@protobase/server 0.33.3 → 0.34.0

package/dist/better-auth/mcp/signed-query-guard.js

@@ -0,0 +1,29 @@
+import { APIError, createAuthMiddleware } from "better-auth/api";
+//#region src/better-auth/mcp/signed-query-guard.ts
+const signedQueryPaths = [
+	"/oauth2/continue",
+	"/oauth2/consent",
+	"/oauth2/authorize"
+];
+/** Whether a request to `path` may carry a signed authorization query. */
+const isSignedQueryAllowed = (path) => path !== void 0 && signedQueryPaths.includes(path);
+const hasSignedQuery = (body) => typeof body === "object" && body !== null && "oauth_query" in body;
+/**
+* Refuses a signed authorization query on any other request (`400 OAUTH_QUERY_REFUSED`), so a sign-in by password,
+* emailed code, passkey, two-factor or provider never resumes an authorization on its own: the person goes on from
+* the connect page, which shows what they allow. Runs before the provider's own hook.
+*/
+const mcpSignedQueryGuard = () => ({
+	id: "protobase-mcp-signed-query-guard",
+	hooks: { before: [{
+		matcher: (context) => hasSignedQuery(context.body) && !isSignedQueryAllowed(context.path),
+		handler: createAuthMiddleware(async () => {
+			throw new APIError("BAD_REQUEST", {
+				code: "OAUTH_QUERY_REFUSED",
+				message: "Sign in first, then continue from the connect page."
+			});
+		})
+	}] }
+});
+//#endregion
+export { isSignedQueryAllowed, mcpSignedQueryGuard };

package/dist/better-auth/origins.d.ts

@@ -1,4 +1,11 @@
 //#region src/better-auth/origins.d.ts
 /** Where browsers read which origins may use the app's passkeys (WebAuthn Related Origin Requests). */
 export declare const webauthnPath = "/.well-known/webauthn";
+/**
+ * Where MCP clients discover how to sign in: the OAuth authorization server's metadata, and the protected resource's
+ * (also below it, at the resource's path). Every bundle sends them to the API, which answers them with MCP on.
+ */
+export declare const oauthWellKnownPaths: string[];
+/** Whether `path` is one of `oauthWellKnownPaths` or below one. */
+export declare const isOAuthWellKnownPath: (path: string) => boolean;
 //#endregion

package/dist/better-auth/origins.js

@@ -44,5 +44,12 @@ const multiHostBaseURL = (baseURL, origins) => {
 };
 /** Where browsers read which origins may use the app's passkeys (WebAuthn Related Origin Requests). */
 const webauthnPath = "/.well-known/webauthn";
+/**
+* Where MCP clients discover how to sign in: the OAuth authorization server's metadata, and the protected resource's
+* (also below it, at the resource's path). Every bundle sends them to the API, which answers them with MCP on.
+*/
+const oauthWellKnownPaths = ["/.well-known/oauth-authorization-server", "/.well-known/oauth-protected-resource"];
+/** Whether `path` is one of `oauthWellKnownPaths` or below one. */
+const isOAuthWellKnownPath = (path) => oauthWellKnownPaths.some((prefix) => path === prefix || path.startsWith(`${prefix}/`));
 //#endregion
-export { appOrigins, multiHostBaseURL, originsVariable, readList, readOrigins, resolveOrigins, webauthnPath };
+export { appOrigins, isOAuthWellKnownPath, multiHostBaseURL, oauthWellKnownPaths, originsVariable, readList, readOrigins, resolveOrigins, webauthnPath };

package/dist/better-auth/password-reset.js

@@ -5,15 +5,16 @@ const resetLinkLifetimeSeconds = 3600;
 const resetLinkLifetime = "1 hour";
 /**
 * Better Auth's own password reset, sending the link with `mail`. Resetting ends the user's sessions, so a reset
-* after a leaked password also signs out whoever used it.
+* after a leaked password also signs out whoever used it, and `onPasswordReset` disconnects the user's MCP clients.
 */
-const passwordResetOptions = (mail) => ({
+const passwordResetOptions = (mail, { onPasswordReset } = {}) => ({
 	resetPasswordTokenExpiresIn: resetLinkLifetimeSeconds,
 	revokeSessionsOnPasswordReset: true,
 	sendResetPassword: ({ user, url }) => sendAuthEmail(mail, "resetPasswordEmail", user.email, {
 		url,
 		lifetime: resetLinkLifetime
-	}, url)
+	}, url),
+	...onPasswordReset && { onPasswordReset }
 });
 //#endregion
 export { passwordResetOptions, resetLinkLifetimeSeconds };

package/dist/better-auth/policy-plugin.js

@@ -1,35 +1,12 @@
 import { effectiveSignInPolicy, missingRequiredMethods, parseSignInPolicy, signInPolicyProblem } from "./sign-in-policy.js";
 import { readSignInPolicy, saveSignInPolicy, signInPolicySchema } from "./policy-store.js";
 import { isPoliced, lastPasskeyRequired, policyRefusal, setupRequired } from "./sign-in-enforcement.js";
+import { accountMethods } from "./sign-in-setup.js";
 import { adminOnly } from "./admin-only.js";
 import { isStaffSession } from "./staff-checks.js";
 import * as z$1 from "zod";
 import { APIError, createAuthEndpoint, createAuthMiddleware, getSessionFromCtx, sessionMiddleware } from "better-auth/api";
 //#region src/better-auth/policy-plugin.ts
-const accountMethods = async (context, user, socialProviders) => {
-	const accounts = await context.internalAdapter.findAccounts(user.id);
-	const passkeys = await context.adapter.count({
-		model: "passkey",
-		where: [{
-			field: "userId",
-			value: user.id
-		}]
-	});
-	const app = await context.adapter.findOne({
-		model: "twoFactor",
-		where: [{
-			field: "userId",
-			value: user.id
-		}]
-	});
-	return {
-		password: accounts.some((account) => account.providerId === "credential"),
-		passkeys,
-		twoFactor: Boolean(user.twoFactorEnabled),
-		authenticatorApp: Boolean(user.twoFactorEnabled) && app !== null && app.verified !== false,
-		socialSignIn: accounts.some((account) => socialProviders.includes(account.providerId))
-	};
-};
 const refuse = (status, refusal) => new APIError(status, refusal);
 const currentPolicy = async (context, { mail, defaultPolicy }) => effectiveSignInPolicy((await readSignInPolicy(context.adapter, defaultPolicy)).policy, { mail });
 const providersUnder = (policy, { socialProviders, platformSignIn }) => [...socialProviders, ...platformSignIn && policy.platformSignIn === "allowed" ? [platformSignIn.provider] : []];

package/dist/better-auth/session-token.js

@@ -0,0 +1,26 @@
+import { forbidden, unauthorized } from "../problem.js";
+import { APIError } from "better-auth/api";
+//#region src/better-auth/session-token.ts
+const messageOf = (body) => {
+	const message = body?.message;
+	return typeof message === "string" ? message : "Signing in is refused";
+};
+/**
+* The bearer token of the session a request's cookie carries, minted as `GET /api/auth/token` would, with the same
+* plugin hooks (the sign-in policy's hold-back included) but without its rate limit: a forged cookie fails its
+* signature before any store read. No session is a 401 problem, a refusal a 403 with Better Auth's message; any other
+* error stays as it is.
+*/
+const betterAuthSessionToken = (auth) => async (request) => {
+	try {
+		const { token } = await auth.api.getToken({ headers: request.headers });
+		return token;
+	} catch (error) {
+		if (!(error instanceof APIError)) throw error;
+		if (error.statusCode === 401) throw unauthorized("Sign in first");
+		if (error.statusCode === 403) throw forbidden("sign-in-refused", messageOf(error.body));
+		throw error;
+	}
+};
+//#endregion
+export { betterAuthSessionToken };

package/dist/better-auth/sign-in-enforcement.js

@@ -65,9 +65,14 @@ const setupRequired = {
 	code: "SIGN_IN_SETUP_REQUIRED",
 	message: "Set up what this app requires for signing in first."
 };
+/** The answer to someone whose address is not verified who asks to allow an app (an MCP client) to act as them. */
+const addressNotVerified = {
+	code: "ADDRESS_NOT_VERIFIED",
+	message: "Confirm your address first: sign out, then sign in with a code emailed to you."
+};
 const lastPasskeyRequired = {
 	code: "PASSKEY_REQUIRED",
 	message: "Passkeys are required for every account, so the last one cannot be removed."
 };
 //#endregion
-export { isPoliced, lastPasskeyRequired, policyRefusal, setupRequired, staffSignInPath };
+export { addressNotVerified, isPoliced, lastPasskeyRequired, policyRefusal, setupRequired, staffSignInPath };

package/dist/better-auth/sign-in-setup.js

@@ -0,0 +1,38 @@
+import { effectiveSignInPolicy, missingRequiredMethods } from "./sign-in-policy.js";
+import { readSignInPolicy } from "./policy-store.js";
+//#region src/better-auth/sign-in-setup.ts
+/** What `user`'s account can sign in with and has set up; `socialProviders` are the provider ids that count as social sign-in. */
+const accountMethods = async (context, user, socialProviders) => {
+	const accounts = await context.internalAdapter.findAccounts(user.id);
+	const passkeys = await context.adapter.count({
+		model: "passkey",
+		where: [{
+			field: "userId",
+			value: user.id
+		}]
+	});
+	const app = await context.adapter.findOne({
+		model: "twoFactor",
+		where: [{
+			field: "userId",
+			value: user.id
+		}]
+	});
+	return {
+		password: accounts.some((account) => account.providerId === "credential"),
+		passkeys,
+		twoFactor: Boolean(user.twoFactorEnabled),
+		authenticatorApp: Boolean(user.twoFactorEnabled) && app !== null && app.verified !== false,
+		socialSignIn: accounts.some((account) => socialProviders.includes(account.providerId))
+	};
+};
+/**
+* The methods the sign-in policy requires that `user` has not set up yet; empty when nothing is missing. `defaultPolicy`
+* applies until an admin saves one.
+*/
+const missingSetup = async (context, user, { mail, defaultPolicy }) => {
+	const policy = effectiveSignInPolicy((await readSignInPolicy(context.adapter, defaultPolicy)).policy, { mail });
+	return missingRequiredMethods(policy, await accountMethods(context, user, []));
+};
+//#endregion
+export { accountMethods, missingSetup };

package/dist/better-auth/snake-case-names.js

@@ -61,7 +61,108 @@ const pluginNames = {
 		deviceType: "device_type",
 		backedUp: "backed_up",
 		createdAt: "created_at"
-	} } }
+	} } },
+	mcp: {
+		oauthClient: {
+			modelName: "oauth_client",
+			fields: {
+				clientId: "client_id",
+				clientSecret: "client_secret",
+				clientDiscoveryId: "client_discovery_id",
+				skipConsent: "skip_consent",
+				enableEndSession: "enable_end_session",
+				subjectType: "subject_type",
+				clientCredentialsScopes: "client_credentials_scopes",
+				userId: "user_id",
+				createdAt: "created_at",
+				updatedAt: "updated_at",
+				softwareId: "software_id",
+				softwareVersion: "software_version",
+				softwareStatement: "software_statement",
+				redirectUris: "redirect_uris",
+				postLogoutRedirectUris: "post_logout_redirect_uris",
+				backchannelLogoutUri: "backchannel_logout_uri",
+				backchannelLogoutSessionRequired: "backchannel_logout_session_required",
+				tokenEndpointAuthMethod: "token_endpoint_auth_method",
+				applicationType: "application_type",
+				jwksUri: "jwks_uri",
+				grantTypes: "grant_types",
+				responseTypes: "response_types",
+				requirePKCE: "require_pkce",
+				dpopBoundAccessTokens: "dpop_bound_access_tokens",
+				referenceId: "reference_id"
+			}
+		},
+		oauthResource: {
+			modelName: "oauth_resource",
+			fields: {
+				accessTokenTtl: "access_token_ttl",
+				refreshTokenTtl: "refresh_token_ttl",
+				signingAlgorithm: "signing_algorithm",
+				signingKeyId: "signing_key_id",
+				allowedScopes: "allowed_scopes",
+				customClaims: "custom_claims",
+				dpopBoundAccessTokensRequired: "dpop_bound_access_tokens_required",
+				createdAt: "created_at",
+				updatedAt: "updated_at",
+				policyVersion: "policy_version"
+			}
+		},
+		oauthClientResource: {
+			modelName: "oauth_client_resource",
+			fields: {
+				clientId: "client_id",
+				resourceId: "resource_id",
+				createdAt: "created_at"
+			}
+		},
+		oauthRefreshToken: {
+			modelName: "oauth_refresh_token",
+			fields: {
+				clientId: "client_id",
+				sessionId: "session_id",
+				userId: "user_id",
+				referenceId: "reference_id",
+				authorizationCodeId: "authorization_code_id",
+				requestedUserInfoClaims: "requested_user_info_claims",
+				expiresAt: "expires_at",
+				createdAt: "created_at",
+				rotatedAt: "rotated_at",
+				rotationReplayResponse: "rotation_replay_response",
+				rotationReplayExpiresAt: "rotation_replay_expires_at",
+				authTime: "auth_time"
+			}
+		},
+		oauthAccessToken: {
+			modelName: "oauth_access_token",
+			fields: {
+				clientId: "client_id",
+				sessionId: "session_id",
+				userId: "user_id",
+				referenceId: "reference_id",
+				authorizationCodeId: "authorization_code_id",
+				requestedUserInfoClaims: "requested_user_info_claims",
+				refreshId: "refresh_id",
+				expiresAt: "expires_at",
+				createdAt: "created_at"
+			}
+		},
+		oauthConsent: {
+			modelName: "oauth_consent",
+			fields: {
+				clientId: "client_id",
+				userId: "user_id",
+				referenceId: "reference_id",
+				requestedUserInfoClaims: "requested_user_info_claims",
+				createdAt: "created_at",
+				updatedAt: "updated_at"
+			}
+		},
+		oauthClientAssertion: {
+			modelName: "oauth_client_assertion",
+			fields: { expiresAt: "expires_at" }
+		}
+	}
 };
 //#endregion
 export { coreNames, pluginNames };

package/dist/better-auth/staff-checks.js

@@ -55,7 +55,8 @@ const accountChanges = [
 	"/invitation/accept",
 	"/organization/leave",
 	"/organization/transfer-ownership",
-	"/organization/delete"
+	"/organization/delete",
+	"/account/connected-apps/disconnect"
 ];
 const staffCannotChange = {
 	code: "STAFF_CANNOT_CHANGE_SIGN_IN",
@@ -63,7 +64,13 @@ const staffCannotChange = {
 };
 /** Whether a staff session's request to `path` is refused: changes to the person's sign-in, and saving the sign-in policy. */
 const isRefusedForStaff = (path, method) => accountChanges.includes(path) || path === "/policy/sign-in" && method === "POST";
+const staffCannotConnect = {
+	code: "STAFF_CANNOT_CONNECT",
+	message: "Staff cannot allow apps to act for a person."
+};
+/** Whether `path` is one of the OAuth provider's, through which an outside app (an MCP client) is allowed to act as someone. */
+const isOAuthPath = (path) => path.startsWith("/oauth2/");
 /** Whether a Better Auth session is one staff started as someone: the admin plugin's `impersonatedBy` names the staff member. */
 const isStaffSession = (session) => Boolean(session.impersonatedBy);
 //#endregion
-export { isRefusedForStaff, isStaffSession, isStrongSignIn, permissionMissing, reasonProblem, signInNotStrong, signInStale, staffCannotChange, staffClaimsRefusal, staffLabel };
+export { isOAuthPath, isRefusedForStaff, isStaffSession, isStrongSignIn, permissionMissing, reasonProblem, signInNotStrong, signInStale, staffCannotChange, staffCannotConnect, staffClaimsRefusal, staffLabel };

package/dist/better-auth/staff-plugin.js

@@ -1,5 +1,5 @@
 import { adminOnly } from "./admin-only.js";
-import { isRefusedForStaff, isStaffSession, staffCannotChange } from "./staff-checks.js";
+import { isOAuthPath, isRefusedForStaff, isStaffSession, staffCannotChange, staffCannotConnect } from "./staff-checks.js";
 import { endStaffSignIn, listStaffSignIns, staffSignInOfSession, staffSignInSchema } from "./staff-log.js";
 import { staffSignInEndpoints } from "./staff-sign-in-endpoints.js";
 import { APIError, createAuthEndpoint, createAuthMiddleware, getSessionFromCtx, sessionMiddleware } from "better-auth/api";
@@ -7,7 +7,8 @@ import { deleteSessionCookie } from "better-auth/cookies";
 //#region src/better-auth/staff-plugin.ts
 /**
 * Staff of the operator sign in as a person of this app, for support (see `staffSignInEndpoints`). A staff session
-* shows who started it and why, can be stopped, and cannot change the person's sign-in or the sign-in policy. Every
+* shows who started it and why, can be stopped, and cannot change the person's sign-in or the sign-in policy, or allow
+* an outside app to act as the person. Every
 * staff sign-in is logged for the app's admins. The plugin is there without an operator provider too, so its table
 * exists from the first auth migration.
 */
@@ -56,6 +57,12 @@ const staffSignInPlugin = ({ operator, mail, defaultPolicy }) => ({
 			const session = await getSessionFromCtx(ctx);
 			if (session && isStaffSession(session.session)) throw new APIError("FORBIDDEN", staffCannotChange);
 		})
+	}, {
+		matcher: (context) => context.path !== void 0 && isOAuthPath(context.path),
+		handler: createAuthMiddleware(async (ctx) => {
+			const session = await getSessionFromCtx(ctx);
+			if (session && isStaffSession(session.session)) throw new APIError("FORBIDDEN", staffCannotConnect);
+		})
 	}] }
 });
 //#endregion

package/dist/better-auth/status-route.js

@@ -14,7 +14,7 @@ import { Hono } from "hono";
 * operator provider's name, when staff can sign in as people; `passkeyDomains`, when people have passkeys for more than
 * one of the app's hosts, the RP IDs a passkey sign-in can ask for, the passkey domain first; with organizations, who may create them and the roles
 * with their labels, `membership` for those a member can hold, and the roles each one's holders may also give; and
-* `anonymous` when the project's anonymous role reads a resource, so the admin app opens for visitors before anyone signs in; and
+* `anonymous` when the project's anonymous role reads a resource, so the admin app opens for visitors before anyone signs in; `mcp` when MCP clients can connect, so the account page lists the connected ones; and
 * `plugins`, those the app loads before sign-in (see `PluginOption`); and `locale`, the language `options.locale` puts
 * the screens in, so the sign-in screens and public forms, which come before `/meta`, are in it too.
 */
@@ -44,6 +44,7 @@ const statusRoute = (auth, { anonymous = false, plugins = [], locale } = {}) =>
 			...staffSignIn && { staffSignIn },
 			...passkeyDomains.length > 1 && { passkeyDomains },
 			...anonymous && { anonymous },
+			...auth.mcp && { mcp: true },
 			...plugins.length > 0 && { plugins },
 			...locale && { locale },
 			...auth.organizations && { organizations: {

package/dist/better-auth/token-claims.js

@@ -0,0 +1,19 @@
+import { narrowClaims } from "./roles/active-role.js";
+import { organizationClaims } from "./organizations/session-organization.js";
+//#region src/better-auth/token-claims.ts
+/**
+* The claims of a token for `user`: the address and the role claims narrowed to one role; with organizations also the
+* claims of `organizationId` while they may work in it (see `organizationClaims`).
+*/
+const tokenClaims = async (user, { wanted, organizationId, organizations }) => {
+	const claims = {
+		role: user.role,
+		...organizations && await organizationClaims(organizations, user, organizationId)
+	};
+	return {
+		email: user.email,
+		...narrowClaims(claims, wanted, Boolean(organizations))
+	};
+};
+//#endregion
+export { tokenClaims };

package/dist/better-auth/users.d.ts

@@ -52,7 +52,10 @@ export declare const setUserRole: (auth: AdminAuth, input: {
   email: string;
   role: string;
 }>;
-/** Disables or re-enables sign-in. Banning ends the user's sessions; the last active admin cannot be banned. */
+/**
+ * Disables or re-enables sign-in. Banning ends the user's sessions and, with MCP on, disconnects their MCP clients and
+ * forgets them, so re-enabling brings none back: each has to be allowed again. The last active admin cannot be banned.
+ */
 export declare const setUserBanned: (auth: AdminAuth, input: {
   email: string;
   banned: boolean;

package/dist/better-auth/users.js

@@ -1,5 +1,6 @@
 import { parseRoles } from "./parse-roles.js";
 import { isActiveAdmin } from "./last-admin.js";
+import { revokeMcpGrants } from "./mcp/revoke-grants.js";
 import { ownOrganizationsWithoutMembers } from "./organizations/host.js";
 //#region src/better-auth/users.ts
 /** The roles this auth instance allows, `admin` first. */
@@ -98,7 +99,10 @@ const setUserRole = async (auth, input) => {
 		role: wanted.join(",")
 	};
 };
-/** Disables or re-enables sign-in. Banning ends the user's sessions; the last active admin cannot be banned. */
+/**
+* Disables or re-enables sign-in. Banning ends the user's sessions and, with MCP on, disconnects their MCP clients and
+* forgets them, so re-enabling brings none back: each has to be allowed again. The last active admin cannot be banned.
+*/
 const setUserBanned = async (auth, input) => {
 	const user = await findUser(auth, input.email);
 	const { internalAdapter } = await auth.$context;
@@ -117,6 +121,7 @@ const setUserBanned = async (auth, input) => {
 		banExpires: null
 	});
 	await internalAdapter.deleteUserSessions(user.id);
+	if (auth.mcp) await revokeMcpGrants((await auth.$context).adapter, user.id);
 };
 //#endregion
 export { createUser, deleteUser, hasUsers, listUsers, parseRoles, roleChoices, setUserBanned, setUserRole };

package/dist/check-roles.js

@@ -18,7 +18,7 @@ const checkRoleLimits = (registry, limits) => {
 			...model,
 			fields: Object.fromEntries(Object.entries(model.fields).map(([field, value]) => [field, {
 				...value,
-				filterable: true
+				filterable: !value.encrypted
 			}]))
 		};
 		const checked = checkFilter(trusted, filter);

package/dist/create-admin.js

@@ -22,9 +22,11 @@ import { readAppName } from "./app-name.js";
 import { realtimePath, restPath, storagePath, supabaseFunctionsPath, supabasePath } from "./supabase-paths.js";
 import { goTruePath } from "./gotrue/keys.js";
 import { authBasePath } from "./better-auth/auth-base-path.js";
+import { mcpDiscovery } from "./better-auth/mcp/discovery-routes.js";
 import { withoutSessionTokens } from "./better-auth/without-session-tokens.js";
 import { organizationRoutes } from "./better-auth/organizations/admin-routes.js";
 import { statusRoute } from "./better-auth/status-route.js";
+import { betterAuthSessionToken } from "./better-auth/session-token.js";
 import { goTrueTokens } from "./gotrue/access-tokens.js";
 import { goTrueRoutes } from "./gotrue/routes.js";
 import { changesSchema } from "./changes/events-options.js";
@@ -56,8 +58,10 @@ import { createFilesRuntime } from "./files/runtime.js";
 import { fileRoutes } from "./files/routes.js";
 import { formRoutes } from "./forms/routes.js";
 import { createFormsRuntime } from "./forms/runtime.js";
+import { createEncryptionRuntime } from "./encryption/runtime.js";
 import { functionRoutes } from "./functions/routes.js";
 import { supabaseFunctionRoutes } from "./functions/supabase-routes.js";
+import { upgradeAuthenticator } from "./functions/upgrade-caller.js";
 import { localeSetting } from "./locale/locale-option.js";
 import { mapSettings } from "./maps/map-settings.js";
 import { pluginOptions, pluginsBeforeSignIn } from "./plugins/plugin-settings.js";
@@ -144,6 +148,10 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	});
 	const apiKeys = apiKeySettings(options.apiKeys, globalThis.process?.env ?? {});
 	const servesKeys = Boolean(apiKeys.publishable || apiKeys.secret);
+	const encryption = createEncryptionRuntime({
+		models: registry.entries.map((entry) => entry.model),
+		env: globalThis.process?.env ?? {}
+	});
 	const files = createFilesRuntime({
 		...filesOptions && { options: filesOptions },
 		env: globalThis.process?.env ?? {},
@@ -185,6 +193,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 		plugins,
 		sources,
 		...files && { files },
+		...encryption && { encryption },
 		...appModels.some(isCaptured) && { actorSetting: `${changes}.actor` },
 		...withHistory && { history: {
 			schema: changes,
@@ -254,6 +263,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 			registry,
 			db
 		}));
+		if (auth.mcp) mcpDiscovery(app, auth);
 		app.on(["GET", "POST"], `${authBasePath}/*`, async (c) => withoutSessionTokens(c.req.raw, await auth.handler(c.req.raw)));
 		app.route(goTruePath, goTrueRoutes(auth));
 		if (auth.origins.length > 1) app.get(webauthnPath, (c) => c.json({ origins: auth.origins }));
@@ -272,6 +282,14 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 			report: options.onUnhandledError
 		}));
 	}
+	const report = options.onUnhandledError ?? ((error) => console.error(error));
+	const upgradeAuthenticate = upgradeAuthenticator({
+		authenticate,
+		...auth && {
+			origins: auth.origins,
+			sessionToken: betterAuthSessionToken(auth)
+		}
+	});
 	app.route("/", functionRoutes({
 		basePath: `${systemPath}/functions`,
 		functions: apiFunctions,
@@ -280,7 +298,10 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 		db,
 		records: (session) => callerRecords(deps, session),
 		onError,
-		wake: () => wakeDispatch(deps)
+		wake: () => wakeDispatch(deps),
+		upgradeWebSocket,
+		upgradeAuthenticate,
+		report
 	}));
 	const verifyGoTrue = auth ? jwtVerifier(goTrueTokens({ auth })) : () => Promise.reject(unauthorized("This app signs no user tokens"));
 	app.route("/", supabaseFunctionRoutes({
@@ -296,7 +317,6 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	app.route("/", batchRoute(deps, authenticate, meta));
 	app.route("/", fileRoutes(deps, authenticate));
 	if (forms) app.route(`${systemPath}/forms`, formRoutes(deps, forms));
-	const report = options.onUnhandledError ?? ((error) => console.error(error));
 	const feed = tableFeed({
 		db,
 		schema: changes,

package/dist/deps.d.ts

@@ -1,6 +1,7 @@
 import "./types.js";
 import "./comments/comment-users.js";
 import "./comments/mention-job.js";
+import "./encryption/runtime.js";
 import "./files/runtime.js";
 import "./plugins/plugin-settings.js";
 import "./registry.js";

package/dist/encryption/apply.d.ts

@@ -0,0 +1,40 @@
+import "../registry.js";
+import { CascadingKey } from "./cascading-keys.js";
+import { UnreadableEntry } from "./status.js";
+import { Db } from "@protobase/query";
+//#region src/encryption/apply.d.ts
+/** Values sealed under another table (as `.table()` wrote it) or column, before a rename: of one field, or every one of the resource. */
+export type RebindOption = {
+  resource: string;
+  field?: string;
+  from: {
+    table?: string;
+    column?: string;
+  };
+};
+export type ApplyOptions = {
+  rebind?: RebindOption;
+};
+/** What `apply` did to one encrypted field. */
+export type FieldApplied = {
+  resource: string;
+  field: string;
+  /** Plaintext values it encrypted. */
+  encrypted: number;
+  /** Values under a previous key it encrypted with the current one. */
+  reencrypted: number;
+  /** Values that opened only where they were before a rename, sealed again where they are now. */
+  rebound: number;
+  /** Values a write changed while it ran, which it left alone. */
+  skipped: number;
+  unreadable: UnreadableEntry[];
+  /** History rows and undispatched changes it removed the field's old values from. */
+  historyScrubbed: number;
+  outboxScrubbed: number;
+};
+export type ApplyResult = {
+  kid: string;
+  fields: FieldApplied[];
+  warnings: CascadingKey[];
+};
+//#endregion