@softr/sdk 0.0.91-alpha.1 → 0.0.91

package/dist/auth/server.js

@@ -1,5 +1,4 @@
 import { settings } from "./methods/settings.js";
-import { currentUserRow } from "./current-user-row.js";
 import { confirmAuthenticatorSetup, removeAuthenticator, resetAuthenticator, sendAuthenticatorResetCode, skipAuthenticatorSetup, startAuthenticatorSetup, verifyAuthenticator } from "./methods/authenticator.js";
 import { sendSignInCode, signInWithCode } from "./methods/code.js";
 import { signInWithMagicLink } from "./methods/magicLink.js";
@@ -8,6 +7,7 @@ import { checkPasswordLink, requestPasswordReset, setPasswordWithLink } from "./
 import { confirmSignUp, signUp } from "./methods/signup.js";
 import { signInWithGoogle } from "./methods/social.js";
 import { removeAvatar, updateProfile } from "./methods/profile.js";
+import { currentUserRow } from "./current-user-row.js";
 import "@tanstack/react-start/server-only";
 
 //#region src/auth/server.ts

package/dist/datasource/record.js

@@ -30,15 +30,6 @@ function refererHeader() {
 	const referer = getRequestHeader("referer");
 	return { Referer: referer !== void 0 && URL.parse(referer)?.origin === page.origin ? referer : page.href };
 }
-/** A datasource call the service refused. `status` is its HTTP status. */
-var DatasourceError = class extends Error {
-	status;
-	constructor(message, status) {
-		super(message);
-		this.name = "DatasourceError";
-		this.status = status;
-	}
-};
 async function describeFailure(res) {
 	const body = await res.json().catch(() => null);
 	const message = typeof body === "object" && body !== null && "message" in body ? body.message : null;
@@ -244,7 +235,7 @@ async function updateRecord(action, options) {
 		},
 		body: JSON.stringify({ fields: rawFields })
 	});
-	if (!res.ok) throw new DatasourceError(`datasource update failed for action "${actionId}": ${await describeFailure(res)}`, res.status);
+	if (!res.ok) throw new Error(`datasource update failed for action "${actionId}": ${await describeFailure(res)}`);
 	const record = await res.json();
 	return {
 		id: record.id,
@@ -266,7 +257,7 @@ async function deleteRecord(action, options) {
 			...refererHeader()
 		}
 	});
-	if (!res.ok) throw new DatasourceError(`datasource delete failed for action "${actionId}": ${await describeFailure(res)}`, res.status);
+	if (!res.ok) throw new Error(`datasource delete failed for action "${actionId}": ${await describeFailure(res)}`);
 }
 function resolveTarget(subject, operation) {
 	const declaredBy = operation === "read" ? "defineQuery" : "defineMutation";
@@ -290,4 +281,4 @@ function dealiasData(data, select) {
 }
 
 //#endregion
-export { DatasourceError, createRecord, deleteRecord, describeFailure, dsUrl, getRecord, listRecords, refererHeader, resolveTarget, updateRecord };
+export { createRecord, deleteRecord, describeFailure, dsUrl, getRecord, listRecords, refererHeader, resolveTarget, updateRecord };

package/dist/formatting.d.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import * as react2 from "react";
+import * as react0 from "react";
 import { ReactNode } from "react";
 
 //#region src/formatting.d.ts
@@ -94,7 +94,7 @@ declare function FormattingScope({
   /** A BCP 47 locale, such as `de-DE`. It drops the app's fixed date format inside the scope. */
   locale?: string;
   children?: ReactNode;
-}): react2.FunctionComponentElement<react2.ProviderProps<Scope>>;
+}): react0.FunctionComponentElement<react0.ProviderProps<Scope>>;
 /**
  * A date in the app's format, safe to render on the server. A timestamp whose
  * zone is not known yet renders `fallback` until the browser supplies it, so
@@ -115,6 +115,6 @@ declare function FormattedDate({
   time?: boolean;
   /** What renders while the visitor's zone is unknown. */
   fallback?: ReactNode;
-}): react2.FunctionComponentElement<react2.FragmentProps>;
+}): react0.FunctionComponentElement<react0.FragmentProps>;
 //#endregion
 export { DateOptions, DateParts, DateSeparator, DateValue, FixedDateFormat, FormattedDate, Formatting, FormattingScope, WeekDay, formatDate, formatDateTime, formatNumber, useFormatting };

package/dist/index.d.ts

@@ -17,7 +17,5 @@ import { useOverrides } from "./core/use-overrides.js";
 import { useUserTimezone } from "./timezone.js";
 import { PwaInstall, PwaPlatform, SoftrPwaHead, usePwaInstall } from "./pwa.js";
 import { DefaultErrorOverlay } from "./default-error-overlay.js";
-import { Agent, AgentChatSummary, listAgents } from "./agent/agent-fns.js";
-import { AgentBlock, AgentChat, AgentChatOptions, AgentMessage, AgentQuestion, AgentTodo, AgentToolCall, useAgentChat } from "./agent/use-agent-chat.js";
 import { Audience } from "./route/audience.js";
-export { type ActionPermissions, type Agent, type AgentBlock, type AgentChat, type AgentChatOptions, type AgentChatSummary, type AgentMessage, type AgentQuestion, type AgentTodo, type AgentToolCall, type AiAnswer, type AiFile, type AiGenerateInit, type AiMessage, type AiUsage, Audience, type AuthOptions, type AuthSettings, AuthSettingsProvider, type DateOptions, type DateParts, type DateSeparator, type DateValue, DefaultErrorOverlay, type FieldShape, type FileAttachment, type FileItem, type FixedDateFormat, FormattedDate, type Formatting, FormattingScope, type Page, type PageSettings, type PwaInstall, type PwaPlatform, type SoftrContext, type SoftrDatasources, type SoftrFieldRegistry, SoftrPwaHead, type SoftrUserGroupId, type SoftrUserGroups, type SoftrUserProperties, type User, type WeekDay, assertRouteAccess, checkAccess, defineAiAction, defineIntegration, defineMutation, definePage, defineQuery, defineVisibility, defineWorkflow, fieldShape, formatDate, formatDateTime, formatDuration, formatField, formatNumber, formatValue, getAuthSettings, getSoftrContext, guardRoute, initialSoftrContext, isAccessError, isAlreadyAuthenticatedError, isAuthorized, isForbiddenError, isUnauthenticatedError, listAgents, pageHead, registerSoftrFields, softrAuthMiddleware, softrMcpMiddleware, toReturnPath, useAgentChat, useAuthSettings, useCurrentUser, useFileUpload, useFormatting, useOverrides, usePwaInstall, useUserTimezone };
+export { type ActionPermissions, type AiAnswer, type AiFile, type AiGenerateInit, type AiMessage, type AiUsage, Audience, type AuthOptions, type AuthSettings, AuthSettingsProvider, type DateOptions, type DateParts, type DateSeparator, type DateValue, DefaultErrorOverlay, type FieldShape, type FileAttachment, type FileItem, type FixedDateFormat, FormattedDate, type Formatting, FormattingScope, type Page, type PageSettings, type PwaInstall, type PwaPlatform, type SoftrContext, type SoftrDatasources, type SoftrFieldRegistry, SoftrPwaHead, type SoftrUserGroupId, type SoftrUserGroups, type SoftrUserProperties, type User, type WeekDay, assertRouteAccess, checkAccess, defineAiAction, defineIntegration, defineMutation, definePage, defineQuery, defineVisibility, defineWorkflow, fieldShape, formatDate, formatDateTime, formatDuration, formatField, formatNumber, formatValue, getAuthSettings, getSoftrContext, guardRoute, initialSoftrContext, isAccessError, isAlreadyAuthenticatedError, isAuthorized, isForbiddenError, isUnauthenticatedError, pageHead, registerSoftrFields, softrAuthMiddleware, softrMcpMiddleware, toReturnPath, useAuthSettings, useCurrentUser, useFileUpload, useFormatting, useOverrides, usePwaInstall, useUserTimezone };

package/dist/index.js

@@ -12,8 +12,6 @@ import { fieldShape, formatDuration, formatField, formatValue, registerSoftrFiel
 import { useOverrides } from "./core/use-overrides.js";
 import { useUserTimezone } from "./timezone.js";
 import { DefaultErrorOverlay } from "./default-error-overlay.js";
-import { listAgents } from "./agent/agent-fns.js";
-import { useAgentChat } from "./agent/use-agent-chat.js";
 import { Audience } from "./route/audience.js";
 
-export { Audience, AuthSettingsProvider, DefaultErrorOverlay, FormattedDate, FormattingScope, SoftrPwaHead, assertRouteAccess, checkAccess, defineAiAction, defineIntegration, defineMutation, definePage, defineQuery, defineVisibility, defineWorkflow, fieldShape, formatDate, formatDateTime, formatDuration, formatField, formatNumber, formatValue, getAuthSettings, getSoftrContext, guardRoute, initialSoftrContext, isAccessError, isAlreadyAuthenticatedError, isAuthorized, isForbiddenError, isUnauthenticatedError, listAgents, pageHead, registerSoftrFields, softrAuthMiddleware, softrMcpMiddleware, toReturnPath, useAgentChat, useAuthSettings, useCurrentUser, useFileUpload, useFormatting, useOverrides, usePwaInstall, useUserTimezone };
+export { Audience, AuthSettingsProvider, DefaultErrorOverlay, FormattedDate, FormattingScope, SoftrPwaHead, assertRouteAccess, checkAccess, defineAiAction, defineIntegration, defineMutation, definePage, defineQuery, defineVisibility, defineWorkflow, fieldShape, formatDate, formatDateTime, formatDuration, formatField, formatNumber, formatValue, getAuthSettings, getSoftrContext, guardRoute, initialSoftrContext, isAccessError, isAlreadyAuthenticatedError, isAuthorized, isForbiddenError, isUnauthenticatedError, pageHead, registerSoftrFields, softrAuthMiddleware, softrMcpMiddleware, toReturnPath, useAuthSettings, useCurrentUser, useFileUpload, useFormatting, useOverrides, usePwaInstall, useUserTimezone };

package/dist/mcp.d.ts

@@ -1,9 +1,9 @@
-import { DatasourceAction, ReadShape } from "./action.js";
-import * as _tanstack_react_start0 from "@tanstack/react-start";
+import { DatasourceAction } from "./action.js";
+import * as _tanstack_react_start6 from "@tanstack/react-start";
 
 //#region src/mcp.d.ts
 
-type SoftrMcpOptions<TUsers extends ReadShape = ReadShape> = {
+type SoftrMcpOptions = {
   /**
    * The actions to expose as tools, from `defineQuery` and `defineMutation`.
    *
@@ -12,19 +12,6 @@ type SoftrMcpOptions<TUsers extends ReadShape = ReadShape> = {
    * decide who may run the ones that are listed.
    */
   actions?: Array<DatasourceAction>;
-  /**
-   * Fills the owner of a person's record from who is calling, the way the app's
-   * pages do with `auth.currentUserRow`. The field is left out of the tool, so
-   * the assistant can't leave it wrong or name someone else.
-   */
-  owner?: SoftrMcpOwner<TUsers>;
-};
-type SoftrMcpOwner<TUsers extends ReadShape = ReadShape> = {
-  /** The people table, and its email field, to find the caller's row in. */
-  users: DatasourceAction<TUsers>;
-  email: keyof TUsers["fields"] & string;
-  /** Listed create or update action id to the field that links to the caller's row. */
-  fields: Record<string, string>;
 };
 /**
  * Serves the MCP endpoint and its OAuth flow from the app's own origin.
@@ -44,6 +31,6 @@ type SoftrMcpOwner<TUsers extends ReadShape = ReadShape> = {
  *   ],
  * }))
  */
-declare function softrMcpMiddleware<TUsers extends ReadShape>(options?: SoftrMcpOptions<TUsers>): _tanstack_react_start0.RequestMiddlewareAfterServer<{}, undefined, undefined>;
+declare function softrMcpMiddleware(options?: SoftrMcpOptions): _tanstack_react_start6.RequestMiddlewareAfterServer<{}, undefined, undefined>;
 //#endregion
 export { softrMcpMiddleware };

package/dist/mcp.js

@@ -5,10 +5,8 @@ import { softrConfig } from "./softr-config.js";
 import { sessionConfig } from "./auth/config.js";
 import { readSessionToken, withSessionToken } from "./auth/session.js";
 import { isDatasourceAction } from "./action.js";
-import { DatasourceError } from "./datasource/record.js";
 import { makePlatform } from "./auth/platform.js";
 import { ds } from "./datasource/datasource.js";
-import { currentUserRow } from "./auth/current-user-row.js";
 import { z } from "zod";
 import { createMiddleware } from "@tanstack/react-start";
 
@@ -50,14 +48,6 @@ function softrMcpMiddleware(options = {}) {
 		assert(!actions.has(value.id), `two actions share the id "${value.id}"`);
 		actions.set(value.id, value);
 	}
-	const owner = options.owner;
-	for (const [actionId, field] of Object.entries(owner?.fields ?? {})) {
-		const action = actions.get(actionId);
-		assert(action, `owner names "${actionId}", which is not a listed action`);
-		const { operation, fields } = action.resource;
-		assert(operation === "create" || operation === "update", `owner fills "${actionId}", which is a ${operation}`);
-		assert(field in (fields ?? {}), `"${actionId}" has no field "${field}" for the owner`);
-	}
 	return createMiddleware({ type: "request" }).server(async ({ next, request }) => {
 		const url = new URL(request.url);
 		const origin = url.origin;
@@ -81,7 +71,7 @@ function softrMcpMiddleware(options = {}) {
 			});
 			case AUTHORIZE_PATH: return await authorize(request, login);
 			case TOKEN_PATH: return await issueToken(request);
-			case MCP_PATH: return await rpc(request, origin, actions, owner);
+			case MCP_PATH: return await rpc(request, origin, actions);
 			default: return await next();
 		}
 	});
@@ -254,8 +244,7 @@ const WHOAMI = {
 		type: "object",
 		properties: {},
 		additionalProperties: false
-	},
-	annotations: { readOnlyHint: true }
+	}
 };
 /** How many records a read returns when the caller does not say. */
 const DEFAULT_LIMIT = 20;
@@ -268,16 +257,14 @@ const MAX_LIMIT = 100;
 * that only ever reads one datasource exposes one read, even though its
 * credentials would allow more.
 */
-function describeTool(action, ownerField) {
+function describeTool(action) {
 	const { operation, fields } = action.resource;
 	const names = Object.keys(fields ?? {});
-	const writable = names.filter((name) => name !== ownerField);
-	const fieldProps = Object.fromEntries(writable.map((name) => [name, { description: `The "${name}" field.` }]));
+	const fieldProps = Object.fromEntries(names.map((name) => [name, { description: `The "${name}" field.` }]));
 	switch (operation) {
 		case "read": return {
 			name: action.id,
 			description: `Read records from "${action.id}". Returns the fields ${names.join(", ")}. Only records the signed-in user may see come back.`,
-			annotations: { readOnlyHint: true },
 			inputSchema: {
 				type: "object",
 				properties: {
@@ -298,7 +285,7 @@ function describeTool(action, ownerField) {
 		};
 		case "create": return {
 			name: action.id,
-			description: `Create a record with "${action.id}". Writable fields: ${writable.join(", ")}.`,
+			description: `Create a record with "${action.id}". Writable fields: ${names.join(", ")}.`,
 			inputSchema: {
 				type: "object",
 				properties: fieldProps,
@@ -307,7 +294,7 @@ function describeTool(action, ownerField) {
 		};
 		case "update": return {
 			name: action.id,
-			description: `Update a record with "${action.id}". Writable fields: ${writable.join(", ")}.`,
+			description: `Update a record with "${action.id}". Writable fields: ${names.join(", ")}.`,
 			inputSchema: {
 				type: "object",
 				properties: {
@@ -343,7 +330,7 @@ function describeTool(action, ownerField) {
 * visitor's user groups exactly as it would a click in the app. Nothing here
 * decides what is allowed.
 */
-async function runTool(action, args, owner) {
+async function runTool(action, args) {
 	const typed = action;
 	switch (action.resource.operation) {
 		case "read": {
@@ -355,21 +342,13 @@ async function runTool(action, args, owner) {
 				nextOffset: result$1.nextOffset
 			};
 		}
-		case "create": {
-			const data = writableFields(action, args, owner?.field);
-			if (owner !== null) {
-				const row = await owner.row();
-				if (row === null) throw new Error("The visitor has no row in the people table, so this record can't be created for them.");
-				data[owner.field] = { id: row.id };
-			}
-			return await ds.create(typed, { data });
-		}
+		case "create": return await ds.create(typed, { data: writableFields(action, args) });
 		case "update": {
 			const { id,...data } = args;
 			assert(typeof id === "string" && id !== "", "update needs a record id");
 			return await ds.update(typed, {
 				id,
-				data: writableFields(action, data, owner?.field)
+				data: writableFields(action, data)
 			});
 		}
 		case "delete": {
@@ -380,19 +359,8 @@ async function runTool(action, args, owner) {
 		}
 	}
 }
-function ownerFieldOf(owner, actionId) {
-	return owner !== void 0 && Object.hasOwn(owner.fields, actionId) ? owner.fields[actionId] : void 0;
-}
-function ownerFill(owner, actionId, sessionToken) {
-	const field = ownerFieldOf(owner, actionId);
-	if (owner === void 0 || field === void 0) return null;
-	return {
-		field,
-		row: async () => currentUserRow(await resolveUser(sessionToken), owner.users, owner.email)
-	};
-}
 /**
-* Only the fields the action declared, less the owner it fills itself.
+* Only the fields the action declared.
 *
 * `additionalProperties: false` in the tool schema is a hint to the model, not
 * a check — a client can send whatever it likes. An unlisted key reaches the
@@ -400,18 +368,9 @@ function ownerFill(owner, actionId, sessionToken) {
 * straight through. So the action's field list gets enforced here, or it isn't
 * a boundary at all.
 */
-function writableFields(action, args, ownerField) {
+function writableFields(action, args) {
 	const allowed = action.resource.fields ?? {};
-	return Object.fromEntries(Object.entries(args).filter(([name]) => name in allowed && name !== ownerField));
-}
-/**
-* The error as the assistant should read it. A row rule that keeps the caller
-* from changing a record answers 404, the same as a deleted record, so a bare
-* "not found" would leave the assistant guessing.
-*/
-function describeError(error) {
-	if (error instanceof DatasourceError && error.status === 404) return "Refused: this record doesn't exist, or the visitor's user group may not change it. If it still shows in a read, it is a permission. Tell the visitor they don't have access to this action, and that the app's builder can grant it.";
-	return error instanceof Error ? error.message : String(error);
+	return Object.fromEntries(Object.entries(args).filter(([name]) => name in allowed));
 }
 function clampLimit(raw) {
 	if (typeof raw !== "number" || !Number.isInteger(raw)) return DEFAULT_LIMIT;
@@ -421,15 +380,13 @@ function clampOffset(raw) {
 	if (typeof raw !== "number" || !Number.isInteger(raw) || raw < 0) return null;
 	return raw;
 }
-async function rpc(request, origin, actions, owner) {
+async function rpc(request, origin, actions) {
 	if (request.method !== "POST") return methodNotAllowed("POST");
 	const token = bearerToken(request);
 	if (token === null) return unauthorized(origin);
 	const session = await platformSession(token);
-	let sessionToken;
-	if (session.ok) sessionToken = session.sessionToken;
-	else if (session.refused && await resolveUser(token) !== null) sessionToken = token;
-	else return session.refused ? unauthorized(origin) : unavailable();
+	if (!session.ok) return session.refused ? unauthorized(origin) : unavailable();
+	const { sessionToken } = session;
 	const body = await readJson(request);
 	const message = z.object({
 		id: z.union([z.string(), z.number()]).optional(),
@@ -458,7 +415,7 @@ async function rpc(request, origin, actions, owner) {
 				}
 			});
 		}
-		case "tools/list": return result(id, { tools: [WHOAMI, ...[...actions.values()].map((action) => describeTool(action, ownerFieldOf(owner, action.id)))] });
+		case "tools/list": return result(id, { tools: [WHOAMI, ...[...actions.values()].map(describeTool)] });
 		case "tools/call": {
 			const name = params?.name;
 			const args = typeof params?.arguments === "object" && params.arguments !== null ? params.arguments : {};
@@ -470,13 +427,13 @@ async function rpc(request, origin, actions, owner) {
 			const action = typeof name === "string" ? actions.get(name) : void 0;
 			if (action === void 0) return failure(id, -32602, `Unknown tool: ${String(name)}`);
 			try {
-				return result(id, toolResult(await withSessionToken(sessionToken, () => runTool(action, args, ownerFill(owner, action.id, sessionToken)))));
+				return result(id, toolResult(await withSessionToken(sessionToken, () => runTool(action, args))));
 			} catch (error) {
 				return result(id, {
 					isError: true,
 					content: [{
 						type: "text",
-						text: describeError(error)
+						text: error instanceof Error ? error.message : String(error)
 					}]
 				});
 			}

package/dist/package.js

@@ -1,5 +1,5 @@
 //#region package.json
-var version = "0.0.91-alpha.1";
+var version = "0.0.91";
 
 //#endregion
 export { version };

package/dist/pwa.d.ts

@@ -1,4 +1,4 @@
-import * as react0 from "react";
+import * as react4 from "react";
 import "@tanstack/react-start";
 
 //#region src/pwa.d.ts
@@ -23,7 +23,7 @@ import "@tanstack/react-start";
  *   )
  * }
  */
-declare function SoftrPwaHead(): react0.FunctionComponentElement<react0.FragmentProps>;
+declare function SoftrPwaHead(): react4.FunctionComponentElement<react4.FragmentProps>;
 type PwaPlatform = "ios" | "android" | "desktop";
 type PwaInstall = {
   available: false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softr/sdk",
-  "version": "0.0.91-alpha.1",
+  "version": "0.0.91",
   "type": "module",
   "exports": {
     ".": { "types": "./dist/index.d.ts", "import": "./dist/index.js" },

package/skills/softr-sdk/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: core
   library: softr-sdk
-  library_version: 0.0.91-alpha.1
+  library_version: 0.0.91
 ---
 
 # Softr SDK core
@@ -52,7 +52,6 @@ Each sub-skill stands alone for its task and repeats the boundary above, so most
 | Ask an AI model: a summary, an extraction from a document, a classification, a draft, a chat | [ai/SKILL.md](./ai/SKILL.md) |
 | Call a connected third-party API (Slack, Stripe, Gmail, …), or an AI model on the user's own provider account | [integrations/SKILL.md](./integrations/SKILL.md) |
 | Open the app to AI assistants over MCP | [mcp/SKILL.md](./mcp/SKILL.md) |
-| Let visitors chat with a Softr agent | [agent-chat/SKILL.md](./agent-chat/SKILL.md) |
 | Let visitors install the app on their home screen | [pwa/SKILL.md](./pwa/SKILL.md) |
 | Show a date, a time or a number | [formatting/SKILL.md](./formatting/SKILL.md) |
 
@@ -95,9 +94,6 @@ Running a model on the user's OWN provider account, because they chose that for
 Opening the app to an AI assistant over MCP?
   load softr-sdk/mcp
 
-Adding a chat with one of the app's Softr agents, or a Connect button for the visitor's account it needs?
-  load softr-sdk/agent-chat
-
 Adding an install button, or making the app installable?
   load softr-sdk/pwa
 

package/skills/softr-sdk/ai/SKILL.md

@@ -13,7 +13,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.79-alpha.0
+  library_version: 0.0.91
 ---
 
 **Boundary.** `ai` lives on `@softr/sdk/server` and runs only inside a `createServerFn` handler — importing it into a component fails the build. `defineAiAction` and every type come from `@softr/sdk` and can be imported anywhere.

package/skills/softr-sdk/auth/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.91-alpha.1
+  library_version: 0.0.91
 ---
 
 **Boundary.** `auth` lives on `@softr/sdk/server` and runs only inside a `createServerFn` handler — importing it into a component fails the build.

package/skills/softr-sdk/charts-and-metrics/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.91-alpha.1
+  library_version: 0.0.91
 ---
 
 **Boundary.** `ds` lives on `@softr/sdk/server` and runs only inside a `createServerFn` handler or a server-side route hook — importing it into a component fails the build. `defineQuery` and every type come from `@softr/sdk` and can be imported anywhere.

package/skills/softr-sdk/current-user/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.91-alpha.1
+  library_version: 0.0.91
 ---
 
 # The current user
@@ -56,9 +56,9 @@ It returns `User | null` and never suspends or fetches. It selects off root rout
 ```tsx
 export const Route = createFileRoute('/_app/invoices')({
   beforeLoad: guardRoute(pageSettings),
-  loader: (opts) => {
+  loader: async (opts) => {
     assertRouteAccess(pageSettings, opts)
-    return fetchInvoicesFor({ data: { userId: opts.context.user.id } })
+    return { name: opts.context.user.fullName, invoices: await getMyInvoices() }
   },
   head: pageHead(pageSettings),
 })
@@ -66,6 +66,8 @@ export const Route = createFileRoute('/_app/invoices')({
 
 A `guardRoute` in `beforeLoad` guarantees a visitor at runtime, but it does not change what the compiler sees. `context.user` is still `User | null` in the loader. `assertRouteAccess(pageSettings, opts)` at the top of the loader narrows it there, so prefer that over `!`. Take `opts` whole: a destructured `context` does not narrow. See [routes-and-visibility](../routes-and-visibility/SKILL.md).
 
+Never pass the visitor's id from a loader into a server function. The loader also runs in the browser, so the id arrives as an argument anyone can set. `getMyInvoices` below reads the visitor from its own `context`.
+
 ### In a server function: `context`
 
 ```ts

package/skills/softr-sdk/file-uploads/SKILL.md

@@ -7,7 +7,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.91-alpha.1
+  library_version: 0.0.91
 ---
 
 **Boundary.** `upload` lives on `@softr/sdk/server` and runs inside server functions. `useFileUpload` and `FileItem` live on `@softr/sdk` and run in components. `FileAttachment` comes from `@softr/sdk` and can be imported anywhere.

package/skills/softr-sdk/formatting/SKILL.md

@@ -8,7 +8,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.91-alpha.1
+  library_version: 0.0.91
 ---
 
 # Dates, times and numbers

package/skills/softr-sdk/integrations/SKILL.md

@@ -7,21 +7,21 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.91-alpha.1
+  library_version: 0.0.91
 ---
 
 **Boundary.** `integration` lives on `@softr/sdk/server` and runs only inside a `createServerFn` handler — importing it into a component fails the build. `defineIntegration` and every type come from `@softr/sdk` and can be imported anywhere.
 
 # Integrations
 
-`integration.createFetcher` calls a third-party API through Softr's authenticated proxy. It handles authorization automatically — you never set API keys or auth headers yourself.
+`integration.createFetcher` calls a third-party API through Softr's authenticated proxy. It adds the connected account's credentials automatically — you never set API keys or auth headers yourself. **Every call acts as that one account, whoever the visitor is**, so take what a call reaches, such as a customer or a channel, from the session or a record the server read, never from the arguments the browser sends.
 
 ## Setup
 
 ```ts
 import { createServerFn } from '@tanstack/react-start'
 import { defineIntegration } from '@softr/sdk'
-import { integration } from '@softr/sdk/server'
+import { auth, integration } from '@softr/sdk/server'
 ```
 
 ## Reading connected integrations from the prompt
@@ -77,7 +77,7 @@ const getCalendarEvents = createServerFn().handler(async () => {
 })
 ```
 
-For a dynamic path segment, pass `params` matching each `{placeholder}` token:
+For a dynamic path segment, pass `params` matching each `{placeholder}` token. Here the customer comes from the visitor's own Users row, which `auth.currentUserRow` finds through `usersQuery`, the app's `defineQuery` on the Users table:
 
 ```ts
 const getStripeCustomer = defineIntegration({
@@ -89,10 +89,12 @@ const getStripeCustomer = defineIntegration({
 })
 
 const fetchCustomer = createServerFn({ method: 'GET' })
-  .validator((data: { customerId: string }) => data)
-  .handler(async ({ data }) => {
+  .handler(async ({ context }) => {
+    const me = await auth.currentUserRow(context.user, usersQuery, 'email')
+    const customerId = me?.fields.stripeCustomerId
+    if (!customerId) throw new Error('No Stripe customer for this visitor')
     const stripe = integration.createFetcher(getStripeCustomer)
-    const res = await stripe({ params: { id: data.customerId } })
+    const res = await stripe({ params: { id: customerId } })
     if (!res.ok) throw new Error(`Stripe error: ${res.status} ${await res.text()}`)
     return res.json()
   })
@@ -110,12 +112,12 @@ const postSlackMessage = defineIntegration({
 })
 
 const sendSlackMessage = createServerFn({ method: 'POST' })
-  .validator((data: { channel: string; text: string }) => data)
+  .validator((data: { text: string }) => data)
   .handler(async ({ data }) => {
     const slack = integration.createFetcher(postSlackMessage)
     const res = await slack({
       headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ channel: data.channel, text: data.text }),
+      body: JSON.stringify({ channel: '#sales', text: data.text }),
     })
     if (!res.ok) throw new Error(`Slack error: ${res.status} ${await res.text()}`)
     return res.json()

package/skills/softr-sdk/mcp/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.91-alpha.1
+  library_version: 0.0.91
 ---
 
 **Boundary.** `softrMcpMiddleware` lives on `@softr/sdk` and is registered once, in `src/start.ts`. The actions you hand it are the same `defineQuery` / `defineMutation` values the app's own pages use — declared wherever they already live, not duplicated for MCP.
@@ -53,25 +53,10 @@ The list is the whole tool surface. Write it out:
 
 - An action you leave out is invisible to the assistant, even where the app's pages use it freely.
 - An action you list still obeys its own `permissions`. Listing it does not widen who may run it — the assistant runs as whoever signed in, with that user's groups.
-- The assistant calls the action directly and skips server functions, so a row filter written in one does not apply. A listed read returns every row the user's data restrictions allow, and a listed update or delete takes any id that passes them. On a table whose rows belong to people, list an action only once a data restriction scopes the table to the user's own rows.
-- A create on a table whose rows belong to a person gets its owner from `owner`, never from the assistant. See below.
 - Two actions with the same `id` throw at startup. So does anything that is not a `defineQuery` or `defineMutation` value.
 
 Reads first. Add a write only when the user asked for one, and name it back to them.
 
-## The owner of a person's record
-
-The assistant knows the caller's login, not their row in the people table. Left to fill an owner link, it writes the login id, which shows as a stray name, or anyone's row it likes. `owner` takes the field out of the tool and fills it with the caller's own row, found the way `auth.currentUserRow` finds it:
-
-```ts
-softrMcpMiddleware({
-  actions: [listRequests, requestTimeOff],
-  owner: { users: usersQuery, email: 'email', fields: { requestTimeOff: 'employee' } },
-})
-```
-
-`fields` maps each create or update action id to its owner link. A caller with no row in the people table is refused, and nothing is created. On an update the field is only taken out, so nobody moves a record to someone else.
-
 ## The login round trip
 
 Connecting starts with an approval page the app serves. Most people hit it signed out, and that page cannot sign anyone in. It sends them to the login page named in `softr.json` (`auth.routes.login.path`), with the approval page in the search param named there (`auth.routes.login.redirectParam`).

package/skills/softr-sdk/pwa/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.91-alpha.1
+  library_version: 0.0.91
 ---
 
 # Installing the app

package/skills/softr-sdk/record-mutations/SKILL.md

@@ -8,7 +8,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.91-alpha.1
+  library_version: 0.0.91
 ---
 
 **Boundary.** `ds` lives on `@softr/sdk/server` and runs only inside a `createServerFn` handler — importing it into a component fails the build. `defineMutation` and every type come from `@softr/sdk` and can be imported anywhere.

package/skills/softr-sdk/record-queries/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.91-alpha.1
+  library_version: 0.0.91
 ---
 
 **Boundary.** `ds` lives on `@softr/sdk/server` and runs only inside a `createServerFn` handler or a server-side route hook — importing it into a component fails the build. The same holds for any helper that calls `ds`: declare it inside the handler. A function at module level that calls `ds` keeps the server-only import in the browser bundle, and every page stops loading until it moves. `defineQuery` and every type come from `@softr/sdk` and can be imported anywhere.

package/skills/softr-sdk/record-queries/references/filters-and-sorting.md

@@ -127,6 +127,8 @@ Both take filters or nested groups:
 
 Nesting goes two levels, a group inside a group. A third level throws `Cannot nest filter groups more than three levels deep.` Flatten by distributing the outer condition rather than nesting further.
 
+**An `$or` with no members matches every row.** When its members come from a list that can be empty, return no rows for an empty list instead of reading the table.
+
 ## Sorting
 
 ```ts

package/skills/softr-sdk/region-visibility/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.91-alpha.1
+  library_version: 0.0.91
 ---
 
 **Boundary.** `Audience` and `defineVisibility` come from `@softr/sdk` and work anywhere.