Merge branch 'main' into cp/216-fix-users-link

app/src/Api.ts

@@ -61,7 +61,7 @@ export class Api {
    private token?: string;
    private user?: TApiUser;
    private verified = false;
-   private token_transport: "header" | "cookie" | "none" = "header";
+   public token_transport: "header" | "cookie" | "none" = "header";
 
    public system!: SystemApi;
    public data!: DataApi;

app/src/App.ts

@@ -5,7 +5,6 @@ import type { em as prototypeEm } from "data/prototype";
 import { Connection } from "data/connection/Connection";
 import type { Hono } from "hono";
 import {
-   type InitialModuleConfigs,
    type ModuleConfigs,
    type Modules,
    ModuleManager,
@@ -381,8 +380,10 @@ export class App<
       if (results.length > 0) {
          for (const { name, result } of results) {
             if (result) {
-               $console.log(`[Plugin:${name}] schema`);
                ctx.helper.ensureSchema(result);
+               if (ctx.flags.sync_required) {
+                  $console.log(`[Plugin:${name}] schema, sync required`);
+               }
             }
          }
       }

app/src/adapter/browser/BkndBrowserApp.tsx

@@ -0,0 +1,153 @@
+import {
+   createContext,
+   lazy,
+   Suspense,
+   useContext,
+   useEffect,
+   useState,
+   type ReactNode,
+} from "react";
+import { checksum } from "bknd/utils";
+import { App, registries, sqlocal, type BkndConfig } from "bknd";
+import { Route, Router, Switch } from "wouter";
+import { ClientProvider } from "bknd/client";
+import { SQLocalKysely } from "sqlocal/kysely";
+import type { ClientConfig, DatabasePath } from "sqlocal";
+import { OpfsStorageAdapter } from "bknd/adapter/browser";
+import type { BkndAdminConfig } from "bknd/ui";
+
+const Admin = lazy(() =>
+   Promise.all([
+      import("bknd/ui"),
+      // @ts-ignore
+      import("bknd/dist/styles.css"),
+   ]).then(([mod]) => ({
+      default: mod.Admin,
+   })),
+);
+
+function safeViewTransition(fn: () => void) {
+   if (document.startViewTransition) {
+      document.startViewTransition(fn);
+   } else {
+      fn();
+   }
+}
+
+export type BrowserBkndConfig<Args = ImportMetaEnv> = Omit<
+   BkndConfig<Args>,
+   "connection" | "app"
+> & {
+   adminConfig?: BkndAdminConfig;
+   connection?: ClientConfig | DatabasePath;
+};
+
+export type BkndBrowserAppProps = {
+   children: ReactNode;
+   header?: ReactNode;
+   loading?: ReactNode;
+   notFound?: ReactNode;
+} & BrowserBkndConfig;
+
+const BkndBrowserAppContext = createContext<{
+   app: App;
+   hash: string;
+}>(undefined!);
+
+export function BkndBrowserApp({
+   children,
+   adminConfig,
+   header,
+   loading,
+   notFound,
+   ...config
+}: BkndBrowserAppProps) {
+   const [app, setApp] = useState<App | undefined>(undefined);
+   const [hash, setHash] = useState<string>("");
+   const adminRoutePath = (adminConfig?.basepath ?? "") + "/*?";
+
+   async function onBuilt(app: App) {
+      safeViewTransition(async () => {
+         setApp(app);
+         setHash(await checksum(app.toJSON()));
+      });
+   }
+
+   useEffect(() => {
+      setup({ ...config, adminConfig })
+         .then((app) => onBuilt(app as any))
+         .catch(console.error);
+   }, []);
+
+   if (!app) {
+      return (
+         loading ?? (
+            <Center>
+               <span style={{ opacity: 0.2 }}>Loading...</span>
+            </Center>
+         )
+      );
+   }
+
+   return (
+      <BkndBrowserAppContext.Provider value={{ app, hash }}>
+         <ClientProvider storage={window.localStorage} fetcher={app.server.request}>
+            {header}
+            <Router key={hash}>
+               <Switch>
+                  {children}
+
+                  <Route path={adminRoutePath}>
+                     <Suspense>
+                        <Admin config={adminConfig} />
+                     </Suspense>
+                  </Route>
+                  <Route path="*">
+                     {notFound ?? (
+                        <Center style={{ fontSize: "48px", fontFamily: "monospace" }}>404</Center>
+                     )}
+                  </Route>
+               </Switch>
+            </Router>
+         </ClientProvider>
+      </BkndBrowserAppContext.Provider>
+   );
+}
+
+export function useApp() {
+   return useContext(BkndBrowserAppContext);
+}
+
+const Center = (props: React.HTMLAttributes<HTMLDivElement>) => (
+   <div
+      {...props}
+      style={{
+         width: "100%",
+         minHeight: "100vh",
+         display: "flex",
+         justifyContent: "center",
+         alignItems: "center",
+         ...(props.style ?? {}),
+      }}
+   />
+);
+
+let initialized = false;
+async function setup(config: BrowserBkndConfig = {}) {
+   if (initialized) return;
+   initialized = true;
+
+   registries.media.register("opfs", OpfsStorageAdapter);
+
+   const app = App.create({
+      ...config,
+      // @ts-ignore
+      connection: sqlocal(new SQLocalKysely(config.connection ?? ":localStorage:")),
+   });
+
+   await config.beforeBuild?.(app);
+   await app.build({ sync: true });
+   await config.onBuilt?.(app);
+
+   return app;
+}

app/src/adapter/browser/OpfsStorageAdapter.spec.ts

@@ -0,0 +1,34 @@
+import { describe, beforeAll, vi, afterAll, spyOn } from "bun:test";
+import { OpfsStorageAdapter } from "./OpfsStorageAdapter";
+// @ts-ignore
+import { assetsPath } from "../../../__test__/helper";
+import { adapterTestSuite } from "media/storage/adapters/adapter-test-suite";
+import { bunTestRunner } from "adapter/bun/test";
+import { MockFileSystemDirectoryHandle } from "adapter/browser/mock";
+
+describe("OpfsStorageAdapter", async () => {
+   let mockRoot: MockFileSystemDirectoryHandle;
+   let testSuiteAdapter: OpfsStorageAdapter;
+
+   const _mock = spyOn(global, "navigator");
+
+   beforeAll(() => {
+      // mock navigator.storage.getDirectory()
+      mockRoot = new MockFileSystemDirectoryHandle("opfs-root");
+      const mockNavigator = {
+         storage: {
+            getDirectory: vi.fn().mockResolvedValue(mockRoot),
+         },
+      };
+      // @ts-ignore
+      _mock.mockReturnValue(mockNavigator);
+      testSuiteAdapter = new OpfsStorageAdapter();
+   });
+
+   afterAll(() => {
+      _mock.mockRestore();
+   });
+
+   const file = Bun.file(`${assetsPath}/image.png`);
+   await adapterTestSuite(bunTestRunner, () => testSuiteAdapter, file);
+});

app/src/adapter/browser/OpfsStorageAdapter.ts

@@ -0,0 +1,265 @@
+import type { FileBody, FileListObject, FileMeta, FileUploadPayload } from "bknd";
+import { StorageAdapter, guessMimeType } from "bknd";
+import { parse, s, isFile, isBlob } from "bknd/utils";
+
+export const opfsAdapterConfig = s.object(
+   {
+      root: s.string({ default: "" }).optional(),
+   },
+   {
+      title: "OPFS",
+      description: "Origin Private File System storage",
+      additionalProperties: false,
+   },
+);
+export type OpfsAdapterConfig = s.Static<typeof opfsAdapterConfig>;
+
+/**
+ * Storage adapter for OPFS (Origin Private File System)
+ * Provides browser-based file storage using the File System Access API
+ */
+export class OpfsStorageAdapter extends StorageAdapter {
+   private config: OpfsAdapterConfig;
+   private rootPromise: Promise<FileSystemDirectoryHandle>;
+
+   constructor(config: Partial<OpfsAdapterConfig> = {}) {
+      super();
+      this.config = parse(opfsAdapterConfig, config);
+      this.rootPromise = this.initializeRoot();
+   }
+
+   private async initializeRoot(): Promise<FileSystemDirectoryHandle> {
+      const opfsRoot = await navigator.storage.getDirectory();
+      if (!this.config.root) {
+         return opfsRoot;
+      }
+
+      // navigate to or create nested directory structure
+      const parts = this.config.root.split("/").filter(Boolean);
+      let current = opfsRoot;
+      for (const part of parts) {
+         current = await current.getDirectoryHandle(part, { create: true });
+      }
+      return current;
+   }
+
+   getSchema() {
+      return opfsAdapterConfig;
+   }
+
+   getName(): string {
+      return "opfs";
+   }
+
+   async listObjects(prefix?: string): Promise<FileListObject[]> {
+      const root = await this.rootPromise;
+      const files: FileListObject[] = [];
+
+      for await (const [name, handle] of root.entries()) {
+         if (handle.kind === "file") {
+            if (!prefix || name.startsWith(prefix)) {
+               const file = await (handle as FileSystemFileHandle).getFile();
+               files.push({
+                  key: name,
+                  last_modified: new Date(file.lastModified),
+                  size: file.size,
+               });
+            }
+         }
+      }
+
+      return files;
+   }
+
+   private async computeEtagFromArrayBuffer(buffer: ArrayBuffer): Promise<string> {
+      const hashBuffer = await crypto.subtle.digest("SHA-256", buffer);
+      const hashArray = Array.from(new Uint8Array(hashBuffer));
+      const hashHex = hashArray.map((byte) => byte.toString(16).padStart(2, "0")).join("");
+
+      // wrap the hex string in quotes for ETag format
+      return `"${hashHex}"`;
+   }
+
+   async putObject(key: string, body: FileBody): Promise<string | FileUploadPayload> {
+      if (body === null) {
+         throw new Error("Body is empty");
+      }
+
+      const root = await this.rootPromise;
+      const fileHandle = await root.getFileHandle(key, { create: true });
+      const writable = await fileHandle.createWritable();
+
+      try {
+         let contentBuffer: ArrayBuffer;
+
+         if (isFile(body)) {
+            contentBuffer = await body.arrayBuffer();
+            await writable.write(contentBuffer);
+         } else if (body instanceof ReadableStream) {
+            const chunks: Uint8Array[] = [];
+            const reader = body.getReader();
+            try {
+               while (true) {
+                  const { done, value } = await reader.read();
+                  if (done) break;
+                  chunks.push(value);
+                  await writable.write(value);
+               }
+            } finally {
+               reader.releaseLock();
+            }
+            // compute total size and combine chunks for etag
+            const totalSize = chunks.reduce((sum, chunk) => sum + chunk.length, 0);
+            const combined = new Uint8Array(totalSize);
+            let offset = 0;
+            for (const chunk of chunks) {
+               combined.set(chunk, offset);
+               offset += chunk.length;
+            }
+            contentBuffer = combined.buffer;
+         } else if (isBlob(body)) {
+            contentBuffer = await (body as Blob).arrayBuffer();
+            await writable.write(contentBuffer);
+         } else {
+            // body is ArrayBuffer or ArrayBufferView
+            if (ArrayBuffer.isView(body)) {
+               const view = body as ArrayBufferView;
+               contentBuffer = view.buffer.slice(
+                  view.byteOffset,
+                  view.byteOffset + view.byteLength,
+               ) as ArrayBuffer;
+            } else {
+               contentBuffer = body as ArrayBuffer;
+            }
+            await writable.write(body);
+         }
+
+         await writable.close();
+         return await this.computeEtagFromArrayBuffer(contentBuffer);
+      } catch (error) {
+         await writable.abort();
+         throw error;
+      }
+   }
+
+   async deleteObject(key: string): Promise<void> {
+      try {
+         const root = await this.rootPromise;
+         await root.removeEntry(key);
+      } catch {
+         // file doesn't exist, which is fine
+      }
+   }
+
+   async objectExists(key: string): Promise<boolean> {
+      try {
+         const root = await this.rootPromise;
+         await root.getFileHandle(key);
+         return true;
+      } catch {
+         return false;
+      }
+   }
+
+   private parseRangeHeader(
+      rangeHeader: string,
+      fileSize: number,
+   ): { start: number; end: number } | null {
+      // parse "bytes=start-end" format
+      const match = rangeHeader.match(/^bytes=(\d*)-(\d*)$/);
+      if (!match) return null;
+
+      const [, startStr, endStr] = match;
+      let start = startStr ? Number.parseInt(startStr, 10) : 0;
+      let end = endStr ? Number.parseInt(endStr, 10) : fileSize - 1;
+
+      // handle suffix-byte-range-spec (e.g., "bytes=-500")
+      if (!startStr && endStr) {
+         start = Math.max(0, fileSize - Number.parseInt(endStr, 10));
+         end = fileSize - 1;
+      }
+
+      // validate range
+      if (start < 0 || end >= fileSize || start > end) {
+         return null;
+      }
+
+      return { start, end };
+   }
+
+   async getObject(key: string, headers: Headers): Promise<Response> {
+      try {
+         const root = await this.rootPromise;
+         const fileHandle = await root.getFileHandle(key);
+         const file = await fileHandle.getFile();
+         const fileSize = file.size;
+         const mimeType = guessMimeType(key);
+
+         const responseHeaders = new Headers({
+            "Accept-Ranges": "bytes",
+            "Content-Type": mimeType || "application/octet-stream",
+         });
+
+         const rangeHeader = headers.get("range");
+
+         if (rangeHeader) {
+            const range = this.parseRangeHeader(rangeHeader, fileSize);
+
+            if (!range) {
+               // invalid range - return 416 Range Not Satisfiable
+               responseHeaders.set("Content-Range", `bytes */${fileSize}`);
+               return new Response("", {
+                  status: 416,
+                  headers: responseHeaders,
+               });
+            }
+
+            const { start, end } = range;
+            const arrayBuffer = await file.arrayBuffer();
+            const chunk = arrayBuffer.slice(start, end + 1);
+
+            responseHeaders.set("Content-Range", `bytes ${start}-${end}/${fileSize}`);
+            responseHeaders.set("Content-Length", chunk.byteLength.toString());
+
+            return new Response(chunk, {
+               status: 206, // Partial Content
+               headers: responseHeaders,
+            });
+         } else {
+            // normal request - return entire file
+            const content = await file.arrayBuffer();
+            responseHeaders.set("Content-Length", content.byteLength.toString());
+
+            return new Response(content, {
+               status: 200,
+               headers: responseHeaders,
+            });
+         }
+      } catch {
+         // handle file reading errors
+         return new Response("", { status: 404 });
+      }
+   }
+
+   getObjectUrl(_key: string): string {
+      throw new Error("Method not implemented.");
+   }
+
+   async getObjectMeta(key: string): Promise<FileMeta> {
+      const root = await this.rootPromise;
+      const fileHandle = await root.getFileHandle(key);
+      const file = await fileHandle.getFile();
+
+      return {
+         type: guessMimeType(key) || "application/octet-stream",
+         size: file.size,
+      };
+   }
+
+   toJSON(_secrets?: boolean) {
+      return {
+         type: this.getName(),
+         config: this.config,
+      };
+   }
+}

app/src/adapter/browser/index.ts

@@ -0,0 +1,2 @@
+export * from "./OpfsStorageAdapter";
+export * from "./BkndBrowserApp";

app/src/adapter/browser/mock.ts

@@ -0,0 +1,136 @@
+// mock OPFS API for testing
+class MockFileSystemFileHandle {
+   kind: "file" = "file";
+   name: string;
+   private content: ArrayBuffer;
+   private lastModified: number;
+
+   constructor(name: string, content: ArrayBuffer = new ArrayBuffer(0)) {
+      this.name = name;
+      this.content = content;
+      this.lastModified = Date.now();
+   }
+
+   async getFile(): Promise<File> {
+      return new File([this.content], this.name, {
+         lastModified: this.lastModified,
+         type: this.guessMimeType(),
+      });
+   }
+
+   async createWritable(): Promise<FileSystemWritableFileStream> {
+      const handle = this;
+      return {
+         async write(data: any) {
+            if (data instanceof ArrayBuffer) {
+               handle.content = data;
+            } else if (ArrayBuffer.isView(data)) {
+               handle.content = data.buffer.slice(
+                  data.byteOffset,
+                  data.byteOffset + data.byteLength,
+               ) as ArrayBuffer;
+            } else if (data instanceof Blob) {
+               handle.content = await data.arrayBuffer();
+            }
+            handle.lastModified = Date.now();
+         },
+         async close() {},
+         async abort() {},
+         async seek(_position: number) {},
+         async truncate(_size: number) {},
+      } as FileSystemWritableFileStream;
+   }
+
+   private guessMimeType(): string {
+      const ext = this.name.split(".").pop()?.toLowerCase();
+      const mimeTypes: Record<string, string> = {
+         png: "image/png",
+         jpg: "image/jpeg",
+         jpeg: "image/jpeg",
+         gif: "image/gif",
+         webp: "image/webp",
+         svg: "image/svg+xml",
+         txt: "text/plain",
+         json: "application/json",
+         pdf: "application/pdf",
+      };
+      return mimeTypes[ext || ""] || "application/octet-stream";
+   }
+}
+
+export class MockFileSystemDirectoryHandle {
+   kind: "directory" = "directory";
+   name: string;
+   private files: Map<string, MockFileSystemFileHandle> = new Map();
+   private directories: Map<string, MockFileSystemDirectoryHandle> = new Map();
+
+   constructor(name: string = "root") {
+      this.name = name;
+   }
+
+   async getFileHandle(
+      name: string,
+      options?: FileSystemGetFileOptions,
+   ): Promise<FileSystemFileHandle> {
+      if (this.files.has(name)) {
+         return this.files.get(name) as any;
+      }
+      if (options?.create) {
+         const handle = new MockFileSystemFileHandle(name);
+         this.files.set(name, handle);
+         return handle as any;
+      }
+      throw new Error(`File not found: ${name}`);
+   }
+
+   async getDirectoryHandle(
+      name: string,
+      options?: FileSystemGetDirectoryOptions,
+   ): Promise<FileSystemDirectoryHandle> {
+      if (this.directories.has(name)) {
+         return this.directories.get(name) as any;
+      }
+      if (options?.create) {
+         const handle = new MockFileSystemDirectoryHandle(name);
+         this.directories.set(name, handle);
+         return handle as any;
+      }
+      throw new Error(`Directory not found: ${name}`);
+   }
+
+   async removeEntry(name: string, _options?: FileSystemRemoveOptions): Promise<void> {
+      this.files.delete(name);
+      this.directories.delete(name);
+   }
+
+   async *entries(): AsyncIterableIterator<[string, FileSystemHandle]> {
+      for (const [name, handle] of this.files) {
+         yield [name, handle as any];
+      }
+      for (const [name, handle] of this.directories) {
+         yield [name, handle as any];
+      }
+   }
+
+   async *keys(): AsyncIterableIterator<string> {
+      for (const name of this.files.keys()) {
+         yield name;
+      }
+      for (const name of this.directories.keys()) {
+         yield name;
+      }
+   }
+
+   async *values(): AsyncIterableIterator<FileSystemHandle> {
+      for (const handle of this.files.values()) {
+         yield handle as any;
+      }
+      for (const handle of this.directories.values()) {
+         yield handle as any;
+      }
+   }
+
+   [Symbol.asyncIterator](): AsyncIterableIterator<[string, FileSystemHandle]> {
+      return this.entries();
+   }
+}

app/src/adapter/bun/bun.adapter.ts

@@ -1,14 +1,12 @@
-/// <reference types="bun-types" />
-
 import path from "node:path";
 import { type RuntimeBkndConfig, createRuntimeApp } from "bknd/adapter";
 import { registerLocalMediaAdapter } from ".";
 import { config, type App } from "bknd";
-import type { ServeOptions } from "bun";
 import { serveStatic } from "hono/bun";
 
 type BunEnv = Bun.Env;
-export type BunBkndConfig<Env = BunEnv> = RuntimeBkndConfig<Env> & Omit<ServeOptions, "fetch">;
+export type BunBkndConfig<Env = BunEnv> = RuntimeBkndConfig<Env> &
+   Omit<Bun.Serve.Options<undefined, string>, "fetch">;
 
 export async function createApp<Env = BunEnv>(
    { distPath, serveStatic: _serveStatic, ...config }: BunBkndConfig<Env> = {},
@@ -45,6 +43,7 @@ export function createHandler<Env = BunEnv>(
 
 export function serve<Env = BunEnv>(
    {
+      app,
       distPath,
       connection,
       config: _config,
@@ -60,10 +59,11 @@ export function serve<Env = BunEnv>(
    args: Env = Bun.env as Env,
 ) {
    Bun.serve({
-      ...serveOptions,
+      ...(serveOptions as any),
       port,
       fetch: createHandler(
          {
+            app,
             connection,
             config: _config,
             options,

app/src/adapter/cloudflare/cloudflare-workers.adapter.ts

@@ -3,7 +3,7 @@
 import type { RuntimeBkndConfig } from "bknd/adapter";
 import { Hono } from "hono";
 import { serveStatic } from "hono/cloudflare-workers";
-import type { MaybePromise } from "bknd";
+import type { App, MaybePromise } from "bknd";
 import { $console } from "bknd/utils";
 import { createRuntimeApp } from "bknd/adapter";
 import { registerAsyncsExecutionContext, makeConfig, type CloudflareContext } from "./config";
@@ -55,8 +55,12 @@ export async function createApp<Env extends CloudflareEnv = CloudflareEnv>(
 // compatiblity
 export const getFresh = createApp;
 
+let app: App | undefined;
 export function serve<Env extends CloudflareEnv = CloudflareEnv>(
    config: CloudflareBkndConfig<Env> = {},
+   serveOptions?: (args: Env) => {
+      warm?: boolean;
+   },
 ) {
    return {
       async fetch(request: Request, env: Env, ctx: ExecutionContext) {
@@ -92,8 +96,11 @@ export function serve<Env extends CloudflareEnv = CloudflareEnv>(
             }
          }
 
-         const context = { request, env, ctx } as CloudflareContext<Env>;
-         const app = await createApp(config, context);
+         const { warm } = serveOptions?.(env) ?? {};
+         if (!app || warm !== true) {
+            const context = { request, env, ctx } as CloudflareContext<Env>;
+            app = await createApp(config, context);
+         }
 
          return app.fetch(request, env, ctx);
       },

app/src/adapter/cloudflare/proxy.ts

@@ -65,37 +65,31 @@ export function withPlatformProxy<Env extends CloudflareEnv>(
    }
 
    return {
-      ...config,
-      beforeBuild: async (app, registries) => {
-         if (!use_proxy) return;
-         const env = await getEnv();
-         registerMedia(env, registries as any);
-         await config?.beforeBuild?.(app, registries);
-      },
-      bindings: async (env) => {
-         return (await config?.bindings?.(await getEnv(env))) || {};
-      },
       // @ts-ignore
       app: async (_env) => {
          const env = await getEnv(_env);
          const binding = use_proxy ? getBinding(env, "D1Database") : undefined;
+         const appConfig = typeof config.app === "function" ? await config.app(env) : config;
+         const connection =
+            use_proxy && binding
+               ? d1Sqlite({
+                    binding: binding.value as any,
+                 })
+               : appConfig.connection;
 
-         if (config?.app === undefined && use_proxy && binding) {
-            return {
-               connection: d1Sqlite({
-                  binding: binding.value,
-               }),
-            };
-         } else if (typeof config?.app === "function") {
-            const appConfig = await config?.app(env);
-            if (binding) {
-               appConfig.connection = d1Sqlite({
-                  binding: binding.value,
-               }) as any;
-            }
-            return appConfig;
-         }
-         return config?.app || {};
+         return {
+            ...appConfig,
+            beforeBuild: async (app, registries) => {
+               if (!use_proxy) return;
+               const env = await getEnv();
+               registerMedia(env, registries as any);
+               await config?.beforeBuild?.(app, registries);
+            },
+            bindings: async (env) => {
+               return (await config?.bindings?.(await getEnv(env))) || {};
+            },
+            connection,
+         };
       },
    } satisfies CloudflareBkndConfig<Env>;
 }

app/src/adapter/index.ts

@@ -14,14 +14,15 @@ import type { AdminControllerOptions } from "modules/server/AdminController";
 import type { Manifest } from "vite";
 
 export type BkndConfig<Args = any, Additional = {}> = Merge<
-   CreateAppConfig & {
-      app?:
-         | Merge<Omit<BkndConfig, "app"> & Additional>
-         | ((args: Args) => MaybePromise<Merge<Omit<BkndConfig<Args>, "app"> & Additional>>);
-      onBuilt?: (app: App) => MaybePromise<void>;
-      beforeBuild?: (app?: App, registries?: typeof $registries) => MaybePromise<void>;
-      buildConfig?: Parameters<App["build"]>[0];
-   } & Additional
+   CreateAppConfig &
+      Omit<Additional, "app"> & {
+         app?:
+            | Omit<BkndConfig<Args, Additional>, "app">
+            | ((args: Args) => MaybePromise<Omit<BkndConfig<Args, Additional>, "app">>);
+         onBuilt?: (app: App) => MaybePromise<void>;
+         beforeBuild?: (app?: App, registries?: typeof $registries) => MaybePromise<void>;
+         buildConfig?: Parameters<App["build"]>[0];
+      }
 >;
 
 export type FrameworkBkndConfig<Args = any> = BkndConfig<Args>;

app/src/adapter/nextjs/nextjs.adapter.ts

@@ -1,5 +1,6 @@
 import { createFrameworkApp, type FrameworkBkndConfig } from "bknd/adapter";
 import { isNode } from "bknd/utils";
+// @ts-expect-error next is not installed
 import type { NextApiRequest } from "next";
 
 type NextjsEnv = NextApiRequest["env"];
@@ -18,7 +19,9 @@ function getCleanRequest(req: Request, cleanRequest: NextjsBkndConfig["cleanRequ
    if (!cleanRequest) return req;
 
    const url = new URL(req.url);
-   cleanRequest?.searchParams?.forEach((k) => url.searchParams.delete(k));
+   cleanRequest?.searchParams?.forEach((k) => {
+      url.searchParams.delete(k);
+   });
 
    if (isNode()) {
       return new Request(url.toString(), {

app/src/adapter/node/node.adapter.ts

@@ -24,7 +24,7 @@ export async function createApp<Env = NodeEnv>(
       path.resolve(distPath ?? relativeDistPath ?? "./node_modules/bknd/dist", "static"),
    );
    if (relativeDistPath) {
-      console.warn("relativeDistPath is deprecated, please use distPath instead");
+      $console.warn("relativeDistPath is deprecated, please use distPath instead");
    }
 
    registerLocalMediaAdapter();

app/src/adapter/node/node.adapter.vi-test.ts

@@ -1,4 +1,4 @@
-import { describe, beforeAll, afterAll } from "vitest";
+import { describe } from "vitest";
 import * as node from "./node.adapter";
 import { adapterTestSuite } from "adapter/adapter-test-suite";
 import { viTestRunner } from "adapter/node/vitest";

app/src/adapter/sveltekit/index.ts

@@ -0,0 +1 @@
+export * from "./sveltekit.adapter";

app/src/adapter/sveltekit/sveltekit.adapter.spec.ts

@@ -0,0 +1,16 @@
+import { afterAll, beforeAll, describe } from "bun:test";
+import * as sveltekit from "./sveltekit.adapter";
+import { disableConsoleLog, enableConsoleLog } from "core/utils";
+import { adapterTestSuite } from "adapter/adapter-test-suite";
+import { bunTestRunner } from "adapter/bun/test";
+
+beforeAll(disableConsoleLog);
+afterAll(enableConsoleLog);
+
+describe("sveltekit adapter", () => {
+   adapterTestSuite(bunTestRunner, {
+      makeApp: (c, a) => sveltekit.getApp(c as any, a ?? ({} as any)),
+      makeHandler: (c, a) => (request: Request) =>
+         sveltekit.serve(c as any, a ?? ({} as any))({ request }),
+   });
+});

app/src/adapter/sveltekit/sveltekit.adapter.ts

@@ -0,0 +1,33 @@
+import { createRuntimeApp, type RuntimeBkndConfig } from "bknd/adapter";
+
+type TSvelteKit = {
+   request: Request;
+};
+
+export type SvelteKitBkndConfig<Env> = Pick<RuntimeBkndConfig<Env>, "adminOptions">;
+
+/**
+ * Get bknd app instance
+ * @param config - bknd configuration
+ * @param args - environment variables (use $env/dynamic/private for universal runtime support)
+ */
+export async function getApp<Env>(
+   config: SvelteKitBkndConfig<Env> = {} as SvelteKitBkndConfig<Env>,
+   args: Env,
+) {
+   return await createRuntimeApp(config, args);
+}
+
+/**
+ * Create request handler for hooks.server.ts
+ * @param config - bknd configuration
+ * @param args - environment variables (use $env/dynamic/private for universal runtime support)
+ */
+export function serve<Env>(
+   config: SvelteKitBkndConfig<Env> = {} as SvelteKitBkndConfig<Env>,
+   args: Env,
+) {
+   return async (fnArgs: TSvelteKit) => {
+      return (await getApp(config, args)).fetch(fnArgs.request);
+   };
+}

app/src/auth/AppAuth.ts

@@ -46,6 +46,22 @@ export class AppAuth extends Module<AppAuthSchema> {
          to.strategies!.password!.enabled = true;
       }
 
+      if (to.default_role_register && to.default_role_register?.length > 0) {
+         const valid_to_role = Object.keys(to.roles ?? {}).includes(to.default_role_register);
+
+         if (!valid_to_role) {
+            const msg = `Default role for registration not found: ${to.default_role_register}`;
+            // if changing to a new value
+            if (from.default_role_register !== to.default_role_register) {
+               throw new Error(msg);
+            }
+
+            // resetting gracefully, since role doesn't exist anymore
+            $console.warn(`${msg}, resetting to undefined`);
+            to.default_role_register = undefined;
+         }
+      }
+
       return to;
    }
 
@@ -82,6 +98,7 @@ export class AppAuth extends Module<AppAuthSchema> {
       this._authenticator = new Authenticator(strategies, new AppUserPool(this), {
          jwt: this.config.jwt,
          cookie: this.config.cookie,
+         default_role_register: this.config.default_role_register,
       });
 
       this.registerEntities();
@@ -171,10 +188,20 @@ export class AppAuth extends Module<AppAuthSchema> {
       } catch (e) {}
    }
 
-   async createUser({ email, password, ...additional }: CreateUserPayload): Promise<DB["users"]> {
+   async createUser({
+      email,
+      password,
+      role,
+      ...additional
+   }: CreateUserPayload): Promise<DB["users"]> {
       if (!this.enabled) {
          throw new Error("Cannot create user, auth not enabled");
       }
+      if (role) {
+         if (!Object.keys(this.config.roles ?? {}).includes(role)) {
+            throw new Error(`Role "${role}" not found`);
+         }
+      }
 
       const strategy = "password" as const;
       const pw = this.authenticator.strategy(strategy) as PasswordStrategy;
@@ -183,6 +210,7 @@ export class AppAuth extends Module<AppAuthSchema> {
       mutator.__unstable_toggleSystemEntityCreation(false);
       const { data: created } = await mutator.insertOne({
          ...(additional as any),
+         role: role || this.config.default_role_register || undefined,
          email,
          strategy,
          strategy_value,

app/src/auth/api/AuthController.ts

@@ -13,6 +13,7 @@ import {
    InvalidSchemaError,
    transformObject,
    mcpTool,
+   $console,
 } from "bknd/utils";
 import type { PasswordStrategy } from "auth/authenticate/strategies";
 
@@ -210,7 +211,7 @@ export class AuthController extends Controller {
       const idType = s.anyOf([s.number({ title: "Integer" }), s.string({ title: "UUID" })]);
 
       const getUser = async (params: { id?: string | number; email?: string }) => {
-         let user: DB["users"] | undefined = undefined;
+         let user: DB["users"] | undefined;
          if (params.id) {
             const { data } = await this.userRepo.findId(params.id);
             user = data;
@@ -225,26 +226,33 @@ export class AuthController extends Controller {
       };
 
       const roles = Object.keys(this.auth.config.roles ?? {});
-      mcp.tool(
-         "auth_user_create",
-         {
-            description: "Create a new user",
-            inputSchema: s.object({
-               email: s.string({ format: "email" }),
-               password: s.string({ minLength: 8 }),
-               role: s
-                  .string({
-                     enum: roles.length > 0 ? roles : undefined,
-                  })
-                  .optional(),
-            }),
-         },
-         async (params, c) => {
-            await c.context.ctx().helper.granted(c, AuthPermissions.createUser);
+      try {
+         const actions = this.auth.authenticator.strategy("password").getActions();
+         if (actions.create) {
+            const schema = actions.create.schema;
+            mcp.tool(
+               "auth_user_create",
+               {
+                  description: "Create a new user",
+                  inputSchema: s.object({
+                     ...schema.properties,
+                     role: s
+                        .string({
+                           enum: roles.length > 0 ? roles : undefined,
+                        })
+                        .optional(),
+                  }),
+               },
+               async (params, c) => {
+                  await c.context.ctx().helper.granted(c, AuthPermissions.createUser);
 
-            return c.json(await this.auth.createUser(params));
-         },
-      );
+                  return c.json(await this.auth.createUser(params));
+               },
+            );
+         }
+      } catch (e) {
+         $console.warn("error creating auth_user_create tool", e);
+      }
 
       mcp.tool(
          "auth_user_token",

app/src/auth/auth-schema.ts

@@ -51,6 +51,7 @@ export const authConfigSchema = $object(
       basepath: s.string({ default: "/api/auth" }),
       entity_name: s.string({ default: "users" }),
       allow_register: s.boolean({ default: true }).optional(),
+      default_role_register: s.string().optional(),
       jwt: jwtConfig,
       cookie: cookieConfig,
       strategies: $record(

app/src/auth/authenticate/Authenticator.ts

@@ -74,6 +74,7 @@ export const jwtConfig = s.strictObject(
 export const authenticatorConfig = s.object({
    jwt: jwtConfig,
    cookie: cookieConfig,
+   default_role_register: s.string().optional(),
 });
 
 type AuthConfig = s.Static<typeof authenticatorConfig>;
@@ -164,9 +165,13 @@ export class Authenticator<
          if (!("strategy_value" in profile)) {
             throw new InvalidConditionsException("Profile must have a strategy value");
          }
+         if ("role" in profile) {
+            throw new InvalidConditionsException("Role cannot be provided during registration");
+         }
 
          const user = await this.userPool.create(strategy.getName(), {
             ...profile,
+            role: this.config.default_role_register,
             strategy_value: profile.strategy_value,
          });
 

app/src/auth/authenticate/strategies/PasswordStrategy.ts

@@ -10,6 +10,7 @@ const schema = s
    .object({
       hashing: s.string({ enum: ["plain", "sha256", "bcrypt"], default: "sha256" }),
       rounds: s.number({ minimum: 1, maximum: 10 }).optional(),
+      minLength: s.number({ default: 8, minimum: 1 }).optional(),
    })
    .strict();
 
@@ -37,7 +38,7 @@ export class PasswordStrategy extends AuthStrategy<typeof schema> {
             format: "email",
          }),
          password: s.string({
-            minLength: 8, // @todo: this should be configurable
+            minLength: this.config.minLength,
          }),
       });
    }
@@ -65,12 +66,21 @@ export class PasswordStrategy extends AuthStrategy<typeof schema> {
             return await bcryptCompare(compare, actual);
       }
 
-      return false;
+      return actual === compare;
    }
 
    verify(password: string) {
       return async (user: User) => {
-         const compare = await this.compare(user?.strategy_value!, password);
+         if (!user || !user.strategy_value) {
+            throw new InvalidCredentialsException();
+         }
+
+         if (!this.getPayloadSchema().properties.password.validate(password).valid) {
+            $console.debug("PasswordStrategy: Invalid password", password);
+            throw new InvalidCredentialsException();
+         }
+
+         const compare = await this.compare(user.strategy_value, password);
          if (compare !== true) {
             throw new InvalidCredentialsException();
          }

app/src/cli/commands/run/platform.ts

@@ -67,7 +67,10 @@ export async function startServer(
    $console.info("Server listening on", url);
 
    if (options.open) {
-      await open(url);
+      const p = await open(url, { wait: false });
+      p.on("error", () => {
+         $console.warn("Couldn't open url in browser");
+      });
    }
 }
 

app/src/core/drivers/email/plunk.spec.ts

@@ -0,0 +1,55 @@
+import { describe, it, expect } from "bun:test";
+import { plunkEmail } from "./plunk";
+
+const ALL_TESTS = !!process.env.ALL_TESTS;
+
+describe.skipIf(ALL_TESTS)("plunk", () => {
+	it("should throw on failed", async () => {
+		const driver = plunkEmail({ apiKey: "invalid" });
+		expect(driver.send("foo@bar.com", "Test", "Test")).rejects.toThrow();
+	});
+
+	it("should send an email", async () => {
+		const driver = plunkEmail({
+			apiKey: process.env.PLUNK_API_KEY!,
+			from: undefined, // Default to what Plunk sets
+		});
+		const response = await driver.send(
+			"help@bknd.io",
+			"Test Email from Plunk",
+			"This is a test email",
+		);
+		expect(response).toBeDefined();
+		expect(response.success).toBe(true);
+		expect(response.emails).toBeDefined();
+		expect(response.timestamp).toBeDefined();
+	});
+
+	it("should send HTML email", async () => {
+		const driver = plunkEmail({
+			apiKey: process.env.PLUNK_API_KEY!,
+			from: undefined,
+		});
+		const htmlBody = "<h1>Test Email</h1><p>This is a test email</p>";
+		const response = await driver.send(
+			"help@bknd.io",
+			"HTML Test",
+			htmlBody,
+		);
+		expect(response).toBeDefined();
+		expect(response.success).toBe(true);
+	});
+
+	it("should send with text and html", async () => {
+		const driver = plunkEmail({
+			apiKey: process.env.PLUNK_API_KEY!,
+			from: undefined,
+		});
+		const response = await driver.send("test@example.com", "Test Email", {
+			text: "help@bknd.io",
+			html: "<p>This is HTML</p>",
+		});
+		expect(response).toBeDefined();
+		expect(response.success).toBe(true);
+	});
+});

app/src/core/drivers/email/plunk.ts

@@ -0,0 +1,70 @@
+import type { IEmailDriver } from "./index";
+
+export type PlunkEmailOptions = {
+	apiKey: string;
+	host?: string;
+	from?: string;
+};
+
+export type PlunkEmailSendOptions = {
+	subscribed?: boolean;
+	name?: string;
+	from?: string;
+	reply?: string;
+	headers?: Record<string, string>;
+};
+
+export type PlunkEmailResponse = {
+	success: boolean;
+	emails: Array<{
+		contact: {
+			id: string;
+			email: string;
+		};
+		email: string;
+	}>;
+	timestamp: string;
+};
+
+export const plunkEmail = (
+	config: PlunkEmailOptions,
+): IEmailDriver<PlunkEmailResponse, PlunkEmailSendOptions> => {
+	const host = config.host ?? "https://api.useplunk.com/v1/send";
+	const from = config.from;
+
+	return {
+		send: async (
+			to: string,
+			subject: string,
+			body: string | { text: string; html: string },
+			options?: PlunkEmailSendOptions,
+		) => {
+			const payload: any = {
+			  from,
+				to,
+				subject,
+			};
+
+			if (typeof body === "string") {
+				payload.body = body;
+			} else {
+				payload.body = body.html;
+			}
+
+			const res = await fetch(host, {
+				method: "POST",
+				headers: {
+					"Content-Type": "application/json",
+					Authorization: `Bearer ${config.apiKey}`,
+				},
+				body: JSON.stringify({ ...payload, ...options }),
+			});
+
+			if (!res.ok) {
+				throw new Error(`Plunk API error: ${await res.text()}`);
+			}
+
+			return (await res.json()) as PlunkEmailResponse;
+		},
+	};
+};

app/src/core/drivers/email/resend.spec.ts

@@ -4,7 +4,7 @@ import { resendEmail } from "./resend";
 const ALL_TESTS = !!process.env.ALL_TESTS;
 
 describe.skipIf(ALL_TESTS)("resend", () => {
-   it.only("should throw on failed", async () => {
+   it("should throw on failed", async () => {
       const driver = resendEmail({ apiKey: "invalid" } as any);
       expect(driver.send("foo@bar.com", "Test", "Test")).rejects.toThrow();
    });

app/src/core/drivers/index.ts

@@ -5,3 +5,4 @@ export type { IEmailDriver } from "./email";
 export { resendEmail } from "./email/resend";
 export { sesEmail } from "./email/ses";
 export { mailchannelsEmail } from "./email/mailchannels";
+export { plunkEmail } from "./email/plunk";

app/src/core/env.ts

@@ -8,7 +8,7 @@ export function isDebug(): boolean {
    try {
       // @ts-expect-error - this is a global variable in dev
       return is_toggled(__isDev);
-   } catch (e) {
+   } catch (_e) {
       return false;
    }
 }

app/src/core/events/EventListener.ts

@@ -1,3 +1,4 @@
+import type { MaybePromise } from "bknd";
 import type { Event } from "./Event";
 import type { EventClass } from "./EventManager";
 
@@ -7,7 +8,7 @@ export type ListenerMode = (typeof ListenerModes)[number];
 export type ListenerHandler<E extends Event<any, any>> = (
    event: E,
    slug: string,
-) => E extends Event<any, infer R> ? R | Promise<R | void> : never;
+) => E extends Event<any, infer R> ? MaybePromise<R | void> : never;
 
 export class EventListener<E extends Event = Event> {
    mode: ListenerMode = "async";

app/src/core/server/flash.ts

@@ -32,6 +32,7 @@ export function getFlashMessage(
 ): { type: FlashMessageType; message: string } | undefined {
    const flash = getCookieValue(flash_key);
    if (flash && clear) {
+      // biome-ignore lint/suspicious/noDocumentCookie: .
       document.cookie = `${flash_key}=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/;`;
    }
    return flash ? JSON.parse(flash) : undefined;

app/src/core/utils/objects.ts

@@ -14,9 +14,9 @@ export function isObject(value: unknown): value is Record<string, unknown> {
 
 export function omitKeys<T extends object, K extends keyof T>(
    obj: T,
-   keys_: readonly K[],
+   keys_: readonly K[] | K[] | string[],
 ): Omit<T, Extract<K, keyof T>> {
-   const keys = new Set(keys_);
+   const keys = new Set(keys_ as readonly K[]);
    const result = {} as Omit<T, Extract<K, keyof T>>;
    for (const [key, value] of Object.entries(obj) as [keyof T, T[keyof T]][]) {
       if (!keys.has(key as K)) {

app/src/core/utils/runtime.ts

@@ -1,3 +1,4 @@
+import type { MaybePromise } from "core/types";
 import { getRuntimeKey as honoGetRuntimeKey } from "hono/adapter";
 
 /**
@@ -77,3 +78,37 @@ export function threw(fn: () => any, instance?: new (...args: any[]) => Error) {
       return true;
    }
 }
+
+export async function threwAsync(fn: Promise<any>, instance?: new (...args: any[]) => Error) {
+   try {
+      await fn;
+      return false;
+   } catch (e) {
+      if (instance) {
+         if (e instanceof instance) {
+            return true;
+         }
+         // if instance given but not what expected, throw
+         throw e;
+      }
+      return true;
+   }
+}
+
+export async function $waitUntil(
+   message: string,
+   condition: () => MaybePromise<boolean>,
+   delay = 100,
+   maxAttempts = 10,
+) {
+   let attempts = 0;
+   while (attempts < maxAttempts) {
+      if (await condition()) {
+         return;
+      }
+      await new Promise((resolve) => setTimeout(resolve, delay));
+      attempts++;
+   }
+
+   throw new Error(`$waitUntil: "${message}" failed after ${maxAttempts} attempts`);
+}

app/src/core/utils/strings.ts

@@ -120,17 +120,14 @@ export function patternMatch(target: string, pattern: RegExp | string): boolean
 }
 
 export function slugify(str: string): string {
-   return (
-      String(str)
-         .normalize("NFKD") // split accented characters into their base characters and diacritical marks
-         // biome-ignore lint/suspicious/noMisleadingCharacterClass: <explanation>
-         .replace(/[\u0300-\u036f]/g, "") // remove all the accents, which happen to be all in the \u03xx UNICODE block.
-         .trim() // trim leading or trailing whitespace
-         .toLowerCase() // convert to lowercase
-         .replace(/[^a-z0-9 -]/g, "") // remove non-alphanumeric characters
-         .replace(/\s+/g, "-") // replace spaces with hyphens
-         .replace(/-+/g, "-") // remove consecutive hyphens
-   );
+   return String(str)
+      .normalize("NFKD") // split accented characters into their base characters and diacritical marks
+      .replace(/[\u0300-\u036f]/g, "") // remove all the accents, which happen to be all in the \u03xx UNICODE block.
+      .trim() // trim leading or trailing whitespace
+      .toLowerCase() // convert to lowercase
+      .replace(/[^a-z0-9 -]/g, "") // remove non-alphanumeric characters
+      .replace(/\s+/g, "-") // replace spaces with hyphens
+      .replace(/-+/g, "-"); // remove consecutive hyphens
 }
 
 export function truncate(str: string, length = 50, end = "..."): string {

app/src/data/api/DataController.ts

@@ -96,6 +96,9 @@ export class DataController extends Controller {
       // read entity schema
       hono.get(
          "/schema.json",
+         permission(SystemPermissions.schemaRead, {
+            context: (_c) => ({ module: "data" }),
+         }),
          permission(DataPermissions.entityRead, {
             context: (c) => ({ entity: c.req.param("entity") }),
          }),
@@ -124,6 +127,9 @@ export class DataController extends Controller {
       // read schema
       hono.get(
          "/schemas/:entity/:context?",
+         permission(SystemPermissions.schemaRead, {
+            context: (_c) => ({ module: "data" }),
+         }),
          permission(DataPermissions.entityRead, {
             context: (c) => ({ entity: c.req.param("entity") }),
          }),
@@ -161,7 +167,7 @@ export class DataController extends Controller {
       hono.get(
          "/types",
          permission(SystemPermissions.schemaRead, {
-            context: (c) => ({ module: "data" }),
+            context: (_c) => ({ module: "data" }),
          }),
          describeRoute({
             summary: "Retrieve data typescript definitions",
@@ -182,6 +188,9 @@ export class DataController extends Controller {
        */
       hono.get(
          "/info/:entity",
+         permission(SystemPermissions.schemaRead, {
+            context: (_c) => ({ module: "data" }),
+         }),
          permission(DataPermissions.entityRead, {
             context: (c) => ({ entity: c.req.param("entity") }),
          }),

app/src/data/connection/Connection.ts

@@ -6,17 +6,15 @@ import {
    type CompiledQuery,
    type DatabaseIntrospector,
    type Dialect,
-   type Expression,
    type Kysely,
    type KyselyPlugin,
    type OnModifyForeignAction,
    type QueryResult,
-   type RawBuilder,
    type SelectQueryBuilder,
    type SelectQueryNode,
-   type Simplify,
    sql,
 } from "kysely";
+import type { jsonArrayFrom, jsonBuildObject, jsonObjectFrom } from "kysely/helpers/sqlite";
 import type { BaseIntrospector, BaseIntrospectorConfig } from "./BaseIntrospector";
 import type { DB } from "bknd";
 import type { Constructor } from "core/registry/Registry";
@@ -70,15 +68,9 @@ export type IndexSpec = {
 };
 
 export type DbFunctions = {
-   jsonObjectFrom<O>(expr: SelectQueryBuilderExpression<O>): RawBuilder<Simplify<O> | null>;
-   jsonArrayFrom<O>(expr: SelectQueryBuilderExpression<O>): RawBuilder<Simplify<O>[]>;
-   jsonBuildObject<O extends Record<string, Expression<unknown>>>(
-      obj: O,
-   ): RawBuilder<
-      Simplify<{
-         [K in keyof O]: O[K] extends Expression<infer V> ? V : never;
-      }>
-   >;
+   jsonObjectFrom: typeof jsonObjectFrom;
+   jsonArrayFrom: typeof jsonArrayFrom;
+   jsonBuildObject: typeof jsonBuildObject;
 };
 
 export type ConnQuery = CompiledQuery | Compilable;

app/src/data/connection/connection-test-suite.ts

@@ -14,27 +14,31 @@ export function connectionTestSuite(
    {
       makeConnection,
       rawDialectDetails,
+      disableConsoleLog: _disableConsoleLog = true,
    }: {
       makeConnection: () => MaybePromise<{
          connection: Connection;
          dispose: () => MaybePromise<void>;
       }>;
       rawDialectDetails: string[];
+      disableConsoleLog?: boolean;
    },
 ) {
    const { test, expect, describe, beforeEach, afterEach, afterAll, beforeAll } = testRunner;
-   beforeAll(() => disableConsoleLog());
-   afterAll(() => enableConsoleLog());
+   if (_disableConsoleLog) {
+      beforeAll(() => disableConsoleLog());
+      afterAll(() => enableConsoleLog());
+   }
 
-   describe("base", () => {
-      let ctx: Awaited<ReturnType<typeof makeConnection>>;
-      beforeEach(async () => {
-         ctx = await makeConnection();
-      });
-      afterEach(async () => {
-         await ctx.dispose();
-      });
+   let ctx: Awaited<ReturnType<typeof makeConnection>>;
+   beforeEach(async () => {
+      ctx = await makeConnection();
+   });
+   afterEach(async () => {
+      await ctx.dispose();
+   });
 
+   describe("base", async () => {
       test("pings", async () => {
          const res = await ctx.connection.ping();
          expect(res).toBe(true);
@@ -98,52 +102,54 @@ export function connectionTestSuite(
    });
 
    describe("schema", async () => {
-      const { connection, dispose } = await makeConnection();
-      afterAll(async () => {
-         await dispose();
-      });
+      const makeSchema = async () => {
+         const fields = [
+            {
+               type: "integer",
+               name: "id",
+               primary: true,
+            },
+            {
+               type: "text",
+               name: "text",
+            },
+            {
+               type: "json",
+               name: "json",
+            },
+         ] as const satisfies FieldSpec[];
 
-      const fields = [
-         {
-            type: "integer",
-            name: "id",
-            primary: true,
-         },
-         {
-            type: "text",
-            name: "text",
-         },
-         {
-            type: "json",
-            name: "json",
-         },
-      ] as const satisfies FieldSpec[];
+         let b = ctx.connection.kysely.schema.createTable("test");
+         for (const field of fields) {
+            // @ts-expect-error
+            b = b.addColumn(...ctx.connection.getFieldSchema(field));
+         }
+         await b.execute();
 
-      let b = connection.kysely.schema.createTable("test");
-      for (const field of fields) {
-         // @ts-expect-error
-         b = b.addColumn(...connection.getFieldSchema(field));
-      }
-      await b.execute();
-
-      // add index
-      await connection.kysely.schema.createIndex("test_index").on("test").columns(["id"]).execute();
+         // add index
+         await ctx.connection.kysely.schema
+            .createIndex("test_index")
+            .on("test")
+            .columns(["id"])
+            .execute();
+      };
 
       test("executes query", async () => {
-         await connection.kysely
+         await makeSchema();
+         await ctx.connection.kysely
             .insertInto("test")
             .values({ id: 1, text: "test", json: JSON.stringify({ a: 1 }) })
             .execute();
 
          const expected = { id: 1, text: "test", json: { a: 1 } };
 
-         const qb = connection.kysely.selectFrom("test").selectAll();
-         const res = await connection.executeQuery(qb);
+         const qb = ctx.connection.kysely.selectFrom("test").selectAll();
+         const res = await ctx.connection.executeQuery(qb);
          expect(res.rows).toEqual([expected]);
          expect(rawDialectDetails.every((detail) => getPath(res, detail) !== undefined)).toBe(true);
 
          {
-            const res = await connection.executeQueries(qb, qb);
+            const res = await ctx.connection.executeQueries(qb, qb);
             expect(res.length).toBe(2);
             res.map((r) => {
                expect(r.rows).toEqual([expected]);
@@ -155,15 +161,21 @@ export function connectionTestSuite(
       });
 
       test("introspects", async () => {
-         const tables = await connection.getIntrospector().getTables({
+         await makeSchema();
+         const tables = await ctx.connection.getIntrospector().getTables({
             withInternalKyselyTables: false,
          });
          const clean = tables.map((t) => ({
             ...t,
-            columns: t.columns.map((c) => ({
-               ...c,
-               dataType: undefined,
-            })),
+            columns: t.columns
+               .map((c) => ({
+                  ...c,
+                  // ignore data type
+                  dataType: undefined,
+                  // ignore default value if "id"
+                  hasDefaultValue: c.name !== "id" ? c.hasDefaultValue : undefined,
+               }))
+               .sort((a, b) => a.name.localeCompare(b.name)),
          }));
 
          expect(clean).toEqual([
@@ -176,14 +188,8 @@ export function connectionTestSuite(
                      dataType: undefined,
                      isNullable: false,
                      isAutoIncrementing: true,
-                     hasDefaultValue: false,
-                  },
-                  {
-                     name: "text",
-                     dataType: undefined,
-                     isNullable: true,
-                     isAutoIncrementing: false,
-                     hasDefaultValue: false,
+                     hasDefaultValue: undefined,
+                     comment: undefined,
                   },
                   {
                      name: "json",
@@ -191,25 +197,34 @@ export function connectionTestSuite(
                      isNullable: true,
                      isAutoIncrementing: false,
                      hasDefaultValue: false,
+                     comment: undefined,
+                  },
+                  {
+                     name: "text",
+                     dataType: undefined,
+                     isNullable: true,
+                     isAutoIncrementing: false,
+                     hasDefaultValue: false,
+                     comment: undefined,
+                  },
+               ],
+            },
+         ]);
+
+         expect(await ctx.connection.getIntrospector().getIndices()).toEqual([
+            {
+               name: "test_index",
+               table: "test",
+               isUnique: false,
+               columns: [
+                  {
+                     name: "id",
+                     order: 0,
                   },
                ],
             },
          ]);
       });
-
-      expect(await connection.getIntrospector().getIndices()).toEqual([
-         {
-            name: "test_index",
-            table: "test",
-            isUnique: false,
-            columns: [
-               {
-                  name: "id",
-                  order: 0,
-               },
-            ],
-         },
-      ]);
    });
 
    describe("integration", async () => {

app/src/data/connection/postgres/PgPostgresConnection.ts

@@ -0,0 +1,33 @@
+import { Kysely, PostgresDialect, type PostgresDialectConfig as KyselyPostgresDialectConfig } from "kysely";
+import { PostgresIntrospector } from "./PostgresIntrospector";
+import { PostgresConnection, plugins } from "./PostgresConnection";
+import { customIntrospector } from "../Connection";
+import type { Pool } from "pg";
+
+export type PostgresDialectConfig = Omit<KyselyPostgresDialectConfig, "pool"> & {
+   pool: Pool;
+};
+
+export class PgPostgresConnection extends PostgresConnection<Pool> {
+   override name = "pg";
+
+   constructor(config: PostgresDialectConfig) {
+      const kysely = new Kysely({
+         dialect: customIntrospector(PostgresDialect, PostgresIntrospector, {
+            excludeTables: [],
+         }).create(config),
+         plugins,
+      });
+
+      super(kysely);
+      this.client = config.pool;
+   }
+
+   override async close(): Promise<void> {
+      await this.client.end();
+   }
+}
+
+export function pg(config: PostgresDialectConfig): PgPostgresConnection {
+   return new PgPostgresConnection(config);
+}

app/src/data/connection/postgres/PostgresConnection.ts

@@ -0,0 +1,89 @@
+import {
+   Connection,
+   type DbFunctions,
+   type FieldSpec,
+   type SchemaResponse,
+   type ConnQuery,
+   type ConnQueryResults,
+} from "../Connection";
+import {
+   ParseJSONResultsPlugin,
+   type ColumnDataType,
+   type ColumnDefinitionBuilder,
+   type Kysely,
+   type KyselyPlugin,
+   type SelectQueryBuilder,
+} from "kysely";
+import { jsonArrayFrom, jsonBuildObject, jsonObjectFrom } from "kysely/helpers/postgres";
+
+export type QB = SelectQueryBuilder<any, any, any>;
+
+export const plugins = [new ParseJSONResultsPlugin()];
+
+export abstract class PostgresConnection<Client = unknown> extends Connection<Client> {
+   protected override readonly supported = {
+      batching: true,
+      softscans: true,
+   };
+
+   constructor(kysely: Kysely<any>, fn?: Partial<DbFunctions>, _plugins?: KyselyPlugin[]) {
+      super(
+         kysely,
+         fn ?? {
+            jsonArrayFrom,
+            jsonBuildObject,
+            jsonObjectFrom,
+         },
+         _plugins ?? plugins,
+      );
+   }
+
+   override getFieldSchema(spec: FieldSpec): SchemaResponse {
+      this.validateFieldSpecType(spec.type);
+      let type: ColumnDataType = spec.type;
+
+      if (spec.primary) {
+         if (spec.type === "integer") {
+            type = "serial";
+         }
+      }
+
+      switch (spec.type) {
+         case "blob":
+            type = "bytea";
+            break;
+         case "date":
+         case "datetime":
+            // https://www.postgresql.org/docs/17/datatype-datetime.html
+            type = "timestamp";
+            break;
+         case "text":
+            // https://www.postgresql.org/docs/17/datatype-character.html
+            type = "varchar";
+            break;
+      }
+
+      return [
+         spec.name,
+         type,
+         (col: ColumnDefinitionBuilder) => {
+            if (spec.primary) {
+               return col.primaryKey().notNull();
+            }
+            if (spec.references) {
+               return col
+                  .references(spec.references)
+                  .onDelete(spec.onDelete ?? "set null")
+                  .onUpdate(spec.onUpdate ?? "no action");
+            }
+            return col;
+         },
+      ];
+   }
+
+   override async executeQueries<O extends ConnQuery[]>(...qbs: O): Promise<ConnQueryResults<O>> {
+      return this.kysely.transaction().execute(async (trx) => {
+         return Promise.all(qbs.map((q) => trx.executeQuery(q)));
+      }) as any;
+   }
+}

app/src/data/connection/postgres/PostgresIntrospector.ts

@@ -0,0 +1,128 @@
+import { type SchemaMetadata, sql } from "kysely";
+import { BaseIntrospector } from "../BaseIntrospector";
+
+type PostgresSchemaSpec = {
+   name: string;
+   type: "VIEW" | "BASE TABLE";
+   columns: {
+      name: string;
+      type: string;
+      notnull: number;
+      dflt: string;
+      pk: boolean;
+   }[];
+   indices: {
+      name: string;
+      origin: string;
+      partial: number;
+      sql: string;
+      columns: { name: string; seqno: number }[];
+   }[];
+};
+
+export class PostgresIntrospector extends BaseIntrospector {
+   async getSchemas(): Promise<SchemaMetadata[]> {
+      const rawSchemas = await this.db
+         .selectFrom("pg_catalog.pg_namespace")
+         .select("nspname")
+         .$castTo<{ nspname: string }>()
+         .execute();
+
+      return rawSchemas.map((it) => ({ name: it.nspname }));
+   }
+
+   async getSchemaSpec() {
+      const query = sql`
+         WITH tables_and_views AS (
+            SELECT table_name AS name,
+               table_type AS type
+            FROM information_schema.tables
+            WHERE table_schema = 'public'
+              AND table_type IN ('BASE TABLE', 'VIEW')
+              AND table_name NOT LIKE 'pg_%'
+              AND table_name NOT IN (${this.getExcludedTableNames().join(", ")})
+         ),
+
+            columns_info AS (
+               SELECT table_name AS name,
+                  json_agg(json_build_object(
+                     'name', column_name,
+                     'type', data_type,
+                     'notnull', (CASE WHEN is_nullable = 'NO' THEN true ELSE false END),
+                     'dflt', column_default,
+                     'pk', (SELECT COUNT(*) > 0
+                        FROM information_schema.table_constraints tc
+                        INNER JOIN information_schema.key_column_usage kcu
+                          ON tc.constraint_name = kcu.constraint_name
+                        WHERE tc.table_name = c.table_name
+                          AND tc.constraint_type = 'PRIMARY KEY'
+                          AND kcu.column_name = c.column_name)
+                     )) AS columns
+               FROM information_schema.columns c
+               WHERE table_schema = 'public'
+               GROUP BY table_name
+            ),
+
+            indices_info AS (
+               SELECT
+                  t.relname AS table_name,
+                  json_agg(json_build_object(
+                     'name', i.relname,
+                     'origin', pg_get_indexdef(i.oid),
+                     'partial', (CASE WHEN ix.indisvalid THEN false ELSE true END),
+                     'sql', pg_get_indexdef(i.oid),
+                     'columns', (
+                        SELECT json_agg(json_build_object(
+                           'name', a.attname,
+                           'seqno', x.ordinal_position
+                         ))
+                        FROM unnest(ix.indkey) WITH ORDINALITY AS x(attnum, ordinal_position)
+                            JOIN pg_attribute a ON a.attnum = x.attnum AND a.attrelid = t.oid
+                     ))) AS indices
+               FROM pg_class t
+                  LEFT JOIN pg_index ix ON t.oid = ix.indrelid
+                  LEFT JOIN pg_class i ON i.oid = ix.indexrelid
+               WHERE t.relkind IN ('r', 'v')  -- r = table, v = view
+                 AND t.relname NOT LIKE 'pg_%'
+               GROUP BY t.relname
+            )
+
+         SELECT
+            tv.name,
+            tv.type,
+            ci.columns,
+            ii.indices
+         FROM tables_and_views tv
+            LEFT JOIN columns_info ci ON tv.name = ci.name
+            LEFT JOIN indices_info ii ON tv.name = ii.table_name;
+      `;
+
+      const tables = await this.executeWithPlugins<PostgresSchemaSpec[]>(query);
+
+      return tables.map((table) => ({
+         name: table.name,
+         isView: table.type === "VIEW",
+         columns: table.columns.map((col) => ({
+            name: col.name,
+            dataType: col.type,
+            isNullable: !col.notnull,
+            isAutoIncrementing: col.dflt?.toLowerCase().includes("nextval") ?? false,
+            hasDefaultValue: col.dflt != null,
+            comment: undefined,
+         })),
+         indices: table.indices
+            // filter out db-managed primary key index
+            .filter((index) => index.name !== `${table.name}_pkey`)
+            .map((index) => ({
+               name: index.name,
+               table: table.name,
+               isUnique: index.sql?.match(/unique/i) != null,
+               columns: index.columns.map((col) => ({
+                  name: col.name,
+                  // seqno starts at 1
+                  order: col.seqno - 1,
+               })),
+            })),
+      }));
+   }
+}

app/src/data/connection/postgres/PostgresJsConnection.ts

@@ -0,0 +1,31 @@
+import { Kysely } from "kysely";
+import { PostgresIntrospector } from "./PostgresIntrospector";
+import { PostgresConnection, plugins } from "./PostgresConnection";
+import { customIntrospector } from "../Connection";
+import { PostgresJSDialect, type PostgresJSDialectConfig } from "kysely-postgres-js";
+
+export class PostgresJsConnection extends PostgresConnection<PostgresJSDialectConfig["postgres"]> {
+   override name = "postgres-js";
+
+   constructor(config: PostgresJSDialectConfig) {
+      const kysely = new Kysely({
+         dialect: customIntrospector(PostgresJSDialect, PostgresIntrospector, {
+            excludeTables: [],
+         }).create(config),
+         plugins,
+      });
+
+      super(kysely);
+      this.client = config.postgres;
+   }
+
+   override async close(): Promise<void> {
+      await this.client.end();
+   }
+}
+
+export function postgresJs(
+   config: PostgresJSDialectConfig,
+): PostgresJsConnection {
+   return new PostgresJsConnection(config);
+}

app/src/data/connection/postgres/custom.ts

@@ -0,0 +1,46 @@
+import { customIntrospector, type DbFunctions } from "../Connection";
+import { Kysely, type Dialect, type KyselyPlugin } from "kysely";
+import { plugins, PostgresConnection } from "./PostgresConnection";
+import { PostgresIntrospector } from "./PostgresIntrospector";
+
+export type Constructor<T> = new (...args: any[]) => T;
+
+export type CustomPostgresConnection = {
+   supports?: Partial<PostgresConnection["supported"]>;
+   fn?: Partial<DbFunctions>;
+   plugins?: KyselyPlugin[];
+   excludeTables?: string[];
+};
+
+export function createCustomPostgresConnection<
+   T extends Constructor<Dialect>,
+   C extends ConstructorParameters<T>[0],
+>(
+   name: string,
+   dialect: Constructor<Dialect>,
+   options?: CustomPostgresConnection,
+): (config: C) => PostgresConnection {
+   const supported = {
+      batching: true,
+      ...((options?.supports ?? {}) as any),
+   };
+
+   return (config: C) =>
+      new (class extends PostgresConnection {
+         override name = name;
+         override readonly supported = supported;
+
+         constructor(config: C) {
+            super(
+               new Kysely({
+                  dialect: customIntrospector(dialect, PostgresIntrospector, {
+                     excludeTables: options?.excludeTables ?? [],
+                  }).create(config),
+                  plugins: options?.plugins ?? plugins,
+               }),
+               options?.fn,
+               options?.plugins,
+            );
+         }
+      })(config);
+}

app/src/data/connection/sqlite/SqliteConnection.ts

@@ -13,31 +13,43 @@ import { customIntrospector } from "../Connection";
 import { SqliteIntrospector } from "./SqliteIntrospector";
 import type { Field } from "data/fields/Field";
 
-// @todo: add pragmas
 export type SqliteConnectionConfig<
    CustomDialect extends Constructor<Dialect> = Constructor<Dialect>,
 > = {
    excludeTables?: string[];
-   dialect: CustomDialect;
-   dialectArgs?: ConstructorParameters<CustomDialect>;
    additionalPlugins?: KyselyPlugin[];
    customFn?: Partial<DbFunctions>;
-};
+} & (
+   | {
+        dialect: CustomDialect;
+        dialectArgs?: ConstructorParameters<CustomDialect>;
+     }
+   | {
+        kysely: Kysely<any>;
+     }
+);
 
 export abstract class SqliteConnection<Client = unknown> extends Connection<Client> {
    override name = "sqlite";
 
    constructor(config: SqliteConnectionConfig) {
-      const { excludeTables, dialect, dialectArgs = [], additionalPlugins } = config;
+      const { excludeTables, additionalPlugins } = config;
       const plugins = [new ParseJSONResultsPlugin(), ...(additionalPlugins ?? [])];
 
-      const kysely = new Kysely({
-         dialect: customIntrospector(dialect, SqliteIntrospector, {
-            excludeTables,
+      let kysely: Kysely<any>;
+      if ("dialect" in config) {
+         kysely = new Kysely({
+            dialect: customIntrospector(config.dialect, SqliteIntrospector, {
+               excludeTables,
+               plugins,
+            }).create(...(config.dialectArgs ?? [])),
             plugins,
-         }).create(...dialectArgs),
-         plugins,
-      });
+         });
+      } else if ("kysely" in config) {
+         kysely = config.kysely;
+      } else {
+         throw new Error("Either dialect or kysely must be provided");
+      }
 
       super(
          kysely,

app/src/data/connection/sqlite/SqliteIntrospector.ts

@@ -83,7 +83,7 @@ export class SqliteIntrospector extends BaseIntrospector {
                   dataType: col.type,
                   isNullable: !col.notnull,
                   isAutoIncrementing: col.name === autoIncrementCol,
-                  hasDefaultValue: col.dflt_value != null,
+                  hasDefaultValue: col.name === autoIncrementCol ? true : col.dflt_value != null,
                   comment: undefined,
                };
             }) ?? [],

app/src/data/connection/sqlite/libsql/LibsqlConnection.ts

@@ -18,7 +18,7 @@ export type LibsqlClientFns = {
 function getClient(clientOrCredentials: Client | LibSqlCredentials | LibsqlClientFns): Client {
    if (clientOrCredentials && "url" in clientOrCredentials) {
       const { url, authToken } = clientOrCredentials;
-      return createClient({ url, authToken });
+      return createClient({ url, authToken }) as unknown as Client;
    }
 
    return clientOrCredentials as Client;

app/src/data/connection/sqlite/sqlocal/SQLocalConnection.spec.ts

@@ -0,0 +1,15 @@
+import { describe } from "bun:test";
+import { SQLocalConnection } from "./SQLocalConnection";
+import { connectionTestSuite } from "data/connection/connection-test-suite";
+import { bunTestRunner } from "adapter/bun/test";
+import { SQLocalKysely } from "sqlocal/kysely";
+
+describe("SQLocalConnection", () => {
+   connectionTestSuite(bunTestRunner, {
+      makeConnection: () => ({
+         connection: new SQLocalConnection(new SQLocalKysely({ databasePath: ":memory:" })),
+         dispose: async () => {},
+      }),
+      rawDialectDetails: [],
+   });
+});

app/src/data/connection/sqlite/sqlocal/SQLocalConnection.ts

@@ -0,0 +1,50 @@
+import { Kysely, ParseJSONResultsPlugin } from "kysely";
+import { SqliteConnection } from "../SqliteConnection";
+import { SqliteIntrospector } from "../SqliteIntrospector";
+import type { DB } from "bknd";
+import type { SQLocalKysely } from "sqlocal/kysely";
+
+const plugins = [new ParseJSONResultsPlugin()];
+
+export class SQLocalConnection extends SqliteConnection<SQLocalKysely> {
+   private connected: boolean = false;
+
+   constructor(client: SQLocalKysely) {
+      // @ts-expect-error - config is protected
+      client.config.onConnect = () => {
+         // we need to listen for the connection, it will be awaited in init()
+         this.connected = true;
+      };
+      super({
+         kysely: new Kysely<any>({
+            dialect: {
+               ...client.dialect,
+               createIntrospector: (db: Kysely<DB>) => {
+                  return new SqliteIntrospector(db as any, {
+                     plugins,
+                  });
+               },
+            },
+            plugins,
+         }) as any,
+      });
+      this.client = client;
+   }
+
+   override async init() {
+      if (this.initialized) return;
+      let tries = 0;
+      while (!this.connected && tries < 100) {
+         tries++;
+         await new Promise((resolve) => setTimeout(resolve, 5));
+      }
+      if (!this.connected) {
+         throw new Error("Failed to connect to SQLite database");
+      }
+      this.initialized = true;
+   }
+}
+
+export function sqlocal(instance: InstanceType<typeof SQLocalKysely>): SQLocalConnection {
+   return new SQLocalConnection(instance);
+}

app/src/data/entities/query/Repository.ts

@@ -103,6 +103,7 @@ export class Repository<TBD extends object = DefaultDB, TB extends keyof TBD = a
          validated.with = options.with;
       }
 
+      // add explicit joins. Implicit joins are added in `where` builder
       if (options.join && options.join.length > 0) {
          for (const entry of options.join) {
             const related = this.em.relationOf(entity.name, entry);
@@ -127,12 +128,28 @@ export class Repository<TBD extends object = DefaultDB, TB extends keyof TBD = a
          const invalid = WhereBuilder.getPropertyNames(options.where).filter((field) => {
             if (field.includes(".")) {
                const [alias, prop] = field.split(".") as [string, string];
-               if (!aliases.includes(alias)) {
+               // check aliases first (added joins)
+               if (aliases.includes(alias)) {
+                  this.checkIndex(alias, prop, "where");
+                  return !this.em.entity(alias).getField(prop);
+               }
+               // check if alias (entity) exists
+               if (!this.em.hasEntity(alias)) {
                   return true;
                }
+               // check related fields for auto join
+               const related = this.em.relationOf(entity.name, alias);
+               if (related) {
+                  const other = related.other(entity);
+                  if (other.entity.getField(prop)) {
+                     // if related field is found, add join to validated options
+                     validated.join?.push(alias);
+                     this.checkIndex(alias, prop, "where");
+                     return false;
+                  }
+               }
 
-               this.checkIndex(alias, prop, "where");
-               return !this.em.entity(alias).getField(prop);
+               return true;
             }
 
             this.checkIndex(entity.name, field, "where");

app/src/data/entities/query/WithBuilder.ts

@@ -4,6 +4,7 @@ import type { KyselyJsonFrom } from "data/relations/EntityRelation";
 import type { RepoQuery } from "data/server/query";
 import { InvalidSearchParamsException } from "data/errors";
 import type { Entity, EntityManager, RepositoryQB } from "data/entities";
+import { $console } from "bknd/utils";
 
 export class WithBuilder {
    static addClause(
@@ -13,7 +14,7 @@ export class WithBuilder {
       withs: RepoQuery["with"],
    ) {
       if (!withs || !isObject(withs)) {
-         console.warn(`'withs' undefined or invalid, given: ${JSON.stringify(withs)}`);
+         $console.warn(`'withs' undefined or invalid, given: ${JSON.stringify(withs)}`);
          return qb;
       }
 
@@ -37,9 +38,7 @@ export class WithBuilder {
             let subQuery = relation.buildWith(entity, ref)(eb);
             if (query) {
                subQuery = em.repo(other.entity).addOptionsToQueryBuilder(subQuery, query as any, {
-                  ignore: ["with", "join", cardinality === 1 ? "limit" : undefined].filter(
-                     Boolean,
-                  ) as any,
+                  ignore: ["with", cardinality === 1 ? "limit" : undefined].filter(Boolean) as any,
                });
             }
 
@@ -57,7 +56,7 @@ export class WithBuilder {
    static validateWiths(em: EntityManager<any>, entity: string, withs: RepoQuery["with"]) {
       let depth = 0;
       if (!withs || !isObject(withs)) {
-         withs && console.warn(`'withs' invalid, given: ${JSON.stringify(withs)}`);
+         withs && $console.warn(`'withs' invalid, given: ${JSON.stringify(withs)}`);
          return depth;
       }
 

app/src/data/fields/JsonSchemaField.ts

@@ -26,7 +26,12 @@ export class JsonSchemaField<
 
    constructor(name: string, config: Partial<JsonSchemaFieldConfig>) {
       super(name, config);
-      this.validator = new Validator({ ...this.getJsonSchema() });
+
+      // make sure to hand over clean json
+      const schema = this.getJsonSchema();
+      this.validator = new Validator(
+         typeof schema === "object" ? JSON.parse(JSON.stringify(schema)) : {},
+      );
    }
 
    protected getSchema() {

app/src/data/fields/NumberField.ts

@@ -52,7 +52,7 @@ export class NumberField<Required extends true | false = false> extends Field<
 
       switch (context) {
          case "submit":
-            return Number.parseInt(value);
+            return Number.parseInt(value, 10);
       }
 
       return value;

app/src/data/helper.ts

@@ -28,7 +28,7 @@ export function getChangeSet(
          const value = _value === "" ? null : _value;
 
          // normalize to null if undefined
-         const newValue = field.getValue(value, "submit") || null;
+         const newValue = field.getValue(value, "submit") ?? null;
          // @todo: add typing for "action"
          if (action === "create" || newValue !== data[key]) {
             acc[key] = newValue;

app/src/data/prototype/index.ts

@@ -289,7 +289,7 @@ class EntityManagerPrototype<Entities extends Record<string, Entity>> extends En
       super(Object.values(__entities), new DummyConnection(), relations, indices);
    }
 
-   withConnection(connection: Connection): EntityManager<Schema<Entities>> {
+   withConnection(connection: Connection): EntityManager<Schemas<Entities>> {
       return new EntityManager(this.entities, connection, this.relations.all, this.indices);
    }
 }

app/src/data/server/query.spec.ts

@@ -1,8 +1,9 @@
-import { test, describe, expect } from "bun:test";
+import { test, describe, expect, beforeAll, afterAll } from "bun:test";
 import * as q from "./query";
 import { parse as $parse, type ParseOptions } from "bknd/utils";
 import type { PrimaryFieldType } from "modules";
 import type { Generated } from "kysely";
+import { disableConsoleLog, enableConsoleLog } from "core/utils/test";
 
 const parse = (v: unknown, o: ParseOptions = {}) =>
    $parse(q.repoQuery, v, {
@@ -15,6 +16,9 @@ const decode = (input: any, output: any) => {
    expect(parse(input)).toEqual(output);
 };
 
+beforeAll(() => disableConsoleLog());
+afterAll(() => enableConsoleLog());
+
 describe("server/query", () => {
    test("limit & offset", () => {
       //expect(() => parse({ limit: false })).toThrow();

app/src/index.ts

@@ -132,6 +132,8 @@ export type * from "data/entities/Entity";
 export type { EntityManager } from "data/entities/EntityManager";
 export type { SchemaManager } from "data/schema/SchemaManager";
 export type * from "data/entities";
+
+// data connection
 export {
    BaseIntrospector,
    Connection,
@@ -144,9 +146,32 @@ export {
    type ConnQuery,
    type ConnQueryResults,
 } from "data/connection";
+
+// data sqlite
 export { SqliteConnection } from "data/connection/sqlite/SqliteConnection";
 export { SqliteIntrospector } from "data/connection/sqlite/SqliteIntrospector";
 export { SqliteLocalConnection } from "data/connection/sqlite/SqliteLocalConnection";
+
+// data sqlocal
+export { SQLocalConnection, sqlocal } from "data/connection/sqlite/sqlocal/SQLocalConnection";
+
+// data postgres
+export {
+   pg,
+   PgPostgresConnection,
+} from "data/connection/postgres/PgPostgresConnection";
+export { PostgresIntrospector } from "data/connection/postgres/PostgresIntrospector";
+export { PostgresConnection } from "data/connection/postgres/PostgresConnection";
+export {
+   postgresJs,
+   PostgresJsConnection,
+} from "data/connection/postgres/PostgresJsConnection";
+export {
+   createCustomPostgresConnection,
+   type CustomPostgresConnection,
+} from "data/connection/postgres/custom";
+
+// data prototype
 export {
    text,
    number,

app/src/media/api/MediaApi.ts

@@ -71,11 +71,12 @@ export class MediaApi extends ModuleApi<MediaApiOptions> {
    }
 
    protected uploadFile<T extends FileUploadedEventData>(
-      body: File | Blob | ReadableStream | Buffer<ArrayBufferLike>,
+      body: BodyInit,
       opts?: {
          filename?: string;
          path?: TInput;
          _init?: Omit<RequestInit, "body">;
+         query?: Record<string, any>;
       },
    ): FetchPromise<ResponseObject<T>> {
       const headers = {
@@ -102,14 +103,22 @@ export class MediaApi extends ModuleApi<MediaApiOptions> {
          headers,
       };
       if (opts?.path) {
-         return this.post(opts.path, body, init);
+         return this.request<T>(opts.path, opts?.query, {
+            ...init,
+            body,
+            method: "POST",
+         });
       }
 
       if (!name || name.length === 0) {
          throw new Error("Invalid filename");
       }
 
-      return this.post<T>(opts?.path ?? ["upload", name], body, init);
+      return this.request<T>(opts?.path ?? ["upload", name], opts?.query, {
+         ...init,
+         body,
+         method: "POST",
+      });
    }
 
    async upload<T extends FileUploadedEventData>(
@@ -119,6 +128,7 @@ export class MediaApi extends ModuleApi<MediaApiOptions> {
          _init?: Omit<RequestInit, "body">;
          path?: TInput;
          fetcher?: ApiFetcher;
+         query?: Record<string, any>;
       } = {},
    ) {
       if (item instanceof Request || typeof item === "string") {
@@ -144,7 +154,7 @@ export class MediaApi extends ModuleApi<MediaApiOptions> {
          });
       }
 
-      return this.uploadFile<T>(item, opts);
+      return this.uploadFile<T>(item as BodyInit, opts);
    }
 
    async uploadToEntity(
@@ -155,11 +165,14 @@ export class MediaApi extends ModuleApi<MediaApiOptions> {
       opts?: {
          _init?: Omit<RequestInit, "body">;
          fetcher?: typeof fetch;
+         overwrite?: boolean;
       },
    ): Promise<ResponseObject<FileUploadedEventData & { result: DB["media"] }>> {
+      const query = opts?.overwrite !== undefined ? { overwrite: opts.overwrite } : undefined;
       return this.upload(item, {
          ...opts,
          path: ["entity", entity, id, field],
+         query,
       });
    }
 

app/src/media/storage/adapters/adapter-test-suite.ts

@@ -5,7 +5,7 @@ import type { BunFile } from "bun";
 
 export async function adapterTestSuite(
    testRunner: TestRunner,
-   adapter: StorageAdapter,
+   _adapter: StorageAdapter | (() => StorageAdapter),
    file: File | BunFile,
    opts?: {
       retries?: number;
@@ -25,7 +25,12 @@ export async function adapterTestSuite(
    const _filename = randomString(10);
    const filename = `${_filename}.png`;
 
+   const getAdapter = (
+      typeof _adapter === "function" ? _adapter : () => _adapter
+   ) as () => StorageAdapter;
+
    await test("puts an object", async () => {
+      const adapter = getAdapter();
       objects = (await adapter.listObjects()).length;
       const result = await adapter.putObject(filename, file as unknown as File);
       expect(result).toBeDefined();
@@ -38,6 +43,7 @@ export async function adapterTestSuite(
    });
 
    await test("lists objects", async () => {
+      const adapter = getAdapter();
       const length = await retry(
          () => adapter.listObjects().then((res) => res.length),
          (length) => length > objects,
@@ -49,10 +55,12 @@ export async function adapterTestSuite(
    });
 
    await test("file exists", async () => {
+      const adapter = getAdapter();
       expect(await adapter.objectExists(filename)).toBe(true);
    });
 
    await test("gets an object", async () => {
+      const adapter = getAdapter();
       const res = await adapter.getObject(filename, new Headers());
       expect(res.ok).toBe(true);
       expect(res.headers.get("Accept-Ranges")).toBe("bytes");
@@ -62,6 +70,7 @@ export async function adapterTestSuite(
    if (options.testRange) {
       await test("handles range request - partial content", async () => {
          const headers = new Headers({ Range: "bytes=0-99" });
+         const adapter = getAdapter();
          const res = await adapter.getObject(filename, headers);
          expect(res.status).toBe(206); // Partial Content
          expect(/^bytes 0-99\/\d+$/.test(res.headers.get("Content-Range")!)).toBe(true);
@@ -70,6 +79,7 @@ export async function adapterTestSuite(
 
       await test("handles range request - suffix range", async () => {
          const headers = new Headers({ Range: "bytes=-100" });
+         const adapter = getAdapter();
          const res = await adapter.getObject(filename, headers);
          expect(res.status).toBe(206); // Partial Content
          expect(/^bytes \d+-\d+\/\d+$/.test(res.headers.get("Content-Range")!)).toBe(true);
@@ -77,6 +87,7 @@ export async function adapterTestSuite(
 
       await test("handles invalid range request", async () => {
          const headers = new Headers({ Range: "bytes=invalid" });
+         const adapter = getAdapter();
          const res = await adapter.getObject(filename, headers);
          expect(res.status).toBe(416); // Range Not Satisfiable
          expect(/^bytes \*\/\d+$/.test(res.headers.get("Content-Range")!)).toBe(true);
@@ -84,6 +95,7 @@ export async function adapterTestSuite(
    }
 
    await test("gets object meta", async () => {
+      const adapter = getAdapter();
       expect(await adapter.getObjectMeta(filename)).toEqual({
          type: file.type, // image/png
          size: file.size,
@@ -91,6 +103,7 @@ export async function adapterTestSuite(
    });
 
    await test("deletes an object", async () => {
+      const adapter = getAdapter();
       expect(await adapter.deleteObject(filename)).toBeUndefined();
 
       if (opts?.skipExistsAfterDelete !== true) {

app/src/modes/code.ts

@@ -10,16 +10,19 @@ export type CodeMode<AdapterConfig extends BkndConfig> = AdapterConfig extends B
    ? BkndModeConfig<Args, AdapterConfig>
    : never;
 
-export function code<Args>(config: BkndCodeModeConfig<Args>): BkndConfig<Args> {
+export function code<
+   Config extends BkndConfig,
+   Args = Config extends BkndConfig<infer A> ? A : unknown,
+>(codeConfig: CodeMode<Config>): BkndConfig<Args> {
    return {
-      ...config,
+      ...codeConfig,
       app: async (args) => {
          const {
             config: appConfig,
             plugins,
             isProd,
             syncSchemaOptions,
-         } = await makeModeConfig(config, args);
+         } = await makeModeConfig(codeConfig, args);
 
          if (appConfig?.options?.mode && appConfig?.options?.mode !== "code") {
             $console.warn("You should not set a different mode than `db` when using code mode");

app/src/modes/hybrid.ts

@@ -1,6 +1,6 @@
 import type { BkndConfig } from "bknd/adapter";
 import { makeModeConfig, type BkndModeConfig } from "./shared";
-import { getDefaultConfig, type MaybePromise, type ModuleConfigs, type Merge } from "bknd";
+import { getDefaultConfig, type MaybePromise, type Merge } from "bknd";
 import type { DbModuleManager } from "modules/db/DbModuleManager";
 import { invariant, $console } from "bknd/utils";
 
@@ -9,7 +9,7 @@ export type BkndHybridModeOptions = {
     * Reader function to read the configuration from the file system.
     * This is required for hybrid mode to work.
     */
-   reader?: (path: string) => MaybePromise<string>;
+   reader?: (path: string) => MaybePromise<string | object>;
    /**
     * Provided secrets to be merged into the configuration
     */
@@ -23,42 +23,36 @@ export type HybridMode<AdapterConfig extends BkndConfig> = AdapterConfig extends
    ? BkndModeConfig<Args, Merge<BkndHybridModeOptions & AdapterConfig>>
    : never;
 
-export function hybrid<Args>({
-   configFilePath = "bknd-config.json",
-   ...rest
-}: HybridBkndConfig<Args>): BkndConfig<Args> {
+export function hybrid<
+   Config extends BkndConfig,
+   Args = Config extends BkndConfig<infer A> ? A : unknown,
+>(hybridConfig: HybridMode<Config>): BkndConfig<Args> {
    return {
-      ...rest,
-      config: undefined,
+      ...hybridConfig,
       app: async (args) => {
          const {
             config: appConfig,
             isProd,
             plugins,
             syncSchemaOptions,
-         } = await makeModeConfig(
-            {
-               ...rest,
-               configFilePath,
-            },
-            args,
-         );
+         } = await makeModeConfig(hybridConfig, args);
+
+         const configFilePath = appConfig.configFilePath ?? "bknd-config.json";
 
          if (appConfig?.options?.mode && appConfig?.options?.mode !== "db") {
             $console.warn("You should not set a different mode than `db` when using hybrid mode");
          }
          invariant(
             typeof appConfig.reader === "function",
-            "You must set the `reader` option when using hybrid mode",
+            "You must set a `reader` option when using hybrid mode",
          );
 
-         let fileConfig: ModuleConfigs;
-         try {
-            fileConfig = JSON.parse(await appConfig.reader!(configFilePath)) as ModuleConfigs;
-         } catch (e) {
-            const defaultConfig = (appConfig.config ?? getDefaultConfig()) as ModuleConfigs;
-            await appConfig.writer!(configFilePath, JSON.stringify(defaultConfig, null, 2));
-            fileConfig = defaultConfig;
+         const fileContent = await appConfig.reader?.(configFilePath);
+         let fileConfig = typeof fileContent === "string" ? JSON.parse(fileContent) : fileContent;
+         if (!fileConfig) {
+            $console.warn("No config found, using default config");
+            fileConfig = getDefaultConfig();
+            await appConfig.writer?.(configFilePath, JSON.stringify(fileConfig, null, 2));
          }
 
          return {
@@ -80,6 +74,13 @@ export function hybrid<Args>({
                   skipValidation: isProd,
                   // secrets are required for hybrid mode
                   secrets: appConfig.secrets,
+                  onModulesBuilt: async (ctx) => {
+                     if (ctx.flags.sync_required && !isProd && syncSchemaOptions.force) {
+                        $console.log("[hybrid] syncing schema");
+                        await ctx.em.schema().sync(syncSchemaOptions);
+                     }
+                     await appConfig?.options?.manager?.onModulesBuilt?.(ctx);
+                  },
                   ...appConfig?.options?.manager,
                },
             },

app/src/modes/shared.ts

@@ -1,7 +1,7 @@
 import type { AppPlugin, BkndConfig, MaybePromise, Merge } from "bknd";
 import { syncTypes, syncConfig } from "bknd/plugins";
 import { syncSecrets } from "plugins/dev/sync-secrets.plugin";
-import { invariant, $console } from "bknd/utils";
+import { $console } from "bknd/utils";
 
 export type BkndModeOptions = {
    /**
@@ -56,6 +56,14 @@ export type BkndModeConfig<Args = any, Additional = {}> = BkndConfig<
    Merge<BkndModeOptions & Additional>
 >;
 
+function _isProd() {
+   try {
+      return process.env.NODE_ENV === "production";
+   } catch (_e) {
+      return false;
+   }
+}
+
 export async function makeModeConfig<
    Args = any,
    Config extends BkndModeConfig<Args> = BkndModeConfig<Args>,
@@ -69,25 +77,24 @@ export async function makeModeConfig<
 
    if (typeof config.isProduction !== "boolean") {
       $console.warn(
-         "You should set `isProduction` option when using managed modes to prevent accidental issues",
+         "You should set `isProduction` option when using managed modes to prevent accidental issues with writing plugins and syncing schema. As fallback, it is set to",
+         _isProd(),
       );
    }
 
-   invariant(
-      typeof config.writer === "function",
-      "You must set the `writer` option when using managed modes",
-   );
+   let needsWriter = false;
 
    const { typesFilePath, configFilePath, writer, syncSecrets: syncSecretsOptions } = config;
 
-   const isProd = config.isProduction;
-   const plugins = appConfig?.options?.plugins ?? ([] as AppPlugin[]);
+   const isProd = config.isProduction ?? _isProd();
+   const plugins = config?.options?.plugins ?? ([] as AppPlugin[]);
+   const syncFallback = typeof config.syncSchema === "boolean" ? config.syncSchema : !isProd;
    const syncSchemaOptions =
       typeof config.syncSchema === "object"
          ? config.syncSchema
          : {
-              force: config.syncSchema !== false,
-              drop: true,
+              force: syncFallback,
+              drop: syncFallback,
            };
 
    if (!isProd) {
@@ -95,6 +102,7 @@ export async function makeModeConfig<
          if (plugins.some((p) => p.name === "bknd-sync-types")) {
             throw new Error("You have to unregister the `syncTypes` plugin");
          }
+         needsWriter = true;
          plugins.push(
             syncTypes({
                enabled: true,
@@ -114,6 +122,7 @@ export async function makeModeConfig<
          if (plugins.some((p) => p.name === "bknd-sync-config")) {
             throw new Error("You have to unregister the `syncConfig` plugin");
          }
+         needsWriter = true;
          plugins.push(
             syncConfig({
                enabled: true,
@@ -142,6 +151,7 @@ export async function makeModeConfig<
                .join(".");
          }
 
+         needsWriter = true;
          plugins.push(
             syncSecrets({
                enabled: true,
@@ -174,6 +184,10 @@ export async function makeModeConfig<
       }
    }
 
+   if (needsWriter && typeof config.writer !== "function") {
+      $console.warn("You must set a `writer` function, attempts to write will fail");
+   }
+
    return {
       config,
       isProd,

app/src/modules/ModuleManager.ts

@@ -87,7 +87,7 @@ export type ModuleManagerOptions = {
    verbosity?: Verbosity;
 };
 
-const debug_modules = env("modules_debug");
+const debug_modules = env("modules_debug", false);
 
 abstract class ModuleManagerEvent<A = {}> extends Event<{ ctx: ModuleBuildContext } & A> {}
 export class ModuleManagerConfigUpdateEvent<
@@ -223,7 +223,7 @@ export class ModuleManager {
    }
 
    extractSecrets() {
-      const moduleConfigs = structuredClone(this.configs());
+      const moduleConfigs = JSON.parse(JSON.stringify(this.configs()));
       const secrets = { ...this.options?.secrets };
       const extractedKeys: string[] = [];
 

app/src/modules/db/DbModuleManager.ts

@@ -1,4 +1,4 @@
-import { mark, stripMark, $console, s, SecretSchema, setPath } from "bknd/utils";
+import { mark, stripMark, $console, s, setPath } from "bknd/utils";
 import { BkndError } from "core/errors";
 import * as $diff from "core/object/diff";
 import type { Connection } from "data/connection";
@@ -290,13 +290,12 @@ export class DbModuleManager extends ModuleManager {
                   updated_at: new Date(),
                });
             }
-         } else if (e instanceof TransformPersistFailedException) {
-            $console.error("ModuleManager: Cannot save invalid config");
-            this.revertModules();
-            throw e;
          } else {
+            if (e instanceof TransformPersistFailedException) {
+               $console.error("ModuleManager: Cannot save invalid config");
+            }
             $console.error("ModuleManager: Aborting");
-            this.revertModules();
+            await this.revertModules();
             throw e;
          }
       }

app/src/modules/permissions/index.ts

@@ -33,3 +33,5 @@ export const schemaRead = new Permission(
 );
 export const build = new Permission("system.build");
 export const mcp = new Permission("system.mcp");
+export const info = new Permission("system.info");
+export const openapi = new Permission("system.openapi");

app/src/modules/server/AppServer.ts

@@ -105,7 +105,10 @@ export class AppServer extends Module<AppServerConfig> {
 
          if (err instanceof Error) {
             if (isDebug()) {
-               return c.json({ error: err.message, stack: err.stack }, 500);
+               return c.json(
+                  { error: err.message, stack: err.stack?.split("\n").map((line) => line.trim()) },
+                  500,
+               );
             }
          }
 

app/src/modules/server/SystemController.ts

@@ -1,5 +1,3 @@
-/// <reference types="@cloudflare/workers-types" />
-
 import type { App } from "App";
 import {
    datetimeStringLocal,
@@ -125,7 +123,7 @@ export class SystemController extends Controller {
    private registerConfigController(client: Hono<any>): void {
       const { permission } = this.middlewares;
       // don't add auth again, it's already added in getController
-      const hono = this.create(); /* .use(permission(SystemPermissions.configRead)); */
+      const hono = this.create();
 
       if (!this.app.isReadOnly()) {
          const manager = this.app.modules as DbModuleManager;
@@ -317,6 +315,11 @@ export class SystemController extends Controller {
             summary: "Get the config for a module",
             tags: ["system"],
          }),
+         permission(SystemPermissions.configRead, {
+            context: (c) => ({
+               module: c.req.param("module"),
+            }),
+         }),
          mcpTool("system_config", {
             annotations: {
                readOnlyHint: true,
@@ -354,7 +357,7 @@ export class SystemController extends Controller {
 
    override getController() {
       const { permission, auth } = this.middlewares;
-      const hono = this.create().use(auth());
+      const hono = this.create().use(auth()).use(permission(SystemPermissions.accessApi, {}));
 
       this.registerConfigController(hono);
 
@@ -429,6 +432,9 @@ export class SystemController extends Controller {
 
       hono.get(
          "/permissions",
+         permission(SystemPermissions.schemaRead, {
+            context: (_c) => ({ module: "auth" }),
+         }),
          describeRoute({
             summary: "Get the permissions",
             tags: ["system"],
@@ -441,6 +447,7 @@ export class SystemController extends Controller {
 
       hono.post(
          "/build",
+         permission(SystemPermissions.build, {}),
          describeRoute({
             summary: "Build the app",
             tags: ["system"],
@@ -471,6 +478,7 @@ export class SystemController extends Controller {
 
       hono.get(
          "/info",
+         permission(SystemPermissions.info, {}),
          mcpTool("system_info"),
          describeRoute({
             summary: "Get the server info",
@@ -504,6 +512,7 @@ export class SystemController extends Controller {
 
       hono.get(
          "/openapi.json",
+         permission(SystemPermissions.openapi, {}),
          openAPISpecs(this.ctx.server, {
             info: {
                title: "bknd API",
@@ -511,7 +520,11 @@ export class SystemController extends Controller {
             },
          }),
       );
-      hono.get("/swagger", swaggerUI({ url: "/api/system/openapi.json" }));
+      hono.get(
+         "/swagger",
+         permission(SystemPermissions.openapi, {}),
+         swaggerUI({ url: "/api/system/openapi.json" }),
+      );
 
       return hono;
    }

app/src/plugins/auth/email-otp.plugin.spec.ts

@@ -0,0 +1,683 @@
+import { afterAll, beforeAll, describe, expect, mock, test, setSystemTime } from "bun:test";
+import { emailOTP } from "./email-otp.plugin";
+import { createApp } from "core/test/utils";
+import { disableConsoleLog, enableConsoleLog } from "core/utils/test";
+
+beforeAll(disableConsoleLog);
+afterAll(enableConsoleLog);
+
+describe("otp plugin", () => {
+   test("should not work if auth is not enabled", async () => {
+      const app = createApp({
+         options: {
+            plugins: [emailOTP({ showActualErrors: true })],
+         },
+      });
+      await app.build();
+      const res = await app.server.request("/api/auth/otp/login", {
+         method: "POST",
+         headers: {
+            "Content-Type": "application/json",
+         },
+         body: JSON.stringify({ email: "test@test.com" }),
+      });
+      expect(res.status).toBe(404);
+   });
+
+   test("should require email driver if sendEmail is true", async () => {
+      const app = createApp({
+         config: {
+            auth: {
+               enabled: true,
+            },
+         },
+         options: {
+            plugins: [emailOTP()],
+         },
+      });
+      await app.build();
+      const res = await app.server.request("/api/auth/otp/login", {
+         method: "POST",
+         headers: {
+            "Content-Type": "application/json",
+         },
+         body: JSON.stringify({ email: "test@test.com" }),
+      });
+      expect(res.status).toBe(404);
+
+      {
+         const app = createApp({
+            config: {
+               auth: {
+                  enabled: true,
+               },
+            },
+            options: {
+               plugins: [emailOTP({ sendEmail: false })],
+            },
+         });
+         await app.build();
+         const res = await app.server.request("/api/auth/otp/register", {
+            method: "POST",
+            headers: {
+               "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ email: "test@test.com" }),
+         });
+         expect(res.status).toBe(201);
+      }
+   });
+
+   test("should prevent mutations of the OTP entity", async () => {
+      const app = createApp({
+         config: {
+            auth: {
+               enabled: true,
+            },
+         },
+         options: {
+            drivers: {
+               email: {
+                  send: async () => {},
+               },
+            },
+            plugins: [emailOTP({ showActualErrors: true })],
+         },
+      });
+      await app.build();
+
+      const payload = {
+         email: "test@test.com",
+         code: "123456",
+         action: "login",
+         created_at: new Date(),
+         expires_at: new Date(Date.now() + 1000 * 60 * 60 * 24),
+         used_at: null,
+      };
+
+      expect(app.em.mutator("users_otp").insertOne(payload)).rejects.toThrow();
+      expect(
+         await app
+            .getApi()
+            .data.createOne("users_otp", payload)
+            .then((r) => r.ok),
+      ).toBe(false);
+   });
+
+   test("should generate a token", async () => {
+      const called = mock(() => null);
+      const app = createApp({
+         config: {
+            auth: {
+               enabled: true,
+            },
+         },
+         options: {
+            plugins: [emailOTP({ showActualErrors: true })],
+            drivers: {
+               email: {
+                  send: async (to) => {
+                     expect(to).toBe("test@test.com");
+                     called();
+                  },
+               },
+            },
+            seed: async (ctx) => {
+               await ctx.app.createUser({ email: "test@test.com", password: "12345678" });
+            },
+         },
+      });
+      await app.build();
+
+      const res = await app.server.request("/api/auth/otp/login", {
+         method: "POST",
+         headers: {
+            "Content-Type": "application/json",
+         },
+         body: JSON.stringify({ email: "test@test.com" }),
+      });
+      expect(res.status).toBe(201);
+      const data = (await res.json()) as any;
+      expect(data.sent).toBe(true);
+      expect(data.data.email).toBe("test@test.com");
+      expect(data.data.action).toBe("login");
+      expect(data.data.expires_at).toBeDefined();
+
+      {
+         const { data } = await app.em.fork().repo("users_otp").findOne({ email: "test@test.com" });
+         expect(data?.code).toBeDefined();
+         expect(data?.code?.length).toBe(6);
+         expect(data?.code?.split("").every((char: string) => Number.isInteger(Number(char)))).toBe(
+            true,
+         );
+         expect(data?.email).toBe("test@test.com");
+      }
+      expect(called).toHaveBeenCalled();
+   });
+
+   test("should login with a code", async () => {
+      let code = "";
+
+      const app = createApp({
+         config: {
+            auth: {
+               enabled: true,
+               jwt: {
+                  secret: "test",
+               },
+            },
+         },
+         options: {
+            plugins: [
+               emailOTP({
+                  showActualErrors: true,
+                  generateEmail: (otp) => ({ subject: "test", body: otp.code }),
+               }),
+            ],
+            drivers: {
+               email: {
+                  send: async (to, _subject, body) => {
+                     expect(to).toBe("test@test.com");
+                     code = String(body);
+                  },
+               },
+            },
+            seed: async (ctx) => {
+               await ctx.app.createUser({ email: "test@test.com", password: "12345678" });
+            },
+         },
+      });
+      await app.build();
+
+      await app.server.request("/api/auth/otp/login", {
+         method: "POST",
+         headers: {
+            "Content-Type": "application/json",
+         },
+         body: JSON.stringify({ email: "test@test.com" }),
+      });
+
+      {
+         const res = await app.server.request("/api/auth/otp/login", {
+            method: "POST",
+            headers: {
+               "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ email: "test@test.com", code }),
+         });
+         expect(res.status).toBe(200);
+         expect(res.headers.get("set-cookie")).toBeDefined();
+         const userData = (await res.json()) as any;
+         expect(userData.user.email).toBe("test@test.com");
+         expect(userData.token).toBeDefined();
+      }
+   });
+
+   test("should register with a code", async () => {
+      let code = "";
+
+      const app = createApp({
+         config: {
+            auth: {
+               enabled: true,
+               jwt: {
+                  secret: "test",
+               },
+            },
+         },
+         options: {
+            plugins: [
+               emailOTP({
+                  showActualErrors: true,
+                  generateEmail: (otp) => ({ subject: "test", body: otp.code }),
+               }),
+            ],
+            drivers: {
+               email: {
+                  send: async (to, _subject, body) => {
+                     expect(to).toBe("test@test.com");
+                     code = String(body);
+                  },
+               },
+            },
+         },
+      });
+      await app.build();
+
+      const res = await app.server.request("/api/auth/otp/register", {
+         method: "POST",
+         headers: {
+            "Content-Type": "application/json",
+         },
+         body: JSON.stringify({ email: "test@test.com" }),
+      });
+      const data = (await res.json()) as any;
+      expect(data.sent).toBe(true);
+      expect(data.data.email).toBe("test@test.com");
+      expect(data.data.action).toBe("register");
+      expect(data.data.expires_at).toBeDefined();
+
+      {
+         const res = await app.server.request("/api/auth/otp/register", {
+            method: "POST",
+            headers: {
+               "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ email: "test@test.com", code }),
+         });
+         expect(res.status).toBe(200);
+         expect(res.headers.get("set-cookie")).toBeDefined();
+         const userData = (await res.json()) as any;
+         expect(userData.user.email).toBe("test@test.com");
+         expect(userData.token).toBeDefined();
+      }
+   });
+
+   test("should not send email if sendEmail is false", async () => {
+      const called = mock(() => null);
+      const app = createApp({
+         config: {
+            auth: {
+               enabled: true,
+            },
+         },
+         options: {
+            plugins: [emailOTP({ sendEmail: false })],
+            drivers: {
+               email: {
+                  send: async () => {
+                     called();
+                  },
+               },
+            },
+         },
+      });
+      await app.build();
+
+      const res = await app.server.request("/api/auth/otp/register", {
+         method: "POST",
+         headers: {
+            "Content-Type": "application/json",
+         },
+         body: JSON.stringify({ email: "test@test.com" }),
+      });
+      expect(res.status).toBe(201);
+      expect(called).not.toHaveBeenCalled();
+   });
+
+   test("should reject invalid codes", async () => {
+      const app = createApp({
+         config: {
+            auth: {
+               enabled: true,
+               jwt: {
+                  secret: "test",
+               },
+            },
+         },
+         options: {
+            plugins: [
+               emailOTP({
+                  showActualErrors: true,
+                  generateEmail: (otp) => ({ subject: "test", body: otp.code }),
+               }),
+            ],
+            drivers: {
+               email: {
+                  send: async () => {},
+               },
+            },
+            seed: async (ctx) => {
+               await ctx.app.createUser({ email: "test@test.com", password: "12345678" });
+            },
+         },
+      });
+      await app.build();
+
+      // First send a code
+      await app.server.request("/api/auth/otp/login", {
+         method: "POST",
+         headers: {
+            "Content-Type": "application/json",
+         },
+         body: JSON.stringify({ email: "test@test.com" }),
+      });
+
+      // Try to use an invalid code
+      const res = await app.server.request("/api/auth/otp/login", {
+         method: "POST",
+         headers: {
+            "Content-Type": "application/json",
+         },
+         body: JSON.stringify({ email: "test@test.com", code: "999999" }),
+      });
+      expect(res.status).toBe(400);
+      const error = await res.json();
+      expect(error).toBeDefined();
+   });
+
+   test("should reject code reuse", async () => {
+      let code = "";
+
+      const app = createApp({
+         config: {
+            auth: {
+               enabled: true,
+               jwt: {
+                  secret: "test",
+               },
+            },
+         },
+         options: {
+            plugins: [
+               emailOTP({
+                  showActualErrors: true,
+                  generateEmail: (otp) => ({ subject: "test", body: otp.code }),
+               }),
+            ],
+            drivers: {
+               email: {
+                  send: async (_to, _subject, body) => {
+                     code = String(body);
+                  },
+               },
+            },
+            seed: async (ctx) => {
+               await ctx.app.createUser({ email: "test@test.com", password: "12345678" });
+            },
+         },
+      });
+      await app.build();
+
+      // Send a code
+      await app.server.request("/api/auth/otp/login", {
+         method: "POST",
+         headers: {
+            "Content-Type": "application/json",
+         },
+         body: JSON.stringify({ email: "test@test.com" }),
+      });
+
+      // Use the code successfully
+      {
+         const res = await app.server.request("/api/auth/otp/login", {
+            method: "POST",
+            headers: {
+               "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ email: "test@test.com", code }),
+         });
+         expect(res.status).toBe(200);
+      }
+
+      // Try to use the same code again
+      {
+         const res = await app.server.request("/api/auth/otp/login", {
+            method: "POST",
+            headers: {
+               "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ email: "test@test.com", code }),
+         });
+         expect(res.status).toBe(400);
+         const error = await res.json();
+         expect(error).toBeDefined();
+      }
+   });
+
+   test("should reject expired codes", async () => {
+      // Set a fixed system time
+      const baseTime = Date.now();
+      setSystemTime(new Date(baseTime));
+
+      try {
+         const app = createApp({
+            config: {
+               auth: {
+                  enabled: true,
+                  jwt: {
+                     secret: "test",
+                  },
+               },
+            },
+            options: {
+               plugins: [
+                  emailOTP({
+                     showActualErrors: true,
+                     ttl: 1, // 1 second TTL
+                     generateEmail: (otp) => ({ subject: "test", body: otp.code }),
+                  }),
+               ],
+               drivers: {
+                  email: {
+                     send: async () => {},
+                  },
+               },
+               seed: async (ctx) => {
+                  await ctx.app.createUser({ email: "test@test.com", password: "12345678" });
+               },
+            },
+         });
+         await app.build();
+
+         // Send a code
+         const sendRes = await app.server.request("/api/auth/otp/login", {
+            method: "POST",
+            headers: {
+               "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ email: "test@test.com" }),
+         });
+         expect(sendRes.status).toBe(201);
+
+         // Get the code from the database
+         const { data: otpData } = await app.em
+            .fork()
+            .repo("users_otp")
+            .findOne({ email: "test@test.com" });
+         expect(otpData?.code).toBeDefined();
+
+         // Advance system time by more than 1 second to expire the code
+         setSystemTime(new Date(baseTime + 1100));
+
+         // Try to use the expired code
+         const res = await app.server.request("/api/auth/otp/login", {
+            method: "POST",
+            headers: {
+               "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ email: "test@test.com", code: otpData?.code }),
+         });
+         expect(res.status).toBe(400);
+         const error = await res.json();
+         expect(error).toBeDefined();
+      } finally {
+         // Reset system time
+         setSystemTime();
+      }
+   });
+
+   test("should reject codes with different actions", async () => {
+      let loginCode = "";
+      let registerCode = "";
+
+      const app = createApp({
+         config: {
+            auth: {
+               enabled: true,
+               jwt: {
+                  secret: "test",
+               },
+            },
+         },
+         options: {
+            plugins: [
+               emailOTP({
+                  showActualErrors: true,
+                  generateEmail: (otp) => ({ subject: "test", body: otp.code }),
+               }),
+            ],
+            drivers: {
+               email: {
+                  send: async () => {},
+               },
+            },
+            seed: async (ctx) => {
+               await ctx.app.createUser({ email: "test@test.com", password: "12345678" });
+            },
+         },
+      });
+      await app.build();
+
+      // Send a login code
+      await app.server.request("/api/auth/otp/login", {
+         method: "POST",
+         headers: {
+            "Content-Type": "application/json",
+         },
+         body: JSON.stringify({ email: "test@test.com" }),
+      });
+
+      // Get the login code
+      const { data: loginOtp } = await app
+         .getApi()
+         .data.readOneBy("users_otp", { where: { email: "test@test.com", action: "login" } });
+      loginCode = loginOtp?.code || "";
+
+      // Send a register code
+      await app.server.request("/api/auth/otp/register", {
+         method: "POST",
+         headers: {
+            "Content-Type": "application/json",
+         },
+         body: JSON.stringify({ email: "test@test.com" }),
+      });
+
+      // Get the register code
+      const { data: registerOtp } = await app
+         .getApi()
+         .data.readOneBy("users_otp", { where: { email: "test@test.com", action: "register" } });
+      registerCode = registerOtp?.code || "";
+
+      // Try to use login code for register
+      {
+         const res = await app.server.request("/api/auth/otp/register", {
+            method: "POST",
+            headers: {
+               "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ email: "test@test.com", code: loginCode }),
+         });
+         expect(res.status).toBe(400);
+         const error = await res.json();
+         expect(error).toBeDefined();
+      }
+
+      // Try to use register code for login
+      {
+         const res = await app.server.request("/api/auth/otp/login", {
+            method: "POST",
+            headers: {
+               "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ email: "test@test.com", code: registerCode }),
+         });
+         expect(res.status).toBe(400);
+         const error = await res.json();
+         expect(error).toBeDefined();
+      }
+   });
+
+   test("should invalidate previous codes when sending new code", async () => {
+      let firstCode = "";
+      let secondCode = "";
+
+      const app = createApp({
+         config: {
+            auth: {
+               enabled: true,
+               jwt: {
+                  secret: "test",
+               },
+            },
+         },
+         options: {
+            plugins: [
+               emailOTP({
+                  showActualErrors: true,
+                  generateEmail: (otp) => ({ subject: "test", body: otp.code }),
+               }),
+            ],
+            drivers: {
+               email: {
+                  send: async () => {},
+               },
+            },
+            seed: async (ctx) => {
+               await ctx.app.createUser({ email: "test@test.com", password: "12345678" });
+            },
+         },
+      });
+      await app.build();
+      const em = app.em.fork();
+
+      // Send first code
+      await app.server.request("/api/auth/otp/login", {
+         method: "POST",
+         headers: {
+            "Content-Type": "application/json",
+         },
+         body: JSON.stringify({ email: "test@test.com" }),
+      });
+
+      // Get the first code
+      const { data: firstOtp } = await em
+         .repo("users_otp")
+         .findOne({ email: "test@test.com", action: "login" });
+      firstCode = firstOtp?.code || "";
+      expect(firstCode).toBeDefined();
+
+      // Send second code (should invalidate the first)
+      await app.server.request("/api/auth/otp/login", {
+         method: "POST",
+         headers: {
+            "Content-Type": "application/json",
+         },
+         body: JSON.stringify({ email: "test@test.com" }),
+      });
+
+      // Get the second code
+      const { data: secondOtp } = await em
+         .repo("users_otp")
+         .findOne({ email: "test@test.com", action: "login" });
+      secondCode = secondOtp?.code || "";
+      expect(secondCode).toBeDefined();
+      expect(secondCode).not.toBe(firstCode);
+
+      // Try to use the first code (should fail as it's been invalidated)
+      {
+         const res = await app.server.request("/api/auth/otp/login", {
+            method: "POST",
+            headers: {
+               "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ email: "test@test.com", code: firstCode }),
+         });
+         expect(res.status).toBe(400);
+         const error = await res.json();
+         expect(error).toBeDefined();
+      }
+
+      // The second code should work
+      {
+         const res = await app.server.request("/api/auth/otp/login", {
+            method: "POST",
+            headers: {
+               "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ email: "test@test.com", code: secondCode }),
+         });
+         expect(res.status).toBe(200);
+      }
+   });
+});

app/src/plugins/auth/email-otp.plugin.ts

@@ -0,0 +1,388 @@
+import {
+   datetime,
+   em,
+   entity,
+   enumm,
+   Exception,
+   text,
+   type App,
+   type AppPlugin,
+   type DB,
+   type FieldSchema,
+   type MaybePromise,
+   type EntityConfig,
+   DatabaseEvents,
+} from "bknd";
+import {
+   invariant,
+   s,
+   jsc,
+   HttpStatus,
+   threwAsync,
+   randomString,
+   $console,
+   pickKeys,
+} from "bknd/utils";
+import { Hono } from "hono";
+
+export type EmailOTPPluginOptions = {
+   /**
+    * Customize code generation. If not provided, a random 6-digit code will be generated.
+    */
+   generateCode?: (user: Pick<DB["users"], "email">) => string;
+
+   /**
+    * The base path for the API endpoints.
+    * @default "/api/auth/otp"
+    */
+   apiBasePath?: string;
+
+   /**
+    * The TTL for the OTP tokens in seconds.
+    * @default 600 (10 minutes)
+    */
+   ttl?: number;
+
+   /**
+    * The name of the OTP entity.
+    * @default "users_otp"
+    */
+   entity?: string;
+
+   /**
+    * The config for the OTP entity.
+    */
+   entityConfig?: EntityConfig;
+
+   /**
+    * Customize email content. If not provided, a default email will be sent.
+    */
+   generateEmail?: (
+      otp: EmailOTPFieldSchema,
+   ) => MaybePromise<{ subject: string; body: string | { text: string; html: string } }>;
+
+   /**
+    * Enable debug mode for error messages.
+    * @default false
+    */
+   showActualErrors?: boolean;
+
+   /**
+    * Allow direct mutations (create/update) of OTP codes outside of this plugin,
+    * e.g. via API or admin UI. If false, mutations are only allowed via the plugin's flows.
+    * @default false
+    */
+   allowExternalMutations?: boolean;
+
+   /**
+    * Whether to send the email with the OTP code.
+    * @default true
+    */
+   sendEmail?: boolean;
+};
+
+const otpFields = {
+   action: enumm({
+      enum: ["login", "register"],
+   }),
+   code: text().required(),
+   email: text().required(),
+   created_at: datetime(),
+   expires_at: datetime().required(),
+   used_at: datetime(),
+};
+
+export type EmailOTPFieldSchema = FieldSchema<typeof otpFields>;
+
+class OTPError extends Exception {
+   override name = "OTPError";
+   override code = HttpStatus.BAD_REQUEST;
+}
+
+export function emailOTP({
+   generateCode: _generateCode,
+   apiBasePath = "/api/auth/otp",
+   ttl = 600,
+   entity: entityName = "users_otp",
+   entityConfig,
+   generateEmail: _generateEmail,
+   showActualErrors = false,
+   allowExternalMutations = false,
+   sendEmail = true,
+}: EmailOTPPluginOptions = {}): AppPlugin {
+   return (app: App) => {
+      return {
+         name: "email-otp",
+         schema: () =>
+            em(
+               {
+                  [entityName]: entity(
+                     entityName,
+                     otpFields,
+                     {
+                        name: "Users OTP",
+                        sort_dir: "desc",
+                        primary_format: app.module.data.config.default_primary_format,
+                        ...entityConfig,
+                     },
+                     "generated",
+                  ) as any,
+               },
+               ({ index }, schema) => {
+                  const otp = schema[entityName]!;
+                  index(otp).on(["email", "expires_at", "code"]);
+               },
+            ),
+         onBuilt: async () => {
+            const auth = app.module.auth;
+            invariant(auth && auth.enabled === true, "Auth is not enabled");
+            invariant(!sendEmail || app.drivers?.email, "Email driver is not registered");
+
+            const generateCode =
+               _generateCode ?? (() => Math.floor(100000 + Math.random() * 900000).toString());
+            const generateEmail =
+               _generateEmail ??
+               ((otp: EmailOTPFieldSchema) => ({
+                  subject: "OTP Code",
+                  body: `Your OTP code is: ${otp.code}`,
+               }));
+            const em = app.em.fork();
+
+            const hono = new Hono()
+               .post(
+                  "/login",
+                  jsc(
+                     "json",
+                     s.strictObject({
+                        email: s.string({ format: "email" }),
+                        code: s.string({ minLength: 1 }).optional(),
+                     }),
+                  ),
+                  jsc("query", s.object({ redirect: s.string().optional() })),
+                  async (c) => {
+                     const { email, code } = c.req.valid("json");
+                     const { redirect } = c.req.valid("query");
+                     const user = await findUser(app, email);
+
+                     if (code) {
+                        const otpData = await getValidatedCode(
+                           app,
+                           entityName,
+                           email,
+                           code,
+                           "login",
+                        );
+                        await em.mutator(entityName).updateOne(otpData.id, { used_at: new Date() });
+
+                        const jwt = await auth.authenticator.jwt(user);
+                        // @ts-expect-error private method
+                        return auth.authenticator.respondWithUser(
+                           c,
+                           { user, token: jwt },
+                           { redirect },
+                        );
+                     } else {
+                        const otpData = await invalidateAndGenerateCode(
+                           app,
+                           { generateCode, ttl, entity: entityName },
+                           user,
+                           "login",
+                        );
+                        if (sendEmail) {
+                           await sendCode(app, otpData, { generateEmail });
+                        }
+
+                        return c.json(
+                           {
+                              sent: true,
+                              data: pickKeys(otpData, ["email", "action", "expires_at"]),
+                           },
+                           HttpStatus.CREATED,
+                        );
+                     }
+                  },
+               )
+               .post(
+                  "/register",
+                  jsc(
+                     "json",
+                     s.object({
+                        email: s.string({ format: "email" }),
+                        code: s.string({ minLength: 1 }).optional(),
+                     }),
+                  ),
+                  jsc("query", s.object({ redirect: s.string().optional() })),
+                  async (c) => {
+                     const { email, code, ...rest } = c.req.valid("json");
+                     const { redirect } = c.req.valid("query");
+
+                     // throw if user exists
+                     if (!(await threwAsync(findUser(app, email)))) {
+                        throw new Exception("User already exists", HttpStatus.BAD_REQUEST);
+                     }
+
+                     if (code) {
+                        const otpData = await getValidatedCode(
+                           app,
+                           entityName,
+                           email,
+                           code,
+                           "register",
+                        );
+                        await em.mutator(entityName).updateOne(otpData.id, { used_at: new Date() });
+
+                        const user = await app.createUser({
+                           ...rest,
+                           email,
+                           password: randomString(32, true),
+                        });
+
+                        const jwt = await auth.authenticator.jwt(user);
+                        // @ts-expect-error private method
+                        return auth.authenticator.respondWithUser(
+                           c,
+                           { user, token: jwt },
+                           { redirect },
+                        );
+                     } else {
+                        const otpData = await invalidateAndGenerateCode(
+                           app,
+                           { generateCode, ttl, entity: entityName },
+                           { email },
+                           "register",
+                        );
+                        if (sendEmail) {
+                           await sendCode(app, otpData, { generateEmail });
+                        }
+
+                        return c.json(
+                           {
+                              sent: true,
+                              data: pickKeys(otpData, ["email", "action", "expires_at"]),
+                           },
+                           HttpStatus.CREATED,
+                        );
+                     }
+                  },
+               )
+               .onError((err) => {
+                  if (showActualErrors || err instanceof OTPError) {
+                     throw err;
+                  }
+
+                  throw new Exception("Invalid credentials", HttpStatus.BAD_REQUEST);
+               });
+
+            app.server.route(apiBasePath, hono);
+
+            if (allowExternalMutations !== true) {
+               registerListeners(app, entityName);
+            }
+         },
+      };
+   };
+}
+
+async function findUser(app: App, email: string) {
+   const user_entity = app.module.auth.config.entity_name as "users";
+   const { data: user } = await app.em.repo(user_entity).findOne({ email });
+   if (!user) {
+      throw new Exception("User not found", HttpStatus.BAD_REQUEST);
+   }
+
+   return user;
+}
+
+async function invalidateAndGenerateCode(
+   app: App,
+   opts: Required<Pick<EmailOTPPluginOptions, "generateCode" | "ttl" | "entity">>,
+   user: Pick<DB["users"], "email">,
+   action: EmailOTPFieldSchema["action"],
+) {
+   const { generateCode, ttl, entity: entityName } = opts;
+   const newCode = generateCode?.(user);
+   if (!newCode) {
+      throw new OTPError("Failed to generate code");
+   }
+
+   await invalidateAllUserCodes(app, entityName, user.email, ttl);
+   const { data: otpData } = await app.em
+      .fork()
+      .mutator(entityName)
+      .insertOne({
+         code: newCode,
+         email: user.email,
+         action,
+         created_at: new Date(),
+         expires_at: new Date(Date.now() + ttl * 1000),
+      });
+
+   $console.log("[OTP Code]", newCode);
+
+   return otpData;
+}
+
+async function sendCode(
+   app: App,
+   otpData: EmailOTPFieldSchema,
+   opts: Required<Pick<EmailOTPPluginOptions, "generateEmail">>,
+) {
+   const { generateEmail } = opts;
+   const { subject, body } = await generateEmail(otpData);
+   await app.drivers?.email?.send(otpData.email, subject, body);
+}
+
+async function getValidatedCode(
+   app: App,
+   entityName: string,
+   email: string,
+   code: string,
+   action: EmailOTPFieldSchema["action"],
+) {
+   invariant(email, "[OTP Plugin]: Email is required");
+   invariant(code, "[OTP Plugin]: Code is required");
+   const em = app.em.fork();
+   const { data: otpData } = await em.repo(entityName).findOne({ email, code, action });
+   if (!otpData) {
+      throw new OTPError("Invalid code");
+   }
+
+   if (otpData.expires_at < new Date()) {
+      throw new OTPError("Code expired");
+   }
+
+   if (otpData.used_at) {
+      throw new OTPError("Code already used");
+   }
+
+   return otpData;
+}
+
+async function invalidateAllUserCodes(app: App, entityName: string, email: string, ttl: number) {
+   invariant(ttl > 0, "[OTP Plugin]: TTL must be greater than 0");
+   invariant(email, "[OTP Plugin]: Email is required");
+   const em = app.em.fork();
+   await em
+      .mutator(entityName)
+      .updateWhere(
+         { expires_at: new Date(Date.now() - 1000) },
+         { email, used_at: { $isnull: true } },
+      );
+}
+
+function registerListeners(app: App, entityName: string) {
+   [DatabaseEvents.MutatorInsertBefore, DatabaseEvents.MutatorUpdateBefore].forEach((event) => {
+      app.emgr.onEvent(
+         event,
+         (e: { params: { entity: { name: string } } }) => {
+            if (e.params.entity.name === entityName) {
+               throw new OTPError("Mutations of the OTP entity are not allowed");
+            }
+         },
+         {
+            mode: "sync",
+            id: "bknd-email-otp",
+         },
+      );
+   });
+}

app/src/plugins/index.ts

@@ -8,3 +8,4 @@ export { syncConfig, type SyncConfigOptions } from "./dev/sync-config.plugin";
 export { syncTypes, type SyncTypesOptions } from "./dev/sync-types.plugin";
 export { syncSecrets, type SyncSecretsOptions } from "./dev/sync-secrets.plugin";
 export { timestamps, type TimestampsPluginOptions } from "./data/timestamps.plugin";
+export { emailOTP, type EmailOTPPluginOptions } from "./auth/email-otp.plugin";

app/src/ui/Admin.tsx

@@ -5,7 +5,7 @@ import { BkndProvider } from "ui/client/bknd";
 import { useTheme, type AppTheme } from "ui/client/use-theme";
 import { Logo } from "ui/components/display/Logo";
 import * as AppShell from "ui/layouts/AppShell/AppShell";
-import { ClientProvider, useBkndWindowContext, type ClientProviderProps } from "./client";
+import { ClientProvider, useBkndWindowContext, type ClientProviderProps } from "bknd/client";
 import { createMantineTheme } from "./lib/mantine/theme";
 import { Routes } from "./routes";
 import type { BkndAdminAppShellOptions, BkndAdminEntitiesOptions } from "./options";
@@ -52,26 +52,30 @@ export type BkndAdminProps = {
    children?: ReactNode;
 };
 
-export default function Admin({
-   baseUrl: baseUrlOverride,
-   withProvider = false,
-   config: _config = {},
-   children,
-}: BkndAdminProps) {
-   const { theme } = useTheme();
+export default function Admin(props: BkndAdminProps) {
    const Provider = ({ children }: any) =>
-      withProvider ? (
+      props.withProvider ? (
          <ClientProvider
-            baseUrl={baseUrlOverride}
-            {...(typeof withProvider === "object" ? withProvider : {})}
+            baseUrl={props.baseUrl}
+            {...(typeof props.withProvider === "object" ? props.withProvider : {})}
          >
             {children}
          </ClientProvider>
       ) : (
          children
       );
+
+   return (
+      <Provider>
+         <AdminInner {...props} />
+      </Provider>
+   );
+}
+
+function AdminInner(props: BkndAdminProps) {
+   const { theme } = useTheme();
    const config = {
-      ..._config,
+      ...props.config,
       ...useBkndWindowContext(),
    };
 
@@ -82,14 +86,12 @@ export default function Admin({
    );
 
    return (
-      <Provider>
-         <MantineProvider {...createMantineTheme(theme as any)}>
-            <Notifications position="top-right" />
-            <Routes BkndWrapper={BkndWrapper} basePath={config?.basepath}>
-               {children}
-            </Routes>
-         </MantineProvider>
-      </Provider>
+      <MantineProvider {...createMantineTheme(theme as any)}>
+         <Notifications position="top-right" />
+         <Routes BkndWrapper={BkndWrapper} basePath={config?.basepath}>
+            {props.children}
+         </Routes>
+      </MantineProvider>
    );
 }
 

app/src/ui/client/BkndProvider.tsx

@@ -9,7 +9,7 @@ import {
    useState,
    type ReactNode,
 } from "react";
-import { useApi } from "ui/client";
+import { useApi } from "bknd/client";
 import { type TSchemaActions, getSchemaActions } from "./schema/actions";
 import { AppReduced } from "./utils/AppReduced";
 import { Message } from "ui/components/display/Message";

app/src/ui/client/ClientProvider.tsx

@@ -14,18 +14,20 @@ const ClientContext = createContext<BkndClientContext>(undefined!);
 export type ClientProviderProps = {
    children?: ReactNode;
    baseUrl?: string;
+   api?: Api;
 } & ApiOptions;
 
 export const ClientProvider = ({
    children,
    host,
    baseUrl: _baseUrl = host,
+   api: _api,
    ...props
 }: ClientProviderProps) => {
    const winCtx = useBkndWindowContext();
    const _ctx = useClientContext();
    let actualBaseUrl = _baseUrl ?? _ctx?.baseUrl ?? "";
-   let user: any = undefined;
+   let user: any;
 
    if (winCtx) {
       user = winCtx.user;
@@ -40,6 +42,7 @@ export const ClientProvider = ({
    const apiProps = { user, ...props, host: actualBaseUrl };
    const api = useMemo(
       () =>
+         _api ??
          new Api({
             ...apiProps,
             verbose: isDebug(),
@@ -50,7 +53,7 @@ export const ClientProvider = ({
                }
             },
          }),
-      [JSON.stringify(apiProps)],
+      [_api, JSON.stringify(apiProps)],
    );
 
    const [authState, setAuthState] = useState<Partial<AuthState> | undefined>(api.getAuthState());
@@ -64,9 +67,14 @@ export const ClientProvider = ({
 
 export const useApi = (host?: ApiOptions["host"]): Api => {
    const context = useContext(ClientContext);
+
    if (!context?.api || (host && host.length > 0 && host !== context.baseUrl)) {
+      console.info("creating new api", { host });
       return new Api({ host: host ?? "" });
    }
+   if (!context) {
+      throw new Error("useApi must be used within a ClientProvider");
+   }
 
    return context.api;
 };

app/src/ui/client/api/use-api.ts

@@ -2,7 +2,7 @@ import type { Api } from "Api";
 import { FetchPromise, type ModuleApi, type ResponseObject } from "modules/ModuleApi";
 import useSWR, { type SWRConfiguration, useSWRConfig, type Middleware, type SWRHook } from "swr";
 import useSWRInfinite from "swr/infinite";
-import { useApi } from "ui/client";
+import { useApi } from "../ClientProvider";
 import { useState } from "react";
 
 export const useApiQuery = <

app/src/ui/client/api/use-entity.ts

@@ -8,9 +8,9 @@ import type {
    ModuleApi,
 } from "bknd";
 import { objectTransform, encodeSearch } from "bknd/utils";
-import type { Insertable, Selectable, Updateable } from "kysely";
+import type { Insertable, Selectable, Updateable, Generated } from "kysely";
 import useSWR, { type SWRConfiguration, type SWRResponse, mutate } from "swr";
-import { type Api, useApi } from "ui/client";
+import { type Api, useApi } from "bknd/client";
 
 export class UseEntityApiError<Payload = any> extends Error {
    constructor(
@@ -33,6 +33,7 @@ interface UseEntityReturn<
    Entity extends keyof DB | string,
    Id extends PrimaryFieldType | undefined,
    Data = Entity extends keyof DB ? DB[Entity] : EntityData,
+   ActualId = Data extends { id: infer I } ? (I extends Generated<infer T> ? T : I) : never,
    Response = ResponseObject<RepositoryResult<Selectable<Data>>>,
 > {
    create: (input: Insertable<Data>) => Promise<Response>;
@@ -42,9 +43,11 @@ interface UseEntityReturn<
       ResponseObject<RepositoryResult<Id extends undefined ? Selectable<Data>[] : Selectable<Data>>>
    >;
    update: Id extends undefined
-      ? (input: Updateable<Data>, id: Id) => Promise<Response>
+      ? (input: Updateable<Data>, id: ActualId) => Promise<Response>
       : (input: Updateable<Data>) => Promise<Response>;
-   _delete: Id extends undefined ? (id: Id) => Promise<Response> : () => Promise<Response>;
+   _delete: Id extends undefined
+      ? (id: PrimaryFieldType) => Promise<Response>
+      : () => Promise<Response>;
 }
 
 export const useEntity = <

app/src/ui/client/index.ts

@@ -4,6 +4,7 @@ export {
    type ClientProviderProps,
    useApi,
    useBaseUrl,
+   useClientContext
 } from "./ClientProvider";
 
 export * from "./api/use-api";

app/src/ui/client/schema/auth/use-auth.ts

@@ -1,7 +1,6 @@
 import type { AuthState } from "Api";
 import type { AuthResponse } from "bknd";
-import { useApi, useInvalidate } from "ui/client";
-import { useClientContext } from "ui/client/ClientProvider";
+import { useApi, useInvalidate, useClientContext } from "bknd/client";
 
 type LoginData = {
    email: string;
@@ -19,6 +18,7 @@ type UseAuth = {
    logout: () => Promise<void>;
    verify: () => Promise<void>;
    setToken: (token: string) => void;
+   local: boolean;
 };
 
 export const useAuth = (options?: { baseUrl?: string }): UseAuth => {
@@ -61,5 +61,6 @@ export const useAuth = (options?: { baseUrl?: string }): UseAuth => {
       logout,
       setToken,
       verify,
+      local: !!api.options.storage,
    };
 };

app/src/ui/components/buttons/Button.tsx

@@ -1,6 +1,5 @@
 import type React from "react";
-import { Children } from "react";
-import { forwardRef } from "react";
+import { Children, forwardRef } from "react";
 import { twMerge } from "tailwind-merge";
 import { Link } from "ui/components/wouter/Link";
 

app/src/ui/components/form/Formy/components.tsx

@@ -1,6 +1,6 @@
 import { Tooltip } from "@mantine/core";
 import clsx from "clsx";
-import { getBrowser } from "core/utils";
+import { getBrowser } from "bknd/utils";
 import type { Field } from "data/fields";
 import { Switch as RadixSwitch } from "radix-ui";
 import {

app/src/ui/components/form/native-form/NativeForm.tsx

@@ -16,15 +16,18 @@ import {
    setPath,
 } from "./utils";
 
-export type NativeFormProps = {
+export type NativeFormProps = Omit<ComponentPropsWithoutRef<"form">, "onChange" | "onSubmit"> & {
    hiddenSubmit?: boolean;
    validateOn?: "change" | "submit";
-   errorFieldSelector?: <K extends keyof HTMLElementTagNameMap>(name: string) => any | null;
+   errorFieldSelector?: (selector: string) => any | null;
    reportValidity?: boolean;
-   onSubmit?: (data: any, ctx: { event: FormEvent<HTMLFormElement> }) => Promise<void> | void;
+   onSubmit?: (
+      data: any,
+      ctx: { event: FormEvent<HTMLFormElement>; form: HTMLFormElement },
+   ) => Promise<void> | void;
    onSubmitInvalid?: (
       errors: InputError[],
-      ctx: { event: FormEvent<HTMLFormElement> },
+      ctx: { event: FormEvent<HTMLFormElement>; form: HTMLFormElement },
    ) => Promise<void> | void;
    onError?: (errors: InputError[]) => void;
    disableSubmitOnError?: boolean;
@@ -33,7 +36,7 @@ export type NativeFormProps = {
       ctx: { event: ChangeEvent<HTMLFormElement>; key: string; value: any; errors: InputError[] },
    ) => Promise<void> | void;
    clean?: CleanOptions | true;
-} & Omit<ComponentPropsWithoutRef<"form">, "onChange" | "onSubmit">;
+};
 
 export type InputError = {
    name: string;
@@ -188,12 +191,12 @@ export function NativeForm({
 
       const errors = validate({ report: true });
       if (errors.length > 0) {
-         onSubmitInvalid?.(errors, { event: e });
+         onSubmitInvalid?.(errors, { event: e, form });
          return;
       }
 
       if (onSubmit) {
-         await onSubmit(getFormValues(), { event: e });
+         await onSubmit(getFormValues(), { event: e, form });
       } else {
          form.submit();
       }

app/src/ui/components/wouter/Link.tsx

@@ -1,5 +1,4 @@
-import { useInsertionEffect, useRef } from "react";
-import { type LinkProps, Link as WouterLink, useRoute, useRouter } from "wouter";
+import { type LinkProps, Link as WouterLink, useRouter } from "wouter";
 import { useEvent } from "../../hooks/use-event";
 
 /*

app/src/ui/elements/auth/AuthForm.tsx

@@ -1,13 +1,16 @@
 import type { AppAuthOAuthStrategy, AppAuthSchema } from "auth/auth-schema";
 import clsx from "clsx";
 import { NativeForm } from "ui/components/form/native-form/NativeForm";
-import { transform } from "lodash-es";
-import type { ComponentPropsWithoutRef } from "react";
+import { transformObject } from "bknd/utils";
+import { useEffect, useState, type ComponentPropsWithoutRef, type FormEvent } from "react";
 import { Button } from "ui/components/buttons/Button";
 import { Group, Input, Password, Label } from "ui/components/form/Formy/components";
 import { SocialLink } from "./SocialLink";
+import { useAuth } from "bknd/client";
+import { Alert } from "ui/components/display/Alert";
+import { useLocation } from "wouter";
 
-export type LoginFormProps = Omit<ComponentPropsWithoutRef<"form">, "onSubmit" | "action"> & {
+export type LoginFormProps = Omit<ComponentPropsWithoutRef<"form">, "action"> & {
    className?: string;
    formData?: any;
    action: "login" | "register";
@@ -23,25 +26,50 @@ export function AuthForm({
    action,
    auth,
    buttonLabel = action === "login" ? "Sign in" : "Sign up",
+   onSubmit: _onSubmit,
    ...props
 }: LoginFormProps) {
+   const $auth = useAuth();
    const basepath = auth?.basepath ?? "/api/auth";
+   const [error, setError] = useState<string>();
+   const [, navigate] = useLocation();
    const password = {
       action: `${basepath}/password/${action}`,
       strategy: auth?.strategies?.password ?? ({ type: "password" } as const),
    };
 
-   const oauth = transform(
-      auth?.strategies ?? {},
-      (result, value, key) => {
-         if (value.type !== "password") {
-            result[key] = value.config;
-         }
-      },
-      {},
-   ) as Record<string, AppAuthOAuthStrategy>;
+   const oauth = transformObject(auth?.strategies ?? {}, (value) => {
+      return value.type !== "password" ? value.config : undefined;
+   }) as Record<string, AppAuthOAuthStrategy>;
    const has_oauth = Object.keys(oauth).length > 0;
 
+   async function onSubmit(
+      data: any,
+      ctx: { event: FormEvent<HTMLFormElement>; form: HTMLFormElement },
+   ) {
+      if ($auth?.local) {
+         ctx.event.preventDefault();
+
+         const res = await $auth.login(data);
+         if ("token" in res) {
+            navigate("/");
+         } else {
+            setError((res as any).error);
+            return;
+         }
+      }
+
+      await _onSubmit?.(ctx.event);
+      // submit form
+      ctx.form.submit();
+   }
+
+   useEffect(() => {
+      if ($auth.user) {
+         navigate("/");
+      }
+   }, [$auth.user]);
+
    return (
       <div className="flex flex-col gap-4 w-full">
          {has_oauth && (
@@ -63,17 +91,19 @@ export function AuthForm({
          <NativeForm
             method={method}
             action={password.action}
+            onSubmit={onSubmit}
             {...(props as any)}
             validateOn="change"
             className={clsx("flex flex-col gap-3 w-full", className)}
          >
+            {error && <Alert.Exception message={error} className="justify-center" />}
             <Group>
                <Label htmlFor="email">Email address</Label>
                <Input type="email" name="email" required />
             </Group>
             <Group>
                <Label htmlFor="password">Password</Label>
-               <Password name="password" required minLength={8} />
+               <Password name="password" required minLength={1} />
             </Group>
 
             <Button

app/src/ui/elements/auth/SocialLink.tsx

@@ -1,4 +1,4 @@
-import { ucFirstAllSnakeToPascalWithSpaces } from "core/utils";
+import { ucFirstAllSnakeToPascalWithSpaces } from "bknd/utils";
 import type { ReactNode } from "react";
 import { Button } from "ui/components/buttons/Button";
 import type { IconType } from "ui/components/buttons/IconButton";

app/src/ui/elements/hooks/use-auth.ts

@@ -1,9 +1,11 @@
 import type { AppAuthSchema } from "auth/auth-schema";
 import { useEffect, useState } from "react";
-import { useApi } from "ui/client";
+import { useApi } from "bknd/client";
 
 type AuthStrategyData = Pick<AppAuthSchema, "strategies" | "basepath">;
-export const useAuthStrategies = (options?: { baseUrl?: string }): Partial<AuthStrategyData> & {
+export const useAuthStrategies = (options?: {
+   baseUrl?: string;
+}): Partial<AuthStrategyData> & {
    loading: boolean;
 } => {
    const [data, setData] = useState<AuthStrategyData>();

app/src/ui/elements/media/Dropzone.tsx

@@ -14,7 +14,7 @@ import { isFileAccepted } from "bknd/utils";
 import { type FileWithPath, useDropzone } from "./use-dropzone";
 import { checkMaxReached } from "./helper";
 import { DropzoneInner } from "./DropzoneInner";
-import { createDropzoneStore } from "ui/elements/media/dropzone-state";
+import { createDropzoneStore } from "./dropzone-state";
 import { useStore } from "zustand";
 
 export type FileState = {

app/src/ui/elements/media/DropzoneContainer.tsx

@@ -1,9 +1,8 @@
-import type { Api } from "bknd/client";
 import type { PrimaryFieldType, RepoQueryIn } from "bknd";
 import type { MediaFieldSchema } from "media/AppMedia";
 import type { TAppMediaConfig } from "media/media-schema";
 import { useId, useEffect, useRef, useState } from "react";
-import { useApi, useApiInfiniteQuery, useApiQuery, useInvalidate } from "bknd/client";
+import { type Api, useApi, useApiInfiniteQuery, useApiQuery, useInvalidate } from "bknd/client";
 import { useEvent } from "ui/hooks/use-event";
 import { Dropzone, type DropzoneProps } from "./Dropzone";
 import { mediaItemsToFileStates } from "./helper";
@@ -132,26 +131,24 @@ export function DropzoneContainer({
    }
 
    return (
-      <>
-         <Dropzone
-            key={key}
-            getUploadInfo={getUploadInfo}
-            handleDelete={handleDelete}
-            autoUpload
-            initialItems={_initialItems}
-            footer={
-               infinite &&
-               "setSize" in $q && (
-                  <Footer
-                     items={_initialItems.length}
-                     length={placeholderLength}
-                     onFirstVisible={() => $q.setSize($q.size + 1)}
-                  />
-               )
-            }
-            {...props}
-         />
-      </>
+      <Dropzone
+         key={key}
+         getUploadInfo={getUploadInfo}
+         handleDelete={handleDelete}
+         autoUpload
+         initialItems={_initialItems}
+         footer={
+            infinite &&
+            "setSize" in $q && (
+               <Footer
+                  items={_initialItems.length}
+                  length={placeholderLength}
+                  onFirstVisible={() => $q.setSize($q.size + 1)}
+               />
+            )
+         }
+         {...props}
+      />
    );
 }
 

app/src/ui/elements/media/DropzoneInner.tsx

@@ -19,8 +19,8 @@ import {
 } from "react-icons/tb";
 import { Dropdown, type DropdownItem } from "ui/components/overlay/Dropdown";
 import { IconButton } from "ui/components/buttons/IconButton";
-import { formatNumber } from "core/utils";
-import type { DropzoneRenderProps, FileState } from "ui/elements";
+import { formatNumber } from "bknd/utils";
+import type { DropzoneRenderProps, FileState } from "./Dropzone";
 import { useDropzoneFileState, useDropzoneState } from "./Dropzone";
 
 function handleUploadError(e: unknown) {

app/src/ui/layouts/AppShell/AppShell.tsx

@@ -474,6 +474,7 @@ type SectionHeaderAccordionItemProps = {
    ActiveIcon?: any;
    children?: React.ReactNode;
    renderHeaderRight?: (props: { open: boolean }) => React.ReactNode;
+   scrollContainerRef?: React.RefObject<HTMLDivElement>;
 };
 
 export const SectionHeaderAccordionItem = ({
@@ -483,6 +484,7 @@ export const SectionHeaderAccordionItem = ({
    ActiveIcon = IconChevronUp,
    children,
    renderHeaderRight,
+   scrollContainerRef,
 }: SectionHeaderAccordionItemProps) => (
    <div
       style={{ minHeight: 49 }}
@@ -493,6 +495,8 @@ export const SectionHeaderAccordionItem = ({
             : "flex-initial cursor-pointer hover:bg-primary/5",
       )}
    >
+      {/** biome-ignore lint/a11y/noStaticElementInteractions: . */}
+      {/** biome-ignore lint/a11y/useKeyWithClickEvents: . */}
       <div
          className={twMerge(
             "flex flex-row bg-muted/10 border-muted border-b h-14 py-4 pr-4 pl-2 items-center gap-2",
@@ -501,14 +505,12 @@ export const SectionHeaderAccordionItem = ({
       >
          <IconButton Icon={open ? ActiveIcon : IconChevronDown} disabled={open} />
          <h2 className="text-lg dark:font-bold font-semibold select-text">{title}</h2>
-         <div className="flex flex-grow" />
+         <div className="flex grow" />
          {renderHeaderRight?.({ open })}
       </div>
       <div
-         className={twMerge(
-            "overflow-y-scroll transition-all",
-            open ? " flex-grow" : "h-0 opacity-0",
-         )}
+         ref={scrollContainerRef}
+         className={twMerge("overflow-y-scroll transition-all", open ? " grow" : "h-0 opacity-0")}
       >
          {children}
       </div>
@@ -518,14 +520,25 @@ export const SectionHeaderAccordionItem = ({
 export const RouteAwareSectionHeaderAccordionItem = ({
    routePattern,
    identifier,
+   renderHeaderRight,
    ...props
-}: Omit<SectionHeaderAccordionItemProps, "open" | "toggle"> & {
+}: Omit<SectionHeaderAccordionItemProps, "open" | "toggle" | "renderHeaderRight"> & {
+   renderHeaderRight?: (props: { open: boolean; active: boolean }) => React.ReactNode;
    // it's optional because it could be provided using the context
    routePattern?: string;
    identifier: string;
 }) => {
    const { active, toggle } = useRoutePathState(routePattern, identifier);
-   return <SectionHeaderAccordionItem {...props} open={active} toggle={toggle} />;
+   return (
+      <SectionHeaderAccordionItem
+         {...props}
+         open={active}
+         toggle={toggle}
+         renderHeaderRight={
+            renderHeaderRight && ((props) => renderHeaderRight?.({ open: props.open, active }))
+         }
+      />
+   );
 };
 
 export const Separator = ({ className, ...props }: ComponentPropsWithoutRef<"hr">) => (

app/src/ui/layouts/AppShell/Header.tsx

@@ -1,4 +1,4 @@
-import { SegmentedControl, Tooltip } from "@mantine/core";
+import { SegmentedControl } from "@mantine/core";
 import { IconApi, IconBook, IconKeyOff, IconSettings, IconUser } from "@tabler/icons-react";
 import {
    TbDatabase,
@@ -10,7 +10,7 @@ import {
    TbUser,
    TbX,
 } from "react-icons/tb";
-import { useAuth, useBkndWindowContext } from "ui/client";
+import { useAuth, useBkndWindowContext } from "bknd/client";
 import { useBknd } from "ui/client/bknd";
 import { useTheme } from "ui/client/use-theme";
 import { Button } from "ui/components/buttons/Button";
@@ -24,34 +24,35 @@ import { useLocation } from "wouter";
 import { NavLink } from "./AppShell";
 import { autoFormatString } from "core/utils";
 import { appShellStore } from "ui/store";
-import { getVersion } from "core/env";
+import { getVersion, isDebug } from "core/env";
 import { McpIcon } from "ui/routes/tools/mcp/components/mcp-icon";
 import { useAppShellAdminOptions } from "ui/options";
 
 export function HeaderNavigation() {
    const [location, navigate] = useLocation();
+   const { config } = useBknd();
 
    const items: {
       label: string;
       href: string;
-      Icon: any;
+      Icon?: any;
       exact?: boolean;
       tooltip?: string;
       disabled?: boolean;
    }[] = [
-      /*{
-         label: "Base",
-         href: "#",
-         exact: true,
-         Icon: TbLayoutDashboard,
-         disabled: true,
-         tooltip: "Coming soon"
-      },*/
       { label: "Data", href: "/data", Icon: TbDatabase },
       { label: "Auth", href: "/auth", Icon: TbFingerprint },
       { label: "Media", href: "/media", Icon: TbPhoto },
-      { label: "Flows", href: "/flows", Icon: TbHierarchy2 },
    ];
+
+   if (isDebug() || Object.keys(config.flows?.flows ?? {}).length > 0) {
+      items.push({ label: "Flows", href: "/flows", Icon: TbHierarchy2 });
+   }
+
+   if (config.server.mcp.enabled) {
+      items.push({ label: "MCP", href: "/tools/mcp", Icon: McpIcon });
+   }
+
    const activeItem = items.find((item) =>
       item.exact ? location === item.href : location.startsWith(item.href),
    );
@@ -154,8 +155,10 @@ function UserMenu() {
 
    async function handleLogout() {
       await auth.logout();
-      // @todo: grab from somewhere constant
-      navigate(logout_route, { reload: true });
+
+      if (!auth.local) {
+         navigate(logout_route, { reload: true });
+      }
    }
 
    async function handleLogin() {

app/src/ui/modals/media/MediaInfoModal.tsx

@@ -1,6 +1,6 @@
 import type { ContextModalProps } from "@mantine/modals";
 import { type ReactNode, useEffect, useMemo, useState } from "react";
-import { useEntityQuery } from "ui/client";
+import { useEntityQuery } from "bknd/client";
 import { type FileState, Media } from "ui/elements";
 import { autoFormatString, datetimeStringLocal, formatNumber } from "core/utils";
 import { twMerge } from "tailwind-merge";

app/src/ui/modules/auth/hooks/use-create-user-modal.ts

@@ -1,4 +1,4 @@
-import { useApi, useInvalidate } from "ui/client";
+import { useApi, useInvalidate } from "bknd/client";
 import { useBkndAuth } from "ui/client/schema/auth/use-bknd-auth";
 import { routes, useNavigate } from "ui/lib/routes";
 import { bkndModals } from "ui/modals";

app/src/ui/modules/data/components/EntityForm.tsx

@@ -19,9 +19,10 @@ import type { RelationField } from "data/relations";
 import { useEntityAdminOptions } from "ui/options";
 
 // simplify react form types 🤦
-export type FormApi = ReactFormExtendedApi<any, any, any, any, any, any, any, any, any, any>;
 // biome-ignore format: ...
-export type TFieldApi = FieldApi<any, any, any, any, any, any, any, any, any, any, any, any, any, any, any, any, any, any, any>;
+export type FormApi = ReactFormExtendedApi<any, any, any, any, any, any, any, any, any, any, any, any>;
+// biome-ignore format: ...
+export type TFieldApi = FieldApi<any, any, any, any, any, any, any, any, any, any, any, any, any, any, any, any, any, any, any, any, any, any, any>;
 
 type EntityFormProps = {
    entity: Entity;

app/src/ui/modules/data/components/fields/EntityRelationalFormField.tsx

@@ -4,7 +4,7 @@ import type { EntityData } from "bknd";
 import type { RelationField } from "data/relations";
 import { useEffect, useRef, useState } from "react";
 import { TbEye } from "react-icons/tb";
-import { useEntityQuery } from "ui/client";
+import { useEntityQuery } from "bknd/client";
 import { useBknd } from "ui/client/bknd";
 import { Button } from "ui/components/buttons/Button";
 import * as Formy from "ui/components/form/Formy";

app/src/ui/routes/auth/auth.index.tsx

@@ -1,6 +1,6 @@
 import clsx from "clsx";
 import { TbArrowRight, TbCircle, TbCircleCheckFilled, TbFingerprint } from "react-icons/tb";
-import { useApiQuery } from "ui/client";
+import { useApiQuery } from "bknd/client";
 import { useBknd } from "ui/client/bknd";
 import { useBkndAuth } from "ui/client/schema/auth/use-bknd-auth";
 import { ButtonLink, type ButtonLinkProps } from "ui/components/buttons/Button";

app/src/ui/routes/auth/auth.roles.edit.$role.tsx

@@ -35,7 +35,7 @@ import { SegmentedControl, Tooltip } from "@mantine/core";
 import { Popover } from "ui/components/overlay/Popover";
 import { cn } from "ui/lib/utils";
 import { JsonViewer } from "ui/components/code/JsonViewer";
-import { mountOnce, useApiQuery } from "ui/client";
+import { mountOnce, useApiQuery } from "bknd/client";
 import { CodePreview } from "ui/components/code/CodePreview";
 import type { JsonError } from "json-schema-library";
 import { Alert } from "ui/components/display/Alert";
@@ -378,11 +378,7 @@ function replaceEntitiesEnum(schema: Record<string, any>, entities: string[]) {
    });
 }
 
-const Policy = ({
-   permission,
-}: {
-   permission: TPermission;
-}) => {
+const Policy = ({ permission }: { permission: TPermission }) => {
    const { value } = useDerivedFieldContext("", ({ value }) => ({
       effect: (value?.effect ?? "allow") as "allow" | "deny" | "filter",
    }));
@@ -503,22 +499,24 @@ const CustomFieldWrapper = ({
                         className: "max-w-none",
                      }}
                      position="bottom-end"
-                     target={() =>
-                        typeof schema.content === "object" ? (
-                           <JsonViewer
-                              className="w-auto max-w-120 bg-background pr-3 text-sm"
-                              json={schema.content}
-                              title={schema.name}
-                              expand={5}
-                           />
-                        ) : (
-                           <CodePreview
-                              code={schema.content}
-                              lang="typescript"
-                              className="w-auto max-w-120 bg-background p-3 text-sm"
-                           />
-                        )
-                     }
+                     target={() => (
+                        <div className="w-auto max-w-[80vw] md:max-w-120 bg-background overflow-scroll">
+                           {typeof schema.content === "object" ? (
+                              <JsonViewer
+                                 className="pr-3 text-sm"
+                                 json={schema.content}
+                                 title={schema.name}
+                                 expand={5}
+                              />
+                           ) : (
+                              <CodePreview
+                                 code={schema.content}
+                                 lang="typescript"
+                                 className="p-3 text-sm"
+                              />
+                           )}
+                        </div>
+                     )}
                   >
                      <Button variant="ghost" size="smaller" IconLeft={TbCodeDots}>
                         {autoFormatString(schema.name)}

app/src/ui/routes/data/data.$entity.$id.tsx

@@ -3,7 +3,7 @@ import { ucFirst } from "bknd/utils";
 import type { Entity, EntityData, EntityRelation } from "bknd";
 import { Fragment, useState } from "react";
 import { TbDots } from "react-icons/tb";
-import { useApiQuery, useEntityQuery } from "ui/client";
+import { useApiQuery, useEntityQuery } from "bknd/client";
 import { useBkndData } from "ui/client/schema/data/use-bknd-data";
 import { Button } from "ui/components/buttons/Button";
 import { IconButton } from "ui/components/buttons/IconButton";
@@ -207,7 +207,7 @@ function DataEntityUpdateImpl({ params }) {
                   handleSubmit={handleSubmit}
                   fieldsDisabled={fieldsDisabled}
                   data={data ?? undefined}
-                  Form={Form}
+                  Form={Form as any}
                   action="update"
                   className="flex flex-grow flex-col gap-3 p-3"
                />

app/src/ui/routes/data/data.$entity.create.tsx

@@ -1,6 +1,6 @@
 import type { EntityData } from "bknd";
 import { useState } from "react";
-import { useEntityMutate } from "ui/client";
+import { useEntityMutate } from "bknd/client";
 import { useBkndData } from "ui/client/schema/data/use-bknd-data";
 import { Button } from "ui/components/buttons/Button";
 import { Message } from "ui/components/display/Message";
@@ -121,7 +121,7 @@ export function DataEntityCreate({ params }) {
                handleSubmit={handleSubmit}
                fieldsDisabled={fieldsDisabled}
                data={search.value}
-               Form={Form}
+               Form={Form as any}
                action="create"
                className="flex flex-grow flex-col gap-3 p-3"
             />

app/src/ui/routes/data/data.$entity.index.tsx

@@ -2,7 +2,7 @@ import type { Entity } from "bknd";
 import { repoQuery } from "data/server/query";
 import { Fragment } from "react";
 import { TbDots } from "react-icons/tb";
-import { useApiQuery } from "ui/client";
+import { useApiQuery } from "bknd/client";
 import { useBknd } from "ui/client/bknd";
 import { useBkndData } from "ui/client/schema/data/use-bknd-data";
 import { Button } from "ui/components/buttons/Button";

app/src/ui/routes/data/forms/entity.fields.form.tsx

@@ -5,12 +5,12 @@ import {
    ucFirstAllSnakeToPascalWithSpaces,
    s,
    stringIdentifier,
+   pickKeys,
 } from "bknd/utils";
 import {
    type TAppDataEntityFields,
    fieldsSchemaObject as originalFieldsSchemaObject,
 } from "data/data-schema";
-import { omit } from "lodash-es";
 import { forwardRef, memo, useEffect, useImperativeHandle } from "react";
 import { type FieldArrayWithId, type UseFormReturn, useFieldArray, useForm } from "react-hook-form";
 import { TbGripVertical, TbSettings, TbTrash } from "react-icons/tb";
@@ -317,7 +317,6 @@ function EntityField({
    const name = watch(`fields.${index}.name`);
    const { active, toggle } = useRoutePathState(routePattern ?? "", name);
    const fieldSpec = fieldSpecs.find((s) => s.type === type)!;
-   const specificData = omit(field.field.config, commonProps);
    const disabled = fieldSpec.disabled || [];
    const hidden = fieldSpec.hidden || [];
    const dragDisabled = index === 0;
@@ -476,7 +475,7 @@ function EntityField({
                               field={field}
                               onChange={(value) => {
                                  setValue(`${prefix}.config`, {
-                                    ...getValues([`fields.${index}.config`])[0],
+                                    ...pickKeys(getValues([`${prefix}.config`])[0], commonProps),
                                     ...value,
                                  });
                               }}
@@ -520,7 +519,7 @@ const SpecificForm = ({
    readonly?: boolean;
 }) => {
    const type = field.field.type;
-   const specificData = omit(field.field.config, commonProps);
+   const specificData = omitKeys(field.field.config ?? {}, commonProps);
 
    return (
       <JsonSchemaForm

app/src/ui/routes/index.tsx

@@ -11,11 +11,16 @@ import SettingsRoutes from "./settings";
 import { FlashMessage } from "ui/modules/server/FlashMessage";
 import { AuthRegister } from "ui/routes/auth/auth.register";
 import { BkndModalsProvider } from "ui/modals";
-import { useBkndWindowContext } from "ui/client";
+import { useBkndWindowContext } from "bknd/client";
 import ToolsRoutes from "./tools";
 
 // @ts-ignore
-const TestRoutes = lazy(() => import("./test"));
+let TestRoutes: any;
+try {
+   if (import.meta.env.DEV) {
+      TestRoutes = lazy(() => import("./test"));
+   }
+} catch {}
 
 export function Routes({
    BkndWrapper,
@@ -43,11 +48,13 @@ export function Routes({
                      <Route path="/" nest>
                         <Root>
                            <Switch>
-                              <Route path="/test*" nest>
-                                 <Suspense fallback={null}>
-                                    <TestRoutes />
-                                 </Suspense>
-                              </Route>
+                              {TestRoutes && (
+                                 <Route path="/test*" nest>
+                                    <Suspense fallback={null}>
+                                       <TestRoutes />
+                                    </Suspense>
+                                 </Route>
+                              )}
 
                               {children}
 

app/src/ui/routes/media/media.index.tsx

@@ -1,11 +1,12 @@
 import { IconPhoto } from "@tabler/icons-react";
 import { useBknd } from "ui/client/BkndProvider";
 import { Empty } from "ui/components/display/Empty";
-import { type FileState, Media } from "ui/elements";
 import { useBrowserTitle } from "ui/hooks/use-browser-title";
 import * as AppShell from "ui/layouts/AppShell/AppShell";
 import { useLocation } from "wouter";
 import { bkndModals } from "ui/modals";
+import { DropzoneContainer } from "ui/elements/media/DropzoneContainer";
+import type { FileState } from "ui/elements/media/Dropzone";
 
 export function MediaIndex() {
    const { config } = useBknd();
@@ -35,7 +36,7 @@ export function MediaIndex() {
    return (
       <AppShell.Scrollable>
          <div className="flex flex-1 p-3">
-            <Media.Dropzone onClick={onClick} infinite query={{ sort: "-id" }} />
+            <DropzoneContainer onClick={onClick} infinite query={{ sort: "-id" }} />
          </div>
       </AppShell.Scrollable>
    );

app/src/ui/routes/root.tsx

@@ -1,6 +1,6 @@
 import { IconHome } from "@tabler/icons-react";
 import { useEffect } from "react";
-import { useAuth } from "ui/client";
+import { useAuth } from "bknd/client";
 import { useEffectOnce } from "ui/hooks/use-effect";
 import { Empty } from "../components/display/Empty";
 import { useBrowserTitle } from "../hooks/use-browser-title";

app/src/ui/routes/settings/routes/auth.settings.tsx

@@ -49,19 +49,21 @@ export const AuthSettings = ({ schema: _unsafe_copy, config }) => {
    try {
       const user_entity = config.entity_name ?? "users";
       const entities = _s.config.data.entities ?? {};
-      console.log("entities", entities, user_entity);
       const user_fields = Object.entries(entities[user_entity]?.fields ?? {})
          .map(([name, field]) => (!field.config?.virtual ? name : undefined))
          .filter(Boolean);
 
       if (user_fields.length > 0) {
-         console.log("user_fields", user_fields);
          _schema.properties.jwt.properties.fields.items.enum = user_fields;
          _schema.properties.jwt.properties.fields.uniqueItems = true;
          uiSchema.jwt.fields["ui:widget"] = "checkboxes";
       }
-   } catch (e) {}
-   console.log("_s", _s);
+
+      const roles = Object.keys(config.roles ?? {});
+      if (roles.length > 0) {
+         _schema.properties.default_role_register.enum = roles;
+      }
+   } catch (_e) {}
    const roleSchema = _schema.properties.roles?.additionalProperties ?? { type: "object" };
    /* if (_s.permissions) {
       roleSchema.properties.permissions.items.enum = _s.permissions;