@protobase/server 0.33.2 → 0.33.4

package/dist/better-auth/session-token.js

@@ -0,0 +1,26 @@
+import { forbidden, unauthorized } from "../problem.js";
+import { APIError } from "better-auth/api";
+//#region src/better-auth/session-token.ts
+const messageOf = (body) => {
+	const message = body?.message;
+	return typeof message === "string" ? message : "Signing in is refused";
+};
+/**
+* The bearer token of the session a request's cookie carries, minted as `GET /api/auth/token` would, with the same
+* plugin hooks (the sign-in policy's hold-back included) but without its rate limit: a forged cookie fails its
+* signature before any store read. No session is a 401 problem, a refusal a 403 with Better Auth's message; any other
+* error stays as it is.
+*/
+const betterAuthSessionToken = (auth) => async (request) => {
+	try {
+		const { token } = await auth.api.getToken({ headers: request.headers });
+		return token;
+	} catch (error) {
+		if (!(error instanceof APIError)) throw error;
+		if (error.statusCode === 401) throw unauthorized("Sign in first");
+		if (error.statusCode === 403) throw forbidden("sign-in-refused", messageOf(error.body));
+		throw error;
+	}
+};
+//#endregion
+export { betterAuthSessionToken };

package/dist/check-owners.js

@@ -1,14 +1,20 @@
 //#region src/check-owners.ts
+const holds = (field, id) => field === "text" || field === id || field === "bigint" && id === "integer";
 /**
-* Stops startup on an `.owner()` field that cannot hold the ids of the auth instance's users: Better Auth's own ids
-* are random text, so the field must be text unless `generateUserId` makes the ids. Without an auth instance the
-* ids come from the app's own authenticator, which this cannot see.
+* Stops startup on an `.owner()` field that cannot hold the ids of the signed-in users. The authenticator's
+* `userIdType` declares their type; without it, the auth instance's users have Better Auth's own ids, random text,
+* unless `generateUserId` makes the ids. Without either, the ids come from the app's own authenticator, which this
+* cannot see.
 */
-const checkOwnerFields = (registry, auth) => {
+const checkOwnerFields = (registry, userIdType, auth) => {
+	if (userIdType) return checkAgainst(registry, userIdType, (ownerType) => `the authenticator's users have ${userIdType} ids: make it a ${userIdType} or text column, or declare the authenticator's userIdType`);
 	if (!auth || auth.generatesUserIds) return;
+	checkAgainst(registry, "text", (ownerType) => `Better Auth's user ids are random text: make it a text column, or give createAuth a generateUserId that makes ${ownerType} ids`);
+};
+const checkAgainst = (registry, userIdType, fix) => {
 	for (const entry of registry.entries) {
-		if (entry.ownerType === void 0 || entry.ownerType === "text") continue;
-		throw new Error(`${entry.name}.${entry.model.owner} is the owner of its records, so it holds the signed-in user's id, but it holds ${entry.ownerType} values and Better Auth's user ids are random text: make it a text column, or give createAuth a generateUserId that makes ${entry.ownerType} ids`);
+		if (entry.ownerType === void 0 || holds(entry.ownerType, userIdType)) continue;
+		throw new Error(`${entry.name}.${entry.model.owner} is the owner of its records, so it holds the signed-in user's id, but it holds ${entry.ownerType} values and ${fix(entry.ownerType)}`);
 	}
 };
 //#endregion

package/dist/create-admin.js

@@ -25,6 +25,7 @@ import { authBasePath } from "./better-auth/auth-base-path.js";
 import { withoutSessionTokens } from "./better-auth/without-session-tokens.js";
 import { organizationRoutes } from "./better-auth/organizations/admin-routes.js";
 import { statusRoute } from "./better-auth/status-route.js";
+import { betterAuthSessionToken } from "./better-auth/session-token.js";
 import { goTrueTokens } from "./gotrue/access-tokens.js";
 import { goTrueRoutes } from "./gotrue/routes.js";
 import { changesSchema } from "./changes/events-options.js";
@@ -58,6 +59,7 @@ import { formRoutes } from "./forms/routes.js";
 import { createFormsRuntime } from "./forms/runtime.js";
 import { functionRoutes } from "./functions/routes.js";
 import { supabaseFunctionRoutes } from "./functions/supabase-routes.js";
+import { upgradeAuthenticator } from "./functions/upgrade-caller.js";
 import { localeSetting } from "./locale/locale-option.js";
 import { mapSettings } from "./maps/map-settings.js";
 import { pluginOptions, pluginsBeforeSignIn } from "./plugins/plugin-settings.js";
@@ -115,7 +117,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	checkBottomBars(registry, bottomBarModels, pageModels.map((entry) => entry.name), declaredRoles(auth, options.roles));
 	checkViews(registry, viewModels, pageModels.map((entry) => entry.name), fieldTypes);
 	checkRoleLimits(registry, options.roles?.limits ?? []);
-	checkOwnerFields(registry, auth);
+	checkOwnerFields(registry, authenticate.userIdType, auth);
 	checkPositionAfter(registry);
 	checkParents(registry);
 	checkPages(pageModels, {
@@ -272,6 +274,14 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 			report: options.onUnhandledError
 		}));
 	}
+	const report = options.onUnhandledError ?? ((error) => console.error(error));
+	const upgradeAuthenticate = upgradeAuthenticator({
+		authenticate,
+		...auth && {
+			origins: auth.origins,
+			sessionToken: betterAuthSessionToken(auth)
+		}
+	});
 	app.route("/", functionRoutes({
 		basePath: `${systemPath}/functions`,
 		functions: apiFunctions,
@@ -280,7 +290,10 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 		db,
 		records: (session) => callerRecords(deps, session),
 		onError,
-		wake: () => wakeDispatch(deps)
+		wake: () => wakeDispatch(deps),
+		upgradeWebSocket,
+		upgradeAuthenticate,
+		report
 	}));
 	const verifyGoTrue = auth ? jwtVerifier(goTrueTokens({ auth })) : () => Promise.reject(unauthorized("This app signs no user tokens"));
 	app.route("/", supabaseFunctionRoutes({
@@ -296,7 +309,6 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	app.route("/", batchRoute(deps, authenticate, meta));
 	app.route("/", fileRoutes(deps, authenticate));
 	if (forms) app.route(`${systemPath}/forms`, formRoutes(deps, forms));
-	const report = options.onUnhandledError ?? ((error) => console.error(error));
 	const feed = tableFeed({
 		db,
 		schema: changes,

package/dist/functions/accept-socket.js

@@ -0,0 +1,32 @@
+import { HttpProblem } from "../problem.js";
+import { socketEvents } from "./function-socket.js";
+//#region src/functions/accept-socket.ts
+const marker = "protobase-websocket";
+/**
+* One call's `acceptWebSocket` and what turns its answer into the upgrade. `accept` only records the events and returns
+* a marker response; `answer` upgrades once the function has returned it, so a caller that is refused, or a function
+* that throws, never gets a socket.
+*/
+const socketAcceptor = ({ c, upgradeWebSocket, report, recheck }) => {
+	let accepted;
+	const accept = (events) => {
+		if (c.req.header("upgrade")?.toLowerCase() !== "websocket") throw new HttpProblem(426, "upgrade-required", "Upgrade Required", "Open this function with a WebSocket", {}, { upgrade: "websocket" });
+		if (!upgradeWebSocket) throw new Error("This server does not accept WebSockets");
+		accepted = events;
+		return new Response(null, { headers: { [marker]: "accept" } });
+	};
+	const answer = (name, response) => {
+		if (!accepted) return response;
+		if (!response.headers.has(marker)) throw new Error(`The function "${name}" accepted a WebSocket but answered with another response`);
+		return upgradeWebSocket(c, socketEvents(accepted, {
+			report,
+			...recheck && { recheck }
+		}), { onError: report });
+	};
+	return {
+		accept,
+		answer
+	};
+};
+//#endregion
+export { socketAcceptor };

package/dist/functions/define-function.d.ts

@@ -1,5 +1,6 @@
 import { Session } from "../types.js";
 import { Caller } from "../api-keys/resolve-caller.js";
+import { SocketEvents } from "./function-socket.js";
 import { FunctionRecords } from "./records.js";
 import { Capability } from "@protobase/schema";
 import { Db } from "@protobase/query";
@@ -12,6 +13,12 @@ export type PublicFunctionContext = {
   db: Db;
   /** The caller, through the app's own `authenticate`: rejects with a 401 problem when the request carries no valid token. */
   caller: () => Promise<FunctionCaller>;
+  /**
+   * Answers a WebSocket upgrade with a socket: return its response. A request that is no upgrade is a 426 problem. A
+   * protected function's caller is checked again every minute while the socket is open, which closes with 1008 once
+   * they would be refused; a public function checks its own callers.
+   */
+  acceptWebSocket: (events: SocketEvents) => Response;
 };
 /** Who called a function, and the app's resources as them. */
 export type FunctionCaller = {

package/dist/functions/function-socket.d.ts

@@ -0,0 +1,18 @@
+import "hono/ws";
+//#region src/functions/function-socket.d.ts
+/** An open WebSocket as a function sees it. */
+export type FunctionSocket = {
+  /** Resolves once the data is written to the connection, or at once when the socket is closed; it never rejects. */
+  send(data: string | ArrayBuffer | Uint8Array): Promise<void>;
+  close(code?: number, reason?: string): void;
+  /** The bytes queued to send but not yet written. */
+  readonly bufferedAmount: number;
+};
+/** What a function's socket does: see `acceptWebSocket`. */
+export type SocketEvents = {
+  onOpen?: (socket: FunctionSocket) => void | Promise<void>;
+  /** Text arrives as a string, binary as an ArrayBuffer. The next message waits until a returned promise settles. */
+  onMessage?: (data: string | ArrayBuffer, socket: FunctionSocket) => void | Promise<void>;
+  onClose?: (code: number, reason: string) => void | Promise<void>;
+};
+//#endregion

package/dist/functions/function-socket.js

@@ -0,0 +1,81 @@
+import { recheckWhileOpen } from "./socket-recheck.js";
+//#region src/functions/function-socket.ts
+const openState = 1;
+/** Received bytes waiting for `onMessage` above which reading pauses. */
+const pauseAboveBytes = 1 << 20;
+/** Where reading cannot pause, the waiting bytes above which the socket closes with 1013 (Try Again Later). */
+const closeAboveBytes = 16 << 20;
+const sizeOf = (data) => typeof data === "string" ? data.length : data.byteLength;
+/**
+* A function's socket events as Hono's, over the host's raw socket. Messages reach `onMessage` one at a time, in order,
+* after `onOpen`, and `onClose` comes after the last of them. A handler that throws or rejects is reported and closes
+* the socket with 1011.
+*/
+const socketEvents = (events, { report, recheck }) => {
+	let raw;
+	let socket;
+	let chain = Promise.resolve();
+	let waiting = 0;
+	let paused = false;
+	let ended = false;
+	let stopRecheck = () => {};
+	const end = (code, reason) => {
+		ended = true;
+		stopRecheck();
+		raw.close(code, reason);
+	};
+	const fail = (error) => {
+		report(error);
+		if (!ended) end(1011, "Internal Error");
+	};
+	const enqueue = (step, always = false) => {
+		chain = chain.then(() => ended && !always ? void 0 : step()).catch(fail);
+	};
+	const received = (data) => {
+		const size = sizeOf(data);
+		waiting += size;
+		if (waiting > 1048576 && raw.pause && !paused) {
+			paused = true;
+			raw.pause();
+		}
+		if (waiting > 16777216 && !raw.pause && !ended) end(1013, "Try Again Later");
+		enqueue(async () => {
+			await events.onMessage?.(data, socket);
+			waiting -= size;
+			if (paused && waiting === 0) {
+				paused = false;
+				raw.resume?.();
+			}
+		});
+	};
+	return {
+		onOpen: (_event, ws) => {
+			raw = ws.raw;
+			socket = {
+				send: (data) => new Promise((resolve) => {
+					if (raw.readyState !== openState) return resolve();
+					raw.send(data, () => resolve());
+				}),
+				close: (code, reason) => raw.close(code, reason),
+				get bufferedAmount() {
+					return raw.bufferedAmount;
+				}
+			};
+			if (recheck) stopRecheck = recheckWhileOpen({
+				check: recheck,
+				close: end,
+				report
+			});
+			enqueue(() => events.onOpen?.(socket));
+		},
+		onMessage: (event) => {
+			if (typeof event.data === "string" || event.data instanceof ArrayBuffer) received(event.data);
+		},
+		onClose: (event) => {
+			stopRecheck();
+			enqueue(() => events.onClose?.(event.code, event.reason), true);
+		}
+	};
+};
+//#endregion
+export { closeAboveBytes, pauseAboveBytes, socketEvents };

package/dist/functions/routes.js

@@ -1,7 +1,9 @@
-import { notFound } from "../problem.js";
+import { forbidden, notFound } from "../problem.js";
 import { invokeFunction } from "./define-function.js";
 import { runInBackground } from "../background-work.js";
+import { socketAcceptor } from "./accept-socket.js";
 import { functionGate, requireGate } from "./function-gate.js";
+import { sameCaller } from "./same-caller.js";
 import { Hono } from "hono";
 import { cors } from "hono/cors";
 //#region src/functions/routes.ts
@@ -10,17 +12,21 @@ const relativeRequest = (request, prefix) => {
 	url.pathname = url.pathname.slice(prefix.length) || "/";
 	return new Request(url, request);
 };
+const isUpgrade = (request) => request.headers.get("upgrade")?.toLowerCase() === "websocket";
 /**
 * Every function at `<basePath>/<name>` and below, any method. A protected function authenticates the request first, so
 * a call without a valid token is the authenticator's 401 problem, and one its gate refuses a 403; a public one gets the caller only when it asks. Each
 * call runs as background work, so calls that hold the database for long leave a connection to page requests. Once a
 * call ends, failed or not, `wake` runs, so what it wrote reaches open pages without waiting for the dispatcher's poll.
+* A function may answer an upgrade with a socket, only once it returned; a protected one's caller is checked again
+* every minute while it is open.
 */
-const functionRoutes = ({ basePath, functions, authenticate, access, db, records, onError, wake }) => {
+const functionRoutes = ({ basePath, functions, authenticate, access, db, records, onError, wake, upgradeWebSocket, upgradeAuthenticate = authenticate, report }) => {
 	const app = new Hono().basePath(basePath);
 	app.onError(onError);
+	const sessionOf = (request) => isUpgrade(request) ? upgradeAuthenticate(request) : authenticate(request);
 	const callerOf = async (request) => {
-		const session = await authenticate(request);
+		const session = await sessionOf(request);
 		return {
 			session,
 			records: records(session)
@@ -36,21 +42,40 @@ const functionRoutes = ({ basePath, functions, authenticate, access, db, records
 			const request = relativeRequest(c.req.raw, prefix);
 			if (options.public) {
 				let caller;
-				return invokeFunction(name, fn, request, {
+				const acceptor = socketAcceptor({
+					c,
+					upgradeWebSocket,
+					report
+				});
+				const context = {
 					name,
 					db,
-					caller: () => caller ??= callerOf(c.req.raw)
-				});
+					caller: () => caller ??= callerOf(c.req.raw),
+					acceptWebSocket: acceptor.accept
+				};
+				return acceptor.answer(name, await invokeFunction(name, fn, request, context));
 			}
 			const caller = await callerOf(c.req.raw);
 			requireGate(name, gate, caller.session);
+			const recheck = async () => {
+				const again = await upgradeAuthenticate(c.req.raw);
+				requireGate(name, gate, again);
+				if (!sameCaller(caller.session, again)) throw forbidden("caller-changed", "Your access changed: open the socket again");
+			};
+			const acceptor = socketAcceptor({
+				c,
+				upgradeWebSocket,
+				report,
+				recheck
+			});
 			const context = {
 				name,
 				db,
 				...caller,
-				caller: async () => caller
+				caller: async () => caller,
+				acceptWebSocket: acceptor.accept
 			};
-			return invokeFunction(name, fn, request, context);
+			return acceptor.answer(name, await invokeFunction(name, fn, request, context));
 		})));
 	}
 	app.all("/*", (c) => {

package/dist/functions/same-caller.js

@@ -0,0 +1,9 @@
+//#region src/functions/same-caller.ts
+const sameRoles = (a, b) => {
+	const roles = new Set(a);
+	return roles.size === new Set(b).size && b.every((role) => roles.has(role));
+};
+/** Whether two resolutions of a caller give the same user, tenant, organization and roles, in any order. */
+const sameCaller = (a, b) => a.user.id === b.user.id && a.tenant === b.tenant && a.organization?.id === b.organization?.id && sameRoles(a.user.roles, b.user.roles);
+//#endregion
+export { sameCaller };

package/dist/functions/socket-recheck.js

@@ -0,0 +1,33 @@
+import { HttpProblem } from "../problem.js";
+//#region src/functions/socket-recheck.ts
+const isRefusal = (error) => error instanceof HttpProblem && (error.status === 401 || error.status === 403);
+/**
+* Runs `check` every `everyMs` while a socket is open, one check after the other. A refusal closes the socket with 1008
+* (Policy Violation) and the problem's title; any other error is reported and closes it with 1011, so an outage that
+* stops the check ends the access too. Returns the function that stops it.
+*/
+const recheckWhileOpen = ({ check, close, report, everyMs = 6e4 }) => {
+	let stopped = false;
+	let timer;
+	const end = (error) => {
+		if (stopped) return;
+		stopped = true;
+		if (isRefusal(error)) return close(1008, error.title);
+		report(error);
+		close(1011, "Internal Error");
+	};
+	const run = () => check().then(() => {
+		if (!stopped) schedule();
+	}, end);
+	const schedule = () => {
+		timer = setTimeout(run, everyMs);
+		timer.unref?.();
+	};
+	schedule();
+	return () => {
+		stopped = true;
+		clearTimeout(timer);
+	};
+};
+//#endregion
+export { recheckWhileOpen };

package/dist/functions/upgrade-caller.js

@@ -0,0 +1,25 @@
+import { forbidden } from "../problem.js";
+//#region src/functions/upgrade-caller.ts
+const hostOf = (url) => URL.canParse(url) ? new URL(url).host : void 0;
+const allowedOrigin = (request, origins) => {
+	const origin = request.headers.get("origin");
+	if (origin === null) return true;
+	if (origins) return origins.includes(origin);
+	const host = hostOf(origin);
+	return host !== void 0 && host === new URL(request.url).host;
+};
+/**
+* The caller of a WebSocket upgrade, which a browser opens with its session cookie and no headers of its own: refused
+* with 403 from a foreign origin (cross-site WebSocket hijacking), then by its bearer token when it has one, otherwise
+* by the bearer token its cookie's session mints, which goes through `authenticate` with all the request's other
+* headers, as a plain call would.
+*/
+const upgradeAuthenticator = ({ authenticate, origins, sessionToken }) => async (request) => {
+	if (!allowedOrigin(request, origins)) throw forbidden("foreign-origin", "This page’s origin may not open a socket to this app");
+	if (request.headers.has("authorization") || !request.headers.has("cookie") || !sessionToken) return authenticate(request);
+	const headers = new Headers(request.headers);
+	headers.set("authorization", `Bearer ${await sessionToken(request)}`);
+	return authenticate(new Request(request, { headers }));
+};
+//#endregion
+export { upgradeAuthenticator };

package/dist/index.d.ts

@@ -24,6 +24,7 @@ import { FileProvider, FileStore, StoredObject } from "./files/store.js";
 import { FilesOptions } from "./files/options.js";
 import { ApiKeys, ApiKeysOptions, apiKeySettings, apiKeyVariables } from "./api-keys/api-key-settings.js";
 import { Caller, CallerOptions, apiKeyCaller } from "./api-keys/resolve-caller.js";
+import { FunctionSocket, SocketEvents } from "./functions/function-socket.js";
 import { ErrorReportingOptions, ErrorReportingSettings, errorReportingSettings, errorReportingVariable } from "./error-reporting/error-reporting-settings.js";
 import { ChatMessage, ChatTextPart, Completion, CompletionOptions, ModelError, ModelSettings, ReasoningDetail, ReasoningEffort, ToolCall, ToolSpec, streamChatCompletion } from "./assistant/chat-completions.js";
 import { CleanupEntry, CleanupSchedule, ScheduledDelete, storageCleanupSchedule } from "./files/cleanup-schedule.js";
@@ -105,4 +106,4 @@ import { isSchedule } from "./jobs/schedule.js";
 import { DrainResult, JobsRuntime, StartJobsOptions, startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
 import { checkJobsSchema, jobsSchema, jobsSchemaMigration } from "./jobs/schema.js";
-export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApiKeys, type ApiKeysOptions, type AppIcons, type AppIdentity, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticatorOptions, type Caller, type CallerOptions, type CapturedRow, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSource, type HistoryOptions, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type MemberInput, MissingCredentials, type MobileConfig, ModelError, type ModelSettings, type NewOrganization, type NewUser, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, backgroundSettled, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, goTruePath, handleDroppedConnections, hasUsers, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, objectKey, parseColumns, parseRoles, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, waitUntil, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };
+export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApiKeys, type ApiKeysOptions, type AppIcons, type AppIdentity, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticatorOptions, type Caller, type CallerOptions, type CapturedRow, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryOptions, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type MemberInput, MissingCredentials, type MobileConfig, ModelError, type ModelSettings, type NewOrganization, type NewUser, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, backgroundSettled, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, goTruePath, handleDroppedConnections, hasUsers, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, objectKey, parseColumns, parseRoles, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, waitUntil, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };

package/dist/registry.d.ts

@@ -1,2 +1,2 @@
 import "./resource-source.js";
-import { ResourceModel } from "@protobase/schema";
+import { KeyType, ResourceModel } from "@protobase/schema";

package/dist/types.d.ts

@@ -1,7 +1,7 @@
 import { JobDefinition } from "./jobs/job-types.js";
 import { Hono } from "hono";
 import { PageModel } from "@protobase/layout";
-import { ResourceModel, ViewModel } from "@protobase/schema";
+import { KeyType, ResourceModel, ViewModel } from "@protobase/schema";
 import { Db } from "@protobase/query";
 //#region src/types.d.ts
 export type TenantValue = string | number;
@@ -20,8 +20,14 @@ export type Session = {
   organization?: SessionOrganization;
   anonymous?: true;
 };
-/** Resolves the caller of a request, or throws a 401 problem (see `unauthorized`). */
-export type Authenticator = (request: Request) => Promise<Session> | Session;
+/**
+ * Resolves the caller of a request, or throws a 401 problem (see `unauthorized`). `userIdType` declares the type of
+ * the ids of the users it returns, which `.owner()` fields are checked against at startup, such as `'uuid'` for an
+ * authenticator that maps the signed-in account to the app's own user row.
+ */
+export type Authenticator = ((request: Request) => Promise<Session> | Session) & {
+  userIdType?: KeyType;
+};
 export type AdminEnv = {
   Variables: {
     session: Session;

package/dist/webhooks/attempt.js

@@ -47,10 +47,14 @@ const callFunction = async (name, subscription, event, options, context, signal)
 		session,
 		records: context.records(session)
 	};
+	const acceptWebSocket = () => {
+		throw new Error(`The function "${name}" accepted a WebSocket, but a webhook delivery is no upgrade`);
+	};
 	const functionContext = {
 		name,
 		db: context.db,
-		caller: async () => caller
+		caller: async () => caller,
+		acceptWebSocket
 	};
 	return invokeFunction(name, fn, await request("http://protobase.internal/", event, options, signal), fn.options.public ? functionContext : {
 		...functionContext,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.33.2",
+  "version": "0.33.4",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -32,9 +32,9 @@
   "dependencies": {
     "@better-auth/passkey": "^1.7.7",
     "@better-auth/sso": "^1.7.7",
-    "@protobase/layout": "0.33.2",
-    "@protobase/query": "0.33.2",
-    "@protobase/schema": "0.33.2",
+    "@protobase/layout": "0.33.4",
+    "@protobase/query": "0.33.4",
+    "@protobase/schema": "0.33.4",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",