@protobase/server 0.47.0 → 0.48.0

package/dist/auth-store.d.ts

@@ -0,0 +1,3 @@
+import { storeTableNames } from "./better-auth/store/table-names.js";
+import { migrationsTableName } from "./better-auth/store/migrations-table.js";
+export { migrationsTableName, storeTableNames };

package/dist/auth-store.js

@@ -0,0 +1,3 @@
+import { migrationsTableName } from "./better-auth/store/migrations-table.js";
+import { storeTableNames } from "./better-auth/store/table-names.js";
+export { migrationsTableName, storeTableNames };

package/dist/better-auth/auth-schema.d.ts

@@ -1,17 +1,16 @@
 import { AdminAuth } from "./create-auth.js";
 //#region src/better-auth/auth-schema.d.ts
 /**
- * The SQL that brings the admin store up to what this version of Protobase and the project's Better Auth plugins need:
- * for a store with the camelCase names of Protobase 0.6, their rename to snake_case (`snakeCaseMigration`); otherwise
- * new tables, columns and indexes, each skipped where it exists, and never a drop but of MCP's tables once MCP is off
- * (`dropMcpTables`). `undefined` when the store is current. A change Better Auth cannot make safely, such as a required
- * column without a default on a table with rows, is an error.
+ * The SQL that brings the admin store to this version of Protobase: the migrations it has not applied, each followed by
+ * its row in `auth_migrations`; for a new store, that table first. A store an earlier Protobase made without the record
+ * is adopted: the migrations it matches are recorded as applied (`planAdoption`), the others follow. `undefined` when
+ * the store is current. The SQL never drops anything.
  */
 export declare const authSchemaMigration: (auth: AdminAuth) => Promise<string | undefined>;
 /**
- * Refuses to go on while the admin store lacks a table or column Better Auth needs, still has the camelCase names of
- * Protobase 0.6, since every sign-in would fail, or still has MCP's tables with MCP off, since their grants would come
- * back with MCP. The server never changes the schema itself: the project's migrations do, before the new version serves.
+ * Refuses to go on while the admin store has not applied every migration of this version of Protobase, from its
+ * `auth_migrations` alone, since every sign-in would fail. The server never changes the schema itself: the project's
+ * migrations do, before the new version serves.
  */
 export declare const checkAuthSchema: (auth: AdminAuth) => Promise<void>;
 //#endregion

package/dist/better-auth/auth-schema.js

@@ -1,54 +1,52 @@
-import { storeSchema } from "./auth-tables.js";
-import { dropMcpTables, leftoverMcpTables, mcpTableNames, withMcpTables } from "./mcp/mcp-tables.js";
-import { snakeCaseMigration } from "./snake-case-migration.js";
-import { getMigrations } from "better-auth/db/migration";
+import { storeNames } from "./store/store-names.js";
+import { latestStoreVersion, storeMigrations } from "./store/migrations/index.js";
+import { appliedVersions, migrationsTableName } from "./store/migrations-table.js";
+import { migrationSql, migrationsTableSql } from "./store/migration-sql.js";
+import { adoptionSql, planAdoption, storeHasTables } from "./store/adoption.js";
+import { storeDb } from "./store/store-db.js";
 //#region src/better-auth/auth-schema.ts
 /** The command that writes the pending changes as a migration file of the project. */
 const authMigrationCommand = "protobase auth migration";
+const refuseNewer = (applied) => {
+	const newest = applied.at(-1);
+	if (newest !== void 0 && newest > latestStoreVersion) throw new Error(`The auth store is at migration ${newest}, newer than the ${latestStoreVersion} this version of Protobase knows; upgrade Protobase`);
+};
 /**
-* Better Auth's statements, each made to skip what exists already, so a migration written from an empty database also
-* applies to one an earlier Protobase set up in place.
-*/
-const skipExisting = (sql) => sql.split(";\n\n").map((statement) => statement.replace(/^create table (?!if not exists )/, "create table if not exists ").replace(/^create (unique )?index (?!if not exists )/, (_, unique) => `create ${unique ?? ""}index if not exists `).replace(/^(alter table .+? )add column (?!if not exists )/, "$1add column if not exists ")).join(";\n\n");
-/**
-* Better Auth adds `email_verified` to a `user` table that exists only when the table still has the camelCase names
-* of Protobase 0.6, whose `emailVerified` it does not know: such a store is renamed, never given new columns beside
-* the old ones.
-*/
-const hasCamelCaseNames = ({ toBeAdded }) => toBeAdded.some(({ table, fields }) => table === "user" && "email_verified" in fields);
-/**
-* The SQL that brings the admin store up to what this version of Protobase and the project's Better Auth plugins need:
-* for a store with the camelCase names of Protobase 0.6, their rename to snake_case (`snakeCaseMigration`); otherwise
-* new tables, columns and indexes, each skipped where it exists, and never a drop but of MCP's tables once MCP is off
-* (`dropMcpTables`). `undefined` when the store is current. A change Better Auth cannot make safely, such as a required
-* column without a default on a table with rows, is an error.
+* The SQL that brings the admin store to this version of Protobase: the migrations it has not applied, each followed by
+* its row in `auth_migrations`; for a new store, that table first. A store an earlier Protobase made without the record
+* is adopted: the migrations it matches are recorded as applied (`planAdoption`), the others follow. `undefined` when
+* the store is current. The SQL never drops anything.
 */
 const authSchemaMigration = async (auth) => {
-	const found = await getMigrations(withMcpTables(auth), { throwOnUnsafe: false });
-	if (hasCamelCaseNames(found)) return snakeCaseMigration(storeSchema(auth));
-	const drop = leftoverMcpTables(auth, found).length > 0 ? [dropMcpTables(storeSchema(auth))] : [];
-	const { toBeCreated, toBeAdded, toBeAddedIndexes, compileMigrations } = await getMigrations(auth.options);
-	const statements = [...toBeCreated.length === 0 && toBeAdded.length === 0 && toBeAddedIndexes.length === 0 ? [] : [skipExisting(await compileMigrations())], ...drop];
-	return statements.length === 0 ? void 0 : statements.join("\n\n");
+	const names = storeNames(auth);
+	const db = storeDb(auth);
+	const applied = await appliedVersions(db, names);
+	if (applied !== void 0) {
+		refuseNewer(applied);
+		const pending = storeMigrations.filter((migration) => !applied.includes(migration.version));
+		return pending.length === 0 ? void 0 : pending.map((migration) => migrationSql(names, migration)).join("\n\n");
+	}
+	if (!await storeHasTables(db, names)) return [migrationsTableSql(names), ...storeMigrations.map((migration) => migrationSql(names, migration))].join("\n\n");
+	const { adopted, pending } = await planAdoption(db, names);
+	return [
+		migrationsTableSql(names),
+		adoptionSql(names, adopted),
+		...pending.map((migration) => migrationSql(names, migration))
+	].join("\n\n");
 };
 /**
-* The tables and `table.column`s the admin store lacks; an index missing is not a reason to refuse requests. MCP's
-* tables, named with MCP off only to find them left over, are never missing then.
-*/
-const missingTablesAndColumns = (auth, { toBeCreated, toBeAdded }) => [...toBeCreated.map(({ table }) => table).filter((table) => auth.mcp || !mcpTableNames.includes(table)), ...toBeAdded.flatMap(({ table, fields }) => Object.keys(fields).map((field) => `${table}.${field}`))];
-/**
-* Refuses to go on while the admin store lacks a table or column Better Auth needs, still has the camelCase names of
-* Protobase 0.6, since every sign-in would fail, or still has MCP's tables with MCP off, since their grants would come
-* back with MCP. The server never changes the schema itself: the project's migrations do, before the new version serves.
+* Refuses to go on while the admin store has not applied every migration of this version of Protobase, from its
+* `auth_migrations` alone, since every sign-in would fail. The server never changes the schema itself: the project's
+* migrations do, before the new version serves.
 */
 const checkAuthSchema = async (auth) => {
-	const plan = await getMigrations(withMcpTables(auth), { throwOnUnsafe: false });
-	if (hasCamelCaseNames(plan)) throw new Error(`The auth schema still has the camelCase names of Protobase 0.6, which this version names in snake_case. Write their rename as a migration with \`${authMigrationCommand}\`, apply it with the project's migrations, then start again.`);
-	const missing = missingTablesAndColumns(auth, plan);
-	if (missing.length > 0) throw new Error(`The auth schema is behind this version of Protobase (missing ${missing.join(", ")}). Write the change as a migration with \`${authMigrationCommand}\`, apply it with the project's migrations, then start again.`);
-	const leftovers = leftoverMcpTables(auth, plan);
-	if (leftovers.length === 0) return;
-	throw new Error(`The auth schema still has the tables of the OAuth provider for MCP (${leftovers.join(", ")}), which is off. Write their removal as a migration with \`${authMigrationCommand}\`, apply it with the project's migrations, then start again; every MCP client then has to be allowed again.`);
+	const applied = await appliedVersions(storeDb(auth), storeNames(auth));
+	const write = `Write it as a migration with \`${authMigrationCommand}\`, apply it with the project's migrations, then start again.`;
+	if (applied === void 0) throw new Error(`The auth store has no ${migrationsTableName} table: it is new, or an earlier Protobase made it. ${write}`);
+	refuseNewer(applied);
+	const missing = storeMigrations.filter((migration) => !applied.includes(migration.version));
+	if (missing.length === 0) return;
+	throw new Error(`The auth schema is behind this version of Protobase (missing migrations ${missing.map(({ version, name }) => `${version} ${name}`).join(", ")}). ${write}`);
 };
 //#endregion
-export { authMigrationCommand, authSchemaMigration, checkAuthSchema, skipExisting };
+export { authMigrationCommand, authSchemaMigration, checkAuthSchema };

package/dist/better-auth/auth-tables.d.ts

@@ -1,6 +1,6 @@
 import { AdminAuth } from "./create-auth.js";
 //#region src/better-auth/auth-tables.d.ts
-/** The admin store's tables with every plugin the project's auth has, which the assistant's queries must never read. */
+/** The admin store's tables, which the assistant's queries and the app's resources must never read: the user table and `storeTableNames`. */
 export declare const authStoreTables: (auth: AdminAuth) => {
   schema: string | undefined;
   name: string;

package/dist/better-auth/auth-tables.js

@@ -1,11 +1,13 @@
-import { getSchema } from "better-auth/db";
+import { storeNames } from "./store/store-names.js";
+import { storeTableNames } from "./store/table-names.js";
 //#region src/better-auth/auth-tables.ts
-/** The schema the admin store lives in; the search path decides when its options name none. */
-const storeSchema = ({ options: { database } }) => database && "schemaName" in database ? database.schemaName : void 0;
-/** The admin store's tables with every plugin the project's auth has, which the assistant's queries must never read. */
-const authStoreTables = (auth) => Object.keys(getSchema(auth.options)).map((name) => ({
-	schema: storeSchema(auth),
-	name
-}));
+/** The admin store's tables, which the assistant's queries and the app's resources must never read: the user table and `storeTableNames`. */
+const authStoreTables = (auth) => {
+	const { schema, users } = storeNames(auth);
+	return [users.modelName, ...storeTableNames].map((name) => ({
+		schema,
+		name
+	}));
+};
 //#endregion
-export { authStoreTables, storeSchema };
+export { authStoreTables };

package/dist/better-auth/authenticator.d.ts

@@ -1,8 +1,8 @@
-import { AdminAuth } from "./create-auth.js";
 import { Authenticator, TenantValue } from "../types.js";
 import { JwtVerifyOptions } from "../auth/jwt.js";
 import { TrustedApp } from "./app-tokens.js";
 import { JwksCacheOptions } from "./jwks-cache.js";
+import { AdminAuth } from "./create-auth.js";
 //#region src/better-auth/authenticator.d.ts
 export type BetterAuthAuthenticatorOptions = {
   /** The Better Auth instance of this process: keys are read from it directly, no HTTP round trip. */

package/dist/better-auth/create-auth.d.ts

@@ -1,21 +1,21 @@
-import { StaffSignIn } from "./staff-log.js";
+import { UserColumn, UserTableOptions } from "./user-table.js";
+import { Mailer } from "../mail/smtp-mailer.js";
+import { SignInPolicy } from "./sign-in-policy.js";
+import { OperatorProvider } from "./operator-provider.js";
+import { PlatformSignIn } from "./platform-sign-in.js";
 import { RoleDefinitions, RolesInput } from "./organizations/role-definitions.js";
+import { OrganizationRole } from "./organizations/store.js";
+import { OrganizationsOptions, ResolvedOrganizations } from "./organizations/options.js";
+import { StaffSignIn } from "./staff-log.js";
+import "../index.js";
 import { ConnectedApp } from "./mcp/connected-apps.js";
 import { ReplacingContext } from "./end-replaced-session.js";
 import { UserDeletionListener } from "./user-deletion.js";
 import "./auth-base-path.js";
-import { Mailer } from "../mail/smtp-mailer.js";
-import { OperatorProvider } from "./operator-provider.js";
-import { OrganizationRole } from "./organizations/store.js";
-import { SignInPolicy } from "./sign-in-policy.js";
 import { McpAuthOptions } from "./mcp/mcp-plugins.js";
-import { OrganizationsOptions, ResolvedOrganizations } from "./organizations/options.js";
-import { PlatformSignIn } from "./platform-sign-in.js";
 import { SsoOptions } from "./saml-sign-in.js";
 import { signUpPaths } from "./sign-up/sign-up-plugin.js";
 import { PasswordHash } from "./password-hashes.js";
-import { UserTableOptions } from "./user-table.js";
-import "../index.js";
 import { BetterAuthOptions } from "better-auth";
 import { JwtOptions } from "better-auth/plugins";
 //#region src/better-auth/create-auth.d.ts
@@ -8752,9 +8752,6 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
     };
   };
   advanced: {
-    database?: {
-      generateId: "uuid";
-    } | undefined;
     useSecureCookies: boolean;
     cookiePrefix: string;
     defaultCookieAttributes: {
@@ -8764,6 +8761,10 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
     backgroundTasks: {
       handler: () => void;
     };
+    database: {
+      generateId?: "uuid" | undefined;
+      validateSchema: false;
+    };
   };
   socialProviders?: import("better-auth").SocialProviders | undefined;
   appName: string;
@@ -8839,6 +8840,13 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
   signUpRole: string | undefined;
   /** The app keeps each user's metadata, in the column `users.metadata` names. */
   userMetadata: boolean;
+  /** The user table's name and columns, as `users` names them, for the store's migrations. */
+  userTable: {
+    modelName: string;
+    column: (name: UserColumn) => string;
+    fieldNames: Record<string, string>;
+    metadata: string | undefined;
+  };
   socialProviders: string[];
   /** The app's name it signs in and mails as: `PROTOBASE_APP_NAME`, else `appName`, else `Protobase`. */
   appName: string;

package/dist/better-auth/create-auth.js

@@ -306,7 +306,10 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 				secure
 			},
 			backgroundTasks: { handler: () => {} },
-			...options.generateUserId === "uuid" && { database: { generateId: "uuid" } }
+			database: {
+				validateSchema: false,
+				...options.generateUserId === "uuid" && { generateId: "uuid" }
+			}
 		}
 	};
 };
@@ -402,6 +405,8 @@ const createAuth = (options) => {
 		signUpRole: mailer ? signUpRole : void 0,
 		/** The app keeps each user's metadata, in the column `users.metadata` names. */
 		userMetadata: Boolean(options.users?.metadata),
+		/** The user table's name and columns, as `users` names them, for the store's migrations. */
+		userTable: userTable(options.users),
 		socialProviders,
 		/** The app's name it signs in and mails as: `PROTOBASE_APP_NAME`, else `appName`, else `Protobase`. */
 		appName: appName ?? "Protobase",

package/dist/better-auth/mcp/mcp-plugins.d.ts

@@ -1,5 +1,5 @@
-import "./connected-apps.js";
 import "../organizations/store.js";
+import "./connected-apps.js";
 import { ClientMetadataResourceFetch } from "@better-auth/oauth-provider";
 //#region src/better-auth/mcp/mcp-plugins.d.ts
 export type McpAuthOptions = {

package/dist/better-auth/store/adoption.js

@@ -0,0 +1,87 @@
+import { ddl } from "./ddl.js";
+import { migrationNames } from "./migrations/migration.js";
+import { storeMigrations } from "./migrations/index.js";
+import { recordMigrations } from "./migrations-table.js";
+import { statementsSql } from "./migration-sql.js";
+import { sql } from "kysely";
+//#region src/better-auth/store/adoption.ts
+const key = ({ table, column }) => `${table}.${column}`;
+const columnsIn = async (db, schema) => (await sql`select table_name as "table", column_name as "column", udt_name as "type" from information_schema.columns
+      where table_schema = ${schema === void 0 ? sql`current_schema()` : schema} order by table_name, ordinal_position`.execute(db)).rows;
+const scratchSchema = "protobase_auth_adoption";
+/** For each migration, the columns it makes: every one runs in a scratch schema, in a transaction that is rolled back. */
+const madeColumns = async (db, names) => {
+	const tx = await db.startTransaction().execute();
+	const run = async () => {
+		await sql`create schema ${sql.id(scratchSchema)}`.execute(tx);
+		const scratch = migrationNames({
+			...names,
+			schema: scratchSchema
+		});
+		const made = [];
+		let before = [];
+		for (const migration of storeMigrations) {
+			for (const statement of migration.statements(scratch)) await statement.execute(tx);
+			const after = await columnsIn(tx, scratchSchema);
+			made.push(after.filter((column) => !before.some((earlier) => key(earlier) === key(column))));
+			before = after;
+		}
+		return made;
+	};
+	return run().finally(() => tx.rollback().execute());
+};
+/** Whether the store has any table of the migrations besides the user table, which may be another system's. */
+const storeHasTables = async (db, names) => {
+	const tables = new Set((await columnsIn(db, names.schema)).map((column) => column.table));
+	return storeMigrations.some((migration) => migration.tables.some((table) => tables.has(table)));
+};
+/** Which migrations the store matches and which it still needs; a migration it matches only partly is an error. */
+const planAdoption = async (db, names) => {
+	const made = await madeColumns(db, names);
+	const found = new Map((await columnsIn(db, names.schema)).map((column) => [key(column), column.type]));
+	const adoption = {
+		adopted: [],
+		pending: []
+	};
+	const problems = [];
+	storeMigrations.forEach((migration, i) => {
+		const columns = made[i];
+		const there = columns.filter((column) => found.has(key(column)));
+		if (there.length === 0) return void adoption.pending.push(migration);
+		const missing = columns.filter((column) => !found.has(key(column))).map((column) => `lacks ${key(column)}`);
+		const otherType = there.filter((column) => found.get(key(column)) !== column.type).map((column) => `has ${key(column)} as ${found.get(key(column))}, not ${column.type}`);
+		if (missing.length === 0 && otherType.length === 0) return void adoption.adopted.push({
+			migration,
+			columns
+		});
+		problems.push(`${migration.version} ${migration.name} ${[...missing, ...otherType].join(", ")}`);
+	});
+	if (problems.length > 0) throw new Error(`The auth store an earlier Protobase made matches none of its migrations' versions: ${problems.join("; ")}. Bring it to the schema of Protobase 0.47 first, with that version's \`protobase auth migration\`, then run this again.`);
+	return adoption;
+};
+/**
+* The SQL that records the adopted migrations as applied, once it finds every column they make with its type; it
+* stops the migration, naming what it lacks, on a database that differs from the one it was written from.
+*/
+const adoptionSql = (names, adopted) => {
+	const expected = adopted.flatMap(({ columns }) => columns).map(({ table, column, type }) => ddl`(${sql.lit(table)}, ${sql.lit(column)}, ${sql.lit(type)})`);
+	const schema = names.schema === void 0 ? sql`current_schema()` : sql.lit(names.schema);
+	const check = ddl`do $adopt$
+declare
+  missing text;
+begin
+  select string_agg(expected.table_name || '.' || expected.column_name, ', ' order by expected.table_name, expected.column_name) into missing
+  from (values ${sql.join(expected, sql`,\n    `)}) as expected (table_name, column_name, udt_name)
+  where not exists (
+    select from information_schema.columns found
+    where found.table_schema = ${schema} and found.table_name = expected.table_name and found.column_name = expected.column_name and found.udt_name = expected.udt_name
+  );
+  if missing is not null then
+    raise exception 'The auth store does not match the migrations this file adopts: it lacks %, or has them as other types', missing;
+  end if;
+end
+$adopt$`;
+	return `-- The auth store an earlier Protobase made, without a record of its migrations, adopted: ${adopted.map(({ migration }) => `${migration.version} ${migration.name}`).join(", ")}\n-- recorded as applied, once every table and column they make is there.\n${statementsSql([check, recordMigrations(names, adopted.map(({ migration }) => migration))])}`;
+};
+//#endregion
+export { adoptionSql, planAdoption, storeHasTables };

package/dist/better-auth/store/ddl.js

@@ -0,0 +1,18 @@
+import { DummyDriver, Kysely, PostgresAdapter, PostgresIntrospector, PostgresQueryCompiler, sql } from "kysely";
+//#region src/better-auth/store/ddl.ts
+/** A fragment of SQL whose strings are identifiers: `ddl\`create table ${'user'} (...)\`` is `create table "user" (...)`. */
+const ddl = (strings, ...parts) => sql(strings, ...parts.map((part) => typeof part === "string" ? sql.id(part) : part));
+const compiler = new Kysely({ dialect: {
+	createAdapter: () => new PostgresAdapter(),
+	createDriver: () => new DummyDriver(),
+	createIntrospector: (db) => new PostgresIntrospector(db),
+	createQueryCompiler: () => new PostgresQueryCompiler()
+} });
+/** The text of a fragment. One that holds a parameter, a value given as neither identifier nor `sql.lit`, is an error. */
+const ddlText = (fragment) => {
+	const { sql: text, parameters } = fragment.compile(compiler);
+	if (parameters.length > 0) throw new Error(`A migration statement has no parameters; give each value with sql.lit: ${text}`);
+	return text;
+};
+//#endregion
+export { ddl, ddlText };

package/dist/better-auth/store/drift.d.ts

@@ -0,0 +1,9 @@
+import { AdminAuth } from "../create-auth.js";
+//#region src/better-auth/store/drift.d.ts
+/**
+ * What Better Auth, with the features the app turns on, finds the store lacks or has otherwise: tables, `table.column`s,
+ * indexes and its other findings; none when the store matches. It compares the database's tables, so only
+ * `protobase dev` runs it, on the developer's machine: a deploy reads the record of migrations instead (`checkAuthSchema`).
+ */
+export declare const authSchemaDrift: (auth: AdminAuth) => Promise<string[]>;
+//#endregion

package/dist/better-auth/store/drift.js

@@ -0,0 +1,18 @@
+import { getMigrations } from "better-auth/db/migration";
+//#region src/better-auth/store/drift.ts
+/**
+* What Better Auth, with the features the app turns on, finds the store lacks or has otherwise: tables, `table.column`s,
+* indexes and its other findings; none when the store matches. It compares the database's tables, so only
+* `protobase dev` runs it, on the developer's machine: a deploy reads the record of migrations instead (`checkAuthSchema`).
+*/
+const authSchemaDrift = async (auth) => {
+	const { toBeCreated, toBeAdded, toBeAddedIndexes, schemaProblems } = await getMigrations(auth.options, { throwOnUnsafe: false });
+	return [
+		...toBeCreated.map(({ table }) => `lacks the table ${table}`),
+		...toBeAdded.flatMap(({ table, fields }) => Object.keys(fields).map((field) => `lacks the column ${table}.${field}`)),
+		...toBeAddedIndexes.map(({ name }) => `lacks the index ${name}`),
+		...schemaProblems
+	];
+};
+//#endregion
+export { authSchemaDrift };

package/dist/better-auth/store/migration-sql.js

@@ -0,0 +1,15 @@
+import { ddl, ddlText } from "./ddl.js";
+import { migrationNames } from "./migrations/migration.js";
+import { createMigrationsTable, recordMigrations } from "./migrations-table.js";
+//#region src/better-auth/store/migration-sql.ts
+/** The statements as SQL text. */
+const statementsSql = (statements) => statements.map((statement) => `${ddlText(statement)};`).join("\n\n");
+/** A migration's statements, then the row that records it, under a comment naming it. */
+const migrationSql = (names, migration) => `-- ${migration.version} ${migration.name}: ${migration.title}.\n${statementsSql([...migration.statements(migrationNames(names)), recordMigrations(names, [migration])])}`;
+/** The migrations table, for a store that has none yet, in the store's schema, made when it is missing. */
+const migrationsTableSql = (names) => {
+	const schema = names.schema === void 0 ? [] : [ddl`create schema if not exists ${names.schema}`];
+	return `-- The record of the auth store's migrations.\n${statementsSql([...schema, createMigrationsTable(names)])}`;
+};
+//#endregion
+export { migrationSql, migrationsTableSql, statementsSql };

package/dist/better-auth/store/migrations/001-core.js

@@ -0,0 +1,80 @@
+import { ddl } from "../ddl.js";
+//#region src/better-auth/store/migrations/001-core.ts
+/** Sign-in itself: users, with their roles and bans, sessions, accounts, codes and the token signing keys. */
+const core = {
+	version: 1,
+	name: "core",
+	title: "Better Auth's users, sessions, accounts, verifications and signing keys",
+	tables: [
+		"session",
+		"account",
+		"verification",
+		"jwks"
+	],
+	statements: ({ table, user, userColumn: column, metadata, id, idRef }) => [
+		ddl`create table if not exists ${user} (id ${id} primary key)`,
+		ddl`alter table ${user}
+  add column if not exists ${column("name")} text not null,
+  add column if not exists ${column("email")} text not null unique,
+  add column if not exists ${column("email_verified")} boolean not null,
+  add column if not exists ${column("image")} text,
+  add column if not exists ${column("created_at")} timestamptz default current_timestamp not null,
+  add column if not exists ${column("updated_at")} timestamptz default current_timestamp not null,
+  add column if not exists ${column("role")} text,
+  add column if not exists ${column("banned")} boolean,
+  add column if not exists ${column("ban_reason")} text,
+  add column if not exists ${column("ban_expires")} timestamptz,
+  add column if not exists ${column("last_role")} text,
+  add column if not exists ${column("email_confirmed_at")} timestamptz`,
+		...metadata ? [ddl`alter table ${user} add column if not exists ${metadata} jsonb`] : [],
+		ddl`create table ${table("session")} (
+  id ${id} primary key,
+  expires_at timestamptz not null,
+  token text not null unique,
+  created_at timestamptz default current_timestamp not null,
+  updated_at timestamptz not null,
+  ip_address text,
+  user_agent text,
+  user_id ${idRef} not null references ${user} (id) on delete cascade,
+  impersonated_by text,
+  active_role text
+)`,
+		ddl`create index session_user_id_idx on ${table("session")} (user_id)`,
+		ddl`create table ${table("account")} (
+  id ${id} primary key,
+  account_id text not null,
+  provider_id text not null,
+  user_id ${idRef} not null references ${user} (id) on delete cascade,
+  access_token text,
+  refresh_token text,
+  id_token text,
+  access_token_expires_at timestamptz,
+  refresh_token_expires_at timestamptz,
+  scope text,
+  password text,
+  created_at timestamptz default current_timestamp not null,
+  updated_at timestamptz not null
+)`,
+		ddl`create index account_user_id_idx on ${table("account")} (user_id)`,
+		ddl`create table ${table("verification")} (
+  id ${id} primary key,
+  identifier text not null,
+  value text not null,
+  expires_at timestamptz not null,
+  created_at timestamptz default current_timestamp not null,
+  updated_at timestamptz default current_timestamp not null
+)`,
+		ddl`create index verification_identifier_idx on ${table("verification")} (identifier)`,
+		ddl`create table ${table("jwks")} (
+  id ${id} primary key,
+  public_key text not null,
+  private_key text not null,
+  created_at timestamptz not null,
+  expires_at timestamptz,
+  alg text,
+  crv text
+)`
+	]
+};
+//#endregion
+export { core };

package/dist/better-auth/store/migrations/002-two-factor.js

@@ -0,0 +1,25 @@
+import { ddl } from "../ddl.js";
+//#region src/better-auth/store/migrations/002-two-factor.ts
+/** Two-step sign-in: each user's authenticator secret and backup codes. */
+const twoFactor = {
+	version: 2,
+	name: "two_factor",
+	title: "The authenticator secrets and backup codes of two-step sign-in",
+	tables: ["two_factor"],
+	statements: ({ table, user, userColumn: column, id, idRef }) => [
+		ddl`alter table ${user} add column if not exists ${column("two_factor_enabled")} boolean`,
+		ddl`create table ${table("two_factor")} (
+  id ${id} primary key,
+  secret text not null,
+  backup_codes text not null,
+  user_id ${idRef} not null references ${user} (id) on delete cascade,
+  verified boolean,
+  failed_verification_count integer,
+  locked_until timestamptz
+)`,
+		ddl`create index two_factor_secret_idx on ${table("two_factor")} (secret)`,
+		ddl`create index two_factor_user_id_idx on ${table("two_factor")} (user_id)`
+	]
+};
+//#endregion
+export { twoFactor };

package/dist/better-auth/store/migrations/003-passkeys.js

@@ -0,0 +1,29 @@
+import { ddl } from "../ddl.js";
+//#region src/better-auth/store/migrations/003-passkeys.ts
+/** Passkeys, each with the RP ID it was made for. */
+const passkeys = {
+	version: 3,
+	name: "passkeys",
+	title: "The users' passkeys",
+	tables: ["passkey"],
+	statements: ({ table, user, id, idRef }) => [
+		ddl`create table ${table("passkey")} (
+  id ${id} primary key,
+  name text,
+  public_key text not null,
+  user_id ${idRef} not null references ${user} (id) on delete cascade,
+  credential_id text not null,
+  counter integer not null,
+  device_type text not null,
+  backed_up boolean not null,
+  transports text,
+  created_at timestamptz,
+  aaguid text,
+  rp_id text
+)`,
+		ddl`create index passkey_user_id_idx on ${table("passkey")} (user_id)`,
+		ddl`create index passkey_credential_id_idx on ${table("passkey")} (credential_id)`
+	]
+};
+//#endregion
+export { passkeys };

package/dist/better-auth/store/migrations/004-sign-in-policy.js

@@ -0,0 +1,22 @@
+import { ddl } from "../ddl.js";
+//#region src/better-auth/store/migrations/004-sign-in-policy.ts
+/** The sign-in policy admins save, each save a row of its own. */
+const signInPolicy = {
+	version: 4,
+	name: "sign_in_policy",
+	title: "The sign-in policies admins saved",
+	tables: ["sign_in_policy"],
+	statements: ({ table, id }) => [ddl`create table ${table("sign_in_policy")} (
+  id ${id} primary key,
+  password text not null,
+  email_code text not null,
+  passkey text not null,
+  two_factor text not null,
+  staff_access text not null,
+  platform_sign_in text not null,
+  created_at timestamptz not null,
+  created_by text
+)`]
+};
+//#endregion
+export { signInPolicy };

package/dist/better-auth/store/migrations/005-staff-sign-in.js

@@ -0,0 +1,25 @@
+import { ddl } from "../ddl.js";
+//#region src/better-auth/store/migrations/005-staff-sign-in.ts
+/** The log of the operator's staff signing in as the app's people. */
+const staffSignIn = {
+	version: 5,
+	name: "staff_sign_in",
+	title: "The log of staff sign-ins as the app's people",
+	tables: ["staff_sign_in"],
+	statements: ({ table, id }) => [ddl`create table ${table("staff_sign_in")} (
+  id ${id} primary key,
+  user_id text not null,
+  user_email text not null,
+  staff text not null,
+  staff_name text,
+  staff_subject text not null,
+  issuer text not null,
+  reason text not null,
+  session_id text not null,
+  started_at timestamptz not null,
+  expires_at timestamptz not null,
+  ended_at timestamptz
+)`]
+};
+//#endregion
+export { staffSignIn };