Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/pinebasedev/svelteflarenpx agentmods add skills/pinebasedev/svelteflare/auth-db-billingWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pinebasedev/svelteflare/auth-db-billing)<a href="https://agentmods.dev/skills/pinebasedev/svelteflare/auth-db-billing"><img src="https://agentmods.dev/badge/skills/pinebasedev/svelteflare/auth-db-billing/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/pinebasedev/svelteflare/auth-db-billing"><img src="https://agentmods.dev/badge/skills/pinebasedev/svelteflare/auth-db-billing.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00172 | $0.02903 |
| Opus 5.5 | $0.00069 | $0.01161 |
| Sonnet 5.5 | $0.00034 | $0.00581 |
| Haiku 4.5 | $0.00017 | $0.00290 |
Grade A, and why
auth-db-billing scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 24d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 365 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Auth / DB / Billing
Backend product systems for the svelteflare monorepo. All server logic lives in apps/api (Hono Worker). The SvelteKit app (apps/web) is a pure SPA with ssr = false — it has no +page.server.ts or hooks.server.ts. Every authenticated action, DB query, and billing operation goes through the Hono API.
Architecture quick-map
apps/api/src/
auth.ts ← Better Auth singleton factory (getAuth)
db/
schema.ts ← Drizzle schema: app tables + re-exports auth-schema.ts
auth-schema.ts ← Better Auth tables, GENERATED (pnpm --filter @repo/api generate:auth)
database.ts ← DB singleton factory (getDb)
middleware/
auth.ts ← authMiddleware — resolves session on every request
authorization.ts ← requireAuthenticated, requireEntitled
subscription.ts ← subscriptionMiddleware — resolves isEntitled
rateLimit.ts ← rate limits differ by subscription tier
routes/
index.ts ← route groups (public / authenticated / admin)
auth.ts ← passes all /v1/auth/* to Better Auth handler
apps/web/src/lib/
authClient.ts ← Better Auth client (browser-side)
api.ts ← Hono RPC client (hc<AppType>)
Better Auth
How auth is initialized
getAuth(db, env) in apps/api/src/auth.ts is a singleton factory. It takes the Drizzle DB instance and Cloudflare env bindings. Never call betterAuth() directly in a route — always use getAuth.
Active plugins:
emailOTP— 6-digit OTP for email verification, 15-min expiry@better-auth/stripe— creates Stripe customer on signup, manages subscriptions- Email/password (requires email verification before login)
- Google OAuth (
disableImplicitSignUp: true— must sign up first)
No org/role/team plugins are active. The current auth model is single-user with subscription tiers only.
Session access in Hono routes
authMiddleware runs on every request and sets these on the Hono context:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 24d ago Changed · -15 lines f87901cfc5ab
- 1mo ago First seen · 380 lines · 172 tokens per session scan A 10f4438d9d26
auth-db-billing is a skill published in the GitHub repository pinebasedev/svelteflare (50 stars, last pushed 25d ago), licensed MIT. It adds 172 tokens to every session and 2,903 once invoked, about $0.0007 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
auth-setup
Auth worker setup for Better Auth, OAuth, admin bootstrap, and env/secrets. Use when configuring auth for a fork, setting redirect URIs, or debugging auth env.
binding-hono-client
Typed HTTP clients for Cloudflare service bindings — bindingHonoClient, WorkerBindingRegistry, Worker RPC with clientApp, HonoClientApp. Use when calling env.CHATROOM or any WorkerRef/BoundWorker over fetch with @firtoz/hono-fetcher, adding a worker Hono app RPC type, or fixing JsonResponse / missing .delete on…
durable-object-package
Add or change a Durable Object worker package under durable-objects/ (Alchemy, env.d.ts, Hono on the DO). Use when scaffolding with turbo gen durable-object, editing durable-objects//alchemy.run.ts, workers/app.ts, or env.d.ts for a DO. Not for web app bindings or cross-worker rpc—see web-alchemy-bindings and…
socka-realtime
Socka + Durable Object WebSockets—defineSocka, SockaWebSocketDO, useSockaSession, SSR-safe ws URLs, web worker forwarding, live-draft vs commit, canvas/whiteboard acceptance, and pre-merge checks. Use for realtime features, /api/ws, or @firtoz/socka.
worker-rpc-turbo
When a worker package WorkerRef / WorkerStub a peer to avoid ./alchemy value-import cycles, paste no drift service / name strings derived from omitDefaultPhysicalWorkerScriptName(peerAlchemyAppId, app.stage) with DEFAULTWORKERRESOURCEID/ALCHEMYAPPIDS from alchemy-utils/worker-peer-scripts.
web-alchemy-bindings
Wire @internal/web to durable-objects workers—workspace dep, alchemy.run.ts ReactRouter bindings, and env patterns. Use when adding workspace: for a worker, editing apps/web/alchemy.run.ts, or debugging missing worker types after a new package.