@protobase/server 0.21.6 → 0.21.8

package/dist/create-admin.d.ts

@@ -1,11 +1,13 @@
 import { AdminAuth } from "./better-auth/create-auth.js";
 import { EventsOptions } from "./changes/events-options.js";
-import { HistoryOptions } from "./history/options.js";
 import { JobDefinition } from "./jobs/job-types.js";
 import { Admin, Authenticator, PageSource, ViewSource } from "./types.js";
+import { CommentUsers } from "./comments/comment-users.js";
+import { HistoryOptions } from "./history/options.js";
 import { WebhooksOptions } from "./webhooks/table/options.js";
 import { SubscriptionDefinition } from "./webhooks/subscription.js";
 import { FilesOptions } from "./files/options.js";
+import { Difficulty } from "./forms/challenge.js";
 import { ResourceSource } from "./resource-source.js";
 import { FunctionSource } from "./functions/define-function.js";
 import { AdminOptions } from "./admin-options.js";
@@ -33,7 +35,7 @@ export type CreateAdminInput = {
   events?: EventsOptions;
   /** How long the history of resources with `.history()` is kept (see `HistoryOptions`). */
   history?: HistoryOptions;
-  /** The app's jobs (see `defineJob`): with any, or a resource with events or history, admins get the failed jobs page (`failed_jobs`). */
+  /** The app's jobs (see `defineJob`): with any, or a resource with events, history or comments, admins get the failed jobs page (`failed_jobs`). */
   jobs?: JobDefinition[];
   /** Where the resources' events are delivered (`subscription(...)` exports of the config module). */
   subscriptions?: SubscriptionDefinition[];
@@ -52,7 +54,11 @@ export type CreateAdminInput = {
    */
   fieldTypes?: Record<string, string[]>;
   options?: AdminOptions;
+  /** @internal The proof-of-work range of public forms' bot checks, which tests make tiny. */
+  formsDifficulty?: Difficulty;
+  /** @internal The users comments name, mention and mail, which tests fake; from `auth` otherwise. */
+  commentUsers?: CommentUsers;
 };
 /** The admin REST API as a Hono app. It uses only Web APIs, so it runs on Node, Workers and anywhere else Hono does. */
-export declare const createAdmin: ({ resources: appResources, views: appViews, pages, userMenu, bottomBars, db, authenticate, auth, functions, files: filesOptions, events, history: historyOptions, jobs, subscriptions, webhooks: webhooksOptions, bundlePlugins, fieldTypes, options }: CreateAdminInput) => Admin;
+export declare const createAdmin: ({ resources: appResources, views: appViews, pages, userMenu, bottomBars, db, authenticate, auth, functions, files: filesOptions, events, history: historyOptions, jobs, subscriptions, webhooks: webhooksOptions, bundlePlugins, fieldTypes, options, formsDifficulty, commentUsers: givenCommentUsers }: CreateAdminInput) => Admin;
 //#endregion

package/dist/create-admin.js

@@ -1,7 +1,11 @@
-import { assistantSettings } from "./assistant/assistant-settings.js";
+import { aiModel } from "./ai/ai-model.js";
+import { hasAiActions, hasAiFields } from "./ai/ai-fields.js";
+import { fillHook } from "./ai/fill-hook.js";
 import { createErrorHandler } from "./error-handler.js";
 import { isCaptured } from "./changes/capture-sql.js";
 import { assistantRecords } from "./assistant/records.js";
+import { fillJob } from "./ai/fill-job.js";
+import { assistantSettings } from "./assistant/assistant-settings.js";
 import { builtInAssistant } from "./assistant/built-in-assistant.js";
 import { consoleAuditQueue } from "./audit/console-queue.js";
 import { webauthnPath } from "./better-auth/origins.js";
@@ -11,8 +15,12 @@ import { authBasePath } from "./better-auth/create-auth.js";
 import { organizationRoutes } from "./better-auth/organizations/admin-routes.js";
 import { statusRoute } from "./better-auth/status-route.js";
 import { changesSchema } from "./changes/events-options.js";
-import { activityResource, activityView } from "./history/activity.js";
+import { appOrigin } from "./comments/app-origin.js";
 import { betterAuthActorNames } from "./history/actor-names.js";
+import { betterAuthCommentUsers } from "./comments/comment-users.js";
+import { mentionJob } from "./comments/mention-job.js";
+import { commentsResource, commentsView } from "./comments/record-comments.js";
+import { activityResource, activityView } from "./history/activity.js";
 import { historyDays } from "./history/options.js";
 import { pruneHistoryJob } from "./history/prune-history.js";
 import { callerRecords } from "./functions/records.js";
@@ -20,7 +28,7 @@ import { toApiFunction } from "./functions/define-function.js";
 import { createWebhooks } from "./webhooks/webhooks.js";
 import { webhookTable } from "./webhooks/table/webhook-table.js";
 import { subscriptionWriteCheck } from "./webhooks/table/validate-hook.js";
-import { withAnonymous } from "./anonymous.js";
+import { visitorsBrowse, withAnonymous } from "./anonymous.js";
 import { checkBottomBars, checkShell } from "./check-shell.js";
 import { checkOwnerFields } from "./check-owners.js";
 import { checkRoleLimits } from "./check-roles.js";
@@ -28,6 +36,8 @@ import { checkViews } from "./check-views.js";
 import { errorReportingSettings } from "./error-reporting/error-reporting-settings.js";
 import { createFilesRuntime } from "./files/runtime.js";
 import { fileRoutes } from "./files/routes.js";
+import { formRoutes } from "./forms/routes.js";
+import { createFormsRuntime } from "./forms/runtime.js";
 import { functionRoutes } from "./functions/routes.js";
 import { mapSettings } from "./maps/map-settings.js";
 import { pluginOptions, pluginsBeforeSignIn } from "./plugins/plugin-settings.js";
@@ -44,30 +54,35 @@ import { createScanGuard } from "./scan-guard.js";
 import { failedJobs, failedJobsView } from "./jobs/failed-jobs.js";
 import { Hono } from "hono";
 import { checkPages } from "@protobase/layout";
-import { anonymousRole } from "@protobase/schema";
 //#region src/create-admin.ts
 const declaredRoles = (auth, roles) => {
 	const names = [...auth?.roles ?? [], ...Object.keys(roles?.definitions ?? {})];
 	return names.length > 0 ? [...new Set(names)] : void 0;
 };
 /** The admin REST API as a Hono app. It uses only Web APIs, so it runs on Node, Workers and anywhere else Hono does. */
-const createAdmin = ({ resources: appResources, views: appViews = [], pages = [], userMenu, bottomBars = [], db, authenticate, auth, functions = {}, files: filesOptions, events, history: historyOptions, jobs = [], subscriptions = [], webhooks: webhooksOptions, bundlePlugins = [], fieldTypes = {}, options = {} }) => {
+const createAdmin = ({ resources: appResources, views: appViews = [], pages = [], userMenu, bottomBars = [], db, authenticate, auth, functions = {}, files: filesOptions, events, history: historyOptions, jobs = [], subscriptions = [], webhooks: webhooksOptions, bundlePlugins = [], fieldTypes = {}, options = {}, formsDifficulty, commentUsers: givenCommentUsers }) => {
 	const basePath = options.basePath ?? "/api/v1";
 	const appModels = appResources.map((resource) => resource.toModel());
-	const withJobs = jobs.length > 0 || appModels.some(isCaptured);
+	const withComments = appModels.some((model) => model.comments);
+	const withAiFields = hasAiFields(appModels);
+	const withJobs = jobs.length > 0 || appModels.some(isCaptured) || withComments || withAiFields;
 	const withHistory = appModels.some((model) => model.history);
 	const changes = changesSchema(events);
 	const days = historyDays(historyOptions);
 	const resources = [
 		...appResources,
 		...withJobs ? [failedJobs] : [],
-		...withHistory ? [activityResource(changes, { tenant: appModels.some((model) => model.history && model.tenant) })] : []
+		...withHistory ? [activityResource(changes, { tenant: appModels.some((model) => model.history && model.tenant) })] : [],
+		...withComments ? [commentsResource({ tenant: appModels.some((model) => model.comments && model.tenant) })] : []
 	];
 	const views = [
 		...appViews,
 		...withJobs ? [failedJobsView] : [],
-		...withHistory ? [activityView] : []
+		...withHistory ? [activityView] : [],
+		...withComments ? [commentsView] : []
 	];
+	const commentUsers = withComments ? givenCommentUsers ?? (auth && betterAuthCommentUsers(auth)) : void 0;
+	const mentions = withComments ? mentionJob(commentUsers, auth?.appName ?? readAppName(globalThis.process?.env ?? {}) ?? "Protobase") : void 0;
 	const registry = buildRegistry(resources);
 	const apiFunctions = Object.fromEntries(Object.entries(functions).map(([name, source]) => [name, toApiFunction(name, source)]));
 	const viewModels = views.map((view) => view.toModel());
@@ -83,6 +98,13 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 		models: Object.fromEntries(registry.entries.map((entry) => [entry.name, entry.model])),
 		actions: (resource) => new Set(viewModels.filter((view) => view.resource === resource).flatMap((view) => view.actions.map((action) => action.name)))
 	});
+	const forms = createFormsRuntime({
+		registry,
+		views: viewModels,
+		limits: options.roles?.limits ?? [],
+		env: globalThis.process?.env ?? {},
+		...formsDifficulty && { difficulty: formsDifficulty }
+	});
 	const systemPath = basePath.slice(0, basePath.lastIndexOf("/"));
 	const assistant = assistantSettings(options.assistant, globalThis.process?.env ?? {});
 	const runtime = runtimeUrl(options.runtime, globalThis.process?.env ?? {});
@@ -101,6 +123,9 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 		systemPath
 	});
 	const table = webhooksOptions && webhookTable(webhooksOptions, auth);
+	const withAi = withAiFields || hasAiActions(viewModels);
+	const model = withAi ? aiModel(options.assistant, globalThis.process?.env ?? {}) : void 0;
+	const fill = withAiFields ? fillJob(() => deps) : void 0;
 	const deps = {
 		db,
 		registry,
@@ -112,7 +137,11 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 		systemPath,
 		statementTimeoutMs: options.statementTimeoutMs ?? 15e3,
 		guard: createScanGuard(db, options.scanGuard),
-		hooks: [...options.writeHooks ?? [], ...table ? [subscriptionWriteCheck(registry.entries.map((entry) => entry.model), table.checkUrl)] : []],
+		hooks: [
+			...options.writeHooks ?? [],
+			...table ? [subscriptionWriteCheck(registry.entries.map((entry) => entry.model), table.checkUrl)] : [],
+			...fill ? [fillHook(() => deps, fill)] : []
+		],
 		audit: options.audit ?? consoleAuditQueue(),
 		accessOptions: {
 			...options.roles && { roles: options.roles },
@@ -130,6 +159,15 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 		...withHistory && { history: {
 			schema: changes,
 			...auth && { actorNames: betterAuthActorNames(auth) }
+		} },
+		...mentions && { comments: {
+			...commentUsers && { users: commentUsers },
+			mentionJob: mentions,
+			appOrigin: appOrigin(auth?.origins ?? [])
+		} },
+		...withAi && { ai: {
+			...model && { model },
+			...options.onUnhandledError && { report: options.onUnhandledError }
 		} }
 	};
 	const meta = createMeta(deps, auth?.appName ?? readAppName(globalThis.process?.env ?? {}) ?? "Protobase");
@@ -173,7 +211,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	}
 	if (auth) {
 		app.route(authBasePath, statusRoute(auth, {
-			anonymous: Object.hasOwn(options.roles?.definitions ?? {}, anonymousRole),
+			anonymous: visitorsBrowse(options.roles),
 			plugins: pluginsBeforeSignIn(plugins)
 		}));
 		if (auth.organizations) app.route(authBasePath, organizationRoutes({
@@ -209,6 +247,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	}));
 	app.route("/", batchRoute(deps, authenticate, meta));
 	app.route("/", fileRoutes(deps, authenticate));
+	if (forms) app.route(`${systemPath}/forms`, formRoutes(deps, forms));
 	app.route(basePath, api);
 	app.route(`${deps.systemPath}/meta`, metaApp);
 	app.route(deps.systemPath || "/", system);
@@ -220,7 +259,12 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 		log: (line) => console.log(line),
 		...table && { table }
 	});
-	return Object.assign(app, { jobs: [...webhooks.jobs, ...withHistory && days !== void 0 ? [pruneHistoryJob(changes, days)] : []] });
+	return Object.assign(app, { jobs: [
+		...webhooks.jobs,
+		...withHistory && days !== void 0 ? [pruneHistoryJob(changes, days)] : [],
+		...mentions ? [mentions] : [],
+		...fill ? [fill] : []
+	] });
 };
 //#endregion
 export { createAdmin };

package/dist/deps.d.ts

@@ -1,4 +1,6 @@
 import "./types.js";
+import "./comments/comment-users.js";
+import "./comments/mention-job.js";
 import "./files/runtime.js";
 import "./plugins/plugin-settings.js";
 import "./registry.js";

package/dist/error-handler.js

@@ -1,6 +1,6 @@
 import { HttpProblem, problemResponse } from "./problem.js";
-import { HTTPException } from "hono/http-exception";
 import { QueryError } from "@protobase/query";
+import { HTTPException } from "hono/http-exception";
 //#region src/error-handler.ts
 const titles = {
 	400: "Bad Request",

package/dist/files/attach.js

@@ -1,8 +1,8 @@
 import { badRequest } from "../problem.js";
+import { tenantScope } from "../tenant.js";
 import { accepts } from "./media-types.js";
 import { externalFile, parseExternalUrl } from "./external-url.js";
 import { baseOf, parseUri, variantPaths } from "./uri.js";
-import { tenantScope } from "../tenant.js";
 import { readTicket } from "./ticket.js";
 //#region src/files/attach.ts
 /** The ticket scope of a caller's upload for one field. */

package/dist/files/upload.js

@@ -1,8 +1,8 @@
 import { HttpProblem, badRequest } from "../problem.js";
-import { accepts, servedType } from "./media-types.js";
-import { cleanName, tenantSegment, variantPath } from "./uri.js";
 import { tenantScope } from "../tenant.js";
 import { requestAccess, requireOperation, writableFields } from "../request-access.js";
+import { accepts, servedType } from "./media-types.js";
+import { cleanName, tenantSegment, variantPath } from "./uri.js";
 import { issueTicket } from "./ticket.js";
 import { ticketScope } from "./attach.js";
 import { ticketSeconds } from "./runtime.js";

package/dist/forms/challenge.d.ts

@@ -0,0 +1,8 @@
+import "altcha-lib";
+//#region src/forms/challenge.d.ts
+/** The range of rounds a challenge is made for. */
+export type Difficulty = {
+  min: number;
+  max: number;
+};
+//#endregion

package/dist/forms/challenge.js

@@ -0,0 +1,71 @@
+import { CappedMap, createChallenge, randomInt, verifySolution } from "altcha-lib";
+import { deriveKey } from "altcha-lib/algorithms/web/sha";
+//#region src/forms/challenge.ts
+/**
+* How many SHA-256 rounds a visitor's browser runs to send a form: the challenge is made for one count in this range,
+* and the solver counts up to it. About a second in Chromium on a current laptop: 0.4 s at the low end and 1.1 s at
+* the high end, measured on an Apple M1 Pro.
+*/
+const formDifficulty = {
+	min: 5e4,
+	max: 1e5
+};
+const expiresInSeconds = 300;
+const spentCapacity = 1e4;
+const encoder = new TextEncoder();
+const toHex = (bytes) => [...new Uint8Array(bytes)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+const purposeKey = async (secret, info) => {
+	const material = await crypto.subtle.importKey("raw", encoder.encode(secret), "HKDF", false, ["deriveBits"]);
+	return toHex(await crypto.subtle.deriveBits({
+		name: "HKDF",
+		hash: "SHA-256",
+		salt: /* @__PURE__ */ new Uint8Array(0),
+		info: encoder.encode(info)
+	}, material, 256));
+};
+const isProof = (value) => {
+	if (typeof value !== "object" || value === null) return false;
+	const { challenge, solution } = value;
+	return typeof challenge === "object" && challenge !== null && typeof challenge.parameters === "object" && typeof solution === "object" && solution !== null;
+};
+/**
+* The bot check of public forms: a signed proof-of-work challenge (ALTCHA) per submission, made for one form and valid
+* for five minutes, which verifies once. The secret signs the challenges, so they verify on every instance that shares it.
+*/
+const createFormChallenges = (secret, { difficulty = formDifficulty, now = Date.now } = {}) => {
+	const keys = Promise.all([purposeKey(secret, "protobase forms challenge"), purposeKey(secret, "protobase forms key")]);
+	const spent = new CappedMap({ maxSize: spentCapacity });
+	const issue = async (form) => {
+		const [hmacSignatureSecret, hmacKeySignatureSecret] = await keys;
+		return createChallenge({
+			algorithm: "SHA-256",
+			cost: 1,
+			deriveKey,
+			counter: randomInt(difficulty.max, difficulty.min),
+			data: { form },
+			expiresAt: Math.floor(now() / 1e3) + expiresInSeconds,
+			hmacSignatureSecret,
+			hmacKeySignatureSecret
+		});
+	};
+	const verify = async (form, proof) => {
+		if (!isProof(proof) || proof.challenge.parameters.data?.form !== form) return "invalid";
+		const [hmacSignatureSecret, hmacKeySignatureSecret] = await keys;
+		const result = await verifySolution({
+			challenge: proof.challenge,
+			solution: proof.solution,
+			deriveKey,
+			hmacSignatureSecret,
+			hmacKeySignatureSecret
+		});
+		if (result.expired) return "expired";
+		if (!result.verified) return "invalid";
+		return spent.setIfAbsent(proof.challenge.signature, true) ? "ok" : "replayed";
+	};
+	return {
+		issue,
+		verify
+	};
+};
+//#endregion
+export { createFormChallenges, formDifficulty };

package/dist/forms/check-forms.js

@@ -0,0 +1,59 @@
+import { requiredOnCreate } from "../validate-body.js";
+//#region src/forms/check-forms.ts
+const plainTypes = [
+	"text",
+	"integer",
+	"bigint",
+	"decimal",
+	"boolean",
+	"date",
+	"enum",
+	"currency",
+	"country"
+];
+const fieldErrors = (registry, { form, view }, granted) => {
+	const entry = registry.find(view.resource);
+	if (!entry) return [];
+	const { model } = entry;
+	if (!granted) return [`the anonymous role must grant creating its fields: { '${view.resource}.create': [${form.fields.map((name) => `'${name}'`).join(", ")}] }`];
+	const fields = form.fields.flatMap((name) => {
+		const field = model.fields[name];
+		if (!field) return [`field "${name}" does not exist on ${view.resource}`];
+		if (field.readOnly) return [`field "${name}" is read-only, so nobody fills it in`];
+		if (field.sensitive) return [`field "${name}" is sensitive, and a public form does not take sensitive fields`];
+		if (field.type === "relation") return [`field "${name}" is a relation, whose records a visitor cannot read to pick one`];
+		if (field.type === "file") return [`field "${name}" is a file field, and a visitor cannot upload`];
+		if (!plainTypes.includes(field.type)) return [`field "${name}" is ${field.type}, which a form has no input for`];
+		if (name === model.tenant) return [`field "${name}" is the tenant, which the server sets`];
+		if (!granted.includes(name)) return [`the anonymous role does not create "${name}": add it to { '${view.resource}.create': [...] }`];
+		return [];
+	});
+	const sources = entry.source.state.fields ?? {};
+	const missing = Object.values(model.fields).filter((field) => !field.readOnly && field.name !== model.tenant && !form.fields.includes(field.name)).filter((field) => sources[field.name] && requiredOnCreate(field, sources[field.name].schema)).map((field) => `it leaves out "${field.name}", which every create must give, so no submission could be saved`);
+	return [...fields, ...missing];
+};
+/**
+* What stops startup about the public forms: a name two forms share, a resource that does not exist, and fields a
+* visitor cannot fill in, the anonymous role does not create, or that leave out a field the create needs. Identical forms
+* on several views of one resource, such as one view built on another, count as one. Returns the forms by name.
+*/
+const checkForms = (registry, declared, anonymousCreates) => {
+	const forms = /* @__PURE__ */ new Map();
+	const problems = [];
+	for (const item of declared) {
+		const { form, view } = item;
+		const where = `View "${view.resource}": form "${form.name}"`;
+		const taken = forms.get(form.name);
+		if (taken) {
+			if (!(taken.view.resource === view.resource && JSON.stringify(taken.form) === JSON.stringify(form))) problems.push(`${where}: the name is taken by a form of ${taken.view.resource}; form names are unique across the app`);
+			continue;
+		}
+		forms.set(form.name, item);
+		if (!registry.find(view.resource)) problems.push(`${where}: there is no resource "${view.resource}"`);
+		problems.push(...fieldErrors(registry, item, anonymousCreates(view.resource)).map((problem) => `${where}: ${problem}`));
+	}
+	if (problems.length > 0) throw new Error(`The public forms cannot be served:\n${problems.map((problem) => `  - ${problem}`).join("\n")}`);
+	return forms;
+};
+//#endregion
+export { checkForms };

package/dist/forms/rate-limit.js

@@ -0,0 +1,38 @@
+import { getIP } from "better-auth/api";
+//#region src/forms/rate-limit.ts
+const windowMs = 6e4;
+/**
+* The client a request counts against, as Better Auth's sign-in limit reads it: an `X-Forwarded-For` of one valid
+* address (IPv6 by its /64), or `unknown`, one bucket for every request without one (several addresses included, since
+* the leftmost is whatever the client sent). In development and tests a request without one is `127.0.0.1`.
+*/
+const clientAddress = (headers) => getIP(headers, {}) ?? "unknown";
+/**
+* At most `perMinute` takes per key in a fixed window of a minute, kept in this process. Keys whose window has passed are
+* dropped as new ones come, so memory follows the clients of the last minute.
+*/
+const createRateLimit = ({ now = Date.now } = {}) => {
+	const windows = /* @__PURE__ */ new Map();
+	const prune = (at) => {
+		for (const [key, window] of windows) if (at - window.start >= windowMs) windows.delete(key);
+	};
+	/** Counts a take for `key`: `0` when allowed, else the seconds until its window lets it through again. */
+	const take = (key, perMinute) => {
+		const at = now();
+		const current = windows.get(key);
+		if (!current || at - current.start >= windowMs) {
+			prune(at);
+			windows.set(key, {
+				start: at,
+				count: 1
+			});
+			return 0;
+		}
+		if (current.count >= perMinute) return Math.ceil((current.start + windowMs - at) / 1e3);
+		current.count += 1;
+		return 0;
+	};
+	return { take };
+};
+//#endregion
+export { clientAddress, createRateLimit };

package/dist/forms/routes.js

@@ -0,0 +1,83 @@
+import { HttpProblem, badRequest, notFound } from "../problem.js";
+import { runWrite } from "../write-pipeline.js";
+import { anonymousSession } from "../anonymous.js";
+import { pruneView } from "../view-access.js";
+import { clientAddress } from "./rate-limit.js";
+import { Hono } from "hono";
+import { restrictModel } from "@protobase/schema";
+//#region src/forms/routes.ts
+const refusedProof = {
+	invalid: "The check that you are not a bot failed; send the form again",
+	expired: "The check that you are not a bot expired; send the form again",
+	replayed: "This check was already used; send the form again"
+};
+const formPage = (deps, { form, view }) => {
+	const entry = deps.registry.find(view.resource);
+	const model = restrictModel(entry.model, {
+		readableFields: form.fields,
+		writableFields: {
+			create: form.fields,
+			update: []
+		}
+	});
+	const pruned = pruneView(view, model, { [model.name]: model });
+	const shown = {
+		resource: view.resource,
+		...view.names && { names: view.names },
+		fields: pruned.fields,
+		filters: [],
+		layout: [],
+		actions: []
+	};
+	return {
+		name: form.name,
+		...form.title !== void 0 && { title: form.title },
+		fields: form.fields,
+		thanks: form.thanks,
+		resource: model,
+		view: shown
+	};
+};
+/**
+* Beside the API, without sign-in: `GET <systemPath>/forms/<name>` describes a public form, `GET .../<name>:challenge`
+* hands out a bot check, and `POST .../<name>` with `{ values, proof }` creates the record as the anonymous role, limited
+* to the form's fields, after the rate limit and the check. It answers `204`: the visitor never reads the record back.
+*/
+const formRoutes = (deps, runtime) => {
+	const app = new Hono();
+	const find = (target) => {
+		const colon = target.indexOf(":");
+		const declared = runtime.forms.get(colon < 0 ? target : target.slice(0, colon));
+		if (!declared) throw notFound(`There is no form "${colon < 0 ? target : target.slice(0, colon)}"`);
+		return {
+			declared,
+			action: colon < 0 ? "" : target.slice(colon + 1)
+		};
+	};
+	app.get("/:target", async (c) => {
+		const { declared, action } = find(c.req.param("target"));
+		if (action === "challenge") return c.json(await runtime.challenges.issue(declared.form.name), 200, { "Cache-Control": "no-store" });
+		if (action !== "") throw notFound(`There is no method ":${action}"`);
+		return c.json(formPage(deps, declared));
+	});
+	app.post("/:target", async (c) => {
+		const { declared, action } = find(c.req.param("target"));
+		if (action !== "") throw notFound(`There is no method ":${action}"`);
+		const { form, view } = declared;
+		const wait = runtime.limit.take(`${form.name}|${clientAddress(c.req.raw.headers)}`, form.perMinute);
+		if (wait > 0) throw new HttpProblem(429, "too-many-submissions", "Too Many Requests", "This form was sent too often; wait a minute and send it again", {}, { "Retry-After": String(wait) });
+		const body = await c.req.json();
+		if (typeof body !== "object" || body === null || Array.isArray(body)) throw badRequest("invalid-submission", "Send the form as { values, proof }");
+		const { values, proof } = body;
+		const verdict = await runtime.challenges.verify(form.name, proof);
+		if (verdict !== "ok") throw badRequest("bot-check-failed", refusedProof[verdict]);
+		await runWrite(deps, deps.registry.find(view.resource), anonymousSession(), {
+			operation: "create",
+			body: values
+		}, form);
+		return c.body(null, 204);
+	});
+	return app;
+};
+//#endregion
+export { formRoutes };

package/dist/forms/runtime.js

@@ -0,0 +1,31 @@
+import { createRateLimit } from "./rate-limit.js";
+import { createFormChallenges } from "./challenge.js";
+import { checkForms } from "./check-forms.js";
+import { anonymousRole } from "@protobase/schema";
+//#region src/forms/runtime.ts
+/** The fields the anonymous role may create on `resource`, or `undefined` when it may not create there. */
+const anonymousCreates = (limits) => (resource) => {
+	const held = limits.filter((limit) => limit.role === anonymousRole && limit.capability === `${resource}.create`);
+	return held.length === 0 ? void 0 : held.flatMap((limit) => limit.fields ?? []);
+};
+/**
+* The public forms of the views, checked, with the challenges that guard them and their rate limit; `undefined` without
+* any. Fails at startup on a form that cannot be served and when nothing signs the challenges.
+*/
+const createFormsRuntime = ({ registry, views, limits, env, difficulty }) => {
+	const declared = [...views].sort((a, b) => Number(a.roles !== void 0) - Number(b.roles !== void 0)).flatMap((view) => (view.forms ?? []).map((form) => ({
+		form,
+		view
+	})));
+	if (declared.length === 0) return void 0;
+	const forms = checkForms(registry, declared, anonymousCreates(limits));
+	const secret = env.PROTOBASE_FORMS_SECRET ?? env.BETTER_AUTH_SECRET;
+	if (!secret) throw new Error("Public forms need a secret to sign their bot checks: set PROTOBASE_FORMS_SECRET or BETTER_AUTH_SECRET");
+	return {
+		forms,
+		challenges: createFormChallenges(secret, { ...difficulty && { difficulty } }),
+		limit: createRateLimit()
+	};
+};
+//#endregion
+export { createFormsRuntime };

package/dist/history/read-history.js

@@ -6,14 +6,15 @@ import { fetchReadable } from "../read-service.js";
 import { quoteIdent } from "../changes/capture-sql.js";
 import { parseParams } from "../params.js";
 import { encodeKey } from "@protobase/schema/internal";
-import { sql } from "kysely";
 import { z } from "zod";
+import { sql } from "kysely";
 //#region src/history/read-history.ts
 const params = z.object({
 	page_size: z.coerce.number().int().min(0).max(100).optional(),
 	page_token: z.string().regex(/^\d+$/, "Use the next_page_token of the previous page").optional()
 });
 const defaultPageSize = 20;
+const visitorName = "Visitor";
 const picked = (row, names) => row ? Object.fromEntries(Object.entries(row).filter(([name]) => names.has(name))) : void 0;
 const shown = (row, readable, names) => {
 	const values = new Set(Object.values(readable.fields).filter((field) => !field.sensitive && !field.file).map((field) => field.name));
@@ -21,7 +22,7 @@ const shown = (row, readable, names) => {
 	if (row.operation === "update" && changed.length === 0) return [];
 	const before = picked(row.before, values);
 	const after = picked(row.after, values);
-	const name = row.actor_id === null ? void 0 : names[row.actor_id];
+	const name = row.actor_id === null ? void 0 : row.actor_id === "" ? visitorName : names[row.actor_id];
 	return [{
 		id: row.id,
 		at: row.at,
@@ -61,7 +62,7 @@ const readHistory = async (deps, entry, session, key, query) => {
 	});
 	if (!rows) throw notFound(`No ${entry.name} with this key`);
 	const page = rows.slice(0, size);
-	const ids = [...new Set(page.flatMap((row) => row.actor_id === null ? [] : [row.actor_id]))];
+	const ids = [...new Set(page.flatMap((row) => row.actor_id === null || row.actor_id === "" ? [] : [row.actor_id]))];
 	const names = ids.length > 0 && actorNames ? await actorNames(ids) : {};
 	return {
 		items: page.flatMap((row) => shown(row, access.readable, names)),

package/dist/index.d.ts

@@ -9,16 +9,18 @@ import { PlatformSignIn, readPlatformSignIn } from "./better-auth/platform-sign-
 import { EmailComponent, EmailOptions, EmailTemplate, RenderedEmail, defineEmail } from "./mail/define-email.js";
 import { AdminAuth, CreateAuthOptions, UserCreatedHook, createAuth, normalizeRoles } from "./better-auth/create-auth.js";
 import { EventsOptions } from "./changes/events-options.js";
-import { HistoryOptions } from "./history/options.js";
 import { StandardSchema, readJson } from "./functions/read-json.js";
 import { EnqueueOptions, JobContext, JobDefinition, JobOptions } from "./jobs/job-types.js";
 import { Admin, AuditEvent, AuditQueue, Authenticator, PipelineHook, ScanGuardMode, Session, SessionOrganization, TenantValue, User, ViewSource, WriteEvent, WriteOperation } from "./types.js";
+import { CommentUsers } from "./comments/comment-users.js";
+import { HistoryOptions } from "./history/options.js";
 import { WebhooksOptions } from "./webhooks/table/options.js";
 import { EventData, RunContext, SubscriptionDefinition, SubscriptionEvent, SubscriptionOptions, subscription } from "./webhooks/subscription.js";
 import { Sharp, renderVariant, thumbHash } from "./files/images.js";
 import { FileProvider, FileStore, StoredObject } from "./files/store.js";
 import { FilesOptions } from "./files/options.js";
 import { ErrorReportingOptions, ErrorReportingSettings, errorReportingSettings, errorReportingVariable } from "./error-reporting/error-reporting-settings.js";
+import { ChatMessage, ChatTextPart, Completion, CompletionOptions, ModelError, ModelSettings, ReasoningDetail, ReasoningEffort, ToolCall, ToolSpec, streamChatCompletion } from "./assistant/chat-completions.js";
 import { CleanupEntry, CleanupSchedule, ScheduledDelete, storageCleanupSchedule } from "./files/cleanup-schedule.js";
 import { CleanupReport } from "./files/cleanup-runner.js";
 import { MapLayer } from "./maps/map-layers.js";
@@ -30,7 +32,6 @@ import { RecordKeyInput, ToolRecord, ToolRecords } from "./assistant/records.js"
 import { FunctionRecords, ListParams, RecordPage } from "./functions/records.js";
 import { ApiFunction, CorsOptions, FunctionApp, FunctionCaller, FunctionContext, FunctionHandler, FunctionOptions, FunctionSource, ProtectedFunctionOptions, PublicFunctionContext, PublicFunctionHandler, PublicFunctionOptions, defineFunction } from "./functions/define-function.js";
 import { CorsOrigins } from "./api-cors.js";
-import { ChatMessage, ChatTextPart, Completion, CompletionOptions, ModelError, ModelSettings, ReasoningDetail, ReasoningEffort, ToolCall, ToolSpec, streamChatCompletion } from "./assistant/chat-completions.js";
 import { ConversationRecord, ConversationStore } from "./assistant/conversation-store.js";
 import { Conversation, ConversationsOptions, conversationKey, createConversations } from "./assistant/conversations.js";
 import { ApprovalAnswer, ApprovalRequest, requestApproval } from "./assistant/approval.js";
@@ -61,6 +62,9 @@ import { parseColumns, readOutbox } from "./changes/outbox.js";
 import { newWebhookSecret } from "./webhooks/standard-webhooks.js";
 import { webhooks } from "./webhooks/table/plugin.js";
 import { checkWebhooksSchema, webhooksMigration } from "./webhooks/table/schema.js";
+import { checkComments, commentsMigration } from "./comments/comments-sql.js";
+import { CheckAiInput, checkAi } from "./ai/check-ai.js";
+import { CommentItem } from "./comments/comment-item.js";
 import { MemberInput, NewOrganization, addAppRoleToOwners, addMember, createOrganization, listOrganizations, removeMember, setMemberRoles } from "./better-auth/organizations/host.js";
 import { AssistantBackend, assistantProtocolRoutes } from "./assistant/protocol-routes.js";
 import { fileConversationStore } from "./assistant/file-conversation-store.js";
@@ -87,4 +91,4 @@ import { FatalJobError } from "./jobs/run-job.js";
 import { DrainResult, JobsRuntime, StartJobsOptions, startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
 import { checkJobsSchema, jobsSchema, jobsSchemaMigration } from "./jobs/schema.js";
-export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticatorOptions, type CapturedRow, type ChatMessage, type ChatTextPart, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSource, type HistoryOptions, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type MemberInput, MissingCredentials, ModelError, type ModelSettings, type NewOrganization, type NewUser, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, addAppRoleToOwners, addMember, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, changesMigration, checkAuthSchema, checkChanges, checkJobsSchema, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, handleDroppedConnections, hasUsers, imageSize, isCaptured, isJobDefinition, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storeFile, streamChatCompletion, subscription, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };
+export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticatorOptions, type CapturedRow, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSource, type HistoryOptions, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type MemberInput, MissingCredentials, ModelError, type ModelSettings, type NewOrganization, type NewUser, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, addAppRoleToOwners, addMember, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkJobsSchema, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, handleDroppedConnections, hasUsers, imageSize, isCaptured, isJobDefinition, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storeFile, streamChatCompletion, subscription, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };