@softr/sdk 0.0.68-alpha.2 → 0.0.68-props.1

package/dist/assertions.js

@@ -59,4 +59,4 @@ function throwAtCaller(f, ex) {
 }
 
 //#endregion
-export { assert, panic, requireDefined, softAssert };
+export { assert, panic, requireDefined, softAssert, throwAtCaller };

package/dist/auth/isomorphic.d.ts

@@ -2,9 +2,9 @@ import { User } from "./user.js";
 import { Formatting } from "../formatting.js";
 import { Permissions } from "./permissions.js";
 import { SoftrContext } from "./context.js";
-import * as react0 from "react";
+import * as react6 from "react";
 import { ReactNode } from "react";
-import * as _tanstack_react_start0 from "@tanstack/react-start";
+import * as _tanstack_react_start1 from "@tanstack/react-start";
 
 //#region src/auth/isomorphic.d.ts
 
@@ -21,7 +21,7 @@ import * as _tanstack_react_start0 from "@tanstack/react-start";
  *   requestMiddleware: [softrAuthMiddleware()],
  * }))
  */
-declare function softrAuthMiddleware(): _tanstack_react_start0.RequestMiddlewareAfterServer<{}, readonly [_tanstack_react_start0.RequestMiddlewareAfterServer<{}, undefined, undefined>, _tanstack_react_start0.RequestMiddlewareAfterServer<{}, undefined, undefined>], {
+declare function softrAuthMiddleware(): _tanstack_react_start1.RequestMiddlewareAfterServer<{}, readonly [_tanstack_react_start1.RequestMiddlewareAfterServer<{}, undefined, undefined>, _tanstack_react_start1.RequestMiddlewareAfterServer<{}, undefined, undefined>], {
   user: User | null;
   permissions: Permissions;
   formatting: Formatting;
@@ -35,7 +35,7 @@ declare function softrAuthMiddleware(): _tanstack_react_start0.RequestMiddleware
  *   beforeLoad: async () => await getSoftrContext(),
  * })
  */
-declare const getSoftrContext: _tanstack_react_start0.OptionalFetcher<undefined, undefined, Promise<SoftrContext>>;
+declare const getSoftrContext: _tanstack_react_start1.OptionalFetcher<undefined, undefined, Promise<SoftrContext>>;
 /**
  * The context to hand `createRouter`, before any request has resolved one.
  *
@@ -83,7 +83,7 @@ type AuthOptions = {
  *   staleTime: 60_000,
  * })
  */
-declare const getAuthSettings: _tanstack_react_start0.OptionalFetcher<undefined, undefined, Promise<AuthOptions>>;
+declare const getAuthSettings: _tanstack_react_start1.OptionalFetcher<undefined, undefined, Promise<AuthOptions>>;
 /**
  * Makes the auth options readable with {@link useAuthSettings} anywhere below.
  *
@@ -103,7 +103,7 @@ declare function AuthSettingsProvider({
 }: {
   value: AuthOptions;
   children?: ReactNode;
-}): react0.JSX.Element;
+}): react6.JSX.Element;
 /**
  * Which ways in this app offers. Requires an {@link AuthSettingsProvider}
  * above it.

package/dist/auth/platform.d.ts

@@ -1,4 +1,3 @@
-import "./user.js";
 import "./context.js";
 import { z } from "zod";
 

package/dist/auth/platform.js

@@ -1,8 +1,8 @@
-import { panic } from "../assertions.js";
+import { assert, panic } from "../assertions.js";
 import { fetch } from "../fetch.js";
 import { permissionsSchema } from "./permissions.js";
 import { sessionConfig } from "./config.js";
-import { userSchema } from "./user.js";
+import { softrConfig } from "../softr-config.js";
 import { z } from "zod";
 
 //#region src/auth/platform.ts
@@ -33,10 +33,30 @@ const authSettingsSchema = z.object({
 	sso: z.object({ type: z.enum(["SAML", "OPEN_ID"]).nullable() }).nullable()
 });
 function makePlatform(applicationId) {
+	const aliases = Object.entries(softrConfig().user?.properties ?? {});
+	const withAttributes = aliases.length > 0 ? "?includeAttributes=true" : "";
+	const userSchema = z.object({
+		id: z.string(),
+		email: z.string(),
+		fullName: z.string(),
+		userGroupIds: z.array(z.string()),
+		attributes: z.record(z.string(), z.unknown()).optional()
+	}).transform(({ attributes,...identity }) => {
+		const properties = {};
+		for (const [alias, field] of aliases) {
+			assert(attributes !== void 0, "The signed-in user came back without their properties.");
+			assert(Object.hasOwn(attributes, field), `softr.json user.properties.${alias} names the field "${field}", which the users table does not have.`);
+			properties[alias] = attributes[field];
+		}
+		return {
+			...identity,
+			properties
+		};
+	});
 	return {
 		authSettings: () => request(`/v1/vibe/applications/${applicationId}/users/auth-settings`, { method: "GET" }, authSettingsSchema),
 		session: async (token) => {
-			const result = await request(`/v1/vibe/applications/${applicationId}/users/session`, {
+			const result = await request(`/v1/vibe/applications/${applicationId}/users/session${withAttributes}`, {
 				method: "GET",
 				token
 			}, z.object({
@@ -46,7 +66,7 @@ function makePlatform(applicationId) {
 			if (result.status === 404) panic(`Application ${applicationId} not found. Check SOFTR_APPLICATION_ID.`);
 			return result;
 		},
-		tokens: (credentials) => request(`/v1/vibe/applications/${applicationId}/users/tokens`, {
+		tokens: (credentials) => request(`/v1/vibe/applications/${applicationId}/users/tokens${withAttributes}`, {
 			method: "POST",
 			json: credentials
 		}, z.object({
@@ -69,7 +89,7 @@ function makePlatform(applicationId) {
 			method: "POST",
 			json: { email }
 		}, z.null()),
-		signInWithCode: (credentials) => request(`/v1/vibe/applications/${applicationId}/users/tokens/with-code`, {
+		signInWithCode: (credentials) => request(`/v1/vibe/applications/${applicationId}/users/tokens/with-code${withAttributes}`, {
 			method: "POST",
 			json: credentials
 		}, z.object({
@@ -88,7 +108,7 @@ function makePlatform(applicationId) {
 				challengeToken: z.string()
 			}).nullish()
 		})),
-		signInWithGoogle: (body) => request(`/v1/vibe/applications/${applicationId}/users/tokens/with-google`, {
+		signInWithGoogle: (body) => request(`/v1/vibe/applications/${applicationId}/users/tokens/with-google${withAttributes}`, {
 			method: "POST",
 			json: body
 		}, z.object({
@@ -107,7 +127,7 @@ function makePlatform(applicationId) {
 				challengeToken: z.string()
 			}).nullish()
 		})),
-		signInWithMagicLink: (body) => request(`/v1/vibe/applications/${applicationId}/users/tokens/with-magic-link`, {
+		signInWithMagicLink: (body) => request(`/v1/vibe/applications/${applicationId}/users/tokens/with-magic-link${withAttributes}`, {
 			method: "POST",
 			json: body
 		}, z.object({
@@ -134,7 +154,7 @@ function makePlatform(applicationId) {
 			method: "POST",
 			json: body
 		}, z.object({ email: z.string() })),
-		setPassword: (body) => request(`/v1/vibe/applications/${applicationId}/users/set-password`, {
+		setPassword: (body) => request(`/v1/vibe/applications/${applicationId}/users/set-password${withAttributes}`, {
 			method: "POST",
 			json: body
 		}, z.object({
@@ -157,7 +177,7 @@ function makePlatform(applicationId) {
 			method: "POST",
 			json: body
 		}, z.null()),
-		signUpWithCode: (body) => request(`/v1/vibe/applications/${applicationId}/users/sign-up/with-code`, {
+		signUpWithCode: (body) => request(`/v1/vibe/applications/${applicationId}/users/sign-up/with-code${withAttributes}`, {
 			method: "POST",
 			json: body
 		}, z.object({
@@ -176,7 +196,7 @@ function makePlatform(applicationId) {
 				challengeToken: z.string()
 			}).nullish()
 		})),
-		signUpWithPassword: (body) => request(`/v1/vibe/applications/${applicationId}/users/sign-up/with-password`, {
+		signUpWithPassword: (body) => request(`/v1/vibe/applications/${applicationId}/users/sign-up/with-password${withAttributes}`, {
 			method: "POST",
 			json: body
 		}, z.object({
@@ -202,7 +222,7 @@ function makePlatform(applicationId) {
 			otpauthUri: z.string(),
 			qrPngBase64: z.string()
 		})),
-		authenticatorSetupComplete: (token, code) => request(`/v1/vibe/applications/${applicationId}/users/authenticator/setup/complete`, {
+		authenticatorSetupComplete: (token, code) => request(`/v1/vibe/applications/${applicationId}/users/authenticator/setup/complete${withAttributes}`, {
 			method: "POST",
 			token,
 			json: { code }
@@ -214,7 +234,7 @@ function makePlatform(applicationId) {
 			}),
 			backupCodes: z.array(z.string())
 		})),
-		authenticatorSetupDismiss: (token) => request(`/v1/vibe/applications/${applicationId}/users/authenticator/setup/dismiss`, {
+		authenticatorSetupDismiss: (token) => request(`/v1/vibe/applications/${applicationId}/users/authenticator/setup/dismiss${withAttributes}`, {
 			method: "POST",
 			token
 		}, z.object({
@@ -233,7 +253,7 @@ function makePlatform(applicationId) {
 				challengeToken: z.string()
 			}).nullish()
 		})),
-		authenticatorVerify: (token, body) => request(`/v1/vibe/applications/${applicationId}/users/authenticator/totp/verify`, {
+		authenticatorVerify: (token, body) => request(`/v1/vibe/applications/${applicationId}/users/authenticator/totp/verify${withAttributes}`, {
 			method: "POST",
 			token,
 			json: body

package/dist/auth/session.js

@@ -2,10 +2,10 @@ import { readRequestCookies, serializeCookie, writeCookies } from "../cookies.js
 import { permissionsSchema } from "./permissions.js";
 import { sessionConfig } from "./config.js";
 import { userSchema } from "./user.js";
+import { z } from "zod";
 import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { getRequestProtocol } from "@tanstack/react-start/server";
-import { z } from "zod";
 
 //#region src/auth/session.ts
 const SESSION_TOKEN = "session_token";

package/dist/auth/user.d.ts

@@ -13,12 +13,19 @@ interface SoftrUserGroups {}
 type SoftrUserGroupId = SoftrUserGroups extends {
   ids: infer Id extends string;
 } ? Id : string;
+/**
+ * The fields of the visitor's row that softr.json declares under
+ * `user.properties`, keyed by their aliases. The app's generated types declare
+ * it.
+ */
+interface SoftrUserProperties {}
 /** The signed-in visitor. */
 type User = {
   id: string;
   email: string;
   fullName: string;
   userGroupIds: Array<SoftrUserGroupId>;
+  properties: SoftrUserProperties;
 };
 //#endregion
-export { SoftrUserGroupId, SoftrUserGroups, User };
+export { SoftrUserGroupId, SoftrUserGroups, SoftrUserProperties, User };

package/dist/auth/user.js

@@ -5,7 +5,8 @@ const userSchema = z.object({
 	id: z.string(),
 	email: z.string(),
 	fullName: z.string(),
-	userGroupIds: z.array(z.string())
+	userGroupIds: z.array(z.string()),
+	properties: z.record(z.string(), z.unknown())
 });
 
 //#endregion

package/dist/cli.js

@@ -1,12 +1,14 @@
 #!/usr/bin/env node
 import { version } from "./package.js";
 import { requireDefined } from "./assertions.js";
+import { SoftrConfigError, loadSoftrConfig } from "./softr-config.schema.js";
 import { fetchSoftrEnvInput, metadataSourceFromEnv } from "./codegen/fetch-metadata.js";
+import { renderUserPropertiesDoc } from "./codegen/datasource-docs.js";
 import { renderUserGroupsDoc } from "./codegen/user-groups.js";
 import { renderSoftrEnv } from "./codegen/softr-env.js";
 import { writeIfChanged } from "./codegen/write-if-changed.js";
 import { writeDatasourceDocs } from "./codegen/write-datasource-docs.js";
-import { writeFileSync } from "node:fs";
+import { rmSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { parseArgs } from "node:util";
 
@@ -14,9 +16,10 @@ import { parseArgs } from "node:util";
 const OUTPUT = "softr-env.d.ts";
 const DOCS_DIR = "docs/datasources";
 const USER_GROUPS_DOC = "docs/user-groups.md";
+const USER_PROPERTIES_DOC = "docs/user-properties.md";
 async function generate({ json }) {
 	if (json) console.info = console.error;
-	const input = await fetchSoftrEnvInput(metadataSourceFromEnv());
+	const input = await fetchSoftrEnvInput(metadataSourceFromEnv(), loadSoftrConfig(process.cwd()).user?.properties ?? {});
 	writeFileSync(path.resolve(process.cwd(), OUTPUT), renderSoftrEnv(input, version), "utf8");
 	const report = writeDocs(input);
 	if (json) {
@@ -26,18 +29,30 @@ async function generate({ json }) {
 	printReport(report);
 }
 function writeDocs(input) {
+	if (input.users === null) rmSync(path.resolve(process.cwd(), USER_PROPERTIES_DOC), { force: true });
 	const datasourceDocs = writeDatasourceDocs(input.datasources, path.resolve(process.cwd(), DOCS_DIR));
 	return {
 		types: OUTPUT,
-		docs: [{
-			subject: "datasources",
-			path: `${DOCS_DIR}/README.md`,
-			changed: datasourceDocs.changed
-		}, {
-			subject: "user groups",
-			path: USER_GROUPS_DOC,
-			changed: writeIfChanged(path.resolve(process.cwd(), USER_GROUPS_DOC), renderUserGroupsDoc(input.userGroups))
-		}],
+		docs: [
+			{
+				subject: "datasources",
+				path: `${DOCS_DIR}/README.md`,
+				changed: datasourceDocs.changed
+			},
+			{
+				subject: "user groups",
+				path: USER_GROUPS_DOC,
+				changed: writeIfChanged(path.resolve(process.cwd(), USER_GROUPS_DOC), renderUserGroupsDoc(input.userGroups))
+			},
+			...input.users === null ? [] : [{
+				subject: "user properties",
+				path: USER_PROPERTIES_DOC,
+				changed: writeIfChanged(path.resolve(process.cwd(), USER_PROPERTIES_DOC), renderUserPropertiesDoc(input.users, {
+					datasources: new Map(input.datasources.map((d) => [d.id, d])),
+					fileNames: datasourceDocs.fileNames
+				}))
+			}]
+		],
 		datasources: input.datasources.map(({ id, name }) => ({
 			id,
 			name,
@@ -61,7 +76,18 @@ const { positionals, values } = parseArgs({
 	} }
 });
 const [command] = positionals;
-if (command === "generate") await generate({ json: values.json });
+if (command === "generate") try {
+	await generate({ json: values.json });
+} catch (error) {
+	if (!values.json) throw error;
+	const kind = error instanceof SoftrConfigError ? "softr-config" : "other";
+	const message = error instanceof Error ? error.message : String(error);
+	process.stdout.write(`${JSON.stringify({ error: {
+		kind,
+		message
+	} })}\n`);
+	process.exit(1);
+}
 else {
 	console.error(command ? `softr-sdk: unknown command '${command}'` : "softr-sdk: no command given");
 	console.error("usage: softr-sdk generate [--json]");

package/dist/codegen/datasource-docs.js

@@ -18,6 +18,97 @@ function renderDatasourceDoc(datasource, context) {
 		...renderExamples(datasource, context.datasources)
 	].join("\n");
 }
+function renderUserPropertiesDoc(users, context) {
+	const aliases = Object.entries(users.properties);
+	assert(aliases.length > 0, "Expected user properties to document, but got none");
+	const [first] = requireDefined(aliases[0]);
+	const registered = linkedDatasource(users.tableId, context.datasources);
+	const types = /* @__PURE__ */ new Set();
+	const sampled = aliases.filter(([, field]) => {
+		const type = fieldTypeLiteral(field);
+		if (types.has(type)) return false;
+		types.add(type);
+		return true;
+	});
+	return [
+		"# User properties",
+		"",
+		`Users datasource: ${displayName(users.name) || users.tableId}` + (registered === void 0 ? "" : `  \nRegistered as: [${datasourceLabel(registered)}](./datasources/${requireDefined(context.fileNames.get(registered.id))}) (${registered.id})`),
+		"",
+		"> This document is generated automatically when softr.json's `user.properties` or the users table changes.",
+		"",
+		"Each alias below is declared in softr.json under `user.properties`, and read as `user.properties.<alias>`.",
+		"",
+		"## Field reference",
+		"",
+		...aliases.flatMap(([alias, field]) => {
+			const linkedId = option(field.options, "linkedTableId");
+			const linked = typeof linkedId === "string" ? linkedDatasource(linkedId, context.datasources) : void 0;
+			return [
+				`### ${alias}`,
+				"",
+				`- Field: ${displayName(field.name)}`,
+				`- ID: ${field.id}`,
+				`- Type: ${fieldTypeLiteral(field).slice(1, -1)}`,
+				...optionLines(field),
+				...choiceLines(field),
+				...typeof linkedId !== "string" ? [] : linked === void 0 ? [`- Links to: ${linkedId}, not registered`] : [`- Links to: [${datasourceLabel(linked)}](./datasources/${requireDefined(context.fileNames.get(linked.id))}) (${linked.id})`],
+				""
+			];
+		}),
+		"## Read shape",
+		"",
+		"In a component:",
+		"",
+		"```tsx",
+		"import { useCurrentUser } from '@softr/sdk'",
+		"",
+		"const user = useCurrentUser()",
+		"if (user === null) return null",
+		"",
+		...sampled.map(([alias, field]) => `user.properties.${alias} // ${fieldTypeLiteral(field).slice(1, -1)}`),
+		"```",
+		"",
+		"In a route's `beforeLoad`, to send a visitor elsewhere. It guards navigation only, not data:",
+		"",
+		"```tsx",
+		"import { createFileRoute, redirect } from '@tanstack/react-router'",
+		"import { assertRouteAccess, defineVisibility } from '@softr/sdk'",
+		"",
+		"const visibility = defineVisibility({ userGroupTypes: ['LOGGED_IN_USERS'] })",
+		"",
+		"export const Route = createFileRoute('/example')({",
+		"  beforeLoad: (opts) => {",
+		"    assertRouteAccess(visibility, opts)",
+		`    if (opts.context.user.properties.${first} == null) throw redirect({ to: '/' })`,
+		"  },",
+		"})",
+		"```",
+		"",
+		"In a server function, called from a route's `loader`. The handler checks the visitor itself:",
+		"",
+		"```tsx",
+		"import { createFileRoute } from '@tanstack/react-router'",
+		"import { createServerFn } from '@tanstack/react-start'",
+		"",
+		`const get${pascalCase(first)} = createServerFn().handler(async ({ context }) => {`,
+		"  if (!context.user) throw new Error('Not signed in')",
+		`  return context.user.properties.${first}`,
+		"})",
+		"",
+		"export const Route = createFileRoute('/example')({",
+		`  loader: () => get${pascalCase(first)}(),`,
+		"  component: Example,",
+		"})",
+		"",
+		"function Example() {",
+		`  const ${first} = Route.useLoaderData()`,
+		"  // ...",
+		"}",
+		"```",
+		""
+	].join("\n");
+}
 /** Two trailing spaces are a markdown hard break, which keeps the block one paragraph. */
 function summary(datasource, context) {
 	const lines = [`Datasource ID: ${datasource.id}`];
@@ -315,4 +406,4 @@ function words(value) {
 }
 
 //#endregion
-export { renderDatasourceDoc, renderDatasourceIndex };
+export { renderDatasourceDoc, renderDatasourceIndex, renderUserPropertiesDoc };

package/dist/codegen/datasource-types.js

@@ -251,6 +251,21 @@ function linkedRecord(options, context) {
 	if (linked === void 0 || linked.primaryFieldId === "") return "LinkedRecord";
 	return `LinkedRecord<NonNullable<${`${nameOf(linked.id, context)}Read[${quote(linked.primaryFieldId)}]`}>>`;
 }
+/** `SoftrUserProperties`, each alias typed as its field reads. */
+function renderUserProperties(properties, datasources) {
+	const context = {
+		datasources: byId(datasources),
+		names: typeNames(datasources)
+	};
+	return [
+		"interface SoftrUserProperties {",
+		...Object.entries(properties).map(([alias, field]) => indent(readMember({
+			...field,
+			id: alias
+		}, context))),
+		"}"
+	].join("\n");
+}
 function renderRegistry(datasources, context) {
 	return [
 		"interface SoftrDatasources {",
@@ -494,4 +509,4 @@ function indent(block) {
 }
 
 //#endregion
-export { choiceEntries, fieldTypeLiteral, isWritable, linkedDatasource, option, readExample, renderDatasourceTypes, resolvedShape, scalarExample, underlyingType };
+export { choiceEntries, fieldTypeLiteral, isWritable, linkedDatasource, option, readExample, renderDatasourceTypes, renderUserProperties, resolvedShape, scalarExample, underlyingType };

package/dist/codegen/fetch-metadata.js

@@ -1,5 +1,6 @@
 import { panic } from "../assertions.js";
 import { fetch } from "../fetch.js";
+import { panicConfig } from "../softr-config.schema.js";
 
 //#region src/codegen/fetch-metadata.ts
 function metadataSourceFromEnv(env = process.env) {
@@ -17,27 +18,44 @@ function metadataSourceFromEnv(env = process.env) {
 		token: env.SOFTR_STUDIO_TOKEN
 	};
 }
-async function fetchSoftrEnvInput(source) {
+async function fetchSoftrEnvInput(source, aliases) {
 	const { studioApiUrl, datasourceApiUrl, applicationId, token } = source;
 	const [registered, userGroups] = await Promise.all([apiFetch(`${studioApiUrl}/v1/applications/${applicationId}/datasources`, token), apiFetch(`${studioApiUrl}/v1/applications/${applicationId}/access-control/user-groups`, token)]);
+	const datasources = await Promise.all(registered.map(async ({ name, datasource }) => {
+		const metadata = await apiFetch(`${datasourceApiUrl}/v1/datasource/vibe/studio/applications/${applicationId}/datasources/${datasource.id}/metadata`, token);
+		return {
+			...metadata,
+			id: datasource.id,
+			tableId: metadata.id,
+			name
+		};
+	}));
+	let users = null;
+	if (Object.keys(aliases).length > 0) {
+		const metadata = await apiFetch(`${datasourceApiUrl}/v1/datasource/vibe/studio/applications/${applicationId}/datasources/user-connection/metadata`, token, () => panic("softr.json declares user.properties, but this app has no users table."));
+		users = {
+			tableId: metadata.id,
+			name: metadata.name,
+			properties: {}
+		};
+		for (const [alias, fieldId] of Object.entries(aliases)) {
+			const field = metadata.fields.find(({ id }) => id === fieldId) ?? panicConfig(`softr.json user.properties.${alias} names "${fieldId}", which is not a field of the users table.`);
+			if (field.type === "ATTACHMENT" || field.type === "LONG_TEXT" || field.allowMultipleEntries && (field.type === "LINKED_RECORD" || field.type === "LOOKUP")) panicConfig(`softr.json user.properties.${alias} names "${field.name}", a ${field.allowMultipleEntries ? "multiple " : ""}${field.type} field, which can be too big to read with the signed-in user. Remove it, and read it with defineQuery on the users table instead.`);
+			users.properties[alias] = field;
+		}
+	}
 	return {
-		datasources: await Promise.all(registered.map(async ({ name, datasource }) => {
-			const metadata = await apiFetch(`${datasourceApiUrl}/v1/datasource/vibe/studio/applications/${applicationId}/datasources/${datasource.id}/metadata`, token);
-			return {
-				...metadata,
-				id: datasource.id,
-				tableId: metadata.id,
-				name
-			};
-		})),
-		userGroups
+		datasources,
+		userGroups,
+		users
 	};
 }
-async function apiFetch(url, token) {
+async function apiFetch(url, token, notFound = () => panic(`${url} answered 404`)) {
 	const response = await fetch(url, { headers: {
 		accept: "application/json",
 		Authorization: `Bearer ${token}`
 	} }).catch(() => panic(`Could not reach ${url}`));
+	if (response.status === 404) return notFound();
 	if (!response.ok) panic(`${url} answered ${response.status}`);
 	return await response.json();
 }

package/dist/codegen/softr-env.js

@@ -1,4 +1,4 @@
-import { renderDatasourceTypes } from "./datasource-types.js";
+import { renderDatasourceTypes, renderUserProperties } from "./datasource-types.js";
 import { renderUserGroups } from "./user-groups.js";
 
 //#region src/codegen/softr-env.ts
@@ -15,6 +15,7 @@ function renderSoftrEnv(input, sdkVersion) {
 		indent(interfaces),
 		"",
 		indent(renderUserGroups(input.userGroups)),
+		...input.users === null ? [] : ["", indent(renderUserProperties(input.users.properties, input.datasources))],
 		"}",
 		""
 	].join("\n");

package/dist/cookies.js

@@ -1,3 +1,4 @@
+import { softAssert } from "./assertions.js";
 import { getRequestHeader, getResponseHeaders, setResponseHeader } from "@tanstack/react-start/server";
 
 //#region src/cookies.ts
@@ -38,9 +39,16 @@ const USER_TIMEZONE_COOKIE = "user-timezone";
 function readUserTimezone() {
 	return readRequestCookies()[USER_TIMEZONE_COOKIE] ?? null;
 }
+/** What browsers keep of one cookie's name and value. They drop a larger one silently. */
+const COOKIE_MAX_BYTES = 4096;
 function writeCookies(cookies) {
-	if (cookies.length === 0) return;
-	setResponseHeader("Set-Cookie", [...getResponseHeaders().getSetCookie(), ...cookies]);
+	const written = cookies.filter((cookie) => {
+		const size = cookie.split(";")[0].length;
+		softAssert(size <= COOKIE_MAX_BYTES, () => `The ${cookie.slice(0, cookie.indexOf("="))} cookie is ${size} bytes, over the ${COOKIE_MAX_BYTES} a browser keeps. It was not written.`);
+		return size <= COOKIE_MAX_BYTES;
+	});
+	if (written.length === 0) return;
+	setResponseHeader("Set-Cookie", [...getResponseHeaders().getSetCookie(), ...written]);
 }
 
 //#endregion

package/dist/core/integration.d.ts

@@ -7,13 +7,6 @@ interface IntegrationFetchInit {
   headers?: Record<string, string>;
   body?: string;
   signal?: AbortSignal;
-  /**
-   * Relay the vendor's answer as it is produced instead of waiting for all of it — for any endpoint
-   * that streams, such as an LLM completion requested with `"stream": true`. The returned `Response`
-   * body is then the vendor's own stream, readable chunk by chunk. A vendor that answers in one piece
-   * still works.
-   */
-  stream?: boolean;
 }
 declare function integrationCreateFetcher(action: IntegrationAction): (init?: IntegrationFetchInit) => Promise<Response>;
 declare const integration: {

package/dist/core/integration.js

@@ -3,16 +3,15 @@ import { readSessionToken } from "../auth/session.js";
 import { dsUrl, refererHeader } from "../datasource/record.js";
 
 //#region src/core/integration.ts
-const EVENT_STREAM = "text/event-stream";
-async function integrationFetch(action, { params, query, headers = {}, body, signal, stream = false } = {}) {
+async function integrationFetch(action, { params, query, headers = {}, body, signal } = {}) {
 	if (signal?.aborted) throw signal.reason ?? new DOMException("The operation was aborted.", "AbortError");
 	const payload = {
 		method: action.resource.method,
 		url: buildUrl(action.resource.url, params, query),
-		headers: stream ? withAcceptEventStream(headers) : headers
+		headers
 	};
 	if (body !== void 0) payload.body = body;
-	return fetch(`${dsUrl(action.id)}/${stream ? "proxy/stream" : "proxy"}`, {
+	return fetch(`${dsUrl(action.id)}/proxy`, {
 		method: "POST",
 		headers: {
 			"Content-Type": "application/json",
@@ -31,12 +30,6 @@ function buildUrl(template, params, query) {
 	if (query !== void 0 && Object.keys(query).length > 0) url += `?${new URLSearchParams(query).toString()}`;
 	return url;
 }
-function withAcceptEventStream(headers) {
-	return Object.keys(headers).some((name) => name.toLowerCase() === "accept") ? headers : {
-		...headers,
-		Accept: EVENT_STREAM
-	};
-}
 function integrationCreateFetcher(action) {
 	return (init) => integrationFetch(action, init);
 }

package/dist/default-error-overlay.d.ts

@@ -1,4 +1,4 @@
-import * as react6 from "react";
+import * as react5 from "react";
 
 //#region src/default-error-overlay.d.ts
 type Props = {
@@ -8,6 +8,6 @@ type Props = {
 declare function DefaultErrorOverlay({
   error,
   reset
-}: Props): react6.JSX.Element;
+}: Props): react5.JSX.Element;
 //#endregion
 export { DefaultErrorOverlay };

package/dist/formatting.d.ts

@@ -1,6 +1,6 @@
+import { z } from "zod";
 import * as react0 from "react";
 import { ReactNode } from "react";
-import { z } from "zod";
 
 //#region src/formatting.d.ts
 type FixedDateFormat = "FRIENDLY" | "DD-MM-YYYY" | "MM-DD-YYYY" | "YYYY-MM-DD";

package/dist/formatting.js

@@ -1,6 +1,6 @@
 import { logger } from "./logger.js";
-import { Fragment, createContext, createElement, useContext, useMemo, useSyncExternalStore } from "react";
 import { z } from "zod";
+import { Fragment, createContext, createElement, useContext, useMemo, useSyncExternalStore } from "react";
 import { rootRouteId, useRouteContext } from "@tanstack/react-router";
 
 //#region src/formatting.ts

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { SoftrUserGroupId, SoftrUserGroups, User } from "./auth/user.js";
+import { SoftrUserGroupId, SoftrUserGroups, SoftrUserProperties, User } from "./auth/user.js";
 import { ActionPermissions, SoftrDatasources, defineIntegration, defineMutation, defineQuery, defineWorkflow } from "./action.js";
 import { FileAttachment } from "./core/file-upload.js";
 import { FileItem, useFileUpload } from "./core/use-file-upload.js";
@@ -14,4 +14,4 @@ import { useUserTimezone } from "./timezone.js";
 import { PwaInstall, PwaPlatform, SoftrPwaHead, usePwaInstall } from "./pwa.js";
 import { DefaultErrorOverlay } from "./default-error-overlay.js";
 import { Audience } from "./visibility/audience.js";
-export { type ActionPermissions, Audience, type AuthOptions, type AuthSettings, AuthSettingsProvider, type DateOptions, type DateParts, type DateSeparator, type DateValue, DefaultErrorOverlay, type FileAttachment, type FileItem, type FixedDateFormat, FormattedDate, type Formatting, FormattingScope, type PwaInstall, type PwaPlatform, type SoftrContext, type SoftrDatasources, SoftrPwaHead, type SoftrUserGroupId, type SoftrUserGroups, type User, type WeekDay, assertRouteAccess, checkAccess, defineIntegration, defineMutation, defineQuery, defineVisibility, defineWorkflow, formatDate, formatDateTime, formatNumber, getAuthSettings, getSoftrContext, guardRoute, initialSoftrContext, isAccessError, isAlreadyAuthenticatedError, isAuthorized, isForbiddenError, isUnauthenticatedError, softrAuthMiddleware, softrMcpMiddleware, toReturnPath, useAuthSettings, useCurrentUser, useFileUpload, useFormatting, usePwaInstall, useUserTimezone };
+export { type ActionPermissions, Audience, type AuthOptions, type AuthSettings, AuthSettingsProvider, type DateOptions, type DateParts, type DateSeparator, type DateValue, DefaultErrorOverlay, type FileAttachment, type FileItem, type FixedDateFormat, FormattedDate, type Formatting, FormattingScope, type PwaInstall, type PwaPlatform, type SoftrContext, type SoftrDatasources, SoftrPwaHead, type SoftrUserGroupId, type SoftrUserGroups, type SoftrUserProperties, type User, type WeekDay, assertRouteAccess, checkAccess, defineIntegration, defineMutation, defineQuery, defineVisibility, defineWorkflow, formatDate, formatDateTime, formatNumber, getAuthSettings, getSoftrContext, guardRoute, initialSoftrContext, isAccessError, isAlreadyAuthenticatedError, isAuthorized, isForbiddenError, isUnauthenticatedError, softrAuthMiddleware, softrMcpMiddleware, toReturnPath, useAuthSettings, useCurrentUser, useFileUpload, useFormatting, usePwaInstall, useUserTimezone };

package/dist/mcp.d.ts

@@ -1,5 +1,5 @@
 import { DatasourceAction } from "./action.js";
-import * as _tanstack_react_start4 from "@tanstack/react-start";
+import * as _tanstack_react_start0 from "@tanstack/react-start";
 
 //#region src/mcp.d.ts
 
@@ -31,6 +31,6 @@ type SoftrMcpOptions = {
  *   ],
  * }))
  */
-declare function softrMcpMiddleware(options?: SoftrMcpOptions): _tanstack_react_start4.RequestMiddlewareAfterServer<{}, undefined, undefined>;
+declare function softrMcpMiddleware(options?: SoftrMcpOptions): _tanstack_react_start0.RequestMiddlewareAfterServer<{}, undefined, undefined>;
 //#endregion
 export { softrMcpMiddleware };

package/dist/mcp.js

@@ -2,12 +2,12 @@ import { assert } from "./assertions.js";
 import { fetch } from "./fetch.js";
 import { sessionConfig } from "./auth/config.js";
 import { readSessionToken, withSessionToken } from "./auth/session.js";
+import { softrConfig } from "./softr-config.js";
 import { makePlatform, platformApiUrl } from "./auth/platform.js";
 import { isDatasourceAction } from "./action.js";
-import { softrConfig } from "./softr-config.js";
 import { ds } from "./datasource/datasource.js";
-import { createMiddleware } from "@tanstack/react-start";
 import { z } from "zod";
+import { createMiddleware } from "@tanstack/react-start";
 
 //#region src/mcp.ts
 const MCP_PATH = "/_softr/mcp";

package/dist/package.js

@@ -1,5 +1,5 @@
 //#region package.json
-var version = "0.0.68-alpha.2";
+var version = "0.0.68-props.1";
 
 //#endregion
 export { version };

package/dist/pwa.d.ts

@@ -1,4 +1,4 @@
-import * as react4 from "react";
+import * as react3 from "react";
 import "@tanstack/react-start";
 
 //#region src/pwa.d.ts
@@ -23,7 +23,7 @@ import "@tanstack/react-start";
  *   )
  * }
  */
-declare function SoftrPwaHead(): react4.FunctionComponentElement<react4.FragmentProps>;
+declare function SoftrPwaHead(): react3.FunctionComponentElement<react3.FragmentProps>;
 type PwaPlatform = "ios" | "android" | "desktop";
 type PwaInstall = {
   available: false;

package/dist/pwa.js

@@ -2,9 +2,9 @@ import { logger } from "./logger.js";
 import { fetch } from "./fetch.js";
 import { sessionConfig } from "./auth/config.js";
 import { platformApiUrl } from "./auth/platform.js";
+import { z } from "zod";
 import { Fragment, createElement, useEffect, useState } from "react";
 import { createMiddleware } from "@tanstack/react-start";
-import { z } from "zod";
 
 //#region src/pwa.ts
 const MANIFEST_PATH = "/manifest.webmanifest";

package/dist/softr-config.schema.js

@@ -1,6 +1,17 @@
+import { throwAtCaller } from "./assertions.js";
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
 import { z } from "zod";
 
 //#region src/softr-config.schema.ts
+const SOFTR_CONFIG_FILE = "softr.json";
+/** The cause is in softr.json, so the app's author can fix it. */
+var SoftrConfigError = class extends Error {
+	name = "SoftrConfigError";
+};
+function panicConfig(message) {
+	throwAtCaller(panicConfig, new SoftrConfigError(message));
+}
 const AccessBehaviour = z.union([
 	z.string(),
 	z.object({
@@ -9,32 +20,49 @@ const AccessBehaviour = z.union([
 	}),
 	z.object({ strategy: z.literal("throw") })
 ], { error: "must be a path like \"/login\", { \"strategy\": \"redirect\", \"to\": \"/login\" } or { \"strategy\": \"throw\" }" });
-const AppPath = z.string().refine((path) => path.startsWith("/") && !path.includes("?") && !path.includes("#") && new URL(path, "https://app.invalid").origin === "https://app.invalid", { error: "must be a path on this app like \"/login\", with no \"?\" or \"#\"" });
-const SoftrConfigSchema = z.object({ auth: z.strictObject({
-	routes: z.strictObject({
-		login: z.strictObject({
-			path: AppPath,
-			redirectParam: z.string()
+const AppPath = z.string().refine((path$1) => path$1.startsWith("/") && !path$1.includes("?") && !path$1.includes("#") && new URL(path$1, "https://app.invalid").origin === "https://app.invalid", { error: "must be a path on this app like \"/login\", with no \"?\" or \"#\"" });
+const SoftrConfigSchema = z.object({
+	auth: z.strictObject({
+		routes: z.strictObject({
+			login: z.strictObject({
+				path: AppPath,
+				redirectParam: z.string()
+			}),
+			resetPassword: z.strictObject({
+				path: AppPath,
+				tokenParam: z.string()
+			}),
+			acceptInvitation: z.strictObject({
+				path: AppPath,
+				tokenParam: z.string()
+			}),
+			magicLink: z.strictObject({
+				path: AppPath,
+				tokenParam: z.string()
+			})
 		}),
-		resetPassword: z.strictObject({
-			path: AppPath,
-			tokenParam: z.string()
-		}),
-		acceptInvitation: z.strictObject({
-			path: AppPath,
-			tokenParam: z.string()
-		}),
-		magicLink: z.strictObject({
-			path: AppPath,
-			tokenParam: z.string()
+		guard: z.strictObject({
+			unauthenticated: AccessBehaviour,
+			forbidden: AccessBehaviour,
+			alreadyAuthenticated: AccessBehaviour
 		})
 	}),
-	guard: z.strictObject({
-		unauthenticated: AccessBehaviour,
-		forbidden: AccessBehaviour,
-		alreadyAuthenticated: AccessBehaviour
-	})
-}) });
+	user: z.strictObject({ properties: z.record(z.string(), z.string()) }).optional()
+});
+function loadSoftrConfig(root) {
+	const file = path.join(root, SOFTR_CONFIG_FILE);
+	if (!existsSync(file)) panicConfig(`${SOFTR_CONFIG_FILE} is missing from ${root}`);
+	const source = readFileSync(file, "utf8");
+	let parsed;
+	try {
+		parsed = JSON.parse(source);
+	} catch (error) {
+		panicConfig(`${SOFTR_CONFIG_FILE} is not valid JSON: ${error instanceof Error ? error.message : error}`);
+	}
+	const result = SoftrConfigSchema.safeParse(parsed);
+	if (!result.success) panicConfig(`${SOFTR_CONFIG_FILE} does not match the schema:\n\n${z.prettifyError(result.error)}`);
+	return result.data;
+}
 
 //#endregion
-export { SoftrConfigSchema };
+export { SOFTR_CONFIG_FILE, SoftrConfigError, loadSoftrConfig, panicConfig };

package/dist/visibility/route.js

@@ -1,5 +1,5 @@
-import { ACCESS_REASONS, checkAccess } from "./visibility.js";
 import { softrConfig } from "../softr-config.js";
+import { ACCESS_REASONS, checkAccess } from "./visibility.js";
 import { redirect } from "@tanstack/react-router";
 
 //#region src/visibility/route.ts

package/dist/vite.js

@@ -1,12 +1,8 @@
-import { assert, panic } from "./assertions.js";
-import { SoftrConfigSchema } from "./softr-config.schema.js";
-import { existsSync, readFileSync } from "node:fs";
+import { SOFTR_CONFIG_FILE, loadSoftrConfig } from "./softr-config.schema.js";
 import path from "node:path";
-import { z } from "zod";
 import { pathToFileURL } from "node:url";
 
 //#region src/vite.ts
-const SOFTR_CONFIG_FILE = "softr.json";
 function softr() {
 	return [softrConfig(), editEngine()];
 }
@@ -27,20 +23,6 @@ function softrConfig() {
 		}
 	};
 }
-function loadSoftrConfig(root) {
-	const file = path.join(root, SOFTR_CONFIG_FILE);
-	assert(existsSync(file), `${SOFTR_CONFIG_FILE} is missing from ${root}`);
-	const source = readFileSync(file, "utf8");
-	let parsed;
-	try {
-		parsed = JSON.parse(source);
-	} catch (error) {
-		panic(`${SOFTR_CONFIG_FILE} is not valid JSON: ${error instanceof Error ? error.message : error}`);
-	}
-	const result = SoftrConfigSchema.safeParse(parsed);
-	if (!result.success) panic(`${SOFTR_CONFIG_FILE} does not match the schema:\n\n${z.prettifyError(result.error)}`);
-	return result.data;
-}
 /**
 * The edit engine is provided by the pod runtime rather than an app dependency: it is never in the
 * app's `package.json` and never in its `node_modules`. The pod points `SOFTR_EDIT_ENGINE_DIR` at

package/package.json

@@ -1,16 +1,37 @@
 {
   "name": "@softr/sdk",
-  "version": "0.0.68-alpha.2",
+  "version": "0.0.68-props.1",
   "type": "module",
   "exports": {
-    ".": { "types": "./dist/index.d.ts", "import": "./dist/index.js" },
-    "./client": { "types": "./dist/client.d.ts", "import": "./dist/client.js" },
-    "./server": { "types": "./dist/server.d.ts", "import": "./dist/server.js" },
-    "./vite": { "types": "./dist/vite.d.ts", "import": "./dist/vite.js" }
-  },
-  "bin": { "softr-sdk": "./dist/cli.js" },
-  "files": ["dist", "schema", "skills", "!skills/_artifacts"],
-  "publishConfig": { "access": "public" },
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./client": {
+      "types": "./dist/client.d.ts",
+      "import": "./dist/client.js"
+    },
+    "./server": {
+      "types": "./dist/server.d.ts",
+      "import": "./dist/server.js"
+    },
+    "./vite": {
+      "types": "./dist/vite.d.ts",
+      "import": "./dist/vite.js"
+    }
+  },
+  "bin": {
+    "softr-sdk": "./dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "schema",
+    "skills",
+    "!skills/_artifacts"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
   "scripts": {
     "build": "tsdown",
     "test": "node --import ./src/test-utils/setup.ts --test",
@@ -42,7 +63,9 @@
       "optional": true
     }
   },
-  "keywords": ["tanstack-intent"],
+  "keywords": [
+    "tanstack-intent"
+  ],
   "intent": {
     "version": 1,
     "repo": "@softr/sdk",

package/schema/softr.schema.json

@@ -54,6 +54,19 @@
       },
       "required": ["routes", "guard"],
       "additionalProperties": false
+    },
+    "user": {
+      "type": "object",
+      "description": "The signed-in user.",
+      "properties": {
+        "properties": {
+          "type": "object",
+          "description": "Fields of the users table the app reads as user.properties, keyed by the name the app uses. Each value is a field id. No other field leaves the server.",
+          "additionalProperties": { "type": "string" }
+        }
+      },
+      "required": ["properties"],
+      "additionalProperties": false
     }
   },
   "required": ["auth"],

package/skills/softr-sdk/SKILL.md

@@ -12,7 +12,7 @@ description: >-
 metadata:
   type: core
   library: softr-sdk
-  library_version: 0.0.68-alpha.2
+  library_version: 0.0.68-props.1
 ---
 
 # Softr SDK core
@@ -48,7 +48,6 @@ Each sub-skill stands alone for its task and repeats the boundary above, so most
 | Trigger a Softr workflow | [workflows/SKILL.md](./workflows/SKILL.md) |
 | Sign a visitor in, out, or up | [auth/SKILL.md](./auth/SKILL.md) |
 | Call a connected third-party API (Slack, Stripe, Gmail, …) | [integrations/SKILL.md](./integrations/SKILL.md) |
-| Show an AI answer as it is written (a chat, an assistant, a live summary) | [integrations/SKILL.md](./integrations/SKILL.md), section "Streaming a vendor answer" |
 | Open the app to AI assistants over MCP | [mcp/SKILL.md](./mcp/SKILL.md) |
 | Let visitors install the app on their home screen | [pwa/SKILL.md](./pwa/SKILL.md) |
 | Show a date, a time or a number | [formatting/SKILL.md](./formatting/SKILL.md) |
@@ -83,9 +82,6 @@ Wiring a login, signup, or sign-out?
 Calling a connected third-party API (Slack, Stripe, Gmail, Google Calendar, …)?
   load softr-sdk/integrations
 
-Showing an AI answer as it is written: a chat, an assistant, a summary that types itself out?
-  load softr-sdk/integrations and stream the call: its "Streaming a vendor answer" section
-
 Opening the app to an AI assistant over MCP?
   load softr-sdk/mcp
 

package/skills/softr-sdk/auth/SKILL.md

@@ -19,7 +19,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.68-alpha.2
+  library_version: 0.0.68-props.1
 ---
 
 **Boundary.** `auth` lives on `@softr/sdk/server` and runs only inside a `createServerFn` handler — importing it into a component fails the build.

package/skills/softr-sdk/charts-and-metrics/SKILL.md

@@ -12,7 +12,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.68-alpha.2
+  library_version: 0.0.68-props.1
 ---
 
 **Boundary.** `ds` lives on `@softr/sdk/server` and runs only inside a `createServerFn` handler or a server-side route hook — importing it into a component fails the build. `defineQuery` and every type come from `@softr/sdk` and can be imported anywhere.

package/skills/softr-sdk/current-user/SKILL.md

@@ -4,12 +4,13 @@ description: >-
   Read the signed-in Softr visitor: useCurrentUser and the User type,
   context.user in a route's beforeLoad, and context.user inside a server
   function handler, where Start types it from the app's registered request
-  middleware. Covers the null guest and the generated SoftrUserGroups that
-  narrows group ids to the app's own.
+  middleware. Covers the null guest, the generated SoftrUserGroups that narrows
+  group ids to the app's own, and user.properties, the fields of the visitor's
+  row that softr.json declares.
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.68-alpha.2
+  library_version: 0.0.68-props.1
 ---
 
 # The current user
@@ -31,6 +32,7 @@ type User = {
   email: string
   fullName: string
   userGroupIds: Array<SoftrUserGroupId>   // the app's own group ids
+  properties: SoftrUserProperties         // the aliases softr.json declares
 }
 ```
 
@@ -90,6 +92,25 @@ For every group's name and id, read `docs/user-groups.md`. It lists every group
 
 `user.userGroupIds` and every `customGroups` the SDK accepts take only those ids, so an id the app does not have stops compiling. A new group appears in the list once it exists on the app.
 
+### Fields of the visitor's row: `user.properties`
+
+To read more of the visitor's row in the users table, give each field an alias in `softr.json`, under `user.properties`. The value is the field's id:
+
+```json
+{
+  "user": {
+    "properties": {
+      "plan": "OeIz1",
+      "seats": "1iHKE"
+    }
+  }
+}
+```
+
+`user.properties` then holds exactly those aliases. To read them, see `docs/user-properties.md`.
+
+Attachment and long text fields, and linked record and lookup fields with multiple entries, cannot be properties. Read those with `defineQuery` on the users table. See [record-queries](../record-queries/SKILL.md).
+
 ## References
 
 - [routes-and-visibility/SKILL.md](../routes-and-visibility/SKILL.md): `isAuthorized` narrows `context.user` while applying the route's rule

package/skills/softr-sdk/file-uploads/SKILL.md

@@ -10,7 +10,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.68-alpha.2
+  library_version: 0.0.68-props.1
 ---
 
 **Boundary.** `upload` lives on `@softr/sdk/server` and runs inside server functions. `useFileUpload` and `FileItem` live on `@softr/sdk` and run in components. `FileAttachment` comes from `@softr/sdk` and can be imported anywhere.

package/skills/softr-sdk/formatting/SKILL.md

@@ -10,7 +10,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.68-alpha.2
+  library_version: 0.0.68-props.1
 ---
 
 # Dates, times and numbers

package/skills/softr-sdk/integrations/SKILL.md

@@ -5,12 +5,12 @@ description: >-
   defineIntegration from @softr/sdk declares the action with its integrationId,
   the one HTTP method and endpoint url it allows, and permissions;
   integration.createFetcher from @softr/sdk/server binds it and returns a
-  fetcher function you call with optional params, query, headers, body, and
-  stream for a vendor answer that arrives in pieces. Check res.ok before res.json().
+  fetcher function you call with optional params, query, headers, and body.
+  Check res.ok before res.json().
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.68-alpha.2
+  library_version: 0.0.68-props.1
 ---
 
 **Boundary.** `integration` lives on `@softr/sdk/server` and runs only inside a `createServerFn` handler — importing it into a component fails the build. `defineIntegration` and every type come from `@softr/sdk` and can be imported anywhere.
@@ -129,16 +129,9 @@ Do not add an `Authorization` key to `headers` — Softr injects the integration
 
 ## Calling an AI model
 
-**Two shapes, decided by who reads the answer.** An answer the user reads as it is written — a chat, an
-assistant, a long summary shown on the page — streams: pass `stream: true` to the fetcher, ask the vendor
-for its stream in the request, and relay the body, see
-[Streaming a vendor answer](#streaming-a-vendor-answer) below. An answer the server reads — JSON the page
-lays out, text saved to a field — is buffered: the call below, then `res.json()`. A chat is never buffered:
-the user would watch a blank panel until the last token.
-
 A button on one record that hands its fields to the model and shows the answer is the `ai-action` pattern:
-it carries the buffered call and the model id, so write the call by hand only for another shape — a batch,
-a field the model fills on create, or a chat, which streams. An AI integration is called like any other. For `ANTHROPIC_AI`, the action is `POST` on
+it carries this call and the model id, so write the call by hand only for another shape — a batch, a chat,
+a field the model fills on create. An AI integration is called like any other. For `ANTHROPIC_AI`, the action is `POST` on
 `https://api.anthropic.com/v1/messages`, the request carries the `anthropic-version` header and a body of
 `model`, `max_tokens`, `system` and `messages`, and the answer's text is in `content[].text`:
 
@@ -171,49 +164,6 @@ const text = body.content.flatMap((block) => (block.type === 'text' && block.tex
 the button is pressed. `claude-opus-5-5` is the current default; `claude-sonnet-5-5` is the cheaper one for a
 short summary.
 
-## Streaming a vendor answer
-
-Some vendor endpoints can send their answer in pieces while they produce it — LLM completions token by token, long exports, live event feeds. The fetcher relays such an answer as it arrives when you pass `stream: true`; the response body is then the vendor's own stream, unchanged.
-
-Every connected LLM streams its completion. Ask the vendor for it in the request **and** pass `stream: true` to the fetcher; one without the other gains nothing:
-
-| integrationType | Endpoint | How to ask for the stream |
-|---|---|---|
-| ANTHROPIC_AI | `POST /v1/messages` | `"stream": true` in the body |
-| OPEN_AI | `POST /v1/chat/completions` or `POST /v1/responses` | `"stream": true` in the body |
-| GEMINI_AI | `POST /v1beta/models/{model}:streamGenerateContent` with `query: { alt: 'sse' }` | the endpoint itself; `generateContent` never streams, so the action's `url` must name the streaming one |
-| MISTRAL_AI | `POST /v1/chat/completions` | `"stream": true` in the body |
-| DEEP_SEEK_AI | `POST /chat/completions` | `"stream": true` in the body |
-| COHERE | `POST /v2/chat` | `"stream": true` in the body |
-
-For any other vendor, read that endpoint's docs: it streams when they offer a `stream` flag, an `Accept: text/event-stream` variant, or a chunked response to read incrementally. Most REST calls answer in one piece; call those without `stream` and `res.json()` works.
-
-Hand a streamed body to the browser as a `Response` from the server function and read it there. The example below streams a completion through the `askClaude` action declared above; the same shape applies to any vendor endpoint that streams.
-
-```ts
-const streamAnswer = createServerFn({ method: 'POST' })
-  .validator((data: { prompt: string }) => data)
-  .handler(async ({ data }) => {
-    const claude = integration.createFetcher(askClaude)
-    const res = await claude({
-      stream: true,
-      headers: { 'Content-Type': 'application/json', 'anthropic-version': '2023-06-01' },
-      body: JSON.stringify({
-        model: 'claude-opus-5-5',
-        max_tokens: 1024,
-        stream: true,
-        messages: [{ role: 'user', content: data.prompt }],
-      }),
-    })
-    if (!res.ok) throw new Error(`AI error: ${res.status} ${await res.text()}`)
-    return new Response(res.body, { headers: { 'Content-Type': 'text/event-stream' } })
-  })
-```
-
-On the client, call the server function's URL with `fetch` and read `response.body` with a `ReadableStream` reader; each chunk arrives in the vendor's own format, for an event stream one or more `event:`/`data:` frames. Use `stream: true` only together with a request that asks the vendor to stream: without it the vendor answers in one piece, which still works but gains nothing.
-
-`stream: true` is not available for REST_API integrations; those always answer in one piece.
-
 ## Base URLs by integration type
 
 Match the `integrationType` from the attached integrations section to find the base URL:
@@ -285,7 +235,3 @@ If the API the user needs is not in the table above, call it directly from a ser
 **Not checking `res.ok`.** The fetcher returns the proxied response as-is. A 4xx or 5xx from the third-party API is not thrown — call `res.ok` or `res.status` before calling `res.json()`.
 
 **Reusing one action for a different endpoint.** An action authorizes one `method` and one endpoint `url`. A different endpoint belongs to a different action — declare one for it, with its own audience.
-
-**Buffering an answer the user watches being written.** A chat or assistant called without streaming shows nothing until the last token arrives, and a long answer then hits the proxy's read timeout. Two flags are needed, and they are not the same thing: `stream: true` on the fetcher init is Softr's, it routes the call through the streaming proxy; the vendor's own request for a stream, such as `"stream": true` in an Anthropic or OpenAI body, or Gemini's `streamGenerateContent` endpoint, is what makes the vendor send pieces. Set both, then return `res.body` in a `Response`.
-
-**Reading a streamed body with `res.json()`.** With `stream: true` the body is an event stream, not one JSON document. Return `res.body` in a `Response` or read it with a stream reader; `res.json()` waits for the end and then fails to parse.

package/skills/softr-sdk/mcp/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.68-alpha.2
+  library_version: 0.0.68-props.1
 ---
 
 **Boundary.** `softrMcpMiddleware` lives on `@softr/sdk` and is registered once, in `src/start.ts`. The actions you hand it are the same `defineQuery` / `defineMutation` values the app's own pages use — declared wherever they already live, not duplicated for MCP.

package/skills/softr-sdk/pwa/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.68-alpha.2
+  library_version: 0.0.68-props.1
 ---
 
 # Installing the app

package/skills/softr-sdk/record-mutations/SKILL.md

@@ -11,7 +11,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.68-alpha.2
+  library_version: 0.0.68-props.1
 ---
 
 **Boundary.** `ds` lives on `@softr/sdk/server` and runs only inside a `createServerFn` handler — importing it into a component fails the build. `defineMutation` and every type come from `@softr/sdk` and can be imported anywhere.

package/skills/softr-sdk/record-queries/SKILL.md

@@ -13,7 +13,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.68-alpha.2
+  library_version: 0.0.68-props.1
 ---
 
 **Boundary.** `ds` lives on `@softr/sdk/server` and runs only inside a `createServerFn` handler or a server-side route hook — importing it into a component fails the build. The same holds for any helper that calls `ds`: declare it inside the handler. A function at module level that calls `ds` keeps the server-only import in the browser bundle, and every page stops loading until it moves. `defineQuery` and every type come from `@softr/sdk` and can be imported anywhere.

package/skills/softr-sdk/region-visibility/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.68-alpha.2
+  library_version: 0.0.68-props.1
 ---
 
 **Boundary.** `Audience` and `defineVisibility` come from `@softr/sdk` and work anywhere.

package/skills/softr-sdk/routes-and-visibility/SKILL.md

@@ -13,7 +13,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.68-alpha.2
+  library_version: 0.0.68-props.1
 ---
 
 **Boundary.** `defineVisibility`, the access functions and the error predicates come from `@softr/sdk` and work anywhere.

package/skills/softr-sdk/workflows/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.68-alpha.2
+  library_version: 0.0.68-props.1
 ---
 
 **Boundary.** `workflow` lives on `@softr/sdk/server` and runs only inside a `createServerFn` handler — importing it into a component fails the build. `defineWorkflow` and every type come from `@softr/sdk` and can be imported anywhere.