create-protobase 0.0.0-stage → 0.14.2

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/bin/create-protobase.mjs

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { run } from '../dist/index.js'
+
+await run(process.argv)

package/dist/create-project.js

@@ -0,0 +1,20 @@
+import path from "node:path";
+import { cpSync, existsSync, readFileSync, readdirSync, renameSync, writeFileSync } from "node:fs";
+//#region src/create-project.ts
+/**
+* Writes a new project to `targetDir` from `templateDir`, which the build writes from the scratch preset, with its
+* package.json named after the folder. The folder may exist only when it is empty.
+*/
+const createProject = (templateDir, targetDir) => {
+	if (existsSync(targetDir) && readdirSync(targetDir).length > 0) throw new Error(`${targetDir} is not empty`);
+	cpSync(templateDir, targetDir, { recursive: true });
+	for (const file of readdirSync(targetDir).filter((file) => file.startsWith("_"))) renameSync(path.join(targetDir, file), path.join(targetDir, file.slice(1)));
+	const packageFile = path.join(targetDir, "package.json");
+	const manifest = JSON.parse(readFileSync(packageFile, "utf8"));
+	writeFileSync(packageFile, `${JSON.stringify({
+		...manifest,
+		name: path.basename(targetDir)
+	}, null, 2)}\n`);
+};
+//#endregion
+export { createProject };

package/dist/index.js

@@ -0,0 +1,27 @@
+import { createProject } from "./create-project.js";
+import { nextSteps } from "./next-steps.js";
+import path from "node:path";
+import { parseArgs } from "node:util";
+//#region src/index.ts
+const templateDir = path.join(import.meta.dirname, "template");
+const usage = "usage: npm create protobase <dir>";
+const create = (argv) => {
+	const { positionals } = parseArgs({
+		args: argv.slice(2),
+		allowPositionals: true
+	});
+	const [dir, ...extra] = positionals;
+	if (!dir || extra.length > 0) throw new Error(usage);
+	createProject(templateDir, path.resolve(dir));
+	process.stdout.write(`Created a Protobase project in ${dir}. Next:\n\n${nextSteps(dir)}`);
+};
+const run = (argv) => {
+	try {
+		create(argv);
+	} catch (error) {
+		process.stderr.write(`error: ${error.message}\n`);
+		process.exitCode = 1;
+	}
+};
+//#endregion
+export { run };

package/dist/next-steps.js

@@ -0,0 +1,12 @@
+//#region src/next-steps.ts
+/** What to run in a new project, from `cwd`'s point of view, until its admin app serves. */
+const nextSteps = (dir) => [
+	`cd ${dir}`,
+	"bun install",
+	"cp .env.example .env   # then set DATABASE_URL and BETTER_AUTH_SECRET",
+	"bun run db:migrate",
+	"bun run protobase users create you@example.com --generate-password",
+	"bun run dev            # http://localhost:5173"
+].map((line) => `  ${line}\n`).join("");
+//#endregion
+export { nextSteps };

package/dist/template/.env.example

@@ -0,0 +1,8 @@
+# The app's settings for `protobase dev`, `protobase serve` and the db:* scripts; a deployed app gets them from its host.
+DATABASE_URL=postgres://protobase:protobase@localhost:55432/scratch
+
+# Admin store (Better Auth users, sessions, signing keys): the `auth` schema of DATABASE_URL, created by `db:migrate`.
+BETTER_AUTH_URL=http://localhost:5173
+# Signs cookies and encrypts the token keys. Generate your own: openssl rand -base64 32
+BETTER_AUTH_SECRET=change-me-generate-with-openssl-rand-base64-32
+# TRUSTED_ORIGINS=

package/dist/template/AGENTS.md

@@ -0,0 +1,22 @@
+# Working on this app
+
+A Protobase app: each resource's data config in `config/<name>/data.ts` and its screens in `config/<name>/ui.ts`, all
+exported from `config/index.ts`, over a Postgres database. Reference: https://docs.protobase.net. It starts empty: the
+first change adds its first tables and resources.
+
+## Database changes
+
+- Every schema change is a new migration file in `db/migrations/`, numbered after the last one (`001_customers.sql`
+  first). Never edit or remove a migration that exists: it has already run on the live database.
+- Expand only, where possible: add tables, columns and indexes, and keep what the running app still reads. Rename or
+  drop only when asked to, once nothing uses it.
+
+## Never touch
+
+- `auth/` and the `auth` schema: sign-in and accounts.
+- `.github/workflows/`.
+
+## Scripts
+
+The platform runs `db:migrate` (the auth schema's migrations included), `typecheck` and `test`, with their settings in
+the environment: keep them working. Run `typecheck` and `test` before you finish.

package/dist/template/_.gitignore

@@ -0,0 +1,3 @@
+node_modules
+dist
+.env

package/dist/template/_bunfig.toml

@@ -0,0 +1,4 @@
+# `bun run` runs scripts and package bins on Bun even when Node is on PATH, whose `#!/usr/bin/env node` would otherwise
+# start Node.
+[run]
+bun = true

package/dist/template/auth/auth.ts

@@ -0,0 +1,26 @@
+import { PostgresDialect } from 'kysely'
+import pg from 'pg'
+import { betterAuthAuthenticator, createAuth, handleDroppedConnections } from '@protobase/server'
+import { databaseUrl } from '../db/connection'
+
+const secret = process.env.BETTER_AUTH_SECRET
+if (!secret) throw new Error('BETTER_AUTH_SECRET is not set; generate one with `openssl rand -base64 32` and put it in .env')
+
+// One pool across hot reloads of this module
+const store = globalThis as { __adminPool?: pg.Pool }
+store.__adminPool ??= handleDroppedConnections(new pg.Pool({ connectionString: databaseUrl, max: 5 }))
+
+/** The admin store (Better Auth's users, sessions and signing keys) lives in this schema, next to the app's own schemas. */
+export const authSchema = 'auth'
+
+export const auth = createAuth({
+  database: { dialect: new PostgresDialect({ pool: store.__adminPool }), type: 'postgres', schemaName: authSchema, transaction: true },
+  baseURL: process.env.BETTER_AUTH_URL ?? 'http://localhost:5173',
+  secret,
+  // No defaultRole on purpose: every account is created with an explicit role (`protobase users create --role`).
+  roles: ['admin'],
+  trustedOrigins: process.env.TRUSTED_ORIGINS?.split(',').filter(Boolean),
+})
+
+/** Every user works in tenant 1, which access rules can compare with an organization_id column. */
+export const authenticate = betterAuthAuthenticator({ auth, tenant: 1 })

package/dist/template/config/index.ts

@@ -0,0 +1,4 @@
+// Every resource, view and page of the app, exported from here: `export * from './orders/data'`. A new app has no
+// resources yet, only the Users page, for admins; it is deployed with its first change.
+export { usersPage } from '@protobase/layout'
+export { accountMenu } from './user-menu'

package/dist/template/config/user-menu.ts

@@ -0,0 +1,4 @@
+import { userMenu } from '@protobase/schema'
+
+/** The profile menu's own pages: Users, for admins. */
+export const accountMenu = userMenu((m) => [m.page('accounts', { label: 'Users', icon: 'users' })])

package/dist/template/db/connection.ts

@@ -0,0 +1,8 @@
+import postgres from 'postgres'
+
+const url = process.env.DATABASE_URL
+if (!url) throw new Error('DATABASE_URL is not set; put it in .env')
+
+export const databaseUrl = url
+
+export const connect = (options: postgres.Options<{}> = {}) => postgres(databaseUrl, { onnotice: () => {}, ...options })

package/dist/template/db/migrate.ts

@@ -0,0 +1,30 @@
+import { readdir, readFile } from 'node:fs/promises'
+import { fileURLToPath } from 'node:url'
+import { connect } from './connection'
+
+// Applies the migrations not applied yet, the app's and the auth schema's alike, in file name order and in one
+// transaction: when one fails, none is applied and the database stays as the running version expects it. Run it before
+// a new version serves, while nothing else writes. A statement Postgres runs only outside a transaction, such as
+// `create index concurrently`, does not belong in these files.
+
+const directory = fileURLToPath(new URL('./migrations/', import.meta.url))
+// Any constant shared by every run of this script: two runs at once take turns.
+const lockKey = 7_311_946_202
+
+const sql = connect({ max: 1 })
+const files = (await readdir(directory)).filter((file) => file.endsWith('.sql')).sort()
+
+const applied = await sql.begin(async (tx) => {
+  await tx`select pg_advisory_xact_lock(${lockKey})`
+  await tx`create table if not exists public.schema_migrations (name text primary key, applied_at timestamptz not null default now())`
+  const done = new Set((await tx`select name from public.schema_migrations`).map((row) => row.name))
+  const pending = files.filter((file) => !done.has(file))
+  for (const file of pending) {
+    await tx.unsafe(await readFile(directory + file, 'utf8'))
+    await tx`insert into public.schema_migrations (name) values (${file})`
+  }
+  return pending
+})
+for (const file of applied) console.log(`applied ${file}`)
+
+await sql.end()

package/dist/template/db/migrations/001_auth.sql

@@ -0,0 +1,36 @@
+-- The auth schema changes this version of Protobase needs, written by `protobase auth migration`.
+-- Applied with the project's other migrations; edit or remove statements the project handles differently.
+
+create schema if not exists "auth";
+
+create table if not exists "auth"."user" ("id" text not null primary key, "name" text not null, "email" text not null unique, "email_verified" boolean not null, "image" text, "created_at" timestamptz default CURRENT_TIMESTAMP not null, "updated_at" timestamptz default CURRENT_TIMESTAMP not null, "role" text, "banned" boolean, "ban_reason" text, "ban_expires" timestamptz, "two_factor_enabled" boolean);
+
+create table if not exists "auth"."session" ("id" text not null primary key, "expires_at" timestamptz not null, "token" text not null unique, "created_at" timestamptz default CURRENT_TIMESTAMP not null, "updated_at" timestamptz not null, "ip_address" text, "user_agent" text, "user_id" text not null references "auth"."user" ("id") on delete cascade, "impersonated_by" text);
+
+create table if not exists "auth"."account" ("id" text not null primary key, "account_id" text not null, "provider_id" text not null, "user_id" text not null references "auth"."user" ("id") on delete cascade, "access_token" text, "refresh_token" text, "id_token" text, "access_token_expires_at" timestamptz, "refresh_token_expires_at" timestamptz, "scope" text, "password" text, "created_at" timestamptz default CURRENT_TIMESTAMP not null, "updated_at" timestamptz not null);
+
+create table if not exists "auth"."verification" ("id" text not null primary key, "identifier" text not null, "value" text not null, "expires_at" timestamptz not null, "created_at" timestamptz default CURRENT_TIMESTAMP not null, "updated_at" timestamptz default CURRENT_TIMESTAMP not null);
+
+create table if not exists "auth"."jwks" ("id" text not null primary key, "public_key" text not null, "private_key" text not null, "created_at" timestamptz not null, "expires_at" timestamptz, "alg" text, "crv" text);
+
+create table if not exists "auth"."two_factor" ("id" text not null primary key, "secret" text not null, "backup_codes" text not null, "user_id" text not null references "auth"."user" ("id") on delete cascade, "verified" boolean, "failed_verification_count" integer, "locked_until" timestamptz);
+
+create table if not exists "auth"."passkey" ("id" text not null primary key, "name" text, "public_key" text not null, "user_id" text not null references "auth"."user" ("id") on delete cascade, "credential_id" text not null, "counter" integer not null, "device_type" text not null, "backed_up" boolean not null, "transports" text, "created_at" timestamptz, "aaguid" text);
+
+create table if not exists "auth"."sign_in_policy" ("id" text not null primary key, "password" text not null, "email_code" text not null, "passkey" text not null, "two_factor" text not null, "staff_access" text not null, "platform_sign_in" text not null, "created_at" timestamptz not null, "created_by" text);
+
+create table if not exists "auth"."staff_sign_in" ("id" text not null primary key, "user_id" text not null, "user_email" text not null, "staff" text not null, "staff_name" text, "staff_subject" text not null, "issuer" text not null, "reason" text not null, "session_id" text not null, "started_at" timestamptz not null, "expires_at" timestamptz not null, "ended_at" timestamptz);
+
+create index if not exists "session_user_id_idx" on "auth"."session" ("user_id");
+
+create index if not exists "account_user_id_idx" on "auth"."account" ("user_id");
+
+create index if not exists "verification_identifier_idx" on "auth"."verification" ("identifier");
+
+create index if not exists "two_factor_secret_idx" on "auth"."two_factor" ("secret");
+
+create index if not exists "two_factor_user_id_idx" on "auth"."two_factor" ("user_id");
+
+create index if not exists "passkey_user_id_idx" on "auth"."passkey" ("user_id");
+
+create index if not exists "passkey_credential_id_idx" on "auth"."passkey" ("credential_id");

package/dist/template/db/migrations/002_auth_snake_case.sql

@@ -0,0 +1,109 @@
+-- The auth schema changes this version of Protobase needs, written by `protobase auth migration`.
+-- Applied with the project's other migrations; edit or remove statements the project handles differently.
+
+-- Renames the auth store of Protobase 0.6 to snake_case. A store set up with the snake_case names has no "emailVerified"
+-- and is left as it is.
+do $$
+declare
+  constraint_row record;
+begin
+  if not exists (select from information_schema.columns where table_schema = 'auth' and table_name = 'user' and column_name = 'emailVerified') then
+    return;
+  end if;
+
+  alter table "auth"."twoFactor" rename to two_factor;
+  alter table "auth"."signInPolicy" rename to sign_in_policy;
+  alter table "auth"."staffSignIn" rename to staff_sign_in;
+
+  alter table "auth"."user" rename column "emailVerified" to email_verified;
+  alter table "auth"."user" rename column "createdAt" to created_at;
+  alter table "auth"."user" rename column "updatedAt" to updated_at;
+  alter table "auth"."user" rename column "banReason" to ban_reason;
+  alter table "auth"."user" rename column "banExpires" to ban_expires;
+  alter table "auth"."user" rename column "twoFactorEnabled" to two_factor_enabled;
+
+  alter table "auth".session rename column "expiresAt" to expires_at;
+  alter table "auth".session rename column "createdAt" to created_at;
+  alter table "auth".session rename column "updatedAt" to updated_at;
+  alter table "auth".session rename column "ipAddress" to ip_address;
+  alter table "auth".session rename column "userAgent" to user_agent;
+  alter table "auth".session rename column "userId" to user_id;
+  alter table "auth".session rename column "impersonatedBy" to impersonated_by;
+
+  alter table "auth".account rename column "accountId" to account_id;
+  alter table "auth".account rename column "providerId" to provider_id;
+  alter table "auth".account rename column "userId" to user_id;
+  alter table "auth".account rename column "accessToken" to access_token;
+  alter table "auth".account rename column "refreshToken" to refresh_token;
+  alter table "auth".account rename column "idToken" to id_token;
+  alter table "auth".account rename column "accessTokenExpiresAt" to access_token_expires_at;
+  alter table "auth".account rename column "refreshTokenExpiresAt" to refresh_token_expires_at;
+  alter table "auth".account rename column "createdAt" to created_at;
+  alter table "auth".account rename column "updatedAt" to updated_at;
+
+  alter table "auth".verification rename column "expiresAt" to expires_at;
+  alter table "auth".verification rename column "createdAt" to created_at;
+  alter table "auth".verification rename column "updatedAt" to updated_at;
+
+  alter table "auth".jwks rename column "publicKey" to public_key;
+  alter table "auth".jwks rename column "privateKey" to private_key;
+  alter table "auth".jwks rename column "createdAt" to created_at;
+  alter table "auth".jwks rename column "expiresAt" to expires_at;
+
+  alter table "auth".two_factor rename column "backupCodes" to backup_codes;
+  alter table "auth".two_factor rename column "userId" to user_id;
+  alter table "auth".two_factor rename column "failedVerificationCount" to failed_verification_count;
+  alter table "auth".two_factor rename column "lockedUntil" to locked_until;
+
+  alter table "auth".passkey rename column "publicKey" to public_key;
+  alter table "auth".passkey rename column "userId" to user_id;
+  alter table "auth".passkey rename column "credentialID" to credential_id;
+  alter table "auth".passkey rename column "deviceType" to device_type;
+  alter table "auth".passkey rename column "backedUp" to backed_up;
+  alter table "auth".passkey rename column "createdAt" to created_at;
+
+  alter table "auth".sign_in_policy rename column "emailCode" to email_code;
+  alter table "auth".sign_in_policy rename column "twoFactor" to two_factor;
+  alter table "auth".sign_in_policy rename column "staffAccess" to staff_access;
+  alter table "auth".sign_in_policy rename column "platformSignIn" to platform_sign_in;
+  alter table "auth".sign_in_policy rename column "createdAt" to created_at;
+  alter table "auth".sign_in_policy rename column "createdBy" to created_by;
+
+  alter table "auth".staff_sign_in rename column "userId" to user_id;
+  alter table "auth".staff_sign_in rename column "userEmail" to user_email;
+  alter table "auth".staff_sign_in rename column "staffName" to staff_name;
+  alter table "auth".staff_sign_in rename column "staffSubject" to staff_subject;
+  alter table "auth".staff_sign_in rename column "sessionId" to session_id;
+  alter table "auth".staff_sign_in rename column "startedAt" to started_at;
+  alter table "auth".staff_sign_in rename column "expiresAt" to expires_at;
+  alter table "auth".staff_sign_in rename column "endedAt" to ended_at;
+
+  -- A primary key's index takes the new name with it.
+  alter table "auth".two_factor rename constraint "twoFactor_pkey" to two_factor_pkey;
+  alter table "auth".sign_in_policy rename constraint "signInPolicy_pkey" to sign_in_policy_pkey;
+  alter table "auth".staff_sign_in rename constraint "staffSignIn_pkey" to staff_sign_in_pkey;
+  alter table "auth".session rename constraint "session_userId_fkey" to session_user_id_fkey;
+  alter table "auth".account rename constraint "account_userId_fkey" to account_user_id_fkey;
+  alter table "auth".two_factor rename constraint "twoFactor_userId_fkey" to two_factor_user_id_fkey;
+  alter table "auth".passkey rename constraint "passkey_userId_fkey" to passkey_user_id_fkey;
+
+  alter index "auth"."session_userId_idx" rename to session_user_id_idx;
+  alter index "auth"."account_userId_idx" rename to account_user_id_idx;
+  alter index "auth"."twoFactor_secret_idx" rename to two_factor_secret_idx;
+  alter index "auth"."twoFactor_userId_idx" rename to two_factor_user_id_idx;
+  alter index "auth"."passkey_userId_idx" rename to passkey_user_id_idx;
+  alter index "auth"."passkey_credentialID_idx" rename to passkey_credential_id_idx;
+
+  -- Postgres 18 names each not-null constraint after its table and column, as "user_emailVerified_not_null"; earlier
+  -- versions keep no such constraints, so there is nothing to rename there.
+  for constraint_row in
+    select c.conrelid::regclass as table_name, c.conname as old_name, t.relname || '_' || a.attname || '_not_null' as new_name
+    from pg_constraint c
+    join pg_class t on t.oid = c.conrelid
+    join pg_attribute a on a.attrelid = c.conrelid and a.attnum = c.conkey[1]
+    where c.contype = 'n' and t.relnamespace = (select oid from pg_namespace where nspname = 'auth') and c.conname ~ '[A-Z]'
+  loop
+    execute format('alter table %s rename constraint %I to %I', constraint_row.table_name, constraint_row.old_name, constraint_row.new_name);
+  end loop;
+end
+$$;

package/dist/template/db/migrations/003_auth.sql

@@ -0,0 +1,6 @@
+-- The auth schema changes this version of Protobase needs, written by `protobase auth migration`.
+-- Applied with the project's other migrations; edit or remove statements the project handles differently.
+
+alter table "auth"."user" add column if not exists "last_role" text;
+
+alter table "auth"."session" add column if not exists "active_role" text;

package/dist/template/db/migrations/004_auth.sql

@@ -0,0 +1,4 @@
+-- The auth schema changes this version of Protobase needs, written by `protobase migration`.
+-- Applied with the project's other migrations; edit or remove statements the project handles differently.
+
+alter table "auth"."passkey" add column if not exists "rp_id" text;

package/dist/template/node-types.d.ts

@@ -0,0 +1 @@
+/// <reference types="node" />

package/dist/template/package.json

@@ -0,0 +1,35 @@
+{
+  "name": "scratch",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "db:migrate": "bun db/migrate.ts",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "protobase": "protobase",
+    "build": "protobase build",
+    "serve": "protobase build && protobase serve dist",
+    "dev": "protobase dev"
+  },
+  "dependencies": {
+    "@protobase/cli": ">=0.14.2 <1",
+    "@protobase/layout": ">=0.14.2 <1",
+    "@protobase/schema": ">=0.14.2 <1",
+    "@protobase/server": ">=0.14.2 <1",
+    "@protobase/ui": ">=0.14.2 <1",
+    "better-auth": "^1.7.7",
+    "jose": "^6.2.12",
+    "kysely": "^0.29.6",
+    "pg": "^8.23.1",
+    "postgres": "^3.4.9",
+    "react": "^19.3.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.20.5",
+    "@types/pg": "^8.23.1",
+    "@types/react": "^19.3.0",
+    "typescript": "^6.0.3",
+    "vitest": "^5.0.3"
+  }
+}

package/dist/template/protobase.config.ts

@@ -0,0 +1,4 @@
+import * as config from './config'
+import { auth, authenticate } from './auth/auth'
+
+export default { config, auth, authenticate }

package/dist/template/tsconfig.json

@@ -0,0 +1,16 @@
+{
+  "compilerOptions": {
+    "target": "ES2023",
+    "lib": ["ES2023", "DOM", "DOM.Iterable"],
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "jsx": "react-jsx",
+    "strict": true,
+    "noUncheckedIndexedAccess": true,
+    "verbatimModuleSyntax": true,
+    "isolatedModules": true,
+    "skipLibCheck": true,
+    "noEmit": true
+  },
+  "exclude": ["node_modules", "dist"]
+}

package/dist/template/vitest.config.ts

@@ -0,0 +1,4 @@
+import { defineConfig } from 'vitest/config'
+
+// Unit tests sit next to the code they test; a new project has none yet.
+export default defineConfig({ test: { include: ['**/*.test.ts'], exclude: ['node_modules/**', 'dist/**'], passWithNoTests: true } })

package/package.json

@@ -1,6 +1,30 @@
 {
   "name": "create-protobase",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.14.2",
+  "description": "npm create protobase: starts a new Protobase project from scratch.",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/PrototeamHQ/protobase.git",
+    "directory": "packages/create-protobase"
+  },
+  "homepage": "https://docs.protobase.net",
+  "type": "module",
+  "engines": {
+    "node": ">=22.12.0"
+  },
+  "bin": {
+    "create-protobase": "./bin/create-protobase.mjs"
+  },
+  "files": [
+    "bin",
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsdown && bun ../presets/src/write-template.ts",
+    "prepack": "tsdown && bun ../presets/src/write-template.ts"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.