auth 1.7.0-beta.4 → 1.7.0-beta.6

package/dist/api.mjs

@@ -133,6 +133,10 @@ const generateDrizzleSchema = async ({ options, file, adapter }) => {
 				if (attr.type === "date" && attr.defaultValue.toString().includes("new Date()")) if (databaseType === "sqlite") type += `.default(sql\`(cast(unixepoch('subsecond') * 1000 as integer))\`)`;
 				else type += `.defaultNow()`;
 			} else if (typeof attr.defaultValue === "string") type += `.default("${attr.defaultValue}")`;
+			else if (Array.isArray(attr.defaultValue)) {
+				const elements = attr.defaultValue.map((value) => JSON.stringify(value)).join(", ");
+				type += `.default([${elements}])`;
+			} else if (typeof attr.defaultValue === "object" && attr.defaultValue !== null) type += `.default(${JSON.stringify(attr.defaultValue)})`;
 			else type += `.default(${attr.defaultValue})`;
 			if (attr.onUpdate && attr.type === "date") {
 				if (typeof attr.onUpdate === "function") type += `.$onUpdate(${attr.onUpdate})`;
@@ -404,6 +408,16 @@ const generatePrismaSchema = async ({ adapter, options, file }) => {
 					return "Int[]";
 				}
 			}
+			function getFieldTypeParts(type) {
+				const isArray = type.endsWith("[]");
+				const typeWithoutArray = isArray ? type.slice(0, -2) : type;
+				const isOptional = typeWithoutArray.endsWith("?");
+				return {
+					fieldType: isOptional ? typeWithoutArray.slice(0, -1) : typeWithoutArray,
+					isArray,
+					isOptional
+				};
+			}
 			const prismaModel = builder.findByType("model", { name: modelName });
 			if (!prismaModel) if (provider === "mongodb") builder.model(modelName).field("id", "String").attribute("id").attribute(`map("_id")`);
 			else {
@@ -416,15 +430,9 @@ const generatePrismaSchema = async ({ adapter, options, file }) => {
 			for (const field in fields) {
 				const attr = fields[field];
 				const fieldName = attr.fieldName || field;
-				if (prismaModel) {
-					if (builder.findByType("field", {
-						name: fieldName,
-						within: prismaModel.properties
-					})) continue;
-				}
 				const useUUIDs = options.advanced?.database?.generateId === "uuid";
 				const useNumberId = options.advanced?.database?.generateId === "serial";
-				const fieldBuilder = builder.model(modelName).field(fieldName, field === "id" && useNumberId ? getType({
+				const fieldType = field === "id" && useNumberId ? getType({
 					isBigint: false,
 					isOptional: false,
 					type: "number"
@@ -432,12 +440,33 @@ const generatePrismaSchema = async ({ adapter, options, file }) => {
 					isBigint: attr?.bigint || false,
 					isOptional: attr?.required === false,
 					type: attr.references?.field === "id" ? useNumberId ? "number" : "string" : attr.type
-				}));
+				});
+				if (prismaModel) {
+					const isAlreadyExist = builder.findByType("field", {
+						name: fieldName,
+						within: prismaModel.properties
+					});
+					if (isAlreadyExist) {
+						if (fieldType && typeof isAlreadyExist.fieldType === "string") {
+							const fieldTypeParts = getFieldTypeParts(fieldType);
+							const existingFieldTypeParts = getFieldTypeParts(isAlreadyExist.fieldType);
+							if ((existingFieldTypeParts.fieldType === "Int" || existingFieldTypeParts.fieldType === "BigInt") && (fieldTypeParts.fieldType === "Int" || fieldTypeParts.fieldType === "BigInt")) {
+								isAlreadyExist.fieldType = fieldTypeParts.fieldType;
+								isAlreadyExist.optional = fieldTypeParts.isOptional || void 0;
+								isAlreadyExist.array = fieldTypeParts.isArray || void 0;
+							}
+						}
+						continue;
+					}
+				}
+				if (!fieldType) throw new Error(`Unsupported Prisma field type for model "${modelName}", field "${fieldName}"${attr.type ? ` (source type: "${attr.type}")` : ""}.`);
+				const fieldBuilder = builder.model(modelName).field(fieldName, fieldType);
 				if (field === "id") {
 					fieldBuilder.attribute("id");
 					if (provider === "mongodb") fieldBuilder.attribute(`map("_id")`);
 				}
 				if (attr.unique) builder.model(modelName).blockAttribute(`unique([${fieldName}])`);
+				if ((attr.type === "string[]" || attr.type === "number[]") && provider !== "sqlite" && provider !== "mysql" && attr.defaultValue === void 0) fieldBuilder.attribute("default([])");
 				if (attr.defaultValue !== void 0) {
 					if (Array.isArray(attr.defaultValue)) {
 						if (attr.type === "json") {

package/dist/index.mjs

@@ -578,7 +578,25 @@ function showNextSteps(lines) {
 }
 const ai = new Command("ai").description("Interactive setup for Agent Auth — AI agent authentication").action(aiAction);
 //#endregion
-//#region src/utils/add-cloudflare-modules.ts
+//#region src/utils/cloudflare-virtual-modules.ts
+/**
+* `cloudflare:workers` is a Workers-runtime built-in module. The CLI loads
+* `auth.ts` with jiti, outside that runtime, so a config importing it would
+* crash. It is aliased to an inert stub whose named exports mirror the real
+* module so every import links.
+*
+* Like the SvelteKit stubs, these are *named* exports that must exist at link
+* time, so the surface is enumerated by hand. The list mirrors workerd's
+* `cloudflare:workers` re-export module: the entrypoint/RPC classes are real
+* classes (so `extends` works), and the value/helper exports are recursive
+* proxies that absorb any access (so `env.MY_BINDING.get()` does not throw).
+*
+* `cloudflare:test` is intentionally NOT stubbed: it is a different module with
+* a different surface, provided only by `@cloudflare/vitest-pool-workers` for
+* test runs, and an auth config never imports it.
+*
+* @see https://github.com/cloudflare/workerd/blob/main/src/cloudflare/workers.ts
+*/
 const createModule = () => {
 	return `data:text/javascript;charset=utf-8,${encodeURIComponent(`
 const createStub = (label) => {
@@ -591,15 +609,14 @@ const createStub = (label) => {
       if (prop === "then") return undefined;
       return createStub(label + "." + String(prop));
     },
-    apply(_, __, args) {
-      return createStub(label + "()")
+    apply() {
+      return createStub(label + "()");
     },
     construct() {
       return createStub(label + "#instance");
     },
   };
-  const fn = () => createStub(label + "()");
-  return new Proxy(fn, handler);
+  return new Proxy(function () {}, handler);
 };
 
 class WorkerEntrypoint {
@@ -608,141 +625,204 @@ class WorkerEntrypoint {
     this.env = env;
   }
 }
-
 class DurableObject {
-  constructor(state, env) {
-    this.state = state;
+  constructor(ctx, env) {
+    this.ctx = ctx;
     this.env = env;
   }
 }
-
-class RpcTarget {
-  constructor(value) {
-    this.value = value;
+class WorkflowEntrypoint {
+  constructor(ctx, env) {
+    this.ctx = ctx;
+    this.env = env;
   }
 }
-
-const RpcStub = RpcTarget;
+class RpcTarget {}
+class RpcStub {}
+class RpcPromise {}
+class RpcProperty {}
+class ServiceStub {}
 
 const env = createStub("env");
-const caches = createStub("caches");
-const scheduler = createStub("scheduler");
-const executionCtx = createStub("executionCtx");
-
-export { DurableObject, RpcStub, RpcTarget, WorkerEntrypoint, caches, env, executionCtx, scheduler };
+const exportsStub = createStub("exports");
+const cache = createStub("cache");
+const tracing = createStub("tracing");
+const withEnv = createStub("withEnv");
+const withExports = createStub("withExports");
+const withEnvAndExports = createStub("withEnvAndExports");
+const waitUntil = createStub("waitUntil");
+const abortIsolate = createStub("abortIsolate");
 
-const defaultExport = {
+export {
+  WorkerEntrypoint,
   DurableObject,
-  RpcStub,
+  WorkflowEntrypoint,
   RpcTarget,
-  WorkerEntrypoint,
-  caches,
+  RpcStub,
+  RpcPromise,
+  RpcProperty,
+  ServiceStub,
   env,
-  executionCtx,
-  scheduler,
+  exportsStub as exports,
+  cache,
+  tracing,
+  withEnv,
+  withExports,
+  withEnvAndExports,
+  waitUntil,
+  abortIsolate,
 };
-
-export default defaultExport;
 // jiti dirty hack: .unknown
 `)}`;
 };
 const CLOUDFLARE_STUB_MODULE = createModule();
-function addCloudflareModules(aliases, _cwd) {
+function addCloudflareVirtualModules(aliases) {
 	if (!aliases["cloudflare:workers"]) aliases["cloudflare:workers"] = CLOUDFLARE_STUB_MODULE;
-	if (!aliases["cloudflare:test"]) aliases["cloudflare:test"] = CLOUDFLARE_STUB_MODULE;
 }
 //#endregion
-//#region src/utils/add-svelte-kit-env-modules.ts
+//#region src/utils/sveltekit-virtual-modules.ts
 /**
-* Adds SvelteKit environment modules and path aliases
-* @param aliases - The aliases object to populate
-* @param cwd - Current working directory (optional, defaults to process.cwd())
+* SvelteKit exposes virtual runtime modules (`$env/*`, `$app/*`,
+* `$service-worker`) that exist only while its Vite plugin runs. The CLI loads
+* `auth.ts` with jiti, outside Vite, so a config importing them would crash the
+* loader. Each is aliased to an inert stub.
+*
+* The stubs are injected unconditionally — a non-SvelteKit config never imports
+* them, so the unused aliases are harmless, and it keeps this free of project
+* detection. Real path aliases (`$lib` and any `kit.alias`) are deliberately
+* NOT handled here: `svelte-kit sync` writes them into `.svelte-kit/tsconfig.json`,
+* which the tsconfig `paths` matcher in `get-config.ts` resolves.
+*
+* Why the export surface is enumerated by hand: these are *named* exports, and
+* ESM requires every imported name to exist at link time, so an opaque or
+* wildcard stub is impossible. (Vite asset imports are default-export and so
+* can be matched by rule in `vite-virtual-modules.ts`; a static analyzer can
+* ignore these opaquely because it never runs the module — we do, so we have to
+* provide runnable exports.) The shapes mirror SvelteKit's public, documented
+* surface, which is the stable contract; the internal `__sveltekit/*` virtual
+* modules the real files depend on are not, which is why we stub `$app/*`
+* directly rather than resolving SvelteKit's on-disk files.
+*
+* The authoritative export surfaces this mirrors:
+*
+* @see https://github.com/sveltejs/kit/tree/main/packages/kit/src/runtime/app
+* @see https://github.com/sveltejs/kit/blob/main/packages/kit/src/types/ambient.d.ts
 */
-function addSvelteKitEnvModules(aliases, cwd) {
-	const workingDir = cwd || process.cwd();
-	aliases["$env/dynamic/private"] = createDataUriModule(createDynamicEnvModule());
-	aliases["$env/dynamic/public"] = createDataUriModule(createDynamicEnvModule());
-	aliases["$env/static/private"] = createDataUriModule(createStaticEnvModule(filterPrivateEnv("PUBLIC_", "")));
-	aliases["$env/static/public"] = createDataUriModule(createStaticEnvModule(filterPublicEnv("PUBLIC_", "")));
-	const svelteKitAliases = getSvelteKitPathAliases(workingDir);
-	Object.assign(aliases, svelteKitAliases);
-}
-function getSvelteKitPathAliases(cwd) {
-	const aliases = {};
-	const packageJsonPath = path.join(cwd, "package.json");
-	const svelteConfigPath = path.join(cwd, "svelte.config.js");
-	const svelteConfigTsPath = path.join(cwd, "svelte.config.ts");
-	let isSvelteKitProject = false;
-	if (fs.existsSync(packageJsonPath)) try {
-		const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, "utf-8"));
-		isSvelteKitProject = !!{
-			...packageJson.dependencies,
-			...packageJson.devDependencies
-		}["@sveltejs/kit"];
-	} catch {}
-	if (!isSvelteKitProject) isSvelteKitProject = fs.existsSync(svelteConfigPath) || fs.existsSync(svelteConfigTsPath);
-	if (!isSvelteKitProject) return aliases;
-	const libPaths = [path.join(cwd, "src", "lib"), path.join(cwd, "lib")];
-	for (const libPath of libPaths) if (fs.existsSync(libPath)) {
-		aliases["$lib"] = libPath;
-		for (const subPath of [
-			"server",
-			"utils",
-			"components",
-			"stores"
-		]) {
-			const subDir = path.join(libPath, subPath);
-			if (fs.existsSync(subDir)) aliases[`$lib/${subPath}`] = subDir;
-		}
-		break;
-	}
-	aliases["$app/server"] = createDataUriModule(createAppServerModule());
-	const customAliases = getSvelteConfigAliases(cwd);
-	Object.assign(aliases, customAliases);
-	return aliases;
-}
-function getSvelteConfigAliases(cwd) {
-	const aliases = {};
-	const configPaths = [path.join(cwd, "svelte.config.js"), path.join(cwd, "svelte.config.ts")];
-	for (const configPath of configPaths) if (fs.existsSync(configPath)) {
-		try {
-			const aliasMatch = fs.readFileSync(configPath, "utf-8").match(/alias\s*:\s*\{([^}]+)\}/);
-			if (aliasMatch && aliasMatch[1]) {
-				const aliasMatches = aliasMatch[1].matchAll(/['"`](\$[^'"`]+)['"`]\s*:\s*['"`]([^'"`]+)['"`]/g);
-				for (const match of aliasMatches) {
-					const [, alias, target] = match;
-					if (alias && target) {
-						aliases[alias + "/*"] = path.resolve(cwd, target) + "/*";
-						aliases[alias] = path.resolve(cwd, target);
-					}
-				}
-			}
-		} catch {}
-		break;
-	}
-	return aliases;
+function addSvelteKitVirtualModules(aliases) {
+	aliases["$env/dynamic/private"] = createStubModule(createDynamicEnvModule("private"));
+	aliases["$env/dynamic/public"] = createStubModule(createDynamicEnvModule("public"));
+	aliases["$env/static/private"] = createStubModule(createStaticEnvModule(filterPrivateEnv("PUBLIC_", "")));
+	aliases["$env/static/public"] = createStubModule(createStaticEnvModule(filterPublicEnv("PUBLIC_", "")));
+	for (const [id, body] of Object.entries(appModuleStubs)) aliases[id] = createStubModule(body);
 }
-function createAppServerModule() {
-	return `
-// $app/server stub for CLI compatibility
-export default {};
-// jiti dirty hack: .unknown
+/**
+* `$app/env` is SvelteKit's alias for `$app/environment` with an identical
+* export surface, so both specifiers share this body.
+* @see https://github.com/sveltejs/kit/pull/15934
+*/
+const environmentStub = `
+export const browser = false;
+export const building = false;
+export const dev = false;
+export const version = "";
 `;
-}
-function createDataUriModule(module) {
-	return `data:text/javascript;charset=utf-8,${encodeURIComponent(module)}`;
+/**
+* Specifier → module source for the inert `$app/*` and `$service-worker`
+* stubs. The bodies do nothing (the CLI never serves a request); they exist
+* only so every name a config might import resolves. Keep each entry aligned
+* with SvelteKit's documented exports.
+* @see https://svelte.dev/docs/kit/$app-environment
+* @see https://svelte.dev/docs/kit/$app-server
+* @see https://svelte.dev/docs/kit/$service-worker
+*/
+const appModuleStubs = {
+	"$app/environment": environmentStub,
+	"$app/env": environmentStub,
+	"$app/server": `
+export function getRequestEvent() {}
+export function read() {}
+export function query() {}
+export function prerender() {}
+export function command() {}
+export function form() {}
+export const requested = false;
+`,
+	"$app/paths": `
+export const base = "";
+export const assets = "";
+export function resolve(path) { return path; }
+export function resolveRoute(path) { return path; }
+export function asset(value) { return value; }
+export async function match() { return null; }
+`,
+	"$app/navigation": `
+export function goto() {}
+export function invalidate() {}
+export function invalidateAll() {}
+export function preloadData() {}
+export function preloadCode() {}
+export function beforeNavigate() {}
+export function afterNavigate() {}
+export function onNavigate() {}
+export function disableScrollHandling() {}
+export function pushState() {}
+export function replaceState() {}
+export function refreshAll() {}
+`,
+	"$app/state": `
+export const page = {};
+export const navigating = {};
+export const updated = { check() { return Promise.resolve(false); } };
+`,
+	"$app/stores": `
+export const page = { subscribe() { return () => {}; } };
+export const navigating = { subscribe() { return () => {}; } };
+export const updated = { subscribe() { return () => {}; }, check() { return Promise.resolve(false); } };
+export function getStores() { return { page, navigating, updated }; }
+`,
+	"$app/forms": `
+export function applyAction() {}
+export function deserialize() {}
+export function enhance() {}
+`,
+	"$service-worker": `
+export const base = "";
+export const build = [];
+export const files = [];
+export const prerendered = [];
+export const version = "";
+`
+};
+/**
+* Wraps a module body as a `data:` URI for use as a jiti alias target. The
+* trailing marker is load-bearing: without an "extension", jiti resolves the
+* alias value as a file path and fails with ENOENT, so the comment gives it an
+* unknown extension and forces a native import instead. (Stubs injected by the
+* Babel plugin in `vite-virtual-modules.ts` set the specifier directly and do
+* not go through alias resolution, so they need no marker.)
+*/
+function createStubModule(body) {
+	const source = `${body}\n// jiti dirty hack: .unknown\n`;
+	return `data:text/javascript;charset=utf-8,${encodeURIComponent(source)}`;
 }
 function createStaticEnvModule(env) {
-	return `
-  ${Object.keys(env).filter((k) => validIdentifier.test(k) && !reserved.has(k)).map((k) => `export const ${k} = ${JSON.stringify(env[k])};`).join("\n")}
-  // jiti dirty hack: .unknown
-  `;
+	return Object.keys(env).filter((k) => validIdentifier.test(k) && !reserved.has(k)).map((k) => `export const ${k} = ${JSON.stringify(env[k])};`).join("\n");
 }
-function createDynamicEnvModule() {
+function createDynamicEnvModule(visibility) {
 	return `
-  export const env = process.env;
-  // jiti dirty hack: .unknown
-  `;
+const keep = (key) => typeof key === "string" && ${visibility === "public" ? `key.startsWith("PUBLIC_")` : `!key.startsWith("PUBLIC_")`};
+export const env = new Proxy(
+  {},
+  {
+    get: (_, key) => (keep(key) ? process.env[key] : undefined),
+    has: (_, key) => keep(key) && key in process.env,
+    ownKeys: () => Object.keys(process.env).filter(keep),
+    getOwnPropertyDescriptor: (_, key) =>
+      keep(key) && key in process.env
+        ? { value: process.env[key], enumerable: true, configurable: true }
+        : undefined,
+  },
+);`;
 }
 function filterPrivateEnv(publicPrefix, privatePrefix) {
 	return Object.fromEntries(Object.entries(process.env).filter(([k]) => k.startsWith(privatePrefix) && (publicPrefix === "" || !k.startsWith(publicPrefix))));
@@ -802,6 +882,50 @@ const reserved = new Set([
 	"instanceof"
 ]);
 //#endregion
+//#region src/utils/vite-virtual-modules.ts
+/**
+* Stub modules for Vite's "special" imports (asset and query-suffixed
+* modules). Vite resolves these through its plugin pipeline at build time; the
+* CLI loads auth configs with jiti, where no such pipeline exists and there is
+* no file on disk to read. Without a substitute, a config that transitively
+* imports e.g. `./logo.svg`, `./app.css?inline`, or `./worker.ts?worker`
+* crashes the loader.
+*
+* Detection mirrors Vite's own classification. The query-suffix patterns are
+* tested against the full specifier, the extension membership against the
+* specifier with its query stripped, and query patterns take precedence over
+* extension membership (so `./a.css?raw` is raw text, not a stylesheet). The
+* regexes are not part of Vite's public API, so they are copied here.
+*
+* @see https://github.com/vitejs/vite/blob/main/packages/vite/src/node/constants.ts
+* @see https://github.com/vitejs/vite/blob/main/packages/vite/src/node/plugins/asset.ts
+*/
+const WORKER_RE = /[?&](?:worker|sharedworker)(?:&|$)/;
+const URL_RE = /[?&]url(?:&|$)/;
+const RAW_RE = /[?&]raw(?:&|$)/;
+const INLINE_RE = /[?&]inline(?:&|$)/;
+const WASM_INIT_RE = /\.wasm\?init\b/;
+const CSS_MODULE_RE = /\.module\.(?:css|less|sass|scss|styl|stylus|pcss|postcss|sss)(?:$|\?)/;
+const CSS_LANGS_RE = /\.(?:css|less|sass|scss|styl|stylus|pcss|postcss|sss)(?:$|\?)/;
+const KNOWN_ASSET_RE = /\.(?:apng|bmp|png|jpe?g|jfif|pjpeg|pjp|gif|svg|ico|webp|avif|cur|jxl|mp4|webm|ogg|mp3|wav|flac|aac|opus|mov|m4a|vtt|woff2?|eot|ttf|otf|webmanifest|pdf|txt)(?:\?.*)?$/i;
+function createDataUriModule(body) {
+	return `data:text/javascript;charset=utf-8,${encodeURIComponent(body)}`;
+}
+/**
+* Returns a data-URI stub module for a Vite special import, or `undefined`
+* when the specifier is an ordinary module that should resolve normally. The
+* stub's runtime shape matches what Vite would emit (a string for raw/url, a
+* worker constructor, a class-name proxy for CSS Modules, and so on).
+*/
+function getViteAssetStub(specifier) {
+	if (WORKER_RE.test(specifier)) return createDataUriModule(URL_RE.test(specifier) ? `export default "";` : `export default function () {};`);
+	if (WASM_INIT_RE.test(specifier)) return createDataUriModule(`export default async () => ({ exports: {} });`);
+	if (RAW_RE.test(specifier) || INLINE_RE.test(specifier) || URL_RE.test(specifier)) return createDataUriModule(`export default "";`);
+	if (CSS_MODULE_RE.test(specifier)) return createDataUriModule(`export default new Proxy({}, { get: (_, key) => String(key) });`);
+	if (CSS_LANGS_RE.test(specifier)) return createDataUriModule(`export default undefined;`);
+	if (KNOWN_ASSET_RE.test(specifier)) return createDataUriModule(`export default "";`);
+}
+//#endregion
 //#region src/utils/get-config.ts
 let possiblePaths$1 = [
 	"auth.ts",
@@ -943,6 +1067,11 @@ function createRewriteImportPathsPlugin(matchers) {
 	return ({ types: t }) => {
 		const rewrite = (source) => {
 			if (!source) return;
+			const stub = getViteAssetStub(source.value);
+			if (stub) {
+				source.value = stub;
+				return;
+			}
 			const resolved = resolveWithMatchers(source.value, matchers);
 			if (resolved) source.value = resolved;
 		};
@@ -972,16 +1101,15 @@ function createRewriteImportPathsPlugin(matchers) {
 /** Virtual module aliases; real tsconfig paths go through the babel plugin. */
 function getVirtualModuleAliases() {
 	const result = {};
-	addSvelteKitEnvModules(result);
-	addCloudflareModules(result);
+	addSvelteKitVirtualModules(result);
+	addCloudflareVirtualModules(result);
 	return result;
 }
 /**
 * .tsx files are not supported by Jiti.
 */
 const jitiOptions = (cwd) => {
-	const matchers = collectPathsMatchers(cwd);
-	const plugins = matchers.length > 0 ? [createRewriteImportPathsPlugin(matchers)] : [];
+	const plugins = [createRewriteImportPathsPlugin(collectPathsMatchers(cwd))];
 	return {
 		transformOptions: { babel: {
 			presets: [[babelPresetTypeScript, {
@@ -1282,6 +1410,10 @@ const generateDrizzleSchema = async ({ options, file, adapter }) => {
 				if (attr.type === "date" && attr.defaultValue.toString().includes("new Date()")) if (databaseType === "sqlite") type += `.default(sql\`(cast(unixepoch('subsecond') * 1000 as integer))\`)`;
 				else type += `.defaultNow()`;
 			} else if (typeof attr.defaultValue === "string") type += `.default("${attr.defaultValue}")`;
+			else if (Array.isArray(attr.defaultValue)) {
+				const elements = attr.defaultValue.map((value) => JSON.stringify(value)).join(", ");
+				type += `.default([${elements}])`;
+			} else if (typeof attr.defaultValue === "object" && attr.defaultValue !== null) type += `.default(${JSON.stringify(attr.defaultValue)})`;
 			else type += `.default(${attr.defaultValue})`;
 			if (attr.onUpdate && attr.type === "date") {
 				if (typeof attr.onUpdate === "function") type += `.$onUpdate(${attr.onUpdate})`;
@@ -1638,6 +1770,16 @@ const generatePrismaSchema = async ({ adapter, options, file }) => {
 					return "Int[]";
 				}
 			}
+			function getFieldTypeParts(type) {
+				const isArray = type.endsWith("[]");
+				const typeWithoutArray = isArray ? type.slice(0, -2) : type;
+				const isOptional = typeWithoutArray.endsWith("?");
+				return {
+					fieldType: isOptional ? typeWithoutArray.slice(0, -1) : typeWithoutArray,
+					isArray,
+					isOptional
+				};
+			}
 			const prismaModel = builder.findByType("model", { name: modelName });
 			if (!prismaModel) if (provider === "mongodb") builder.model(modelName).field("id", "String").attribute("id").attribute(`map("_id")`);
 			else {
@@ -1650,15 +1792,9 @@ const generatePrismaSchema = async ({ adapter, options, file }) => {
 			for (const field in fields) {
 				const attr = fields[field];
 				const fieldName = attr.fieldName || field;
-				if (prismaModel) {
-					if (builder.findByType("field", {
-						name: fieldName,
-						within: prismaModel.properties
-					})) continue;
-				}
 				const useUUIDs = options.advanced?.database?.generateId === "uuid";
 				const useNumberId = options.advanced?.database?.generateId === "serial";
-				const fieldBuilder = builder.model(modelName).field(fieldName, field === "id" && useNumberId ? getType({
+				const fieldType = field === "id" && useNumberId ? getType({
 					isBigint: false,
 					isOptional: false,
 					type: "number"
@@ -1666,12 +1802,33 @@ const generatePrismaSchema = async ({ adapter, options, file }) => {
 					isBigint: attr?.bigint || false,
 					isOptional: attr?.required === false,
 					type: attr.references?.field === "id" ? useNumberId ? "number" : "string" : attr.type
-				}));
+				});
+				if (prismaModel) {
+					const isAlreadyExist = builder.findByType("field", {
+						name: fieldName,
+						within: prismaModel.properties
+					});
+					if (isAlreadyExist) {
+						if (fieldType && typeof isAlreadyExist.fieldType === "string") {
+							const fieldTypeParts = getFieldTypeParts(fieldType);
+							const existingFieldTypeParts = getFieldTypeParts(isAlreadyExist.fieldType);
+							if ((existingFieldTypeParts.fieldType === "Int" || existingFieldTypeParts.fieldType === "BigInt") && (fieldTypeParts.fieldType === "Int" || fieldTypeParts.fieldType === "BigInt")) {
+								isAlreadyExist.fieldType = fieldTypeParts.fieldType;
+								isAlreadyExist.optional = fieldTypeParts.isOptional || void 0;
+								isAlreadyExist.array = fieldTypeParts.isArray || void 0;
+							}
+						}
+						continue;
+					}
+				}
+				if (!fieldType) throw new Error(`Unsupported Prisma field type for model "${modelName}", field "${fieldName}"${attr.type ? ` (source type: "${attr.type}")` : ""}.`);
+				const fieldBuilder = builder.model(modelName).field(fieldName, fieldType);
 				if (field === "id") {
 					fieldBuilder.attribute("id");
 					if (provider === "mongodb") fieldBuilder.attribute(`map("_id")`);
 				}
 				if (attr.unique) builder.model(modelName).blockAttribute(`unique([${fieldName}])`);
+				if ((attr.type === "string[]" || attr.type === "number[]") && provider !== "sqlite" && provider !== "mysql" && attr.defaultValue === void 0) fieldBuilder.attribute("default([])");
 				if (attr.defaultValue !== void 0) {
 					if (Array.isArray(attr.defaultValue)) {
 						if (attr.type === "json") {
@@ -1848,6 +2005,9 @@ function createMockAdapter$1(adapterId, dialect) {
 		consumeOne: async () => {
 			throw new Error("Mock adapter methods should not be called");
 		},
+		incrementOne: async () => {
+			throw new Error("Mock adapter methods should not be called");
+		},
 		transaction: async (callback) => {
 			throw new Error("Mock adapter methods should not be called");
 		},
@@ -1857,6 +2017,19 @@ function createMockAdapter$1(adapterId, dialect) {
 		}
 	};
 }
+function getDefaultSchemaOutputFileName(adapterId, now = /* @__PURE__ */ new Date()) {
+	if (adapterId === "prisma") return "schema.prisma";
+	if (adapterId === "kysely") return `${now.toISOString().replace(/:/g, "-")}.sql`;
+	return "auth-schema.ts";
+}
+async function resolveSchemaOutputPath({ cwd, output, adapterId, now = /* @__PURE__ */ new Date() }) {
+	if (!output) return output;
+	const resolvedOutput = path.resolve(cwd, output);
+	try {
+		if ((await fs$1.stat(resolvedOutput)).isDirectory()) return path.join(output, getDefaultSchemaOutputFileName(adapterId, now));
+	} catch {}
+	return output;
+}
 async function generateAction(opts) {
 	const options = z.object({
 		cwd: z.string(),
@@ -1886,6 +2059,11 @@ async function generateAction(opts) {
 		console.error(e.message);
 		process.exit(1);
 	});
+	options.output = await resolveSchemaOutputPath({
+		cwd,
+		output: options.output,
+		adapterId: adapter.id
+	});
 	const spinner = yoctoSpinner({ text: "preparing schema..." }).start();
 	const schema = await generateSchema({
 		adapter,
@@ -2109,6 +2287,8 @@ function sanitizeBetterAuthConfig(config) {
 	const sanitized = JSON.parse(JSON.stringify(config));
 	const sensitiveKeys = [
 		"secret",
+		"secrets",
+		"secretKey",
 		"clientSecret",
 		"clientId",
 		"authToken",
@@ -2162,6 +2342,7 @@ function sanitizeBetterAuthConfig(config) {
 				const lowerSensitiveKey = sensitiveKey.toLowerCase();
 				return lowerKey === lowerSensitiveKey || lowerKey.endsWith(lowerSensitiveKey);
 			})) if (typeof value === "string" && value.length > 0) result[key] = "[REDACTED]";
+			else if (Array.isArray(value)) result[key] = "[REDACTED]";
 			else if (typeof value === "object" && value !== null) result[key] = redactSensitive(value, key);
 			else result[key] = value;
 			else result[key] = redactSensitive(value, key);
@@ -3689,25 +3870,6 @@ const tempPluginsConfig = {
 			}]
 		}
 	},
-	oidc: {
-		displayName: "OIDC",
-		auth: {
-			function: "oidc",
-			imports: [{
-				path: "better-auth/plugins",
-				imports: [createImport({ name: "oidc" })],
-				isNamedImport: false
-			}]
-		},
-		authClient: {
-			function: "oidcClient",
-			imports: [{
-				path: "better-auth/client/plugins",
-				imports: [createImport({ name: "oidcClient" })],
-				isNamedImport: false
-			}]
-		}
-	},
 	admin: {
 		displayName: "Admin",
 		auth: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auth",
-  "version": "1.7.0-beta.4",
+  "version": "1.7.0-beta.6",
   "description": "The CLI for Better Auth",
   "type": "module",
   "license": "MIT",
@@ -46,7 +46,7 @@
     "@babel/core": "^7.29.0",
     "@babel/preset-react": "^7.28.5",
     "@babel/preset-typescript": "^7.28.5",
-    "@better-auth/utils": "0.4.1",
+    "@better-auth/utils": "0.4.2",
     "@clack/prompts": "^0.11.0",
     "@mrleebo/prisma-ast": "^0.13.1",
     "c12": "^4.0.0-beta.5",
@@ -61,9 +61,9 @@
     "semver": "^7.7.4",
     "yocto-spinner": "^0.2.3",
     "zod": "^4.3.6",
-    "@better-auth/core": "1.7.0-beta.4",
-    "@better-auth/telemetry": "1.7.0-beta.4",
-    "better-auth": "1.7.0-beta.4"
+    "@better-auth/core": "1.7.0-beta.6",
+    "@better-auth/telemetry": "1.7.0-beta.6",
+    "better-auth": "1.7.0-beta.6"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.13",
@@ -75,7 +75,7 @@
     "tsx": "^4.21.0",
     "type-fest": "^5.4.4",
     "typescript": "^5.9.3",
-    "@better-auth/passkey": "1.7.0-beta.4"
+    "@better-auth/passkey": "1.7.0-beta.6"
   },
   "scripts": {
     "build": "tsdown",