@protobase/server 0.26.9 → 0.27.0

package/dist/admin-options.d.ts

@@ -55,8 +55,8 @@ export type AdminOptions = {
   /**
    * The websites whose browser code may call the API (`/api/*` but `/api/auth/*`) besides the app's own origins (see
    * `createAuth`'s `origins`): a list of origins, or `*` for any. Defaults to the one the platform passes in
-   * `PROTOBASE_CORS_ORIGINS` (`*` or comma separated), when set. With neither this nor other origins, the API sends no
-   * CORS headers.
+   * `PROTOBASE_CORS_ORIGINS` (`*` or comma separated), when set. A `mobile` section adds the app's Capacitor origins
+   * (`capacitor://localhost`, `https://localhost`). With none of these nor other origins, the API sends no CORS headers.
    */
   cors?: CorsOrigins;
   /** The runtime updates endpoint behind the top bar's update button (see `RuntimeOptions`); `false` turns it off. */

package/dist/api-cors.js

@@ -1,17 +1,28 @@
 import { readList } from "./better-auth/origins.js";
+import { capacitorOrigins } from "./mobile-config.js";
 import { cors } from "hono/cors";
 //#region src/api-cors.ts
 const corsOriginsVariable = "PROTOBASE_CORS_ORIGINS";
-/** The origins in `PROTOBASE_CORS_ORIGINS`, `*` or comma separated; `undefined` when it is unset. One that is not a URL stops the server at startup. */
+/**
+* The origins in `PROTOBASE_CORS_ORIGINS`, `*` or comma separated; `undefined` when it is unset. One that is not an
+* http or https URL stops the server at startup: another scheme, such as `capacitor:`, has the origin `null`.
+*/
 const readCorsOrigins = (env) => {
 	const value = env[corsOriginsVariable]?.trim();
 	if (!value) return void 0;
 	if (value === "*") return "*";
 	return readList(value).map((origin) => {
 		if (!URL.canParse(origin)) throw new Error(`${corsOriginsVariable} lists "${origin}", which is not a URL such as https://shop.com`);
-		return new URL(origin).origin;
+		const url = new URL(origin);
+		if (url.protocol !== "http:" && url.protocol !== "https:") throw new Error(`${corsOriginsVariable} lists "${origin}", but it takes http and https origins only; a mobile section in protobase.config.ts allows the app's Capacitor origins`);
+		return url.origin;
 	});
 };
+/** The allowed origins plus the Capacitor ones when the app has a mobile section; `*` stays `*`. */
+const withMobileOrigins = (allowed, mobile) => {
+	if (!mobile || allowed === "*") return allowed;
+	return [.../* @__PURE__ */ new Set([...allowed ?? [], ...capacitorOrigins])];
+};
 const allowHeaders = [
 	"authorization",
 	"content-type",
@@ -53,4 +64,4 @@ const apiCors = ({ own, allowed, skip }) => {
 	return (c, next) => skip(c.req.path) ? next() : handler(c, next);
 };
 //#endregion
-export { apiCors, corsOriginsVariable, readCorsOrigins };
+export { apiCors, corsOriginsVariable, readCorsOrigins, withMobileOrigins };

package/dist/app-name.d.ts

@@ -0,0 +1,4 @@
+//#region src/app-name.d.ts
+/** The app's name when neither the app nor the platform names it. */
+export declare const defaultAppName = "Protobase";
+//#endregion

package/dist/better-auth/create-auth.d.ts

@@ -1347,7 +1347,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
           $Infer: {
             body: {
               token: string;
-              issuer? /** Sign-in attempts allowed per minute and client, default 5; also the sign-up requests allowed. */ : string;
+              issuer?: string;
             };
             response: {
               payload: {
@@ -4018,7 +4018,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               userId: string;
               expiresAt: Date;
               token: string;
-              ipAddress?: string | null | undefined;
+              ipAddress? /** The RP ID of new passkeys. */ : string | null | undefined;
               userAgent?: string | null | undefined;
             };
             user: Record<string, any> & {

package/dist/better-auth/create-auth.js

@@ -1,4 +1,4 @@
-import { multiHostBaseURL, readOrigins, resolveOrigins } from "./origins.js";
+import { appOrigins, multiHostBaseURL, readOrigins, resolveOrigins } from "./origins.js";
 import { defaultAppName, readAppName } from "../app-name.js";
 import { goTrueIssuer, goTrueKeyPair } from "../gotrue/keys.js";
 import { roleDefinitions } from "./organizations/role-definitions.js";
@@ -148,7 +148,8 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 			passkeyPlugin({
 				domain: passkeyDomain ?? hosts[0],
 				hosts,
-				formerDomain: hosts[0]
+				formerDomain: hosts[0],
+				origins: appOrigins(options.baseURL, origins)
 			}),
 			...mail ? [emailOTP(emailCodeOptions(mail))] : [],
 			...mail && signUpRole ? [signUpPlugin({
@@ -310,7 +311,7 @@ const createAuth = (options) => {
 		/** Issuer and audience of the tokens: `baseURL`, on every origin. */
 		issuer: options.baseURL,
 		/** Every origin the app is served on, `baseURL`'s first. */
-		origins: [new URL(options.baseURL).origin, ...origins],
+		origins: appOrigins(options.baseURL, origins),
 		/** The RP ID of new passkeys. */
 		passkeyDomain,
 		roles,

package/dist/better-auth/origins.js

@@ -24,6 +24,11 @@ const resolveOrigins = (baseURL, origins) => {
 	return [...new Set(resolved)].filter((origin) => origin !== base.origin);
 };
 /**
+* Every origin the app is served on: `baseURL`'s, then the others from `resolveOrigins`. The only origins a passkey's
+* answer may name, and the list `/.well-known/webauthn` serves; never empty.
+*/
+const appOrigins = (baseURL, origins) => [new URL(baseURL).origin, ...origins];
+/**
 * Better Auth's `baseURL` for an app on several origins: each request is answered for its own host when that is one of
 * them (its links, such as a password reset, and its passkey and sign-in callbacks then stay on that host), and for
 * `baseURL` otherwise. With no other origins it is `baseURL` itself.
@@ -40,4 +45,4 @@ const multiHostBaseURL = (baseURL, origins) => {
 /** Where browsers read which origins may use the app's passkeys (WebAuthn Related Origin Requests). */
 const webauthnPath = "/.well-known/webauthn";
 //#endregion
-export { multiHostBaseURL, originsVariable, readList, readOrigins, resolveOrigins, webauthnPath };
+export { appOrigins, multiHostBaseURL, originsVariable, readList, readOrigins, resolveOrigins, webauthnPath };

package/dist/better-auth/passkey-plugin.js

@@ -18,11 +18,13 @@ const decodeBase64 = (value) => Uint8Array.from(atob(value), (char) => char.char
 * RP ID it was made with, so changing the passkey domain breaks none. A sign-in asks the browser for passkeys of one RP
 * ID, `?rpId=` or the passkey domain, and checks the passkey it gets against its own. On an app with several origins,
 * browsers let each origin use the passkeys of the others through `/.well-known/webauthn` (Related Origin Requests).
+* Adding a passkey and signing in with one both accept only an answer that names one of the app's own origins.
 */
-const passkeyPlugin = ({ domain, hosts, formerDomain }) => {
+const passkeyPlugin = ({ domain, hosts, formerDomain, origins }) => {
 	const base = passkey({
 		schema: pluginNames.passkey,
-		rpID: domain
+		rpID: domain,
+		origin: origins
 	});
 	const rpIDOf = (stored) => stored.rpID ?? formerDomain;
 	/** `GET /passkey/generate-authenticate-options?rpId=`: what the browser needs to ask for a passkey of that RP ID. */
@@ -70,8 +72,6 @@ const passkeyPlugin = ({ domain, hosts, formerDomain }) => {
 		method: "POST",
 		body: z$1.object({ response: z$1.record(z$1.any(), z$1.any()) })
 	}, async (ctx) => {
-		const origin = ctx.headers?.get("origin");
-		if (!origin) throw new APIError("BAD_REQUEST", { message: "origin missing" });
 		const response = ctx.body.response;
 		const cookie = ctx.context.createAuthCookie(challengeCookie);
 		const token = await ctx.getSignedCookie(cookie.name, ctx.context.secret);
@@ -91,7 +91,7 @@ const passkeyPlugin = ({ domain, hosts, formerDomain }) => {
 		const verification = await verifyAuthenticationResponse({
 			response,
 			expectedChallenge,
-			expectedOrigin: origin,
+			expectedOrigin: origins,
 			expectedRPID: rpIDOf(stored),
 			credential: {
 				id: stored.credentialID,

package/dist/create-admin.d.ts

@@ -1,3 +1,4 @@
+import { MobileConfig } from "./mobile-config.js";
 import { AdminAuth } from "./better-auth/create-auth.js";
 import { EventsOptions } from "./changes/events-options.js";
 import { JobDefinition } from "./jobs/job-types.js";
@@ -43,6 +44,8 @@ export type CreateAdminInput = {
   subscriptions?: SubscriptionDefinition[];
   /** Webhook subscriptions made in the admin app, from `extends: [webhooks()]` (see `WebhooksOptions`). */
   webhooks?: WebhooksOptions;
+  /** The app's iOS and Android build (see `MobileConfig`): the API answers its Capacitor origins through CORS. */
+  mobile?: MobileConfig;
   /**
    * The plugins the app's bundle carries, as `protobase build` writes them: its protobase.ui.tsx and its extensions'
    * UI configs, each a plugin.json path on the app's origin. `/meta` names them to everyone, before any other plugin,
@@ -69,5 +72,5 @@ export type CreateAdminInput = {
   upgradeWebSocket?: UpgradeWebSocket;
 };
 /** The admin REST API as a Hono app. It uses only Web APIs, so it runs on Node, Workers and anywhere else Hono does. */
-export declare const createAdmin: ({ resources: appResources, views: appViews, pages, userMenu, bottomBars, db, authenticate, auth, functions, files: filesOptions, events, history: historyOptions, jobs, subscriptions, webhooks: webhooksOptions, bundlePlugins, fieldTypes, options, formsDifficulty, commentUsers: givenCommentUsers, verifyToken, upgradeWebSocket }: CreateAdminInput) => Admin;
+export declare const createAdmin: ({ resources: appResources, views: appViews, pages, userMenu, bottomBars, db, authenticate, auth, functions, files: filesOptions, events, history: historyOptions, jobs, subscriptions, webhooks: webhooksOptions, mobile, bundlePlugins, fieldTypes, options, formsDifficulty, commentUsers: givenCommentUsers, verifyToken, upgradeWebSocket }: CreateAdminInput) => Admin;
 //#endregion

package/dist/create-admin.js

@@ -10,7 +10,7 @@ import { assistantSettings } from "./assistant/assistant-settings.js";
 import { builtInAssistant } from "./assistant/built-in-assistant.js";
 import { consoleAuditQueue } from "./audit/console-queue.js";
 import { webauthnPath } from "./better-auth/origins.js";
-import { apiCors, readCorsOrigins } from "./api-cors.js";
+import { apiCors, readCorsOrigins, withMobileOrigins } from "./api-cors.js";
 import { apiKeySettings } from "./api-keys/api-key-settings.js";
 import { apiKeyCaller } from "./api-keys/resolve-caller.js";
 import { jwtVerifier } from "./auth/jwt.js";
@@ -75,7 +75,7 @@ const declaredRoles = (auth, roles) => {
 	return names.length > 0 ? [...new Set(names)] : void 0;
 };
 /** The admin REST API as a Hono app. It uses only Web APIs, so it runs on Node, Workers and anywhere else Hono does. */
-const createAdmin = ({ resources: appResources, views: appViews = [], pages = [], userMenu, bottomBars = [], db, authenticate, auth, functions = {}, files: filesOptions, events, history: historyOptions, jobs = [], subscriptions = [], webhooks: webhooksOptions, bundlePlugins = [], fieldTypes = {}, options = {}, formsDifficulty, commentUsers: givenCommentUsers, verifyToken, upgradeWebSocket }) => {
+const createAdmin = ({ resources: appResources, views: appViews = [], pages = [], userMenu, bottomBars = [], db, authenticate, auth, functions = {}, files: filesOptions, events, history: historyOptions, jobs = [], subscriptions = [], webhooks: webhooksOptions, mobile, bundlePlugins = [], fieldTypes = {}, options = {}, formsDifficulty, commentUsers: givenCommentUsers, verifyToken, upgradeWebSocket }) => {
 	const basePath = options.basePath ?? "/api/v1";
 	const appModels = appResources.map((resource) => resource.toModel());
 	const withComments = appModels.some((model) => model.comments);
@@ -219,7 +219,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	}, withAnonymous(authenticate, options.roles));
 	const app = new Hono();
 	app.onError(onError);
-	const corsOrigins = options.cors ?? readCorsOrigins(globalThis.process?.env ?? {});
+	const corsOrigins = withMobileOrigins(options.cors ?? readCorsOrigins(globalThis.process?.env ?? {}), Boolean(mobile));
 	const ownOrigins = auth?.origins ?? [];
 	if (corsOrigins !== void 0 || ownOrigins.length > 1) {
 		const answering = [authBasePath, ...Object.entries(apiFunctions).filter(([, fn]) => fn.options.cors).map(([name]) => `${systemPath}/functions/${name}`)];

package/dist/gotrue/provider-flows.js

@@ -0,0 +1,42 @@
+import { goTruePath } from "./keys.js";
+import { hashOf } from "../better-auth/sign-up/sign-up-code.js";
+import { generateRandomString } from "better-auth/crypto";
+import { deleteCookie, getCookie, setCookie } from "hono/cookie";
+//#region src/gotrue/provider-flows.ts
+const flowSeconds = 600;
+const flowCookie = (context) => context.createAuthCookie("gotrue_flow", {
+	maxAge: flowSeconds,
+	path: `${goTruePath}/callback`
+});
+const identifierOf = async (id) => `gotrue-provider-flow-${await hashOf(id)}`;
+/** Keeps `flow` and gives the browser its id; answers the flow's hand-off secret. */
+const startFlow = async (c, context, flow) => {
+	const id = generateRandomString(32);
+	const secret = generateRandomString(32);
+	const stored = {
+		...flow,
+		handOff: await hashOf(secret)
+	};
+	await context.internalAdapter.createVerificationValue({
+		identifier: await identifierOf(id),
+		value: JSON.stringify(stored),
+		expiresAt: new Date(Date.now() + flowSeconds * 1e3)
+	});
+	const { name, attributes } = flowCookie(context);
+	setCookie(c, name, id, attributes);
+	return secret;
+};
+/** Takes the flow of the browser's cookie, so it works once, and clears the cookie; nothing when there is none. */
+const takeFlow = async (c, context) => {
+	const { name, attributes } = flowCookie(context);
+	const id = getCookie(c, name);
+	if (!id) return void 0;
+	deleteCookie(c, name, attributes);
+	const consumed = await context.internalAdapter.consumeVerificationValue(await identifierOf(id));
+	if (!consumed || new Date(consumed.expiresAt) < /* @__PURE__ */ new Date()) return void 0;
+	return JSON.parse(consumed.value);
+};
+/** Whether `secret` is the flow's hand-off secret. */
+const isHandOff = async (flow, secret) => !!secret && await hashOf(secret) === flow.handOff;
+//#endregion
+export { isHandOff, startFlow, takeFlow };

package/dist/gotrue/provider-routes.js

@@ -2,6 +2,7 @@ import { goTruePath } from "./keys.js";
 import { GoTrueError } from "./errors.js";
 import { callBetterAuth } from "./forward.js";
 import { issueAuthCode } from "./auth-codes.js";
+import { isHandOff, startFlow, takeFlow } from "./provider-flows.js";
 import { Hono } from "hono";
 //#region src/gotrue/provider-routes.ts
 const challengeOf = (query) => {
@@ -27,52 +28,65 @@ const providerRoutes = ({ auth, context, sessionOf }) => {
 		if (requested && URL.canParse(requested) && (await context()).isTrustedOrigin(requested)) return requested;
 		return own;
 	};
+	const implicitFragment = async (userId) => {
+		const session = await sessionOf((await (await context()).internalAdapter.createSession(userId)).token);
+		return {
+			access_token: session.access_token,
+			token_type: "bearer",
+			expires_in: String(session.expires_in),
+			expires_at: String(session.expires_at),
+			refresh_token: session.refresh_token
+		};
+	};
 	return new Hono().get("/authorize", async (c) => {
 		const query = c.req.query();
 		const provider = query.provider ?? "";
 		if (!auth.socialProviders.includes(provider)) throw new GoTrueError(400, "validation_failed", `Unsupported provider: ${provider || "none"} is not one of this app's`);
 		const challenge = challengeOf(query);
+		const redirectTo = await destination(query.redirect_to, c.req.raw);
+		if (!challenge && new URL(redirectTo).protocol !== "https:") throw new GoTrueError(400, "validation_failed", "A redirect_to that is not https needs a code_challenge");
+		const before = await auth.api.getSession({ headers: c.req.raw.headers });
+		const secret = await startFlow(c, await context(), {
+			redirectTo,
+			challenge,
+			sessionBefore: before?.session.id
+		});
 		const callback = new URL(`${goTruePath}/callback`, c.req.url);
-		callback.searchParams.set("redirect_to", await destination(query.redirect_to, c.req.raw));
-		if (challenge) {
-			callback.searchParams.set("code_challenge", challenge.challenge);
-			callback.searchParams.set("code_challenge_method", challenge.method);
-		}
+		const success = new URL(callback);
+		success.searchParams.set("flow", secret);
 		const { json, headers } = await callBetterAuth(auth, c.req.raw, "/sign-in/social", {
 			provider,
-			callbackURL: callback.toString(),
+			callbackURL: success.toString(),
 			errorCallbackURL: callback.toString(),
 			disableRedirect: true,
 			...query.scopes && { scopes: query.scopes.split(/[\s,]+/).filter(Boolean) }
 		});
-		const response = c.redirect(String(json.url), 302);
-		for (const cookie of headers.getSetCookie()) response.headers.append("set-cookie", cookie);
-		return response;
+		for (const cookie of headers.getSetCookie()) c.header("set-cookie", cookie, { append: true });
+		return c.redirect(String(json.url), 302);
 	}).get("/callback", async (c) => {
 		const query = c.req.query();
-		const target = await destination(query.redirect_to, c.req.raw);
-		const challenge = challengeOf(query);
-		const where = challenge ? "search" : "hash";
-		const signedIn = !query.error && await auth.api.getSession({ headers: c.req.raw.headers });
-		if (!signedIn) {
+		const ctx = await context();
+		const flow = await takeFlow(c, ctx);
+		const signedIn = flow && !query.error && await isHandOff(flow, query.flow) && await auth.api.getSession({ headers: c.req.raw.headers });
+		const made = signedIn && signedIn.session.id !== flow.sessionBefore ? signedIn : void 0;
+		if (!flow || !made) {
 			const error = query.error ?? "access_denied";
+			const target = flow?.redirectTo ?? await destination(query.redirect_to, c.req.raw);
+			const where = (flow ? flow.challenge : query.code_challenge) ? "search" : "hash";
 			return c.redirect(withParams(target, {
 				error,
 				error_code: error,
 				error_description: query.error_description ?? "The sign-in with the provider did not complete"
 			}, where), 302);
 		}
-		const ctx = await context();
-		if (challenge) return c.redirect(withParams(target, { code: await issueAuthCode(ctx, signedIn.user.id, challenge) }, "search"), 302);
-		const session = await sessionOf((await ctx.internalAdapter.createSession(signedIn.user.id)).token);
-		const fragment = {
-			access_token: session.access_token,
-			token_type: "bearer",
-			expires_in: String(session.expires_in),
-			expires_at: String(session.expires_at),
-			refresh_token: session.refresh_token
-		};
-		return c.redirect(withParams(target, fragment, "hash"), 302);
+		const { redirectTo, challenge } = flow;
+		const handOff = challenge ? withParams(redirectTo, { code: await issueAuthCode(ctx, made.user.id, challenge) }, "search") : withParams(redirectTo, await implicitFragment(made.user.id), "hash");
+		const { headers } = await auth.api.signOut({
+			headers: c.req.raw.headers,
+			returnHeaders: true
+		});
+		for (const cookie of headers.getSetCookie()) c.header("set-cookie", cookie, { append: true });
+		return c.redirect(handOff, 302);
 	});
 };
 //#endregion

package/dist/index.d.ts

@@ -1,3 +1,4 @@
+import { MobileConfig } from "./mobile-config.js";
 import { SignInPolicy, SignInRule, StaffAccessRule, defaultSignInPolicy, signInPolicyMethods } from "./better-auth/sign-in-policy.js";
 import { StaffSignIn } from "./better-auth/staff-log.js";
 import { MailMessage, Mailer } from "./mail/smtp-mailer.js";
@@ -55,6 +56,7 @@ import { parseRoles } from "./better-auth/parse-roles.js";
 import { LinkedAccount, NewUser, StoredUser, createUser, deleteUser, hasUsers, listUsers, roleChoices, setUserBanned, setUserRole } from "./better-auth/users.js";
 import { IssueTokenOptions, issueToken, maxTokenTtlSeconds } from "./better-auth/tokens.js";
 import { webauthnPath } from "./better-auth/origins.js";
+import { defaultAppName } from "./app-name.js";
 import { authSchemaMigration, checkAuthSchema } from "./better-auth/auth-schema.js";
 import { changesMigration, checkChanges, migrationCommand } from "./changes/capture-schema.js";
 import { checkComputed, computedMigration } from "./computed/computed-schema.js";
@@ -96,4 +98,4 @@ import { isSchedule } from "./jobs/schedule.js";
 import { DrainResult, JobsRuntime, StartJobsOptions, startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
 import { checkJobsSchema, jobsSchema, jobsSchemaMigration } from "./jobs/schema.js";
-export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApiKeys, type ApiKeysOptions, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticatorOptions, type Caller, type CallerOptions, type CapturedRow, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSource, type HistoryOptions, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type JwtVerifyOptions, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type MemberInput, MissingCredentials, ModelError, type ModelSettings, type NewOrganization, type NewUser, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, handleDroppedConnections, hasUsers, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storeFile, streamChatCompletion, subscription, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };
+export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApiKeys, type ApiKeysOptions, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticatorOptions, type Caller, type CallerOptions, type CapturedRow, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSource, type HistoryOptions, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type JwtVerifyOptions, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type MemberInput, MissingCredentials, type MobileConfig, ModelError, type ModelSettings, type NewOrganization, type NewUser, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, handleDroppedConnections, hasUsers, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storeFile, streamChatCompletion, subscription, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };

package/dist/index.js

@@ -21,6 +21,7 @@ import { webauthnPath } from "./better-auth/origins.js";
 import { apiKeySettings, apiKeyVariables } from "./api-keys/api-key-settings.js";
 import { apiKeyCaller } from "./api-keys/resolve-caller.js";
 import { jwtAuthenticator, jwtVerifier } from "./auth/jwt.js";
+import { defaultAppName } from "./app-name.js";
 import { defaultSignInPolicy, signInPolicyMethods } from "./better-auth/sign-in-policy.js";
 import { parseRoles } from "./better-auth/parse-roles.js";
 import { readOperatorSettings } from "./better-auth/operator-provider.js";
@@ -73,4 +74,4 @@ import { aspectRatio, fileSize, fileType, imageSize, processor } from "./files/p
 import { defineEmail } from "./mail/define-email.js";
 import { startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
-export { FatalJobError, HttpProblem, MissingCredentials, ModelError, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, handleDroppedConnections, hasUsers, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storeFile, streamChatCompletion, subscription, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };
+export { FatalJobError, HttpProblem, MissingCredentials, ModelError, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, handleDroppedConnections, hasUsers, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storeFile, streamChatCompletion, subscription, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };

package/dist/mobile-config.d.ts

@@ -0,0 +1,9 @@
+//#region src/mobile-config.d.ts
+/** The `mobile` section of `protobase.config.ts`: with it, `protobase mobile` builds the app for iOS and Android. */
+export type MobileConfig = {
+  /** The app's id in reverse-DNS form, such as `com.example.shop`. */
+  appId: string;
+  /** Extra native Capacitor plugins the app needs, as npm name → version range, such as `{ '@capacitor/camera': '^8.0.0' }`. */
+  plugins?: Record<string, string>;
+};
+//#endregion

package/dist/mobile-config.js

@@ -0,0 +1,8 @@
+//#region src/mobile-config.ts
+/**
+* The origins Capacitor's WebView serves the app's files on: `capacitor://localhost` on iOS, `https://localhost` on
+* Android. They hold because `protobase mobile` never sets Capacitor's `server.hostname` or schemes.
+*/
+const capacitorOrigins = ["capacitor://localhost", "https://localhost"];
+//#endregion
+export { capacitorOrigins };

package/dist/project-config.d.ts

@@ -1,3 +1,4 @@
+import { MobileConfig } from "./mobile-config.js";
 import { AdminAuth } from "./better-auth/create-auth.js";
 import { EventsOptions } from "./changes/events-options.js";
 import { Authenticator } from "./types.js";
@@ -32,6 +33,8 @@ export type ProjectConfig = {
   webhooks?: WebhooksOptions;
   /** The module of the app's jobs, e.g. `import * as jobs from './config/jobs'`: every `defineJob` it exports. */
   jobs?: Record<string, unknown>;
+  /** The app's iOS and Android build (see `MobileConfig`): `protobase mobile` needs it, and the API answers the app's origins. */
+  mobile?: MobileConfig;
   options?: AdminOptions;
 };
 /** Typed identity, for `export default defineConfig({ extends: [...], config, auth, ... })` in `protobase.config.ts`. */

package/dist/project-config.js

@@ -143,13 +143,14 @@ const mergedOptions = (named) => {
 */
 const mergeConfig = (...configs) => {
 	const named = configs.flatMap((config, index) => flatten(config, config.name ?? `config ${index + 1}`));
-	const { db, authenticate, auth, events, history, webhooks } = lastSet(named.map(({ config }) => ({
+	const { db, authenticate, auth, events, history, webhooks, mobile } = lastSet(named.map(({ config }) => ({
 		db: config.db,
 		authenticate: config.authenticate,
 		auth: config.auth,
 		events: config.events,
 		history: config.history,
-		webhooks: config.webhooks
+		webhooks: config.webhooks,
+		mobile: config.mobile
 	})));
 	const module = mergedModule(named);
 	const functions = mergedFunctions(named);
@@ -169,6 +170,7 @@ const mergeConfig = (...configs) => {
 		...history && { history },
 		...webhooks && { webhooks },
 		...jobs && { jobs },
+		...mobile && { mobile },
 		...options && { options }
 	};
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.26.9",
+  "version": "0.27.0",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -32,9 +32,9 @@
   "dependencies": {
     "@better-auth/passkey": "^1.7.7",
     "@better-auth/sso": "^1.7.7",
-    "@protobase/layout": "0.26.9",
-    "@protobase/query": "0.26.9",
-    "@protobase/schema": "0.26.9",
+    "@protobase/layout": "0.27.0",
+    "@protobase/query": "0.27.0",
+    "@protobase/schema": "0.27.0",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",