@vexcms/better-auth 0.1.0-alpha.2 → 0.1.0-alpha.21

package/README.md

@@ -1,6 +1,6 @@
 # @vexcms/better-auth
 
-[Better Auth](https://www.better-auth.com/) adapter for [VEX CMS](https://github.com/ianyimi/vex). Automatically extracts Better Auth's authentication tables and converts them into VEX collection definitions, enabling admin panel management of auth data.
+[Better Auth](https://www.better-auth.com/) integration for [VEX CMS](https://github.com/ianyimi/vex). Converts Better Auth's user/session/account/verification tables — and any registered plugin's tables — into standard Vex collections, so auth data is manageable through the same admin panel as everything else.
 
 ## Installation
 
@@ -8,35 +8,115 @@
 pnpm add @vexcms/better-auth
 ```
 
+## Two entry points
+
+VexCMS configuration is split into a client-safe `vex.config.ts` and a server-only
+`vex.config.server.ts`, and this package mirrors that split:
+
+| Entry point | Where it's imported | What it does |
+|---|---|---|
+| `@vexcms/better-auth` (root) | `vex.config.server.ts`, Convex functions | `betterAuthAdapter()` — instantiates the live adapter from your real Better Auth options. Re-exports the Convex DB adapter, so it pulls in `convex/server`. **Never import this from client code.** |
+| `@vexcms/better-auth/client` | `vex.config.ts` | `betterAuthCollections()` — derives the same collections from a plain-data schema description. No plugin factories, no environment reads, no server SDKs (~1 KB gzip marginal). |
+
 ## Usage
 
-```typescript
-import { defineConfig } from "@vexcms/core"
-import { vexBetterAuth } from "@vexcms/better-auth"
+Author a client-safe module holding everything about your Better Auth setup that determines
+which collections exist and which fields they carry — model names, `user.additionalFields`,
+and which plugins are registered:
 
-export default defineConfig({
-  auth: vexBetterAuth({
-    config: {
-      user: { modelName: "users" },
-      plugins: [admin()],
+```ts
+// src/auth/schema.ts — no server imports, safe in the browser bundle
+import type { BetterAuthSchemaInput } from "@vexcms/better-auth/client";
+
+export const authSchema = {
+  user: {
+    additionalFields: {
+      roles: { type: "string[]", defaultValue: ["user"], required: true },
     },
-  }),
+  },
+  plugins: {
+    admin: true,
+    anonymous: true,
+    apiKey: true,
+    convex: true,
+    organization: { teams: true },
+  },
+} satisfies BetterAuthSchemaInput;
+```
+
+```ts
+// vex.config.ts (client)
+import { betterAuthCollections } from "@vexcms/better-auth/client";
+import { defineConfig } from "@vexcms/core";
+
+import { authSchema } from "./auth/schema";
+
+export default defineConfig({
+  authCollections: betterAuthCollections(authSchema),
   collections: [/* ... */],
-})
+});
+```
+
+Your real Better Auth options spread the same schema module and add everything server-only —
+the secret, base URL, and real plugin instances. `plugins` on `authSchema` is a descriptor map
+for `betterAuthCollections()`, not plugin instances, so it's dropped by name rather than
+shadowed by the override:
+
+```ts
+// src/auth/options.ts (server)
+import type { BetterAuthOptions } from "better-auth";
+import { admin, anonymous, organization } from "better-auth/plugins";
+import { apiKey } from "@better-auth/api-key";
+import { convex } from "@convex-dev/better-auth/plugins";
+
+import { authSchema } from "./schema";
+
+const { plugins: _pluginDescriptors, ...schemaOptions } = authSchema;
+
+export const authOptions: BetterAuthOptions = {
+  ...schemaOptions,
+  secret: process.env.BETTER_AUTH_SECRET,
+  plugins: [admin(), anonymous(), apiKey(), convex(), organization({ teams: true })],
+};
 ```
 
+```ts
+// vex.config.server.ts (server)
+import { betterAuthAdapter } from "@vexcms/better-auth";
+import { defineServerConfig } from "@vexcms/core";
+
+import { authOptions } from "./auth/options";
+
+import vexConfig from "./vex.config";
+
+export default defineServerConfig({
+  config: vexConfig,
+  server: {
+    auth: { adapter: betterAuthAdapter({ config: authOptions }) },
+  },
+});
+```
+
+`defineServerConfig` compares the client config's `authCollections` against the live
+adapter's `collections` and throws `VexAuthConfigError` naming the first divergence — e.g.
+`collection "user" is missing field(s) "phone"` — the moment `authSchema` and `authOptions`
+fall out of sync. Registering the adapter (`server.auth`) is optional: omit it for a project
+with no auth, or to skip the check.
+
 ## What It Does
 
-`vexBetterAuth()` takes your Better Auth configuration and:
+Both entry points convert Better Auth's schema into Vex collections through the same pipeline:
 
-1. **Extracts auth tables** — Uses Better Auth's `getAuthTables()` to resolve the complete schema including plugin-contributed fields
-2. **Converts fields** — Maps Better Auth field types to VEX field types (string → text, boolean → checkbox, references → relationship, etc.)
-3. **Configures admin UI** — Sets appropriate field visibility:
-   - **Editable**: user name, image, role, ban status
-   - **Hidden**: sensitive fields (tokens, secrets, verification values)
-   - **Read-only**: everything else
-4. **Creates indexes** — Generates database indexes for indexed/unique fields
-5. **Groups in sidebar** — All auth collections appear under the "Auth" group
+1. **Resolves the full schema** — `betterAuthAdapter()` runs Better Auth's `getAuthTables()`
+   over your real options; `betterAuthCollections()` runs it over plain `{ id, schema }` plugin
+   stubs resolved from a committed schema snapshot, so both produce identical collections
+2. **Converts fields** — maps Better Auth field types to Vex field types (string → text,
+   boolean → checkbox, references → relationship, etc.)
+3. **Configures admin UI** — sets field visibility: editable (name, image, role, ban status),
+   hidden (tokens, secrets, verification values), read-only (everything else)
+4. **Creates indexes** — generates database indexes for indexed/unique fields
+5. **Protects system collections** — every auth collection except `user` is `protected`, so a
+   user-defined collection can't override its slug
 
 ## Supported Auth Tables
 
@@ -47,36 +127,63 @@ export default defineConfig({
 | `account` | OAuth/credential accounts linked to users |
 | `verification` | Email verification and password reset tokens |
 
-Plugin-contributed tables (e.g., from `admin()`, `apiKey()`) are automatically included.
+## Modelled plugins
+
+`betterAuthCollections()` models 11 plugins' schemas directly — `admin`, `anonymous`,
+`apiKey`, `convex`, `deviceAuthorization`, `jwt`, `mcp`, `oidcProvider`, `organization`
+(`teams` changes which tables exist), `phoneNumber`, `siwe`, `twoFactor`. Each descriptor
+accepts `true` or schema-affecting options only (`{ schema: { ... } }` to rename columns or
+add fields) — runtime options (roles, mailers, secrets) are rejected by the type, since
+accepting them would risk a server callback ending up in the browser bundle.
+
+Naming any other `better-auth/plugins` export in `authSchema.plugins` is a type error pointing
+at the fix: read that plugin's `schema` off its real instance on the server, and hand-copy the
+plain-data value into `extraSchema`:
+
+```ts
+// src/auth/schema.ts
+export const authSchema = {
+  plugins: { admin: true },
+  // `magicLink` isn't modelled — copy its `schema` shape from the real plugin
+  // instance rather than importing `better-auth/plugins` here.
+  extraSchema: {
+    verification: { fields: {} },
+  },
+} satisfies BetterAuthSchemaInput;
+```
 
-## Plugin Support
+`betterAuthAdapter()` (server-side) accepts any registered plugin directly — it instantiates
+your real options, so it needs no such list.
 
-Better Auth plugins that add fields or tables are fully supported:
+## Custom Model Names
 
-```typescript
-import { admin } from "better-auth/plugins"
+Custom `modelName` values are respected and propagated to relationship references:
 
-vexBetterAuth({
-  config: {
-    plugins: [admin()],  // Adds role, banned, banReason fields to user
-  },
-})
+```ts
+export const authSchema = {
+  user: { modelName: "users" },
+  session: { modelName: "sessions" },
+} satisfies BetterAuthSchemaInput;
 ```
 
-## Custom Model Names
+## Keeping the plugin schema snapshot fresh
 
-Custom `modelName` values are respected and propagated to relationship references:
+`betterAuthCollections()` reads plugin schemas from a snapshot committed to this package
+(`src/pluginSchemas.generated.ts`), so it never instantiates a real plugin factory.
+Regenerate it after a Better Auth upgrade:
 
-```typescript
-vexBetterAuth({
-  config: {
-    user: { modelName: "users" },
-    session: { modelName: "sessions" },
-  },
-})
+```bash
+pnpm --filter @vexcms/better-auth gen:auth-schemas
 ```
 
+`pluginSchemas.test.ts` fails whenever the committed snapshot and the installed `better-auth`
+version disagree, and a new upstream plugin fails this package's typecheck via an
+exhaustiveness assertion until it's classified as modelled or explicitly routed to
+`extraSchema`. Projects consuming this package never run this — it's this package's own
+maintenance task.
+
 ## Peer Dependencies
 
 - `@vexcms/core` — Core VEX CMS types
-- `better-auth` — Better Auth (>=1.4.9 <1.5.0)
+- `better-auth` — Better Auth (>=1.6.23 <1.7.0)
+- `convex` — Convex backend (>=1.44.0 <2)

package/dist/adapter.d.ts

@@ -16,7 +16,12 @@ export interface BetterAuthAdapterOptions {
  *
  * Introspects Better Auth's full merged schema (base fields + plugin fields
  * + additionalFields) via `getAuthTables()` and converts each table into a
- * standard Vex `CollectionConfig` using Vex field builders.
+ * standard Vex `CollectionConfig` using Vex field builders. Server-only: pass
+ * the resulting `VexAuthAdapter` to `defineServerConfig({ server: { auth: { adapter } } })`,
+ * which also uses its `collections` as the source of truth to verify that the client config's
+ * `authCollections` — built by {@link better-auth/src!betterAuthCollections} from
+ * `@vexcms/better-auth/client` — have not drifted, throwing `VexAuthConfigError` naming the
+ * first divergence.
  *
  * Mappings from Better Auth `DBFieldAttribute` to Vex fields:
  * - `type` → Vex field type (`string`→text, `boolean`→checkbox, `number`→number,
@@ -31,16 +36,23 @@ export interface BetterAuthAdapterOptions {
  * @param props — Adapter options; pass your Better Auth config object wrapped
  *   in `{ config: authOptions }`. Optional — when omitted, uses default
  *   Better Auth tables with no plugins or additional fields.
- * @returns A `VexAuthAdapter` ready for `defineConfig({ auth: … })`.
+ * @returns A `VexAuthAdapter` ready for `defineServerConfig({ server: { auth: { adapter } } })`.
  *
  * @example
  * ```ts
+ * // vex.config.server.ts
  * import { betterAuthAdapter } from "@vexcms/better-auth";
+ * import { defineServerConfig } from "@vexcms/core";
+ *
  * import { authOptions } from "~/auth/server";
  *
- * export default defineConfig({
- *   auth: betterAuthAdapter({ config: authOptions }),
- *   collections: [posts],
+ * import vexConfig from "./vex.config";
+ *
+ * export default defineServerConfig({
+ *   config: vexConfig,
+ *   server: {
+ *     auth: { adapter: betterAuthAdapter({ config: authOptions }) },
+ *   },
  * });
  * ```
  */

package/dist/adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oBAAoB,EAKpB,cAAc,EACf,MAAM,cAAc,CAAC;AAWtB,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAGvE;;;;;;;GAOG;AACH,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,iBAAiB,CAAC;CAC3B;AA+BD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,CAAC,EAAE,wBAAwB,GAC/B,cAAc,CAmGhB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,QAYA"}
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oBAAoB,EAKpB,cAAc,EACf,MAAM,cAAc,CAAC;AAWtB,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAGvE;;;;;;;GAOG;AACH,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,iBAAiB,CAAC;CAC3B;AA+BD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,CAAC,EAAE,wBAAwB,GAAG,cAAc,CAmGlF;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,QAOA"}

package/dist/chunk-YPIEILO5.js

@@ -0,0 +1,196 @@
+// src/adapter.ts
+import {
+  array,
+  checkbox,
+  date,
+  defineCollection,
+  number,
+  select,
+  text
+} from "@vexcms/core";
+import { getAuthTables } from "better-auth/db";
+var AUTH_COLLECTION_TYPES = {
+  user: "user",
+  session: "session",
+  account: "account",
+  verification: "verification"
+};
+var EDITABLE_FIELDS = /* @__PURE__ */ new Set([
+  "name",
+  "email",
+  "image",
+  "role",
+  "banned",
+  "banReason",
+  "banExpires"
+]);
+var HIDDEN_FIELDS = /* @__PURE__ */ new Set([
+  "hashedPassword",
+  "password",
+  "twoFactorSecret",
+  "twoFactorBackupCodes",
+  "token",
+  "secret",
+  "code"
+]);
+function betterAuthAdapter(props) {
+  const tables = getAuthTables(props?.config ?? {});
+  const collections = [];
+  const authCollections = [
+    { type: AUTH_COLLECTION_TYPES.user, slug: props?.config?.user?.modelName },
+    {
+      type: AUTH_COLLECTION_TYPES.session,
+      slug: props?.config?.session?.modelName
+    },
+    {
+      type: AUTH_COLLECTION_TYPES.account,
+      slug: props?.config?.account?.modelName
+    },
+    {
+      type: AUTH_COLLECTION_TYPES.verification,
+      slug: props?.config?.verification?.modelName
+    }
+  ];
+  for (const [tableKey, tableDef] of Object.entries(tables)) {
+    const slug = tableDef.modelName ?? tableKey;
+    const fields = {};
+    addAuthCollectionFields({
+      attributes: tableDef.fields,
+      slug,
+      fields,
+      config: props?.config,
+      extractId: true
+    });
+    const authCollectionType = authCollections.find((ac) => ac.slug === slug)?.type;
+    if (authCollectionType) {
+      switch (authCollectionType) {
+        case "user": {
+          const additionalFields = props?.config?.user?.additionalFields;
+          addAuthCollectionFields({
+            attributes: additionalFields,
+            slug,
+            fields,
+            config: props?.config
+          });
+          break;
+        }
+        case "session": {
+          const additionalFields = props?.config?.session?.additionalFields;
+          addAuthCollectionFields({
+            attributes: additionalFields,
+            slug,
+            fields,
+            config: props?.config
+          });
+          break;
+        }
+        case "account": {
+          const additionalFields = props?.config?.account?.additionalFields;
+          addAuthCollectionFields({
+            attributes: additionalFields,
+            slug,
+            fields,
+            config: props?.config
+          });
+          break;
+        }
+        case "verification": {
+          const additionalFields = props?.config?.verification?.additionalFields;
+          addAuthCollectionFields({
+            attributes: additionalFields,
+            slug,
+            fields,
+            config: props?.config
+          });
+          break;
+        }
+        default:
+          break;
+      }
+    }
+    const isProtected = slug !== "user" && slug !== "users";
+    collections.push(
+      defineCollection({
+        slug,
+        fields,
+        admin: {
+          icon: "Lock"
+        },
+        meta: isProtected ? { protected: true } : void 0
+      })
+    );
+  }
+  const userSlug = tables.user?.modelName ?? "user";
+  return {
+    name: "better-auth",
+    collections,
+    userCollection: userSlug
+  };
+}
+function addAuthCollectionFields(props) {
+  if (!props.attributes) return;
+  for (const [fieldName, attr] of Object.entries(props.attributes)) {
+    if (props.extractId === true && fieldName === "id") continue;
+    const field = betterAuthAttrToVexField(fieldName, attr, props.slug, props?.config);
+    if (field) props.fields[fieldName] = field;
+  }
+}
+function betterAuthAttrToVexField(fieldName, attr, tableSlug, authOptions) {
+  if (fieldName === "id") return null;
+  const isUserTable = tableSlug === authOptions?.user?.modelName || tableSlug === "user" || tableSlug === "users";
+  const isEditable = isUserTable && EDITABLE_FIELDS.has(fieldName);
+  const isHidden = HIDDEN_FIELDS.has(fieldName);
+  const admin = {};
+  if (!isEditable) admin.readOnly = true;
+  if (isHidden) admin.hidden = true;
+  const baseOptions = {
+    defaultValue: void 0
+  };
+  if (Object.keys(admin).length > 0) baseOptions.admin = admin;
+  if (!isEditable) baseOptions.meta = { locked: true };
+  if (attr.required) baseOptions.required = attr.required;
+  if (attr.defaultValue !== void 0 && typeof attr.defaultValue !== "function") {
+    baseOptions.defaultValue = attr.defaultValue;
+  }
+  if (attr.unique || attr.index) {
+    baseOptions.index = `by_${fieldName}`;
+  }
+  if (attr.references) {
+    return text(baseOptions);
+  }
+  if (Array.isArray(attr.type)) {
+    return select({
+      options: attr.type.map((v) => ({ value: v, label: v })),
+      ...baseOptions
+    });
+  }
+  switch (attr.type) {
+    case "string":
+      return text(baseOptions);
+    case "string[]":
+      return array({
+        ...baseOptions,
+        items: text(baseOptions)
+      });
+    case "boolean":
+      return checkbox(baseOptions);
+    case "number":
+      return number(baseOptions);
+    case "number[]":
+      return array({
+        ...baseOptions,
+        items: number(baseOptions)
+      });
+    case "date":
+      return date(baseOptions);
+    case "json":
+      return text(baseOptions);
+    default:
+      return null;
+  }
+}
+
+export {
+  betterAuthAdapter
+};
+//# sourceMappingURL=chunk-YPIEILO5.js.map

package/dist/chunk-YPIEILO5.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/adapter.ts"],"sourcesContent":["import type {\n  AuthCollectionConfig,\n  AuthFieldMeta,\n  BaseFieldInput,\n  CollectionSlug,\n  FieldAdminConfigInput,\n  VexAuthAdapter,\n} from \"@vexcms/core\";\nimport {\n  array,\n  AuthCollectionMeta,\n  checkbox,\n  date,\n  defineCollection,\n  number,\n  select,\n  text,\n} from \"@vexcms/core\";\nimport type { BetterAuthOptions, DBFieldAttribute } from \"better-auth\";\nimport { getAuthTables } from \"better-auth/db\";\n\n/**\n * Options for `betterAuthAdapter()`.\n *\n * Accepts the same `BetterAuthOptions` object you pass to `betterAuth()`\n * on the server. Only schema-affecting properties (modelNames,\n * additionalFields, plugins) are read. Runtime options (database, secret,\n * baseURL) are ignored.\n */\nexport interface BetterAuthAdapterOptions {\n  config: BetterAuthOptions;\n}\n\nconst AUTH_COLLECTION_TYPES = {\n  user: \"user\",\n  session: \"session\",\n  account: \"account\",\n  verification: \"verification\",\n} as const;\n\n/** Fields on the user table that end-users are allowed to edit. */\nconst EDITABLE_FIELDS = new Set([\n  \"name\",\n  \"email\",\n  \"image\",\n  \"role\",\n  \"banned\",\n  \"banReason\",\n  \"banExpires\",\n]);\n\n/** Fields that should be hidden in the admin UI for security. */\nconst HIDDEN_FIELDS = new Set([\n  \"hashedPassword\",\n  \"password\",\n  \"twoFactorSecret\",\n  \"twoFactorBackupCodes\",\n  \"token\",\n  \"secret\",\n  \"code\",\n]);\n\n/**\n * Creates a Vex auth adapter from a Better Auth configuration.\n *\n * Introspects Better Auth's full merged schema (base fields + plugin fields\n * + additionalFields) via `getAuthTables()` and converts each table into a\n * standard Vex `CollectionConfig` using Vex field builders. Server-only: pass\n * the resulting `VexAuthAdapter` to `defineServerConfig({ server: { auth: { adapter } } })`,\n * which also uses its `collections` as the source of truth to verify that the client config's\n * `authCollections` — built by {@link better-auth/src!betterAuthCollections} from\n * `@vexcms/better-auth/client` — have not drifted, throwing `VexAuthConfigError` naming the\n * first divergence.\n *\n * Mappings from Better Auth `DBFieldAttribute` to Vex fields:\n * - `type` → Vex field type (`string`→text, `boolean`→checkbox, `number`→number,\n *   `date`/`timestamp`→date, `json`→text fallback, array→select)\n * - `required` → field `required`\n * - `defaultValue` → field `defaultValue`\n * - `unique`/`index` → field `index` (index name: `by_<field>_unique` or `by_<field>`)\n * - `references` → `relationship` field\n * - System fields get `admin.readOnly: true` and `meta.locked: true`\n * - Sensitive fields get `admin.hidden: true`\n *\n * @param props — Adapter options; pass your Better Auth config object wrapped\n *   in `{ config: authOptions }`. Optional — when omitted, uses default\n *   Better Auth tables with no plugins or additional fields.\n * @returns A `VexAuthAdapter` ready for `defineServerConfig({ server: { auth: { adapter } } })`.\n *\n * @example\n * ```ts\n * // vex.config.server.ts\n * import { betterAuthAdapter } from \"@vexcms/better-auth\";\n * import { defineServerConfig } from \"@vexcms/core\";\n *\n * import { authOptions } from \"~/auth/server\";\n *\n * import vexConfig from \"./vex.config\";\n *\n * export default defineServerConfig({\n *   config: vexConfig,\n *   server: {\n *     auth: { adapter: betterAuthAdapter({ config: authOptions }) },\n *   },\n * });\n * ```\n */\nexport function betterAuthAdapter(props?: BetterAuthAdapterOptions): VexAuthAdapter {\n  const tables = getAuthTables(props?.config ?? {});\n  const collections: AuthCollectionConfig[] = [];\n  const authCollections = [\n    { type: AUTH_COLLECTION_TYPES.user, slug: props?.config?.user?.modelName },\n    {\n      type: AUTH_COLLECTION_TYPES.session,\n      slug: props?.config?.session?.modelName,\n    },\n    {\n      type: AUTH_COLLECTION_TYPES.account,\n      slug: props?.config?.account?.modelName,\n    },\n    {\n      type: AUTH_COLLECTION_TYPES.verification,\n      slug: props?.config?.verification?.modelName,\n    },\n  ] as const;\n\n  for (const [tableKey, tableDef] of Object.entries(tables)) {\n    const slug = tableDef.modelName ?? tableKey;\n    const fields: AuthCollectionConfig[\"fields\"] = {};\n\n    addAuthCollectionFields({\n      attributes: tableDef.fields,\n      slug,\n      fields,\n      config: props?.config,\n      extractId: true,\n    });\n\n    const authCollectionType = authCollections.find((ac) => ac.slug === slug)?.type;\n    if (authCollectionType) {\n      switch (authCollectionType) {\n        case \"user\": {\n          const additionalFields = props?.config?.user?.additionalFields;\n          addAuthCollectionFields({\n            attributes: additionalFields,\n            slug,\n            fields,\n            config: props?.config,\n          });\n          break;\n        }\n        case \"session\": {\n          const additionalFields = props?.config?.session?.additionalFields;\n          addAuthCollectionFields({\n            attributes: additionalFields,\n            slug,\n            fields,\n            config: props?.config,\n          });\n          break;\n        }\n        case \"account\": {\n          const additionalFields = props?.config?.account?.additionalFields;\n          addAuthCollectionFields({\n            attributes: additionalFields,\n            slug,\n            fields,\n            config: props?.config,\n          });\n          break;\n        }\n        case \"verification\": {\n          const additionalFields = props?.config?.verification?.additionalFields;\n          addAuthCollectionFields({\n            attributes: additionalFields,\n            slug,\n            fields,\n            config: props?.config,\n          });\n          break;\n        }\n        default:\n          break;\n      }\n    }\n\n    const isProtected = slug !== \"user\" && slug !== \"users\";\n\n    collections.push(\n      defineCollection<AuthFieldMeta, AuthCollectionMeta>({\n        slug: slug as CollectionSlug,\n        fields,\n        admin: {\n          icon: \"Lock\",\n        },\n        meta: isProtected ? { protected: true } : undefined,\n      }),\n    );\n  }\n\n  const userSlug = tables.user?.modelName ?? \"user\";\n  return {\n    name: \"better-auth\",\n    collections,\n    userCollection: userSlug as CollectionSlug,\n  };\n}\n\n/**\n * Converts a set of Better Auth field attributes into Vex field definitions\n * and appends them to the given collection `fields` map.\n *\n * Iterates over `attributes`, calls {@link betterAuthAttrToVexField} for each\n * entry, and mutates `props.fields` in place. When `extractId` is `true`,\n * the `id` field is skipped because Convex auto-generates `_id`.\n *\n * @param props — Field extraction options.\n * @param props.attributes — Better Auth `DBFieldAttribute` map to convert.\n * @param props.slug — Collection slug (used for relationship target resolution).\n * @param props.fields — Mutable Vex collection fields object to populate.\n * @param props.config — Better Auth options (for model name / additional fields lookups).\n * @param props.extractId — When `true`, skips the `id` field.\n *\n * @internal\n */\nexport function addAuthCollectionFields(props: {\n  attributes?: Record<string, DBFieldAttribute>;\n  slug: string;\n  fields: AuthCollectionConfig[\"fields\"];\n  config?: BetterAuthOptions;\n  extractId?: boolean;\n}) {\n  if (!props.attributes) return;\n  for (const [fieldName, attr] of Object.entries(props.attributes)) {\n    if (props.extractId === true && fieldName === \"id\") continue;\n    const field = betterAuthAttrToVexField(fieldName, attr, props.slug, props?.config);\n    if (field) props.fields[fieldName] = field;\n  }\n}\n\n/**\n * Maps a single Better Auth `DBFieldAttribute` to a Vex field builder call.\n *\n * Handles all Better Auth scalar types: `string`, `boolean`, `number`, `date`,\n * `timestamp`, `json`, and enum arrays. Maps overlapping properties\n * (`required`, `defaultValue`, `unique`/`index`, `references`) to their\n * Vex equivalents. Sets `admin.readOnly` and `meta.locked` on system\n * fields, and `admin.hidden` on sensitive fields.\n *\n * @param fieldName — The field name from Better Auth.\n * @param attr — The Better Auth field attribute.\n * @param tableSlug — The collection slug (for relationship targets).\n * @param authOptions -- The betterAuth options\n * @returns A Vex field instance, or `null` if the type is unsupported.\n *\n * @internal\n */\nfunction betterAuthAttrToVexField(\n  fieldName: string,\n  attr: DBFieldAttribute,\n  tableSlug: string,\n  authOptions?: BetterAuthOptions,\n) {\n  // Skip id — Convex auto-generates _id\n  if (fieldName === \"id\") return null;\n\n  const isUserTable =\n    tableSlug === authOptions?.user?.modelName || tableSlug === \"user\" || tableSlug === \"users\";\n  const isEditable = isUserTable && EDITABLE_FIELDS.has(fieldName);\n  const isHidden = HIDDEN_FIELDS.has(fieldName);\n\n  const admin: FieldAdminConfigInput = {};\n  if (!isEditable) admin.readOnly = true;\n  if (isHidden) admin.hidden = true;\n\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  const baseOptions: { defaultValue: any } & BaseFieldInput<AuthFieldMeta> = {\n    defaultValue: undefined,\n  };\n  if (Object.keys(admin).length > 0) baseOptions.admin = admin;\n  if (!isEditable) baseOptions.meta = { locked: true };\n  if (attr.required) baseOptions.required = attr.required;\n  if (attr.defaultValue !== undefined && typeof attr.defaultValue !== \"function\") {\n    baseOptions.defaultValue = attr.defaultValue;\n  }\n  if (attr.unique || attr.index) {\n    baseOptions.index = `by_${fieldName}`;\n  }\n\n  if (attr.references) {\n    return text(baseOptions);\n  }\n\n  if (Array.isArray(attr.type)) {\n    return select({\n      options: attr.type.map((v: string) => ({ value: v, label: v })),\n      ...baseOptions,\n    });\n  }\n\n  switch (attr.type) {\n    case \"string\":\n      return text(baseOptions);\n    case \"string[]\":\n      return array({\n        ...baseOptions,\n        items: text(baseOptions),\n      });\n    case \"boolean\":\n      return checkbox(baseOptions);\n    case \"number\":\n      return number(baseOptions);\n    case \"number[]\":\n      return array({\n        ...baseOptions,\n        items: number(baseOptions),\n      });\n    case \"date\":\n      return date(baseOptions);\n    case \"json\":\n      // Fall back to text until a dedicated json field type is wired\n      // TODO: create json field\n      return text(baseOptions);\n    default:\n      // Unknown type — skip rather than crash\n      return null;\n  }\n}\n"],"mappings":";AAQA;AAAA,EACE;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,SAAS,qBAAqB;AAc9B,IAAM,wBAAwB;AAAA,EAC5B,MAAM;AAAA,EACN,SAAS;AAAA,EACT,SAAS;AAAA,EACT,cAAc;AAChB;AAGA,IAAM,kBAAkB,oBAAI,IAAI;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGD,IAAM,gBAAgB,oBAAI,IAAI;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AA+CM,SAAS,kBAAkB,OAAkD;AAClF,QAAM,SAAS,cAAc,OAAO,UAAU,CAAC,CAAC;AAChD,QAAM,cAAsC,CAAC;AAC7C,QAAM,kBAAkB;AAAA,IACtB,EAAE,MAAM,sBAAsB,MAAM,MAAM,OAAO,QAAQ,MAAM,UAAU;AAAA,IACzE;AAAA,MACE,MAAM,sBAAsB;AAAA,MAC5B,MAAM,OAAO,QAAQ,SAAS;AAAA,IAChC;AAAA,IACA;AAAA,MACE,MAAM,sBAAsB;AAAA,MAC5B,MAAM,OAAO,QAAQ,SAAS;AAAA,IAChC;AAAA,IACA;AAAA,MACE,MAAM,sBAAsB;AAAA,MAC5B,MAAM,OAAO,QAAQ,cAAc;AAAA,IACrC;AAAA,EACF;AAEA,aAAW,CAAC,UAAU,QAAQ,KAAK,OAAO,QAAQ,MAAM,GAAG;AACzD,UAAM,OAAO,SAAS,aAAa;AACnC,UAAM,SAAyC,CAAC;AAEhD,4BAAwB;AAAA,MACtB,YAAY,SAAS;AAAA,MACrB;AAAA,MACA;AAAA,MACA,QAAQ,OAAO;AAAA,MACf,WAAW;AAAA,IACb,CAAC;AAED,UAAM,qBAAqB,gBAAgB,KAAK,CAAC,OAAO,GAAG,SAAS,IAAI,GAAG;AAC3E,QAAI,oBAAoB;AACtB,cAAQ,oBAAoB;AAAA,QAC1B,KAAK,QAAQ;AACX,gBAAM,mBAAmB,OAAO,QAAQ,MAAM;AAC9C,kCAAwB;AAAA,YACtB,YAAY;AAAA,YACZ;AAAA,YACA;AAAA,YACA,QAAQ,OAAO;AAAA,UACjB,CAAC;AACD;AAAA,QACF;AAAA,QACA,KAAK,WAAW;AACd,gBAAM,mBAAmB,OAAO,QAAQ,SAAS;AACjD,kCAAwB;AAAA,YACtB,YAAY;AAAA,YACZ;AAAA,YACA;AAAA,YACA,QAAQ,OAAO;AAAA,UACjB,CAAC;AACD;AAAA,QACF;AAAA,QACA,KAAK,WAAW;AACd,gBAAM,mBAAmB,OAAO,QAAQ,SAAS;AACjD,kCAAwB;AAAA,YACtB,YAAY;AAAA,YACZ;AAAA,YACA;AAAA,YACA,QAAQ,OAAO;AAAA,UACjB,CAAC;AACD;AAAA,QACF;AAAA,QACA,KAAK,gBAAgB;AACnB,gBAAM,mBAAmB,OAAO,QAAQ,cAAc;AACtD,kCAAwB;AAAA,YACtB,YAAY;AAAA,YACZ;AAAA,YACA;AAAA,YACA,QAAQ,OAAO;AAAA,UACjB,CAAC;AACD;AAAA,QACF;AAAA,QACA;AACE;AAAA,MACJ;AAAA,IACF;AAEA,UAAM,cAAc,SAAS,UAAU,SAAS;AAEhD,gBAAY;AAAA,MACV,iBAAoD;AAAA,QAClD;AAAA,QACA;AAAA,QACA,OAAO;AAAA,UACL,MAAM;AAAA,QACR;AAAA,QACA,MAAM,cAAc,EAAE,WAAW,KAAK,IAAI;AAAA,MAC5C,CAAC;AAAA,IACH;AAAA,EACF;AAEA,QAAM,WAAW,OAAO,MAAM,aAAa;AAC3C,SAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA,gBAAgB;AAAA,EAClB;AACF;AAmBO,SAAS,wBAAwB,OAMrC;AACD,MAAI,CAAC,MAAM,WAAY;AACvB,aAAW,CAAC,WAAW,IAAI,KAAK,OAAO,QAAQ,MAAM,UAAU,GAAG;AAChE,QAAI,MAAM,cAAc,QAAQ,cAAc,KAAM;AACpD,UAAM,QAAQ,yBAAyB,WAAW,MAAM,MAAM,MAAM,OAAO,MAAM;AACjF,QAAI,MAAO,OAAM,OAAO,SAAS,IAAI;AAAA,EACvC;AACF;AAmBA,SAAS,yBACP,WACA,MACA,WACA,aACA;AAEA,MAAI,cAAc,KAAM,QAAO;AAE/B,QAAM,cACJ,cAAc,aAAa,MAAM,aAAa,cAAc,UAAU,cAAc;AACtF,QAAM,aAAa,eAAe,gBAAgB,IAAI,SAAS;AAC/D,QAAM,WAAW,cAAc,IAAI,SAAS;AAE5C,QAAM,QAA+B,CAAC;AACtC,MAAI,CAAC,WAAY,OAAM,WAAW;AAClC,MAAI,SAAU,OAAM,SAAS;AAG7B,QAAM,cAAqE;AAAA,IACzE,cAAc;AAAA,EAChB;AACA,MAAI,OAAO,KAAK,KAAK,EAAE,SAAS,EAAG,aAAY,QAAQ;AACvD,MAAI,CAAC,WAAY,aAAY,OAAO,EAAE,QAAQ,KAAK;AACnD,MAAI,KAAK,SAAU,aAAY,WAAW,KAAK;AAC/C,MAAI,KAAK,iBAAiB,UAAa,OAAO,KAAK,iBAAiB,YAAY;AAC9E,gBAAY,eAAe,KAAK;AAAA,EAClC;AACA,MAAI,KAAK,UAAU,KAAK,OAAO;AAC7B,gBAAY,QAAQ,MAAM,SAAS;AAAA,EACrC;AAEA,MAAI,KAAK,YAAY;AACnB,WAAO,KAAK,WAAW;AAAA,EACzB;AAEA,MAAI,MAAM,QAAQ,KAAK,IAAI,GAAG;AAC5B,WAAO,OAAO;AAAA,MACZ,SAAS,KAAK,KAAK,IAAI,CAAC,OAAe,EAAE,OAAO,GAAG,OAAO,EAAE,EAAE;AAAA,MAC9D,GAAG;AAAA,IACL,CAAC;AAAA,EACH;AAEA,UAAQ,KAAK,MAAM;AAAA,IACjB,KAAK;AACH,aAAO,KAAK,WAAW;AAAA,IACzB,KAAK;AACH,aAAO,MAAM;AAAA,QACX,GAAG;AAAA,QACH,OAAO,KAAK,WAAW;AAAA,MACzB,CAAC;AAAA,IACH,KAAK;AACH,aAAO,SAAS,WAAW;AAAA,IAC7B,KAAK;AACH,aAAO,OAAO,WAAW;AAAA,IAC3B,KAAK;AACH,aAAO,MAAM;AAAA,QACX,GAAG;AAAA,QACH,OAAO,OAAO,WAAW;AAAA,MAC3B,CAAC;AAAA,IACH,KAAK;AACH,aAAO,KAAK,WAAW;AAAA,IACzB,KAAK;AAGH,aAAO,KAAK,WAAW;AAAA,IACzB;AAEE,aAAO;AAAA,EACX;AACF;","names":[]}

package/dist/client.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Client-safe entry point for `@vexcms/better-auth`.
+ *
+ * The browser imports this — never the package root, which re-exports the
+ * Convex DB adapter and pulls `convex/server` into the graph. Everything here
+ * is pure data transformation: `@vexcms/core` plus Better Auth's
+ * `getAuthTables`/`mergeSchema` (~1 KB gzipped), with no plugin factories, no
+ * environment reads, and no server SDKs.
+ *
+ * @example
+ * ```ts
+ * // src/vex.config.ts
+ * import { betterAuthCollections } from "@vexcms/better-auth/client";
+ * import { authSchema } from "./auth/schema";
+ *
+ * export default defineConfig({ authCollections: betterAuthCollections(authSchema) });
+ * ```
+ *
+ * @module
+ */
+export { betterAuthCollections } from "./collections";
+export type { BetterAuthCoreTableInput, BetterAuthSchemaInput, } from "./collections";
+export type { BetterAuthPluginDescriptors, BetterAuthPluginName, ModelledPluginDescriptors, ModelledPluginName, PluginDBSchema, PluginSchemaOverride, } from "./pluginSchemas";
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,YAAY,EACV,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,2BAA2B,EAC3B,oBAAoB,EACpB,yBAAyB,EACzB,kBAAkB,EAClB,cAAc,EACd,oBAAoB,GACrB,MAAM,iBAAiB,CAAC"}