@protobase/server 0.6.0 → 0.7.0

package/dist/better-auth/auth-schema.d.ts

@@ -2,13 +2,15 @@ import { AdminAuth } from "./create-auth.js";
 //#region src/better-auth/auth-schema.d.ts
 /**
  * The SQL that brings the admin store up to what this version of Protobase and the project's Better Auth plugins need:
+ * for a store with the camelCase names of Protobase 0.6, their rename to snake_case (`snakeCaseMigration`); otherwise
  * new tables, columns and indexes, never a drop, each skipped where it exists. `undefined` when the store is current. A
  * change Better Auth cannot make safely, such as a required column without a default on a table with rows, is an error.
  */
 export declare const authSchemaMigration: (auth: AdminAuth) => Promise<string | undefined>;
 /**
- * Refuses to go on while the admin store lacks a table or column Better Auth needs, since every sign-in would fail.
- * The server never changes the schema itself: the project's migrations do, before the new version serves.
+ * Refuses to go on while the admin store lacks a table or column Better Auth needs, or still has the camelCase names
+ * of Protobase 0.6, since every sign-in would fail. The server never changes the schema itself: the project's
+ * migrations do, before the new version serves.
  */
 export declare const checkAuthSchema: (auth: AdminAuth) => Promise<void>;
 //#endregion

package/dist/better-auth/auth-schema.js

@@ -1,3 +1,4 @@
+import { snakeCaseMigration } from "./snake-case-migration.js";
 import { getMigrations } from "better-auth/db/migration";
 //#region src/better-auth/auth-schema.ts
 /** The command that writes the pending changes as a migration file of the project. */
@@ -8,28 +9,37 @@ const authMigrationCommand = "protobase auth migration";
 */
 const skipExisting = (sql) => sql.split(";\n\n").map((statement) => statement.replace(/^create table (?!if not exists )/, "create table if not exists ").replace(/^create (unique )?index (?!if not exists )/, (_, unique) => `create ${unique ?? ""}index if not exists `).replace(/^(alter table .+? )add column (?!if not exists )/, "$1add column if not exists ")).join(";\n\n");
 /**
+* Better Auth adds `email_verified` to a `user` table that exists only when the table still has the camelCase names
+* of Protobase 0.6, whose `emailVerified` it does not know: such a store is renamed, never given new columns beside
+* the old ones.
+*/
+const hasCamelCaseNames = ({ toBeAdded }) => toBeAdded.some(({ table, fields }) => table === "user" && "email_verified" in fields);
+const storeSchema = ({ options: { database } }) => database && "schemaName" in database ? database.schemaName : void 0;
+/**
 * The SQL that brings the admin store up to what this version of Protobase and the project's Better Auth plugins need:
+* for a store with the camelCase names of Protobase 0.6, their rename to snake_case (`snakeCaseMigration`); otherwise
 * new tables, columns and indexes, never a drop, each skipped where it exists. `undefined` when the store is current. A
 * change Better Auth cannot make safely, such as a required column without a default on a table with rows, is an error.
 */
 const authSchemaMigration = async (auth) => {
+	if (hasCamelCaseNames(await getMigrations(auth.options, { throwOnUnsafe: false }))) return snakeCaseMigration(storeSchema(auth));
 	const { toBeCreated, toBeAdded, toBeAddedIndexes, compileMigrations } = await getMigrations(auth.options);
 	if (toBeCreated.length === 0 && toBeAdded.length === 0 && toBeAddedIndexes.length === 0) return void 0;
 	return skipExisting(await compileMigrations());
 };
 /** The tables and `table.column`s the admin store lacks; an index missing is not a reason to refuse requests. */
-const missingAuthSchema = async (auth) => {
-	const { toBeCreated, toBeAdded } = await getMigrations(auth.options, { throwOnUnsafe: false });
-	return [...toBeCreated.map(({ table }) => table), ...toBeAdded.flatMap(({ table, fields }) => Object.keys(fields).map((field) => `${table}.${field}`))];
-};
+const missingTablesAndColumns = ({ toBeCreated, toBeAdded }) => [...toBeCreated.map(({ table }) => table), ...toBeAdded.flatMap(({ table, fields }) => Object.keys(fields).map((field) => `${table}.${field}`))];
 /**
-* Refuses to go on while the admin store lacks a table or column Better Auth needs, since every sign-in would fail.
-* The server never changes the schema itself: the project's migrations do, before the new version serves.
+* Refuses to go on while the admin store lacks a table or column Better Auth needs, or still has the camelCase names
+* of Protobase 0.6, since every sign-in would fail. The server never changes the schema itself: the project's
+* migrations do, before the new version serves.
 */
 const checkAuthSchema = async (auth) => {
-	const missing = await missingAuthSchema(auth);
+	const plan = await getMigrations(auth.options, { throwOnUnsafe: false });
+	if (hasCamelCaseNames(plan)) throw new Error(`The auth schema still has the camelCase names of Protobase 0.6, which this version names in snake_case. Write their rename as a migration with \`${authMigrationCommand}\`, apply it with the project's migrations, then start again.`);
+	const missing = missingTablesAndColumns(plan);
 	if (missing.length === 0) return;
 	throw new Error(`The auth schema is behind this version of Protobase (missing ${missing.join(", ")}). Write the change as a migration with \`${authMigrationCommand}\`, apply it with the project's migrations, then start again.`);
 };
 //#endregion
-export { authMigrationCommand, authSchemaMigration, checkAuthSchema, missingAuthSchema, skipExisting };
+export { authMigrationCommand, authSchemaMigration, checkAuthSchema, skipExisting };

package/dist/better-auth/create-auth.d.ts

@@ -62,11 +62,47 @@ export type UserCreatedHook = NonNullable<UserCreateHooks['after']>;
 /** The configured roles with `admin` first; `admin` is added when missing. */
 export declare const normalizeRoles: (roles?: string[]) => string[];
 export declare const createAuth: (options: CreateAuthOptions) => import("better-auth").Auth<{
+  user: {
+    fields: {
+      emailVerified: string;
+      createdAt: string;
+      updatedAt: string;
+    };
+  };
+  session: {
+    fields: {
+      expiresAt: string;
+      createdAt: string;
+      updatedAt: string;
+      ipAddress: string;
+      userAgent: string;
+      userId: string;
+    };
+  };
+  verification: {
+    fields: {
+      expiresAt: string;
+      createdAt: string;
+      updatedAt: string;
+    };
+  };
   account: {
     encryptOAuthTokens?: true | undefined;
     accountLinking: {
       allowDifferentEmails: true;
     };
+    fields: {
+      accountId: string;
+      providerId: string;
+      userId: string;
+      accessToken: string;
+      refreshToken: string;
+      idToken: string;
+      accessTokenExpiresAt: string;
+      refreshTokenExpiresAt: string;
+      createdAt: string;
+      updatedAt: string;
+    };
   };
   plugins: [{
     id: "admin";
@@ -954,6 +990,19 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
       };
     };
     options: NoInfer<{
+      schema: {
+        user: {
+          fields: {
+            banReason: string;
+            banExpires: string;
+          };
+        };
+        session: {
+          fields: {
+            impersonatedBy: string;
+          };
+        };
+      };
       defaultRole: string;
       roles: {
         [k: string]: import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<{
@@ -975,6 +1024,16 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
     id: "jwt";
     version: string;
     options: NoInfer<{
+      schema: {
+        jwks: {
+          fields: {
+            publicKey: string;
+            privateKey: string;
+            createdAt: string;
+            expiresAt: string;
+          };
+        };
+      };
       jwt: {
         expirationTime: string;
         issuer: string;
@@ -3021,6 +3080,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
     id: "protobase-sign-in-policy";
     schema: {
       readonly signInPolicy: {
+        readonly modelName: "sign_in_policy";
         readonly fields: {
           readonly password: {
             readonly type: "string";
@@ -3029,6 +3089,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
           readonly emailCode: {
             readonly type: "string";
             readonly required: true;
+            readonly fieldName: "email_code";
           };
           readonly passkey: {
             readonly type: "string";
@@ -3037,24 +3098,29 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
           readonly twoFactor: {
             readonly type: "string";
             readonly required: true;
+            readonly fieldName: "two_factor";
           };
           readonly staffAccess: {
             readonly type: "string";
             readonly required: true;
             readonly defaultValue: "allowed";
+            readonly fieldName: "staff_access";
           };
           readonly platformSignIn: {
             readonly type: "string";
             readonly required: true;
             readonly defaultValue: "allowed";
+            readonly fieldName: "platform_sign_in";
           };
           readonly createdAt: {
             readonly type: "date";
             readonly required: true;
+            readonly fieldName: "created_at";
           };
           readonly createdBy: {
             readonly type: "string";
             readonly required: false;
+            readonly fieldName: "created_by";
           };
         };
       };
@@ -3073,7 +3139,12 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
                 expiresAt: Date;
                 token: string;
                 ipAddress?: string | null | undefined;
-                userAgent?: string | null | undefined;
+                userAgent? /**
+                 * A sign-in provider the platform adds for people who already have an account: an OpenID Connect provider that never
+                 * signs anyone up. Defaults to the one the platform passes in `PROTOBASE_SIGN_IN_ISSUER`, `PROTOBASE_SIGN_IN_CLIENT_ID`
+                 * and `PROTOBASE_SIGN_IN_CLIENT_SECRET` (see `readPlatformSignIn`), when set; `false` turns it off whatever the
+                 * environment says. Left out when `socialProviders` has a provider with the same id.
+                 */ : string | null | undefined;
               };
               user: Record<string, any> & {
                 id: string;
@@ -3097,7 +3168,12 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
                 expiresAt: Date;
                 token: string;
                 ipAddress?: string | null | undefined;
-                userAgent?: string | null | undefined;
+                userAgent? /**
+                 * A sign-in provider the platform adds for people who already have an account: an OpenID Connect provider that never
+                 * signs anyone up. Defaults to the one the platform passes in `PROTOBASE_SIGN_IN_ISSUER`, `PROTOBASE_SIGN_IN_CLIENT_ID`
+                 * and `PROTOBASE_SIGN_IN_CLIENT_SECRET` (see `readPlatformSignIn`), when set; `false` turns it off whatever the
+                 * environment says. Left out when `socialProviders` has a provider with the same id.
+                 */ : string | null | undefined;
               };
               user: Record<string, any> & {
                 id: string;
@@ -3120,7 +3196,12 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               expiresAt: Date;
               token: string;
               ipAddress?: string | null | undefined;
-              userAgent?: string | null | undefined;
+              userAgent? /**
+               * A sign-in provider the platform adds for people who already have an account: an OpenID Connect provider that never
+               * signs anyone up. Defaults to the one the platform passes in `PROTOBASE_SIGN_IN_ISSUER`, `PROTOBASE_SIGN_IN_CLIENT_ID`
+               * and `PROTOBASE_SIGN_IN_CLIENT_SECRET` (see `readPlatformSignIn`), when set; `false` turns it off whatever the
+               * environment says. Left out when `socialProviders` has a provider with the same id.
+               */ : string | null | undefined;
             };
             user: Record<string, any> & {
               id: string;
@@ -3175,7 +3256,12 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
                 expiresAt: Date;
                 token: string;
                 ipAddress?: string | null | undefined;
-                userAgent?: string | null | undefined;
+                userAgent? /**
+                 * A sign-in provider the platform adds for people who already have an account: an OpenID Connect provider that never
+                 * signs anyone up. Defaults to the one the platform passes in `PROTOBASE_SIGN_IN_ISSUER`, `PROTOBASE_SIGN_IN_CLIENT_ID`
+                 * and `PROTOBASE_SIGN_IN_CLIENT_SECRET` (see `readPlatformSignIn`), when set; `false` turns it off whatever the
+                 * environment says. Left out when `socialProviders` has a provider with the same id.
+                 */ : string | null | undefined;
               };
               user: Record<string, any> & {
                 id: string;
@@ -3199,7 +3285,12 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
                 expiresAt: Date;
                 token: string;
                 ipAddress?: string | null | undefined;
-                userAgent?: string | null | undefined;
+                userAgent? /**
+                 * A sign-in provider the platform adds for people who already have an account: an OpenID Connect provider that never
+                 * signs anyone up. Defaults to the one the platform passes in `PROTOBASE_SIGN_IN_ISSUER`, `PROTOBASE_SIGN_IN_CLIENT_ID`
+                 * and `PROTOBASE_SIGN_IN_CLIENT_SECRET` (see `readPlatformSignIn`), when set; `false` turns it off whatever the
+                 * environment says. Left out when `socialProviders` has a provider with the same id.
+                 */ : string | null | undefined;
               };
               user: Record<string, any> & {
                 id: string;
@@ -3222,7 +3313,12 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               expiresAt: Date;
               token: string;
               ipAddress?: string | null | undefined;
-              userAgent?: string | null | undefined;
+              userAgent? /**
+               * A sign-in provider the platform adds for people who already have an account: an OpenID Connect provider that never
+               * signs anyone up. Defaults to the one the platform passes in `PROTOBASE_SIGN_IN_ISSUER`, `PROTOBASE_SIGN_IN_CLIENT_ID`
+               * and `PROTOBASE_SIGN_IN_CLIENT_SECRET` (see `readPlatformSignIn`), when set; `false` turns it off whatever the
+               * environment says. Left out when `socialProviders` has a provider with the same id.
+               */ : string | null | undefined;
             };
             user: Record<string, any> & {
               id: string;
@@ -3277,7 +3373,12 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               expiresAt: Date;
               token: string;
               ipAddress?: string | null | undefined;
-              userAgent?: string | null | undefined;
+              userAgent? /**
+               * A sign-in provider the platform adds for people who already have an account: an OpenID Connect provider that never
+               * signs anyone up. Defaults to the one the platform passes in `PROTOBASE_SIGN_IN_ISSUER`, `PROTOBASE_SIGN_IN_CLIENT_ID`
+               * and `PROTOBASE_SIGN_IN_CLIENT_SECRET` (see `readPlatformSignIn`), when set; `false` turns it off whatever the
+               * environment says. Left out when `socialProviders` has a provider with the same id.
+               */ : string | null | undefined;
             };
             user: Record<string, any> & {
               id: string;
@@ -3299,7 +3400,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
           twoFactor: boolean;
           authenticatorApp: boolean;
         };
-        missing: ("passkey" | "twoFactor")[];
+        missing: ("twoFactor" | "passkey")[];
       }>;
     };
     hooks: {
@@ -3312,14 +3413,17 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
     id: "protobase-staff-sign-in";
     schema: {
       readonly staffSignIn: {
+        readonly modelName: "staff_sign_in";
         readonly fields: {
           readonly userId: {
             readonly type: "string";
             readonly required: true;
+            readonly fieldName: "user_id";
           };
           readonly userEmail: {
             readonly type: "string";
             readonly required: true;
+            readonly fieldName: "user_email";
           };
           readonly staff: {
             readonly type: "string";
@@ -3328,10 +3432,12 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
           readonly staffName: {
             readonly type: "string";
             readonly required: false;
+            readonly fieldName: "staff_name";
           };
           readonly staffSubject: {
             readonly type: "string";
             readonly required: true;
+            readonly fieldName: "staff_subject";
           };
           readonly issuer: {
             readonly type: "string";
@@ -3344,18 +3450,22 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
           readonly sessionId: {
             readonly type: "string";
             readonly required: true;
+            readonly fieldName: "session_id";
           };
           readonly startedAt: {
             readonly type: "date";
             readonly required: true;
+            readonly fieldName: "started_at";
           };
           readonly expiresAt: {
             readonly type: "date";
             readonly required: true;
+            readonly fieldName: "expires_at";
           };
           readonly endedAt: {
             readonly type: "date";
             readonly required: false;
+            readonly fieldName: "ended_at";
           };
         };
       };
@@ -3373,7 +3483,12 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               expiresAt: Date;
               token: string;
               ipAddress?: string | null | undefined;
-              userAgent?: string | null | undefined;
+              userAgent? /**
+               * A sign-in provider the platform adds for people who already have an account: an OpenID Connect provider that never
+               * signs anyone up. Defaults to the one the platform passes in `PROTOBASE_SIGN_IN_ISSUER`, `PROTOBASE_SIGN_IN_CLIENT_ID`
+               * and `PROTOBASE_SIGN_IN_CLIENT_SECRET` (see `readPlatformSignIn`), when set; `false` turns it off whatever the
+               * environment says. Left out when `socialProviders` has a provider with the same id.
+               */ : string | null | undefined;
             };
             user: Record<string, any> & {
               id: string;
@@ -3401,7 +3516,12 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               expiresAt: Date;
               token: string;
               ipAddress?: string | null | undefined;
-              userAgent?: string | null | undefined;
+              userAgent? /**
+               * A sign-in provider the platform adds for people who already have an account: an OpenID Connect provider that never
+               * signs anyone up. Defaults to the one the platform passes in `PROTOBASE_SIGN_IN_ISSUER`, `PROTOBASE_SIGN_IN_CLIENT_ID`
+               * and `PROTOBASE_SIGN_IN_CLIENT_SECRET` (see `readPlatformSignIn`), when set; `false` turns it off whatever the
+               * environment says. Left out when `socialProviders` has a provider with the same id.
+               */ : string | null | undefined;
             };
             user: Record<string, any> & {
               id: string;
@@ -3430,7 +3550,12 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
                 expiresAt: Date;
                 token: string;
                 ipAddress?: string | null | undefined;
-                userAgent?: string | null | undefined;
+                userAgent? /**
+                 * A sign-in provider the platform adds for people who already have an account: an OpenID Connect provider that never
+                 * signs anyone up. Defaults to the one the platform passes in `PROTOBASE_SIGN_IN_ISSUER`, `PROTOBASE_SIGN_IN_CLIENT_ID`
+                 * and `PROTOBASE_SIGN_IN_CLIENT_SECRET` (see `readPlatformSignIn`), when set; `false` turns it off whatever the
+                 * environment says. Left out when `socialProviders` has a provider with the same id.
+                 */ : string | null | undefined;
               };
               user: Record<string, any> & {
                 id: string;
@@ -3454,7 +3579,12 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
                 expiresAt: Date;
                 token: string;
                 ipAddress?: string | null | undefined;
-                userAgent?: string | null | undefined;
+                userAgent? /**
+                 * A sign-in provider the platform adds for people who already have an account: an OpenID Connect provider that never
+                 * signs anyone up. Defaults to the one the platform passes in `PROTOBASE_SIGN_IN_ISSUER`, `PROTOBASE_SIGN_IN_CLIENT_ID`
+                 * and `PROTOBASE_SIGN_IN_CLIENT_SECRET` (see `readPlatformSignIn`), when set; `false` turns it off whatever the
+                 * environment says. Left out when `socialProviders` has a provider with the same id.
+                 */ : string | null | undefined;
               };
               user: Record<string, any> & {
                 id: string;
@@ -3477,7 +3607,12 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               expiresAt: Date;
               token: string;
               ipAddress?: string | null | undefined;
-              userAgent?: string | null | undefined;
+              userAgent? /**
+               * A sign-in provider the platform adds for people who already have an account: an OpenID Connect provider that never
+               * signs anyone up. Defaults to the one the platform passes in `PROTOBASE_SIGN_IN_ISSUER`, `PROTOBASE_SIGN_IN_CLIENT_ID`
+               * and `PROTOBASE_SIGN_IN_CLIENT_SECRET` (see `readPlatformSignIn`), when set; `false` turns it off whatever the
+               * environment says. Left out when `socialProviders` has a provider with the same id.
+               */ : string | null | undefined;
             };
             user: Record<string, any> & {
               id: string;

package/dist/better-auth/create-auth.js

@@ -5,6 +5,7 @@ import { passwordResetOptions } from "./password-reset.js";
 import { platformSignInFor, platformSignInProvider, readPlatformSignIn, resolvePlatformSignIn } from "./platform-sign-in.js";
 import { signInPolicyPlugin } from "./policy-plugin.js";
 import { emailCodeOptions, twoFactorCodeOptions, unusedEmailCodePaths } from "./sign-in-mail.js";
+import { coreNames, pluginNames } from "./snake-case-names.js";
 import { staffSignInPlugin } from "./staff-plugin.js";
 import { twoFactorAfterPasswordOrCode } from "./two-factor-challenge.js";
 import { passkey } from "@better-auth/passkey";
@@ -60,16 +61,22 @@ const betterAuthOptions = (options, { roles, defaultRole, mailer, operator, plat
 			...mailer && passwordResetOptions(mailer)
 		},
 		...options.socialProviders && { socialProviders: options.socialProviders },
+		user: coreNames.user,
+		session: coreNames.session,
+		verification: coreNames.verification,
 		account: {
+			...coreNames.account,
 			accountLinking: { allowDifferentEmails: true },
 			...options.encryptOAuthTokens && { encryptOAuthTokens: true }
 		},
 		plugins: [
 			admin({
+				schema: pluginNames.admin,
 				defaultRole: defaultRole ?? "unassigned",
 				roles: Object.fromEntries(roles.map((role) => [role, role === "admin" ? adminAc : userAc]))
 			}),
 			jwt({
+				schema: pluginNames.jwt,
 				jwt: {
 					expirationTime: tokenLifetime,
 					issuer: options.baseURL,
@@ -82,10 +89,11 @@ const betterAuthOptions = (options, { roles, defaultRole, mailer, operator, plat
 				disableSettingJwtHeader: true
 			}),
 			twoFactorAfterPasswordOrCode({
+				schema: pluginNames.twoFactor,
 				allowPasswordless: true,
 				...mailer && { otpOptions: twoFactorCodeOptions(mailer) }
 			}),
-			passkey(),
+			passkey({ schema: pluginNames.passkey }),
 			...mailer ? [emailOTP(emailCodeOptions(mailer))] : [],
 			...signIn ? [genericOAuth({ config: [platformSignInProvider(signIn)] })] : [],
 			signInPolicyPlugin({

package/dist/better-auth/policy-store.js

@@ -2,42 +2,51 @@ import { defaultSignInPolicy, parseSignInPolicy } from "./sign-in-policy.js";
 //#region src/better-auth/policy-store.ts
 /** Better Auth's model for the sign-in policy: one row per save, the newest applies, the older ones are its history. */
 const signInPolicyModel = "signInPolicy";
-const signInPolicySchema = { [signInPolicyModel]: { fields: {
-	password: {
-		type: "string",
-		required: true
-	},
-	emailCode: {
-		type: "string",
-		required: true
-	},
-	passkey: {
-		type: "string",
-		required: true
-	},
-	twoFactor: {
-		type: "string",
-		required: true
-	},
-	staffAccess: {
-		type: "string",
-		required: true,
-		defaultValue: "allowed"
-	},
-	platformSignIn: {
-		type: "string",
-		required: true,
-		defaultValue: "allowed"
-	},
-	createdAt: {
-		type: "date",
-		required: true
-	},
-	createdBy: {
-		type: "string",
-		required: false
+const signInPolicySchema = { [signInPolicyModel]: {
+	modelName: "sign_in_policy",
+	fields: {
+		password: {
+			type: "string",
+			required: true
+		},
+		emailCode: {
+			type: "string",
+			required: true,
+			fieldName: "email_code"
+		},
+		passkey: {
+			type: "string",
+			required: true
+		},
+		twoFactor: {
+			type: "string",
+			required: true,
+			fieldName: "two_factor"
+		},
+		staffAccess: {
+			type: "string",
+			required: true,
+			defaultValue: "allowed",
+			fieldName: "staff_access"
+		},
+		platformSignIn: {
+			type: "string",
+			required: true,
+			defaultValue: "allowed",
+			fieldName: "platform_sign_in"
+		},
+		createdAt: {
+			type: "date",
+			required: true,
+			fieldName: "created_at"
+		},
+		createdBy: {
+			type: "string",
+			required: false,
+			fieldName: "created_by"
+		}
 	}
-} } };
+} };
 /** The newest saved policy, or the default when none was saved. A row that no longer parses counts as none. */
 const readSignInPolicy = async (adapter) => {
 	const [row] = await adapter.findMany({

package/dist/better-auth/snake-case-migration.js

@@ -0,0 +1,122 @@
+//#region src/better-auth/snake-case-migration.ts
+const schemaName = /^[a-z_][a-z0-9_]*$/;
+/**
+* The migration that renames the auth store of Protobase 0.6 in place, from Better Auth's camelCase names to the
+* snake_case ones of `snake-case-names.ts`: tables, columns, and the indexes and constraints named after them. Data,
+* defaults, keys and indexes stay as they are. On a store that has the snake_case names already it does nothing, so a
+* project's migrations can carry it after an auth migration written with them. `schema` is the store's schema, the
+* connection's current one when left out.
+*/
+const snakeCaseMigration = (schema) => {
+	if (schema !== void 0 && !schemaName.test(schema)) throw new Error(`Invalid auth schema name "${schema}"`);
+	const s = schema === void 0 ? "" : `"${schema}".`;
+	const current = schema === void 0 ? "current_schema()" : `'${schema}'`;
+	return `-- Renames the auth store of Protobase 0.6 to snake_case. A store set up with the snake_case names has no "emailVerified"
+-- and is left as it is.
+do $$
+declare
+  constraint_row record;
+begin
+  if not exists (select from information_schema.columns where table_schema = ${current} and table_name = 'user' and column_name = 'emailVerified') then
+    return;
+  end if;
+
+  alter table ${s}"twoFactor" rename to two_factor;
+  alter table ${s}"signInPolicy" rename to sign_in_policy;
+  alter table ${s}"staffSignIn" rename to staff_sign_in;
+
+  alter table ${s}"user" rename column "emailVerified" to email_verified;
+  alter table ${s}"user" rename column "createdAt" to created_at;
+  alter table ${s}"user" rename column "updatedAt" to updated_at;
+  alter table ${s}"user" rename column "banReason" to ban_reason;
+  alter table ${s}"user" rename column "banExpires" to ban_expires;
+  alter table ${s}"user" rename column "twoFactorEnabled" to two_factor_enabled;
+
+  alter table ${s}session rename column "expiresAt" to expires_at;
+  alter table ${s}session rename column "createdAt" to created_at;
+  alter table ${s}session rename column "updatedAt" to updated_at;
+  alter table ${s}session rename column "ipAddress" to ip_address;
+  alter table ${s}session rename column "userAgent" to user_agent;
+  alter table ${s}session rename column "userId" to user_id;
+  alter table ${s}session rename column "impersonatedBy" to impersonated_by;
+
+  alter table ${s}account rename column "accountId" to account_id;
+  alter table ${s}account rename column "providerId" to provider_id;
+  alter table ${s}account rename column "userId" to user_id;
+  alter table ${s}account rename column "accessToken" to access_token;
+  alter table ${s}account rename column "refreshToken" to refresh_token;
+  alter table ${s}account rename column "idToken" to id_token;
+  alter table ${s}account rename column "accessTokenExpiresAt" to access_token_expires_at;
+  alter table ${s}account rename column "refreshTokenExpiresAt" to refresh_token_expires_at;
+  alter table ${s}account rename column "createdAt" to created_at;
+  alter table ${s}account rename column "updatedAt" to updated_at;
+
+  alter table ${s}verification rename column "expiresAt" to expires_at;
+  alter table ${s}verification rename column "createdAt" to created_at;
+  alter table ${s}verification rename column "updatedAt" to updated_at;
+
+  alter table ${s}jwks rename column "publicKey" to public_key;
+  alter table ${s}jwks rename column "privateKey" to private_key;
+  alter table ${s}jwks rename column "createdAt" to created_at;
+  alter table ${s}jwks rename column "expiresAt" to expires_at;
+
+  alter table ${s}two_factor rename column "backupCodes" to backup_codes;
+  alter table ${s}two_factor rename column "userId" to user_id;
+  alter table ${s}two_factor rename column "failedVerificationCount" to failed_verification_count;
+  alter table ${s}two_factor rename column "lockedUntil" to locked_until;
+
+  alter table ${s}passkey rename column "publicKey" to public_key;
+  alter table ${s}passkey rename column "userId" to user_id;
+  alter table ${s}passkey rename column "credentialID" to credential_id;
+  alter table ${s}passkey rename column "deviceType" to device_type;
+  alter table ${s}passkey rename column "backedUp" to backed_up;
+  alter table ${s}passkey rename column "createdAt" to created_at;
+
+  alter table ${s}sign_in_policy rename column "emailCode" to email_code;
+  alter table ${s}sign_in_policy rename column "twoFactor" to two_factor;
+  alter table ${s}sign_in_policy rename column "staffAccess" to staff_access;
+  alter table ${s}sign_in_policy rename column "platformSignIn" to platform_sign_in;
+  alter table ${s}sign_in_policy rename column "createdAt" to created_at;
+  alter table ${s}sign_in_policy rename column "createdBy" to created_by;
+
+  alter table ${s}staff_sign_in rename column "userId" to user_id;
+  alter table ${s}staff_sign_in rename column "userEmail" to user_email;
+  alter table ${s}staff_sign_in rename column "staffName" to staff_name;
+  alter table ${s}staff_sign_in rename column "staffSubject" to staff_subject;
+  alter table ${s}staff_sign_in rename column "sessionId" to session_id;
+  alter table ${s}staff_sign_in rename column "startedAt" to started_at;
+  alter table ${s}staff_sign_in rename column "expiresAt" to expires_at;
+  alter table ${s}staff_sign_in rename column "endedAt" to ended_at;
+
+  -- A primary key's index takes the new name with it.
+  alter table ${s}two_factor rename constraint "twoFactor_pkey" to two_factor_pkey;
+  alter table ${s}sign_in_policy rename constraint "signInPolicy_pkey" to sign_in_policy_pkey;
+  alter table ${s}staff_sign_in rename constraint "staffSignIn_pkey" to staff_sign_in_pkey;
+  alter table ${s}session rename constraint "session_userId_fkey" to session_user_id_fkey;
+  alter table ${s}account rename constraint "account_userId_fkey" to account_user_id_fkey;
+  alter table ${s}two_factor rename constraint "twoFactor_userId_fkey" to two_factor_user_id_fkey;
+  alter table ${s}passkey rename constraint "passkey_userId_fkey" to passkey_user_id_fkey;
+
+  alter index ${s}"session_userId_idx" rename to session_user_id_idx;
+  alter index ${s}"account_userId_idx" rename to account_user_id_idx;
+  alter index ${s}"twoFactor_secret_idx" rename to two_factor_secret_idx;
+  alter index ${s}"twoFactor_userId_idx" rename to two_factor_user_id_idx;
+  alter index ${s}"passkey_userId_idx" rename to passkey_user_id_idx;
+  alter index ${s}"passkey_credentialID_idx" rename to passkey_credential_id_idx;
+
+  -- Postgres 18 names each not-null constraint after its table and column, as "user_emailVerified_not_null"; earlier
+  -- versions keep no such constraints, so there is nothing to rename there.
+  for constraint_row in
+    select c.conrelid::regclass as table_name, c.conname as old_name, t.relname || '_' || a.attname || '_not_null' as new_name
+    from pg_constraint c
+    join pg_class t on t.oid = c.conrelid
+    join pg_attribute a on a.attrelid = c.conrelid and a.attnum = c.conkey[1]
+    where c.contype = 'n' and t.relnamespace = (select oid from pg_namespace where nspname = ${current}) and c.conname ~ '[A-Z]'
+  loop
+    execute format('alter table %s rename constraint %I to %I', constraint_row.table_name, constraint_row.old_name, constraint_row.new_name);
+  end loop;
+end
+$$;`;
+};
+//#endregion
+export { snakeCaseMigration };

package/dist/better-auth/snake-case-names.js

@@ -0,0 +1,72 @@
+//#region src/better-auth/snake-case-names.ts
+/** Better Auth's own tables, as its `user`, `session`, `account` and `verification` options name them. */
+const coreNames = {
+	user: { fields: {
+		emailVerified: "email_verified",
+		createdAt: "created_at",
+		updatedAt: "updated_at"
+	} },
+	session: { fields: {
+		expiresAt: "expires_at",
+		createdAt: "created_at",
+		updatedAt: "updated_at",
+		ipAddress: "ip_address",
+		userAgent: "user_agent",
+		userId: "user_id"
+	} },
+	account: { fields: {
+		accountId: "account_id",
+		providerId: "provider_id",
+		userId: "user_id",
+		accessToken: "access_token",
+		refreshToken: "refresh_token",
+		idToken: "id_token",
+		accessTokenExpiresAt: "access_token_expires_at",
+		refreshTokenExpiresAt: "refresh_token_expires_at",
+		createdAt: "created_at",
+		updatedAt: "updated_at"
+	} },
+	verification: { fields: {
+		expiresAt: "expires_at",
+		createdAt: "created_at",
+		updatedAt: "updated_at"
+	} }
+};
+/** The `schema` option of each plugin with tables or columns of its own. */
+const pluginNames = {
+	admin: {
+		user: { fields: {
+			banReason: "ban_reason",
+			banExpires: "ban_expires"
+		} },
+		session: { fields: { impersonatedBy: "impersonated_by" } }
+	},
+	jwt: { jwks: { fields: {
+		publicKey: "public_key",
+		privateKey: "private_key",
+		createdAt: "created_at",
+		expiresAt: "expires_at"
+	} } },
+	twoFactor: {
+		user: { fields: { twoFactorEnabled: "two_factor_enabled" } },
+		twoFactor: {
+			modelName: "two_factor",
+			fields: {
+				backupCodes: "backup_codes",
+				userId: "user_id",
+				failedVerificationCount: "failed_verification_count",
+				lockedUntil: "locked_until"
+			}
+		}
+	},
+	passkey: { passkey: { fields: {
+		publicKey: "public_key",
+		userId: "user_id",
+		credentialID: "credential_id",
+		deviceType: "device_type",
+		backedUp: "backed_up",
+		createdAt: "created_at"
+	} } }
+};
+//#endregion
+export { coreNames, pluginNames };

package/dist/better-auth/staff-log.js

@@ -1,52 +1,63 @@
 //#region src/better-auth/staff-log.ts
 /** Better Auth's model for the log of staff sign-ins: one row per session staff started as someone. */
 const staffSignInModel = "staffSignIn";
-const staffSignInSchema = { [staffSignInModel]: { fields: {
-	userId: {
-		type: "string",
-		required: true
-	},
-	userEmail: {
-		type: "string",
-		required: true
-	},
-	staff: {
-		type: "string",
-		required: true
-	},
-	staffName: {
-		type: "string",
-		required: false
-	},
-	staffSubject: {
-		type: "string",
-		required: true
-	},
-	issuer: {
-		type: "string",
-		required: true
-	},
-	reason: {
-		type: "string",
-		required: true
-	},
-	sessionId: {
-		type: "string",
-		required: true
-	},
-	startedAt: {
-		type: "date",
-		required: true
-	},
-	expiresAt: {
-		type: "date",
-		required: true
-	},
-	endedAt: {
-		type: "date",
-		required: false
+const staffSignInSchema = { [staffSignInModel]: {
+	modelName: "staff_sign_in",
+	fields: {
+		userId: {
+			type: "string",
+			required: true,
+			fieldName: "user_id"
+		},
+		userEmail: {
+			type: "string",
+			required: true,
+			fieldName: "user_email"
+		},
+		staff: {
+			type: "string",
+			required: true
+		},
+		staffName: {
+			type: "string",
+			required: false,
+			fieldName: "staff_name"
+		},
+		staffSubject: {
+			type: "string",
+			required: true,
+			fieldName: "staff_subject"
+		},
+		issuer: {
+			type: "string",
+			required: true
+		},
+		reason: {
+			type: "string",
+			required: true
+		},
+		sessionId: {
+			type: "string",
+			required: true,
+			fieldName: "session_id"
+		},
+		startedAt: {
+			type: "date",
+			required: true,
+			fieldName: "started_at"
+		},
+		expiresAt: {
+			type: "date",
+			required: true,
+			fieldName: "expires_at"
+		},
+		endedAt: {
+			type: "date",
+			required: false,
+			fieldName: "ended_at"
+		}
 	}
-} } };
+} };
 const entry = (row) => ({
 	id: row.id,
 	user: row.userEmail,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -30,9 +30,9 @@
   },
   "dependencies": {
     "@better-auth/passkey": "^1.7.7",
-    "@protobase/layout": "0.6.0",
-    "@protobase/query": "0.6.0",
-    "@protobase/schema": "0.6.0",
+    "@protobase/layout": "0.7.0",
+    "@protobase/query": "0.7.0",
+    "@protobase/schema": "0.7.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@simplewebauthn/server": "^13.3.1",
     "better-auth": "^1.7.7",