fix(plugin-auth): pin better-auth family to 1.7.0-rc.1 in the published manifest (#3085)

Every fresh `npx create-objectstack` (15.1.0) project shipped with auth
returning 500 on sign-up / sign-in / get-session: "Cannot set properties
of undefined (setting 'modelName')", thrown from
@better-auth/oauth-provider@1.6.23 during better-auth init.

The workspace forces the whole better-auth family to 1.7.0-rc.1 via
pnpm-workspace.yaml overrides (GHSA-j8v8-g9cx-5qf4 is only fixed in the
1.7.0 pre-release line, see 602053c), so every CI job and showcase here
ran a graph downstream installs can never reproduce: overrides do not
ship with published packages, and plugin-auth still declared ^1.6.23 for
better-auth / @better-auth/core / @better-auth/oauth-provider /
@better-auth/sso. Downstream resolved those to 1.6.23 (still the npm
`latest`), and the 1.7 scim + 1.6.23 rest mix crashes at startup.

- Pin all four to the exact 1.7.0-rc.1 (same as @better-auth/scim) — the
  only combination this repo actually builds and tests. No `^` on the rc:
  npm's default resolution never selects a prerelease from a caret range,
  which is precisely how this drift shipped. Relax to ^1.7.0 once a
  stable better-auth 1.7.0 exists.
- Workspace lockfile is unchanged by the pin (pnpm already resolved these
  to 1.7.0-rc.1 via the overrides); the overrides stay as belt-and-braces.
- Add scripts/check-override-consistency.mjs + a validate-deps step: for
  every pnpm-workspace override whose package appears in a publishable
  package's dependencies/optionalDependencies/peerDependencies, the
  declared range must resolve to the override target under npm's default
  (no-prerelease) semantics, so tested-vs-published drift fails CI with a
  "overrides do not ship with published packages" hint instead of
  shipping silently. Needs semver, added as a root devDependency.

Verified against the packed artifact: `pnpm pack` of this plugin-auth,
installed into a fresh create-objectstack@15.1.0 project via a pnpm
override — lockfile resolves the whole family (adapters + telemetry
included) to 1.7.0-rc.1, startup log has zero "Failed to register OIDC
discovery routes", and sign-up / sign-in / get-session all return 200. A
control project without the override reproduces the three 500s.

Co-authored-by: Jack Zhuang <277994282+os-zhuang@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: os-zhuang

.changeset/plugin-auth-pin-better-auth-family.md

@@ -0,0 +1,9 @@
+---
+"@objectstack/plugin-auth": patch
+---
+
+Fix fresh-project auth returning 500 on every endpoint (sign-up / sign-in / get-session) with `Cannot set properties of undefined (setting 'modelName')`.
+
+The published manifest declared `better-auth`, `@better-auth/core`, `@better-auth/oauth-provider`, and `@better-auth/sso` as `^1.6.23`, while only `@better-auth/scim` was pinned to `1.7.0-rc.1` (GHSA-j8v8-g9cx-5qf4 is fixed only in the 1.7.0 pre-release line). The framework workspace forces the whole better-auth family to `1.7.0-rc.1` via pnpm overrides, but overrides do not ship with published packages — a downstream `npx create-objectstack` install resolved the `^1.6.23` ranges to 1.6.23 (still the npm `latest`), and the resulting 1.7/1.6 mix crashes during better-auth initialization, so every fresh 15.1.0 project shipped with broken auth.
+
+All four packages are now pinned to the exact `1.7.0-rc.1` — the only combination the workspace actually builds and tests against. The pins will be relaxed to `^1.7.0` once a stable better-auth 1.7.0 ships. A new CI gate (`scripts/check-override-consistency.mjs`) fails whenever a pnpm-workspace override target is not reachable from a publishable package's declared range, so tested-vs-published drift like this cannot recur silently.

.github/workflows/validate-deps.yml

@@ -8,6 +8,7 @@ on:
       - '.changeset/config.json'
       - 'pnpm-workspace.yaml'
       - 'scripts/check-changeset-fixed.mjs'
+      - 'scripts/check-override-consistency.mjs'
       # Re-run when the workflow itself changes, so edits to these gates are
       # exercised on the PR that introduces them.
       - '.github/workflows/validate-deps.yml'
@@ -58,6 +59,16 @@ jobs:
 
       - name: Verify Changesets "fixed" group covers every public package
         run: node scripts/check-changeset-fixed.mjs
+
+      # pnpm overrides pin what THIS workspace resolves, but they do not ship
+      # with published packages — downstream installs see only the declared
+      # ranges. If an override target isn't reachable from a publishable
+      # package's declared range, we test one dependency graph and publish
+      # another (the 15.1.0 quickstart shipped exactly that: plugin-auth
+      # declared better-auth ^1.6.23 while CI ran the 1.7.0-rc.1 override,
+      # and every fresh project 500'd on auth).
+      - name: Verify overrides are reflected in published manifests
+        run: node scripts/check-override-consistency.mjs
 
       # Fail the workflow if known vulnerabilities are found — enforces
       # security compliance before merging.

package.json

@@ -46,6 +46,7 @@
     "@types/node": "^26.1.1",
     "@typescript-eslint/parser": "^8.63.0",
     "eslint": "^10.7.0",
+    "semver": "^7.7.3",
     "svelte": "^5.55.7",
     "tsup": "^8.5.1",
     "tsx": "^4.23.0",

packages/plugins/plugin-auth/package.json

@@ -18,17 +18,17 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "@better-auth/core": "^1.6.23",
-    "@better-auth/oauth-provider": "^1.6.23",
+    "@better-auth/core": "1.7.0-rc.1",
+    "@better-auth/oauth-provider": "1.7.0-rc.1",
     "@better-auth/scim": "1.7.0-rc.1",
-    "@better-auth/sso": "^1.6.23",
+    "@better-auth/sso": "1.7.0-rc.1",
     "@noble/hashes": "^2.2.0",
     "@objectstack/core": "workspace:*",
     "@objectstack/platform-objects": "workspace:*",
     "@objectstack/rest": "workspace:*",
     "@objectstack/spec": "workspace:*",
     "@objectstack/types": "workspace:*",
-    "better-auth": "^1.6.23",
+    "better-auth": "1.7.0-rc.1",
     "jose": "^6.2.3"
   },
   "devDependencies": {

pnpm-lock.yaml

@@ -30,19 +30,26 @@ onlyBuiltDependencies:
 #     @vscode/vsce > cheerio (declares undici ^7.19.0); force the patched
 #     7.28.0 line (stays in the 7.x major cheerio supports). CI audit gate.
 #   - @better-auth/scim: GHSA-j8v8-g9cx-5qf4 (high) — account/provider
-#     takeover. `plugin-auth` depends on ^1.6.23 (the `latest` dist-tag), but
-#     the advisory is patched only in >=1.7.0-beta.4 — there is NO stable
-#     patched release yet. Pin to the newest pre-release (1.7.0-rc.1) to clear
-#     the CI audit gate; revert to a stable `^1.7.x` line the moment one ships.
+#     takeover. The advisory is patched only in >=1.7.0-beta.4 — there is NO
+#     stable patched release yet (npm `latest` is still 1.6.23). Pin to the
+#     newest pre-release (1.7.0-rc.1) to clear the CI audit gate; revert to a
+#     stable `^1.7.x` line the moment one ships.
 #   - @better-auth/oauth-provider: GHSA-p2fr-6hmx-4528 — same better-auth
-#     monorepo and same situation as @better-auth/scim above. `plugin-auth`
-#     depends on ^1.6.23; the fix first ships in the 1.7.0 pre-release line.
-#     Pin to 1.7.0-rc.1. The 1.7 oauth-provider is exercised on the sign-in
-#     path and imports symbols (e.g. CLIENT_ASSERTION_TYPE) that only exist in
-#     @better-auth/core 1.7.x, so the ENTIRE better-auth family must move to
-#     1.7.0-rc.1 together — mixing a 1.7 plugin with 1.6.23 core 500s at
-#     runtime (dogfood sign-in). The full family is pinned below; revert all of
+#     monorepo and same situation as @better-auth/scim above. The fix first
+#     ships in the 1.7.0 pre-release line. Pin to 1.7.0-rc.1. The 1.7
+#     oauth-provider is exercised on the sign-in path and imports symbols
+#     (e.g. CLIENT_ASSERTION_TYPE) that only exist in @better-auth/core 1.7.x,
+#     so the ENTIRE better-auth family must move to 1.7.0-rc.1 together —
+#     mixing a 1.7 plugin with 1.6.23 core throws "Cannot set properties of
+#     undefined (setting 'modelName')" during better-auth init and 500s every
+#     auth endpoint at runtime. The full family is pinned below; revert all of
 #     them to a stable `^1.7.x` line the moment one ships.
+#     IMPORTANT: these overrides do NOT ship with published packages — a
+#     downstream `npx create-objectstack` install resolves plugin-auth's own
+#     declared ranges. plugin-auth therefore pins the same exact 1.7.0-rc.1 in
+#     its dependencies (a `^1.6.23` range there resolved to the broken 1.6.23
+#     mix and 500'd every fresh 15.1.0 project). Keep both in sync — CI
+#     enforces this via scripts/check-override-consistency.mjs.
 #   - uuid: GHSA-w5hq-g745-h8pq (high) — pulled 8.3.2 transitively; the fix
 #     first lands in 11.1.1. Pin to the ^11.1.1 LTS line (uuid `legacy-11`
 #     dist-tag) rather than the latest major to keep the jump conservative.