@softr/sdk 0.0.68 → 0.0.69-alpha.0

package/dist/auth/methods/profile.d.ts

@@ -0,0 +1,26 @@
+import { User } from "../user.js";
+import { AuthError, Result } from "./utils.js";
+
+//#region src/auth/methods/profile.d.ts
+
+/**
+ * Changes the signed-in visitor's own name, photo, or both. A field left out
+ * stays as it is, and `avatar: null` removes the photo.
+ *
+ * The photo can change only where `user.avatarEditable` is true. Elsewhere a
+ * photo answers `avatarNotSupported`, so hide the photo controls instead.
+ *
+ * Answers with the visitor as they are now. The page keeps showing what it
+ * loaded until its route context loads again, so call `router.invalidate()`
+ * after a success.
+ *
+ * @example
+ * const result = await auth.updateProfile({ fullName: 'Ann Lee' })
+ * const result = await auth.updateProfile({ avatar: file })
+ */
+declare function updateProfile(changes: {
+  fullName?: string;
+  avatar?: File | null;
+}): Promise<Result<User, AuthError>>;
+//#endregion
+export { updateProfile };

package/dist/auth/methods/profile.js

@@ -0,0 +1,52 @@
+import { assert, panic } from "../../assertions.js";
+import { sessionConfig } from "../config.js";
+import { clearSessionData, readSessionToken } from "../session.js";
+import { makePlatform } from "../platform.js";
+import { authError } from "./utils.js";
+
+//#region src/auth/methods/profile.ts
+/**
+* Changes the signed-in visitor's own name, photo, or both. A field left out
+* stays as it is, and `avatar: null` removes the photo.
+*
+* The photo can change only where `user.avatarEditable` is true. Elsewhere a
+* photo answers `avatarNotSupported`, so hide the photo controls instead.
+*
+* Answers with the visitor as they are now. The page keeps showing what it
+* loaded until its route context loads again, so call `router.invalidate()`
+* after a success.
+*
+* @example
+* const result = await auth.updateProfile({ fullName: 'Ann Lee' })
+* const result = await auth.updateProfile({ avatar: file })
+*/
+async function updateProfile(changes) {
+	assert(changes.fullName !== void 0 || changes.avatar !== void 0, "updateProfile needs a name or a photo to change");
+	const token = readSessionToken();
+	if (token === null) return authError("notAuthenticated", "Nobody is signed in.");
+	const form = new FormData();
+	if (changes.fullName !== void 0) form.set("fullName", changes.fullName);
+	if (changes.avatar === null) form.set("removeAvatar", "true");
+	if (changes.avatar) form.set("avatar", changes.avatar);
+	const result = await makePlatform(sessionConfig().applicationId).updateProfile(token, form);
+	if (!result.ok) {
+		switch (result.status) {
+			case 400: return authError("invalidName", result.message);
+			case 401: return authError("notAuthenticated", result.message);
+			case 409: return authError("avatarNotSupported", result.message);
+			case 413: return authError("fileTooLarge", result.message);
+			case 415: return authError("notAnImage", result.message);
+			case 429: return authError("tooManyAttempts", result.message);
+		}
+		if (result.status >= 500) panic(`Expected the profile to update, but got ${result.status}: ` + result.message);
+		throw new Error(`${result.message}. Check SOFTR_APPLICATION_ID.`);
+	}
+	clearSessionData();
+	return {
+		success: true,
+		data: result.data
+	};
+}
+
+//#endregion
+export { updateProfile };

package/dist/auth/methods/utils.d.ts

@@ -10,6 +10,6 @@ type AuthError = {
   code: AuthErrorCode;
   message: string;
 };
-type AuthErrorCode = "invalidCredentials" | "tooManyAttempts" | "emailTaken" | "invalidDetails" | "invalidCode" | "notAuthenticated" | "emailDomainNotAllowed" | "linkExpired";
+type AuthErrorCode = "invalidCredentials" | "tooManyAttempts" | "emailTaken" | "invalidDetails" | "invalidCode" | "notAuthenticated" | "emailDomainNotAllowed" | "linkExpired" | "invalidName" | "fileTooLarge" | "notAnImage" | "avatarNotSupported";
 //#endregion
 export { AuthError, Result };

package/dist/auth/platform.js

@@ -1,4 +1,4 @@
-import { panic } from "../assertions.js";
+import { assert, panic } from "../assertions.js";
 import { fetch } from "../fetch.js";
 import { permissionsSchema } from "./permissions.js";
 import { sessionConfig } from "./config.js";
@@ -267,6 +267,11 @@ function makePlatform(applicationId) {
 			token,
 			json: { code }
 		}, z.null()),
+		updateProfile: (token, form) => request(`/v1/vibe/applications/${applicationId}/users/me/profile`, {
+			method: "PATCH",
+			token,
+			form
+		}, userSchema),
 		signOut: (token) => request(`/v1/applications/${applicationId}/users/sign-out`, {
 			method: "POST",
 			token
@@ -275,6 +280,7 @@ function makePlatform(applicationId) {
 }
 const errorSchema = z.object({ message: z.string() });
 async function request(path, init, schema, parse = (response$1) => response$1.json()) {
+	assert(init.json === void 0 || init.form === void 0, "A platform request carries a JSON body or a form, not both");
 	const response = await fetch(`${await platformApiUrl()}${path}`, {
 		method: init.method,
 		headers: {
@@ -282,7 +288,8 @@ async function request(path, init, schema, parse = (response$1) => response$1.js
 			...init.json === void 0 ? {} : { "content-type": "application/json" },
 			...init.token ? { authorization: `Bearer ${init.token}` } : {}
 		},
-		...init.json === void 0 ? {} : { body: JSON.stringify(init.json) }
+		...init.json === void 0 ? {} : { body: JSON.stringify(init.json) },
+		...init.form === void 0 ? {} : { body: init.form }
 	});
 	if (!response.ok) {
 		const error = errorSchema.safeParse(await response.json().catch(() => null));

package/dist/auth/server.d.ts

@@ -6,6 +6,7 @@ import { checkPasswordLink, requestPasswordReset, setPasswordWithLink } from "./
 import { settings } from "./methods/settings.js";
 import { confirmSignUp, signUp } from "./methods/signup.js";
 import { signInWithGoogle } from "./methods/social.js";
+import { updateProfile } from "./methods/profile.js";
 import { currentUserRow } from "./current-user-row.js";
 import "@tanstack/react-start/server-only";
 
@@ -34,6 +35,7 @@ declare const auth: {
   resetAuthenticator: typeof resetAuthenticator;
   removeAuthenticator: typeof removeAuthenticator;
   settings: typeof settings;
+  updateProfile: typeof updateProfile;
   currentUserRow: typeof currentUserRow;
 };
 //#endregion

package/dist/auth/server.js

@@ -6,6 +6,7 @@ import { signIn, signOut } from "./methods/password.js";
 import { checkPasswordLink, requestPasswordReset, setPasswordWithLink } from "./methods/passwordLink.js";
 import { confirmSignUp, signUp } from "./methods/signup.js";
 import { signInWithGoogle } from "./methods/social.js";
+import { updateProfile } from "./methods/profile.js";
 import { currentUserRow } from "./current-user-row.js";
 import "@tanstack/react-start/server-only";
 
@@ -33,6 +34,7 @@ const auth = {
 	resetAuthenticator,
 	removeAuthenticator,
 	settings,
+	updateProfile,
 	currentUserRow
 };
 

package/dist/auth/session.js

@@ -118,6 +118,16 @@ function clearSession() {
 		PENDING_AUTH
 	]);
 }
+/**
+* Drops the cached visitor and leaves the session signed in, so the next
+* request needing a visitor re-reads one from the platform.
+*
+* For a mutation to what the visitor's own record holds — their name, their
+* groups — which the cache would otherwise answer stale for up to five minutes.
+*/
+function clearSessionData() {
+	clearCookies([SESSION_DATA]);
+}
 const standInToken = new AsyncLocalStorage();
 const sessionDataSchema = z.object({
 	user: userSchema.nullable(),
@@ -210,4 +220,4 @@ function openEnvelope(raw, purpose) {
 }
 
 //#endregion
-export { clearPendingAuth, clearSession, makePendingAuthCookie, makeSessionDataCookie, makeSessionTokenCookie, readPendingAuthToken, readSessionData, readSessionToken, withSessionToken };
+export { clearPendingAuth, clearSession, clearSessionData, makePendingAuthCookie, makeSessionDataCookie, makeSessionTokenCookie, readPendingAuthToken, readSessionData, readSessionToken, withSessionToken };

package/dist/auth/user.d.ts

@@ -19,6 +19,10 @@ type User = {
   email: string;
   fullName: string;
   userGroupIds: Array<SoftrUserGroupId>;
+  /** Their photo, or `null` when they have none. Show their initials then. */
+  avatarUrl: string | null;
+  /** Whether `auth.updateProfile` can change their photo in this app. */
+  avatarEditable: boolean;
 };
 //#endregion
 export { SoftrUserGroupId, SoftrUserGroups, User };

package/dist/auth/user.js

@@ -5,7 +5,9 @@ const userSchema = z.object({
 	id: z.string(),
 	email: z.string(),
 	fullName: z.string(),
-	userGroupIds: z.array(z.string())
+	userGroupIds: z.array(z.string()),
+	avatarUrl: z.string().nullable().default(null),
+	avatarEditable: z.boolean().default(false)
 });
 
 //#endregion

package/dist/default-error-overlay.d.ts

@@ -1,4 +1,4 @@
-import * as react6 from "react";
+import * as react4 from "react";
 
 //#region src/default-error-overlay.d.ts
 type Props = {
@@ -8,6 +8,6 @@ type Props = {
 declare function DefaultErrorOverlay({
   error,
   reset
-}: Props): react6.JSX.Element;
+}: Props): react4.JSX.Element;
 //#endregion
 export { DefaultErrorOverlay };

package/dist/mcp.d.ts

@@ -1,5 +1,5 @@
 import { DatasourceAction } from "./action.js";
-import * as _tanstack_react_start4 from "@tanstack/react-start";
+import * as _tanstack_react_start0 from "@tanstack/react-start";
 
 //#region src/mcp.d.ts
 
@@ -31,6 +31,6 @@ type SoftrMcpOptions = {
  *   ],
  * }))
  */
-declare function softrMcpMiddleware(options?: SoftrMcpOptions): _tanstack_react_start4.RequestMiddlewareAfterServer<{}, undefined, undefined>;
+declare function softrMcpMiddleware(options?: SoftrMcpOptions): _tanstack_react_start0.RequestMiddlewareAfterServer<{}, undefined, undefined>;
 //#endregion
 export { softrMcpMiddleware };

package/dist/package.js

@@ -1,5 +1,5 @@
 //#region package.json
-var version = "0.0.68";
+var version = "0.0.69-alpha.0";
 
 //#endregion
 export { version };

package/dist/pwa.d.ts

@@ -1,4 +1,4 @@
-import * as react4 from "react";
+import * as react5 from "react";
 import "@tanstack/react-start";
 
 //#region src/pwa.d.ts
@@ -23,7 +23,7 @@ import "@tanstack/react-start";
  *   )
  * }
  */
-declare function SoftrPwaHead(): react4.FunctionComponentElement<react4.FragmentProps>;
+declare function SoftrPwaHead(): react5.FunctionComponentElement<react5.FragmentProps>;
 type PwaPlatform = "ios" | "android" | "desktop";
 type PwaInstall = {
   available: false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softr/sdk",
-  "version": "0.0.68",
+  "version": "0.0.69-alpha.0",
   "type": "module",
   "exports": {
     ".": { "types": "./dist/index.d.ts", "import": "./dist/index.js" },

package/skills/softr-sdk/SKILL.md

@@ -12,7 +12,7 @@ description: >-
 metadata:
   type: core
   library: softr-sdk
-  library_version: 0.0.68
+  library_version: 0.0.69-alpha.0
 ---
 
 # Softr SDK core

package/skills/softr-sdk/auth/SKILL.md

@@ -7,19 +7,18 @@ description: >-
   sign-in (verifyAuthenticator, startAuthenticatorSetup,
   confirmAuthenticatorSetup, skipAuthenticatorSetup) and the ones that change an
   authenticator from a settings page (sendAuthenticatorResetCode,
-  resetAuthenticator, removeAuthenticator), the emailed password links
-  (requestPasswordReset, checkPasswordLink, setPasswordWithLink), and
-  getAuthSettings, AuthSettingsProvider and useAuthSettings for which sign-in
-  and sign-up methods the app has enabled. Covers the Result shape they answer
-  with and its codes invalidCredentials, tooManyAttempts, emailTaken,
-  invalidDetails, invalidCode, notAuthenticated, emailDomainNotAllowed and
-  linkExpired, the two-step sign-up, why a successful sign-in does not always
-  mean the visitor is signed in, and toReturnPath for where to land after
-  signing in.
+  resetAuthenticator, removeAuthenticator), updateProfile for the visitor's own
+  name and photo, the emailed password links (requestPasswordReset,
+  checkPasswordLink, setPasswordWithLink), and getAuthSettings,
+  AuthSettingsProvider and useAuthSettings for which sign-in and sign-up methods
+  the app has enabled. Covers the Result shape they answer with and its error
+  codes (invalidCredentials, emailTaken, notAuthenticated, notAnImage and the
+  rest), the two-step sign-up, why a successful sign-in does not always mean the
+  visitor is signed in, and toReturnPath for where to land after signing in.
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.68
+  library_version: 0.0.69-alpha.0
 ---
 
 **Boundary.** `auth` lives on `@softr/sdk/server` and runs only inside a `createServerFn` handler — importing it into a component fails the build.
@@ -82,6 +81,12 @@ Changing an authenticator from a settings page:
 | `auth.resetAuthenticator({ code })` | Unpairs the app, so a new one can be enrolled |
 | `auth.removeAuthenticator({ code })` | Turns the authenticator off |
 
+Changing the visitor's own profile:
+
+| Call | Does |
+| --- | --- |
+| `auth.updateProfile({ fullName?, avatar? })` | Changes their name, their photo, or both. `avatar: null` removes the photo |
+
 ## Setup
 
 `auth` is server-only, so every call sits inside a `createServerFn` handler:
@@ -451,6 +456,20 @@ All three need a signed-in visitor and answer `notAuthenticated` when there is n
 
 After a reset, enrol the new app with `startAuthenticatorSetup` and `confirmAuthenticatorSetup`, which is also where the new backup codes come from. After a removal, an app that requires an authenticator asks the visitor to set one up again on their next sign-in.
 
+### Changing the visitor's name and photo
+
+```ts
+const result = await auth.updateProfile({ fullName: 'Ann Lee' })
+const result = await auth.updateProfile({ avatar: file })   // a File from an <input type="file">
+const result = await auth.updateProfile({ avatar: null })   // removes the photo
+```
+
+It answers with the updated `User`. Pass the file through a server function that takes `FormData`. The photo must be a PNG, JPEG or GIF of at most 5 MB, or it answers `notAnImage` or `fileTooLarge`. A blank or unacceptable name answers `invalidName`.
+
+Only some apps can store a photo. Show the photo controls only when `user.avatarEditable` is true; elsewhere a photo answers `avatarNotSupported`.
+
+The page keeps showing the old name and photo until its route context loads again, so call `router.invalidate()` after a success.
+
 ## References
 
 - [current-user/SKILL.md](../current-user/SKILL.md): reading the visitor these calls establish

package/skills/softr-sdk/charts-and-metrics/SKILL.md

@@ -12,7 +12,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.68
+  library_version: 0.0.69-alpha.0
 ---
 
 **Boundary.** `ds` lives on `@softr/sdk/server` and runs only inside a `createServerFn` handler or a server-side route hook — importing it into a component fails the build. `defineQuery` and every type come from `@softr/sdk` and can be imported anywhere.

package/skills/softr-sdk/current-user/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.68
+  library_version: 0.0.69-alpha.0
 ---
 
 # The current user
@@ -31,6 +31,8 @@ type User = {
   email: string
   fullName: string
   userGroupIds: Array<SoftrUserGroupId>   // the app's own group ids
+  avatarUrl: string | null                 // their photo; show their initials when null
+  avatarEditable: boolean                  // whether auth.updateProfile can change the photo
 }
 ```
 

package/skills/softr-sdk/file-uploads/SKILL.md

@@ -10,7 +10,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.68
+  library_version: 0.0.69-alpha.0
 ---
 
 **Boundary.** `upload` lives on `@softr/sdk/server` and runs inside server functions. `useFileUpload` and `FileItem` live on `@softr/sdk` and run in components. `FileAttachment` comes from `@softr/sdk` and can be imported anywhere.

package/skills/softr-sdk/formatting/SKILL.md

@@ -10,7 +10,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.68
+  library_version: 0.0.69-alpha.0
 ---
 
 # Dates, times and numbers

package/skills/softr-sdk/integrations/SKILL.md

@@ -10,7 +10,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.68
+  library_version: 0.0.69-alpha.0
 ---
 
 **Boundary.** `integration` lives on `@softr/sdk/server` and runs only inside a `createServerFn` handler — importing it into a component fails the build. `defineIntegration` and every type come from `@softr/sdk` and can be imported anywhere.

package/skills/softr-sdk/mcp/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.68
+  library_version: 0.0.69-alpha.0
 ---
 
 **Boundary.** `softrMcpMiddleware` lives on `@softr/sdk` and is registered once, in `src/start.ts`. The actions you hand it are the same `defineQuery` / `defineMutation` values the app's own pages use — declared wherever they already live, not duplicated for MCP.

package/skills/softr-sdk/pwa/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.68
+  library_version: 0.0.69-alpha.0
 ---
 
 # Installing the app

package/skills/softr-sdk/record-mutations/SKILL.md

@@ -11,7 +11,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.68
+  library_version: 0.0.69-alpha.0
 ---
 
 **Boundary.** `ds` lives on `@softr/sdk/server` and runs only inside a `createServerFn` handler — importing it into a component fails the build. `defineMutation` and every type come from `@softr/sdk` and can be imported anywhere.

package/skills/softr-sdk/record-queries/SKILL.md

@@ -13,7 +13,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.68
+  library_version: 0.0.69-alpha.0
 ---
 
 **Boundary.** `ds` lives on `@softr/sdk/server` and runs only inside a `createServerFn` handler or a server-side route hook — importing it into a component fails the build. The same holds for any helper that calls `ds`: declare it inside the handler. A function at module level that calls `ds` keeps the server-only import in the browser bundle, and every page stops loading until it moves. `defineQuery` and every type come from `@softr/sdk` and can be imported anywhere.

package/skills/softr-sdk/region-visibility/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.68
+  library_version: 0.0.69-alpha.0
 ---
 
 **Boundary.** `Audience` and `defineVisibility` come from `@softr/sdk` and work anywhere.

package/skills/softr-sdk/routes-and-visibility/SKILL.md

@@ -13,7 +13,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.68
+  library_version: 0.0.69-alpha.0
 ---
 
 **Boundary.** `defineVisibility`, the access functions and the error predicates come from `@softr/sdk` and work anywhere.

package/skills/softr-sdk/workflows/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.68
+  library_version: 0.0.69-alpha.0
 ---
 
 **Boundary.** `workflow` lives on `@softr/sdk/server` and runs only inside a `createServerFn` handler — importing it into a component fails the build. `defineWorkflow` and every type come from `@softr/sdk` and can be imported anywhere.