@protobase/server 0.9.0 → 0.10.0

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 import { SignInPolicy, SignInRule, StaffAccessRule, defaultSignInPolicy, signInPolicyMethods } from "./better-auth/sign-in-policy.js";
 import { StaffSignIn } from "./better-auth/staff-log.js";
-import { RoleDefinition, RolesInput } from "./better-auth/organizations/role-definitions.js";
 import { OperatorProvider, readOperatorSettings } from "./better-auth/operator-provider.js";
+import { RoleDefinition, RolesInput } from "./better-auth/organizations/role-definitions.js";
 import { OrganizationRole, StoredMember, StoredOrganization } from "./better-auth/organizations/store.js";
 import { OrganizationsOptions } from "./better-auth/organizations/options.js";
 import { PlatformSignIn, readPlatformSignIn } from "./better-auth/platform-sign-in.js";
@@ -20,6 +20,7 @@ import { ResourceSource, configExports } from "./resource-source.js";
 import { RecordKeyInput, ToolRecord, ToolRecords } from "./assistant/records.js";
 import { FunctionRecords, ListParams, RecordPage } from "./functions/records.js";
 import { ApiFunction, CorsOptions, FunctionApp, FunctionCaller, FunctionContext, FunctionHandler, FunctionOptions, FunctionSource, ProtectedFunctionOptions, PublicFunctionContext, PublicFunctionHandler, PublicFunctionOptions, defineFunction } from "./functions/define-function.js";
+import { CorsOrigins } from "./api-cors.js";
 import { ChatMessage, ChatTextPart, Completion, CompletionOptions, ModelError, ModelSettings, ReasoningDetail, ReasoningEffort, ToolCall, ToolSpec, streamChatCompletion } from "./assistant/chat-completions.js";
 import { ConversationRecord, ConversationStore } from "./assistant/conversation-store.js";
 import { Conversation, ConversationsOptions, conversationKey, createConversations } from "./assistant/conversations.js";
@@ -37,6 +38,7 @@ import { BetterAuthAuthenticatorOptions, betterAuthAuthenticator } from "./bette
 import { parseRoles } from "./better-auth/parse-roles.js";
 import { LinkedAccount, NewUser, StoredUser, createUser, deleteUser, hasUsers, listUsers, roleChoices, setUserBanned, setUserRole } from "./better-auth/users.js";
 import { IssueTokenOptions, issueToken, maxTokenTtlSeconds } from "./better-auth/tokens.js";
+import { webauthnPath } from "./better-auth/origins.js";
 import { authSchemaMigration, checkAuthSchema } from "./better-auth/auth-schema.js";
 import { changesMigration, checkChanges, migrationCommand } from "./changes/capture-schema.js";
 import { CapturedRow, CoalescedChange, coalesce } from "./changes/coalesce.js";
@@ -66,4 +68,4 @@ import { FatalJobError } from "./jobs/run-job.js";
 import { DrainResult, JobsRuntime, StartJobsOptions, startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
 import { checkJobsSchema, jobsSchema, jobsSchemaMigration } from "./jobs/schema.js";
-export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticatorOptions, type CapturedRow, type ChatMessage, type ChatTextPart, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CreateAdminInput, type CreateAuthOptions, type DrainResult, type EnqueueOptions, type EventData, type EventsOptions, FatalJobError, type FileCleanupInput, type FileObject, type FileProvider, type FileStore, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSource, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type LinkedAccount, type ListParams, type LocalFilesOptions, type MemberInput, ModelError, type ModelSettings, type NewOrganization, type NewUser, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PipelineHook, type PlatformSignIn, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type RecordKeyInput, type RecordPage, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type ScanGuardMode, type ScheduledDelete, type Session, type SessionOrganization, type SignInPolicy, type SignInRule, type SignatureOptions, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TurnOptions, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, addAppRoleToOwners, addMember, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, betterAuthAuthenticator, changesMigration, checkAuthSchema, checkChanges, checkJobsSchema, checkWebhooksSchema, coalesce, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineFunction, defineJob, defineTool, deleteUser, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, functionApp, hasUsers, imageSize, isJobDefinition, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, listOrganizations, listUsers, localFileStore, localFiles, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, requestApproval, requireEnv, resourceChange, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, startJobs, storageCleanupSchedule, streamChatCompletion, subscription, unauthorized, verifySignature, verifyStandardWebhook, webhooks, webhooksMigration, widget, withCacheBreakpoints };
+export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticatorOptions, type CapturedRow, type ChatMessage, type ChatTextPart, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DrainResult, type EnqueueOptions, type EventData, type EventsOptions, FatalJobError, type FileCleanupInput, type FileObject, type FileProvider, type FileStore, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSource, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type LinkedAccount, type ListParams, type LocalFilesOptions, type MemberInput, ModelError, type ModelSettings, type NewOrganization, type NewUser, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PipelineHook, type PlatformSignIn, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type RecordKeyInput, type RecordPage, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type ScanGuardMode, type ScheduledDelete, type Session, type SessionOrganization, type SignInPolicy, type SignInRule, type SignatureOptions, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TurnOptions, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, addAppRoleToOwners, addMember, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, betterAuthAuthenticator, changesMigration, checkAuthSchema, checkChanges, checkJobsSchema, checkWebhooksSchema, coalesce, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineFunction, defineJob, defineTool, deleteUser, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, functionApp, hasUsers, imageSize, isJobDefinition, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, listOrganizations, listUsers, localFileStore, localFiles, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, requestApproval, requireEnv, resourceChange, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, startJobs, storageCleanupSchedule, streamChatCompletion, subscription, unauthorized, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints };

package/dist/index.js

@@ -12,6 +12,7 @@ import { ModelError, streamChatCompletion } from "./assistant/chat-completions.j
 import { checkJobsSchema, jobsSchema, jobsSchemaMigration } from "./jobs/schema.js";
 import { runTurn } from "./assistant/turn.js";
 import { consoleAuditQueue } from "./audit/console-queue.js";
+import { webauthnPath } from "./better-auth/origins.js";
 import { readOperatorSettings } from "./better-auth/operator-provider.js";
 import { parseRoles } from "./better-auth/parse-roles.js";
 import { defaultSignInPolicy, signInPolicyMethods } from "./better-auth/sign-in-policy.js";
@@ -50,4 +51,4 @@ import { createFileCleanup } from "./files/file-cleanup.js";
 import { aspectRatio, fileSize, fileType, imageSize, processor } from "./files/processors.js";
 import { startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
-export { FatalJobError, HttpProblem, ModelError, addAppRoleToOwners, addMember, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, betterAuthAuthenticator, changesMigration, checkAuthSchema, checkChanges, checkJobsSchema, checkWebhooksSchema, coalesce, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineFunction, defineJob, defineTool, deleteUser, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, functionApp, hasUsers, imageSize, isJobDefinition, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, listOrganizations, listUsers, localFileStore, localFiles, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, requestApproval, requireEnv, resourceChange, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, startJobs, storageCleanupSchedule, streamChatCompletion, subscription, unauthorized, verifySignature, verifyStandardWebhook, webhooks, webhooksMigration, widget, withCacheBreakpoints };
+export { FatalJobError, HttpProblem, ModelError, addAppRoleToOwners, addMember, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, betterAuthAuthenticator, changesMigration, checkAuthSchema, checkChanges, checkJobsSchema, checkWebhooksSchema, coalesce, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineFunction, defineJob, defineTool, deleteUser, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, functionApp, hasUsers, imageSize, isJobDefinition, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, listOrganizations, listUsers, localFileStore, localFiles, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, requestApproval, requireEnv, resourceChange, roleChoices, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, startJobs, storageCleanupSchedule, streamChatCompletion, subscription, unauthorized, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints };

package/dist/jobs/failed-jobs.js

@@ -6,13 +6,13 @@ const admins = ({ user }) => user?.roles?.includes("admin") ?? false;
 * The failed jobs, over the `jobs.failed` view: the admin app lists them with their last error, and retries or deletes
 * one through the view's triggers. Admins only, whatever the project's roles say.
 */
-const failedJobs = resource("failedJobs").table(`${jobsSchema}.failed`).fields({
+const failedJobs = resource("failed_jobs").table(`${jobsSchema}.failed`).fields({
 	id: f.uuid().readOnly().filterable(),
 	name: f.text().readOnly().filterable().sortable(),
 	error: f.text().optional().readOnly(),
 	attempts: f.integer().readOnly(),
-	failedAt: f.timestamp().readOnly().filterable().sortable(),
-	createdAt: f.timestamp().readOnly().sortable(),
+	failed_at: f.timestamp().readOnly().filterable().sortable(),
+	created_at: f.timestamp().readOnly().sortable(),
 	key: f.text().optional().readOnly().filterable(),
 	payload: f.json().optional().readOnly(),
 	output: f.json().optional().readOnly(),
@@ -24,23 +24,23 @@ const failedJobs = resource("failedJobs").table(`${jobsSchema}.failed`).fields({
 	delete: admins,
 	create: () => false
 });
-const failedJobsView = view("failedJobs").names({
+const failedJobsView = view("failed_jobs").names({
 	singular: "Failed job",
 	plural: "Failed jobs"
 }).icon("triangle-alert").title((r) => r.name).help("Jobs that used up their attempts, or failed for good. Retry one once its cause is fixed: it gets one more attempt.").fields((r) => ({
 	name: r.name.label("Job"),
 	error: r.error.label("Last error"),
-	failedAt: r.failedAt.label("Failed"),
-	createdAt: r.createdAt.label("Enqueued"),
+	failed_at: r.failed_at.label("Failed"),
+	created_at: r.created_at.label("Enqueued"),
 	output: r.output.label("Error details")
 })).list((r) => ({
 	columns: [
 		r.name,
 		r.error,
 		r.attempts,
-		r.failedAt
+		r.failed_at
 	],
-	sort: [[r.failedAt, "desc"]]
+	sort: [[r.failed_at, "desc"]]
 })).layout((r) => [
 	l.section("Failure", [r.error, r.output]),
 	l.section("Job", [
@@ -50,8 +50,8 @@ const failedJobsView = view("failedJobs").names({
 	]),
 	l.sidebar([
 		r.attempts,
-		r.failedAt,
-		r.createdAt
+		r.failed_at,
+		r.created_at
 	])
 ]).actions((a) => [a.update("retry", {
 	label: "Retry",

package/dist/jobs/functions-sql.js

@@ -1,5 +1,5 @@
 /** The comment each Protobase function in the jobs schema carries, which the startup check reads. */
-const functionsComment = `Protobase jobs 2`;
+const functionsComment = `Protobase jobs 3`;
 /** Protobase's own functions beside pg-boss's tables, by name; each carries `functionsComment`. */
 const functionNames = [
 	"enqueue",
@@ -11,7 +11,9 @@ const functionNames = [
 * `jobs.enqueue(name, payload, run_at, key, group_key, priority)`: a job from SQL, such as a trigger, in the caller's
 * transaction. It inserts what pg-boss's `send()` does, with the queue's retry settings; it creates a queue that no
 * worker has created yet. A `key` keeps one waiting job, as `mode: 'dedupe'` does, and an ordered job takes its group
-* as `group_key`. Tied to the pg-boss schema version, which the startup check pins.
+* as `group_key`, and an id from `uuidv7()`, which rises within a database session: pg-boss runs a group's jobs by their
+* transaction's start, then by id, so the jobs one transaction enqueues run in that order. Tied to the pg-boss schema
+* version, which the startup check pins.
 */
 const enqueue = (schema) => `create or replace function ${schema}.enqueue(
   job_name text,
@@ -45,14 +47,15 @@ begin
   end if;
   execute format(
     'insert into ${schema}.%I (name, data, priority, start_after, singleton_key, retry_limit, retry_delay, retry_backoff,
-       retry_delay_max, expire_seconds, deletion_seconds, keep_until, policy, dead_letter, heartbeat_seconds, upsert_by_key)
-     values ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $4 + $12 * interval ''1s'', $13, $14, $15, $16)
+       retry_delay_max, expire_seconds, deletion_seconds, keep_until, policy, dead_letter, heartbeat_seconds, upsert_by_key, id)
+     values ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $4 + $12 * interval ''1s'', $13, $14, $15, $16, $17)
      on conflict do nothing
      returning id',
     queue.table_name)
   using job_name, payload, priority, start, coalesce(key, group_key), queue.retry_limit, queue.retry_delay,
     queue.retry_backoff, queue.retry_delay_max, queue.expire_seconds, queue.deletion_seconds, queue.retention_seconds,
-    queue.policy, queue.dead_letter, queue.heartbeat_seconds, key is not null
+    queue.policy, queue.dead_letter, queue.heartbeat_seconds, key is not null,
+    case when group_key is null then gen_random_uuid() else uuidv7() end
   into job_id;
   -- A concurrent enqueue of the same key inserted first: its job is the one waiting.
   if job_id is null and key is not null then

package/dist/jobs/runtime.js

@@ -81,8 +81,10 @@ const startJobs = async ({ db, jobs, work = true, pollSeconds = 2, shutdownSecon
 		const checked = await validatePayload(definition, payload);
 		if ("invalid" in checked) throw new Error(checked.invalid);
 		const data = checked.value ?? null;
+		const orderedId = definition.options.ordered ? (await sql`select uuidv7() as id`.execute(target)).rows[0].id : void 0;
 		const send = {
 			...sendOptions(definition.options, options),
+			...orderedId !== void 0 && { id: orderedId },
 			db: jobsDatabase(target)
 		};
 		const keyed = async (key) => {

package/dist/meta.js

@@ -1,16 +1,17 @@
 import { seesAssistant } from "./assistant/assistant-settings.js";
 import { sha256Hex, stableJson } from "./hash.js";
 import { requestAccess } from "./request-access.js";
+import { activeRole } from "./active-role.js";
 import { seesRuntime } from "./runtime/runtime-settings.js";
 import { pruneView } from "./view-access.js";
 import { prunePage } from "@protobase/layout";
-import { pickView } from "@protobase/schema";
+import { bottomBarFor, pickView } from "@protobase/schema";
 //#region src/meta.ts
 const modelsHash = (deps) => sha256Hex(stableJson(deps.registry.entries.map((entry) => entry.model))).then((hash) => hash.slice(0, 32));
 /**
 * `/meta` as one caller sees it: the resources they can do anything with, each as the restricted model (hidden fields
 * absent, `readOnly` unless writable), the view for their roles with hidden fields pruned, what they may do, and the
-* user menu without the resources they cannot see.
+* user menu and their bottom bar without the resources they cannot see.
 * The ETag hashes all of it, so it differs per user and per roles.
 */
 const createMeta = (deps) => {
@@ -32,6 +33,8 @@ const createMeta = (deps) => {
 		};
 		const pages = deps.pages.flatMap((page) => prunePage(page, session.user.roles, callerAccess) ?? []);
 		const shown = (item) => item.kind === "link" || (item.kind === "resource" ? visible.some((access) => access.entry.name === item.resource) : pages.some((page) => page.name === item.page));
+		const bar = bottomBarFor(deps.bottomBars, activeRole(session));
+		const barItems = bar?.items.filter(shown) ?? [];
 		const body = {
 			resources: visible.map((access) => access.readable),
 			views,
@@ -48,6 +51,10 @@ const createMeta = (deps) => {
 				].filter((op) => resolved.operations[op] && (resolved.recordChecks.includes(op) || resolved.rowFilter[op] !== void 0))
 			}])),
 			...deps.userMenu && { userMenu: { items: deps.userMenu.items.filter(shown) } },
+			...bar && barItems.length > 0 && { bottomBar: {
+				label: bar.label,
+				items: barItems
+			} },
 			...deps.assistant && seesAssistant(session.user.roles) && { assistant: { url: deps.assistant } },
 			...deps.runtime && seesRuntime(session.user.roles) && { runtime: { url: deps.runtime } }
 		};

package/dist/openapi/components.js

@@ -64,7 +64,7 @@ const parameters = {
 	orderBy: {
 		name: "order_by",
 		in: "query",
-		description: "Comma separated sortable fields, each with an optional `desc`, as in [AIP-132](https://google.aip.dev/132#ordering): `createdAt desc, number`. The primary key breaks ties.",
+		description: "Comma separated sortable fields, each with an optional `desc`, as in [AIP-132](https://google.aip.dev/132#ordering): `created_at desc, number`. The primary key breaks ties.",
 		schema: { type: "string" }
 	},
 	pageSize: {

package/dist/openapi/document.js

@@ -2,20 +2,22 @@ import { batchSchemas, errorResponses, parameters, problemSchema, searchBody } f
 import { resourcePaths } from "./resource-paths.js";
 import { resourceSchemas } from "./schemas.js";
 //#region src/openapi/document.ts
+const resourcesServer = (basePath) => basePath.slice(basePath.lastIndexOf("/") + 1);
+const systemServer = ".";
 /** The OpenAPI 3.1 document for one caller, generated from the resource models they may see and their zod record schemas. */
-const openApiDocument = (accesses, basePath, systemPath) => ({
+const openApiDocument = (accesses, basePath) => ({
 	openapi: "3.1.0",
 	info: {
 		title: "Protobase API",
 		version: "1.0.0",
 		description: "Admin API for an existing Postgres database. Follows Google's API design conventions ([AIP](https://google.aip.dev)) and reports errors as RFC 9457 `application/problem+json`."
 	},
-	servers: [{ url: basePath }],
+	servers: [{ url: resourcesServer(basePath) }],
 	security: [{ bearer: [] }],
 	tags: accesses.map(({ entry }) => ({ name: entry.name })),
 	paths: {
 		"/meta": {
-			servers: [{ url: systemPath || "/" }],
+			servers: [{ url: systemServer }],
 			get: {
 				operationId: "get_meta",
 				summary: "Resource and view models",
@@ -27,8 +29,8 @@ const openApiDocument = (accesses, basePath, systemPath) => ({
 				}
 			}
 		},
-		[`/${basePath.slice(basePath.lastIndexOf("/") + 1)}:batchWrite`]: {
-			servers: [{ url: basePath.slice(0, basePath.lastIndexOf("/")) || "/" }],
+		[`/${resourcesServer(basePath)}:batchWrite`]: {
+			servers: [{ url: systemServer }],
 			post: {
 				operationId: "batch_write",
 				summary: "Write many records in one transaction",

package/dist/openapi/naming.js

@@ -1,4 +1,5 @@
 //#region src/openapi/naming.ts
-const pascal = (name) => name.charAt(0).toUpperCase() + name.slice(1);
+/** A component name from a resource name: `stock_moves` and `stockMoves` both become `StockMoves`. */
+const pascal = (name) => name.split("_").map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join("");
 //#endregion
 export { pascal };

package/dist/resource-source.d.ts

@@ -1,7 +1,7 @@
 import { SubscriptionDefinition } from "./webhooks/subscription.js";
 import "./index.js";
 import { PageDefinition } from "@protobase/layout";
-import { AccessSource, EventMatch, FileProcessor, UserMenuSource, ViewModel } from "@protobase/schema";
+import { AccessSource, BottomBarSource, EventMatch, FileProcessor, UserMenuSource, ViewModel } from "@protobase/schema";
 import { z } from "zod";
 //#region src/resource-source.d.ts
 type FieldSource = {
@@ -29,7 +29,7 @@ export type ResourceSource = AccessSource & {
 };
 /**
  * Splits a config module (`import * as config from './config'`) into its resources, views, pages, subscriptions and,
- * when it exports one `userMenu(...)`, the user menu.
+ * when it exports one `userMenu(...)`, the user menu, and its `bottomBar(...)` exports in order.
  */
 export declare const configExports: (module: Record<string, unknown>) => {
   userMenu?: UserMenuSource | undefined;
@@ -39,5 +39,6 @@ export declare const configExports: (module: Record<string, unknown>) => {
   }>;
   pages: PageDefinition[];
   subscriptions: SubscriptionDefinition[];
+  bottomBars: BottomBarSource[];
 };
 //#endregion

package/dist/resource-source.js

@@ -3,7 +3,7 @@ import { isPageDefinition } from "@protobase/layout";
 //#region src/resource-source.ts
 /**
 * Splits a config module (`import * as config from './config'`) into its resources, views, pages, subscriptions and,
-* when it exports one `userMenu(...)`, the user menu.
+* when it exports one `userMenu(...)`, the user menu, and its `bottomBar(...)` exports in order.
 */
 const configExports = (module) => {
 	const values = Object.values(module);
@@ -12,12 +12,14 @@ const configExports = (module) => {
 	const others = values.filter((value) => !isPageDefinition(value) && !isSubscription(value));
 	const buildable = others.filter((value) => typeof value?.toModel === "function");
 	const menus = others.filter((value) => typeof value?.toUserMenuModel === "function");
+	const bottomBars = [...new Set(others.filter((value) => typeof value?.toBottomBarModel === "function"))];
 	if (menus.length > 1) throw new Error(`The config module exports ${menus.length} user menus; export one userMenu(...)`);
 	return {
 		resources: buildable.filter((value) => typeof value.recordSchema === "function"),
 		views: buildable.filter((value) => typeof value.recordSchema !== "function"),
 		pages,
 		subscriptions,
+		bottomBars,
 		...menus[0] && { userMenu: menus[0] }
 	};
 };

package/dist/routes/docs.js

@@ -8,10 +8,10 @@ const docsRoutes = (deps) => {
 	const app = new Hono();
 	app.get("/openapi.json", async (c) => {
 		const visible = (await Promise.all(deps.registry.entries.map((entry) => requestAccess(deps, entry, c.get("session"))))).filter((access) => Object.values(access.resolved.operations).some(Boolean));
-		return c.json(openApiDocument(visible, deps.basePath, deps.systemPath));
+		return c.json(openApiDocument(visible, deps.basePath));
 	});
 	app.get("/docs", Scalar({
-		url: `${deps.systemPath}/openapi.json`,
+		url: "openapi.json",
 		pageTitle: "Protobase API"
 	}));
 	return app;

package/dist/webhooks/table/owner-roles.js

@@ -1,23 +1,29 @@
 import { parseRoles } from "../../better-auth/parse-roles.js";
 import { effectiveRoles, globalRoles } from "../../better-auth/organizations/app-roles.js";
 import { findMember } from "../../better-auth/organizations/store.js";
+import { resolveActiveRole } from "../../better-auth/roles/active-role.js";
 //#region src/webhooks/table/owner-roles.ts
-/**
-* The roles someone holds now, as their next token would carry them: their global roles and, with organizations, their
-* app roles as a member of the tenant. None for a user who is banned or gone.
-*/
-const betterAuthOwnerRoles = (auth) => async ({ id, tenant }) => {
-	const { adapter, internalAdapter } = await auth.$context;
-	const user = await internalAdapter.findUserById(id);
-	if (!user || user.banned) return [];
+const heldIn = async (auth, user, tenant) => {
 	if (!auth.organizations) return parseRoles(user.role);
 	const global = globalRoles(user.role);
 	if (tenant === void 0) return global;
+	const { adapter } = await auth.$context;
 	const member = await findMember(adapter, {
 		organizationId: String(tenant),
-		userId: id
+		userId: user.id
 	});
 	return member ? effectiveRoles(global, member.appRoles) : global;
 };
+/**
+* The role someone acts with now, as their next session's token would carry it: the one they last chose while they
+* hold it, else their first (see `resolveActiveRole`). None for a user who is banned or gone, or holds no role.
+*/
+const betterAuthOwnerRoles = (auth) => async ({ id, tenant }) => {
+	const { internalAdapter } = await auth.$context;
+	const user = await internalAdapter.findUserById(id);
+	if (!user || user.banned) return [];
+	const active = resolveActiveRole(await heldIn(auth, user, tenant), [user.lastRole]);
+	return active === void 0 ? [] : [active];
+};
 //#endregion
 export { betterAuthOwnerRoles };

package/dist/webhooks/table/plugin.d.ts

@@ -4,7 +4,7 @@ import { ProjectConfig } from "../../project-config.js";
 /**
  * Webhook subscriptions made in the admin app: `extends: [webhooks()]` in `protobase.config.ts`. It adds the Webhook
  * subscriptions and Webhook deliveries pages, over a `webhooks` schema that `protobase migration` writes. Who may
- * create subscriptions is the resources' access (`webhookSubscriptions.create`, ...); each delivers as its owner.
+ * create subscriptions is the resources' access (`webhook_subscriptions.create`, ...); each delivers as its owner.
  */
 export declare const webhooks: (options?: WebhooksOptions) => ProjectConfig;
 //#endregion

package/dist/webhooks/table/plugin.js

@@ -4,7 +4,7 @@ import { webhookResources } from "@protobase/schema";
 /**
 * Webhook subscriptions made in the admin app: `extends: [webhooks()]` in `protobase.config.ts`. It adds the Webhook
 * subscriptions and Webhook deliveries pages, over a `webhooks` schema that `protobase migration` writes. Who may
-* create subscriptions is the resources' access (`webhookSubscriptions.create`, ...); each delivers as its owner.
+* create subscriptions is the resources' access (`webhook_subscriptions.create`, ...); each delivers as its owner.
 */
 const webhooks = (options = {}) => {
 	const schema = webhooksSchema(options);

package/dist/webhooks/table/validate-hook.js

@@ -8,7 +8,7 @@ const isHeaders = (value) => value === null || value === void 0 || typeof value
 * it covers, headers of text, and a URL at a public address. A refusal is a 400 problem, and the write rolls back.
 */
 const subscriptionWriteCheck = (models, checkUrl) => async (event) => {
-	if (event.resource.name !== "webhookSubscriptions" || !event.after) return;
+	if (event.resource.name !== "webhook_subscriptions" || !event.after) return;
 	const { events, url, filter, headers } = event.after;
 	const candidate = {
 		kind: "subscription",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -30,9 +30,9 @@
   },
   "dependencies": {
     "@better-auth/passkey": "^1.7.7",
-    "@protobase/layout": "0.9.0",
-    "@protobase/query": "0.9.0",
-    "@protobase/schema": "0.9.0",
+    "@protobase/layout": "0.10.0",
+    "@protobase/query": "0.10.0",
+    "@protobase/schema": "0.10.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@simplewebauthn/server": "^13.3.1",
     "better-auth": "^1.7.7",