@protobase/server 0.47.1 → 0.49.0

package/dist/better-auth/store/migrations/index.js

@@ -0,0 +1,22 @@
+import { core } from "./001-core.js";
+import { twoFactor } from "./002-two-factor.js";
+import { passkeys } from "./003-passkeys.js";
+import { signInPolicy } from "./004-sign-in-policy.js";
+import { staffSignIn } from "./005-staff-sign-in.js";
+import { organizations } from "./006-organizations.js";
+import { mcp } from "./007-mcp.js";
+//#region src/better-auth/store/migrations/index.ts
+/** The auth store's migrations, by version. A new one goes last, with the next version. */
+const storeMigrations = [
+	core,
+	twoFactor,
+	passkeys,
+	signInPolicy,
+	staffSignIn,
+	organizations,
+	mcp
+];
+/** The version the store is at once every migration is applied. */
+const latestStoreVersion = storeMigrations.at(-1).version;
+//#endregion
+export { latestStoreVersion, storeMigrations };

package/dist/better-auth/store/migrations/migration.d.ts

@@ -0,0 +1,3 @@
+import "../../user-table.js";
+import "../store-names.js";
+import "kysely";

package/dist/better-auth/store/migrations/migration.js

@@ -0,0 +1,14 @@
+import { storeTable } from "../store-names.js";
+import { sql } from "kysely";
+//#region src/better-auth/store/migrations/migration.ts
+/** The `ddl` parts of the app's names. */
+const migrationNames = (names) => ({
+	table: (name) => storeTable(names, name),
+	user: storeTable(names, names.users.modelName),
+	userColumn: names.users.column,
+	metadata: names.users.metadata,
+	id: sql.raw(names.uuidIds ? "uuid default pg_catalog.gen_random_uuid()" : "text"),
+	idRef: sql.raw(names.uuidIds ? "uuid" : "text")
+});
+//#endregion
+export { migrationNames };

package/dist/better-auth/store/migrations-table.d.ts

@@ -0,0 +1,7 @@
+import "./store-names.js";
+import "./migrations/migration.js";
+import { Kysely } from "kysely";
+//#region src/better-auth/store/migrations-table.d.ts
+/** The table, in the store's schema. */
+export declare const migrationsTableName = "auth_migrations";
+//#endregion

package/dist/better-auth/store/migrations-table.js

@@ -0,0 +1,23 @@
+import { ddl, ddlText } from "./ddl.js";
+import { storeTable } from "./store-names.js";
+import { sql } from "kysely";
+//#region src/better-auth/store/migrations-table.ts
+/** The table, in the store's schema. */
+const migrationsTableName = "auth_migrations";
+const migrationsTable = (names) => storeTable(names, migrationsTableName);
+/** The statement that makes the table. */
+const createMigrationsTable = (names) => ddl`create table ${migrationsTable(names)} (
+  version integer primary key,
+  name text not null,
+  applied_at timestamptz default current_timestamp not null
+)`;
+/** The statement that records `migrations` as applied. */
+const recordMigrations = (names, migrations) => ddl`insert into ${migrationsTable(names)} (version, name) values ${sql.join(migrations.map(({ version, name }) => ddl`(${sql.lit(version)}, ${sql.lit(name)})`))}`;
+/** The versions the store has applied, in order; `undefined` when it has no migrations table. */
+const appliedVersions = async (db, names) => {
+	const [found] = (await sql`select to_regclass(${ddlText(migrationsTable(names))}) is not null as found`.execute(db)).rows;
+	if (!found?.found) return void 0;
+	return (await sql`select version from ${migrationsTable(names)} order by version`.execute(db)).rows.map((row) => row.version);
+};
+//#endregion
+export { appliedVersions, createMigrationsTable, migrationsTableName, recordMigrations };

package/dist/better-auth/store/resources-outside.d.ts

@@ -0,0 +1,7 @@
+import { AdminAuth } from "../create-auth.js";
+import { ResourceModel } from "@protobase/schema";
+import { Kysely } from "kysely";
+//#region src/better-auth/store/resources-outside.d.ts
+/** Refuses a resource over a table of the admin store: the user table, a feature's table or the record of migrations. */
+export declare const checkResourcesOutsideAuthStore: (db: Kysely<any>, models: readonly ResourceModel[], auth: AdminAuth) => Promise<void>;
+//#endregion

package/dist/better-auth/store/resources-outside.js

@@ -0,0 +1,20 @@
+import { storeDb } from "./store-db.js";
+import { authStoreTables } from "../auth-tables.js";
+import { sql } from "kysely";
+//#region src/better-auth/store/resources-outside.ts
+const quoted = (name) => `"${name.replaceAll("\"", "\"\"")}"`;
+const resolve = async (db, tables) => (await sql`select t.n::int as n, ns.nspname as schema, c.relname as name, current_database() as database
+      from unnest(${tables.map(({ schema, name }) => schema ? `${quoted(schema)}.${quoted(name)}` : quoted(name))}::text[]) with ordinality as t(name, n)
+      join pg_class c on c.oid = to_regclass(t.name) join pg_namespace ns on ns.oid = c.relnamespace order by t.n`.execute(db)).rows;
+/** Refuses a resource over a table of the admin store: the user table, a feature's table or the record of migrations. */
+const checkResourcesOutsideAuthStore = async (db, models, auth) => {
+	if (models.length === 0) return;
+	const store = await resolve(storeDb(auth), authStoreTables(auth));
+	const same = (a, b) => a.database === b.database && a.schema === b.schema && a.name === b.name;
+	const over = (await resolve(db, models.map((model) => model.table))).filter((table) => store.some((own) => same(own, table)));
+	if (over.length === 0) return;
+	const named = over.map((table) => `${models[table.n - 1].name} (${table.schema}.${table.name})`).join(", ");
+	throw new Error(`Resources over the auth store's tables, which hold password hashes, sessions and tokens: ${named}. Remove them from the config; the auth store is read through Better Auth alone.`);
+};
+//#endregion
+export { checkResourcesOutsideAuthStore };

package/dist/better-auth/store/store-db.js

@@ -0,0 +1,13 @@
+import { Kysely, PostgresDialect } from "kysely";
+//#region src/better-auth/store/store-db.ts
+/**
+* A Kysely on the admin store's connections: `createAuth`'s `database`, a `pg` Pool or `{ dialect, type: 'postgres' }`.
+* The pool is the app's, so it is never destroyed here.
+*/
+const storeDb = ({ options: { database } }) => {
+	if (database && typeof database === "object" && "dialect" in database) return new Kysely({ dialect: database.dialect });
+	if (database && typeof database === "object" && "connect" in database) return new Kysely({ dialect: new PostgresDialect({ pool: database }) });
+	throw new Error("The admin store's database is neither a pg Pool nor { dialect, type: 'postgres' }");
+};
+//#endregion
+export { storeDb };

package/dist/better-auth/store/store-names.d.ts

@@ -0,0 +1,2 @@
+import "../user-table.js";
+import "../create-auth.js";

package/dist/better-auth/store/store-names.js

@@ -0,0 +1,14 @@
+import { sql } from "kysely";
+//#region src/better-auth/store/store-names.ts
+/** The schema the admin store lives in; the search path decides when its options name none. */
+const storeSchema = ({ options: { database } }) => database && "schemaName" in database ? database.schemaName : void 0;
+/** The store's configured names, from the app's auth. */
+const storeNames = (auth) => ({
+	schema: storeSchema(auth),
+	users: auth.userTable,
+	uuidIds: auth.options.advanced?.database?.generateId === "uuid"
+});
+/** A table of the store, in its schema, as an identifier for `ddl`. */
+const storeTable = ({ schema }, name) => schema === void 0 ? sql.id(name) : sql.id(schema, name);
+//#endregion
+export { storeNames, storeSchema, storeTable };

package/dist/better-auth/store/table-names.d.ts

@@ -0,0 +1,7 @@
+//#region src/better-auth/store/table-names.d.ts
+/**
+ * The admin store's tables besides the user table, whose name the app may configure: every feature's, which the store
+ * has whether the app turns the feature on or not, and the record of its migrations.
+ */
+export declare const storeTableNames: string[];
+//#endregion

package/dist/better-auth/store/table-names.js

@@ -0,0 +1,10 @@
+import { storeMigrations } from "./migrations/index.js";
+import { migrationsTableName } from "./migrations-table.js";
+//#region src/better-auth/store/table-names.ts
+/**
+* The admin store's tables besides the user table, whose name the app may configure: every feature's, which the store
+* has whether the app turns the feature on or not, and the record of its migrations.
+*/
+const storeTableNames = [...storeMigrations.flatMap((migration) => migration.tables), migrationsTableName];
+//#endregion
+export { storeTableNames };

package/dist/better-auth/user-table.js

@@ -16,7 +16,7 @@ const userFields = {
 	last_role: "lastRole",
 	last_organization_id: "lastOrganizationId"
 };
-/** The user table's names, from `createAuth`'s `users` option; unknown columns are an error. */
+/** The user table's names, from `auth.users` option; unknown columns are an error. */
 const userTable = ({ table = "user", columns = {}, metadata } = {}) => {
 	const unknown = Object.keys(columns).find((name) => !(name in userFields));
 	if (unknown !== void 0) throw new Error(`users.columns names "${unknown}", which is not a column of the user table: ${Object.keys(userFields).join(", ")}`);

package/dist/better-auth/users.d.ts

@@ -1,5 +1,5 @@
-import { AdminAuth } from "./create-auth.js";
 import { parseRoles } from "./parse-roles.js";
+import { AdminAuth } from "./create-auth.js";
 //#region src/better-auth/users.d.ts
 /** The roles this auth instance allows, `admin` first. */
 export declare const roleChoices: (auth: AdminAuth) => string[];
@@ -10,7 +10,7 @@ export type LinkedAccount = {
 };
 /**
  * Without `password` the user signs in by emailed code, passkey or a sign-in provider only. `metadata` lands in the
- * user metadata column, which `createAuth`'s `users.metadata` names; it needs one.
+ * user metadata column, which `auth.users.metadata` names; it needs one.
  */
 export type NewUser = {
   email: string;

package/dist/comments/comment-users.d.ts

@@ -1,5 +1,5 @@
-import "../better-auth/create-auth.js";
 import { TenantValue } from "../types.js";
+import "../better-auth/create-auth.js";
 //#region src/comments/comment-users.d.ts
 /** The users comments name, mention and mail: from the project's auth. */
 export type CommentUsers = {

package/dist/config-exports.d.ts

@@ -0,0 +1,2 @@
+import { configExports } from "./resource-source.js";
+export { configExports };

package/dist/config-exports.js

@@ -0,0 +1,2 @@
+import { configExports } from "./resource-source.js";
+export { configExports };

package/dist/create-admin.d.ts

@@ -1,7 +1,6 @@
 import { MobileConfig } from "./mobile-config.js";
 import { AppIdentity } from "./app-identity.js";
 import { AppIcons } from "./web-app/app-icons.js";
-import { AdminAuth } from "./better-auth/create-auth.js";
 import { EventsOptions } from "./changes/events-options.js";
 import { JobDefinition } from "./jobs/job-types.js";
 import { Admin, Authenticator, PageSource, ViewSource } from "./types.js";
@@ -15,6 +14,7 @@ import { Difficulty } from "./forms/challenge.js";
 import { ResourceSource } from "./resource-source.js";
 import { FunctionSource } from "./functions/define-function.js";
 import { AdminOptions } from "./admin-options.js";
+import { AdminAuth } from "./better-auth/create-auth.js";
 import { BottomBarSource, UserMenuSource } from "@protobase/schema";
 import { Db } from "@protobase/query";
 import { JWTPayload } from "jose";
@@ -35,6 +35,8 @@ export type CreateAdminInput = {
   auth?: AdminAuth;
   /** API functions of the app's own, each served at `<systemPath>/functions/<name>` (see `defineFunction`). */
   functions?: Record<string, FunctionSource>;
+  /** The app's secret (`secret`): it signs public forms' bot checks, and upload tickets unless `files.secret` names another. */
+  secret?: string;
   /** Where file fields keep their bytes (see `FilesOptions`). */
   files?: FilesOptions;
   /** Where the changes that resources' events are raised from are captured (see `EventsOptions`). */
@@ -45,9 +47,9 @@ export type CreateAdminInput = {
   jobs?: JobDefinition[];
   /** Where the resources' events are delivered (`subscription(...)` exports of the config module). */
   subscriptions?: SubscriptionDefinition[];
-  /** Webhook subscriptions made in the admin app, from `extends: [webhooks()]` (see `WebhooksOptions`). */
+  /** Webhook subscriptions made in the admin app, from `webhooks: {}` (see `WebhooksOptions`). */
   webhooks?: WebhooksOptions;
-  /** Each user's devices and the endpoints that register them, from `extends: [notifications()]` (see `NotificationsOptions`). */
+  /** Each user's devices and the endpoints that register them, from `notifications: {}` (see `NotificationsOptions`). */
   notifications?: NotificationsOptions;
   /**
    * The app's iOS and Android build (see `MobileConfig`): the API answers its Capacitor origins through CORS, and sign-in
@@ -88,5 +90,5 @@ export type CreateAdminInput = {
   upgradeWebSocket?: UpgradeWebSocket;
 };
 /** The admin REST API as a Hono app. It uses only Web APIs, so it runs on Node, Workers and anywhere else Hono does. */
-export declare const createAdmin: ({ resources: appResources, views: appViews, pages, userMenu, bottomBars, db, authenticate, auth, functions, files: filesOptions, events, history: historyOptions, jobs, subscriptions, webhooks: webhooksOptions, notifications, mobile, app: identity, icons, bundlePlugins, fieldTypes, options, formsDifficulty, commentUsers: givenCommentUsers, verifyToken, upgradeWebSocket }: CreateAdminInput) => Admin;
+export declare const createAdmin: ({ resources: appResources, views: appViews, pages, userMenu, bottomBars, db, authenticate, auth, functions, secret, files: filesOptions, events, history: historyOptions, jobs, subscriptions, webhooks: webhooksOptions, notifications, mobile, app: identity, icons, bundlePlugins, fieldTypes, options, formsDifficulty, commentUsers: givenCommentUsers, verifyToken, upgradeWebSocket }: CreateAdminInput) => Admin;
 //#endregion

package/dist/create-admin.js

@@ -103,7 +103,7 @@ const declaredRoles = (auth, roles) => {
 	return names.length > 0 ? [...new Set(names)] : void 0;
 };
 /** The admin REST API as a Hono app. It uses only Web APIs, so it runs on Node, Workers and anywhere else Hono does. */
-const createAdmin = ({ resources: appResources, views: appViews = [], pages = [], userMenu, bottomBars = [], db, authenticate, auth, functions = {}, files: filesOptions, events, history: historyOptions, jobs = [], subscriptions = [], webhooks: webhooksOptions, notifications, mobile, app: identity, icons, bundlePlugins = [], fieldTypes = {}, options = {}, formsDifficulty, commentUsers: givenCommentUsers, verifyToken, upgradeWebSocket }) => {
+const createAdmin = ({ resources: appResources, views: appViews = [], pages = [], userMenu, bottomBars = [], db, authenticate, auth, functions = {}, secret, files: filesOptions, events, history: historyOptions, jobs = [], subscriptions = [], webhooks: webhooksOptions, notifications, mobile, app: identity, icons, bundlePlugins = [], fieldTypes = {}, options = {}, formsDifficulty, commentUsers: givenCommentUsers, verifyToken, upgradeWebSocket }) => {
 	const basePath = options.basePath ?? "/api/v1";
 	const appModels = appResources.map((resource) => resource.toModel());
 	const withComments = appModels.some((model) => model.comments);
@@ -154,6 +154,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 		views: viewModels,
 		limits: options.roles?.limits ?? [],
 		env: globalThis.process?.env ?? {},
+		...secret && { secret },
 		...formsDifficulty && { difficulty: formsDifficulty }
 	});
 	const systemPath = basePath.slice(0, basePath.lastIndexOf("/"));
@@ -178,6 +179,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	});
 	const files = createFilesRuntime({
 		...filesOptions && { options: filesOptions },
+		...secret && { secret },
 		env: globalThis.process?.env ?? {},
 		models: registry.entries.map((entry) => entry.model),
 		systemPath,

package/dist/encryption/keyring.js

@@ -27,7 +27,7 @@ const entriesOf = (env) => {
 	}))];
 };
 const checkApart = (entries, env) => {
-	for (const name of ["BETTER_AUTH_SECRET", "PROTOBASE_SECRET_KEY"]) {
+	for (const name of ["PROTOBASE_SECRET", "PROTOBASE_SECRET_KEY"]) {
 		const secret = env[name]?.trim();
 		const same = secret && entries.find((entry) => entry.text === secret);
 		if (same) throw new Error(`${same.where} is the same as ${name}: give encryption a key of its own`);

package/dist/files/options.d.ts

@@ -1,21 +1,18 @@
 import { Sharp } from "./images.js";
 import { FileProvider } from "./store.js";
 //#region src/files/options.d.ts
-/** `files` in `protobase.config.ts`. Environment variables override it (see `resolveProviders`). */
+/** Where file fields keep their bytes, as the API runs with them: `files` of `protobase.config.ts` with its providers made. Environment variables override it (see `resolveProviders`). */
 export type FilesOptions = {
   /**
-   * Providers by name, such as `private: localFiles({ dir: './data/files' })`. A name is part of every stored value, so
-   * name the role (`archive`), not the vendor. Without config, `private` and `public` are folders under `data/files`.
+   * Providers by name. A name is part of every stored value, so name the role (`archive`), not the vendor. Without
+   * config, `private` and `public` are folders under `data/files`.
    */
   providers?: Record<string, FileProvider>;
   /** How long bytes outlive their last reference, for restores; default `1 day`. Public providers default to 0. */
   retention?: number | string;
-  /** Signs upload tickets and download URLs; default `PROTOBASE_FILES_SECRET`, then `BETTER_AUTH_SECRET`. */
+  /** Signs upload tickets and download URLs; default `PROTOBASE_FILES_SECRET`, then the app's `secret` (`PROTOBASE_SECRET`). */
   secret?: string;
-  /**
-   * The image library that makes the variants and placeholders of image fields: `import sharp from 'sharp'` in the
-   * config, so a built bundle carries it with its native add-on.
-   */
+  /** The image library that makes the variants and placeholders of image fields: sharp's default export. */
   sharp?: Sharp;
   /**
    * Hosts whose images the admin app draws with the page's referrer, besides the app's own and those its providers link

package/dist/files/provider-settings.d.ts

@@ -0,0 +1,16 @@
+import { FileProvider } from "./store.js";
+import { LocalFilesOptions } from "./local-files.js";
+import { S3FilesOptions } from "./s3-files.js";
+//#region src/files/provider-settings.d.ts
+/**
+ * A built-in file provider in `files.providers`, as data: `{ kind: 'local', dir }`, a folder on local disk, or
+ * `{ kind: 's3', bucket }`, an S3-compatible bucket. The provider is made when the app serves.
+ */
+export type FileProviderSettings = ({
+  kind: 'local';
+} & LocalFilesOptions) | ({
+  kind: 's3';
+} & S3FilesOptions);
+/** The provider the settings describe. */
+export declare const fileProviderOf: (name: string, settings: FileProviderSettings) => FileProvider;
+//#endregion

package/dist/files/provider-settings.js

@@ -0,0 +1,17 @@
+import { localFiles } from "./local-files.js";
+import { s3Files } from "./s3-files.js";
+//#region src/files/provider-settings.ts
+/** The provider the settings describe. */
+const fileProviderOf = (name, settings) => {
+	if (settings.kind === "local") {
+		const { kind: _, ...options } = settings;
+		return localFiles(options);
+	}
+	if (settings.kind === "s3") {
+		const { kind: _, ...options } = settings;
+		return s3Files(options);
+	}
+	throw new Error(`files.providers.${name}: kind is "local", "s3" or "custom", whose provider is the default export of files/${name}.ts`);
+};
+//#endregion
+export { fileProviderOf };

package/dist/files/runtime.js

@@ -13,7 +13,7 @@ const imageFields = (models) => models.flatMap((model) => Object.values(model.fi
 * The runtime, when a resource has a file field, the config names providers or the app serves `/api/sb/storage/v1`. It fails at startup when a field's
 * provider is not configured, nothing signs uploads, or a field makes image variants or placeholders without sharp.
 */
-const createFilesRuntime = ({ options = {}, env, models, systemPath, storage: servesStorage = false }) => {
+const createFilesRuntime = ({ options = {}, env, secret: appSecret, models, systemPath, storage: servesStorage = false }) => {
 	const storageName = servesStorage ? storageProviderName(options) : void 0;
 	const storage = storageName && options.storage !== false ? {
 		provider: storageName,
@@ -22,10 +22,10 @@ const createFilesRuntime = ({ options = {}, env, models, systemPath, storage: se
 	const fieldProviders = models.flatMap((model) => Object.values(model.fields).flatMap((field) => field.file ? [field.file.provider] : []));
 	const used = [.../* @__PURE__ */ new Set([...fieldProviders, ...storage ? [storage.provider] : []])];
 	if (used.length === 0 && !options.providers) return void 0;
-	const secret = options.secret ?? env.PROTOBASE_FILES_SECRET ?? env.BETTER_AUTH_SECRET;
-	if (!secret) throw new Error("File fields and /api/sb/storage/v1 need a secret to sign uploads: set BETTER_AUTH_SECRET, PROTOBASE_FILES_SECRET or files.secret");
+	const secret = options.secret ?? env.PROTOBASE_FILES_SECRET ?? appSecret ?? env.PROTOBASE_SECRET;
+	if (!secret) throw new Error("File fields and /api/sb/storage/v1 need a secret to sign uploads: set secret in protobase.config.ts, files.secret or PROTOBASE_FILES_SECRET");
 	const images = imageFields(models);
-	if (images.length > 0 && !options.sharp) throw new Error(`${images.join(", ")} make image variants or placeholders, which need sharp: add it to the project (bun add sharp), then import sharp from 'sharp' in the config and pass files: { sharp }`);
+	if (images.length > 0 && !options.sharp) throw new Error(`${images.join(", ")} make image variants or placeholders, which need sharp: add it to the project (bun add sharp), then give the config files: { sharp: () => import('sharp') }`);
 	const providers = resolveProviders(options, env, used);
 	const retention = retentionOf(options, env);
 	return {

package/dist/forms/runtime.js

@@ -12,15 +12,15 @@ const anonymousCreates = (limits) => (resource) => {
 * The public forms of the views, checked, with the challenges that guard them and their rate limit; `undefined` without
 * any. Fails at startup on a form that cannot be served and when nothing signs the challenges.
 */
-const createFormsRuntime = ({ registry, views, limits, env, difficulty }) => {
+const createFormsRuntime = ({ registry, views, limits, env, secret: appSecret, difficulty }) => {
 	const declared = [...views].sort((a, b) => Number(a.roles !== void 0) - Number(b.roles !== void 0)).flatMap((view) => (view.forms ?? []).map((form) => ({
 		form,
 		view
 	})));
 	if (declared.length === 0) return void 0;
 	const forms = checkForms(registry, declared, anonymousCreates(limits));
-	const secret = env.PROTOBASE_FORMS_SECRET ?? env.BETTER_AUTH_SECRET;
-	if (!secret) throw new Error("Public forms need a secret to sign their bot checks: set PROTOBASE_FORMS_SECRET or BETTER_AUTH_SECRET");
+	const secret = env.PROTOBASE_FORMS_SECRET ?? appSecret ?? env.PROTOBASE_SECRET;
+	if (!secret) throw new Error("Public forms need a secret to sign their bot checks: set secret in protobase.config.ts, or PROTOBASE_FORMS_SECRET");
 	return {
 		forms,
 		challenges: createFormChallenges(secret, { ...difficulty && { difficulty } }),

package/dist/index.d.ts

@@ -1,18 +1,9 @@
 import { MobileConfig } from "./mobile-config.js";
 import { AppIdentity } from "./app-identity.js";
 import { AppIcons, PngIcon, pngIcons } from "./web-app/app-icons.js";
-import { StaffSignIn } from "./better-auth/staff-log.js";
-import { RoleDefinition, RolesInput } from "./better-auth/organizations/role-definitions.js";
-import { MailMessage, Mailer } from "./mail/smtp-mailer.js";
-import { OperatorProvider, readOperatorSettings } from "./better-auth/operator-provider.js";
-import { OrganizationRole, StoredMember, StoredOrganization } from "./better-auth/organizations/store.js";
-import { SignInPolicy, SignInRule, StaffAccessRule, defaultSignInPolicy, signInPolicyMethods } from "./better-auth/sign-in-policy.js";
-import { OrganizationsOptions } from "./better-auth/organizations/options.js";
-import { PlatformSignIn, readPlatformSignIn } from "./better-auth/platform-sign-in.js";
-import { EmailComponent, EmailOptions, EmailTemplate, RenderedEmail, defineEmail } from "./mail/define-email.js";
-import { AdminAuth, CreateAuthOptions, UserCreatedHook, createAuth, normalizeRoles } from "./better-auth/create-auth.js";
 import { EventsOptions } from "./changes/events-options.js";
 import { StandardSchema, readJson } from "./functions/read-json.js";
+import { MailMessage, Mailer } from "./mail/smtp-mailer.js";
 import { JsonObject, JsonValue } from "./notifications/json-value.js";
 import { HistoryPosition, NewNotification, StoredNotification, historyIdPattern, historyLimits } from "./notifications/history.js";
 import { PushMessage, PushMessageError, Urgency, WebPushFields, maxTtlSeconds, pushMessage, urgencies } from "./notifications/message.js";
@@ -60,28 +51,38 @@ import { RuntimeOptions, runtimeUrl, runtimeVariable, seesRuntime } from "./runt
 import { AdminOptions } from "./admin-options.js";
 import { CreateAdminInput, createAdmin } from "./create-admin.js";
 import { handleDroppedConnections } from "./dropped-connections.js";
-import { AppPoolConfig, PgModule, appPool, longQueryPool, poolWaitMs, readDbConnections } from "./app-pool.js";
+import { AppPoolConfig, PgModule, poolWaitMs, readDbConnections } from "./app-pool.js";
 import { ConnectionsBusy } from "./connections-busy.js";
 import { isBackgroundWork, runInBackground, wantsLongQueries } from "./background-work.js";
 import { longQueryTimeoutMs } from "./statement-timeout.js";
 import { checkViewQueries } from "./check-view-queries.js";
-import { ProjectConfig, defineConfig, mergeConfig } from "./project-config.js";
 import { consoleAuditQueue } from "./audit/console-queue.js";
 import { JwtOptions, JwtVerifyOptions, jwtAuthenticator, jwtVerifier } from "./auth/jwt.js";
+import { SignInPolicy, SignInRule, StaffAccessRule, defaultSignInPolicy, signInPolicyMethods } from "./better-auth/sign-in-policy.js";
+import { StaffSignIn } from "./better-auth/staff-log.js";
+import { RoleDefinition, RolesInput } from "./better-auth/organizations/role-definitions.js";
+import { OrganizationRole, StoredMember, StoredOrganization } from "./better-auth/organizations/store.js";
+import { OrganizationsOptions } from "./better-auth/organizations/options.js";
+import { AuthHooks, AuthSettings, HookContext } from "./better-auth/auth-settings.js";
 import { TrustedApp, withTrustedApps } from "./better-auth/app-tokens.js";
-import { BetterAuthAuthenticator, BetterAuthAuthenticatorOptions, betterAuthAuthenticator, betterAuthTokens } from "./better-auth/authenticator.js";
+import { BetterAuthAuthenticator, BetterAuthAuthenticatorOptions, betterAuthTokens } from "./better-auth/authenticator.js";
+import { AuthenticateSettings } from "./better-auth/authenticate-settings.js";
 import { parseRoles } from "./better-auth/parse-roles.js";
 import { LinkedAccount, NewUser, StoredUser, createUser, deleteUser, hasUsers, listUsers, roleChoices, setUserBanned, setUserRole } from "./better-auth/users.js";
 import { IssueTokenOptions, issueToken, maxTokenTtlSeconds } from "./better-auth/tokens.js";
 import { passwordLength } from "./better-auth/new-account-password.js";
+import { OperatorProvider, readOperatorSettings } from "./better-auth/operator-provider.js";
 import { isOAuthWellKnownPath, oauthWellKnownPaths, webauthnPath } from "./better-auth/origins.js";
 import { goTruePath } from "./gotrue/keys.js";
 import { supabasePath } from "./supabase-paths.js";
 import { realtimeLimits } from "./realtime/realtime-limits.js";
 import { capSocketMessages, honorSocketMessageCaps, socketMessageCapOf } from "./functions/socket-message-cap.js";
-import { defaultAppName, shownAppName } from "./app-name.js";
+import { appNameOver, defaultAppName, shownAppName } from "./app-name.js";
 import { webManifestPath } from "./web-app/web-manifest-route.js";
+import { PlatformSignIn, readPlatformSignIn } from "./better-auth/platform-sign-in.js";
 import { authSchemaMigration, checkAuthSchema } from "./better-auth/auth-schema.js";
+import { authSchemaDrift } from "./better-auth/store/drift.js";
+import { checkResourcesOutsideAuthStore } from "./better-auth/store/resources-outside.js";
 import { changesMigration, checkChanges, migrationCommand } from "./changes/capture-schema.js";
 import { checkComputed, computedMigration } from "./computed/computed-schema.js";
 import { isCaptured } from "./changes/capture-sql.js";
@@ -90,12 +91,10 @@ import { ResourceChange, recordOf, resourceChange } from "./changes/resource-cha
 import { eventMatcher } from "./changes/match-events.js";
 import { parseColumns, readOutbox } from "./changes/outbox.js";
 import { newWebhookSecret } from "./webhooks/standard-webhooks.js";
-import { webhooks } from "./webhooks/table/plugin.js";
 import { checkWebhooksSchema, webhooksMigration } from "./webhooks/table/schema.js";
 import { checkComments, commentsMigration } from "./comments/comments-sql.js";
 import { CheckAiInput, checkAi } from "./ai/check-ai.js";
 import { CommentItem } from "./comments/comment-item.js";
-import { notifications } from "./notifications/plugin.js";
 import { checkNotificationsSchema, notificationsMigration } from "./notifications/schema.js";
 import { deviceStore, removeDevicesWithUsers } from "./notifications/device-store-of.js";
 import { DeviceStoreError, postgresDeviceStore } from "./notifications/postgres-store.js";
@@ -139,9 +138,10 @@ import { SignatureOptions, StandardWebhookOptions, verifySignature, verifyStanda
 import { requireEnv } from "./functions/require-env.js";
 import { backgroundSettled, waitUntil } from "./functions/wait-until.js";
 import { FileLimits, limitedFileStore, storeUsage } from "./files/limits.js";
-import { LocalFilesOptions, localFileStore, localFiles } from "./files/local-files.js";
+import { LocalFilesOptions, localFileStore } from "./files/local-files.js";
+import { S3Bucket, S3FilesOptions, S3ListPage, S3Object, s3FileStore } from "./files/s3-files.js";
+import { FileProviderSettings } from "./files/provider-settings.js";
 import { StoreFileInput, storeFile } from "./files/store-file.js";
-import { S3Bucket, S3FilesOptions, S3ListPage, S3Object, s3FileStore, s3Files } from "./files/s3-files.js";
 import { storageProvider } from "./files/storage-provider.js";
 import { objectKey } from "./storage/object-key.js";
 import { FileCleanupInput, createFileCleanup } from "./files/file-cleanup.js";
@@ -154,11 +154,14 @@ import { FileRef, formatUri, variantPath } from "./files/uri.js";
 import { aspectRatio, fileSize, fileType, imageSize, processor } from "./files/processors.js";
 import { defineJob, isJobDefinition, jobDefinitions } from "./jobs/define-job.js";
 import { FatalJobError } from "./jobs/run-job.js";
+import { JobDeclaration, JobRun, enqueueJob } from "./jobs/declared-job.js";
 import { isSchedule } from "./jobs/schedule.js";
+import { EmailComponent, EmailOptions, EmailTemplate, RenderedEmail, defineEmail } from "./mail/define-email.js";
 import { DrainResult, JobsRuntime, StartJobsOptions, startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
 import { checkJobsSchema, jobsSchema, jobsSchemaMigration } from "./jobs/schema.js";
 import { MobileRelease, ReleaseFile, ServedReleaseFile, composeRelease, releaseManifest } from "./mobile-release/release.js";
 import { MobileReleaseAppInput, OfferedRelease, mobileReleaseApp } from "./mobile-release/release-app.js";
 import { mobileSigningKeyVariable, readSigningKey } from "./mobile-release/signing-key.js";
-export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApiKeys, type ApiKeysOptions, type ApnsEnvironment, type AppIcons, type AppIdentity, type AppPoolConfig, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BatchOperation, type BatchResult, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type Caller, type CallerOptions, type CapturedRow, type CascadingKey, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, ConnectionsBusy, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type Device, type DeviceColumn, type DeviceKind, type DeviceStore, DeviceStoreError, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryColumn, type HistoryOptions, type HistoryPosition, type HistoryStore, HistoryStoreError, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JsonObject, type JsonValue, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type McpApprovals, type McpGateInput, type McpHandlerInput, type McpRoutesInput, type McpServerInput, type McpToolsInput, type McpWrites, type MemberInput, type Membership, MissingCredentials, type MobileConfig, type MobileRelease, type MobileReleaseAppInput, ModelError, type ModelSettings, type NewDevice, type NewNotification, type NewOrganization, type NewUser, type NotificationRecipients, NotificationSendError, type NotificationsOptions, type OfferedRelease, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PgModule, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type PushAnswer, type PushMessage, PushMessageError, type PushSender, type QueryOptions, type QueryResult, type ReadableResources, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordKeyInput, type RecordPage, type ReleaseFile, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type SendNotification, type ServedReleaseFile, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredNotification, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolAnnotations, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type Urgency, type User, type UserCreatedHook, type VapidSettings, type ViewSource, type WebPushFields, type WebPushOptions, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, type WriteRecordToolsInput, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appPool, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, composeRelease, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, deviceIdParam, deviceStore, devicesPath, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, localFiles, longQueryPool, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, mergeConfig, migrationCommand, mobileReleaseApp, mobileSigningKeyVariable, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notifications, notificationsMigration, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readSigningKey, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, recordOf, releaseManifest, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };
+import { AdminAuth, CreateAuthOptions, UserCreatedHook, normalizeRoles } from "./better-auth/create-auth.js";
+export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApiKeys, type ApiKeysOptions, type ApnsEnvironment, type AppIcons, type AppIdentity, type AppPoolConfig, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type AuthHooks, type AuthSettings, type AuthenticateSettings, type Authenticator, type BatchOperation, type BatchResult, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type Caller, type CallerOptions, type CapturedRow, type CascadingKey, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, ConnectionsBusy, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type Device, type DeviceColumn, type DeviceKind, type DeviceStore, DeviceStoreError, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileProviderSettings, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryColumn, type HistoryOptions, type HistoryPosition, type HistoryStore, HistoryStoreError, type HookContext, HttpProblem, type IssueTokenOptions, type JobContext, type JobDeclaration, type JobDefinition, type JobOptions, type JobRun, type JobsRuntime, type JsonObject, type JsonValue, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type McpApprovals, type McpGateInput, type McpHandlerInput, type McpRoutesInput, type McpServerInput, type McpToolsInput, type McpWrites, type MemberInput, type Membership, MissingCredentials, type MobileConfig, type MobileRelease, type MobileReleaseAppInput, ModelError, type ModelSettings, type NewDevice, type NewNotification, type NewOrganization, type NewUser, type NotificationRecipients, NotificationSendError, type NotificationsOptions, type OfferedRelease, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PgModule, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type PushAnswer, type PushMessage, PushMessageError, type PushSender, type QueryOptions, type QueryResult, type ReadableResources, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordKeyInput, type RecordPage, type ReleaseFile, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type SendNotification, type ServedReleaseFile, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredNotification, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolAnnotations, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type Urgency, type User, type UserCreatedHook, type VapidSettings, type ViewSource, type WebPushFields, type WebPushOptions, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, type WriteRecordToolsInput, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appNameOver, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkResourcesOutsideAuthStore, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, composeRelease, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, deviceIdParam, deviceStore, devicesPath, enqueueJob, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, migrationCommand, mobileReleaseApp, mobileSigningKeyVariable, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notificationsMigration, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readSigningKey, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, recordOf, releaseManifest, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };