Entry and request scope
apps/web/src/server.ts wraps the TanStack handler in runWithRequestRuntime. This preserves waitUntil without opening a database connection for every public page. When a protected operation needs auth, createRequestScope(request) supplies one database and one Better Auth instance.
The scope uses AsyncLocalStorage across asynchronous continuations and a WeakMap for the same Request object. SSR prefetch and cloned Requests can reuse the current scope. A different HTTP request gets a different Worker pool because a Worker socket belongs to the invocation that opened it. Node development reuses its long-lived pool instead.
Authentication and authorization
The oRPC context calls getAuthorizedSession, which bypasses cookie caching and rejects an active Ban. orgProcedure additionally looks up current membership in the Session's Active Organization. adminProcedure re-reads the authoritative Session before checking the platform role.
// Server router: orgProcedure supplies a membership-checked organizationId.
const list = orgProcedure.handler(async ({ context }) => {
return context.db.query.todo.findMany({
where: { organizationId: context.organizationId },
});
});Mobile requests can carry the expected user/session/organization scope. The server refuses a changed scope rather than answering a request under a new identity. Cancelling the client wait cannot undo a mutation the server already committed.
Commit and cleanup
Audited writes enqueue an Audit Event in the same database transaction as the domain change, then attempt publication. The durable audit job recovers unpublished records. AI streams and scheduled jobs own separately bounded pools and explicitly close them when their work settles.
Do not cache a request-bound auth instance, database client or Layer at module scope. Public docs and discovery routes read compiled public content and do not require a Session.