@protobase/server 0.48.0 → 0.49.1

package/dist/better-auth/saml-plugin.js

@@ -0,0 +1,36 @@
+import { samlEntityId } from "./saml-sign-in.js";
+import { sso } from "@better-auth/sso";
+//#region src/better-auth/saml-plugin.ts
+/** The provider as one of the SSO plugin's configured providers (`defaultSSO`). */
+const defaultSsoEntry = (provider, baseURL) => {
+	const { idp, attributes = {} } = provider;
+	const mapping = Object.fromEntries(Object.entries(attributes).filter(([, name]) => name !== void 0));
+	return {
+		providerId: provider.id,
+		domain: provider.domains.join(","),
+		samlConfig: {
+			issuer: samlEntityId(baseURL, provider.id),
+			entryPoint: "ssoUrl" in idp ? idp.ssoUrl : "",
+			idpMetadata: "metadata" in idp ? { metadata: idp.metadata } : {
+				entityID: idp.entityId,
+				cert: idp.certificate
+			},
+			...Object.keys(mapping).length > 0 && { mapping }
+		}
+	};
+};
+/**
+* Better Auth's SSO plugin with the configured providers. Their domains are trusted, so an address there links to the
+* account that has it; organizations are not assigned by provider, and nobody registers providers.
+*/
+const samlPlugin = (providers, baseURL) => {
+	const { schema: _schema, ...plugin } = sso({
+		defaultSSO: providers.map((provider) => defaultSsoEntry(provider, baseURL)),
+		domainVerification: { enabled: true },
+		organizationProvisioning: { disabled: true },
+		providersLimit: 0
+	});
+	return plugin;
+};
+//#endregion
+export { defaultSsoEntry, samlPlugin };

package/dist/better-auth/saml-sign-in.d.ts

@@ -1,4 +1,3 @@
-import "@better-auth/sso";
 //#region src/better-auth/saml-sign-in.d.ts
 /**
  * A SAML 2.0 identity provider people of the app sign in with, for example the company's Okta, Entra ID or Google
@@ -34,4 +33,31 @@ export type SamlProvider = {
 export type SsoOptions = {
   saml: SamlProvider[];
 };
+/**
+ * The providers with their defaults filled in: the name `SSO`, and the domains trimmed and lowercased. A malformed id,
+ * an id used twice or by another sign-in provider (`takenIds`), no domains or a domain that is not a host name, and IdP
+ * settings that are missing or not a URL are errors.
+ */
+export declare const resolveSamlProviders: (saml: SamlProvider[], takenIds: string[]) => {
+  name: string;
+  domains: string[];
+  /** The id: the button's `?sign-in=` link, the provider's paths and the namespace of its accounts. Lowercase letters, digits or "-". */
+  id: string;
+  /** The provider's metadata XML, or its entity ID, sign-in URL and signing certificate(s) (PEM; several while one rotates). */
+  idp: {
+    metadata: string;
+  } | {
+    entityId: string;
+    ssoUrl: string;
+    certificate: string | string[];
+  };
+  /** The assertion's attribute names, when they are not `email`, `givenName`, `surname` and `displayName`. */
+  attributes?: {
+    email?: string;
+    name?: string;
+    firstName?: string;
+    lastName?: string;
+  };
+}[];
+export type ResolvedSamlProvider = ReturnType<typeof resolveSamlProviders>[number];
 //#endregion

package/dist/better-auth/saml-sign-in.js

@@ -1,7 +1,6 @@
 import { authBasePath } from "./auth-base-path.js";
 import { providerIdPattern } from "./platform-sign-in.js";
 import { APIError, createAuthMiddleware } from "better-auth/api";
-import { sso } from "@better-auth/sso";
 //#region src/better-auth/saml-sign-in.ts
 const domainPattern = /^[a-z0-9-]+(\.[a-z0-9-]+)*$/;
 const checkIdp = (id, idp) => {
@@ -37,37 +36,6 @@ const resolveSamlProviders = (saml, takenIds) => {
 };
 /** The app's SP entity ID for a provider: its metadata URL on `baseURL`, the same on every origin. */
 const samlEntityId = (baseURL, id) => `${baseURL.replace(/\/$/, "")}${authBasePath}/sso/saml2/sp/metadata?providerId=${encodeURIComponent(id)}`;
-/** The provider as one of the SSO plugin's configured providers (`defaultSSO`). */
-const defaultSsoEntry = (provider, baseURL) => {
-	const { idp, attributes = {} } = provider;
-	const mapping = Object.fromEntries(Object.entries(attributes).filter(([, name]) => name !== void 0));
-	return {
-		providerId: provider.id,
-		domain: provider.domains.join(","),
-		samlConfig: {
-			issuer: samlEntityId(baseURL, provider.id),
-			entryPoint: "ssoUrl" in idp ? idp.ssoUrl : "",
-			idpMetadata: "metadata" in idp ? { metadata: idp.metadata } : {
-				entityID: idp.entityId,
-				cert: idp.certificate
-			},
-			...Object.keys(mapping).length > 0 && { mapping }
-		}
-	};
-};
-/**
-* Better Auth's SSO plugin with the configured providers. Their domains are trusted, so an address there links to the
-* account that has it; organizations are not assigned by provider, and nobody registers providers.
-*/
-const samlPlugin = (providers, baseURL) => {
-	const { schema: _schema, ...plugin } = sso({
-		defaultSSO: providers.map((provider) => defaultSsoEntry(provider, baseURL)),
-		domainVerification: { enabled: true },
-		organizationProvisioning: { disabled: true },
-		providersLimit: 0
-	});
-	return plugin;
-};
 /** The SSO plugin's endpoints for providers kept in its table, and its OIDC callback, which Protobase does not serve. */
 const samlDisabledPaths = [
 	"/sso/register",
@@ -130,4 +98,4 @@ const emailInDomains = (email, domains) => {
 	return domains.some((allowed) => domain === allowed || domain.endsWith(`.${allowed}`));
 };
 //#endregion
-export { defaultSsoEntry, emailInDomains, isSamlPath, resolveSamlProviders, samlDisabledPaths, samlEntityId, samlGuardPlugin, samlPlugin, samlRefusal };
+export { emailInDomains, isSamlPath, resolveSamlProviders, samlDisabledPaths, samlEntityId, samlGuardPlugin, samlRefusal };

package/dist/better-auth/secret-versions.d.ts

@@ -0,0 +1,7 @@
+//#region src/better-auth/secret-versions.d.ts
+/** Better Auth's versioned secrets: the current one first, each with the version its ciphertexts name. */
+export type VersionedSecret = {
+  version: number;
+  value: string;
+};
+//#endregion

package/dist/better-auth/secret-versions.js

@@ -0,0 +1,21 @@
+import { createHash } from "node:crypto";
+//#region src/better-auth/secret-versions.ts
+const versionOf = (secret) => Number.parseInt(createHash("sha256").update(`protobase-secret-version:${secret}`).digest("hex").slice(0, 7), 16);
+/**
+* Better Auth's options for the app's `secret` and its `previousSecrets`: `secrets`, which encrypt with the current
+* one and decrypt with any of them, and `secret`, which Better Auth keeps for what was encrypted before secrets had
+* versions. That is the oldest secret listed: the one in use when the app last ran without versions, unless it was
+* changed since without being listed.
+*/
+const versionedSecrets = (secret, previousSecrets = []) => {
+	const all = [.../* @__PURE__ */ new Set([secret, ...previousSecrets])];
+	return {
+		secrets: all.map((value) => ({
+			version: versionOf(value),
+			value
+		})),
+		legacySecret: all.at(-1)
+	};
+};
+//#endregion
+export { versionedSecrets };

package/dist/better-auth/signing-keys.js

@@ -0,0 +1,86 @@
+import { createAuthEndpoint, createAuthMiddleware } from "better-auth/api";
+import { createJwk } from "better-auth/plugins";
+const daySeconds = 86400;
+/** The JWT plugin's rotation for `options`: `rotationInterval` and `gracePeriod`, in seconds. */
+const signingKeyRotation = ({ signingKeyDays = 30, signingKeyGraceDays = 7 } = {}) => {
+	if (!(signingKeyDays > 0)) throw new Error("signingKeyDays must be more than 0");
+	if (!(signingKeyGraceDays >= 1)) throw new Error("signingKeyGraceDays must be at least 1: tokens of `protobase token` last up to a day");
+	return {
+		rotationInterval: Math.round(signingKeyDays * daySeconds),
+		gracePeriod: Math.round(signingKeyGraceDays * daySeconds)
+	};
+};
+const isPrimary = (key) => key.alg === null || key.alg === void 0 || key.alg === "EdDSA";
+const marginMs = 6e4;
+const signingPaths = /* @__PURE__ */ new Set(["/token", "/oauth2/token"]);
+/**
+* Keeps a live EdDSA key for the app's tokens. The JWT plugin signs with the newest live key of the primary algorithm,
+* else with the newest live key of any: once the EdDSA key expired while the ES256 one of the GoTrue-compatible
+* tokens still lived, it would sign the app's tokens ES256 until that one expired too. So before every signing, a new
+* EdDSA key is made when none lives; a key made before rotation was on (without an expiry) gets the one it would have
+* had, its creation plus the rotation interval, so it rotates too. A key past its grace period, which no longer
+* verifies, is deleted, so the store keeps a few keys (Better Auth reads at most 100). The key set is read once per
+* key's lifetime: until the newest EdDSA key expires, signing reads nothing more.
+*/
+const signingKeys = (jwt) => {
+	const intervalMs = jwt.jwks.rotationInterval * 1e3;
+	const graceMs = jwt.jwks.gracePeriod * 1e3;
+	let liveUntil = 0;
+	let pending;
+	const check = async (ctx) => {
+		const now = Date.now();
+		const { adapter } = ctx.context;
+		const dated = (await adapter.findMany({ model: "jwks" })).map((key) => ({
+			...key,
+			undated: !key.expiresAt,
+			expiresAt: key.expiresAt ?? new Date(key.createdAt.getTime() + intervalMs)
+		}));
+		const retired = dated.filter((key) => key.expiresAt.getTime() + graceMs <= now);
+		if (retired.length > 0) await adapter.deleteMany({
+			model: "jwks",
+			where: [{
+				field: "id",
+				operator: "in",
+				value: retired.map((key) => key.id)
+			}]
+		});
+		const keys = dated.filter((key) => !retired.includes(key));
+		await Promise.all(keys.filter((key) => key.undated).map((key) => adapter.update({
+			model: "jwks",
+			where: [{
+				field: "id",
+				value: key.id
+			}],
+			update: { expiresAt: key.expiresAt }
+		})));
+		liveUntil = (keys.filter((key) => isPrimary(key) && key.expiresAt.getTime() - marginMs > now).sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime())[0] ?? await createJwk(ctx, jwt)).expiresAt.getTime() - marginMs;
+	};
+	/** Makes sure a live EdDSA key signs the next token; concurrent callers share one check. */
+	const ensure = async (ctx) => {
+		if (Date.now() < liveUntil) return;
+		pending ??= check(ctx).finally(() => {
+			pending = void 0;
+		});
+		await pending;
+	};
+	return {
+		plugin: {
+			id: "protobase-signing-keys",
+			endpoints: { 
+			/** Makes sure a live EdDSA key signs the next token, for signing outside the plugin's paths (`issueToken`). */
+ensureSigningKey: createAuthEndpoint.serverOnly({ method: "POST" }, async (ctx) => {
+				await ensure(ctx);
+				return ctx.json({ ok: true });
+			}) },
+			hooks: { before: [{
+				matcher: (ctx) => signingPaths.has(ctx.path ?? ""),
+				handler: createAuthMiddleware(async (ctx) => {
+					await ensure(ctx);
+				})
+			}] }
+		},
+		ensure
+	};
+};
+//#endregion
+export { signingKeyRotation, signingKeys };

package/dist/better-auth/tokens.js

@@ -24,6 +24,7 @@ const issueToken = async (auth, options) => {
 	if (user.banned) throw new Error(`${options.email} is banned`);
 	const issuedAt = Math.floor(Date.now() / 1e3);
 	const { role } = narrowClaims({ role: parseRoles(user.role).join(",") }, [user.lastRole], Boolean(auth.organizations));
+	await auth.api.ensureSigningKey();
 	const { token } = await auth.api.signJWT({ body: { payload: {
 		iat: issuedAt,
 		exp: issuedAt + ttl,

package/dist/better-auth/user-table.js

@@ -16,7 +16,7 @@ const userFields = {
 	last_role: "lastRole",
 	last_organization_id: "lastOrganizationId"
 };
-/** The user table's names, from `createAuth`'s `users` option; unknown columns are an error. */
+/** The user table's names, from `auth.users` option; unknown columns are an error. */
 const userTable = ({ table = "user", columns = {}, metadata } = {}) => {
 	const unknown = Object.keys(columns).find((name) => !(name in userFields));
 	if (unknown !== void 0) throw new Error(`users.columns names "${unknown}", which is not a column of the user table: ${Object.keys(userFields).join(", ")}`);

package/dist/better-auth/users.d.ts

@@ -10,7 +10,7 @@ export type LinkedAccount = {
 };
 /**
  * Without `password` the user signs in by emailed code, passkey or a sign-in provider only. `metadata` lands in the
- * user metadata column, which `createAuth`'s `users.metadata` names; it needs one.
+ * user metadata column, which `auth.users.metadata` names; it needs one.
  */
 export type NewUser = {
   email: string;

package/dist/create-admin.d.ts

@@ -35,6 +35,8 @@ export type CreateAdminInput = {
   auth?: AdminAuth;
   /** API functions of the app's own, each served at `<systemPath>/functions/<name>` (see `defineFunction`). */
   functions?: Record<string, FunctionSource>;
+  /** The app's secret (`secret`): it signs public forms' bot checks, and upload tickets unless `files.secret` names another. */
+  secret?: string;
   /** Where file fields keep their bytes (see `FilesOptions`). */
   files?: FilesOptions;
   /** Where the changes that resources' events are raised from are captured (see `EventsOptions`). */
@@ -45,9 +47,9 @@ export type CreateAdminInput = {
   jobs?: JobDefinition[];
   /** Where the resources' events are delivered (`subscription(...)` exports of the config module). */
   subscriptions?: SubscriptionDefinition[];
-  /** Webhook subscriptions made in the admin app, from `extends: [webhooks()]` (see `WebhooksOptions`). */
+  /** Webhook subscriptions made in the admin app, from `webhooks: {}` (see `WebhooksOptions`). */
   webhooks?: WebhooksOptions;
-  /** Each user's devices and the endpoints that register them, from `extends: [notifications()]` (see `NotificationsOptions`). */
+  /** Each user's devices and the endpoints that register them, from `notifications: {}` (see `NotificationsOptions`). */
   notifications?: NotificationsOptions;
   /**
    * The app's iOS and Android build (see `MobileConfig`): the API answers its Capacitor origins through CORS, and sign-in
@@ -88,5 +90,5 @@ export type CreateAdminInput = {
   upgradeWebSocket?: UpgradeWebSocket;
 };
 /** The admin REST API as a Hono app. It uses only Web APIs, so it runs on Node, Workers and anywhere else Hono does. */
-export declare const createAdmin: ({ resources: appResources, views: appViews, pages, userMenu, bottomBars, db, authenticate, auth, functions, files: filesOptions, events, history: historyOptions, jobs, subscriptions, webhooks: webhooksOptions, notifications, mobile, app: identity, icons, bundlePlugins, fieldTypes, options, formsDifficulty, commentUsers: givenCommentUsers, verifyToken, upgradeWebSocket }: CreateAdminInput) => Admin;
+export declare const createAdmin: ({ resources: appResources, views: appViews, pages, userMenu, bottomBars, db, authenticate, auth, functions, secret, files: filesOptions, events, history: historyOptions, jobs, subscriptions, webhooks: webhooksOptions, notifications, mobile, app: identity, icons, bundlePlugins, fieldTypes, options, formsDifficulty, commentUsers: givenCommentUsers, verifyToken, upgradeWebSocket }: CreateAdminInput) => Admin;
 //#endregion

package/dist/create-admin.js

@@ -103,7 +103,7 @@ const declaredRoles = (auth, roles) => {
 	return names.length > 0 ? [...new Set(names)] : void 0;
 };
 /** The admin REST API as a Hono app. It uses only Web APIs, so it runs on Node, Workers and anywhere else Hono does. */
-const createAdmin = ({ resources: appResources, views: appViews = [], pages = [], userMenu, bottomBars = [], db, authenticate, auth, functions = {}, files: filesOptions, events, history: historyOptions, jobs = [], subscriptions = [], webhooks: webhooksOptions, notifications, mobile, app: identity, icons, bundlePlugins = [], fieldTypes = {}, options = {}, formsDifficulty, commentUsers: givenCommentUsers, verifyToken, upgradeWebSocket }) => {
+const createAdmin = ({ resources: appResources, views: appViews = [], pages = [], userMenu, bottomBars = [], db, authenticate, auth, functions = {}, secret, files: filesOptions, events, history: historyOptions, jobs = [], subscriptions = [], webhooks: webhooksOptions, notifications, mobile, app: identity, icons, bundlePlugins = [], fieldTypes = {}, options = {}, formsDifficulty, commentUsers: givenCommentUsers, verifyToken, upgradeWebSocket }) => {
 	const basePath = options.basePath ?? "/api/v1";
 	const appModels = appResources.map((resource) => resource.toModel());
 	const withComments = appModels.some((model) => model.comments);
@@ -154,6 +154,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 		views: viewModels,
 		limits: options.roles?.limits ?? [],
 		env: globalThis.process?.env ?? {},
+		...secret && { secret },
 		...formsDifficulty && { difficulty: formsDifficulty }
 	});
 	const systemPath = basePath.slice(0, basePath.lastIndexOf("/"));
@@ -178,6 +179,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	});
 	const files = createFilesRuntime({
 		...filesOptions && { options: filesOptions },
+		...secret && { secret },
 		env: globalThis.process?.env ?? {},
 		models: registry.entries.map((entry) => entry.model),
 		systemPath,

package/dist/encryption/keyring.js

@@ -27,7 +27,7 @@ const entriesOf = (env) => {
 	}))];
 };
 const checkApart = (entries, env) => {
-	for (const name of ["BETTER_AUTH_SECRET", "PROTOBASE_SECRET_KEY"]) {
+	for (const name of ["PROTOBASE_SECRET", "PROTOBASE_SECRET_KEY"]) {
 		const secret = env[name]?.trim();
 		const same = secret && entries.find((entry) => entry.text === secret);
 		if (same) throw new Error(`${same.where} is the same as ${name}: give encryption a key of its own`);

package/dist/files/options.d.ts

@@ -1,21 +1,18 @@
 import { Sharp } from "./images.js";
 import { FileProvider } from "./store.js";
 //#region src/files/options.d.ts
-/** `files` in `protobase.config.ts`. Environment variables override it (see `resolveProviders`). */
+/** Where file fields keep their bytes, as the API runs with them: `files` of `protobase.config.ts` with its providers made. Environment variables override it (see `resolveProviders`). */
 export type FilesOptions = {
   /**
-   * Providers by name, such as `private: localFiles({ dir: './data/files' })`. A name is part of every stored value, so
-   * name the role (`archive`), not the vendor. Without config, `private` and `public` are folders under `data/files`.
+   * Providers by name. A name is part of every stored value, so name the role (`archive`), not the vendor. Without
+   * config, `private` and `public` are folders under `data/files`.
    */
   providers?: Record<string, FileProvider>;
   /** How long bytes outlive their last reference, for restores; default `1 day`. Public providers default to 0. */
   retention?: number | string;
-  /** Signs upload tickets and download URLs; default `PROTOBASE_FILES_SECRET`, then `BETTER_AUTH_SECRET`. */
+  /** Signs upload tickets and download URLs; default `PROTOBASE_FILES_SECRET`, then the app's `secret` (`PROTOBASE_SECRET`). */
   secret?: string;
-  /**
-   * The image library that makes the variants and placeholders of image fields: `import sharp from 'sharp'` in the
-   * config, so a built bundle carries it with its native add-on.
-   */
+  /** The image library that makes the variants and placeholders of image fields: sharp's default export. */
   sharp?: Sharp;
   /**
    * Hosts whose images the admin app draws with the page's referrer, besides the app's own and those its providers link

package/dist/files/provider-settings.d.ts

@@ -0,0 +1,16 @@
+import { FileProvider } from "./store.js";
+import { LocalFilesOptions } from "./local-files.js";
+import { S3FilesOptions } from "./s3-files.js";
+//#region src/files/provider-settings.d.ts
+/**
+ * A built-in file provider in `files.providers`, as data: `{ kind: 'local', dir }`, a folder on local disk, or
+ * `{ kind: 's3', bucket }`, an S3-compatible bucket. The provider is made when the app serves.
+ */
+export type FileProviderSettings = ({
+  kind: 'local';
+} & LocalFilesOptions) | ({
+  kind: 's3';
+} & S3FilesOptions);
+/** The provider the settings describe. */
+export declare const fileProviderOf: (name: string, settings: FileProviderSettings) => FileProvider;
+//#endregion

package/dist/files/provider-settings.js

@@ -0,0 +1,17 @@
+import { localFiles } from "./local-files.js";
+import { s3Files } from "./s3-files.js";
+//#region src/files/provider-settings.ts
+/** The provider the settings describe. */
+const fileProviderOf = (name, settings) => {
+	if (settings.kind === "local") {
+		const { kind: _, ...options } = settings;
+		return localFiles(options);
+	}
+	if (settings.kind === "s3") {
+		const { kind: _, ...options } = settings;
+		return s3Files(options);
+	}
+	throw new Error(`files.providers.${name}: kind is "local", "s3" or "custom", whose provider is the default export of files/${name}.ts`);
+};
+//#endregion
+export { fileProviderOf };

package/dist/files/runtime.js

@@ -13,7 +13,7 @@ const imageFields = (models) => models.flatMap((model) => Object.values(model.fi
 * The runtime, when a resource has a file field, the config names providers or the app serves `/api/sb/storage/v1`. It fails at startup when a field's
 * provider is not configured, nothing signs uploads, or a field makes image variants or placeholders without sharp.
 */
-const createFilesRuntime = ({ options = {}, env, models, systemPath, storage: servesStorage = false }) => {
+const createFilesRuntime = ({ options = {}, env, secret: appSecret, models, systemPath, storage: servesStorage = false }) => {
 	const storageName = servesStorage ? storageProviderName(options) : void 0;
 	const storage = storageName && options.storage !== false ? {
 		provider: storageName,
@@ -22,10 +22,10 @@ const createFilesRuntime = ({ options = {}, env, models, systemPath, storage: se
 	const fieldProviders = models.flatMap((model) => Object.values(model.fields).flatMap((field) => field.file ? [field.file.provider] : []));
 	const used = [.../* @__PURE__ */ new Set([...fieldProviders, ...storage ? [storage.provider] : []])];
 	if (used.length === 0 && !options.providers) return void 0;
-	const secret = options.secret ?? env.PROTOBASE_FILES_SECRET ?? env.BETTER_AUTH_SECRET;
-	if (!secret) throw new Error("File fields and /api/sb/storage/v1 need a secret to sign uploads: set BETTER_AUTH_SECRET, PROTOBASE_FILES_SECRET or files.secret");
+	const secret = options.secret ?? env.PROTOBASE_FILES_SECRET ?? appSecret ?? env.PROTOBASE_SECRET;
+	if (!secret) throw new Error("File fields and /api/sb/storage/v1 need a secret to sign uploads: set secret in protobase.config.ts, files.secret or PROTOBASE_FILES_SECRET");
 	const images = imageFields(models);
-	if (images.length > 0 && !options.sharp) throw new Error(`${images.join(", ")} make image variants or placeholders, which need sharp: add it to the project (bun add sharp), then import sharp from 'sharp' in the config and pass files: { sharp }`);
+	if (images.length > 0 && !options.sharp) throw new Error(`${images.join(", ")} make image variants or placeholders, which need sharp: add it to the project (bun add sharp), then give the config files: { sharp: () => import('sharp') }`);
 	const providers = resolveProviders(options, env, used);
 	const retention = retentionOf(options, env);
 	return {

package/dist/forms/runtime.js

@@ -12,15 +12,15 @@ const anonymousCreates = (limits) => (resource) => {
 * The public forms of the views, checked, with the challenges that guard them and their rate limit; `undefined` without
 * any. Fails at startup on a form that cannot be served and when nothing signs the challenges.
 */
-const createFormsRuntime = ({ registry, views, limits, env, difficulty }) => {
+const createFormsRuntime = ({ registry, views, limits, env, secret: appSecret, difficulty }) => {
 	const declared = [...views].sort((a, b) => Number(a.roles !== void 0) - Number(b.roles !== void 0)).flatMap((view) => (view.forms ?? []).map((form) => ({
 		form,
 		view
 	})));
 	if (declared.length === 0) return void 0;
 	const forms = checkForms(registry, declared, anonymousCreates(limits));
-	const secret = env.PROTOBASE_FORMS_SECRET ?? env.BETTER_AUTH_SECRET;
-	if (!secret) throw new Error("Public forms need a secret to sign their bot checks: set PROTOBASE_FORMS_SECRET or BETTER_AUTH_SECRET");
+	const secret = env.PROTOBASE_FORMS_SECRET ?? appSecret ?? env.PROTOBASE_SECRET;
+	if (!secret) throw new Error("Public forms need a secret to sign their bot checks: set secret in protobase.config.ts, or PROTOBASE_FORMS_SECRET");
 	return {
 		forms,
 		challenges: createFormChallenges(secret, { ...difficulty && { difficulty } }),

package/dist/gotrue/sessions-plugin.js

@@ -4,7 +4,7 @@ import { goTrueUser } from "./user-json.js";
 import { accessClaims, goTrueSession } from "./session-json.js";
 import * as z$1 from "zod";
 import { APIError, createAuthEndpoint } from "better-auth/api";
-import { createJwk, signJWT } from "better-auth/plugins";
+import { signJWT } from "better-auth/plugins";
 import { generateRandomString } from "better-auth/crypto";
 //#region src/gotrue/sessions-plugin.ts
 const refreshTokenNotFound = () => new APIError("BAD_REQUEST", {
@@ -16,13 +16,7 @@ const refreshTokenNotFound = () => new APIError("BAD_REQUEST", {
 * so signing out anywhere, a ban or a revoked session ends it, and refreshing gives the session a new token, so each
 * refresh token works once. Server-side endpoints only, for `goTrueRoutes`.
 */
-const goTrueSessionsPlugin = ({ issuer, jwt, policy }) => {
-	let primaryKeyMade = false;
-	const makePrimaryKey = async (ctx) => {
-		if (primaryKeyMade) return;
-		if (!(await ctx.context.adapter.findMany({ model: "jwks" })).some((key) => key.alg === null || key.alg === void 0 || key.alg === "EdDSA")) await createJwk(ctx, jwt);
-		primaryKeyMade = true;
-	};
+const goTrueSessionsPlugin = ({ issuer, jwt, signingKey, policy }) => {
 	const sessionOf = async (ctx, sessionToken) => {
 		const found = await ctx.context.internalAdapter.findSession(sessionToken);
 		if (!found) throw refreshTokenNotFound();
@@ -31,7 +25,7 @@ const goTrueSessionsPlugin = ({ issuer, jwt, policy }) => {
 		if (refusal) throw new APIError("FORBIDDEN", refusal);
 		const accounts = await ctx.context.internalAdapter.findAccounts(user.id);
 		const now = Math.floor(Date.now() / 1e3);
-		await makePrimaryKey(ctx);
+		await signingKey(ctx);
 		const accessToken = await signJWT(ctx, {
 			options: jwt,
 			payload: accessClaims({

package/dist/index.d.ts

@@ -51,20 +51,25 @@ import { RuntimeOptions, runtimeUrl, runtimeVariable, seesRuntime } from "./runt
 import { AdminOptions } from "./admin-options.js";
 import { CreateAdminInput, createAdmin } from "./create-admin.js";
 import { handleDroppedConnections } from "./dropped-connections.js";
-import { AppPoolConfig, PgModule, appPool, longQueryPool, poolWaitMs, readDbConnections } from "./app-pool.js";
+import { AppPoolConfig, PgModule, poolWaitMs, readDbConnections } from "./app-pool.js";
 import { ConnectionsBusy } from "./connections-busy.js";
 import { isBackgroundWork, runInBackground, wantsLongQueries } from "./background-work.js";
 import { longQueryTimeoutMs } from "./statement-timeout.js";
 import { checkViewQueries } from "./check-view-queries.js";
-import { ProjectConfig, defineConfig, mergeConfig } from "./project-config.js";
 import { consoleAuditQueue } from "./audit/console-queue.js";
 import { JwtOptions, JwtVerifyOptions, jwtAuthenticator, jwtVerifier } from "./auth/jwt.js";
+import { SignInPolicy, SignInRule, StaffAccessRule, defaultSignInPolicy, signInPolicyMethods } from "./better-auth/sign-in-policy.js";
+import { StaffSignIn } from "./better-auth/staff-log.js";
+import { RoleDefinition, RolesInput } from "./better-auth/organizations/role-definitions.js";
+import { OrganizationRole, StoredMember, StoredOrganization } from "./better-auth/organizations/store.js";
+import { OrganizationsOptions } from "./better-auth/organizations/options.js";
+import { AuthHooks, AuthSettings, HookContext } from "./better-auth/auth-settings.js";
 import { TrustedApp, withTrustedApps } from "./better-auth/app-tokens.js";
-import { BetterAuthAuthenticator, BetterAuthAuthenticatorOptions, betterAuthAuthenticator, betterAuthTokens } from "./better-auth/authenticator.js";
+import { BetterAuthAuthenticator, BetterAuthAuthenticatorOptions, betterAuthTokens } from "./better-auth/authenticator.js";
+import { AuthenticateSettings } from "./better-auth/authenticate-settings.js";
 import { parseRoles } from "./better-auth/parse-roles.js";
 import { LinkedAccount, NewUser, StoredUser, createUser, deleteUser, hasUsers, listUsers, roleChoices, setUserBanned, setUserRole } from "./better-auth/users.js";
 import { IssueTokenOptions, issueToken, maxTokenTtlSeconds } from "./better-auth/tokens.js";
-import { SignInPolicy, SignInRule, StaffAccessRule, defaultSignInPolicy, signInPolicyMethods } from "./better-auth/sign-in-policy.js";
 import { passwordLength } from "./better-auth/new-account-password.js";
 import { OperatorProvider, readOperatorSettings } from "./better-auth/operator-provider.js";
 import { isOAuthWellKnownPath, oauthWellKnownPaths, webauthnPath } from "./better-auth/origins.js";
@@ -72,7 +77,7 @@ import { goTruePath } from "./gotrue/keys.js";
 import { supabasePath } from "./supabase-paths.js";
 import { realtimeLimits } from "./realtime/realtime-limits.js";
 import { capSocketMessages, honorSocketMessageCaps, socketMessageCapOf } from "./functions/socket-message-cap.js";
-import { defaultAppName, shownAppName } from "./app-name.js";
+import { appNameOver, defaultAppName, shownAppName } from "./app-name.js";
 import { webManifestPath } from "./web-app/web-manifest-route.js";
 import { PlatformSignIn, readPlatformSignIn } from "./better-auth/platform-sign-in.js";
 import { authSchemaMigration, checkAuthSchema } from "./better-auth/auth-schema.js";
@@ -86,12 +91,10 @@ import { ResourceChange, recordOf, resourceChange } from "./changes/resource-cha
 import { eventMatcher } from "./changes/match-events.js";
 import { parseColumns, readOutbox } from "./changes/outbox.js";
 import { newWebhookSecret } from "./webhooks/standard-webhooks.js";
-import { webhooks } from "./webhooks/table/plugin.js";
 import { checkWebhooksSchema, webhooksMigration } from "./webhooks/table/schema.js";
 import { checkComments, commentsMigration } from "./comments/comments-sql.js";
 import { CheckAiInput, checkAi } from "./ai/check-ai.js";
 import { CommentItem } from "./comments/comment-item.js";
-import { notifications } from "./notifications/plugin.js";
 import { checkNotificationsSchema, notificationsMigration } from "./notifications/schema.js";
 import { deviceStore, removeDevicesWithUsers } from "./notifications/device-store-of.js";
 import { DeviceStoreError, postgresDeviceStore } from "./notifications/postgres-store.js";
@@ -105,11 +108,7 @@ import { sendNotification } from "./notifications/send-notification.js";
 import { VapidSettings, readVapidSettings, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable } from "./notifications/web-push/vapid-settings.js";
 import { WebPushOptions, webPushSender } from "./notifications/web-push/web-push-sender.js";
 import { generateVapidKeys } from "./notifications/web-push/keys.js";
-import { RoleDefinition, RolesInput } from "./better-auth/organizations/role-definitions.js";
-import { OrganizationRole, StoredMember, StoredOrganization } from "./better-auth/organizations/store.js";
-import { OrganizationsOptions } from "./better-auth/organizations/options.js";
 import { MemberInput, NewOrganization, addAppRoleToOwners, addMember, createOrganization, listOrganizations, removeMember, setMemberRoles } from "./better-auth/organizations/host.js";
-import { StaffSignIn } from "./better-auth/staff-log.js";
 import { AssistantBackend, assistantProtocolRoutes } from "./assistant/protocol-routes.js";
 import { fileConversationStore } from "./assistant/file-conversation-store.js";
 import { withCacheBreakpoints } from "./assistant/cache-breakpoints.js";
@@ -139,9 +138,10 @@ import { SignatureOptions, StandardWebhookOptions, verifySignature, verifyStanda
 import { requireEnv } from "./functions/require-env.js";
 import { backgroundSettled, waitUntil } from "./functions/wait-until.js";
 import { FileLimits, limitedFileStore, storeUsage } from "./files/limits.js";
-import { LocalFilesOptions, localFileStore, localFiles } from "./files/local-files.js";
+import { LocalFilesOptions, localFileStore } from "./files/local-files.js";
+import { S3Bucket, S3FilesOptions, S3ListPage, S3Object, s3FileStore } from "./files/s3-files.js";
+import { FileProviderSettings } from "./files/provider-settings.js";
 import { StoreFileInput, storeFile } from "./files/store-file.js";
-import { S3Bucket, S3FilesOptions, S3ListPage, S3Object, s3FileStore, s3Files } from "./files/s3-files.js";
 import { storageProvider } from "./files/storage-provider.js";
 import { objectKey } from "./storage/object-key.js";
 import { FileCleanupInput, createFileCleanup } from "./files/file-cleanup.js";
@@ -154,6 +154,7 @@ import { FileRef, formatUri, variantPath } from "./files/uri.js";
 import { aspectRatio, fileSize, fileType, imageSize, processor } from "./files/processors.js";
 import { defineJob, isJobDefinition, jobDefinitions } from "./jobs/define-job.js";
 import { FatalJobError } from "./jobs/run-job.js";
+import { JobDeclaration, JobRun, enqueueJob } from "./jobs/declared-job.js";
 import { isSchedule } from "./jobs/schedule.js";
 import { EmailComponent, EmailOptions, EmailTemplate, RenderedEmail, defineEmail } from "./mail/define-email.js";
 import { DrainResult, JobsRuntime, StartJobsOptions, startJobs } from "./jobs/runtime.js";
@@ -162,5 +163,5 @@ import { checkJobsSchema, jobsSchema, jobsSchemaMigration } from "./jobs/schema.
 import { MobileRelease, ReleaseFile, ServedReleaseFile, composeRelease, releaseManifest } from "./mobile-release/release.js";
 import { MobileReleaseAppInput, OfferedRelease, mobileReleaseApp } from "./mobile-release/release-app.js";
 import { mobileSigningKeyVariable, readSigningKey } from "./mobile-release/signing-key.js";
-import { AdminAuth, CreateAuthOptions, UserCreatedHook, createAuth, normalizeRoles } from "./better-auth/create-auth.js";
-export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApiKeys, type ApiKeysOptions, type ApnsEnvironment, type AppIcons, type AppIdentity, type AppPoolConfig, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BatchOperation, type BatchResult, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type Caller, type CallerOptions, type CapturedRow, type CascadingKey, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, ConnectionsBusy, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type Device, type DeviceColumn, type DeviceKind, type DeviceStore, DeviceStoreError, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryColumn, type HistoryOptions, type HistoryPosition, type HistoryStore, HistoryStoreError, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JsonObject, type JsonValue, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type McpApprovals, type McpGateInput, type McpHandlerInput, type McpRoutesInput, type McpServerInput, type McpToolsInput, type McpWrites, type MemberInput, type Membership, MissingCredentials, type MobileConfig, type MobileRelease, type MobileReleaseAppInput, ModelError, type ModelSettings, type NewDevice, type NewNotification, type NewOrganization, type NewUser, type NotificationRecipients, NotificationSendError, type NotificationsOptions, type OfferedRelease, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PgModule, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type PushAnswer, type PushMessage, PushMessageError, type PushSender, type QueryOptions, type QueryResult, type ReadableResources, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordKeyInput, type RecordPage, type ReleaseFile, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type SendNotification, type ServedReleaseFile, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredNotification, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolAnnotations, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type Urgency, type User, type UserCreatedHook, type VapidSettings, type ViewSource, type WebPushFields, type WebPushOptions, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, type WriteRecordToolsInput, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appPool, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkResourcesOutsideAuthStore, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, composeRelease, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, deviceIdParam, deviceStore, devicesPath, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, localFiles, longQueryPool, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, mergeConfig, migrationCommand, mobileReleaseApp, mobileSigningKeyVariable, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notifications, notificationsMigration, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readSigningKey, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, recordOf, releaseManifest, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };
+import { AdminAuth, CreateAuthOptions, UserCreatedHook, normalizeRoles } from "./better-auth/create-auth.js";
+export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApiKeys, type ApiKeysOptions, type ApnsEnvironment, type AppIcons, type AppIdentity, type AppPoolConfig, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type AuthHooks, type AuthSettings, type AuthenticateSettings, type Authenticator, type BatchOperation, type BatchResult, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type Caller, type CallerOptions, type CapturedRow, type CascadingKey, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, ConnectionsBusy, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type Device, type DeviceColumn, type DeviceKind, type DeviceStore, DeviceStoreError, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileProviderSettings, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryColumn, type HistoryOptions, type HistoryPosition, type HistoryStore, HistoryStoreError, type HookContext, HttpProblem, type IssueTokenOptions, type JobContext, type JobDeclaration, type JobDefinition, type JobOptions, type JobRun, type JobsRuntime, type JsonObject, type JsonValue, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type McpApprovals, type McpGateInput, type McpHandlerInput, type McpRoutesInput, type McpServerInput, type McpToolsInput, type McpWrites, type MemberInput, type Membership, MissingCredentials, type MobileConfig, type MobileRelease, type MobileReleaseAppInput, ModelError, type ModelSettings, type NewDevice, type NewNotification, type NewOrganization, type NewUser, type NotificationRecipients, NotificationSendError, type NotificationsOptions, type OfferedRelease, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PgModule, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type PushAnswer, type PushMessage, PushMessageError, type PushSender, type QueryOptions, type QueryResult, type ReadableResources, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordKeyInput, type RecordPage, type ReleaseFile, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type SendNotification, type ServedReleaseFile, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredNotification, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolAnnotations, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type Urgency, type User, type UserCreatedHook, type VapidSettings, type ViewSource, type WebPushFields, type WebPushOptions, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, type WriteRecordToolsInput, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appNameOver, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkResourcesOutsideAuthStore, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, composeRelease, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, deviceIdParam, deviceStore, devicesPath, enqueueJob, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, migrationCommand, mobileReleaseApp, mobileSigningKeyVariable, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notificationsMigration, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readSigningKey, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, recordOf, releaseManifest, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };