@opensaas/stack-auth 0.36.0 → 0.37.0

package/dist/server/index.js

@@ -24,6 +24,189 @@ function toBetterAuthModelOptions(model) {
         options.fields = model.fields;
     return Object.keys(options).length > 0 ? options : undefined;
 }
+const MODELS_WITH_NO_ADDITIONAL_FIELDS_PASSTHROUGH = [
+    'user',
+    'session',
+    'account',
+    'verification',
+];
+/**
+ * Reject `betterAuthOptions` keys that already have a dedicated, non-passthrough
+ * seam — accepting them here would create two unranked ways to set the same
+ * thing, or (for `additionalFields`) silently diverge from the generated
+ * Prisma schema. See the `betterAuthOptions` doc comment on `AuthConfig`.
+ */
+function assertNoUnsupportedPassthroughKeys(betterAuthOptions) {
+    if ('database' in betterAuthOptions) {
+        throw new Error('[@opensaas/stack-auth] `betterAuthOptions.database` is not supported — the stack ' +
+            'derives the database adapter from your `db` config and the running context. ' +
+            'Configure the database through `db` in `opensaas.config.ts` instead.');
+    }
+    if ('plugins' in betterAuthOptions) {
+        throw new Error('[@opensaas/stack-auth] `betterAuthOptions.plugins` is not supported — better-auth ' +
+            'plugins are added through `authPlugin({ betterAuthPlugins: [...] })`, which the stack ' +
+            'appends `nextCookies()` after. Use `betterAuthPlugins` instead.');
+    }
+    for (const model of MODELS_WITH_NO_ADDITIONAL_FIELDS_PASSTHROUGH) {
+        const modelOptions = betterAuthOptions[model];
+        if (modelOptions &&
+            typeof modelOptions === 'object' &&
+            !Array.isArray(modelOptions) &&
+            'additionalFields' in modelOptions) {
+            throw new Error(`[@opensaas/stack-auth] \`betterAuthOptions.${model}.additionalFields\` is not ` +
+                'supported — it adds columns that would not be reflected in the generated Prisma ' +
+                'schema. Add fields to the derived list instead: ' +
+                (model === 'user'
+                    ? '`extendUserList`, or declare the list yourself in your own `lists` config.'
+                    : 'declare the derived list yourself in your own `lists` config (the auth plugin ' +
+                        'merges in field additions for the models it derives).'));
+        }
+    }
+}
+function isPlainObject(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        !Array.isArray(value) &&
+        Object.getPrototypeOf(value) === Object.prototype);
+}
+/**
+ * Deep-merge `overrides` onto `base`, recursing into plain-object values so a
+ * nested addition (one database hook, one session sub-option) merges
+ * alongside sibling keys the stack already set there rather than replacing
+ * the whole branch. Arrays and any other value type replace outright.
+ * `overrides` wins on every key collision.
+ */
+function mergeBetterAuthOptions(base, overrides) {
+    const result = { ...base };
+    for (const [key, value] of Object.entries(overrides)) {
+        const baseValue = result[key];
+        result[key] =
+            isPlainObject(baseValue) && isPlainObject(value)
+                ? mergeBetterAuthOptions(baseValue, value)
+                : value;
+    }
+    return result;
+}
+/**
+ * Build the `BetterAuthOptions` a better-auth instance for this OpenSaas
+ * config should be constructed with — the same options `createAuth()` uses
+ * internally, available standalone for an app that still needs to hand-wire
+ * its own `betterAuth()` instance (e.g. a third-party contract that requires
+ * a resolved instance at module-init time). Keeps the auth plugin
+ * authoritative for everything it models; the app's additions on top become
+ * an explicit, reviewable diff instead of a parallel, hand-duplicated config.
+ *
+ * @example
+ * ```typescript
+ * import { betterAuth } from 'better-auth'
+ * import { buildBetterAuthOptions } from '@opensaas/stack-auth/server'
+ *
+ * export const auth = betterAuth({
+ *   ...(await buildBetterAuthOptions(config, context)),
+ *   databaseHooks: { user: { create: { after: syncDomainUser } } },
+ * })
+ * ```
+ */
+export async function buildBetterAuthOptions(opensaasConfig, context) {
+    const resolvedConfig = await Promise.resolve(opensaasConfig);
+    const resolvedContext = await Promise.resolve(context);
+    // Extract auth config from plugin data
+    const authConfig = resolvedConfig._pluginData?.auth;
+    if (!authConfig) {
+        throw new Error('Auth config not found. Make sure to use authPlugin() in your opensaas.config.ts');
+    }
+    // `requireConfirmation` has no better-auth equivalent — it's a UI-only
+    // concern the pre-built forms already take as their own
+    // `requirePasswordConfirmation` prop. Warn rather than silently drop it,
+    // since setting it here looks like it should do something.
+    if (authConfig.emailAndPassword.enabled &&
+        authConfig.emailAndPassword.requireConfirmation !== true) {
+        console.warn('[@opensaas/stack-auth] `emailAndPassword.requireConfirmation` has no effect here — ' +
+            'createAuth() has no better-auth option to forward it to. Pass ' +
+            '`requirePasswordConfirmation` directly to <SignUpForm> / <ResetPasswordForm> instead.');
+    }
+    // `passwordReset` is wired through better-auth's `emailAndPassword` config
+    // (there's no password to reset without a password-based account), so it
+    // silently has no effect if email/password auth itself isn't enabled.
+    if (authConfig.passwordReset.enabled && !authConfig.emailAndPassword.enabled) {
+        console.warn('[@opensaas/stack-auth] `passwordReset.enabled` has no effect here — ' +
+            '`emailAndPassword.enabled` is false, so there is no password-based account to reset.');
+    }
+    assertNoUnsupportedPassthroughKeys(authConfig.betterAuthOptions);
+    // Build better-auth configuration
+    const betterAuthConfig = {
+        database: getDatabaseConfig(resolvedConfig.db, resolvedContext),
+        // Mirror the per-model config (modelName + field column maps) back to
+        // better-auth so the running auth instance reads/writes the same
+        // tables/columns the OpenSaaS Auth lists were derived from.
+        user: toBetterAuthModelOptions(authConfig.models.user),
+        session: {
+            ...toBetterAuthModelOptions(authConfig.models.session),
+            expiresIn: authConfig.session.expiresIn || 604800,
+            // better-auth treats `updateAge: 0` as "refresh on every request", not
+            // "never refresh" — disabling refresh entirely requires its separate
+            // `disableSessionRefresh` flag regardless of `updateAge`.
+            ...(authConfig.session.updateAge === false
+                ? { disableSessionRefresh: true }
+                : { updateAge: authConfig.session.updateAge }),
+        },
+        account: toBetterAuthModelOptions(authConfig.models.account),
+        verification: toBetterAuthModelOptions(authConfig.models.verification),
+        // Enable email and password if configured
+        emailAndPassword: authConfig.emailAndPassword.enabled
+            ? {
+                enabled: true,
+                requireEmailVerification: authConfig.emailVerification.enabled,
+                minPasswordLength: authConfig.emailAndPassword.minPasswordLength,
+                ...(authConfig.passwordReset.enabled
+                    ? {
+                        sendResetPassword: authConfig.emailAndPassword.sendResetPassword,
+                        resetPasswordTokenExpiresIn: authConfig.passwordReset.tokenExpiration,
+                    }
+                    : {}),
+            }
+            : undefined,
+        // Email verification (independent of emailAndPassword — also covers
+        // e.g. a social-provider account whose email isn't yet verified)
+        emailVerification: authConfig.emailVerification.enabled
+            ? {
+                sendVerificationEmail: authConfig.emailVerification.sendVerificationEmail,
+                sendOnSignUp: authConfig.emailVerification.sendOnSignUp,
+                expiresIn: authConfig.emailVerification.tokenExpiration,
+            }
+            : undefined,
+        // Trust host (required for production)
+        trustedOrigins: process.env.BETTER_AUTH_TRUSTED_ORIGINS?.split(',') || [],
+        // Social providers
+        socialProviders: Object.entries(authConfig.socialProviders)
+            .filter(([_, config]) => config?.enabled !== false)
+            .reduce((acc, [provider, config]) => {
+            if (config) {
+                acc[provider] = {
+                    clientId: config.clientId,
+                    clientSecret: config.clientSecret,
+                };
+            }
+            return acc;
+        }, {}),
+        // Rate limiting configuration
+        rateLimit: authConfig.rateLimit
+            ? {
+                enabled: authConfig.rateLimit.enabled,
+                window: authConfig.rateLimit.window,
+                max: authConfig.rateLimit.max,
+            }
+            : undefined,
+        // Pass through any additional Better Auth plugins, then append
+        // nextCookies LAST so it can write the Set-Cookie headers produced by
+        // any auth.api.* call made inside a Next.js server action into Next's
+        // cookie store. This is what makes the server-action auth forms (which
+        // call auth.api.signInEmail/signUpEmail/etc. server-side) actually
+        // persist a session. It must be the final plugin in the array.
+        plugins: [...(authConfig.betterAuthPlugins || []), nextCookies()],
+    };
+    return mergeBetterAuthOptions(betterAuthConfig, authConfig.betterAuthOptions);
+}
 /**
  * Create a better-auth instance from OpenSaas config
  * This should be called once at app startup
@@ -50,66 +233,7 @@ export function createAuth(opensaasConfig, context) {
             return authInstance;
         if (!authPromise) {
             authPromise = (async () => {
-                const resolvedConfig = await configPromise;
-                const resolvedContext = await contextPromise;
-                // Extract auth config from plugin data
-                const authConfig = resolvedConfig._pluginData?.auth;
-                if (!authConfig) {
-                    throw new Error('Auth config not found. Make sure to use authPlugin() in your opensaas.config.ts');
-                }
-                // Build better-auth configuration
-                const betterAuthConfig = {
-                    database: getDatabaseConfig(resolvedConfig.db, resolvedContext),
-                    // Mirror the per-model config (modelName + field column maps) back to
-                    // better-auth so the running auth instance reads/writes the same
-                    // tables/columns the OpenSaaS Auth lists were derived from.
-                    user: toBetterAuthModelOptions(authConfig.models.user),
-                    session: {
-                        ...toBetterAuthModelOptions(authConfig.models.session),
-                        expiresIn: authConfig.session.expiresIn || 604800,
-                        updateAge: authConfig.session.updateAge
-                            ? (authConfig.session.expiresIn || 604800) / 10
-                            : 0,
-                    },
-                    account: toBetterAuthModelOptions(authConfig.models.account),
-                    verification: toBetterAuthModelOptions(authConfig.models.verification),
-                    // Enable email and password if configured
-                    emailAndPassword: authConfig.emailAndPassword.enabled
-                        ? {
-                            enabled: true,
-                            requireEmailVerification: authConfig.emailVerification.enabled,
-                        }
-                        : undefined,
-                    // Trust host (required for production)
-                    trustedOrigins: process.env.BETTER_AUTH_TRUSTED_ORIGINS?.split(',') || [],
-                    // Social providers
-                    socialProviders: Object.entries(authConfig.socialProviders)
-                        .filter(([_, config]) => config?.enabled !== false)
-                        .reduce((acc, [provider, config]) => {
-                        if (config) {
-                            acc[provider] = {
-                                clientId: config.clientId,
-                                clientSecret: config.clientSecret,
-                            };
-                        }
-                        return acc;
-                    }, {}),
-                    // Rate limiting configuration
-                    rateLimit: authConfig.rateLimit
-                        ? {
-                            enabled: authConfig.rateLimit.enabled,
-                            window: authConfig.rateLimit.window,
-                            max: authConfig.rateLimit.max,
-                        }
-                        : undefined,
-                    // Pass through any additional Better Auth plugins, then append
-                    // nextCookies LAST so it can write the Set-Cookie headers produced by
-                    // any auth.api.* call made inside a Next.js server action into Next's
-                    // cookie store. This is what makes the server-action auth forms (which
-                    // call auth.api.signInEmail/signUpEmail/etc. server-side) actually
-                    // persist a session. It must be the final plugin in the array.
-                    plugins: [...(authConfig.betterAuthPlugins || []), nextCookies()],
-                };
+                const betterAuthConfig = await buildBetterAuthOptions(configPromise, contextPromise);
                 authInstance = betterAuth(betterAuthConfig);
                 return authInstance;
             })();
@@ -158,14 +282,17 @@ export function createAuth(opensaasConfig, context) {
     });
 }
 /**
- * Get session from better-auth and transform it to OpenSaas session format
- * This is used internally by the generated context
+ * Get session from better-auth and transform it to OpenSaas session format.
+ *
+ * Not called by any generated code today — apps currently hand-roll this same
+ * transform against `auth.api.getSession({ headers: await headers() })` (see
+ * `examples/starter-auth/lib/auth.ts`). Exported as a reusable helper for that
+ * pattern; pass the caller's request headers (e.g. Next.js `await headers()`
+ * in a Server Component/action) so a session cookie can actually be resolved.
  */
-export async function getSessionFromAuth(auth, sessionFields) {
+export async function getSessionFromAuth(auth, sessionFields, headers) {
     try {
-        const session = await auth.api.getSession({
-            headers: new Headers(),
-        });
+        const session = await auth.api.getSession({ headers });
         if (!session?.user) {
             return null;
         }

package/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAA;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAMjD;;GAEG;AACH,SAAS,iBAAiB,CACxB,QAAwB,EACxB,OAAsB;IAEtB,OAAO,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE;QACnC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;KAC5B,CAAC,CAAA;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,wBAAwB,CAC/B,KAAgC;IAEhC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAA;IACtD,MAAM,OAAO,GAA4D,EAAE,CAAA;IAC3E,IAAI,KAAK,CAAC,SAAS;QAAE,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAA;IACxD,IAAI,SAAS;QAAE,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;IAC5C,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;AAC9D,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,UAAU,CACxB,cAAwD,EACxD,OAA+C;IAE/C,4CAA4C;IAC5C,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAA;IACrD,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAE/C,0CAA0C;IAC1C,IAAI,YAAY,GAAyC,IAAI,CAAA;IAC7D,IAAI,WAAW,GAAkD,IAAI,CAAA;IAErE,KAAK,UAAU,eAAe;QAC5B,IAAI,YAAY;YAAE,OAAO,YAAY,CAAA;QAErC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,WAAW,GAAG,CAAC,KAAK,IAAI,EAAE;gBACxB,MAAM,cAAc,GAAG,MAAM,aAAa,CAAA;gBAC1C,MAAM,eAAe,GAAG,MAAM,cAAc,CAAA;gBAE5C,uCAAuC;gBACvC,MAAM,UAAU,GAAG,cAAc,CAAC,WAAW,EAAE,IAAwC,CAAA;gBAEvF,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAA;gBACH,CAAC;gBAED,kCAAkC;gBAClC,MAAM,gBAAgB,GAAsB;oBAC1C,QAAQ,EAAE,iBAAiB,CAAC,cAAc,CAAC,EAAE,EAAE,eAAe,CAAC;oBAE/D,sEAAsE;oBACtE,iEAAiE;oBACjE,4DAA4D;oBAC5D,IAAI,EAAE,wBAAwB,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC;oBACtD,OAAO,EAAE;wBACP,GAAG,wBAAwB,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;wBACtD,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,SAAS,IAAI,MAAM;wBACjD,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,SAAS;4BACrC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,GAAG,EAAE;4BAC/C,CAAC,CAAC,CAAC;qBACN;oBACD,OAAO,EAAE,wBAAwB,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;oBAC5D,YAAY,EAAE,wBAAwB,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC;oBAEtE,0CAA0C;oBAC1C,gBAAgB,EAAE,UAAU,CAAC,gBAAgB,CAAC,OAAO;wBACnD,CAAC,CAAC;4BACE,OAAO,EAAE,IAAI;4BACb,wBAAwB,EAAE,UAAU,CAAC,iBAAiB,CAAC,OAAO;yBAC/D;wBACH,CAAC,CAAC,SAAS;oBAEb,uCAAuC;oBACvC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE;oBAEzE,mBAAmB;oBACnB,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC;yBACxD,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,KAAK,CAAC;yBAClD,MAAM,CACL,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE;wBAC1B,IAAI,MAAM,EAAE,CAAC;4BACX,GAAG,CAAC,QAAQ,CAAC,GAAG;gCACd,QAAQ,EAAE,MAAM,CAAC,QAAQ;gCACzB,YAAY,EAAE,MAAM,CAAC,YAAY;6BAClC,CAAA;wBACH,CAAC;wBACD,OAAO,GAAG,CAAA;oBACZ,CAAC,EACD,EAAgE,CACjE;oBAEH,8BAA8B;oBAC9B,SAAS,EAAE,UAAU,CAAC,SAAS;wBAC7B,CAAC,CAAC;4BACE,OAAO,EAAE,UAAU,CAAC,SAAS,CAAC,OAAO;4BACrC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,MAAM;4BACnC,GAAG,EAAE,UAAU,CAAC,SAAS,CAAC,GAAG;yBAC9B;wBACH,CAAC,CAAC,SAAS;oBAEb,+DAA+D;oBAC/D,sEAAsE;oBACtE,sEAAsE;oBACtE,uEAAuE;oBACvE,mEAAmE;oBACnE,+DAA+D;oBAC/D,OAAO,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,iBAAiB,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC;iBAClE,CAAA;gBAED,YAAY,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAA;gBAC3C,OAAO,YAAY,CAAA;YACrB,CAAC,CAAC,EAAE,CAAA;QACN,CAAC;QAED,OAAO,WAAW,CAAA;IACpB,CAAC;IAED,2DAA2D;IAC3D,OAAO,IAAI,KAAK,CAAC,EAAmC,EAAE;QACpD,GAAG,CAAC,CAAC,EAAE,IAAI;YACT,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACpB,oCAAoC;gBACpC,OAAO,SAAS,CAAA;YAClB,CAAC;YAED,iCAAiC;YACjC,MAAM,WAAW,GAAG,KAAK,EAAE,GAAG,IAAe,EAAE,EAAE;gBAC/C,MAAM,QAAQ,GAAG,MAAM,eAAe,EAAE,CAAA;gBACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAA6B,CAAC,CAAA;gBACrD,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;oBAChC,OAAQ,KAAyC,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;gBACzE,CAAC;gBACD,OAAO,KAAK,CAAA;YACd,CAAC,CAAA;YAED,4EAA4E;YAC5E,OAAO,IAAI,KAAK,CAAC,WAAW,EAAE;gBAC5B,GAAG,CAAC,MAAM,EAAE,OAAO;oBACjB,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;wBACvB,qCAAqC;wBACrC,OAAO,SAAS,CAAA;oBAClB,CAAC;oBACD,4DAA4D;oBAC5D,OAAO,KAAK,EAAE,GAAG,IAAe,EAAE,EAAE;wBAClC,MAAM,QAAQ,GAAG,MAAM,eAAe,EAAE,CAAA;wBACxC,MAAM,WAAW,GAAG,QAAQ,CAAC,IAA6B,CAAC,CAAA;wBAC3D,IAAI,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;4BACnD,MAAM,UAAU,GAAI,WAAuC,CAAC,OAAiB,CAAC,CAAA;4BAC9E,IAAI,OAAO,UAAU,KAAK,UAAU,EAAE,CAAC;gCACrC,OAAQ,UAA8C,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;4BACjF,CAAC;4BACD,OAAO,UAAU,CAAA;wBACnB,CAAC;wBACD,MAAM,IAAI,KAAK,CACb,YAAY,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,6BAA6B,CACzE,CAAA;oBACH,CAAC,CAAA;gBACH,CAAC;aACF,CAAC,CAAA;QACJ,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAmC,EACnC,aAAuB;IAEvB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;YACxC,OAAO,EAAE,IAAI,OAAO,EAAE;SACvB,CAAC,CAAA;QAEF,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;YACnB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,6CAA6C;QAC7C,MAAM,MAAM,GAA4B,EAAE,CAAA;QAE1C,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;YAClC,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACvB,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;YACjC,CAAC;iBAAM,IAAI,KAAK,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAkC,CAAC,CAAA;YAClE,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAA;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAMjD;;GAEG;AACH,SAAS,iBAAiB,CACxB,QAAwB,EACxB,OAAsB;IAEtB,OAAO,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE;QACnC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;KAC5B,CAAC,CAAA;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,wBAAwB,CAC/B,KAAgC;IAEhC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAA;IACtD,MAAM,OAAO,GAA4D,EAAE,CAAA;IAC3E,IAAI,KAAK,CAAC,SAAS;QAAE,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAA;IACxD,IAAI,SAAS;QAAE,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;IAC5C,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;AAC9D,CAAC;AAED,MAAM,4CAA4C,GAAG;IACnD,MAAM;IACN,SAAS;IACT,SAAS;IACT,cAAc;CACN,CAAA;AAEV;;;;;GAKG;AACH,SAAS,kCAAkC,CAAC,iBAA0C;IACpF,IAAI,UAAU,IAAI,iBAAiB,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,mFAAmF;YACjF,8EAA8E;YAC9E,sEAAsE,CACzE,CAAA;IACH,CAAC;IAED,IAAI,SAAS,IAAI,iBAAiB,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,oFAAoF;YAClF,wFAAwF;YACxF,iEAAiE,CACpE,CAAA;IACH,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,4CAA4C,EAAE,CAAC;QACjE,MAAM,YAAY,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAA;QAC7C,IACE,YAAY;YACZ,OAAO,YAAY,KAAK,QAAQ;YAChC,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;YAC5B,kBAAkB,IAAI,YAAY,EAClC,CAAC;YACD,MAAM,IAAI,KAAK,CACb,8CAA8C,KAAK,6BAA6B;gBAC9E,kFAAkF;gBAClF,kDAAkD;gBAClD,CAAC,KAAK,KAAK,MAAM;oBACf,CAAC,CAAC,4EAA4E;oBAC9E,CAAC,CAAC,gFAAgF;wBAChF,uDAAuD,CAAC,CAC/D,CAAA;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,SAAS,CAClD,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,sBAAsB,CAC7B,IAA6B,EAC7B,SAAkC;IAElC,MAAM,MAAM,GAA4B,EAAE,GAAG,IAAI,EAAE,CAAA;IACnD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACrD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;QAC7B,MAAM,CAAC,GAAG,CAAC;YACT,aAAa,CAAC,SAAS,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC;gBAC9C,CAAC,CAAC,sBAAsB,CAAC,SAAS,EAAE,KAAK,CAAC;gBAC1C,CAAC,CAAC,KAAK,CAAA;IACb,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,cAAwD,EACxD,OAA+C;IAE/C,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAA;IAC5D,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAEtD,uCAAuC;IACvC,MAAM,UAAU,GAAG,cAAc,CAAC,WAAW,EAAE,IAAwC,CAAA;IAEvF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAA;IACH,CAAC;IAED,uEAAuE;IACvE,wDAAwD;IACxD,yEAAyE;IACzE,2DAA2D;IAC3D,IACE,UAAU,CAAC,gBAAgB,CAAC,OAAO;QACnC,UAAU,CAAC,gBAAgB,CAAC,mBAAmB,KAAK,IAAI,EACxD,CAAC;QACD,OAAO,CAAC,IAAI,CACV,qFAAqF;YACnF,gEAAgE;YAChE,uFAAuF,CAC1F,CAAA;IACH,CAAC;IAED,2EAA2E;IAC3E,yEAAyE;IACzE,sEAAsE;IACtE,IAAI,UAAU,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;QAC7E,OAAO,CAAC,IAAI,CACV,sEAAsE;YACpE,sFAAsF,CACzF,CAAA;IACH,CAAC;IAED,kCAAkC,CAAC,UAAU,CAAC,iBAA4C,CAAC,CAAA;IAE3F,kCAAkC;IAClC,MAAM,gBAAgB,GAAsB;QAC1C,QAAQ,EAAE,iBAAiB,CAAC,cAAc,CAAC,EAAE,EAAE,eAAe,CAAC;QAE/D,sEAAsE;QACtE,iEAAiE;QACjE,4DAA4D;QAC5D,IAAI,EAAE,wBAAwB,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC;QACtD,OAAO,EAAE;YACP,GAAG,wBAAwB,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;YACtD,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,SAAS,IAAI,MAAM;YACjD,uEAAuE;YACvE,qEAAqE;YACrE,0DAA0D;YAC1D,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,KAAK,KAAK;gBACxC,CAAC,CAAC,EAAE,qBAAqB,EAAE,IAAI,EAAE;gBACjC,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;SACjD;QACD,OAAO,EAAE,wBAAwB,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;QAC5D,YAAY,EAAE,wBAAwB,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC;QAEtE,0CAA0C;QAC1C,gBAAgB,EAAE,UAAU,CAAC,gBAAgB,CAAC,OAAO;YACnD,CAAC,CAAC;gBACE,OAAO,EAAE,IAAI;gBACb,wBAAwB,EAAE,UAAU,CAAC,iBAAiB,CAAC,OAAO;gBAC9D,iBAAiB,EAAE,UAAU,CAAC,gBAAgB,CAAC,iBAAiB;gBAChE,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,OAAO;oBAClC,CAAC,CAAC;wBACE,iBAAiB,EAAE,UAAU,CAAC,gBAAgB,CAAC,iBAAiB;wBAChE,2BAA2B,EAAE,UAAU,CAAC,aAAa,CAAC,eAAe;qBACtE;oBACH,CAAC,CAAC,EAAE,CAAC;aACR;YACH,CAAC,CAAC,SAAS;QAEb,oEAAoE;QACpE,iEAAiE;QACjE,iBAAiB,EAAE,UAAU,CAAC,iBAAiB,CAAC,OAAO;YACrD,CAAC,CAAC;gBACE,qBAAqB,EAAE,UAAU,CAAC,iBAAiB,CAAC,qBAAqB;gBACzE,YAAY,EAAE,UAAU,CAAC,iBAAiB,CAAC,YAAY;gBACvD,SAAS,EAAE,UAAU,CAAC,iBAAiB,CAAC,eAAe;aACxD;YACH,CAAC,CAAC,SAAS;QAEb,uCAAuC;QACvC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE;QAEzE,mBAAmB;QACnB,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC;aACxD,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,KAAK,CAAC;aAClD,MAAM,CACL,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE;YAC1B,IAAI,MAAM,EAAE,CAAC;gBACX,GAAG,CAAC,QAAQ,CAAC,GAAG;oBACd,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,YAAY,EAAE,MAAM,CAAC,YAAY;iBAClC,CAAA;YACH,CAAC;YACD,OAAO,GAAG,CAAA;QACZ,CAAC,EACD,EAAgE,CACjE;QAEH,8BAA8B;QAC9B,SAAS,EAAE,UAAU,CAAC,SAAS;YAC7B,CAAC,CAAC;gBACE,OAAO,EAAE,UAAU,CAAC,SAAS,CAAC,OAAO;gBACrC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,MAAM;gBACnC,GAAG,EAAE,UAAU,CAAC,SAAS,CAAC,GAAG;aAC9B;YACH,CAAC,CAAC,SAAS;QAEb,+DAA+D;QAC/D,sEAAsE;QACtE,sEAAsE;QACtE,uEAAuE;QACvE,mEAAmE;QACnE,+DAA+D;QAC/D,OAAO,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,iBAAiB,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC;KAClE,CAAA;IAED,OAAO,sBAAsB,CAC3B,gBAAsD,EACtD,UAAU,CAAC,iBAA4C,CACnC,CAAA;AACxB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,UAAU,CACxB,cAAwD,EACxD,OAA+C;IAE/C,4CAA4C;IAC5C,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAA;IACrD,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAE/C,0CAA0C;IAC1C,IAAI,YAAY,GAAyC,IAAI,CAAA;IAC7D,IAAI,WAAW,GAAkD,IAAI,CAAA;IAErE,KAAK,UAAU,eAAe;QAC5B,IAAI,YAAY;YAAE,OAAO,YAAY,CAAA;QAErC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,WAAW,GAAG,CAAC,KAAK,IAAI,EAAE;gBACxB,MAAM,gBAAgB,GAAG,MAAM,sBAAsB,CAAC,aAAa,EAAE,cAAc,CAAC,CAAA;gBACpF,YAAY,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAA;gBAC3C,OAAO,YAAY,CAAA;YACrB,CAAC,CAAC,EAAE,CAAA;QACN,CAAC;QAED,OAAO,WAAW,CAAA;IACpB,CAAC;IAED,2DAA2D;IAC3D,OAAO,IAAI,KAAK,CAAC,EAAmC,EAAE;QACpD,GAAG,CAAC,CAAC,EAAE,IAAI;YACT,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACpB,oCAAoC;gBACpC,OAAO,SAAS,CAAA;YAClB,CAAC;YAED,iCAAiC;YACjC,MAAM,WAAW,GAAG,KAAK,EAAE,GAAG,IAAe,EAAE,EAAE;gBAC/C,MAAM,QAAQ,GAAG,MAAM,eAAe,EAAE,CAAA;gBACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAA6B,CAAC,CAAA;gBACrD,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;oBAChC,OAAQ,KAAyC,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;gBACzE,CAAC;gBACD,OAAO,KAAK,CAAA;YACd,CAAC,CAAA;YAED,4EAA4E;YAC5E,OAAO,IAAI,KAAK,CAAC,WAAW,EAAE;gBAC5B,GAAG,CAAC,MAAM,EAAE,OAAO;oBACjB,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;wBACvB,qCAAqC;wBACrC,OAAO,SAAS,CAAA;oBAClB,CAAC;oBACD,4DAA4D;oBAC5D,OAAO,KAAK,EAAE,GAAG,IAAe,EAAE,EAAE;wBAClC,MAAM,QAAQ,GAAG,MAAM,eAAe,EAAE,CAAA;wBACxC,MAAM,WAAW,GAAG,QAAQ,CAAC,IAA6B,CAAC,CAAA;wBAC3D,IAAI,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;4BACnD,MAAM,UAAU,GAAI,WAAuC,CAAC,OAAiB,CAAC,CAAA;4BAC9E,IAAI,OAAO,UAAU,KAAK,UAAU,EAAE,CAAC;gCACrC,OAAQ,UAA8C,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;4BACjF,CAAC;4BACD,OAAO,UAAU,CAAA;wBACnB,CAAC;wBACD,MAAM,IAAI,KAAK,CACb,YAAY,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,6BAA6B,CACzE,CAAA;oBACH,CAAC,CAAA;gBACH,CAAC;aACF,CAAC,CAAA;QACJ,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAmC,EACnC,aAAuB,EACvB,OAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;QAEtD,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;YACnB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,6CAA6C;QAC7C,MAAM,MAAM,GAA4B,EAAE,CAAA;QAE1C,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;YAClC,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACvB,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;YACjC,CAAC;iBAAM,IAAI,KAAK,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAkC,CAAC,CAAA;YAClE,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opensaas/stack-auth",
-  "version": "0.36.0",
+  "version": "0.37.0",
   "description": "Better-auth integration for OpenSaas Stack",
   "type": "module",
   "main": "./dist/index.js",
@@ -65,8 +65,8 @@
     "react": "^19.2.4",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
     "vitest": "^4.1.10",
-    "@opensaas/stack-cli": "0.36.0",
-    "@opensaas/stack-core": "0.36.0"
+    "@opensaas/stack-cli": "0.37.0",
+    "@opensaas/stack-core": "0.37.0"
   },
   "scripts": {
     "build": "tsc",

package/src/config/adopt-better-auth-tables.ts

@@ -28,6 +28,22 @@
  * auth migration. The recipe never touches the application's own domain `User`:
  * its model names are `Auth`-prefixed by default and the plugin only ever
  * adds/extends its *derived* keys.
+ *
+ * The single most common adoption shape is a project that ran better-auth
+ * *before* adding Stack: its live tables are still better-auth's own default
+ * lowercase names (`user`/`session`/`account`/`verification`), even though the
+ * derived list keys need the `Auth` prefix to avoid colliding with the app's
+ * own domain `User`. Pass `useBetterAuthTableNames: true` to point every
+ * model's physical table at that default while keeping the prefixed list keys
+ * (or `tableNames` for an explicit per-model override):
+ *
+ * ```typescript
+ * authPlugin({
+ *   ...adoptBetterAuthTables({ useBetterAuthTableNames: true }),
+ *   // AuthUser/AuthSession/AuthAccount/AuthVerification list keys,
+ *   // @@map("user")/@@map("session")/@@map("account")/@@map("verification")
+ * })
+ * ```
  */
 
 import type { AuthConfig, AuthModelConfig } from './types.js'
@@ -89,6 +105,39 @@ export type AdoptBetterAuthTablesOptions = {
     account?: Record<string, string>
     verification?: Record<string, string>
   }
+
+  /**
+   * Set every model's physical table name to better-auth's own default
+   * lowercase table name (`user`, `session`, `account`, `verification`) —
+   * independent of the prefixed list key/`modelName`.
+   *
+   * This is the single most common adoption shape: a project that ran
+   * better-auth before adding the stack has exactly these tables, and the
+   * default `modelNamePrefix: 'Auth'` alone would otherwise pin the table
+   * name to the prefixed model name (`AuthUser`, ...), which `prisma migrate
+   * diff` reads as a rename against the live `user` table.
+   *
+   * Ignored for a model with an explicit entry in {@link tableNames}.
+   *
+   * @default false
+   */
+  useBetterAuthTableNames?: boolean
+
+  /**
+   * Per-model explicit table name overrides, keyed by model. Takes
+   * precedence over `useBetterAuthTableNames` for that model.
+   *
+   * @example
+   * ```typescript
+   * adoptBetterAuthTables({ tableNames: { user: 'users' } })
+   * ```
+   */
+  tableNames?: {
+    user?: string
+    session?: string
+    account?: string
+    verification?: string
+  }
 }
 
 /** The four better-auth models and their default (unprefixed) model names. */
@@ -99,6 +148,14 @@ const MODEL_DEFAULT_NAMES = {
   verification: 'Verification',
 } as const
 
+/** better-auth's own default lowercase table names, per model. */
+const BETTER_AUTH_DEFAULT_TABLE_NAMES = {
+  user: 'user',
+  session: 'session',
+  account: 'account',
+  verification: 'verification',
+} as const
+
 /**
  * The adoption-relevant slice of {@link AuthConfig}: the plugin-level `schema`
  * and the per-model `modelName`/`fields`. Returned (not the full `AuthConfig`)
@@ -123,12 +180,24 @@ export type AdoptBetterAuthTablesConfig = Pick<
 export function adoptBetterAuthTables(
   options: AdoptBetterAuthTablesOptions = {},
 ): AdoptBetterAuthTablesConfig {
-  const { schema = 'auth', modelNamePrefix = 'Auth', fields = {} } = options
+  const {
+    schema = 'auth',
+    modelNamePrefix = 'Auth',
+    fields = {},
+    useBetterAuthTableNames = false,
+    tableNames = {},
+  } = options
 
   const buildModel = (model: keyof typeof MODEL_DEFAULT_NAMES): AuthModelConfig => {
     const config: AuthModelConfig = {
       modelName: `${modelNamePrefix}${MODEL_DEFAULT_NAMES[model]}`,
     }
+    const tableName =
+      tableNames[model] ??
+      (useBetterAuthTableNames ? BETTER_AUTH_DEFAULT_TABLE_NAMES[model] : undefined)
+    if (tableName !== undefined) {
+      config.tableName = tableName
+    }
     const fieldMap = fields[model]
     if (fieldMap && Object.keys(fieldMap).length > 0) {
       config.fields = fieldMap

package/src/config/derive-auth-lists.ts

@@ -2,13 +2,15 @@
  * Pure `better-auth config → Auth lists` derivation.
  *
  * This module is intentionally free of side effects and plugin/runtime
- * concerns: given the resolved better-auth model config (per-model `modelName`
- * and `fields` column maps) plus any custom User fields, it produces the four
- * OpenSaaS Auth lists (user/session/account/verification) with:
+ * concerns: given the resolved better-auth model config (per-model `modelName`,
+ * `tableName`, and `fields` column maps) plus any custom User fields, it
+ * produces the four OpenSaaS Auth lists (user/session/account/verification)
+ * with:
  *
  *  - list keys taken from each model's `modelName`
- *  - a table `@@map` (list-level `db.map`) when the key differs from the
- *    default better-auth model name
+ *  - a table `@@map` (list-level `db.map`) taken from each model's resolved
+ *    `tableName` — independent of `modelName`, so a renamed list key can still
+ *    adopt a differently-named live table
  *  - field-level `@map` (`db.map`) for any better-auth field → column override
  *  - relationship refs between the auth lists wired to the *derived* keys
  *    (e.g. `Session.user → AuthUser.sessions`)
@@ -31,17 +33,6 @@ import type { RelationshipField } from '@opensaas/stack-core/fields'
 import type { ExtendUserListConfig } from '../lists/index.js'
 import type { AuthAccessConfig, NormalizedAuthModelConfig, NormalizedAuthModels } from './types.js'
 
-/**
- * Default better-auth model names — used to decide whether a `@@map` is needed
- * (only when the configured `modelName` differs from the default).
- */
-const DEFAULT_MODEL_NAMES = {
-  user: 'User',
-  session: 'Session',
-  account: 'Account',
-  verification: 'Verification',
-} as const
-
 /**
  * The derived Auth list set together with the keys each list was placed under.
  * Keys are surfaced separately so callers (plugin add-vs-extend logic, runtime
@@ -71,24 +62,24 @@ export type DerivedAuthLists = {
  * Auth list must opt back in so the generated models keep those columns and
  * better-auth keeps working.
  *
- * When the developer renames the model (e.g. `modelName: 'AuthUser'`), we also
- * pin the physical table name to that model name via `@@map("AuthUser")` so the
- * generated list adopts the developer's live table exactly. When a `schema` is
- * configured (plugin-level or per-model), the list is placed in that Postgres
- * schema via `@@schema(...)`.
+ * The physical table name (`@@map`) comes from the model's resolved
+ * `tableName` — independent of the list key/`modelName` — so a renamed list
+ * key can still adopt a differently-named live table (e.g. better-auth's own
+ * default lowercase table names). When a `schema` is configured (plugin-level
+ * or per-model), the list is placed in that Postgres schema via `@@schema(...)`.
  *
- * With no `modelName`/`schema` overrides we emit only `timestamps: true`,
+ * With no `tableName`/`schema` overrides we emit only `timestamps: true`,
  * leaving the default `User`/`Session`/... table/schema output unchanged.
  */
-function listDb(
-  model: NormalizedAuthModelConfig,
-  defaultModelName: string,
-): { timestamps: true; map?: string; schema?: string } {
-  const map = model.modelName !== defaultModelName ? model.modelName : undefined
+function listDb(model: NormalizedAuthModelConfig): {
+  timestamps: true
+  map?: string
+  schema?: string
+} {
   const schema = model.schema
   return {
     timestamps: true,
-    ...(map !== undefined ? { map } : {}),
+    ...(model.tableName !== undefined ? { map: model.tableName } : {}),
     ...(schema !== undefined ? { schema } : {}),
   }
 }
@@ -110,14 +101,18 @@ function fieldDb(fieldName: string, fields: Record<string, string>): { map: stri
  * Build the `db` config for a `user` relationship (`Session.user` /
  * `Account.user`), honouring a `userId` column override from the better-auth
  * `fields` map and mirroring better-auth's own FK shape: no separate FK index
- * — the index is applied at the field level via `isIndexed: false` — and
- * `onDelete: Cascade`, so a generated Auth schema diffs clean against a live
- * better-auth database on both dimensions instead of showing a spurious index
- * drop and a referential-action change (issue #679).
+ * — the index is applied at the field level via `isIndexed: false` —
+ * `onDelete: Cascade`, and a required (non-nullable) foreign key, since
+ * better-auth's adapter always writes a `userId` on every session/account row
+ * it creates. This means a generated Auth schema diffs clean against a live
+ * better-auth database on all three dimensions instead of showing a spurious
+ * index drop, a referential-action change, and a `DROP NOT NULL` (issues #679,
+ * #863).
  */
 function userRelationshipDb(fields: Record<string, string>): NonNullable<RelationshipField['db']> {
   const column = fields.userId
   return {
+    isNullable: false,
     ...(column ? { foreignKey: { map: column } } : {}),
     extendPrismaSchema: ({ fkLine, relationLine }) => ({
       fkLine,
@@ -161,7 +156,7 @@ function createUserList(
       // Custom fields from user config
       ...(userConfig.fields || {}),
     },
-    db: listDb(model, DEFAULT_MODEL_NAMES.user),
+    db: listDb(model),
     access: userConfig.access || access,
     hooks: userConfig.hooks,
   })
@@ -187,7 +182,9 @@ function createSessionList(
         isIndexed: 'unique',
         db: fieldDb('token', f),
       }),
-      expiresAt: timestamp({ db: fieldDb('expiresAt', f) }),
+      expiresAt: timestamp({
+        db: { isNullable: false, ...fieldDb('expiresAt', f) },
+      }),
       ipAddress: text({ db: fieldDb('ipAddress', f) }),
       userAgent: text({ db: fieldDb('userAgent', f) }),
       user: relationship({
@@ -196,7 +193,7 @@ function createSessionList(
         db: userRelationshipDb(f),
       }),
     },
-    db: listDb(model, DEFAULT_MODEL_NAMES.session),
+    db: listDb(model),
     access,
   })
 }
@@ -231,7 +228,7 @@ function createAccountList(
       idToken: text({ db: fieldDb('idToken', f) }),
       password: text({ db: fieldDb('password', f) }),
     },
-    db: listDb(model, DEFAULT_MODEL_NAMES.account),
+    db: listDb(model),
     access,
   })
 }
@@ -252,9 +249,11 @@ function createVerificationList(
     fields: {
       identifier: text({ validation: { isRequired: true }, db: fieldDb('identifier', f) }),
       value: text({ validation: { isRequired: true }, db: fieldDb('value', f) }),
-      expiresAt: timestamp({ db: fieldDb('expiresAt', f) }),
+      expiresAt: timestamp({
+        db: { isNullable: false, ...fieldDb('expiresAt', f) },
+      }),
     },
-    db: listDb(model, DEFAULT_MODEL_NAMES.verification),
+    db: listDb(model),
     access,
   })
 }