dbsc-toolkit 2.9.8 → 2.9.9

package/README.md

@@ -116,11 +116,32 @@ Without the script those browsers stay on `tier: "none"`. Chromium 146+ doesn't
 
 Walk-through: [docs/getting-started.md](./docs/getting-started.md).
 
-## Live demo
+### Not on Express?
 
-<https://dbsc-toolkit.onrender.com/>
+`createDbsc()` is the Express convenience layer. The protocol itself — native DBSC, the polyfill, per-request proof verification — lives in a framework-agnostic core that takes plain data and a `StorageAdapter`, nothing else. The Express, Fastify, Hono, and Next.js adapters are thin wrappers over it. If you're on a different runtime (or wiring DBSC into your own framework's session layer), import the core handlers directly:
 
-Sign up, log in, click **Check session**. Chromium 146+ lands on `tier: "dbsc"` within a second; Firefox/Safari land on `tier: "bound"` within ~3 seconds. The demo uses a 60-second bound-cookie TTL so refresh fires fast — open DevTools Network and watch. Source: [examples/express/](./examples/express/).
+```ts
+import {
+  handleRegistration,   // POST /dbsc/registration
+  handleRefresh,        // POST /dbsc/refresh
+  handleBoundRegistration, handleBoundRefresh,   // the polyfill routes
+  verifyBoundProof,     // your requireProof() equivalent
+  issueChallenge,
+  buildRegistrationHeader,
+  type StorageAdapter,  // the only interface you implement
+} from "dbsc-toolkit";
+```
+
+These are the same functions every shipped adapter calls. A complete raw-`http` integration built on them — both protocol surfaces, every header and cookie detail — is in [docs/adapters.md](./docs/adapters.md#writing-your-own-adapter).
+
+## Live demos
+
+| URL | Stack | Source |
+|---|---|---|
+| <https://dbsc-toolkit.onrender.com/> | Express + raw `dbsc-toolkit` | [examples/express/](./examples/express/) |
+| <https://dbsc-better-auth-demo.onrender.com/> | Hono + Better Auth + `@dbsc-toolkit/better-auth` | [examples/better-auth/](./examples/better-auth/) |
+
+Sign up, log in, click **Check session**. Chromium 145+ lands on `tier: "dbsc"` within a second; Firefox/Safari land on `tier: "bound"` within ~3 seconds. Open DevTools Network and watch the binding flow.
 
 ## Comparison
 
@@ -212,6 +233,36 @@ app.post("/logout", async (req, res) => {
 
 Full walk-through with `autoBind`, per-route policy, and the migration timeline: [docs/integrating-existing-auth.md](./docs/integrating-existing-auth.md).
 
+### Using Better Auth?
+
+Install [@dbsc-toolkit/better-auth](./packages/better-auth/) — sessions from every sign-in method (email, OAuth, magic link, passkey) get bound automatically:
+
+```ts
+// auth.ts
+import { betterAuth } from "better-auth"
+import { dbsc } from "@dbsc-toolkit/better-auth"
+
+export const auth = betterAuth({
+  plugins: [dbsc()],
+})
+```
+
+```ts
+// server.ts
+import { dbscExpress } from "@dbsc-toolkit/better-auth/express"
+
+const dbsc = dbscExpress(auth)
+dbsc.install(app)                              // mounts /dbsc/*, /dbsc-bound/*, /dbsc-client/*
+app.all("/api/auth/*splat", toNodeHandler(auth))
+app.get("/profile", dbsc.requireProof(), profileHandler)
+```
+
+```html
+<script src="/dbsc-client/init.js" type="module"></script>
+```
+
+Live demo: <https://dbsc-better-auth-demo.onrender.com/>. Full docs in the [package README](./packages/better-auth/README.md).
+
 ## Protect your routes
 
 After `createDbsc().install()`, every request through the middleware has a `tier` field on the request context. The library does not auto-protect anything — you add `requireProof()` to each route that matters.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dbsc-toolkit",
-  "version": "2.9.8",
+  "version": "2.9.9",
   "description": "Server-side Device Bound Session Credentials (DBSC) for Node.js plus a Web Crypto polyfill for Firefox, Safari, and older Chromium. Cookie-theft protection on every modern browser.",
   "license": "Apache-2.0",
   "type": "module",
@@ -93,6 +93,7 @@
   },
   "devDependencies": {
     "@fastify/cookie": "^11.0.2",
+    "fastify-plugin": "^5.0.1",
     "@types/express": "^5.0.6",
     "@types/node": "^20.0.0",
     "@types/pg": "^8.0.0",
@@ -136,5 +137,6 @@
   },
   "engines": {
     "node": ">=20.0.0"
-  }
+  },
+  "packageManager": "pnpm@9.0.0"
 }