@protobase/server 0.26.9 → 0.28.0

package/dist/admin-options.d.ts

@@ -55,8 +55,8 @@ export type AdminOptions = {
   /**
    * The websites whose browser code may call the API (`/api/*` but `/api/auth/*`) besides the app's own origins (see
    * `createAuth`'s `origins`): a list of origins, or `*` for any. Defaults to the one the platform passes in
-   * `PROTOBASE_CORS_ORIGINS` (`*` or comma separated), when set. With neither this nor other origins, the API sends no
-   * CORS headers.
+   * `PROTOBASE_CORS_ORIGINS` (`*` or comma separated), when set. A `mobile` section adds the app's Capacitor origins
+   * (`capacitor://localhost`, `https://localhost`). With none of these nor other origins, the API sends no CORS headers.
    */
   cors?: CorsOrigins;
   /** The runtime updates endpoint behind the top bar's update button (see `RuntimeOptions`); `false` turns it off. */

package/dist/api-cors.js

@@ -1,17 +1,28 @@
 import { readList } from "./better-auth/origins.js";
+import { capacitorOrigins } from "./mobile-config.js";
 import { cors } from "hono/cors";
 //#region src/api-cors.ts
 const corsOriginsVariable = "PROTOBASE_CORS_ORIGINS";
-/** The origins in `PROTOBASE_CORS_ORIGINS`, `*` or comma separated; `undefined` when it is unset. One that is not a URL stops the server at startup. */
+/**
+* The origins in `PROTOBASE_CORS_ORIGINS`, `*` or comma separated; `undefined` when it is unset. One that is not an
+* http or https URL stops the server at startup: another scheme, such as `capacitor:`, has the origin `null`.
+*/
 const readCorsOrigins = (env) => {
 	const value = env[corsOriginsVariable]?.trim();
 	if (!value) return void 0;
 	if (value === "*") return "*";
 	return readList(value).map((origin) => {
 		if (!URL.canParse(origin)) throw new Error(`${corsOriginsVariable} lists "${origin}", which is not a URL such as https://shop.com`);
-		return new URL(origin).origin;
+		const url = new URL(origin);
+		if (url.protocol !== "http:" && url.protocol !== "https:") throw new Error(`${corsOriginsVariable} lists "${origin}", but it takes http and https origins only; a mobile section in protobase.config.ts allows the app's Capacitor origins`);
+		return url.origin;
 	});
 };
+/** The allowed origins plus the Capacitor ones when the app has a mobile section; `*` stays `*`. */
+const withMobileOrigins = (allowed, mobile) => {
+	if (!mobile || allowed === "*") return allowed;
+	return [.../* @__PURE__ */ new Set([...allowed ?? [], ...capacitorOrigins])];
+};
 const allowHeaders = [
 	"authorization",
 	"content-type",
@@ -53,4 +64,4 @@ const apiCors = ({ own, allowed, skip }) => {
 	return (c, next) => skip(c.req.path) ? next() : handler(c, next);
 };
 //#endregion
-export { apiCors, corsOriginsVariable, readCorsOrigins };
+export { apiCors, corsOriginsVariable, readCorsOrigins, withMobileOrigins };

package/dist/app-identity.d.ts

@@ -0,0 +1,12 @@
+//#region src/app-identity.d.ts
+/**
+ * The `app` section of `protobase.config.ts`: the colours the installed app shows, beside its name (`createAuth`'s
+ * `appName`) and its icons (`protobase.favicon.svg` and the PNGs beside it). Any CSS colour, such as `#0d9488`.
+ */
+export type AppIdentity = {
+  /** The colour of the installed app's title bar and of the browser's toolbar around it. */
+  themeColor?: string;
+  /** The colour of the screen an installed app shows while it starts. */
+  backgroundColor?: string;
+};
+//#endregion

package/dist/app-name.d.ts

@@ -0,0 +1,4 @@
+//#region src/app-name.d.ts
+/** The app's name when neither the app nor the platform names it. */
+export declare const defaultAppName = "Protobase";
+//#endregion

package/dist/app-name.js

@@ -4,8 +4,10 @@ const appNameVariable = "PROTOBASE_APP_NAME";
 const defaultAppName = "Protobase";
 /**
 * The app's name the platform passes in `PROTOBASE_APP_NAME`, such as `Property Finder`; `undefined` when it is not
-* set. Protobase names the app with it in sign-in prompts and in the mail it sends, unless the app names itself.
+* set. Protobase names the app with it in sign-in prompts and in the mail it sends, over the name the app gives itself.
 */
 const readAppName = (env) => env["PROTOBASE_APP_NAME"]?.trim() || void 0;
+/** The name the app goes by: the platform's `PROTOBASE_APP_NAME`, which deployments rename it with, over its own `own`. */
+const appNameOver = (env, own) => readAppName(env) ?? own;
 //#endregion
-export { appNameVariable, defaultAppName, readAppName };
+export { appNameOver, appNameVariable, defaultAppName, readAppName };

package/dist/better-auth/create-auth.d.ts

@@ -34,8 +34,9 @@ export type CreateAuthOptions = {
   passkeyDomain?: string;
   /**
    * The app's name: authenticator apps and passkey prompts show it, the auth emails name the app with it, and the
-   * default mailer sends them from it, as the sender's display name. Defaults to the name the platform passes in
-   * `PROTOBASE_APP_NAME`, when set, and to `Protobase` otherwise (without a sender's display name).
+   * default mailer sends them from it, as the sender's display name; the tab titles, the sidebar's logo and the
+   * installed app show it too. The name the platform passes in `PROTOBASE_APP_NAME`, when set, overrides it; without
+   * either it is `Protobase` (without a sender's display name).
    */
   appName?: string;
   /** Signs cookies and encrypts the JWT private keys. Generate with `openssl rand -base64 32`. */
@@ -1294,7 +1295,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               email: string;
               emailVerified: boolean;
               name: string;
-              image?: string | null | undefined;
+              image? /** Signs cookies and encrypts the JWT private keys. Generate with `openssl rand -base64 32`. */ : string | null | undefined;
             };
           };
         }>>[];
@@ -1347,7 +1348,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
           $Infer: {
             body: {
               token: string;
-              issuer? /** Sign-in attempts allowed per minute and client, default 5; also the sign-up requests allowed. */ : string;
+              issuer?: string;
             };
             response: {
               payload: {
@@ -5971,7 +5972,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
   /** The app keeps each user's metadata, in the column `users.metadata` names. */
   userMetadata: boolean;
   socialProviders: string[];
-  /** The app's name it signs in and mails as: `appName`, else `PROTOBASE_APP_NAME`, else `Protobase`. */
+  /** The app's name it signs in and mails as: `PROTOBASE_APP_NAME`, else `appName`, else `Protobase`. */
   appName: string;
   operator: string | undefined;
   platformSignIn: {

package/dist/better-auth/create-auth.js

@@ -1,5 +1,5 @@
-import { multiHostBaseURL, readOrigins, resolveOrigins } from "./origins.js";
-import { defaultAppName, readAppName } from "../app-name.js";
+import { appOrigins, multiHostBaseURL, readOrigins, resolveOrigins } from "./origins.js";
+import { appNameOver, defaultAppName } from "../app-name.js";
 import { goTrueIssuer, goTrueKeyPair } from "../gotrue/keys.js";
 import { roleDefinitions } from "./organizations/role-definitions.js";
 import { narrowClaims } from "./roles/active-role.js";
@@ -38,7 +38,6 @@ const platformOperator = () => readOperatorSettings(globalThis.process?.env ?? {
 const platformSignInSettings = () => readPlatformSignIn(globalThis.process?.env ?? {});
 const platformOrigins = () => readOrigins(globalThis.process?.env ?? {});
 const platformPasskeyDomain = () => readPasskeyDomain(globalThis.process?.env ?? {});
-const platformAppName = () => readAppName(globalThis.process?.env ?? {});
 const tokenLifetime = "15m";
 /**
 * Better Auth for a single-tenant admin: sign-in with a password, an emailed code or a passkey, two-factor
@@ -148,7 +147,8 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 			passkeyPlugin({
 				domain: passkeyDomain ?? hosts[0],
 				hosts,
-				formerDomain: hosts[0]
+				formerDomain: hosts[0],
+				origins: appOrigins(options.baseURL, origins)
 			}),
 			...mail ? [emailOTP(emailCodeOptions(mail))] : [],
 			...mail && signUpRole ? [signUpPlugin({
@@ -275,7 +275,7 @@ const createAuth = (options) => {
 	const signUpRole = options.signUp && checkSignUpRole(options.signUp.role, roles);
 	const others = roles.filter((role) => role !== "admin");
 	const defaultRole = options.defaultRole ?? (options.organizations ? "user" : others.length === 1 ? others[0] : void 0);
-	const appName = options.appName ?? platformAppName();
+	const appName = appNameOver(globalThis.process?.env ?? {}, options.appName);
 	const mailer = options.mailer === void 0 ? platformMailer(void 0, appName) : options.mailer || void 0;
 	const provider = options.operator === void 0 ? platformOperator() : options.operator || void 0;
 	const operator = provider && resolveOperator(provider);
@@ -310,7 +310,7 @@ const createAuth = (options) => {
 		/** Issuer and audience of the tokens: `baseURL`, on every origin. */
 		issuer: options.baseURL,
 		/** Every origin the app is served on, `baseURL`'s first. */
-		origins: [new URL(options.baseURL).origin, ...origins],
+		origins: appOrigins(options.baseURL, origins),
 		/** The RP ID of new passkeys. */
 		passkeyDomain,
 		roles,
@@ -328,7 +328,7 @@ const createAuth = (options) => {
 		/** The app keeps each user's metadata, in the column `users.metadata` names. */
 		userMetadata: Boolean(options.users?.metadata),
 		socialProviders,
-		/** The app's name it signs in and mails as: `appName`, else `PROTOBASE_APP_NAME`, else `Protobase`. */
+		/** The app's name it signs in and mails as: `PROTOBASE_APP_NAME`, else `appName`, else `Protobase`. */
 		appName: appName ?? "Protobase",
 		operator: operator?.name,
 		platformSignIn: platformSignIn && {

package/dist/better-auth/origins.js

@@ -24,6 +24,11 @@ const resolveOrigins = (baseURL, origins) => {
 	return [...new Set(resolved)].filter((origin) => origin !== base.origin);
 };
 /**
+* Every origin the app is served on: `baseURL`'s, then the others from `resolveOrigins`. The only origins a passkey's
+* answer may name, and the list `/.well-known/webauthn` serves; never empty.
+*/
+const appOrigins = (baseURL, origins) => [new URL(baseURL).origin, ...origins];
+/**
 * Better Auth's `baseURL` for an app on several origins: each request is answered for its own host when that is one of
 * them (its links, such as a password reset, and its passkey and sign-in callbacks then stay on that host), and for
 * `baseURL` otherwise. With no other origins it is `baseURL` itself.
@@ -40,4 +45,4 @@ const multiHostBaseURL = (baseURL, origins) => {
 /** Where browsers read which origins may use the app's passkeys (WebAuthn Related Origin Requests). */
 const webauthnPath = "/.well-known/webauthn";
 //#endregion
-export { multiHostBaseURL, originsVariable, readList, readOrigins, resolveOrigins, webauthnPath };
+export { appOrigins, multiHostBaseURL, originsVariable, readList, readOrigins, resolveOrigins, webauthnPath };

package/dist/better-auth/passkey-plugin.js

@@ -18,11 +18,13 @@ const decodeBase64 = (value) => Uint8Array.from(atob(value), (char) => char.char
 * RP ID it was made with, so changing the passkey domain breaks none. A sign-in asks the browser for passkeys of one RP
 * ID, `?rpId=` or the passkey domain, and checks the passkey it gets against its own. On an app with several origins,
 * browsers let each origin use the passkeys of the others through `/.well-known/webauthn` (Related Origin Requests).
+* Adding a passkey and signing in with one both accept only an answer that names one of the app's own origins.
 */
-const passkeyPlugin = ({ domain, hosts, formerDomain }) => {
+const passkeyPlugin = ({ domain, hosts, formerDomain, origins }) => {
 	const base = passkey({
 		schema: pluginNames.passkey,
-		rpID: domain
+		rpID: domain,
+		origin: origins
 	});
 	const rpIDOf = (stored) => stored.rpID ?? formerDomain;
 	/** `GET /passkey/generate-authenticate-options?rpId=`: what the browser needs to ask for a passkey of that RP ID. */
@@ -70,8 +72,6 @@ const passkeyPlugin = ({ domain, hosts, formerDomain }) => {
 		method: "POST",
 		body: z$1.object({ response: z$1.record(z$1.any(), z$1.any()) })
 	}, async (ctx) => {
-		const origin = ctx.headers?.get("origin");
-		if (!origin) throw new APIError("BAD_REQUEST", { message: "origin missing" });
 		const response = ctx.body.response;
 		const cookie = ctx.context.createAuthCookie(challengeCookie);
 		const token = await ctx.getSignedCookie(cookie.name, ctx.context.secret);
@@ -91,7 +91,7 @@ const passkeyPlugin = ({ domain, hosts, formerDomain }) => {
 		const verification = await verifyAuthenticationResponse({
 			response,
 			expectedChallenge,
-			expectedOrigin: origin,
+			expectedOrigin: origins,
 			expectedRPID: rpIDOf(stored),
 			credential: {
 				id: stored.credentialID,

package/dist/create-admin.d.ts

@@ -1,3 +1,6 @@
+import { MobileConfig } from "./mobile-config.js";
+import { AppIdentity } from "./app-identity.js";
+import { AppIcons } from "./web-app/app-icons.js";
 import { AdminAuth } from "./better-auth/create-auth.js";
 import { EventsOptions } from "./changes/events-options.js";
 import { JobDefinition } from "./jobs/job-types.js";
@@ -43,6 +46,15 @@ export type CreateAdminInput = {
   subscriptions?: SubscriptionDefinition[];
   /** Webhook subscriptions made in the admin app, from `extends: [webhooks()]` (see `WebhooksOptions`). */
   webhooks?: WebhooksOptions;
+  /** The app's iOS and Android build (see `MobileConfig`): the API answers its Capacitor origins through CORS. */
+  mobile?: MobileConfig;
+  /** The app's colours, which its web manifest carries (see `AppIdentity`). */
+  app?: AppIdentity;
+  /**
+   * The icons the project has of its own, as `protobase build` and `protobase dev` find them beside its favicon: the
+   * web manifest names its PNGs, and `/meta` the favicon when it is the project's, which the sidebar's logo draws.
+   */
+  icons?: AppIcons;
   /**
    * The plugins the app's bundle carries, as `protobase build` writes them: its protobase.ui.tsx and its extensions'
    * UI configs, each a plugin.json path on the app's origin. `/meta` names them to everyone, before any other plugin,
@@ -69,5 +81,5 @@ export type CreateAdminInput = {
   upgradeWebSocket?: UpgradeWebSocket;
 };
 /** The admin REST API as a Hono app. It uses only Web APIs, so it runs on Node, Workers and anywhere else Hono does. */
-export declare const createAdmin: ({ resources: appResources, views: appViews, pages, userMenu, bottomBars, db, authenticate, auth, functions, files: filesOptions, events, history: historyOptions, jobs, subscriptions, webhooks: webhooksOptions, bundlePlugins, fieldTypes, options, formsDifficulty, commentUsers: givenCommentUsers, verifyToken, upgradeWebSocket }: CreateAdminInput) => Admin;
+export declare const createAdmin: ({ resources: appResources, views: appViews, pages, userMenu, bottomBars, db, authenticate, auth, functions, files: filesOptions, events, history: historyOptions, jobs, subscriptions, webhooks: webhooksOptions, mobile, app: identity, icons, bundlePlugins, fieldTypes, options, formsDifficulty, commentUsers: givenCommentUsers, verifyToken, upgradeWebSocket }: CreateAdminInput) => Admin;
 //#endregion

package/dist/create-admin.js

@@ -10,7 +10,7 @@ import { assistantSettings } from "./assistant/assistant-settings.js";
 import { builtInAssistant } from "./assistant/built-in-assistant.js";
 import { consoleAuditQueue } from "./audit/console-queue.js";
 import { webauthnPath } from "./better-auth/origins.js";
-import { apiCors, readCorsOrigins } from "./api-cors.js";
+import { apiCors, readCorsOrigins, withMobileOrigins } from "./api-cors.js";
 import { apiKeySettings } from "./api-keys/api-key-settings.js";
 import { apiKeyCaller } from "./api-keys/resolve-caller.js";
 import { jwtVerifier } from "./auth/jwt.js";
@@ -63,6 +63,7 @@ import { batchRoute } from "./routes/batch.js";
 import { collectionRoutes } from "./routes/collection.js";
 import { docsRoutes } from "./routes/docs.js";
 import { metaRoutes } from "./routes/meta.js";
+import { faviconPath } from "./web-app/web-manifest.js";
 import { webManifestRoute } from "./web-app/web-manifest-route.js";
 import { recordRoutes } from "./routes/record.js";
 import { createScanGuard } from "./scan-guard.js";
@@ -75,7 +76,7 @@ const declaredRoles = (auth, roles) => {
 	return names.length > 0 ? [...new Set(names)] : void 0;
 };
 /** The admin REST API as a Hono app. It uses only Web APIs, so it runs on Node, Workers and anywhere else Hono does. */
-const createAdmin = ({ resources: appResources, views: appViews = [], pages = [], userMenu, bottomBars = [], db, authenticate, auth, functions = {}, files: filesOptions, events, history: historyOptions, jobs = [], subscriptions = [], webhooks: webhooksOptions, bundlePlugins = [], fieldTypes = {}, options = {}, formsDifficulty, commentUsers: givenCommentUsers, verifyToken, upgradeWebSocket }) => {
+const createAdmin = ({ resources: appResources, views: appViews = [], pages = [], userMenu, bottomBars = [], db, authenticate, auth, functions = {}, files: filesOptions, events, history: historyOptions, jobs = [], subscriptions = [], webhooks: webhooksOptions, mobile, app: identity, icons, bundlePlugins = [], fieldTypes = {}, options = {}, formsDifficulty, commentUsers: givenCommentUsers, verifyToken, upgradeWebSocket }) => {
 	const basePath = options.basePath ?? "/api/v1";
 	const appModels = appResources.map((resource) => resource.toModel());
 	const withComments = appModels.some((model) => model.comments);
@@ -191,7 +192,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 		} }
 	};
 	const appName = auth?.appName ?? readAppName(globalThis.process?.env ?? {}) ?? "Protobase";
-	const meta = createMeta(deps, appName);
+	const meta = createMeta(deps, appName, icons?.favicon ? faviconPath : void 0);
 	const onError = createErrorHandler(options.onUnhandledError);
 	const guarded = (routes, caller = authenticate) => {
 		const app = new Hono();
@@ -219,7 +220,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	}, withAnonymous(authenticate, options.roles));
 	const app = new Hono();
 	app.onError(onError);
-	const corsOrigins = options.cors ?? readCorsOrigins(globalThis.process?.env ?? {});
+	const corsOrigins = withMobileOrigins(options.cors ?? readCorsOrigins(globalThis.process?.env ?? {}), Boolean(mobile));
 	const ownOrigins = auth?.origins ?? [];
 	if (corsOrigins !== void 0 || ownOrigins.length > 1) {
 		const answering = [authBasePath, ...Object.entries(apiFunctions).filter(([, fn]) => fn.options.cors).map(([name]) => `${systemPath}/functions/${name}`)];
@@ -301,7 +302,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	}
 	app.route(basePath, api);
 	app.route(`${deps.systemPath}/meta`, metaApp);
-	app.route(systemPath || "/", webManifestRoute(appName));
+	app.route(systemPath || "/", webManifestRoute(appName, identity, icons));
 	app.route(deps.systemPath || "/", system);
 	const webhooks = createWebhooks({
 		deps,

package/dist/gotrue/provider-flows.js

@@ -0,0 +1,42 @@
+import { goTruePath } from "./keys.js";
+import { hashOf } from "../better-auth/sign-up/sign-up-code.js";
+import { generateRandomString } from "better-auth/crypto";
+import { deleteCookie, getCookie, setCookie } from "hono/cookie";
+//#region src/gotrue/provider-flows.ts
+const flowSeconds = 600;
+const flowCookie = (context) => context.createAuthCookie("gotrue_flow", {
+	maxAge: flowSeconds,
+	path: `${goTruePath}/callback`
+});
+const identifierOf = async (id) => `gotrue-provider-flow-${await hashOf(id)}`;
+/** Keeps `flow` and gives the browser its id; answers the flow's hand-off secret. */
+const startFlow = async (c, context, flow) => {
+	const id = generateRandomString(32);
+	const secret = generateRandomString(32);
+	const stored = {
+		...flow,
+		handOff: await hashOf(secret)
+	};
+	await context.internalAdapter.createVerificationValue({
+		identifier: await identifierOf(id),
+		value: JSON.stringify(stored),
+		expiresAt: new Date(Date.now() + flowSeconds * 1e3)
+	});
+	const { name, attributes } = flowCookie(context);
+	setCookie(c, name, id, attributes);
+	return secret;
+};
+/** Takes the flow of the browser's cookie, so it works once, and clears the cookie; nothing when there is none. */
+const takeFlow = async (c, context) => {
+	const { name, attributes } = flowCookie(context);
+	const id = getCookie(c, name);
+	if (!id) return void 0;
+	deleteCookie(c, name, attributes);
+	const consumed = await context.internalAdapter.consumeVerificationValue(await identifierOf(id));
+	if (!consumed || new Date(consumed.expiresAt) < /* @__PURE__ */ new Date()) return void 0;
+	return JSON.parse(consumed.value);
+};
+/** Whether `secret` is the flow's hand-off secret. */
+const isHandOff = async (flow, secret) => !!secret && await hashOf(secret) === flow.handOff;
+//#endregion
+export { isHandOff, startFlow, takeFlow };

package/dist/gotrue/provider-routes.js

@@ -2,6 +2,7 @@ import { goTruePath } from "./keys.js";
 import { GoTrueError } from "./errors.js";
 import { callBetterAuth } from "./forward.js";
 import { issueAuthCode } from "./auth-codes.js";
+import { isHandOff, startFlow, takeFlow } from "./provider-flows.js";
 import { Hono } from "hono";
 //#region src/gotrue/provider-routes.ts
 const challengeOf = (query) => {
@@ -27,52 +28,65 @@ const providerRoutes = ({ auth, context, sessionOf }) => {
 		if (requested && URL.canParse(requested) && (await context()).isTrustedOrigin(requested)) return requested;
 		return own;
 	};
+	const implicitFragment = async (userId) => {
+		const session = await sessionOf((await (await context()).internalAdapter.createSession(userId)).token);
+		return {
+			access_token: session.access_token,
+			token_type: "bearer",
+			expires_in: String(session.expires_in),
+			expires_at: String(session.expires_at),
+			refresh_token: session.refresh_token
+		};
+	};
 	return new Hono().get("/authorize", async (c) => {
 		const query = c.req.query();
 		const provider = query.provider ?? "";
 		if (!auth.socialProviders.includes(provider)) throw new GoTrueError(400, "validation_failed", `Unsupported provider: ${provider || "none"} is not one of this app's`);
 		const challenge = challengeOf(query);
+		const redirectTo = await destination(query.redirect_to, c.req.raw);
+		if (!challenge && new URL(redirectTo).protocol !== "https:") throw new GoTrueError(400, "validation_failed", "A redirect_to that is not https needs a code_challenge");
+		const before = await auth.api.getSession({ headers: c.req.raw.headers });
+		const secret = await startFlow(c, await context(), {
+			redirectTo,
+			challenge,
+			sessionBefore: before?.session.id
+		});
 		const callback = new URL(`${goTruePath}/callback`, c.req.url);
-		callback.searchParams.set("redirect_to", await destination(query.redirect_to, c.req.raw));
-		if (challenge) {
-			callback.searchParams.set("code_challenge", challenge.challenge);
-			callback.searchParams.set("code_challenge_method", challenge.method);
-		}
+		const success = new URL(callback);
+		success.searchParams.set("flow", secret);
 		const { json, headers } = await callBetterAuth(auth, c.req.raw, "/sign-in/social", {
 			provider,
-			callbackURL: callback.toString(),
+			callbackURL: success.toString(),
 			errorCallbackURL: callback.toString(),
 			disableRedirect: true,
 			...query.scopes && { scopes: query.scopes.split(/[\s,]+/).filter(Boolean) }
 		});
-		const response = c.redirect(String(json.url), 302);
-		for (const cookie of headers.getSetCookie()) response.headers.append("set-cookie", cookie);
-		return response;
+		for (const cookie of headers.getSetCookie()) c.header("set-cookie", cookie, { append: true });
+		return c.redirect(String(json.url), 302);
 	}).get("/callback", async (c) => {
 		const query = c.req.query();
-		const target = await destination(query.redirect_to, c.req.raw);
-		const challenge = challengeOf(query);
-		const where = challenge ? "search" : "hash";
-		const signedIn = !query.error && await auth.api.getSession({ headers: c.req.raw.headers });
-		if (!signedIn) {
+		const ctx = await context();
+		const flow = await takeFlow(c, ctx);
+		const signedIn = flow && !query.error && await isHandOff(flow, query.flow) && await auth.api.getSession({ headers: c.req.raw.headers });
+		const made = signedIn && signedIn.session.id !== flow.sessionBefore ? signedIn : void 0;
+		if (!flow || !made) {
 			const error = query.error ?? "access_denied";
+			const target = flow?.redirectTo ?? await destination(query.redirect_to, c.req.raw);
+			const where = (flow ? flow.challenge : query.code_challenge) ? "search" : "hash";
 			return c.redirect(withParams(target, {
 				error,
 				error_code: error,
 				error_description: query.error_description ?? "The sign-in with the provider did not complete"
 			}, where), 302);
 		}
-		const ctx = await context();
-		if (challenge) return c.redirect(withParams(target, { code: await issueAuthCode(ctx, signedIn.user.id, challenge) }, "search"), 302);
-		const session = await sessionOf((await ctx.internalAdapter.createSession(signedIn.user.id)).token);
-		const fragment = {
-			access_token: session.access_token,
-			token_type: "bearer",
-			expires_in: String(session.expires_in),
-			expires_at: String(session.expires_at),
-			refresh_token: session.refresh_token
-		};
-		return c.redirect(withParams(target, fragment, "hash"), 302);
+		const { redirectTo, challenge } = flow;
+		const handOff = challenge ? withParams(redirectTo, { code: await issueAuthCode(ctx, made.user.id, challenge) }, "search") : withParams(redirectTo, await implicitFragment(made.user.id), "hash");
+		const { headers } = await auth.api.signOut({
+			headers: c.req.raw.headers,
+			returnHeaders: true
+		});
+		for (const cookie of headers.getSetCookie()) c.header("set-cookie", cookie, { append: true });
+		return c.redirect(handOff, 302);
 	});
 };
 //#endregion

package/dist/index.d.ts

@@ -1,3 +1,6 @@
+import { MobileConfig } from "./mobile-config.js";
+import { AppIdentity } from "./app-identity.js";
+import { AppIcons, PngIcon, pngIcons } from "./web-app/app-icons.js";
 import { SignInPolicy, SignInRule, StaffAccessRule, defaultSignInPolicy, signInPolicyMethods } from "./better-auth/sign-in-policy.js";
 import { StaffSignIn } from "./better-auth/staff-log.js";
 import { MailMessage, Mailer } from "./mail/smtp-mailer.js";
@@ -55,6 +58,7 @@ import { parseRoles } from "./better-auth/parse-roles.js";
 import { LinkedAccount, NewUser, StoredUser, createUser, deleteUser, hasUsers, listUsers, roleChoices, setUserBanned, setUserRole } from "./better-auth/users.js";
 import { IssueTokenOptions, issueToken, maxTokenTtlSeconds } from "./better-auth/tokens.js";
 import { webauthnPath } from "./better-auth/origins.js";
+import { defaultAppName } from "./app-name.js";
 import { authSchemaMigration, checkAuthSchema } from "./better-auth/auth-schema.js";
 import { changesMigration, checkChanges, migrationCommand } from "./changes/capture-schema.js";
 import { checkComputed, computedMigration } from "./computed/computed-schema.js";
@@ -96,4 +100,4 @@ import { isSchedule } from "./jobs/schedule.js";
 import { DrainResult, JobsRuntime, StartJobsOptions, startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
 import { checkJobsSchema, jobsSchema, jobsSchemaMigration } from "./jobs/schema.js";
-export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApiKeys, type ApiKeysOptions, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticatorOptions, type Caller, type CallerOptions, type CapturedRow, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSource, type HistoryOptions, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type JwtVerifyOptions, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type MemberInput, MissingCredentials, ModelError, type ModelSettings, type NewOrganization, type NewUser, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, handleDroppedConnections, hasUsers, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storeFile, streamChatCompletion, subscription, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };
+export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApiKeys, type ApiKeysOptions, type AppIcons, type AppIdentity, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticatorOptions, type Caller, type CallerOptions, type CapturedRow, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSource, type HistoryOptions, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type JwtVerifyOptions, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type MemberInput, MissingCredentials, type MobileConfig, ModelError, type ModelSettings, type NewOrganization, type NewUser, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, handleDroppedConnections, hasUsers, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storeFile, streamChatCompletion, subscription, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };

package/dist/index.js

@@ -21,6 +21,7 @@ import { webauthnPath } from "./better-auth/origins.js";
 import { apiKeySettings, apiKeyVariables } from "./api-keys/api-key-settings.js";
 import { apiKeyCaller } from "./api-keys/resolve-caller.js";
 import { jwtAuthenticator, jwtVerifier } from "./auth/jwt.js";
+import { defaultAppName } from "./app-name.js";
 import { defaultSignInPolicy, signInPolicyMethods } from "./better-auth/sign-in-policy.js";
 import { parseRoles } from "./better-auth/parse-roles.js";
 import { readOperatorSettings } from "./better-auth/operator-provider.js";
@@ -48,6 +49,7 @@ import { beforeSignInPluginsVariable, pluginOptions, pluginsBeforeSignIn, plugin
 import { runtimeUrl, runtimeVariable, seesRuntime } from "./runtime/runtime-settings.js";
 import { checkSourceNames, sourceOptions, sourcesFor, sourcesVariable } from "./sources/source-settings.js";
 import { renderVariant, thumbHash } from "./files/images.js";
+import { pngIcons } from "./web-app/app-icons.js";
 import { createAdmin } from "./create-admin.js";
 import { handleDroppedConnections } from "./dropped-connections.js";
 import { configExports } from "./resource-source.js";
@@ -73,4 +75,4 @@ import { aspectRatio, fileSize, fileType, imageSize, processor } from "./files/p
 import { defineEmail } from "./mail/define-email.js";
 import { startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
-export { FatalJobError, HttpProblem, MissingCredentials, ModelError, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, handleDroppedConnections, hasUsers, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storeFile, streamChatCompletion, subscription, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };
+export { FatalJobError, HttpProblem, MissingCredentials, ModelError, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, handleDroppedConnections, hasUsers, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storeFile, streamChatCompletion, subscription, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };

package/dist/meta.js

@@ -28,7 +28,7 @@ const modelsHash = (deps) => sha256Hex(stableJson(deps.registry.entries.map((ent
 * they could use once signed in, which keep their place in the bottom bar and the user menu.
 * The ETag hashes all of it, so it differs per user and per roles.
 */
-const createMeta = (deps, appName) => {
+const createMeta = (deps, appName, appIcon) => {
 	const base = modelsHash(deps);
 	const forCaller = async (session) => {
 		const accesses = await Promise.all(deps.registry.entries.map((entry) => requestAccess(deps, entry, session)));
@@ -62,6 +62,7 @@ const createMeta = (deps, appName) => {
 		const sources = sourcesFor(deps.sources, session.user.roles);
 		const body = {
 			appName,
+			...appIcon && { appIcon },
 			resources: visible.map((access) => access.readable),
 			views,
 			pages,

package/dist/mobile-config.d.ts

@@ -0,0 +1,9 @@
+//#region src/mobile-config.d.ts
+/** The `mobile` section of `protobase.config.ts`: with it, `protobase mobile` builds the app for iOS and Android. */
+export type MobileConfig = {
+  /** The app's id in reverse-DNS form, such as `com.example.shop`. */
+  appId: string;
+  /** Extra native Capacitor plugins the app needs, as npm name → version range, such as `{ '@capacitor/camera': '^8.0.0' }`. */
+  plugins?: Record<string, string>;
+};
+//#endregion

package/dist/mobile-config.js

@@ -0,0 +1,8 @@
+//#region src/mobile-config.ts
+/**
+* The origins Capacitor's WebView serves the app's files on: `capacitor://localhost` on iOS, `https://localhost` on
+* Android. They hold because `protobase mobile` never sets Capacitor's `server.hostname` or schemes.
+*/
+const capacitorOrigins = ["capacitor://localhost", "https://localhost"];
+//#endregion
+export { capacitorOrigins };

package/dist/project-config.d.ts

@@ -1,3 +1,5 @@
+import { MobileConfig } from "./mobile-config.js";
+import { AppIdentity } from "./app-identity.js";
 import { AdminAuth } from "./better-auth/create-auth.js";
 import { EventsOptions } from "./changes/events-options.js";
 import { Authenticator } from "./types.js";
@@ -32,6 +34,10 @@ export type ProjectConfig = {
   webhooks?: WebhooksOptions;
   /** The module of the app's jobs, e.g. `import * as jobs from './config/jobs'`: every `defineJob` it exports. */
   jobs?: Record<string, unknown>;
+  /** The app's iOS and Android build (see `MobileConfig`): `protobase mobile` needs it, and the API answers the app's origins. */
+  mobile?: MobileConfig;
+  /** The installed app's colours (see `AppIdentity`), which its web manifest carries. */
+  app?: AppIdentity;
   options?: AdminOptions;
 };
 /** Typed identity, for `export default defineConfig({ extends: [...], config, auth, ... })` in `protobase.config.ts`. */

package/dist/project-config.js

@@ -143,13 +143,15 @@ const mergedOptions = (named) => {
 */
 const mergeConfig = (...configs) => {
 	const named = configs.flatMap((config, index) => flatten(config, config.name ?? `config ${index + 1}`));
-	const { db, authenticate, auth, events, history, webhooks } = lastSet(named.map(({ config }) => ({
+	const { db, authenticate, auth, events, history, webhooks, mobile, app } = lastSet(named.map(({ config }) => ({
 		db: config.db,
 		authenticate: config.authenticate,
 		auth: config.auth,
 		events: config.events,
 		history: config.history,
-		webhooks: config.webhooks
+		webhooks: config.webhooks,
+		mobile: config.mobile,
+		app: config.app
 	})));
 	const module = mergedModule(named);
 	const functions = mergedFunctions(named);
@@ -169,6 +171,8 @@ const mergeConfig = (...configs) => {
 		...history && { history },
 		...webhooks && { webhooks },
 		...jobs && { jobs },
+		...mobile && { mobile },
+		...app && { app },
 		...options && { options }
 	};
 };

package/dist/web-app/app-icons.d.ts

@@ -0,0 +1,31 @@
+//#region src/web-app/app-icons.d.ts
+/**
+ * The PNG icons a project may put beside its `protobase.favicon.svg`, for platforms that take no SVG, each square at
+ * `size` pixels and answered on the app's own origin at `/<file>`: Android's 192 and 512 pixel icons, a 512 pixel
+ * maskable one whose mark keeps to the middle 80%, and the 180 pixel Apple touch icon an iPhone home screen shows.
+ */
+export declare const pngIcons: {
+  readonly icon192: {
+    readonly file: "protobase.icon-192.png";
+    readonly size: 192;
+  };
+  readonly icon512: {
+    readonly file: "protobase.icon-512.png";
+    readonly size: 512;
+  };
+  readonly maskable: {
+    readonly file: "protobase.icon-maskable.png";
+    readonly size: 512;
+  };
+  readonly appleTouch: {
+    readonly file: "protobase.apple-touch-icon.png";
+    readonly size: 180;
+  };
+};
+export type PngIcon = keyof typeof pngIcons;
+/** The icons a project has of its own: `favicon` when the favicon is its own rather than Protobase's, and its PNGs. */
+export type AppIcons = {
+  favicon: boolean;
+  png: PngIcon[];
+};
+//#endregion

package/dist/web-app/app-icons.js

@@ -0,0 +1,26 @@
+//#region src/web-app/app-icons.ts
+/**
+* The PNG icons a project may put beside its `protobase.favicon.svg`, for platforms that take no SVG, each square at
+* `size` pixels and answered on the app's own origin at `/<file>`: Android's 192 and 512 pixel icons, a 512 pixel
+* maskable one whose mark keeps to the middle 80%, and the 180 pixel Apple touch icon an iPhone home screen shows.
+*/
+const pngIcons = {
+	icon192: {
+		file: "protobase.icon-192.png",
+		size: 192
+	},
+	icon512: {
+		file: "protobase.icon-512.png",
+		size: 512
+	},
+	maskable: {
+		file: "protobase.icon-maskable.png",
+		size: 512
+	},
+	appleTouch: {
+		file: "protobase.apple-touch-icon.png",
+		size: 180
+	}
+};
+//#endregion
+export { pngIcons };

package/dist/web-app/web-manifest-route.js

@@ -4,9 +4,9 @@ import { Hono } from "hono";
 /** The path under the system path (`/api`) the admin app's page links its manifest at. */
 const webManifestPath = "/manifest.webmanifest";
 /** Answers the web app manifest to anyone: the browser fetches it without the user's token, before they sign in. */
-const webManifestRoute = (appName) => {
+const webManifestRoute = (appName, identity, icons) => {
 	const app = new Hono();
-	const body = JSON.stringify(webManifest(appName));
+	const body = JSON.stringify(webManifest(appName, identity, icons));
 	app.get(webManifestPath, () => new Response(body, { headers: {
 		"content-type": "application/manifest+json",
 		"cache-control": "no-cache"

package/dist/web-app/web-manifest.js

@@ -1,22 +1,41 @@
+import { pngIcons } from "./app-icons.js";
 //#region src/web-app/web-manifest.ts
 /** Where the app's favicon is on its own origin, which `protobase build` and `protobase dev` always answer. */
 const faviconPath = "/protobase.favicon.svg";
+const manifestIcons = {
+	icon192: "any",
+	icon512: "any",
+	maskable: "maskable"
+};
+const isManifestIcon = (icon) => icon in manifestIcons;
+const manifestIcon = (icon) => {
+	const { file, size } = pngIcons[icon];
+	return {
+		src: `/${file}`,
+		sizes: `${size}x${size}`,
+		type: "image/png",
+		...manifestIcons[icon] === "maskable" && { purpose: "maskable" }
+	};
+};
 /**
 * The web app manifest that makes the admin app installable: named for the app, opening at its home page in a window
-* of its own, with the favicon as its icon. An SVG with `sizes: "any"` meets Chrome's 192 and 512 pixel icon sizes.
+* of its own, with the favicon as its icon, the project's PNGs beside it and its colours when it has them. An SVG with
+* `sizes: "any"` meets Chrome's 192 and 512 pixel icon sizes; Safari and some Android launchers take only PNGs.
 */
-const webManifest = (appName) => ({
+const webManifest = (appName, { themeColor, backgroundColor } = {}, icons) => ({
 	name: appName,
 	short_name: appName,
 	id: "/",
 	start_url: "/",
 	scope: "/",
 	display: "standalone",
+	...themeColor && { theme_color: themeColor },
+	...backgroundColor && { background_color: backgroundColor },
 	icons: [{
 		src: faviconPath,
 		sizes: "any",
 		type: "image/svg+xml"
-	}]
+	}, ...(icons?.png ?? []).filter(isManifestIcon).map(manifestIcon)]
 });
 //#endregion
 export { faviconPath, webManifest };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.26.9",
+  "version": "0.28.0",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -32,9 +32,9 @@
   "dependencies": {
     "@better-auth/passkey": "^1.7.7",
     "@better-auth/sso": "^1.7.7",
-    "@protobase/layout": "0.26.9",
-    "@protobase/query": "0.26.9",
-    "@protobase/schema": "0.26.9",
+    "@protobase/layout": "0.28.0",
+    "@protobase/query": "0.28.0",
+    "@protobase/schema": "0.28.0",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",