@protobase/server 0.14.5 → 0.14.7

package/dist/better-auth/create-auth.d.ts

@@ -6,6 +6,7 @@ import { RoleDefinitions, RolesInput } from "./organizations/role-definitions.js
 import { OrganizationRole } from "./organizations/store.js";
 import { OrganizationsOptions, ResolvedOrganizations } from "./organizations/options.js";
 import { PlatformSignIn } from "./platform-sign-in.js";
+import { signUpPaths } from "./sign-up/sign-up-plugin.js";
 import "../index.js";
 import { BetterAuthOptions } from "better-auth";
 //#region src/better-auth/create-auth.d.ts
@@ -44,7 +45,16 @@ export type CreateAuthOptions = {
    * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
    */
   defaultRole?: string;
-  /** Sign-in attempts allowed per minute and client, default 5. */
+  /**
+   * Open sign-up: anyone makes their own account from the sign-in page, with `role`, after proving their address with
+   * an emailed code. Off by default, so accounts come only from the host, an admin, an invitation or a sign-in provider.
+   * Needs a mailer: without one it is not offered. `role` is one of `roles` and never `admin`; give it the least
+   * a stranger may hold. Not with `organizations`, whose people come from invitations.
+   */
+  signUp?: {
+    role: string;
+  };
+  /** Sign-in attempts allowed per minute and client, default 5; also the sign-up requests allowed. */
   signInPerMinute?: number;
   /**
    * Sends the password-reset email and the emailed sign-in and two-factor codes; without a mailer none of them is
@@ -87,9 +97,9 @@ type UserCreateHooks = NonNullable<NonNullable<NonNullable<BetterAuthOptions['da
 export type UserCreatedHook = NonNullable<UserCreateHooks['after']>;
 /**
  * Better Auth for a single-tenant admin: sign-in with a password, an emailed code or a passkey, two-factor
- * authentication, and the sign-in policy admins set; no public sign-up (every account is created on the host with
- * `createUser`, or by an admin through the admin plugin), roles from the admin plugin's `role` column, 15 minute JWTs
- * at `/api/auth/token` with the keys at `/api/auth/jwks`.
+ * authentication, and the sign-in policy admins set; no public sign-up unless `signUp` turns it on (every account is
+ * created on the host with `createUser`, or by an admin through the admin plugin), roles from the admin plugin's `role`
+ * column, 15 minute JWTs at `/api/auth/token` with the keys at `/api/auth/jwks`.
  */
 /** The configured roles with `admin` first; `admin` is added when missing. */
 export declare const normalizeRoles: (roles?: RolesInput) => string[];
@@ -733,7 +743,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               expiresAt: Date;
               token: string;
               ipAddress?: string | null | undefined;
-              userAgent?: string | null | undefined;
+              userAgent? /** Open sign-up is on and offered: the app asks for it, and can mail the codes. */ : string | null | undefined;
             };
           };
         }>>[];
@@ -2192,7 +2202,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               userId: string;
               expiresAt: Date;
               token: string;
-              ipAddress? /** The RP ID of new passkeys. */ : string | null | undefined;
+              ipAddress?: string | null | undefined;
               userAgent?: string | null | undefined;
             };
             user: Record<string, any> & {
@@ -2707,7 +2717,10 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
           email: string;
           emailVerified: boolean;
           name: string;
-          image?: string | null | undefined;
+          image? /**
+           * Turns on organizations: people work in one at a time, records of `.tenant` resources are scoped to it, and roles
+           * are held globally (on the user) or per membership. Off by default: the app works as one organization.
+           */ : string | null | undefined;
         } & Record<string, any>;
       }>;
       signInEmailOTP: import("better-auth").StrictEndpoint<"/sign-in/email-otp", {
@@ -3015,6 +3028,34 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
       INVALID_OTP: import("better-auth").RawError<"INVALID_OTP">;
       TOO_MANY_ATTEMPTS: import("better-auth").RawError<"TOO_MANY_ATTEMPTS">;
     };
+  } | {
+    id: "protobase-sign-up";
+    endpoints: {
+      sendSignUpCode: import("better-auth").StrictEndpoint<string, {
+        method: "POST";
+        body: import("zod").ZodObject<{
+          email: import("zod").ZodPipe<import("zod").ZodString, import("zod").ZodEmail>;
+        }, import("zod/v4/core").$strip>;
+      }, {
+        sent: boolean;
+      }>;
+      createSignUpAccount: import("better-auth").StrictEndpoint<string, {
+        method: "POST";
+        body: import("zod").ZodObject<{
+          email: import("zod").ZodPipe<import("zod").ZodString, import("zod").ZodEmail>;
+          code: import("zod").ZodString;
+          name: import("zod").ZodString;
+          password: import("zod").ZodOptional<import("zod").ZodString>;
+        }, import("zod/v4/core").$strip>;
+      }, {
+        user: {
+          id: string;
+          email: string;
+          name: string;
+          role: string;
+        };
+      }>;
+    };
   } | {
     id: "generic-oauth";
     version: string;
@@ -3100,7 +3141,15 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
                 email: string;
                 emailVerified: boolean;
                 name: string;
-                image?: string | null | undefined;
+                image?
+                /**
+                 * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+                 * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+                 */
+                /**
+                 * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+                 * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+                 */ : string | null | undefined;
               };
             };
           }>>[];
@@ -3124,7 +3173,15 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
                 email: string;
                 emailVerified: boolean;
                 name: string;
-                image?: string | null | undefined;
+                image?
+                /**
+                 * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+                 * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+                 */
+                /**
+                 * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+                 * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+                 */ : string | null | undefined;
               };
             };
           }>>[];
@@ -3147,7 +3204,15 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               email: string;
               emailVerified: boolean;
               name: string;
-              image?: string | null | undefined;
+              image?
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */ : string | null | undefined;
             };
           } & {
             session: {
@@ -3202,7 +3267,15 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
                 email: string;
                 emailVerified: boolean;
                 name: string;
-                image?: string | null | undefined;
+                image?
+                /**
+                 * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+                 * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+                 */
+                /**
+                 * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+                 * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+                 */ : string | null | undefined;
               };
             };
           }>>[];
@@ -3226,7 +3299,15 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
                 email: string;
                 emailVerified: boolean;
                 name: string;
-                image?: string | null | undefined;
+                image?
+                /**
+                 * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+                 * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+                 */
+                /**
+                 * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+                 * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+                 */ : string | null | undefined;
               };
             };
           }>>[];
@@ -3249,7 +3330,15 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               email: string;
               emailVerified: boolean;
               name: string;
-              image?: string | null | undefined;
+              image?
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */ : string | null | undefined;
             };
           } & {
             session: {
@@ -3304,7 +3393,15 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               email: string;
               emailVerified: boolean;
               name: string;
-              image?: string | null | undefined;
+              image?
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */ : string | null | undefined;
             };
           };
         }>>[];
@@ -3409,7 +3506,15 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               email: string;
               emailVerified: boolean;
               name: string;
-              image?: string | null | undefined;
+              image?
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */ : string | null | undefined;
             };
           };
         }>>[];
@@ -3437,7 +3542,15 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               email: string;
               emailVerified: boolean;
               name: string;
-              image?: string | null | undefined;
+              image?
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */ : string | null | undefined;
             };
           };
         }>>[];
@@ -3466,7 +3579,15 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
                 email: string;
                 emailVerified: boolean;
                 name: string;
-                image?: string | null | undefined;
+                image?
+                /**
+                 * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+                 * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+                 */
+                /**
+                 * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+                 * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+                 */ : string | null | undefined;
               };
             };
           }>>[];
@@ -3490,7 +3611,15 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
                 email: string;
                 emailVerified: boolean;
                 name: string;
-                image?: string | null | undefined;
+                image?
+                /**
+                 * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+                 * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+                 */
+                /**
+                 * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+                 * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+                 */ : string | null | undefined;
               };
             };
           }>>[];
@@ -3513,7 +3642,15 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               email: string;
               emailVerified: boolean;
               name: string;
-              image?: string | null | undefined;
+              image?
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */ : string | null | undefined;
             };
           } & {
             session: {
@@ -3610,7 +3747,15 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               email: string;
               emailVerified: boolean;
               name: string;
-              image?: string | null | undefined;
+              image?
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */ : string | null | undefined;
             };
           };
         }>>[];
@@ -3642,7 +3787,15 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               email: string;
               emailVerified: boolean;
               name: string;
-              image?: string | null | undefined;
+              image?
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */ : string | null | undefined;
             };
           };
         }>>[];
@@ -3970,7 +4123,15 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               email: string;
               emailVerified: boolean;
               name: string;
-              image?: string | null | undefined;
+              image?
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */ : string | null | undefined;
             };
           };
         }>>[];
@@ -4009,7 +4170,15 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               email: string;
               emailVerified: boolean;
               name: string;
-              image?: string | null | undefined;
+              image?
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */ : string | null | undefined;
             };
           };
         }>>[];
@@ -4044,7 +4213,15 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               email: string;
               emailVerified: boolean;
               name: string;
-              image?: string | null | undefined;
+              image?
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */ : string | null | undefined;
             };
           };
         }>>[];
@@ -4084,7 +4261,15 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               email: string;
               emailVerified: boolean;
               name: string;
-              image?: string | null | undefined;
+              image?
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */ : string | null | undefined;
             };
           };
         }>>[];
@@ -4141,7 +4326,15 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               email: string;
               emailVerified: boolean;
               name: string;
-              image?: string | null | undefined;
+              image?
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */
+              /**
+               * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
+               * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
+               */ : string | null | undefined;
             };
           };
         }>>[];
@@ -4233,6 +4426,14 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
     window: number;
     max: number;
     customRules: {
+      [signUpPaths.sendCode]: {
+        window: number;
+        max: number;
+      };
+      [signUpPaths.create]: {
+        window: number;
+        max: number;
+      };
       '/sign-in/email': {
         window: number;
         max: number;
@@ -4293,6 +4494,8 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
   defaultRole: string | undefined;
   mail: boolean;
   passwordReset: boolean;
+  /** Open sign-up is on and offered: the app asks for it, and can mail the codes. */
+  signUp: boolean;
   socialProviders: string[];
   operator: string | undefined;
   platformSignIn: {

package/dist/better-auth/create-auth.js

@@ -15,6 +15,7 @@ import { rolesPlugin } from "./roles/roles-plugin.js";
 import { platformSignInFor, platformSignInProvider, readPlatformSignIn, resolvePlatformSignIn } from "./platform-sign-in.js";
 import { signInPolicyPlugin } from "./policy-plugin.js";
 import { emailCodeOptions, twoFactorCodeOptions, unusedEmailCodePaths } from "./sign-in-mail.js";
+import { signUpPaths, signUpPlugin } from "./sign-up/sign-up-plugin.js";
 import { staffSignInPlugin } from "./staff-plugin.js";
 import { twoFactorAfterPasswordOrCode } from "./two-factor-challenge.js";
 import { APIError } from "better-auth/api";
@@ -30,9 +31,9 @@ const tokenLifetime = "15m";
 const authBasePath = "/api/auth";
 /**
 * Better Auth for a single-tenant admin: sign-in with a password, an emailed code or a passkey, two-factor
-* authentication, and the sign-in policy admins set; no public sign-up (every account is created on the host with
-* `createUser`, or by an admin through the admin plugin), roles from the admin plugin's `role` column, 15 minute JWTs
-* at `/api/auth/token` with the keys at `/api/auth/jwks`.
+* authentication, and the sign-in policy admins set; no public sign-up unless `signUp` turns it on (every account is
+* created on the host with `createUser`, or by an admin through the admin plugin), roles from the admin plugin's `role`
+* column, 15 minute JWTs at `/api/auth/token` with the keys at `/api/auth/jwks`.
 */
 /** The configured roles with `admin` first; `admin` is added when missing. */
 const normalizeRoles = (roles) => roleDefinitions(roles).names;
@@ -43,7 +44,7 @@ const organizationPaths = ["/organization/set-active", "/organization/accept-inv
 * The options `createAuth` gives Better Auth, with the roles, default role, mailer, operator provider and platform
 * sign-in provider already resolved.
 */
-const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, definitions, defaultRole, mailer, operator, platformSignIn, organizations, context = noContext }) => {
+const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, definitions, defaultRole, mailer, signUpRole, operator, platformSignIn, organizations, context = noContext }) => {
 	const secure = options.baseURL.startsWith("https://");
 	const signIn = platformSignInFor(platformSignIn, Object.keys(options.socialProviders ?? {}));
 	const hosts = passkeyHosts([options.baseURL, ...origins]);
@@ -114,6 +115,11 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 				formerDomain: hosts[0]
 			}),
 			...mailer ? [emailOTP(emailCodeOptions(mailer))] : [],
+			...mailer && signUpRole ? [signUpPlugin({
+				role: signUpRole,
+				mailer,
+				appName: options.appName ?? "Protobase"
+			})] : [],
 			...signIn ? [genericOAuth({ config: [platformSignInProvider(signIn)] })] : [],
 			signInPolicyPlugin({
 				mail: Boolean(mailer),
@@ -175,6 +181,14 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 				"/invitation/sign-up": {
 					window: 60,
 					max: options.signInPerMinute ?? 5
+				},
+				[signUpPaths.sendCode]: {
+					window: 60,
+					max: options.signInPerMinute ?? 5
+				},
+				[signUpPaths.create]: {
+					window: 60,
+					max: options.signInPerMinute ?? 5
 				}
 			}
 		},
@@ -188,10 +202,17 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 		}
 	};
 };
+const checkSignUpRole = (role, roles) => {
+	if (role === "admin") throw new Error("signUp.role cannot be admin: give the least a stranger may hold");
+	if (!roles.includes(role)) throw new Error(`signUp.role "${role}" is not one of the roles: ${roles.join(", ")}`);
+	return role;
+};
 const createAuth = (options) => {
+	if (options.signUp && options.organizations) throw new Error("signUp is not available with organizations: their people join by invitation");
 	const definitions = roleDefinitions(options.roles, { organizations: options.organizations !== void 0 });
 	const roles = definitions.names;
 	if (options.defaultRole !== void 0 && !roles.includes(options.defaultRole)) throw new Error(`defaultRole "${options.defaultRole}" is not one of the roles: ${roles.join(", ")}`);
+	const signUpRole = options.signUp && checkSignUpRole(options.signUp.role, roles);
 	const others = roles.filter((role) => role !== "admin");
 	const defaultRole = options.defaultRole ?? (options.organizations ? "user" : others.length === 1 ? others[0] : void 0);
 	const mailer = options.mailer === void 0 ? platformMailer() : options.mailer || void 0;
@@ -212,6 +233,7 @@ const createAuth = (options) => {
 		definitions,
 		defaultRole,
 		mailer,
+		signUpRole,
 		operator,
 		platformSignIn,
 		...organizations && {
@@ -233,6 +255,8 @@ const createAuth = (options) => {
 		defaultRole,
 		mail: Boolean(mailer),
 		passwordReset: Boolean(mailer),
+		/** Open sign-up is on and offered: the app asks for it, and can mail the codes. */
+		signUp: Boolean(signUpRole && mailer),
 		socialProviders,
 		operator: operator?.name,
 		platformSignIn: platformSignIn && {

package/dist/better-auth/new-account-password.js

@@ -0,0 +1,25 @@
+import { APIError } from "better-auth/api";
+//#region src/better-auth/new-account-password.ts
+const minPasswordLength = 12;
+const maxPasswordLength = 128;
+/**
+* Checks the password someone chose for a new account they make themselves, from an invitation or by signing up,
+* against the effective sign-in policy: none while passwords are forbidden, one unless emailed codes are allowed, and
+* of the length Better Auth's own sign-in takes.
+*/
+const checkNewAccountPassword = (policy, password) => {
+	if (password !== void 0 && policy.password === "forbidden") throw new APIError("BAD_REQUEST", {
+		code: "SIGN_IN_METHOD_FORBIDDEN",
+		message: "This app does not sign in with passwords; leave the password out."
+	});
+	if (password === void 0 && policy.emailCode !== "allowed") throw new APIError("BAD_REQUEST", {
+		code: "PASSWORD_REQUIRED",
+		message: "Choose a password to sign in with."
+	});
+	if (password !== void 0 && (password.length < minPasswordLength || password.length > maxPasswordLength)) throw new APIError("BAD_REQUEST", {
+		code: "PASSWORD_LENGTH",
+		message: `Choose a password of ${minPasswordLength} to ${maxPasswordLength} characters.`
+	});
+};
+//#endregion
+export { checkNewAccountPassword };

package/dist/better-auth/organizations/invitation-endpoints.js

@@ -1,6 +1,7 @@
 import { noGlobalRole } from "./role-definitions.js";
 import { findOrganization } from "./store.js";
 import { invitationLink, invitationToken } from "./invitation-token.js";
+import { checkNewAccountPassword } from "../new-account-password.js";
 import { effectiveSignInPolicy } from "../sign-in-policy.js";
 import { readSignInPolicy } from "../policy-store.js";
 import { acceptInvitation, invitationOfToken } from "./accept-invitation.js";
@@ -8,8 +9,6 @@ import { APIError, createAuthEndpoint, createAuthMiddleware, sessionMiddleware }
 import { setSessionCookie } from "better-auth/cookies";
 import * as z$1 from "zod";
 //#region src/better-auth/organizations/invitation-endpoints.ts
-const minPasswordLength = 12;
-const maxPasswordLength = 128;
 const tokenBody = z$1.object({ token: z$1.string().min(1) });
 const startIn = (context, sessionToken, organizationId) => context.internalAdapter.updateSession(sessionToken, { activeOrganizationId: organizationId });
 /**
@@ -71,20 +70,8 @@ const invitationEndpoints = ({ resolved, mail }) => ({
 			code: "ACCOUNT_EXISTS",
 			message: "This address has an account already: sign in to accept the invitation."
 		});
-		const policy = effectiveSignInPolicy((await readSignInPolicy(ctx.context.adapter)).policy, { mail });
 		const { password } = ctx.body;
-		if (password !== void 0 && policy.password === "forbidden") throw new APIError("BAD_REQUEST", {
-			code: "SIGN_IN_METHOD_FORBIDDEN",
-			message: "This app does not sign in with passwords; leave the password out."
-		});
-		if (password === void 0 && policy.emailCode !== "allowed") throw new APIError("BAD_REQUEST", {
-			code: "PASSWORD_REQUIRED",
-			message: "Choose a password to sign in with."
-		});
-		if (password !== void 0 && (password.length < minPasswordLength || password.length > maxPasswordLength)) throw new APIError("BAD_REQUEST", {
-			code: "PASSWORD_LENGTH",
-			message: `Choose a password of ${minPasswordLength} to ${maxPasswordLength} characters.`
-		});
+		checkNewAccountPassword(effectiveSignInPolicy((await readSignInPolicy(ctx.context.adapter)).policy, { mail }), password);
 		const user = await internalAdapter.createUser({
 			email: invitation.email.toLowerCase(),
 			name: ctx.body.name,

package/dist/better-auth/sign-up/sign-up-code.js

@@ -0,0 +1,52 @@
+import { APIError } from "better-auth/api";
+const signUpCodeLifetime = "5 minutes";
+const allowedAttempts = 3;
+const identifierOf = (email) => `sign-up-otp-${email}`;
+const hashOf = async (code) => {
+	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(code));
+	return btoa(String.fromCharCode(...new Uint8Array(digest)));
+};
+const sixDigits = () => {
+	const limit = Math.floor(2 ** 32 / 1e6) * 1e6;
+	for (;;) {
+		const [value] = crypto.getRandomValues(/* @__PURE__ */ new Uint32Array(1));
+		if (value < limit) return String(value % 1e6).padStart(6, "0");
+	}
+};
+const invalidCode = () => new APIError("BAD_REQUEST", {
+	code: "SIGN_UP_CODE_INVALID",
+	message: "The code is not right, or has expired. Ask for a new one."
+});
+/** A new code for `email`, replacing any earlier one; the store keeps only its hash. */
+const issueSignUpCode = async (context, email) => {
+	const code = sixDigits();
+	const identifier = identifierOf(email);
+	await context.internalAdapter.deleteVerificationByIdentifier(identifier);
+	await context.internalAdapter.createVerificationValue({
+		identifier,
+		value: `${await hashOf(code)}:0`,
+		expiresAt: new Date(Date.now() + 3e5)
+	});
+	return code;
+};
+/**
+* Takes the code for `email` when `code` is it, so it works once; a wrong one counts a try. Taking the stored value is
+* atomic, so of two requests with the right code only one gets through. Throws `SIGN_UP_CODE_INVALID` otherwise.
+*/
+const consumeSignUpCode = async (context, email, code) => {
+	const identifier = identifierOf(email);
+	const consumed = await context.internalAdapter.consumeVerificationValue(identifier);
+	if (!consumed || new Date(consumed.expiresAt) < /* @__PURE__ */ new Date()) throw invalidCode();
+	const separator = consumed.value.lastIndexOf(":");
+	const hash = consumed.value.slice(0, separator);
+	const attempts = Number(consumed.value.slice(separator + 1)) + 1;
+	if (hash === await hashOf(code)) return;
+	if (attempts < allowedAttempts) await context.internalAdapter.createVerificationValue({
+		identifier,
+		value: `${hash}:${attempts}`,
+		expiresAt: new Date(consumed.expiresAt)
+	});
+	throw invalidCode();
+};
+//#endregion
+export { consumeSignUpCode, issueSignUpCode, signUpCodeLifetime };

package/dist/better-auth/sign-up/sign-up-mail.js

@@ -0,0 +1,29 @@
+import { signUpCodeLifetime } from "./sign-up-code.js";
+//#region src/better-auth/sign-up/sign-up-mail.ts
+/** The email with the code that makes an account for the address. */
+const signUpCodeEmail = ({ to, code, appName }) => ({
+	to,
+	subject: "Your code to create an account",
+	text: [
+		`Use this code to create your account for ${appName}:`,
+		"",
+		code,
+		"",
+		`It works for ${signUpCodeLifetime}, once.`,
+		"If you did not try to create an account, ignore this email: nobody can create one for your address without the code.",
+		""
+	].join("\n")
+});
+/** The email to an address that asked for a sign-up code while it has an account already: no code, a pointer to sign in instead. */
+const accountExistsEmail = ({ to, appName }) => ({
+	to,
+	subject: "You already have an account",
+	text: [
+		`Someone asked to create an account for ${appName} with this address, which has one already, so no new account was made.`,
+		"",
+		"Sign in with it instead. If this was not you, ignore this email.",
+		""
+	].join("\n")
+});
+//#endregion
+export { accountExistsEmail, signUpCodeEmail };

package/dist/better-auth/sign-up/sign-up-plugin.d.ts

@@ -0,0 +1,8 @@
+import "zod";
+//#region src/better-auth/sign-up/sign-up-plugin.d.ts
+/** The paths of the sign-up endpoints, as `ctx.path` and the rate limits name them. */
+export declare const signUpPaths: {
+  sendCode: string;
+  create: string;
+};
+//#endregion

package/dist/better-auth/sign-up/sign-up-plugin.js

@@ -0,0 +1,98 @@
+import { checkNewAccountPassword } from "../new-account-password.js";
+import { effectiveSignInPolicy } from "../sign-in-policy.js";
+import { readSignInPolicy } from "../policy-store.js";
+import { consumeSignUpCode, issueSignUpCode } from "./sign-up-code.js";
+import { accountExistsEmail, signUpCodeEmail } from "./sign-up-mail.js";
+import { APIError, createAuthEndpoint } from "better-auth/api";
+import { setSessionCookie } from "better-auth/cookies";
+import * as z$1 from "zod";
+//#region src/better-auth/sign-up/sign-up-plugin.ts
+const address = z$1.string().trim().toLowerCase().pipe(z$1.email());
+/** The paths of the sign-up endpoints, as `ctx.path` and the rate limits name them. */
+const signUpPaths = {
+	sendCode: "/sign-up/send-code",
+	create: "/sign-up/create"
+};
+const noAdminYet = () => new APIError("FORBIDDEN", {
+	code: "NO_ADMIN_YET",
+	message: "This app has no admin yet; accounts are created on the host until it has one."
+});
+/**
+* Open sign-up: anyone makes their own account, with `role`. The address comes first, and a code mailed to it, so an
+* account exists only for an address its owner reads, verified from the start, and nobody can claim an address before
+* its owner does. Asking for a code answers the same whether the address has an account or not; one that has gets a
+* mail saying so instead of a code. While the store has no user, nobody signs up: the first admin is made on the host.
+*/
+const signUpPlugin = ({ role, mailer, appName }) => ({
+	id: "protobase-sign-up",
+	endpoints: {
+		/** `POST /sign-up/send-code` with `{ email }`: mails a code for making an account with the address. */
+		sendSignUpCode: createAuthEndpoint(signUpPaths.sendCode, {
+			method: "POST",
+			body: z$1.object({ email: address })
+		}, async (ctx) => {
+			const { email } = ctx.body;
+			const { internalAdapter, adapter } = ctx.context;
+			if (await adapter.count({ model: "user" }) === 0) throw noAdminYet();
+			const message = await internalAdapter.findUserByEmail(email) ? accountExistsEmail({
+				to: email,
+				appName
+			}) : signUpCodeEmail({
+				to: email,
+				code: await issueSignUpCode(ctx.context, email),
+				appName
+			});
+			await ctx.context.runInBackgroundOrAwait(mailer.send(message));
+			return ctx.json({ sent: true });
+		}),
+		/**
+		* `POST /sign-up/create` with `{ email, code, name, password? }`: makes the account with the mailed code, verified
+		* and with the sign-up role, and signs the person in. A password is needed unless the sign-in policy offers emailed
+		* codes; the policy's required methods are then set up as after any sign-in.
+		*/
+		createSignUpAccount: createAuthEndpoint(signUpPaths.create, {
+			method: "POST",
+			body: z$1.object({
+				email: address,
+				code: z$1.string().trim().min(1),
+				name: z$1.string().trim().min(1).max(200),
+				password: z$1.string().optional()
+			})
+		}, async (ctx) => {
+			const { email, code, name, password } = ctx.body;
+			const { internalAdapter, adapter } = ctx.context;
+			if (await adapter.count({ model: "user" }) === 0) throw noAdminYet();
+			checkNewAccountPassword(effectiveSignInPolicy((await readSignInPolicy(adapter)).policy, { mail: true }), password);
+			await consumeSignUpCode(ctx.context, email, code);
+			if (await internalAdapter.findUserByEmail(email)) throw new APIError("BAD_REQUEST", {
+				code: "ACCOUNT_EXISTS",
+				message: "This address has an account already: sign in instead."
+			});
+			const user = await internalAdapter.createUser({
+				email,
+				name,
+				emailVerified: true,
+				role
+			}, { method: "sign-up" });
+			if (password !== void 0) await internalAdapter.linkAccount({
+				userId: user.id,
+				providerId: "credential",
+				accountId: user.id,
+				password: await ctx.context.password.hash(password)
+			});
+			const session = await internalAdapter.createSession(user.id, false);
+			await setSessionCookie(ctx, {
+				session,
+				user
+			});
+			return ctx.json({ user: {
+				id: user.id,
+				email: user.email,
+				name: user.name,
+				role
+			} });
+		})
+	}
+});
+//#endregion
+export { signUpPaths, signUpPlugin };

package/dist/better-auth/status-route.js

@@ -9,7 +9,7 @@ import { Hono } from "hono";
 * `GET {authBase}/status`: `needsAdmin` while the admin store has no user, so a login page can say how to create one;
 * `signInMethods`, the ways to sign in the sign-in policy leaves on (`password`, `emailCode`, `passkey`), so it offers
 * only those; `passwordReset` when reset mail can be sent and passwords are on, so it offers "Forgot password?" only
-* then; the ids of the `socialProviders` people can sign in with, so it offers "Continue with GitHub" when `github` is
+* then; `signUp` when the app has open sign-up, so it offers "Create an account"; the ids of the `socialProviders` people can sign in with, so it offers "Continue with GitHub" when `github` is
 * one; `platformSignIn`, the id and name of the platform's provider when it is one of them; `staffSignIn`, the
 * operator provider's name, when staff can sign in as people; `passkeyDomains`, when people have passkeys for more than
 * one of the app's hosts, the RP IDs a passkey sign-in can ask for, the passkey domain first; with organizations, who may create them and the roles
@@ -35,6 +35,7 @@ const statusRoute = (auth, { anonymous = false } = {}) => {
 			needsAdmin: !await hasUsers(auth),
 			signInMethods,
 			passwordReset: auth.passwordReset && policy.password === "allowed",
+			...auth.signUp && { signUp: true },
 			socialProviders,
 			...platformSignIn && { platformSignIn },
 			...staffSignIn && { staffSignIn },

package/dist/changes/event-code-error.js

@@ -0,0 +1,14 @@
+//#region src/changes/event-code-error.ts
+/**
+* An error the app's code threw while a change was dispatched: an event's `match` or filter, a subscription's `when`, or
+* an access rule of the roles it delivers as. Dispatch keeps the change as failed and moves on; any other error, such
+* as the database's, fails the whole dispatch, which is retried.
+*/
+var EventCodeError = class extends Error {
+	name = "EventCodeError";
+	constructor(what, error) {
+		super(`${what} threw: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+	}
+};
+//#endregion
+export { EventCodeError };

package/dist/changes/match-events.js

@@ -1,3 +1,4 @@
+import { EventCodeError } from "./event-code-error.js";
 import { evaluateFilter } from "@protobase/schema";
 import { checkEventFilter } from "@protobase/schema/internal";
 //#region src/changes/match-events.ts
@@ -39,7 +40,13 @@ const eventTest = (model, event, match) => {
 		if (!match) throw new Error(`Resource "${model.name}": event "${event.name}" has no match function`);
 		tests.push((change) => match(contextOf(change)));
 	}
-	return (change) => tests.every((test) => test(change));
+	return (change) => {
+		try {
+			return tests.every((test) => test(change));
+		} catch (error) {
+			throw new EventCodeError(`Event ${event.name} on ${change.resource} ${change.key}`, error);
+		}
+	};
 };
 /**
 * The names of the resource's events a change raises, in declaration order. The filters are checked once, here; `matches`

package/dist/webhooks/route-events.js

@@ -1,3 +1,4 @@
+import { EventCodeError } from "../changes/event-code-error.js";
 import { eventPatternMatches } from "./subscription.js";
 import { evaluateFilter } from "@protobase/schema";
 import { checkEventFilter } from "@protobase/schema/internal";
@@ -48,7 +49,12 @@ const subscriptionRouter = (subscriptions, models) => {
 		if (options.enabled === false) return false;
 		if (options.tenant !== void 0 && String(options.tenant) !== String(change.tenant)) return false;
 		const filter = filters.get(`${subscription.name}\0${change.resource}`);
-		return !filter || evaluateFilter(filter, change.after ?? change.before) === true;
+		if (!filter) return true;
+		try {
+			return evaluateFilter(filter, change.after ?? change.before) === true;
+		} catch (error) {
+			throw new EventCodeError(`The when of subscription "${subscription.name}" on ${change.resource} ${change.key}`, error);
+		}
 	};
 	return (change, events) => subscriptions.flatMap((subscription) => {
 		if (!passes(subscription, change)) return [];

package/dist/webhooks/subscriber-view.js

@@ -1,4 +1,5 @@
 import { requestAccess } from "../request-access.js";
+import { EventCodeError } from "../changes/event-code-error.js";
 import { checkRecord, evaluateFilter } from "@protobase/schema";
 //#region src/webhooks/subscriber-view.ts
 /**
@@ -64,8 +65,14 @@ const subscriberEvents = (deps) => {
 		if (!entry) throw new Error(`Not implemented: a change of "${change.resource}", which is no resource of the app`);
 		const cacheKey = `${subscription.name}\0${change.resource}`;
 		if (!accesses.has(cacheKey)) accesses.set(cacheKey, requestAccess(deps, entry, session));
-		const access = await accesses.get(cacheKey);
-		if (!await mayRead(access, change.after ?? change.before)) return void 0;
+		const readable = async () => {
+			const access = await accesses.get(cacheKey);
+			return await mayRead(access, change.after ?? change.before) ? access : void 0;
+		};
+		const access = await readable().catch((error) => {
+			throw new EventCodeError(`The access check of subscription "${subscription.name}" on ${change.resource} ${change.key}`, error);
+		});
+		if (!access) return void 0;
 		return subscriptionEvent(change, event, {
 			fields: Object.keys(access.readable.fields),
 			thin

package/dist/webhooks/webhooks.js

@@ -1,5 +1,6 @@
 import { dispatchJobName } from "../changes/capture-sql.js";
 import { coalesce } from "../changes/coalesce.js";
+import { EventCodeError } from "../changes/event-code-error.js";
 import { eventMatcher } from "../changes/match-events.js";
 import { deleteOutbox, readOutbox } from "../changes/outbox.js";
 import { resourceChange } from "../changes/resource-change.js";
@@ -41,6 +42,9 @@ const deliveryGroup = ({ subscription, change }) => `${subscription.name}:${chan
 *   time: it turns the committed outbox rows into events, makes the first try of every unordered delivery itself,
 *   queues the failures and the ordered deliveries, and deletes the rows in that same transaction. A process that dies
 *   before that commits leaves the rows, and the job's retry delivers them again, under the same `webhook-id`.
+* - `webhooks.dispatch-change`, one change whose app code threw in dispatch: an event's `match` or filter, a
+*   subscription's `when`, or an access rule of its roles. Kept as failed, so dispatch moves on to later changes; a
+*   retry after the fix queues the change's deliveries. Any other error fails the whole dispatch, which is retried.
 * - `webhooks.deliver`, one try of an unordered delivery; a failure queues the next try on the Standard Webhooks
 *   schedule, or Retry-After, and the last one is kept as failed.
 * - `webhooks.deliver-ordered`, the ordered deliveries of one dispatch for one subscription and record, retried with
@@ -138,20 +142,54 @@ const createWebhooks = ({ deps, subscriptions, functions, schema, log, table })
 			}
 		}
 	});
-	const deliveriesOf = async (changes, db) => {
+	const changeDeliveries = async (db) => {
 		const route = subscriptionRouter(await current(db), models);
 		const eventOf = subscriberEvents(deps);
-		const deliveries = [];
-		for (const change of changes) for (const { subscription, event } of route(change, matchers.get(change.resource)(change))) {
-			const shaped = await eventOf(subscription, change, event);
-			if (shaped) deliveries.push({
-				subscription,
-				event: shaped,
-				change
-			});
+		return async (change) => {
+			const deliveries = [];
+			for (const { subscription, event } of route(change, matchers.get(change.resource)(change))) {
+				const shaped = await eventOf(subscription, change, event);
+				if (shaped) deliveries.push({
+					subscription,
+					event: shaped,
+					change
+				});
+			}
+			return deliveries;
+		};
+	};
+	const queueOrdered = async (db, deliveries) => {
+		const groups = /* @__PURE__ */ new Map();
+		for (const delivery of deliveries.filter(({ subscription }) => subscription.options.ordered)) {
+			const group = deliveryGroup(delivery);
+			const payload = groups.get(group) ?? {
+				subscription: delivery.subscription.name,
+				events: []
+			};
+			payload.events.push(delivery.event);
+			groups.set(group, payload);
 		}
-		return deliveries;
+		for (const [group, payload] of groups) await deliverOrdered.enqueue(db, payload, { group });
 	};
+	const dispatchChange = defineJob({
+		name: "webhooks.dispatch-change",
+		maxAttempts: 1,
+		timeout: "5 minutes",
+		run: async ({ change }, { db }) => {
+			const deliveries = await (await changeDeliveries(db))(change);
+			await db.transaction().execute(async (trx) => {
+				for (const { subscription, event } of deliveries.filter(({ subscription }) => !subscription.options.ordered)) {
+					const payload = {
+						subscription: subscription.name,
+						event,
+						attempt: 1
+					};
+					await deliver.enqueue(trx, payload, { key: deliveryKey(payload) });
+				}
+				await queueOrdered(trx, deliveries);
+			});
+		}
+	});
 	const dispatchBatch = async (db, signal) => {
 		const rows = await readOutbox(db, schema, models, batchSize);
 		if (rows.length === 0) return 0;
@@ -159,7 +197,18 @@ const createWebhooks = ({ deps, subscriptions, functions, schema, log, table })
 			const entry = deps.registry.find(change.resource);
 			return entry ? [resourceChange(entry.model, change)] : [];
 		});
-		const deliveries = await deliveriesOf(changes, db);
+		const deliveriesOf = await changeDeliveries(db);
+		const deliveries = [];
+		const failures = [];
+		for (const change of changes) try {
+			deliveries.push(...await deliveriesOf(change));
+		} catch (error) {
+			if (!(error instanceof EventCodeError)) throw error;
+			failures.push({
+				change,
+				error
+			});
+		}
 		const now = deliveries.filter(({ subscription }) => !subscription.options.ordered);
 		const results = await mapLimit(now, parallelAttempts, ({ subscription, event }) => attempt(subscription, event, db, 1, signal));
 		await db.transaction().execute(async (trx) => {
@@ -179,20 +228,12 @@ const createWebhooks = ({ deps, subscriptions, functions, schema, log, table })
 					delay
 				});
 			}
-			const groups = /* @__PURE__ */ new Map();
-			for (const delivery of deliveries.filter(({ subscription }) => subscription.options.ordered)) {
-				const group = deliveryGroup(delivery);
-				const payload = groups.get(group) ?? {
-					subscription: delivery.subscription.name,
-					events: []
-				};
-				payload.events.push(delivery.event);
-				groups.set(group, payload);
-			}
-			for (const [group, payload] of groups) await deliverOrdered.enqueue(trx, payload, { group });
+			await queueOrdered(trx, deliveries);
+			for (const { change } of failures) await dispatchChange.enqueue(trx, { change });
 			await deleteOutbox(trx, schema, rows.map((row) => row.id));
 		});
 		for (const [index, { subscription, event }] of now.entries()) report(subscription.name, event, 1, results[index]);
+		for (const { error } of failures) log(`events kept as failed (webhooks.dispatch-change): ${error.message}`);
 		return rows.length;
 	};
 	const dispatch = defineJob({
@@ -223,6 +264,7 @@ const createWebhooks = ({ deps, subscriptions, functions, schema, log, table })
 	});
 	return { jobs: [
 		dispatch,
+		dispatchChange,
 		deliver,
 		deliverOrdered,
 		...table ? [sendTest] : [],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.14.5",
+  "version": "0.14.7",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -30,9 +30,9 @@
   },
   "dependencies": {
     "@better-auth/passkey": "^1.7.7",
-    "@protobase/layout": "0.14.5",
-    "@protobase/query": "0.14.5",
-    "@protobase/schema": "0.14.5",
+    "@protobase/layout": "0.14.7",
+    "@protobase/query": "0.14.7",
+    "@protobase/schema": "0.14.7",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",