@protobase/server 0.62.4 → 0.62.5

package/dist/better-auth/auth-settings.d.ts

@@ -1,5 +1,5 @@
 import { UserColumn } from "./user-table.js";
-import { Mailer } from "../mail/smtp-mailer.js";
+import { Mailer } from "../mail/mail-message.js";
 import { SignInPolicy } from "./sign-in-policy.js";
 import { StaffSignIn } from "./staff-log.js";
 import { Person } from "./organizations/people-endpoint.js";
@@ -10,6 +10,7 @@ import { VersionedSecret } from "./secret-versions.js";
 import { UserDeletionListener } from "./user-deletion.js";
 import { OrganizationRole, StoredMember, StoredOrganization } from "./organizations/store.js";
 import { OrganizationsOptions, ResolvedOrganizations } from "./organizations/options.js";
+import { PersonalMailProvider } from "../personal-mail/personal-mail-provider.js";
 import { McpAuthOptions } from "./mcp/mcp-plugins.js";
 import "../index.js";
 import { CreateAuthOptions, UserCreatedHook } from "./create-auth.js";
@@ -8836,6 +8837,8 @@ export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput)
     id: string;
     name: string;
   }[];
+  personalMail: PersonalMailProvider[];
+  personalMailer: (userId: string) => Mailer;
   mcp: {
     resource: string;
     path: string;

package/dist/better-auth/create-auth.d.ts

@@ -1,5 +1,5 @@
 import { UserColumn, UserTableOptions } from "./user-table.js";
-import { Mailer } from "../mail/smtp-mailer.js";
+import { Mailer } from "../mail/mail-message.js";
 import { SignInPolicy } from "./sign-in-policy.js";
 import { StaffSignIn } from "./staff-log.js";
 import { Person } from "./organizations/people-endpoint.js";
@@ -10,9 +10,11 @@ import { VersionedSecret } from "./secret-versions.js";
 import { UserDeletionListener } from "./user-deletion.js";
 import { OrganizationRole } from "./organizations/store.js";
 import { OrganizationsOptions, ResolvedOrganizations } from "./organizations/options.js";
+import { PersonalMailProvider } from "../personal-mail/personal-mail-provider.js";
 import { McpAuthOptions } from "./mcp/mcp-plugins.js";
 import { OperatorProvider } from "./operator-provider.js";
 import { PlatformSignIn } from "./platform-sign-in.js";
+import { PersonalMailProviderId } from "../personal-mail/personal-mail-providers.js";
 import "../index.js";
 import "./auth-base-path.js";
 import { mcpAuthPlugins } from "./mcp/mcp-auth-plugins.js";
@@ -108,6 +110,12 @@ export type CreateAuthOptions = {
    * One with the id of `signInProvider` takes its place. Default none.
    */
   socialProviders?: BetterAuthOptions['socialProviders'];
+  /**
+   * The mail providers people may link their own mailbox with, from the account page, for the app's functions to send
+   * mail from it (`context.personalMail`), such as `['gmail']`. Each links through its sign-in provider, which
+   * `socialProviders` must have: Gmail through `google`. Default none.
+   */
+  personalMail?: PersonalMailProviderId[];
   /** Encrypt the OAuth access, refresh and ID tokens Better Auth stores for social sign-ins, with `secret`. Default off. */
   encryptOAuthTokens?: boolean;
   /** Runs after a user is created, by any route: `createUser`, an admin, or a social sign-up. Default none. */
@@ -1794,7 +1802,7 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
           email: string;
           emailVerified: boolean;
           name: string;
-          image? /** Runs after a user is created, by any route: `createUser`, an admin, or a social sign-up. Default none. */ : string | null | undefined;
+          image?: string | null | undefined;
         }) | import("better-auth/plugins").UserWithTwoFactor;
       }>;
       generateBackupCodes: import("better-call").StrictEndpoint<"/two-factor/generate-backup-codes", {
@@ -8977,6 +8985,10 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
     id: string;
     name: string;
   }[];
+  /** The mail providers people link their own mailbox with (`personalMail`). */
+  personalMail: PersonalMailProvider[];
+  /** Mail from `userId`'s own mailbox, through the mail provider they linked (see `personalMailer`). */
+  personalMailer: (userId: string) => Mailer;
   /** The OAuth provider for MCP clients, when on: the endpoint's resource (its URL) and path, and the scope its tokens carry. */
   mcp: {
     resource: string;

package/dist/better-auth/create-auth.js

@@ -5,6 +5,9 @@ import { defaultSignInPolicy } from "./sign-in-policy.js";
 import { roleDefinitions } from "./organizations/role-definitions.js";
 import { signInPolicyPlugin } from "./policy-plugin.js";
 import { goTrueSessionsPlugin } from "../gotrue/sessions-plugin.js";
+import { betterAuthLinkedAccounts } from "../personal-mail/linked-accounts.js";
+import { resolvePersonalMail } from "../personal-mail/personal-mail-providers.js";
+import { personalMailer } from "../personal-mail/personal-mailer.js";
 import { endReplacedSession } from "./end-replaced-session.js";
 import { authBasePath } from "./auth-base-path.js";
 import { authLogger } from "./auth-logger.js";
@@ -368,6 +371,7 @@ const createAuth = (options, plugins = {}) => {
 	const socialProviders = Object.keys(options.socialProviders ?? {});
 	const platformSignIn = platformSignInFor(signInSettings && resolvePlatformSignIn(signInSettings), socialProviders);
 	const saml = resolveSamlProviders(options.sso?.saml ?? [], [...socialProviders, ...platformSignIn ? [platformSignIn.provider] : []]);
+	const personalMail = resolvePersonalMail(options.personalMail ?? [], socialProviders);
 	const origins = resolveOrigins(options.baseURL, options.origins ?? platformOrigins());
 	const passkeyDomain = resolvePasskeyDomain(options.passkeyDomain ?? platformPasskeyDomain(), [options.baseURL, ...origins]);
 	const organizations = options.organizations && resolveOrganizations(options.organizations, definitions, options.baseURL);
@@ -458,6 +462,10 @@ const createAuth = (options, plugins = {}) => {
 			id,
 			name
 		})),
+		/** The mail providers people link their own mailbox with (`personalMail`). */
+		personalMail,
+		/** Mail from `userId`'s own mailbox, through the mail provider they linked (see `personalMailer`). */
+		personalMailer: (userId) => personalMailer(betterAuthLinkedAccounts(auth), personalMail, userId),
 		/** The OAuth provider for MCP clients, when on: the endpoint's resource (its URL) and path, and the scope its tokens carry. */
 		mcp: mcp && {
 			resource: mcp.resource,

package/dist/better-auth/status-route.js

@@ -14,7 +14,7 @@ import { Hono } from "hono";
 * operator provider's name, when staff can sign in as people; `passkeyDomains`, when people have passkeys for more than
 * one of the app's hosts, the RP IDs a passkey sign-in can ask for, the passkey domain first; with organizations, who may create them and the roles
 * with their labels, `membership` for those a member can hold, and the roles each one's holders may also give; and
-* `anonymous` when the project's anonymous role reads a resource, so the admin app opens for visitors before anyone signs in; `mcp` when MCP clients can connect, with the `url` of its endpoint, so the account page shows that address and lists the connected clients; and
+* `anonymous` when the project's anonymous role reads a resource, so the admin app opens for visitors before anyone signs in; `mcp` when MCP clients can connect, with the `url` of its endpoint, so the account page shows that address and lists the connected clients; `personalMail`, the mail providers people may link their mailbox with, each with the sign-in provider it links through, the scopes and the authorization parameters of the link, so the account page offers "Link Gmail"; and
 * `plugins`, those the app loads before sign-in (see `PluginOption`); and `locale`, the language `options.locale` puts
 * the screens in, so the sign-in screens and public forms, which come before `/meta`, are in it too.
 */
@@ -48,6 +48,13 @@ const statusRoute = (auth, { anonymous = false, plugins = [], locale } = {}) =>
 			...passkeyDomains.length > 1 && { passkeyDomains },
 			...anonymous && { anonymous },
 			...auth.mcp && { mcp: { url: auth.mcp.resource } },
+			...auth.personalMail.length > 0 && { personalMail: auth.personalMail.map(({ id, name, signInProvider, scopes, linkParams }) => ({
+				id,
+				name,
+				provider: signInProvider,
+				scopes,
+				params: linkParams
+			})) },
 			...plugins.length > 0 && { plugins },
 			...locale && { locale },
 			...auth.organizations && { organizations: {

package/dist/create-admin.js

@@ -414,6 +414,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 		records: (session) => callerRecords(deps, session),
 		channels,
 		decryptField,
+		...auth && auth.personalMail.length > 0 && { personalMailer: auth.personalMailer },
 		onError,
 		wake: () => wakeDispatch(deps),
 		upgradeWebSocket,

package/dist/functions/define-function.d.ts

@@ -1,4 +1,5 @@
 import { DecryptField } from "../encryption/decrypt-field-types.js";
+import { Mailer } from "../mail/mail-message.js";
 import { Session } from "../types.js";
 import { Caller } from "../api-keys/resolve-caller.js";
 import { SocketEvents } from "./function-socket.js";
@@ -43,6 +44,15 @@ export type FunctionContext = PublicFunctionContext & FunctionCaller & {
    * the audit does. Not on a public function's context: a public function that needs a value enqueues a job.
    */
   decryptField: DecryptField;
+  /**
+   * Mail from the caller's own mailbox, through the mail provider they linked (`auth.personalMail`), attachments and
+   * all: `personalMail.send({ to, subject, text, html, attachments })`, or an email template's `send(to, data,
+   * context.personalMail, { attachments })`. Rejects with a `PersonalMailError`, sending nothing, when they linked no
+   * mailbox (`not_linked`) or the link no longer works (`link_expired`); thrown on, it answers as a 409 problem with
+   * that `code`. Only someone signed in as themselves sends from their mailbox: staff signed in as them, or an outside
+   * app acting for them, is refused with a 403 problem. Not on a public function's context.
+   */
+  personalMail: Mailer;
 };
 /** What a function gets at `/api/sb/functions/v1/<name>`, where supabase-js calls it: the caller its keys and token make. */
 export type KeyFunctionContext = {

package/dist/functions/own-mailbox.js

@@ -0,0 +1,9 @@
+import { ownSignInUser } from "../notifications/caller.js";
+//#region src/functions/own-mailbox.ts
+/**
+* The caller's own mailbox: mail goes out from it only for someone signed in as themselves. Staff signed in as them,
+* an outside app acting for them and a visitor are refused with a 403 problem, sending nothing.
+*/
+const ownMailbox = (session, personalMailer) => ({ send: async (message) => personalMailer(ownSignInUser(session, "send mail from their own mailbox")).send(message) });
+//#endregion
+export { ownMailbox };

package/dist/functions/routes.js

@@ -5,6 +5,7 @@ import { invokeFunction } from "./define-function.js";
 import { runInBackground } from "../background-work.js";
 import { callsAccess } from "../calls/calls-access.js";
 import { socketAcceptor } from "./accept-socket.js";
+import { ownMailbox } from "./own-mailbox.js";
 import { functionGate, requireGate } from "./function-gate.js";
 import { sameCaller } from "./same-caller.js";
 import { Hono } from "hono";
@@ -15,6 +16,7 @@ const relativeRequest = (request, prefix) => {
 	url.pathname = url.pathname.slice(prefix.length) || "/";
 	return new Request(url, request);
 };
+const noPersonalMail = () => ({ send: () => Promise.reject(/* @__PURE__ */ new Error("Personal mail is off: name the mail providers people may link in auth.personalMail, such as [\"gmail\"]")) });
 const isUpgrade = (request) => request.headers.get("upgrade")?.toLowerCase() === "websocket";
 /**
 * Every function at `<basePath>/<name>` and below, any method. A protected function authenticates the request first, so
@@ -24,7 +26,7 @@ const isUpgrade = (request) => request.headers.get("upgrade")?.toLowerCase() ===
 * A function may answer an upgrade with a socket, only once it returned. While it is open, its caller is checked again
 * every minute: a protected function's always, a public one's once `caller()` resolved.
 */
-const functionRoutes = ({ basePath, functions, authenticate, access, db, records, channels, decryptField, onError, wake, upgradeWebSocket, upgradeAuthenticate = authenticate, calls, report }) => {
+const functionRoutes = ({ basePath, functions, authenticate, access, db, records, channels, decryptField, personalMailer = noPersonalMail, onError, wake, upgradeWebSocket, upgradeAuthenticate = authenticate, calls, report }) => {
 	const app = new Hono().basePath(basePath);
 	app.onError(onError);
 	const sessionOf = (request) => isUpgrade(request) ? upgradeAuthenticate(request) : authenticate(request);
@@ -99,6 +101,7 @@ const functionRoutes = ({ basePath, functions, authenticate, access, db, records
 				...caller,
 				caller: async () => caller,
 				decryptField: decryptField(reader),
+				personalMail: ownMailbox(caller.session, personalMailer),
 				acceptWebSocket: acceptor.accept,
 				calls: callsAccess(calls, async () => caller)
 			};

package/dist/index.d.ts

@@ -5,7 +5,7 @@ import { RealtimeOptions, relayed, sqlSends } from "./realtime/relay/realtime-op
 import { EventsOptions } from "./changes/events-options.js";
 import { DecryptField, FieldDecrypter, FieldReader, RecordKey } from "./encryption/decrypt-field-types.js";
 import { StandardSchema, readJson } from "./functions/read-json.js";
-import { MailMessage, Mailer } from "./mail/smtp-mailer.js";
+import { MailAttachment, MailMessage, Mailer } from "./mail/mail-message.js";
 import { JsonObject, JsonValue } from "./notifications/json-value.js";
 import { HistoryPosition, NewNotification, StoredNotification, historyIdPattern, historyLimits } from "./notifications/history.js";
 import { PushMessage, PushMessageError, Urgency, WebPushFields, maxTtlSeconds, pushMessage, urgencies } from "./notifications/message.js";
@@ -175,9 +175,11 @@ import { defineJob, isJobDefinition, jobDefinitions } from "./jobs/define-job.js
 import { FatalJobError } from "./jobs/run-job.js";
 import { ArgumentsPayload, EnqueueJob, JobDeclaration, JobName, JobPayload, JobRun, enqueueJob } from "./jobs/declared-job.js";
 import { isSchedule } from "./jobs/schedule.js";
+import { PersonalMailError, PersonalMailErrorCode } from "./personal-mail/personal-mail-error.js";
+import { PersonalMailProviderId } from "./personal-mail/personal-mail-providers.js";
 import { EmailComponent, EmailOptions, EmailTemplate, RenderedEmail, defineEmail } from "./mail/define-email.js";
 import { DrainResult, JobsRuntime, StartJobsOptions, startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
 import { checkJobsSchema, jobsSchema, jobsSchemaMigration } from "./jobs/schema.js";
 import { AdminAuth, CreateAuthOptions, UserCreatedHook, normalizeRoles } from "./better-auth/create-auth.js";
-export { type Admin, type AdminAuth, type AdminOptions, type AggregateParams, type ApiFunction, type ApiKeys, type ApiKeysOptions, type ApnsEnvironment, type AppIcons, type AppIdentity, type AppPoolConfig, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type ArgumentsPayload, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type AuthHooks, type AuthSettings, type AuthenticateSettings, type Authenticator, type BaseToolContext, type BatchOperation, type BatchResult, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type CallBackend, type CallMember, type Caller, type CallerOptions, type CallsAccess, type CallsOptions, type CapturedRow, type CascadingKey, type ChannelBroadcast, type ChannelSender, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentToolsInput, type CommentUsers, type Completion, type CompletionOptions, ConnectionsBusy, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DecryptField, type Device, type DeviceColumn, type DeviceKind, type DeviceStore, DeviceStoreError, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueJob, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldDecrypter, type FieldReader, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileProviderSettings, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryColumn, type HistoryOptions, type HistoryPosition, type HistoryStore, HistoryStoreError, type HookContext, HttpProblem, type IssueTokenOptions, type JobContext, type JobDeclaration, type JobDefinition, type JobName, type JobOptions, type JobPayload, type JobRun, type JobsRuntime, type JsonObject, type JsonValue, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LiveKitBackend, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type McpApprovals, type McpGateInput, type McpHandlerInput, type McpRoutesInput, type McpServerInput, type McpToolsInput, type McpWrites, type MemberInput, type Membership, MissingCredentials, type MobileConfig, ModelError, type ModelSettings, type NewDevice, type NewNotification, type NewOrganization, type NewUser, type NotificationRecipients, NotificationSendError, type NotificationsOptions, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PgModule, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type PushAnswer, type PushMessage, PushMessageError, type PushSender, type QueryOptions, type QueryResult, type ReadableResources, type RealtimeOptions, type RealtimePrune, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordGroups, type RecordKey, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type SendNotification, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StatusOptions, type StoreFileInput, type StoredMember, type StoredNotification, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolAnnotations, type ToolCall, type ToolComment, type ToolCommentPage, type ToolComments, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type Urgency, type User, type UserCreatedHook, type VapidSettings, type ViewSource, type WebPushFields, type WebPushOptions, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, type WriteRecordToolsInput, addAppRoleToOwners, addCommentTool, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appNameOver, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthTokens, callsMigration, capSocketMessages, changesMigration, channelSendsMigration, checkAi, checkAuthSchema, checkCalls, checkChanges, checkChannelSends, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkRealtimeRelay, checkResourcesOutsideAuthStore, checkSourceNames, checkStatusSchema, checkViewQueries, checkWebhooksSchema, coalesce, commentTools, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, countRecordsTool, createAdmin, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, describeResourceTool, deviceIdParam, deviceStore, devicesPath, enqueueJob, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listCommentsTool, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpIcons, mcpInstructions, mcpRoutes, mcpServer, mcpToolContext, mcpTools, migrationCommand, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notificationsMigration, oauthWellKnownPaths, objectKey, onDoNotDisturb, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, realtimeRelayMigration, recordOf, refusalOf, refused, relayed, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, sqlSends, startErrorReporting, startJobs, statusMigration, statusNames, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };
+export { type Admin, type AdminAuth, type AdminOptions, type AggregateParams, type ApiFunction, type ApiKeys, type ApiKeysOptions, type ApnsEnvironment, type AppIcons, type AppIdentity, type AppPoolConfig, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type ArgumentsPayload, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type AuthHooks, type AuthSettings, type AuthenticateSettings, type Authenticator, type BaseToolContext, type BatchOperation, type BatchResult, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type CallBackend, type CallMember, type Caller, type CallerOptions, type CallsAccess, type CallsOptions, type CapturedRow, type CascadingKey, type ChannelBroadcast, type ChannelSender, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentToolsInput, type CommentUsers, type Completion, type CompletionOptions, ConnectionsBusy, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DecryptField, type Device, type DeviceColumn, type DeviceKind, type DeviceStore, DeviceStoreError, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueJob, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldDecrypter, type FieldReader, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileProviderSettings, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryColumn, type HistoryOptions, type HistoryPosition, type HistoryStore, HistoryStoreError, type HookContext, HttpProblem, type IssueTokenOptions, type JobContext, type JobDeclaration, type JobDefinition, type JobName, type JobOptions, type JobPayload, type JobRun, type JobsRuntime, type JsonObject, type JsonValue, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LiveKitBackend, type LocalFilesOptions, type MailAttachment, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type McpApprovals, type McpGateInput, type McpHandlerInput, type McpRoutesInput, type McpServerInput, type McpToolsInput, type McpWrites, type MemberInput, type Membership, MissingCredentials, type MobileConfig, ModelError, type ModelSettings, type NewDevice, type NewNotification, type NewOrganization, type NewUser, type NotificationRecipients, NotificationSendError, type NotificationsOptions, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, PersonalMailError, type PersonalMailErrorCode, type PersonalMailProviderId, type PgModule, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type PushAnswer, type PushMessage, PushMessageError, type PushSender, type QueryOptions, type QueryResult, type ReadableResources, type RealtimeOptions, type RealtimePrune, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordGroups, type RecordKey, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type SendNotification, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StatusOptions, type StoreFileInput, type StoredMember, type StoredNotification, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolAnnotations, type ToolCall, type ToolComment, type ToolCommentPage, type ToolComments, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type Urgency, type User, type UserCreatedHook, type VapidSettings, type ViewSource, type WebPushFields, type WebPushOptions, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, type WriteRecordToolsInput, addAppRoleToOwners, addCommentTool, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appNameOver, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthTokens, callsMigration, capSocketMessages, changesMigration, channelSendsMigration, checkAi, checkAuthSchema, checkCalls, checkChanges, checkChannelSends, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkRealtimeRelay, checkResourcesOutsideAuthStore, checkSourceNames, checkStatusSchema, checkViewQueries, checkWebhooksSchema, coalesce, commentTools, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, countRecordsTool, createAdmin, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, describeResourceTool, deviceIdParam, deviceStore, devicesPath, enqueueJob, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listCommentsTool, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpIcons, mcpInstructions, mcpRoutes, mcpServer, mcpToolContext, mcpTools, migrationCommand, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notificationsMigration, oauthWellKnownPaths, objectKey, onDoNotDisturb, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, realtimeRelayMigration, recordOf, refusalOf, refused, relayed, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, sqlSends, startErrorReporting, startJobs, statusMigration, statusNames, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };

package/dist/index.js

@@ -33,6 +33,7 @@ import { supabasePath } from "./supabase-paths.js";
 import { goTruePath } from "./gotrue/keys.js";
 import { defaultSignInPolicy, signInPolicyMethods } from "./better-auth/sign-in-policy.js";
 import { parseRoles } from "./better-auth/parse-roles.js";
+import { PersonalMailError } from "./personal-mail/personal-mail-error.js";
 import { passwordLength } from "./better-auth/new-account-password.js";
 import { readOperatorSettings } from "./better-auth/operator-provider.js";
 import { readPlatformSignIn } from "./better-auth/platform-sign-in.js";
@@ -132,4 +133,4 @@ import { enqueueJob } from "./jobs/declared-job.js";
 import { defineEmail } from "./mail/define-email.js";
 import { startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
-export { ConnectionsBusy, DeviceStoreError, FatalJobError, HistoryStoreError, HttpProblem, MissingCredentials, ModelError, NotificationSendError, PushMessageError, addAppRoleToOwners, addCommentTool, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appNameOver, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthTokens, callsMigration, capSocketMessages, changesMigration, channelSendsMigration, checkAi, checkAuthSchema, checkCalls, checkChanges, checkChannelSends, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkRealtimeRelay, checkResourcesOutsideAuthStore, checkSourceNames, checkStatusSchema, checkViewQueries, checkWebhooksSchema, coalesce, commentTools, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, countRecordsTool, createAdmin, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, describeResourceTool, deviceIdParam, deviceStore, devicesPath, enqueueJob, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listCommentsTool, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpIcons, mcpInstructions, mcpRoutes, mcpServer, mcpToolContext, mcpTools, migrationCommand, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notificationsMigration, oauthWellKnownPaths, objectKey, onDoNotDisturb, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, realtimeRelayMigration, recordOf, refusalOf, refused, relayed, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, sqlSends, startErrorReporting, startJobs, statusMigration, statusNames, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };
+export { ConnectionsBusy, DeviceStoreError, FatalJobError, HistoryStoreError, HttpProblem, MissingCredentials, ModelError, NotificationSendError, PersonalMailError, PushMessageError, addAppRoleToOwners, addCommentTool, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appNameOver, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthTokens, callsMigration, capSocketMessages, changesMigration, channelSendsMigration, checkAi, checkAuthSchema, checkCalls, checkChanges, checkChannelSends, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkRealtimeRelay, checkResourcesOutsideAuthStore, checkSourceNames, checkStatusSchema, checkViewQueries, checkWebhooksSchema, coalesce, commentTools, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, countRecordsTool, createAdmin, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, describeResourceTool, deviceIdParam, deviceStore, devicesPath, enqueueJob, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listCommentsTool, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpIcons, mcpInstructions, mcpRoutes, mcpServer, mcpToolContext, mcpTools, migrationCommand, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notificationsMigration, oauthWellKnownPaths, objectKey, onDoNotDisturb, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, realtimeRelayMigration, recordOf, refusalOf, refused, relayed, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, sqlSends, startErrorReporting, startJobs, statusMigration, statusNames, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };

package/dist/jobs/job-types.d.ts

@@ -1,6 +1,6 @@
 import { DecryptField } from "../encryption/decrypt-field-types.js";
 import { StandardSchema } from "../functions/read-json.js";
-import { Mailer } from "../mail/smtp-mailer.js";
+import { Mailer } from "../mail/mail-message.js";
 import { SendNotification } from "../notifications/send-input.js";
 import { Db } from "@protobase/query";
 //#region src/jobs/job-types.d.ts

package/dist/jobs/runtime.d.ts

@@ -1,5 +1,5 @@
 import { FieldDecrypter } from "../encryption/decrypt-field-types.js";
-import { Mailer } from "../mail/smtp-mailer.js";
+import { Mailer } from "../mail/mail-message.js";
 import { JobDefinition } from "./job-types.js";
 import { JobsEnqueuer } from "./current.js";
 import { Db } from "@protobase/query";

package/dist/mail/composer-message.js

@@ -0,0 +1,27 @@
+//#region src/mail/composer-message.ts
+/**
+* `message` as Nodemailer composes it: its header fields checked, and its attachments as their bytes alone, with
+* Nodemailer's reads of a file path or URL turned off, so no attachment can name a file on the server or a URL to fetch.
+*/
+const composerMessage = ({ attachments, ...message }) => {
+	checkHeaders(message.headers);
+	if (!attachments?.length) return message;
+	return {
+		...message,
+		attachments: attachments.map(({ filename, content, contentType }) => ({
+			filename,
+			content: Buffer.from(content),
+			...contentType && { contentType }
+		})),
+		disableFileAccess: true,
+		disableUrlAccess: true
+	};
+};
+const checkHeaders = (headers = {}) => {
+	for (const [name, value] of Object.entries(headers)) {
+		if (!/^[!-9;-~]+$/.test(name)) throw new Error(`Mail header name "${name}" is not a valid header field name`);
+		if (/[\r\n]/.test(value)) throw new Error(`Mail header ${name} has a line break; a header value is one line`);
+	}
+};
+//#endregion
+export { composerMessage };

package/dist/mail/define-email.d.ts

@@ -1,4 +1,4 @@
-import { Mailer } from "./smtp-mailer.js";
+import { MailAttachment, Mailer } from "./mail-message.js";
 //#region src/mail/define-email.d.ts
 export type EmailOptions<Data extends object> = {
   /** Names the email in errors, such as `welcome` or `listing-alert`. */
@@ -32,10 +32,13 @@ export type EmailTemplate<Data extends object> = {
   render(data: Data): Promise<RenderedEmail>;
   /**
    * Renders the email for `data` and sends it to `to`: through `mailer` when given, such as a job's `context.mail`,
-   * otherwise through the app's SMTP server (`PROTOBASE_SMTP_URL`, `PROTOBASE_MAIL_FROM`). Rejects when mail is off
-   * or the server refuses the message.
+   * or a function's `context.personalMail`, the caller's own mailbox, otherwise through the app's SMTP server
+   * (`PROTOBASE_SMTP_URL`, `PROTOBASE_MAIL_FROM`), with the `attachments` given. Rejects when mail is off or the server
+   * refuses the message.
    */
-  send(to: string, data: Data, mailer?: Mailer): Promise<void>;
+  send(to: string, data: Data, mailer?: Mailer, extra?: {
+    attachments?: MailAttachment[];
+  }): Promise<void>;
 };
 /**
  * An email the app sends, with typed data: its subject and a React component for its body. Protobase renders it to

package/dist/mail/define-email.js

@@ -27,11 +27,12 @@ const defineEmail = (options) => {
 			...headers && { headers }
 		};
 	};
-	const send = async (to, data, mailer = platformMailer()) => {
+	const send = async (to, data, mailer = platformMailer(), { attachments } = {}) => {
 		if (!mailer) throw new Error(`Email "${options.name}" cannot be sent: mail is off; set ${smtpUrlVariable} and ${mailFromVariable}`);
 		await mailer.send({
 			to,
-			...await render(data)
+			...await render(data),
+			...attachments && attachments.length > 0 && { attachments }
 		});
 	};
 	return {

package/dist/mail/{smtp-mailer.d.ts → mail-message.d.ts}

@@ -1,4 +1,4 @@
-//#region src/mail/smtp-mailer.d.ts
+//#region src/mail/mail-message.d.ts
 export type MailMessage = {
   to: string;
   subject: string;
@@ -11,6 +11,14 @@ export type MailMessage = {
    * of bulk mail. A value is one line.
    */
   headers?: Record<string, string>;
+  /** Files sent with the message, such as an invoice's PDF. */
+  attachments?: MailAttachment[];
+};
+/** A file sent with a message: its name as the recipient sees it, its bytes, and its media type, else one its name implies. */
+export type MailAttachment = {
+  filename: string;
+  content: Uint8Array;
+  contentType?: string;
 };
 /** Sends one message; rejects when the server refuses it. */
 export type Mailer = {

package/dist/mail/smtp-mailer.js

@@ -1,3 +1,4 @@
+import { composerMessage } from "./composer-message.js";
 //#region src/mail/smtp-mailer.ts
 /**
 * Mail over SMTP with Nodemailer: the most used Node SMTP client, maintained, with no dependencies of its
@@ -10,14 +11,13 @@
 const smtpMailer = (settings) => {
 	let transport;
 	return { send: async (message) => {
-		checkHeaders(message.headers);
 		transport ??= import("nodemailer").then(({ createTransport }) => createTransport({
 			url: settings.smtpUrl,
 			name: senderDomain(settings.from)
 		}));
 		await (await transport).sendMail({
 			from: sender(settings),
-			...message
+			...composerMessage(message)
 		});
 	} };
 };
@@ -27,11 +27,5 @@ const sender = ({ from, name }) => name ? {
 } : from;
 /** The domain of a sender address `readMailSettings` accepted, so always a dotted hostname. */
 const senderDomain = (from) => from.slice(from.lastIndexOf("@") + 1);
-const checkHeaders = (headers = {}) => {
-	for (const [name, value] of Object.entries(headers)) {
-		if (!/^[!-9;-~]+$/.test(name)) throw new Error(`Mail header name "${name}" is not a valid header field name`);
-		if (/[\r\n]/.test(value)) throw new Error(`Mail header ${name} has a line break; a header value is one line`);
-	}
-};
 //#endregion
 export { smtpMailer };

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.62.4";
+var version = "0.62.5";
 //#endregion
 export { version };

package/dist/personal-mail/gmail.js

@@ -0,0 +1,43 @@
+import { PersonalMailError } from "./personal-mail-error.js";
+import { rfc822Message } from "./rfc822-message.js";
+//#region src/personal-mail/gmail.ts
+/** The Gmail API's scope that sends mail and nothing else: no reading of the mailbox. */
+const gmailSendScope = "https://www.googleapis.com/auth/gmail.send";
+/** Its upload endpoint takes the message as it is, up to 35 MB, where the JSON one takes it base64-encoded. */
+const gmailSendUrl = "https://gmail.googleapis.com/upload/gmail/v1/users/me/messages/send?uploadType=media";
+/**
+* Gmail, linked through Google sign-in: offline access, so Google gives a refresh token, asked with `prompt=consent`
+* so it gives one again on a second link. Gmail sets the From header to the linked address.
+*/
+const gmail = (fetcher = (...args) => fetch(...args)) => ({
+	id: "gmail",
+	name: "Gmail",
+	signInProvider: "google",
+	scopes: [gmailSendScope],
+	linkParams: {
+		access_type: "offline",
+		prompt: "consent"
+	},
+	send: async (message, accessToken) => {
+		const body = await rfc822Message(message);
+		const response = await fetcher(gmailSendUrl, {
+			method: "POST",
+			headers: {
+				authorization: `Bearer ${accessToken}`,
+				"content-type": "message/rfc822"
+			},
+			body: new Uint8Array(body)
+		});
+		if (response.ok) return;
+		if (response.status === 401 || response.status === 403 && await gmailReason(response) === "insufficientPermissions") throw new PersonalMailError("link_expired", "gmail");
+		throw new Error(`Gmail refused the message: ${response.status} ${response.statusText}`);
+	}
+});
+const gmailReason = async (response) => {
+	if (!response.headers.get("content-type")?.includes("json")) return;
+	const body = await response.json();
+	const reasons = [...body.error?.errors ?? [], ...body.error?.details ?? []].map((entry) => entry.reason);
+	return reasons.includes("insufficientPermissions") || reasons.includes("ACCESS_TOKEN_SCOPE_INSUFFICIENT") ? "insufficientPermissions" : reasons[0];
+};
+//#endregion
+export { gmail, gmailSendScope, gmailSendUrl };

package/dist/personal-mail/linked-accounts.js

@@ -0,0 +1,36 @@
+import { PersonalMailError } from "./personal-mail-error.js";
+import { APIError } from "better-auth/api";
+//#region src/personal-mail/linked-accounts.ts
+const storedScopes = (scope) => (scope ?? "").split(/[\s,]+/).filter(Boolean);
+/**
+* The accounts Better Auth keeps, with the tokens it stores, decrypted when `encryptOAuthTokens` is on. Its
+* `getAccessToken` refreshes a token within five seconds of expiry with the provider's refresh token and stores the new
+* one; when the provider refuses the refresh, as for a revoked grant, that is `link_expired`.
+*/
+const betterAuthLinkedAccounts = (auth) => ({
+	accounts: async (userId) => {
+		return (await (await auth.$context).internalAdapter.findAccounts(userId)).map((account) => ({
+			id: account.id,
+			providerId: account.providerId,
+			scopes: storedScopes(account.scope)
+		}));
+	},
+	accessToken: async (userId, account, provider) => {
+		const accessToken = await validAccessToken(auth, userId, account.id, provider);
+		if (!accessToken) throw new PersonalMailError("link_expired", provider);
+		return accessToken;
+	}
+});
+const validAccessToken = async (auth, userId, accountId, provider) => {
+	try {
+		return (await auth.api.getAccessToken({ body: {
+			accountId,
+			userId
+		} })).accessToken;
+	} catch (error) {
+		if (error instanceof APIError && error.body?.code === "FAILED_TO_GET_ACCESS_TOKEN") throw new PersonalMailError("link_expired", provider);
+		throw error;
+	}
+};
+//#endregion
+export { betterAuthLinkedAccounts };

package/dist/personal-mail/personal-mail-error.d.ts

@@ -0,0 +1,22 @@
+import { HttpProblem } from "../problem.js";
+//#region src/personal-mail/personal-mail-error.d.ts
+/**
+ * Why a message cannot go out from someone's own mailbox: `not_linked`, they linked no mail provider of the app's, or
+ * linked the sign-in account without allowing it to send mail; `link_expired`, the provider no longer honours the
+ * link, as when they revoked it or its refresh token expired, so they link it again.
+ */
+export type PersonalMailErrorCode = 'not_linked' | 'link_expired';
+/**
+ * Thrown when a message cannot go out from someone's own mailbox, and nothing was sent. Out of a function it answers as
+ * a 409 problem whose `code` and `provider` say which, so the app can offer to link the mailbox; in code,
+ * `error instanceof PersonalMailError` and its `code` tell.
+ */
+export declare class PersonalMailError extends HttpProblem {
+  readonly code: PersonalMailErrorCode;
+  /** The mail provider at fault, such as `gmail`; none when nothing is linked. */
+  readonly provider?: string | undefined;
+  constructor(code: PersonalMailErrorCode,
+  /** The mail provider at fault, such as `gmail`; none when nothing is linked. */
+  provider?: string | undefined);
+}
+//#endregion

package/dist/personal-mail/personal-mail-error.js

@@ -0,0 +1,25 @@
+import { HttpProblem } from "../problem.js";
+//#region src/personal-mail/personal-mail-error.ts
+const details = {
+	not_linked: "Link a mailbox to send mail from it",
+	link_expired: "The link to your mailbox has expired: link it again to send mail from it"
+};
+/**
+* Thrown when a message cannot go out from someone's own mailbox, and nothing was sent. Out of a function it answers as
+* a 409 problem whose `code` and `provider` say which, so the app can offer to link the mailbox; in code,
+* `error instanceof PersonalMailError` and its `code` tell.
+*/
+var PersonalMailError = class extends HttpProblem {
+	code;
+	provider;
+	constructor(code, provider) {
+		super(409, `personal-mail-${code.replace("_", "-")}`, "Conflict", details[code], {
+			code,
+			...provider && { provider }
+		});
+		this.code = code;
+		this.provider = provider;
+	}
+};
+//#endregion
+export { PersonalMailError };

package/dist/personal-mail/personal-mail-provider.d.ts

@@ -0,0 +1,25 @@
+import { MailMessage } from "../mail/mail-message.js";
+//#region src/personal-mail/personal-mail-provider.d.ts
+/**
+ * A mail provider people link their own mailbox with, through the app's sign-in provider of the same company: linking
+ * asks the sign-in provider for `scopes` with `linkParams`, the sign-in account Better Auth keeps holds the tokens, and
+ * `send` sends a message with its access token.
+ */
+export type PersonalMailProvider = {
+  /** Its id, such as `gmail`, as `auth.personalMail` names it. */
+  id: string;
+  /** The name the account page shows, such as `Gmail`. */
+  name: string;
+  /** The sign-in provider whose account holds the tokens, such as `google`: one of the app's `socialProviders`. */
+  signInProvider: string;
+  /** The scopes linking asks for, which the account must hold to send. */
+  scopes: string[];
+  /** More authorization parameters of the link, such as those that ask for a refresh token. */
+  linkParams: Record<string, string>;
+  /**
+   * Sends `message` from the mailbox. Rejects with a `PersonalMailError` of `link_expired` when the provider refuses the
+   * token, and with an error naming the status for anything else it refuses.
+   */
+  send: (message: MailMessage, accessToken: string) => Promise<void>;
+};
+//#endregion

package/dist/personal-mail/personal-mail-providers.d.ts

@@ -0,0 +1,8 @@
+import { PersonalMailProvider } from "./personal-mail-provider.js";
+//#region src/personal-mail/personal-mail-providers.d.ts
+/** The mail providers Protobase links mailboxes with, by the id `auth.personalMail` names them with. */
+export declare const personalMailProviders: {
+  gmail: (fetcher?: typeof fetch) => PersonalMailProvider;
+};
+export type PersonalMailProviderId = keyof typeof personalMailProviders;
+//#endregion

package/dist/personal-mail/personal-mail-providers.js

@@ -0,0 +1,16 @@
+import { gmail } from "./gmail.js";
+//#region src/personal-mail/personal-mail-providers.ts
+/** The mail providers Protobase links mailboxes with, by the id `auth.personalMail` names them with. */
+const personalMailProviders = { gmail };
+/**
+* The providers of `ids`, each checked against the app's sign-in providers: linking one goes through its sign-in
+* provider, so an app without it is a configuration error at startup.
+*/
+const resolvePersonalMail = (ids, signInProviders) => ids.map((id) => {
+	if (!Object.hasOwn(personalMailProviders, id)) throw new Error(`auth.personalMail: "${id}" is not a mail provider; use one of ${Object.keys(personalMailProviders).join(", ")}`);
+	const provider = personalMailProviders[id]();
+	if (!signInProviders.includes(provider.signInProvider)) throw new Error(`auth.personalMail: ${provider.name} links through the sign-in provider "${provider.signInProvider}"; add it to auth.socialProviders`);
+	return provider;
+});
+//#endregion
+export { personalMailProviders, resolvePersonalMail };

package/dist/personal-mail/personal-mailer.js

@@ -0,0 +1,26 @@
+import { PersonalMailError } from "./personal-mail-error.js";
+//#region src/personal-mail/personal-mailer.ts
+/** The mail provider `userId` linked, of the app's `providers` in their order, with the account that holds its tokens. */
+const linkedProvider = async (accounts, providers, userId) => {
+	const linked = await accounts.accounts(userId);
+	for (const provider of providers) {
+		const account = linked.find((candidate) => candidate.providerId === provider.signInProvider && provider.scopes.every((scope) => candidate.scopes.includes(scope)));
+		if (account) return {
+			provider,
+			account
+		};
+	}
+};
+/**
+* Mail from `userId`'s own mailbox: each message goes out through the mail provider they linked, with an access token
+* refreshed when it expired. Rejects with a `PersonalMailError` and sends nothing when they linked none (`not_linked`)
+* or the provider no longer honours the link (`link_expired`).
+*/
+const personalMailer = (accounts, providers, userId) => ({ send: async (message) => {
+	const linked = await linkedProvider(accounts, providers, userId);
+	if (!linked) throw new PersonalMailError("not_linked");
+	const accessToken = await accounts.accessToken(userId, linked.account, linked.provider.id);
+	await linked.provider.send(message, accessToken);
+} });
+//#endregion
+export { linkedProvider, personalMailer };

package/dist/personal-mail/rfc822-message.js

@@ -0,0 +1,15 @@
+import { composerMessage } from "../mail/composer-message.js";
+//#region src/personal-mail/rfc822-message.ts
+/**
+* `message` as an RFC 5322 message, attachments and all, the way the SMTP mailer composes it, with Nodemailer's
+* composer. Without `from`, the provider fills in the From header with the mailbox it sends from.
+*/
+const rfc822Message = async (message, from) => {
+	const { default: MailComposer } = await import("nodemailer/lib/mail-composer");
+	return new MailComposer({
+		...from && { from },
+		...composerMessage(message)
+	}).compile().build();
+};
+//#endregion
+export { rfc822Message };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.62.4",
+  "version": "0.62.5",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -42,9 +42,9 @@
     "@better-auth/sso": "^1.7.12",
     "@livekit/protocol": "1.53.1",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.62.4",
-    "@protobase/query": "0.62.4",
-    "@protobase/schema": "0.62.4",
+    "@protobase/layout": "0.62.5",
+    "@protobase/query": "0.62.5",
+    "@protobase/schema": "0.62.5",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",