@opensaas/stack-auth 0.36.0 → 0.38.0

package/dist/server/index.js

@@ -1,6 +1,28 @@
 import { betterAuth } from 'better-auth';
 import { prismaAdapter } from 'better-auth/adapters/prisma';
 import { nextCookies } from 'better-auth/next-js';
+/**
+ * Guard against the supplied plugin tuple silently drifting from the plugin
+ * array actually resolved from `authPlugin({ betterAuthPlugins })` — the
+ * supplied tuple exists for typing only, so if it isn't the exact same
+ * instances in the exact same order, the type it produces would be a lie
+ * about what `betterAuth()` is actually constructed with.
+ */
+function assertPluginTupleMatchesResolved(supplied, resolved) {
+    if (supplied.length !== resolved.length) {
+        throw new Error('[@opensaas/stack-auth] The plugin tuple passed to `buildBetterAuthOptions()` / `createAuth()` ' +
+            `has ${supplied.length} plugin(s), but the plugin array resolved from \`authPlugin({ ` +
+            `betterAuthPlugins })\` has ${resolved.length}. Pass the exact same array (without ` +
+            '`nextCookies()` — the stack appends that itself).');
+    }
+    const mismatchIndex = supplied.findIndex((plugin, index) => plugin !== resolved[index]);
+    if (mismatchIndex !== -1) {
+        throw new Error('[@opensaas/stack-auth] The plugin tuple passed to `buildBetterAuthOptions()` / `createAuth()` ' +
+            `does not match the plugin array resolved from \`authPlugin({ betterAuthPlugins })\` at index ` +
+            `${mismatchIndex} (got plugin "${supplied[mismatchIndex]?.id}", expected the same instance as ` +
+            `"${resolved[mismatchIndex]?.id}"). Pass the exact same array — same instances, same order.`);
+    }
+}
 /**
  * Get better-auth database configuration from OpenSaas config
  */
@@ -24,25 +46,177 @@ function toBetterAuthModelOptions(model) {
         options.fields = model.fields;
     return Object.keys(options).length > 0 ? options : undefined;
 }
+const MODELS_WITH_NO_ADDITIONAL_FIELDS_PASSTHROUGH = [
+    'user',
+    'session',
+    'account',
+    'verification',
+];
 /**
- * Create a better-auth instance from OpenSaas config
- * This should be called once at app startup
- *
- * @example
- * ```typescript
- * // lib/auth.ts
- * import { createAuth } from '@opensaas/stack-auth/server'
- * import config from '../opensaas.config'
- * import { rawOpensaasContext } from '@/.opensaas/context'
- *
- * export const auth = createAuth(config, rawOpensaasContext)
- * ```
+ * Reject `betterAuthOptions` keys that already have a dedicated, non-passthrough
+ * seam — accepting them here would create two unranked ways to set the same
+ * thing, or (for `additionalFields`) silently diverge from the generated
+ * Prisma schema. See the `betterAuthOptions` doc comment on `AuthConfig`.
+ */
+function assertNoUnsupportedPassthroughKeys(betterAuthOptions) {
+    if ('database' in betterAuthOptions) {
+        throw new Error('[@opensaas/stack-auth] `betterAuthOptions.database` is not supported — the stack ' +
+            'derives the database adapter from your `db` config and the running context. ' +
+            'Configure the database through `db` in `opensaas.config.ts` instead.');
+    }
+    if ('plugins' in betterAuthOptions) {
+        throw new Error('[@opensaas/stack-auth] `betterAuthOptions.plugins` is not supported — better-auth ' +
+            'plugins are added through `authPlugin({ betterAuthPlugins: [...] })`, which the stack ' +
+            'appends `nextCookies()` after. Use `betterAuthPlugins` instead.');
+    }
+    for (const model of MODELS_WITH_NO_ADDITIONAL_FIELDS_PASSTHROUGH) {
+        const modelOptions = betterAuthOptions[model];
+        if (modelOptions &&
+            typeof modelOptions === 'object' &&
+            !Array.isArray(modelOptions) &&
+            'additionalFields' in modelOptions) {
+            throw new Error(`[@opensaas/stack-auth] \`betterAuthOptions.${model}.additionalFields\` is not ` +
+                'supported — it adds columns that would not be reflected in the generated Prisma ' +
+                'schema. Add fields to the derived list instead: ' +
+                (model === 'user'
+                    ? '`extendUserList`, or declare the list yourself in your own `lists` config.'
+                    : 'declare the derived list yourself in your own `lists` config (the auth plugin ' +
+                        'merges in field additions for the models it derives).'));
+        }
+    }
+}
+function isPlainObject(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        !Array.isArray(value) &&
+        Object.getPrototypeOf(value) === Object.prototype);
+}
+/**
+ * Deep-merge `overrides` onto `base`, recursing into plain-object values so a
+ * nested addition (one database hook, one session sub-option) merges
+ * alongside sibling keys the stack already set there rather than replacing
+ * the whole branch. Arrays and any other value type replace outright.
+ * `overrides` wins on every key collision.
  */
-export function createAuth(opensaasConfig, context) {
+function mergeBetterAuthOptions(base, overrides) {
+    const result = { ...base };
+    for (const [key, value] of Object.entries(overrides)) {
+        const baseValue = result[key];
+        result[key] =
+            isPlainObject(baseValue) && isPlainObject(value)
+                ? mergeBetterAuthOptions(baseValue, value)
+                : value;
+    }
+    return result;
+}
+export async function buildBetterAuthOptions(opensaasConfig, context, plugins) {
+    const resolvedConfig = await Promise.resolve(opensaasConfig);
+    const resolvedContext = await Promise.resolve(context);
+    // Extract auth config from plugin data
+    const authConfig = resolvedConfig._pluginData?.auth;
+    if (!authConfig) {
+        throw new Error('Auth config not found. Make sure to use authPlugin() in your opensaas.config.ts');
+    }
+    // `requireConfirmation` has no better-auth equivalent — it's a UI-only
+    // concern the pre-built forms already take as their own
+    // `requirePasswordConfirmation` prop. Warn rather than silently drop it,
+    // since setting it here looks like it should do something.
+    if (authConfig.emailAndPassword.enabled &&
+        authConfig.emailAndPassword.requireConfirmation !== true) {
+        console.warn('[@opensaas/stack-auth] `emailAndPassword.requireConfirmation` has no effect here — ' +
+            'createAuth() has no better-auth option to forward it to. Pass ' +
+            '`requirePasswordConfirmation` directly to <SignUpForm> / <ResetPasswordForm> instead.');
+    }
+    // `passwordReset` is wired through better-auth's `emailAndPassword` config
+    // (there's no password to reset without a password-based account), so it
+    // silently has no effect if email/password auth itself isn't enabled.
+    if (authConfig.passwordReset.enabled && !authConfig.emailAndPassword.enabled) {
+        console.warn('[@opensaas/stack-auth] `passwordReset.enabled` has no effect here — ' +
+            '`emailAndPassword.enabled` is false, so there is no password-based account to reset.');
+    }
+    assertNoUnsupportedPassthroughKeys(authConfig.betterAuthOptions);
+    const resolvedPlugins = authConfig.betterAuthPlugins || [];
+    if (plugins) {
+        assertPluginTupleMatchesResolved(plugins, resolvedPlugins);
+    }
+    // Build better-auth configuration
+    const betterAuthConfig = {
+        database: getDatabaseConfig(resolvedConfig.db, resolvedContext),
+        // Mirror the per-model config (modelName + field column maps) back to
+        // better-auth so the running auth instance reads/writes the same
+        // tables/columns the OpenSaaS Auth lists were derived from.
+        user: toBetterAuthModelOptions(authConfig.models.user),
+        session: {
+            ...toBetterAuthModelOptions(authConfig.models.session),
+            expiresIn: authConfig.session.expiresIn || 604800,
+            // better-auth treats `updateAge: 0` as "refresh on every request", not
+            // "never refresh" — disabling refresh entirely requires its separate
+            // `disableSessionRefresh` flag regardless of `updateAge`.
+            ...(authConfig.session.updateAge === false
+                ? { disableSessionRefresh: true }
+                : { updateAge: authConfig.session.updateAge }),
+        },
+        account: toBetterAuthModelOptions(authConfig.models.account),
+        verification: toBetterAuthModelOptions(authConfig.models.verification),
+        // Enable email and password if configured
+        emailAndPassword: authConfig.emailAndPassword.enabled
+            ? {
+                enabled: true,
+                requireEmailVerification: authConfig.emailVerification.enabled,
+                minPasswordLength: authConfig.emailAndPassword.minPasswordLength,
+                ...(authConfig.passwordReset.enabled
+                    ? {
+                        sendResetPassword: authConfig.emailAndPassword.sendResetPassword,
+                        resetPasswordTokenExpiresIn: authConfig.passwordReset.tokenExpiration,
+                    }
+                    : {}),
+            }
+            : undefined,
+        // Email verification (independent of emailAndPassword — also covers
+        // e.g. a social-provider account whose email isn't yet verified)
+        emailVerification: authConfig.emailVerification.enabled
+            ? {
+                sendVerificationEmail: authConfig.emailVerification.sendVerificationEmail,
+                sendOnSignUp: authConfig.emailVerification.sendOnSignUp,
+                expiresIn: authConfig.emailVerification.tokenExpiration,
+            }
+            : undefined,
+        // Trust host (required for production)
+        trustedOrigins: process.env.BETTER_AUTH_TRUSTED_ORIGINS?.split(',') || [],
+        // Social providers
+        socialProviders: Object.entries(authConfig.socialProviders)
+            .filter(([_, config]) => config?.enabled !== false)
+            .reduce((acc, [provider, config]) => {
+            if (config) {
+                acc[provider] = {
+                    clientId: config.clientId,
+                    clientSecret: config.clientSecret,
+                };
+            }
+            return acc;
+        }, {}),
+        // Rate limiting configuration
+        rateLimit: authConfig.rateLimit
+            ? {
+                enabled: authConfig.rateLimit.enabled,
+                window: authConfig.rateLimit.window,
+                max: authConfig.rateLimit.max,
+            }
+            : undefined,
+        // Pass through any additional Better Auth plugins, then append
+        // nextCookies LAST so it can write the Set-Cookie headers produced by
+        // any auth.api.* call made inside a Next.js server action into Next's
+        // cookie store. This is what makes the server-action auth forms (which
+        // call auth.api.signInEmail/signUpEmail/etc. server-side) actually
+        // persist a session. It must be the final plugin in the array.
+        plugins: [...resolvedPlugins, nextCookies()],
+    };
+    return mergeBetterAuthOptions(betterAuthConfig, authConfig.betterAuthOptions);
+}
+export function createAuth(opensaasConfig, context, plugins) {
     // Resolve config and context asynchronously
     const configPromise = Promise.resolve(opensaasConfig);
     const contextPromise = Promise.resolve(context);
-    // Create auth instance lazily when needed
     let authInstance = null;
     let authPromise = null;
     async function getAuthInstance() {
@@ -50,66 +224,9 @@ export function createAuth(opensaasConfig, context) {
             return authInstance;
         if (!authPromise) {
             authPromise = (async () => {
-                const resolvedConfig = await configPromise;
-                const resolvedContext = await contextPromise;
-                // Extract auth config from plugin data
-                const authConfig = resolvedConfig._pluginData?.auth;
-                if (!authConfig) {
-                    throw new Error('Auth config not found. Make sure to use authPlugin() in your opensaas.config.ts');
-                }
-                // Build better-auth configuration
-                const betterAuthConfig = {
-                    database: getDatabaseConfig(resolvedConfig.db, resolvedContext),
-                    // Mirror the per-model config (modelName + field column maps) back to
-                    // better-auth so the running auth instance reads/writes the same
-                    // tables/columns the OpenSaaS Auth lists were derived from.
-                    user: toBetterAuthModelOptions(authConfig.models.user),
-                    session: {
-                        ...toBetterAuthModelOptions(authConfig.models.session),
-                        expiresIn: authConfig.session.expiresIn || 604800,
-                        updateAge: authConfig.session.updateAge
-                            ? (authConfig.session.expiresIn || 604800) / 10
-                            : 0,
-                    },
-                    account: toBetterAuthModelOptions(authConfig.models.account),
-                    verification: toBetterAuthModelOptions(authConfig.models.verification),
-                    // Enable email and password if configured
-                    emailAndPassword: authConfig.emailAndPassword.enabled
-                        ? {
-                            enabled: true,
-                            requireEmailVerification: authConfig.emailVerification.enabled,
-                        }
-                        : undefined,
-                    // Trust host (required for production)
-                    trustedOrigins: process.env.BETTER_AUTH_TRUSTED_ORIGINS?.split(',') || [],
-                    // Social providers
-                    socialProviders: Object.entries(authConfig.socialProviders)
-                        .filter(([_, config]) => config?.enabled !== false)
-                        .reduce((acc, [provider, config]) => {
-                        if (config) {
-                            acc[provider] = {
-                                clientId: config.clientId,
-                                clientSecret: config.clientSecret,
-                            };
-                        }
-                        return acc;
-                    }, {}),
-                    // Rate limiting configuration
-                    rateLimit: authConfig.rateLimit
-                        ? {
-                            enabled: authConfig.rateLimit.enabled,
-                            window: authConfig.rateLimit.window,
-                            max: authConfig.rateLimit.max,
-                        }
-                        : undefined,
-                    // Pass through any additional Better Auth plugins, then append
-                    // nextCookies LAST so it can write the Set-Cookie headers produced by
-                    // any auth.api.* call made inside a Next.js server action into Next's
-                    // cookie store. This is what makes the server-action auth forms (which
-                    // call auth.api.signInEmail/signUpEmail/etc. server-side) actually
-                    // persist a session. It must be the final plugin in the array.
-                    plugins: [...(authConfig.betterAuthPlugins || []), nextCookies()],
-                };
+                const betterAuthConfig = plugins
+                    ? await buildBetterAuthOptions(configPromise, contextPromise, plugins)
+                    : await buildBetterAuthOptions(configPromise, contextPromise);
                 authInstance = betterAuth(betterAuthConfig);
                 return authInstance;
             })();
@@ -158,31 +275,102 @@ export function createAuth(opensaasConfig, context) {
     });
 }
 /**
- * Get session from better-auth and transform it to OpenSaas session format
- * This is used internally by the generated context
+ * Field names already warned about failing to resolve against a session, so a
+ * given field warns at most once per process rather than once per request.
  */
-export async function getSessionFromAuth(auth, sessionFields) {
-    try {
-        const session = await auth.api.getSession({
-            headers: new Headers(),
-        });
-        if (!session?.user) {
-            return null;
-        }
-        // Build session object with requested fields
-        const result = {};
-        for (const field of sessionFields) {
-            if (field === 'userId') {
-                result.userId = session.user.id;
-            }
-            else if (field in session.user) {
-                result[field] = session.user[field];
-            }
-        }
-        return result;
+const unresolvedSessionFieldWarnings = new Set();
+/**
+ * Warn (once per field, per process) that a `sessionFields` entry could not
+ * be resolved from the session shape `auth.api.getSession()` actually
+ * returned — naming the field and what keys were available to check, so the
+ * gap is visible here instead of surfacing later as an access-control
+ * function silently reading `undefined`.
+ */
+function warnUnresolvedSessionField(field, resolvedSession) {
+    if (unresolvedSessionFieldWarnings.has(field))
+        return;
+    unresolvedSessionFieldWarnings.add(field);
+    const user = isPlainObject(resolvedSession.user) ? resolvedSession.user : undefined;
+    const sessionRow = isPlainObject(resolvedSession.session) ? resolvedSession.session : undefined;
+    console.warn(`[@opensaas/stack-auth] sessionFields: "${field}" was not found on the resolved session. ` +
+        `Checked its top-level keys (${Object.keys(resolvedSession).join(', ') || 'none'}), ` +
+        `its "user" object (${user ? Object.keys(user).join(', ') || 'none' : 'not present'}), ` +
+        `and its "session" object (${sessionRow ? Object.keys(sessionRow).join(', ') || 'none' : 'not present'}). ` +
+        `The field is omitted from the projected session. A \`customSession\` plugin that nests this ` +
+        `value elsewhere is the app's own to reconcile — see the \`sessionFields\` reference. ` +
+        `This warning will not repeat for "${field}".`);
+}
+/**
+ * Resolve a single `sessionFields` entry off the resolved better-auth
+ * session (whatever `auth.api.getSession()` returned — the default `{
+ * session, user }` shape, or a `customSession` plugin's replaced shape).
+ *
+ * `userId` is special-cased to the authenticated user's `id` — the
+ * documented default apps depend on. Every other name resolves against a
+ * fixed precedence so a collision between sources is predictable rather
+ * than incidental: a top-level key on the resolved session object, then the
+ * `user` object, then the `session` sub-object.
+ */
+function resolveSessionField(field, resolvedSession) {
+    const user = isPlainObject(resolvedSession.user) ? resolvedSession.user : undefined;
+    if (field === 'userId') {
+        return user && 'id' in user ? { found: true, value: user.id } : { found: false };
+    }
+    if (field in resolvedSession) {
+        return { found: true, value: resolvedSession[field] };
+    }
+    if (user && field in user) {
+        return { found: true, value: user[field] };
     }
-    catch {
+    const sessionRow = isPlainObject(resolvedSession.session) ? resolvedSession.session : undefined;
+    if (sessionRow && field in sessionRow) {
+        return { found: true, value: sessionRow[field] };
+    }
+    return { found: false };
+}
+/**
+ * Get session from better-auth and transform it to OpenSaas session format —
+ * a flattened projection of `sessionFields` off the *resolved* session
+ * object, not just its `user` sub-object. This is what makes a
+ * `customSession` plugin's fields (added at the top level, or a
+ * session-only field like the admin plugin's `impersonatedBy`) reachable.
+ * See the `sessionFields` reference for the resolution precedence.
+ *
+ * Returns `null` only when there is genuinely no session — a resolved
+ * session with no `user` key (a `customSession` plugin that dropped it) is
+ * still a session and still gets projected, never misreported as anonymous.
+ * A listed field that can't be resolved from the session shape is omitted
+ * and warns once per field per process (see `warnUnresolvedSessionField`)
+ * instead of silently vanishing into an access-control function reading
+ * `undefined`.
+ *
+ * Errors from the underlying `auth.api.getSession()` call propagate rather
+ * than becoming `null` — collapsing a lookup failure (e.g. a session-store
+ * outage) into "anonymous" is indistinguishable from a mass sign-out under
+ * fail-closed access control, so the caller must see it.
+ *
+ * Not called by any generated code before this helper existed — apps used to
+ * hand-roll this same transform against `auth.api.getSession({ headers:
+ * await headers() })`. Exported as the single reusable implementation; pass
+ * the caller's request headers (e.g. Next.js `await headers()` in a Server
+ * Component/action) so a session cookie can actually be resolved.
+ */
+export async function getSessionFromAuth(auth, sessionFields, headers) {
+    const resolvedSession = await auth.api.getSession({ headers });
+    if (!resolvedSession) {
         return null;
     }
+    const resolvedSessionRecord = resolvedSession;
+    const result = {};
+    for (const field of sessionFields) {
+        const resolved = resolveSessionField(field, resolvedSessionRecord);
+        if (resolved.found) {
+            result[field] = resolved.value;
+        }
+        else {
+            warnUnresolvedSessionField(field, resolvedSessionRecord);
+        }
+    }
+    return result;
 }
 //# sourceMappingURL=index.js.map

package/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAA;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAMjD;;GAEG;AACH,SAAS,iBAAiB,CACxB,QAAwB,EACxB,OAAsB;IAEtB,OAAO,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE;QACnC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;KAC5B,CAAC,CAAA;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,wBAAwB,CAC/B,KAAgC;IAEhC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAA;IACtD,MAAM,OAAO,GAA4D,EAAE,CAAA;IAC3E,IAAI,KAAK,CAAC,SAAS;QAAE,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAA;IACxD,IAAI,SAAS;QAAE,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;IAC5C,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;AAC9D,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,UAAU,CACxB,cAAwD,EACxD,OAA+C;IAE/C,4CAA4C;IAC5C,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAA;IACrD,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAE/C,0CAA0C;IAC1C,IAAI,YAAY,GAAyC,IAAI,CAAA;IAC7D,IAAI,WAAW,GAAkD,IAAI,CAAA;IAErE,KAAK,UAAU,eAAe;QAC5B,IAAI,YAAY;YAAE,OAAO,YAAY,CAAA;QAErC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,WAAW,GAAG,CAAC,KAAK,IAAI,EAAE;gBACxB,MAAM,cAAc,GAAG,MAAM,aAAa,CAAA;gBAC1C,MAAM,eAAe,GAAG,MAAM,cAAc,CAAA;gBAE5C,uCAAuC;gBACvC,MAAM,UAAU,GAAG,cAAc,CAAC,WAAW,EAAE,IAAwC,CAAA;gBAEvF,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAA;gBACH,CAAC;gBAED,kCAAkC;gBAClC,MAAM,gBAAgB,GAAsB;oBAC1C,QAAQ,EAAE,iBAAiB,CAAC,cAAc,CAAC,EAAE,EAAE,eAAe,CAAC;oBAE/D,sEAAsE;oBACtE,iEAAiE;oBACjE,4DAA4D;oBAC5D,IAAI,EAAE,wBAAwB,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC;oBACtD,OAAO,EAAE;wBACP,GAAG,wBAAwB,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;wBACtD,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,SAAS,IAAI,MAAM;wBACjD,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,SAAS;4BACrC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,GAAG,EAAE;4BAC/C,CAAC,CAAC,CAAC;qBACN;oBACD,OAAO,EAAE,wBAAwB,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;oBAC5D,YAAY,EAAE,wBAAwB,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC;oBAEtE,0CAA0C;oBAC1C,gBAAgB,EAAE,UAAU,CAAC,gBAAgB,CAAC,OAAO;wBACnD,CAAC,CAAC;4BACE,OAAO,EAAE,IAAI;4BACb,wBAAwB,EAAE,UAAU,CAAC,iBAAiB,CAAC,OAAO;yBAC/D;wBACH,CAAC,CAAC,SAAS;oBAEb,uCAAuC;oBACvC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE;oBAEzE,mBAAmB;oBACnB,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC;yBACxD,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,KAAK,CAAC;yBAClD,MAAM,CACL,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE;wBAC1B,IAAI,MAAM,EAAE,CAAC;4BACX,GAAG,CAAC,QAAQ,CAAC,GAAG;gCACd,QAAQ,EAAE,MAAM,CAAC,QAAQ;gCACzB,YAAY,EAAE,MAAM,CAAC,YAAY;6BAClC,CAAA;wBACH,CAAC;wBACD,OAAO,GAAG,CAAA;oBACZ,CAAC,EACD,EAAgE,CACjE;oBAEH,8BAA8B;oBAC9B,SAAS,EAAE,UAAU,CAAC,SAAS;wBAC7B,CAAC,CAAC;4BACE,OAAO,EAAE,UAAU,CAAC,SAAS,CAAC,OAAO;4BACrC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,MAAM;4BACnC,GAAG,EAAE,UAAU,CAAC,SAAS,CAAC,GAAG;yBAC9B;wBACH,CAAC,CAAC,SAAS;oBAEb,+DAA+D;oBAC/D,sEAAsE;oBACtE,sEAAsE;oBACtE,uEAAuE;oBACvE,mEAAmE;oBACnE,+DAA+D;oBAC/D,OAAO,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,iBAAiB,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC;iBAClE,CAAA;gBAED,YAAY,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAA;gBAC3C,OAAO,YAAY,CAAA;YACrB,CAAC,CAAC,EAAE,CAAA;QACN,CAAC;QAED,OAAO,WAAW,CAAA;IACpB,CAAC;IAED,2DAA2D;IAC3D,OAAO,IAAI,KAAK,CAAC,EAAmC,EAAE;QACpD,GAAG,CAAC,CAAC,EAAE,IAAI;YACT,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACpB,oCAAoC;gBACpC,OAAO,SAAS,CAAA;YAClB,CAAC;YAED,iCAAiC;YACjC,MAAM,WAAW,GAAG,KAAK,EAAE,GAAG,IAAe,EAAE,EAAE;gBAC/C,MAAM,QAAQ,GAAG,MAAM,eAAe,EAAE,CAAA;gBACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAA6B,CAAC,CAAA;gBACrD,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;oBAChC,OAAQ,KAAyC,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;gBACzE,CAAC;gBACD,OAAO,KAAK,CAAA;YACd,CAAC,CAAA;YAED,4EAA4E;YAC5E,OAAO,IAAI,KAAK,CAAC,WAAW,EAAE;gBAC5B,GAAG,CAAC,MAAM,EAAE,OAAO;oBACjB,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;wBACvB,qCAAqC;wBACrC,OAAO,SAAS,CAAA;oBAClB,CAAC;oBACD,4DAA4D;oBAC5D,OAAO,KAAK,EAAE,GAAG,IAAe,EAAE,EAAE;wBAClC,MAAM,QAAQ,GAAG,MAAM,eAAe,EAAE,CAAA;wBACxC,MAAM,WAAW,GAAG,QAAQ,CAAC,IAA6B,CAAC,CAAA;wBAC3D,IAAI,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;4BACnD,MAAM,UAAU,GAAI,WAAuC,CAAC,OAAiB,CAAC,CAAA;4BAC9E,IAAI,OAAO,UAAU,KAAK,UAAU,EAAE,CAAC;gCACrC,OAAQ,UAA8C,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;4BACjF,CAAC;4BACD,OAAO,UAAU,CAAA;wBACnB,CAAC;wBACD,MAAM,IAAI,KAAK,CACb,YAAY,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,6BAA6B,CACzE,CAAA;oBACH,CAAC,CAAA;gBACH,CAAC;aACF,CAAC,CAAA;QACJ,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAmC,EACnC,aAAuB;IAEvB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;YACxC,OAAO,EAAE,IAAI,OAAO,EAAE;SACvB,CAAC,CAAA;QAEF,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;YACnB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,6CAA6C;QAC7C,MAAM,MAAM,GAA4B,EAAE,CAAA;QAE1C,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;YAClC,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACvB,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;YACjC,CAAC;iBAAM,IAAI,KAAK,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAkC,CAAC,CAAA;YAClE,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAA;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAsBjD;;;;;;GAMG;AACH,SAAS,gCAAgC,CACvC,QAAqC,EACrC,QAAqC;IAErC,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,gGAAgG;YAC9F,OAAO,QAAQ,CAAC,MAAM,gEAAgE;YACtF,8BAA8B,QAAQ,CAAC,MAAM,uCAAuC;YACpF,mDAAmD,CACtD,CAAA;IACH,CAAC;IAED,MAAM,aAAa,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;IACvF,IAAI,aAAa,KAAK,CAAC,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,gGAAgG;YAC9F,+FAA+F;YAC/F,GAAG,aAAa,iBAAiB,QAAQ,CAAC,aAAa,CAAC,EAAE,EAAE,mCAAmC;YAC/F,IAAI,QAAQ,CAAC,aAAa,CAAC,EAAE,EAAE,6DAA6D,CAC/F,CAAA;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CACxB,QAAwB,EACxB,OAAsB;IAEtB,OAAO,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE;QACnC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;KAC5B,CAAC,CAAA;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,wBAAwB,CAC/B,KAAgC;IAEhC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAA;IACtD,MAAM,OAAO,GAA4D,EAAE,CAAA;IAC3E,IAAI,KAAK,CAAC,SAAS;QAAE,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAA;IACxD,IAAI,SAAS;QAAE,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;IAC5C,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;AAC9D,CAAC;AAED,MAAM,4CAA4C,GAAG;IACnD,MAAM;IACN,SAAS;IACT,SAAS;IACT,cAAc;CACN,CAAA;AAEV;;;;;GAKG;AACH,SAAS,kCAAkC,CAAC,iBAA0C;IACpF,IAAI,UAAU,IAAI,iBAAiB,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,mFAAmF;YACjF,8EAA8E;YAC9E,sEAAsE,CACzE,CAAA;IACH,CAAC;IAED,IAAI,SAAS,IAAI,iBAAiB,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,oFAAoF;YAClF,wFAAwF;YACxF,iEAAiE,CACpE,CAAA;IACH,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,4CAA4C,EAAE,CAAC;QACjE,MAAM,YAAY,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAA;QAC7C,IACE,YAAY;YACZ,OAAO,YAAY,KAAK,QAAQ;YAChC,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;YAC5B,kBAAkB,IAAI,YAAY,EAClC,CAAC;YACD,MAAM,IAAI,KAAK,CACb,8CAA8C,KAAK,6BAA6B;gBAC9E,kFAAkF;gBAClF,kDAAkD;gBAClD,CAAC,KAAK,KAAK,MAAM;oBACf,CAAC,CAAC,4EAA4E;oBAC9E,CAAC,CAAC,gFAAgF;wBAChF,uDAAuD,CAAC,CAC/D,CAAA;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,SAAS,CAClD,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,sBAAsB,CAC7B,IAA6B,EAC7B,SAAkC;IAElC,MAAM,MAAM,GAA4B,EAAE,GAAG,IAAI,EAAE,CAAA;IACnD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACrD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;QAC7B,MAAM,CAAC,GAAG,CAAC;YACT,aAAa,CAAC,SAAS,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC;gBAC9C,CAAC,CAAC,sBAAsB,CAAC,SAAS,EAAE,KAAK,CAAC;gBAC1C,CAAC,CAAC,KAAK,CAAA;IACb,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAuDD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,cAAwD,EACxD,OAA+C,EAC/C,OAAkB;IAElB,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAA;IAC5D,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAEtD,uCAAuC;IACvC,MAAM,UAAU,GAAG,cAAc,CAAC,WAAW,EAAE,IAAwC,CAAA;IAEvF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAA;IACH,CAAC;IAED,uEAAuE;IACvE,wDAAwD;IACxD,yEAAyE;IACzE,2DAA2D;IAC3D,IACE,UAAU,CAAC,gBAAgB,CAAC,OAAO;QACnC,UAAU,CAAC,gBAAgB,CAAC,mBAAmB,KAAK,IAAI,EACxD,CAAC;QACD,OAAO,CAAC,IAAI,CACV,qFAAqF;YACnF,gEAAgE;YAChE,uFAAuF,CAC1F,CAAA;IACH,CAAC;IAED,2EAA2E;IAC3E,yEAAyE;IACzE,sEAAsE;IACtE,IAAI,UAAU,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;QAC7E,OAAO,CAAC,IAAI,CACV,sEAAsE;YACpE,sFAAsF,CACzF,CAAA;IACH,CAAC;IAED,kCAAkC,CAAC,UAAU,CAAC,iBAA4C,CAAC,CAAA;IAE3F,MAAM,eAAe,GAAG,UAAU,CAAC,iBAAiB,IAAI,EAAE,CAAA;IAC1D,IAAI,OAAO,EAAE,CAAC;QACZ,gCAAgC,CAAC,OAAO,EAAE,eAAe,CAAC,CAAA;IAC5D,CAAC;IAED,kCAAkC;IAClC,MAAM,gBAAgB,GAAsB;QAC1C,QAAQ,EAAE,iBAAiB,CAAC,cAAc,CAAC,EAAE,EAAE,eAAe,CAAC;QAE/D,sEAAsE;QACtE,iEAAiE;QACjE,4DAA4D;QAC5D,IAAI,EAAE,wBAAwB,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC;QACtD,OAAO,EAAE;YACP,GAAG,wBAAwB,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;YACtD,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,SAAS,IAAI,MAAM;YACjD,uEAAuE;YACvE,qEAAqE;YACrE,0DAA0D;YAC1D,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,KAAK,KAAK;gBACxC,CAAC,CAAC,EAAE,qBAAqB,EAAE,IAAI,EAAE;gBACjC,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;SACjD;QACD,OAAO,EAAE,wBAAwB,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;QAC5D,YAAY,EAAE,wBAAwB,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC;QAEtE,0CAA0C;QAC1C,gBAAgB,EAAE,UAAU,CAAC,gBAAgB,CAAC,OAAO;YACnD,CAAC,CAAC;gBACE,OAAO,EAAE,IAAI;gBACb,wBAAwB,EAAE,UAAU,CAAC,iBAAiB,CAAC,OAAO;gBAC9D,iBAAiB,EAAE,UAAU,CAAC,gBAAgB,CAAC,iBAAiB;gBAChE,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,OAAO;oBAClC,CAAC,CAAC;wBACE,iBAAiB,EAAE,UAAU,CAAC,gBAAgB,CAAC,iBAAiB;wBAChE,2BAA2B,EAAE,UAAU,CAAC,aAAa,CAAC,eAAe;qBACtE;oBACH,CAAC,CAAC,EAAE,CAAC;aACR;YACH,CAAC,CAAC,SAAS;QAEb,oEAAoE;QACpE,iEAAiE;QACjE,iBAAiB,EAAE,UAAU,CAAC,iBAAiB,CAAC,OAAO;YACrD,CAAC,CAAC;gBACE,qBAAqB,EAAE,UAAU,CAAC,iBAAiB,CAAC,qBAAqB;gBACzE,YAAY,EAAE,UAAU,CAAC,iBAAiB,CAAC,YAAY;gBACvD,SAAS,EAAE,UAAU,CAAC,iBAAiB,CAAC,eAAe;aACxD;YACH,CAAC,CAAC,SAAS;QAEb,uCAAuC;QACvC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE;QAEzE,mBAAmB;QACnB,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC;aACxD,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,KAAK,CAAC;aAClD,MAAM,CACL,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE;YAC1B,IAAI,MAAM,EAAE,CAAC;gBACX,GAAG,CAAC,QAAQ,CAAC,GAAG;oBACd,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,YAAY,EAAE,MAAM,CAAC,YAAY;iBAClC,CAAA;YACH,CAAC;YACD,OAAO,GAAG,CAAA;QACZ,CAAC,EACD,EAAgE,CACjE;QAEH,8BAA8B;QAC9B,SAAS,EAAE,UAAU,CAAC,SAAS;YAC7B,CAAC,CAAC;gBACE,OAAO,EAAE,UAAU,CAAC,SAAS,CAAC,OAAO;gBACrC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,MAAM;gBACnC,GAAG,EAAE,UAAU,CAAC,SAAS,CAAC,GAAG;aAC9B;YACH,CAAC,CAAC,SAAS;QAEb,+DAA+D;QAC/D,sEAAsE;QACtE,sEAAsE;QACtE,uEAAuE;QACvE,mEAAmE;QACnE,+DAA+D;QAC/D,OAAO,EAAE,CAAC,GAAG,eAAe,EAAE,WAAW,EAAE,CAAC;KAC7C,CAAA;IAED,OAAO,sBAAsB,CAC3B,gBAAsD,EACtD,UAAU,CAAC,iBAA4C,CACG,CAAA;AAC9D,CAAC;AA8CD,MAAM,UAAU,UAAU,CACxB,cAAwD,EACxD,OAA+C,EAC/C,OAAkB;IAElB,4CAA4C;IAC5C,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAA;IACrD,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAI/C,IAAI,YAAY,GAAwB,IAAI,CAAA;IAC5C,IAAI,WAAW,GAAiC,IAAI,CAAA;IAEpD,KAAK,UAAU,eAAe;QAC5B,IAAI,YAAY;YAAE,OAAO,YAAY,CAAA;QAErC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,WAAW,GAAG,CAAC,KAAK,IAAI,EAAE;gBACxB,MAAM,gBAAgB,GAAG,OAAO;oBAC9B,CAAC,CAAC,MAAM,sBAAsB,CAAC,aAAa,EAAE,cAAc,EAAE,OAAO,CAAC;oBACtE,CAAC,CAAC,MAAM,sBAAsB,CAAC,aAAa,EAAE,cAAc,CAAC,CAAA;gBAC/D,YAAY,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAA;gBAC3C,OAAO,YAAY,CAAA;YACrB,CAAC,CAAC,EAAE,CAAA;QACN,CAAC;QAED,OAAO,WAAW,CAAA;IACpB,CAAC;IAED,2DAA2D;IAC3D,OAAO,IAAI,KAAK,CAAC,EAAkB,EAAE;QACnC,GAAG,CAAC,CAAC,EAAE,IAAI;YACT,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACpB,oCAAoC;gBACpC,OAAO,SAAS,CAAA;YAClB,CAAC;YAED,iCAAiC;YACjC,MAAM,WAAW,GAAG,KAAK,EAAE,GAAG,IAAe,EAAE,EAAE;gBAC/C,MAAM,QAAQ,GAAG,MAAM,eAAe,EAAE,CAAA;gBACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAA6B,CAAC,CAAA;gBACrD,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;oBAChC,OAAQ,KAAyC,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;gBACzE,CAAC;gBACD,OAAO,KAAK,CAAA;YACd,CAAC,CAAA;YAED,4EAA4E;YAC5E,OAAO,IAAI,KAAK,CAAC,WAAW,EAAE;gBAC5B,GAAG,CAAC,MAAM,EAAE,OAAO;oBACjB,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;wBACvB,qCAAqC;wBACrC,OAAO,SAAS,CAAA;oBAClB,CAAC;oBACD,4DAA4D;oBAC5D,OAAO,KAAK,EAAE,GAAG,IAAe,EAAE,EAAE;wBAClC,MAAM,QAAQ,GAAG,MAAM,eAAe,EAAE,CAAA;wBACxC,MAAM,WAAW,GAAG,QAAQ,CAAC,IAA6B,CAAC,CAAA;wBAC3D,IAAI,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;4BACnD,MAAM,UAAU,GAAI,WAAuC,CAAC,OAAiB,CAAC,CAAA;4BAC9E,IAAI,OAAO,UAAU,KAAK,UAAU,EAAE,CAAC;gCACrC,OAAQ,UAA8C,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;4BACjF,CAAC;4BACD,OAAO,UAAU,CAAA;wBACnB,CAAC;wBACD,MAAM,IAAI,KAAK,CACb,YAAY,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,6BAA6B,CACzE,CAAA;oBACH,CAAC,CAAA;gBACH,CAAC;aACF,CAAC,CAAA;QACJ,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,8BAA8B,GAAG,IAAI,GAAG,EAAU,CAAA;AAExD;;;;;;GAMG;AACH,SAAS,0BAA0B,CAAC,KAAa,EAAE,eAAwC;IACzF,IAAI,8BAA8B,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAM;IACrD,8BAA8B,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IAEzC,MAAM,IAAI,GAAG,aAAa,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;IACnF,MAAM,UAAU,GAAG,aAAa,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;IAE/F,OAAO,CAAC,IAAI,CACV,0CAA0C,KAAK,2CAA2C;QACxF,+BAA+B,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,KAAK;QACrF,sBAAsB,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,aAAa,KAAK;QACxF,6BAA6B,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,aAAa,KAAK;QAC3G,8FAA8F;QAC9F,uFAAuF;QACvF,qCAAqC,KAAK,IAAI,CACjD,CAAA;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,mBAAmB,CAC1B,KAAa,EACb,eAAwC;IAExC,MAAM,IAAI,GAAG,aAAa,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;IAEnF,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,OAAO,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;IAClF,CAAC;IAED,IAAI,KAAK,IAAI,eAAe,EAAE,CAAC;QAC7B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,CAAA;IACvD,CAAC;IACD,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAA;IAC5C,CAAC;IACD,MAAM,UAAU,GAAG,aAAa,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;IAC/F,IAAI,UAAU,IAAI,KAAK,IAAI,UAAU,EAAE,CAAC;QACtC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAAA;IAClD,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;AACzB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAmC,EACnC,aAAuB,EACvB,OAAgB;IAEhB,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IAE9D,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,qBAAqB,GAAG,eAA0C,CAAA;IACxE,MAAM,MAAM,GAA4B,EAAE,CAAA;IAE1C,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAA;QAClE,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAA;QAChC,CAAC;aAAM,CAAC;YACN,0BAA0B,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAA;QAC1D,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/server/schema-converter.d.ts

@@ -8,13 +8,13 @@ import type { ListConfig } from '@opensaas/stack-core';
  * Inferred from better-auth internal types
  */
 type BetterAuthFieldAttribute = {
-    type: string;
+    type: string | string[];
     required?: boolean;
     unique?: boolean;
     references?: {
         model: string;
         field: string;
-        onDelete?: 'cascade' | 'set null' | 'restrict';
+        onDelete?: 'no action' | 'restrict' | 'cascade' | 'set null' | 'set default';
     };
     defaultValue?: unknown;
     returned?: boolean;
@@ -24,7 +24,7 @@ type BetterAuthFieldAttribute = {
  * Better Auth table schema structure
  */
 type BetterAuthTableSchema = {
-    modelName: string;
+    modelName?: string;
     fields: Record<string, BetterAuthFieldAttribute>;
 };
 /**

package/dist/server/schema-converter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-converter.d.ts","sourceRoot":"","sources":["../../src/server/schema-converter.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAe,MAAM,sBAAsB,CAAA;AAEnE;;;GAGG;AACH,KAAK,wBAAwB,GAAG;IAC9B,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,UAAU,CAAC,EAAE;QACX,KAAK,EAAE,MAAM,CAAA;QACb,KAAK,EAAE,MAAM,CAAA;QACb,QAAQ,CAAC,EAAE,SAAS,GAAG,UAAU,GAAG,UAAU,CAAA;KAC/C,CAAA;IACD,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB,CAAA;AAED;;GAEG;AACH,KAAK,qBAAqB,GAAG;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAA;CACjD,CAAA;AA2DD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,qBAAqB,GAEjC,UAAU,CAAC,GAAG,CAAC,CA4BjB;AAED;;;GAGG;AACH,KAAK,gBAAgB,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,cAAc,CAAA;AAEvE;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAA;AA0BzE;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,EAC7C,aAAa,GAAE,iBAAsB,GAEpC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAejC"}
+{"version":3,"file":"schema-converter.d.ts","sourceRoot":"","sources":["../../src/server/schema-converter.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAe,MAAM,sBAAsB,CAAA;AAEnE;;;GAGG;AACH,KAAK,wBAAwB,GAAG;IAC9B,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,UAAU,CAAC,EAAE;QACX,KAAK,EAAE,MAAM,CAAA;QACb,KAAK,EAAE,MAAM,CAAA;QACb,QAAQ,CAAC,EAAE,WAAW,GAAG,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,aAAa,CAAA;KAC7E,CAAA;IACD,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB,CAAA;AAED;;GAEG;AACH,KAAK,qBAAqB,GAAG;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAA;CACjD,CAAA;AA2DD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,qBAAqB,GAEjC,UAAU,CAAC,GAAG,CAAC,CA4BjB;AAED;;;GAGG;AACH,KAAK,gBAAgB,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,cAAc,CAAA;AAEvE;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAA;AA0BzE;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,EAC7C,aAAa,GAAE,iBAAsB,GAEpC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAejC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opensaas/stack-auth",
-  "version": "0.36.0",
+  "version": "0.38.0",
   "description": "Better-auth integration for OpenSaas Stack",
   "type": "module",
   "main": "./dist/index.js",
@@ -60,13 +60,13 @@
     "@typescript/native": "npm:typescript@^7.0.2",
     "@vitest/coverage-v8": "^4.1.10",
     "@vitest/ui": "^4.1.10",
-    "better-auth": "^1.5.5",
+    "better-auth": "^1.6.25",
     "next": "^16.2.10",
-    "react": "^19.2.4",
+    "react": "^19.2.8",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
     "vitest": "^4.1.10",
-    "@opensaas/stack-cli": "0.36.0",
-    "@opensaas/stack-core": "0.36.0"
+    "@opensaas/stack-cli": "0.38.0",
+    "@opensaas/stack-core": "0.38.0"
   },
   "scripts": {
     "build": "tsc",

package/src/config/adopt-better-auth-tables.ts

@@ -28,6 +28,22 @@
  * auth migration. The recipe never touches the application's own domain `User`:
  * its model names are `Auth`-prefixed by default and the plugin only ever
  * adds/extends its *derived* keys.
+ *
+ * The single most common adoption shape is a project that ran better-auth
+ * *before* adding Stack: its live tables are still better-auth's own default
+ * lowercase names (`user`/`session`/`account`/`verification`), even though the
+ * derived list keys need the `Auth` prefix to avoid colliding with the app's
+ * own domain `User`. Pass `useBetterAuthTableNames: true` to point every
+ * model's physical table at that default while keeping the prefixed list keys
+ * (or `tableNames` for an explicit per-model override):
+ *
+ * ```typescript
+ * authPlugin({
+ *   ...adoptBetterAuthTables({ useBetterAuthTableNames: true }),
+ *   // AuthUser/AuthSession/AuthAccount/AuthVerification list keys,
+ *   // @@map("user")/@@map("session")/@@map("account")/@@map("verification")
+ * })
+ * ```
  */
 
 import type { AuthConfig, AuthModelConfig } from './types.js'
@@ -89,6 +105,39 @@ export type AdoptBetterAuthTablesOptions = {
     account?: Record<string, string>
     verification?: Record<string, string>
   }
+
+  /**
+   * Set every model's physical table name to better-auth's own default
+   * lowercase table name (`user`, `session`, `account`, `verification`) —
+   * independent of the prefixed list key/`modelName`.
+   *
+   * This is the single most common adoption shape: a project that ran
+   * better-auth before adding the stack has exactly these tables, and the
+   * default `modelNamePrefix: 'Auth'` alone would otherwise pin the table
+   * name to the prefixed model name (`AuthUser`, ...), which `prisma migrate
+   * diff` reads as a rename against the live `user` table.
+   *
+   * Ignored for a model with an explicit entry in {@link tableNames}.
+   *
+   * @default false
+   */
+  useBetterAuthTableNames?: boolean
+
+  /**
+   * Per-model explicit table name overrides, keyed by model. Takes
+   * precedence over `useBetterAuthTableNames` for that model.
+   *
+   * @example
+   * ```typescript
+   * adoptBetterAuthTables({ tableNames: { user: 'users' } })
+   * ```
+   */
+  tableNames?: {
+    user?: string
+    session?: string
+    account?: string
+    verification?: string
+  }
 }
 
 /** The four better-auth models and their default (unprefixed) model names. */
@@ -99,6 +148,14 @@ const MODEL_DEFAULT_NAMES = {
   verification: 'Verification',
 } as const
 
+/** better-auth's own default lowercase table names, per model. */
+const BETTER_AUTH_DEFAULT_TABLE_NAMES = {
+  user: 'user',
+  session: 'session',
+  account: 'account',
+  verification: 'verification',
+} as const
+
 /**
  * The adoption-relevant slice of {@link AuthConfig}: the plugin-level `schema`
  * and the per-model `modelName`/`fields`. Returned (not the full `AuthConfig`)
@@ -123,12 +180,24 @@ export type AdoptBetterAuthTablesConfig = Pick<
 export function adoptBetterAuthTables(
   options: AdoptBetterAuthTablesOptions = {},
 ): AdoptBetterAuthTablesConfig {
-  const { schema = 'auth', modelNamePrefix = 'Auth', fields = {} } = options
+  const {
+    schema = 'auth',
+    modelNamePrefix = 'Auth',
+    fields = {},
+    useBetterAuthTableNames = false,
+    tableNames = {},
+  } = options
 
   const buildModel = (model: keyof typeof MODEL_DEFAULT_NAMES): AuthModelConfig => {
     const config: AuthModelConfig = {
       modelName: `${modelNamePrefix}${MODEL_DEFAULT_NAMES[model]}`,
     }
+    const tableName =
+      tableNames[model] ??
+      (useBetterAuthTableNames ? BETTER_AUTH_DEFAULT_TABLE_NAMES[model] : undefined)
+    if (tableName !== undefined) {
+      config.tableName = tableName
+    }
     const fieldMap = fields[model]
     if (fieldMap && Object.keys(fieldMap).length > 0) {
       config.fields = fieldMap