@softr/sdk 0.0.68-alpha.0 → 0.0.68-props.0

package/dist/auth/platform.d.ts

@@ -1,4 +1,3 @@
-import "./user.js";
 import "./context.js";
 import { z } from "zod";
 

package/dist/auth/platform.js

@@ -1,8 +1,8 @@
-import { panic } from "../assertions.js";
+import { assert, panic } from "../assertions.js";
 import { fetch } from "../fetch.js";
 import { permissionsSchema } from "./permissions.js";
 import { sessionConfig } from "./config.js";
-import { userSchema } from "./user.js";
+import { softrConfig } from "../softr-config.js";
 import { z } from "zod";
 
 //#region src/auth/platform.ts
@@ -33,10 +33,30 @@ const authSettingsSchema = z.object({
 	sso: z.object({ type: z.enum(["SAML", "OPEN_ID"]).nullable() }).nullable()
 });
 function makePlatform(applicationId) {
+	const aliases = Object.entries(softrConfig().user?.properties ?? {});
+	const withAttributes = aliases.length > 0 ? "?includeAttributes=true" : "";
+	const userSchema = z.object({
+		id: z.string(),
+		email: z.string(),
+		fullName: z.string(),
+		userGroupIds: z.array(z.string()),
+		attributes: z.record(z.string(), z.unknown()).optional()
+	}).transform(({ attributes,...identity }) => {
+		const properties = {};
+		for (const [alias, field] of aliases) {
+			assert(attributes !== void 0, "The signed-in user came back without their properties.");
+			assert(Object.hasOwn(attributes, field), `softr.json user.properties.${alias} names the field "${field}", which the users table does not have.`);
+			properties[alias] = attributes[field];
+		}
+		return {
+			...identity,
+			properties
+		};
+	});
 	return {
 		authSettings: () => request(`/v1/vibe/applications/${applicationId}/users/auth-settings`, { method: "GET" }, authSettingsSchema),
 		session: async (token) => {
-			const result = await request(`/v1/vibe/applications/${applicationId}/users/session`, {
+			const result = await request(`/v1/vibe/applications/${applicationId}/users/session${withAttributes}`, {
 				method: "GET",
 				token
 			}, z.object({
@@ -46,7 +66,7 @@ function makePlatform(applicationId) {
 			if (result.status === 404) panic(`Application ${applicationId} not found. Check SOFTR_APPLICATION_ID.`);
 			return result;
 		},
-		tokens: (credentials) => request(`/v1/vibe/applications/${applicationId}/users/tokens`, {
+		tokens: (credentials) => request(`/v1/vibe/applications/${applicationId}/users/tokens${withAttributes}`, {
 			method: "POST",
 			json: credentials
 		}, z.object({
@@ -69,7 +89,7 @@ function makePlatform(applicationId) {
 			method: "POST",
 			json: { email }
 		}, z.null()),
-		signInWithCode: (credentials) => request(`/v1/vibe/applications/${applicationId}/users/tokens/with-code`, {
+		signInWithCode: (credentials) => request(`/v1/vibe/applications/${applicationId}/users/tokens/with-code${withAttributes}`, {
 			method: "POST",
 			json: credentials
 		}, z.object({
@@ -88,7 +108,7 @@ function makePlatform(applicationId) {
 				challengeToken: z.string()
 			}).nullish()
 		})),
-		signInWithGoogle: (body) => request(`/v1/vibe/applications/${applicationId}/users/tokens/with-google`, {
+		signInWithGoogle: (body) => request(`/v1/vibe/applications/${applicationId}/users/tokens/with-google${withAttributes}`, {
 			method: "POST",
 			json: body
 		}, z.object({
@@ -107,7 +127,7 @@ function makePlatform(applicationId) {
 				challengeToken: z.string()
 			}).nullish()
 		})),
-		signInWithMagicLink: (body) => request(`/v1/vibe/applications/${applicationId}/users/tokens/with-magic-link`, {
+		signInWithMagicLink: (body) => request(`/v1/vibe/applications/${applicationId}/users/tokens/with-magic-link${withAttributes}`, {
 			method: "POST",
 			json: body
 		}, z.object({
@@ -134,7 +154,7 @@ function makePlatform(applicationId) {
 			method: "POST",
 			json: body
 		}, z.object({ email: z.string() })),
-		setPassword: (body) => request(`/v1/vibe/applications/${applicationId}/users/set-password`, {
+		setPassword: (body) => request(`/v1/vibe/applications/${applicationId}/users/set-password${withAttributes}`, {
 			method: "POST",
 			json: body
 		}, z.object({
@@ -157,7 +177,7 @@ function makePlatform(applicationId) {
 			method: "POST",
 			json: body
 		}, z.null()),
-		signUpWithCode: (body) => request(`/v1/vibe/applications/${applicationId}/users/sign-up/with-code`, {
+		signUpWithCode: (body) => request(`/v1/vibe/applications/${applicationId}/users/sign-up/with-code${withAttributes}`, {
 			method: "POST",
 			json: body
 		}, z.object({
@@ -176,7 +196,7 @@ function makePlatform(applicationId) {
 				challengeToken: z.string()
 			}).nullish()
 		})),
-		signUpWithPassword: (body) => request(`/v1/vibe/applications/${applicationId}/users/sign-up/with-password`, {
+		signUpWithPassword: (body) => request(`/v1/vibe/applications/${applicationId}/users/sign-up/with-password${withAttributes}`, {
 			method: "POST",
 			json: body
 		}, z.object({
@@ -202,7 +222,7 @@ function makePlatform(applicationId) {
 			otpauthUri: z.string(),
 			qrPngBase64: z.string()
 		})),
-		authenticatorSetupComplete: (token, code) => request(`/v1/vibe/applications/${applicationId}/users/authenticator/setup/complete`, {
+		authenticatorSetupComplete: (token, code) => request(`/v1/vibe/applications/${applicationId}/users/authenticator/setup/complete${withAttributes}`, {
 			method: "POST",
 			token,
 			json: { code }
@@ -214,7 +234,7 @@ function makePlatform(applicationId) {
 			}),
 			backupCodes: z.array(z.string())
 		})),
-		authenticatorSetupDismiss: (token) => request(`/v1/vibe/applications/${applicationId}/users/authenticator/setup/dismiss`, {
+		authenticatorSetupDismiss: (token) => request(`/v1/vibe/applications/${applicationId}/users/authenticator/setup/dismiss${withAttributes}`, {
 			method: "POST",
 			token
 		}, z.object({
@@ -233,7 +253,7 @@ function makePlatform(applicationId) {
 				challengeToken: z.string()
 			}).nullish()
 		})),
-		authenticatorVerify: (token, body) => request(`/v1/vibe/applications/${applicationId}/users/authenticator/totp/verify`, {
+		authenticatorVerify: (token, body) => request(`/v1/vibe/applications/${applicationId}/users/authenticator/totp/verify${withAttributes}`, {
 			method: "POST",
 			token,
 			json: body

package/dist/auth/session.js

@@ -2,10 +2,10 @@ import { readRequestCookies, serializeCookie, writeCookies } from "../cookies.js
 import { permissionsSchema } from "./permissions.js";
 import { sessionConfig } from "./config.js";
 import { userSchema } from "./user.js";
+import { z } from "zod";
 import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { getRequestProtocol } from "@tanstack/react-start/server";
-import { z } from "zod";
 
 //#region src/auth/session.ts
 const SESSION_TOKEN = "session_token";

package/dist/auth/user.d.ts

@@ -13,12 +13,19 @@ interface SoftrUserGroups {}
 type SoftrUserGroupId = SoftrUserGroups extends {
   ids: infer Id extends string;
 } ? Id : string;
+/**
+ * The fields of the visitor's row that softr.json declares under
+ * `user.properties`, keyed by their aliases. The app's generated types declare
+ * it.
+ */
+interface SoftrUserProperties {}
 /** The signed-in visitor. */
 type User = {
   id: string;
   email: string;
   fullName: string;
   userGroupIds: Array<SoftrUserGroupId>;
+  properties: SoftrUserProperties;
 };
 //#endregion
-export { SoftrUserGroupId, SoftrUserGroups, User };
+export { SoftrUserGroupId, SoftrUserGroups, SoftrUserProperties, User };

package/dist/auth/user.js

@@ -5,7 +5,8 @@ const userSchema = z.object({
 	id: z.string(),
 	email: z.string(),
 	fullName: z.string(),
-	userGroupIds: z.array(z.string())
+	userGroupIds: z.array(z.string()),
+	properties: z.record(z.string(), z.unknown())
 });
 
 //#endregion

package/dist/cli.js

@@ -2,11 +2,13 @@
 import { version } from "./package.js";
 import { requireDefined } from "./assertions.js";
 import { fetchSoftrEnvInput, metadataSourceFromEnv } from "./codegen/fetch-metadata.js";
+import { renderUserPropertiesDoc } from "./codegen/datasource-docs.js";
 import { renderUserGroupsDoc } from "./codegen/user-groups.js";
 import { renderSoftrEnv } from "./codegen/softr-env.js";
 import { writeIfChanged } from "./codegen/write-if-changed.js";
 import { writeDatasourceDocs } from "./codegen/write-datasource-docs.js";
-import { writeFileSync } from "node:fs";
+import { loadSoftrConfig } from "./softr-config.schema.js";
+import { rmSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { parseArgs } from "node:util";
 
@@ -14,9 +16,10 @@ import { parseArgs } from "node:util";
 const OUTPUT = "softr-env.d.ts";
 const DOCS_DIR = "docs/datasources";
 const USER_GROUPS_DOC = "docs/user-groups.md";
+const USER_PROPERTIES_DOC = "docs/user-properties.md";
 async function generate({ json }) {
 	if (json) console.info = console.error;
-	const input = await fetchSoftrEnvInput(metadataSourceFromEnv());
+	const input = await fetchSoftrEnvInput(metadataSourceFromEnv(), loadSoftrConfig(process.cwd()).user?.properties ?? {});
 	writeFileSync(path.resolve(process.cwd(), OUTPUT), renderSoftrEnv(input, version), "utf8");
 	const report = writeDocs(input);
 	if (json) {
@@ -26,18 +29,30 @@ async function generate({ json }) {
 	printReport(report);
 }
 function writeDocs(input) {
+	if (input.users === null) rmSync(path.resolve(process.cwd(), USER_PROPERTIES_DOC), { force: true });
 	const datasourceDocs = writeDatasourceDocs(input.datasources, path.resolve(process.cwd(), DOCS_DIR));
 	return {
 		types: OUTPUT,
-		docs: [{
-			subject: "datasources",
-			path: `${DOCS_DIR}/README.md`,
-			changed: datasourceDocs.changed
-		}, {
-			subject: "user groups",
-			path: USER_GROUPS_DOC,
-			changed: writeIfChanged(path.resolve(process.cwd(), USER_GROUPS_DOC), renderUserGroupsDoc(input.userGroups))
-		}],
+		docs: [
+			{
+				subject: "datasources",
+				path: `${DOCS_DIR}/README.md`,
+				changed: datasourceDocs.changed
+			},
+			{
+				subject: "user groups",
+				path: USER_GROUPS_DOC,
+				changed: writeIfChanged(path.resolve(process.cwd(), USER_GROUPS_DOC), renderUserGroupsDoc(input.userGroups))
+			},
+			...input.users === null ? [] : [{
+				subject: "user properties",
+				path: USER_PROPERTIES_DOC,
+				changed: writeIfChanged(path.resolve(process.cwd(), USER_PROPERTIES_DOC), renderUserPropertiesDoc(input.users, {
+					datasources: new Map(input.datasources.map((d) => [d.id, d])),
+					fileNames: datasourceDocs.fileNames
+				}))
+			}]
+		],
 		datasources: input.datasources.map(({ id, name }) => ({
 			id,
 			name,

package/dist/codegen/datasource-docs.js

@@ -18,6 +18,98 @@ function renderDatasourceDoc(datasource, context) {
 		...renderExamples(datasource, context.datasources)
 	].join("\n");
 }
+function renderUserPropertiesDoc(users, context) {
+	const aliases = Object.entries(users.properties);
+	assert(aliases.length > 0, "Expected user properties to document, but got none");
+	const [first] = requireDefined(aliases[0]);
+	const registered = linkedDatasource(users.tableId, context.datasources);
+	const types = /* @__PURE__ */ new Set();
+	const sampled = aliases.filter(([, field]) => {
+		const type = fieldTypeLiteral(field);
+		if (types.has(type)) return false;
+		types.add(type);
+		return true;
+	});
+	return [
+		"# User properties",
+		"",
+		`Users datasource: ${displayName(users.name) || users.tableId}  `,
+		`Datasource ID: ${users.datasourceId}` + (registered === void 0 ? "" : `  \nRegistered as: [${datasourceLabel(registered)}](./datasources/${requireDefined(context.fileNames.get(registered.id))}) (${registered.id})`),
+		"",
+		"> This document is generated automatically when softr.json's `user.properties` or the users table changes.",
+		"",
+		"Each alias below is declared in softr.json under `user.properties`, and read as `user.properties.<alias>`.",
+		"",
+		"## Field reference",
+		"",
+		...aliases.flatMap(([alias, field]) => {
+			const linkedId = option(field.options, "linkedTableId");
+			const linked = typeof linkedId === "string" ? linkedDatasource(linkedId, context.datasources) : void 0;
+			return [
+				`### ${alias}`,
+				"",
+				`- Field: ${displayName(field.name)}`,
+				`- ID: ${field.id}`,
+				`- Type: ${fieldTypeLiteral(field).slice(1, -1)}`,
+				...optionLines(field),
+				...choiceLines(field),
+				...typeof linkedId !== "string" ? [] : linked === void 0 ? [`- Links to: ${linkedId}, not registered`] : [`- Links to: [${datasourceLabel(linked)}](./datasources/${requireDefined(context.fileNames.get(linked.id))}) (${linked.id})`],
+				""
+			];
+		}),
+		"## Read shape",
+		"",
+		"In a component:",
+		"",
+		"```tsx",
+		"import { useCurrentUser } from '@softr/sdk'",
+		"",
+		"const user = useCurrentUser()",
+		"if (user === null) return null",
+		"",
+		...sampled.map(([alias, field]) => `user.properties.${alias} // ${fieldTypeLiteral(field).slice(1, -1)}`),
+		"```",
+		"",
+		"In a route's `beforeLoad`, to send a visitor elsewhere. It guards navigation only, not data:",
+		"",
+		"```tsx",
+		"import { createFileRoute, redirect } from '@tanstack/react-router'",
+		"import { assertRouteAccess, defineVisibility } from '@softr/sdk'",
+		"",
+		"const visibility = defineVisibility({ userGroupTypes: ['LOGGED_IN_USERS'] })",
+		"",
+		"export const Route = createFileRoute('/example')({",
+		"  beforeLoad: (opts) => {",
+		"    assertRouteAccess(visibility, opts)",
+		`    if (opts.context.user.properties.${first} == null) throw redirect({ to: '/' })`,
+		"  },",
+		"})",
+		"```",
+		"",
+		"In a server function, called from a route's `loader`. The handler checks the visitor itself:",
+		"",
+		"```tsx",
+		"import { createFileRoute } from '@tanstack/react-router'",
+		"import { createServerFn } from '@tanstack/react-start'",
+		"",
+		`const get${pascalCase(first)} = createServerFn().handler(async ({ context }) => {`,
+		"  if (!context.user) throw new Error('Not signed in')",
+		`  return context.user.properties.${first}`,
+		"})",
+		"",
+		"export const Route = createFileRoute('/example')({",
+		`  loader: () => get${pascalCase(first)}(),`,
+		"  component: Example,",
+		"})",
+		"",
+		"function Example() {",
+		`  const ${first} = Route.useLoaderData()`,
+		"  // ...",
+		"}",
+		"```",
+		""
+	].join("\n");
+}
 /** Two trailing spaces are a markdown hard break, which keeps the block one paragraph. */
 function summary(datasource, context) {
 	const lines = [`Datasource ID: ${datasource.id}`];
@@ -315,4 +407,4 @@ function words(value) {
 }
 
 //#endregion
-export { renderDatasourceDoc, renderDatasourceIndex };
+export { renderDatasourceDoc, renderDatasourceIndex, renderUserPropertiesDoc };

package/dist/codegen/datasource-types.js

@@ -251,6 +251,21 @@ function linkedRecord(options, context) {
 	if (linked === void 0 || linked.primaryFieldId === "") return "LinkedRecord";
 	return `LinkedRecord<NonNullable<${`${nameOf(linked.id, context)}Read[${quote(linked.primaryFieldId)}]`}>>`;
 }
+/** `SoftrUserProperties`, each alias typed as its field reads. */
+function renderUserProperties(properties, datasources) {
+	const context = {
+		datasources: byId(datasources),
+		names: typeNames(datasources)
+	};
+	return [
+		"interface SoftrUserProperties {",
+		...Object.entries(properties).map(([alias, field]) => indent(readMember({
+			...field,
+			id: alias
+		}, context))),
+		"}"
+	].join("\n");
+}
 function renderRegistry(datasources, context) {
 	return [
 		"interface SoftrDatasources {",
@@ -494,4 +509,4 @@ function indent(block) {
 }
 
 //#endregion
-export { choiceEntries, fieldTypeLiteral, isWritable, linkedDatasource, option, readExample, renderDatasourceTypes, resolvedShape, scalarExample, underlyingType };
+export { choiceEntries, fieldTypeLiteral, isWritable, linkedDatasource, option, readExample, renderDatasourceTypes, renderUserProperties, resolvedShape, scalarExample, underlyingType };

package/dist/codegen/fetch-metadata.js

@@ -1,4 +1,4 @@
-import { panic } from "../assertions.js";
+import { assert, panic } from "../assertions.js";
 import { fetch } from "../fetch.js";
 
 //#region src/codegen/fetch-metadata.ts
@@ -17,27 +17,54 @@ function metadataSourceFromEnv(env = process.env) {
 		token: env.SOFTR_STUDIO_TOKEN
 	};
 }
-async function fetchSoftrEnvInput(source) {
+async function fetchSoftrEnvInput(source, aliases) {
 	const { studioApiUrl, datasourceApiUrl, applicationId, token } = source;
 	const [registered, userGroups] = await Promise.all([apiFetch(`${studioApiUrl}/v1/applications/${applicationId}/datasources`, token), apiFetch(`${studioApiUrl}/v1/applications/${applicationId}/access-control/user-groups`, token)]);
+	const datasources = await Promise.all(registered.map(async ({ name, datasource }) => {
+		const metadata = await apiFetch(`${datasourceApiUrl}/v1/datasource/vibe/studio/applications/${applicationId}/datasources/${datasource.id}/metadata`, token);
+		return {
+			...metadata,
+			id: datasource.id,
+			tableId: metadata.id,
+			name
+		};
+	}));
+	let users = null;
+	if (Object.keys(aliases).length > 0) {
+		const { payload } = await apiFetch(`${studioApiUrl}/v1/applications/${applicationId}`, token);
+		const connection = payload.user_connection?.datasource ?? panic("softr.json declares user.properties, but this app has no users table.");
+		const metadata = await apiFetch(`${datasourceApiUrl}/v1/datasource/${applicationId}/${connection.integration_id}/metadata`, token, {
+			datasourceType: connection.datasource_integration_type,
+			resourceIdentifier: { keys: connection.resource_identifier.keys }
+		});
+		users = {
+			datasourceId: connection.id,
+			tableId: metadata.id,
+			name: metadata.name,
+			properties: {}
+		};
+		for (const [alias, fieldId] of Object.entries(aliases)) {
+			const field = metadata.fields.find(({ id }) => id === fieldId) ?? panic(`softr.json user.properties.${alias} names "${fieldId}", which is not a field of the users table.`);
+			assert(field.type !== "ATTACHMENT" && field.type !== "LONG_TEXT" && !(field.allowMultipleEntries && (field.type === "LINKED_RECORD" || field.type === "LOOKUP")), `softr.json user.properties.${alias} names "${field.name}", a ${field.allowMultipleEntries ? "multiple " : ""}${field.type} field, which can be too big to read with the signed-in user. Remove it, and read it with defineQuery on the users table instead.`);
+			users.properties[alias] = field;
+		}
+	}
 	return {
-		datasources: await Promise.all(registered.map(async ({ name, datasource }) => {
-			const metadata = await apiFetch(`${datasourceApiUrl}/v1/datasource/vibe/studio/applications/${applicationId}/datasources/${datasource.id}/metadata`, token);
-			return {
-				...metadata,
-				id: datasource.id,
-				tableId: metadata.id,
-				name
-			};
-		})),
-		userGroups
+		datasources,
+		userGroups,
+		users
 	};
 }
-async function apiFetch(url, token) {
-	const response = await fetch(url, { headers: {
-		accept: "application/json",
-		Authorization: `Bearer ${token}`
-	} }).catch(() => panic(`Could not reach ${url}`));
+async function apiFetch(url, token, body) {
+	const response = await fetch(url, {
+		method: body === void 0 ? "GET" : "POST",
+		headers: {
+			accept: "application/json",
+			...body === void 0 ? {} : { "content-type": "application/json" },
+			Authorization: `Bearer ${token}`
+		},
+		body: body === void 0 ? void 0 : JSON.stringify(body)
+	}).catch(() => panic(`Could not reach ${url}`));
 	if (!response.ok) panic(`${url} answered ${response.status}`);
 	return await response.json();
 }

package/dist/codegen/softr-env.js

@@ -1,4 +1,4 @@
-import { renderDatasourceTypes } from "./datasource-types.js";
+import { renderDatasourceTypes, renderUserProperties } from "./datasource-types.js";
 import { renderUserGroups } from "./user-groups.js";
 
 //#region src/codegen/softr-env.ts
@@ -15,6 +15,7 @@ function renderSoftrEnv(input, sdkVersion) {
 		indent(interfaces),
 		"",
 		indent(renderUserGroups(input.userGroups)),
+		...input.users === null ? [] : ["", indent(renderUserProperties(input.users.properties, input.datasources))],
 		"}",
 		""
 	].join("\n");

package/dist/cookies.js

@@ -1,3 +1,4 @@
+import { softAssert } from "./assertions.js";
 import { getRequestHeader, getResponseHeaders, setResponseHeader } from "@tanstack/react-start/server";
 
 //#region src/cookies.ts
@@ -38,9 +39,16 @@ const USER_TIMEZONE_COOKIE = "user-timezone";
 function readUserTimezone() {
 	return readRequestCookies()[USER_TIMEZONE_COOKIE] ?? null;
 }
+/** What browsers keep of one cookie's name and value. They drop a larger one silently. */
+const COOKIE_MAX_BYTES = 4096;
 function writeCookies(cookies) {
-	if (cookies.length === 0) return;
-	setResponseHeader("Set-Cookie", [...getResponseHeaders().getSetCookie(), ...cookies]);
+	const written = cookies.filter((cookie) => {
+		const size = cookie.split(";")[0].length;
+		softAssert(size <= COOKIE_MAX_BYTES, () => `The ${cookie.slice(0, cookie.indexOf("="))} cookie is ${size} bytes, over the ${COOKIE_MAX_BYTES} a browser keeps. It was not written.`);
+		return size <= COOKIE_MAX_BYTES;
+	});
+	if (written.length === 0) return;
+	setResponseHeader("Set-Cookie", [...getResponseHeaders().getSetCookie(), ...written]);
 }
 
 //#endregion

package/dist/core/integration.d.ts

@@ -7,13 +7,6 @@ interface IntegrationFetchInit {
   headers?: Record<string, string>;
   body?: string;
   signal?: AbortSignal;
-  /**
-   * Relay the vendor's answer as it is produced instead of waiting for all of it — for any endpoint
-   * that streams, such as an LLM completion requested with `"stream": true`. The returned `Response`
-   * body is then the vendor's own stream, readable chunk by chunk. A vendor that answers in one piece
-   * still works.
-   */
-  stream?: boolean;
 }
 declare function integrationCreateFetcher(action: IntegrationAction): (init?: IntegrationFetchInit) => Promise<Response>;
 declare const integration: {

package/dist/core/integration.js

@@ -3,16 +3,15 @@ import { readSessionToken } from "../auth/session.js";
 import { dsUrl, refererHeader } from "../datasource/record.js";
 
 //#region src/core/integration.ts
-const EVENT_STREAM = "text/event-stream";
-async function integrationFetch(action, { params, query, headers = {}, body, signal, stream = false } = {}) {
+async function integrationFetch(action, { params, query, headers = {}, body, signal } = {}) {
 	if (signal?.aborted) throw signal.reason ?? new DOMException("The operation was aborted.", "AbortError");
 	const payload = {
 		method: action.resource.method,
 		url: buildUrl(action.resource.url, params, query),
-		headers: stream ? withAcceptEventStream(headers) : headers
+		headers
 	};
 	if (body !== void 0) payload.body = body;
-	return fetch(`${dsUrl(action.id)}/${stream ? "proxy/stream" : "proxy"}`, {
+	return fetch(`${dsUrl(action.id)}/proxy`, {
 		method: "POST",
 		headers: {
 			"Content-Type": "application/json",
@@ -31,12 +30,6 @@ function buildUrl(template, params, query) {
 	if (query !== void 0 && Object.keys(query).length > 0) url += `?${new URLSearchParams(query).toString()}`;
 	return url;
 }
-function withAcceptEventStream(headers) {
-	return Object.keys(headers).some((name) => name.toLowerCase() === "accept") ? headers : {
-		...headers,
-		Accept: EVENT_STREAM
-	};
-}
 function integrationCreateFetcher(action) {
 	return (init) => integrationFetch(action, init);
 }

package/dist/formatting.d.ts

@@ -1,6 +1,6 @@
-import * as react0 from "react";
-import { ReactNode } from "react";
 import { z } from "zod";
+import * as react2 from "react";
+import { ReactNode } from "react";
 
 //#region src/formatting.d.ts
 type FixedDateFormat = "FRIENDLY" | "DD-MM-YYYY" | "MM-DD-YYYY" | "YYYY-MM-DD";
@@ -94,7 +94,7 @@ declare function FormattingScope({
   /** A BCP 47 locale, such as `de-DE`. It drops the app's fixed date format inside the scope. */
   locale?: string;
   children?: ReactNode;
-}): react0.FunctionComponentElement<react0.ProviderProps<Scope>>;
+}): react2.FunctionComponentElement<react2.ProviderProps<Scope>>;
 /**
  * A date in the app's format, safe to render on the server. A timestamp whose
  * zone is not known yet renders `fallback` until the browser supplies it, so
@@ -115,6 +115,6 @@ declare function FormattedDate({
   time?: boolean;
   /** What renders while the visitor's zone is unknown. */
   fallback?: ReactNode;
-}): react0.FunctionComponentElement<react0.FragmentProps>;
+}): react2.FunctionComponentElement<react2.FragmentProps>;
 //#endregion
 export { DateOptions, DateParts, DateSeparator, DateValue, FixedDateFormat, FormattedDate, Formatting, FormattingScope, WeekDay, formatDate, formatDateTime, formatNumber, useFormatting };

package/dist/formatting.js

@@ -1,6 +1,6 @@
 import { logger } from "./logger.js";
-import { Fragment, createContext, createElement, useContext, useMemo, useSyncExternalStore } from "react";
 import { z } from "zod";
+import { Fragment, createContext, createElement, useContext, useMemo, useSyncExternalStore } from "react";
 import { rootRouteId, useRouteContext } from "@tanstack/react-router";
 
 //#region src/formatting.ts

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { SoftrUserGroupId, SoftrUserGroups, User } from "./auth/user.js";
+import { SoftrUserGroupId, SoftrUserGroups, SoftrUserProperties, User } from "./auth/user.js";
 import { ActionPermissions, SoftrDatasources, defineIntegration, defineMutation, defineQuery, defineWorkflow } from "./action.js";
 import { FileAttachment } from "./core/file-upload.js";
 import { FileItem, useFileUpload } from "./core/use-file-upload.js";
@@ -14,4 +14,4 @@ import { useUserTimezone } from "./timezone.js";
 import { PwaInstall, PwaPlatform, SoftrPwaHead, usePwaInstall } from "./pwa.js";
 import { DefaultErrorOverlay } from "./default-error-overlay.js";
 import { Audience } from "./visibility/audience.js";
-export { type ActionPermissions, Audience, type AuthOptions, type AuthSettings, AuthSettingsProvider, type DateOptions, type DateParts, type DateSeparator, type DateValue, DefaultErrorOverlay, type FileAttachment, type FileItem, type FixedDateFormat, FormattedDate, type Formatting, FormattingScope, type PwaInstall, type PwaPlatform, type SoftrContext, type SoftrDatasources, SoftrPwaHead, type SoftrUserGroupId, type SoftrUserGroups, type User, type WeekDay, assertRouteAccess, checkAccess, defineIntegration, defineMutation, defineQuery, defineVisibility, defineWorkflow, formatDate, formatDateTime, formatNumber, getAuthSettings, getSoftrContext, guardRoute, initialSoftrContext, isAccessError, isAlreadyAuthenticatedError, isAuthorized, isForbiddenError, isUnauthenticatedError, softrAuthMiddleware, softrMcpMiddleware, toReturnPath, useAuthSettings, useCurrentUser, useFileUpload, useFormatting, usePwaInstall, useUserTimezone };
+export { type ActionPermissions, Audience, type AuthOptions, type AuthSettings, AuthSettingsProvider, type DateOptions, type DateParts, type DateSeparator, type DateValue, DefaultErrorOverlay, type FileAttachment, type FileItem, type FixedDateFormat, FormattedDate, type Formatting, FormattingScope, type PwaInstall, type PwaPlatform, type SoftrContext, type SoftrDatasources, SoftrPwaHead, type SoftrUserGroupId, type SoftrUserGroups, type SoftrUserProperties, type User, type WeekDay, assertRouteAccess, checkAccess, defineIntegration, defineMutation, defineQuery, defineVisibility, defineWorkflow, formatDate, formatDateTime, formatNumber, getAuthSettings, getSoftrContext, guardRoute, initialSoftrContext, isAccessError, isAlreadyAuthenticatedError, isAuthorized, isForbiddenError, isUnauthenticatedError, softrAuthMiddleware, softrMcpMiddleware, toReturnPath, useAuthSettings, useCurrentUser, useFileUpload, useFormatting, usePwaInstall, useUserTimezone };

package/dist/mcp.d.ts

@@ -1,5 +1,5 @@
 import { DatasourceAction } from "./action.js";
-import * as _tanstack_react_start0 from "@tanstack/react-start";
+import * as _tanstack_react_start4 from "@tanstack/react-start";
 
 //#region src/mcp.d.ts
 
@@ -31,6 +31,6 @@ type SoftrMcpOptions = {
  *   ],
  * }))
  */
-declare function softrMcpMiddleware(options?: SoftrMcpOptions): _tanstack_react_start0.RequestMiddlewareAfterServer<{}, undefined, undefined>;
+declare function softrMcpMiddleware(options?: SoftrMcpOptions): _tanstack_react_start4.RequestMiddlewareAfterServer<{}, undefined, undefined>;
 //#endregion
 export { softrMcpMiddleware };

package/dist/mcp.js

@@ -2,12 +2,12 @@ import { assert } from "./assertions.js";
 import { fetch } from "./fetch.js";
 import { sessionConfig } from "./auth/config.js";
 import { readSessionToken, withSessionToken } from "./auth/session.js";
+import { softrConfig } from "./softr-config.js";
 import { makePlatform, platformApiUrl } from "./auth/platform.js";
 import { isDatasourceAction } from "./action.js";
-import { softrConfig } from "./softr-config.js";
 import { ds } from "./datasource/datasource.js";
-import { createMiddleware } from "@tanstack/react-start";
 import { z } from "zod";
+import { createMiddleware } from "@tanstack/react-start";
 
 //#region src/mcp.ts
 const MCP_PATH = "/_softr/mcp";

package/dist/package.js

@@ -1,5 +1,5 @@
 //#region package.json
-var version = "0.0.68-alpha.0";
+var version = "0.0.68-props.0";
 
 //#endregion
 export { version };

package/dist/pwa.d.ts

@@ -1,4 +1,4 @@
-import * as react4 from "react";
+import * as react0 from "react";
 import "@tanstack/react-start";
 
 //#region src/pwa.d.ts
@@ -23,7 +23,7 @@ import "@tanstack/react-start";
  *   )
  * }
  */
-declare function SoftrPwaHead(): react4.FunctionComponentElement<react4.FragmentProps>;
+declare function SoftrPwaHead(): react0.FunctionComponentElement<react0.FragmentProps>;
 type PwaPlatform = "ios" | "android" | "desktop";
 type PwaInstall = {
   available: false;

package/dist/pwa.js

@@ -2,9 +2,9 @@ import { logger } from "./logger.js";
 import { fetch } from "./fetch.js";
 import { sessionConfig } from "./auth/config.js";
 import { platformApiUrl } from "./auth/platform.js";
+import { z } from "zod";
 import { Fragment, createElement, useEffect, useState } from "react";
 import { createMiddleware } from "@tanstack/react-start";
-import { z } from "zod";
 
 //#region src/pwa.ts
 const MANIFEST_PATH = "/manifest.webmanifest";

package/dist/softr-config.schema.js

@@ -1,6 +1,10 @@
+import { assert, panic } from "./assertions.js";
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
 import { z } from "zod";
 
 //#region src/softr-config.schema.ts
+const SOFTR_CONFIG_FILE = "softr.json";
 const AccessBehaviour = z.union([
 	z.string(),
 	z.object({
@@ -9,32 +13,49 @@ const AccessBehaviour = z.union([
 	}),
 	z.object({ strategy: z.literal("throw") })
 ], { error: "must be a path like \"/login\", { \"strategy\": \"redirect\", \"to\": \"/login\" } or { \"strategy\": \"throw\" }" });
-const AppPath = z.string().refine((path) => path.startsWith("/") && !path.includes("?") && !path.includes("#") && new URL(path, "https://app.invalid").origin === "https://app.invalid", { error: "must be a path on this app like \"/login\", with no \"?\" or \"#\"" });
-const SoftrConfigSchema = z.object({ auth: z.strictObject({
-	routes: z.strictObject({
-		login: z.strictObject({
-			path: AppPath,
-			redirectParam: z.string()
+const AppPath = z.string().refine((path$1) => path$1.startsWith("/") && !path$1.includes("?") && !path$1.includes("#") && new URL(path$1, "https://app.invalid").origin === "https://app.invalid", { error: "must be a path on this app like \"/login\", with no \"?\" or \"#\"" });
+const SoftrConfigSchema = z.object({
+	auth: z.strictObject({
+		routes: z.strictObject({
+			login: z.strictObject({
+				path: AppPath,
+				redirectParam: z.string()
+			}),
+			resetPassword: z.strictObject({
+				path: AppPath,
+				tokenParam: z.string()
+			}),
+			acceptInvitation: z.strictObject({
+				path: AppPath,
+				tokenParam: z.string()
+			}),
+			magicLink: z.strictObject({
+				path: AppPath,
+				tokenParam: z.string()
+			})
 		}),
-		resetPassword: z.strictObject({
-			path: AppPath,
-			tokenParam: z.string()
-		}),
-		acceptInvitation: z.strictObject({
-			path: AppPath,
-			tokenParam: z.string()
-		}),
-		magicLink: z.strictObject({
-			path: AppPath,
-			tokenParam: z.string()
+		guard: z.strictObject({
+			unauthenticated: AccessBehaviour,
+			forbidden: AccessBehaviour,
+			alreadyAuthenticated: AccessBehaviour
 		})
 	}),
-	guard: z.strictObject({
-		unauthenticated: AccessBehaviour,
-		forbidden: AccessBehaviour,
-		alreadyAuthenticated: AccessBehaviour
-	})
-}) });
+	user: z.strictObject({ properties: z.record(z.string(), z.string()) }).optional()
+});
+function loadSoftrConfig(root) {
+	const file = path.join(root, SOFTR_CONFIG_FILE);
+	assert(existsSync(file), `${SOFTR_CONFIG_FILE} is missing from ${root}`);
+	const source = readFileSync(file, "utf8");
+	let parsed;
+	try {
+		parsed = JSON.parse(source);
+	} catch (error) {
+		panic(`${SOFTR_CONFIG_FILE} is not valid JSON: ${error instanceof Error ? error.message : error}`);
+	}
+	const result = SoftrConfigSchema.safeParse(parsed);
+	if (!result.success) panic(`${SOFTR_CONFIG_FILE} does not match the schema:\n\n${z.prettifyError(result.error)}`);
+	return result.data;
+}
 
 //#endregion
-export { SoftrConfigSchema };
+export { SOFTR_CONFIG_FILE, loadSoftrConfig };

package/dist/visibility/route.js

@@ -1,5 +1,5 @@
-import { ACCESS_REASONS, checkAccess } from "./visibility.js";
 import { softrConfig } from "../softr-config.js";
+import { ACCESS_REASONS, checkAccess } from "./visibility.js";
 import { redirect } from "@tanstack/react-router";
 
 //#region src/visibility/route.ts

package/dist/vite.js

@@ -1,12 +1,8 @@
-import { assert, panic } from "./assertions.js";
-import { SoftrConfigSchema } from "./softr-config.schema.js";
-import { existsSync, readFileSync } from "node:fs";
+import { SOFTR_CONFIG_FILE, loadSoftrConfig } from "./softr-config.schema.js";
 import path from "node:path";
-import { z } from "zod";
 import { pathToFileURL } from "node:url";
 
 //#region src/vite.ts
-const SOFTR_CONFIG_FILE = "softr.json";
 function softr() {
 	return [softrConfig(), editEngine()];
 }
@@ -27,20 +23,6 @@ function softrConfig() {
 		}
 	};
 }
-function loadSoftrConfig(root) {
-	const file = path.join(root, SOFTR_CONFIG_FILE);
-	assert(existsSync(file), `${SOFTR_CONFIG_FILE} is missing from ${root}`);
-	const source = readFileSync(file, "utf8");
-	let parsed;
-	try {
-		parsed = JSON.parse(source);
-	} catch (error) {
-		panic(`${SOFTR_CONFIG_FILE} is not valid JSON: ${error instanceof Error ? error.message : error}`);
-	}
-	const result = SoftrConfigSchema.safeParse(parsed);
-	if (!result.success) panic(`${SOFTR_CONFIG_FILE} does not match the schema:\n\n${z.prettifyError(result.error)}`);
-	return result.data;
-}
 /**
 * The edit engine is provided by the pod runtime rather than an app dependency: it is never in the
 * app's `package.json` and never in its `node_modules`. The pod points `SOFTR_EDIT_ENGINE_DIR` at

package/package.json

@@ -1,16 +1,37 @@
 {
   "name": "@softr/sdk",
-  "version": "0.0.68-alpha.0",
+  "version": "0.0.68-props.0",
   "type": "module",
   "exports": {
-    ".": { "types": "./dist/index.d.ts", "import": "./dist/index.js" },
-    "./client": { "types": "./dist/client.d.ts", "import": "./dist/client.js" },
-    "./server": { "types": "./dist/server.d.ts", "import": "./dist/server.js" },
-    "./vite": { "types": "./dist/vite.d.ts", "import": "./dist/vite.js" }
-  },
-  "bin": { "softr-sdk": "./dist/cli.js" },
-  "files": ["dist", "schema", "skills", "!skills/_artifacts"],
-  "publishConfig": { "access": "public" },
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./client": {
+      "types": "./dist/client.d.ts",
+      "import": "./dist/client.js"
+    },
+    "./server": {
+      "types": "./dist/server.d.ts",
+      "import": "./dist/server.js"
+    },
+    "./vite": {
+      "types": "./dist/vite.d.ts",
+      "import": "./dist/vite.js"
+    }
+  },
+  "bin": {
+    "softr-sdk": "./dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "schema",
+    "skills",
+    "!skills/_artifacts"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
   "scripts": {
     "build": "tsdown",
     "test": "node --import ./src/test-utils/setup.ts --test",
@@ -42,7 +63,9 @@
       "optional": true
     }
   },
-  "keywords": ["tanstack-intent"],
+  "keywords": [
+    "tanstack-intent"
+  ],
   "intent": {
     "version": 1,
     "repo": "@softr/sdk",

package/schema/softr.schema.json

@@ -54,6 +54,19 @@
       },
       "required": ["routes", "guard"],
       "additionalProperties": false
+    },
+    "user": {
+      "type": "object",
+      "description": "The signed-in user.",
+      "properties": {
+        "properties": {
+          "type": "object",
+          "description": "Fields of the users table the app reads as user.properties, keyed by the name the app uses. Each value is a field id. No other field leaves the server.",
+          "additionalProperties": { "type": "string" }
+        }
+      },
+      "required": ["properties"],
+      "additionalProperties": false
     }
   },
   "required": ["auth"],

package/skills/softr-sdk/SKILL.md

@@ -12,7 +12,7 @@ description: >-
 metadata:
   type: core
   library: softr-sdk
-  library_version: 0.0.68-alpha.0
+  library_version: 0.0.68-props.0
 ---
 
 # Softr SDK core

package/skills/softr-sdk/auth/SKILL.md

@@ -19,7 +19,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.68-alpha.0
+  library_version: 0.0.68-props.0
 ---
 
 **Boundary.** `auth` lives on `@softr/sdk/server` and runs only inside a `createServerFn` handler — importing it into a component fails the build.

package/skills/softr-sdk/charts-and-metrics/SKILL.md

@@ -12,7 +12,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.68-alpha.0
+  library_version: 0.0.68-props.0
 ---
 
 **Boundary.** `ds` lives on `@softr/sdk/server` and runs only inside a `createServerFn` handler or a server-side route hook — importing it into a component fails the build. `defineQuery` and every type come from `@softr/sdk` and can be imported anywhere.

package/skills/softr-sdk/current-user/SKILL.md

@@ -4,12 +4,13 @@ description: >-
   Read the signed-in Softr visitor: useCurrentUser and the User type,
   context.user in a route's beforeLoad, and context.user inside a server
   function handler, where Start types it from the app's registered request
-  middleware. Covers the null guest and the generated SoftrUserGroups that
-  narrows group ids to the app's own.
+  middleware. Covers the null guest, the generated SoftrUserGroups that narrows
+  group ids to the app's own, and user.properties, the fields of the visitor's
+  row that softr.json declares.
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.68-alpha.0
+  library_version: 0.0.68-props.0
 ---
 
 # The current user
@@ -31,6 +32,7 @@ type User = {
   email: string
   fullName: string
   userGroupIds: Array<SoftrUserGroupId>   // the app's own group ids
+  properties: SoftrUserProperties         // the aliases softr.json declares
 }
 ```
 
@@ -90,6 +92,25 @@ For every group's name and id, read `docs/user-groups.md`. It lists every group
 
 `user.userGroupIds` and every `customGroups` the SDK accepts take only those ids, so an id the app does not have stops compiling. A new group appears in the list once it exists on the app.
 
+### Fields of the visitor's row: `user.properties`
+
+To read more of the visitor's row in the users table, give each field an alias in `softr.json`, under `user.properties`. The value is the field's id:
+
+```json
+{
+  "user": {
+    "properties": {
+      "plan": "OeIz1",
+      "seats": "1iHKE"
+    }
+  }
+}
+```
+
+`user.properties` then holds exactly those aliases. To read them, see `docs/user-properties.md`.
+
+Attachment and long text fields, and linked record and lookup fields with multiple entries, cannot be properties. Read those with `defineQuery` on the users table. See [record-queries](../record-queries/SKILL.md).
+
 ## References
 
 - [routes-and-visibility/SKILL.md](../routes-and-visibility/SKILL.md): `isAuthorized` narrows `context.user` while applying the route's rule

package/skills/softr-sdk/file-uploads/SKILL.md

@@ -10,7 +10,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.68-alpha.0
+  library_version: 0.0.68-props.0
 ---
 
 **Boundary.** `upload` lives on `@softr/sdk/server` and runs inside server functions. `useFileUpload` and `FileItem` live on `@softr/sdk` and run in components. `FileAttachment` comes from `@softr/sdk` and can be imported anywhere.

package/skills/softr-sdk/formatting/SKILL.md

@@ -10,7 +10,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.68-alpha.0
+  library_version: 0.0.68-props.0
 ---
 
 # Dates, times and numbers

package/skills/softr-sdk/integrations/SKILL.md

@@ -5,12 +5,12 @@ description: >-
   defineIntegration from @softr/sdk declares the action with its integrationId,
   the one HTTP method and endpoint url it allows, and permissions;
   integration.createFetcher from @softr/sdk/server binds it and returns a
-  fetcher function you call with optional params, query, headers, body, and
-  stream for a vendor answer that arrives in pieces. Check res.ok before res.json().
+  fetcher function you call with optional params, query, headers, and body.
+  Check res.ok before res.json().
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.68-alpha.0
+  library_version: 0.0.68-props.0
 ---
 
 **Boundary.** `integration` lives on `@softr/sdk/server` and runs only inside a `createServerFn` handler — importing it into a component fails the build. `defineIntegration` and every type come from `@softr/sdk` and can be imported anywhere.
@@ -164,41 +164,6 @@ const text = body.content.flatMap((block) => (block.type === 'text' && block.tex
 the button is pressed. `claude-opus-5-5` is the current default; `claude-sonnet-5-5` is the cheaper one for a
 short summary.
 
-## Streaming a vendor answer
-
-Some vendor endpoints can send their answer in pieces while they produce it — LLM completions token by token, long exports, live event feeds. The fetcher relays such an answer as it arrives when you pass `stream: true`; the response body is then the vendor's own stream, unchanged.
-
-Decide per call, from the vendor's API docs for that endpoint, not from the integration type or the action:
-
-- The endpoint offers a streaming mode (a `stream: true` body flag, an `Accept: text/event-stream` variant, a chunked response the docs say to read incrementally). Ask the vendor for it in the request and pass `stream: true` to the fetcher.
-- The endpoint answers in one piece, which is the case for most REST calls. Call the fetcher without `stream`; the answer is buffered and `res.json()` works.
-
-Hand a streamed body to the browser as a `Response` from the server function and read it there. The example below streams a completion through the `askClaude` action declared above; the same shape applies to any vendor endpoint that streams.
-
-```ts
-const streamAnswer = createServerFn({ method: 'POST' })
-  .validator((data: { prompt: string }) => data)
-  .handler(async ({ data }) => {
-    const claude = integration.createFetcher(askClaude)
-    const res = await claude({
-      stream: true,
-      headers: { 'Content-Type': 'application/json', 'anthropic-version': '2023-06-01' },
-      body: JSON.stringify({
-        model: 'claude-opus-5-5',
-        max_tokens: 1024,
-        stream: true,
-        messages: [{ role: 'user', content: data.prompt }],
-      }),
-    })
-    if (!res.ok) throw new Error(`AI error: ${res.status} ${await res.text()}`)
-    return new Response(res.body, { headers: { 'Content-Type': 'text/event-stream' } })
-  })
-```
-
-On the client, call the server function's URL with `fetch` and read `response.body` with a `ReadableStream` reader; each chunk arrives in the vendor's own format, for an event stream one or more `event:`/`data:` frames. Use `stream: true` only together with a request that asks the vendor to stream: without it the vendor answers in one piece, which still works but gains nothing.
-
-`stream: true` is not available for REST_API integrations; those always answer in one piece.
-
 ## Base URLs by integration type
 
 Match the `integrationType` from the attached integrations section to find the base URL:
@@ -270,5 +235,3 @@ If the API the user needs is not in the table above, call it directly from a ser
 **Not checking `res.ok`.** The fetcher returns the proxied response as-is. A 4xx or 5xx from the third-party API is not thrown — call `res.ok` or `res.status` before calling `res.json()`.
 
 **Reusing one action for a different endpoint.** An action authorizes one `method` and one endpoint `url`. A different endpoint belongs to a different action — declare one for it, with its own audience.
-
-**Reading a streamed body with `res.json()`.** With `stream: true` the body is an event stream, not one JSON document. Return `res.body` in a `Response` or read it with a stream reader; `res.json()` waits for the end and then fails to parse.

package/skills/softr-sdk/mcp/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.68-alpha.0
+  library_version: 0.0.68-props.0
 ---
 
 **Boundary.** `softrMcpMiddleware` lives on `@softr/sdk` and is registered once, in `src/start.ts`. The actions you hand it are the same `defineQuery` / `defineMutation` values the app's own pages use — declared wherever they already live, not duplicated for MCP.

package/skills/softr-sdk/pwa/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.68-alpha.0
+  library_version: 0.0.68-props.0
 ---
 
 # Installing the app

package/skills/softr-sdk/record-mutations/SKILL.md

@@ -11,7 +11,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.68-alpha.0
+  library_version: 0.0.68-props.0
 ---
 
 **Boundary.** `ds` lives on `@softr/sdk/server` and runs only inside a `createServerFn` handler — importing it into a component fails the build. `defineMutation` and every type come from `@softr/sdk` and can be imported anywhere.

package/skills/softr-sdk/record-queries/SKILL.md

@@ -13,7 +13,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.68-alpha.0
+  library_version: 0.0.68-props.0
 ---
 
 **Boundary.** `ds` lives on `@softr/sdk/server` and runs only inside a `createServerFn` handler or a server-side route hook — importing it into a component fails the build. The same holds for any helper that calls `ds`: declare it inside the handler. A function at module level that calls `ds` keeps the server-only import in the browser bundle, and every page stops loading until it moves. `defineQuery` and every type come from `@softr/sdk` and can be imported anywhere.

package/skills/softr-sdk/region-visibility/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.68-alpha.0
+  library_version: 0.0.68-props.0
 ---
 
 **Boundary.** `Audience` and `defineVisibility` come from `@softr/sdk` and work anywhere.

package/skills/softr-sdk/routes-and-visibility/SKILL.md

@@ -13,7 +13,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.68-alpha.0
+  library_version: 0.0.68-props.0
 ---
 
 **Boundary.** `defineVisibility`, the access functions and the error predicates come from `@softr/sdk` and work anywhere.

package/skills/softr-sdk/workflows/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.68-alpha.0
+  library_version: 0.0.68-props.0
 ---
 
 **Boundary.** `workflow` lives on `@softr/sdk/server` and runs only inside a `createServerFn` handler — importing it into a component fails the build. `defineWorkflow` and every type come from `@softr/sdk` and can be imported anywhere.