payload-better-auth 1.0.0

package/dist/better-auth/reconcile-queue.d.ts

@@ -0,0 +1,70 @@
+import type { AuthContext } from 'better-auth';
+import type { BAUser, PayloadUser } from './sources.js';
+export interface QueueDeps {
+    deleteUserFromPayload: (baId: string) => Promise<void>;
+    internalAdapter: AuthContext['internalAdapter'];
+    listPayloadUsersPage: (limit: number, page: number) => Promise<{
+        hasNextPage: boolean;
+        total: number;
+        users: PayloadUser[];
+    }>;
+    log?: (msg: string, extra?: any) => void;
+    prunePayloadOrphans?: boolean;
+    syncUserToPayload: (baUser: BAUser) => Promise<void>;
+}
+export type TaskSource = 'full-reconcile' | 'user-operation';
+export interface InitOptions {
+    forceReset?: boolean;
+    reconcileEveryMs?: number;
+    runOnBoot?: boolean;
+    tickMs?: number;
+}
+export declare class Queue {
+    private bootstrapState;
+    private deps;
+    private failed;
+    private keys;
+    private lastError;
+    private lastSeedAt;
+    private processed;
+    private processing;
+    private q;
+    private reconcileEveryMs;
+    private reconcileTimeout;
+    private reconciling;
+    private tickTimer;
+    constructor(deps: QueueDeps, opts?: InitOptions);
+    private bumpFront;
+    /** Clear all full-reconcile tasks from the queue, preserving user-operation tasks */
+    private clearFullReconcileTasks;
+    private enqueue;
+    private listBAUsersPage;
+    private runTask;
+    private scheduleNextReconcile;
+    /** Paginated approach: process users page by page to reduce memory usage */
+    private seedFullReconcilePaginated;
+    private tick;
+    enqueueDelete(baId: string, priority?: boolean, source?: TaskSource, reconcileId?: string): void;
+    enqueueEnsure(user: BAUser, priority?: boolean, source?: TaskSource, reconcileId?: string): void;
+    getInstanceInfo(): {
+        isBootstrapped: boolean;
+    };
+    /** Seed tasks by comparing users page by page (Better-Auth → Payload). */
+    seedFullReconcile(): Promise<void>;
+    start({ reconcileEveryMs, tickMs }?: {
+        reconcileEveryMs?: number | undefined;
+        tickMs?: number | undefined;
+    }): void;
+    status(): {
+        failed: number;
+        fullReconcileTasks: number;
+        lastError: string | null;
+        lastSeedAt: string | null;
+        processed: number;
+        processing: boolean;
+        queueSize: number;
+        reconciling: boolean;
+        sampleKeys: string[];
+        userOperationTasks: number;
+    };
+}

package/dist/better-auth/reconcile-queue.js

@@ -0,0 +1,311 @@
+const KEY = (t)=>`${t.kind}:${t.baId}`;
+export class Queue {
+    // Bootstrap state stored directly on the queue instance
+    bootstrapState = {
+        adminHeaders: null,
+        bootstrapPromise: null,
+        isBootstrapped: false
+    };
+    deps;
+    failed = 0;
+    keys = new Map();
+    lastError = null;
+    lastSeedAt = null;
+    processed = 0;
+    processing = false;
+    q = [];
+    reconcileEveryMs = 30 * 60_000 // default 30 minutes
+    ;
+    reconcileTimeout = null;
+    reconciling = false;
+    tickTimer = null;
+    constructor(deps, opts = {}){
+        this.deps = deps;
+        const log = this.deps?.log ?? (()=>{});
+        // Start bootstrap process - but defer heavy operations
+        log('Starting bootstrap process...');
+        // Start timers but don't run reconcile immediately
+        this.start({
+            reconcileEveryMs: opts?.reconcileEveryMs ?? 30 * 60_000,
+            tickMs: opts?.tickMs ?? 1000
+        });
+        // Defer the initial reconcile to avoid circular dependency issues
+        if (opts?.runOnBoot ?? true) {
+            // Use setTimeout instead of queueMicrotask to give more time for initialization
+            setTimeout(()=>{
+                this.seedFullReconcile().catch((err)=>console.error('[reconcile] seed failed', err));
+            }, 2000); // 2 second delay to allow Better Auth and Payload to fully initialize
+        }
+        log('Bootstrap process completed');
+    }
+    bumpFront(task) {
+        this.q = [
+            task,
+            ...this.q.filter((t)=>t !== task)
+        ];
+    }
+    /** Clear all full-reconcile tasks from the queue, preserving user-operation tasks */ clearFullReconcileTasks() {
+        const log = this.deps?.log ?? (()=>{});
+        const beforeCount = this.q.length;
+        const fullReconcileCount = this.q.filter((t)=>t.source === 'full-reconcile').length;
+        // Remove full-reconcile tasks from queue and keys map
+        this.q = this.q.filter((task)=>{
+            if (task.source === 'full-reconcile') {
+                this.keys.delete(KEY(task));
+                return false;
+            }
+            return true;
+        });
+        const afterCount = this.q.length;
+        log('reconcile.clear-previous', {
+            afterCount,
+            beforeCount,
+            clearedFullReconcile: fullReconcileCount,
+            preservedUserOps: afterCount
+        });
+    }
+    // ——— Internals ———
+    enqueue(task, priority) {
+        const k = KEY(task);
+        const existing = this.keys.get(k);
+        if (existing) {
+            if (task.kind === 'ensure' && existing.kind === 'ensure' && !existing.baUser && task.baUser) {
+                existing.baUser = task.baUser;
+            }
+            if (priority) {
+                this.bumpFront(existing);
+            }
+            return;
+        }
+        if (priority) {
+            this.q.unshift(task);
+        } else {
+            this.q.push(task);
+        }
+        this.keys.set(k, task);
+    }
+    async listBAUsersPage({ limit, offset }) {
+        // sort by newest (used) first
+        // when a delete is happening in the meantime, this will lead to some users not being listed (as the index changes)
+        // TODO: fix this by maintaining a delete list.
+        const total = await this.deps.internalAdapter.countTotalUsers();
+        const users = await this.deps.internalAdapter.listUsers(limit, offset, {
+            direction: 'desc',
+            field: 'updatedAt'
+        });
+        return {
+            total,
+            users
+        };
+    }
+    async runTask(t) {
+        const log = this.deps?.log ?? (()=>{});
+        if (t.kind === 'ensure') {
+            log('queue.ensure', {
+                attempts: t.attempts,
+                baId: t.baId
+            });
+            await this.deps.syncUserToPayload(t.baUser ?? {
+                id: t.baId
+            });
+            return;
+        }
+        // delete
+        log('queue.delete', {
+            attempts: t.attempts,
+            baId: t.baId
+        });
+        await this.deps.deleteUserFromPayload(t.baId);
+    }
+    scheduleNextReconcile() {
+        if (this.reconcileTimeout) {
+            clearTimeout(this.reconcileTimeout);
+        }
+        this.reconcileTimeout = setTimeout(async ()=>{
+            if (!this.reconciling) {
+                this.reconciling = true;
+                try {
+                    await this.seedFullReconcile();
+                } catch (error) {
+                // Error is already logged in seedFullReconcile
+                } finally{
+                    this.reconciling = false;
+                    // Schedule the next reconcile after this one completes
+                    this.scheduleNextReconcile();
+                }
+            }
+        }, this.reconcileEveryMs);
+        // Optional unref for Node.js environments to prevent keeping process alive
+        if ('unref' in this.reconcileTimeout && typeof this.reconcileTimeout.unref === 'function') {
+            this.reconcileTimeout.unref();
+        }
+    }
+    /** Paginated approach: process users page by page to reduce memory usage */ async seedFullReconcilePaginated(reconcileId) {
+        const log = this.deps?.log ?? (()=>{});
+        const pageSize = 500;
+        let baIdSet = null;
+        // If we need to prune orphans, we need to collect all BA user IDs
+        if (this.deps.prunePayloadOrphans) {
+            baIdSet = new Set();
+            let baOffset = 0;
+            let baTotal = 0;
+            do {
+                const { total, users: baUsers } = await this.listBAUsersPage({
+                    limit: pageSize,
+                    offset: baOffset
+                });
+                baTotal = total;
+                // Enqueue ensure tasks for this page with full-reconcile source
+                for (const u of baUsers){
+                    this.enqueueEnsure(u, false, 'full-reconcile', reconcileId);
+                    baIdSet.add(u.id);
+                }
+                baOffset += baUsers.length;
+                log('reconcile.seed.ba-page', {
+                    processed: baOffset,
+                    reconcileId,
+                    total: baTotal
+                });
+            }while (baOffset < baTotal)
+        } else {
+            // If not pruning, we can process BA users page by page without storing IDs
+            let baOffset = 0;
+            let baTotal = 0;
+            do {
+                // TODO: make sure that we dont go past the window through deletes happening
+                // (As a user deletes, the total window size becomes smaller)
+                const { total, users: baUsers } = await this.listBAUsersPage({
+                    limit: pageSize,
+                    offset: baOffset
+                });
+                baTotal = total;
+                // Enqueue ensure tasks for this page with full-reconcile source
+                for (const u of baUsers){
+                    this.enqueueEnsure(u, false, 'full-reconcile', reconcileId);
+                }
+                baOffset += baUsers.length;
+                log('reconcile.seed.ba-page', {
+                    processed: baOffset,
+                    reconcileId,
+                    total: baTotal
+                });
+            }while (baOffset < baTotal)
+        }
+        // Process Payload users page by page for orphan pruning
+        if (this.deps.prunePayloadOrphans && baIdSet) {
+            let payloadPage = 1;
+            let hasNextPage = true;
+            while(hasNextPage){
+                const { hasNextPage: nextPage, users: pUsers } = await this.deps.listPayloadUsersPage(pageSize, payloadPage);
+                hasNextPage = nextPage;
+                for (const pu of pUsers){
+                    const ext = pu.externalId?.toString();
+                    if (ext && !baIdSet.has(ext)) {
+                        this.enqueueDelete(ext, false, 'full-reconcile', reconcileId);
+                    }
+                }
+                payloadPage++;
+                log('reconcile.seed.payload-page', {
+                    page: payloadPage - 1,
+                    reconcileId
+                });
+            }
+        }
+    }
+    async tick() {
+        if (this.processing) {
+            return;
+        }
+        const now = Date.now();
+        const idx = this.q.findIndex((t)=>t.nextAt <= now);
+        if (idx === -1) {
+            return;
+        }
+        const task = this.q[idx];
+        this.processing = true;
+        try {
+            await this.runTask(task);
+            this.q.splice(idx, 1);
+            this.keys.delete(KEY(task));
+            this.processed++;
+        } catch (e) {
+            this.failed++;
+            this.lastError = e?.message ?? String(e);
+            task.attempts += 1;
+            const delay = Math.min(60_000, Math.pow(2, task.attempts) * 1000) + Math.floor(Math.random() * 500);
+            task.nextAt = now + delay;
+        } finally{
+            this.processing = false;
+        }
+    }
+    enqueueDelete(baId, priority = false, source = 'user-operation', reconcileId) {
+        this.enqueue({
+            attempts: 0,
+            baId,
+            kind: 'delete',
+            nextAt: Date.now(),
+            reconcileId,
+            source
+        }, priority);
+    }
+    // ——— Public enqueue API ———
+    enqueueEnsure(user, priority = false, source = 'user-operation', reconcileId) {
+        this.enqueue({
+            attempts: 0,
+            baId: user.id,
+            baUser: user,
+            kind: 'ensure',
+            nextAt: Date.now(),
+            reconcileId,
+            source
+        }, priority);
+    }
+    // Get current instance info
+    getInstanceInfo() {
+        return {
+            isBootstrapped: this.bootstrapState.isBootstrapped
+        };
+    }
+    /** Seed tasks by comparing users page by page (Better-Auth → Payload). */ async seedFullReconcile() {
+        const log = this.deps?.log ?? (()=>{});
+        this.lastSeedAt = new Date().toISOString();
+        const reconcileId = `reconcile-${Date.now()}-${Math.random().toString(36).substr(2, 9)}`;
+        log('reconcile.seed.start', {
+            reconcileId
+        });
+        // Clear all previous full-reconcile tasks, but preserve user-operation tasks
+        this.clearFullReconcileTasks();
+        await this.seedFullReconcilePaginated(reconcileId);
+        log('reconcile.seed.done', this.status());
+    }
+    start({ reconcileEveryMs = 30 * 60_000, tickMs = 1000 } = {}) {
+        this.reconcileEveryMs = reconcileEveryMs;
+        if (!this.tickTimer) {
+            this.tickTimer = setInterval(()=>this.tick(), tickMs);
+            // Optional unref for Node.js environments to prevent keeping process alive
+            if ('unref' in this.tickTimer && typeof this.tickTimer.unref === 'function') {
+                this.tickTimer.unref();
+            }
+        }
+        // Schedule the first reconcile
+        this.scheduleNextReconcile();
+    }
+    status() {
+        const userOpCount = this.q.filter((t)=>t.source === 'user-operation').length;
+        const fullReconcileCount = this.q.filter((t)=>t.source === 'full-reconcile').length;
+        return {
+            failed: this.failed,
+            fullReconcileTasks: fullReconcileCount,
+            lastError: this.lastError,
+            lastSeedAt: this.lastSeedAt,
+            processed: this.processed,
+            processing: this.processing,
+            queueSize: this.q.length,
+            reconciling: this.reconciling,
+            sampleKeys: Array.from(this.keys.keys()).slice(0, 50),
+            userOperationTasks: userOpCount
+        };
+    }
+}
+
+//# sourceMappingURL=reconcile-queue.js.map

package/dist/better-auth/reconcile-queue.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/better-auth/reconcile-queue.ts"],"sourcesContent":["import type { AuthContext } from 'better-auth'\n\n// src/reconcile-queue.ts\nimport type { BAUser, PayloadUser } from './sources.js'\n\nexport interface QueueDeps {\n  deleteUserFromPayload: (baId: string) => Promise<void> // delete by externalId; ignore missing\n  internalAdapter: AuthContext['internalAdapter']\n\n  // Paginated loaders (efficient processing)\n  listPayloadUsersPage: (\n    limit: number,\n    page: number,\n  ) => Promise<{ hasNextPage: boolean; total: number; users: PayloadUser[] }>\n  // Logging\n  log?: (msg: string, extra?: any) => void\n\n  // Policy\n  prunePayloadOrphans?: boolean // default: false\n\n  // Idempotent effects (via Payload Local API)\n  syncUserToPayload: (baUser: BAUser) => Promise<void> // upsert by externalId=baUser.id\n}\n\nexport type TaskSource = 'full-reconcile' | 'user-operation'\n\n// Bootstrap options interface\nexport interface InitOptions {\n  forceReset?: boolean\n  reconcileEveryMs?: number\n  runOnBoot?: boolean\n  tickMs?: number\n}\n\n// Simplified bootstrap state interface (removed processId)\ninterface BootstrapState {\n  adminHeaders: Headers | null\n  bootstrapPromise: null | Promise<void>\n  isBootstrapped: boolean\n}\n\ntype Task =\n  | {\n      attempts: number\n      baId: string\n      baUser?: BAUser\n      kind: 'ensure'\n      nextAt: number\n      reconcileId?: string\n      source: TaskSource\n    }\n  | {\n      attempts: number\n      baId: string\n      kind: 'delete'\n      nextAt: number\n      reconcileId?: string\n      source: TaskSource\n    }\n\nconst KEY = (t: Task) => `${t.kind}:${t.baId}`\n\nexport class Queue {\n  // Bootstrap state stored directly on the queue instance\n  private bootstrapState: BootstrapState = {\n    adminHeaders: null,\n    bootstrapPromise: null,\n    isBootstrapped: false,\n  }\n  private deps!: QueueDeps\n  private failed = 0\n  private keys = new Map<string, Task>()\n  private lastError: null | string = null\n  private lastSeedAt: null | string = null\n  private processed = 0\n\n  private processing = false\n  private q: Task[] = []\n  private reconcileEveryMs = 30 * 60_000 // default 30 minutes\n  private reconcileTimeout: NodeJS.Timeout | null = null\n  private reconciling = false\n\n  private tickTimer: NodeJS.Timeout | null = null\n\n  constructor(deps: QueueDeps, opts: InitOptions = {}) {\n    this.deps = deps\n    const log = this.deps?.log ?? (() => {})\n    // Start bootstrap process - but defer heavy operations\n    log('Starting bootstrap process...')\n\n    // Start timers but don't run reconcile immediately\n    this.start({\n      reconcileEveryMs: opts?.reconcileEveryMs ?? 30 * 60_000,\n      tickMs: opts?.tickMs ?? 1000,\n    })\n\n    // Defer the initial reconcile to avoid circular dependency issues\n    if (opts?.runOnBoot ?? true) {\n      // Use setTimeout instead of queueMicrotask to give more time for initialization\n      setTimeout(() => {\n        this.seedFullReconcile().catch((err) => console.error('[reconcile] seed failed', err))\n      }, 2000) // 2 second delay to allow Better Auth and Payload to fully initialize\n    }\n\n    log('Bootstrap process completed')\n  }\n\n  private bumpFront(task: Task) {\n    this.q = [task, ...this.q.filter((t) => t !== task)]\n  }\n\n  /** Clear all full-reconcile tasks from the queue, preserving user-operation tasks */\n  private clearFullReconcileTasks() {\n    const log = this.deps?.log ?? (() => {})\n    const beforeCount = this.q.length\n    const fullReconcileCount = this.q.filter((t) => t.source === 'full-reconcile').length\n\n    // Remove full-reconcile tasks from queue and keys map\n    this.q = this.q.filter((task) => {\n      if (task.source === 'full-reconcile') {\n        this.keys.delete(KEY(task))\n        return false\n      }\n      return true\n    })\n\n    const afterCount = this.q.length\n    log('reconcile.clear-previous', {\n      afterCount,\n      beforeCount,\n      clearedFullReconcile: fullReconcileCount,\n      preservedUserOps: afterCount,\n    })\n  }\n\n  // ——— Internals ———\n  private enqueue(task: Task, priority: boolean) {\n    const k = KEY(task)\n    const existing = this.keys.get(k)\n    if (existing) {\n      if (task.kind === 'ensure' && existing.kind === 'ensure' && !existing.baUser && task.baUser) {\n        existing.baUser = task.baUser\n      }\n      if (priority) {\n        this.bumpFront(existing)\n      }\n      return\n    }\n    if (priority) {\n      this.q.unshift(task)\n    } else {\n      this.q.push(task)\n    }\n    this.keys.set(k, task)\n  }\n\n  private async listBAUsersPage({ limit, offset }: { limit: number; offset: number }) {\n    // sort by newest (used) first\n    // when a delete is happening in the meantime, this will lead to some users not being listed (as the index changes)\n    // TODO: fix this by maintaining a delete list.\n    const total = await this.deps.internalAdapter.countTotalUsers()\n    const users = await this.deps.internalAdapter.listUsers(limit, offset, {\n      direction: 'desc',\n      field: 'updatedAt',\n    })\n    return { total, users }\n  }\n\n  private async runTask(t: Task) {\n    const log = this.deps?.log ?? (() => {})\n    if (t.kind === 'ensure') {\n      log('queue.ensure', { attempts: t.attempts, baId: t.baId })\n      await this.deps.syncUserToPayload(t.baUser ?? { id: t.baId })\n      return\n    }\n    // delete\n    log('queue.delete', { attempts: t.attempts, baId: t.baId })\n    await this.deps.deleteUserFromPayload(t.baId)\n  }\n  private scheduleNextReconcile() {\n    if (this.reconcileTimeout) {\n      clearTimeout(this.reconcileTimeout)\n    }\n\n    this.reconcileTimeout = setTimeout(async () => {\n      if (!this.reconciling) {\n        this.reconciling = true\n        try {\n          await this.seedFullReconcile()\n        } catch (error) {\n          // Error is already logged in seedFullReconcile\n        } finally {\n          this.reconciling = false\n          // Schedule the next reconcile after this one completes\n          this.scheduleNextReconcile()\n        }\n      }\n    }, this.reconcileEveryMs)\n\n    // Optional unref for Node.js environments to prevent keeping process alive\n    if ('unref' in this.reconcileTimeout && typeof this.reconcileTimeout.unref === 'function') {\n      this.reconcileTimeout.unref()\n    }\n  }\n\n  /** Paginated approach: process users page by page to reduce memory usage */\n  private async seedFullReconcilePaginated(reconcileId: string) {\n    const log = this.deps?.log ?? (() => {})\n    const pageSize = 500\n    let baIdSet: null | Set<string> = null\n\n    // If we need to prune orphans, we need to collect all BA user IDs\n    if (this.deps.prunePayloadOrphans) {\n      baIdSet = new Set<string>()\n      let baOffset = 0\n      let baTotal = 0\n\n      do {\n        const { total, users: baUsers } = await this.listBAUsersPage({\n          limit: pageSize,\n          offset: baOffset,\n        })\n        baTotal = total\n\n        // Enqueue ensure tasks for this page with full-reconcile source\n        for (const u of baUsers) {\n          this.enqueueEnsure(u, false, 'full-reconcile', reconcileId)\n          baIdSet.add(u.id)\n        }\n\n        baOffset += baUsers.length\n        log('reconcile.seed.ba-page', { processed: baOffset, reconcileId, total: baTotal })\n      } while (baOffset < baTotal)\n    } else {\n      // If not pruning, we can process BA users page by page without storing IDs\n      let baOffset = 0\n      let baTotal = 0\n\n      do {\n        // TODO: make sure that we dont go past the window through deletes happening\n        // (As a user deletes, the total window size becomes smaller)\n        const { total, users: baUsers } = await this.listBAUsersPage({\n          limit: pageSize,\n          offset: baOffset,\n        })\n        baTotal = total\n\n        // Enqueue ensure tasks for this page with full-reconcile source\n        for (const u of baUsers) {\n          this.enqueueEnsure(u, false, 'full-reconcile', reconcileId)\n        }\n\n        baOffset += baUsers.length\n        log('reconcile.seed.ba-page', { processed: baOffset, reconcileId, total: baTotal })\n      } while (baOffset < baTotal)\n    }\n\n    // Process Payload users page by page for orphan pruning\n    if (this.deps.prunePayloadOrphans && baIdSet) {\n      let payloadPage = 1\n      let hasNextPage = true\n\n      while (hasNextPage) {\n        const { hasNextPage: nextPage, users: pUsers } = await this.deps.listPayloadUsersPage(\n          pageSize,\n          payloadPage,\n        )\n        hasNextPage = nextPage\n\n        for (const pu of pUsers) {\n          const ext = pu.externalId?.toString()\n          if (ext && !baIdSet.has(ext)) {\n            this.enqueueDelete(ext, false, 'full-reconcile', reconcileId)\n          }\n        }\n\n        payloadPage++\n        log('reconcile.seed.payload-page', { page: payloadPage - 1, reconcileId })\n      }\n    }\n  }\n\n  private async tick() {\n    if (this.processing) {\n      return\n    }\n    const now = Date.now()\n    const idx = this.q.findIndex((t) => t.nextAt <= now)\n    if (idx === -1) {\n      return\n    }\n    const task = this.q[idx]\n    this.processing = true\n    try {\n      await this.runTask(task)\n      this.q.splice(idx, 1)\n      this.keys.delete(KEY(task))\n      this.processed++\n    } catch (e: any) {\n      this.failed++\n      this.lastError = e?.message ?? String(e)\n      task.attempts += 1\n      const delay =\n        Math.min(60_000, Math.pow(2, task.attempts) * 1000) + Math.floor(Math.random() * 500)\n      task.nextAt = now + delay\n    } finally {\n      this.processing = false\n    }\n  }\n\n  enqueueDelete(\n    baId: string,\n    priority = false,\n    source: TaskSource = 'user-operation',\n    reconcileId?: string,\n  ) {\n    this.enqueue(\n      { attempts: 0, baId, kind: 'delete', nextAt: Date.now(), reconcileId, source },\n      priority,\n    )\n  }\n\n  // ——— Public enqueue API ———\n  enqueueEnsure(\n    user: BAUser,\n    priority = false,\n    source: TaskSource = 'user-operation',\n    reconcileId?: string,\n  ) {\n    this.enqueue(\n      {\n        attempts: 0,\n        baId: user.id,\n        baUser: user,\n        kind: 'ensure',\n        nextAt: Date.now(),\n        reconcileId,\n        source,\n      },\n      priority,\n    )\n  }\n\n  // Get current instance info\n  getInstanceInfo() {\n    return {\n      isBootstrapped: this.bootstrapState.isBootstrapped,\n    }\n  }\n\n  /** Seed tasks by comparing users page by page (Better-Auth → Payload). */\n  async seedFullReconcile() {\n    const log = this.deps?.log ?? (() => {})\n    this.lastSeedAt = new Date().toISOString()\n    const reconcileId = `reconcile-${Date.now()}-${Math.random().toString(36).substr(2, 9)}`\n\n    log('reconcile.seed.start', { reconcileId })\n\n    // Clear all previous full-reconcile tasks, but preserve user-operation tasks\n    this.clearFullReconcileTasks()\n\n    await this.seedFullReconcilePaginated(reconcileId)\n\n    log('reconcile.seed.done', this.status())\n  }\n\n  start({ reconcileEveryMs = 30 * 60_000, tickMs = 1000 } = {}) {\n    this.reconcileEveryMs = reconcileEveryMs\n\n    if (!this.tickTimer) {\n      this.tickTimer = setInterval(() => this.tick(), tickMs)\n      // Optional unref for Node.js environments to prevent keeping process alive\n      if ('unref' in this.tickTimer && typeof this.tickTimer.unref === 'function') {\n        this.tickTimer.unref()\n      }\n    }\n\n    // Schedule the first reconcile\n    this.scheduleNextReconcile()\n  }\n\n  status() {\n    const userOpCount = this.q.filter((t) => t.source === 'user-operation').length\n    const fullReconcileCount = this.q.filter((t) => t.source === 'full-reconcile').length\n\n    return {\n      failed: this.failed,\n      fullReconcileTasks: fullReconcileCount,\n      lastError: this.lastError,\n      lastSeedAt: this.lastSeedAt,\n      processed: this.processed,\n      processing: this.processing,\n      queueSize: this.q.length,\n      reconciling: this.reconciling,\n      sampleKeys: Array.from(this.keys.keys()).slice(0, 50),\n      userOperationTasks: userOpCount,\n    }\n  }\n}\n"],"names":["KEY","t","kind","baId","Queue","bootstrapState","adminHeaders","bootstrapPromise","isBootstrapped","deps","failed","keys","Map","lastError","lastSeedAt","processed","processing","q","reconcileEveryMs","reconcileTimeout","reconciling","tickTimer","opts","log","start","tickMs","runOnBoot","setTimeout","seedFullReconcile","catch","err","console","error","bumpFront","task","filter","clearFullReconcileTasks","beforeCount","length","fullReconcileCount","source","delete","afterCount","clearedFullReconcile","preservedUserOps","enqueue","priority","k","existing","get","baUser","unshift","push","set","listBAUsersPage","limit","offset","total","internalAdapter","countTotalUsers","users","listUsers","direction","field","runTask","attempts","syncUserToPayload","id","deleteUserFromPayload","scheduleNextReconcile","clearTimeout","unref","seedFullReconcilePaginated","reconcileId","pageSize","baIdSet","prunePayloadOrphans","Set","baOffset","baTotal","baUsers","u","enqueueEnsure","add","payloadPage","hasNextPage","nextPage","pUsers","listPayloadUsersPage","pu","ext","externalId","toString","has","enqueueDelete","page","tick","now","Date","idx","findIndex","nextAt","splice","e","message","String","delay","Math","min","pow","floor","random","user","getInstanceInfo","toISOString","substr","status","setInterval","userOpCount","fullReconcileTasks","queueSize","sampleKeys","Array","from","slice","userOperationTasks"],"mappings":"AA4DA,MAAMA,MAAM,CAACC,IAAY,GAAGA,EAAEC,IAAI,CAAC,CAAC,EAAED,EAAEE,IAAI,EAAE;AAE9C,OAAO,MAAMC;IACX,wDAAwD;IAChDC,iBAAiC;QACvCC,cAAc;QACdC,kBAAkB;QAClBC,gBAAgB;IAClB,EAAC;IACOC,KAAgB;IAChBC,SAAS,EAAC;IACVC,OAAO,IAAIC,MAAmB;IAC9BC,YAA2B,KAAI;IAC/BC,aAA4B,KAAI;IAChCC,YAAY,EAAC;IAEbC,aAAa,MAAK;IAClBC,IAAY,EAAE,CAAA;IACdC,mBAAmB,KAAK,OAAO,qBAAqB;KAAtB;IAC9BC,mBAA0C,KAAI;IAC9CC,cAAc,MAAK;IAEnBC,YAAmC,KAAI;IAE/C,YAAYZ,IAAe,EAAEa,OAAoB,CAAC,CAAC,CAAE;QACnD,IAAI,CAACb,IAAI,GAAGA;QACZ,MAAMc,MAAM,IAAI,CAACd,IAAI,EAAEc,OAAQ,CAAA,KAAO,CAAA;QACtC,uDAAuD;QACvDA,IAAI;QAEJ,mDAAmD;QACnD,IAAI,CAACC,KAAK,CAAC;YACTN,kBAAkBI,MAAMJ,oBAAoB,KAAK;YACjDO,QAAQH,MAAMG,UAAU;QAC1B;QAEA,kEAAkE;QAClE,IAAIH,MAAMI,aAAa,MAAM;YAC3B,gFAAgF;YAChFC,WAAW;gBACT,IAAI,CAACC,iBAAiB,GAAGC,KAAK,CAAC,CAACC,MAAQC,QAAQC,KAAK,CAAC,2BAA2BF;YACnF,GAAG,OAAM,sEAAsE;QACjF;QAEAP,IAAI;IACN;IAEQU,UAAUC,IAAU,EAAE;QAC5B,IAAI,CAACjB,CAAC,GAAG;YAACiB;eAAS,IAAI,CAACjB,CAAC,CAACkB,MAAM,CAAC,CAAClC,IAAMA,MAAMiC;SAAM;IACtD;IAEA,mFAAmF,GACnF,AAAQE,0BAA0B;QAChC,MAAMb,MAAM,IAAI,CAACd,IAAI,EAAEc,OAAQ,CAAA,KAAO,CAAA;QACtC,MAAMc,cAAc,IAAI,CAACpB,CAAC,CAACqB,MAAM;QACjC,MAAMC,qBAAqB,IAAI,CAACtB,CAAC,CAACkB,MAAM,CAAC,CAAClC,IAAMA,EAAEuC,MAAM,KAAK,kBAAkBF,MAAM;QAErF,sDAAsD;QACtD,IAAI,CAACrB,CAAC,GAAG,IAAI,CAACA,CAAC,CAACkB,MAAM,CAAC,CAACD;YACtB,IAAIA,KAAKM,MAAM,KAAK,kBAAkB;gBACpC,IAAI,CAAC7B,IAAI,CAAC8B,MAAM,CAACzC,IAAIkC;gBACrB,OAAO;YACT;YACA,OAAO;QACT;QAEA,MAAMQ,aAAa,IAAI,CAACzB,CAAC,CAACqB,MAAM;QAChCf,IAAI,4BAA4B;YAC9BmB;YACAL;YACAM,sBAAsBJ;YACtBK,kBAAkBF;QACpB;IACF;IAEA,oBAAoB;IACZG,QAAQX,IAAU,EAAEY,QAAiB,EAAE;QAC7C,MAAMC,IAAI/C,IAAIkC;QACd,MAAMc,WAAW,IAAI,CAACrC,IAAI,CAACsC,GAAG,CAACF;QAC/B,IAAIC,UAAU;YACZ,IAAId,KAAKhC,IAAI,KAAK,YAAY8C,SAAS9C,IAAI,KAAK,YAAY,CAAC8C,SAASE,MAAM,IAAIhB,KAAKgB,MAAM,EAAE;gBAC3FF,SAASE,MAAM,GAAGhB,KAAKgB,MAAM;YAC/B;YACA,IAAIJ,UAAU;gBACZ,IAAI,CAACb,SAAS,CAACe;YACjB;YACA;QACF;QACA,IAAIF,UAAU;YACZ,IAAI,CAAC7B,CAAC,CAACkC,OAAO,CAACjB;QACjB,OAAO;YACL,IAAI,CAACjB,CAAC,CAACmC,IAAI,CAAClB;QACd;QACA,IAAI,CAACvB,IAAI,CAAC0C,GAAG,CAACN,GAAGb;IACnB;IAEA,MAAcoB,gBAAgB,EAAEC,KAAK,EAAEC,MAAM,EAAqC,EAAE;QAClF,8BAA8B;QAC9B,mHAAmH;QACnH,+CAA+C;QAC/C,MAAMC,QAAQ,MAAM,IAAI,CAAChD,IAAI,CAACiD,eAAe,CAACC,eAAe;QAC7D,MAAMC,QAAQ,MAAM,IAAI,CAACnD,IAAI,CAACiD,eAAe,CAACG,SAAS,CAACN,OAAOC,QAAQ;YACrEM,WAAW;YACXC,OAAO;QACT;QACA,OAAO;YAAEN;YAAOG;QAAM;IACxB;IAEA,MAAcI,QAAQ/D,CAAO,EAAE;QAC7B,MAAMsB,MAAM,IAAI,CAACd,IAAI,EAAEc,OAAQ,CAAA,KAAO,CAAA;QACtC,IAAItB,EAAEC,IAAI,KAAK,UAAU;YACvBqB,IAAI,gBAAgB;gBAAE0C,UAAUhE,EAAEgE,QAAQ;gBAAE9D,MAAMF,EAAEE,IAAI;YAAC;YACzD,MAAM,IAAI,CAACM,IAAI,CAACyD,iBAAiB,CAACjE,EAAEiD,MAAM,IAAI;gBAAEiB,IAAIlE,EAAEE,IAAI;YAAC;YAC3D;QACF;QACA,SAAS;QACToB,IAAI,gBAAgB;YAAE0C,UAAUhE,EAAEgE,QAAQ;YAAE9D,MAAMF,EAAEE,IAAI;QAAC;QACzD,MAAM,IAAI,CAACM,IAAI,CAAC2D,qBAAqB,CAACnE,EAAEE,IAAI;IAC9C;IACQkE,wBAAwB;QAC9B,IAAI,IAAI,CAAClD,gBAAgB,EAAE;YACzBmD,aAAa,IAAI,CAACnD,gBAAgB;QACpC;QAEA,IAAI,CAACA,gBAAgB,GAAGQ,WAAW;YACjC,IAAI,CAAC,IAAI,CAACP,WAAW,EAAE;gBACrB,IAAI,CAACA,WAAW,GAAG;gBACnB,IAAI;oBACF,MAAM,IAAI,CAACQ,iBAAiB;gBAC9B,EAAE,OAAOI,OAAO;gBACd,+CAA+C;gBACjD,SAAU;oBACR,IAAI,CAACZ,WAAW,GAAG;oBACnB,uDAAuD;oBACvD,IAAI,CAACiD,qBAAqB;gBAC5B;YACF;QACF,GAAG,IAAI,CAACnD,gBAAgB;QAExB,2EAA2E;QAC3E,IAAI,WAAW,IAAI,CAACC,gBAAgB,IAAI,OAAO,IAAI,CAACA,gBAAgB,CAACoD,KAAK,KAAK,YAAY;YACzF,IAAI,CAACpD,gBAAgB,CAACoD,KAAK;QAC7B;IACF;IAEA,0EAA0E,GAC1E,MAAcC,2BAA2BC,WAAmB,EAAE;QAC5D,MAAMlD,MAAM,IAAI,CAACd,IAAI,EAAEc,OAAQ,CAAA,KAAO,CAAA;QACtC,MAAMmD,WAAW;QACjB,IAAIC,UAA8B;QAElC,kEAAkE;QAClE,IAAI,IAAI,CAAClE,IAAI,CAACmE,mBAAmB,EAAE;YACjCD,UAAU,IAAIE;YACd,IAAIC,WAAW;YACf,IAAIC,UAAU;YAEd,GAAG;gBACD,MAAM,EAAEtB,KAAK,EAAEG,OAAOoB,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC1B,eAAe,CAAC;oBAC3DC,OAAOmB;oBACPlB,QAAQsB;gBACV;gBACAC,UAAUtB;gBAEV,gEAAgE;gBAChE,KAAK,MAAMwB,KAAKD,QAAS;oBACvB,IAAI,CAACE,aAAa,CAACD,GAAG,OAAO,kBAAkBR;oBAC/CE,QAAQQ,GAAG,CAACF,EAAEd,EAAE;gBAClB;gBAEAW,YAAYE,QAAQ1C,MAAM;gBAC1Bf,IAAI,0BAA0B;oBAAER,WAAW+D;oBAAUL;oBAAahB,OAAOsB;gBAAQ;YACnF,QAASD,WAAWC,QAAQ;QAC9B,OAAO;YACL,2EAA2E;YAC3E,IAAID,WAAW;YACf,IAAIC,UAAU;YAEd,GAAG;gBACD,4EAA4E;gBAC5E,6DAA6D;gBAC7D,MAAM,EAAEtB,KAAK,EAAEG,OAAOoB,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC1B,eAAe,CAAC;oBAC3DC,OAAOmB;oBACPlB,QAAQsB;gBACV;gBACAC,UAAUtB;gBAEV,gEAAgE;gBAChE,KAAK,MAAMwB,KAAKD,QAAS;oBACvB,IAAI,CAACE,aAAa,CAACD,GAAG,OAAO,kBAAkBR;gBACjD;gBAEAK,YAAYE,QAAQ1C,MAAM;gBAC1Bf,IAAI,0BAA0B;oBAAER,WAAW+D;oBAAUL;oBAAahB,OAAOsB;gBAAQ;YACnF,QAASD,WAAWC,QAAQ;QAC9B;QAEA,wDAAwD;QACxD,IAAI,IAAI,CAACtE,IAAI,CAACmE,mBAAmB,IAAID,SAAS;YAC5C,IAAIS,cAAc;YAClB,IAAIC,cAAc;YAElB,MAAOA,YAAa;gBAClB,MAAM,EAAEA,aAAaC,QAAQ,EAAE1B,OAAO2B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC9E,IAAI,CAAC+E,oBAAoB,CACnFd,UACAU;gBAEFC,cAAcC;gBAEd,KAAK,MAAMG,MAAMF,OAAQ;oBACvB,MAAMG,MAAMD,GAAGE,UAAU,EAAEC;oBAC3B,IAAIF,OAAO,CAACf,QAAQkB,GAAG,CAACH,MAAM;wBAC5B,IAAI,CAACI,aAAa,CAACJ,KAAK,OAAO,kBAAkBjB;oBACnD;gBACF;gBAEAW;gBACA7D,IAAI,+BAA+B;oBAAEwE,MAAMX,cAAc;oBAAGX;gBAAY;YAC1E;QACF;IACF;IAEA,MAAcuB,OAAO;QACnB,IAAI,IAAI,CAAChF,UAAU,EAAE;YACnB;QACF;QACA,MAAMiF,MAAMC,KAAKD,GAAG;QACpB,MAAME,MAAM,IAAI,CAAClF,CAAC,CAACmF,SAAS,CAAC,CAACnG,IAAMA,EAAEoG,MAAM,IAAIJ;QAChD,IAAIE,QAAQ,CAAC,GAAG;YACd;QACF;QACA,MAAMjE,OAAO,IAAI,CAACjB,CAAC,CAACkF,IAAI;QACxB,IAAI,CAACnF,UAAU,GAAG;QAClB,IAAI;YACF,MAAM,IAAI,CAACgD,OAAO,CAAC9B;YACnB,IAAI,CAACjB,CAAC,CAACqF,MAAM,CAACH,KAAK;YACnB,IAAI,CAACxF,IAAI,CAAC8B,MAAM,CAACzC,IAAIkC;YACrB,IAAI,CAACnB,SAAS;QAChB,EAAE,OAAOwF,GAAQ;YACf,IAAI,CAAC7F,MAAM;YACX,IAAI,CAACG,SAAS,GAAG0F,GAAGC,WAAWC,OAAOF;YACtCrE,KAAK+B,QAAQ,IAAI;YACjB,MAAMyC,QACJC,KAAKC,GAAG,CAAC,QAAQD,KAAKE,GAAG,CAAC,GAAG3E,KAAK+B,QAAQ,IAAI,QAAQ0C,KAAKG,KAAK,CAACH,KAAKI,MAAM,KAAK;YACnF7E,KAAKmE,MAAM,GAAGJ,MAAMS;QACtB,SAAU;YACR,IAAI,CAAC1F,UAAU,GAAG;QACpB;IACF;IAEA8E,cACE3F,IAAY,EACZ2C,WAAW,KAAK,EAChBN,SAAqB,gBAAgB,EACrCiC,WAAoB,EACpB;QACA,IAAI,CAAC5B,OAAO,CACV;YAAEoB,UAAU;YAAG9D;YAAMD,MAAM;YAAUmG,QAAQH,KAAKD,GAAG;YAAIxB;YAAajC;QAAO,GAC7EM;IAEJ;IAEA,6BAA6B;IAC7BoC,cACE8B,IAAY,EACZlE,WAAW,KAAK,EAChBN,SAAqB,gBAAgB,EACrCiC,WAAoB,EACpB;QACA,IAAI,CAAC5B,OAAO,CACV;YACEoB,UAAU;YACV9D,MAAM6G,KAAK7C,EAAE;YACbjB,QAAQ8D;YACR9G,MAAM;YACNmG,QAAQH,KAAKD,GAAG;YAChBxB;YACAjC;QACF,GACAM;IAEJ;IAEA,4BAA4B;IAC5BmE,kBAAkB;QAChB,OAAO;YACLzG,gBAAgB,IAAI,CAACH,cAAc,CAACG,cAAc;QACpD;IACF;IAEA,wEAAwE,GACxE,MAAMoB,oBAAoB;QACxB,MAAML,MAAM,IAAI,CAACd,IAAI,EAAEc,OAAQ,CAAA,KAAO,CAAA;QACtC,IAAI,CAACT,UAAU,GAAG,IAAIoF,OAAOgB,WAAW;QACxC,MAAMzC,cAAc,CAAC,UAAU,EAAEyB,KAAKD,GAAG,GAAG,CAAC,EAAEU,KAAKI,MAAM,GAAGnB,QAAQ,CAAC,IAAIuB,MAAM,CAAC,GAAG,IAAI;QAExF5F,IAAI,wBAAwB;YAAEkD;QAAY;QAE1C,6EAA6E;QAC7E,IAAI,CAACrC,uBAAuB;QAE5B,MAAM,IAAI,CAACoC,0BAA0B,CAACC;QAEtClD,IAAI,uBAAuB,IAAI,CAAC6F,MAAM;IACxC;IAEA5F,MAAM,EAAEN,mBAAmB,KAAK,MAAM,EAAEO,SAAS,IAAI,EAAE,GAAG,CAAC,CAAC,EAAE;QAC5D,IAAI,CAACP,gBAAgB,GAAGA;QAExB,IAAI,CAAC,IAAI,CAACG,SAAS,EAAE;YACnB,IAAI,CAACA,SAAS,GAAGgG,YAAY,IAAM,IAAI,CAACrB,IAAI,IAAIvE;YAChD,2EAA2E;YAC3E,IAAI,WAAW,IAAI,CAACJ,SAAS,IAAI,OAAO,IAAI,CAACA,SAAS,CAACkD,KAAK,KAAK,YAAY;gBAC3E,IAAI,CAAClD,SAAS,CAACkD,KAAK;YACtB;QACF;QAEA,+BAA+B;QAC/B,IAAI,CAACF,qBAAqB;IAC5B;IAEA+C,SAAS;QACP,MAAME,cAAc,IAAI,CAACrG,CAAC,CAACkB,MAAM,CAAC,CAAClC,IAAMA,EAAEuC,MAAM,KAAK,kBAAkBF,MAAM;QAC9E,MAAMC,qBAAqB,IAAI,CAACtB,CAAC,CAACkB,MAAM,CAAC,CAAClC,IAAMA,EAAEuC,MAAM,KAAK,kBAAkBF,MAAM;QAErF,OAAO;YACL5B,QAAQ,IAAI,CAACA,MAAM;YACnB6G,oBAAoBhF;YACpB1B,WAAW,IAAI,CAACA,SAAS;YACzBC,YAAY,IAAI,CAACA,UAAU;YAC3BC,WAAW,IAAI,CAACA,SAAS;YACzBC,YAAY,IAAI,CAACA,UAAU;YAC3BwG,WAAW,IAAI,CAACvG,CAAC,CAACqB,MAAM;YACxBlB,aAAa,IAAI,CAACA,WAAW;YAC7BqG,YAAYC,MAAMC,IAAI,CAAC,IAAI,CAAChH,IAAI,CAACA,IAAI,IAAIiH,KAAK,CAAC,GAAG;YAClDC,oBAAoBP;QACtB;IACF;AACF"}

package/dist/better-auth/sources.d.ts

@@ -0,0 +1,35 @@
+import { type SanitizedConfig } from 'payload';
+export type BAUser = {
+    [k: string]: any;
+    email?: null | string;
+    id: string;
+};
+export type PayloadUser = {
+    externalId?: null | string;
+    id: number | string;
+};
+export interface BetterAuthUser {
+    [k: string]: any;
+    email?: null | string;
+    id: string;
+    name?: null | string;
+}
+/** Create a function to load Payload users page by page via Local API. */
+export declare function createListPayloadUsersPage(config: Promise<SanitizedConfig>): (limit: number, page: number) => Promise<{
+    hasNextPage: boolean;
+    total: number;
+    users: PayloadUser[];
+}>;
+/**
+ * Sync user from better-auth to Payload
+ * This is called from the better-auth hooks
+ * Creates a Payload user with externalId, which prevents reverse sync
+ */
+/**
+ * Create a function to sync user from better-auth to Payload
+ * This is called from the better-auth hooks
+ * Creates a Payload user with externalId, which prevents reverse sync
+ */
+export declare function createSyncUserToPayload(config: Promise<SanitizedConfig>): (betterAuthUser: BetterAuthUser) => Promise<void>;
+export declare function createDeleteUserFromPayload(config: Promise<SanitizedConfig>): (betterAuthUserId: string) => Promise<void>;
+export declare function createAttachExternalIdInPayload(config: Promise<SanitizedConfig>): (payloadUserId: number | string, baId: string) => Promise<void>;

package/dist/better-auth/sources.js

@@ -0,0 +1,126 @@
+// src/sources.ts
+import { getPayload } from 'payload';
+import { signCanonical } from './crypto-shared.js';
+const INTERNAL_SECRET = process.env.BA_TO_PAYLOAD_SECRET;
+/** Create a function to load Payload users page by page via Local API. */ export function createListPayloadUsersPage(config) {
+    return async function listPayloadUsersPage(limit, page) {
+        const payload = await getPayload({
+            config
+        });
+        const res = await payload.find({
+            collection: 'users',
+            depth: 0,
+            limit,
+            overrideAccess: true,
+            page
+        });
+        return {
+            hasNextPage: res.hasNextPage || false,
+            total: res.totalDocs || 0,
+            users: res.docs.map((d)=>({
+                    id: d.id,
+                    externalId: d.externalId
+                }))
+        };
+    };
+}
+// Better-auth is the single source of truth and manages users through database hooks
+// These functions provide bidirectional validation and sync capabilities
+/**
+ * Sync user from better-auth to Payload
+ * This is called from the better-auth hooks
+ * Creates a Payload user with externalId, which prevents reverse sync
+ */ /**
+ * Create a function to sync user from better-auth to Payload
+ * This is called from the better-auth hooks
+ * Creates a Payload user with externalId, which prevents reverse sync
+ */ export function createSyncUserToPayload(config) {
+    return async function syncUserToPayload(betterAuthUser) {
+        const payload = await getPayload({
+            config
+        });
+        // idempotency check (keep as-is)
+        const existing = await payload.find({
+            collection: 'users',
+            limit: 1,
+            where: {
+                externalId: {
+                    equals: betterAuthUser.id
+                }
+            }
+        });
+        if (existing.docs.length) {
+            return;
+        }
+        const baBody = {
+            op: 'create',
+            userId: betterAuthUser.id
+        } // keep body minimal & stable
+        ;
+        const baSig = signCanonical(baBody, INTERNAL_SECRET);
+        await payload.create({
+            collection: 'users',
+            context: {
+                baBody,
+                baSig
+            },
+            data: {
+                name: betterAuthUser.name ?? '',
+                externalId: betterAuthUser.id
+            },
+            overrideAccess: false
+        });
+    };
+}
+// Create a function to delete user from Payload
+export function createDeleteUserFromPayload(config) {
+    return async function deleteUserFromPayload(betterAuthUserId) {
+        const payload = await getPayload({
+            config
+        });
+        const existing = await payload.find({
+            collection: 'users',
+            limit: 1,
+            where: {
+                externalId: {
+                    equals: betterAuthUserId
+                }
+            }
+        });
+        if (!existing.docs.length) {
+            return;
+        }
+        const baBody = {
+            op: 'delete',
+            userId: betterAuthUserId
+        };
+        const baSig = signCanonical(baBody, INTERNAL_SECRET);
+        await payload.delete({
+            id: existing.docs[0].id,
+            collection: 'users',
+            context: {
+                baBody,
+                baSig
+            },
+            overrideAccess: false
+        });
+    };
+}
+// ——— Optional: link an existing Payload user (id-matched) to BA id
+export function createAttachExternalIdInPayload(config) {
+    return async function attachExternalIdInPayload(payloadUserId, baId) {
+        const payload = await getPayload({
+            config
+        });
+        await payload.update({
+            id: payloadUserId,
+            collection: 'users',
+            data: {
+                externalId: baId
+            },
+            overrideAccess: true
+        });
+    };
+}
+
+//# sourceMappingURL=sources.js.map

package/dist/better-auth/sources.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/better-auth/sources.ts"],"sourcesContent":["// src/sources.ts\nimport { getPayload, type SanitizedConfig } from 'payload'\n\nimport { signCanonical } from './crypto-shared.js'\n\nconst INTERNAL_SECRET = process.env.BA_TO_PAYLOAD_SECRET!\n\nexport type BAUser = { [k: string]: any; email?: null | string; id: string }\nexport type PayloadUser = { externalId?: null | string; id: number | string }\n\n// Better Auth user type for sync operations\nexport interface BetterAuthUser {\n  [k: string]: any\n  email?: null | string\n  id: string\n  name?: null | string\n}\n\n/** Create a function to load Payload users page by page via Local API. */\nexport function createListPayloadUsersPage(config: Promise<SanitizedConfig>) {\n  return async function listPayloadUsersPage(\n    limit: number,\n    page: number,\n  ): Promise<{ hasNextPage: boolean; total: number; users: PayloadUser[] }> {\n    const payload = await getPayload({ config })\n    const res = await payload.find({\n      collection: 'users',\n      depth: 0,\n      limit,\n      overrideAccess: true,\n      page,\n    })\n    return {\n      hasNextPage: res.hasNextPage || false,\n      total: res.totalDocs || 0,\n      users: res.docs.map((d: any) => ({\n        id: d.id,\n        externalId: d.externalId,\n      })),\n    }\n  }\n}\n\n// Better-auth is the single source of truth and manages users through database hooks\n// These functions provide bidirectional validation and sync capabilities\n/**\n * Sync user from better-auth to Payload\n * This is called from the better-auth hooks\n * Creates a Payload user with externalId, which prevents reverse sync\n */\n\n/**\n * Create a function to sync user from better-auth to Payload\n * This is called from the better-auth hooks\n * Creates a Payload user with externalId, which prevents reverse sync\n */\nexport function createSyncUserToPayload(config: Promise<SanitizedConfig>) {\n  return async function syncUserToPayload(betterAuthUser: BetterAuthUser) {\n    const payload = await getPayload({ config })\n\n    // idempotency check (keep as-is)\n    const existing = await payload.find({\n      collection: 'users',\n      limit: 1,\n      where: { externalId: { equals: betterAuthUser.id } },\n    })\n    if (existing.docs.length) {\n      return\n    }\n\n    const baBody = { op: 'create', userId: betterAuthUser.id } // keep body minimal & stable\n    const baSig = signCanonical(baBody, INTERNAL_SECRET)\n\n    await payload.create({\n      collection: 'users',\n      context: { baBody, baSig },\n      data: {\n        name: betterAuthUser.name ?? '',\n        externalId: betterAuthUser.id,\n      },\n      overrideAccess: false,\n    })\n  }\n}\n\n// Create a function to delete user from Payload\nexport function createDeleteUserFromPayload(config: Promise<SanitizedConfig>) {\n  return async function deleteUserFromPayload(betterAuthUserId: string) {\n    const payload = await getPayload({ config })\n\n    const existing = await payload.find({\n      collection: 'users',\n      limit: 1,\n      where: { externalId: { equals: betterAuthUserId } },\n    })\n    if (!existing.docs.length) {\n      return\n    }\n\n    const baBody = { op: 'delete', userId: betterAuthUserId }\n    const baSig = signCanonical(baBody, INTERNAL_SECRET)\n\n    await payload.delete({\n      id: existing.docs[0].id,\n      collection: 'users',\n      context: { baBody, baSig },\n      overrideAccess: false,\n    })\n  }\n}\n\n// ——— Optional: link an existing Payload user (id-matched) to BA id\nexport function createAttachExternalIdInPayload(config: Promise<SanitizedConfig>) {\n  return async function attachExternalIdInPayload(payloadUserId: number | string, baId: string) {\n    const payload = await getPayload({ config })\n    await payload.update({\n      id: payloadUserId,\n      collection: 'users',\n      data: { externalId: baId },\n      overrideAccess: true,\n    })\n  }\n}\n"],"names":["getPayload","signCanonical","INTERNAL_SECRET","process","env","BA_TO_PAYLOAD_SECRET","createListPayloadUsersPage","config","listPayloadUsersPage","limit","page","payload","res","find","collection","depth","overrideAccess","hasNextPage","total","totalDocs","users","docs","map","d","id","externalId","createSyncUserToPayload","syncUserToPayload","betterAuthUser","existing","where","equals","length","baBody","op","userId","baSig","create","context","data","name","createDeleteUserFromPayload","deleteUserFromPayload","betterAuthUserId","delete","createAttachExternalIdInPayload","attachExternalIdInPayload","payloadUserId","baId","update"],"mappings":"AAAA,iBAAiB;AACjB,SAASA,UAAU,QAA8B,UAAS;AAE1D,SAASC,aAAa,QAAQ,qBAAoB;AAElD,MAAMC,kBAAkBC,QAAQC,GAAG,CAACC,oBAAoB;AAaxD,wEAAwE,GACxE,OAAO,SAASC,2BAA2BC,MAAgC;IACzE,OAAO,eAAeC,qBACpBC,KAAa,EACbC,IAAY;QAEZ,MAAMC,UAAU,MAAMX,WAAW;YAAEO;QAAO;QAC1C,MAAMK,MAAM,MAAMD,QAAQE,IAAI,CAAC;YAC7BC,YAAY;YACZC,OAAO;YACPN;YACAO,gBAAgB;YAChBN;QACF;QACA,OAAO;YACLO,aAAaL,IAAIK,WAAW,IAAI;YAChCC,OAAON,IAAIO,SAAS,IAAI;YACxBC,OAAOR,IAAIS,IAAI,CAACC,GAAG,CAAC,CAACC,IAAY,CAAA;oBAC/BC,IAAID,EAAEC,EAAE;oBACRC,YAAYF,EAAEE,UAAU;gBAC1B,CAAA;QACF;IACF;AACF;AAEA,qFAAqF;AACrF,yEAAyE;AACzE;;;;CAIC,GAED;;;;CAIC,GACD,OAAO,SAASC,wBAAwBnB,MAAgC;IACtE,OAAO,eAAeoB,kBAAkBC,cAA8B;QACpE,MAAMjB,UAAU,MAAMX,WAAW;YAAEO;QAAO;QAE1C,iCAAiC;QACjC,MAAMsB,WAAW,MAAMlB,QAAQE,IAAI,CAAC;YAClCC,YAAY;YACZL,OAAO;YACPqB,OAAO;gBAAEL,YAAY;oBAAEM,QAAQH,eAAeJ,EAAE;gBAAC;YAAE;QACrD;QACA,IAAIK,SAASR,IAAI,CAACW,MAAM,EAAE;YACxB;QACF;QAEA,MAAMC,SAAS;YAAEC,IAAI;YAAUC,QAAQP,eAAeJ,EAAE;QAAC,EAAE,6BAA6B;;QACxF,MAAMY,QAAQnC,cAAcgC,QAAQ/B;QAEpC,MAAMS,QAAQ0B,MAAM,CAAC;YACnBvB,YAAY;YACZwB,SAAS;gBAAEL;gBAAQG;YAAM;YACzBG,MAAM;gBACJC,MAAMZ,eAAeY,IAAI,IAAI;gBAC7Bf,YAAYG,eAAeJ,EAAE;YAC/B;YACAR,gBAAgB;QAClB;IACF;AACF;AAEA,gDAAgD;AAChD,OAAO,SAASyB,4BAA4BlC,MAAgC;IAC1E,OAAO,eAAemC,sBAAsBC,gBAAwB;QAClE,MAAMhC,UAAU,MAAMX,WAAW;YAAEO;QAAO;QAE1C,MAAMsB,WAAW,MAAMlB,QAAQE,IAAI,CAAC;YAClCC,YAAY;YACZL,OAAO;YACPqB,OAAO;gBAAEL,YAAY;oBAAEM,QAAQY;gBAAiB;YAAE;QACpD;QACA,IAAI,CAACd,SAASR,IAAI,CAACW,MAAM,EAAE;YACzB;QACF;QAEA,MAAMC,SAAS;YAAEC,IAAI;YAAUC,QAAQQ;QAAiB;QACxD,MAAMP,QAAQnC,cAAcgC,QAAQ/B;QAEpC,MAAMS,QAAQiC,MAAM,CAAC;YACnBpB,IAAIK,SAASR,IAAI,CAAC,EAAE,CAACG,EAAE;YACvBV,YAAY;YACZwB,SAAS;gBAAEL;gBAAQG;YAAM;YACzBpB,gBAAgB;QAClB;IACF;AACF;AAEA,oEAAoE;AACpE,OAAO,SAAS6B,gCAAgCtC,MAAgC;IAC9E,OAAO,eAAeuC,0BAA0BC,aAA8B,EAAEC,IAAY;QAC1F,MAAMrC,UAAU,MAAMX,WAAW;YAAEO;QAAO;QAC1C,MAAMI,QAAQsC,MAAM,CAAC;YACnBzB,IAAIuB;YACJjC,YAAY;YACZyB,MAAM;gBAAEd,YAAYuB;YAAK;YACzBhC,gBAAgB;QAClB;IACF;AACF"}

package/dist/collections/Users/index.d.ts

@@ -0,0 +1,5 @@
+import type { CollectionConfig } from 'payload';
+import { createAuthClient } from 'better-auth/react';
+export declare function createUsersCollection({ authClientOptions, }: {
+    authClientOptions: Parameters<typeof createAuthClient>['0'];
+}): CollectionConfig;