tanstack-start

Create the project files from scratch: configure vite.config.ts with the cloudflare plugin first, set wrangler.jsonc main to @tanstack/react-start/server-entry, then add routes, server functions, D1 with Drizzle, and better-auth. Deploy with wrangler after running remote D1 migrations.

Create a getAuth() factory using the Drizzle adapter with the D1 binding, and call it per-request rather than at module level. Expose it through an API catch-all route using createAPIFileRoute at /api/auth/$, not a server function, since better-auth needs direct request/response access.

The env object is undefined when accessed at module level because bindings only exist during request handling. Import env from cloudflare:workers and access it inside the request handler, creating the Drizzle client per-request.

Yes, better-auth supports Google OAuth via socialProviders with GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET secrets. You must add the production callback URL https://your-worker.workers.dev/api/auth/callback/google in Google Cloud Console.

Build failures usually come from wrong Vite plugin order or wrangler misconfiguration. Plugins must be ordered cloudflare, tailwindcss, tanstackStart, viteReact, and wrangler.jsonc needs the nodejs_compat compatibility flag with main set to the TanStack server entry.

Redirect loops happen when BETTER_AUTH_URL does not exactly match the deployed URL, including protocol and no trailing slash. Also set TRUSTED_ORIGINS with all valid URLs and redeploy after updating secrets, since wrangler secret put does not redeploy.