@protobase/server 0.40.5 → 0.40.6

package/dist/admin-options.d.ts

@@ -55,11 +55,14 @@ export type AdminOptions = {
   /**
    * The MCP endpoint, on with `createAuth({ mcp })`. `sql: true` also offers admins and the `ai` role
    * `run_read_only_query`, which reads the whole database as the app's database role, outside the access rules.
+   * `writes: true` offers `create_record` and `update_record`, through the REST API's access rules, `validate` and write
+   * hooks; the person approves each write in their client, and a client that cannot ask is refused.
    * `false`: the host serves its own MCP endpoint at `auth.mcp.path`, in front of this app. This app then answers 404
    * there and needs no `forAudience`, while the OAuth provider's discovery stays.
    */
   mcp?: {
     sql?: boolean;
+    writes?: boolean;
   } | false;
   /**
    * The websites whose browser code may call the API (`/api/*` but `/api/auth/*`) besides the app's own origins (see

package/dist/assistant/record-tool-args.js

@@ -0,0 +1,33 @@
+import { HttpProblem } from "../problem.js";
+//#region src/assistant/record-tool-args.ts
+/** A refusal the model can act on (no such resource, not allowed, a bad filter) is its to read; anything else fails the call. */
+const refused = (error) => {
+	if (error instanceof HttpProblem && error.status < 500) return JSON.stringify({
+		error: error.slug,
+		message: error.detail
+	});
+	throw error;
+};
+const resourceOf = (args) => typeof args.resource === "string" && args.resource ? args.resource : void 0;
+const keyOf = (value) => {
+	if (typeof value === "string" || typeof value === "number") return value;
+	if (Array.isArray(value) && value.length > 0 && value.every((part) => typeof part === "string" || typeof part === "number")) return value;
+};
+const resourceParameter = {
+	type: "string",
+	description: "The resource's name, as list_resources gives it."
+};
+const keyParameter = {
+	description: "The record's key: its value, or the values of its key fields in order when the key has several.",
+	anyOf: [
+		{ type: "string" },
+		{ type: "number" },
+		{
+			type: "array",
+			items: { type: ["string", "number"] },
+			minItems: 1
+		}
+	]
+};
+//#endregion
+export { keyOf, keyParameter, refused, resourceOf, resourceParameter };

package/dist/assistant/record-tools.js

@@ -1,5 +1,5 @@
-import { HttpProblem } from "../problem.js";
 import { defineTool } from "./tools.js";
+import { keyOf, keyParameter, refused, resourceOf, resourceParameter } from "./record-tool-args.js";
 //#region src/assistant/record-tools.ts
 const readOnly = {
 	readOnlyHint: true,
@@ -7,13 +7,6 @@ const readOnly = {
 };
 const defaultPageSize = 20;
 const maxPageSize = 100;
-const refused = (error) => {
-	if (error instanceof HttpProblem && error.status < 500) return JSON.stringify({
-		error: error.slug,
-		message: error.detail
-	});
-	throw error;
-};
 const fieldEntry = (field, view) => {
 	const hint = view?.fields[field.name];
 	return {
@@ -37,15 +30,6 @@ const resourceEntry = (model, view) => ({
 	fields: Object.values(model.fields).map((field) => fieldEntry(field, view))
 });
 const described = ({ models, views }) => models.map((model) => resourceEntry(model, views.find((view) => view.resource === model.name)));
-const resourceOf = (args) => typeof args.resource === "string" && args.resource ? args.resource : void 0;
-const keyOf = (value) => {
-	if (typeof value === "string" || typeof value === "number") return value;
-	if (Array.isArray(value) && value.length > 0 && value.every((part) => typeof part === "string" || typeof part === "number")) return value;
-};
-const resourceParameter = {
-	type: "string",
-	description: "The resource's name, as list_resources gives it."
-};
 /** Lists the resources the caller may read, with their fields, labels and which fields filters and sorts take. */
 const listResourcesTool = () => defineTool({
 	name: "list_resources",
@@ -107,18 +91,7 @@ const getRecordTool = () => defineTool({
 		type: "object",
 		properties: {
 			resource: resourceParameter,
-			key: {
-				description: "The record's key: its value, or the values of its key fields in order when the key has several.",
-				anyOf: [
-					{ type: "string" },
-					{ type: "number" },
-					{
-						type: "array",
-						items: { type: ["string", "number"] },
-						minItems: 1
-					}
-				]
-			}
+			key: keyParameter
 		},
 		required: ["resource", "key"]
 	},

package/dist/assistant/write-record-tools.d.ts

@@ -0,0 +1,9 @@
+import { AssistantTool } from "./tools.js";
+//#region src/assistant/write-record-tools.d.ts
+/** Creates a record of a resource once the user approves it, under the caller's access rules. */
+export declare const createRecordTool: () => AssistantTool;
+/** Updates one record by its key once the user approves it, under the caller's access rules. */
+export declare const updateRecordTool: () => AssistantTool;
+/** `create_record` and `update_record`. */
+export declare const writeRecordTools: () => AssistantTool[];
+//#endregion

package/dist/assistant/write-record-tools.js

@@ -0,0 +1,85 @@
+import { defineTool } from "./tools.js";
+import { keyOf, keyParameter, refused, resourceOf, resourceParameter } from "./record-tool-args.js";
+//#region src/assistant/write-record-tools.ts
+const writes = {
+	readOnlyHint: false,
+	destructiveHint: false,
+	openWorldHint: false
+};
+const dataParameter = {
+	type: "object",
+	description: "Field names to values, as list_resources gives the fields."
+};
+const dataOf = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+const notApproved = (answer) => `The user did not approve this change (${answer}); nothing was written.`;
+/** Creates a record of a resource once the user approves it, under the caller's access rules. */
+const createRecordTool = () => defineTool({
+	name: "create_record",
+	description: "Creates a record of a resource and returns it as JSON ({ record, etag }). The user approves each write in their client first; nothing is written without it.",
+	parameters: {
+		type: "object",
+		properties: {
+			resource: resourceParameter,
+			data: dataParameter
+		},
+		required: ["resource", "data"]
+	},
+	annotations: writes,
+	run: async (args, context) => {
+		const resource = resourceOf(args);
+		const data = dataOf(args.data);
+		if (!resource || !data) return "Pass the resource and data as { \"resource\": \"<name>\", \"data\": { \"<field>\": <value> } }.";
+		const answer = await context.approve({
+			title: `Create a record in ${resource}?`,
+			code: JSON.stringify(data, null, 2),
+			approveLabel: "Create"
+		});
+		if (answer !== "approved") return notApproved(answer);
+		return context.records.create(resource, data).then((record) => JSON.stringify(record), refused);
+	}
+});
+/** Updates one record by its key once the user approves it, under the caller's access rules. */
+const updateRecordTool = () => defineTool({
+	name: "update_record",
+	description: "Updates fields of one record of a resource by its key and returns it as JSON ({ record, etag }). Pass the etag get_record gave to fail when someone changed the record since. The user approves each write in their client first; nothing is written without it.",
+	parameters: {
+		type: "object",
+		properties: {
+			resource: resourceParameter,
+			key: keyParameter,
+			data: {
+				...dataParameter,
+				description: "The fields to change, names to new values, as list_resources gives the fields."
+			},
+			etag: {
+				type: "string",
+				description: "The etag get_record gave, to fail when the record changed since."
+			}
+		},
+		required: [
+			"resource",
+			"key",
+			"data"
+		]
+	},
+	annotations: writes,
+	run: async (args, context) => {
+		const resource = resourceOf(args);
+		const key = keyOf(args.key);
+		const data = dataOf(args.data);
+		if (!resource || key === void 0 || !data) return "Pass the resource, key and data as { \"resource\": \"<name>\", \"key\": \"<key>\", \"data\": { \"<field>\": <value> } }.";
+		const shownKey = Array.isArray(key) ? key.join(",") : String(key);
+		const answer = await context.approve({
+			title: `Update ${resource} ${shownKey}?`,
+			code: JSON.stringify(data, null, 2),
+			approveLabel: "Update"
+		});
+		if (answer !== "approved") return notApproved(answer);
+		const etag = typeof args.etag === "string" && args.etag ? args.etag : void 0;
+		return context.records.update(resource, key, data, { etag }).then((record) => JSON.stringify(record), refused);
+	}
+});
+/** `create_record` and `update_record`. */
+const writeRecordTools = () => [createRecordTool(), updateRecordTool()];
+//#endregion
+export { createRecordTool, updateRecordTool, writeRecordTools };

package/dist/create-admin.js

@@ -298,7 +298,8 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	else if (auth?.mcp && mcpAuthenticate) {
 		const tools = mcpTools({
 			db,
-			sql: options.mcp !== false && options.mcp?.sql === true
+			sql: options.mcp !== false && options.mcp?.sql === true,
+			writes: options.mcp !== false && options.mcp?.writes === true
 		});
 		const server = (session) => mcpServer({
 			info: {

package/dist/index.d.ts

@@ -89,6 +89,7 @@ import { WidgetOptions, maxWidgetPropsBytes, widget } from "./assistant/widget.j
 import { QueryOptions, QueryResult, runReadOnlyQuery, runReadWriteQuery } from "./assistant/run-query.js";
 import { readOnlyQueryTool, readWriteQueryTool } from "./assistant/query-tools.js";
 import { getRecordTool, listRecordsTool, listResourcesTool, readRecordTools } from "./assistant/record-tools.js";
+import { createRecordTool, updateRecordTool, writeRecordTools } from "./assistant/write-record-tools.js";
 import { McpServerInput, mcpServer } from "./mcp/mcp-server.js";
 import { McpToolsInput, mcpTools } from "./mcp/mcp-tools.js";
 import { McpGateInput, mcpGate, sessionOf } from "./mcp/mcp-gate.js";
@@ -123,4 +124,4 @@ import { isSchedule } from "./jobs/schedule.js";
 import { DrainResult, JobsRuntime, StartJobsOptions, startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
 import { checkJobsSchema, jobsSchema, jobsSchemaMigration } from "./jobs/schema.js";
-export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApiKeys, type ApiKeysOptions, type AppIcons, type AppIdentity, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type Caller, type CallerOptions, type CapturedRow, type CascadingKey, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryOptions, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type McpGateInput, type McpHandlerInput, type McpRoutesInput, type McpServerInput, type McpToolsInput, type MemberInput, MissingCredentials, type MobileConfig, ModelError, type ModelSettings, type NewOrganization, type NewUser, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReadableResources, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolAnnotations, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkQueryRunner, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, processor, queryRunnerMigration, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readWriteQueryTool, readableResources, realtimeLimits, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, sessionOf, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, waitUntil, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };
+export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApiKeys, type ApiKeysOptions, type AppIcons, type AppIdentity, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type Caller, type CallerOptions, type CapturedRow, type CascadingKey, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryOptions, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type McpGateInput, type McpHandlerInput, type McpRoutesInput, type McpServerInput, type McpToolsInput, type MemberInput, MissingCredentials, type MobileConfig, ModelError, type ModelSettings, type NewOrganization, type NewUser, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReadableResources, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolAnnotations, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkQueryRunner, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, processor, queryRunnerMigration, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readWriteQueryTool, readableResources, realtimeLimits, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, sessionOf, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, variantPath, verifySignature, verifyStandardWebhook, waitUntil, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };

package/dist/index.js

@@ -39,6 +39,7 @@ import { mcpHandler } from "./mcp/mcp-handler.js";
 import { mcpRoutes } from "./mcp/mcp-routes.js";
 import { mcpServer } from "./mcp/mcp-server.js";
 import { getRecordTool, listRecordsTool, listResourcesTool, readRecordTools } from "./assistant/record-tools.js";
+import { createRecordTool, updateRecordTool, writeRecordTools } from "./assistant/write-record-tools.js";
 import { mcpTools } from "./mcp/mcp-tools.js";
 import { addAppRoleToOwners, addMember, createOrganization, listOrganizations, removeMember, setMemberRoles } from "./better-auth/organizations/host.js";
 import { createUser, deleteUser, hasUsers, listUsers, roleChoices, setUserBanned, setUserRole } from "./better-auth/users.js";
@@ -94,4 +95,4 @@ import { aspectRatio, fileSize, fileType, imageSize, processor } from "./files/p
 import { defineEmail } from "./mail/define-email.js";
 import { startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
-export { FatalJobError, HttpProblem, MissingCredentials, ModelError, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkQueryRunner, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, processor, queryRunnerMigration, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readWriteQueryTool, readableResources, realtimeLimits, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, sessionOf, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, waitUntil, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };
+export { FatalJobError, HttpProblem, MissingCredentials, ModelError, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkQueryRunner, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, processor, queryRunnerMigration, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readWriteQueryTool, readableResources, realtimeLimits, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, sessionOf, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, variantPath, verifySignature, verifyStandardWebhook, waitUntil, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };

package/dist/mcp/mcp-approval.js

@@ -0,0 +1,57 @@
+import { inputRequired, inputResponse } from "@modelcontextprotocol/server";
+//#region src/mcp/mcp-approval.ts
+/** Thrown by `approve` over MCP when the request carries no answer yet: the server then asks the client for one. */
+var ApprovalNeeded = class extends Error {
+	request;
+	constructor(request) {
+		super("The user has not answered the approval yet");
+		this.request = request;
+	}
+};
+/**
+* `ToolContext.approve` over MCP, from the answers a retried call carries: approved only when the user accepted and
+* ticked `approve`, rejected on any other answer, and `ApprovalNeeded` when there is none yet.
+*/
+const mcpApproval = (inputResponses) => (request) => {
+	const answer = inputResponse(inputResponses, "approve");
+	if (answer.kind === "missing") return Promise.reject(new ApprovalNeeded(request));
+	if (answer.kind === "elicit" && answer.action === "accept" && answer.content?.approve === true) return Promise.resolve("approved");
+	return Promise.resolve("rejected");
+};
+const asksForms = (capabilities) => {
+	const elicitation = capabilities?.elicitation;
+	return elicitation !== void 0 && (elicitation.form !== void 0 || elicitation.url === void 0);
+};
+const messageOf = (request) => [
+	request.title,
+	request.body,
+	request.fields?.map(({ label, value }) => `${label}: ${value}`).join("\n"),
+	request.code
+].filter(Boolean).join("\n\n");
+const cannotAsk = {
+	content: [{
+		type: "text",
+		text: "This client cannot ask you to approve a change, so nothing was written; use a client that supports MCP elicitation."
+	}],
+	isError: true
+};
+/**
+* The answer to a call whose tool asked for approval: a form asking the user to approve `request` when the client can
+* show one, else a refusal. A 2025-protocol request declares no capabilities per request, so it is always refused.
+*/
+const approvalAsked = (request, capabilities) => {
+	if (!asksForms(capabilities)) return cannotAsk;
+	return inputRequired({ inputRequests: { approve: inputRequired.elicit({
+		message: messageOf(request),
+		requestedSchema: {
+			type: "object",
+			properties: { approve: {
+				type: "boolean",
+				title: request.approveLabel ?? "Approve"
+			} },
+			required: ["approve"]
+		}
+	}) } });
+};
+//#endregion
+export { ApprovalNeeded, approvalAsked, mcpApproval };

package/dist/mcp/mcp-authenticator.js

@@ -1,13 +1,14 @@
 //#region src/mcp/mcp-authenticator.ts
 const hasAudiences = (authenticate) => typeof authenticate.forAudience === "function";
-const isMcpOptions = (options) => options === void 0 || options === false || typeof options === "object" && options !== null && !Array.isArray(options) && Object.entries(options).every(([name, value]) => name === "sql" && (value === void 0 || typeof value === "boolean"));
+const isMcpOptions = (options) => options === void 0 || options === false || typeof options === "object" && options !== null && !Array.isArray(options) && Object.entries(options).every(([name, value]) => (name === "sql" || name === "writes") && (value === void 0 || typeof value === "boolean"));
 /**
 * The authenticator of the MCP endpoint's tokens, when MCP is on (`createAuth({ mcp })`); none when the host serves its
-* own (`options.mcp: false`). Stops the server at startup when `options.mcp` is neither `false` nor `{ sql?: boolean }`,
-* when it is set without MCP, or when `authenticate` cannot verify tokens for another audience.
+* own (`options.mcp: false`). Stops the server at startup when `options.mcp` is neither `false` nor
+* `{ sql?: boolean; writes?: boolean }`, when it is set without MCP, or when `authenticate` cannot verify tokens for
+* another audience.
 */
 const mcpAuthenticator = (authenticate, mcp, options) => {
-	if (!isMcpOptions(options)) throw new Error("options.mcp takes false or { sql?: boolean }");
+	if (!isMcpOptions(options)) throw new Error("options.mcp takes false or { sql?: boolean, writes?: boolean }");
 	if (options === false) return void 0;
 	if (options && !mcp) throw new Error("options.mcp needs createAuth({ mcp }) passed as auth");
 	if (!mcp) return void 0;

package/dist/mcp/mcp-context.d.ts

@@ -4,8 +4,8 @@ import { ToolContext } from "../assistant/tools.js";
 import { Meta } from "../meta.js";
 //#region src/mcp/mcp-context.d.ts
 /**
- * What tools get over MCP for `session`: the records and resources it may read, under its access rules. Nothing shows
- * beside a tool's result, and asking for approval fails: no read tool asks, and approval over MCP comes with writes.
+ * What tools get over MCP for `session`: its records and the resources it may read, under its access rules. Nothing
+ * shows beside a tool's result, and `mcpServer` gives each call its own `approve`.
  */
-export declare const mcpToolContext: (deps: Deps, meta: Pick<Meta, "forCaller">, session: Session) => ToolContext;
+export declare const mcpToolContext: (deps: Deps, meta: Pick<Meta, "forCaller">, session: Session) => Omit<ToolContext, "approve">;
 //#endregion

package/dist/mcp/mcp-context.js

@@ -2,15 +2,14 @@ import { assistantRecords } from "../assistant/records.js";
 import { readableResources } from "../assistant/readable-resources.js";
 //#region src/mcp/mcp-context.ts
 /**
-* What tools get over MCP for `session`: the records and resources it may read, under its access rules. Nothing shows
-* beside a tool's result, and asking for approval fails: no read tool asks, and approval over MCP comes with writes.
+* What tools get over MCP for `session`: its records and the resources it may read, under its access rules. Nothing
+* shows beside a tool's result, and `mcpServer` gives each call its own `approve`.
 */
 const mcpToolContext = (deps, meta, session) => ({
 	session,
 	records: assistantRecords(deps, session),
 	resources: () => readableResources(meta, session),
-	show: () => {},
-	approve: () => Promise.reject(/* @__PURE__ */ new Error("Not implemented: MCP tools cannot ask for approval yet"))
+	show: () => {}
 });
 //#endregion
 export { mcpToolContext };

package/dist/mcp/mcp-server.d.ts

@@ -9,11 +9,14 @@ export type McpServerInput = {
     title?: string;
   };
   tools: AssistantTool[];
-  /** What each tool gets as its context, for the caller of the request. */
-  context: ToolContext;
+  /** What each tool gets as its context, for the caller of the request; `approve` comes from each call's own answers. */
+  context: Omit<ToolContext, 'approve'>;
   /** Gets the errors a tool throws, which the client only sees as a failure. */
   report: (error: unknown) => void;
 };
-/** An MCP server offering `tools` as MCP tools, each with its JSON Schema, its hints, and the text it returns. */
+/**
+ * An MCP server offering `tools` as MCP tools, each with its JSON Schema, its hints, and the text it returns. A tool
+ * that asks for approval makes the call ask the client's user, and runs again from the start with their answer.
+ */
 export declare const mcpServer: ({ info, tools, context, report }: McpServerInput) => McpServer;
 //#endregion

package/dist/mcp/mcp-server.js

@@ -1,6 +1,8 @@
 import { checkedTools } from "../assistant/checked-tools.js";
-import { McpServer, fromJsonSchema } from "@modelcontextprotocol/server";
+import { ApprovalNeeded, approvalAsked, mcpApproval } from "./mcp-approval.js";
+import { CLIENT_CAPABILITIES_META_KEY, McpServer, fromJsonSchema } from "@modelcontextprotocol/server";
 //#region src/mcp/mcp-server.ts
+const capabilitiesOf = (envelope) => envelope?.[CLIENT_CAPABILITIES_META_KEY];
 const failed = {
 	content: [{
 		type: "text",
@@ -8,7 +10,10 @@ const failed = {
 	}],
 	isError: true
 };
-/** An MCP server offering `tools` as MCP tools, each with its JSON Schema, its hints, and the text it returns. */
+/**
+* An MCP server offering `tools` as MCP tools, each with its JSON Schema, its hints, and the text it returns. A tool
+* that asks for approval makes the call ask the client's user, and runs again from the start with their answer.
+*/
 const mcpServer = ({ info, tools, context, report }) => {
 	const server = new McpServer(info);
 	for (const tool of checkedTools(tools)) {
@@ -17,13 +22,17 @@ const mcpServer = ({ info, tools, context, report }) => {
 			inputSchema: fromJsonSchema(tool.parameters),
 			...tool.annotations && { annotations: tool.annotations }
 		};
-		server.registerTool(tool.name, config, async (args) => {
+		server.registerTool(tool.name, config, async (args, ctx) => {
 			try {
 				return { content: [{
 					type: "text",
-					text: await tool.run(args, context)
+					text: await tool.run(args, {
+						...context,
+						approve: mcpApproval(ctx.mcpReq.inputResponses)
+					})
 				}] };
 			} catch (error) {
+				if (error instanceof ApprovalNeeded) return approvalAsked(error.request, capabilitiesOf(ctx.mcpReq.envelope));
 				report(error);
 				return failed;
 			}

package/dist/mcp/mcp-tools.d.ts

@@ -6,7 +6,12 @@ export type McpToolsInput = {
   db: Db;
   /** Offers `run_read_only_query` to callers who see the assistant (`admin` or `ai`); it reads outside the access rules. */
   sql: boolean;
+  /** Offers `create_record` and `update_record`; each write still needs the caller's role and their approval in the client. */
+  writes: boolean;
 };
-/** The default MCP tools for a caller: the record tools, and read-only SQL when `sql` is on and the caller sees the assistant. */
-export declare const mcpTools: ({ db, sql }: McpToolsInput) => (session: Session) => AssistantTool[];
+/**
+ * The default MCP tools for a caller: the record tools, the write tools when `writes` is on, and read-only SQL when `sql`
+ * is on and the caller sees the assistant.
+ */
+export declare const mcpTools: ({ db, sql, writes }: McpToolsInput) => (session: Session) => AssistantTool[];
 //#endregion

package/dist/mcp/mcp-tools.js

@@ -1,8 +1,16 @@
 import { seesAssistant } from "../assistant/assistant-settings.js";
 import { readOnlyQueryTool } from "../assistant/query-tools.js";
 import { readRecordTools } from "../assistant/record-tools.js";
+import { writeRecordTools } from "../assistant/write-record-tools.js";
 //#region src/mcp/mcp-tools.ts
-/** The default MCP tools for a caller: the record tools, and read-only SQL when `sql` is on and the caller sees the assistant. */
-const mcpTools = ({ db, sql }) => (session) => [...readRecordTools(), ...sql && seesAssistant(session.user.roles) ? [readOnlyQueryTool(db)] : []];
+/**
+* The default MCP tools for a caller: the record tools, the write tools when `writes` is on, and read-only SQL when `sql`
+* is on and the caller sees the assistant.
+*/
+const mcpTools = ({ db, sql, writes }) => (session) => [
+	...readRecordTools(),
+	...writes ? writeRecordTools() : [],
+	...sql && seesAssistant(session.user.roles) ? [readOnlyQueryTool(db)] : []
+];
 //#endregion
 export { mcpTools };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.40.5",
+  "version": "0.40.6",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -36,9 +36,9 @@
     "@better-auth/passkey": "^1.7.12",
     "@better-auth/sso": "^1.7.12",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.40.5",
-    "@protobase/query": "0.40.5",
-    "@protobase/schema": "0.40.5",
+    "@protobase/layout": "0.40.6",
+    "@protobase/query": "0.40.6",
+    "@protobase/schema": "0.40.6",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",