@protobase/server 0.67.0 → 0.67.2

package/dist/config-exports.d.ts

@@ -1,4 +1,6 @@
 import { configExports } from "./resource-source.js";
+import { definitionsSchema, userTablesSchema } from "./user-tables/names.js";
+import { userTableResources } from "./user-tables/user-table-resources.js";
 import { builtInResources } from "./built-in-resources.js";
 import { webhooksModule } from "./webhooks/table/webhooks-module.js";
-export { builtInResources, configExports, webhooksModule };
+export { builtInResources, configExports, definitionsSchema, userTableResources, userTablesSchema, webhooksModule };

package/dist/config-exports.js

@@ -1,4 +1,6 @@
 import { builtInResources } from "./built-in-resources.js";
 import { configExports } from "./resource-source.js";
+import { definitionsSchema, userTablesSchema } from "./user-tables/names.js";
+import { userTableResources } from "./user-tables/user-table-resources.js";
 import { webhooksModule } from "./webhooks/table/webhooks-module.js";
-export { builtInResources, configExports, webhooksModule };
+export { builtInResources, configExports, definitionsSchema, userTableResources, userTablesSchema, webhooksModule };

package/dist/create-admin.d.ts

@@ -17,6 +17,7 @@ import { Difficulty } from "./forms/challenge.js";
 import { ResourceSource } from "./resource-source.js";
 import { FunctionSource } from "./functions/define-function.js";
 import { AdminOptions } from "./admin-options.js";
+import { UserTableSources } from "./user-tables/served-user-tables.js";
 import { AdminAuth } from "./better-auth/create-auth.js";
 import { BottomBarSource, UserMenuSource } from "@protobase/schema";
 import { Db } from "@protobase/query";
@@ -26,6 +27,8 @@ import { UpgradeWebSocket } from "hono/ws";
 export type CreateAdminInput = {
   resources: ResourceSource[];
   views?: ViewSource[];
+  /** The tables users add, from their definitions (`userTableResources`): one a resource here or a built-in names is left out with a warning. */
+  userTables?: UserTableSources;
   /** The `userMenu(...)` export of the config module: pages under the signed-in user in the sidebar. */
   userMenu?: UserMenuSource;
   /** The `bottomBar(...)` exports of the config module, in order: tabs on phones for the roles each names. */
@@ -99,5 +102,5 @@ export type CreateAdminInput = {
   upgradeWebSocket?: UpgradeWebSocket;
 };
 /** The admin REST API as a Hono app. It uses only Web APIs, so it runs on Node, Workers and anywhere else Hono does. */
-export declare const createAdmin: ({ resources: appResources, views: appViews, pages, userMenu, bottomBars, db, authenticate, auth, functions, secret, files: filesOptions, events, history: historyOptions, jobs, subscriptions, webhooks: webhooksOptions, realtime, notifications, status, calls, mobile, app: identity, icons, bundlePlugins, fieldTypes, options, formsDifficulty, commentUsers: givenCommentUsers, verifyToken, upgradeWebSocket }: CreateAdminInput) => Admin;
+export declare const createAdmin: ({ resources: appResources, views: appViews, userTables, pages, userMenu, bottomBars, db, authenticate, auth, functions, secret, files: filesOptions, events, history: historyOptions, jobs, subscriptions, webhooks: webhooksOptions, realtime, notifications, status, calls, mobile, app: identity, icons, bundlePlugins, fieldTypes, options, formsDifficulty, commentUsers: givenCommentUsers, verifyToken, upgradeWebSocket }: CreateAdminInput) => Admin;
 //#endregion

package/dist/create-admin.js

@@ -112,6 +112,7 @@ import { recordRoutes } from "./routes/record.js";
 import { firstAdminUrl } from "./better-auth/first-admin-url.js";
 import { createScanGuard } from "./scan-guard.js";
 import { builtInResources } from "./built-in-resources.js";
+import { servedUserTables } from "./user-tables/served-user-tables.js";
 import { Hono } from "hono";
 import { accountPage, accountPageName, checkPages, settingsResources, withSettingsFields } from "@protobase/layout";
 import { guestCallsPath, ringsPath, statusPath } from "@protobase/schema/internal";
@@ -122,7 +123,7 @@ const declaredRoles = (auth, roles) => {
 	return names.length > 0 ? [...new Set(names)] : void 0;
 };
 /** The admin REST API as a Hono app. It uses only Web APIs, so it runs on Node, Workers and anywhere else Hono does. */
-const createAdmin = ({ resources: appResources, views: appViews = [], pages = [], userMenu, bottomBars = [], db, authenticate, auth, functions = {}, secret, files: filesOptions, events, history: historyOptions, jobs = [], subscriptions = [], webhooks: webhooksOptions, realtime, notifications, status, calls, mobile, app: identity, icons, bundlePlugins = [], fieldTypes = {}, options = {}, formsDifficulty, commentUsers: givenCommentUsers, verifyToken, upgradeWebSocket }) => {
+const createAdmin = ({ resources: appResources, views: appViews = [], userTables, pages = [], userMenu, bottomBars = [], db, authenticate, auth, functions = {}, secret, files: filesOptions, events, history: historyOptions, jobs = [], subscriptions = [], webhooks: webhooksOptions, realtime, notifications, status, calls, mobile, app: identity, icons, bundlePlugins = [], fieldTypes = {}, options = {}, formsDifficulty, commentUsers: givenCommentUsers, verifyToken, upgradeWebSocket }) => {
 	const basePath = options.basePath ?? "/api/v1";
 	const appModels = appResources.map((resource) => resource.toModel());
 	const withComments = appModels.some((model) => model.comments);
@@ -136,8 +137,21 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 		notifications: notifications !== void 0,
 		...events && { events }
 	});
-	const resources = [...appResources, ...builtIn.resources];
-	const views = [...appViews, ...builtIn.views];
+	const served = servedUserTables(userTables ?? {
+		resources: [],
+		views: []
+	}, [...appModels, ...builtIn.resources.map((resource) => resource.toModel())].map((model) => model.name));
+	for (const warning of served.warnings) console.warn(warning);
+	const resources = [
+		...appResources,
+		...builtIn.resources,
+		...served.resources
+	];
+	const views = [
+		...appViews,
+		...builtIn.views,
+		...served.views
+	];
 	const commentUsers = withComments ? givenCommentUsers ?? (auth && betterAuthCommentUsers(auth)) : void 0;
 	const mentions = withComments ? mentionJob(commentUsers, shownAppName(auth, globalThis.process?.env ?? {})) : void 0;
 	const registry = buildRegistry(resources);
@@ -551,6 +565,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	return Object.assign(app, {
 		startRealtimePrune: prune,
 		decryptField,
+		metaPath: `${deps.systemPath}/meta`,
 		jobs: [
 			...webhooks.jobs,
 			...withHistory && days !== void 0 ? [pruneHistoryJob(changes, days)] : [],

package/dist/index.d.ts

@@ -101,6 +101,10 @@ import { eventMatcher } from "./changes/match-events.js";
 import { parseColumns, readOutbox } from "./changes/outbox.js";
 import { newWebhookSecret } from "./webhooks/standard-webhooks.js";
 import { checkWebhooksSchema, webhooksMigration } from "./webhooks/table/schema.js";
+import { checkUserTablesSchema, userTablesMigration } from "./user-tables/schema.js";
+import { UserTables, userTableResources } from "./user-tables/user-table-resources.js";
+import { readDefinitionsVersion } from "./user-tables/definitions-version.js";
+import { reloadingAdmin } from "./user-tables/reloading-admin.js";
 import { checkRealtimeRelay, realtimeRelayMigration } from "./realtime/relay/relay-schema.js";
 import { channelSendsMigration, checkChannelSends } from "./channels/sends-schema.js";
 import { checkComments, commentsMigration } from "./comments/comments-sql.js";
@@ -184,4 +188,4 @@ import { DrainResult, JobsRuntime, StartJobsOptions, startJobs } from "./jobs/ru
 import { jobsDrainApp } from "./jobs/drain-route.js";
 import { checkJobsSchema, jobsSchema, jobsSchemaMigration } from "./jobs/schema.js";
 import { AdminAuth, CreateAuthOptions, UserCreatedHook, normalizeRoles } from "./better-auth/create-auth.js";
-export { type Admin, type AdminAuth, type AdminOptions, type AggregateParams, type ApiFunction, type ApiKeys, type ApiKeysOptions, type ApnsEnvironment, type AppIcons, type AppIdentity, type AppPoolConfig, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type ArgumentsPayload, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type AuthHooks, type AuthSettings, type AuthenticateSettings, type Authenticator, type BaseToolContext, type BatchOperation, type BatchResult, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type CallBackend, type CallMember, type Caller, type CallerOptions, type CallsAccess, type CallsOptions, type CapturedRow, type CascadingKey, type ChannelBroadcast, type ChannelSender, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentToolsInput, type CommentUsers, type Completion, type CompletionOptions, ConnectionsBusy, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DecryptField, type Device, type DeviceColumn, type DeviceKind, type DeviceStore, DeviceStoreError, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueJob, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldDecrypter, type FieldReader, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileProviderSettings, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryColumn, type HistoryOptions, type HistoryPosition, type HistoryStore, HistoryStoreError, type HookContext, HttpProblem, type IssueTokenOptions, type JobContext, type JobDeclaration, type JobDefinition, type JobName, type JobOptions, type JobPayload, type JobRun, type JobsRuntime, type JsonObject, type JsonValue, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LiveKitBackend, type LocalFilesOptions, type MailAttachment, type MailMessage, MailServerTimeoutError, type Mailer, type MapLayer, type MapOptions, type MapSettings, type McpApprovals, type McpGateInput, type McpHandlerInput, type McpRoutesInput, type McpServerInput, type McpToolsInput, type McpWrites, type MemberInput, type Membership, MissingCredentials, type MobileConfig, ModelError, type ModelSettings, type NewDevice, type NewNotification, type NewOrganization, type NewUser, type NotificationRecipients, NotificationSendError, type NotificationsOptions, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PdfComponent, type PdfOptions, type PdfTemplate, PersonalMailError, type PersonalMailErrorCode, type PersonalMailProviderId, type PgModule, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type PushAnswer, type PushMessage, PushMessageError, type PushSender, type QueryOptions, type QueryResult, type ReadableResources, type RealtimeOptions, type RealtimePrune, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordGroups, type RecordKey, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type SendNotification, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StatusOptions, type StoreFileInput, type StoredMember, type StoredNotification, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolAnnotations, type ToolCall, type ToolComment, type ToolCommentPage, type ToolComments, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type Urgency, type User, type UserCreatedHook, type VapidSettings, type ViewSource, type WebPushFields, type WebPushOptions, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, type WriteRecordToolsInput, addAppRoleToOwners, addCommentTool, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appNameOver, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthTokens, callsMigration, capSocketMessages, changesMigration, channelSendsMigration, checkAi, checkAuthSchema, checkCalls, checkChanges, checkChannelSends, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkRealtimeRelay, checkResourcesOutsideAuthStore, checkSourceNames, checkStatusSchema, checkViewQueries, checkWebhooksSchema, coalesce, commentTools, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, countRecordsTool, createAdmin, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineEmail, defineFunction, defineJob, definePdf, defineTool, deleteRecordTool, deleteUser, describeResourceTool, deviceIdParam, deviceStore, devicesPath, enqueueJob, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listCommentsTool, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpIcons, mcpInstructions, mcpRoutes, mcpServer, mcpToolContext, mcpTools, migrationCommand, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notificationsMigration, oauthWellKnownPaths, objectKey, onDoNotDisturb, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, realtimeRelayMigration, recordOf, refusalOf, refused, relayed, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, sqlSends, startErrorReporting, startJobs, statusMigration, statusNames, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };
+export { type Admin, type AdminAuth, type AdminOptions, type AggregateParams, type ApiFunction, type ApiKeys, type ApiKeysOptions, type ApnsEnvironment, type AppIcons, type AppIdentity, type AppPoolConfig, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type ArgumentsPayload, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type AuthHooks, type AuthSettings, type AuthenticateSettings, type Authenticator, type BaseToolContext, type BatchOperation, type BatchResult, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type CallBackend, type CallMember, type Caller, type CallerOptions, type CallsAccess, type CallsOptions, type CapturedRow, type CascadingKey, type ChannelBroadcast, type ChannelSender, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentToolsInput, type CommentUsers, type Completion, type CompletionOptions, ConnectionsBusy, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DecryptField, type Device, type DeviceColumn, type DeviceKind, type DeviceStore, DeviceStoreError, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueJob, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldDecrypter, type FieldReader, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileProviderSettings, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryColumn, type HistoryOptions, type HistoryPosition, type HistoryStore, HistoryStoreError, type HookContext, HttpProblem, type IssueTokenOptions, type JobContext, type JobDeclaration, type JobDefinition, type JobName, type JobOptions, type JobPayload, type JobRun, type JobsRuntime, type JsonObject, type JsonValue, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LiveKitBackend, type LocalFilesOptions, type MailAttachment, type MailMessage, MailServerTimeoutError, type Mailer, type MapLayer, type MapOptions, type MapSettings, type McpApprovals, type McpGateInput, type McpHandlerInput, type McpRoutesInput, type McpServerInput, type McpToolsInput, type McpWrites, type MemberInput, type Membership, MissingCredentials, type MobileConfig, ModelError, type ModelSettings, type NewDevice, type NewNotification, type NewOrganization, type NewUser, type NotificationRecipients, NotificationSendError, type NotificationsOptions, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PdfComponent, type PdfOptions, type PdfTemplate, PersonalMailError, type PersonalMailErrorCode, type PersonalMailProviderId, type PgModule, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type PushAnswer, type PushMessage, PushMessageError, type PushSender, type QueryOptions, type QueryResult, type ReadableResources, type RealtimeOptions, type RealtimePrune, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordGroups, type RecordKey, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type SendNotification, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StatusOptions, type StoreFileInput, type StoredMember, type StoredNotification, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolAnnotations, type ToolCall, type ToolComment, type ToolCommentPage, type ToolComments, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type Urgency, type User, type UserCreatedHook, type UserTables, type VapidSettings, type ViewSource, type WebPushFields, type WebPushOptions, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, type WriteRecordToolsInput, addAppRoleToOwners, addCommentTool, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appNameOver, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthTokens, callsMigration, capSocketMessages, changesMigration, channelSendsMigration, checkAi, checkAuthSchema, checkCalls, checkChanges, checkChannelSends, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkRealtimeRelay, checkResourcesOutsideAuthStore, checkSourceNames, checkStatusSchema, checkUserTablesSchema, checkViewQueries, checkWebhooksSchema, coalesce, commentTools, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, countRecordsTool, createAdmin, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineEmail, defineFunction, defineJob, definePdf, defineTool, deleteRecordTool, deleteUser, describeResourceTool, deviceIdParam, deviceStore, devicesPath, enqueueJob, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listCommentsTool, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpIcons, mcpInstructions, mcpRoutes, mcpServer, mcpToolContext, mcpTools, migrationCommand, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notificationsMigration, oauthWellKnownPaths, objectKey, onDoNotDisturb, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readDefinitionsVersion, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, realtimeRelayMigration, recordOf, refusalOf, refused, relayed, reloadingAdmin, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, sqlSends, startErrorReporting, startJobs, statusMigration, statusNames, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, userTableResources, userTablesMigration, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };

package/dist/index.js

@@ -113,6 +113,10 @@ import { authStoreTables } from "./better-auth/auth-tables.js";
 import { checkResourcesOutsideAuthStore } from "./better-auth/store/resources-outside.js";
 import { checkComputed, computedMigration } from "./computed/computed-schema.js";
 import { checkWebhooksSchema, webhooksMigration } from "./webhooks/table/schema.js";
+import { checkUserTablesSchema, userTablesMigration } from "./user-tables/schema.js";
+import { userTableResources } from "./user-tables/user-table-resources.js";
+import { readDefinitionsVersion } from "./user-tables/definitions-version.js";
+import { reloadingAdmin } from "./user-tables/reloading-admin.js";
 import { checkRealtimeRelay, realtimeRelayMigration } from "./realtime/relay/relay-schema.js";
 import { channelSendsMigration, checkChannelSends } from "./channels/sends-schema.js";
 import { callsMigration, checkCalls } from "./calls/calls-sql.js";
@@ -135,4 +139,4 @@ import { defineEmail } from "./mail/define-email.js";
 import { definePdf } from "./pdf/define-pdf.js";
 import { startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
-export { ConnectionsBusy, DeviceStoreError, FatalJobError, HistoryStoreError, HttpProblem, MailServerTimeoutError, MissingCredentials, ModelError, NotificationSendError, PersonalMailError, PushMessageError, addAppRoleToOwners, addCommentTool, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appNameOver, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthTokens, callsMigration, capSocketMessages, changesMigration, channelSendsMigration, checkAi, checkAuthSchema, checkCalls, checkChanges, checkChannelSends, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkRealtimeRelay, checkResourcesOutsideAuthStore, checkSourceNames, checkStatusSchema, checkViewQueries, checkWebhooksSchema, coalesce, commentTools, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, countRecordsTool, createAdmin, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineEmail, defineFunction, defineJob, definePdf, defineTool, deleteRecordTool, deleteUser, describeResourceTool, deviceIdParam, deviceStore, devicesPath, enqueueJob, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listCommentsTool, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpIcons, mcpInstructions, mcpRoutes, mcpServer, mcpToolContext, mcpTools, migrationCommand, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notificationsMigration, oauthWellKnownPaths, objectKey, onDoNotDisturb, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, realtimeRelayMigration, recordOf, refusalOf, refused, relayed, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, sqlSends, startErrorReporting, startJobs, statusMigration, statusNames, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };
+export { ConnectionsBusy, DeviceStoreError, FatalJobError, HistoryStoreError, HttpProblem, MailServerTimeoutError, MissingCredentials, ModelError, NotificationSendError, PersonalMailError, PushMessageError, addAppRoleToOwners, addCommentTool, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appNameOver, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthTokens, callsMigration, capSocketMessages, changesMigration, channelSendsMigration, checkAi, checkAuthSchema, checkCalls, checkChanges, checkChannelSends, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkRealtimeRelay, checkResourcesOutsideAuthStore, checkSourceNames, checkStatusSchema, checkUserTablesSchema, checkViewQueries, checkWebhooksSchema, coalesce, commentTools, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, countRecordsTool, createAdmin, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineEmail, defineFunction, defineJob, definePdf, defineTool, deleteRecordTool, deleteUser, describeResourceTool, deviceIdParam, deviceStore, devicesPath, enqueueJob, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listCommentsTool, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpIcons, mcpInstructions, mcpRoutes, mcpServer, mcpToolContext, mcpTools, migrationCommand, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notificationsMigration, oauthWellKnownPaths, objectKey, onDoNotDisturb, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readDefinitionsVersion, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, realtimeRelayMigration, recordOf, refusalOf, refused, relayed, reloadingAdmin, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, sqlSends, startErrorReporting, startJobs, statusMigration, statusNames, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, userTableResources, userTablesMigration, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.67.0";
+var version = "0.67.2";
 //#endregion
 export { version };

package/dist/types.d.ts

@@ -147,11 +147,12 @@ export type PageSource = {
 /**
  * The admin API, the jobs it needs a worker to run (the delivery of resource events), the pruning of the realtime
  * tables a serving process starts once it listens and stops as it closes, and the read of encrypted fields that
- * `startJobs` gives the jobs' context.
+ * `startJobs` gives the jobs' context, and the path it answers `/meta` at.
  */
 export type Admin = Hono<AdminEnv> & {
   jobs: JobDefinition[];
   startRealtimePrune: () => RealtimePrune;
   decryptField: FieldDecrypter;
+  metaPath: string;
 };
 //#endregion

package/dist/user-tables/check-definition.d.ts

@@ -0,0 +1,12 @@
+import { DefinitionFieldType } from "./names.js";
+import { StoredDefinition, StoredField } from "./read-definitions.js";
+//#region src/user-tables/check-definition.d.ts
+/** A field of a definition that passed `checkDefinition`: its name is a safe identifier and its type one of the eight. */
+export type CheckedField = Omit<StoredField, 'type'> & {
+  type: DefinitionFieldType;
+};
+/** A definition that passed `checkDefinition`, which a resource is built from. */
+export type CheckedDefinition = Omit<StoredDefinition, 'fields'> & {
+  fields: CheckedField[];
+};
+//#endregion

package/dist/user-tables/check-definition.js

@@ -0,0 +1,42 @@
+import { definitionColumnTypes, definitionFieldTypes, isUserTableName, userTablesSchema } from "./names.js";
+//#region src/user-tables/check-definition.ts
+const reservedFields = ["id", "etag"];
+const isFieldType = (type) => definitionFieldTypes.includes(type);
+const fieldProblem = (field, columns) => {
+	if (!isUserTableName(field.name)) return `the field name ${JSON.stringify(field.name)} is not lowercase letters, digits and "_", starting with a letter, at most 63 bytes`;
+	if (reservedFields.includes(field.name)) return `the field name "${field.name}" is reserved`;
+	if (!isFieldType(field.type)) return `the field "${field.name}" has the type ${JSON.stringify(field.type)}, which is not one of ${definitionFieldTypes.join(", ")}`;
+	if (field.type === "decimal" && (field.precision === null || field.scale === null)) return `the decimal field "${field.name}" has no precision and scale`;
+	const column = columns.get(field.name);
+	if (!column) return `the column "${field.name}" does not exist`;
+	if (!definitionColumnTypes[field.type].includes(column.type)) return `the column "${field.name}" is ${column.type}, not what a ${field.type} field needs (${definitionColumnTypes[field.type].join(" or ")})`;
+	if (!field.required && column.notNull) return `the optional field "${field.name}" has a NOT NULL column`;
+};
+/**
+* The definition checked against the user tables schema, or the first thing wrong with it: every name a safe
+* identifier, every type one of the eight, its table there with an `id bigint` primary key and a column of the right
+* type for each field, and its title a text field of it.
+*/
+const checkDefinition = (definition, tables) => {
+	const problem = (text) => ({ problem: `The user table ${JSON.stringify(definition.name)} is not served: ${text}.` });
+	if (!isUserTableName(definition.name)) return problem("its name is not lowercase letters, digits and \"_\", starting with a letter, at most 63 bytes");
+	const columns = tables.get(definition.name);
+	if (!columns) return problem(`the table ${userTablesSchema}.${definition.name} does not exist`);
+	const id = columns.get("id");
+	if (!id || id.type !== "bigint" || !id.key) return problem(`${userTablesSchema}.${definition.name} has no "id" bigint primary key`);
+	const seen = /* @__PURE__ */ new Set();
+	for (const field of definition.fields) {
+		if (seen.has(field.name)) return problem(`the field "${field.name}" is defined twice`);
+		seen.add(field.name);
+		const found = fieldProblem(field, columns);
+		if (found) return problem(found);
+	}
+	const title = definition.fields.find((field) => field.name === definition.title_field);
+	if (definition.title_field !== null && (!title || title.type !== "text" && title.type !== "long_text")) return problem(`its title "${definition.title_field}" is not one of its text fields`);
+	return { definition: {
+		...definition,
+		fields: definition.fields
+	} };
+};
+//#endregion
+export { checkDefinition };

package/dist/user-tables/definition-resource.d.ts

@@ -0,0 +1,12 @@
+import { CheckedDefinition } from "./check-definition.js";
+import { TableIndexes } from "@protobase/query";
+//#region src/user-tables/definition-resource.d.ts
+/**
+ * The resource and view of a checked definition over `user_tables.<name>`, with the indexes its table has (none before
+ * they are read): built with the schema builders, so it is checked, accessed and guarded as a resource of the config.
+ */
+export declare const definitionResource: (definition: CheckedDefinition, indexes?: TableIndexes) => {
+  resource: import("@protobase/schema").ResourceBuilder<any, import("@protobase/schema").Ref<string, unknown>>;
+  view: import("@protobase/schema").ViewBuilder<import("@protobase/schema").ResourceBuilder<any, import("@protobase/schema").Ref<string, unknown>>>;
+};
+//#endregion

package/dist/user-tables/definition-resource.js

@@ -0,0 +1,62 @@
+import { userTablesSchema } from "./names.js";
+import { f, resource, view } from "@protobase/schema";
+import { indexServes } from "@protobase/query";
+//#region src/user-tables/definition-resource.ts
+const admins = ({ user }) => user?.roles?.includes("admin") ?? false;
+const builders = {
+	text: () => f.text(),
+	long_text: () => f.text(),
+	integer: () => f.integer(),
+	decimal: (field) => f.decimal({
+		precision: field.precision,
+		scale: field.scale
+	}),
+	boolean: () => f.boolean(),
+	date: () => f.date(),
+	timestamp: () => f.timestamp(),
+	json: () => f.json()
+};
+const served = (indexes, column, need) => indexes.indexes.some((index) => indexServes(index, column, need, /* @__PURE__ */ new Set()));
+const isText = (field) => field.type === "text" || field.type === "long_text";
+const fieldOf = (field, indexes) => {
+	const built = builders[field.type](field);
+	const optional = field.required ? built : built.optional();
+	if (field.type === "json") return optional;
+	const sortable = served(indexes, field.name, "btree");
+	const filtered = sortable || isText(field) && served(indexes, field.name, "trigram") ? optional.filterable() : optional;
+	return sortable ? filtered.sortable() : filtered;
+};
+/**
+* The resource and view of a checked definition over `user_tables.<name>`, with the indexes its table has (none before
+* they are read): built with the schema builders, so it is checked, accessed and guarded as a resource of the config.
+*/
+const definitionResource = (definition, indexes = {
+	kind: "table",
+	indexes: []
+}) => {
+	const key = f.bigint().readOnly().dbDefault();
+	const keyed = served(indexes, "id", "btree") ? key.filterable().sortable() : key;
+	const fields = Object.fromEntries([["id", keyed], ...definition.fields.map((field) => [field.name, fieldOf(field, indexes)])]);
+	const title = definition.fields.find((field) => field.name === definition.title_field);
+	const base = resource(definition.name).table(`${userTablesSchema}.${definition.name}`).fields(fields).primaryKey((r) => r.id).explicitGrants().access({
+		list: admins,
+		read: admins,
+		create: admins,
+		update: admins,
+		delete: admins
+	});
+	const searchable = title && served(indexes, title.name, "trigram") ? base.search((r) => [r[title.name]]) : base;
+	const labelled = view(definition.name).names({
+		singular: definition.singular_label,
+		plural: definition.plural_label
+	}).fields((r) => Object.fromEntries(definition.fields.map((field) => {
+		const labelledField = r[field.name].label(field.label);
+		return [field.name, field.type === "long_text" ? labelledField.multiline() : labelledField];
+	})));
+	return {
+		resource: searchable,
+		view: title ? labelled.title((r) => r[title.name]) : labelled
+	};
+};
+//#endregion
+export { definitionResource };

package/dist/user-tables/definitions-version.d.ts

@@ -0,0 +1,10 @@
+import { Db } from "@protobase/query";
+//#region src/user-tables/definitions-version.d.ts
+/**
+ * The version of the stored definitions as a whole, from their rows alone: how many there are, the highest id and the
+ * sum of their versions. Adding one raises the highest id, which an identity never gives again, removing one lowers the
+ * count, and changing one raises its version, so each change moves it, as long as every change of a definition or its
+ * fields raises the definition's version. One read of `tables`, which holds a row per table users add.
+ */
+export declare const readDefinitionsVersion: (db: Db) => Promise<string>;
+//#endregion

package/dist/user-tables/definitions-version.js

@@ -0,0 +1,16 @@
+import { definitionsSchema } from "./names.js";
+import { sql } from "kysely";
+//#region src/user-tables/definitions-version.ts
+/**
+* The version of the stored definitions as a whole, from their rows alone: how many there are, the highest id and the
+* sum of their versions. Adding one raises the highest id, which an identity never gives again, removing one lowers the
+* count, and changing one raises its version, so each change moves it, as long as every change of a definition or its
+* fields raises the definition's version. One read of `tables`, which holds a row per table users add.
+*/
+const readDefinitionsVersion = async (db) => {
+	const { rows } = await sql`select count(*) || ':' || coalesce(max(id), 0) || ':' || coalesce(sum(version), 0) as version
+    from ${sql.table(`${definitionsSchema}.tables`)}`.execute(db);
+	return rows[0].version;
+};
+//#endregion
+export { readDefinitionsVersion };

package/dist/user-tables/latest-admin.js

@@ -0,0 +1,47 @@
+//#region src/user-tables/latest-admin.ts
+/** How long a read of the definitions version holds before a request reads it again, in milliseconds. */
+const versionCheckMs = 1e3;
+/**
+* The latest admin built, the only one kept: a cache of one entry, swapped for one built anew when the definitions
+* version moved. `get(true)` reads the version at once, `get()` at most once a `versionCheckMs`; either waits for a read
+* or rebuild already running instead of starting another, so two requests never build twice. A request keeps the admin
+* it got until it is answered.
+*/
+const latestAdmin = ({ admin, version, readVersion, rebuild, now = Date.now }) => {
+	let latest = {
+		admin,
+		version,
+		checkedAt: now()
+	};
+	let checking;
+	const check = async () => {
+		const checkedAt = now();
+		const read = await readVersion();
+		if (read === latest.version) {
+			latest = {
+				...latest,
+				checkedAt
+			};
+			return latest.admin;
+		}
+		latest = {
+			admin: await rebuild(latest.admin),
+			version: read,
+			checkedAt
+		};
+		return latest.admin;
+	};
+	const get = (atOnce = false) => {
+		if (!atOnce && now() - latest.checkedAt < 1e3) return Promise.resolve(latest.admin);
+		checking ??= check().finally(() => {
+			checking = void 0;
+		});
+		return checking;
+	};
+	return {
+		get,
+		current: () => latest.admin
+	};
+};
+//#endregion
+export { latestAdmin, versionCheckMs };

package/dist/user-tables/names.d.ts

@@ -0,0 +1,18 @@
+//#region src/user-tables/names.d.ts
+/** The schema the definitions of the tables users add live in: `tables`, and `fields` of each. */
+export declare const definitionsSchema = "table_definitions";
+/** The schema the tables users add live in, apart from their definitions, so no name of one reaches a definitions table. */
+export declare const userTablesSchema = "user_tables";
+/** The field types a definition may give, each with the Postgres types its column may have. */
+export declare const definitionColumnTypes: {
+  readonly text: readonly ["text"];
+  readonly long_text: readonly ["text"];
+  readonly integer: readonly ["integer"];
+  readonly decimal: readonly ["numeric"];
+  readonly boolean: readonly ["boolean"];
+  readonly date: readonly ["date"];
+  readonly timestamp: readonly ["timestamp with time zone"];
+  readonly json: readonly ["jsonb"];
+};
+export type DefinitionFieldType = keyof typeof definitionColumnTypes;
+//#endregion

package/dist/user-tables/names.js

@@ -0,0 +1,22 @@
+//#region src/user-tables/names.ts
+/** The schema the definitions of the tables users add live in: `tables`, and `fields` of each. */
+const definitionsSchema = "table_definitions";
+/** The schema the tables users add live in, apart from their definitions, so no name of one reaches a definitions table. */
+const userTablesSchema = "user_tables";
+/** What a name of a user table or field must be: it reaches SQL as an identifier, always quoted too. */
+const userTableName = /^[a-z][a-z0-9_]*$/;
+/** The field types a definition may give, each with the Postgres types its column may have. */
+const definitionColumnTypes = {
+	text: ["text"],
+	long_text: ["text"],
+	integer: ["integer"],
+	decimal: ["numeric"],
+	boolean: ["boolean"],
+	date: ["date"],
+	timestamp: ["timestamp with time zone"],
+	json: ["jsonb"]
+};
+const definitionFieldTypes = Object.keys(definitionColumnTypes);
+const isUserTableName = (name) => userTableName.test(name) && new TextEncoder().encode(name).length <= 63;
+//#endregion
+export { definitionColumnTypes, definitionFieldTypes, definitionsSchema, isUserTableName, userTableName, userTablesSchema };

package/dist/user-tables/read-definitions.d.ts

@@ -0,0 +1,22 @@
+import { Db } from "@protobase/query";
+//#region src/user-tables/read-definitions.d.ts
+/** A field of a stored definition, as its row holds it: nothing in it is trusted before `checkDefinition`. */
+export type StoredField = {
+  name: string;
+  label: string;
+  type: string;
+  required: boolean;
+  precision: number | null;
+  scale: number | null;
+};
+/** A stored definition of a table users add, as its rows hold it, with its fields in order. */
+export type StoredDefinition = {
+  id: string;
+  name: string;
+  singular_label: string;
+  plural_label: string;
+  title_field: string | null;
+  version: string;
+  fields: StoredField[];
+};
+//#endregion

package/dist/user-tables/read-definitions.js

@@ -0,0 +1,33 @@
+import { definitionsSchema, userTablesSchema } from "./names.js";
+import { sql } from "kysely";
+//#region src/user-tables/read-definitions.ts
+/** The stored definitions, by id, each with its fields by position. */
+const readDefinitions = async (db) => {
+	const { rows } = await sql`select t.id::text as id, t.name, t.singular_label, t.plural_label, t.title_field, t.version::text as version,
+      coalesce((select json_agg(json_build_object('name', f.name, 'label', f.label, 'type', f.type, 'required', f.required, 'precision', f.precision, 'scale', f.scale) order by f.position, f.name)
+        from ${sql.table(`${definitionsSchema}.fields`)} f where f.table_id = t.id), '[]') as fields
+    from ${sql.table(`${definitionsSchema}.tables`)} t order by t.id`.execute(db);
+	return rows;
+};
+/** The columns of the tables of the user tables schema, from the catalogue. */
+const readUserTableColumns = async (db) => {
+	const { rows } = await sql`select c.relname::text as table, a.attname::text as column,
+      format_type(a.atttypid, null) as type, a.attnotnull as not_null,
+      exists (select from pg_index i where i.indrelid = c.oid and i.indisprimary and i.indnatts = 1 and i.indkey[0] = a.attnum) as key
+    from pg_class c join pg_namespace n on n.oid = c.relnamespace join pg_attribute a on a.attrelid = c.oid
+    where n.nspname = ${userTablesSchema} and c.relkind in ('r', 'p') and a.attnum > 0 and not a.attisdropped
+    order by c.relname, a.attnum`.execute(db);
+	const tables = /* @__PURE__ */ new Map();
+	for (const row of rows) {
+		const columns = tables.get(row.table) ?? /* @__PURE__ */ new Map();
+		columns.set(row.column, {
+			type: row.type,
+			notNull: row.not_null,
+			key: row.key
+		});
+		tables.set(row.table, columns);
+	}
+	return tables;
+};
+//#endregion
+export { readDefinitions, readUserTableColumns };

package/dist/user-tables/reloading-admin.d.ts

@@ -0,0 +1,40 @@
+import { FieldDecrypter } from "../encryption/decrypt-field-types.js";
+import { JobDefinition } from "../jobs/job-types.js";
+import { RealtimePrune } from "../realtime/realtime-prune.js";
+import { Admin, AdminEnv } from "../types.js";
+import { UserTables } from "./user-table-resources.js";
+import "../index.js";
+import { Hono } from "hono";
+//#region src/user-tables/reloading-admin.d.ts
+export type ReloadingAdminInput = {
+  /** The admin startup built, from the user tables of `version`. */
+  first: Admin;
+  version: string;
+  /** The definitions version now (`readDefinitionsVersion`). */
+  readVersion: () => Promise<string>;
+  /** The user tables now (`userTableResources`). */
+  readTables: () => Promise<UserTables>;
+  /** The admin of the app with these user tables, as startup built `first`. */
+  build: (tables: UserTables) => Admin;
+  /** The app's `onUnhandledError`: a failed version read, and an admin that does not build. */
+  report?: (error: unknown, request?: Request) => void;
+  statementTimeoutMs?: number;
+  now?: () => number;
+};
+/**
+ * The app's admin, rebuilt when the tables users add change, so every process serves a new definition without a
+ * restart. `/meta` reads the definitions version first; any other request at most once a second, and once more when the
+ * admin answers it not found or invalid, as it does a resource or field it does not know, and then is answered again by
+ * the admin built anew. A request finishes on the admin it started with, and a WebSocket keeps the admin it opened
+ * with. An admin that does not build with the new definitions is reported, and the one before keeps serving.
+ * `reload()` reads the version at once, for the process that changed a definition. The jobs, the realtime prune and
+ * the field decrypter are those of `first`.
+ */
+export declare const reloadingAdmin: ({ first, version, readVersion, readTables, build, report, statementTimeoutMs, now }: ReloadingAdminInput) => Hono<AdminEnv, import("hono/types").BlankSchema, "/"> & {
+  jobs: JobDefinition[];
+  startRealtimePrune: () => RealtimePrune;
+  decryptField: FieldDecrypter;
+  metaPath: string;
+  reload: () => Promise<undefined>;
+};
+//#endregion

package/dist/user-tables/reloading-admin.js

@@ -0,0 +1,63 @@
+import { createErrorHandler } from "../error-handler.js";
+import { latestAdmin } from "./latest-admin.js";
+import { Hono } from "hono";
+//#region src/user-tables/reloading-admin.ts
+const problemStatuses = /* @__PURE__ */ new Set([400, 404]);
+const namesUnknown = (response) => problemStatuses.has(response.status) && (response.headers.get("content-type")?.startsWith("application/problem+json") ?? false);
+const replayable = async (request) => {
+	if (!request.body) return () => request;
+	if (!request.headers.get("content-type")?.includes("json")) return;
+	const body = await request.arrayBuffer();
+	return () => new Request(request, { body });
+};
+/**
+* The app's admin, rebuilt when the tables users add change, so every process serves a new definition without a
+* restart. `/meta` reads the definitions version first; any other request at most once a second, and once more when the
+* admin answers it not found or invalid, as it does a resource or field it does not know, and then is answered again by
+* the admin built anew. A request finishes on the admin it started with, and a WebSocket keeps the admin it opened
+* with. An admin that does not build with the new definitions is reported, and the one before keeps serving.
+* `reload()` reads the version at once, for the process that changed a definition. The jobs, the realtime prune and
+* the field decrypter are those of `first`.
+*/
+const reloadingAdmin = ({ first, version, readVersion, readTables, build, report, statementTimeoutMs, now }) => {
+	const rebuild = async (current) => {
+		const tables = await readTables();
+		try {
+			return build(tables);
+		} catch (error) {
+			report?.(new Error("The tables users add changed, but the app does not build with them, so it serves the tables it served before", { cause: error }));
+			return current;
+		}
+	};
+	const latest = latestAdmin({
+		admin: first,
+		version,
+		readVersion,
+		rebuild,
+		...now && { now }
+	});
+	const answer = async (request, env) => {
+		const path = new URL(request.url).pathname;
+		const atOnce = path === first.metaPath || path.startsWith(`${first.metaPath}/`);
+		const admin = await latest.get(atOnce);
+		const again = atOnce ? void 0 : await replayable(request);
+		if (!again) return admin.fetch(request, env);
+		const answered = await admin.fetch(again(), env);
+		if (!namesUnknown(answered)) return answered;
+		const fresh = await latest.get(true);
+		return fresh === admin ? answered : fresh.fetch(again(), env);
+	};
+	const app = new Hono();
+	app.onError(createErrorHandler(report, statementTimeoutMs));
+	app.all("*", (c) => answer(c.req.raw, c.env));
+	const reload = async () => void await latest.get(true);
+	return Object.assign(app, {
+		jobs: first.jobs,
+		startRealtimePrune: first.startRealtimePrune,
+		decryptField: first.decryptField,
+		metaPath: first.metaPath,
+		reload
+	});
+};
+//#endregion
+export { reloadingAdmin };

package/dist/user-tables/schema-sql.js

@@ -0,0 +1,35 @@
+import { definitionFieldTypes, definitionsSchema, userTableName, userTablesSchema } from "./names.js";
+//#region src/user-tables/schema-sql.ts
+const nameCheck = (column) => `check (${column} ~ '${userTableName.source}' and octet_length(${column}) <= 63)`;
+/** The table of definitions: one row per table users add, its labels and a version that each change of it raises. */
+const tablesSql = () => `create table ${definitionsSchema}.tables (
+  id bigint generated always as identity primary key,
+  name text not null unique ${nameCheck("name")},
+  singular_label text not null,
+  plural_label text not null,
+  title_field text ${nameCheck("title_field")},
+  version bigint not null check (version > 0)
+)`;
+/** The fields of each definition, in order, each with its label and type; a decimal names its precision and scale. */
+const fieldsSql = () => `create table ${definitionsSchema}.fields (
+  table_id bigint not null references ${definitionsSchema}.tables (id) on delete cascade,
+  name text not null ${nameCheck("name")} check (name not in ('id', 'etag')),
+  label text not null,
+  type text not null check (type in (${definitionFieldTypes.map((type) => `'${type}'`).join(", ")})),
+  required boolean not null,
+  position integer not null,
+  precision integer check (precision between 1 and 1000),
+  scale integer check (scale between 0 and precision),
+  primary key (table_id, name),
+  check ((type = 'decimal') = (precision is not null and scale is not null))
+)`;
+const schemasSql = () => [
+	"create extension if not exists pg_trgm",
+	`create schema if not exists ${definitionsSchema}`,
+	`revoke create on schema ${definitionsSchema} from public`,
+	`create schema if not exists ${userTablesSchema}`,
+	`revoke create on schema ${userTablesSchema} from public`,
+	`grant usage, create on schema ${userTablesSchema} to current_user`
+];
+//#endregion
+export { fieldsSql, schemasSql, tablesSql };

package/dist/user-tables/schema.d.ts

@@ -0,0 +1,10 @@
+import { Db } from "@protobase/query";
+//#region src/user-tables/schema.d.ts
+/**
+ * The SQL that adds what user tables need: pg_trgm, the definitions schema with its `tables` and `fields`, and the
+ * schema the tables themselves live in. `undefined` when current. Nothing is dropped.
+ */
+export declare const userTablesMigration: (db: Db) => Promise<string | undefined>;
+/** Refuses to go on while the schemas of user tables are missing; the project's migrations add them. */
+export declare const checkUserTablesSchema: (db: Db) => Promise<void>;
+//#endregion

package/dist/user-tables/schema.js

@@ -0,0 +1,34 @@
+import { migrationCommand } from "../changes/capture-schema.js";
+import { definitionsSchema, userTablesSchema } from "./names.js";
+import { fieldsSql, schemasSql, tablesSql } from "./schema-sql.js";
+import { sql } from "kysely";
+//#region src/user-tables/schema.ts
+const readUserTablesSchema = async (db) => {
+	const { rows } = await sql`select
+    to_regclass(${`${definitionsSchema}.tables`}) is not null as tables,
+    to_regclass(${`${definitionsSchema}.fields`}) is not null as fields,
+    exists (select from pg_namespace where nspname = ${userTablesSchema}) as data,
+    exists (select from pg_extension where extname = 'pg_trgm') as trgm`.execute(db);
+	return rows[0];
+};
+/**
+* The SQL that adds what user tables need: pg_trgm, the definitions schema with its `tables` and `fields`, and the
+* schema the tables themselves live in. `undefined` when current. Nothing is dropped.
+*/
+const userTablesMigration = async (db) => {
+	const found = await readUserTablesSchema(db);
+	if (found.tables && found.fields && found.data && found.trgm) return void 0;
+	return `${[
+		...schemasSql(),
+		...found.tables ? [] : [tablesSql()],
+		...found.fields ? [] : [fieldsSql()]
+	].join(";\n\n")};`;
+};
+/** Refuses to go on while the schemas of user tables are missing; the project's migrations add them. */
+const checkUserTablesSchema = async (db) => {
+	const found = await readUserTablesSchema(db);
+	if (found.tables && found.fields && found.data && found.trgm) return;
+	throw new Error(`The ${definitionsSchema} or ${userTablesSchema} schema, or pg_trgm, is missing, and userTables keeps the tables users add there. Write it as a migration with \`${migrationCommand}\`, apply it with the project's migrations, then start again.`);
+};
+//#endregion
+export { checkUserTablesSchema, userTablesMigration };

package/dist/user-tables/served-user-tables.d.ts

@@ -0,0 +1,9 @@
+import { ViewSource } from "../types.js";
+import { ResourceSource } from "../resource-source.js";
+//#region src/user-tables/served-user-tables.d.ts
+/** The resources and views of the tables users add, as `userTableResources` builds them. */
+export type UserTableSources = {
+  resources: ResourceSource[];
+  views: ViewSource[];
+};
+//#endregion

package/dist/user-tables/served-user-tables.js

@@ -0,0 +1,30 @@
+//#region src/user-tables/served-user-tables.ts
+/**
+* The user tables a name of the app's own or a built-in resource does not take, and a warning for each one it does: a
+* resource in code of the same name wins, which is how a table taken over as code hands over. Of two with one name, the
+* first is kept.
+*/
+const servedUserTables = (tables, taken) => {
+	const names = new Set(taken);
+	const kept = {
+		resources: [],
+		views: []
+	};
+	const warnings = [];
+	for (const source of tables.resources) {
+		const { name } = source.toModel();
+		if (names.has(name)) {
+			warnings.push(`The user table "${name}" is not served: a resource of the app has its name.`);
+			continue;
+		}
+		names.add(name);
+		kept.resources.push(source);
+		kept.views.push(...tables.views.filter((view) => view.toModel().resource === name).slice(0, 1));
+	}
+	return {
+		...kept,
+		warnings
+	};
+};
+//#endregion
+export { servedUserTables };

package/dist/user-tables/user-table-resources.d.ts

@@ -0,0 +1,16 @@
+import { definitionResource } from "./definition-resource.js";
+import { Db } from "@protobase/query";
+//#region src/user-tables/user-table-resources.d.ts
+/** What the stored definitions serve: a resource and view for each that fits the database, and why each other one is left out. */
+export type UserTables = {
+  resources: Array<ReturnType<typeof definitionResource>['resource']>;
+  views: Array<ReturnType<typeof definitionResource>['view']>;
+  problems: string[];
+};
+/**
+ * The resources of the tables users add, from their definitions and the catalogue: a definition that does not fit the
+ * database is left out with a problem, so the rest of the app serves. Filters, sorts and search are claimed only where
+ * the table's indexes serve them, read as the scan guard reads them.
+ */
+export declare const userTableResources: (db: Db) => Promise<UserTables>;
+//#endregion

package/dist/user-tables/user-table-resources.js

@@ -0,0 +1,32 @@
+import { checkDefinition } from "./check-definition.js";
+import { definitionResource } from "./definition-resource.js";
+import { readDefinitions, readUserTableColumns } from "./read-definitions.js";
+import { tableIndexes } from "@protobase/query";
+//#region src/user-tables/user-table-resources.ts
+/**
+* The resources of the tables users add, from their definitions and the catalogue: a definition that does not fit the
+* database is left out with a problem, so the rest of the app serves. Filters, sorts and search are claimed only where
+* the table's indexes serve them, read as the scan guard reads them.
+*/
+const userTableResources = async (db) => {
+	const [definitions, columns] = await Promise.all([readDefinitions(db), readUserTableColumns(db)]);
+	const tables = {
+		resources: [],
+		views: [],
+		problems: []
+	};
+	for (const stored of definitions) {
+		const checked = checkDefinition(stored, columns);
+		if ("problem" in checked) {
+			tables.problems.push(checked.problem);
+			continue;
+		}
+		const indexes = await tableIndexes(db, definitionResource(checked.definition).resource.toModel());
+		const { resource, view } = definitionResource(checked.definition, indexes);
+		tables.resources.push(resource);
+		tables.views.push(view);
+	}
+	return tables;
+};
+//#endregion
+export { userTableResources };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.67.0",
+  "version": "0.67.2",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -43,9 +43,9 @@
     "@better-auth/sso": "^1.7.12",
     "@livekit/protocol": "1.53.1",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.67.0",
-    "@protobase/query": "0.67.0",
-    "@protobase/schema": "0.67.0",
+    "@protobase/layout": "0.67.2",
+    "@protobase/query": "0.67.2",
+    "@protobase/schema": "0.67.2",
     "@react-email/render": "^2.1.0",
     "@react-pdf/primitives": "^4.4.0",
     "@react-pdf/renderer": "^4.9.0",