@protobase/server 0.21.7 → 0.21.8

package/dist/aggregate-groups.js

@@ -3,8 +3,8 @@ import { readTransaction } from "./transactions.js";
 import { parseParams } from "./params.js";
 import { labelRequests, relatedLabels } from "./related-labels.js";
 import { scoped, seriesRange } from "./aggregate-service.js";
-import { groupTotals, series } from "@protobase/query";
 import { z } from "zod";
+import { groupTotals, series } from "@protobase/query";
 //#region src/aggregate-groups.ts
 const name = z.string().min(1);
 const aggregateParams = z.object({

package/dist/aggregate-service.js

@@ -1,13 +1,13 @@
 import { badRequest } from "./problem.js";
-import { columnId, filterCondition, scopeConditions, tableId, whereClause } from "./sql-parts.js";
 import { checkedFilter } from "./filter-input.js";
 import { readScope, requestAccess, requireOperation } from "./request-access.js";
+import { columnId, filterCondition, scopeConditions, tableId, whereClause } from "./sql-parts.js";
 import { readTransaction } from "./transactions.js";
 import { parseParams } from "./params.js";
 import { labelRequests, relatedLabels } from "./related-labels.js";
-import { facetCounts, histogram, series, withoutField } from "@protobase/query";
-import { sql } from "kysely";
 import { z } from "zod";
+import { sql } from "kysely";
+import { facetCounts, histogram, series, withoutField } from "@protobase/query";
 //#region src/aggregate-service.ts
 const field = z.string().min(1);
 const filter = z.string().optional();

package/dist/ai/ai-fields.js

@@ -0,0 +1,9 @@
+//#region src/ai/ai-fields.ts
+/** The fields of a resource a job fills from a prompt (`.ai()`). */
+const aiFields = (model) => Object.values(model.fields).filter((field) => field.ai);
+/** Whether a resource has a field a job fills from a prompt. */
+const hasAiFields = (models) => models.some((model) => aiFields(model).length > 0);
+/** Whether a view has an action that has the model write a field (`a.ai`). */
+const hasAiActions = (views) => views.some((view) => view.actions.some((action) => action.run?.kind === "ai"));
+//#endregion
+export { aiFields, hasAiActions, hasAiFields };

package/dist/ai/ai-model.js

@@ -0,0 +1,9 @@
+import { modelSettings } from "../assistant/model-settings.js";
+//#region src/ai/ai-model.ts
+/**
+* The model AI fields and actions call: the assistant's, also when `url` names a chat backend elsewhere (it replaces the
+* chat, not the model) and when the option is `false` (which turns off the chat only).
+*/
+const aiModel = (option, env) => modelSettings(option === false ? void 0 : option, env);
+//#endregion
+export { aiModel };

package/dist/ai/check-ai.d.ts

@@ -0,0 +1,13 @@
+import { AssistantOptions } from "../assistant/assistant-settings.js";
+import { ResourceModel, ViewModel } from "@protobase/schema";
+//#region src/ai/check-ai.d.ts
+export type CheckAiInput = {
+  models: readonly ResourceModel[];
+  views: readonly ViewModel[];
+  /** The project's `options.assistant`, whose model settings AI fields and actions use. */
+  assistant: AssistantOptions | false | undefined;
+  env: Record<string, string | undefined>;
+};
+/** Fails when a resource has an AI field or a view an AI action and no model is set to fill or run them. */
+export declare const checkAi: ({ models, views, assistant, env }: CheckAiInput) => void;
+//#endregion

package/dist/ai/check-ai.js

@@ -0,0 +1,11 @@
+import { aiModel } from "./ai-model.js";
+import { hasAiActions, hasAiFields } from "./ai-fields.js";
+//#region src/ai/check-ai.ts
+/** Fails when a resource has an AI field or a view an AI action and no model is set to fill or run them. */
+const checkAi = ({ models, views, assistant, env }) => {
+	if (!hasAiFields(models) && !hasAiActions(views)) return;
+	if (aiModel(assistant, env)) return;
+	throw new Error("AI fields and actions need a model: set PROTOBASE_ASSISTANT_API_KEY (and PROTOBASE_ASSISTANT_MODEL when PROTOBASE_ASSISTANT_BASE_URL is not OpenRouter), or options.assistant.apiKey");
+};
+//#endregion
+export { checkAi };

package/dist/ai/fill-hook.js

@@ -0,0 +1,47 @@
+import { aiFields } from "./ai-fields.js";
+import { requestAccess, writableFields } from "../request-access.js";
+import { isEmpty, same, writerSession } from "./values.js";
+import { encodeKey, promptFields } from "@protobase/schema/internal";
+//#region src/ai/fill-hook.ts
+const wantsFill = (event, field, after) => {
+	const reads = promptFields(field.ai.prompt);
+	if (event.operation === "create") return isEmpty(after[field.name]) && reads.some((name) => !isEmpty(after[name]));
+	if (event.operation !== "update" || !event.before) return false;
+	const before = event.before;
+	return reads.some((name) => !same(before[name], after[name])) && same(before[field.name], after[field.name]);
+};
+/**
+* The write hook that enqueues the `ai.fill` job of each AI field a write calls for, in the write's transaction, one
+* waiting job per record and field with the latest writer. The job writes as the writer, so a visitor without a token
+* (a public form) or a writer who may not read what the prompt reads or update the field gets no fill.
+*/
+const fillHook = (depsOf, job) => async (event, trx) => {
+	const { after } = event;
+	if (!after || event.anonymous) return;
+	const wanted = aiFields(event.resource).filter((field) => wantsFill(event, field, after));
+	if (wanted.length === 0) return;
+	const deps = depsOf();
+	const entry = deps.registry.find(event.resource.name);
+	const access = await requestAccess(deps, entry, writerSession(event.user, event.tenant));
+	const updatable = access.resolved.operations.update ? writableFields(access, "update") : [];
+	const key = encodeKey(event.resource.primaryKey.map((name) => after[name]));
+	for (const field of wanted) {
+		if (!(updatable.includes(field.name) && promptFields(field.ai.prompt).every((name) => Object.hasOwn(access.model.fields, name)))) continue;
+		const payload = {
+			resource: event.resource.name,
+			key,
+			field: field.name,
+			user: {
+				id: event.user.id,
+				roles: [...event.user.roles]
+			},
+			...event.tenant !== void 0 && { tenant: event.tenant }
+		};
+		await job.enqueue(trx, payload, {
+			key: `ai:${event.resource.name}:${key}:${field.name}`,
+			mode: "replace"
+		});
+	}
+};
+//#endregion
+export { fillHook };

package/dist/ai/fill-job.js

@@ -0,0 +1,67 @@
+import { HttpProblem } from "../problem.js";
+import { same, writerSession } from "./values.js";
+import { assistantRecords } from "../assistant/records.js";
+import { defineJob } from "../jobs/define-job.js";
+import { FatalJobError } from "../jobs/run-job.js";
+import { generateValue } from "./generate-value.js";
+import { promptFields } from "@protobase/schema/internal";
+import { z } from "zod";
+//#region src/ai/fill-job.ts
+const payload = z.object({
+	resource: z.string(),
+	key: z.string(),
+	field: z.string(),
+	user: z.object({
+		id: z.union([z.string(), z.number()]),
+		roles: z.array(z.string())
+	}),
+	tenant: z.union([z.string(), z.number()]).optional()
+});
+const current = async (read) => {
+	try {
+		return await read;
+	} catch (error) {
+		if (error instanceof HttpProblem && error.status === 404) return void 0;
+		if (error instanceof HttpProblem && error.status === 403) throw new FatalJobError(error.message);
+		throw error;
+	}
+};
+/**
+* The job that fills an AI field (`.ai()`) from its prompt, as the user whose write enqueued it. It writes nothing when
+* the record is gone, when a field the prompt reads changed while the model answered (that change enqueued a newer job),
+* or when the value is the one stored; when every field the prompt reads is empty the field is cleared. A model that
+* fails, or a record changed between the read and the write, is retried.
+*/
+const fillJob = (depsOf) => defineJob({
+	name: "ai.fill",
+	payload,
+	maxAttempts: 5,
+	retryDelay: "30 seconds",
+	concurrency: 4,
+	run: async (job, { signal }) => {
+		const deps = depsOf();
+		const field = deps.registry.find(job.resource)?.model.fields[job.field];
+		if (!field?.ai) throw new FatalJobError(`${job.resource} has no AI field "${job.field}"`);
+		const model = deps.ai?.model;
+		if (!model) throw new Error("AI fields need a model: set PROTOBASE_ASSISTANT_API_KEY");
+		const records = assistantRecords(deps, writerSession(job.user, job.tenant));
+		const read = await current(records.get(job.resource, job.key));
+		if (!read) return;
+		const value = await generateValue(model, {
+			prompt: field.ai.prompt,
+			record: read.record,
+			field
+		}, signal);
+		const now = await current(records.get(job.resource, job.key));
+		if (!now || promptFields(field.ai.prompt).some((name) => !same(now.record[name], read.record[name]))) return;
+		if (same(now.record[job.field] ?? null, value)) return;
+		try {
+			await records.update(job.resource, job.key, { [job.field]: value }, { etag: now.etag });
+		} catch (error) {
+			if (error instanceof HttpProblem && error.status === 403) throw new FatalJobError(error.message);
+			throw error;
+		}
+	}
+});
+//#endregion
+export { fillJob };

package/dist/ai/generate-route.js

@@ -0,0 +1,57 @@
+import { HttpProblem, badRequest, forbidden, notFound } from "../problem.js";
+import { readRecord } from "../read-service.js";
+import { runWrite } from "../write-pipeline.js";
+import { ModelError } from "../assistant/chat-completions.js";
+import { generateValue } from "./generate-value.js";
+import { promptFields } from "@protobase/schema/internal";
+import { pickView } from "@protobase/schema";
+//#region src/ai/generate-route.ts
+/** How long the model may take to answer one click. */
+const answerTimeoutMs = 6e4;
+const actionName = (body) => {
+	const action = typeof body === "object" && body !== null ? body.action : void 0;
+	if (typeof action !== "string" || action === "") throw badRequest("invalid-action", "Send the name of the AI action, as { \"action\": \"<name>\" }");
+	return action;
+};
+const aiRun = (deps, entry, session, name) => {
+	const run = pickView(deps.views, session.user.roles, entry.name)?.actions.find((action) => action.name === name)?.run;
+	if (run?.kind !== "ai" || run.prompt === void 0) throw notFound("There is no such AI action");
+	return {
+		prompt: run.prompt,
+		writes: run.writes
+	};
+};
+const unavailable = () => new HttpProblem(502, "ai-unavailable", "Bad Gateway", "The model did not answer. Try again later.");
+/**
+* Runs the AI action `body.action` on a record as the caller (`POST /{resource}/{key}:generate`): reads the record,
+* has the model write the action's field from its prompt, and updates it with the ETag it read, so an edit made while
+* the model answered fails the write with 412 instead of being overwritten. Only a signed-in user whose view has the
+* action, who may read the fields its prompt names and update the field it writes, runs it; nothing is asked of the
+* model before those checks pass. A model that fails is reported to the app and answers 502, without its message.
+*/
+const generateField = async (deps, entry, session, key, body, signal) => {
+	if (session.anonymous) throw forbidden("ai-needs-user", "Sign in to run an AI action");
+	const run = aiRun(deps, entry, session, actionName(body));
+	const model = deps.ai?.model;
+	if (!model) throw new HttpProblem(503, "ai-not-configured", "Service Unavailable", "AI actions need a model: set PROTOBASE_ASSISTANT_API_KEY");
+	const { record, etag, permissions } = await readRecord(deps, entry, session, key);
+	if (!promptFields(run.prompt).every((name) => Object.hasOwn(record, name)) || permissions.fields[run.writes] !== "edit") throw forbidden("ai-forbidden", `You may not run this AI action on this ${entry.name} record`);
+	const value = await generateValue(model, {
+		prompt: run.prompt,
+		record,
+		field: entry.model.fields[run.writes]
+	}, AbortSignal.any([signal, AbortSignal.timeout(answerTimeoutMs)])).catch((error) => {
+		if (!(error instanceof ModelError) && !(error instanceof Error && error.name === "TimeoutError")) throw error;
+		deps.ai?.report?.(error);
+		throw unavailable();
+	});
+	if (value === null) throw new HttpProblem(422, "ai-no-value", "Unprocessable Content", "The fields the prompt reads are empty, or the model gave no answer");
+	return runWrite(deps, entry, session, {
+		operation: "update",
+		key,
+		body: { [run.writes]: value },
+		ifMatch: etag
+	});
+};
+//#endregion
+export { generateField };

package/dist/ai/generate-value.js

@@ -0,0 +1,28 @@
+import "../assistant/model-settings.js";
+import { isEmpty } from "./values.js";
+import { streamChatCompletion } from "../assistant/chat-completions.js";
+import { promptFields, renderPrompt } from "@protobase/schema/internal";
+//#region src/ai/generate-value.ts
+const instruction = "You write the value of one field of a record in a business app. Answer with the value only: no introduction, no quotes, no Markdown code fences.";
+/**
+* The value the model writes for `field` from `prompt` filled with the record's values, trimmed; `null` when every field
+* the prompt reads is empty, without asking the model, or when the model answers nothing. Rejects with a `ModelError`.
+*/
+const generateValue = async (settings, { prompt, record, field }, signal) => {
+	if (promptFields(prompt).every((name) => isEmpty(record[name]))) return null;
+	const choices = field.type === "enum" && field.enumValues ? `\n\nAnswer with exactly one of: ${field.enumValues.join(", ")}` : "";
+	const messages = [{
+		role: "system",
+		content: instruction
+	}, {
+		role: "user",
+		content: `${renderPrompt(prompt, record)}${choices}`
+	}];
+	const { content } = await streamChatCompletion(settings, messages, () => {}, {
+		...signal && { signal },
+		...settings.baseUrl === "https://openrouter.ai/api/v1" && { reasoning: "low" }
+	});
+	return content.trim() || null;
+};
+//#endregion
+export { generateValue };

package/dist/ai/values.js

@@ -0,0 +1,15 @@
+//#region src/ai/values.ts
+/** Whether a field holds nothing the model could read: `null`, missing or blank text. */
+const isEmpty = (value) => value === null || value === void 0 || typeof value === "string" && value.trim() === "";
+/** Whether two values of a record are the same, json and file values by their content. */
+const same = (a, b) => a === b || typeof a === "object" && typeof b === "object" && JSON.stringify(a) === JSON.stringify(b);
+/** The session of a writer as a write hook saw them, in their tenant: what an AI field is filled as. */
+const writerSession = (user, tenant) => ({
+	user,
+	...tenant !== void 0 && {
+		tenant,
+		organization: { id: tenant }
+	}
+});
+//#endregion
+export { isEmpty, same, writerSession };

package/dist/assistant/assistant-settings.d.ts

@@ -26,11 +26,11 @@ export type AssistantSettings = {
   chats: string;
 };
 export declare const assistantVariables: {
-  readonly url: "PROTOBASE_ASSISTANT_URL";
+  readonly chats: "PROTOBASE_ASSISTANT_CHATS";
   readonly apiKey: "PROTOBASE_ASSISTANT_API_KEY";
   readonly model: "PROTOBASE_ASSISTANT_MODEL";
   readonly baseUrl: "PROTOBASE_ASSISTANT_BASE_URL";
-  readonly chats: "PROTOBASE_ASSISTANT_CHATS";
+  readonly url: "PROTOBASE_ASSISTANT_URL";
 };
 /** The roles that see the assistant: `/meta` names it, and the built-in one answers, only for a caller with one of them. */
 export declare const assistantRoles: readonly ["admin", "ai"];

package/dist/assistant/assistant-settings.js

@@ -1,16 +1,13 @@
 import { checkedUrl } from "../checked-url.js";
+import { modelSettings, modelVariables } from "./model-settings.js";
 //#region src/assistant/assistant-settings.ts
 const assistantVariables = {
 	url: "PROTOBASE_ASSISTANT_URL",
-	apiKey: "PROTOBASE_ASSISTANT_API_KEY",
-	model: "PROTOBASE_ASSISTANT_MODEL",
-	baseUrl: "PROTOBASE_ASSISTANT_BASE_URL",
+	...modelVariables,
 	chats: "PROTOBASE_ASSISTANT_CHATS"
 };
 /** Where the built-in assistant keeps conversations without `chats`: relative to the working directory. */
 const defaultChatsDirectory = ".protobase/chats";
-const openRouterUrl = "https://openrouter.ai/api/v1";
-const openRouterModel = "openrouter/auto";
 /** The roles that see the assistant: `/meta` names it, and the built-in one answers, only for a caller with one of them. */
 const assistantRoles = ["admin", "ai"];
 const seesAssistant = (roles) => assistantRoles.some((role) => roles.includes(role));
@@ -21,30 +18,19 @@ const seesAssistant = (roles) => assistantRoles.some((role) => roles.includes(ro
 */
 const assistantSettings = (option, env) => {
 	if (option === false) return void 0;
-	const value = (key) => {
-		return (option?.[key] ?? env[assistantVariables[key]])?.trim() || void 0;
-	};
+	const value = (key) => (option?.[key] ?? env[assistantVariables[key]])?.trim() || void 0;
 	const source = (key) => option?.[key] === void 0 ? assistantVariables[key] : `options.assistant.${key}`;
 	const url = value("url");
 	if (url) return {
 		kind: "external",
 		url: checkedUrl(url, source("url"))
 	};
-	const apiKey = value("apiKey");
-	if (!apiKey) return void 0;
-	const baseUrl = checkedUrl(value("baseUrl") ?? "https://openrouter.ai/api/v1", source("baseUrl"));
-	const model = value("model") ?? (baseUrl === "https://openrouter.ai/api/v1" ? "openrouter/auto" : void 0);
-	if (!model) throw new Error(`${assistantVariables.model} (or options.assistant.model) is required with an endpoint other than OpenRouter's`);
-	return {
+	const model = modelSettings(option, env);
+	return model && {
 		kind: "built-in",
-		model: {
-			baseUrl,
-			apiKey,
-			model,
-			...option && option.fetch && { fetch: option.fetch }
-		},
+		model,
 		chats: value("chats") ?? ".protobase/chats"
 	};
 };
 //#endregion
-export { assistantRoles, assistantSettings, assistantVariables, defaultChatsDirectory, openRouterModel, openRouterUrl, seesAssistant };
+export { assistantRoles, assistantSettings, assistantVariables, defaultChatsDirectory, seesAssistant };

package/dist/assistant/built-in-assistant.js

@@ -1,4 +1,5 @@
-import { openRouterUrl, seesAssistant } from "./assistant-settings.js";
+import { openRouterUrl } from "./model-settings.js";
+import { seesAssistant } from "./assistant-settings.js";
 import { appContext } from "./app-context.js";
 import { conversationKey, createConversations } from "./conversations.js";
 import { fileConversationStore } from "./file-conversation-store.js";

package/dist/assistant/model-settings.js

@@ -0,0 +1,31 @@
+import { checkedUrl } from "../checked-url.js";
+//#region src/assistant/model-settings.ts
+/** The environment variables of the model settings, which `options.assistant`'s keys of the same name win over. */
+const modelVariables = {
+	apiKey: "PROTOBASE_ASSISTANT_API_KEY",
+	model: "PROTOBASE_ASSISTANT_MODEL",
+	baseUrl: "PROTOBASE_ASSISTANT_BASE_URL"
+};
+const openRouterUrl = "https://openrouter.ai/api/v1";
+const openRouterModel = "openrouter/auto";
+/**
+* The chat model an API key gives, the option over its environment variable: OpenRouter unless `baseUrl` names another
+* OpenAI-compatible endpoint, which then needs a `model`; none without a key. A value that cannot work throws.
+*/
+const modelSettings = (option, env) => {
+	const value = (key) => (option?.[key] ?? env[modelVariables[key]])?.trim() || void 0;
+	const source = (key) => option?.[key] === void 0 ? modelVariables[key] : `options.assistant.${key}`;
+	const apiKey = value("apiKey");
+	if (!apiKey) return void 0;
+	const baseUrl = checkedUrl(value("baseUrl") ?? "https://openrouter.ai/api/v1", source("baseUrl"));
+	const model = value("model") ?? (baseUrl === "https://openrouter.ai/api/v1" ? "openrouter/auto" : void 0);
+	if (!model) throw new Error(`${modelVariables.model} (or options.assistant.model) is required with an endpoint other than OpenRouter's`);
+	return {
+		baseUrl,
+		apiKey,
+		model,
+		...option?.fetch && { fetch: option.fetch }
+	};
+};
+//#endregion
+export { modelSettings, modelVariables, openRouterModel, openRouterUrl };

package/dist/assistant/turn.d.ts

@@ -1,6 +1,6 @@
 import { Session } from "../types.js";
-import { ToolRecords } from "./records.js";
 import { ModelSettings, ReasoningEffort } from "./chat-completions.js";
+import { ToolRecords } from "./records.js";
 import { Conversation } from "./conversations.js";
 import { AssistantTool } from "./tools.js";
 //#region src/assistant/turn.d.ts

package/dist/assistant/turn.js

@@ -1,7 +1,7 @@
+import { noRecords } from "./records.js";
+import { ModelError, streamChatCompletion } from "./chat-completions.js";
 import { requestApproval } from "./approval.js";
 import { withCacheBreakpoints } from "./cache-breakpoints.js";
-import { ModelError, streamChatCompletion } from "./chat-completions.js";
-import { noRecords } from "./records.js";
 //#region src/assistant/turn.ts
 const toolResult = async (call, tools, context) => {
 	const tool = tools.find((entry) => entry.name === call.function.name);

package/dist/batch/reorder.js

@@ -1,8 +1,8 @@
 import { badRequest } from "../problem.js";
-import { columnId, keyConditions, scopeConditions, tableId, whereClause } from "../sql-parts.js";
-import { fetchRecord } from "../records.js";
 import { tenantScope } from "../tenant.js";
 import { requireOperation, targetFilter, writableFields } from "../request-access.js";
+import { columnId, keyConditions, scopeConditions, tableId, whereClause } from "../sql-parts.js";
+import { fetchRecord } from "../records.js";
 import { validateBody } from "../validate-body.js";
 import { missing, shown } from "../write-shared.js";
 import { applyUpdate, planUpdate } from "../write-update.js";

package/dist/batch/run-batch.js

@@ -1,7 +1,7 @@
 import { HttpProblem, badRequest, notFound } from "../problem.js";
-import { problemOf } from "../error-handler.js";
 import { requestAccess } from "../request-access.js";
 import { writeTransaction } from "../transactions.js";
+import { problemOf } from "../error-handler.js";
 import { actorSettings, wakeDispatch } from "../changes/actor.js";
 import { keyOf } from "../write-shared.js";
 import { writeIn } from "../write-pipeline.js";

package/dist/better-auth/create-auth.d.ts

@@ -36,7 +36,7 @@ export type CreateAuthOptions = {
   appName?: string;
   /** Signs cookies and encrypts the JWT private keys. Generate with `openssl rand -base64 32`. */
   secret: string;
-  /** Extra origins that may call the auth endpoints. `baseURL` and `https://*.trycloudflare.com` are always trusted. */
+  /** Extra origins that may call the auth endpoints, such as the exact host of a dev tunnel. `baseURL` and `origins` are always trusted. */
   trustedOrigins?: string[];
   /**
    * The roles users can have, for example `['admin', 'accountant', 'warehouse']`. `admin` is always included; default
@@ -800,7 +800,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               expiresAt: Date;
               token: string;
               ipAddress?: string | null | undefined;
-              userAgent? /** Open sign-up is on and offered: the app asks for it, and can mail the codes. */ : string | null | undefined;
+              userAgent?: string | null | undefined;
             };
           };
         }>>[];
@@ -3749,7 +3749,15 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
           name?: string;
           slug?: string;
           logo?: string | null;
-          metadata?: Record<string, any>;
+          metadata?
+          /**
+           * The options `createAuth` gives Better Auth, with the roles, default role, mailer, operator provider and platform
+           * sign-in provider already resolved.
+           */
+          /**
+           * The options `createAuth` gives Better Auth, with the roles, default role, mailer, operator provider and platform
+           * sign-in provider already resolved.
+           */ : Record<string, any>;
           [key: string]: any;
         };
       }>;
@@ -4232,7 +4240,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
     hooks: {
       after: {
         matcher: (context: {
-          path? /** Sign-in attempts allowed per minute and client, default 5; also the sign-up requests allowed. */ : string;
+          path?: string;
         }) => boolean;
         handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
       }[];

package/dist/better-auth/create-auth.js

@@ -64,7 +64,6 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 		trustedOrigins: [
 			options.baseURL,
 			...origins,
-			"https://*.trycloudflare.com",
 			...options.trustedOrigins ?? []
 		],
 		emailAndPassword: {

package/dist/better-auth/organizations/invitation-endpoints.js

@@ -5,9 +5,9 @@ import { checkNewAccountPassword } from "../new-account-password.js";
 import { effectiveSignInPolicy } from "../sign-in-policy.js";
 import { readSignInPolicy } from "../policy-store.js";
 import { acceptInvitation, invitationOfToken } from "./accept-invitation.js";
+import * as z$1 from "zod";
 import { APIError, createAuthEndpoint, createAuthMiddleware, sessionMiddleware } from "better-auth/api";
 import { setSessionCookie } from "better-auth/cookies";
-import * as z$1 from "zod";
 //#region src/better-auth/organizations/invitation-endpoints.ts
 const tokenBody = z$1.object({ token: z$1.string().min(1) });
 const startIn = (context, sessionToken, organizationId) => context.internalAdapter.updateSession(sessionToken, { activeOrganizationId: organizationId });

package/dist/better-auth/organizations/member-endpoints.js

@@ -1,8 +1,8 @@
 import "./role-definitions.js";
 import { checkAppRoleChange, effectiveRoles, globalRoles } from "./app-roles.js";
 import { findMember, findMemberById, findOrganization, organizationRoleOf, setAppRoles } from "./store.js";
-import { APIError, createAuthEndpoint, sessionMiddleware } from "better-auth/api";
 import * as z$1 from "zod";
+import { APIError, createAuthEndpoint, sessionMiddleware } from "better-auth/api";
 //#region src/better-auth/organizations/member-endpoints.ts
 const memberNotFound = {
 	code: "MEMBER_NOT_FOUND",

package/dist/better-auth/passkey-plugin.js

@@ -1,7 +1,7 @@
 import { pluginNames } from "./snake-case-names.js";
+import * as z$1 from "zod";
 import { APIError, createAuthEndpoint, getSessionFromCtx } from "better-auth/api";
 import { setSessionCookie } from "better-auth/cookies";
-import * as z$1 from "zod";
 import { PASSKEY_ERROR_CODES, passkey } from "@better-auth/passkey";
 import { generateAuthenticationOptions, verifyAuthenticationResponse } from "@simplewebauthn/server";
 import { generateRandomString } from "better-auth/crypto";

package/dist/better-auth/policy-plugin.js

@@ -3,8 +3,8 @@ import { effectiveSignInPolicy, missingRequiredMethods, parseSignInPolicy, signI
 import { readSignInPolicy, saveSignInPolicy, signInPolicySchema } from "./policy-store.js";
 import { isPoliced, lastPasskeyRequired, policyRefusal, setupRequired } from "./sign-in-enforcement.js";
 import { adminOnly } from "./admin-only.js";
-import { APIError, createAuthEndpoint, createAuthMiddleware, getSessionFromCtx, sessionMiddleware } from "better-auth/api";
 import * as z$1 from "zod";
+import { APIError, createAuthEndpoint, createAuthMiddleware, getSessionFromCtx, sessionMiddleware } from "better-auth/api";
 //#region src/better-auth/policy-plugin.ts
 const accountMethods = async (context, user, socialProviders) => {
 	const accounts = await context.internalAdapter.findAccounts(user.id);

package/dist/better-auth/roles/roles-plugin.js

@@ -1,7 +1,7 @@
 import "../organizations/role-definitions.js";
 import { sessionRoles } from "./session-role.js";
-import { APIError, createAuthEndpoint, createAuthMiddleware, getSessionFromCtx, sessionMiddleware } from "better-auth/api";
 import * as z$1 from "zod";
+import { APIError, createAuthEndpoint, createAuthMiddleware, getSessionFromCtx, sessionMiddleware } from "better-auth/api";
 //#region src/better-auth/roles/roles-plugin.ts
 /**
 * Switching the role a session acts with, as switching its organization: the session keeps it, and its tokens carry it

package/dist/better-auth/sign-up/sign-up-plugin.js

@@ -4,9 +4,9 @@ import { effectiveSignInPolicy } from "../sign-in-policy.js";
 import { readSignInPolicy } from "../policy-store.js";
 import { consumeSignUpCode, issueSignUpCode, signUpCodeLifetime } from "./sign-up-code.js";
 import { consumeSignUpTicket, issueSignUpTicket } from "./sign-up-ticket.js";
+import * as z$1 from "zod";
 import { APIError, createAuthEndpoint } from "better-auth/api";
 import { setSessionCookie } from "better-auth/cookies";
-import * as z$1 from "zod";
 //#region src/better-auth/sign-up/sign-up-plugin.ts
 const address = z$1.string().trim().toLowerCase().pipe(z$1.email());
 /** The paths of the sign-up endpoints, as `ctx.path` and the rate limits name them. */

package/dist/better-auth/staff-sign-in-endpoints.js

@@ -5,9 +5,9 @@ import { effectiveSignInPolicy } from "./sign-in-policy.js";
 import { readSignInPolicy } from "./policy-store.js";
 import { policyRefusal, staffSignInPath } from "./sign-in-enforcement.js";
 import { logStaffSignIn } from "./staff-log.js";
+import * as z$1 from "zod";
 import { APIError, createAuthEndpoint } from "better-auth/api";
 import { expireCookie, setSessionCookie } from "better-auth/cookies";
-import * as z$1 from "zod";
 //#region src/better-auth/staff-sign-in-endpoints.ts
 const startLifetimeMs = 6e5;
 const stateCookie = "staff_state";

package/dist/changes/capture-schema.d.ts

@@ -1,6 +1,6 @@
 import { EventsOptions } from "./events-options.js";
-import { Db } from "@protobase/query";
 import { ResourceModel } from "@protobase/schema";
+import { Db } from "@protobase/query";
 //#region src/changes/capture-schema.d.ts
 /** The command that writes what the config needs as a migration file of the project. */
 export declare const migrationCommand = "protobase migration";

package/dist/changes/outbox.d.ts

@@ -1,7 +1,7 @@
 import { Row } from "../types.js";
 import { CapturedRow } from "./coalesce.js";
-import { Db } from "@protobase/query";
 import { ResourceModel } from "@protobase/schema";
+import { Db } from "@protobase/query";
 //#region src/changes/outbox.d.ts
 /**
  * A captured row's columns from the JSON text the database stores: the columns of 64-bit integer and decimal fields as