Refresh active bb Connect sessions

[ymichael]

What was wrong

bb Connect authenticated requests by validating the Better Auth session cookie directly against D1. That bypassed Better Auth's normal session endpoint, so the configured sliding refresh never ran: a user who stayed active only through Connect still had a fixed seven-day database expiration and was logged out when it elapsed.

Separately, the Oxc migration changed the checked-in TanStack route tree's generated lint header from ESLint to Oxlint without changing TanStack Start's generator configuration. Every web dev-server start or production build therefore restored the generator's default /* eslint-disable */ header and left apps/web/src/routeTree.gen.ts dirty.

What changed

• Define the Connect session lifetime and update age once in @bb/connect-db, and pass them explicitly to Better Auth.
• Keep Connect's existing short-lived direct-verification cache for the edge gate, while ensuring a positive cache entry cannot outlive the database session.
• Retain the verified D1 session expiration in that cache and derive a non-authoritative refresh hint from the same seven-day lifetime and one-day update age that configure Better Auth.
• Only when that update-age boundary has arrived, call the account worker's real Better Auth get-session route after authenticated, non-cacheable Connect HTTP traffic. Normal dynamic requests therefore have no extra Worker hop. Better Auth still rechecks D1 and owns the update, race behavior, and renewed cookie attributes.
• Drop the old expiration hint before the Better Auth check so the next request observes the renewed D1 row rather than repeating the cross-worker call for the remainder of Connect's 20-second verification-cache TTL.
• Return cacheability explicitly from the edge-cache layer and skip refresh for cache hits, cacheable misses, wrong-account requests, desktop-cookie requests, and WebSocket upgrades. Dynamic traffic counts as activity; static-only and WebSocket-only traffic deliberately do not.
• Enable public Worker-to-Worker fetches for the Connect worker so the wildcard gate can reach the account worker on the apex domain without embedding Better Auth in the latency-sensitive gate bundle.
• Preserve every Set-Cookie field returned by Better Auth as a separate response header, so future auth configuration that emits more than one cookie cannot fold them into an invalid combined cookie.
• Add database-backed tests using Better Auth itself plus worker response tests for production/local cookies, update-age gating, cache hits and misses, account isolation, and WebSocket behavior.
• Configure TanStack Start's route generator to emit the repository's Oxlint header, keeping the tracked route tree stable across dev-server starts and production builds.

This does not change the server/host-daemon wire contract, so HOST_DAEMON_PROTOCOL_VERSION is unchanged. It adds no CLI, SDK, or user-facing configuration surface.

How you verified

The session regression tests exercise Better Auth against real in-memory SQLite: Connect reports a fresh session as not due and a session at Better Auth's update-age boundary as due; Better Auth then moves the due session forward and returns its cross-subdomain cookie, while a fresh session remains unchanged. A two-cookie response test verifies both cookie fields stay separate through the boundary. Worker tests prove fresh dynamic traffic makes no account-worker request, due dynamic traffic renews, and cacheable responses and WebSockets skip refresh even when it is due. The real-workerd encoding suite verifies cached gzip bodies remain intact.

A local Cloud end-to-end check created a temporary account and expiring session, sent an authenticated request through the Connect wildcard gate, and observed the actual Connect → web Better Auth subrequest: the gate returned the expected offline 503 with a renewed cookie and D1 held the new seven-day expiration. The temporary account/server were removed afterward (zero rows remained).

The route-tree regression was reproduced on main: starting the web dev server changed the tracked header back to /* eslint-disable */. With the inline TanStack Start router configuration, repeated forced web production builds leave apps/web/src/routeTree.gen.ts byte-for-byte unchanged.

• pnpm exec turbo run test --filter=@bb/connect --force (114 tests passed)
• pnpm exec turbo run test --filter=@bb/connect --force -- --run src/session.test.ts (15 tests passed)
• pnpm exec turbo run test --filter=@bb/connect --force -- --run src/worker.test.ts (76 tests passed)
• pnpm exec turbo run test --filter=@bb/connect --force -- --run src/response-encoding.test.ts (6 real-workerd tests passed)
• pnpm exec turbo run test --filter=@bb/web --force (79 tests passed)
• pnpm exec turbo run typecheck --filter=@bb/connect --filter=@bb/web --filter=@bb/connect-db
• pnpm exec turbo run build --filter=@bb/web --force (route tree unchanged)
• pnpm exec wrangler deploy --dry-run from apps/connect (261.20 KiB / 67.23 KiB gzip)
• pnpm install --frozen-lockfile --offline --ignore-scripts
• pnpm lint (zero errors)
• pnpm exec oxfmt --check apps/connect/package.json apps/connect/src/account-session.ts apps/connect/src/cache.ts apps/connect/src/session.ts apps/connect/src/session.test.ts apps/connect/src/worker.ts apps/connect/src/worker.test.ts apps/connect/test/encoding-fixture.ts apps/web/src/server/auth.ts apps/web/vite.config.ts packages/connect-db/src/constants.ts
• git diff --check

Fixes: N/A — reported directly in bb.

AGENT GENERATED