@nano-app/backend 0.18.0 → 0.20.0

package/build/index.js

@@ -1,14 +1,15 @@
-import express from "express";
-import morgan from "morgan";
-import cors from "cors";
-import helmet from "helmet";
-import compression from "compression";
-import "dotenv/config";
 import { glob } from "glob";
 import { isAbsolute, resolve } from "node:path";
 import { existsSync } from "node:fs";
 import { createJiti } from "jiti";
 import { z } from "zod";
+import express from "express";
+import "dotenv/config";
+import morgan from "morgan";
+import cors from "cors";
+import helmet from "helmet";
+import compression from "compression";
+import { ipKeyGenerator } from "express-rate-limit";
 // ../core/utils/NanoError.ts
 /** Error of the framework, with the status a handler answers */
 var NanoError = class extends Error {
@@ -39,11 +40,21 @@ var FileReader = class {
 		return sAbsolutePath;
 	}
 };
+// ../core/utils/Validator.ts
+/** Checks the consumer's files; an invalid file throws a `NanoError` */
+var Validator = class {
+	/** Checks a file with a schema: an invalid one throws with its key */
+	static validate(oSchema, oFile, sKey) {
+		const oResult = oSchema.safeParse(oFile);
+		if (!oResult.success) throw new NanoError(`${sKey}:\n${z.prettifyError(oResult.error)}`);
+		return oResult.data;
+	}
+};
 // ../core/files/FileLoader.ts
 /** Finds and loads the consumer's files */
 var FileLoader = class {
-	/** Finds the `*.<extension>.ts` files of a folder: `{ [subPath]: defaultExport }` */
-	static async findMany(sExtension, sSourceDir) {
+	/** The `*.<extension>.ts` files of a folder by subpath, checked with a schema */
+	static async findMany(sExtension, oSchema, sSourceDir) {
 		const sSrcDir = (sSourceDir ?? `src/${sExtension}s`).replace(/^\.\//, "").replace(/\/$/, "");
 		const aFilePaths = await glob(`${sSrcDir}/**/*.${sExtension}.{ts,js}`, {
 			posix: true,
@@ -51,29 +62,13 @@ var FileLoader = class {
 		});
 		const oEntries = {};
 		for (const sFilePath of aFilePaths) {
-			const sFileSubPath = sFilePath.slice(sSrcDir.length).replace(new RegExp(`\\.${sExtension}\\.(ts|js)$`), "");
-			const sKey = sExtension === "store" ? sFileSubPath.slice(1).replaceAll("/", "_") : sFileSubPath;
-			oEntries[sKey] = await FileReader.loadModule(sFilePath, { default: true });
+			const sKey = sFilePath.slice(sSrcDir.length).replace(new RegExp(`\\.${sExtension}\\.(ts|js)$`), "");
+			const oFile = await FileReader.loadModule(sFilePath, { default: true });
+			oEntries[sKey] = Validator.validate(oSchema, oFile, sKey);
 		}
 		return oEntries;
 	}
 };
-// ../core/utils/Validator.ts
-/** Checks values of the framework and the consumer's files; an invalid file throws a `NanoError` */
-var Validator = class {
-	/** Whether a value is a plain object */
-	static isObject(oValue) {
-		return Object.prototype.toString.call(oValue) === "[object Object]";
-	}
-	/** Checks every entry with a zod schema (`ROUTE`, `STORE`): the first invalid one throws with its key */
-	static validate(oEntries, oSchema) {
-		return Object.fromEntries(Object.entries(oEntries).map(([sKey, oEntry]) => {
-			const oResult = oSchema.safeParse(oEntry);
-			if (!oResult.success) throw new NanoError(`${sKey}:\n${z.prettifyError(oResult.error)}`);
-			return [sKey, oResult.data];
-		}));
-	}
-};
 // ../core/utils/Logger.ts
 /** Messages of the framework on the console */
 var Logger = class Logger {
@@ -98,17 +93,7 @@ var Logger = class Logger {
 		return oDate.toISOString().slice(0, 19).replace("T", " ");
 	}
 };
-// ../core/utils/Paths.ts
-/** Paths of the app's pages */
-var Paths = class {
-	/** Whether a path matches a pattern: exact (`/admin`), or the path and all below it (`/admin/*`) */
-	static matches(sPattern, sPath) {
-		if (!sPattern.endsWith("/*")) return sPattern === sPath;
-		const sBase = sPattern.slice(0, -2);
-		return sPath === sBase || sPath.startsWith(`${sBase}/`);
-	}
-};
-// ../core/const.ts
+// src/const.ts
 /** Loopback and private networks: the proxies the backend trusts by default */
 const PRIVATE_NETWORKS = [
 	"127.0.0.0/8",
@@ -118,7 +103,303 @@ const PRIVATE_NETWORKS = [
 	"192.168.0.0/16",
 	"fc00::/7"
 ];
-// ../core/utils/validations.ts
+/** Express settings: the client IP comes from `X-Forwarded-For` only through private proxies */
+const SETTINGS = { "trust proxy": PRIVATE_NETWORKS };
+/** Base middlewares */
+const PACKAGES = {
+	morgan: {
+		tokens: {
+			timestamp: () => Logger.date(),
+			path: (oReq) => oReq.path
+		},
+		format: ":timestamp | :method :path :status"
+	},
+	cors: { methods: [
+		"GET",
+		"HEAD",
+		"PUT",
+		"POST",
+		"DELETE",
+		"QUERY"
+	] },
+	helmet: true,
+	compression: false,
+	express: { limit: "10kb" },
+	urlencoded: { extended: false }
+};
+/** Key of the Postgres lock that lets one startup change the database at a time */
+const LOCK = 7310002;
+/** Name of Better Auth's database: its tables live in `nano_auth` */
+const AUTH_NAME = "auth";
+/** Marks of the dynamic segments of a path, from the least to the most generic */
+const MARKS = [
+	":",
+	"{",
+	"*"
+];
+// src/database/DatabaseManager.ts
+/** The databases of the app and its plugins: the pool of `DATABASE_URL`, its lock and one client per config */
+var DatabaseManager = class {
+	static oPool;
+	static oClients = /* @__PURE__ */ new Map();
+	/** Mounts a database once, whatever its client, and gives its client; undefined without one */
+	static async mount(oDB) {
+		if (!oDB) return void 0;
+		return this.getClient(oDB);
+	}
+	/** The pool of `DATABASE_URL`, shared by every client, created on the first call */
+	static async pool() {
+		const sUrl = process.env.DATABASE_URL;
+		if (!sUrl) throw new NanoError("The DATABASE_URL environment variable is not defined.");
+		const { Pool } = await import("pg");
+		this.oPool ??= new Pool({ connectionString: sUrl });
+		return this.oPool;
+	}
+	/** Creates the client of a database on the shared pool, with the lock for its changes */
+	static async getClient(oDB) {
+		const { sName, oConfig } = oDB;
+		const oClient = this.oClients.get(oConfig);
+		if (oClient !== void 0) return oClient;
+		await this.pool();
+		await oDB.checkTables();
+		const oDBClient = await oDB.connect(this.oPool);
+		const oConnection = await this.oPool.connect();
+		await oConnection.query("SELECT pg_advisory_lock($1)", [LOCK]);
+		const { migrate, push } = oConfig;
+		if (migrate) await oDB.migrate(migrate);
+		if (push) await oDB.push();
+		oConnection.release(true);
+		Logger.info(`Database "${sName}" mounted`);
+		this.oClients.set(oConfig, oDBClient);
+		return oDBClient;
+	}
+};
+// src/database/clients/DatabaseClient.ts
+/** A database the manager mounts, whatever its client: its tables, its client and its changes */
+var DatabaseClient = class {
+	sName;
+	oConfig;
+	/** Its nano_* schema, reserved for its plugin; the app has none */
+	sSchema;
+	/** Creates a new client of a database, named as its plugin */
+	constructor(sName, oConfig) {
+		this.sName = sName;
+		this.oConfig = oConfig;
+		this.sSchema = sName === "app" ? void 0 : `nano_${sName}`;
+	}
+	/** Checks its tables: a nano_* schema only for the plugin of its name */
+	async checkTables() {
+		for (const { schema, name } of await this.tables()) if (schema.startsWith("nano_") && schema !== this.sSchema) throw new NanoError(`The database "${this.sName}": table "${schema}.${name}" breaks the rule, each nano_* schema is reserved for the plugin of its name.`);
+	}
+};
+// src/database/clients/BetterAuth.ts
+/** Better Auth's tables, as its options declare them, in its nano_* schema on its Kysely adapter */
+var BetterAuth = class extends DatabaseClient {
+	oOptions;
+	oPool;
+	oDatabase;
+	/** Creates the database of Better Auth from its options */
+	constructor(sName, oConfig, oOptions) {
+		super(sName, oConfig);
+		this.oOptions = oOptions;
+	}
+	/** Its tables, from the options: the base ones, its plugins' and the additional fields */
+	async tables() {
+		const { getSchema } = await import("better-auth/db");
+		const sSchema = this.sSchema ?? "public";
+		return Object.keys(getSchema(this.oOptions)).map((name) => ({
+			schema: sSchema,
+			name
+		}));
+	}
+	/** Better Auth's `database` option on the shared pool, its tables in its nano_* schema */
+	async connect(oPool) {
+		const { PostgresDialect } = await import("kysely");
+		this.oPool = oPool;
+		this.oDatabase = {
+			dialect: new PostgresDialect({ pool: oPool }),
+			type: "postgres",
+			schemaName: this.sSchema
+		};
+		return this.oDatabase;
+	}
+	/** Applies the pending migrations of a folder, generated from `npx auth generate --adapter drizzle` */
+	async migrate(sFolder) {
+		const { drizzle } = await import("drizzle-orm/node-postgres");
+		const { migrate } = await import("drizzle-orm/node-postgres/migrator");
+		await migrate(drizzle({ client: this.oPool }), {
+			migrationsFolder: sFolder,
+			migrationsSchema: this.sSchema
+		});
+	}
+	/** Creates the tables and columns its options need; it only adds */
+	async push() {
+		const { getMigrations } = await import("better-auth/db/migration");
+		const { runMigrations } = await getMigrations({
+			...this.oOptions,
+			database: this.oDatabase
+		});
+		await runMigrations();
+	}
+};
+// src/auth/Auth.ts
+/** Better Auth of the app: its tables in `nano_auth`, its endpoints and the access of each request */
+var Auth = class {
+	static oAuth;
+	static fnHeaders;
+	/** Mounts its database and creates the instance; its endpoints, none without options */
+	static async init(oOptions) {
+		if (!oOptions) return [];
+		const { betterAuth } = await import("better-auth");
+		const { fromNodeHeaders, toNodeHandler } = await import("better-auth/node");
+		const { database = { push: true }, advanced, basePath = "/api/auth", ...oRest } = oOptions;
+		const oFullOptions = {
+			...oRest,
+			basePath,
+			advanced: {
+				...advanced,
+				ipAddress: {
+					trustedProxies: PRIVATE_NETWORKS,
+					...advanced?.ipAddress
+				}
+			}
+		};
+		const oDatabase = await DatabaseManager.mount(new BetterAuth(AUTH_NAME, database, oFullOptions));
+		const oAuth = betterAuth({
+			...oFullOptions,
+			database: oDatabase
+		});
+		this.oAuth = oAuth;
+		this.fnHeaders = fromNodeHeaders;
+		return [{
+			path: `${basePath}/{*path}`,
+			handler: toNodeHandler(oAuth)
+		}];
+	}
+	/** The session of a request; 401 without one unless public, 403 without the permissions */
+	static async guard(oReq, isPublic, oPermissions) {
+		const oSession = await this.session(oReq);
+		if (this.oAuth && !oSession && !isPublic) throw new NanoError("Not authenticated", 401);
+		if (!await this.isGranted(oSession, isPublic ? void 0 : oPermissions)) throw new NanoError("Forbidden", 403);
+		return oSession;
+	}
+	/** The session of a request, when it has one */
+	static async session(oReq) {
+		if (!this.oAuth || !this.fnHeaders) return void 0;
+		const headers = this.fnHeaders(oReq.headers);
+		return await this.oAuth.api.getSession({ headers }) ?? void 0;
+	}
+	/** Whether the user of a session has the permissions; always without Better Auth or permissions */
+	static async isGranted(oSession, oPermissions) {
+		if (!this.oAuth || !oPermissions) return true;
+		const { success } = await this.oAuth.api.userHasPermission({ body: {
+			userId: oSession?.user.id,
+			role: oSession?.user.role,
+			permissions: oPermissions
+		} });
+		return success;
+	}
+};
+// src/database/clients/Drizzle.ts
+/** Drizzle client of the app or of a plugin: its tables, its client and its changes */
+var Drizzle = class extends DatabaseClient {
+	oClient;
+	/** The Postgres schema and name of each of its tables, from Drizzle's metadata */
+	async tables() {
+		const { is } = await import("drizzle-orm");
+		const { getTableConfig, PgTable } = await import("drizzle-orm/pg-core");
+		return Object.values(this.oConfig.relations).map(({ table }) => table).filter((oTable) => is(oTable, PgTable)).map((oTable) => {
+			const { name, schema = "public" } = getTableConfig(oTable);
+			return {
+				schema,
+				name
+			};
+		});
+	}
+	/** Creates its client on a pool */
+	async connect(oPool) {
+		const { migrate, push, ...oDrizzleConfig } = this.oConfig;
+		const { drizzle } = await import("drizzle-orm/node-postgres");
+		this.oClient = drizzle({
+			...oDrizzleConfig,
+			client: oPool
+		});
+		return this.oClient;
+	}
+	/** Applies the pending migrations of a folder, recorded in its own nano_* schema */
+	async migrate(sFolder) {
+		const { migrate } = await import("drizzle-orm/node-postgres/migrator");
+		await migrate(this.oClient, {
+			migrationsFolder: sFolder,
+			migrationsSchema: this.sSchema
+		});
+	}
+	/** Pushes its tables to their Postgres schemas, failing when it would lose data */
+	async push() {
+		const { pushSchema } = await import("drizzle-kit/api-postgres");
+		const oTables = Object.fromEntries(Object.values(this.oConfig.relations).map(({ name, table }) => [name, table]));
+		const schemas = (await this.tables()).map(({ schema }) => schema);
+		const { hints, apply } = await pushSchema(oTables, this.oClient, {
+			schemas,
+			tables: void 0,
+			entities: void 0,
+			extensions: void 0
+		});
+		if (hints.length) {
+			const sHints = hints.map((oHint) => oHint.hint).join("; ");
+			throw new NanoError(`The database "${this.sName}" cannot be pushed without losing data: ${sHints}. Run \`pnpm drizzle-kit push\` by hand.`);
+		}
+		await apply();
+	}
+};
+// src/router/Endpoint.ts
+/** A route: its methods, its access and its callbacks */
+var Endpoint = class {
+	oMethods;
+	oCallbacks;
+	isPublic;
+	/** Allowed methods and the options of the route */
+	constructor({ callbacks = {}, public: isPublic = false, permissions, ...oMethods }) {
+		this.oMethods = Object.fromEntries(Object.entries(oMethods).map(([sMethod, oMethod]) => [sMethod, typeof oMethod === "function" ? {
+			handler: oMethod,
+			permissions
+		} : {
+			permissions,
+			...oMethod
+		}]));
+		this.oCallbacks = callbacks;
+		this.isPublic = isPublic;
+	}
+	/** Runs its onInit and gives its handler for all methods */
+	async init(oParams) {
+		await this.oCallbacks.onInit?.(oParams);
+		return (oReq, oRes) => this.run(oReq, oParams).then((oResponse) => {
+			const { status, ...oBody } = oResponse;
+			const iStatus = status ?? 200;
+			oRes.status(iStatus).json({
+				...oBody,
+				success: iStatus < 400
+			});
+		});
+	}
+	/** Checks the session and the permissions of the method, then runs onBefore and it */
+	async run(oReq, oParams) {
+		const sMethod = oReq.method;
+		const oMethod = this.oMethods[sMethod];
+		const session = await Auth.guard(oReq, this.isPublic, oMethod?.permissions);
+		if (!oMethod) throw new NanoError(`Method ${sMethod} not implemented`, 405);
+		const oRequestParams = {
+			...oParams,
+			session
+		};
+		const onBeforeResult = await this.oCallbacks.onBefore?.(oReq, sMethod, oRequestParams) ?? {};
+		return oMethod.handler(oReq, {
+			...oRequestParams,
+			onBeforeResult
+		});
+	}
+};
+// src/router/validations.ts
 /** A function of the consumer, typed as what the framework calls */
 function callable() {
 	return z.custom((oValue) => typeof oValue === "function");
@@ -145,215 +426,32 @@ const ROUTE = z.strictObject({
 	DELETE: METHOD,
 	QUERY: METHOD
 }).refine(({ GET, POST, PUT, DELETE, QUERY }) => GET ?? POST ?? PUT ?? DELETE ?? QUERY, { error: "It defines no HTTP method" });
-/** A path of the app, starting with `/` */
-const PATH = z.string().startsWith("/");
-z.object({
-	type: z.enum(["app", "api"]),
-	data: z.record(z.string(), z.any()).optional(),
-	headers: z.record(z.string(), z.string()).optional(),
-	auth: z.object({
-		path: z.string(),
-		routes: z.array(z.object({
-			match: PATH,
-			redirect: PATH.optional(),
-			roles: z.string().optional(),
-			permissions: z.record(z.string(), z.string()).optional()
-		}).refine(({ match, redirect }) => !Paths.matches(match, redirect ?? "/"), { error: "Its \"redirect\" must be outside its \"match\"" })).optional()
-	}).optional()
-});
-// src/auth/permissions.ts
-/** Whether the session's user has the permissions; always without Better Auth or permissions */
-async function isGranted({ auth, session }, oPermissions) {
-	if (!auth || !oPermissions) return true;
-	const { success } = await auth.api.userHasPermission({ body: {
-		userId: session?.user.id,
-		role: session?.user.role,
-		permissions: oPermissions
-	} });
-	return success;
-}
-// src/routes/Endpoint.ts
-/** Base class for all endpoints */
-var Endpoint = class {
-	oMethods;
-	oCallbacks;
-	isPublic;
-	/** Allowed methods and the options of the route */
-	constructor(oMethods, { callbacks = {}, public: isPublic = false, permissions }) {
-		this.oMethods = Object.fromEntries(Object.entries(oMethods).map(([sMethod, oMethod]) => [sMethod, typeof oMethod === "function" ? {
-			handler: oMethod,
-			permissions
-		} : {
-			permissions,
-			...oMethod
-		}]));
-		this.oCallbacks = callbacks;
-		this.isPublic = isPublic;
-	}
-	/** Handler for all methods */
-	async mount(oParams, sPath) {
-		if (!oParams.auth && Object.values(this.oMethods).some(({ permissions }) => permissions)) Logger.warn(`${sPath}: its permissions are not checked without Better Auth. Add src/auth.ts.`);
-		await this.oCallbacks.onInit?.(oParams);
-		return this.createHandler(oParams);
-	}
-	/** Express handler: onBefore, then the method of the request */
-	createHandler(oParams) {
-		return (oReq, oRes, fnNext) => {
-			if (oParams.auth && !oRes.locals.session && !this.isPublic) return fnNext(new NanoError("Not authenticated", 401));
-			const sMethod = oReq.method;
-			const oMethod = this.oMethods[sMethod];
-			if (!oMethod) return fnNext(new NanoError(`Method ${sMethod} not implemented`, 405));
-			const oRequestParams = {
-				...oParams,
-				session: oRes.locals.session
-			};
-			return isGranted(oRequestParams, this.isPublic ? void 0 : oMethod.permissions).then((isAllowed) => {
-				if (!isAllowed) throw new NanoError("Forbidden", 403);
-				return this.oCallbacks.onBefore?.(oReq, sMethod, oRequestParams) ?? {};
-			}).then((onBeforeResult) => oMethod.handler(oReq, {
-				...oRequestParams,
-				onBeforeResult
-			})).then((oResponse) => {
-				const { status, ...oBody } = oResponse;
-				const iStatus = status ?? 200;
-				oRes.status(iStatus).json({
-					...oBody,
-					success: iStatus < 400
-				});
-			});
-		};
-	}
-};
-// src/routes/Router.ts
-/** Turns a folder of `*.route.ts` files into Express paths and endpoints */
-var Router = class {
+// src/router/Router.ts
+/** Turns a folder of `*.route.ts` files and routes made in code into Express paths and endpoints */
+var Router = class Router {
 	sRoutesDir;
 	sBasePath;
-	constructor(sRoutesDir, sBasePath) {
+	oRoutes;
+	constructor(sRoutesDir, sBasePath, oRoutes) {
 		this.sRoutesDir = sRoutesDir;
 		this.sBasePath = sBasePath ?? "";
+		this.oRoutes = oRoutes ?? {};
 	}
-	/** Loads the routes and creates one endpoint per file */
-	async mount() {
-		if (!this.sRoutesDir) return [];
-		const oFiles = await FileLoader.findMany("route", this.sRoutesDir);
-		const oRoutes = Validator.validate(oFiles, ROUTE);
-		return Object.entries(oRoutes).map(([sFilePath, { expression, callbacks, public: isPublic, permissions, ...methods }]) => {
-			const sPath = this.createPath(sFilePath, expression);
-			Logger.info(sPath);
-			return {
-				path: sPath,
-				endpoint: new Endpoint(methods, {
-					callbacks,
-					public: isPublic,
-					permissions
-				})
-			};
-		});
-	}
-	/** `basePath` + file path (`/index` is the folder itself) + `expression`, as Express reads them */
-	createPath(sEndpoint, sExpression = "") {
-		return `${this.sBasePath}${sEndpoint.replace(/\/index$/, "")}${sExpression}` || "/";
-	}
-};
-// src/auth/BetterAuth.ts
-/** Files of the app's Better Auth options, relative to `cwd`: source, then built */
-const AUTH_FILES = ["src/auth.ts", "src/auth.js"];
-/** Better Auth on the app's Drizzle client: the instance, its handler and the session lookup */
-var BetterAuth = class {
-	static oAuth;
-	/** The options of the app's `src/auth.ts`, or undefined without it: Better Auth stays off */
-	static async findOptions() {
-		const sFilePath = AUTH_FILES.find(existsSync);
-		if (!sFilePath) return void 0;
-		const oFile = await FileReader.loadModule(sFilePath, { default: true });
-		if (!Validator.isObject(oFile?.options)) throw new NanoError(`${sFilePath} must default export { options }: the Better Auth options.`);
-		return oFile.options;
-	}
-	/** The instance, once the app's plugin created it */
-	static get() {
-		return this.oAuth;
-	}
-	/** Creates the instance on the app's client and schema, its handler and the session lookup */
-	static async create(oOptions, oDb, oSchema) {
-		const { betterAuth } = await import("better-auth");
-		const { drizzleAdapter } = await import("better-auth/adapters/drizzle");
-		const { getSchema } = await import("better-auth/db");
-		const { fromNodeHeaders, toNodeHandler } = await import("better-auth/node");
-		const aMissing = Object.keys(getSchema(oOptions)).filter((sModel) => !oSchema[sModel]);
-		if (aMissing.length) throw new NanoError(`Better Auth needs the tables ${aMissing.join(", ")} in the app's schema. Run \`npx auth generate\` and apply your schema with drizzle-kit.`);
-		const oAuth = betterAuth({
-			...oOptions,
-			advanced: {
-				...oOptions.advanced,
-				ipAddress: {
-					trustedProxies: PRIVATE_NETWORKS,
-					...oOptions.advanced?.ipAddress
-				}
-			},
-			database: drizzleAdapter(oDb, {
-				provider: "pg",
-				schema: oSchema
-			})
-		});
-		this.oAuth = oAuth;
-		const fnSession = (oReq, oRes, fnNext) => oAuth.api.getSession({ headers: fromNodeHeaders(oReq.headers) }).then((oSession) => {
-			oRes.locals.session = oSession ?? void 0;
-			fnNext();
-		});
-		return {
-			oHandler: toNodeHandler(oAuth),
-			fnSession,
-			sPath: `${oOptions.basePath ?? "/api/auth"}/{*path}`
-		};
-	}
-};
-// src/database/Database.ts
-/** Drizzle clients of the app and its plugins, one per name, on one pool of `DATABASE_URL` */
-var Database = class {
-	static oPool;
-	/** Mounted clients, by name */
-	static oClients = {};
-	/** Gets a client by name */
-	static get(sName) {
-		return this.oClients[sName];
-	}
-	/** Mounts the Drizzle client of a schema, checking the `nano_*` rule of its tables */
-	static async mount(sName, { schema }) {
-		if (this.get(sName)) throw new NanoError(`The database "${sName}" is already mounted.`);
-		const { defineRelations, is } = await import("drizzle-orm");
-		const { getTableConfig, PgTable } = await import("drizzle-orm/pg-core");
-		const { drizzle } = await import("drizzle-orm/node-postgres");
-		const sOwn = `nano_${sName}`;
-		const { breaks, rule } = sName === "app" ? {
-			breaks: (sSchema) => sSchema.startsWith("nano_"),
-			rule: "the nano_* schemas are reserved for plugins"
-		} : {
-			breaks: (sSchema) => sSchema !== sOwn,
-			rule: `a plugin keeps its tables in "${sOwn}"`
-		};
-		for (const oTable of Object.values(schema).filter((oValue) => is(oValue, PgTable))) {
-			const { name, schema: sSchema = "public" } = getTableConfig(oTable);
-			if (breaks(sSchema)) throw new NanoError(`The database "${sName}": table "${sSchema}.${name}" breaks the rule, ${rule}.`);
-		}
-		this.oPool ??= await this.pool();
-		const oClient = drizzle({
-			client: this.oPool,
-			relations: schema.relations ?? defineRelations(schema)
-		});
-		this.oClients[sName] = oClient;
-		Logger.info(`Database "${sName}" mounted`);
-		return oClient;
+	/** Loads the routes and creates one endpoint per route, the most specific path first */
+	async load() {
+		const oRoutes = this.sRoutesDir ? await FileLoader.findMany("route", ROUTE, this.sRoutesDir) : {};
+		for (const [sPath, oRoute] of Object.entries(this.oRoutes)) oRoutes[sPath] = Validator.validate(ROUTE, oRoute, sPath);
+		return Object.entries(oRoutes).map(([sFilePath, { expression = "", ...oEndpointParams }]) => ({
+			path: `${this.sBasePath}${sFilePath.replace(/\/index$/, "")}${expression}` || "/",
+			endpoint: new Endpoint(oEndpointParams)
+		})).sort((oA, oB) => Router.specificity(oA.path).localeCompare(Router.specificity(oB.path)));
 	}
-	/** The pool of `DATABASE_URL`, shared by every client */
-	static async pool() {
-		const sUrl = process.env.DATABASE_URL;
-		if (!sUrl) throw new NanoError("The DATABASE_URL environment variable is not defined.");
-		const { Pool } = await import("pg");
-		return new Pool({ connectionString: sUrl });
+	/** One digit per segment: 0 static, 1 `:param`, 2 `{optional}`, 3 `*wildcard` */
+	static specificity(sPath) {
+		return sPath.split("/").map((sSegment) => MARKS.reduce((iRank, sMark, iIndex) => sSegment.includes(sMark) ? iIndex + 1 : iRank, 0)).join("");
 	}
 };
-// src/routes/Plugin.ts
+// src/plugins/Plugin.ts
 /** A group of routes, with its options, callbacks and database */
 var Plugin = class {
 	oConfig;
@@ -361,150 +459,104 @@ var Plugin = class {
 	constructor(oConfig) {
 		this.oConfig = oConfig;
 	}
-	/** Mounts its endpoints on express app */
-	async mount(oApp) {
-		const { name, routesDir, basePath, database, options, callbacks } = this.oConfig;
-		const oAuthOptions = name === "app" ? await BetterAuth.findOptions() : void 0;
-		const oDb = database ? await Database.mount(name, database) : Database.get("app");
-		if (oAuthOptions) {
-			if (!database) throw new NanoError("src/auth.ts needs the database of the app: set mainPlugin.database.schema.");
-			const { sPath, oHandler, fnSession } = await BetterAuth.create(oAuthOptions, oDb, database.schema);
-			oApp.all(sPath, oHandler);
-			oApp.use(fnSession);
-		}
+	/** Its endpoints, the most specific path first, for NanoApp to register */
+	async build(oAppDB) {
+		const { name, routesDir, routes, basePath, database, options, callbacks } = this.oConfig;
+		const db = await DatabaseManager.mount(database ? new Drizzle(name, database) : oAppDB);
 		const oParams = Object.freeze({
 			...options,
-			db: oDb,
-			auth: BetterAuth.get()
+			db
 		});
-		await callbacks?.onMount?.(oApp, oParams);
-		const oRouter = new Router(routesDir, basePath);
-		for (const { path, endpoint } of await oRouter.mount()) oApp.all(path, await endpoint.mount(oParams, path));
+		await callbacks?.onMount?.(oParams);
+		const aRoutes = await new Router(routesDir, basePath, routes).load();
+		return Promise.all(aRoutes.map(async ({ path, endpoint }) => ({
+			path,
+			handler: await endpoint.init(oParams)
+		})));
 	}
 };
-// src/app/config.ts
-/** Initial application configuration */
-const INITIAL_CONFIG = {
-	/** Application port */
-	port: 3e3,
-	/** Express settings: the client IP comes from `X-Forwarded-For` only through private proxies */
-	settings: { "trust proxy": PRIVATE_NETWORKS },
-	/** Initial middlewares */
-	packages: {
-		morgan: {
-			tokens: {
-				timestamp: () => Logger.date(),
-				path: (oReq) => oReq.path
+// src/plugins/PluginManager.ts
+/** The plugins of the app: its own, the ones before it and the ones after it */
+var PluginManager = class {
+	/** The endpoints of every plugin, in order: before, the app's, after */
+	static async build(oConfig) {
+		const { routesDir = "src/routes", database, plugins } = oConfig;
+		const oAppDB = database && new Drizzle("app", database);
+		const { before = [], after = [] } = plugins ?? {};
+		const aPlugins = [
+			...before,
+			{
+				name: "app",
+				routesDir
 			},
-			format: ":timestamp | :method :path :status"
-		},
-		cors: { methods: [
-			"GET",
-			"HEAD",
-			"PUT",
-			"POST",
-			"DELETE",
-			"QUERY"
-		] },
-		helmet: true,
-		compression: false,
-		express: { limit: "10kb" },
-		urlencoded: { extended: false }
-	},
-	/** Main plugin to mount */
-	mainPlugin: {
-		routesDir: "src/routes",
-		basePath: ""
-	},
-	/** Plugins around the consumer routes */
-	plugins: []
-};
-/** Merges a value over its default: plain objects key by key at every level; anything else replaces it */
-function deepMerge(oDefault, oValue) {
-	if (oValue === void 0) return oDefault;
-	if (!Validator.isObject(oDefault) || !Validator.isObject(oValue)) return oValue;
-	const aKeys = Object.keys({
-		...oDefault,
-		...oValue
-	});
-	return Object.fromEntries(aKeys.map((sKey) => [sKey, deepMerge(oDefault[sKey], oValue[sKey])]));
-}
-/** Whether a merged configuration kept the plain object of the initial one */
-function isMergedConfig(oValue) {
-	return Validator.isObject(oValue);
-}
-/** Merges the consumer configuration over the initial one; the main plugin is always named "app" */
-function mergeConfig(oConfig = {}) {
-	const oMerged = deepMerge(INITIAL_CONFIG, oConfig);
-	if (!isMergedConfig(oMerged)) throw new NanoError("The configuration of createNanoApp must be an object.");
-	return {
-		...oMerged,
-		mainPlugin: {
-			...oMerged.mainPlugin,
-			name: "app"
-		}
-	};
-}
-// src/app/errors.ts
-/** Database errors the request caused, by their Postgres code or Drizzle's name */
-const DATABASE_ERRORS = {
-	"23505": {
-		status: 409,
-		message: "Conflict"
-	},
-	"23503": {
-		status: 409,
-		message: "Conflict"
-	},
-	"23502": {
-		status: 400,
-		message: "Invalid request"
-	},
-	"22P02": {
-		status: 400,
-		message: "Invalid request"
-	},
-	DrizzleError: {
-		status: 400,
-		message: "Invalid request"
+			...after
+		];
+		const aMounts = [];
+		for (const oPlugin of aPlugins) aMounts.push(...await new Plugin(oPlugin).build(oAppDB));
+		return aMounts;
 	}
 };
-/** Whether anything thrown is an object, read as a HandlerError or a Drizzle error with its Postgres cause */
-function isHandlerError(oError) {
-	return typeof oError === "object" && oError !== null;
-}
-/** Normalizes anything thrown by a handler into an ApiResponse plus its status */
-function normalize(oError) {
-	if (typeof oError === "string") return {
-		status: 400,
-		body: {
-			success: false,
-			message: oError
-		}
-	};
-	const oThrown = isHandlerError(oError) ? oError : {};
-	const sKey = oThrown.cause?.code ?? oThrown.name ?? "";
-	const { status, message, warning } = DATABASE_ERRORS[sKey] ?? oThrown;
-	const iStatus = status ?? 500;
-	return {
-		status: iStatus,
-		body: {
-			success: false,
-			warning: warning ?? false,
-			message: iStatus < 500 && message || "Internal server error"
-		}
-	};
-}
+// src/app/handlers/errors.ts
 /** Turns every unmatched request into a 404 for the error handler */
 const notFoundHandler = (oReq, _oRes, fnNext) => {
 	fnNext(new NanoError(`${oReq.path} not found`, 404));
 };
-/** Turns any error raised by a handler into an ApiResponse */
+/** Answers anything a handler throws as an ApiResponse */
 const errorHandler = (oError, _oReq, oRes, _fnNext) => {
-	const { status, body } = normalize(oError);
-	if (status >= 500) Logger.error("Internal server error", oError);
-	oRes.status(status).json(body);
+	const oThrown = typeof oError === "string" ? new NanoError(oError, 400) : oError;
+	const iStatus = oThrown?.status ?? 500;
+	const sMessage = iStatus < 500 ? oThrown.message : "Internal server error";
+	if (iStatus >= 500) Logger.error(sMessage, oError);
+	oRes.status(iStatus).json({
+		success: false,
+		warning: oThrown.warning ?? false,
+		message: sMessage
+	});
 };
+// src/app/handlers/rateLimit.ts
+/** Rate limit per client IP: each request spends a token of the client's bucket, refilled over time */
+function rateLimit({ capacity = 100, refillPerSecond = 1, message = "Too many requests, please try again later." }) {
+	const fnRefill = (oBucket, iNow) => Math.min(capacity, oBucket.iTokens + (iNow - oBucket.iTime) / 1e3 * refillPerSecond);
+	const oBuckets = /* @__PURE__ */ new Map();
+	setInterval(() => {
+		const iNow = Date.now();
+		for (const [sIp, oBucket] of oBuckets) if (fnRefill(oBucket, iNow) >= capacity) oBuckets.delete(sIp);
+	}, 6e4).unref();
+	return (oReq, oRes, fnNext) => {
+		const sIp = ipKeyGenerator(oReq.ip ?? "");
+		const iNow = Date.now();
+		const iTokens = fnRefill(oBuckets.get(sIp) ?? {
+			iTokens: capacity,
+			iTime: iNow
+		}, iNow);
+		if (iTokens < 1) {
+			oRes.set("Retry-After", String(Math.ceil((1 - iTokens) / refillPerSecond)));
+			return fnNext({
+				status: 429,
+				message
+			});
+		}
+		oBuckets.set(sIp, {
+			iTokens: iTokens - 1,
+			iTime: iNow
+		});
+		fnNext();
+	};
+}
+// src/app/packages.ts
+/** The base middlewares that are on, in the order the app uses them */
+function packages(oConfig) {
+	if (oConfig.morgan) for (const [sKey, fnToken] of Object.entries(oConfig.morgan.tokens ?? {})) morgan.token(sKey, fnToken);
+	return [
+		oConfig.morgan && morgan(oConfig.morgan.format),
+		oConfig.cors && cors(oConfig.cors),
+		oConfig.helmet && helmet(),
+		oConfig.rateLimit && rateLimit(oConfig.rateLimit),
+		oConfig.compression && compression(),
+		oConfig.express && express.json(oConfig.express),
+		oConfig.urlencoded && express.urlencoded(oConfig.urlencoded)
+	].filter((fnPackage) => typeof fnPackage === "function");
+}
 // src/app/NanoApp.ts
 /** Main NanoApp class */
 var NanoApp = class {
@@ -512,16 +564,17 @@ var NanoApp = class {
 	oConfig;
 	constructor(oConfig = {}) {
 		this.oApp = express();
-		this.oConfig = mergeConfig(oConfig);
+		this.oConfig = oConfig;
 		this.start();
 	}
 	/** Starts the application */
 	async start() {
 		try {
 			await this.initialize();
-			this.oApp.listen(this.oConfig.port, () => {
+			const iPort = this.oConfig.port ?? 3e3;
+			this.oApp.listen(iPort, () => {
 				this.oConfig.listener?.();
-				Logger.info(`Nano App running on port ${this.oConfig.port}`);
+				Logger.info(`Nano App running on port ${iPort}`);
 			});
 		} catch (oError) {
 			Logger.error("Error trying to start the server.", oError);
@@ -530,39 +583,25 @@ var NanoApp = class {
 	}
 	/** Initializes the application in the right order */
 	async initialize() {
-		for (const [sKey, oValue] of Object.entries(this.oConfig.settings)) this.oApp.set(sKey, oValue);
-		this.setPackages(this.oConfig.packages);
-		const { mainPlugin, plugins } = this.oConfig;
-		const oPlugins = {
-			before: [],
-			after: []
-		};
-		for (const oPlugin of plugins) oPlugins[oPlugin.stage ?? "before"].push(oPlugin);
-		for (const oPlugin of [
-			...oPlugins.before,
-			mainPlugin,
-			...oPlugins.after
-		]) await new Plugin(oPlugin).mount(this.oApp);
+		for (const [sKey, oValue] of Object.entries({
+			...SETTINGS,
+			...this.oConfig.settings
+		})) this.oApp.set(sKey, oValue);
+		for (const fnPackage of packages({
+			...PACKAGES,
+			...this.oConfig.packages
+		})) this.oApp.use(fnPackage);
+		const aAuth = await Auth.init(this.oConfig.auth);
+		const aPlugins = await PluginManager.build(this.oConfig);
+		for (const { path, handler } of [...aAuth, ...aPlugins]) {
+			Logger.info(path);
+			this.oApp.all(path, handler);
+		}
 		this.oApp.use(notFoundHandler);
 		this.oApp.use(errorHandler);
 	}
-	/** Adds the packages according to the configuration */
-	setPackages(oConfig) {
-		if (oConfig.morgan) {
-			for (const [sKey, fnToken] of Object.entries(oConfig.morgan.tokens ?? {})) morgan.token(sKey, fnToken);
-			this.oApp.use(morgan(oConfig.morgan.format));
-		}
-		const aPackages = [
-			oConfig.cors && cors(oConfig.cors),
-			oConfig.helmet && helmet(),
-			oConfig.compression && compression(),
-			oConfig.express && express.json(oConfig.express),
-			oConfig.urlencoded && express.urlencoded(oConfig.urlencoded)
-		];
-		for (const fnPackage of aPackages) if (fnPackage) this.oApp.use(fnPackage);
-	}
 };
-// src/app/creators.ts
+// src/lib/creators.ts
 /** Creates a new NanoApp instance */
 function createNanoApp(oConfig) {
 	return new NanoApp(oConfig);
@@ -572,10 +611,19 @@ function createRoute(oRoute) {
 	return oRoute;
 }
 function createPlugin(fnCreator) {
-	return fnCreator;
+	return (options) => {
+		const oConfig = fnCreator(options);
+		return {
+			...oConfig,
+			basePath: options?.basePath ?? oConfig.basePath
+		};
+	};
 }
 /** Creates the callbacks of a plugin, typed with what it injects in its params. */
 function createPluginCallbacks(oCallbacks) {
 	return oCallbacks;
 }
+// src/index.ts
+/** Whether the user of a session has the permissions, asked to Better Auth */
+const isGranted = Auth.isGranted.bind(Auth);
 export { NanoApp, NanoError, createNanoApp, createPlugin, createPluginCallbacks, createRoute, isGranted };