@nbt-dev/nbt 0.0.1 → 0.0.4

package/dist/nbt.js

@@ -3393,8 +3393,10 @@ var program = new Command();
 
 // src/nbt.ts
 var import_node_child_process2 = require("node:child_process");
+var net = __toESM(require("node:net"));
 var path3 = __toESM(require("node:path"));
 var fs2 = __toESM(require("node:fs"));
+var readline = __toESM(require("node:readline/promises"));
 
 // src/bundler.ts
 var import_esbuild = __toESM(require("esbuild"));
@@ -3423,9 +3425,11 @@ if (process.platform !== "linux" || process.arch !== "x64") {
   process.exit(1);
 }
 var VENDOR = path3.join(__dirname, "..", "vendor", "linux-x64");
-var CONTRACTS = path3.join(__dirname, "..", "contracts");
+var STDLIB = path3.join(__dirname, "..", "stdlib");
+var NBT_BIN = path3.join(VENDOR, "nbt");
+var CONSOLE_BIN = path3.join(VENDOR, "console");
 function nativeEnv() {
-  return { ...process.env, NBT_PLATFORM_CONTRACTS: CONTRACTS };
+  return { ...process.env };
 }
 function corsOriginsFromNbtJson() {
   let dir = process.cwd();
@@ -3456,17 +3460,10 @@ function consoleEnv() {
   return env;
 }
 function forwardToNative(argv2) {
-  let bin;
-  let args;
-  const isConsole = argv2[0] === "console";
-  if (isConsole) {
-    bin = path3.join(VENDOR, "console");
-    args = argv2.slice(1);
-  } else {
-    bin = path3.join(VENDOR, "nbt");
-    args = argv2;
-  }
+  const isConsole = consoleCommands.has(argv2[0]);
+  const bin = isConsole ? CONSOLE_BIN : NBT_BIN;
   const env = isConsole ? consoleEnv() : nativeEnv();
+  const nativeArgv = argv2[0] === "up" ? withProjectUpDefaults(argv2) : argv2;
   if (!fs2.existsSync(bin)) {
     console.error(
       `@nbt-dev/nbt: bundled binary not found at ${bin} (broken install?)`
@@ -3478,9 +3475,9 @@ function forwardToNative(argv2) {
   } catch (_) {
   }
   if (typeof process.execve === "function") {
-    process.execve(bin, [bin, ...args], env);
+    process.execve(bin, [bin, ...nativeArgv], env);
   }
-  const r = (0, import_node_child_process2.spawnSync)(bin, args, { stdio: "inherit", env });
+  const r = (0, import_node_child_process2.spawnSync)(bin, nativeArgv, { stdio: "inherit", env });
   if (r.error) {
     console.error(`@nbt-dev/nbt: failed to exec ${bin}: ${r.error.message}`);
     process.exit(1);
@@ -3489,17 +3486,340 @@ function forwardToNative(argv2) {
 }
 var program2 = new Command();
 program2.name("nbt").description("nbt CLI + console daemon for the nbt-dev console (linux/x64).");
-var NATIVE = [
-  ["init", "Scaffold a new project or cartridge"],
+var NBT = [
   ["install", "Install a cartridge on a live instance"],
   ["generate", "Generate a typed client from contracts"],
-  ["migrate", "Schema migration tooling (dev | deploy)"],
-  ["console", "Run / manage the console daemon"]
+  ["migrate", "Create migrations and deploy local cartridges"],
+  ["lsp", "Run the NBT language server over stdio (editors)"],
+  ["editor", "Install the NBT VS Code extension (editor install)"]
+];
+var CONSOLE = [
+  ["up", "Boot the console daemon"],
+  ["gen-cluster-key", "Generate a cluster signing key (copy to every node)"]
 ];
-for (const [name, summary] of NATIVE) {
+var consoleCommands = new Set(CONSOLE.map(([n]) => n));
+for (const [name, summary] of [...NBT, ...CONSOLE]) {
   program2.command(name).description(`${summary} (native)`);
 }
 var customCommands = /* @__PURE__ */ new Set();
+customCommands.add("init");
+program2.command("init").description("Scaffold an nbt project (nbt.json, nbt/, generated/)").argument("[dir]", "directory to create the project in (default: current directory)").option("-y, --yes", "skip prompts; include the hello-world example").option("--no-example", "skip the hello-world example cartridge").action((dir, opts) => {
+  runInit(dir, opts).catch((e) => {
+    console.error(`nbt init: ${e?.message ?? e}`);
+    process.exit(1);
+  });
+});
+var NBT_JSON_TEMPLATE = `{
+  "carts": "nbt",
+  "generated": "generated",
+  "environments": {
+    "dev": { "host": "127.0.0.1", "port": 8080 }
+  }
+}
+`;
+var HELLO_SCHEMA = `# A minimal entity. CRUD routes are generated automatically:
+#   GET    /api/hello/note        list
+#   POST   /api/hello/note        create
+#   GET    /api/hello/note/:id    get
+#   PUT    /api/hello/note/:id    update
+#   DELETE /api/hello/note/:id    delete
+entity Note {
+  id: ulid
+  createdAt: DateTime @default(now())
+  updatedAt: DateTime @updatedAt
+  title: string
+  body: string
+
+  @@index([title])
+}
+`;
+async function runInit(dir, opts) {
+  const root = dir ? path3.resolve(process.cwd(), dir) : process.cwd();
+  if (dir) fs2.mkdirSync(root, { recursive: true });
+  if (fs2.existsSync(path3.join(root, "nbt.json"))) {
+    throw new Error(`nbt.json already exists ${dir ? `in ${dir}` : "here"} \u2014 this is already an nbt project`);
+  }
+  if (!fs2.existsSync(path3.join(STDLIB, "auth", "schema.nbt"))) {
+    throw new Error("bundled auth cartridge is missing (broken install)");
+  }
+  if (fs2.existsSync(path3.join(root, "nbt", "auth"))) {
+    throw new Error("nbt/auth already exists; refusing to overwrite it during init");
+  }
+  fs2.writeFileSync(path3.join(root, "nbt.json"), NBT_JSON_TEMPLATE);
+  fs2.mkdirSync(path3.join(root, "nbt"), { recursive: true });
+  fs2.mkdirSync(path3.join(root, "generated"), { recursive: true });
+  addStandardCartridge("auth", path3.join(root, "nbt"), false);
+  console.log("Created project:");
+  console.log("  nbt.json    (dev environment configured)");
+  console.log("  nbt/auth/   (local core auth cartridge)");
+  console.log("  generated/  (typed client output \u2014 nbt generate)");
+  const example = opts.example !== false && (opts.yes === true || await wantExample());
+  if (example) {
+    scaffoldHelloCart(path3.join(root, "nbt", "hello"));
+    console.log("\nCreated example cartridge nbt/hello/ (entity Note).");
+    console.log("\nNext:");
+    if (dir) console.log(`  cd ${dir}`);
+    console.log("  nbt dev            # boot the console + live-reload on save");
+  } else {
+    if (dir) console.log(`
+Next: cd ${dir}, then run \`nbt dev\` or add a standard cartridge with \`nbt add <name>\`.`);
+    else console.log("\nNext: run `nbt dev`, or add another standard cartridge with `nbt add <name>`.");
+  }
+}
+async function wantExample() {
+  if (!process.stdin.isTTY) return true;
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    const ans = (await rl.question("Add a hello-world example cartridge? [Y/n] ")).trim().toLowerCase();
+    return ans === "" || ans === "y" || ans === "yes";
+  } finally {
+    rl.close();
+  }
+}
+function scaffoldHelloCart(dir) {
+  fs2.mkdirSync(path3.join(dir, "migrations"), { recursive: true });
+  fs2.writeFileSync(path3.join(dir, "schema.nbt"), HELLO_SCHEMA);
+}
+customCommands.add("add");
+program2.command("add").description("Vendor standard-library cartridges into this project").argument("<cartridge...>", "standard cartridge name(s)").option("--overwrite", "replace an existing local cartridge").action((cartridges, opts) => {
+  try {
+    const proj = loadNbtProject();
+    for (const name of cartridges) {
+      const dest = addStandardCartridge(name, proj.cartsDir, opts.overwrite === true);
+      console.log(`Added ${name} -> ${path3.relative(proj.rootDir, dest)}`);
+    }
+    console.log("Run `nbt migrate deploy` to deploy the local cartridge set.");
+  } catch (e) {
+    console.error(`nbt add: ${e?.message ?? e}`);
+    process.exit(1);
+  }
+});
+function addStandardCartridge(name, cartsDir, overwrite) {
+  if (!/^[a-z0-9][a-z0-9_-]*$/.test(name)) {
+    throw new Error(`invalid cartridge name '${name}'`);
+  }
+  const src = path3.join(STDLIB, name);
+  if (!fs2.existsSync(path3.join(src, "schema.nbt"))) {
+    const available = fs2.existsSync(STDLIB) ? fs2.readdirSync(STDLIB, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name).sort().join(", ") : "";
+    throw new Error(
+      `unknown standard cartridge '${name}'${available ? ` (available: ${available})` : " (broken install: stdlib missing)"}`
+    );
+  }
+  const dest = path3.join(cartsDir, name);
+  if (fs2.existsSync(dest)) {
+    if (!overwrite) throw new Error(`${dest} already exists; use --overwrite to replace it`);
+    fs2.rmSync(dest, { recursive: true, force: true });
+  }
+  fs2.mkdirSync(cartsDir, { recursive: true });
+  fs2.cpSync(src, dest, { recursive: true });
+  return dest;
+}
+customCommands.add("list");
+program2.command("list").description("List available standard-library modules").action(() => {
+  if (!fs2.existsSync(STDLIB)) {
+    console.error("nbt list: bundled stdlib missing (broken install)");
+    process.exit(1);
+  }
+  const proj = loadNbtProject();
+  const names = fs2.readdirSync(STDLIB, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name).filter((n) => fs2.existsSync(path3.join(STDLIB, n, "schema.nbt"))).sort();
+  for (const n of names) {
+    const installed = fs2.existsSync(path3.join(proj.cartsDir, n, "schema.nbt"));
+    console.log(installed ? `${n} (installed)` : n);
+  }
+});
+customCommands.add("update");
+program2.command("update").description("Update vendored standard-library modules from the bundled stdlib").argument("<module...>", "standard module name(s)").action((modules) => {
+  try {
+    const proj = loadNbtProject();
+    for (const name of modules) {
+      const src = path3.join(STDLIB, name);
+      if (!fs2.existsSync(path3.join(src, "schema.nbt"))) {
+        throw new Error(`unknown standard module '${name}' (see: nbt list)`);
+      }
+      const dest = path3.join(proj.cartsDir, name);
+      if (!fs2.existsSync(path3.join(dest, "schema.nbt"))) {
+        throw new Error(`'${name}' is not installed in this project \u2014 run: nbt add ${name}`);
+      }
+      const written = copyStdlibOver(src, dest);
+      for (const f of written) console.log(`  wrote ${path3.relative(proj.rootDir, f)}`);
+      console.log(`Updated ${name}.`);
+    }
+    console.log("Run `nbt migrate create <module>` to capture any schema changes, then `nbt migrate deploy`.");
+  } catch (e) {
+    console.error(`nbt update: ${e?.message ?? e}`);
+    process.exit(1);
+  }
+});
+function copyStdlibOver(src, dest) {
+  const written = [];
+  const walk = (s, d) => {
+    fs2.mkdirSync(d, { recursive: true });
+    for (const e of fs2.readdirSync(s, { withFileTypes: true })) {
+      const sp = path3.join(s, e.name);
+      const dp = path3.join(d, e.name);
+      if (e.isDirectory()) walk(sp, dp);
+      else {
+        fs2.copyFileSync(sp, dp);
+        written.push(dp);
+      }
+    }
+  };
+  walk(src, dest);
+  return written;
+}
+customCommands.add("dev");
+program2.command("dev").description("Boot the console and live-reload local carts on .nbt change").option("-p, --port <port>", "console HTTP port (default: nbt.json dev env, else 8080)").option("-d, --data-dir <dir>", "console data dir (default: ./data)").action((opts) => {
+  runDev(opts).catch((e) => {
+    console.error(`nbt dev: ${e?.message ?? e}`);
+    process.exit(1);
+  });
+});
+function loadNbtProject() {
+  let dir = process.cwd();
+  for (let i = 0; i < 32; i++) {
+    const candidate = path3.join(dir, "nbt.json");
+    if (fs2.existsSync(candidate)) {
+      try {
+        const cfg = JSON.parse(fs2.readFileSync(candidate, "utf8"));
+        const carts = typeof cfg?.carts === "string" ? cfg.carts : "nbt";
+        const port = Number(cfg?.environments?.dev?.port) || 8080;
+        return { rootDir: dir, cartsDir: path3.resolve(dir, carts), port };
+      } catch {
+        break;
+      }
+    }
+    const parent = path3.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return { rootDir: process.cwd(), cartsDir: path3.resolve(process.cwd(), "nbt"), port: 8080 };
+}
+function withProjectUpDefaults(argv2) {
+  const hasPort = argv2.some((arg) => arg === "--port" || arg === "-p" || arg.startsWith("--port="));
+  if (hasPort) return argv2;
+  return [...argv2, "--port", String(loadNbtProject().port)];
+}
+function discoverCarts(cartsDir) {
+  if (!fs2.existsSync(cartsDir)) return [];
+  return fs2.readdirSync(cartsDir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => path3.join(cartsDir, e.name)).filter((d) => fs2.existsSync(path3.join(d, "schema.nbt")));
+}
+function newestNbtMtime(dir) {
+  let newest = 0;
+  const walk = (d) => {
+    let entries;
+    try {
+      entries = fs2.readdirSync(d, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const e of entries) {
+      const p = path3.join(d, e.name);
+      if (e.isDirectory()) {
+        if (e.name !== ".dist" && e.name !== "node_modules") walk(p);
+      } else if (e.name.endsWith(".nbt")) {
+        try {
+          const m = fs2.statSync(p).mtimeMs;
+          if (m > newest) newest = m;
+        } catch {
+        }
+      }
+    }
+  };
+  walk(dir);
+  return newest;
+}
+function tcpUp(port, host = "127.0.0.1") {
+  return new Promise((resolve3) => {
+    const sock = net.connect({ port, host });
+    sock.once("connect", () => {
+      sock.destroy();
+      resolve3(true);
+    });
+    sock.once("error", () => resolve3(false));
+    sock.setTimeout(500, () => {
+      sock.destroy();
+      resolve3(false);
+    });
+  });
+}
+var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+function installCart(cartDir, port) {
+  const r = (0, import_node_child_process2.spawnSync)(NBT_BIN, ["install", "--path", cartDir, "--port", String(port)], {
+    stdio: "inherit",
+    env: nativeEnv()
+  });
+  return r.status === 0;
+}
+async function runDev(opts) {
+  const proj = loadNbtProject();
+  const port = opts.port ? Number(opts.port) : proj.port;
+  if (!Number.isFinite(port) || port <= 0) throw new Error(`invalid port '${opts.port}'`);
+  const upArgs = ["up", "--port", String(port)];
+  if (opts.dataDir) upArgs.push("--data-dir", opts.dataDir);
+  console.log(`nbt dev: starting console on :${port}`);
+  const daemon = (0, import_node_child_process2.spawn)(CONSOLE_BIN, upArgs, { stdio: "inherit", env: consoleEnv() });
+  let shuttingDown = false;
+  const shutdown = (code = 0) => {
+    if (shuttingDown) return;
+    shuttingDown = true;
+    try {
+      daemon.kill("SIGTERM");
+    } catch {
+    }
+    process.exit(code);
+  };
+  process.on("SIGINT", () => shutdown(0));
+  process.on("SIGTERM", () => shutdown(0));
+  daemon.on("exit", (code) => {
+    if (!shuttingDown) {
+      console.error(`nbt dev: console exited (${code ?? "signal"})`);
+      process.exit(code ?? 1);
+    }
+  });
+  let ready = false;
+  for (let i = 0; i < 60; i++) {
+    if (await tcpUp(port)) {
+      ready = true;
+      break;
+    }
+    await sleep(250);
+  }
+  if (!ready) {
+    console.error("nbt dev: console did not come up in time");
+    return shutdown(1);
+  }
+  const carts = discoverCarts(proj.cartsDir);
+  if (carts.length === 0) {
+    console.warn(`nbt dev: no carts found under ${proj.cartsDir} (nothing to watch)`);
+  }
+  const applied = /* @__PURE__ */ new Map();
+  for (const c of carts) {
+    console.log(`nbt dev: install ${path3.basename(c)}`);
+    installCart(c, port);
+    applied.set(c, newestNbtMtime(c));
+  }
+  console.log(`nbt dev: watching ${proj.cartsDir} \u2014 edit .nbt to reload (Ctrl-C to stop)`);
+  let busy = false;
+  setInterval(async () => {
+    if (busy || shuttingDown) return;
+    busy = true;
+    try {
+      for (const c of discoverCarts(proj.cartsDir)) {
+        const m = newestNbtMtime(c);
+        const prev = applied.get(c) ?? 0;
+        if (m > prev) {
+          await sleep(150);
+          const settled = newestNbtMtime(c);
+          console.log(`nbt dev: reload ${path3.basename(c)}`);
+          installCart(c, port);
+          applied.set(c, settled);
+        }
+      }
+    } finally {
+      busy = false;
+    }
+  }, 400);
+}
 customCommands.add("bundle");
 program2.command("bundle").description("Bundle TypeScript workflow code via esbuild").argument("<entry...>", "workflow entry point file(s)").option("-o, --outfile <dir>", "output file").action((entry, opts) => {
   if (!opts.outfile) {
@@ -3508,8 +3828,67 @@ program2.command("bundle").description("Bundle TypeScript workflow code via esbu
   }
   bundleWorkflows({ entryPoints: entry, outfile: opts.outfile });
 });
+customCommands.add("completions");
+program2.command("completions").description("Emit a shell completion script (bash | zsh | fish)").argument("<shell>", "bash | zsh | fish").action((shell) => {
+  const script = completionScript(shell);
+  if (!script) {
+    console.error(`completions: unknown shell '${shell}' (want bash|zsh|fish)`);
+    process.exit(1);
+  }
+  process.stdout.write(script);
+});
+function completionScript(shell) {
+  const n = "nbt";
+  if (shell === "bash") {
+    return `_${n}_complete() {
+  local cur="\${COMP_WORDS[COMP_CWORD]}"
+  local IFS=$'\\n'
+  COMPREPLY=( $(${n} __complete__ "\${COMP_WORDS[@]:1}") )
+}
+complete -F _${n}_complete ${n}
+`;
+  }
+  if (shell === "zsh") {
+    return `#compdef ${n}
+_${n}() {
+  local -a cands
+  cands=( $(${n} __complete__ "\${(@)words[2,$CURRENT]}") )
+  compadd -a cands
+}
+compdef _${n} ${n}
+`;
+  }
+  if (shell === "fish") {
+    return `complete -c ${n} -f -a "(${n} __complete__ (commandline -opc)[2..])"
+`;
+  }
+  return "";
+}
+function runCompletion(words) {
+  if (words.length <= 1) {
+    const prefix = words[0] ?? "";
+    const names = [
+      ...NBT.map(([n]) => n),
+      ...CONSOLE.map(([n]) => n),
+      ...customCommands
+    ];
+    const cands = [...new Set(names)].filter((n) => n.startsWith(prefix)).sort();
+    if (cands.length) process.stdout.write(cands.join("\n") + "\n");
+    process.exit(0);
+  }
+  const first2 = words[0];
+  if (customCommands.has(first2)) process.exit(0);
+  const isConsole = consoleCommands.has(first2);
+  const bin = isConsole ? CONSOLE_BIN : NBT_BIN;
+  const env = isConsole ? consoleEnv() : nativeEnv();
+  const r = (0, import_node_child_process2.spawnSync)(bin, ["__complete__", ...words], { stdio: "inherit", env });
+  process.exit(r.status === null ? 0 : r.status);
+}
 var argv = process.argv.slice(2);
 var first = argv[0];
+if (first === "__complete__") {
+  runCompletion(argv.slice(1));
+}
 if (!first || first === "-h" || first === "--help" || first === "help") {
   program2.outputHelp();
   process.exit(first ? 0 : 1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nbt-dev/nbt",
-  "version": "0.0.1",
+  "version": "0.0.4",
   "description": "The nbt CLI and console daemon for the nbt-dev console — a fixed-target OS for web development. Linux/x64 prebuilt binaries.",
   "bin": {
     "nbt": "dist/nbt.js"
@@ -8,9 +8,10 @@
   "files": [
     "dist/",
     "vendor/linux-x64/",
-    "contracts/",
+    "stdlib/",
     "README.md",
-    "LICENSE"
+    "LICENSE",
+    "TRADEMARKS.md"
   ],
   "scripts": {
     "build": "node scripts/build.mjs",
@@ -29,7 +30,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "license": "MIT",
+  "license": "CPAL-1.0",
   "dependencies": {
     "esbuild": "^0.28.0"
   },

package/stdlib/auth/README.md

@@ -0,0 +1,83 @@
+# Auth Cartridge
+
+User identity, sessions, API keys, and cross-cartridge middleware.
+
+## Middleware
+
+The cartridge exports `authenticate` — validates the `session_token` cookie
+against stored Sessions. Returns 401 if missing or invalid. On success, sets
+`X-User-Id` on the forwarded request.
+
+To protect another cartridge, add this to its schema.nbt:
+
+```
+import "auth";
+```
+
+All routes on that cartridge now require a valid session cookie. The auth
+cartridge's own routes remain unprotected.
+
+## How middleware works
+
+```
+client request
+    |
+    v
+console proxy sees "guarded" cartridge has depends:auth
+    |
+    v
+POST /_middleware/authenticate -> auth cartridge socket
+    |
+    +-- no session_token cookie  -> 401 "unauthorized"
+    +-- token not in Sessions    -> 401 "invalid session"
+    +-- valid session            -> 200 + X-User-Id header
+    |
+    v (if 200)
+forward request to guarded cartridge with X-User-Id injected
+```
+
+## Writing middleware
+
+Middleware is a function with access to the incoming request. Available helpers:
+
+```nbt
+middleware authenticate(request: Request) {
+  jai {
+    // read headers/cookies from the request
+    token := get_cookie(request, "session_token");
+    key   := get_header(request, "X-Api-Key");
+
+    // reject
+    respond(401, "unauthorized");
+
+    // accept and enrich the forwarded request
+    set_header("X-User-Id", "42");
+    respond(200, "");
+  }
+}
+```
+
+| Helper                       | Does                                      |
+|------------------------------|-------------------------------------------|
+| `get_cookie(request, name)`  | Parse and return a cookie value            |
+| `get_header(request, name)`  | Case-insensitive header lookup             |
+| `set_header(name, value)`    | Add header to forwarded request (max 16)   |
+| `respond(status, body)`      | Set response and return from handler       |
+
+`respond()` is terminal — it writes the HTTP response and exits the handler.
+
+## Manifest
+
+After `nbt build`, the auth cartridge's manifest contains:
+
+```
+user
+session
+account
+verification
+apikey
+middleware:authenticate
+```
+
+A cartridge that imports auth gets `depends:auth` in its own manifest.
+The console reads both at startup to build the middleware dependency map.

package/stdlib/auth/migrations/20260424144652_initial/migration.nbt

@@ -0,0 +1,48 @@
+migration initial {
+  add_entity User
+  add_field User name string default("")
+  add_field User username string default("")
+  add_field User email string default("")
+  add_field User emailVerified bool default(false)
+  add_field User externalId string default("")
+  add_field User capsVersion u32 default(0)
+  add_index User [email]
+  add_index User [externalId]
+  add_entity UserRole
+  add_field UserRole userId string default("")
+  add_field UserRole cart string default("")
+  add_field UserRole role string default("")
+  add_index UserRole [userId]
+  add_entity Session
+  add_field Session userId string default("")
+  add_field Session token string default("")
+  add_field Session expiresAt DateTime default(0)
+  add_field Session ipAddress string default("")
+  add_field Session userAgent string default("")
+  add_index Session [token]
+  add_index Session [userId]
+  add_entity Account
+  add_field Account userId string default("")
+  add_field Account providerId string default("")
+  add_field Account password string default("")
+  add_field Account accessToken string default("")
+  add_field Account refreshToken string default("")
+  add_field Account idToken string default("")
+  add_field Account accessTokenExpiresAt DateTime default(0)
+  add_field Account refreshTokenExpiresAt DateTime default(0)
+  add_field Account scope string default("")
+  add_index Account [userId]
+  add_entity Verification
+  add_field Verification identifier string default("")
+  add_field Verification value string default("")
+  add_field Verification expiresAt DateTime default(0)
+  add_index Verification [identifier]
+  add_entity ApiKey
+  add_field ApiKey name string default("")
+  add_field ApiKey projectId string default("")
+  add_field ApiKey start string default("")
+  add_field ApiKey prefix string default("")
+  add_field ApiKey key string default("")
+  add_field ApiKey permissions string default("")
+  add_field ApiKey roles string default("")
+}

package/stdlib/auth/migrations/20260424144652_initial/schema_snapshot.nbt

@@ -0,0 +1,58 @@
+entity User {
+  name: string
+  username?: string
+  email?: string
+  emailVerified: bool
+  externalId?: string
+  capsVersion: u32
+  @@index([email])
+  @@index([externalId])
+}
+
+entity UserRole {
+  userId: string
+  cart: string
+  role: string
+  @@index([userId])
+}
+
+entity Session {
+  userId: string
+  token: string
+  expiresAt: DateTime
+  ipAddress?: string
+  userAgent?: string
+  @@index([token])
+  @@index([userId])
+}
+
+entity Account {
+  userId: string
+  providerId: string
+  password: string
+  accessToken: string
+  refreshToken: string
+  idToken: string
+  accessTokenExpiresAt: DateTime
+  refreshTokenExpiresAt: DateTime
+  scope: string
+  @@index([userId])
+}
+
+entity Verification {
+  identifier: string
+  value: string
+  expiresAt: DateTime
+  @@index([identifier])
+}
+
+entity ApiKey {
+  name: string
+  projectId: string
+  start: string
+  prefix: string
+  key: string
+  permissions: string
+  roles: string
+}
+

package/stdlib/auth/migrations/20260521191014_update_user/migration.nbt

@@ -0,0 +1,3 @@
+migration update_user {
+  add_unique User [email]
+}