@protobase/server 0.10.0 → 0.11.1

package/dist/admin-options.d.ts

@@ -1,4 +1,5 @@
 import { AuditQueue, PipelineHook, ScanGuardMode } from "./types.js";
+import { PluginOption } from "./plugins/plugin-settings.js";
 import { CorsOrigins } from "./api-cors.js";
 import { AssistantOptions } from "./assistant/assistant-settings.js";
 import { RuntimeOptions } from "./runtime/runtime-settings.js";
@@ -39,5 +40,10 @@ export type AdminOptions = {
   cors?: CorsOrigins;
   /** The runtime updates endpoint behind the top bar's update button (see `RuntimeOptions`); `false` turns it off. */
   runtime?: RuntimeOptions | false;
+  /**
+   * The plugins the admin app loads (see `PluginOption`), before the ones the platform lists in `PROTOBASE_PLUGINS`;
+   * `false` turns both off.
+   */
+  plugins?: PluginOption[] | false;
 };
 //#endregion

package/dist/check-views.js

@@ -1,5 +1,7 @@
 import { relatedErrors } from "./view-related.js";
+import { addressErrors, addressPlaceholders, appHrefError, displayFields, fieldRefsIn, hrefPlaceholders } from "@protobase/schema";
 //#region src/check-views.ts
+const linkFields = (run) => run?.kind !== "link" ? [] : "to" in run ? addressPlaceholders(run.to) : hrefPlaceholders(run.href);
 const sensitiveErrors = (view, model) => {
 	const sensitive = (name) => Boolean(model.fields[name]?.sensitive);
 	return [
@@ -10,11 +12,12 @@ const sensitiveErrors = (view, model) => {
 			...(view.list?.sort ?? []).map(([name]) => name),
 			...view.list?.search ?? []
 		]],
+		["a list display", (view.list?.displays ?? []).flatMap(displayFields)],
 		["a filter", view.filters.map((widget) => widget.field)],
 		["the chart", view.chart ? [view.chart.field] : []],
 		["the sidebar", view.layout.flatMap((item) => item.kind === "sidebar" ? item.fields : [])],
 		["the recent records", view.nav?.recent ? [view.nav.recent.status] : []],
-		["an action", view.actions.flatMap((action) => action.run?.kind === "update" ? Object.keys(action.run.values) : action.run?.kind === "link" ? [...action.run.href.matchAll(/\{(\w+)\}/g)].map((match) => match[1]) : [])]
+		["an action", view.actions.flatMap((action) => action.run?.kind === "update" ? Object.keys(action.run.values) : linkFields(action.run))]
 	].flatMap(([place, names]) => [...new Set(names.filter(sensitive))].map((name) => `sensitive field "${name}" cannot be in ${place}`));
 };
 const valueLabelErrors = (view, model) => Object.entries(view.fields).flatMap(([name, hints]) => {
@@ -23,20 +26,40 @@ const valueLabelErrors = (view, model) => Object.entries(view.fields).flatMap(([
 	if (field?.type !== "enum") return [`value labels of "${name}" need an enum field`];
 	return Object.keys(hints.valueLabels).filter((value) => !field.enumValues?.includes(value)).map((value) => `value label "${value}" is not a value of "${name}"`);
 });
+const linkErrors = (view, model, models, pages) => view.actions.flatMap(({ name, run }) => {
+	if (run?.kind !== "link") return [];
+	if ("href" in run) {
+		const error = appHrefError(run.href);
+		return error ? [`action "${name}": ${error}`] : [];
+	}
+	return addressErrors(run.to, {
+		models,
+		pages,
+		source: model
+	}).map((error) => `action "${name}": ${error}`);
+});
+const unknownFieldErrors = (view, model) => {
+	const unknown = (names, what) => names.filter((name) => !Object.hasOwn(model.fields, name)).map((name) => `${what} names field "${name}", which ${model.name} does not have`);
+	return [...(view.list?.displays ?? []).flatMap((display) => unknown(displayFields(display), `display "${display.name}"`)), ...view.layout.flatMap((item) => item.kind === "custom" ? unknown(fieldRefsIn(item.props), `custom section ${item.component}`) : [])];
+};
 /**
-* Fails at startup when a view uses a sensitive field where it would show empty, labels values its enum does not have,
-* or has a related section that does not fit the resources.
+* Fails at startup when a view uses a sensitive field where it would show empty, a display or custom section names a
+* field the resource does not have, labels values its enum does not have,
+* has a related section that does not fit the resources, or a link to an address the app does not have.
 */
-const checkViews = (registry, views) => {
+const checkViews = (registry, views, pages = []) => {
 	const models = Object.fromEntries(registry.entries.map((entry) => [entry.name, entry.model]));
+	const pageNames = new Set(pages);
 	const problems = views.flatMap((view) => {
 		const model = models[view.resource];
 		if (!model) return [];
 		const related = view.layout.flatMap((item) => item.kind === "related" ? relatedErrors(item, view.resource, models).map((error) => `related "${item.title}": ${error}`) : []);
 		return [
 			...sensitiveErrors(view, model),
+			...unknownFieldErrors(view, model),
 			...valueLabelErrors(view, model),
-			...related
+			...related,
+			...linkErrors(view, model, models, pageNames)
 		].map((problem) => `View "${view.resource}": ${problem}`);
 	});
 	if (problems.length > 0) throw new Error(`The views do not match the resources:\n${problems.map((problem) => `  - ${problem}`).join("\n")}`);

package/dist/create-admin.js

@@ -19,6 +19,7 @@ import { checkViews } from "./check-views.js";
 import { createFilesRuntime } from "./files/runtime.js";
 import { fileRoutes } from "./files/routes.js";
 import { functionRoutes } from "./functions/routes.js";
+import { pluginOptions } from "./plugins/plugin-settings.js";
 import { runtimeUrl } from "./runtime/runtime-settings.js";
 import { createMeta } from "./meta.js";
 import { buildRegistry } from "./registry.js";
@@ -50,7 +51,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	checkShell(registry, viewModels, userMenuModel, pageModels.map((entry) => entry.name));
 	const bottomBarModels = bottomBars.map((bar) => bar.toBottomBarModel());
 	checkBottomBars(registry, bottomBarModels, pageModels.map((entry) => entry.name), declaredRoles(auth, options.roles));
-	checkViews(registry, viewModels);
+	checkViews(registry, viewModels, pageModels.map((entry) => entry.name));
 	checkPages(pageModels, {
 		models: Object.fromEntries(registry.entries.map((entry) => [entry.name, entry.model])),
 		actions: (resource) => new Set(viewModels.filter((view) => view.resource === resource).flatMap((view) => view.actions.map((action) => action.name)))
@@ -58,6 +59,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	const systemPath = basePath.slice(0, basePath.lastIndexOf("/"));
 	const assistant = assistantSettings(options.assistant, globalThis.process?.env ?? {});
 	const runtime = runtimeUrl(options.runtime, globalThis.process?.env ?? {});
+	const plugins = pluginOptions(options.plugins, globalThis.process?.env ?? {});
 	const files = createFilesRuntime({
 		...filesOptions && { options: filesOptions },
 		env: globalThis.process?.env ?? {},
@@ -85,6 +87,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 		rowPermissions: (resource) => typeof options.rowPermissions === "object" ? !options.rowPermissions.except.includes(resource) : options.rowPermissions !== false,
 		...assistant && { assistant: assistant.kind === "external" ? assistant.url : `${systemPath}/assistant` },
 		...runtime && { runtime },
+		plugins,
 		...files && { files },
 		...registry.entries.some((entry) => entry.model.events) && { actorSetting: `${changesSchema(events)}.actor` }
 	};

package/dist/deps.d.ts

@@ -1,5 +1,6 @@
 import "./types.js";
 import "./files/runtime.js";
+import "./plugins/plugin-settings.js";
 import "./registry.js";
 import "./scan-guard.js";
 import { PageModel } from "@protobase/layout";

package/dist/index.d.ts

@@ -16,6 +16,7 @@ import { FileProvider, FileStore, StoredObject } from "./files/store.js";
 import { FilesOptions } from "./files/options.js";
 import { CleanupEntry, CleanupSchedule, ScheduledDelete, storageCleanupSchedule } from "./files/cleanup-schedule.js";
 import { CleanupReport } from "./files/cleanup-runner.js";
+import { PluginOption, PluginRef, pluginOptions, pluginsFor, pluginsVariable } from "./plugins/plugin-settings.js";
 import { ResourceSource, configExports } from "./resource-source.js";
 import { RecordKeyInput, ToolRecord, ToolRecords } from "./assistant/records.js";
 import { FunctionRecords, ListParams, RecordPage } from "./functions/records.js";
@@ -68,4 +69,4 @@ import { FatalJobError } from "./jobs/run-job.js";
 import { DrainResult, JobsRuntime, StartJobsOptions, startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
 import { checkJobsSchema, jobsSchema, jobsSchemaMigration } from "./jobs/schema.js";
-export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticatorOptions, type CapturedRow, type ChatMessage, type ChatTextPart, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DrainResult, type EnqueueOptions, type EventData, type EventsOptions, FatalJobError, type FileCleanupInput, type FileObject, type FileProvider, type FileStore, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSource, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type LinkedAccount, type ListParams, type LocalFilesOptions, type MemberInput, ModelError, type ModelSettings, type NewOrganization, type NewUser, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PipelineHook, type PlatformSignIn, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type RecordKeyInput, type RecordPage, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type ScanGuardMode, type ScheduledDelete, type Session, type SessionOrganization, type SignInPolicy, type SignInRule, type SignatureOptions, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TurnOptions, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, addAppRoleToOwners, addMember, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, betterAuthAuthenticator, changesMigration, checkAuthSchema, checkChanges, checkJobsSchema, checkWebhooksSchema, coalesce, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineFunction, defineJob, defineTool, deleteUser, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, functionApp, hasUsers, imageSize, isJobDefinition, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, listOrganizations, listUsers, localFileStore, localFiles, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, requestApproval, requireEnv, resourceChange, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, startJobs, storageCleanupSchedule, streamChatCompletion, subscription, unauthorized, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints };
+export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticatorOptions, type CapturedRow, type ChatMessage, type ChatTextPart, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DrainResult, type EnqueueOptions, type EventData, type EventsOptions, FatalJobError, type FileCleanupInput, type FileObject, type FileProvider, type FileStore, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSource, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type LinkedAccount, type ListParams, type LocalFilesOptions, type MemberInput, ModelError, type ModelSettings, type NewOrganization, type NewUser, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type RecordKeyInput, type RecordPage, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type ScanGuardMode, type ScheduledDelete, type Session, type SessionOrganization, type SignInPolicy, type SignInRule, type SignatureOptions, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TurnOptions, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, addAppRoleToOwners, addMember, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, betterAuthAuthenticator, changesMigration, checkAuthSchema, checkChanges, checkJobsSchema, checkWebhooksSchema, coalesce, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineFunction, defineJob, defineTool, deleteUser, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, functionApp, hasUsers, imageSize, isJobDefinition, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, listOrganizations, listUsers, localFileStore, localFiles, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, pluginOptions, pluginsFor, pluginsVariable, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, requestApproval, requireEnv, resourceChange, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, startJobs, storageCleanupSchedule, streamChatCompletion, subscription, unauthorized, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints };

package/dist/index.js

@@ -31,6 +31,7 @@ import { newWebhookSecret } from "./webhooks/standard-webhooks.js";
 import { subscription } from "./webhooks/subscription.js";
 import { storageCleanupSchedule } from "./files/cleanup-schedule.js";
 import { localFileStore, localFiles } from "./files/local-files.js";
+import { pluginOptions, pluginsFor, pluginsVariable } from "./plugins/plugin-settings.js";
 import { runtimeUrl, runtimeVariable, seesRuntime } from "./runtime/runtime-settings.js";
 import { createAdmin } from "./create-admin.js";
 import { configExports } from "./resource-source.js";
@@ -51,4 +52,4 @@ import { createFileCleanup } from "./files/file-cleanup.js";
 import { aspectRatio, fileSize, fileType, imageSize, processor } from "./files/processors.js";
 import { startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
-export { FatalJobError, HttpProblem, ModelError, addAppRoleToOwners, addMember, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, betterAuthAuthenticator, changesMigration, checkAuthSchema, checkChanges, checkJobsSchema, checkWebhooksSchema, coalesce, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineFunction, defineJob, defineTool, deleteUser, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, functionApp, hasUsers, imageSize, isJobDefinition, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, listOrganizations, listUsers, localFileStore, localFiles, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, requestApproval, requireEnv, resourceChange, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, startJobs, storageCleanupSchedule, streamChatCompletion, subscription, unauthorized, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints };
+export { FatalJobError, HttpProblem, ModelError, addAppRoleToOwners, addMember, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, betterAuthAuthenticator, changesMigration, checkAuthSchema, checkChanges, checkJobsSchema, checkWebhooksSchema, coalesce, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineFunction, defineJob, defineTool, deleteUser, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, functionApp, hasUsers, imageSize, isJobDefinition, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, listOrganizations, listUsers, localFileStore, localFiles, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, pluginOptions, pluginsFor, pluginsVariable, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, requestApproval, requireEnv, resourceChange, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, startJobs, storageCleanupSchedule, streamChatCompletion, subscription, unauthorized, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints };

package/dist/meta.js

@@ -2,6 +2,7 @@ import { seesAssistant } from "./assistant/assistant-settings.js";
 import { sha256Hex, stableJson } from "./hash.js";
 import { requestAccess } from "./request-access.js";
 import { activeRole } from "./active-role.js";
+import { pluginsFor } from "./plugins/plugin-settings.js";
 import { seesRuntime } from "./runtime/runtime-settings.js";
 import { pruneView } from "./view-access.js";
 import { prunePage } from "@protobase/layout";
@@ -35,6 +36,7 @@ const createMeta = (deps) => {
 		const shown = (item) => item.kind === "link" || (item.kind === "resource" ? visible.some((access) => access.entry.name === item.resource) : pages.some((page) => page.name === item.page));
 		const bar = bottomBarFor(deps.bottomBars, activeRole(session));
 		const barItems = bar?.items.filter(shown) ?? [];
+		const plugins = pluginsFor(deps.plugins, session.user.roles);
 		const body = {
 			resources: visible.map((access) => access.readable),
 			views,
@@ -56,7 +58,8 @@ const createMeta = (deps) => {
 				items: barItems
 			} },
 			...deps.assistant && seesAssistant(session.user.roles) && { assistant: { url: deps.assistant } },
-			...deps.runtime && seesRuntime(session.user.roles) && { runtime: { url: deps.runtime } }
+			...deps.runtime && seesRuntime(session.user.roles) && { runtime: { url: deps.runtime } },
+			...plugins.length > 0 && { plugins }
 		};
 		return {
 			body,

package/dist/plugins/plugin-settings.d.ts

@@ -0,0 +1,27 @@
+import { JsonValue } from "@protobase/schema";
+//#region src/plugins/plugin-settings.d.ts
+/**
+ * A plugin the admin app loads at runtime: `url` names its plugin.json (`protobase build-plugin` writes it), on another
+ * origin or this one (`/plugins/...`). The plugin reads `settings` with `usePlugin()`. With `roles`, `/meta` names it
+ * only to callers holding one of them; without, to everyone.
+ */
+export type PluginOption = {
+  url: string;
+  settings?: Record<string, JsonValue>;
+  roles?: string[];
+};
+/** A plugin as `/meta` names it to a caller. */
+export type PluginRef = {
+  url: string;
+  settings?: Record<string, JsonValue>;
+};
+/** The platform's plugins, as plugin.json URLs separated by commas, loaded after the ones `options.plugins` lists. */
+export declare const pluginsVariable = "PROTOBASE_PLUGINS";
+/**
+ * The plugins the app loads: those `options.plugins` lists, then those `PROTOBASE_PLUGINS` adds, each URL once. `false`
+ * turns both off. A value that is no URL stops the server at startup.
+ */
+export declare const pluginOptions: (option: PluginOption[] | false | undefined, env: Record<string, string | undefined>) => PluginOption[];
+/** The plugins `/meta` names to a caller with `roles`: those for everyone, and those for one of their roles. */
+export declare const pluginsFor: (plugins: readonly PluginOption[], roles: readonly string[]) => PluginRef[];
+//#endregion

package/dist/plugins/plugin-settings.js

@@ -0,0 +1,31 @@
+//#region src/plugins/plugin-settings.ts
+/** The platform's plugins, as plugin.json URLs separated by commas, loaded after the ones `options.plugins` lists. */
+const pluginsVariable = "PROTOBASE_PLUGINS";
+const checkedPluginUrl = (url, source) => {
+	if (url.startsWith("/") && !url.startsWith("//")) return url;
+	if (!URL.canParse(url)) throw new Error(`${source} names "${url}", which is no URL; use https://... or a path such as /plugins/name/plugin.json`);
+	const { protocol } = new URL(url);
+	if (protocol !== "https:" && protocol !== "http:") throw new Error(`${source} names "${url}", which must start with https:// or http://, not ${protocol}//`);
+	return url;
+};
+/**
+* The plugins the app loads: those `options.plugins` lists, then those `PROTOBASE_PLUGINS` adds, each URL once. `false`
+* turns both off. A value that is no URL stops the server at startup.
+*/
+const pluginOptions = (option, env) => {
+	if (option === false) return [];
+	const given = (option ?? []).map((plugin) => ({
+		...plugin,
+		url: checkedPluginUrl(plugin.url.trim(), "options.plugins")
+	}));
+	const listed = (env["PROTOBASE_PLUGINS"] ?? "").split(",").map((url) => url.trim()).filter((url) => url !== "").map((url) => ({ url: checkedPluginUrl(url, pluginsVariable) }));
+	const all = [...given, ...listed];
+	return all.filter((plugin, index) => all.findIndex((other) => other.url === plugin.url) === index);
+};
+/** The plugins `/meta` names to a caller with `roles`: those for everyone, and those for one of their roles. */
+const pluginsFor = (plugins, roles) => plugins.filter((plugin) => !plugin.roles || plugin.roles.some((role) => roles.includes(role))).map(({ url, settings }) => ({
+	url,
+	...settings && { settings }
+}));
+//#endregion
+export { pluginOptions, pluginsFor, pluginsVariable };

package/dist/view-access.js

@@ -1,6 +1,6 @@
 import { relatedErrors } from "./view-related.js";
 import { resolveFieldPath } from "@protobase/layout";
-import { navRecentErrors } from "@protobase/schema";
+import { addressErrors, hrefPlaceholders, navRecentErrors, pruneByShape, shapes, tableDisplay } from "@protobase/schema";
 //#region src/view-access.ts
 const pruneRelated = (item, resource, models) => {
 	const { columns, ...rest } = item;
@@ -9,46 +9,145 @@ const pruneRelated = (item, resource, models) => {
 		...rest,
 		columns: visible
 	} : rest;
-	return relatedErrors(narrowed, resource, models).length === 0 ? [narrowed] : [];
+	return relatedErrors(narrowed, resource, models).length === 0 ? narrowed : void 0;
 };
+const keepDefault = ({ default: opens, displays, ...list }) => {
+	const shown = displays && displays.length > 0 ? displays : void 0;
+	const kept = opens === tableDisplay || shown?.some((display) => display.name === opens);
+	return {
+		...list,
+		...shown && { displays: shown },
+		...opens !== void 0 && kept && { default: opens }
+	};
+};
+const listShape = shapes.object({
+	columns: shapes.list(shapes.field),
+	sort: shapes.list(shapes.tuple(shapes.field, shapes.data)),
+	search: shapes.list(shapes.field),
+	displays: shapes.list(shapes.oneOf({
+		cards: shapes.object({
+			kind: shapes.data,
+			name: shapes.data,
+			label: shapes.data,
+			icon: shapes.data,
+			title: shapes.field,
+			subtitle: shapes.field,
+			badge: shapes.field,
+			meta: shapes.list(shapes.field)
+		}),
+		custom: shapes.object({
+			kind: shapes.data,
+			name: shapes.data,
+			label: shapes.data,
+			icon: shapes.data,
+			component: shapes.data,
+			fields: shapes.list(shapes.field),
+			props: shapes.refs
+		}, { requires: ["props"] })
+	})),
+	default: shapes.data
+}, { after: keepDefault });
+const widgetShape = shapes.oneOf({
+	range: shapes.object({
+		kind: shapes.data,
+		field: shapes.field,
+		histogram: shapes.data
+	}, { requires: ["field"] }),
+	facets: shapes.object({
+		kind: shapes.data,
+		field: shapes.field,
+		search: shapes.data
+	}, { requires: ["field"] }),
+	dateRange: shapes.object({
+		kind: shapes.data,
+		field: shapes.field,
+		presets: shapes.data
+	}, { requires: ["field"] }),
+	toggle: shapes.object({
+		kind: shapes.data,
+		field: shapes.field
+	}, { requires: ["field"] })
+});
+const layoutShape = (resource, models) => shapes.oneOf({
+	section: shapes.object({
+		kind: shapes.data,
+		title: shapes.data,
+		help: shapes.data,
+		fields: shapes.list(shapes.field, { nonEmpty: true })
+	}, { requires: ["fields"] }),
+	sidebar: shapes.object({
+		kind: shapes.data,
+		fields: shapes.list(shapes.field, { nonEmpty: true })
+	}, { requires: ["fields"] }),
+	related: shapes.map((item) => pruneRelated(item, resource, models)),
+	custom: shapes.object({
+		kind: shapes.data,
+		component: shapes.data,
+		title: shapes.data,
+		sidebar: shapes.data,
+		props: shapes.refs
+	}, { requires: ["props"] })
+});
+const linkShape = (model, models) => shapes.map((run) => {
+	return ("to" in run ? addressErrors(run.to, {
+		models,
+		source: model
+	}).length === 0 : hrefPlaceholders(run.href).every((name) => Object.hasOwn(model.fields, name))) ? run : void 0;
+});
+const actionShape = (model, models) => shapes.object({
+	name: shapes.data,
+	label: shapes.data,
+	icon: shapes.data,
+	confirm: shapes.data,
+	bulk: shapes.data,
+	run: shapes.oneOf({
+		update: shapes.object({
+			kind: shapes.data,
+			values: shapes.keys({ all: true })
+		}, { requires: ["values"] }),
+		delete: shapes.data,
+		link: linkShape(model, models)
+	})
+}, { requires: ["run"] });
+const viewShape = (resource, model, models) => shapes.object({
+	resource: shapes.data,
+	roles: shapes.data,
+	title: shapes.field,
+	searchResult: shapes.object({
+		title: shapes.list(shapes.field, { nonEmpty: true }),
+		subtitle: shapes.field
+	}),
+	nav: shapes.object({
+		hidden: shapes.data,
+		group: shapes.data,
+		order: shapes.data,
+		recent: shapes.map((recent) => navRecentErrors(recent, model).length === 0 ? recent : void 0)
+	}),
+	names: shapes.data,
+	icon: shapes.data,
+	help: shapes.data,
+	fields: shapes.keys(),
+	list: listShape,
+	filters: shapes.list(widgetShape),
+	layout: shapes.list(layoutShape(resource, models)),
+	chart: shapes.object({
+		field: shapes.field,
+		range: shapes.data,
+		granularity: shapes.data
+	}, { requires: ["field"] }),
+	saveFeedback: shapes.data,
+	actions: shapes.list(actionShape(model, models))
+});
 /**
-* The view with every reference to a field the caller cannot read removed: columns, sort, search, field labels,
-* filter widgets, layout, chart, title, search result, the update actions that set one, and the sidebar's `recent` group
-* when its status, filter or order uses a hidden field. Nothing in it may name a hidden field. Related sections are checked against
-* `models`, the caller's view of every resource.
+* The view with every reference to a field the caller cannot read removed: list columns, sort, search and displays,
+* field hints, filter widgets, record sections and custom components' props, the chart, title and search result, the
+* actions that set or read one, and the sidebar's `recent` group. Nothing in it may name a hidden field. Related sections
+* and links are checked against `models`, the caller's view of every resource.
 */
 const pruneView = (view, model, models) => {
-	const visible = (name) => Object.hasOwn(model.fields, name);
-	const { title, chart, list, nav, searchResult, ...rest } = view;
-	const { recent, ...placement } = nav ?? {};
-	const resultTitle = searchResult?.title?.filter(visible);
-	const subtitle = searchResult?.subtitle;
-	return {
-		...rest,
-		...searchResult && { searchResult: {
-			...resultTitle?.length && { title: resultTitle },
-			...subtitle !== void 0 && visible(subtitle) && { subtitle }
-		} },
-		...nav && { nav: recent && navRecentErrors(recent, model).length === 0 ? nav : placement },
-		...title !== void 0 && visible(title) && { title },
-		...chart && visible(chart.field) && { chart },
-		...list && { list: {
-			columns: list.columns.filter(visible),
-			...list.sort && { sort: list.sort.filter(([name]) => visible(name)) },
-			...list.search && { search: list.search.filter(visible) }
-		} },
-		fields: Object.fromEntries(Object.entries(view.fields).filter(([name]) => visible(name))),
-		filters: view.filters.filter((widget) => visible(widget.field)),
-		actions: view.actions.filter((action) => action.run?.kind !== "update" || Object.keys(action.run.values).every(visible)),
-		layout: view.layout.flatMap((item) => {
-			if (item.kind === "related") return pruneRelated(item, view.resource, models);
-			const fields = item.fields.filter(visible);
-			return fields.length > 0 ? [{
-				...item,
-				fields
-			}] : [];
-		})
-	};
+	const pruned = pruneByShape(view, viewShape(view.resource, model, models), (name) => Object.hasOwn(model.fields, name));
+	if (!pruned) throw new Error(`The view of ${view.resource} is not an object`);
+	return pruned;
 };
 //#endregion
 export { pruneView };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.10.0",
+  "version": "0.11.1",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -30,9 +30,9 @@
   },
   "dependencies": {
     "@better-auth/passkey": "^1.7.7",
-    "@protobase/layout": "0.10.0",
-    "@protobase/query": "0.10.0",
-    "@protobase/schema": "0.10.0",
+    "@protobase/layout": "0.11.1",
+    "@protobase/query": "0.11.1",
+    "@protobase/schema": "0.11.1",
     "@scalar/hono-api-reference": "^0.12.10",
     "@simplewebauthn/server": "^13.3.1",
     "better-auth": "^1.7.7",