@classytic/arc 2.37.0 → 2.38.0

package/dist/{validate-qK_-7MVk.mjs → validate-CidSeUrx.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-DrZrabOW.mjs";
+/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-Add2L50I.mjs";
 //#region src/core/aggregation/normalize.ts
 /**
 * Framework cap on URL-driven aggregation limits when the host opts

package/dist/{versioning-DEs-_hFi.d.mts → versioning-B843jOYX.d.mts}

@@ -1,5 +1,5 @@
 
-import { n as DomainEvent } from "./EventTransport-BEVP50ka.mjs";
+import { n as DomainEvent } from "./EventTransport-Cx60_s-6.mjs";
 import { FastifyPluginAsync, FastifyRequest } from "fastify";
 //#region src/plugins/caching.d.ts
 interface CachingRule {

package/dist/{versioning-Dtw0MyX4.mjs → versioning-C2r0eOZ4.mjs}

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-DrZrabOW.mjs";
-import { d as createDomainError } from "./errors-DsdZc1Xv.mjs";
+/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-Add2L50I.mjs";
+import { d as createDomainError } from "./errors-2ExmOgIJ.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/versioning.ts
 var versioning_exports = /* @__PURE__ */ __exportAll({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@classytic/arc",
-  "version": "2.37.0",
+  "version": "2.38.0",
   "description": "Resource-oriented backend framework for Fastify - clean, minimal, powerful, tree-shakable",
   "type": "module",
   "exports": {
@@ -343,16 +343,18 @@
     "check:peer-skew": "node scripts/check-peer-skew.mjs",
     "check:docs-drift": "node scripts/check-docs-drift.mjs",
     "check:boundaries": "node scripts/check-boundaries.mjs",
-    "prepublishOnly": "npm run check:peer-skew && npm run check:docs-drift && npm run check:route-api && npm run check:boundaries && npm run typecheck && npm run lint && npm run build && npm run check:api-surface && npm run check:forgotten-exports && npm run check:package && npm run test:ci && npm run smoke:consumer && npm run smoke:mcp",
+    "prepublishOnly": "npm run check:line-endings && npm run check:peer-skew && npm run check:docs-drift && npm run check:route-api && npm run check:boundaries && npm run typecheck && npm run lint && npm run build && npm run check:api-surface && npm run check:forgotten-exports && npm run check:package && npm run test:ci && npm run smoke:consumer && npm run smoke:mcp",
     "check:route-api": "node scripts/check-removed-route-api.mjs",
-    "check:forgotten-exports": "node scripts/check-forgotten-exports.mjs"
+    "check:forgotten-exports": "node scripts/check-forgotten-exports.mjs",
+    "check:line-endings": "node scripts/check-line-endings.mjs",
+    "fix:line-endings": "node scripts/check-line-endings.mjs --fix"
   },
   "engines": {
     "node": ">=22"
   },
   "peerDependencies": {
-    "@classytic/primitives": ">=0.25.0",
-    "@classytic/repo-core": ">=0.25.0",
+    "@classytic/primitives": ">=0.26.4",
+    "@classytic/repo-core": ">=0.26.0",
     "@classytic/streamline": ">=2.8.0",
     "@fastify/cors": ">=11.0.0",
     "@fastify/helmet": ">=13.0.0",
@@ -371,7 +373,7 @@
     "@opentelemetry/instrumentation-http": ">=0.50.0",
     "@opentelemetry/instrumentation-mongodb": ">=0.40.0",
     "@opentelemetry/sdk-node": ">=0.50.0",
-    "better-auth": ">=1.6.2",
+    "better-auth": ">=1.7.0",
     "bullmq": ">=5.0.0",
     "fastify": ">=5.12.0",
     "fastify-raw-body": ">=5.0.0",
@@ -483,8 +485,8 @@
     "@classytic/gitkit": ">=0.1.0",
     "@classytic/mongokit": "^3.33.0",
     "@classytic/pgkit": "^0.1.0",
-    "@classytic/primitives": "^0.25.0",
-    "@classytic/repo-core": "^0.25.0",
+    "@classytic/primitives": "^0.26.4",
+    "@classytic/repo-core": "^0.26.0",
     "@classytic/sqlitekit": "^0.9.0",
     "@classytic/streamline": "^2.8.2",
     "@electric-sql/pglite": "^0.5.4",
@@ -504,7 +506,7 @@
     "@types/qs": "^6.15.1",
     "@vitest/coverage-v8": "^4.1.9",
     "ajv": "^8.20.0",
-    "better-auth": "^1.6.25",
+    "better-auth": "^1.7.2",
     "better-sqlite3": "^13.0.3",
     "bullmq": "^6.1.2",
     "dotenv": "^17.4.2",

package/skills/arc/references/auth.md

@@ -86,7 +86,10 @@ const app2 = await createApp({
 2. Reads `session.activeOrganizationId`, or falls back to `x-organization-id` header (needed for API key auth where synthetic sessions have no org context)
 3. Looks up org membership via `auth.api.getActiveMember` (or `getActiveMemberRole` with explicit `organizationId` for header-based resolution)
 4. Splits roles: `"admin,recruiter"` → `['admin', 'recruiter']`
-5. Sets `request.scope`: `{ kind: 'member', organizationId, orgRoles: string[], teamId? }`
+5. Resolves `session.activeTeamId` (if set) against `auth.api.listUserTeams` scoped to the ACTIVE org, and binds it only if the team is one the user belongs to AND carries that `organizationId`. Stale or cross-org team state is dropped, not trusted. Requires **better-auth >=1.7.0** — the `organizationId` query param landed in 1.7.0, and without it a self-query returns teams across every org the user belongs to.
+6. Sets `request.scope`: `{ kind: 'member', organizationId, orgRoles: string[], teamId? }`
+
+Both `authenticate` and `optionalAuthenticate` run this same flow — an optional-auth route sees the identical scope when a session exists (arc 2.37.1; before that `teamId` was never set on the optional path).
 
 **Sessions at scale (BA-native knobs — know these before reaching for arc's):**
 - **Redis sessions**: use BA's `secondaryStorage` (sessions land there INSTEAD of the DB unless `session.storeSessionInDatabase: true`). Arc's `@classytic/arc/auth/redis` (`SessionStore`) is the JWT-strategy store — different layer, don't mix them.
@@ -240,7 +243,7 @@ The `auth.api.*` direct in-process API map and `auth.$context.tables` schema int
 |---|---|---|---|
 | (core) — `emailAndPassword`, OAuth providers | `user`, `session`, `account`, `verification` | both kits + playground | Nothing extra. Optionally overlay `user` as a resource. |
 | `organization()` (built-in) | `organization`, `member`, `invitation` | both kits + playground | `createBetterAuthAdapter({ orgContext: true })`; overlay `organization` / `member` as resources. |
-| `organization({ teams: true })` | + `team`, `teamMember` | mongokit | `requireTeamMembership()` works on `scope.teamId`. |
+| `organization({ teams: true })` | + `team`, `teamMember` | mongokit | `requireTeamMembership()` works on `scope.teamId`. Needs **better-auth >=1.7.0** (see step 5 of the org-context flow). |
 | `twoFactor()` (built-in) | `twoFactor` | both kits | Picked up automatically by overlay; expose `twoFactor` as a resource if needed. |
 | `admin()` (built-in) | (field-only, augments `user`) | both kits | `requireRoles(['admin'])` reads the platform role; no extra plumbing. |
 | `bearer()` (built-in) | (none — header strategy) | CLI scaffold | Token comes via `Authorization: Bearer <session>` instead of cookie — same `auth.api.getSession()` path. Use for SPA / mobile clients. |