@protobase/server 0.45.13 → 0.45.15

package/dist/better-auth/auth-mail/auth-emails.d.ts

@@ -1,5 +1,6 @@
 import "./account-exists-email.js";
 import "./invitation-email.js";
+import "./no-account-email.js";
 import "./reset-password-email.js";
 import "./sign-in-code-email.js";
 import "./sign-up-code-email.js";

package/dist/better-auth/auth-mail/auth-emails.js

@@ -1,8 +1,9 @@
 import { accountExistsEmail } from "./account-exists-email.js";
 import { invitationEmail } from "./invitation-email.js";
+import { noAccountEmail } from "./no-account-email.js";
 import { resetPasswordEmail } from "./reset-password-email.js";
 import { signInCodeEmail } from "./sign-in-code-email.js";
 import { signUpCodeEmail } from "./sign-up-code-email.js";
 import { staffSignInEmail } from "./staff-sign-in-email.js";
 import { twoFactorCodeEmail } from "./two-factor-code-email.js";
-export { accountExistsEmail, invitationEmail, resetPasswordEmail, signInCodeEmail, signUpCodeEmail, staffSignInEmail, twoFactorCodeEmail };
+export { accountExistsEmail, invitationEmail, noAccountEmail, resetPasswordEmail, signInCodeEmail, signUpCodeEmail, staffSignInEmail, twoFactorCodeEmail };

package/dist/better-auth/auth-mail/no-account-email.d.ts

@@ -0,0 +1 @@
+import "../../index.js";

package/dist/better-auth/auth-mail/no-account-email.js

@@ -0,0 +1,32 @@
+import { defineEmail } from "../../mail/define-email.js";
+import { EmailButton, EmailLayout, EmailNote } from "../../mail/email-layout.js";
+import { signInPath } from "@protobase/schema";
+import { Text } from "react-email";
+import { jsx, jsxs } from "react/jsx-runtime";
+//#region src/better-auth/auth-mail/no-account-email.tsx
+const NoAccountEmail = ({ app }) => /* @__PURE__ */ jsxs(EmailLayout, {
+	app,
+	preview: `No ${app.name} account uses this address`,
+	heading: "No account for this address",
+	children: [
+		/* @__PURE__ */ jsxs(Text, { children: [
+			"Someone asked for a code to sign in to ",
+			app.name,
+			" with this address. No account uses it, so no code was sent."
+		] }),
+		/* @__PURE__ */ jsx(Text, { children: "If you have an account, sign in again with the address you signed up with." }),
+		/* @__PURE__ */ jsxs(EmailButton, {
+			href: new URL(signInPath(), app.url).href,
+			children: ["Sign in to ", app.name]
+		}),
+		/* @__PURE__ */ jsx(EmailNote, { children: "If this was not you, ignore this email: nothing was changed." })
+	]
+});
+/** The email to an address that asked for a sign-in code while no account uses it: no code, a hint to try another address. */
+const noAccountEmail = defineEmail({
+	name: "no-account",
+	subject: ({ app }) => `No ${app.name} account uses this address`,
+	component: NoAccountEmail
+});
+//#endregion
+export { noAccountEmail };

package/dist/better-auth/authenticator.js

@@ -44,8 +44,12 @@ const betterAuthAuthenticator = (options) => {
 		});
 		const verify = async (request) => {
 			const { payload, session } = await sessions(request);
-			if (auth) await standing(await auth.$context, payload, session);
-			return session;
+			if (!auth) return session;
+			const signIn = await standing(await auth.$context, payload, session);
+			return signIn ? {
+				...session,
+				signIn
+			} : session;
 		};
 		if (!organizations) return verify;
 		return async (request) => {
@@ -65,11 +69,13 @@ const betterAuthAuthenticator = (options) => {
 	const dpopReplayStore = () => replayStore ??= options.auth ? options.auth.$context.then(({ internalAdapter }) => createDpopReplayStore(internalAdapter)) : Promise.resolve(createInMemoryDpopReplayStore());
 	const ownStanding = (context, payload, session) => checkTokenStanding(context, tokenClaims(payload, session.user.roles, organizations ? session.tenant : void 0), organizations);
 	const own = sessionOf({ audience: options.audience ?? issuer }, ownStanding);
-	const grantStanding = (context, payload, session) => checkMcpGrant(context.adapter, {
-		userId: payload.sub,
-		clientId: session.client?.id,
-		issuedAt: payload.iat
-	});
+	const grantStanding = async (context, payload, session) => {
+		await checkMcpGrant(context.adapter, {
+			userId: payload.sub,
+			clientId: session.client?.id,
+			issuedAt: payload.iat
+		});
+	};
 	return Object.assign(withTrustedApps(own, issuer, options.apps ?? []), { forAudience: (audience) => sessionOf({
 		audience,
 		typ: "at+jwt",

package/dist/better-auth/create-auth.d.ts

@@ -1,6 +1,7 @@
 import { StaffSignIn } from "./staff-log.js";
 import { RoleDefinitions, RolesInput } from "./organizations/role-definitions.js";
 import { ConnectedApp } from "./mcp/connected-apps.js";
+import { UserDeletionListener } from "./user-deletion.js";
 import "./auth-base-path.js";
 import { Mailer } from "../mail/smtp-mailer.js";
 import { OperatorProvider } from "./operator-provider.js";
@@ -232,6 +233,18 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
     };
   };
   plugins: ({
+    id: "protobase-user-deletion";
+    hooks: {
+      before: {
+        matcher: (context: import("better-auth").HookEndpointContext) => boolean;
+        handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
+      }[];
+      after: {
+        matcher: (context: import("better-auth").HookEndpointContext) => boolean;
+        handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
+      }[];
+    };
+  } | {
     id: "admin";
     version: string;
     init(): {
@@ -3105,6 +3118,14 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
       INVALID_OTP: import("better-auth").RawError<"INVALID_OTP">;
       TOO_MANY_ATTEMPTS: import("better-auth").RawError<"TOO_MANY_ATTEMPTS">;
     };
+  } | {
+    id: "protobase-no-account-mail";
+    hooks: {
+      after: {
+        matcher: (ctx: import("better-auth").HookEndpointContext) => boolean;
+        handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
+      }[];
+    };
   } | {
     id: "protobase-sign-up";
     endpoints: {
@@ -3731,7 +3752,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               userId: string;
               expiresAt: Date;
               token: string;
-              ipAddress?: string | null | undefined;
+              ipAddress? /** The app keeps each user's metadata, in the column `users.metadata` names. */ : string | null | undefined;
               userAgent?: string | null | undefined;
             };
             user: Record<string, any> & {
@@ -8717,6 +8738,14 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
    * names. Only `createAdmin` with a `mobile` section uses it; `handler` and `api` never trust a Capacitor origin.
    */
   handleMobile: (request: Request) => Promise<Response>;
+  /**
+   * What runs when a user is deleted: `set` a named listener that removes what the app keeps of the user elsewhere,
+   * such as their devices; `run` is for a deletion outside Better Auth's endpoints (`deleteUser`).
+   */
+  userDeletion: {
+    set: (name: string, listener: UserDeletionListener) => undefined;
+    run: (userId: string) => Promise<void>;
+  };
   /** Issuer and audience of the tokens: `baseURL`, on every origin. */
   issuer: string;
   /** Every origin the app is served on, `baseURL`'s first. */

package/dist/better-auth/create-auth.js

@@ -12,6 +12,7 @@ import { platformMailer } from "../mail/platform-mailer.js";
 import { readOperatorSettings, resolveOperator } from "./operator-provider.js";
 import { defaultInvitationUrl } from "./invitations/invitation-link-hook.js";
 import { lastAdminGuardPlugin } from "./last-admin-guard.js";
+import { userDeletion } from "./user-deletion.js";
 import { revokeMcpGrants } from "./mcp/revoke-grants.js";
 import { coreNames, pluginNames } from "./snake-case-names.js";
 import { lastOrganizationField, sessionOrganizationHooks } from "./organizations/session-organization.js";
@@ -28,6 +29,7 @@ import { platformSignInFor, platformSignInProvider, readPlatformSignIn, resolveP
 import { appSignInPolicy } from "./app-sign-in-policy.js";
 import { assertNoEndpointKeyClashes } from "./endpoint-key-clashes.js";
 import { emailInDomains, resolveSamlProviders, samlDisabledPaths, samlGuardPlugin, samlPlugin } from "./saml-sign-in.js";
+import { noAccountMailPlugin } from "./no-account-mail.js";
 import { emailCodeOptions, twoFactorCodeOptions, unusedEmailCodePaths } from "./sign-in-mail.js";
 import { signUpPaths, signUpPlugin } from "./sign-up/sign-up-plugin.js";
 import { confirmedOnCreate, confirmedOnUpdate, emailConfirmedField } from "./email-confirmed.js";
@@ -62,7 +64,7 @@ const organizationPaths = ["/organization/set-active", "/organization/accept-inv
 * The options `createAuth` gives Better Auth, with the roles, default role, mailer, operator provider and platform
 * sign-in provider already resolved.
 */
-const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, definitions, defaultRole, appName = defaultAppName, mailer, signUpRole, operator, platformSignIn, saml = [], organizations, mcp, context = noContext, signInPolicy = defaultSignInPolicy, mobile }) => {
+const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, definitions, defaultRole, appName = defaultAppName, mailer, signUpRole, operator, platformSignIn, saml = [], organizations, mcp, context = noContext, signInPolicy = defaultSignInPolicy, mobile, deletion }) => {
 	const secure = options.baseURL.startsWith("https://");
 	const signIn = platformSignInFor(platformSignIn, Object.keys(options.socialProviders ?? {}));
 	const hosts = passkeyHosts([options.baseURL, ...origins]);
@@ -161,7 +163,7 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 				formerDomain: hosts[0],
 				origins: appOrigins(options.baseURL, origins)
 			}),
-			...mail ? [emailOTP(emailCodeOptions(mail))] : [],
+			...mail ? [emailOTP(emailCodeOptions(mail)), noAccountMailPlugin(mail)] : [],
 			...mail && signUpRole ? [signUpPlugin({
 				role: signUpRole,
 				mail,
@@ -182,6 +184,7 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 			}),
 			rolesPlugin({ definitions }),
 			lastAdminGuardPlugin(),
+			...deletion ? [deletion.plugin] : [],
 			...organizations ? [organizationPlugin({
 				resolved: organizations,
 				secret: options.secret,
@@ -314,8 +317,10 @@ const createAuth = (options) => {
 	let instance;
 	const context = () => instance?.$context ?? Promise.reject(/* @__PURE__ */ new Error("The auth instance is not made yet"));
 	const mobile = mobileRequests();
+	const deletion = userDeletion();
 	const authOptions = betterAuthOptions(options, {
 		mobile,
+		deletion,
 		origins,
 		passkeyDomain,
 		roles,
@@ -341,6 +346,14 @@ const createAuth = (options) => {
 		* names. Only `createAdmin` with a `mobile` section uses it; `handler` and `api` never trust a Capacitor origin.
 		*/
 		handleMobile: (request) => auth.handler(mobile.grant(request)),
+		/**
+		* What runs when a user is deleted: `set` a named listener that removes what the app keeps of the user elsewhere,
+		* such as their devices; `run` is for a deletion outside Better Auth's endpoints (`deleteUser`).
+		*/
+		userDeletion: {
+			set: deletion.set,
+			run: deletion.run
+		},
 		/** Issuer and audience of the tokens: `baseURL`, on every origin. */
 		issuer: options.baseURL,
 		/** Every origin the app is served on, `baseURL`'s first. */

package/dist/better-auth/no-account-mail.js

@@ -0,0 +1,24 @@
+import { sendAuthEmail } from "./auth-mail/send-auth-email.js";
+import { APIError, createAuthMiddleware } from "better-auth/api";
+//#region src/better-auth/no-account-mail.ts
+/**
+* Mails an address that asked for a sign-in code while no account uses it, so its owner knows to try another address.
+* The email OTP plugin answers such a request as it answers one for an account, and mails nothing; this hook sends the
+* no-account email after it, so the answer still tells nobody which addresses have an account.
+*/
+const noAccountMailPlugin = (mail) => ({
+	id: "protobase-no-account-mail",
+	hooks: { after: [{
+		matcher: (ctx) => ctx.path === "/email-otp/send-verification-otp",
+		handler: createAuthMiddleware(async (ctx) => {
+			if (ctx.context.returned instanceof APIError) return;
+			const { email, type } = ctx.body;
+			if (type !== "sign-in") return;
+			const address = email.toLowerCase();
+			if (await ctx.context.internalAdapter.findUserByEmail(address)) return;
+			await ctx.context.runInBackgroundOrAwait(sendAuthEmail(mail, "noAccountEmail", address, {}, ctx.context.baseURL));
+		})
+	}] }
+});
+//#endregion
+export { noAccountMailPlugin };

package/dist/better-auth/token-standing.js

@@ -3,7 +3,16 @@ import { noGlobalRole } from "./organizations/role-definitions.js";
 import { parseRoles } from "./parse-roles.js";
 import { effectiveRoles, globalRoles } from "./organizations/app-roles.js";
 import { findMember, findOrganization } from "./organizations/store.js";
+import { isStaffSession } from "./staff-checks.js";
 //#region src/better-auth/token-standing.ts
+/**
+* The sign-in a session row stands for: staff started it when the admin plugin's `impersonatedBy` names someone. A row
+* read without that field gives `undefined`, so a caller who cannot be told apart from staff is never taken for the user.
+*/
+const signInOf = (session, id) => "impersonatedBy" in session && session.impersonatedBy !== void 0 ? {
+	session: id,
+	staff: isStaffSession(session)
+} : void 0;
 const tokenClaims = (payload, roles, tenant) => ({
 	userId: payload.sub,
 	...typeof payload.sid === "string" && { sessionId: payload.sid },
@@ -26,20 +35,19 @@ const heldWhere = async ({ adapter }, user, organizations, organizationId) => {
 /**
 * Whether a token still stands, read from the store on every request: its user exists and is not banned, its session
 * is not signed out or expired, and each role it carries is one the user still holds there. A token that fails is a
-* 401, so the client asks its session for a new one, which carries the roles as they are now or is refused.
+* 401, so the client asks its session for a new one, which carries the roles as they are now or is refused. Answers the
+* sign-in the token's session stands for (`signInOf`), `undefined` for a token without one.
 */
 const checkTokenStanding = async (context, claims, organizations, now = /* @__PURE__ */ new Date()) => {
 	const { adapter } = context;
-	if (claims.sessionId !== void 0) {
-		const session = await adapter.findOne({
-			model: "session",
-			where: [{
-				field: "id",
-				value: claims.sessionId
-			}]
-		});
-		if (!session || session.userId !== claims.userId || session.expiresAt <= now) throw revoked();
-	}
+	const session = claims.sessionId === void 0 ? void 0 : await adapter.findOne({
+		model: "session",
+		where: [{
+			field: "id",
+			value: claims.sessionId
+		}]
+	});
+	if (claims.sessionId !== void 0 && (!session || session.userId !== claims.userId || session.expiresAt <= now)) throw revoked();
 	const user = await adapter.findOne({
 		model: "user",
 		where: [{
@@ -50,6 +58,7 @@ const checkTokenStanding = async (context, claims, organizations, now = /* @__PU
 	if (!user || bannedNow(user, now)) throw revoked();
 	const held = await heldWhere(context, user, organizations, claims.organizationId);
 	if (!held || claims.roles.some((role) => !held.includes(role))) throw revoked();
+	return session ? signInOf(session, claims.sessionId) : void 0;
 };
 //#endregion
-export { checkTokenStanding, tokenClaims };
+export { checkTokenStanding, signInOf, tokenClaims };

package/dist/better-auth/user-deletion.d.ts

@@ -0,0 +1,4 @@
+//#region src/better-auth/user-deletion.d.ts
+/** Removes what the app keeps of a user elsewhere than the auth store, such as their devices; it throws to stop the deletion. */
+export type UserDeletionListener = (userId: string) => Promise<void>;
+//#endregion

package/dist/better-auth/user-deletion.js

@@ -0,0 +1,50 @@
+import "./organizations/role-definitions.js";
+import { parseRoles } from "./parse-roles.js";
+import { createAuthMiddleware, getSessionFromCtx, isAPIError } from "better-auth/api";
+//#region src/better-auth/user-deletion.ts
+const removePath = "/admin/remove-user";
+/**
+* What runs when a user is deleted, by an admin (`/admin/remove-user`) or by `deleteUser` (the CLI): each listener
+* before anything is deleted, so one that throws stops the deletion with the user, their sessions and accounts in
+* place, and once more after the user is gone, for what was added in between.
+*/
+const userDeletion = () => {
+	const listeners = /* @__PURE__ */ new Map();
+	const run = async (userId) => {
+		for (const listener of listeners.values()) await listener(userId);
+	};
+	const allowedRemoval = async (ctx) => {
+		const userId = ctx.body?.userId;
+		if (typeof userId !== "string" || userId === "") return void 0;
+		const session = await getSessionFromCtx(ctx);
+		if (!session || !parseRoles(session.user.role).includes("admin") || session.user.id === userId) return void 0;
+		return await ctx.context.internalAdapter.findUserById(userId) ? userId : void 0;
+	};
+	return {
+		plugin: {
+			id: "protobase-user-deletion",
+			hooks: {
+				before: [{
+					matcher: (context) => context.path === removePath,
+					handler: createAuthMiddleware(async (ctx) => {
+						const userId = await allowedRemoval(ctx);
+						if (userId !== void 0) await run(userId);
+					})
+				}],
+				after: [{
+					matcher: (context) => context.path === removePath,
+					handler: createAuthMiddleware(async (ctx) => {
+						const userId = ctx.body?.userId;
+						if (isAPIError(ctx.context.returned) || typeof userId !== "string" || userId === "") return;
+						await run(userId);
+					})
+				}]
+			}
+		},
+		run,
+		/** Sets the listener of `name`, in place of the one it had: an app built again does not add another. */
+		set: (name, listener) => void listeners.set(name, listener)
+	};
+};
+//#endregion
+export { userDeletion };

package/dist/better-auth/users.d.ts

@@ -42,7 +42,7 @@ export declare const createUser: (auth: AdminAuth, input: NewUser) => Promise<{
   role: string;
 }>;
 export declare const listUsers: (auth: AdminAuth) => Promise<StoredUser[]>;
-/** Deletes the user with their sessions and accounts; refuses to delete the last active admin. */
+/** Deletes the user with their sessions and accounts, and what `auth.userDeletion` removes; refuses to delete the last active admin. */
 export declare const deleteUser: (auth: AdminAuth, email: string) => Promise<void>;
 /** Sets the role: one of the configured roles, or several separated by commas; refuses to demote the last active admin. */
 export declare const setUserRole: (auth: AdminAuth, input: {

package/dist/better-auth/users.js

@@ -80,13 +80,15 @@ const listUsers = async (auth) => (await allUsers(auth)).map((user) => ({
 	banned: Boolean(user.banned),
 	createdAt: new Date(user.createdAt).toISOString()
 }));
-/** Deletes the user with their sessions and accounts; refuses to delete the last active admin. */
+/** Deletes the user with their sessions and accounts, and what `auth.userDeletion` removes; refuses to delete the last active admin. */
 const deleteUser = async (auth, email) => {
 	const user = await findUser(auth, email);
 	await refuseLastAdmin(auth, user, "delete");
 	const { internalAdapter } = await auth.$context;
+	await auth.userDeletion.run(user.id);
 	await internalAdapter.deleteUserSessions(user.id);
 	await internalAdapter.deleteUser(user.id);
+	await auth.userDeletion.run(user.id);
 };
 /** Sets the role: one of the configured roles, or several separated by commas; refuses to demote the last active admin. */
 const setUserRole = async (auth, input) => {

package/dist/create-admin.d.ts

@@ -8,6 +8,7 @@ import { Admin, Authenticator, PageSource, ViewSource } from "./types.js";
 import { CommentUsers } from "./comments/comment-users.js";
 import { HistoryOptions } from "./history/options.js";
 import { WebhooksOptions } from "./webhooks/table/options.js";
+import { NotificationsOptions } from "./notifications/options.js";
 import { SubscriptionDefinition } from "./webhooks/subscription.js";
 import { FilesOptions } from "./files/options.js";
 import { Difficulty } from "./forms/challenge.js";
@@ -46,6 +47,8 @@ export type CreateAdminInput = {
   subscriptions?: SubscriptionDefinition[];
   /** Webhook subscriptions made in the admin app, from `extends: [webhooks()]` (see `WebhooksOptions`). */
   webhooks?: WebhooksOptions;
+  /** Each user's devices and the endpoints that register them, from `extends: [notifications()]` (see `NotificationsOptions`). */
+  notifications?: NotificationsOptions;
   /**
    * The app's iOS and Android build (see `MobileConfig`): the API answers its Capacitor origins through CORS, and sign-in
    * at `/api/auth` trusts the Capacitor origin a request names, without CORS, as the app calls it through native HTTP.
@@ -85,5 +88,5 @@ export type CreateAdminInput = {
   upgradeWebSocket?: UpgradeWebSocket;
 };
 /** The admin REST API as a Hono app. It uses only Web APIs, so it runs on Node, Workers and anywhere else Hono does. */
-export declare const createAdmin: ({ resources: appResources, views: appViews, pages, userMenu, bottomBars, db, authenticate, auth, functions, files: filesOptions, events, history: historyOptions, jobs, subscriptions, webhooks: webhooksOptions, mobile, app: identity, icons, bundlePlugins, fieldTypes, options, formsDifficulty, commentUsers: givenCommentUsers, verifyToken, upgradeWebSocket }: CreateAdminInput) => Admin;
+export declare const createAdmin: ({ resources: appResources, views: appViews, pages, userMenu, bottomBars, db, authenticate, auth, functions, files: filesOptions, events, history: historyOptions, jobs, subscriptions, webhooks: webhooksOptions, notifications, mobile, app: identity, icons, bundlePlugins, fieldTypes, options, formsDifficulty, commentUsers: givenCommentUsers, verifyToken, upgradeWebSocket }: CreateAdminInput) => Admin;
 //#endregion

package/dist/create-admin.js

@@ -51,6 +51,9 @@ import { toApiFunction } from "./functions/define-function.js";
 import { createWebhooks } from "./webhooks/webhooks.js";
 import { webhookTable } from "./webhooks/table/webhook-table.js";
 import { subscriptionUrlCheck, subscriptionWriteCheck } from "./webhooks/table/validate-hook.js";
+import { deviceStore, removeDevicesWithUsers } from "./notifications/device-store-of.js";
+import { devicesPath } from "./notifications/paths.js";
+import { deviceRoutes } from "./notifications/routes.js";
 import { visitorsBrowse, withAnonymous } from "./anonymous.js";
 import { checkBottomBars, checkShell } from "./check-shell.js";
 import { checkOwnerFields } from "./check-owners.js";
@@ -94,7 +97,7 @@ const declaredRoles = (auth, roles) => {
 	return names.length > 0 ? [...new Set(names)] : void 0;
 };
 /** The admin REST API as a Hono app. It uses only Web APIs, so it runs on Node, Workers and anywhere else Hono does. */
-const createAdmin = ({ resources: appResources, views: appViews = [], pages = [], userMenu, bottomBars = [], db, authenticate, auth, functions = {}, files: filesOptions, events, history: historyOptions, jobs = [], subscriptions = [], webhooks: webhooksOptions, mobile, app: identity, icons, bundlePlugins = [], fieldTypes = {}, options = {}, formsDifficulty, commentUsers: givenCommentUsers, verifyToken, upgradeWebSocket }) => {
+const createAdmin = ({ resources: appResources, views: appViews = [], pages = [], userMenu, bottomBars = [], db, authenticate, auth, functions = {}, files: filesOptions, events, history: historyOptions, jobs = [], subscriptions = [], webhooks: webhooksOptions, notifications, mobile, app: identity, icons, bundlePlugins = [], fieldTypes = {}, options = {}, formsDifficulty, commentUsers: givenCommentUsers, verifyToken, upgradeWebSocket }) => {
 	const basePath = options.basePath ?? "/api/v1";
 	const appModels = appResources.map((resource) => resource.toModel());
 	const withComments = appModels.some((model) => model.comments);
@@ -361,6 +364,11 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	}));
 	app.route("/", batchRoute(deps, authenticate, meta));
 	app.route("/", fileRoutes(deps, authenticate));
+	if (notifications) {
+		const devices = deviceStore(db, notifications);
+		if (auth) removeDevicesWithUsers(auth, devices);
+		app.route(devicesPath(systemPath), guarded((routes) => void routes.route("/", deviceRoutes(devices))));
+	}
 	if (forms) app.route(`${systemPath}/forms`, formRoutes(deps, forms));
 	const feed = tableFeed({
 		db,

package/dist/index.d.ts

@@ -18,6 +18,9 @@ import { Admin, AuditEvent, AuditQueue, Authenticator, PipelineHook, ScanGuardMo
 import { CommentUsers } from "./comments/comment-users.js";
 import { HistoryOptions } from "./history/options.js";
 import { WebhooksOptions } from "./webhooks/table/options.js";
+import { ApnsEnvironment, Device, DeviceKind, NewDevice } from "./notifications/device.js";
+import { DeviceStore } from "./notifications/device-store.js";
+import { DeviceColumn, NotificationsOptions } from "./notifications/options.js";
 import { EventData, RunContext, SubscriptionDefinition, SubscriptionEvent, SubscriptionOptions, subscription } from "./webhooks/subscription.js";
 import { Sharp, renderVariant, thumbHash } from "./files/images.js";
 import { FileProvider, FileStore, StoredObject } from "./files/store.js";
@@ -86,6 +89,12 @@ import { checkWebhooksSchema, webhooksMigration } from "./webhooks/table/schema.
 import { checkComments, commentsMigration } from "./comments/comments-sql.js";
 import { CheckAiInput, checkAi } from "./ai/check-ai.js";
 import { CommentItem } from "./comments/comment-item.js";
+import { notifications } from "./notifications/plugin.js";
+import { checkNotificationsSchema, notificationsMigration } from "./notifications/schema.js";
+import { deviceStore, removeDevicesWithUsers } from "./notifications/device-store-of.js";
+import { DeviceStoreError, postgresDeviceStore } from "./notifications/postgres-store.js";
+import { deviceIdParam, devicesPath } from "./notifications/paths.js";
+import { maxDevicesPerUser } from "./notifications/routes.js";
 import { MemberInput, NewOrganization, addAppRoleToOwners, addMember, createOrganization, listOrganizations, removeMember, setMemberRoles } from "./better-auth/organizations/host.js";
 import { AssistantBackend, assistantProtocolRoutes } from "./assistant/protocol-routes.js";
 import { fileConversationStore } from "./assistant/file-conversation-store.js";
@@ -137,4 +146,4 @@ import { checkJobsSchema, jobsSchema, jobsSchemaMigration } from "./jobs/schema.
 import { MobileRelease, ReleaseFile, ServedReleaseFile, composeRelease, releaseManifest } from "./mobile-release/release.js";
 import { MobileReleaseAppInput, OfferedRelease, mobileReleaseApp } from "./mobile-release/release-app.js";
 import { mobileSigningKeyVariable, readSigningKey } from "./mobile-release/signing-key.js";
-export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApiKeys, type ApiKeysOptions, type AppIcons, type AppIdentity, type AppPoolConfig, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BatchOperation, type BatchResult, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type Caller, type CallerOptions, type CapturedRow, type CascadingKey, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, ConnectionsBusy, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryOptions, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type McpGateInput, type McpHandlerInput, type McpRoutesInput, type McpServerInput, type McpToolsInput, type McpWrites, type MemberInput, MissingCredentials, type MobileConfig, type MobileRelease, type MobileReleaseAppInput, ModelError, type ModelSettings, type NewOrganization, type NewUser, type OfferedRelease, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PgModule, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReadableResources, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordKeyInput, type RecordPage, type ReleaseFile, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type ServedReleaseFile, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolAnnotations, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, type WriteRecordToolsInput, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appPool, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkQueryRunner, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, composeRelease, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, localFiles, longQueryPool, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, mergeConfig, migrationCommand, mobileReleaseApp, mobileSigningKeyVariable, newWebhookSecret, normalizeRoles, notFound, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, processor, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readSigningKey, readWriteQueryTool, readableResources, realtimeLimits, recordOf, releaseManifest, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };
+export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApiKeys, type ApiKeysOptions, type ApnsEnvironment, type AppIcons, type AppIdentity, type AppPoolConfig, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BatchOperation, type BatchResult, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type Caller, type CallerOptions, type CapturedRow, type CascadingKey, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, ConnectionsBusy, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type Device, type DeviceColumn, type DeviceKind, type DeviceStore, DeviceStoreError, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryOptions, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type McpGateInput, type McpHandlerInput, type McpRoutesInput, type McpServerInput, type McpToolsInput, type McpWrites, type MemberInput, MissingCredentials, type MobileConfig, type MobileRelease, type MobileReleaseAppInput, ModelError, type ModelSettings, type NewDevice, type NewOrganization, type NewUser, type NotificationsOptions, type OfferedRelease, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PgModule, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReadableResources, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordKeyInput, type RecordPage, type ReleaseFile, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type ServedReleaseFile, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolAnnotations, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, type WriteRecordToolsInput, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appPool, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, composeRelease, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, deviceIdParam, deviceStore, devicesPath, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, localFiles, longQueryPool, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxTokenTtlSeconds, maxWidgetPropsBytes, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, mergeConfig, migrationCommand, mobileReleaseApp, mobileSigningKeyVariable, newWebhookSecret, normalizeRoles, notFound, notifications, notificationsMigration, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, processor, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readSigningKey, readWriteQueryTool, readableResources, realtimeLimits, recordOf, releaseManifest, removeDevicesWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };

package/dist/index.js

@@ -56,6 +56,10 @@ import { recordOf, resourceChange } from "./changes/resource-change.js";
 import { defineFunction } from "./functions/define-function.js";
 import { newWebhookSecret } from "./webhooks/standard-webhooks.js";
 import { subscription } from "./webhooks/subscription.js";
+import { DeviceStoreError, postgresDeviceStore } from "./notifications/postgres-store.js";
+import { deviceStore, removeDevicesWithUsers } from "./notifications/device-store-of.js";
+import { deviceIdParam, devicesPath } from "./notifications/paths.js";
+import { maxDevicesPerUser } from "./notifications/routes.js";
 import { errorReportingSettings, errorReportingVariable } from "./error-reporting/error-reporting-settings.js";
 import { storageCleanupSchedule } from "./files/cleanup-schedule.js";
 import { limitedFileStore, storeUsage } from "./files/limits.js";
@@ -86,6 +90,8 @@ import { checkComputed, computedMigration } from "./computed/computed-schema.js"
 import { webhooks } from "./webhooks/table/plugin.js";
 import { checkWebhooksSchema, webhooksMigration } from "./webhooks/table/schema.js";
 import { checkAi } from "./ai/check-ai.js";
+import { notifications } from "./notifications/plugin.js";
+import { checkNotificationsSchema, notificationsMigration } from "./notifications/schema.js";
 import { maxWidgetPropsBytes, widget } from "./assistant/widget.js";
 import { checkQueryRunner, queryRunnerMigration } from "./assistant/query-runner/query-runner.js";
 import { startErrorReporting } from "./error-reporting/error-reporter.js";
@@ -104,4 +110,4 @@ import { jobsDrainApp } from "./jobs/drain-route.js";
 import { composeRelease, releaseManifest } from "./mobile-release/release.js";
 import { mobileReleaseApp } from "./mobile-release/release-app.js";
 import { mobileSigningKeyVariable, readSigningKey } from "./mobile-release/signing-key.js";
-export { ConnectionsBusy, FatalJobError, HttpProblem, MissingCredentials, ModelError, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appPool, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkQueryRunner, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, composeRelease, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, localFiles, longQueryPool, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, mergeConfig, migrationCommand, mobileReleaseApp, mobileSigningKeyVariable, newWebhookSecret, normalizeRoles, notFound, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, processor, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readSigningKey, readWriteQueryTool, readableResources, realtimeLimits, recordOf, releaseManifest, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };
+export { ConnectionsBusy, DeviceStoreError, FatalJobError, HttpProblem, MissingCredentials, ModelError, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appPool, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, composeRelease, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, deviceIdParam, deviceStore, devicesPath, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, localFiles, longQueryPool, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxTokenTtlSeconds, maxWidgetPropsBytes, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, mergeConfig, migrationCommand, mobileReleaseApp, mobileSigningKeyVariable, newWebhookSecret, normalizeRoles, notFound, notifications, notificationsMigration, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, processor, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readSigningKey, readWriteQueryTool, readableResources, realtimeLimits, recordOf, releaseManifest, removeDevicesWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };

package/dist/notifications/caller.js

@@ -0,0 +1,16 @@
+import { forbidden } from "../problem.js";
+//#region src/notifications/caller.ts
+/**
+* The id of the user whose devices a request may register and remove: only someone signed in as themselves. Refused:
+* visitors, outside apps acting for the user (an MCP client), and every session whose authenticator does not mark it as
+* the user's own sign-in (`Session.signIn`), staff signed in as the user included.
+*/
+const ownDeviceUser = (session) => {
+	const refuse = () => forbidden("own-sign-in-only", "Only someone signed in as themselves can change their devices");
+	if (session.anonymous || session.client || session.signIn?.staff !== false) throw refuse();
+	const userId = String(session.user.id);
+	if (userId === "" || session.user.id === void 0 || session.user.id === null) throw refuse();
+	return userId;
+};
+//#endregion
+export { ownDeviceUser };