TanStack Start SPA mode + catalog deps + Vite 8 (#89)

- Cloud app uses TanStack Start with SPA mode for unified dev/prod
- File-based routes: pages, /v1/* API catch-all, /auth/* catch-all
- Root route with auth gate + ExecutorProvider
- Cloud-specific auth API group (CloudAuthApi) with typed atom
- Upgrade Vite to v8, @vitejs/plugin-react to v6 across workspace
- Catalog shared deps (vite, react, typescript, tanstack, tailwind)
- Fix Tailwind @source paths for new package structure
- Cloud shell with user footer, no version check

Author: RhysSullivan

.gitignore

@@ -42,4 +42,4 @@ executor.har
 apps/desktop/resources/
 
 # cloud local dev database
-.pglite
+.pglite

.gitmodules

@@ -0,0 +1,9 @@
+[submodule ".reference/effect-atom"]
+	path = .reference/effect-atom
+	url = https://github.com/tim-smart/effect-atom.git
+[submodule ".reference/tanstack-router"]
+	path = .reference/tanstack-router
+	url = https://github.com/TanStack/router.git
+[submodule ".reference/effect"]
+	path = .reference/effect
+	url = https://github.com/Effect-TS/effect.git

.reference/executor

@@ -30,6 +30,6 @@
   },
   "devDependencies": {
     "bun-types": "catalog:",
-    "typescript": "^5.9.3"
+    "typescript": "catalog:"
   }
 }

.reference/tanstack-router

@@ -15,30 +15,30 @@
     "@executor/react": "workspace:*",
     "@executor/sdk": "workspace:*",
     "@executor/storage-postgres": "workspace:*",
-    "@tanstack/react-router": "^1.168.10",
+    "@tanstack/react-router": "catalog:",
+    "@tanstack/react-start": "catalog:",
     "@workos-inc/node": "^7.0.0",
     "drizzle-orm": "catalog:",
     "effect": "catalog:",
     "pg": "^8.16.0",
-    "react": "^19.1.0",
-    "react-dom": "^19.1.0"
+    "react": "catalog:",
+    "react-dom": "catalog:"
   },
   "devDependencies": {
     "@electric-sql/pglite": "^0.4.3",
+    "@tailwindcss/vite": "catalog:",
     "@types/pg": "^8.15.4",
-    "@tailwindcss/vite": "^4.1.10",
-    "@types/react": "^19.1.0",
-    "@types/react-dom": "^19.1.0",
-    "@vitejs/plugin-react": "^4.5.2",
+    "@types/react": "catalog:",
+    "@types/react-dom": "catalog:",
+    "@vitejs/plugin-react": "catalog:",
     "portless": "^0.3.0",
-    "typescript": "^5.9.3",
-    "vite": "^6.3.5"
+    "typescript": "catalog:",
+    "vite": "catalog:"
   },
   "scripts": {
-    "dev": "op run --env-file=.env -- portless executor-cloud bun --hot ./src/main.ts",
-    "dev:web": "vite",
-    "start": "bun ./src/main.ts",
-    "build:web": "vite build",
+    "dev": "portless executor-cloud op run --env-file=.env -- vite dev",
+    "build": "vite build",
+    "start": "bun ./server.ts",
     "typecheck": "tsc --noEmit"
   }
 }

apps/cli/package.json

@@ -12,17 +12,16 @@ import { Effect, Layer } from "effect";
 
 import { addGroup, CoreHandlers, ExecutorService, ExecutionEngineService } from "@executor/api";
 import { createExecutionEngine } from "@executor/execution";
-import { makeUserStore } from "@executor/storage-postgres";
 import { OpenApiGroup, OpenApiExtensionService, OpenApiHandlers } from "@executor/plugin-openapi/api";
 import { McpGroup, McpExtensionService, McpHandlers } from "@executor/plugin-mcp/api";
 import { GoogleDiscoveryGroup, GoogleDiscoveryExtensionService, GoogleDiscoveryHandlers } from "@executor/plugin-google-discovery/api";
 import { GraphqlGroup, GraphqlExtensionService, GraphqlHandlers } from "@executor/plugin-graphql/api";
 
 import { createTeamExecutor } from "./services/executor";
-import { authenticateRequest } from "./auth/workos";
 import { CloudAuthApi } from "./auth/api";
 import { CloudAuthHandlers } from "./auth/handlers";
 import { AuthContext, UserStoreService } from "./auth/context";
+import { WorkOSAuth } from "./auth/workos";
 import type { DrizzleDb } from "./services/db";
 
 // ---------------------------------------------------------------------------
@@ -65,10 +64,15 @@ const parseCookie = (cookieHeader: string | null, name: string): string | null =
 // ---------------------------------------------------------------------------
 
 export const createCloudApiHandler = (db: DrizzleDb, encryptionKey: string) => {
-  const userStore = makeUserStore(db);
-
   return async (request: Request): Promise<Response> => {
-    const auth = await authenticateRequest(request);
+    // Authenticate via WorkOS sealed session
+    const auth = await Effect.runPromise(
+      Effect.gen(function* () {
+        const workos = yield* WorkOSAuth;
+        return yield* workos.authenticateRequest(request);
+      }).pipe(Effect.provide(WorkOSAuth.Default)),
+    );
+
     if (!auth) {
       return Response.json({ error: "Unauthorized" }, { status: 401 });
     }
@@ -78,7 +82,14 @@ export const createCloudApiHandler = (db: DrizzleDb, encryptionKey: string) => {
       return Response.json({ error: "No team selected" }, { status: 401 });
     }
 
-    const team = await userStore.getTeam(teamId);
+    // Resolve team name
+    const userStore = UserStoreService.layer(db);
+    const team = await Effect.runPromise(
+      Effect.gen(function* () {
+        const users = yield* UserStoreService;
+        return yield* users.use((s) => s.getTeam(teamId));
+      }).pipe(Effect.provide(userStore)),
+    );
     const teamName = team?.name ?? "Unknown Team";
 
     const executor = await Effect.runPromise(
@@ -108,7 +119,8 @@ export const createCloudApiHandler = (db: DrizzleDb, encryptionKey: string) => {
           name: `${auth.firstName ?? ""} ${auth.lastName ?? ""}`.trim() || null,
           avatarUrl: auth.avatarUrl,
         })),
-        Layer.provideMerge(Layer.succeed(UserStoreService, userStore)),
+        Layer.provideMerge(UserStoreService.layer(db)),
+        Layer.provideMerge(WorkOSAuth.Default),
         Layer.provideMerge(HttpServer.layerContext),
       ),
       { middleware: HttpMiddleware.logger },

apps/cloud/index.html

@@ -1,5 +1,6 @@
 import { HttpApiEndpoint, HttpApiGroup } from "@effect/platform";
 import { Schema } from "effect";
+import { UserStoreError, WorkOSError } from "./context";
 
 const AuthUser = Schema.Struct({
   id: Schema.String,
@@ -18,8 +19,25 @@ const AuthMeResponse = Schema.Struct({
   team: Schema.NullOr(AuthTeam),
 });
 
+const AuthCallbackSearch = Schema.Struct({
+  code: Schema.String,
+});
+
 export class CloudAuthApi extends HttpApiGroup.make("cloudAuth")
   .add(
     HttpApiEndpoint.get("me")`/auth/me`
-      .addSuccess(AuthMeResponse),
+      .addSuccess(AuthMeResponse)
+      .addError(UserStoreError),
+  )
+  .add(
+    HttpApiEndpoint.get("login")`/auth/login`,
+  )
+  .add(
+    HttpApiEndpoint.get("callback")`/auth/callback`
+      .setUrlParams(AuthCallbackSearch)
+      .addError(UserStoreError)
+      .addError(WorkOSError),
+  )
+  .add(
+    HttpApiEndpoint.post("logout")`/auth/logout`,
   ) {}

apps/cloud/package.json

@@ -1,5 +1,24 @@
-import { Context } from "effect";
-import type { makeUserStore } from "@executor/storage-postgres";
+import { Context, Effect, Layer, Schema } from "effect";
+import { makeUserStore } from "@executor/storage-postgres";
+import type { DrizzleDb } from "../services/db";
+
+// ---------------------------------------------------------------------------
+// Errors
+// ---------------------------------------------------------------------------
+
+export class UserStoreError extends Schema.TaggedError<UserStoreError>()(
+  "UserStoreError",
+  { cause: Schema.Unknown },
+) {}
+
+export class WorkOSError extends Schema.TaggedError<WorkOSError>()(
+  "WorkOSError",
+  { cause: Schema.Unknown },
+) {}
+
+// ---------------------------------------------------------------------------
+// AuthContext — resolved per-request from sealed session
+// ---------------------------------------------------------------------------
 
 export class AuthContext extends Context.Tag("@executor/cloud/AuthContext")<
   AuthContext,
@@ -12,7 +31,30 @@ export class AuthContext extends Context.Tag("@executor/cloud/AuthContext")<
   }
 >() {}
 
+// ---------------------------------------------------------------------------
+// UserStoreService — wraps the Drizzle-backed user store with Effect
+// ---------------------------------------------------------------------------
+
+type RawStore = ReturnType<typeof makeUserStore>;
+
+const makeService = (db: DrizzleDb) => {
+  const store = makeUserStore(db);
+
+  const use = <A>(fn: (s: RawStore) => Promise<A>) =>
+    Effect.tryPromise({
+      try: () => fn(store),
+      catch: (cause) => new UserStoreError({ cause }),
+    }).pipe(Effect.withSpan("user_store"));
+
+  return { use };
+};
+
+type UserStoreServiceType = ReturnType<typeof makeService>;
+
 export class UserStoreService extends Context.Tag("@executor/cloud/UserStoreService")<
   UserStoreService,
-  ReturnType<typeof makeUserStore>
->() {}
+  UserStoreServiceType
+>() {
+  static layer = (db: DrizzleDb) =>
+    Layer.succeed(this, makeService(db));
+}