator;
-  settings: typeof settings;
 };
 //#endregion
 export { auth };

package/dist/auth/server.js

@@ -1,9 +1,7 @@
-import { settings } from "./methods/settings.js";
 import { confirmAuthenticatorSetup, removeAuthenticator, resetAuthenticator, sendAuthenticatorResetCode, skipAuthenticatorSetup, startAuthenticatorSetup, verifyAuthenticator } from "./methods/authenticator.js";
 import { sendSignInCode, signInWithCode } from "./methods/code.js";
 import { signInWithMagicLink } from "./methods/magicLink.js";
 import { signIn, signOut } from "./methods/password.js";
-import { checkPasswordLink, requestPasswordReset, setPasswordWithLink } from "./methods/passwordLink.js";
 import { confirmSignUp, signUp } from "./methods/signup.js";
 import { signInWithGoogle } from "./methods/social.js";
 import "@tanstack/react-start/server-only";
@@ -21,17 +19,13 @@ const auth = {
 	signInWithCode,
 	signInWithGoogle,
 	signInWithMagicLink,
-	requestPasswordReset,
-	checkPasswordLink,
-	setPasswordWithLink,
 	startAuthenticatorSetup,
 	confirmAuthenticatorSetup,
 	skipAuthenticatorSetup,
 	verifyAuthenticator,
 	sendAuthenticatorResetCode,
 	resetAuthenticator,
-	removeAuthenticator,
-	settings
+	removeAuthenticator
 };
 
 //#endregion

package/dist/default-error-overlay.d.ts

@@ -1,4 +1,4 @@
-import * as react6 from "react";
+import * as react5 from "react";
 
 //#region src/default-error-overlay.d.ts
 type Props = {
@@ -8,6 +8,6 @@ type Props = {
 declare function DefaultErrorOverlay({
   error,
   reset
-}: Props): react6.JSX.Element;
+}: Props): react5.JSX.Element;
 //#endregion
 export { DefaultErrorOverlay };

package/dist/index.d.ts

@@ -4,13 +4,12 @@ import { FileAttachment } from "./core/file-upload.js";
 import { FileItem, useFileUpload } from "./core/use-file-upload.js";
 import { DateOptions, DateParts, DateSeparator, DateValue, FixedDateFormat, FormattedDate, Formatting, FormattingScope, WeekDay, formatDate, formatDateTime, formatNumber, useFormatting } from "./formatting.js";
 import { SoftrContext } from "./auth/context.js";
-import { AuthSettings } from "./auth/platform.js";
 import { checkAccess, defineVisibility, isAuthorized } from "./visibility/visibility.js";
-import { assertRouteAccess, authRedirectTarget, guardRoute, isAccessError, isAlreadyAuthenticatedError, isForbiddenError, isUnauthenticatedError } from "./visibility/route.js";
-import { AuthOptions, AuthSettingsProvider, getAuthSettings, getSoftrContext, initialSoftrContext, softrAuthMiddleware, useAuthSettings, useCurrentUser } from "./auth/isomorphic.js";
+import { assertRouteAccess, guardRoute, isAccessError, isAlreadyAuthenticatedError, isForbiddenError, isUnauthenticatedError } from "./visibility/route.js";
+import { getSoftrContext, initialSoftrContext, softrAuthMiddleware, useCurrentUser } from "./auth/isomorphic.js";
 import { softrMcpMiddleware } from "./mcp.js";
 import { useUserTimezone } from "./timezone.js";
 import { PwaInstall, PwaPlatform, SoftrPwaHead, usePwaInstall } from "./pwa.js";
 import { DefaultErrorOverlay } from "./default-error-overlay.js";
 import { Audience } from "./visibility/audience.js";
-export { type ActionPermissions, Audience, type AuthOptions, type AuthSettings, AuthSettingsProvider, type DateOptions, type DateParts, type DateSeparator, type DateValue, DefaultErrorOverlay, type FileAttachment, type FileItem, type FixedDateFormat, FormattedDate, type Formatting, FormattingScope, type PwaInstall, type PwaPlatform, type SoftrContext, type SoftrDatasources, SoftrPwaHead, type SoftrUserGroupId, type SoftrUserGroups, type User, type WeekDay, assertRouteAccess, authRedirectTarget, checkAccess, defineIntegration, defineMutation, defineQuery, defineVisibility, defineWorkflow, formatDate, formatDateTime, formatNumber, getAuthSettings, getSoftrContext, guardRoute, initialSoftrContext, isAccessError, isAlreadyAuthenticatedError, isAuthorized, isForbiddenError, isUnauthenticatedError, softrAuthMiddleware, softrMcpMiddleware, useAuthSettings, useCurrentUser, useFileUpload, useFormatting, usePwaInstall, useUserTimezone };
+export { type ActionPermissions, Audience, type DateOptions, type DateParts, type DateSeparator, type DateValue, DefaultErrorOverlay, type FileAttachment, type FileItem, type FixedDateFormat, FormattedDate, type Formatting, FormattingScope, type PwaInstall, type PwaPlatform, type SoftrContext, type SoftrDatasources, SoftrPwaHead, type SoftrUserGroupId, type SoftrUserGroups, type User, type WeekDay, assertRouteAccess, checkAccess, defineIntegration, defineMutation, defineQuery, defineVisibility, defineWorkflow, formatDate, formatDateTime, formatNumber, getSoftrContext, guardRoute, initialSoftrContext, isAccessError, isAlreadyAuthenticatedError, isAuthorized, isForbiddenError, isUnauthenticatedError, softrAuthMiddleware, softrMcpMiddleware, useCurrentUser, useFileUpload, useFormatting, usePwaInstall, useUserTimezone };

package/dist/index.js

@@ -1,13 +1,13 @@
 import { useFileUpload } from "./core/use-file-upload.js";
 import { defineIntegration, defineMutation, defineQuery, defineWorkflow } from "./action.js";
 import { checkAccess, defineVisibility, isAuthorized } from "./visibility/visibility.js";
-import { assertRouteAccess, authRedirectTarget, guardRoute, isAccessError, isAlreadyAuthenticatedError, isForbiddenError, isUnauthenticatedError } from "./visibility/route.js";
+import { assertRouteAccess, guardRoute, isAccessError, isAlreadyAuthenticatedError, isForbiddenError, isUnauthenticatedError } from "./visibility/route.js";
 import { FormattedDate, FormattingScope, formatDate, formatDateTime, formatNumber, useFormatting } from "./formatting.js";
 import { SoftrPwaHead, usePwaInstall } from "./pwa.js";
-import { AuthSettingsProvider, getAuthSettings, getSoftrContext, initialSoftrContext, softrAuthMiddleware, useAuthSettings, useCurrentUser } from "./auth/isomorphic.js";
+import { getSoftrContext, initialSoftrContext, softrAuthMiddleware, useCurrentUser } from "./auth/isomorphic.js";
 import { softrMcpMiddleware } from "./mcp.js";
 import { useUserTimezone } from "./timezone.js";
 import { DefaultErrorOverlay } from "./default-error-overlay.js";
 import { Audience } from "./visibility/audience.js";
 
-export { Audience, AuthSettingsProvider, DefaultErrorOverlay, FormattedDate, FormattingScope, SoftrPwaHead, assertRouteAccess, authRedirectTarget, checkAccess, defineIntegration, defineMutation, defineQuery, defineVisibility, defineWorkflow, formatDate, formatDateTime, formatNumber, getAuthSettings, getSoftrContext, guardRoute, initialSoftrContext, isAccessError, isAlreadyAuthenticatedError, isAuthorized, isForbiddenError, isUnauthenticatedError, softrAuthMiddleware, softrMcpMiddleware, useAuthSettings, useCurrentUser, useFileUpload, useFormatting, usePwaInstall, useUserTimezone };
+export { Audience, DefaultErrorOverlay, FormattedDate, FormattingScope, SoftrPwaHead, assertRouteAccess, checkAccess, defineIntegration, defineMutation, defineQuery, defineVisibility, defineWorkflow, formatDate, formatDateTime, formatNumber, getSoftrContext, guardRoute, initialSoftrContext, isAccessError, isAlreadyAuthenticatedError, isAuthorized, isForbiddenError, isUnauthenticatedError, softrAuthMiddleware, softrMcpMiddleware, useCurrentUser, useFileUpload, useFormatting, usePwaInstall, useUserTimezone };

package/dist/mcp.d.ts

@@ -1,5 +1,5 @@
 import { DatasourceAction } from "./action.js";
-import * as _tanstack_react_start4 from "@tanstack/react-start";
+import * as _tanstack_react_start3 from "@tanstack/react-start";
 
 //#region src/mcp.d.ts
 
@@ -12,6 +12,12 @@ type SoftrMcpOptions = {
    * decide who may run the ones that are listed.
    */
   actions?: Array<DatasourceAction>;
+  /**
+   * The app's sign-in page, as a path on this app. A signed-out visitor who
+   * opens the approval page is sent here with `?redirect=` pointing back at it.
+   * Defaults to `/login`.
+   */
+  loginPath?: string;
 };
 /**
  * Serves the MCP endpoint and its OAuth flow from the app's own origin.
@@ -31,6 +37,6 @@ type SoftrMcpOptions = {
  *   ],
  * }))
  */
-declare function softrMcpMiddleware(options?: SoftrMcpOptions): _tanstack_react_start4.RequestMiddlewareAfterServer<{}, undefined, undefined>;
+declare function softrMcpMiddleware(options?: SoftrMcpOptions): _tanstack_react_start3.RequestMiddlewareAfterServer<{}, undefined, undefined>;
 //#endregion
 export { softrMcpMiddleware };

package/dist/mcp.js

@@ -4,7 +4,6 @@ import { sessionConfig } from "./auth/config.js";
 import { readSessionToken, withSessionToken } from "./auth/session.js";
 import { makePlatform, platformApiUrl } from "./auth/platform.js";
 import { isDatasourceAction } from "./action.js";
-import { softrConfig } from "./visibility/route.js";
 import { ds } from "./datasource/datasource.js";
 import { createMiddleware } from "@tanstack/react-start";
 import { z } from "zod";
@@ -39,7 +38,8 @@ const SUPPORTED_PROTOCOL_VERSIONS = ["2025-06-18", "2025-03-26"];
 * }))
 */
 function softrMcpMiddleware(options = {}) {
-	const login = softrConfig().auth.routes.login;
+	const loginPath = options.loginPath ?? "/login";
+	assert(loginPath.startsWith("/") && new URL(loginPath, "https://app.invalid").origin === "https://app.invalid", `softrMcpMiddleware's loginPath must be a path on this app, got "${loginPath}"`);
 	const actions = /* @__PURE__ */ new Map();
 	for (const action of options.actions ?? []) {
 		assert(isDatasourceAction(action), "softrMcpMiddleware takes actions built by defineQuery or defineMutation");
@@ -68,7 +68,7 @@ function softrMcpMiddleware(options = {}) {
 				client_id_metadata_document_supported: true,
 				scopes_supported: SCOPES
 			});
-			case AUTHORIZE_PATH: return await authorize(request, login);
+			case AUTHORIZE_PATH: return await authorize(request, loginPath);
 			case TOKEN_PATH: return await issueToken(request);
 			case MCP_PATH: return await rpc(request, origin, actions);
 			default: return await next();
@@ -92,14 +92,14 @@ const authorizeQuerySchema = z.object({
 * because this runs on the app's origin. The client and the code are the
 * platform's, so we ask it for both.
 */
-async function authorize(request, login) {
+async function authorize(request, loginPath) {
 	const url = new URL(request.url);
 	const query = authorizeQuerySchema.safeParse(Object.fromEntries(url.searchParams));
 	if (!query.success) return html(400, page("This request is not valid", "The app that sent you here left something out. Close this window and try connecting again."));
 	if (request.method !== "GET" && request.method !== "POST") return methodNotAllowed("GET, POST");
 	const sessionToken = readSessionToken();
 	const user = sessionToken === null ? null : await resolveUser(sessionToken);
-	if (user === null || sessionToken === null) return html(200, signInPage(url, login));
+	if (user === null || sessionToken === null) return html(200, signInPage(url, loginPath));
 	const client = await platformConsent(query.data);
 	if (!client.ok) return html(400, page("We can't connect this right now", escapeHtml(client.message)));
 	if (request.method === "GET") return html(200, consentPage(user, url, client.name));
@@ -539,9 +539,9 @@ function consentPage(user, url, clientName) {
        <button type="submit" name="decision" value="deny">Cancel</button>
      </form>`);
 }
-function signInPage(url, login) {
-	const back = new URLSearchParams({ [login.redirectParam]: url.pathname + url.search });
-	return page("Sign in first", "You need to be signed in to this app before you can connect an assistant to it.", `<a class="primary" href="${escapeHtml(`${login.path}?${back}`)}">Sign in</a>`);
+function signInPage(url, loginPath) {
+	const back = encodeURIComponent(url.pathname + url.search);
+	return page("Sign in first", "You need to be signed in to this app before you can connect an assistant to it.", `<a class="primary" href="${escapeHtml(loginPath)}?redirect=${back}">Sign in</a>`);
 }
 function page(title, body, actions = "") {
 	return `<!doctype html>

package/dist/package.js

@@ -1,5 +1,5 @@
 //#region package.json
-var version = "0.0.64-alpha.0";
+var version = "0.0.64";
 
 //#endregion
 export { version };

package/dist/pwa.d.ts

@@ -1,4 +1,4 @@
-import * as react4 from "react";
+import * as react3 from "react";
 import "@tanstack/react-start";
 
 //#region src/pwa.d.ts
@@ -23,7 +23,7 @@ import "@tanstack/react-start";
  *   )
  * }
  */
-declare function SoftrPwaHead(): react4.FunctionComponentElement<react4.FragmentProps>;
+declare function SoftrPwaHead(): react3.FunctionComponentElement<react3.FragmentProps>;
 type PwaPlatform = "ios" | "android" | "desktop";
 type PwaInstall = {
   available: false;

package/dist/softr-config.js

@@ -9,32 +9,11 @@ const AccessBehaviour = z.union([
 	}),
 	z.object({ strategy: z.literal("throw") })
 ], { error: "must be a path like \"/login\", { \"strategy\": \"redirect\", \"to\": \"/login\" } or { \"strategy\": \"throw\" }" });
-const AppPath = z.string().refine((path) => path.startsWith("/") && !path.includes("?") && !path.includes("#") && new URL(path, "https://app.invalid").origin === "https://app.invalid", { error: "must be a path on this app like \"/login\", with no \"?\" or \"#\"" });
-const SoftrConfigSchema = z.object({ auth: z.strictObject({
-	routes: z.strictObject({
-		login: z.strictObject({
-			path: AppPath,
-			redirectParam: z.string()
-		}),
-		resetPassword: z.strictObject({
-			path: AppPath,
-			tokenParam: z.string()
-		}),
-		acceptInvitation: z.strictObject({
-			path: AppPath,
-			tokenParam: z.string()
-		}),
-		magicLink: z.strictObject({
-			path: AppPath,
-			tokenParam: z.string()
-		})
-	}),
-	guard: z.strictObject({
-		unauthenticated: AccessBehaviour,
-		forbidden: AccessBehaviour,
-		alreadyAuthenticated: AccessBehaviour
-	})
-}) });
+const SoftrConfigSchema = z.object({ auth: z.strictObject({ guard: z.strictObject({
+	unauthenticated: AccessBehaviour,
+	forbidden: AccessBehaviour,
+	alreadyAuthenticated: AccessBehaviour
+}) }) });
 
 //#endregion
 export { SoftrConfigSchema };

package/dist/visibility/route.d.ts

@@ -1,5 +1,4 @@
 import { AccessContext, AccessReason, Narrowed, Visibility, VisibilityRule } from "./visibility.js";
-import "../softr-config.js";
 
 //#region src/visibility/route.d.ts
 
@@ -47,8 +46,7 @@ declare function isAlreadyAuthenticatedError(error: unknown): error is AccessErr
  * A `beforeLoad` handler that denies a visitor who fails the rule.
  *
  * Each reason falls back to the app's configured behaviour. Pass `overrides` to
- * change what any one reason does. A redirected signed-out visitor carries the
- * page they wanted, for {@link authRedirectTarget} to read back.
+ * change what any one reason does.
  *
  * Throws a router redirect, so it belongs in `beforeLoad` and nowhere else.
  *
@@ -57,35 +55,17 @@ declare function isAlreadyAuthenticatedError(error: unknown): error is AccessErr
  */
 declare function guardRoute(visibility: Visibility, overrides?: GuardOverrides): (opts: {
   context: AccessContext;
-  location: {
-    href: string;
-  };
 }) => void;
 /**
  * Throws what {@link guardRoute} would, for a `beforeLoad` that runs its own
  * checks after the rule. It takes no overrides.
  *
  * @example
- * beforeLoad: (opts) => {
- *   assertRouteAccess(visibility, opts)
- *   if (opts.params.projectId === "demo") throw redirect({ to: "/projects" })
+ * beforeLoad: ({ context, params }) => {
+ *   assertRouteAccess(visibility, context)
+ *   if (params.projectId === "demo") throw redirect({ to: "/projects" })
  * }
  */
-declare function assertRouteAccess<R extends VisibilityRule, O extends {
-  context: AccessContext;
-  location: {
-    href: string;
-  };
-}>(visibility: Visibility<R>, opts: O): asserts opts is O & {
-  context: Narrowed<R>;
-};
-/**
- * Where to send a visitor who just signed in: the path a guard sent them away
- * from, or `home`. Anything but a path on this app is `home`.
- *
- * @example
- * const target = authRedirectTarget(useLocation({ select: (l) => l.search }), "/")
- */
-declare function authRedirectTarget(search: Record<string, unknown>, home: string): string;
+declare function assertRouteAccess<R extends VisibilityRule>(visibility: Visibility<R>, context: AccessContext): asserts context is Narrowed<R>;
 //#endregion
-export { assertRouteAccess, authRedirectTarget, guardRoute, isAccessError, isAlreadyAuthenticatedError, isForbiddenError, isUnauthenticatedError };
+export { assertRouteAccess, guardRoute, isAccessError, isAlreadyAuthenticatedError, isForbiddenError, isUnauthenticatedError };