@protobase/server 0.45.22 → 0.46.0

package/dist/create-admin.js

@@ -24,6 +24,7 @@ import { realtimePath, restPath, storagePath, supabaseFunctionsPath, supabasePat
 import { goTruePath } from "./gotrue/keys.js";
 import { authBasePath } from "./better-auth/auth-base-path.js";
 import { mcpDiscovery } from "./better-auth/mcp/discovery-routes.js";
+import { mcpApprovals } from "./mcp/mcp-approval-store.js";
 import { checkMcpWrites, rolesWithoutApproval } from "./mcp/mcp-writes.js";
 import { mcpAuthenticator } from "./mcp/mcp-authenticator.js";
 import { mcpToolContext } from "./mcp/mcp-context.js";
@@ -320,6 +321,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 			sql: options.mcp !== false && options.mcp?.sql === true,
 			writes
 		});
+		const approvals = mcpApprovals();
 		const server = (session) => mcpServer({
 			info: {
 				name: appName,
@@ -328,7 +330,8 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 			tools: tools(session),
 			context: mcpToolContext(deps, meta, session),
 			report,
-			rolesWithoutApproval: rolesWithoutApproval(writes)
+			rolesWithoutApproval: rolesWithoutApproval(writes),
+			approvals
 		});
 		mcpRoutes(app, {
 			path: auth.mcp.path,

package/dist/index.d.ts

@@ -123,6 +123,7 @@ import { WriteRecordToolsInput } from "./assistant/write-tool-limits.js";
 import { createRecordTool, updateRecordTool, writeRecordTools } from "./assistant/write-record-tools.js";
 import { deleteRecordTool } from "./assistant/delete-record-tool.js";
 import { batchWriteTool } from "./assistant/batch-write-tool.js";
+import { McpApprovals, mcpApprovals } from "./mcp/mcp-approval-store.js";
 import { McpServerInput, mcpServer } from "./mcp/mcp-server.js";
 import { McpToolsInput, mcpTools } from "./mcp/mcp-tools.js";
 import { McpGateInput, mcpGate, sessionOf } from "./mcp/mcp-gate.js";
@@ -160,4 +161,4 @@ import { checkJobsSchema, jobsSchema, jobsSchemaMigration } from "./jobs/schema.
 import { MobileRelease, ReleaseFile, ServedReleaseFile, composeRelease, releaseManifest } from "./mobile-release/release.js";
 import { MobileReleaseAppInput, OfferedRelease, mobileReleaseApp } from "./mobile-release/release-app.js";
 import { mobileSigningKeyVariable, readSigningKey } from "./mobile-release/signing-key.js";
-export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApiKeys, type ApiKeysOptions, type ApnsEnvironment, type AppIcons, type AppIdentity, type AppPoolConfig, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BatchOperation, type BatchResult, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type Caller, type CallerOptions, type CapturedRow, type CascadingKey, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, ConnectionsBusy, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type Device, type DeviceColumn, type DeviceKind, type DeviceStore, DeviceStoreError, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryColumn, type HistoryOptions, type HistoryPosition, type HistoryStore, HistoryStoreError, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JsonObject, type JsonValue, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type McpGateInput, type McpHandlerInput, type McpRoutesInput, type McpServerInput, type McpToolsInput, type McpWrites, type MemberInput, MissingCredentials, type MobileConfig, type MobileRelease, type MobileReleaseAppInput, ModelError, type ModelSettings, type NewDevice, type NewNotification, type NewOrganization, type NewUser, type NotificationRecipients, NotificationSendError, type NotificationsOptions, type OfferedRelease, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PgModule, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type PushAnswer, type PushMessage, PushMessageError, type PushSender, type QueryOptions, type QueryResult, type ReadableResources, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordKeyInput, type RecordPage, type ReleaseFile, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type SendNotification, type ServedReleaseFile, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredNotification, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolAnnotations, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type Urgency, type User, type UserCreatedHook, type VapidSettings, type ViewSource, type WebPushFields, type WebPushOptions, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, type WriteRecordToolsInput, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appPool, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, composeRelease, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, deviceIdParam, deviceStore, devicesPath, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, localFiles, longQueryPool, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, mergeConfig, migrationCommand, mobileReleaseApp, mobileSigningKeyVariable, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notifications, notificationsMigration, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readSigningKey, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, recordOf, releaseManifest, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };
+export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApiKeys, type ApiKeysOptions, type ApnsEnvironment, type AppIcons, type AppIdentity, type AppPoolConfig, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BatchOperation, type BatchResult, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type Caller, type CallerOptions, type CapturedRow, type CascadingKey, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, ConnectionsBusy, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type Device, type DeviceColumn, type DeviceKind, type DeviceStore, DeviceStoreError, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryColumn, type HistoryOptions, type HistoryPosition, type HistoryStore, HistoryStoreError, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JsonObject, type JsonValue, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type McpApprovals, type McpGateInput, type McpHandlerInput, type McpRoutesInput, type McpServerInput, type McpToolsInput, type McpWrites, type MemberInput, MissingCredentials, type MobileConfig, type MobileRelease, type MobileReleaseAppInput, ModelError, type ModelSettings, type NewDevice, type NewNotification, type NewOrganization, type NewUser, type NotificationRecipients, NotificationSendError, type NotificationsOptions, type OfferedRelease, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PgModule, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type PushAnswer, type PushMessage, PushMessageError, type PushSender, type QueryOptions, type QueryResult, type ReadableResources, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordKeyInput, type RecordPage, type ReleaseFile, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type SendNotification, type ServedReleaseFile, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredNotification, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolAnnotations, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type Urgency, type User, type UserCreatedHook, type VapidSettings, type ViewSource, type WebPushFields, type WebPushOptions, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, type WriteRecordToolsInput, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appPool, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, composeRelease, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, deviceIdParam, deviceStore, devicesPath, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, localFiles, longQueryPool, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, mergeConfig, migrationCommand, mobileReleaseApp, mobileSigningKeyVariable, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notifications, notificationsMigration, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readSigningKey, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, recordOf, releaseManifest, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };

package/dist/index.js

@@ -35,6 +35,7 @@ import { passwordLength } from "./better-auth/new-account-password.js";
 import { readOperatorSettings } from "./better-auth/operator-provider.js";
 import { readPlatformSignIn } from "./better-auth/platform-sign-in.js";
 import { createAuth, normalizeRoles } from "./better-auth/create-auth.js";
+import { mcpApprovals } from "./mcp/mcp-approval-store.js";
 import { mcpToolContext } from "./mcp/mcp-context.js";
 import { mcpGate, sessionOf } from "./mcp/mcp-gate.js";
 import { mcpHandler } from "./mcp/mcp-handler.js";
@@ -122,4 +123,4 @@ import { jobsDrainApp } from "./jobs/drain-route.js";
 import { composeRelease, releaseManifest } from "./mobile-release/release.js";
 import { mobileReleaseApp } from "./mobile-release/release-app.js";
 import { mobileSigningKeyVariable, readSigningKey } from "./mobile-release/signing-key.js";
-export { ConnectionsBusy, DeviceStoreError, FatalJobError, HistoryStoreError, HttpProblem, MissingCredentials, ModelError, NotificationSendError, PushMessageError, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appPool, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, composeRelease, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, deviceIdParam, deviceStore, devicesPath, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, localFiles, longQueryPool, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, mergeConfig, migrationCommand, mobileReleaseApp, mobileSigningKeyVariable, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notifications, notificationsMigration, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readSigningKey, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, recordOf, releaseManifest, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };
+export { ConnectionsBusy, DeviceStoreError, FatalJobError, HistoryStoreError, HttpProblem, MissingCredentials, ModelError, NotificationSendError, PushMessageError, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appPool, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, composeRelease, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, deviceIdParam, deviceStore, devicesPath, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, localFiles, longQueryPool, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, mergeConfig, migrationCommand, mobileReleaseApp, mobileSigningKeyVariable, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notifications, notificationsMigration, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readSigningKey, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, recordOf, releaseManifest, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };

package/dist/mcp/mcp-approval-store.d.ts

@@ -0,0 +1,21 @@
+//#region src/mcp/mcp-approval-store.d.ts
+/** An approval asked for: the `requestState` the client echoes with the answer, and the nonce the answer is filed under. */
+export type AskedApproval = {
+  state: string;
+  nonce: string;
+};
+/**
+ * The approvals an MCP server asked for and has not had answered: `ask` mints the state for the call `call` hashes to,
+ * in the scope `scope` hashes to, and `check` takes an echoed state back once, resolving to its nonce only when this
+ * store minted it for that very call and scope, it is unexpired and no other check took it first.
+ */
+export type McpApprovals = {
+  ask: (scope: string, call: string) => Promise<AskedApproval>;
+  check: (scope: string, call: string, state: unknown) => Promise<string | undefined>;
+};
+/**
+ * The approvals of an app's MCP endpoint: built once at startup, with a key of its own no one else holds, drawn when
+ * it first asks, so a server that never asks draws nothing.
+ */
+export declare const mcpApprovals: () => McpApprovals;
+//#endregion

package/dist/mcp/mcp-approval-store.js

@@ -0,0 +1,93 @@
+import { createRequestStateCodec } from "@modelcontextprotocol/server";
+//#region src/mcp/mcp-approval-store.ts
+/** How long an approval asked for can be answered: RFC 6749's longest life for a one-time code. */
+const approvalLifetime = 6e5;
+const purpose = "mcp.approve";
+const isPayload = (value) => {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+	const { purpose: named, nonce, call, expiresAt } = value;
+	return named === purpose && typeof nonce === "string" && nonce !== "" && typeof call === "string" && /^[0-9a-f]{64}$/.test(call) && typeof expiresAt === "number" && Number.isFinite(expiresAt);
+};
+const newNonce = () => Buffer.from(crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(16))).toString("base64url");
+/** An approval store with the key given; `mcpApprovals` is the one a server uses. */
+const approvalStore = ({ key, now = () => Date.now(), perScope = 50, total = 1e4 }) => {
+	const codec = createRequestStateCodec({
+		key,
+		ttlSeconds: approvalLifetime / 1e3
+	});
+	const scopes = /* @__PURE__ */ new Map();
+	let waiting = 0;
+	const dropExpired = () => {
+		const at = now();
+		for (const [scope, issued] of scopes) {
+			for (const [nonce, { expiresAt }] of issued) {
+				if (expiresAt > at) continue;
+				issued.delete(nonce);
+				waiting -= 1;
+			}
+			if (issued.size === 0) scopes.delete(scope);
+		}
+	};
+	const take = (scope, nonce) => {
+		const issued = scopes.get(scope);
+		const entry = issued?.get(nonce);
+		if (!issued || !entry) return void 0;
+		issued.delete(nonce);
+		waiting -= 1;
+		if (issued.size === 0) scopes.delete(scope);
+		return entry;
+	};
+	return {
+		ask: async (scope, call) => {
+			const nonce = newNonce();
+			const expiresAt = now() + approvalLifetime;
+			const state = await codec.mint({
+				purpose,
+				nonce,
+				call,
+				expiresAt
+			});
+			dropExpired();
+			if (waiting >= total) throw new Error("Too many approvals are waiting for an answer");
+			const issued = scopes.get(scope) ?? /* @__PURE__ */ new Map();
+			if (issued.size >= perScope) {
+				issued.delete(issued.keys().next().value);
+				waiting -= 1;
+			}
+			issued.set(nonce, {
+				call,
+				expiresAt
+			});
+			scopes.set(scope, issued);
+			waiting += 1;
+			return {
+				state,
+				nonce
+			};
+		},
+		check: async (scope, call, state) => {
+			if (typeof state !== "string") return void 0;
+			const payload = await codec.verify(state, void 0).catch(() => void 0);
+			if (!isPayload(payload)) return void 0;
+			const issued = take(scope, payload.nonce);
+			if (!issued) return void 0;
+			if (issued.call !== call || payload.call !== call || payload.expiresAt !== issued.expiresAt) return void 0;
+			if (now() >= issued.expiresAt) return void 0;
+			return payload.nonce;
+		}
+	};
+};
+/**
+* The approvals of an app's MCP endpoint: built once at startup, with a key of its own no one else holds, drawn when
+* it first asks, so a server that never asks draws nothing.
+*/
+const mcpApprovals = () => {
+	let store;
+	const opened = () => store ??= approvalStore({ key: crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32)) });
+	return {
+		ask: (scope, call) => opened().ask(scope, call),
+		check: async (scope, call, state) => store ? store.check(scope, call, state) : void 0
+	};
+};
+//#endregion
+export { approvalLifetime, approvalStore, mcpApprovals };

package/dist/mcp/mcp-approval.js

@@ -8,15 +8,21 @@ var ApprovalNeeded = class extends Error {
 		this.request = request;
 	}
 };
+/** The key of the answer to the approval asked with `nonce`: an answer filed under any other counts for nothing. */
+const approvalKey = (nonce) => `approve-${nonce}`;
 /**
-* `ToolContext.approve` over MCP, from the answers a retried call carries: approved only when the user accepted and
-* ticked `approve`, rejected on any other answer, and `ApprovalNeeded` when there is none yet.
+* `ToolContext.approve` over MCP, from the answer a retried call carries to the approval asked for that very call:
+* `ApprovalNeeded` when it carries no state that counts, or no answer under that state's key; approved only when the
+* user accepted and ticked `approve`; rejected on any other answer.
 */
-const mcpApproval = (inputResponses) => (request) => {
-	const answer = inputResponse(inputResponses, "approve");
-	if (answer.kind === "missing") return Promise.reject(new ApprovalNeeded(request));
-	if (answer.kind === "elicit" && answer.action === "accept" && answer.content?.approve === true) return Promise.resolve("approved");
-	return Promise.resolve("rejected");
+const mcpApproval = ({ inputResponses, requestState, check }) => async (request) => {
+	if (requestState === void 0) throw new ApprovalNeeded(request);
+	const nonce = await check(requestState);
+	if (nonce === void 0) throw new ApprovalNeeded(request);
+	const answer = inputResponse(inputResponses, approvalKey(nonce));
+	if (answer.kind === "missing") throw new ApprovalNeeded(request);
+	if (answer.kind === "elicit" && answer.action === "accept" && answer.content?.approve === true) return "approved";
+	return "rejected";
 };
 /**
 * Whether `roles`, the roles the signed-in user holds, include one of `exempt`, whose MCP writes need no approval: an
@@ -44,21 +50,26 @@ const cannotAsk = {
 };
 /**
 * The answer to a call whose tool asked for approval: a form asking the user to approve `request` when the client can
-* show one, else a refusal. A 2025-protocol request declares no capabilities per request, so it is always refused.
+* show one, filed under the nonce of the state `ask` mints for the call, else a refusal. A 2025-protocol request
+* declares no capabilities per request, so it is always refused.
 */
-const approvalAsked = (request, capabilities) => {
+const approvalAsked = async (request, capabilities, ask) => {
 	if (!asksForms(capabilities)) return cannotAsk;
-	return inputRequired({ inputRequests: { approve: inputRequired.elicit({
-		message: messageOf(request),
-		requestedSchema: {
-			type: "object",
-			properties: { approve: {
-				type: "boolean",
-				title: request.approveLabel ?? "Approve"
-			} },
-			required: ["approve"]
-		}
-	}) } });
+	const { state, nonce } = await ask();
+	return inputRequired({
+		inputRequests: { [approvalKey(nonce)]: inputRequired.elicit({
+			message: messageOf(request),
+			requestedSchema: {
+				type: "object",
+				properties: { approve: {
+					type: "boolean",
+					title: request.approveLabel ?? "Approve"
+				} },
+				required: ["approve"]
+			}
+		}) },
+		requestState: state
+	});
 };
 //#endregion
-export { ApprovalNeeded, approvalAsked, approvedUnasked, mcpApproval, writesUnasked };
+export { ApprovalNeeded, approvalAsked, approvalKey, approvedUnasked, mcpApproval, writesUnasked };

package/dist/mcp/mcp-call-hash.js

@@ -0,0 +1,47 @@
+import { createHash } from "node:crypto";
+//#region src/mcp/mcp-call-hash.ts
+const maxDepth = 32;
+const isPlainObject = (value) => {
+	const prototype = Object.getPrototypeOf(value);
+	return prototype === Object.prototype || prototype === null;
+};
+/**
+* `value` as JSON with each object's keys sorted and arrays kept in order, written out rather than rebuilt, so an own
+* `__proto__` key is encoded like any other. Throws on what JSON cannot hold and past `maxDepth` levels of nesting.
+*/
+const canonicalJson = (value, depth = 0) => {
+	if (depth > maxDepth) throw new Error(`The call nests deeper than ${maxDepth} levels`);
+	if (value === null || typeof value === "boolean" || typeof value === "string") return JSON.stringify(value);
+	if (typeof value === "number") {
+		if (!Number.isFinite(value)) throw new Error("The call holds a number JSON cannot");
+		return JSON.stringify(value);
+	}
+	if (Array.isArray(value)) return `[${Array.from(value, (item) => canonicalJson(item, depth + 1)).join(",")}]`;
+	if (typeof value === "object" && isPlainObject(value)) return `{${Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, item]) => `${JSON.stringify(key)}:${canonicalJson(item, depth + 1)}`).join(",")}}`;
+	throw new Error("The call holds a value JSON cannot");
+};
+const isUserId = (id) => typeof id === "string" && id !== "" || typeof id === "number" && Number.isFinite(id);
+/** The scope of a call by `session` to `resource`; throws for a session without a user to bind an approval to. */
+const callScope = (session, resource) => {
+	if (session.anonymous || !isUserId(session.user.id)) throw new Error("An approval needs a signed-in user");
+	if (!resource) throw new Error("An approval needs the MCP resource the token was verified for");
+	return {
+		resource: resource.href,
+		user: session.user.id,
+		tenant: session.tenant ?? null,
+		organization: session.organization?.id ?? null,
+		client: session.client?.id ?? null
+	};
+};
+const sha256 = (text) => createHash("sha256").update(text).digest("hex");
+/** The SHA-256 of a tool call: its tool, its arguments and its scope. */
+const callHash = (tool, args, scope) => sha256(canonicalJson([
+	"mcp.approve.call.v1",
+	tool,
+	args,
+	scope
+]));
+/** The SHA-256 of `scope` alone, which the approvals waiting for an answer are kept under. */
+const scopeHash = (scope) => sha256(canonicalJson(["mcp.approve.scope.v1", scope]));
+//#endregion
+export { callHash, callScope, canonicalJson, scopeHash };

package/dist/mcp/mcp-server.d.ts

@@ -1,4 +1,5 @@
 import { AssistantTool, ToolContext } from "../assistant/tools.js";
+import { McpApprovals } from "./mcp-approval-store.js";
 import { McpServer } from "@modelcontextprotocol/server";
 //#region src/mcp/mcp-server.d.ts
 export type McpServerInput = {
@@ -15,11 +16,14 @@ export type McpServerInput = {
   report: (error: unknown) => void;
   /** The roles whose calls are approved without asking the client: a user holding one of them is never asked. None by default. */
   rolesWithoutApproval?: readonly string[];
+  /** The approvals asked for and not yet answered, `mcpApprovals()` built once for every server the endpoint builds. */
+  approvals: McpApprovals;
 };
 /**
  * An MCP server offering `tools` as MCP tools, each with its JSON Schema, its hints, and the text it returns. A tool
- * that asks for approval makes the call ask the client's user, and runs again from the start with their answer; for a
- * user holding one of `rolesWithoutApproval` it is approved at once, and the client is never asked.
+ * that asks for approval makes the call ask the client's user, and runs again from the start with their answer, which
+ * counts only for the call it was asked for, once, while it lasts; for a user holding one of `rolesWithoutApproval` it
+ * is approved at once, and the client is never asked.
  */
-export declare const mcpServer: ({ info, tools, context, report, rolesWithoutApproval }: McpServerInput) => McpServer;
+export declare const mcpServer: ({ info, tools, context, report, rolesWithoutApproval, approvals }: McpServerInput) => McpServer;
 //#endregion

package/dist/mcp/mcp-server.js

@@ -1,6 +1,7 @@
 import { isStatementTimeout } from "../statement-timeout.js";
 import { checkedTools } from "../assistant/checked-tools.js";
 import { ApprovalNeeded, approvalAsked, approvedUnasked, mcpApproval, writesUnasked } from "./mcp-approval.js";
+import { callHash, callScope, scopeHash } from "./mcp-call-hash.js";
 import { CLIENT_CAPABILITIES_META_KEY, McpServer, fromJsonSchema } from "@modelcontextprotocol/server";
 //#region src/mcp/mcp-server.ts
 const capabilitiesOf = (envelope) => envelope?.[CLIENT_CAPABILITIES_META_KEY];
@@ -28,10 +29,11 @@ const stopped = (tool) => ({
 });
 /**
 * An MCP server offering `tools` as MCP tools, each with its JSON Schema, its hints, and the text it returns. A tool
-* that asks for approval makes the call ask the client's user, and runs again from the start with their answer; for a
-* user holding one of `rolesWithoutApproval` it is approved at once, and the client is never asked.
+* that asks for approval makes the call ask the client's user, and runs again from the start with their answer, which
+* counts only for the call it was asked for, once, while it lasts; for a user holding one of `rolesWithoutApproval` it
+* is approved at once, and the client is never asked.
 */
-const mcpServer = ({ info, tools, context, report, rolesWithoutApproval = [] }) => {
+const mcpServer = ({ info, tools, context, report, rolesWithoutApproval = [], approvals }) => {
 	const server = new McpServer(info);
 	const unasked = writesUnasked(rolesWithoutApproval, context.session.user.roles);
 	for (const tool of checkedTools(tools)) {
@@ -40,17 +42,41 @@ const mcpServer = ({ info, tools, context, report, rolesWithoutApproval = [] })
 			inputSchema: inputSchemaOf(tool.parameters),
 			...tool.annotations && { annotations: tool.annotations }
 		};
-		server.registerTool(tool.name, config, async (args, ctx) => {
+		const answer = async (args, ctx) => {
+			const bound = () => {
+				const scope = callScope(context.session, ctx.http?.authInfo?.resource);
+				return {
+					scope: scopeHash(scope),
+					call: callHash(tool.name, args, scope)
+				};
+			};
+			const check = (state) => {
+				const { scope, call } = bound();
+				return approvals.check(scope, call, state);
+			};
+			const approve = unasked ? approvedUnasked : mcpApproval({
+				inputResponses: ctx.mcpReq.inputResponses,
+				requestState: ctx.mcpReq.requestState(),
+				check
+			});
 			try {
 				return { content: [{
 					type: "text",
-					text: await tool.run(args, {
+					text: await tool.run(structuredClone(args), {
 						...context,
-						approve: unasked ? approvedUnasked : mcpApproval(ctx.mcpReq.inputResponses)
+						approve
 					})
 				}] };
 			} catch (error) {
-				if (error instanceof ApprovalNeeded) return approvalAsked(error.request, capabilitiesOf(ctx.mcpReq.envelope));
+				if (!(error instanceof ApprovalNeeded)) throw error;
+				const { scope, call } = bound();
+				return approvalAsked(error.request, capabilitiesOf(ctx.mcpReq.envelope), () => approvals.ask(scope, call));
+			}
+		};
+		server.registerTool(tool.name, config, async (args, ctx) => {
+			try {
+				return await answer(args, ctx);
+			} catch (error) {
 				report(error);
 				return isStatementTimeout(error) ? stopped(tool.name) : failed;
 			}

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.45.22";
+var version = "0.46.0";
 //#endregion
 export { version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.45.22",
+  "version": "0.46.0",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -36,9 +36,9 @@
     "@better-auth/passkey": "^1.7.12",
     "@better-auth/sso": "^1.7.12",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.45.22",
-    "@protobase/query": "0.45.22",
-    "@protobase/schema": "0.45.22",
+    "@protobase/layout": "0.46.0",
+    "@protobase/query": "0.46.0",
+    "@protobase/schema": "0.46.0",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",