@protobase/server 0.67.1 → 0.67.3

package/dist/config-exports.js

@@ -1,6 +1,6 @@
 import { builtInResources } from "./built-in-resources.js";
-import { configExports } from "./resource-source.js";
 import { definitionsSchema, userTablesSchema } from "./user-tables/names.js";
+import { configExports } from "./resource-source.js";
 import { userTableResources } from "./user-tables/user-table-resources.js";
 import { webhooksModule } from "./webhooks/table/webhooks-module.js";
 export { builtInResources, configExports, definitionsSchema, userTableResources, userTablesSchema, webhooksModule };

package/dist/create-admin.js

@@ -112,7 +112,7 @@ import { recordRoutes } from "./routes/record.js";
 import { firstAdminUrl } from "./better-auth/first-admin-url.js";
 import { createScanGuard } from "./scan-guard.js";
 import { builtInResources } from "./built-in-resources.js";
-import { servedUserTables } from "./user-tables/served-user-tables.js";
+import { adminUserTables } from "./user-tables/admin-user-tables.js";
 import { Hono } from "hono";
 import { accountPage, accountPageName, checkPages, settingsResources, withSettingsFields } from "@protobase/layout";
 import { guestCallsPath, ringsPath, statusPath } from "@protobase/schema/internal";
@@ -137,10 +137,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], userTables
 		notifications: notifications !== void 0,
 		...events && { events }
 	});
-	const served = servedUserTables(userTables ?? {
-		resources: [],
-		views: []
-	}, [...appModels, ...builtIn.resources.map((resource) => resource.toModel())].map((model) => model.name));
+	const served = adminUserTables(userTables, [...appModels, ...builtIn.resources.map((resource) => resource.toModel())].map((model) => model.name), options.roles !== void 0);
 	for (const warning of served.warnings) console.warn(warning);
 	const resources = [
 		...appResources,
@@ -241,6 +238,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], userTables
 		guard: createScanGuard(db, options.scanGuard),
 		hooks: [
 			...options.writeHooks ?? [],
+			...served.hooks,
 			...table ? [subscriptionWriteCheck(registry.entries.map((entry) => entry.model))] : [],
 			...fill ? [fillHook(() => deps, fill)] : []
 		],
@@ -565,6 +563,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], userTables
 	return Object.assign(app, {
 		startRealtimePrune: prune,
 		decryptField,
+		metaPath: `${deps.systemPath}/meta`,
 		jobs: [
 			...webhooks.jobs,
 			...withHistory && days !== void 0 ? [pruneHistoryJob(changes, days)] : [],

package/dist/index.d.ts

@@ -103,6 +103,8 @@ import { newWebhookSecret } from "./webhooks/standard-webhooks.js";
 import { checkWebhooksSchema, webhooksMigration } from "./webhooks/table/schema.js";
 import { checkUserTablesSchema, userTablesMigration } from "./user-tables/schema.js";
 import { UserTables, userTableResources } from "./user-tables/user-table-resources.js";
+import { readDefinitionsVersion } from "./user-tables/definitions-version.js";
+import { reloadingAdmin } from "./user-tables/reloading-admin.js";
 import { checkRealtimeRelay, realtimeRelayMigration } from "./realtime/relay/relay-schema.js";
 import { channelSendsMigration, checkChannelSends } from "./channels/sends-schema.js";
 import { checkComments, commentsMigration } from "./comments/comments-sql.js";
@@ -186,4 +188,4 @@ import { DrainResult, JobsRuntime, StartJobsOptions, startJobs } from "./jobs/ru
 import { jobsDrainApp } from "./jobs/drain-route.js";
 import { checkJobsSchema, jobsSchema, jobsSchemaMigration } from "./jobs/schema.js";
 import { AdminAuth, CreateAuthOptions, UserCreatedHook, normalizeRoles } from "./better-auth/create-auth.js";
-export { type Admin, type AdminAuth, type AdminOptions, type AggregateParams, type ApiFunction, type ApiKeys, type ApiKeysOptions, type ApnsEnvironment, type AppIcons, type AppIdentity, type AppPoolConfig, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type ArgumentsPayload, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type AuthHooks, type AuthSettings, type AuthenticateSettings, type Authenticator, type BaseToolContext, type BatchOperation, type BatchResult, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type CallBackend, type CallMember, type Caller, type CallerOptions, type CallsAccess, type CallsOptions, type CapturedRow, type CascadingKey, type ChannelBroadcast, type ChannelSender, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentToolsInput, type CommentUsers, type Completion, type CompletionOptions, ConnectionsBusy, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DecryptField, type Device, type DeviceColumn, type DeviceKind, type DeviceStore, DeviceStoreError, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueJob, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldDecrypter, type FieldReader, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileProviderSettings, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryColumn, type HistoryOptions, type HistoryPosition, type HistoryStore, HistoryStoreError, type HookContext, HttpProblem, type IssueTokenOptions, type JobContext, type JobDeclaration, type JobDefinition, type JobName, type JobOptions, type JobPayload, type JobRun, type JobsRuntime, type JsonObject, type JsonValue, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LiveKitBackend, type LocalFilesOptions, type MailAttachment, type MailMessage, MailServerTimeoutError, type Mailer, type MapLayer, type MapOptions, type MapSettings, type McpApprovals, type McpGateInput, type McpHandlerInput, type McpRoutesInput, type McpServerInput, type McpToolsInput, type McpWrites, type MemberInput, type Membership, MissingCredentials, type MobileConfig, ModelError, type ModelSettings, type NewDevice, type NewNotification, type NewOrganization, type NewUser, type NotificationRecipients, NotificationSendError, type NotificationsOptions, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PdfComponent, type PdfOptions, type PdfTemplate, PersonalMailError, type PersonalMailErrorCode, type PersonalMailProviderId, type PgModule, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type PushAnswer, type PushMessage, PushMessageError, type PushSender, type QueryOptions, type QueryResult, type ReadableResources, type RealtimeOptions, type RealtimePrune, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordGroups, type RecordKey, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type SendNotification, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StatusOptions, type StoreFileInput, type StoredMember, type StoredNotification, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolAnnotations, type ToolCall, type ToolComment, type ToolCommentPage, type ToolComments, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type Urgency, type User, type UserCreatedHook, type UserTables, type VapidSettings, type ViewSource, type WebPushFields, type WebPushOptions, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, type WriteRecordToolsInput, addAppRoleToOwners, addCommentTool, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appNameOver, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthTokens, callsMigration, capSocketMessages, changesMigration, channelSendsMigration, checkAi, checkAuthSchema, checkCalls, checkChanges, checkChannelSends, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkRealtimeRelay, checkResourcesOutsideAuthStore, checkSourceNames, checkStatusSchema, checkUserTablesSchema, checkViewQueries, checkWebhooksSchema, coalesce, commentTools, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, countRecordsTool, createAdmin, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineEmail, defineFunction, defineJob, definePdf, defineTool, deleteRecordTool, deleteUser, describeResourceTool, deviceIdParam, deviceStore, devicesPath, enqueueJob, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listCommentsTool, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpIcons, mcpInstructions, mcpRoutes, mcpServer, mcpToolContext, mcpTools, migrationCommand, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notificationsMigration, oauthWellKnownPaths, objectKey, onDoNotDisturb, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, realtimeRelayMigration, recordOf, refusalOf, refused, relayed, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, sqlSends, startErrorReporting, startJobs, statusMigration, statusNames, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, userTableResources, userTablesMigration, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };
+export { type Admin, type AdminAuth, type AdminOptions, type AggregateParams, type ApiFunction, type ApiKeys, type ApiKeysOptions, type ApnsEnvironment, type AppIcons, type AppIdentity, type AppPoolConfig, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type ArgumentsPayload, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type AuthHooks, type AuthSettings, type AuthenticateSettings, type Authenticator, type BaseToolContext, type BatchOperation, type BatchResult, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type CallBackend, type CallMember, type Caller, type CallerOptions, type CallsAccess, type CallsOptions, type CapturedRow, type CascadingKey, type ChannelBroadcast, type ChannelSender, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentToolsInput, type CommentUsers, type Completion, type CompletionOptions, ConnectionsBusy, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DecryptField, type Device, type DeviceColumn, type DeviceKind, type DeviceStore, DeviceStoreError, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueJob, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldDecrypter, type FieldReader, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileProviderSettings, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryColumn, type HistoryOptions, type HistoryPosition, type HistoryStore, HistoryStoreError, type HookContext, HttpProblem, type IssueTokenOptions, type JobContext, type JobDeclaration, type JobDefinition, type JobName, type JobOptions, type JobPayload, type JobRun, type JobsRuntime, type JsonObject, type JsonValue, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LiveKitBackend, type LocalFilesOptions, type MailAttachment, type MailMessage, MailServerTimeoutError, type Mailer, type MapLayer, type MapOptions, type MapSettings, type McpApprovals, type McpGateInput, type McpHandlerInput, type McpRoutesInput, type McpServerInput, type McpToolsInput, type McpWrites, type MemberInput, type Membership, MissingCredentials, type MobileConfig, ModelError, type ModelSettings, type NewDevice, type NewNotification, type NewOrganization, type NewUser, type NotificationRecipients, NotificationSendError, type NotificationsOptions, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PdfComponent, type PdfOptions, type PdfTemplate, PersonalMailError, type PersonalMailErrorCode, type PersonalMailProviderId, type PgModule, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type PushAnswer, type PushMessage, PushMessageError, type PushSender, type QueryOptions, type QueryResult, type ReadableResources, type RealtimeOptions, type RealtimePrune, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordGroups, type RecordKey, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type SendNotification, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StatusOptions, type StoreFileInput, type StoredMember, type StoredNotification, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolAnnotations, type ToolCall, type ToolComment, type ToolCommentPage, type ToolComments, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type Urgency, type User, type UserCreatedHook, type UserTables, type VapidSettings, type ViewSource, type WebPushFields, type WebPushOptions, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, type WriteRecordToolsInput, addAppRoleToOwners, addCommentTool, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appNameOver, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthTokens, callsMigration, capSocketMessages, changesMigration, channelSendsMigration, checkAi, checkAuthSchema, checkCalls, checkChanges, checkChannelSends, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkRealtimeRelay, checkResourcesOutsideAuthStore, checkSourceNames, checkStatusSchema, checkUserTablesSchema, checkViewQueries, checkWebhooksSchema, coalesce, commentTools, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, countRecordsTool, createAdmin, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineEmail, defineFunction, defineJob, definePdf, defineTool, deleteRecordTool, deleteUser, describeResourceTool, deviceIdParam, deviceStore, devicesPath, enqueueJob, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listCommentsTool, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpIcons, mcpInstructions, mcpRoutes, mcpServer, mcpToolContext, mcpTools, migrationCommand, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notificationsMigration, oauthWellKnownPaths, objectKey, onDoNotDisturb, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readDefinitionsVersion, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, realtimeRelayMigration, recordOf, refusalOf, refused, relayed, reloadingAdmin, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, sqlSends, startErrorReporting, startJobs, statusMigration, statusNames, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, userTableResources, userTablesMigration, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };

package/dist/index.js

@@ -115,6 +115,8 @@ import { checkComputed, computedMigration } from "./computed/computed-schema.js"
 import { checkWebhooksSchema, webhooksMigration } from "./webhooks/table/schema.js";
 import { checkUserTablesSchema, userTablesMigration } from "./user-tables/schema.js";
 import { userTableResources } from "./user-tables/user-table-resources.js";
+import { readDefinitionsVersion } from "./user-tables/definitions-version.js";
+import { reloadingAdmin } from "./user-tables/reloading-admin.js";
 import { checkRealtimeRelay, realtimeRelayMigration } from "./realtime/relay/relay-schema.js";
 import { channelSendsMigration, checkChannelSends } from "./channels/sends-schema.js";
 import { callsMigration, checkCalls } from "./calls/calls-sql.js";
@@ -137,4 +139,4 @@ import { defineEmail } from "./mail/define-email.js";
 import { definePdf } from "./pdf/define-pdf.js";
 import { startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
-export { ConnectionsBusy, DeviceStoreError, FatalJobError, HistoryStoreError, HttpProblem, MailServerTimeoutError, MissingCredentials, ModelError, NotificationSendError, PersonalMailError, PushMessageError, addAppRoleToOwners, addCommentTool, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appNameOver, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthTokens, callsMigration, capSocketMessages, changesMigration, channelSendsMigration, checkAi, checkAuthSchema, checkCalls, checkChanges, checkChannelSends, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkRealtimeRelay, checkResourcesOutsideAuthStore, checkSourceNames, checkStatusSchema, checkUserTablesSchema, checkViewQueries, checkWebhooksSchema, coalesce, commentTools, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, countRecordsTool, createAdmin, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineEmail, defineFunction, defineJob, definePdf, defineTool, deleteRecordTool, deleteUser, describeResourceTool, deviceIdParam, deviceStore, devicesPath, enqueueJob, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listCommentsTool, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpIcons, mcpInstructions, mcpRoutes, mcpServer, mcpToolContext, mcpTools, migrationCommand, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notificationsMigration, oauthWellKnownPaths, objectKey, onDoNotDisturb, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, realtimeRelayMigration, recordOf, refusalOf, refused, relayed, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, sqlSends, startErrorReporting, startJobs, statusMigration, statusNames, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, userTableResources, userTablesMigration, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };
+export { ConnectionsBusy, DeviceStoreError, FatalJobError, HistoryStoreError, HttpProblem, MailServerTimeoutError, MissingCredentials, ModelError, NotificationSendError, PersonalMailError, PushMessageError, addAppRoleToOwners, addCommentTool, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appNameOver, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthTokens, callsMigration, capSocketMessages, changesMigration, channelSendsMigration, checkAi, checkAuthSchema, checkCalls, checkChanges, checkChannelSends, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkRealtimeRelay, checkResourcesOutsideAuthStore, checkSourceNames, checkStatusSchema, checkUserTablesSchema, checkViewQueries, checkWebhooksSchema, coalesce, commentTools, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, countRecordsTool, createAdmin, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineEmail, defineFunction, defineJob, definePdf, defineTool, deleteRecordTool, deleteUser, describeResourceTool, deviceIdParam, deviceStore, devicesPath, enqueueJob, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listCommentsTool, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpIcons, mcpInstructions, mcpRoutes, mcpServer, mcpToolContext, mcpTools, migrationCommand, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notificationsMigration, oauthWellKnownPaths, objectKey, onDoNotDisturb, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readDefinitionsVersion, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, realtimeRelayMigration, recordOf, refusalOf, refused, relayed, reloadingAdmin, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, sqlSends, startErrorReporting, startJobs, statusMigration, statusNames, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, userTableResources, userTablesMigration, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.67.1";
+var version = "0.67.3";
 //#endregion
 export { version };

package/dist/types.d.ts

@@ -147,11 +147,12 @@ export type PageSource = {
 /**
  * The admin API, the jobs it needs a worker to run (the delivery of resource events), the pruning of the realtime
  * tables a serving process starts once it listens and stops as it closes, and the read of encrypted fields that
- * `startJobs` gives the jobs' context.
+ * `startJobs` gives the jobs' context, and the path it answers `/meta` at.
  */
 export type Admin = Hono<AdminEnv> & {
   jobs: JobDefinition[];
   startRealtimePrune: () => RealtimePrune;
   decryptField: FieldDecrypter;
+  metaPath: string;
 };
 //#endregion

package/dist/user-tables/admin-user-tables.js

@@ -0,0 +1,38 @@
+import { definitionsResources, fieldsResourceName, tablesResourceName } from "./definitions-resources.js";
+import { definitionsHook } from "./definitions-hook.js";
+import { servedUserTables } from "./served-user-tables.js";
+//#region src/user-tables/admin-user-tables.ts
+/**
+* What the tables users add bring to the admin, with `userTables` on: the resources over their definitions, through
+* which they are created, each user table a name in code (`codeNames`, the app's and Protobase's) does not take, and the
+* hook that creates their tables and columns. Without `tables`, nothing.
+*/
+const adminUserTables = (tables, codeNames, roles) => {
+	if (!tables) return {
+		resources: [],
+		views: [],
+		hooks: [],
+		warnings: []
+	};
+	const definitions = definitionsResources({
+		roles,
+		taken: codeNames
+	});
+	const served = servedUserTables(tables, [
+		...codeNames,
+		tablesResourceName,
+		fieldsResourceName
+	]);
+	return {
+		resources: [
+			definitions.tables,
+			definitions.fields,
+			...served.resources
+		],
+		views: served.views,
+		hooks: [definitionsHook(codeNames)],
+		warnings: served.warnings
+	};
+};
+//#endregion
+export { adminUserTables };

package/dist/user-tables/definition-resource.js

@@ -4,7 +4,7 @@ import { indexServes } from "@protobase/query";
 //#region src/user-tables/definition-resource.ts
 const admins = ({ user }) => user?.roles?.includes("admin") ?? false;
 const builders = {
-	text: () => f.text(),
+	text: () => f.text().max(500),
 	long_text: () => f.text(),
 	integer: () => f.integer(),
 	decimal: (field) => f.decimal({

package/dist/user-tables/definitions-hook.js

@@ -0,0 +1,80 @@
+import { badRequest } from "../problem.js";
+import { definitionsSchema, userTablesSchema } from "./names.js";
+import { checkDefinition } from "./check-definition.js";
+import { definitionResource } from "./definition-resource.js";
+import "./definitions-resources.js";
+import { readDefinitions, readUserTableColumns } from "./read-definitions.js";
+import { createTableSql, fieldSql, trigramIndexSql } from "./table-ddl.js";
+import { indexServes, tableIndexes } from "@protobase/query";
+import { sql } from "kysely";
+//#region src/user-tables/definitions-hook.ts
+const refuse = (field, message) => badRequest("invalid-record", `The request body is invalid: ${field}: ${message}`, { errors: [{
+	field,
+	code: "invalid-value",
+	message
+}] });
+const tablesTable = sql.table(`${definitionsSchema}.tables`);
+const raiseVersion = (trx, tableId) => sql`update ${tablesTable} set version = version + 1 where id = ${tableId}`.execute(trx);
+const lockedTable = async (trx, tableId) => {
+	const { rows } = await sql`select name, title_field from ${tablesTable} where id = ${tableId} for update`.execute(trx);
+	return rows[0];
+};
+const builtDefinition = async (trx, tableId) => {
+	const [definitions, columns] = await Promise.all([readDefinitions(trx), readUserTableColumns(trx)]);
+	const stored = definitions.find((definition) => definition.id === String(tableId));
+	const checked = checkDefinition(stored, columns);
+	if ("problem" in checked) throw new Error(`A definition the API wrote does not check: ${checked.problem}`);
+	const indexes = await tableIndexes(trx, definitionResource(checked.definition).resource.toModel());
+	definitionResource(checked.definition, indexes);
+	return {
+		definition: checked.definition,
+		indexes
+	};
+};
+const createTable = async (trx, table) => {
+	if (table.title_field != null) throw refuse("title_field", "Set the title field once its field is added");
+	const { rows } = await sql`select to_regclass(format('%I.%I', ${userTablesSchema}::text, ${table.name}::text)) is not null as found`.execute(trx);
+	if (rows[0].found) throw refuse("name", `The database already has a table "${table.name}" for the tables users add`);
+	await createTableSql(table.name).execute(trx);
+	await builtDefinition(trx, table.id);
+};
+const addField = async (trx, field, taken) => {
+	const table = await lockedTable(trx, field.table_id);
+	if (taken.includes(table.name)) throw refuse("table_id", `"${table.name}" is a resource in the app's code now, which owns its fields`);
+	const { rows } = await sql`select exists (select from pg_attribute a join pg_class c on c.oid = a.attrelid join pg_namespace n on n.oid = c.relnamespace
+    where n.nspname = ${userTablesSchema} and c.relname = ${table.name} and a.attname = ${field.name} and a.attnum > 0 and not a.attisdropped) as found`.execute(trx);
+	if (rows[0].found) throw refuse("name", `The table already has a column "${field.name}"`);
+	for (const statement of fieldSql(table.name, field)) await statement.execute(trx);
+	await raiseVersion(trx, field.table_id);
+	await builtDefinition(trx, field.table_id);
+};
+const setTitle = async (trx, table) => {
+	const title = table.title_field;
+	const { rows } = await sql`select type from ${sql.table(`${definitionsSchema}.fields`)} where table_id = ${table.id} and name = ${title}`.execute(trx);
+	if (rows[0]?.type !== "text" && rows[0]?.type !== "long_text") throw refuse("title_field", `"${title}" is not a text field of this table`);
+	const { definition, indexes } = await builtDefinition(trx, table.id);
+	if (indexes.indexes.some((index) => indexServes(index, title, "trigram", /* @__PURE__ */ new Set()))) return;
+	await trigramIndexSql(definition.name, title).execute(trx);
+};
+/**
+* Creates in the database what a write of a definition describes, inside its transaction, from the rows as written: a
+* new table, a new field's column and index, the title's search index. Changing a field raises its table's version, so
+* every process serves the change; any update of a table, a label or its title, raises it already, as the version column
+* of the record's ETag (`etagBump` in `records.ts`). A definition is never deleted.
+* `taken` holds the names of the app's resources and those Protobase adds.
+*/
+const definitionsHook = (taken) => async (event, trx) => {
+	const { name } = event.resource;
+	if (name !== "user_tables" && name !== "user_table_fields") return;
+	if (event.operation === "delete" || event.operation === "undelete") throw new Error(`A ${name} record is never deleted`);
+	const after = event.after;
+	if (name === "user_tables") {
+		if (event.operation === "create") return createTable(trx, after);
+		if (after.title_field != null && after.title_field !== event.before?.title_field) return setTitle(trx, after);
+		return;
+	}
+	if (event.operation === "create") return addField(trx, after, taken);
+	await raiseVersion(trx, after.table_id);
+};
+//#endregion
+export { definitionsHook };

package/dist/user-tables/definitions-resources.js

@@ -0,0 +1,54 @@
+import { definitionFieldTypes, definitionsSchema, nameProblem } from "./names.js";
+import { f, resource } from "@protobase/schema";
+//#region src/user-tables/definitions-resources.ts
+/** The names of the resources over the definitions: a table users add takes neither. */
+const tablesResourceName = "user_tables";
+const fieldsResourceName = "user_table_fields";
+const admins = ({ user }) => user?.roles?.includes("admin") ?? false;
+const never = () => false;
+const createOnly = { update: never };
+const accessOf = (roles) => roles ? { delete: never } : {
+	list: admins,
+	read: admins,
+	create: admins,
+	update: admins,
+	delete: never
+};
+const issue = (field, problem) => problem ? [{
+	field,
+	message: problem
+}] : [];
+/**
+* The definitions of the tables users add, as resources: a table at `/user_tables/<id>`, each of its fields at
+* `/user_table_fields/<table_id>,<name>`. Writing one creates its table or column in the database, in the same
+* transaction (`definitionsHook`). `taken` holds the names of the app's resources and those Protobase adds, which a
+* new table may not have.
+*/
+const definitionsResources = ({ roles, taken }) => {
+	return {
+		tables: resource(tablesResourceName).table(`${definitionsSchema}.tables`).fields({
+			id: f.bigint().readOnly().dbDefault().filterable().sortable(),
+			name: f.text().access(createOnly).filterable().sortable(),
+			singular_label: f.text().max(200),
+			plural_label: f.text().max(200),
+			title_field: f.text().optional(),
+			version: f.bigint().readOnly().dbDefault()
+		}).primaryKey((r) => r.id).explicitGrants().access(accessOf(roles)).validate((table) => [...issue("name", nameProblem(table.name, "table") ?? (taken.includes(table.name) || ["user_tables", "user_table_fields"].includes(table.name) ? `"${table.name}" is the name of a resource of the app` : void 0)), ...issue("title_field", table.title_field ? nameProblem(table.title_field, "field") : void 0)]),
+		fields: resource(fieldsResourceName).table(`${definitionsSchema}.fields`).fields({
+			table_id: f.relation(tablesResourceName).access(createOnly).filterable(),
+			name: f.text().access(createOnly),
+			label: f.text().max(200),
+			type: f.enum(definitionFieldTypes).access(createOnly),
+			required: f.boolean().default(false).access(createOnly),
+			position: f.integer().sortable(),
+			precision: f.integer().optional().access(createOnly),
+			scale: f.integer().optional().access(createOnly)
+		}).primaryKey((r) => [r.table_id, r.name]).explicitGrants().access(accessOf(roles)).validate((field) => [
+			...issue("name", nameProblem(field.name, "field")),
+			...issue("required", field.required ? "A field users add is optional: the records already there have no value for it" : void 0),
+			...field.type === "decimal" ? [...issue("precision", field.precision == null || field.precision < 1 || field.precision > 1e3 ? "A decimal needs a precision from 1 to 1000" : void 0), ...issue("scale", field.scale == null || field.scale < 0 || field.precision != null && field.scale > field.precision ? "A decimal needs a scale from 0 to its precision" : void 0)] : [...issue("precision", field.precision == null ? void 0 : "Only a decimal has a precision"), ...issue("scale", field.scale == null ? void 0 : "Only a decimal has a scale")]
+		])
+	};
+};
+//#endregion
+export { definitionsResources, fieldsResourceName, tablesResourceName };

package/dist/user-tables/definitions-version.d.ts

@@ -0,0 +1,10 @@
+import { Db } from "@protobase/query";
+//#region src/user-tables/definitions-version.d.ts
+/**
+ * The version of the stored definitions as a whole, from their rows alone: how many there are, the highest id and the
+ * sum of their versions. Adding one raises the highest id, which an identity never gives again, removing one lowers the
+ * count, and changing one raises its version, so each change moves it, as long as every change of a definition or its
+ * fields raises the definition's version. One read of `tables`, which holds a row per table users add.
+ */
+export declare const readDefinitionsVersion: (db: Db) => Promise<string>;
+//#endregion

package/dist/user-tables/definitions-version.js

@@ -0,0 +1,16 @@
+import { definitionsSchema } from "./names.js";
+import { sql } from "kysely";
+//#region src/user-tables/definitions-version.ts
+/**
+* The version of the stored definitions as a whole, from their rows alone: how many there are, the highest id and the
+* sum of their versions. Adding one raises the highest id, which an identity never gives again, removing one lowers the
+* count, and changing one raises its version, so each change moves it, as long as every change of a definition or its
+* fields raises the definition's version. One read of `tables`, which holds a row per table users add.
+*/
+const readDefinitionsVersion = async (db) => {
+	const { rows } = await sql`select count(*) || ':' || coalesce(max(id), 0) || ':' || coalesce(sum(version), 0) as version
+    from ${sql.table(`${definitionsSchema}.tables`)}`.execute(db);
+	return rows[0].version;
+};
+//#endregion
+export { readDefinitionsVersion };

package/dist/user-tables/latest-admin.js

@@ -0,0 +1,47 @@
+//#region src/user-tables/latest-admin.ts
+/** How long a read of the definitions version holds before a request reads it again, in milliseconds. */
+const versionCheckMs = 1e3;
+/**
+* The latest admin built, the only one kept: a cache of one entry, swapped for one built anew when the definitions
+* version moved. `get(true)` reads the version at once, `get()` at most once a `versionCheckMs`; either waits for a read
+* or rebuild already running instead of starting another, so two requests never build twice. A request keeps the admin
+* it got until it is answered.
+*/
+const latestAdmin = ({ admin, version, readVersion, rebuild, now = Date.now }) => {
+	let latest = {
+		admin,
+		version,
+		checkedAt: now()
+	};
+	let checking;
+	const check = async () => {
+		const checkedAt = now();
+		const read = await readVersion();
+		if (read === latest.version) {
+			latest = {
+				...latest,
+				checkedAt
+			};
+			return latest.admin;
+		}
+		latest = {
+			admin: await rebuild(latest.admin),
+			version: read,
+			checkedAt
+		};
+		return latest.admin;
+	};
+	const get = (atOnce = false) => {
+		if (!atOnce && now() - latest.checkedAt < 1e3) return Promise.resolve(latest.admin);
+		checking ??= check().finally(() => {
+			checking = void 0;
+		});
+		return checking;
+	};
+	return {
+		get,
+		current: () => latest.admin
+	};
+};
+//#endregion
+export { latestAdmin, versionCheckMs };

package/dist/user-tables/names.js

@@ -1,3 +1,4 @@
+import { reservedWords } from "./reserved-words.js";
 //#region src/user-tables/names.ts
 /** The schema the definitions of the tables users add live in: `tables`, and `fields` of each. */
 const definitionsSchema = "table_definitions";
@@ -18,5 +19,13 @@ const definitionColumnTypes = {
 };
 const definitionFieldTypes = Object.keys(definitionColumnTypes);
 const isUserTableName = (name) => userTableName.test(name) && new TextEncoder().encode(name).length <= 63;
+/** The names a field never takes: the key's, and the API's for the record version. */
+const reservedFieldNames = ["id", "etag"];
+/** What is wrong with a name a table or field users add is given, or `undefined` when it may have it. */
+const nameProblem = (name, kind) => {
+	if (typeof name !== "string" || !isUserTableName(name)) return "Use lowercase letters, digits and \"_\", starting with a letter, at most 63 bytes";
+	if (reservedWords.has(name)) return `"${name}" is a word SQL reserves`;
+	if (kind === "field" && reservedFieldNames.includes(name)) return `"${name}" is the name of a field every table has`;
+};
 //#endregion
-export { definitionColumnTypes, definitionFieldTypes, definitionsSchema, isUserTableName, userTableName, userTablesSchema };
+export { definitionColumnTypes, definitionFieldTypes, definitionsSchema, isUserTableName, nameProblem, reservedFieldNames, userTableName, userTablesSchema };

package/dist/user-tables/reloading-admin.d.ts

@@ -0,0 +1,41 @@
+import { FieldDecrypter } from "../encryption/decrypt-field-types.js";
+import { JobDefinition } from "../jobs/job-types.js";
+import { RealtimePrune } from "../realtime/realtime-prune.js";
+import { Admin, AdminEnv } from "../types.js";
+import { UserTables } from "./user-table-resources.js";
+import "../index.js";
+import { Hono } from "hono";
+//#region src/user-tables/reloading-admin.d.ts
+export type ReloadingAdminInput = {
+  /** The admin startup built, from the user tables of `version`. */
+  first: Admin;
+  version: string;
+  /** The definitions version now (`readDefinitionsVersion`). */
+  readVersion: () => Promise<string>;
+  /** The user tables now (`userTableResources`). */
+  readTables: () => Promise<UserTables>;
+  /** The admin of the app with these user tables, as startup built `first`. */
+  build: (tables: UserTables) => Admin;
+  /** The app's `onUnhandledError`: a failed version read, and an admin that does not build. */
+  report?: (error: unknown, request?: Request) => void;
+  statementTimeoutMs?: number;
+  now?: () => number;
+};
+/**
+ * The app's admin, rebuilt when the tables users add change, so every process serves a new definition without a
+ * restart. `/meta` reads the definitions version first; any other request at most once a second, and once more when the
+ * admin answers it not found or invalid, as it does a resource or field it does not know, and then is answered again by
+ * the admin built anew. A request finishes on the admin it started with, and a WebSocket keeps the admin it opened
+ * with. An admin that does not build with the new definitions is reported, and the one before keeps serving.
+ * A write to a definition that succeeded rebuilds it at once, before it is answered, so the next request of the writer
+ * finds the change. `reload()` reads the version at once, for the process that changed a definition another way. The
+ * jobs, the realtime prune and the field decrypter are those of `first`.
+ */
+export declare const reloadingAdmin: ({ first, version, readVersion, readTables, build, report, statementTimeoutMs, now }: ReloadingAdminInput) => Hono<AdminEnv, import("hono/types").BlankSchema, "/"> & {
+  jobs: JobDefinition[];
+  startRealtimePrune: () => RealtimePrune;
+  decryptField: FieldDecrypter;
+  metaPath: string;
+  reload: () => Promise<undefined>;
+};
+//#endregion

package/dist/user-tables/reloading-admin.js

@@ -0,0 +1,71 @@
+import { createErrorHandler } from "../error-handler.js";
+import "./definitions-resources.js";
+import { latestAdmin } from "./latest-admin.js";
+import { Hono } from "hono";
+//#region src/user-tables/reloading-admin.ts
+const problemStatuses = /* @__PURE__ */ new Set([400, 404]);
+const namesUnknown = (response) => problemStatuses.has(response.status) && (response.headers.get("content-type")?.startsWith("application/problem+json") ?? false);
+const replayable = async (request) => {
+	if (!request.body) return () => request;
+	if (!request.headers.get("content-type")?.includes("json")) return;
+	const body = await request.arrayBuffer();
+	return () => new Request(request, { body });
+};
+const writesDefinitions = (request, path) => request.method !== "GET" && request.method !== "HEAD" && (path.endsWith(":batchWrite") || path.split("/").some((segment) => segment === "user_tables" || segment === "user_table_fields"));
+/**
+* The app's admin, rebuilt when the tables users add change, so every process serves a new definition without a
+* restart. `/meta` reads the definitions version first; any other request at most once a second, and once more when the
+* admin answers it not found or invalid, as it does a resource or field it does not know, and then is answered again by
+* the admin built anew. A request finishes on the admin it started with, and a WebSocket keeps the admin it opened
+* with. An admin that does not build with the new definitions is reported, and the one before keeps serving.
+* A write to a definition that succeeded rebuilds it at once, before it is answered, so the next request of the writer
+* finds the change. `reload()` reads the version at once, for the process that changed a definition another way. The
+* jobs, the realtime prune and the field decrypter are those of `first`.
+*/
+const reloadingAdmin = ({ first, version, readVersion, readTables, build, report, statementTimeoutMs, now }) => {
+	const rebuild = async (current) => {
+		const tables = await readTables();
+		try {
+			return build(tables);
+		} catch (error) {
+			report?.(new Error("The tables users add changed, but the app does not build with them, so it serves the tables it served before", { cause: error }));
+			return current;
+		}
+	};
+	const latest = latestAdmin({
+		admin: first,
+		version,
+		readVersion,
+		rebuild,
+		...now && { now }
+	});
+	const answerOn = async (request, env, path) => {
+		const atOnce = path === first.metaPath || path.startsWith(`${first.metaPath}/`);
+		const admin = await latest.get(atOnce);
+		const again = atOnce ? void 0 : await replayable(request);
+		if (!again) return admin.fetch(request, env);
+		const answered = await admin.fetch(again(), env);
+		if (!namesUnknown(answered)) return answered;
+		const fresh = await latest.get(true);
+		return fresh === admin ? answered : fresh.fetch(again(), env);
+	};
+	const answer = async (request, env) => {
+		const path = new URL(request.url).pathname;
+		const answered = await answerOn(request, env, path);
+		if (answered.ok && writesDefinitions(request, path)) await latest.get(true);
+		return answered;
+	};
+	const app = new Hono();
+	app.onError(createErrorHandler(report, statementTimeoutMs));
+	app.all("*", (c) => answer(c.req.raw, c.env));
+	const reload = async () => void await latest.get(true);
+	return Object.assign(app, {
+		jobs: first.jobs,
+		startRealtimePrune: first.startRealtimePrune,
+		decryptField: first.decryptField,
+		metaPath: first.metaPath,
+		reload
+	});
+};
+//#endregion
+export { reloadingAdmin };

package/dist/user-tables/reserved-words.js

@@ -0,0 +1,87 @@
+//#region src/user-tables/reserved-words.ts
+/**
+* The key words Postgres 18 reserves, `select word from pg_get_keywords() where catcode = 'R'`: a table or field users
+* add never takes one, so its name works unquoted in any SQL a developer writes against it.
+*/
+const reservedWords = /* @__PURE__ */ new Set([
+	"all",
+	"analyse",
+	"analyze",
+	"and",
+	"any",
+	"array",
+	"as",
+	"asc",
+	"asymmetric",
+	"both",
+	"case",
+	"cast",
+	"check",
+	"collate",
+	"column",
+	"constraint",
+	"create",
+	"current_catalog",
+	"current_date",
+	"current_role",
+	"current_time",
+	"current_timestamp",
+	"current_user",
+	"default",
+	"deferrable",
+	"desc",
+	"distinct",
+	"do",
+	"else",
+	"end",
+	"except",
+	"false",
+	"fetch",
+	"for",
+	"foreign",
+	"from",
+	"grant",
+	"group",
+	"having",
+	"in",
+	"initially",
+	"intersect",
+	"into",
+	"lateral",
+	"leading",
+	"limit",
+	"localtime",
+	"localtimestamp",
+	"not",
+	"null",
+	"offset",
+	"on",
+	"only",
+	"or",
+	"order",
+	"placing",
+	"primary",
+	"references",
+	"returning",
+	"select",
+	"session_user",
+	"some",
+	"symmetric",
+	"system_user",
+	"table",
+	"then",
+	"to",
+	"trailing",
+	"true",
+	"union",
+	"unique",
+	"user",
+	"using",
+	"variadic",
+	"when",
+	"where",
+	"window",
+	"with"
+]);
+//#endregion
+export { reservedWords };

package/dist/user-tables/schema-sql.js

@@ -1,15 +1,17 @@
 import { definitionFieldTypes, definitionsSchema, userTableName, userTablesSchema } from "./names.js";
 //#region src/user-tables/schema-sql.ts
 const nameCheck = (column) => `check (${column} ~ '${userTableName.source}' and octet_length(${column}) <= 63)`;
-/** The table of definitions: one row per table users add, its labels and a version that each change of it raises. */
+/** The table of definitions: one row per table users add, its labels and a version, 1 when added, that each change of it raises. */
 const tablesSql = () => `create table ${definitionsSchema}.tables (
   id bigint generated always as identity primary key,
   name text not null unique ${nameCheck("name")},
   singular_label text not null,
   plural_label text not null,
   title_field text ${nameCheck("title_field")},
-  version bigint not null check (version > 0)
+  version bigint not null default 1 check (version > 0)
 )`;
+/** Gives a definitions table made before new definitions started at version 1 that default. */
+const versionDefaultSql = () => `alter table ${definitionsSchema}.tables alter column version set default 1`;
 /** The fields of each definition, in order, each with its label and type; a decimal names its precision and scale. */
 const fieldsSql = () => `create table ${definitionsSchema}.fields (
   table_id bigint not null references ${definitionsSchema}.tables (id) on delete cascade,
@@ -32,4 +34,4 @@ const schemasSql = () => [
 	`grant usage, create on schema ${userTablesSchema} to current_user`
 ];
 //#endregion
-export { fieldsSql, schemasSql, tablesSql };
+export { fieldsSql, schemasSql, tablesSql, versionDefaultSql };

package/dist/user-tables/schema.js

@@ -1,11 +1,12 @@
 import { migrationCommand } from "../changes/capture-schema.js";
 import { definitionsSchema, userTablesSchema } from "./names.js";
-import { fieldsSql, schemasSql, tablesSql } from "./schema-sql.js";
+import { fieldsSql, schemasSql, tablesSql, versionDefaultSql } from "./schema-sql.js";
 import { sql } from "kysely";
 //#region src/user-tables/schema.ts
 const readUserTablesSchema = async (db) => {
 	const { rows } = await sql`select
     to_regclass(${`${definitionsSchema}.tables`}) is not null as tables,
+    exists (select from information_schema.columns where table_schema = ${definitionsSchema} and table_name = 'tables' and column_name = 'version' and column_default is not null) as "versionDefault",
     to_regclass(${`${definitionsSchema}.fields`}) is not null as fields,
     exists (select from pg_namespace where nspname = ${userTablesSchema}) as data,
     exists (select from pg_extension where extname = 'pg_trgm') as trgm`.execute(db);
@@ -17,18 +18,18 @@ const readUserTablesSchema = async (db) => {
 */
 const userTablesMigration = async (db) => {
 	const found = await readUserTablesSchema(db);
-	if (found.tables && found.fields && found.data && found.trgm) return void 0;
+	if (found.tables && found.versionDefault && found.fields && found.data && found.trgm) return void 0;
 	return `${[
 		...schemasSql(),
-		...found.tables ? [] : [tablesSql()],
+		...found.tables ? found.versionDefault ? [] : [versionDefaultSql()] : [tablesSql()],
 		...found.fields ? [] : [fieldsSql()]
 	].join(";\n\n")};`;
 };
 /** Refuses to go on while the schemas of user tables are missing; the project's migrations add them. */
 const checkUserTablesSchema = async (db) => {
 	const found = await readUserTablesSchema(db);
-	if (found.tables && found.fields && found.data && found.trgm) return;
-	throw new Error(`The ${definitionsSchema} or ${userTablesSchema} schema, or pg_trgm, is missing, and userTables keeps the tables users add there. Write it as a migration with \`${migrationCommand}\`, apply it with the project's migrations, then start again.`);
+	if (found.tables && found.versionDefault && found.fields && found.data && found.trgm) return;
+	throw new Error(`The ${definitionsSchema} or ${userTablesSchema} schema, the default of a definition's version, or pg_trgm, is missing, and userTables keeps the tables users add there. Write it as a migration with \`${migrationCommand}\`, apply it with the project's migrations, then start again.`);
 };
 //#endregion
 export { checkUserTablesSchema, userTablesMigration };

package/dist/user-tables/table-ddl.js

@@ -0,0 +1,56 @@
+import { nameProblem, userTablesSchema } from "./names.js";
+import { sql } from "kysely";
+//#region src/user-tables/table-ddl.ts
+const checkedName = (name, kind) => {
+	const problem = nameProblem(name, kind);
+	if (problem) throw new Error(`The ${kind} name ${JSON.stringify(name)} cannot reach SQL: ${problem}`);
+	return name;
+};
+const tableId = (table) => sql.id(userTablesSchema, checkedName(table, "table"));
+const decimalOf = (precision, scale) => {
+	if (!Number.isInteger(precision) || precision < 1 || precision > 1e3) throw new Error(`The precision ${JSON.stringify(precision)} is not a whole number from 1 to 1000`);
+	if (!Number.isInteger(scale) || scale < 0 || scale > precision) throw new Error(`The scale ${JSON.stringify(scale)} is not a whole number from 0 to the precision`);
+	return sql.raw(`numeric(${precision}, ${scale})`);
+};
+const columnType = (field) => {
+	switch (field.type) {
+		case "text":
+		case "long_text": return sql.raw("text");
+		case "integer": return sql.raw("integer");
+		case "decimal": return decimalOf(field.precision, field.scale);
+		case "boolean": return sql.raw("boolean");
+		case "date": return sql.raw("date");
+		case "timestamp": return sql.raw("timestamptz");
+		case "json": return sql.raw("jsonb");
+		default: throw new Error(`The field type ${JSON.stringify(field.type)} has no column type`);
+	}
+};
+/** The index a field's column gets so its list filters and sorts: btree, a trigram one for long text, which outgrows a btree entry, and none for json. */
+const indexKind = (type) => {
+	switch (type) {
+		case "text":
+		case "integer":
+		case "decimal":
+		case "boolean":
+		case "date":
+		case "timestamp": return "btree";
+		case "long_text": return "trigram";
+		case "json": return;
+		default: throw new Error(`The field type ${JSON.stringify(type)} has no index kind`);
+	}
+};
+/** The new table, with its key alone: its fields are added as columns. */
+const createTableSql = (table) => sql`create table ${tableId(table)} (id bigint generated always as identity primary key)`;
+/** The field's column: nullable and without a default, so the records already there read it as empty. */
+const addColumnSql = (table, field) => sql`alter table ${tableId(table)} add column ${sql.id(checkedName(field.name, "field"))} ${columnType(field)}`;
+const btreeSql = (table, column) => sql`create index on ${tableId(table)} (${sql.id(checkedName(column, "field"))})`;
+/** The pg_trgm index that search and text filters need on a text column. */
+const trigramIndexSql = (table, column) => sql`create index on ${tableId(table)} using gin (${sql.id(checkedName(column, "field"))} gin_trgm_ops)`;
+/** The column and the index of a field added to a table. */
+const fieldSql = (table, field) => {
+	const kind = indexKind(field.type);
+	const index = kind === "btree" ? [btreeSql(table, field.name)] : kind === "trigram" ? [trigramIndexSql(table, field.name)] : [];
+	return [addColumnSql(table, field), ...index];
+};
+//#endregion
+export { addColumnSql, createTableSql, fieldSql, indexKind, trigramIndexSql };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.67.1",
+  "version": "0.67.3",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -43,9 +43,9 @@
     "@better-auth/sso": "^1.7.12",
     "@livekit/protocol": "1.53.1",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.67.1",
-    "@protobase/query": "0.67.1",
-    "@protobase/schema": "0.67.1",
+    "@protobase/layout": "0.67.3",
+    "@protobase/query": "0.67.3",
+    "@protobase/schema": "0.67.3",
     "@react-email/render": "^2.1.0",
     "@react-pdf/primitives": "^4.4.0",
     "@react-pdf/renderer": "^4.9.0",