merge dev to main (v3.6.4)

[ymc9]

Summary by CodeRabbit

• New Features

  • Better Auth adapter now intelligently configures array field support based on the database provider (native arrays for PostgreSQL, JSON serialization for SQLite).

• Bug Fixes

  • Fixed delegate field reference handling to properly support inherited policy conditions in create operations.

• Tests

  • Added comprehensive test coverage for array field handling in the Better Auth adapter.
  • Added regression test for delegated model creation with inherited policy fields.

• Chores

  • Released version 3.6.4 across all packages.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: ebd19b17-0aee-4d42-a96a-171864d1aac2

📥 Commits

Reviewing files that changed from the base of the PR and between e96e048 and d30ebad.

📒 Files selected for processing (31)

• package.json
• packages/auth-adapters/better-auth/package.json
• packages/auth-adapters/better-auth/src/adapter.ts
• packages/auth-adapters/better-auth/src/config.ts
• packages/auth-adapters/better-auth/src/schema-generator.ts
• packages/auth-adapters/better-auth/test/adapter.test.ts
• packages/cli/package.json
• packages/clients/client-helpers/package.json
• packages/clients/tanstack-query/package.json
• packages/common-helpers/package.json
• packages/config/eslint-config/package.json
• packages/config/tsdown-config/package.json
• packages/config/typescript-config/package.json
• packages/config/vitest-config/package.json
• packages/create-zenstack/package.json
• packages/ide/vscode/package.json
• packages/language/package.json
• packages/orm/package.json
• packages/plugins/policy/package.json
• packages/plugins/policy/src/expression-transformer.ts
• packages/schema/package.json
• packages/sdk/package.json
• packages/server/package.json
• packages/testtools/package.json
• packages/zod/package.json
• samples/orm/package.json
• tests/e2e/package.json
• tests/regression/package.json
• tests/regression/test/issue-2620.test.ts
• tests/runtimes/bun/package.json
• tests/runtimes/edge-runtime/package.json

---

📝 Walkthrough

Walkthrough

This PR releases version 3.6.4 across all packages, refactors the Better Auth adapter to externalize configuration logic, implements array field support detection for database schemas, and adds comprehensive tests and regression coverage for new functionality.

Changes

Cohort / File(s)	Summary
Version Bump package.json, packages/*/package.json, samples/*/package.json, tests/*/package.json	Version bumped from 3.6.3 to 3.6.4 across 25 package manifests with no functional changes.
Better Auth Adapter Configuration packages/auth-adapters/better-auth/src/adapter.ts, packages/auth-adapters/better-auth/src/config.ts	Extracted AdapterConfig interface and field definitions to new config.ts module; moved provider and adapter option logic (debugLogs, usePlural, supportsArrays) into separate file with new getSupportsArrays() helper function for feature detection.
Better Auth Schema Generation packages/auth-adapters/better-auth/src/schema-generator.ts	Integrated array support feature detection; modified field type mapping to conditionally map string[] and number[] to native arrays (String/Int with array: true) when supported, or to Json field type when arrays are unsupported.
Better Auth Adapter Tests packages/auth-adapters/better-auth/test/adapter.test.ts	Added comprehensive test suite validating array field preservation for PostgreSQL and JSON serialization for SQLite; includes schema generation validation with temporary file cleanup.
Policy Plugin packages/plugins/policy/src/expression-transformer.ts	Removed create operation short-circuit in delegate-field reference logic; now generates correlated subquery lookups during create using available inserted identifiers from VALUES context.
Regression Tests tests/regression/test/issue-2620.test.ts	Added test coverage for delegated sub-model creation with inherited policy field references, validating @@allow conditions on extended models.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

• #2614: Modifies the same Better Auth adapter files and package exports; closely related refactoring effort.

Poem

🐰 Arrays take flight with feature's delight,
Config extracted, logic extracted just right,
Postgres arrays bloom, SQLite holds Json tight,
Delegate models inherit, policies unite—
Version 3.6.4 shines ever so bright! ✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'merge dev to main (v3.6.4)' clearly indicates this is a version release PR that bumps all packages to v3.6.4, which matches the primary change throughout the changeset.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[claude]

Claude finished @ymc9's task —— View job

---

Code Review for v3.6.4 Release (dev → main)

Reviewing this release PR with focus on code quality, bugs, performance, security, and test coverage.

Review Tasks

• Analyze better-auth adapter changes
• Review policy expression transformer fixes
• Examine new regression test (issue-2620)
• Check version bump consistency
• Assess overall code quality and security
• Provide comprehensive feedback

✅ Overall Assessment: APPROVED

This is a solid release with meaningful improvements and proper regression test coverage. The changes are well-implemented and follow good development practices.

📋 Detailed Review

1. Better Auth Adapter Improvements ⭐

Major Enhancements:

• Architecture: Cleaner separation with dedicated config.ts file
• Database Support: Smart array handling - native arrays for PostgreSQL, JSON fallback for SQLite
• Performance: Lazy-loaded schema generator reduces initial bundle size
• Testing: Comprehensive test suite validates array serialization scenarios

Code Quality:

• Clean, readable code structure
• Proper error handling in adapter operations
• Type safety could be improved (several as any assertions)

2. Policy Expression Transformer Fix 🔧

Critical Fix (expression-transformer.ts:920-925):

• Issue: Delegate sub-types couldn't access inherited base fields in policies during create operations
• Solution: Uses correlated subqueries to resolve inherited fields from base tables
• Impact: Enables proper policy enforcement for inheritance hierarchies

This is a well-architected fix that correctly handles the impedance mismatch between ZModel inheritance and SQL table structures.

3. Regression Test Coverage 🧪

issue-2620.test.ts provides excellent coverage:

• Tests both success and failure scenarios
• Uses realistic delegate inheritance pattern
• Verifies policy enforcement with inherited fields
• Clean, focused test design following testing best practices

4. Code Quality & Security 🔒

Strengths:

• No security vulnerabilities found
• Consistent version bumping across all packages (3.6.4)
• Proper error handling and validation
• No hardcoded secrets or credentials

Minor Concerns:

• Console warnings in schema-generator.ts are appropriate for dev guidance
• Some type assertions could be strengthened
• TODO comment at line 40 in schema-generator.ts for future package.json integration

5. Performance Considerations ⚡

Positive:

• Lazy loading reduces initial bundle size
• Efficient array handling based on database capabilities
• Optimized SQL generation for delegate inheritance

No performance regressions identified.

🎯 Recommendations

1. Type Safety: Consider replacing as any assertions with more specific types where possible
2. Documentation: The new array handling logic is well-implemented but could benefit from inline documentation
3. Error Handling: Consider more specific error types for better debugging experience

✅ Final Verdict: Ready to Merge

This PR delivers solid improvements with proper test coverage and maintains code quality standards. The delegate inheritance fix addresses a real user pain point, and the better-auth enhancements add valuable functionality.