@protobase/server 0.27.0 → 0.28.1

package/dist/app-identity.d.ts

@@ -0,0 +1,12 @@
+//#region src/app-identity.d.ts
+/**
+ * The `app` section of `protobase.config.ts`: the colours the installed app shows, beside its name (`createAuth`'s
+ * `appName`) and its icons (`protobase.favicon.svg` and the PNGs beside it). Any CSS colour, such as `#0d9488`.
+ */
+export type AppIdentity = {
+  /** The colour of the installed app's title bar and of the browser's toolbar around it. */
+  themeColor?: string;
+  /** The colour of the screen an installed app shows while it starts. */
+  backgroundColor?: string;
+};
+//#endregion

package/dist/app-name.js

@@ -4,8 +4,10 @@ const appNameVariable = "PROTOBASE_APP_NAME";
 const defaultAppName = "Protobase";
 /**
 * The app's name the platform passes in `PROTOBASE_APP_NAME`, such as `Property Finder`; `undefined` when it is not
-* set. Protobase names the app with it in sign-in prompts and in the mail it sends, unless the app names itself.
+* set. Protobase names the app with it in sign-in prompts and in the mail it sends, over the name the app gives itself.
 */
 const readAppName = (env) => env["PROTOBASE_APP_NAME"]?.trim() || void 0;
+/** The name the app goes by: the platform's `PROTOBASE_APP_NAME`, which deployments rename it with, over its own `own`. */
+const appNameOver = (env, own) => readAppName(env) ?? own;
 //#endregion
-export { appNameVariable, defaultAppName, readAppName };
+export { appNameOver, appNameVariable, defaultAppName, readAppName };

package/dist/better-auth/create-auth.d.ts

@@ -34,8 +34,9 @@ export type CreateAuthOptions = {
   passkeyDomain?: string;
   /**
    * The app's name: authenticator apps and passkey prompts show it, the auth emails name the app with it, and the
-   * default mailer sends them from it, as the sender's display name. Defaults to the name the platform passes in
-   * `PROTOBASE_APP_NAME`, when set, and to `Protobase` otherwise (without a sender's display name).
+   * default mailer sends them from it, as the sender's display name; the tab titles, the sidebar's logo and the
+   * installed app show it too. The name the platform passes in `PROTOBASE_APP_NAME`, when set, overrides it; without
+   * either it is `Protobase` (without a sender's display name).
    */
   appName?: string;
   /** Signs cookies and encrypts the JWT private keys. Generate with `openssl rand -base64 32`. */
@@ -1294,7 +1295,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               email: string;
               emailVerified: boolean;
               name: string;
-              image?: string | null | undefined;
+              image? /** Signs cookies and encrypts the JWT private keys. Generate with `openssl rand -base64 32`. */ : string | null | undefined;
             };
           };
         }>>[];
@@ -4018,7 +4019,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               userId: string;
               expiresAt: Date;
               token: string;
-              ipAddress? /** The RP ID of new passkeys. */ : string | null | undefined;
+              ipAddress?: string | null | undefined;
               userAgent?: string | null | undefined;
             };
             user: Record<string, any> & {
@@ -5971,7 +5972,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
   /** The app keeps each user's metadata, in the column `users.metadata` names. */
   userMetadata: boolean;
   socialProviders: string[];
-  /** The app's name it signs in and mails as: `appName`, else `PROTOBASE_APP_NAME`, else `Protobase`. */
+  /** The app's name it signs in and mails as: `PROTOBASE_APP_NAME`, else `appName`, else `Protobase`. */
   appName: string;
   operator: string | undefined;
   platformSignIn: {

package/dist/better-auth/create-auth.js

@@ -1,5 +1,5 @@
 import { appOrigins, multiHostBaseURL, readOrigins, resolveOrigins } from "./origins.js";
-import { defaultAppName, readAppName } from "../app-name.js";
+import { appNameOver, defaultAppName } from "../app-name.js";
 import { goTrueIssuer, goTrueKeyPair } from "../gotrue/keys.js";
 import { roleDefinitions } from "./organizations/role-definitions.js";
 import { narrowClaims } from "./roles/active-role.js";
@@ -38,7 +38,6 @@ const platformOperator = () => readOperatorSettings(globalThis.process?.env ?? {
 const platformSignInSettings = () => readPlatformSignIn(globalThis.process?.env ?? {});
 const platformOrigins = () => readOrigins(globalThis.process?.env ?? {});
 const platformPasskeyDomain = () => readPasskeyDomain(globalThis.process?.env ?? {});
-const platformAppName = () => readAppName(globalThis.process?.env ?? {});
 const tokenLifetime = "15m";
 /**
 * Better Auth for a single-tenant admin: sign-in with a password, an emailed code or a passkey, two-factor
@@ -276,7 +275,7 @@ const createAuth = (options) => {
 	const signUpRole = options.signUp && checkSignUpRole(options.signUp.role, roles);
 	const others = roles.filter((role) => role !== "admin");
 	const defaultRole = options.defaultRole ?? (options.organizations ? "user" : others.length === 1 ? others[0] : void 0);
-	const appName = options.appName ?? platformAppName();
+	const appName = appNameOver(globalThis.process?.env ?? {}, options.appName);
 	const mailer = options.mailer === void 0 ? platformMailer(void 0, appName) : options.mailer || void 0;
 	const provider = options.operator === void 0 ? platformOperator() : options.operator || void 0;
 	const operator = provider && resolveOperator(provider);
@@ -329,7 +328,7 @@ const createAuth = (options) => {
 		/** The app keeps each user's metadata, in the column `users.metadata` names. */
 		userMetadata: Boolean(options.users?.metadata),
 		socialProviders,
-		/** The app's name it signs in and mails as: `appName`, else `PROTOBASE_APP_NAME`, else `Protobase`. */
+		/** The app's name it signs in and mails as: `PROTOBASE_APP_NAME`, else `appName`, else `Protobase`. */
 		appName: appName ?? "Protobase",
 		operator: operator?.name,
 		platformSignIn: platformSignIn && {

package/dist/check-parents.js

@@ -0,0 +1,16 @@
+//#region src/check-parents.ts
+/**
+* Stops startup on a `.parent()` whose relation cannot find the parent record: a resource the app does not have, or one
+* whose key is not exactly one field, the relation's one column.
+*/
+const checkParents = (registry) => {
+	const problems = registry.entries.flatMap(({ name, model }) => (model.parents ?? []).flatMap(({ field }) => {
+		const resource = model.fields[field].relation.resource;
+		const parent = registry.find(resource)?.model;
+		if (!parent) return [`${name} parent "${field}": unknown resource "${resource}"`];
+		return parent.primaryKey.length === 1 ? [] : [`${name} parent "${field}": "${resource}" has a key of ${parent.primaryKey.length} fields, not one`];
+	}));
+	if (problems.length > 0) throw new Error(`The parents cannot find the records they point at:\n${problems.map((problem) => `  - ${problem}`).join("\n")}`);
+};
+//#endregion
+export { checkParents };

package/dist/comments/comment-access.js

@@ -1,6 +1,6 @@
 import { forbidden, notFound } from "../problem.js";
 import { requestAccess, requireOperation } from "../request-access.js";
-import { fetchReadable } from "../read-service.js";
+import { fetchReadable } from "../fetch-readable.js";
 //#region src/comments/comment-access.ts
 /** The caller's access to a resource with comments, who must be allowed to read it; a resource without is a 404. */
 const commentAccess = async (deps, entry, session) => {

package/dist/create-admin.d.ts

@@ -1,4 +1,6 @@
 import { MobileConfig } from "./mobile-config.js";
+import { AppIdentity } from "./app-identity.js";
+import { AppIcons } from "./web-app/app-icons.js";
 import { AdminAuth } from "./better-auth/create-auth.js";
 import { EventsOptions } from "./changes/events-options.js";
 import { JobDefinition } from "./jobs/job-types.js";
@@ -46,6 +48,13 @@ export type CreateAdminInput = {
   webhooks?: WebhooksOptions;
   /** The app's iOS and Android build (see `MobileConfig`): the API answers its Capacitor origins through CORS. */
   mobile?: MobileConfig;
+  /** The app's colours, which its web manifest carries (see `AppIdentity`). */
+  app?: AppIdentity;
+  /**
+   * The icons the project has of its own, as `protobase build` and `protobase dev` find them beside its favicon: the
+   * web manifest names its PNGs, and `/meta` the favicon when it is the project's, which the sidebar's logo draws.
+   */
+  icons?: AppIcons;
   /**
    * The plugins the app's bundle carries, as `protobase build` writes them: its protobase.ui.tsx and its extensions'
    * UI configs, each a plugin.json path on the app's origin. `/meta` names them to everyone, before any other plugin,
@@ -72,5 +81,5 @@ export type CreateAdminInput = {
   upgradeWebSocket?: UpgradeWebSocket;
 };
 /** The admin REST API as a Hono app. It uses only Web APIs, so it runs on Node, Workers and anywhere else Hono does. */
-export declare const createAdmin: ({ resources: appResources, views: appViews, pages, userMenu, bottomBars, db, authenticate, auth, functions, files: filesOptions, events, history: historyOptions, jobs, subscriptions, webhooks: webhooksOptions, mobile, bundlePlugins, fieldTypes, options, formsDifficulty, commentUsers: givenCommentUsers, verifyToken, upgradeWebSocket }: CreateAdminInput) => Admin;
+export declare const createAdmin: ({ resources: appResources, views: appViews, pages, userMenu, bottomBars, db, authenticate, auth, functions, files: filesOptions, events, history: historyOptions, jobs, subscriptions, webhooks: webhooksOptions, mobile, app: identity, icons, bundlePlugins, fieldTypes, options, formsDifficulty, commentUsers: givenCommentUsers, verifyToken, upgradeWebSocket }: CreateAdminInput) => Admin;
 //#endregion

package/dist/create-admin.js

@@ -41,6 +41,7 @@ import { visitorsBrowse, withAnonymous } from "./anonymous.js";
 import { checkBottomBars, checkShell } from "./check-shell.js";
 import { checkOwnerFields } from "./check-owners.js";
 import { checkRoleLimits } from "./check-roles.js";
+import { checkParents } from "./check-parents.js";
 import { checkPositionAfter } from "./check-position-after.js";
 import { checkViews } from "./check-views.js";
 import { liveRoutes } from "./live/live-route.js";
@@ -63,6 +64,7 @@ import { batchRoute } from "./routes/batch.js";
 import { collectionRoutes } from "./routes/collection.js";
 import { docsRoutes } from "./routes/docs.js";
 import { metaRoutes } from "./routes/meta.js";
+import { faviconPath } from "./web-app/web-manifest.js";
 import { webManifestRoute } from "./web-app/web-manifest-route.js";
 import { recordRoutes } from "./routes/record.js";
 import { createScanGuard } from "./scan-guard.js";
@@ -75,7 +77,7 @@ const declaredRoles = (auth, roles) => {
 	return names.length > 0 ? [...new Set(names)] : void 0;
 };
 /** The admin REST API as a Hono app. It uses only Web APIs, so it runs on Node, Workers and anywhere else Hono does. */
-const createAdmin = ({ resources: appResources, views: appViews = [], pages = [], userMenu, bottomBars = [], db, authenticate, auth, functions = {}, files: filesOptions, events, history: historyOptions, jobs = [], subscriptions = [], webhooks: webhooksOptions, mobile, bundlePlugins = [], fieldTypes = {}, options = {}, formsDifficulty, commentUsers: givenCommentUsers, verifyToken, upgradeWebSocket }) => {
+const createAdmin = ({ resources: appResources, views: appViews = [], pages = [], userMenu, bottomBars = [], db, authenticate, auth, functions = {}, files: filesOptions, events, history: historyOptions, jobs = [], subscriptions = [], webhooks: webhooksOptions, mobile, app: identity, icons, bundlePlugins = [], fieldTypes = {}, options = {}, formsDifficulty, commentUsers: givenCommentUsers, verifyToken, upgradeWebSocket }) => {
 	const basePath = options.basePath ?? "/api/v1";
 	const appModels = appResources.map((resource) => resource.toModel());
 	const withComments = appModels.some((model) => model.comments);
@@ -110,6 +112,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	checkRoleLimits(registry, options.roles?.limits ?? []);
 	checkOwnerFields(registry, auth);
 	checkPositionAfter(registry);
+	checkParents(registry);
 	checkPages(pageModels, {
 		models: Object.fromEntries(registry.entries.map((entry) => [entry.name, entry.model])),
 		actions: (resource) => new Set(viewModels.filter((view) => view.resource === resource).flatMap((view) => view.actions.map((action) => action.name))),
@@ -191,7 +194,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 		} }
 	};
 	const appName = auth?.appName ?? readAppName(globalThis.process?.env ?? {}) ?? "Protobase";
-	const meta = createMeta(deps, appName);
+	const meta = createMeta(deps, appName, icons?.favicon ? faviconPath : void 0);
 	const onError = createErrorHandler(options.onUnhandledError);
 	const guarded = (routes, caller = authenticate) => {
 		const app = new Hono();
@@ -301,7 +304,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	}
 	app.route(basePath, api);
 	app.route(`${deps.systemPath}/meta`, metaApp);
-	app.route(systemPath || "/", webManifestRoute(appName));
+	app.route(systemPath || "/", webManifestRoute(appName, identity, icons));
 	app.route(deps.systemPath || "/", system);
 	const webhooks = createWebhooks({
 		deps,

package/dist/error-handler.js

@@ -28,6 +28,7 @@ const databaseProblem = (error) => {
 	if (error.code === "57014") return new HttpProblem(504, "statement-timeout", "Gateway Timeout", "The query exceeded the statement timeout");
 	if (error.code === "23505") return new HttpProblem(409, "conflict", "Conflict", "A record with the same unique value already exists");
 	if (error.code === "23503") return new HttpProblem(409, "conflict", "Conflict", "The record points at, or is pointed at by, another record");
+	if (error.code === "40P01") return new HttpProblem(409, "conflict", "Conflict", "The record was written at the same time as another; send it again");
 	if (error.code === "23502") return new HttpProblem(400, "invalid-record", "Bad Request", "A required column has no value");
 	if (error.code === "23514") return new HttpProblem(400, "invalid-record", "Bad Request", "A check constraint rejected the record");
 	if (error.code.startsWith("22")) return new HttpProblem(400, "invalid-value", "Bad Request", "A value has the wrong format for its column");

package/dist/fetch-readable.js

@@ -0,0 +1,33 @@
+import { tenantScope } from "./tenant.js";
+import { recordDecision, targetFilter } from "./request-access.js";
+import { fetchRecord } from "./records.js";
+//#region src/fetch-readable.ts
+/**
+* The row with this key if the caller may read it: inside their tenant and row filter, and passing a record-level read
+* rule. Such a rule may look at fields the caller cannot see, so then the whole row is read; the caller cuts it down.
+* `lock` locks the row the first read finds.
+*/
+const fetchReadable = async (trx, access, key, deleted, { fields, lock, ...shape }) => {
+	const { entry } = access;
+	const tenant = tenantScope(entry, access.session)?.tenantValue;
+	const recordRule = access.resolved.recordChecks.includes("read");
+	const filter = targetFilter(access, "read");
+	const current = await fetchRecord(trx, entry, key, tenant, {
+		deleted,
+		...filter && { filter },
+		...lock && { lock },
+		...shape,
+		...!recordRule && fields && { fields }
+	});
+	if (!current || !recordRule) return current;
+	const decision = await recordDecision(access, "read", current.record);
+	if (decision === false) return void 0;
+	if (decision !== true && !await fetchRecord(trx, entry, key, tenant, {
+		deleted,
+		filter: decision,
+		fields: [access.full.fields[access.full.primaryKey[0]]]
+	})) return void 0;
+	return current;
+};
+//#endregion
+export { fetchReadable };

package/dist/history/read-history.js

@@ -1,8 +1,8 @@
 import { notFound } from "../problem.js";
 import { tenantScope } from "../tenant.js";
 import { requestAccess, requireOperation } from "../request-access.js";
+import { fetchReadable } from "../fetch-readable.js";
 import { readTransaction } from "../transactions.js";
-import { fetchReadable } from "../read-service.js";
 import { quoteIdent } from "../changes/capture-sql.js";
 import { parseParams } from "../params.js";
 import { encodeKey } from "@protobase/schema/internal";

package/dist/index.d.ts

@@ -1,4 +1,6 @@
 import { MobileConfig } from "./mobile-config.js";
+import { AppIdentity } from "./app-identity.js";
+import { AppIcons, PngIcon, pngIcons } from "./web-app/app-icons.js";
 import { SignInPolicy, SignInRule, StaffAccessRule, defaultSignInPolicy, signInPolicyMethods } from "./better-auth/sign-in-policy.js";
 import { StaffSignIn } from "./better-auth/staff-log.js";
 import { MailMessage, Mailer } from "./mail/smtp-mailer.js";
@@ -98,4 +100,4 @@ import { isSchedule } from "./jobs/schedule.js";
 import { DrainResult, JobsRuntime, StartJobsOptions, startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
 import { checkJobsSchema, jobsSchema, jobsSchemaMigration } from "./jobs/schema.js";
-export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApiKeys, type ApiKeysOptions, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticatorOptions, type Caller, type CallerOptions, type CapturedRow, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSource, type HistoryOptions, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type JwtVerifyOptions, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type MemberInput, MissingCredentials, type MobileConfig, ModelError, type ModelSettings, type NewOrganization, type NewUser, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, handleDroppedConnections, hasUsers, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storeFile, streamChatCompletion, subscription, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };
+export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApiKeys, type ApiKeysOptions, type AppIcons, type AppIdentity, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticatorOptions, type Caller, type CallerOptions, type CapturedRow, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSource, type HistoryOptions, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type JwtVerifyOptions, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type MemberInput, MissingCredentials, type MobileConfig, ModelError, type ModelSettings, type NewOrganization, type NewUser, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, handleDroppedConnections, hasUsers, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storeFile, streamChatCompletion, subscription, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };

package/dist/index.js

@@ -49,6 +49,7 @@ import { beforeSignInPluginsVariable, pluginOptions, pluginsBeforeSignIn, plugin
 import { runtimeUrl, runtimeVariable, seesRuntime } from "./runtime/runtime-settings.js";
 import { checkSourceNames, sourceOptions, sourcesFor, sourcesVariable } from "./sources/source-settings.js";
 import { renderVariant, thumbHash } from "./files/images.js";
+import { pngIcons } from "./web-app/app-icons.js";
 import { createAdmin } from "./create-admin.js";
 import { handleDroppedConnections } from "./dropped-connections.js";
 import { configExports } from "./resource-source.js";
@@ -74,4 +75,4 @@ import { aspectRatio, fileSize, fileType, imageSize, processor } from "./files/p
 import { defineEmail } from "./mail/define-email.js";
 import { startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
-export { FatalJobError, HttpProblem, MissingCredentials, ModelError, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, handleDroppedConnections, hasUsers, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storeFile, streamChatCompletion, subscription, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };
+export { FatalJobError, HttpProblem, MissingCredentials, ModelError, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, handleDroppedConnections, hasUsers, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storeFile, streamChatCompletion, subscription, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };

package/dist/meta.js

@@ -28,7 +28,7 @@ const modelsHash = (deps) => sha256Hex(stableJson(deps.registry.entries.map((ent
 * they could use once signed in, which keep their place in the bottom bar and the user menu.
 * The ETag hashes all of it, so it differs per user and per roles.
 */
-const createMeta = (deps, appName) => {
+const createMeta = (deps, appName, appIcon) => {
 	const base = modelsHash(deps);
 	const forCaller = async (session) => {
 		const accesses = await Promise.all(deps.registry.entries.map((entry) => requestAccess(deps, entry, session)));
@@ -62,10 +62,11 @@ const createMeta = (deps, appName) => {
 		const sources = sourcesFor(deps.sources, session.user.roles);
 		const body = {
 			appName,
+			...appIcon && { appIcon },
 			resources: visible.map((access) => access.readable),
 			views,
 			pages,
-			permissions: Object.fromEntries(visible.map(({ entry, resolved }) => [entry.name, {
+			permissions: Object.fromEntries(visible.map(({ entry, resolved, full }) => [entry.name, {
 				read: resolved.operations.read || resolved.operations.list,
 				create: resolved.operations.create,
 				update: resolved.operations.update,
@@ -74,7 +75,7 @@ const createMeta = (deps, appName) => {
 					"create",
 					"update",
 					"delete"
-				].filter((op) => resolved.operations[op] && (resolved.recordChecks.includes(op) || resolved.rowFilter[op] !== void 0))
+				].filter((op) => resolved.operations[op] && (resolved.recordChecks.includes(op) || resolved.rowFilter[op] !== void 0 || (full.parents?.length ?? 0) > 0))
 			}])),
 			...signIn.length > 0 && { signIn },
 			...deps.userMenu && { userMenu: { items: deps.userMenu.items.filter(shown) } },

package/dist/parent-access.js

@@ -0,0 +1,84 @@
+import { tenantScope } from "./tenant.js";
+import { recordDecision, requestAccess } from "./request-access.js";
+import { fetchRecord } from "./records.js";
+import { fetchReadable } from "./fetch-readable.js";
+//#region src/parent-access.ts
+/** A record's identity across resources; `1` and `"1"` are the same record. */
+const pathKey = (resource, key) => JSON.stringify([resource, ...key.map(String)]);
+/**
+* The parents these records name through `model.parents`, a null or missing relation naming none, sorted by path key:
+* the order they are locked in, so two writes naming the same parents lock them in the same order. A parent named twice
+* with the same need is checked once.
+*/
+const parentTargets = (model, records) => {
+	const targets = records.flatMap((record) => (model.parents ?? []).flatMap(({ field, access }) => {
+		const value = record[field];
+		if (value === void 0 || value === null) return [];
+		const resource = model.fields[field].relation.resource;
+		return [{
+			field,
+			access,
+			resource,
+			value,
+			key: pathKey(resource, [value])
+		}];
+	}));
+	return targets.filter((target, index) => targets.findIndex((other) => other.key === target.key && other.access === target.access) === index).sort((a, b) => a.key < b.key ? -1 : a.key > b.key ? 1 : 0);
+};
+const mayOn = async (scope, entry, key, need, path) => {
+	const access = await scope.accessOf(entry);
+	if (!access.resolved.operations.read) return false;
+	const found = await fetchReadable(scope.trx, access, key, "hide", scope.lock ? { lock: "no-key-update" } : {});
+	if (!found) return false;
+	if (need === "read") return true;
+	if (!access.resolved.operations.update) return false;
+	const tenant = tenantScope(entry, access.session)?.tenantValue;
+	const keyField = [access.full.fields[access.full.primaryKey[0]]];
+	const filter = access.resolved.rowFilter.update;
+	if (filter && !await fetchRecord(scope.trx, entry, key, tenant, {
+		filter,
+		fields: keyField
+	})) return false;
+	if (access.resolved.recordChecks.includes("update")) {
+		const decision = await recordDecision(access, "update", found.record, {});
+		if (decision === false) return false;
+		if (decision !== true && !await fetchRecord(scope.trx, entry, key, tenant, {
+			filter: decision,
+			fields: keyField
+		})) return false;
+	}
+	return parentsAllow(scope, access, [found.record], [...path, pathKey(entry.name, key)]);
+};
+const parentsAllow = async (scope, access, records, path) => {
+	for (const target of parentTargets(access.full, records)) {
+		if (path.includes(target.key)) return false;
+		const entry = scope.deps.registry.find(target.resource);
+		if (!entry) throw new Error(`Parent "${target.field}" of "${access.entry.name}" points at "${target.resource}", which the app does not have`);
+		if (!await mayOn(scope, entry, [target.value], target.access, path)) return false;
+	}
+	return true;
+};
+const ownPath = (access, records) => records.filter((record) => access.full.primaryKey.every((name) => record[name] !== void 0 && record[name] !== null)).map((record) => pathKey(access.entry.name, access.full.primaryKey.map((name) => record[name])));
+/**
+* Whether the caller may write records of `access`'s resource given the parents they name (`.parent()`): an update passes
+* the record before and after, so the parent it leaves and the one it moves to are locked in one order. With `lock`,
+* each parent is locked FOR NO KEY UPDATE until the transaction ends, so a parent changed or deleted at the same moment
+* cannot slip through; a read-only transaction cannot lock. Every call checks again; only each resource's access for
+* the session is reused.
+*/
+const parentGuard = (trx, access, lock) => {
+	const resolved = /* @__PURE__ */ new Map();
+	const accessOf = (entry) => {
+		if (!resolved.has(entry.name)) resolved.set(entry.name, requestAccess(access.deps, entry, access.session));
+		return resolved.get(entry.name);
+	};
+	const scope = {
+		trx,
+		deps: access.deps,
+		lock,
+		accessOf
+	};
+	return (...records) => parentsAllow(scope, access, records, ownPath(access, records));
+};
+//#endregion
+export { parentGuard, parentTargets, pathKey };

package/dist/project-config.d.ts

@@ -1,4 +1,5 @@
 import { MobileConfig } from "./mobile-config.js";
+import { AppIdentity } from "./app-identity.js";
 import { AdminAuth } from "./better-auth/create-auth.js";
 import { EventsOptions } from "./changes/events-options.js";
 import { Authenticator } from "./types.js";
@@ -35,6 +36,8 @@ export type ProjectConfig = {
   jobs?: Record<string, unknown>;
   /** The app's iOS and Android build (see `MobileConfig`): `protobase mobile` needs it, and the API answers the app's origins. */
   mobile?: MobileConfig;
+  /** The installed app's colours (see `AppIdentity`), which its web manifest carries. */
+  app?: AppIdentity;
   options?: AdminOptions;
 };
 /** Typed identity, for `export default defineConfig({ extends: [...], config, auth, ... })` in `protobase.config.ts`. */

package/dist/project-config.js

@@ -143,14 +143,15 @@ const mergedOptions = (named) => {
 */
 const mergeConfig = (...configs) => {
 	const named = configs.flatMap((config, index) => flatten(config, config.name ?? `config ${index + 1}`));
-	const { db, authenticate, auth, events, history, webhooks, mobile } = lastSet(named.map(({ config }) => ({
+	const { db, authenticate, auth, events, history, webhooks, mobile, app } = lastSet(named.map(({ config }) => ({
 		db: config.db,
 		authenticate: config.authenticate,
 		auth: config.auth,
 		events: config.events,
 		history: config.history,
 		webhooks: config.webhooks,
-		mobile: config.mobile
+		mobile: config.mobile,
+		app: config.app
 	})));
 	const module = mergedModule(named);
 	const functions = mergedFunctions(named);
@@ -171,6 +172,7 @@ const mergeConfig = (...configs) => {
 		...webhooks && { webhooks },
 		...jobs && { jobs },
 		...mobile && { mobile },
+		...app && { app },
 		...options && { options }
 	};
 };

package/dist/read-service.js

@@ -1,40 +1,14 @@
 import { notFound } from "./problem.js";
-import { tenantScope } from "./tenant.js";
-import { recordDecision, requestAccess, requireOperation, targetFilter, visibleFields, writableFields } from "./request-access.js";
+import { requestAccess, requireOperation, visibleFields, writableFields } from "./request-access.js";
 import { presentFiles } from "./files/present.js";
 import { pickFields } from "./rows.js";
-import { fetchRecord } from "./records.js";
+import { fetchReadable } from "./fetch-readable.js";
 import { rowPermissions } from "./row-permissions.js";
 import { readTransaction } from "./transactions.js";
 //#region src/read-service.ts
 /** `edit` for fields the caller may change on this record, `read` for the rest (sensitive ones included); hidden fields are not listed at all. */
 const fieldModes = (access, canUpdate) => Object.fromEntries(Object.keys(access.readable.fields).map((name) => [name, canUpdate && writableFields(access, "update").includes(name) ? "edit" : "read"]));
 /**
-* The row with this key if the caller may read it: inside their tenant and row filter, and passing a record-level read
-* rule. Such a rule may look at fields the caller cannot see, so then the whole row is read; the caller cuts it down.
-*/
-const fetchReadable = async (trx, access, key, deleted, { fields, ...shape }) => {
-	const { entry } = access;
-	const tenant = tenantScope(entry, access.session)?.tenantValue;
-	const recordRule = access.resolved.recordChecks.includes("read");
-	const filter = targetFilter(access, "read");
-	const current = await fetchRecord(trx, entry, key, tenant, {
-		deleted,
-		...filter && { filter },
-		...shape,
-		...!recordRule && fields && { fields }
-	});
-	if (!current || !recordRule) return current;
-	const decision = await recordDecision(access, "read", current.record);
-	if (decision === false) return void 0;
-	if (decision !== true && !await fetchRecord(trx, entry, key, tenant, {
-		deleted,
-		filter: decision,
-		fields: [access.full.fields[access.full.primaryKey[0]]]
-	})) return void 0;
-	return current;
-};
-/**
 * The record with this key as the caller may see it: readable fields only, inside the caller's tenant and row filter.
 * A key outside the tenant, outside the row filter, or failing a record-level read rule is a plain 404.
 */
@@ -66,4 +40,4 @@ const readRecord = async (deps, entry, session, key, deleted = "hide") => {
 	};
 };
 //#endregion
-export { fetchReadable, fieldModes, readRecord };
+export { fieldModes, readRecord };

package/dist/records.js

@@ -12,6 +12,7 @@ const stored = async (entry, raw, shape = {}) => {
 	};
 };
 const rowsOf = async (db, query) => (await query.execute(db)).rows;
+const lockClause = (lock) => lock === "no-key-update" ? sql` for no key update` : lock ? sql` for update` : sql``;
 /** The row of the caller's tenant with this key (live unless `deleted` says otherwise), optionally narrowed by a filter. */
 const fetchRecord = async (db, entry, key, tenant, options = {}) => {
 	const { filter, deleted, lock = false, ...shape } = options;
@@ -20,7 +21,7 @@ const fetchRecord = async (db, entry, key, tenant, options = {}) => {
 		...keyConditions(entry.model, key),
 		...filterCondition(entry.model, filter)
 	];
-	const query = sql`select ${returningList(entry, shape.fields)} from ${tableId(entry.model)} as t${whereClause(conditions)} limit 1${lock ? sql` for update` : sql``}`;
+	const query = sql`select ${returningList(entry, shape.fields)} from ${tableId(entry.model)} as t${whereClause(conditions)} limit 1${lockClause(lock)}`;
 	return stored(entry, (await rowsOf(db, query))[0], shape);
 };
 const writeValue = (field, value) => field.type === "json" && value !== null ? JSON.stringify(value) : value;

package/dist/reveal-service.js

@@ -1,8 +1,8 @@
 import { badRequest, notFound } from "./problem.js";
 import { tenantScope } from "./tenant.js";
 import { requestAccess, requireOperation } from "./request-access.js";
+import { fetchReadable } from "./fetch-readable.js";
 import { readTransaction } from "./transactions.js";
-import { fetchReadable } from "./read-service.js";
 import { encodeKey } from "@protobase/schema/internal";
 //#region src/reveal-service.ts
 /**

package/dist/row-permissions.js

@@ -2,6 +2,7 @@ import { tenantScope } from "./tenant.js";
 import { recordDecision } from "./request-access.js";
 import { aliasedColumn, columnId, scopeConditions, tableId, whereClause } from "./sql-parts.js";
 import { fetchRecord } from "./records.js";
+import { parentGuard } from "./parent-access.js";
 import { sql } from "kysely";
 import { compileFilter } from "@protobase/query";
 //#region src/row-permissions.ts
@@ -21,8 +22,8 @@ const matching = async (trx, access, rows, filter) => {
 };
 /**
 * What the caller may do with each of these (exposed) rows: the operation must be allowed, the row must match the
-* operation's row filter (checked in the database), and a record-level rule must pass for the stored record. This only
-* informs the UI; every write is checked again by the write pipeline.
+* operation's row filter (checked in the database), a record-level rule must pass for the stored record, and its parents
+* (`.parent()`) must allow writing it. This only informs the UI; every write is checked again by the write pipeline.
 */
 const rowPermissions = async (trx, access, rows) => {
 	const { resolved, entry, session } = access;
@@ -63,7 +64,23 @@ const rowPermissions = async (trx, access, rows) => {
 			if (decision !== true) result[i][operation] = (await matching(trx, access, [row], decision)).size > 0;
 		}
 	}
+	await withParents(trx, access, rows, result);
 	return result;
 };
+const withParents = async (trx, access, rows, result) => {
+	const { full, entry, session } = access;
+	if (!full.parents?.length) return;
+	const guard = parentGuard(trx, access, false);
+	const fields = [.../* @__PURE__ */ new Set([...full.primaryKey, ...full.parents.map((parent) => parent.field)])].map((name) => full.fields[name]);
+	const tenant = tenantScope(entry, session)?.tenantValue;
+	for (const [i, row] of rows.entries()) {
+		const permissions = result[i];
+		if (!permissions.update && !permissions.delete) continue;
+		const stored = await fetchRecord(trx, entry, full.primaryKey.map((name) => row[name]), tenant, { fields });
+		const allowed = stored !== void 0 && await guard(stored.record);
+		permissions.update &&= allowed;
+		permissions.delete &&= allowed;
+	}
+};
 //#endregion
 export { rowPermissions };

package/dist/web-app/app-icons.d.ts

@@ -0,0 +1,31 @@
+//#region src/web-app/app-icons.d.ts
+/**
+ * The PNG icons a project may put beside its `protobase.favicon.svg`, for platforms that take no SVG, each square at
+ * `size` pixels and answered on the app's own origin at `/<file>`: Android's 192 and 512 pixel icons, a 512 pixel
+ * maskable one whose mark keeps to the middle 80%, and the 180 pixel Apple touch icon an iPhone home screen shows.
+ */
+export declare const pngIcons: {
+  readonly icon192: {
+    readonly file: "protobase.icon-192.png";
+    readonly size: 192;
+  };
+  readonly icon512: {
+    readonly file: "protobase.icon-512.png";
+    readonly size: 512;
+  };
+  readonly maskable: {
+    readonly file: "protobase.icon-maskable.png";
+    readonly size: 512;
+  };
+  readonly appleTouch: {
+    readonly file: "protobase.apple-touch-icon.png";
+    readonly size: 180;
+  };
+};
+export type PngIcon = keyof typeof pngIcons;
+/** The icons a project has of its own: `favicon` when the favicon is its own rather than Protobase's, and its PNGs. */
+export type AppIcons = {
+  favicon: boolean;
+  png: PngIcon[];
+};
+//#endregion

package/dist/web-app/app-icons.js

@@ -0,0 +1,26 @@
+//#region src/web-app/app-icons.ts
+/**
+* The PNG icons a project may put beside its `protobase.favicon.svg`, for platforms that take no SVG, each square at
+* `size` pixels and answered on the app's own origin at `/<file>`: Android's 192 and 512 pixel icons, a 512 pixel
+* maskable one whose mark keeps to the middle 80%, and the 180 pixel Apple touch icon an iPhone home screen shows.
+*/
+const pngIcons = {
+	icon192: {
+		file: "protobase.icon-192.png",
+		size: 192
+	},
+	icon512: {
+		file: "protobase.icon-512.png",
+		size: 512
+	},
+	maskable: {
+		file: "protobase.icon-maskable.png",
+		size: 512
+	},
+	appleTouch: {
+		file: "protobase.apple-touch-icon.png",
+		size: 180
+	}
+};
+//#endregion
+export { pngIcons };

package/dist/web-app/web-manifest-route.js

@@ -4,9 +4,9 @@ import { Hono } from "hono";
 /** The path under the system path (`/api`) the admin app's page links its manifest at. */
 const webManifestPath = "/manifest.webmanifest";
 /** Answers the web app manifest to anyone: the browser fetches it without the user's token, before they sign in. */
-const webManifestRoute = (appName) => {
+const webManifestRoute = (appName, identity, icons) => {
 	const app = new Hono();
-	const body = JSON.stringify(webManifest(appName));
+	const body = JSON.stringify(webManifest(appName, identity, icons));
 	app.get(webManifestPath, () => new Response(body, { headers: {
 		"content-type": "application/manifest+json",
 		"cache-control": "no-cache"

package/dist/web-app/web-manifest.js

@@ -1,22 +1,41 @@
+import { pngIcons } from "./app-icons.js";
 //#region src/web-app/web-manifest.ts
 /** Where the app's favicon is on its own origin, which `protobase build` and `protobase dev` always answer. */
 const faviconPath = "/protobase.favicon.svg";
+const manifestIcons = {
+	icon192: "any",
+	icon512: "any",
+	maskable: "maskable"
+};
+const isManifestIcon = (icon) => icon in manifestIcons;
+const manifestIcon = (icon) => {
+	const { file, size } = pngIcons[icon];
+	return {
+		src: `/${file}`,
+		sizes: `${size}x${size}`,
+		type: "image/png",
+		...manifestIcons[icon] === "maskable" && { purpose: "maskable" }
+	};
+};
 /**
 * The web app manifest that makes the admin app installable: named for the app, opening at its home page in a window
-* of its own, with the favicon as its icon. An SVG with `sizes: "any"` meets Chrome's 192 and 512 pixel icon sizes.
+* of its own, with the favicon as its icon, the project's PNGs beside it and its colours when it has them. An SVG with
+* `sizes: "any"` meets Chrome's 192 and 512 pixel icon sizes; Safari and some Android launchers take only PNGs.
 */
-const webManifest = (appName) => ({
+const webManifest = (appName, { themeColor, backgroundColor } = {}, icons) => ({
 	name: appName,
 	short_name: appName,
 	id: "/",
 	start_url: "/",
 	scope: "/",
 	display: "standalone",
+	...themeColor && { theme_color: themeColor },
+	...backgroundColor && { background_color: backgroundColor },
 	icons: [{
 		src: faviconPath,
 		sizes: "any",
 		type: "image/svg+xml"
-	}]
+	}, ...(icons?.png ?? []).filter(isManifestIcon).map(manifestIcon)]
 });
 //#endregion
 export { faviconPath, webManifest };

package/dist/write-pipeline.js

@@ -8,7 +8,7 @@ import { isDatabaseError } from "./error-handler.js";
 import { attachFiles } from "./files/attach.js";
 import { actorSettings, wakeDispatch } from "./changes/actor.js";
 import { validateBody } from "./validate-body.js";
-import { assertWritten, checkPrecondition, decide, denied, firstKeyField, keyOf, missing, notifier, shown } from "./write-shared.js";
+import { assertWritten, checkParents, checkPrecondition, decide, denied, firstKeyField, keyOf, missing, notifier, shown } from "./write-shared.js";
 import { applyUpdate, planUpdate } from "./write-update.js";
 import { checkRankAfter } from "./rank-after.js";
 //#region src/write-pipeline.ts
@@ -31,8 +31,11 @@ const create = async (trx, deps, access, body) => {
 		...tenantValues
 	};
 	const filter = await decide(access, "create", void 0, row);
+	const parents = checkParents(trx, access, "create");
+	await parents(row);
 	const created = await insertRecord(trx, entry, row, { etagFields: Object.keys(access.model.fields) });
 	await assertWritten(trx, access, created, "create", access.resolved.rowFilter.create, filter);
+	await parents(created.record);
 	if (full.position) await checkRankAfter(trx, deps, access, full.position.field, [{
 		key: keyOf(access, created.record),
 		before: null
@@ -77,6 +80,7 @@ const removeOrRestore = async (trx, deps, access, request) => {
 		filter,
 		fields: [firstKeyField(access)]
 	})) throw denied(entry, operation);
+	await checkParents(trx, access, operation)(current.record);
 	const notify = notifier(deps, access);
 	if (undelete) {
 		const restored = await restoreRecord(trx, entry, request.key, scope?.tenantValue, shape);

package/dist/write-shared.js

@@ -5,6 +5,7 @@ import { presentFiles } from "./files/present.js";
 import { ifMatchSatisfied } from "./etag.js";
 import { pickFields } from "./rows.js";
 import { fetchRecord } from "./records.js";
+import { parentGuard } from "./parent-access.js";
 import { scheduleRemovedFiles } from "./files/attach.js";
 //#region src/write-shared.ts
 const missing = (entry) => notFound(`No ${entry.name} with this key`);
@@ -22,6 +23,17 @@ const decide = async (access, operation, record, input) => {
 	if (decision === false) throw denied(access.entry, operation);
 	return decision === true ? void 0 : decision;
 };
+/**
+* Refuses a write whose records' parents (`.parent()`) do not give the caller the access it needs, with the same answer
+* as a refused record-level rule; each parent stays locked until the write commits.
+*/
+const checkParents = (trx, access, operation) => {
+	if (!access.full.parents?.length) return async (..._records) => {};
+	const guard = parentGuard(trx, access, true);
+	return async (...records) => {
+		if (!await guard(...records)) throw denied(access.entry, operation);
+	};
+};
 const keyOf = (access, record) => access.full.primaryKey.map((name) => record[name]);
 const firstKeyField = (access) => access.full.fields[access.full.primaryKey[0]];
 const assertWritten = async (trx, access, written, operation, ...filters) => {
@@ -53,4 +65,4 @@ const notifier = (deps, access) => async (trx, kind, before, after) => {
 	await scheduleRemovedFiles(access, kind, before, after);
 };
 //#endregion
-export { assertWritten, checkPrecondition, decide, denied, firstKeyField, keyOf, missing, notifier, shown };
+export { assertWritten, checkParents, checkPrecondition, decide, denied, firstKeyField, keyOf, missing, notifier, shown };

package/dist/write-update.js

@@ -3,11 +3,12 @@ import { targetFilter } from "./request-access.js";
 import { fetchRecord, updateRecord } from "./records.js";
 import { attachFiles } from "./files/attach.js";
 import { validateBody } from "./validate-body.js";
-import { assertWritten, checkPrecondition, decide, denied, firstKeyField, missing, notifier } from "./write-shared.js";
+import { assertWritten, checkParents, checkPrecondition, decide, denied, firstKeyField, missing, notifier } from "./write-shared.js";
 //#region src/write-update.ts
 /**
 * Everything an update needs before it writes: the row (locked, inside the caller's tenant and row filters), the ETag
-* precondition, validation against the fields the caller may write, and the record-level rule with its filter.
+* precondition, validation against the fields the caller may write, the record-level rule with its filter, and the
+* parents (`.parent()`) it leaves and moves to, checked in one call so they are locked in one order.
 */
 const planUpdate = async (trx, access, key, body, ifMatch, required = true) => {
 	const { entry, full } = access;
@@ -27,10 +28,16 @@ const planUpdate = async (trx, access, key, body, ifMatch, required = true) => {
 		filter,
 		fields: [firstKeyField(access)]
 	})) throw denied(entry, "update");
+	const parents = checkParents(trx, access, "update");
+	if (Object.keys(values).length > 0) await parents(current.record, {
+		...current.record,
+		...values
+	});
 	return {
 		current,
 		values,
-		...filter && { filter }
+		...filter && { filter },
+		parents
 	};
 };
 /** Writes a planned update, checks the row as written against the filters, and runs the hooks. */
@@ -39,6 +46,7 @@ const applyUpdate = async (trx, deps, access, key, plan) => {
 	const tenant = tenantScope(entry, access.session)?.tenantValue;
 	const updated = await updateRecord(trx, entry, key, tenant, plan.values, { etagFields: Object.keys(access.model.fields) });
 	await assertWritten(trx, access, updated, "update", access.resolved.rowFilter.update, plan.filter);
+	await plan.parents(updated.record);
 	await notifier(deps, access)(trx, "update", plan.current.record, updated.record);
 	return updated;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.27.0",
+  "version": "0.28.1",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -32,9 +32,9 @@
   "dependencies": {
     "@better-auth/passkey": "^1.7.7",
     "@better-auth/sso": "^1.7.7",
-    "@protobase/layout": "0.27.0",
-    "@protobase/query": "0.27.0",
-    "@protobase/schema": "0.27.0",
+    "@protobase/layout": "0.28.1",
+    "@protobase/query": "0.28.1",
+    "@protobase/schema": "0.28.1",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",