@protobase/server 0.3.5 → 0.5.0

package/dist/better-auth/two-factor-challenge.js

@@ -0,0 +1,23 @@
+import { twoFactor } from "better-auth/plugins";
+//#region src/better-auth/two-factor-challenge.ts
+/**
+* Better Auth's two-factor plugin, whose second step also follows a sign-in with an emailed code: the plugin asks for
+* it after a password only, and an inbox alone is one factor as well. A passkey is two factors already, so a passkey
+* sign-in is not asked. The plugin's own hook does the work; only the paths it matches grow.
+*/
+const twoFactorAfterPasswordOrCode = (options) => {
+	const plugin = twoFactor(options);
+	const after = plugin.hooks.after.map((hook) => ({
+		...hook,
+		matcher: (context) => hook.matcher(context) || context.path === "/sign-in/email-otp"
+	}));
+	return {
+		...plugin,
+		hooks: {
+			...plugin.hooks,
+			after
+		}
+	};
+};
+//#endregion
+export { twoFactorAfterPasswordOrCode };

package/dist/better-auth/users.d.ts

@@ -1,4 +1,5 @@
 import { AdminAuth } from "./create-auth.js";
+import { parseRoles } from "./parse-roles.js";
 //#region src/better-auth/users.d.ts
 /** The roles this auth instance allows, `admin` first. */
 export declare const roleChoices: (auth: AdminAuth) => string[];
@@ -19,18 +20,14 @@ export type StoredUser = {
 export declare const hasUsers: (auth: AdminAuth) => Promise<boolean>;
 /**
  * Creates a user directly in the admin store. Host side only (no HTTP route creates accounts while the store is empty):
- * the first user is always an `admin`, later ones get `role` (default `user`).
+ * the first user is always an `admin`, later ones get `role` (default `user`). The address counts as verified, so the
+ * user can also sign in with an emailed code.
  */
 export declare const createUser: (auth: AdminAuth, input: NewUser) => Promise<{
   id: string;
   email: string;
   role: string;
 }>;
-/**
- * The admin plugin stores roles as a comma separated string. A value written as a JS array through a Postgres driver
- * comes back as an array literal (`{admin,sales}`); that is read too, and rewritten as a plain string on the next change.
- */
-export declare const parseRoles: (role: string | string[] | null | undefined) => string[];
 export declare const listUsers: (auth: AdminAuth) => Promise<StoredUser[]>;
 /** Deletes the user with their sessions and accounts; refuses to delete the last active admin. */
 export declare const deleteUser: (auth: AdminAuth, email: string) => Promise<void>;
@@ -47,4 +44,5 @@ export declare const setUserBanned: (auth: AdminAuth, input: {
   email: string;
   banned: boolean;
 }) => Promise<void>;
-//#endregion
+//#endregion
+export { parseRoles };

package/dist/better-auth/users.js

@@ -1,3 +1,4 @@
+import { parseRoles } from "./parse-roles.js";
 //#region src/better-auth/users.ts
 /** The roles this auth instance allows, `admin` first. */
 const roleChoices = (auth) => [...auth.roles];
@@ -11,7 +12,8 @@ const checkRoles = (auth, role) => {
 const hasUsers = async (auth) => (await auth.$context).adapter.count({ model: "user" }).then((count) => count > 0);
 /**
 * Creates a user directly in the admin store. Host side only (no HTTP route creates accounts while the store is empty):
-* the first user is always an `admin`, later ones get `role` (default `user`).
+* the first user is always an `admin`, later ones get `role` (default `user`). The address counts as verified, so the
+* user can also sign in with an emailed code.
 */
 const createUser = async (auth, input) => {
 	const first = !await hasUsers(auth);
@@ -30,15 +32,6 @@ const createUser = async (auth, input) => {
 		role: String(user.role)
 	};
 };
-/**
-* The admin plugin stores roles as a comma separated string. A value written as a JS array through a Postgres driver
-* comes back as an array literal (`{admin,sales}`); that is read too, and rewritten as a plain string on the next change.
-*/
-const parseRoles = (role) => {
-	if (Array.isArray(role)) return role;
-	const text = (role ?? "user").trim();
-	return (text.startsWith("{") && text.endsWith("}") ? text.slice(1, -1) : text).split(",").map((name) => name.trim().replace(/^"|"$/g, "")).filter(Boolean);
-};
 const allUsers = async (auth) => {
 	const { adapter } = await auth.$context;
 	return adapter.findMany({

package/dist/create-admin.d.ts

@@ -1,6 +1,7 @@
 import { AdminAuth } from "./better-auth/create-auth.js";
 import { ResourceSource } from "./resource-source.js";
-import { AdminEnv, AdminOptions, Authenticator, PageSource, ViewSource } from "./types.js";
+import { AdminEnv, Authenticator, PageSource, ViewSource } from "./types.js";
+import { AdminOptions } from "./admin-options.js";
 import { Hono } from "hono";
 import { UserMenuSource } from "@protobase/schema";
 import { Db } from "@protobase/query";

package/dist/create-admin.js

@@ -1,5 +1,6 @@
 import { assistantSettings } from "./assistant/assistant-settings.js";
 import { createErrorHandler } from "./error-handler.js";
+import { assistantRecords } from "./assistant/records.js";
 import { builtInAssistant } from "./assistant/built-in-assistant.js";
 import { consoleAuditQueue } from "./audit/console-queue.js";
 import { authBasePath } from "./better-auth/create-auth.js";
@@ -84,14 +85,20 @@ const createAdmin = ({ resources, views = [], pages = [], userMenu, db, authenti
 		app.route(authBasePath, statusRoute(auth));
 		app.on(["GET", "POST"], `${authBasePath}/*`, (c) => auth.handler(c.req.raw));
 	}
-	if (assistant?.kind === "built-in") app.route(`${systemPath}/assistant`, builtInAssistant({
-		model: assistant.model,
-		chats: assistant.chats,
-		db,
-		meta,
-		authenticate,
-		report: options.onUnhandledError
-	}));
+	if (assistant?.kind === "built-in") {
+		const tools = options.assistant ? options.assistant.tools : void 0;
+		const records = (session) => assistantRecords(deps, session);
+		app.route(`${systemPath}/assistant`, builtInAssistant({
+			model: assistant.model,
+			chats: assistant.chats,
+			db,
+			meta,
+			authenticate,
+			tools,
+			records,
+			report: options.onUnhandledError
+		}));
+	}
 	app.route("/", batchRoute(deps, authenticate, meta));
 	app.route(basePath, api);
 	app.route(deps.systemPath || "/", system);

package/dist/deps.d.ts

@@ -0,0 +1,6 @@
+import "./types.js";
+import "./registry.js";
+import "./scan-guard.js";
+import { PageModel } from "@protobase/layout";
+import { ResolveOptions, ViewModel } from "@protobase/schema";
+import { Db } from "@protobase/query";

package/dist/index.d.ts

@@ -1,24 +1,32 @@
+import { SignInPolicy, SignInRule, StaffAccessRule, defaultSignInPolicy, signInPolicyMethods } from "./better-auth/sign-in-policy.js";
+import { StaffSignIn } from "./better-auth/staff-log.js";
+import { OperatorProvider, readOperatorSettings } from "./better-auth/operator-provider.js";
 import { AdminAuth, CreateAuthOptions, UserCreatedHook, createAuth, normalizeRoles } from "./better-auth/create-auth.js";
 import { ResourceSource, configExports } from "./resource-source.js";
-import { AssistantOptions, AssistantSettings, ModelSettings, assistantRoles, assistantSettings, assistantVariables, seesAssistant } from "./assistant/assistant-settings.js";
+import { ChatMessage, ChatTextPart, Completion, CompletionOptions, ModelError, ModelSettings, ReasoningDetail, ReasoningEffort, ToolCall, ToolSpec, streamChatCompletion } from "./assistant/chat-completions.js";
+import { Admin, AuditEvent, AuditQueue, Authenticator, PipelineHook, ScanGuardMode, Session, TenantValue, User, ViewSource, WriteEvent, WriteOperation } from "./types.js";
+import { ConversationRecord, ConversationStore } from "./assistant/conversation-store.js";
+import { Conversation, ConversationsOptions, conversationKey, createConversations } from "./assistant/conversations.js";
+import { ApprovalAnswer, ApprovalRequest, requestApproval } from "./assistant/approval.js";
+import { RecordKeyInput, ToolRecord, ToolRecords } from "./assistant/records.js";
+import { AssistantTool, ToolContext, defineTool } from "./assistant/tools.js";
+import { AssistantOptions, AssistantSettings, assistantRoles, assistantSettings, assistantVariables, seesAssistant } from "./assistant/assistant-settings.js";
 import { RuntimeOptions, runtimeUrl, runtimeVariable, seesRuntime } from "./runtime/runtime-settings.js";
-import { Admin, AdminOptions, AuditEvent, AuditQueue, Authenticator, PipelineHook, ScanGuardMode, Session, TenantValue, User, ViewSource, WriteEvent, WriteOperation } from "./types.js";
+import { AdminOptions } from "./admin-options.js";
 import { CreateAdminInput, createAdmin } from "./create-admin.js";
+import { ProjectConfig, defineConfig, mergeConfig } from "./project-config.js";
 import { consoleAuditQueue } from "./audit/console-queue.js";
 import { JwtOptions, jwtAuthenticator } from "./auth/jwt.js";
 import { HttpProblem, badRequest, forbidden, notFound, unauthorized } from "./problem.js";
 import { BetterAuthAuthenticatorOptions, betterAuthAuthenticator } from "./better-auth/authenticator.js";
-import { NewUser, StoredUser, createUser, deleteUser, hasUsers, listUsers, parseRoles, roleChoices, setUserBanned, setUserRole } from "./better-auth/users.js";
+import { parseRoles } from "./better-auth/parse-roles.js";
+import { NewUser, StoredUser, createUser, deleteUser, hasUsers, listUsers, roleChoices, setUserBanned, setUserRole } from "./better-auth/users.js";
 import { IssueTokenOptions, issueToken, maxTokenTtlSeconds } from "./better-auth/tokens.js";
-import { ChatMessage, ChatTextPart, Completion, CompletionOptions, ModelError, ReasoningDetail, ReasoningEffort, ToolCall, ToolSpec, streamChatCompletion } from "./assistant/chat-completions.js";
-import { ConversationRecord, ConversationStore } from "./assistant/conversation-store.js";
-import { Conversation, ConversationsOptions, conversationKey, createConversations } from "./assistant/conversations.js";
 import { AssistantBackend, assistantProtocolRoutes } from "./assistant/protocol-routes.js";
 import { fileConversationStore } from "./assistant/file-conversation-store.js";
 import { withCacheBreakpoints } from "./assistant/cache-breakpoints.js";
-import { ApprovalAnswer, ApprovalRequest, requestApproval } from "./assistant/approval.js";
-import { AssistantTool, ToolContext, defineTool } from "./assistant/tools.js";
 import { TurnOptions, runTurn } from "./assistant/turn.js";
+import { WidgetOptions, maxWidgetPropsBytes, widget } from "./assistant/widget.js";
 import { QueryOptions, QueryResult, runReadOnlyQuery, runReadWriteQuery } from "./assistant/run-query.js";
 import { readOnlyQueryTool, readWriteQueryTool } from "./assistant/query-tools.js";
-export { type Admin, type AdminAuth, type AdminOptions, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticatorOptions, type ChatMessage, type ChatTextPart, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CreateAdminInput, type CreateAuthOptions, HttpProblem, type IssueTokenOptions, type JwtOptions, ModelError, type ModelSettings, type NewUser, type PipelineHook, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type ResourceSource, type RuntimeOptions, type ScanGuardMode, type Session, type StoredUser, type TenantValue, type ToolCall, type ToolContext, type ToolSpec, type TurnOptions, type User, type UserCreatedHook, type ViewSource, type WriteEvent, type WriteOperation, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, badRequest, betterAuthAuthenticator, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createUser, defineTool, deleteUser, fileConversationStore, forbidden, hasUsers, issueToken, jwtAuthenticator, listUsers, maxTokenTtlSeconds, normalizeRoles, notFound, parseRoles, readOnlyQueryTool, readWriteQueryTool, requestApproval, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, seesAssistant, seesRuntime, setUserBanned, setUserRole, streamChatCompletion, unauthorized, withCacheBreakpoints };
+export { type Admin, type AdminAuth, type AdminOptions, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticatorOptions, type ChatMessage, type ChatTextPart, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CreateAdminInput, type CreateAuthOptions, HttpProblem, type IssueTokenOptions, type JwtOptions, ModelError, type ModelSettings, type NewUser, type OperatorProvider, type PipelineHook, type ProjectConfig, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type RecordKeyInput, type ResourceSource, type RuntimeOptions, type ScanGuardMode, type Session, type SignInPolicy, type SignInRule, type StaffAccessRule, type StaffSignIn, type StoredUser, type TenantValue, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TurnOptions, type User, type UserCreatedHook, type ViewSource, type WidgetOptions, type WriteEvent, type WriteOperation, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, badRequest, betterAuthAuthenticator, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createUser, defaultSignInPolicy, defineConfig, defineTool, deleteUser, fileConversationStore, forbidden, hasUsers, issueToken, jwtAuthenticator, listUsers, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, normalizeRoles, notFound, parseRoles, readOnlyQueryTool, readOperatorSettings, readWriteQueryTool, requestApproval, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, seesAssistant, seesRuntime, setUserBanned, setUserRole, signInPolicyMethods, streamChatCompletion, unauthorized, widget, withCacheBreakpoints };

package/dist/index.js

@@ -11,12 +11,17 @@ import { withCacheBreakpoints } from "./assistant/cache-breakpoints.js";
 import { ModelError, streamChatCompletion } from "./assistant/chat-completions.js";
 import { runTurn } from "./assistant/turn.js";
 import { consoleAuditQueue } from "./audit/console-queue.js";
+import { readOperatorSettings } from "./better-auth/operator-provider.js";
+import { defaultSignInPolicy, signInPolicyMethods } from "./better-auth/sign-in-policy.js";
+import { parseRoles } from "./better-auth/parse-roles.js";
 import { createAuth, normalizeRoles } from "./better-auth/create-auth.js";
-import { createUser, deleteUser, hasUsers, listUsers, parseRoles, roleChoices, setUserBanned, setUserRole } from "./better-auth/users.js";
+import { createUser, deleteUser, hasUsers, listUsers, roleChoices, setUserBanned, setUserRole } from "./better-auth/users.js";
 import { runtimeUrl, runtimeVariable, seesRuntime } from "./runtime/runtime-settings.js";
 import { createAdmin } from "./create-admin.js";
 import { configExports } from "./resource-source.js";
+import { defineConfig, mergeConfig } from "./project-config.js";
 import { jwtAuthenticator } from "./auth/jwt.js";
 import { betterAuthAuthenticator } from "./better-auth/authenticator.js";
 import { issueToken, maxTokenTtlSeconds } from "./better-auth/tokens.js";
-export { HttpProblem, ModelError, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, badRequest, betterAuthAuthenticator, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createUser, defineTool, deleteUser, fileConversationStore, forbidden, hasUsers, issueToken, jwtAuthenticator, listUsers, maxTokenTtlSeconds, normalizeRoles, notFound, parseRoles, readOnlyQueryTool, readWriteQueryTool, requestApproval, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, seesAssistant, seesRuntime, setUserBanned, setUserRole, streamChatCompletion, unauthorized, withCacheBreakpoints };
+import { maxWidgetPropsBytes, widget } from "./assistant/widget.js";
+export { HttpProblem, ModelError, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, badRequest, betterAuthAuthenticator, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createUser, defaultSignInPolicy, defineConfig, defineTool, deleteUser, fileConversationStore, forbidden, hasUsers, issueToken, jwtAuthenticator, listUsers, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, normalizeRoles, notFound, parseRoles, readOnlyQueryTool, readOperatorSettings, readWriteQueryTool, requestApproval, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, seesAssistant, seesRuntime, setUserBanned, setUserRole, signInPolicyMethods, streamChatCompletion, unauthorized, widget, withCacheBreakpoints };

package/dist/list-service.js

@@ -1,11 +1,11 @@
-import { checkedFilter, checkedSort } from "./filter-input.js";
-import { readScope, requestAccess, requireOperation } from "./request-access.js";
-import { readTransaction } from "./transactions.js";
 import { etagAlias } from "./sql-parts.js";
 import { etagOf } from "./etag.js";
 import { exposeRow, pickFields } from "./rows.js";
-import { deletedRows, listParams, pageSizeOf, parseParams, seekParams, selectedFields } from "./params.js";
+import { checkedFilter, checkedSort } from "./filter-input.js";
+import { readScope, requestAccess, requireOperation } from "./request-access.js";
 import { rowPermissions } from "./row-permissions.js";
+import { readTransaction } from "./transactions.js";
+import { deletedRows, listParams, pageSizeOf, parseParams, seekParams, selectedFields } from "./params.js";
 import { estimateCount, exactCount, listQuery, seekToPosition } from "@protobase/query";
 //#region src/list-service.ts
 /**

package/dist/project-config.d.ts

@@ -0,0 +1,28 @@
+import { AdminAuth } from "./better-auth/create-auth.js";
+import { Authenticator } from "./types.js";
+import { AdminOptions } from "./admin-options.js";
+import { Db } from "@protobase/query";
+//#region src/project-config.d.ts
+/** What `protobase.config.ts` may default-export. Everything is optional. */
+export type ProjectConfig = {
+  /** Names the config in errors, such as two configs defining the same tool; an extension should set it. */
+  name?: string;
+  /** Configs this one extends: merged in order before it (see `mergeConfig`). */
+  extends?: ProjectConfig[];
+  /** The config module, e.g. `import * as config from './config'`; default: ./config/index.ts and ./config/*\/ui.ts. */
+  config?: Record<string, unknown>;
+  db?: Db;
+  authenticate?: Authenticator;
+  /** A Better Auth instance; createAdmin mounts its routes under /api/auth. */
+  auth?: AdminAuth;
+  options?: AdminOptions;
+};
+/** Typed identity, for `export default defineConfig({ extends: [...], config, auth, ... })` in `protobase.config.ts`. */
+export declare const defineConfig: (config: ProjectConfig) => ProjectConfig;
+/**
+ * One config from several, each after the ones it `extends`, the last being the app's own. Named things are all kept:
+ * resources, views and pages of the config modules, assistant tools; one name defined by two configs is an error naming
+ * both. Write hooks run in the same order. Every other value is the last config's that sets it, so the app's own wins.
+ */
+export declare const mergeConfig: (...configs: ProjectConfig[]) => ProjectConfig;
+//#endregion

package/dist/project-config.js

@@ -0,0 +1,111 @@
+import { isPageDefinition } from "@protobase/layout";
+//#region src/project-config.ts
+/** Typed identity, for `export default defineConfig({ extends: [...], config, auth, ... })` in `protobase.config.ts`. */
+const defineConfig = (config) => config;
+const lastSet = (objects) => Object.fromEntries(objects.flatMap((object) => Object.entries(object)).filter(([, value]) => value !== void 0));
+const flatten = (config, label) => [...(config.extends ?? []).flatMap((parent, index) => flatten(parent, parent.name ?? `${label} extends[${index}]`)), {
+	config,
+	label
+}];
+const checkUnique = (kind, entries) => {
+	const seen = /* @__PURE__ */ new Map();
+	for (const { name, value, label } of entries) {
+		const first = seen.get(name);
+		if (first && first.value !== value) throw new Error(`${kind} "${name}" is defined twice, ${first.label === label ? `in ${label}` : `by ${first.label} and by ${label}`}; rename one of them`);
+		if (!first) seen.set(name, {
+			value,
+			label
+		});
+	}
+};
+const mergedModule = (named) => {
+	const withModule = named.filter(({ config }) => config.config);
+	if (withModule.length === 0) return void 0;
+	const exports = withModule.flatMap(({ config, label }) => Object.entries(config.config).map(([key, value]) => ({
+		key,
+		value,
+		label
+	})));
+	const values = exports.map((entry) => ({
+		...entry,
+		value: entry.value
+	}));
+	checkUnique("The resource", values.filter(({ value }) => typeof value?.recordSchema === "function" && typeof value.toModel === "function").map(({ value, label }) => ({
+		name: String(value.toModel().name),
+		value,
+		label
+	})));
+	checkUnique("The page", exports.filter(({ value }) => isPageDefinition(value)).map(({ value, label }) => ({
+		name: value.name,
+		value,
+		label
+	})));
+	const menus = values.filter(({ value }) => typeof value?.toUserMenuModel === "function");
+	if (new Set(menus.map(({ value }) => value)).size > 1) throw new Error(`Only one config may export a user menu; ${menus.map(({ label }) => label).join(" and ")} each do`);
+	const module = {};
+	const own = withModule.at(-1).label;
+	for (const { key, value, label } of exports) {
+		if (Object.values(module).includes(value)) continue;
+		module[label === own ? key : `${label}:${key}`] = value;
+	}
+	return module;
+};
+const mergedAssistant = (named) => {
+	const options = named.map(({ config, label }) => ({
+		assistant: config.options?.assistant,
+		label
+	})).filter(({ assistant }) => assistant !== void 0);
+	if (options.length === 0) return void 0;
+	if (options.at(-1).assistant === false) return false;
+	const after = options.slice(options.findLastIndex(({ assistant }) => assistant === false) + 1);
+	const tools = after.flatMap(({ assistant, label }) => (assistant.tools ?? []).map((tool) => ({
+		tool,
+		label
+	})));
+	checkUnique("The assistant tool", tools.map(({ tool, label }) => ({
+		name: tool.name,
+		value: tool,
+		label
+	})));
+	return {
+		...lastSet(after.map(({ assistant }) => assistant)),
+		...tools.length > 0 && { tools: tools.map(({ tool }) => tool) }
+	};
+};
+const mergedOptions = (named) => {
+	const all = named.flatMap(({ config }) => config.options ? [config.options] : []);
+	if (all.length === 0) return void 0;
+	const writeHooks = all.flatMap((options) => options.writeHooks ?? []);
+	const assistant = mergedAssistant(named);
+	return {
+		...lastSet(all),
+		...writeHooks.length > 0 && { writeHooks },
+		...assistant !== void 0 && { assistant }
+	};
+};
+/**
+* One config from several, each after the ones it `extends`, the last being the app's own. Named things are all kept:
+* resources, views and pages of the config modules, assistant tools; one name defined by two configs is an error naming
+* both. Write hooks run in the same order. Every other value is the last config's that sets it, so the app's own wins.
+*/
+const mergeConfig = (...configs) => {
+	const named = configs.flatMap((config, index) => flatten(config, config.name ?? `config ${index + 1}`));
+	const { db, authenticate, auth } = lastSet(named.map(({ config }) => ({
+		db: config.db,
+		authenticate: config.authenticate,
+		auth: config.auth
+	})));
+	const module = mergedModule(named);
+	const options = mergedOptions(named);
+	const name = configs.at(-1)?.name;
+	return {
+		...name && { name },
+		...module && { config: module },
+		...db && { db },
+		...authenticate && { authenticate },
+		...auth && { auth },
+		...options && { options }
+	};
+};
+//#endregion
+export { defineConfig, mergeConfig };

package/dist/read-service.js

@@ -1,10 +1,10 @@
 import { notFound } from "./problem.js";
-import { tenantScope } from "./tenant.js";
-import { recordDecision, requestAccess, requireOperation, targetFilter, visibleFields, writableFields } from "./request-access.js";
-import { readTransaction } from "./transactions.js";
 import { pickFields } from "./rows.js";
 import { fetchRecord } from "./records.js";
+import { tenantScope } from "./tenant.js";
+import { recordDecision, requestAccess, requireOperation, targetFilter, visibleFields, writableFields } from "./request-access.js";
 import { rowPermissions } from "./row-permissions.js";
+import { readTransaction } from "./transactions.js";
 //#region src/read-service.ts
 /** `edit` for fields the caller may change on this record, `read` for the rest (sensitive ones included); hidden fields are not listed at all. */
 const fieldModes = (access, canUpdate) => Object.fromEntries(Object.keys(access.readable.fields).map((name) => [name, canUpdate && writableFields(access, "update").includes(name) ? "edit" : "read"]));

package/dist/registry.d.ts

@@ -0,0 +1,2 @@
+import "./resource-source.js";
+import { ResourceModel } from "@protobase/schema";

package/dist/routes/record.js

@@ -1,11 +1,11 @@
 import { notFound } from "../problem.js";
+import { keyFromPath } from "../key.js";
 import { pickFields } from "../rows.js";
+import { readRecord } from "../read-service.js";
 import { runWrite } from "../write-pipeline.js";
-import { keyFromPath } from "../key.js";
 import { deletedRows, selectedFields } from "../params.js";
 import { returnPreference } from "./preferences.js";
 import { resolveTarget } from "./target.js";
-import { readRecord } from "../read-service.js";
 import { revealField } from "../reveal-service.js";
 import { Hono } from "hono";
 //#region src/routes/record.ts

package/dist/row-permissions.js

@@ -1,7 +1,7 @@
-import { tenantScope } from "./tenant.js";
-import { recordDecision } from "./request-access.js";
 import { aliasedColumn, columnId, scopeConditions, tableId, whereClause } from "./sql-parts.js";
 import { fetchRecord } from "./records.js";
+import { tenantScope } from "./tenant.js";
+import { recordDecision } from "./request-access.js";
 import { compileFilter } from "@protobase/query";
 import { sql } from "kysely";
 //#region src/row-permissions.ts

package/dist/scan-guard.d.ts

@@ -0,0 +1,4 @@
+import "./types.js";
+import "./registry.js";
+import { ResourceModel } from "@protobase/schema";
+import { Db } from "@protobase/query";

package/dist/types.d.ts

@@ -1,8 +1,6 @@
-import { AssistantOptions } from "./assistant/assistant-settings.js";
-import { RuntimeOptions } from "./runtime/runtime-settings.js";
 import { Hono } from "hono";
 import { PageModel } from "@protobase/layout";
-import { ResolveOptions, ResourceModel, ViewModel } from "@protobase/schema";
+import { ResourceModel, ViewModel } from "@protobase/schema";
 import { Db } from "@protobase/query";
 //#region src/types.d.ts
 export type TenantValue = string | number;
@@ -64,35 +62,6 @@ export type AuditQueue = {
   publish(event: AuditEvent): Promise<void>;
 };
 export type ScanGuardMode = 'reject' | 'warn' | 'off';
-export type AdminOptions = {
-  /** Default `/api/v1`. */
-  basePath?: string;
-  /** Applied to every request's transaction with SET LOCAL. Default 15000. */
-  statementTimeoutMs?: number;
-  /** List shapes that would sequentially scan a table of more than `seqScanRows` rows (default 10000). Default mode `reject`. */
-  scanGuard?: {
-    mode?: ScanGuardMode;
-    seqScanRows?: number;
-  };
-  /** Runs inside the write transaction after each create, update and delete. */
-  writeHooks?: PipelineHook[];
-  /** The project's roles (from `defineRoles`): an operation without an access rule needs the matching capability. */
-  roles?: ResolveOptions['roles'];
-  /** What an operation without a rule does; overrides the capability check. Without `roles` the default is allow. */
-  defaultAccess?: ResolveOptions['defaultAccess'];
-  /** Whether list items carry their `permissions` (update, delete): true by default, or `{ except: [...] }` for resources that opt out. */
-  rowPermissions?: boolean | {
-    except: string[];
-  };
-  /** Receives an event for every reveal of a sensitive field. Default: printed to the console, nothing kept. */
-  audit?: AuditQueue;
-  /** Called with every error the API turns into a 500, so the host can report it. */
-  onUnhandledError?: (error: unknown) => void;
-  /** The assistant in the admin app's dock: a backend elsewhere or the built-in one (see `AssistantOptions`); `false` turns it off. */
-  assistant?: AssistantOptions | false;
-  /** The runtime updates endpoint behind the top bar's update button (see `RuntimeOptions`); `false` turns it off. */
-  runtime?: RuntimeOptions | false;
-};
 export type ViewSource = {
   toModel(): ViewModel;
 };

package/dist/write-pipeline.js

@@ -1,10 +1,10 @@
 import { HttpProblem, badRequest } from "./problem.js";
+import { deleteRecord, fetchRecord, insertRecord, restoreRecord } from "./records.js";
 import { tenantScope } from "./tenant.js";
 import { requestAccess, requireOperation, targetFilter, writableFields } from "./request-access.js";
 import { writeTransaction } from "./transactions.js";
-import { deleteRecord, fetchRecord, insertRecord, restoreRecord } from "./records.js";
-import { assertWritten, checkPrecondition, decide, denied, firstKeyField, missing, notifier, shown } from "./write-shared.js";
 import { validateBody } from "./validate-body.js";
+import { assertWritten, checkPrecondition, decide, denied, firstKeyField, missing, notifier, shown } from "./write-shared.js";
 import { applyUpdate, planUpdate } from "./write-update.js";
 //#region src/write-pipeline.ts
 const withOwner = (access, values) => {

package/dist/write-shared.js

@@ -1,9 +1,9 @@
 import { forbidden, notFound, preconditionFailed, preconditionRequired } from "./problem.js";
-import { tenantScope } from "./tenant.js";
-import { andFilters, recordDecision } from "./request-access.js";
 import { ifMatchSatisfied } from "./etag.js";
 import { pickFields } from "./rows.js";
 import { fetchRecord } from "./records.js";
+import { tenantScope } from "./tenant.js";
+import { andFilters, recordDecision } from "./request-access.js";
 //#region src/write-shared.ts
 const missing = (entry) => notFound(`No ${entry.name} with this key`);
 const checkPrecondition = (current, ifMatch, required) => {

package/dist/write-update.js

@@ -1,8 +1,8 @@
+import { fetchRecord, updateRecord } from "./records.js";
 import { tenantScope } from "./tenant.js";
 import { targetFilter } from "./request-access.js";
-import { fetchRecord, updateRecord } from "./records.js";
-import { assertWritten, checkPrecondition, decide, denied, firstKeyField, missing, notifier } from "./write-shared.js";
 import { validateBody } from "./validate-body.js";
+import { assertWritten, checkPrecondition, decide, denied, firstKeyField, missing, notifier } from "./write-shared.js";
 //#region src/write-update.ts
 /**
 * Everything an update needs before it writes: the row (locked, inside the caller's tenant and row filters), the ETag

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.3.5",
+  "version": "0.5.0",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -29,10 +29,12 @@
     "access": "public"
   },
   "dependencies": {
-    "@protobase/layout": "0.3.5",
-    "@protobase/query": "0.3.5",
-    "@protobase/schema": "0.3.5",
+    "@better-auth/passkey": "^1.7.7",
+    "@protobase/layout": "0.5.0",
+    "@protobase/query": "0.5.0",
+    "@protobase/schema": "0.5.0",
     "@scalar/hono-api-reference": "^0.12.10",
+    "@simplewebauthn/server": "^13.3.1",
     "better-auth": "^1.7.7",
     "hono": "^4.13.13",
     "jose": "^6.2.12",