@beignet/provider-auth-better-auth 0.0.51 → 0.0.52

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @beignet/provider-auth-better-auth
 
+## 0.0.52
+
+### Patch Changes
+
+- b39bb6e: Clarify that Beignet applications require Node.js 22.12 or newer and can use
+  npm, pnpm, Yarn, or Bun for package management and framework commands.
+- c12b995: Correct repository-port examples in provider documentation and direct app
+  creation users to the public CLI reference.
+- 06eb712: Support Better Auth 1.7, scaffold its issuer-scoped account identity schema, and warn when upgraded Drizzle apps still need the account migration.
+
 ## 0.0.51
 
 ### Patch Changes

package/README.md

@@ -1,7 +1,6 @@
 # @beignet/provider-auth-better-auth
 
-> **Runtime:** Beignet requires Node.js 22.12 or newer. Bun 1.3.14 or newer is
-> supported for Beignet commands.
+> **Runtime:** Beignet requires Node.js 22.12 or newer. Bun is optional.
 
 > [!CAUTION]
 > Beignet is experimental alpha software. The `0.0.x` package line is for early
@@ -35,11 +34,11 @@ schema, and auth routes.
 ## Install
 
 ```bash
-bun add @beignet/core @beignet/provider-auth-better-auth better-auth@1.6.25
+bun add @beignet/core @beignet/provider-auth-better-auth better-auth@1.7.1
 ```
 
-The provider supports Better Auth `>=1.3.26 <1.7.0`. The standard Beignet
-starter pins Better Auth to `1.6.25` so clean installs use the version Beignet
+The provider supports Better Auth `>=1.3.26 <1.8.0`. The standard Beignet
+starter pins Better Auth to `1.7.1` so clean installs use the version Beignet
 validates in generated apps.
 
 ## Agent skills
@@ -98,6 +97,7 @@ export type AuthSession = BeignetAuthSession<AuthUser, AuthSessionMetadata>;
 ```ts
 // ports/index.ts
 import type { ActivityActor, GatePort } from "@beignet/core/ports";
+import type { UserRepository } from "@/features/users/ports";
 import type { AuthPort } from "./auth";
 
 export type AppAuthorizationContext = {
@@ -107,6 +107,7 @@ export type AppAuthorizationContext = {
 export type AppPorts = {
   auth: AuthPort;
   gate: GatePort<AppAuthorizationContext, []>;
+  users: UserRepository;
   // ...other ports (db, mailer, eventBus, etc.)
 };
 ```
@@ -238,17 +239,15 @@ You can also check authentication in use cases:
 
 ```ts
 // features/users/use-cases/get-profile.ts
-import { createUseCase } from "@beignet/core/application";
 import { z } from "zod";
 import { requireUser } from "@/lib/auth";
+import { useCase } from "@/lib/use-case";
 
 const UserProfileSchema = z.object({
   id: z.string(),
   email: z.string().email(),
 });
 
-const useCase = createUseCase<AppContext>();
-
 export const getUserProfile = useCase
   .query("users.profile")
   .input(z.object({ userId: z.string() }))
@@ -256,7 +255,7 @@ export const getUserProfile = useCase
   .run(async ({ ctx, input }) => {
     requireUser(ctx);
 
-    return ctx.ports.db.users.getProfile(input.userId);
+    return ctx.ports.users.getProfile(input.userId);
   });
 ```
 
@@ -266,6 +265,10 @@ request once with
 then call an app-owned helper such as `requireUser(ctx)` instead of depending
 on the raw request.
 
+`ctx.ports.users` is an app-owned feature repository. The database provider's
+`ctx.ports.db` entry exposes the database client and health check; it does not
+contain feature repositories.
+
 `beignet doctor --strict` checks that installed Better Auth providers are
 registered in `server/providers.ts`. The provider does not declare Beignet-owned
 env vars because Better Auth configuration, secrets, database adapter options,
@@ -337,6 +340,33 @@ plugin's current `failedVerificationCount` and `lockedUntil` fields. The
 standard Beignet starter does not enable two-factor authentication, so its
 default auth configuration does not require those fields.
 
+### Upgrading an existing app to Better Auth 1.7
+
+Better Auth 1.7 adds a required `issuer` field to `account` and a unique
+compound index across `issuer` and `accountId`. Fresh Beignet starters include
+both. Existing databases require a reviewed data migration before the 1.7
+runtime is deployed:
+
+1. Back up the auth tables and stop authentication writes.
+2. Add `issuer` as nullable, then populate it from a trusted provider mapping.
+   Credential accounts use `local:credential`, with `accountId` equal to the
+   linked user's stable ID.
+3. Check for duplicate `(issuer, accountId)` identities and resolve any
+   collisions without merging users by email.
+4. Make `issuer` non-nullable and add the
+   `account_issuer_accountId_uidx` unique index.
+5. Run `bunx auth generate`, review the Drizzle or Prisma output, apply it with
+   the app's migration tooling, and deploy the schema and Better Auth packages
+   together.
+
+SQLite requires a table rebuild to add the final `NOT NULL` constraint. Apps
+created from an older Beignet MySQL starter must also convert `account_id` from
+`text` to `varchar(255)` before creating the compound index. Social, SSO,
+SIWE, One Tap, and custom OAuth accounts need provider-specific issuer mapping;
+do not infer issuers from email or another mutable profile field. Follow Better
+Auth's [1.7 account identity migration](https://better-auth.com/docs/guides/1-7-upgrade-guide#account-identity-is-scoped-by-issuer)
+for the authoritative mapping and cutover sequence.
+
 Keep business authorization in feature policies and use Beignet auth hooks only
 for HTTP-boundary authentication.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@beignet/provider-auth-better-auth",
-  "version": "0.0.51",
+  "version": "0.0.52",
   "type": "module",
   "description": "Better Auth provider for Beignet - adds auth port for authentication and session management",
   "main": "./dist/index.js",
@@ -58,14 +58,14 @@
   },
   "peerDependencies": {
     "@beignet/core": ">=0.0.3 <1.0.0",
-    "better-auth": ">=1.3.26 <1.7.0"
+    "better-auth": ">=1.3.26 <1.8.0"
   },
   "devDependencies": {
     "@beignet/core": "*",
     "@beignet/devtools": "*",
-    "@types/bun": "^1.3.13",
+    "@types/bun": "^1.4.0",
     "@types/node": "^22.0.0",
-    "better-auth": "1.6.25",
+    "better-auth": "1.7.1",
     "typescript": "^5.3.0"
   },
   "beignet": {

package/skills/auth-provider/SKILL.md

@@ -144,7 +144,13 @@ action.
   out of devtools, audit metadata, and error reports.
 - After upgrading Better Auth or changing its plugins, regenerate the schema
   for the app's database adapter and apply the resulting migration before
-  deployment. Apps using `twoFactor()` need the current
+  deployment. Better Auth 1.7 requires `account.issuer` plus a unique
+  `(issuer, accountId)` index. Existing apps must pause auth writes, backfill
+  issuers from trusted provider identities, check collisions, then make
+  `issuer` non-nullable before deploying 1.7. Credential accounts use
+  `local:credential`; never derive a social issuer from email. Older Beignet
+  MySQL starters must also change `account_id` from `text` to `varchar(255)` so
+  the index is valid. Apps using `twoFactor()` need the current
   `failedVerificationCount` and `lockedUntil` fields. The standard Beignet
   starter does not enable two-factor authentication.