@tatara/cli 0.0.0-stage → 0.1.1

package/templates/features/base/files/tsconfig.json

@@ -0,0 +1,20 @@
+{
+	"compilerOptions": {
+		"target": "es2024",
+		"lib": ["es2024"],
+		"module": "nodenext",
+		"moduleResolution": "nodenext",
+		"strict": true,
+		"noUncheckedIndexedAccess": true,
+		"noImplicitOverride": true,
+		"noFallthroughCasesInSwitch": true,
+		"erasableSyntaxOnly": true,
+		"verbatimModuleSyntax": true,
+		"allowImportingTsExtensions": true,
+		"noEmit": true,
+		"skipLibCheck": true,
+		"resolveJsonModule": true,
+		"types": ["node"]
+	},
+	"include": ["src", "tests", "*.config.ts"]
+}

package/templates/features/base/files/tsdown.config.ts

@@ -0,0 +1,15 @@
+import { defineConfig } from "tsdown";
+
+export default defineConfig({
+	entry: {
+		"apps/api/server": "src/apps/api/server.ts",
+		"apps/cli/index": "src/apps/cli/index.ts",
+		// tatara:slot entries
+	},
+	format: "esm",
+	platform: "node",
+	target: "node24",
+	outDir: "dist",
+	dts: false,
+	clean: true,
+});

package/templates/features/base/files/vitest.config.ts

@@ -0,0 +1,16 @@
+import { existsSync, readFileSync } from "node:fs";
+import { parseEnv } from "node:util";
+import { defineConfig } from "vitest/config";
+
+const env = existsSync(".env.test")
+	? (parseEnv(readFileSync(".env.test", "utf8")) as Record<string, string>)
+	: {};
+
+export default defineConfig({
+	test: {
+		include: ["src/**/*.test.ts", "tests/**/*.test.ts"],
+		env,
+		setupFiles: ["tests/setup.ts"],
+		// tatara:slot vitest
+	},
+});

package/templates/features/better-auth/files/src/core/auth/auth.ts

@@ -0,0 +1,26 @@
+import { betterAuth } from "better-auth";
+import { bearer, openAPI } from "better-auth/plugins";
+import { database } from "#core/auth/adapter";
+import { env } from "#core/config/env";
+import { newId } from "#core/db/id";
+// tatara:slot imports
+
+export const auth = betterAuth({
+	appName: "__APP_NAME__",
+	baseURL: env.APP_URL,
+	basePath: "/api/auth",
+	secret: env.BETTER_AUTH_SECRET,
+	trustedOrigins: env.CORS_ORIGINS,
+	database,
+	advanced: { database: { generateId: () => newId() } },
+	// tatara:slot options
+	plugins: [
+		// Authorization: Bearer <session token> for mobile and API clients
+		bearer(),
+		// reference for the auth endpoints at /api/auth/reference
+		openAPI(),
+		// tatara:slot plugins
+	],
+});
+
+export type Session = typeof auth.$Infer.Session;

package/templates/features/better-auth/files/src/core/auth/db/seed.ts

@@ -0,0 +1,24 @@
+import { auth } from "#core/auth/auth";
+import { env } from "#core/config/env";
+import { defineSeed } from "#core/db/seed";
+
+/** Development admin account (never created in production). */
+export default defineSeed({
+	name: "auth:dev-admin",
+	order: 0,
+	async run({ logger }) {
+		if (env.NODE_ENV !== "development" && env.NODE_ENV !== "test") return;
+		const ctx = await auth.$context;
+		const email = env.SEED_ADMIN_EMAIL;
+		const existing = await ctx.internalAdapter.findUserByEmail(email);
+		if (existing) return;
+		const user = await ctx.internalAdapter.createUser({
+			email,
+			name: "Dev admin",
+			emailVerified: true,
+			// tatara:slot seed-user-fields
+		}, { method: "admin" });
+		// tatara:slot seed-after-user
+		logger.info({ email, userId: user.id }, "created development admin");
+	},
+});

package/templates/features/better-auth/files/src/core/auth/delivery.ts

@@ -0,0 +1,48 @@
+import { smsSender } from "#core/auth/sms";
+import { env } from "#core/config/env";
+// tatara:slot imports
+
+export interface OutboxMessage {
+	channel: "email" | "sms";
+	to: string;
+	subject?: string;
+	text: string;
+	/** one-time code, when the message carries one */
+	code?: string;
+	sentAt: string;
+}
+
+const outbox: OutboxMessage[] = [];
+
+/** Only with DEV_OUTBOX=true in development or test: the outbox exposes sign-in codes. */
+export function outboxEnabled(): boolean {
+	return env.DEV_OUTBOX && (env.NODE_ENV === "development" || env.NODE_ENV === "test");
+}
+
+/** Messages are kept here so tests and local sign-in can read codes. */
+function record(message: Omit<OutboxMessage, "sentAt">) {
+	if (!outboxEnabled()) return;
+	outbox.push({ ...message, sentAt: new Date().toISOString() });
+	if (outbox.length > 200) outbox.shift();
+}
+
+/** Newest first. Empty unless the outbox is enabled. */
+export function readOutbox(to?: string): OutboxMessage[] {
+	if (!outboxEnabled()) return [];
+	return outbox.filter((m) => !to || m.to === to).reverse();
+}
+
+export async function deliverEmail(message: {
+	to: string;
+	subject: string;
+	text: string;
+	code?: string;
+}): Promise<void> {
+	record({ channel: "email", ...message });
+	// tatara:slot email-delivery
+}
+
+export async function deliverSms(message: { to: string; text: string; code?: string }): Promise<void> {
+	record({ channel: "sms", ...message });
+	await smsSender.send(message.to, message.text);
+}

package/templates/features/better-auth/files/src/core/auth/openapi.ts

@@ -0,0 +1,60 @@
+import type { OpenAPIHono } from "@hono/zod-openapi";
+import { auth } from "#core/auth/auth";
+
+type JsonObject = Record<string, unknown>;
+type OpenApiDocument = ReturnType<OpenAPIHono["getOpenAPI31Document"]>;
+type Paths = NonNullable<OpenApiDocument["paths"]>;
+type Components = NonNullable<OpenApiDocument["components"]>;
+
+interface AuthDocument {
+	paths?: Record<string, JsonObject>;
+	components?: { schemas?: JsonObject; securitySchemes?: JsonObject };
+}
+
+const SCHEMA_REF = "#/components/schemas/";
+
+// better-auth names schemas like the app (User, Member, …); prefix them so neither side is overwritten
+function renameRefs(value: unknown, rename: (name: string) => string): AuthDocument {
+	return JSON.parse(
+		JSON.stringify(value).replaceAll(
+			new RegExp(`"\\$ref":"${SCHEMA_REF}([^"]+)"`, "g"),
+			(_match, name: string) => `"$ref":"${SCHEMA_REF}${rename(name)}"`,
+		),
+	) as AuthDocument;
+}
+
+function retag(paths: Record<string, JsonObject>, tag: string): Record<string, JsonObject> {
+	for (const operations of Object.values(paths)) {
+		for (const operation of Object.values(operations as Record<string, JsonObject>)) {
+			if (operation && typeof operation === "object") operation.tags = [tag];
+		}
+	}
+	return paths;
+}
+
+/** Adds better-auth's endpoints (served under `basePath`) to the app's OpenAPI document. */
+export async function mergeAuthOpenApi(document: OpenApiDocument, basePath: string): Promise<void> {
+	const authDoc = renameRefs(await auth.api.generateOpenAPISchema(), (name) => `Auth${name}`);
+
+	document.paths ??= {};
+	for (const [path, operations] of Object.entries(retag(authDoc.paths ?? {}, "Auth"))) {
+		document.paths[`${basePath}${path}`] = operations as Paths[string];
+	}
+
+	document.components ??= {};
+	document.components.schemas ??= {};
+	for (const [name, schema] of Object.entries(authDoc.components?.schemas ?? {})) {
+		document.components.schemas[`Auth${name}`] = schema as NonNullable<
+			Components["schemas"]
+		>[string];
+	}
+	document.components.securitySchemes = {
+		...(authDoc.components?.securitySchemes as Components["securitySchemes"]),
+		...document.components.securitySchemes,
+	};
+
+	document.tags = [
+		...(document.tags ?? []),
+		{ name: "Auth", description: "Sign-up, sign-in, sessions, organizations (better-auth)" },
+	];
+}

package/templates/features/better-auth/files/src/core/auth/principal.ts

@@ -0,0 +1,40 @@
+import { createMiddleware } from "hono/factory";
+import { auth } from "#core/auth/auth";
+import type { AppEnv } from "#core/http/context";
+
+/**
+ * The session's active organization, or null once the user stops being a member of it.
+ * better-auth leaves `activeOrganizationId` on the removed member's session.
+ */
+async function activeMembership(userId: string, orgId: string | null | undefined) {
+	if (!orgId) return null;
+	const { adapter } = await auth.$context;
+	const member = await adapter.findOne({
+		model: "member",
+		where: [
+			{ field: "organizationId", value: orgId },
+			{ field: "userId", value: userId },
+		],
+	});
+	return member ? orgId : null;
+}
+
+/** Resolves the session (cookie or bearer token) into `c.var.principal`. */
+export const attachPrincipal = createMiddleware<AppEnv>(async (c, next) => {
+	const session = await auth.api.getSession({ headers: c.req.raw.headers });
+	if (session) {
+		const user = session.user as typeof session.user & { role?: string | null };
+		const s = session.session as typeof session.session & { activeOrganizationId?: string | null };
+		c.set("principal", {
+			userId: user.id,
+			orgId: await activeMembership(user.id, s.activeOrganizationId),
+			roles: (user.role ?? "user")
+				.split(",")
+				.map((role) => role.trim())
+				.filter(Boolean),
+			kind: "user",
+			claims: {},
+		});
+	}
+	await next();
+});

package/templates/features/better-auth/files/src/core/auth/sms.ts

@@ -0,0 +1,14 @@
+import { logger } from "#core/logging/logger";
+
+/** Implement this for your SMS provider and return it from `smsSender`. */
+export interface SmsSender {
+	send(to: string, text: string): Promise<void>;
+}
+
+const consoleSender: SmsSender = {
+	async send(to) {
+		logger.info({ to }, "sms not sent: no SMS provider configured (see src/core/auth/sms.ts)");
+	},
+};
+
+export const smsSender: SmsSender = consoleSender;

package/templates/features/better-auth/files/src/core/auth/tests/openapi.test.ts

@@ -0,0 +1,45 @@
+import { describe, expect, it } from "vitest";
+import { api } from "#tests/helpers/api";
+
+interface Document {
+	paths: Record<string, Record<string, { tags?: string[] }>>;
+	components: { schemas: Record<string, unknown>; securitySchemes: Record<string, unknown> };
+}
+
+async function apiDocument(): Promise<Document> {
+	const res = await api.get<Document>("/openapi.json");
+	expect(res.status).toBe(200);
+	return res.body;
+}
+
+function refs(value: unknown): string[] {
+	return [...JSON.stringify(value).matchAll(/"\$ref":"#\/components\/schemas\/([^"]+)"/g)].map(
+		(match) => match[1] ?? "",
+	);
+}
+
+describe("OpenAPI document", () => {
+	it("documents better-auth endpoints next to the app's own", async () => {
+		const doc = await apiDocument();
+		expect(doc.paths["/api/auth/get-session"]?.get).toBeDefined();
+		expect(doc.paths["/api/me"]?.get).toBeDefined();
+	});
+
+	it("tags better-auth operations as Auth", async () => {
+		const doc = await apiDocument();
+		expect(doc.paths["/api/auth/get-session"]?.get?.tags).toEqual(["Auth"]);
+	});
+
+	it("prefixes better-auth schemas so app schemas keep their names", async () => {
+		const doc = await apiDocument();
+		expect(doc.components.schemas.AuthUser).toBeDefined();
+		expect(doc.components.schemas.Principal).toBeDefined();
+		expect(doc.components.securitySchemes.bearerAuth).toBeDefined();
+	});
+
+	it("resolves every schema reference", async () => {
+		const doc = await apiDocument();
+		const missing = refs(doc).filter((name) => !(name in doc.components.schemas));
+		expect(missing).toEqual([]);
+	});
+});

package/templates/features/better-auth/files/tests/helpers/auth.ts

@@ -0,0 +1,40 @@
+import { auth } from "#core/auth/auth";
+import { newId } from "#core/db/id";
+// tatara:slot imports
+
+export interface AsUserOptions {
+	email?: string;
+	name?: string;
+	/** user roles (admin plugin); ignored without organizations + roles */
+	roles?: string[];
+	// tatara:slot options
+}
+
+/** Creates a verified user and returns their id. */
+export async function createTestUser(options: AsUserOptions = {}): Promise<string> {
+	const ctx = await auth.$context;
+	const user = await ctx.internalAdapter.createUser({
+		email: options.email ?? `user-${newId()}@example.com`,
+		name: options.name ?? "Test User",
+		emailVerified: true,
+		// tatara:slot user-fields
+	}, { method: "admin" });
+	return user.id;
+}
+
+/** A new user with a real session; the token is sent as a bearer token. */
+export async function authenticate(
+	options: AsUserOptions = {},
+): Promise<{ userId: string; headers: Record<string, string> }> {
+	const userId = await createTestUser(options);
+	const ctx = await auth.$context;
+	const session = await ctx.internalAdapter.createSession(userId);
+	return { userId, headers: { authorization: `Bearer ${session.token}` } };
+}
+
+/** Headers that authenticate as a new user. */
+export async function asUser(options: AsUserOptions = {}): Promise<Record<string, string>> {
+	const user = await authenticate(options);
+	// tatara:slot as-user
+	return user.headers;
+}

package/templates/features/better-auth/files+admin/src/core/auth/tests/openapi-admin.test.ts

@@ -0,0 +1,8 @@
+import { expect, it } from "vitest";
+import { adminApi } from "#tests/helpers/api";
+
+it("leaves auth out of the admin OpenAPI document", async () => {
+	const res = await adminApi.get<{ paths: Record<string, unknown> }>("/openapi.json");
+	expect(res.status).toBe(200);
+	expect(Object.keys(res.body.paths).some((path) => path.startsWith("/api/auth/"))).toBe(false);
+});

package/templates/features/better-auth/files+auth-orgs/src/core/auth/tests/principal.test.ts

@@ -0,0 +1,44 @@
+import { beforeEach, describe, expect, it } from "vitest";
+import { auth } from "#core/auth/auth";
+import { api } from "#tests/helpers/api";
+import { authenticate } from "#tests/helpers/auth";
+import { resetDatabase } from "#tests/helpers/db";
+
+beforeEach(async () => {
+	await resetDatabase();
+});
+
+describe("principal", () => {
+	it("drops the active organization once the user is no longer a member", async () => {
+		const owner = await authenticate();
+		const member = await authenticate({ email: "member@example.com" });
+		const org = await api.post<{ id: string }>(
+			"/api/auth/organization/create",
+			{ name: "School", slug: "school" },
+			{ headers: owner.headers },
+		);
+		await auth.api.addMember({
+			body: { userId: member.userId, role: "member", organizationId: org.body.id },
+		});
+		await api.post(
+			"/api/auth/organization/set-active",
+			{ organizationId: org.body.id },
+			{ headers: member.headers },
+		);
+		const before = await api.get<{ data: { orgId: string | null } }>("/api/me", {
+			headers: member.headers,
+		});
+		expect(before.body.data.orgId).toBe(org.body.id);
+
+		const removed = await api.post(
+			"/api/auth/organization/remove-member",
+			{ memberIdOrEmail: "member@example.com", organizationId: org.body.id },
+			{ headers: owner.headers },
+		);
+		expect(removed.status).toBe(200);
+		const after = await api.get<{ data: { orgId: string | null } }>("/api/me", {
+			headers: member.headers,
+		});
+		expect(after.body.data.orgId).toBeNull();
+	});
+});

package/templates/features/better-auth/files+auth-orgs+authz/src/core/auth/tests/principal-authz.test.ts

@@ -0,0 +1,40 @@
+import { beforeEach, expect, it } from "vitest";
+import { auth } from "#core/auth/auth";
+import { api } from "#tests/helpers/api";
+import { authenticate } from "#tests/helpers/auth";
+import { applyTestAccess } from "#tests/helpers/authz";
+import { resetDatabase } from "#tests/helpers/db";
+
+beforeEach(async () => {
+	await resetDatabase();
+});
+
+it("does not restore old org roles when a removed member is added back", async () => {
+	const owner = await authenticate();
+	const member = await authenticate({ email: "member@example.com" });
+	const org = await api.post<{ id: string }>(
+		"/api/auth/organization/create",
+		{ name: "School", slug: "school" },
+		{ headers: owner.headers },
+	);
+	await auth.api.addMember({
+		body: { userId: member.userId, role: "member", organizationId: org.body.id },
+	});
+	await applyTestAccess(member.userId, { systemRoles: ["admin"], orgId: org.body.id });
+	await api.post(
+		"/api/auth/organization/remove-member",
+		{ memberIdOrEmail: "member@example.com", organizationId: org.body.id },
+		{ headers: owner.headers },
+	);
+
+	await auth.api.addMember({
+		body: { userId: member.userId, role: "member", organizationId: org.body.id },
+	});
+	await api.post(
+		"/api/auth/organization/set-active",
+		{ organizationId: org.body.id },
+		{ headers: member.headers },
+	);
+	const roles = await api.get("/api/authorization/roles", { headers: member.headers });
+	expect(roles.status).toBe(403);
+});

package/templates/features/better-auth/files+drizzle+mysql/src/core/auth/adapter.ts

@@ -0,0 +1,15 @@
+import { drizzleAdapter } from "better-auth/adapters/drizzle";
+import * as authSchema from "#core/auth/db/auth.schema";
+import { db } from "#core/db/client";
+// tatara:slot imports
+
+export const database = drizzleAdapter(db, {
+	provider: "mysql",
+	schema: {
+		user: authSchema.users,
+		session: authSchema.sessions,
+		account: authSchema.accounts,
+		verification: authSchema.verifications,
+		// tatara:slot adapter-schema
+	},
+});

package/templates/features/better-auth/files+drizzle+mysql/src/core/auth/db/auth.schema.ts

@@ -0,0 +1,57 @@
+import { boolean, mysqlTable, text, timestamp, varchar } from "drizzle-orm/mysql-core";
+
+const id = () => varchar({ length: 36 });
+const createdAt = () => timestamp({ fsp: 3, mode: "date" }).notNull().defaultNow();
+const updatedAt = () => timestamp({ fsp: 3, mode: "date" }).notNull().defaultNow();
+
+export const users = mysqlTable("users", {
+	id: id().primaryKey(),
+	name: varchar({ length: 255 }).notNull(),
+	email: varchar({ length: 255 }).notNull().unique(),
+	emailVerified: boolean().notNull().default(false),
+	image: text(),
+	// tatara:slot user-fields
+	createdAt: createdAt(),
+	updatedAt: updatedAt(),
+});
+
+export const sessions = mysqlTable("sessions", {
+	id: id().primaryKey(),
+	expiresAt: timestamp({ fsp: 3, mode: "date" }).notNull(),
+	token: varchar({ length: 255 }).notNull().unique(),
+	ipAddress: varchar({ length: 64 }),
+	userAgent: text(),
+	userId: id()
+		.notNull()
+		.references(() => users.id, { onDelete: "cascade" }),
+	// tatara:slot session-fields
+	createdAt: createdAt(),
+	updatedAt: updatedAt(),
+});
+
+export const accounts = mysqlTable("accounts", {
+	id: id().primaryKey(),
+	accountId: varchar({ length: 255 }).notNull(),
+	providerId: varchar({ length: 64 }).notNull(),
+	userId: id()
+		.notNull()
+		.references(() => users.id, { onDelete: "cascade" }),
+	accessToken: text(),
+	refreshToken: text(),
+	idToken: text(),
+	accessTokenExpiresAt: timestamp({ fsp: 3, mode: "date" }),
+	refreshTokenExpiresAt: timestamp({ fsp: 3, mode: "date" }),
+	scope: text(),
+	password: text(),
+	createdAt: createdAt(),
+	updatedAt: updatedAt(),
+});
+
+export const verifications = mysqlTable("verifications", {
+	id: id().primaryKey(),
+	identifier: varchar({ length: 255 }).notNull(),
+	value: text().notNull(),
+	expiresAt: timestamp({ fsp: 3, mode: "date" }).notNull(),
+	createdAt: createdAt(),
+	updatedAt: updatedAt(),
+});

package/templates/features/better-auth/files+drizzle+postgres/src/core/auth/adapter.ts

@@ -0,0 +1,15 @@
+import { drizzleAdapter } from "better-auth/adapters/drizzle";
+import * as authSchema from "#core/auth/db/auth.schema";
+import { db } from "#core/db/client";
+// tatara:slot imports
+
+export const database = drizzleAdapter(db, {
+	provider: "pg",
+	schema: {
+		user: authSchema.users,
+		session: authSchema.sessions,
+		account: authSchema.accounts,
+		verification: authSchema.verifications,
+		// tatara:slot adapter-schema
+	},
+});

package/templates/features/better-auth/files+drizzle+postgres/src/core/auth/db/auth.schema.ts

@@ -0,0 +1,56 @@
+import { boolean, pgTable, text, timestamp } from "drizzle-orm/pg-core";
+
+const createdAt = () => timestamp({ withTimezone: true, mode: "date" }).notNull().defaultNow();
+const updatedAt = () => timestamp({ withTimezone: true, mode: "date" }).notNull().defaultNow();
+
+export const users = pgTable("users", {
+	id: text().primaryKey(),
+	name: text().notNull(),
+	email: text().notNull().unique(),
+	emailVerified: boolean().notNull().default(false),
+	image: text(),
+	// tatara:slot user-fields
+	createdAt: createdAt(),
+	updatedAt: updatedAt(),
+});
+
+export const sessions = pgTable("sessions", {
+	id: text().primaryKey(),
+	expiresAt: timestamp({ withTimezone: true, mode: "date" }).notNull(),
+	token: text().notNull().unique(),
+	ipAddress: text(),
+	userAgent: text(),
+	userId: text()
+		.notNull()
+		.references(() => users.id, { onDelete: "cascade" }),
+	// tatara:slot session-fields
+	createdAt: createdAt(),
+	updatedAt: updatedAt(),
+});
+
+export const accounts = pgTable("accounts", {
+	id: text().primaryKey(),
+	accountId: text().notNull(),
+	providerId: text().notNull(),
+	userId: text()
+		.notNull()
+		.references(() => users.id, { onDelete: "cascade" }),
+	accessToken: text(),
+	refreshToken: text(),
+	idToken: text(),
+	accessTokenExpiresAt: timestamp({ withTimezone: true, mode: "date" }),
+	refreshTokenExpiresAt: timestamp({ withTimezone: true, mode: "date" }),
+	scope: text(),
+	password: text(),
+	createdAt: createdAt(),
+	updatedAt: updatedAt(),
+});
+
+export const verifications = pgTable("verifications", {
+	id: text().primaryKey(),
+	identifier: text().notNull(),
+	value: text().notNull(),
+	expiresAt: timestamp({ withTimezone: true, mode: "date" }).notNull(),
+	createdAt: createdAt(),
+	updatedAt: updatedAt(),
+});

package/templates/features/better-auth/files+prisma/prisma/models/auth.prisma

@@ -0,0 +1,62 @@
+// better-auth tables. Field names are what better-auth expects; columns are snake_case.
+
+model User {
+  id            String    @id @db.VarChar(36)
+  name          String    @db.VarChar(255)
+  email         String    @unique @db.VarChar(255)
+  emailVerified Boolean   @default(false) @map("email_verified")
+  image         String?   @db.Text
+  // tatara:slot user-fields
+  createdAt     DateTime  @default(now()) @map("created_at")
+  updatedAt     DateTime  @default(now()) @updatedAt @map("updated_at")
+  sessions      Session[]
+  accounts      Account[]
+  // tatara:slot user-relations
+
+  @@map("users")
+}
+
+model Session {
+  id        String   @id @db.VarChar(36)
+  expiresAt DateTime @map("expires_at")
+  token     String   @unique @db.VarChar(255)
+  ipAddress String?  @map("ip_address") @db.VarChar(64)
+  userAgent String?  @map("user_agent") @db.Text
+  userId    String   @map("user_id") @db.VarChar(36)
+  user      User     @relation(fields: [userId], references: [id], onDelete: Cascade)
+  // tatara:slot session-fields
+  createdAt DateTime @default(now()) @map("created_at")
+  updatedAt DateTime @default(now()) @updatedAt @map("updated_at")
+
+  @@map("sessions")
+}
+
+model Account {
+  id                    String    @id @db.VarChar(36)
+  accountId             String    @map("account_id") @db.VarChar(255)
+  providerId            String    @map("provider_id") @db.VarChar(64)
+  userId                String    @map("user_id") @db.VarChar(36)
+  user                  User      @relation(fields: [userId], references: [id], onDelete: Cascade)
+  accessToken           String?   @map("access_token") @db.Text
+  refreshToken          String?   @map("refresh_token") @db.Text
+  idToken               String?   @map("id_token") @db.Text
+  accessTokenExpiresAt  DateTime? @map("access_token_expires_at")
+  refreshTokenExpiresAt DateTime? @map("refresh_token_expires_at")
+  scope                 String?   @db.Text
+  password              String?   @db.Text
+  createdAt             DateTime  @default(now()) @map("created_at")
+  updatedAt             DateTime  @default(now()) @updatedAt @map("updated_at")
+
+  @@map("accounts")
+}
+
+model Verification {
+  id         String   @id @db.VarChar(36)
+  identifier String   @db.VarChar(255)
+  value      String   @db.Text
+  expiresAt  DateTime @map("expires_at")
+  createdAt  DateTime @default(now()) @map("created_at")
+  updatedAt  DateTime @default(now()) @updatedAt @map("updated_at")
+
+  @@map("verifications")
+}

package/templates/features/better-auth/files+prisma+mysql/src/core/auth/adapter.ts

@@ -0,0 +1,4 @@
+import { prismaAdapter } from "better-auth/adapters/prisma";
+import { db } from "#core/db/client";
+
+export const database = prismaAdapter(db, { provider: "mysql" });