@nano-app/backend 0.16.0 → 0.17.0

package/README.md

@@ -48,7 +48,7 @@ export default createRoute({
 
 ## Routes
 
-Each `*.route.ts` under `mainPlugin.routesDir` default-exports an object with the HTTP methods it implements (`GET`, `POST`, `PUT`, `DELETE`, `QUERY`). **The file path is the URL** (`index.route.ts` → `/`, `api/users.route.ts` → `/api/users`). `expression` is appended to that path as is, in Express syntax (`/:id`, `{/:id}` for optional):
+Each `*.route.ts` under `mainPlugin.routesDir` default-exports an object with the HTTP methods it implements (`GET`, `POST`, `PUT`, `DELETE`, `QUERY`). **The file path is the URL** (`index.route.ts` → `/`, `api/users.route.ts` → `/api/users`). A route file holds only those methods and its options (`expression`, `public`, `permissions`, `callbacks`): any other key, or an invalid value, stops the startup with the file and what is wrong. `expression` is appended to that path as is, in Express syntax (`/:id`, `{/:id}` for optional):
 
 ```ts
 export default createRoute({

package/build/index.d.ts

@@ -2,6 +2,7 @@ import express, { Express, Request, Request as Request$1 } from "express";
 import { CorsOptions } from "cors";
 import "dotenv/config";
 import "jiti";
+import { z } from "zod";
 import "better-auth";
 /** API response */
 type ApiResponse<T = any> = {
@@ -55,7 +56,7 @@ type Callback<Deps> = (params: Params<Deps>) => Promise<void>;
 type CallbackMethod<Deps> = (req: Request$1, method: string, params: Params<Deps>) => Promise<NanoObject>;
 /** Callback run with the Express app */
 type CallbackMount<Deps> = (app: Express, params: Params<Deps>) => Promise<void>;
-/** Callbacks of an endpoint. They never receive the app: what affects the whole app goes in the plugin's onMount */
+/** Callbacks of an endpoint; what affects the whole app goes in the plugin's onMount */
 type Callbacks<Deps = NanoObject<any>> = {
   /** Run once, when the endpoint is mounted */
   onInit?: Callback<Deps>;
@@ -79,7 +80,7 @@ type RouteEntry<Deps = NanoObject<any>> = {
 } & Handlers<Deps>;
 /** Generic object */
 type NanoObject<T = any> = Record<string, T>;
-/** Error of the framework: Node shows it as `[nano-app] [ERROR]: <message>`, and a handler answers its status */
+/** Error of the framework, with the status a handler answers */
 declare class NanoError extends Error {
   status?: number;
   /** Error with its message, and the status a handler answers (500 without one) */
@@ -89,7 +90,7 @@ declare class NanoError extends Error {
 }
 /** Database of a plugin or of the app */
 type DatabaseConfig = {
-  /** Its Drizzle schema: the module of its tables, with its `relations` when it has them (`import * as schema from './db/schema'`) */
+  /** Its Drizzle schema: the module of its tables and `relations` */
   schema: NanoObject;
 };
 /** When a plugin is mounted, relative to the consumer routes */
@@ -111,19 +112,8 @@ type PluginConfig<Options = NanoObject> = {
   /** Plugin callbacks */
   callbacks?: PluginCallbacks;
 };
-/** The project's plugin: nano-app names it "app" and mounts it between the "before" and "after" plugins */
-type MainPluginConfig<Options = NanoObject> = {
-  /** Directory of the project's `*.route.ts` files. Defaults to "src/routes" */
-  routesDir?: string;
-  /** Base path prepended to every route, e.g. "/api" (no trailing slash). Defaults to none */
-  basePath?: string;
-  /** Drizzle schema of the project's database; without it the app has none */
-  database?: DatabaseConfig;
-  /** Plugin options */
-  options?: Options;
-  /** Plugin callbacks */
-  callbacks?: PluginCallbacks;
-};
+/** The project's plugin, named "app": `routesDir` defaults to "src/routes" */
+type MainPluginConfig<Options = NanoObject> = Partial<Omit<PluginConfig<Options>, 'name' | 'stage'>>;
 /** Configuration of the framework's built-in packages */
 type PackagesConfig = {
   /** Morgan configuration */
@@ -160,7 +150,7 @@ type NanoAppConfig = {
   mainPlugin?: MainPluginConfig;
 };
 /** Merges the consumer configuration over the initial one; the main plugin is always named "app" */
-declare function mergeConfig(oConfig?: NanoAppConfig): NanoAppConfig & Required<Pick<NanoAppConfig, 'settings' | 'plugins' | 'packages'>> & {
+declare function mergeConfig(oConfig?: NanoAppConfig): NanoAppConfig & Required<Pick<NanoAppConfig, 'port' | 'settings' | 'plugins' | 'packages'>> & {
   mainPlugin: PluginConfig;
 };
 /** Main NanoApp class */

package/build/index.js

@@ -8,8 +8,9 @@ import { glob } from "glob";
 import { isAbsolute, resolve } from "node:path";
 import { existsSync } from "node:fs";
 import { createJiti } from "jiti";
+import { z } from "zod";
 // ../core/utils/NanoError.ts
-/** Error of the framework: Node shows it as `[nano-app] [ERROR]: <message>`, and a handler answers its status */
+/** Error of the framework, with the status a handler answers */
 var NanoError = class extends Error {
 	status;
 	/** Error with its message, and the status a handler answers (500 without one) */
@@ -41,7 +42,7 @@ var FileReader = class {
 // ../core/files/FileLoader.ts
 /** Finds and loads the consumer's files */
 var FileLoader = class {
-	/** Finds `*.<extension>.ts` (or built `.js`) files in a folder (`src/<extension>s` by default) and returns `{ [subPath]: defaultExport }` */
+	/** Finds the `*.<extension>.ts` files of a folder: `{ [subPath]: defaultExport }` */
 	static async findMany(sExtension, sSourceDir) {
 		const sSrcDir = (sSourceDir ?? `src/${sExtension}s`).replace(/^\.\//, "").replace(/\/$/, "");
 		const aFilePaths = await glob(`${sSrcDir}/**/*.${sExtension}.{ts,js}`, {
@@ -57,89 +58,20 @@ var FileLoader = class {
 		return oEntries;
 	}
 };
-// ../core/const.ts
-/** HTTP methods a route can handle */
-const HTTP_METHODS = [
-	"GET",
-	"POST",
-	"PUT",
-	"DELETE",
-	"QUERY"
-];
-/** Loopback and private networks: the proxies the backend trusts by default */
-const PRIVATE_NETWORKS = [
-	"127.0.0.0/8",
-	"::1/128",
-	"10.0.0.0/8",
-	"172.16.0.0/12",
-	"192.168.0.0/16",
-	"fc00::/7"
-];
-// ../core/utils/Paths.ts
-/** Paths of the app's pages */
-var Paths = class {
-	/** Whether a path matches a pattern: exact (`/admin`), or the path and all below it (`/admin/*`) */
-	static matches(sPattern, sPath) {
-		if (!sPattern.endsWith("/*")) return sPattern === sPath;
-		const sBase = sPattern.slice(0, -2);
-		return sPath === sBase || sPath.startsWith(`${sBase}/`);
-	}
-};
 // ../core/utils/Validator.ts
-const STORE_TYPES = ["app", "api"];
 /** Checks values of the framework and the consumer's files; an invalid file throws a `NanoError` */
-var Validator = class Validator {
+var Validator = class {
 	/** Whether a value is a plain object */
 	static isObject(oValue) {
 		return Object.prototype.toString.call(oValue) === "[object Object]";
 	}
-	/** Whether a value is a plain object of strings */
-	static isStringMap(oValue) {
-		return Validator.isObject(oValue) && Object.values(oValue).every((sItem) => typeof sItem === "string");
-	}
-	/** Whether a value is a path that starts with `/` */
-	static isPath(oValue) {
-		return typeof oValue === "string" && oValue.startsWith("/");
-	}
-	/** First environment variable of a list that is not defined */
-	static missingEnv(aNames) {
-		return aNames.find((sName) => !process.env[sName]);
-	}
-	/** Checks every entry with a guard (`Validator.isRoute`...): the first invalid one throws */
-	static validate(oEntries, fnGuard) {
-		return Object.fromEntries(Object.entries(oEntries).filter(([sKey, oEntry]) => fnGuard(oEntry, sKey)));
-	}
-	/** Type guard for a `*.route.ts` entry */
-	static isRoute(oEntry, sFilePath) {
-		if (!Validator.isObject(oEntry)) throw new NanoError(`${sFilePath}: the default export is not an object.`);
-		if (oEntry.expression && typeof oEntry.expression !== "string") throw new NanoError(`${sFilePath}: "expression" must be a string.`);
-		if (oEntry.public !== void 0 && typeof oEntry.public !== "boolean") throw new NanoError(`${sFilePath}: "public" must be a boolean.`);
-		for (const sMethod of HTTP_METHODS) {
-			const oMethod = oEntry[sMethod];
-			if (oMethod && typeof oMethod !== "function" && typeof oMethod.handler !== "function") throw new NanoError(`${sFilePath}: "${sMethod}" must be a function or { handler, permissions }.`);
-		}
-		if (!HTTP_METHODS.some((sMethod) => oEntry[sMethod])) throw new NanoError(`${sFilePath}: defines no HTTP method.`);
-		return true;
-	}
-	/** Type guard for a `*.store.ts` entry */
-	static isStore(oEntry, sFilePath) {
-		if (!Validator.isObject(oEntry)) throw new NanoError(`${sFilePath}: the default export is not an object.`);
-		if (!STORE_TYPES.includes(oEntry.type)) throw new NanoError(`${sFilePath}: its type must be "app" or "api".`);
-		if (oEntry.data !== void 0 && !Validator.isObject(oEntry.data)) throw new NanoError(`${sFilePath}: "data" must be an object.`);
-		if (oEntry.headers !== void 0 && !Validator.isStringMap(oEntry.headers)) throw new NanoError(`${sFilePath}: "headers" must be an object of strings.`);
-		if (oEntry.auth !== void 0 && !Validator.isAuth(oEntry.auth)) throw new NanoError(`${sFilePath}: "auth" must be { path, routes }: each route { match, redirect, roles, permissions } with paths starting with /, roles as "admin,user", permissions as { resource: "read,update" }, and a redirect outside its match.`);
-		return true;
-	}
-	/** Whether `auth` has the base path of Better Auth and valid routes, none redirecting to itself */
-	static isAuth(oAuth) {
-		if (!Validator.isObject(oAuth) || typeof oAuth.path !== "string") return false;
-		const aRoutes = oAuth.routes ?? [];
-		if (!Array.isArray(aRoutes)) return false;
-		return aRoutes.every((oRoute) => {
-			if (!Validator.isObject(oRoute)) return false;
-			const { match, redirect = "/", roles, permissions } = oRoute;
-			return Validator.isPath(match) && Validator.isPath(redirect) && !Paths.matches(match, redirect) && (roles === void 0 || typeof roles === "string") && (permissions === void 0 || Validator.isStringMap(permissions));
-		});
+	/** Checks every entry with a zod schema (`ROUTE`, `STORE`): the first invalid one throws with its key */
+	static validate(oEntries, oSchema) {
+		return Object.fromEntries(Object.entries(oEntries).map(([sKey, oEntry]) => {
+			const oResult = oSchema.safeParse(oEntry);
+			if (!oResult.success) throw new NanoError(`${sKey}:\n${z.prettifyError(oResult.error)}`);
+			return [sKey, oResult.data];
+		}));
 	}
 };
 // ../core/utils/Logger.ts
@@ -166,58 +98,69 @@ var Logger = class Logger {
 		return oDate.toISOString().slice(0, 19).replace("T", " ");
 	}
 };
-// src/auth/BetterAuth.ts
-/** Files of the app's Better Auth options, relative to `cwd`: source, then built */
-const AUTH_FILES = ["src/auth.ts", "src/auth.js"];
-/** Better Auth on the app's Drizzle client: the instance, its handler and the session lookup */
-var BetterAuth = class {
-	static oAuth;
-	/** The options of the app's `src/auth.ts`, or undefined without it: Better Auth stays off */
-	static async findOptions() {
-		const sFilePath = AUTH_FILES.find(existsSync);
-		if (!sFilePath) return void 0;
-		const oFile = await FileReader.loadModule(sFilePath, { default: true });
-		if (!Validator.isObject(oFile?.options)) throw new NanoError(`${sFilePath} must default export { options }: the Better Auth options.`);
-		return oFile.options;
-	}
-	/** The instance, once the app's plugin created it */
-	static get() {
-		return this.oAuth;
-	}
-	/** Creates the instance on the app's client and schema, its handler and the session lookup */
-	static async create(oOptions, oDb, oSchema) {
-		const { betterAuth } = await import("better-auth");
-		const { drizzleAdapter } = await import("better-auth/adapters/drizzle");
-		const { getSchema } = await import("better-auth/db");
-		const { fromNodeHeaders, toNodeHandler } = await import("better-auth/node");
-		const aMissing = Object.keys(getSchema(oOptions)).filter((sModel) => !oSchema[sModel]);
-		if (aMissing.length) throw new NanoError(`Better Auth needs the tables ${aMissing.join(", ")} in the app's schema. Run \`npx auth generate\` and apply your schema with drizzle-kit.`);
-		const oAuth = betterAuth({
-			...oOptions,
-			advanced: {
-				...oOptions.advanced,
-				ipAddress: {
-					trustedProxies: PRIVATE_NETWORKS,
-					...oOptions.advanced?.ipAddress
-				}
-			},
-			database: drizzleAdapter(oDb, {
-				provider: "pg",
-				schema: oSchema
-			})
-		});
-		this.oAuth = oAuth;
-		const fnSession = (oReq, oRes, fnNext) => oAuth.api.getSession({ headers: fromNodeHeaders(oReq.headers) }).then((oSession) => {
-			oRes.locals.session = oSession ?? void 0;
-			fnNext();
-		});
-		return {
-			oHandler: toNodeHandler(oAuth),
-			fnSession,
-			sPath: `${oOptions.basePath ?? "/api/auth"}/{*path}`
-		};
+// ../core/utils/Paths.ts
+/** Paths of the app's pages */
+var Paths = class {
+	/** Whether a path matches a pattern: exact (`/admin`), or the path and all below it (`/admin/*`) */
+	static matches(sPattern, sPath) {
+		if (!sPattern.endsWith("/*")) return sPattern === sPath;
+		const sBase = sPattern.slice(0, -2);
+		return sPath === sBase || sPath.startsWith(`${sBase}/`);
 	}
 };
+// ../core/const.ts
+/** Loopback and private networks: the proxies the backend trusts by default */
+const PRIVATE_NETWORKS = [
+	"127.0.0.0/8",
+	"::1/128",
+	"10.0.0.0/8",
+	"172.16.0.0/12",
+	"192.168.0.0/16",
+	"fc00::/7"
+];
+// ../core/utils/validations.ts
+/** A function of the consumer, typed as what the framework calls */
+function callable() {
+	return z.custom((oValue) => typeof oValue === "function");
+}
+/** Permissions of Better Auth's admin plugin: the actions per resource */
+const PERMISSIONS = z.record(z.string(), z.array(z.string())).optional();
+/** A method of a route: its handler, or it with its own permissions */
+const METHOD = z.union([callable(), z.object({
+	handler: callable(),
+	permissions: PERMISSIONS
+})]).optional();
+/** A `*.route.ts` file: its options, its callbacks and at least one HTTP method, nothing else */
+const ROUTE = z.strictObject({
+	expression: z.string().optional(),
+	public: z.boolean().optional(),
+	permissions: PERMISSIONS,
+	callbacks: z.object({
+		onInit: callable().optional(),
+		onBefore: callable().optional()
+	}).optional(),
+	GET: METHOD,
+	POST: METHOD,
+	PUT: METHOD,
+	DELETE: METHOD,
+	QUERY: METHOD
+}).refine(({ GET, POST, PUT, DELETE, QUERY }) => GET ?? POST ?? PUT ?? DELETE ?? QUERY, { error: "It defines no HTTP method" });
+/** A path of the app, starting with `/` */
+const PATH = z.string().startsWith("/");
+z.object({
+	type: z.enum(["app", "api"]),
+	data: z.record(z.string(), z.any()).optional(),
+	headers: z.record(z.string(), z.string()).optional(),
+	auth: z.object({
+		path: z.string(),
+		routes: z.array(z.object({
+			match: PATH,
+			redirect: PATH.optional(),
+			roles: z.string().optional(),
+			permissions: z.record(z.string(), z.string()).optional()
+		}).refine(({ match, redirect }) => !Paths.matches(match, redirect ?? "/"), { error: "Its \"redirect\" must be outside its \"match\"" })).optional()
+	}).optional()
+});
 // src/auth/permissions.ts
 /** Whether the session's user has the permissions; always without Better Auth or permissions */
 async function isGranted({ auth, session }, oPermissions) {
@@ -257,9 +200,8 @@ var Endpoint = class {
 	createHandler(oParams) {
 		return (oReq, oRes, fnNext) => {
 			if (oParams.auth && !oRes.locals.session && !this.isPublic) return fnNext(new NanoError("Not authenticated", 401));
-			const sMethod = oReq.method.toUpperCase();
-			const sHandled = HTTP_METHODS.find((sHttpMethod) => sHttpMethod === sMethod);
-			const oMethod = sHandled && this.oMethods[sHandled];
+			const sMethod = oReq.method;
+			const oMethod = this.oMethods[sMethod];
 			if (!oMethod) return fnNext(new NanoError(`Method ${sMethod} not implemented`, 405));
 			const oRequestParams = {
 				...oParams,
@@ -295,7 +237,7 @@ var Router = class {
 	async mount() {
 		if (!this.sRoutesDir) return [];
 		const oFiles = await FileLoader.findMany("route", this.sRoutesDir);
-		const oRoutes = Validator.validate(oFiles, Validator.isRoute);
+		const oRoutes = Validator.validate(oFiles, ROUTE);
 		return Object.entries(oRoutes).map(([sFilePath, { expression, callbacks, public: isPublic, permissions, ...methods }]) => {
 			const sPath = this.createPath(sFilePath, expression);
 			Logger.info(sPath);
@@ -314,6 +256,58 @@ var Router = class {
 		return `${this.sBasePath}${sEndpoint.replace(/\/index$/, "")}${sExpression}` || "/";
 	}
 };
+// src/auth/BetterAuth.ts
+/** Files of the app's Better Auth options, relative to `cwd`: source, then built */
+const AUTH_FILES = ["src/auth.ts", "src/auth.js"];
+/** Better Auth on the app's Drizzle client: the instance, its handler and the session lookup */
+var BetterAuth = class {
+	static oAuth;
+	/** The options of the app's `src/auth.ts`, or undefined without it: Better Auth stays off */
+	static async findOptions() {
+		const sFilePath = AUTH_FILES.find(existsSync);
+		if (!sFilePath) return void 0;
+		const oFile = await FileReader.loadModule(sFilePath, { default: true });
+		if (!Validator.isObject(oFile?.options)) throw new NanoError(`${sFilePath} must default export { options }: the Better Auth options.`);
+		return oFile.options;
+	}
+	/** The instance, once the app's plugin created it */
+	static get() {
+		return this.oAuth;
+	}
+	/** Creates the instance on the app's client and schema, its handler and the session lookup */
+	static async create(oOptions, oDb, oSchema) {
+		const { betterAuth } = await import("better-auth");
+		const { drizzleAdapter } = await import("better-auth/adapters/drizzle");
+		const { getSchema } = await import("better-auth/db");
+		const { fromNodeHeaders, toNodeHandler } = await import("better-auth/node");
+		const aMissing = Object.keys(getSchema(oOptions)).filter((sModel) => !oSchema[sModel]);
+		if (aMissing.length) throw new NanoError(`Better Auth needs the tables ${aMissing.join(", ")} in the app's schema. Run \`npx auth generate\` and apply your schema with drizzle-kit.`);
+		const oAuth = betterAuth({
+			...oOptions,
+			advanced: {
+				...oOptions.advanced,
+				ipAddress: {
+					trustedProxies: PRIVATE_NETWORKS,
+					...oOptions.advanced?.ipAddress
+				}
+			},
+			database: drizzleAdapter(oDb, {
+				provider: "pg",
+				schema: oSchema
+			})
+		});
+		this.oAuth = oAuth;
+		const fnSession = (oReq, oRes, fnNext) => oAuth.api.getSession({ headers: fromNodeHeaders(oReq.headers) }).then((oSession) => {
+			oRes.locals.session = oSession ?? void 0;
+			fnNext();
+		});
+		return {
+			oHandler: toNodeHandler(oAuth),
+			fnSession,
+			sPath: `${oOptions.basePath ?? "/api/auth"}/{*path}`
+		};
+	}
+};
 // src/database/Database.ts
 /** Drizzle clients of the app and its plugins, one per name, on one pool of `DATABASE_URL` */
 var Database = class {
@@ -324,17 +318,23 @@ var Database = class {
 	static get(sName) {
 		return this.oClients[sName];
 	}
-	/** Mounts the Drizzle client of a schema: the app's tables outside `nano_*`, a plugin's only in `nano_<name>` */
+	/** Mounts the Drizzle client of a schema, checking the `nano_*` rule of its tables */
 	static async mount(sName, { schema }) {
 		if (this.get(sName)) throw new NanoError(`The database "${sName}" is already mounted.`);
 		const { defineRelations, is } = await import("drizzle-orm");
 		const { getTableConfig, PgTable } = await import("drizzle-orm/pg-core");
 		const { drizzle } = await import("drizzle-orm/node-postgres");
 		const sOwn = `nano_${sName}`;
-		const isApp = sName === "app";
+		const { breaks, rule } = sName === "app" ? {
+			breaks: (sSchema) => sSchema.startsWith("nano_"),
+			rule: "the nano_* schemas are reserved for plugins"
+		} : {
+			breaks: (sSchema) => sSchema !== sOwn,
+			rule: `a plugin keeps its tables in "${sOwn}"`
+		};
 		for (const oTable of Object.values(schema).filter((oValue) => is(oValue, PgTable))) {
 			const { name, schema: sSchema = "public" } = getTableConfig(oTable);
-			if (isApp ? sSchema.startsWith("nano_") : sSchema !== sOwn) throw new NanoError(`The database "${sName}": table "${sSchema}.${name}" breaks the rule, ${isApp ? "the nano_* schemas are reserved for plugins" : `a plugin keeps its tables in "${sOwn}"`}.`);
+			if (breaks(sSchema)) throw new NanoError(`The database "${sName}": table "${sSchema}.${name}" breaks the rule, ${rule}.`);
 		}
 		this.oPool ??= await this.pool();
 		const oClient = drizzle({
@@ -357,19 +357,18 @@ var Database = class {
 /** A group of routes, with its options, callbacks and database */
 var Plugin = class {
 	oConfig;
-	oAuthOptions;
-	/** Creates a new Plugin instance; the app's plugin also gets the Better Auth options */
-	constructor(oConfig, oAuthOptions) {
+	/** Creates a new Plugin instance */
+	constructor(oConfig) {
 		this.oConfig = oConfig;
-		this.oAuthOptions = oAuthOptions;
 	}
 	/** Mounts its endpoints on express app */
 	async mount(oApp) {
 		const { name, routesDir, basePath, database, options, callbacks } = this.oConfig;
+		const oAuthOptions = name === "app" ? await BetterAuth.findOptions() : void 0;
 		const oDb = database ? await Database.mount(name, database) : Database.get("app");
-		if (this.oAuthOptions) {
+		if (oAuthOptions) {
 			if (!database) throw new NanoError("src/auth.ts needs the database of the app: set mainPlugin.database.schema.");
-			const { sPath, oHandler, fnSession } = await BetterAuth.create(this.oAuthOptions, oDb, database.schema);
+			const { sPath, oHandler, fnSession } = await BetterAuth.create(oAuthOptions, oDb, database.schema);
 			oApp.all(sPath, oHandler);
 			oApp.use(fnSession);
 		}
@@ -388,8 +387,6 @@ var Plugin = class {
 const INITIAL_CONFIG = {
 	/** Application port */
 	port: 3e3,
-	/** Application listener */
-	listener: () => {},
 	/** Express settings: the client IP comes from `X-Forwarded-For` only through private proxies */
 	settings: { "trust proxy": PRIVATE_NETWORKS },
 	/** Initial middlewares */
@@ -449,7 +446,7 @@ function mergeConfig(oConfig = {}) {
 	};
 }
 // src/app/errors.ts
-/** Database errors the request caused, by their Postgres code or Drizzle's name; their own messages name tables and columns */
+/** Database errors the request caused, by their Postgres code or Drizzle's name */
 const DATABASE_ERRORS = {
 	"23505": {
 		status: 409,
@@ -522,7 +519,7 @@ var NanoApp = class {
 	async start() {
 		try {
 			await this.initialize();
-			this.oApp.listen(Number(this.oConfig.port), () => {
+			this.oApp.listen(this.oConfig.port, () => {
 				this.oConfig.listener?.();
 				Logger.info(`Nano App running on port ${this.oConfig.port}`);
 			});
@@ -535,20 +532,22 @@ var NanoApp = class {
 	async initialize() {
 		for (const [sKey, oValue] of Object.entries(this.oConfig.settings)) this.oApp.set(sKey, oValue);
 		this.setPackages(this.oConfig.packages);
+		const { mainPlugin, plugins } = this.oConfig;
 		const oPlugins = {
 			before: [],
 			after: []
 		};
-		for (const oPlugin of this.oConfig.plugins) oPlugins[oPlugin.stage ?? "before"].push(oPlugin);
-		for (const oPlugin of oPlugins.before) await new Plugin(oPlugin).mount(this.oApp);
-		const { mainPlugin } = this.oConfig;
-		await new Plugin(mainPlugin, await BetterAuth.findOptions()).mount(this.oApp);
-		for (const oPlugin of oPlugins.after) await new Plugin(oPlugin).mount(this.oApp);
+		for (const oPlugin of plugins) oPlugins[oPlugin.stage ?? "before"].push(oPlugin);
+		for (const oPlugin of [
+			...oPlugins.before,
+			mainPlugin,
+			...oPlugins.after
+		]) await new Plugin(oPlugin).mount(this.oApp);
 		this.oApp.use(notFoundHandler);
 		this.oApp.use(errorHandler);
 	}
 	/** Adds the packages according to the configuration */
-	setPackages(oConfig = {}) {
+	setPackages(oConfig) {
 		if (oConfig.morgan) {
 			for (const [sKey, fnToken] of Object.entries(oConfig.morgan.tokens ?? {})) morgan.token(sKey, fnToken);
 			this.oApp.use(morgan(oConfig.morgan.format));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nano-app/backend",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "description": "Express server with file-convention routes, plugins and an optional PostgreSQL layer",
   "type": "module",
   "main": "build/index.js",
@@ -50,7 +50,8 @@
     "glob": "^14.0.4",
     "helmet": "^8.3.0",
     "jiti": "^2.7.0",
-    "morgan": "^1.12.1"
+    "morgan": "^1.12.1",
+    "zod": "^4.6.7"
   },
   "peerDependencies": {
     "better-auth": "^1.7.18",