fix(ci): rebase+retry push in deploy/staging workflows to avoid fetch-first rejection

.changeset/auth-types-gen-export-wildcard.md

@@ -0,0 +1,5 @@
+---
+"everything-dev": patch
+---
+
+Fix stale auth type name in type generation by replacing the hard-coded re-export list in `auth-types.gen.ts` with `export type *`. New types added to the auth plugin's `auth-export.ts` now flow through automatically without generator changes, preventing the class of `TS2724` errors caused by stale type names.

.changeset/fix-deploy-push-fetch-first.md

@@ -0,0 +1,5 @@
+---
+"everything-dev": patch
+---
+
+Fix `Deploy` and `Staging` workflows failing with `! [rejected] main -> main (fetch first)` when remote `main` (or `staging`) advances during the long deploy window. The final push step now `fetch` + `rebase` against the remote ref before pushing, retries up to 5 times with exponential backoff, and exits cleanly when there's nothing to push after rebase. This eliminates races with the `Release` workflow's auto-merged `chore: version packages` PR, manual `workflow_dispatch` triggers, Renovate, and human commits landing during deploy.

.github/templates/workflows/deploy.yml

@@ -75,8 +75,25 @@ jobs:
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add bos.config.json
-          if ! git diff --cached --quiet; then
+
+          for i in 1 2 3 4 5; do
+            git fetch origin "$TARGET_BRANCH"
+            if ! git rebase "origin/$TARGET_BRANCH"; then
+              echo "Rebase conflict — manual intervention required"
+              exit 1
+            fi
+            git add bos.config.json
+            if git diff --cached --quiet; then
+              echo "Nothing to push after rebase (attempt $i)"
+              exit 0
+            fi
             git commit -m "chore: update deployment URLs [skip ci]"
-            git push origin "$TARGET_BRANCH"
-          fi
+            if git push origin "$TARGET_BRANCH"; then
+              echo "Push succeeded on attempt $i"
+              exit 0
+            fi
+            echo "Push attempt $i failed, retrying in $((i*5))s..."
+            sleep $((i*5))
+          done
+          echo "All push attempts failed"
+          exit 1

.github/templates/workflows/staging.yml

@@ -76,8 +76,25 @@ jobs:
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add bos.config.json
-          if ! git diff --cached --quiet; then
+
+          for i in 1 2 3 4 5; do
+            git fetch origin "$TARGET_BRANCH"
+            if ! git rebase "origin/$TARGET_BRANCH"; then
+              echo "Rebase conflict — manual intervention required"
+              exit 1
+            fi
+            git add bos.config.json
+            if git diff --cached --quiet; then
+              echo "Nothing to push after rebase (attempt $i)"
+              exit 0
+            fi
             git commit -m "chore: update staging deployment URLs [skip ci]"
-            git push origin "$TARGET_BRANCH"
-          fi
+            if git push origin "$TARGET_BRANCH"; then
+              echo "Push succeeded on attempt $i"
+              exit 0
+            fi
+            echo "Push attempt $i failed, retrying in $((i*5))s..."
+            sleep $((i*5))
+          done
+          echo "All push attempts failed"
+          exit 1

.github/workflows/deploy.yml

@@ -109,8 +109,25 @@ jobs:
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add bos.config.json
-          if ! git diff --cached --quiet; then
+
+          for i in 1 2 3 4 5; do
+            git fetch origin "$TARGET_BRANCH"
+            if ! git rebase "origin/$TARGET_BRANCH"; then
+              echo "Rebase conflict — manual intervention required"
+              exit 1
+            fi
+            git add bos.config.json
+            if git diff --cached --quiet; then
+              echo "Nothing to push after rebase (attempt $i)"
+              exit 0
+            fi
             git commit -m "chore: update deployment URLs [skip ci]"
-            git push origin "$TARGET_BRANCH"
-          fi
+            if git push origin "$TARGET_BRANCH"; then
+              echo "Push succeeded on attempt $i"
+              exit 0
+            fi
+            echo "Push attempt $i failed, retrying in $((i*5))s..."
+            sleep $((i*5))
+          done
+          echo "All push attempts failed"
+          exit 1

.github/workflows/staging.yml

@@ -80,8 +80,25 @@ jobs:
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add bos.config.json
-          if ! git diff --cached --quiet; then
+
+          for i in 1 2 3 4 5; do
+            git fetch origin "$TARGET_BRANCH"
+            if ! git rebase "origin/$TARGET_BRANCH"; then
+              echo "Rebase conflict — manual intervention required"
+              exit 1
+            fi
+            git add bos.config.json
+            if git diff --cached --quiet; then
+              echo "Nothing to push after rebase (attempt $i)"
+              exit 0
+            fi
             git commit -m "chore: update staging deployment URLs [skip ci]"
-            git push origin "$TARGET_BRANCH"
-          fi
+            if git push origin "$TARGET_BRANCH"; then
+              echo "Push succeeded on attempt $i"
+              exit 0
+            fi
+            echo "Push attempt $i failed, retrying in $((i*5))s..."
+            sleep $((i*5))
+          done
+          echo "All push attempts failed"
+          exit 1

api/src/lib/auth.ts

@@ -14,6 +14,8 @@ import type {
   AuthPluginContext,
 } from "./auth-types.gen";
 
+export type * from "./auth-types.gen";
+
 export type AuthContext = AuthPluginContext;
 export type RequestAuthUser = NonNullable<AuthContext["user"]>;
 export type ApiKeyContext = NonNullable<AuthContext["apiKey"]>;

host/src/lib/auth.ts

@@ -1,24 +1,13 @@
 import type {
-  AuthPluginContext,
   AuthRequestContext,
   AuthSession,
   AuthSessionData,
   AuthSessionUser,
-  AuthServices as GeneratedAuthServices,
 } from "@/lib/auth-types.gen";
 
-export type {
-  AuthPluginContext,
-  AuthRequestContext,
-  AuthSession,
-  AuthSessionData,
-  AuthSessionUser,
-};
-export type AuthUser = AuthSessionUser;
+export type * from "@/lib/auth-types.gen";
 
-interface AuthServices extends GeneratedAuthServices {
-  auth: GeneratedAuthServices["auth"];
-}
+export type AuthUser = AuthSessionUser;
 
 export interface AuthClient {
   getSession(): Promise<AuthSession | null>;
@@ -38,5 +27,3 @@ export type HonoEnv = { Variables: AuthVariables };
 export function toAuthClientContext(headers: Headers): Record<string, string> {
   return Object.fromEntries(headers.entries());
 }
-
-export type { AuthServices };

package.json

@@ -29,7 +29,7 @@
       "better-auth": "1.6.25",
       "@better-auth/api-key": "1.6.25",
       "@better-auth/passkey": "1.6.25",
-      "better-near-auth": "1.8.2",
+      "better-near-auth": "1.10.0",
       "every-plugin": "^2.10.1",
       "everything-dev": "^1.53.0",
       "typescript": "^5.9.3",

packages/everything-dev/src/api-contract.ts

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join, relative } from "node:path";
+import { buildAuthTypesGenContent } from "./auth-types-gen";
 import { fetchJsonOrNull, fetchResponse } from "./http-client";
 import type { JsonObject, RuntimeConfig, RuntimePluginConfig } from "./types";
 
@@ -187,106 +188,6 @@ async function fetchAuthExportTypes(opts: {
   return generatedPath;
 }
 
-function writeAuthTypesGen(targetPath: string, authExportPath: string) {
-  const exportImportPath = toImportPath(targetPath, authExportPath);
-  const content = [
-    `export type {`,
-    `  Auth,`,
-    `  AuthOrganizationContext,`,
-    `  AuthOrganization,`,
-    `  AuthOrganizationSummary,`,
-    `  AuthOrganizationMember,`,
-    `  AuthApiKey,`,
-    `  AuthInvitation,`,
-    `  GetActiveMemberInput,`,
-    `  GetOrganizationInput,`,
-    `  ListMembersInput,`,
-    `  ListInvitationsInput,`,
-    `  ListApiKeysInput,`,
-    `  AuthServices,`,
-    `  createAuthInstance,`,
-    `} from "${exportImportPath}";`,
-    `import type { InferOutput, ContractType as AuthContract } from "${toImportPath(targetPath, join(dirname(authExportPath), "contract.d.ts"))}";`,
-    `import type { Auth as BaseAuth } from "${exportImportPath}";`,
-    "",
-    'type RawAuthSession = InferOutput<"getSession">;',
-    'type RawAuthRequestContext = InferOutput<"getContext">;',
-    'type RawAuthActiveMember = InferOutput<"getActiveMember">;',
-    "",
-    'export type AuthSessionUser = NonNullable<RawAuthSession["user"]>;',
-    'export type AuthSessionData = NonNullable<RawAuthSession["session"]>;',
-    "export type AuthSession = {",
-    "  user: AuthSessionUser | null;",
-    "  session: AuthSessionData | null;",
-    "};",
-    "export type AuthRequestContext = RawAuthRequestContext;",
-    "export type AuthPluginContext = Partial<AuthRequestContext> & {",
-    "  reqHeaders?: Headers;",
-    "  getRawBody?: () => Promise<string>;",
-    "};",
-    "export type AuthActiveMember = RawAuthActiveMember;",
-    'export type AuthBaseSession = BaseAuth["$Infer"]["Session"];',
-    "export type AuthContractType = AuthContract;",
-    "",
-  ].join("\n");
-  mkdirSync(dirname(targetPath), { recursive: true });
-  writeFileIfChanged(targetPath, content);
-}
-
-function writeContractBasedAuthTypesGen(targetPath: string, configDir: string) {
-  const authExportRel = toImportPath(
-    targetPath,
-    join(configDir, ".bos", "generated", "auth", "auth-export.d.ts"),
-  );
-  const contractRel = toImportPath(
-    targetPath,
-    join(configDir, ".bos", "generated", "auth", "contract.d.ts"),
-  );
-
-  const content = [
-    `export type {`,
-    `  Auth,`,
-    `  AuthOrganizationContext,`,
-    `  AuthOrganization,`,
-    `  AuthOrganizationSummary,`,
-    `  AuthOrganizationMember,`,
-    `  AuthApiKey,`,
-    `  AuthInvitation,`,
-    `  GetActiveMemberInput,`,
-    `  GetOrganizationInput,`,
-    `  ListMembersInput,`,
-    `  ListInvitationsInput,`,
-    `  ListApiKeysInput,`,
-    `  AuthServices,`,
-    `  createAuthInstance,`,
-    `} from "${authExportRel}";`,
-    `import type { InferOutput, ContractType as AuthContract } from "${contractRel}";`,
-    `import type { Auth as BaseAuth } from "${authExportRel}";`,
-    "",
-    'type RawAuthSession = InferOutput<"getSession">;',
-    'type RawAuthRequestContext = InferOutput<"getContext">;',
-    'type RawAuthActiveMember = InferOutput<"getActiveMember">;',
-    "",
-    'export type AuthSessionUser = NonNullable<RawAuthSession["user"]>;',
-    'export type AuthSessionData = NonNullable<RawAuthSession["session"]>;',
-    "export type AuthSession = {",
-    "  user: AuthSessionUser | null;",
-    "  session: AuthSessionData | null;",
-    "};",
-    "export type AuthRequestContext = RawAuthRequestContext;",
-    "export type AuthPluginContext = Partial<AuthRequestContext> & {",
-    "  reqHeaders?: Headers;",
-    "  getRawBody?: () => Promise<string>;",
-    "};",
-    "export type AuthActiveMember = RawAuthActiveMember;",
-    'export type AuthBaseSession = BaseAuth["$Infer"]["Session"];',
-    "export type AuthContractType = AuthContract;",
-    "",
-  ].join("\n");
-  mkdirSync(dirname(targetPath), { recursive: true });
-  writeFileIfChanged(targetPath, content);
-}
-
 async function resolveContractSource(opts: {
   configDir: string;
   runtimeDir: string;
@@ -534,11 +435,32 @@ export function writeGeneratedFiles(opts: {
 
   if (opts.authExportPath) {
     for (const authTypesPath of authTypeTargets) {
-      writeAuthTypesGen(authTypesPath, opts.authExportPath);
+      const exportImportPath = toImportPath(authTypesPath, opts.authExportPath);
+      const contractImportPath = toImportPath(
+        authTypesPath,
+        join(dirname(opts.authExportPath), "contract.d.ts"),
+      );
+      mkdirSync(dirname(authTypesPath), { recursive: true });
+      writeFileIfChanged(
+        authTypesPath,
+        buildAuthTypesGenContent(exportImportPath, contractImportPath),
+      );
     }
   } else if (opts.authSource) {
     for (const authTypesPath of authTypeTargets) {
-      writeContractBasedAuthTypesGen(authTypesPath, opts.configDir);
+      const exportImportPath = toImportPath(
+        authTypesPath,
+        join(opts.configDir, ".bos", "generated", "auth", "auth-export.d.ts"),
+      );
+      const contractImportPath = toImportPath(
+        authTypesPath,
+        join(opts.configDir, ".bos", "generated", "auth", "contract.d.ts"),
+      );
+      mkdirSync(dirname(authTypesPath), { recursive: true });
+      writeFileIfChanged(
+        authTypesPath,
+        buildAuthTypesGenContent(exportImportPath, contractImportPath),
+      );
     }
   }