rm plan doc

refactor(cli): use errore for typed error handling in run command
Replace untyped catch blocks and scattered process.exit() with errore tagged errors and error-as-values pattern. Compile-time safety for error handling paths. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-08-02 16:16:02 +00:00 · 2026-03-07 10:34:01 -06:00 · 2026-03-07 10:30:21 -06:00 · 2026-03-07 10:05:15 -06:00 · 2026-03-07 10:02:16 -06:00 · 2026-03-07 10:02:11 -06:00
176 changed files with 4861 additions and 2157 deletions
@@ -9,6 +9,21 @@ jobs:
  test:
    runs-on: ubuntu-latest
    
+    services:
+      postgres:
+        image: postgres:17
+        env:
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_USER: postgres
+          POSTGRES_DB: bknd
+        ports:
+          - 5430:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+    
    steps:
      - uses: actions/checkout@v4
      
@@ -24,7 +39,7 @@ jobs:

      - name: Install dependencies
        working-directory: ./app
-        run: bun install
+        run: bun install #--linker=hoisted

      - name: Build
        working-directory: ./app
@@ -1,110 +1,202 @@
-# Functional Source License, Version 1.1, MIT Future License

-## Abbreviation
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/

-FSL-1.1-MIT
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION

-## Notice
+1. Definitions.

-Copyright 2025 Dennis Senn
+   "License" shall mean the terms and conditions for use, reproduction,
+   and distribution as defined by Sections 1 through 9 of this document.

-## Terms and Conditions
+   "Licensor" shall mean the copyright owner or entity authorized by
+   the copyright owner that is granting the License.

-### Licensor ("We")
+   "Legal Entity" shall mean the union of the acting entity and all
+   other entities that control, are controlled by, or are under common
+   control with that entity. For the purposes of this definition,
+   "control" means (i) the power, direct or indirect, to cause the
+   direction or management of such entity, whether by contract or
+   otherwise, or (ii) ownership of fifty percent (50%) or more of the
+   outstanding shares, or (iii) beneficial ownership of such entity.

-The party offering the Software under these Terms and Conditions.
+   "You" (or "Your") shall mean an individual or Legal Entity
+   exercising permissions granted by this License.

-### The Software
+   "Source" form shall mean the preferred form for making modifications,
+   including but not limited to software source code, documentation
+   source, and configuration files.

-The "Software" is each version of the software that we make available under
-these Terms and Conditions, as indicated by our inclusion of these Terms and
-Conditions with the Software.
+   "Object" form shall mean any form resulting from mechanical
+   transformation or translation of a Source form, including but
+   not limited to compiled object code, generated documentation,
+   and conversions to other media types.

-### License Grant
+   "Work" shall mean the work of authorship, whether in Source or
+   Object form, made available under the License, as indicated by a
+   copyright notice that is included in or attached to the work
+   (an example is provided in the Appendix below).

-Subject to your compliance with this License Grant and the Patents,
-Redistribution and Trademark clauses below, we hereby grant you the right to
-use, copy, modify, create derivative works, publicly perform, publicly display
-and redistribute the Software for any Permitted Purpose identified below.
+   "Derivative Works" shall mean any work, whether in Source or Object
+   form, that is based on (or derived from) the Work and for which the
+   editorial revisions, annotations, elaborations, or other modifications
+   represent, as a whole, an original work of authorship. For the purposes
+   of this License, Derivative Works shall not include works that remain
+   separable from, or merely link (or bind by name) to the interfaces of,
+   the Work and Derivative Works thereof.

-### Permitted Purpose
+   "Contribution" shall mean any work of authorship, including
+   the original version of the Work and any modifications or additions
+   to that Work or Derivative Works thereof, that is intentionally
+   submitted to Licensor for inclusion in the Work by the copyright owner
+   or by an individual or Legal Entity authorized to submit on behalf of
+   the copyright owner. For the purposes of this definition, "submitted"
+   means any form of electronic, verbal, or written communication sent
+   to the Licensor or its representatives, including but not limited to
+   communication on electronic mailing lists, source code control systems,
+   and issue tracking systems that are managed by, or on behalf of, the
+   Licensor for the purpose of discussing and improving the Work, but
+   excluding communication that is conspicuously marked or otherwise
+   designated in writing by the copyright owner as "Not a Contribution."

-A Permitted Purpose is any purpose other than a Competing Use. A Competing Use
-means making the Software available to others in a commercial product or
-service that:
+   "Contributor" shall mean Licensor and any individual or Legal Entity
+   on behalf of whom a Contribution has been received by Licensor and
+   subsequently incorporated within the Work.

-1. substitutes for the Software;
+2. Grant of Copyright License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   copyright license to reproduce, prepare Derivative Works of,
+   publicly display, publicly perform, sublicense, and distribute the
+   Work and such Derivative Works in Source or Object form.

-2. substitutes for any other product or service we offer using the Software
-   that exists as of the date we make the Software available; or
+3. Grant of Patent License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   (except as stated in this section) patent license to make, have made,
+   use, offer to sell, sell, import, and otherwise transfer the Work,
+   where such license applies only to those patent claims licensable
+   by such Contributor that are necessarily infringed by their
+   Contribution(s) alone or by combination of their Contribution(s)
+   with the Work to which such Contribution(s) was submitted. If You
+   institute patent litigation against any entity (including a
+   cross-claim or counterclaim in a lawsuit) alleging that the Work
+   or a Contribution incorporated within the Work constitutes direct
+   or contributory patent infringement, then any patent licenses
+   granted to You under this License for that Work shall terminate
+   as of the date such litigation is filed.

-3. offers the same or substantially similar functionality as the Software.
+4. Redistribution. You may reproduce and distribute copies of the
+   Work or Derivative Works thereof in any medium, with or without
+   modifications, and in Source or Object form, provided that You
+   meet the following conditions:

-Permitted Purposes specifically include using the Software:
+   (a) You must give any other recipients of the Work or
+   Derivative Works a copy of this License; and

-1. for your internal use and access;
+   (b) You must cause any modified files to carry prominent notices
+   stating that You changed the files; and

-2. for non-commercial education;
+   (c) You must retain, in the Source form of any Derivative Works
+   that You distribute, all copyright, patent, trademark, and
+   attribution notices from the Source form of the Work,
+   excluding those notices that do not pertain to any part of
+   the Derivative Works; and

-3. for non-commercial research; and
+   (d) If the Work includes a "NOTICE" text file as part of its
+   distribution, then any Derivative Works that You distribute must
+   include a readable copy of the attribution notices contained
+   within such NOTICE file, excluding those notices that do not
+   pertain to any part of the Derivative Works, in at least one
+   of the following places: within a NOTICE text file distributed
+   as part of the Derivative Works; within the Source form or
+   documentation, if provided along with the Derivative Works; or,
+   within a display generated by the Derivative Works, if and
+   wherever such third-party notices normally appear. The contents
+   of the NOTICE file are for informational purposes only and
+   do not modify the License. You may add Your own attribution
+   notices within Derivative Works that You distribute, alongside
+   or as an addendum to the NOTICE text from the Work, provided
+   that such additional attribution notices cannot be construed
+   as modifying the License.

-4. in connection with professional services that you provide to a licensee
-   using the Software in accordance with these Terms and Conditions.
+   You may add Your own copyright statement to Your modifications and
+   may provide additional or different license terms and conditions
+   for use, reproduction, or distribution of Your modifications, or
+   for any such Derivative Works as a whole, provided Your use,
+   reproduction, and distribution of the Work otherwise complies with
+   the conditions stated in this License.

-### Patents
+5. Submission of Contributions. Unless You explicitly state otherwise,
+   any Contribution intentionally submitted for inclusion in the Work
+   by You to the Licensor shall be under the terms and conditions of
+   this License, without any additional terms or conditions.
+   Notwithstanding the above, nothing herein shall supersede or modify
+   the terms of any separate license agreement you may have executed
+   with Licensor regarding such Contributions.

-To the extent your use for a Permitted Purpose would necessarily infringe our
-patents, the license grant above includes a license under our patents. If you
-make a claim against any party that the Software infringes or contributes to
-the infringement of any patent, then your patent license to the Software ends
-immediately.
+6. Trademarks. This License does not grant permission to use the trade
+   names, trademarks, service marks, or product names of the Licensor,
+   except as required for reasonable and customary use in describing the
+   origin of the Work and reproducing the content of the NOTICE file.

-### Redistribution
+7. Disclaimer of Warranty. Unless required by applicable law or
+   agreed to in writing, Licensor provides the Work (and each
+   Contributor provides its Contributions) on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+   implied, including, without limitation, any warranties or conditions
+   of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+   PARTICULAR PURPOSE. You are solely responsible for determining the
+   appropriateness of using or redistributing the Work and assume any
+   risks associated with Your exercise of permissions under this License.

-The Terms and Conditions apply to all copies, modifications and derivatives of
-the Software.
+8. Limitation of Liability. In no event and under no legal theory,
+   whether in tort (including negligence), contract, or otherwise,
+   unless required by applicable law (such as deliberate and grossly
+   negligent acts) or agreed to in writing, shall any Contributor be
+   liable to You for damages, including any direct, indirect, special,
+   incidental, or consequential damages of any character arising as a
+   result of this License or out of the use or inability to use the
+   Work (including but not limited to damages for loss of goodwill,
+   work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses), even if such Contributor
+   has been advised of the possibility of such damages.

-If you redistribute any copies, modifications or derivatives of the Software,
-you must include a copy of or a link to these Terms and Conditions and not
-remove any copyright notices provided in or with the Software.
+9. Accepting Warranty or Additional Liability. While redistributing
+   the Work or Derivative Works thereof, You may choose to offer,
+   and charge a fee for, acceptance of support, warranty, indemnity,
+   or other liability obligations and/or rights consistent with this
+   License. However, in accepting such obligations, You may act only
+   on Your own behalf and on Your sole responsibility, not on behalf
+   of any other Contributor, and only if You agree to indemnify,
+   defend, and hold each Contributor harmless for any liability
+   incurred by, or claims asserted against, such Contributor by reason
+   of your accepting any such warranty or additional liability.

-### Disclaimer
+END OF TERMS AND CONDITIONS

-THE SOFTWARE IS PROVIDED "AS IS" AND WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF FITNESS FOR A PARTICULAR
-PURPOSE, MERCHANTABILITY, TITLE OR NON-INFRINGEMENT.
+APPENDIX: How to apply the Apache License to your work.

-IN NO EVENT WILL WE HAVE ANY LIABILITY TO YOU ARISING OUT OF OR RELATED TO THE
-SOFTWARE, INCLUDING INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES,
-EVEN IF WE HAVE BEEN INFORMED OF THEIR POSSIBILITY IN ADVANCE.
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.

-### Trademarks
+Copyright 2026 Dennis Senn

-Except for displaying the License Details and identifying us as the origin of
-the Software, you have no right under these Terms and Conditions to use our
-trademarks, trade names, service marks or product names.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at

-## Grant of Future License
+       http://www.apache.org/licenses/LICENSE-2.0

-We hereby irrevocably grant you an additional license to use the Software under
-the MIT license that is effective on the second anniversary of the date we make
-the Software available. On or after that date, you may use the Software under
-the MIT license, in which case the following will apply:
-
-Permission is hereby granted, free of charge, to any person obtaining a copy of
-this software and associated documentation files (the "Software"), to deal in
-the Software without restriction, including without limitation the rights to
-use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
-of the Software, and to permit persons to whom the Software is furnished to do
-so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
@@ -17,7 +17,7 @@ It's designed to avoid vendor lock-in and architectural limitations. Built exclu
  * SQLite: LibSQL, Node SQLite, Bun SQLite, Cloudflare D1, Cloudflare Durable Objects SQLite, SQLocal
  * Postgres: Vanilla Postgres, Supabase, Neon, Xata
 * **Frameworks**: React, Next.js, React Router, Astro, Vite, Waku
-* **Storage**: AWS S3, S3-compatible (Tigris, R2, Minio, etc.), Cloudflare R2 (binding), Cloudinary, Filesystem
+* **Storage**: AWS S3, S3-compatible (Tigris, R2, Minio, etc.), Cloudflare R2 (binding), Cloudinary, Filesystem, Origin Private File System (OPFS)
 * **Deployment**: Standalone, Docker, Cloudflare Workers, Vercel, Netlify, Deno Deploy, AWS Lambda, Valtown etc.

 **For documentation and examples, please visit https://docs.bknd.io.**
@@ -1,66 +1,76 @@
 import { expect, describe, it, beforeAll, afterAll, mock } from "bun:test";
 import * as adapter from "adapter";
-import { disableConsoleLog, enableConsoleLog } from "core/utils";
+import { disableConsoleLog, enableConsoleLog, omitKeys } from "core/utils";
 import { adapterTestSuite } from "adapter/adapter-test-suite";
 import { bunTestRunner } from "adapter/bun/test";
-import { omitKeys } from "core/utils";
+
+const stripConnection = <T extends Record<string, any>>(cfg: T) =>
+  omitKeys(cfg, ["connection"]);

 beforeAll(disableConsoleLog);
 afterAll(enableConsoleLog);

 describe("adapter", () => {
-   it("makes config", async () => {
-      expect(omitKeys(await adapter.makeConfig({}), ["connection"])).toEqual({});
-      expect(
-         omitKeys(await adapter.makeConfig({}, { env: { TEST: "test" } }), ["connection"]),
-      ).toEqual({});
+  describe("makeConfig", () => {
+    it("returns empty config for empty inputs", async () => {
+      const cases: Array<Parameters<typeof adapter.makeConfig>> = [
+        [{}],
+        [{}, { env: { TEST: "test" } }],
+      ];

-      // merges everything returned from `app` with the config
-      expect(
-         omitKeys(
-            await adapter.makeConfig(
-               { app: (a) => ({ config: { server: { cors: { origin: a.env.TEST } } } }) },
-               { env: { TEST: "test" } },
-            ),
-            ["connection"],
-         ),
-      ).toEqual({
-         config: { server: { cors: { origin: "test" } } },
-      });
-   });
+      for (const args of cases) {
+        const cfg = await adapter.makeConfig(...(args as any));
+        expect(stripConnection(cfg)).toEqual({});
+      }
+    });

-   it("allows all properties in app function", async () => {
-      const called = mock(() => null);
-      const config = await adapter.makeConfig(
-         {
-            app: (env) => ({
-               connection: { url: "test" },
-               config: { server: { cors: { origin: "test" } } },
-               options: {
-                  mode: "db",
-               },
-               onBuilt: () => {
-                  called();
-                  expect(env).toEqual({ foo: "bar" });
-               },
-            }),
-         },
-         { foo: "bar" },
+    it("merges app output into config", async () => {
+      const cfg = await adapter.makeConfig(
+        { app: (a) => ({ config: { server: { cors: { origin: a.env.TEST } } } }) },
+        { env: { TEST: "test" } },
      );
-      expect(config.connection).toEqual({ url: "test" });
-      expect(config.config).toEqual({ server: { cors: { origin: "test" } } });
-      expect(config.options).toEqual({ mode: "db" });
-      await config.onBuilt?.(null as any);
-      expect(called).toHaveBeenCalled();
-   });

-   adapterTestSuite(bunTestRunner, {
+      expect(stripConnection(cfg)).toEqual({
+        config: { server: { cors: { origin: "test" } } },
+      });
+    });
+
+    it("allows all properties in app() result", async () => {
+      const called = mock(() => null);
+
+      const cfg = await adapter.makeConfig(
+        {
+          app: (env) => ({
+            connection: { url: "test" },
+            config: { server: { cors: { origin: "test" } } },
+            options: { mode: "db" as const },
+            onBuilt: () => {
+              called();
+              expect(env).toEqual({ foo: "bar" });
+            },
+          }),
+        },
+        { foo: "bar" },
+      );
+
+      expect(cfg.connection).toEqual({ url: "test" });
+      expect(cfg.config).toEqual({ server: { cors: { origin: "test" } } });
+      expect(cfg.options).toEqual({ mode: "db" });
+
+      await cfg.onBuilt?.({} as any);
+      expect(called).toHaveBeenCalledTimes(1);
+    });
+  });
+
+  describe("adapter test suites", () => {
+    adapterTestSuite(bunTestRunner, {
      makeApp: adapter.createFrameworkApp,
      label: "framework app",
-   });
+    });

-   adapterTestSuite(bunTestRunner, {
+    adapterTestSuite(bunTestRunner, {
      makeApp: adapter.createRuntimeApp,
      label: "runtime app",
-   });
+    });
+  });
 });
@@ -1,7 +1,7 @@
 /// <reference types="@types/bun" />
-import { describe, expect, it } from "bun:test";
+import { describe, expect, it, mock } from "bun:test";
 import { Hono } from "hono";
-import { getFileFromContext, isFile, isReadableStream } from "core/utils";
+import { getFileFromContext, isFile, isReadableStream, s, jsc } from "core/utils";
 import { MediaApi } from "media/api/MediaApi";
 import { assetsPath, assetsTmpPath } from "../helper";

@@ -67,7 +67,7 @@ describe("MediaApi", () => {
      const res = await mockedBackend.request("/api/media/file/" + name);
      await Bun.write(path, res);

-      const file = await Bun.file(path);
+      const file = Bun.file(path);
      expect(file.size).toBeGreaterThan(0);
      expect(file.type).toBe("image/png");
      await file.delete();
@@ -98,7 +98,7 @@ describe("MediaApi", () => {
      expect(isReadableStream(res.body)).toBe(true);
      expect(isReadableStream(res.res.body)).toBe(true);

-      const blob = await res.res.blob();
+      const blob = (await res.res.blob()) as File;
      expect(isFile(blob)).toBe(true);
      expect(blob.size).toBeGreaterThan(0);
      expect(blob.type).toBe("image/png");
@@ -113,7 +113,7 @@ describe("MediaApi", () => {
      const res = await api.getFileStream(name);
      expect(isReadableStream(res)).toBe(true);

-      const blob = await new Response(res).blob();
+      const blob = (await new Response(res).blob()) as File;
      expect(isFile(blob)).toBe(true);
      expect(blob.size).toBeGreaterThan(0);
      expect(blob.type).toBe("image/png");
@@ -154,15 +154,38 @@ describe("MediaApi", () => {
      }

      // upload via readable from bun
-      await matches(await api.upload(file.stream(), { filename: "readable.png" }), "readable.png");
+      await matches(api.upload(file.stream(), { filename: "readable.png" }), "readable.png");

      // upload via readable from response
      {
         const response = (await mockedBackend.request(url)) as Response;
-         await matches(
-            await api.upload(response.body!, { filename: "readable.png" }),
-            "readable.png",
-         );
+         await matches(api.upload(response.body!, { filename: "readable.png" }), "readable.png");
      }
   });
+
+   it("should add overwrite query for entity upload", async (c) => {
+      const call = mock(() => null);
+      const hono = new Hono().post(
+         "/api/media/entity/:entity/:id/:field",
+         jsc("query", s.object({ overwrite: s.boolean().optional() })),
+         async (c) => {
+            const { overwrite } = c.req.valid("query");
+            expect(overwrite).toBe(true);
+            call();
+            return c.json({ ok: true });
+         },
+      );
+      const api = new MediaApi(
+         {
+            upload_fetcher: hono.request,
+         },
+         hono.request,
+      );
+      const file = Bun.file(`${assetsPath}/image.png`);
+      const res = await api.uploadToEntity("posts", 1, "cover", file as any, {
+         overwrite: true,
+      });
+      expect(res.ok).toBe(true);
+      expect(call).toHaveBeenCalled();
+   });
 });
@@ -1,8 +1,12 @@
-import { describe, expect, mock, test } from "bun:test";
+import { describe, expect, mock, test, beforeAll, afterAll } from "bun:test";
 import { createApp as internalCreateApp, type CreateAppConfig } from "bknd";
 import { getDummyConnection } from "../../__test__/helper";
 import { ModuleManager } from "modules/ModuleManager";
 import { em, entity, text } from "data/prototype";
+import { disableConsoleLog, enableConsoleLog } from "core/utils/test";
+
+beforeAll(disableConsoleLog);
+afterAll(enableConsoleLog);

 async function createApp(config: CreateAppConfig = {}) {
   const app = internalCreateApp({
@@ -1,7 +1,11 @@
 import { AppEvents } from "App";
-import { describe, test, expect, beforeAll, mock } from "bun:test";
+import { describe, test, expect, beforeAll, mock, afterAll } from "bun:test";
 import { type App, createApp, createMcpToolCaller } from "core/test/utils";
 import type { McpServer } from "bknd/utils";
+import { disableConsoleLog, enableConsoleLog } from "core/utils/test";
+
+beforeAll(disableConsoleLog);
+afterAll(enableConsoleLog);

 /**
 * - [x] system_config
@@ -1,8 +1,12 @@
-import { describe, expect, test } from "bun:test";
+import { describe, expect, test, beforeAll, afterAll } from "bun:test";
 import { Guard, type GuardConfig } from "auth/authorize/Guard";
 import { Permission } from "auth/authorize/Permission";
 import { Role, type RoleSchema } from "auth/authorize/Role";
 import { objectTransform, s } from "bknd/utils";
+import { disableConsoleLog, enableConsoleLog } from "core/utils/test";
+
+beforeAll(disableConsoleLog);
+afterAll(enableConsoleLog);

 function createGuard(
   permissionNames: string[],
@@ -7,8 +7,8 @@ import type { App, DB } from "bknd";
 import type { CreateUserPayload } from "auth/AppAuth";
 import { disableConsoleLog, enableConsoleLog } from "core/utils/test";

-beforeAll(() => disableConsoleLog());
-afterAll(() => enableConsoleLog());
+beforeAll(disableConsoleLog);
+afterAll(enableConsoleLog);

 async function makeApp(config: Partial<CreateAppConfig["config"]> = {}) {
   const app = createApp({
@@ -0,0 +1,40 @@
+import { describe, test, expect, beforeAll, afterAll } from "bun:test";
+import { createAuthTestApp } from "./shared";
+import { disableConsoleLog, enableConsoleLog } from "core/utils/test";
+import { em, entity, text } from "data/prototype";
+
+beforeAll(disableConsoleLog);
+afterAll(enableConsoleLog);
+
+const schema = em(
+   {
+      posts: entity("posts", {
+         title: text(),
+         content: text(),
+      }),
+      comments: entity("comments", {
+         content: text(),
+      }),
+   },
+   ({ relation }, { posts, comments }) => {
+      relation(posts).manyToOne(comments);
+   },
+);
+
+describe("DataController (auth)", () => {
+   test("reading schema.json", async () => {
+      const { request } = await createAuthTestApp(
+         {
+            permission: ["system.access.api", "data.entity.read", "system.schema.read"],
+            request: new Request("http://localhost/api/data/schema.json"),
+         },
+         {
+            config: { data: schema.toJSON() },
+         },
+      );
+      expect((await request.guest()).status).toBe(403);
+      expect((await request.member()).status).toBe(403);
+      expect((await request.authorized()).status).toBe(200);
+      expect((await request.admin()).status).toBe(200);
+   });
+});
@@ -1,20 +0,0 @@
-import { describe, it, expect } from "bun:test";
-import { SystemController } from "modules/server/SystemController";
-import { createApp } from "core/test/utils";
-import type { CreateAppConfig } from "App";
-import { getPermissionRoutes } from "auth/middlewares/permission.middleware";
-
-async function makeApp(config: Partial<CreateAppConfig> = {}) {
-   const app = createApp(config);
-   await app.build();
-   return app;
-}
-
-describe.skip("SystemController", () => {
-   it("...", async () => {
-      const app = await makeApp();
-      const controller = new SystemController(app);
-      const hono = controller.getController();
-      console.log(getPermissionRoutes(hono));
-   });
-});
@@ -0,0 +1,41 @@
+import { describe, test, expect, beforeAll, afterAll } from "bun:test";
+import { createAuthTestApp } from "./shared";
+import { disableConsoleLog, enableConsoleLog } from "core/utils/test";
+
+beforeAll(disableConsoleLog);
+afterAll(enableConsoleLog);
+
+describe("SystemController (auth)", () => {
+   test("reading info", async () => {
+      const { request } = await createAuthTestApp({
+         permission: ["system.access.api", "system.info"],
+         request: new Request("http://localhost/api/system/info"),
+      });
+      expect((await request.guest()).status).toBe(403);
+      expect((await request.member()).status).toBe(403);
+      expect((await request.authorized()).status).toBe(200);
+      expect((await request.admin()).status).toBe(200);
+   });
+
+   test("reading permissions", async () => {
+      const { request } = await createAuthTestApp({
+         permission: ["system.access.api", "system.schema.read"],
+         request: new Request("http://localhost/api/system/permissions"),
+      });
+      expect((await request.guest()).status).toBe(403);
+      expect((await request.member()).status).toBe(403);
+      expect((await request.authorized()).status).toBe(200);
+      expect((await request.admin()).status).toBe(200);
+   });
+
+   test("access openapi", async () => {
+      const { request } = await createAuthTestApp({
+         permission: ["system.access.api", "system.openapi"],
+         request: new Request("http://localhost/api/system/openapi.json"),
+      });
+      expect((await request.guest()).status).toBe(403);
+      expect((await request.member()).status).toBe(403);
+      expect((await request.authorized()).status).toBe(200);
+      expect((await request.admin()).status).toBe(200);
+   });
+});
@@ -0,0 +1,171 @@
+import { createApp } from "core/test/utils";
+import type { CreateAppConfig } from "App";
+import type { RoleSchema } from "auth/authorize/Role";
+import { isPlainObject } from "core/utils";
+
+export type AuthTestConfig = {
+   guest?: RoleSchema;
+   member?: RoleSchema;
+   authorized?: RoleSchema;
+};
+
+export async function createAuthTestApp(
+   testConfig: {
+      permission: AuthTestConfig | string | string[];
+      request: Request;
+   },
+   config: Partial<CreateAppConfig> = {},
+) {
+   let member: RoleSchema | undefined;
+   let authorized: RoleSchema | undefined;
+   let guest: RoleSchema | undefined;
+   if (isPlainObject(testConfig.permission)) {
+      if (testConfig.permission.guest)
+         guest = {
+            ...testConfig.permission.guest,
+            is_default: true,
+         };
+      if (testConfig.permission.member) member = testConfig.permission.member;
+      if (testConfig.permission.authorized) authorized = testConfig.permission.authorized;
+   } else {
+      member = {
+         permissions: [],
+      };
+      authorized = {
+         permissions: Array.isArray(testConfig.permission)
+            ? testConfig.permission
+            : [testConfig.permission],
+      };
+      guest = {
+         permissions: [],
+         is_default: true,
+      };
+   }
+
+   console.log("authorized", authorized);
+
+   const app = createApp({
+      ...config,
+      config: {
+         ...config.config,
+         auth: {
+            ...config.config?.auth,
+            enabled: true,
+            guard: {
+               enabled: true,
+               ...config.config?.auth?.guard,
+            },
+            jwt: {
+               ...config.config?.auth?.jwt,
+               secret: "secret",
+            },
+            roles: {
+               ...config.config?.auth?.roles,
+               guest,
+               member,
+               authorized,
+               admin: {
+                  implicit_allow: true,
+               },
+            },
+         },
+      },
+   });
+   await app.build();
+
+   const users = {
+      guest: null,
+      member: await app.createUser({
+         email: "member@test.com",
+         password: "12345678",
+         role: "member",
+      }),
+      authorized: await app.createUser({
+         email: "authorized@test.com",
+         password: "12345678",
+         role: "authorized",
+      }),
+      admin: await app.createUser({
+         email: "admin@test.com",
+         password: "12345678",
+         role: "admin",
+      }),
+   } as const;
+
+   const tokens = {} as Record<keyof typeof users, string>;
+   for (const [key, user] of Object.entries(users)) {
+      if (user) {
+         tokens[key as keyof typeof users] = await app.module.auth.authenticator.jwt(user);
+      }
+   }
+
+   async function makeRequest(user: keyof typeof users, input: string, init: RequestInit = {}) {
+      const headers = new Headers(init.headers ?? {});
+      if (user in tokens) {
+         headers.set("Authorization", `Bearer ${tokens[user as keyof typeof tokens]}`);
+      }
+      const res = await app.server.request(input, {
+         ...init,
+         headers,
+      });
+
+      let data: any;
+      if (res.headers.get("Content-Type")?.startsWith("application/json")) {
+         data = await res.json();
+      } else if (res.headers.get("Content-Type")?.startsWith("text/")) {
+         data = await res.text();
+      }
+
+      return {
+         status: res.status,
+         ok: res.ok,
+         headers: Object.fromEntries(res.headers.entries()),
+         data,
+      };
+   }
+
+   const requestFn = new Proxy(
+      {},
+      {
+         get(_, prop: keyof typeof users) {
+            return async (input: string, init: RequestInit = {}) => {
+               return makeRequest(prop, input, init);
+            };
+         },
+      },
+   ) as {
+      [K in keyof typeof users]: (
+         input: string,
+         init?: RequestInit,
+      ) => Promise<{
+         status: number;
+         ok: boolean;
+         headers: Record<string, string>;
+         data: any;
+      }>;
+   };
+
+   const request = new Proxy(
+      {},
+      {
+         get(_, prop: keyof typeof users) {
+            return async () => {
+               return makeRequest(prop, testConfig.request.url, {
+                  headers: testConfig.request.headers,
+                  method: testConfig.request.method,
+                  body: testConfig.request.body,
+               });
+            };
+         },
+      },
+   ) as {
+      [K in keyof typeof users]: () => Promise<{
+         status: number;
+         ok: boolean;
+         headers: Record<string, string>;
+         data: any;
+      }>;
+   };
+
+   return { app, users, request, requestFn };
+}
@@ -0,0 +1,13 @@
+import { PasswordStrategy } from "auth/authenticate/strategies/PasswordStrategy";
+import { describe, expect, it } from "bun:test";
+
+describe("PasswordStrategy", () => {
+   it("should enforce provided minimum length", async () => {
+      const strategy = new PasswordStrategy({ minLength: 8, hashing: "plain" });
+
+      expect(strategy.verify("password")({} as any)).rejects.toThrow();
+      expect(
+         strategy.verify("password1234")({ strategy_value: "password1234" } as any),
+      ).resolves.toBeUndefined();
+   });
+});
@@ -0,0 +1,85 @@
+import { describe, beforeAll, afterAll, test } from "bun:test";
+import type { PostgresConnection } from "data/connection/postgres/PostgresConnection";
+import { pg, postgresJs } from "bknd";
+import { Pool } from "pg";
+import postgres from "postgres";
+import { disableConsoleLog, enableConsoleLog, $waitUntil } from "bknd/utils";
+import { $ } from "bun";
+import { connectionTestSuite } from "data/connection/connection-test-suite";
+import { bunTestRunner } from "adapter/bun/test";
+
+const credentials = {
+   host: "localhost",
+   port: 5430,
+   user: "postgres",
+   password: "postgres",
+   database: "bknd",
+};
+
+async function cleanDatabase(connection: InstanceType<typeof PostgresConnection>) {
+   const kysely = connection.kysely;
+
+   // drop all tables+indexes & create new schema
+   await kysely.schema.dropSchema("public").ifExists().cascade().execute();
+   await kysely.schema.dropIndex("public").ifExists().cascade().execute();
+   await kysely.schema.createSchema("public").execute();
+}
+
+async function isPostgresRunning() {
+   try {
+      // Try to actually connect to PostgreSQL
+      const conn = pg({ pool: new Pool(credentials) });
+      await conn.ping();
+      await conn.close();
+      return true;
+   } catch (e) {
+      return false;
+   }
+}
+
+describe("postgres", () => {
+   beforeAll(async () => {
+      if (!(await isPostgresRunning())) {
+         await $`docker run --rm --name bknd-test-postgres -d -e POSTGRES_PASSWORD=${credentials.password} -e POSTGRES_USER=${credentials.user} -e POSTGRES_DB=${credentials.database} -p ${credentials.port}:5432 postgres:17`;
+         await $waitUntil("Postgres is running", isPostgresRunning);
+         await new Promise((resolve) => setTimeout(resolve, 500));
+      }
+
+      disableConsoleLog();
+   });
+   afterAll(async () => {
+      if (await isPostgresRunning()) {
+         try {
+            await $`docker stop bknd-test-postgres`;
+         } catch (e) {}
+      }
+
+      enableConsoleLog();
+   });
+
+   describe.serial.each([
+      ["pg", () => pg({ pool: new Pool(credentials) })],
+      ["postgresjs", () => postgresJs({ postgres: postgres(credentials) })],
+   ])("%s", (name, createConnection) => {
+      connectionTestSuite(
+         {
+            ...bunTestRunner,
+            test: test.serial,
+         },
+         {
+            makeConnection: () => {
+               const connection = createConnection();
+               return {
+                  connection,
+                  dispose: async () => {
+                     await cleanDatabase(connection);
+                     await connection.close();
+                  },
+               };
+            },
+            rawDialectDetails: [],
+            disableConsoleLog: false,
+         },
+      );
+   });
+});
@@ -124,6 +124,81 @@ describe("[Repository]", async () => {
            .then((r) => [r.count, r.total]),
      ).resolves.toEqual([undefined, undefined]);
   });
+
+   test("auto join", async () => {
+      const schema = $em(
+         {
+            posts: $entity("posts", {
+               title: $text(),
+               content: $text(),
+            }),
+            comments: $entity("comments", {
+               content: $text(),
+            }),
+            another: $entity("another", {
+               title: $text(),
+            }),
+         },
+         ({ relation }, { posts, comments }) => {
+            relation(comments).manyToOne(posts);
+         },
+      );
+      const em = schema.proto.withConnection(getDummyConnection().dummyConnection);
+      await em.schema().sync({ force: true });
+
+      await em.mutator("posts").insertOne({ title: "post1", content: "content1" });
+      await em
+         .mutator("comments")
+         .insertMany([{ content: "comment1", posts_id: 1 }, { content: "comment2" }] as any);
+
+      const res = await em.repo("comments").findMany({
+         where: {
+            "posts.title": "post1",
+         },
+      });
+      expect(res.data as any).toEqual([
+         {
+            id: 1,
+            content: "comment1",
+            posts_id: 1,
+         },
+      ]);
+
+      {
+         // manual join should still work
+         const res = await em.repo("comments").findMany({
+            join: ["posts"],
+            where: {
+               "posts.title": "post1",
+            },
+         });
+         expect(res.data as any).toEqual([
+            {
+               id: 1,
+               content: "comment1",
+               posts_id: 1,
+            },
+         ]);
+      }
+
+      // inexistent should be detected and thrown
+      expect(
+         em.repo("comments").findMany({
+            where: {
+               "random.title": "post1",
+            },
+         }),
+      ).rejects.toThrow(/Invalid where field/);
+
+      // existing alias, but not a relation should throw
+      expect(
+         em.repo("comments").findMany({
+            where: {
+               "another.title": "post1",
+            },
+         }),
+      ).rejects.toThrow(/Invalid where field/);
+   });
 });

 describe("[data] Repository (Events)", async () => {
@@ -59,7 +59,7 @@ describe("SqliteIntrospector", () => {
                  dataType: "INTEGER",
                  isNullable: false,
                  isAutoIncrementing: true,
-                  hasDefaultValue: false,
+                  hasDefaultValue: true,
                  comment: undefined,
               },
               {
@@ -89,7 +89,7 @@ describe("SqliteIntrospector", () => {
                  dataType: "INTEGER",
                  isNullable: false,
                  isAutoIncrementing: true,
-                  hasDefaultValue: false,
+                  hasDefaultValue: true,
                  comment: undefined,
               },
               {
@@ -1,9 +1,15 @@
 import { afterAll, beforeAll, describe, expect, it } from "bun:test";
 import { App, createApp, type AuthResponse } from "../../src";
 import { auth } from "../../src/modules/middlewares";
-import { randomString, secureRandomString, withDisabledConsole } from "../../src/core/utils";
+import {
+   mergeObject,
+   randomString,
+   secureRandomString,
+   withDisabledConsole,
+} from "../../src/core/utils";
 import { disableConsoleLog, enableConsoleLog } from "core/utils/test";
 import { getDummyConnection } from "../helper";
+import type { AppAuthSchema } from "auth/auth-schema";

 beforeAll(disableConsoleLog);
 afterAll(enableConsoleLog);
@@ -62,12 +68,12 @@ const configs = {
   },
 };

-function createAuthApp() {
+function createAuthApp(config?: Partial<AppAuthSchema>) {
   const { dummyConnection } = getDummyConnection();
   const app = createApp({
      connection: dummyConnection,
      config: {
-         auth: configs.auth,
+         auth: mergeObject(configs.auth, config ?? {}),
      },
   });

@@ -132,6 +138,16 @@ const fns = <Mode extends "cookie" | "token" = "token">(app: App, mode?: Mode) =

         return { res, data };
      },
+      register: async (user: any): Promise<{ res: Response; data: AuthResponse }> => {
+         const res = (await app.server.request("/api/auth/password/register", {
+            method: "POST",
+            headers: headers(),
+            body: body(user),
+         })) as Response;
+         const data = mode === "cookie" ? getCookie(res, "auth") : await res.json();
+
+         return { res, data };
+      },
      me: async (token?: string): Promise<Pick<AuthResponse, "user">> => {
         const res = (await app.server.request("/api/auth/me", {
            method: "GET",
@@ -245,4 +261,61 @@ describe("integration auth", () => {
         expect(await $fns.me()).toEqual({ user: null as any });
      }
   });
+
+   it("should register users with default role", async () => {
+      const app = createAuthApp({ default_role_register: "guest" });
+      await app.build();
+      const $fns = fns(app);
+
+      // takes default role
+      expect(
+         await app
+            .createUser({
+               email: "test@bknd.io",
+               password: "12345678",
+            })
+            .then((r) => r.role),
+      ).toBe("guest");
+
+      // throws error if role doesn't exist
+      expect(
+         app.createUser({
+            email: "test@bknd.io",
+            password: "12345678",
+            role: "doesnt exist",
+         }),
+      ).rejects.toThrow();
+
+      // takes role if provided
+      expect(
+         await app
+            .createUser({
+               email: "test2@bknd.io",
+               password: "12345678",
+               role: "admin",
+            })
+            .then((r) => r.role),
+      ).toBe("admin");
+
+      // registering with role is not allowed
+      expect(
+         await $fns
+            .register({
+               email: "test3@bknd.io",
+               password: "12345678",
+               role: "admin",
+            })
+            .then((r) => r.res.ok),
+      ).toBe(false);
+
+      // takes default role
+      expect(
+         await $fns
+            .register({
+               email: "test3@bknd.io",
+               password: "12345678",
+            })
+            .then((r) => r.data.user.role),
+      ).toBe("guest");
+   });
 });
@@ -8,9 +8,10 @@ import type { TAppMediaConfig } from "../../src/media/media-schema";
 import { StorageLocalAdapter } from "adapter/node/storage/StorageLocalAdapter";
 import { assetsPath, assetsTmpPath } from "../helper";
 import { disableConsoleLog, enableConsoleLog } from "core/utils/test";
+import * as proto from "data/prototype";

 beforeAll(() => {
-   //disableConsoleLog();
+   disableConsoleLog();
   registries.media.register("local", StorageLocalAdapter);
 });
 afterAll(enableConsoleLog);
@@ -128,4 +129,87 @@ describe("MediaController", () => {
      expect(destFile.exists()).resolves.toBe(true);
      await destFile.delete();
   });
+
+   test("entity upload with max_items and overwrite", async () => {
+      const app = createApp({
+         config: {
+            media: mergeObject(
+               {
+                  enabled: true,
+                  adapter: {
+                     type: "local",
+                     config: {
+                        path: assetsTmpPath,
+                     },
+                  },
+               },
+               {},
+            ),
+            data: {
+               entities: {
+                  posts: proto
+                     .entity("posts", {
+                        title: proto.text(),
+                        cover: proto.medium(),
+                     })
+                     .toJSON(),
+               },
+            },
+         },
+      });
+      await app.build();
+
+      // create a post first
+      const createRes = await app.server.request("/api/data/entity/posts", {
+         method: "POST",
+         headers: { "Content-Type": "application/json" },
+         body: JSON.stringify({ title: "Test Post" }),
+      });
+      expect(createRes.status).toBe(201);
+      const { data: post } = (await createRes.json()) as any;
+
+      const file = Bun.file(path);
+      const uploadedFiles: string[] = [];
+
+      // upload first file to entity (should succeed)
+      const res1 = await app.server.request(`/api/media/entity/posts/${post.id}/cover`, {
+         method: "POST",
+         body: file,
+      });
+      expect(res1.status).toBe(201);
+      const result1 = (await res1.json()) as any;
+      uploadedFiles.push(result1.name);
+
+      // upload second file without overwrite (should fail - max_items reached)
+      const res2 = await app.server.request(`/api/media/entity/posts/${post.id}/cover`, {
+         method: "POST",
+         body: file,
+      });
+      expect(res2.status).toBe(400);
+      const result2 = (await res2.json()) as any;
+      expect(result2.error).toContain("Max items");
+
+      // upload third file with overwrite=true (should succeed and delete old file)
+      const res3 = await app.server.request(
+         `/api/media/entity/posts/${post.id}/cover?overwrite=true`,
+         {
+            method: "POST",
+            body: file,
+         },
+      );
+      expect(res3.status).toBe(201);
+      const result3 = (await res3.json()) as any;
+      uploadedFiles.push(result3.name);
+
+      // verify old file was deleted from storage
+      const oldFile = Bun.file(assetsTmpPath + "/" + uploadedFiles[0]);
+      expect(await oldFile.exists()).toBe(false);
+
+      // verify new file exists
+      const newFile = Bun.file(assetsTmpPath + "/" + uploadedFiles[1]);
+      expect(await newFile.exists()).toBe(true);
+
+      // cleanup
+      await newFile.delete();
+   });
 });
@@ -10,12 +10,6 @@ beforeAll(disableConsoleLog);
 afterAll(enableConsoleLog);

 describe("AppAuth", () => {
-   test.skip("...", () => {
-      const auth = new AppAuth({});
-      console.log(auth.toJSON());
-      console.log(auth.config);
-   });
-
   moduleTestSuite(AppAuth);

   let ctx: ModuleBuildContext;
@@ -39,11 +33,9 @@ describe("AppAuth", () => {
      await auth.build();

      const oldConfig = auth.toJSON(true);
-      //console.log(oldConfig);
      await auth.schema().patch("enabled", true);
      await auth.build();
      const newConfig = auth.toJSON(true);
-      //console.log(newConfig);
      expect(newConfig.jwt.secret).not.toBe(oldConfig.jwt.secret);
   });

@@ -69,7 +61,6 @@ describe("AppAuth", () => {
      const app = new AuthController(auth).getController();

      {
-         disableConsoleLog();
         const res = await app.request("/password/register", {
            method: "POST",
            headers: {
@@ -80,7 +71,6 @@ describe("AppAuth", () => {
               password: "12345678",
            }),
         });
-         enableConsoleLog();
         expect(res.status).toBe(200);

         const { data: users } = await ctx.em.repository("users").findMany();
@@ -119,7 +109,6 @@ describe("AppAuth", () => {
      const app = new AuthController(auth).getController();

      {
-         disableConsoleLog();
         const res = await app.request("/password/register", {
            method: "POST",
            headers: {
@@ -130,7 +119,6 @@ describe("AppAuth", () => {
               password: "12345678",
            }),
         });
-         enableConsoleLog();
         expect(res.status).toBe(200);

         const { data: users } = await ctx.em.repository("users").findMany();
@@ -235,4 +223,32 @@ describe("AppAuth", () => {
         }
      }
   });
+
+   test("default role for registration must be a valid role", async () => {
+      const app = createApp({
+         config: {
+            auth: {
+               enabled: true,
+               jwt: {
+                  secret: "123456",
+               },
+               allow_register: true,
+               roles: {
+                  guest: {
+                     is_default: true,
+                  },
+               },
+            },
+         },
+      });
+
+      await app.build();
+
+      const auth = app.module.auth;
+      // doesn't allow invalid role
+      expect(auth.schema().patch("default_role_register", "admin")).rejects.toThrow();
+      // allows valid role
+      await auth.schema().patch("default_role_register", "guest");
+      expect(auth.toJSON().default_role_register).toBe("guest");
+   });
 });
@@ -1,10 +1,14 @@
-import { describe, expect, test } from "bun:test";
+import { describe, expect, test, beforeAll, afterAll } from "bun:test";
 import { createApp } from "core/test/utils";
 import { em, entity, text } from "data/prototype";
 import { registries } from "modules/registries";
 import { StorageLocalAdapter } from "adapter/node/storage/StorageLocalAdapter";
 import { AppMedia } from "../../src/media/AppMedia";
 import { moduleTestSuite } from "./module-test-suite";
+import { disableConsoleLog, enableConsoleLog } from "core/utils/test";
+
+beforeAll(disableConsoleLog);
+afterAll(enableConsoleLog);

 describe("AppMedia", () => {
   test.skip("...", () => {
@@ -1,7 +1,11 @@
-import { it, expect, describe } from "bun:test";
+import { it, expect, describe, beforeAll, afterAll } from "bun:test";
 import { DbModuleManager } from "modules/db/DbModuleManager";
 import { getDummyConnection } from "../helper";
 import { TABLE_NAME } from "modules/db/migrations";
+import { disableConsoleLog, enableConsoleLog } from "core/utils/test";
+
+beforeAll(disableConsoleLog);
+afterAll(enableConsoleLog);

 describe("DbModuleManager", () => {
   it("should extract secrets", async () => {
@@ -11,7 +11,7 @@ import { s, stripMark } from "core/utils/schema";
 import { Connection } from "data/connection/Connection";
 import { entity, text } from "data/prototype";

-beforeAll(disableConsoleLog);
+beforeAll(() => disableConsoleLog());
 afterAll(enableConsoleLog);

 describe("ModuleManager", async () => {
@@ -82,7 +82,6 @@ describe("ModuleManager", async () => {
            },
         },
      } as any;
-      //const { version, ...json } = mm.toJSON() as any;

      const { dummyConnection } = getDummyConnection();
      const db = dummyConnection.kysely;
@@ -97,10 +96,6 @@ describe("ModuleManager", async () => {

      await mm2.build();

-      /* console.log({
-         json,
-         configs: mm2.configs(),
-      }); */
      //expect(stripMark(json)).toEqual(stripMark(mm2.configs()));
      expect(mm2.configs().data.entities?.test).toBeDefined();
      expect(mm2.configs().data.entities?.test?.fields?.content).toBeDefined();
@@ -228,8 +223,6 @@ describe("ModuleManager", async () => {
      const c = getDummyConnection();
      const mm = new ModuleManager(c.dummyConnection);
      await mm.build();
-      console.log("==".repeat(30));
-      console.log("");
      const json = mm.configs();

      const c2 = getDummyConnection();
@@ -275,7 +268,6 @@ describe("ModuleManager", async () => {
         }

         override async build() {
-            //console.log("building FailingModule", this.config);
            if (this.config.value && this.config.value < 0) {
               throw new Error("value must be positive, given: " + this.config.value);
            }
@@ -296,9 +288,6 @@ describe("ModuleManager", async () => {
         }
      }

-      beforeEach(() => disableConsoleLog(["log", "warn", "error"]));
-      afterEach(enableConsoleLog);
-
      test("it builds", async () => {
         const { dummyConnection } = getDummyConnection();
         const mm = new TestModuleManager(dummyConnection);
@@ -2,6 +2,8 @@ import { $ } from "bun";
 import * as tsup from "tsup";
 import pkg from "./package.json" with { type: "json" };
 import c from "picocolors";
+import { watch as fsWatch, readdirSync, rmSync } from "node:fs";
+import { join } from "node:path";

 const args = process.argv.slice(2);
 const watch = args.includes("--watch");
@@ -25,7 +27,18 @@ const define = {

 if (clean) {
   console.info("Cleaning dist (w/o static)");
-   await $`find dist -mindepth 1 ! -path "dist/static/*" ! -path "dist/static" -exec rm -rf {} +`;
+   // Cross-platform clean: remove all files/folders in dist except static
+   const distPath = join(import.meta.dir, "dist");
+   try {
+      const entries = readdirSync(distPath);
+      for (const entry of entries) {
+         if (entry === "static") continue;
+         const entryPath = join(distPath, entry);
+         rmSync(entryPath, { recursive: true, force: true });
+      }
+   } catch (e) {
+      // dist may not exist yet, ignore
+   }
 }

 let types_running = false;
@@ -83,7 +96,8 @@ async function buildApi() {
   await tsup.build({
      minify,
      sourcemap,
-      watch,
+      // don't use tsup's broken watch, we'll handle it ourselves
+      watch: false,
      define,
      entry: [
         "src/index.ts",
@@ -121,7 +135,7 @@ async function buildUi() {
   const base = {
      minify,
      sourcemap,
-      watch,
+      watch: false,
      define,
      external: [
         ...external,
@@ -180,12 +194,15 @@ async function buildUiElements() {
   await tsup.build({
      minify,
      sourcemap,
-      watch,
+      watch: false,
      define,
      entry: ["src/ui/elements/index.ts"],
      outDir: "dist/ui/elements",
      external: [
         "ui/client",
+         "bknd",
+         /^bknd\/.*/,
+         "wouter",
         "react",
         "react-dom",
         "react/jsx-runtime",
@@ -222,7 +239,7 @@ function baseConfig(adapter: string, overrides: Partial<tsup.Options> = {}): tsu
   return {
      minify,
      sourcemap,
-      watch,
+      watch: false,
      entry: [`src/adapter/${adapter}/index.ts`],
      format: ["esm"],
      platform: "neutral",
@@ -265,6 +282,11 @@ async function buildAdapters() {

      // specific adatpers
      tsup.build(baseConfig("react-router")),
+      tsup.build(
+         baseConfig("browser", {
+            external: [/^sqlocal\/?.*?/, "wouter"],
+         }),
+      ),
      tsup.build(
         baseConfig("bun", {
            external: [/^bun\:.*/],
@@ -297,6 +319,11 @@ async function buildAdapters() {
         platform: "node",
      }),

+      tsup.build({
+         ...baseConfig("sveltekit"),
+         platform: "node",
+      }),
+
      tsup.build({
         ...baseConfig("node"),
         platform: "node",
@@ -327,4 +354,48 @@ async function buildAdapters() {
   ]);
 }

-await Promise.all([buildApi(), buildUi(), buildUiElements(), buildAdapters()]);
+async function buildAll() {
+   await Promise.all([buildApi(), buildUi(), buildUiElements(), buildAdapters()]);
+}
+
+// initial build
+await buildAll();
+
+// custom watcher since tsup's watch is broken in 8.3.5+
+if (watch) {
+   oldConsole.log(c.cyan("[Watch]"), "watching for changes in src/...");
+
+   let debounceTimer: ReturnType<typeof setTimeout> | null = null;
+   let isBuilding = false;
+
+   const rebuild = async () => {
+      if (isBuilding) return;
+      isBuilding = true;
+      oldConsole.log(c.cyan("[Watch]"), "rebuilding...");
+      try {
+         await buildAll();
+         oldConsole.log(c.cyan("[Watch]"), c.green("done"));
+      } catch (e) {
+         oldConsole.warn(c.cyan("[Watch]"), c.red("build failed"), e);
+      }
+      isBuilding = false;
+   };
+
+   const debouncedRebuild = () => {
+      if (debounceTimer) clearTimeout(debounceTimer);
+      debounceTimer = setTimeout(rebuild, 100);
+   };
+
+   // watch src directory recursively
+   fsWatch(join(import.meta.dir, "src"), { recursive: true }, (event, filename) => {
+      if (!filename) return;
+      // ignore non-source files
+      if (!filename.endsWith(".ts") && !filename.endsWith(".tsx") && !filename.endsWith(".css"))
+         return;
+      oldConsole.log(c.cyan("[Watch]"), c.dim(`${event}: ${filename}`));
+      debouncedRebuild();
+   });
+
+   // keep process alive
+   await new Promise(() => {});
+}
@@ -3,7 +3,7 @@
  "type": "module",
  "sideEffects": false,
  "bin": "./dist/cli/index.js",
-  "version": "0.19.0",
+  "version": "0.20.0",
  "description": "Lightweight Firebase/Supabase alternative built to run anywhere — incl. Next.js, React Router, Astro, Cloudflare, Bun, Node, AWS Lambda & more.",
  "homepage": "https://bknd.io",
  "repository": {
@@ -46,7 +46,7 @@
    "test:e2e:report": "VITE_DB_URL=:memory: playwright show-report",
    "docs:build-assets": "bun internal/docs.build-assets.ts"
  },
-  "license": "FSL-1.1-MIT",
+  "license": "Apache-2.0",
  "dependencies": {
    "@cfworker/json-schema": "^4.1.1",
    "@codemirror/lang-html": "^6.4.11",
@@ -63,9 +63,9 @@
    "dayjs": "^1.11.19",
    "fast-xml-parser": "^5.3.1",
    "hono": "4.10.4",
-    "json-schema-library": "10.0.0-rc7",
+"json-schema-library": "10.0.0-rc7",
    "json-schema-to-ts": "^3.1.1",
-    "jsonv-ts": "0.9.3",
+    "jsonv-ts": "^0.10.1",
    "kysely": "0.28.8",
    "lodash-es": "^4.17.21",
    "oauth4webapi": "^2.11.1",
@@ -99,6 +99,7 @@
    "@testing-library/jest-dom": "^6.6.3",
    "@testing-library/react": "^16.2.0",
    "@types/node": "^24.10.0",
+    "@types/pg": "^8.15.6",
    "@types/react": "^19.0.10",
    "@types/react-dom": "^19.0.4",
    "@vitejs/plugin-react": "^5.1.0",
@@ -107,17 +108,21 @@
    "clsx": "^2.1.1",
    "commander": "^14.0.2",
    "dotenv": "^17.2.3",
+    "errore": "^0.14.0",
    "jotai": "^2.12.2",
    "jsdom": "^26.1.0",
    "kysely-generic-sqlite": "^1.2.1",
+    "kysely-postgres-js": "^2.0.0",
    "libsql": "^0.5.22",
    "libsql-stateless-easy": "^1.8.0",
    "miniflare": "^4.20251011.2",
    "open": "^10.2.0",
    "openapi-types": "^12.1.3",
+    "pg": "^8.16.3",
    "postcss": "^8.5.3",
    "postcss-preset-mantine": "^1.18.0",
    "postcss-simple-vars": "^7.0.1",
+    "postgres": "^3.4.7",
    "posthog-js-lite": "^3.6.0",
    "react": "^19.0.0",
    "react-dom": "^19.0.0",
@@ -125,6 +130,7 @@
    "react-icons": "5.5.0",
    "react-json-view-lite": "^2.5.0",
    "sql-formatter": "^15.6.10",
+    "sqlocal": "^0.16.0",
    "tailwind-merge": "^3.0.2",
    "tailwindcss": "^4.1.16",
    "tailwindcss-animate": "^1.0.7",
@@ -248,11 +254,21 @@
      "import": "./dist/adapter/astro/index.js",
      "require": "./dist/adapter/astro/index.js"
    },
+    "./adapter/sveltekit": {
+      "types": "./dist/types/adapter/sveltekit/index.d.ts",
+      "import": "./dist/adapter/sveltekit/index.js",
+      "require": "./dist/adapter/sveltekit/index.js"
+    },
    "./adapter/aws": {
      "types": "./dist/types/adapter/aws/index.d.ts",
      "import": "./dist/adapter/aws/index.js",
      "require": "./dist/adapter/aws/index.js"
    },
+    "./adapter/browser": {
+      "types": "./dist/types/adapter/browser/index.d.ts",
+      "import": "./dist/adapter/browser/index.js",
+      "require": "./dist/adapter/browser/index.js"
+    },
    "./dist/main.css": "./dist/ui/main.css",
    "./dist/styles.css": "./dist/ui/styles.css",
    "./dist/manifest.json": "./dist/static/.vite/manifest.json",
@@ -270,6 +286,7 @@
      "adapter/react-router": ["./dist/types/adapter/react-router/index.d.ts"],
      "adapter/bun": ["./dist/types/adapter/bun/index.d.ts"],
      "adapter/node": ["./dist/types/adapter/node/index.d.ts"],
+      "adapter/sveltekit": ["./dist/types/adapter/sveltekit/index.d.ts"],
      "adapter/sqlite": ["./dist/types/adapter/sqlite/edge.d.ts"]
    }
  },
@@ -299,6 +316,8 @@
    "remix",
    "react-router",
    "astro",
+    "sveltekit",
+    "svelte",
    "bun",
    "node"
  ]
@@ -61,7 +61,7 @@ export class Api {
   private token?: string;
   private user?: TApiUser;
   private verified = false;
-   private token_transport: "header" | "cookie" | "none" = "header";
+   public token_transport: "header" | "cookie" | "none" = "header";

   public system!: SystemApi;
   public data!: DataApi;
@@ -0,0 +1,153 @@
+import {
+   createContext,
+   lazy,
+   Suspense,
+   useContext,
+   useEffect,
+   useState,
+   type ReactNode,
+} from "react";
+import { checksum } from "bknd/utils";
+import { App, registries, sqlocal, type BkndConfig } from "bknd";
+import { Route, Router, Switch } from "wouter";
+import { ClientProvider } from "bknd/client";
+import { SQLocalKysely } from "sqlocal/kysely";
+import type { ClientConfig, DatabasePath } from "sqlocal";
+import { OpfsStorageAdapter } from "bknd/adapter/browser";
+import type { BkndAdminConfig } from "bknd/ui";
+
+const Admin = lazy(() =>
+   Promise.all([
+      import("bknd/ui"),
+      // @ts-ignore
+      import("bknd/dist/styles.css"),
+   ]).then(([mod]) => ({
+      default: mod.Admin,
+   })),
+);
+
+function safeViewTransition(fn: () => void) {
+   if (document.startViewTransition) {
+      document.startViewTransition(fn);
+   } else {
+      fn();
+   }
+}
+
+export type BrowserBkndConfig<Args = ImportMetaEnv> = Omit<
+   BkndConfig<Args>,
+   "connection" | "app"
+> & {
+   adminConfig?: BkndAdminConfig;
+   connection?: ClientConfig | DatabasePath;
+};
+
+export type BkndBrowserAppProps = {
+   children: ReactNode;
+   header?: ReactNode;
+   loading?: ReactNode;
+   notFound?: ReactNode;
+} & BrowserBkndConfig;
+
+const BkndBrowserAppContext = createContext<{
+   app: App;
+   hash: string;
+}>(undefined!);
+
+export function BkndBrowserApp({
+   children,
+   adminConfig,
+   header,
+   loading,
+   notFound,
+   ...config
+}: BkndBrowserAppProps) {
+   const [app, setApp] = useState<App | undefined>(undefined);
+   const [hash, setHash] = useState<string>("");
+   const adminRoutePath = (adminConfig?.basepath ?? "") + "/*?";
+
+   async function onBuilt(app: App) {
+      safeViewTransition(async () => {
+         setApp(app);
+         setHash(await checksum(app.toJSON()));
+      });
+   }
+
+   useEffect(() => {
+      setup({ ...config, adminConfig })
+         .then((app) => onBuilt(app as any))
+         .catch(console.error);
+   }, []);
+
+   if (!app) {
+      return (
+         loading ?? (
+            <Center>
+               <span style={{ opacity: 0.2 }}>Loading...</span>
+            </Center>
+         )
+      );
+   }
+
+   return (
+      <BkndBrowserAppContext.Provider value={{ app, hash }}>
+         <ClientProvider storage={window.localStorage} fetcher={app.server.request}>
+            {header}
+            <Router key={hash}>
+               <Switch>
+                  {children}
+
+                  <Route path={adminRoutePath}>
+                     <Suspense>
+                        <Admin config={adminConfig} />
+                     </Suspense>
+                  </Route>
+                  <Route path="*">
+                     {notFound ?? (
+                        <Center style={{ fontSize: "48px", fontFamily: "monospace" }}>404</Center>
+                     )}
+                  </Route>
+               </Switch>
+            </Router>
+         </ClientProvider>
+      </BkndBrowserAppContext.Provider>
+   );
+}
+
+export function useApp() {
+   return useContext(BkndBrowserAppContext);
+}
+
+const Center = (props: React.HTMLAttributes<HTMLDivElement>) => (
+   <div
+      {...props}
+      style={{
+         width: "100%",
+         minHeight: "100vh",
+         display: "flex",
+         justifyContent: "center",
+         alignItems: "center",
+         ...(props.style ?? {}),
+      }}
+   />
+);
+
+let initialized = false;
+async function setup(config: BrowserBkndConfig = {}) {
+   if (initialized) return;
+   initialized = true;
+
+   registries.media.register("opfs", OpfsStorageAdapter);
+
+   const app = App.create({
+      ...config,
+      // @ts-ignore
+      connection: sqlocal(new SQLocalKysely(config.connection ?? ":localStorage:")),
+   });
+
+   await config.beforeBuild?.(app);
+   await app.build({ sync: true });
+   await config.onBuilt?.(app);
+
+   return app;
+}
@@ -0,0 +1,34 @@
+import { describe, beforeAll, vi, afterAll, spyOn } from "bun:test";
+import { OpfsStorageAdapter } from "./OpfsStorageAdapter";
+// @ts-ignore
+import { assetsPath } from "../../../__test__/helper";
+import { adapterTestSuite } from "media/storage/adapters/adapter-test-suite";
+import { bunTestRunner } from "adapter/bun/test";
+import { MockFileSystemDirectoryHandle } from "adapter/browser/mock";
+
+describe("OpfsStorageAdapter", async () => {
+   let mockRoot: MockFileSystemDirectoryHandle;
+   let testSuiteAdapter: OpfsStorageAdapter;
+
+   const _mock = spyOn(global, "navigator");
+
+   beforeAll(() => {
+      // mock navigator.storage.getDirectory()
+      mockRoot = new MockFileSystemDirectoryHandle("opfs-root");
+      const mockNavigator = {
+         storage: {
+            getDirectory: vi.fn().mockResolvedValue(mockRoot),
+         },
+      };
+      // @ts-ignore
+      _mock.mockReturnValue(mockNavigator);
+      testSuiteAdapter = new OpfsStorageAdapter();
+   });
+
+   afterAll(() => {
+      _mock.mockRestore();
+   });
+
+   const file = Bun.file(`${assetsPath}/image.png`);
+   await adapterTestSuite(bunTestRunner, () => testSuiteAdapter, file);
+});
@@ -0,0 +1,265 @@
+import type { FileBody, FileListObject, FileMeta, FileUploadPayload } from "bknd";
+import { StorageAdapter, guessMimeType } from "bknd";
+import { parse, s, isFile, isBlob } from "bknd/utils";
+
+export const opfsAdapterConfig = s.object(
+   {
+      root: s.string({ default: "" }).optional(),
+   },
+   {
+      title: "OPFS",
+      description: "Origin Private File System storage",
+      additionalProperties: false,
+   },
+);
+export type OpfsAdapterConfig = s.Static<typeof opfsAdapterConfig>;
+
+/**
+ * Storage adapter for OPFS (Origin Private File System)
+ * Provides browser-based file storage using the File System Access API
+ */
+export class OpfsStorageAdapter extends StorageAdapter {
+   private config: OpfsAdapterConfig;
+   private rootPromise: Promise<FileSystemDirectoryHandle>;
+
+   constructor(config: Partial<OpfsAdapterConfig> = {}) {
+      super();
+      this.config = parse(opfsAdapterConfig, config);
+      this.rootPromise = this.initializeRoot();
+   }
+
+   private async initializeRoot(): Promise<FileSystemDirectoryHandle> {
+      const opfsRoot = await navigator.storage.getDirectory();
+      if (!this.config.root) {
+         return opfsRoot;
+      }
+
+      // navigate to or create nested directory structure
+      const parts = this.config.root.split("/").filter(Boolean);
+      let current = opfsRoot;
+      for (const part of parts) {
+         current = await current.getDirectoryHandle(part, { create: true });
+      }
+      return current;
+   }
+
+   getSchema() {
+      return opfsAdapterConfig;
+   }
+
+   getName(): string {
+      return "opfs";
+   }
+
+   async listObjects(prefix?: string): Promise<FileListObject[]> {
+      const root = await this.rootPromise;
+      const files: FileListObject[] = [];
+
+      for await (const [name, handle] of root.entries()) {
+         if (handle.kind === "file") {
+            if (!prefix || name.startsWith(prefix)) {
+               const file = await (handle as FileSystemFileHandle).getFile();
+               files.push({
+                  key: name,
+                  last_modified: new Date(file.lastModified),
+                  size: file.size,
+               });
+            }
+         }
+      }
+
+      return files;
+   }
+
+   private async computeEtagFromArrayBuffer(buffer: ArrayBuffer): Promise<string> {
+      const hashBuffer = await crypto.subtle.digest("SHA-256", buffer);
+      const hashArray = Array.from(new Uint8Array(hashBuffer));
+      const hashHex = hashArray.map((byte) => byte.toString(16).padStart(2, "0")).join("");
+
+      // wrap the hex string in quotes for ETag format
+      return `"${hashHex}"`;
+   }
+
+   async putObject(key: string, body: FileBody): Promise<string | FileUploadPayload> {
+      if (body === null) {
+         throw new Error("Body is empty");
+      }
+
+      const root = await this.rootPromise;
+      const fileHandle = await root.getFileHandle(key, { create: true });
+      const writable = await fileHandle.createWritable();
+
+      try {
+         let contentBuffer: ArrayBuffer;
+
+         if (isFile(body)) {
+            contentBuffer = await body.arrayBuffer();
+            await writable.write(contentBuffer);
+         } else if (body instanceof ReadableStream) {
+            const chunks: Uint8Array[] = [];
+            const reader = body.getReader();
+            try {
+               while (true) {
+                  const { done, value } = await reader.read();
+                  if (done) break;
+                  chunks.push(value);
+                  await writable.write(value);
+               }
+            } finally {
+               reader.releaseLock();
+            }
+            // compute total size and combine chunks for etag
+            const totalSize = chunks.reduce((sum, chunk) => sum + chunk.length, 0);
+            const combined = new Uint8Array(totalSize);
+            let offset = 0;
+            for (const chunk of chunks) {
+               combined.set(chunk, offset);
+               offset += chunk.length;
+            }
+            contentBuffer = combined.buffer;
+         } else if (isBlob(body)) {
+            contentBuffer = await (body as Blob).arrayBuffer();
+            await writable.write(contentBuffer);
+         } else {
+            // body is ArrayBuffer or ArrayBufferView
+            if (ArrayBuffer.isView(body)) {
+               const view = body as ArrayBufferView;
+               contentBuffer = view.buffer.slice(
+                  view.byteOffset,
+                  view.byteOffset + view.byteLength,
+               ) as ArrayBuffer;
+            } else {
+               contentBuffer = body as ArrayBuffer;
+            }
+            await writable.write(body);
+         }
+
+         await writable.close();
+         return await this.computeEtagFromArrayBuffer(contentBuffer);
+      } catch (error) {
+         await writable.abort();
+         throw error;
+      }
+   }
+
+   async deleteObject(key: string): Promise<void> {
+      try {
+         const root = await this.rootPromise;
+         await root.removeEntry(key);
+      } catch {
+         // file doesn't exist, which is fine
+      }
+   }
+
+   async objectExists(key: string): Promise<boolean> {
+      try {
+         const root = await this.rootPromise;
+         await root.getFileHandle(key);
+         return true;
+      } catch {
+         return false;
+      }
+   }
+
+   private parseRangeHeader(
+      rangeHeader: string,
+      fileSize: number,
+   ): { start: number; end: number } | null {
+      // parse "bytes=start-end" format
+      const match = rangeHeader.match(/^bytes=(\d*)-(\d*)$/);
+      if (!match) return null;
+
+      const [, startStr, endStr] = match;
+      let start = startStr ? Number.parseInt(startStr, 10) : 0;
+      let end = endStr ? Number.parseInt(endStr, 10) : fileSize - 1;
+
+      // handle suffix-byte-range-spec (e.g., "bytes=-500")
+      if (!startStr && endStr) {
+         start = Math.max(0, fileSize - Number.parseInt(endStr, 10));
+         end = fileSize - 1;
+      }
+
+      // validate range
+      if (start < 0 || end >= fileSize || start > end) {
+         return null;
+      }
+
+      return { start, end };
+   }
+
+   async getObject(key: string, headers: Headers): Promise<Response> {
+      try {
+         const root = await this.rootPromise;
+         const fileHandle = await root.getFileHandle(key);
+         const file = await fileHandle.getFile();
+         const fileSize = file.size;
+         const mimeType = guessMimeType(key);
+
+         const responseHeaders = new Headers({
+            "Accept-Ranges": "bytes",
+            "Content-Type": mimeType || "application/octet-stream",
+         });
+
+         const rangeHeader = headers.get("range");
+
+         if (rangeHeader) {
+            const range = this.parseRangeHeader(rangeHeader, fileSize);
+
+            if (!range) {
+               // invalid range - return 416 Range Not Satisfiable
+               responseHeaders.set("Content-Range", `bytes */${fileSize}`);
+               return new Response("", {
+                  status: 416,
+                  headers: responseHeaders,
+               });
+            }
+
+            const { start, end } = range;
+            const arrayBuffer = await file.arrayBuffer();
+            const chunk = arrayBuffer.slice(start, end + 1);
+
+            responseHeaders.set("Content-Range", `bytes ${start}-${end}/${fileSize}`);
+            responseHeaders.set("Content-Length", chunk.byteLength.toString());
+
+            return new Response(chunk, {
+               status: 206, // Partial Content
+               headers: responseHeaders,
+            });
+         } else {
+            // normal request - return entire file
+            const content = await file.arrayBuffer();
+            responseHeaders.set("Content-Length", content.byteLength.toString());
+
+            return new Response(content, {
+               status: 200,
+               headers: responseHeaders,
+            });
+         }
+      } catch {
+         // handle file reading errors
+         return new Response("", { status: 404 });
+      }
+   }
+
+   getObjectUrl(_key: string): string {
+      throw new Error("Method not implemented.");
+   }
+
+   async getObjectMeta(key: string): Promise<FileMeta> {
+      const root = await this.rootPromise;
+      const fileHandle = await root.getFileHandle(key);
+      const file = await fileHandle.getFile();
+
+      return {
+         type: guessMimeType(key) || "application/octet-stream",
+         size: file.size,
+      };
+   }
+
+   toJSON(_secrets?: boolean) {
+      return {
+         type: this.getName(),
+         config: this.config,
+      };
+   }
+}
@@ -0,0 +1,2 @@
+export * from "./OpfsStorageAdapter";
+export * from "./BkndBrowserApp";
@@ -0,0 +1,136 @@
+// mock OPFS API for testing
+class MockFileSystemFileHandle {
+   kind: "file" = "file";
+   name: string;
+   private content: ArrayBuffer;
+   private lastModified: number;
+
+   constructor(name: string, content: ArrayBuffer = new ArrayBuffer(0)) {
+      this.name = name;
+      this.content = content;
+      this.lastModified = Date.now();
+   }
+
+   async getFile(): Promise<File> {
+      return new File([this.content], this.name, {
+         lastModified: this.lastModified,
+         type: this.guessMimeType(),
+      });
+   }
+
+   async createWritable(): Promise<FileSystemWritableFileStream> {
+      const handle = this;
+      return {
+         async write(data: any) {
+            if (data instanceof ArrayBuffer) {
+               handle.content = data;
+            } else if (ArrayBuffer.isView(data)) {
+               handle.content = data.buffer.slice(
+                  data.byteOffset,
+                  data.byteOffset + data.byteLength,
+               ) as ArrayBuffer;
+            } else if (data instanceof Blob) {
+               handle.content = await data.arrayBuffer();
+            }
+            handle.lastModified = Date.now();
+         },
+         async close() {},
+         async abort() {},
+         async seek(_position: number) {},
+         async truncate(_size: number) {},
+      } as FileSystemWritableFileStream;
+   }
+
+   private guessMimeType(): string {
+      const ext = this.name.split(".").pop()?.toLowerCase();
+      const mimeTypes: Record<string, string> = {
+         png: "image/png",
+         jpg: "image/jpeg",
+         jpeg: "image/jpeg",
+         gif: "image/gif",
+         webp: "image/webp",
+         svg: "image/svg+xml",
+         txt: "text/plain",
+         json: "application/json",
+         pdf: "application/pdf",
+      };
+      return mimeTypes[ext || ""] || "application/octet-stream";
+   }
+}
+
+export class MockFileSystemDirectoryHandle {
+   kind: "directory" = "directory";
+   name: string;
+   private files: Map<string, MockFileSystemFileHandle> = new Map();
+   private directories: Map<string, MockFileSystemDirectoryHandle> = new Map();
+
+   constructor(name: string = "root") {
+      this.name = name;
+   }
+
+   async getFileHandle(
+      name: string,
+      options?: FileSystemGetFileOptions,
+   ): Promise<FileSystemFileHandle> {
+      if (this.files.has(name)) {
+         return this.files.get(name) as any;
+      }
+      if (options?.create) {
+         const handle = new MockFileSystemFileHandle(name);
+         this.files.set(name, handle);
+         return handle as any;
+      }
+      throw new Error(`File not found: ${name}`);
+   }
+
+   async getDirectoryHandle(
+      name: string,
+      options?: FileSystemGetDirectoryOptions,
+   ): Promise<FileSystemDirectoryHandle> {
+      if (this.directories.has(name)) {
+         return this.directories.get(name) as any;
+      }
+      if (options?.create) {
+         const handle = new MockFileSystemDirectoryHandle(name);
+         this.directories.set(name, handle);
+         return handle as any;
+      }
+      throw new Error(`Directory not found: ${name}`);
+   }
+
+   async removeEntry(name: string, _options?: FileSystemRemoveOptions): Promise<void> {
+      this.files.delete(name);
+      this.directories.delete(name);
+   }
+
+   async *entries(): AsyncIterableIterator<[string, FileSystemHandle]> {
+      for (const [name, handle] of this.files) {
+         yield [name, handle as any];
+      }
+      for (const [name, handle] of this.directories) {
+         yield [name, handle as any];
+      }
+   }
+
+   async *keys(): AsyncIterableIterator<string> {
+      for (const name of this.files.keys()) {
+         yield name;
+      }
+      for (const name of this.directories.keys()) {
+         yield name;
+      }
+   }
+
+   async *values(): AsyncIterableIterator<FileSystemHandle> {
+      for (const handle of this.files.values()) {
+         yield handle as any;
+      }
+      for (const handle of this.directories.values()) {
+         yield handle as any;
+      }
+   }
+
+   [Symbol.asyncIterator](): AsyncIterableIterator<[string, FileSystemHandle]> {
+      return this.entries();
+   }
+}
@@ -1,4 +1,4 @@
-import { describe, beforeAll, afterAll } from "vitest";
+import { describe } from "vitest";
 import * as node from "./node.adapter";
 import { adapterTestSuite } from "adapter/adapter-test-suite";
 import { viTestRunner } from "adapter/node/vitest";
@@ -0,0 +1 @@
+export * from "./sveltekit.adapter";
@@ -0,0 +1,16 @@
+import { afterAll, beforeAll, describe } from "bun:test";
+import * as sveltekit from "./sveltekit.adapter";
+import { disableConsoleLog, enableConsoleLog } from "core/utils";
+import { adapterTestSuite } from "adapter/adapter-test-suite";
+import { bunTestRunner } from "adapter/bun/test";
+
+beforeAll(disableConsoleLog);
+afterAll(enableConsoleLog);
+
+describe("sveltekit adapter", () => {
+   adapterTestSuite(bunTestRunner, {
+      makeApp: (c, a) => sveltekit.getApp(c as any, a ?? ({} as any)),
+      makeHandler: (c, a) => (request: Request) =>
+         sveltekit.serve(c as any, a ?? ({} as any))({ request }),
+   });
+});
@@ -0,0 +1,33 @@
+import { createRuntimeApp, type RuntimeBkndConfig } from "bknd/adapter";
+
+type TSvelteKit = {
+   request: Request;
+};
+
+export type SvelteKitBkndConfig<Env> = Pick<RuntimeBkndConfig<Env>, "adminOptions">;
+
+/**
+ * Get bknd app instance
+ * @param config - bknd configuration
+ * @param args - environment variables (use $env/dynamic/private for universal runtime support)
+ */
+export async function getApp<Env>(
+   config: SvelteKitBkndConfig<Env> = {} as SvelteKitBkndConfig<Env>,
+   args: Env,
+) {
+   return await createRuntimeApp(config, args);
+}
+
+/**
+ * Create request handler for hooks.server.ts
+ * @param config - bknd configuration
+ * @param args - environment variables (use $env/dynamic/private for universal runtime support)
+ */
+export function serve<Env>(
+   config: SvelteKitBkndConfig<Env> = {} as SvelteKitBkndConfig<Env>,
+   args: Env,
+) {
+   return async (fnArgs: TSvelteKit) => {
+      return (await getApp(config, args)).fetch(fnArgs.request);
+   };
+}
@@ -46,6 +46,22 @@ export class AppAuth extends Module<AppAuthSchema> {
         to.strategies!.password!.enabled = true;
      }

+      if (to.default_role_register && to.default_role_register?.length > 0) {
+         const valid_to_role = Object.keys(to.roles ?? {}).includes(to.default_role_register);
+
+         if (!valid_to_role) {
+            const msg = `Default role for registration not found: ${to.default_role_register}`;
+            // if changing to a new value
+            if (from.default_role_register !== to.default_role_register) {
+               throw new Error(msg);
+            }
+
+            // resetting gracefully, since role doesn't exist anymore
+            $console.warn(`${msg}, resetting to undefined`);
+            to.default_role_register = undefined;
+         }
+      }
+
      return to;
   }

@@ -82,6 +98,7 @@ export class AppAuth extends Module<AppAuthSchema> {
      this._authenticator = new Authenticator(strategies, new AppUserPool(this), {
         jwt: this.config.jwt,
         cookie: this.config.cookie,
+         default_role_register: this.config.default_role_register,
      });

      this.registerEntities();
@@ -171,10 +188,20 @@ export class AppAuth extends Module<AppAuthSchema> {
      } catch (e) {}
   }

-   async createUser({ email, password, ...additional }: CreateUserPayload): Promise<DB["users"]> {
+   async createUser({
+      email,
+      password,
+      role,
+      ...additional
+   }: CreateUserPayload): Promise<DB["users"]> {
      if (!this.enabled) {
         throw new Error("Cannot create user, auth not enabled");
      }
+      if (role) {
+         if (!Object.keys(this.config.roles ?? {}).includes(role)) {
+            throw new Error(`Role "${role}" not found`);
+         }
+      }

      const strategy = "password" as const;
      const pw = this.authenticator.strategy(strategy) as PasswordStrategy;
@@ -183,6 +210,7 @@ export class AppAuth extends Module<AppAuthSchema> {
      mutator.__unstable_toggleSystemEntityCreation(false);
      const { data: created } = await mutator.insertOne({
         ...(additional as any),
+         role: role || this.config.default_role_register || undefined,
         email,
         strategy,
         strategy_value,
@@ -13,6 +13,7 @@ import {
   InvalidSchemaError,
   transformObject,
   mcpTool,
+   $console,
 } from "bknd/utils";
 import type { PasswordStrategy } from "auth/authenticate/strategies";

@@ -210,7 +211,7 @@ export class AuthController extends Controller {
      const idType = s.anyOf([s.number({ title: "Integer" }), s.string({ title: "UUID" })]);

      const getUser = async (params: { id?: string | number; email?: string }) => {
-         let user: DB["users"] | undefined = undefined;
+         let user: DB["users"] | undefined;
         if (params.id) {
            const { data } = await this.userRepo.findId(params.id);
            user = data;
@@ -225,26 +226,33 @@ export class AuthController extends Controller {
      };

      const roles = Object.keys(this.auth.config.roles ?? {});
-      mcp.tool(
-         "auth_user_create",
-         {
-            description: "Create a new user",
-            inputSchema: s.object({
-               email: s.string({ format: "email" }),
-               password: s.string({ minLength: 8 }),
-               role: s
-                  .string({
-                     enum: roles.length > 0 ? roles : undefined,
-                  })
-                  .optional(),
-            }),
-         },
-         async (params, c) => {
-            await c.context.ctx().helper.granted(c, AuthPermissions.createUser);
+      try {
+         const actions = this.auth.authenticator.strategy("password").getActions();
+         if (actions.create) {
+            const schema = actions.create.schema;
+            mcp.tool(
+               "auth_user_create",
+               {
+                  description: "Create a new user",
+                  inputSchema: s.object({
+                     ...schema.properties,
+                     role: s
+                        .string({
+                           enum: roles.length > 0 ? roles : undefined,
+                        })
+                        .optional(),
+                  }),
+               },
+               async (params, c) => {
+                  await c.context.ctx().helper.granted(c, AuthPermissions.createUser);

-            return c.json(await this.auth.createUser(params));
-         },
-      );
+                  return c.json(await this.auth.createUser(params));
+               },
+            );
+         }
+      } catch (e) {
+         $console.warn("error creating auth_user_create tool", e);
+      }

      mcp.tool(
         "auth_user_token",
@@ -51,6 +51,7 @@ export const authConfigSchema = $object(
      basepath: s.string({ default: "/api/auth" }),
      entity_name: s.string({ default: "users" }),
      allow_register: s.boolean({ default: true }).optional(),
+      default_role_register: s.string().optional(),
      jwt: jwtConfig,
      cookie: cookieConfig,
      strategies: $record(
@@ -74,6 +74,7 @@ export const jwtConfig = s.strictObject(
 export const authenticatorConfig = s.object({
   jwt: jwtConfig,
   cookie: cookieConfig,
+   default_role_register: s.string().optional(),
 });

 type AuthConfig = s.Static<typeof authenticatorConfig>;
@@ -164,9 +165,13 @@ export class Authenticator<
         if (!("strategy_value" in profile)) {
            throw new InvalidConditionsException("Profile must have a strategy value");
         }
+         if ("role" in profile) {
+            throw new InvalidConditionsException("Role cannot be provided during registration");
+         }

         const user = await this.userPool.create(strategy.getName(), {
            ...profile,
+            role: this.config.default_role_register,
            strategy_value: profile.strategy_value,
         });

@@ -10,6 +10,7 @@ const schema = s
   .object({
      hashing: s.string({ enum: ["plain", "sha256", "bcrypt"], default: "sha256" }),
      rounds: s.number({ minimum: 1, maximum: 10 }).optional(),
+      minLength: s.number({ default: 8, minimum: 1 }).optional(),
   })
   .strict();

@@ -37,7 +38,7 @@ export class PasswordStrategy extends AuthStrategy<typeof schema> {
            format: "email",
         }),
         password: s.string({
-            minLength: 8, // @todo: this should be configurable
+            minLength: this.config.minLength,
         }),
      });
   }
@@ -65,12 +66,21 @@ export class PasswordStrategy extends AuthStrategy<typeof schema> {
            return await bcryptCompare(compare, actual);
      }

-      return false;
+      return actual === compare;
   }

   verify(password: string) {
      return async (user: User) => {
-         const compare = await this.compare(user?.strategy_value!, password);
+         if (!user || !user.strategy_value) {
+            throw new InvalidCredentialsException();
+         }
+
+         if (!this.getPayloadSchema().properties.password.validate(password).valid) {
+            $console.debug("PasswordStrategy: Invalid password", password);
+            throw new InvalidCredentialsException();
+         }
+
+         const compare = await this.compare(user.strategy_value, password);
         if (compare !== true) {
            throw new InvalidCredentialsException();
         }
@@ -4,7 +4,9 @@ import type { CliBkndConfig, CliCommand } from "cli/types";
 import { Option } from "commander";
 import { config, type App, type CreateAppConfig, type MaybePromise, registries } from "bknd";
 import dotenv from "dotenv";
+import * as errore from "errore";
 import c from "picocolors";
+import { execFileSync } from "node:child_process";
 import path from "node:path";
 import {
   PLATFORMS,
@@ -18,6 +20,26 @@ import { createRuntimeApp, makeConfig } from "bknd/adapter";
 import { colorizeConsole, isBun } from "bknd/utils";
 import { withConfigOptions, type WithConfigOptions } from "cli/utils/options";

+class ConfigLoadError extends errore.createTaggedError({
+   name: "ConfigLoadError",
+   message: "Failed to load config: $reason",
+}) {}
+
+class NeedsBunError extends errore.createTaggedError({
+   name: "NeedsBunError",
+   message: "Config requires Bun runtime",
+}) {}
+
+class NeedsTypeStrippingError extends errore.createTaggedError({
+   name: "NeedsTypeStrippingError",
+   message: "Node $version needs --experimental-strip-types for .ts config",
+}) {}
+
+class ReexecFailedError extends errore.createTaggedError({
+   name: "ReexecFailedError",
+   message: "Re-exec failed: $reason",
+}) {}
+
 const env_files = [".env", ".dev.vars"];
 dotenv.config({
   path: env_files.map((file) => path.resolve(process.cwd(), file)),
@@ -55,6 +77,106 @@ if (!registries.media.has(local)) {
   registries.media.register(local, StorageLocalAdapter);
 }

+function needsTypeStripping(configFilePath: string): boolean {
+   if (!/\.[mc]?ts$/.test(configFilePath)) return false;
+   const [major, minor] = process.versions.node.split(".").map(Number);
+   // Node v22.06 introduced experimental TypeScript support via strip types.
+   return major === 22 && minor! < 18 && minor! > 5;
+}
+
+function reexecWithTypeStripping(): ReexecFailedError | never {
+   if (process.env.__BKND_REEXEC) {
+      return new ReexecFailedError({
+         reason: "TS config still failed after re-exec with --experimental-strip-types",
+      });
+   }
+
+   const cliPath = path.resolve(process.argv[1]!);
+   const args = ["--experimental-strip-types", cliPath, ...process.argv.slice(2)];
+
+   console.info(
+      c.yellow("Node <22.18 detected, re-executing with --experimental-strip-types"),
+   );
+
+   const result = errore.try({
+      try: () =>
+         execFileSync(process.execPath, args, {
+            stdio: "inherit",
+            env: { ...process.env, __BKND_REEXEC: "1" },
+         }),
+      catch: (e) =>
+         new ReexecFailedError({
+            reason: "Failed to re-exec with --experimental-strip-types",
+            cause: e,
+         }),
+   });
+
+   if (result instanceof Error) return result;
+   process.exit(0);
+}
+
+async function loadConfigFile(
+   configFilePath: string,
+): Promise<ConfigLoadError | NeedsBunError | NeedsTypeStrippingError | CliBkndConfig> {
+   if (needsTypeStripping(configFilePath) && !process.execArgv.includes("--experimental-strip-types")) {
+      return new NeedsTypeStrippingError({
+         version: process.versions.node,
+      });
+   }
+
+   const result = await errore.tryAsync({
+      try: () => import(configFilePath).then((m) => m.default as CliBkndConfig),
+      catch: (e) => {
+         const needsBun =
+            (e instanceof ReferenceError && /\bBun\b.*not defined/.test(e.message)) ||
+            (e instanceof Error && "code" in e && e.code === "ERR_UNSUPPORTED_ESM_URL_SCHEME" && /bun:/.test(e.message));
+         if (needsBun) return new NeedsBunError();
+         return new ConfigLoadError({
+            reason: e instanceof Error ? e.message : String(e),
+            cause: e,
+         });
+      },
+   });
+
+   return result;
+}
+
+function reexecUnderBun(): ReexecFailedError | never {
+   if (process.env.__BKND_REEXEC) {
+      return new ReexecFailedError({
+         reason: "Config requires Bun but still failed under Bun runtime",
+      });
+   }
+
+   const bunPath = process.env.BUN_INSTALL
+      ? path.join(process.env.BUN_INSTALL, "bin", "bun")
+      : "bun";
+
+   const cliPath = path.resolve(process.argv[1]!);
+   const args = [cliPath, ...process.argv.slice(2)];
+
+   console.info(
+      c.yellow("Config requires Bun runtime, re-executing:"),
+      c.cyan(`bun ${args.join(" ")}`),
+   );
+
+   const result = errore.try({
+      try: () =>
+         execFileSync(bunPath, args, {
+            stdio: "inherit",
+            env: { ...process.env, __BKND_REEXEC: "1" },
+         }),
+      catch: (e) =>
+         new ReexecFailedError({
+            reason: "Could not re-exec under Bun. Install Bun (https://bun.sh) or use bknd/adapter/node in your config.",
+            cause: e,
+         }),
+   });
+
+   if (result instanceof Error) return result;
+   process.exit(0);
+}
+
 type MakeAppConfig = {
   connection?: CreateAppConfig["connection"];
   server?: { platform?: Platform };
@@ -99,12 +221,33 @@ export async function makeAppFromEnv(options: Partial<RunOptions> = {}) {
      // check configuration file to be present
   } else if (configFilePath) {
      console.info("Using config from", c.cyan(configFilePath));
-      try {
-         const config = (await import(configFilePath).then((m) => m.default)) as CliBkndConfig;
-         app = await makeConfigApp(config, options.server);
-      } catch (e) {
-         console.error("Failed to load config:", e);
-         process.exit(1);
+      const configResult = await loadConfigFile(configFilePath);
+
+      if (configResult instanceof Error) {
+         errore.matchError(configResult, {
+            NeedsTypeStrippingError: () => {
+               const reexecResult = reexecWithTypeStripping();
+               // only reached on failure — success calls process.exit(0)
+               console.error(c.red(reexecResult.message));
+               process.exit(1);
+            },
+            NeedsBunError: () => {
+               const reexecResult = reexecUnderBun();
+               // only reached on failure — success calls process.exit(0)
+               console.error(c.red(reexecResult.message));
+               process.exit(1);
+            },
+            ConfigLoadError: (e) => {
+               console.error(c.red("Failed to load config:"), e.reason);
+               process.exit(1);
+            },
+            Error: (e) => {
+               console.error(c.red("Failed to load config:"), e.message);
+               process.exit(1);
+            },
+         });
+      } else {
+         app = await makeConfigApp(configResult, options.server);
      }

      // try to use an in-memory connection
@@ -8,7 +8,7 @@ export function isDebug(): boolean {
   try {
      // @ts-expect-error - this is a global variable in dev
      return is_toggled(__isDev);
-   } catch (e) {
+   } catch (_e) {
      return false;
   }
 }
@@ -1,3 +1,4 @@
+import type { MaybePromise } from "bknd";
 import type { Event } from "./Event";
 import type { EventClass } from "./EventManager";

@@ -7,7 +8,7 @@ export type ListenerMode = (typeof ListenerModes)[number];
 export type ListenerHandler<E extends Event<any, any>> = (
   event: E,
   slug: string,
-) => E extends Event<any, infer R> ? R | Promise<R | void> : never;
+) => E extends Event<any, infer R> ? MaybePromise<R | void> : never;

 export class EventListener<E extends Event = Event> {
   mode: ListenerMode = "async";
@@ -32,6 +32,7 @@ export function getFlashMessage(
 ): { type: FlashMessageType; message: string } | undefined {
   const flash = getCookieValue(flash_key);
   if (flash && clear) {
+      // biome-ignore lint/suspicious/noDocumentCookie: .
      document.cookie = `${flash_key}=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/;`;
   }
   return flash ? JSON.parse(flash) : undefined;
@@ -14,9 +14,9 @@ export function isObject(value: unknown): value is Record<string, unknown> {

 export function omitKeys<T extends object, K extends keyof T>(
   obj: T,
-   keys_: readonly K[],
+   keys_: readonly K[] | K[] | string[],
 ): Omit<T, Extract<K, keyof T>> {
-   const keys = new Set(keys_);
+   const keys = new Set(keys_ as readonly K[]);
   const result = {} as Omit<T, Extract<K, keyof T>>;
   for (const [key, value] of Object.entries(obj) as [keyof T, T[keyof T]][]) {
      if (!keys.has(key as K)) {
@@ -1,3 +1,4 @@
+import type { MaybePromise } from "core/types";
 import { getRuntimeKey as honoGetRuntimeKey } from "hono/adapter";

 /**
@@ -77,3 +78,37 @@ export function threw(fn: () => any, instance?: new (...args: any[]) => Error) {
      return true;
   }
 }
+
+export async function threwAsync(fn: Promise<any>, instance?: new (...args: any[]) => Error) {
+   try {
+      await fn;
+      return false;
+   } catch (e) {
+      if (instance) {
+         if (e instanceof instance) {
+            return true;
+         }
+         // if instance given but not what expected, throw
+         throw e;
+      }
+      return true;
+   }
+}
+
+export async function $waitUntil(
+   message: string,
+   condition: () => MaybePromise<boolean>,
+   delay = 100,
+   maxAttempts = 10,
+) {
+   let attempts = 0;
+   while (attempts < maxAttempts) {
+      if (await condition()) {
+         return;
+      }
+      await new Promise((resolve) => setTimeout(resolve, delay));
+      attempts++;
+   }
+
+   throw new Error(`$waitUntil: "${message}" failed after ${maxAttempts} attempts`);
+}
@@ -96,6 +96,9 @@ export class DataController extends Controller {
      // read entity schema
      hono.get(
         "/schema.json",
+         permission(SystemPermissions.schemaRead, {
+            context: (_c) => ({ module: "data" }),
+         }),
         permission(DataPermissions.entityRead, {
            context: (c) => ({ entity: c.req.param("entity") }),
         }),
@@ -124,6 +127,9 @@ export class DataController extends Controller {
      // read schema
      hono.get(
         "/schemas/:entity/:context?",
+         permission(SystemPermissions.schemaRead, {
+            context: (_c) => ({ module: "data" }),
+         }),
         permission(DataPermissions.entityRead, {
            context: (c) => ({ entity: c.req.param("entity") }),
         }),
@@ -161,7 +167,7 @@ export class DataController extends Controller {
      hono.get(
         "/types",
         permission(SystemPermissions.schemaRead, {
-            context: (c) => ({ module: "data" }),
+            context: (_c) => ({ module: "data" }),
         }),
         describeRoute({
            summary: "Retrieve data typescript definitions",
@@ -182,6 +188,9 @@ export class DataController extends Controller {
       */
      hono.get(
         "/info/:entity",
+         permission(SystemPermissions.schemaRead, {
+            context: (_c) => ({ module: "data" }),
+         }),
         permission(DataPermissions.entityRead, {
            context: (c) => ({ entity: c.req.param("entity") }),
         }),
@@ -6,15 +6,12 @@ import {
   type CompiledQuery,
   type DatabaseIntrospector,
   type Dialect,
-   type Expression,
   type Kysely,
   type KyselyPlugin,
   type OnModifyForeignAction,
   type QueryResult,
-   type RawBuilder,
   type SelectQueryBuilder,
   type SelectQueryNode,
-   type Simplify,
   sql,
 } from "kysely";
 import type { jsonArrayFrom, jsonBuildObject, jsonObjectFrom } from "kysely/helpers/sqlite";
@@ -14,27 +14,31 @@ export function connectionTestSuite(
   {
      makeConnection,
      rawDialectDetails,
+      disableConsoleLog: _disableConsoleLog = true,
   }: {
      makeConnection: () => MaybePromise<{
         connection: Connection;
         dispose: () => MaybePromise<void>;
      }>;
      rawDialectDetails: string[];
+      disableConsoleLog?: boolean;
   },
 ) {
   const { test, expect, describe, beforeEach, afterEach, afterAll, beforeAll } = testRunner;
-   beforeAll(() => disableConsoleLog());
-   afterAll(() => enableConsoleLog());
+   if (_disableConsoleLog) {
+      beforeAll(() => disableConsoleLog());
+      afterAll(() => enableConsoleLog());
+   }

-   describe("base", () => {
-      let ctx: Awaited<ReturnType<typeof makeConnection>>;
-      beforeEach(async () => {
-         ctx = await makeConnection();
-      });
-      afterEach(async () => {
-         await ctx.dispose();
-      });
+   let ctx: Awaited<ReturnType<typeof makeConnection>>;
+   beforeEach(async () => {
+      ctx = await makeConnection();
+   });
+   afterEach(async () => {
+      await ctx.dispose();
+   });

+   describe("base", async () => {
      test("pings", async () => {
         const res = await ctx.connection.ping();
         expect(res).toBe(true);
@@ -98,52 +102,54 @@ export function connectionTestSuite(
   });

   describe("schema", async () => {
-      const { connection, dispose } = await makeConnection();
-      afterAll(async () => {
-         await dispose();
-      });
+      const makeSchema = async () => {
+         const fields = [
+            {
+               type: "integer",
+               name: "id",
+               primary: true,
+            },
+            {
+               type: "text",
+               name: "text",
+            },
+            {
+               type: "json",
+               name: "json",
+            },
+         ] as const satisfies FieldSpec[];

-      const fields = [
-         {
-            type: "integer",
-            name: "id",
-            primary: true,
-         },
-         {
-            type: "text",
-            name: "text",
-         },
-         {
-            type: "json",
-            name: "json",
-         },
-      ] as const satisfies FieldSpec[];
+         let b = ctx.connection.kysely.schema.createTable("test");
+         for (const field of fields) {
+            // @ts-expect-error
+            b = b.addColumn(...ctx.connection.getFieldSchema(field));
+         }
+         await b.execute();

-      let b = connection.kysely.schema.createTable("test");
-      for (const field of fields) {
-         // @ts-expect-error
-         b = b.addColumn(...connection.getFieldSchema(field));
-      }
-      await b.execute();
-
-      // add index
-      await connection.kysely.schema.createIndex("test_index").on("test").columns(["id"]).execute();
+         // add index
+         await ctx.connection.kysely.schema
+            .createIndex("test_index")
+            .on("test")
+            .columns(["id"])
+            .execute();
+      };

      test("executes query", async () => {
-         await connection.kysely
+         await makeSchema();
+         await ctx.connection.kysely
            .insertInto("test")
            .values({ id: 1, text: "test", json: JSON.stringify({ a: 1 }) })
            .execute();

         const expected = { id: 1, text: "test", json: { a: 1 } };

-         const qb = connection.kysely.selectFrom("test").selectAll();
-         const res = await connection.executeQuery(qb);
+         const qb = ctx.connection.kysely.selectFrom("test").selectAll();
+         const res = await ctx.connection.executeQuery(qb);
         expect(res.rows).toEqual([expected]);
         expect(rawDialectDetails.every((detail) => getPath(res, detail) !== undefined)).toBe(true);

         {
-            const res = await connection.executeQueries(qb, qb);
+            const res = await ctx.connection.executeQueries(qb, qb);
            expect(res.length).toBe(2);
            res.map((r) => {
               expect(r.rows).toEqual([expected]);
@@ -155,15 +161,21 @@ export function connectionTestSuite(
      });

      test("introspects", async () => {
-         const tables = await connection.getIntrospector().getTables({
+         await makeSchema();
+         const tables = await ctx.connection.getIntrospector().getTables({
            withInternalKyselyTables: false,
         });
         const clean = tables.map((t) => ({
            ...t,
-            columns: t.columns.map((c) => ({
-               ...c,
-               dataType: undefined,
-            })),
+            columns: t.columns
+               .map((c) => ({
+                  ...c,
+                  // ignore data type
+                  dataType: undefined,
+                  // ignore default value if "id"
+                  hasDefaultValue: c.name !== "id" ? c.hasDefaultValue : undefined,
+               }))
+               .sort((a, b) => a.name.localeCompare(b.name)),
         }));

         expect(clean).toEqual([
@@ -176,14 +188,8 @@ export function connectionTestSuite(
                     dataType: undefined,
                     isNullable: false,
                     isAutoIncrementing: true,
-                     hasDefaultValue: false,
-                  },
-                  {
-                     name: "text",
-                     dataType: undefined,
-                     isNullable: true,
-                     isAutoIncrementing: false,
-                     hasDefaultValue: false,
+                     hasDefaultValue: undefined,
+                     comment: undefined,
                  },
                  {
                     name: "json",
@@ -191,25 +197,34 @@ export function connectionTestSuite(
                     isNullable: true,
                     isAutoIncrementing: false,
                     hasDefaultValue: false,
+                     comment: undefined,
+                  },
+                  {
+                     name: "text",
+                     dataType: undefined,
+                     isNullable: true,
+                     isAutoIncrementing: false,
+                     hasDefaultValue: false,
+                     comment: undefined,
+                  },
+               ],
+            },
+         ]);
+
+         expect(await ctx.connection.getIntrospector().getIndices()).toEqual([
+            {
+               name: "test_index",
+               table: "test",
+               isUnique: false,
+               columns: [
+                  {
+                     name: "id",
+                     order: 0,
                  },
               ],
            },
         ]);
      });
-
-      expect(await connection.getIntrospector().getIndices()).toEqual([
-         {
-            name: "test_index",
-            table: "test",
-            isUnique: false,
-            columns: [
-               {
-                  name: "id",
-                  order: 0,
-               },
-            ],
-         },
-      ]);
   });

   describe("integration", async () => {
@@ -0,0 +1,33 @@
+import { Kysely, PostgresDialect, type PostgresDialectConfig as KyselyPostgresDialectConfig } from "kysely";
+import { PostgresIntrospector } from "./PostgresIntrospector";
+import { PostgresConnection, plugins } from "./PostgresConnection";
+import { customIntrospector } from "../Connection";
+import type { Pool } from "pg";
+
+export type PostgresDialectConfig = Omit<KyselyPostgresDialectConfig, "pool"> & {
+   pool: Pool;
+};
+
+export class PgPostgresConnection extends PostgresConnection<Pool> {
+   override name = "pg";
+
+   constructor(config: PostgresDialectConfig) {
+      const kysely = new Kysely({
+         dialect: customIntrospector(PostgresDialect, PostgresIntrospector, {
+            excludeTables: [],
+         }).create(config),
+         plugins,
+      });
+
+      super(kysely);
+      this.client = config.pool;
+   }
+
+   override async close(): Promise<void> {
+      await this.client.end();
+   }
+}
+
+export function pg(config: PostgresDialectConfig): PgPostgresConnection {
+   return new PgPostgresConnection(config);
+}
@@ -5,7 +5,7 @@ import {
   type SchemaResponse,
   type ConnQuery,
   type ConnQueryResults,
-} from "bknd";
+} from "../Connection";
 import {
   ParseJSONResultsPlugin,
   type ColumnDataType,
@@ -20,7 +20,7 @@ export type QB = SelectQueryBuilder<any, any, any>;

 export const plugins = [new ParseJSONResultsPlugin()];

-export abstract class PostgresConnection extends Connection {
+export abstract class PostgresConnection<Client = unknown> extends Connection<Client> {
   protected override readonly supported = {
      batching: true,
      softscans: true,
@@ -68,7 +68,7 @@ export abstract class PostgresConnection extends Connection {
         type,
         (col: ColumnDefinitionBuilder) => {
            if (spec.primary) {
-               return col.primaryKey();
+               return col.primaryKey().notNull();
            }
            if (spec.references) {
               return col
@@ -76,7 +76,7 @@ export abstract class PostgresConnection extends Connection {
                  .onDelete(spec.onDelete ?? "set null")
                  .onUpdate(spec.onUpdate ?? "no action");
            }
-            return spec.nullable ? col : col.notNull();
+            return col;
         },
      ];
   }
@@ -1,5 +1,5 @@
 import { type SchemaMetadata, sql } from "kysely";
-import { BaseIntrospector } from "bknd";
+import { BaseIntrospector } from "../BaseIntrospector";

 type PostgresSchemaSpec = {
   name: string;
@@ -102,26 +102,27 @@ export class PostgresIntrospector extends BaseIntrospector {
      return tables.map((table) => ({
         name: table.name,
         isView: table.type === "VIEW",
-         columns: table.columns.map((col) => {
-            return {
-               name: col.name,
-               dataType: col.type,
-               isNullable: !col.notnull,
-               // @todo: check default value on 'nextval' see https://www.postgresql.org/docs/17/datatype-numeric.html#DATATYPE-SERIAL
-               isAutoIncrementing: true, // just for now
-               hasDefaultValue: col.dflt != null,
-               comment: undefined,
-            };
-         }),
-         indices: table.indices.map((index) => ({
-            name: index.name,
-            table: table.name,
-            isUnique: index.sql?.match(/unique/i) != null,
-            columns: index.columns.map((col) => ({
-               name: col.name,
-               order: col.seqno,
-            })),
+         columns: table.columns.map((col) => ({
+            name: col.name,
+            dataType: col.type,
+            isNullable: !col.notnull,
+            isAutoIncrementing: col.dflt?.toLowerCase().includes("nextval") ?? false,
+            hasDefaultValue: col.dflt != null,
+            comment: undefined,
         })),
+         indices: table.indices
+            // filter out db-managed primary key index
+            .filter((index) => index.name !== `${table.name}_pkey`)
+            .map((index) => ({
+               name: index.name,
+               table: table.name,
+               isUnique: index.sql?.match(/unique/i) != null,
+               columns: index.columns.map((col) => ({
+                  name: col.name,
+                  // seqno starts at 1
+                  order: col.seqno - 1,
+               })),
+            })),
      }));
   }
 }
@@ -0,0 +1,31 @@
+import { Kysely } from "kysely";
+import { PostgresIntrospector } from "./PostgresIntrospector";
+import { PostgresConnection, plugins } from "./PostgresConnection";
+import { customIntrospector } from "../Connection";
+import { PostgresJSDialect, type PostgresJSDialectConfig } from "kysely-postgres-js";
+
+export class PostgresJsConnection extends PostgresConnection<PostgresJSDialectConfig["postgres"]> {
+   override name = "postgres-js";
+
+   constructor(config: PostgresJSDialectConfig) {
+      const kysely = new Kysely({
+         dialect: customIntrospector(PostgresJSDialect, PostgresIntrospector, {
+            excludeTables: [],
+         }).create(config),
+         plugins,
+      });
+
+      super(kysely);
+      this.client = config.postgres;
+   }
+
+   override async close(): Promise<void> {
+      await this.client.end();
+   }
+}
+
+export function postgresJs(
+   config: PostgresJSDialectConfig,
+): PostgresJsConnection {
+   return new PostgresJsConnection(config);
+}
@@ -1,4 +1,4 @@
-import { customIntrospector, type DbFunctions } from "bknd";
+import { customIntrospector, type DbFunctions } from "../Connection";
 import { Kysely, type Dialect, type KyselyPlugin } from "kysely";
 import { plugins, PostgresConnection } from "./PostgresConnection";
 import { PostgresIntrospector } from "./PostgresIntrospector";
@@ -6,7 +6,7 @@ import { PostgresIntrospector } from "./PostgresIntrospector";
 export type Constructor<T> = new (...args: any[]) => T;

 export type CustomPostgresConnection = {
-   supports?: PostgresConnection["supported"];
+   supports?: Partial<PostgresConnection["supported"]>;
   fn?: Partial<DbFunctions>;
   plugins?: KyselyPlugin[];
   excludeTables?: string[];
@@ -13,31 +13,43 @@ import { customIntrospector } from "../Connection";
 import { SqliteIntrospector } from "./SqliteIntrospector";
 import type { Field } from "data/fields/Field";

-// @todo: add pragmas
 export type SqliteConnectionConfig<
   CustomDialect extends Constructor<Dialect> = Constructor<Dialect>,
 > = {
   excludeTables?: string[];
-   dialect: CustomDialect;
-   dialectArgs?: ConstructorParameters<CustomDialect>;
   additionalPlugins?: KyselyPlugin[];
   customFn?: Partial<DbFunctions>;
-};
+} & (
+   | {
+        dialect: CustomDialect;
+        dialectArgs?: ConstructorParameters<CustomDialect>;
+     }
+   | {
+        kysely: Kysely<any>;
+     }
+);

 export abstract class SqliteConnection<Client = unknown> extends Connection<Client> {
   override name = "sqlite";

   constructor(config: SqliteConnectionConfig) {
-      const { excludeTables, dialect, dialectArgs = [], additionalPlugins } = config;
+      const { excludeTables, additionalPlugins } = config;
      const plugins = [new ParseJSONResultsPlugin(), ...(additionalPlugins ?? [])];

-      const kysely = new Kysely({
-         dialect: customIntrospector(dialect, SqliteIntrospector, {
-            excludeTables,
+      let kysely: Kysely<any>;
+      if ("dialect" in config) {
+         kysely = new Kysely({
+            dialect: customIntrospector(config.dialect, SqliteIntrospector, {
+               excludeTables,
+               plugins,
+            }).create(...(config.dialectArgs ?? [])),
            plugins,
-         }).create(...dialectArgs),
-         plugins,
-      });
+         });
+      } else if ("kysely" in config) {
+         kysely = config.kysely;
+      } else {
+         throw new Error("Either dialect or kysely must be provided");
+      }

      super(
         kysely,
@@ -83,7 +83,7 @@ export class SqliteIntrospector extends BaseIntrospector {
                  dataType: col.type,
                  isNullable: !col.notnull,
                  isAutoIncrementing: col.name === autoIncrementCol,
-                  hasDefaultValue: col.dflt_value != null,
+                  hasDefaultValue: col.name === autoIncrementCol ? true : col.dflt_value != null,
                  comment: undefined,
               };
            }) ?? [],
@@ -0,0 +1,15 @@
+import { describe } from "bun:test";
+import { SQLocalConnection } from "./SQLocalConnection";
+import { connectionTestSuite } from "data/connection/connection-test-suite";
+import { bunTestRunner } from "adapter/bun/test";
+import { SQLocalKysely } from "sqlocal/kysely";
+
+describe("SQLocalConnection", () => {
+   connectionTestSuite(bunTestRunner, {
+      makeConnection: () => ({
+         connection: new SQLocalConnection(new SQLocalKysely({ databasePath: ":memory:" })),
+         dispose: async () => {},
+      }),
+      rawDialectDetails: [],
+   });
+});
@@ -0,0 +1,50 @@
+import { Kysely, ParseJSONResultsPlugin } from "kysely";
+import { SqliteConnection } from "../SqliteConnection";
+import { SqliteIntrospector } from "../SqliteIntrospector";
+import type { DB } from "bknd";
+import type { SQLocalKysely } from "sqlocal/kysely";
+
+const plugins = [new ParseJSONResultsPlugin()];
+
+export class SQLocalConnection extends SqliteConnection<SQLocalKysely> {
+   private connected: boolean = false;
+
+   constructor(client: SQLocalKysely) {
+      // @ts-expect-error - config is protected
+      client.config.onConnect = () => {
+         // we need to listen for the connection, it will be awaited in init()
+         this.connected = true;
+      };
+      super({
+         kysely: new Kysely<any>({
+            dialect: {
+               ...client.dialect,
+               createIntrospector: (db: Kysely<DB>) => {
+                  return new SqliteIntrospector(db as any, {
+                     plugins,
+                  });
+               },
+            },
+            plugins,
+         }) as any,
+      });
+      this.client = client;
+   }
+
+   override async init() {
+      if (this.initialized) return;
+      let tries = 0;
+      while (!this.connected && tries < 100) {
+         tries++;
+         await new Promise((resolve) => setTimeout(resolve, 5));
+      }
+      if (!this.connected) {
+         throw new Error("Failed to connect to SQLite database");
+      }
+      this.initialized = true;
+   }
+}
+
+export function sqlocal(instance: InstanceType<typeof SQLocalKysely>): SQLocalConnection {
+   return new SQLocalConnection(instance);
+}
@@ -103,6 +103,7 @@ export class Repository<TBD extends object = DefaultDB, TB extends keyof TBD = a
         validated.with = options.with;
      }

+      // add explicit joins. Implicit joins are added in `where` builder
      if (options.join && options.join.length > 0) {
         for (const entry of options.join) {
            const related = this.em.relationOf(entity.name, entry);
@@ -127,12 +128,28 @@ export class Repository<TBD extends object = DefaultDB, TB extends keyof TBD = a
         const invalid = WhereBuilder.getPropertyNames(options.where).filter((field) => {
            if (field.includes(".")) {
               const [alias, prop] = field.split(".") as [string, string];
-               if (!aliases.includes(alias)) {
+               // check aliases first (added joins)
+               if (aliases.includes(alias)) {
+                  this.checkIndex(alias, prop, "where");
+                  return !this.em.entity(alias).getField(prop);
+               }
+               // check if alias (entity) exists
+               if (!this.em.hasEntity(alias)) {
                  return true;
               }
+               // check related fields for auto join
+               const related = this.em.relationOf(entity.name, alias);
+               if (related) {
+                  const other = related.other(entity);
+                  if (other.entity.getField(prop)) {
+                     // if related field is found, add join to validated options
+                     validated.join?.push(alias);
+                     this.checkIndex(alias, prop, "where");
+                     return false;
+                  }
+               }

-               this.checkIndex(alias, prop, "where");
-               return !this.em.entity(alias).getField(prop);
+               return true;
            }

            this.checkIndex(entity.name, field, "where");
@@ -52,7 +52,7 @@ export class NumberField<Required extends true | false = false> extends Field<

      switch (context) {
         case "submit":
-            return Number.parseInt(value);
+            return Number.parseInt(value, 10);
      }

      return value;
@@ -28,7 +28,7 @@ export function getChangeSet(
         const value = _value === "" ? null : _value;

         // normalize to null if undefined
-         const newValue = field.getValue(value, "submit") || null;
+         const newValue = field.getValue(value, "submit") ?? null;
         // @todo: add typing for "action"
         if (action === "create" || newValue !== data[key]) {
            acc[key] = newValue;
@@ -289,7 +289,7 @@ class EntityManagerPrototype<Entities extends Record<string, Entity>> extends En
      super(Object.values(__entities), new DummyConnection(), relations, indices);
   }

-   withConnection(connection: Connection): EntityManager<Schema<Entities>> {
+   withConnection(connection: Connection): EntityManager<Schemas<Entities>> {
      return new EntityManager(this.entities, connection, this.relations.all, this.indices);
   }
 }
@@ -1,8 +1,9 @@
-import { test, describe, expect } from "bun:test";
+import { test, describe, expect, beforeAll, afterAll } from "bun:test";
 import * as q from "./query";
 import { parse as $parse, type ParseOptions } from "bknd/utils";
 import type { PrimaryFieldType } from "modules";
 import type { Generated } from "kysely";
+import { disableConsoleLog, enableConsoleLog } from "core/utils/test";

 const parse = (v: unknown, o: ParseOptions = {}) =>
   $parse(q.repoQuery, v, {
@@ -15,6 +16,9 @@ const decode = (input: any, output: any) => {
   expect(parse(input)).toEqual(output);
 };

+beforeAll(() => disableConsoleLog());
+afterAll(() => enableConsoleLog());
+
 describe("server/query", () => {
   test("limit & offset", () => {
      //expect(() => parse({ limit: false })).toThrow();
@@ -132,6 +132,8 @@ export type * from "data/entities/Entity";
 export type { EntityManager } from "data/entities/EntityManager";
 export type { SchemaManager } from "data/schema/SchemaManager";
 export type * from "data/entities";
+
+// data connection
 export {
   BaseIntrospector,
   Connection,
@@ -144,9 +146,32 @@ export {
   type ConnQuery,
   type ConnQueryResults,
 } from "data/connection";
+
+// data sqlite
 export { SqliteConnection } from "data/connection/sqlite/SqliteConnection";
 export { SqliteIntrospector } from "data/connection/sqlite/SqliteIntrospector";
 export { SqliteLocalConnection } from "data/connection/sqlite/SqliteLocalConnection";
+
+// data sqlocal
+export { SQLocalConnection, sqlocal } from "data/connection/sqlite/sqlocal/SQLocalConnection";
+
+// data postgres
+export {
+   pg,
+   PgPostgresConnection,
+} from "data/connection/postgres/PgPostgresConnection";
+export { PostgresIntrospector } from "data/connection/postgres/PostgresIntrospector";
+export { PostgresConnection } from "data/connection/postgres/PostgresConnection";
+export {
+   postgresJs,
+   PostgresJsConnection,
+} from "data/connection/postgres/PostgresJsConnection";
+export {
+   createCustomPostgresConnection,
+   type CustomPostgresConnection,
+} from "data/connection/postgres/custom";
+
+// data prototype
 export {
   text,
   number,
@@ -71,11 +71,12 @@ export class MediaApi extends ModuleApi<MediaApiOptions> {
   }

   protected uploadFile<T extends FileUploadedEventData>(
-      body: File | Blob | ReadableStream | Buffer<ArrayBufferLike>,
+      body: BodyInit,
      opts?: {
         filename?: string;
         path?: TInput;
         _init?: Omit<RequestInit, "body">;
+         query?: Record<string, any>;
      },
   ): FetchPromise<ResponseObject<T>> {
      const headers = {
@@ -102,14 +103,22 @@ export class MediaApi extends ModuleApi<MediaApiOptions> {
         headers,
      };
      if (opts?.path) {
-         return this.post(opts.path, body, init);
+         return this.request<T>(opts.path, opts?.query, {
+            ...init,
+            body,
+            method: "POST",
+         });
      }

      if (!name || name.length === 0) {
         throw new Error("Invalid filename");
      }

-      return this.post<T>(opts?.path ?? ["upload", name], body, init);
+      return this.request<T>(opts?.path ?? ["upload", name], opts?.query, {
+         ...init,
+         body,
+         method: "POST",
+      });
   }

   async upload<T extends FileUploadedEventData>(
@@ -119,6 +128,7 @@ export class MediaApi extends ModuleApi<MediaApiOptions> {
         _init?: Omit<RequestInit, "body">;
         path?: TInput;
         fetcher?: ApiFetcher;
+         query?: Record<string, any>;
      } = {},
   ) {
      if (item instanceof Request || typeof item === "string") {
@@ -144,7 +154,7 @@ export class MediaApi extends ModuleApi<MediaApiOptions> {
         });
      }

-      return this.uploadFile<T>(item, opts);
+      return this.uploadFile<T>(item as BodyInit, opts);
   }

   async uploadToEntity(
@@ -155,11 +165,14 @@ export class MediaApi extends ModuleApi<MediaApiOptions> {
      opts?: {
         _init?: Omit<RequestInit, "body">;
         fetcher?: typeof fetch;
+         overwrite?: boolean;
      },
   ): Promise<ResponseObject<FileUploadedEventData & { result: DB["media"] }>> {
+      const query = opts?.overwrite !== undefined ? { overwrite: opts.overwrite } : undefined;
      return this.upload(item, {
         ...opts,
         path: ["entity", entity, id, field],
+         query,
      });
   }

@@ -5,7 +5,7 @@ import type { BunFile } from "bun";

 export async function adapterTestSuite(
   testRunner: TestRunner,
-   adapter: StorageAdapter,
+   _adapter: StorageAdapter | (() => StorageAdapter),
   file: File | BunFile,
   opts?: {
      retries?: number;
@@ -25,7 +25,12 @@ export async function adapterTestSuite(
   const _filename = randomString(10);
   const filename = `${_filename}.png`;

+   const getAdapter = (
+      typeof _adapter === "function" ? _adapter : () => _adapter
+   ) as () => StorageAdapter;
+
   await test("puts an object", async () => {
+      const adapter = getAdapter();
      objects = (await adapter.listObjects()).length;
      const result = await adapter.putObject(filename, file as unknown as File);
      expect(result).toBeDefined();
@@ -38,6 +43,7 @@ export async function adapterTestSuite(
   });

   await test("lists objects", async () => {
+      const adapter = getAdapter();
      const length = await retry(
         () => adapter.listObjects().then((res) => res.length),
         (length) => length > objects,
@@ -49,10 +55,12 @@ export async function adapterTestSuite(
   });

   await test("file exists", async () => {
+      const adapter = getAdapter();
      expect(await adapter.objectExists(filename)).toBe(true);
   });

   await test("gets an object", async () => {
+      const adapter = getAdapter();
      const res = await adapter.getObject(filename, new Headers());
      expect(res.ok).toBe(true);
      expect(res.headers.get("Accept-Ranges")).toBe("bytes");
@@ -62,6 +70,7 @@ export async function adapterTestSuite(
   if (options.testRange) {
      await test("handles range request - partial content", async () => {
         const headers = new Headers({ Range: "bytes=0-99" });
+         const adapter = getAdapter();
         const res = await adapter.getObject(filename, headers);
         expect(res.status).toBe(206); // Partial Content
         expect(/^bytes 0-99\/\d+$/.test(res.headers.get("Content-Range")!)).toBe(true);
@@ -70,6 +79,7 @@ export async function adapterTestSuite(

      await test("handles range request - suffix range", async () => {
         const headers = new Headers({ Range: "bytes=-100" });
+         const adapter = getAdapter();
         const res = await adapter.getObject(filename, headers);
         expect(res.status).toBe(206); // Partial Content
         expect(/^bytes \d+-\d+\/\d+$/.test(res.headers.get("Content-Range")!)).toBe(true);
@@ -77,6 +87,7 @@ export async function adapterTestSuite(

      await test("handles invalid range request", async () => {
         const headers = new Headers({ Range: "bytes=invalid" });
+         const adapter = getAdapter();
         const res = await adapter.getObject(filename, headers);
         expect(res.status).toBe(416); // Range Not Satisfiable
         expect(/^bytes \*\/\d+$/.test(res.headers.get("Content-Range")!)).toBe(true);
@@ -84,6 +95,7 @@ export async function adapterTestSuite(
   }

   await test("gets object meta", async () => {
+      const adapter = getAdapter();
      expect(await adapter.getObjectMeta(filename)).toEqual({
         type: file.type, // image/png
         size: file.size,
@@ -91,6 +103,7 @@ export async function adapterTestSuite(
   });

   await test("deletes an object", async () => {
+      const adapter = getAdapter();
      expect(await adapter.deleteObject(filename)).toBeUndefined();

      if (opts?.skipExistsAfterDelete !== true) {
@@ -87,7 +87,7 @@ export async function makeModeConfig<
   const { typesFilePath, configFilePath, writer, syncSecrets: syncSecretsOptions } = config;

   const isProd = config.isProduction ?? _isProd();
-   const plugins = appConfig?.options?.plugins ?? ([] as AppPlugin[]);
+   const plugins = config?.options?.plugins ?? ([] as AppPlugin[]);
   const syncFallback = typeof config.syncSchema === "boolean" ? config.syncSchema : !isProd;
   const syncSchemaOptions =
      typeof config.syncSchema === "object"
@@ -87,7 +87,7 @@ export type ModuleManagerOptions = {
   verbosity?: Verbosity;
 };

-const debug_modules = env("modules_debug");
+const debug_modules = env("modules_debug", false);

 abstract class ModuleManagerEvent<A = {}> extends Event<{ ctx: ModuleBuildContext } & A> {}
 export class ModuleManagerConfigUpdateEvent<
@@ -33,3 +33,5 @@ export const schemaRead = new Permission(
 );
 export const build = new Permission("system.build");
 export const mcp = new Permission("system.mcp");
+export const info = new Permission("system.info");
+export const openapi = new Permission("system.openapi");
@@ -1,5 +1,3 @@
-/// <reference types="@cloudflare/workers-types" />
-
 import type { App } from "App";
 import {
   datetimeStringLocal,
@@ -125,7 +123,7 @@ export class SystemController extends Controller {
   private registerConfigController(client: Hono<any>): void {
      const { permission } = this.middlewares;
      // don't add auth again, it's already added in getController
-      const hono = this.create(); /* .use(permission(SystemPermissions.configRead)); */
+      const hono = this.create();

      if (!this.app.isReadOnly()) {
         const manager = this.app.modules as DbModuleManager;
@@ -317,6 +315,11 @@ export class SystemController extends Controller {
            summary: "Get the config for a module",
            tags: ["system"],
         }),
+         permission(SystemPermissions.configRead, {
+            context: (c) => ({
+               module: c.req.param("module"),
+            }),
+         }),
         mcpTool("system_config", {
            annotations: {
               readOnlyHint: true,
@@ -354,7 +357,7 @@ export class SystemController extends Controller {

   override getController() {
      const { permission, auth } = this.middlewares;
-      const hono = this.create().use(auth());
+      const hono = this.create().use(auth()).use(permission(SystemPermissions.accessApi, {}));

      this.registerConfigController(hono);

@@ -429,6 +432,9 @@ export class SystemController extends Controller {

      hono.get(
         "/permissions",
+         permission(SystemPermissions.schemaRead, {
+            context: (_c) => ({ module: "auth" }),
+         }),
         describeRoute({
            summary: "Get the permissions",
            tags: ["system"],
@@ -441,6 +447,7 @@ export class SystemController extends Controller {

      hono.post(
         "/build",
+         permission(SystemPermissions.build, {}),
         describeRoute({
            summary: "Build the app",
            tags: ["system"],
@@ -471,6 +478,7 @@ export class SystemController extends Controller {

      hono.get(
         "/info",
+         permission(SystemPermissions.info, {}),
         mcpTool("system_info"),
         describeRoute({
            summary: "Get the server info",
@@ -504,6 +512,7 @@ export class SystemController extends Controller {

      hono.get(
         "/openapi.json",
+         permission(SystemPermissions.openapi, {}),
         openAPISpecs(this.ctx.server, {
            info: {
               title: "bknd API",
@@ -511,7 +520,11 @@ export class SystemController extends Controller {
            },
         }),
      );
-      hono.get("/swagger", swaggerUI({ url: "/api/system/openapi.json" }));
+      hono.get(
+         "/swagger",
+         permission(SystemPermissions.openapi, {}),
+         swaggerUI({ url: "/api/system/openapi.json" }),
+      );

      return hono;
   }
@@ -0,0 +1,683 @@
+import { afterAll, beforeAll, describe, expect, mock, test, setSystemTime } from "bun:test";
+import { emailOTP } from "./email-otp.plugin";
+import { createApp } from "core/test/utils";
+import { disableConsoleLog, enableConsoleLog } from "core/utils/test";
+
+beforeAll(disableConsoleLog);
+afterAll(enableConsoleLog);
+
+describe("otp plugin", () => {
+   test("should not work if auth is not enabled", async () => {
+      const app = createApp({
+         options: {
+            plugins: [emailOTP({ showActualErrors: true })],
+         },
+      });
+      await app.build();
+      const res = await app.server.request("/api/auth/otp/login", {
+         method: "POST",
+         headers: {
+            "Content-Type": "application/json",
+         },
+         body: JSON.stringify({ email: "test@test.com" }),
+      });
+      expect(res.status).toBe(404);
+   });
+
+   test("should require email driver if sendEmail is true", async () => {
+      const app = createApp({
+         config: {
+            auth: {
+               enabled: true,
+            },
+         },
+         options: {
+            plugins: [emailOTP()],
+         },
+      });
+      await app.build();
+      const res = await app.server.request("/api/auth/otp/login", {
+         method: "POST",
+         headers: {
+            "Content-Type": "application/json",
+         },
+         body: JSON.stringify({ email: "test@test.com" }),
+      });
+      expect(res.status).toBe(404);
+
+      {
+         const app = createApp({
+            config: {
+               auth: {
+                  enabled: true,
+               },
+            },
+            options: {
+               plugins: [emailOTP({ sendEmail: false })],
+            },
+         });
+         await app.build();
+         const res = await app.server.request("/api/auth/otp/register", {
+            method: "POST",
+            headers: {
+               "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ email: "test@test.com" }),
+         });
+         expect(res.status).toBe(201);
+      }
+   });
+
+   test("should prevent mutations of the OTP entity", async () => {
+      const app = createApp({
+         config: {
+            auth: {
+               enabled: true,
+            },
+         },
+         options: {
+            drivers: {
+               email: {
+                  send: async () => {},
+               },
+            },
+            plugins: [emailOTP({ showActualErrors: true })],
+         },
+      });
+      await app.build();
+
+      const payload = {
+         email: "test@test.com",
+         code: "123456",
+         action: "login",
+         created_at: new Date(),
+         expires_at: new Date(Date.now() + 1000 * 60 * 60 * 24),
+         used_at: null,
+      };
+
+      expect(app.em.mutator("users_otp").insertOne(payload)).rejects.toThrow();
+      expect(
+         await app
+            .getApi()
+            .data.createOne("users_otp", payload)
+            .then((r) => r.ok),
+      ).toBe(false);
+   });
+
+   test("should generate a token", async () => {
+      const called = mock(() => null);
+      const app = createApp({
+         config: {
+            auth: {
+               enabled: true,
+            },
+         },
+         options: {
+            plugins: [emailOTP({ showActualErrors: true })],
+            drivers: {
+               email: {
+                  send: async (to) => {
+                     expect(to).toBe("test@test.com");
+                     called();
+                  },
+               },
+            },
+            seed: async (ctx) => {
+               await ctx.app.createUser({ email: "test@test.com", password: "12345678" });
+            },
+         },
+      });
+      await app.build();
+
+      const res = await app.server.request("/api/auth/otp/login", {
+         method: "POST",
+         headers: {
+            "Content-Type": "application/json",
+         },
+         body: JSON.stringify({ email: "test@test.com" }),
+      });
+      expect(res.status).toBe(201);
+      const data = (await res.json()) as any;
+      expect(data.sent).toBe(true);
+      expect(data.data.email).toBe("test@test.com");
+      expect(data.data.action).toBe("login");
+      expect(data.data.expires_at).toBeDefined();
+
+      {
+         const { data } = await app.em.fork().repo("users_otp").findOne({ email: "test@test.com" });
+         expect(data?.code).toBeDefined();
+         expect(data?.code?.length).toBe(6);
+         expect(data?.code?.split("").every((char: string) => Number.isInteger(Number(char)))).toBe(
+            true,
+         );
+         expect(data?.email).toBe("test@test.com");
+      }
+      expect(called).toHaveBeenCalled();
+   });
+
+   test("should login with a code", async () => {
+      let code = "";
+
+      const app = createApp({
+         config: {
+            auth: {
+               enabled: true,
+               jwt: {
+                  secret: "test",
+               },
+            },
+         },
+         options: {
+            plugins: [
+               emailOTP({
+                  showActualErrors: true,
+                  generateEmail: (otp) => ({ subject: "test", body: otp.code }),
+               }),
+            ],
+            drivers: {
+               email: {
+                  send: async (to, _subject, body) => {
+                     expect(to).toBe("test@test.com");
+                     code = String(body);
+                  },
+               },
+            },
+            seed: async (ctx) => {
+               await ctx.app.createUser({ email: "test@test.com", password: "12345678" });
+            },
+         },
+      });
+      await app.build();
+
+      await app.server.request("/api/auth/otp/login", {
+         method: "POST",
+         headers: {
+            "Content-Type": "application/json",
+         },
+         body: JSON.stringify({ email: "test@test.com" }),
+      });
+
+      {
+         const res = await app.server.request("/api/auth/otp/login", {
+            method: "POST",
+            headers: {
+               "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ email: "test@test.com", code }),
+         });
+         expect(res.status).toBe(200);
+         expect(res.headers.get("set-cookie")).toBeDefined();
+         const userData = (await res.json()) as any;
+         expect(userData.user.email).toBe("test@test.com");
+         expect(userData.token).toBeDefined();
+      }
+   });
+
+   test("should register with a code", async () => {
+      let code = "";
+
+      const app = createApp({
+         config: {
+            auth: {
+               enabled: true,
+               jwt: {
+                  secret: "test",
+               },
+            },
+         },
+         options: {
+            plugins: [
+               emailOTP({
+                  showActualErrors: true,
+                  generateEmail: (otp) => ({ subject: "test", body: otp.code }),
+               }),
+            ],
+            drivers: {
+               email: {
+                  send: async (to, _subject, body) => {
+                     expect(to).toBe("test@test.com");
+                     code = String(body);
+                  },
+               },
+            },
+         },
+      });
+      await app.build();
+
+      const res = await app.server.request("/api/auth/otp/register", {
+         method: "POST",
+         headers: {
+            "Content-Type": "application/json",
+         },
+         body: JSON.stringify({ email: "test@test.com" }),
+      });
+      const data = (await res.json()) as any;
+      expect(data.sent).toBe(true);
+      expect(data.data.email).toBe("test@test.com");
+      expect(data.data.action).toBe("register");
+      expect(data.data.expires_at).toBeDefined();
+
+      {
+         const res = await app.server.request("/api/auth/otp/register", {
+            method: "POST",
+            headers: {
+               "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ email: "test@test.com", code }),
+         });
+         expect(res.status).toBe(200);
+         expect(res.headers.get("set-cookie")).toBeDefined();
+         const userData = (await res.json()) as any;
+         expect(userData.user.email).toBe("test@test.com");
+         expect(userData.token).toBeDefined();
+      }
+   });
+
+   test("should not send email if sendEmail is false", async () => {
+      const called = mock(() => null);
+      const app = createApp({
+         config: {
+            auth: {
+               enabled: true,
+            },
+         },
+         options: {
+            plugins: [emailOTP({ sendEmail: false })],
+            drivers: {
+               email: {
+                  send: async () => {
+                     called();
+                  },
+               },
+            },
+         },
+      });
+      await app.build();
+
+      const res = await app.server.request("/api/auth/otp/register", {
+         method: "POST",
+         headers: {
+            "Content-Type": "application/json",
+         },
+         body: JSON.stringify({ email: "test@test.com" }),
+      });
+      expect(res.status).toBe(201);
+      expect(called).not.toHaveBeenCalled();
+   });
+
+   test("should reject invalid codes", async () => {
+      const app = createApp({
+         config: {
+            auth: {
+               enabled: true,
+               jwt: {
+                  secret: "test",
+               },
+            },
+         },
+         options: {
+            plugins: [
+               emailOTP({
+                  showActualErrors: true,
+                  generateEmail: (otp) => ({ subject: "test", body: otp.code }),
+               }),
+            ],
+            drivers: {
+               email: {
+                  send: async () => {},
+               },
+            },
+            seed: async (ctx) => {
+               await ctx.app.createUser({ email: "test@test.com", password: "12345678" });
+            },
+         },
+      });
+      await app.build();
+
+      // First send a code
+      await app.server.request("/api/auth/otp/login", {
+         method: "POST",
+         headers: {
+            "Content-Type": "application/json",
+         },
+         body: JSON.stringify({ email: "test@test.com" }),
+      });
+
+      // Try to use an invalid code
+      const res = await app.server.request("/api/auth/otp/login", {
+         method: "POST",
+         headers: {
+            "Content-Type": "application/json",
+         },
+         body: JSON.stringify({ email: "test@test.com", code: "999999" }),
+      });
+      expect(res.status).toBe(400);
+      const error = await res.json();
+      expect(error).toBeDefined();
+   });
+
+   test("should reject code reuse", async () => {
+      let code = "";
+
+      const app = createApp({
+         config: {
+            auth: {
+               enabled: true,
+               jwt: {
+                  secret: "test",
+               },
+            },
+         },
+         options: {
+            plugins: [
+               emailOTP({
+                  showActualErrors: true,
+                  generateEmail: (otp) => ({ subject: "test", body: otp.code }),
+               }),
+            ],
+            drivers: {
+               email: {
+                  send: async (_to, _subject, body) => {
+                     code = String(body);
+                  },
+               },
+            },
+            seed: async (ctx) => {
+               await ctx.app.createUser({ email: "test@test.com", password: "12345678" });
+            },
+         },
+      });
+      await app.build();
+
+      // Send a code
+      await app.server.request("/api/auth/otp/login", {
+         method: "POST",
+         headers: {
+            "Content-Type": "application/json",
+         },
+         body: JSON.stringify({ email: "test@test.com" }),
+      });
+
+      // Use the code successfully
+      {
+         const res = await app.server.request("/api/auth/otp/login", {
+            method: "POST",
+            headers: {
+               "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ email: "test@test.com", code }),
+         });
+         expect(res.status).toBe(200);
+      }
+
+      // Try to use the same code again
+      {
+         const res = await app.server.request("/api/auth/otp/login", {
+            method: "POST",
+            headers: {
+               "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ email: "test@test.com", code }),
+         });
+         expect(res.status).toBe(400);
+         const error = await res.json();
+         expect(error).toBeDefined();
+      }
+   });
+
+   test("should reject expired codes", async () => {
+      // Set a fixed system time
+      const baseTime = Date.now();
+      setSystemTime(new Date(baseTime));
+
+      try {
+         const app = createApp({
+            config: {
+               auth: {
+                  enabled: true,
+                  jwt: {
+                     secret: "test",
+                  },
+               },
+            },
+            options: {
+               plugins: [
+                  emailOTP({
+                     showActualErrors: true,
+                     ttl: 1, // 1 second TTL
+                     generateEmail: (otp) => ({ subject: "test", body: otp.code }),
+                  }),
+               ],
+               drivers: {
+                  email: {
+                     send: async () => {},
+                  },
+               },
+               seed: async (ctx) => {
+                  await ctx.app.createUser({ email: "test@test.com", password: "12345678" });
+               },
+            },
+         });
+         await app.build();
+
+         // Send a code
+         const sendRes = await app.server.request("/api/auth/otp/login", {
+            method: "POST",
+            headers: {
+               "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ email: "test@test.com" }),
+         });
+         expect(sendRes.status).toBe(201);
+
+         // Get the code from the database
+         const { data: otpData } = await app.em
+            .fork()
+            .repo("users_otp")
+            .findOne({ email: "test@test.com" });
+         expect(otpData?.code).toBeDefined();
+
+         // Advance system time by more than 1 second to expire the code
+         setSystemTime(new Date(baseTime + 1100));
+
+         // Try to use the expired code
+         const res = await app.server.request("/api/auth/otp/login", {
+            method: "POST",
+            headers: {
+               "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ email: "test@test.com", code: otpData?.code }),
+         });
+         expect(res.status).toBe(400);
+         const error = await res.json();
+         expect(error).toBeDefined();
+      } finally {
+         // Reset system time
+         setSystemTime();
+      }
+   });
+
+   test("should reject codes with different actions", async () => {
+      let loginCode = "";
+      let registerCode = "";
+
+      const app = createApp({
+         config: {
+            auth: {
+               enabled: true,
+               jwt: {
+                  secret: "test",
+               },
+            },
+         },
+         options: {
+            plugins: [
+               emailOTP({
+                  showActualErrors: true,
+                  generateEmail: (otp) => ({ subject: "test", body: otp.code }),
+               }),
+            ],
+            drivers: {
+               email: {
+                  send: async () => {},
+               },
+            },
+            seed: async (ctx) => {
+               await ctx.app.createUser({ email: "test@test.com", password: "12345678" });
+            },
+         },
+      });
+      await app.build();
+
+      // Send a login code
+      await app.server.request("/api/auth/otp/login", {
+         method: "POST",
+         headers: {
+            "Content-Type": "application/json",
+         },
+         body: JSON.stringify({ email: "test@test.com" }),
+      });
+
+      // Get the login code
+      const { data: loginOtp } = await app
+         .getApi()
+         .data.readOneBy("users_otp", { where: { email: "test@test.com", action: "login" } });
+      loginCode = loginOtp?.code || "";
+
+      // Send a register code
+      await app.server.request("/api/auth/otp/register", {
+         method: "POST",
+         headers: {
+            "Content-Type": "application/json",
+         },
+         body: JSON.stringify({ email: "test@test.com" }),
+      });
+
+      // Get the register code
+      const { data: registerOtp } = await app
+         .getApi()
+         .data.readOneBy("users_otp", { where: { email: "test@test.com", action: "register" } });
+      registerCode = registerOtp?.code || "";
+
+      // Try to use login code for register
+      {
+         const res = await app.server.request("/api/auth/otp/register", {
+            method: "POST",
+            headers: {
+               "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ email: "test@test.com", code: loginCode }),
+         });
+         expect(res.status).toBe(400);
+         const error = await res.json();
+         expect(error).toBeDefined();
+      }
+
+      // Try to use register code for login
+      {
+         const res = await app.server.request("/api/auth/otp/login", {
+            method: "POST",
+            headers: {
+               "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ email: "test@test.com", code: registerCode }),
+         });
+         expect(res.status).toBe(400);
+         const error = await res.json();
+         expect(error).toBeDefined();
+      }
+   });
+
+   test("should invalidate previous codes when sending new code", async () => {
+      let firstCode = "";
+      let secondCode = "";
+
+      const app = createApp({
+         config: {
+            auth: {
+               enabled: true,
+               jwt: {
+                  secret: "test",
+               },
+            },
+         },
+         options: {
+            plugins: [
+               emailOTP({
+                  showActualErrors: true,
+                  generateEmail: (otp) => ({ subject: "test", body: otp.code }),
+               }),
+            ],
+            drivers: {
+               email: {
+                  send: async () => {},
+               },
+            },
+            seed: async (ctx) => {
+               await ctx.app.createUser({ email: "test@test.com", password: "12345678" });
+            },
+         },
+      });
+      await app.build();
+      const em = app.em.fork();
+
+      // Send first code
+      await app.server.request("/api/auth/otp/login", {
+         method: "POST",
+         headers: {
+            "Content-Type": "application/json",
+         },
+         body: JSON.stringify({ email: "test@test.com" }),
+      });
+
+      // Get the first code
+      const { data: firstOtp } = await em
+         .repo("users_otp")
+         .findOne({ email: "test@test.com", action: "login" });
+      firstCode = firstOtp?.code || "";
+      expect(firstCode).toBeDefined();
+
+      // Send second code (should invalidate the first)
+      await app.server.request("/api/auth/otp/login", {
+         method: "POST",
+         headers: {
+            "Content-Type": "application/json",
+         },
+         body: JSON.stringify({ email: "test@test.com" }),
+      });
+
+      // Get the second code
+      const { data: secondOtp } = await em
+         .repo("users_otp")
+         .findOne({ email: "test@test.com", action: "login" });
+      secondCode = secondOtp?.code || "";
+      expect(secondCode).toBeDefined();
+      expect(secondCode).not.toBe(firstCode);
+
+      // Try to use the first code (should fail as it's been invalidated)
+      {
+         const res = await app.server.request("/api/auth/otp/login", {
+            method: "POST",
+            headers: {
+               "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ email: "test@test.com", code: firstCode }),
+         });
+         expect(res.status).toBe(400);
+         const error = await res.json();
+         expect(error).toBeDefined();
+      }
+
+      // The second code should work
+      {
+         const res = await app.server.request("/api/auth/otp/login", {
+            method: "POST",
+            headers: {
+               "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ email: "test@test.com", code: secondCode }),
+         });
+         expect(res.status).toBe(200);
+      }
+   });
+});
@@ -0,0 +1,388 @@
+import {
+   datetime,
+   em,
+   entity,
+   enumm,
+   Exception,
+   text,
+   type App,
+   type AppPlugin,
+   type DB,
+   type FieldSchema,
+   type MaybePromise,
+   type EntityConfig,
+   DatabaseEvents,
+} from "bknd";
+import {
+   invariant,
+   s,
+   jsc,
+   HttpStatus,
+   threwAsync,
+   randomString,
+   $console,
+   pickKeys,
+} from "bknd/utils";
+import { Hono } from "hono";
+
+export type EmailOTPPluginOptions = {
+   /**
+    * Customize code generation. If not provided, a random 6-digit code will be generated.
+    */
+   generateCode?: (user: Pick<DB["users"], "email">) => string;
+
+   /**
+    * The base path for the API endpoints.
+    * @default "/api/auth/otp"
+    */
+   apiBasePath?: string;
+
+   /**
+    * The TTL for the OTP tokens in seconds.
+    * @default 600 (10 minutes)
+    */
+   ttl?: number;
+
+   /**
+    * The name of the OTP entity.
+    * @default "users_otp"
+    */
+   entity?: string;
+
+   /**
+    * The config for the OTP entity.
+    */
+   entityConfig?: EntityConfig;
+
+   /**
+    * Customize email content. If not provided, a default email will be sent.
+    */
+   generateEmail?: (
+      otp: EmailOTPFieldSchema,
+   ) => MaybePromise<{ subject: string; body: string | { text: string; html: string } }>;
+
+   /**
+    * Enable debug mode for error messages.
+    * @default false
+    */
+   showActualErrors?: boolean;
+
+   /**
+    * Allow direct mutations (create/update) of OTP codes outside of this plugin,
+    * e.g. via API or admin UI. If false, mutations are only allowed via the plugin's flows.
+    * @default false
+    */
+   allowExternalMutations?: boolean;
+
+   /**
+    * Whether to send the email with the OTP code.
+    * @default true
+    */
+   sendEmail?: boolean;
+};
+
+const otpFields = {
+   action: enumm({
+      enum: ["login", "register"],
+   }),
+   code: text().required(),
+   email: text().required(),
+   created_at: datetime(),
+   expires_at: datetime().required(),
+   used_at: datetime(),
+};
+
+export type EmailOTPFieldSchema = FieldSchema<typeof otpFields>;
+
+class OTPError extends Exception {
+   override name = "OTPError";
+   override code = HttpStatus.BAD_REQUEST;
+}
+
+export function emailOTP({
+   generateCode: _generateCode,
+   apiBasePath = "/api/auth/otp",
+   ttl = 600,
+   entity: entityName = "users_otp",
+   entityConfig,
+   generateEmail: _generateEmail,
+   showActualErrors = false,
+   allowExternalMutations = false,
+   sendEmail = true,
+}: EmailOTPPluginOptions = {}): AppPlugin {
+   return (app: App) => {
+      return {
+         name: "email-otp",
+         schema: () =>
+            em(
+               {
+                  [entityName]: entity(
+                     entityName,
+                     otpFields,
+                     {
+                        name: "Users OTP",
+                        sort_dir: "desc",
+                        primary_format: app.module.data.config.default_primary_format,
+                        ...entityConfig,
+                     },
+                     "generated",
+                  ) as any,
+               },
+               ({ index }, schema) => {
+                  const otp = schema[entityName]!;
+                  index(otp).on(["email", "expires_at", "code"]);
+               },
+            ),
+         onBuilt: async () => {
+            const auth = app.module.auth;
+            invariant(auth && auth.enabled === true, "Auth is not enabled");
+            invariant(!sendEmail || app.drivers?.email, "Email driver is not registered");
+
+            const generateCode =
+               _generateCode ?? (() => Math.floor(100000 + Math.random() * 900000).toString());
+            const generateEmail =
+               _generateEmail ??
+               ((otp: EmailOTPFieldSchema) => ({
+                  subject: "OTP Code",
+                  body: `Your OTP code is: ${otp.code}`,
+               }));
+            const em = app.em.fork();
+
+            const hono = new Hono()
+               .post(
+                  "/login",
+                  jsc(
+                     "json",
+                     s.strictObject({
+                        email: s.string({ format: "email" }),
+                        code: s.string({ minLength: 1 }).optional(),
+                     }),
+                  ),
+                  jsc("query", s.object({ redirect: s.string().optional() })),
+                  async (c) => {
+                     const { email, code } = c.req.valid("json");
+                     const { redirect } = c.req.valid("query");
+                     const user = await findUser(app, email);
+
+                     if (code) {
+                        const otpData = await getValidatedCode(
+                           app,
+                           entityName,
+                           email,
+                           code,
+                           "login",
+                        );
+                        await em.mutator(entityName).updateOne(otpData.id, { used_at: new Date() });
+
+                        const jwt = await auth.authenticator.jwt(user);
+                        // @ts-expect-error private method
+                        return auth.authenticator.respondWithUser(
+                           c,
+                           { user, token: jwt },
+                           { redirect },
+                        );
+                     } else {
+                        const otpData = await invalidateAndGenerateCode(
+                           app,
+                           { generateCode, ttl, entity: entityName },
+                           user,
+                           "login",
+                        );
+                        if (sendEmail) {
+                           await sendCode(app, otpData, { generateEmail });
+                        }
+
+                        return c.json(
+                           {
+                              sent: true,
+                              data: pickKeys(otpData, ["email", "action", "expires_at"]),
+                           },
+                           HttpStatus.CREATED,
+                        );
+                     }
+                  },
+               )
+               .post(
+                  "/register",
+                  jsc(
+                     "json",
+                     s.object({
+                        email: s.string({ format: "email" }),
+                        code: s.string({ minLength: 1 }).optional(),
+                     }),
+                  ),
+                  jsc("query", s.object({ redirect: s.string().optional() })),
+                  async (c) => {
+                     const { email, code, ...rest } = c.req.valid("json");
+                     const { redirect } = c.req.valid("query");
+
+                     // throw if user exists
+                     if (!(await threwAsync(findUser(app, email)))) {
+                        throw new Exception("User already exists", HttpStatus.BAD_REQUEST);
+                     }
+
+                     if (code) {
+                        const otpData = await getValidatedCode(
+                           app,
+                           entityName,
+                           email,
+                           code,
+                           "register",
+                        );
+                        await em.mutator(entityName).updateOne(otpData.id, { used_at: new Date() });
+
+                        const user = await app.createUser({
+                           ...rest,
+                           email,
+                           password: randomString(32, true),
+                        });
+
+                        const jwt = await auth.authenticator.jwt(user);
+                        // @ts-expect-error private method
+                        return auth.authenticator.respondWithUser(
+                           c,
+                           { user, token: jwt },
+                           { redirect },
+                        );
+                     } else {
+                        const otpData = await invalidateAndGenerateCode(
+                           app,
+                           { generateCode, ttl, entity: entityName },
+                           { email },
+                           "register",
+                        );
+                        if (sendEmail) {
+                           await sendCode(app, otpData, { generateEmail });
+                        }
+
+                        return c.json(
+                           {
+                              sent: true,
+                              data: pickKeys(otpData, ["email", "action", "expires_at"]),
+                           },
+                           HttpStatus.CREATED,
+                        );
+                     }
+                  },
+               )
+               .onError((err) => {
+                  if (showActualErrors || err instanceof OTPError) {
+                     throw err;
+                  }
+
+                  throw new Exception("Invalid credentials", HttpStatus.BAD_REQUEST);
+               });
+
+            app.server.route(apiBasePath, hono);
+
+            if (allowExternalMutations !== true) {
+               registerListeners(app, entityName);
+            }
+         },
+      };
+   };
+}
+
+async function findUser(app: App, email: string) {
+   const user_entity = app.module.auth.config.entity_name as "users";
+   const { data: user } = await app.em.repo(user_entity).findOne({ email });
+   if (!user) {
+      throw new Exception("User not found", HttpStatus.BAD_REQUEST);
+   }
+
+   return user;
+}
+
+async function invalidateAndGenerateCode(
+   app: App,
+   opts: Required<Pick<EmailOTPPluginOptions, "generateCode" | "ttl" | "entity">>,
+   user: Pick<DB["users"], "email">,
+   action: EmailOTPFieldSchema["action"],
+) {
+   const { generateCode, ttl, entity: entityName } = opts;
+   const newCode = generateCode?.(user);
+   if (!newCode) {
+      throw new OTPError("Failed to generate code");
+   }
+
+   await invalidateAllUserCodes(app, entityName, user.email, ttl);
+   const { data: otpData } = await app.em
+      .fork()
+      .mutator(entityName)
+      .insertOne({
+         code: newCode,
+         email: user.email,
+         action,
+         created_at: new Date(),
+         expires_at: new Date(Date.now() + ttl * 1000),
+      });
+
+   $console.log("[OTP Code]", newCode);
+
+   return otpData;
+}
+
+async function sendCode(
+   app: App,
+   otpData: EmailOTPFieldSchema,
+   opts: Required<Pick<EmailOTPPluginOptions, "generateEmail">>,
+) {
+   const { generateEmail } = opts;
+   const { subject, body } = await generateEmail(otpData);
+   await app.drivers?.email?.send(otpData.email, subject, body);
+}
+
+async function getValidatedCode(
+   app: App,
+   entityName: string,
+   email: string,
+   code: string,
+   action: EmailOTPFieldSchema["action"],
+) {
+   invariant(email, "[OTP Plugin]: Email is required");
+   invariant(code, "[OTP Plugin]: Code is required");
+   const em = app.em.fork();
+   const { data: otpData } = await em.repo(entityName).findOne({ email, code, action });
+   if (!otpData) {
+      throw new OTPError("Invalid code");
+   }
+
+   if (otpData.expires_at < new Date()) {
+      throw new OTPError("Code expired");
+   }
+
+   if (otpData.used_at) {
+      throw new OTPError("Code already used");
+   }
+
+   return otpData;
+}
+
+async function invalidateAllUserCodes(app: App, entityName: string, email: string, ttl: number) {
+   invariant(ttl > 0, "[OTP Plugin]: TTL must be greater than 0");
+   invariant(email, "[OTP Plugin]: Email is required");
+   const em = app.em.fork();
+   await em
+      .mutator(entityName)
+      .updateWhere(
+         { expires_at: new Date(Date.now() - 1000) },
+         { email, used_at: { $isnull: true } },
+      );
+}
+
+function registerListeners(app: App, entityName: string) {
+   [DatabaseEvents.MutatorInsertBefore, DatabaseEvents.MutatorUpdateBefore].forEach((event) => {
+      app.emgr.onEvent(
+         event,
+         (e: { params: { entity: { name: string } } }) => {
+            if (e.params.entity.name === entityName) {
+               throw new OTPError("Mutations of the OTP entity are not allowed");
+            }
+         },
+         {
+            mode: "sync",
+            id: "bknd-email-otp",
+         },
+      );
+   });
+}
@@ -8,3 +8,4 @@ export { syncConfig, type SyncConfigOptions } from "./dev/sync-config.plugin";
 export { syncTypes, type SyncTypesOptions } from "./dev/sync-types.plugin";
 export { syncSecrets, type SyncSecretsOptions } from "./dev/sync-secrets.plugin";
 export { timestamps, type TimestampsPluginOptions } from "./data/timestamps.plugin";
+export { emailOTP, type EmailOTPPluginOptions } from "./auth/email-otp.plugin";
@@ -5,7 +5,7 @@ import { BkndProvider } from "ui/client/bknd";
 import { useTheme, type AppTheme } from "ui/client/use-theme";
 import { Logo } from "ui/components/display/Logo";
 import * as AppShell from "ui/layouts/AppShell/AppShell";
-import { ClientProvider, useBkndWindowContext, type ClientProviderProps } from "./client";
+import { ClientProvider, useBkndWindowContext, type ClientProviderProps } from "bknd/client";
 import { createMantineTheme } from "./lib/mantine/theme";
 import { Routes } from "./routes";
 import type { BkndAdminAppShellOptions, BkndAdminEntitiesOptions } from "./options";
@@ -52,26 +52,30 @@ export type BkndAdminProps = {
   children?: ReactNode;
 };

-export default function Admin({
-   baseUrl: baseUrlOverride,
-   withProvider = false,
-   config: _config = {},
-   children,
-}: BkndAdminProps) {
-   const { theme } = useTheme();
+export default function Admin(props: BkndAdminProps) {
   const Provider = ({ children }: any) =>
-      withProvider ? (
+      props.withProvider ? (
         <ClientProvider
-            baseUrl={baseUrlOverride}
-            {...(typeof withProvider === "object" ? withProvider : {})}
+            baseUrl={props.baseUrl}
+            {...(typeof props.withProvider === "object" ? props.withProvider : {})}
         >
            {children}
         </ClientProvider>
      ) : (
         children
      );
+
+   return (
+      <Provider>
+         <AdminInner {...props} />
+      </Provider>
+   );
+}
+
+function AdminInner(props: BkndAdminProps) {
+   const { theme } = useTheme();
   const config = {
-      ..._config,
+      ...props.config,
      ...useBkndWindowContext(),
   };

@@ -82,14 +86,12 @@ export default function Admin({
   );

   return (
-      <Provider>
-         <MantineProvider {...createMantineTheme(theme as any)}>
-            <Notifications position="top-right" />
-            <Routes BkndWrapper={BkndWrapper} basePath={config?.basepath}>
-               {children}
-            </Routes>
-         </MantineProvider>
-      </Provider>
+      <MantineProvider {...createMantineTheme(theme as any)}>
+         <Notifications position="top-right" />
+         <Routes BkndWrapper={BkndWrapper} basePath={config?.basepath}>
+            {props.children}
+         </Routes>
+      </MantineProvider>
   );
 }

@@ -9,7 +9,7 @@ import {
   useState,
   type ReactNode,
 } from "react";
-import { useApi } from "ui/client";
+import { useApi } from "bknd/client";
 import { type TSchemaActions, getSchemaActions } from "./schema/actions";
 import { AppReduced } from "./utils/AppReduced";
 import { Message } from "ui/components/display/Message";
@@ -14,18 +14,20 @@ const ClientContext = createContext<BkndClientContext>(undefined!);
 export type ClientProviderProps = {
   children?: ReactNode;
   baseUrl?: string;
+   api?: Api;
 } & ApiOptions;

 export const ClientProvider = ({
   children,
   host,
   baseUrl: _baseUrl = host,
+   api: _api,
   ...props
 }: ClientProviderProps) => {
   const winCtx = useBkndWindowContext();
   const _ctx = useClientContext();
   let actualBaseUrl = _baseUrl ?? _ctx?.baseUrl ?? "";
-   let user: any = undefined;
+   let user: any;

   if (winCtx) {
      user = winCtx.user;
@@ -40,6 +42,7 @@ export const ClientProvider = ({
   const apiProps = { user, ...props, host: actualBaseUrl };
   const api = useMemo(
      () =>
+         _api ??
         new Api({
            ...apiProps,
            verbose: isDebug(),
@@ -50,7 +53,7 @@ export const ClientProvider = ({
               }
            },
         }),
-      [JSON.stringify(apiProps)],
+      [_api, JSON.stringify(apiProps)],
   );

   const [authState, setAuthState] = useState<Partial<AuthState> | undefined>(api.getAuthState());
@@ -64,9 +67,14 @@ export const ClientProvider = ({

 export const useApi = (host?: ApiOptions["host"]): Api => {
   const context = useContext(ClientContext);
+
   if (!context?.api || (host && host.length > 0 && host !== context.baseUrl)) {
+      console.info("creating new api", { host });
      return new Api({ host: host ?? "" });
   }
+   if (!context) {
+      throw new Error("useApi must be used within a ClientProvider");
+   }

   return context.api;
 };
@@ -2,7 +2,7 @@ import type { Api } from "Api";
 import { FetchPromise, type ModuleApi, type ResponseObject } from "modules/ModuleApi";
 import useSWR, { type SWRConfiguration, useSWRConfig, type Middleware, type SWRHook } from "swr";
 import useSWRInfinite from "swr/infinite";
-import { useApi } from "ui/client";
+import { useApi } from "../ClientProvider";
 import { useState } from "react";

 export const useApiQuery = <
@@ -10,7 +10,7 @@ import type {
 import { objectTransform, encodeSearch } from "bknd/utils";
 import type { Insertable, Selectable, Updateable, Generated } from "kysely";
 import useSWR, { type SWRConfiguration, type SWRResponse, mutate } from "swr";
-import { type Api, useApi } from "ui/client";
+import { type Api, useApi } from "bknd/client";

 export class UseEntityApiError<Payload = any> extends Error {
   constructor(
@@ -4,6 +4,7 @@ export {
   type ClientProviderProps,
   useApi,
   useBaseUrl,
+   useClientContext
 } from "./ClientProvider";

 export * from "./api/use-api";
@@ -1,7 +1,6 @@
 import type { AuthState } from "Api";
 import type { AuthResponse } from "bknd";
-import { useApi, useInvalidate } from "ui/client";
-import { useClientContext } from "ui/client/ClientProvider";
+import { useApi, useInvalidate, useClientContext } from "bknd/client";

 type LoginData = {
   email: string;
@@ -19,6 +18,7 @@ type UseAuth = {
   logout: () => Promise<void>;
   verify: () => Promise<void>;
   setToken: (token: string) => void;
+   local: boolean;
 };

 export const useAuth = (options?: { baseUrl?: string }): UseAuth => {
@@ -61,5 +61,6 @@ export const useAuth = (options?: { baseUrl?: string }): UseAuth => {
      logout,
      setToken,
      verify,
+      local: !!api.options.storage,
   };
 };
@@ -1,6 +1,5 @@
 import type React from "react";
-import { Children } from "react";
-import { forwardRef } from "react";
+import { Children, forwardRef } from "react";
 import { twMerge } from "tailwind-merge";
 import { Link } from "ui/components/wouter/Link";

@@ -1,6 +1,6 @@
 import { Tooltip } from "@mantine/core";
 import clsx from "clsx";
-import { getBrowser } from "core/utils";
+import { getBrowser } from "bknd/utils";
 import type { Field } from "data/fields";
 import { Switch as RadixSwitch } from "radix-ui";
 import {
@@ -16,15 +16,18 @@ import {
   setPath,
 } from "./utils";

-export type NativeFormProps = {
+export type NativeFormProps = Omit<ComponentPropsWithoutRef<"form">, "onChange" | "onSubmit"> & {
   hiddenSubmit?: boolean;
   validateOn?: "change" | "submit";
-   errorFieldSelector?: <K extends keyof HTMLElementTagNameMap>(name: string) => any | null;
+   errorFieldSelector?: (selector: string) => any | null;
   reportValidity?: boolean;
-   onSubmit?: (data: any, ctx: { event: FormEvent<HTMLFormElement> }) => Promise<void> | void;
+   onSubmit?: (
+      data: any,
+      ctx: { event: FormEvent<HTMLFormElement>; form: HTMLFormElement },
+   ) => Promise<void> | void;
   onSubmitInvalid?: (
      errors: InputError[],
-      ctx: { event: FormEvent<HTMLFormElement> },
+      ctx: { event: FormEvent<HTMLFormElement>; form: HTMLFormElement },
   ) => Promise<void> | void;
   onError?: (errors: InputError[]) => void;
   disableSubmitOnError?: boolean;
@@ -33,7 +36,7 @@ export type NativeFormProps = {
      ctx: { event: ChangeEvent<HTMLFormElement>; key: string; value: any; errors: InputError[] },
   ) => Promise<void> | void;
   clean?: CleanOptions | true;
-} & Omit<ComponentPropsWithoutRef<"form">, "onChange" | "onSubmit">;
+};

 export type InputError = {
   name: string;
@@ -188,12 +191,12 @@ export function NativeForm({

      const errors = validate({ report: true });
      if (errors.length > 0) {
-         onSubmitInvalid?.(errors, { event: e });
+         onSubmitInvalid?.(errors, { event: e, form });
         return;
      }

      if (onSubmit) {
-         await onSubmit(getFormValues(), { event: e });
+         await onSubmit(getFormValues(), { event: e, form });
      } else {
         form.submit();
      }
@@ -1,5 +1,4 @@
-import { useInsertionEffect, useRef } from "react";
-import { type LinkProps, Link as WouterLink, useRoute, useRouter } from "wouter";
+import { type LinkProps, Link as WouterLink, useRouter } from "wouter";
 import { useEvent } from "../../hooks/use-event";

 /*
@@ -1,13 +1,16 @@
 import type { AppAuthOAuthStrategy, AppAuthSchema } from "auth/auth-schema";
 import clsx from "clsx";
 import { NativeForm } from "ui/components/form/native-form/NativeForm";
-import { transform } from "lodash-es";
-import type { ComponentPropsWithoutRef } from "react";
+import { transformObject } from "bknd/utils";
+import { useEffect, useState, type ComponentPropsWithoutRef, type FormEvent } from "react";
 import { Button } from "ui/components/buttons/Button";
 import { Group, Input, Password, Label } from "ui/components/form/Formy/components";
 import { SocialLink } from "./SocialLink";
+import { useAuth } from "bknd/client";
+import { Alert } from "ui/components/display/Alert";
+import { useLocation } from "wouter";

-export type LoginFormProps = Omit<ComponentPropsWithoutRef<"form">, "onSubmit" | "action"> & {
+export type LoginFormProps = Omit<ComponentPropsWithoutRef<"form">, "action"> & {
   className?: string;
   formData?: any;
   action: "login" | "register";
@@ -23,25 +26,50 @@ export function AuthForm({
   action,
   auth,
   buttonLabel = action === "login" ? "Sign in" : "Sign up",
+   onSubmit: _onSubmit,
   ...props
 }: LoginFormProps) {
+   const $auth = useAuth();
   const basepath = auth?.basepath ?? "/api/auth";
+   const [error, setError] = useState<string>();
+   const [, navigate] = useLocation();
   const password = {
      action: `${basepath}/password/${action}`,
      strategy: auth?.strategies?.password ?? ({ type: "password" } as const),
   };

-   const oauth = transform(
-      auth?.strategies ?? {},
-      (result, value, key) => {
-         if (value.type !== "password") {
-            result[key] = value.config;
-         }
-      },
-      {},
-   ) as Record<string, AppAuthOAuthStrategy>;
+   const oauth = transformObject(auth?.strategies ?? {}, (value) => {
+      return value.type !== "password" ? value.config : undefined;
+   }) as Record<string, AppAuthOAuthStrategy>;
   const has_oauth = Object.keys(oauth).length > 0;

+   async function onSubmit(
+      data: any,
+      ctx: { event: FormEvent<HTMLFormElement>; form: HTMLFormElement },
+   ) {
+      if ($auth?.local) {
+         ctx.event.preventDefault();
+
+         const res = await $auth.login(data);
+         if ("token" in res) {
+            navigate("/");
+         } else {
+            setError((res as any).error);
+            return;
+         }
+      }
+
+      await _onSubmit?.(ctx.event);
+      // submit form
+      ctx.form.submit();
+   }
+
+   useEffect(() => {
+      if ($auth.user) {
+         navigate("/");
+      }
+   }, [$auth.user]);
+
   return (
      <div className="flex flex-col gap-4 w-full">
         {has_oauth && (
@@ -63,17 +91,19 @@ export function AuthForm({
         <NativeForm
            method={method}
            action={password.action}
+            onSubmit={onSubmit}
            {...(props as any)}
            validateOn="change"
            className={clsx("flex flex-col gap-3 w-full", className)}
         >
+            {error && <Alert.Exception message={error} className="justify-center" />}
            <Group>
               <Label htmlFor="email">Email address</Label>
               <Input type="email" name="email" required />
            </Group>
            <Group>
               <Label htmlFor="password">Password</Label>
-               <Password name="password" required minLength={8} />
+               <Password name="password" required minLength={1} />
            </Group>

            <Button
@@ -1,4 +1,4 @@
-import { ucFirstAllSnakeToPascalWithSpaces } from "core/utils";
+import { ucFirstAllSnakeToPascalWithSpaces } from "bknd/utils";
 import type { ReactNode } from "react";
 import { Button } from "ui/components/buttons/Button";
 import type { IconType } from "ui/components/buttons/IconButton";
@@ -1,9 +1,11 @@
 import type { AppAuthSchema } from "auth/auth-schema";
 import { useEffect, useState } from "react";
-import { useApi } from "ui/client";
+import { useApi } from "bknd/client";

 type AuthStrategyData = Pick<AppAuthSchema, "strategies" | "basepath">;
-export const useAuthStrategies = (options?: { baseUrl?: string }): Partial<AuthStrategyData> & {
+export const useAuthStrategies = (options?: {
+   baseUrl?: string;
+}): Partial<AuthStrategyData> & {
   loading: boolean;
 } => {
   const [data, setData] = useState<AuthStrategyData>();
@@ -14,7 +14,7 @@ import { isFileAccepted } from "bknd/utils";
 import { type FileWithPath, useDropzone } from "./use-dropzone";
 import { checkMaxReached } from "./helper";
 import { DropzoneInner } from "./DropzoneInner";
-import { createDropzoneStore } from "ui/elements/media/dropzone-state";
+import { createDropzoneStore } from "./dropzone-state";
 import { useStore } from "zustand";

 export type FileState = {
@@ -1,9 +1,8 @@
-import type { Api } from "bknd/client";
 import type { PrimaryFieldType, RepoQueryIn } from "bknd";
 import type { MediaFieldSchema } from "media/AppMedia";
 import type { TAppMediaConfig } from "media/media-schema";
 import { useId, useEffect, useRef, useState } from "react";
-import { useApi, useApiInfiniteQuery, useApiQuery, useInvalidate } from "bknd/client";
+import { type Api, useApi, useApiInfiniteQuery, useApiQuery, useInvalidate } from "bknd/client";
 import { useEvent } from "ui/hooks/use-event";
 import { Dropzone, type DropzoneProps } from "./Dropzone";
 import { mediaItemsToFileStates } from "./helper";
@@ -132,26 +131,24 @@ export function DropzoneContainer({
   }

   return (
-      <>
-         <Dropzone
-            key={key}
-            getUploadInfo={getUploadInfo}
-            handleDelete={handleDelete}
-            autoUpload
-            initialItems={_initialItems}
-            footer={
-               infinite &&
-               "setSize" in $q && (
-                  <Footer
-                     items={_initialItems.length}
-                     length={placeholderLength}
-                     onFirstVisible={() => $q.setSize($q.size + 1)}
-                  />
-               )
-            }
-            {...props}
-         />
-      </>
+      <Dropzone
+         key={key}
+         getUploadInfo={getUploadInfo}
+         handleDelete={handleDelete}
+         autoUpload
+         initialItems={_initialItems}
+         footer={
+            infinite &&
+            "setSize" in $q && (
+               <Footer
+                  items={_initialItems.length}
+                  length={placeholderLength}
+                  onFirstVisible={() => $q.setSize($q.size + 1)}
+               />
+            )
+         }
+         {...props}
+      />
   );
 }

@@ -19,8 +19,8 @@ import {
 } from "react-icons/tb";
 import { Dropdown, type DropdownItem } from "ui/components/overlay/Dropdown";
 import { IconButton } from "ui/components/buttons/IconButton";
-import { formatNumber } from "core/utils";
-import type { DropzoneRenderProps, FileState } from "ui/elements";
+import { formatNumber } from "bknd/utils";
+import type { DropzoneRenderProps, FileState } from "./Dropzone";
 import { useDropzoneFileState, useDropzoneState } from "./Dropzone";

 function handleUploadError(e: unknown) {
@@ -474,6 +474,7 @@ type SectionHeaderAccordionItemProps = {
   ActiveIcon?: any;
   children?: React.ReactNode;
   renderHeaderRight?: (props: { open: boolean }) => React.ReactNode;
+   scrollContainerRef?: React.RefObject<HTMLDivElement>;
 };

 export const SectionHeaderAccordionItem = ({
@@ -483,6 +484,7 @@ export const SectionHeaderAccordionItem = ({
   ActiveIcon = IconChevronUp,
   children,
   renderHeaderRight,
+   scrollContainerRef,
 }: SectionHeaderAccordionItemProps) => (
   <div
      style={{ minHeight: 49 }}
@@ -493,6 +495,8 @@ export const SectionHeaderAccordionItem = ({
            : "flex-initial cursor-pointer hover:bg-primary/5",
      )}
   >
+      {/** biome-ignore lint/a11y/noStaticElementInteractions: . */}
+      {/** biome-ignore lint/a11y/useKeyWithClickEvents: . */}
      <div
         className={twMerge(
            "flex flex-row bg-muted/10 border-muted border-b h-14 py-4 pr-4 pl-2 items-center gap-2",
@@ -501,14 +505,12 @@ export const SectionHeaderAccordionItem = ({
      >
         <IconButton Icon={open ? ActiveIcon : IconChevronDown} disabled={open} />
         <h2 className="text-lg dark:font-bold font-semibold select-text">{title}</h2>
-         <div className="flex flex-grow" />
+         <div className="flex grow" />
         {renderHeaderRight?.({ open })}
      </div>
      <div
-         className={twMerge(
-            "overflow-y-scroll transition-all",
-            open ? " flex-grow" : "h-0 opacity-0",
-         )}
+         ref={scrollContainerRef}
+         className={twMerge("overflow-y-scroll transition-all", open ? " grow" : "h-0 opacity-0")}
      >
         {children}
      </div>
@@ -518,14 +520,25 @@ export const SectionHeaderAccordionItem = ({
 export const RouteAwareSectionHeaderAccordionItem = ({
   routePattern,
   identifier,
+   renderHeaderRight,
   ...props
-}: Omit<SectionHeaderAccordionItemProps, "open" | "toggle"> & {
+}: Omit<SectionHeaderAccordionItemProps, "open" | "toggle" | "renderHeaderRight"> & {
+   renderHeaderRight?: (props: { open: boolean; active: boolean }) => React.ReactNode;
   // it's optional because it could be provided using the context
   routePattern?: string;
   identifier: string;
 }) => {
   const { active, toggle } = useRoutePathState(routePattern, identifier);
-   return <SectionHeaderAccordionItem {...props} open={active} toggle={toggle} />;
+   return (
+      <SectionHeaderAccordionItem
+         {...props}
+         open={active}
+         toggle={toggle}
+         renderHeaderRight={
+            renderHeaderRight && ((props) => renderHeaderRight?.({ open: props.open, active }))
+         }
+      />
+   );
 };

 export const Separator = ({ className, ...props }: ComponentPropsWithoutRef<"hr">) => (
@@ -1,4 +1,4 @@
-import { SegmentedControl, Tooltip } from "@mantine/core";
+import { SegmentedControl } from "@mantine/core";
 import { IconApi, IconBook, IconKeyOff, IconSettings, IconUser } from "@tabler/icons-react";
 import {
   TbDatabase,
@@ -10,7 +10,7 @@ import {
   TbUser,
   TbX,
 } from "react-icons/tb";
-import { useAuth, useBkndWindowContext } from "ui/client";
+import { useAuth, useBkndWindowContext } from "bknd/client";
 import { useBknd } from "ui/client/bknd";
 import { useTheme } from "ui/client/use-theme";
 import { Button } from "ui/components/buttons/Button";
@@ -24,34 +24,35 @@ import { useLocation } from "wouter";
 import { NavLink } from "./AppShell";
 import { autoFormatString } from "core/utils";
 import { appShellStore } from "ui/store";
-import { getVersion } from "core/env";
+import { getVersion, isDebug } from "core/env";
 import { McpIcon } from "ui/routes/tools/mcp/components/mcp-icon";
 import { useAppShellAdminOptions } from "ui/options";

 export function HeaderNavigation() {
   const [location, navigate] = useLocation();
+   const { config } = useBknd();

   const items: {
      label: string;
      href: string;
-      Icon: any;
+      Icon?: any;
      exact?: boolean;
      tooltip?: string;
      disabled?: boolean;
   }[] = [
-      /*{
-         label: "Base",
-         href: "#",
-         exact: true,
-         Icon: TbLayoutDashboard,
-         disabled: true,
-         tooltip: "Coming soon"
-      },*/
      { label: "Data", href: "/data", Icon: TbDatabase },
      { label: "Auth", href: "/auth", Icon: TbFingerprint },
      { label: "Media", href: "/media", Icon: TbPhoto },
-      { label: "Flows", href: "/flows", Icon: TbHierarchy2 },
   ];
+
+   if (isDebug() || Object.keys(config.flows?.flows ?? {}).length > 0) {
+      items.push({ label: "Flows", href: "/flows", Icon: TbHierarchy2 });
+   }
+
+   if (config.server.mcp.enabled) {
+      items.push({ label: "MCP", href: "/tools/mcp", Icon: McpIcon });
+   }
+
   const activeItem = items.find((item) =>
      item.exact ? location === item.href : location.startsWith(item.href),
   );
@@ -154,8 +155,10 @@ function UserMenu() {

   async function handleLogout() {
      await auth.logout();
-      // @todo: grab from somewhere constant
-      navigate(logout_route, { reload: true });
+
+      if (!auth.local) {
+         navigate(logout_route, { reload: true });
+      }
   }

   async function handleLogin() {
@@ -1,6 +1,6 @@
 import type { ContextModalProps } from "@mantine/modals";
 import { type ReactNode, useEffect, useMemo, useState } from "react";
-import { useEntityQuery } from "ui/client";
+import { useEntityQuery } from "bknd/client";
 import { type FileState, Media } from "ui/elements";
 import { autoFormatString, datetimeStringLocal, formatNumber } from "core/utils";
 import { twMerge } from "tailwind-merge";
@@ -1,4 +1,4 @@
-import { useApi, useInvalidate } from "ui/client";
+import { useApi, useInvalidate } from "bknd/client";
 import { useBkndAuth } from "ui/client/schema/auth/use-bknd-auth";
 import { routes, useNavigate } from "ui/lib/routes";
 import { bkndModals } from "ui/modals";
@@ -4,7 +4,7 @@ import type { EntityData } from "bknd";
 import type { RelationField } from "data/relations";
 import { useEffect, useRef, useState } from "react";
 import { TbEye } from "react-icons/tb";
-import { useEntityQuery } from "ui/client";
+import { useEntityQuery } from "bknd/client";
 import { useBknd } from "ui/client/bknd";
 import { Button } from "ui/components/buttons/Button";
 import * as Formy from "ui/components/form/Formy";
@@ -1,6 +1,6 @@
 import clsx from "clsx";
 import { TbArrowRight, TbCircle, TbCircleCheckFilled, TbFingerprint } from "react-icons/tb";
-import { useApiQuery } from "ui/client";
+import { useApiQuery } from "bknd/client";
 import { useBknd } from "ui/client/bknd";
 import { useBkndAuth } from "ui/client/schema/auth/use-bknd-auth";
 import { ButtonLink, type ButtonLinkProps } from "ui/components/buttons/Button";
@@ -35,7 +35,7 @@ import { SegmentedControl, Tooltip } from "@mantine/core";
 import { Popover } from "ui/components/overlay/Popover";
 import { cn } from "ui/lib/utils";
 import { JsonViewer } from "ui/components/code/JsonViewer";
-import { mountOnce, useApiQuery } from "ui/client";
+import { mountOnce, useApiQuery } from "bknd/client";
 import { CodePreview } from "ui/components/code/CodePreview";
 import type { JsonError } from "json-schema-library";
 import { Alert } from "ui/components/display/Alert";
@@ -378,11 +378,7 @@ function replaceEntitiesEnum(schema: Record<string, any>, entities: string[]) {
   });
 }

-const Policy = ({
-   permission,
-}: {
-   permission: TPermission;
-}) => {
+const Policy = ({ permission }: { permission: TPermission }) => {
   const { value } = useDerivedFieldContext("", ({ value }) => ({
      effect: (value?.effect ?? "allow") as "allow" | "deny" | "filter",
   }));
@@ -503,22 +499,24 @@ const CustomFieldWrapper = ({
                        className: "max-w-none",
                     }}
                     position="bottom-end"
-                     target={() =>
-                        typeof schema.content === "object" ? (
-                           <JsonViewer
-                              className="w-auto max-w-120 bg-background pr-3 text-sm"
-                              json={schema.content}
-                              title={schema.name}
-                              expand={5}
-                           />
-                        ) : (
-                           <CodePreview
-                              code={schema.content}
-                              lang="typescript"
-                              className="w-auto max-w-120 bg-background p-3 text-sm"
-                           />
-                        )
-                     }
+                     target={() => (
+                        <div className="w-auto max-w-[80vw] md:max-w-120 bg-background overflow-scroll">
+                           {typeof schema.content === "object" ? (
+                              <JsonViewer
+                                 className="pr-3 text-sm"
+                                 json={schema.content}
+                                 title={schema.name}
+                                 expand={5}
+                              />
+                           ) : (
+                              <CodePreview
+                                 code={schema.content}
+                                 lang="typescript"
+                                 className="p-3 text-sm"
+                              />
+                           )}
+                        </div>
+                     )}
                  >
                     <Button variant="ghost" size="smaller" IconLeft={TbCodeDots}>
                        {autoFormatString(schema.name)}
@@ -3,7 +3,7 @@ import { ucFirst } from "bknd/utils";
 import type { Entity, EntityData, EntityRelation } from "bknd";
 import { Fragment, useState } from "react";
 import { TbDots } from "react-icons/tb";
-import { useApiQuery, useEntityQuery } from "ui/client";
+import { useApiQuery, useEntityQuery } from "bknd/client";
 import { useBkndData } from "ui/client/schema/data/use-bknd-data";
 import { Button } from "ui/components/buttons/Button";
 import { IconButton } from "ui/components/buttons/IconButton";
@@ -1,6 +1,6 @@
 import type { EntityData } from "bknd";
 import { useState } from "react";
-import { useEntityMutate } from "ui/client";
+import { useEntityMutate } from "bknd/client";
 import { useBkndData } from "ui/client/schema/data/use-bknd-data";
 import { Button } from "ui/components/buttons/Button";
 import { Message } from "ui/components/display/Message";
@@ -2,7 +2,7 @@ import type { Entity } from "bknd";
 import { repoQuery } from "data/server/query";
 import { Fragment } from "react";
 import { TbDots } from "react-icons/tb";
-import { useApiQuery } from "ui/client";
+import { useApiQuery } from "bknd/client";
 import { useBknd } from "ui/client/bknd";
 import { useBkndData } from "ui/client/schema/data/use-bknd-data";
 import { Button } from "ui/components/buttons/Button";
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Cameron Pak	99c783e7f0	rm plan doc	2026-03-07 10:34:01 -06:00
Cameron Pak	4defc4d1e7	refactor(cli): use errore for typed error handling in run command Replace untyped catch blocks and scattered process.exit() with errore tagged errors and error-as-values pattern. Compile-time safety for error handling paths. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-07 10:30:21 -06:00
Cameron Pak	fd1323fecc	Add simplified command to build bknd	2026-03-07 10:05:15 -06:00
Cameron Pak	44d7c092f8	fix(cli): detect bun: protocol imports and re-exec under Bun Catch ERR_UNSUPPORTED_ESM_URL_SCHEME with bun: protocol in addition to ReferenceError "Bun is not defined" when deciding to re-exec. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-07 10:02:16 -06:00
Cameron Pak	45cf746855	fix(cli): refine type-stripping version check and add build:all script Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-07 10:02:11 -06:00
Cameron Pak	db961b5447	fix(cli): replace jiti with Node native type-stripping for TS configs Drop jiti dependency. Node >=22.18 imports .ts natively; 22.13–22.17 re-execs with --experimental-strip-types. Bun re-exec unchanged.	2026-03-07 09:50:56 -06:00
Cameron Pak	48d432ddb2	fix(cli): add re-exec loop guard and robust Bun error matching Prevent infinite re-exec loop when Bun is installed but config still fails. Use regex for error matching instead of exact string comparison. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-07 08:55:37 -06:00
Cameron Pak	980886b5c5	fix(cli): fix TS2345 for process.argv[1] type narrowing Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-07 08:48:16 -06:00
Cameron Pak	827e7faa7f	fix(cli): support loading bknd.config.ts and detect runtime mismatch Add jiti to handle TypeScript config imports natively in the CLI, removing the need for npx tsx or --experimental-strip-types workarounds. Detect Bun adapter usage under Node and suggest running CLI with the correct runtime. Closes #360	2026-03-07 08:41:04 -06:00
Cameron Pak	e6b17f6424	fix(cli): support loading bknd.config.ts without tsx workaround Add jiti as a dependency to handle TypeScript config imports natively in the CLI, removing the need for npx tsx or --experimental-strip-types workarounds. Closes #360	2026-03-07 08:06:51 -06:00
Cameron Pak	7832328a50	Merge pull request #359 from jonaspm/patch-1 Update client:only attribute in astro.mdx	2026-03-03 11:37:59 -06:00
Jonás Perusquía Morales	e5bfc602e1	Update client:only attribute in astro.mdx Astro requires client:only to specify the frontend library used	2026-03-03 11:27:59 -06:00
Cameron Pak	3894271b17	Merge pull request #353 from jonaspm/docs/auth-change-password docs: Document changePassword method in auth module	2026-02-28 11:38:33 -06:00
Jonas Perusquia Morales	cc1e1976f7	chore: Document error cases for password update method	2026-02-23 13:03:37 -06:00
dswbx	224d98879a	Merge pull request #356 from jonaspm/fix/cross-platform-cleanup Make dist clean cross-platform without shell commands	2026-02-20 18:00:46 +01:00
Jonas Perusquia Morales	d1522c97ea	Make dist clean cross-platform without shell commands	2026-02-20 09:50:30 -06:00
Jonas Perusquia Morales	8805f017a1	Update auth docs to clarify server module usage	2026-02-18 11:12:14 -06:00
Jonas Perusquia Morales	0ef06375c0	docs: Document changePassword method in auth module	2026-02-18 11:03:58 -06:00
dswbx	3d5c2cd3a8	Merge pull request #350 from xretic/main refactor adapter tests for improved structure	2026-02-11 10:02:56 +01:00
roma	fc60dfd042	refactor adapter tests for improved structure reduced test duplication by extracting a small helper to strip connection from configs	2026-02-09 03:07:58 +01:00
Cameron Pak	c8ee30b3da	Merge pull request #348 from bknd-io/intro-docs-updates Docs: consolidate dual introductions, restructure setup page	2026-02-07 17:23:21 -06:00
Cameron Pak	b85c3a8a9b	Remove redundant redirects config	2026-02-07 17:17:36 -06:00
Cameron Pak	e20c2ef92c	Docs: move redirects to global config, remove client-side redirect page Co-Authored-By: Craft Agent <agents-noreply@craft.do>	2026-02-07 17:14:11 -06:00
Cameron Pak	5873baad3c	Docs: add redirect from /usage/introduction to /usage/setup Co-Authored-By: Craft Agent <agents-noreply@craft.do>	2026-02-07 17:09:36 -06:00
Cameron Pak	aca162f9c8	Refactor setup documentation for clarity	2026-02-07 16:58:49 -06:00
Cameron Pak	9f0997c28a	Refactor and update documentation links for introduction	2026-02-07 16:50:51 -06:00
dswbx	68063986d1	Merge pull request #343 from cameronapak/doc-touchups	2026-01-31 11:22:25 +01:00
Cameron Pak	53f8609e9d	Docs: updating copy to reflect bknd's open opt-in philosophy	2026-01-30 03:39:53 -06:00
Cameron Pak	833bfa5049	Docs: Enhance the pun https://github.com/bknd-io/bknd/pull/343#discussion_r2743055999	2026-01-30 03:28:12 -06:00
dswbx	defcdfef0b	Merge pull request #342 from cameronapak/guard-config Docs: Guard lockout and how to set up Guard properly	2026-01-29 19:39:42 +01:00
cameronapak	348ac7f8b0	Docs: Refactor start page for clarity and flow	2026-01-25 15:20:20 -06:00
cameronapak	16b1cde8ea	Docs: Add beta warning callout to start page	2026-01-25 13:58:43 -06:00
cameronapak	436b195242	Docs: Add warning about Guard lockout Adds a callout to the `config.mdx` documentation warning users that enabling the Guard without first creating an admin user will lock them out.	2026-01-25 13:30:31 -06:00
dswbx	ccd504440e	Merge pull request #340 from bknd-io/chore/license update license to Apache-2.0 in package.json	2026-01-21 13:30:02 +01:00
dswbx	023f5391e4	chore: update license to Apache-2.0 in package.json	2026-01-21 11:02:18 +01:00
dswbx	9685c5d4e1	Merge pull request #337 from jonaspm/chore/upgrade-astro-version chore: Update Astro to version 5.16.9 in example package	2026-01-15 14:25:20 +01:00
Jonas Perusquia Morales	9b008be512	chore: Update Astro to version 5.16.9 in example package	2026-01-14 12:52:38 -06:00
dswbx	5352331464	Merge pull request #327 from matschik/main docs(cloudflare): fix import in Cloudflare configuration example	2026-01-11 19:32:50 +01:00
dswbx	0e4f25cf11	refactor: update type handling in SvelteKit adapter tests and MediaApi uploadFile method	2026-01-09 14:51:42 +01:00
dswbx	4a5bdade8d	fix: handle lazy import errors for TestRoutes in development for nextjs	2026-01-09 14:42:18 +01:00
dswbx	047bb80a97	Merge pull request #330 from jonaspm/fix/upload-media-entity-overwrite [WIP] fix: Add overwrite option to uploadToEntity method	2026-01-09 14:34:41 +01:00
dswbx	d826cb23a3	Merge pull request #291 from bknd-io/release/0.20 Release 0.20	2026-01-09 14:32:01 +01:00
dswbx	23a9e7c278	bump version to 0.20.0	2026-01-09 14:30:31 +01:00
dswbx	a9fe43130e	Merge pull request #324 from screenfluent/feat/sveltekit-adapter feat: add SvelteKit adapter	2026-01-09 14:23:57 +01:00
dswbx	3b7ec06703	Merge pull request #331 from bknd-io/change-license change license to apache 2.0	2026-01-09 13:46:14 +01:00
dswbx	55a124b519	feat(plugin/email-otp): preserve additional payload data during user creation Replaced `s.object` with `s.strictObject` to enforce schema validation. Updated logic to include unprocessed JSON properties (`...rest`) when creating a user, ensuring additional payload data is preserved.	2026-01-09 13:46:01 +01:00
dswbx	dc3fe330d7	change license to Apache 2.0	2026-01-09 13:43:51 +01:00
dswbx	d541167fb3	docs: add sveltekit integration guide	2026-01-09 13:26:28 +01:00
dswbx	7e8b357bbb	add support for `/admin` route in backend handler and enable asset copying updated `hooks.server.ts` to handle `/admin` routes and prevent fallback for 404 responses. added `adminBasepath` config to match backend paths. introduced assets copying step via `postinstall` script and included `robots.txt` and `favicon.ico` under `static`.	2026-01-09 13:11:01 +01:00
dswbx	521d8bc6ff	refactor(adapter): replaced `FrameworkBkndConfig` with `RuntimeBkndConfig`	2026-01-09 12:59:03 +01:00
dswbx	19f1941544	Merge remote-tracking branch 'origin/main' into release/0.20	2026-01-09 11:31:43 +01:00
dswbx	f9373bd0e6	test: remove `only`	2026-01-09 11:30:04 +01:00
dswbx	5384738b67	tests: ensuring `overwrite` is passed and respected in media api	2026-01-09 11:28:19 +01:00
dswbx	d82e28e6b1	Merge remote-tracking branch 'origin/release/0.20' into fork/jonaspm/fix/upload-media-entity-overwrite	2026-01-09 10:12:21 +01:00
Jonas Perusquia Morales	c38bc95b1d	fix: Add query support to media upload API methods	2026-01-08 12:37:13 -06:00
Mathieu Schimmerling	6651fce099	Merge pull request #1 from matschik/matschik-patch-1 docs(cloudflare): modify import in Cloudflare configuration example	2026-01-02 19:38:19 +01:00
Mathieu Schimmerling	91a1fc8a0c	docs(cloudflare): modify import in Cloudflare configuration example Updated import statement to include 'd1' from 'bknd/adapter/cloudflare'.	2026-01-02 19:13:24 +01:00
Szymon Rączka	03d3b8e407	feat(sveltekit): use createRuntimeApp for built-in Admin UI	2025-12-28 20:13:50 +01:00
Szymon Rączka	a97a79f11e	fix(sveltekit): make adapter runtime-agnostic Remove process.env default to support all SvelteKit runtimes (Node, Cloudflare Workers, Vercel Edge, Deno). Users now pass env explicitly via $env/dynamic/private.	2025-12-28 12:47:09 +01:00
Szymon Rączka	90b4de7093	feat: add SvelteKit adapter Add framework adapter for SvelteKit with: - `getApp()` - get bknd app instance - `serve()` - request handler for hooks.server.ts Usage in hooks.server.ts: ```typescript import { serve } from "bknd/adapter/sveltekit"; import config from "../bknd.config"; const bkndHandler = serve(config); export const handle = async ({ event, resolve }) => { if (event.url.pathname.startsWith("/api/")) { return bkndHandler(event); } return resolve(event); }; ``` Includes: - Adapter implementation (app/src/adapter/sveltekit/) - Test suite - Working example (examples/sveltekit/) - Package exports and types	2025-12-26 17:30:03 +01:00
dswbx	81f3914e7f	admin ui: made context overlays scrollable	2025-12-22 15:10:36 +01:00
dswbx	5163e2142e	Merge pull request #323 from jonaspm/docs/add-readOneBy docs: Document data.readOneBy method with usage examples	2025-12-17 17:40:37 +01:00
Jonas Perusquia Morales	15ed075de3	docs: Document data.readOneBy method with usage examples	2025-12-17 09:35:24 -06:00
dswbx	4f7925dfd8	bump rc, hide flows by `isDebug` instead	2025-12-05 17:12:07 +01:00
dswbx	21e970cd8c	Merge pull request #321 from bknd-io/feat/admin/mcp-in-nav feat(admin): add mcp as main navigation item when enabled, and make it route-aware	2025-12-05 17:03:35 +01:00
dswbx	40b70e7a20	feat(admin): add mcp as main navigation item when enabled, and make it route-aware	2025-12-05 15:25:06 +01:00
dswbx	9958dd7308	Merge pull request #320 from bknd-io/feat/auth-role-and-password feat: add `default_role_register` and password `minLength` config	2025-12-05 14:16:05 +01:00
dswbx	fef77eea61	feat: add minLength to pw strategy, and enforce	2025-12-05 14:03:09 +01:00
dswbx	ed41887d74	feat/fix: adding `auth.default_role_register` and disallow giving role on registration payload	2025-12-05 14:02:42 +01:00
dswbx	8ba4793160	Merge pull request #319 from jonaspm/docs/add-auth-logout feat: Add documentation for auth.logout method in SDK usage	2025-12-04 22:06:09 +01:00
Jonas Perusquia Morales	65e17db2a2	feat: Add documentation for auth.logout method in SDK usage	2025-12-04 14:48:11 -06:00
dswbx	e21b5e5b55	fix tsup broken watch	2025-12-03 18:08:54 +01:00
dswbx	959dee013e	fix admin local auth	2025-12-03 17:41:25 +01:00
dswbx	a39e76a440	Merge pull request #315 from bknd-io/feat/admin-local-auth feat: add local auth support if api storage provided	2025-12-02 19:13:07 +01:00
dswbx	acc10377ca	feat: add local auth support if api storage provided	2025-12-02 18:18:45 +01:00
dswbx	506c7d84cc	chore: bump version to 0.20.0-rc.1 and fix client context	2025-12-02 15:14:27 +01:00
dswbx	7ba542c040	removed sqlocal package, updated readme	2025-12-02 14:21:30 +01:00
dswbx	b784d8611a	Merge pull request #308 from bknd-io/feat/opfs-and-sqlocal feat: opfs and sqlocal	2025-12-02 14:18:55 +01:00
dswbx	a21d4ad6a7	docs: update sqlocal doc	2025-12-02 14:16:27 +01:00
dswbx	731b7a7e8d	tests: fix node tests + add connection test suite for sqlocal	2025-12-02 14:11:26 +01:00
dswbx	e56fc9c368	finalized sqlocal, added `BkndBrowserApp`, updated react example	2025-12-02 14:03:41 +01:00
dswbx	d1aa2da5b1	Merge remote-tracking branch 'origin/release/0.20' into feat/opfs-and-sqlocal	2025-12-02 10:31:39 +01:00
dswbx	52fe9aa085	Merge pull request #289 from bknd-io/feat/postgres-fc feat: move postgres as part of the main repo	2025-12-02 10:29:43 +01:00
dswbx	065821d9a5	chore: github tests with isolated deps	2025-12-02 10:25:49 +01:00
dswbx	0fc817382a	Merge remote-tracking branch 'origin/release/0.20' into feat/postgres-fc # Conflicts: # app/src/core/utils/runtime.ts	2025-12-02 10:20:58 +01:00
dswbx	2e6b95e484	Merge pull request #314 from bknd-io/docs/update-nov-react docs: updated react-router and react sdk	2025-12-02 10:05:32 +01:00
dswbx	4e31f48917	docs: updated react-router and react sdk	2025-12-02 10:01:29 +01:00
dswbx	b2872eb196	Merge pull request #313 from bknd-io/feat/data-implicit-joins feat: Add implicit joins in repository where clauses	2025-12-02 09:49:44 +01:00
dswbx	3d804f5ac5	Merge pull request #312 from bknd-io/fix/controller-schema-access fix: putting schema related endpoints behind schema permission and added tests	2025-12-02 09:49:25 +01:00
dswbx	da025efee1	Merge pull request #307 from bknd-io/fix/ui-client-import Fix UI client import	2025-12-02 09:48:35 +01:00
dswbx	ab1fa4c895	fix: add infinite back to dropzone container	2025-12-02 09:46:09 +01:00
dswbx	ebe3bc2ff5	Merge pull request #311 from bknd-io/fix/admin-field-config fix config reconciliation for specific field types, remove lodash	2025-12-02 09:43:58 +01:00
dswbx	f792d8b93e	feat(repository): add implicit joins in where clauses	2025-12-02 09:38:16 +01:00
dswbx	319469f44b	fix: putting schema related endpoints behind schema permission and add tests	2025-12-02 08:53:49 +01:00
dswbx	1359741e5f	fix config reconciliation for specific field types, remove lodash Replace lodash with native utilities and fix config merging to preserve common properties when switching between field types.	2025-11-29 14:18:57 +01:00
dswbx	8f4de33a76	use nullish coalescing and fix mode plugin pick up	2025-11-26 10:04:24 +01:00
dswbx	43dbc856ce	fix SystemController config read permission	2025-11-26 07:41:19 +01:00
dswbx	5a8f2b4894	upgrade bun and set linker isolated	2025-11-25 16:28:11 +01:00
dswbx	2627213de7	Merge pull request #292 from bknd-io/feat/add-otp-plugin OTP plugin	2025-11-25 16:24:20 +01:00
dswbx	36e1bb1867	init opfs and sqlocal as another browser adapter	2025-11-25 16:21:16 +01:00
dswbx	0cf1d86213	fix client imports to prevent multiple react context's	2025-11-25 16:16:10 +01:00
dswbx	3fac740771	Merge branch 'release/0.20' into feat/add-otp-plugin	2025-11-21 20:03:30 +01:00
dswbx	2b5e1771de	refactor: enhance email OTP responses and improve data structure Updated the email OTP plugin to return a structured response containing the email, action, and expiration details. Adjusted the tests to validate the new response format. Increased password length for user creation	2025-11-14 21:59:06 +01:00
dswbx	a16e017e39	Merge remote-tracking branch 'origin/release/0.20' into feat/add-otp-plugin	2025-11-14 09:01:36 +01:00
dswbx	ba3d11edab	Merge remote-tracking branch 'origin/release/0.20' into feat/add-otp-plugin	2025-11-10 13:25:01 +01:00
dswbx	b6717f0237	otp: update docs on permissions, only require email driver if sendEmail is not false	2025-11-10 10:25:33 +01:00
dswbx	c57f3e8070	otp: added missing tests	2025-11-10 10:17:16 +01:00
dswbx	c2f4f92d1a	refactor otp listeners	2025-11-10 09:40:47 +01:00
dswbx	6eb8525656	otp: add `sendEmail` option to disable sending for debugging	2025-11-10 09:30:24 +01:00
dswbx	793c214e6d	Merge remote-tracking branch 'origin/release/0.20' into feat/add-otp-plugin	2025-11-07 09:58:48 +01:00
dswbx	4094004b83	Merge remote-tracking branch 'origin/release/0.20' into feat/add-otp-plugin	2025-11-07 09:50:33 +01:00
dswbx	7e399830e5	add validation for used OTP codes	2025-11-07 09:12:58 +01:00
dswbx	ee2ab982df	docs: added `emailOTP` plugin docs	2025-11-07 09:11:13 +01:00
dswbx	5be55a6fa6	clean up error, it's prefixed with the plugin name already	2025-11-07 08:51:44 +01:00
dswbx	341eb13425	rename to email otp to make it more explicit	2025-11-07 08:48:02 +01:00
dswbx	68fbb6e933	fix events reference for instance checks	2025-11-06 20:47:19 +01:00
dswbx	8b36985252	otp: add entity config, reduce result	2025-11-06 20:38:16 +01:00
dswbx	ff86240b0e	feat: add OTP plugin	2025-11-06 20:06:51 +01:00
dswbx	40bbdb904f	refactor: expose additional kysely postgres options	2025-11-05 10:47:47 +01:00
dswbx	a333d537b0	refactor postgres functions to not rely on the packages	2025-11-05 10:21:35 +01:00
dswbx	108c108d82	merge origin/release/0.20	2025-11-05 10:05:57 +01:00
dswbx	ed47c5bf51	postgres: move examples up	2025-10-31 20:11:16 +01:00
dswbx	dbb19a27f4	fix pg imports for node tests	2025-10-31 17:48:50 +01:00
dswbx	71a17696eb	fix ".only" tests	2025-10-31 17:44:37 +01:00
dswbx	2dbafebcea	pg test: change is running check approach	2025-10-31 17:38:17 +01:00
dswbx	84d4635ec3	fix bun 1.3 new hoisting (for now)	2025-10-31 17:31:19 +01:00
dswbx	e9c92b6086	upgrade bun, add zustand	2025-10-31 17:27:04 +01:00
dswbx	5fa7601ad5	revert bun upgrade (should be separate pr)	2025-10-31 17:21:58 +01:00
dswbx	2c7054c317	feat: move postgres as part of the main repo	2025-10-31 17:13:23 +01:00