@protobase/server 0.33.3 → 0.34.0

package/dist/encryption/status.js

@@ -0,0 +1,92 @@
+import { bindingOf } from "./binding.js";
+import { envelopePrefix } from "./envelope-seal.js";
+import { columnId, tableId } from "../sql-parts.js";
+import { UnreadableValue, openText } from "./envelope-open.js";
+import { cascadingKeys } from "./cascading-keys.js";
+import { historyRemnants, outboxRemnants } from "./remnants.js";
+import { scanColumn } from "./scan.js";
+import { sql } from "kysely";
+//#region src/encryption/status.ts
+const encryptedFields = (entry) => Object.values(entry.model.fields).filter((field) => field.encrypted);
+/** Opens one scanned value: its plaintext and key id, or why it does not open. A value that is no envelope is plaintext. */
+const examine = (keyring, entry, field, row, binding = bindingOf(entry.model, field, row.record)) => {
+	if (!row.stored.startsWith("pbenc:")) return { kind: "plaintext" };
+	try {
+		return {
+			kind: "open",
+			plaintext: openText(keyring, binding, row.stored, {
+				resource: entry.name,
+				field: field.name
+			}),
+			kid: row.stored.split(":")[2]
+		};
+	} catch (error) {
+		if (!(error instanceof UnreadableValue)) throw error;
+		return {
+			kind: "unreadable",
+			entry: {
+				key: entry.model.primaryKey.map((name) => String(row.record[name])),
+				...error.kid && { kid: error.kid },
+				kind: error.kind
+			}
+		};
+	}
+};
+const fieldStatus = async (db, entry, field, keyring, changesSchema) => {
+	const status = {
+		resource: entry.name,
+		field: field.name,
+		byKey: {},
+		plaintext: 0,
+		unreadable: [],
+		history: 0,
+		outbox: 0
+	};
+	await scanColumn(db, entry, field, async (rows) => {
+		for (const row of rows) {
+			const found = examine(keyring, entry, field, row);
+			if (found.kind === "plaintext") status.plaintext++;
+			else if (found.kind === "open") status.byKey[found.kid] = (status.byKey[found.kid] ?? 0) + 1;
+			else status.unreadable.push(found.entry);
+		}
+	});
+	status.history = await historyRemnants(db, changesSchema, entry.model, field);
+	status.outbox = await outboxRemnants(db, changesSchema, entry.model, field);
+	return status;
+};
+const strayValues = async (db, entry) => {
+	const fields = Object.values(entry.model.fields).filter((field) => field.type === "text" && !field.encrypted);
+	const stray = [];
+	for (const field of fields) {
+		const { rows } = await sql`select count(*)::text as count from ${tableId(entry.model)} where ${columnId(field)} like ${`${envelopePrefix}%`}`.execute(db);
+		const count = Number(rows[0].count);
+		if (count > 0) stray.push({
+			resource: entry.name,
+			field: field.name,
+			count
+		});
+	}
+	return stray;
+};
+/**
+* Per encrypted field: the values by key, the plaintext ones, those that do not open, and the old plaintext left in the
+* history and the outbox; envelopes in fields that are not encrypted; foreign keys that rewrite a key. It writes nothing.
+*/
+const encryptionStatus = async (db, entries, keyring, changesSchema) => {
+	const fields = [];
+	const stray = [];
+	const cascading = [];
+	for (const entry of entries) {
+		for (const field of encryptedFields(entry)) fields.push(await fieldStatus(db, entry, field, keyring, changesSchema));
+		stray.push(...await strayValues(db, entry));
+		if (encryptedFields(entry).length > 0) cascading.push(...await cascadingKeys(db, entry.model));
+	}
+	return {
+		kid: keyring.current.id,
+		fields,
+		stray,
+		cascading
+	};
+};
+//#endregion
+export { encryptedFields, encryptionStatus, examine };

package/dist/encryption/stored-value.js

@@ -0,0 +1,16 @@
+import { Sealed } from "./envelope-seal.js";
+//#region src/encryption/stored-value.ts
+/**
+* The value a record write sends for `field`: JSON as text, and for an encrypted field only `null` or a value `sealValues`
+* sealed, so no write path stores plaintext in it.
+*/
+const storedValue = (field, value) => {
+	if (field.encrypted) {
+		if (value === null) return null;
+		if (value instanceof Sealed) return Sealed.textOf(value);
+		throw new Error(`"${field.name}" is encrypted, and its value was not sealed`);
+	}
+	return field.type === "json" && value !== null ? JSON.stringify(value) : value;
+};
+//#endregion
+export { storedValue };

package/dist/encryption/tools.d.ts

@@ -0,0 +1,26 @@
+import { EventsOptions } from "../changes/events-options.js";
+import { ResourceSource } from "../resource-source.js";
+import { EncryptionStatus } from "./status.js";
+import { ApplyOptions, ApplyResult } from "./apply.js";
+import { Db } from "@protobase/query";
+//#region src/encryption/tools.d.ts
+export type EncryptionToolsInput = {
+  resources: ResourceSource[];
+  db: Db;
+  events?: EventsOptions;
+  env: Record<string, string | undefined>;
+};
+/**
+ * What `protobase encryption status` and `apply` run on a project: `undefined` when it has no encrypted fields. It fails
+ * on the same config and key problems as the server's startup. `kid` is the id of the current key.
+ */
+export declare const createEncryptionTools: ({ resources, db, events, env }: EncryptionToolsInput) => {
+  kid: string;
+  /** What every encrypted field's column holds, and what remains of its plaintext; it writes nothing. */
+  status: () => Promise<EncryptionStatus>;
+  /** Encrypts the plaintext, moves previous keys' values to the current one, rebinds renamed ones, and scrubs remnants. */
+  apply: (options?: ApplyOptions) => Promise<ApplyResult>;
+} | undefined;
+/** The tools of a project with encrypted fields. */
+export type EncryptionTools = NonNullable<ReturnType<typeof createEncryptionTools>>;
+//#endregion

package/dist/encryption/tools.js

@@ -0,0 +1,34 @@
+import { changesSchema } from "../changes/events-options.js";
+import { createEncryptionRuntime } from "./runtime.js";
+import { buildRegistry } from "../registry.js";
+import { encryptionStatus } from "./status.js";
+import { applyEncryption } from "./apply.js";
+import { rebindProblem } from "./rebind-check.js";
+//#region src/encryption/tools.ts
+/**
+* What `protobase encryption status` and `apply` run on a project: `undefined` when it has no encrypted fields. It fails
+* on the same config and key problems as the server's startup. `kid` is the id of the current key.
+*/
+const createEncryptionTools = ({ resources, db, events, env }) => {
+	const { entries } = buildRegistry(resources);
+	const runtime = createEncryptionRuntime({
+		models: entries.map((entry) => entry.model),
+		env
+	});
+	if (!runtime) return void 0;
+	const { keyring } = runtime;
+	const schema = changesSchema(events);
+	return {
+		kid: keyring.current.id,
+		/** What every encrypted field's column holds, and what remains of its plaintext; it writes nothing. */
+		status: () => encryptionStatus(db, entries, keyring, schema),
+		/** Encrypts the plaintext, moves previous keys' values to the current one, rebinds renamed ones, and scrubs remnants. */
+		apply: async (options = {}) => {
+			const problem = options.rebind && rebindProblem(entries, options.rebind);
+			if (problem) throw new Error(problem);
+			return applyEncryption(db, entries, keyring, schema, options);
+		}
+	};
+};
+//#endregion
+export { createEncryptionTools };

package/dist/forms/check-forms.js

@@ -20,7 +20,7 @@ const fieldErrors = (registry, { form, view }, granted) => {
 		const field = model.fields[name];
 		if (!field) return [`field "${name}" does not exist on ${view.resource}`];
 		if (field.readOnly) return [`field "${name}" is read-only, so nobody fills it in`];
-		if (field.sensitive) return [`field "${name}" is sensitive, and a public form does not take sensitive fields`];
+		if (field.sensitive && !field.encrypted) return [`field "${name}" is sensitive, and a public form takes only encrypted ones of them`];
 		if (field.type === "relation") return [`field "${name}" is a relation, whose records a visitor cannot read to pick one`];
 		if (field.type === "file") return [`field "${name}" is a file field, and a visitor cannot upload`];
 		if (!plainTypes.includes(field.type)) return [`field "${name}" is ${field.type}, which a form has no input for`];

package/dist/functions/accept-socket.js

@@ -0,0 +1,32 @@
+import { HttpProblem } from "../problem.js";
+import { socketEvents } from "./function-socket.js";
+//#region src/functions/accept-socket.ts
+const marker = "protobase-websocket";
+/**
+* One call's `acceptWebSocket` and what turns its answer into the upgrade. `accept` only records the events and returns
+* a marker response; `answer` upgrades once the function has returned it, so a caller that is refused, or a function
+* that throws, never gets a socket.
+*/
+const socketAcceptor = ({ c, upgradeWebSocket, report, recheck }) => {
+	let accepted;
+	const accept = (events) => {
+		if (c.req.header("upgrade")?.toLowerCase() !== "websocket") throw new HttpProblem(426, "upgrade-required", "Upgrade Required", "Open this function with a WebSocket", {}, { upgrade: "websocket" });
+		if (!upgradeWebSocket) throw new Error("This server does not accept WebSockets");
+		accepted = events;
+		return new Response(null, { headers: { [marker]: "accept" } });
+	};
+	const answer = (name, response) => {
+		if (!accepted) return response;
+		if (!response.headers.has(marker)) throw new Error(`The function "${name}" accepted a WebSocket but answered with another response`);
+		return upgradeWebSocket(c, socketEvents(accepted, {
+			report,
+			...recheck && { recheck }
+		}), { onError: report });
+	};
+	return {
+		accept,
+		answer
+	};
+};
+//#endregion
+export { socketAcceptor };

package/dist/functions/define-function.d.ts

@@ -1,5 +1,6 @@
 import { Session } from "../types.js";
 import { Caller } from "../api-keys/resolve-caller.js";
+import { SocketEvents } from "./function-socket.js";
 import { FunctionRecords } from "./records.js";
 import { Capability } from "@protobase/schema";
 import { Db } from "@protobase/query";
@@ -12,6 +13,12 @@ export type PublicFunctionContext = {
   db: Db;
   /** The caller, through the app's own `authenticate`: rejects with a 401 problem when the request carries no valid token. */
   caller: () => Promise<FunctionCaller>;
+  /**
+   * Answers a WebSocket upgrade with a socket: return its response. A request that is no upgrade is a 426 problem. A
+   * protected function's caller is checked again every minute while the socket is open, which closes with 1008 once
+   * they would be refused; a public function checks its own callers.
+   */
+  acceptWebSocket: (events: SocketEvents) => Response;
 };
 /** Who called a function, and the app's resources as them. */
 export type FunctionCaller = {

package/dist/functions/function-socket.d.ts

@@ -0,0 +1,18 @@
+import "hono/ws";
+//#region src/functions/function-socket.d.ts
+/** An open WebSocket as a function sees it. */
+export type FunctionSocket = {
+  /** Resolves once the data is written to the connection, or at once when the socket is closed; it never rejects. */
+  send(data: string | ArrayBuffer | Uint8Array): Promise<void>;
+  close(code?: number, reason?: string): void;
+  /** The bytes queued to send but not yet written. */
+  readonly bufferedAmount: number;
+};
+/** What a function's socket does: see `acceptWebSocket`. */
+export type SocketEvents = {
+  onOpen?: (socket: FunctionSocket) => void | Promise<void>;
+  /** Text arrives as a string, binary as an ArrayBuffer. The next message waits until a returned promise settles. */
+  onMessage?: (data: string | ArrayBuffer, socket: FunctionSocket) => void | Promise<void>;
+  onClose?: (code: number, reason: string) => void | Promise<void>;
+};
+//#endregion

package/dist/functions/function-socket.js

@@ -0,0 +1,81 @@
+import { recheckWhileOpen } from "./socket-recheck.js";
+//#region src/functions/function-socket.ts
+const openState = 1;
+/** Received bytes waiting for `onMessage` above which reading pauses. */
+const pauseAboveBytes = 1 << 20;
+/** Where reading cannot pause, the waiting bytes above which the socket closes with 1013 (Try Again Later). */
+const closeAboveBytes = 16 << 20;
+const sizeOf = (data) => typeof data === "string" ? data.length : data.byteLength;
+/**
+* A function's socket events as Hono's, over the host's raw socket. Messages reach `onMessage` one at a time, in order,
+* after `onOpen`, and `onClose` comes after the last of them. A handler that throws or rejects is reported and closes
+* the socket with 1011.
+*/
+const socketEvents = (events, { report, recheck }) => {
+	let raw;
+	let socket;
+	let chain = Promise.resolve();
+	let waiting = 0;
+	let paused = false;
+	let ended = false;
+	let stopRecheck = () => {};
+	const end = (code, reason) => {
+		ended = true;
+		stopRecheck();
+		raw.close(code, reason);
+	};
+	const fail = (error) => {
+		report(error);
+		if (!ended) end(1011, "Internal Error");
+	};
+	const enqueue = (step, always = false) => {
+		chain = chain.then(() => ended && !always ? void 0 : step()).catch(fail);
+	};
+	const received = (data) => {
+		const size = sizeOf(data);
+		waiting += size;
+		if (waiting > 1048576 && raw.pause && !paused) {
+			paused = true;
+			raw.pause();
+		}
+		if (waiting > 16777216 && !raw.pause && !ended) end(1013, "Try Again Later");
+		enqueue(async () => {
+			await events.onMessage?.(data, socket);
+			waiting -= size;
+			if (paused && waiting === 0) {
+				paused = false;
+				raw.resume?.();
+			}
+		});
+	};
+	return {
+		onOpen: (_event, ws) => {
+			raw = ws.raw;
+			socket = {
+				send: (data) => new Promise((resolve) => {
+					if (raw.readyState !== openState) return resolve();
+					raw.send(data, () => resolve());
+				}),
+				close: (code, reason) => raw.close(code, reason),
+				get bufferedAmount() {
+					return raw.bufferedAmount;
+				}
+			};
+			if (recheck) stopRecheck = recheckWhileOpen({
+				check: recheck,
+				close: end,
+				report
+			});
+			enqueue(() => events.onOpen?.(socket));
+		},
+		onMessage: (event) => {
+			if (typeof event.data === "string" || event.data instanceof ArrayBuffer) received(event.data);
+		},
+		onClose: (event) => {
+			stopRecheck();
+			enqueue(() => events.onClose?.(event.code, event.reason), true);
+		}
+	};
+};
+//#endregion
+export { closeAboveBytes, pauseAboveBytes, socketEvents };

package/dist/functions/routes.js

@@ -1,7 +1,9 @@
-import { notFound } from "../problem.js";
+import { forbidden, notFound } from "../problem.js";
 import { invokeFunction } from "./define-function.js";
 import { runInBackground } from "../background-work.js";
+import { socketAcceptor } from "./accept-socket.js";
 import { functionGate, requireGate } from "./function-gate.js";
+import { sameCaller } from "./same-caller.js";
 import { Hono } from "hono";
 import { cors } from "hono/cors";
 //#region src/functions/routes.ts
@@ -10,17 +12,21 @@ const relativeRequest = (request, prefix) => {
 	url.pathname = url.pathname.slice(prefix.length) || "/";
 	return new Request(url, request);
 };
+const isUpgrade = (request) => request.headers.get("upgrade")?.toLowerCase() === "websocket";
 /**
 * Every function at `<basePath>/<name>` and below, any method. A protected function authenticates the request first, so
 * a call without a valid token is the authenticator's 401 problem, and one its gate refuses a 403; a public one gets the caller only when it asks. Each
 * call runs as background work, so calls that hold the database for long leave a connection to page requests. Once a
 * call ends, failed or not, `wake` runs, so what it wrote reaches open pages without waiting for the dispatcher's poll.
+* A function may answer an upgrade with a socket, only once it returned; a protected one's caller is checked again
+* every minute while it is open.
 */
-const functionRoutes = ({ basePath, functions, authenticate, access, db, records, onError, wake }) => {
+const functionRoutes = ({ basePath, functions, authenticate, access, db, records, onError, wake, upgradeWebSocket, upgradeAuthenticate = authenticate, report }) => {
 	const app = new Hono().basePath(basePath);
 	app.onError(onError);
+	const sessionOf = (request) => isUpgrade(request) ? upgradeAuthenticate(request) : authenticate(request);
 	const callerOf = async (request) => {
-		const session = await authenticate(request);
+		const session = await sessionOf(request);
 		return {
 			session,
 			records: records(session)
@@ -36,21 +42,40 @@ const functionRoutes = ({ basePath, functions, authenticate, access, db, records
 			const request = relativeRequest(c.req.raw, prefix);
 			if (options.public) {
 				let caller;
-				return invokeFunction(name, fn, request, {
+				const acceptor = socketAcceptor({
+					c,
+					upgradeWebSocket,
+					report
+				});
+				const context = {
 					name,
 					db,
-					caller: () => caller ??= callerOf(c.req.raw)
-				});
+					caller: () => caller ??= callerOf(c.req.raw),
+					acceptWebSocket: acceptor.accept
+				};
+				return acceptor.answer(name, await invokeFunction(name, fn, request, context));
 			}
 			const caller = await callerOf(c.req.raw);
 			requireGate(name, gate, caller.session);
+			const recheck = async () => {
+				const again = await upgradeAuthenticate(c.req.raw);
+				requireGate(name, gate, again);
+				if (!sameCaller(caller.session, again)) throw forbidden("caller-changed", "Your access changed: open the socket again");
+			};
+			const acceptor = socketAcceptor({
+				c,
+				upgradeWebSocket,
+				report,
+				recheck
+			});
 			const context = {
 				name,
 				db,
 				...caller,
-				caller: async () => caller
+				caller: async () => caller,
+				acceptWebSocket: acceptor.accept
 			};
-			return invokeFunction(name, fn, request, context);
+			return acceptor.answer(name, await invokeFunction(name, fn, request, context));
 		})));
 	}
 	app.all("/*", (c) => {

package/dist/functions/same-caller.js

@@ -0,0 +1,9 @@
+//#region src/functions/same-caller.ts
+const sameRoles = (a, b) => {
+	const roles = new Set(a);
+	return roles.size === new Set(b).size && b.every((role) => roles.has(role));
+};
+/** Whether two resolutions of a caller give the same user, tenant, organization and roles, in any order. */
+const sameCaller = (a, b) => a.user.id === b.user.id && a.tenant === b.tenant && a.organization?.id === b.organization?.id && sameRoles(a.user.roles, b.user.roles);
+//#endregion
+export { sameCaller };

package/dist/functions/socket-recheck.js

@@ -0,0 +1,33 @@
+import { HttpProblem } from "../problem.js";
+//#region src/functions/socket-recheck.ts
+const isRefusal = (error) => error instanceof HttpProblem && (error.status === 401 || error.status === 403);
+/**
+* Runs `check` every `everyMs` while a socket is open, one check after the other. A refusal closes the socket with 1008
+* (Policy Violation) and the problem's title; any other error is reported and closes it with 1011, so an outage that
+* stops the check ends the access too. Returns the function that stops it.
+*/
+const recheckWhileOpen = ({ check, close, report, everyMs = 6e4 }) => {
+	let stopped = false;
+	let timer;
+	const end = (error) => {
+		if (stopped) return;
+		stopped = true;
+		if (isRefusal(error)) return close(1008, error.title);
+		report(error);
+		close(1011, "Internal Error");
+	};
+	const run = () => check().then(() => {
+		if (!stopped) schedule();
+	}, end);
+	const schedule = () => {
+		timer = setTimeout(run, everyMs);
+		timer.unref?.();
+	};
+	schedule();
+	return () => {
+		stopped = true;
+		clearTimeout(timer);
+	};
+};
+//#endregion
+export { recheckWhileOpen };

package/dist/functions/upgrade-caller.js

@@ -0,0 +1,25 @@
+import { forbidden } from "../problem.js";
+//#region src/functions/upgrade-caller.ts
+const hostOf = (url) => URL.canParse(url) ? new URL(url).host : void 0;
+const allowedOrigin = (request, origins) => {
+	const origin = request.headers.get("origin");
+	if (origin === null) return true;
+	if (origins) return origins.includes(origin);
+	const host = hostOf(origin);
+	return host !== void 0 && host === new URL(request.url).host;
+};
+/**
+* The caller of a WebSocket upgrade, which a browser opens with its session cookie and no headers of its own: refused
+* with 403 from a foreign origin (cross-site WebSocket hijacking), then by its bearer token when it has one, otherwise
+* by the bearer token its cookie's session mints, which goes through `authenticate` with all the request's other
+* headers, as a plain call would.
+*/
+const upgradeAuthenticator = ({ authenticate, origins, sessionToken }) => async (request) => {
+	if (!allowedOrigin(request, origins)) throw forbidden("foreign-origin", "This page’s origin may not open a socket to this app");
+	if (request.headers.has("authorization") || !request.headers.has("cookie") || !sessionToken) return authenticate(request);
+	const headers = new Headers(request.headers);
+	headers.set("authorization", `Bearer ${await sessionToken(request)}`);
+	return authenticate(new Request(request, { headers }));
+};
+//#endregion
+export { upgradeAuthenticator };

package/dist/gotrue/user-routes.js

@@ -1,6 +1,7 @@
 import { effectiveSignInPolicy } from "../better-auth/sign-in-policy.js";
 import { readSignInPolicy } from "../better-auth/policy-store.js";
 import { goTrueUser, userMetadata } from "./user-json.js";
+import { revokeMcpGrants } from "../better-auth/mcp/revoke-grants.js";
 import { checkNewAccountPassword } from "../better-auth/new-account-password.js";
 import { goTrueTokens } from "./access-tokens.js";
 import { GoTrueError } from "./errors.js";
@@ -22,6 +23,9 @@ const logoutScopes = [
 /**
 * The signed-in user's own endpoints, with their access token: `GET /user`, `PUT /user` for a new password or metadata,
 * and `POST /logout`. A token whose session has ended, by signing out or a ban, is GoTrue's `session_not_found`.
+* With MCP on, signing out everywhere or the other sessions, and setting a password, disconnect the user's MCP clients,
+* as the same steps do through Better Auth: GoTrue has no way to tell a password reset from a change, so every new
+* password does.
 */
 const userRoutes = ({ auth, context }) => {
 	const claimsOf = accessClaimsOf(goTrueTokens({ auth }));
@@ -61,6 +65,7 @@ const userRoutes = ({ auth, context }) => {
 			model: "session",
 			where
 		});
+		if (scope !== "local" && auth.mcp) await revokeMcpGrants(adapter, claims.sub);
 	};
 	return new Hono().get("/user", async (c) => c.json(await userJson(await signedIn(c.req.raw)))).put("/user", async (c) => {
 		const { email, password, data } = await readBody(c.req.raw, updateBody);
@@ -78,6 +83,7 @@ const userRoutes = ({ auth, context }) => {
 				accountId: user.id,
 				password: hash
 			});
+			if (auth.mcp) await revokeMcpGrants(ctx.adapter, user.id);
 		}
 		const merged = data && Object.fromEntries(Object.entries({
 			...userMetadata(user.metadata),

package/dist/index.d.ts

@@ -2,13 +2,13 @@ import { MobileConfig } from "./mobile-config.js";
 import { AppIdentity } from "./app-identity.js";
 import { AppIcons, PngIcon, pngIcons } from "./web-app/app-icons.js";
 import { StaffSignIn } from "./better-auth/staff-log.js";
+import { RoleDefinition, RolesInput } from "./better-auth/organizations/role-definitions.js";
 import { MailMessage, Mailer } from "./mail/smtp-mailer.js";
 import { OperatorProvider, readOperatorSettings } from "./better-auth/operator-provider.js";
-import { RoleDefinition, RolesInput } from "./better-auth/organizations/role-definitions.js";
 import { OrganizationRole, StoredMember, StoredOrganization } from "./better-auth/organizations/store.js";
+import { SignInPolicy, SignInRule, StaffAccessRule, defaultSignInPolicy, signInPolicyMethods } from "./better-auth/sign-in-policy.js";
 import { OrganizationsOptions } from "./better-auth/organizations/options.js";
 import { PlatformSignIn, readPlatformSignIn } from "./better-auth/platform-sign-in.js";
-import { SignInPolicy, SignInRule, StaffAccessRule, defaultSignInPolicy, signInPolicyMethods } from "./better-auth/sign-in-policy.js";
 import { EmailComponent, EmailOptions, EmailTemplate, RenderedEmail, defineEmail } from "./mail/define-email.js";
 import { AdminAuth, CreateAuthOptions, UserCreatedHook, createAuth, normalizeRoles } from "./better-auth/create-auth.js";
 import { EventsOptions } from "./changes/events-options.js";
@@ -24,6 +24,7 @@ import { FileProvider, FileStore, StoredObject } from "./files/store.js";
 import { FilesOptions } from "./files/options.js";
 import { ApiKeys, ApiKeysOptions, apiKeySettings, apiKeyVariables } from "./api-keys/api-key-settings.js";
 import { Caller, CallerOptions, apiKeyCaller } from "./api-keys/resolve-caller.js";
+import { FunctionSocket, SocketEvents } from "./functions/function-socket.js";
 import { ErrorReportingOptions, ErrorReportingSettings, errorReportingSettings, errorReportingVariable } from "./error-reporting/error-reporting-settings.js";
 import { ChatMessage, ChatTextPart, Completion, CompletionOptions, ModelError, ModelSettings, ReasoningDetail, ReasoningEffort, ToolCall, ToolSpec, streamChatCompletion } from "./assistant/chat-completions.js";
 import { CleanupEntry, CleanupSchedule, ScheduledDelete, storageCleanupSchedule } from "./files/cleanup-schedule.js";
@@ -53,11 +54,11 @@ import { consoleAuditQueue } from "./audit/console-queue.js";
 import { JwtOptions, JwtVerifyOptions, jwtAuthenticator, jwtVerifier } from "./auth/jwt.js";
 import { HttpProblem, MissingCredentials, badRequest, forbidden, notFound, unauthorized } from "./problem.js";
 import { TrustedApp, withTrustedApps } from "./better-auth/app-tokens.js";
-import { BetterAuthAuthenticatorOptions, betterAuthAuthenticator, betterAuthTokens } from "./better-auth/authenticator.js";
+import { BetterAuthAuthenticator, BetterAuthAuthenticatorOptions, betterAuthAuthenticator, betterAuthTokens } from "./better-auth/authenticator.js";
 import { parseRoles } from "./better-auth/parse-roles.js";
 import { LinkedAccount, NewUser, StoredUser, createUser, deleteUser, hasUsers, listUsers, roleChoices, setUserBanned, setUserRole } from "./better-auth/users.js";
 import { IssueTokenOptions, issueToken, maxTokenTtlSeconds } from "./better-auth/tokens.js";
-import { webauthnPath } from "./better-auth/origins.js";
+import { isOAuthWellKnownPath, oauthWellKnownPaths, webauthnPath } from "./better-auth/origins.js";
 import { goTruePath } from "./gotrue/keys.js";
 import { supabasePath } from "./supabase-paths.js";
 import { defaultAppName } from "./app-name.js";
@@ -96,6 +97,10 @@ import { S3Bucket, S3FilesOptions, S3ListPage, S3Object, s3FileStore, s3Files }
 import { storageProvider } from "./files/storage-provider.js";
 import { objectKey } from "./storage/object-key.js";
 import { FileCleanupInput, createFileCleanup } from "./files/file-cleanup.js";
+import { CascadingKey } from "./encryption/cascading-keys.js";
+import { EncryptionStatus, FieldStatus, StrayValues, UnreadableEntry } from "./encryption/status.js";
+import { ApplyOptions, ApplyResult, FieldApplied, RebindOption } from "./encryption/apply.js";
+import { EncryptionTools, EncryptionToolsInput, createEncryptionTools } from "./encryption/tools.js";
 import { FileObject, FileVariantObject } from "./files/present.js";
 import { FileRef, formatUri, variantPath } from "./files/uri.js";
 import { aspectRatio, fileSize, fileType, imageSize, processor } from "./files/processors.js";
@@ -105,4 +110,4 @@ import { isSchedule } from "./jobs/schedule.js";
 import { DrainResult, JobsRuntime, StartJobsOptions, startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
 import { checkJobsSchema, jobsSchema, jobsSchemaMigration } from "./jobs/schema.js";
-export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApiKeys, type ApiKeysOptions, type AppIcons, type AppIdentity, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticatorOptions, type Caller, type CallerOptions, type CapturedRow, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSource, type HistoryOptions, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type MemberInput, MissingCredentials, type MobileConfig, ModelError, type ModelSettings, type NewOrganization, type NewUser, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, backgroundSettled, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, goTruePath, handleDroppedConnections, hasUsers, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, objectKey, parseColumns, parseRoles, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, waitUntil, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };
+export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApiKeys, type ApiKeysOptions, type AppIcons, type AppIdentity, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type Caller, type CallerOptions, type CapturedRow, type CascadingKey, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryOptions, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type MemberInput, MissingCredentials, type MobileConfig, ModelError, type ModelSettings, type NewOrganization, type NewUser, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, backgroundSettled, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, goTruePath, handleDroppedConnections, hasUsers, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, waitUntil, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };

package/dist/index.js

@@ -17,7 +17,7 @@ import { requestApproval } from "./assistant/approval.js";
 import { withCacheBreakpoints } from "./assistant/cache-breakpoints.js";
 import { runTurn } from "./assistant/turn.js";
 import { consoleAuditQueue } from "./audit/console-queue.js";
-import { webauthnPath } from "./better-auth/origins.js";
+import { isOAuthWellKnownPath, oauthWellKnownPaths, webauthnPath } from "./better-auth/origins.js";
 import { apiKeySettings, apiKeyVariables } from "./api-keys/api-key-settings.js";
 import { apiKeyCaller } from "./api-keys/resolve-caller.js";
 import { jwtAuthenticator, jwtVerifier } from "./auth/jwt.js";
@@ -76,8 +76,9 @@ import { requireEnv } from "./functions/require-env.js";
 import { backgroundSettled, waitUntil } from "./functions/wait-until.js";
 import { storeFile } from "./files/store-file.js";
 import { createFileCleanup } from "./files/file-cleanup.js";
+import { createEncryptionTools } from "./encryption/tools.js";
 import { aspectRatio, fileSize, fileType, imageSize, processor } from "./files/processors.js";
 import { defineEmail } from "./mail/define-email.js";
 import { startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
-export { FatalJobError, HttpProblem, MissingCredentials, ModelError, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, backgroundSettled, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, goTruePath, handleDroppedConnections, hasUsers, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, objectKey, parseColumns, parseRoles, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, waitUntil, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };
+export { FatalJobError, HttpProblem, MissingCredentials, ModelError, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, backgroundSettled, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, goTruePath, handleDroppedConnections, hasUsers, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, waitUntil, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };