@protobase/server 0.28.3 → 0.28.4

package/dist/better-auth/app-sign-in-policy.js

@@ -0,0 +1,29 @@
+import { defaultSignInPolicy, parseSignInPolicy, signInPolicyProblem } from "./sign-in-policy.js";
+//#region src/better-auth/app-sign-in-policy.ts
+const firstAdmin = {
+	password: true,
+	passkeys: 0,
+	twoFactor: false,
+	authenticatorApp: false,
+	socialSignIn: false
+};
+/**
+* The policy an app applies until an admin saves one: `defaultSignInPolicy` with the methods `given` names changed.
+* It is checked as an admin's save is, with mail on: without mail the policy applies as a saved one does (see
+* `effectiveSignInPolicy`), so a missing mail setting turns passwords back on rather than stopping the app.
+*/
+const appSignInPolicy = (given = {}) => {
+	const policy = parseSignInPolicy({
+		...defaultSignInPolicy,
+		...given
+	});
+	if (!policy) throw new Error("signInPolicy: choose one of the offered rules for every sign-in method (see signInPolicyMethods)");
+	const problem = signInPolicyProblem(policy, {
+		mail: true,
+		admin: firstAdmin
+	});
+	if (problem) throw new Error(`signInPolicy: ${problem}`);
+	return policy;
+};
+//#endregion
+export { appSignInPolicy };

package/dist/better-auth/create-auth.d.ts

@@ -1,4 +1,3 @@
-import { SignInPolicy } from "./sign-in-policy.js";
 import { StaffSignIn } from "./staff-log.js";
 import { Mailer } from "../mail/smtp-mailer.js";
 import { OperatorProvider } from "./operator-provider.js";
@@ -6,6 +5,7 @@ import { RoleDefinitions, RolesInput } from "./organizations/role-definitions.js
 import { OrganizationRole } from "./organizations/store.js";
 import { OrganizationsOptions, ResolvedOrganizations } from "./organizations/options.js";
 import { PlatformSignIn } from "./platform-sign-in.js";
+import { SignInPolicy } from "./sign-in-policy.js";
 import { SsoOptions } from "./saml-sign-in.js";
 import { signUpPaths } from "./sign-up/sign-up-plugin.js";
 import { PasswordHash } from "./password-hashes.js";
@@ -63,6 +63,12 @@ export type CreateAuthOptions = {
   signUp?: {
     role: string;
   };
+  /**
+   * The sign-in policy that applies until an admin saves one on the Sign-in policy page, and when the saved one no
+   * longer reads: the methods it names, for example `{ password: 'forbidden' }` for emailed codes and passkeys only,
+   * with everything else allowed. Checked at startup as an admin's save is. Default everything allowed.
+   */
+  signInPolicy?: Partial<SignInPolicy>;
   /** Sign-in attempts allowed per minute and client, default 5; also the sign-up requests allowed. */
   signInPerMinute?: number;
   /**
@@ -339,7 +345,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               expiresAt: Date;
               token: string;
               ipAddress?: string | null | undefined;
-              userAgent?: string | null | undefined;
+              userAgent? /** Signs cookies and encrypts the JWT private keys. Generate with `openssl rand -base64 32`. */ : string | null | undefined;
             };
           };
         }>>[];
@@ -1295,7 +1301,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               email: string;
               emailVerified: boolean;
               name: string;
-              image? /** Signs cookies and encrypts the JWT private keys. Generate with `openssl rand -base64 32`. */ : string | null | undefined;
+              image?: string | null | undefined;
             };
           };
         }>>[];
@@ -4415,7 +4421,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
           twoFactor: boolean;
           authenticatorApp: boolean;
         };
-        missing: ("twoFactor" | "passkey")[];
+        missing: ("passkey" | "twoFactor")[];
       }>;
     };
     hooks: {
@@ -5964,6 +5970,8 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
   /** New users get their ids from `generateUserId` instead of Better Auth's random text. */
   generatesUserIds: boolean;
   mail: boolean;
+  /** The policy until an admin saves one. */
+  signInPolicy: SignInPolicy;
   passwordReset: boolean;
   /** Open sign-up is on and offered: the app asks for it, and can mail the codes. */
   signUp: boolean;

package/dist/better-auth/create-auth.js

@@ -1,6 +1,7 @@
 import { appOrigins, multiHostBaseURL, readOrigins, resolveOrigins } from "./origins.js";
 import { appNameOver, defaultAppName } from "../app-name.js";
 import { goTrueIssuer, goTrueKeyPair } from "../gotrue/keys.js";
+import { defaultSignInPolicy } from "./sign-in-policy.js";
 import { roleDefinitions } from "./organizations/role-definitions.js";
 import { narrowClaims } from "./roles/active-role.js";
 import { signInPolicyPlugin } from "./policy-plugin.js";
@@ -20,6 +21,7 @@ import { passkeyPlugin } from "./passkey-plugin.js";
 import { passwordResetOptions } from "./password-reset.js";
 import { rolesPlugin } from "./roles/roles-plugin.js";
 import { platformSignInFor, platformSignInProvider, readPlatformSignIn, resolvePlatformSignIn } from "./platform-sign-in.js";
+import { appSignInPolicy } from "./app-sign-in-policy.js";
 import { emailInDomains, resolveSamlProviders, samlDisabledPaths, samlGuardPlugin, samlPlugin } from "./saml-sign-in.js";
 import { emailCodeOptions, twoFactorCodeOptions, unusedEmailCodePaths } from "./sign-in-mail.js";
 import { signUpPaths, signUpPlugin } from "./sign-up/sign-up-plugin.js";
@@ -55,7 +57,7 @@ const organizationPaths = ["/organization/set-active", "/organization/accept-inv
 * The options `createAuth` gives Better Auth, with the roles, default role, mailer, operator provider and platform
 * sign-in provider already resolved.
 */
-const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, definitions, defaultRole, appName = defaultAppName, mailer, signUpRole, operator, platformSignIn, saml = [], organizations, context = noContext }) => {
+const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, definitions, defaultRole, appName = defaultAppName, mailer, signUpRole, operator, platformSignIn, saml = [], organizations, context = noContext, signInPolicy = defaultSignInPolicy }) => {
 	const secure = options.baseURL.startsWith("https://");
 	const signIn = platformSignInFor(platformSignIn, Object.keys(options.socialProviders ?? {}));
 	const hosts = passkeyHosts([options.baseURL, ...origins]);
@@ -69,6 +71,7 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 	const passwordHashes = options.passwordHashes ?? [];
 	const policy = {
 		mail: Boolean(mailer),
+		defaultPolicy: signInPolicy,
 		socialProviders: [...Object.keys(options.socialProviders ?? {}), ...samlIds],
 		...operator && { operator: operator.name },
 		...signIn && { platformSignIn: {
@@ -153,7 +156,8 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 			...mail ? [emailOTP(emailCodeOptions(mail))] : [],
 			...mail && signUpRole ? [signUpPlugin({
 				role: signUpRole,
-				mail
+				mail,
+				defaultPolicy: signInPolicy
 			})] : [],
 			...signIn ? [genericOAuth({ config: [platformSignInProvider(signIn)] })] : [],
 			...saml.length > 0 ? [samlPlugin(saml, options.baseURL), samlGuardPlugin(samlIds)] : [],
@@ -165,7 +169,8 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 			}),
 			staffSignInPlugin({
 				...operator && { operator },
-				...mail && { mail }
+				...mail && { mail },
+				defaultPolicy: signInPolicy
 			}),
 			rolesPlugin({ definitions }),
 			lastAdminGuardPlugin(),
@@ -180,6 +185,7 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 			})] : [],
 			usersPlugin({
 				definitions,
+				defaultPolicy: signInPolicy,
 				...mail && { mail },
 				invitationUrl: organizations?.invitationUrl ?? defaultInvitationUrl(options.baseURL),
 				invitationSeconds: organizations?.invitationExpiresIn ?? 604800,
@@ -273,6 +279,7 @@ const createAuth = (options) => {
 	const roles = definitions.names;
 	if (options.defaultRole !== void 0 && !roles.includes(options.defaultRole)) throw new Error(`defaultRole "${options.defaultRole}" is not one of the roles: ${roles.join(", ")}`);
 	const signUpRole = options.signUp && checkSignUpRole(options.signUp.role, roles);
+	const signInPolicy = appSignInPolicy(options.signInPolicy);
 	const others = roles.filter((role) => role !== "admin");
 	const defaultRole = options.defaultRole ?? (options.organizations ? "user" : others.length === 1 ? others[0] : void 0);
 	const appName = appNameOver(globalThis.process?.env ?? {}, options.appName);
@@ -300,6 +307,7 @@ const createAuth = (options) => {
 		operator,
 		platformSignIn,
 		saml,
+		signInPolicy,
 		...organizations && {
 			organizations,
 			context
@@ -320,6 +328,8 @@ const createAuth = (options) => {
 		/** New users get their ids from `generateUserId` instead of Better Auth's random text. */
 		generatesUserIds: Boolean(options.generateUserId),
 		mail: Boolean(mailer),
+		/** The policy until an admin saves one. */
+		signInPolicy,
 		passwordReset: Boolean(mailer),
 		/** Open sign-up is on and offered: the app asks for it, and can mail the codes. */
 		signUp: Boolean(signUpRole && mailer),

package/dist/better-auth/invitations/account-from-invitation.js

@@ -10,7 +10,7 @@ import { setSessionCookie } from "better-auth/cookies";
 */
 const createInvitedAccount = async (ctx, input) => {
 	const { internalAdapter } = ctx.context;
-	checkNewAccountPassword(effectiveSignInPolicy((await readSignInPolicy(ctx.context.adapter)).policy, { mail: input.mail }), input.password);
+	checkNewAccountPassword(effectiveSignInPolicy((await readSignInPolicy(ctx.context.adapter, input.defaultPolicy)).policy, { mail: input.mail }), input.password);
 	const user = await internalAdapter.createUser({
 		email: input.email.toLowerCase(),
 		name: input.name,

package/dist/better-auth/invitations/invitation-endpoints.js

@@ -14,7 +14,7 @@ const tokenQuery = z$1.object({ token: z$1.string().min(1) });
 * vouched for, and the link in the mail proves the person reads it. Accepting an organization's invitation signed in is
 * the organization plugin's.
 */
-const invitationEndpoints = ({ mail, organizations }) => ({
+const invitationEndpoints = ({ mail, defaultPolicy, organizations }) => ({
 	/**
 	* `GET /invitation?token=`: who invites, the address and roles, until when, and whether the address has an account;
 	* for an invitation to the app also the app's name, and for an organization's the organization and the role there.
@@ -75,7 +75,8 @@ const invitationEndpoints = ({ mail, organizations }) => ({
 			email,
 			name: ctx.body.name,
 			...ctx.body.password !== void 0 && { password: ctx.body.password },
-			mail
+			mail,
+			defaultPolicy
 		};
 		if (found.kind === "app") {
 			const user = await createInvitedAccount(ctx, {

package/dist/better-auth/policy-plugin.js

@@ -31,14 +31,14 @@ const accountMethods = async (context, user, socialProviders) => {
 	};
 };
 const refuse = (status, refusal) => new APIError(status, refusal);
-const currentPolicy = async (context, mail) => effectiveSignInPolicy((await readSignInPolicy(context.adapter)).policy, { mail });
+const currentPolicy = async (context, { mail, defaultPolicy }) => effectiveSignInPolicy((await readSignInPolicy(context.adapter, defaultPolicy)).policy, { mail });
 const providersUnder = (policy, { socialProviders, platformSignIn }) => [...socialProviders, ...platformSignIn && policy.platformSignIn === "allowed" ? [platformSignIn.provider] : []];
 /**
 * Why `user` gets no API token yet, or `undefined` when they may have one: the policy requires a method, such as
 * two-factor authentication, that their account has not set up. `read` is the effective policy, when read already.
 */
 const tokenRefusal = async (context, user, options, read) => {
-	const policy = read ?? await currentPolicy(context, options.mail);
+	const policy = read ?? await currentPolicy(context, options);
 	if (policy.twoFactor !== "required" && policy.passkey !== "required") return void 0;
 	const account = await accountMethods(context, user, providersUnder(policy, options));
 	return missingRequiredMethods(policy, account).length > 0 ? setupRequired : void 0;
@@ -49,10 +49,10 @@ const tokenRefusal = async (context, user, options, read) => {
 * someone without what it requires gets a session, so they can set it up, but no API token (`403 SIGN_IN_SETUP_REQUIRED`).
 */
 const signInPolicyPlugin = (options) => {
-	const { mail, operator, platformSignIn } = options;
+	const { mail, defaultPolicy, operator, platformSignIn } = options;
 	const policyAdmin = adminOnly("Only an admin can change how people sign in.");
 	const policyAnswer = async (context) => {
-		const stored = await readSignInPolicy(context.adapter);
+		const stored = await readSignInPolicy(context.adapter, defaultPolicy);
 		const savedBy = stored.savedBy && (await context.internalAdapter.findUserById(stored.savedBy))?.email;
 		return {
 			policy: stored.policy,
@@ -105,7 +105,7 @@ const signInPolicyPlugin = (options) => {
 				method: "GET",
 				use: [sessionMiddleware]
 			}, async (ctx) => {
-				const policy = await currentPolicy(ctx.context, mail);
+				const policy = await currentPolicy(ctx.context, options);
 				const { socialSignIn: _, ...account } = await accountMethods(ctx.context, ctx.context.session.user, providersUnder(policy, options));
 				return ctx.json({
 					policy,
@@ -123,7 +123,7 @@ const signInPolicyPlugin = (options) => {
 					code: "SIGN_IN_CODES_ONLY",
 					message: "Only sign-in codes can be emailed."
 				});
-				const policy = await currentPolicy(ctx.context, mail);
+				const policy = await currentPolicy(ctx.context, options);
 				const refusal = policyRefusal(policy, {
 					path,
 					body: ctx.body,

package/dist/better-auth/policy-store.js

@@ -1,4 +1,4 @@
-import { defaultSignInPolicy, parseSignInPolicy } from "./sign-in-policy.js";
+import { parseSignInPolicy } from "./sign-in-policy.js";
 //#region src/better-auth/policy-store.ts
 /** Better Auth's model for the sign-in policy: one row per save, the newest applies, the older ones are its history. */
 const signInPolicyModel = "signInPolicy";
@@ -47,8 +47,8 @@ const signInPolicySchema = { [signInPolicyModel]: {
 		}
 	}
 } };
-/** The newest saved policy, or the default when none was saved. A row that no longer parses counts as none. */
-const readSignInPolicy = async (adapter) => {
+/** The newest saved policy, or the app's default (see `appSignInPolicy`) when none was saved. A row that no longer parses counts as none. */
+const readSignInPolicy = async (adapter, appDefault) => {
 	const [row] = await adapter.findMany({
 		model: signInPolicyModel,
 		sortBy: {
@@ -58,7 +58,7 @@ const readSignInPolicy = async (adapter) => {
 		limit: 1
 	});
 	const policy = row && parseSignInPolicy(row);
-	if (!policy) return { policy: defaultSignInPolicy };
+	if (!policy) return { policy: appDefault };
 	return {
 		policy,
 		savedAt: new Date(row.createdAt).toISOString(),

package/dist/better-auth/sign-up/sign-up-plugin.js

@@ -27,7 +27,7 @@ const noAdminYet = () => new APIError("FORBIDDEN", {
 * has an account or not; one that has gets a mail saying so, with a link to sign in, instead of a code. While the store
 * has no user, nobody signs up: the first admin is made on the host.
 */
-const signUpPlugin = ({ role, mail }) => ({
+const signUpPlugin = ({ role, mail, defaultPolicy }) => ({
 	id: "protobase-sign-up",
 	endpoints: {
 		/** `POST /sign-up/send-code` with `{ email }`: mails a code for making an account with the address. */
@@ -78,7 +78,7 @@ const signUpPlugin = ({ role, mail }) => ({
 			const { ticket, name, password } = ctx.body;
 			const { internalAdapter, adapter } = ctx.context;
 			if (await adapter.count({ model: "user" }) === 0) throw noAdminYet();
-			checkNewAccountPassword(effectiveSignInPolicy((await readSignInPolicy(adapter)).policy, { mail: true }), password);
+			checkNewAccountPassword(effectiveSignInPolicy((await readSignInPolicy(adapter, defaultPolicy)).policy, { mail: true }), password);
 			const email = await consumeSignUpTicket(ctx.context, ticket);
 			const passwordHash = password === void 0 ? void 0 : await ctx.context.password.hash(password);
 			const user = await createSignedUpAccount(ctx.context, {

package/dist/better-auth/staff-plugin.js

@@ -11,12 +11,13 @@ import { deleteSessionCookie } from "better-auth/cookies";
 * staff sign-in is logged for the app's admins. The plugin is there without an operator provider too, so its table
 * exists from the first auth migration.
 */
-const staffSignInPlugin = ({ operator, mail }) => ({
+const staffSignInPlugin = ({ operator, mail, defaultPolicy }) => ({
 	id: "protobase-staff-sign-in",
 	schema: staffSignInSchema,
 	endpoints: {
 		...operator && staffSignInEndpoints({
 			operator,
+			defaultPolicy,
 			...mail && { mail }
 		}),
 		/** `GET /staff/session`: for a staff session, who started it, as whom, why, and until when; otherwise `{ staff: null }`. */

package/dist/better-auth/staff-sign-in-endpoints.js

@@ -35,7 +35,7 @@ const withError = (url, code) => {
 * permission and sign-in and starts a session as the person, of Better Auth's admin plugin (`impersonatedBy` names
 * them). The session is short and never extended, and the person's two-factor and passkey requirements do not stop it.
 */
-const staffSignInEndpoints = ({ operator, mail }) => {
+const staffSignInEndpoints = ({ operator, mail, defaultPolicy }) => {
 	const clients = /* @__PURE__ */ new Map();
 	const clientOf = (context) => {
 		const callback = `${context.baseURL}/staff/callback`;
@@ -52,7 +52,7 @@ const staffSignInEndpoints = ({ operator, mail }) => {
 			now: Math.floor(Date.now() / 1e3)
 		});
 		if (refusal) return refusal;
-		const policy = effectiveSignInPolicy((await readSignInPolicy(ctx.context.adapter)).policy, { mail: Boolean(mail) });
+		const policy = effectiveSignInPolicy((await readSignInPolicy(ctx.context.adapter, defaultPolicy)).policy, { mail: Boolean(mail) });
 		const off = policyRefusal(policy, { path: staffSignInPath });
 		if (off) return off;
 		const found = await ctx.context.internalAdapter.findUserByEmail(started.email.toLowerCase());

package/dist/better-auth/status-route.js

@@ -22,7 +22,7 @@ const statusRoute = (auth, { anonymous = false, plugins = [], locale } = {}) =>
 	const app = new Hono();
 	app.get("/status", async (c) => {
 		const context = await auth.$context;
-		const policy = effectiveSignInPolicy((await readSignInPolicy(context.adapter)).policy, { mail: auth.mail });
+		const policy = effectiveSignInPolicy((await readSignInPolicy(context.adapter, auth.signInPolicy)).policy, { mail: auth.mail });
 		const signInMethods = [
 			...policy.password === "allowed" ? ["password"] : [],
 			...policy.emailCode === "allowed" ? ["emailCode"] : [],

package/dist/better-auth/users/users-plugin.js

@@ -13,6 +13,7 @@ const usersPlugin = (options) => ({
 		...userEndpoints(options),
 		...invitationEndpoints({
 			mail: Boolean(options.mail),
+			defaultPolicy: options.defaultPolicy,
 			...options.organizations && { organizations: options.organizations }
 		})
 	},

package/dist/better-auth/users.d.ts

@@ -8,10 +8,13 @@ export type LinkedAccount = {
   providerId: string;
   accountId: string;
 };
-/** `metadata` lands in the user metadata column, which `createAuth`'s `users.metadata` names; it needs one. */
+/**
+ * Without `password` the user signs in by emailed code, passkey or a sign-in provider only. `metadata` lands in the
+ * user metadata column, which `createAuth`'s `users.metadata` names; it needs one.
+ */
 export type NewUser = {
   email: string;
-  password: string;
+  password?: string;
   name?: string;
   role?: string;
   accounts?: LinkedAccount[];

package/dist/better-auth/users.js

@@ -35,7 +35,7 @@ const createUser = async (auth, input) => {
 	await checkAccounts(auth, accounts);
 	const { user } = await auth.api.createUser({ body: {
 		email: input.email,
-		password: input.password,
+		...input.password !== void 0 && { password: input.password },
 		name: input.name ?? input.email.split("@")[0],
 		role,
 		...input.metadata && { data: { metadata: input.metadata } }

package/dist/gotrue/email-code-routes.js

@@ -41,7 +41,7 @@ const emailCodeRoutes = ({ auth, context, sessionOf }) => {
 	const checkMetadata = (data) => {
 		if (Object.keys(data).length > 0 && !auth.userMetadata) throw new GoTrueError(400, "validation_failed", "This app keeps no user metadata: leave data out");
 	};
-	const signUpPolicy = async () => effectiveSignInPolicy((await readSignInPolicy((await context()).adapter)).policy, { mail: true });
+	const signUpPolicy = async () => effectiveSignInPolicy((await readSignInPolicy((await context()).adapter, auth.signInPolicy)).policy, { mail: true });
 	const sendSignUpCode = (request, email) => callBetterAuth(auth, request, "/sign-up/send-code", { email });
 	const sendSignInCode = (request, email) => callBetterAuth(auth, request, "/email-otp/send-verification-otp", {
 		email,

package/dist/gotrue/user-routes.js

@@ -69,7 +69,7 @@ const userRoutes = ({ auth, context }) => {
 		if (email !== void 0 && email.trim().toLowerCase() !== user.email) throw new GoTrueError(422, "email_change_not_allowed", "Changing the email address is not offered");
 		if (data !== void 0 && !auth.userMetadata) throw new GoTrueError(400, "validation_failed", "This app keeps no user metadata: leave data out");
 		if (password !== void 0) {
-			checkNewAccountPassword(effectiveSignInPolicy((await readSignInPolicy(ctx.adapter)).policy, { mail: auth.mail }), password);
+			checkNewAccountPassword(effectiveSignInPolicy((await readSignInPolicy(ctx.adapter, auth.signInPolicy)).policy, { mail: auth.mail }), password);
 			const hash = await ctx.password.hash(password);
 			if (await ctx.internalAdapter.findCredentialAccount(user.id)) await ctx.internalAdapter.updatePassword(user.id, hash);
 			else await ctx.internalAdapter.linkAccount({

package/dist/index.d.ts

@@ -1,7 +1,6 @@
 import { MobileConfig } from "./mobile-config.js";
 import { AppIdentity } from "./app-identity.js";
 import { AppIcons, PngIcon, pngIcons } from "./web-app/app-icons.js";
-import { SignInPolicy, SignInRule, StaffAccessRule, defaultSignInPolicy, signInPolicyMethods } from "./better-auth/sign-in-policy.js";
 import { StaffSignIn } from "./better-auth/staff-log.js";
 import { MailMessage, Mailer } from "./mail/smtp-mailer.js";
 import { OperatorProvider, readOperatorSettings } from "./better-auth/operator-provider.js";
@@ -9,6 +8,7 @@ import { RoleDefinition, RolesInput } from "./better-auth/organizations/role-def
 import { OrganizationRole, StoredMember, StoredOrganization } from "./better-auth/organizations/store.js";
 import { OrganizationsOptions } from "./better-auth/organizations/options.js";
 import { PlatformSignIn, readPlatformSignIn } from "./better-auth/platform-sign-in.js";
+import { SignInPolicy, SignInRule, StaffAccessRule, defaultSignInPolicy, signInPolicyMethods } from "./better-auth/sign-in-policy.js";
 import { EmailComponent, EmailOptions, EmailTemplate, RenderedEmail, defineEmail } from "./mail/define-email.js";
 import { AdminAuth, CreateAuthOptions, UserCreatedHook, createAuth, normalizeRoles } from "./better-auth/create-auth.js";
 import { EventsOptions } from "./changes/events-options.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.28.3",
+  "version": "0.28.4",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -32,9 +32,9 @@
   "dependencies": {
     "@better-auth/passkey": "^1.7.7",
     "@better-auth/sso": "^1.7.7",
-    "@protobase/layout": "0.28.3",
-    "@protobase/query": "0.28.3",
-    "@protobase/schema": "0.28.3",
+    "@protobase/layout": "0.28.4",
+    "@protobase/query": "0.28.4",
+    "@protobase/schema": "0.28.4",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",