@protobase/server 0.7.0 → 0.8.1

package/dist/functions/define-function.js

@@ -0,0 +1,36 @@
+//#region src/functions/define-function.ts
+function defineFunction(first, handler) {
+	if (handler === void 0) return {
+		kind: "function",
+		options: {},
+		handler: first
+	};
+	return {
+		kind: "function",
+		options: first,
+		handler
+	};
+}
+const isApp = (value) => typeof value === "object" && value !== null && typeof value.fetch === "function";
+const isApiFunction = (value) => typeof value === "object" && value !== null && value.kind === "function";
+/** A function's name is its URL segment: letters, digits, `-` and `_`, starting with a letter or digit. */
+const functionNamePattern = /^[A-Za-z0-9][A-Za-z0-9_-]*$/;
+/** The function a source stands for; anything else is an error naming it. */
+const toApiFunction = (name, source) => {
+	if (!functionNamePattern.test(name)) throw new Error(`The function name "${name}" is not a URL segment: use letters, digits, - and _`);
+	if (isApiFunction(source)) {
+		if (typeof source.handler !== "function" && !isApp(source.handler)) throw new Error(`The function "${name}" has no handler: pass a (request, context) function or a Hono app`);
+		return source;
+	}
+	if (typeof source === "function" || isApp(source)) return defineFunction(source);
+	throw new Error(`The function "${name}" must default-export defineFunction(...), a (request, context) handler or a Hono app`);
+};
+/** Calls a function's handler or app with its request and context; anything but a Response is an error. */
+const invokeFunction = async (name, fn, request, context) => {
+	const { handler } = fn;
+	const response = isApp(handler) ? await handler.fetch(request, context) : await handler(request, context);
+	if (!(response instanceof Response)) throw new Error(`The function "${name}" returned no Response`);
+	return response;
+};
+//#endregion
+export { defineFunction, functionNamePattern, invokeFunction, toApiFunction };

package/dist/functions/function-app.d.ts

@@ -0,0 +1,17 @@
+import { FunctionContext, PublicFunctionContext } from "./define-function.js";
+import { Env, Hono } from "hono";
+//#region src/functions/function-app.d.ts
+/** A Hono app's env for a protected function: `c.env` is its context, `c.env.records` the caller's records. */
+export type FunctionEnv = {
+  Bindings: FunctionContext;
+};
+/** A Hono app's env for a public function. */
+export type PublicFunctionEnv = {
+  Bindings: PublicFunctionContext;
+};
+/**
+ * `new Hono()` for a function, whose errors and unknown paths reach the app's own error handling: problems as
+ * problem+json, anything else a 500 the app reports. A plain Hono app answers them itself.
+ */
+export declare const functionApp: <E extends Env = FunctionEnv>() => Hono<E, import("hono/types").BlankSchema, "/">;
+//#endregion

package/dist/functions/function-app.js

@@ -0,0 +1,19 @@
+import { notFound } from "../problem.js";
+import { Hono } from "hono";
+//#region src/functions/function-app.ts
+/**
+* `new Hono()` for a function, whose errors and unknown paths reach the app's own error handling: problems as
+* problem+json, anything else a 500 the app reports. A plain Hono app answers them itself.
+*/
+const functionApp = () => {
+	const app = new Hono();
+	app.onError((error) => {
+		throw error;
+	});
+	app.notFound((c) => {
+		throw notFound(`There is no route at ${c.req.path}`);
+	});
+	return app;
+};
+//#endregion
+export { functionApp };

package/dist/functions/read-json.d.ts

@@ -0,0 +1,35 @@
+//#region src/functions/read-json.d.ts
+type Issue = {
+  message: string;
+  path?: ReadonlyArray<PropertyKey | {
+    key: PropertyKey;
+  }>;
+};
+/** A Standard Schema (https://standardschema.dev), such as a zod 4, Valibot or ArkType schema. */
+export type StandardSchema<Output = unknown> = {
+  readonly '~standard': {
+    readonly version: 1;
+    readonly validate: (value: unknown) => {
+      value: Output;
+      issues?: undefined;
+    } | {
+      issues: ReadonlyArray<Issue>;
+    } | Promise<{
+      value: Output;
+      issues?: undefined;
+    } | {
+      issues: ReadonlyArray<Issue>;
+    }>;
+    readonly types?: {
+      readonly input: unknown;
+      readonly output: Output;
+    };
+  };
+};
+/**
+ * The request's JSON body, checked against `schema` when one is given. A body that is no JSON is a 400 `malformed-json`
+ * problem, one the schema refuses a 400 `invalid-body` problem listing each issue by field.
+ */
+export declare function readJson(request: Request): Promise<unknown>;
+export declare function readJson<Output>(request: Request, schema: StandardSchema<Output>): Promise<Output>;
+//#endregion

package/dist/functions/read-json.js

@@ -0,0 +1,24 @@
+import { badRequest } from "../problem.js";
+//#region src/functions/read-json.ts
+const fieldOf = (issue) => (issue.path ?? []).map((part) => String(typeof part === "object" ? part.key : part)).join(".");
+async function readJson(request, schema) {
+	const text = await request.text();
+	let body;
+	try {
+		body = JSON.parse(text);
+	} catch (error) {
+		if (error instanceof SyntaxError) throw badRequest("malformed-json", "The request body is not valid JSON");
+		throw error;
+	}
+	if (!schema) return body;
+	const result = await schema["~standard"].validate(body);
+	if (!result.issues) return result.value;
+	const errors = result.issues.map((issue) => ({
+		field: fieldOf(issue),
+		message: issue.message
+	}));
+	const first = errors[0];
+	throw badRequest("invalid-body", `The request body is invalid: ${first.field ? `${first.field}: ` : ""}${first.message}`, { errors });
+}
+//#endregion
+export { readJson };

package/dist/functions/records.d.ts

@@ -0,0 +1,43 @@
+import { Row } from "../types.js";
+import "../deps.js";
+import { RecordKeyInput, ToolRecord, ToolRecords } from "../assistant/records.js";
+//#region src/functions/records.d.ts
+/** The list parameters of the REST API (AIP-132), as values rather than query text. */
+export type ListParams = {
+  filter?: string;
+  order_by?: string;
+  page_size?: number;
+  page_token?: string;
+  fields?: string[];
+  count?: 'exact';
+  show_deleted?: boolean;
+};
+/**
+ * A page of records as the REST API lists it: each item with its `etag` and, unless the resource opts out, whether the
+ * caller may update and delete it; and the token of the next page, empty on the last.
+ */
+export type RecordPage = {
+  items: Array<Row & {
+    etag?: string;
+    permissions?: {
+      update: boolean;
+      delete: boolean;
+    };
+  }>;
+  next_page_token: string;
+  total_size_estimate: number;
+  total_size?: number;
+};
+/**
+ * The app's resources as the caller: their access rules, row filters, tenant scope, validation and write hooks apply as
+ * in the REST API. A refusal or a missing record rejects with an `HttpProblem`, which becomes the function's response
+ * when it is not caught.
+ */
+export type FunctionRecords = ToolRecords & {
+  list: (resource: string, params?: ListParams) => Promise<RecordPage>;
+  /** With `etag`, fails with 412 when the record changed since it was read. Resolves to the record as it was. */
+  delete: (resource: string, key: RecordKeyInput, options?: {
+    etag?: string;
+  }) => Promise<ToolRecord>;
+};
+//#endregion

package/dist/functions/records.js

@@ -0,0 +1,31 @@
+import { notFound } from "../problem.js";
+import { decodeKeyText } from "../key.js";
+import { runWrite } from "../write-pipeline.js";
+import { assistantRecords } from "../assistant/records.js";
+import { listRecords } from "../list-service.js";
+import { encodeKey } from "@protobase/schema";
+//#region src/functions/records.ts
+const filterLength = 2e5;
+/** `FunctionRecords` over the admin's resources for `session`. */
+const callerRecords = (deps, session) => {
+	const entryOf = (resource) => {
+		const entry = deps.registry.find(resource);
+		if (!entry) throw notFound(`There is no resource "${resource}"`);
+		return entry;
+	};
+	return {
+		...assistantRecords(deps, session),
+		list: async (resource, params = {}) => (await listRecords(deps, entryOf(resource), session, params, filterLength)).body,
+		delete: async (resource, input, { etag } = {}) => {
+			const entry = entryOf(resource);
+			const key = decodeKeyText(entry, Array.isArray(input) ? encodeKey(input) : String(input));
+			return runWrite(deps, entry, session, {
+				operation: "delete",
+				key,
+				ifMatch: etag ?? "*"
+			});
+		}
+	};
+};
+//#endregion
+export { callerRecords };

package/dist/functions/require-env.d.ts

@@ -0,0 +1,7 @@
+//#region src/functions/require-env.d.ts
+/**
+ * An environment variable the function cannot work without, such as an API key: `protobase dev` reads it from `.env`,
+ * `protobase serve` from its environment. A missing one is an error, so the call is a 500 the app reports.
+ */
+export declare const requireEnv: (name: string) => any;
+//#endregion

package/dist/functions/require-env.js

@@ -0,0 +1,12 @@
+//#region src/functions/require-env.ts
+/**
+* An environment variable the function cannot work without, such as an API key: `protobase dev` reads it from `.env`,
+* `protobase serve` from its environment. A missing one is an error, so the call is a 500 the app reports.
+*/
+const requireEnv = (name) => {
+	const value = globalThis.process?.env?.[name];
+	if (!value) throw new Error(`The environment variable ${name} is not set`);
+	return value;
+};
+//#endregion
+export { requireEnv };

package/dist/functions/routes.js

@@ -0,0 +1,60 @@
+import { forbidden, notFound } from "../problem.js";
+import { invokeFunction } from "./define-function.js";
+import { Hono } from "hono";
+import { cors } from "hono/cors";
+//#region src/functions/routes.ts
+const relativeRequest = (request, prefix) => {
+	const url = new URL(request.url);
+	url.pathname = url.pathname.slice(prefix.length) || "/";
+	return new Request(url, request);
+};
+const requireRoles = (name, session, roles) => {
+	if (!roles || roles.some((role) => session.user.roles.includes(role))) return;
+	throw forbidden("function-forbidden", `You may not call the function "${name}"`);
+};
+/**
+* Every function at `<basePath>/<name>` and below, any method. A protected function authenticates the request first, so
+* a call without a valid token is the authenticator's 401 problem; a public one gets the caller only when it asks.
+*/
+const functionRoutes = ({ basePath, functions, authenticate, db, records, onError }) => {
+	const app = new Hono().basePath(basePath);
+	app.onError(onError);
+	const callerOf = async (request) => {
+		const session = await authenticate(request);
+		return {
+			session,
+			records: records(session)
+		};
+	};
+	for (const [name, fn] of Object.entries(functions)) {
+		const prefix = `${basePath}/${name}`;
+		const { options } = fn;
+		if (options.cors) app.use(`/${name}/*`, cors(options.cors));
+		app.all(`/${name}/*`, async (c) => {
+			const request = relativeRequest(c.req.raw, prefix);
+			if (options.public) {
+				let caller;
+				return invokeFunction(name, fn, request, {
+					name,
+					db,
+					caller: () => caller ??= callerOf(c.req.raw)
+				});
+			}
+			const caller = await callerOf(c.req.raw);
+			requireRoles(name, caller.session, options.roles);
+			const context = {
+				name,
+				db,
+				...caller,
+				caller: async () => caller
+			};
+			return invokeFunction(name, fn, request, context);
+		});
+	}
+	app.all("/*", (c) => {
+		throw notFound(`There is no function at ${c.req.path}`);
+	});
+	return app;
+};
+//#endregion
+export { functionRoutes };

package/dist/functions/verify-signature.d.ts

@@ -0,0 +1,32 @@
+//#region src/functions/verify-signature.d.ts
+export type SignatureOptions = {
+  /** The shared secret, as the sender shows it. */
+  secret: string;
+  /** The header that carries the signature, such as `x-hub-signature-256`. */
+  header: string;
+  /** Text before the signature in that header, such as `sha256=`. */
+  prefix?: string;
+  /** How the signature is written. Default `hex`. */
+  encoding?: 'hex' | 'base64';
+  /** Default `SHA-256`. */
+  hash?: 'SHA-1' | 'SHA-256' | 'SHA-512';
+};
+/**
+ * The request's body as text, once its HMAC signature checks out against `secret`, as GitHub, Shopify and many others
+ * sign their webhooks. A missing or wrong signature is a 401 `invalid-signature` problem.
+ */
+export declare const verifySignature: (request: Request, { secret, header, prefix, encoding, hash }: SignatureOptions) => Promise<string>;
+export type StandardWebhookOptions = {
+  /** The endpoint's secret, `whsec_` and base64. */
+  secret: string;
+  /** How old, or how far ahead, a message may be. Default 300. */
+  toleranceSeconds?: number;
+  /** The current time in milliseconds; for tests. */
+  now?: () => number;
+};
+/**
+ * The request's body as text, once its Standard Webhooks signature checks out (https://www.standardwebhooks.com), as
+ * Supabase Auth hooks, Svix, Resend and others sign theirs. A missing, stale or wrong signature is a 401 problem.
+ */
+export declare const verifyStandardWebhook: (request: Request, { secret, toleranceSeconds, now }: StandardWebhookOptions) => Promise<string>;
+//#endregion

package/dist/functions/verify-signature.js

@@ -0,0 +1,49 @@
+import { HttpProblem } from "../problem.js";
+//#region src/functions/verify-signature.ts
+const invalid = (detail) => new HttpProblem(401, "invalid-signature", "Unauthorized", detail);
+const decodeHex = (text) => /^(?:[0-9a-f]{2})+$/i.test(text) ? new Uint8Array(text.match(/../g).map((pair) => parseInt(pair, 16))) : void 0;
+const decodeBase64 = (text) => /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(text) && text.length > 0 ? Uint8Array.from(atob(text), (char) => char.charCodeAt(0)) : void 0;
+const verifyHmac = async (key, hash, signature, content) => {
+	const cryptoKey = await crypto.subtle.importKey("raw", key, {
+		name: "HMAC",
+		hash
+	}, false, ["verify"]);
+	return crypto.subtle.verify("HMAC", cryptoKey, signature, new TextEncoder().encode(content));
+};
+/**
+* The request's body as text, once its HMAC signature checks out against `secret`, as GitHub, Shopify and many others
+* sign their webhooks. A missing or wrong signature is a 401 `invalid-signature` problem.
+*/
+const verifySignature = async (request, { secret, header, prefix = "", encoding = "hex", hash = "SHA-256" }) => {
+	const body = await request.text();
+	const value = request.headers.get(header);
+	if (!value?.startsWith(prefix)) throw invalid(`The request has no ${header} signature`);
+	const text = value.slice(prefix.length).trim();
+	const signature = encoding === "hex" ? decodeHex(text) : decodeBase64(text);
+	if (!signature || !await verifyHmac(new TextEncoder().encode(secret), hash, signature, body)) throw invalid(`The ${header} signature does not match the body`);
+	return body;
+};
+/**
+* The request's body as text, once its Standard Webhooks signature checks out (https://www.standardwebhooks.com), as
+* Supabase Auth hooks, Svix, Resend and others sign theirs. A missing, stale or wrong signature is a 401 problem.
+*/
+const verifyStandardWebhook = async (request, { secret, toleranceSeconds = 300, now = Date.now }) => {
+	const body = await request.text();
+	const id = request.headers.get("webhook-id");
+	const timestamp = request.headers.get("webhook-timestamp");
+	const signatures = request.headers.get("webhook-signature");
+	if (!id || !timestamp || !signatures) throw invalid("The request has no webhook-id, webhook-timestamp and webhook-signature headers");
+	const seconds = Number(timestamp);
+	if (!Number.isInteger(seconds) || Math.abs(now() / 1e3 - seconds) > toleranceSeconds) throw invalid("The webhook-timestamp is too old or too far ahead");
+	const key = decodeBase64(secret.replace(/^whsec_/, ""));
+	if (!key) throw new Error("The Standard Webhooks secret is not base64 (whsec_...)");
+	const content = `${id}.${timestamp}.${body}`;
+	for (const entry of signatures.split(" ")) {
+		const [version, text = ""] = entry.split(",");
+		const signature = decodeBase64(text);
+		if (version === "v1" && signature && await verifyHmac(key, "SHA-256", signature, content)) return body;
+	}
+	throw invalid("No webhook-signature matches the body");
+};
+//#endregion
+export { verifySignature, verifyStandardWebhook };

package/dist/index.d.ts

@@ -1,15 +1,25 @@
 import { SignInPolicy, SignInRule, StaffAccessRule, defaultSignInPolicy, signInPolicyMethods } from "./better-auth/sign-in-policy.js";
 import { StaffSignIn } from "./better-auth/staff-log.js";
+import { RoleDefinition, RolesInput } from "./better-auth/organizations/role-definitions.js";
 import { OperatorProvider, readOperatorSettings } from "./better-auth/operator-provider.js";
+import { OrganizationRole, StoredMember, StoredOrganization } from "./better-auth/organizations/store.js";
+import { OrganizationsOptions } from "./better-auth/organizations/options.js";
 import { PlatformSignIn, readPlatformSignIn } from "./better-auth/platform-sign-in.js";
 import { AdminAuth, CreateAuthOptions, UserCreatedHook, createAuth, normalizeRoles } from "./better-auth/create-auth.js";
+import { EventsOptions } from "./changes/events-options.js";
+import { FileProvider, FileStore, StoredObject } from "./files/store.js";
+import { FilesOptions } from "./files/options.js";
+import { Admin, AuditEvent, AuditQueue, Authenticator, PipelineHook, ScanGuardMode, Session, SessionOrganization, TenantValue, User, ViewSource, WriteEvent, WriteOperation } from "./types.js";
+import { CleanupEntry, CleanupSchedule, ScheduledDelete, storageCleanupSchedule } from "./files/cleanup-schedule.js";
+import { CleanupReport } from "./files/cleanup-runner.js";
 import { ResourceSource, configExports } from "./resource-source.js";
+import { RecordKeyInput, ToolRecord, ToolRecords } from "./assistant/records.js";
+import { FunctionRecords, ListParams, RecordPage } from "./functions/records.js";
+import { ApiFunction, CorsOptions, FunctionApp, FunctionCaller, FunctionContext, FunctionHandler, FunctionOptions, FunctionSource, ProtectedFunctionOptions, PublicFunctionContext, PublicFunctionHandler, PublicFunctionOptions, defineFunction } from "./functions/define-function.js";
 import { ChatMessage, ChatTextPart, Completion, CompletionOptions, ModelError, ModelSettings, ReasoningDetail, ReasoningEffort, ToolCall, ToolSpec, streamChatCompletion } from "./assistant/chat-completions.js";
-import { Admin, AuditEvent, AuditQueue, Authenticator, PipelineHook, ScanGuardMode, Session, TenantValue, User, ViewSource, WriteEvent, WriteOperation } from "./types.js";
 import { ConversationRecord, ConversationStore } from "./assistant/conversation-store.js";
 import { Conversation, ConversationsOptions, conversationKey, createConversations } from "./assistant/conversations.js";
 import { ApprovalAnswer, ApprovalRequest, requestApproval } from "./assistant/approval.js";
-import { RecordKeyInput, ToolRecord, ToolRecords } from "./assistant/records.js";
 import { AssistantTool, ToolContext, defineTool } from "./assistant/tools.js";
 import { AssistantOptions, AssistantSettings, assistantRoles, assistantSettings, assistantVariables, seesAssistant } from "./assistant/assistant-settings.js";
 import { RuntimeOptions, runtimeUrl, runtimeVariable, seesRuntime } from "./runtime/runtime-settings.js";
@@ -24,6 +34,11 @@ import { parseRoles } from "./better-auth/parse-roles.js";
 import { LinkedAccount, NewUser, StoredUser, createUser, deleteUser, hasUsers, listUsers, roleChoices, setUserBanned, setUserRole } from "./better-auth/users.js";
 import { IssueTokenOptions, issueToken, maxTokenTtlSeconds } from "./better-auth/tokens.js";
 import { authSchemaMigration, checkAuthSchema } from "./better-auth/auth-schema.js";
+import { changesMigration, checkChanges, migrationCommand } from "./changes/capture-schema.js";
+import { CapturedRow, CoalescedChange, coalesce } from "./changes/coalesce.js";
+import { ResourceChange, recordOf, resourceChange } from "./changes/resource-change.js";
+import { eventMatcher } from "./changes/match-events.js";
+import { MemberInput, NewOrganization, addAppRoleToOwners, addMember, createOrganization, listOrganizations, removeMember, setMemberRoles } from "./better-auth/organizations/host.js";
 import { AssistantBackend, assistantProtocolRoutes } from "./assistant/protocol-routes.js";
 import { fileConversationStore } from "./assistant/file-conversation-store.js";
 import { withCacheBreakpoints } from "./assistant/cache-breakpoints.js";
@@ -31,4 +46,12 @@ import { TurnOptions, runTurn } from "./assistant/turn.js";
 import { WidgetOptions, maxWidgetPropsBytes, widget } from "./assistant/widget.js";
 import { QueryOptions, QueryResult, runReadOnlyQuery, runReadWriteQuery } from "./assistant/run-query.js";
 import { readOnlyQueryTool, readWriteQueryTool } from "./assistant/query-tools.js";
-export { type Admin, type AdminAuth, type AdminOptions, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticatorOptions, type ChatMessage, type ChatTextPart, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CreateAdminInput, type CreateAuthOptions, HttpProblem, type IssueTokenOptions, type JwtOptions, type LinkedAccount, ModelError, type ModelSettings, type NewUser, type OperatorProvider, type PipelineHook, type PlatformSignIn, type ProjectConfig, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type RecordKeyInput, type ResourceSource, type RuntimeOptions, type ScanGuardMode, type Session, type SignInPolicy, type SignInRule, type StaffAccessRule, type StaffSignIn, type StoredUser, type TenantValue, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TurnOptions, type User, type UserCreatedHook, type ViewSource, type WidgetOptions, type WriteEvent, type WriteOperation, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, betterAuthAuthenticator, checkAuthSchema, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createUser, defaultSignInPolicy, defineConfig, defineTool, deleteUser, fileConversationStore, forbidden, hasUsers, issueToken, jwtAuthenticator, listUsers, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, normalizeRoles, notFound, parseRoles, readOnlyQueryTool, readOperatorSettings, readPlatformSignIn, readWriteQueryTool, requestApproval, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, seesAssistant, seesRuntime, setUserBanned, setUserRole, signInPolicyMethods, streamChatCompletion, unauthorized, widget, withCacheBreakpoints };
+import { FunctionEnv, PublicFunctionEnv, functionApp } from "./functions/function-app.js";
+import { StandardSchema, readJson } from "./functions/read-json.js";
+import { SignatureOptions, StandardWebhookOptions, verifySignature, verifyStandardWebhook } from "./functions/verify-signature.js";
+import { requireEnv } from "./functions/require-env.js";
+import { LocalFilesOptions, localFileStore, localFiles } from "./files/local-files.js";
+import { FileCleanupInput, createFileCleanup } from "./files/file-cleanup.js";
+import { FileObject } from "./files/present.js";
+import { aspectRatio, fileSize, fileType, imageSize, processor } from "./files/processors.js";
+export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticatorOptions, type CapturedRow, type ChatMessage, type ChatTextPart, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CreateAdminInput, type CreateAuthOptions, type EventsOptions, type FileCleanupInput, type FileObject, type FileProvider, type FileStore, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSource, HttpProblem, type IssueTokenOptions, type JwtOptions, type LinkedAccount, type ListParams, type LocalFilesOptions, type MemberInput, ModelError, type ModelSettings, type NewOrganization, type NewUser, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PipelineHook, type PlatformSignIn, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type RecordKeyInput, type RecordPage, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RuntimeOptions, type ScanGuardMode, type ScheduledDelete, type Session, type SessionOrganization, type SignInPolicy, type SignInRule, type SignatureOptions, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type TenantValue, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TurnOptions, type User, type UserCreatedHook, type ViewSource, type WidgetOptions, type WriteEvent, type WriteOperation, addAppRoleToOwners, addMember, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, betterAuthAuthenticator, changesMigration, checkAuthSchema, checkChanges, coalesce, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineFunction, defineTool, deleteUser, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, functionApp, hasUsers, imageSize, issueToken, jwtAuthenticator, listOrganizations, listUsers, localFileStore, localFiles, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, normalizeRoles, notFound, parseRoles, processor, readJson, readOnlyQueryTool, readOperatorSettings, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, requestApproval, requireEnv, resourceChange, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, storageCleanupSchedule, streamChatCompletion, unauthorized, verifySignature, verifyStandardWebhook, widget, withCacheBreakpoints };

package/dist/index.js

@@ -12,11 +12,15 @@ import { ModelError, streamChatCompletion } from "./assistant/chat-completions.j
 import { runTurn } from "./assistant/turn.js";
 import { consoleAuditQueue } from "./audit/console-queue.js";
 import { readOperatorSettings } from "./better-auth/operator-provider.js";
-import { readPlatformSignIn } from "./better-auth/platform-sign-in.js";
-import { defaultSignInPolicy, signInPolicyMethods } from "./better-auth/sign-in-policy.js";
 import { parseRoles } from "./better-auth/parse-roles.js";
+import { defaultSignInPolicy, signInPolicyMethods } from "./better-auth/sign-in-policy.js";
+import { readPlatformSignIn } from "./better-auth/platform-sign-in.js";
 import { createAuth, normalizeRoles } from "./better-auth/create-auth.js";
+import { addAppRoleToOwners, addMember, createOrganization, listOrganizations, removeMember, setMemberRoles } from "./better-auth/organizations/host.js";
 import { createUser, deleteUser, hasUsers, listUsers, roleChoices, setUserBanned, setUserRole } from "./better-auth/users.js";
+import { storageCleanupSchedule } from "./files/cleanup-schedule.js";
+import { localFileStore, localFiles } from "./files/local-files.js";
+import { defineFunction } from "./functions/define-function.js";
 import { runtimeUrl, runtimeVariable, seesRuntime } from "./runtime/runtime-settings.js";
 import { createAdmin } from "./create-admin.js";
 import { configExports } from "./resource-source.js";
@@ -25,5 +29,15 @@ import { jwtAuthenticator } from "./auth/jwt.js";
 import { betterAuthAuthenticator } from "./better-auth/authenticator.js";
 import { issueToken, maxTokenTtlSeconds } from "./better-auth/tokens.js";
 import { authSchemaMigration, checkAuthSchema } from "./better-auth/auth-schema.js";
+import { changesMigration, checkChanges, migrationCommand } from "./changes/capture-schema.js";
+import { coalesce } from "./changes/coalesce.js";
+import { recordOf, resourceChange } from "./changes/resource-change.js";
+import { eventMatcher } from "./changes/match-events.js";
 import { maxWidgetPropsBytes, widget } from "./assistant/widget.js";
-export { HttpProblem, ModelError, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, betterAuthAuthenticator, checkAuthSchema, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createUser, defaultSignInPolicy, defineConfig, defineTool, deleteUser, fileConversationStore, forbidden, hasUsers, issueToken, jwtAuthenticator, listUsers, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, normalizeRoles, notFound, parseRoles, readOnlyQueryTool, readOperatorSettings, readPlatformSignIn, readWriteQueryTool, requestApproval, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, seesAssistant, seesRuntime, setUserBanned, setUserRole, signInPolicyMethods, streamChatCompletion, unauthorized, widget, withCacheBreakpoints };
+import { functionApp } from "./functions/function-app.js";
+import { readJson } from "./functions/read-json.js";
+import { verifySignature, verifyStandardWebhook } from "./functions/verify-signature.js";
+import { requireEnv } from "./functions/require-env.js";
+import { createFileCleanup } from "./files/file-cleanup.js";
+import { aspectRatio, fileSize, fileType, imageSize, processor } from "./files/processors.js";
+export { HttpProblem, ModelError, addAppRoleToOwners, addMember, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, betterAuthAuthenticator, changesMigration, checkAuthSchema, checkChanges, coalesce, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineFunction, defineTool, deleteUser, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, functionApp, hasUsers, imageSize, issueToken, jwtAuthenticator, listOrganizations, listUsers, localFileStore, localFiles, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, normalizeRoles, notFound, parseRoles, processor, readJson, readOnlyQueryTool, readOperatorSettings, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, requestApproval, requireEnv, resourceChange, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, storageCleanupSchedule, streamChatCompletion, unauthorized, verifySignature, verifyStandardWebhook, widget, withCacheBreakpoints };

package/dist/list-service.js

@@ -1,3 +1,4 @@
+import { presentFiles } from "./files/present.js";
 import { etagAlias } from "./sql-parts.js";
 import { etagOf } from "./etag.js";
 import { exposeRow, pickFields } from "./rows.js";
@@ -39,7 +40,8 @@ const listRecords = async (deps, entry, session, input, maxFilterLength, jump =
 			[etagField.name]: etagField
 		}
 	} : model;
-	const read = entry.etag && columns ? columns : Object.keys(model.fields);
+	const withKey = columns?.some((name) => model.fields[name].type === "file") ? [.../* @__PURE__ */ new Set([...columns, ...entry.model.primaryKey.filter((name) => model.fields[name])])] : columns;
+	const read = entry.etag && withKey ? withKey : Object.keys(model.fields);
 	const shape = {
 		...filter && { filter },
 		...sort && { sort },
@@ -80,7 +82,7 @@ const listRecords = async (deps, entry, session, input, maxFilterLength, jump =
 	return {
 		warning,
 		body: {
-			items: result.rows.map((row, i) => ({
+			items: (await presentFiles(access, result.rows)).map((row, i) => ({
 				...pickFields(row, columns),
 				etag: result.etags[i],
 				...result.permissions && { permissions: result.permissions[i] }

package/dist/openapi/resource-paths.js

@@ -1,3 +1,4 @@
+import { writableFields } from "../request-access.js";
 import { pascal } from "./naming.js";
 //#region src/openapi/resource-paths.ts
 const param = (name) => ({ $ref: `#/components/parameters/${name}` });
@@ -411,7 +412,83 @@ const resourcePaths = (access) => {
 			}
 		} }
 	};
-	return withoutDenied(paths, access);
+	return {
+		...withoutDenied(paths, access),
+		...uploadPath(access)
+	};
+};
+const uploadPath = (access) => {
+	const { entry } = access;
+	const writable = /* @__PURE__ */ new Set([...writableFields(access, "create"), ...writableFields(access, "update")]);
+	const fields = Object.values(access.readable.fields).filter((model) => model.file && writable.has(model.name)).map((model) => model.name);
+	if (fields.length === 0) return {};
+	const binary = {
+		type: "string",
+		format: "binary"
+	};
+	return { [`/${entry.name}:upload`]: { post: {
+		operationId: `upload_${entry.name}`,
+		tags: [entry.name],
+		summary: `Upload a file for a ${entry.name} field`,
+		description: "Streams one file: the raw body with `name`, or `multipart/form-data` with one file part. Its type is detected from the content, corrected when the name or header says otherwise, and checked against the field's allowed types. The answer's `value` is a ticket: send it as the field's value in a create, update or batch write within 24 hours.",
+		parameters: [{
+			...field("The file field"),
+			schema: {
+				type: "string",
+				enum: fields
+			}
+		}, query("name", "The file name, for a raw body")],
+		requestBody: {
+			required: true,
+			content: {
+				"application/octet-stream": { schema: binary },
+				"multipart/form-data": { schema: {
+					type: "object",
+					properties: { file: binary }
+				} }
+			}
+		},
+		responses: {
+			201: {
+				description: "Stored; use `value` in a write",
+				content: json({
+					type: "object",
+					required: [
+						"value",
+						"file",
+						"derived"
+					],
+					properties: {
+						value: { type: "string" },
+						file: {
+							type: "object",
+							properties: {
+								name: { type: "string" },
+								type: { type: "string" },
+								size: { type: "integer" }
+							}
+						},
+						derived: {
+							type: "object",
+							description: "Values the field's processors computed for its derived fields"
+						},
+						corrected: {
+							type: "object",
+							properties: {
+								from: { type: "string" },
+								to: { type: "string" }
+							}
+						}
+					}
+				})
+			},
+			400: error("BadRequest"),
+			...auth,
+			403: error("Forbidden"),
+			413: { description: "Larger than the field allows" },
+			415: { description: "A type the field does not allow" }
+		}
+	} } };
 };
 //#endregion
 export { resourcePaths };