# Covara > Your Drizzle schema is already a backend This file contains links to documentation sections following the llmstxt.org standard. ## Table of Contents - [Account security flows](https://kahveciderin.github.io/covara/docs/auth/account-security.md): Opt-in CSRF protection, login throttling, email verification, and password reset — all layered onto useAuth. - [API keys](https://kahveciderin.github.io/covara/docs/auth/api-keys.md): Standalone helpers to create, verify, list, rotate, and revoke hashed API keys, with a pluggable store. - [Federated login](https://kahveciderin.github.io/covara/docs/auth/federated.md): Add Google, Microsoft, Okta, Auth0, Keycloak, or any generic OIDC provider as a login backend, with verified id_token handling. - [Auth quickstart](https://kahveciderin.github.io/covara/docs/auth/getting-started.md): The fastest way to get real auth working in Covara — email/password with email confirmation plus GitHub social login, with the one table you actual... - [Internal & system tables](https://kahveciderin.github.io/covara/docs/auth/internal-tables.md): Every table Covara's auth/system layer reads or writes, the columns each one requires, which are framework-owned vs app-supplied, and how to bring ... - [JWT authentication](https://kahveciderin.github.io/covara/docs/auth/jwt.md): Server-side JWT bearer adapter plus the client JWTClient and useJWTAuth hook with pluggable token storage for web and React Native. - [Magic links](https://kahveciderin.github.io/covara/docs/auth/magic-links.md): Opt-in passwordless email login — request a single-use token and verify it to create a session, without leaking which emails exist. - [Multi-factor auth (TOTP)](https://kahveciderin.github.io/covara/docs/auth/mfa.md): Opt-in TOTP multi-factor authentication with backup codes, enrollment and verification routes, and a login gate. - [OIDC provider](https://kahveciderin.github.io/covara/docs/auth/oidc-provider.md): A complete OpenID Connect server — authorization code flow with PKCE, token revocation and introspection, dynamic client registration, consent revo... - [Authentication overview](https://kahveciderin.github.io/covara/docs/auth/overview.md): Covara's authentication landscape — choose between the built-in OIDC provider and session-based useAuth, populate the request user, and enforce row... - [Passwords](https://kahveciderin.github.io/covara/docs/auth/passwords.md): Workers-safe scrypt password hashing (hashPassword/verifyPassword/needsRehash) and an enforceable password policy with a built-in denylist. - [Authorization scopes](https://kahveciderin.github.io/covara/docs/auth/scopes.md): Row-level security with RSQL scope expressions enforced across reads, writes, subscriptions, and search — scope patterns, programmatic helpers, and... - [Secure query builder](https://kahveciderin.github.io/covara/docs/auth/secure-queries.md): The scope-enforcement layer behind useResource — run scope-safe selects, counts, aggregates, and mutations in your own routes, with admin bypass an... - [Security headers](https://kahveciderin.github.io/covara/docs/auth/security-headers.md): HSTS, X-Frame-Options, MIME-sniffing protection, Referrer-Policy, and COOP auto-mounted by createCovara, with opt-in Content-Security-Policy. - [Session-based auth](https://kahveciderin.github.io/covara/docs/auth/sessions.md): The useAuth function — login/signup/logout routes, cookie options, session rotation, lifecycle hooks, auth adapters (Passport, Auth.js), and sessio... - [Social login (Passport.js)](https://kahveciderin.github.io/covara/docs/auth/social.md): Plug any Passport.js OAuth2 strategy (GitHub, Discord, Google, Facebook, Spotify, …) into useAuth as a social login — on Node and Cloudflare Worker... - [Client authentication](https://kahveciderin.github.io/covara/docs/client/auth.md): The useAuth hook and its strategies (cookie, JWT, bearer, API key, auto), plus the OIDC PKCE flow with token refresh, storage options, and a callba... - [Billing (client)](https://kahveciderin.github.io/covara/docs/client/billing.md): The client.billing API and the useCredits, useSubscription, and useCheckout React hooks for checkout redirects, credit balances, and subscription s... - [File uploads (client)](https://kahveciderin.github.io/covara/docs/client/files.md): Upload files from the client with progress, presigned direct-to-bucket uploads, and the useFileUpload / useFile / useFiles React hooks. - [Live queries](https://kahveciderin.github.io/covara/docs/client/live-queries.md): The reactive LiveQuery store behind useLiveList — a hybrid fetch+subscribe cache with optimistic mutations, status tracking, and a framework-agnost... - [Offline support](https://kahveciderin.github.io/covara/docs/client/offline.md): Optimistic updates, a persisted mutation queue, automatic sync on reconnect, ID remapping, and conflict handling — with LocalStorage or IndexedDB b... - [Client library overview](https://kahveciderin.github.io/covara/docs/client/overview.md): The type-safe, real-time Covara client — setup, configuration, resilient transport, date handling, and the client methods that power queries, subsc... - [Queries & repository](https://kahveciderin.github.io/covara/docs/client/queries.md): Typed resource CRUD, batch and RPC calls, aggregations, and the immutable fluent query builder with select-narrowed return types and escaped filter... - [React hooks](https://kahveciderin.github.io/covara/docs/client/react-hooks.md): useLiveList, useInfiniteList, useLiveAggregate, useMutation, useSearch, useAuth, file and billing hooks, plus invalidation and prefetch — the full ... - [React Native](https://kahveciderin.github.io/covara/docs/client/react-native.md): Run the Covara client in React Native — pluggable AsyncStorage-compatible token storage, environment-aware transport and offline backends, and getD... - [Type generation](https://kahveciderin.github.io/covara/docs/client/typegen.md): Generate TypeScript types from your running API — resource interfaces, input/update types, field-metadata helpers, public env types, and a typed cl... - [Authentication Contracts](https://kahveciderin.github.io/covara/docs/contracts/auth.md): - `tests/invariants/auth-hardening.test.ts` - Security edge cases - [Billing Contracts](https://kahveciderin.github.io/covara/docs/contracts/billing.md): Scope: `src/billing/` — the `BillingAdapter` interface, the Stripe / Lemon - [Email Contracts](https://kahveciderin.github.io/covara/docs/contracts/email.md): Scope: `src/email/` — the `EmailAdapter` interface, the Resend and Cloudflare - [Environment Variables Contracts](https://kahveciderin.github.io/covara/docs/contracts/environment-variables.md): - `tests/env/env.test.ts` - Server-side parsing, public/private separation, ETag - [ETag / Optimistic Concurrency Contracts](https://kahveciderin.github.io/covara/docs/contracts/etag.md): These guarantees apply to resources configured with `etag` in `useResource(table, { etag: {...} })`. Without the config, no ETag headers are emitte... - [Server-Rendered htmx Pages Conctracts](https://kahveciderin.github.io/covara/docs/contracts/htmx-pages.md): > **Beta.** The htmx page layer is newer than the rest of Covara; these invariants may evolve while it stabilizes. - [Offline Sync Contracts](https://kahveciderin.github.io/covara/docs/contracts/offline-sync.md): - `tests/sync/offline-sync-edge-cases.test.ts` - Comprehensive sync scenarios - [Covara Contracts](https://kahveciderin.github.io/covara/docs/contracts/overview.md): This folder contains the formal contracts (guarantees and non-guarantees) for the Covara framework. These contracts are: - [Pagination Contracts](https://kahveciderin.github.io/covara/docs/contracts/pagination.md): For applications requiring consistency: - [Search Contracts](https://kahveciderin.github.io/covara/docs/contracts/search.md): - `tests/search/adapter.test.ts` - Global adapter registration - [Storage (File Upload) Contracts](https://kahveciderin.github.io/covara/docs/contracts/storage.md): - `tests/storage/memory.test.ts` - Memory adapter operations - [Subscription Contracts](https://kahveciderin.github.io/covara/docs/contracts/subscriptions.md): - `tests/invariants/subscription-invariants.test.ts` - Core invariants - [Task Contracts](https://kahveciderin.github.io/covara/docs/contracts/tasks.md): - `tests/invariants/task-state-machine.test.ts` - State machine invariants - [Mutation Tracking Contracts](https://kahveciderin.github.io/covara/docs/contracts/track-mutations.md): - `tests/track-mutations.test.ts` - Core functionality - [Aggregations](https://kahveciderin.github.io/covara/docs/core/aggregations.md): Group-by, count, sum, avg, min, max queries with pre-grouping filters and post-grouping HAVING, plus a live aggregation subscription that recompute... - [Batch operations](https://kahveciderin.github.io/covara/docs/core/batch.md): Bulk create, update, delete, and upsert with configurable limits, filter-scoped batch mutations, and lifecycle hooks per item. - [CRUD endpoints](https://kahveciderin.github.io/covara/docs/core/crud.md): The read and write endpoints every resource generates — list, get, create, update, replace, delete, count — with request/response shapes and projec... - [Fields: masking, writable, computed](https://kahveciderin.github.io/covara/docs/core/fields.md): Field-level read masking, enforced writable allowlists (mass-assignment protection), filterable/sortable allowlists, strictInput, generated fields,... - [Filtering (RSQL)](https://kahveciderin.github.io/covara/docs/core/filtering.md): Covara's RSQL-like filter language — 30+ built-in operators, combinators, date handling, and custom operators that work for both SQL queries and li... - [Nested write-through](https://kahveciderin.github.io/covara/docs/core/nested-writes.md): Create belongsTo parents and hasMany/hasOne children together with the main row in a single atomic POST, with foreign keys wired automatically. - [Optimistic locking (ETags)](https://kahveciderin.github.io/covara/docs/core/optimistic-locking.md): ETag emission, If-Match compare-and-swap on writes, If-None-Match 304 reads, and auto-incrementing version fields for lost-update protection. - [Pagination](https://kahveciderin.github.io/covara/docs/core/pagination.md): Cursor-based keyset pagination with multi-field ordering, stable ordering, opaque tamper-evident cursors, and optional total counts. - [Procedures & lifecycle hooks](https://kahveciderin.github.io/covara/docs/core/procedures.md): Custom Zod-validated RPC endpoints and before/after lifecycle hooks on every CRUD operation, with automatic mutation tracking and hook composition ... - [Relations & joins](https://kahveciderin.github.io/covara/docs/core/relations.md): Define belongsTo, hasOne, hasMany, and manyToMany relations and load them efficiently with batch loading, include options, eager strategies, nested... - [Resources & the app factory](https://kahveciderin.github.io/covara/docs/core/resources-and-app.md): useResource and createCovara — the central abstraction that turns a Drizzle table into a full REST + real-time API, and every configuration option. - [RSQL](https://kahveciderin.github.io/covara/docs/core/rsql.md): Covara's RSQL expression language — the one syntax used for query filters and authorization scopes — its operators, combinators, value types, the t... - [Full-text search](https://kahveciderin.github.io/covara/docs/core/search.md): Built-in full-text search via SQLite FTS5, Postgres tsvector, OpenSearch, or in-memory adapters, with auto-indexing, field weights, RSQL post-filte... - [Soft delete](https://kahveciderin.github.io/covara/docs/core/soft-delete.md): Mark rows deleted instead of removing them — reads hide soft-deleted rows by default, subscribers see a removed event, and ?withDeleted=true reveal... - [Database matrix](https://kahveciderin.github.io/covara/docs/deployment/databases.md): Every Drizzle-supported SQLite and PostgreSQL driver Covara runs on — libsql, better-sqlite3, D1, postgres-js, Neon, PGlite — across Node and Workers. - [Durable Object KV](https://kahveciderin.github.io/covara/docs/deployment/durable-object-kv.md): Shared, strongly-consistent state on Cloudflare Workers without Redis — cross-isolate subscriptions, sessions, rate limits, and tasks backed by a s... - [Environment variables](https://kahveciderin.github.io/covara/docs/deployment/environment-variables.md): Type-safe env config with Zod validation, automatic public/private separation, an HTTP endpoint to expose public vars with ETag caching, and a clie... - [Deploy on Node](https://kahveciderin.github.io/covara/docs/deployment/node.md): Run a Covara app standalone with startServer from covara/node, including graceful shutdown that drains SSE connections for zero-downtime deploys. - [Deploy on Cloudflare Workers](https://kahveciderin.github.io/covara/docs/deployment/workers.md): Run a Covara app at the edge — D1/Postgres, nodejs_compat, the Durable Object KV for shared state, cross-process subscription fan-out, and SSE cost... - [Server-rendered htmx — Overview](https://kahveciderin.github.io/covara/docs/htmx/overview.md): > **Beta.** Server-rendered htmx support is newer than Covara's JSON API and TypeScript client and may still change between releases. The JSON API ... - [Building pages](https://kahveciderin.github.io/covara/docs/htmx/pages.md): > **Beta.** The server-rendered htmx layer is newer than the rest of Covara and its API may still change. - [Introduction](https://kahveciderin.github.io/covara/docs/intro.md): Covara turns your Drizzle schema into a complete, production-ready real-time API with a type-safe, offline-first TypeScript client. - [Billing](https://kahveciderin.github.io/covara/docs/platform/billing.md): One provider-agnostic billing layer over Stripe, Lemon Squeezy, Paddle, and Polar — plans, checkout, subscriptions, usage, a KV-backed credits ledg... - [Email](https://kahveciderin.github.io/covara/docs/platform/email.md): A provider-agnostic email layer — Resend and Cloudflare Email Service adapters, batch sending, and a fluent template builder that renders escaped r... - [Health checks](https://kahveciderin.github.io/covara/docs/platform/health.md): Liveness and readiness endpoints (/healthz, /readyz) with dependency checks and runtime thresholds, wired into graceful shutdown for zero-downtime ... - [KV store](https://kahveciderin.github.io/covara/docs/platform/kv.md): The Redis-compatible key-value abstraction behind subscriptions, sessions, tasks, rate limits, and the changelog — memory, Redis, and Durable Objec... - [File storage](https://kahveciderin.github.io/covara/docs/platform/storage.md): File uploads as first-class resources — local/S3/R2/in-memory adapters, useFileResource endpoints, MIME and size validation, presigned URLs, orphan... - [Background tasks](https://kahveciderin.github.io/covara/docs/platform/tasks.md): A distributed job queue — task definitions with Zod validation, retry strategies, scheduling and cron recurrence with catchup, idempotency, concurr... - [Quick Start](https://kahveciderin.github.io/covara/docs/quick-start.md): Scaffold a Covara project with the CLI — add --frontend react for a full-stack real-time app — or drop it into an existing Hono app for a full REST... - [Aggregate subscriptions](https://kahveciderin.github.io/covara/docs/realtime/aggregate-subscriptions.md): Live aggregations over SSE — recompute-on-change with scope-aware skipping, debounced re-emit, order-independent dedup, and cross-process fan-out. - [Changelog](https://kahveciderin.github.io/covara/docs/realtime/changelog.md): The central, monotonically-sequenced log of all mutations that powers reliable, resumable subscriptions and catch-up on reconnect. - [Mutation tracking](https://kahveciderin.github.io/covara/docs/realtime/mutation-tracking.md): Wrap your Drizzle db with trackMutations so custom routes, procedures, transactions, raw SQL, and external writers all feed the changelog, subscrip... - [Subscriptions](https://kahveciderin.github.io/covara/docs/realtime/subscriptions.md): Changelog-based real-time subscriptions over SSE — event types, the hybrid fetch+subscribe model, subscription modes for paginated views, reconnect... - [Admin UI](https://kahveciderin.github.io/covara/docs/tooling/admin-ui.md): A built-in dashboard at /__covara/ui — resource introspection, a data explorer, live requests/subscriptions/changelog, task and session management,... - [CLI](https://kahveciderin.github.io/covara/docs/tooling/cli.md): The covara CLI — scaffold projects, run a watch-and-auto-push dev loop, manage database profiles, push schema, browse/import/export data, and gener... - [Error handling](https://kahveciderin.github.io/covara/docs/tooling/error-handling.md): RFC 7807 Problem Details responses, the built-in error classes, status-aware logging, and the client TransportError with status-check helpers. - [Middleware](https://kahveciderin.github.io/covara/docs/tooling/middleware.md): Observability metrics and tracing, structured logging, API versioning, idempotency keys, and rate limiting — all standard Hono middleware applied g... - [Observability storage](https://kahveciderin.github.io/covara/docs/tooling/observability.md): Pluggable persistence for the admin audit log, request/error logs, and metrics — in-memory by default, KV-backed automatically, or bring your own d... - [OpenAPI](https://kahveciderin.github.io/covara/docs/tooling/openapi.md): Auto-generated OpenAPI 3.0 specs from your resources — endpoints, schemas from Drizzle columns, filter operators, ETag headers, security schemes, a... - [Tutorial: a real-time todo app](https://kahveciderin.github.io/covara/docs/tutorial.md): Build a complete real-time todo app with Covara — schema, auth, relations, search, file uploads, live aggregations, and a React client.