fix(auth): sso() takes no schema option; bridge ssoProvider via adapter map

@better-auth/sso (1.6.20) exposes NO `schema` option (verified: no mergeSchema,
runtime never reads options.schema), so the per-plugin schema-remap that
oauthProvider uses is unavailable. Drop the invalid `schema` arg + the dead
buildSsoPluginSchema(); call sso() bare (gated off by OS_SSO_ENABLED). Add
ssoProvider -> sys_sso_provider to AUTH_MODEL_TO_PROTOCOL.

KNOWN-INCOMPLETE (documented inline): the ACTIVE factory adapter
(createObjectQLAdapterFactory) passes the raw better-auth model name to the
data engine and maps fields only from per-model declarations — neither of
which the sso plugin provides. Finishing the integration needs objectql-adapter
to resolve schema-less plugin model + camelCase field names, then full E2E.
Compiles green (DTS ok for plugin-auth + platform-objects); feature off by
default.

+ pnpm-lock.yaml (@better-auth/sso ^1.6.20).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: os-zhuang

packages/plugins/plugin-auth/src/auth-manager.ts

@@ -23,7 +23,6 @@ import {
   buildOrganizationPluginSchema,
   buildTwoFactorPluginSchema,
   buildOauthProviderPluginSchema,
-  buildSsoPluginSchema,
   buildDeviceAuthorizationPluginSchema,
   buildJwtPluginSchema,
   buildAdminPluginSchema,
@@ -939,13 +938,15 @@ export class AuthManager {
     // Toggle with `OS_SSO_ENABLED` (mirrors `OS_OIDC_PROVIDER_ENABLED`).
     if (enabled.sso) {
       const { sso } = await import('@better-auth/sso');
-      plugins.push(sso({
-        schema: buildSsoPluginSchema(),
-        // provisionUser / organizationProvisioning are the hook for assigning a
-        // default env role on first federated login (ADR-0024 V1 minimal
-        // decisions). JIT user creation works out of the box via account
-        // linking; wire role defaults here in the follow-up.
-      }));
+      // NOTE: unlike `oauthProvider`, @better-auth/sso hardcodes its `ssoProvider`
+      // model and accepts NO `schema` option (verified against 1.6.20 — no
+      // mergeSchema, runtime never reads options.schema). Its table mapping to
+      // `sys_sso_provider` must therefore be resolved by the better-auth adapter
+      // / a global model map, not per-plugin here (see AUTH_SSO_PROVIDER_SCHEMA;
+      // TODO confirm the resolved table name in E2E).
+      // provisionUser / organizationProvisioning will assign a default env role
+      // on first federated login (ADR-0024 V1); JIT works via account linking.
+      plugins.push(sso());
     }
 
     // Device Authorization Grant (RFC 8628) — for CLI / TV-style devices.

packages/plugins/plugin-auth/src/auth-schema-config.ts

@@ -682,17 +682,11 @@ export const AUTH_SSO_PROVIDER_SCHEMA = {
   },
 } as const;
 
-/**
- * Builds the `schema` option for `@better-auth/sso`'s `sso()` plugin, pointing
- * its single `ssoProvider` model at ObjectStack's `sys_sso_provider` table.
- *
- * @returns An object suitable for `sso({ schema: … })`
- */
-export function buildSsoPluginSchema() {
-  return {
-    ssoProvider: AUTH_SSO_PROVIDER_SCHEMA,
-  };
-}
+// NOTE: there is intentionally no `buildSsoPluginSchema()`. Unlike
+// `oauthProvider`, the @better-auth/sso plugin exposes NO `schema` option
+// (verified vs 1.6.20), so the mapping above cannot be handed to the plugin —
+// it must be consumed at the ADAPTER layer (AUTH_MODEL_TO_PROTOCOL + field
+// resolution in objectql-adapter.ts). See ADR-0024.
 
 // ---------------------------------------------------------------------------
 // Helper: build device-authorization plugin schema option

packages/plugins/plugin-auth/src/objectql-adapter.ts

@@ -16,6 +16,15 @@ export const AUTH_MODEL_TO_PROTOCOL: Record<string, string> = {
   session: SystemObjectName.SESSION,
   account: SystemObjectName.ACCOUNT,
   verification: SystemObjectName.VERIFICATION,
+  // @better-auth/sso has NO `schema` option (verified vs 1.6.20 — no
+  // mergeSchema, runtime never reads options.schema), so it cannot declare
+  // its modelName/fields. Bridge the table name here. NOTE: the ACTIVE
+  // factory adapter (createObjectQLAdapterFactory) passes the raw `model`
+  // to dataEngine and does NOT yet consult resolveProtocolName for plugin
+  // models — nor map sso's camelCase fields (oidcConfig→oidc_config …).
+  // Finishing the @better-auth/sso integration needs that adapter work +
+  // E2E (see ADR-0024 / sys_sso_provider). Off by default (OS_SSO_ENABLED).
+  ssoProvider: 'sys_sso_provider',
 };
 
 /**