@softr/sdk 0.0.82 → 0.0.83-alpha.0

package/dist/action.d.ts

@@ -234,5 +234,38 @@ type IntegrationDefinition<TId extends string> = {
  * const res = await listEvents({ query: { timeMin: now, singleEvents: "true" } })
  */
 declare function defineIntegration<const TId extends string>(definition: IntegrationDefinition<TId>): IntegrationAction<TId>;
+type AiResource = {
+  type: "SOFTR_AI";
+  model: string;
+};
+type AiAction<TId extends string = string> = Action<AiResource> & {
+  id: TId;
+};
+type AiDefinition<TId extends string> = {
+  id: TId;
+  model: string;
+  permissions: ActionPermissions;
+};
+/**
+ * Declares an AI action: a model call run by Softr on its own provider keys and billed to the
+ * workspace's AI credits, so nothing has to be connected. `model` is the id of a model from
+ * Softr's AI catalog, chosen when the app is built: read the catalog with the `list_ai_models`
+ * tool and copy the id exactly. An id outside the catalog is refused when the action is saved.
+ *
+ * Every call spends the workspace's credits, so keep the audience to signed-in users unless a
+ * public page really needs the call.
+ *
+ * Pass the returned object to `ai.generate()` or `ai.stream()` at runtime.
+ *
+ * @example
+ * const summarizeDeal = defineAiAction({
+ *   id: "summarizeDeal",
+ *   model: "anthropic-claude-sonnet-4-6",
+ *   permissions: { userGroupTypes: ["LOGGED_IN_USERS"] },
+ * })
+ *
+ * const answer = await ai.generate(summarizeDeal, { system: "...", prompt: facts })
+ */
+declare function defineAiAction<const TId extends string>(definition: AiDefinition<TId>): AiAction<TId>;
 //#endregion
-export { ActionData, ActionPermissions, ActionRecord, ActionShape, DatasourceAction, FieldTypeOf, IntegrationAction, ReadOf, ReadShape, SoftrDatasources, WorkflowAction, defineIntegration, defineMutation, defineQuery, defineWorkflow };
+export { ActionData, ActionPermissions, ActionRecord, ActionShape, AiAction, DatasourceAction, FieldTypeOf, IntegrationAction, ReadOf, ReadShape, SoftrDatasources, WorkflowAction, defineAiAction, defineIntegration, defineMutation, defineQuery, defineWorkflow };

package/dist/action.js

@@ -56,6 +56,17 @@ function isDatasourceAction(value) {
 	const resource = candidate.resource;
 	return typeof candidate.id === "string" && typeof resource === "object" && resource !== null && resource.type === "DATASOURCE";
 }
+function defineAiAction(definition) {
+	const { id, model, permissions } = definition;
+	return {
+		id,
+		resource: {
+			type: "SOFTR_AI",
+			model
+		},
+		permissions
+	};
+}
 
 //#endregion
-export { defineIntegration, defineMutation, defineQuery, defineWorkflow, isDatasourceAction };
+export { defineAiAction, defineIntegration, defineMutation, defineQuery, defineWorkflow, isDatasourceAction };

package/dist/core/ai.d.ts

@@ -0,0 +1,76 @@
+import { AiAction } from "../action.js";
+
+//#region src/core/ai.d.ts
+/** A document or image the model reads, by the URL the app holds it under: one of its own uploads, as a rule. */
+interface AiFile {
+  /** An https URL Softr may fetch. */
+  url: string;
+  /** The file's type when the URL does not say, such as `application/pdf`. */
+  mimeType?: string;
+}
+/** One earlier turn of a conversation. */
+interface AiMessage {
+  role: 'user' | 'assistant';
+  content: string;
+}
+interface AiGenerateInit {
+  /** What the model is and the rules it answers under. */
+  system?: string;
+  /** The earlier turns of a conversation, oldest first, before the prompt. Leave out for a one-shot call. */
+  messages?: ReadonlyArray<AiMessage>;
+  /** What it is asked, with the facts it is given. */
+  prompt: string;
+  /**
+   * A JSON schema the answer has to match. With it, the model is asked for JSON only and the
+   * answer comes back parsed in `json` as well as written in `text`.
+   */
+  schema?: Record<string, unknown>;
+  /** Documents and images the model reads alongside the prompt. */
+  files?: ReadonlyArray<AiFile>;
+  /** A cap on the answer's length, in tokens; Softr caps it further. */
+  maxOutputTokens?: number;
+  /**
+   * How hard a reasoning model thinks before it answers. A model that does not reason ignores it;
+   * the catalog says which do. Left out, the provider's default applies.
+   */
+  reasoning?: 'low' | 'medium' | 'high';
+  /** How varied the answer is, 0 to 1: 0 for an extraction, higher for a draft. A low default when left out. */
+  temperature?: number;
+  signal?: AbortSignal;
+}
+interface AiUsage {
+  inputTokens: number;
+  outputTokens: number;
+}
+interface AiAnswer {
+  /** The answer as the model wrote it. */
+  text: string;
+  /** The answer parsed as JSON when `schema` was given and the model kept to it; `null` otherwise. */
+  json: unknown;
+  usage: AiUsage;
+  /** The model that answered. */
+  model: string;
+}
+/**
+ * Thrown when the model call was refused or failed. `status` is the HTTP status Softr answered
+ * with; 402 means the workspace has no AI credits left.
+ */
+declare class AiError extends Error {
+  readonly status: number;
+  constructor(status: number, message: string);
+}
+/** Runs the action once and answers when the model is done. */
+declare function aiGenerate(action: AiAction, init: AiGenerateInit): Promise<AiAnswer>;
+/**
+ * Runs the action and answers while the model writes. The returned `Response` body is a stream of
+ * Server-Sent Events, one JSON object per `data:` line: `{ "text": "..." }` for each piece of the
+ * answer, then `{ "done": true, "usage": {...}, "model": "..." }`, or `{ "error": "..." }` in its
+ * place. Hand it to the browser as a `Response` with `Content-Type: text/event-stream`.
+ */
+declare function aiStream(action: AiAction, init: AiGenerateInit): Promise<Response>;
+declare const ai: {
+  generate: typeof aiGenerate;
+  stream: typeof aiStream;
+};
+//#endregion
+export { AiAnswer, AiError, AiFile, AiGenerateInit, AiMessage, AiUsage, ai };

package/dist/core/ai.js

@@ -0,0 +1,64 @@
+import { fetch } from "../fetch.js";
+import { readSessionToken } from "../auth/session.js";
+import { describeFailure, dsUrl, refererHeader } from "../datasource/record.js";
+
+//#region src/core/ai.ts
+/**
+* Thrown when the model call was refused or failed. `status` is the HTTP status Softr answered
+* with; 402 means the workspace has no AI credits left.
+*/
+var AiError = class extends Error {
+	status;
+	constructor(status, message) {
+		super(message);
+		this.name = "AiError";
+		this.status = status;
+	}
+};
+function body(init) {
+	return JSON.stringify({
+		system: init.system,
+		messages: init.messages,
+		prompt: init.prompt,
+		schema: init.schema,
+		files: init.files,
+		maxOutputTokens: init.maxOutputTokens,
+		reasoning: init.reasoning,
+		temperature: init.temperature
+	});
+}
+async function post(action, path, init) {
+	if (init.signal?.aborted) throw init.signal.reason ?? new DOMException("The operation was aborted.", "AbortError");
+	const res = await fetch(`${dsUrl(action.id)}/${path}`, {
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			"Authorization": `Bearer ${readSessionToken()}`,
+			...refererHeader()
+		},
+		body: body(init),
+		signal: init.signal
+	});
+	if (!res.ok) throw new AiError(res.status, `AI call "${action.id}" failed: ${await describeFailure(res)}`);
+	return res;
+}
+/** Runs the action once and answers when the model is done. */
+async function aiGenerate(action, init) {
+	return await (await post(action, "softr-ai/generate", init)).json();
+}
+/**
+* Runs the action and answers while the model writes. The returned `Response` body is a stream of
+* Server-Sent Events, one JSON object per `data:` line: `{ "text": "..." }` for each piece of the
+* answer, then `{ "done": true, "usage": {...}, "model": "..." }`, or `{ "error": "..." }` in its
+* place. Hand it to the browser as a `Response` with `Content-Type: text/event-stream`.
+*/
+async function aiStream(action, init) {
+	return post(action, "softr-ai/generate/stream", init);
+}
+const ai = {
+	generate: aiGenerate,
+	stream: aiStream
+};
+
+//#endregion
+export { AiError, ai };

package/dist/index.d.ts

@@ -1,7 +1,8 @@
 import { SoftrUserGroupId, SoftrUserGroups, SoftrUserProperties, User } from "./auth/user.js";
-import { ActionPermissions, SoftrDatasources, defineIntegration, defineMutation, defineQuery, defineWorkflow } from "./action.js";
+import { ActionPermissions, SoftrDatasources, defineAiAction, defineIntegration, defineMutation, defineQuery, defineWorkflow } from "./action.js";
 import { FileAttachment } from "./core/file-upload.js";
 import { FileItem, useFileUpload } from "./core/use-file-upload.js";
+import { AiAnswer, AiFile, AiGenerateInit, AiMessage, AiUsage } from "./core/ai.js";
 import { DateOptions, DateParts, DateSeparator, DateValue, FixedDateFormat, FormattedDate, Formatting, FormattingScope, WeekDay, formatDate, formatDateTime, formatNumber, useFormatting } from "./formatting.js";
 import { SoftrContext } from "./auth/context.js";
 import { AuthSettings } from "./auth/platform.js";
@@ -17,4 +18,4 @@ import { useUserTimezone } from "./timezone.js";
 import { PwaInstall, PwaPlatform, SoftrPwaHead, usePwaInstall } from "./pwa.js";
 import { DefaultErrorOverlay } from "./default-error-overlay.js";
 import { Audience } from "./route/audience.js";
-export { type ActionPermissions, Audience, type AuthOptions, type AuthSettings, AuthSettingsProvider, type DateOptions, type DateParts, type DateSeparator, type DateValue, DefaultErrorOverlay, type FieldShape, type FileAttachment, type FileItem, type FixedDateFormat, FormattedDate, type Formatting, FormattingScope, type Page, type PageSettings, type PwaInstall, type PwaPlatform, type SoftrContext, type SoftrDatasources, type SoftrFieldRegistry, SoftrPwaHead, type SoftrUserGroupId, type SoftrUserGroups, type SoftrUserProperties, type User, type WeekDay, assertRouteAccess, checkAccess, defineIntegration, defineMutation, definePage, defineQuery, defineVisibility, defineWorkflow, fieldShape, formatDate, formatDateTime, formatDuration, formatField, formatNumber, formatValue, getAuthSettings, getSoftrContext, guardRoute, initialSoftrContext, isAccessError, isAlreadyAuthenticatedError, isAuthorized, isForbiddenError, isUnauthenticatedError, pageHead, registerSoftrFields, softrAuthMiddleware, softrMcpMiddleware, toReturnPath, useAuthSettings, useCurrentUser, useFileUpload, useFormatting, useOverrides, usePwaInstall, useUserTimezone };
+export { type ActionPermissions, type AiAnswer, type AiFile, type AiGenerateInit, type AiMessage, type AiUsage, Audience, type AuthOptions, type AuthSettings, AuthSettingsProvider, type DateOptions, type DateParts, type DateSeparator, type DateValue, DefaultErrorOverlay, type FieldShape, type FileAttachment, type FileItem, type FixedDateFormat, FormattedDate, type Formatting, FormattingScope, type Page, type PageSettings, type PwaInstall, type PwaPlatform, type SoftrContext, type SoftrDatasources, type SoftrFieldRegistry, SoftrPwaHead, type SoftrUserGroupId, type SoftrUserGroups, type SoftrUserProperties, type User, type WeekDay, assertRouteAccess, checkAccess, defineAiAction, defineIntegration, defineMutation, definePage, defineQuery, defineVisibility, defineWorkflow, fieldShape, formatDate, formatDateTime, formatDuration, formatField, formatNumber, formatValue, getAuthSettings, getSoftrContext, guardRoute, initialSoftrContext, isAccessError, isAlreadyAuthenticatedError, isAuthorized, isForbiddenError, isUnauthenticatedError, pageHead, registerSoftrFields, softrAuthMiddleware, softrMcpMiddleware, toReturnPath, useAuthSettings, useCurrentUser, useFileUpload, useFormatting, useOverrides, usePwaInstall, useUserTimezone };

package/dist/index.js

@@ -1,5 +1,5 @@
 import { useFileUpload } from "./core/use-file-upload.js";
-import { defineIntegration, defineMutation, defineQuery, defineWorkflow } from "./action.js";
+import { defineAiAction, defineIntegration, defineMutation, defineQuery, defineWorkflow } from "./action.js";
 import { checkAccess, defineVisibility, isAuthorized } from "./route/visibility.js";
 import { assertRouteAccess, guardRoute, isAccessError, isAlreadyAuthenticatedError, isForbiddenError, isUnauthenticatedError } from "./route/route.js";
 import { definePage, pageHead } from "./route/page.js";
@@ -14,4 +14,4 @@ import { useUserTimezone } from "./timezone.js";
 import { DefaultErrorOverlay } from "./default-error-overlay.js";
 import { Audience } from "./route/audience.js";
 
-export { Audience, AuthSettingsProvider, DefaultErrorOverlay, FormattedDate, FormattingScope, SoftrPwaHead, assertRouteAccess, checkAccess, defineIntegration, defineMutation, definePage, defineQuery, defineVisibility, defineWorkflow, fieldShape, formatDate, formatDateTime, formatDuration, formatField, formatNumber, formatValue, getAuthSettings, getSoftrContext, guardRoute, initialSoftrContext, isAccessError, isAlreadyAuthenticatedError, isAuthorized, isForbiddenError, isUnauthenticatedError, pageHead, registerSoftrFields, softrAuthMiddleware, softrMcpMiddleware, toReturnPath, useAuthSettings, useCurrentUser, useFileUpload, useFormatting, useOverrides, usePwaInstall, useUserTimezone };
+export { Audience, AuthSettingsProvider, DefaultErrorOverlay, FormattedDate, FormattingScope, SoftrPwaHead, assertRouteAccess, checkAccess, defineAiAction, defineIntegration, defineMutation, definePage, defineQuery, defineVisibility, defineWorkflow, fieldShape, formatDate, formatDateTime, formatDuration, formatField, formatNumber, formatValue, getAuthSettings, getSoftrContext, guardRoute, initialSoftrContext, isAccessError, isAlreadyAuthenticatedError, isAuthorized, isForbiddenError, isUnauthenticatedError, pageHead, registerSoftrFields, softrAuthMiddleware, softrMcpMiddleware, toReturnPath, useAuthSettings, useCurrentUser, useFileUpload, useFormatting, useOverrides, usePwaInstall, useUserTimezone };

package/dist/mcp.d.ts

@@ -1,5 +1,5 @@
 import { DatasourceAction } from "./action.js";
-import * as _tanstack_react_start5 from "@tanstack/react-start";
+import * as _tanstack_react_start0 from "@tanstack/react-start";
 
 //#region src/mcp.d.ts
 
@@ -31,6 +31,6 @@ type SoftrMcpOptions = {
  *   ],
  * }))
  */
-declare function softrMcpMiddleware(options?: SoftrMcpOptions): _tanstack_react_start5.RequestMiddlewareAfterServer<{}, undefined, undefined>;
+declare function softrMcpMiddleware(options?: SoftrMcpOptions): _tanstack_react_start0.RequestMiddlewareAfterServer<{}, undefined, undefined>;
 //#endregion
 export { softrMcpMiddleware };

package/dist/package.js

@@ -1,5 +1,5 @@
 //#region package.json
-var version = "0.0.82";
+var version = "0.0.83-alpha.0";
 
 //#endregion
 export { version };

package/dist/server.d.ts

@@ -1,8 +1,9 @@
 import { upload } from "./core/file-upload.js";
+import { AiError, ai } from "./core/ai.js";
 import { auth } from "./auth/server.js";
 import { FieldChoice, RecordOption, RecordOptions } from "./core/options.js";
 import { ds } from "./datasource/datasource.js";
 import { workflow } from "./core/workflow.js";
 import { integration } from "./core/integration.js";
 import "@tanstack/react-start/server-only";
-export { type FieldChoice, type RecordOption, type RecordOptions, auth, ds, integration, upload, workflow };
+export { AiError, type FieldChoice, type RecordOption, type RecordOptions, ai, auth, ds, integration, upload, workflow };

package/dist/server.js

@@ -3,6 +3,7 @@ import { ds } from "./datasource/datasource.js";
 import { auth } from "./auth/server.js";
 import { workflow } from "./core/workflow.js";
 import { integration } from "./core/integration.js";
+import { AiError, ai } from "./core/ai.js";
 import "@tanstack/react-start/server-only";
 
-export { auth, ds, integration, upload, workflow };
+export { AiError, ai, auth, ds, integration, upload, workflow };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softr/sdk",
-  "version": "0.0.82",
+  "version": "0.0.83-alpha.0",
   "type": "module",
   "exports": {
     ".": { "types": "./dist/index.d.ts", "import": "./dist/index.js" },

package/skills/softr-sdk/SKILL.md

@@ -18,6 +18,7 @@ metadata:
 > **CRITICAL**: The SDK is split across four entrypoints and the split is enforced. `ds` and `auth` exist only on `@softr/sdk/server` and only run inside a `createServerFn` handler. Importing them anywhere else fails the build.
 > **CRITICAL**: Every route file must declare its audience with `defineVisibility` and guard itself with that rule in `beforeLoad`. There is no default and nothing is inherited from a sibling.
 > **CRITICAL**: The app is already wired. `src/start.ts`, `src/router.tsx` and `src/routes/__root.tsx` register `softrAuthMiddleware` and resolve the session. Do not add a second registration of it. `softrMcpMiddleware` is the one thing an app adds to `src/start.ts` itself — load the `softr-sdk/mcp` sub-skill before doing so.
+> **CRITICAL**: `ai.generate` and `ai.stream` live on `@softr/sdk/server` and only run inside a `createServerFn` handler. Use `defineAiAction` from `@softr/sdk` to declare the action with the model it runs on, an id copied from the `ai_list_models` tool. Softr runs the model on its own keys; never ask the user for an API key for the app's own AI feature. Load the `softr-sdk/ai` sub-skill for the full pattern.
 > **CRITICAL**: `workflow.trigger` lives on `@softr/sdk/server` and only runs inside a `createServerFn` handler. Use `defineWorkflow` from `@softr/sdk` to declare the action, then pass it to `workflow.trigger`. Load the `softr-sdk/workflows` sub-skill for the full pattern.
 
 Each sub-skill stands alone for its task and repeats the boundary above, so most work needs **one** sub-skill and not this file. Load this one when you are unsure which sub-skill applies, or when the wiring below is what you are touching. Add a second sub-skill only when the work genuinely crosses that boundary: a page that lists records behind a group restriction needs `record-queries` plus `routes-and-visibility`.
@@ -26,8 +27,8 @@ Each sub-skill stands alone for its task and repeats the boundary above, so most
 
 | Import | Runs | Holds |
 | --- | --- | --- |
-| `@softr/sdk` | Both | `defineQuery`, `defineMutation`, `defineVisibility`, `guardRoute`, `assertRouteAccess`, `isAuthorized`, `checkAccess`, `Audience`, `useCurrentUser`, `useUserTimezone`, `FormattedDate`, `FormattingScope`, `useFormatting`, `formatDate`, `formatDateTime`, `formatNumber`, `formatValue`, `formatField`, `fieldShape`, `registerSoftrFields`, `useOverrides`, `SoftrPwaHead`, `usePwaInstall`, `getSoftrContext`, `initialSoftrContext`, `softrAuthMiddleware`, the error predicates, and every type |
-| `@softr/sdk/server` | Server only | `ds`, `auth`, `workflow`, `integration` |
+| `@softr/sdk` | Both | `defineQuery`, `defineMutation`, `defineAiAction`, `defineVisibility`, `guardRoute`, `assertRouteAccess`, `isAuthorized`, `checkAccess`, `Audience`, `useCurrentUser`, `useUserTimezone`, `FormattedDate`, `FormattingScope`, `useFormatting`, `formatDate`, `formatDateTime`, `formatNumber`, `formatValue`, `formatField`, `fieldShape`, `registerSoftrFields`, `useOverrides`, `SoftrPwaHead`, `usePwaInstall`, `getSoftrContext`, `initialSoftrContext`, `softrAuthMiddleware`, the error predicates, and every type |
+| `@softr/sdk/server` | Server only | `ds`, `auth`, `workflow`, `integration`, `ai` |
 | `@softr/sdk/client` | Browser only | `useFileUpload` |
 | `@softr/sdk/vite` | Build | `softr()`, already in `vite.config.ts` |
 
@@ -43,7 +44,8 @@ Each sub-skill stands alone for its task and repeats the boundary above, so most
 | Create, update or delete a record | [record-mutations/SKILL.md](./record-mutations/SKILL.md) |
 | Trigger a Softr workflow | [workflows/SKILL.md](./workflows/SKILL.md) |
 | Sign a visitor in, out, or up | [auth/SKILL.md](./auth/SKILL.md) |
-| Call a connected third-party API (Slack, Stripe, Gmail, …) | [integrations/SKILL.md](./integrations/SKILL.md) |
+| Ask an AI model: a summary, an extraction from a document, a classification, a draft, a chat | [ai/SKILL.md](./ai/SKILL.md) |
+| Call a connected third-party API (Slack, Stripe, Gmail, …), or an AI model on the user's own provider account | [integrations/SKILL.md](./integrations/SKILL.md) |
 | Open the app to AI assistants over MCP | [mcp/SKILL.md](./mcp/SKILL.md) |
 | Let visitors install the app on their home screen | [pwa/SKILL.md](./pwa/SKILL.md) |
 | Show a date, a time or a number | [formatting/SKILL.md](./formatting/SKILL.md) |
@@ -75,9 +77,15 @@ Triggering a Softr workflow from a button or form?
 Wiring a login, signup, or sign-out?
   load softr-sdk/auth
 
+Asking an AI model for anything: a summary, fields out of a document, a classification, a draft, a chat?
+  load softr-sdk/ai — Softr runs the model on its own keys, nothing to connect; pick the model from ai_list_models
+
 Calling a connected third-party API (Slack, Stripe, Gmail, Google Calendar, …)?
   load softr-sdk/integrations
 
+Running a model on the user's OWN provider account, because they chose that for the feature?
+  load softr-sdk/integrations: its "Calling an AI model" section
+
 Opening the app to an AI assistant over MCP?
   load softr-sdk/mcp
 

package/skills/softr-sdk/ai/SKILL.md

@@ -0,0 +1,168 @@
+---
+name: ai
+description: >-
+  Run an AI model from the app on Softr's own keys, billed to the workspace's
+  AI credits, with nothing to connect: defineAiAction from @softr/sdk declares
+  the action with the catalog model it runs on and its permissions;
+  ai.generate from @softr/sdk/server runs it with a system text, a prompt, an
+  optional JSON schema for an answer that is data, and optional files;
+  ai.stream runs it for an answer the user watches being written. Load this
+  for a summary, an extraction, a classification, a draft, or a chat the app
+  asks a model for, before you decide whether a feature runs on Softr AI
+  or on the user's own account, and before you change the model it runs on.
+metadata:
+  type: sub-skill
+  library: softr-sdk
+  library_version: 0.0.79-alpha.0
+---
+
+**Boundary.** `ai` lives on `@softr/sdk/server` and runs only inside a `createServerFn` handler — importing it into a component fails the build. `defineAiAction` and every type come from `@softr/sdk` and can be imported anywhere.
+
+# AI
+
+An app asks a model through an AI action. Softr runs the call on its own provider keys and bills the workspace's AI credits, so there is no key to ask the user for and nothing to connect. This is the default for every AI feature of the app's own — a summary of a record, fields extracted from a document, a classification, a draft, a chat. The other path is the user's own provider account, through a connected integration: the `integrations` sub-skill. An app can hold both: each feature carries its own choice in its code.
+
+## Decide who runs it first
+
+Never choose silently between Softr AI and the user's own account. Decide for each AI feature, before you write its code, in this order:
+
+1. The user said who runs it: follow it. "My OpenAI key" or "our Anthropic account", with exactly one integration of that type in `integration_list`: use that one, without asking. A new key of a provider they named — they asked for a new one, or the workspace holds none of that type — is one `requestinput` of type `integration` for that type: its card connects one. A connected key runs the feature; a skipped request means Softr AI, and you say so. Several keys of that type, or "my own key" with no provider: ask (step 4). A provider or a model named without "my" or "our" ("use Claude", "summarise with GPT") is a model preference on Softr AI, not a reason to ask.
+2. The app already has AI features: follow the choice they made, and say so in one line.
+3. `integration_list` shows no `OPEN_AI`, `ANTHROPIC_AI` or `GEMINI_AI` integration: use Softr AI, and say so in one line. Call the tool; do not assume the answer.
+4. Otherwise ask with one `requestinput` of type `aiProvider`. Its card lists every key the workspace holds and every provider to connect, unfiltered. The answer is Softr AI, or the integration with its id and type: follow it, even when it is another provider than the one the user named. A declined request means Softr AI: use it, and say so in one line.
+
+Never ask who runs a feature, or which key, with the `question` tool: its free-text answer invites the user to type a key into the chat.
+
+Ask at most once per turn. A turn that builds several AI features sends one request, and its `feature` names every one of them in the user's words: "Deal summary and lead tagging". It holds the names only, never the provider, the key or how the feature runs, because the card asks exactly that: "Product chat", not "Product chat, using an OpenAI key".
+
+An own-account answer leaves this skill: the call goes through `defineIntegration`, as the `integrations` sub-skill describes.
+
+## Choose the model
+
+The model is chosen when the app is built and frozen in its code. Before you declare an action, read Softr's catalog with the `ai_list_models` tool: the most recent models of each provider. Each entry carries the `id` the action names, the `provider`, `bestFor`, what to pick it for, `reads`, what it reads beside text, and `reasoning`, whether it thinks before it answers. (`providerModelId` is for the own-account path of the `integrations` sub-skill, never for `defineAiAction`.)
+
+- by default — a chat, an assistant, a summary, a briefing, a draft: a mid-tier model, `anthropic`'s newest one between its cheapest and strongest. When the user named another provider, that provider's mid-tier model;
+- an extraction or a classification: the cheapest model whose `reads` covers what it is given — an image or a PDF needs `IMAGE`;
+- the strongest model listed only when the user asks for more quality.
+
+Copy the `id` exactly from the tool's answer. An id outside the catalog is refused when the action is saved, and a model spelled from memory, or taken from an example, never is in it.
+
+## Changing it later
+
+A model change asked in chat ("use a cheaper model", "try Gemini") edits the `model` of the feature's action, or, on the user's own account, the `providerModelId` its call sends. Read `ai_list_models` again and copy the new id. It never sends an `aiProvider` request. On the user's own account the new model is one of that account's provider: a model of another provider, or a switch to the user's own key, changes who runs it, so follow step 1 of the order above.
+
+## Say it
+
+The plan and the closing message give one line per AI feature built or changed: who runs it, its model, what it bills — Softr AI uses the workspace's AI credits, the user's own key is billed by its provider — and that the user can ask to switch the model or to use their own OpenAI, Anthropic or Gemini key. For example: "Deal summary runs on Softr AI with <the model> and uses your workspace's AI credits. Ask me to switch the model or to use your own OpenAI, Anthropic or Gemini key."
+
+## Declare the action
+
+```ts
+const summarizeDeal = defineAiAction({
+  id: 'summarizeDeal',
+  model: '<an id from ai_list_models>',
+  permissions: { userGroupTypes: ['LOGGED_IN_USERS'] },
+})
+```
+
+Write the object inline in `defineAiAction`. Passing it through a variable widens the types.
+
+**Every call spends the workspace's credits.** Keep the audience to `['LOGGED_IN_USERS']`, narrowed with `customGroups` where the feature is for some users only. Open an AI action to visitors only when a public page really needs it, and say so to the user: anyone on the internet can then bill the workspace.
+
+Declare one action per feature — the summary and the extraction are two actions, each with its own `id`, its own model and its own audience.
+
+## Core pattern: an answer the server reads
+
+`ai.generate(action, init)` runs the action and answers when the model is done. `init` takes:
+
+- `prompt` — what the model is asked, with the facts it is given. Required.
+- `system` — what the model is and the rules it answers under.
+- `schema` — a JSON schema the answer has to match. With it the model is asked for JSON only, and the answer comes back parsed in `json` as well as written in `text`.
+- `files` — documents and images the model reads, each as `{ url, mimeType? }`: an `https` URL Softr may fetch, one of the app's own uploads as a rule.
+- `maxOutputTokens` — a cap on the answer's length. Softr caps it further.
+- `messages` — the earlier turns of a conversation, oldest first, each `{ role: 'user' | 'assistant', content }`. The prompt is the newest turn. Leave out for a one-shot call.
+- `reasoning` — `'low'`, `'medium'` or `'high'`: how hard a reasoning model thinks before it answers. The catalog says which models reason; the others ignore it. Leave out for the provider's default.
+- `temperature` — 0 to 1: how varied the answer is. `0` for an extraction or a classification, around `0.7` for a draft. A low default when left out.
+
+The answer is `{ text, json, usage, model }`: `text` as the model wrote it, `json` parsed when a schema was given and the model kept to it, `null` otherwise.
+
+```ts
+const summarize = createServerFn({ method: 'POST' })
+  .validator(z.object({ recordId: z.string() }))
+  .handler(async ({ data }) => {
+    const deal = await ds.get(dealQuery, { id: data.recordId })
+    if (deal === null) throw new Error('This deal no longer exists')
+    const facts = [`Name: ${fieldText(deal.fields.name)}`, `Stage: ${fieldText(deal.fields.stage)}`].join('\n')
+    const answer = await ai.generate(summarizeDeal, {
+      system: 'You brief a sales team. Use only the facts given; say what is missing rather than invent it.',
+      prompt: facts,
+      maxOutputTokens: 800,
+    })
+    return answer.text
+  })
+```
+
+## Extraction: an answer that is data
+
+A document dropped on the app, fields pulled out of it, a record created — the model reads the file and answers in the shape the record needs. Give it the schema and the file; validate the parsed answer before writing it, since a model may stray from the shape.
+
+```ts
+const InvoiceFields = z.object({ vendor: z.string(), total: z.number(), issuedOn: z.string() })
+
+const extractInvoice = createServerFn({ method: 'POST' })
+  .validator(z.object({ fileUrl: z.string().url() }))
+  .handler(async ({ data }) => {
+    const answer = await ai.generate(readInvoice, {
+      system: 'Read the invoice and answer with its fields. Dates as YYYY-MM-DD, amounts as numbers.',
+      prompt: 'Extract the vendor, the total and the issue date.',
+      schema: {
+        type: 'object',
+        properties: { vendor: { type: 'string' }, total: { type: 'number' }, issuedOn: { type: 'string' } },
+        required: ['vendor', 'total', 'issuedOn'],
+      },
+      files: [{ url: data.fileUrl, mimeType: 'application/pdf' }],
+    })
+    const parsed = InvoiceFields.safeParse(answer.json)
+    if (!parsed.success) throw new Error('The invoice could not be read. Try a clearer scan.')
+    return ds.create(createInvoice, { data: parsed.data })
+  })
+```
+
+The file's URL comes from the app's own upload: load the Softr SDK `file-uploads` guidance for that half. `readInvoice` names a model whose `bestFor` reads PDF documents.
+
+## Streaming: an answer the user watches being written
+
+A chat, an assistant, a long draft shown as it is typed — never buffer these: the user would watch a blank panel until the last token. A chat box the user types into is always this case, never `ai.generate`. `ai.stream(action, init)` takes the same `init` and answers with a `Response` whose body is a stream of Server-Sent Events. Hand it to the browser from the server function, unchanged:
+
+```ts
+const draftReply = createServerFn({ method: 'POST' })
+  .validator(z.object({ prompt: z.string() }))
+  .handler(async ({ data }) => {
+    const res = await ai.stream(draftAction, { system: 'You write replies for a support team.', prompt: data.prompt })
+    return new Response(res.body, { headers: { 'Content-Type': 'text/event-stream' } })
+  })
+```
+
+Each event is one JSON object on a `data:` line:
+
+- `{ "text": "..." }` — the next piece of the answer; append it.
+- `{ "done": true, "usage": { "inputTokens", "outputTokens" }, "model": "..." }` — the answer is complete.
+- `{ "error": "..." }` — in place of `done`, when the call ended before its answer: show the message.
+
+On the client, call the server function's URL with `fetch`, read `response.body` with a stream reader, split on blank lines, and parse the JSON after `data:`. A conversation sends its earlier turns in `messages`; the app keeps them, the model holds nothing between calls.
+
+## Failure modes
+
+**Calling from client code.** `ai` is server-only. Importing it into a component or calling it outside a `createServerFn` handler fails the build or has no request context to act on.
+
+**Spelling a model id.** `model` is copied from `ai_list_models`, never written from memory. An id outside the catalog fails the save of the action, so the app cannot be published with it.
+
+**No credits left.** `ai.generate` and `ai.stream` throw an `AiError` whose `status` is `402` when the workspace has no AI credits. Show its message to the user; the workspace owner tops the credits up in Softr. Any other refusal carries its status and reason the same way.
+
+**Trusting `json` without checking it.** A model may stray from the schema; `json` is then `null`, or a shape close to the one asked. Validate it with `zod` before writing it to a record, and keep `text` as the fallback the user can read.
+
+**Buffering a chat.** A chat built on `ai.generate` shows nothing until the whole reply is done, and the user reads "replies appear all at once" in your closing message. A chat streams.
+
+**Reading a streamed body with `res.json()`.** The body of `ai.stream` is an event stream, not one JSON document. Return `res.body` in a `Response` or read it with a stream reader.
+
+**Asking for the user's API key.** An AI feature of the app's own needs none. Only when the user chose their own provider account for the feature does the call go through a connected integration — load the `integrations` sub-skill then.

package/skills/softr-sdk/integrations/SKILL.md

@@ -127,9 +127,11 @@ Do not add an `Authorization` key to `headers` — Softr injects the integration
 
 ## Calling an AI model
 
-A button on one record that hands its fields to the model and shows the answer is the `ai-action` pattern:
-it carries this call and the model id, so write the call by hand only for another shape — a batch, a chat,
-a field the model fills on create. An AI integration is called like any other. For `ANTHROPIC_AI`, the action is `POST` on
+**This is the path for the user's own provider account only.** An AI feature of the app's own — a summary, an extraction, a chat — runs on Softr's keys through an AI action, with nothing to connect and no key to ask for: load the `ai` sub-skill for it. Call a model through an integration only when the user chose their own OpenAI, Anthropic or Gemini account for the feature, in the prompt or when asked, and had it connected.
+
+**The model id comes from `ai_list_models`, never from memory.** Each entry of that list carries `providerModelId`, the id the provider's own API accepts, and `provider`: `anthropic` for an `ANTHROPIC_AI` integration, `openai` for `OPEN_AI`, `google_ai` for `GEMINI_AI`. Pick an entry of the integration's provider as the `ai` sub-skill's "Choose the model" says, and send its `providerModelId`. An id spelled from memory (`claude-3-5-…`, `gpt-4o`) names a model that no longer answers, and the error only shows up when the button is pressed.
+
+An AI integration is called like any other. For `ANTHROPIC_AI`, the action is `POST` on
 `https://api.anthropic.com/v1/messages`, the request carries the `anthropic-version` header and a body of
 `model`, `max_tokens`, `system` and `messages`, and the answer's text is in `content[].text`:
 
@@ -146,7 +148,7 @@ const claude = integration.createFetcher(askClaude)
 const res = await claude({
   headers: { 'Content-Type': 'application/json', 'anthropic-version': '2023-06-01' },
   body: JSON.stringify({
-    model: 'claude-opus-5-5',
+    model: '<providerModelId of an anthropic entry of ai_list_models>',
     max_tokens: 1024,
     system: 'You write a short briefing for a sales team. Use only the facts given.',
     messages: [{ role: 'user', content: facts }],
@@ -157,10 +159,7 @@ const body = (await res.json()) as { content: Array<{ type: string; text?: strin
 const text = body.content.flatMap((block) => (block.type === 'text' && block.text ? [block.text] : [])).join('')
 ```
 
-**Use the model id above as it is written here.** Model ids are not derivable: one spelled from memory
-(`claude-3-5-…`, `claude-sonnet-4-…`) names a model that no longer answers, and the error only shows up when
-the button is pressed. `claude-opus-5-5` is the current default; `claude-sonnet-5-5` is the cheaper one for a
-short summary.
+For `OPEN_AI`, the action is `POST` on `https://api.openai.com/v1/chat/completions` with a body of `model` and `messages` (the system text as the first message, role `system`); the answer's text is in `choices[0].message.content`. For `GEMINI_AI`, the action is `POST` on `https://generativelanguage.googleapis.com/v1beta/models/<providerModelId>:generateContent` with a body of `contents` (`[{ role: 'user', parts: [{ text }] }]`) and an optional `systemInstruction`; the answer's text is in `candidates[0].content.parts[].text`. Read the answer defensively: a refusal or an empty answer leaves the text out.
 
 ## Base URLs by integration type