@protobase/server 0.48.0 → 0.49.0

package/dist/better-auth/saml-plugin.js

@@ -0,0 +1,36 @@
+import { samlEntityId } from "./saml-sign-in.js";
+import { sso } from "@better-auth/sso";
+//#region src/better-auth/saml-plugin.ts
+/** The provider as one of the SSO plugin's configured providers (`defaultSSO`). */
+const defaultSsoEntry = (provider, baseURL) => {
+	const { idp, attributes = {} } = provider;
+	const mapping = Object.fromEntries(Object.entries(attributes).filter(([, name]) => name !== void 0));
+	return {
+		providerId: provider.id,
+		domain: provider.domains.join(","),
+		samlConfig: {
+			issuer: samlEntityId(baseURL, provider.id),
+			entryPoint: "ssoUrl" in idp ? idp.ssoUrl : "",
+			idpMetadata: "metadata" in idp ? { metadata: idp.metadata } : {
+				entityID: idp.entityId,
+				cert: idp.certificate
+			},
+			...Object.keys(mapping).length > 0 && { mapping }
+		}
+	};
+};
+/**
+* Better Auth's SSO plugin with the configured providers. Their domains are trusted, so an address there links to the
+* account that has it; organizations are not assigned by provider, and nobody registers providers.
+*/
+const samlPlugin = (providers, baseURL) => {
+	const { schema: _schema, ...plugin } = sso({
+		defaultSSO: providers.map((provider) => defaultSsoEntry(provider, baseURL)),
+		domainVerification: { enabled: true },
+		organizationProvisioning: { disabled: true },
+		providersLimit: 0
+	});
+	return plugin;
+};
+//#endregion
+export { defaultSsoEntry, samlPlugin };

package/dist/better-auth/saml-sign-in.d.ts

@@ -1,4 +1,3 @@
-import "@better-auth/sso";
 //#region src/better-auth/saml-sign-in.d.ts
 /**
  * A SAML 2.0 identity provider people of the app sign in with, for example the company's Okta, Entra ID or Google
@@ -34,4 +33,31 @@ export type SamlProvider = {
 export type SsoOptions = {
   saml: SamlProvider[];
 };
+/**
+ * The providers with their defaults filled in: the name `SSO`, and the domains trimmed and lowercased. A malformed id,
+ * an id used twice or by another sign-in provider (`takenIds`), no domains or a domain that is not a host name, and IdP
+ * settings that are missing or not a URL are errors.
+ */
+export declare const resolveSamlProviders: (saml: SamlProvider[], takenIds: string[]) => {
+  name: string;
+  domains: string[];
+  /** The id: the button's `?sign-in=` link, the provider's paths and the namespace of its accounts. Lowercase letters, digits or "-". */
+  id: string;
+  /** The provider's metadata XML, or its entity ID, sign-in URL and signing certificate(s) (PEM; several while one rotates). */
+  idp: {
+    metadata: string;
+  } | {
+    entityId: string;
+    ssoUrl: string;
+    certificate: string | string[];
+  };
+  /** The assertion's attribute names, when they are not `email`, `givenName`, `surname` and `displayName`. */
+  attributes?: {
+    email?: string;
+    name?: string;
+    firstName?: string;
+    lastName?: string;
+  };
+}[];
+export type ResolvedSamlProvider = ReturnType<typeof resolveSamlProviders>[number];
 //#endregion

package/dist/better-auth/saml-sign-in.js

@@ -1,7 +1,6 @@
 import { authBasePath } from "./auth-base-path.js";
 import { providerIdPattern } from "./platform-sign-in.js";
 import { APIError, createAuthMiddleware } from "better-auth/api";
-import { sso } from "@better-auth/sso";
 //#region src/better-auth/saml-sign-in.ts
 const domainPattern = /^[a-z0-9-]+(\.[a-z0-9-]+)*$/;
 const checkIdp = (id, idp) => {
@@ -37,37 +36,6 @@ const resolveSamlProviders = (saml, takenIds) => {
 };
 /** The app's SP entity ID for a provider: its metadata URL on `baseURL`, the same on every origin. */
 const samlEntityId = (baseURL, id) => `${baseURL.replace(/\/$/, "")}${authBasePath}/sso/saml2/sp/metadata?providerId=${encodeURIComponent(id)}`;
-/** The provider as one of the SSO plugin's configured providers (`defaultSSO`). */
-const defaultSsoEntry = (provider, baseURL) => {
-	const { idp, attributes = {} } = provider;
-	const mapping = Object.fromEntries(Object.entries(attributes).filter(([, name]) => name !== void 0));
-	return {
-		providerId: provider.id,
-		domain: provider.domains.join(","),
-		samlConfig: {
-			issuer: samlEntityId(baseURL, provider.id),
-			entryPoint: "ssoUrl" in idp ? idp.ssoUrl : "",
-			idpMetadata: "metadata" in idp ? { metadata: idp.metadata } : {
-				entityID: idp.entityId,
-				cert: idp.certificate
-			},
-			...Object.keys(mapping).length > 0 && { mapping }
-		}
-	};
-};
-/**
-* Better Auth's SSO plugin with the configured providers. Their domains are trusted, so an address there links to the
-* account that has it; organizations are not assigned by provider, and nobody registers providers.
-*/
-const samlPlugin = (providers, baseURL) => {
-	const { schema: _schema, ...plugin } = sso({
-		defaultSSO: providers.map((provider) => defaultSsoEntry(provider, baseURL)),
-		domainVerification: { enabled: true },
-		organizationProvisioning: { disabled: true },
-		providersLimit: 0
-	});
-	return plugin;
-};
 /** The SSO plugin's endpoints for providers kept in its table, and its OIDC callback, which Protobase does not serve. */
 const samlDisabledPaths = [
 	"/sso/register",
@@ -130,4 +98,4 @@ const emailInDomains = (email, domains) => {
 	return domains.some((allowed) => domain === allowed || domain.endsWith(`.${allowed}`));
 };
 //#endregion
-export { defaultSsoEntry, emailInDomains, isSamlPath, resolveSamlProviders, samlDisabledPaths, samlEntityId, samlGuardPlugin, samlPlugin, samlRefusal };
+export { emailInDomains, isSamlPath, resolveSamlProviders, samlDisabledPaths, samlEntityId, samlGuardPlugin, samlRefusal };

package/dist/better-auth/user-table.js

@@ -16,7 +16,7 @@ const userFields = {
 	last_role: "lastRole",
 	last_organization_id: "lastOrganizationId"
 };
-/** The user table's names, from `createAuth`'s `users` option; unknown columns are an error. */
+/** The user table's names, from `auth.users` option; unknown columns are an error. */
 const userTable = ({ table = "user", columns = {}, metadata } = {}) => {
 	const unknown = Object.keys(columns).find((name) => !(name in userFields));
 	if (unknown !== void 0) throw new Error(`users.columns names "${unknown}", which is not a column of the user table: ${Object.keys(userFields).join(", ")}`);

package/dist/better-auth/users.d.ts

@@ -10,7 +10,7 @@ export type LinkedAccount = {
 };
 /**
  * Without `password` the user signs in by emailed code, passkey or a sign-in provider only. `metadata` lands in the
- * user metadata column, which `createAuth`'s `users.metadata` names; it needs one.
+ * user metadata column, which `auth.users.metadata` names; it needs one.
  */
 export type NewUser = {
   email: string;

package/dist/create-admin.d.ts

@@ -35,6 +35,8 @@ export type CreateAdminInput = {
   auth?: AdminAuth;
   /** API functions of the app's own, each served at `<systemPath>/functions/<name>` (see `defineFunction`). */
   functions?: Record<string, FunctionSource>;
+  /** The app's secret (`secret`): it signs public forms' bot checks, and upload tickets unless `files.secret` names another. */
+  secret?: string;
   /** Where file fields keep their bytes (see `FilesOptions`). */
   files?: FilesOptions;
   /** Where the changes that resources' events are raised from are captured (see `EventsOptions`). */
@@ -45,9 +47,9 @@ export type CreateAdminInput = {
   jobs?: JobDefinition[];
   /** Where the resources' events are delivered (`subscription(...)` exports of the config module). */
   subscriptions?: SubscriptionDefinition[];
-  /** Webhook subscriptions made in the admin app, from `extends: [webhooks()]` (see `WebhooksOptions`). */
+  /** Webhook subscriptions made in the admin app, from `webhooks: {}` (see `WebhooksOptions`). */
   webhooks?: WebhooksOptions;
-  /** Each user's devices and the endpoints that register them, from `extends: [notifications()]` (see `NotificationsOptions`). */
+  /** Each user's devices and the endpoints that register them, from `notifications: {}` (see `NotificationsOptions`). */
   notifications?: NotificationsOptions;
   /**
    * The app's iOS and Android build (see `MobileConfig`): the API answers its Capacitor origins through CORS, and sign-in
@@ -88,5 +90,5 @@ export type CreateAdminInput = {
   upgradeWebSocket?: UpgradeWebSocket;
 };
 /** The admin REST API as a Hono app. It uses only Web APIs, so it runs on Node, Workers and anywhere else Hono does. */
-export declare const createAdmin: ({ resources: appResources, views: appViews, pages, userMenu, bottomBars, db, authenticate, auth, functions, files: filesOptions, events, history: historyOptions, jobs, subscriptions, webhooks: webhooksOptions, notifications, mobile, app: identity, icons, bundlePlugins, fieldTypes, options, formsDifficulty, commentUsers: givenCommentUsers, verifyToken, upgradeWebSocket }: CreateAdminInput) => Admin;
+export declare const createAdmin: ({ resources: appResources, views: appViews, pages, userMenu, bottomBars, db, authenticate, auth, functions, secret, files: filesOptions, events, history: historyOptions, jobs, subscriptions, webhooks: webhooksOptions, notifications, mobile, app: identity, icons, bundlePlugins, fieldTypes, options, formsDifficulty, commentUsers: givenCommentUsers, verifyToken, upgradeWebSocket }: CreateAdminInput) => Admin;
 //#endregion

package/dist/create-admin.js

@@ -103,7 +103,7 @@ const declaredRoles = (auth, roles) => {
 	return names.length > 0 ? [...new Set(names)] : void 0;
 };
 /** The admin REST API as a Hono app. It uses only Web APIs, so it runs on Node, Workers and anywhere else Hono does. */
-const createAdmin = ({ resources: appResources, views: appViews = [], pages = [], userMenu, bottomBars = [], db, authenticate, auth, functions = {}, files: filesOptions, events, history: historyOptions, jobs = [], subscriptions = [], webhooks: webhooksOptions, notifications, mobile, app: identity, icons, bundlePlugins = [], fieldTypes = {}, options = {}, formsDifficulty, commentUsers: givenCommentUsers, verifyToken, upgradeWebSocket }) => {
+const createAdmin = ({ resources: appResources, views: appViews = [], pages = [], userMenu, bottomBars = [], db, authenticate, auth, functions = {}, secret, files: filesOptions, events, history: historyOptions, jobs = [], subscriptions = [], webhooks: webhooksOptions, notifications, mobile, app: identity, icons, bundlePlugins = [], fieldTypes = {}, options = {}, formsDifficulty, commentUsers: givenCommentUsers, verifyToken, upgradeWebSocket }) => {
 	const basePath = options.basePath ?? "/api/v1";
 	const appModels = appResources.map((resource) => resource.toModel());
 	const withComments = appModels.some((model) => model.comments);
@@ -154,6 +154,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 		views: viewModels,
 		limits: options.roles?.limits ?? [],
 		env: globalThis.process?.env ?? {},
+		...secret && { secret },
 		...formsDifficulty && { difficulty: formsDifficulty }
 	});
 	const systemPath = basePath.slice(0, basePath.lastIndexOf("/"));
@@ -178,6 +179,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	});
 	const files = createFilesRuntime({
 		...filesOptions && { options: filesOptions },
+		...secret && { secret },
 		env: globalThis.process?.env ?? {},
 		models: registry.entries.map((entry) => entry.model),
 		systemPath,

package/dist/encryption/keyring.js

@@ -27,7 +27,7 @@ const entriesOf = (env) => {
 	}))];
 };
 const checkApart = (entries, env) => {
-	for (const name of ["BETTER_AUTH_SECRET", "PROTOBASE_SECRET_KEY"]) {
+	for (const name of ["PROTOBASE_SECRET", "PROTOBASE_SECRET_KEY"]) {
 		const secret = env[name]?.trim();
 		const same = secret && entries.find((entry) => entry.text === secret);
 		if (same) throw new Error(`${same.where} is the same as ${name}: give encryption a key of its own`);

package/dist/files/options.d.ts

@@ -1,21 +1,18 @@
 import { Sharp } from "./images.js";
 import { FileProvider } from "./store.js";
 //#region src/files/options.d.ts
-/** `files` in `protobase.config.ts`. Environment variables override it (see `resolveProviders`). */
+/** Where file fields keep their bytes, as the API runs with them: `files` of `protobase.config.ts` with its providers made. Environment variables override it (see `resolveProviders`). */
 export type FilesOptions = {
   /**
-   * Providers by name, such as `private: localFiles({ dir: './data/files' })`. A name is part of every stored value, so
-   * name the role (`archive`), not the vendor. Without config, `private` and `public` are folders under `data/files`.
+   * Providers by name. A name is part of every stored value, so name the role (`archive`), not the vendor. Without
+   * config, `private` and `public` are folders under `data/files`.
    */
   providers?: Record<string, FileProvider>;
   /** How long bytes outlive their last reference, for restores; default `1 day`. Public providers default to 0. */
   retention?: number | string;
-  /** Signs upload tickets and download URLs; default `PROTOBASE_FILES_SECRET`, then `BETTER_AUTH_SECRET`. */
+  /** Signs upload tickets and download URLs; default `PROTOBASE_FILES_SECRET`, then the app's `secret` (`PROTOBASE_SECRET`). */
   secret?: string;
-  /**
-   * The image library that makes the variants and placeholders of image fields: `import sharp from 'sharp'` in the
-   * config, so a built bundle carries it with its native add-on.
-   */
+  /** The image library that makes the variants and placeholders of image fields: sharp's default export. */
   sharp?: Sharp;
   /**
    * Hosts whose images the admin app draws with the page's referrer, besides the app's own and those its providers link

package/dist/files/provider-settings.d.ts

@@ -0,0 +1,16 @@
+import { FileProvider } from "./store.js";
+import { LocalFilesOptions } from "./local-files.js";
+import { S3FilesOptions } from "./s3-files.js";
+//#region src/files/provider-settings.d.ts
+/**
+ * A built-in file provider in `files.providers`, as data: `{ kind: 'local', dir }`, a folder on local disk, or
+ * `{ kind: 's3', bucket }`, an S3-compatible bucket. The provider is made when the app serves.
+ */
+export type FileProviderSettings = ({
+  kind: 'local';
+} & LocalFilesOptions) | ({
+  kind: 's3';
+} & S3FilesOptions);
+/** The provider the settings describe. */
+export declare const fileProviderOf: (name: string, settings: FileProviderSettings) => FileProvider;
+//#endregion

package/dist/files/provider-settings.js

@@ -0,0 +1,17 @@
+import { localFiles } from "./local-files.js";
+import { s3Files } from "./s3-files.js";
+//#region src/files/provider-settings.ts
+/** The provider the settings describe. */
+const fileProviderOf = (name, settings) => {
+	if (settings.kind === "local") {
+		const { kind: _, ...options } = settings;
+		return localFiles(options);
+	}
+	if (settings.kind === "s3") {
+		const { kind: _, ...options } = settings;
+		return s3Files(options);
+	}
+	throw new Error(`files.providers.${name}: kind is "local", "s3" or "custom", whose provider is the default export of files/${name}.ts`);
+};
+//#endregion
+export { fileProviderOf };

package/dist/files/runtime.js

@@ -13,7 +13,7 @@ const imageFields = (models) => models.flatMap((model) => Object.values(model.fi
 * The runtime, when a resource has a file field, the config names providers or the app serves `/api/sb/storage/v1`. It fails at startup when a field's
 * provider is not configured, nothing signs uploads, or a field makes image variants or placeholders without sharp.
 */
-const createFilesRuntime = ({ options = {}, env, models, systemPath, storage: servesStorage = false }) => {
+const createFilesRuntime = ({ options = {}, env, secret: appSecret, models, systemPath, storage: servesStorage = false }) => {
 	const storageName = servesStorage ? storageProviderName(options) : void 0;
 	const storage = storageName && options.storage !== false ? {
 		provider: storageName,
@@ -22,10 +22,10 @@ const createFilesRuntime = ({ options = {}, env, models, systemPath, storage: se
 	const fieldProviders = models.flatMap((model) => Object.values(model.fields).flatMap((field) => field.file ? [field.file.provider] : []));
 	const used = [.../* @__PURE__ */ new Set([...fieldProviders, ...storage ? [storage.provider] : []])];
 	if (used.length === 0 && !options.providers) return void 0;
-	const secret = options.secret ?? env.PROTOBASE_FILES_SECRET ?? env.BETTER_AUTH_SECRET;
-	if (!secret) throw new Error("File fields and /api/sb/storage/v1 need a secret to sign uploads: set BETTER_AUTH_SECRET, PROTOBASE_FILES_SECRET or files.secret");
+	const secret = options.secret ?? env.PROTOBASE_FILES_SECRET ?? appSecret ?? env.PROTOBASE_SECRET;
+	if (!secret) throw new Error("File fields and /api/sb/storage/v1 need a secret to sign uploads: set secret in protobase.config.ts, files.secret or PROTOBASE_FILES_SECRET");
 	const images = imageFields(models);
-	if (images.length > 0 && !options.sharp) throw new Error(`${images.join(", ")} make image variants or placeholders, which need sharp: add it to the project (bun add sharp), then import sharp from 'sharp' in the config and pass files: { sharp }`);
+	if (images.length > 0 && !options.sharp) throw new Error(`${images.join(", ")} make image variants or placeholders, which need sharp: add it to the project (bun add sharp), then give the config files: { sharp: () => import('sharp') }`);
 	const providers = resolveProviders(options, env, used);
 	const retention = retentionOf(options, env);
 	return {

package/dist/forms/runtime.js

@@ -12,15 +12,15 @@ const anonymousCreates = (limits) => (resource) => {
 * The public forms of the views, checked, with the challenges that guard them and their rate limit; `undefined` without
 * any. Fails at startup on a form that cannot be served and when nothing signs the challenges.
 */
-const createFormsRuntime = ({ registry, views, limits, env, difficulty }) => {
+const createFormsRuntime = ({ registry, views, limits, env, secret: appSecret, difficulty }) => {
 	const declared = [...views].sort((a, b) => Number(a.roles !== void 0) - Number(b.roles !== void 0)).flatMap((view) => (view.forms ?? []).map((form) => ({
 		form,
 		view
 	})));
 	if (declared.length === 0) return void 0;
 	const forms = checkForms(registry, declared, anonymousCreates(limits));
-	const secret = env.PROTOBASE_FORMS_SECRET ?? env.BETTER_AUTH_SECRET;
-	if (!secret) throw new Error("Public forms need a secret to sign their bot checks: set PROTOBASE_FORMS_SECRET or BETTER_AUTH_SECRET");
+	const secret = env.PROTOBASE_FORMS_SECRET ?? appSecret ?? env.PROTOBASE_SECRET;
+	if (!secret) throw new Error("Public forms need a secret to sign their bot checks: set secret in protobase.config.ts, or PROTOBASE_FORMS_SECRET");
 	return {
 		forms,
 		challenges: createFormChallenges(secret, { ...difficulty && { difficulty } }),

package/dist/index.d.ts

@@ -51,20 +51,25 @@ import { RuntimeOptions, runtimeUrl, runtimeVariable, seesRuntime } from "./runt
 import { AdminOptions } from "./admin-options.js";
 import { CreateAdminInput, createAdmin } from "./create-admin.js";
 import { handleDroppedConnections } from "./dropped-connections.js";
-import { AppPoolConfig, PgModule, appPool, longQueryPool, poolWaitMs, readDbConnections } from "./app-pool.js";
+import { AppPoolConfig, PgModule, poolWaitMs, readDbConnections } from "./app-pool.js";
 import { ConnectionsBusy } from "./connections-busy.js";
 import { isBackgroundWork, runInBackground, wantsLongQueries } from "./background-work.js";
 import { longQueryTimeoutMs } from "./statement-timeout.js";
 import { checkViewQueries } from "./check-view-queries.js";
-import { ProjectConfig, defineConfig, mergeConfig } from "./project-config.js";
 import { consoleAuditQueue } from "./audit/console-queue.js";
 import { JwtOptions, JwtVerifyOptions, jwtAuthenticator, jwtVerifier } from "./auth/jwt.js";
+import { SignInPolicy, SignInRule, StaffAccessRule, defaultSignInPolicy, signInPolicyMethods } from "./better-auth/sign-in-policy.js";
+import { StaffSignIn } from "./better-auth/staff-log.js";
+import { RoleDefinition, RolesInput } from "./better-auth/organizations/role-definitions.js";
+import { OrganizationRole, StoredMember, StoredOrganization } from "./better-auth/organizations/store.js";
+import { OrganizationsOptions } from "./better-auth/organizations/options.js";
+import { AuthHooks, AuthSettings, HookContext } from "./better-auth/auth-settings.js";
 import { TrustedApp, withTrustedApps } from "./better-auth/app-tokens.js";
-import { BetterAuthAuthenticator, BetterAuthAuthenticatorOptions, betterAuthAuthenticator, betterAuthTokens } from "./better-auth/authenticator.js";
+import { BetterAuthAuthenticator, BetterAuthAuthenticatorOptions, betterAuthTokens } from "./better-auth/authenticator.js";
+import { AuthenticateSettings } from "./better-auth/authenticate-settings.js";
 import { parseRoles } from "./better-auth/parse-roles.js";
 import { LinkedAccount, NewUser, StoredUser, createUser, deleteUser, hasUsers, listUsers, roleChoices, setUserBanned, setUserRole } from "./better-auth/users.js";
 import { IssueTokenOptions, issueToken, maxTokenTtlSeconds } from "./better-auth/tokens.js";
-import { SignInPolicy, SignInRule, StaffAccessRule, defaultSignInPolicy, signInPolicyMethods } from "./better-auth/sign-in-policy.js";
 import { passwordLength } from "./better-auth/new-account-password.js";
 import { OperatorProvider, readOperatorSettings } from "./better-auth/operator-provider.js";
 import { isOAuthWellKnownPath, oauthWellKnownPaths, webauthnPath } from "./better-auth/origins.js";
@@ -72,7 +77,7 @@ import { goTruePath } from "./gotrue/keys.js";
 import { supabasePath } from "./supabase-paths.js";
 import { realtimeLimits } from "./realtime/realtime-limits.js";
 import { capSocketMessages, honorSocketMessageCaps, socketMessageCapOf } from "./functions/socket-message-cap.js";
-import { defaultAppName, shownAppName } from "./app-name.js";
+import { appNameOver, defaultAppName, shownAppName } from "./app-name.js";
 import { webManifestPath } from "./web-app/web-manifest-route.js";
 import { PlatformSignIn, readPlatformSignIn } from "./better-auth/platform-sign-in.js";
 import { authSchemaMigration, checkAuthSchema } from "./better-auth/auth-schema.js";
@@ -86,12 +91,10 @@ import { ResourceChange, recordOf, resourceChange } from "./changes/resource-cha
 import { eventMatcher } from "./changes/match-events.js";
 import { parseColumns, readOutbox } from "./changes/outbox.js";
 import { newWebhookSecret } from "./webhooks/standard-webhooks.js";
-import { webhooks } from "./webhooks/table/plugin.js";
 import { checkWebhooksSchema, webhooksMigration } from "./webhooks/table/schema.js";
 import { checkComments, commentsMigration } from "./comments/comments-sql.js";
 import { CheckAiInput, checkAi } from "./ai/check-ai.js";
 import { CommentItem } from "./comments/comment-item.js";
-import { notifications } from "./notifications/plugin.js";
 import { checkNotificationsSchema, notificationsMigration } from "./notifications/schema.js";
 import { deviceStore, removeDevicesWithUsers } from "./notifications/device-store-of.js";
 import { DeviceStoreError, postgresDeviceStore } from "./notifications/postgres-store.js";
@@ -105,11 +108,7 @@ import { sendNotification } from "./notifications/send-notification.js";
 import { VapidSettings, readVapidSettings, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable } from "./notifications/web-push/vapid-settings.js";
 import { WebPushOptions, webPushSender } from "./notifications/web-push/web-push-sender.js";
 import { generateVapidKeys } from "./notifications/web-push/keys.js";
-import { RoleDefinition, RolesInput } from "./better-auth/organizations/role-definitions.js";
-import { OrganizationRole, StoredMember, StoredOrganization } from "./better-auth/organizations/store.js";
-import { OrganizationsOptions } from "./better-auth/organizations/options.js";
 import { MemberInput, NewOrganization, addAppRoleToOwners, addMember, createOrganization, listOrganizations, removeMember, setMemberRoles } from "./better-auth/organizations/host.js";
-import { StaffSignIn } from "./better-auth/staff-log.js";
 import { AssistantBackend, assistantProtocolRoutes } from "./assistant/protocol-routes.js";
 import { fileConversationStore } from "./assistant/file-conversation-store.js";
 import { withCacheBreakpoints } from "./assistant/cache-breakpoints.js";
@@ -139,9 +138,10 @@ import { SignatureOptions, StandardWebhookOptions, verifySignature, verifyStanda
 import { requireEnv } from "./functions/require-env.js";
 import { backgroundSettled, waitUntil } from "./functions/wait-until.js";
 import { FileLimits, limitedFileStore, storeUsage } from "./files/limits.js";
-import { LocalFilesOptions, localFileStore, localFiles } from "./files/local-files.js";
+import { LocalFilesOptions, localFileStore } from "./files/local-files.js";
+import { S3Bucket, S3FilesOptions, S3ListPage, S3Object, s3FileStore } from "./files/s3-files.js";
+import { FileProviderSettings } from "./files/provider-settings.js";
 import { StoreFileInput, storeFile } from "./files/store-file.js";
-import { S3Bucket, S3FilesOptions, S3ListPage, S3Object, s3FileStore, s3Files } from "./files/s3-files.js";
 import { storageProvider } from "./files/storage-provider.js";
 import { objectKey } from "./storage/object-key.js";
 import { FileCleanupInput, createFileCleanup } from "./files/file-cleanup.js";
@@ -154,6 +154,7 @@ import { FileRef, formatUri, variantPath } from "./files/uri.js";
 import { aspectRatio, fileSize, fileType, imageSize, processor } from "./files/processors.js";
 import { defineJob, isJobDefinition, jobDefinitions } from "./jobs/define-job.js";
 import { FatalJobError } from "./jobs/run-job.js";
+import { JobDeclaration, JobRun, enqueueJob } from "./jobs/declared-job.js";
 import { isSchedule } from "./jobs/schedule.js";
 import { EmailComponent, EmailOptions, EmailTemplate, RenderedEmail, defineEmail } from "./mail/define-email.js";
 import { DrainResult, JobsRuntime, StartJobsOptions, startJobs } from "./jobs/runtime.js";
@@ -162,5 +163,5 @@ import { checkJobsSchema, jobsSchema, jobsSchemaMigration } from "./jobs/schema.
 import { MobileRelease, ReleaseFile, ServedReleaseFile, composeRelease, releaseManifest } from "./mobile-release/release.js";
 import { MobileReleaseAppInput, OfferedRelease, mobileReleaseApp } from "./mobile-release/release-app.js";
 import { mobileSigningKeyVariable, readSigningKey } from "./mobile-release/signing-key.js";
-import { AdminAuth, CreateAuthOptions, UserCreatedHook, createAuth, normalizeRoles } from "./better-auth/create-auth.js";
-export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApiKeys, type ApiKeysOptions, type ApnsEnvironment, type AppIcons, type AppIdentity, type AppPoolConfig, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BatchOperation, type BatchResult, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type Caller, type CallerOptions, type CapturedRow, type CascadingKey, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, ConnectionsBusy, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type Device, type DeviceColumn, type DeviceKind, type DeviceStore, DeviceStoreError, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryColumn, type HistoryOptions, type HistoryPosition, type HistoryStore, HistoryStoreError, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JsonObject, type JsonValue, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type McpApprovals, type McpGateInput, type McpHandlerInput, type McpRoutesInput, type McpServerInput, type McpToolsInput, type McpWrites, type MemberInput, type Membership, MissingCredentials, type MobileConfig, type MobileRelease, type MobileReleaseAppInput, ModelError, type ModelSettings, type NewDevice, type NewNotification, type NewOrganization, type NewUser, type NotificationRecipients, NotificationSendError, type NotificationsOptions, type OfferedRelease, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PgModule, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type PushAnswer, type PushMessage, PushMessageError, type PushSender, type QueryOptions, type QueryResult, type ReadableResources, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordKeyInput, type RecordPage, type ReleaseFile, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type SendNotification, type ServedReleaseFile, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredNotification, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolAnnotations, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type Urgency, type User, type UserCreatedHook, type VapidSettings, type ViewSource, type WebPushFields, type WebPushOptions, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, type WriteRecordToolsInput, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appPool, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkResourcesOutsideAuthStore, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, composeRelease, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, deviceIdParam, deviceStore, devicesPath, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, localFiles, longQueryPool, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, mergeConfig, migrationCommand, mobileReleaseApp, mobileSigningKeyVariable, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notifications, notificationsMigration, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readSigningKey, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, recordOf, releaseManifest, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };
+import { AdminAuth, CreateAuthOptions, UserCreatedHook, normalizeRoles } from "./better-auth/create-auth.js";
+export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApiKeys, type ApiKeysOptions, type ApnsEnvironment, type AppIcons, type AppIdentity, type AppPoolConfig, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type AuthHooks, type AuthSettings, type AuthenticateSettings, type Authenticator, type BatchOperation, type BatchResult, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type Caller, type CallerOptions, type CapturedRow, type CascadingKey, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, ConnectionsBusy, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type Device, type DeviceColumn, type DeviceKind, type DeviceStore, DeviceStoreError, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileProviderSettings, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryColumn, type HistoryOptions, type HistoryPosition, type HistoryStore, HistoryStoreError, type HookContext, HttpProblem, type IssueTokenOptions, type JobContext, type JobDeclaration, type JobDefinition, type JobOptions, type JobRun, type JobsRuntime, type JsonObject, type JsonValue, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type McpApprovals, type McpGateInput, type McpHandlerInput, type McpRoutesInput, type McpServerInput, type McpToolsInput, type McpWrites, type MemberInput, type Membership, MissingCredentials, type MobileConfig, type MobileRelease, type MobileReleaseAppInput, ModelError, type ModelSettings, type NewDevice, type NewNotification, type NewOrganization, type NewUser, type NotificationRecipients, NotificationSendError, type NotificationsOptions, type OfferedRelease, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PgModule, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type PushAnswer, type PushMessage, PushMessageError, type PushSender, type QueryOptions, type QueryResult, type ReadableResources, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordKeyInput, type RecordPage, type ReleaseFile, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type SendNotification, type ServedReleaseFile, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredNotification, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolAnnotations, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type Urgency, type User, type UserCreatedHook, type VapidSettings, type ViewSource, type WebPushFields, type WebPushOptions, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, type WriteRecordToolsInput, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appNameOver, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkResourcesOutsideAuthStore, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, composeRelease, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, deviceIdParam, deviceStore, devicesPath, enqueueJob, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, migrationCommand, mobileReleaseApp, mobileSigningKeyVariable, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notificationsMigration, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readSigningKey, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, recordOf, releaseManifest, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };

package/dist/index.js

@@ -26,7 +26,7 @@ import { apiKeyCaller } from "./api-keys/resolve-caller.js";
 import { jwtAuthenticator, jwtVerifier } from "./auth/jwt.js";
 import { realtimeLimits } from "./realtime/realtime-limits.js";
 import { objectKey } from "./storage/object-key.js";
-import { defaultAppName, shownAppName } from "./app-name.js";
+import { appNameOver, defaultAppName, shownAppName } from "./app-name.js";
 import { supabasePath } from "./supabase-paths.js";
 import { goTruePath } from "./gotrue/keys.js";
 import { defaultSignInPolicy, signInPolicyMethods } from "./better-auth/sign-in-policy.js";
@@ -34,7 +34,7 @@ import { parseRoles } from "./better-auth/parse-roles.js";
 import { passwordLength } from "./better-auth/new-account-password.js";
 import { readOperatorSettings } from "./better-auth/operator-provider.js";
 import { readPlatformSignIn } from "./better-auth/platform-sign-in.js";
-import { createAuth, normalizeRoles } from "./better-auth/create-auth.js";
+import { normalizeRoles } from "./better-auth/create-auth.js";
 import { mcpApprovals } from "./mcp/mcp-approval-store.js";
 import { mcpToolContext } from "./mcp/mcp-context.js";
 import { mcpGate, sessionOf } from "./mcp/mcp-gate.js";
@@ -75,8 +75,8 @@ import { NotificationSendError, maxMessageBytes, maxRecipients } from "./notific
 import { errorReportingSettings, errorReportingVariable } from "./error-reporting/error-reporting-settings.js";
 import { storageCleanupSchedule } from "./files/cleanup-schedule.js";
 import { limitedFileStore, storeUsage } from "./files/limits.js";
-import { localFileStore, localFiles } from "./files/local-files.js";
-import { s3FileStore, s3Files } from "./files/s3-files.js";
+import { localFileStore } from "./files/local-files.js";
+import { s3FileStore } from "./files/s3-files.js";
 import { storageProvider } from "./files/storage-provider.js";
 import { isBackgroundWork, runInBackground, wantsLongQueries } from "./background-work.js";
 import { capSocketMessages, honorSocketMessageCaps, socketMessageCapOf } from "./functions/socket-message-cap.js";
@@ -89,22 +89,19 @@ import { pngIcons } from "./web-app/app-icons.js";
 import { webManifestPath } from "./web-app/web-manifest-route.js";
 import { createAdmin } from "./create-admin.js";
 import { handleDroppedConnections } from "./dropped-connections.js";
-import { appPool, longQueryPool, poolWaitMs, readDbConnections } from "./app-pool.js";
+import { poolWaitMs, readDbConnections } from "./app-pool.js";
 import { configExports } from "./resource-source.js";
 import { checkViewQueries } from "./check-view-queries.js";
-import { defineConfig, mergeConfig } from "./project-config.js";
 import { withTrustedApps } from "./better-auth/app-tokens.js";
-import { betterAuthAuthenticator, betterAuthTokens } from "./better-auth/authenticator.js";
+import { betterAuthTokens } from "./better-auth/authenticator.js";
 import { issueToken, maxTokenTtlSeconds } from "./better-auth/tokens.js";
 import { authSchemaMigration, checkAuthSchema } from "./better-auth/auth-schema.js";
 import { authSchemaDrift } from "./better-auth/store/drift.js";
 import { authStoreTables } from "./better-auth/auth-tables.js";
 import { checkResourcesOutsideAuthStore } from "./better-auth/store/resources-outside.js";
 import { checkComputed, computedMigration } from "./computed/computed-schema.js";
-import { webhooks } from "./webhooks/table/plugin.js";
 import { checkWebhooksSchema, webhooksMigration } from "./webhooks/table/schema.js";
 import { checkAi } from "./ai/check-ai.js";
-import { notifications } from "./notifications/plugin.js";
 import { checkNotificationsSchema, notificationsMigration } from "./notifications/schema.js";
 import { sendNotification } from "./notifications/send-notification.js";
 import { maxWidgetPropsBytes, widget } from "./assistant/widget.js";
@@ -119,10 +116,11 @@ import { storeFile } from "./files/store-file.js";
 import { createFileCleanup } from "./files/file-cleanup.js";
 import { createEncryptionTools } from "./encryption/tools.js";
 import { aspectRatio, fileSize, fileType, imageSize, processor } from "./files/processors.js";
+import { enqueueJob } from "./jobs/declared-job.js";
 import { defineEmail } from "./mail/define-email.js";
 import { startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
 import { composeRelease, releaseManifest } from "./mobile-release/release.js";
 import { mobileReleaseApp } from "./mobile-release/release-app.js";
 import { mobileSigningKeyVariable, readSigningKey } from "./mobile-release/signing-key.js";
-export { ConnectionsBusy, DeviceStoreError, FatalJobError, HistoryStoreError, HttpProblem, MissingCredentials, ModelError, NotificationSendError, PushMessageError, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appPool, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkResourcesOutsideAuthStore, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, composeRelease, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, deviceIdParam, deviceStore, devicesPath, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, localFiles, longQueryPool, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, mergeConfig, migrationCommand, mobileReleaseApp, mobileSigningKeyVariable, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notifications, notificationsMigration, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readSigningKey, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, recordOf, releaseManifest, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };
+export { ConnectionsBusy, DeviceStoreError, FatalJobError, HistoryStoreError, HttpProblem, MissingCredentials, ModelError, NotificationSendError, PushMessageError, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appNameOver, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkResourcesOutsideAuthStore, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, composeRelease, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, deviceIdParam, deviceStore, devicesPath, enqueueJob, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, migrationCommand, mobileReleaseApp, mobileSigningKeyVariable, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notificationsMigration, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readSigningKey, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, recordOf, releaseManifest, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };

package/dist/internal.d.ts

@@ -0,0 +1,13 @@
+import { checkNotificationsOptions } from "./notifications/options.js";
+import { isSubscription } from "./webhooks/subscription.js";
+import { appPool, longQueryPool } from "./app-pool.js";
+import { AppAuthInput, appAuthOptions, buildAppAuth } from "./better-auth/auth-settings.js";
+import { betterAuthAuthenticator } from "./better-auth/authenticator.js";
+import { buildAuthenticator } from "./better-auth/authenticate-settings.js";
+import { localFiles } from "./files/local-files.js";
+import { s3Files } from "./files/s3-files.js";
+import { fileProviderOf } from "./files/provider-settings.js";
+import { declaredJob } from "./jobs/declared-job.js";
+import { AuthPlugins, buildAuth, createAuth, loadAuthPlugins } from "./better-auth/create-auth.js";
+import { webhooksModule } from "./webhooks/table/webhooks-module.js";
+export { type AppAuthInput, type AuthPlugins, appAuthOptions, appPool, betterAuthAuthenticator, buildAppAuth, buildAuth, buildAuthenticator, checkNotificationsOptions, createAuth, declaredJob, fileProviderOf, isSubscription, loadAuthPlugins, localFiles, longQueryPool, s3Files, webhooksModule };

package/dist/internal.js

@@ -0,0 +1,13 @@
+import { buildAuth, createAuth, loadAuthPlugins } from "./better-auth/create-auth.js";
+import { isSubscription } from "./webhooks/subscription.js";
+import { checkNotificationsOptions } from "./notifications/options.js";
+import { localFiles } from "./files/local-files.js";
+import { s3Files } from "./files/s3-files.js";
+import { appPool, longQueryPool } from "./app-pool.js";
+import { betterAuthAuthenticator } from "./better-auth/authenticator.js";
+import { declaredJob } from "./jobs/declared-job.js";
+import { appAuthOptions, buildAppAuth } from "./better-auth/auth-settings.js";
+import { buildAuthenticator } from "./better-auth/authenticate-settings.js";
+import { fileProviderOf } from "./files/provider-settings.js";
+import { webhooksModule } from "./webhooks/table/webhooks-module.js";
+export { appAuthOptions, appPool, betterAuthAuthenticator, buildAppAuth, buildAuth, buildAuthenticator, checkNotificationsOptions, createAuth, declaredJob, fileProviderOf, isSubscription, loadAuthPlugins, localFiles, longQueryPool, s3Files, webhooksModule };

package/dist/jobs/declared-job.d.ts

@@ -0,0 +1,24 @@
+import { EnqueueOptions, JobContext, JobDefinition, JobOptions } from "./job-types.js";
+import { ArgumentsSpec } from "@protobase/schema";
+import { Db } from "@protobase/query";
+//#region src/jobs/declared-job.d.ts
+/**
+ * A job as `protobase.config.ts` declares it, by its name: what it does, its arguments and when it runs. Its run is the
+ * default export of `jobs/<name>.ts`, loaded the first time the job runs.
+ */
+export type JobDeclaration = Omit<JobOptions<unknown>, 'name' | 'payload' | 'run'> & {
+  /** What the job does, for the people who read the config and the failed jobs page. */
+  description?: string;
+  /** Its arguments by name, each a field type or a type with options (see `ArgumentSpec`), such as `{ invoiceId: 'bigint' }`. */
+  arguments?: ArgumentsSpec;
+};
+/** The default export of `jobs/<name>.ts`: what the job does with its arguments. */
+export type JobRun<Payload = Record<string, unknown>> = (payload: Payload, context: JobContext) => Promise<void> | void;
+/** The job a config declares, whose run `load` gives on its first run. */
+export declare const declaredJob: (name: string, { description: _, arguments: args, ...options }: JobDeclaration, load: () => Promise<JobRun>) => JobDefinition;
+/**
+ * Enqueues the job named `name`, which the config declares, in `db`'s own transaction when it is one, and returns its
+ * id: what a write hook calls, so the job commits with the write or not at all.
+ */
+export declare const enqueueJob: (db: Db, name: string, payload?: Record<string, unknown>, options?: EnqueueOptions) => Promise<string>;
+//#endregion

package/dist/jobs/declared-job.js

@@ -0,0 +1,26 @@
+import { currentJobs } from "./current.js";
+import { defineJob } from "./define-job.js";
+import { argumentsSchema } from "@protobase/schema";
+//#region src/jobs/declared-job.ts
+/** The job a config declares, whose run `load` gives on its first run. */
+const declaredJob = (name, { description: _, arguments: args, ...options }, load) => {
+	let run;
+	return defineJob({
+		...options,
+		name,
+		...args && { payload: argumentsSchema(name, args) },
+		run: async (payload, context) => (await (run ??= load()))(payload ?? {}, context)
+	});
+};
+/**
+* Enqueues the job named `name`, which the config declares, in `db`'s own transaction when it is one, and returns its
+* id: what a write hook calls, so the job commits with the write or not at all.
+*/
+const enqueueJob = (db, name, payload, options) => {
+	const runtime = currentJobs();
+	const definition = runtime.definition(name);
+	if (!definition) throw new Error(`There is no job "${name}": declare it in protobase.config.ts's jobs`);
+	return runtime.enqueue(definition, db, payload, options);
+};
+//#endregion
+export { declaredJob, enqueueJob };