@baseplate-dev/plugin-auth 1.0.7 → 1.0.8

package/CHANGELOG.md

@@ -1,23 +1,273 @@
 # @baseplate-dev/plugin-auth
 
-## 1.0.7
+## 1.0.8
 
 ### Patch Changes
 
-- [#825](https://github.com/halfdomelabs/baseplate/pull/825) [`55be8d4`](https://github.com/halfdomelabs/baseplate/commit/55be8d4d2994ff56ff580ff847f5271c6e8cdb25) Thanks [@kingston](https://github.com/kingston)! - Migrate from gql.tada to graphql-code-generator with client-preset
+- [#985](https://github.com/halfdomelabs/baseplate/pull/985) [`2ec1006`](https://github.com/halfdomelabs/baseplate/commit/2ec1006a5327ec48b5b1319e85d87f0885dddc95) Thanks [@kingston](https://github.com/kingston)! - Backend environment configuration is now exposed via a lazy `getConfig()` (plus an `isDevelopment()` helper) instead of a module-scope `config` constant, so backend modules can be imported by tooling and tests without a fully configured environment, and invalid configuration now fails with a readable list of the offending variables.
 
-- Updated dependencies [[`1115ba0`](https://github.com/halfdomelabs/baseplate/commit/1115ba082d2288db9f233c459dde3f32b890ff67), [`69483b8`](https://github.com/halfdomelabs/baseplate/commit/69483b8b703a2b568f9dfcfc349046bf3a2bb948), [`c175429`](https://github.com/halfdomelabs/baseplate/commit/c175429101d8e902e178067785f2840cd22347cb), [`41b09d1`](https://github.com/halfdomelabs/baseplate/commit/41b09d1a95eacb1a29603ea61f60324dea94d1a9), [`fdd496d`](https://github.com/halfdomelabs/baseplate/commit/fdd496da00348cd56b329a50f60d94597e063045), [`28517d6`](https://github.com/halfdomelabs/baseplate/commit/28517d60059070943a3d1ebdb99d0a2fabbe30a7), [`168793d`](https://github.com/halfdomelabs/baseplate/commit/168793d958e001de2eb8bebed03c2b42397da701), [`34fc44e`](https://github.com/halfdomelabs/baseplate/commit/34fc44ec930c951c90edfbf2f658878a0cae8bb5), [`05b667f`](https://github.com/halfdomelabs/baseplate/commit/05b667fa0a21e78a6af3d553be1900f10e349c50), [`55be8d4`](https://github.com/halfdomelabs/baseplate/commit/55be8d4d2994ff56ff580ff847f5271c6e8cdb25), [`ad028b5`](https://github.com/halfdomelabs/baseplate/commit/ad028b5b840d5bf45f3597e95145b75b0e4eb2b7), [`d5e0b23`](https://github.com/halfdomelabs/baseplate/commit/d5e0b2397ce2aacacfd9663fb33d4176ec61ca61), [`d87bad9`](https://github.com/halfdomelabs/baseplate/commit/d87bad97614bb626598916efb073d05c469ec336)]:
+- [#983](https://github.com/halfdomelabs/baseplate/pull/983) [`f750e01`](https://github.com/halfdomelabs/baseplate/commit/f750e01aebbee8e826aa1fc259f56f43ce8793c2) Thanks [@kingston](https://github.com/kingston)! - Successful logins no longer count against the per-IP login rate limit, so users behind a shared IP are no longer locked out by ordinary repeated logins.
+
+- Updated dependencies [[`4c9acc4`](https://github.com/halfdomelabs/baseplate/commit/4c9acc48cc5b62aa3a642aef2ef3ed6d22fd2017), [`425d568`](https://github.com/halfdomelabs/baseplate/commit/425d568b1c98487b283fea7a65c429babc993da6), [`2ec1006`](https://github.com/halfdomelabs/baseplate/commit/2ec1006a5327ec48b5b1319e85d87f0885dddc95), [`3785e88`](https://github.com/halfdomelabs/baseplate/commit/3785e88c3cdc2ae3160a1b266f5f5695d1292a13), [`99fec21`](https://github.com/halfdomelabs/baseplate/commit/99fec214709952d17fb804832866d4bdc6bcc363), [`cc8dff2`](https://github.com/halfdomelabs/baseplate/commit/cc8dff2511ee87947b84401d2d9f37ba9cfa263b), [`eb22c19`](https://github.com/halfdomelabs/baseplate/commit/eb22c1994fa9e369b5b7b79b6394550889dd99b8), [`eb22c19`](https://github.com/halfdomelabs/baseplate/commit/eb22c1994fa9e369b5b7b79b6394550889dd99b8), [`3e3cf59`](https://github.com/halfdomelabs/baseplate/commit/3e3cf5967aadb12d473e509a5f225bbdaa79dc0e), [`380a4e2`](https://github.com/halfdomelabs/baseplate/commit/380a4e25f097f867e679b30993b5cb62ca8e8c79)]:
   - @baseplate-dev/react-generators@1.0.0
-  - @baseplate-dev/ui-components@1.0.0
+  - @baseplate-dev/core-generators@1.0.0
   - @baseplate-dev/fastify-generators@1.0.0
-  - @baseplate-dev/project-builder-lib@1.0.0
-  - @baseplate-dev/plugin-queue@1.0.0
-  - @baseplate-dev/sync@1.0.0
   - @baseplate-dev/plugin-email@1.0.0
+  - @baseplate-dev/plugin-queue@1.0.0
+  - @baseplate-dev/ui-components@1.0.0
+  - @baseplate-dev/project-builder-lib@1.0.0
   - @baseplate-dev/plugin-rate-limit@1.0.0
-  - @baseplate-dev/core-generators@1.0.0
+  - @baseplate-dev/sync@1.0.0
   - @baseplate-dev/utils@1.0.0
 
+## 0.6.15
+
+### Patch Changes
+
+- [#962](https://github.com/halfdomelabs/baseplate/pull/962) [`615c8e1`](https://github.com/halfdomelabs/baseplate/commit/615c8e173cede3cfa0298b92d5b84999ffedce5b) Thanks [@kingston](https://github.com/kingston)! - Tightened handling of indexed access across the codebase, fixing latent cases where a missing array element or record entry could surface as an undefined value in a field typed as required, such as unmatched regular expression capture groups and parsed command strings.
+
+- [#967](https://github.com/halfdomelabs/baseplate/pull/967) [`8b2dfd7`](https://github.com/halfdomelabs/baseplate/commit/8b2dfd7aa799b51dfa02deeaf7592af8ea29ed7e) Thanks [@kingston](https://github.com/kingston)! - Fix login and change-password failing with an internal server error instead of an invalid credentials message when the account has no stored password, which affected logging in with an unrecognized email address and changing the password on accounts linked only to a social provider
+
+- [#964](https://github.com/halfdomelabs/baseplate/pull/964) [`fb42641`](https://github.com/halfdomelabs/baseplate/commit/fb42641e235085cca019992f8615c2b9be0fdacb) Thanks [@kingston](https://github.com/kingston)! - Fixed the initial user seed script occasionally failing because no name was supplied. The seed script now sets the initial user's name from a new `INITIAL_USER_NAME` seed environment variable, defaulting to "Admin" if not set.
+
+- Updated dependencies [[`403874a`](https://github.com/halfdomelabs/baseplate/commit/403874a10f67120eb36badc93920359cb267dcb5), [`615c8e1`](https://github.com/halfdomelabs/baseplate/commit/615c8e173cede3cfa0298b92d5b84999ffedce5b), [`8b2dfd7`](https://github.com/halfdomelabs/baseplate/commit/8b2dfd7aa799b51dfa02deeaf7592af8ea29ed7e), [`dac747d`](https://github.com/halfdomelabs/baseplate/commit/dac747d5085f82de33bc4cc66ef0709fc405cccd), [`4ed5ae3`](https://github.com/halfdomelabs/baseplate/commit/4ed5ae379ec7097d072612fa9c29738947b11334), [`05cfe52`](https://github.com/halfdomelabs/baseplate/commit/05cfe5202692c8f3f3876d2e1c994c267d18d622), [`3184ab4`](https://github.com/halfdomelabs/baseplate/commit/3184ab40137515c7c96249793ca882526055292d), [`615c8e1`](https://github.com/halfdomelabs/baseplate/commit/615c8e173cede3cfa0298b92d5b84999ffedce5b), [`9cdfaa9`](https://github.com/halfdomelabs/baseplate/commit/9cdfaa9e3702c8a569c5dac739877dc8330a8f73), [`9139686`](https://github.com/halfdomelabs/baseplate/commit/91396867ec7832068aa6a5d19d038dcd1f04ec5c), [`e12d469`](https://github.com/halfdomelabs/baseplate/commit/e12d4699363b6d8c24c060929bec7b117933c8c2), [`e12d469`](https://github.com/halfdomelabs/baseplate/commit/e12d4699363b6d8c24c060929bec7b117933c8c2), [`15f4f2c`](https://github.com/halfdomelabs/baseplate/commit/15f4f2c6742bdde2b6a5f0b5f5063e01a053123e)]:
+  - @baseplate-dev/fastify-generators@0.6.15
+  - @baseplate-dev/project-builder-lib@0.6.15
+  - @baseplate-dev/core-generators@0.6.15
+  - @baseplate-dev/plugin-email@0.6.15
+  - @baseplate-dev/plugin-queue@0.6.15
+  - @baseplate-dev/react-generators@0.6.15
+  - @baseplate-dev/sync@0.6.15
+  - @baseplate-dev/utils@0.6.15
+  - @baseplate-dev/plugin-rate-limit@0.6.15
+  - @baseplate-dev/ui-components@0.6.15
+
+## 0.6.14
+
+### Patch Changes
+
+- Updated dependencies [[`e7ee500`](https://github.com/halfdomelabs/baseplate/commit/e7ee500e5a2d78778bd3bdb79b4f2f40b5f040ef), [`e7ee500`](https://github.com/halfdomelabs/baseplate/commit/e7ee500e5a2d78778bd3bdb79b4f2f40b5f040ef), [`e7ee500`](https://github.com/halfdomelabs/baseplate/commit/e7ee500e5a2d78778bd3bdb79b4f2f40b5f040ef)]:
+  - @baseplate-dev/project-builder-lib@0.6.14
+  - @baseplate-dev/fastify-generators@0.6.14
+  - @baseplate-dev/plugin-email@0.6.14
+  - @baseplate-dev/plugin-queue@0.6.14
+  - @baseplate-dev/plugin-rate-limit@0.6.14
+  - @baseplate-dev/core-generators@0.6.14
+  - @baseplate-dev/react-generators@0.6.14
+  - @baseplate-dev/sync@0.6.14
+  - @baseplate-dev/ui-components@0.6.14
+  - @baseplate-dev/utils@0.6.14
+
+## 0.6.13
+
+### Patch Changes
+
+- [#950](https://github.com/halfdomelabs/baseplate/pull/950) [`9619580`](https://github.com/halfdomelabs/baseplate/commit/9619580e79c50556f649801bd9f04e4f7b221cc3) Thanks [@kingston](https://github.com/kingston)! - Generated backends now build a single app runtime composition root (`createAppRuntime()`) that constructs every application-scoped service — Redis, email, queues, storage, Stripe, pubsub, notifications, and auth sessions — once and disposes them together on shutdown, replacing the previous module-level singletons. Code reaches them through `ctx.services`, feature modules declare themselves with `defineAppModule()`, and `ServiceContext` splits into `ExecutionContext` (auth state) and `ServiceContext` (adds `services`), with `ServiceContextWith<K>`/`RequestServiceContextWith<K>` for narrowing a dependency to the services it actually uses. `createAppRuntime()` accepts an `overrides` map for supplying test doubles and a `backgroundServices` flag (default `false`) controlling whether the process runs queue supervision and scheduling, and `withScriptContext()` builds and safely disposes a runtime for one-off scripts and seeds.
+
+- [#950](https://github.com/halfdomelabs/baseplate/pull/950) [`9619580`](https://github.com/halfdomelabs/baseplate/commit/9619580e79c50556f649801bd9f04e4f7b221cc3) Thanks [@kingston](https://github.com/kingston)! - Refined the ESLint config for generated apps, and brought the internal monorepo configs in line with it. `eslint-plugin-unicorn` now uses its `unopinionated` preset while retaining `consistent-function-scoping`, `filename-case`, and `no-for-loop`, with `filename-case` applying to all generated apps rather than only React ones; `@typescript-eslint/switch-exhaustiveness-check` catches new union members silently falling into a generic `default` case; `react/prop-types` is disabled as redundant with TypeScript prop typing; `@typescript-eslint/explicit-function-return-type` no longer applies to React components (it remains load-bearing elsewhere) and `@typescript-eslint/prefer-destructuring` was removed. Unused ESLint disable directives and inline configs are now reported.
+
+- [#919](https://github.com/halfdomelabs/baseplate/pull/919) [`9548f2d`](https://github.com/halfdomelabs/baseplate/commit/9548f2d12af830e28187efed4b5a27d42020b289) Thanks [@kingston](https://github.com/kingston)! - Upgrade insecure dependencies flagged by pnpm audit. Generated projects now use axios 1.18.1 (was 1.16.1) and better-auth 1.6.23 (was 1.6.11), addressing multiple axios advisories (prototype pollution, DoS, proxy handling) and a stored XSS advisory in better-auth. Transitive dependencies (js-yaml, brace-expansion, protobufjs, esbuild, body-parser) were also updated to patched versions in the monorepo and example lockfiles.
+
+- [#927](https://github.com/halfdomelabs/baseplate/pull/927) [`0d3cd21`](https://github.com/halfdomelabs/baseplate/commit/0d3cd21bec022599977539f65fb2431d28574c83) Thanks [@kingston](https://github.com/kingston)! - Upgraded generated projects to TypeScript 6.0.3 (from 5.9.3), with typescript-eslint 8.65.0, `@vitest/eslint-plugin` 1.6.23, `eslint-plugin-perfectionist` 5.10.0, and `vitest-mock-extended` 3.1.1 for compatibility. Generated React apps now set `"types": ["node"]` in `tsconfig.app.json` and generated backends set `rootDir`/`types` in their `tsconfig.json`, since TypeScript 6 no longer implicitly includes `@types/node` globals for composite builds. Note that `@module-federation/vite` is pinned at exactly 1.17.0 — 1.17.1+ breaks the module federation shared-scope singleton for `zod`/`@baseplate-dev/project-builder-lib`, which left entity IDs unassigned when plugin-seeded models were merged into a new project during setup.
+
+- Updated dependencies [[`becf3c5`](https://github.com/halfdomelabs/baseplate/commit/becf3c52b87a775c3a988995385b174e42c0b9e4), [`9619580`](https://github.com/halfdomelabs/baseplate/commit/9619580e79c50556f649801bd9f04e4f7b221cc3), [`80c1474`](https://github.com/halfdomelabs/baseplate/commit/80c1474f8903f0609f8d7484b0d0be8b59d4f6c0), [`ed5d784`](https://github.com/halfdomelabs/baseplate/commit/ed5d784a0edb2f794ae723ba3fb46a3768cade4c), [`45886a6`](https://github.com/halfdomelabs/baseplate/commit/45886a6fc3ac02f37bf19a3dae45d38186c9ad8a), [`9619580`](https://github.com/halfdomelabs/baseplate/commit/9619580e79c50556f649801bd9f04e4f7b221cc3), [`9619580`](https://github.com/halfdomelabs/baseplate/commit/9619580e79c50556f649801bd9f04e4f7b221cc3), [`03cc94e`](https://github.com/halfdomelabs/baseplate/commit/03cc94e0308d441404b4e84457e678b4d19c47b8), [`9619580`](https://github.com/halfdomelabs/baseplate/commit/9619580e79c50556f649801bd9f04e4f7b221cc3), [`4819cfa`](https://github.com/halfdomelabs/baseplate/commit/4819cfad49158dec8eec05fc9d9b0025e7a81434), [`f596b4b`](https://github.com/halfdomelabs/baseplate/commit/f596b4b43bd9f0ecb7d5379739b0e36a01c40c70), [`307ed48`](https://github.com/halfdomelabs/baseplate/commit/307ed48144da1dab378c8b21e8cdbbe592fc3c48), [`cd8465e`](https://github.com/halfdomelabs/baseplate/commit/cd8465ec84b69241ee4e9a53d5131cd9bfe0b39f), [`ed5d784`](https://github.com/halfdomelabs/baseplate/commit/ed5d784a0edb2f794ae723ba3fb46a3768cade4c), [`80b7a20`](https://github.com/halfdomelabs/baseplate/commit/80b7a2090a06e5f729a798a7750ea126c8f27a8c), [`d0f8726`](https://github.com/halfdomelabs/baseplate/commit/d0f87265f16bfbde6c1525b0655850e906a7c3ed), [`47765e5`](https://github.com/halfdomelabs/baseplate/commit/47765e58ebd1979f94f0b1889efe539bcfe3e7f1), [`80c1474`](https://github.com/halfdomelabs/baseplate/commit/80c1474f8903f0609f8d7484b0d0be8b59d4f6c0), [`9548f2d`](https://github.com/halfdomelabs/baseplate/commit/9548f2d12af830e28187efed4b5a27d42020b289), [`e89c814`](https://github.com/halfdomelabs/baseplate/commit/e89c8143a7a4ea45817a45544fba6bf0ba6fe758), [`9030d45`](https://github.com/halfdomelabs/baseplate/commit/9030d45cd00ff8e3b9ea20744499457e25b0fbf4), [`0d3cd21`](https://github.com/halfdomelabs/baseplate/commit/0d3cd21bec022599977539f65fb2431d28574c83), [`13b78ca`](https://github.com/halfdomelabs/baseplate/commit/13b78caae04ad84441ca48d98a0b9e17135485d9)]:
+  - @baseplate-dev/react-generators@0.6.13
+  - @baseplate-dev/fastify-generators@0.6.13
+  - @baseplate-dev/plugin-email@0.6.13
+  - @baseplate-dev/plugin-queue@0.6.13
+  - @baseplate-dev/utils@0.6.13
+  - @baseplate-dev/core-generators@0.6.13
+  - @baseplate-dev/project-builder-lib@0.6.13
+  - @baseplate-dev/ui-components@0.6.13
+  - @baseplate-dev/plugin-rate-limit@0.6.13
+  - @baseplate-dev/sync@0.6.13
+
+## 0.6.12
+
+### Patch Changes
+
+- Updated dependencies [[`0620a2b`](https://github.com/halfdomelabs/baseplate/commit/0620a2b2a59a4b401a9d9268f596776f4da09a9b), [`0620a2b`](https://github.com/halfdomelabs/baseplate/commit/0620a2b2a59a4b401a9d9268f596776f4da09a9b), [`0620a2b`](https://github.com/halfdomelabs/baseplate/commit/0620a2b2a59a4b401a9d9268f596776f4da09a9b), [`3f925ff`](https://github.com/halfdomelabs/baseplate/commit/3f925ff4e22fde6c76f7c8b471fac044ed0a82b3), [`0620a2b`](https://github.com/halfdomelabs/baseplate/commit/0620a2b2a59a4b401a9d9268f596776f4da09a9b), [`0620a2b`](https://github.com/halfdomelabs/baseplate/commit/0620a2b2a59a4b401a9d9268f596776f4da09a9b), [`65a1b96`](https://github.com/halfdomelabs/baseplate/commit/65a1b969e7900b935800d111c23b3af70a660514)]:
+  - @baseplate-dev/fastify-generators@0.6.12
+  - @baseplate-dev/core-generators@0.6.12
+  - @baseplate-dev/react-generators@0.6.12
+  - @baseplate-dev/project-builder-lib@0.6.12
+  - @baseplate-dev/plugin-email@0.6.12
+  - @baseplate-dev/plugin-queue@0.6.12
+  - @baseplate-dev/plugin-rate-limit@0.6.12
+  - @baseplate-dev/sync@0.6.12
+  - @baseplate-dev/ui-components@0.6.12
+  - @baseplate-dev/utils@0.6.12
+
+## 0.6.11
+
+### Patch Changes
+
+- Updated dependencies [[`cc296f4`](https://github.com/halfdomelabs/baseplate/commit/cc296f4737d0462f3536dda27ae9eb297f799b8b), [`05e7b98`](https://github.com/halfdomelabs/baseplate/commit/05e7b98c84069284976b33dfc3426a71a5b9bc64)]:
+  - @baseplate-dev/core-generators@0.6.11
+  - @baseplate-dev/project-builder-lib@0.6.11
+  - @baseplate-dev/react-generators@0.6.11
+  - @baseplate-dev/fastify-generators@0.6.11
+  - @baseplate-dev/sync@0.6.11
+  - @baseplate-dev/ui-components@0.6.11
+  - @baseplate-dev/utils@0.6.11
+  - @baseplate-dev/plugin-email@0.6.11
+  - @baseplate-dev/plugin-queue@0.6.11
+  - @baseplate-dev/plugin-rate-limit@0.6.11
+
+## 0.6.10
+
+### Patch Changes
+
+- [#886](https://github.com/halfdomelabs/baseplate/pull/886) [`30765f0`](https://github.com/halfdomelabs/baseplate/commit/30765f079c46019d9c91fb96f1b3c399b4dc8759) Thanks [@kingston](https://github.com/kingston)! - Migrate from @originjs/vite-plugin-federation to @module-federation/vite for active maintenance and Vite 7+ peer-range support. As part of this, `@baseplate-dev/project-builder-lib` and `@baseplate-dev/ui-components` now declare `react`, `react-dom`, `zod` (and `@baseplate-dev/ui-components` from project-builder-lib) as peer dependencies — these were already required by consumers but are now explicit, so the federation runtime can dedupe them across host and remotes.
+
+- [#888](https://github.com/halfdomelabs/baseplate/pull/888) [`f9fe0c2`](https://github.com/halfdomelabs/baseplate/commit/f9fe0c20f16bf3495129aa859340dd689500cc1e) Thanks [@kingston](https://github.com/kingston)! - Upgrade better-auth and turbo to their latest versions
+  - better-auth: 1.4.19 → 1.6.11 (injected into generated projects)
+  - turbo: 2.9.0 → 2.9.15 (monorepo dev dependency and generated project version)
+
+- Updated dependencies [[`f5ad6d2`](https://github.com/halfdomelabs/baseplate/commit/f5ad6d2ff994ecdd03f790b7e5c0915ddc7660c5), [`db93095`](https://github.com/halfdomelabs/baseplate/commit/db93095c6a9846d1e583832b70b85898ae785b10), [`ffe0818`](https://github.com/halfdomelabs/baseplate/commit/ffe081872b7c99124243e3bb04e73c7b5ddd0f7e), [`30765f0`](https://github.com/halfdomelabs/baseplate/commit/30765f079c46019d9c91fb96f1b3c399b4dc8759), [`4b38b79`](https://github.com/halfdomelabs/baseplate/commit/4b38b79282a32414c688b1f6212b88c0c75d413d), [`58d7c6b`](https://github.com/halfdomelabs/baseplate/commit/58d7c6bc433021e543e65817bf75582654ad4d42), [`4b38b79`](https://github.com/halfdomelabs/baseplate/commit/4b38b79282a32414c688b1f6212b88c0c75d413d), [`0afcb97`](https://github.com/halfdomelabs/baseplate/commit/0afcb979943a6f4f571c56af5e73936ed9d40370), [`62df439`](https://github.com/halfdomelabs/baseplate/commit/62df43917263034e621f29fb261d2b93ca9edf23), [`e8da347`](https://github.com/halfdomelabs/baseplate/commit/e8da347b3bd799b31c5d04d1317dedaa8c14e412), [`f9fe0c2`](https://github.com/halfdomelabs/baseplate/commit/f9fe0c20f16bf3495129aa859340dd689500cc1e), [`0c44597`](https://github.com/halfdomelabs/baseplate/commit/0c445971b18d50300c50c8bfb414967df9170c83), [`f5ad6d2`](https://github.com/halfdomelabs/baseplate/commit/f5ad6d2ff994ecdd03f790b7e5c0915ddc7660c5), [`f9fe0c2`](https://github.com/halfdomelabs/baseplate/commit/f9fe0c20f16bf3495129aa859340dd689500cc1e), [`f5ad6d2`](https://github.com/halfdomelabs/baseplate/commit/f5ad6d2ff994ecdd03f790b7e5c0915ddc7660c5), [`62df439`](https://github.com/halfdomelabs/baseplate/commit/62df43917263034e621f29fb261d2b93ca9edf23), [`c1e8765`](https://github.com/halfdomelabs/baseplate/commit/c1e8765fb3b59f56db4bc393e7469a54332c94b8)]:
+  - @baseplate-dev/sync@0.6.10
+  - @baseplate-dev/core-generators@0.6.10
+  - @baseplate-dev/react-generators@0.6.10
+  - @baseplate-dev/project-builder-lib@0.6.10
+  - @baseplate-dev/fastify-generators@0.6.10
+  - @baseplate-dev/plugin-email@0.6.10
+  - @baseplate-dev/ui-components@0.6.10
+  - @baseplate-dev/plugin-queue@0.6.10
+  - @baseplate-dev/plugin-rate-limit@0.6.10
+  - @baseplate-dev/utils@0.6.10
+
+## 0.6.9
+
+### Patch Changes
+
+- Updated dependencies [[`7677630`](https://github.com/halfdomelabs/baseplate/commit/7677630f1e445e2c8c8c56b70435d12b0242affb)]:
+  - @baseplate-dev/core-generators@0.6.9
+  - @baseplate-dev/fastify-generators@0.6.9
+  - @baseplate-dev/react-generators@0.6.9
+  - @baseplate-dev/plugin-email@0.6.9
+  - @baseplate-dev/plugin-queue@0.6.9
+  - @baseplate-dev/plugin-rate-limit@0.6.9
+  - @baseplate-dev/project-builder-lib@0.6.9
+  - @baseplate-dev/sync@0.6.9
+  - @baseplate-dev/ui-components@0.6.9
+  - @baseplate-dev/utils@0.6.9
+
+## 0.6.8
+
+### Patch Changes
+
+- Updated dependencies [[`04006df`](https://github.com/halfdomelabs/baseplate/commit/04006df7b2c9d124c83264d40aaeaa2a71558035), [`04006df`](https://github.com/halfdomelabs/baseplate/commit/04006df7b2c9d124c83264d40aaeaa2a71558035), [`f9cecc1`](https://github.com/halfdomelabs/baseplate/commit/f9cecc1c72d455aa5952c03c94182cb935b3b3dc), [`b231bca`](https://github.com/halfdomelabs/baseplate/commit/b231bcace5bd8395fe1cc92b2cb319302023342b)]:
+  - @baseplate-dev/react-generators@0.6.8
+  - @baseplate-dev/ui-components@0.6.8
+  - @baseplate-dev/core-generators@0.6.8
+  - @baseplate-dev/plugin-email@0.6.8
+  - @baseplate-dev/project-builder-lib@0.6.8
+  - @baseplate-dev/plugin-queue@0.6.8
+  - @baseplate-dev/plugin-rate-limit@0.6.8
+  - @baseplate-dev/fastify-generators@0.6.8
+  - @baseplate-dev/sync@0.6.8
+  - @baseplate-dev/utils@0.6.8
+
+## 0.6.7
+
+### Patch Changes
+
+- [#877](https://github.com/halfdomelabs/baseplate/pull/877) [`0527c02`](https://github.com/halfdomelabs/baseplate/commit/0527c02fc9cc08363a93ff640345680ef832cd30) Thanks [@kingston](https://github.com/kingston)! - Reduce password rate limit aggressiveness (15 attempts/hour for IP, 10 consecutive fails/hour), reset login rate limits after successful password reset, and improve error messages to suggest password reset when rate limited
+
+- Updated dependencies [[`2d39358`](https://github.com/halfdomelabs/baseplate/commit/2d39358510f73073a80ac78c3c7433a3aac2f0cd), [`335e063`](https://github.com/halfdomelabs/baseplate/commit/335e063b85676c9a55635ade6cf9b7b38bdd431d), [`c3a6719`](https://github.com/halfdomelabs/baseplate/commit/c3a67191d9a456d7440728f43f34cd02d28ffd12), [`2d39358`](https://github.com/halfdomelabs/baseplate/commit/2d39358510f73073a80ac78c3c7433a3aac2f0cd), [`2d39358`](https://github.com/halfdomelabs/baseplate/commit/2d39358510f73073a80ac78c3c7433a3aac2f0cd), [`7031c74`](https://github.com/halfdomelabs/baseplate/commit/7031c74af6a0ee74007a2b3cce30c738cff36e6a)]:
+  - @baseplate-dev/core-generators@0.6.7
+  - @baseplate-dev/ui-components@0.6.7
+  - @baseplate-dev/fastify-generators@0.6.7
+  - @baseplate-dev/react-generators@0.6.7
+  - @baseplate-dev/plugin-email@0.6.7
+  - @baseplate-dev/plugin-queue@0.6.7
+  - @baseplate-dev/plugin-rate-limit@0.6.7
+  - @baseplate-dev/project-builder-lib@0.6.7
+  - @baseplate-dev/sync@0.6.7
+  - @baseplate-dev/utils@0.6.7
+
+## 0.6.6
+
+### Patch Changes
+
+- Updated dependencies [[`7cffc85`](https://github.com/halfdomelabs/baseplate/commit/7cffc85dfc2e9dc3ca6e1f243aeb874d2a1c5b13)]:
+  - @baseplate-dev/fastify-generators@0.6.6
+  - @baseplate-dev/plugin-email@0.6.6
+  - @baseplate-dev/plugin-queue@0.6.6
+  - @baseplate-dev/plugin-rate-limit@0.6.6
+  - @baseplate-dev/core-generators@0.6.6
+  - @baseplate-dev/project-builder-lib@0.6.6
+  - @baseplate-dev/react-generators@0.6.6
+  - @baseplate-dev/sync@0.6.6
+  - @baseplate-dev/ui-components@0.6.6
+  - @baseplate-dev/utils@0.6.6
+
+## 0.6.5
+
+### Patch Changes
+
+- [#834](https://github.com/halfdomelabs/baseplate/pull/834) [`37b6d8f`](https://github.com/halfdomelabs/baseplate/commit/37b6d8fd76086dab2953e12e48543334c5056f15) Thanks [@kingston](https://github.com/kingston)! - Add `accountsFeatureRef` field to auth plugin, separating user data models (User, UserAccount, UserRole, UserSession, AuthVerification) from auth infrastructure code. Defaults to a new `accounts` feature alongside the existing `auth` feature. Includes schema migration 029 to backfill existing projects.
+
+- [#863](https://github.com/halfdomelabs/baseplate/pull/863) [`eec498b`](https://github.com/halfdomelabs/baseplate/commit/eec498b152c79402b7370dda990d01602c9a5fee) Thanks [@kingston](https://github.com/kingston)! - Add authorization rules to the User model's email field in both Better Auth and Placeholder Auth plugins, restricting email visibility to admins and the user themselves (via a new "self" instance role)
+
+- [#869](https://github.com/halfdomelabs/baseplate/pull/869) [`860b82d`](https://github.com/halfdomelabs/baseplate/commit/860b82da0466386ad11128c619595179ee76d0a4) Thanks [@kingston](https://github.com/kingston)! - Use UUIDv4 (gen_random_uuid) instead of UUIDv7 for AuthVerification/Verification model IDs, since these are short-lived security tokens where timestamp leakage is undesirable and sortability provides no benefit
+
+- [#844](https://github.com/halfdomelabs/baseplate/pull/844) [`06f5173`](https://github.com/halfdomelabs/baseplate/commit/06f517371c4904482873a4e30fe9b23b4fd2e36d) Thanks [@kingston](https://github.com/kingston)! - Improve better-auth feature parity with local-auth by adding password/email flows, admin mutations, frontend auth pages, seed user generator, and admin role. Also updates role flags, refines admin role handling, enhances auth UI, and adds project migration.
+
+- [#851](https://github.com/halfdomelabs/baseplate/pull/851) [`53b8635`](https://github.com/halfdomelabs/baseplate/commit/53b86354ee6bc4b46d1966f657e3d6c942cf1eb1) Thanks [@kingston](https://github.com/kingston)! - Add plugin dependency support: plugins can declare `pluginDependencies` in plugin.json to require other plugins. Includes circular dependency detection via toposort, definition issue checking that blocks save for unmet dependencies, UI gating that prompts users to enable/configure dependencies before enabling a plugin, and implementation plugin validation. Added dependency declarations to local-auth (email, queue, rate-limit), email (queue), and storage (queue).
+
+- [#834](https://github.com/halfdomelabs/baseplate/pull/834) [`37b6d8f`](https://github.com/halfdomelabs/baseplate/commit/37b6d8fd76086dab2953e12e48543334c5056f15) Thanks [@kingston](https://github.com/kingston)! - Register definition issue checkers for plugin schema validation so model drift errors surface globally in the issues panel, not just on plugin settings pages
+
+- [#865](https://github.com/halfdomelabs/baseplate/pull/865) [`c7131f5`](https://github.com/halfdomelabs/baseplate/commit/c7131f5caebda203ece99d30fcf2d58ead3abdb8) Thanks [@kingston](https://github.com/kingston)! - Update plugin model definitions to use `defaultGeneration: 'uuidv7'` for UUID primary key fields
+
+- Updated dependencies [[`37b6d8f`](https://github.com/halfdomelabs/baseplate/commit/37b6d8fd76086dab2953e12e48543334c5056f15), [`860b82d`](https://github.com/halfdomelabs/baseplate/commit/860b82da0466386ad11128c619595179ee76d0a4), [`9708637`](https://github.com/halfdomelabs/baseplate/commit/97086370718861d2c3170ec6d83af84793fbd09e), [`9708637`](https://github.com/halfdomelabs/baseplate/commit/97086370718861d2c3170ec6d83af84793fbd09e), [`8dcf7b3`](https://github.com/halfdomelabs/baseplate/commit/8dcf7b3c909672487bad61b7a4465d1860092363), [`90ef6d5`](https://github.com/halfdomelabs/baseplate/commit/90ef6d51e0076834dd437d6854f90d391ccba3fb), [`06f5173`](https://github.com/halfdomelabs/baseplate/commit/06f517371c4904482873a4e30fe9b23b4fd2e36d), [`6c32220`](https://github.com/halfdomelabs/baseplate/commit/6c3222084aed198e3ab9ac2169443b3eb0e15359), [`c24a24a`](https://github.com/halfdomelabs/baseplate/commit/c24a24ac9d2b66623acb0fda9c6ff2b3b80c0a6d), [`9688ca3`](https://github.com/halfdomelabs/baseplate/commit/9688ca348fd995a228bff597069f58644d7e9459), [`71146cd`](https://github.com/halfdomelabs/baseplate/commit/71146cd1ab784f45e4409fef7e6e447750047e48), [`fc8f158`](https://github.com/halfdomelabs/baseplate/commit/fc8f1582f1702d2d6f6eaa60607da7bb777750b5), [`5e182c3`](https://github.com/halfdomelabs/baseplate/commit/5e182c308c51b8d6f735b213ae12ba475c34dbd2), [`0ba6744`](https://github.com/halfdomelabs/baseplate/commit/0ba67445708689622341f3031502b3308f71f68e), [`53b8635`](https://github.com/halfdomelabs/baseplate/commit/53b86354ee6bc4b46d1966f657e3d6c942cf1eb1), [`37b6d8f`](https://github.com/halfdomelabs/baseplate/commit/37b6d8fd76086dab2953e12e48543334c5056f15), [`85d957d`](https://github.com/halfdomelabs/baseplate/commit/85d957d4a2ab4b3a55a96c8dbba9a79d2f72511c), [`8d30c14`](https://github.com/halfdomelabs/baseplate/commit/8d30c145ce5d72dcfc038ff076ed0746d2d763cc), [`ed5d250`](https://github.com/halfdomelabs/baseplate/commit/ed5d250146f0b48386a8208741150f9011892a35), [`efcf233`](https://github.com/halfdomelabs/baseplate/commit/efcf2338c018ad46b08e8fef3994630dea511723), [`2a514a6`](https://github.com/halfdomelabs/baseplate/commit/2a514a63e741e1b16b3b1b168b84a60965141887), [`497904a`](https://github.com/halfdomelabs/baseplate/commit/497904a9b5088171f95c5e16bcda542fb5e98610), [`87a2218`](https://github.com/halfdomelabs/baseplate/commit/87a2218266f957bb4beacd6b13cb3d610fd15a41), [`c7131f5`](https://github.com/halfdomelabs/baseplate/commit/c7131f5caebda203ece99d30fcf2d58ead3abdb8), [`adc5f55`](https://github.com/halfdomelabs/baseplate/commit/adc5f55dbf3a1451f4402cd6bd126e15f60b8ed8), [`c7131f5`](https://github.com/halfdomelabs/baseplate/commit/c7131f5caebda203ece99d30fcf2d58ead3abdb8), [`c7131f5`](https://github.com/halfdomelabs/baseplate/commit/c7131f5caebda203ece99d30fcf2d58ead3abdb8)]:
+  - @baseplate-dev/project-builder-lib@0.6.5
+  - @baseplate-dev/fastify-generators@0.6.5
+  - @baseplate-dev/utils@0.6.5
+  - @baseplate-dev/plugin-email@0.6.5
+  - @baseplate-dev/react-generators@0.6.5
+  - @baseplate-dev/ui-components@0.6.5
+  - @baseplate-dev/plugin-rate-limit@0.6.5
+  - @baseplate-dev/core-generators@0.6.5
+  - @baseplate-dev/plugin-queue@0.6.5
+  - @baseplate-dev/sync@0.6.5
+
+## 0.6.4
+
+### Patch Changes
+
+- [#836](https://github.com/halfdomelabs/baseplate/pull/836) [`9369fd4`](https://github.com/halfdomelabs/baseplate/commit/9369fd4e38f2eaf370ac37b8bca8f552845d0f9c) Thanks [@kingston](https://github.com/kingston)! - Add `requireNameOnRegistration` option to local auth plugin. When enabled, the registration form collects and requires a name field from users.
+
+- Updated dependencies [[`ba315aa`](https://github.com/halfdomelabs/baseplate/commit/ba315aaaec0e8842ec7fadb765b1fed5e3abda5a), [`ba315aa`](https://github.com/halfdomelabs/baseplate/commit/ba315aaaec0e8842ec7fadb765b1fed5e3abda5a), [`ba315aa`](https://github.com/halfdomelabs/baseplate/commit/ba315aaaec0e8842ec7fadb765b1fed5e3abda5a)]:
+  - @baseplate-dev/ui-components@0.6.4
+  - @baseplate-dev/project-builder-lib@0.6.4
+  - @baseplate-dev/plugin-rate-limit@0.6.4
+  - @baseplate-dev/plugin-email@0.6.4
+  - @baseplate-dev/plugin-queue@0.6.4
+  - @baseplate-dev/core-generators@0.6.4
+  - @baseplate-dev/fastify-generators@0.6.4
+  - @baseplate-dev/react-generators@0.6.4
+  - @baseplate-dev/sync@0.6.4
+  - @baseplate-dev/utils@0.6.4
+
+## 0.6.3
+
+### Patch Changes
+
+- [#835](https://github.com/halfdomelabs/baseplate/pull/835) [`8072019`](https://github.com/halfdomelabs/baseplate/commit/8072019942287ee35720520d08f517272510c931) Thanks [@kingston](https://github.com/kingston)! - Migrate from gql.tada to graphql-code-generator with client-preset
+
+- Updated dependencies [[`8072019`](https://github.com/halfdomelabs/baseplate/commit/8072019942287ee35720520d08f517272510c931), [`8072019`](https://github.com/halfdomelabs/baseplate/commit/8072019942287ee35720520d08f517272510c931), [`8072019`](https://github.com/halfdomelabs/baseplate/commit/8072019942287ee35720520d08f517272510c931), [`8072019`](https://github.com/halfdomelabs/baseplate/commit/8072019942287ee35720520d08f517272510c931), [`8072019`](https://github.com/halfdomelabs/baseplate/commit/8072019942287ee35720520d08f517272510c931), [`8072019`](https://github.com/halfdomelabs/baseplate/commit/8072019942287ee35720520d08f517272510c931), [`8072019`](https://github.com/halfdomelabs/baseplate/commit/8072019942287ee35720520d08f517272510c931), [`8072019`](https://github.com/halfdomelabs/baseplate/commit/8072019942287ee35720520d08f517272510c931), [`8072019`](https://github.com/halfdomelabs/baseplate/commit/8072019942287ee35720520d08f517272510c931), [`8072019`](https://github.com/halfdomelabs/baseplate/commit/8072019942287ee35720520d08f517272510c931), [`8072019`](https://github.com/halfdomelabs/baseplate/commit/8072019942287ee35720520d08f517272510c931), [`8072019`](https://github.com/halfdomelabs/baseplate/commit/8072019942287ee35720520d08f517272510c931), [`8072019`](https://github.com/halfdomelabs/baseplate/commit/8072019942287ee35720520d08f517272510c931)]:
+  - @baseplate-dev/react-generators@0.6.3
+  - @baseplate-dev/ui-components@0.6.3
+  - @baseplate-dev/fastify-generators@0.6.3
+  - @baseplate-dev/project-builder-lib@0.6.3
+  - @baseplate-dev/plugin-queue@0.6.3
+  - @baseplate-dev/sync@0.6.3
+  - @baseplate-dev/plugin-email@0.6.3
+  - @baseplate-dev/plugin-rate-limit@0.6.3
+  - @baseplate-dev/core-generators@0.6.3
+  - @baseplate-dev/utils@0.6.3
+
 ## 0.6.2
 
 ### Patch Changes

package/dist/auth/core/common.js

@@ -1,4 +1,5 @@
 import { authConfigSpec, createPluginModule, pluginConfigSpec, PluginUtils, } from '@baseplate-dev/project-builder-lib';
+import { AUTH_PLUGIN_CONFIG_MIGRATIONS } from './schema/migrations.js';
 import { createAuthPluginDefinitionSchema } from './schema/plugin-definition.js';
 export default createPluginModule({
     name: 'common',
@@ -8,14 +9,12 @@ export default createPluginModule({
     },
     initialize: ({ authConfig, pluginConfig }, { pluginKey }) => {
         pluginConfig.schemas.set(pluginKey, createAuthPluginDefinitionSchema);
+        pluginConfig.migrations.set(pluginKey, AUTH_PLUGIN_CONFIG_MIGRATIONS);
         authConfig.pluginKey.set(pluginKey);
         authConfig.getAuthConfig.set((definition) => {
             const pluginConfig = PluginUtils.configByKeyOrThrow(definition, pluginKey);
             return {
                 roles: pluginConfig.roles,
-                modelNames: {
-                    user: pluginConfig.authFeatureRef,
-                },
             };
         });
     },

package/dist/auth/core/components/auth-definition-editor.js

@@ -20,10 +20,15 @@ export function AuthDefinitionEditor({ definition: pluginMetadata, metadata, onS
         if (pluginMetadata?.config) {
             return pluginMetadata.config;
         }
-        const defaultAuthFeatureRef = FeatureUtils.getFeatureIdByNameOrDefault(definition, 'auth');
+        const defaultAuthFeatureRef = FeatureUtils.getFeatureIdByNameOrDefault(definition, 'accounts/auth');
+        const defaultAccountsFeatureRef = FeatureUtils.getFeatureIdByNameOrDefault(definition, 'accounts/users');
+        if (!defaultImplementation) {
+            throw new Error('No auth implementation plugins are available');
+        }
         return {
             implementationPluginKey: defaultImplementation.key,
             authFeatureRef: defaultAuthFeatureRef,
+            accountsFeatureRef: defaultAccountsFeatureRef,
             roles: createDefaultAuthRoles(),
         };
     }, [definition, pluginMetadata?.config, defaultImplementation]);
@@ -45,9 +50,11 @@ export function AuthDefinitionEditor({ definition: pluginMetadata, metadata, onS
     const navigate = useNavigate();
     const onSubmit = handleSubmit((data) => saveDefinitionWithFeedback((draftConfig) => {
         const featureRef = FeatureUtils.ensureFeatureByNameRecursively(draftConfig, data.authFeatureRef);
+        const accountsFeatureRef = FeatureUtils.ensureFeatureByNameRecursively(draftConfig, data.accountsFeatureRef);
         PluginUtils.setPluginConfig(draftConfig, metadata, {
             ...data,
             authFeatureRef: featureRef,
+            accountsFeatureRef,
         }, definitionContainer);
         // Make sure we disable other plugins that are not the selected implementation
         const otherPlugins = availableImplementations.filter((i) => i.key !== implementationPluginKey);
@@ -70,6 +77,6 @@ export function AuthDefinitionEditor({ definition: pluginMetadata, metadata, onS
                     '--action-bar-height': '52px',
                 }, children: _jsxs("form", { onSubmit: onSubmit, className: "auth:max-w-6xl auth:flex-1", children: [_jsxs("div", { className: "auth:pb-16", children: [!isSelectedImplementationActive &&
                                     selectedPlugin &&
-                                    !hasSelectedImplementationChanged && (_jsxs(Alert, { variant: "warning", children: [_jsx(AlertTitle, { children: "Implementation Provider Not Active" }), _jsx(AlertDescription, { children: _jsxs("p", { children: ["The selected implementation provider is not active. Please make sure", ' ', _jsx(Link, { to: selectedImplementationUrl, className: "auth:inline-block auth:font-medium", children: "configure the provider" }), ' ', "before syncing."] }) })] })), _jsxs(SectionList, { children: [_jsxs(SectionListSection, { children: [_jsxs(SectionListSectionHeader, { children: [_jsx(SectionListSectionTitle, { children: "General Settings" }), _jsx(SectionListSectionDescription, { children: "Configure the general settings for the auth plugin." })] }), _jsxs(SectionListSectionContent, { className: "auth:space-y-6", children: [_jsx(FeatureComboboxFieldController, { label: "Auth Feature Path", name: "authFeatureRef", control: control, canCreate: true, description: "Specify the feature path where auth functionality will be generated" }), _jsx(SelectFieldController, { label: "Authentication Provider", name: "implementationPluginKey", control: control, options: availableImplementations, renderItemLabel: (item) => (_jsxs("div", { className: "auth:flex auth:flex-col auth:gap-2", children: [_jsx("div", { className: "auth:text-sm auth:font-medium", children: item.displayName }), _jsx("div", { className: "auth:text-sm auth:text-muted-foreground", children: item.description })] })), getOptionLabel: (item) => item.displayName, getOptionValue: (item) => item.key, description: "The authentication provider to use for your project" })] })] }), _jsx(RoleEditorForm, { control: control })] })] }), _jsx(FormActionBar, { form: form, allowSaveWithoutDirty: !pluginMetadata })] }) })] }));
+                                    !hasSelectedImplementationChanged && (_jsxs(Alert, { variant: "warning", children: [_jsx(AlertTitle, { children: "Implementation Provider Not Active" }), _jsx(AlertDescription, { children: _jsxs("p", { children: ["The selected implementation provider is not active. Please make sure", ' ', _jsx(Link, { to: selectedImplementationUrl, className: "auth:inline-block auth:font-medium", children: "configure the provider" }), ' ', "before syncing."] }) })] })), _jsxs(SectionList, { children: [_jsxs(SectionListSection, { children: [_jsxs(SectionListSectionHeader, { children: [_jsx(SectionListSectionTitle, { children: "General Settings" }), _jsx(SectionListSectionDescription, { children: "Configure the general settings for the auth plugin." })] }), _jsxs(SectionListSectionContent, { className: "auth:space-y-6", children: [_jsx(FeatureComboboxFieldController, { label: "Auth Feature Path", name: "authFeatureRef", control: control, canCreate: true, description: "Specify the feature path where auth infrastructure will be generated" }), _jsx(FeatureComboboxFieldController, { label: "Accounts Feature Path", name: "accountsFeatureRef", control: control, canCreate: true, description: "Specify the feature path where user account models will be generated" }), _jsx(SelectFieldController, { label: "Authentication Provider", name: "implementationPluginKey", control: control, options: availableImplementations, renderItemLabel: (item) => (_jsxs("div", { className: "auth:flex auth:flex-col auth:gap-2", children: [_jsx("div", { className: "auth:text-sm auth:font-medium", children: item.displayName }), _jsx("div", { className: "auth:text-sm auth:text-muted-foreground", children: item.description })] })), getOptionLabel: (item) => item.displayName, getOptionValue: (item) => item.key, description: "The authentication provider to use for your project" })] })] }), _jsx(RoleEditorForm, { control: control })] })] }), _jsx(FormActionBar, { form: form, allowSaveWithoutDirty: !pluginMetadata })] }) })] }));
 }
 //# sourceMappingURL=auth-definition-editor.js.map

package/dist/auth/core/components/role-editor-form/role-editor-form.js

@@ -26,6 +26,8 @@ export function RoleEditorForm({ className, control, }) {
     }
     function handleDeleteRole(roleIdx) {
         const role = roles[roleIdx];
+        if (!role)
+            return;
         requestConfirm({
             title: 'Delete Role',
             content: `Are you sure you want to delete the role "${role.name}"?`,

package/dist/auth/core/node.js

@@ -21,6 +21,7 @@ export default createPluginModule({
                             name: r.name,
                             comment: r.comment,
                             builtIn: r.builtIn,
+                            autoAssigned: r.autoAssigned,
                         })),
                     }),
                     userSessionTypes: userSessionTypesGenerator({}),

package/dist/auth/core/schema/migrations.d.ts

@@ -0,0 +1,3 @@
+import type { PluginConfigMigration } from '@baseplate-dev/project-builder-lib';
+export declare const AUTH_PLUGIN_CONFIG_MIGRATIONS: PluginConfigMigration[];
+//# sourceMappingURL=migrations.d.ts.map

package/dist/auth/core/schema/migrations.js

@@ -0,0 +1,54 @@
+import { featureEntityType } from '@baseplate-dev/project-builder-lib';
+export const AUTH_PLUGIN_CONFIG_MIGRATIONS = [
+    {
+        name: 'add-accounts-feature-ref',
+        version: 1,
+        // Plugin migrations run on raw serialized JSON where withRef fields store
+        // feature NAME PATHS (e.g. "accounts/auth"), not IDs. Values must be set to
+        // names so deserialization can resolve them to feature IDs.
+        migrate: (config, projectDefinition) => {
+            const typedConfig = config;
+            const def = projectDefinition;
+            const features = def.features ?? [];
+            // Find or plan to create the three features needed for the new hierarchy:
+            //   accounts        (parent, no code)
+            //   accounts/auth   (auth infrastructure)
+            //   accounts/users  (user models)
+            const accountsFeature = features.find((f) => f.name === 'accounts' && !f.parentRef);
+            const accountsId = accountsFeature?.id ?? featureEntityType.generateNewId();
+            const accountsAuthFeature = features.find((f) => f.name === 'accounts/auth');
+            const accountsAuthId = accountsAuthFeature?.id ?? featureEntityType.generateNewId();
+            const accountsUsersFeature = features.find((f) => f.name === 'accounts/users');
+            const accountsUsersId = accountsUsersFeature?.id ?? featureEntityType.generateNewId();
+            return {
+                updatedConfig: {
+                    ...typedConfig,
+                    authFeatureRef: 'accounts/auth',
+                    accountsFeatureRef: 'accounts/users',
+                },
+                updateProjectDefinition: (draft) => {
+                    const draftDef = draft;
+                    draftDef.features ??= [];
+                    if (!accountsFeature) {
+                        draftDef.features.push({ id: accountsId, name: 'accounts' });
+                    }
+                    if (!accountsAuthFeature) {
+                        draftDef.features.push({
+                            id: accountsAuthId,
+                            name: 'accounts/auth',
+                            parentRef: 'accounts',
+                        });
+                    }
+                    if (!accountsUsersFeature) {
+                        draftDef.features.push({
+                            id: accountsUsersId,
+                            name: 'accounts/users',
+                            parentRef: 'accounts',
+                        });
+                    }
+                },
+            };
+        },
+    },
+];
+//# sourceMappingURL=migrations.js.map

package/dist/auth/core/schema/plugin-definition.d.ts

@@ -3,26 +3,31 @@ import { z } from 'zod';
 export declare const createAuthPluginDefinitionSchema: (context: import("@baseplate-dev/project-builder-lib").DefinitionSchemaParserContext) => z.ZodObject<{
     implementationPluginKey: z.ZodString;
     authFeatureRef: z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>;
+    accountsFeatureRef: z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>;
     roles: z.ZodArray<z.ZodType<{
         id: string;
         name: string;
         comment: string;
         builtIn: boolean;
+        autoAssigned: boolean;
     }, {
         id: string;
         name: string;
         comment: string;
         builtIn?: boolean | undefined;
+        autoAssigned?: boolean | undefined;
     }, z.core.$ZodTypeInternals<{
         id: string;
         name: string;
         comment: string;
         builtIn: boolean;
+        autoAssigned: boolean;
     }, {
         id: string;
         name: string;
         comment: string;
         builtIn?: boolean | undefined;
+        autoAssigned?: boolean | undefined;
     }>>>;
 }, z.core.$strip>;
 export type AuthPluginDefinition = def.InferOutput<typeof createAuthPluginDefinitionSchema>;

package/dist/auth/core/schema/plugin-definition.js

@@ -9,6 +9,10 @@ export const createAuthPluginDefinitionSchema = definitionSchema((ctx) => z.obje
         type: featureEntityType,
         onDelete: 'RESTRICT',
     }),
+    accountsFeatureRef: ctx.withRef({
+        type: featureEntityType,
+        onDelete: 'RESTRICT',
+    }),
     roles: createAuthRolesSchema(ctx),
 }));
 //# sourceMappingURL=plugin-definition.js.map

package/dist/auth/core/schema/roles/constants.js

@@ -4,16 +4,25 @@ export const AUTH_DEFAULT_ROLES = [
         name: 'public',
         comment: 'All users (including unauthenticated and authenticated users)',
         builtIn: true,
+        autoAssigned: true,
     },
     {
         name: 'user',
         comment: 'All authenticated users',
         builtIn: true,
+        autoAssigned: true,
     },
     {
         name: 'system',
         comment: 'System processes without a user context, e.g. background jobs',
         builtIn: true,
+        autoAssigned: true,
+    },
+    {
+        name: 'admin',
+        comment: 'Administrator with full access',
+        builtIn: true,
+        autoAssigned: false,
     },
 ];
 export function createDefaultAuthRoles() {

package/dist/auth/core/schema/roles/schema.d.ts

@@ -5,21 +5,25 @@ export declare const createAuthRoleSchema: (context: import("@baseplate-dev/proj
     name: string;
     comment: string;
     builtIn: boolean;
+    autoAssigned: boolean;
 }, {
     id: string;
     name: string;
     comment: string;
     builtIn?: boolean | undefined;
+    autoAssigned?: boolean | undefined;
 }, z.core.$ZodTypeInternals<{
     id: string;
     name: string;
     comment: string;
     builtIn: boolean;
+    autoAssigned: boolean;
 }, {
     id: string;
     name: string;
     comment: string;
     builtIn?: boolean | undefined;
+    autoAssigned?: boolean | undefined;
 }>>;
 /**
  * Defines the schema for a role.
@@ -35,20 +39,24 @@ export declare const createAuthRolesSchema: (context: import("@baseplate-dev/pro
     name: string;
     comment: string;
     builtIn: boolean;
+    autoAssigned: boolean;
 }, {
     id: string;
     name: string;
     comment: string;
     builtIn?: boolean | undefined;
+    autoAssigned?: boolean | undefined;
 }, z.core.$ZodTypeInternals<{
     id: string;
     name: string;
     comment: string;
     builtIn: boolean;
+    autoAssigned: boolean;
 }, {
     id: string;
     name: string;
     comment: string;
     builtIn?: boolean | undefined;
+    autoAssigned?: boolean | undefined;
 }>>>;
 //# sourceMappingURL=schema.d.ts.map

package/dist/auth/core/schema/roles/schema.js

@@ -6,6 +6,7 @@ export const createAuthRoleSchema = definitionSchema((ctx) => ctx.withEnt(z.obje
     name: z.string().min(1),
     comment: z.string().min(1),
     builtIn: z.boolean().default(false),
+    autoAssigned: z.boolean().default(false),
 }), { type: authRoleEntityType }));
 /**
  * Defines the schema for an array of roles ensuring that there are no duplicate