@protobase/server 0.40.5 → 0.40.7

package/dist/admin-options.d.ts

@@ -55,11 +55,14 @@ export type AdminOptions = {
   /**
    * The MCP endpoint, on with `createAuth({ mcp })`. `sql: true` also offers admins and the `ai` role
    * `run_read_only_query`, which reads the whole database as the app's database role, outside the access rules.
+   * `writes: true` offers `create_record` and `update_record`, through the REST API's access rules, `validate` and write
+   * hooks; the person approves each write in their client, and a client that cannot ask is refused.
    * `false`: the host serves its own MCP endpoint at `auth.mcp.path`, in front of this app. This app then answers 404
    * there and needs no `forAudience`, while the OAuth provider's discovery stays.
    */
   mcp?: {
     sql?: boolean;
+    writes?: boolean;
   } | false;
   /**
    * The websites whose browser code may call the API (`/api/*` but `/api/auth/*`) besides the app's own origins (see

package/dist/assistant/record-tool-args.js

@@ -0,0 +1,33 @@
+import { HttpProblem } from "../problem.js";
+//#region src/assistant/record-tool-args.ts
+/** A refusal the model can act on (no such resource, not allowed, a bad filter) is its to read; anything else fails the call. */
+const refused = (error) => {
+	if (error instanceof HttpProblem && error.status < 500) return JSON.stringify({
+		error: error.slug,
+		message: error.detail
+	});
+	throw error;
+};
+const resourceOf = (args) => typeof args.resource === "string" && args.resource ? args.resource : void 0;
+const keyOf = (value) => {
+	if (typeof value === "string" || typeof value === "number") return value;
+	if (Array.isArray(value) && value.length > 0 && value.every((part) => typeof part === "string" || typeof part === "number")) return value;
+};
+const resourceParameter = {
+	type: "string",
+	description: "The resource's name, as list_resources gives it."
+};
+const keyParameter = {
+	description: "The record's key: its value, or the values of its key fields in order when the key has several.",
+	anyOf: [
+		{ type: "string" },
+		{ type: "number" },
+		{
+			type: "array",
+			items: { type: ["string", "number"] },
+			minItems: 1
+		}
+	]
+};
+//#endregion
+export { keyOf, keyParameter, refused, resourceOf, resourceParameter };

package/dist/assistant/record-tools.js

@@ -1,5 +1,5 @@
-import { HttpProblem } from "../problem.js";
 import { defineTool } from "./tools.js";
+import { keyOf, keyParameter, refused, resourceOf, resourceParameter } from "./record-tool-args.js";
 //#region src/assistant/record-tools.ts
 const readOnly = {
 	readOnlyHint: true,
@@ -7,13 +7,6 @@ const readOnly = {
 };
 const defaultPageSize = 20;
 const maxPageSize = 100;
-const refused = (error) => {
-	if (error instanceof HttpProblem && error.status < 500) return JSON.stringify({
-		error: error.slug,
-		message: error.detail
-	});
-	throw error;
-};
 const fieldEntry = (field, view) => {
 	const hint = view?.fields[field.name];
 	return {
@@ -37,15 +30,6 @@ const resourceEntry = (model, view) => ({
 	fields: Object.values(model.fields).map((field) => fieldEntry(field, view))
 });
 const described = ({ models, views }) => models.map((model) => resourceEntry(model, views.find((view) => view.resource === model.name)));
-const resourceOf = (args) => typeof args.resource === "string" && args.resource ? args.resource : void 0;
-const keyOf = (value) => {
-	if (typeof value === "string" || typeof value === "number") return value;
-	if (Array.isArray(value) && value.length > 0 && value.every((part) => typeof part === "string" || typeof part === "number")) return value;
-};
-const resourceParameter = {
-	type: "string",
-	description: "The resource's name, as list_resources gives it."
-};
 /** Lists the resources the caller may read, with their fields, labels and which fields filters and sorts take. */
 const listResourcesTool = () => defineTool({
 	name: "list_resources",
@@ -107,18 +91,7 @@ const getRecordTool = () => defineTool({
 		type: "object",
 		properties: {
 			resource: resourceParameter,
-			key: {
-				description: "The record's key: its value, or the values of its key fields in order when the key has several.",
-				anyOf: [
-					{ type: "string" },
-					{ type: "number" },
-					{
-						type: "array",
-						items: { type: ["string", "number"] },
-						minItems: 1
-					}
-				]
-			}
+			key: keyParameter
 		},
 		required: ["resource", "key"]
 	},

package/dist/assistant/write-record-tools.d.ts

@@ -0,0 +1,9 @@
+import { AssistantTool } from "./tools.js";
+//#region src/assistant/write-record-tools.d.ts
+/** Creates a record of a resource once the user approves it, under the caller's access rules. */
+export declare const createRecordTool: () => AssistantTool;
+/** Updates one record by its key once the user approves it, under the caller's access rules. */
+export declare const updateRecordTool: () => AssistantTool;
+/** `create_record` and `update_record`. */
+export declare const writeRecordTools: () => AssistantTool[];
+//#endregion

package/dist/assistant/write-record-tools.js

@@ -0,0 +1,85 @@
+import { defineTool } from "./tools.js";
+import { keyOf, keyParameter, refused, resourceOf, resourceParameter } from "./record-tool-args.js";
+//#region src/assistant/write-record-tools.ts
+const writes = {
+	readOnlyHint: false,
+	destructiveHint: false,
+	openWorldHint: false
+};
+const dataParameter = {
+	type: "object",
+	description: "Field names to values, as list_resources gives the fields."
+};
+const dataOf = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+const notApproved = (answer) => `The user did not approve this change (${answer}); nothing was written.`;
+/** Creates a record of a resource once the user approves it, under the caller's access rules. */
+const createRecordTool = () => defineTool({
+	name: "create_record",
+	description: "Creates a record of a resource and returns it as JSON ({ record, etag }). The user approves each write in their client first; nothing is written without it.",
+	parameters: {
+		type: "object",
+		properties: {
+			resource: resourceParameter,
+			data: dataParameter
+		},
+		required: ["resource", "data"]
+	},
+	annotations: writes,
+	run: async (args, context) => {
+		const resource = resourceOf(args);
+		const data = dataOf(args.data);
+		if (!resource || !data) return "Pass the resource and data as { \"resource\": \"<name>\", \"data\": { \"<field>\": <value> } }.";
+		const answer = await context.approve({
+			title: `Create a record in ${resource}?`,
+			code: JSON.stringify(data, null, 2),
+			approveLabel: "Create"
+		});
+		if (answer !== "approved") return notApproved(answer);
+		return context.records.create(resource, data).then((record) => JSON.stringify(record), refused);
+	}
+});
+/** Updates one record by its key once the user approves it, under the caller's access rules. */
+const updateRecordTool = () => defineTool({
+	name: "update_record",
+	description: "Updates fields of one record of a resource by its key and returns it as JSON ({ record, etag }). Pass the etag get_record gave to fail when someone changed the record since. The user approves each write in their client first; nothing is written without it.",
+	parameters: {
+		type: "object",
+		properties: {
+			resource: resourceParameter,
+			key: keyParameter,
+			data: {
+				...dataParameter,
+				description: "The fields to change, names to new values, as list_resources gives the fields."
+			},
+			etag: {
+				type: "string",
+				description: "The etag get_record gave, to fail when the record changed since."
+			}
+		},
+		required: [
+			"resource",
+			"key",
+			"data"
+		]
+	},
+	annotations: writes,
+	run: async (args, context) => {
+		const resource = resourceOf(args);
+		const key = keyOf(args.key);
+		const data = dataOf(args.data);
+		if (!resource || key === void 0 || !data) return "Pass the resource, key and data as { \"resource\": \"<name>\", \"key\": \"<key>\", \"data\": { \"<field>\": <value> } }.";
+		const shownKey = Array.isArray(key) ? key.join(",") : String(key);
+		const answer = await context.approve({
+			title: `Update ${resource} ${shownKey}?`,
+			code: JSON.stringify(data, null, 2),
+			approveLabel: "Update"
+		});
+		if (answer !== "approved") return notApproved(answer);
+		const etag = typeof args.etag === "string" && args.etag ? args.etag : void 0;
+		return context.records.update(resource, key, data, { etag }).then((record) => JSON.stringify(record), refused);
+	}
+});
+/** `create_record` and `update_record`. */
+const writeRecordTools = () => [createRecordTool(), updateRecordTool()];
+//#endregion
+export { createRecordTool, updateRecordTool, writeRecordTools };

package/dist/better-auth/authenticator.d.ts

@@ -31,7 +31,9 @@ export type BetterAuthAuthenticator = Authenticator & {
    * An authenticator for the OAuth access tokens issued for `audience` alone: the app's keys, a `typ` of `at+jwt`, and
    * proof of the key for a DPoP-bound token, checked against `audience` as the URL it guards (the endpoint must answer
    * at exactly that URL). The app's own tokens and trusted apps' are refused; the session keeps the token's `client`.
-   * With `jwksUrl` instead of `auth`, a DPoP proof's single use holds in this process only.
+   * With `auth`, every request also reads the store to check that the person still allows the client
+   * (`checkMcpGrant`), so a disconnected client or a secured account ends its tokens at once. With `jwksUrl` instead of
+   * `auth`, a token works until it expires, and a DPoP proof's single use holds in this process only.
    */
   forAudience: (audience: string) => Authenticator;
 };

package/dist/better-auth/authenticator.js

@@ -2,6 +2,7 @@ import { jwtSessions } from "../auth/jwt.js";
 import { noGlobalRole } from "./organizations/role-definitions.js";
 import { cachedKeys } from "./jwks-cache.js";
 import { withTrustedApps } from "./app-tokens.js";
+import { checkMcpGrant } from "./mcp/grant-standing.js";
 import { checkTokenStanding, tokenClaims } from "./token-standing.js";
 import { createDpopReplayStore, createInMemoryDpopReplayStore } from "better-auth/oauth2";
 //#region src/better-auth/authenticator.ts
@@ -43,7 +44,7 @@ const betterAuthAuthenticator = (options) => {
 		});
 		const verify = async (request) => {
 			const { payload, session } = await sessions(request);
-			if (auth && standing) await checkTokenStanding(await auth.$context, tokenClaims(payload, session.user.roles, organizations ? session.tenant : void 0), organizations);
+			if (auth) await standing(await auth.$context, payload, session);
 			return session;
 		};
 		if (!organizations) return verify;
@@ -62,7 +63,13 @@ const betterAuthAuthenticator = (options) => {
 	};
 	let replayStore;
 	const dpopReplayStore = () => replayStore ??= options.auth ? options.auth.$context.then(({ internalAdapter }) => createDpopReplayStore(internalAdapter)) : Promise.resolve(createInMemoryDpopReplayStore());
-	const own = sessionOf({ audience: options.audience ?? issuer }, true);
+	const ownStanding = (context, payload, session) => checkTokenStanding(context, tokenClaims(payload, session.user.roles, organizations ? session.tenant : void 0), organizations);
+	const own = sessionOf({ audience: options.audience ?? issuer }, ownStanding);
+	const grantStanding = (context, payload, session) => checkMcpGrant(context.adapter, {
+		userId: payload.sub,
+		clientId: session.client?.id,
+		issuedAt: payload.iat
+	});
 	return Object.assign(withTrustedApps(own, issuer, options.apps ?? []), { forAudience: (audience) => sessionOf({
 		audience,
 		typ: "at+jwt",
@@ -71,7 +78,7 @@ const betterAuthAuthenticator = (options) => {
 			replayStore: dpopReplayStore
 		},
 		oauthClient: true
-	}, false) });
+	}, grantStanding) });
 };
 //#endregion
 export { betterAuthAuthenticator, betterAuthTokens };

package/dist/better-auth/create-auth.d.ts

@@ -8446,6 +8446,24 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
         handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
       }[];
     };
+  } | {
+    id: "protobase-mcp-refresh-reuse";
+    hooks: {
+      before: {
+        matcher: (context: {
+          path?: string;
+          body?: unknown;
+        }) => boolean;
+        handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
+      }[];
+      after: {
+        matcher: (context: {
+          path?: string;
+          body?: unknown;
+        }) => boolean;
+        handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
+      }[];
+    };
   } | {
     id: "protobase-mcp-connected-apps";
     endpoints: {

package/dist/better-auth/mcp/grant-standing.js

@@ -0,0 +1,26 @@
+import { unauthorized } from "../../problem.js";
+import "./consent-check.js";
+//#region src/better-auth/mcp/grant-standing.ts
+/**
+* Whether an MCP access token's grant still stands, read from the store on every request: the person still allows its
+* client with a consent made no later than the token. Disconnecting the client, or securing the account, deletes the
+* consents (`revokeMcpGrants`), so its access tokens stop at once instead of working out their 15 minutes, and stay
+* stopped when the person allows the client again, whose new consent is newer than them. Not the browser session that
+* allowed the client: the grant outlives it. A lookup that fails is not caught.
+*/
+const checkMcpGrant = async (adapter, { userId, clientId, issuedAt }) => {
+	if (clientId === void 0) throw unauthorized("The access token names no client");
+	if (issuedAt === void 0) throw unauthorized("The access token has no issue time");
+	if (!(await adapter.findMany({
+		model: "oauthConsent",
+		where: [{
+			field: "userId",
+			value: userId
+		}, {
+			field: "clientId",
+			value: clientId
+		}]
+	})).some((consent) => new Date(consent.createdAt).getTime() <= issuedAt * 1e3)) throw unauthorized("The client was disconnected: connect it again");
+};
+//#endregion
+export { checkMcpGrant };

package/dist/better-auth/mcp/mcp-plugins.js

@@ -4,6 +4,7 @@ import { pluginNames } from "../snake-case-names.js";
 import { mcpConnectedApps } from "./connected-apps.js";
 import { consentReference } from "./consent-reference.js";
 import { mcpTokenClaims } from "./mcp-token-claims.js";
+import { mcpRefreshReuse } from "./refresh-reuse.js";
 import { mcpRequestDefaults } from "./request-defaults.js";
 import { mcpSetupGate } from "./setup-gate.js";
 import { mcpSignedQueryGuard } from "./signed-query-guard.js";
@@ -56,7 +57,8 @@ const mcpUnusedPaths = [
 /**
 * The Better Auth plugins of an OAuth provider for MCP clients, after the `jwt` plugin, in this order: the guard on
 * signed queries, the request defaults, the setup gate, the provider (`mcp()`), and client metadata documents
-* (`cimd()`), the revocation when the account is secured (`mcpGrantRevocation`), and the person's list of connected
+* (`cimd()`), the revocation when the account is secured (`mcpGrantRevocation`) or a refresh token is reused
+* (`mcpRefreshReuse`), and the person's list of connected
 * apps, where they disconnect one (`mcpConnectedApps`). A client registers itself, the person signs in on the app's own pages and allows it on the connect
 * page, and the client gets 15-minute access tokens for the MCP resource only, with refresh tokens, carrying the role
 * and organization the person worked in when they allowed it.
@@ -101,6 +103,7 @@ const mcpAuthPlugins = ({ mcp: resolved, organizations, mail, defaultPolicy, def
 		metadataProfile: "mcp-2026-07-28"
 	}),
 	mcpGrantRevocation(),
+	mcpRefreshReuse(),
 	mcpConnectedApps({ definitions })
 ];
 //#endregion

package/dist/better-auth/mcp/refresh-reuse.js

@@ -0,0 +1,66 @@
+import { revokeMcpGrants } from "./revoke-grants.js";
+import { base64url } from "jose";
+import { createAuthMiddleware } from "better-auth/api";
+//#region src/better-auth/mcp/refresh-reuse.ts
+const refreshModel = "oauthRefreshToken";
+/** The refresh token a request to the token or revocation endpoint presents, or `undefined`. */
+const presentedRefreshToken = (path, body) => {
+	if (typeof body !== "object" || body === null) return void 0;
+	const params = body;
+	if (path === "/oauth2/token" && params.grant_type === "refresh_token" && typeof params.refresh_token === "string") return params.refresh_token;
+	if (path === "/oauth2/revoke" && params.token_type_hint !== "access_token" && typeof params.token === "string") return params.token;
+};
+const storedToken = async (token) => base64url.encode(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(token))));
+/** The stored row of a refresh token, before the provider handles it. */
+const findRefreshToken = async (adapter, token) => await adapter.findOne({
+	model: refreshModel,
+	where: [{
+		field: "token",
+		value: await storedToken(token)
+	}]
+}) ?? void 0;
+/**
+* Ends the grant after the provider took a refresh token for stolen: when a rotated one is presented again, it deletes
+* every refresh token of that client and person (`invalidateRefreshFamily`) but leaves the consent, so the access
+* tokens would still be taken. A row the request found before and that is gone after was deleted that way, so the
+* grant is revoked (`revokeMcpGrants`), and the client's access tokens stop at once (`checkMcpGrant`).
+*/
+const endGrantIfFamilyInvalidated = async (adapter, before) => {
+	if (await adapter.findOne({
+		model: refreshModel,
+		where: [{
+			field: "id",
+			value: before.id
+		}]
+	})) return;
+	await revokeMcpGrants(adapter, before.userId, before.clientId);
+};
+/**
+* Hooks around the token and revocation endpoints that disconnect a client whose refresh token was reused
+* (`endGrantIfFamilyInvalidated`). A failure to read or delete is not caught: the request answers 500.
+*/
+const mcpRefreshReuse = () => {
+	const found = /* @__PURE__ */ new WeakMap();
+	const matcher = (context) => presentedRefreshToken(context.path, context.body) !== void 0;
+	return {
+		id: "protobase-mcp-refresh-reuse",
+		hooks: {
+			before: [{
+				matcher,
+				handler: createAuthMiddleware(async (ctx) => {
+					const row = await findRefreshToken(ctx.context.adapter, presentedRefreshToken(ctx.path, ctx.body));
+					if (row) found.set(ctx.context, row);
+				})
+			}],
+			after: [{
+				matcher,
+				handler: createAuthMiddleware(async (ctx) => {
+					const row = found.get(ctx.context);
+					if (row) await endGrantIfFamilyInvalidated(ctx.context.adapter, row);
+				})
+			}]
+		}
+	};
+};
+//#endregion
+export { endGrantIfFamilyInvalidated, findRefreshToken, mcpRefreshReuse, presentedRefreshToken };

package/dist/better-auth/mcp/revoke-grants.js

@@ -3,9 +3,9 @@ import { createAuthMiddleware } from "better-auth/api";
 //#region src/better-auth/mcp/revoke-grants.ts
 /**
 * Disconnects the user's MCP clients, or only `clientId`: deletes their consents, then their access tokens and refresh
-* tokens. Without the consent no code or refresh is exchanged any more (`mcpConsentCheck`), and authorize asks the
-* person again; access tokens already issued work out their 15 minutes. Access tokens go before refresh tokens, as the
-* provider's own revocation does, since an access token's row may name its refresh token.
+* tokens. Without the consent no code or refresh is exchanged any more (`mcpConsentCheck`), access tokens already
+* issued are refused at the next request (`checkMcpGrant`), and authorize asks the person again. Access tokens go
+* before refresh tokens, as the provider's own revocation does, since an access token's row may name its refresh token.
 */
 const revokeMcpGrants = async (adapter, userId, clientId) => {
 	const where = [{

package/dist/better-auth/operator-provider.js

@@ -47,10 +47,10 @@ const resolveOperator = (provider) => {
 		sessionMinutes
 	};
 };
-const base64url = (bytes) => btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+const base64url$1 = (bytes) => btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 /** A random value for `state`, `nonce` and the PKCE verifier. */
-const randomValue = () => base64url(crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32)));
-const challengeOf = async (verifier) => base64url(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier))));
+const randomValue = () => base64url$1(crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32)));
+const challengeOf = async (verifier) => base64url$1(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier))));
 /**
 * An OpenID Connect client of the operator provider: the authorization code flow with PKCE, a client secret, and an
 * ID token verified against the provider's keys, issuer, this client and the nonce. The provider's settings and keys

package/dist/create-admin.js

@@ -298,7 +298,8 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	else if (auth?.mcp && mcpAuthenticate) {
 		const tools = mcpTools({
 			db,
-			sql: options.mcp !== false && options.mcp?.sql === true
+			sql: options.mcp !== false && options.mcp?.sql === true,
+			writes: options.mcp !== false && options.mcp?.writes === true
 		});
 		const server = (session) => mcpServer({
 			info: {

package/dist/index.d.ts

@@ -89,6 +89,7 @@ import { WidgetOptions, maxWidgetPropsBytes, widget } from "./assistant/widget.j
 import { QueryOptions, QueryResult, runReadOnlyQuery, runReadWriteQuery } from "./assistant/run-query.js";
 import { readOnlyQueryTool, readWriteQueryTool } from "./assistant/query-tools.js";
 import { getRecordTool, listRecordsTool, listResourcesTool, readRecordTools } from "./assistant/record-tools.js";
+import { createRecordTool, updateRecordTool, writeRecordTools } from "./assistant/write-record-tools.js";
 import { McpServerInput, mcpServer } from "./mcp/mcp-server.js";
 import { McpToolsInput, mcpTools } from "./mcp/mcp-tools.js";
 import { McpGateInput, mcpGate, sessionOf } from "./mcp/mcp-gate.js";
@@ -123,4 +124,4 @@ import { isSchedule } from "./jobs/schedule.js";
 import { DrainResult, JobsRuntime, StartJobsOptions, startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
 import { checkJobsSchema, jobsSchema, jobsSchemaMigration } from "./jobs/schema.js";
-export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApiKeys, type ApiKeysOptions, type AppIcons, type AppIdentity, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type Caller, type CallerOptions, type CapturedRow, type CascadingKey, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryOptions, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type McpGateInput, type McpHandlerInput, type McpRoutesInput, type McpServerInput, type McpToolsInput, type MemberInput, MissingCredentials, type MobileConfig, ModelError, type ModelSettings, type NewOrganization, type NewUser, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReadableResources, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolAnnotations, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkQueryRunner, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, processor, queryRunnerMigration, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readWriteQueryTool, readableResources, realtimeLimits, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, sessionOf, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, waitUntil, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };
+export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApiKeys, type ApiKeysOptions, type AppIcons, type AppIdentity, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type Caller, type CallerOptions, type CapturedRow, type CascadingKey, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryOptions, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type McpGateInput, type McpHandlerInput, type McpRoutesInput, type McpServerInput, type McpToolsInput, type MemberInput, MissingCredentials, type MobileConfig, ModelError, type ModelSettings, type NewOrganization, type NewUser, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReadableResources, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolAnnotations, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkQueryRunner, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, processor, queryRunnerMigration, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readWriteQueryTool, readableResources, realtimeLimits, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, sessionOf, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, variantPath, verifySignature, verifyStandardWebhook, waitUntil, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };

package/dist/index.js

@@ -39,6 +39,7 @@ import { mcpHandler } from "./mcp/mcp-handler.js";
 import { mcpRoutes } from "./mcp/mcp-routes.js";
 import { mcpServer } from "./mcp/mcp-server.js";
 import { getRecordTool, listRecordsTool, listResourcesTool, readRecordTools } from "./assistant/record-tools.js";
+import { createRecordTool, updateRecordTool, writeRecordTools } from "./assistant/write-record-tools.js";
 import { mcpTools } from "./mcp/mcp-tools.js";
 import { addAppRoleToOwners, addMember, createOrganization, listOrganizations, removeMember, setMemberRoles } from "./better-auth/organizations/host.js";
 import { createUser, deleteUser, hasUsers, listUsers, roleChoices, setUserBanned, setUserRole } from "./better-auth/users.js";
@@ -94,4 +95,4 @@ import { aspectRatio, fileSize, fileType, imageSize, processor } from "./files/p
 import { defineEmail } from "./mail/define-email.js";
 import { startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
-export { FatalJobError, HttpProblem, MissingCredentials, ModelError, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkQueryRunner, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, processor, queryRunnerMigration, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readWriteQueryTool, readableResources, realtimeLimits, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, sessionOf, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, waitUntil, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };
+export { FatalJobError, HttpProblem, MissingCredentials, ModelError, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkQueryRunner, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, processor, queryRunnerMigration, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readWriteQueryTool, readableResources, realtimeLimits, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, sessionOf, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, variantPath, verifySignature, verifyStandardWebhook, waitUntil, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };

package/dist/mcp/mcp-approval.js

@@ -0,0 +1,57 @@
+import { inputRequired, inputResponse } from "@modelcontextprotocol/server";
+//#region src/mcp/mcp-approval.ts
+/** Thrown by `approve` over MCP when the request carries no answer yet: the server then asks the client for one. */
+var ApprovalNeeded = class extends Error {
+	request;
+	constructor(request) {
+		super("The user has not answered the approval yet");
+		this.request = request;
+	}
+};
+/**
+* `ToolContext.approve` over MCP, from the answers a retried call carries: approved only when the user accepted and
+* ticked `approve`, rejected on any other answer, and `ApprovalNeeded` when there is none yet.
+*/
+const mcpApproval = (inputResponses) => (request) => {
+	const answer = inputResponse(inputResponses, "approve");
+	if (answer.kind === "missing") return Promise.reject(new ApprovalNeeded(request));
+	if (answer.kind === "elicit" && answer.action === "accept" && answer.content?.approve === true) return Promise.resolve("approved");
+	return Promise.resolve("rejected");
+};
+const asksForms = (capabilities) => {
+	const elicitation = capabilities?.elicitation;
+	return elicitation !== void 0 && (elicitation.form !== void 0 || elicitation.url === void 0);
+};
+const messageOf = (request) => [
+	request.title,
+	request.body,
+	request.fields?.map(({ label, value }) => `${label}: ${value}`).join("\n"),
+	request.code
+].filter(Boolean).join("\n\n");
+const cannotAsk = {
+	content: [{
+		type: "text",
+		text: "This client cannot ask you to approve a change, so nothing was written; use a client that supports MCP elicitation."
+	}],
+	isError: true
+};
+/**
+* The answer to a call whose tool asked for approval: a form asking the user to approve `request` when the client can
+* show one, else a refusal. A 2025-protocol request declares no capabilities per request, so it is always refused.
+*/
+const approvalAsked = (request, capabilities) => {
+	if (!asksForms(capabilities)) return cannotAsk;
+	return inputRequired({ inputRequests: { approve: inputRequired.elicit({
+		message: messageOf(request),
+		requestedSchema: {
+			type: "object",
+			properties: { approve: {
+				type: "boolean",
+				title: request.approveLabel ?? "Approve"
+			} },
+			required: ["approve"]
+		}
+	}) } });
+};
+//#endregion
+export { ApprovalNeeded, approvalAsked, mcpApproval };

package/dist/mcp/mcp-authenticator.js

@@ -1,13 +1,14 @@
 //#region src/mcp/mcp-authenticator.ts
 const hasAudiences = (authenticate) => typeof authenticate.forAudience === "function";
-const isMcpOptions = (options) => options === void 0 || options === false || typeof options === "object" && options !== null && !Array.isArray(options) && Object.entries(options).every(([name, value]) => name === "sql" && (value === void 0 || typeof value === "boolean"));
+const isMcpOptions = (options) => options === void 0 || options === false || typeof options === "object" && options !== null && !Array.isArray(options) && Object.entries(options).every(([name, value]) => (name === "sql" || name === "writes") && (value === void 0 || typeof value === "boolean"));
 /**
 * The authenticator of the MCP endpoint's tokens, when MCP is on (`createAuth({ mcp })`); none when the host serves its
-* own (`options.mcp: false`). Stops the server at startup when `options.mcp` is neither `false` nor `{ sql?: boolean }`,
-* when it is set without MCP, or when `authenticate` cannot verify tokens for another audience.
+* own (`options.mcp: false`). Stops the server at startup when `options.mcp` is neither `false` nor
+* `{ sql?: boolean; writes?: boolean }`, when it is set without MCP, or when `authenticate` cannot verify tokens for
+* another audience.
 */
 const mcpAuthenticator = (authenticate, mcp, options) => {
-	if (!isMcpOptions(options)) throw new Error("options.mcp takes false or { sql?: boolean }");
+	if (!isMcpOptions(options)) throw new Error("options.mcp takes false or { sql?: boolean, writes?: boolean }");
 	if (options === false) return void 0;
 	if (options && !mcp) throw new Error("options.mcp needs createAuth({ mcp }) passed as auth");
 	if (!mcp) return void 0;

package/dist/mcp/mcp-context.d.ts

@@ -4,8 +4,8 @@ import { ToolContext } from "../assistant/tools.js";
 import { Meta } from "../meta.js";
 //#region src/mcp/mcp-context.d.ts
 /**
- * What tools get over MCP for `session`: the records and resources it may read, under its access rules. Nothing shows
- * beside a tool's result, and asking for approval fails: no read tool asks, and approval over MCP comes with writes.
+ * What tools get over MCP for `session`: its records and the resources it may read, under its access rules. Nothing
+ * shows beside a tool's result, and `mcpServer` gives each call its own `approve`.
  */
-export declare const mcpToolContext: (deps: Deps, meta: Pick<Meta, "forCaller">, session: Session) => ToolContext;
+export declare const mcpToolContext: (deps: Deps, meta: Pick<Meta, "forCaller">, session: Session) => Omit<ToolContext, "approve">;
 //#endregion

package/dist/mcp/mcp-context.js

@@ -2,15 +2,14 @@ import { assistantRecords } from "../assistant/records.js";
 import { readableResources } from "../assistant/readable-resources.js";
 //#region src/mcp/mcp-context.ts
 /**
-* What tools get over MCP for `session`: the records and resources it may read, under its access rules. Nothing shows
-* beside a tool's result, and asking for approval fails: no read tool asks, and approval over MCP comes with writes.
+* What tools get over MCP for `session`: its records and the resources it may read, under its access rules. Nothing
+* shows beside a tool's result, and `mcpServer` gives each call its own `approve`.
 */
 const mcpToolContext = (deps, meta, session) => ({
 	session,
 	records: assistantRecords(deps, session),
 	resources: () => readableResources(meta, session),
-	show: () => {},
-	approve: () => Promise.reject(/* @__PURE__ */ new Error("Not implemented: MCP tools cannot ask for approval yet"))
+	show: () => {}
 });
 //#endregion
 export { mcpToolContext };

package/dist/mcp/mcp-server.d.ts

@@ -9,11 +9,14 @@ export type McpServerInput = {
     title?: string;
   };
   tools: AssistantTool[];
-  /** What each tool gets as its context, for the caller of the request. */
-  context: ToolContext;
+  /** What each tool gets as its context, for the caller of the request; `approve` comes from each call's own answers. */
+  context: Omit<ToolContext, 'approve'>;
   /** Gets the errors a tool throws, which the client only sees as a failure. */
   report: (error: unknown) => void;
 };
-/** An MCP server offering `tools` as MCP tools, each with its JSON Schema, its hints, and the text it returns. */
+/**
+ * An MCP server offering `tools` as MCP tools, each with its JSON Schema, its hints, and the text it returns. A tool
+ * that asks for approval makes the call ask the client's user, and runs again from the start with their answer.
+ */
 export declare const mcpServer: ({ info, tools, context, report }: McpServerInput) => McpServer;
 //#endregion

package/dist/mcp/mcp-server.js

@@ -1,6 +1,8 @@
 import { checkedTools } from "../assistant/checked-tools.js";
-import { McpServer, fromJsonSchema } from "@modelcontextprotocol/server";
+import { ApprovalNeeded, approvalAsked, mcpApproval } from "./mcp-approval.js";
+import { CLIENT_CAPABILITIES_META_KEY, McpServer, fromJsonSchema } from "@modelcontextprotocol/server";
 //#region src/mcp/mcp-server.ts
+const capabilitiesOf = (envelope) => envelope?.[CLIENT_CAPABILITIES_META_KEY];
 const failed = {
 	content: [{
 		type: "text",
@@ -8,7 +10,10 @@ const failed = {
 	}],
 	isError: true
 };
-/** An MCP server offering `tools` as MCP tools, each with its JSON Schema, its hints, and the text it returns. */
+/**
+* An MCP server offering `tools` as MCP tools, each with its JSON Schema, its hints, and the text it returns. A tool
+* that asks for approval makes the call ask the client's user, and runs again from the start with their answer.
+*/
 const mcpServer = ({ info, tools, context, report }) => {
 	const server = new McpServer(info);
 	for (const tool of checkedTools(tools)) {
@@ -17,13 +22,17 @@ const mcpServer = ({ info, tools, context, report }) => {
 			inputSchema: fromJsonSchema(tool.parameters),
 			...tool.annotations && { annotations: tool.annotations }
 		};
-		server.registerTool(tool.name, config, async (args) => {
+		server.registerTool(tool.name, config, async (args, ctx) => {
 			try {
 				return { content: [{
 					type: "text",
-					text: await tool.run(args, context)
+					text: await tool.run(args, {
+						...context,
+						approve: mcpApproval(ctx.mcpReq.inputResponses)
+					})
 				}] };
 			} catch (error) {
+				if (error instanceof ApprovalNeeded) return approvalAsked(error.request, capabilitiesOf(ctx.mcpReq.envelope));
 				report(error);
 				return failed;
 			}

package/dist/mcp/mcp-tools.d.ts

@@ -6,7 +6,12 @@ export type McpToolsInput = {
   db: Db;
   /** Offers `run_read_only_query` to callers who see the assistant (`admin` or `ai`); it reads outside the access rules. */
   sql: boolean;
+  /** Offers `create_record` and `update_record`; each write still needs the caller's role and their approval in the client. */
+  writes: boolean;
 };
-/** The default MCP tools for a caller: the record tools, and read-only SQL when `sql` is on and the caller sees the assistant. */
-export declare const mcpTools: ({ db, sql }: McpToolsInput) => (session: Session) => AssistantTool[];
+/**
+ * The default MCP tools for a caller: the record tools, the write tools when `writes` is on, and read-only SQL when `sql`
+ * is on and the caller sees the assistant.
+ */
+export declare const mcpTools: ({ db, sql, writes }: McpToolsInput) => (session: Session) => AssistantTool[];
 //#endregion

package/dist/mcp/mcp-tools.js

@@ -1,8 +1,16 @@
 import { seesAssistant } from "../assistant/assistant-settings.js";
 import { readOnlyQueryTool } from "../assistant/query-tools.js";
 import { readRecordTools } from "../assistant/record-tools.js";
+import { writeRecordTools } from "../assistant/write-record-tools.js";
 //#region src/mcp/mcp-tools.ts
-/** The default MCP tools for a caller: the record tools, and read-only SQL when `sql` is on and the caller sees the assistant. */
-const mcpTools = ({ db, sql }) => (session) => [...readRecordTools(), ...sql && seesAssistant(session.user.roles) ? [readOnlyQueryTool(db)] : []];
+/**
+* The default MCP tools for a caller: the record tools, the write tools when `writes` is on, and read-only SQL when `sql`
+* is on and the caller sees the assistant.
+*/
+const mcpTools = ({ db, sql, writes }) => (session) => [
+	...readRecordTools(),
+	...writes ? writeRecordTools() : [],
+	...sql && seesAssistant(session.user.roles) ? [readOnlyQueryTool(db)] : []
+];
 //#endregion
 export { mcpTools };

package/dist/meta.d.ts

@@ -19,6 +19,8 @@ export type ResourcePermissions = {
 export type CallerMeta = {
   /** The app's name, which ends the admin app's tab titles. */
   appName: string;
+  /** The Protobase version the server runs: the admin app offers a reload when it changes under an open page. */
+  protobaseVersion: string;
   /** The app's own icon, its favicon's path, when the project has one: the sidebar's logo draws it beside the name. */
   appIcon?: string;
   resources: ResourceModel[];

package/dist/meta.js

@@ -5,6 +5,7 @@ import { pruneView } from "./view-access.js";
 import { activeRole } from "./active-role.js";
 import { pluginsFor } from "./plugins/plugin-settings.js";
 import { metaModel } from "./meta-model.js";
+import { protobaseVersion } from "./protobase-version.js";
 import { seesRuntime } from "./runtime/runtime-settings.js";
 import { sourcesFor } from "./sources/source-settings.js";
 import { prunePage } from "@protobase/layout";
@@ -63,6 +64,7 @@ const createMeta = (deps, appName, appIcon) => {
 		const sources = sourcesFor(deps.sources, session.user.roles);
 		const body = {
 			appName,
+			protobaseVersion,
 			...appIcon && { appIcon },
 			resources: visible.map(metaModel),
 			views,
@@ -98,8 +100,11 @@ const createMeta = (deps, appName, appIcon) => {
 			etag: `"${(await sha256Hex(stableJson(body))).slice(0, 32)}"`
 		};
 	};
-	/** The X-Meta-Version header: the models, and the roles the access depends on, so a role change moves it. */
-	const version = async (roles) => (await sha256Hex(`${await base}|${[...roles].sort().join(",")}`)).slice(0, 32);
+	/**
+	* The X-Meta-Version header: the models, the Protobase version, so the admin app reads `/meta` again on the first
+	* answer after an upgrade, and the roles the access depends on, so a role change moves it.
+	*/
+	const version = async (roles) => (await sha256Hex(`${await base}|${protobaseVersion}|${[...roles].sort().join(",")}`)).slice(0, 32);
 	return {
 		forCaller,
 		version

package/dist/package.js

@@ -0,0 +1,4 @@
+//#region package.json
+var version = "0.40.7";
+//#endregion
+export { version };

package/dist/protobase-version.js

@@ -0,0 +1,6 @@
+import { version } from "./package.js";
+//#region src/protobase-version.ts
+/** The Protobase version this server is, from @protobase/server's package.json: `/meta` names it to the admin app. */
+const protobaseVersion = version;
+//#endregion
+export { protobaseVersion };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.40.5",
+  "version": "0.40.7",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -36,9 +36,9 @@
     "@better-auth/passkey": "^1.7.12",
     "@better-auth/sso": "^1.7.12",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.40.5",
-    "@protobase/query": "0.40.5",
-    "@protobase/schema": "0.40.5",
+    "@protobase/layout": "0.40.7",
+    "@protobase/query": "0.40.7",
+    "@protobase/schema": "0.40.7",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",