@softr/sdk 0.0.65-alpha.0 → 0.0.65

package/dist/auth/isomorphic.d.ts

@@ -2,6 +2,8 @@ import { User } from "./user.js";
 import { Formatting } from "../formatting.js";
 import { Permissions } from "./permissions.js";
 import { SoftrContext } from "./context.js";
+import * as react0 from "react";
+import { ReactNode } from "react";
 import * as _tanstack_react_start0 from "@tanstack/react-start";
 
 //#region src/auth/isomorphic.d.ts
@@ -54,5 +56,62 @@ declare function initialSoftrContext(): SoftrContext;
  * }
  */
 declare function useCurrentUser(): User | null;
+/** Which ways in this app offers, each named for the `auth` call it unlocks. */
+type AuthOptions = {
+  /** `auth.signIn` */
+  password: boolean;
+  /** `auth.sendSignInCode`, then `auth.signInWithCode` */
+  emailCode: boolean;
+  /** `auth.signInWithMagicLink` */
+  magicLink: boolean;
+  /** `auth.signInWithGoogle`, with the client id to start Google sign-in with. */
+  google: {
+    clientId: string;
+  } | null;
+  /** `auth.signUp`, then `auth.confirmSignUp` */
+  signUp: boolean;
+  /** The builder asked for strong passwords whenever a visitor sets one. */
+  strongPasswords: boolean;
+};
+/**
+ * Loads the app's {@link AuthOptions}. Call it from the auth layout's loader
+ * and hand the result to {@link AuthSettingsProvider}.
+ *
+ * @example
+ * export const Route = createFileRoute("/_auth")({
+ *   loader: () => getAuthSettings(),
+ *   staleTime: 60_000,
+ * })
+ */
+declare const getAuthSettings: _tanstack_react_start0.OptionalFetcher<undefined, undefined, Promise<AuthOptions>>;
+/**
+ * Makes the auth options readable with {@link useAuthSettings} anywhere below.
+ *
+ * @example
+ * function AuthLayout() {
+ *   const authSettings = Route.useLoaderData()
+ *   return (
+ *     <AuthSettingsProvider value={authSettings}>
+ *       <Outlet />
+ *     </AuthSettingsProvider>
+ *   )
+ * }
+ */
+declare function AuthSettingsProvider({
+  value,
+  children
+}: {
+  value: AuthOptions;
+  children?: ReactNode;
+}): react0.JSX.Element;
+/**
+ * Which ways in this app offers. Requires an {@link AuthSettingsProvider}
+ * above it.
+ *
+ * @example
+ * const options = useAuthSettings()
+ * return options.password && <PasswordForm />
+ */
+declare function useAuthSettings(): AuthOptions;
 //#endregion
-export { getSoftrContext, initialSoftrContext, softrAuthMiddleware, useCurrentUser };
+export { AuthOptions, AuthSettingsProvider, getAuthSettings, getSoftrContext, initialSoftrContext, softrAuthMiddleware, useAuthSettings, useCurrentUser };

package/dist/auth/isomorphic.js

@@ -1,17 +1,20 @@
-import { assert, panic } from "../assertions.js";
+import { assert, panic, requireDefined } from "../assertions.js";
 import { readUserTimezone, writeCookies } from "../cookies.js";
 import { sessionConfig } from "./config.js";
 import { clearSession, makeSessionDataCookie, readSessionData, readSessionToken } from "./session.js";
 import { makePlatform } from "./platform.js";
 import { defaultFormatting, resolveFormatting } from "../formatting.js";
 import { readLocaleSettings } from "../locale-settings.js";
+import { settings } from "./methods/settings.js";
 import { bootErrorMiddleware } from "../boot-error.js";
 import { pwaMiddleware } from "../pwa.js";
+import { createContext, useContext } from "react";
 import { createMiddleware, createServerFn, getGlobalStartContext } from "@tanstack/react-start";
 import { getRequestHeader } from "@tanstack/react-start/server";
 import { rootRouteId, useRouteContext } from "@tanstack/react-router";
+import { jsx } from "react/jsx-runtime";
 
-//#region src/auth/isomorphic.ts
+//#region src/auth/isomorphic.tsx
 /**
 * Resolves the Softr visitor, their permissions and the app's formatting for
 * every request, so that `getSoftrContext` and the route guards have something
@@ -29,8 +32,10 @@ function softrAuthMiddleware() {
 	return createMiddleware({ type: "request" }).middleware([bootErrorMiddleware(), pwaMiddleware()]).server(async ({ next }) => {
 		async function getSession() {
 			const token = readSessionToken();
-			const cached = readSessionData(token);
-			if (cached !== null) return cached;
+			if (process.env.NODE_ENV === "production") {
+				const cached = readSessionData(token);
+				if (cached !== null) return cached;
+			}
 			const result = await makePlatform(sessionConfig().applicationId).session(token);
 			if (!result.ok) panic(result.message);
 			const session = result.data;
@@ -41,11 +46,11 @@ function softrAuthMiddleware() {
 			writeCookies([makeSessionDataCookie(session, token)]);
 			return session;
 		}
-		const [{ user, permissions }, settings] = await Promise.all([getSession(), readLocaleSettings()]);
+		const [{ user, permissions }, settings$1] = await Promise.all([getSession(), readLocaleSettings()]);
 		return next({ context: {
 			user,
 			permissions,
-			formatting: resolveFormatting(settings, getRequestHeader("accept-language") ?? null, readUserTimezone())
+			formatting: resolveFormatting(settings$1, getRequestHeader("accept-language") ?? null, readUserTimezone())
 		} });
 	});
 }
@@ -94,6 +99,61 @@ function useCurrentUser() {
 		select: (context) => context.user
 	});
 }
+/**
+* Loads the app's {@link AuthOptions}. Call it from the auth layout's loader
+* and hand the result to {@link AuthSettingsProvider}.
+*
+* @example
+* export const Route = createFileRoute("/_auth")({
+*   loader: () => getAuthSettings(),
+*   staleTime: 60_000,
+* })
+*/
+const getAuthSettings = createServerFn({ method: "GET" }).handler(async () => {
+	const raw = await settings();
+	const on = (method) => raw.loginEnabled && raw.authenticationMethods.includes(method);
+	const emailMethods = on("EMAIL") ? raw.emailAuth?.loginMethods ?? [] : [];
+	const clientId = raw.googleAuth?.clientId?.trim();
+	return {
+		password: emailMethods.includes("PASSWORD"),
+		emailCode: emailMethods.includes("EMAIL_CODE"),
+		magicLink: on("MAGIC_LINK"),
+		google: on("GOOGLE") && clientId ? { clientId } : null,
+		signUp: raw.loginEnabled && (raw.signUpPolicy === "OPEN_TO_PUBLIC" || raw.signUpPolicy === "DOMAIN_RESTRICTED"),
+		strongPasswords: on("EMAIL") && (raw.emailAuth?.strongPasswords ?? false)
+	};
+});
+const AuthSettingsContext = createContext(null);
+/**
+* Makes the auth options readable with {@link useAuthSettings} anywhere below.
+*
+* @example
+* function AuthLayout() {
+*   const authSettings = Route.useLoaderData()
+*   return (
+*     <AuthSettingsProvider value={authSettings}>
+*       <Outlet />
+*     </AuthSettingsProvider>
+*   )
+* }
+*/
+function AuthSettingsProvider({ value, children }) {
+	return /* @__PURE__ */ jsx(AuthSettingsContext.Provider, {
+		value,
+		children
+	});
+}
+/**
+* Which ways in this app offers. Requires an {@link AuthSettingsProvider}
+* above it.
+*
+* @example
+* const options = useAuthSettings()
+* return options.password && <PasswordForm />
+*/
+function useAuthSettings() {
+	return requireDefined(useContext(AuthSettingsContext), "useAuthSettings needs an AuthSettingsProvider above it.");
+}
 
 //#endregion
-export { getSoftrContext, initialSoftrContext, softrAuthMiddleware, useCurrentUser };
+export { AuthSettingsProvider, getAuthSettings, getSoftrContext, initialSoftrContext, softrAuthMiddleware, useAuthSettings, useCurrentUser };

package/dist/auth/methods/passwordLink.d.ts

@@ -0,0 +1,47 @@
+import { User } from "../user.js";
+import { AuthError, Result } from "./utils.js";
+
+//#region src/auth/methods/passwordLink.d.ts
+
+/**
+ * Emails a link to set a new password.
+ *
+ * Succeeds whether or not the address has an account, and sends nothing when
+ * it has none.
+ */
+declare function requestPasswordReset(details: {
+  email: string;
+}): Promise<Result<null, AuthError>>;
+/**
+ * Checks a password reset or invitation link, and returns the address it was
+ * mailed to. The link stays usable.
+ */
+declare function checkPasswordLink(details: {
+  token: string;
+}): Promise<Result<{
+  email: string;
+}, AuthError>>;
+/**
+ * Sets a new password with a password reset or invitation link, and signs the
+ * visitor in.
+ *
+ * Any success uses up the link, `authenticatorRequired` included, and ends
+ * the visitor's other sessions.
+ */
+declare function setPasswordWithLink(details: {
+  token: string;
+  password: string;
+}): Promise<Result<{
+  status: "signedIn";
+  user: User;
+} | {
+  status: "authenticatorRequired";
+  /**
+   * `verify`: they have an authenticator app and owe a code.
+   * `setup`: the app requires one and they have none yet.
+   * `setupOptional`: same, except they may skip it instead.
+   */
+  step: "verify" | "setup" | "setupOptional";
+}, AuthError>>;
+//#endregion
+export { checkPasswordLink, requestPasswordReset, setPasswordWithLink };

package/dist/auth/methods/passwordLink.js

@@ -0,0 +1,86 @@
+import { assert, panic } from "../../assertions.js";
+import { writeCookies } from "../../cookies.js";
+import { sessionConfig } from "../config.js";
+import { clearPendingAuth, makePendingAuthCookie, makeSessionDataCookie, makeSessionTokenCookie } from "../session.js";
+import { makePlatform } from "../platform.js";
+import { authError } from "./utils.js";
+
+//#region src/auth/methods/passwordLink.ts
+/**
+* Emails a link to set a new password.
+*
+* Succeeds whether or not the address has an account, and sends nothing when
+* it has none.
+*/
+async function requestPasswordReset(details) {
+	const result = await makePlatform(sessionConfig().applicationId).forgotPassword(details);
+	if (!result.ok) {
+		if (result.status === 429) return authError("tooManyAttempts", result.message);
+		panic(`Expected the password reset link to be emailed, but got ${result.status}: ${result.message}.`);
+	}
+	return {
+		success: true,
+		data: null
+	};
+}
+/**
+* Checks a password reset or invitation link, and returns the address it was
+* mailed to. The link stays usable.
+*/
+async function checkPasswordLink(details) {
+	const result = await makePlatform(sessionConfig().applicationId).checkPasswordToken(details);
+	if (!result.ok) {
+		if (result.status === 429) return authError("tooManyAttempts", result.message);
+		if (result.status === 400 || result.status === 401) return authError("linkExpired", result.message);
+		panic(`Expected the link to be checked, but got ${result.status}: ${result.message}.`);
+	}
+	return {
+		success: true,
+		data: result.data
+	};
+}
+/**
+* Sets a new password with a password reset or invitation link, and signs the
+* visitor in.
+*
+* Any success uses up the link, `authenticatorRequired` included, and ends
+* the visitor's other sessions.
+*/
+async function setPasswordWithLink(details) {
+	const result = await makePlatform(sessionConfig().applicationId).setPassword(details);
+	if (!result.ok) {
+		if (result.status === 429) return authError("tooManyAttempts", result.message);
+		if (result.status === 400 && result.message === "Password must be at least 8 characters long.") return authError("invalidDetails", result.message);
+		if (result.status === 400 || result.status === 401) return authError("linkExpired", result.message);
+		panic(`Expected the password to be set, but got ${result.status}: ${result.message}.`);
+	}
+	if (result.data.status === "MFA_REQUIRED") {
+		const { mfa } = result.data;
+		assert(mfa, "Expected a challenge from setting a password, but got none");
+		writeCookies([makePendingAuthCookie(mfa.challengeToken)]);
+		return {
+			success: true,
+			data: {
+				status: "authenticatorRequired",
+				step: mfa.action === "VERIFICATION_REQUIRED" ? "verify" : mfa.action === "SETUP_REQUIRED" ? "setup" : "setupOptional"
+			}
+		};
+	}
+	const { session } = result.data;
+	assert(session, "Expected a session from setting a password, but got none");
+	writeCookies([makeSessionTokenCookie(session.jwt), makeSessionDataCookie({
+		user: session.user,
+		permissions: session.permissions
+	}, session.jwt)]);
+	clearPendingAuth();
+	return {
+		success: true,
+		data: {
+			status: "signedIn",
+			user: session.user
+		}
+	};
+}
+
+//#endregion
+export { checkPasswordLink, requestPasswordReset, setPasswordWithLink };

package/dist/auth/methods/settings.d.ts

@@ -0,0 +1,11 @@
+import { AuthSettings } from "../platform.js";
+
+//#region src/auth/methods/settings.d.ts
+
+/**
+ * How visitors may sign in and sign up to this app, as configured in Studio.
+ * A login or sign-up page renders only the methods it lists.
+ */
+declare function settings(): Promise<AuthSettings>;
+//#endregion
+export { settings };

package/dist/auth/methods/settings.js

@@ -0,0 +1,17 @@
+import { panic } from "../../assertions.js";
+import { sessionConfig } from "../config.js";
+import { makePlatform } from "../platform.js";
+
+//#region src/auth/methods/settings.ts
+/**
+* How visitors may sign in and sign up to this app, as configured in Studio.
+* A login or sign-up page renders only the methods it lists.
+*/
+async function settings() {
+	const result = await makePlatform(sessionConfig().applicationId).authSettings();
+	if (!result.ok) panic(`Expected the auth settings, but got ${result.status}: ${result.message}`);
+	return result.data;
+}
+
+//#endregion
+export { settings };

package/dist/auth/methods/signup.js

@@ -17,6 +17,7 @@ async function signUp(details) {
 		if (result.status === 409) return authError("emailTaken", result.message);
 		if (result.status === 429) return authError("tooManyAttempts", result.message);
 		if (result.status === 400) return authError("invalidDetails", result.message);
+		if (result.status === 401 && result.message === "Email domain not allowed") return authError("emailDomainNotAllowed", result.message);
 		if (result.status >= 500) panic(`Expected the sign-up code to be emailed, but got ${result.status}: ` + result.message);
 		throw new Error(`${result.message}. Check SOFTR_APPLICATION_ID and that the app allows sign-up.`);
 	}

package/dist/auth/methods/social.js

@@ -22,6 +22,7 @@ async function signInWithGoogle(credentials) {
 	const result = await makePlatform(sessionConfig().applicationId).signInWithGoogle(credentials);
 	if (!result.ok) {
 		if (result.status === 429) return authError("tooManyAttempts", result.message);
+		if (result.status === 400 && result.message.startsWith("Emails with ") && result.message.endsWith(" domain is not allowed to signup.")) return authError("emailDomainNotAllowed", result.message);
 		if (result.status === 400 || result.status === 401) return authError("invalidCredentials", result.message);
 		if (result.status >= 500) panic(`Expected Google sign-in to succeed, but got ${result.status}: ` + result.message);
 		throw new Error(`${result.message}. Check SOFTR_APPLICATION_ID and that the app allows Google sign-in.`);

package/dist/auth/methods/utils.d.ts

@@ -10,6 +10,6 @@ type AuthError = {
   code: AuthErrorCode;
   message: string;
 };
-type AuthErrorCode = "invalidCredentials" | "tooManyAttempts" | "emailTaken" | "invalidDetails" | "invalidCode" | "notAuthenticated";
+type AuthErrorCode = "invalidCredentials" | "tooManyAttempts" | "emailTaken" | "invalidDetails" | "invalidCode" | "notAuthenticated" | "emailDomainNotAllowed" | "linkExpired";
 //#endregion
 export { AuthError, Result };

package/dist/auth/platform.d.ts

@@ -0,0 +1,46 @@
+import "./user.js";
+import "./context.js";
+import { z } from "zod";
+
+//#region src/auth/platform.d.ts
+
+declare const authSettingsSchema: z.ZodObject<{
+  loginEnabled: z.ZodBoolean;
+  authenticationMethods: z.ZodArray<z.ZodEnum<{
+    EMAIL: "EMAIL";
+    SSO: "SSO";
+    GOOGLE: "GOOGLE";
+    MAGIC_LINK: "MAGIC_LINK";
+  }>>;
+  signUpPolicy: z.ZodNullable<z.ZodEnum<{
+    DISABLED: "DISABLED";
+    OPEN_TO_PUBLIC: "OPEN_TO_PUBLIC";
+    DOMAIN_RESTRICTED: "DOMAIN_RESTRICTED";
+  }>>;
+  sessionExpirationDays: z.ZodNullable<z.ZodNumber>;
+  inactivityTimeoutMinutes: z.ZodNullable<z.ZodNumber>;
+  emailAuth: z.ZodNullable<z.ZodObject<{
+    loginMethods: z.ZodArray<z.ZodEnum<{
+      PASSWORD: "PASSWORD";
+      EMAIL_CODE: "EMAIL_CODE";
+    }>>;
+    strongPasswords: z.ZodBoolean;
+    emailCodeExpirationMinutes: z.ZodNullable<z.ZodNumber>;
+  }, z.core.$strip>>;
+  googleAuth: z.ZodNullable<z.ZodObject<{
+    clientId: z.ZodNullable<z.ZodString>;
+    userType: z.ZodNullable<z.ZodEnum<{
+      INTERNAL: "INTERNAL";
+      EXTERNAL: "EXTERNAL";
+    }>>;
+  }, z.core.$strip>>;
+  sso: z.ZodNullable<z.ZodObject<{
+    type: z.ZodNullable<z.ZodEnum<{
+      SAML: "SAML";
+      OPEN_ID: "OPEN_ID";
+    }>>;
+  }, z.core.$strip>>;
+}, z.core.$strip>;
+type AuthSettings = z.infer<typeof authSettingsSchema>;
+//#endregion
+export { AuthSettings };

package/dist/auth/platform.js

@@ -6,8 +6,35 @@ import { userSchema } from "./user.js";
 import { z } from "zod";
 
 //#region src/auth/platform.ts
+const authSettingsSchema = z.object({
+	loginEnabled: z.boolean(),
+	authenticationMethods: z.array(z.enum([
+		"EMAIL",
+		"SSO",
+		"GOOGLE",
+		"MAGIC_LINK"
+	])),
+	signUpPolicy: z.enum([
+		"DISABLED",
+		"OPEN_TO_PUBLIC",
+		"DOMAIN_RESTRICTED"
+	]).nullable(),
+	sessionExpirationDays: z.number().nullable(),
+	inactivityTimeoutMinutes: z.number().nullable(),
+	emailAuth: z.object({
+		loginMethods: z.array(z.enum(["PASSWORD", "EMAIL_CODE"])),
+		strongPasswords: z.boolean(),
+		emailCodeExpirationMinutes: z.number().nullable()
+	}).nullable(),
+	googleAuth: z.object({
+		clientId: z.string().nullable(),
+		userType: z.enum(["INTERNAL", "EXTERNAL"]).nullable()
+	}).nullable(),
+	sso: z.object({ type: z.enum(["SAML", "OPEN_ID"]).nullable() }).nullable()
+});
 function makePlatform(applicationId) {
 	return {
+		authSettings: () => request(`/v1/vibe/applications/${applicationId}/users/auth-settings`, { method: "GET" }, authSettingsSchema),
 		session: async (token) => {
 			const result = await request(`/v1/vibe/applications/${applicationId}/users/session`, {
 				method: "GET",
@@ -99,6 +126,33 @@ function makePlatform(applicationId) {
 				challengeToken: z.string()
 			}).nullish()
 		})),
+		forgotPassword: (body) => request(`/v1/vibe/applications/${applicationId}/users/forgot-password`, {
+			method: "POST",
+			json: body
+		}, z.null()),
+		checkPasswordToken: (body) => request(`/v1/vibe/applications/${applicationId}/users/set-password/check`, {
+			method: "POST",
+			json: body
+		}, z.object({ email: z.string() })),
+		setPassword: (body) => request(`/v1/vibe/applications/${applicationId}/users/set-password`, {
+			method: "POST",
+			json: body
+		}, z.object({
+			status: z.enum(["AUTHENTICATED", "MFA_REQUIRED"]),
+			session: z.object({
+				jwt: z.string(),
+				user: userSchema,
+				permissions: permissionsSchema
+			}).nullish(),
+			mfa: z.object({
+				action: z.enum([
+					"VERIFICATION_REQUIRED",
+					"SETUP_REQUIRED",
+					"SETUP_OPTIONAL"
+				]),
+				challengeToken: z.string()
+			}).nullish()
+		})),
 		sendSignUpCode: (body) => request(`/v1/vibe/applications/${applicationId}/users/sign-up/send-code`, {
 			method: "POST",
 			json: body

package/dist/auth/returnPath.d.ts

@@ -0,0 +1,19 @@
+//#region src/auth/returnPath.d.ts
+/**
+ * Where to send a visitor who just signed in: the path a guard sent them away
+ * from, else where `auth.guard.alreadyAuthenticated` in softr.json points, else
+ * `/`. Anything but a path on this app counts as missing. It always reloads the
+ * page, so the router picks up the new session.
+ *
+ * @example
+ * const location = useLocation()
+ * navigate(toReturnPath(location))
+ */
+declare function toReturnPath(location: {
+  search: Record<string, unknown>;
+}): {
+  href: string;
+  reloadDocument: true;
+};
+//#endregion
+export { toReturnPath };

package/dist/auth/returnPath.js

@@ -0,0 +1,37 @@
+import { softrConfig } from "../softr-config.js";
+
+//#region src/auth/returnPath.ts
+/**
+* Where to send a visitor who just signed in: the path a guard sent them away
+* from, else where `auth.guard.alreadyAuthenticated` in softr.json points, else
+* `/`. Anything but a path on this app counts as missing. It always reloads the
+* page, so the router picks up the new session.
+*
+* @example
+* const location = useLocation()
+* navigate(toReturnPath(location))
+*/
+function toReturnPath(location) {
+	const { auth } = softrConfig();
+	const target = location.search[auth.routes.login.redirectParam];
+	if (typeof target === "string" && target.startsWith("/") && new URL(target, "https://app.invalid").origin === "https://app.invalid") return {
+		href: target,
+		reloadDocument: true
+	};
+	const fallback = auth.guard.alreadyAuthenticated;
+	if (typeof fallback === "string") return {
+		href: fallback,
+		reloadDocument: true
+	};
+	if (fallback.strategy === "redirect") return {
+		href: fallback.to,
+		reloadDocument: true
+	};
+	return {
+		href: "/",
+		reloadDocument: true
+	};
+}
+
+//#endregion
+export { toReturnPath };

package/dist/auth/server.d.ts

@@ -2,6 +2,8 @@ import { confirmAuthenticatorSetup, removeAuthenticator, resetAuthenticator, sen
 import { sendSignInCode, signInWithCode } from "./methods/code.js";
 import { signInWithMagicLink } from "./methods/magicLink.js";
 import { signIn, signOut } from "./methods/password.js";
+import { checkPasswordLink, requestPasswordReset, setPasswordWithLink } from "./methods/passwordLink.js";
+import { settings } from "./methods/settings.js";
 import { confirmSignUp, signUp } from "./methods/signup.js";
 import { signInWithGoogle } from "./methods/social.js";
 import "@tanstack/react-start/server-only";
@@ -20,6 +22,9 @@ declare const auth: {
   signInWithCode: typeof signInWithCode;
   signInWithGoogle: typeof signInWithGoogle;
   signInWithMagicLink: typeof signInWithMagicLink;
+  requestPasswordReset: typeof requestPasswordReset;
+  checkPasswordLink: typeof checkPasswordLink;
+  setPasswordWithLink: typeof setPasswordWithLink;
   startAuthenticatorSetup: typeof startAuthenticatorSetup;
   confirmAuthenticatorSetup: typeof confirmAuthenticatorSetup;
   skipAuthenticatorSetup: typeof skipAuthenticatorSetup;
@@ -27,6 +32,7 @@ declare const auth: {
   sendAuthenticatorResetCode: typeof sendAuthenticatorResetCode;
   resetAuthenticator: typeof resetAuthenticator;
   removeAuthenticator: typeof removeAuthenticator;
+  settings: typeof settings;
 };
 //#endregion
 export { auth };

package/dist/auth/server.js

@@ -1,7 +1,9 @@
+import { settings } from "./methods/settings.js";
 import { confirmAuthenticatorSetup, removeAuthenticator, resetAuthenticator, sendAuthenticatorResetCode, skipAuthenticatorSetup, startAuthenticatorSetup, verifyAuthenticator } from "./methods/authenticator.js";
 import { sendSignInCode, signInWithCode } from "./methods/code.js";
 import { signInWithMagicLink } from "./methods/magicLink.js";
 import { signIn, signOut } from "./methods/password.js";
+import { checkPasswordLink, requestPasswordReset, setPasswordWithLink } from "./methods/passwordLink.js";
 import { confirmSignUp, signUp } from "./methods/signup.js";
 import { signInWithGoogle } from "./methods/social.js";
 import "@tanstack/react-start/server-only";
@@ -19,13 +21,17 @@ const auth = {
 	signInWithCode,
 	signInWithGoogle,
 	signInWithMagicLink,
+	requestPasswordReset,
+	checkPasswordLink,
+	setPasswordWithLink,
 	startAuthenticatorSetup,
 	confirmAuthenticatorSetup,
 	skipAuthenticatorSetup,
 	verifyAuthenticator,
 	sendAuthenticatorResetCode,
 	resetAuthenticator,
-	removeAuthenticator
+	removeAuthenticator,
+	settings
 };
 
 //#endregion

package/dist/default-error-overlay.d.ts

@@ -1,4 +1,4 @@
-import * as react5 from "react";
+import * as react6 from "react";
 
 //#region src/default-error-overlay.d.ts
 type Props = {
@@ -8,6 +8,6 @@ type Props = {
 declare function DefaultErrorOverlay({
   error,
   reset
-}: Props): react5.JSX.Element;
+}: Props): react6.JSX.Element;
 //#endregion
 export { DefaultErrorOverlay };

package/dist/index.d.ts

@@ -4,12 +4,14 @@ import { FileAttachment } from "./core/file-upload.js";
 import { FileItem, useFileUpload } from "./core/use-file-upload.js";
 import { DateOptions, DateParts, DateSeparator, DateValue, FixedDateFormat, FormattedDate, Formatting, FormattingScope, WeekDay, formatDate, formatDateTime, formatNumber, useFormatting } from "./formatting.js";
 import { SoftrContext } from "./auth/context.js";
+import { AuthSettings } from "./auth/platform.js";
 import { checkAccess, defineVisibility, isAuthorized } from "./visibility/visibility.js";
 import { assertRouteAccess, guardRoute, isAccessError, isAlreadyAuthenticatedError, isForbiddenError, isUnauthenticatedError } from "./visibility/route.js";
-import { getSoftrContext, initialSoftrContext, softrAuthMiddleware, useCurrentUser } from "./auth/isomorphic.js";
+import { toReturnPath } from "./auth/returnPath.js";
+import { AuthOptions, AuthSettingsProvider, getAuthSettings, getSoftrContext, initialSoftrContext, softrAuthMiddleware, useAuthSettings, useCurrentUser } from "./auth/isomorphic.js";
 import { softrMcpMiddleware } from "./mcp.js";
 import { useUserTimezone } from "./timezone.js";
 import { PwaInstall, PwaPlatform, SoftrPwaHead, usePwaInstall } from "./pwa.js";
 import { DefaultErrorOverlay } from "./default-error-overlay.js";
 import { Audience } from "./visibility/audience.js";
-export { type ActionPermissions, Audience, type DateOptions, type DateParts, type DateSeparator, type DateValue, DefaultErrorOverlay, type FileAttachment, type FileItem, type FixedDateFormat, FormattedDate, type Formatting, FormattingScope, type PwaInstall, type PwaPlatform, type SoftrContext, type SoftrDatasources, SoftrPwaHead, type SoftrUserGroupId, type SoftrUserGroups, type User, type WeekDay, assertRouteAccess, checkAccess, defineIntegration, defineMutation, defineQuery, defineVisibility, defineWorkflow, formatDate, formatDateTime, formatNumber, getSoftrContext, guardRoute, initialSoftrContext, isAccessError, isAlreadyAuthenticatedError, isAuthorized, isForbiddenError, isUnauthenticatedError, softrAuthMiddleware, softrMcpMiddleware, useCurrentUser, useFileUpload, useFormatting, usePwaInstall, useUserTimezone };
+export { type ActionPermissions, Audience, type AuthOptions, type AuthSettings, AuthSettingsProvider, type DateOptions, type DateParts, type DateSeparator, type DateValue, DefaultErrorOverlay, type FileAttachment, type FileItem, type FixedDateFormat, FormattedDate, type Formatting, FormattingScope, type PwaInstall, type PwaPlatform, type SoftrContext, type SoftrDatasources, SoftrPwaHead, type SoftrUserGroupId, type SoftrUserGroups, type User, type WeekDay, assertRouteAccess, checkAccess, defineIntegration, defineMutation, defineQuery, defineVisibility, defineWorkflow, formatDate, formatDateTime, formatNumber, getAuthSettings, getSoftrContext, guardRoute, initialSoftrContext, isAccessError, isAlreadyAuthenticatedError, isAuthorized, isForbiddenError, isUnauthenticatedError, softrAuthMiddleware, softrMcpMiddleware, toReturnPath, useAuthSettings, useCurrentUser, useFileUpload, useFormatting, usePwaInstall, useUserTimezone };

package/dist/index.js

@@ -2,12 +2,13 @@ import { useFileUpload } from "./core/use-file-upload.js";
 import { defineIntegration, defineMutation, defineQuery, defineWorkflow } from "./action.js";
 import { checkAccess, defineVisibility, isAuthorized } from "./visibility/visibility.js";
 import { assertRouteAccess, guardRoute, isAccessError, isAlreadyAuthenticatedError, isForbiddenError, isUnauthenticatedError } from "./visibility/route.js";
+import { toReturnPath } from "./auth/returnPath.js";
 import { FormattedDate, FormattingScope, formatDate, formatDateTime, formatNumber, useFormatting } from "./formatting.js";
 import { SoftrPwaHead, usePwaInstall } from "./pwa.js";
-import { getSoftrContext, initialSoftrContext, softrAuthMiddleware, useCurrentUser } from "./auth/isomorphic.js";
+import { AuthSettingsProvider, getAuthSettings, getSoftrContext, initialSoftrContext, softrAuthMiddleware, useAuthSettings, useCurrentUser } from "./auth/isomorphic.js";
 import { softrMcpMiddleware } from "./mcp.js";
 import { useUserTimezone } from "./timezone.js";
 import { DefaultErrorOverlay } from "./default-error-overlay.js";
 import { Audience } from "./visibility/audience.js";
 
-export { Audience, DefaultErrorOverlay, FormattedDate, FormattingScope, SoftrPwaHead, assertRouteAccess, checkAccess, defineIntegration, defineMutation, defineQuery, defineVisibility, defineWorkflow, formatDate, formatDateTime, formatNumber, getSoftrContext, guardRoute, initialSoftrContext, isAccessError, isAlreadyAuthenticatedError, isAuthorized, isForbiddenError, isUnauthenticatedError, softrAuthMiddleware, softrMcpMiddleware, useCurrentUser, useFileUpload, useFormatting, usePwaInstall, useUserTimezone };
+export { Audience, AuthSettingsProvider, DefaultErrorOverlay, FormattedDate, FormattingScope, SoftrPwaHead, assertRouteAccess, checkAccess, defineIntegration, defineMutation, defineQuery, defineVisibility, defineWorkflow, formatDate, formatDateTime, formatNumber, getAuthSettings, getSoftrContext, guardRoute, initialSoftrContext, isAccessError, isAlreadyAuthenticatedError, isAuthorized, isForbiddenError, isUnauthenticatedError, softrAuthMiddleware, softrMcpMiddleware, toReturnPath, useAuthSettings, useCurrentUser, useFileUpload, useFormatting, usePwaInstall, useUserTimezone };