@protobase/server 0.37.2 → 0.39.0

package/dist/assistant/query-runner/query-runner.d.ts

@@ -0,0 +1,21 @@
+import { ResourceModel } from "@protobase/schema";
+import { Db } from "@protobase/query";
+//#region src/assistant/query-runner/query-runner.d.ts
+/** A table as config names it: the search path decides when it names no schema. */
+export type TableName = {
+  schema?: string;
+  name: string;
+};
+/**
+ * The SQL that makes the role the assistant's read-only queries run as, and its runner, and grants it exactly the
+ * resources' tables, never an auth table; `undefined` when the database is current.
+ */
+export declare const queryRunnerMigration: (db: Db, models: readonly ResourceModel[], authTables: readonly TableName[]) => Promise<string | undefined>;
+/**
+ * Refuses to go on while the runner of the assistant's read-only queries is missing or out of date, or runs as a role
+ * that is not weaker than the app's: the app's role itself or one it is a member of, a superuser, a login role, or one
+ * that can read an auth table, or while the role may call a security-definer function that runs as a role able to
+ * read one. It checks the owner's privileges, not its name, so a database cloned under another name still passes. A resource added since the last migration is not checked: Postgres refuses to read its table until then.
+ */
+export declare const checkQueryRunner: (db: Db, authTables: readonly TableName[]) => Promise<void>;
+//#endregion

package/dist/assistant/query-runner/query-runner.js

@@ -0,0 +1,79 @@
+import { modelVariables } from "../model-settings.js";
+import { migrationCommand } from "../../jobs/schema.js";
+import { queryRoleSql, queryRunnerSignature, queryRunnerSql, runnerBody } from "./runner-sql.js";
+import { plannedGrants } from "./runner-plan.js";
+import { sql } from "kysely";
+//#region src/assistant/query-runner/query-runner.ts
+const quoted = (name) => `"${name.replaceAll("\"", "\"\"")}"`;
+const regclassText = ({ schema, name }) => schema ? `${quoted(schema)}.${quoted(name)}` : quoted(name);
+const roleSql = sql.raw(queryRoleSql);
+const rowsOf = async (db, query) => (await query.execute(db)).rows;
+const resolved = (db, tables) => rowsOf(db, sql`select n.nspname as schema, c.relname as name from unnest(${tables.map(regclassText)}::text[]) with ordinality as t(name, n)
+      join pg_class c on c.oid = to_regclass(t.name) join pg_namespace n on n.oid = c.relnamespace order by t.n`);
+const readRunner = async (db) => {
+	const [runner] = await rowsOf(db, sql`select p.prosrc as source, p.prosecdef as definer, pg_get_userbyid(p.proowner) as owner,
+      (p.proacl is null or exists (select from aclexplode(p.proacl) a where a.grantee = 0 and a.privilege_type = 'EXECUTE')) as executable
+      from pg_proc p where p.oid = to_regprocedure(${queryRunnerSignature})`);
+	return runner;
+};
+/** What the database holds of the query role and its runner, and the tables the role should read and must not. Only reads the catalogue. */
+const readQueryRunner = async (db, models, authTables) => {
+	const [role] = await rowsOf(db, sql`select ${roleSql} as name, exists (select from pg_roles where rolname = ${roleSql}) as exists`);
+	const tables = await rowsOf(db, sql`select n.nspname as schema, c.relname as name from pg_class c join pg_namespace n on n.oid = c.relnamespace, aclexplode(c.relacl) a
+      where a.grantee = (select oid from pg_roles where rolname = ${roleSql}) and a.privilege_type = 'SELECT' order by 1, 2`);
+	const schemas = await rowsOf(db, sql`select n.nspname as schema from pg_namespace n, aclexplode(n.nspacl) a
+      where a.grantee = (select oid from pg_roles where rolname = ${roleSql}) and a.privilege_type = 'USAGE' order by 1`);
+	return {
+		role,
+		runner: await readRunner(db),
+		resources: await resolved(db, models.map((model) => model.table)),
+		authTables: await resolved(db, authTables),
+		granted: {
+			tables,
+			schemas: schemas.map((found) => found.schema)
+		}
+	};
+};
+/**
+* The SQL that makes the role the assistant's read-only queries run as, and its runner, and grants it exactly the
+* resources' tables, never an auth table; `undefined` when the database is current.
+*/
+const queryRunnerMigration = async (db, models, authTables) => {
+	const { role, runner, resources, authTables: auth, granted } = await readQueryRunner(db, models, authTables);
+	const plan = plannedGrants({
+		resources,
+		authTables: auth,
+		granted
+	});
+	return role.exists && runner?.source === runnerBody && runner.definer && runner.owner === role.name && !runner.executable && plan.grants.length === 0 && plan.revokes.length === 0 ? void 0 : queryRunnerSql(plan);
+};
+const refusal = (state) => /* @__PURE__ */ new Error(`The query role of the assistant's read-only queries ${state}. Write it as a migration with \`${migrationCommand}\`, run with the built-in assistant's key set (${modelVariables.apiKey} or options.assistant.apiKey), apply it with the project's migrations, then start again.`);
+const leakingFunctions = (db, authTables) => rowsOf(db, sql`with runner as (select proowner as role from pg_proc where oid = to_regprocedure(${queryRunnerSignature}))
+      select format('%I.%I(%s)', n.nspname, p.proname, pg_get_function_identity_arguments(p.oid)) as name
+      from pg_proc p join pg_namespace n on n.oid = p.pronamespace, runner
+      where p.prosecdef and p.prorettype <> 'trigger'::regtype and p.proowner <> runner.role
+        and has_schema_privilege(runner.role, p.pronamespace, 'USAGE') and has_function_privilege(runner.role, p.oid, 'EXECUTE')
+        and exists (select from unnest(${authTables.map(regclassText)}::text[]) as t(name) join pg_class c on c.oid = to_regclass(t.name)
+          where has_schema_privilege(p.proowner, c.relnamespace, 'USAGE') and has_any_column_privilege(p.proowner, c.oid, 'SELECT'))
+      order by 1`);
+/**
+* Refuses to go on while the runner of the assistant's read-only queries is missing or out of date, or runs as a role
+* that is not weaker than the app's: the app's role itself or one it is a member of, a superuser, a login role, or one
+* that can read an auth table, or while the role may call a security-definer function that runs as a role able to
+* read one. It checks the owner's privileges, not its name, so a database cloned under another name still passes. A resource added since the last migration is not checked: Postgres refuses to read its table until then.
+*/
+const checkQueryRunner = async (db, authTables) => {
+	const [runner] = await rowsOf(db, sql`select p.prosrc as source, p.prosecdef as definer,
+      (o.rolsuper or o.rolcanlogin or pg_has_role(p.proowner, current_user, 'MEMBER')) as strong,
+      exists (select from unnest(${authTables.map(regclassText)}::text[]) as t(name) join pg_class c on c.oid = to_regclass(t.name)
+        where has_schema_privilege(p.proowner, c.relnamespace, 'USAGE') and has_any_column_privilege(p.proowner, c.oid, 'SELECT')) as reads_auth
+      from pg_proc p join pg_roles o on o.oid = p.proowner where p.oid = to_regprocedure(${queryRunnerSignature})`);
+	if (!runner || !runner.definer || runner.source !== runnerBody) throw refusal("is missing");
+	if (runner.strong) throw refusal("is not weaker than the app's database role");
+	if (runner.reads_auth) throw refusal("can read the auth schema");
+	const leaking = await leakingFunctions(db, authTables);
+	if (leaking.length === 0) return;
+	throw new Error(`The query role of the assistant's read-only queries can read the auth schema through the security-definer functions ${leaking.map((found) => found.name).join(", ")}. Revoke execute on them from PUBLIC, or move them to a schema without a resource, then start again.`);
+};
+//#endregion
+export { checkQueryRunner, queryRunnerMigration, readQueryRunner };

package/dist/assistant/query-runner/runner-plan.js

@@ -0,0 +1,30 @@
+//#region src/assistant/query-runner/runner-plan.ts
+const same = (a, b) => a.schema === b.schema && a.name === b.name;
+const unique = (items, equal) => items.filter((item, index) => items.findIndex((other) => equal(item, other)) === index);
+/**
+* What the query role must be given and what taken back so that it reads exactly the resources' tables, never an auth
+* table, with usage on the schemas those are in. `resources` and `authTables` are the tables that exist, `granted`
+* what the role holds now.
+*/
+const plannedGrants = ({ resources, authTables, granted }) => {
+	const tables = unique(resources.filter((table) => !authTables.some((auth) => same(table, auth))), same);
+	const schemas = [...new Set(tables.map((table) => table.schema))];
+	return {
+		grants: [...schemas.filter((schema) => !granted.schemas.includes(schema)).map((schema) => ({
+			on: "schema",
+			schema
+		})), ...tables.filter((table) => !granted.tables.some((found) => same(found, table))).map((table) => ({
+			on: "table",
+			...table
+		}))],
+		revokes: [...granted.tables.filter((found) => !tables.some((table) => same(table, found))).map((table) => ({
+			on: "table",
+			...table
+		})), ...granted.schemas.filter((schema) => !schemas.includes(schema)).map((schema) => ({
+			on: "schema",
+			schema
+		}))]
+	};
+};
+//#endregion
+export { plannedGrants };

package/dist/assistant/query-runner/runner-sql.js

@@ -0,0 +1,68 @@
+//#region src/assistant/query-runner/runner-sql.ts
+/** The schema the read-only query runner lives in. */
+const queryRunnerSchema = "query";
+/** The function every read-only query runs through, as the query role. */
+const queryRunnerFunction = `${queryRunnerSchema}.run_read_only`;
+/** Its signature, as `to_regprocedure` and `revoke` name it. */
+const queryRunnerSignature = `${queryRunnerFunction}(text, integer)`;
+/**
+* The query role's name, computed by Postgres when the SQL runs, so one migration file serves every environment's
+* database. Roles belong to the whole cluster, so the name carries the database's, cut to leave room for the suffix.
+*/
+const queryRoleSql = "left(current_database(), 57) || '_query'";
+/**
+* The runner's plpgsql body. A cursor runs the statement, which Postgres refuses when the text holds more than one
+* query. Each row comes back as JSON, a number that is not a plain integer of at most 15 digits as its exact text,
+* which `JSON.parse` would otherwise round or reformat. The newlines keep a trailing `--` comment from swallowing the
+* wrapper.
+*/
+const runnerBody = `
+declare
+  rows refcursor;
+  row json;
+begin
+  open rows no scroll for execute 'select (select json_object_agg(e.key, case when json_typeof(e.value) = ''number'' and e.value::text !~ ''^-?[0-9]{1,15}$'' then to_json(e.value::text) else e.value end order by e.n) from json_each(to_json(r)) with ordinality as e(key, value, n)) from (' || E'\\n' || statement || E'\\n' || ') r limit ' || (row_limit + 1);
+  loop
+    fetch rows into row;
+    exit when not found;
+    return next row;
+  end loop;
+  close rows;
+end
+`;
+const literal = (text) => `'${text.replaceAll("'", "''")}'`;
+const grantSql = ({ grants, revokes }) => [...grants.map((grant) => grant.on === "schema" ? `  execute format('grant usage on schema %I to %I', ${literal(grant.schema)}, query_role);` : `  execute format('grant select on table %I.%I to %I', ${literal(grant.schema)}, ${literal(grant.name)}, query_role);`), ...revokes.map((revoke) => revoke.on === "schema" ? `  execute format('revoke usage on schema %I from %I', ${literal(revoke.schema)}, query_role);` : `  execute format('revoke select on table %I.%I from %I', ${literal(revoke.schema)}, ${literal(revoke.name)}, query_role);`)];
+/**
+* The SQL that makes the query role and the runner, and gives the role exactly `grants`, taking back `revokes`. It
+* applies again on a database that has them. The migrating role becomes a member of the role, which Postgres 16 needs
+* to hand it the function, and so may execute the runner; PUBLIC may not. The role bypasses row-level security only
+* when the migrating role may give it that: a superuser, or a role with BYPASSRLS on Postgres 16 or later.
+*/
+const queryRunnerSql = (plan) => [
+	`create schema if not exists ${queryRunnerSchema};`,
+	[
+		"do $$",
+		"declare",
+		`  query_role text := ${queryRoleSql};`,
+		"begin",
+		"  if not exists (select from pg_roles where rolname = query_role) then execute format('create role %I nologin', query_role); end if;",
+		"  execute format('grant %I to current_user', query_role);",
+		"  if (select rolsuper or (rolbypassrls and current_setting('server_version_num')::int >= 160000) from pg_roles where rolname = current_user) then execute format('alter role %I bypassrls', query_role); end if;",
+		...grantSql(plan),
+		"end $$;"
+	].join("\n"),
+	`create or replace function ${queryRunnerFunction}(statement text, row_limit integer) returns setof json language plpgsql security definer as $f$${runnerBody}$f$;`,
+	[
+		"do $$",
+		"declare",
+		`  query_role text := ${queryRoleSql};`,
+		"begin",
+		`  execute format('grant create on schema ${queryRunnerSchema} to %I', query_role);`,
+		`  execute format('alter function ${queryRunnerSignature} owner to %I', query_role);`,
+		`  execute format('revoke create on schema ${queryRunnerSchema} from %I', query_role);`,
+		"end $$;"
+	].join("\n"),
+	`revoke execute on function ${queryRunnerSignature} from public;`
+].join("\n\n");
+//#endregion
+export { queryRoleSql, queryRunnerFunction, queryRunnerSchema, queryRunnerSignature, queryRunnerSql, runnerBody };

package/dist/assistant/query-tools.d.ts

@@ -4,7 +4,8 @@ import { Db } from "@protobase/query";
 //#region src/assistant/query-tools.d.ts
 /**
  * Lets the model read the app's database: one SELECT per call, in a read-only transaction (see `runReadOnlyQuery`).
- * The rows show as a table in the chat. It runs as the app's database role, outside Protobase's access rules.
+ * The rows show as a table in the chat. It runs as the query role, outside Protobase's access rules: it reads the
+ * resources' tables only, never the auth schema.
  */
 export declare const readOnlyQueryTool: (db: Db, options?: QueryOptions) => AssistantTool;
 /**

package/dist/assistant/query-tools.js

@@ -26,11 +26,12 @@ const shown = (result, statement, context) => {
 const statementOf = (args) => typeof args.sql === "string" && args.sql.trim() ? args.sql : void 0;
 /**
 * Lets the model read the app's database: one SELECT per call, in a read-only transaction (see `runReadOnlyQuery`).
-* The rows show as a table in the chat. It runs as the app's database role, outside Protobase's access rules.
+* The rows show as a table in the chat. It runs as the query role, outside Protobase's access rules: it reads the
+* resources' tables only, never the auth schema.
 */
 const readOnlyQueryTool = (db, options = {}) => defineTool({
 	name: "run_read_only_query",
-	description: `Runs one PostgreSQL SELECT on the app's database in a read-only transaction and returns up to ${options.rowLimit ?? 200} rows as JSON ({ columns, rows, truncated }). The user sees the rows as a table. Use it to answer questions about the data. It cannot change anything.`,
+	description: `Runs one PostgreSQL SELECT on the app's database in a read-only transaction and returns up to ${options.rowLimit ?? 200} rows as JSON ({ columns, rows, truncated }). The user sees the rows as a table. Use it to answer questions about the data. It reads the app's resource tables only. It cannot change anything.`,
 	parameters: {
 		type: "object",
 		properties: { sql: sqlParameter("One SELECT statement, without a trailing semicolon.") },

package/dist/assistant/run-query.d.ts

@@ -13,7 +13,9 @@ export type QueryResult = {
 };
 /**
  * Runs one SELECT (or VALUES, or a WITH query) in a READ ONLY transaction that is always rolled back, so nothing it
- * does, settings included, outlives it. Postgres refuses any write in it, and the statement cannot leave it.
+ * does, settings included, outlives it. Postgres refuses any write in it, and the statement cannot leave it. It runs
+ * through the runner `protobase migration` makes, as the query role, which reads only the resources' tables and never
+ * the auth schema, and cannot switch back to the app's role; its cursor runs one statement only.
  */
 export declare const runReadOnlyQuery: (db: Db, statement: string, options?: QueryOptions) => Promise<QueryResult>;
 /**

package/dist/assistant/run-query.js

@@ -1,6 +1,8 @@
+import { queryRunnerFunction } from "./query-runner/runner-sql.js";
 import { sql } from "kysely";
 //#region src/assistant/run-query.ts
-const wrapped = (statement, rowLimit) => sql`with result as (\n${sql.raw(statement.trim().replace(/;\s*$/, ""))}\n) select * from result limit ${rowLimit + 1}`;
+const withoutSemicolon = (statement) => statement.trim().replace(/;\s*$/, "");
+const wrapped = (statement, rowLimit) => sql`with result as (\n${sql.raw(withoutSemicolon(statement))}\n) select * from result limit ${rowLimit + 1}`;
 const cell = (value) => {
 	if (typeof value === "bigint") return value.toString();
 	if (value instanceof Date) return value.toISOString();
@@ -12,28 +14,40 @@ const resultOf = (rows, rowLimit) => ({
 	rows: rows.slice(0, rowLimit).map((row) => Object.values(row).map(cell)),
 	truncated: rows.length > rowLimit
 });
-const run = (db, statement, options, begin, end) => db.connection().execute(async (connection) => {
+const run = (db, query, options, begin, end) => db.connection().execute(async (connection) => {
 	const rowLimit = options.rowLimit ?? 200;
 	await sql.raw(begin).execute(connection);
 	let succeeded = false;
 	try {
 		await sql`select set_config('statement_timeout', ${String(options.timeoutMs ?? 5e3)}, true)`.execute(connection);
-		const { rows } = await wrapped(statement, rowLimit).execute(connection);
+		const { rows } = await query(rowLimit).execute(connection);
 		succeeded = true;
-		return resultOf(rows, rowLimit);
+		return {
+			rows,
+			rowLimit
+		};
 	} finally {
 		await sql.raw(end(succeeded)).execute(connection);
 	}
 });
+const throughRunner = (statement) => (rowLimit) => sql`select row::text as row from ${sql.raw(queryRunnerFunction)}(${withoutSemicolon(statement)}, ${rowLimit}) as row`;
 /**
 * Runs one SELECT (or VALUES, or a WITH query) in a READ ONLY transaction that is always rolled back, so nothing it
-* does, settings included, outlives it. Postgres refuses any write in it, and the statement cannot leave it.
+* does, settings included, outlives it. Postgres refuses any write in it, and the statement cannot leave it. It runs
+* through the runner `protobase migration` makes, as the query role, which reads only the resources' tables and never
+* the auth schema, and cannot switch back to the app's role; its cursor runs one statement only.
 */
-const runReadOnlyQuery = (db, statement, options = {}) => run(db, statement, options, "begin transaction read only", () => "rollback");
+const runReadOnlyQuery = async (db, statement, options = {}) => {
+	const { rows, rowLimit } = await run(db, throughRunner(statement), options, "begin transaction read only", () => "rollback");
+	return resultOf(rows.map(({ row }) => JSON.parse(row ?? "{}")), rowLimit);
+};
 /**
 * Runs one INSERT, UPDATE or DELETE with a RETURNING clause (or a query) in a READ WRITE transaction, committed when it
 * succeeds. Only call it for a statement the user approved.
 */
-const runReadWriteQuery = (db, statement, options = {}) => run(db, statement, options, "begin transaction read write", (succeeded) => succeeded ? "commit" : "rollback");
+const runReadWriteQuery = async (db, statement, options = {}) => {
+	const { rows, rowLimit } = await run(db, (limit) => wrapped(statement, limit), options, "begin transaction read write", (succeeded) => succeeded ? "commit" : "rollback");
+	return resultOf(rows, rowLimit);
+};
 //#endregion
 export { runReadOnlyQuery, runReadWriteQuery };

package/dist/batch/reorder.js

@@ -3,7 +3,7 @@ import { tenantScope } from "../tenant.js";
 import { requireOperation, targetFilter, writableFields } from "../request-access.js";
 import { columnId, keyConditions, scopeConditions, tableId, whereClause } from "../sql-parts.js";
 import { fetchRecord } from "../records.js";
-import { validateBody } from "../validate-body.js";
+import { refuseUnknownField, validateBody } from "../validate-body.js";
 import { missing, shown } from "../write-shared.js";
 import { applyUpdate, planUpdate } from "../write-update.js";
 import { checkRankAfter } from "../rank-after.js";
@@ -50,6 +50,7 @@ const reorderIn = async (trx, deps, access, input) => {
 	const { entry, full } = access;
 	requireOperation(access, "update");
 	const field = full.fields[input.field];
+	if (!Object.hasOwn(access.readable.fields, input.field)) refuseUnknownField(input.field);
 	validateBody(access, "update", { [input.field]: 1 });
 	if (field?.type !== "integer" && field?.type !== "bigint") throw badRequest("invalid-parameter", `"${input.field}" must be an integer field to order by`);
 	if (!writableFields(access, "update").includes(input.field)) throw badRequest("invalid-parameter", `"${input.field}" is read-only`);

package/dist/better-auth/auth-schema.js

@@ -1,3 +1,4 @@
+import { storeSchema } from "./auth-tables.js";
 import { dropMcpTables, leftoverMcpTables, mcpTableNames, withMcpTables } from "./mcp/mcp-tables.js";
 import { snakeCaseMigration } from "./snake-case-migration.js";
 import { getMigrations } from "better-auth/db/migration";
@@ -15,7 +16,6 @@ const skipExisting = (sql) => sql.split(";\n\n").map((statement) => statement.re
 * the old ones.
 */
 const hasCamelCaseNames = ({ toBeAdded }) => toBeAdded.some(({ table, fields }) => table === "user" && "email_verified" in fields);
-const storeSchema = ({ options: { database } }) => database && "schemaName" in database ? database.schemaName : void 0;
 /**
 * The SQL that brings the admin store up to what this version of Protobase and the project's Better Auth plugins need:
 * for a store with the camelCase names of Protobase 0.6, their rename to snake_case (`snakeCaseMigration`); otherwise

package/dist/better-auth/auth-tables.d.ts

@@ -0,0 +1,8 @@
+import { AdminAuth } from "./create-auth.js";
+//#region src/better-auth/auth-tables.d.ts
+/** The admin store's tables with every plugin the project's auth has, which the assistant's queries must never read. */
+export declare const authStoreTables: (auth: AdminAuth) => {
+  schema: string | undefined;
+  name: string;
+}[];
+//#endregion

package/dist/better-auth/auth-tables.js

@@ -0,0 +1,11 @@
+import { getSchema } from "better-auth/db";
+//#region src/better-auth/auth-tables.ts
+/** The schema the admin store lives in; the search path decides when its options name none. */
+const storeSchema = ({ options: { database } }) => database && "schemaName" in database ? database.schemaName : void 0;
+/** The admin store's tables with every plugin the project's auth has, which the assistant's queries must never read. */
+const authStoreTables = (auth) => Object.keys(getSchema(auth.options)).map((name) => ({
+	schema: storeSchema(auth),
+	name
+}));
+//#endregion
+export { authStoreTables, storeSchema };

package/dist/index.d.ts

@@ -94,6 +94,8 @@ import { McpGateInput, mcpGate, sessionOf } from "./mcp/mcp-gate.js";
 import { McpHandlerInput, mcpHandler } from "./mcp/mcp-handler.js";
 import { McpRoutesInput, mcpRoutes } from "./mcp/mcp-routes.js";
 import { mcpToolContext } from "./mcp/mcp-context.js";
+import { checkQueryRunner, queryRunnerMigration } from "./assistant/query-runner/query-runner.js";
+import { authStoreTables } from "./better-auth/auth-tables.js";
 import { ErrorReporter } from "./error-reporting/sentry-reporter.js";
 import { startErrorReporting } from "./error-reporting/error-reporter.js";
 import { FunctionEnv, PublicFunctionEnv, functionApp } from "./functions/function-app.js";
@@ -120,4 +122,4 @@ import { isSchedule } from "./jobs/schedule.js";
 import { DrainResult, JobsRuntime, StartJobsOptions, startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
 import { checkJobsSchema, jobsSchema, jobsSchemaMigration } from "./jobs/schema.js";
-export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApiKeys, type ApiKeysOptions, type AppIcons, type AppIdentity, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type Caller, type CallerOptions, type CapturedRow, type CascadingKey, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryOptions, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type McpGateInput, type McpHandlerInput, type McpRoutesInput, type McpServerInput, type McpToolsInput, type MemberInput, MissingCredentials, type MobileConfig, ModelError, type ModelSettings, type NewOrganization, type NewUser, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReadableResources, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolAnnotations, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, backgroundSettled, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readWriteQueryTool, readableResources, realtimeLimits, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, sessionOf, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, waitUntil, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };
+export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApiKeys, type ApiKeysOptions, type AppIcons, type AppIdentity, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type Caller, type CallerOptions, type CapturedRow, type CascadingKey, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryOptions, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type McpGateInput, type McpHandlerInput, type McpRoutesInput, type McpServerInput, type McpToolsInput, type MemberInput, MissingCredentials, type MobileConfig, ModelError, type ModelSettings, type NewOrganization, type NewUser, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReadableResources, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolAnnotations, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkQueryRunner, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, processor, queryRunnerMigration, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readWriteQueryTool, readableResources, realtimeLimits, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, sessionOf, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, waitUntil, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };

package/dist/index.js

@@ -72,12 +72,14 @@ import { defineConfig, mergeConfig } from "./project-config.js";
 import { withTrustedApps } from "./better-auth/app-tokens.js";
 import { betterAuthAuthenticator, betterAuthTokens } from "./better-auth/authenticator.js";
 import { issueToken, maxTokenTtlSeconds } from "./better-auth/tokens.js";
+import { authStoreTables } from "./better-auth/auth-tables.js";
 import { authSchemaMigration, checkAuthSchema } from "./better-auth/auth-schema.js";
 import { checkComputed, computedMigration } from "./computed/computed-schema.js";
 import { webhooks } from "./webhooks/table/plugin.js";
 import { checkWebhooksSchema, webhooksMigration } from "./webhooks/table/schema.js";
 import { checkAi } from "./ai/check-ai.js";
 import { maxWidgetPropsBytes, widget } from "./assistant/widget.js";
+import { checkQueryRunner, queryRunnerMigration } from "./assistant/query-runner/query-runner.js";
 import { startErrorReporting } from "./error-reporting/error-reporter.js";
 import { functionApp } from "./functions/function-app.js";
 import { readJson } from "./functions/read-json.js";
@@ -91,4 +93,4 @@ import { aspectRatio, fileSize, fileType, imageSize, processor } from "./files/p
 import { defineEmail } from "./mail/define-email.js";
 import { startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
-export { FatalJobError, HttpProblem, MissingCredentials, ModelError, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, backgroundSettled, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readWriteQueryTool, readableResources, realtimeLimits, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, sessionOf, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, waitUntil, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };
+export { FatalJobError, HttpProblem, MissingCredentials, ModelError, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkQueryRunner, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, processor, queryRunnerMigration, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readWriteQueryTool, readableResources, realtimeLimits, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, sessionOf, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, waitUntil, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };

package/dist/openapi/schemas.js

@@ -69,7 +69,7 @@ const only = (schema, names) => ({
 });
 /**
 * Component schemas of a resource for one caller: the record with the fields they may read, and the create and update
-* bodies with the fields they may write. Hidden fields appear nowhere.
+* bodies with the fields they may write. Hidden fields appear nowhere; a write-only one only in the bodies.
 */
 const resourceSchemas = (access) => {
 	const { entry, model, resolved } = access;
@@ -104,7 +104,7 @@ const resourceSchemas = (access) => {
 		}
 	};
 	record.required = [...record.required ?? [], "etag"];
-	const writable = access.readable;
+	const writable = access.full;
 	const body = (names) => {
 		const properties = only(input.schema, names).properties;
 		const optional = new Set(names.filter((field) => writable.fields[field]?.nullable || writable.fields[field]?.default && "db" in writable.fields[field].default));

package/dist/request-access.js

@@ -65,11 +65,13 @@ const requireOperation = (access, operation) => {
 	if (access.session.anonymous) throw unauthorized(`Send a bearer token to ${operation} ${access.entry.name}`);
 	throw forbidden("access-denied", `You may not ${operation} ${access.entry.name}`);
 };
+const writesBlind = (access, name, mode) => access.entry.source.fieldAccess()[name]?.[mode] !== void 0 && !access.full.fields[name]?.file && name !== access.full.position?.field;
 /**
-* Fields the caller may write on create or update. A field they cannot read is never writable, even when its write rule
-* allows it (nobody writes blind; a sensitive field counts as readable); the tenant column is always set by the server.
+* Fields the caller may write on create or update: those they read (a sensitive field counts as read), and write-only
+* ones, which they cannot read but whose own write rule allows them (see `writesBlind`). The tenant column is always set
+* by the server.
 */
-const writableFields = (access, mode) => access.resolved.writableFields[mode].filter((name) => Object.hasOwn(access.readable.fields, name) && name !== access.full.tenant);
+const writableFields = (access, mode) => access.resolved.writableFields[mode].filter((name) => (Object.hasOwn(access.readable.fields, name) || writesBlind(access, name, mode)) && name !== access.full.tenant);
 const visibleFields = (access) => Object.values(access.model.fields);
 const andFilters = (filters) => {
 	const present = filters.filter((filter) => filter !== void 0);

package/dist/validate-body.js

@@ -17,6 +17,15 @@ const invalidValue = (field, issue) => {
 		...params && { params }
 	};
 };
+const unknownField = (name) => ({
+	field: name,
+	code: "unknown-field",
+	message: `Unknown field "${name}"`
+});
+/** Refuses a field the caller may not name in this request as `validateBody` refuses an unknown one. */
+const refuseUnknownField = (name) => {
+	throw fail([unknownField(name)]);
+};
 const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const reserved = ["etag", "permissions"];
 const isEmptyText = (field, value) => field.type === "text" && !field.nullable && value === "";
@@ -26,11 +35,11 @@ const isEmptyText = (field, value) => field.type === "text" && !field.nullable &
 */
 const requiredOnCreate = (field, schema) => !(field.default && "db" in field.default) && !field.nullable && !schema.safeParse(void 0).success;
 /**
-* Checks a create or update body for this caller. A field the caller cannot read is an unknown field, one they can read
-* but not write is read-only (the tenant column and the API's own `etag` and `permissions` keys are always read-only);
-* every provided value goes through its field's zod schema, then `.validate()` rules run on the result. An empty text
-* for a text field that may not be null counts as not given: a create fills in its default or reports it required,
-* an update reports it required. Only the values written are checked, so a stored '' still reads.
+* Checks a create or update body for this caller. A field the caller can neither read nor write is an unknown field, one
+* they can read but not write is read-only (the tenant column and the API's own `etag` and `permissions` keys are always
+* read-only), and a write-only one (see `writableFields`) is written like any other; every provided value goes through
+* its field's zod schema, then `.validate()` rules run on the result. An empty text for a text field that may not be null
+* counts as not given: a create fills in its default or reports it required, an update reports it required. Only the values written are checked, so a stored '' still reads.
 * Returns only the values to write: on create the defaults are filled in, on update only the provided fields.
 * `current` is the stored record an update merges into for `.validate()` rules, which get a set encrypted field of it as
 * `encrypted`: they see an encrypted value as text only when this write gives it.
@@ -46,11 +55,7 @@ const validateBody = (access, mode, body, current = {}) => {
 		code: "read-only",
 		message: name === "etag" ? "The version is not part of the body; send it in the If-Match header" : `"${name}" is read-only`
 	});
-	else if (!Object.hasOwn(model.fields, name)) errors.push({
-		field: name,
-		code: "unknown-field",
-		message: `Unknown field "${name}"`
-	});
+	else if (!Object.hasOwn(model.fields, name) && !writable.has(name)) errors.push(unknownField(name));
 	else if (!writable.has(name) || name === full.tenant) errors.push({
 		field: name,
 		code: "read-only",
@@ -92,11 +97,11 @@ const validateBody = (access, mode, body, current = {}) => {
 	};
 	const issues = entry.source.validators.flatMap((validate) => validate(merged) ?? []);
 	if (issues.length > 0) throw fail(issues.map((issue) => ({
-		field: Object.hasOwn(model.fields, issue.field) ? issue.field : "_record",
+		field: Object.hasOwn(model.fields, issue.field) || writable.has(issue.field) ? issue.field : "_record",
 		code: "invalid-record",
 		message: issue.message
 	})));
 	return values;
 };
 //#endregion
-export { requiredOnCreate, validateBody };
+export { refuseUnknownField, requiredOnCreate, validateBody };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.37.2",
+  "version": "0.39.0",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -36,9 +36,9 @@
     "@better-auth/passkey": "^1.7.12",
     "@better-auth/sso": "^1.7.12",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.37.2",
-    "@protobase/query": "0.37.2",
-    "@protobase/schema": "0.37.2",
+    "@protobase/layout": "0.39.0",
+    "@protobase/query": "0.39.0",
+    "@protobase/schema": "0.39.0",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",