feat(auth): better-auth 1.5.5 -> 1.6.x + resendOTP via @rafters/better-auth-resend (#122)

[ssilvius]

Closes #122. Stacked on #128 (drops Astro from apps/web). Will rebase once #128 merges.

What

Drops the console.log OTP placeholder. OTP now delivers via Resend through @rafters/better-auth-resend (renders the OtpEmail template from @rafters/mail-react-email, posts to Resend's API).

Workspace plumbing

Extends the cross-repo pattern from #107 (rafters packages) to mail packages.

• pnpm-workspace.yaml: glob now includes ../mail/packages/{core,resend,react-email,better-auth-resend} as workspace:* source. Catalog backfilled with mail's entries (drizzle-orm, tsup, @cloudflare/workers-types). Sanctioned pattern per 019e2840.
• apps/web/package.json: @rafters/better-auth-resend, @rafters/mail, @rafters/mail-react-email, @rafters/mail-resend as workspace:*. better-auth + @better-auth/passkey bumped 1.5.5 -> ^1.6.0. drizzle-orm ^0.45.1 -> ^0.45.2 to satisfy better-auth 1.6.11's drizzle-adapter peer.
• root package.json: @rafters/better-auth-resend added as devDep so root vitest can resolve it from tests/.

Wiring

apps/web/src/auth.ts:

emailOTP({
  sendVerificationOTP: (() => {
    const send = resendOTP({
      apiKey: env.RESEND_API_KEY,
      fromEmail: env.FROM_EMAIL,
      brandName: \"Rafters Studio\",
      expiryMinutes: 10,
      baseUrl: \"https://api.resend.com\",
    });
    return ({ email, otp }) => send(email, otp);
  })(),
}),

Why the IIFE: resendOTP returns (email, otp) => Promise<void> but better-auth 1.6's sendVerificationOTP is ({email, otp, type}, ctx?) => Promise<void>. The IIFE constructs the Resend sender once (Zod parse + React Email renderer setup is non-trivial), then wraps to bridge signatures. buildAuth is itself memoized per D1Database via the existing authCache WeakMap.

wrangler.jsonc: vars.FROM_EMAIL = \"noreply@rafters.studio\". RESEND_API_KEY is provisioned via wrangler secret put (#125 covers prod secrets).

Tests

tests/api/auth.test.ts (new): asserts resendOTP returns a 2-arity function from valid config, and rejects empty apiKey + invalid fromEmail (Zod boundary contract). Workers-pool integration test for the auth handler is deferred to #126's e2e suite (would need to extend test-worker.ts to mount auth + provision a test better-auth schema; too much for this PR).

Verification

• pnpm typecheck clean
• pnpm test: 27 passed (was 24, +3 auth wiring), 2 skipped
• pnpm build (wrangler deploy --dry-run) clean; FROM_EMAIL appears in the binding inventory
• End-to-end OTP delivery: verifies at deploy time with a real RESEND_API_KEY (operator step, not in CI)

Out of scope

• Polar webhook verification + audit (feat(polar): verify production transaction flow + audit-log Polar webhook events #124)
• Inbound email via @rafters/mail-cloudflare (feat(mail): inbound email via @rafters/mail-cloudflare + R2 + D1 (CF Email Routing) #123)
• Production wrangler config + secrets provisioning (chore(deploy): production wrangler config -- path-scoped routes, secrets, observability, CF Email Routing #125)
• Auth handler e2e tests (test(e2e): post-deploy smoke tests for auth, color, polar, inbound mail #126)

Test plan

• pnpm typecheck clean
• pnpm test 27 pass / 2 skip
• pnpm build (wrangler dry-run) clean
• OTP delivery verified against real Resend in dev (operator)
• After feat(web): strip Astro, re-scaffold apps/web as pure Hono worker (#121) #128 merges: rebase + force-push if needed

Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com