@softr/sdk 0.0.91-alpha.0 → 0.0.91

package/dist/auth/isomorphic.d.ts

@@ -22,7 +22,7 @@ import * as _tanstack_react_start0 from "@tanstack/react-start";
  *   requestMiddleware: [softrAuthMiddleware()],
  * }))
  */
-declare function softrAuthMiddleware(): _tanstack_react_start0.RequestMiddlewareAfterServer<{}, readonly [_tanstack_react_start0.RequestMiddlewareAfterServer<{}, undefined, undefined>, _tanstack_react_start0.RequestMiddlewareAfterServer<{}, undefined, undefined>, _tanstack_react_start0.RequestMiddlewareAfterServer<{}, undefined, undefined>, _tanstack_react_start0.RequestMiddlewareAfterServer<{}, undefined, undefined>, _tanstack_react_start0.RequestMiddlewareAfterServer<{}, undefined, undefined>], {
+declare function softrAuthMiddleware(): _tanstack_react_start0.RequestMiddlewareAfterServer<{}, readonly [_tanstack_react_start0.RequestMiddlewareAfterServer<{}, undefined, undefined>, _tanstack_react_start0.RequestMiddlewareAfterServer<{}, undefined, undefined>, _tanstack_react_start0.RequestMiddlewareAfterServer<{}, undefined, undefined>, _tanstack_react_start0.RequestMiddlewareAfterServer<{}, undefined, undefined>], {
   user: User | null;
   permissions: Permissions;
   formatting: Formatting;

package/dist/auth/isomorphic.js

@@ -10,7 +10,6 @@ import { bootErrorMiddleware } from "../boot-error.js";
 import { pwaMiddleware } from "../pwa.js";
 import { faviconMiddleware } from "../favicon.js";
 import { embeddingMiddleware } from "../embedding.js";
-import { appIdentityMiddleware } from "../app-identity.js";
 import { createContext, useContext } from "react";
 import { createMiddleware, createServerFn, getGlobalStartContext } from "@tanstack/react-start";
 import { getRequestHeader } from "@tanstack/react-start/server";
@@ -35,7 +34,6 @@ import { jsx } from "react/jsx-runtime";
 function softrAuthMiddleware() {
 	return createMiddleware({ type: "request" }).middleware([
 		embeddingMiddleware(),
-		appIdentityMiddleware(),
 		bootErrorMiddleware(),
 		pwaMiddleware(),
 		faviconMiddleware()

package/dist/mcp.d.ts

@@ -1,5 +1,5 @@
 import { DatasourceAction } from "./action.js";
-import * as _tanstack_react_start0 from "@tanstack/react-start";
+import * as _tanstack_react_start6 from "@tanstack/react-start";
 
 //#region src/mcp.d.ts
 
@@ -31,6 +31,6 @@ type SoftrMcpOptions = {
  *   ],
  * }))
  */
-declare function softrMcpMiddleware(options?: SoftrMcpOptions): _tanstack_react_start0.RequestMiddlewareAfterServer<{}, undefined, undefined>;
+declare function softrMcpMiddleware(options?: SoftrMcpOptions): _tanstack_react_start6.RequestMiddlewareAfterServer<{}, undefined, undefined>;
 //#endregion
 export { softrMcpMiddleware };

package/dist/package.js

@@ -1,5 +1,5 @@
 //#region package.json
-var version = "0.0.91-alpha.0";
+var version = "0.0.91";
 
 //#endregion
 export { version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softr/sdk",
-  "version": "0.0.91-alpha.0",
+  "version": "0.0.91",
   "type": "module",
   "exports": {
     ".": { "types": "./dist/index.d.ts", "import": "./dist/index.js" },

package/skills/softr-sdk/current-user/SKILL.md

@@ -56,9 +56,9 @@ It returns `User | null` and never suspends or fetches. It selects off root rout
 ```tsx
 export const Route = createFileRoute('/_app/invoices')({
   beforeLoad: guardRoute(pageSettings),
-  loader: (opts) => {
+  loader: async (opts) => {
     assertRouteAccess(pageSettings, opts)
-    return fetchInvoicesFor({ data: { userId: opts.context.user.id } })
+    return { name: opts.context.user.fullName, invoices: await getMyInvoices() }
   },
   head: pageHead(pageSettings),
 })
@@ -66,6 +66,8 @@ export const Route = createFileRoute('/_app/invoices')({
 
 A `guardRoute` in `beforeLoad` guarantees a visitor at runtime, but it does not change what the compiler sees. `context.user` is still `User | null` in the loader. `assertRouteAccess(pageSettings, opts)` at the top of the loader narrows it there, so prefer that over `!`. Take `opts` whole: a destructured `context` does not narrow. See [routes-and-visibility](../routes-and-visibility/SKILL.md).
 
+Never pass the visitor's id from a loader into a server function. The loader also runs in the browser, so the id arrives as an argument anyone can set. `getMyInvoices` below reads the visitor from its own `context`.
+
 ### In a server function: `context`
 
 ```ts

package/skills/softr-sdk/integrations/SKILL.md

@@ -14,14 +14,14 @@ metadata:
 
 # Integrations
 
-`integration.createFetcher` calls a third-party API through Softr's authenticated proxy. It handles authorization automatically — you never set API keys or auth headers yourself.
+`integration.createFetcher` calls a third-party API through Softr's authenticated proxy. It adds the connected account's credentials automatically — you never set API keys or auth headers yourself. **Every call acts as that one account, whoever the visitor is**, so take what a call reaches, such as a customer or a channel, from the session or a record the server read, never from the arguments the browser sends.
 
 ## Setup
 
 ```ts
 import { createServerFn } from '@tanstack/react-start'
 import { defineIntegration } from '@softr/sdk'
-import { integration } from '@softr/sdk/server'
+import { auth, integration } from '@softr/sdk/server'
 ```
 
 ## Reading connected integrations from the prompt
@@ -77,7 +77,7 @@ const getCalendarEvents = createServerFn().handler(async () => {
 })
 ```
 
-For a dynamic path segment, pass `params` matching each `{placeholder}` token:
+For a dynamic path segment, pass `params` matching each `{placeholder}` token. Here the customer comes from the visitor's own Users row, which `auth.currentUserRow` finds through `usersQuery`, the app's `defineQuery` on the Users table:
 
 ```ts
 const getStripeCustomer = defineIntegration({
@@ -89,10 +89,12 @@ const getStripeCustomer = defineIntegration({
 })
 
 const fetchCustomer = createServerFn({ method: 'GET' })
-  .validator((data: { customerId: string }) => data)
-  .handler(async ({ data }) => {
+  .handler(async ({ context }) => {
+    const me = await auth.currentUserRow(context.user, usersQuery, 'email')
+    const customerId = me?.fields.stripeCustomerId
+    if (!customerId) throw new Error('No Stripe customer for this visitor')
     const stripe = integration.createFetcher(getStripeCustomer)
-    const res = await stripe({ params: { id: data.customerId } })
+    const res = await stripe({ params: { id: customerId } })
     if (!res.ok) throw new Error(`Stripe error: ${res.status} ${await res.text()}`)
     return res.json()
   })
@@ -110,12 +112,12 @@ const postSlackMessage = defineIntegration({
 })
 
 const sendSlackMessage = createServerFn({ method: 'POST' })
-  .validator((data: { channel: string; text: string }) => data)
+  .validator((data: { text: string }) => data)
   .handler(async ({ data }) => {
     const slack = integration.createFetcher(postSlackMessage)
     const res = await slack({
       headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ channel: data.channel, text: data.text }),
+      body: JSON.stringify({ channel: '#sales', text: data.text }),
     })
     if (!res.ok) throw new Error(`Slack error: ${res.status} ${await res.text()}`)
     return res.json()

package/skills/softr-sdk/record-queries/references/filters-and-sorting.md

@@ -127,6 +127,8 @@ Both take filters or nested groups:
 
 Nesting goes two levels, a group inside a group. A third level throws `Cannot nest filter groups more than three levels deep.` Flatten by distributing the outer condition rather than nesting further.
 
+**An `$or` with no members matches every row.** When its members come from a list that can be empty, return no rows for an empty list instead of reading the table.
+
 ## Sorting
 
 ```ts

package/skills/softr-sdk/routes-and-visibility/SKILL.md

@@ -73,6 +73,8 @@ Everyone is both audiences, as in the first line above. A set names each audienc
 
 Take every id in `customGroups` from `docs/user-groups.md`, which lists each group the app has with its name and id. An id the app does not have is a type error.
 
+**`visibility` guards the page, not the server functions it calls.** A call can reach them without the page and with any arguments, so the queries and mutations behind a page carry its groups in their own `permissions` and reach only the rows the visitor's role allows.
+
 ## Core Patterns
 
 ### Guard a whole section with one layout route

package/dist/app-identity.js

@@ -1,25 +0,0 @@
-import { createMiddleware } from "@tanstack/react-start";
-
-//#region src/app-identity.ts
-/**
-* Tells support which Softr app answered, in an `x-softr-app-id` response
-* header.
-*/
-function appIdentityMiddleware() {
-	return createMiddleware({ type: "request" }).server(async ({ next }) => {
-		const result = await next();
-		const applicationId = process.env.SOFTR_APPLICATION_ID;
-		if (!applicationId) return result;
-		try {
-			result.response.headers.set("x-softr-app-id", applicationId);
-			return result;
-		} catch {
-			const response = new Response(result.response.body, result.response);
-			response.headers.set("x-softr-app-id", applicationId);
-			return response;
-		}
-	});
-}
-
-//#endregion
-export { appIdentityMiddleware };