@protobase/server 0.4.1 → 0.6.0

package/dist/better-auth/platform-sign-in.js

@@ -0,0 +1,88 @@
+import { decodeJwt } from "jose";
+//#region src/better-auth/platform-sign-in.ts
+const signInIssuerVariable = "PROTOBASE_SIGN_IN_ISSUER";
+const signInClientIdVariable = "PROTOBASE_SIGN_IN_CLIENT_ID";
+const signInClientSecretVariable = "PROTOBASE_SIGN_IN_CLIENT_SECRET";
+const signInProviderVariable = "PROTOBASE_SIGN_IN_PROVIDER";
+const signInNameVariable = "PROTOBASE_SIGN_IN_NAME";
+/**
+* The provider the platform passes in `PROTOBASE_SIGN_IN_ISSUER`, `PROTOBASE_SIGN_IN_CLIENT_ID` and
+* `PROTOBASE_SIGN_IN_CLIENT_SECRET` (with `PROTOBASE_SIGN_IN_PROVIDER` and `PROTOBASE_SIGN_IN_NAME` optional);
+* `undefined` when none of the three is set. Some but not all of them stops the server at startup.
+*/
+const readPlatformSignIn = (env) => {
+	const required = [
+		signInIssuerVariable,
+		signInClientIdVariable,
+		signInClientSecretVariable
+	];
+	const [issuer, clientId, clientSecret] = required.map((name) => env[name]?.trim() || void 0);
+	if (!issuer && !clientId && !clientSecret) return void 0;
+	if (!issuer || !clientId || !clientSecret) throw new Error(`${required.join(", ")} go together: set all three for the platform sign-in provider, or none`);
+	const provider = env[signInProviderVariable]?.trim();
+	const name = env[signInNameVariable]?.trim();
+	return {
+		issuer,
+		clientId,
+		clientSecret,
+		...provider && { provider },
+		...name && { name }
+	};
+};
+const providerId = /^[a-z][a-z0-9-]*$/;
+/** The provider with its defaults filled in; an issuer that is not a URL or a malformed id is an error. */
+const resolvePlatformSignIn = (signIn) => {
+	if (!URL.canParse(signIn.issuer)) throw new Error(`The platform sign-in provider's issuer must be a URL, not "${signIn.issuer}"`);
+	const provider = signIn.provider ?? "oidc";
+	if (!providerId.test(provider)) throw new Error(`Invalid sign-in provider id "${provider}": use lowercase letters, digits or "-"`);
+	return {
+		...signIn,
+		provider,
+		name: signIn.name ?? (provider === "github" ? "GitHub" : "SSO"),
+		scopes: signIn.scopes ?? []
+	};
+};
+/** The platform provider, unless the app configures a provider of its own with the same id, which then wins. */
+const platformSignInFor = (signIn, socialProviders) => signIn && !socialProviders.includes(signIn.provider) ? signIn : void 0;
+/**
+* The person as an ID token Better Auth already verified (the provider's keys, this client and the nonce) says, once
+* its issuer is the configured one; `null` without an ID token, so nothing comes from an unverified source.
+*/
+const idTokenUser = (idToken, issuer) => {
+	if (!idToken) return null;
+	const claims = decodeJwt(idToken);
+	if (claims.iss !== issuer || typeof claims.sub !== "string" || !claims.sub || typeof claims.email !== "string") return null;
+	return {
+		id: claims.sub,
+		sub: claims.sub,
+		email: claims.email,
+		emailVerified: claims.email_verified === true,
+		name: typeof claims.name === "string" && claims.name ? claims.name : claims.email.split("@")[0],
+		...typeof claims.picture === "string" && { image: claims.picture }
+	};
+};
+/**
+* The provider for Better Auth's generic OAuth plugin: discovery, PKCE, the client secret in a Basic header, an ID
+* token that must verify against the provider's keys, and no sign-up. A provider whose settings cannot be read at
+* startup is left out until the next start.
+*/
+const platformSignInProvider = (signIn) => ({
+	providerId: signIn.provider,
+	name: signIn.name,
+	clientId: signIn.clientId,
+	clientSecret: signIn.clientSecret,
+	discoveryUrl: `${signIn.issuer.replace(/\/$/, "")}/.well-known/openid-configuration`,
+	scopes: [
+		"openid",
+		"email",
+		"profile",
+		...signIn.scopes
+	],
+	pkce: true,
+	requireIdTokenVerification: true,
+	authentication: "basic",
+	disableSignUp: true,
+	getUserInfo: async (tokens) => idTokenUser(tokens.idToken, signIn.issuer)
+});
+//#endregion
+export { idTokenUser, platformSignInFor, platformSignInProvider, readPlatformSignIn, resolvePlatformSignIn, signInClientIdVariable, signInClientSecretVariable, signInIssuerVariable, signInNameVariable, signInProviderVariable };

package/dist/better-auth/policy-plugin.js

@@ -36,8 +36,9 @@ const refuse = (status, refusal) => new APIError(status, refusal);
 * applies it to Better Auth's own endpoints. A method the policy turns off answers `403 SIGN_IN_METHOD_FORBIDDEN`;
 * someone without what it requires gets a session, so they can set it up, but no API token (`403 SIGN_IN_SETUP_REQUIRED`).
 */
-const signInPolicyPlugin = ({ mail, socialProviders, operator }) => {
+const signInPolicyPlugin = ({ mail, socialProviders, operator, platformSignIn }) => {
 	const currentPolicy = async (context) => effectiveSignInPolicy((await readSignInPolicy(context.adapter)).policy, { mail });
+	const providersUnder = (policy) => [...socialProviders, ...platformSignIn && policy.platformSignIn === "allowed" ? [platformSignIn.provider] : []];
 	const policyAdmin = adminOnly("Only an admin can change how people sign in.");
 	const policyAnswer = async (context) => {
 		const stored = await readSignInPolicy(context.adapter);
@@ -47,6 +48,7 @@ const signInPolicyPlugin = ({ mail, socialProviders, operator }) => {
 			effective: effectiveSignInPolicy(stored.policy, { mail }),
 			mail,
 			...operator && { operator },
+			...platformSignIn && { platformSignIn: platformSignIn.name },
 			...stored.savedAt && { savedAt: stored.savedAt },
 			...savedBy && { savedBy }
 		};
@@ -72,9 +74,10 @@ const signInPolicyPlugin = ({ mail, socialProviders, operator }) => {
 					message: "Choose one of the offered rules for every sign-in method."
 				});
 				const user = ctx.context.session.user;
+				const admin = await accountMethods(ctx.context, user, providersUnder(effectiveSignInPolicy(policy, { mail })));
 				const problem = signInPolicyProblem(policy, {
 					mail,
-					admin: await accountMethods(ctx.context, user, socialProviders)
+					admin
 				});
 				if (problem) throw refuse("BAD_REQUEST", {
 					code: "SIGN_IN_POLICY_REFUSED",
@@ -92,7 +95,7 @@ const signInPolicyPlugin = ({ mail, socialProviders, operator }) => {
 				use: [sessionMiddleware]
 			}, async (ctx) => {
 				const policy = await currentPolicy(ctx.context);
-				const { socialSignIn: _, ...account } = await accountMethods(ctx.context, ctx.context.session.user, socialProviders);
+				const { socialSignIn: _, ...account } = await accountMethods(ctx.context, ctx.context.session.user, providersUnder(policy));
 				return ctx.json({
 					policy,
 					mail,
@@ -112,14 +115,16 @@ const signInPolicyPlugin = ({ mail, socialProviders, operator }) => {
 				const policy = await currentPolicy(ctx.context);
 				const refusal = policyRefusal(policy, {
 					path,
-					body: ctx.body
+					body: ctx.body,
+					params: ctx.params,
+					...platformSignIn && { platformProvider: platformSignIn.provider }
 				});
 				if (refusal) throw refuse("FORBIDDEN", refusal);
 				if (path === "/sign-in/email-otp") return vouchForCreatedAccount(ctx.context, ctx.body.email);
 				if (!(path === "/token" && (policy.twoFactor === "required" || policy.passkey === "required") || path === "/passkey/delete-passkey" && policy.passkey === "required")) return;
 				const session = await getSessionFromCtx(ctx);
 				if (!session || isStaffSession(session.session)) return;
-				const account = await accountMethods(ctx.context, session.user, socialProviders);
+				const account = await accountMethods(ctx.context, session.user, providersUnder(policy));
 				if (path === "/token" && missingRequiredMethods(policy, account).length > 0) throw refuse("FORBIDDEN", setupRequired);
 				if (path === "/passkey/delete-passkey" && account.passkeys <= 1) throw refuse("FORBIDDEN", lastPasskeyRequired);
 			})

package/dist/better-auth/policy-store.js

@@ -24,6 +24,11 @@ const signInPolicySchema = { [signInPolicyModel]: { fields: {
 		required: true,
 		defaultValue: "allowed"
 	},
+	platformSignIn: {
+		type: "string",
+		required: true,
+		defaultValue: "allowed"
+	},
 	createdAt: {
 		type: "date",
 		required: true

package/dist/better-auth/sign-in-enforcement.js

@@ -13,6 +13,8 @@ const passkeyPaths = [
 	"/passkey/verify-registration"
 ];
 const staffSignInPath = "/staff/sign-in";
+const providerPaths = ["/sign-in/social", "/link-social"];
+const callbackPath = "/callback/:id";
 const accountPaths = [
 	"/email-otp/send-verification-otp",
 	"/passkey/delete-passkey",
@@ -26,23 +28,29 @@ const isPoliced = (path) => path !== void 0 && ([
 	...emailCodePaths,
 	...passkeyPaths,
 	...accountPaths,
+	...providerPaths,
+	callbackPath,
 	"/staff/sign-in"
 ].includes(path) || path.startsWith("/reset-password/"));
-const methodOf = (path, body) => {
+const providerOf = ({ path, body, params }) => providerPaths.includes(path) ? body?.provider : path === callbackPath ? params?.id : void 0;
+const methodOf = (request) => {
+	const { path, body } = request;
 	if (passwordPaths.includes(path) || path.startsWith("/reset-password/")) return "password";
 	if (emailCodePaths.includes(path)) return "emailCode";
 	if (path === "/email-otp/send-verification-otp" && body?.type === "sign-in") return "emailCode";
 	if (passkeyPaths.includes(path)) return "passkey";
 	if (path === "/two-factor/enable") return "twoFactor";
 	if (path === "/staff/sign-in") return "staffAccess";
+	if (request.platformProvider !== void 0 && providerOf(request) === request.platformProvider) return "platformSignIn";
 };
 /**
 * Why the policy refuses a request to Better Auth at `path`, or `undefined` when it lets it through: a method the
 * policy turns off, or turning off two-factor authentication while the policy requires it. Removing the last passkey
 * while passkeys are required depends on the account, so the plugin checks that itself.
 */
-const policyRefusal = (policy, { path, body }) => {
-	const method = methodOf(path, body);
+const policyRefusal = (policy, request) => {
+	const { path } = request;
+	const method = methodOf(request);
 	if (method && policy[method] === "forbidden") return {
 		code: "SIGN_IN_METHOD_FORBIDDEN",
 		message: signInPolicyMethods[method].forbidden

package/dist/better-auth/sign-in-policy.d.ts

@@ -7,7 +7,8 @@ export type StaffAccessRule = 'allowed' | 'notify' | 'forbidden';
  * The app's sign-in policy. `password`, `emailCode` and `passkey` are ways to sign in; `twoFactor` is the second step
  * after a password or an emailed code. Only a passkey and two-factor authentication can be required: they are set up
  * once per person, so "required" sends everyone without one to set it up. `staffAccess` is whether the operator's
- * staff may sign in as people, for support.
+ * staff may sign in as people, for support. `platformSignIn` is whether people may sign in through the provider the
+ * platform adds (see `PlatformSignIn`), which the app's developer did not choose.
  */
 export type SignInPolicy = {
   password: 'allowed' | 'forbidden';
@@ -15,6 +16,7 @@ export type SignInPolicy = {
   passkey: SignInRule;
   twoFactor: SignInRule;
   staffAccess: StaffAccessRule;
+  platformSignIn: 'allowed' | 'forbidden';
 };
 /** Each method with the rules it takes, its name, and what the server answers when the policy turns it off. */
 export declare const signInPolicyMethods: {
@@ -43,6 +45,11 @@ export declare const signInPolicyMethods: {
     readonly rules: readonly ["allowed", "notify", "forbidden"];
     readonly forbidden: "Staff sign-in is turned off for this app.";
   };
+  readonly platformSignIn: {
+    readonly label: "Sign-in through the platform";
+    readonly rules: readonly ["allowed", "forbidden"];
+    readonly forbidden: "Signing in through the platform is turned off for this app.";
+  };
 };
 /** Everything allowed and nothing required: the policy of an app whose admins never saved one. */
 export declare const defaultSignInPolicy: SignInPolicy;

package/dist/better-auth/sign-in-policy.js

@@ -37,6 +37,11 @@ const signInPolicyMethods = {
 			"forbidden"
 		],
 		forbidden: "Staff sign-in is turned off for this app."
+	},
+	platformSignIn: {
+		label: "Sign-in through the platform",
+		rules: ["allowed", "forbidden"],
+		forbidden: "Signing in through the platform is turned off for this app."
 	}
 };
 /** Everything allowed and nothing required: the policy of an app whose admins never saved one. */
@@ -45,7 +50,8 @@ const defaultSignInPolicy = {
 	emailCode: "allowed",
 	passkey: "allowed",
 	twoFactor: "allowed",
-	staffAccess: "allowed"
+	staffAccess: "allowed",
+	platformSignIn: "allowed"
 };
 const methodNames = Object.keys(signInPolicyMethods);
 /** A policy from a request body or a stored row; `undefined` when a method is missing or has a rule it does not take. */
@@ -57,13 +63,21 @@ const parseSignInPolicy = (input) => {
 /**
 * The policy as it applies. Emailed codes need mail; without mail, password sign-in is on whatever the policy says, so
 * an app whose mail settings went missing does not lock out everyone who had only emailed codes left. Staff sign-in
-* that emails the person is off without mail, since nobody would be told.
+* that emails the person is off without mail, since nobody would be told. Sign-in through the platform is off while
+* passkeys or two-factor authentication are required: it skips the app's second step, and the provider's own cannot
+* be checked.
 */
-const effectiveSignInPolicy = (policy, { mail }) => mail ? policy : {
-	...policy,
-	password: "allowed",
-	emailCode: "forbidden",
-	...policy.staffAccess === "notify" && { staffAccess: "forbidden" }
+const effectiveSignInPolicy = (policy, { mail }) => {
+	const strict = policy.passkey === "required" || policy.twoFactor === "required";
+	return {
+		...policy,
+		...!mail && {
+			password: "allowed",
+			emailCode: "forbidden"
+		},
+		...!mail && policy.staffAccess === "notify" && { staffAccess: "forbidden" },
+		...strict && { platformSignIn: "forbidden" }
+	};
 };
 /** The required methods `account` has not set up yet, in the order a setup page asks for them. */
 const missingRequiredMethods = (policy, account) => [...policy.twoFactor === "required" && !account.twoFactor ? ["twoFactor"] : [], ...policy.passkey === "required" && account.passkeys === 0 ? ["passkey"] : []];

package/dist/better-auth/staff-plugin.js

@@ -9,7 +9,7 @@ import { deleteSessionCookie } from "better-auth/cookies";
 * Staff of the operator sign in as a person of this app, for support (see `staffSignInEndpoints`). A staff session
 * shows who started it and why, can be stopped, and cannot change the person's sign-in or the sign-in policy. Every
 * staff sign-in is logged for the app's admins. The plugin is there without an operator provider too, so its table
-* exists from the first `auth:migrate`.
+* exists from the first auth migration.
 */
 const staffSignInPlugin = ({ operator, mailer }) => ({
 	id: "protobase-staff-sign-in",

package/dist/better-auth/status-route.js

@@ -7,24 +7,30 @@ import { Hono } from "hono";
 * `GET {authBase}/status`: `needsAdmin` while the admin store has no user, so a login page can say how to create one;
 * `signInMethods`, the ways to sign in the sign-in policy leaves on (`password`, `emailCode`, `passkey`), so it offers
 * only those; `passwordReset` when reset mail can be sent and passwords are on, so it offers "Forgot password?" only
-* then; the ids of the configured `socialProviders`, so it offers "Continue with GitHub" when `github` is one; and
-* `staffSignIn`, the operator provider's name, when staff can sign in as people.
+* then; the ids of the `socialProviders` people can sign in with, so it offers "Continue with GitHub" when `github` is
+* one; `platformSignIn`, the id and name of the platform's provider when it is one of them; and `staffSignIn`, the
+* operator provider's name, when staff can sign in as people.
 */
 const statusRoute = (auth) => {
 	const app = new Hono();
 	app.get("/status", async (c) => {
-		const policy = effectiveSignInPolicy((await readSignInPolicy((await auth.$context).adapter)).policy, { mail: auth.mail });
+		const context = await auth.$context;
+		const policy = effectiveSignInPolicy((await readSignInPolicy(context.adapter)).policy, { mail: auth.mail });
 		const signInMethods = [
 			...policy.password === "allowed" ? ["password"] : [],
 			...policy.emailCode === "allowed" ? ["emailCode"] : [],
 			...policy.passkey !== "forbidden" ? ["passkey"] : []
 		];
 		const staffSignIn = auth.operator && policy.staffAccess !== "forbidden" ? auth.operator : void 0;
+		const platform = auth.platformSignIn;
+		const platformSignIn = platform && policy.platformSignIn === "allowed" && context.socialProviders.some((provider) => provider.id === platform.provider) ? platform : void 0;
+		const socialProviders = [...auth.socialProviders, ...platformSignIn ? [platformSignIn.provider] : []];
 		return c.json({
 			needsAdmin: !await hasUsers(auth),
 			signInMethods,
 			passwordReset: auth.passwordReset && policy.password === "allowed",
-			socialProviders: auth.socialProviders,
+			socialProviders,
+			...platformSignIn && { platformSignIn },
 			...staffSignIn && { staffSignIn }
 		});
 	});

package/dist/better-auth/users.d.ts

@@ -3,11 +3,17 @@ import { parseRoles } from "./parse-roles.js";
 //#region src/better-auth/users.d.ts
 /** The roles this auth instance allows, `admin` first. */
 export declare const roleChoices: (auth: AdminAuth) => string[];
+/** An account at a sign-in provider, as Better Auth keys it: `{ providerId: 'github', accountId: '<GitHub user id>' }`. */
+export type LinkedAccount = {
+  providerId: string;
+  accountId: string;
+};
 export type NewUser = {
   email: string;
   password: string;
   name?: string;
   role?: string;
+  accounts?: LinkedAccount[];
 };
 export type StoredUser = {
   id: string;
@@ -21,7 +27,8 @@ export declare const hasUsers: (auth: AdminAuth) => Promise<boolean>;
 /**
  * Creates a user directly in the admin store. Host side only (no HTTP route creates accounts while the store is empty):
  * the first user is always an `admin`, later ones get `role` (default `user`). The address counts as verified, so the
- * user can also sign in with an emailed code.
+ * user can also sign in with an emailed code. `accounts` link the user to sign-in providers up front, so a provider
+ * signs them in by its own id whatever address it reports; one that signs in another user already is refused.
  */
 export declare const createUser: (auth: AdminAuth, input: NewUser) => Promise<{
   id: string;

package/dist/better-auth/users.js

@@ -10,22 +10,37 @@ const checkRoles = (auth, role) => {
 };
 /** Whether the admin store has any user yet. */
 const hasUsers = async (auth) => (await auth.$context).adapter.count({ model: "user" }).then((count) => count > 0);
+const checkAccounts = async (auth, accounts) => {
+	const { internalAdapter } = await auth.$context;
+	for (const account of accounts) {
+		if (!account.providerId || !account.accountId || account.providerId === "credential") throw new Error(`Cannot link an account "${account.providerId}:${account.accountId}"`);
+		if (await internalAdapter.findAccountByKey(account)) throw new Error(`The ${account.providerId} account ${account.accountId} signs in another user already`);
+	}
+};
 /**
 * Creates a user directly in the admin store. Host side only (no HTTP route creates accounts while the store is empty):
 * the first user is always an `admin`, later ones get `role` (default `user`). The address counts as verified, so the
-* user can also sign in with an emailed code.
+* user can also sign in with an emailed code. `accounts` link the user to sign-in providers up front, so a provider
+* signs them in by its own id whatever address it reports; one that signs in another user already is refused.
 */
 const createUser = async (auth, input) => {
 	const first = !await hasUsers(auth);
 	const requested = input.role ?? auth.defaultRole;
 	if (!first && requested === void 0) throw new Error(`A role is required: choose one of ${auth.roles.join(", ")}`);
 	const role = first ? "admin" : checkRoles(auth, requested).join(",");
+	const accounts = input.accounts ?? [];
+	await checkAccounts(auth, accounts);
 	const { user } = await auth.api.createUser({ body: {
 		email: input.email,
 		password: input.password,
 		name: input.name ?? input.email.split("@")[0],
 		role
 	} });
+	const { internalAdapter } = await auth.$context;
+	for (const account of accounts) await internalAdapter.linkAccount({
+		userId: user.id,
+		...account
+	});
 	return {
 		id: user.id,
 		email: user.email,

package/dist/create-admin.d.ts

@@ -1,6 +1,7 @@
 import { AdminAuth } from "./better-auth/create-auth.js";
 import { ResourceSource } from "./resource-source.js";
-import { AdminEnv, AdminOptions, Authenticator, PageSource, ViewSource } from "./types.js";
+import { AdminEnv, Authenticator, PageSource, ViewSource } from "./types.js";
+import { AdminOptions } from "./admin-options.js";
 import { Hono } from "hono";
 import { UserMenuSource } from "@protobase/schema";
 import { Db } from "@protobase/query";

package/dist/create-admin.js

@@ -1,5 +1,6 @@
 import { assistantSettings } from "./assistant/assistant-settings.js";
 import { createErrorHandler } from "./error-handler.js";
+import { assistantRecords } from "./assistant/records.js";
 import { builtInAssistant } from "./assistant/built-in-assistant.js";
 import { consoleAuditQueue } from "./audit/console-queue.js";
 import { authBasePath } from "./better-auth/create-auth.js";
@@ -84,14 +85,20 @@ const createAdmin = ({ resources, views = [], pages = [], userMenu, db, authenti
 		app.route(authBasePath, statusRoute(auth));
 		app.on(["GET", "POST"], `${authBasePath}/*`, (c) => auth.handler(c.req.raw));
 	}
-	if (assistant?.kind === "built-in") app.route(`${systemPath}/assistant`, builtInAssistant({
-		model: assistant.model,
-		chats: assistant.chats,
-		db,
-		meta,
-		authenticate,
-		report: options.onUnhandledError
-	}));
+	if (assistant?.kind === "built-in") {
+		const tools = options.assistant ? options.assistant.tools : void 0;
+		const records = (session) => assistantRecords(deps, session);
+		app.route(`${systemPath}/assistant`, builtInAssistant({
+			model: assistant.model,
+			chats: assistant.chats,
+			db,
+			meta,
+			authenticate,
+			tools,
+			records,
+			report: options.onUnhandledError
+		}));
+	}
 	app.route("/", batchRoute(deps, authenticate, meta));
 	app.route(basePath, api);
 	app.route(deps.systemPath || "/", system);

package/dist/deps.d.ts

@@ -0,0 +1,6 @@
+import "./types.js";
+import "./registry.js";
+import "./scan-guard.js";
+import { PageModel } from "@protobase/layout";
+import { ResolveOptions, ViewModel } from "@protobase/schema";
+import { Db } from "@protobase/query";

package/dist/index.d.ts

@@ -1,28 +1,34 @@
 import { SignInPolicy, SignInRule, StaffAccessRule, defaultSignInPolicy, signInPolicyMethods } from "./better-auth/sign-in-policy.js";
 import { StaffSignIn } from "./better-auth/staff-log.js";
 import { OperatorProvider, readOperatorSettings } from "./better-auth/operator-provider.js";
+import { PlatformSignIn, readPlatformSignIn } from "./better-auth/platform-sign-in.js";
 import { AdminAuth, CreateAuthOptions, UserCreatedHook, createAuth, normalizeRoles } from "./better-auth/create-auth.js";
 import { ResourceSource, configExports } from "./resource-source.js";
-import { AssistantOptions, AssistantSettings, ModelSettings, assistantRoles, assistantSettings, assistantVariables, seesAssistant } from "./assistant/assistant-settings.js";
+import { ChatMessage, ChatTextPart, Completion, CompletionOptions, ModelError, ModelSettings, ReasoningDetail, ReasoningEffort, ToolCall, ToolSpec, streamChatCompletion } from "./assistant/chat-completions.js";
+import { Admin, AuditEvent, AuditQueue, Authenticator, PipelineHook, ScanGuardMode, Session, TenantValue, User, ViewSource, WriteEvent, WriteOperation } from "./types.js";
+import { ConversationRecord, ConversationStore } from "./assistant/conversation-store.js";
+import { Conversation, ConversationsOptions, conversationKey, createConversations } from "./assistant/conversations.js";
+import { ApprovalAnswer, ApprovalRequest, requestApproval } from "./assistant/approval.js";
+import { RecordKeyInput, ToolRecord, ToolRecords } from "./assistant/records.js";
+import { AssistantTool, ToolContext, defineTool } from "./assistant/tools.js";
+import { AssistantOptions, AssistantSettings, assistantRoles, assistantSettings, assistantVariables, seesAssistant } from "./assistant/assistant-settings.js";
 import { RuntimeOptions, runtimeUrl, runtimeVariable, seesRuntime } from "./runtime/runtime-settings.js";
-import { Admin, AdminOptions, AuditEvent, AuditQueue, Authenticator, PipelineHook, ScanGuardMode, Session, TenantValue, User, ViewSource, WriteEvent, WriteOperation } from "./types.js";
+import { AdminOptions } from "./admin-options.js";
 import { CreateAdminInput, createAdmin } from "./create-admin.js";
+import { ProjectConfig, defineConfig, mergeConfig } from "./project-config.js";
 import { consoleAuditQueue } from "./audit/console-queue.js";
 import { JwtOptions, jwtAuthenticator } from "./auth/jwt.js";
 import { HttpProblem, badRequest, forbidden, notFound, unauthorized } from "./problem.js";
 import { BetterAuthAuthenticatorOptions, betterAuthAuthenticator } from "./better-auth/authenticator.js";
 import { parseRoles } from "./better-auth/parse-roles.js";
-import { NewUser, StoredUser, createUser, deleteUser, hasUsers, listUsers, roleChoices, setUserBanned, setUserRole } from "./better-auth/users.js";
+import { LinkedAccount, NewUser, StoredUser, createUser, deleteUser, hasUsers, listUsers, roleChoices, setUserBanned, setUserRole } from "./better-auth/users.js";
 import { IssueTokenOptions, issueToken, maxTokenTtlSeconds } from "./better-auth/tokens.js";
-import { ChatMessage, ChatTextPart, Completion, CompletionOptions, ModelError, ReasoningDetail, ReasoningEffort, ToolCall, ToolSpec, streamChatCompletion } from "./assistant/chat-completions.js";
-import { ConversationRecord, ConversationStore } from "./assistant/conversation-store.js";
-import { Conversation, ConversationsOptions, conversationKey, createConversations } from "./assistant/conversations.js";
+import { authSchemaMigration, checkAuthSchema } from "./better-auth/auth-schema.js";
 import { AssistantBackend, assistantProtocolRoutes } from "./assistant/protocol-routes.js";
 import { fileConversationStore } from "./assistant/file-conversation-store.js";
 import { withCacheBreakpoints } from "./assistant/cache-breakpoints.js";
-import { ApprovalAnswer, ApprovalRequest, requestApproval } from "./assistant/approval.js";
-import { AssistantTool, ToolContext, defineTool } from "./assistant/tools.js";
 import { TurnOptions, runTurn } from "./assistant/turn.js";
+import { WidgetOptions, maxWidgetPropsBytes, widget } from "./assistant/widget.js";
 import { QueryOptions, QueryResult, runReadOnlyQuery, runReadWriteQuery } from "./assistant/run-query.js";
 import { readOnlyQueryTool, readWriteQueryTool } from "./assistant/query-tools.js";
-export { type Admin, type AdminAuth, type AdminOptions, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticatorOptions, type ChatMessage, type ChatTextPart, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CreateAdminInput, type CreateAuthOptions, HttpProblem, type IssueTokenOptions, type JwtOptions, ModelError, type ModelSettings, type NewUser, type OperatorProvider, type PipelineHook, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type ResourceSource, type RuntimeOptions, type ScanGuardMode, type Session, type SignInPolicy, type SignInRule, type StaffAccessRule, type StaffSignIn, type StoredUser, type TenantValue, type ToolCall, type ToolContext, type ToolSpec, type TurnOptions, type User, type UserCreatedHook, type ViewSource, type WriteEvent, type WriteOperation, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, badRequest, betterAuthAuthenticator, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createUser, defaultSignInPolicy, defineTool, deleteUser, fileConversationStore, forbidden, hasUsers, issueToken, jwtAuthenticator, listUsers, maxTokenTtlSeconds, normalizeRoles, notFound, parseRoles, readOnlyQueryTool, readOperatorSettings, readWriteQueryTool, requestApproval, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, seesAssistant, seesRuntime, setUserBanned, setUserRole, signInPolicyMethods, streamChatCompletion, unauthorized, withCacheBreakpoints };
+export { type Admin, type AdminAuth, type AdminOptions, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticatorOptions, type ChatMessage, type ChatTextPart, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CreateAdminInput, type CreateAuthOptions, HttpProblem, type IssueTokenOptions, type JwtOptions, type LinkedAccount, ModelError, type ModelSettings, type NewUser, type OperatorProvider, type PipelineHook, type PlatformSignIn, type ProjectConfig, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type RecordKeyInput, type ResourceSource, type RuntimeOptions, type ScanGuardMode, type Session, type SignInPolicy, type SignInRule, type StaffAccessRule, type StaffSignIn, type StoredUser, type TenantValue, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TurnOptions, type User, type UserCreatedHook, type ViewSource, type WidgetOptions, type WriteEvent, type WriteOperation, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, betterAuthAuthenticator, checkAuthSchema, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createUser, defaultSignInPolicy, defineConfig, defineTool, deleteUser, fileConversationStore, forbidden, hasUsers, issueToken, jwtAuthenticator, listUsers, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, normalizeRoles, notFound, parseRoles, readOnlyQueryTool, readOperatorSettings, readPlatformSignIn, readWriteQueryTool, requestApproval, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, seesAssistant, seesRuntime, setUserBanned, setUserRole, signInPolicyMethods, streamChatCompletion, unauthorized, widget, withCacheBreakpoints };

package/dist/index.js

@@ -12,6 +12,7 @@ import { ModelError, streamChatCompletion } from "./assistant/chat-completions.j
 import { runTurn } from "./assistant/turn.js";
 import { consoleAuditQueue } from "./audit/console-queue.js";
 import { readOperatorSettings } from "./better-auth/operator-provider.js";
+import { readPlatformSignIn } from "./better-auth/platform-sign-in.js";
 import { defaultSignInPolicy, signInPolicyMethods } from "./better-auth/sign-in-policy.js";
 import { parseRoles } from "./better-auth/parse-roles.js";
 import { createAuth, normalizeRoles } from "./better-auth/create-auth.js";
@@ -19,7 +20,10 @@ import { createUser, deleteUser, hasUsers, listUsers, roleChoices, setUserBanned
 import { runtimeUrl, runtimeVariable, seesRuntime } from "./runtime/runtime-settings.js";
 import { createAdmin } from "./create-admin.js";
 import { configExports } from "./resource-source.js";
+import { defineConfig, mergeConfig } from "./project-config.js";
 import { jwtAuthenticator } from "./auth/jwt.js";
 import { betterAuthAuthenticator } from "./better-auth/authenticator.js";
 import { issueToken, maxTokenTtlSeconds } from "./better-auth/tokens.js";
-export { HttpProblem, ModelError, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, badRequest, betterAuthAuthenticator, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createUser, defaultSignInPolicy, defineTool, deleteUser, fileConversationStore, forbidden, hasUsers, issueToken, jwtAuthenticator, listUsers, maxTokenTtlSeconds, normalizeRoles, notFound, parseRoles, readOnlyQueryTool, readOperatorSettings, readWriteQueryTool, requestApproval, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, seesAssistant, seesRuntime, setUserBanned, setUserRole, signInPolicyMethods, streamChatCompletion, unauthorized, withCacheBreakpoints };
+import { authSchemaMigration, checkAuthSchema } from "./better-auth/auth-schema.js";
+import { maxWidgetPropsBytes, widget } from "./assistant/widget.js";
+export { HttpProblem, ModelError, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, betterAuthAuthenticator, checkAuthSchema, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createUser, defaultSignInPolicy, defineConfig, defineTool, deleteUser, fileConversationStore, forbidden, hasUsers, issueToken, jwtAuthenticator, listUsers, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, normalizeRoles, notFound, parseRoles, readOnlyQueryTool, readOperatorSettings, readPlatformSignIn, readWriteQueryTool, requestApproval, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, seesAssistant, seesRuntime, setUserBanned, setUserRole, signInPolicyMethods, streamChatCompletion, unauthorized, widget, withCacheBreakpoints };

package/dist/list-service.js

@@ -1,11 +1,11 @@
-import { checkedFilter, checkedSort } from "./filter-input.js";
-import { readScope, requestAccess, requireOperation } from "./request-access.js";
-import { readTransaction } from "./transactions.js";
 import { etagAlias } from "./sql-parts.js";
 import { etagOf } from "./etag.js";
 import { exposeRow, pickFields } from "./rows.js";
-import { deletedRows, listParams, pageSizeOf, parseParams, seekParams, selectedFields } from "./params.js";
+import { checkedFilter, checkedSort } from "./filter-input.js";
+import { readScope, requestAccess, requireOperation } from "./request-access.js";
 import { rowPermissions } from "./row-permissions.js";
+import { readTransaction } from "./transactions.js";
+import { deletedRows, listParams, pageSizeOf, parseParams, seekParams, selectedFields } from "./params.js";
 import { estimateCount, exactCount, listQuery, seekToPosition } from "@protobase/query";
 //#region src/list-service.ts
 /**

package/dist/project-config.d.ts

@@ -0,0 +1,28 @@
+import { AdminAuth } from "./better-auth/create-auth.js";
+import { Authenticator } from "./types.js";
+import { AdminOptions } from "./admin-options.js";
+import { Db } from "@protobase/query";
+//#region src/project-config.d.ts
+/** What `protobase.config.ts` may default-export. Everything is optional. */
+export type ProjectConfig = {
+  /** Names the config in errors, such as two configs defining the same tool; an extension should set it. */
+  name?: string;
+  /** Configs this one extends: merged in order before it (see `mergeConfig`). */
+  extends?: ProjectConfig[];
+  /** The config module, e.g. `import * as config from './config'`; default: ./config/index.ts and ./config/*\/ui.ts. */
+  config?: Record<string, unknown>;
+  db?: Db;
+  authenticate?: Authenticator;
+  /** A Better Auth instance; createAdmin mounts its routes under /api/auth. */
+  auth?: AdminAuth;
+  options?: AdminOptions;
+};
+/** Typed identity, for `export default defineConfig({ extends: [...], config, auth, ... })` in `protobase.config.ts`. */
+export declare const defineConfig: (config: ProjectConfig) => ProjectConfig;
+/**
+ * One config from several, each after the ones it `extends`, the last being the app's own. Named things are all kept:
+ * resources, views and pages of the config modules, assistant tools; one name defined by two configs is an error naming
+ * both. Write hooks run in the same order. Every other value is the last config's that sets it, so the app's own wins.
+ */
+export declare const mergeConfig: (...configs: ProjectConfig[]) => ProjectConfig;
+//#endregion