@protobase/server 0.25.10 → 0.25.11

package/dist/api-keys/api-key-settings.d.ts

@@ -0,0 +1,24 @@
+//#region src/api-keys/api-key-settings.d.ts
+/**
+ * The app's two keys, for clients that call it the way they call Supabase. `publishable_key` is safe in a browser and
+ * makes a request anonymous or its signed-in user's; `secret_key` stays on servers and makes a request the app's own.
+ * Each falls back to `PROTOBASE_PUBLISHABLE_KEY` and `PROTOBASE_SECRET_KEY`; without either, nothing is admitted by key.
+ */
+export type ApiKeysOptions = {
+  publishable_key?: string;
+  secret_key?: string;
+};
+export type ApiKeys = {
+  publishable?: string;
+  secret?: string;
+};
+export declare const apiKeyVariables: {
+  readonly publishable_key: "PROTOBASE_PUBLISHABLE_KEY";
+  readonly secret_key: "PROTOBASE_SECRET_KEY";
+};
+/**
+ * The keys that are set, unless the option is `false`. A publishable key that looks like a secret one, the other way
+ * round, or both the same stop the server at startup, without printing the keys.
+ */
+export declare const apiKeySettings: (option: ApiKeysOptions | false | undefined, env: Record<string, string | undefined>) => ApiKeys;
+//#endregion

package/dist/api-keys/api-key-settings.js

@@ -0,0 +1,32 @@
+//#region src/api-keys/api-key-settings.ts
+const apiKeyVariables = {
+	publishable_key: "PROTOBASE_PUBLISHABLE_KEY",
+	secret_key: "PROTOBASE_SECRET_KEY"
+};
+const wrongPrefix = {
+	publishable_key: "sb_secret_",
+	secret_key: "sb_publishable_"
+};
+/**
+* The keys that are set, unless the option is `false`. A publishable key that looks like a secret one, the other way
+* round, or both the same stop the server at startup, without printing the keys.
+*/
+const apiKeySettings = (option, env) => {
+	if (option === false) return {};
+	const read = (name) => {
+		const value = (option?.[name] ?? env[apiKeyVariables[name]])?.trim();
+		if (!value) return void 0;
+		const source = option?.[name] === void 0 ? apiKeyVariables[name] : `The ${name} option`;
+		if (value.startsWith(wrongPrefix[name])) throw new Error(`${source} starts with ${wrongPrefix[name]}, the other key's prefix; swap the two keys`);
+		return value;
+	};
+	const publishable = read("publishable_key");
+	const secret = read("secret_key");
+	if (publishable !== void 0 && publishable === secret) throw new Error("The publishable and the secret key are the same; the secret key must be one of its own");
+	return {
+		...publishable && { publishable },
+		...secret && { secret }
+	};
+};
+//#endregion
+export { apiKeySettings, apiKeyVariables };

package/dist/api-keys/resolve-caller.d.ts

@@ -0,0 +1,35 @@
+import { ApiKeys } from "./api-key-settings.js";
+import { JWTPayload } from "jose";
+//#region src/api-keys/resolve-caller.d.ts
+/**
+ * Who a key-admitted request runs as. `anon` and `authenticated` are the database roles of the same names; `app` is
+ * the app's own role, the one that owns its tables. `claims` are those of the signed-in user's token, or for the keys
+ * alone the `role` claim that Supabase gives them, so `auth.jwt()` reads the same.
+ */
+export type Caller = {
+  role: 'anon';
+  claims: {
+    role: 'anon';
+  };
+} | {
+  role: 'authenticated';
+  claims: JWTPayload;
+} | {
+  role: 'app';
+  claims: {
+    role: 'service_role';
+  };
+};
+export type CallerOptions = {
+  keys: ApiKeys;
+  /** Verifies a user's token against the app's key set and returns its claims, such as `jwtVerifier(betterAuthTokens(...))`. */
+  verify: (token: string) => Promise<JWTPayload>;
+};
+/**
+ * Resolves the `apikey` header and `Authorization: Bearer` of a request to its caller. The key picks the role: the
+ * publishable key is `anon`, the secret key `app`. A user's token in the bearer makes either `authenticated` with its
+ * claims. A bearer that is no token must be the key itself, as supabase-js sends it when nobody is signed in. A
+ * missing or wrong key, a wrong bearer or a token that does not verify or names no user is a 401 problem.
+ */
+export declare const apiKeyCaller: (options: CallerOptions) => (request: Request) => Promise<Caller>;
+//#endregion

package/dist/api-keys/resolve-caller.js

@@ -0,0 +1,39 @@
+import { unauthorized } from "../problem.js";
+import { createHash, timingSafeEqual } from "node:crypto";
+//#region src/api-keys/resolve-caller.ts
+const digest = (text) => createHash("sha256").update(text).digest();
+const sameKey = (given, key) => key !== void 0 && timingSafeEqual(digest(given), digest(key));
+const isJwt = (token) => token.split(".").length === 3;
+/**
+* Resolves the `apikey` header and `Authorization: Bearer` of a request to its caller. The key picks the role: the
+* publishable key is `anon`, the secret key `app`. A user's token in the bearer makes either `authenticated` with its
+* claims. A bearer that is no token must be the key itself, as supabase-js sends it when nobody is signed in. A
+* missing or wrong key, a wrong bearer or a token that does not verify or names no user is a 401 problem.
+*/
+const apiKeyCaller = (options) => async (request) => {
+	const key = request.headers.get("apikey")?.trim();
+	if (!key) throw unauthorized("Send the app's publishable or secret key in the apikey header");
+	const publishable = sameKey(key, options.keys.publishable);
+	if (!publishable && !sameKey(key, options.keys.secret)) throw unauthorized("The apikey header holds no key of this app");
+	const header = request.headers.get("authorization");
+	const [scheme, bearer] = header?.split(" ") ?? [];
+	if (header !== null && (scheme?.toLowerCase() !== "bearer" || !bearer)) throw unauthorized("Send a bearer token in the Authorization header");
+	if (bearer !== void 0 && isJwt(bearer)) {
+		const claims = await options.verify(bearer);
+		if (!claims.sub) throw unauthorized("The bearer token has no subject");
+		return {
+			role: "authenticated",
+			claims
+		};
+	}
+	if (bearer !== void 0 && !sameKey(bearer, key)) throw unauthorized("The bearer is neither a token nor the key in the apikey header");
+	return publishable ? {
+		role: "anon",
+		claims: { role: "anon" }
+	} : {
+		role: "app",
+		claims: { role: "service_role" }
+	};
+};
+//#endregion
+export { apiKeyCaller };

package/dist/auth/jwt.d.ts

@@ -1,5 +1,5 @@
 import { Authenticator, TenantValue } from "../types.js";
-import { JWTVerifyGetKey } from "jose";
+import { JWTPayload, JWTVerifyGetKey } from "jose";
 //#region src/auth/jwt.d.ts
 export type JwtOptions = {
   /** JWKS endpoint of the identity provider; or pass `keys`, for example `createLocalJWKSet`. */
@@ -20,6 +20,9 @@ export type JwtOptions = {
   /** A fixed tenant (or resolver) used instead of any claim, for single-tenant deployments. */
   tenant?: TenantValue | (() => Promise<TenantValue | undefined>);
 };
+export type JwtVerifyOptions = Pick<JwtOptions, 'jwksUrl' | 'keys' | 'issuer' | 'audience' | 'algorithms'>;
+/** Verifies a JWT against a JWKS and returns its claims; a token that does not verify is a 401 problem. */
+export declare const jwtVerifier: (options: JwtVerifyOptions) => (token: string) => Promise<JWTPayload>;
 /** Verifies `Authorization: Bearer <jwt>` against a JWKS; `sub` is the user id. Without the header, `MissingCredentials`. */
 export declare const jwtAuthenticator: (options: JwtOptions) => Authenticator;
 //#endregion

package/dist/auth/jwt.js

@@ -17,26 +17,33 @@ const rolesOf = (claim) => {
 	if (typeof claim === "string") return claim.split(/[\s,]+/).filter(Boolean);
 	return Array.isArray(claim) ? claim.filter((role) => typeof role === "string") : [];
 };
-/** Verifies `Authorization: Bearer <jwt>` against a JWKS; `sub` is the user id. Without the header, `MissingCredentials`. */
-const jwtAuthenticator = (options) => {
-	const { rolesClaim = "roles", tenantClaim = "tenant" } = options;
+/** Verifies a JWT against a JWKS and returns its claims; a token that does not verify is a 401 problem. */
+const jwtVerifier = (options) => {
 	const keys = options.keys ?? (options.jwksUrl ? createRemoteJWKSet(new URL(options.jwksUrl)) : void 0);
 	if (!keys) throw new Error("jwtAuthenticator needs jwksUrl or keys");
-	return async (request) => {
-		const header = request.headers.get("authorization");
-		if (header === null) throw new MissingCredentials("Send a bearer token in the Authorization header");
-		const [scheme, token] = header.split(" ");
-		if (scheme?.toLowerCase() !== "bearer" || !token) throw unauthorized("Send a bearer token in the Authorization header");
-		const verified = await jwtVerify(token, keys, {
+	return async (token) => {
+		return (await jwtVerify(token, keys, {
 			algorithms: options.algorithms ?? asymmetric,
 			...options.issuer && { issuer: options.issuer },
 			...options.audience && { audience: options.audience }
 		}).catch((error) => {
 			if (error instanceof errors.JOSEError) throw unauthorized("The bearer token is invalid or expired");
 			throw error;
-		});
-		const { sub, [tenantClaim]: tenant, [rolesClaim]: roles } = verified.payload;
-		const extraRoles = options.extraRolesClaim === void 0 ? [] : rolesOf(verified.payload[options.extraRolesClaim]);
+		})).payload;
+	};
+};
+/** Verifies `Authorization: Bearer <jwt>` against a JWKS; `sub` is the user id. Without the header, `MissingCredentials`. */
+const jwtAuthenticator = (options) => {
+	const { rolesClaim = "roles", tenantClaim = "tenant" } = options;
+	const verify = jwtVerifier(options);
+	return async (request) => {
+		const header = request.headers.get("authorization");
+		if (header === null) throw new MissingCredentials("Send a bearer token in the Authorization header");
+		const [scheme, token] = header.split(" ");
+		if (scheme?.toLowerCase() !== "bearer" || !token) throw unauthorized("Send a bearer token in the Authorization header");
+		const payload = await verify(token);
+		const { sub, [tenantClaim]: tenant, [rolesClaim]: roles } = payload;
+		const extraRoles = options.extraRolesClaim === void 0 ? [] : rolesOf(payload[options.extraRolesClaim]);
 		if (!sub) throw unauthorized("The bearer token has no subject");
 		const claimed = typeof tenant === "string" || typeof tenant === "number" ? tenant : void 0;
 		const tenantValue = options.tenant === void 0 ? claimed : typeof options.tenant === "function" ? await options.tenant() : options.tenant;
@@ -50,4 +57,4 @@ const jwtAuthenticator = (options) => {
 	};
 };
 //#endregion
-export { jwtAuthenticator };
+export { jwtAuthenticator, jwtVerifier };

package/dist/better-auth/authenticator.d.ts

@@ -1,5 +1,6 @@
 import { AdminAuth } from "./create-auth.js";
 import { Authenticator, TenantValue } from "../types.js";
+import { JwtVerifyOptions } from "../auth/jwt.js";
 import { TrustedApp } from "./app-tokens.js";
 import { JwksCacheOptions } from "./jwks-cache.js";
 //#region src/better-auth/authenticator.d.ts
@@ -19,6 +20,10 @@ export type BetterAuthAuthenticatorOptions = {
   /** Other Protobase apps whose users this API admits with their own tokens, so their admin apps can draw its resources (see `TrustedApp`). */
   apps?: TrustedApp[];
 };
+/** How the tokens of this Better Auth instance verify: its key set, and its issuer as both issuer and audience. */
+export declare const betterAuthTokens: (options: Pick<BetterAuthAuthenticatorOptions, "auth" | "jwksUrl" | "issuer" | "cache">) => JwtVerifyOptions & {
+  issuer: string;
+};
 /**
  * Verifies the bearer JWT that Better Auth's jwt plugin issues. `sub` is the user id, the `role` claim (a comma
  * separated string from the admin plugin) becomes `roles`. With organizations, the `org` claim is the tenant and the

package/dist/better-auth/authenticator.js

@@ -3,6 +3,17 @@ import { jwtAuthenticator } from "../auth/jwt.js";
 import { withTrustedApps } from "./app-tokens.js";
 import { cachedKeys } from "./jwks-cache.js";
 //#region src/better-auth/authenticator.ts
+/** How the tokens of this Better Auth instance verify: its key set, and its issuer as both issuer and audience. */
+const betterAuthTokens = (options) => {
+	const issuer = options.issuer ?? options.auth?.issuer;
+	if (!issuer) throw new Error("betterAuthAuthenticator needs `issuer` (or an `auth` instance with a baseURL)");
+	if (!options.auth && !options.jwksUrl) throw new Error("betterAuthAuthenticator needs `auth` or `jwksUrl`");
+	return {
+		...options.auth ? { keys: cachedKeys(() => options.auth.api.getJwks(), options.cache) } : { jwksUrl: options.jwksUrl },
+		issuer,
+		audience: issuer
+	};
+};
 /**
 * Verifies the bearer JWT that Better Auth's jwt plugin issues. `sub` is the user id, the `role` claim (a comma
 * separated string from the admin plugin) becomes `roles`. With organizations, the `org` claim is the tenant and the
@@ -10,14 +21,11 @@ import { cachedKeys } from "./jwks-cache.js";
 * role, is left out. With `apps`, the tokens of those apps are admitted too, with the roles each gives its users here.
 */
 const betterAuthAuthenticator = (options) => {
-	const issuer = options.issuer ?? options.auth?.issuer;
-	if (!issuer) throw new Error("betterAuthAuthenticator needs `issuer` (or an `auth` instance with a baseURL)");
-	if (!options.auth && !options.jwksUrl) throw new Error("betterAuthAuthenticator needs `auth` or `jwksUrl`");
+	const tokens = betterAuthTokens(options);
+	const { issuer } = tokens;
 	const organizations = options.organizations ?? Boolean(options.auth?.organizations);
 	const verify = jwtAuthenticator({
-		...options.auth ? { keys: cachedKeys(() => options.auth.api.getJwks(), options.cache) } : { jwksUrl: options.jwksUrl },
-		issuer,
-		audience: issuer,
+		...tokens,
 		rolesClaim: "role",
 		...organizations && {
 			tenantClaim: "org",
@@ -39,4 +47,4 @@ const betterAuthAuthenticator = (options) => {
 	}, issuer, options.apps ?? []);
 };
 //#endregion
-export { betterAuthAuthenticator };
+export { betterAuthAuthenticator, betterAuthTokens };

package/dist/index.d.ts

@@ -45,10 +45,12 @@ import { isBackgroundWork, runInBackground } from "./background-work.js";
 import { checkViewQueries } from "./check-view-queries.js";
 import { ProjectConfig, defineConfig, mergeConfig } from "./project-config.js";
 import { consoleAuditQueue } from "./audit/console-queue.js";
-import { JwtOptions, jwtAuthenticator } from "./auth/jwt.js";
+import { JwtOptions, JwtVerifyOptions, jwtAuthenticator, jwtVerifier } from "./auth/jwt.js";
+import { ApiKeys, ApiKeysOptions, apiKeySettings, apiKeyVariables } from "./api-keys/api-key-settings.js";
+import { Caller, CallerOptions, apiKeyCaller } from "./api-keys/resolve-caller.js";
 import { HttpProblem, MissingCredentials, badRequest, forbidden, notFound, unauthorized } from "./problem.js";
 import { TrustedApp, withTrustedApps } from "./better-auth/app-tokens.js";
-import { BetterAuthAuthenticatorOptions, betterAuthAuthenticator } from "./better-auth/authenticator.js";
+import { BetterAuthAuthenticatorOptions, betterAuthAuthenticator, betterAuthTokens } from "./better-auth/authenticator.js";
 import { parseRoles } from "./better-auth/parse-roles.js";
 import { LinkedAccount, NewUser, StoredUser, createUser, deleteUser, hasUsers, listUsers, roleChoices, setUserBanned, setUserRole } from "./better-auth/users.js";
 import { IssueTokenOptions, issueToken, maxTokenTtlSeconds } from "./better-auth/tokens.js";
@@ -93,4 +95,4 @@ import { FatalJobError } from "./jobs/run-job.js";
 import { DrainResult, JobsRuntime, StartJobsOptions, startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
 import { checkJobsSchema, jobsSchema, jobsSchemaMigration } from "./jobs/schema.js";
-export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticatorOptions, type CapturedRow, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSource, type HistoryOptions, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type MemberInput, MissingCredentials, ModelError, type ModelSettings, type NewOrganization, type NewUser, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, addAppRoleToOwners, addMember, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, handleDroppedConnections, hasUsers, imageSize, isBackgroundWork, isCaptured, isJobDefinition, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storeFile, streamChatCompletion, subscription, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };
+export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApiKeys, type ApiKeysOptions, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticatorOptions, type Caller, type CallerOptions, type CapturedRow, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSource, type HistoryOptions, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type JwtVerifyOptions, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type MemberInput, MissingCredentials, ModelError, type ModelSettings, type NewOrganization, type NewUser, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, handleDroppedConnections, hasUsers, imageSize, isBackgroundWork, isCaptured, isJobDefinition, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storeFile, streamChatCompletion, subscription, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };

package/dist/index.js

@@ -49,9 +49,11 @@ import { handleDroppedConnections } from "./dropped-connections.js";
 import { configExports } from "./resource-source.js";
 import { checkViewQueries } from "./check-view-queries.js";
 import { defineConfig, mergeConfig } from "./project-config.js";
-import { jwtAuthenticator } from "./auth/jwt.js";
+import { jwtAuthenticator, jwtVerifier } from "./auth/jwt.js";
+import { apiKeySettings, apiKeyVariables } from "./api-keys/api-key-settings.js";
+import { apiKeyCaller } from "./api-keys/resolve-caller.js";
 import { withTrustedApps } from "./better-auth/app-tokens.js";
-import { betterAuthAuthenticator } from "./better-auth/authenticator.js";
+import { betterAuthAuthenticator, betterAuthTokens } from "./better-auth/authenticator.js";
 import { issueToken, maxTokenTtlSeconds } from "./better-auth/tokens.js";
 import { authSchemaMigration, checkAuthSchema } from "./better-auth/auth-schema.js";
 import { checkComputed, computedMigration } from "./computed/computed-schema.js";
@@ -70,4 +72,4 @@ import { aspectRatio, fileSize, fileType, imageSize, processor } from "./files/p
 import { defineEmail } from "./mail/define-email.js";
 import { startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
-export { FatalJobError, HttpProblem, MissingCredentials, ModelError, addAppRoleToOwners, addMember, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, handleDroppedConnections, hasUsers, imageSize, isBackgroundWork, isCaptured, isJobDefinition, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storeFile, streamChatCompletion, subscription, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };
+export { FatalJobError, HttpProblem, MissingCredentials, ModelError, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, handleDroppedConnections, hasUsers, imageSize, isBackgroundWork, isCaptured, isJobDefinition, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storeFile, streamChatCompletion, subscription, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.25.10",
+  "version": "0.25.11",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -32,9 +32,9 @@
   "dependencies": {
     "@better-auth/passkey": "^1.7.7",
     "@better-auth/sso": "^1.7.7",
-    "@protobase/layout": "0.25.10",
-    "@protobase/query": "0.25.10",
-    "@protobase/schema": "0.25.10",
+    "@protobase/layout": "0.25.11",
+    "@protobase/query": "0.25.11",
+    "@protobase/schema": "0.25.11",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",