@nano-app/backend 0.18.0 → 0.19.0

package/README.md

@@ -48,7 +48,7 @@ export default createRoute({
 
 ## Routes
 
-Each `*.route.ts` under `mainPlugin.routesDir` default-exports an object with the HTTP methods it implements (`GET`, `POST`, `PUT`, `DELETE`, `QUERY`). **The file path is the URL** (`index.route.ts` → `/`, `api/users.route.ts` → `/api/users`). A route file holds only those methods and its options (`expression`, `public`, `permissions`, `callbacks`): any other key, or an invalid value, stops the startup with the file and what is wrong. `expression` is appended to that path as is, in Express syntax (`/:id`, `{/:id}` for optional):
+Each `*.route.ts` under `routesDir` default-exports an object with the HTTP methods it implements (`GET`, `POST`, `PUT`, `DELETE`, `QUERY`). **The file path is the URL** (`index.route.ts` → `/`, `api/users.route.ts` → `/api/users`). A route file holds only those methods and its options (`expression`, `public`, `permissions`, `callbacks`): any other key, or an invalid value, stops the startup with the file and what is wrong. `expression` is appended to that path as is, in Express syntax (`/:id`, `{/:id}` for optional):
 
 ```ts
 export default createRoute({
@@ -84,10 +84,12 @@ Every option is optional.
 | `listener` | `() => {}` | Callback once the server is listening. |
 | `settings` | `{ "trust proxy": <private networks> }` | Values for `app.set()`: see [Client IP](#client-ip). |
 | `packages` | see below | Framework base middlewares. |
-| `mainPlugin` | `{ routesDir: "src/routes" }` | Your routes (`routesDir`, relative to `cwd`), `basePath` (e.g. `/api`, no trailing slash) and database: see [Database](#database). |
-| `plugins` | `[]` | Plugins mounted around your routes, in order: see [Plugins](#plugins). |
+| `routesDir` | `"src/routes"` | Folder of your routes, relative to `cwd`. |
+| `database` | none | Your Drizzle schema: see [Database](#database). |
+| `auth` | none | Better Auth options: see [Better Auth](#better-auth). |
+| `plugins` | `{}` | Plugins mounted `before` and `after` your routes, in order: see [Plugins](#plugins). |
 
-`packages` accepts `morgan`, `cors`, `helmet`, `compression`, `express` (`express.json` options) and `urlencoded`. The merge is **per section**: passing one key keeps the others; pass `false` to disable one.
+`packages` accepts `morgan`, `cors`, `helmet`, `compression`, `express` (`express.json` options) and `urlencoded`. Each one you set replaces its default whole and the others keep theirs; pass `false` to disable one. `settings` works the same way, key by key.
 
 `compression` is off by default: the proxy in front of the app (an ingress, nginx) usually compresses the answers. Turn it on with `packages: { compression: true }` when nothing does.
 
@@ -114,7 +116,7 @@ By default the backend reads that header only when the request comes from loopba
 
 ## Database
 
-Off until the app passes its schema: nano-app creates a [Drizzle](https://orm.drizzle.team) client of it on `DATABASE_URL` and passes it to your handlers as `db`. **It never modifies your schemas**: applying them (`drizzle-kit push`, `drizzle-kit generate` and `migrate`) is up to you.
+Off until the app passes its schema: nano-app creates a [Drizzle](https://orm.drizzle.team) client of it on `DATABASE_URL` and passes it to your handlers as `db`. It changes your tables only when you ask: `push` or `migrations`. Without them, applying the schema (`drizzle-kit push`, `drizzle-kit generate` and `migrate`) is up to you.
 
 ```bash
 pnpm add drizzle-orm pg
@@ -136,7 +138,7 @@ export const users = pgTable('users', {
 import { createNanoApp } from '@nano-app/backend';
 import * as schema from './db/schema';
 
-createNanoApp({ mainPlugin: { database: { schema } } });
+createNanoApp({ database: { schema } });
 ```
 
 ```ts
@@ -149,63 +151,46 @@ export default createRoute({
 ```
 
 - `database.schema` is the module of your tables: every export that is a table, and `relations` (from `defineRelations`) when you relate them. A `pgSchema` the tables use is exported too, so drizzle-kit creates it.
-- One pool serves the app and every plugin with a database. It connects on its first query: a missing table fails that query, not the startup.
+- `database.push: true` applies the schema at startup with drizzle-kit's push (`pnpm add drizzle-kit`), only to the Postgres schemas of its tables. A change that would lose data stops the startup.
+- `database.migrations` is the folder `drizzle-kit generate` writes: its pending migrations are applied at startup.
+- One pool serves the app, Better Auth and every plugin with a database. It connects on its first query: a missing table fails that query, not the startup.
 - Startup fails if `DATABASE_URL` is missing.
-- The `nano_` prefix is reserved for plugins: a table of yours in a `nano_*` Postgres schema fails the startup.
+- Each `nano_*` Postgres schema is reserved for the plugin of its name (`nano_auth` for Better Auth): a table of yours in one fails the startup.
 - Without a database, `db` is `undefined`.
 - Drizzle and pg are loaded only when your database or a mounted plugin's is on.
 
 ## Better Auth
 
-Users, sign-in and sessions with [Better Auth](https://www.better-auth.com), on your database. On when your app has `src/auth.ts` (or the built `src/auth.js`), relative to `cwd`: its default export holds the options in `options` (everything but `database`: nano-app passes your Drizzle client and schema). Without the file it stays off.
+Users, sign-in and sessions with [Better Auth](https://www.better-auth.com). On when `createNanoApp` has `auth`: its options, everything but `database`. Without it, it stays off.
 
 ```bash
-pnpm add better-auth
-```
-
-```ts
-// src/auth.ts: nano-app and the Better Auth CLI read `options`
-import type { BetterAuthOptions } from 'better-auth';
-
-export default {
-  options: { emailAndPassword: { enabled: true } } satisfies BetterAuthOptions,
-};
+pnpm add better-auth kysely pg
 ```
 
 ```ts
 // src/app.ts
 import { createNanoApp } from '@nano-app/backend';
-import * as schema from './db/schema';
-
-createNanoApp({ mainPlugin: { database: { schema } } });
-```
 
-Its tables are yours, like the rest of your schema. Add them with its CLI, then apply them with drizzle-kit; run both again when you change the options:
-
-```bash
-npx auth generate --adapter drizzle --dialect pg --output src/db/auth-schema.ts   # then export its tables from src/db/schema.ts
-pnpm drizzle-kit push
+createNanoApp({ auth: { emailAndPassword: { enabled: true } } });
 ```
 
-- It needs the database: `src/auth.ts` without `mainPlugin.database.schema` fails at startup, and so does a file without `options`.
-- Startup also fails if your schema lacks a table the options need (`user`, `session`, ...), naming them.
-- Its endpoints are mounted with your routes, at its `basePath` (default `/api/auth`), and stay public.
+- It uses the pool of `DATABASE_URL`, with or without a database of the app: startup fails if it is missing.
+- Its tables live in the Postgres schema `nano_auth`. nano-app creates them at startup with Better Auth's migrations, and adds what new options need; it never drops anything.
+- Its endpoints are mounted before your routes, at its `basePath` (default `/api/auth`), and stay public.
 - In production, Better Auth limits sign-in, sign-up and password reset to a few attempts per client IP (its `rateLimit`): see [Client IP](#client-ip).
-- Every route of yours and of the `after` plugins needs a session: without one, 401. The `before` plugins stay public (a landing, an about page).
-- Handlers and `onBefore` receive the session in `params.session` (`{ user, session }`).
+- With it on, every route of the app and of every plugin needs a session: without one it answers 401 `Not authenticated`.
+- `createRoute({ public: true, ... })` answers without a session. An unknown path answers 404.
+- Handlers and `onBefore` receive the session in `params.session` (`{ user, session }`), also on a public route when the request has one.
+- The middlewares a plugin adds with `app.use` in `onMount` are not checked: a plugin that exposes something public says it in its README.
 - Sign-up works as Better Auth sets it: with `emailAndPassword` anyone can sign up and reach your routes. Close it with `disableSignUp: true`, or check roles in your handlers.
-- Relate your tables to `user` in your `relations`. Extra user fields go in its `user.additionalFields`.
+- Extra user fields go in its `user.additionalFields`.
 - Set `BETTER_AUTH_SECRET` and `BETTER_AUTH_URL` in the environment, as Better Auth asks.
-- With it on, every route of the app and of the plugins mounted after it (`stage: 'after'`) needs a session: without one it answers 401 `Not authenticated`. The handlers receive it in `session`.
-- `createRoute({ public: true, ... })` answers without a session; its handlers still receive `session` when the request has one. An unknown path answers 404.
-- Its own endpoints, the plugins mounted before the app and the middlewares a plugin adds with `app.use` in `onMount` are not checked: a plugin that exposes something public says it in its README.
-- Better Auth is loaded only when it is on.
-- Before 0.14.0 the options went in `packages.betterAuth`: move them to the default export of `src/auth.ts`.
-- nano-app creates the one instance the app uses: do not call `betterAuth()` in `src/auth.ts`. The CLI's `generate` only reads `options` of its default export.
+- Better Auth is loaded only when it is on, and nano-app creates the one instance the app uses.
+- Before 0.19.0 the options went in the default export of `src/auth.ts` and its tables in your schema: move the options to `auth`.
 
 ### Permissions
 
-A route asks for permissions of Better Auth's [admin plugin](https://www.better-auth.com/docs/plugins/admin): add `admin()` to the `plugins` of your options, with your roles (`ac` and `roles`), and generate its fields with `npx auth generate`. A user without them gets 403:
+A route asks for permissions of Better Auth's [admin plugin](https://www.better-auth.com/docs/plugins/admin): add `admin()` to the `plugins` of your options, with your roles (`ac` and `roles`). A user without them gets 403:
 
 ```ts
 export default createRoute({
@@ -220,7 +205,7 @@ A public route does not check them. Without Better Auth the route answers anyway
 
 ## Plugins
 
-A plugin is a group of endpoints mounted under a base path. Your routes are mounted as one (named `app`). The official plugins are in [`@nano-app/plugins`](https://github.com/Nano-Nathan/nano-app/blob/main/plugins/README.md). You write one with `createPlugin` and list it in `plugins`. Nothing is mounted unless you list it. Official plugins that have tables ship their own migrations: nano-app applies them at startup, each in its `nano_*` schema. That is the only change it makes to your database.
+A plugin is a group of endpoints mounted under a base path. Your routes are mounted as one (named `app`). The official plugins are in [`@nano-app/plugins`](https://github.com/Nano-Nathan/nano-app/blob/main/plugins/README.md). You write one with `createPlugin` and list it in `plugins.before` or `plugins.after`. Nothing is mounted unless you list it.
 
 ```ts
 // src/plugins/hello/index.ts
@@ -249,10 +234,10 @@ export default createRoute({
 import { createNanoApp } from '@nano-app/backend';
 import hello from './plugins/hello';
 
-createNanoApp({ plugins: [hello()] });
+createNanoApp({ plugins: { before: [hello()] } });
 ```
 
-`createPlugin` types the options of that plugin. Each plugin chooses its base path and whether it mounts `before` (default) or `after` your routes. What the plugin puts in `options` reaches every callback and handler of its routes in `params`.
+`createPlugin` types the options of that plugin. Each plugin chooses its base path; the app chooses whether it mounts `before` or `after` its routes. What the plugin puts in `options` reaches every callback and handler of its routes in `params`.
 
 ### Callbacks
 
@@ -277,11 +262,11 @@ export default createPlugin((options?: { publicPaths?: string[] }) => ({
 }));
 ```
 
-The endpoints of one plugin have no guaranteed order: one route's `onInit` must not depend on another's. `mainPlugin` takes `callbacks` too.
+The endpoints of one plugin have no guaranteed order: one route's `onInit` must not depend on another's.
 
-Everything is mounted on one Express application, in this order: base middlewares → `before` plugins → your routes → `after` plugins → 404 → error handler.
+Everything is mounted on one Express application, in this order: base middlewares → Better Auth → `before` plugins → your routes → `after` plugins → 404 → error handler.
 
-A plugin with a database passes its own `database: { schema }`, and keeps its tables in the Postgres schema `nano_<its name>`: a table elsewhere fails the startup. Two plugins with the same name and a database fail too. Without a database of its own, a plugin receives the app's `db`. See [`@nano-app/plugins`](https://github.com/Nano-Nathan/nano-app/blob/main/plugins/README.md#database).
+A plugin with a database passes its own `database` (`schema`, `push`, `migrations`, as the app's). Only it may keep tables in the Postgres schema `nano_<its name>`: a table in the `nano_*` schema of another fails the startup. Without a database of its own, a plugin receives the app's `db`. See [`@nano-app/plugins`](https://github.com/Nano-Nathan/nano-app/blob/main/plugins/README.md#database).
 
 ## Errors
 
@@ -289,10 +274,9 @@ The framework mounts the 404 and the error handler: an unmatched request becomes
 
 ```ts
 throw { status: 409, message: 'Already exists' };   // → 409 { success: false, warning: false, message: "Already exists" }
-throw 'Field name is required';                     // → 400 { success: false, message: "Field name is required" }
+throw 'Field name is required';                     // → 400 { success: false, warning: false, message: "Field name is required" }
 throw new Error('boom');                            // → 500 "Internal server error", logged to stderr
-// A Postgres error the request caused answers without its message, which names tables and columns:
-// 23505 and 23503 → 409 "Conflict", 23502 and 22P02 → 400 "Invalid request"
+// A Postgres error is one more Error: 500. Catch it in your handler to answer a 409
 GET /unknown                                        // → 404 { success: false, warning: false, message: "/unknown not found" }
 ```
 

package/build/index.d.ts

@@ -3,7 +3,7 @@ import { CorsOptions } from "cors";
 import "dotenv/config";
 import "jiti";
 import { z } from "zod";
-import "better-auth";
+import { BetterAuthOptions } from "better-auth";
 /** API response */
 type ApiResponse<T = any> = {
   status?: number;
@@ -83,6 +83,8 @@ type RouteEntry<Deps = NanoObject<any>> = {
 } & Handlers<Deps>;
 /** Generic object */
 type NanoObject<T = any> = Record<string, T>;
+/** Better Auth options, without `database`: it uses the app's Drizzle client */
+type AuthOptions = Omit<BetterAuthOptions, 'database'>;
 /** Error of the framework, with the status a handler answers */
 declare class NanoError extends Error {
   status?: number;
@@ -95,9 +97,11 @@ declare class NanoError extends Error {
 type DatabaseConfig = {
   /** Its Drizzle schema: the module of its tables and `relations` */
   schema: NanoObject;
+  /** Applies the schema at startup with drizzle-kit's push, failing on data loss. Defaults to false */
+  push?: boolean;
+  /** Folder of the migrations `drizzle-kit generate` writes, applied at startup */
+  migrations?: string;
 };
-/** When a plugin is mounted, relative to the consumer routes */
-type PluginStage = 'before' | 'after';
 /** Plugin configuration: a group of endpoints */
 type PluginConfig<Options = NanoObject> = {
   /** Name of the plugin, also the name of its database when it has one */
@@ -106,8 +110,6 @@ type PluginConfig<Options = NanoObject> = {
   routesDir: string;
   /** Base path prepended to every endpoint, e.g. "/auth" (no trailing slash). Defaults to none */
   basePath?: string;
-  /** Mount point relative to the consumer routes. Defaults to "before" */
-  stage?: PluginStage;
   /** Drizzle schema of the plugin's database, mounted before its endpoints */
   database?: DatabaseConfig;
   /** Plugin options */
@@ -115,8 +117,20 @@ type PluginConfig<Options = NanoObject> = {
   /** Plugin callbacks */
   callbacks?: PluginCallbacks;
 };
-/** The project's plugin, named "app": `routesDir` defaults to "src/routes" */
-type MainPluginConfig<Options = NanoObject> = Partial<Omit<PluginConfig<Options>, 'name' | 'stage'>>;
+/** What PluginManager reads: the app's plugin and the ones around it */
+type PluginManagerConfig = {
+  /** Folder of the app's routes. Defaults to "src/routes" */
+  routesDir?: string;
+  /** Drizzle schema of the app's database */
+  database?: DatabaseConfig;
+  /** Plugins mounted before and after the app's routes */
+  plugins?: {
+    /** Before the app's routes */
+    before?: PluginConfig[];
+    /** After the app's routes */
+    after?: PluginConfig[];
+  };
+};
 /** Configuration of the framework's built-in packages */
 type PackagesConfig = {
   /** Morgan configuration */
@@ -137,29 +151,25 @@ type PackagesConfig = {
   /** urlencoded configuration */
   urlencoded?: Partial<Parameters<typeof express.urlencoded>[0]> | false;
 };
-/** Application configuration */
-type NanoAppConfig = {
+/** What NanoApp reads: the server */
+type ServerConfig = {
   /** Listener run once the server is listening */
   listener?: () => void;
   /** Application port. Defaults to 3000 */
   port?: number;
-  /** Values applied with Express `app.set()` (e.g. `{ "trust proxy": 1 }`) */
+  /** Values for Express `app.set()` (e.g. `{ "trust proxy": 1 }`), over the defaults */
   settings?: NanoObject<unknown>;
-  /** Default middlewares configuration */
+  /** Base middlewares: each one set replaces its default */
   packages?: PackagesConfig;
-  /** Plugins to mount. Defaults to [] */
-  plugins?: PluginConfig[];
-  /** Main plugin to mount. */
-  mainPlugin?: MainPluginConfig;
-};
-/** Merges the consumer configuration over the initial one; the main plugin is always named "app" */
-declare function mergeConfig(oConfig?: NanoAppConfig): NanoAppConfig & Required<Pick<NanoAppConfig, 'port' | 'settings' | 'plugins' | 'packages'>> & {
-  mainPlugin: PluginConfig;
+  /** Better Auth options: with them, every route needs a session unless it is `public` */
+  auth?: AuthOptions;
 };
+/** Application configuration: the server and its plugins */
+type NanoAppConfig = ServerConfig & PluginManagerConfig;
 /** Main NanoApp class */
 declare class NanoApp {
   protected oApp: Express;
-  protected oConfig: ReturnType<typeof mergeConfig>;
+  protected oConfig: NanoAppConfig;
   constructor(oConfig?: NanoAppConfig);
   /** Starts the application */
   private start;
@@ -179,4 +189,4 @@ export declare function createPlugin<Options>(fnCreator: Creator<Options>): Crea
 export declare function createPluginCallbacks<Deps = NanoObject<any>>(oCallbacks: PluginCallbacks<Deps>): PluginCallbacks<Deps>;
 /** Whether the session's user has the permissions; always without Better Auth or permissions */
 declare function isGranted({ auth, session }: Params, oPermissions?: NanoObject<string[]>): Promise<boolean>;
-export { type ApiPromise, type ApiResponse, type Callbacks, type DatabaseConfig, type Handler, type HandlerParams, type Handlers, type MainPluginConfig, type MethodEntry, NanoApp, type NanoAppConfig, NanoError, type NanoObject, type PackagesConfig, type Params, type PluginCallbacks, type PluginConfig, type PluginStage, type QueryParams, type Request, type RouteEntry, isGranted };
+export { type ApiPromise, type ApiResponse, type Callbacks, type DatabaseConfig, type Handler, type HandlerParams, type Handlers, type MethodEntry, NanoApp, type NanoAppConfig, NanoError, type NanoObject, type PackagesConfig, type Params, type PluginCallbacks, type PluginConfig, type PluginManagerConfig, type QueryParams, type Request, type RouteEntry, type ServerConfig, isGranted };

package/build/index.js

@@ -161,6 +161,117 @@ z.object({
 		}).refine(({ match, redirect }) => !Paths.matches(match, redirect ?? "/"), { error: "Its \"redirect\" must be outside its \"match\"" })).optional()
 	}).optional()
 });
+// src/database/DatabaseManager.ts
+/** The databases of the app and its plugins: one Drizzle client per name on the pool of `DATABASE_URL` */
+var DatabaseManager = class {
+	static oPool;
+	static oClients = {};
+	/** The Drizzle client of a database, created on the first call; without a config, the app's */
+	static async mount(sName, oConfig) {
+		if (!oConfig) return this.oClients["app"];
+		this.oClients[sName] ??= this.create(sName, oConfig);
+		return this.oClients[sName];
+	}
+	/** Creates a client: the `nano_*` rule of its tables, then its push and its migrations */
+	static async create(sName, oConfig) {
+		const { schema, push, migrations } = oConfig;
+		const { defineRelations, is } = await import("drizzle-orm");
+		const { getTableConfig, PgTable } = await import("drizzle-orm/pg-core");
+		const { drizzle } = await import("drizzle-orm/node-postgres");
+		const sOwn = sName === "app" ? void 0 : `nano_${sName}`;
+		const aSchemas = Object.values(schema).filter((oValue) => is(oValue, PgTable)).map((oTable) => {
+			const { name, schema: sSchema = "public" } = getTableConfig(oTable);
+			if (sSchema.startsWith("nano_") && sSchema !== sOwn) throw new NanoError(`The database "${sName}": table "${sSchema}.${name}" breaks the rule, each nano_* schema is reserved for the plugin of its name.`);
+			return sSchema;
+		});
+		const oClient = drizzle({
+			client: await this.pool(),
+			relations: schema.relations ?? defineRelations(schema)
+		});
+		if (push && aSchemas.length) {
+			const { pushSchema } = await import("drizzle-kit/api-postgres");
+			const { hints, apply } = await pushSchema(schema, oClient, {
+				schemas: aSchemas,
+				tables: void 0,
+				entities: void 0,
+				extensions: void 0
+			});
+			if (hints.length) throw new NanoError(`The database "${sName}" cannot be pushed without losing data: ${hints.map((oHint) => oHint.hint).join("; ")}. Run \`pnpm drizzle-kit push\` by hand.`);
+			await apply();
+		}
+		if (migrations) {
+			const { migrate } = await import("drizzle-orm/node-postgres/migrator");
+			await migrate(oClient, { migrationsFolder: migrations });
+		}
+		Logger.info(`Database "${sName}" mounted`);
+		return oClient;
+	}
+	/** The pool of `DATABASE_URL`, shared by every client and Better Auth, created on the first call */
+	static pool() {
+		this.oPool ??= this.createPool();
+		return this.oPool;
+	}
+	/** Creates the pool of `DATABASE_URL` */
+	static async createPool() {
+		const sUrl = process.env.DATABASE_URL;
+		if (!sUrl) throw new NanoError("The DATABASE_URL environment variable is not defined.");
+		const { Pool } = await import("pg");
+		return new Pool({ connectionString: sUrl });
+	}
+};
+// src/auth/BetterAuth.ts
+/** Postgres schema of Better Auth's tables */
+const SCHEMA = "nano_auth";
+/** Key of the Postgres lock that lets one startup migrate at a time */
+const MIGRATION_LOCK = 7310002;
+/** Better Auth of the app: its tables in `nano_auth`, its endpoints and the session of a request */
+var BetterAuth = class {
+	static oAuth;
+	static fnHeaders;
+	/** Better Auth's instance, once mounted */
+	static instance() {
+		return this.oAuth;
+	}
+	/** The session of a request, when it has one */
+	static async session(oReq) {
+		if (!this.oAuth || !this.fnHeaders) return void 0;
+		const oHeaders = this.fnHeaders(oReq.headers);
+		return await this.oAuth.api.getSession({ headers: oHeaders }) ?? void 0;
+	}
+	/** Migrates its tables, creates the instance and mounts its endpoints; off without options */
+	static async mount(oApp, oOptions) {
+		if (!oOptions) return;
+		const { betterAuth } = await import("better-auth");
+		const { getMigrations } = await import("better-auth/db/migration");
+		const { fromNodeHeaders, toNodeHandler } = await import("better-auth/node");
+		const { PostgresDialect } = await import("kysely");
+		const oPool = await DatabaseManager.pool();
+		const { advanced, basePath = "/api/auth" } = oOptions;
+		const oFullOptions = {
+			...oOptions,
+			advanced: {
+				...advanced,
+				ipAddress: {
+					trustedProxies: PRIVATE_NETWORKS,
+					...advanced?.ipAddress
+				}
+			},
+			database: {
+				dialect: new PostgresDialect({ pool: oPool }),
+				type: "postgres",
+				schemaName: SCHEMA
+			}
+		};
+		const oConnection = await oPool.connect();
+		await oConnection.query("SELECT pg_advisory_lock($1)", [MIGRATION_LOCK]);
+		await (await getMigrations(oFullOptions)).runMigrations();
+		oConnection.release(true);
+		const oAuth = betterAuth(oFullOptions);
+		this.oAuth = oAuth;
+		this.fnHeaders = fromNodeHeaders;
+		oApp.all(`${basePath}/{*path}`, toNodeHandler(oAuth));
+	}
+};
 // src/auth/permissions.ts
 /** Whether the session's user has the permissions; always without Better Auth or permissions */
 async function isGranted({ auth, session }, oPermissions) {
@@ -172,7 +283,7 @@ async function isGranted({ auth, session }, oPermissions) {
 	} });
 	return success;
 }
-// src/routes/Endpoint.ts
+// src/router/Endpoint.ts
 /** Base class for all endpoints */
 var Endpoint = class {
 	oMethods;
@@ -192,39 +303,42 @@ var Endpoint = class {
 	}
 	/** Handler for all methods */
 	async mount(oParams, sPath) {
-		if (!oParams.auth && Object.values(this.oMethods).some(({ permissions }) => permissions)) Logger.warn(`${sPath}: its permissions are not checked without Better Auth. Add src/auth.ts.`);
+		const isUnchecked = Object.values(this.oMethods).some(({ permissions }) => permissions);
+		if (!oParams.auth && isUnchecked) Logger.warn(`${sPath}: its permissions are not checked without Better Auth. Set auth in createNanoApp.`);
 		await this.oCallbacks.onInit?.(oParams);
 		return this.createHandler(oParams);
 	}
-	/** Express handler: onBefore, then the method of the request */
+	/** Express handler: the request, answered as an ApiResponse */
 	createHandler(oParams) {
-		return (oReq, oRes, fnNext) => {
-			if (oParams.auth && !oRes.locals.session && !this.isPublic) return fnNext(new NanoError("Not authenticated", 401));
-			const sMethod = oReq.method;
-			const oMethod = this.oMethods[sMethod];
-			if (!oMethod) return fnNext(new NanoError(`Method ${sMethod} not implemented`, 405));
-			const oRequestParams = {
-				...oParams,
-				session: oRes.locals.session
-			};
-			return isGranted(oRequestParams, this.isPublic ? void 0 : oMethod.permissions).then((isAllowed) => {
-				if (!isAllowed) throw new NanoError("Forbidden", 403);
-				return this.oCallbacks.onBefore?.(oReq, sMethod, oRequestParams) ?? {};
-			}).then((onBeforeResult) => oMethod.handler(oReq, {
-				...oRequestParams,
-				onBeforeResult
-			})).then((oResponse) => {
-				const { status, ...oBody } = oResponse;
-				const iStatus = status ?? 200;
-				oRes.status(iStatus).json({
-					...oBody,
-					success: iStatus < 400
-				});
+		return (oReq, oRes) => this.run(oReq, oParams).then((oResponse) => {
+			const { status, ...oBody } = oResponse;
+			const iStatus = status ?? 200;
+			oRes.status(iStatus).json({
+				...oBody,
+				success: iStatus < 400
 			});
+		});
+	}
+	/** Checks the session and the permissions, then runs onBefore and the method */
+	async run(oReq, oParams) {
+		const oSession = await BetterAuth.session(oReq);
+		const oRequestParams = {
+			...oParams,
+			session: oSession
 		};
+		if (oParams.auth && !oSession && !this.isPublic) throw new NanoError("Not authenticated", 401);
+		const sMethod = oReq.method;
+		const oMethod = this.oMethods[sMethod];
+		if (!oMethod) throw new NanoError(`Method ${sMethod} not implemented`, 405);
+		if (!await isGranted(oRequestParams, this.isPublic ? void 0 : oMethod.permissions)) throw new NanoError("Forbidden", 403);
+		const onBeforeResult = await this.oCallbacks.onBefore?.(oReq, sMethod, oRequestParams) ?? {};
+		return oMethod.handler(oReq, {
+			...oRequestParams,
+			onBeforeResult
+		});
 	}
 };
-// src/routes/Router.ts
+// src/router/Router.ts
 /** Turns a folder of `*.route.ts` files into Express paths and endpoints */
 var Router = class {
 	sRoutesDir;
@@ -256,104 +370,7 @@ var Router = class {
 		return `${this.sBasePath}${sEndpoint.replace(/\/index$/, "")}${sExpression}` || "/";
 	}
 };
-// src/auth/BetterAuth.ts
-/** Files of the app's Better Auth options, relative to `cwd`: source, then built */
-const AUTH_FILES = ["src/auth.ts", "src/auth.js"];
-/** Better Auth on the app's Drizzle client: the instance, its handler and the session lookup */
-var BetterAuth = class {
-	static oAuth;
-	/** The options of the app's `src/auth.ts`, or undefined without it: Better Auth stays off */
-	static async findOptions() {
-		const sFilePath = AUTH_FILES.find(existsSync);
-		if (!sFilePath) return void 0;
-		const oFile = await FileReader.loadModule(sFilePath, { default: true });
-		if (!Validator.isObject(oFile?.options)) throw new NanoError(`${sFilePath} must default export { options }: the Better Auth options.`);
-		return oFile.options;
-	}
-	/** The instance, once the app's plugin created it */
-	static get() {
-		return this.oAuth;
-	}
-	/** Creates the instance on the app's client and schema, its handler and the session lookup */
-	static async create(oOptions, oDb, oSchema) {
-		const { betterAuth } = await import("better-auth");
-		const { drizzleAdapter } = await import("better-auth/adapters/drizzle");
-		const { getSchema } = await import("better-auth/db");
-		const { fromNodeHeaders, toNodeHandler } = await import("better-auth/node");
-		const aMissing = Object.keys(getSchema(oOptions)).filter((sModel) => !oSchema[sModel]);
-		if (aMissing.length) throw new NanoError(`Better Auth needs the tables ${aMissing.join(", ")} in the app's schema. Run \`npx auth generate\` and apply your schema with drizzle-kit.`);
-		const oAuth = betterAuth({
-			...oOptions,
-			advanced: {
-				...oOptions.advanced,
-				ipAddress: {
-					trustedProxies: PRIVATE_NETWORKS,
-					...oOptions.advanced?.ipAddress
-				}
-			},
-			database: drizzleAdapter(oDb, {
-				provider: "pg",
-				schema: oSchema
-			})
-		});
-		this.oAuth = oAuth;
-		const fnSession = (oReq, oRes, fnNext) => oAuth.api.getSession({ headers: fromNodeHeaders(oReq.headers) }).then((oSession) => {
-			oRes.locals.session = oSession ?? void 0;
-			fnNext();
-		});
-		return {
-			oHandler: toNodeHandler(oAuth),
-			fnSession,
-			sPath: `${oOptions.basePath ?? "/api/auth"}/{*path}`
-		};
-	}
-};
-// src/database/Database.ts
-/** Drizzle clients of the app and its plugins, one per name, on one pool of `DATABASE_URL` */
-var Database = class {
-	static oPool;
-	/** Mounted clients, by name */
-	static oClients = {};
-	/** Gets a client by name */
-	static get(sName) {
-		return this.oClients[sName];
-	}
-	/** Mounts the Drizzle client of a schema, checking the `nano_*` rule of its tables */
-	static async mount(sName, { schema }) {
-		if (this.get(sName)) throw new NanoError(`The database "${sName}" is already mounted.`);
-		const { defineRelations, is } = await import("drizzle-orm");
-		const { getTableConfig, PgTable } = await import("drizzle-orm/pg-core");
-		const { drizzle } = await import("drizzle-orm/node-postgres");
-		const sOwn = `nano_${sName}`;
-		const { breaks, rule } = sName === "app" ? {
-			breaks: (sSchema) => sSchema.startsWith("nano_"),
-			rule: "the nano_* schemas are reserved for plugins"
-		} : {
-			breaks: (sSchema) => sSchema !== sOwn,
-			rule: `a plugin keeps its tables in "${sOwn}"`
-		};
-		for (const oTable of Object.values(schema).filter((oValue) => is(oValue, PgTable))) {
-			const { name, schema: sSchema = "public" } = getTableConfig(oTable);
-			if (breaks(sSchema)) throw new NanoError(`The database "${sName}": table "${sSchema}.${name}" breaks the rule, ${rule}.`);
-		}
-		this.oPool ??= await this.pool();
-		const oClient = drizzle({
-			client: this.oPool,
-			relations: schema.relations ?? defineRelations(schema)
-		});
-		this.oClients[sName] = oClient;
-		Logger.info(`Database "${sName}" mounted`);
-		return oClient;
-	}
-	/** The pool of `DATABASE_URL`, shared by every client */
-	static async pool() {
-		const sUrl = process.env.DATABASE_URL;
-		if (!sUrl) throw new NanoError("The DATABASE_URL environment variable is not defined.");
-		const { Pool } = await import("pg");
-		return new Pool({ connectionString: sUrl });
-	}
-};
-// src/routes/Plugin.ts
+// src/plugins/Plugin.ts
 /** A group of routes, with its options, callbacks and database */
 var Plugin = class {
 	oConfig;
@@ -364,146 +381,78 @@ var Plugin = class {
 	/** Mounts its endpoints on express app */
 	async mount(oApp) {
 		const { name, routesDir, basePath, database, options, callbacks } = this.oConfig;
-		const oAuthOptions = name === "app" ? await BetterAuth.findOptions() : void 0;
-		const oDb = database ? await Database.mount(name, database) : Database.get("app");
-		if (oAuthOptions) {
-			if (!database) throw new NanoError("src/auth.ts needs the database of the app: set mainPlugin.database.schema.");
-			const { sPath, oHandler, fnSession } = await BetterAuth.create(oAuthOptions, oDb, database.schema);
-			oApp.all(sPath, oHandler);
-			oApp.use(fnSession);
-		}
+		const oDb = await DatabaseManager.mount(name, database);
 		const oParams = Object.freeze({
 			...options,
 			db: oDb,
-			auth: BetterAuth.get()
+			auth: BetterAuth.instance()
 		});
 		await callbacks?.onMount?.(oApp, oParams);
 		const oRouter = new Router(routesDir, basePath);
 		for (const { path, endpoint } of await oRouter.mount()) oApp.all(path, await endpoint.mount(oParams, path));
 	}
 };
-// src/app/config.ts
-/** Initial application configuration */
-const INITIAL_CONFIG = {
-	/** Application port */
-	port: 3e3,
-	/** Express settings: the client IP comes from `X-Forwarded-For` only through private proxies */
-	settings: { "trust proxy": PRIVATE_NETWORKS },
-	/** Initial middlewares */
-	packages: {
-		morgan: {
-			tokens: {
-				timestamp: () => Logger.date(),
-				path: (oReq) => oReq.path
-			},
-			format: ":timestamp | :method :path :status"
-		},
-		cors: { methods: [
-			"GET",
-			"HEAD",
-			"PUT",
-			"POST",
-			"DELETE",
-			"QUERY"
-		] },
-		helmet: true,
-		compression: false,
-		express: { limit: "10kb" },
-		urlencoded: { extended: false }
-	},
-	/** Main plugin to mount */
-	mainPlugin: {
-		routesDir: "src/routes",
-		basePath: ""
-	},
-	/** Plugins around the consumer routes */
-	plugins: []
+// src/plugins/PluginManager.ts
+/** The plugins of the app: its own, the ones before it and the ones after it */
+var PluginManager = class {
+	/** Mounts every plugin on express app, in order: before, the app's, after */
+	static async mount(oApp, oConfig) {
+		const { routesDir = "src/routes", database, plugins } = oConfig;
+		await DatabaseManager.mount("app", database);
+		const oAppPlugin = new Plugin({
+			name: "app",
+			routesDir,
+			database
+		});
+		const aBefore = (plugins?.before ?? []).map((oPlugin) => new Plugin(oPlugin));
+		const aAfter = (plugins?.after ?? []).map((oPlugin) => new Plugin(oPlugin));
+		for (const oPlugin of [
+			...aBefore,
+			oAppPlugin,
+			...aAfter
+		]) await oPlugin.mount(oApp);
+	}
 };
-/** Merges a value over its default: plain objects key by key at every level; anything else replaces it */
-function deepMerge(oDefault, oValue) {
-	if (oValue === void 0) return oDefault;
-	if (!Validator.isObject(oDefault) || !Validator.isObject(oValue)) return oValue;
-	const aKeys = Object.keys({
-		...oDefault,
-		...oValue
-	});
-	return Object.fromEntries(aKeys.map((sKey) => [sKey, deepMerge(oDefault[sKey], oValue[sKey])]));
-}
-/** Whether a merged configuration kept the plain object of the initial one */
-function isMergedConfig(oValue) {
-	return Validator.isObject(oValue);
-}
-/** Merges the consumer configuration over the initial one; the main plugin is always named "app" */
-function mergeConfig(oConfig = {}) {
-	const oMerged = deepMerge(INITIAL_CONFIG, oConfig);
-	if (!isMergedConfig(oMerged)) throw new NanoError("The configuration of createNanoApp must be an object.");
-	return {
-		...oMerged,
-		mainPlugin: {
-			...oMerged.mainPlugin,
-			name: "app"
-		}
-	};
-}
-// src/app/errors.ts
-/** Database errors the request caused, by their Postgres code or Drizzle's name */
-const DATABASE_ERRORS = {
-	"23505": {
-		status: 409,
-		message: "Conflict"
-	},
-	"23503": {
-		status: 409,
-		message: "Conflict"
-	},
-	"23502": {
-		status: 400,
-		message: "Invalid request"
-	},
-	"22P02": {
-		status: 400,
-		message: "Invalid request"
+/** Express settings: the client IP comes from `X-Forwarded-For` only through private proxies */
+const SETTINGS = { "trust proxy": PRIVATE_NETWORKS };
+/** Base middlewares */
+const PACKAGES = {
+	morgan: {
+		tokens: {
+			timestamp: () => Logger.date(),
+			path: (oReq) => oReq.path
+		},
+		format: ":timestamp | :method :path :status"
 	},
-	DrizzleError: {
-		status: 400,
-		message: "Invalid request"
-	}
+	cors: { methods: [
+		"GET",
+		"HEAD",
+		"PUT",
+		"POST",
+		"DELETE",
+		"QUERY"
+	] },
+	helmet: true,
+	compression: false,
+	express: { limit: "10kb" },
+	urlencoded: { extended: false }
 };
-/** Whether anything thrown is an object, read as a HandlerError or a Drizzle error with its Postgres cause */
-function isHandlerError(oError) {
-	return typeof oError === "object" && oError !== null;
-}
-/** Normalizes anything thrown by a handler into an ApiResponse plus its status */
-function normalize(oError) {
-	if (typeof oError === "string") return {
-		status: 400,
-		body: {
-			success: false,
-			message: oError
-		}
-	};
-	const oThrown = isHandlerError(oError) ? oError : {};
-	const sKey = oThrown.cause?.code ?? oThrown.name ?? "";
-	const { status, message, warning } = DATABASE_ERRORS[sKey] ?? oThrown;
-	const iStatus = status ?? 500;
-	return {
-		status: iStatus,
-		body: {
-			success: false,
-			warning: warning ?? false,
-			message: iStatus < 500 && message || "Internal server error"
-		}
-	};
-}
+// src/app/handlers/errors.ts
 /** Turns every unmatched request into a 404 for the error handler */
 const notFoundHandler = (oReq, _oRes, fnNext) => {
 	fnNext(new NanoError(`${oReq.path} not found`, 404));
 };
-/** Turns any error raised by a handler into an ApiResponse */
+/** Answers anything a handler throws as an ApiResponse */
 const errorHandler = (oError, _oReq, oRes, _fnNext) => {
-	const { status, body } = normalize(oError);
-	if (status >= 500) Logger.error("Internal server error", oError);
-	oRes.status(status).json(body);
+	const oThrown = typeof oError === "string" ? new NanoError(oError, 400) : oError;
+	const iStatus = oThrown?.status ?? 500;
+	const sMessage = iStatus < 500 ? oThrown.message : "Internal server error";
+	if (iStatus >= 500) Logger.error(sMessage, oError);
+	oRes.status(iStatus).json({
+		success: false,
+		warning: oThrown.warning ?? false,
+		message: sMessage
+	});
 };
 // src/app/NanoApp.ts
 /** Main NanoApp class */
@@ -512,16 +461,17 @@ var NanoApp = class {
 	oConfig;
 	constructor(oConfig = {}) {
 		this.oApp = express();
-		this.oConfig = mergeConfig(oConfig);
+		this.oConfig = oConfig;
 		this.start();
 	}
 	/** Starts the application */
 	async start() {
 		try {
 			await this.initialize();
-			this.oApp.listen(this.oConfig.port, () => {
+			const iPort = this.oConfig.port ?? 3e3;
+			this.oApp.listen(iPort, () => {
 				this.oConfig.listener?.();
-				Logger.info(`Nano App running on port ${this.oConfig.port}`);
+				Logger.info(`Nano App running on port ${iPort}`);
 			});
 		} catch (oError) {
 			Logger.error("Error trying to start the server.", oError);
@@ -530,19 +480,16 @@ var NanoApp = class {
 	}
 	/** Initializes the application in the right order */
 	async initialize() {
-		for (const [sKey, oValue] of Object.entries(this.oConfig.settings)) this.oApp.set(sKey, oValue);
-		this.setPackages(this.oConfig.packages);
-		const { mainPlugin, plugins } = this.oConfig;
-		const oPlugins = {
-			before: [],
-			after: []
-		};
-		for (const oPlugin of plugins) oPlugins[oPlugin.stage ?? "before"].push(oPlugin);
-		for (const oPlugin of [
-			...oPlugins.before,
-			mainPlugin,
-			...oPlugins.after
-		]) await new Plugin(oPlugin).mount(this.oApp);
+		for (const [sKey, oValue] of Object.entries({
+			...SETTINGS,
+			...this.oConfig.settings
+		})) this.oApp.set(sKey, oValue);
+		this.setPackages({
+			...PACKAGES,
+			...this.oConfig.packages
+		});
+		await BetterAuth.mount(this.oApp, this.oConfig.auth);
+		await PluginManager.mount(this.oApp, this.oConfig);
 		this.oApp.use(notFoundHandler);
 		this.oApp.use(errorHandler);
 	}
@@ -562,7 +509,7 @@ var NanoApp = class {
 		for (const fnPackage of aPackages) if (fnPackage) this.oApp.use(fnPackage);
 	}
 };
-// src/app/creators.ts
+// src/lib/creators.ts
 /** Creates a new NanoApp instance */
 function createNanoApp(oConfig) {
 	return new NanoApp(oConfig);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nano-app/backend",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "description": "Express server with file-convention routes, plugins and an optional PostgreSQL layer",
   "type": "module",
   "main": "build/index.js",
@@ -56,13 +56,21 @@
   },
   "peerDependencies": {
     "better-auth": "^1.7.18",
+    "drizzle-kit": "^1.0.0-rc.5",
     "drizzle-orm": "^1.0.0-rc.5",
+    "kysely": "^0.29.8",
     "pg": "^8.23.1"
   },
   "peerDependenciesMeta": {
+    "kysely": {
+      "optional": true
+    },
     "better-auth": {
       "optional": true
     },
+    "drizzle-kit": {
+      "optional": true
+    },
     "drizzle-orm": {
       "optional": true
     },
@@ -80,6 +88,7 @@
     "better-auth": "^1.7.18",
     "drizzle-kit": "^1.0.0-rc.5",
     "drizzle-orm": "^1.0.0-rc.5",
+    "kysely": "^0.29.8",
     "pg": "^8.23.1",
     "tsdown": "^0.23.5",
     "tsx": "^4.23.15",