@protobase/server 0.47.1 → 0.48.0

package/dist/better-auth/store/migrations/006-organizations.js

@@ -0,0 +1,50 @@
+import { ddl } from "../ddl.js";
+//#region src/better-auth/store/migrations/006-organizations.ts
+/** Organizations, their members and invitations, and the organization each user and session works in. */
+const organizations = {
+	version: 6,
+	name: "organizations",
+	title: "Organizations, their members and their invitations",
+	tables: [
+		"organization",
+		"member",
+		"invitation"
+	],
+	statements: ({ table, user, userColumn: column, id, idRef }) => [
+		ddl`alter table ${user} add column if not exists ${column("last_organization_id")} text`,
+		ddl`alter table ${table("session")} add column active_organization_id text`,
+		ddl`create table ${table("organization")} (
+  id ${id} primary key,
+  name text not null,
+  slug text not null unique,
+  logo text,
+  created_at timestamptz not null,
+  metadata text
+)`,
+		ddl`create table ${table("member")} (
+  id ${id} primary key,
+  organization_id ${idRef} not null references ${table("organization")} (id) on delete cascade,
+  user_id ${idRef} not null references ${user} (id) on delete cascade,
+  role text not null,
+  created_at timestamptz not null,
+  app_roles jsonb
+)`,
+		ddl`create index member_organization_id_idx on ${table("member")} (organization_id)`,
+		ddl`create index member_user_id_idx on ${table("member")} (user_id)`,
+		ddl`create table ${table("invitation")} (
+  id ${id} primary key,
+  organization_id ${idRef} not null references ${table("organization")} (id) on delete cascade,
+  email text not null,
+  role text,
+  status text not null,
+  expires_at timestamptz not null,
+  created_at timestamptz default current_timestamp not null,
+  inviter_id ${idRef} not null references ${user} (id) on delete cascade,
+  app_roles jsonb
+)`,
+		ddl`create index invitation_organization_id_idx on ${table("invitation")} (organization_id)`,
+		ddl`create index invitation_email_idx on ${table("invitation")} (email)`
+	]
+};
+//#endregion
+export { organizations };

package/dist/better-auth/store/migrations/007-mcp.js

@@ -0,0 +1,150 @@
+import { ddl } from "../ddl.js";
+//#region src/better-auth/store/migrations/007-mcp.ts
+/** The OAuth provider MCP clients sign in through: its clients, resources, tokens and consents. */
+const mcp = {
+	version: 7,
+	name: "mcp",
+	title: "The clients, resources, tokens and consents of the OAuth provider for MCP",
+	tables: [
+		"oauth_client",
+		"oauth_resource",
+		"oauth_client_resource",
+		"oauth_refresh_token",
+		"oauth_access_token",
+		"oauth_consent",
+		"oauth_client_assertion"
+	],
+	statements: ({ table, user, id, idRef }) => [
+		ddl`create table ${table("oauth_client")} (
+  id ${id} primary key,
+  client_id text not null unique,
+  client_secret text,
+  client_discovery_id text,
+  disabled boolean,
+  skip_consent boolean,
+  enable_end_session boolean,
+  subject_type text,
+  scopes jsonb,
+  client_credentials_scopes jsonb,
+  user_id ${idRef} references ${user} (id) on delete cascade,
+  created_at timestamptz,
+  updated_at timestamptz,
+  name text,
+  uri text,
+  icon text,
+  contacts jsonb,
+  tos text,
+  policy text,
+  software_id text,
+  software_version text,
+  software_statement text,
+  redirect_uris jsonb not null,
+  post_logout_redirect_uris jsonb,
+  backchannel_logout_uri text,
+  backchannel_logout_session_required boolean,
+  token_endpoint_auth_method text,
+  application_type text,
+  jwks text,
+  jwks_uri text,
+  grant_types jsonb,
+  response_types jsonb,
+  require_pkce boolean,
+  dpop_bound_access_tokens boolean,
+  reference_id text,
+  metadata jsonb
+)`,
+		ddl`create index oauth_client_user_id_idx on ${table("oauth_client")} (user_id)`,
+		ddl`create table ${table("oauth_resource")} (
+  id ${id} primary key,
+  identifier text not null unique,
+  name text not null,
+  access_token_ttl integer,
+  refresh_token_ttl integer,
+  signing_algorithm text,
+  signing_key_id text,
+  allowed_scopes jsonb,
+  custom_claims jsonb,
+  dpop_bound_access_tokens_required boolean,
+  disabled boolean,
+  created_at timestamptz,
+  updated_at timestamptz,
+  policy_version integer,
+  metadata jsonb
+)`,
+		ddl`create table ${table("oauth_client_resource")} (
+  id ${id} primary key,
+  client_id text not null references ${table("oauth_client")} (client_id) on delete cascade,
+  resource_id text not null references ${table("oauth_resource")} (identifier) on delete cascade,
+  metadata jsonb,
+  created_at timestamptz
+)`,
+		ddl`create index oauth_client_resource_client_id_idx on ${table("oauth_client_resource")} (client_id)`,
+		ddl`create index oauth_client_resource_resource_id_idx on ${table("oauth_client_resource")} (resource_id)`,
+		ddl`create unique index oauth_client_resource_client_id_resource_id_uidx on ${table("oauth_client_resource")} (client_id, resource_id)`,
+		ddl`create table ${table("oauth_refresh_token")} (
+  id ${id} primary key,
+  token text not null unique,
+  client_id text not null references ${table("oauth_client")} (client_id) on delete cascade,
+  session_id ${idRef} references ${table("session")} (id) on delete set null,
+  user_id ${idRef} not null references ${user} (id) on delete cascade,
+  reference_id text,
+  authorization_code_id text,
+  resources jsonb,
+  requested_user_info_claims jsonb,
+  expires_at timestamptz not null,
+  created_at timestamptz not null,
+  revoked timestamptz,
+  rotated_at timestamptz,
+  rotation_replay_response text,
+  rotation_replay_expires_at timestamptz,
+  auth_time timestamptz,
+  confirmation jsonb,
+  scopes jsonb not null
+)`,
+		ddl`create index oauth_refresh_token_client_id_idx on ${table("oauth_refresh_token")} (client_id)`,
+		ddl`create index oauth_refresh_token_session_id_idx on ${table("oauth_refresh_token")} (session_id)`,
+		ddl`create index oauth_refresh_token_user_id_idx on ${table("oauth_refresh_token")} (user_id)`,
+		ddl`create index oauth_refresh_token_authorization_code_id_idx on ${table("oauth_refresh_token")} (authorization_code_id)`,
+		ddl`create table ${table("oauth_access_token")} (
+  id ${id} primary key,
+  token text not null unique,
+  client_id text not null references ${table("oauth_client")} (client_id) on delete cascade,
+  session_id ${idRef} references ${table("session")} (id) on delete set null,
+  user_id ${idRef} references ${user} (id) on delete cascade,
+  reference_id text,
+  authorization_code_id text,
+  resources jsonb,
+  requested_user_info_claims jsonb,
+  refresh_id ${idRef} references ${table("oauth_refresh_token")} (id) on delete cascade,
+  expires_at timestamptz not null,
+  created_at timestamptz not null,
+  revoked timestamptz,
+  confirmation jsonb,
+  scopes jsonb not null
+)`,
+		ddl`create index oauth_access_token_client_id_idx on ${table("oauth_access_token")} (client_id)`,
+		ddl`create index oauth_access_token_session_id_idx on ${table("oauth_access_token")} (session_id)`,
+		ddl`create index oauth_access_token_user_id_idx on ${table("oauth_access_token")} (user_id)`,
+		ddl`create index oauth_access_token_authorization_code_id_idx on ${table("oauth_access_token")} (authorization_code_id)`,
+		ddl`create index oauth_access_token_refresh_id_idx on ${table("oauth_access_token")} (refresh_id)`,
+		ddl`create table ${table("oauth_consent")} (
+  id ${id} primary key,
+  client_id text not null references ${table("oauth_client")} (client_id) on delete cascade,
+  user_id ${idRef} references ${user} (id) on delete cascade,
+  reference_id text,
+  resources jsonb,
+  requested_user_info_claims jsonb,
+  scopes jsonb not null,
+  created_at timestamptz not null,
+  updated_at timestamptz not null
+)`,
+		ddl`create index oauth_consent_client_id_idx on ${table("oauth_consent")} (client_id)`,
+		ddl`create index oauth_consent_user_id_idx on ${table("oauth_consent")} (user_id)`,
+		ddl`create table ${table("oauth_client_assertion")} (
+  id ${id} primary key,
+  expires_at timestamptz not null
+)`
+	]
+};
+//#endregion
+export { mcp };

package/dist/better-auth/store/migrations/index.js

@@ -0,0 +1,22 @@
+import { core } from "./001-core.js";
+import { twoFactor } from "./002-two-factor.js";
+import { passkeys } from "./003-passkeys.js";
+import { signInPolicy } from "./004-sign-in-policy.js";
+import { staffSignIn } from "./005-staff-sign-in.js";
+import { organizations } from "./006-organizations.js";
+import { mcp } from "./007-mcp.js";
+//#region src/better-auth/store/migrations/index.ts
+/** The auth store's migrations, by version. A new one goes last, with the next version. */
+const storeMigrations = [
+	core,
+	twoFactor,
+	passkeys,
+	signInPolicy,
+	staffSignIn,
+	organizations,
+	mcp
+];
+/** The version the store is at once every migration is applied. */
+const latestStoreVersion = storeMigrations.at(-1).version;
+//#endregion
+export { latestStoreVersion, storeMigrations };

package/dist/better-auth/store/migrations/migration.d.ts

@@ -0,0 +1,3 @@
+import "../../user-table.js";
+import "../store-names.js";
+import "kysely";

package/dist/better-auth/store/migrations/migration.js

@@ -0,0 +1,14 @@
+import { storeTable } from "../store-names.js";
+import { sql } from "kysely";
+//#region src/better-auth/store/migrations/migration.ts
+/** The `ddl` parts of the app's names. */
+const migrationNames = (names) => ({
+	table: (name) => storeTable(names, name),
+	user: storeTable(names, names.users.modelName),
+	userColumn: names.users.column,
+	metadata: names.users.metadata,
+	id: sql.raw(names.uuidIds ? "uuid default pg_catalog.gen_random_uuid()" : "text"),
+	idRef: sql.raw(names.uuidIds ? "uuid" : "text")
+});
+//#endregion
+export { migrationNames };

package/dist/better-auth/store/migrations-table.d.ts

@@ -0,0 +1,7 @@
+import "./store-names.js";
+import "./migrations/migration.js";
+import { Kysely } from "kysely";
+//#region src/better-auth/store/migrations-table.d.ts
+/** The table, in the store's schema. */
+export declare const migrationsTableName = "auth_migrations";
+//#endregion

package/dist/better-auth/store/migrations-table.js

@@ -0,0 +1,23 @@
+import { ddl, ddlText } from "./ddl.js";
+import { storeTable } from "./store-names.js";
+import { sql } from "kysely";
+//#region src/better-auth/store/migrations-table.ts
+/** The table, in the store's schema. */
+const migrationsTableName = "auth_migrations";
+const migrationsTable = (names) => storeTable(names, migrationsTableName);
+/** The statement that makes the table. */
+const createMigrationsTable = (names) => ddl`create table ${migrationsTable(names)} (
+  version integer primary key,
+  name text not null,
+  applied_at timestamptz default current_timestamp not null
+)`;
+/** The statement that records `migrations` as applied. */
+const recordMigrations = (names, migrations) => ddl`insert into ${migrationsTable(names)} (version, name) values ${sql.join(migrations.map(({ version, name }) => ddl`(${sql.lit(version)}, ${sql.lit(name)})`))}`;
+/** The versions the store has applied, in order; `undefined` when it has no migrations table. */
+const appliedVersions = async (db, names) => {
+	const [found] = (await sql`select to_regclass(${ddlText(migrationsTable(names))}) is not null as found`.execute(db)).rows;
+	if (!found?.found) return void 0;
+	return (await sql`select version from ${migrationsTable(names)} order by version`.execute(db)).rows.map((row) => row.version);
+};
+//#endregion
+export { appliedVersions, createMigrationsTable, migrationsTableName, recordMigrations };

package/dist/better-auth/store/resources-outside.d.ts

@@ -0,0 +1,7 @@
+import { AdminAuth } from "../create-auth.js";
+import { ResourceModel } from "@protobase/schema";
+import { Kysely } from "kysely";
+//#region src/better-auth/store/resources-outside.d.ts
+/** Refuses a resource over a table of the admin store: the user table, a feature's table or the record of migrations. */
+export declare const checkResourcesOutsideAuthStore: (db: Kysely<any>, models: readonly ResourceModel[], auth: AdminAuth) => Promise<void>;
+//#endregion

package/dist/better-auth/store/resources-outside.js

@@ -0,0 +1,20 @@
+import { storeDb } from "./store-db.js";
+import { authStoreTables } from "../auth-tables.js";
+import { sql } from "kysely";
+//#region src/better-auth/store/resources-outside.ts
+const quoted = (name) => `"${name.replaceAll("\"", "\"\"")}"`;
+const resolve = async (db, tables) => (await sql`select t.n::int as n, ns.nspname as schema, c.relname as name, current_database() as database
+      from unnest(${tables.map(({ schema, name }) => schema ? `${quoted(schema)}.${quoted(name)}` : quoted(name))}::text[]) with ordinality as t(name, n)
+      join pg_class c on c.oid = to_regclass(t.name) join pg_namespace ns on ns.oid = c.relnamespace order by t.n`.execute(db)).rows;
+/** Refuses a resource over a table of the admin store: the user table, a feature's table or the record of migrations. */
+const checkResourcesOutsideAuthStore = async (db, models, auth) => {
+	if (models.length === 0) return;
+	const store = await resolve(storeDb(auth), authStoreTables(auth));
+	const same = (a, b) => a.database === b.database && a.schema === b.schema && a.name === b.name;
+	const over = (await resolve(db, models.map((model) => model.table))).filter((table) => store.some((own) => same(own, table)));
+	if (over.length === 0) return;
+	const named = over.map((table) => `${models[table.n - 1].name} (${table.schema}.${table.name})`).join(", ");
+	throw new Error(`Resources over the auth store's tables, which hold password hashes, sessions and tokens: ${named}. Remove them from the config; the auth store is read through Better Auth alone.`);
+};
+//#endregion
+export { checkResourcesOutsideAuthStore };

package/dist/better-auth/store/store-db.js

@@ -0,0 +1,13 @@
+import { Kysely, PostgresDialect } from "kysely";
+//#region src/better-auth/store/store-db.ts
+/**
+* A Kysely on the admin store's connections: `createAuth`'s `database`, a `pg` Pool or `{ dialect, type: 'postgres' }`.
+* The pool is the app's, so it is never destroyed here.
+*/
+const storeDb = ({ options: { database } }) => {
+	if (database && typeof database === "object" && "dialect" in database) return new Kysely({ dialect: database.dialect });
+	if (database && typeof database === "object" && "connect" in database) return new Kysely({ dialect: new PostgresDialect({ pool: database }) });
+	throw new Error("The admin store's database is neither a pg Pool nor { dialect, type: 'postgres' }");
+};
+//#endregion
+export { storeDb };

package/dist/better-auth/store/store-names.d.ts

@@ -0,0 +1,2 @@
+import "../user-table.js";
+import "../create-auth.js";

package/dist/better-auth/store/store-names.js

@@ -0,0 +1,14 @@
+import { sql } from "kysely";
+//#region src/better-auth/store/store-names.ts
+/** The schema the admin store lives in; the search path decides when its options name none. */
+const storeSchema = ({ options: { database } }) => database && "schemaName" in database ? database.schemaName : void 0;
+/** The store's configured names, from the app's auth. */
+const storeNames = (auth) => ({
+	schema: storeSchema(auth),
+	users: auth.userTable,
+	uuidIds: auth.options.advanced?.database?.generateId === "uuid"
+});
+/** A table of the store, in its schema, as an identifier for `ddl`. */
+const storeTable = ({ schema }, name) => schema === void 0 ? sql.id(name) : sql.id(schema, name);
+//#endregion
+export { storeNames, storeSchema, storeTable };

package/dist/better-auth/store/table-names.d.ts

@@ -0,0 +1,7 @@
+//#region src/better-auth/store/table-names.d.ts
+/**
+ * The admin store's tables besides the user table, whose name the app may configure: every feature's, which the store
+ * has whether the app turns the feature on or not, and the record of its migrations.
+ */
+export declare const storeTableNames: string[];
+//#endregion

package/dist/better-auth/store/table-names.js

@@ -0,0 +1,10 @@
+import { storeMigrations } from "./migrations/index.js";
+import { migrationsTableName } from "./migrations-table.js";
+//#region src/better-auth/store/table-names.ts
+/**
+* The admin store's tables besides the user table, whose name the app may configure: every feature's, which the store
+* has whether the app turns the feature on or not, and the record of its migrations.
+*/
+const storeTableNames = [...storeMigrations.flatMap((migration) => migration.tables), migrationsTableName];
+//#endregion
+export { storeTableNames };

package/dist/better-auth/users.d.ts

@@ -1,5 +1,5 @@
-import { AdminAuth } from "./create-auth.js";
 import { parseRoles } from "./parse-roles.js";
+import { AdminAuth } from "./create-auth.js";
 //#region src/better-auth/users.d.ts
 /** The roles this auth instance allows, `admin` first. */
 export declare const roleChoices: (auth: AdminAuth) => string[];

package/dist/comments/comment-users.d.ts

@@ -1,5 +1,5 @@
-import "../better-auth/create-auth.js";
 import { TenantValue } from "../types.js";
+import "../better-auth/create-auth.js";
 //#region src/comments/comment-users.d.ts
 /** The users comments name, mention and mail: from the project's auth. */
 export type CommentUsers = {

package/dist/config-exports.d.ts

@@ -0,0 +1,2 @@
+import { configExports } from "./resource-source.js";
+export { configExports };

package/dist/config-exports.js

@@ -0,0 +1,2 @@
+import { configExports } from "./resource-source.js";
+export { configExports };

package/dist/create-admin.d.ts

@@ -1,7 +1,6 @@
 import { MobileConfig } from "./mobile-config.js";
 import { AppIdentity } from "./app-identity.js";
 import { AppIcons } from "./web-app/app-icons.js";
-import { AdminAuth } from "./better-auth/create-auth.js";
 import { EventsOptions } from "./changes/events-options.js";
 import { JobDefinition } from "./jobs/job-types.js";
 import { Admin, Authenticator, PageSource, ViewSource } from "./types.js";
@@ -15,6 +14,7 @@ import { Difficulty } from "./forms/challenge.js";
 import { ResourceSource } from "./resource-source.js";
 import { FunctionSource } from "./functions/define-function.js";
 import { AdminOptions } from "./admin-options.js";
+import { AdminAuth } from "./better-auth/create-auth.js";
 import { BottomBarSource, UserMenuSource } from "@protobase/schema";
 import { Db } from "@protobase/query";
 import { JWTPayload } from "jose";

package/dist/index.d.ts

@@ -1,18 +1,9 @@
 import { MobileConfig } from "./mobile-config.js";
 import { AppIdentity } from "./app-identity.js";
 import { AppIcons, PngIcon, pngIcons } from "./web-app/app-icons.js";
-import { StaffSignIn } from "./better-auth/staff-log.js";
-import { RoleDefinition, RolesInput } from "./better-auth/organizations/role-definitions.js";
-import { MailMessage, Mailer } from "./mail/smtp-mailer.js";
-import { OperatorProvider, readOperatorSettings } from "./better-auth/operator-provider.js";
-import { OrganizationRole, StoredMember, StoredOrganization } from "./better-auth/organizations/store.js";
-import { SignInPolicy, SignInRule, StaffAccessRule, defaultSignInPolicy, signInPolicyMethods } from "./better-auth/sign-in-policy.js";
-import { OrganizationsOptions } from "./better-auth/organizations/options.js";
-import { PlatformSignIn, readPlatformSignIn } from "./better-auth/platform-sign-in.js";
-import { EmailComponent, EmailOptions, EmailTemplate, RenderedEmail, defineEmail } from "./mail/define-email.js";
-import { AdminAuth, CreateAuthOptions, UserCreatedHook, createAuth, normalizeRoles } from "./better-auth/create-auth.js";
 import { EventsOptions } from "./changes/events-options.js";
 import { StandardSchema, readJson } from "./functions/read-json.js";
+import { MailMessage, Mailer } from "./mail/smtp-mailer.js";
 import { JsonObject, JsonValue } from "./notifications/json-value.js";
 import { HistoryPosition, NewNotification, StoredNotification, historyIdPattern, historyLimits } from "./notifications/history.js";
 import { PushMessage, PushMessageError, Urgency, WebPushFields, maxTtlSeconds, pushMessage, urgencies } from "./notifications/message.js";
@@ -73,7 +64,9 @@ import { BetterAuthAuthenticator, BetterAuthAuthenticatorOptions, betterAuthAuth
 import { parseRoles } from "./better-auth/parse-roles.js";
 import { LinkedAccount, NewUser, StoredUser, createUser, deleteUser, hasUsers, listUsers, roleChoices, setUserBanned, setUserRole } from "./better-auth/users.js";
 import { IssueTokenOptions, issueToken, maxTokenTtlSeconds } from "./better-auth/tokens.js";
+import { SignInPolicy, SignInRule, StaffAccessRule, defaultSignInPolicy, signInPolicyMethods } from "./better-auth/sign-in-policy.js";
 import { passwordLength } from "./better-auth/new-account-password.js";
+import { OperatorProvider, readOperatorSettings } from "./better-auth/operator-provider.js";
 import { isOAuthWellKnownPath, oauthWellKnownPaths, webauthnPath } from "./better-auth/origins.js";
 import { goTruePath } from "./gotrue/keys.js";
 import { supabasePath } from "./supabase-paths.js";
@@ -81,7 +74,10 @@ import { realtimeLimits } from "./realtime/realtime-limits.js";
 import { capSocketMessages, honorSocketMessageCaps, socketMessageCapOf } from "./functions/socket-message-cap.js";
 import { defaultAppName, shownAppName } from "./app-name.js";
 import { webManifestPath } from "./web-app/web-manifest-route.js";
+import { PlatformSignIn, readPlatformSignIn } from "./better-auth/platform-sign-in.js";
 import { authSchemaMigration, checkAuthSchema } from "./better-auth/auth-schema.js";
+import { authSchemaDrift } from "./better-auth/store/drift.js";
+import { checkResourcesOutsideAuthStore } from "./better-auth/store/resources-outside.js";
 import { changesMigration, checkChanges, migrationCommand } from "./changes/capture-schema.js";
 import { checkComputed, computedMigration } from "./computed/computed-schema.js";
 import { isCaptured } from "./changes/capture-sql.js";
@@ -109,7 +105,11 @@ import { sendNotification } from "./notifications/send-notification.js";
 import { VapidSettings, readVapidSettings, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable } from "./notifications/web-push/vapid-settings.js";
 import { WebPushOptions, webPushSender } from "./notifications/web-push/web-push-sender.js";
 import { generateVapidKeys } from "./notifications/web-push/keys.js";
+import { RoleDefinition, RolesInput } from "./better-auth/organizations/role-definitions.js";
+import { OrganizationRole, StoredMember, StoredOrganization } from "./better-auth/organizations/store.js";
+import { OrganizationsOptions } from "./better-auth/organizations/options.js";
 import { MemberInput, NewOrganization, addAppRoleToOwners, addMember, createOrganization, listOrganizations, removeMember, setMemberRoles } from "./better-auth/organizations/host.js";
+import { StaffSignIn } from "./better-auth/staff-log.js";
 import { AssistantBackend, assistantProtocolRoutes } from "./assistant/protocol-routes.js";
 import { fileConversationStore } from "./assistant/file-conversation-store.js";
 import { withCacheBreakpoints } from "./assistant/cache-breakpoints.js";
@@ -155,10 +155,12 @@ import { aspectRatio, fileSize, fileType, imageSize, processor } from "./files/p
 import { defineJob, isJobDefinition, jobDefinitions } from "./jobs/define-job.js";
 import { FatalJobError } from "./jobs/run-job.js";
 import { isSchedule } from "./jobs/schedule.js";
+import { EmailComponent, EmailOptions, EmailTemplate, RenderedEmail, defineEmail } from "./mail/define-email.js";
 import { DrainResult, JobsRuntime, StartJobsOptions, startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
 import { checkJobsSchema, jobsSchema, jobsSchemaMigration } from "./jobs/schema.js";
 import { MobileRelease, ReleaseFile, ServedReleaseFile, composeRelease, releaseManifest } from "./mobile-release/release.js";
 import { MobileReleaseAppInput, OfferedRelease, mobileReleaseApp } from "./mobile-release/release-app.js";
 import { mobileSigningKeyVariable, readSigningKey } from "./mobile-release/signing-key.js";
-export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApiKeys, type ApiKeysOptions, type ApnsEnvironment, type AppIcons, type AppIdentity, type AppPoolConfig, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BatchOperation, type BatchResult, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type Caller, type CallerOptions, type CapturedRow, type CascadingKey, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, ConnectionsBusy, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type Device, type DeviceColumn, type DeviceKind, type DeviceStore, DeviceStoreError, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryColumn, type HistoryOptions, type HistoryPosition, type HistoryStore, HistoryStoreError, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JsonObject, type JsonValue, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type McpApprovals, type McpGateInput, type McpHandlerInput, type McpRoutesInput, type McpServerInput, type McpToolsInput, type McpWrites, type MemberInput, type Membership, MissingCredentials, type MobileConfig, type MobileRelease, type MobileReleaseAppInput, ModelError, type ModelSettings, type NewDevice, type NewNotification, type NewOrganization, type NewUser, type NotificationRecipients, NotificationSendError, type NotificationsOptions, type OfferedRelease, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PgModule, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type PushAnswer, type PushMessage, PushMessageError, type PushSender, type QueryOptions, type QueryResult, type ReadableResources, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordKeyInput, type RecordPage, type ReleaseFile, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type SendNotification, type ServedReleaseFile, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredNotification, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolAnnotations, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type Urgency, type User, type UserCreatedHook, type VapidSettings, type ViewSource, type WebPushFields, type WebPushOptions, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, type WriteRecordToolsInput, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appPool, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, composeRelease, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, deviceIdParam, deviceStore, devicesPath, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, localFiles, longQueryPool, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, mergeConfig, migrationCommand, mobileReleaseApp, mobileSigningKeyVariable, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notifications, notificationsMigration, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readSigningKey, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, recordOf, releaseManifest, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };
+import { AdminAuth, CreateAuthOptions, UserCreatedHook, createAuth, normalizeRoles } from "./better-auth/create-auth.js";
+export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApiKeys, type ApiKeysOptions, type ApnsEnvironment, type AppIcons, type AppIdentity, type AppPoolConfig, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BatchOperation, type BatchResult, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type Caller, type CallerOptions, type CapturedRow, type CascadingKey, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, ConnectionsBusy, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type Device, type DeviceColumn, type DeviceKind, type DeviceStore, DeviceStoreError, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryColumn, type HistoryOptions, type HistoryPosition, type HistoryStore, HistoryStoreError, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JsonObject, type JsonValue, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type McpApprovals, type McpGateInput, type McpHandlerInput, type McpRoutesInput, type McpServerInput, type McpToolsInput, type McpWrites, type MemberInput, type Membership, MissingCredentials, type MobileConfig, type MobileRelease, type MobileReleaseAppInput, ModelError, type ModelSettings, type NewDevice, type NewNotification, type NewOrganization, type NewUser, type NotificationRecipients, NotificationSendError, type NotificationsOptions, type OfferedRelease, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PgModule, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type PushAnswer, type PushMessage, PushMessageError, type PushSender, type QueryOptions, type QueryResult, type ReadableResources, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordKeyInput, type RecordPage, type ReleaseFile, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type SendNotification, type ServedReleaseFile, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredNotification, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolAnnotations, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type Urgency, type User, type UserCreatedHook, type VapidSettings, type ViewSource, type WebPushFields, type WebPushOptions, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, type WriteRecordToolsInput, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appPool, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkResourcesOutsideAuthStore, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, composeRelease, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, deviceIdParam, deviceStore, devicesPath, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, localFiles, longQueryPool, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, mergeConfig, migrationCommand, mobileReleaseApp, mobileSigningKeyVariable, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notifications, notificationsMigration, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readSigningKey, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, recordOf, releaseManifest, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };

package/dist/index.js

@@ -96,8 +96,10 @@ import { defineConfig, mergeConfig } from "./project-config.js";
 import { withTrustedApps } from "./better-auth/app-tokens.js";
 import { betterAuthAuthenticator, betterAuthTokens } from "./better-auth/authenticator.js";
 import { issueToken, maxTokenTtlSeconds } from "./better-auth/tokens.js";
-import { authStoreTables } from "./better-auth/auth-tables.js";
 import { authSchemaMigration, checkAuthSchema } from "./better-auth/auth-schema.js";
+import { authSchemaDrift } from "./better-auth/store/drift.js";
+import { authStoreTables } from "./better-auth/auth-tables.js";
+import { checkResourcesOutsideAuthStore } from "./better-auth/store/resources-outside.js";
 import { checkComputed, computedMigration } from "./computed/computed-schema.js";
 import { webhooks } from "./webhooks/table/plugin.js";
 import { checkWebhooksSchema, webhooksMigration } from "./webhooks/table/schema.js";
@@ -123,4 +125,4 @@ import { jobsDrainApp } from "./jobs/drain-route.js";
 import { composeRelease, releaseManifest } from "./mobile-release/release.js";
 import { mobileReleaseApp } from "./mobile-release/release-app.js";
 import { mobileSigningKeyVariable, readSigningKey } from "./mobile-release/signing-key.js";
-export { ConnectionsBusy, DeviceStoreError, FatalJobError, HistoryStoreError, HttpProblem, MissingCredentials, ModelError, NotificationSendError, PushMessageError, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appPool, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, composeRelease, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, deviceIdParam, deviceStore, devicesPath, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, localFiles, longQueryPool, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, mergeConfig, migrationCommand, mobileReleaseApp, mobileSigningKeyVariable, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notifications, notificationsMigration, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readSigningKey, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, recordOf, releaseManifest, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };
+export { ConnectionsBusy, DeviceStoreError, FatalJobError, HistoryStoreError, HttpProblem, MissingCredentials, ModelError, NotificationSendError, PushMessageError, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appPool, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaDrift, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkResourcesOutsideAuthStore, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, composeRelease, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, deviceIdParam, deviceStore, devicesPath, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, localFiles, longQueryPool, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, mergeConfig, migrationCommand, mobileReleaseApp, mobileSigningKeyVariable, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notifications, notificationsMigration, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readSigningKey, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, recordOf, releaseManifest, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };

package/dist/jobs/job-types.d.ts

@@ -1,5 +1,5 @@
-import { Mailer } from "../mail/smtp-mailer.js";
 import { StandardSchema } from "../functions/read-json.js";
+import { Mailer } from "../mail/smtp-mailer.js";
 import { SendNotification } from "../notifications/send-input.js";
 import { Db } from "@protobase/query";
 //#region src/jobs/job-types.d.ts

package/dist/notifications/device-store-of.d.ts

@@ -1,6 +1,6 @@
-import { AdminAuth } from "../better-auth/create-auth.js";
 import { DeviceStore } from "./device-store.js";
 import { NotificationsOptions } from "./options.js";
+import { AdminAuth } from "../better-auth/create-auth.js";
 import { Db } from "@protobase/query";
 //#region src/notifications/device-store-of.d.ts
 /**

package/dist/notifications/history-store-of.d.ts

@@ -1,6 +1,6 @@
-import { AdminAuth } from "../better-auth/create-auth.js";
 import { HistoryStore } from "./history-store.js";
 import { NotificationsOptions } from "./options.js";
+import { AdminAuth } from "../better-auth/create-auth.js";
 import { Db } from "@protobase/query";
 //#region src/notifications/history-store-of.d.ts
 /**

package/dist/notifications/schema.d.ts

@@ -1,5 +1,5 @@
-import { AdminAuth } from "../better-auth/create-auth.js";
 import { NotificationsOptions } from "./options.js";
+import { AdminAuth } from "../better-auth/create-auth.js";
 import { Db } from "@protobase/query";
 //#region src/notifications/schema.d.ts
 /**

package/dist/notifications/schema.js

@@ -1,6 +1,6 @@
 import { migrationCommand } from "../changes/capture-schema.js";
 import { historyNames, notificationsNames } from "./options.js";
-import { storeSchema } from "../better-auth/auth-tables.js";
+import { storeSchema } from "../better-auth/store/store-names.js";
 import { deviceSessionColumnSql, devicesTableSql, qualified } from "./schema-sql.js";
 import { historyTableSql } from "./history-sql.js";
 import { sql } from "kysely";

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.47.1";
+var version = "0.48.0";
 //#endregion
 export { version };

package/dist/project-config.d.ts

@@ -1,6 +1,5 @@
 import { MobileConfig } from "./mobile-config.js";
 import { AppIdentity } from "./app-identity.js";
-import { AdminAuth } from "./better-auth/create-auth.js";
 import { EventsOptions } from "./changes/events-options.js";
 import { Authenticator } from "./types.js";
 import { HistoryOptions } from "./history/options.js";
@@ -9,6 +8,7 @@ import { NotificationsOptions } from "./notifications/options.js";
 import { FilesOptions } from "./files/options.js";
 import { FunctionSource } from "./functions/define-function.js";
 import { AdminOptions } from "./admin-options.js";
+import { AdminAuth } from "./better-auth/create-auth.js";
 import { Db } from "@protobase/query";
 //#region src/project-config.d.ts
 /** What `protobase.config.ts` may default-export. Everything is optional. */