@opensaas/stack-auth 0.20.1 → 0.22.0

package/dist/config/plugin.js

@@ -1,3 +1,4 @@
+import { getDbKey } from '@opensaas/stack-core';
 import { normalizeAuthConfig } from './index.js';
 import { getAuthLists } from '../lists/index.js';
 import { convertBetterAuthSchema } from '../server/schema-converter.js';
@@ -32,8 +33,12 @@ export function authPlugin(config) {
             typeName: 'AuthRuntimeServices',
         },
         init: async (context) => {
-            // Get auth lists from base Better Auth schema
-            const authLists = getAuthLists(normalized.extendUserList);
+            // Derive the auth lists from the better-auth model config (modelName +
+            // field column maps). With no overrides this yields the historical
+            // User/Session/Account/Verification keys; with overrides (e.g.
+            // user.modelName: 'AuthUser') the lists are keyed and column-mapped to
+            // match the developer's live better-auth tables.
+            const authLists = getAuthLists(normalized.extendUserList, normalized.models);
             // Extract additional lists from Better Auth plugins
             for (const plugin of normalized.betterAuthPlugins) {
                 if (plugin && typeof plugin === 'object' && 'schema' in plugin) {
@@ -58,10 +63,18 @@ export function authPlugin(config) {
                     }
                 }
             }
-            // Add all auth lists
+            // Add all auth lists.
+            //
+            // The plugin only ever touches its OWN derived keys. When a developer
+            // renames the auth user model (e.g. user.modelName: 'AuthUser'), the
+            // derived key is 'AuthUser' and an app's separate 'User' list is left
+            // untouched — the plugin never extends/overwrites a list it didn't
+            // derive. Extending only kicks in when an existing list shares the
+            // derived key (e.g. the default 'User'), which is the intended
+            // "merge auth fields into my User" behaviour.
             for (const [listName, listConfig] of Object.entries(authLists)) {
                 if (context.config.lists[listName]) {
-                    // If user defined a User list, extend it with auth fields
+                    // A list already exists under this derived key — merge auth fields in.
                     context.extendList(listName, {
                         fields: listConfig.fields,
                         hooks: listConfig.hooks,
@@ -78,7 +91,40 @@ export function authPlugin(config) {
             // Access at runtime via: config._pluginData.auth
             context.setPluginData('auth', normalized);
         },
+        beforeGenerate: (generationConfig) => {
+            // Collect every schema the Auth lists are placed in (per-model schema,
+            // else the plugin-level schema). When none is configured the Auth lists
+            // stay in the default `public` schema and we leave the config untouched —
+            // the greenfield default Prisma schema is unchanged (no `schemas`, no
+            // `previewFeatures`, no `@@schema`).
+            const authSchemas = Array.from(new Set(Object.values(normalized.models)
+                .map((model) => model.schema)
+                .filter((schema) => Boolean(schema))));
+            if (authSchemas.length === 0) {
+                return generationConfig;
+            }
+            // Multi-schema Prisma requires the datasource to list every schema in use
+            // AND every model to carry an `@@schema`. Merge the auth schema(s) into the
+            // datasource `schemas` array (always including `public` for the app's own
+            // lists), and default any list without an explicit `db.schema` to `public`
+            // so the generated multi-schema schema is coherent and valid.
+            const schemas = Array.from(new Set(['public', ...(generationConfig.db.schemas ?? []), ...authSchemas]));
+            const lists = Object.fromEntries(Object.entries(generationConfig.lists).map(([listKey, listConfig]) => {
+                if (listConfig.db?.schema) {
+                    return [listKey, listConfig];
+                }
+                return [listKey, { ...listConfig, db: { ...listConfig.db, schema: 'public' } }];
+            }));
+            return {
+                ...generationConfig,
+                db: { ...generationConfig.db, schemas },
+                lists,
+            };
+        },
         runtime: (context) => {
+            // Resolve the user list's context.db key from the configured user model.
+            // context.db is keyed camelCase, so 'User' -> 'user', 'AuthUser' -> 'authUser'.
+            const userDbKey = getDbKey(normalized.models.user.modelName);
             // Provide auth-related utilities at runtime
             return {
                 /**
@@ -86,9 +132,7 @@ export function authPlugin(config) {
                  * Uses the access-controlled context to fetch user data
                  */
                 getUser: async (userId) => {
-                    // Use 'authUser' if custom User list name was provided, otherwise 'user'
-                    const userListKey = 'user'; // TODO: Make this configurable based on list name
-                    return await context.db[userListKey].findUnique({
+                    return await context.db[userDbKey].findUnique({
                         where: { id: userId },
                     });
                 },
@@ -100,8 +144,7 @@ export function authPlugin(config) {
                     if (!context.session?.userId) {
                         return null;
                     }
-                    const userListKey = 'user';
-                    return await context.db[userListKey].findUnique({
+                    return await context.db[userDbKey].findUnique({
                         where: { id: context.session.userId },
                     });
                 },

package/dist/config/plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../src/config/plugin.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAA;AAEvE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,UAAU,CAAC,MAAkB;IAC3C,MAAM,UAAU,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAA;IAE9C,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,OAAO;QAEhB,mBAAmB,EAAE;YACnB,MAAM,EAAE,iEAAiE;YACzE,QAAQ,EAAE,qBAAqB;SAChC;QAED,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACtB,8CAA8C;YAC9C,MAAM,SAAS,GAAG,YAAY,CAAC,UAAU,CAAC,cAAc,CAAC,CAAA;YAEzD,oDAAoD;YACpD,KAAK,MAAM,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,CAAC;gBAClD,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,QAAQ,IAAI,MAAM,EAAE,CAAC;oBAC/D,yDAAyD;oBACzD,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAA;oBAClC,MAAM,WAAW,GAAG,uBAAuB,CAAC,YAAY,CAAC,CAAA;oBAEzD,kCAAkC;oBAClC,KAAK,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;wBACjE,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;4BACnC,yBAAyB;4BACzB,OAAO,CAAC,UAAU,CAAC,QAAQ,EAAE;gCAC3B,MAAM,EAAE,UAAU,CAAC,MAAM;gCACzB,KAAK,EAAE,UAAU,CAAC,KAAK;gCACvB,MAAM,EAAE,UAAU,CAAC,MAAM;gCACzB,GAAG,EAAE,UAAU,CAAC,GAAG;6BACpB,CAAC,CAAA;wBACJ,CAAC;6BAAM,CAAC;4BACN,6BAA6B;4BAC7B,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;wBACvC,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAED,qBAAqB;YACrB,KAAK,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC/D,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACnC,0DAA0D;oBAC1D,OAAO,CAAC,UAAU,CAAC,QAAQ,EAAE;wBAC3B,MAAM,EAAE,UAAU,CAAC,MAAM;wBACzB,KAAK,EAAE,UAAU,CAAC,KAAK;wBACvB,MAAM,EAAE,UAAU,CAAC,MAAM;wBACzB,GAAG,EAAE,UAAU,CAAC,GAAG;qBACpB,CAAC,CAAA;gBACJ,CAAC;qBAAM,CAAC;oBACN,+BAA+B;oBAC/B,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;gBACvC,CAAC;YACH,CAAC;YAED,uCAAuC;YACvC,iDAAiD;YACjD,OAAO,CAAC,aAAa,CAAuB,MAAM,EAAE,UAAU,CAAC,CAAA;QACjE,CAAC;QAED,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE;YACnB,4CAA4C;YAC5C,OAAO;gBACL;;;mBAGG;gBACH,OAAO,EAAE,KAAK,EAAE,MAAc,EAAE,EAAE;oBAChC,yEAAyE;oBACzE,MAAM,WAAW,GAAG,MAAM,CAAA,CAAC,kDAAkD;oBAC7E,OAAO,MAAM,OAAO,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,UAAU,CAAC;wBAC9C,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;qBACtB,CAAC,CAAA;gBACJ,CAAC;gBAED;;;mBAGG;gBACH,cAAc,EAAE,KAAK,IAAI,EAAE;oBACzB,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;wBAC7B,OAAO,IAAI,CAAA;oBACb,CAAC;oBACD,MAAM,WAAW,GAAG,MAAM,CAAA;oBAC1B,OAAO,MAAM,OAAO,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,UAAU,CAAC;wBAC9C,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE;qBACtC,CAAC,CAAA;gBACJ,CAAC;aACF,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../src/config/plugin.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAE/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAA;AAEvE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,UAAU,CAAC,MAAkB;IAC3C,MAAM,UAAU,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAA;IAE9C,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,OAAO;QAEhB,mBAAmB,EAAE;YACnB,MAAM,EAAE,iEAAiE;YACzE,QAAQ,EAAE,qBAAqB;SAChC;QAED,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACtB,uEAAuE;YACvE,mEAAmE;YACnE,+DAA+D;YAC/D,uEAAuE;YACvE,iDAAiD;YACjD,MAAM,SAAS,GAAG,YAAY,CAAC,UAAU,CAAC,cAAc,EAAE,UAAU,CAAC,MAAM,CAAC,CAAA;YAE5E,oDAAoD;YACpD,KAAK,MAAM,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,CAAC;gBAClD,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,QAAQ,IAAI,MAAM,EAAE,CAAC;oBAC/D,yDAAyD;oBACzD,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAA;oBAClC,MAAM,WAAW,GAAG,uBAAuB,CAAC,YAAY,CAAC,CAAA;oBAEzD,kCAAkC;oBAClC,KAAK,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;wBACjE,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;4BACnC,yBAAyB;4BACzB,OAAO,CAAC,UAAU,CAAC,QAAQ,EAAE;gCAC3B,MAAM,EAAE,UAAU,CAAC,MAAM;gCACzB,KAAK,EAAE,UAAU,CAAC,KAAK;gCACvB,MAAM,EAAE,UAAU,CAAC,MAAM;gCACzB,GAAG,EAAE,UAAU,CAAC,GAAG;6BACpB,CAAC,CAAA;wBACJ,CAAC;6BAAM,CAAC;4BACN,6BAA6B;4BAC7B,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;wBACvC,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAED,sBAAsB;YACtB,EAAE;YACF,sEAAsE;YACtE,qEAAqE;YACrE,sEAAsE;YACtE,mEAAmE;YACnE,mEAAmE;YACnE,+DAA+D;YAC/D,8CAA8C;YAC9C,KAAK,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC/D,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACnC,uEAAuE;oBACvE,OAAO,CAAC,UAAU,CAAC,QAAQ,EAAE;wBAC3B,MAAM,EAAE,UAAU,CAAC,MAAM;wBACzB,KAAK,EAAE,UAAU,CAAC,KAAK;wBACvB,MAAM,EAAE,UAAU,CAAC,MAAM;wBACzB,GAAG,EAAE,UAAU,CAAC,GAAG;qBACpB,CAAC,CAAA;gBACJ,CAAC;qBAAM,CAAC;oBACN,+BAA+B;oBAC/B,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;gBACvC,CAAC;YACH,CAAC;YAED,uCAAuC;YACvC,iDAAiD;YACjD,OAAO,CAAC,aAAa,CAAuB,MAAM,EAAE,UAAU,CAAC,CAAA;QACjE,CAAC;QAED,cAAc,EAAE,CAAC,gBAAgB,EAAE,EAAE;YACnC,uEAAuE;YACvE,wEAAwE;YACxE,0EAA0E;YAC1E,sEAAsE;YACtE,qCAAqC;YACrC,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAC5B,IAAI,GAAG,CACL,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;iBAC7B,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;iBAC5B,MAAM,CAAC,CAAC,MAAM,EAAoB,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CACzD,CACF,CAAA;YAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7B,OAAO,gBAAgB,CAAA;YACzB,CAAC;YAED,0EAA0E;YAC1E,4EAA4E;YAC5E,0EAA0E;YAC1E,2EAA2E;YAC3E,8DAA8D;YAC9D,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CACxB,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,GAAG,WAAW,CAAC,CAAC,CAC5E,CAAA;YAED,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAC9B,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,EAAE;gBACnE,IAAI,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC;oBAC1B,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;gBAC9B,CAAC;gBACD,OAAO,CAAC,OAAO,EAAE,EAAE,GAAG,UAAU,EAAE,EAAE,EAAE,EAAE,GAAG,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAA;YACjF,CAAC,CAAC,CACH,CAAA;YAED,OAAO;gBACL,GAAG,gBAAgB;gBACnB,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,EAAE,EAAE,OAAO,EAAE;gBACvC,KAAK;aACN,CAAA;QACH,CAAC;QAED,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE;YACnB,yEAAyE;YACzE,gFAAgF;YAChF,MAAM,SAAS,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YAE5D,4CAA4C;YAC5C,OAAO;gBACL;;;mBAGG;gBACH,OAAO,EAAE,KAAK,EAAE,MAAc,EAAE,EAAE;oBAChC,OAAO,MAAM,OAAO,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC;wBAC5C,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;qBACtB,CAAC,CAAA;gBACJ,CAAC;gBAED;;;mBAGG;gBACH,cAAc,EAAE,KAAK,IAAI,EAAE;oBACzB,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;wBAC7B,OAAO,IAAI,CAAA;oBACb,CAAC;oBACD,OAAO,MAAM,OAAO,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC;wBAC5C,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE;qBACtC,CAAC,CAAA;gBACJ,CAAC;aACF,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/config/types.d.ts

@@ -75,6 +75,54 @@ export type SessionConfig = {
      */
     updateAge?: boolean;
 };
+/**
+ * Per-model better-auth configuration block.
+ *
+ * Mirrors better-auth's own `BetterAuthDBOptions` (the `user`/`session`/
+ * `account`/`verification` config a developer already writes): `modelName`
+ * renames the table/list and `fields` maps individual better-auth field names
+ * to database column names. The auth plugin derives its Auth lists from this
+ * config so the generated lists carry the same keys and column maps as the
+ * developer's live better-auth tables.
+ *
+ * @example
+ * ```typescript
+ * authPlugin({
+ *   user: { modelName: 'AuthUser', fields: { name: 'full_name' } },
+ *   session: { modelName: 'AuthSession' },
+ * })
+ * ```
+ */
+export type AuthModelConfig = {
+    /**
+     * The table/list name for this model.
+     * Becomes the OpenSaaS list key (and Prisma model name) and the table `@@map`.
+     * @default the default better-auth model name (e.g. 'User', 'Session')
+     */
+    modelName?: string;
+    /**
+     * Map better-auth field names to database column names.
+     * Each entry generates a `@map("column")` on the derived field.
+     *
+     * @example
+     * ```typescript
+     * fields: { name: 'full_name', emailVerified: 'email_verified' }
+     * ```
+     */
+    fields?: Record<string, string>;
+    /**
+     * Database schema (Postgres) for this auth model.
+     * Generates a `@@schema("...")` on the derived list, overriding the
+     * plugin-level {@link AuthConfig.schema} for this one model.
+     *
+     * @example
+     * ```typescript
+     * // Place the verification table in a different schema from the rest
+     * verification: { schema: 'auth_internal' }
+     * ```
+     */
+    schema?: string;
+};
 /**
  * Auth configuration options
  */
@@ -102,9 +150,56 @@ export type AuthConfig = {
      */
     socialProviders?: SocialProvidersConfig;
     /**
-     * Session configuration
+     * Session configuration.
+     *
+     * Carries session expiry settings as well as the better-auth `session` model
+     * config (`modelName` + field column `fields` maps) used to derive the Auth
+     * session list.
+     */
+    session?: SessionConfig & AuthModelConfig;
+    /**
+     * better-auth `user` model configuration (modelName + field column maps).
+     * Used to derive the Auth user list's key, table `@@map`, and field `@map`s.
+     *
+     * Custom fields beyond the better-auth basics are added via `extendUserList`.
      */
-    session?: SessionConfig;
+    user?: AuthModelConfig;
+    /**
+     * better-auth `account` model configuration (modelName + field column maps).
+     */
+    account?: AuthModelConfig;
+    /**
+     * better-auth `verification` model configuration (modelName + field column maps).
+     */
+    verification?: AuthModelConfig;
+    /**
+     * Database schema (Postgres) for the generated Auth lists.
+     *
+     * When set, all four Auth lists (user/session/account/verification) are placed
+     * in this schema via `@@schema(...)`, and the stack's multi-schema support is
+     * wired automatically: the datasource `schemas` array gains this schema (plus
+     * `public`) and the `multiSchema` preview feature is enabled. A per-model
+     * {@link AuthModelConfig.schema} overrides this for an individual list.
+     *
+     * Useful for adopting an existing separate-schema better-auth installation
+     * (e.g. an `auth` Postgres schema) so the generated lists diff clean against
+     * the live tables. When unset, the Auth lists stay in the default `public`
+     * schema and no `@@schema` is emitted (greenfield default unchanged).
+     *
+     * Only applies to the `postgresql` provider.
+     *
+     * @example Adopt an `auth`-schema better-auth install
+     * ```typescript
+     * authPlugin({
+     *   schema: 'auth',
+     *   user: { modelName: 'AuthUser' },
+     *   session: { modelName: 'AuthSession' },
+     *   account: { modelName: 'AuthAccount' },
+     *   verification: { modelName: 'AuthVerification' },
+     * })
+     * ```
+     */
+    schema?: string;
     /**
      * Which fields to include in the session object
      * This determines what data is available in access control functions
@@ -194,14 +289,46 @@ export type AuthConfig = {
         max?: number;
     };
 };
+/**
+ * Resolved per-model auth configuration after normalization.
+ * Always carries a concrete `modelName` (the developer's override or the
+ * better-auth default) and a (possibly empty) `fields` column map. `schema`
+ * carries the resolved Postgres schema for the model (per-model override, else
+ * the plugin-level schema, else `undefined` for the default `public` schema).
+ */
+export type NormalizedAuthModelConfig = {
+    modelName: string;
+    fields: Record<string, string>;
+    schema?: string;
+};
+/**
+ * Resolved auth model configuration for all four better-auth models.
+ * Consumed by the Auth-list derivation and the runtime user-key resolution.
+ */
+export type NormalizedAuthModels = {
+    user: NormalizedAuthModelConfig;
+    session: NormalizedAuthModelConfig;
+    account: NormalizedAuthModelConfig;
+    verification: NormalizedAuthModelConfig;
+};
 /**
  * Internal normalized auth configuration
  * Used after parsing user config
  */
-export type NormalizedAuthConfig = Required<Omit<AuthConfig, 'emailAndPassword' | 'emailVerification' | 'passwordReset' | 'betterAuthPlugins' | 'rateLimit'>> & {
+export type NormalizedAuthConfig = Required<Omit<AuthConfig, 'emailAndPassword' | 'emailVerification' | 'passwordReset' | 'betterAuthPlugins' | 'rateLimit' | 'session' | 'user' | 'account' | 'verification' | 'schema'>> & {
     emailAndPassword: Required<EmailPasswordConfig>;
     emailVerification: Required<EmailVerificationConfig>;
     passwordReset: Required<PasswordResetConfig>;
+    /** Resolved session expiry settings (model config lives under `models.session`). */
+    session: Required<SessionConfig>;
+    /** Resolved better-auth model config (modelName + field column maps + schema) for all auth models. */
+    models: NormalizedAuthModels;
+    /**
+     * Plugin-level Postgres schema for the Auth lists, if any. Resolved per-model
+     * schemas live on `models.<model>.schema`; this is the unresolved plugin-level
+     * default (used to wire the datasource `schemas` array during generation).
+     */
+    schema?: string;
     betterAuthPlugins: any[];
     rateLimit?: {
         enabled: boolean;

package/dist/config/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/config/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAE7D;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,CAAC,EAAE,aAAa,CAAA;IACtB,MAAM,CAAC,EAAE,aAAa,CAAA;IACtB,OAAO,CAAC,EAAE,aAAa,CAAA;IACvB,OAAO,CAAC,EAAE,aAAa,CAAA;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAAA;CACzC,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B;;;OAGG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAA;CAC9B,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,OAAO,EAAE,OAAO,CAAA;IAChB;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB;;OAEG;IACH,gBAAgB,CAAC,EAAE,mBAAmB,GAAG;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAA;IAE1D;;OAEG;IACH,iBAAiB,CAAC,EAAE,uBAAuB,GAAG;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAA;IAE/D;;OAEG;IACH,aAAa,CAAC,EAAE,mBAAmB,GAAG;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAA;IAEvD;;OAEG;IACH,eAAe,CAAC,EAAE,qBAAqB,CAAA;IAEvC;;OAEG;IACH,OAAO,CAAC,EAAE,aAAa,CAAA;IAEvB;;;;;;;;;;OAUG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IAExB;;;;;;;;;;;;OAYG;IACH,cAAc,CAAC,EAAE,oBAAoB,CAAA;IAErC;;;;;;;;;;OAUG;IACH,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAEpF;;;;;;;;;;;;OAYG;IAEH,iBAAiB,CAAC,EAAE,GAAG,EAAE,CAAA;IAEzB;;;;;;;;;;;;;;;;;;OAkBG;IACH,SAAS,CAAC,EAAE;QACV,OAAO,EAAE,OAAO,CAAA;QAChB;;;WAGG;QACH,MAAM,CAAC,EAAE,MAAM,CAAA;QACf;;;WAGG;QACH,GAAG,CAAC,EAAE,MAAM,CAAA;KACb,CAAA;CACF,CAAA;AAED;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CACzC,IAAI,CACF,UAAU,EACV,kBAAkB,GAAG,mBAAmB,GAAG,eAAe,GAAG,mBAAmB,GAAG,WAAW,CAC/F,CACF,GAAG;IACF,gBAAgB,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAA;IAC/C,iBAAiB,EAAE,QAAQ,CAAC,uBAAuB,CAAC,CAAA;IACpD,aAAa,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAA;IAE5C,iBAAiB,EAAE,GAAG,EAAE,CAAA;IACxB,SAAS,CAAC,EAAE;QACV,OAAO,EAAE,OAAO,CAAA;QAChB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,GAAG,CAAC,EAAE,MAAM,CAAA;KACb,CAAA;CACF,CAAA"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/config/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAE7D;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,CAAC,EAAE,aAAa,CAAA;IACtB,MAAM,CAAC,EAAE,aAAa,CAAA;IACtB,OAAO,CAAC,EAAE,aAAa,CAAA;IACvB,OAAO,CAAC,EAAE,aAAa,CAAA;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAAA;CACzC,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B;;;OAGG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAA;CAC9B,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,OAAO,EAAE,OAAO,CAAA;IAChB;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B;;;;;;;;;;OAUG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB;;OAEG;IACH,gBAAgB,CAAC,EAAE,mBAAmB,GAAG;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAA;IAE1D;;OAEG;IACH,iBAAiB,CAAC,EAAE,uBAAuB,GAAG;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAA;IAE/D;;OAEG;IACH,aAAa,CAAC,EAAE,mBAAmB,GAAG;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAA;IAEvD;;OAEG;IACH,eAAe,CAAC,EAAE,qBAAqB,CAAA;IAEvC;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,aAAa,GAAG,eAAe,CAAA;IAEzC;;;;;OAKG;IACH,IAAI,CAAC,EAAE,eAAe,CAAA;IAEtB;;OAEG;IACH,OAAO,CAAC,EAAE,eAAe,CAAA;IAEzB;;OAEG;IACH,YAAY,CAAC,EAAE,eAAe,CAAA;IAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IAEf;;;;;;;;;;OAUG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IAExB;;;;;;;;;;;;OAYG;IACH,cAAc,CAAC,EAAE,oBAAoB,CAAA;IAErC;;;;;;;;;;OAUG;IACH,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAEpF;;;;;;;;;;;;OAYG;IAEH,iBAAiB,CAAC,EAAE,GAAG,EAAE,CAAA;IAEzB;;;;;;;;;;;;;;;;;;OAkBG;IACH,SAAS,CAAC,EAAE;QACV,OAAO,EAAE,OAAO,CAAA;QAChB;;;WAGG;QACH,MAAM,CAAC,EAAE,MAAM,CAAA;QACf;;;WAGG;QACH,GAAG,CAAC,EAAE,MAAM,CAAA;KACb,CAAA;CACF,CAAA;AAED;;;;;;GAMG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AAED;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,yBAAyB,CAAA;IAC/B,OAAO,EAAE,yBAAyB,CAAA;IAClC,OAAO,EAAE,yBAAyB,CAAA;IAClC,YAAY,EAAE,yBAAyB,CAAA;CACxC,CAAA;AAED;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CACzC,IAAI,CACF,UAAU,EACR,kBAAkB,GAClB,mBAAmB,GACnB,eAAe,GACf,mBAAmB,GACnB,WAAW,GACX,SAAS,GACT,MAAM,GACN,SAAS,GACT,cAAc,GACd,QAAQ,CACX,CACF,GAAG;IACF,gBAAgB,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAA;IAC/C,iBAAiB,EAAE,QAAQ,CAAC,uBAAuB,CAAC,CAAA;IACpD,aAAa,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAA;IAC5C,oFAAoF;IACpF,OAAO,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAA;IAChC,sGAAsG;IACtG,MAAM,EAAE,oBAAoB,CAAA;IAC5B;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IAEf,iBAAiB,EAAE,GAAG,EAAE,CAAA;IACxB,SAAS,CAAC,EAAE;QACV,OAAO,EAAE,OAAO,CAAA;QAChB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,GAAG,CAAC,EAAE,MAAM,CAAA;KACb,CAAA;CACF,CAAA"}

package/dist/index.d.ts

@@ -31,6 +31,10 @@ export { normalizeAuthConfig } from './config/index.js';
 export { authPlugin } from './config/plugin.js';
 export type { AuthConfig, NormalizedAuthConfig } from './config/index.js';
 export type * from './config/types.js';
+export { deriveAuthLists } from './config/derive-auth-lists.js';
+export type { DerivedAuthLists } from './config/derive-auth-lists.js';
+export { adoptBetterAuthTables } from './config/adopt-better-auth-tables.js';
+export type { AdoptBetterAuthTablesOptions, AdoptBetterAuthTablesConfig, } from './config/adopt-better-auth-tables.js';
 export type { AuthRuntimeServices } from './runtime/types.js';
 export { getAuthLists, createUserList, createSessionList, createAccountList, createVerificationList, } from './lists/index.js';
 export type { ExtendUserListConfig } from './lists/index.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAGH,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAC/C,YAAY,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACzE,mBAAmB,mBAAmB,CAAA;AAGtC,YAAY,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AAG7D,OAAO,EACL,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAGH,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAC/C,YAAY,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACzE,mBAAmB,mBAAmB,CAAA;AAGtC,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AAC/D,YAAY,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAA;AAKrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAA;AAC5E,YAAY,EACV,4BAA4B,EAC5B,2BAA2B,GAC5B,MAAM,sCAAsC,CAAA;AAG7C,YAAY,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AAG7D,OAAO,EACL,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA"}

package/dist/index.js

@@ -30,6 +30,12 @@
 // Config exports
 export { normalizeAuthConfig } from './config/index.js';
 export { authPlugin } from './config/plugin.js';
+// Pure better-auth config -> Auth lists derivation (advanced use cases)
+export { deriveAuthLists } from './config/derive-auth-lists.js';
+// "Adopt existing better-auth tables" recipe — sets the model/schema knobs that
+// match a pre-existing separate-schema better-auth install so a migrating
+// project reaches Schema parity without rebuilding the config by hand.
+export { adoptBetterAuthTables } from './config/adopt-better-auth-tables.js';
 // List generators (for advanced use cases)
 export { getAuthLists, createUserList, createSessionList, createAccountList, createVerificationList, } from './lists/index.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,iBAAiB;AACjB,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAO/C,2CAA2C;AAC3C,OAAO,EACL,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,kBAAkB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,iBAAiB;AACjB,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAI/C,wEAAwE;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AAG/D,gFAAgF;AAChF,0EAA0E;AAC1E,uEAAuE;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAA;AAS5E,2CAA2C;AAC3C,OAAO,EACL,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,kBAAkB,CAAA"}

package/dist/lists/index.d.ts

@@ -1,4 +1,5 @@
 import type { ListConfig, FieldConfig } from '@opensaas/stack-core';
+import type { NormalizedAuthModels } from '../config/types.js';
 /**
  * Configuration for extending the auto-generated User list
  */
@@ -19,28 +20,33 @@ export type ExtendUserListConfig = {
     hooks?: ListConfig<any>['hooks'];
 };
 /**
- * Create the base User list with better-auth required fields
- * This matches the better-auth user schema
+ * Create the base User list with better-auth required fields.
+ *
+ * Backwards-compatible helper: derives the default `User` list (keyed `User`,
+ * default field shapes) via {@link deriveAuthLists}.
  */
 export declare function createUserList(config?: ExtendUserListConfig): ListConfig<any>;
 /**
- * Create the Session list for better-auth
- * Stores active user sessions
+ * Create the Session list for better-auth (default `Session` key).
  */
 export declare function createSessionList(): ListConfig<any>;
 /**
- * Create the Account list for better-auth
- * Stores OAuth provider accounts and credentials
+ * Create the Account list for better-auth (default `Account` key).
  */
 export declare function createAccountList(): ListConfig<any>;
 /**
- * Create the Verification list for better-auth
- * Stores email verification tokens, password reset tokens, etc.
+ * Create the Verification list for better-auth (default `Verification` key).
  */
 export declare function createVerificationList(): ListConfig<any>;
 /**
- * Get all auth lists required by better-auth
- * This is the main export used by withAuth()
+ * Get all auth lists required by better-auth.
+ *
+ * Derives the Auth lists from the resolved better-auth model config. When no
+ * `models` are supplied (or none carry overrides), the result is the historical
+ * default set keyed `User`/`Session`/`Account`/`Verification`.
+ *
+ * @param userConfig - Extra User-list fields/access/hooks (from `extendUserList`)
+ * @param models - Resolved better-auth model config; defaults to the better-auth defaults
  */
-export declare function getAuthLists(userConfig?: ExtendUserListConfig): Record<string, ListConfig<any>>;
+export declare function getAuthLists(userConfig?: ExtendUserListConfig, models?: NormalizedAuthModels): Record<string, ListConfig<any>>;
 //# sourceMappingURL=index.d.ts.map

package/dist/lists/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lists/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAEnE;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IACpC;;;OAGG;IAEH,MAAM,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAA;IAClC;;OAEG;IAEH,KAAK,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAA;CACjC,CAAA;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,MAAM,CAAC,EAAE,oBAAoB,GAC5B,UAAU,CAAC,GAAG,CAAC,CAqDjB;AAED;;;GAGG;AAEH,wBAAgB,iBAAiB,IAAI,UAAU,CAAC,GAAG,CAAC,CA+CnD;AAED;;;GAGG;AAEH,wBAAgB,iBAAiB,IAAI,UAAU,CAAC,GAAG,CAAC,CA0DnD;AAED;;;GAGG;AAEH,wBAAgB,sBAAsB,IAAI,UAAU,CAAC,GAAG,CAAC,CA2BxD;AAED;;;GAGG;AAEH,wBAAgB,YAAY,CAAC,UAAU,CAAC,EAAE,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAO/F"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lists/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACnE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAG9D;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IACpC;;;OAGG;IAEH,MAAM,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAA;IAClC;;OAEG;IAEH,KAAK,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAA;CACjC,CAAA;AAeD;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,MAAM,CAAC,EAAE,oBAAoB,GAE5B,UAAU,CAAC,GAAG,CAAC,CAEjB;AAED;;GAEG;AAEH,wBAAgB,iBAAiB,IAAI,UAAU,CAAC,GAAG,CAAC,CAEnD;AAED;;GAEG;AAEH,wBAAgB,iBAAiB,IAAI,UAAU,CAAC,GAAG,CAAC,CAEnD;AAED;;GAEG;AAEH,wBAAgB,sBAAsB,IAAI,UAAU,CAAC,GAAG,CAAC,CAExD;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,UAAU,CAAC,EAAE,oBAAoB,EACjC,MAAM,GAAE,oBAAqC,GAE5C,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAEjC"}

package/dist/lists/index.js

@@ -1,231 +1,57 @@
-import { list } from '@opensaas/stack-core';
-import { text, timestamp, checkbox, relationship } from '@opensaas/stack-core/fields';
+import { deriveAuthLists } from '../config/derive-auth-lists.js';
 /**
- * Create the base User list with better-auth required fields
- * This matches the better-auth user schema
+ * The default better-auth model config (no `modelName`/`fields` overrides).
+ * Produces the historical `User`/`Session`/`Account`/`Verification` keys with
+ * their original field shapes. Used by the backwards-compatible
+ * `createUserList`/`getAuthLists` helpers.
+ */
+const DEFAULT_MODELS = {
+    user: { modelName: 'User', fields: {} },
+    session: { modelName: 'Session', fields: {} },
+    account: { modelName: 'Account', fields: {} },
+    verification: { modelName: 'Verification', fields: {} },
+};
+/**
+ * Create the base User list with better-auth required fields.
+ *
+ * Backwards-compatible helper: derives the default `User` list (keyed `User`,
+ * default field shapes) via {@link deriveAuthLists}.
  */
 export function createUserList(config) {
-    return list({
-        fields: {
-            // Better-auth required fields
-            name: text({
-                validation: { isRequired: true },
-            }),
-            email: text({
-                validation: { isRequired: true },
-                isIndexed: 'unique',
-            }),
-            emailVerified: checkbox({
-                defaultValue: false,
-            }),
-            image: text(),
-            // Relationships to other auth tables
-            sessions: relationship({
-                ref: 'Session.user',
-                many: true,
-            }),
-            accounts: relationship({
-                ref: 'Account.user',
-                many: true,
-            }),
-            // Custom fields from user config
-            ...(config?.fields || {}),
-        },
-        access: config?.access || {
-            operation: {
-                // Anyone can query users (for displaying names, etc.)
-                query: () => true,
-                // Anyone can create a user (sign up)
-                create: () => true,
-                // Only update your own user record
-                update: ({ session, item }) => {
-                    if (!session)
-                        return false;
-                    const userId = session.userId;
-                    const itemId = item?.id;
-                    return userId === itemId;
-                },
-                // Only delete your own user record
-                delete: ({ session, item }) => {
-                    if (!session)
-                        return false;
-                    const userId = session.userId;
-                    const itemId = item?.id;
-                    return userId === itemId;
-                },
-            },
-        },
-        hooks: config?.hooks,
-    });
+    return deriveAuthLists(DEFAULT_MODELS, config).lists.User;
 }
 /**
- * Create the Session list for better-auth
- * Stores active user sessions
+ * Create the Session list for better-auth (default `Session` key).
  */
 // eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
 export function createSessionList() {
-    return list({
-        fields: {
-            // Session token (stored in cookie, used as primary key)
-            token: text({
-                validation: { isRequired: true },
-                isIndexed: 'unique',
-            }),
-            // Expiration timestamp
-            expiresAt: timestamp(),
-            // Optional: IP address for security
-            ipAddress: text(),
-            // Optional: User agent for security
-            userAgent: text(),
-            // Relationship to user (userId will be auto-generated)
-            user: relationship({
-                ref: 'User.sessions',
-            }),
-        },
-        access: {
-            operation: {
-                // Only the session owner can query their sessions
-                query: ({ session }) => {
-                    if (!session)
-                        return false;
-                    const userId = session.userId;
-                    if (!userId)
-                        return false;
-                    // Return Prisma filter for nested relationship
-                    return {
-                        user: {
-                            id: { equals: userId },
-                        },
-                    };
-                },
-                // Better-auth handles session creation
-                create: () => true,
-                // No manual updates
-                update: () => false,
-                // Better-auth handles session deletion (logout)
-                delete: ({ session, item }) => {
-                    if (!session)
-                        return false;
-                    const userId = session.userId;
-                    const itemUserId = item?.user?.id;
-                    return userId === itemUserId;
-                },
-            },
-        },
-    });
+    return deriveAuthLists(DEFAULT_MODELS).lists.Session;
 }
 /**
- * Create the Account list for better-auth
- * Stores OAuth provider accounts and credentials
+ * Create the Account list for better-auth (default `Account` key).
  */
 // eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
 export function createAccountList() {
-    return list({
-        fields: {
-            // Account identifier from provider
-            accountId: text({
-                validation: { isRequired: true },
-            }),
-            // Provider identifier (e.g., 'github', 'google', 'credentials')
-            providerId: text({
-                validation: { isRequired: true },
-            }),
-            // Relationship to user (userId will be auto-generated)
-            user: relationship({
-                ref: 'User.accounts',
-            }),
-            // OAuth tokens
-            accessToken: text(),
-            refreshToken: text(),
-            accessTokenExpiresAt: timestamp(),
-            refreshTokenExpiresAt: timestamp(),
-            scope: text(),
-            idToken: text(),
-            // Password hash for credential provider (better-auth stores in account table)
-            password: text(),
-        },
-        access: {
-            operation: {
-                // Only the account owner can query their accounts
-                query: ({ session }) => {
-                    if (!session)
-                        return false;
-                    const userId = session.userId;
-                    if (!userId)
-                        return false;
-                    // Return Prisma filter for nested relationship
-                    return {
-                        user: {
-                            id: { equals: userId },
-                        },
-                    };
-                },
-                // Better-auth handles account creation
-                create: () => true,
-                // Better-auth handles account updates (token refresh)
-                update: ({ session, item }) => {
-                    if (!session)
-                        return false;
-                    const userId = session.userId;
-                    const itemUserId = item?.user?.id;
-                    return userId === itemUserId;
-                },
-                // Account owner can delete their accounts
-                delete: ({ session, item }) => {
-                    if (!session)
-                        return false;
-                    const userId = session.userId;
-                    const itemUserId = item?.user?.id;
-                    return userId === itemUserId;
-                },
-            },
-        },
-    });
+    return deriveAuthLists(DEFAULT_MODELS).lists.Account;
 }
 /**
- * Create the Verification list for better-auth
- * Stores email verification tokens, password reset tokens, etc.
+ * Create the Verification list for better-auth (default `Verification` key).
  */
 // eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
 export function createVerificationList() {
-    return list({
-        fields: {
-            // Identifier (e.g., email address)
-            identifier: text({
-                validation: { isRequired: true },
-            }),
-            // Token value
-            value: text({
-                validation: { isRequired: true },
-            }),
-            // Expiration timestamp
-            expiresAt: timestamp(),
-        },
-        access: {
-            operation: {
-                // No public querying (better-auth handles verification internally)
-                query: () => false,
-                // Better-auth creates verification tokens
-                create: () => true,
-                // No updates
-                update: () => false,
-                // Better-auth deletes used/expired tokens
-                delete: () => true,
-            },
-        },
-    });
+    return deriveAuthLists(DEFAULT_MODELS).lists.Verification;
 }
 /**
- * Get all auth lists required by better-auth
- * This is the main export used by withAuth()
+ * Get all auth lists required by better-auth.
+ *
+ * Derives the Auth lists from the resolved better-auth model config. When no
+ * `models` are supplied (or none carry overrides), the result is the historical
+ * default set keyed `User`/`Session`/`Account`/`Verification`.
+ *
+ * @param userConfig - Extra User-list fields/access/hooks (from `extendUserList`)
+ * @param models - Resolved better-auth model config; defaults to the better-auth defaults
  */
-// eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
-export function getAuthLists(userConfig) {
-    return {
-        User: createUserList(userConfig),
-        Session: createSessionList(),
-        Account: createAccountList(),
-        Verification: createVerificationList(),
-    };
+export function getAuthLists(userConfig, models = DEFAULT_MODELS) {
+    return deriveAuthLists(models, userConfig || {}).lists;
 }
 //# sourceMappingURL=index.js.map