[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

⚠️⚠️⚠️⚠️⚠️⚠️

main is currently in pre mode so this branch has prereleases rather than normal releases. If you want to exit prereleases, run changeset pre exit on main.

⚠️⚠️⚠️⚠️⚠️⚠️

Releases

everything-dev@2.0.0-rc.28

Minor Changes

• 8c916ff: Second catalog leg: react/react-dom 19.3.1 (strict singletons — floating children realign via bos upgrade), effect 4.0.0-rc.118 with the vendored clone retagged and the unstable/http subpaths promoted to effect/http/*, alchemy 2.0.0-beta.83 (beta.84 removed the Docker/Util surface), module-federation 2.9.2, tanstack query 5.104.5 / table 9.3.1 / form 1.33.5 / intent 0.5.6, zod 4.6.7, yaml 2.9.1, drizzle patches.
• 680ea78: PGlite is the only local database — docker-compose is retired (ADR 0038). The zero-config dev default is now a persistent, file-backed PGlite data dir (pglite:.bos/db, per workspace process), so concurrent local projects can never collide on DB ports and data survives restarts without any .env. bos dev migrates leftovers once: compose-era postgres://everythingdev:…@localhost:543x/… URLs in .env are rewritten to the pglite defaults and a scaffold-shaped docker-compose.yml is relocated to .bos/compose-retired/. db:* commands work against pglite (drizzle-kit pglite dialect selected by URL scheme); the CLI/scaffold drop the compose template, dev:postgres* scripts, post-init docker prompt, and preflight auto-start; regression tests and the deploy smoke run on pglite (TEST_DATABASE=postgres + an external URL remains the parity escape hatch). Production postgres:// URLs are unchanged.

Patch Changes

• 282ede6: Auth plugin surfaces rate-limit and client-IP configuration (auth: Better Auth rate limiter falls back to a single shared bucket behind proxies — expose advanced.ipAddress (and rateLimit) config #688). New authored variables under auth.variables: rateLimit: { enabled, window (seconds), max, storage: "memory" | "database" } and ipAddress: { ipAddressHeaders, trustedProxies }. A new rate_limit table backs storage: "database" — the multi-replica option, since in-memory buckets are per instance (migration applied on boot). trustedProxies is strictly opt-in: Better Auth walks the forwarded chain right-to-left and takes the first untrusted address, so list your proxies' own addresses, never a range that also covers clients (bug: Rate limiter keys off spoofable x-forwarded-for; 15-min unswept growth window #338). Deployments behind appending proxies (Cloudflare + Railway) should name a single trusted header (cf-connecting-ip, x-real-ip) — the default x-forwarded-for cannot resolve a client IP through an untrusted comma-chain, which is why the boot WARN fell back to a shared per-path bucket. Absent configuration leaves Better Auth's defaults unchanged; BETTER_AUTH_RATE_LIMIT_DISABLED=1 still wins. The root runtime's canonical posture in bos.app.ts is ipAddress: { ipAddressHeaders: ["cf-connecting-ip"] } with no rateLimit — library defaults stand; the root is Cloudflare-proxied, children inherit it through extends, and each deployment can override.

• 8c916ff: Bump the platform catalog: better-auth 1.7.7 → 1.7.14 (with @better-auth/*), @orpc suite 2.0.0-beta.35 → 2.0.0-beta.45 (PublisherResumeOptions takes ttl in milliseconds instead of seconds), @tanstack/react-router 1.170.32 → 1.170.46 (router-core 1.171.39, router-plugin 1.168.48, router-generator 1.167.46), and the Effect toolchain trio in lockstep (@effect/tsgo 0.63.0, oxlint 1.90.0, oxlint-tsgolint 7.0.2005). The pnpm pin moves to 12.16.1.

  Overrides now reference the catalog through pnpm's catalog: protocol so shared-dep pins cannot drift from the catalog (bos upgrade doesn't reconcile stale pnpm overrides that shadow the platform catalog — children fail the #546 skew gate pointing at the wrong fix #659/bos upgrade should reconcile v2-migration pnpm overrides with the platform catalog, and audit/retire child ui/rsbuild.config.ts overrides #682); bos upgrade reconciles child overrides, propagates the pnpm pin forward-only to existing v2 children, and regenerates the framework minimumReleaseAgeExclude rows from the catalog with minimumReleaseAgeExcludePrune enabled — the list replaces instead of accumulating. The v1→v2 migration's V2_CATALOG baseline is drift-guarded against the parent catalog (row-for-row, both directions), closing upgrade --from v1: drops app.api.variables, overwrites custom authed-mount guards, writes outdated catalog + router-client shim #650's outdated-catalog vector.

• 680ea78: Concurrent bos dev sessions in one config dir no longer crash artifact generation: .bos/bos.resolved-config.json is now written atomically (tmp + rename) so a sibling session never reads a torn file, and the contract-bridge stale sweep removes gen files with rmSync(…, { force: true }) so a file vanishing between the existence check and the removal no longer fails the boot with ENOENT … lstat.

• 024e9c7: Release-scoped slot stamping no longer skips a slot the child only configures. A child that sets auth: { variables, secrets } (or a remote-only api: { variables, secrets }) had that slot counted as authored, so the deploy train left it unpinned and the auth server (or api) kept following the parent's live config pointer — under a host and auth UI pinned to the child's release. A slot now counts as authored only when it names a code source (production, development, pin, extends, proxy, a bare plugin ref, or ui: false); configuration-only entries get the release's production + pin stamped with their variables/secrets kept. Affected children pick this up on their next deploy after upgrading.

• 2f72431: Auth plugin onboard page: a rescan by someone who has left the community now says they're no longer a member instead of "You're in". The page checks a fresh organization list against the redeemed organization ID, clears a stale active organization, and shows a retryable error if the check fails. The redeem's refusal for a member who left now carries data.action: "rejoin-organization". Child apps can configure the joined screen through the onboard auth variable: links.next/links.home (with an {organizationId} placeholder) and links.explore for the success and error panels (defaults stay /build, /dashboard, /explore; next: false hides the build link), plus community.url, an app endpoint that returns the joined community's page and channels for a "Visit {community}" button and channel links.

• 86eb1df: SSR session resolution is tri-state and never round-trips the public edge on the hot path (SSR session resolution fetches the public edge URL — resolve in-process (or internal base URL) and degrade gracefully #689). The host's per-request in-process getContext resolution now distinguishes unresolved (no auth plugin, or resolution failed → undefined) from authoritative sign-out (getContext succeeded with no session → null). The SSR query-cache seeding follows: authoritative null seeds the cache (the same explicit signed-out entry sign-out writes), undefined leaves it empty so the guard's fetch still runs — closing the dev:ssr SSR session resolution returns null — authed routes 307 to /login despite a valid session #527 failure mode where a wedged auth resolution redirected signed-in users to /login without ever fetching. A server-side session-fetch failure degrades to a signed-out render instead of failing the whole document: an edge rate-limit or block page can no longer 500 every SSR page for every visitor.

• Updated dependencies [8c916ff]

• Updated dependencies [150b092]

  • every-plugin@3.0.0-rc.15

every-plugin@3.0.0-rc.15

Patch Changes

• 8c916ff: Bump the @orpc suite to 2.0.0-beta.45 — MemoryPublisher's resume option takes ttl (milliseconds) instead of seconds.
• 150b092: createRpcClient keeps the request's own headers, including content-type: application/json, when you pass custom headers such as an API key. Before, they were dropped and the server rejected the input.