kernel-better-auth

Define the auth contract so Better Auth is the single source of truth for authentication across clients and server boundaries.

Standards

Better Auth owns authentication:

• session creation and renewal
• token issuance where Better Auth plugins provide it
• login and logout flows
• auth client methods
• auth-owned tables and endpoints

Do not re-implement custom JWT issuance, refresh-token rotation, password hashing, or session storage when Better Auth already covers the surface.

Authentication and authorization are separate concerns:

• kernel-better-auth owns who the caller is and how identity is established
• app/domain code owns what that caller is allowed to do