@protobase/server 0.67.2 → 0.67.4

package/dist/better-auth/auth-settings.d.ts

@@ -1010,8 +1010,8 @@ export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput)
           $Infer: {
             body: {
               permissions: {
-                readonly user?: ("list" | "create" | "update" | "delete" | "set-role" | "ban" | "impersonate" | "set-password" | "set-email" | "get" | "impersonate-admins")[] | undefined;
-                readonly session?: ("list" | "delete" | "revoke")[] | undefined;
+                readonly user?: ("create" | "update" | "delete" | "list" | "set-role" | "ban" | "impersonate" | "set-password" | "set-email" | "get" | "impersonate-admins")[] | undefined;
+                readonly session?: ("delete" | "list" | "revoke")[] | undefined;
               };
             } & {
               userId?: string | undefined;

package/dist/better-auth/create-auth.d.ts

@@ -1143,8 +1143,8 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
           $Infer: {
             body: {
               permissions: {
-                readonly user?: ("list" | "create" | "update" | "delete" | "set-role" | "ban" | "impersonate" | "set-password" | "set-email" | "get" | "impersonate-admins")[] | undefined;
-                readonly session?: ("list" | "delete" | "revoke")[] | undefined;
+                readonly user?: ("create" | "update" | "delete" | "list" | "set-role" | "ban" | "impersonate" | "set-password" | "set-email" | "get" | "impersonate-admins")[] | undefined;
+                readonly session?: ("delete" | "list" | "revoke")[] | undefined;
               };
             } & {
               userId?: string | undefined;

package/dist/better-auth/status-route.js

@@ -17,9 +17,11 @@ import { Hono } from "hono";
 * with their labels, `membership` for those a member can hold, and the roles each one's holders may also give; and
 * `anonymous` when the project's anonymous role reads a resource, so the admin app opens for visitors before anyone signs in; `mcp` when MCP clients can connect, with the `url` of its endpoint, so the account page shows that address and lists the connected clients; `personalMail`, the mail providers people may link their mailbox with, each with the sign-in provider it links through, the scopes and the authorization parameters of the link, so the account page offers "Link Gmail"; and
 * `plugins`, those the app loads before sign-in (see `PluginOption`); and `locale`, the language `options.locale` puts
-* the screens in, so the sign-in screens and public forms, which come before `/meta`, are in it too.
+* the screens in, so the sign-in screens and public forms, which come before `/meta`, are in it too; `appName` and
+* `appIcon`, the app's name and the path of its own icon when it has one, which those screens show as `/meta` names them;
+* and `runsOnNote` when the host has the sign-in page end on the "Runs on Protobase" note (see `readRunsOnNote`).
 */
-const statusRoute = (auth, { anonymous = false, plugins = [], locale, firstAdminUrl } = {}) => {
+const statusRoute = (auth, { anonymous = false, plugins = [], locale, firstAdminUrl, appName, appIcon, runsOnNote = false } = {}) => {
 	const app = new Hono();
 	app.get("/status", async (c) => {
 		const context = await auth.$context;
@@ -60,6 +62,9 @@ const statusRoute = (auth, { anonymous = false, plugins = [], locale, firstAdmin
 			})) },
 			...plugins.length > 0 && { plugins },
 			...locale && { locale },
+			...appName && { appName },
+			...appIcon && { appIcon },
+			...runsOnNote && { runsOnNote },
 			...auth.organizations && { organizations: {
 				create: auth.organizations.create,
 				roles: roleLabels(auth.roleDefinitions)

package/dist/config-exports.d.ts

@@ -1,6 +1,9 @@
 import { configExports } from "./resource-source.js";
+import { ownedTableNames } from "./user-tables/owned-definitions.js";
 import { definitionsSchema, userTablesSchema } from "./user-tables/names.js";
+import { CheckedDefinition } from "./user-tables/check-definition.js";
+import { maxTextLength } from "./user-tables/definition-resource.js";
 import { userTableResources } from "./user-tables/user-table-resources.js";
 import { builtInResources } from "./built-in-resources.js";
 import { webhooksModule } from "./webhooks/table/webhooks-module.js";
-export { builtInResources, configExports, definitionsSchema, userTableResources, userTablesSchema, webhooksModule };
+export { type CheckedDefinition, builtInResources, configExports, definitionsSchema, maxTextLength, ownedTableNames, userTableResources, userTablesSchema, webhooksModule };

package/dist/config-exports.js

@@ -1,6 +1,8 @@
 import { builtInResources } from "./built-in-resources.js";
-import { configExports } from "./resource-source.js";
 import { definitionsSchema, userTablesSchema } from "./user-tables/names.js";
+import { maxTextLength } from "./user-tables/definition-resource.js";
+import { configExports } from "./resource-source.js";
+import { ownedTableNames } from "./user-tables/owned-definitions.js";
 import { userTableResources } from "./user-tables/user-table-resources.js";
 import { webhooksModule } from "./webhooks/table/webhooks-module.js";
-export { builtInResources, configExports, definitionsSchema, userTableResources, userTablesSchema, webhooksModule };
+export { builtInResources, configExports, definitionsSchema, maxTextLength, ownedTableNames, userTableResources, userTablesSchema, webhooksModule };

package/dist/create-admin.js

@@ -108,11 +108,12 @@ import { metaRoutes } from "./routes/meta.js";
 import { faviconPath } from "./web-app/web-manifest.js";
 import { webManifestRoute } from "./web-app/web-manifest-route.js";
 import { mcpIcons } from "./web-app/mcp-icons.js";
+import { readRunsOnNote } from "./runs-on-note.js";
 import { recordRoutes } from "./routes/record.js";
 import { firstAdminUrl } from "./better-auth/first-admin-url.js";
 import { createScanGuard } from "./scan-guard.js";
 import { builtInResources } from "./built-in-resources.js";
-import { servedUserTables } from "./user-tables/served-user-tables.js";
+import { adminUserTables } from "./user-tables/admin-user-tables.js";
 import { Hono } from "hono";
 import { accountPage, accountPageName, checkPages, settingsResources, withSettingsFields } from "@protobase/layout";
 import { guestCallsPath, ringsPath, statusPath } from "@protobase/schema/internal";
@@ -137,10 +138,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], userTables
 		notifications: notifications !== void 0,
 		...events && { events }
 	});
-	const served = servedUserTables(userTables ?? {
-		resources: [],
-		views: []
-	}, [...appModels, ...builtIn.resources.map((resource) => resource.toModel())].map((model) => model.name));
+	const served = adminUserTables(userTables, [...appModels, ...builtIn.resources.map((resource) => resource.toModel())].map((model) => model.name), options.roles !== void 0);
 	for (const warning of served.warnings) console.warn(warning);
 	const resources = [
 		...appResources,
@@ -190,6 +188,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], userTables
 	const assistant = assistantSettings(options.assistant, globalThis.process?.env ?? {});
 	const runtime = runtimeUrl(options.runtime, globalThis.process?.env ?? {});
 	const firstAdmin = firstAdminUrl(globalThis.process?.env ?? {});
+	const runsOnNote = readRunsOnNote(globalThis.process?.env ?? {});
 	const errorReporting = errorReportingSettings(options.errorReporting, globalThis.process?.env ?? {});
 	const maps = mapSettings(options.maps, globalThis.process?.env ?? {});
 	const senders = notifications ? notificationSenders(notifications) : [];
@@ -241,6 +240,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], userTables
 		guard: createScanGuard(db, options.scanGuard),
 		hooks: [
 			...options.writeHooks ?? [],
+			...served.hooks,
 			...table ? [subscriptionWriteCheck(registry.entries.map((entry) => entry.model))] : [],
 			...fill ? [fillHook(() => deps, fill)] : []
 		],
@@ -289,7 +289,8 @@ const createAdmin = ({ resources: appResources, views: appViews = [], userTables
 		}) }
 	};
 	const appName = shownAppName(auth, globalThis.process?.env ?? {});
-	const meta = createMeta(deps, appName, icons?.favicon ? faviconPath : void 0);
+	const appIcon = icons?.favicon ? faviconPath : void 0;
+	const meta = createMeta(deps, appName, appIcon);
 	const onError = createErrorHandler(options.onUnhandledError, deps.statementTimeoutMs);
 	const guarded = (routes, caller = authenticate) => {
 		const app = new Hono();
@@ -310,7 +311,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], userTables
 		app.route("/", recordRoutes(deps));
 	}, withAnonymous(authenticate, options.roles));
 	const system = guarded((app) => {
-		app.route("/", docsRoutes(deps));
+		app.route("/", docsRoutes(deps, appName));
 	});
 	const metaApp = guarded((app) => {
 		app.route("/", metaRoutes(meta));
@@ -339,7 +340,10 @@ const createAdmin = ({ resources: appResources, views: appViews = [], userTables
 			anonymous: visitorsBrowse(options.roles),
 			plugins: pluginsBeforeSignIn(plugins),
 			...locale && { locale },
-			...firstAdmin && { firstAdminUrl: firstAdmin }
+			...firstAdmin && { firstAdminUrl: firstAdmin },
+			appName,
+			...appIcon && { appIcon },
+			runsOnNote
 		}));
 		if (auth.organizations) app.route(authBasePath, organizationRoutes({
 			auth,

package/dist/index.d.ts

@@ -102,6 +102,7 @@ import { parseColumns, readOutbox } from "./changes/outbox.js";
 import { newWebhookSecret } from "./webhooks/standard-webhooks.js";
 import { checkWebhooksSchema, webhooksMigration } from "./webhooks/table/schema.js";
 import { checkUserTablesSchema, userTablesMigration } from "./user-tables/schema.js";
+import { ownedDefinitionsMigration } from "./user-tables/owned-definitions.js";
 import { UserTables, userTableResources } from "./user-tables/user-table-resources.js";
 import { readDefinitionsVersion } from "./user-tables/definitions-version.js";
 import { reloadingAdmin } from "./user-tables/reloading-admin.js";
@@ -188,4 +189,4 @@ import { DrainResult, JobsRuntime, StartJobsOptions, startJobs } from "./jobs/ru
 import { jobsDrainApp } from "./jobs/drain-route.js";
 import { checkJobsSchema, jobsSchema, jobsSchemaMigration } from "./jobs/schema.js";
 import { AdminAuth, CreateAuthOptions, UserCreatedHook, normalizeRoles } from "./better-auth/create-auth.js";
-export { type Admin, type AdminAuth, type AdminOptions, type AggregateParams, type ApiFunction, type ApiKeys, type ApiKeysOptions, type ApnsEnvironment, type AppIcons, type AppIdentity, type AppPoolConfig, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type ArgumentsPayload, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type AuthHooks, type AuthSettings, type AuthenticateSettings, type Authenticator, type BaseToolContext, type BatchOperation, type BatchResult, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type CallBackend, type CallMember, type Caller, type CallerOptions, type CallsAccess, type CallsOptions, type CapturedRow, type CascadingKey, type ChannelBroadcast, type ChannelSender, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentToolsInput, type CommentUsers, type Completion, type CompletionOptions, ConnectionsBusy, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DecryptField, type Device, type DeviceColumn, type DeviceKind, type DeviceStore, DeviceStoreError, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueJob, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldDecrypter, type FieldReader, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileProviderSettings, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryColumn, type HistoryOptions, type HistoryPosition, type HistoryStore, HistoryStoreError, type HookContext, HttpProblem, type IssueTokenOptions, type JobContext, type JobDeclaration, type JobDefinition, type JobName, type JobOptions, type JobPayload, type JobRun, type JobsRuntime, type JsonObject, type JsonValue, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LiveKitBackend, type LocalFilesOptions, type MailAttachment, type MailMessage, MailServerTimeoutError, type Mailer, type MapLayer, type MapOptions, type MapSettings, type McpApprovals, type McpGateInput, type McpHandlerInput, type McpRoutesInput, type McpServerInput, type McpToolsInput, type McpWrites, type MemberInput, type Membership, MissingCredentials, type MobileConfig, ModelError, type ModelSettings, type NewDevice, type NewNotification, type NewOrganization, type NewUser, type NotificationRecipients, NotificationSendError, type NotificationsOptions, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PdfComponent, type PdfOptions, type PdfTemplate, PersonalMailError, type PersonalMailErrorCode, type PersonalMailProviderId, type PgModule, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type PushAnswer, type PushMessage, PushMessageError, type PushSender, type QueryOptions, type QueryResult, type ReadableResources, type RealtimeOptions, type RealtimePrune, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordGroups, type RecordKey, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type SendNotification, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StatusOptions, type StoreFileInput, type StoredMember, type StoredNotification, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolAnnotations, type ToolCall, type ToolComment, type ToolCommentPage, type ToolComments, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type Urgency, type User, type UserCreatedHook, type UserTables, type VapidSettings, type ViewSource, type WebPushFields, type WebPushOptions, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, type WriteRecordToolsInput, addAppRoleToOwners, addCommentTool, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appNameOver, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthTokens, callsMigration, capSocketMessages, changesMigration, channelSendsMigration, checkAi, checkAuthSchema, checkCalls, checkChanges, checkChannelSends, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkRealtimeRelay, checkResourcesOutsideAuthStore, checkSourceNames, checkStatusSchema, checkUserTablesSchema, checkViewQueries, checkWebhooksSchema, coalesce, commentTools, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, countRecordsTool, createAdmin, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineEmail, defineFunction, defineJob, definePdf, defineTool, deleteRecordTool, deleteUser, describeResourceTool, deviceIdParam, deviceStore, devicesPath, enqueueJob, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listCommentsTool, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpIcons, mcpInstructions, mcpRoutes, mcpServer, mcpToolContext, mcpTools, migrationCommand, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notificationsMigration, oauthWellKnownPaths, objectKey, onDoNotDisturb, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readDefinitionsVersion, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, realtimeRelayMigration, recordOf, refusalOf, refused, relayed, reloadingAdmin, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, sqlSends, startErrorReporting, startJobs, statusMigration, statusNames, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, userTableResources, userTablesMigration, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };
+export { type Admin, type AdminAuth, type AdminOptions, type AggregateParams, type ApiFunction, type ApiKeys, type ApiKeysOptions, type ApnsEnvironment, type AppIcons, type AppIdentity, type AppPoolConfig, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type ArgumentsPayload, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type AuthHooks, type AuthSettings, type AuthenticateSettings, type Authenticator, type BaseToolContext, type BatchOperation, type BatchResult, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type CallBackend, type CallMember, type Caller, type CallerOptions, type CallsAccess, type CallsOptions, type CapturedRow, type CascadingKey, type ChannelBroadcast, type ChannelSender, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentToolsInput, type CommentUsers, type Completion, type CompletionOptions, ConnectionsBusy, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DecryptField, type Device, type DeviceColumn, type DeviceKind, type DeviceStore, DeviceStoreError, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueJob, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldDecrypter, type FieldReader, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileProviderSettings, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryColumn, type HistoryOptions, type HistoryPosition, type HistoryStore, HistoryStoreError, type HookContext, HttpProblem, type IssueTokenOptions, type JobContext, type JobDeclaration, type JobDefinition, type JobName, type JobOptions, type JobPayload, type JobRun, type JobsRuntime, type JsonObject, type JsonValue, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LiveKitBackend, type LocalFilesOptions, type MailAttachment, type MailMessage, MailServerTimeoutError, type Mailer, type MapLayer, type MapOptions, type MapSettings, type McpApprovals, type McpGateInput, type McpHandlerInput, type McpRoutesInput, type McpServerInput, type McpToolsInput, type McpWrites, type MemberInput, type Membership, MissingCredentials, type MobileConfig, ModelError, type ModelSettings, type NewDevice, type NewNotification, type NewOrganization, type NewUser, type NotificationRecipients, NotificationSendError, type NotificationsOptions, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PdfComponent, type PdfOptions, type PdfTemplate, PersonalMailError, type PersonalMailErrorCode, type PersonalMailProviderId, type PgModule, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type PushAnswer, type PushMessage, PushMessageError, type PushSender, type QueryOptions, type QueryResult, type ReadableResources, type RealtimeOptions, type RealtimePrune, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordGroups, type RecordKey, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type SendNotification, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StatusOptions, type StoreFileInput, type StoredMember, type StoredNotification, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolAnnotations, type ToolCall, type ToolComment, type ToolCommentPage, type ToolComments, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type Urgency, type User, type UserCreatedHook, type UserTables, type VapidSettings, type ViewSource, type WebPushFields, type WebPushOptions, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, type WriteRecordToolsInput, addAppRoleToOwners, addCommentTool, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appNameOver, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthTokens, callsMigration, capSocketMessages, changesMigration, channelSendsMigration, checkAi, checkAuthSchema, checkCalls, checkChanges, checkChannelSends, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkRealtimeRelay, checkResourcesOutsideAuthStore, checkSourceNames, checkStatusSchema, checkUserTablesSchema, checkViewQueries, checkWebhooksSchema, coalesce, commentTools, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, countRecordsTool, createAdmin, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineEmail, defineFunction, defineJob, definePdf, defineTool, deleteRecordTool, deleteUser, describeResourceTool, deviceIdParam, deviceStore, devicesPath, enqueueJob, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listCommentsTool, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpIcons, mcpInstructions, mcpRoutes, mcpServer, mcpToolContext, mcpTools, migrationCommand, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notificationsMigration, oauthWellKnownPaths, objectKey, onDoNotDisturb, ownedDefinitionsMigration, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readDefinitionsVersion, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, realtimeRelayMigration, recordOf, refusalOf, refused, relayed, reloadingAdmin, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, sqlSends, startErrorReporting, startJobs, statusMigration, statusNames, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, userTableResources, userTablesMigration, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };

package/dist/index.js

@@ -114,6 +114,7 @@ import { checkResourcesOutsideAuthStore } from "./better-auth/store/resources-ou
 import { checkComputed, computedMigration } from "./computed/computed-schema.js";
 import { checkWebhooksSchema, webhooksMigration } from "./webhooks/table/schema.js";
 import { checkUserTablesSchema, userTablesMigration } from "./user-tables/schema.js";
+import { ownedDefinitionsMigration } from "./user-tables/owned-definitions.js";
 import { userTableResources } from "./user-tables/user-table-resources.js";
 import { readDefinitionsVersion } from "./user-tables/definitions-version.js";
 import { reloadingAdmin } from "./user-tables/reloading-admin.js";
@@ -139,4 +140,4 @@ import { defineEmail } from "./mail/define-email.js";
 import { definePdf } from "./pdf/define-pdf.js";
 import { startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
-export { ConnectionsBusy, DeviceStoreError, FatalJobError, HistoryStoreError, HttpProblem, MailServerTimeoutError, MissingCredentials, ModelError, NotificationSendError, PersonalMailError, PushMessageError, addAppRoleToOwners, addCommentTool, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appNameOver, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthTokens, callsMigration, capSocketMessages, changesMigration, channelSendsMigration, checkAi, checkAuthSchema, checkCalls, checkChanges, checkChannelSends, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkRealtimeRelay, checkResourcesOutsideAuthStore, checkSourceNames, checkStatusSchema, checkUserTablesSchema, checkViewQueries, checkWebhooksSchema, coalesce, commentTools, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, countRecordsTool, createAdmin, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineEmail, defineFunction, defineJob, definePdf, defineTool, deleteRecordTool, deleteUser, describeResourceTool, deviceIdParam, deviceStore, devicesPath, enqueueJob, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listCommentsTool, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpIcons, mcpInstructions, mcpRoutes, mcpServer, mcpToolContext, mcpTools, migrationCommand, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notificationsMigration, oauthWellKnownPaths, objectKey, onDoNotDisturb, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readDefinitionsVersion, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, realtimeRelayMigration, recordOf, refusalOf, refused, relayed, reloadingAdmin, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, sqlSends, startErrorReporting, startJobs, statusMigration, statusNames, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, userTableResources, userTablesMigration, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };
+export { ConnectionsBusy, DeviceStoreError, FatalJobError, HistoryStoreError, HttpProblem, MailServerTimeoutError, MissingCredentials, ModelError, NotificationSendError, PersonalMailError, PushMessageError, addAppRoleToOwners, addCommentTool, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appNameOver, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthTokens, callsMigration, capSocketMessages, changesMigration, channelSendsMigration, checkAi, checkAuthSchema, checkCalls, checkChanges, checkChannelSends, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkRealtimeRelay, checkResourcesOutsideAuthStore, checkSourceNames, checkStatusSchema, checkUserTablesSchema, checkViewQueries, checkWebhooksSchema, coalesce, commentTools, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, countRecordsTool, createAdmin, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineEmail, defineFunction, defineJob, definePdf, defineTool, deleteRecordTool, deleteUser, describeResourceTool, deviceIdParam, deviceStore, devicesPath, enqueueJob, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listCommentsTool, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpIcons, mcpInstructions, mcpRoutes, mcpServer, mcpToolContext, mcpTools, migrationCommand, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notificationsMigration, oauthWellKnownPaths, objectKey, onDoNotDisturb, ownedDefinitionsMigration, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readDefinitionsVersion, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, realtimeRelayMigration, recordOf, refusalOf, refused, relayed, reloadingAdmin, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, sqlSends, startErrorReporting, startJobs, statusMigration, statusNames, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, userTableResources, userTablesMigration, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };

package/dist/openapi/document.js

@@ -4,11 +4,13 @@ import { resourceSchemas } from "./schemas.js";
 //#region src/openapi/document.ts
 const resourcesServer = (basePath) => basePath.slice(basePath.lastIndexOf("/") + 1);
 const systemServer = ".";
+/** The title of the app's API reference and OpenAPI document, such as "Shop & Co API". */
+const apiTitle = (appName) => `${appName} API`;
 /** The OpenAPI 3.1 document for one caller, generated from the resource models they may see and their zod record schemas. */
-const openApiDocument = (accesses, basePath) => ({
+const openApiDocument = (accesses, basePath, appName) => ({
 	openapi: "3.1.0",
 	info: {
-		title: "Protobase API",
+		title: apiTitle(appName),
 		version: "1.0.0",
 		description: "Admin API for an existing Postgres database. Follows Google's API design conventions ([AIP](https://google.aip.dev)) and reports errors as RFC 9457 `application/problem+json`."
 	},
@@ -73,4 +75,4 @@ const openApiDocument = (accesses, basePath) => ({
 	}
 });
 //#endregion
-export { openApiDocument };
+export { apiTitle, openApiDocument };

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.67.2";
+var version = "0.67.4";
 //#endregion
 export { version };

package/dist/routes/docs.js

@@ -1,18 +1,21 @@
 import { requestAccess } from "../request-access.js";
-import { openApiDocument } from "../openapi/document.js";
+import { apiTitle, openApiDocument } from "../openapi/document.js";
 import { Hono } from "hono";
 import { Scalar } from "@scalar/hono-api-reference";
 //#region src/routes/docs.ts
-/** The OpenAPI document and the Scalar reference. Both need a token: the document lists what the caller may see and do. */
-const docsRoutes = (deps) => {
+/**
+* The OpenAPI document and the Scalar reference, both titled with the app's name. Both need a token: the document lists
+* what the caller may see and do.
+*/
+const docsRoutes = (deps, appName) => {
 	const app = new Hono();
 	app.get("/openapi.json", async (c) => {
 		const visible = (await Promise.all(deps.registry.entries.map((entry) => requestAccess(deps, entry, c.get("session"))))).filter((access) => Object.values(access.resolved.operations).some(Boolean));
-		return c.json(openApiDocument(visible, deps.basePath));
+		return c.json(openApiDocument(visible, deps.basePath, appName));
 	});
 	app.get("/docs", Scalar({
 		url: "openapi.json",
-		pageTitle: "Protobase API"
+		pageTitle: apiTitle(appName)
 	}));
 	return app;
 };

package/dist/runs-on-note.js

@@ -0,0 +1,15 @@
+//#region src/runs-on-note.ts
+const runsOnNoteVariable = "PROTOBASE_RUNS_ON_NOTE";
+/**
+* Whether the sign-in page ends on the "Runs on Protobase" note: the host turns it on with `PROTOBASE_RUNS_ON_NOTE=true`,
+* so an app's repository cannot turn it off. Unset or empty, there is no note; any value but `true` or `false` stops the
+* server at startup.
+*/
+const readRunsOnNote = (env) => {
+	const value = env[runsOnNoteVariable];
+	if (!value) return false;
+	if (value !== "true" && value !== "false") throw new Error(`${runsOnNoteVariable} must be true or false, not "${value}"`);
+	return value === "true";
+};
+//#endregion
+export { readRunsOnNote, runsOnNoteVariable };

package/dist/user-tables/admin-user-tables.js

@@ -0,0 +1,38 @@
+import { definitionsResources, fieldsResourceName, tablesResourceName } from "./definitions-resources.js";
+import { definitionsHook } from "./definitions-hook.js";
+import { servedUserTables } from "./served-user-tables.js";
+//#region src/user-tables/admin-user-tables.ts
+/**
+* What the tables users add bring to the admin, with `userTables` on: the resources over their definitions, through
+* which they are created, each user table a name in code (`codeNames`, the app's and Protobase's) does not take, and the
+* hook that creates their tables and columns. Without `tables`, nothing.
+*/
+const adminUserTables = (tables, codeNames, roles) => {
+	if (!tables) return {
+		resources: [],
+		views: [],
+		hooks: [],
+		warnings: []
+	};
+	const definitions = definitionsResources({
+		roles,
+		taken: codeNames
+	});
+	const served = servedUserTables(tables, [
+		...codeNames,
+		tablesResourceName,
+		fieldsResourceName
+	]);
+	return {
+		resources: [
+			definitions.tables,
+			definitions.fields,
+			...served.resources
+		],
+		views: served.views,
+		hooks: [definitionsHook(codeNames)],
+		warnings: served.warnings
+	};
+};
+//#endregion
+export { adminUserTables };

package/dist/user-tables/definition-resource.d.ts

@@ -1,6 +1,8 @@
 import { CheckedDefinition } from "./check-definition.js";
 import { TableIndexes } from "@protobase/query";
 //#region src/user-tables/definition-resource.d.ts
+/** The most characters a text field takes: four bytes each at most, it always fits the entry of its btree index. */
+export declare const maxTextLength = 500;
 /**
  * The resource and view of a checked definition over `user_tables.<name>`, with the indexes its table has (none before
  * they are read): built with the schema builders, so it is checked, accessed and guarded as a resource of the config.

package/dist/user-tables/definition-resource.js

@@ -3,8 +3,10 @@ import { f, resource, view } from "@protobase/schema";
 import { indexServes } from "@protobase/query";
 //#region src/user-tables/definition-resource.ts
 const admins = ({ user }) => user?.roles?.includes("admin") ?? false;
+/** The most characters a text field takes: four bytes each at most, it always fits the entry of its btree index. */
+const maxTextLength = 500;
 const builders = {
-	text: () => f.text(),
+	text: () => f.text().max(500),
 	long_text: () => f.text(),
 	integer: () => f.integer(),
 	decimal: (field) => f.decimal({
@@ -59,4 +61,4 @@ const definitionResource = (definition, indexes = {
 	};
 };
 //#endregion
-export { definitionResource };
+export { definitionResource, maxTextLength };

package/dist/user-tables/definitions-hook.js

@@ -0,0 +1,80 @@
+import { badRequest } from "../problem.js";
+import { definitionsSchema, userTablesSchema } from "./names.js";
+import { checkDefinition } from "./check-definition.js";
+import { definitionResource } from "./definition-resource.js";
+import "./definitions-resources.js";
+import { readDefinitions, readUserTableColumns } from "./read-definitions.js";
+import { createTableSql, fieldSql, trigramIndexSql } from "./table-ddl.js";
+import { indexServes, tableIndexes } from "@protobase/query";
+import { sql } from "kysely";
+//#region src/user-tables/definitions-hook.ts
+const refuse = (field, message) => badRequest("invalid-record", `The request body is invalid: ${field}: ${message}`, { errors: [{
+	field,
+	code: "invalid-value",
+	message
+}] });
+const tablesTable = sql.table(`${definitionsSchema}.tables`);
+const raiseVersion = (trx, tableId) => sql`update ${tablesTable} set version = version + 1 where id = ${tableId}`.execute(trx);
+const lockedTable = async (trx, tableId) => {
+	const { rows } = await sql`select name, title_field from ${tablesTable} where id = ${tableId} for update`.execute(trx);
+	return rows[0];
+};
+const builtDefinition = async (trx, tableId) => {
+	const [definitions, columns] = await Promise.all([readDefinitions(trx), readUserTableColumns(trx)]);
+	const stored = definitions.find((definition) => definition.id === String(tableId));
+	const checked = checkDefinition(stored, columns);
+	if ("problem" in checked) throw new Error(`A definition the API wrote does not check: ${checked.problem}`);
+	const indexes = await tableIndexes(trx, definitionResource(checked.definition).resource.toModel());
+	definitionResource(checked.definition, indexes);
+	return {
+		definition: checked.definition,
+		indexes
+	};
+};
+const createTable = async (trx, table) => {
+	if (table.title_field != null) throw refuse("title_field", "Set the title field once its field is added");
+	const { rows } = await sql`select to_regclass(format('%I.%I', ${userTablesSchema}::text, ${table.name}::text)) is not null as found`.execute(trx);
+	if (rows[0].found) throw refuse("name", `The database already has a table "${table.name}" for the tables users add`);
+	await createTableSql(table.name).execute(trx);
+	await builtDefinition(trx, table.id);
+};
+const addField = async (trx, field, taken) => {
+	const table = await lockedTable(trx, field.table_id);
+	if (taken.includes(table.name)) throw refuse("table_id", `"${table.name}" is a resource in the app's code now, which owns its fields`);
+	const { rows } = await sql`select exists (select from pg_attribute a join pg_class c on c.oid = a.attrelid join pg_namespace n on n.oid = c.relnamespace
+    where n.nspname = ${userTablesSchema} and c.relname = ${table.name} and a.attname = ${field.name} and a.attnum > 0 and not a.attisdropped) as found`.execute(trx);
+	if (rows[0].found) throw refuse("name", `The table already has a column "${field.name}"`);
+	for (const statement of fieldSql(table.name, field)) await statement.execute(trx);
+	await raiseVersion(trx, field.table_id);
+	await builtDefinition(trx, field.table_id);
+};
+const setTitle = async (trx, table) => {
+	const title = table.title_field;
+	const { rows } = await sql`select type from ${sql.table(`${definitionsSchema}.fields`)} where table_id = ${table.id} and name = ${title}`.execute(trx);
+	if (rows[0]?.type !== "text" && rows[0]?.type !== "long_text") throw refuse("title_field", `"${title}" is not a text field of this table`);
+	const { definition, indexes } = await builtDefinition(trx, table.id);
+	if (indexes.indexes.some((index) => indexServes(index, title, "trigram", /* @__PURE__ */ new Set()))) return;
+	await trigramIndexSql(definition.name, title).execute(trx);
+};
+/**
+* Creates in the database what a write of a definition describes, inside its transaction, from the rows as written: a
+* new table, a new field's column and index, the title's search index. Changing a field raises its table's version, so
+* every process serves the change; any update of a table, a label or its title, raises it already, as the version column
+* of the record's ETag (`etagBump` in `records.ts`). A definition is never deleted.
+* `taken` holds the names of the app's resources and those Protobase adds.
+*/
+const definitionsHook = (taken) => async (event, trx) => {
+	const { name } = event.resource;
+	if (name !== "user_tables" && name !== "user_table_fields") return;
+	if (event.operation === "delete" || event.operation === "undelete") throw new Error(`A ${name} record is never deleted`);
+	const after = event.after;
+	if (name === "user_tables") {
+		if (event.operation === "create") return createTable(trx, after);
+		if (after.title_field != null && after.title_field !== event.before?.title_field) return setTitle(trx, after);
+		return;
+	}
+	if (event.operation === "create") return addField(trx, after, taken);
+	await raiseVersion(trx, after.table_id);
+};
+//#endregion
+export { definitionsHook };

package/dist/user-tables/definitions-resources.js

@@ -0,0 +1,54 @@
+import { definitionFieldTypes, definitionsSchema, nameProblem } from "./names.js";
+import { f, resource } from "@protobase/schema";
+//#region src/user-tables/definitions-resources.ts
+/** The names of the resources over the definitions: a table users add takes neither. */
+const tablesResourceName = "user_tables";
+const fieldsResourceName = "user_table_fields";
+const admins = ({ user }) => user?.roles?.includes("admin") ?? false;
+const never = () => false;
+const createOnly = { update: never };
+const accessOf = (roles) => roles ? { delete: never } : {
+	list: admins,
+	read: admins,
+	create: admins,
+	update: admins,
+	delete: never
+};
+const issue = (field, problem) => problem ? [{
+	field,
+	message: problem
+}] : [];
+/**
+* The definitions of the tables users add, as resources: a table at `/user_tables/<id>`, each of its fields at
+* `/user_table_fields/<table_id>,<name>`. Writing one creates its table or column in the database, in the same
+* transaction (`definitionsHook`). `taken` holds the names of the app's resources and those Protobase adds, which a
+* new table may not have.
+*/
+const definitionsResources = ({ roles, taken }) => {
+	return {
+		tables: resource(tablesResourceName).table(`${definitionsSchema}.tables`).fields({
+			id: f.bigint().readOnly().dbDefault().filterable().sortable(),
+			name: f.text().access(createOnly).filterable().sortable(),
+			singular_label: f.text().max(200),
+			plural_label: f.text().max(200),
+			title_field: f.text().optional(),
+			version: f.bigint().readOnly().dbDefault()
+		}).primaryKey((r) => r.id).explicitGrants().access(accessOf(roles)).validate((table) => [...issue("name", nameProblem(table.name, "table") ?? (taken.includes(table.name) || ["user_tables", "user_table_fields"].includes(table.name) ? `"${table.name}" is the name of a resource of the app` : void 0)), ...issue("title_field", table.title_field ? nameProblem(table.title_field, "field") : void 0)]),
+		fields: resource(fieldsResourceName).table(`${definitionsSchema}.fields`).fields({
+			table_id: f.relation(tablesResourceName).access(createOnly).filterable(),
+			name: f.text().access(createOnly),
+			label: f.text().max(200),
+			type: f.enum(definitionFieldTypes).access(createOnly),
+			required: f.boolean().default(false).access(createOnly),
+			position: f.integer().sortable(),
+			precision: f.integer().optional().access(createOnly),
+			scale: f.integer().optional().access(createOnly)
+		}).primaryKey((r) => [r.table_id, r.name]).explicitGrants().access(accessOf(roles)).validate((field) => [
+			...issue("name", nameProblem(field.name, "field")),
+			...issue("required", field.required ? "A field users add is optional: the records already there have no value for it" : void 0),
+			...field.type === "decimal" ? [...issue("precision", field.precision == null || field.precision < 1 || field.precision > 1e3 ? "A decimal needs a precision from 1 to 1000" : void 0), ...issue("scale", field.scale == null || field.scale < 0 || field.precision != null && field.scale > field.precision ? "A decimal needs a scale from 0 to its precision" : void 0)] : [...issue("precision", field.precision == null ? void 0 : "Only a decimal has a precision"), ...issue("scale", field.scale == null ? void 0 : "Only a decimal has a scale")]
+		])
+	};
+};
+//#endregion
+export { definitionsResources, fieldsResourceName, tablesResourceName };

package/dist/user-tables/names.js

@@ -1,3 +1,4 @@
+import { reservedWords } from "./reserved-words.js";
 //#region src/user-tables/names.ts
 /** The schema the definitions of the tables users add live in: `tables`, and `fields` of each. */
 const definitionsSchema = "table_definitions";
@@ -18,5 +19,13 @@ const definitionColumnTypes = {
 };
 const definitionFieldTypes = Object.keys(definitionColumnTypes);
 const isUserTableName = (name) => userTableName.test(name) && new TextEncoder().encode(name).length <= 63;
+/** The names a field never takes: the key's, and the API's for the record version. */
+const reservedFieldNames = ["id", "etag"];
+/** What is wrong with a name a table or field users add is given, or `undefined` when it may have it. */
+const nameProblem = (name, kind) => {
+	if (typeof name !== "string" || !isUserTableName(name)) return "Use lowercase letters, digits and \"_\", starting with a letter, at most 63 bytes";
+	if (reservedWords.has(name)) return `"${name}" is a word SQL reserves`;
+	if (kind === "field" && reservedFieldNames.includes(name)) return `"${name}" is the name of a field every table has`;
+};
 //#endregion
-export { definitionColumnTypes, definitionFieldTypes, definitionsSchema, isUserTableName, userTableName, userTablesSchema };
+export { definitionColumnTypes, definitionFieldTypes, definitionsSchema, isUserTableName, nameProblem, reservedFieldNames, userTableName, userTablesSchema };

package/dist/user-tables/owned-definitions.d.ts

@@ -0,0 +1,12 @@
+import { ResourceModel } from "@protobase/schema";
+import { Db } from "@protobase/query";
+//#region src/user-tables/owned-definitions.d.ts
+/** The user tables a resource in code owns, as `protobase eject` writes one: over `user_tables.<name>`, with that name. */
+export declare const ownedTableNames: (models: readonly ResourceModel[]) => string[];
+/**
+ * The delete of the definitions of the user tables a resource in code owns, with their fields; their tables and rows
+ * stay. `undefined` when no such definition is left. `protobase migration` writes it once the code that owns them has
+ * deployed, so a definition goes in a later deploy than the one that stopped reading it.
+ */
+export declare const ownedDefinitionsMigration: (db: Db, models: readonly ResourceModel[]) => Promise<string | undefined>;
+//#endregion

package/dist/user-tables/owned-definitions.js

@@ -0,0 +1,22 @@
+import { definitionsSchema } from "./names.js";
+import { sql } from "kysely";
+//#region src/user-tables/owned-definitions.ts
+/** The user tables a resource in code owns, as `protobase eject` writes one: over `user_tables.<name>`, with that name. */
+const ownedTableNames = (models) => models.filter((model) => model.table.schema === "user_tables" && model.table.name === model.name).map((model) => model.name);
+const literal = (text) => `'${text.replaceAll("'", "''")}'`;
+/**
+* The delete of the definitions of the user tables a resource in code owns, with their fields; their tables and rows
+* stay. `undefined` when no such definition is left. `protobase migration` writes it once the code that owns them has
+* deployed, so a definition goes in a later deploy than the one that stopped reading it.
+*/
+const ownedDefinitionsMigration = async (db, models) => {
+	const owned = ownedTableNames(models);
+	if (owned.length === 0) return;
+	const { rows: found } = await sql`select to_regclass(${`${definitionsSchema}.tables`}) is not null as found`.execute(db);
+	if (!found[0].found) return;
+	const { rows } = await sql`select name from ${sql.table(`${definitionsSchema}.tables`)} where name = any(${owned}) order by name`.execute(db);
+	if (rows.length === 0) return;
+	return `delete from ${definitionsSchema}.tables where name in (${rows.map((row) => literal(row.name)).join(", ")});`;
+};
+//#endregion
+export { ownedDefinitionsMigration, ownedTableNames };

package/dist/user-tables/reloading-admin.d.ts

@@ -27,8 +27,9 @@ export type ReloadingAdminInput = {
  * admin answers it not found or invalid, as it does a resource or field it does not know, and then is answered again by
  * the admin built anew. A request finishes on the admin it started with, and a WebSocket keeps the admin it opened
  * with. An admin that does not build with the new definitions is reported, and the one before keeps serving.
- * `reload()` reads the version at once, for the process that changed a definition. The jobs, the realtime prune and
- * the field decrypter are those of `first`.
+ * A write to a definition that succeeded rebuilds it at once, before it is answered, so the next request of the writer
+ * finds the change. `reload()` reads the version at once, for the process that changed a definition another way. The
+ * jobs, the realtime prune and the field decrypter are those of `first`.
  */
 export declare const reloadingAdmin: ({ first, version, readVersion, readTables, build, report, statementTimeoutMs, now }: ReloadingAdminInput) => Hono<AdminEnv, import("hono/types").BlankSchema, "/"> & {
   jobs: JobDefinition[];

package/dist/user-tables/reloading-admin.js

@@ -1,4 +1,5 @@
 import { createErrorHandler } from "../error-handler.js";
+import "./definitions-resources.js";
 import { latestAdmin } from "./latest-admin.js";
 import { Hono } from "hono";
 //#region src/user-tables/reloading-admin.ts
@@ -10,14 +11,16 @@ const replayable = async (request) => {
 	const body = await request.arrayBuffer();
 	return () => new Request(request, { body });
 };
+const writesDefinitions = (request, path) => request.method !== "GET" && request.method !== "HEAD" && (path.endsWith(":batchWrite") || path.split("/").some((segment) => segment === "user_tables" || segment === "user_table_fields"));
 /**
 * The app's admin, rebuilt when the tables users add change, so every process serves a new definition without a
 * restart. `/meta` reads the definitions version first; any other request at most once a second, and once more when the
 * admin answers it not found or invalid, as it does a resource or field it does not know, and then is answered again by
 * the admin built anew. A request finishes on the admin it started with, and a WebSocket keeps the admin it opened
 * with. An admin that does not build with the new definitions is reported, and the one before keeps serving.
-* `reload()` reads the version at once, for the process that changed a definition. The jobs, the realtime prune and
-* the field decrypter are those of `first`.
+* A write to a definition that succeeded rebuilds it at once, before it is answered, so the next request of the writer
+* finds the change. `reload()` reads the version at once, for the process that changed a definition another way. The
+* jobs, the realtime prune and the field decrypter are those of `first`.
 */
 const reloadingAdmin = ({ first, version, readVersion, readTables, build, report, statementTimeoutMs, now }) => {
 	const rebuild = async (current) => {
@@ -36,8 +39,7 @@ const reloadingAdmin = ({ first, version, readVersion, readTables, build, report
 		rebuild,
 		...now && { now }
 	});
-	const answer = async (request, env) => {
-		const path = new URL(request.url).pathname;
+	const answerOn = async (request, env, path) => {
 		const atOnce = path === first.metaPath || path.startsWith(`${first.metaPath}/`);
 		const admin = await latest.get(atOnce);
 		const again = atOnce ? void 0 : await replayable(request);
@@ -47,6 +49,12 @@ const reloadingAdmin = ({ first, version, readVersion, readTables, build, report
 		const fresh = await latest.get(true);
 		return fresh === admin ? answered : fresh.fetch(again(), env);
 	};
+	const answer = async (request, env) => {
+		const path = new URL(request.url).pathname;
+		const answered = await answerOn(request, env, path);
+		if (answered.ok && writesDefinitions(request, path)) await latest.get(true);
+		return answered;
+	};
 	const app = new Hono();
 	app.onError(createErrorHandler(report, statementTimeoutMs));
 	app.all("*", (c) => answer(c.req.raw, c.env));

package/dist/user-tables/reserved-words.js

@@ -0,0 +1,87 @@
+//#region src/user-tables/reserved-words.ts
+/**
+* The key words Postgres 18 reserves, `select word from pg_get_keywords() where catcode = 'R'`: a table or field users
+* add never takes one, so its name works unquoted in any SQL a developer writes against it.
+*/
+const reservedWords = /* @__PURE__ */ new Set([
+	"all",
+	"analyse",
+	"analyze",
+	"and",
+	"any",
+	"array",
+	"as",
+	"asc",
+	"asymmetric",
+	"both",
+	"case",
+	"cast",
+	"check",
+	"collate",
+	"column",
+	"constraint",
+	"create",
+	"current_catalog",
+	"current_date",
+	"current_role",
+	"current_time",
+	"current_timestamp",
+	"current_user",
+	"default",
+	"deferrable",
+	"desc",
+	"distinct",
+	"do",
+	"else",
+	"end",
+	"except",
+	"false",
+	"fetch",
+	"for",
+	"foreign",
+	"from",
+	"grant",
+	"group",
+	"having",
+	"in",
+	"initially",
+	"intersect",
+	"into",
+	"lateral",
+	"leading",
+	"limit",
+	"localtime",
+	"localtimestamp",
+	"not",
+	"null",
+	"offset",
+	"on",
+	"only",
+	"or",
+	"order",
+	"placing",
+	"primary",
+	"references",
+	"returning",
+	"select",
+	"session_user",
+	"some",
+	"symmetric",
+	"system_user",
+	"table",
+	"then",
+	"to",
+	"trailing",
+	"true",
+	"union",
+	"unique",
+	"user",
+	"using",
+	"variadic",
+	"when",
+	"where",
+	"window",
+	"with"
+]);
+//#endregion
+export { reservedWords };

package/dist/user-tables/schema-sql.js

@@ -1,15 +1,17 @@
 import { definitionFieldTypes, definitionsSchema, userTableName, userTablesSchema } from "./names.js";
 //#region src/user-tables/schema-sql.ts
 const nameCheck = (column) => `check (${column} ~ '${userTableName.source}' and octet_length(${column}) <= 63)`;
-/** The table of definitions: one row per table users add, its labels and a version that each change of it raises. */
+/** The table of definitions: one row per table users add, its labels and a version, 1 when added, that each change of it raises. */
 const tablesSql = () => `create table ${definitionsSchema}.tables (
   id bigint generated always as identity primary key,
   name text not null unique ${nameCheck("name")},
   singular_label text not null,
   plural_label text not null,
   title_field text ${nameCheck("title_field")},
-  version bigint not null check (version > 0)
+  version bigint not null default 1 check (version > 0)
 )`;
+/** Gives a definitions table made before new definitions started at version 1 that default. */
+const versionDefaultSql = () => `alter table ${definitionsSchema}.tables alter column version set default 1`;
 /** The fields of each definition, in order, each with its label and type; a decimal names its precision and scale. */
 const fieldsSql = () => `create table ${definitionsSchema}.fields (
   table_id bigint not null references ${definitionsSchema}.tables (id) on delete cascade,
@@ -32,4 +34,4 @@ const schemasSql = () => [
 	`grant usage, create on schema ${userTablesSchema} to current_user`
 ];
 //#endregion
-export { fieldsSql, schemasSql, tablesSql };
+export { fieldsSql, schemasSql, tablesSql, versionDefaultSql };

package/dist/user-tables/schema.js

@@ -1,11 +1,12 @@
 import { migrationCommand } from "../changes/capture-schema.js";
 import { definitionsSchema, userTablesSchema } from "./names.js";
-import { fieldsSql, schemasSql, tablesSql } from "./schema-sql.js";
+import { fieldsSql, schemasSql, tablesSql, versionDefaultSql } from "./schema-sql.js";
 import { sql } from "kysely";
 //#region src/user-tables/schema.ts
 const readUserTablesSchema = async (db) => {
 	const { rows } = await sql`select
     to_regclass(${`${definitionsSchema}.tables`}) is not null as tables,
+    exists (select from information_schema.columns where table_schema = ${definitionsSchema} and table_name = 'tables' and column_name = 'version' and column_default is not null) as "versionDefault",
     to_regclass(${`${definitionsSchema}.fields`}) is not null as fields,
     exists (select from pg_namespace where nspname = ${userTablesSchema}) as data,
     exists (select from pg_extension where extname = 'pg_trgm') as trgm`.execute(db);
@@ -17,18 +18,18 @@ const readUserTablesSchema = async (db) => {
 */
 const userTablesMigration = async (db) => {
 	const found = await readUserTablesSchema(db);
-	if (found.tables && found.fields && found.data && found.trgm) return void 0;
+	if (found.tables && found.versionDefault && found.fields && found.data && found.trgm) return void 0;
 	return `${[
 		...schemasSql(),
-		...found.tables ? [] : [tablesSql()],
+		...found.tables ? found.versionDefault ? [] : [versionDefaultSql()] : [tablesSql()],
 		...found.fields ? [] : [fieldsSql()]
 	].join(";\n\n")};`;
 };
 /** Refuses to go on while the schemas of user tables are missing; the project's migrations add them. */
 const checkUserTablesSchema = async (db) => {
 	const found = await readUserTablesSchema(db);
-	if (found.tables && found.fields && found.data && found.trgm) return;
-	throw new Error(`The ${definitionsSchema} or ${userTablesSchema} schema, or pg_trgm, is missing, and userTables keeps the tables users add there. Write it as a migration with \`${migrationCommand}\`, apply it with the project's migrations, then start again.`);
+	if (found.tables && found.versionDefault && found.fields && found.data && found.trgm) return;
+	throw new Error(`The ${definitionsSchema} or ${userTablesSchema} schema, the default of a definition's version, or pg_trgm, is missing, and userTables keeps the tables users add there. Write it as a migration with \`${migrationCommand}\`, apply it with the project's migrations, then start again.`);
 };
 //#endregion
 export { checkUserTablesSchema, userTablesMigration };

package/dist/user-tables/table-ddl.js

@@ -0,0 +1,56 @@
+import { nameProblem, userTablesSchema } from "./names.js";
+import { sql } from "kysely";
+//#region src/user-tables/table-ddl.ts
+const checkedName = (name, kind) => {
+	const problem = nameProblem(name, kind);
+	if (problem) throw new Error(`The ${kind} name ${JSON.stringify(name)} cannot reach SQL: ${problem}`);
+	return name;
+};
+const tableId = (table) => sql.id(userTablesSchema, checkedName(table, "table"));
+const decimalOf = (precision, scale) => {
+	if (!Number.isInteger(precision) || precision < 1 || precision > 1e3) throw new Error(`The precision ${JSON.stringify(precision)} is not a whole number from 1 to 1000`);
+	if (!Number.isInteger(scale) || scale < 0 || scale > precision) throw new Error(`The scale ${JSON.stringify(scale)} is not a whole number from 0 to the precision`);
+	return sql.raw(`numeric(${precision}, ${scale})`);
+};
+const columnType = (field) => {
+	switch (field.type) {
+		case "text":
+		case "long_text": return sql.raw("text");
+		case "integer": return sql.raw("integer");
+		case "decimal": return decimalOf(field.precision, field.scale);
+		case "boolean": return sql.raw("boolean");
+		case "date": return sql.raw("date");
+		case "timestamp": return sql.raw("timestamptz");
+		case "json": return sql.raw("jsonb");
+		default: throw new Error(`The field type ${JSON.stringify(field.type)} has no column type`);
+	}
+};
+/** The index a field's column gets so its list filters and sorts: btree, a trigram one for long text, which outgrows a btree entry, and none for json. */
+const indexKind = (type) => {
+	switch (type) {
+		case "text":
+		case "integer":
+		case "decimal":
+		case "boolean":
+		case "date":
+		case "timestamp": return "btree";
+		case "long_text": return "trigram";
+		case "json": return;
+		default: throw new Error(`The field type ${JSON.stringify(type)} has no index kind`);
+	}
+};
+/** The new table, with its key alone: its fields are added as columns. */
+const createTableSql = (table) => sql`create table ${tableId(table)} (id bigint generated always as identity primary key)`;
+/** The field's column: nullable and without a default, so the records already there read it as empty. */
+const addColumnSql = (table, field) => sql`alter table ${tableId(table)} add column ${sql.id(checkedName(field.name, "field"))} ${columnType(field)}`;
+const btreeSql = (table, column) => sql`create index on ${tableId(table)} (${sql.id(checkedName(column, "field"))})`;
+/** The pg_trgm index that search and text filters need on a text column. */
+const trigramIndexSql = (table, column) => sql`create index on ${tableId(table)} using gin (${sql.id(checkedName(column, "field"))} gin_trgm_ops)`;
+/** The column and the index of a field added to a table. */
+const fieldSql = (table, field) => {
+	const kind = indexKind(field.type);
+	const index = kind === "btree" ? [btreeSql(table, field.name)] : kind === "trigram" ? [trigramIndexSql(table, field.name)] : [];
+	return [addColumnSql(table, field), ...index];
+};
+//#endregion
+export { addColumnSql, createTableSql, fieldSql, indexKind, trigramIndexSql };

package/dist/user-tables/user-table-resources.d.ts

@@ -1,10 +1,15 @@
+import { CheckedDefinition } from "./check-definition.js";
 import { definitionResource } from "./definition-resource.js";
 import { Db } from "@protobase/query";
 //#region src/user-tables/user-table-resources.d.ts
-/** What the stored definitions serve: a resource and view for each that fits the database, and why each other one is left out. */
+/**
+ * What the stored definitions serve: a resource and view for each that fits the database, the definitions they are
+ * built from, as `protobase eject` writes them into code, and why each other one is left out.
+ */
 export type UserTables = {
   resources: Array<ReturnType<typeof definitionResource>['resource']>;
   views: Array<ReturnType<typeof definitionResource>['view']>;
+  definitions: CheckedDefinition[];
   problems: string[];
 };
 /**

package/dist/user-tables/user-table-resources.js

@@ -13,6 +13,7 @@ const userTableResources = async (db) => {
 	const tables = {
 		resources: [],
 		views: [],
+		definitions: [],
 		problems: []
 	};
 	for (const stored of definitions) {
@@ -25,6 +26,7 @@ const userTableResources = async (db) => {
 		const { resource, view } = definitionResource(checked.definition, indexes);
 		tables.resources.push(resource);
 		tables.views.push(view);
+		tables.definitions.push(checked.definition);
 	}
 	return tables;
 };

package/dist/web-app/app-icons.d.ts

@@ -1,7 +1,7 @@
 import { pngIcons } from "@protobase/schema/png-icons";
 //#region src/web-app/app-icons.d.ts
 export type PngIcon = keyof typeof pngIcons;
-/** The icons a project has of its own: `favicon` when the favicon is its own rather than Protobase's, and its PNGs. */
+/** The icons a project has of its own: `favicon` when the favicon is its own rather than the neutral mark, and its PNGs. */
 export type AppIcons = {
   favicon: boolean;
   png: PngIcon[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.67.2",
+  "version": "0.67.4",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -43,9 +43,9 @@
     "@better-auth/sso": "^1.7.12",
     "@livekit/protocol": "1.53.1",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.67.2",
-    "@protobase/query": "0.67.2",
-    "@protobase/schema": "0.67.2",
+    "@protobase/layout": "0.67.4",
+    "@protobase/query": "0.67.4",
+    "@protobase/schema": "0.67.4",
     "@react-email/render": "^2.1.0",
     "@react-pdf/primitives": "^4.4.0",
     "@react-pdf/renderer": "^4.9.0",