@softr/sdk 0.0.93-alpha.2 → 0.0.94

package/dist/action.d.ts

@@ -234,51 +234,6 @@ type IntegrationDefinition<TId extends string> = {
  * const res = await listEvents({ query: { timeMin: now, singleEvents: "true" } })
  */
 declare function defineIntegration<const TId extends string>(definition: IntegrationDefinition<TId>): IntegrationAction<TId>;
-type EmailInputs = {
-  senderId?: string;
-  to?: ReadonlyArray<string>;
-  cc?: ReadonlyArray<string>;
-  bcc?: ReadonlyArray<string>;
-  replyTo?: string;
-};
-type EmailResource = {
-  type: "WORKFLOW_STEP";
-  stepType: "SOFTR_SEND_EMAIL";
-  inputs: EmailInputs;
-};
-type EmailAction<TId extends string = string> = Action<EmailResource> & {
-  id: TId;
-};
-type EmailDefinition<TId extends string> = EmailInputs & {
-  id: TId;
-  permissions: ActionPermissions;
-};
-/**
- * Declares an email action: who may send it, and the fields every email it sends keeps whatever the
- * call says. Softr sends it from the app's email sender and bills the workspace's workflow credits.
- *
- * - `to`, `cc`, `bcc`: addresses. An element may be a whole `{LOGGED_IN_USER:EMAIL}` or
- *   `{LOGGED_IN_USER:<field>}` placeholder, filled in for the signed-in sender.
- * - `replyTo`: an address or one such placeholder.
- * - `senderId`: one of the workspace's email senders, for an email that must come from that address.
- *   Left out, the app's sender is used. The call can never choose the sender.
- *
- * A field declared here wins over the call's, and declaring `to` also ignores the call's `cc` and
- * `bcc`. Fix the recipients whenever the use case allows,
- * because anyone in the audience can otherwise send any email to anyone.
- *
- * Pass the returned object to `email.send()` at runtime.
- *
- * @example
- * const notifyOwner = defineEmailAction({
- *   id: "notifyOwner",
- *   to: ["owner@acme.com"],
- *   permissions: { userGroupTypes: ["NON_LOGGED_IN_USERS", "LOGGED_IN_USERS"] },
- * })
- *
- * await email.send(notifyOwner, { subject: "New submission", body: html, replyTo: data.email })
- */
-declare function defineEmailAction<const TId extends string>(definition: EmailDefinition<TId>): EmailAction<TId>;
 type AiResource = {
   type: "SOFTR_AI";
   model: string;
@@ -313,4 +268,4 @@ type AiDefinition<TId extends string> = {
  */
 declare function defineAiAction<const TId extends string>(definition: AiDefinition<TId>): AiAction<TId>;
 //#endregion
-export { ActionData, ActionPermissions, ActionRecord, ActionShape, AiAction, DatasourceAction, EmailAction, FieldTypeOf, IntegrationAction, ReadOf, ReadShape, SoftrDatasources, WorkflowAction, defineAiAction, defineEmailAction, defineIntegration, defineMutation, defineQuery, defineWorkflow };
+export { ActionData, ActionPermissions, ActionRecord, ActionShape, AiAction, DatasourceAction, FieldTypeOf, IntegrationAction, ReadOf, ReadShape, SoftrDatasources, WorkflowAction, defineAiAction, defineIntegration, defineMutation, defineQuery, defineWorkflow };

package/dist/action.js

@@ -50,43 +50,6 @@ function defineIntegration(definition) {
 		permissions
 	};
 }
-/**
-* Declares an email action: who may send it, and the fields every email it sends keeps whatever the
-* call says. Softr sends it from the app's email sender and bills the workspace's workflow credits.
-*
-* - `to`, `cc`, `bcc`: addresses. An element may be a whole `{LOGGED_IN_USER:EMAIL}` or
-*   `{LOGGED_IN_USER:<field>}` placeholder, filled in for the signed-in sender.
-* - `replyTo`: an address or one such placeholder.
-* - `senderId`: one of the workspace's email senders, for an email that must come from that address.
-*   Left out, the app's sender is used. The call can never choose the sender.
-*
-* A field declared here wins over the call's, and declaring `to` also ignores the call's `cc` and
-* `bcc`. Fix the recipients whenever the use case allows,
-* because anyone in the audience can otherwise send any email to anyone.
-*
-* Pass the returned object to `email.send()` at runtime.
-*
-* @example
-* const notifyOwner = defineEmailAction({
-*   id: "notifyOwner",
-*   to: ["owner@acme.com"],
-*   permissions: { userGroupTypes: ["NON_LOGGED_IN_USERS", "LOGGED_IN_USERS"] },
-* })
-*
-* await email.send(notifyOwner, { subject: "New submission", body: html, replyTo: data.email })
-*/
-function defineEmailAction(definition) {
-	const { id, permissions,...inputs } = definition;
-	return {
-		id,
-		resource: {
-			type: "WORKFLOW_STEP",
-			stepType: "SOFTR_SEND_EMAIL",
-			inputs
-		},
-		permissions
-	};
-}
 function isDatasourceAction(value) {
 	if (typeof value !== "object" || value === null) return false;
 	const candidate = value;
@@ -106,4 +69,4 @@ function defineAiAction(definition) {
 }
 
 //#endregion
-export { defineAiAction, defineEmailAction, defineIntegration, defineMutation, defineQuery, defineWorkflow, isDatasourceAction };
+export { defineAiAction, defineIntegration, defineMutation, defineQuery, defineWorkflow, isDatasourceAction };

package/dist/auth/methods/emailCode2fa.d.ts

@@ -0,0 +1,34 @@
+import { User } from "../user.js";
+import { AuthError, Result } from "./utils.js";
+
+//#region src/auth/methods/emailCode2fa.d.ts
+
+/**
+ * Finishes a sign-in that answered `emailCodeRequired`, with the code emailed
+ * to the visitor.
+ *
+ * A `signedIn` result means the visitor is signed in. An app that also asks for
+ * an authenticator app answers `authenticatorRequired` instead, naming the step
+ * to send them to next.
+ */
+declare function verifyEmailCode(details: {
+  code: string;
+}): Promise<Result<{
+  status: "signedIn";
+  user: User;
+} | {
+  status: "authenticatorRequired";
+  /**
+   * `verify`: they have an authenticator app and owe a code.
+   * `setup`: the app requires one and they have none yet.
+   * `setupOptional`: same, except they may skip it instead.
+   */
+  step: "verify" | "setup" | "setupOptional";
+}, AuthError>>;
+/**
+ * Emails the code for {@link verifyEmailCode} again. Asking again within a
+ * short wait sends nothing and still succeeds.
+ */
+declare function resendEmailCode(): Promise<Result<null, AuthError>>;
+//#endregion
+export { resendEmailCode, verifyEmailCode };

package/dist/auth/methods/emailCode2fa.js

@@ -0,0 +1,71 @@
+import { assert, panic } from "../../assertions.js";
+import { writeCookies } from "../../cookies.js";
+import { sessionConfig } from "../config.js";
+import { clearPendingAuth, makePendingAuthCookie, makeSessionDataCookie, makeSessionTokenCookie, readPendingAuthToken } from "../session.js";
+import { makePlatform } from "../platform.js";
+import { authError } from "./utils.js";
+
+//#region src/auth/methods/emailCode2fa.ts
+/**
+* Finishes a sign-in that answered `emailCodeRequired`, with the code emailed
+* to the visitor.
+*
+* A `signedIn` result means the visitor is signed in. An app that also asks for
+* an authenticator app answers `authenticatorRequired` instead, naming the step
+* to send them to next.
+*/
+async function verifyEmailCode(details) {
+	const result = await makePlatform(sessionConfig().applicationId).emailCodeVerify(readPendingAuthToken(), details.code);
+	if (!result.ok) {
+		if (result.status === 400 || result.status === 401) return authError("invalidCode", result.message);
+		if (result.status === 429) return authError("tooManyAttempts", result.message);
+		if (result.status >= 500) panic(`Expected to verify the emailed code, but got ${result.status}: ` + result.message);
+		throw new Error(`${result.message}. Check SOFTR_APPLICATION_ID and that the app asks for an emailed code at sign-in.`);
+	}
+	if (result.data.status === "MFA_REQUIRED") {
+		const { mfa } = result.data;
+		assert(mfa, "Expected a challenge from verification, but got none");
+		writeCookies([makePendingAuthCookie(mfa.challengeToken)]);
+		return {
+			success: true,
+			data: {
+				status: "authenticatorRequired",
+				step: mfa.action === "VERIFICATION_REQUIRED" ? "verify" : mfa.action === "SETUP_REQUIRED" ? "setup" : "setupOptional"
+			}
+		};
+	}
+	const { session } = result.data;
+	assert(session, "Expected a session from verification, but got none");
+	writeCookies([...makeSessionTokenCookie(session.jwt), makeSessionDataCookie({
+		user: session.user,
+		permissions: session.permissions
+	}, session.jwt)]);
+	clearPendingAuth();
+	return {
+		success: true,
+		data: {
+			status: "signedIn",
+			user: session.user
+		}
+	};
+}
+/**
+* Emails the code for {@link verifyEmailCode} again. Asking again within a
+* short wait sends nothing and still succeeds.
+*/
+async function resendEmailCode() {
+	const result = await makePlatform(sessionConfig().applicationId).emailCodeResend(readPendingAuthToken());
+	if (!result.ok) {
+		if (result.status === 401) return authError("notAuthenticated", result.message);
+		if (result.status === 429) return authError("tooManyAttempts", result.message);
+		if (result.status >= 500) panic(`Expected the code to be emailed again, but got ${result.status}: ` + result.message);
+		throw new Error(`${result.message}. Check SOFTR_APPLICATION_ID and that the app asks for an emailed code at sign-in.`);
+	}
+	return {
+		success: true,
+		data: null
+	};
+}
+
+//#endregion
+export { resendEmailCode, verifyEmailCode };

package/dist/auth/methods/password.d.ts

@@ -8,7 +8,8 @@ import { AuthError, Result } from "./utils.js";
  *
  * A `signedIn` result means the visitor is signed in. An app that also asks for
  * an authenticator app answers `authenticatorRequired` instead, naming the step
- * to send them to next.
+ * to send them to next. An app that also asks for an emailed code answers
+ * `emailCodeRequired`; `verifyEmailCode` finishes it.
  */
 declare function signIn(credentials: {
   email: string;
@@ -24,6 +25,8 @@ declare function signIn(credentials: {
    * `setupOptional`: same, except they may skip it instead.
    */
   step: "verify" | "setup" | "setupOptional";
+} | {
+  status: "emailCodeRequired";
 }, AuthError>>;
 /**
  * Signs the visitor out.

package/dist/auth/methods/password.js

@@ -11,7 +11,8 @@ import { authError } from "./utils.js";
 *
 * A `signedIn` result means the visitor is signed in. An app that also asks for
 * an authenticator app answers `authenticatorRequired` instead, naming the step
-* to send them to next.
+* to send them to next. An app that also asks for an emailed code answers
+* `emailCodeRequired`; `verifyEmailCode` finishes it.
 */
 async function signIn(credentials) {
 	const result = await makePlatform(sessionConfig().applicationId).tokens(credentials);
@@ -25,6 +26,10 @@ async function signIn(credentials) {
 		const { mfa } = result.data;
 		assert(mfa, "Expected a challenge from sign-in, but got none");
 		writeCookies([makePendingAuthCookie(mfa.challengeToken)]);
+		if (mfa.action === "EMAIL_CODE_REQUIRED") return {
+			success: true,
+			data: { status: "emailCodeRequired" }
+		};
 		return {
 			success: true,
 			data: {

package/dist/auth/platform.js

@@ -71,6 +71,27 @@ function makePlatform(applicationId) {
 		tokens: (credentials) => request(`/v1/vibe/applications/${applicationId}/users/tokens${withAttributes}`, {
 			method: "POST",
 			json: credentials
+		}, z.object({
+			status: z.enum(["AUTHENTICATED", "MFA_REQUIRED"]),
+			session: z.object({
+				jwt: z.string(),
+				user: userSchema,
+				permissions: permissionsSchema
+			}).nullish(),
+			mfa: z.object({
+				action: z.enum([
+					"VERIFICATION_REQUIRED",
+					"SETUP_REQUIRED",
+					"SETUP_OPTIONAL",
+					"EMAIL_CODE_REQUIRED"
+				]),
+				challengeToken: z.string()
+			}).nullish()
+		})),
+		emailCodeVerify: (token, code) => request(`/v1/vibe/applications/${applicationId}/users/tokens/email-code/verify${withAttributes}`, {
+			method: "POST",
+			token,
+			json: { code }
 		}, z.object({
 			status: z.enum(["AUTHENTICATED", "MFA_REQUIRED"]),
 			session: z.object({
@@ -87,6 +108,10 @@ function makePlatform(applicationId) {
 				challengeToken: z.string()
 			}).nullish()
 		})),
+		emailCodeResend: (token) => request(`/v1/vibe/applications/${applicationId}/users/tokens/email-code/resend`, {
+			method: "POST",
+			token
+		}, z.null()),
 		sendSignInCode: (email) => request(`/v1/vibe/applications/${applicationId}/users/tokens/send-code`, {
 			method: "POST",
 			json: { email }

package/dist/auth/server.d.ts

@@ -1,5 +1,6 @@
 import { confirmAuthenticatorSetup, removeAuthenticator, resetAuthenticator, sendAuthenticatorResetCode, skipAuthenticatorSetup, startAuthenticatorSetup, verifyAuthenticator } from "./methods/authenticator.js";
 import { sendSignInCode, signInWithCode } from "./methods/code.js";
+import { resendEmailCode, verifyEmailCode } from "./methods/emailCode2fa.js";
 import { signInWithMagicLink } from "./methods/magicLink.js";
 import { signIn, signOut } from "./methods/password.js";
 import { checkPasswordLink, requestPasswordReset, setPasswordWithLink } from "./methods/passwordLink.js";
@@ -34,6 +35,8 @@ declare const auth: {
   sendAuthenticatorResetCode: typeof sendAuthenticatorResetCode;
   resetAuthenticator: typeof resetAuthenticator;
   removeAuthenticator: typeof removeAuthenticator;
+  verifyEmailCode: typeof verifyEmailCode;
+  resendEmailCode: typeof resendEmailCode;
   settings: typeof settings;
   updateProfile: typeof updateProfile;
   removeAvatar: typeof removeAvatar;

package/dist/auth/server.js

@@ -1,6 +1,7 @@
 import { settings } from "./methods/settings.js";
 import { confirmAuthenticatorSetup, removeAuthenticator, resetAuthenticator, sendAuthenticatorResetCode, skipAuthenticatorSetup, startAuthenticatorSetup, verifyAuthenticator } from "./methods/authenticator.js";
 import { sendSignInCode, signInWithCode } from "./methods/code.js";
+import { resendEmailCode, verifyEmailCode } from "./methods/emailCode2fa.js";
 import { signInWithMagicLink } from "./methods/magicLink.js";
 import { signIn, signOut } from "./methods/password.js";
 import { checkPasswordLink, requestPasswordReset, setPasswordWithLink } from "./methods/passwordLink.js";
@@ -33,6 +34,8 @@ const auth = {
 	sendAuthenticatorResetCode,
 	resetAuthenticator,
 	removeAuthenticator,
+	verifyEmailCode,
+	resendEmailCode,
 	settings,
 	updateProfile,
 	removeAvatar,

package/dist/index.d.ts

@@ -1,9 +1,8 @@
 import { SoftrUserGroupId, SoftrUserGroups, SoftrUserProperties, User } from "./auth/user.js";
-import { ActionPermissions, SoftrDatasources, defineAiAction, defineEmailAction, defineIntegration, defineMutation, defineQuery, defineWorkflow } from "./action.js";
+import { ActionPermissions, SoftrDatasources, defineAiAction, defineIntegration, defineMutation, defineQuery, defineWorkflow } from "./action.js";
 import { FileAttachment } from "./core/file-upload.js";
 import { FileItem, useFileUpload } from "./core/use-file-upload.js";
 import { AiAnswer, AiFile, AiGenerateInit, AiMessage, AiUsage } from "./core/ai.js";
-import { EmailAttachment, EmailSendInit, EmailSent } from "./core/email.js";
 import { DateOptions, DateParts, DateSeparator, DateValue, FixedDateFormat, FormattedDate, Formatting, FormattingScope, WeekDay, formatDate, formatDateTime, formatNumber, useFormatting } from "./formatting.js";
 import { SoftrContext } from "./auth/context.js";
 import { AuthSettings } from "./auth/platform.js";
@@ -19,4 +18,4 @@ import { useUserTimezone } from "./timezone.js";
 import { PwaInstall, PwaPlatform, SoftrPwaHead, usePwaInstall } from "./pwa.js";
 import { DefaultErrorOverlay } from "./default-error-overlay.js";
 import { Audience } from "./route/audience.js";
-export { type ActionPermissions, type AiAnswer, type AiFile, type AiGenerateInit, type AiMessage, type AiUsage, Audience, type AuthOptions, type AuthSettings, AuthSettingsProvider, type DateOptions, type DateParts, type DateSeparator, type DateValue, DefaultErrorOverlay, type EmailAttachment, type EmailSendInit, type EmailSent, type FieldShape, type FileAttachment, type FileItem, type FixedDateFormat, FormattedDate, type Formatting, FormattingScope, type Page, type PageSettings, type PwaInstall, type PwaPlatform, type SoftrContext, type SoftrDatasources, type SoftrFieldRegistry, SoftrPwaHead, type SoftrUserGroupId, type SoftrUserGroups, type SoftrUserProperties, type User, type WeekDay, assertRouteAccess, checkAccess, defineAiAction, defineEmailAction, defineIntegration, defineMutation, definePage, defineQuery, defineVisibility, defineWorkflow, fieldShape, formatDate, formatDateTime, formatDuration, formatField, formatNumber, formatValue, getAuthSettings, getSoftrContext, guardRoute, initialSoftrContext, isAccessError, isAlreadyAuthenticatedError, isAuthorized, isForbiddenError, isUnauthenticatedError, pageHead, registerSoftrFields, softrAuthMiddleware, softrMcpMiddleware, toReturnPath, useAuthSettings, useCurrentUser, useFileUpload, useFormatting, useOverrides, usePwaInstall, useUserTimezone };
+export { type ActionPermissions, type AiAnswer, type AiFile, type AiGenerateInit, type AiMessage, type AiUsage, Audience, type AuthOptions, type AuthSettings, AuthSettingsProvider, type DateOptions, type DateParts, type DateSeparator, type DateValue, DefaultErrorOverlay, type FieldShape, type FileAttachment, type FileItem, type FixedDateFormat, FormattedDate, type Formatting, FormattingScope, type Page, type PageSettings, type PwaInstall, type PwaPlatform, type SoftrContext, type SoftrDatasources, type SoftrFieldRegistry, SoftrPwaHead, type SoftrUserGroupId, type SoftrUserGroups, type SoftrUserProperties, type User, type WeekDay, assertRouteAccess, checkAccess, defineAiAction, defineIntegration, defineMutation, definePage, defineQuery, defineVisibility, defineWorkflow, fieldShape, formatDate, formatDateTime, formatDuration, formatField, formatNumber, formatValue, getAuthSettings, getSoftrContext, guardRoute, initialSoftrContext, isAccessError, isAlreadyAuthenticatedError, isAuthorized, isForbiddenError, isUnauthenticatedError, pageHead, registerSoftrFields, softrAuthMiddleware, softrMcpMiddleware, toReturnPath, useAuthSettings, useCurrentUser, useFileUpload, useFormatting, useOverrides, usePwaInstall, useUserTimezone };

package/dist/index.js

@@ -1,4 +1,4 @@
-import { defineAiAction, defineEmailAction, defineIntegration, defineMutation, defineQuery, defineWorkflow } from "./action.js";
+import { defineAiAction, defineIntegration, defineMutation, defineQuery, defineWorkflow } from "./action.js";
 import { useFileUpload } from "./core/use-file-upload.js";
 import { checkAccess, defineVisibility, isAuthorized } from "./route/visibility.js";
 import { assertRouteAccess, guardRoute, isAccessError, isAlreadyAuthenticatedError, isForbiddenError, isUnauthenticatedError } from "./route/route.js";
@@ -14,4 +14,4 @@ import { useUserTimezone } from "./timezone.js";
 import { DefaultErrorOverlay } from "./default-error-overlay.js";
 import { Audience } from "./route/audience.js";
 
-export { Audience, AuthSettingsProvider, DefaultErrorOverlay, FormattedDate, FormattingScope, SoftrPwaHead, assertRouteAccess, checkAccess, defineAiAction, defineEmailAction, defineIntegration, defineMutation, definePage, defineQuery, defineVisibility, defineWorkflow, fieldShape, formatDate, formatDateTime, formatDuration, formatField, formatNumber, formatValue, getAuthSettings, getSoftrContext, guardRoute, initialSoftrContext, isAccessError, isAlreadyAuthenticatedError, isAuthorized, isForbiddenError, isUnauthenticatedError, pageHead, registerSoftrFields, softrAuthMiddleware, softrMcpMiddleware, toReturnPath, useAuthSettings, useCurrentUser, useFileUpload, useFormatting, useOverrides, usePwaInstall, useUserTimezone };
+export { Audience, AuthSettingsProvider, DefaultErrorOverlay, FormattedDate, FormattingScope, SoftrPwaHead, assertRouteAccess, checkAccess, defineAiAction, defineIntegration, defineMutation, definePage, defineQuery, defineVisibility, defineWorkflow, fieldShape, formatDate, formatDateTime, formatDuration, formatField, formatNumber, formatValue, getAuthSettings, getSoftrContext, guardRoute, initialSoftrContext, isAccessError, isAlreadyAuthenticatedError, isAuthorized, isForbiddenError, isUnauthenticatedError, pageHead, registerSoftrFields, softrAuthMiddleware, softrMcpMiddleware, toReturnPath, useAuthSettings, useCurrentUser, useFileUpload, useFormatting, useOverrides, usePwaInstall, useUserTimezone };

package/dist/package.js

@@ -1,5 +1,5 @@
 //#region package.json
-var version = "0.0.93-alpha.2";
+var version = "0.0.94";
 
 //#endregion
 export { version };

package/dist/server.d.ts

@@ -1,11 +1,9 @@
 import { upload } from "./core/file-upload.js";
 import { AiError, ai } from "./core/ai.js";
-import { StepError, StepErrorCode } from "./core/step.js";
-import { EmailError, EmailErrorCode, email } from "./core/email.js";
 import { auth } from "./auth/server.js";
 import { FieldChoice, RecordOption, RecordOptions } from "./core/options.js";
 import { ds } from "./datasource/datasource.js";
 import { workflow } from "./core/workflow.js";
 import { integration } from "./core/integration.js";
 import "@tanstack/react-start/server-only";
-export { AiError, EmailError, type EmailErrorCode, type FieldChoice, type RecordOption, type RecordOptions, StepError, type StepErrorCode, ai, auth, ds, email, integration, upload, workflow };
+export { AiError, type FieldChoice, type RecordOption, type RecordOptions, ai, auth, ds, integration, upload, workflow };

package/dist/server.js

@@ -4,8 +4,6 @@ import { auth } from "./auth/server.js";
 import { workflow } from "./core/workflow.js";
 import { integration } from "./core/integration.js";
 import { AiError, ai } from "./core/ai.js";
-import { StepError } from "./core/step.js";
-import { EmailError, email } from "./core/email.js";
 import "@tanstack/react-start/server-only";
 
-export { AiError, EmailError, StepError, ai, auth, ds, email, integration, upload, workflow };
+export { AiError, ai, auth, ds, integration, upload, workflow };

package/dist/vite.js

@@ -1,10 +1,9 @@
 import { SOFTR_CONFIG_FILE, loadSoftrConfig } from "./softr-config.schema.js";
 import path from "node:path";
-import { pathToFileURL } from "node:url";
 
 //#region src/vite.ts
 function softr() {
-	return [softrConfig(), editEngine()];
+	return [softrConfig()];
 }
 function softrConfig() {
 	let root;
@@ -23,24 +22,6 @@ function softrConfig() {
 		}
 	};
 }
-/**
-* The edit engine is provided by the pod runtime rather than an app dependency: it is never in the
-* app's `package.json` and never in its `node_modules`. The pod points `SOFTR_EDIT_ENGINE_DIR` at
-* the copy baked into its image, and this function loads it from there.
-*
-* If the env var is unset, this plugin is a no-op. It's only loaded in the preview mode
-*/
-async function editEngine() {
-	const dir = process.env.SOFTR_EDIT_ENGINE_DIR;
-	if (!dir) return false;
-	const entry = pathToFileURL(path.join(dir, "dist", "vite.js")).href;
-	try {
-		return (await import(entry)).editEngineStudio();
-	} catch (error) {
-		console.error(`[softr] could not load the edit engine from ${entry}:`, error);
-		return false;
-	}
-}
 
 //#endregion
 export { softr };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softr/sdk",
-  "version": "0.0.93-alpha.2",
+  "version": "0.0.94",
   "type": "module",
   "exports": {
     ".": { "types": "./dist/index.d.ts", "import": "./dist/index.js" },

package/skills/softr-sdk/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: core
   library: softr-sdk
-  library_version: 0.0.93-alpha.2
+  library_version: 0.0.94
 ---
 
 # Softr SDK core
@@ -22,8 +22,6 @@ metadata:
 >
 > **CRITICAL**: The app is already wired. `src/start.ts`, `src/router.tsx` and `src/routes/__root.tsx` register `softrAuthMiddleware` and resolve the session. Do not add a second registration of it. `softrMcpMiddleware` is the one thing an app adds to `src/start.ts` itself — load the `softr-sdk/mcp` sub-skill before doing so.
 >
-> **CRITICAL**: `email.send` lives on `@softr/sdk/server` and only runs inside a `createServerFn` handler. Use `defineEmailAction` from `@softr/sdk` to declare who may send it and the recipients it fixes. An email the app sends itself needs no workflow and no connected mail service. Load the `softr-sdk/email` sub-skill for the full pattern.
->
 > **CRITICAL**: `ai.generate` and `ai.stream` live on `@softr/sdk/server` and only run inside a `createServerFn` handler. Use `defineAiAction` from `@softr/sdk` to declare the action with the model it runs on, an id copied from the `ai_list_models` tool. Softr runs the model on its own keys; never ask the user for an API key for the app's own AI feature. Load the `softr-sdk/ai` sub-skill for the full pattern.
 >
 > **CRITICAL**: `workflow.trigger` lives on `@softr/sdk/server` and only runs inside a `createServerFn` handler. Use `defineWorkflow` from `@softr/sdk` to declare the action, then pass it to `workflow.trigger`. Load the `softr-sdk/workflows` sub-skill for the full pattern.
@@ -34,8 +32,8 @@ Each sub-skill stands alone for its task and repeats the boundary above, so most
 
 | Import | Runs | Holds |
 | --- | --- | --- |
-| `@softr/sdk` | Both | `defineQuery`, `defineMutation`, `defineEmailAction`, `defineAiAction`, `definePage`, `pageHead`, `defineVisibility`, `guardRoute`, `assertRouteAccess`, `isAuthorized`, `checkAccess`, `Audience`, `useCurrentUser`, `useUserTimezone`, `FormattedDate`, `FormattingScope`, `useFormatting`, `formatDate`, `formatDateTime`, `formatNumber`, `formatValue`, `formatField`, `fieldShape`, `registerSoftrFields`, `useOverrides`, `SoftrPwaHead`, `usePwaInstall`, `getSoftrContext`, `initialSoftrContext`, `softrAuthMiddleware`, the error predicates, and every type |
-| `@softr/sdk/server` | Server only | `ds`, `auth`, `email`, `EmailError`, `workflow`, `integration`, `ai` |
+| `@softr/sdk` | Both | `defineQuery`, `defineMutation`, `defineAiAction`, `definePage`, `pageHead`, `defineVisibility`, `guardRoute`, `assertRouteAccess`, `isAuthorized`, `checkAccess`, `Audience`, `useCurrentUser`, `useUserTimezone`, `FormattedDate`, `FormattingScope`, `useFormatting`, `formatDate`, `formatDateTime`, `formatNumber`, `formatValue`, `formatField`, `fieldShape`, `registerSoftrFields`, `useOverrides`, `SoftrPwaHead`, `usePwaInstall`, `getSoftrContext`, `initialSoftrContext`, `softrAuthMiddleware`, the error predicates, and every type |
+| `@softr/sdk/server` | Server only | `ds`, `auth`, `workflow`, `integration`, `ai` |
 | `@softr/sdk/client` | Browser only | `useFileUpload` |
 | `@softr/sdk/vite` | Build | `softr()`, already in `vite.config.ts` |
 
@@ -49,11 +47,10 @@ Each sub-skill stands alone for its task and repeats the boundary above, so most
 | Fetch records from a datasource | [record-queries/SKILL.md](./record-queries/SKILL.md) |
 | Chart, aggregate or count records | [charts-and-metrics/SKILL.md](./charts-and-metrics/SKILL.md) |
 | Create, update or delete a record | [record-mutations/SKILL.md](./record-mutations/SKILL.md) |
-| Send an email from the app: a form that emails the owner, a confirmation, staff emailing a client | [email/SKILL.md](./email/SKILL.md) |
 | Trigger a Softr workflow | [workflows/SKILL.md](./workflows/SKILL.md) |
 | Sign a visitor in, out, or up | [auth/SKILL.md](./auth/SKILL.md) |
 | Ask an AI model: a summary, an extraction from a document, a classification, a draft, a chat | [ai/SKILL.md](./ai/SKILL.md) |
-| Call a connected third-party API (Slack, Stripe, Gmail from the user's own mailbox, …), or an AI model on the user's own provider account | [integrations/SKILL.md](./integrations/SKILL.md) |
+| Call a connected third-party API (Slack, Stripe, Gmail, …), or an AI model on the user's own provider account | [integrations/SKILL.md](./integrations/SKILL.md) |
 | Open the app to AI assistants over MCP | [mcp/SKILL.md](./mcp/SKILL.md) |
 | Let visitors install the app on their home screen | [pwa/SKILL.md](./pwa/SKILL.md) |
 | Show a date, a time or a number | [formatting/SKILL.md](./formatting/SKILL.md) |
@@ -79,9 +76,6 @@ Drawing a chart, a stat tile, or any aggregated number?
 Submitting a form, editing a record, or deleting one?
   load softr-sdk/record-mutations
 
-Sending an email when a form is submitted or a button is pressed?
-  load softr-sdk/email — no workflow, no connected mail service
-
 Triggering a Softr workflow from a button or form?
   load softr-sdk/workflows
 

package/skills/softr-sdk/ai/SKILL.md

@@ -13,7 +13,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.93-alpha.2
+  library_version: 0.0.94
 ---
 
 **Boundary.** `ai` lives on `@softr/sdk/server` and runs only inside a `createServerFn` handler — importing it into a component fails the build. `defineAiAction` and every type come from `@softr/sdk` and can be imported anywhere.

package/skills/softr-sdk/auth/SKILL.md

@@ -3,13 +3,13 @@ name: auth
 description: >-
   Sign a visitor in, out or up from a server function with auth from
   @softr/sdk/server: password, code, Google and magic link, sign-up and its
-  confirmation, the authenticator-app steps, password reset links,
-  updateProfile, and getAuthSettings and useAuthSettings for the methods the app
-  enables. Covers the Result shape, its error codes, and toReturnPath.
+  confirmation, the emailed-code and authenticator-app steps, password reset
+  links, updateProfile, and getAuthSettings and useAuthSettings for the methods
+  the app enables. Covers the Result shape, its error codes, and toReturnPath.
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.93-alpha.2
+  library_version: 0.0.94
 ---
 
 **Boundary.** `auth` lives on `@softr/sdk/server` and runs only inside a `createServerFn` handler — importing it into a component fails the build.
@@ -55,6 +55,13 @@ Signing out:
 | --- | --- |
 | `auth.signOut()` | Ends every session that visitor has in this app, on every device |
 
+Finishing a sign-in that wants a code from the visitor's inbox:
+
+| Call | Does |
+| --- | --- |
+| `auth.verifyEmailCode({ code })` | Answers it with the code that was emailed |
+| `auth.resendEmailCode()` | Emails that code again |
+
 Finishing a sign-in that wants an authenticator app:
 
 | Call | Does |
@@ -197,6 +204,8 @@ Those calls take only what the visitor typed. The sign-in they finish is the one
 
 An app with no authenticator app configured never answers `authenticatorRequired`. The type still has both arms either way, so `result.data.user` does not exist until you have narrowed on `status`.
 
+`signIn` has a third answer, `{ status: 'emailCodeRequired' }`, for an app that asks a password sign-in for a code from the visitor's inbox as well. The code is already on its way. Show a code field as the next step and finish with `auth.verifyEmailCode({ code })`, see [Finishing a sign-in that needs an emailed code](#finishing-a-sign-in-that-needs-an-emailed-code). That call answers like `signIn` does, so an app that also wants an authenticator app goes on to that step after it.
+
 ## Landing after sign-in
 
 A guard that turns a signed-out visitor away sends them to the page `softr.json` names for that, usually the login page. The page they wanted rides along in the search param named for the login page. `toReturnPath` from `@softr/sdk` reads it back:
@@ -255,10 +264,13 @@ if (answer.message !== null) return setMessage(answer.message)
 if (answer.outcome.status === 'authenticatorRequired') {
   return setStep({ name: 'secondFactor', opensOn: answer.outcome.step })
 }
+if (answer.outcome.status === 'emailCodeRequired') {
+  return setStep({ name: 'emailCode' })
+}
 await navigate({ href: target })
 ```
 
-Three exits: a message for the form to render, the second-factor step, the return target.
+Four exits: a message for the form to render, the emailed-code step, the authenticator step, the return target.
 
 A server function that throws `redirect` needs the hook. Call the imported function directly and the throw never reaches the router, so a successful sign-in leaves the visitor on the form.
 
@@ -385,6 +397,22 @@ The UI has to carry email into step two, plus the name if step one collected one
 
 `password` is what the account is created with. Leave it out only for an app that signs people in with an emailed code. An app that expects a password rejects a sign-up without one, and an app that does not expect one rejects a sign-up that sends it.
 
+### Finishing a sign-in that needs an emailed code
+
+After `signIn` answers `emailCodeRequired`, the visitor owes the code that was just emailed to them:
+
+```ts
+// invalidCode for a wrong or expired code, otherwise the same two-armed result as signIn.
+const result = await auth.verifyEmailCode({ code })
+
+// For a "Resend code" link.
+const sent = await auth.resendEmailCode()
+```
+
+Send `authenticatorRequired` on to the authenticator step, never into the app.
+
+Asking for a resend too soon sends nothing and still succeeds. It answers `notAuthenticated` once the sign-in has run out of time, and the visitor then signs in again from the start.
+
 ### Finishing a sign-in that needs an authenticator app
 
 On `step: 'verify'` the visitor already has an app, and owes a code from it:

package/skills/softr-sdk/charts-and-metrics/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.93-alpha.2
+  library_version: 0.0.94
 ---
 
 **Boundary.** `ds` lives on `@softr/sdk/server` and runs only inside a `createServerFn` handler or a server-side route hook — importing it into a component fails the build. `defineQuery` and every type come from `@softr/sdk` and can be imported anywhere.

package/skills/softr-sdk/current-user/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.93-alpha.2
+  library_version: 0.0.94
 ---
 
 # The current user

package/skills/softr-sdk/file-uploads/SKILL.md

@@ -7,7 +7,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.93-alpha.2
+  library_version: 0.0.94
 ---
 
 **Boundary.** `upload` lives on `@softr/sdk/server` and runs inside server functions. `useFileUpload` and `FileItem` live on `@softr/sdk` and run in components. `FileAttachment` comes from `@softr/sdk` and can be imported anywhere.

package/skills/softr-sdk/formatting/SKILL.md

@@ -8,7 +8,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.93-alpha.2
+  library_version: 0.0.94
 ---
 
 # Dates, times and numbers

package/skills/softr-sdk/integrations/SKILL.md

@@ -7,7 +7,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.93-alpha.2
+  library_version: 0.0.94
 ---
 
 **Boundary.** `integration` lives on `@softr/sdk/server` and runs only inside a `createServerFn` handler — importing it into a component fails the build. `defineIntegration` and every type come from `@softr/sdk` and can be imported anywhere.
@@ -16,8 +16,6 @@ metadata:
 
 `integration.createFetcher` calls a third-party API through Softr's authenticated proxy. It adds the connected account's credentials automatically — you never set API keys or auth headers yourself. **Every call acts as that one account, whoever the visitor is**, so take what a call reaches, such as a customer or a channel, from the session or a record the server read, never from the arguments the browser sends.
 
-An email the app sends is the `email` sub-skill, with nothing to connect. Send through a connected Gmail or Outlook only when the user wants the email to come from their own mailbox.
-
 ## Setup
 
 ```ts

package/skills/softr-sdk/mcp/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.93-alpha.2
+  library_version: 0.0.94
 ---
 
 **Boundary.** `softrMcpMiddleware` lives on `@softr/sdk` and is registered once, in `src/start.ts`. The actions you hand it are the same `defineQuery` / `defineMutation` values the app's own pages use — declared wherever they already live, not duplicated for MCP.

package/skills/softr-sdk/pwa/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.93-alpha.2
+  library_version: 0.0.94
 ---
 
 # Installing the app

package/skills/softr-sdk/record-mutations/SKILL.md

@@ -8,7 +8,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.93-alpha.2
+  library_version: 0.0.94
 ---
 
 **Boundary.** `ds` lives on `@softr/sdk/server` and runs only inside a `createServerFn` handler — importing it into a component fails the build. `defineMutation` and every type come from `@softr/sdk` and can be imported anywhere.

package/skills/softr-sdk/record-queries/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.93-alpha.2
+  library_version: 0.0.94
 ---
 
 **Boundary.** `ds` lives on `@softr/sdk/server` and runs only inside a `createServerFn` handler or a server-side route hook — importing it into a component fails the build. The same holds for any helper that calls `ds`: declare it inside the handler. A function at module level that calls `ds` keeps the server-only import in the browser bundle, and every page stops loading until it moves. `defineQuery` and every type come from `@softr/sdk` and can be imported anywhere.

package/skills/softr-sdk/region-visibility/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.93-alpha.2
+  library_version: 0.0.94
 ---
 
 **Boundary.** `Audience` and `defineVisibility` come from `@softr/sdk` and work anywhere.

package/skills/softr-sdk/routes-and-visibility/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.93-alpha.2
+  library_version: 0.0.94
 ---
 
 **Boundary.** `definePage`, `pageHead`, the access functions and the error predicates come from `@softr/sdk` and work anywhere.

package/skills/softr-sdk/workflows/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.93-alpha.2
+  library_version: 0.0.94
 ---
 
 **Boundary.** `workflow` lives on `@softr/sdk/server` and runs only inside a `createServerFn` handler — importing it into a component fails the build. `defineWorkflow` and every type come from `@softr/sdk` and can be imported anywhere.
@@ -18,8 +18,6 @@ metadata:
 
 `workflow.trigger` fires a Softr workflow and waits for it to finish. It resolves to `void`.
 
-An email the app sends itself, when a form is submitted or a button is pressed, needs no workflow: load the `email` sub-skill. Fire a workflow for what the workflow's own steps do, such as updating a CRM or posting to a connected service.
-
 ## Setup
 
 ```ts
@@ -33,15 +31,15 @@ import { workflow } from '@softr/sdk/server'
 Every trigger needs a workflow action: which workflow, which trigger step, who may run it, and any data that is always sent. The workflow must have a **Run custom workflow** trigger — no other trigger type can be fired from app code.
 
 ```ts
-const syncNewLead = defineWorkflow({
-  id: 'syncNewLead',
+const sendWelcomeEmail = defineWorkflow({
+  id: 'sendWelcomeEmail',
   workflowId: 'c9d8e7f6-a5b4-4c3d-8e2f-1a0b9c8d7e6f',
   triggerId: '926da496-749f-4006-999c-197d8a556122',
   permissions: { userGroupTypes: ['LOGGED_IN_USERS'] },
   body: {
     email: '{LOGGED_IN_USER:EMAIL}',  // resolved server-side from the signed-in user
     name: '{LOGGED_IN_USER:NAME}',
-    source: 'website',                // any hardcoded value — always sent, never overridden at runtime
+    plan: 'enterprise',               // any hardcoded value — always sent, never overridden at runtime
   },
 })
 ```
@@ -72,7 +70,7 @@ These placeholders are resolved server-side when the workflow runs:
 const runWorkflow = createServerFn({ method: 'POST' })
   .validator(z.object({ message: z.string() }))
   .handler(async ({ data }) => {
-    await workflow.trigger(syncNewLead, { message: data.message })
+    await workflow.trigger(sendWelcomeEmail, { message: data.message })
   })
 ```
 
@@ -84,7 +82,7 @@ const runWorkflow = createServerFn({ method: 'POST' })
 
 ```ts
 const run = createServerFn({ method: 'POST' }).handler(async () => {
-  await workflow.trigger(syncNewLead)
+  await workflow.trigger(sendWelcomeEmail)
 })
 ```
 
@@ -96,11 +94,11 @@ Omit the second argument when the action's `body` already carries everything the
 
 ```ts
 // Wrong: calling from a click handler
-<button onClick={() => workflow.trigger(syncNewLead)}>Run</button>
+<button onClick={() => workflow.trigger(sendWelcomeEmail)}>Run</button>
 
 // Correct: server function, called from the button
 const run = createServerFn({ method: 'POST' }).handler(() =>
-  workflow.trigger(syncNewLead),
+  workflow.trigger(sendWelcomeEmail),
 )
 // …
 const submit = useServerFn(run)

package/dist/core/email.d.ts

@@ -1,52 +0,0 @@
-import { EmailAction } from "../action.js";
-import { StepError, StepErrorCode } from "./step.js";
-
-//#region src/core/email.d.ts
-/** A file the email carries, by the URL the app holds it under. */
-interface EmailAttachment {
-  name: string;
-  /** The URL of a file uploaded to this app with `upload`. */
-  url: string;
-}
-interface EmailSendInit {
-  /** Ignored when the action declares its own. */
-  to?: ReadonlyArray<string>;
-  /** Ignored when the action declares its own `cc` or `to`. */
-  cc?: ReadonlyArray<string>;
-  /** Ignored when the action declares its own `bcc` or `to`. */
-  bcc?: ReadonlyArray<string>;
-  /** Ignored when the action declares its own. */
-  replyTo?: string;
-  subject: string;
-  /** Plain text or HTML. */
-  body: string;
-  /** Files uploaded to this app with `upload`; any other URL is refused. */
-  attachments?: ReadonlyArray<EmailAttachment>;
-  /**
-   * The same key sends the email once, however often the call is repeated. Pass one derived from
-   * what the email is about, such as the id of the record it announces, when the call may be retried.
-   * At most 128 characters. Left out, every call gets a fresh one.
-   */
-  idempotencyKey?: string;
-}
-interface EmailSent {
-  /** Null when the mail provider did not report one; the email was still sent. */
-  messageId: string | null;
-}
-type EmailErrorCode = StepErrorCode;
-/**
- * Thrown when Softr did not send the email; a {@link StepError}, so `code` says why. For an email, `INVALID_INPUT`
- * is a missing subject or body, an entry that is not exactly one address, more than 50 recipients, an attachment
- * that is not one of the app's uploads, or an idempotency key over 128 characters; `UNAVAILABLE` includes the Softr
- * fallback address past its daily limit and an unconfirmed sender.
- */
-declare class EmailError extends StepError {
-  constructor(status: number, code: EmailErrorCode, message: string);
-}
-/** Sends one email through the action. Never retries by itself. */
-declare function sendEmail(action: EmailAction, init: EmailSendInit): Promise<EmailSent>;
-declare const email: {
-  send: typeof sendEmail;
-};
-//#endregion
-export { EmailAttachment, EmailError, EmailErrorCode, EmailSendInit, EmailSent, email };

package/dist/core/email.js

@@ -1,62 +0,0 @@
-import { assert } from "../assertions.js";
-import { softrApiUrl } from "../softr-api.js";
-import { fetch } from "../fetch.js";
-import { sessionConfig } from "../auth/config.js";
-import { readSessionToken } from "../auth/session.js";
-import { StepError, readStepFailure } from "./step.js";
-
-//#region src/core/email.ts
-/** Longer than Softr waits for the send itself, so its own timeout answers first. */
-const TIMEOUT_MS = 12e4;
-/**
-* Thrown when Softr did not send the email; a {@link StepError}, so `code` says why. For an email, `INVALID_INPUT`
-* is a missing subject or body, an entry that is not exactly one address, more than 50 recipients, an attachment
-* that is not one of the app's uploads, or an idempotency key over 128 characters; `UNAVAILABLE` includes the Softr
-* fallback address past its daily limit and an unconfirmed sender.
-*/
-var EmailError = class extends StepError {
-	constructor(status, code, message) {
-		super(status, code, message);
-		this.name = "EmailError";
-	}
-};
-/** Sends one email through the action. Never retries by itself. */
-async function sendEmail(action, init) {
-	const { to, cc, bcc, replyTo, subject, body, attachments } = init;
-	const sessionToken = readSessionToken();
-	let res;
-	try {
-		res = await fetch(`${softrApiUrl("SOFTR_PLATFORM_API_URL")}/v1/vibe/applications/${sessionConfig().applicationId}/actions/${action.id}/step`, {
-			method: "POST",
-			headers: {
-				...sessionToken ? { Authorization: `Bearer ${sessionToken}` } : {},
-				"Content-Type": "application/json",
-				"Idempotency-Key": init.idempotencyKey ?? crypto.randomUUID()
-			},
-			body: JSON.stringify({ input: {
-				to,
-				cc,
-				bcc,
-				replyTo,
-				subject,
-				body,
-				attachments
-			} }),
-			signal: AbortSignal.timeout(TIMEOUT_MS)
-		});
-	} catch (error) {
-		if (error instanceof DOMException && error.name === "TimeoutError") throw new EmailError(504, "TIMEOUT", `Email "${action.id}" got no answer in time. It may still have been sent.`);
-		throw new EmailError(502, "UNAVAILABLE", `Email "${action.id}" could not reach Softr: ${error instanceof Error ? error.message : String(error)}`);
-	}
-	if (res.ok) {
-		const sent = await res.json();
-		assert(typeof sent === "object" && sent !== null && "messageId" in sent && (typeof sent.messageId === "string" || sent.messageId === null), "the send answered without a messageId");
-		return { messageId: sent.messageId };
-	}
-	const { code, message } = await readStepFailure(res, `Email "${action.id}" failed with HTTP ${res.status}`);
-	throw new EmailError(res.status, code, message);
-}
-const email = { send: sendEmail };
-
-//#endregion
-export { EmailError, email };

package/dist/core/step.d.ts

@@ -1,20 +0,0 @@
-//#region src/core/step.d.ts
-/** Why Softr did not run a workflow step the app runs by itself, whatever the step. */
-declare const STEP_ERROR_CODES: readonly ["NOT_FOUND", "INVALID_INPUT", "UNAVAILABLE", "TIMEOUT", "RATE_LIMITED"];
-type StepErrorCode = (typeof STEP_ERROR_CODES)[number];
-/**
- * Thrown when Softr did not run a step the app runs by itself, such as sending an email. `code` says why:
- *
- * - `NOT_FOUND`: no such action, or the caller is not in its audience.
- * - `INVALID_INPUT`: the call's inputs were refused; the message says which.
- * - `UNAVAILABLE`: Softr could not run it, for example with no workflow credits left, or could not be reached.
- * - `TIMEOUT`: no answer in time. It may still have run; retry with the same idempotency key.
- * - `RATE_LIMITED`: the app ran its actions too often in the last minute or day; try again later.
- */
-declare class StepError extends Error {
-  readonly status: number;
-  readonly code: StepErrorCode;
-  constructor(status: number, code: StepErrorCode, message: string);
-}
-//#endregion
-export { StepError, StepErrorCode };

package/dist/core/step.js

@@ -1,48 +0,0 @@
-//#region src/core/step.ts
-/** Why Softr did not run a workflow step the app runs by itself, whatever the step. */
-const STEP_ERROR_CODES = [
-	"NOT_FOUND",
-	"INVALID_INPUT",
-	"UNAVAILABLE",
-	"TIMEOUT",
-	"RATE_LIMITED"
-];
-/**
-* Thrown when Softr did not run a step the app runs by itself, such as sending an email. `code` says why:
-*
-* - `NOT_FOUND`: no such action, or the caller is not in its audience.
-* - `INVALID_INPUT`: the call's inputs were refused; the message says which.
-* - `UNAVAILABLE`: Softr could not run it, for example with no workflow credits left, or could not be reached.
-* - `TIMEOUT`: no answer in time. It may still have run; retry with the same idempotency key.
-* - `RATE_LIMITED`: the app ran its actions too often in the last minute or day; try again later.
-*/
-var StepError = class extends Error {
-	status;
-	code;
-	constructor(status, code, message) {
-		super(message);
-		this.name = "StepError";
-		this.status = status;
-		this.code = code;
-	}
-};
-/** The code and message of a step Softr refused, read from its answer; `fallbackMessage` when it sent none. */
-async function readStepFailure(res, fallbackMessage) {
-	const failure = await res.json().catch(() => null);
-	const known = typeof failure === "object" && failure !== null ? failure : {};
-	return {
-		code: ("code" in known ? STEP_ERROR_CODES.find((errorCode) => errorCode === known.code) : void 0) ?? codeOfStatus(res.status),
-		message: "message" in known && typeof known.message === "string" && known.message !== "" ? known.message : fallbackMessage
-	};
-}
-function codeOfStatus(status) {
-	switch (status) {
-		case 400: return "INVALID_INPUT";
-		case 404: return "NOT_FOUND";
-		case 429: return "RATE_LIMITED";
-		default: return "UNAVAILABLE";
-	}
-}
-
-//#endregion
-export { StepError, readStepFailure };

package/skills/softr-sdk/email/SKILL.md

@@ -1,127 +0,0 @@
----
-name: email
-description: >-
-  Send an email from the app itself, with nothing to connect and no workflow:
-  defineEmailAction from @softr/sdk declares who may send it and the fields it
-  fixes (to, cc, bcc, replyTo, and an optional senderId); email.send from
-  @softr/sdk/server sends one with a subject, a text or HTML body and optional
-  attachments, and throws an EmailError with a code when Softr does not send it.
-  Load this for a contact form that emails the owner, a confirmation to the
-  signed-in user, staff emailing a client, or any email the app sends while
-  handling what a person does in it.
-metadata:
-  type: sub-skill
-  library: softr-sdk
-  library_version: 0.0.93-alpha.2
----
-
-**Boundary.** `email` and `EmailError` live on `@softr/sdk/server` and run only inside a `createServerFn` handler — importing them into a component fails the build. `defineEmailAction` and every type come from `@softr/sdk` and can be imported anywhere.
-
-# Email
-
-An app sends an email through an email action. Softr sends it from the app's email sender and bills the workspace's **workflow credits**, so there is no mail service to connect and no workflow to build. Use it for every email the app sends while it handles something a person does in it: a form submitted, a button pressed, a record saved through the app.
-
-A workflow is still the answer for an email on a schedule ("every Monday") or on a change made outside the app (a record edited in the table): load `automate-with-workflows` for those. A connected Gmail or Outlook is the answer only when the user wants the email to come from their own mailbox, through the `integrations` sub-skill.
-
-`defineEmailAction` missing from `@softr/sdk`? The app was built on an older version. Upgrade `@softr/sdk` to the latest version first, then write the action.
-
-## Who can send it, and to whom
-
-The action's `permissions` is its audience: everyone in it can send an email through it, directly, without the app's own code. The app's code is not a guard. Only what the declaration fixes holds whatever the caller sends.
-
-- **Fix the recipients whenever the use case allows.** A contact form that emails the owner fixes `to` to the owner. "Email me this report" fixes `to` to `{LOGGED_IN_USER:EMAIL}`. Then nobody can send the app's email to anyone else.
-- **When people pick the recipients, narrow the audience.** "Staff email a client" leaves `to` open and keeps the action to the staff group with `customGroups`. An action with open recipients for all signed-in users lets anyone who signs up send any email to anyone from the app's address, up to the workspace's credits. Build that only when the user asks for it, and tell them so in one line. An action open to visitors must fix `to`, `cc` or `bcc`: one that fixes none is not stored.
-
-## The sender
-
-Every email comes from the app's email sender, unless the action names one of the workspace's senders with `senderId`.
-
-- Read the app's sender with `application_get` before you say where the emails come from, and name it. Never write "if no sender is set": read it. That tool shows the sign-in emails' default, an `@softr.app` address, when no sender is set. Emails from an email action then come from Softr's address instead: the workspace's name at `<workspaceId>@softr-email.com`, limited to 30 emails a day for the whole workspace, its workflows included. That address is for testing only. Say so in your closing message when no sender is set, and that the app needs its own sender before real users rely on its emails.
-- When the app has no sender of its own, list the workspace's senders with `workspace_list_email_senders` and offer the confirmed ones by name: for this email (`senderId`, nothing else changes) or as the app's sender. Never pick one yourself.
-- Changing the app's sender also changes the address its sign-in emails come from. Ask the user before you call `application_configure_email_sender`, and name both effects. A workspace whose plan has no custom senders is refused; then say that sending from their own address needs the Professional plan.
-- Set `senderId` only when the user wants this email from a specific address, such as `billing@`. Pick it from `workspace_list_email_senders`, copied exactly. A sender the mail provider has not confirmed makes every send fail until it is confirmed. That confirmation is all an email action needs; the domain's DNS records (DKIM, Return-Path) are needed only before Studio lets the app pick the address as its own sender, and they help the emails stay out of spam.
-
-## What it costs
-
-Every email costs **5 workflow credits per recipient**, from the workspace's monthly workflow credits, which its workflows spend too. You do not know the workspace's plan, so never name one or count how many emails it covers. The plan and the closing message give the cost and where to watch it, for example: "Each submission emails you, at 5 workflow credits per email. Track them in Settings → Billing → Workflow usage, where this app has its own row."
-
-Emails sent from the preview are real and charged, and the actions in the code reach the live app as soon as they are saved. Send at most one test email, and only when the user asks for one. Never send emails in a loop to try something out.
-
-## Declare the action
-
-```ts
-const notifyOwner = defineEmailAction({
-  id: 'notifyOwner',
-  to: ['owner@acme.com'],
-  permissions: { userGroupTypes: ['NON_LOGGED_IN_USERS', 'LOGGED_IN_USERS'] },
-})
-
-const emailClient = defineEmailAction({
-  id: 'emailClient',
-  replyTo: '{LOGGED_IN_USER:EMAIL}',
-  permissions: { userGroupTypes: ['LOGGED_IN_USERS'], customGroups: ['<the staff group id>'] },
-})
-```
-
-- `id` is a name you choose, unique across the app.
-- `to`, `cc`, `bcc`: arrays of addresses. Each one declared here replaces the call's, and declaring `to` also ignores the call's `cc` and `bcc`. An element may be a whole placeholder for the signed-in sender: `{LOGGED_IN_USER:EMAIL}`, or `{LOGGED_IN_USER:<field>}` for an email field of their user record. Never part of a string, never in the call.
-- `replyTo`: an address or one such placeholder.
-- `senderId`: one of the workspace's senders, as above. The call can never set the sender.
-- `permissions`: who may send it, as for queries and mutations.
-
-Write the object inline in `defineEmailAction`, every value a literal. A declaration that cannot be read is not stored, and the check reports it.
-
-Declare one action per kind of email: the owner's notification and the client's confirmation are two actions, each with its own recipients and audience.
-
-## Core pattern
-
-```ts
-const submit = createServerFn({ method: 'POST' })
-  .validator(contactSchema)
-  .handler(async ({ data }) => {
-    const saved = await ds.create(saveSubmission, { data })
-    try {
-      await email.send(notifyOwner, {
-        subject: `New message from ${data.name}`,
-        body: renderSubmission(data),  // the app's own HTML, with what the visitor typed escaped
-        replyTo: data.email,
-        idempotencyKey: `submission-${saved.id}`,
-      })
-    } catch (error) {
-      if (error instanceof EmailError) return { saved: true, emailed: false, reason: error.message }
-      throw error
-    }
-    return { saved: true, emailed: true }
-  })
-```
-
-`email.send(action, init)` takes:
-
-- `subject` and `body`. Required. `body` is plain text or HTML. Escape what visitors typed before you put it into HTML.
-- `to`, `cc`, `bcc`, `replyTo`: each used only where the action does not fix it, and `cc` and `bcc` never when it fixes `to`. Each entry is one address. At most 50 recipients per email.
-- `attachments`: `{ name, url }` each, a file uploaded to this app (the Softr SDK `file-uploads` guidance); any other URL is refused with `INVALID_INPUT`. 10 MB in total.
-- `idempotencyKey`: the same key sends once, however often the call is repeated. Pass one derived from what the email is about, such as the record it announces, so a retried request never sends twice. When nothing is saved first, the form makes one key per submission (`crypto.randomUUID()` when the person starts submitting), sends it with the request and reuses it when they retry. At most 128 characters. Left out, every call is a new email, so a retry after `TIMEOUT` or a double click sends twice.
-
-It answers `{ messageId }` once the email is sent. The answer never lists the recipients.
-
-## Failure modes
-
-**Not handling `EmailError`.** `email.send` throws an `EmailError`, a `StepError` from `@softr/sdk/server`, with `status`, `code` and `message` when the email was not sent, and never retries by itself. Catch it, keep what the request already saved, and show the person a line they can act on: "Saved, but the email could not be sent." The codes:
-
-| `code` | Meaning |
-| --- | --- |
-| `NOT_FOUND` | No such action, or the caller is not in its audience |
-| `INVALID_INPUT` | No subject or body, an entry or placeholder that is not exactly one address, more than 50 recipients, an attachment that is not one of the app's uploads, or an idempotency key over 128 characters |
-| `UNAVAILABLE` | Softr could not send it or could not be reached: no workflow credits left, Softr's address past its 30 emails today, an unconfirmed sender, or an outage |
-| `TIMEOUT` | No answer in time. It may still have been sent: retry only with the same key |
-| `RATE_LIMITED` | The app sent too often in the last minute or day. Tell the person to try again later |
-
-**Letting a mistyped address reach Softr.** An address the person typed (the reply-to of a contact form, a client's email) that is not one address is refused with `INVALID_INPUT`, which reads as a vague failure. Check its format in the validator and tell them which field is wrong.
-
-**Calling from client code.** `email` is server-only. Wrap the send in a `createServerFn` and call that from the form or the button.
-
-**Taking recipients from the request when they could be fixed.** A `to` the browser sends is a `to` any caller can change. Fix it in the declaration, or read it on the server from the record the email is about.
-
-**Placeholders in the call.** `{LOGGED_IN_USER:EMAIL}` is filled only in the declaration. In the call it is sent as written and fails.
-
-**Building a workflow for an email the app sends itself.** A "Run custom workflow" trigger plus a "Send email" step does the same at more cost to the user: a workflow to keep published. Use the email action; keep workflows for schedules and table events.