[nedtwigg]

Removes the original code/link authentication, leaving @pgstencil/auth as the Better Auth integration only, and makes the changes that depended on that. These are breaking, so they should release as 0.5.0. This PR does not raise the version, so merging it does not stage a release.

CHANGELOG.md lists every breaking change with how an application adapts.

What changes

• Legacy auth removed. The original source modules, their subpath exports, the package's migrations/ directory, openid-client, and the examples/login and examples/workers applications are gone, with their tests and snapshots. The package root now re-exports the Better Auth module.
• One example. examples/better-auth gains billing routes behind its sign-in, the pnpm dev entry with the local inbox and StripeDev, and the deployable Workers entry.
• Infrastructure tests stand alone. The database, parallel and query-type tests run on a small fixture schema and fixture app instead of auth tables.
• pgstencil command. The core package ships the database commands that scripts/db.ts ran privately, configured by pgstencil.json. kysely-codegen is a new optional tooling peer. defaultMigrations is now always a list.
• Sign-in email. emailFrom and renderEmail on createAuthApp and createBetterAuthWorker; the default sender is signin@<origin hostname> instead of [email protected]. Core exports escapeHtml.
• Billing. Reconciliation reads every page of a customer's subscriptions instead of throwing past 100. Billing.pruneEvents({ olderThanDays }) trims the webhook ledger. BillingDB is compared with generated declarations at typecheck.
• Security. SECURITY.md gains FAIL IF rules for Stripe webhooks, checkout and entitlement, each pinned by a test, and the release-gating audit's scope now includes the stripe package. Its timeout rises from 40 to 50 minutes.
• Node. Pinned once, at 24.22.2, in devEngines.runtime; pnpm and all three workflows read it. CI ran only Node 26 before, so the declared minimum of 24 was untested. .nvmrc is removed.
• Docs. README, PACKAGES, BILLING and WORKERS are rewritten for the new layout. PLAN.md, DISTRIBUTION_AND_BILLING_PLAN.md, LOGIN_FLOW.md and OAUTH.md are deleted. CHANGELOG.md and AGENTS.md are new.

Verification

Run locally on the branch tip, under Node 24.22.2:

• pnpm check (formatting, typecheck, script tests, 178 Vitest tests): pass
• pnpm db:verify: pass
• pnpm --filter @pgstencil/example-better-auth build: pass
• pnpm packages:verify, including the provenance check and the CLI run from the packed tarball: pass

Only the tip was run. The six commits are grouped by theme and were not each checked on their own.

For the reviewer

• A database that applied the old auth migrations must keep 001_auth.sql, 002_oauth.sql and 004_oauth_workers.sql as a source of its own, byte for byte, because the package no longer ships them and applied SQL stays under checksum validation.
• Audit duration. Past audit runs took 13 to 23 minutes. Billing adds roughly 60 clauses to check, so the first run on main is worth watching against the new 50-minute limit.
• Secret scanning. gitleaks is not installed where this was prepared, so .gitleaksignore was not rechecked. The rewritten billing HTTP test still contains a local test secret and may need a new fingerprint.
• Failed sign-in sends answer 200. Better Auth swallows a send failure, including a renderer that throws; nothing is delivered and an email.delivery.failed diagnostic is recorded. This predates the PR and is now documented.

🤖 Generated with Claude Code