@protobase/server 0.25.9 → 0.25.11

package/dist/api-keys/api-key-settings.d.ts

@@ -0,0 +1,24 @@
+//#region src/api-keys/api-key-settings.d.ts
+/**
+ * The app's two keys, for clients that call it the way they call Supabase. `publishable_key` is safe in a browser and
+ * makes a request anonymous or its signed-in user's; `secret_key` stays on servers and makes a request the app's own.
+ * Each falls back to `PROTOBASE_PUBLISHABLE_KEY` and `PROTOBASE_SECRET_KEY`; without either, nothing is admitted by key.
+ */
+export type ApiKeysOptions = {
+  publishable_key?: string;
+  secret_key?: string;
+};
+export type ApiKeys = {
+  publishable?: string;
+  secret?: string;
+};
+export declare const apiKeyVariables: {
+  readonly publishable_key: "PROTOBASE_PUBLISHABLE_KEY";
+  readonly secret_key: "PROTOBASE_SECRET_KEY";
+};
+/**
+ * The keys that are set, unless the option is `false`. A publishable key that looks like a secret one, the other way
+ * round, or both the same stop the server at startup, without printing the keys.
+ */
+export declare const apiKeySettings: (option: ApiKeysOptions | false | undefined, env: Record<string, string | undefined>) => ApiKeys;
+//#endregion

package/dist/api-keys/api-key-settings.js

@@ -0,0 +1,32 @@
+//#region src/api-keys/api-key-settings.ts
+const apiKeyVariables = {
+	publishable_key: "PROTOBASE_PUBLISHABLE_KEY",
+	secret_key: "PROTOBASE_SECRET_KEY"
+};
+const wrongPrefix = {
+	publishable_key: "sb_secret_",
+	secret_key: "sb_publishable_"
+};
+/**
+* The keys that are set, unless the option is `false`. A publishable key that looks like a secret one, the other way
+* round, or both the same stop the server at startup, without printing the keys.
+*/
+const apiKeySettings = (option, env) => {
+	if (option === false) return {};
+	const read = (name) => {
+		const value = (option?.[name] ?? env[apiKeyVariables[name]])?.trim();
+		if (!value) return void 0;
+		const source = option?.[name] === void 0 ? apiKeyVariables[name] : `The ${name} option`;
+		if (value.startsWith(wrongPrefix[name])) throw new Error(`${source} starts with ${wrongPrefix[name]}, the other key's prefix; swap the two keys`);
+		return value;
+	};
+	const publishable = read("publishable_key");
+	const secret = read("secret_key");
+	if (publishable !== void 0 && publishable === secret) throw new Error("The publishable and the secret key are the same; the secret key must be one of its own");
+	return {
+		...publishable && { publishable },
+		...secret && { secret }
+	};
+};
+//#endregion
+export { apiKeySettings, apiKeyVariables };

package/dist/api-keys/resolve-caller.d.ts

@@ -0,0 +1,35 @@
+import { ApiKeys } from "./api-key-settings.js";
+import { JWTPayload } from "jose";
+//#region src/api-keys/resolve-caller.d.ts
+/**
+ * Who a key-admitted request runs as. `anon` and `authenticated` are the database roles of the same names; `app` is
+ * the app's own role, the one that owns its tables. `claims` are those of the signed-in user's token, or for the keys
+ * alone the `role` claim that Supabase gives them, so `auth.jwt()` reads the same.
+ */
+export type Caller = {
+  role: 'anon';
+  claims: {
+    role: 'anon';
+  };
+} | {
+  role: 'authenticated';
+  claims: JWTPayload;
+} | {
+  role: 'app';
+  claims: {
+    role: 'service_role';
+  };
+};
+export type CallerOptions = {
+  keys: ApiKeys;
+  /** Verifies a user's token against the app's key set and returns its claims, such as `jwtVerifier(betterAuthTokens(...))`. */
+  verify: (token: string) => Promise<JWTPayload>;
+};
+/**
+ * Resolves the `apikey` header and `Authorization: Bearer` of a request to its caller. The key picks the role: the
+ * publishable key is `anon`, the secret key `app`. A user's token in the bearer makes either `authenticated` with its
+ * claims. A bearer that is no token must be the key itself, as supabase-js sends it when nobody is signed in. A
+ * missing or wrong key, a wrong bearer or a token that does not verify or names no user is a 401 problem.
+ */
+export declare const apiKeyCaller: (options: CallerOptions) => (request: Request) => Promise<Caller>;
+//#endregion

package/dist/api-keys/resolve-caller.js

@@ -0,0 +1,39 @@
+import { unauthorized } from "../problem.js";
+import { createHash, timingSafeEqual } from "node:crypto";
+//#region src/api-keys/resolve-caller.ts
+const digest = (text) => createHash("sha256").update(text).digest();
+const sameKey = (given, key) => key !== void 0 && timingSafeEqual(digest(given), digest(key));
+const isJwt = (token) => token.split(".").length === 3;
+/**
+* Resolves the `apikey` header and `Authorization: Bearer` of a request to its caller. The key picks the role: the
+* publishable key is `anon`, the secret key `app`. A user's token in the bearer makes either `authenticated` with its
+* claims. A bearer that is no token must be the key itself, as supabase-js sends it when nobody is signed in. A
+* missing or wrong key, a wrong bearer or a token that does not verify or names no user is a 401 problem.
+*/
+const apiKeyCaller = (options) => async (request) => {
+	const key = request.headers.get("apikey")?.trim();
+	if (!key) throw unauthorized("Send the app's publishable or secret key in the apikey header");
+	const publishable = sameKey(key, options.keys.publishable);
+	if (!publishable && !sameKey(key, options.keys.secret)) throw unauthorized("The apikey header holds no key of this app");
+	const header = request.headers.get("authorization");
+	const [scheme, bearer] = header?.split(" ") ?? [];
+	if (header !== null && (scheme?.toLowerCase() !== "bearer" || !bearer)) throw unauthorized("Send a bearer token in the Authorization header");
+	if (bearer !== void 0 && isJwt(bearer)) {
+		const claims = await options.verify(bearer);
+		if (!claims.sub) throw unauthorized("The bearer token has no subject");
+		return {
+			role: "authenticated",
+			claims
+		};
+	}
+	if (bearer !== void 0 && !sameKey(bearer, key)) throw unauthorized("The bearer is neither a token nor the key in the apikey header");
+	return publishable ? {
+		role: "anon",
+		claims: { role: "anon" }
+	} : {
+		role: "app",
+		claims: { role: "service_role" }
+	};
+};
+//#endregion
+export { apiKeyCaller };

package/dist/auth/jwt.d.ts

@@ -1,5 +1,5 @@
 import { Authenticator, TenantValue } from "../types.js";
-import { JWTVerifyGetKey } from "jose";
+import { JWTPayload, JWTVerifyGetKey } from "jose";
 //#region src/auth/jwt.d.ts
 export type JwtOptions = {
   /** JWKS endpoint of the identity provider; or pass `keys`, for example `createLocalJWKSet`. */
@@ -20,6 +20,9 @@ export type JwtOptions = {
   /** A fixed tenant (or resolver) used instead of any claim, for single-tenant deployments. */
   tenant?: TenantValue | (() => Promise<TenantValue | undefined>);
 };
+export type JwtVerifyOptions = Pick<JwtOptions, 'jwksUrl' | 'keys' | 'issuer' | 'audience' | 'algorithms'>;
+/** Verifies a JWT against a JWKS and returns its claims; a token that does not verify is a 401 problem. */
+export declare const jwtVerifier: (options: JwtVerifyOptions) => (token: string) => Promise<JWTPayload>;
 /** Verifies `Authorization: Bearer <jwt>` against a JWKS; `sub` is the user id. Without the header, `MissingCredentials`. */
 export declare const jwtAuthenticator: (options: JwtOptions) => Authenticator;
 //#endregion

package/dist/auth/jwt.js

@@ -17,26 +17,33 @@ const rolesOf = (claim) => {
 	if (typeof claim === "string") return claim.split(/[\s,]+/).filter(Boolean);
 	return Array.isArray(claim) ? claim.filter((role) => typeof role === "string") : [];
 };
-/** Verifies `Authorization: Bearer <jwt>` against a JWKS; `sub` is the user id. Without the header, `MissingCredentials`. */
-const jwtAuthenticator = (options) => {
-	const { rolesClaim = "roles", tenantClaim = "tenant" } = options;
+/** Verifies a JWT against a JWKS and returns its claims; a token that does not verify is a 401 problem. */
+const jwtVerifier = (options) => {
 	const keys = options.keys ?? (options.jwksUrl ? createRemoteJWKSet(new URL(options.jwksUrl)) : void 0);
 	if (!keys) throw new Error("jwtAuthenticator needs jwksUrl or keys");
-	return async (request) => {
-		const header = request.headers.get("authorization");
-		if (header === null) throw new MissingCredentials("Send a bearer token in the Authorization header");
-		const [scheme, token] = header.split(" ");
-		if (scheme?.toLowerCase() !== "bearer" || !token) throw unauthorized("Send a bearer token in the Authorization header");
-		const verified = await jwtVerify(token, keys, {
+	return async (token) => {
+		return (await jwtVerify(token, keys, {
 			algorithms: options.algorithms ?? asymmetric,
 			...options.issuer && { issuer: options.issuer },
 			...options.audience && { audience: options.audience }
 		}).catch((error) => {
 			if (error instanceof errors.JOSEError) throw unauthorized("The bearer token is invalid or expired");
 			throw error;
-		});
-		const { sub, [tenantClaim]: tenant, [rolesClaim]: roles } = verified.payload;
-		const extraRoles = options.extraRolesClaim === void 0 ? [] : rolesOf(verified.payload[options.extraRolesClaim]);
+		})).payload;
+	};
+};
+/** Verifies `Authorization: Bearer <jwt>` against a JWKS; `sub` is the user id. Without the header, `MissingCredentials`. */
+const jwtAuthenticator = (options) => {
+	const { rolesClaim = "roles", tenantClaim = "tenant" } = options;
+	const verify = jwtVerifier(options);
+	return async (request) => {
+		const header = request.headers.get("authorization");
+		if (header === null) throw new MissingCredentials("Send a bearer token in the Authorization header");
+		const [scheme, token] = header.split(" ");
+		if (scheme?.toLowerCase() !== "bearer" || !token) throw unauthorized("Send a bearer token in the Authorization header");
+		const payload = await verify(token);
+		const { sub, [tenantClaim]: tenant, [rolesClaim]: roles } = payload;
+		const extraRoles = options.extraRolesClaim === void 0 ? [] : rolesOf(payload[options.extraRolesClaim]);
 		if (!sub) throw unauthorized("The bearer token has no subject");
 		const claimed = typeof tenant === "string" || typeof tenant === "number" ? tenant : void 0;
 		const tenantValue = options.tenant === void 0 ? claimed : typeof options.tenant === "function" ? await options.tenant() : options.tenant;
@@ -50,4 +57,4 @@ const jwtAuthenticator = (options) => {
 	};
 };
 //#endregion
-export { jwtAuthenticator };
+export { jwtAuthenticator, jwtVerifier };

package/dist/better-auth/authenticator.d.ts

@@ -1,5 +1,6 @@
 import { AdminAuth } from "./create-auth.js";
 import { Authenticator, TenantValue } from "../types.js";
+import { JwtVerifyOptions } from "../auth/jwt.js";
 import { TrustedApp } from "./app-tokens.js";
 import { JwksCacheOptions } from "./jwks-cache.js";
 //#region src/better-auth/authenticator.d.ts
@@ -19,6 +20,10 @@ export type BetterAuthAuthenticatorOptions = {
   /** Other Protobase apps whose users this API admits with their own tokens, so their admin apps can draw its resources (see `TrustedApp`). */
   apps?: TrustedApp[];
 };
+/** How the tokens of this Better Auth instance verify: its key set, and its issuer as both issuer and audience. */
+export declare const betterAuthTokens: (options: Pick<BetterAuthAuthenticatorOptions, "auth" | "jwksUrl" | "issuer" | "cache">) => JwtVerifyOptions & {
+  issuer: string;
+};
 /**
  * Verifies the bearer JWT that Better Auth's jwt plugin issues. `sub` is the user id, the `role` claim (a comma
  * separated string from the admin plugin) becomes `roles`. With organizations, the `org` claim is the tenant and the

package/dist/better-auth/authenticator.js

@@ -3,6 +3,17 @@ import { jwtAuthenticator } from "../auth/jwt.js";
 import { withTrustedApps } from "./app-tokens.js";
 import { cachedKeys } from "./jwks-cache.js";
 //#region src/better-auth/authenticator.ts
+/** How the tokens of this Better Auth instance verify: its key set, and its issuer as both issuer and audience. */
+const betterAuthTokens = (options) => {
+	const issuer = options.issuer ?? options.auth?.issuer;
+	if (!issuer) throw new Error("betterAuthAuthenticator needs `issuer` (or an `auth` instance with a baseURL)");
+	if (!options.auth && !options.jwksUrl) throw new Error("betterAuthAuthenticator needs `auth` or `jwksUrl`");
+	return {
+		...options.auth ? { keys: cachedKeys(() => options.auth.api.getJwks(), options.cache) } : { jwksUrl: options.jwksUrl },
+		issuer,
+		audience: issuer
+	};
+};
 /**
 * Verifies the bearer JWT that Better Auth's jwt plugin issues. `sub` is the user id, the `role` claim (a comma
 * separated string from the admin plugin) becomes `roles`. With organizations, the `org` claim is the tenant and the
@@ -10,14 +21,11 @@ import { cachedKeys } from "./jwks-cache.js";
 * role, is left out. With `apps`, the tokens of those apps are admitted too, with the roles each gives its users here.
 */
 const betterAuthAuthenticator = (options) => {
-	const issuer = options.issuer ?? options.auth?.issuer;
-	if (!issuer) throw new Error("betterAuthAuthenticator needs `issuer` (or an `auth` instance with a baseURL)");
-	if (!options.auth && !options.jwksUrl) throw new Error("betterAuthAuthenticator needs `auth` or `jwksUrl`");
+	const tokens = betterAuthTokens(options);
+	const { issuer } = tokens;
 	const organizations = options.organizations ?? Boolean(options.auth?.organizations);
 	const verify = jwtAuthenticator({
-		...options.auth ? { keys: cachedKeys(() => options.auth.api.getJwks(), options.cache) } : { jwksUrl: options.jwksUrl },
-		issuer,
-		audience: issuer,
+		...tokens,
 		rolesClaim: "role",
 		...organizations && {
 			tenantClaim: "org",
@@ -39,4 +47,4 @@ const betterAuthAuthenticator = (options) => {
 	}, issuer, options.apps ?? []);
 };
 //#endregion
-export { betterAuthAuthenticator };
+export { betterAuthAuthenticator, betterAuthTokens };

package/dist/better-auth/create-auth.d.ts

@@ -8,6 +8,8 @@ import { OrganizationsOptions, ResolvedOrganizations } from "./organizations/opt
 import { PlatformSignIn } from "./platform-sign-in.js";
 import { SsoOptions } from "./saml-sign-in.js";
 import { signUpPaths } from "./sign-up/sign-up-plugin.js";
+import { PasswordHash } from "./password-hashes.js";
+import { UserTableOptions } from "./user-table.js";
 import "../index.js";
 import { BetterAuthOptions } from "better-auth";
 //#region src/better-auth/create-auth.d.ts
@@ -80,9 +82,22 @@ export type CreateAuthOptions = {
   onUserCreated?: UserCreatedHook;
   /**
    * The id of a new user, by any route. Default Better Auth's random 32-character text. `.owner()` fields hold it: a
-   * `text` column for the default, or an integer column when this takes the next value of the app's own users sequence.
+   * `text` column for the default, an integer column when this takes the next value of the app's own users sequence,
+   * or a `uuid` column with `'uuid'`, which makes a random UUID in code and makes every id column of the store a `uuid`.
    */
-  generateUserId?: () => string | Promise<string>;
+  generateUserId?: (() => string | Promise<string>) | 'uuid';
+  /**
+   * The user table, when it is one another system made, such as Supabase's `auth.users`: its name, the columns named
+   * otherwise than Protobase names them, and a JSON column for each user's metadata, for example `{ table: 'users',
+   * columns: { role: 'app_role' }, metadata: 'raw_user_meta_data' }`. The other tables keep their names. Default the
+   * table `protobase auth migration` makes.
+   */
+  users?: UserTableOptions;
+  /**
+   * Password hashes another system wrote that sign-in accepts besides Better Auth's own, such as `['bcrypt']` for
+   * Supabase Auth's. The first sign-in with one stores the password again as Better Auth hashes it. Default none.
+   */
+  passwordHashes?: PasswordHash[];
   /**
    * The identity provider the operator's staff sign in with to sign in as people of this app, for support. Defaults
    * to the one the platform passes in `PROTOBASE_OPERATOR_ISSUER`, `PROTOBASE_OPERATOR_CLIENT_ID` and
@@ -123,22 +138,35 @@ export type UserCreatedHook = NonNullable<UserCreateHooks['after']>;
 export declare const normalizeRoles: (roles?: RolesInput) => string[];
 export declare const createAuth: (options: CreateAuthOptions) => import("better-auth").Auth<{
   user: {
+    modelName: string;
     fields: {
+      name: string;
+      email: string;
       emailVerified: string;
+      image: string;
       createdAt: string;
       updatedAt: string;
     };
   } | {
     additionalFields: {
-      readonly lastOrganizationId: {
+      metadata?: {
+        readonly type: "json";
+        readonly required: false;
+        readonly fieldName: string;
+      } | undefined;
+      lastOrganizationId?: {
         readonly type: "string";
         readonly required: false;
         readonly input: false;
         readonly fieldName: "last_organization_id";
-      };
+      } | undefined;
     };
+    modelName: string;
     fields: {
+      name: string;
+      email: string;
       emailVerified: string;
+      image: string;
       createdAt: string;
       updatedAt: string;
     };
@@ -178,7 +206,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
       updatedAt: string;
     };
   };
-  plugins: [{
+  plugins: ({
     id: "admin";
     version: string;
     init(): {
@@ -1094,7 +1122,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
         }>;
       };
     }>;
-  }, {
+  } | {
     id: "jwt";
     version: string;
     options: NoInfer<{
@@ -1362,7 +1390,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
         };
       };
     };
-  }, {
+  } | {
     hooks: {
       after: {
         matcher: (context: Parameters<(context: import("better-auth").HookEndpointContext) => boolean>[0]) => boolean;
@@ -2030,7 +2058,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
       ACCOUNT_TEMPORARILY_LOCKED: import("better-auth").RawError<"ACCOUNT_TEMPORARILY_LOCKED">;
       INVALID_TWO_FACTOR_COOKIE: import("better-auth").RawError<"INVALID_TWO_FACTOR_COOKIE">;
     };
-  }, {
+  } | {
     endpoints: {
       generatePasskeyAuthenticationOptions: import("better-auth").StrictEndpoint<"/passkey/generate-authenticate-options", {
         method: "GET";
@@ -2332,7 +2360,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               expiresAt: Date;
               token: string;
               ipAddress?: string | null | undefined;
-              userAgent? /** Every origin the app is served on, `baseURL`'s first. */ : string | null | undefined;
+              userAgent?: string | null | undefined;
             };
             user: Record<string, any> & {
               id: string;
@@ -2511,7 +2539,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
       RESOLVED_USER_INVALID: import("better-auth").RawError<"RESOLVED_USER_INVALID">;
     };
     options: import("@better-auth/passkey").PasskeyOptions | undefined;
-  }, ...({
+  } | {
     id: "email-otp";
     version: string;
     init(ctx: import("better-auth").AuthContext): {
@@ -5198,8 +5226,8 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
           appRoles: string[];
           id: string;
           createdAt: Date;
-          userId: string;
           role: string;
+          userId: string;
           organizationId: string;
         };
       }>;
@@ -5212,7 +5240,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
         handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
       }[];
     };
-  })[], {
+  } | {
     id: "protobase-users";
     endpoints: {
       getInvitation: import("better-auth").StrictEndpoint<"/invitation", {
@@ -5262,8 +5290,8 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
           appRoles: string[];
           id: string;
           createdAt: Date;
-          userId: string;
           role: string;
+          userId: string;
           organizationId: string;
         };
       }>;
@@ -5678,7 +5706,15 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
         handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
       }[];
     };
-  }];
+  } | {
+    id: "protobase-rehash-passwords";
+    hooks: {
+      after: {
+        matcher: (ctx: import("better-auth").HookEndpointContext) => boolean;
+        handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
+      }[];
+    };
+  })[];
   disabledPaths: string[];
   databaseHooks: {
     session?: {
@@ -5757,6 +5793,9 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
     };
   };
   advanced: {
+    database?: {
+      generateId: "uuid";
+    } | undefined;
     useSecureCookies: boolean;
     defaultCookieAttributes: {
       sameSite: "lax";
@@ -5785,6 +5824,12 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
       url: string;
       token: string;
     }) => Promise<void>) | undefined;
+    password?: {
+      verify: ({ hash, password }: {
+        hash: string;
+        password: string;
+      }) => Promise<boolean>;
+    } | undefined;
     enabled: true;
     disableSignUp: true;
     minPasswordLength: number;

package/dist/better-auth/create-auth.js

@@ -21,8 +21,10 @@ import { signInPolicyPlugin } from "./policy-plugin.js";
 import { emailInDomains, resolveSamlProviders, samlDisabledPaths, samlGuardPlugin, samlPlugin } from "./saml-sign-in.js";
 import { emailCodeOptions, twoFactorCodeOptions, unusedEmailCodePaths } from "./sign-in-mail.js";
 import { signUpPaths, signUpPlugin } from "./sign-up/sign-up-plugin.js";
+import { rehashPasswordsPlugin, verifyAcceptedHash } from "./password-hashes.js";
 import { staffSignInPlugin } from "./staff-plugin.js";
 import { twoFactorAfterPasswordOrCode } from "./two-factor-challenge.js";
+import { metadataField, userFieldsNamed, userModel, userTable, withUserColumns } from "./user-table.js";
 import { usersPlugin } from "./users/users-plugin.js";
 import { APIError } from "better-auth/api";
 import { betterAuth } from "better-auth";
@@ -44,6 +46,7 @@ const tokenLifetime = "15m";
 /** The configured roles with `admin` first; `admin` is added when missing. */
 const normalizeRoles = (roles) => roleDefinitions(roles).names;
 const adminImpersonationPaths = ["/admin/impersonate-user", "/admin/stop-impersonating"];
+const newUserId = (generate) => generate === "uuid" ? crypto.randomUUID() : generate();
 const noContext = () => Promise.reject(/* @__PURE__ */ new Error("The auth context is read only once createAuth has made the instance"));
 const organizationPaths = ["/organization/set-active", "/organization/accept-invitation"];
 /**
@@ -60,6 +63,12 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 		baseURL: options.baseURL
 	};
 	const samlIds = saml.map((provider) => provider.id);
+	const users = userTable(options.users);
+	const passwordHashes = options.passwordHashes ?? [];
+	const userFields = {
+		...organizations && userFieldsNamed(lastOrganizationField, users),
+		...metadataField(users)
+	};
 	return {
 		appName,
 		database: options.database,
@@ -75,13 +84,14 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 			enabled: true,
 			disableSignUp: true,
 			minPasswordLength: 12,
+			...passwordHashes.length > 0 && { password: { verify: verifyAcceptedHash(passwordHashes) } },
 			...mail && passwordResetOptions(mail)
 		},
 		...options.socialProviders && { socialProviders: options.socialProviders },
-		user: organizations ? {
-			...coreNames.user,
-			additionalFields: lastOrganizationField
-		} : coreNames.user,
+		user: Object.keys(userFields).length > 0 ? {
+			...userModel(users),
+			additionalFields: userFields
+		} : userModel(users),
 		session: coreNames.session,
 		verification: coreNames.verification,
 		account: {
@@ -162,8 +172,9 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 				invitationUrl: organizations?.invitationUrl ?? defaultInvitationUrl(options.baseURL),
 				invitationSeconds: organizations?.invitationExpiresIn ?? 604800,
 				...organizations && { organizations }
-			})
-		],
+			}),
+			...passwordHashes.length > 0 ? [rehashPasswordsPlugin(passwordHashes)] : []
+		].map((plugin) => withUserColumns(plugin, users)),
 		disabledPaths: [
 			...unusedEmailCodePaths,
 			...adminImpersonationPaths,
@@ -183,7 +194,7 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 					});
 					const withId = options.generateUserId ? {
 						...user,
-						id: await options.generateUserId()
+						id: await newUserId(options.generateUserId)
 					} : user;
 					return { data: context?.path === "/admin/create-user" || samlProvider ? {
 						...withId,
@@ -231,7 +242,8 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 				sameSite: "lax",
 				secure
 			},
-			backgroundTasks: { handler: () => {} }
+			backgroundTasks: { handler: () => {} },
+			...options.generateUserId === "uuid" && { database: { generateId: "uuid" } }
 		}
 	};
 };

package/dist/better-auth/password-hashes.d.ts

@@ -0,0 +1,4 @@
+//#region src/better-auth/password-hashes.d.ts
+/** The hash formats sign-in accepts besides Better Auth's own. */
+export type PasswordHash = 'bcrypt';
+//#endregion

package/dist/better-auth/password-hashes.js

@@ -0,0 +1,31 @@
+import { APIError, createAuthMiddleware } from "better-auth/api";
+import { verifyPassword } from "better-auth/crypto";
+import bcrypt from "bcryptjs";
+//#region src/better-auth/password-hashes.ts
+const formats = { bcrypt: {
+	matches: (hash) => /^\$2[aby]\$/.test(hash),
+	verify: (password, hash) => bcrypt.compare(password, hash)
+} };
+const formatOf = (accepted, hash) => accepted.map((name) => formats[name]).find((format) => format.matches(hash));
+/** Better Auth's `password.verify`: the accepted formats first, then its own scrypt. */
+const verifyAcceptedHash = (accepted) => ({ hash, password }) => formatOf(accepted, hash)?.verify(password, hash) ?? verifyPassword({
+	hash,
+	password
+});
+/** After a sign-in with a password in one of the accepted formats, stores it again as Better Auth hashes it. */
+const rehashPasswordsPlugin = (accepted) => ({
+	id: "protobase-rehash-passwords",
+	hooks: { after: [{
+		matcher: (ctx) => ctx.path === "/sign-in/email",
+		handler: createAuthMiddleware(async (ctx) => {
+			if (ctx.context.returned instanceof APIError) return;
+			const { email, password } = ctx.body;
+			const found = await ctx.context.internalAdapter.findUserByEmail(email.toLowerCase(), { includeAccounts: true });
+			const account = found?.accounts.find((candidate) => candidate.providerId === "credential" && candidate.accountId === found.user.id);
+			if (!found || !account?.password || !formatOf(accepted, account.password)) return;
+			await ctx.context.internalAdapter.updatePassword(found.user.id, await ctx.context.password.hash(password));
+		})
+	}] }
+});
+//#endregion
+export { rehashPasswordsPlugin, verifyAcceptedHash };

package/dist/better-auth/snake-case-names.js

@@ -1,11 +1,6 @@
 //#region src/better-auth/snake-case-names.ts
-/** Better Auth's own tables, as its `user`, `session`, `account` and `verification` options name them. */
+/** Better Auth's own tables, as its `session`, `account` and `verification` options name them; the user table's are in `user-table.ts`. */
 const coreNames = {
-	user: { fields: {
-		emailVerified: "email_verified",
-		createdAt: "created_at",
-		updatedAt: "updated_at"
-	} },
 	session: { fields: {
 		expiresAt: "expires_at",
 		createdAt: "created_at",

package/dist/better-auth/user-table.d.ts

@@ -0,0 +1,31 @@
+import "better-auth";
+//#region src/better-auth/user-table.d.ts
+/** Each column of the user table, by the name Protobase gives it, with Better Auth's field it holds. */
+declare const userFields: {
+  readonly name: "name";
+  readonly email: "email";
+  readonly email_verified: "emailVerified";
+  readonly image: "image";
+  readonly created_at: "createdAt";
+  readonly updated_at: "updatedAt";
+  readonly role: "role";
+  readonly banned: "banned";
+  readonly ban_reason: "banReason";
+  readonly ban_expires: "banExpires";
+  readonly two_factor_enabled: "twoFactorEnabled";
+  readonly last_role: "lastRole";
+  readonly last_organization_id: "lastOrganizationId";
+};
+export type UserColumn = keyof typeof userFields;
+export type UserTableOptions = {
+  /** The table's name, default `user`, for example `users` for Supabase's `auth.users`. */
+  table?: string;
+  /**
+   * The columns named otherwise than Protobase names them: `{ role: 'app_role' }`, where `role` holds something else
+   * already, such as the Postgres role in Supabase's `auth.users`.
+   */
+  columns?: Partial<Record<UserColumn, string>>;
+  /** A JSON column that holds each user's metadata, such as `raw_user_meta_data`; none by default. */
+  metadata?: string;
+};
+//#endregion

package/dist/better-auth/user-table.js

@@ -0,0 +1,69 @@
+//#region src/better-auth/user-table.ts
+/** Each column of the user table, by the name Protobase gives it, with Better Auth's field it holds. */
+const userFields = {
+	name: "name",
+	email: "email",
+	email_verified: "emailVerified",
+	image: "image",
+	created_at: "createdAt",
+	updated_at: "updatedAt",
+	role: "role",
+	banned: "banned",
+	ban_reason: "banReason",
+	ban_expires: "banExpires",
+	two_factor_enabled: "twoFactorEnabled",
+	last_role: "lastRole",
+	last_organization_id: "lastOrganizationId"
+};
+/** The user table's names, from `createAuth`'s `users` option; unknown columns are an error. */
+const userTable = ({ table = "user", columns = {}, metadata } = {}) => {
+	const unknown = Object.keys(columns).find((name) => !(name in userFields));
+	if (unknown !== void 0) throw new Error(`users.columns names "${unknown}", which is not a column of the user table: ${Object.keys(userFields).join(", ")}`);
+	const column = (name) => columns[name] ?? name;
+	return {
+		modelName: table,
+		column,
+		fieldNames: Object.fromEntries(Object.entries(userFields).map(([name, field]) => [field, column(name)])),
+		metadata
+	};
+};
+/** Better Auth's `user` option: the table and its core columns. */
+const userModel = ({ modelName, column }) => ({
+	modelName,
+	fields: {
+		name: column("name"),
+		email: column("email"),
+		emailVerified: column("email_verified"),
+		image: column("image"),
+		createdAt: column("created_at"),
+		updatedAt: column("updated_at")
+	}
+});
+/** Each user field the user metadata column adds; none without one. */
+const metadataField = ({ metadata }) => metadata ? { metadata: {
+	type: "json",
+	required: false,
+	fieldName: metadata
+} } : void 0;
+/** The fields, each with its column named as the app names it. */
+const userFieldsNamed = (fields, { fieldNames }) => Object.fromEntries(Object.entries(fields).map(([field, attribute]) => [field, {
+	...attribute,
+	fieldName: fieldNames[field] ?? attribute.fieldName
+}]));
+/** The plugin, with the columns it adds to the user table named as the app names them. */
+const withUserColumns = (plugin, table) => {
+	const user = plugin.schema?.user;
+	if (!user) return plugin;
+	return {
+		...plugin,
+		schema: {
+			...plugin.schema,
+			user: {
+				...user,
+				fields: userFieldsNamed(user.fields, table)
+			}
+		}
+	};
+};
+//#endregion
+export { metadataField, userFieldsNamed, userModel, userTable, withUserColumns };

package/dist/better-auth/users.d.ts

@@ -8,12 +8,14 @@ export type LinkedAccount = {
   providerId: string;
   accountId: string;
 };
+/** `metadata` lands in the user metadata column, which `createAuth`'s `users.metadata` names; it needs one. */
 export type NewUser = {
   email: string;
   password: string;
   name?: string;
   role?: string;
   accounts?: LinkedAccount[];
+  metadata?: Record<string, unknown>;
 };
 export type StoredUser = {
   id: string;

package/dist/better-auth/users.js

@@ -37,7 +37,8 @@ const createUser = async (auth, input) => {
 		email: input.email,
 		password: input.password,
 		name: input.name ?? input.email.split("@")[0],
-		role
+		role,
+		...input.metadata && { data: { metadata: input.metadata } }
 	} });
 	const { internalAdapter } = await auth.$context;
 	for (const account of accounts) await internalAdapter.linkAccount({

package/dist/index.d.ts

@@ -45,10 +45,12 @@ import { isBackgroundWork, runInBackground } from "./background-work.js";
 import { checkViewQueries } from "./check-view-queries.js";
 import { ProjectConfig, defineConfig, mergeConfig } from "./project-config.js";
 import { consoleAuditQueue } from "./audit/console-queue.js";
-import { JwtOptions, jwtAuthenticator } from "./auth/jwt.js";
+import { JwtOptions, JwtVerifyOptions, jwtAuthenticator, jwtVerifier } from "./auth/jwt.js";
+import { ApiKeys, ApiKeysOptions, apiKeySettings, apiKeyVariables } from "./api-keys/api-key-settings.js";
+import { Caller, CallerOptions, apiKeyCaller } from "./api-keys/resolve-caller.js";
 import { HttpProblem, MissingCredentials, badRequest, forbidden, notFound, unauthorized } from "./problem.js";
 import { TrustedApp, withTrustedApps } from "./better-auth/app-tokens.js";
-import { BetterAuthAuthenticatorOptions, betterAuthAuthenticator } from "./better-auth/authenticator.js";
+import { BetterAuthAuthenticatorOptions, betterAuthAuthenticator, betterAuthTokens } from "./better-auth/authenticator.js";
 import { parseRoles } from "./better-auth/parse-roles.js";
 import { LinkedAccount, NewUser, StoredUser, createUser, deleteUser, hasUsers, listUsers, roleChoices, setUserBanned, setUserRole } from "./better-auth/users.js";
 import { IssueTokenOptions, issueToken, maxTokenTtlSeconds } from "./better-auth/tokens.js";
@@ -93,4 +95,4 @@ import { FatalJobError } from "./jobs/run-job.js";
 import { DrainResult, JobsRuntime, StartJobsOptions, startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
 import { checkJobsSchema, jobsSchema, jobsSchemaMigration } from "./jobs/schema.js";
-export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticatorOptions, type CapturedRow, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSource, type HistoryOptions, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type MemberInput, MissingCredentials, ModelError, type ModelSettings, type NewOrganization, type NewUser, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, addAppRoleToOwners, addMember, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, handleDroppedConnections, hasUsers, imageSize, isBackgroundWork, isCaptured, isJobDefinition, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storeFile, streamChatCompletion, subscription, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };
+export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApiKeys, type ApiKeysOptions, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticatorOptions, type Caller, type CallerOptions, type CapturedRow, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSource, type HistoryOptions, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type JwtVerifyOptions, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type MemberInput, MissingCredentials, ModelError, type ModelSettings, type NewOrganization, type NewUser, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, handleDroppedConnections, hasUsers, imageSize, isBackgroundWork, isCaptured, isJobDefinition, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storeFile, streamChatCompletion, subscription, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };

package/dist/index.js

@@ -49,9 +49,11 @@ import { handleDroppedConnections } from "./dropped-connections.js";
 import { configExports } from "./resource-source.js";
 import { checkViewQueries } from "./check-view-queries.js";
 import { defineConfig, mergeConfig } from "./project-config.js";
-import { jwtAuthenticator } from "./auth/jwt.js";
+import { jwtAuthenticator, jwtVerifier } from "./auth/jwt.js";
+import { apiKeySettings, apiKeyVariables } from "./api-keys/api-key-settings.js";
+import { apiKeyCaller } from "./api-keys/resolve-caller.js";
 import { withTrustedApps } from "./better-auth/app-tokens.js";
-import { betterAuthAuthenticator } from "./better-auth/authenticator.js";
+import { betterAuthAuthenticator, betterAuthTokens } from "./better-auth/authenticator.js";
 import { issueToken, maxTokenTtlSeconds } from "./better-auth/tokens.js";
 import { authSchemaMigration, checkAuthSchema } from "./better-auth/auth-schema.js";
 import { checkComputed, computedMigration } from "./computed/computed-schema.js";
@@ -70,4 +72,4 @@ import { aspectRatio, fileSize, fileType, imageSize, processor } from "./files/p
 import { defineEmail } from "./mail/define-email.js";
 import { startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
-export { FatalJobError, HttpProblem, MissingCredentials, ModelError, addAppRoleToOwners, addMember, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, handleDroppedConnections, hasUsers, imageSize, isBackgroundWork, isCaptured, isJobDefinition, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storeFile, streamChatCompletion, subscription, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };
+export { FatalJobError, HttpProblem, MissingCredentials, ModelError, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, handleDroppedConnections, hasUsers, imageSize, isBackgroundWork, isCaptured, isJobDefinition, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storeFile, streamChatCompletion, subscription, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.25.9",
+  "version": "0.25.11",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -32,14 +32,15 @@
   "dependencies": {
     "@better-auth/passkey": "^1.7.7",
     "@better-auth/sso": "^1.7.7",
-    "@protobase/layout": "0.25.9",
-    "@protobase/query": "0.25.9",
-    "@protobase/schema": "0.25.9",
+    "@protobase/layout": "0.25.11",
+    "@protobase/query": "0.25.11",
+    "@protobase/schema": "0.25.11",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",
     "@simplewebauthn/server": "^13.3.1",
     "altcha-lib": "^2.6.0",
+    "bcryptjs": "^3.0.3",
     "better-auth": "^1.7.7",
     "cron-parser": "^5.10.1",
     "file-type": "^22.1.1",