Fastify Better Auth Bridge

Wire Better Auth session resolution into Fastify 5 via the onRequest hook. Use this when Better Auth already exists but Fastify lacks the framework bridge.

Do NOT load this skill when

• The problem is callback URL configuration, trusted origins, or provider bootstrap order
• The problem is IDCS group mapping or org_members provisioning rules
• The goal is to build a parallel session system alongside Better Auth

NEVER

• Never build a parallel session layer when cookie header forwarding is all that's needed — the symptom (no session) and the fix (forward cookies) are separated by two layers, making it easy to misdiagnose.
• Never enforce RBAC policy inside the bridge onRequest hook — the bridge resolves identity, route guards enforce access. Mixing them makes both untestable.
• Never share mutable array decorator defaults in Fastify 5 — arrays on the prototype are shared across all requests; use a Symbol-backed getter/setter per-request.
• Never skip the Web Request bridge — auth.api.getSession() requires a native Web API Request, not a Fastify request object. Passing the wrong type silently returns no session.
• Never assume reply.send(undefined) is safe in Fastify 5 — it throws.

The Non-Obvious Parts