@softr/sdk 0.0.90-alpha.6 → 0.0.90-alpha.7

package/dist/auth/isomorphic.d.ts

@@ -2,7 +2,7 @@ import { User } from "./user.js";
 import { Formatting } from "../formatting.js";
 import { Permissions } from "./permissions.js";
 import { SoftrContext } from "./context.js";
-import * as react0 from "react";
+import * as react3 from "react";
 import { ReactNode } from "react";
 import * as _tanstack_react_start0 from "@tanstack/react-start";
 
@@ -104,7 +104,7 @@ declare function AuthSettingsProvider({
 }: {
   value: AuthOptions;
   children?: ReactNode;
-}): react0.JSX.Element;
+}): react3.JSX.Element;
 /**
  * Which ways in this app offers. Requires an {@link AuthSettingsProvider}
  * above it.

package/dist/auth/server.js

@@ -1,4 +1,5 @@
 import { settings } from "./methods/settings.js";
+import { currentUserRow } from "./current-user-row.js";
 import { confirmAuthenticatorSetup, removeAuthenticator, resetAuthenticator, sendAuthenticatorResetCode, skipAuthenticatorSetup, startAuthenticatorSetup, verifyAuthenticator } from "./methods/authenticator.js";
 import { sendSignInCode, signInWithCode } from "./methods/code.js";
 import { signInWithMagicLink } from "./methods/magicLink.js";
@@ -7,7 +8,6 @@ import { checkPasswordLink, requestPasswordReset, setPasswordWithLink } from "./
 import { confirmSignUp, signUp } from "./methods/signup.js";
 import { signInWithGoogle } from "./methods/social.js";
 import { removeAvatar, updateProfile } from "./methods/profile.js";
-import { currentUserRow } from "./current-user-row.js";
 import "@tanstack/react-start/server-only";
 
 //#region src/auth/server.ts

package/dist/datasource/record.js

@@ -30,6 +30,15 @@ function refererHeader() {
 	const referer = getRequestHeader("referer");
 	return { Referer: referer !== void 0 && URL.parse(referer)?.origin === page.origin ? referer : page.href };
 }
+/** A datasource call the service refused. `status` is its HTTP status. */
+var DatasourceError = class extends Error {
+	status;
+	constructor(message, status) {
+		super(message);
+		this.name = "DatasourceError";
+		this.status = status;
+	}
+};
 async function describeFailure(res) {
 	const body = await res.json().catch(() => null);
 	const message = typeof body === "object" && body !== null && "message" in body ? body.message : null;
@@ -235,7 +244,7 @@ async function updateRecord(action, options) {
 		},
 		body: JSON.stringify({ fields: rawFields })
 	});
-	if (!res.ok) throw new Error(`datasource update failed for action "${actionId}": ${await describeFailure(res)}`);
+	if (!res.ok) throw new DatasourceError(`datasource update failed for action "${actionId}": ${await describeFailure(res)}`, res.status);
 	const record = await res.json();
 	return {
 		id: record.id,
@@ -257,7 +266,7 @@ async function deleteRecord(action, options) {
 			...refererHeader()
 		}
 	});
-	if (!res.ok) throw new Error(`datasource delete failed for action "${actionId}": ${await describeFailure(res)}`);
+	if (!res.ok) throw new DatasourceError(`datasource delete failed for action "${actionId}": ${await describeFailure(res)}`, res.status);
 }
 function resolveTarget(subject, operation) {
 	const declaredBy = operation === "read" ? "defineQuery" : "defineMutation";
@@ -281,4 +290,4 @@ function dealiasData(data, select) {
 }
 
 //#endregion
-export { createRecord, deleteRecord, describeFailure, dsUrl, getRecord, listRecords, refererHeader, resolveTarget, updateRecord };
+export { DatasourceError, createRecord, deleteRecord, describeFailure, dsUrl, getRecord, listRecords, refererHeader, resolveTarget, updateRecord };

package/dist/mcp.d.ts

@@ -1,9 +1,9 @@
-import { DatasourceAction } from "./action.js";
+import { DatasourceAction, ReadShape } from "./action.js";
 import * as _tanstack_react_start6 from "@tanstack/react-start";
 
 //#region src/mcp.d.ts
 
-type SoftrMcpOptions = {
+type SoftrMcpOptions<TUsers extends ReadShape = ReadShape> = {
   /**
    * The actions to expose as tools, from `defineQuery` and `defineMutation`.
    *
@@ -12,6 +12,19 @@ type SoftrMcpOptions = {
    * decide who may run the ones that are listed.
    */
   actions?: Array<DatasourceAction>;
+  /**
+   * Fills the owner of a person's record from who is calling, the way the app's
+   * pages do with `auth.currentUserRow`. The field is left out of the tool, so
+   * the assistant can't leave it wrong or name someone else.
+   */
+  owner?: SoftrMcpOwner<TUsers>;
+};
+type SoftrMcpOwner<TUsers extends ReadShape = ReadShape> = {
+  /** The people table, and its email field, to find the caller's row in. */
+  users: DatasourceAction<TUsers>;
+  email: keyof TUsers["fields"] & string;
+  /** Listed create or update action id to the field that links to the caller's row. */
+  fields: Record<string, string>;
 };
 /**
  * Serves the MCP endpoint and its OAuth flow from the app's own origin.
@@ -31,6 +44,6 @@ type SoftrMcpOptions = {
  *   ],
  * }))
  */
-declare function softrMcpMiddleware(options?: SoftrMcpOptions): _tanstack_react_start6.RequestMiddlewareAfterServer<{}, undefined, undefined>;
+declare function softrMcpMiddleware<TUsers extends ReadShape>(options?: SoftrMcpOptions<TUsers>): _tanstack_react_start6.RequestMiddlewareAfterServer<{}, undefined, undefined>;
 //#endregion
 export { softrMcpMiddleware };

package/dist/mcp.js

@@ -5,8 +5,10 @@ import { softrConfig } from "./softr-config.js";
 import { sessionConfig } from "./auth/config.js";
 import { readSessionToken, withSessionToken } from "./auth/session.js";
 import { isDatasourceAction } from "./action.js";
+import { DatasourceError } from "./datasource/record.js";
 import { makePlatform } from "./auth/platform.js";
 import { ds } from "./datasource/datasource.js";
+import { currentUserRow } from "./auth/current-user-row.js";
 import { z } from "zod";
 import { createMiddleware } from "@tanstack/react-start";
 
@@ -48,6 +50,14 @@ function softrMcpMiddleware(options = {}) {
 		assert(!actions.has(value.id), `two actions share the id "${value.id}"`);
 		actions.set(value.id, value);
 	}
+	const owner = options.owner;
+	for (const [actionId, field] of Object.entries(owner?.fields ?? {})) {
+		const action = actions.get(actionId);
+		assert(action, `owner names "${actionId}", which is not a listed action`);
+		const { operation, fields } = action.resource;
+		assert(operation === "create" || operation === "update", `owner fills "${actionId}", which is a ${operation}`);
+		assert(field in (fields ?? {}), `"${actionId}" has no field "${field}" for the owner`);
+	}
 	return createMiddleware({ type: "request" }).server(async ({ next, request }) => {
 		const url = new URL(request.url);
 		const origin = url.origin;
@@ -71,7 +81,7 @@ function softrMcpMiddleware(options = {}) {
 			});
 			case AUTHORIZE_PATH: return await authorize(request, login);
 			case TOKEN_PATH: return await issueToken(request);
-			case MCP_PATH: return await rpc(request, origin, actions);
+			case MCP_PATH: return await rpc(request, origin, actions, owner);
 			default: return await next();
 		}
 	});
@@ -258,10 +268,11 @@ const MAX_LIMIT = 100;
 * that only ever reads one datasource exposes one read, even though its
 * credentials would allow more.
 */
-function describeTool(action) {
+function describeTool(action, ownerField) {
 	const { operation, fields } = action.resource;
 	const names = Object.keys(fields ?? {});
-	const fieldProps = Object.fromEntries(names.map((name) => [name, { description: `The "${name}" field.` }]));
+	const writable = names.filter((name) => name !== ownerField);
+	const fieldProps = Object.fromEntries(writable.map((name) => [name, { description: `The "${name}" field.` }]));
 	switch (operation) {
 		case "read": return {
 			name: action.id,
@@ -287,7 +298,7 @@ function describeTool(action) {
 		};
 		case "create": return {
 			name: action.id,
-			description: `Create a record with "${action.id}". Writable fields: ${names.join(", ")}.`,
+			description: `Create a record with "${action.id}". Writable fields: ${writable.join(", ")}.`,
 			inputSchema: {
 				type: "object",
 				properties: fieldProps,
@@ -296,7 +307,7 @@ function describeTool(action) {
 		};
 		case "update": return {
 			name: action.id,
-			description: `Update a record with "${action.id}". Writable fields: ${names.join(", ")}.`,
+			description: `Update a record with "${action.id}". Writable fields: ${writable.join(", ")}.`,
 			inputSchema: {
 				type: "object",
 				properties: {
@@ -332,7 +343,7 @@ function describeTool(action) {
 * visitor's user groups exactly as it would a click in the app. Nothing here
 * decides what is allowed.
 */
-async function runTool(action, args) {
+async function runTool(action, args, owner) {
 	const typed = action;
 	switch (action.resource.operation) {
 		case "read": {
@@ -344,13 +355,21 @@ async function runTool(action, args) {
 				nextOffset: result$1.nextOffset
 			};
 		}
-		case "create": return await ds.create(typed, { data: writableFields(action, args) });
+		case "create": {
+			const data = writableFields(action, args, owner?.field);
+			if (owner !== null) {
+				const row = await owner.row();
+				if (row === null) throw new Error("The visitor has no row in the people table, so this record can't be created for them.");
+				data[owner.field] = { id: row.id };
+			}
+			return await ds.create(typed, { data });
+		}
 		case "update": {
 			const { id,...data } = args;
 			assert(typeof id === "string" && id !== "", "update needs a record id");
 			return await ds.update(typed, {
 				id,
-				data: writableFields(action, data)
+				data: writableFields(action, data, owner?.field)
 			});
 		}
 		case "delete": {
@@ -361,8 +380,19 @@ async function runTool(action, args) {
 		}
 	}
 }
+function ownerFieldOf(owner, actionId) {
+	return owner !== void 0 && Object.hasOwn(owner.fields, actionId) ? owner.fields[actionId] : void 0;
+}
+function ownerFill(owner, actionId, sessionToken) {
+	const field = ownerFieldOf(owner, actionId);
+	if (owner === void 0 || field === void 0) return null;
+	return {
+		field,
+		row: async () => currentUserRow(await resolveUser(sessionToken), owner.users, owner.email)
+	};
+}
 /**
-* Only the fields the action declared.
+* Only the fields the action declared, less the owner it fills itself.
 *
 * `additionalProperties: false` in the tool schema is a hint to the model, not
 * a check — a client can send whatever it likes. An unlisted key reaches the
@@ -370,9 +400,18 @@ async function runTool(action, args) {
 * straight through. So the action's field list gets enforced here, or it isn't
 * a boundary at all.
 */
-function writableFields(action, args) {
+function writableFields(action, args, ownerField) {
 	const allowed = action.resource.fields ?? {};
-	return Object.fromEntries(Object.entries(args).filter(([name]) => name in allowed));
+	return Object.fromEntries(Object.entries(args).filter(([name]) => name in allowed && name !== ownerField));
+}
+/**
+* The error as the assistant should read it. A row rule that keeps the caller
+* from changing a record answers 404, the same as a deleted record, so a bare
+* "not found" would leave the assistant guessing.
+*/
+function describeError(error) {
+	if (error instanceof DatasourceError && error.status === 404) return "Refused: this record doesn't exist, or the visitor's user group may not change it. If it still shows in a read, it is a permission. Tell the visitor they don't have access to this action, and that the app's builder can grant it.";
+	return error instanceof Error ? error.message : String(error);
 }
 function clampLimit(raw) {
 	if (typeof raw !== "number" || !Number.isInteger(raw)) return DEFAULT_LIMIT;
@@ -382,7 +421,7 @@ function clampOffset(raw) {
 	if (typeof raw !== "number" || !Number.isInteger(raw) || raw < 0) return null;
 	return raw;
 }
-async function rpc(request, origin, actions) {
+async function rpc(request, origin, actions, owner) {
 	if (request.method !== "POST") return methodNotAllowed("POST");
 	const token = bearerToken(request);
 	if (token === null) return unauthorized(origin);
@@ -419,7 +458,7 @@ async function rpc(request, origin, actions) {
 				}
 			});
 		}
-		case "tools/list": return result(id, { tools: [WHOAMI, ...[...actions.values()].map(describeTool)] });
+		case "tools/list": return result(id, { tools: [WHOAMI, ...[...actions.values()].map((action) => describeTool(action, ownerFieldOf(owner, action.id)))] });
 		case "tools/call": {
 			const name = params?.name;
 			const args = typeof params?.arguments === "object" && params.arguments !== null ? params.arguments : {};
@@ -431,13 +470,13 @@ async function rpc(request, origin, actions) {
 			const action = typeof name === "string" ? actions.get(name) : void 0;
 			if (action === void 0) return failure(id, -32602, `Unknown tool: ${String(name)}`);
 			try {
-				return result(id, toolResult(await withSessionToken(sessionToken, () => runTool(action, args))));
+				return result(id, toolResult(await withSessionToken(sessionToken, () => runTool(action, args, ownerFill(owner, action.id, sessionToken)))));
 			} catch (error) {
 				return result(id, {
 					isError: true,
 					content: [{
 						type: "text",
-						text: error instanceof Error ? error.message : String(error)
+						text: describeError(error)
 					}]
 				});
 			}

package/dist/package.js

@@ -1,5 +1,5 @@
 //#region package.json
-var version = "0.0.90-alpha.6";
+var version = "0.0.90-alpha.7";
 
 //#endregion
 export { version };

package/package.json

@@ -1,16 +1,37 @@
 {
   "name": "@softr/sdk",
-  "version": "0.0.90-alpha.6",
+  "version": "0.0.90-alpha.7",
   "type": "module",
   "exports": {
-    ".": { "types": "./dist/index.d.ts", "import": "./dist/index.js" },
-    "./client": { "types": "./dist/client.d.ts", "import": "./dist/client.js" },
-    "./server": { "types": "./dist/server.d.ts", "import": "./dist/server.js" },
-    "./vite": { "types": "./dist/vite.d.ts", "import": "./dist/vite.js" }
-  },
-  "bin": { "softr-sdk": "./dist/cli.js" },
-  "files": ["dist", "schema", "skills", "!skills/_artifacts"],
-  "publishConfig": { "access": "public" },
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./client": {
+      "types": "./dist/client.d.ts",
+      "import": "./dist/client.js"
+    },
+    "./server": {
+      "types": "./dist/server.d.ts",
+      "import": "./dist/server.js"
+    },
+    "./vite": {
+      "types": "./dist/vite.d.ts",
+      "import": "./dist/vite.js"
+    }
+  },
+  "bin": {
+    "softr-sdk": "./dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "schema",
+    "skills",
+    "!skills/_artifacts"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
   "scripts": {
     "build": "tsdown",
     "test": "node --import ./src/test-utils/setup.ts --test",
@@ -42,7 +63,9 @@
       "optional": true
     }
   },
-  "keywords": ["tanstack-intent"],
+  "keywords": [
+    "tanstack-intent"
+  ],
   "intent": {
     "version": 1,
     "repo": "@softr/sdk",

package/skills/softr-sdk/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: core
   library: softr-sdk
-  library_version: 0.0.90-alpha.6
+  library_version: 0.0.90-alpha.7
 ---
 
 # Softr SDK core

package/skills/softr-sdk/agent-chat/SKILL.md

@@ -1,15 +1,15 @@
 ---
 name: agent-chat
 description: >-
-  Chat with one of the app's Softr agents: listAgents() and useAgentChat(agentId,
-  { record }) from @softr/sdk give the chat state with no UI — messages, the
-  streaming reply, past chats, approve, reject, connect. Load it for an agent
-  chat, approving its actions, which records the agent may change for each
-  visitor, or connecting the visitor's account a tool needs.
+  Chat with one of the app's Softr agents: listAgents() and
+  useAgentChat(agentId, { record }) from @softr/sdk give the chat state with no
+  UI — messages, the streaming reply, past chats, approve, reject, connect. Load
+  it for an agent chat, approving its actions, which records the agent may
+  change for each visitor, or connecting the visitor's account a tool needs.
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.90-alpha.6
+  library_version: 0.0.90-alpha.7
 ---
 
 **Boundary.** `listAgents` and `useAgentChat` live on `@softr/sdk`. `listAgents` runs in a route loader, `useAgentChat` in a component. Neither needs a route, server function or registration of its own. It chats as the signed-in visitor, or anonymously when no one is signed in.
@@ -92,6 +92,7 @@ The agent reads and changes data through the app's own MCP, as the visitor who i
 
 **The agent calls a listed action directly, with any input.** It skips pages and server functions. Two things guard it: the action's `permissions` say who may run it, and the app's data restrictions say which rows each user group reaches. A read returns every row the visitor may see, and an update or delete takes any id that passes both.
 
+- **The owner comes from the app, never from the agent.** Name each create's owner link in `owner` on `softrMcpMiddleware`, as [mcp/SKILL.md](../mcp/SKILL.md) shows. The agent knows the visitor's login, not their row, and could name anyone.
 - **By default, each visitor changes only their own records.** On a table whose rows belong to a person, such as requests or bookings, open its create, update and delete to every signed-in visitor, and let the table's data restriction narrow edit and delete to the visitor's own rows. The groups that manage everyone's records get no restriction.
 - Split an action by role only for fields one role sets. A request's status goes on its own update with `customGroups` for the managers, and the visitor's update doesn't list it. One update open to every signed-in visitor that writes the status lets an employee have the agent approve their own vacation request.
 - Don't list an update or delete on a table whose rows belong to people until its restriction is in place. Without it, the agent edits anyone's row.

package/skills/softr-sdk/auth/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.90-alpha.6
+  library_version: 0.0.90-alpha.7
 ---
 
 **Boundary.** `auth` lives on `@softr/sdk/server` and runs only inside a `createServerFn` handler — importing it into a component fails the build.

package/skills/softr-sdk/charts-and-metrics/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.90-alpha.6
+  library_version: 0.0.90-alpha.7
 ---
 
 **Boundary.** `ds` lives on `@softr/sdk/server` and runs only inside a `createServerFn` handler or a server-side route hook — importing it into a component fails the build. `defineQuery` and every type come from `@softr/sdk` and can be imported anywhere.

package/skills/softr-sdk/current-user/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.90-alpha.6
+  library_version: 0.0.90-alpha.7
 ---
 
 # The current user

package/skills/softr-sdk/file-uploads/SKILL.md

@@ -7,7 +7,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.90-alpha.6
+  library_version: 0.0.90-alpha.7
 ---
 
 **Boundary.** `upload` lives on `@softr/sdk/server` and runs inside server functions. `useFileUpload` and `FileItem` live on `@softr/sdk` and run in components. `FileAttachment` comes from `@softr/sdk` and can be imported anywhere.

package/skills/softr-sdk/formatting/SKILL.md

@@ -8,7 +8,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.90-alpha.6
+  library_version: 0.0.90-alpha.7
 ---
 
 # Dates, times and numbers

package/skills/softr-sdk/integrations/SKILL.md

@@ -7,7 +7,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.90-alpha.6
+  library_version: 0.0.90-alpha.7
 ---
 
 **Boundary.** `integration` lives on `@softr/sdk/server` and runs only inside a `createServerFn` handler — importing it into a component fails the build. `defineIntegration` and every type come from `@softr/sdk` and can be imported anywhere.

package/skills/softr-sdk/mcp/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.90-alpha.6
+  library_version: 0.0.90-alpha.7
 ---
 
 **Boundary.** `softrMcpMiddleware` lives on `@softr/sdk` and is registered once, in `src/start.ts`. The actions you hand it are the same `defineQuery` / `defineMutation` values the app's own pages use — declared wherever they already live, not duplicated for MCP.
@@ -54,10 +54,24 @@ The list is the whole tool surface. Write it out:
 - An action you leave out is invisible to the assistant, even where the app's pages use it freely.
 - An action you list still obeys its own `permissions`. Listing it does not widen who may run it — the assistant runs as whoever signed in, with that user's groups.
 - The assistant calls the action directly and skips server functions, so a row filter written in one does not apply. A listed read returns every row the user's data restrictions allow, and a listed update or delete takes any id that passes them. On a table whose rows belong to people, list an action only once a data restriction scopes the table to the user's own rows.
+- A create on a table whose rows belong to a person gets its owner from `owner`, never from the assistant. See below.
 - Two actions with the same `id` throw at startup. So does anything that is not a `defineQuery` or `defineMutation` value.
 
 Reads first. Add a write only when the user asked for one, and name it back to them.
 
+## The owner of a person's record
+
+The assistant knows the caller's login, not their row in the people table. Left to fill an owner link, it writes the login id, which shows as a stray name, or anyone's row it likes. `owner` takes the field out of the tool and fills it with the caller's own row, found the way `auth.currentUserRow` finds it:
+
+```ts
+softrMcpMiddleware({
+  actions: [listRequests, requestTimeOff],
+  owner: { users: usersQuery, email: 'email', fields: { requestTimeOff: 'employee' } },
+})
+```
+
+`fields` maps each create or update action id to its owner link. A caller with no row in the people table is refused, and nothing is created. On an update the field is only taken out, so nobody moves a record to someone else.
+
 ## The login round trip
 
 Connecting starts with an approval page the app serves. Most people hit it signed out, and that page cannot sign anyone in. It sends them to the login page named in `softr.json` (`auth.routes.login.path`), with the approval page in the search param named there (`auth.routes.login.redirectParam`).

package/skills/softr-sdk/pwa/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.90-alpha.6
+  library_version: 0.0.90-alpha.7
 ---
 
 # Installing the app

package/skills/softr-sdk/record-mutations/SKILL.md

@@ -8,7 +8,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.90-alpha.6
+  library_version: 0.0.90-alpha.7
 ---
 
 **Boundary.** `ds` lives on `@softr/sdk/server` and runs only inside a `createServerFn` handler — importing it into a component fails the build. `defineMutation` and every type come from `@softr/sdk` and can be imported anywhere.

package/skills/softr-sdk/record-queries/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.90-alpha.6
+  library_version: 0.0.90-alpha.7
 ---
 
 **Boundary.** `ds` lives on `@softr/sdk/server` and runs only inside a `createServerFn` handler or a server-side route hook — importing it into a component fails the build. The same holds for any helper that calls `ds`: declare it inside the handler. A function at module level that calls `ds` keeps the server-only import in the browser bundle, and every page stops loading until it moves. `defineQuery` and every type come from `@softr/sdk` and can be imported anywhere.

package/skills/softr-sdk/region-visibility/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.90-alpha.6
+  library_version: 0.0.90-alpha.7
 ---
 
 **Boundary.** `Audience` and `defineVisibility` come from `@softr/sdk` and work anywhere.

package/skills/softr-sdk/routes-and-visibility/SKILL.md

@@ -3,13 +3,13 @@ name: routes-and-visibility
 description: >-
   Add a route file and declare its settings: definePage with its visibility
   (LOGGED_IN_USERS, NON_LOGGED_IN_USERS and customGroups) and its title,
-  guardRoute or assertRouteAccess in beforeLoad, pageHead in head,
-  isAuthorized and checkAccess anywhere, rendering an access error, and the
-  lint rules that require the declaration.
+  guardRoute or assertRouteAccess in beforeLoad, pageHead in head, isAuthorized
+  and checkAccess anywhere, rendering an access error, and the lint rules that
+  require the declaration.
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.90-alpha.6
+  library_version: 0.0.90-alpha.7
 ---
 
 **Boundary.** `definePage`, `pageHead`, the access functions and the error predicates come from `@softr/sdk` and work anywhere.

package/skills/softr-sdk/workflows/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.90-alpha.6
+  library_version: 0.0.90-alpha.7
 ---
 
 **Boundary.** `workflow` lives on `@softr/sdk/server` and runs only inside a `createServerFn` handler — importing it into a component fails the build. `defineWorkflow` and every type come from `@softr/sdk` and can be imported anywhere.