@protobase/server 0.19.0 → 0.19.1

package/dist/admin-options.d.ts

@@ -59,8 +59,8 @@ export type AdminOptions = {
    */
   maps?: MapOptions | false;
   /**
-   * The plugins the admin app loads (see `PluginOption`), before the ones the platform lists in `PROTOBASE_PLUGINS`;
-   * `false` turns both off.
+   * The plugins the admin app loads (see `PluginOption`), before the ones the platform lists in `PROTOBASE_PLUGINS`
+   * and, for those that load before sign-in, `PROTOBASE_PLUGINS_BEFORE_SIGN_IN`; `false` turns all of them off.
    */
   plugins?: PluginOption[] | false;
   /**

package/dist/better-auth/status-route.js

@@ -14,9 +14,10 @@ import { Hono } from "hono";
 * operator provider's name, when staff can sign in as people; `passkeyDomains`, when people have passkeys for more than
 * one of the app's hosts, the RP IDs a passkey sign-in can ask for, the passkey domain first; with organizations, who may create them and the roles
 * with their labels, `membership` for those a member can hold, and the roles each one's holders may also give; and
-* `anonymous` when the project has an anonymous role, so the admin app opens for visitors before anyone signs in.
+* `anonymous` when the project has an anonymous role, so the admin app opens for visitors before anyone signs in; and
+* `plugins`, those the app loads before sign-in (see `PluginOption`).
 */
-const statusRoute = (auth, { anonymous = false } = {}) => {
+const statusRoute = (auth, { anonymous = false, plugins = [] } = {}) => {
 	const app = new Hono();
 	app.get("/status", async (c) => {
 		const context = await auth.$context;
@@ -41,6 +42,7 @@ const statusRoute = (auth, { anonymous = false } = {}) => {
 			...staffSignIn && { staffSignIn },
 			...passkeyDomains.length > 1 && { passkeyDomains },
 			...anonymous && { anonymous },
+			...plugins.length > 0 && { plugins },
 			...auth.organizations && { organizations: {
 				create: auth.organizations.create,
 				roles: auth.roleDefinitions.names.map((name) => ({

package/dist/create-admin.js

@@ -23,7 +23,7 @@ import { createFilesRuntime } from "./files/runtime.js";
 import { fileRoutes } from "./files/routes.js";
 import { functionRoutes } from "./functions/routes.js";
 import { mapStyleUrl } from "./maps/map-settings.js";
-import { pluginOptions } from "./plugins/plugin-settings.js";
+import { pluginOptions, pluginsBeforeSignIn } from "./plugins/plugin-settings.js";
 import { runtimeUrl } from "./runtime/runtime-settings.js";
 import { checkSourceNames, sourceOptions } from "./sources/source-settings.js";
 import { createMeta } from "./meta.js";
@@ -148,7 +148,10 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 		}));
 	}
 	if (auth) {
-		app.route(authBasePath, statusRoute(auth, { anonymous: Object.hasOwn(options.roles?.definitions ?? {}, anonymousRole) }));
+		app.route(authBasePath, statusRoute(auth, {
+			anonymous: Object.hasOwn(options.roles?.definitions ?? {}, anonymousRole),
+			plugins: pluginsBeforeSignIn(plugins)
+		}));
 		if (auth.organizations) app.route(authBasePath, organizationRoutes({
 			auth,
 			audit: deps.audit,

package/dist/index.d.ts

@@ -20,7 +20,7 @@ import { FilesOptions } from "./files/options.js";
 import { ErrorReportingOptions, ErrorReportingSettings, errorReportingSettings, errorReportingVariable } from "./error-reporting/error-reporting-settings.js";
 import { CleanupEntry, CleanupSchedule, ScheduledDelete, storageCleanupSchedule } from "./files/cleanup-schedule.js";
 import { CleanupReport } from "./files/cleanup-runner.js";
-import { PluginOption, PluginRef, pluginOptions, pluginsFor, pluginsVariable } from "./plugins/plugin-settings.js";
+import { PluginOption, PluginRef, beforeSignInPluginsVariable, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable } from "./plugins/plugin-settings.js";
 import { ResourceSource, configExports } from "./resource-source.js";
 import { SourceOption, SourceRef, checkSourceNames, sourceOptions, sourcesFor, sourcesVariable } from "./sources/source-settings.js";
 import { RecordKeyInput, ToolRecord, ToolRecords } from "./assistant/records.js";
@@ -83,4 +83,4 @@ import { FatalJobError } from "./jobs/run-job.js";
 import { DrainResult, JobsRuntime, StartJobsOptions, startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
 import { checkJobsSchema, jobsSchema, jobsSchemaMigration } from "./jobs/schema.js";
-export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticatorOptions, type CapturedRow, type ChatMessage, type ChatTextPart, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSource, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapOptions, type MemberInput, MissingCredentials, ModelError, type ModelSettings, type NewOrganization, type NewUser, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, addAppRoleToOwners, addMember, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, betterAuthAuthenticator, changesMigration, checkAuthSchema, checkChanges, checkJobsSchema, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, hasUsers, imageSize, isJobDefinition, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, pluginOptions, pluginsFor, pluginsVariable, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storeFile, streamChatCompletion, subscription, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };
+export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticatorOptions, type CapturedRow, type ChatMessage, type ChatTextPart, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSource, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapOptions, type MemberInput, MissingCredentials, ModelError, type ModelSettings, type NewOrganization, type NewUser, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, addAppRoleToOwners, addMember, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, changesMigration, checkAuthSchema, checkChanges, checkJobsSchema, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, hasUsers, imageSize, isJobDefinition, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storeFile, streamChatCompletion, subscription, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };

package/dist/index.js

@@ -36,7 +36,7 @@ import { limitedFileStore } from "./files/limits.js";
 import { localFileStore, localFiles } from "./files/local-files.js";
 import { s3FileStore, s3Files } from "./files/s3-files.js";
 import { mapStyleUrl, mapStyleVariable } from "./maps/map-settings.js";
-import { pluginOptions, pluginsFor, pluginsVariable } from "./plugins/plugin-settings.js";
+import { beforeSignInPluginsVariable, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable } from "./plugins/plugin-settings.js";
 import { runtimeUrl, runtimeVariable, seesRuntime } from "./runtime/runtime-settings.js";
 import { checkSourceNames, sourceOptions, sourcesFor, sourcesVariable } from "./sources/source-settings.js";
 import { renderVariant, thumbHash } from "./files/images.js";
@@ -64,4 +64,4 @@ import { aspectRatio, fileSize, fileType, imageSize, processor } from "./files/p
 import { defineEmail } from "./mail/define-email.js";
 import { startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
-export { FatalJobError, HttpProblem, MissingCredentials, ModelError, addAppRoleToOwners, addMember, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, betterAuthAuthenticator, changesMigration, checkAuthSchema, checkChanges, checkJobsSchema, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, hasUsers, imageSize, isJobDefinition, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, pluginOptions, pluginsFor, pluginsVariable, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storeFile, streamChatCompletion, subscription, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };
+export { FatalJobError, HttpProblem, MissingCredentials, ModelError, addAppRoleToOwners, addMember, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, changesMigration, checkAuthSchema, checkChanges, checkJobsSchema, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, hasUsers, imageSize, isJobDefinition, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storeFile, streamChatCompletion, subscription, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };

package/dist/plugins/plugin-settings.d.ts

@@ -3,12 +3,15 @@ import { JsonValue } from "@protobase/schema";
 /**
  * A plugin the admin app loads at runtime: `url` names its plugin.json (`protobase build-plugin` writes it), on another
  * origin or this one (`/plugins/...`). The plugin reads `settings` with `usePlugin()`. With `roles`, `/meta` names it
- * only to callers holding one of them; without, to everyone.
+ * only to callers holding one of them; without, to everyone. With `beforeSignIn`, the sign-in status names it to
+ * everyone, so the app loads it before anyone signs in and draws its `beforeSignIn` component around the pages someone
+ * signed out sees; it cannot have `roles`, since someone signed out has none.
  */
 export type PluginOption = {
   url: string;
   settings?: Record<string, JsonValue>;
   roles?: string[];
+  beforeSignIn?: boolean;
 };
 /** A plugin as `/meta` names it to a caller. */
 export type PluginRef = {
@@ -17,12 +20,17 @@ export type PluginRef = {
 };
 /** The platform's plugins, as plugin.json URLs separated by commas, loaded after the ones `options.plugins` lists. */
 export declare const pluginsVariable = "PROTOBASE_PLUGINS";
+/** The platform's plugins that load before sign-in, as `PROTOBASE_PLUGINS` lists them, after the ones it lists. */
+export declare const beforeSignInPluginsVariable = "PROTOBASE_PLUGINS_BEFORE_SIGN_IN";
 /**
  * The plugins the app loads: the `bundled` ones its bundle carries, then those `options.plugins` lists, then those
- * `PROTOBASE_PLUGINS` adds, each URL once. `false` turns off the last two; the bundle's are the app's own UI. A value
- * that is no URL stops the server at startup.
+ * `PROTOBASE_PLUGINS` and `PROTOBASE_PLUGINS_BEFORE_SIGN_IN` add, each URL once, where it is first listed. A URL either
+ * of the last two lists loads before sign-in. `false` turns off all but the bundle's, which are the app's own UI. A
+ * value that is no URL, or a plugin that loads before sign-in only for some roles, stops the server at startup.
  */
 export declare const pluginOptions: (option: PluginOption[] | false | undefined, env: Record<string, string | undefined>, bundled?: readonly string[]) => PluginOption[];
 /** The plugins `/meta` names to a caller with `roles`: those for everyone, and those for one of their roles. */
 export declare const pluginsFor: (plugins: readonly PluginOption[], roles: readonly string[]) => PluginRef[];
+/** The plugins the sign-in status names to everyone, for the app to load before anyone signs in. */
+export declare const pluginsBeforeSignIn: (plugins: readonly PluginOption[]) => PluginRef[];
 //#endregion

package/dist/plugins/plugin-settings.js

@@ -1,6 +1,8 @@
 //#region src/plugins/plugin-settings.ts
 /** The platform's plugins, as plugin.json URLs separated by commas, loaded after the ones `options.plugins` lists. */
 const pluginsVariable = "PROTOBASE_PLUGINS";
+/** The platform's plugins that load before sign-in, as `PROTOBASE_PLUGINS` lists them, after the ones it lists. */
+const beforeSignInPluginsVariable = "PROTOBASE_PLUGINS_BEFORE_SIGN_IN";
 const checkedPluginUrl = (url, source) => {
 	if (url.startsWith("/") && !url.startsWith("//")) return url;
 	if (!URL.canParse(url)) throw new Error(`${source} names "${url}", which is no URL; use https://... or a path such as /plugins/name/plugin.json`);
@@ -8,10 +10,12 @@ const checkedPluginUrl = (url, source) => {
 	if (protocol !== "https:" && protocol !== "http:") throw new Error(`${source} names "${url}", which must start with https:// or http://, not ${protocol}//`);
 	return url;
 };
+const listedIn = (env, variable) => (env[variable] ?? "").split(",").map((url) => url.trim()).filter((url) => url !== "").map((url) => checkedPluginUrl(url, variable));
 /**
 * The plugins the app loads: the `bundled` ones its bundle carries, then those `options.plugins` lists, then those
-* `PROTOBASE_PLUGINS` adds, each URL once. `false` turns off the last two; the bundle's are the app's own UI. A value
-* that is no URL stops the server at startup.
+* `PROTOBASE_PLUGINS` and `PROTOBASE_PLUGINS_BEFORE_SIGN_IN` add, each URL once, where it is first listed. A URL either
+* of the last two lists loads before sign-in. `false` turns off all but the bundle's, which are the app's own UI. A
+* value that is no URL, or a plugin that loads before sign-in only for some roles, stops the server at startup.
 */
 const pluginOptions = (option, env, bundled = []) => {
 	const own = bundled.map((url) => ({ url: checkedPluginUrl(url, "the bundle") }));
@@ -20,18 +24,29 @@ const pluginOptions = (option, env, bundled = []) => {
 		...plugin,
 		url: checkedPluginUrl(plugin.url.trim(), "options.plugins")
 	}));
-	const listed = (env["PROTOBASE_PLUGINS"] ?? "").split(",").map((url) => url.trim()).filter((url) => url !== "").map((url) => ({ url: checkedPluginUrl(url, pluginsVariable) }));
+	const listed = listedIn(env, pluginsVariable).map((url) => ({ url }));
+	const early = new Set(listedIn(env, beforeSignInPluginsVariable));
 	const all = [
 		...own,
 		...given,
-		...listed
+		...listed,
+		...[...early].map((url) => ({ url }))
 	];
-	return all.filter((plugin, index) => all.findIndex((other) => other.url === plugin.url) === index);
+	const plugins = all.filter((plugin, index) => all.findIndex((other) => other.url === plugin.url) === index).map((plugin) => early.has(plugin.url) ? {
+		...plugin,
+		beforeSignIn: true
+	} : plugin);
+	const limited = plugins.find((plugin) => plugin.beforeSignIn && plugin.roles);
+	if (limited) throw new Error(`The plugin ${limited.url} loads before sign-in and only for some roles; someone signed out has no role, so drop its roles or beforeSignIn`);
+	return plugins;
 };
-/** The plugins `/meta` names to a caller with `roles`: those for everyone, and those for one of their roles. */
-const pluginsFor = (plugins, roles) => plugins.filter((plugin) => !plugin.roles || plugin.roles.some((role) => roles.includes(role))).map(({ url, settings }) => ({
+const refOf = ({ url, settings }) => ({
 	url,
 	...settings && { settings }
-}));
+});
+/** The plugins `/meta` names to a caller with `roles`: those for everyone, and those for one of their roles. */
+const pluginsFor = (plugins, roles) => plugins.filter((plugin) => !plugin.roles || plugin.roles.some((role) => roles.includes(role))).map(refOf);
+/** The plugins the sign-in status names to everyone, for the app to load before anyone signs in. */
+const pluginsBeforeSignIn = (plugins) => plugins.filter((plugin) => plugin.beforeSignIn).map(refOf);
 //#endregion
-export { pluginOptions, pluginsFor, pluginsVariable };
+export { beforeSignInPluginsVariable, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.19.0",
+  "version": "0.19.1",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -30,9 +30,9 @@
   },
   "dependencies": {
     "@better-auth/passkey": "^1.7.7",
-    "@protobase/layout": "0.19.0",
-    "@protobase/query": "0.19.0",
-    "@protobase/schema": "0.19.0",
+    "@protobase/layout": "0.19.1",
+    "@protobase/query": "0.19.1",
+    "@protobase/schema": "0.19.1",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",