test hiding counts

postgres: added `pg` and `postgres`, and examples for xata and neon

.github/workflows/test.yml

@@ -15,7 +15,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v1
         with:
-          bun-version: "1.2.5"
+          bun-version: "1.2.14"
 
       - name: Install dependencies
         working-directory: ./app

.gitignore

@@ -29,4 +29,6 @@ packages/media/.env
 .idea
 .vscode
 .git_old
-docker/tmp
+docker/tmp
+.debug
+.history

.nvmrc

@@ -0,0 +1 @@
+22

README.md

@@ -1,5 +1,4 @@
 [![npm version](https://img.shields.io/npm/v/bknd.svg)](https://npmjs.org/package/bknd)
-[![npm downloads](https://img.shields.io/npm/dm/bknd)](https://www.npmjs.com/package/bknd)
 
 ![bknd](https://raw.githubusercontent.com/bknd-io/bknd/refs/heads/main/docs/_assets/poster.png)
 
@@ -18,14 +17,14 @@ bknd simplifies app development by providing a fully functional backend for data
 > and therefore full backward compatibility is not guaranteed before reaching v1.0.0.
 
 ## Size
-![gzipped size of bknd](https://img.badgesize.io/https://unpkg.com/bknd@latest/dist/index.js?compression=gzip&label=bknd)
+![gzipped size of bknd](https://img.shields.io/bundlejs/size/bknd?label=bknd)
 ![gzipped size of bknd/client](https://img.badgesize.io/https://unpkg.com/bknd@latest/dist/ui/client/index.js?compression=gzip&label=bknd/client)
 ![gzipped size of bknd/elements](https://img.badgesize.io/https://unpkg.com/bknd@latest/dist/ui/elements/index.js?compression=gzip&label=bknd/elements)
 ![gzipped size of bknd/ui](https://img.badgesize.io/https://unpkg.com/bknd@latest/dist/ui/index.js?compression=gzip&label=bknd/ui)
 
 The size on npm is misleading, as the `bknd` package includes the backend, the ui components as well as the whole backend bundled into the cli including static assets. 
 
-Depending on what you use, the size can be higher as additional dependencies are getting pulled in. The minimal size of a full `bknd` app as an API is around 212 kB gzipped (e.g. deployed as Cloudflare Worker).
+Depending on what you use, the size can be higher as additional dependencies are getting pulled in. The minimal size of a full `bknd` app as an API is around 300 kB gzipped (e.g. deployed as Cloudflare Worker).
 
 ## Motivation
 Creating digital products always requires developing both the backend (the logic) and the frontend (the appearance). Building a backend from scratch demands deep knowledge in areas such as authentication and database management. Using a backend framework can speed up initial development, but it still requires ongoing effort to work within its constraints (e.g., *"how to do X with Y?"*), which can quickly slow you down. Choosing a backend system is a tough decision, as you might not be aware of its limitations until you encounter them.

app/.env.example

@@ -0,0 +1,42 @@
+# ===== DB Settings =====
+VITE_DB_URL=:memory:
+# you can set a location for a database here, it'll overwrite the previous setting
+# ideally use the ".db" folder (create it first), it's git ignored
+VITE_DB_URL=file:.db/dev.db
+
+# alternatively, you can use url/token combination
+#VITE_DB_URL=
+#VITE_DB_TOKEN=
+
+
+# ===== DEV Server =====
+# restart the dev server on every change (enable with "1")
+VITE_APP_FRESH=
+# displays react-scan widget (enable with "1")
+VITE_DEBUG_RERENDERS=
+# console logs registered routes on start (enable with "1")
+VITE_SHOW_ROUTES=
+
+
+# ===== Test Credentials =====
+RESEND_API_KEY=
+R2_TOKEN=
+
+R2_ACCESS_KEY=
+R2_SECRET_ACCESS_KEY=
+R2_URL=
+
+AWS_ACCESS_KEY=
+AWS_SECRET_KEY=
+AWS_S3_URL=
+
+OAUTH_CLIENT_ID=
+OAUTH_CLIENT_SECRET=
+
+PUBLIC_POSTHOG_KEY=
+PUBLIC_POSTHOG_HOST=
+
+# ===== Internals =====
+BKND_CLI_CREATE_REF=main
+BKND_CLI_LOG_LEVEL=debug
+BKND_MODULES_DEBUG=1

app/__test__/api/MediaApi.spec.ts

@@ -1,8 +1,8 @@
 /// <reference types="@types/bun" />
 import { describe, expect, it } from "bun:test";
 import { Hono } from "hono";
-import { getFileFromContext, isFile, isReadableStream } from "../../src/core/utils";
-import { MediaApi } from "../../src/media/api/MediaApi";
+import { getFileFromContext, isFile, isReadableStream } from "core/utils";
+import { MediaApi } from "media/api/MediaApi";
 import { assetsPath, assetsTmpPath } from "../helper";
 
 const mockedBackend = new Hono()
@@ -39,10 +39,28 @@ describe("MediaApi", () => {
       // @ts-ignore tests
       const api = new MediaApi({
          token: "token",
+         token_transport: "header",
       });
       expect(api.getUploadHeaders().get("Authorization")).toBe("Bearer token");
    });
 
+   it("should return empty headers if not using `header` transport", () => {
+      expect(
+         new MediaApi({
+            token_transport: "cookie",
+         })
+            .getUploadHeaders()
+            .has("Authorization"),
+      ).toBe(false);
+      expect(
+         new MediaApi({
+            token_transport: "none",
+         })
+            .getUploadHeaders()
+            .has("Authorization"),
+      ).toBe(false);
+   });
+
    it("should get file: native", async () => {
       const name = "image.png";
       const path = `${assetsTmpPath}/${name}`;
@@ -103,8 +121,12 @@ describe("MediaApi", () => {
    });
 
    it("should upload file in various ways", async () => {
-      // @ts-ignore tests
-      const api = new MediaApi({}, mockedBackend.request);
+      const api = new MediaApi(
+         {
+            upload_fetcher: mockedBackend.request,
+         },
+         mockedBackend.request,
+      );
       const file = Bun.file(`${assetsPath}/image.png`);
 
       async function matches(req: Promise<any>, filename: string) {

app/__test__/core/Registry.spec.ts

@@ -1,7 +1,6 @@
 import { describe, expect, test } from "bun:test";
-import type { TObject, TString } from "@sinclair/typebox";
-import { Registry } from "../../src/core/registry/Registry";
-import { type TSchema, Type } from "../../src/core/utils";
+import { type TObject, type TString, Type } from "@sinclair/typebox";
+import { Registry } from "core";
 
 type Constructor<T> = new (...args: any[]) => T;
 

app/__test__/core/object/SchemaObject.spec.ts

@@ -1,6 +1,6 @@
 import { describe, expect, test } from "bun:test";
 import { SchemaObject } from "../../../src/core";
-import { Type } from "../../../src/core/utils";
+import { Type } from "@sinclair/typebox";
 
 describe("SchemaObject", async () => {
    test("basic", async () => {

app/__test__/core/object/object-query.spec.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { type ObjectQuery, convert, validate } from "../../../src/core/object/query/object-query";
+import { type ObjectQuery, convert, validate } from "core/object/query/object-query";
 
 describe("object-query", () => {
    const q: ObjectQuery = { name: "Michael" };

app/__test__/data/data.test.ts

@@ -110,4 +110,18 @@ describe("some tests", async () => {
          new EntityManager([entity, entity2], connection);
       }).toThrow();
    });
+
+   test("primary uuid", async () => {
+      const entity = new Entity("users", [
+         new PrimaryField("id", { format: "uuid" }),
+         new TextField("username"),
+      ]);
+      const em = new EntityManager([entity], getDummyConnection().dummyConnection);
+      await em.schema().sync({ force: true });
+
+      const mutator = em.mutator(entity);
+      const data = await mutator.insertOne({ username: "test" });
+      expect(data.data.id).toBeDefined();
+      expect(data.data.id).toBeString();
+   });
 });

app/__test__/data/specs/Entity.spec.ts

@@ -1,5 +1,6 @@
 import { describe, expect, test } from "bun:test";
-import { Entity, NumberField, TextField } from "../../../src/data";
+import { Entity, NumberField, TextField } from "data";
+import * as p from "data/prototype";
 
 describe("[data] Entity", async () => {
    const entity = new Entity("test", [
@@ -47,14 +48,7 @@ describe("[data] Entity", async () => {
       expect(entity.getField("new_field")).toBe(field);
    });
 
-   // @todo: move this to ClientApp
-   /*test("serialize and deserialize", async () => {
-      const json = entity.toJSON();
-      //sconsole.log("json", json.fields);
-      const newEntity = Entity.deserialize(json);
-      //console.log("newEntity", newEntity.toJSON().fields);
-      expect(newEntity).toBeInstanceOf(Entity);
-      expect(json).toEqual(newEntity.toJSON());
-      expect(json.fields).toEqual(newEntity.toJSON().fields);
-   });*/
+   test.only("types", async () => {
+      console.log(entity.toTypes());
+   });
 });

app/__test__/data/specs/EntityManager.spec.ts

@@ -47,8 +47,8 @@ describe("[data] EntityManager", async () => {
       em.addRelation(new ManyToOneRelation(posts, users));
       expect(em.relations.all.length).toBe(1);
       expect(em.relations.all[0]).toBeInstanceOf(ManyToOneRelation);
-      expect(em.relationsOf("users")).toEqual([em.relations.all[0]]);
-      expect(em.relationsOf("posts")).toEqual([em.relations.all[0]]);
+      expect(em.relationsOf("users")).toEqual([em.relations.all[0]!]);
+      expect(em.relationsOf("posts")).toEqual([em.relations.all[0]!]);
       expect(em.hasRelations("users")).toBe(true);
       expect(em.hasRelations("posts")).toBe(true);
       expect(em.relatedEntitiesOf("users")).toEqual([posts]);

app/__test__/data/specs/Repository.spec.ts

@@ -266,5 +266,12 @@ describe("[data] Repository (Events)", async () => {
       expect(events.has(RepositoryEvents.RepositoryFindManyBefore.slug)).toBeTrue();
       expect(events.has(RepositoryEvents.RepositoryFindManyAfter.slug)).toBeTrue();
       events.clear();
+
+      // check find one on findMany with limit 1
+      await repo.findMany({ where: { id: 1 }, limit: 1 });
+      await repo.emgr.executeAsyncs();
+      expect(events.has(RepositoryEvents.RepositoryFindOneBefore.slug)).toBeTrue();
+      expect(events.has(RepositoryEvents.RepositoryFindOneAfter.slug)).toBeTrue();
+      events.clear();
    });
 });

app/__test__/data/specs/WhereBuilder.spec.ts

@@ -1,25 +1,18 @@
-import { describe, expect, test } from "bun:test";
-import { Value, _jsonp } from "../../src/core/utils";
-import { type RepoQuery, WhereBuilder, type WhereQuery, querySchema } from "../../src/data";
-import type { RepoQueryIn } from "../../src/data/server/data-query-impl";
-import { getDummyConnection } from "./helper";
+import { describe, test, expect } from "bun:test";
+import { getDummyConnection } from "../helper";
+import { type WhereQuery, WhereBuilder } from "data";
 
-const decode = (input: RepoQueryIn, expected: RepoQuery) => {
-   const result = Value.Decode(querySchema, input);
-   expect(result).toEqual(expected);
-};
-
-describe("data-query-impl", () => {
-   function qb() {
-      const c = getDummyConnection();
-      const kysely = c.dummyConnection.kysely;
-      return kysely.selectFrom("t").selectAll();
-   }
-   function compile(q: WhereQuery) {
-      const { sql, parameters } = WhereBuilder.addClause(qb(), q).compile();
-      return { sql, parameters };
-   }
+function qb() {
+   const c = getDummyConnection();
+   const kysely = c.dummyConnection.kysely;
+   return kysely.selectFrom("t").selectAll();
+}
+function compile(q: WhereQuery) {
+   const { sql, parameters } = WhereBuilder.addClause(qb(), q).compile();
+   return { sql, parameters };
+}
 
+describe("WhereBuilder", () => {
    test("single validation", () => {
       const tests: [WhereQuery, string, any[]][] = [
          [{ name: "Michael", age: 40 }, '("name" = ? and "age" = ?)', ["Michael", 40]],
@@ -94,64 +87,4 @@ describe("data-query-impl", () => {
          expect(keys).toEqual(expectedKeys);
       }
    });
-
-   test("with", () => {
-      decode({ with: ["posts"] }, { with: { posts: {} } });
-      decode({ with: { posts: {} } }, { with: { posts: {} } });
-      decode({ with: { posts: { limit: 1 } } }, { with: { posts: { limit: 1 } } });
-      decode(
-         {
-            with: {
-               posts: {
-                  with: {
-                     images: {
-                        select: ["id"],
-                     },
-                  },
-               },
-            },
-         },
-         {
-            with: {
-               posts: {
-                  with: {
-                     images: {
-                        select: ["id"],
-                     },
-                  },
-               },
-            },
-         },
-      );
-
-      // over http
-      {
-         const output = { with: { images: {} } };
-         decode({ with: "images" }, output);
-         decode({ with: '["images"]' }, output);
-         decode({ with: ["images"] }, output);
-         decode({ with: { images: {} } }, output);
-      }
-
-      {
-         const output = { with: { images: {}, comments: {} } };
-         decode({ with: "images,comments" }, output);
-         decode({ with: ["images", "comments"] }, output);
-         decode({ with: '["images", "comments"]' }, output);
-         decode({ with: { images: {}, comments: {} } }, output);
-      }
-   });
-});
-
-describe("data-query-impl: Typebox", () => {
-   test("sort", async () => {
-      const _dflt = { sort: { by: "id", dir: "asc" } };
-
-      decode({ sort: "" }, _dflt);
-      decode({ sort: "name" }, { sort: { by: "name", dir: "asc" } });
-      decode({ sort: "-name" }, { sort: { by: "name", dir: "desc" } });
-      decode({ sort: "-posts.name" }, { sort: { by: "posts.name", dir: "desc" } });
-      decode({ sort: "-1name" }, _dflt);
-      decode({ sort: { by: "name", dir: "desc" } }, { sort: { by: "name", dir: "desc" } });
-   });
 });

app/__test__/data/specs/fields/FieldIndex.spec.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { Type } from "../../../../src/core/utils";
+import { Type } from "@sinclair/typebox";
 import { Entity, EntityIndex, Field } from "../../../../src/data";
 
 class TestField extends Field {

app/__test__/data/specs/fields/PrimaryField.spec.ts

@@ -39,4 +39,28 @@ describe("[data] PrimaryField", async () => {
       expect(field.transformPersist(1)).rejects.toThrow();
       expect(field.transformRetrieve(1)).toBe(1);
    });
+
+   test("format", () => {
+      const uuid = new PrimaryField("uuid", { format: "uuid" });
+      expect(uuid.format).toBe("uuid");
+      expect(uuid.fieldType).toBe("text");
+      expect(uuid.getNewValue()).toBeString();
+      expect(uuid.toType()).toEqual({
+         required: true,
+         comment: undefined,
+         type: "Generated<string>",
+         import: [{ package: "kysely", name: "Generated" }],
+      });
+
+      const integer = new PrimaryField("integer", { format: "integer" });
+      expect(integer.format).toBe("integer");
+      expect(integer.fieldType).toBe("integer");
+      expect(integer.getNewValue()).toBeUndefined();
+      expect(integer.toType()).toEqual({
+         required: true,
+         comment: undefined,
+         type: "Generated<number>",
+         import: [{ package: "kysely", name: "Generated" }],
+      });
+   });
 });

app/__test__/flows/SubWorkflowTask.spec.ts

@@ -1,5 +1,23 @@
 import { describe, expect, test } from "bun:test";
-import { Flow, LogTask, RenderTask, SubFlowTask } from "../../src/flows";
+import { Flow, LogTask, SubFlowTask, RenderTask, Task } from "../../src/flows";
+import { Type } from "@sinclair/typebox";
+
+export class StringifyTask<Output extends string> extends Task<
+   typeof StringifyTask.schema,
+   Output
+> {
+   type = "stringify";
+
+   static override schema = Type.Optional(
+      Type.Object({
+         input: Type.Optional(Type.String()),
+      }),
+   );
+
+   async execute() {
+      return JSON.stringify(this.params.input) as Output;
+   }
+}
 
 describe("SubFlowTask", async () => {
    test("Simple Subflow", async () => {
@@ -22,8 +40,6 @@ describe("SubFlowTask", async () => {
 
       const execution = flow.createExecution();
       await execution.start();
-      /*console.log(execution.logs);
-      console.log(execution.getResponse());*/
 
       expect(execution.getResponse()).toEqual("Subflow output: subflow");
    });
@@ -40,8 +56,8 @@ describe("SubFlowTask", async () => {
          loop: true,
          input: [1, 2, 3],
       });
-      const task3 = new RenderTask("render2", {
-         render: `Subflow output: {{ sub.output | join: ", " }}`,
+      const task3 = new StringifyTask("stringify", {
+         input: "{{ sub.output }}",
       });
 
       const flow = new Flow("test", [task, task2, task3], []);
@@ -51,41 +67,6 @@ describe("SubFlowTask", async () => {
       const execution = flow.createExecution();
       await execution.start();
 
-      console.log("errors", execution.getErrors());
-
-      /*console.log(execution.logs);
-      console.log(execution.getResponse());*/
-
-      expect(execution.getResponse()).toEqual("Subflow output: run 1, run 2, run 3");
-   });
-
-   test("Simple loop from flow input", async () => {
-      const subTask = new RenderTask("render", {
-         render: "run {{ flow.output }}",
-      });
-
-      const subflow = new Flow("subflow", [subTask]);
-
-      const task = new LogTask("log");
-      const task2 = new SubFlowTask("sub", {
-         flow: subflow,
-         loop: true,
-         input: "{{ flow.output | json }}",
-      });
-      const task3 = new RenderTask("render2", {
-         render: `Subflow output: {{ sub.output | join: ", " }}`,
-      });
-
-      const flow = new Flow("test", [task, task2, task3], []);
-      flow.task(task).asInputFor(task2);
-      flow.task(task2).asInputFor(task3);
-
-      const execution = flow.createExecution();
-      await execution.start([4, 5, 6]);
-
-      /*console.log(execution.logs);
-      console.log(execution.getResponse());*/
-
-      expect(execution.getResponse()).toEqual("Subflow output: run 4, run 5, run 6");
+      expect(execution.getResponse()).toEqual('"run 1,run 2,run 3"');
    });
 });

app/__test__/flows/Task.spec.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { Type } from "../../src/core/utils";
+import { Type } from "@sinclair/typebox";
 import { Task } from "../../src/flows";
 import { dynamic } from "../../src/flows/tasks/Task";
 
@@ -51,62 +51,4 @@ describe("Task", async () => {
 
       expect(result.test).toEqual({ key: "path", value: "1/1" });
    });
-
-   test("resolveParams: with json", async () => {
-      const result = await Task.resolveParams(
-         Type.Object({
-            test: dynamic(Type.Object({ key: Type.String(), value: Type.String() })),
-         }),
-         {
-            test: "{{ some | json }}",
-         },
-         {
-            some: {
-               key: "path",
-               value: "1/1",
-            },
-         },
-      );
-
-      expect(result.test).toEqual({ key: "path", value: "1/1" });
-   });
-
-   test("resolveParams: with array", async () => {
-      const result = await Task.resolveParams(
-         Type.Object({
-            test: dynamic(Type.Array(Type.String())),
-         }),
-         {
-            test: '{{ "1,2,3" | split: "," | json }}',
-         },
-      );
-
-      expect(result.test).toEqual(["1", "2", "3"]);
-   });
-
-   test("resolveParams: boolean", async () => {
-      const result = await Task.resolveParams(
-         Type.Object({
-            test: dynamic(Type.Boolean()),
-         }),
-         {
-            test: "{{ true }}",
-         },
-      );
-
-      expect(result.test).toEqual(true);
-   });
-
-   test("resolveParams: float", async () => {
-      const result = await Task.resolveParams(
-         Type.Object({
-            test: dynamic(Type.Number(), Number.parseFloat),
-         }),
-         {
-            test: "{{ 3.14 }}",
-         },
-      );
-
-      expect(result.test).toEqual(3.14);
-   });
 });

app/__test__/flows/inputs.test.ts

@@ -1,7 +1,8 @@
 import { describe, expect, test } from "bun:test";
 import { Hono } from "hono";
 import { Event, EventManager } from "../../src/core/events";
-import { type Static, type StaticDecode, Type, parse } from "../../src/core/utils";
+import { parse } from "../../src/core/utils";
+import { type Static, type StaticDecode, Type } from "@sinclair/typebox";
 import { EventTrigger, Flow, HttpTrigger, type InputsMap, Task } from "../../src/flows";
 import { dynamic } from "../../src/flows/tasks/Task";
 

app/__test__/flows/workflow-basic.test.ts

@@ -1,7 +1,8 @@
 // eslint-disable-next-line import/no-unresolved
 import { describe, expect, test } from "bun:test";
 import { isEqual } from "lodash-es";
-import { type Static, Type, _jsonp, withDisabledConsole } from "../../src/core/utils";
+import { _jsonp, withDisabledConsole } from "../../src/core/utils";
+import { type Static, Type } from "@sinclair/typebox";
 import { Condition, ExecutionEvent, FetchTask, Flow, LogTask, Task } from "../../src/flows";
 
 /*beforeAll(disableConsoleLog);

app/__test__/media/MediaController.spec.ts

@@ -43,8 +43,9 @@ beforeAll(disableConsoleLog);
 afterAll(enableConsoleLog);
 
 describe("MediaController", () => {
-   test.only("accepts direct", async () => {
+   test("accepts direct", async () => {
       const app = await makeApp();
+      console.log("app", app);
 
       const file = Bun.file(path);
       const name = makeName("png");

app/__test__/modules/AppAuth.spec.ts

@@ -69,7 +69,7 @@ describe("AppAuth", () => {
             },
             body: JSON.stringify({
                email: "some@body.com",
-               password: "123456",
+               password: "12345678",
             }),
          });
          enableConsoleLog();
@@ -81,6 +81,65 @@ describe("AppAuth", () => {
       }
    });
 
+   test("creates user on register (bcrypt)", async () => {
+      const auth = new AppAuth(
+         {
+            enabled: true,
+            strategies: {
+               password: {
+                  type: "password",
+                  config: {
+                     hashing: "bcrypt",
+                  },
+               },
+            },
+            // @ts-ignore
+            jwt: {
+               secret: "123456",
+            },
+         },
+         ctx,
+      );
+
+      await auth.build();
+      await ctx.em.schema().sync({ force: true });
+
+      // expect no users, but the query to pass
+      const res = await ctx.em.repository("users").findMany();
+      expect(res.data.length).toBe(0);
+
+      const app = new AuthController(auth).getController();
+
+      {
+         disableConsoleLog();
+         const res = await app.request("/password/register", {
+            method: "POST",
+            headers: {
+               "Content-Type": "application/json",
+            },
+            body: JSON.stringify({
+               email: "some@body.com",
+               password: "12345678",
+            }),
+         });
+         enableConsoleLog();
+         expect(res.status).toBe(200);
+
+         const { data: users } = await ctx.em.repository("users").findMany();
+         expect(users.length).toBe(1);
+         expect(users[0]?.email).toBe("some@body.com");
+      }
+
+      {
+         // check user in database
+         const rawUser = await ctx.connection.kysely
+            .selectFrom("users")
+            .selectAll()
+            .executeTakeFirstOrThrow();
+         expect(rawUser.strategy_value).toStartWith("$");
+      }
+   });
+
    test("registers auth middleware for bknd routes only", async () => {
       const app = createApp({
          initialConfig: {
@@ -94,6 +153,7 @@ describe("AppAuth", () => {
       });
 
       await app.build();
+      app.registerAdminController();
       const spy = spyOn(app.module.auth.authenticator, "requestCookieRefresh");
 
       // register custom route
@@ -103,6 +163,10 @@ describe("AppAuth", () => {
       await app.server.request("/api/system/ping");
       await app.server.request("/test");
 
+      expect(spy.mock.calls.length).toBe(0);
+
+      // admin route
+      await app.server.request("/");
       expect(spy.mock.calls.length).toBe(1);
    });
 

app/__test__/modules/Module.spec.ts

@@ -1,5 +1,6 @@
 import { describe, expect, test } from "bun:test";
-import { type TSchema, Type, stripMark } from "../../src/core/utils";
+import { stripMark } from "../../src/core/utils";
+import { type TSchema, Type } from "@sinclair/typebox";
 import { EntityManager, em, entity, index, text } from "../../src/data";
 import { DummyConnection } from "../../src/data/connection/DummyConnection";
 import { Module } from "../../src/modules/Module";
@@ -9,10 +10,10 @@ function createModule<Schema extends TSchema>(schema: Schema) {
       getSchema() {
          return schema;
       }
-      toJSON() {
+      override toJSON() {
          return this.config;
       }
-      useForceParse() {
+      override useForceParse() {
          return true;
       }
    }

app/__test__/modules/ModuleManager.spec.ts

@@ -1,9 +1,10 @@
 import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
-import { disableConsoleLog, enableConsoleLog, stripMark, Type } from "../../src/core/utils";
-import { Connection, entity, text } from "../../src/data";
-import { Module } from "../../src/modules/Module";
-import { type ConfigTable, getDefaultConfig, ModuleManager } from "../../src/modules/ModuleManager";
-import { CURRENT_VERSION, TABLE_NAME } from "../../src/modules/migrations";
+import { disableConsoleLog, enableConsoleLog, stripMark } from "core/utils";
+import { Type } from "@sinclair/typebox";
+import { Connection, entity, text } from "data";
+import { Module } from "modules/Module";
+import { type ConfigTable, getDefaultConfig, ModuleManager } from "modules/ModuleManager";
+import { CURRENT_VERSION, TABLE_NAME } from "modules/migrations";
 import { getDummyConnection } from "../helper";
 import { diff } from "core/object/diff";
 import type { Static } from "@sinclair/typebox";

app/build.cli.ts

@@ -0,0 +1,23 @@
+import pkg from "./package.json" with { type: "json" };
+import c from "picocolors";
+import { formatNumber } from "core/utils";
+
+const result = await Bun.build({
+   entrypoints: ["./src/cli/index.ts"],
+   target: "node",
+   outdir: "./dist/cli",
+   env: "PUBLIC_*",
+   minify: true,
+   define: {
+      __isDev: "0",
+      __version: JSON.stringify(pkg.version),
+   },
+});
+
+for (const output of result.outputs) {
+   const size_ = await output.text();
+   console.info(
+      c.cyan(formatNumber.fileSize(size_.length)),
+      c.dim(output.path.replace(import.meta.dir + "/", "")),
+   );
+}

app/build.ts

@@ -1,5 +1,6 @@
 import { $ } from "bun";
 import * as tsup from "tsup";
+import pkg from "./package.json" with { type: "json" };
 
 const args = process.argv.slice(2);
 const watch = args.includes("--watch");
@@ -8,8 +9,13 @@ const types = args.includes("--types");
 const sourcemap = args.includes("--sourcemap");
 const clean = args.includes("--clean");
 
+const define = {
+   __isDev: "0",
+   __version: JSON.stringify(pkg.version),
+};
+
 if (clean) {
-   console.log("Cleaning dist (w/o static)");
+   console.info("Cleaning dist (w/o static)");
    await $`find dist -mindepth 1 ! -path "dist/static/*" ! -path "dist/static" -exec rm -rf {} +`;
 }
 
@@ -21,11 +27,11 @@ function buildTypes() {
    Bun.spawn(["bun", "build:types"], {
       stdout: "inherit",
       onExit: () => {
-         console.log("Types built");
+         console.info("Types built");
          Bun.spawn(["bun", "tsc-alias"], {
             stdout: "inherit",
             onExit: () => {
-               console.log("Types aliased");
+               console.info("Types aliased");
                types_running = false;
             },
          });
@@ -47,10 +53,10 @@ if (types && !watch) {
 }
 
 function banner(title: string) {
-   console.log("");
-   console.log("=".repeat(40));
-   console.log(title.toUpperCase());
-   console.log("-".repeat(40));
+   console.info("");
+   console.info("=".repeat(40));
+   console.info(title.toUpperCase());
+   console.info("-".repeat(40));
 }
 
 // collection of always-external packages
@@ -65,6 +71,7 @@ async function buildApi() {
       minify,
       sourcemap,
       watch,
+      define,
       entry: [
          "src/index.ts",
          "src/core/index.ts",
@@ -101,6 +108,7 @@ async function buildUi() {
       minify,
       sourcemap,
       watch,
+      define,
       external: [
          ...external,
          "react",
@@ -160,6 +168,7 @@ async function buildUiElements() {
       minify,
       sourcemap,
       watch,
+      define,
       entry: ["src/ui/elements/index.ts"],
       outDir: "dist/ui/elements",
       external: [
@@ -211,7 +220,7 @@ function baseConfig(adapter: string, overrides: Partial<tsup.Options> = {}): tsu
       },
       ...overrides,
       define: {
-         __isDev: "0",
+         ...define,
          ...overrides.define,
       },
       external: [

app/package.json

@@ -3,7 +3,7 @@
   "type": "module",
   "sideEffects": false,
   "bin": "./dist/cli/index.js",
-  "version": "0.11.2",
+  "version": "0.14.0-rc.2",
   "description": "Lightweight Firebase/Supabase alternative built to run anywhere — incl. Next.js, React Router, Astro, Cloudflare, Bun, Node, AWS Lambda & more.",
   "homepage": "https://bknd.io",
   "repository": {
@@ -14,11 +14,11 @@
     "url": "https://github.com/bknd-io/bknd/issues"
   },
   "scripts": {
-    "dev": "vite",
+    "dev": "BKND_CLI_LOG_LEVEL=debug vite",
     "build": "NODE_ENV=production bun run build.ts --minify --types",
     "build:all": "rm -rf dist && bun run build:static && NODE_ENV=production bun run build.ts --minify --types --clean && bun run build:cli",
     "build:ci": "mkdir -p dist/static/.vite && echo '{}' > dist/static/.vite/manifest.json && NODE_ENV=production bun run build.ts",
-    "build:cli": "bun build src/cli/index.ts --target node --outdir dist/cli --env PUBLIC_* --minify",
+    "build:cli": "bun run build.cli.ts",
     "build:static": "vite build",
     "watch": "bun run build.ts --types --watch",
     "types": "bun tsc -p tsconfig.build.json --noEmit",
@@ -48,38 +48,37 @@
     "@cfworker/json-schema": "^4.1.1",
     "@codemirror/lang-html": "^6.4.9",
     "@codemirror/lang-json": "^6.0.1",
-    "@codemirror/lang-liquid": "^6.2.2",
     "@hello-pangea/dnd": "^18.0.1",
+    "@hono/swagger-ui": "^0.5.1",
     "@libsql/client": "^0.15.2",
     "@mantine/core": "^7.17.1",
     "@mantine/hooks": "^7.17.1",
-    "@sinclair/typebox": "^0.34.30",
+    "@sinclair/typebox": "0.34.30",
     "@tanstack/react-form": "^1.0.5",
     "@uiw/react-codemirror": "^4.23.10",
     "@xyflow/react": "^12.4.4",
     "aws4fetch": "^1.0.20",
+    "bcryptjs": "^3.0.2",
     "dayjs": "^1.11.13",
     "fast-xml-parser": "^5.0.8",
-    "hono": "^4.7.4",
     "json-schema-form-react": "^0.0.2",
     "json-schema-library": "10.0.0-rc7",
     "json-schema-to-ts": "^3.1.1",
     "kysely": "^0.27.6",
-    "liquidjs": "^10.21.0",
+    "hono": "^4.7.11",
     "lodash-es": "^4.17.21",
     "oauth4webapi": "^2.11.1",
     "object-path-immutable": "^4.1.2",
-    "picocolors": "^1.1.1",
     "radix-ui": "^1.1.3",
     "swr": "^2.3.3",
-    "wrangler": "^4.4.1"
+    "uuid": "^11.1.0"
   },
   "devDependencies": {
     "@aws-sdk/client-s3": "^3.758.0",
     "@bluwy/giget-core": "^0.1.2",
     "@dagrejs/dagre": "^1.1.4",
-    "@hono/typebox-validator": "^0.3.2",
-    "@hono/vite-dev-server": "^0.19.0",
+    "@hono/typebox-validator": "^0.3.3",
+    "@hono/vite-dev-server": "^0.19.1",
     "@hookform/resolvers": "^4.1.3",
     "@libsql/kysely-libsql": "^0.4.1",
     "@mantine/modals": "^7.17.1",
@@ -101,9 +100,11 @@
     "dotenv": "^16.4.7",
     "jotai": "^2.12.2",
     "jsdom": "^26.0.0",
+    "jsonv-ts": "^0.1.0",
     "kysely-d1": "^0.3.0",
     "open": "^10.1.0",
     "openapi-types": "^12.1.3",
+    "picocolors": "^1.1.1",
     "postcss": "^8.5.3",
     "postcss-preset-mantine": "^1.17.0",
     "postcss-simple-vars": "^7.0.1",
@@ -120,13 +121,14 @@
     "tsc-alias": "^1.8.11",
     "tsup": "^8.4.0",
     "tsx": "^4.19.3",
-    "vite": "^6.2.1",
+    "vite": "^6.3.5",
     "vite-tsconfig-paths": "^5.1.4",
     "vitest": "^3.0.9",
-    "wouter": "^3.6.0"
+    "wouter": "^3.6.0",
+    "@cloudflare/workers-types": "^4.20250606.0"
   },
   "optionalDependencies": {
-    "@hono/node-server": "^1.13.8"
+    "@hono/node-server": "^1.14.3"
   },
   "peerDependencies": {
     "react": ">=19",

app/src/Api.ts

@@ -1,13 +1,19 @@
 import type { SafeUser } from "auth";
-import { AuthApi } from "auth/api/AuthApi";
-import { DataApi } from "data/api/DataApi";
+import { AuthApi, type AuthApiOptions } from "auth/api/AuthApi";
+import { DataApi, type DataApiOptions } from "data/api/DataApi";
 import { decode } from "hono/jwt";
-import { MediaApi } from "media/api/MediaApi";
+import { MediaApi, type MediaApiOptions } from "media/api/MediaApi";
 import { SystemApi } from "modules/SystemApi";
 import { omitKeys } from "core/utils";
+import type { BaseModuleApiOptions } from "modules";
 
 export type TApiUser = SafeUser;
 
+export type ApiFetcher = (
+   input: RequestInfo | URL,
+   init?: RequestInit,
+) => Response | Promise<Response>;
+
 declare global {
    interface Window {
       __BKND__: {
@@ -16,14 +22,24 @@ declare global {
    }
 }
 
+type SubApiOptions<T extends BaseModuleApiOptions> = Omit<T, keyof BaseModuleApiOptions>;
+
 export type ApiOptions = {
    host?: string;
    headers?: Headers;
    key?: string;
-   localStorage?: boolean;
-   fetcher?: typeof fetch;
+   storage?: {
+      getItem: (key: string) => string | undefined | null | Promise<string | undefined | null>;
+      setItem: (key: string, value: string) => void | Promise<void>;
+      removeItem: (key: string) => void | Promise<void>;
+   };
+   onAuthStateChange?: (state: AuthState) => void;
+   fetcher?: ApiFetcher;
    verbose?: boolean;
    verified?: boolean;
+   data?: SubApiOptions<DataApiOptions>;
+   auth?: SubApiOptions<AuthApiOptions>;
+   media?: SubApiOptions<MediaApiOptions>;
 } & (
    | {
         token?: string;
@@ -56,18 +72,18 @@ export class Api {
       this.verified = options.verified === true;
 
       // prefer request if given
-      if ("request" in options) {
+      if ("request" in options && options.request) {
          this.options.host = options.host ?? new URL(options.request.url).origin;
          this.options.headers = options.headers ?? options.request.headers;
          this.extractToken();
 
          // then check for a token
-      } else if ("token" in options) {
+      } else if ("token" in options && options.token) {
          this.token_transport = "header";
-         this.updateToken(options.token);
+         this.updateToken(options.token, { trigger: false });
 
          // then check for an user object
-      } else if ("user" in options) {
+      } else if ("user" in options && options.user) {
          this.token_transport = "none";
          this.user = options.user;
          this.verified = options.verified !== false;
@@ -110,18 +126,30 @@ export class Api {
             this.updateToken(headerToken);
             return;
          }
-      } else if (this.options.localStorage) {
-         const token = localStorage.getItem(this.tokenKey);
-         if (token) {
+      } else if (this.storage) {
+         this.storage.getItem(this.tokenKey).then((token) => {
             this.token_transport = "header";
-            this.updateToken(token);
-         }
+            this.updateToken(token ? String(token) : undefined);
+         });
       }
-
-      //console.warn("Couldn't extract token");
    }
 
-   updateToken(token?: string, rebuild?: boolean) {
+   private get storage() {
+      if (!this.options.storage) return null;
+      return {
+         getItem: async (key: string) => {
+            return await this.options.storage!.getItem(key);
+         },
+         setItem: async (key: string, value: string) => {
+            return await this.options.storage!.setItem(key, value);
+         },
+         removeItem: async (key: string) => {
+            return await this.options.storage!.removeItem(key);
+         },
+      };
+   }
+
+   updateToken(token?: string, opts?: { rebuild?: boolean; trigger?: boolean }) {
       this.token = token;
       this.verified = false;
 
@@ -131,17 +159,25 @@ export class Api {
          this.user = undefined;
       }
 
-      if (this.options.localStorage) {
+      if (this.storage) {
          const key = this.tokenKey;
 
          if (token) {
-            localStorage.setItem(key, token);
+            this.storage.setItem(key, token).then(() => {
+               this.options.onAuthStateChange?.(this.getAuthState());
+            });
          } else {
-            localStorage.removeItem(key);
+            this.storage.removeItem(key).then(() => {
+               this.options.onAuthStateChange?.(this.getAuthState());
+            });
+         }
+      } else {
+         if (opts?.trigger !== false) {
+            this.options.onAuthStateChange?.(this.getAuthState());
          }
       }
 
-      if (rebuild) this.buildApis();
+      if (opts?.rebuild) this.buildApis();
    }
 
    private markAuthVerified(verfied: boolean) {
@@ -211,15 +247,32 @@ export class Api {
       const fetcher = this.options.fetcher;
 
       this.system = new SystemApi(baseParams, fetcher);
-      this.data = new DataApi(baseParams, fetcher);
-      this.auth = new AuthApi(
+      this.data = new DataApi(
          {
             ...baseParams,
-            onTokenUpdate: (token) => this.updateToken(token, true),
+            ...this.options.data,
+         },
+         fetcher,
+      );
+      this.auth = new AuthApi(
+         {
+            ...baseParams,
+            credentials: this.options.storage ? "omit" : "include",
+            ...this.options.auth,
+            onTokenUpdate: (token) => {
+               this.updateToken(token, { rebuild: true });
+               this.options.auth?.onTokenUpdate?.(token);
+            },
+         },
+         fetcher,
+      );
+      this.media = new MediaApi(
+         {
+            ...baseParams,
+            ...this.options.media,
          },
          fetcher,
       );
-      this.media = new MediaApi(baseParams, fetcher);
    }
 }
 

app/src/App.ts

@@ -15,7 +15,7 @@ import * as SystemPermissions from "modules/permissions";
 import { AdminController, type AdminControllerOptions } from "modules/server/AdminController";
 import { SystemController } from "modules/server/SystemController";
 
-// biome-ignore format: must be there
+// biome-ignore format: must be here
 import { Api, type ApiOptions } from "Api";
 import type { ServerEnv } from "modules/Controller";
 
@@ -151,7 +151,7 @@ export class App {
    }
 
    get fetch(): Hono["fetch"] {
-      return this.server.fetch;
+      return this.server.fetch as any;
    }
 
    get module() {
@@ -253,6 +253,11 @@ export class App {
                break;
          }
       });
+
+      // call server init if set
+      if (this.options?.manager?.onServerInit) {
+         this.options.manager.onServerInit(server);
+      }
    }
 }
 

app/src/adapter/cloudflare/cloudflare-workers.adapter.spec.ts

@@ -1,6 +1,6 @@
 import { afterAll, beforeAll, describe, expect, it } from "bun:test";
 import { makeApp } from "./modes/fresh";
-import { makeConfig } from "./config";
+import { makeConfig, type CfMakeConfigArgs } from "./config";
 import { disableConsoleLog, enableConsoleLog } from "core/utils";
 import { adapterTestSuite } from "adapter/adapter-test-suite";
 import { bunTestRunner } from "adapter/bun/test";
@@ -23,7 +23,7 @@ describe("cf adapter", () => {
             {
                connection: { url: DB_URL },
             },
-            {},
+            $ctx({ DB_URL }),
          ),
       ).toEqual({ connection: { url: DB_URL } });
 
@@ -34,15 +34,15 @@ describe("cf adapter", () => {
                   connection: { url: env.DB_URL },
                }),
             },
-            {
-               DB_URL,
-            },
+            $ctx({ DB_URL }),
          ),
       ).toEqual({ connection: { url: DB_URL } });
    });
 
-   adapterTestSuite<CloudflareBkndConfig, object>(bunTestRunner, {
-      makeApp,
+   adapterTestSuite<CloudflareBkndConfig, CfMakeConfigArgs<any>>(bunTestRunner, {
+      makeApp: async (c, a, o) => {
+         return await makeApp(c, { env: a } as any, o);
+      },
       makeHandler: (c, a, o) => {
          return async (request: any) => {
             const app = await makeApp(
@@ -50,7 +50,7 @@ describe("cf adapter", () => {
                c ?? {
                   connection: { url: DB_URL },
                },
-               a,
+               a!,
                o,
             );
             return app.fetch(request);

app/src/adapter/cloudflare/cloudflare-workers.adapter.ts

@@ -7,8 +7,15 @@ import { getFresh } from "./modes/fresh";
 import { getCached } from "./modes/cached";
 import { getDurable } from "./modes/durable";
 import type { App } from "bknd";
+import { $console } from "core";
 
-export type CloudflareEnv = object;
+declare global {
+   namespace Cloudflare {
+      interface Env {}
+   }
+}
+
+export type CloudflareEnv = Cloudflare.Env;
 export type CloudflareBkndConfig<Env = CloudflareEnv> = RuntimeBkndConfig<Env> & {
    mode?: "warm" | "fresh" | "cache" | "durable";
    bindings?: (args: Env) => {
@@ -16,6 +23,11 @@ export type CloudflareBkndConfig<Env = CloudflareEnv> = RuntimeBkndConfig<Env> &
       dobj?: DurableObjectNamespace;
       db?: D1Database;
    };
+   d1?: {
+      session?: boolean;
+      transport?: "header" | "cookie";
+      first?: D1SessionConstraint;
+   };
    static?: "kv" | "assets";
    key?: string;
    keepAliveSeconds?: number;
@@ -37,7 +49,7 @@ export function serve<Env extends CloudflareEnv = CloudflareEnv>(
          const url = new URL(request.url);
 
          if (config.manifest && config.static === "assets") {
-            console.warn("manifest is not useful with static 'assets'");
+            $console.warn("manifest is not useful with static 'assets'");
          } else if (!config.manifest && config.static === "kv") {
             throw new Error("manifest is required with static 'kv'");
          }

app/src/adapter/cloudflare/config.ts

@@ -1,46 +1,148 @@
+/// <reference types="@cloudflare/workers-types" />
+
 import { registerMedia } from "./storage/StorageR2Adapter";
 import { getBinding } from "./bindings";
-import { D1Connection } from "./D1Connection";
+import { D1Connection } from "./connection/D1Connection";
 import type { CloudflareBkndConfig, CloudflareEnv } from ".";
 import { App } from "bknd";
 import { makeConfig as makeAdapterConfig } from "bknd/adapter";
-import type { ExecutionContext } from "hono";
+import type { Context, ExecutionContext } from "hono";
+import { $console } from "core";
+import { setCookie } from "hono/cookie";
 
 export const constants = {
    exec_async_event_id: "cf_register_waituntil",
    cache_endpoint: "/__bknd/cache",
    do_endpoint: "/__bknd/do",
+   d1_session: {
+      cookie: "cf_d1_session",
+      header: "x-cf-d1-session",
+   },
 };
 
+export type CfMakeConfigArgs<Env extends CloudflareEnv = CloudflareEnv> = {
+   env: Env;
+   ctx?: ExecutionContext;
+   request?: Request;
+};
+
+function getCookieValue(cookies: string | null, name: string) {
+   if (!cookies) return null;
+
+   for (const cookie of cookies.split("; ")) {
+      const [key, value] = cookie.split("=");
+      if (key === name && value) {
+         return decodeURIComponent(value);
+      }
+   }
+   return null;
+}
+
+export function d1SessionHelper(config: CloudflareBkndConfig<any>) {
+   const headerKey = constants.d1_session.header;
+   const cookieKey = constants.d1_session.cookie;
+   const transport = config.d1?.transport;
+
+   return {
+      get: (request?: Request): D1SessionBookmark | undefined => {
+         if (!request || !config.d1?.session) return undefined;
+
+         if (!transport || transport === "cookie") {
+            const cookies = request.headers.get("Cookie");
+            if (cookies) {
+               const cookie = getCookieValue(cookies, cookieKey);
+               if (cookie) {
+                  return cookie;
+               }
+            }
+         }
+
+         if (!transport || transport === "header") {
+            if (request.headers.has(headerKey)) {
+               return request.headers.get(headerKey) as any;
+            }
+         }
+
+         return undefined;
+      },
+      set: (c: Context, d1?: D1DatabaseSession) => {
+         if (!d1 || !config.d1?.session) return;
+
+         const session = d1.getBookmark();
+         if (session) {
+            if (!transport || transport === "header") {
+               c.header(headerKey, session);
+            }
+            if (!transport || transport === "cookie") {
+               setCookie(c, cookieKey, session, {
+                  httpOnly: true,
+                  secure: true,
+                  sameSite: "Lax",
+                  maxAge: 60 * 5, // 5 minutes
+               });
+            }
+         }
+      },
+   };
+}
+
 let media_registered: boolean = false;
 export function makeConfig<Env extends CloudflareEnv = CloudflareEnv>(
    config: CloudflareBkndConfig<Env>,
-   args: Env = {} as Env,
+   args?: CfMakeConfigArgs<Env>,
 ) {
    if (!media_registered) {
       registerMedia(args as any);
       media_registered = true;
    }
 
-   const appConfig = makeAdapterConfig(config, args);
-   const bindings = config.bindings?.(args);
-   if (!appConfig.connection) {
-      let db: D1Database | undefined;
-      if (bindings?.db) {
-         console.log("Using database from bindings");
-         db = bindings.db;
-      } else if (Object.keys(args).length > 0) {
-         const binding = getBinding(args, "D1Database");
-         if (binding) {
-            console.log(`Using database from env "${binding.key}"`);
-            db = binding.value;
+   const appConfig = makeAdapterConfig(config, args?.env);
+
+   if (args?.env) {
+      const bindings = config.bindings?.(args?.env);
+
+      const sessionHelper = d1SessionHelper(config);
+      const sessionId = sessionHelper.get(args.request);
+      let session: D1DatabaseSession | undefined;
+
+      if (!appConfig.connection) {
+         let db: D1Database | undefined;
+         if (bindings?.db) {
+            $console.log("Using database from bindings");
+            db = bindings.db;
+         } else if (Object.keys(args).length > 0) {
+            const binding = getBinding(args.env, "D1Database");
+            if (binding) {
+               $console.log(`Using database from env "${binding.key}"`);
+               db = binding.value;
+            }
+         }
+
+         if (db) {
+            if (config.d1?.session) {
+               session = db.withSession(sessionId ?? config.d1?.first);
+               appConfig.connection = new D1Connection({ binding: session });
+            } else {
+               appConfig.connection = new D1Connection({ binding: db });
+            }
+         } else {
+            throw new Error("No database connection given");
          }
       }
 
-      if (db) {
-         appConfig.connection = new D1Connection({ binding: db });
-      } else {
-         throw new Error("No database connection given");
+      if (config.d1?.session) {
+         appConfig.options = {
+            ...appConfig.options,
+            manager: {
+               ...appConfig.options?.manager,
+               onServerInit: (server) => {
+                  server.use(async (c, next) => {
+                     sessionHelper.set(c, session);
+                     await next();
+                  });
+               },
+            },
+         };
       }
    }
 

app/src/adapter/cloudflare/connection/D1Connection.ts

@@ -5,8 +5,8 @@ import type { QB } from "data/connection/Connection";
 import { type DatabaseIntrospector, Kysely, ParseJSONResultsPlugin } from "kysely";
 import { D1Dialect } from "kysely-d1";
 
-export type D1ConnectionConfig = {
-   binding: D1Database;
+export type D1ConnectionConfig<DB extends D1Database | D1DatabaseSession = D1Database> = {
+   binding: DB;
 };
 
 class CustomD1Dialect extends D1Dialect {
@@ -17,22 +17,25 @@ class CustomD1Dialect extends D1Dialect {
    }
 }
 
-export class D1Connection extends SqliteConnection {
+export class D1Connection<
+   DB extends D1Database | D1DatabaseSession = D1Database,
+> extends SqliteConnection {
    protected override readonly supported = {
       batching: true,
+      counts: false,
    };
 
-   constructor(private config: D1ConnectionConfig) {
+   constructor(private config: D1ConnectionConfig<DB>) {
       const plugins = [new ParseJSONResultsPlugin()];
 
       const kysely = new Kysely({
-         dialect: new CustomD1Dialect({ database: config.binding }),
+         dialect: new CustomD1Dialect({ database: config.binding as D1Database }),
          plugins,
       });
       super(kysely, {}, plugins);
    }
 
-   get client(): D1Database {
+   get client(): DB {
       return this.config.binding;
    }
 

app/src/adapter/cloudflare/index.ts

@@ -1,4 +1,4 @@
-import { D1Connection, type D1ConnectionConfig } from "./D1Connection";
+import { D1Connection, type D1ConnectionConfig } from "./connection/D1Connection";
 
 export * from "./cloudflare-workers.adapter";
 export { makeApp, getFresh } from "./modes/fresh";
@@ -12,6 +12,7 @@ export {
    type GetBindingType,
    type BindingMap,
 } from "./bindings";
+export { constants } from "./config";
 
 export function d1(config: D1ConnectionConfig) {
    return new D1Connection(config);

app/src/adapter/cloudflare/modes/cached.ts

@@ -5,8 +5,9 @@ import { makeConfig, registerAsyncsExecutionContext, constants } from "../config
 
 export async function getCached<Env extends CloudflareEnv = CloudflareEnv>(
    config: CloudflareBkndConfig<Env>,
-   { env, ctx, ...args }: Context<Env>,
+   args: Context<Env>,
 ) {
+   const { env, ctx } = args;
    const { kv } = config.bindings?.(env)!;
    if (!kv) throw new Error("kv namespace is not defined in cloudflare.bindings");
    const key = config.key ?? "app";
@@ -20,7 +21,7 @@ export async function getCached<Env extends CloudflareEnv = CloudflareEnv>(
 
    const app = await createRuntimeApp(
       {
-         ...makeConfig(config, env),
+         ...makeConfig(config, args),
          initialConfig,
          onBuilt: async (app) => {
             registerAsyncsExecutionContext(app, ctx);
@@ -41,7 +42,7 @@ export async function getCached<Env extends CloudflareEnv = CloudflareEnv>(
             await config.beforeBuild?.(app);
          },
       },
-      { env, ctx, ...args },
+      args,
    );
 
    if (!cachedConfig) {

app/src/adapter/cloudflare/modes/durable.ts

@@ -3,6 +3,7 @@ import type { App, CreateAppConfig } from "bknd";
 import { createRuntimeApp, makeConfig } from "bknd/adapter";
 import type { CloudflareBkndConfig, Context, CloudflareEnv } from "../index";
 import { constants, registerAsyncsExecutionContext } from "../config";
+import { $console } from "core";
 
 export async function getDurable<Env extends CloudflareEnv = CloudflareEnv>(
    config: CloudflareBkndConfig<Env>,
@@ -13,7 +14,7 @@ export async function getDurable<Env extends CloudflareEnv = CloudflareEnv>(
    const key = config.key ?? "app";
 
    if ([config.onBuilt, config.beforeBuild].some((x) => x)) {
-      console.log("onBuilt and beforeBuild are not supported with DurableObject mode");
+      $console.warn("onBuilt and beforeBuild are not supported with DurableObject mode");
    }
 
    const start = performance.now();

app/src/adapter/cloudflare/modes/fresh.ts

@@ -1,13 +1,13 @@
 import { createRuntimeApp, type RuntimeOptions } from "bknd/adapter";
 import type { CloudflareBkndConfig, Context, CloudflareEnv } from "../index";
-import { makeConfig, registerAsyncsExecutionContext } from "../config";
+import { makeConfig, registerAsyncsExecutionContext, type CfMakeConfigArgs } from "../config";
 
 export async function makeApp<Env extends CloudflareEnv = CloudflareEnv>(
    config: CloudflareBkndConfig<Env>,
-   args: Env = {} as Env,
+   args?: CfMakeConfigArgs<Env>,
    opts?: RuntimeOptions,
 ) {
-   return await createRuntimeApp<Env>(makeConfig(config, args), args, opts);
+   return await createRuntimeApp<Env>(makeConfig(config, args), args?.env, opts);
 }
 
 export async function getFresh<Env extends CloudflareEnv = CloudflareEnv>(
@@ -20,10 +20,10 @@ export async function getFresh<Env extends CloudflareEnv = CloudflareEnv>(
          ...config,
          onBuilt: async (app) => {
             registerAsyncsExecutionContext(app, ctx.ctx);
-            config.onBuilt?.(app);
+            await config.onBuilt?.(app);
          },
       },
-      ctx.env,
+      ctx,
       opts,
    );
 }

app/src/adapter/cloudflare/storage/StorageR2Adapter.native-spec.ts

@@ -3,7 +3,7 @@ import { test } from "node:test";
 import { Miniflare } from "miniflare";
 import { StorageR2Adapter } from "./StorageR2Adapter";
 import { adapterTestSuite } from "media";
-import { nodeTestRunner } from "adapter/node";
+import { nodeTestRunner } from "adapter/node/test";
 import path from "node:path";
 
 // https://github.com/nodejs/node/issues/44372#issuecomment-1736530480

app/src/adapter/cloudflare/storage/StorageR2Adapter.ts

@@ -1,8 +1,10 @@
 import { registries } from "bknd";
 import { isDebug } from "bknd/core";
-import { StringEnum, Type } from "bknd/utils";
+import { StringEnum } from "bknd/utils";
 import { guessMimeType as guess, StorageAdapter, type FileBody } from "bknd/media";
 import { getBindings } from "../bindings";
+import * as tb from "@sinclair/typebox";
+const { Type } = tb;
 
 export function makeSchema(bindings: string[] = []) {
    return Type.Object(
@@ -122,12 +124,10 @@ export class StorageR2Adapter extends StorageAdapter {
          }
       }
 
-      //console.log("response headers:before", headersToObject(responseHeaders));
       this.writeHttpMetadata(responseHeaders, object);
       responseHeaders.set("etag", object.httpEtag);
       responseHeaders.set("Content-Length", String(object.size));
       responseHeaders.set("Last-Modified", object.uploaded.toUTCString());
-      //console.log("response headers:after", headersToObject(responseHeaders));
 
       return new Response(object.body, {
          status: object.range ? 206 : 200,

app/src/adapter/nextjs/nextjs.adapter.ts

@@ -3,7 +3,6 @@ import { isNode } from "bknd/utils";
 import type { NextApiRequest } from "next";
 
 type NextjsEnv = NextApiRequest["env"];
-
 export type NextjsBkndConfig<Env = NextjsEnv> = FrameworkBkndConfig<Env> & {
    cleanRequest?: { searchParams?: string[] };
 };

app/src/adapter/node/index.ts

@@ -3,7 +3,6 @@ import { type LocalAdapterConfig, StorageLocalAdapter } from "./storage/StorageL
 
 export * from "./node.adapter";
 export { StorageLocalAdapter, type LocalAdapterConfig };
-export { nodeTestRunner } from "./test";
 
 let registered = false;
 export function registerLocalMediaAdapter() {

app/src/adapter/node/node.adapter.native-spec.ts

@@ -1,7 +1,7 @@
 import { describe, before, after } from "node:test";
 import * as node from "./node.adapter";
 import { adapterTestSuite } from "adapter/adapter-test-suite";
-import { nodeTestRunner } from "adapter/node";
+import { nodeTestRunner } from "adapter/node/test";
 import { disableConsoleLog, enableConsoleLog } from "core/utils";
 
 before(() => disableConsoleLog());

app/src/adapter/node/node.adapter.ts

@@ -4,6 +4,7 @@ import { serveStatic } from "@hono/node-server/serve-static";
 import { registerLocalMediaAdapter } from "adapter/node/index";
 import { type RuntimeBkndConfig, createRuntimeApp, type RuntimeOptions } from "bknd/adapter";
 import { config as $config } from "bknd/core";
+import { $console } from "core";
 
 type NodeEnv = NodeJS.ProcessEnv;
 export type NodeBkndConfig<Env = NodeEnv> = RuntimeBkndConfig<Env> & {
@@ -62,7 +63,7 @@ export function serve<Env = NodeEnv>(
          fetch: createHandler(config, args, opts),
       },
       (connInfo) => {
-         console.log(`Server is running on http://localhost:${connInfo.port}`);
+         $console.log(`Server is running on http://localhost:${connInfo.port}`);
          listener?.(connInfo);
       },
    );

app/src/adapter/node/storage/StorageLocalAdapter.native-spec.ts

@@ -1,5 +1,6 @@
 import { describe } from "node:test";
-import { StorageLocalAdapter, nodeTestRunner } from "adapter/node";
+import { nodeTestRunner } from "adapter/node/test";
+import { StorageLocalAdapter } from "adapter/node";
 import { adapterTestSuite } from "media/storage/adapters/adapter-test-suite";
 import { readFileSync } from "node:fs";
 import path from "node:path";

app/src/adapter/node/storage/StorageLocalAdapter.ts

@@ -1,7 +1,9 @@
 import { readFile, readdir, stat, unlink, writeFile } from "node:fs/promises";
-import { type Static, Type, isFile, parse } from "bknd/utils";
+import { type Static, isFile, parse } from "bknd/utils";
 import type { FileBody, FileListObject, FileMeta, FileUploadPayload } from "bknd/media";
 import { StorageAdapter, guessMimeType as guess } from "bknd/media";
+import * as tb from "@sinclair/typebox";
+const { Type } = tb;
 
 export const localAdapterConfig = Type.Object(
    {

app/src/auth/AppAuth.ts

@@ -1,29 +1,23 @@
-import {
-   type AuthAction,
-   AuthPermissions,
-   Authenticator,
-   type ProfileExchange,
-   Role,
-   type Strategy,
-} from "auth";
+import { Authenticator, AuthPermissions, Role, type Strategy } from "auth";
 import type { PasswordStrategy } from "auth/authenticate/strategies";
-import { $console, type DB, Exception, type PrimaryFieldType } from "core";
-import { type Static, secureRandomString, transformObject } from "core/utils";
+import { $console, type DB } from "core";
+import { secureRandomString, transformObject } from "core/utils";
 import type { Entity, EntityManager } from "data";
-import { type FieldSchema, em, entity, enumm, text } from "data/prototype";
-import { pick } from "lodash-es";
+import { em, entity, enumm, type FieldSchema, text } from "data/prototype";
 import { Module } from "modules/Module";
 import { AuthController } from "./api/AuthController";
-import { type AppAuthSchema, STRATEGIES, authConfigSchema } from "./auth-schema";
+import { type AppAuthSchema, authConfigSchema, STRATEGIES } from "./auth-schema";
+import { AppUserPool } from "auth/AppUserPool";
+import type { AppEntity } from "core/config";
 
 export type UserFieldSchema = FieldSchema<typeof AppAuth.usersFields>;
 declare module "core" {
+   interface Users extends AppEntity, UserFieldSchema {}
    interface DB {
-      users: { id: PrimaryFieldType } & UserFieldSchema;
+      users: Users;
    }
 }
 
-type AuthSchema = Static<typeof authConfigSchema>;
 export type CreateUserPayload = { email: string; password: string; [key: string]: any };
 
 export class AppAuth extends Module<typeof authConfigSchema> {
@@ -31,12 +25,12 @@ export class AppAuth extends Module<typeof authConfigSchema> {
    cache: Record<string, any> = {};
    _controller!: AuthController;
 
-   override async onBeforeUpdate(from: AuthSchema, to: AuthSchema) {
+   override async onBeforeUpdate(from: AppAuthSchema, to: AppAuthSchema) {
       const defaultSecret = authConfigSchema.properties.jwt.properties.secret.default;
 
       if (!from.enabled && to.enabled) {
          if (to.jwt.secret === defaultSecret) {
-            console.warn("No JWT secret provided, generating a random one");
+            $console.warn("No JWT secret provided, generating a random one");
             to.jwt.secret = secureRandomString(64);
          }
       }
@@ -80,7 +74,7 @@ export class AppAuth extends Module<typeof authConfigSchema> {
          }
       });
 
-      this._authenticator = new Authenticator(strategies, this.resolveUser.bind(this), {
+      this._authenticator = new Authenticator(strategies, new AppUserPool(this), {
          jwt: this.config.jwt,
          cookie: this.config.cookie,
       });
@@ -90,7 +84,7 @@ export class AppAuth extends Module<typeof authConfigSchema> {
 
       this._controller = new AuthController(this);
       this.ctx.server.route(this.config.basepath, this._controller.getController());
-      this.ctx.guard.registerPermissions(Object.values(AuthPermissions));
+      this.ctx.guard.registerPermissions(AuthPermissions);
    }
 
    isStrategyEnabled(strategy: Strategy | string) {
@@ -122,120 +116,6 @@ export class AppAuth extends Module<typeof authConfigSchema> {
       return this.ctx.em as any;
    }
 
-   private async resolveUser(
-      action: AuthAction,
-      strategy: Strategy,
-      identifier: string,
-      profile: ProfileExchange,
-   ): Promise<any> {
-      if (!this.config.allow_register && action === "register") {
-         throw new Exception("Registration is not allowed", 403);
-      }
-
-      const fields = this.getUsersEntity()
-         .getFillableFields("create")
-         .map((f) => f.name);
-      const filteredProfile = Object.fromEntries(
-         Object.entries(profile).filter(([key]) => fields.includes(key)),
-      );
-
-      switch (action) {
-         case "login":
-            return this.login(strategy, identifier, filteredProfile);
-         case "register":
-            return this.register(strategy, identifier, filteredProfile);
-      }
-   }
-
-   private filterUserData(user: any) {
-      return pick(user, this.config.jwt.fields);
-   }
-
-   private async login(strategy: Strategy, identifier: string, profile: ProfileExchange) {
-      if (!("email" in profile)) {
-         throw new Exception("Profile must have email");
-      }
-      if (typeof identifier !== "string" || identifier.length === 0) {
-         throw new Exception("Identifier must be a string");
-      }
-
-      const users = this.getUsersEntity();
-      this.toggleStrategyValueVisibility(true);
-      const result = await this.em
-         .repo(users as unknown as "users")
-         .findOne({ email: profile.email! });
-      this.toggleStrategyValueVisibility(false);
-      if (!result.data) {
-         throw new Exception("User not found", 404);
-      }
-
-      // compare strategy and identifier
-      if (result.data.strategy !== strategy.getName()) {
-         //console.log("!!! User registered with different strategy");
-         throw new Exception("User registered with different strategy");
-      }
-
-      if (result.data.strategy_value !== identifier) {
-         throw new Exception("Invalid credentials");
-      }
-
-      return this.filterUserData(result.data);
-   }
-
-   private async register(strategy: Strategy, identifier: string, profile: ProfileExchange) {
-      if (!("email" in profile)) {
-         throw new Exception("Profile must have an email");
-      }
-      if (typeof identifier !== "string" || identifier.length === 0) {
-         throw new Exception("Identifier must be a string");
-      }
-
-      const users = this.getUsersEntity();
-      const { data } = await this.em.repo(users).findOne({ email: profile.email! });
-      if (data) {
-         throw new Exception("User already exists");
-      }
-
-      const payload: any = {
-         ...profile,
-         strategy: strategy.getName(),
-         strategy_value: identifier,
-      };
-
-      const mutator = this.em.mutator(users);
-      mutator.__unstable_toggleSystemEntityCreation(false);
-      this.toggleStrategyValueVisibility(true);
-      const createResult = await mutator.insertOne(payload);
-      mutator.__unstable_toggleSystemEntityCreation(true);
-      this.toggleStrategyValueVisibility(false);
-      if (!createResult.data) {
-         throw new Error("Could not create user");
-      }
-
-      return this.filterUserData(createResult.data);
-   }
-
-   private toggleStrategyValueVisibility(visible: boolean) {
-      const toggle = (name: string, visible: boolean) => {
-         const field = this.getUsersEntity().field(name)!;
-
-         if (visible) {
-            field.config.hidden = false;
-            field.config.fillable = true;
-         } else {
-            // reset to normal
-            const template = AppAuth.usersFields.strategy_value.config;
-            field.config.hidden = template.hidden;
-            field.config.fillable = template.fillable;
-         }
-      };
-
-      toggle("strategy_value", visible);
-      toggle("strategy", visible);
-
-      // @todo: think about a PasswordField that automatically hashes on save?
-   }
-
    getUsersEntity(forceCreate?: boolean): Entity<"users", typeof AppAuth.usersFields> {
       const entity_name = this.config.entity_name;
       if (forceCreate || !this.em.hasEntity(entity_name)) {
@@ -288,7 +168,7 @@ export class AppAuth extends Module<typeof authConfigSchema> {
          throw new Error("Cannot create user, auth not enabled");
       }
 
-      const strategy = "password";
+      const strategy = "password" as const;
       const pw = this.authenticator.strategy(strategy) as PasswordStrategy;
       const strategy_value = await pw.hash(password);
       const mutator = this.em.mutator(this.config.entity_name as "users");
@@ -315,8 +195,7 @@ export class AppAuth extends Module<typeof authConfigSchema> {
          ...this.authenticator.toJSON(secrets),
          strategies: transformObject(strategies, (strategy) => ({
             enabled: this.isStrategyEnabled(strategy),
-            type: strategy.getType(),
-            config: strategy.toJSON(secrets),
+            ...strategy.toJSON(secrets),
          })),
       };
    }

app/src/auth/AppUserPool.ts

@@ -0,0 +1,83 @@
+import { AppAuth } from "auth/AppAuth";
+import type { CreateUser, SafeUser, User, UserPool } from "auth/authenticate/Authenticator";
+import { $console } from "core";
+import { pick } from "lodash-es";
+import {
+   InvalidConditionsException,
+   UnableToCreateUserException,
+   UserNotFoundException,
+} from "auth/errors";
+
+export class AppUserPool implements UserPool {
+   constructor(private appAuth: AppAuth) {}
+
+   get em() {
+      return this.appAuth.em;
+   }
+
+   get users() {
+      return this.appAuth.getUsersEntity();
+   }
+
+   async findBy(strategy: string, prop: keyof SafeUser, value: any) {
+      $console.debug("[AppUserPool:findBy]", { strategy, prop, value });
+      this.toggleStrategyValueVisibility(true);
+      const result = await this.em.repo(this.users).findOne({ [prop]: value, strategy });
+      this.toggleStrategyValueVisibility(false);
+
+      if (!result.data) {
+         $console.debug("[AppUserPool]: User not found");
+         throw new UserNotFoundException();
+      }
+
+      return result.data;
+   }
+
+   async create(strategy: string, payload: CreateUser & Partial<Omit<User, "id">>) {
+      $console.debug("[AppUserPool:create]", { strategy, payload });
+      if (!("strategy_value" in payload)) {
+         throw new InvalidConditionsException("Profile must have a strategy_value value");
+      }
+
+      const fields = this.users.getSelect(undefined, "create");
+      const safeProfile = pick(payload, fields) as any;
+      const createPayload: Omit<User, "id"> = {
+         ...safeProfile,
+         strategy,
+      };
+
+      const mutator = this.em.mutator(this.users);
+      mutator.__unstable_toggleSystemEntityCreation(false);
+      this.toggleStrategyValueVisibility(true);
+      const createResult = await mutator.insertOne(createPayload);
+      mutator.__unstable_toggleSystemEntityCreation(true);
+      this.toggleStrategyValueVisibility(false);
+      if (!createResult.data) {
+         throw new UnableToCreateUserException();
+      }
+
+      $console.debug("[AppUserPool]: User created", createResult.data);
+      return createResult.data;
+   }
+
+   private toggleStrategyValueVisibility(visible: boolean) {
+      const toggle = (name: string, visible: boolean) => {
+         const field = this.users.field(name)!;
+
+         if (visible) {
+            field.config.hidden = false;
+            field.config.fillable = true;
+         } else {
+            // reset to normal
+            const template = AppAuth.usersFields.strategy_value.config;
+            field.config.hidden = template.hidden;
+            field.config.fillable = template.fillable;
+         }
+      };
+
+      toggle("strategy_value", visible);
+      toggle("strategy", visible);
+
+      // @todo: think about a PasswordField that automatically hashes on save?
+   }
+}

app/src/auth/api/AuthApi.ts

@@ -4,19 +4,21 @@ import type { AuthResponse, SafeUser, Strategy } from "auth/authenticate/Authent
 import { type BaseModuleApiOptions, ModuleApi } from "modules/ModuleApi";
 
 export type AuthApiOptions = BaseModuleApiOptions & {
-   onTokenUpdate?: (token: string) => void | Promise<void>;
+   onTokenUpdate?: (token?: string) => void | Promise<void>;
+   credentials?: "include" | "same-origin" | "omit";
 };
 
 export class AuthApi extends ModuleApi<AuthApiOptions> {
    protected override getDefaultOptions(): Partial<AuthApiOptions> {
       return {
          basepath: "/api/auth",
+         credentials: "include",
       };
    }
 
    async login(strategy: string, input: any) {
       const res = await this.post<AuthResponse>([strategy, "login"], input, {
-         credentials: "include",
+         credentials: this.options.credentials,
       });
 
       if (res.ok && res.body.token) {
@@ -27,7 +29,7 @@ export class AuthApi extends ModuleApi<AuthApiOptions> {
 
    async register(strategy: string, input: any) {
       const res = await this.post<AuthResponse>([strategy, "register"], input, {
-         credentials: "include",
+         credentials: this.options.credentials,
       });
 
       if (res.ok && res.body.token) {
@@ -68,5 +70,7 @@ export class AuthApi extends ModuleApi<AuthApiOptions> {
       return this.get<Pick<AppAuthSchema, "strategies" | "basepath">>(["strategies"]);
    }
 
-   async logout() {}
+   async logout() {
+      await this.options.onTokenUpdate?.(undefined);
+   }
 }

app/src/auth/api/AuthController.ts

@@ -1,9 +1,9 @@
 import { type AppAuth, AuthPermissions, type SafeUser, type Strategy } from "auth";
-import { tbValidator as tb } from "core";
-import { Type, TypeInvalidError, parse, transformObject } from "core/utils";
+import { TypeInvalidError, parse, transformObject } from "core/utils";
 import { DataPermissions } from "data";
 import type { Hono } from "hono";
 import { Controller, type ServerEnv } from "modules/Controller";
+import { describeRoute, jsc, s } from "core/object/schema";
 
 export type AuthActionResponse = {
    success: boolean;
@@ -12,10 +12,6 @@ export type AuthActionResponse = {
    errors?: any;
 };
 
-const booleanLike = Type.Transform(Type.String())
-   .Decode((v) => v === "1")
-   .Encode((v) => (v ? "1" : "0"));
-
 export class AuthController extends Controller {
    constructor(private auth: AppAuth) {
       super();
@@ -54,6 +50,10 @@ export class AuthController extends Controller {
          hono.post(
             "/create",
             permission([AuthPermissions.createUser, DataPermissions.entityCreate]),
+            describeRoute({
+               summary: "Create a new user",
+               tags: ["auth"],
+            }),
             async (c) => {
                try {
                   const body = await this.auth.authenticator.getBody(c);
@@ -91,9 +91,16 @@ export class AuthController extends Controller {
                }
             },
          );
-         hono.get("create/schema.json", async (c) => {
-            return c.json(create.schema);
-         });
+         hono.get(
+            "create/schema.json",
+            describeRoute({
+               summary: "Get the schema for creating a user",
+               tags: ["auth"],
+            }),
+            async (c) => {
+               return c.json(create.schema);
+            },
+         );
       }
 
       mainHono.route(`/${name}/actions`, hono);
@@ -102,42 +109,55 @@ export class AuthController extends Controller {
    override getController() {
       const { auth } = this.middlewares;
       const hono = this.create();
-      const strategies = this.auth.authenticator.getStrategies();
 
-      for (const [name, strategy] of Object.entries(strategies)) {
-         if (!this.auth.isStrategyEnabled(strategy)) continue;
+      hono.get(
+         "/me",
+         describeRoute({
+            summary: "Get the current user",
+            tags: ["auth"],
+         }),
+         auth(),
+         async (c) => {
+            const claims = c.get("auth")?.user;
+            if (claims) {
+               const { data: user } = await this.userRepo.findId(claims.id);
+               await this.auth.authenticator?.requestCookieRefresh(c);
+               return c.json({ user });
+            }
 
-         hono.route(`/${name}`, strategy.getController(this.auth.authenticator));
-         this.registerStrategyActions(strategy, hono);
-      }
+            return c.json({ user: null }, 403);
+         },
+      );
 
-      hono.get("/me", auth(), async (c) => {
-         const claims = c.get("auth")?.user;
-         if (claims) {
-            const { data: user } = await this.userRepo.findId(claims.id);
-            return c.json({ user });
-         }
+      hono.get(
+         "/logout",
+         describeRoute({
+            summary: "Logout the current user",
+            tags: ["auth"],
+         }),
+         auth(),
+         async (c) => {
+            await this.auth.authenticator.logout(c);
+            if (this.auth.authenticator.isJsonRequest(c)) {
+               return c.json({ ok: true });
+            }
 
-         return c.json({ user: null }, 403);
-      });
+            const referer = c.req.header("referer");
+            if (referer) {
+               return c.redirect(referer);
+            }
 
-      hono.get("/logout", auth(), async (c) => {
-         await this.auth.authenticator.logout(c);
-         if (this.auth.authenticator.isJsonRequest(c)) {
-            return c.json({ ok: true });
-         }
-
-         const referer = c.req.header("referer");
-         if (referer) {
-            return c.redirect(referer);
-         }
-
-         return c.redirect("/");
-      });
+            return c.redirect("/");
+         },
+      );
 
       hono.get(
          "/strategies",
-         tb("query", Type.Object({ include_disabled: Type.Optional(booleanLike) })),
+         describeRoute({
+            summary: "Get the available authentication strategies",
+            tags: ["auth"],
+         }),
+         jsc("query", s.object({ include_disabled: s.boolean().optional() })),
          async (c) => {
             const { include_disabled } = c.req.valid("query");
             const { strategies, basepath } = this.auth.toJSON(false);
@@ -155,6 +175,15 @@ export class AuthController extends Controller {
          },
       );
 
+      const strategies = this.auth.authenticator.getStrategies();
+
+      for (const [name, strategy] of Object.entries(strategies)) {
+         if (!this.auth.isStrategyEnabled(strategy)) continue;
+
+         hono.route(`/${name}`, strategy.getController(this.auth.authenticator));
+         this.registerStrategyActions(strategy, hono);
+      }
+
       return hono.all("*", (c) => c.notFound());
    }
 }

app/src/auth/auth-schema.ts

@@ -1,6 +1,8 @@
 import { cookieConfig, jwtConfig } from "auth/authenticate/Authenticator";
 import { CustomOAuthStrategy, OAuthStrategy, PasswordStrategy } from "auth/authenticate/strategies";
-import { type Static, StringRecord, Type, objectTransform } from "core/utils";
+import { type Static, StringRecord, objectTransform } from "core/utils";
+import * as tbbox from "@sinclair/typebox";
+const { Type } = tbbox;
 
 export const Strategies = {
    password: {

app/src/auth/authenticate/Authenticator.ts

@@ -1,13 +1,12 @@
-import { type DB, Exception, type PrimaryFieldType } from "core";
+import { $console, type DB, Exception } from "core";
 import { addFlashMessage } from "core/server/flash";
 import {
    type Static,
    StringEnum,
    type TObject,
-   Type,
    parse,
    runtimeSupports,
-   transformObject,
+   truncate,
 } from "core/utils";
 import type { Context, Hono } from "hono";
 import { deleteCookie, getSignedCookie, setSignedCookie } from "hono/cookie";
@@ -15,6 +14,9 @@ import { sign, verify } from "hono/jwt";
 import type { CookieOptions } from "hono/utils/cookie";
 import type { ServerEnv } from "modules/Controller";
 import { pick } from "lodash-es";
+import * as tbbox from "@sinclair/typebox";
+import { InvalidConditionsException } from "auth/errors";
+const { Type } = tbbox;
 
 type Input = any; // workaround
 export type JWTPayload = Parameters<typeof sign>[0];
@@ -23,11 +25,12 @@ export const strategyActions = ["create", "change"] as const;
 export type StrategyActionName = (typeof strategyActions)[number];
 export type StrategyAction<S extends TObject = TObject> = {
    schema: S;
-   preprocess: (input: unknown) => Promise<Omit<DB["users"], "id" | "strategy">>;
+   preprocess: (input: Static<S>) => Promise<Omit<DB["users"], "id" | "strategy">>;
 };
 export type StrategyActions = Partial<Record<StrategyActionName, StrategyAction>>;
 
 // @todo: add schema to interface to ensure proper inference
+// @todo: add tests (e.g. invalid strategy_value)
 export interface Strategy {
    getController: (auth: Authenticator) => Hono<any>;
    getType: () => string;
@@ -37,28 +40,22 @@ export interface Strategy {
    getActions?: () => StrategyActions;
 }
 
-export type User = {
-   id: PrimaryFieldType;
-   email: string;
-   password: string;
-   role?: string | null;
-};
+export type User = DB["users"];
 
 export type ProfileExchange = {
    email?: string;
-   username?: string;
-   sub?: string;
-   password?: string;
+   strategy?: string;
+   strategy_value?: string;
    [key: string]: any;
 };
 
-export type SafeUser = Omit<User, "password">;
+export type SafeUser = Omit<User, "strategy_value">;
 export type CreateUser = Pick<User, "email"> & { [key: string]: any };
 export type AuthResponse = { user: SafeUser; token: string };
 
-export interface UserPool<Fields = "id" | "email" | "username"> {
-   findBy: (prop: Fields, value: string | number) => Promise<User | undefined>;
-   create: (user: CreateUser) => Promise<User | undefined>;
+export interface UserPool {
+   findBy: (strategy: string, prop: keyof SafeUser, value: string | number) => Promise<User>;
+   create: (strategy: string, user: CreateUser) => Promise<User>;
 }
 
 const defaultCookieExpires = 60 * 60 * 24 * 7; // 1 week in seconds
@@ -100,12 +97,17 @@ export const authenticatorConfig = Type.Object({
 
 type AuthConfig = Static<typeof authenticatorConfig>;
 export type AuthAction = "login" | "register";
+export type AuthResolveOptions = {
+   identifier?: "email" | string;
+   redirect?: string;
+   forceJsonResponse?: boolean;
+};
 export type AuthUserResolver = (
    action: AuthAction,
    strategy: Strategy,
-   identifier: string,
    profile: ProfileExchange,
-) => Promise<SafeUser | undefined>;
+   opts?: AuthResolveOptions,
+) => Promise<ProfileExchange | undefined>;
 type AuthClaims = SafeUser & {
    iat: number;
    iss?: string;
@@ -113,33 +115,117 @@ type AuthClaims = SafeUser & {
 };
 
 export class Authenticator<Strategies extends Record<string, Strategy> = Record<string, Strategy>> {
-   private readonly strategies: Strategies;
    private readonly config: AuthConfig;
-   private readonly userResolver: AuthUserResolver;
 
-   constructor(strategies: Strategies, userResolver?: AuthUserResolver, config?: AuthConfig) {
-      this.userResolver = userResolver ?? (async (a, s, i, p) => p as any);
-      this.strategies = strategies as Strategies;
+   constructor(
+      private readonly strategies: Strategies,
+      private readonly userPool: UserPool,
+      config?: AuthConfig,
+   ) {
       this.config = parse(authenticatorConfig, config ?? {});
    }
 
-   async resolve(
-      action: AuthAction,
+   async resolveLogin(
+      c: Context,
       strategy: Strategy,
-      identifier: string,
-      profile: ProfileExchange,
-   ): Promise<AuthResponse> {
-      //console.log("resolve", { action, strategy: strategy.getName(), profile });
-      const user = await this.userResolver(action, strategy, identifier, profile);
+      profile: Partial<SafeUser>,
+      verify: (user: User) => Promise<void>,
+      opts?: AuthResolveOptions,
+   ) {
+      try {
+         // @todo: centralize identifier and checks
+         // @todo: check identifier value (if allowed)
+         const identifier = opts?.identifier || "email";
+         if (typeof identifier !== "string" || identifier.length === 0) {
+            throw new InvalidConditionsException("Identifier must be a string");
+         }
+         if (!(identifier in profile)) {
+            throw new InvalidConditionsException(`Profile must have identifier "${identifier}"`);
+         }
 
-      if (user) {
-         return {
-            user,
-            token: await this.jwt(user),
-         };
+         const user = await this.userPool.findBy(
+            strategy.getName(),
+            identifier as any,
+            profile[identifier],
+         );
+
+         if (!user.strategy_value) {
+            throw new InvalidConditionsException("User must have a strategy value");
+         } else if (user.strategy !== strategy.getName()) {
+            throw new InvalidConditionsException("User signed up with a different strategy");
+         }
+
+         await verify(user);
+         const data = await this.safeAuthResponse(user);
+         return this.respondWithUser(c, data, opts);
+      } catch (e) {
+         return this.respondWithError(c, e as Error, opts);
+      }
+   }
+
+   async resolveRegister(
+      c: Context,
+      strategy: Strategy,
+      profile: CreateUser,
+      verify: (user: User) => Promise<void>,
+      opts?: AuthResolveOptions,
+   ) {
+      try {
+         const identifier = opts?.identifier || "email";
+         if (typeof identifier !== "string" || identifier.length === 0) {
+            throw new InvalidConditionsException("Identifier must be a string");
+         }
+         if (!(identifier in profile)) {
+            throw new InvalidConditionsException(`Profile must have identifier "${identifier}"`);
+         }
+         if (!("strategy_value" in profile)) {
+            throw new InvalidConditionsException("Profile must have a strategy value");
+         }
+
+         const user = await this.userPool.create(strategy.getName(), {
+            ...profile,
+            strategy_value: profile.strategy_value,
+         });
+
+         await verify(user);
+         const data = await this.safeAuthResponse(user);
+         return this.respondWithUser(c, data, opts);
+      } catch (e) {
+         return this.respondWithError(c, e as Error, opts);
+      }
+   }
+
+   private async respondWithUser(c: Context, data: AuthResponse, opts?: AuthResolveOptions) {
+      const successUrl = this.getSafeUrl(
+         c,
+         opts?.redirect ?? this.config.cookie.pathSuccess ?? "/",
+      );
+
+      if ("token" in data) {
+         await this.setAuthCookie(c, data.token);
+
+         if (this.isJsonRequest(c) || opts?.forceJsonResponse) {
+            return c.json(data);
+         }
+
+         // can't navigate to "/" – doesn't work on nextjs
+         return c.redirect(successUrl);
       }
 
-      throw new Error("User could not be resolved");
+      throw new Exception("Invalid response");
+   }
+
+   async respondWithError(c: Context, error: Error, opts?: AuthResolveOptions) {
+      $console.error("respondWithError", error);
+      if (this.isJsonRequest(c) || opts?.forceJsonResponse) {
+         // let the server handle it
+         throw error;
+      }
+
+      await addFlashMessage(c, String(error), "error");
+
+      const referer = this.getSafeUrl(c, opts?.redirect ?? c.req.header("Referer") ?? "/");
+      return c.redirect(referer);
    }
 
    getStrategies(): Strategies {
@@ -158,7 +244,7 @@ export class Authenticator<Strategies extends Record<string, Strategy> = Record<
    }
 
    // @todo: add jwt tests
-   async jwt(_user: Omit<User, "password">): Promise<string> {
+   async jwt(_user: SafeUser | ProfileExchange): Promise<string> {
       const user = pick(_user, this.config.jwt.fields);
 
       const payload: JWTPayload = {
@@ -184,6 +270,14 @@ export class Authenticator<Strategies extends Record<string, Strategy> = Record<
       return sign(payload, secret, this.config.jwt?.alg ?? "HS256");
    }
 
+   async safeAuthResponse(_user: User): Promise<AuthResponse> {
+      const user = pick(_user, this.config.jwt.fields) as SafeUser;
+      return {
+         user,
+         token: await this.jwt(user),
+      };
+   }
+
    async verify(jwt: string): Promise<AuthClaims | undefined> {
       try {
          const payload = await verify(
@@ -225,7 +319,7 @@ export class Authenticator<Strategies extends Record<string, Strategy> = Record<
          return token;
       } catch (e: any) {
          if (e instanceof Error) {
-            console.error("[Error:getAuthCookie]", e.message);
+            $console.error("[getAuthCookie]", e.message);
          }
 
          return undefined;
@@ -242,15 +336,18 @@ export class Authenticator<Strategies extends Record<string, Strategy> = Record<
    }
 
    private async setAuthCookie(c: Context<ServerEnv>, token: string) {
+      $console.debug("setting auth cookie", truncate(token));
       const secret = this.config.jwt.secret;
       await setSignedCookie(c, "auth", token, secret, this.cookieOptions);
    }
 
    private async deleteAuthCookie(c: Context) {
+      $console.debug("deleting auth cookie");
       await deleteCookie(c, "auth", this.cookieOptions);
    }
 
    async logout(c: Context<ServerEnv>) {
+      $console.info("Logging out");
       c.set("auth", undefined);
 
       const cookie = await this.getAuthCookie(c);
@@ -262,7 +359,6 @@ export class Authenticator<Strategies extends Record<string, Strategy> = Record<
 
    // @todo: move this to a server helper
    isJsonRequest(c: Context): boolean {
-      //return c.req.header("Content-Type") === "application/x-www-form-urlencoded";
       return c.req.header("Content-Type") === "application/json";
    }
 
@@ -286,37 +382,6 @@ export class Authenticator<Strategies extends Record<string, Strategy> = Record<
       return p;
    }
 
-   async respond(c: Context, data: AuthResponse | Error | any, redirect?: string) {
-      const successUrl = this.getSafeUrl(c, redirect ?? this.config.cookie.pathSuccess ?? "/");
-      const referer = redirect ?? c.req.header("Referer") ?? successUrl;
-      //console.log("auth respond", { redirect, successUrl, successPath });
-
-      if ("token" in data) {
-         await this.setAuthCookie(c, data.token);
-
-         if (this.isJsonRequest(c)) {
-            return c.json(data);
-         }
-
-         // can't navigate to "/" – doesn't work on nextjs
-         //console.log("auth success, redirecting to", successUrl);
-         return c.redirect(successUrl);
-      }
-
-      if (this.isJsonRequest(c)) {
-         return c.json(data, 400);
-      }
-
-      let message = "An error occured";
-      if (data instanceof Exception) {
-         message = data.message;
-      }
-
-      await addFlashMessage(c, message, "error");
-      //console.log("auth failed, redirecting to", referer);
-      return c.redirect(referer);
-   }
-
    // @todo: don't extract user from token, but from the database or cache
    async resolveAuthFromRequest(c: Context): Promise<SafeUser | undefined> {
       let token: string | undefined;
@@ -341,13 +406,3 @@ export class Authenticator<Strategies extends Record<string, Strategy> = Record<
       };
    }
 }
-
-export function createStrategyAction<S extends TObject>(
-   schema: S,
-   preprocess: (input: Static<S>) => Promise<Partial<DB["users"]>>,
-) {
-   return {
-      schema,
-      preprocess,
-   } as StrategyAction<S>;
-}

app/src/auth/authenticate/strategies/PasswordStrategy.ts

@@ -1,152 +1,135 @@
-import type { Authenticator, Strategy } from "auth";
-import { isDebug, tbValidator as tb } from "core";
-import { type Static, StringEnum, Type, parse } from "core/utils";
-import { hash } from "core/utils";
-import { type Context, Hono } from "hono";
-import { type StrategyAction, type StrategyActions, createStrategyAction } from "../Authenticator";
+import { type Authenticator, InvalidCredentialsException, type User } from "auth";
+import { $console, tbValidator as tb } from "core";
+import { hash, parse, type Static, StrictObject, StringEnum } from "core/utils";
+import { Hono } from "hono";
+import { compare as bcryptCompare, genSalt as bcryptGenSalt, hash as bcryptHash } from "bcryptjs";
+import * as tbbox from "@sinclair/typebox";
+import { Strategy } from "./Strategy";
 
-type LoginSchema = { username: string; password: string } | { email: string; password: string };
-type RegisterSchema = { email: string; password: string; [key: string]: any };
+const { Type } = tbbox;
 
-const schema = Type.Object({
-   hashing: StringEnum(["plain", "sha256" /*, "bcrypt"*/] as const, { default: "sha256" }),
+const schema = StrictObject({
+   hashing: StringEnum(["plain", "sha256", "bcrypt"], { default: "sha256" }),
+   rounds: Type.Optional(Type.Number({ minimum: 1, maximum: 10 })),
 });
 
 export type PasswordStrategyOptions = Static<typeof schema>;
-/*export type PasswordStrategyOptions2 = {
-   hashing?: "plain" | "bcrypt" | "sha256";
-};*/
 
-export class PasswordStrategy implements Strategy {
-   private options: PasswordStrategyOptions;
+export class PasswordStrategy extends Strategy<typeof schema> {
+   constructor(config: Partial<PasswordStrategyOptions> = {}) {
+      super(config as any, "password", "password", "form");
 
-   constructor(options: Partial<PasswordStrategyOptions> = {}) {
-      this.options = parse(schema, options);
-   }
-
-   async hash(password: string) {
-      switch (this.options.hashing) {
-         case "sha256":
-            return hash.sha256(password);
-         default:
-            return password;
-      }
-   }
-
-   async login(input: LoginSchema) {
-      if (!("email" in input) || !("password" in input)) {
-         throw new Error("Invalid input: Email and password must be provided");
-      }
-
-      const hashedPassword = await this.hash(input.password);
-      return { ...input, password: hashedPassword };
-   }
-
-   async register(input: RegisterSchema) {
-      if (!input.email || !input.password) {
-         throw new Error("Invalid input: Email and password must be provided");
-      }
-
-      return {
-         ...input,
-         password: await this.hash(input.password),
-      };
-   }
-
-   getController(authenticator: Authenticator): Hono<any> {
-      const hono = new Hono();
-
-      return hono
-         .post(
-            "/login",
-            tb(
-               "query",
-               Type.Object({
-                  redirect: Type.Optional(Type.String()),
-               }),
-            ),
-            async (c) => {
-               const body = await authenticator.getBody(c);
-               const { redirect } = c.req.valid("query");
-
-               try {
-                  const payload = await this.login(body);
-                  const data = await authenticator.resolve(
-                     "login",
-                     this,
-                     payload.password,
-                     payload,
-                  );
-
-                  return await authenticator.respond(c, data, redirect);
-               } catch (e) {
-                  return await authenticator.respond(c, e);
-               }
-            },
-         )
-         .post(
-            "/register",
-            tb(
-               "query",
-               Type.Object({
-                  redirect: Type.Optional(Type.String()),
-               }),
-            ),
-            async (c) => {
-               const body = await authenticator.getBody(c);
-               const { redirect } = c.req.valid("query");
-
-               const payload = await this.register(body);
-               const data = await authenticator.resolve(
-                  "register",
-                  this,
-                  payload.password,
-                  payload,
-               );
-
-               return await authenticator.respond(c, data, redirect);
-            },
-         );
-   }
-
-   getActions(): StrategyActions {
-      return {
-         create: createStrategyAction(
-            Type.Object({
-               email: Type.String({
-                  pattern: "^[\\w-\\.]+@([\\w-]+\\.)+[\\w-]{2,4}$",
-               }),
-               password: Type.String({
-                  minLength: 8, // @todo: this should be configurable
-               }),
-            }),
-            async ({ password, ...input }) => {
-               return {
-                  ...input,
-                  strategy_value: await this.hash(password),
-               };
-            },
-         ),
-      };
+      this.registerAction("create", this.getPayloadSchema(), async ({ password, ...input }) => {
+         return {
+            ...input,
+            strategy_value: await this.hash(password),
+         };
+      });
    }
 
    getSchema() {
       return schema;
    }
 
-   getType() {
-      return "password";
+   private getPayloadSchema() {
+      return Type.Object({
+         email: Type.String({
+            pattern: "^[\\w-\\.\\+_]+@([\\w-]+\\.)+[\\w-]{2,4}$",
+         }),
+         password: Type.String({
+            minLength: 8, // @todo: this should be configurable
+         }),
+      });
    }
 
-   getMode() {
-      return "form" as const;
+   async hash(password: string) {
+      switch (this.config.hashing) {
+         case "sha256":
+            return hash.sha256(password);
+         case "bcrypt": {
+            const salt = await bcryptGenSalt(this.config.rounds ?? 4);
+            return bcryptHash(password, salt);
+         }
+         default:
+            return password;
+      }
    }
 
-   getName() {
-      return "password" as const;
+   async compare(actual: string, compare: string): Promise<boolean> {
+      switch (this.config.hashing) {
+         case "sha256": {
+            const compareHashed = await this.hash(compare);
+            return actual === compareHashed;
+         }
+         case "bcrypt":
+            return await bcryptCompare(compare, actual);
+      }
+
+      return false;
    }
 
-   toJSON(secrets?: boolean) {
-      return secrets ? this.options : undefined;
+   verify(password: string) {
+      return async (user: User) => {
+         const compare = await this.compare(user?.strategy_value!, password);
+         if (compare !== true) {
+            throw new InvalidCredentialsException();
+         }
+      };
+   }
+
+   getController(authenticator: Authenticator): Hono<any> {
+      const hono = new Hono();
+      const redirectQuerySchema = Type.Object({
+         redirect: Type.Optional(Type.String()),
+      });
+      const payloadSchema = this.getPayloadSchema();
+
+      hono.post("/login", tb("query", redirectQuerySchema), async (c) => {
+         try {
+            const body = parse(payloadSchema, await authenticator.getBody(c), {
+               onError: (errors) => {
+                  $console.error("Invalid login payload", [...errors]);
+                  throw new InvalidCredentialsException();
+               },
+            });
+            const { redirect } = c.req.valid("query");
+
+            return await authenticator.resolveLogin(c, this, body, this.verify(body.password), {
+               redirect,
+            });
+         } catch (e) {
+            return authenticator.respondWithError(c, e as any);
+         }
+      });
+
+      hono.post("/register", tb("query", redirectQuerySchema), async (c) => {
+         try {
+            const { redirect } = c.req.valid("query");
+            const { password, email, ...body } = parse(
+               payloadSchema,
+               await authenticator.getBody(c),
+               {
+                  onError: (errors) => {
+                     $console.error("Invalid register payload", [...errors]);
+                     new InvalidCredentialsException();
+                  },
+               },
+            );
+
+            const profile = {
+               ...body,
+               email,
+               strategy_value: await this.hash(password),
+            };
+
+            return await authenticator.resolveRegister(c, this, profile, async () => void 0, {
+               redirect,
+            });
+         } catch (e) {
+            return authenticator.respondWithError(c, e as any);
+         }
+      });
+
+      return hono;
    }
 }

app/src/auth/authenticate/strategies/Strategy.ts

@@ -0,0 +1,63 @@
+import type {
+   Authenticator,
+   StrategyAction,
+   StrategyActionName,
+   StrategyActions,
+} from "../Authenticator";
+import type { Hono } from "hono";
+import type { Static, TSchema } from "@sinclair/typebox";
+import { parse, type TObject } from "core/utils";
+
+export type StrategyMode = "form" | "external";
+
+export abstract class Strategy<Schema extends TSchema = TSchema> {
+   protected actions: StrategyActions = {};
+
+   constructor(
+      protected config: Static<Schema>,
+      public type: string,
+      public name: string,
+      public mode: StrategyMode,
+   ) {
+      // don't worry about typing, it'll throw if invalid
+      this.config = parse(this.getSchema(), (config ?? {}) as any) as Static<Schema>;
+   }
+
+   protected registerAction<S extends TObject = TObject>(
+      name: StrategyActionName,
+      schema: S,
+      preprocess: StrategyAction<S>["preprocess"],
+   ): void {
+      this.actions[name] = {
+         schema,
+         preprocess,
+      } as const;
+   }
+
+   protected abstract getSchema(): Schema;
+
+   abstract getController(auth: Authenticator): Hono;
+
+   getType(): string {
+      return this.type;
+   }
+
+   getMode() {
+      return this.mode;
+   }
+
+   getName(): string {
+      return this.name;
+   }
+
+   toJSON(secrets?: boolean): { type: string; config: Static<Schema> | {} | undefined } {
+      return {
+         type: this.getType(),
+         config: secrets ? this.config : undefined,
+      };
+   }
+
+   getActions(): StrategyActions {
+      return this.actions;
+   }
+}

app/src/auth/authenticate/strategies/index.ts

@@ -5,8 +5,8 @@ import { OAuthCallbackException, OAuthStrategy } from "./oauth/OAuthStrategy";
 export * as issuers from "./oauth/issuers";
 
 export {
-   PasswordStrategy,
    type PasswordStrategyOptions,
+   PasswordStrategy,
    OAuthStrategy,
    OAuthCallbackException,
    CustomOAuthStrategy,

app/src/auth/authenticate/strategies/oauth/CustomOAuthStrategy.ts

@@ -1,43 +1,35 @@
-import { type Static, StringEnum, Type } from "core/utils";
+import { type Static, StrictObject, StringEnum } from "core/utils";
+import * as tbbox from "@sinclair/typebox";
 import type * as oauth from "oauth4webapi";
 import { OAuthStrategy } from "./OAuthStrategy";
+const { Type } = tbbox;
 
 type SupportedTypes = "oauth2" | "oidc";
 
 type RequireKeys<T extends object, K extends keyof T> = Required<Pick<T, K>> & Omit<T, K>;
 
 const UrlString = Type.String({ pattern: "^(https?|wss?)://[^\\s/$.?#].[^\\s]*$" });
-const oauthSchemaCustom = Type.Object(
+const oauthSchemaCustom = StrictObject(
    {
       type: StringEnum(["oidc", "oauth2"] as const, { default: "oidc" }),
       name: Type.String(),
-      client: Type.Object(
-         {
-            client_id: Type.String(),
-            client_secret: Type.String(),
-            token_endpoint_auth_method: StringEnum(["client_secret_basic"]),
-         },
-         {
-            additionalProperties: false,
-         },
-      ),
-      as: Type.Object(
-         {
-            issuer: Type.String(),
-            code_challenge_methods_supported: Type.Optional(StringEnum(["S256"])),
-            scopes_supported: Type.Optional(Type.Array(Type.String())),
-            scope_separator: Type.Optional(Type.String({ default: " " })),
-            authorization_endpoint: Type.Optional(UrlString),
-            token_endpoint: Type.Optional(UrlString),
-            userinfo_endpoint: Type.Optional(UrlString),
-         },
-         {
-            additionalProperties: false,
-         },
-      ),
+      client: StrictObject({
+         client_id: Type.String(),
+         client_secret: Type.String(),
+         token_endpoint_auth_method: StringEnum(["client_secret_basic"]),
+      }),
+      as: StrictObject({
+         issuer: Type.String(),
+         code_challenge_methods_supported: Type.Optional(StringEnum(["S256"])),
+         scopes_supported: Type.Optional(Type.Array(Type.String())),
+         scope_separator: Type.Optional(Type.String({ default: " " })),
+         authorization_endpoint: Type.Optional(UrlString),
+         token_endpoint: Type.Optional(UrlString),
+         userinfo_endpoint: Type.Optional(UrlString),
+      }),
       // @todo: profile mapping
    },
-   { title: "Custom OAuth", additionalProperties: false },
+   { title: "Custom OAuth" },
 );
 
 type OAuthConfigCustom = Static<typeof oauthSchemaCustom>;
@@ -62,6 +54,11 @@ export type IssuerConfig<UserInfo = any> = {
 };
 
 export class CustomOAuthStrategy extends OAuthStrategy {
+   constructor(config: OAuthConfigCustom) {
+      super(config as any);
+      this.type = "custom_oauth";
+   }
+
    override getIssuerConfig(): IssuerConfig {
       return { ...this.config, profile: async (info) => info } as any;
    }
@@ -70,8 +67,4 @@ export class CustomOAuthStrategy extends OAuthStrategy {
    override getSchema() {
       return oauthSchemaCustom;
    }
-
-   override getType() {
-      return "custom_oauth";
-   }
 }

app/src/auth/authenticate/strategies/oauth/OAuthStrategy.ts

@@ -1,10 +1,13 @@
-import type { AuthAction, Authenticator, Strategy } from "auth";
+import type { AuthAction, Authenticator } from "auth";
 import { Exception, isDebug } from "core";
-import { type Static, StringEnum, type TSchema, Type, filterKeys, parse } from "core/utils";
+import { type Static, StringEnum, filterKeys, StrictObject } from "core/utils";
 import { type Context, Hono } from "hono";
 import { getSignedCookie, setSignedCookie } from "hono/cookie";
 import * as oauth from "oauth4webapi";
 import * as issuers from "./issuers";
+import * as tbbox from "@sinclair/typebox";
+import { Strategy } from "auth/authenticate/strategies/Strategy";
+const { Type } = tbbox;
 
 type ConfiguredIssuers = keyof typeof issuers;
 type SupportedTypes = "oauth2" | "oidc";
@@ -13,17 +16,12 @@ type RequireKeys<T extends object, K extends keyof T> = Required<Pick<T, K>> & O
 
 const schemaProvided = Type.Object(
    {
-      //type: StringEnum(["oidc", "oauth2"] as const, { default: "oidc" }),
       name: StringEnum(Object.keys(issuers) as ConfiguredIssuers[]),
-      client: Type.Object(
-         {
-            client_id: Type.String(),
-            client_secret: Type.String(),
-         },
-         {
-            additionalProperties: false,
-         },
-      ),
+      type: StringEnum(["oidc", "oauth2"] as const, { default: "oauth2" }),
+      client: StrictObject({
+         client_id: Type.String(),
+         client_secret: Type.String(),
+      }),
    },
    { title: "OAuth" },
 );
@@ -71,11 +69,13 @@ export class OAuthCallbackException extends Exception {
    }
 }
 
-export class OAuthStrategy implements Strategy {
-   constructor(private _config: OAuthConfig) {}
+export class OAuthStrategy extends Strategy<typeof schemaProvided> {
+   constructor(config: ProvidedOAuthConfig) {
+      super(config, "oauth", config.name, "external");
+   }
 
-   get config() {
-      return this._config;
+   getSchema() {
+      return schemaProvided;
    }
 
    getIssuerConfig(): IssuerConfig {
@@ -103,7 +103,7 @@ export class OAuthStrategy implements Strategy {
          type: info.type,
          client: {
             ...info.client,
-            ...this._config.client,
+            ...this.config.client,
          },
       };
    }
@@ -172,8 +172,7 @@ export class OAuthStrategy implements Strategy {
    ) {
       const config = await this.getConfig();
       const { client, as, type } = config;
-      //console.log("config", config);
-      console.log("callbackParams", callbackParams, options);
+
       const parameters = oauth.validateAuthResponse(
          as,
          client, // no client_secret required
@@ -181,13 +180,9 @@ export class OAuthStrategy implements Strategy {
          oauth.expectNoState,
       );
       if (oauth.isOAuth2Error(parameters)) {
-         //console.log("callback.error", parameters);
          throw new OAuthCallbackException(parameters, "validateAuthResponse");
       }
-      /*console.log(
-         "callback.parameters",
-         JSON.stringify(Object.fromEntries(parameters.entries()), null, 2),
-      );*/
+
       const response = await oauth.authorizationCodeGrantRequest(
          as,
          client,
@@ -195,13 +190,9 @@ export class OAuthStrategy implements Strategy {
          options.redirect_uri,
          options.state,
       );
-      //console.log("callback.response", response);
 
       const challenges = oauth.parseWwwAuthenticateChallenges(response);
       if (challenges) {
-         for (const challenge of challenges) {
-            //console.log("callback.challenge", challenge);
-         }
          // @todo: Handle www-authenticate challenges as needed
          throw new OAuthCallbackException(challenges, "www-authenticate");
       }
@@ -216,20 +207,13 @@ export class OAuthStrategy implements Strategy {
          expectedNonce,
       );
       if (oauth.isOAuth2Error(result)) {
-         console.log("callback.error", result);
          // @todo: Handle OAuth 2.0 response body error
          throw new OAuthCallbackException(result, "processAuthorizationCodeOpenIDResponse");
       }
 
-      //console.log("callback.result", result);
-
       const claims = oauth.getValidatedIdTokenClaims(result);
-      //console.log("callback.IDTokenClaims", claims);
-
       const infoRequest = await oauth.userInfoRequest(as, client, result.access_token!);
-
       const resultUser = await oauth.processUserInfoResponse(as, client, claims.sub, infoRequest);
-      //console.log("callback.resultUser", resultUser);
 
       return await config.profile(resultUser, config, claims); // @todo: check claims
    }
@@ -240,8 +224,7 @@ export class OAuthStrategy implements Strategy {
    ) {
       const config = await this.getConfig();
       const { client, type, as, profile } = config;
-      console.log("config", { client, as, type });
-      console.log("callbackParams", callbackParams, options);
+
       const parameters = oauth.validateAuthResponse(
          as,
          client, // no client_secret required
@@ -249,13 +232,9 @@ export class OAuthStrategy implements Strategy {
          oauth.expectNoState,
       );
       if (oauth.isOAuth2Error(parameters)) {
-         console.log("callback.error", parameters);
          throw new OAuthCallbackException(parameters, "validateAuthResponse");
       }
-      console.log(
-         "callback.parameters",
-         JSON.stringify(Object.fromEntries(parameters.entries()), null, 2),
-      );
+
       const response = await oauth.authorizationCodeGrantRequest(
          as,
          client,
@@ -266,9 +245,6 @@ export class OAuthStrategy implements Strategy {
 
       const challenges = oauth.parseWwwAuthenticateChallenges(response);
       if (challenges) {
-         for (const challenge of challenges) {
-            //console.log("callback.challenge", challenge);
-         }
          // @todo: Handle www-authenticate challenges as needed
          throw new OAuthCallbackException(challenges, "www-authenticate");
       }
@@ -279,19 +255,15 @@ export class OAuthStrategy implements Strategy {
       try {
          result = await oauth.processAuthorizationCodeOAuth2Response(as, client, response);
          if (oauth.isOAuth2Error(result)) {
-            console.log("error", result);
             throw new Error(); // Handle OAuth 2.0 response body error
          }
       } catch (e) {
          result = (await copy.json()) as any;
-         console.log("failed", result);
       }
 
       const res2 = await oauth.userInfoRequest(as, client, result.access_token!);
       const user = await res2.json();
-      console.log("res2", res2, user);
 
-      console.log("result", result);
       return await config.profile(user, config, result);
    }
 
@@ -301,7 +273,6 @@ export class OAuthStrategy implements Strategy {
    ): Promise<UserProfile> {
       const type = this.getIssuerConfig().type;
 
-      console.log("type", type);
       switch (type) {
          case "oidc":
             return await this.oidc(callbackParams, options);
@@ -325,7 +296,6 @@ export class OAuthStrategy implements Strategy {
       };
 
       const setState = async (c: Context, config: TState): Promise<void> => {
-         console.log("--- setting state", config);
          await setSignedCookie(c, cookie_name, JSON.stringify(config), secret, {
             secure: true,
             httpOnly: true,
@@ -356,7 +326,6 @@ export class OAuthStrategy implements Strategy {
          const params = new URLSearchParams(url.search);
 
          const state = await getState(c);
-         console.log("state", state);
 
          // @todo: add config option to determine if state.action is allowed
          const redirect_uri =
@@ -369,21 +338,28 @@ export class OAuthStrategy implements Strategy {
             state: state.state,
          });
 
-         try {
-            const data = await auth.resolve(state.action, this, profile.sub, profile);
-            console.log("******** RESOLVED ********", data);
+         const safeProfile = {
+            email: profile.email,
+            strategy_value: profile.sub,
+         } as const;
 
-            if (state.mode === "cookie") {
-               return await auth.respond(c, data, state.redirect);
+         const verify = async (user) => {
+            if (user.strategy_value !== profile.sub) {
+               throw new Exception("Invalid credentials");
             }
+         };
+         const opts = {
+            redirect: state.redirect,
+            forceJsonResponse: state.mode !== "cookie",
+         } as const;
 
-            return c.json(data);
-         } catch (e) {
-            if (state.mode === "cookie") {
-               return await auth.respond(c, e, state.redirect);
-            }
-
-            throw e;
+         switch (state.action) {
+            case "login":
+               return auth.resolveLogin(c, this, safeProfile, verify, opts);
+            case "register":
+               return auth.resolveRegister(c, this, safeProfile, verify, opts);
+            default:
+               throw new Error("Invalid action");
          }
       });
 
@@ -412,10 +388,8 @@ export class OAuthStrategy implements Strategy {
             redirect_uri,
             state,
          });
-         //console.log("_state", state);
 
          await setState(c, { state, action, redirect: referer.toString(), mode: "cookie" });
-         console.log("--redirecting to", response.url);
 
          return c.redirect(response.url);
       });
@@ -456,28 +430,15 @@ export class OAuthStrategy implements Strategy {
       return hono;
    }
 
-   getType() {
-      return "oauth";
-   }
-
-   getMode() {
-      return "external" as const;
-   }
-
-   getName() {
-      return this.config.name;
-   }
-
-   getSchema() {
-      return schemaProvided;
-   }
-
-   toJSON(secrets?: boolean) {
+   override toJSON(secrets?: boolean) {
       const config = secrets ? this.config : filterKeys(this.config, ["secret", "client_id"]);
 
       return {
-         type: this.getIssuerConfig().type,
-         ...config,
+         ...super.toJSON(secrets),
+         config: {
+            ...config,
+            type: this.getIssuerConfig().type,
+         },
       };
    }
 }

app/src/auth/authenticate/strategies/oauth/issuers/github.ts

@@ -34,8 +34,6 @@ export const github: IssuerConfig<GithubUserInfo> = {
       config: Omit<IssuerConfig, "profile">,
       tokenResponse: any,
    ) => {
-      console.log("github info", info, config, tokenResponse);
-
       try {
          const res = await fetch("https://api.github.com/user/emails", {
             headers: {
@@ -45,7 +43,6 @@ export const github: IssuerConfig<GithubUserInfo> = {
             },
          });
          const data = (await res.json()) as GithubUserEmailResponse;
-         console.log("data", data);
          const email = data.find((e: any) => e.primary)?.email;
          if (!email) {
             throw new Error("No primary email found");

app/src/auth/authorize/Guard.ts

@@ -1,4 +1,4 @@
-import { Exception, Permission } from "core";
+import { $console, Exception, Permission } from "core";
 import { objectTransform } from "core/utils";
 import type { Context } from "hono";
 import type { ServerEnv } from "modules/Controller";
@@ -14,8 +14,6 @@ export type GuardConfig = {
 };
 export type GuardContext = Context<ServerEnv> | GuardUserContext;
 
-const debug = false;
-
 export class Guard {
    permissions: Permission[];
    roles?: Role[];
@@ -83,8 +81,12 @@ export class Guard {
       return this;
    }
 
-   registerPermissions(permissions: Permission[]) {
-      for (const permission of permissions) {
+   registerPermissions(permissions: Record<string, Permission>);
+   registerPermissions(permissions: Permission[]);
+   registerPermissions(permissions: Permission[] | Record<string, Permission>) {
+      const p = Array.isArray(permissions) ? permissions : Object.values(permissions);
+
+      for (const permission of p) {
          this.registerPermission(permission);
       }
 
@@ -95,16 +97,14 @@ export class Guard {
       if (user && typeof user.role === "string") {
          const role = this.roles?.find((role) => role.name === user?.role);
          if (role) {
-            debug && console.log("guard: role found", [user.role]);
+            $console.debug(`guard: role "${user.role}" found`);
             return role;
          }
       }
 
-      debug &&
-         console.log("guard: role not found", {
-            user: user,
-            role: user?.role,
-         });
+      $console.debug("guard: role not found", {
+         user,
+      });
       return this.getDefaultRole();
    }
 
@@ -120,11 +120,14 @@ export class Guard {
    hasPermission(name: string, user?: GuardUserContext): boolean;
    hasPermission(permissionOrName: Permission | string, user?: GuardUserContext): boolean {
       if (!this.isEnabled()) {
-         //console.log("guard not enabled, allowing");
          return true;
       }
 
       const name = typeof permissionOrName === "string" ? permissionOrName : permissionOrName.name;
+      $console.debug("guard: checking permission", {
+         name,
+         user: { id: user?.id, role: user?.role },
+      });
       const exists = this.permissionExists(name);
       if (!exists) {
          throw new Error(`Permission ${name} does not exist`);
@@ -133,10 +136,10 @@ export class Guard {
       const role = this.getUserRole(user);
 
       if (!role) {
-         debug && console.log("guard: role not found, denying");
+         $console.debug("guard: user has no role, denying");
          return false;
       } else if (role.implicit_allow === true) {
-         debug && console.log("guard: role implicit allow, allowing");
+         $console.debug(`guard: role "${role.name}" has implicit allow, allowing`);
          return true;
       }
 
@@ -144,12 +147,11 @@ export class Guard {
          (rolePermission) => rolePermission.permission.name === name,
       );
 
-      debug &&
-         console.log("guard: rolePermission, allowing?", {
-            permission: name,
-            role: role.name,
-            allowing: !!rolePermission,
-         });
+      $console.debug("guard: rolePermission, allowing?", {
+         permission: name,
+         role: role.name,
+         allowing: !!rolePermission,
+      });
       return !!rolePermission;
    }
 

app/src/auth/errors.ts

@@ -1,28 +1,66 @@
-import { Exception } from "core";
+import { Exception, isDebug } from "core";
+import { HttpStatus } from "core/utils";
 
-export class UserExistsException extends Exception {
+export class AuthException extends Exception {
+   getSafeErrorAndCode() {
+      return {
+         error: "Invalid credentials",
+         code: HttpStatus.UNAUTHORIZED,
+      };
+   }
+
+   override toJSON(): any {
+      if (isDebug()) {
+         return super.toJSON();
+      }
+
+      return {
+         error: this.getSafeErrorAndCode().error,
+         type: "AuthException",
+      };
+   }
+}
+
+export class UserExistsException extends AuthException {
    override name = "UserExistsException";
-   override code = 422;
+   override code = HttpStatus.UNPROCESSABLE_ENTITY;
 
    constructor() {
       super("User already exists");
    }
 }
 
-export class UserNotFoundException extends Exception {
+export class UserNotFoundException extends AuthException {
    override name = "UserNotFoundException";
-   override code = 404;
+   override code = HttpStatus.NOT_FOUND;
 
    constructor() {
       super("User not found");
    }
 }
 
-export class InvalidCredentialsException extends Exception {
+export class InvalidCredentialsException extends AuthException {
    override name = "InvalidCredentialsException";
-   override code = 401;
+   override code = HttpStatus.UNAUTHORIZED;
 
    constructor() {
       super("Invalid credentials");
    }
 }
+
+export class UnableToCreateUserException extends AuthException {
+   override name = "UnableToCreateUserException";
+   override code = HttpStatus.INTERNAL_SERVER_ERROR;
+
+   constructor() {
+      super("Unable to create user");
+   }
+}
+
+export class InvalidConditionsException extends AuthException {
+   override code = HttpStatus.UNPROCESSABLE_ENTITY;
+
+   constructor(message: string) {
+      super(message ?? "Invalid conditions");
+   }
+}

app/src/auth/index.ts

@@ -1,5 +1,4 @@
 export { UserExistsException, UserNotFoundException, InvalidCredentialsException } from "./errors";
-export { sha256 } from "./utils/hash";
 export {
    type ProfileExchange,
    type Strategy,

app/src/auth/middlewares.ts

@@ -60,11 +60,7 @@ export const auth = (options?: {
       }
 
       await next();
-
-      if (!skipped) {
-         // renew cookie if applicable
-         authenticator?.requestCookieRefresh(c);
-      }
+      // @todo: potentially add cookie refresh if content-type html and about to expire
 
       // release
       authCtx.skip = false;

app/src/auth/utils/hash.ts

@@ -1,13 +0,0 @@
-// @deprecated: moved to @bknd/core
-export async function sha256(password: string, salt?: string) {
-   // 1. Convert password to Uint8Array
-   const encoder = new TextEncoder();
-   const data = encoder.encode((salt ?? "") + password);
-
-   // 2. Hash the data using SHA-256
-   const hashBuffer = await crypto.subtle.digest("SHA-256", data);
-
-   // 3. Convert hash to hex string for easier display
-   const hashArray = Array.from(new Uint8Array(hashBuffer));
-   return hashArray.map((byte) => byte.toString(16).padStart(2, "0")).join("");
-}

app/src/cli/commands/config.ts

@@ -8,6 +8,8 @@ export const config: CliCommand = (program) => {
       .option("--pretty", "pretty print")
       .action((options) => {
          const config = getDefaultConfig();
+
+         // biome-ignore lint/suspicious/noConsoleLog:
          console.log(options.pretty ? JSON.stringify(config, null, 2) : JSON.stringify(config));
       });
 };

app/src/cli/commands/copy-assets.ts

@@ -32,5 +32,6 @@ async function action(options: { out?: string; clean?: boolean }) {
    // delete ".vite" directory in out
    await fs.rm(path.resolve(out, ".vite"), { recursive: true });
 
+   // biome-ignore lint/suspicious/noConsoleLog:
    console.log(c.green(`Assets copied to: ${c.bold(out)}`));
 }

app/src/cli/commands/create/create.ts

@@ -43,10 +43,12 @@ export const create: CliCommand = (program) => {
 
 function errorOutro() {
    $p.outro(color.red("Failed to create project."));
+   // biome-ignore lint/suspicious/noConsoleLog:
    console.log(
       color.yellow("Sorry that this happened. If you think this is a bug, please report it at: ") +
          color.cyan("https://github.com/bknd-io/bknd/issues"),
    );
+   // biome-ignore lint/suspicious/noConsoleLog:
    console.log("");
    process.exit(1);
 }
@@ -55,7 +57,14 @@ async function onExit() {
    await flush();
 }
 
-async function action(options: { template?: string; dir?: string; integration?: string, yes?: boolean, clean?: boolean }) {
+async function action(options: {
+   template?: string;
+   dir?: string;
+   integration?: string;
+   yes?: boolean;
+   clean?: boolean;
+}) {
+   // biome-ignore lint/suspicious/noConsoleLog:
    console.log("");
    const $t = createScoped("create");
    $t.capture("start", {
@@ -96,10 +105,12 @@ async function action(options: { template?: string; dir?: string; integration?:
 
    $t.properties.at = "dir";
    if (fs.existsSync(downloadOpts.dir)) {
-      const clean = options.clean ?? await $p.confirm({
-         message: `Directory ${color.cyan(downloadOpts.dir)} exists. Clean it?`,
-         initialValue: false,
-      });
+      const clean =
+         options.clean ??
+         (await $p.confirm({
+            message: `Directory ${color.cyan(downloadOpts.dir)} exists. Clean it?`,
+            initialValue: false,
+         }));
       if ($p.isCancel(clean)) {
          await onExit();
          process.exit(1);
@@ -174,8 +185,6 @@ async function action(options: { template?: string; dir?: string; integration?:
          process.exit(1);
       }
 
-      //console.log("integration", { type, integration });
-
       const choices = templates.filter((t) => t.integration === integration);
       if (choices.length === 0) {
          await onExit();
@@ -261,9 +270,11 @@ async function action(options: { template?: string; dir?: string; integration?:
    $p.log.success(`Updated package name to ${color.cyan(ctx.name)}`);
 
    {
-      const install = options.yes ?? await $p.confirm({
-         message: "Install dependencies?",
-      });
+      const install =
+         options.yes ??
+         (await $p.confirm({
+            message: "Install dependencies?",
+         }));
 
       if ($p.isCancel(install)) {
          await onExit();

app/src/cli/commands/debug.ts

@@ -17,6 +17,7 @@ export const debug: CliCommand = (program) => {
 
 const subjects = {
    paths: async () => {
+      // biome-ignore lint/suspicious/noConsoleLog:
       console.log("[PATHS]", {
          rootpath: getRootPath(),
          distPath: getDistPath(),
@@ -27,6 +28,7 @@ const subjects = {
       });
    },
    routes: async () => {
+      // biome-ignore lint/suspicious/noConsoleLog:
       console.log("[APP ROUTES]");
       const credentials = getConnectionCredentialsFromEnv();
       const app = createApp({ connection: credentials });

app/src/cli/commands/index.ts

@@ -5,3 +5,4 @@ export { debug } from "./debug";
 export { user } from "./user";
 export { create } from "./create";
 export { copyAssets } from "./copy-assets";
+export { types } from "./types";

app/src/cli/commands/run/platform.ts

@@ -1,6 +1,6 @@
 import path from "node:path";
 import type { Config } from "@libsql/client/node";
-import { config } from "core";
+import { $console, config } from "core";
 import type { MiddlewareHandler } from "hono";
 import open from "open";
 import { fileExists, getRelativeDistPath } from "../../utils/sys";
@@ -37,7 +37,7 @@ export async function startServer(
    options: { port: number; open?: boolean },
 ) {
    const port = options.port;
-   console.log(`Using ${server} serve`);
+   $console.log(`Using ${server} serve`);
 
    switch (server) {
       case "node": {
@@ -59,7 +59,8 @@ export async function startServer(
    }
 
    const url = `http://localhost:${port}`;
-   console.info("Server listening on", url);
+   $console.info("Server listening on", url);
+
    if (options.open) {
       await open(url);
    }

app/src/cli/commands/schema.ts

@@ -8,6 +8,7 @@ export const schema: CliCommand = (program) => {
       .option("--pretty", "pretty print")
       .action((options) => {
          const schema = getDefaultSchema();
+         // biome-ignore lint/suspicious/noConsoleLog:
          console.log(options.pretty ? JSON.stringify(schema, null, 2) : JSON.stringify(schema));
       });
 };

app/src/cli/commands/types/index.ts

@@ -0,0 +1 @@
+export * from "./types";

app/src/cli/commands/types/types.ts

@@ -0,0 +1,37 @@
+import type { CliCommand } from "cli/types";
+import { Option } from "commander";
+import { makeAppFromEnv } from "cli/commands/run";
+import { EntityTypescript } from "data/entities/EntityTypescript";
+import { writeFile } from "cli/utils/sys";
+import c from "picocolors";
+
+export const types: CliCommand = (program) => {
+   program
+      .command("types")
+      .description("generate types")
+      .addOption(new Option("-o, --outfile <outfile>", "output file").default("bknd-types.d.ts"))
+      .addOption(new Option("--no-write", "do not write to file").default(true))
+      .action(action);
+};
+
+async function action({
+   outfile,
+   write,
+}: {
+   outfile: string;
+   write: boolean;
+}) {
+   const app = await makeAppFromEnv({
+      server: "node",
+   });
+   await app.build();
+
+   const et = new EntityTypescript(app.em);
+
+   if (write) {
+      await writeFile(outfile, et.toString());
+      console.info(`\nTypes written to ${c.cyan(outfile)}`);
+   } else {
+      console.info(et.toString());
+   }
+}

app/src/cli/commands/user.ts

@@ -169,6 +169,7 @@ async function token(app: App, options: any) {
    }
    $log.info(`User found: ${c.cyan(user.email)}`);
 
+   // biome-ignore lint/suspicious/noConsoleLog:
    console.log(
       `\n${c.dim("Token:")}\n${c.yellow(await app.module.auth.authenticator.jwt(user))}\n`,
    );

app/src/cli/utils/sys.ts

@@ -1,5 +1,6 @@
+import { $console } from "core";
 import { execSync, exec as nodeExec } from "node:child_process";
-import { readFile } from "node:fs/promises";
+import { readFile, writeFile as nodeWriteFile } from "node:fs/promises";
 import path from "node:path";
 import url from "node:url";
 
@@ -48,6 +49,16 @@ export async function fileExists(filePath: string) {
    }
 }
 
+export async function writeFile(filePath: string, content: string) {
+   try {
+      await nodeWriteFile(path.resolve(process.cwd(), filePath), content);
+      return true;
+   } catch (e) {
+      $console.error("Failed to write file", e);
+      return false;
+   }
+}
+
 export function exec(command: string, opts?: { silent?: boolean; env?: Record<string, string> }) {
    const stdio = opts?.silent ? "pipe" : "inherit";
    const output = execSync(command, {

app/src/core/clients/aws/AwsClient.ts

@@ -29,7 +29,6 @@ export class AwsClient extends Aws4fetchClient {
    }
 
    getUrl(path: string = "/", searchParamsObj: Record<string, any> = {}): string {
-      //console.log("super:getUrl", path, searchParamsObj);
       const url = new URL(path);
       const converted = this.convertParams(searchParamsObj);
       Object.entries(converted).forEach(([key, value]) => {
@@ -76,8 +75,6 @@ export class AwsClient extends Aws4fetchClient {
          }
 
          const raw = await response.text();
-         //console.log("raw", raw);
-         //console.log(JSON.stringify(xmlToObject(raw), null, 2));
          return xmlToObject(raw) as T;
       }
 

app/src/core/config.ts

@@ -3,7 +3,11 @@
  */
 import type { Generated } from "kysely";
 
-export type PrimaryFieldType = number | Generated<number>;
+export type PrimaryFieldType<IdType = number | string> = IdType | Generated<IdType>;
+
+export interface AppEntity<IdType = number | string> {
+   id: PrimaryFieldType<IdType>;
+}
 
 export interface DB {
    // make sure to make unknown as "any"

app/src/core/console.ts

@@ -23,6 +23,12 @@ function hasColors() {
 }
 
 const __consoles = {
+   critical: {
+      prefix: "CRT",
+      color: colors.red,
+      args_color: colors.red,
+      original: console.error,
+   },
    error: {
       prefix: "ERR",
       color: colors.red,

app/src/core/env.ts

@@ -13,6 +13,15 @@ export function isDebug(): boolean {
    }
 }
 
+export function getVersion(): string {
+   try {
+      // @ts-expect-error - this is a global variable in dev
+      return __version;
+   } catch (e) {
+      return "0.0.0";
+   }
+}
+
 const envs = {
    // used in $console to determine the log level
    cli_log_level: {

app/src/core/errors.ts

@@ -1,9 +1,12 @@
+import type { ContentfulStatusCode } from "hono/utils/http-status";
+import { HttpStatus } from "./utils/reqres";
+
 export class Exception extends Error {
-   code = 400;
+   code: ContentfulStatusCode = HttpStatus.BAD_REQUEST;
    override name = "Exception";
    protected _context = undefined;
 
-   constructor(message: string, code?: number) {
+   constructor(message: string, code?: ContentfulStatusCode) {
       super(message);
       if (code) {
          this.code = code;

app/src/core/events/Event.ts

@@ -14,6 +14,10 @@ export abstract class Event<Params = any, Returning = void> {
    params: Params;
    returned: boolean = false;
 
+   /**
+    * Shallow validation of the event return
+    * It'll be deeply validated on the place where it is called
+    */
    validate(value: Returning): Event<Params, Returning> | void {
       throw new EventReturnedWithoutValidation(this as any, value);
    }

app/src/core/events/EventManager.ts

@@ -1,5 +1,6 @@
 import { type Event, type EventClass, InvalidEventReturn } from "./Event";
 import { EventListener, type ListenerHandler, type ListenerMode } from "./EventListener";
+import { $console } from "core";
 
 export type RegisterListenerConfig =
    | ListenerMode
@@ -83,10 +84,6 @@ export class EventManager<
       } else {
          // @ts-expect-error
          slug = eventOrSlug.constructor?.slug ?? eventOrSlug.slug;
-         /*eventOrSlug instanceof Event
-               ? // @ts-expect-error slug is static
-                 eventOrSlug.constructor.slug
-               : eventOrSlug.slug;*/
       }
 
       return !!this.events.find((e) => slug === e.slug);
@@ -128,8 +125,7 @@ export class EventManager<
       if (listener.id) {
          const existing = this.listeners.find((l) => l.id === listener.id);
          if (existing) {
-            // @todo: add a verbose option?
-            //console.warn(`Listener with id "${listener.id}" already exists.`);
+            $console.debug(`Listener with id "${listener.id}" already exists.`);
             return this;
          }
       }
@@ -191,7 +187,7 @@ export class EventManager<
       // @ts-expect-error slug is static
       const slug = event.constructor.slug;
       if (!this.enabled) {
-         console.log("EventManager disabled, not emitting", slug);
+         $console.debug("EventManager disabled, not emitting", slug);
          return event;
       }
 
@@ -240,7 +236,7 @@ export class EventManager<
          } catch (e) {
             if (e instanceof InvalidEventReturn) {
                this.options?.onInvalidReturn?.(_event, e);
-               console.warn(`Invalid return of event listener for "${slug}": ${e.message}`);
+               $console.warn(`Invalid return of event listener for "${slug}": ${e.message}`);
             } else if (this.options?.onError) {
                this.options.onError(_event, e);
             } else {

app/src/core/index.ts

@@ -3,7 +3,7 @@ import type { Hono, MiddlewareHandler } from "hono";
 export { tbValidator } from "./server/lib/tbValidator";
 export { Exception, BkndError } from "./errors";
 export { isDebug, env } from "./env";
-export { type PrimaryFieldType, config, type DB } from "./config";
+export { type PrimaryFieldType, config, type DB, type AppEntity } from "./config";
 export { AwsClient } from "./clients/aws/AwsClient";
 export {
    SimpleRenderer,
@@ -25,8 +25,11 @@ export {
    isBooleanLike,
 } from "./object/query/query";
 export { Registry, type Constructor } from "./registry/Registry";
+export { getFlashMessage } from "./server/flash";
+export { s, jsc, describeRoute } from "./object/schema";
 
 export * from "./console";
+export * from "./events";
 
 // compatibility
 export type Middleware = MiddlewareHandler<any, any, any>;

app/src/core/object/SchemaObject.ts

@@ -73,6 +73,7 @@ export class SchemaObject<Schema extends TObject> {
          forceParse: true,
          skipMark: this.isForceParse(),
       });
+
       // regardless of "noEmit" – this should always be triggered
       const updatedConfig = await this.onBeforeUpdate(this._config, valid);
 
@@ -122,19 +123,15 @@ export class SchemaObject<Schema extends TObject> {
       const partial = path.length > 0 ? (set({}, path, value) as Partial<Static<Schema>>) : value;
 
       this.throwIfRestricted(partial);
-      //console.log(getFullPathKeys(value).map((k) => path + "." + k));
 
       // overwrite arrays and primitives, only deep merge objects
       // @ts-ignore
-      //console.log("---alt:new", _jsonp(mergeObject(current, partial)));
       const config = mergeObjectWith(current, partial, (objValue, srcValue) => {
          if (Array.isArray(objValue) && Array.isArray(srcValue)) {
             return srcValue;
          }
       });
-      //console.log("---new", _jsonp(config));
 
-      //console.log("overwritePaths", this.options?.overwritePaths);
       if (this.options?.overwritePaths) {
          const keys = getFullPathKeys(value).map((k) => {
             // only prepend path if given
@@ -149,7 +146,6 @@ export class SchemaObject<Schema extends TObject> {
                }
             });
          });
-         //console.log("overwritePaths", keys, overwritePaths);
 
          if (overwritePaths.length > 0) {
             // filter out less specific paths (but only if more than 1)
@@ -157,12 +153,10 @@ export class SchemaObject<Schema extends TObject> {
                overwritePaths.length > 1
                   ? overwritePaths.filter((k) =>
                        overwritePaths.some((k2) => {
-                          //console.log("keep?", { k, k2 }, k2 !== k && k2.startsWith(k));
                           return k2 !== k && k2.startsWith(k);
                        }),
                     )
                   : overwritePaths;
-            //console.log("specific", specific);
 
             for (const p of specific) {
                set(config, p, get(partial, p));
@@ -170,8 +164,6 @@ export class SchemaObject<Schema extends TObject> {
          }
       }
 
-      //console.log("patch", _jsonp({ path, value, partial, config, current }));
-
       const newConfig = await this.set(config);
       return [partial, newConfig];
    }
@@ -181,14 +173,11 @@ export class SchemaObject<Schema extends TObject> {
       const partial = path.length > 0 ? (set({}, path, value) as Partial<Static<Schema>>) : value;
 
       this.throwIfRestricted(partial);
-      //console.log(getFullPathKeys(value).map((k) => path + "." + k));
 
       // overwrite arrays and primitives, only deep merge objects
       // @ts-ignore
       const config = set(current, path, value);
 
-      //console.log("overwrite", { path, value, partial, config, current });
-
       const newConfig = await this.set(config);
       return [partial, newConfig];
    }
@@ -198,7 +187,6 @@ export class SchemaObject<Schema extends TObject> {
       if (p.length > 1) {
          const parent = p.slice(0, -1).join(".");
          if (!has(this._config, parent)) {
-            //console.log("parent", parent, JSON.stringify(this._config, null, 2));
             throw new Error(`Parent path "${parent}" does not exist`);
          }
       }

app/src/core/object/query/query.ts

@@ -34,6 +34,8 @@ type ExpressionMap<Exps extends Expressions> = {
       ? E
       : never;
 };
+type ExpressionKeys<Exps extends Expressions> = Exps[number]["key"];
+
 type ExpressionCondition<Exps extends Expressions> = {
    [K in keyof ExpressionMap<Exps>]: { [P in K]: ExpressionMap<Exps>[K] };
 }[keyof ExpressionMap<Exps>];
@@ -195,5 +197,7 @@ export function makeValidator<Exps extends Expressions>(expressions: Exps) {
          const fns = _build(query, expressions, options);
          return _validate(fns);
       },
+      expressions,
+      expressionKeys: expressions.map((e) => e.key) as ExpressionKeys<Exps>,
    };
 }

app/src/core/object/schema/index.ts

@@ -0,0 +1,52 @@
+import { mergeObject } from "core/utils";
+
+//export { jsc, type Options, type Hook } from "./validator";
+import * as s from "jsonv-ts";
+
+export { validator as jsc, type Options } from "jsonv-ts/hono";
+export { describeRoute, schemaToSpec, openAPISpecs } from "jsonv-ts/hono";
+
+export { s };
+
+export class InvalidSchemaError extends Error {
+   constructor(
+      public schema: s.TAnySchema,
+      public value: unknown,
+      public errors: s.ErrorDetail[] = [],
+   ) {
+      super(
+         `Invalid schema given for ${JSON.stringify(value, null, 2)}\n\n` +
+            `Error: ${JSON.stringify(errors[0], null, 2)}`,
+      );
+   }
+}
+
+export type ParseOptions = {
+   withDefaults?: boolean;
+   coerse?: boolean;
+   clone?: boolean;
+};
+
+export const cloneSchema = <S extends s.TSchema>(schema: S): S => {
+   const json = schema.toJSON();
+   return s.fromSchema(json) as S;
+};
+
+export function parse<S extends s.TAnySchema>(
+   _schema: S,
+   v: unknown,
+   opts: ParseOptions = {},
+): s.StaticCoerced<S> {
+   const schema = (opts.clone ? cloneSchema(_schema as any) : _schema) as s.TSchema;
+   const value = opts.coerse !== false ? schema.coerce(v) : v;
+   const result = schema.validate(value, {
+      shortCircuit: true,
+      ignoreUnsupported: true,
+   });
+   if (!result.valid) throw new InvalidSchemaError(schema, v, result.errors);
+   if (opts.withDefaults) {
+      return mergeObject(schema.template({ withOptional: true }), value) as any;
+   }
+
+   return value as any;
+}

app/src/core/object/schema/validator.ts

@@ -0,0 +1,63 @@
+import type { Context, Env, Input, MiddlewareHandler, ValidationTargets } from "hono";
+import { validator as honoValidator } from "hono/validator";
+import type { Static, StaticCoerced, TAnySchema } from "jsonv-ts";
+
+export type Options = {
+   coerce?: boolean;
+   includeSchema?: boolean;
+};
+
+type ValidationResult = {
+   valid: boolean;
+   errors: {
+      keywordLocation: string;
+      instanceLocation: string;
+      error: string;
+      data?: unknown;
+   }[];
+};
+
+export type Hook<T, E extends Env, P extends string> = (
+   result: { result: ValidationResult; data: T },
+   c: Context<E, P>,
+) => Response | Promise<Response> | void;
+
+export const validator = <
+   // @todo: somehow hono prevents the usage of TSchema
+   Schema extends TAnySchema,
+   Target extends keyof ValidationTargets,
+   E extends Env,
+   P extends string,
+   Opts extends Options = Options,
+   Out = Opts extends { coerce: false } ? Static<Schema> : StaticCoerced<Schema>,
+   I extends Input = {
+      in: { [K in Target]: Static<Schema> };
+      out: { [K in Target]: Out };
+   },
+>(
+   target: Target,
+   schema: Schema,
+   options?: Opts,
+   hook?: Hook<Out, E, P>,
+): MiddlewareHandler<E, P, I> => {
+   // @ts-expect-error not typed well
+   return honoValidator(target, async (_value, c) => {
+      const value = options?.coerce !== false ? schema.coerce(_value) : _value;
+      // @ts-ignore
+      const result = schema.validate(value);
+      if (!result.valid) {
+         return c.json({ ...result, schema }, 400);
+      }
+
+      if (hook) {
+         const hookResult = hook({ result, data: value as Out }, c);
+         if (hookResult) {
+            return hookResult;
+         }
+      }
+
+      return value as Out;
+   });
+};
+
+export const jsc = validator;

app/src/core/server/lib/index.ts

@@ -0,0 +1 @@
+export { tbValidator } from "./tbValidator";

app/src/core/template/SimpleRenderer.spec.ts

@@ -0,0 +1,70 @@
+import { describe, expect, test } from "bun:test";
+import { SimpleRenderer } from "core";
+
+describe(SimpleRenderer, () => {
+   const renderer = new SimpleRenderer(
+      {
+         name: "World",
+         views: 123,
+         nested: {
+            foo: "bar",
+            baz: ["quz", "foo"],
+         },
+         someArray: [1, 2, 3],
+         enabled: true,
+      },
+      {
+         renderKeys: true,
+      },
+   );
+
+   test("strings", async () => {
+      const tests = [
+         ["Hello {{ name }}, count: {{views}}", "Hello World, count: 123"],
+         ["Nested: {{nested.foo}}", "Nested: bar"],
+         ["Nested: {{nested.baz[0]}}", "Nested: quz"],
+      ] as const;
+
+      for (const [template, expected] of tests) {
+         expect(await renderer.renderString(template)).toEqual(expected);
+      }
+   });
+
+   test("arrays", async () => {
+      const tests = [
+         [
+            ["{{someArray[0]}}", "{{someArray[1]}}", "{{someArray[2]}}"],
+            ["1", "2", "3"],
+         ],
+      ] as const;
+
+      for (const [template, expected] of tests) {
+         const result = await renderer.render(template);
+         expect(result).toEqual(expected as any);
+      }
+   });
+
+   test("objects", async () => {
+      const tests = [
+         [
+            {
+               foo: "{{name}}",
+               bar: "{{views}}",
+               baz: "{{nested.foo}}",
+               quz: "{{nested.baz[0]}}",
+            },
+            {
+               foo: "World",
+               bar: "123",
+               baz: "bar",
+               quz: "quz",
+            },
+         ],
+      ] as const;
+
+      for (const [template, expected] of tests) {
+         const result = await renderer.render(template);
+         expect(result).toEqual(expected as any);
+      }
+   });
+});

app/src/core/template/SimpleRenderer.ts

@@ -1,17 +1,13 @@
-import { Liquid, LiquidError } from "liquidjs";
-import type { RenderOptions } from "liquidjs/dist/liquid-options";
-import { BkndError } from "../errors";
+import { get } from "lodash-es";
 
 export type TemplateObject = Record<string, string | Record<string, string>>;
-export type TemplateTypes = string | TemplateObject;
+export type TemplateTypes = string | TemplateObject | any;
 
-export type SimpleRendererOptions = RenderOptions & {
+export type SimpleRendererOptions = {
    renderKeys?: boolean;
 };
 
 export class SimpleRenderer {
-   private engine = new Liquid();
-
    constructor(
       private variables: Record<string, any> = {},
       private options: SimpleRendererOptions = {},
@@ -22,7 +18,6 @@ export class SimpleRenderer {
    }
 
    static hasMarkup(template: string | object): boolean {
-      //console.log("has markup?", template);
       let flat: string = "";
 
       if (Array.isArray(template) || typeof template === "object") {
@@ -34,49 +29,29 @@ export class SimpleRenderer {
          flat = String(template);
       }
 
-      //console.log("** flat", flat);
-
-      const checks = ["{{", "{%", "{#", "{:"];
-      const hasMarkup = checks.some((check) => flat.includes(check));
-      //console.log("--has markup?", hasMarkup);
-      return hasMarkup;
+      const checks = ["{{"];
+      return checks.some((check) => flat.includes(check));
    }
 
-   async render<Given extends TemplateTypes>(template: Given): Promise<Given> {
-      try {
-         if (typeof template === "string") {
-            return (await this.renderString(template)) as unknown as Given;
-         } else if (Array.isArray(template)) {
-            return (await Promise.all(
-               template.map((item) => this.render(item)),
-            )) as unknown as Given;
-         } else if (typeof template === "object") {
-            return (await this.renderObject(template)) as unknown as Given;
-         }
-      } catch (e) {
-         if (e instanceof LiquidError) {
-            const details = {
-               name: e.name,
-               token: {
-                  kind: e.token.kind,
-                  input: e.token.input,
-                  begin: e.token.begin,
-                  end: e.token.end,
-               },
-            };
+   async render<Given extends TemplateTypes = TemplateTypes>(template: Given): Promise<Given> {
+      if (typeof template === "undefined" || template === null) return template;
 
-            throw new BkndError(e.message, details, "liquid");
-         }
-
-         throw e;
+      if (typeof template === "string") {
+         return (await this.renderString(template)) as unknown as Given;
+      } else if (Array.isArray(template)) {
+         return (await Promise.all(template.map((item) => this.render(item)))) as unknown as Given;
+      } else if (typeof template === "object") {
+         return (await this.renderObject(template as any)) as unknown as Given;
       }
 
       throw new Error("Invalid template type");
    }
 
    async renderString(template: string): Promise<string> {
-      //console.log("*** renderString", template, this.variables);
-      return this.engine.parseAndRender(template, this.variables, this.options);
+      return template.replace(/{{\s*([^{}]+?)\s*}}/g, (_, expr: string) => {
+         const value = get(this.variables, expr.trim());
+         return value == null ? "" : String(value);
+      });
    }
 
    async renderObject(template: TemplateObject): Promise<TemplateObject> {

app/src/core/utils/DebugLogger.ts

@@ -9,13 +9,11 @@ export class DebugLogger {
    }
 
    context(context: string) {
-      //console.log("[ settings context ]", context, this._context);
       this._context.push(context);
       return this;
    }
 
    clear() {
-      //console.log("[ clear context ]", this._context.pop(), this._context);
       this._context.pop();
       return this;
    }
@@ -33,6 +31,8 @@ export class DebugLogger {
       const indents = "  ".repeat(Math.max(this._context.length - 1, 0));
       const context =
          this._context.length > 0 ? `[${this._context[this._context.length - 1]}]` : "";
+
+      // biome-ignore lint/suspicious/noConsoleLog: <explanation>
       console.log(indents, context, time, ...args);
 
       this.last = now;

app/src/core/utils/dates.ts

@@ -4,7 +4,6 @@ import weekOfYear from "dayjs/plugin/weekOfYear.js";
 declare module "dayjs" {
    interface Dayjs {
       week(): number;
-
       week(value: number): dayjs.Dayjs;
    }
 }

app/src/core/utils/file.ts

@@ -2,6 +2,7 @@ import { extension, guess, isMimeType } from "media/storage/mime-types-tiny";
 import { randomString } from "core/utils/strings";
 import type { Context } from "hono";
 import { invariant } from "core/utils/runtime";
+import { $console } from "../console";
 
 export function getContentName(request: Request): string | undefined;
 export function getContentName(contentDisposition: string): string | undefined;
@@ -116,7 +117,9 @@ async function detectMimeType(
    return;
 }
 
-export async function getFileFromContext(c: Context<any>): Promise<File> {
+type HonoAnyContext = Context<any, any, any>;
+
+export async function getFileFromContext(c: HonoAnyContext): Promise<File> {
    const contentType = c.req.header("Content-Type") ?? "application/octet-stream";
 
    if (
@@ -130,7 +133,7 @@ export async function getFileFromContext(c: Context<any>): Promise<File> {
             return await blobToFile(v);
          }
       } catch (e) {
-         console.warn("Error parsing form data", e);
+         $console.warn("Error parsing form data", e);
       }
    } else {
       try {
@@ -141,14 +144,14 @@ export async function getFileFromContext(c: Context<any>): Promise<File> {
             return await blobToFile(blob, { name: getContentName(c.req.raw), type: contentType });
          }
       } catch (e) {
-         console.warn("Error parsing blob", e);
+         $console.warn("Error parsing blob", e);
       }
    }
 
    throw new Error("No file found in request");
 }
 
-export async function getBodyFromContext(c: Context<any>): Promise<ReadableStream | File> {
+export async function getBodyFromContext(c: HonoAnyContext): Promise<ReadableStream | File> {
    const contentType = c.req.header("Content-Type") ?? "application/octet-stream";
 
    if (

app/src/core/utils/objects.ts

@@ -359,3 +359,63 @@ export function getPath(
       throw new Error(`Invalid path: ${path.join(".")}`);
    }
 }
+
+export function objectToJsLiteral(value: object, indent: number = 0, _level: number = 0): string {
+   const nl = indent ? "\n" : "";
+   const pad = (lvl: number) => (indent ? " ".repeat(indent * lvl) : "");
+   const openPad = pad(_level + 1);
+   const closePad = pad(_level);
+
+   // primitives
+   if (value === null) return "null";
+   if (value === undefined) return "undefined";
+   const t = typeof value;
+   if (t === "string") return JSON.stringify(value); // handles escapes
+   if (t === "number" || t === "boolean") return String(value);
+
+   // arrays
+   if (Array.isArray(value)) {
+      const out = value
+         .map((v) => objectToJsLiteral(v, indent, _level + 1))
+         .join(", " + (indent ? nl + openPad : ""));
+      return (
+         "[" +
+         (indent && value.length ? nl + openPad : "") +
+         out +
+         (indent && value.length ? nl + closePad : "") +
+         "]"
+      );
+   }
+
+   // objects
+   if (t === "object") {
+      const entries = Object.entries(value).map(([k, v]) => {
+         const idOk = /^[A-Za-z_$][\w$]*$/.test(k); // valid identifier?
+         const key = idOk ? k : JSON.stringify(k); // quote if needed
+         return key + ": " + objectToJsLiteral(v, indent, _level + 1);
+      });
+      const out = entries.join(", " + (indent ? nl + openPad : ""));
+      return (
+         "{" +
+         (indent && entries.length ? nl + openPad : "") +
+         out +
+         (indent && entries.length ? nl + closePad : "") +
+         "}"
+      );
+   }
+
+   throw new TypeError(`Unsupported data type: ${t}`);
+}
+
+// lodash-es compatible `pick` with perfect type inference
+export function pick<T extends object, K extends keyof T>(obj: T, keys: K[]): Pick<T, K> {
+   return keys.reduce(
+      (acc, key) => {
+         if (key in obj) {
+            acc[key] = obj[key];
+         }
+         return acc;
+      },
+      {} as Pick<T, K>,
+   );
+}

app/src/core/utils/reqres.ts

@@ -1,7 +1,3 @@
-import { randomString } from "core/utils/strings";
-import type { Context } from "hono";
-import { extension, guess, isMimeType } from "media/storage/mime-types-tiny";
-
 export function headersToObject(headers: Headers): Record<string, string> {
    if (!headers) return {};
    return { ...Object.fromEntries(headers.entries()) };
@@ -102,7 +98,7 @@ export function decodeSearch(str) {
 export const enum HttpStatus {
    // Informational responses (100–199)
    CONTINUE = 100,
-   SWITCHING_PROTOCOLS = 101,
+   //SWITCHING_PROTOCOLS = 101,
    PROCESSING = 102,
    EARLY_HINTS = 103,
 
@@ -111,8 +107,8 @@ export const enum HttpStatus {
    CREATED = 201,
    ACCEPTED = 202,
    NON_AUTHORITATIVE_INFORMATION = 203,
-   NO_CONTENT = 204,
-   RESET_CONTENT = 205,
+   //NO_CONTENT = 204,
+   //RESET_CONTENT = 205,
    PARTIAL_CONTENT = 206,
    MULTI_STATUS = 207,
    ALREADY_REPORTED = 208,
@@ -123,7 +119,7 @@ export const enum HttpStatus {
    MOVED_PERMANENTLY = 301,
    FOUND = 302,
    SEE_OTHER = 303,
-   NOT_MODIFIED = 304,
+   //NOT_MODIFIED = 304,
    USE_PROXY = 305,
    TEMPORARY_REDIRECT = 307,
    PERMANENT_REDIRECT = 308,
@@ -172,3 +168,13 @@ export const enum HttpStatus {
    NOT_EXTENDED = 510,
    NETWORK_AUTHENTICATION_REQUIRED = 511,
 }
+// biome-ignore lint/suspicious/noConstEnum: <explanation>
+export const enum HttpStatusEmpty {
+   // Informational responses (100–199)
+   SWITCHING_PROTOCOLS = 101,
+   // Successful responses (200–299)
+   NO_CONTENT = 204,
+   RESET_CONTENT = 205,
+   // Redirection messages (300–399)
+   NOT_MODIFIED = 304,
+}

app/src/core/utils/strings.ts

@@ -132,3 +132,8 @@ export function slugify(str: string): string {
          .replace(/-+/g, "-") // remove consecutive hyphens
    );
 }
+
+export function truncate(str: string, length = 50, end = "..."): string {
+   if (str.length <= length) return str;
+   return str.substring(0, length) + end;
+}

app/src/core/utils/test.ts

@@ -36,7 +36,7 @@ export function disableConsoleLog(severities: ConsoleSeverity[] = ["log", "warn"
    severities.forEach((severity) => {
       console[severity] = () => null;
    });
-   $console.setLevel("error");
+   $console.setLevel("critical");
 }
 
 export function enableConsoleLog() {

app/src/core/utils/typebox/index.ts

@@ -1,18 +1,11 @@
-import {
-   Kind,
-   type ObjectOptions,
-   type SchemaOptions,
-   type Static,
-   type StaticDecode,
-   type StringOptions,
-   type TLiteral,
-   type TLiteralValue,
-   type TObject,
-   type TRecord,
-   type TSchema,
-   type TString,
-   Type,
+import * as tb from "@sinclair/typebox";
+import type {
    TypeRegistry,
+   Static,
+   StaticDecode,
+   TSchema,
+   SchemaOptions,
+   TObject,
 } from "@sinclair/typebox";
 import {
    DefaultErrorFunction,
@@ -43,7 +36,7 @@ const validationSymbol = Symbol("tb-parse-validation");
 export class TypeInvalidError extends Error {
    errors: ValueError[];
    constructor(
-      public schema: TSchema,
+      public schema: tb.TSchema,
       public data: unknown,
       message?: string,
    ) {
@@ -92,29 +85,28 @@ export function mark(obj: any, validated = true) {
    }
 }
 
-export function parse<Schema extends TSchema = TSchema>(
+export function parse<Schema extends tb.TSchema = tb.TSchema>(
    schema: Schema,
-   data: RecursivePartial<Static<Schema>>,
+   data: RecursivePartial<tb.Static<Schema>>,
    options?: ParseOptions,
-): Static<Schema> {
+): tb.Static<Schema> {
    if (!options?.forceParse && typeof data === "object" && validationSymbol in data) {
       if (options?.useDefaults === false) {
-         return data as Static<typeof schema>;
+         return data as tb.Static<typeof schema>;
       }
 
       // this is important as defaults are expected
-      return Default(schema, data as any) as Static<Schema>;
+      return Default(schema, data as any) as tb.Static<Schema>;
    }
 
    const parsed = options?.useDefaults === false ? data : Default(schema, data);
 
    if (Check(schema, parsed)) {
       options?.skipMark !== true && mark(parsed, true);
-      return parsed as Static<typeof schema>;
+      return parsed as tb.Static<typeof schema>;
    } else if (options?.onError) {
       options.onError(Errors(schema, data));
    } else {
-      //console.warn("errors", JSON.stringify([...Errors(schema, data)], null, 2));
       throw new TypeInvalidError(schema, data);
    }
 
@@ -122,26 +114,24 @@ export function parse<Schema extends TSchema = TSchema>(
    return undefined as any;
 }
 
-export function parseDecode<Schema extends TSchema = TSchema>(
+export function parseDecode<Schema extends tb.TSchema = tb.TSchema>(
    schema: Schema,
-   data: RecursivePartial<StaticDecode<Schema>>,
-): StaticDecode<Schema> {
-   //console.log("parseDecode", schema, data);
+   data: RecursivePartial<tb.StaticDecode<Schema>>,
+): tb.StaticDecode<Schema> {
    const parsed = Default(schema, data);
 
    if (Check(schema, parsed)) {
-      return parsed as StaticDecode<typeof schema>;
+      return parsed as tb.StaticDecode<typeof schema>;
    }
-   //console.log("errors", ...Errors(schema, data));
 
    throw new TypeInvalidError(schema, data);
 }
 
-export function strictParse<Schema extends TSchema = TSchema>(
+export function strictParse<Schema extends tb.TSchema = tb.TSchema>(
    schema: Schema,
-   data: Static<Schema>,
+   data: tb.Static<Schema>,
    options?: ParseOptions,
-): Static<Schema> {
+): tb.Static<Schema> {
    return parse(schema, data as any, options);
 }
 
@@ -150,11 +140,14 @@ export function registerCustomTypeboxKinds(registry: typeof TypeRegistry) {
       return typeof value === "string" && schema.enum.includes(value);
    });
 }
-registerCustomTypeboxKinds(TypeRegistry);
+registerCustomTypeboxKinds(tb.TypeRegistry);
 
-export const StringEnum = <const T extends readonly string[]>(values: T, options?: StringOptions) =>
-   Type.Unsafe<T[number]>({
-      [Kind]: "StringEnum",
+export const StringEnum = <const T extends readonly string[]>(
+   values: T,
+   options?: tb.StringOptions,
+) =>
+   tb.Type.Unsafe<T[number]>({
+      [tb.Kind]: "StringEnum",
       type: "string",
       enum: values,
       ...options,
@@ -162,45 +155,47 @@ export const StringEnum = <const T extends readonly string[]>(values: T, options
 
 // key value record compatible with RJSF and typebox inference
 // acting like a Record, but using an Object with additionalProperties
-export const StringRecord = <T extends TSchema>(properties: T, options?: ObjectOptions) =>
-   Type.Object({}, { ...options, additionalProperties: properties }) as unknown as TRecord<
-      TString,
+export const StringRecord = <T extends tb.TSchema>(properties: T, options?: tb.ObjectOptions) =>
+   tb.Type.Object({}, { ...options, additionalProperties: properties }) as unknown as tb.TRecord<
+      tb.TString,
       typeof properties
    >;
 
 // fixed value that only be what is given + prefilled
-export const Const = <T extends TLiteralValue = TLiteralValue>(value: T, options?: SchemaOptions) =>
-   Type.Literal(value, { ...options, default: value, const: value, readOnly: true }) as TLiteral<T>;
+export const Const = <T extends tb.TLiteralValue = tb.TLiteralValue>(
+   value: T,
+   options?: tb.SchemaOptions,
+) =>
+   tb.Type.Literal(value, {
+      ...options,
+      default: value,
+      const: value,
+      readOnly: true,
+   }) as tb.TLiteral<T>;
 
-export const StringIdentifier = Type.String({
+export const StringIdentifier = tb.Type.String({
    pattern: "^[a-zA-Z_][a-zA-Z0-9_]*$",
    minLength: 2,
    maxLength: 150,
 });
 
+export const StrictObject = <T extends tb.TProperties>(
+   properties: T,
+   options?: tb.ObjectOptions,
+): tb.TObject<T> => tb.Type.Object(properties, { ...options, additionalProperties: false });
+
 SetErrorFunction((error) => {
    if (error?.schema?.errorMessage) {
       return error.schema.errorMessage;
    }
 
-   if (error?.schema?.[Kind] === "StringEnum") {
+   if (error?.schema?.[tb.Kind] === "StringEnum") {
       return `Expected: ${error.schema.enum.map((e) => `"${e}"`).join(", ")}`;
    }
 
    return DefaultErrorFunction(error);
 });
 
-export {
-   Type,
-   type Static,
-   type StaticDecode,
-   type TSchema,
-   Kind,
-   type TObject,
-   type ValueError,
-   type SchemaOptions,
-   Value,
-   Default,
-   Errors,
-   Check,
-};
+export type { Static, StaticDecode, TSchema, TObject, ValueError, SchemaOptions };
+
+export { Value, Default, Errors, Check };

app/src/core/utils/uuid.ts

@@ -1,4 +1,10 @@
+import { v4, v7 } from "uuid";
+
 // generates v4
 export function uuid(): string {
-   return crypto.randomUUID();
+   return v4();
+}
+
+export function uuidv7(): string {
+   return v7();
 }

app/src/data/api/DataApi.ts

@@ -1,5 +1,6 @@
 import type { DB } from "core";
 import type { EntityData, RepoQueryIn, RepositoryResponse } from "data";
+import type { Insertable, Selectable, Updateable } from "kysely";
 import { type BaseModuleApiOptions, ModuleApi, type PrimaryFieldType } from "modules";
 import type { FetchPromise, ResponseObject } from "modules/ModuleApi";
 
@@ -25,21 +26,23 @@ export class DataApi extends ModuleApi<DataApiOptions> {
       }
    }
 
-   readOne<E extends keyof DB | string, Data = E extends keyof DB ? DB[E] : EntityData>(
+   readOne<E extends keyof DB | string>(
       entity: E,
       id: PrimaryFieldType,
       query: Omit<RepoQueryIn, "where" | "limit" | "offset"> = {},
    ) {
+      type Data = E extends keyof DB ? Selectable<DB[E]> : EntityData;
       return this.get<Pick<RepositoryResponse<Data>, "meta" | "data">>(
          ["entity", entity as any, id],
          query,
       );
    }
 
-   readOneBy<E extends keyof DB | string, Data = E extends keyof DB ? DB[E] : EntityData>(
+   readOneBy<E extends keyof DB | string>(
       entity: E,
       query: Omit<RepoQueryIn, "limit" | "offset" | "sort"> = {},
    ) {
+      type Data = E extends keyof DB ? Selectable<DB[E]> : EntityData;
       type T = Pick<RepositoryResponse<Data>, "meta" | "data">;
       return this.readMany(entity, {
          ...query,
@@ -48,10 +51,8 @@ export class DataApi extends ModuleApi<DataApiOptions> {
       }).refine((data) => data[0]) as unknown as FetchPromise<ResponseObject<T>>;
    }
 
-   readMany<E extends keyof DB | string, Data = E extends keyof DB ? DB[E] : EntityData>(
-      entity: E,
-      query: RepoQueryIn = {},
-   ) {
+   readMany<E extends keyof DB | string>(entity: E, query: RepoQueryIn = {}) {
+      type Data = E extends keyof DB ? Selectable<DB[E]> : EntityData;
       type T = Pick<RepositoryResponse<Data[]>, "meta" | "data">;
 
       const input = query ?? this.options.defaultQuery;
@@ -64,68 +65,70 @@ export class DataApi extends ModuleApi<DataApiOptions> {
       return this.post<T>(["entity", entity as any, "query"], input);
    }
 
-   readManyByReference<
-      E extends keyof DB | string,
-      R extends keyof DB | string,
-      Data = R extends keyof DB ? DB[R] : EntityData,
-   >(entity: E, id: PrimaryFieldType, reference: R, query: RepoQueryIn = {}) {
+   readManyByReference<E extends keyof DB | string, R extends keyof DB | string>(
+      entity: E,
+      id: PrimaryFieldType,
+      reference: R,
+      query: RepoQueryIn = {},
+   ) {
+      type Data = R extends keyof DB ? Selectable<DB[R]> : EntityData;
       return this.get<Pick<RepositoryResponse<Data[]>, "meta" | "data">>(
          ["entity", entity as any, id, reference],
          query ?? this.options.defaultQuery,
       );
    }
 
-   createOne<E extends keyof DB | string, Data = E extends keyof DB ? DB[E] : EntityData>(
+   createOne<E extends keyof DB | string, Input = E extends keyof DB ? DB[E] : EntityData>(
       entity: E,
-      input: Omit<Data, "id">,
+      input: Insertable<Input>,
    ) {
+      type Data = E extends keyof DB ? Selectable<DB[E]> : EntityData;
       return this.post<RepositoryResponse<Data>>(["entity", entity as any], input);
    }
 
-   createMany<E extends keyof DB | string, Data = E extends keyof DB ? DB[E] : EntityData>(
+   createMany<E extends keyof DB | string, Input = E extends keyof DB ? DB[E] : EntityData>(
       entity: E,
-      input: Omit<Data, "id">[],
+      input: Insertable<Input>[],
    ) {
       if (!input || !Array.isArray(input) || input.length === 0) {
          throw new Error("input is required");
       }
+      type Data = E extends keyof DB ? Selectable<DB[E]> : EntityData;
       return this.post<RepositoryResponse<Data[]>>(["entity", entity as any], input);
    }
 
-   updateOne<E extends keyof DB | string, Data = E extends keyof DB ? DB[E] : EntityData>(
+   updateOne<E extends keyof DB | string, Input = E extends keyof DB ? DB[E] : EntityData>(
       entity: E,
       id: PrimaryFieldType,
-      input: Partial<Omit<Data, "id">>,
+      input: Updateable<Input>,
    ) {
       if (!id) throw new Error("ID is required");
+      type Data = E extends keyof DB ? Selectable<DB[E]> : EntityData;
       return this.patch<RepositoryResponse<Data>>(["entity", entity as any, id], input);
    }
 
-   updateMany<E extends keyof DB | string, Data = E extends keyof DB ? DB[E] : EntityData>(
+   updateMany<E extends keyof DB | string, Input = E extends keyof DB ? DB[E] : EntityData>(
       entity: E,
       where: RepoQueryIn["where"],
-      update: Partial<Omit<Data, "id">>,
+      update: Updateable<Input>,
    ) {
       this.requireObjectSet(where);
+      type Data = E extends keyof DB ? Selectable<DB[E]> : EntityData;
       return this.patch<RepositoryResponse<Data[]>>(["entity", entity as any], {
          update,
          where,
       });
    }
 
-   deleteOne<E extends keyof DB | string, Data = E extends keyof DB ? DB[E] : EntityData>(
-      entity: E,
-      id: PrimaryFieldType,
-   ) {
+   deleteOne<E extends keyof DB | string>(entity: E, id: PrimaryFieldType) {
       if (!id) throw new Error("ID is required");
+      type Data = E extends keyof DB ? Selectable<DB[E]> : EntityData;
       return this.delete<RepositoryResponse<Data>>(["entity", entity as any, id]);
    }
 
-   deleteMany<E extends keyof DB | string, Data = E extends keyof DB ? DB[E] : EntityData>(
-      entity: E,
-      where: RepoQueryIn["where"],
-   ) {
+   deleteMany<E extends keyof DB | string>(entity: E, where: RepoQueryIn["where"]) {
       this.requireObjectSet(where);
+      type Data = E extends keyof DB ? Selectable<DB[E]> : EntityData;
       return this.delete<RepositoryResponse<Data>>(["entity", entity as any], where);
    }
 

app/src/data/api/DataController.ts

@@ -1,5 +1,4 @@
-import { isDebug, tbValidator as tb } from "core";
-import { StringEnum, Type } from "core/utils";
+import { $console, isDebug } from "core";
 import {
    DataPermissions,
    type EntityData,
@@ -7,13 +6,15 @@ import {
    type MutatorResponse,
    type RepoQuery,
    type RepositoryResponse,
-   querySchema,
+   repoQuery,
 } from "data";
 import type { Handler } from "hono/types";
 import type { ModuleBuildContext } from "modules";
 import { Controller } from "modules/Controller";
+import { jsc, s, describeRoute, schemaToSpec } from "core/object/schema";
 import * as SystemPermissions from "modules/permissions";
 import type { AppDataConfig } from "../data-schema";
+import { omitKeys } from "core/utils";
 
 export class DataController extends Controller {
    constructor(
@@ -45,7 +46,6 @@ export class DataController extends Controller {
       const template = { data: res.data, meta };
 
       // @todo: this works but it breaks in FE (need to improve DataTable)
-      //return objectCleanEmpty(template) as any;
       // filter empty
       return Object.fromEntries(
          Object.entries(template).filter(([_, v]) => typeof v !== "undefined" && v !== null),
@@ -56,7 +56,6 @@ export class DataController extends Controller {
       const template = { data: res.data };
 
       // filter empty
-      //return objectCleanEmpty(template);
       return Object.fromEntries(Object.entries(template).filter(([_, v]) => v !== undefined));
    }
 
@@ -71,11 +70,7 @@ export class DataController extends Controller {
    override getController() {
       const { permission, auth } = this.middlewares;
       const hono = this.create().use(auth(), permission(SystemPermissions.accessApi));
-
-      const definedEntities = this.em.entities.map((e) => e.name);
-      const tbNumber = Type.Transform(Type.String({ pattern: "^[1-9][0-9]{0,}$" }))
-         .Decode(Number.parseInt)
-         .Encode(String);
+      const entitiesEnum = this.getEntitiesEnum(this.em);
 
       // @todo: sample implementation how to augment handler with additional info
       function handler<HH extends Handler>(name: string, h: HH): any {
@@ -88,6 +83,10 @@ export class DataController extends Controller {
       // info
       hono.get(
          "/",
+         describeRoute({
+            summary: "Retrieve data configuration",
+            tags: ["data"],
+         }),
          handler("data info", (c) => {
             // sample implementation
             return c.json(this.em.toJSON());
@@ -95,56 +94,80 @@ export class DataController extends Controller {
       );
 
       // sync endpoint
-      hono.get("/sync", permission(DataPermissions.databaseSync), async (c) => {
-         const force = c.req.query("force") === "1";
-         const drop = c.req.query("drop") === "1";
-         //console.log("force", force);
-         const tables = await this.em.schema().introspect();
-         //console.log("tables", tables);
-         const changes = await this.em.schema().sync({
-            force,
-            drop,
-         });
-         return c.json({ tables: tables.map((t) => t.name), changes });
-      });
+      hono.get(
+         "/sync",
+         permission(DataPermissions.databaseSync),
+         describeRoute({
+            summary: "Sync database schema",
+            tags: ["data"],
+         }),
+         jsc(
+            "query",
+            s.partialObject({
+               force: s.boolean(),
+               drop: s.boolean(),
+            }),
+         ),
+         async (c) => {
+            const { force, drop } = c.req.valid("query");
+            //console.log("force", force);
+            const tables = await this.em.schema().introspect();
+            //console.log("tables", tables);
+            const changes = await this.em.schema().sync({
+               force,
+               drop,
+            });
+            return c.json({ tables: tables.map((t) => t.name), changes });
+         },
+      );
 
       /**
        * Schema endpoints
        */
       // read entity schema
-      hono.get("/schema.json", permission(DataPermissions.entityRead), async (c) => {
-         const $id = `${this.config.basepath}/schema.json`;
-         const schemas = Object.fromEntries(
-            this.em.entities.map((e) => [
-               e.name,
-               {
-                  $ref: `${this.config.basepath}/schemas/${e.name}`,
-               },
-            ]),
-         );
-         return c.json({
-            $schema: "https://json-schema.org/draft/2020-12/schema",
-            $id,
-            properties: schemas,
-         });
-      });
+      hono.get(
+         "/schema.json",
+         permission(DataPermissions.entityRead),
+         describeRoute({
+            summary: "Retrieve data schema",
+            tags: ["data"],
+         }),
+         async (c) => {
+            const $id = `${this.config.basepath}/schema.json`;
+            const schemas = Object.fromEntries(
+               this.em.entities.map((e) => [
+                  e.name,
+                  {
+                     $ref: `${this.config.basepath}/schemas/${e.name}`,
+                  },
+               ]),
+            );
+            return c.json({
+               $schema: "https://json-schema.org/draft/2020-12/schema",
+               $id,
+               properties: schemas,
+            });
+         },
+      );
 
       // read schema
       hono.get(
          "/schemas/:entity/:context?",
          permission(DataPermissions.entityRead),
-         tb(
+         describeRoute({
+            summary: "Retrieve entity schema",
+            tags: ["data"],
+         }),
+         jsc(
             "param",
-            Type.Object({
-               entity: Type.String(),
-               context: Type.Optional(StringEnum(["create", "update"])),
+            s.object({
+               entity: entitiesEnum,
+               context: s.string({ enum: ["create", "update"], default: "create" }).optional(),
             }),
          ),
          async (c) => {
-            //console.log("request", c.req.raw);
             const { entity, context } = c.req.param();
             if (!this.entityExists(entity)) {
-               console.warn("not found:", entity, definedEntities);
                return this.notFound(c);
             }
             const _entity = this.em.entity(entity);
@@ -168,30 +191,39 @@ export class DataController extends Controller {
       /**
        * Info endpoints
        */
-      hono.get("/info/:entity", async (c) => {
-         const { entity } = c.req.param();
-         if (!this.entityExists(entity)) {
-            return this.notFound(c);
-         }
-         const _entity = this.em.entity(entity);
-         const fields = _entity.fields.map((f) => f.name);
-         const $rels = (r: any) =>
-            r.map((r: any) => ({
-               entity: r.other(_entity).entity.name,
-               ref: r.other(_entity).reference,
-            }));
+      hono.get(
+         "/info/:entity",
+         permission(DataPermissions.entityRead),
+         describeRoute({
+            summary: "Retrieve entity info",
+            tags: ["data"],
+         }),
+         jsc("param", s.object({ entity: entitiesEnum })),
+         async (c) => {
+            const { entity } = c.req.param();
+            if (!this.entityExists(entity)) {
+               return this.notFound(c);
+            }
+            const _entity = this.em.entity(entity);
+            const fields = _entity.fields.map((f) => f.name);
+            const $rels = (r: any) =>
+               r.map((r: any) => ({
+                  entity: r.other(_entity).entity.name,
+                  ref: r.other(_entity).reference,
+               }));
 
-         return c.json({
-            name: _entity.name,
-            fields,
-            relations: {
-               all: $rels(this.em.relations.relationsOf(_entity)),
-               listable: $rels(this.em.relations.listableRelationsOf(_entity)),
-               source: $rels(this.em.relations.sourceRelationsOf(_entity)),
-               target: $rels(this.em.relations.targetRelationsOf(_entity)),
-            },
-         });
-      });
+            return c.json({
+               name: _entity.name,
+               fields,
+               relations: {
+                  all: $rels(this.em.relations.relationsOf(_entity)),
+                  listable: $rels(this.em.relations.listableRelationsOf(_entity)),
+                  source: $rels(this.em.relations.sourceRelationsOf(_entity)),
+                  target: $rels(this.em.relations.targetRelationsOf(_entity)),
+               },
+            });
+         },
+      );
 
       return hono.all("*", (c) => c.notFound());
    }
@@ -200,10 +232,9 @@ export class DataController extends Controller {
       const { permission } = this.middlewares;
       const hono = this.create();
 
-      const definedEntities = this.em.entities.map((e) => e.name);
-      const tbNumber = Type.Transform(Type.String({ pattern: "^[1-9][0-9]{0,}$" }))
-         .Decode(Number.parseInt)
-         .Encode(String);
+      const entitiesEnum = this.getEntitiesEnum(this.em);
+      // @todo: make dynamic based on entity
+      const idType = s.anyOf([s.number(), s.string()], { coerce: (v) => v as any });
 
       /**
        * Function endpoints
@@ -212,14 +243,19 @@ export class DataController extends Controller {
       hono.post(
          "/:entity/fn/count",
          permission(DataPermissions.entityRead),
-         tb("param", Type.Object({ entity: Type.String() })),
+         describeRoute({
+            summary: "Count entities",
+            tags: ["data"],
+         }),
+         jsc("param", s.object({ entity: entitiesEnum })),
+         jsc("json", repoQuery.properties.where),
          async (c) => {
             const { entity } = c.req.valid("param");
             if (!this.entityExists(entity)) {
                return this.notFound(c);
             }
 
-            const where = (await c.req.json()) as any;
+            const where = c.req.valid("json") as any;
             const result = await this.em.repository(entity).count(where);
             return c.json({ entity, count: result.count });
          },
@@ -229,14 +265,19 @@ export class DataController extends Controller {
       hono.post(
          "/:entity/fn/exists",
          permission(DataPermissions.entityRead),
-         tb("param", Type.Object({ entity: Type.String() })),
+         describeRoute({
+            summary: "Check if entity exists",
+            tags: ["data"],
+         }),
+         jsc("param", s.object({ entity: entitiesEnum })),
+         jsc("json", repoQuery.properties.where),
          async (c) => {
             const { entity } = c.req.valid("param");
             if (!this.entityExists(entity)) {
                return this.notFound(c);
             }
 
-            const where = c.req.json() as any;
+            const where = c.req.valid("json") as any;
             const result = await this.em.repository(entity).exists(where);
             return c.json({ entity, exists: result.exists });
          },
@@ -246,19 +287,36 @@ export class DataController extends Controller {
        * Read endpoints
        */
       // read many
+      const saveRepoQuery = s.partialObject({
+         ...omitKeys(repoQuery.properties, ["with"]),
+         sort: s.string({ default: "id" }),
+         select: s.array(s.string()),
+         join: s.array(s.string()),
+      });
+      const saveRepoQueryParams = (pick: string[] = Object.keys(repoQuery.properties)) => [
+         ...(schemaToSpec(saveRepoQuery, "query").parameters?.filter(
+            // @ts-ignore
+            (p) => pick.includes(p.name),
+         ) as any),
+      ];
+
       hono.get(
          "/:entity",
+         describeRoute({
+            summary: "Read many",
+            parameters: saveRepoQueryParams(["limit", "offset", "sort", "select", "join"]),
+            tags: ["data"],
+         }),
          permission(DataPermissions.entityRead),
-         tb("param", Type.Object({ entity: Type.String() })),
-         tb("query", querySchema),
+         jsc("param", s.object({ entity: entitiesEnum })),
+         jsc("query", repoQuery, { skipOpenAPI: true }),
          async (c) => {
-            const { entity } = c.req.param();
+            const { entity } = c.req.valid("param");
             if (!this.entityExists(entity)) {
-               console.warn("not found:", entity, definedEntities);
                return this.notFound(c);
             }
             const options = c.req.valid("query") as RepoQuery;
-            const result = await this.em.repository(entity).findMany(options);
+            const result = await this.em.repo(entity).findMany(options);
 
             return c.json(this.repoResult(result), { status: result.data ? 200 : 404 });
          },
@@ -267,22 +325,27 @@ export class DataController extends Controller {
       // read one
       hono.get(
          "/:entity/:id",
+         describeRoute({
+            summary: "Read one",
+            parameters: saveRepoQueryParams(["offset", "sort", "select"]),
+            tags: ["data"],
+         }),
          permission(DataPermissions.entityRead),
-         tb(
+         jsc(
             "param",
-            Type.Object({
-               entity: Type.String(),
-               id: tbNumber,
+            s.object({
+               entity: entitiesEnum,
+               id: idType,
             }),
          ),
-         tb("query", querySchema),
+         jsc("query", repoQuery, { skipOpenAPI: true }),
          async (c) => {
-            const { entity, id } = c.req.param();
+            const { entity, id } = c.req.valid("param");
             if (!this.entityExists(entity)) {
                return this.notFound(c);
             }
             const options = c.req.valid("query") as RepoQuery;
-            const result = await this.em.repository(entity).findId(Number(id), options);
+            const result = await this.em.repository(entity).findId(id, options);
 
             return c.json(this.repoResult(result), { status: result.data ? 200 : 404 });
          },
@@ -291,18 +354,23 @@ export class DataController extends Controller {
       // read many by reference
       hono.get(
          "/:entity/:id/:reference",
+         describeRoute({
+            summary: "Read many by reference",
+            parameters: saveRepoQueryParams(),
+            tags: ["data"],
+         }),
          permission(DataPermissions.entityRead),
-         tb(
+         jsc(
             "param",
-            Type.Object({
-               entity: Type.String(),
-               id: tbNumber,
-               reference: Type.String(),
+            s.object({
+               entity: entitiesEnum,
+               id: idType,
+               reference: s.string(),
             }),
          ),
-         tb("query", querySchema),
+         jsc("query", repoQuery, { skipOpenAPI: true }),
          async (c) => {
-            const { entity, id, reference } = c.req.param();
+            const { entity, id, reference } = c.req.valid("param");
             if (!this.entityExists(entity)) {
                return this.notFound(c);
             }
@@ -310,25 +378,40 @@ export class DataController extends Controller {
             const options = c.req.valid("query") as RepoQuery;
             const result = await this.em
                .repository(entity)
-               .findManyByReference(Number(id), reference, options);
+               .findManyByReference(id, reference, options);
 
             return c.json(this.repoResult(result), { status: result.data ? 200 : 404 });
          },
       );
 
       // func query
+      const fnQuery = s.partialObject({
+         ...saveRepoQuery.properties,
+         with: s.object({}),
+      });
       hono.post(
          "/:entity/query",
+         describeRoute({
+            summary: "Query entities",
+            requestBody: {
+               content: {
+                  "application/json": {
+                     schema: fnQuery.toJSON(),
+                     example: fnQuery.template({ withOptional: true }),
+                  },
+               },
+            },
+            tags: ["data"],
+         }),
          permission(DataPermissions.entityRead),
-         tb("param", Type.Object({ entity: Type.String() })),
-         tb("json", querySchema),
+         jsc("param", s.object({ entity: entitiesEnum })),
+         jsc("json", repoQuery, { skipOpenAPI: true }),
          async (c) => {
-            const { entity } = c.req.param();
+            const { entity } = c.req.valid("param");
             if (!this.entityExists(entity)) {
                return this.notFound(c);
             }
-            const options = (await c.req.valid("json")) as RepoQuery;
-            //console.log("options", options);
+            const options = (await c.req.json()) as RepoQuery;
             const result = await this.em.repository(entity).findMany(options);
 
             return c.json(this.repoResult(result), { status: result.data ? 200 : 404 });
@@ -341,11 +424,15 @@ export class DataController extends Controller {
       // insert one
       hono.post(
          "/:entity",
+         describeRoute({
+            summary: "Insert one or many",
+            tags: ["data"],
+         }),
          permission(DataPermissions.entityCreate),
-         tb("param", Type.Object({ entity: Type.String() })),
-         tb("json", Type.Union([Type.Object({}), Type.Array(Type.Object({}))])),
+         jsc("param", s.object({ entity: entitiesEnum })),
+         jsc("json", s.anyOf([s.object({}), s.array(s.object({}))])),
          async (c) => {
-            const { entity } = c.req.param();
+            const { entity } = c.req.valid("param");
             if (!this.entityExists(entity)) {
                return this.notFound(c);
             }
@@ -364,13 +451,17 @@ export class DataController extends Controller {
       // update many
       hono.patch(
          "/:entity",
+         describeRoute({
+            summary: "Update many",
+            tags: ["data"],
+         }),
          permission(DataPermissions.entityUpdate),
-         tb("param", Type.Object({ entity: Type.String() })),
-         tb(
+         jsc("param", s.object({ entity: entitiesEnum })),
+         jsc(
             "json",
-            Type.Object({
-               update: Type.Object({}),
-               where: querySchema.properties.where,
+            s.object({
+               update: s.object({}),
+               where: repoQuery.properties.where,
             }),
          ),
          async (c) => {
@@ -391,15 +482,20 @@ export class DataController extends Controller {
       // update one
       hono.patch(
          "/:entity/:id",
+         describeRoute({
+            summary: "Update one",
+            tags: ["data"],
+         }),
          permission(DataPermissions.entityUpdate),
-         tb("param", Type.Object({ entity: Type.String(), id: tbNumber })),
+         jsc("param", s.object({ entity: entitiesEnum, id: idType })),
+         jsc("json", s.object({})),
          async (c) => {
-            const { entity, id } = c.req.param();
+            const { entity, id } = c.req.valid("param");
             if (!this.entityExists(entity)) {
                return this.notFound(c);
             }
             const body = (await c.req.json()) as EntityData;
-            const result = await this.em.mutator(entity).updateOne(Number(id), body);
+            const result = await this.em.mutator(entity).updateOne(id, body);
 
             return c.json(this.mutatorResult(result));
          },
@@ -408,14 +504,18 @@ export class DataController extends Controller {
       // delete one
       hono.delete(
          "/:entity/:id",
+         describeRoute({
+            summary: "Delete one",
+            tags: ["data"],
+         }),
          permission(DataPermissions.entityDelete),
-         tb("param", Type.Object({ entity: Type.String(), id: tbNumber })),
+         jsc("param", s.object({ entity: entitiesEnum, id: idType })),
          async (c) => {
-            const { entity, id } = c.req.param();
+            const { entity, id } = c.req.valid("param");
             if (!this.entityExists(entity)) {
                return this.notFound(c);
             }
-            const result = await this.em.mutator(entity).deleteOne(Number(id));
+            const result = await this.em.mutator(entity).deleteOne(id);
 
             return c.json(this.mutatorResult(result));
          },
@@ -424,15 +524,19 @@ export class DataController extends Controller {
       // delete many
       hono.delete(
          "/:entity",
+         describeRoute({
+            summary: "Delete many",
+            tags: ["data"],
+         }),
          permission(DataPermissions.entityDelete),
-         tb("param", Type.Object({ entity: Type.String() })),
-         tb("json", querySchema.properties.where),
+         jsc("param", s.object({ entity: entitiesEnum })),
+         jsc("json", repoQuery.properties.where),
          async (c) => {
-            const { entity } = c.req.param();
+            const { entity } = c.req.valid("param");
             if (!this.entityExists(entity)) {
                return this.notFound(c);
             }
-            const where = c.req.valid("json") as RepoQuery["where"];
+            const where = (await c.req.json()) as RepoQuery["where"];
             const result = await this.em.mutator(entity).deleteWhere(where);
 
             return c.json(this.mutatorResult(result));

app/src/data/connection/Connection.ts

@@ -2,6 +2,8 @@ import {
    type AliasableExpression,
    type ColumnBuilderCallback,
    type ColumnDataType,
+   type DatabaseIntrospector,
+   type Dialect,
    type Expression,
    type Kysely,
    type KyselyPlugin,
@@ -12,7 +14,8 @@ import {
    type Simplify,
    sql,
 } from "kysely";
-import type { BaseIntrospector } from "./BaseIntrospector";
+import type { BaseIntrospector, BaseIntrospectorConfig } from "./BaseIntrospector";
+import type { Constructor } from "core";
 
 export type QB = SelectQueryBuilder<any, any, any>;
 
@@ -79,6 +82,7 @@ export abstract class Connection<DB = any> {
    kysely: Kysely<DB>;
    protected readonly supported = {
       batching: false,
+      counts: true,
    };
 
    constructor(
@@ -159,3 +163,19 @@ export abstract class Connection<DB = any> {
       // no-op by default
    }
 }
+
+export function customIntrospector<T extends Constructor<Dialect>>(
+   dialect: T,
+   introspector: Constructor<DatabaseIntrospector>,
+   options: BaseIntrospectorConfig = {},
+) {
+   return {
+      create(...args: ConstructorParameters<T>) {
+         return new (class extends dialect {
+            override createIntrospector(db: Kysely<any>): DatabaseIntrospector {
+               return new introspector(db, options);
+            }
+         })(...args);
+      },
+   };
+}