@protobase/server 0.12.1 → 0.12.3

package/dist/admin-options.d.ts

@@ -1,5 +1,6 @@
 import { AuditQueue, PipelineHook, ScanGuardMode } from "./types.js";
 import { PluginOption } from "./plugins/plugin-settings.js";
+import { SourceOption } from "./sources/source-settings.js";
 import { CorsOrigins } from "./api-cors.js";
 import { AssistantOptions } from "./assistant/assistant-settings.js";
 import { RuntimeOptions } from "./runtime/runtime-settings.js";
@@ -45,5 +46,10 @@ export type AdminOptions = {
    * `false` turns both off.
    */
   plugins?: PluginOption[] | false;
+  /**
+   * Other Protobase APIs whose resources the admin app draws as its own (see `SourceOption`), before the ones the
+   * platform lists in `PROTOBASE_SOURCES`; `false` turns both off.
+   */
+  sources?: SourceOption[] | false;
 };
 //#endregion

package/dist/assistant/assistant-settings.js

@@ -1,3 +1,4 @@
+import { checkedUrl } from "../checked-url.js";
 //#region src/assistant/assistant-settings.ts
 const assistantVariables = {
 	url: "PROTOBASE_ASSISTANT_URL",
@@ -13,13 +14,6 @@ const openRouterModel = "openrouter/auto";
 /** The roles that see the assistant: `/meta` names it, and the built-in one answers, only for a caller with one of them. */
 const assistantRoles = ["admin", "ai"];
 const seesAssistant = (roles) => assistantRoles.some((role) => roles.includes(role));
-/** `url` without a trailing slash; anything but an http(s) URL stops the server, naming `source`. */
-const checkedUrl = (url, source) => {
-	if (!URL.canParse(url)) throw new Error(`${source} is not a URL; use https://...`);
-	const { protocol } = new URL(url);
-	if (protocol !== "https:" && protocol !== "http:") throw new Error(`${source} must start with https:// or http://, not ${protocol}//`);
-	return url.replace(/\/+$/, "");
-};
 /**
 * Which assistant the app has: the backend at `url` when one is set, otherwise the built-in one when an API key is
 * set, otherwise none (also when the option is `false`). The built-in one calls OpenRouter unless `baseUrl` names
@@ -53,4 +47,4 @@ const assistantSettings = (option, env) => {
 	};
 };
 //#endregion
-export { assistantRoles, assistantSettings, assistantVariables, checkedUrl, defaultChatsDirectory, openRouterModel, openRouterUrl, seesAssistant };
+export { assistantRoles, assistantSettings, assistantVariables, defaultChatsDirectory, openRouterModel, openRouterUrl, seesAssistant };

package/dist/auth/jwt.d.ts

@@ -5,8 +5,10 @@ export type JwtOptions = {
   /** JWKS endpoint of the identity provider; or pass `keys`, for example `createLocalJWKSet`. */
   jwksUrl?: string | URL;
   keys?: JWTVerifyGetKey;
-  issuer?: string;
-  audience?: string;
+  /** The accepted issuer, or several. */
+  issuer?: string | string[];
+  /** The accepted audience, or several. */
+  audience?: string | string[];
   /** Claim holding the roles, an array, or a string separated by spaces or commas. Default `roles`. */
   rolesClaim?: string;
   /** A second claim whose roles are added to those of `rolesClaim`, such as an organization membership's. */

package/dist/better-auth/app-tokens.d.ts

@@ -0,0 +1,25 @@
+import { Authenticator, TenantValue } from "../types.js";
+import { JWTVerifyGetKey } from "jose";
+//#region src/better-auth/app-tokens.d.ts
+/**
+ * Another Protobase app whose signed-in users this API admits with the tokens that app issues, so its admin app can
+ * draw this API's resources (see `options.sources` there). `issuer` is that app's Better Auth `baseURL`, the issuer and
+ * audience of its tokens; its keys are read from `<issuer>/api/auth/jwks`. `roles` gives its global roles the ones they
+ * are here, `{ admin: 'shop' }`: a role it does not list is dropped, and a user left with none is refused. A role held
+ * in one of its organizations is never mapped: its members could hand it out. Its users work in `tenant` when the
+ * resources have one; nothing in its tokens names a tenant here. `keys` replaces reading its key set, for tests or keys
+ * at hand.
+ */
+export type TrustedApp = {
+  issuer: string;
+  roles: Record<string, string | string[]>;
+  tenant?: TenantValue;
+  keys?: JWTVerifyGetKey;
+};
+/**
+ * Admits the users of the `apps` this API trusts beside its own: a token whose issuer is one of theirs is verified
+ * against that app's keys, its roles given theirs here and its user id made `<sub>@<that app's host>`, unique beside this
+ * app's own users; every other token goes to `own`. A trusted app cannot have `ownIssuer`.
+ */
+export declare const withTrustedApps: (own: Authenticator, ownIssuer: string, apps: readonly TrustedApp[]) => Authenticator;
+//#endregion

package/dist/better-auth/app-tokens.js

@@ -0,0 +1,62 @@
+import { checkedUrl } from "../checked-url.js";
+import { forbidden } from "../problem.js";
+import { noGlobalRole } from "./organizations/role-definitions.js";
+import "./create-auth.js";
+import { jwtAuthenticator } from "../auth/jwt.js";
+import { createRemoteJWKSet, decodeJwt, errors } from "jose";
+//#region src/better-auth/app-tokens.ts
+const claimedIssuer = (request) => {
+	const [scheme, token] = (request.headers.get("authorization") ?? "").split(" ");
+	if (scheme?.toLowerCase() !== "bearer" || !token) return void 0;
+	try {
+		const { iss } = decodeJwt(token);
+		return typeof iss === "string" ? iss.replace(/\/+$/, "") : void 0;
+	} catch (error) {
+		if (error instanceof errors.JOSEError) return void 0;
+		throw error;
+	}
+};
+const trustedAuthenticator = (app, issuer) => {
+	const forms = [issuer, `${issuer}/`];
+	const verify = jwtAuthenticator({
+		keys: app.keys ?? createRemoteJWKSet(new URL(`/api/auth/jwks`, issuer)),
+		issuer: forms,
+		audience: forms,
+		rolesClaim: "role",
+		tenantClaim: "org"
+	});
+	const host = new URL(issuer).host;
+	return async (request) => {
+		const { user, tenant: organization } = await verify(request);
+		const global = organization === void 0 ? user.roles : user.roles.filter((role) => role !== noGlobalRole);
+		const roles = [...new Set(global.flatMap((role) => Object.hasOwn(app.roles, role) ? app.roles[role] : []))];
+		if (roles.length === 0) throw forbidden("no-role", `Your role in ${host} gives you no role here`);
+		return {
+			user: {
+				id: `${user.id}@${host}`,
+				roles
+			},
+			...app.tenant !== void 0 && { tenant: app.tenant }
+		};
+	};
+};
+/**
+* Admits the users of the `apps` this API trusts beside its own: a token whose issuer is one of theirs is verified
+* against that app's keys, its roles given theirs here and its user id made `<sub>@<that app's host>`, unique beside this
+* app's own users; every other token goes to `own`. A trusted app cannot have `ownIssuer`.
+*/
+const withTrustedApps = (own, ownIssuer, apps) => {
+	if (apps.length === 0) return own;
+	const byIssuer = new Map(apps.map((app) => {
+		const issuer = checkedUrl(app.issuer.trim(), `The trusted app's issuer "${app.issuer}"`);
+		if (issuer === checkedUrl(ownIssuer, "issuer")) throw new Error(`The trusted app ${issuer} is this app itself; its own tokens are admitted already`);
+		return [issuer, trustedAuthenticator(app, issuer)];
+	}));
+	return (request) => {
+		const issuer = claimedIssuer(request);
+		const trusted = issuer === void 0 ? void 0 : byIssuer.get(issuer);
+		return trusted ? trusted(request) : own(request);
+	};
+};
+//#endregion
+export { withTrustedApps };

package/dist/better-auth/authenticator.d.ts

@@ -1,5 +1,6 @@
 import { AdminAuth } from "./create-auth.js";
 import { Authenticator, TenantValue } from "../types.js";
+import { TrustedApp } from "./app-tokens.js";
 import { JwksCacheOptions } from "./jwks-cache.js";
 //#region src/better-auth/authenticator.d.ts
 export type BetterAuthAuthenticatorOptions = {
@@ -15,12 +16,14 @@ export type BetterAuthAuthenticatorOptions = {
   organizations?: boolean;
   /** How long the key set is cached; see `cachedKeys`. */
   cache?: JwksCacheOptions;
+  /** Other Protobase apps whose users this API admits with their own tokens, so their admin apps can draw its resources (see `TrustedApp`). */
+  apps?: TrustedApp[];
 };
 /**
  * Verifies the bearer JWT that Better Auth's jwt plugin issues. `sub` is the user id, the `role` claim (a comma
  * separated string from the admin plugin) becomes `roles`. With organizations, the `org` claim is the tenant and the
  * organization, and the membership's `app_roles` are added to the global roles; `user`, which stands for no global
- * role, is left out.
+ * role, is left out. With `apps`, the tokens of those apps are admitted too, with the roles each gives its users here.
  */
 export declare const betterAuthAuthenticator: (options: BetterAuthAuthenticatorOptions) => Authenticator;
 //#endregion

package/dist/better-auth/authenticator.js

@@ -1,12 +1,13 @@
 import { noGlobalRole } from "./organizations/role-definitions.js";
 import { jwtAuthenticator } from "../auth/jwt.js";
+import { withTrustedApps } from "./app-tokens.js";
 import { cachedKeys } from "./jwks-cache.js";
 //#region src/better-auth/authenticator.ts
 /**
 * Verifies the bearer JWT that Better Auth's jwt plugin issues. `sub` is the user id, the `role` claim (a comma
 * separated string from the admin plugin) becomes `roles`. With organizations, the `org` claim is the tenant and the
 * organization, and the membership's `app_roles` are added to the global roles; `user`, which stands for no global
-* role, is left out.
+* role, is left out. With `apps`, the tokens of those apps are admitted too, with the roles each gives its users here.
 */
 const betterAuthAuthenticator = (options) => {
 	const issuer = options.issuer ?? options.auth?.issuer;
@@ -24,8 +25,7 @@ const betterAuthAuthenticator = (options) => {
 		},
 		...options.tenant !== void 0 && { tenant: options.tenant }
 	});
-	if (!organizations) return verify;
-	return async (request) => {
+	return withTrustedApps(!organizations ? verify : async (request) => {
 		const session = await verify(request);
 		const user = {
 			...session.user,
@@ -36,7 +36,7 @@ const betterAuthAuthenticator = (options) => {
 			user,
 			...session.tenant !== void 0 && { organization: { id: session.tenant } }
 		};
-	};
+	}, issuer, options.apps ?? []);
 };
 //#endregion
 export { betterAuthAuthenticator };

package/dist/checked-url.js

@@ -0,0 +1,10 @@
+//#region src/checked-url.ts
+/** `url` without a trailing slash; anything but an http(s) URL stops the server, naming `source`. */
+const checkedUrl = (url, source) => {
+	if (!URL.canParse(url)) throw new Error(`${source} is not a URL; use https://...`);
+	const { protocol } = new URL(url);
+	if (protocol !== "https:" && protocol !== "http:") throw new Error(`${source} must start with https:// or http://, not ${protocol}//`);
+	return url.replace(/\/+$/, "");
+};
+//#endregion
+export { checkedUrl };

package/dist/create-admin.js

@@ -21,6 +21,7 @@ import { fileRoutes } from "./files/routes.js";
 import { functionRoutes } from "./functions/routes.js";
 import { pluginOptions } from "./plugins/plugin-settings.js";
 import { runtimeUrl } from "./runtime/runtime-settings.js";
+import { checkSourceNames, sourceOptions } from "./sources/source-settings.js";
 import { createMeta } from "./meta.js";
 import { buildRegistry } from "./registry.js";
 import { batchRoute } from "./routes/batch.js";
@@ -60,6 +61,11 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	const assistant = assistantSettings(options.assistant, globalThis.process?.env ?? {});
 	const runtime = runtimeUrl(options.runtime, globalThis.process?.env ?? {});
 	const plugins = pluginOptions(options.plugins, globalThis.process?.env ?? {}, bundlePlugins);
+	const sources = sourceOptions(options.sources, globalThis.process?.env ?? {});
+	checkSourceNames(sources, {
+		resources: registry.entries.map((entry) => entry.name),
+		pages: pageModels.map((entry) => entry.name)
+	});
 	const files = createFilesRuntime({
 		...filesOptions && { options: filesOptions },
 		env: globalThis.process?.env ?? {},
@@ -88,6 +94,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 		...assistant && { assistant: assistant.kind === "external" ? assistant.url : `${systemPath}/assistant` },
 		...runtime && { runtime },
 		plugins,
+		sources,
 		...files && { files },
 		...registry.entries.some((entry) => entry.model.events) && { actorSetting: `${changesSchema(events)}.actor` }
 	};

package/dist/index.d.ts

@@ -18,6 +18,7 @@ import { CleanupEntry, CleanupSchedule, ScheduledDelete, storageCleanupSchedule
 import { CleanupReport } from "./files/cleanup-runner.js";
 import { PluginOption, PluginRef, pluginOptions, pluginsFor, pluginsVariable } from "./plugins/plugin-settings.js";
 import { ResourceSource, configExports } from "./resource-source.js";
+import { SourceOption, SourceRef, checkSourceNames, sourceOptions, sourcesFor, sourcesVariable } from "./sources/source-settings.js";
 import { RecordKeyInput, ToolRecord, ToolRecords } from "./assistant/records.js";
 import { FunctionRecords, ListParams, RecordPage } from "./functions/records.js";
 import { ApiFunction, CorsOptions, FunctionApp, FunctionCaller, FunctionContext, FunctionHandler, FunctionOptions, FunctionSource, ProtectedFunctionOptions, PublicFunctionContext, PublicFunctionHandler, PublicFunctionOptions, defineFunction } from "./functions/define-function.js";
@@ -35,6 +36,7 @@ import { ProjectConfig, defineConfig, mergeConfig } from "./project-config.js";
 import { consoleAuditQueue } from "./audit/console-queue.js";
 import { JwtOptions, jwtAuthenticator } from "./auth/jwt.js";
 import { HttpProblem, badRequest, forbidden, notFound, unauthorized } from "./problem.js";
+import { TrustedApp, withTrustedApps } from "./better-auth/app-tokens.js";
 import { BetterAuthAuthenticatorOptions, betterAuthAuthenticator } from "./better-auth/authenticator.js";
 import { parseRoles } from "./better-auth/parse-roles.js";
 import { LinkedAccount, NewUser, StoredUser, createUser, deleteUser, hasUsers, listUsers, roleChoices, setUserBanned, setUserRole } from "./better-auth/users.js";
@@ -69,4 +71,4 @@ import { FatalJobError } from "./jobs/run-job.js";
 import { DrainResult, JobsRuntime, StartJobsOptions, startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
 import { checkJobsSchema, jobsSchema, jobsSchemaMigration } from "./jobs/schema.js";
-export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticatorOptions, type CapturedRow, type ChatMessage, type ChatTextPart, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DrainResult, type EnqueueOptions, type EventData, type EventsOptions, FatalJobError, type FileCleanupInput, type FileObject, type FileProvider, type FileStore, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSource, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type LinkedAccount, type ListParams, type LocalFilesOptions, type MemberInput, ModelError, type ModelSettings, type NewOrganization, type NewUser, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type RecordKeyInput, type RecordPage, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type ScanGuardMode, type ScheduledDelete, type Session, type SessionOrganization, type SignInPolicy, type SignInRule, type SignatureOptions, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TurnOptions, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, addAppRoleToOwners, addMember, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, betterAuthAuthenticator, changesMigration, checkAuthSchema, checkChanges, checkJobsSchema, checkWebhooksSchema, coalesce, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineFunction, defineJob, defineTool, deleteUser, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, functionApp, hasUsers, imageSize, isJobDefinition, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, listOrganizations, listUsers, localFileStore, localFiles, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, pluginOptions, pluginsFor, pluginsVariable, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, requestApproval, requireEnv, resourceChange, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, startJobs, storageCleanupSchedule, streamChatCompletion, subscription, unauthorized, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints };
+export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticatorOptions, type CapturedRow, type ChatMessage, type ChatTextPart, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DrainResult, type EnqueueOptions, type EventData, type EventsOptions, FatalJobError, type FileCleanupInput, type FileObject, type FileProvider, type FileStore, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSource, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type LinkedAccount, type ListParams, type LocalFilesOptions, type MemberInput, ModelError, type ModelSettings, type NewOrganization, type NewUser, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type RecordKeyInput, type RecordPage, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type ScanGuardMode, type ScheduledDelete, type Session, type SessionOrganization, type SignInPolicy, type SignInRule, type SignatureOptions, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, addAppRoleToOwners, addMember, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, betterAuthAuthenticator, changesMigration, checkAuthSchema, checkChanges, checkJobsSchema, checkSourceNames, checkWebhooksSchema, coalesce, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineFunction, defineJob, defineTool, deleteUser, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, functionApp, hasUsers, imageSize, isJobDefinition, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, listOrganizations, listUsers, localFileStore, localFiles, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, pluginOptions, pluginsFor, pluginsVariable, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, requestApproval, requireEnv, resourceChange, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startJobs, storageCleanupSchedule, streamChatCompletion, subscription, unauthorized, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };

package/dist/index.js

@@ -33,10 +33,12 @@ import { storageCleanupSchedule } from "./files/cleanup-schedule.js";
 import { localFileStore, localFiles } from "./files/local-files.js";
 import { pluginOptions, pluginsFor, pluginsVariable } from "./plugins/plugin-settings.js";
 import { runtimeUrl, runtimeVariable, seesRuntime } from "./runtime/runtime-settings.js";
+import { checkSourceNames, sourceOptions, sourcesFor, sourcesVariable } from "./sources/source-settings.js";
 import { createAdmin } from "./create-admin.js";
 import { configExports } from "./resource-source.js";
 import { defineConfig, mergeConfig } from "./project-config.js";
 import { jwtAuthenticator } from "./auth/jwt.js";
+import { withTrustedApps } from "./better-auth/app-tokens.js";
 import { betterAuthAuthenticator } from "./better-auth/authenticator.js";
 import { issueToken, maxTokenTtlSeconds } from "./better-auth/tokens.js";
 import { authSchemaMigration, checkAuthSchema } from "./better-auth/auth-schema.js";
@@ -52,4 +54,4 @@ import { createFileCleanup } from "./files/file-cleanup.js";
 import { aspectRatio, fileSize, fileType, imageSize, processor } from "./files/processors.js";
 import { startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
-export { FatalJobError, HttpProblem, ModelError, addAppRoleToOwners, addMember, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, betterAuthAuthenticator, changesMigration, checkAuthSchema, checkChanges, checkJobsSchema, checkWebhooksSchema, coalesce, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineFunction, defineJob, defineTool, deleteUser, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, functionApp, hasUsers, imageSize, isJobDefinition, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, listOrganizations, listUsers, localFileStore, localFiles, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, pluginOptions, pluginsFor, pluginsVariable, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, requestApproval, requireEnv, resourceChange, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, startJobs, storageCleanupSchedule, streamChatCompletion, subscription, unauthorized, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints };
+export { FatalJobError, HttpProblem, ModelError, addAppRoleToOwners, addMember, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, betterAuthAuthenticator, changesMigration, checkAuthSchema, checkChanges, checkJobsSchema, checkSourceNames, checkWebhooksSchema, coalesce, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineFunction, defineJob, defineTool, deleteUser, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, functionApp, hasUsers, imageSize, isJobDefinition, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, listOrganizations, listUsers, localFileStore, localFiles, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, pluginOptions, pluginsFor, pluginsVariable, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, requestApproval, requireEnv, resourceChange, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startJobs, storageCleanupSchedule, streamChatCompletion, subscription, unauthorized, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };

package/dist/meta.js

@@ -4,6 +4,7 @@ import { requestAccess } from "./request-access.js";
 import { activeRole } from "./active-role.js";
 import { pluginsFor } from "./plugins/plugin-settings.js";
 import { seesRuntime } from "./runtime/runtime-settings.js";
+import { sourcesFor } from "./sources/source-settings.js";
 import { pruneView } from "./view-access.js";
 import { prunePage } from "@protobase/layout";
 import { bottomBarFor, pickView } from "@protobase/schema";
@@ -37,6 +38,7 @@ const createMeta = (deps) => {
 		const bar = bottomBarFor(deps.bottomBars, activeRole(session));
 		const barItems = bar?.items.filter(shown) ?? [];
 		const plugins = pluginsFor(deps.plugins, session.user.roles);
+		const sources = sourcesFor(deps.sources, session.user.roles);
 		const body = {
 			resources: visible.map((access) => access.readable),
 			views,
@@ -59,7 +61,8 @@ const createMeta = (deps) => {
 			} },
 			...deps.assistant && seesAssistant(session.user.roles) && { assistant: { url: deps.assistant } },
 			...deps.runtime && seesRuntime(session.user.roles) && { runtime: { url: deps.runtime } },
-			...plugins.length > 0 && { plugins }
+			...plugins.length > 0 && { plugins },
+			...sources.length > 0 && { sources }
 		};
 		return {
 			body,

package/dist/runtime/runtime-settings.js

@@ -1,4 +1,4 @@
-import { checkedUrl } from "../assistant/assistant-settings.js";
+import { checkedUrl } from "../checked-url.js";
 //#region src/runtime/runtime-settings.ts
 const runtimeVariable = "PROTOBASE_RUNTIME_URL";
 /** Only an admin sees the runtime endpoint: `/meta` names it to nobody else. */

package/dist/sources/source-settings.d.ts

@@ -0,0 +1,37 @@
+//#region src/sources/source-settings.d.ts
+/**
+ * Another Protobase API whose resources the admin app draws as its own: `url` is its resources API (`.../api/v1`),
+ * `label` names it to people when it cannot be reached, and `resources` are the ones the app draws from it, at their
+ * own addresses. With `roles`, `/meta` names it only to callers holding one of them; without, to everyone.
+ */
+export type SourceOption = {
+  url: string;
+  label: string;
+  resources: string[];
+  roles?: string[];
+};
+/** A source as `/meta` names it to a caller. */
+export type SourceRef = {
+  url: string;
+  label: string;
+  resources: string[];
+};
+/** The platform's sources, as a JSON list of `SourceOption`, drawn after the ones `options.sources` lists. */
+export declare const sourcesVariable = "PROTOBASE_SOURCES";
+/**
+ * The sources the app draws resources from: those `options.sources` lists, then those `PROTOBASE_SOURCES` adds; `false`
+ * turns both off. A source that cannot work, one listed twice, or a resource two sources draw stops the server at
+ * startup.
+ */
+export declare const sourceOptions: (option: SourceOption[] | false | undefined, env: Record<string, string | undefined>) => SourceOption[];
+/**
+ * Fails at startup when a source draws a resource under a name the app already uses, for one of its own resources or
+ * a composed page: the address `/<name>` would mean two things.
+ */
+export declare const checkSourceNames: (sources: readonly SourceOption[], own: {
+  resources: readonly string[];
+  pages: readonly string[];
+}) => void;
+/** The sources `/meta` names to a caller with `roles`: those for everyone, and those for one of their roles. */
+export declare const sourcesFor: (sources: readonly SourceOption[], roles: readonly string[]) => SourceRef[];
+//#endregion

package/dist/sources/source-settings.js

@@ -0,0 +1,89 @@
+import { checkedUrl } from "../checked-url.js";
+//#region src/sources/source-settings.ts
+/** The platform's sources, as a JSON list of `SourceOption`, drawn after the ones `options.sources` lists. */
+const sourcesVariable = "PROTOBASE_SOURCES";
+const sourceKeys = /* @__PURE__ */ new Set([
+	"url",
+	"label",
+	"resources",
+	"roles"
+]);
+const isStringList = (value) => Array.isArray(value) && value.every((item) => typeof item === "string");
+const resourceNameProblem = (name) => name === "" ? "is empty" : name === "-" ? "is the prefix of the app's own pages" : name.includes("/") ? "holds a slash" : void 0;
+const checkedSource = (value, where) => {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${where} is not an object such as { "url": "https://...", "label": "...", "resources": ["..."] }`);
+	const unknown = Object.keys(value).filter((key) => !sourceKeys.has(key));
+	if (unknown.length > 0) throw new Error(`${where} has ${unknown.map((key) => `"${key}"`).join(", ")}, which a source does not take; it takes url, label, resources and roles`);
+	const { url, label, resources, roles } = value;
+	if (typeof url !== "string") throw new Error(`${where} needs a url, the other API's resources API such as https://other.example.com/api/v1`);
+	if (typeof label !== "string" || label.trim() === "") throw new Error(`${where} needs a label, its name as people read it`);
+	if (!isStringList(resources) || resources.length === 0) throw new Error(`${where} needs resources, a list of the resource names the app draws from it`);
+	for (const name of resources) {
+		const problem = resourceNameProblem(name);
+		if (problem) throw new Error(`${where} lists the resource "${name}", which ${problem}`);
+	}
+	if (roles !== void 0 && !isStringList(roles)) throw new Error(`${where} has roles that are not a list of role names`);
+	const checked = checkedUrl(url.trim(), `${where}'s url`);
+	const { pathname, search, hash } = new URL(checked);
+	if (pathname === "/" || search || hash) throw new Error(`${where}'s url is "${checked}"; it is the other API's resources API, a path and nothing after it, such as https://other.example.com/api/v1`);
+	return {
+		url: checked,
+		label: label.trim(),
+		resources,
+		...roles && { roles }
+	};
+};
+const listedSources = (env) => {
+	const text = env[sourcesVariable]?.trim();
+	if (!text) return [];
+	const parse = () => {
+		try {
+			return JSON.parse(text);
+		} catch (error) {
+			if (error instanceof SyntaxError) throw new Error(`${sourcesVariable} is not JSON; it is a list such as [{ "url": "https://...", "label": "...", "resources": ["..."] }]`);
+			throw error;
+		}
+	};
+	const parsed = parse();
+	if (!Array.isArray(parsed)) throw new Error(`${sourcesVariable} is not a list; it is a list such as [{ "url": "https://...", "label": "...", "resources": ["..."] }]`);
+	return parsed.map((value, index) => checkedSource(value, `${sourcesVariable}[${index}]`));
+};
+/**
+* The sources the app draws resources from: those `options.sources` lists, then those `PROTOBASE_SOURCES` adds; `false`
+* turns both off. A source that cannot work, one listed twice, or a resource two sources draw stops the server at
+* startup.
+*/
+const sourceOptions = (option, env) => {
+	if (option === false) return [];
+	const all = [...(option ?? []).map((value, index) => checkedSource(value, `options.sources[${index}]`)), ...listedSources(env)];
+	const urls = /* @__PURE__ */ new Set();
+	const drawn = /* @__PURE__ */ new Map();
+	for (const source of all) {
+		if (urls.has(source.url)) throw new Error(`The source ${source.url} is listed twice; list it once, with every resource the app draws from it`);
+		urls.add(source.url);
+		for (const name of source.resources) {
+			const other = drawn.get(name);
+			if (other !== void 0) throw new Error(`The resource "${name}" is drawn from ${other === source.url ? `${other} twice` : `both ${other} and ${source.url}`}; draw it from one source, once`);
+			drawn.set(name, source.url);
+		}
+	}
+	return all;
+};
+/**
+* Fails at startup when a source draws a resource under a name the app already uses, for one of its own resources or
+* a composed page: the address `/<name>` would mean two things.
+*/
+const checkSourceNames = (sources, own) => {
+	for (const source of sources) for (const name of source.resources) {
+		const clash = own.resources.includes(name) ? "resource" : own.pages.includes(name) ? "page" : void 0;
+		if (clash) throw new Error(`The source ${source.label} (${source.url}) draws the resource "${name}", which is also a ${clash} of the app's own; rename one of them, or leave it out of the source's resources`);
+	}
+};
+/** The sources `/meta` names to a caller with `roles`: those for everyone, and those for one of their roles. */
+const sourcesFor = (sources, roles) => sources.filter((source) => !source.roles || source.roles.some((role) => roles.includes(role))).map(({ url, label, resources }) => ({
+	url,
+	label,
+	resources
+}));
+//#endregion
+export { checkSourceNames, sourceOptions, sourcesFor, sourcesVariable };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.12.1",
+  "version": "0.12.3",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -30,9 +30,9 @@
   },
   "dependencies": {
     "@better-auth/passkey": "^1.7.7",
-    "@protobase/layout": "0.12.1",
-    "@protobase/query": "0.12.1",
-    "@protobase/schema": "0.12.1",
+    "@protobase/layout": "0.12.3",
+    "@protobase/query": "0.12.3",
+    "@protobase/schema": "0.12.3",
     "@scalar/hono-api-reference": "^0.12.10",
     "@simplewebauthn/server": "^13.3.1",
     "better-auth": "^1.7.7",