@protobase/server 0.33.4 → 0.34.0

package/dist/better-auth/mcp/signed-query-guard.js

@@ -0,0 +1,29 @@
+import { APIError, createAuthMiddleware } from "better-auth/api";
+//#region src/better-auth/mcp/signed-query-guard.ts
+const signedQueryPaths = [
+	"/oauth2/continue",
+	"/oauth2/consent",
+	"/oauth2/authorize"
+];
+/** Whether a request to `path` may carry a signed authorization query. */
+const isSignedQueryAllowed = (path) => path !== void 0 && signedQueryPaths.includes(path);
+const hasSignedQuery = (body) => typeof body === "object" && body !== null && "oauth_query" in body;
+/**
+* Refuses a signed authorization query on any other request (`400 OAUTH_QUERY_REFUSED`), so a sign-in by password,
+* emailed code, passkey, two-factor or provider never resumes an authorization on its own: the person goes on from
+* the connect page, which shows what they allow. Runs before the provider's own hook.
+*/
+const mcpSignedQueryGuard = () => ({
+	id: "protobase-mcp-signed-query-guard",
+	hooks: { before: [{
+		matcher: (context) => hasSignedQuery(context.body) && !isSignedQueryAllowed(context.path),
+		handler: createAuthMiddleware(async () => {
+			throw new APIError("BAD_REQUEST", {
+				code: "OAUTH_QUERY_REFUSED",
+				message: "Sign in first, then continue from the connect page."
+			});
+		})
+	}] }
+});
+//#endregion
+export { isSignedQueryAllowed, mcpSignedQueryGuard };

package/dist/better-auth/origins.d.ts

@@ -1,4 +1,11 @@
 //#region src/better-auth/origins.d.ts
 /** Where browsers read which origins may use the app's passkeys (WebAuthn Related Origin Requests). */
 export declare const webauthnPath = "/.well-known/webauthn";
+/**
+ * Where MCP clients discover how to sign in: the OAuth authorization server's metadata, and the protected resource's
+ * (also below it, at the resource's path). Every bundle sends them to the API, which answers them with MCP on.
+ */
+export declare const oauthWellKnownPaths: string[];
+/** Whether `path` is one of `oauthWellKnownPaths` or below one. */
+export declare const isOAuthWellKnownPath: (path: string) => boolean;
 //#endregion

package/dist/better-auth/origins.js

@@ -44,5 +44,12 @@ const multiHostBaseURL = (baseURL, origins) => {
 };
 /** Where browsers read which origins may use the app's passkeys (WebAuthn Related Origin Requests). */
 const webauthnPath = "/.well-known/webauthn";
+/**
+* Where MCP clients discover how to sign in: the OAuth authorization server's metadata, and the protected resource's
+* (also below it, at the resource's path). Every bundle sends them to the API, which answers them with MCP on.
+*/
+const oauthWellKnownPaths = ["/.well-known/oauth-authorization-server", "/.well-known/oauth-protected-resource"];
+/** Whether `path` is one of `oauthWellKnownPaths` or below one. */
+const isOAuthWellKnownPath = (path) => oauthWellKnownPaths.some((prefix) => path === prefix || path.startsWith(`${prefix}/`));
 //#endregion
-export { appOrigins, multiHostBaseURL, originsVariable, readList, readOrigins, resolveOrigins, webauthnPath };
+export { appOrigins, isOAuthWellKnownPath, multiHostBaseURL, oauthWellKnownPaths, originsVariable, readList, readOrigins, resolveOrigins, webauthnPath };

package/dist/better-auth/password-reset.js

@@ -5,15 +5,16 @@ const resetLinkLifetimeSeconds = 3600;
 const resetLinkLifetime = "1 hour";
 /**
 * Better Auth's own password reset, sending the link with `mail`. Resetting ends the user's sessions, so a reset
-* after a leaked password also signs out whoever used it.
+* after a leaked password also signs out whoever used it, and `onPasswordReset` disconnects the user's MCP clients.
 */
-const passwordResetOptions = (mail) => ({
+const passwordResetOptions = (mail, { onPasswordReset } = {}) => ({
 	resetPasswordTokenExpiresIn: resetLinkLifetimeSeconds,
 	revokeSessionsOnPasswordReset: true,
 	sendResetPassword: ({ user, url }) => sendAuthEmail(mail, "resetPasswordEmail", user.email, {
 		url,
 		lifetime: resetLinkLifetime
-	}, url)
+	}, url),
+	...onPasswordReset && { onPasswordReset }
 });
 //#endregion
 export { passwordResetOptions, resetLinkLifetimeSeconds };

package/dist/better-auth/policy-plugin.js

@@ -1,35 +1,12 @@
 import { effectiveSignInPolicy, missingRequiredMethods, parseSignInPolicy, signInPolicyProblem } from "./sign-in-policy.js";
 import { readSignInPolicy, saveSignInPolicy, signInPolicySchema } from "./policy-store.js";
 import { isPoliced, lastPasskeyRequired, policyRefusal, setupRequired } from "./sign-in-enforcement.js";
+import { accountMethods } from "./sign-in-setup.js";
 import { adminOnly } from "./admin-only.js";
 import { isStaffSession } from "./staff-checks.js";
 import * as z$1 from "zod";
 import { APIError, createAuthEndpoint, createAuthMiddleware, getSessionFromCtx, sessionMiddleware } from "better-auth/api";
 //#region src/better-auth/policy-plugin.ts
-const accountMethods = async (context, user, socialProviders) => {
-	const accounts = await context.internalAdapter.findAccounts(user.id);
-	const passkeys = await context.adapter.count({
-		model: "passkey",
-		where: [{
-			field: "userId",
-			value: user.id
-		}]
-	});
-	const app = await context.adapter.findOne({
-		model: "twoFactor",
-		where: [{
-			field: "userId",
-			value: user.id
-		}]
-	});
-	return {
-		password: accounts.some((account) => account.providerId === "credential"),
-		passkeys,
-		twoFactor: Boolean(user.twoFactorEnabled),
-		authenticatorApp: Boolean(user.twoFactorEnabled) && app !== null && app.verified !== false,
-		socialSignIn: accounts.some((account) => socialProviders.includes(account.providerId))
-	};
-};
 const refuse = (status, refusal) => new APIError(status, refusal);
 const currentPolicy = async (context, { mail, defaultPolicy }) => effectiveSignInPolicy((await readSignInPolicy(context.adapter, defaultPolicy)).policy, { mail });
 const providersUnder = (policy, { socialProviders, platformSignIn }) => [...socialProviders, ...platformSignIn && policy.platformSignIn === "allowed" ? [platformSignIn.provider] : []];

package/dist/better-auth/sign-in-enforcement.js

@@ -65,9 +65,14 @@ const setupRequired = {
 	code: "SIGN_IN_SETUP_REQUIRED",
 	message: "Set up what this app requires for signing in first."
 };
+/** The answer to someone whose address is not verified who asks to allow an app (an MCP client) to act as them. */
+const addressNotVerified = {
+	code: "ADDRESS_NOT_VERIFIED",
+	message: "Confirm your address first: sign out, then sign in with a code emailed to you."
+};
 const lastPasskeyRequired = {
 	code: "PASSKEY_REQUIRED",
 	message: "Passkeys are required for every account, so the last one cannot be removed."
 };
 //#endregion
-export { isPoliced, lastPasskeyRequired, policyRefusal, setupRequired, staffSignInPath };
+export { addressNotVerified, isPoliced, lastPasskeyRequired, policyRefusal, setupRequired, staffSignInPath };

package/dist/better-auth/sign-in-setup.js

@@ -0,0 +1,38 @@
+import { effectiveSignInPolicy, missingRequiredMethods } from "./sign-in-policy.js";
+import { readSignInPolicy } from "./policy-store.js";
+//#region src/better-auth/sign-in-setup.ts
+/** What `user`'s account can sign in with and has set up; `socialProviders` are the provider ids that count as social sign-in. */
+const accountMethods = async (context, user, socialProviders) => {
+	const accounts = await context.internalAdapter.findAccounts(user.id);
+	const passkeys = await context.adapter.count({
+		model: "passkey",
+		where: [{
+			field: "userId",
+			value: user.id
+		}]
+	});
+	const app = await context.adapter.findOne({
+		model: "twoFactor",
+		where: [{
+			field: "userId",
+			value: user.id
+		}]
+	});
+	return {
+		password: accounts.some((account) => account.providerId === "credential"),
+		passkeys,
+		twoFactor: Boolean(user.twoFactorEnabled),
+		authenticatorApp: Boolean(user.twoFactorEnabled) && app !== null && app.verified !== false,
+		socialSignIn: accounts.some((account) => socialProviders.includes(account.providerId))
+	};
+};
+/**
+* The methods the sign-in policy requires that `user` has not set up yet; empty when nothing is missing. `defaultPolicy`
+* applies until an admin saves one.
+*/
+const missingSetup = async (context, user, { mail, defaultPolicy }) => {
+	const policy = effectiveSignInPolicy((await readSignInPolicy(context.adapter, defaultPolicy)).policy, { mail });
+	return missingRequiredMethods(policy, await accountMethods(context, user, []));
+};
+//#endregion
+export { accountMethods, missingSetup };

package/dist/better-auth/snake-case-names.js

@@ -61,7 +61,108 @@ const pluginNames = {
 		deviceType: "device_type",
 		backedUp: "backed_up",
 		createdAt: "created_at"
-	} } }
+	} } },
+	mcp: {
+		oauthClient: {
+			modelName: "oauth_client",
+			fields: {
+				clientId: "client_id",
+				clientSecret: "client_secret",
+				clientDiscoveryId: "client_discovery_id",
+				skipConsent: "skip_consent",
+				enableEndSession: "enable_end_session",
+				subjectType: "subject_type",
+				clientCredentialsScopes: "client_credentials_scopes",
+				userId: "user_id",
+				createdAt: "created_at",
+				updatedAt: "updated_at",
+				softwareId: "software_id",
+				softwareVersion: "software_version",
+				softwareStatement: "software_statement",
+				redirectUris: "redirect_uris",
+				postLogoutRedirectUris: "post_logout_redirect_uris",
+				backchannelLogoutUri: "backchannel_logout_uri",
+				backchannelLogoutSessionRequired: "backchannel_logout_session_required",
+				tokenEndpointAuthMethod: "token_endpoint_auth_method",
+				applicationType: "application_type",
+				jwksUri: "jwks_uri",
+				grantTypes: "grant_types",
+				responseTypes: "response_types",
+				requirePKCE: "require_pkce",
+				dpopBoundAccessTokens: "dpop_bound_access_tokens",
+				referenceId: "reference_id"
+			}
+		},
+		oauthResource: {
+			modelName: "oauth_resource",
+			fields: {
+				accessTokenTtl: "access_token_ttl",
+				refreshTokenTtl: "refresh_token_ttl",
+				signingAlgorithm: "signing_algorithm",
+				signingKeyId: "signing_key_id",
+				allowedScopes: "allowed_scopes",
+				customClaims: "custom_claims",
+				dpopBoundAccessTokensRequired: "dpop_bound_access_tokens_required",
+				createdAt: "created_at",
+				updatedAt: "updated_at",
+				policyVersion: "policy_version"
+			}
+		},
+		oauthClientResource: {
+			modelName: "oauth_client_resource",
+			fields: {
+				clientId: "client_id",
+				resourceId: "resource_id",
+				createdAt: "created_at"
+			}
+		},
+		oauthRefreshToken: {
+			modelName: "oauth_refresh_token",
+			fields: {
+				clientId: "client_id",
+				sessionId: "session_id",
+				userId: "user_id",
+				referenceId: "reference_id",
+				authorizationCodeId: "authorization_code_id",
+				requestedUserInfoClaims: "requested_user_info_claims",
+				expiresAt: "expires_at",
+				createdAt: "created_at",
+				rotatedAt: "rotated_at",
+				rotationReplayResponse: "rotation_replay_response",
+				rotationReplayExpiresAt: "rotation_replay_expires_at",
+				authTime: "auth_time"
+			}
+		},
+		oauthAccessToken: {
+			modelName: "oauth_access_token",
+			fields: {
+				clientId: "client_id",
+				sessionId: "session_id",
+				userId: "user_id",
+				referenceId: "reference_id",
+				authorizationCodeId: "authorization_code_id",
+				requestedUserInfoClaims: "requested_user_info_claims",
+				refreshId: "refresh_id",
+				expiresAt: "expires_at",
+				createdAt: "created_at"
+			}
+		},
+		oauthConsent: {
+			modelName: "oauth_consent",
+			fields: {
+				clientId: "client_id",
+				userId: "user_id",
+				referenceId: "reference_id",
+				requestedUserInfoClaims: "requested_user_info_claims",
+				createdAt: "created_at",
+				updatedAt: "updated_at"
+			}
+		},
+		oauthClientAssertion: {
+			modelName: "oauth_client_assertion",
+			fields: { expiresAt: "expires_at" }
+		}
+	}
 };
 //#endregion
 export { coreNames, pluginNames };

package/dist/better-auth/staff-checks.js

@@ -55,7 +55,8 @@ const accountChanges = [
 	"/invitation/accept",
 	"/organization/leave",
 	"/organization/transfer-ownership",
-	"/organization/delete"
+	"/organization/delete",
+	"/account/connected-apps/disconnect"
 ];
 const staffCannotChange = {
 	code: "STAFF_CANNOT_CHANGE_SIGN_IN",
@@ -63,7 +64,13 @@ const staffCannotChange = {
 };
 /** Whether a staff session's request to `path` is refused: changes to the person's sign-in, and saving the sign-in policy. */
 const isRefusedForStaff = (path, method) => accountChanges.includes(path) || path === "/policy/sign-in" && method === "POST";
+const staffCannotConnect = {
+	code: "STAFF_CANNOT_CONNECT",
+	message: "Staff cannot allow apps to act for a person."
+};
+/** Whether `path` is one of the OAuth provider's, through which an outside app (an MCP client) is allowed to act as someone. */
+const isOAuthPath = (path) => path.startsWith("/oauth2/");
 /** Whether a Better Auth session is one staff started as someone: the admin plugin's `impersonatedBy` names the staff member. */
 const isStaffSession = (session) => Boolean(session.impersonatedBy);
 //#endregion
-export { isRefusedForStaff, isStaffSession, isStrongSignIn, permissionMissing, reasonProblem, signInNotStrong, signInStale, staffCannotChange, staffClaimsRefusal, staffLabel };
+export { isOAuthPath, isRefusedForStaff, isStaffSession, isStrongSignIn, permissionMissing, reasonProblem, signInNotStrong, signInStale, staffCannotChange, staffCannotConnect, staffClaimsRefusal, staffLabel };

package/dist/better-auth/staff-plugin.js

@@ -1,5 +1,5 @@
 import { adminOnly } from "./admin-only.js";
-import { isRefusedForStaff, isStaffSession, staffCannotChange } from "./staff-checks.js";
+import { isOAuthPath, isRefusedForStaff, isStaffSession, staffCannotChange, staffCannotConnect } from "./staff-checks.js";
 import { endStaffSignIn, listStaffSignIns, staffSignInOfSession, staffSignInSchema } from "./staff-log.js";
 import { staffSignInEndpoints } from "./staff-sign-in-endpoints.js";
 import { APIError, createAuthEndpoint, createAuthMiddleware, getSessionFromCtx, sessionMiddleware } from "better-auth/api";
@@ -7,7 +7,8 @@ import { deleteSessionCookie } from "better-auth/cookies";
 //#region src/better-auth/staff-plugin.ts
 /**
 * Staff of the operator sign in as a person of this app, for support (see `staffSignInEndpoints`). A staff session
-* shows who started it and why, can be stopped, and cannot change the person's sign-in or the sign-in policy. Every
+* shows who started it and why, can be stopped, and cannot change the person's sign-in or the sign-in policy, or allow
+* an outside app to act as the person. Every
 * staff sign-in is logged for the app's admins. The plugin is there without an operator provider too, so its table
 * exists from the first auth migration.
 */
@@ -56,6 +57,12 @@ const staffSignInPlugin = ({ operator, mail, defaultPolicy }) => ({
 			const session = await getSessionFromCtx(ctx);
 			if (session && isStaffSession(session.session)) throw new APIError("FORBIDDEN", staffCannotChange);
 		})
+	}, {
+		matcher: (context) => context.path !== void 0 && isOAuthPath(context.path),
+		handler: createAuthMiddleware(async (ctx) => {
+			const session = await getSessionFromCtx(ctx);
+			if (session && isStaffSession(session.session)) throw new APIError("FORBIDDEN", staffCannotConnect);
+		})
 	}] }
 });
 //#endregion

package/dist/better-auth/status-route.js

@@ -14,7 +14,7 @@ import { Hono } from "hono";
 * operator provider's name, when staff can sign in as people; `passkeyDomains`, when people have passkeys for more than
 * one of the app's hosts, the RP IDs a passkey sign-in can ask for, the passkey domain first; with organizations, who may create them and the roles
 * with their labels, `membership` for those a member can hold, and the roles each one's holders may also give; and
-* `anonymous` when the project's anonymous role reads a resource, so the admin app opens for visitors before anyone signs in; and
+* `anonymous` when the project's anonymous role reads a resource, so the admin app opens for visitors before anyone signs in; `mcp` when MCP clients can connect, so the account page lists the connected ones; and
 * `plugins`, those the app loads before sign-in (see `PluginOption`); and `locale`, the language `options.locale` puts
 * the screens in, so the sign-in screens and public forms, which come before `/meta`, are in it too.
 */
@@ -44,6 +44,7 @@ const statusRoute = (auth, { anonymous = false, plugins = [], locale } = {}) =>
 			...staffSignIn && { staffSignIn },
 			...passkeyDomains.length > 1 && { passkeyDomains },
 			...anonymous && { anonymous },
+			...auth.mcp && { mcp: true },
 			...plugins.length > 0 && { plugins },
 			...locale && { locale },
 			...auth.organizations && { organizations: {

package/dist/better-auth/token-claims.js

@@ -0,0 +1,19 @@
+import { narrowClaims } from "./roles/active-role.js";
+import { organizationClaims } from "./organizations/session-organization.js";
+//#region src/better-auth/token-claims.ts
+/**
+* The claims of a token for `user`: the address and the role claims narrowed to one role; with organizations also the
+* claims of `organizationId` while they may work in it (see `organizationClaims`).
+*/
+const tokenClaims = async (user, { wanted, organizationId, organizations }) => {
+	const claims = {
+		role: user.role,
+		...organizations && await organizationClaims(organizations, user, organizationId)
+	};
+	return {
+		email: user.email,
+		...narrowClaims(claims, wanted, Boolean(organizations))
+	};
+};
+//#endregion
+export { tokenClaims };

package/dist/better-auth/users.d.ts

@@ -52,7 +52,10 @@ export declare const setUserRole: (auth: AdminAuth, input: {
   email: string;
   role: string;
 }>;
-/** Disables or re-enables sign-in. Banning ends the user's sessions; the last active admin cannot be banned. */
+/**
+ * Disables or re-enables sign-in. Banning ends the user's sessions and, with MCP on, disconnects their MCP clients and
+ * forgets them, so re-enabling brings none back: each has to be allowed again. The last active admin cannot be banned.
+ */
 export declare const setUserBanned: (auth: AdminAuth, input: {
   email: string;
   banned: boolean;

package/dist/better-auth/users.js

@@ -1,5 +1,6 @@
 import { parseRoles } from "./parse-roles.js";
 import { isActiveAdmin } from "./last-admin.js";
+import { revokeMcpGrants } from "./mcp/revoke-grants.js";
 import { ownOrganizationsWithoutMembers } from "./organizations/host.js";
 //#region src/better-auth/users.ts
 /** The roles this auth instance allows, `admin` first. */
@@ -98,7 +99,10 @@ const setUserRole = async (auth, input) => {
 		role: wanted.join(",")
 	};
 };
-/** Disables or re-enables sign-in. Banning ends the user's sessions; the last active admin cannot be banned. */
+/**
+* Disables or re-enables sign-in. Banning ends the user's sessions and, with MCP on, disconnects their MCP clients and
+* forgets them, so re-enabling brings none back: each has to be allowed again. The last active admin cannot be banned.
+*/
 const setUserBanned = async (auth, input) => {
 	const user = await findUser(auth, input.email);
 	const { internalAdapter } = await auth.$context;
@@ -117,6 +121,7 @@ const setUserBanned = async (auth, input) => {
 		banExpires: null
 	});
 	await internalAdapter.deleteUserSessions(user.id);
+	if (auth.mcp) await revokeMcpGrants((await auth.$context).adapter, user.id);
 };
 //#endregion
 export { createUser, deleteUser, hasUsers, listUsers, parseRoles, roleChoices, setUserBanned, setUserRole };

package/dist/check-roles.js

@@ -18,7 +18,7 @@ const checkRoleLimits = (registry, limits) => {
 			...model,
 			fields: Object.fromEntries(Object.entries(model.fields).map(([field, value]) => [field, {
 				...value,
-				filterable: true
+				filterable: !value.encrypted
 			}]))
 		};
 		const checked = checkFilter(trusted, filter);

package/dist/create-admin.js

@@ -22,6 +22,7 @@ import { readAppName } from "./app-name.js";
 import { realtimePath, restPath, storagePath, supabaseFunctionsPath, supabasePath } from "./supabase-paths.js";
 import { goTruePath } from "./gotrue/keys.js";
 import { authBasePath } from "./better-auth/auth-base-path.js";
+import { mcpDiscovery } from "./better-auth/mcp/discovery-routes.js";
 import { withoutSessionTokens } from "./better-auth/without-session-tokens.js";
 import { organizationRoutes } from "./better-auth/organizations/admin-routes.js";
 import { statusRoute } from "./better-auth/status-route.js";
@@ -57,6 +58,7 @@ import { createFilesRuntime } from "./files/runtime.js";
 import { fileRoutes } from "./files/routes.js";
 import { formRoutes } from "./forms/routes.js";
 import { createFormsRuntime } from "./forms/runtime.js";
+import { createEncryptionRuntime } from "./encryption/runtime.js";
 import { functionRoutes } from "./functions/routes.js";
 import { supabaseFunctionRoutes } from "./functions/supabase-routes.js";
 import { upgradeAuthenticator } from "./functions/upgrade-caller.js";
@@ -146,6 +148,10 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	});
 	const apiKeys = apiKeySettings(options.apiKeys, globalThis.process?.env ?? {});
 	const servesKeys = Boolean(apiKeys.publishable || apiKeys.secret);
+	const encryption = createEncryptionRuntime({
+		models: registry.entries.map((entry) => entry.model),
+		env: globalThis.process?.env ?? {}
+	});
 	const files = createFilesRuntime({
 		...filesOptions && { options: filesOptions },
 		env: globalThis.process?.env ?? {},
@@ -187,6 +193,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 		plugins,
 		sources,
 		...files && { files },
+		...encryption && { encryption },
 		...appModels.some(isCaptured) && { actorSetting: `${changes}.actor` },
 		...withHistory && { history: {
 			schema: changes,
@@ -256,6 +263,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 			registry,
 			db
 		}));
+		if (auth.mcp) mcpDiscovery(app, auth);
 		app.on(["GET", "POST"], `${authBasePath}/*`, async (c) => withoutSessionTokens(c.req.raw, await auth.handler(c.req.raw)));
 		app.route(goTruePath, goTrueRoutes(auth));
 		if (auth.origins.length > 1) app.get(webauthnPath, (c) => c.json({ origins: auth.origins }));

package/dist/deps.d.ts

@@ -1,6 +1,7 @@
 import "./types.js";
 import "./comments/comment-users.js";
 import "./comments/mention-job.js";
+import "./encryption/runtime.js";
 import "./files/runtime.js";
 import "./plugins/plugin-settings.js";
 import "./registry.js";

package/dist/encryption/apply.d.ts

@@ -0,0 +1,40 @@
+import "../registry.js";
+import { CascadingKey } from "./cascading-keys.js";
+import { UnreadableEntry } from "./status.js";
+import { Db } from "@protobase/query";
+//#region src/encryption/apply.d.ts
+/** Values sealed under another table (as `.table()` wrote it) or column, before a rename: of one field, or every one of the resource. */
+export type RebindOption = {
+  resource: string;
+  field?: string;
+  from: {
+    table?: string;
+    column?: string;
+  };
+};
+export type ApplyOptions = {
+  rebind?: RebindOption;
+};
+/** What `apply` did to one encrypted field. */
+export type FieldApplied = {
+  resource: string;
+  field: string;
+  /** Plaintext values it encrypted. */
+  encrypted: number;
+  /** Values under a previous key it encrypted with the current one. */
+  reencrypted: number;
+  /** Values that opened only where they were before a rename, sealed again where they are now. */
+  rebound: number;
+  /** Values a write changed while it ran, which it left alone. */
+  skipped: number;
+  unreadable: UnreadableEntry[];
+  /** History rows and undispatched changes it removed the field's old values from. */
+  historyScrubbed: number;
+  outboxScrubbed: number;
+};
+export type ApplyResult = {
+  kid: string;
+  fields: FieldApplied[];
+  warnings: CascadingKey[];
+};
+//#endregion

package/dist/encryption/apply.js

@@ -0,0 +1,99 @@
+import { bindingOf, movedBinding } from "./binding.js";
+import { Sealed, sealText } from "./envelope-seal.js";
+import { columnId, tableId } from "../sql-parts.js";
+import { cascadingKeys } from "./cascading-keys.js";
+import { captureOff } from "./capture-off.js";
+import { scrubHistory, scrubOutbox } from "./remnants.js";
+import { scanColumn } from "./scan.js";
+import { encryptedFields, examine } from "./status.js";
+import { sql } from "kysely";
+//#region src/encryption/apply.ts
+const rebindsField = (rebind, entry, field) => rebind !== void 0 && rebind.resource === entry.name && (rebind.field === void 0 || rebind.field === field.name) ? rebind : void 0;
+const changeOf = (keyring, entry, field, row, rebind) => {
+	const binding = bindingOf(entry.model, field, row.record);
+	const seal = (plaintext, count) => ({
+		address: row.address,
+		old: row.stored,
+		value: Sealed.textOf(sealText(keyring.current, binding, plaintext)),
+		count
+	});
+	const found = examine(keyring, entry, field, row, binding);
+	if (found.kind === "plaintext") return seal(row.stored, "encrypted");
+	if (found.kind === "open") return found.kid === keyring.current.id ? void 0 : seal(found.plaintext, "reencrypted");
+	if (found.entry.kind !== "failed-authentication" || !rebind) return found.entry;
+	const moved = examine(keyring, entry, field, row, movedBinding(binding, rebind.from));
+	return moved.kind === "open" ? seal(moved.plaintext, "rebound") : found.entry;
+};
+const write = async (trx, entry, field, change) => {
+	const { model } = entry;
+	const keys = model.primaryKey.map((name, i) => sql`${columnId(model.fields[name])} = ${change.address.key[i]}`);
+	const tenant = model.tenant ? [sql`${columnId(model.fields[model.tenant])} is not distinct from ${change.address.tenant}`] : [];
+	const conditions = sql.join([
+		...keys,
+		...tenant,
+		sql`${columnId(field)} = ${change.old}`
+	], sql` and `);
+	const result = await sql`update ${tableId(model)} set ${columnId(field)} = ${change.value} where ${conditions}`.execute(trx);
+	return Number(result.numAffectedRows ?? 0n) > 0;
+};
+const applyField = async (db, entry, field, keyring, changesSchema, rebind) => {
+	const applied = {
+		resource: entry.name,
+		field: field.name,
+		encrypted: 0,
+		reencrypted: 0,
+		rebound: 0,
+		skipped: 0,
+		unreadable: [],
+		historyScrubbed: 0,
+		outboxScrubbed: 0
+	};
+	await scanColumn(db, entry, field, async (rows, connection) => {
+		const changes = [];
+		for (const row of rows) {
+			const change = changeOf(keyring, entry, field, row, rebind);
+			if (change && "address" in change) changes.push(change);
+			else if (change) applied.unreadable.push(change);
+		}
+		if (changes.length === 0) return;
+		await captureOff(connection, changesSchema, async (trx) => {
+			for (const change of changes) if (await write(trx, entry, field, change)) applied[change.count]++;
+			else applied.skipped++;
+		});
+	});
+	applied.historyScrubbed = await scrubHistory(db, changesSchema, entry.model, field);
+	applied.outboxScrubbed = await scrubOutbox(db, changesSchema, entry.model, field);
+	return applied;
+};
+const keyIdsOf = async (db, entry, field) => {
+	const { rows } = await sql`select distinct split_part(${columnId(field)}, ':', 3) as kid from ${tableId(entry.model)} where ${columnId(field)} like 'pbenc:%'`.execute(db);
+	return rows.map(({ kid }) => kid);
+};
+const checkKeys = async (db, entries, keyring) => {
+	for (const entry of entries) for (const field of encryptedFields(entry)) {
+		const kids = await keyIdsOf(db, entry, field);
+		if (kids.length > 0 && !kids.some((kid) => keyring.byId.has(kid))) throw new Error(`${entry.name}.${field.name} holds values under keys ${kids.join(", ")} only, none of which this run has (key ${keyring.current.id}): run with the keys the app serves with`);
+	}
+};
+/**
+* Brings every encrypted field's column to the current key: plaintext values are encrypted, values under a previous key
+* encrypted again, and with `rebind` values sealed where they were before a rename sealed where they are now. Values that
+* do not open are listed and left alone. Then the fields' old values are removed from the history and the changes not
+* yet dispatched. Its writes capture no change. It refuses to run when a column holds envelopes under none of its keys.
+*/
+const applyEncryption = async (db, entries, keyring, changesSchema, options = {}) => {
+	await checkKeys(db, entries, keyring);
+	const fields = [];
+	const warnings = [];
+	for (const entry of entries) {
+		for (const field of encryptedFields(entry)) fields.push(await applyField(db, entry, field, keyring, changesSchema, rebindsField(options.rebind, entry, field)));
+		if (encryptedFields(entry).length > 0) warnings.push(...await cascadingKeys(db, entry.model));
+	}
+	return {
+		kid: keyring.current.id,
+		fields,
+		warnings
+	};
+};
+//#endregion
+export { applyEncryption };

package/dist/encryption/binding.d.ts

@@ -0,0 +1,2 @@
+import "../types.js";
+import { ResourceModel } from "@protobase/schema";