@nano-app/backend 0.19.0 → 0.20.0

package/README.md

@@ -85,11 +85,13 @@ Every option is optional.
 | `settings` | `{ "trust proxy": <private networks> }` | Values for `app.set()`: see [Client IP](#client-ip). |
 | `packages` | see below | Framework base middlewares. |
 | `routesDir` | `"src/routes"` | Folder of your routes, relative to `cwd`. |
-| `database` | none | Your Drizzle schema: see [Database](#database). |
+| `database` | none | Your Drizzle relations and how its tables are applied: see [Database](#database). |
 | `auth` | none | Better Auth options: see [Better Auth](#better-auth). |
 | `plugins` | `{}` | Plugins mounted `before` and `after` your routes, in order: see [Plugins](#plugins). |
 
-`packages` accepts `morgan`, `cors`, `helmet`, `compression`, `express` (`express.json` options) and `urlencoded`. Each one you set replaces its default whole and the others keep theirs; pass `false` to disable one. `settings` works the same way, key by key.
+`packages` accepts `morgan`, `cors`, `helmet`, `rateLimit`, `compression`, `express` (`express.json` options) and `urlencoded`. Each one you set replaces its default whole and the others keep theirs; pass `false` to disable one. `settings` works the same way, key by key.
+
+`rateLimit` is off by default. With `{ capacity, refillPerSecond, message }` (defaults `100`, `1` and a generic message) it limits every request per client IP, Better Auth's endpoints too: each request spends a token of the client's bucket, which refills over time; without one it answers `429` with `message` and `Retry-After`. The addresses of an IPv6 `/56` are one client, and the buckets live in the memory of each process.
 
 `compression` is off by default: the proxy in front of the app (an ingress, nginx) usually compresses the answers. Turn it on with `packages: { compression: true }` when nothing does.
 
@@ -106,7 +108,7 @@ createNanoApp({
 
 ### Client IP
 
-The [`rate-limit` plugin](../plugins/README.md) and Better Auth count each client by its IP. Behind a proxy (the frontend of `@nano-app/frontend`, nginx, a load balancer, a CDN, Tailscale Funnel), the IP of the request is the proxy's: the client's is the last one the proxies appended to `X-Forwarded-For`.
+The [rate limit](#configuration) and Better Auth count each client by its IP. Behind a proxy (the frontend of `@nano-app/frontend`, nginx, a load balancer, a CDN, Tailscale Funnel), the IP of the request is the proxy's: the client's is the last one the proxies appended to `X-Forwarded-For`.
 
 By default the backend reads that header only when the request comes from loopback or a private network (`127.0.0.0/8`, `::1`, `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`, `fc00::/7`), and takes the last address that is not one of them. A request from a public IP is counted by that IP, whatever header it sends. Better Auth gets the same networks as `advanced.ipAddress.trustedProxies`.
 
@@ -116,7 +118,7 @@ By default the backend reads that header only when the request comes from loopba
 
 ## Database
 
-Off until the app passes its schema: nano-app creates a [Drizzle](https://orm.drizzle.team) client of it on `DATABASE_URL` and passes it to your handlers as `db`. It changes your tables only when you ask: `push` or `migrations`. Without them, applying the schema (`drizzle-kit push`, `drizzle-kit generate` and `migrate`) is up to you.
+Off until the app passes its relations: nano-app creates a [Drizzle](https://orm.drizzle.team) client of them on `DATABASE_URL` and passes it to your handlers as `db`. It changes your tables only when you ask: `push` or `migrate`. Without them, applying the schema (`drizzle-kit push`, `drizzle-kit generate` and `migrate`) is up to you.
 
 ```bash
 pnpm add drizzle-orm pg
@@ -135,10 +137,11 @@ export const users = pgTable('users', {
 
 ```ts
 // src/app.ts — DATABASE_URL comes from the environment (or a .env file)
+import { defineRelations } from 'drizzle-orm';
 import { createNanoApp } from '@nano-app/backend';
 import * as schema from './db/schema';
 
-createNanoApp({ database: { schema } });
+createNanoApp({ database: { relations: defineRelations(schema) } });
 ```
 
 ```ts
@@ -150,9 +153,10 @@ export default createRoute({
 });
 ```
 
-- `database.schema` is the module of your tables: every export that is a table, and `relations` (from `defineRelations`) when you relate them. A `pgSchema` the tables use is exported too, so drizzle-kit creates it.
-- `database.push: true` applies the schema at startup with drizzle-kit's push (`pnpm add drizzle-kit`), only to the Postgres schemas of its tables. A change that would lose data stops the startup.
-- `database.migrations` is the folder `drizzle-kit generate` writes: its pending migrations are applied at startup.
+- `database.relations` is what `defineRelations` gives of your tables, with their relations when you relate them. A `pgSchema` the tables use is exported from the module too, so drizzle-kit creates it. The rest of `database` goes to Drizzle as its options.
+- `database.push: true` applies the tables at startup with drizzle-kit's push (`pnpm add drizzle-kit`), only to the Postgres schemas they use. A change that would lose data stops the startup.
+- `database.migrate` is the folder `drizzle-kit generate` writes: its pending migrations are applied at startup. With both, the migrations run first, then the push.
+- One startup at a time changes the database: a Postgres lock covers the migrations and the push of every database, across replicas.
 - One pool serves the app, Better Auth and every plugin with a database. It connects on its first query: a missing table fails that query, not the startup.
 - Startup fails if `DATABASE_URL` is missing.
 - Each `nano_*` Postgres schema is reserved for the plugin of its name (`nano_auth` for Better Auth): a table of yours in one fails the startup.
@@ -175,13 +179,13 @@ createNanoApp({ auth: { emailAndPassword: { enabled: true } } });
 ```
 
 - It uses the pool of `DATABASE_URL`, with or without a database of the app: startup fails if it is missing.
-- Its tables live in the Postgres schema `nano_auth`. nano-app creates them at startup with Better Auth's migrations, and adds what new options need; it never drops anything.
+- Its tables live in the Postgres schema `nano_auth`, and Better Auth decides them from its options (plugins, `user.additionalFields`).
+- `auth.database` says how they are applied at startup, `{ push: true }` by default: `push` creates them with Better Auth's migrations and adds what new options need, never dropping anything; `migrate` is a folder of Drizzle migrations of them (`npx auth generate --adapter drizzle`, then `drizzle-kit generate`), applied in `nano_auth`.
 - Its endpoints are mounted before your routes, at its `basePath` (default `/api/auth`), and stay public.
 - In production, Better Auth limits sign-in, sign-up and password reset to a few attempts per client IP (its `rateLimit`): see [Client IP](#client-ip).
 - With it on, every route of the app and of every plugin needs a session: without one it answers 401 `Not authenticated`.
 - `createRoute({ public: true, ... })` answers without a session. An unknown path answers 404.
 - Handlers and `onBefore` receive the session in `params.session` (`{ user, session }`), also on a public route when the request has one.
-- The middlewares a plugin adds with `app.use` in `onMount` are not checked: a plugin that exposes something public says it in its README.
 - Sign-up works as Better Auth sets it: with `emailAndPassword` anyone can sign up and reach your routes. Close it with `disableSignUp: true`, or check roles in your handlers.
 - Extra user fields go in its `user.additionalFields`.
 - Set `BETTER_AUTH_SECRET` and `BETTER_AUTH_URL` in the environment, as Better Auth asks.
@@ -199,9 +203,9 @@ export default createRoute({
 });
 ```
 
-A method may ask for its own permissions instead of the route's: `POST: { handler, permissions: { notes: ['create'] } }`. A plain function takes those of the route. Without any, a session is enough. In a handler of your own, `isGranted(params, permissions)` asks Better Auth the same.
+A method may ask for its own permissions instead of the route's: `POST: { handler, permissions: { notes: ['create'] } }`. A plain function takes those of the route. Without any, a session is enough. In a handler of your own, `isGranted(params.session, permissions)` asks Better Auth the same.
 
-A public route does not check them. Without Better Auth the route answers anyway, with a warning at startup. Handlers and callbacks receive Better Auth's instance as `auth`, next to `db`; these params are read-only.
+A public route does not check them. Without Better Auth nothing checks them: the route answers anyway, so turn on `auth` before you rely on them. The params of handlers and callbacks are read-only.
 
 ## Plugins
 
@@ -213,9 +217,9 @@ import { createPlugin } from '@nano-app/backend';
 import { dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
-export default createPlugin((options?: { basePath?: string }) => ({
+export default createPlugin(() => ({
   name: 'hello',
-  basePath: options?.basePath ?? '/hello',
+  basePath: '/hello',
   routesDir: resolve(dirname(fileURLToPath(import.meta.url)), 'routes'),
 }));
 ```
@@ -237,36 +241,31 @@ import hello from './plugins/hello';
 createNanoApp({ plugins: { before: [hello()] } });
 ```
 
-`createPlugin` types the options of that plugin. Each plugin chooses its base path; the app chooses whether it mounts `before` or `after` its routes. What the plugin puts in `options` reaches every callback and handler of its routes in `params`.
+A plugin may also make routes in code with `routes`, by path, beside or instead of `routesDir`: they are checked as the files, and a path in both takes the one in `routes`. Useful when its routes come from its options, as one per table with its own permissions:
+
+```ts
+routes: Object.fromEntries(
+  models.map(sModel => [`/${sModel}`, createRoute({ GET: { handler, permissions: { [sModel]: ['read'] } } })]),
+),
+```
+
+`createPlugin` types the options of that plugin, and adds `basePath` to them: each plugin chooses its default, and the app moves it with `hello({ basePath: '/hi' })`. The app also chooses whether it mounts `before` or `after` its routes: a route of a `before` plugin takes its path from the app's routes, and an `after` plugin only gets what they leave. What the plugin puts in `options` reaches every callback and handler of its routes in `params`.
 
 ### Callbacks
 
-Two levels. Only the plugin's receives the Express app, so nothing app-wide depends on the order of the route files.
+Two levels: the plugin's runs once for the whole plugin, the endpoint's for its route.
 
 | Level | Callback | Runs | Receives | Use |
 |---|---|---|---|---|
-| Plugin (`callbacks` in its config) | `onMount` | Once, after its database and before its endpoints | `(app, params)` | App-level middlewares (a guard), shared setup |
+| Plugin (`callbacks` in its config) | `onMount` | Once, after its database and before its endpoints | `(params)` | Shared setup (a client, a job) |
 | Endpoint (`callbacks` in `createRoute`) | `onInit` | Once, when the endpoint is mounted | `(params)` | Setup of that route |
 | Endpoint | `onBefore` | Before every request the endpoint handles | `(req, method, params)` | Validate or load; its return value reaches the handler as `params.onBeforeResult` (`{}` without `onBefore`) |
 
-```ts
-export default createPlugin((options?: { publicPaths?: string[] }) => ({
-  name: 'guard',
-  routesDir: resolve(dirname(fileURLToPath(import.meta.url)), 'routes'),
-  options: { publicPaths: options?.publicPaths ?? [] },
-  callbacks: {
-    onMount: async (app, { publicPaths }) => {
-      app.use((req, _res, next) => next(publicPaths.includes(req.path) ? undefined : { status: 401, message: 'Unauthorized' }));
-    },
-  },
-}));
-```
-
 The endpoints of one plugin have no guaranteed order: one route's `onInit` must not depend on another's.
 
 Everything is mounted on one Express application, in this order: base middlewares → Better Auth → `before` plugins → your routes → `after` plugins → 404 → error handler.
 
-A plugin with a database passes its own `database` (`schema`, `push`, `migrations`, as the app's). Only it may keep tables in the Postgres schema `nano_<its name>`: a table in the `nano_*` schema of another fails the startup. Without a database of its own, a plugin receives the app's `db`. See [`@nano-app/plugins`](https://github.com/Nano-Nathan/nano-app/blob/main/plugins/README.md#database).
+A plugin with a database passes its own `database` (`relations`, `push`, `migrate`, as the app's). Only it may keep tables in the Postgres schema `nano_<its name>`: a table in the `nano_*` schema of another fails the startup. Without a database of its own, a plugin receives the app's `db`. See [`@nano-app/plugins`](https://github.com/Nano-Nathan/nano-app/blob/main/plugins/README.md#database).
 
 ## Errors
 

package/build/index.d.ts

@@ -1,9 +1,12 @@
-import express, { Express, Request, Request as Request$1 } from "express";
-import { CorsOptions } from "cors";
-import "dotenv/config";
-import "jiti";
 import { z } from "zod";
+import express, { Express, Request, Request as Request$1, RequestHandler } from "express";
+import "dotenv/config";
+import { CorsOptions } from "cors";
 import { BetterAuthOptions } from "better-auth";
+import { AnyRelations } from "drizzle-orm";
+import { DrizzlePgConfig } from "drizzle-orm/pg-core";
+/** Generic object */
+type NanoObject<T = any> = Record<string, T>;
 /** API response */
 type ApiResponse<T = any> = {
   status?: number;
@@ -26,10 +29,34 @@ type QueryParams = {
   limit?: number;
   offset?: number;
 };
+/** Error of the framework, with the status a handler answers */
+declare class NanoError extends Error {
+  status?: number;
+  /** Error with its message, and the status a handler answers (500 without one) */
+  constructor(sMessage: string, iStatus?: number);
+  /** Prefix of the framework's messages, shown before the message */
+  get name(): string;
+}
+/** What every database has, whatever its client */
+type DatabaseOptions = {
+  /** Folder of its migrations, applied at startup */
+  migrate?: string;
+  /** Applies its tables at startup as they are declared, failing on data loss; not with `migrate` */
+  push?: boolean;
+};
+/** Drizzle's options for its client: its tables and how they relate, from `defineRelations` */
+type DrizzleConfig = DrizzlePgConfig<AnyRelations> & {
+  relations: AnyRelations;
+};
+/** Database of a plugin or of the app: the options of its client and what every database has */
+type DatabaseConfig = DatabaseOptions & DrizzleConfig;
+/** Better Auth options; `database` says how its tables are applied, `push` by default */
+type AuthOptions = Omit<BetterAuthOptions, 'database'> & {
+  /** How its tables are applied at startup: `migrate` or `push`. Defaults to `{ push: true }` */
+  database?: DatabaseOptions;
+};
 /** Extra params of handlers and callbacks: what the app injects (options, `db`) and the framework adds */
 type Params<Deps = NanoObject<any>> = Deps & {
-  /** Better Auth's instance, when it is on */
-  auth?: NanoObject;
   /** `{ user, session }` of Better Auth, when the request has one */
   session?: NanoObject;
 };
@@ -57,8 +84,8 @@ type Handlers<Deps = NanoObject<any>> = {
 type Callback<Deps> = (params: Params<Deps>) => Promise<void>;
 /** Callback run before a method, with its request */
 type CallbackMethod<Deps> = (req: Request$1, method: string, params: Params<Deps>) => Promise<NanoObject>;
-/** Callback run with the Express app */
-type CallbackMount<Deps> = (app: Express, params: Params<Deps>) => Promise<void>;
+/** Callback run once with the params */
+type CallbackMount<Deps> = (params: Params<Deps>) => Promise<void>;
 /** Callbacks of an endpoint; what affects the whole app goes in the plugin's onMount */
 type Callbacks<Deps = NanoObject<any>> = {
   /** Run once, when the endpoint is mounted */
@@ -68,46 +95,32 @@ type Callbacks<Deps = NanoObject<any>> = {
 };
 /** Callbacks of a plugin */
 type PluginCallbacks<Deps = NanoObject<any>> = {
-  /** Run once with the Express app, after its database and before its endpoints (e.g. app-level middlewares) */
+  /** Run once, after its database and before its endpoints: the plugin's setup */
   onMount?: CallbackMount<Deps>;
 };
-/** Entry of a route file (`*.route.ts`) */
-type RouteEntry<Deps = NanoObject<any>> = {
-  /** Express route expression appended to the path (e.g. `/:id`) */
-  expression?: string;
+/** Endpoint params */
+type EndpointParams<Deps = NanoObject<any>> = {
   /** With Better Auth on, answers without a session; the handlers still receive it when there is one */
   public?: boolean;
   /** With Better Auth on, the permissions of its admin plugin the user needs (`{ notes: ['read'] }`) */
   permissions?: NanoObject<string[]>;
   callbacks?: Callbacks<Deps>;
 } & Handlers<Deps>;
-/** Generic object */
-type NanoObject<T = any> = Record<string, T>;
-/** Better Auth options, without `database`: it uses the app's Drizzle client */
-type AuthOptions = Omit<BetterAuthOptions, 'database'>;
-/** Error of the framework, with the status a handler answers */
-declare class NanoError extends Error {
-  status?: number;
-  /** Error with its message, and the status a handler answers (500 without one) */
-  constructor(sMessage: string, iStatus?: number);
-  /** Prefix of the framework's messages, shown before the message */
-  get name(): string;
-}
-/** Database of a plugin or of the app */
-type DatabaseConfig = {
-  /** Its Drizzle schema: the module of its tables and `relations` */
-  schema: NanoObject;
-  /** Applies the schema at startup with drizzle-kit's push, failing on data loss. Defaults to false */
-  push?: boolean;
-  /** Folder of the migrations `drizzle-kit generate` writes, applied at startup */
-  migrations?: string;
+/** Route params */
+type RouteParams = {
+  /** Express route expression appended to the path (e.g. `/:id`) */
+  expression?: string;
 };
+/** Entry of a route file (`*.route.ts`) */
+type RouteEntry<Deps = NanoObject<any>> = RouteParams & EndpointParams<Deps>;
 /** Plugin configuration: a group of endpoints */
 type PluginConfig<Options = NanoObject> = {
   /** Name of the plugin, also the name of its database when it has one */
   name: string;
   /** Directory used to discover the `*.route.ts` files */
-  routesDir: string;
+  routesDir?: string;
+  /** Routes made in code, by path (`{ '/notes': createRoute({...}) }`), validated as the files */
+  routes?: NanoObject<RouteEntry<any>>;
   /** Base path prepended to every endpoint, e.g. "/auth" (no trailing slash). Defaults to none */
   basePath?: string;
   /** Drizzle schema of the plugin's database, mounted before its endpoints */
@@ -117,6 +130,11 @@ type PluginConfig<Options = NanoObject> = {
   /** Plugin callbacks */
   callbacks?: PluginCallbacks;
 };
+/** Options every plugin takes, besides its own */
+type PluginOptions = {
+  /** Base path of its endpoints, over the plugin's default */
+  basePath?: string;
+};
 /** What PluginManager reads: the app's plugin and the ones around it */
 type PluginManagerConfig = {
   /** Folder of the app's routes. Defaults to "src/routes" */
@@ -131,6 +149,15 @@ type PluginManagerConfig = {
     after?: PluginConfig[];
   };
 };
+/** Rate limit per client IP: a bucket of tokens per client, refilled over time */
+type RateLimitConfig = {
+  /** Tokens of a full bucket. Defaults to 100 */
+  capacity?: number;
+  /** Tokens refilled per second. Defaults to 1 */
+  refillPerSecond?: number;
+  /** Message of the 429 */
+  message?: string;
+};
 /** Configuration of the framework's built-in packages */
 type PackagesConfig = {
   /** Morgan configuration */
@@ -142,6 +169,8 @@ type PackagesConfig = {
   };
   /** CORS configuration */
   cors?: CorsOptions | false;
+  /** Rate limit per client IP, off by default; it covers every request, Better Auth's too */
+  rateLimit?: RateLimitConfig | false;
   /** Helmet configuration */
   helmet?: boolean;
   /** Compression configuration */
@@ -164,8 +193,28 @@ type ServerConfig = {
   /** Better Auth options: with them, every route needs a session unless it is `public` */
   auth?: AuthOptions;
 };
+/** A route NanoApp registers */
+type Mount = {
+  /** Express path of the route */
+  path: string;
+  /** Its handler */
+  handler: RequestHandler;
+};
 /** Application configuration: the server and its plugins */
 type NanoAppConfig = ServerConfig & PluginManagerConfig;
+/** Better Auth of the app: its tables in `nano_auth`, its endpoints and the access of each request */
+declare abstract class Auth {
+  private static oAuth?;
+  private static fnHeaders?;
+  /** Mounts its database and creates the instance; its endpoints, none without options */
+  static init(oOptions?: AuthOptions): Promise<Mount[]>;
+  /** The session of a request; 401 without one unless public, 403 without the permissions */
+  static guard(oReq: Request$1, isPublic: boolean, oPermissions?: NanoObject<string[]>): Promise<NanoObject | undefined>;
+  /** The session of a request, when it has one */
+  private static session;
+  /** Whether the user of a session has the permissions; always without Better Auth or permissions */
+  static isGranted(oSession?: NanoObject, oPermissions?: NanoObject<string[]>): Promise<boolean>;
+}
 /** Main NanoApp class */
 declare class NanoApp {
   protected oApp: Express;
@@ -175,8 +224,6 @@ declare class NanoApp {
   private start;
   /** Initializes the application in the right order */
   private initialize;
-  /** Adds the packages according to the configuration */
-  private setPackages;
 }
 /** Creates a new NanoApp instance */
 export declare function createNanoApp(oConfig?: NanoAppConfig): NanoApp;
@@ -184,9 +231,9 @@ export declare function createNanoApp(oConfig?: NanoAppConfig): NanoApp;
 export declare function createRoute<Deps = NanoObject<any>>(oRoute: RouteEntry<Deps>): RouteEntry<Deps>;
 /** Creates a plugin: a function of the plugin's own options that returns its configuration. */
 type Creator<Options> = (options?: Options) => PluginConfig<Options>;
-export declare function createPlugin<Options>(fnCreator: Creator<Options>): Creator<Options>;
+export declare function createPlugin<Options extends NanoObject = NanoObject>(fnCreator: Creator<Options>): (options?: Options & PluginOptions) => PluginConfig<Options>;
 /** Creates the callbacks of a plugin, typed with what it injects in its params. */
 export declare function createPluginCallbacks<Deps = NanoObject<any>>(oCallbacks: PluginCallbacks<Deps>): PluginCallbacks<Deps>;
-/** Whether the session's user has the permissions; always without Better Auth or permissions */
-declare function isGranted({ auth, session }: Params, oPermissions?: NanoObject<string[]>): Promise<boolean>;
-export { type ApiPromise, type ApiResponse, type Callbacks, type DatabaseConfig, type Handler, type HandlerParams, type Handlers, type MethodEntry, NanoApp, type NanoAppConfig, NanoError, type NanoObject, type PackagesConfig, type Params, type PluginCallbacks, type PluginConfig, type PluginManagerConfig, type QueryParams, type Request, type RouteEntry, type ServerConfig, isGranted };
+/** Whether the user of a session has the permissions, asked to Better Auth */
+export declare const isGranted: typeof Auth.isGranted;
+export { type ApiPromise, type ApiResponse, type Callbacks, type DatabaseConfig, type Handler, type HandlerParams, type Handlers, type MethodEntry, NanoApp, type NanoAppConfig, NanoError, type NanoObject, type PackagesConfig, type Params, type PluginCallbacks, type PluginConfig, type PluginManagerConfig, type PluginOptions, type QueryParams, type Request, type RouteEntry, type ServerConfig };

package/build/index.js

@@ -1,14 +1,15 @@
-import express from "express";
-import morgan from "morgan";
-import cors from "cors";
-import helmet from "helmet";
-import compression from "compression";
-import "dotenv/config";
 import { glob } from "glob";
 import { isAbsolute, resolve } from "node:path";
 import { existsSync } from "node:fs";
 import { createJiti } from "jiti";
 import { z } from "zod";
+import express from "express";
+import "dotenv/config";
+import morgan from "morgan";
+import cors from "cors";
+import helmet from "helmet";
+import compression from "compression";
+import { ipKeyGenerator } from "express-rate-limit";
 // ../core/utils/NanoError.ts
 /** Error of the framework, with the status a handler answers */
 var NanoError = class extends Error {
@@ -39,11 +40,21 @@ var FileReader = class {
 		return sAbsolutePath;
 	}
 };
+// ../core/utils/Validator.ts
+/** Checks the consumer's files; an invalid file throws a `NanoError` */
+var Validator = class {
+	/** Checks a file with a schema: an invalid one throws with its key */
+	static validate(oSchema, oFile, sKey) {
+		const oResult = oSchema.safeParse(oFile);
+		if (!oResult.success) throw new NanoError(`${sKey}:\n${z.prettifyError(oResult.error)}`);
+		return oResult.data;
+	}
+};
 // ../core/files/FileLoader.ts
 /** Finds and loads the consumer's files */
 var FileLoader = class {
-	/** Finds the `*.<extension>.ts` files of a folder: `{ [subPath]: defaultExport }` */
-	static async findMany(sExtension, sSourceDir) {
+	/** The `*.<extension>.ts` files of a folder by subpath, checked with a schema */
+	static async findMany(sExtension, oSchema, sSourceDir) {
 		const sSrcDir = (sSourceDir ?? `src/${sExtension}s`).replace(/^\.\//, "").replace(/\/$/, "");
 		const aFilePaths = await glob(`${sSrcDir}/**/*.${sExtension}.{ts,js}`, {
 			posix: true,
@@ -51,29 +62,13 @@ var FileLoader = class {
 		});
 		const oEntries = {};
 		for (const sFilePath of aFilePaths) {
-			const sFileSubPath = sFilePath.slice(sSrcDir.length).replace(new RegExp(`\\.${sExtension}\\.(ts|js)$`), "");
-			const sKey = sExtension === "store" ? sFileSubPath.slice(1).replaceAll("/", "_") : sFileSubPath;
-			oEntries[sKey] = await FileReader.loadModule(sFilePath, { default: true });
+			const sKey = sFilePath.slice(sSrcDir.length).replace(new RegExp(`\\.${sExtension}\\.(ts|js)$`), "");
+			const oFile = await FileReader.loadModule(sFilePath, { default: true });
+			oEntries[sKey] = Validator.validate(oSchema, oFile, sKey);
 		}
 		return oEntries;
 	}
 };
-// ../core/utils/Validator.ts
-/** Checks values of the framework and the consumer's files; an invalid file throws a `NanoError` */
-var Validator = class {
-	/** Whether a value is a plain object */
-	static isObject(oValue) {
-		return Object.prototype.toString.call(oValue) === "[object Object]";
-	}
-	/** Checks every entry with a zod schema (`ROUTE`, `STORE`): the first invalid one throws with its key */
-	static validate(oEntries, oSchema) {
-		return Object.fromEntries(Object.entries(oEntries).map(([sKey, oEntry]) => {
-			const oResult = oSchema.safeParse(oEntry);
-			if (!oResult.success) throw new NanoError(`${sKey}:\n${z.prettifyError(oResult.error)}`);
-			return [sKey, oResult.data];
-		}));
-	}
-};
 // ../core/utils/Logger.ts
 /** Messages of the framework on the console */
 var Logger = class Logger {
@@ -98,17 +93,7 @@ var Logger = class Logger {
 		return oDate.toISOString().slice(0, 19).replace("T", " ");
 	}
 };
-// ../core/utils/Paths.ts
-/** Paths of the app's pages */
-var Paths = class {
-	/** Whether a path matches a pattern: exact (`/admin`), or the path and all below it (`/admin/*`) */
-	static matches(sPattern, sPath) {
-		if (!sPattern.endsWith("/*")) return sPattern === sPath;
-		const sBase = sPattern.slice(0, -2);
-		return sPath === sBase || sPath.startsWith(`${sBase}/`);
-	}
-};
-// ../core/const.ts
+// src/const.ts
 /** Loopback and private networks: the proxies the backend trusts by default */
 const PRIVATE_NETWORKS = [
 	"127.0.0.0/8",
@@ -118,179 +103,263 @@ const PRIVATE_NETWORKS = [
 	"192.168.0.0/16",
 	"fc00::/7"
 ];
-// ../core/utils/validations.ts
-/** A function of the consumer, typed as what the framework calls */
-function callable() {
-	return z.custom((oValue) => typeof oValue === "function");
-}
-/** Permissions of Better Auth's admin plugin: the actions per resource */
-const PERMISSIONS = z.record(z.string(), z.array(z.string())).optional();
-/** A method of a route: its handler, or it with its own permissions */
-const METHOD = z.union([callable(), z.object({
-	handler: callable(),
-	permissions: PERMISSIONS
-})]).optional();
-/** A `*.route.ts` file: its options, its callbacks and at least one HTTP method, nothing else */
-const ROUTE = z.strictObject({
-	expression: z.string().optional(),
-	public: z.boolean().optional(),
-	permissions: PERMISSIONS,
-	callbacks: z.object({
-		onInit: callable().optional(),
-		onBefore: callable().optional()
-	}).optional(),
-	GET: METHOD,
-	POST: METHOD,
-	PUT: METHOD,
-	DELETE: METHOD,
-	QUERY: METHOD
-}).refine(({ GET, POST, PUT, DELETE, QUERY }) => GET ?? POST ?? PUT ?? DELETE ?? QUERY, { error: "It defines no HTTP method" });
-/** A path of the app, starting with `/` */
-const PATH = z.string().startsWith("/");
-z.object({
-	type: z.enum(["app", "api"]),
-	data: z.record(z.string(), z.any()).optional(),
-	headers: z.record(z.string(), z.string()).optional(),
-	auth: z.object({
-		path: z.string(),
-		routes: z.array(z.object({
-			match: PATH,
-			redirect: PATH.optional(),
-			roles: z.string().optional(),
-			permissions: z.record(z.string(), z.string()).optional()
-		}).refine(({ match, redirect }) => !Paths.matches(match, redirect ?? "/"), { error: "Its \"redirect\" must be outside its \"match\"" })).optional()
-	}).optional()
-});
+/** Express settings: the client IP comes from `X-Forwarded-For` only through private proxies */
+const SETTINGS = { "trust proxy": PRIVATE_NETWORKS };
+/** Base middlewares */
+const PACKAGES = {
+	morgan: {
+		tokens: {
+			timestamp: () => Logger.date(),
+			path: (oReq) => oReq.path
+		},
+		format: ":timestamp | :method :path :status"
+	},
+	cors: { methods: [
+		"GET",
+		"HEAD",
+		"PUT",
+		"POST",
+		"DELETE",
+		"QUERY"
+	] },
+	helmet: true,
+	compression: false,
+	express: { limit: "10kb" },
+	urlencoded: { extended: false }
+};
+/** Key of the Postgres lock that lets one startup change the database at a time */
+const LOCK = 7310002;
+/** Name of Better Auth's database: its tables live in `nano_auth` */
+const AUTH_NAME = "auth";
+/** Marks of the dynamic segments of a path, from the least to the most generic */
+const MARKS = [
+	":",
+	"{",
+	"*"
+];
 // src/database/DatabaseManager.ts
-/** The databases of the app and its plugins: one Drizzle client per name on the pool of `DATABASE_URL` */
+/** The databases of the app and its plugins: the pool of `DATABASE_URL`, its lock and one client per config */
 var DatabaseManager = class {
 	static oPool;
-	static oClients = {};
-	/** The Drizzle client of a database, created on the first call; without a config, the app's */
-	static async mount(sName, oConfig) {
-		if (!oConfig) return this.oClients["app"];
-		this.oClients[sName] ??= this.create(sName, oConfig);
-		return this.oClients[sName];
-	}
-	/** Creates a client: the `nano_*` rule of its tables, then its push and its migrations */
-	static async create(sName, oConfig) {
-		const { schema, push, migrations } = oConfig;
-		const { defineRelations, is } = await import("drizzle-orm");
-		const { getTableConfig, PgTable } = await import("drizzle-orm/pg-core");
-		const { drizzle } = await import("drizzle-orm/node-postgres");
-		const sOwn = sName === "app" ? void 0 : `nano_${sName}`;
-		const aSchemas = Object.values(schema).filter((oValue) => is(oValue, PgTable)).map((oTable) => {
-			const { name, schema: sSchema = "public" } = getTableConfig(oTable);
-			if (sSchema.startsWith("nano_") && sSchema !== sOwn) throw new NanoError(`The database "${sName}": table "${sSchema}.${name}" breaks the rule, each nano_* schema is reserved for the plugin of its name.`);
-			return sSchema;
-		});
-		const oClient = drizzle({
-			client: await this.pool(),
-			relations: schema.relations ?? defineRelations(schema)
-		});
-		if (push && aSchemas.length) {
-			const { pushSchema } = await import("drizzle-kit/api-postgres");
-			const { hints, apply } = await pushSchema(schema, oClient, {
-				schemas: aSchemas,
-				tables: void 0,
-				entities: void 0,
-				extensions: void 0
-			});
-			if (hints.length) throw new NanoError(`The database "${sName}" cannot be pushed without losing data: ${hints.map((oHint) => oHint.hint).join("; ")}. Run \`pnpm drizzle-kit push\` by hand.`);
-			await apply();
-		}
-		if (migrations) {
-			const { migrate } = await import("drizzle-orm/node-postgres/migrator");
-			await migrate(oClient, { migrationsFolder: migrations });
-		}
-		Logger.info(`Database "${sName}" mounted`);
-		return oClient;
-	}
-	/** The pool of `DATABASE_URL`, shared by every client and Better Auth, created on the first call */
-	static pool() {
-		this.oPool ??= this.createPool();
-		return this.oPool;
-	}
-	/** Creates the pool of `DATABASE_URL` */
-	static async createPool() {
+	static oClients = /* @__PURE__ */ new Map();
+	/** Mounts a database once, whatever its client, and gives its client; undefined without one */
+	static async mount(oDB) {
+		if (!oDB) return void 0;
+		return this.getClient(oDB);
+	}
+	/** The pool of `DATABASE_URL`, shared by every client, created on the first call */
+	static async pool() {
 		const sUrl = process.env.DATABASE_URL;
 		if (!sUrl) throw new NanoError("The DATABASE_URL environment variable is not defined.");
 		const { Pool } = await import("pg");
-		return new Pool({ connectionString: sUrl });
+		this.oPool ??= new Pool({ connectionString: sUrl });
+		return this.oPool;
+	}
+	/** Creates the client of a database on the shared pool, with the lock for its changes */
+	static async getClient(oDB) {
+		const { sName, oConfig } = oDB;
+		const oClient = this.oClients.get(oConfig);
+		if (oClient !== void 0) return oClient;
+		await this.pool();
+		await oDB.checkTables();
+		const oDBClient = await oDB.connect(this.oPool);
+		const oConnection = await this.oPool.connect();
+		await oConnection.query("SELECT pg_advisory_lock($1)", [LOCK]);
+		const { migrate, push } = oConfig;
+		if (migrate) await oDB.migrate(migrate);
+		if (push) await oDB.push();
+		oConnection.release(true);
+		Logger.info(`Database "${sName}" mounted`);
+		this.oClients.set(oConfig, oDBClient);
+		return oDBClient;
 	}
 };
-// src/auth/BetterAuth.ts
-/** Postgres schema of Better Auth's tables */
-const SCHEMA = "nano_auth";
-/** Key of the Postgres lock that lets one startup migrate at a time */
-const MIGRATION_LOCK = 7310002;
-/** Better Auth of the app: its tables in `nano_auth`, its endpoints and the session of a request */
-var BetterAuth = class {
-	static oAuth;
-	static fnHeaders;
-	/** Better Auth's instance, once mounted */
-	static instance() {
-		return this.oAuth;
+// src/database/clients/DatabaseClient.ts
+/** A database the manager mounts, whatever its client: its tables, its client and its changes */
+var DatabaseClient = class {
+	sName;
+	oConfig;
+	/** Its nano_* schema, reserved for its plugin; the app has none */
+	sSchema;
+	/** Creates a new client of a database, named as its plugin */
+	constructor(sName, oConfig) {
+		this.sName = sName;
+		this.oConfig = oConfig;
+		this.sSchema = sName === "app" ? void 0 : `nano_${sName}`;
 	}
-	/** The session of a request, when it has one */
-	static async session(oReq) {
-		if (!this.oAuth || !this.fnHeaders) return void 0;
-		const oHeaders = this.fnHeaders(oReq.headers);
-		return await this.oAuth.api.getSession({ headers: oHeaders }) ?? void 0;
+	/** Checks its tables: a nano_* schema only for the plugin of its name */
+	async checkTables() {
+		for (const { schema, name } of await this.tables()) if (schema.startsWith("nano_") && schema !== this.sSchema) throw new NanoError(`The database "${this.sName}": table "${schema}.${name}" breaks the rule, each nano_* schema is reserved for the plugin of its name.`);
 	}
-	/** Migrates its tables, creates the instance and mounts its endpoints; off without options */
-	static async mount(oApp, oOptions) {
-		if (!oOptions) return;
-		const { betterAuth } = await import("better-auth");
+};
+// src/database/clients/BetterAuth.ts
+/** Better Auth's tables, as its options declare them, in its nano_* schema on its Kysely adapter */
+var BetterAuth = class extends DatabaseClient {
+	oOptions;
+	oPool;
+	oDatabase;
+	/** Creates the database of Better Auth from its options */
+	constructor(sName, oConfig, oOptions) {
+		super(sName, oConfig);
+		this.oOptions = oOptions;
+	}
+	/** Its tables, from the options: the base ones, its plugins' and the additional fields */
+	async tables() {
+		const { getSchema } = await import("better-auth/db");
+		const sSchema = this.sSchema ?? "public";
+		return Object.keys(getSchema(this.oOptions)).map((name) => ({
+			schema: sSchema,
+			name
+		}));
+	}
+	/** Better Auth's `database` option on the shared pool, its tables in its nano_* schema */
+	async connect(oPool) {
+		const { PostgresDialect } = await import("kysely");
+		this.oPool = oPool;
+		this.oDatabase = {
+			dialect: new PostgresDialect({ pool: oPool }),
+			type: "postgres",
+			schemaName: this.sSchema
+		};
+		return this.oDatabase;
+	}
+	/** Applies the pending migrations of a folder, generated from `npx auth generate --adapter drizzle` */
+	async migrate(sFolder) {
+		const { drizzle } = await import("drizzle-orm/node-postgres");
+		const { migrate } = await import("drizzle-orm/node-postgres/migrator");
+		await migrate(drizzle({ client: this.oPool }), {
+			migrationsFolder: sFolder,
+			migrationsSchema: this.sSchema
+		});
+	}
+	/** Creates the tables and columns its options need; it only adds */
+	async push() {
 		const { getMigrations } = await import("better-auth/db/migration");
+		const { runMigrations } = await getMigrations({
+			...this.oOptions,
+			database: this.oDatabase
+		});
+		await runMigrations();
+	}
+};
+// src/auth/Auth.ts
+/** Better Auth of the app: its tables in `nano_auth`, its endpoints and the access of each request */
+var Auth = class {
+	static oAuth;
+	static fnHeaders;
+	/** Mounts its database and creates the instance; its endpoints, none without options */
+	static async init(oOptions) {
+		if (!oOptions) return [];
+		const { betterAuth } = await import("better-auth");
 		const { fromNodeHeaders, toNodeHandler } = await import("better-auth/node");
-		const { PostgresDialect } = await import("kysely");
-		const oPool = await DatabaseManager.pool();
-		const { advanced, basePath = "/api/auth" } = oOptions;
+		const { database = { push: true }, advanced, basePath = "/api/auth", ...oRest } = oOptions;
 		const oFullOptions = {
-			...oOptions,
+			...oRest,
+			basePath,
 			advanced: {
 				...advanced,
 				ipAddress: {
 					trustedProxies: PRIVATE_NETWORKS,
 					...advanced?.ipAddress
 				}
-			},
-			database: {
-				dialect: new PostgresDialect({ pool: oPool }),
-				type: "postgres",
-				schemaName: SCHEMA
 			}
 		};
-		const oConnection = await oPool.connect();
-		await oConnection.query("SELECT pg_advisory_lock($1)", [MIGRATION_LOCK]);
-		await (await getMigrations(oFullOptions)).runMigrations();
-		oConnection.release(true);
-		const oAuth = betterAuth(oFullOptions);
+		const oDatabase = await DatabaseManager.mount(new BetterAuth(AUTH_NAME, database, oFullOptions));
+		const oAuth = betterAuth({
+			...oFullOptions,
+			database: oDatabase
+		});
 		this.oAuth = oAuth;
 		this.fnHeaders = fromNodeHeaders;
-		oApp.all(`${basePath}/{*path}`, toNodeHandler(oAuth));
+		return [{
+			path: `${basePath}/{*path}`,
+			handler: toNodeHandler(oAuth)
+		}];
+	}
+	/** The session of a request; 401 without one unless public, 403 without the permissions */
+	static async guard(oReq, isPublic, oPermissions) {
+		const oSession = await this.session(oReq);
+		if (this.oAuth && !oSession && !isPublic) throw new NanoError("Not authenticated", 401);
+		if (!await this.isGranted(oSession, isPublic ? void 0 : oPermissions)) throw new NanoError("Forbidden", 403);
+		return oSession;
+	}
+	/** The session of a request, when it has one */
+	static async session(oReq) {
+		if (!this.oAuth || !this.fnHeaders) return void 0;
+		const headers = this.fnHeaders(oReq.headers);
+		return await this.oAuth.api.getSession({ headers }) ?? void 0;
+	}
+	/** Whether the user of a session has the permissions; always without Better Auth or permissions */
+	static async isGranted(oSession, oPermissions) {
+		if (!this.oAuth || !oPermissions) return true;
+		const { success } = await this.oAuth.api.userHasPermission({ body: {
+			userId: oSession?.user.id,
+			role: oSession?.user.role,
+			permissions: oPermissions
+		} });
+		return success;
+	}
+};
+// src/database/clients/Drizzle.ts
+/** Drizzle client of the app or of a plugin: its tables, its client and its changes */
+var Drizzle = class extends DatabaseClient {
+	oClient;
+	/** The Postgres schema and name of each of its tables, from Drizzle's metadata */
+	async tables() {
+		const { is } = await import("drizzle-orm");
+		const { getTableConfig, PgTable } = await import("drizzle-orm/pg-core");
+		return Object.values(this.oConfig.relations).map(({ table }) => table).filter((oTable) => is(oTable, PgTable)).map((oTable) => {
+			const { name, schema = "public" } = getTableConfig(oTable);
+			return {
+				schema,
+				name
+			};
+		});
+	}
+	/** Creates its client on a pool */
+	async connect(oPool) {
+		const { migrate, push, ...oDrizzleConfig } = this.oConfig;
+		const { drizzle } = await import("drizzle-orm/node-postgres");
+		this.oClient = drizzle({
+			...oDrizzleConfig,
+			client: oPool
+		});
+		return this.oClient;
+	}
+	/** Applies the pending migrations of a folder, recorded in its own nano_* schema */
+	async migrate(sFolder) {
+		const { migrate } = await import("drizzle-orm/node-postgres/migrator");
+		await migrate(this.oClient, {
+			migrationsFolder: sFolder,
+			migrationsSchema: this.sSchema
+		});
+	}
+	/** Pushes its tables to their Postgres schemas, failing when it would lose data */
+	async push() {
+		const { pushSchema } = await import("drizzle-kit/api-postgres");
+		const oTables = Object.fromEntries(Object.values(this.oConfig.relations).map(({ name, table }) => [name, table]));
+		const schemas = (await this.tables()).map(({ schema }) => schema);
+		const { hints, apply } = await pushSchema(oTables, this.oClient, {
+			schemas,
+			tables: void 0,
+			entities: void 0,
+			extensions: void 0
+		});
+		if (hints.length) {
+			const sHints = hints.map((oHint) => oHint.hint).join("; ");
+			throw new NanoError(`The database "${this.sName}" cannot be pushed without losing data: ${sHints}. Run \`pnpm drizzle-kit push\` by hand.`);
+		}
+		await apply();
 	}
 };
-// src/auth/permissions.ts
-/** Whether the session's user has the permissions; always without Better Auth or permissions */
-async function isGranted({ auth, session }, oPermissions) {
-	if (!auth || !oPermissions) return true;
-	const { success } = await auth.api.userHasPermission({ body: {
-		userId: session?.user.id,
-		role: session?.user.role,
-		permissions: oPermissions
-	} });
-	return success;
-}
 // src/router/Endpoint.ts
-/** Base class for all endpoints */
+/** A route: its methods, its access and its callbacks */
 var Endpoint = class {
 	oMethods;
 	oCallbacks;
 	isPublic;
 	/** Allowed methods and the options of the route */
-	constructor(oMethods, { callbacks = {}, public: isPublic = false, permissions }) {
+	constructor({ callbacks = {}, public: isPublic = false, permissions, ...oMethods }) {
 		this.oMethods = Object.fromEntries(Object.entries(oMethods).map(([sMethod, oMethod]) => [sMethod, typeof oMethod === "function" ? {
 			handler: oMethod,
 			permissions
@@ -301,15 +370,9 @@ var Endpoint = class {
 		this.oCallbacks = callbacks;
 		this.isPublic = isPublic;
 	}
-	/** Handler for all methods */
-	async mount(oParams, sPath) {
-		const isUnchecked = Object.values(this.oMethods).some(({ permissions }) => permissions);
-		if (!oParams.auth && isUnchecked) Logger.warn(`${sPath}: its permissions are not checked without Better Auth. Set auth in createNanoApp.`);
+	/** Runs its onInit and gives its handler for all methods */
+	async init(oParams) {
 		await this.oCallbacks.onInit?.(oParams);
-		return this.createHandler(oParams);
-	}
-	/** Express handler: the request, answered as an ApiResponse */
-	createHandler(oParams) {
 		return (oReq, oRes) => this.run(oReq, oParams).then((oResponse) => {
 			const { status, ...oBody } = oResponse;
 			const iStatus = status ?? 200;
@@ -319,18 +382,16 @@ var Endpoint = class {
 			});
 		});
 	}
-	/** Checks the session and the permissions, then runs onBefore and the method */
+	/** Checks the session and the permissions of the method, then runs onBefore and it */
 	async run(oReq, oParams) {
-		const oSession = await BetterAuth.session(oReq);
-		const oRequestParams = {
-			...oParams,
-			session: oSession
-		};
-		if (oParams.auth && !oSession && !this.isPublic) throw new NanoError("Not authenticated", 401);
 		const sMethod = oReq.method;
 		const oMethod = this.oMethods[sMethod];
+		const session = await Auth.guard(oReq, this.isPublic, oMethod?.permissions);
 		if (!oMethod) throw new NanoError(`Method ${sMethod} not implemented`, 405);
-		if (!await isGranted(oRequestParams, this.isPublic ? void 0 : oMethod.permissions)) throw new NanoError("Forbidden", 403);
+		const oRequestParams = {
+			...oParams,
+			session
+		};
 		const onBeforeResult = await this.oCallbacks.onBefore?.(oReq, sMethod, oRequestParams) ?? {};
 		return oMethod.handler(oReq, {
 			...oRequestParams,
@@ -338,36 +399,56 @@ var Endpoint = class {
 		});
 	}
 };
+// src/router/validations.ts
+/** A function of the consumer, typed as what the framework calls */
+function callable() {
+	return z.custom((oValue) => typeof oValue === "function");
+}
+/** Permissions of Better Auth's admin plugin: the actions per resource */
+const PERMISSIONS = z.record(z.string(), z.array(z.string())).optional();
+/** A method of a route: its handler, or it with its own permissions */
+const METHOD = z.union([callable(), z.object({
+	handler: callable(),
+	permissions: PERMISSIONS
+})]).optional();
+/** A `*.route.ts` file: its options, its callbacks and at least one HTTP method, nothing else */
+const ROUTE = z.strictObject({
+	expression: z.string().optional(),
+	public: z.boolean().optional(),
+	permissions: PERMISSIONS,
+	callbacks: z.object({
+		onInit: callable().optional(),
+		onBefore: callable().optional()
+	}).optional(),
+	GET: METHOD,
+	POST: METHOD,
+	PUT: METHOD,
+	DELETE: METHOD,
+	QUERY: METHOD
+}).refine(({ GET, POST, PUT, DELETE, QUERY }) => GET ?? POST ?? PUT ?? DELETE ?? QUERY, { error: "It defines no HTTP method" });
 // src/router/Router.ts
-/** Turns a folder of `*.route.ts` files into Express paths and endpoints */
-var Router = class {
+/** Turns a folder of `*.route.ts` files and routes made in code into Express paths and endpoints */
+var Router = class Router {
 	sRoutesDir;
 	sBasePath;
-	constructor(sRoutesDir, sBasePath) {
+	oRoutes;
+	constructor(sRoutesDir, sBasePath, oRoutes) {
 		this.sRoutesDir = sRoutesDir;
 		this.sBasePath = sBasePath ?? "";
+		this.oRoutes = oRoutes ?? {};
 	}
-	/** Loads the routes and creates one endpoint per file */
-	async mount() {
-		if (!this.sRoutesDir) return [];
-		const oFiles = await FileLoader.findMany("route", this.sRoutesDir);
-		const oRoutes = Validator.validate(oFiles, ROUTE);
-		return Object.entries(oRoutes).map(([sFilePath, { expression, callbacks, public: isPublic, permissions, ...methods }]) => {
-			const sPath = this.createPath(sFilePath, expression);
-			Logger.info(sPath);
-			return {
-				path: sPath,
-				endpoint: new Endpoint(methods, {
-					callbacks,
-					public: isPublic,
-					permissions
-				})
-			};
-		});
+	/** Loads the routes and creates one endpoint per route, the most specific path first */
+	async load() {
+		const oRoutes = this.sRoutesDir ? await FileLoader.findMany("route", ROUTE, this.sRoutesDir) : {};
+		for (const [sPath, oRoute] of Object.entries(this.oRoutes)) oRoutes[sPath] = Validator.validate(ROUTE, oRoute, sPath);
+		return Object.entries(oRoutes).map(([sFilePath, { expression = "", ...oEndpointParams }]) => ({
+			path: `${this.sBasePath}${sFilePath.replace(/\/index$/, "")}${expression}` || "/",
+			endpoint: new Endpoint(oEndpointParams)
+		})).sort((oA, oB) => Router.specificity(oA.path).localeCompare(Router.specificity(oB.path)));
 	}
-	/** `basePath` + file path (`/index` is the folder itself) + `expression`, as Express reads them */
-	createPath(sEndpoint, sExpression = "") {
-		return `${this.sBasePath}${sEndpoint.replace(/\/index$/, "")}${sExpression}` || "/";
+	/** One digit per segment: 0 static, 1 `:param`, 2 `{optional}`, 3 `*wildcard` */
+	static specificity(sPath) {
+		return sPath.split("/").map((sSegment) => MARKS.reduce((iRank, sMark, iIndex) => sSegment.includes(sMark) ? iIndex + 1 : iRank, 0)).join("");
 	}
 };
 // src/plugins/Plugin.ts
@@ -378,65 +459,43 @@ var Plugin = class {
 	constructor(oConfig) {
 		this.oConfig = oConfig;
 	}
-	/** Mounts its endpoints on express app */
-	async mount(oApp) {
-		const { name, routesDir, basePath, database, options, callbacks } = this.oConfig;
-		const oDb = await DatabaseManager.mount(name, database);
+	/** Its endpoints, the most specific path first, for NanoApp to register */
+	async build(oAppDB) {
+		const { name, routesDir, routes, basePath, database, options, callbacks } = this.oConfig;
+		const db = await DatabaseManager.mount(database ? new Drizzle(name, database) : oAppDB);
 		const oParams = Object.freeze({
 			...options,
-			db: oDb,
-			auth: BetterAuth.instance()
+			db
 		});
-		await callbacks?.onMount?.(oApp, oParams);
-		const oRouter = new Router(routesDir, basePath);
-		for (const { path, endpoint } of await oRouter.mount()) oApp.all(path, await endpoint.mount(oParams, path));
+		await callbacks?.onMount?.(oParams);
+		const aRoutes = await new Router(routesDir, basePath, routes).load();
+		return Promise.all(aRoutes.map(async ({ path, endpoint }) => ({
+			path,
+			handler: await endpoint.init(oParams)
+		})));
 	}
 };
 // src/plugins/PluginManager.ts
 /** The plugins of the app: its own, the ones before it and the ones after it */
 var PluginManager = class {
-	/** Mounts every plugin on express app, in order: before, the app's, after */
-	static async mount(oApp, oConfig) {
+	/** The endpoints of every plugin, in order: before, the app's, after */
+	static async build(oConfig) {
 		const { routesDir = "src/routes", database, plugins } = oConfig;
-		await DatabaseManager.mount("app", database);
-		const oAppPlugin = new Plugin({
-			name: "app",
-			routesDir,
-			database
-		});
-		const aBefore = (plugins?.before ?? []).map((oPlugin) => new Plugin(oPlugin));
-		const aAfter = (plugins?.after ?? []).map((oPlugin) => new Plugin(oPlugin));
-		for (const oPlugin of [
-			...aBefore,
-			oAppPlugin,
-			...aAfter
-		]) await oPlugin.mount(oApp);
+		const oAppDB = database && new Drizzle("app", database);
+		const { before = [], after = [] } = plugins ?? {};
+		const aPlugins = [
+			...before,
+			{
+				name: "app",
+				routesDir
+			},
+			...after
+		];
+		const aMounts = [];
+		for (const oPlugin of aPlugins) aMounts.push(...await new Plugin(oPlugin).build(oAppDB));
+		return aMounts;
 	}
 };
-/** Express settings: the client IP comes from `X-Forwarded-For` only through private proxies */
-const SETTINGS = { "trust proxy": PRIVATE_NETWORKS };
-/** Base middlewares */
-const PACKAGES = {
-	morgan: {
-		tokens: {
-			timestamp: () => Logger.date(),
-			path: (oReq) => oReq.path
-		},
-		format: ":timestamp | :method :path :status"
-	},
-	cors: { methods: [
-		"GET",
-		"HEAD",
-		"PUT",
-		"POST",
-		"DELETE",
-		"QUERY"
-	] },
-	helmet: true,
-	compression: false,
-	express: { limit: "10kb" },
-	urlencoded: { extended: false }
-};
 // src/app/handlers/errors.ts
 /** Turns every unmatched request into a 404 for the error handler */
 const notFoundHandler = (oReq, _oRes, fnNext) => {
@@ -454,6 +513,50 @@ const errorHandler = (oError, _oReq, oRes, _fnNext) => {
 		message: sMessage
 	});
 };
+// src/app/handlers/rateLimit.ts
+/** Rate limit per client IP: each request spends a token of the client's bucket, refilled over time */
+function rateLimit({ capacity = 100, refillPerSecond = 1, message = "Too many requests, please try again later." }) {
+	const fnRefill = (oBucket, iNow) => Math.min(capacity, oBucket.iTokens + (iNow - oBucket.iTime) / 1e3 * refillPerSecond);
+	const oBuckets = /* @__PURE__ */ new Map();
+	setInterval(() => {
+		const iNow = Date.now();
+		for (const [sIp, oBucket] of oBuckets) if (fnRefill(oBucket, iNow) >= capacity) oBuckets.delete(sIp);
+	}, 6e4).unref();
+	return (oReq, oRes, fnNext) => {
+		const sIp = ipKeyGenerator(oReq.ip ?? "");
+		const iNow = Date.now();
+		const iTokens = fnRefill(oBuckets.get(sIp) ?? {
+			iTokens: capacity,
+			iTime: iNow
+		}, iNow);
+		if (iTokens < 1) {
+			oRes.set("Retry-After", String(Math.ceil((1 - iTokens) / refillPerSecond)));
+			return fnNext({
+				status: 429,
+				message
+			});
+		}
+		oBuckets.set(sIp, {
+			iTokens: iTokens - 1,
+			iTime: iNow
+		});
+		fnNext();
+	};
+}
+// src/app/packages.ts
+/** The base middlewares that are on, in the order the app uses them */
+function packages(oConfig) {
+	if (oConfig.morgan) for (const [sKey, fnToken] of Object.entries(oConfig.morgan.tokens ?? {})) morgan.token(sKey, fnToken);
+	return [
+		oConfig.morgan && morgan(oConfig.morgan.format),
+		oConfig.cors && cors(oConfig.cors),
+		oConfig.helmet && helmet(),
+		oConfig.rateLimit && rateLimit(oConfig.rateLimit),
+		oConfig.compression && compression(),
+		oConfig.express && express.json(oConfig.express),
+		oConfig.urlencoded && express.urlencoded(oConfig.urlencoded)
+	].filter((fnPackage) => typeof fnPackage === "function");
+}
 // src/app/NanoApp.ts
 /** Main NanoApp class */
 var NanoApp = class {
@@ -484,30 +587,19 @@ var NanoApp = class {
 			...SETTINGS,
 			...this.oConfig.settings
 		})) this.oApp.set(sKey, oValue);
-		this.setPackages({
+		for (const fnPackage of packages({
 			...PACKAGES,
 			...this.oConfig.packages
-		});
-		await BetterAuth.mount(this.oApp, this.oConfig.auth);
-		await PluginManager.mount(this.oApp, this.oConfig);
+		})) this.oApp.use(fnPackage);
+		const aAuth = await Auth.init(this.oConfig.auth);
+		const aPlugins = await PluginManager.build(this.oConfig);
+		for (const { path, handler } of [...aAuth, ...aPlugins]) {
+			Logger.info(path);
+			this.oApp.all(path, handler);
+		}
 		this.oApp.use(notFoundHandler);
 		this.oApp.use(errorHandler);
 	}
-	/** Adds the packages according to the configuration */
-	setPackages(oConfig) {
-		if (oConfig.morgan) {
-			for (const [sKey, fnToken] of Object.entries(oConfig.morgan.tokens ?? {})) morgan.token(sKey, fnToken);
-			this.oApp.use(morgan(oConfig.morgan.format));
-		}
-		const aPackages = [
-			oConfig.cors && cors(oConfig.cors),
-			oConfig.helmet && helmet(),
-			oConfig.compression && compression(),
-			oConfig.express && express.json(oConfig.express),
-			oConfig.urlencoded && express.urlencoded(oConfig.urlencoded)
-		];
-		for (const fnPackage of aPackages) if (fnPackage) this.oApp.use(fnPackage);
-	}
 };
 // src/lib/creators.ts
 /** Creates a new NanoApp instance */
@@ -519,10 +611,19 @@ function createRoute(oRoute) {
 	return oRoute;
 }
 function createPlugin(fnCreator) {
-	return fnCreator;
+	return (options) => {
+		const oConfig = fnCreator(options);
+		return {
+			...oConfig,
+			basePath: options?.basePath ?? oConfig.basePath
+		};
+	};
 }
 /** Creates the callbacks of a plugin, typed with what it injects in its params. */
 function createPluginCallbacks(oCallbacks) {
 	return oCallbacks;
 }
+// src/index.ts
+/** Whether the user of a session has the permissions, asked to Better Auth */
+const isGranted = Auth.isGranted.bind(Auth);
 export { NanoApp, NanoError, createNanoApp, createPlugin, createPluginCallbacks, createRoute, isGranted };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nano-app/backend",
-  "version": "0.19.0",
+  "version": "0.20.0",
   "description": "Express server with file-convention routes, plugins and an optional PostgreSQL layer",
   "type": "module",
   "main": "build/index.js",
@@ -48,6 +48,7 @@
     "cors": "^2.8.6",
     "dotenv": "^18.0.9",
     "express": "^5.3.0",
+    "express-rate-limit": "^8.7.3",
     "glob": "^14.0.4",
     "helmet": "^8.3.0",
     "jiti": "^2.7.0",