@opensaas/stack-auth 0.39.2 → 0.41.0

package/dist/server/schema-converter.d.ts

@@ -1,81 +0,0 @@
-/**
- * Convert Better Auth database schema to OpenSaaS list configs
- * Allows dynamic list generation from Better Auth plugins
- */
-import type { ListConfig } from '@opensaas/stack-core';
-/**
- * Better Auth field attribute structure
- * Inferred from better-auth internal types
- */
-type BetterAuthFieldAttribute = {
-    type: string | string[];
-    required?: boolean;
-    unique?: boolean;
-    references?: {
-        model: string;
-        field: string;
-        onDelete?: 'no action' | 'restrict' | 'cascade' | 'set null' | 'set default';
-    };
-    defaultValue?: unknown;
-    returned?: boolean;
-    input?: boolean;
-    /**
-     * "If the field should be a bigint on the database instead of integer" —
-     * only meaningful alongside `type: 'number'`. Modelled here so the `number`
-     * branch below can read it; better-auth's rate limiter is the only shipped
-     * example (`lastRequest`, a millisecond epoch that overflows a 32-bit
-     * `Int`), but any plugin can declare it (issue #917).
-     */
-    bigint?: boolean;
-};
-/**
- * Better Auth table schema structure
- */
-type BetterAuthTableSchema = {
-    modelName?: string;
-    fields: Record<string, BetterAuthFieldAttribute>;
-};
-/**
- * Convert Better Auth table schema to OpenSaaS ListConfig.
- *
- * Per ADR-0013, plugin-injected lists ship **closed** — no access is set here,
- * so the list denies every operation until the application grants it. For a
- * table that resolves onto one of the four base auth models (user/session/
- * account/verification), that means `authPlugin({ access: { ... } })`; for any
- * other better-auth-plugin-declared table (e.g. OAuth client tables from the
- * `mcp` plugin), the application must declare the list itself under the same
- * derived key so the plugin's field-only extend path can merge in (its access
- * then stands untouched).
- */
-export declare function convertTableToList(tableName: string, tableSchema: BetterAuthTableSchema): ListConfig<any>;
-/**
- * Base better-auth model keys — the tables the auth plugin's own model config
- * (`user`/`session`/`account`/`verification`, plus `rateLimit` when
- * `rateLimit.storage: 'database'` derives it) can remap via `modelName`.
- */
-type BaseAuthModelKey = 'user' | 'session' | 'account' | 'verification' | 'rateLimit';
-/**
- * Resolved list key for each base better-auth model, as derived by
- * {@link deriveAuthLists} from the plugin's configured model-key remap (e.g.
- * `user.modelName: 'AuthUser'`). Passed to {@link convertBetterAuthSchema} so a
- * provider plugin's schema extension of a base model (e.g. `user`) lands on the
- * same adopted Auth list rather than being re-derived from the plugin's own
- * table name.
- */
-export type BaseAuthModelKeys = Partial<Record<BaseAuthModelKey, string>>;
-/**
- * Convert all Better Auth tables to OpenSaaS list configs
- * This is called by authPlugin() to generate lists from Better Auth + plugins
- *
- * @param tables - The better-auth plugin's declared schema extension
- * @param baseModelKeys - The resolved list keys for the four base auth models
- *   (`user`/`session`/`account`/`verification`), from the same model-key remap
- *   the Auth lists themselves use. When a table name matches one of these keys
- *   (case-insensitively), its list key is taken from here instead of being
- *   re-derived from the table name — so a schema extension targeting `user`
- *   lands on the adopted Auth list (e.g. `AuthUser`) rather than a re-derived
- *   `User`, even when that key collides with an unrelated host list.
- */
-export declare function convertBetterAuthSchema(tables: Record<string, BetterAuthTableSchema>, baseModelKeys?: BaseAuthModelKeys): Record<string, ListConfig<any>>;
-export {};
-//# sourceMappingURL=schema-converter.d.ts.map

package/dist/server/schema-converter.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"schema-converter.d.ts","sourceRoot":"","sources":["../../src/server/schema-converter.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAe,MAAM,sBAAsB,CAAA;AAEnE;;;GAGG;AACH,KAAK,wBAAwB,GAAG;IAC9B,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,UAAU,CAAC,EAAE;QACX,KAAK,EAAE,MAAM,CAAA;QACb,KAAK,EAAE,MAAM,CAAA;QACb,QAAQ,CAAC,EAAE,WAAW,GAAG,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,aAAa,CAAA;KAC7E,CAAA;IACD,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB,CAAA;AAED;;GAEG;AACH,KAAK,qBAAqB,GAAG;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAA;CACjD,CAAA;AAqED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,qBAAqB,GAEjC,UAAU,CAAC,GAAG,CAAC,CA4BjB;AAED;;;;GAIG;AACH,KAAK,gBAAgB,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,cAAc,GAAG,WAAW,CAAA;AAErF;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAA;AA4BzE;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,EAC7C,aAAa,GAAE,iBAAsB,GAEpC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAejC"}

package/dist/server/schema-converter.js

@@ -1,157 +0,0 @@
-/**
- * Convert Better Auth database schema to OpenSaaS list configs
- * Allows dynamic list generation from Better Auth plugins
- */
-import { list } from '@opensaas/stack-core';
-import { text, timestamp, checkbox, integer, bigInt } from '@opensaas/stack-core/fields';
-/**
- * Convert Better Auth field type to OpenSaaS field config
- */
-function convertField(fieldName, betterAuthField) {
-    const { type, required, unique, defaultValue, references, bigint } = betterAuthField;
-    // System fields are auto-generated by OpenSaaS
-    if (fieldName === 'id' || fieldName === 'createdAt' || fieldName === 'updatedAt') {
-        return null;
-    }
-    // Handle references (relationships)
-    if (references) {
-        // Relationships are handled separately
-        // Return null here and handle in relationship pass
-        return null;
-    }
-    // Map Better Auth types to OpenSaaS field types
-    switch (type) {
-        case 'string':
-            return text({
-                validation: { isRequired: required },
-                isIndexed: unique ? 'unique' : undefined,
-                defaultValue: typeof defaultValue === 'string' ? defaultValue : undefined,
-            });
-        case 'number':
-            // A millisecond epoch (e.g. Date.now()) overflows a 32-bit Int, so a
-            // field declaring `bigint: true` must generate a BigInt column instead
-            // (issue #917) — matching what deriveAuthLists produces for the same
-            // upstream declaration (e.g. the rate limiter's `lastRequest`).
-            if (bigint) {
-                return bigInt({
-                    validation: { isRequired: required },
-                    defaultValue: typeof defaultValue === 'number' ? defaultValue : undefined,
-                });
-            }
-            return integer({
-                validation: { isRequired: required },
-                defaultValue: typeof defaultValue === 'number' ? defaultValue : undefined,
-            });
-        case 'boolean':
-            return checkbox({
-                defaultValue: typeof defaultValue === 'boolean' ? defaultValue : false,
-            });
-        case 'date':
-            return timestamp({
-                defaultValue: defaultValue === 'now' ? { kind: 'now' } : undefined,
-            });
-        default:
-            // Unknown type - default to text
-            console.warn(`[stack-auth] Unknown Better Auth field type "${type}" for field "${fieldName}", defaulting to text field`);
-            return text({
-                validation: { isRequired: required },
-            });
-    }
-}
-/**
- * Convert Better Auth table schema to OpenSaaS ListConfig.
- *
- * Per ADR-0013, plugin-injected lists ship **closed** — no access is set here,
- * so the list denies every operation until the application grants it. For a
- * table that resolves onto one of the four base auth models (user/session/
- * account/verification), that means `authPlugin({ access: { ... } })`; for any
- * other better-auth-plugin-declared table (e.g. OAuth client tables from the
- * `mcp` plugin), the application must declare the list itself under the same
- * derived key so the plugin's field-only extend path can merge in (its access
- * then stands untouched).
- */
-export function convertTableToList(tableName, tableSchema) {
-    const fields = {};
-    // First pass: convert regular fields
-    for (const [fieldName, fieldAttr] of Object.entries(tableSchema.fields)) {
-        const fieldConfig = convertField(fieldName, fieldAttr);
-        if (fieldConfig) {
-            fields[fieldName] = fieldConfig;
-        }
-    }
-    // Second pass: add relationships
-    // NOTE: Better Auth uses one-way references, but OpenSaaS requires bidirectional relationships
-    // We skip relationship conversion for now and rely on the foreign key fields
-    // Users can manually add bidirectional relationships if needed by extending the User list
-    for (const [fieldName, fieldAttr] of Object.entries(tableSchema.fields)) {
-        if (fieldAttr.references) {
-            // For now, treat reference fields as regular text fields (foreign keys)
-            // This preserves the userId, clientId, etc. fields that Better Auth expects
-            if (!fields[fieldName]) {
-                fields[fieldName] = text({
-                    validation: { isRequired: fieldAttr.required },
-                });
-            }
-        }
-    }
-    return list({ fields });
-}
-/**
- * Look up the configured remap for a table name, if it names one of the four
- * base better-auth models (case-insensitively). Written as an explicit switch
- * rather than an indexed lookup so no type assertion is needed to narrow the
- * table name into {@link BaseAuthModelKey}.
- */
-function resolveBaseModelKey(tableName, baseModelKeys) {
-    switch (tableName.toLowerCase()) {
-        case 'user':
-            return baseModelKeys.user;
-        case 'session':
-            return baseModelKeys.session;
-        case 'account':
-            return baseModelKeys.account;
-        case 'verification':
-            return baseModelKeys.verification;
-        case 'ratelimit':
-            return baseModelKeys.rateLimit;
-        default:
-            return undefined;
-    }
-}
-/**
- * Convert all Better Auth tables to OpenSaaS list configs
- * This is called by authPlugin() to generate lists from Better Auth + plugins
- *
- * @param tables - The better-auth plugin's declared schema extension
- * @param baseModelKeys - The resolved list keys for the four base auth models
- *   (`user`/`session`/`account`/`verification`), from the same model-key remap
- *   the Auth lists themselves use. When a table name matches one of these keys
- *   (case-insensitively), its list key is taken from here instead of being
- *   re-derived from the table name — so a schema extension targeting `user`
- *   lands on the adopted Auth list (e.g. `AuthUser`) rather than a re-derived
- *   `User`, even when that key collides with an unrelated host list.
- */
-export function convertBetterAuthSchema(tables, baseModelKeys = {}) {
-    const lists = {}; // eslint-disable-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
-    for (const [tableName, tableSchema] of Object.entries(tables)) {
-        // A base-model remap always wins: it reflects the actual configured list
-        // key for that model, whereas `tableSchema.modelName`/the table name are
-        // just how the provider plugin happens to describe its own extension.
-        const listKey = resolveBaseModelKey(tableName, baseModelKeys) ||
-            tableSchema.modelName ||
-            toPascalCase(tableName);
-        lists[listKey] = convertTableToList(tableName, tableSchema);
-    }
-    return lists;
-}
-/**
- * Convert table name to PascalCase
- * e.g., "oauth_application" -> "OauthApplication"
- */
-function toPascalCase(str) {
-    return str
-        .split(/[_-]/)
-        .map((word) => word.charAt(0).toUpperCase() + word.slice(1).toLowerCase())
-        .join('');
-}
-//# sourceMappingURL=schema-converter.js.map

package/dist/server/schema-converter.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"schema-converter.js","sourceRoot":"","sources":["../../src/server/schema-converter.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAA;AAC3C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAA;AAqCxF;;GAEG;AACH,SAAS,YAAY,CACnB,SAAiB,EACjB,eAAyC;IAEzC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,eAAe,CAAA;IAEpF,+CAA+C;IAC/C,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,WAAW,IAAI,SAAS,KAAK,WAAW,EAAE,CAAC;QACjF,OAAO,IAAI,CAAA;IACb,CAAC;IAED,oCAAoC;IACpC,IAAI,UAAU,EAAE,CAAC;QACf,uCAAuC;QACvC,mDAAmD;QACnD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,gDAAgD;IAChD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC;gBACV,UAAU,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE;gBACpC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;gBACxC,YAAY,EAAE,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;aAC1E,CAAC,CAAA;QAEJ,KAAK,QAAQ;YACX,qEAAqE;YACrE,uEAAuE;YACvE,qEAAqE;YACrE,gEAAgE;YAChE,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,MAAM,CAAC;oBACZ,UAAU,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE;oBACpC,YAAY,EAAE,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;iBAC1E,CAAC,CAAA;YACJ,CAAC;YACD,OAAO,OAAO,CAAC;gBACb,UAAU,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE;gBACpC,YAAY,EAAE,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;aAC1E,CAAC,CAAA;QAEJ,KAAK,SAAS;YACZ,OAAO,QAAQ,CAAC;gBACd,YAAY,EAAE,OAAO,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK;aACvE,CAAC,CAAA;QAEJ,KAAK,MAAM;YACT,OAAO,SAAS,CAAC;gBACf,YAAY,EAAE,YAAY,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS;aACnE,CAAC,CAAA;QAEJ;YACE,iCAAiC;YACjC,OAAO,CAAC,IAAI,CACV,gDAAgD,IAAI,gBAAgB,SAAS,6BAA6B,CAC3G,CAAA;YACD,OAAO,IAAI,CAAC;gBACV,UAAU,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE;aACrC,CAAC,CAAA;IACN,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAChC,SAAiB,EACjB,WAAkC;IAGlC,MAAM,MAAM,GAAgC,EAAE,CAAA;IAE9C,qCAAqC;IACrC,KAAK,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QACxE,MAAM,WAAW,GAAG,YAAY,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;QACtD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,CAAC,SAAS,CAAC,GAAG,WAAW,CAAA;QACjC,CAAC;IACH,CAAC;IAED,iCAAiC;IACjC,+FAA+F;IAC/F,6EAA6E;IAC7E,0FAA0F;IAC1F,KAAK,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QACxE,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;YACzB,wEAAwE;YACxE,4EAA4E;YAC5E,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvB,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;oBACvB,UAAU,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,QAAQ,EAAE;iBAC/C,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;AACzB,CAAC;AAmBD;;;;;GAKG;AACH,SAAS,mBAAmB,CAC1B,SAAiB,EACjB,aAAgC;IAEhC,QAAQ,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;QAChC,KAAK,MAAM;YACT,OAAO,aAAa,CAAC,IAAI,CAAA;QAC3B,KAAK,SAAS;YACZ,OAAO,aAAa,CAAC,OAAO,CAAA;QAC9B,KAAK,SAAS;YACZ,OAAO,aAAa,CAAC,OAAO,CAAA;QAC9B,KAAK,cAAc;YACjB,OAAO,aAAa,CAAC,YAAY,CAAA;QACnC,KAAK,WAAW;YACd,OAAO,aAAa,CAAC,SAAS,CAAA;QAChC;YACE,OAAO,SAAS,CAAA;IACpB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAA6C,EAC7C,aAAa,GAAsB,EAAE;IAGrC,MAAM,KAAK,GAAoC,EAAE,CAAA,CAAC,gGAAgG;IAElJ,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9D,yEAAyE;QACzE,yEAAyE;QACzE,sEAAsE;QACtE,MAAM,OAAO,GACX,mBAAmB,CAAC,SAAS,EAAE,aAAa,CAAC;YAC7C,WAAW,CAAC,SAAS;YACrB,YAAY,CAAC,SAAS,CAAC,CAAA;QACzB,KAAK,CAAC,OAAO,CAAC,GAAG,kBAAkB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IAC7D,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,GAAG;SACP,KAAK,CAAC,MAAM,CAAC;SACb,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;SACzE,IAAI,CAAC,EAAE,CAAC,CAAA;AACb,CAAC"}

package/src/server/schema-converter.ts

@@ -1,243 +0,0 @@
-/**
- * Convert Better Auth database schema to OpenSaaS list configs
- * Allows dynamic list generation from Better Auth plugins
- */
-
-import { list } from '@opensaas/stack-core'
-import { text, timestamp, checkbox, integer, bigInt } from '@opensaas/stack-core/fields'
-import type { ListConfig, FieldConfig } from '@opensaas/stack-core'
-
-/**
- * Better Auth field attribute structure
- * Inferred from better-auth internal types
- */
-type BetterAuthFieldAttribute = {
-  type: string | string[] // 'string' | 'number' | 'boolean' | 'date' | etc., or an enum array
-  required?: boolean
-  unique?: boolean
-  references?: {
-    model: string
-    field: string
-    onDelete?: 'no action' | 'restrict' | 'cascade' | 'set null' | 'set default'
-  }
-  defaultValue?: unknown
-  returned?: boolean
-  input?: boolean
-  /**
-   * "If the field should be a bigint on the database instead of integer" —
-   * only meaningful alongside `type: 'number'`. Modelled here so the `number`
-   * branch below can read it; better-auth's rate limiter is the only shipped
-   * example (`lastRequest`, a millisecond epoch that overflows a 32-bit
-   * `Int`), but any plugin can declare it (issue #917).
-   */
-  bigint?: boolean
-}
-
-/**
- * Better Auth table schema structure
- */
-type BetterAuthTableSchema = {
-  modelName?: string
-  fields: Record<string, BetterAuthFieldAttribute>
-}
-
-/**
- * Convert Better Auth field type to OpenSaaS field config
- */
-function convertField(
-  fieldName: string,
-  betterAuthField: BetterAuthFieldAttribute,
-): FieldConfig | null {
-  const { type, required, unique, defaultValue, references, bigint } = betterAuthField
-
-  // System fields are auto-generated by OpenSaaS
-  if (fieldName === 'id' || fieldName === 'createdAt' || fieldName === 'updatedAt') {
-    return null
-  }
-
-  // Handle references (relationships)
-  if (references) {
-    // Relationships are handled separately
-    // Return null here and handle in relationship pass
-    return null
-  }
-
-  // Map Better Auth types to OpenSaaS field types
-  switch (type) {
-    case 'string':
-      return text({
-        validation: { isRequired: required },
-        isIndexed: unique ? 'unique' : undefined,
-        defaultValue: typeof defaultValue === 'string' ? defaultValue : undefined,
-      })
-
-    case 'number':
-      // A millisecond epoch (e.g. Date.now()) overflows a 32-bit Int, so a
-      // field declaring `bigint: true` must generate a BigInt column instead
-      // (issue #917) — matching what deriveAuthLists produces for the same
-      // upstream declaration (e.g. the rate limiter's `lastRequest`).
-      if (bigint) {
-        return bigInt({
-          validation: { isRequired: required },
-          defaultValue: typeof defaultValue === 'number' ? defaultValue : undefined,
-        })
-      }
-      return integer({
-        validation: { isRequired: required },
-        defaultValue: typeof defaultValue === 'number' ? defaultValue : undefined,
-      })
-
-    case 'boolean':
-      return checkbox({
-        defaultValue: typeof defaultValue === 'boolean' ? defaultValue : false,
-      })
-
-    case 'date':
-      return timestamp({
-        defaultValue: defaultValue === 'now' ? { kind: 'now' } : undefined,
-      })
-
-    default:
-      // Unknown type - default to text
-      console.warn(
-        `[stack-auth] Unknown Better Auth field type "${type}" for field "${fieldName}", defaulting to text field`,
-      )
-      return text({
-        validation: { isRequired: required },
-      })
-  }
-}
-
-/**
- * Convert Better Auth table schema to OpenSaaS ListConfig.
- *
- * Per ADR-0013, plugin-injected lists ship **closed** — no access is set here,
- * so the list denies every operation until the application grants it. For a
- * table that resolves onto one of the four base auth models (user/session/
- * account/verification), that means `authPlugin({ access: { ... } })`; for any
- * other better-auth-plugin-declared table (e.g. OAuth client tables from the
- * `mcp` plugin), the application must declare the list itself under the same
- * derived key so the plugin's field-only extend path can merge in (its access
- * then stands untouched).
- */
-export function convertTableToList(
-  tableName: string,
-  tableSchema: BetterAuthTableSchema,
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
-): ListConfig<any> {
-  const fields: Record<string, FieldConfig> = {}
-
-  // First pass: convert regular fields
-  for (const [fieldName, fieldAttr] of Object.entries(tableSchema.fields)) {
-    const fieldConfig = convertField(fieldName, fieldAttr)
-    if (fieldConfig) {
-      fields[fieldName] = fieldConfig
-    }
-  }
-
-  // Second pass: add relationships
-  // NOTE: Better Auth uses one-way references, but OpenSaaS requires bidirectional relationships
-  // We skip relationship conversion for now and rely on the foreign key fields
-  // Users can manually add bidirectional relationships if needed by extending the User list
-  for (const [fieldName, fieldAttr] of Object.entries(tableSchema.fields)) {
-    if (fieldAttr.references) {
-      // For now, treat reference fields as regular text fields (foreign keys)
-      // This preserves the userId, clientId, etc. fields that Better Auth expects
-      if (!fields[fieldName]) {
-        fields[fieldName] = text({
-          validation: { isRequired: fieldAttr.required },
-        })
-      }
-    }
-  }
-
-  return list({ fields })
-}
-
-/**
- * Base better-auth model keys — the tables the auth plugin's own model config
- * (`user`/`session`/`account`/`verification`, plus `rateLimit` when
- * `rateLimit.storage: 'database'` derives it) can remap via `modelName`.
- */
-type BaseAuthModelKey = 'user' | 'session' | 'account' | 'verification' | 'rateLimit'
-
-/**
- * Resolved list key for each base better-auth model, as derived by
- * {@link deriveAuthLists} from the plugin's configured model-key remap (e.g.
- * `user.modelName: 'AuthUser'`). Passed to {@link convertBetterAuthSchema} so a
- * provider plugin's schema extension of a base model (e.g. `user`) lands on the
- * same adopted Auth list rather than being re-derived from the plugin's own
- * table name.
- */
-export type BaseAuthModelKeys = Partial<Record<BaseAuthModelKey, string>>
-
-/**
- * Look up the configured remap for a table name, if it names one of the four
- * base better-auth models (case-insensitively). Written as an explicit switch
- * rather than an indexed lookup so no type assertion is needed to narrow the
- * table name into {@link BaseAuthModelKey}.
- */
-function resolveBaseModelKey(
-  tableName: string,
-  baseModelKeys: BaseAuthModelKeys,
-): string | undefined {
-  switch (tableName.toLowerCase()) {
-    case 'user':
-      return baseModelKeys.user
-    case 'session':
-      return baseModelKeys.session
-    case 'account':
-      return baseModelKeys.account
-    case 'verification':
-      return baseModelKeys.verification
-    case 'ratelimit':
-      return baseModelKeys.rateLimit
-    default:
-      return undefined
-  }
-}
-
-/**
- * Convert all Better Auth tables to OpenSaaS list configs
- * This is called by authPlugin() to generate lists from Better Auth + plugins
- *
- * @param tables - The better-auth plugin's declared schema extension
- * @param baseModelKeys - The resolved list keys for the four base auth models
- *   (`user`/`session`/`account`/`verification`), from the same model-key remap
- *   the Auth lists themselves use. When a table name matches one of these keys
- *   (case-insensitively), its list key is taken from here instead of being
- *   re-derived from the table name — so a schema extension targeting `user`
- *   lands on the adopted Auth list (e.g. `AuthUser`) rather than a re-derived
- *   `User`, even when that key collides with an unrelated host list.
- */
-export function convertBetterAuthSchema(
-  tables: Record<string, BetterAuthTableSchema>,
-  baseModelKeys: BaseAuthModelKeys = {},
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
-): Record<string, ListConfig<any>> {
-  const lists: Record<string, ListConfig<any>> = {} // eslint-disable-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
-
-  for (const [tableName, tableSchema] of Object.entries(tables)) {
-    // A base-model remap always wins: it reflects the actual configured list
-    // key for that model, whereas `tableSchema.modelName`/the table name are
-    // just how the provider plugin happens to describe its own extension.
-    const listKey =
-      resolveBaseModelKey(tableName, baseModelKeys) ||
-      tableSchema.modelName ||
-      toPascalCase(tableName)
-    lists[listKey] = convertTableToList(tableName, tableSchema)
-  }
-
-  return lists
-}
-
-/**
- * Convert table name to PascalCase
- * e.g., "oauth_application" -> "OauthApplication"
- */
-function toPascalCase(str: string): string {
-  return str
-    .split(/[_-]/)
-    .map((word) => word.charAt(0).toUpperCase() + word.slice(1).toLowerCase())
-    .join('')
-}