@opensaas/stack-auth 0.27.1 → 0.28.0

package/dist/config/types.d.ts

@@ -1,3 +1,4 @@
+import type { ListConfig } from '@opensaas/stack-core';
 import type { ExtendUserListConfig } from '../lists/index.js';
 /**
  * OAuth provider configuration
@@ -93,6 +94,47 @@ export type SessionConfig = {
  * })
  * ```
  */
+/**
+ * App-authored operation + field-level access control for the Auth lists,
+ * keyed by better-auth model name (not by the derived list key, so it stays
+ * remap-proof when e.g. `user.modelName: 'AuthUser'`).
+ *
+ * Per ADR-0013, the auth plugin ships its created lists (User/Session/
+ * Account/Verification) **closed** — no permissive defaults. This is the
+ * application's seam to grant them access: the plugin applies each entry to
+ * the corresponding list when it creates it (its own `addList` path), so the
+ * access rides along with the list's `@@map`/`@@schema`/fields and can't
+ * drift from the plugin's shape. A model with no entry here stays closed
+ * (deny-by-default).
+ *
+ * @example
+ * ```typescript
+ * authPlugin({
+ *   access: {
+ *     // Signed-in users can read the directory; only self can write.
+ *     user: {
+ *       operation: {
+ *         query: ({ session }) => !!session,
+ *         update: ({ session, item }) => session?.userId === item.id,
+ *       },
+ *     },
+ *     // A user can read only their own sessions.
+ *     session: {
+ *       operation: {
+ *         query: ({ session }) =>
+ *           session ? { user: { id: { equals: session.userId } } } : false,
+ *       },
+ *     },
+ *   },
+ * })
+ * ```
+ */
+export type AuthAccessConfig = {
+    user?: ListConfig<any>['access'];
+    session?: ListConfig<any>['access'];
+    account?: ListConfig<any>['access'];
+    verification?: ListConfig<any>['access'];
+};
 export type AuthModelConfig = {
     /**
      * The table/list name for this model.
@@ -226,6 +268,22 @@ export type AuthConfig = {
      * ```
      */
     extendUserList?: ExtendUserListConfig;
+    /**
+     * App-authored access control for the Auth lists (User/Session/Account/
+     * Verification), keyed by better-auth model name. See {@link AuthAccessConfig}.
+     *
+     * Per ADR-0013 the auth plugin ships these lists **closed** by default — a
+     * model with no entry here denies every operation (`context.db` reads/writes
+     * return `null`/`[]` and the list doesn't surface in the admin UI). Grant
+     * access explicitly for any Auth list your application reads or writes
+     * through `context.db`.
+     *
+     * For the `user` model specifically, {@link ExtendUserListConfig.access}
+     * (via `extendUserList.access`) is still honoured and takes precedence over
+     * `access.user` if both are set — it predates this option and remains the
+     * narrower, User-specific override.
+     */
+    access?: AuthAccessConfig;
     /**
      * Custom email sending function for verification and password reset
      * If not provided, emails will be logged to console

package/dist/config/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/config/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAE7D;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,CAAC,EAAE,aAAa,CAAA;IACtB,MAAM,CAAC,EAAE,aAAa,CAAA;IACtB,OAAO,CAAC,EAAE,aAAa,CAAA;IACvB,OAAO,CAAC,EAAE,aAAa,CAAA;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAAA;CACzC,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B;;;OAGG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAA;CAC9B,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,OAAO,EAAE,OAAO,CAAA;IAChB;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B;;;;;;;;;;OAUG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB;;OAEG;IACH,gBAAgB,CAAC,EAAE,mBAAmB,GAAG;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAA;IAE1D;;OAEG;IACH,iBAAiB,CAAC,EAAE,uBAAuB,GAAG;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAA;IAE/D;;OAEG;IACH,aAAa,CAAC,EAAE,mBAAmB,GAAG;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAA;IAEvD;;OAEG;IACH,eAAe,CAAC,EAAE,qBAAqB,CAAA;IAEvC;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,aAAa,GAAG,eAAe,CAAA;IAEzC;;;;;OAKG;IACH,IAAI,CAAC,EAAE,eAAe,CAAA;IAEtB;;OAEG;IACH,OAAO,CAAC,EAAE,eAAe,CAAA;IAEzB;;OAEG;IACH,YAAY,CAAC,EAAE,eAAe,CAAA;IAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IAEf;;;;;;;;;;OAUG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IAExB;;;;;;;;;;;;OAYG;IACH,cAAc,CAAC,EAAE,oBAAoB,CAAA;IAErC;;;;;;;;;;OAUG;IACH,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAEpF;;;;;;;;;;;;OAYG;IAEH,iBAAiB,CAAC,EAAE,GAAG,EAAE,CAAA;IAEzB;;;;;;;;;;;;;;;;;;OAkBG;IACH,SAAS,CAAC,EAAE;QACV,OAAO,EAAE,OAAO,CAAA;QAChB;;;WAGG;QACH,MAAM,CAAC,EAAE,MAAM,CAAA;QACf;;;WAGG;QACH,GAAG,CAAC,EAAE,MAAM,CAAA;KACb,CAAA;CACF,CAAA;AAED;;;;;;GAMG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AAED;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,yBAAyB,CAAA;IAC/B,OAAO,EAAE,yBAAyB,CAAA;IAClC,OAAO,EAAE,yBAAyB,CAAA;IAClC,YAAY,EAAE,yBAAyB,CAAA;CACxC,CAAA;AAED;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CACzC,IAAI,CACF,UAAU,EACR,kBAAkB,GAClB,mBAAmB,GACnB,eAAe,GACf,mBAAmB,GACnB,WAAW,GACX,SAAS,GACT,MAAM,GACN,SAAS,GACT,cAAc,GACd,QAAQ,CACX,CACF,GAAG;IACF,gBAAgB,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAA;IAC/C,iBAAiB,EAAE,QAAQ,CAAC,uBAAuB,CAAC,CAAA;IACpD,aAAa,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAA;IAC5C,oFAAoF;IACpF,OAAO,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAA;IAChC,sGAAsG;IACtG,MAAM,EAAE,oBAAoB,CAAA;IAC5B;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IAEf,iBAAiB,EAAE,GAAG,EAAE,CAAA;IACxB,SAAS,CAAC,EAAE;QACV,OAAO,EAAE,OAAO,CAAA;QAChB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,GAAG,CAAC,EAAE,MAAM,CAAA;KACb,CAAA;CACF,CAAA"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/config/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAE7D;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,CAAC,EAAE,aAAa,CAAA;IACtB,MAAM,CAAC,EAAE,aAAa,CAAA;IACtB,OAAO,CAAC,EAAE,aAAa,CAAA;IACvB,OAAO,CAAC,EAAE,aAAa,CAAA;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAAA;CACzC,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B;;;OAGG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAA;CAC9B,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,OAAO,EAAE,OAAO,CAAA;IAChB;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAE7B,IAAI,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAA;IAEhC,OAAO,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAA;IAEnC,OAAO,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAA;IAEnC,YAAY,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAA;CACzC,CAAA;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B;;;;;;;;;;OAUG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB;;OAEG;IACH,gBAAgB,CAAC,EAAE,mBAAmB,GAAG;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAA;IAE1D;;OAEG;IACH,iBAAiB,CAAC,EAAE,uBAAuB,GAAG;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAA;IAE/D;;OAEG;IACH,aAAa,CAAC,EAAE,mBAAmB,GAAG;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAA;IAEvD;;OAEG;IACH,eAAe,CAAC,EAAE,qBAAqB,CAAA;IAEvC;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,aAAa,GAAG,eAAe,CAAA;IAEzC;;;;;OAKG;IACH,IAAI,CAAC,EAAE,eAAe,CAAA;IAEtB;;OAEG;IACH,OAAO,CAAC,EAAE,eAAe,CAAA;IAEzB;;OAEG;IACH,YAAY,CAAC,EAAE,eAAe,CAAA;IAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IAEf;;;;;;;;;;OAUG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IAExB;;;;;;;;;;;;OAYG;IACH,cAAc,CAAC,EAAE,oBAAoB,CAAA;IAErC;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,EAAE,gBAAgB,CAAA;IAEzB;;;;;;;;;;OAUG;IACH,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAEpF;;;;;;;;;;;;OAYG;IAEH,iBAAiB,CAAC,EAAE,GAAG,EAAE,CAAA;IAEzB;;;;;;;;;;;;;;;;;;OAkBG;IACH,SAAS,CAAC,EAAE;QACV,OAAO,EAAE,OAAO,CAAA;QAChB;;;WAGG;QACH,MAAM,CAAC,EAAE,MAAM,CAAA;QACf;;;WAGG;QACH,GAAG,CAAC,EAAE,MAAM,CAAA;KACb,CAAA;CACF,CAAA;AAED;;;;;;GAMG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AAED;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,yBAAyB,CAAA;IAC/B,OAAO,EAAE,yBAAyB,CAAA;IAClC,OAAO,EAAE,yBAAyB,CAAA;IAClC,YAAY,EAAE,yBAAyB,CAAA;CACxC,CAAA;AAED;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CACzC,IAAI,CACF,UAAU,EACR,kBAAkB,GAClB,mBAAmB,GACnB,eAAe,GACf,mBAAmB,GACnB,WAAW,GACX,SAAS,GACT,MAAM,GACN,SAAS,GACT,cAAc,GACd,QAAQ,CACX,CACF,GAAG;IACF,gBAAgB,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAA;IAC/C,iBAAiB,EAAE,QAAQ,CAAC,uBAAuB,CAAC,CAAA;IACpD,aAAa,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAA;IAC5C,oFAAoF;IACpF,OAAO,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAA;IAChC,sGAAsG;IACtG,MAAM,EAAE,oBAAoB,CAAA;IAC5B;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IAEf,iBAAiB,EAAE,GAAG,EAAE,CAAA;IACxB,SAAS,CAAC,EAAE;QACV,OAAO,EAAE,OAAO,CAAA;QAChB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,GAAG,CAAC,EAAE,MAAM,CAAA;KACb,CAAA;CACF,CAAA"}

package/dist/lists/index.d.ts

@@ -1,5 +1,5 @@
 import type { ListConfig, FieldConfig } from '@opensaas/stack-core';
-import type { NormalizedAuthModels } from '../config/types.js';
+import type { AuthAccessConfig, NormalizedAuthModels } from '../config/types.js';
 /**
  * Configuration for extending the auto-generated User list
  */
@@ -10,8 +10,12 @@ export type ExtendUserListConfig = {
      */
     fields?: Record<string, FieldConfig>;
     /**
-     * Access control for the User list
-     * If not provided, defaults to basic access control (users can update their own records)
+     * Access control for the User list.
+     *
+     * Per ADR-0013, if neither this nor `authPlugin({ access: { user: … } })` is
+     * provided, the User list is **closed** (deny-by-default) — it no longer
+     * defaults to permissive access. Takes precedence over `access.user` when
+     * both are set.
      */
     access?: ListConfig<any>['access'];
     /**
@@ -47,6 +51,7 @@ export declare function createVerificationList(): ListConfig<any>;
  *
  * @param userConfig - Extra User-list fields/access/hooks (from `extendUserList`)
  * @param models - Resolved better-auth model config; defaults to the better-auth defaults
+ * @param accessConfig - App-authored access for each Auth list, keyed by better-auth model name
  */
-export declare function getAuthLists(userConfig?: ExtendUserListConfig, models?: NormalizedAuthModels): Record<string, ListConfig<any>>;
+export declare function getAuthLists(userConfig?: ExtendUserListConfig, models?: NormalizedAuthModels, accessConfig?: AuthAccessConfig): Record<string, ListConfig<any>>;
 //# sourceMappingURL=index.d.ts.map

package/dist/lists/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lists/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACnE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAG9D;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IACpC;;;OAGG;IAEH,MAAM,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAA;IAClC;;OAEG;IAEH,KAAK,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAA;CACjC,CAAA;AAeD;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,MAAM,CAAC,EAAE,oBAAoB,GAE5B,UAAU,CAAC,GAAG,CAAC,CAEjB;AAED;;GAEG;AAEH,wBAAgB,iBAAiB,IAAI,UAAU,CAAC,GAAG,CAAC,CAEnD;AAED;;GAEG;AAEH,wBAAgB,iBAAiB,IAAI,UAAU,CAAC,GAAG,CAAC,CAEnD;AAED;;GAEG;AAEH,wBAAgB,sBAAsB,IAAI,UAAU,CAAC,GAAG,CAAC,CAExD;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,UAAU,CAAC,EAAE,oBAAoB,EACjC,MAAM,GAAE,oBAAqC,GAE5C,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAEjC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lists/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAGhF;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IACpC;;;;;;;OAOG;IAEH,MAAM,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAA;IAClC;;OAEG;IAEH,KAAK,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAA;CACjC,CAAA;AAeD;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,MAAM,CAAC,EAAE,oBAAoB,GAE5B,UAAU,CAAC,GAAG,CAAC,CAEjB;AAED;;GAEG;AAEH,wBAAgB,iBAAiB,IAAI,UAAU,CAAC,GAAG,CAAC,CAEnD;AAED;;GAEG;AAEH,wBAAgB,iBAAiB,IAAI,UAAU,CAAC,GAAG,CAAC,CAEnD;AAED;;GAEG;AAEH,wBAAgB,sBAAsB,IAAI,UAAU,CAAC,GAAG,CAAC,CAExD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAC1B,UAAU,CAAC,EAAE,oBAAoB,EACjC,MAAM,GAAE,oBAAqC,EAC7C,YAAY,CAAC,EAAE,gBAAgB,GAE9B,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAEjC"}

package/dist/lists/index.js

@@ -50,8 +50,9 @@ export function createVerificationList() {
  *
  * @param userConfig - Extra User-list fields/access/hooks (from `extendUserList`)
  * @param models - Resolved better-auth model config; defaults to the better-auth defaults
+ * @param accessConfig - App-authored access for each Auth list, keyed by better-auth model name
  */
-export function getAuthLists(userConfig, models = DEFAULT_MODELS) {
-    return deriveAuthLists(models, userConfig || {}).lists;
+export function getAuthLists(userConfig, models = DEFAULT_MODELS, accessConfig) {
+    return deriveAuthLists(models, userConfig || {}, accessConfig || {}).lists;
 }
 //# sourceMappingURL=index.js.map

package/dist/lists/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/lists/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAA;AAwBhE;;;;;GAKG;AACH,MAAM,cAAc,GAAyB;IAC3C,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE;IACvC,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE;IAC7C,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE;IAC7C,YAAY,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE;CACxD,CAAA;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,MAA6B;IAG7B,OAAO,eAAe,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAA;AAC3D,CAAC;AAED;;GAEG;AACH,qGAAqG;AACrG,MAAM,UAAU,iBAAiB;IAC/B,OAAO,eAAe,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,OAAO,CAAA;AACtD,CAAC;AAED;;GAEG;AACH,qGAAqG;AACrG,MAAM,UAAU,iBAAiB;IAC/B,OAAO,eAAe,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,OAAO,CAAA;AACtD,CAAC;AAED;;GAEG;AACH,qGAAqG;AACrG,MAAM,UAAU,sBAAsB;IACpC,OAAO,eAAe,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,YAAY,CAAA;AAC3D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAC1B,UAAiC,EACjC,MAAM,GAAyB,cAAc;IAG7C,OAAO,eAAe,CAAC,MAAM,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,KAAK,CAAA;AACxD,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/lists/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAA;AA4BhE;;;;;GAKG;AACH,MAAM,cAAc,GAAyB;IAC3C,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE;IACvC,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE;IAC7C,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE;IAC7C,YAAY,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE;CACxD,CAAA;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,MAA6B;IAG7B,OAAO,eAAe,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAA;AAC3D,CAAC;AAED;;GAEG;AACH,qGAAqG;AACrG,MAAM,UAAU,iBAAiB;IAC/B,OAAO,eAAe,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,OAAO,CAAA;AACtD,CAAC;AAED;;GAEG;AACH,qGAAqG;AACrG,MAAM,UAAU,iBAAiB;IAC/B,OAAO,eAAe,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,OAAO,CAAA;AACtD,CAAC;AAED;;GAEG;AACH,qGAAqG;AACrG,MAAM,UAAU,sBAAsB;IACpC,OAAO,eAAe,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,YAAY,CAAA;AAC3D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAC1B,UAAiC,EACjC,MAAM,GAAyB,cAAc,EAC7C,YAA+B;IAG/B,OAAO,eAAe,CAAC,MAAM,EAAE,UAAU,IAAI,EAAE,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC,KAAK,CAAA;AAC5E,CAAC"}

package/dist/runtime/types.d.ts

@@ -8,16 +8,18 @@
  */
 export interface AuthRuntimeServices {
     /**
-     * Get user by ID
-     * Uses the access-controlled context to fetch user data
+     * Get user by ID.
+     * Resolves through the plugin runtime's `sudo` helper, so the result does
+     * not depend on the application's User list access policy (ADR-0013).
      *
      * @param userId - The ID of the user to fetch
-     * @returns User object or null if not found or access denied
+     * @returns User object or null if not found
      */
     getUser: (userId: string) => Promise<unknown>;
     /**
-     * Get current user from session
-     * Extracts userId from session and fetches user data
+     * Get current user from session.
+     * Extracts userId from session and fetches user data through the plugin
+     * runtime's `sudo` helper — see {@link getUser}.
      *
      * @returns Current user object or null if not authenticated or not found
      */

package/dist/runtime/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/runtime/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;OAMG;IACH,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IAE7C;;;;;OAKG;IACH,cAAc,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;CACvC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/runtime/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;;OAOG;IACH,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IAE7C;;;;;;OAMG;IACH,cAAc,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;CACvC"}

package/dist/server/schema-converter.d.ts

@@ -28,13 +28,45 @@ type BetterAuthTableSchema = {
     fields: Record<string, BetterAuthFieldAttribute>;
 };
 /**
- * Convert Better Auth table schema to OpenSaaS ListConfig
+ * Convert Better Auth table schema to OpenSaaS ListConfig.
+ *
+ * Per ADR-0013, plugin-injected lists ship **closed** — no access is set here,
+ * so the list denies every operation until the application grants it. For a
+ * table that resolves onto one of the four base auth models (user/session/
+ * account/verification), that means `authPlugin({ access: { ... } })`; for any
+ * other better-auth-plugin-declared table (e.g. OAuth client tables from the
+ * `mcp` plugin), the application must declare the list itself under the same
+ * derived key so the plugin's field-only extend path can merge in (its access
+ * then stands untouched).
  */
 export declare function convertTableToList(tableName: string, tableSchema: BetterAuthTableSchema): ListConfig<any>;
+/**
+ * Base better-auth model keys — the four tables the auth plugin's own model
+ * config (`user`/`session`/`account`/`verification`) can remap via `modelName`.
+ */
+type BaseAuthModelKey = 'user' | 'session' | 'account' | 'verification';
+/**
+ * Resolved list key for each base better-auth model, as derived by
+ * {@link deriveAuthLists} from the plugin's configured model-key remap (e.g.
+ * `user.modelName: 'AuthUser'`). Passed to {@link convertBetterAuthSchema} so a
+ * provider plugin's schema extension of a base model (e.g. `user`) lands on the
+ * same adopted Auth list rather than being re-derived from the plugin's own
+ * table name.
+ */
+export type BaseAuthModelKeys = Partial<Record<BaseAuthModelKey, string>>;
 /**
  * Convert all Better Auth tables to OpenSaaS list configs
  * This is called by authPlugin() to generate lists from Better Auth + plugins
+ *
+ * @param tables - The better-auth plugin's declared schema extension
+ * @param baseModelKeys - The resolved list keys for the four base auth models
+ *   (`user`/`session`/`account`/`verification`), from the same model-key remap
+ *   the Auth lists themselves use. When a table name matches one of these keys
+ *   (case-insensitively), its list key is taken from here instead of being
+ *   re-derived from the table name — so a schema extension targeting `user`
+ *   lands on the adopted Auth list (e.g. `AuthUser`) rather than a re-derived
+ *   `User`, even when that key collides with an unrelated host list.
  */
-export declare function convertBetterAuthSchema(tables: Record<string, BetterAuthTableSchema>): Record<string, ListConfig<any>>;
+export declare function convertBetterAuthSchema(tables: Record<string, BetterAuthTableSchema>, baseModelKeys?: BaseAuthModelKeys): Record<string, ListConfig<any>>;
 export {};
 //# sourceMappingURL=schema-converter.d.ts.map

package/dist/server/schema-converter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-converter.d.ts","sourceRoot":"","sources":["../../src/server/schema-converter.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAe,MAAM,sBAAsB,CAAA;AAEnE;;;GAGG;AACH,KAAK,wBAAwB,GAAG;IAC9B,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,UAAU,CAAC,EAAE;QACX,KAAK,EAAE,MAAM,CAAA;QACb,KAAK,EAAE,MAAM,CAAA;QACb,QAAQ,CAAC,EAAE,SAAS,GAAG,UAAU,GAAG,UAAU,CAAA;KAC/C,CAAA;IACD,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB,CAAA;AAED;;GAEG;AACH,KAAK,qBAAqB,GAAG;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAA;CACjD,CAAA;AAiND;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,qBAAqB,GAEjC,UAAU,CAAC,GAAG,CAAC,CAgCjB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,GAE5C,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAUjC"}
+{"version":3,"file":"schema-converter.d.ts","sourceRoot":"","sources":["../../src/server/schema-converter.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAe,MAAM,sBAAsB,CAAA;AAEnE;;;GAGG;AACH,KAAK,wBAAwB,GAAG;IAC9B,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,UAAU,CAAC,EAAE;QACX,KAAK,EAAE,MAAM,CAAA;QACb,KAAK,EAAE,MAAM,CAAA;QACb,QAAQ,CAAC,EAAE,SAAS,GAAG,UAAU,GAAG,UAAU,CAAA;KAC/C,CAAA;IACD,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB,CAAA;AAED;;GAEG;AACH,KAAK,qBAAqB,GAAG;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAA;CACjD,CAAA;AA2DD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,qBAAqB,GAEjC,UAAU,CAAC,GAAG,CAAC,CA4BjB;AAED;;;GAGG;AACH,KAAK,gBAAgB,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,cAAc,CAAA;AAEvE;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAA;AA0BzE;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,EAC7C,aAAa,GAAE,iBAAsB,GAEpC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAejC"}

package/dist/server/schema-converter.js

@@ -49,161 +49,16 @@ function convertField(fieldName, betterAuthField) {
     }
 }
 /**
- * Get default access control for auth tables
- * Most auth tables should only be accessible to their owners
- */
-// eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
-function getDefaultAccess(tableName) {
-    const lowerTableName = tableName.toLowerCase();
-    // User table - special access control
-    if (lowerTableName === 'user') {
-        return {
-            operation: {
-                query: () => true, // Anyone can query users
-                create: () => true, // Anyone can create (sign up)
-                // eslint-disable-next-line @typescript-eslint/no-explicit-any -- Access control parameters are runtime values
-                update: ({ session, item }) => {
-                    if (!session)
-                        return false;
-                    const userId = session.userId;
-                    const itemId = item?.id;
-                    return userId === itemId;
-                },
-                // eslint-disable-next-line @typescript-eslint/no-explicit-any -- Access control parameters are runtime values
-                delete: ({ session, item }) => {
-                    if (!session)
-                        return false;
-                    const userId = session.userId;
-                    const itemId = item?.id;
-                    return userId === itemId;
-                },
-            },
-        };
-    }
-    // Session table
-    if (lowerTableName === 'session') {
-        return {
-            operation: {
-                // eslint-disable-next-line @typescript-eslint/no-explicit-any -- Access control parameters are runtime values
-                query: ({ session }) => {
-                    if (!session)
-                        return false;
-                    const userId = session.userId;
-                    if (!userId)
-                        return false;
-                    return {
-                        user: { id: { equals: userId } },
-                    };
-                },
-                create: () => true, // Better-auth handles session creation
-                update: () => false, // No manual updates
-                // eslint-disable-next-line @typescript-eslint/no-explicit-any -- Access control parameters are runtime values
-                delete: ({ session, item }) => {
-                    if (!session)
-                        return false;
-                    const userId = session.userId;
-                    const itemUserId = item?.user?.id;
-                    return userId === itemUserId;
-                },
-            },
-        };
-    }
-    // Account table
-    if (lowerTableName === 'account') {
-        return {
-            operation: {
-                // eslint-disable-next-line @typescript-eslint/no-explicit-any -- Access control parameters are runtime values
-                query: ({ session }) => {
-                    if (!session)
-                        return false;
-                    const userId = session.userId;
-                    if (!userId)
-                        return false;
-                    return {
-                        user: { id: { equals: userId } },
-                    };
-                },
-                create: () => true, // Better-auth handles account creation
-                // eslint-disable-next-line @typescript-eslint/no-explicit-any -- Access control parameters are runtime values
-                update: ({ session, item }) => {
-                    if (!session)
-                        return false;
-                    const userId = session.userId;
-                    const itemUserId = item?.user?.id;
-                    return userId === itemUserId;
-                },
-                // eslint-disable-next-line @typescript-eslint/no-explicit-any -- Access control parameters are runtime values
-                delete: ({ session, item }) => {
-                    if (!session)
-                        return false;
-                    const userId = session.userId;
-                    const itemUserId = item?.user?.id;
-                    return userId === itemUserId;
-                },
-            },
-        };
-    }
-    // Verification table
-    if (lowerTableName === 'verification') {
-        return {
-            operation: {
-                query: () => false, // No public querying
-                create: () => true, // Better-auth creates verification tokens
-                update: () => false, // No updates
-                delete: () => true, // Better-auth deletes used/expired tokens
-            },
-        };
-    }
-    // OAuth tables (from MCP/OIDC plugins)
-    if (lowerTableName === 'oauthapplication' ||
-        lowerTableName === 'oauthaccesstoken' ||
-        lowerTableName === 'oauthconsent') {
-        return {
-            operation: {
-                // eslint-disable-next-line @typescript-eslint/no-explicit-any -- Access control parameters are runtime values
-                query: ({ session }) => {
-                    if (!session)
-                        return false;
-                    const userId = session.userId;
-                    if (!userId)
-                        return false;
-                    // Filter by userId if field exists
-                    return {
-                        userId: { equals: userId },
-                    };
-                },
-                create: () => true, // Better-auth/plugins handle creation
-                // eslint-disable-next-line @typescript-eslint/no-explicit-any -- Access control parameters are runtime values
-                update: ({ session, item }) => {
-                    if (!session)
-                        return false;
-                    const userId = session.userId;
-                    const itemUserId = item?.userId;
-                    return userId === itemUserId;
-                },
-                // eslint-disable-next-line @typescript-eslint/no-explicit-any -- Access control parameters are runtime values
-                delete: ({ session, item }) => {
-                    if (!session)
-                        return false;
-                    const userId = session.userId;
-                    const itemUserId = item?.userId;
-                    return userId === itemUserId;
-                },
-            },
-        };
-    }
-    // Default: restrict all access (safest default)
-    return {
-        operation: {
-            query: () => false,
-            create: () => false,
-            update: () => false,
-            delete: () => false,
-        },
-    };
-}
-/**
- * Convert Better Auth table schema to OpenSaaS ListConfig
+ * Convert Better Auth table schema to OpenSaaS ListConfig.
+ *
+ * Per ADR-0013, plugin-injected lists ship **closed** — no access is set here,
+ * so the list denies every operation until the application grants it. For a
+ * table that resolves onto one of the four base auth models (user/session/
+ * account/verification), that means `authPlugin({ access: { ... } })`; for any
+ * other better-auth-plugin-declared table (e.g. OAuth client tables from the
+ * `mcp` plugin), the application must declare the list itself under the same
+ * derived key so the plugin's field-only extend path can merge in (its access
+ * then stands untouched).
  */
 export function convertTableToList(tableName, tableSchema) {
     const fields = {};
@@ -229,21 +84,50 @@ export function convertTableToList(tableName, tableSchema) {
             }
         }
     }
-    // Create list config with default access control
-    return list({
-        fields,
-        access: getDefaultAccess(tableName),
-    });
+    return list({ fields });
+}
+/**
+ * Look up the configured remap for a table name, if it names one of the four
+ * base better-auth models (case-insensitively). Written as an explicit switch
+ * rather than an indexed lookup so no type assertion is needed to narrow the
+ * table name into {@link BaseAuthModelKey}.
+ */
+function resolveBaseModelKey(tableName, baseModelKeys) {
+    switch (tableName.toLowerCase()) {
+        case 'user':
+            return baseModelKeys.user;
+        case 'session':
+            return baseModelKeys.session;
+        case 'account':
+            return baseModelKeys.account;
+        case 'verification':
+            return baseModelKeys.verification;
+        default:
+            return undefined;
+    }
 }
 /**
  * Convert all Better Auth tables to OpenSaaS list configs
  * This is called by authPlugin() to generate lists from Better Auth + plugins
+ *
+ * @param tables - The better-auth plugin's declared schema extension
+ * @param baseModelKeys - The resolved list keys for the four base auth models
+ *   (`user`/`session`/`account`/`verification`), from the same model-key remap
+ *   the Auth lists themselves use. When a table name matches one of these keys
+ *   (case-insensitively), its list key is taken from here instead of being
+ *   re-derived from the table name — so a schema extension targeting `user`
+ *   lands on the adopted Auth list (e.g. `AuthUser`) rather than a re-derived
+ *   `User`, even when that key collides with an unrelated host list.
  */
-export function convertBetterAuthSchema(tables) {
+export function convertBetterAuthSchema(tables, baseModelKeys = {}) {
     const lists = {}; // eslint-disable-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
     for (const [tableName, tableSchema] of Object.entries(tables)) {
-        // Convert table name to PascalCase for OpenSaaS list key
-        const listKey = tableSchema.modelName || toPascalCase(tableName);
+        // A base-model remap always wins: it reflects the actual configured list
+        // key for that model, whereas `tableSchema.modelName`/the table name are
+        // just how the provider plugin happens to describe its own extension.
+        const listKey = resolveBaseModelKey(tableName, baseModelKeys) ||
+            tableSchema.modelName ||
+            toPascalCase(tableName);
         lists[listKey] = convertTableToList(tableName, tableSchema);
     }
     return lists;

package/dist/server/schema-converter.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema-converter.js","sourceRoot":"","sources":["../../src/server/schema-converter.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAA;AAC3C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAA;AA6BhF;;GAEG;AACH,SAAS,YAAY,CACnB,SAAiB,EACjB,eAAyC;IAEzC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,eAAe,CAAA;IAE5E,+CAA+C;IAC/C,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,WAAW,IAAI,SAAS,KAAK,WAAW,EAAE,CAAC;QACjF,OAAO,IAAI,CAAA;IACb,CAAC;IAED,oCAAoC;IACpC,IAAI,UAAU,EAAE,CAAC;QACf,uCAAuC;QACvC,mDAAmD;QACnD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,gDAAgD;IAChD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC;gBACV,UAAU,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE;gBACpC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;gBACxC,YAAY,EAAE,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;aAC1E,CAAC,CAAA;QAEJ,KAAK,QAAQ;YACX,OAAO,OAAO,CAAC;gBACb,UAAU,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE;gBACpC,YAAY,EAAE,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;aAC1E,CAAC,CAAA;QAEJ,KAAK,SAAS;YACZ,OAAO,QAAQ,CAAC;gBACd,YAAY,EAAE,OAAO,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK;aACvE,CAAC,CAAA;QAEJ,KAAK,MAAM;YACT,OAAO,SAAS,CAAC;gBACf,YAAY,EAAE,YAAY,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS;aACnE,CAAC,CAAA;QAEJ;YACE,iCAAiC;YACjC,OAAO,CAAC,IAAI,CACV,gDAAgD,IAAI,gBAAgB,SAAS,6BAA6B,CAC3G,CAAA;YACD,OAAO,IAAI,CAAC;gBACV,UAAU,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE;aACrC,CAAC,CAAA;IACN,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,qGAAqG;AACrG,SAAS,gBAAgB,CAAC,SAAiB;IACzC,MAAM,cAAc,GAAG,SAAS,CAAC,WAAW,EAAE,CAAA;IAE9C,sCAAsC;IACtC,IAAI,cAAc,KAAK,MAAM,EAAE,CAAC;QAC9B,OAAO;YACL,SAAS,EAAE;gBACT,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,yBAAyB;gBAC5C,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,8BAA8B;gBAClD,8GAA8G;gBAC9G,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAO,EAAE,EAAE;oBACjC,IAAI,CAAC,OAAO;wBAAE,OAAO,KAAK,CAAA;oBAC1B,MAAM,MAAM,GAAI,OAA+B,CAAC,MAAM,CAAA;oBACtD,MAAM,MAAM,GAAI,IAAwB,EAAE,EAAE,CAAA;oBAC5C,OAAO,MAAM,KAAK,MAAM,CAAA;gBAC1B,CAAC;gBACD,8GAA8G;gBAC9G,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAO,EAAE,EAAE;oBACjC,IAAI,CAAC,OAAO;wBAAE,OAAO,KAAK,CAAA;oBAC1B,MAAM,MAAM,GAAI,OAA+B,CAAC,MAAM,CAAA;oBACtD,MAAM,MAAM,GAAI,IAAwB,EAAE,EAAE,CAAA;oBAC5C,OAAO,MAAM,KAAK,MAAM,CAAA;gBAC1B,CAAC;aACF;SACF,CAAA;IACH,CAAC;IAED,gBAAgB;IAChB,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO;YACL,SAAS,EAAE;gBACT,8GAA8G;gBAC9G,KAAK,EAAE,CAAC,EAAE,OAAO,EAAO,EAAE,EAAE;oBAC1B,IAAI,CAAC,OAAO;wBAAE,OAAO,KAAK,CAAA;oBAC1B,MAAM,MAAM,GAAI,OAA+B,CAAC,MAAM,CAAA;oBACtD,IAAI,CAAC,MAAM;wBAAE,OAAO,KAAK,CAAA;oBACzB,OAAO;wBACL,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;qBACN,CAAA;gBAC9B,CAAC;gBACD,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,uCAAuC;gBAC3D,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,oBAAoB;gBACzC,8GAA8G;gBAC9G,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAO,EAAE,EAAE;oBACjC,IAAI,CAAC,OAAO;wBAAE,OAAO,KAAK,CAAA;oBAC1B,MAAM,MAAM,GAAI,OAA+B,CAAC,MAAM,CAAA;oBACtD,MAAM,UAAU,GAAI,IAAmC,EAAE,IAAI,EAAE,EAAE,CAAA;oBACjE,OAAO,MAAM,KAAK,UAAU,CAAA;gBAC9B,CAAC;aACF;SACF,CAAA;IACH,CAAC;IAED,gBAAgB;IAChB,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO;YACL,SAAS,EAAE;gBACT,8GAA8G;gBAC9G,KAAK,EAAE,CAAC,EAAE,OAAO,EAAO,EAAE,EAAE;oBAC1B,IAAI,CAAC,OAAO;wBAAE,OAAO,KAAK,CAAA;oBAC1B,MAAM,MAAM,GAAI,OAA+B,CAAC,MAAM,CAAA;oBACtD,IAAI,CAAC,MAAM;wBAAE,OAAO,KAAK,CAAA;oBACzB,OAAO;wBACL,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;qBACN,CAAA;gBAC9B,CAAC;gBACD,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,uCAAuC;gBAC3D,8GAA8G;gBAC9G,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAO,EAAE,EAAE;oBACjC,IAAI,CAAC,OAAO;wBAAE,OAAO,KAAK,CAAA;oBAC1B,MAAM,MAAM,GAAI,OAA+B,CAAC,MAAM,CAAA;oBACtD,MAAM,UAAU,GAAI,IAAmC,EAAE,IAAI,EAAE,EAAE,CAAA;oBACjE,OAAO,MAAM,KAAK,UAAU,CAAA;gBAC9B,CAAC;gBACD,8GAA8G;gBAC9G,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAO,EAAE,EAAE;oBACjC,IAAI,CAAC,OAAO;wBAAE,OAAO,KAAK,CAAA;oBAC1B,MAAM,MAAM,GAAI,OAA+B,CAAC,MAAM,CAAA;oBACtD,MAAM,UAAU,GAAI,IAAmC,EAAE,IAAI,EAAE,EAAE,CAAA;oBACjE,OAAO,MAAM,KAAK,UAAU,CAAA;gBAC9B,CAAC;aACF;SACF,CAAA;IACH,CAAC;IAED,qBAAqB;IACrB,IAAI,cAAc,KAAK,cAAc,EAAE,CAAC;QACtC,OAAO;YACL,SAAS,EAAE;gBACT,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,qBAAqB;gBACzC,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,0CAA0C;gBAC9D,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,aAAa;gBAClC,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,0CAA0C;aAC/D;SACF,CAAA;IACH,CAAC;IAED,uCAAuC;IACvC,IACE,cAAc,KAAK,kBAAkB;QACrC,cAAc,KAAK,kBAAkB;QACrC,cAAc,KAAK,cAAc,EACjC,CAAC;QACD,OAAO;YACL,SAAS,EAAE;gBACT,8GAA8G;gBAC9G,KAAK,EAAE,CAAC,EAAE,OAAO,EAAO,EAAE,EAAE;oBAC1B,IAAI,CAAC,OAAO;wBAAE,OAAO,KAAK,CAAA;oBAC1B,MAAM,MAAM,GAAI,OAA+B,CAAC,MAAM,CAAA;oBACtD,IAAI,CAAC,MAAM;wBAAE,OAAO,KAAK,CAAA;oBACzB,mCAAmC;oBACnC,OAAO;wBACL,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;qBACA,CAAA;gBAC9B,CAAC;gBACD,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,sCAAsC;gBAC1D,8GAA8G;gBAC9G,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAO,EAAE,EAAE;oBACjC,IAAI,CAAC,OAAO;wBAAE,OAAO,KAAK,CAAA;oBAC1B,MAAM,MAAM,GAAI,OAA+B,CAAC,MAAM,CAAA;oBACtD,MAAM,UAAU,GAAI,IAA4B,EAAE,MAAM,CAAA;oBACxD,OAAO,MAAM,KAAK,UAAU,CAAA;gBAC9B,CAAC;gBACD,8GAA8G;gBAC9G,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAO,EAAE,EAAE;oBACjC,IAAI,CAAC,OAAO;wBAAE,OAAO,KAAK,CAAA;oBAC1B,MAAM,MAAM,GAAI,OAA+B,CAAC,MAAM,CAAA;oBACtD,MAAM,UAAU,GAAI,IAA4B,EAAE,MAAM,CAAA;oBACxD,OAAO,MAAM,KAAK,UAAU,CAAA;gBAC9B,CAAC;aACF;SACF,CAAA;IACH,CAAC;IAED,gDAAgD;IAChD,OAAO;QACL,SAAS,EAAE;YACT,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK;YAClB,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK;YACnB,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK;YACnB,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK;SACpB;KACF,CAAA;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAChC,SAAiB,EACjB,WAAkC;IAGlC,MAAM,MAAM,GAAgC,EAAE,CAAA;IAE9C,qCAAqC;IACrC,KAAK,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QACxE,MAAM,WAAW,GAAG,YAAY,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;QACtD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,CAAC,SAAS,CAAC,GAAG,WAAW,CAAA;QACjC,CAAC;IACH,CAAC;IAED,iCAAiC;IACjC,+FAA+F;IAC/F,6EAA6E;IAC7E,0FAA0F;IAC1F,KAAK,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QACxE,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;YACzB,wEAAwE;YACxE,4EAA4E;YAC5E,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvB,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;oBACvB,UAAU,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,QAAQ,EAAE;iBAC/C,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,iDAAiD;IACjD,OAAO,IAAI,CAAC;QACV,MAAM;QACN,MAAM,EAAE,gBAAgB,CAAC,SAAS,CAAC;KACpC,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAA6C;IAG7C,MAAM,KAAK,GAAoC,EAAE,CAAA,CAAC,gGAAgG;IAElJ,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9D,yDAAyD;QACzD,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,IAAI,YAAY,CAAC,SAAS,CAAC,CAAA;QAChE,KAAK,CAAC,OAAO,CAAC,GAAG,kBAAkB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IAC7D,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,GAAG;SACP,KAAK,CAAC,MAAM,CAAC;SACb,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;SACzE,IAAI,CAAC,EAAE,CAAC,CAAA;AACb,CAAC"}
+{"version":3,"file":"schema-converter.js","sourceRoot":"","sources":["../../src/server/schema-converter.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAA;AAC3C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAA;AA6BhF;;GAEG;AACH,SAAS,YAAY,CACnB,SAAiB,EACjB,eAAyC;IAEzC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,eAAe,CAAA;IAE5E,+CAA+C;IAC/C,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,WAAW,IAAI,SAAS,KAAK,WAAW,EAAE,CAAC;QACjF,OAAO,IAAI,CAAA;IACb,CAAC;IAED,oCAAoC;IACpC,IAAI,UAAU,EAAE,CAAC;QACf,uCAAuC;QACvC,mDAAmD;QACnD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,gDAAgD;IAChD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC;gBACV,UAAU,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE;gBACpC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;gBACxC,YAAY,EAAE,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;aAC1E,CAAC,CAAA;QAEJ,KAAK,QAAQ;YACX,OAAO,OAAO,CAAC;gBACb,UAAU,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE;gBACpC,YAAY,EAAE,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;aAC1E,CAAC,CAAA;QAEJ,KAAK,SAAS;YACZ,OAAO,QAAQ,CAAC;gBACd,YAAY,EAAE,OAAO,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK;aACvE,CAAC,CAAA;QAEJ,KAAK,MAAM;YACT,OAAO,SAAS,CAAC;gBACf,YAAY,EAAE,YAAY,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS;aACnE,CAAC,CAAA;QAEJ;YACE,iCAAiC;YACjC,OAAO,CAAC,IAAI,CACV,gDAAgD,IAAI,gBAAgB,SAAS,6BAA6B,CAC3G,CAAA;YACD,OAAO,IAAI,CAAC;gBACV,UAAU,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE;aACrC,CAAC,CAAA;IACN,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAChC,SAAiB,EACjB,WAAkC;IAGlC,MAAM,MAAM,GAAgC,EAAE,CAAA;IAE9C,qCAAqC;IACrC,KAAK,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QACxE,MAAM,WAAW,GAAG,YAAY,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;QACtD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,CAAC,SAAS,CAAC,GAAG,WAAW,CAAA;QACjC,CAAC;IACH,CAAC;IAED,iCAAiC;IACjC,+FAA+F;IAC/F,6EAA6E;IAC7E,0FAA0F;IAC1F,KAAK,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QACxE,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;YACzB,wEAAwE;YACxE,4EAA4E;YAC5E,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvB,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;oBACvB,UAAU,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,QAAQ,EAAE;iBAC/C,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;AACzB,CAAC;AAkBD;;;;;GAKG;AACH,SAAS,mBAAmB,CAC1B,SAAiB,EACjB,aAAgC;IAEhC,QAAQ,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;QAChC,KAAK,MAAM;YACT,OAAO,aAAa,CAAC,IAAI,CAAA;QAC3B,KAAK,SAAS;YACZ,OAAO,aAAa,CAAC,OAAO,CAAA;QAC9B,KAAK,SAAS;YACZ,OAAO,aAAa,CAAC,OAAO,CAAA;QAC9B,KAAK,cAAc;YACjB,OAAO,aAAa,CAAC,YAAY,CAAA;QACnC;YACE,OAAO,SAAS,CAAA;IACpB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAA6C,EAC7C,aAAa,GAAsB,EAAE;IAGrC,MAAM,KAAK,GAAoC,EAAE,CAAA,CAAC,gGAAgG;IAElJ,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9D,yEAAyE;QACzE,yEAAyE;QACzE,sEAAsE;QACtE,MAAM,OAAO,GACX,mBAAmB,CAAC,SAAS,EAAE,aAAa,CAAC;YAC7C,WAAW,CAAC,SAAS;YACrB,YAAY,CAAC,SAAS,CAAC,CAAA;QACzB,KAAK,CAAC,OAAO,CAAC,GAAG,kBAAkB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IAC7D,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,GAAG;SACP,KAAK,CAAC,MAAM,CAAC;SACb,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;SACzE,IAAI,CAAC,EAAE,CAAC,CAAA;AACb,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opensaas/stack-auth",
-  "version": "0.27.1",
+  "version": "0.28.0",
   "description": "Better-auth integration for OpenSaas Stack",
   "type": "module",
   "main": "./dist/index.js",
@@ -65,7 +65,7 @@
     "react": "^19.2.4",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
     "vitest": "^4.1.10",
-    "@opensaas/stack-core": "0.27.1"
+    "@opensaas/stack-core": "0.28.0"
   },
   "scripts": {
     "build": "tsc",