@protobase/server 0.7.0 → 0.8.0

package/dist/better-auth/organizations/organization-plugin.js

@@ -0,0 +1,128 @@
+import "./role-definitions.js";
+import { checkAppRoleChange, effectiveRoles, globalRoles, parseAppRoles } from "./app-roles.js";
+import { findMember } from "./store.js";
+import { invitationEmail } from "./invitation-mail.js";
+import { invitationLink, invitationToken } from "./invitation-token.js";
+import { APIError } from "better-auth/api";
+import { organization } from "better-auth/plugins/organization";
+//#region src/better-auth/organizations/organization-plugin.ts
+/** The snake_case names of the organization plugin's tables and columns, with the app roles of members and invitations. */
+const organizationNames = {
+	organization: { fields: { createdAt: "created_at" } },
+	member: {
+		fields: {
+			organizationId: "organization_id",
+			userId: "user_id",
+			createdAt: "created_at"
+		},
+		additionalFields: { appRoles: {
+			type: "string[]",
+			required: false,
+			defaultValue: [],
+			input: false,
+			fieldName: "app_roles"
+		} }
+	},
+	invitation: {
+		fields: {
+			organizationId: "organization_id",
+			inviterId: "inviter_id",
+			expiresAt: "expires_at",
+			createdAt: "created_at"
+		},
+		additionalFields: { appRoles: {
+			type: "string[]",
+			required: false,
+			defaultValue: [],
+			input: true,
+			fieldName: "app_roles"
+		} }
+	},
+	session: { fields: { activeOrganizationId: "active_organization_id" } }
+};
+/** Runs Protobase's hook, then the project's, with the same data; data either returns is merged, the project's last. */
+const mergeHooks = (own, project = {}) => {
+	const keys = /* @__PURE__ */ new Set([...Object.keys(own), ...Object.keys(project)]);
+	return Object.fromEntries([...keys].map((key) => {
+		const first = own[key];
+		const second = project[key];
+		if (!first || !second) return [key, first ?? second];
+		const both = async (...args) => {
+			const data = {
+				...(await first(...args))?.data,
+				...(await second(...args))?.data
+			};
+			return Object.keys(data).length > 0 ? { data } : void 0;
+		};
+		return [key, both];
+	}));
+};
+/**
+* Better Auth's organization plugin as Protobase uses it: organization roles `owner`, `admin` and `member` with Better
+* Auth's own access control, app roles on members and invitations, ids from `generateId`, creators holding
+* `creatorAppRoles`, invitations checked against what the inviter may give and mailed with a signed link, and the
+* project's hooks after Protobase's.
+*/
+const organizationPlugin = ({ resolved, secret, mailer, context }) => {
+	const { definitions } = resolved;
+	const own = {
+		beforeCreateOrganization: async () => ({ data: { id: await resolved.generateId() } }),
+		beforeAddMember: async ({ member }) => member.role === "owner" && member.appRoles === void 0 ? { data: { appRoles: resolved.creatorAppRoles } } : void 0,
+		afterCreateOrganization: async ({ organization, member }) => {
+			await resolved.options.onCreated?.({
+				organization,
+				member: {
+					...member,
+					appRoles: parseAppRoles(member.appRoles)
+				}
+			});
+		},
+		beforeCreateInvitation: async ({ invitation, inviter }) => {
+			const membership = await findMember((await context()).adapter, {
+				organizationId: invitation.organizationId,
+				userId: inviter.id
+			});
+			const held = effectiveRoles(globalRoles(inviter.role), membership?.appRoles);
+			const refusal = checkAppRoleChange({
+				held,
+				before: [],
+				after: parseAppRoles(invitation.appRoles),
+				definitions
+			});
+			if (refusal) throw new APIError(refusal.status, {
+				code: refusal.code,
+				message: refusal.message
+			});
+		},
+		afterRemoveMember: async ({ member, user }) => {
+			if (globalRoles(user.role).length > 0) return;
+			const { internalAdapter } = await context();
+			for (const session of await internalAdapter.listSessions(member.userId)) if (session.activeOrganizationId === member.organizationId) await internalAdapter.updateSession(session.token, { activeOrganizationId: null });
+		},
+		beforeDeleteOrganization: async ({ organization }) => {
+			await resolved.options.beforeDelete?.(organization);
+		}
+	};
+	return organization({
+		creatorRole: "owner",
+		allowUserToCreateOrganization: (user) => resolved.create === "everyone" || globalRoles(user.role).includes("admin"),
+		invitationExpiresIn: resolved.invitationExpiresIn,
+		membershipLimit: resolved.membershipLimit,
+		requireEmailVerificationOnInvitation: true,
+		cancelPendingInvitationsOnReInvite: true,
+		schema: organizationNames,
+		...mailer && { sendInvitationEmail: async ({ invitation, organization, inviter }) => {
+			const token = await invitationToken(secret, invitation);
+			await mailer.send(invitationEmail({
+				to: invitation.email,
+				inviter: inviter.user.name || inviter.user.email,
+				organization: organization.name,
+				url: invitationLink(resolved.invitationUrl, token),
+				expiresAt: invitation.expiresAt
+			}));
+		} },
+		organizationHooks: mergeHooks(own, resolved.options.hooks)
+	});
+};
+//#endregion
+export { organizationNames, organizationPlugin };

package/dist/better-auth/organizations/protobase-plugin.js

@@ -0,0 +1,21 @@
+import { invitationEndpoints, invitationLinkHook } from "./invitation-endpoints.js";
+import { memberEndpoints } from "./member-endpoints.js";
+//#region src/better-auth/organizations/protobase-plugin.ts
+/**
+* Protobase's endpoints beside Better Auth's organization plugin: invitation links that also make accounts, app roles,
+* handing ownership over, and finding organizations for people with a global role. Without a mailer, whoever invites
+* gets the link in the answer.
+*/
+const protobaseOrganizationPlugin = ({ resolved, mail }) => ({
+	id: "protobase-organizations",
+	endpoints: {
+		...invitationEndpoints({
+			resolved,
+			mail
+		}),
+		...memberEndpoints({ resolved })
+	},
+	hooks: { after: mail ? [] : [invitationLinkHook(resolved)] }
+});
+//#endregion
+export { protobaseOrganizationPlugin };

package/dist/better-auth/organizations/role-definitions.d.ts

@@ -0,0 +1,15 @@
+//#region src/better-auth/organizations/role-definitions.d.ts
+/** A role: its label, or its label and the other roles its holders may also give (see `grantableRoles`). */
+export type RoleDefinition = string | {
+  label: string;
+  grants?: string[];
+};
+/** The roles of an app: names only, or each with its definition. */
+export type RolesInput = string[] | Record<string, RoleDefinition>;
+export type RoleDefinitions = {
+  /** `admin` first, then the others in the order given. */
+  names: string[];
+  labels: Record<string, string>;
+  grants: Record<string, string[]>;
+};
+//#endregion

package/dist/better-auth/organizations/role-definitions.js

@@ -0,0 +1,56 @@
+//#region src/better-auth/organizations/role-definitions.ts
+const roleName = /^[a-z][a-z0-9_-]*$/;
+/** The superuser: holds every role in every organization. */
+const superuserRole = "admin";
+/** The admin plugin's role for an account without a global role; in organization mode it grants nothing. */
+const noGlobalRole = "user";
+const organizationRoleNames = ["owner", "member"];
+const builtInLabels = {
+	[superuserRole]: "Superuser",
+	[noGlobalRole]: "No global role"
+};
+const entriesOf = (input) => Array.isArray(input) ? input.map((name) => [name, void 0]) : Object.entries(input);
+/**
+* The roles with `admin` first (added when missing), their labels and grants. With `organizations`, every role needs a
+* label (`admin` and `user` have one built in), `user` is always there, as the role of an account without a global
+* role, and `owner` and `member` are refused, since they name organization roles.
+*/
+const roleDefinitions = (input = ["admin", "user"], { organizations = false } = {}) => {
+	const entries = entriesOf(input);
+	const bad = entries.find(([name]) => !roleName.test(name));
+	if (bad) throw new Error(`Invalid role "${bad[0]}": use lowercase letters, digits, "_" or "-"`);
+	const given = new Map(entries);
+	const names = [
+		superuserRole,
+		...new Set(entries.map(([name]) => name).filter((name) => name !== superuserRole)),
+		...organizations && !given.has("user") ? [noGlobalRole] : []
+	];
+	const labels = {};
+	const grants = {};
+	for (const name of names) {
+		const definition = given.get(name);
+		const label = typeof definition === "string" ? definition : definition?.label ?? builtInLabels[name];
+		if (label !== void 0) labels[name] = label;
+		grants[name] = typeof definition === "object" ? definition.grants ?? [] : [];
+		const unknown = grants[name].find((granted) => !names.includes(granted));
+		if (unknown !== void 0) throw new Error(`Role "${name}" grants "${unknown}", which is not one of the roles: ${names.join(", ")}`);
+	}
+	if (!organizations) return {
+		names,
+		labels,
+		grants
+	};
+	const reserved = names.find((name) => organizationRoleNames.includes(name));
+	if (reserved) throw new Error(`Role "${reserved}" names an organization role; choose another name`);
+	const unlabelled = names.find((name) => labels[name] === void 0);
+	if (unlabelled) throw new Error(`Role "${unlabelled}" needs a label: with organizations, roles are given as { name: 'Label' }`);
+	return {
+		names,
+		labels,
+		grants
+	};
+};
+/** The roles a member of an organization can hold there: every role but the superuser's and the placeholder. */
+const membershipRoles = ({ names }) => names.filter((name) => name !== "admin" && name !== "user");
+//#endregion
+export { membershipRoles, noGlobalRole, roleDefinitions, superuserRole };

package/dist/better-auth/organizations/session-organization.js

@@ -0,0 +1,68 @@
+import { globalRoles } from "./app-roles.js";
+import { initialOrganization } from "./active-organization.js";
+import { findMember, findOrganization, membershipsOf, organizationRoleOf, summaries } from "./store.js";
+//#region src/better-auth/organizations/session-organization.ts
+/** The user field that keeps the organization someone last worked in, for their next sign-in. */
+const lastOrganizationField = { lastOrganizationId: {
+	type: "string",
+	required: false,
+	input: false,
+	fieldName: "last_organization_id"
+} };
+/** Whether someone may work in an organization: a member, or holding a global role, which enters every one. */
+const mayEnter = async (adapter, user, organizationId) => {
+	if (await findMember(adapter, {
+		organizationId,
+		userId: user.id
+	})) return true;
+	return globalRoles(user.role).length > 0 && await findOrganization(adapter, organizationId) !== null;
+};
+/**
+* The token's organization claims for a session: `org`, the active organization, while the person may still work in
+* it; for a member also `org_role`, their organization role, and `app_roles`, their app roles there. Read when the
+* token is issued, so a removed member or a changed role shows within the token's lifetime.
+*/
+const organizationClaims = async (adapter, user, activeOrganizationId) => {
+	if (!activeOrganizationId) return {};
+	const member = await findMember(adapter, {
+		organizationId: activeOrganizationId,
+		userId: user.id
+	});
+	if (member) return {
+		org: activeOrganizationId,
+		org_role: organizationRoleOf(member),
+		app_roles: member.appRoles
+	};
+	if (await mayEnter(adapter, user, activeOrganizationId)) return { org: activeOrganizationId };
+	return {};
+};
+/**
+* Better Auth's session hooks for organizations: a new session starts in the organization the person last worked in
+* (`initialOrganization`), and a session's change of organization is kept on the user as the next one's start.
+*/
+const sessionOrganizationHooks = (context) => ({
+	create: { before: async (session) => {
+		const { adapter, internalAdapter } = await context();
+		const user = await internalAdapter.findUserById(session.userId);
+		if (!user) return;
+		const last = user.lastOrganizationId;
+		const activeOrganizationId = initialOrganization({
+			memberships: summaries(await membershipsOf(adapter, user.id)),
+			last,
+			entersAny: globalRoles(user.role).length > 0,
+			lastExists: Boolean(last) && await findOrganization(adapter, last) !== null
+		});
+		return activeOrganizationId ? { data: {
+			...session,
+			activeOrganizationId
+		} } : void 0;
+	} },
+	update: { after: async (session) => {
+		if (!session.activeOrganizationId) return;
+		const { internalAdapter } = await context();
+		const user = await internalAdapter.findUserById(session.userId);
+		if (user && user.lastOrganizationId !== session.activeOrganizationId) await internalAdapter.updateUser(session.userId, { lastOrganizationId: session.activeOrganizationId });
+	} }
+});
+//#endregion
+export { lastOrganizationField, mayEnter, organizationClaims, sessionOrganizationHooks };

package/dist/better-auth/organizations/store.d.ts

@@ -0,0 +1,19 @@
+import { createAuthMiddleware } from "better-auth/api";
+//#region src/better-auth/organizations/store.d.ts
+export type OrganizationRole = 'owner' | 'admin' | 'member';
+export type StoredMember = {
+  id: string;
+  organizationId: string;
+  userId: string;
+  role: string;
+  appRoles: string[];
+  createdAt: Date;
+};
+export type StoredOrganization = {
+  id: string;
+  name: string;
+  slug: string;
+  logo?: string | null;
+  createdAt: Date;
+};
+//#endregion

package/dist/better-auth/organizations/store.js

@@ -0,0 +1,73 @@
+import { parseAppRoles } from "./app-roles.js";
+//#region src/better-auth/organizations/store.ts
+/** Better Auth's `findMany` returns 100 rows unless told otherwise; these lists are read whole. */
+const everyRow = 1e5;
+const memberOf = (row) => ({
+	...row,
+	appRoles: parseAppRoles(row.appRoles)
+});
+/** Better Auth stores several organization roles comma separated; Protobase gives each member one. */
+const organizationRoleOf = (member) => {
+	const roles = member.role.split(",").map((name) => name.trim());
+	return roles.includes("owner") ? "owner" : roles.includes("admin") ? "admin" : "member";
+};
+const findMember = async (adapter, where) => {
+	const row = await adapter.findOne({
+		model: "member",
+		where: [{
+			field: "organizationId",
+			value: where.organizationId
+		}, {
+			field: "userId",
+			value: where.userId
+		}]
+	});
+	return row ? memberOf(row) : void 0;
+};
+const findMemberById = async (adapter, id) => {
+	const row = await adapter.findOne({
+		model: "member",
+		where: [{
+			field: "id",
+			value: id
+		}]
+	});
+	return row ? memberOf(row) : void 0;
+};
+const membershipsOf = async (adapter, userId) => (await adapter.findMany({
+	model: "member",
+	where: [{
+		field: "userId",
+		value: userId
+	}],
+	limit: everyRow
+})).map(memberOf);
+const membersOf = async (adapter, organizationId) => (await adapter.findMany({
+	model: "member",
+	where: [{
+		field: "organizationId",
+		value: organizationId
+	}],
+	limit: everyRow
+})).map(memberOf);
+const findOrganization = (adapter, id) => adapter.findOne({
+	model: "organization",
+	where: [{
+		field: "id",
+		value: id
+	}]
+});
+const summaries = (members) => members.map(({ organizationId, createdAt }) => ({
+	organizationId,
+	createdAt
+}));
+const setAppRoles = (adapter, memberId, appRoles) => adapter.update({
+	model: "member",
+	where: [{
+		field: "id",
+		value: memberId
+	}],
+	update: { appRoles: [...appRoles] }
+});
+//#endregion
+export { everyRow, findMember, findMemberById, findOrganization, membersOf, membershipsOf, organizationRoleOf, setAppRoles, summaries };

package/dist/better-auth/staff-checks.js

@@ -51,7 +51,11 @@ const accountChanges = [
 	"/passkey/generate-register-options",
 	"/passkey/verify-registration",
 	"/passkey/update-passkey",
-	"/passkey/delete-passkey"
+	"/passkey/delete-passkey",
+	"/invitation/accept",
+	"/organization/leave",
+	"/organization/transfer-ownership",
+	"/organization/delete"
 ];
 const staffCannotChange = {
 	code: "STAFF_CANNOT_CHANGE_SIGN_IN",

package/dist/better-auth/staff-sign-in-endpoints.js

@@ -6,8 +6,8 @@ import { policyRefusal, staffSignInPath } from "./sign-in-enforcement.js";
 import { staffSignInEmail } from "./sign-in-mail.js";
 import { logStaffSignIn } from "./staff-log.js";
 import { APIError, createAuthEndpoint } from "better-auth/api";
-import * as z$1 from "zod";
 import { expireCookie, setSessionCookie } from "better-auth/cookies";
+import * as z$1 from "zod";
 //#region src/better-auth/staff-sign-in-endpoints.ts
 const startLifetimeMs = 6e5;
 const stateCookie = "staff_state";

package/dist/better-auth/status-route.js

@@ -1,3 +1,4 @@
+import { membershipRoles } from "./organizations/role-definitions.js";
 import { effectiveSignInPolicy } from "./sign-in-policy.js";
 import { readSignInPolicy } from "./policy-store.js";
 import { hasUsers } from "./users.js";
@@ -8,8 +9,9 @@ import { Hono } from "hono";
 * `signInMethods`, the ways to sign in the sign-in policy leaves on (`password`, `emailCode`, `passkey`), so it offers
 * only those; `passwordReset` when reset mail can be sent and passwords are on, so it offers "Forgot password?" only
 * then; the ids of the `socialProviders` people can sign in with, so it offers "Continue with GitHub" when `github` is
-* one; `platformSignIn`, the id and name of the platform's provider when it is one of them; and `staffSignIn`, the
-* operator provider's name, when staff can sign in as people.
+* one; `platformSignIn`, the id and name of the platform's provider when it is one of them; `staffSignIn`, the
+* operator provider's name, when staff can sign in as people; and with organizations, who may create them and the roles
+* with their labels, `membership` for those a member can hold, and the roles each one's holders may also give.
 */
 const statusRoute = (auth) => {
 	const app = new Hono();
@@ -31,7 +33,16 @@ const statusRoute = (auth) => {
 			passwordReset: auth.passwordReset && policy.password === "allowed",
 			socialProviders,
 			...platformSignIn && { platformSignIn },
-			...staffSignIn && { staffSignIn }
+			...staffSignIn && { staffSignIn },
+			...auth.organizations && { organizations: {
+				create: auth.organizations.create,
+				roles: auth.roleDefinitions.names.map((name) => ({
+					name,
+					label: auth.roleDefinitions.labels[name] ?? name,
+					membership: membershipRoles(auth.roleDefinitions).includes(name),
+					grants: auth.roleDefinitions.grants[name] ?? []
+				}))
+			} }
 		});
 	});
 	return app;

package/dist/better-auth/users.d.ts

@@ -28,7 +28,8 @@ export declare const hasUsers: (auth: AdminAuth) => Promise<boolean>;
  * Creates a user directly in the admin store. Host side only (no HTTP route creates accounts while the store is empty):
  * the first user is always an `admin`, later ones get `role` (default `user`). The address counts as verified, so the
  * user can also sign in with an emailed code. `accounts` link the user to sign-in providers up front, so a provider
- * signs them in by its own id whatever address it reports; one that signs in another user already is refused.
+ * signs them in by its own id whatever address it reports; one that signs in another user already is refused. With
+ * organizations, the first user also owns every organization without members, such as those an app's seed made.
  */
 export declare const createUser: (auth: AdminAuth, input: NewUser) => Promise<{
   id: string;

package/dist/better-auth/users.js

@@ -1,4 +1,5 @@
 import { parseRoles } from "./parse-roles.js";
+import { ownOrganizationsWithoutMembers } from "./organizations/host.js";
 //#region src/better-auth/users.ts
 /** The roles this auth instance allows, `admin` first. */
 const roleChoices = (auth) => [...auth.roles];
@@ -21,7 +22,8 @@ const checkAccounts = async (auth, accounts) => {
 * Creates a user directly in the admin store. Host side only (no HTTP route creates accounts while the store is empty):
 * the first user is always an `admin`, later ones get `role` (default `user`). The address counts as verified, so the
 * user can also sign in with an emailed code. `accounts` link the user to sign-in providers up front, so a provider
-* signs them in by its own id whatever address it reports; one that signs in another user already is refused.
+* signs them in by its own id whatever address it reports; one that signs in another user already is refused. With
+* organizations, the first user also owns every organization without members, such as those an app's seed made.
 */
 const createUser = async (auth, input) => {
 	const first = !await hasUsers(auth);
@@ -41,6 +43,7 @@ const createUser = async (auth, input) => {
 		userId: user.id,
 		...account
 	});
+	if (first && auth.organizations) await ownOrganizationsWithoutMembers(auth, user.id);
 	return {
 		id: user.id,
 		email: user.email,

package/dist/create-admin.d.ts

@@ -1,6 +1,8 @@
 import { AdminAuth } from "./better-auth/create-auth.js";
-import { ResourceSource } from "./resource-source.js";
+import { FilesOptions } from "./files/options.js";
 import { AdminEnv, Authenticator, PageSource, ViewSource } from "./types.js";
+import { ResourceSource } from "./resource-source.js";
+import { FunctionSource } from "./functions/define-function.js";
 import { AdminOptions } from "./admin-options.js";
 import { Hono } from "hono";
 import { UserMenuSource } from "@protobase/schema";
@@ -17,8 +19,12 @@ export type CreateAdminInput = {
   authenticate: Authenticator;
   /** A Better Auth instance (see `createAuth`): its handler is mounted at `/api/auth`. */
   auth?: AdminAuth;
+  /** API functions of the app's own, each served at `<systemPath>/functions/<name>` (see `defineFunction`). */
+  functions?: Record<string, FunctionSource>;
+  /** Where file fields keep their bytes (see `FilesOptions`). */
+  files?: FilesOptions;
   options?: AdminOptions;
 };
 /** The admin REST API as a Hono app. It uses only Web APIs, so it runs on Node, Workers and anywhere else Hono does. */
-export declare const createAdmin: ({ resources, views, pages, userMenu, db, authenticate, auth, options }: CreateAdminInput) => Hono<AdminEnv, import("hono/types").BlankSchema, "/">;
+export declare const createAdmin: ({ resources, views, pages, userMenu, db, authenticate, auth, functions, files: filesOptions, options }: CreateAdminInput) => Hono<AdminEnv, import("hono/types").BlankSchema, "/">;
 //#endregion

package/dist/create-admin.js

@@ -4,9 +4,15 @@ import { assistantRecords } from "./assistant/records.js";
 import { builtInAssistant } from "./assistant/built-in-assistant.js";
 import { consoleAuditQueue } from "./audit/console-queue.js";
 import { authBasePath } from "./better-auth/create-auth.js";
+import { organizationRoutes } from "./better-auth/organizations/admin-routes.js";
 import { statusRoute } from "./better-auth/status-route.js";
 import { checkShell } from "./check-shell.js";
 import { checkViews } from "./check-views.js";
+import { createFilesRuntime } from "./files/runtime.js";
+import { fileRoutes } from "./files/routes.js";
+import { toApiFunction } from "./functions/define-function.js";
+import { callerRecords } from "./functions/records.js";
+import { functionRoutes } from "./functions/routes.js";
 import { runtimeUrl } from "./runtime/runtime-settings.js";
 import { createMeta } from "./meta.js";
 import { buildRegistry } from "./registry.js";
@@ -20,9 +26,10 @@ import { Hono } from "hono";
 import { checkPages } from "@protobase/layout";
 //#region src/create-admin.ts
 /** The admin REST API as a Hono app. It uses only Web APIs, so it runs on Node, Workers and anywhere else Hono does. */
-const createAdmin = ({ resources, views = [], pages = [], userMenu, db, authenticate, auth, options = {} }) => {
+const createAdmin = ({ resources, views = [], pages = [], userMenu, db, authenticate, auth, functions = {}, files: filesOptions, options = {} }) => {
 	const basePath = options.basePath ?? "/api/v1";
 	const registry = buildRegistry(resources);
+	const apiFunctions = Object.fromEntries(Object.entries(functions).map(([name, source]) => [name, toApiFunction(name, source)]));
 	const viewModels = views.map((view) => view.toModel());
 	const userMenuModel = userMenu?.toUserMenuModel();
 	const pageModels = pages.map((entry) => entry.toModel());
@@ -35,6 +42,12 @@ const createAdmin = ({ resources, views = [], pages = [], userMenu, db, authenti
 	const systemPath = basePath.slice(0, basePath.lastIndexOf("/"));
 	const assistant = assistantSettings(options.assistant, globalThis.process?.env ?? {});
 	const runtime = runtimeUrl(options.runtime, globalThis.process?.env ?? {});
+	const files = createFilesRuntime({
+		...filesOptions && { options: filesOptions },
+		env: globalThis.process?.env ?? {},
+		models: registry.entries.map((entry) => entry.model),
+		systemPath
+	});
 	const deps = {
 		db,
 		registry,
@@ -53,7 +66,8 @@ const createAdmin = ({ resources, views = [], pages = [], userMenu, db, authenti
 		},
 		rowPermissions: (resource) => typeof options.rowPermissions === "object" ? !options.rowPermissions.except.includes(resource) : options.rowPermissions !== false,
 		...assistant && { assistant: assistant.kind === "external" ? assistant.url : `${systemPath}/assistant` },
-		...runtime && { runtime }
+		...runtime && { runtime },
+		...files && { files }
 	};
 	const meta = createMeta(deps);
 	const onError = createErrorHandler(options.onUnhandledError);
@@ -83,6 +97,12 @@ const createAdmin = ({ resources, views = [], pages = [], userMenu, db, authenti
 	app.onError(onError);
 	if (auth) {
 		app.route(authBasePath, statusRoute(auth));
+		if (auth.organizations) app.route(authBasePath, organizationRoutes({
+			auth,
+			audit: deps.audit,
+			registry,
+			db
+		}));
 		app.on(["GET", "POST"], `${authBasePath}/*`, (c) => auth.handler(c.req.raw));
 	}
 	if (assistant?.kind === "built-in") {
@@ -99,7 +119,16 @@ const createAdmin = ({ resources, views = [], pages = [], userMenu, db, authenti
 			report: options.onUnhandledError
 		}));
 	}
+	app.route("/", functionRoutes({
+		basePath: `${systemPath}/functions`,
+		functions: apiFunctions,
+		authenticate,
+		db,
+		records: (session) => callerRecords(deps, session),
+		onError
+	}));
 	app.route("/", batchRoute(deps, authenticate, meta));
+	app.route("/", fileRoutes(deps, authenticate));
 	app.route(basePath, api);
 	app.route(deps.systemPath || "/", system);
 	return app;

package/dist/deps.d.ts

@@ -1,4 +1,5 @@
 import "./types.js";
+import "./files/runtime.js";
 import "./registry.js";
 import "./scan-guard.js";
 import { PageModel } from "@protobase/layout";