v0.2.0

First-class auth: a typed SDK, real sessions, cookie mode, and a server-driven OAuth2 flow

This release is about the auth story growing up. If you're evaluating
Cratebase against PocketBase, or against hand-rolling auth on top of
Postgres yourself, here's what changed:

• @cratebase/client
  is now the first-party TypeScript SDK, and the one the docs and
  admin dashboard recommend by default (the dashboard itself has been
  migrated off the community pocketbase npm package onto it). It's a
  typed client for records, auth, realtime, files, batch, and admin,
  plus Cratebase's value-add surface (vector/LLM/MCP/queue/presence)
  built in — see Using the TypeScript
  SDK. The
  wire-compatible pocketbase SDK still works unchanged if you'd
  rather keep using it.
• Server-side sessions with instant revocation. A new _sessions
  system collection records one row per minted token. Token
  verification stays a stateless JWT check on the hot path — no
  database read per request — but sessions.list() /
  .revoke(id) / .revokeOthers() / .revokeAll() now give you real,
  immediate control over who's signed in, instead of just waiting for
  tokens to expire. See Sessions.
• Cookie-mode sessions for browser clients, and a documented
  bearer-token + first-party-cookie pattern for SSR frameworks. Turn on
  SESSION_COOKIE and logins/refreshes set an HttpOnly cookie
  instead of handing the token to page JavaScript, with a same-origin
  CSRF check on unsafe methods. See Cookie
  sessions.
• OAuth2 without a client-side redirect dance. With cookie sessions
  on, the server can now drive the whole provider round trip itself —
  GET .../oauth2/{provider}/start sends the browser to the provider
  and GET .../oauth2/{provider}/callback completes the login and
  lands the session in a cookie, no authURL/code juggling in your
  frontend. See OAuth2 → Server-driven redirect
  flow.
• Bans and impersonation as first-class routes, plus a _bans
  system collection, and a Sessions panel and Impersonate/Ban actions
  in the admin dashboard.

Also in this release: a toggle-gated ZIP-export plugin
(POST /api/plugins/zip-export/enqueue) for bundling a collection
field's files into an archive, and $app.rawQuery(sql, params?) in JS
hooks for read-only raw SQL that a filter string can't express (joins,
GROUP BY, window functions).

Download the archive for your platform, unzip it, and run:

./cratebase superuser create you@example.com yourpassword
./cratebase serve

The admin dashboard is at http://127.0.0.1:8090/_/ and the API
at http://127.0.0.1:8090/api/. The database is created on first
run; there is nothing else to install.

Each archive has a matching .sha256 to verify the download.

What's Changed

• feat(server): add ZIP-export plugin by @nicoaudy in #14
• feat(jsvm): $app.rawQuery for raw-SQL reads without Record hydration by @nicoaudy in #16
• feat: first-class auth — @cratebase/client SDK, sessions, cookies, OAuth2 redirect, bans by @nicoaudy in #17

Full Changelog: v0.1.0...v0.2.0