@shivaedev/identity 0.0.0-stage → 0.1.0

package/dist/middleware.d.ts

@@ -0,0 +1,21 @@
+import { Schema } from "effect";
+import { RpcMiddleware } from "effect/rpc";
+import { AuthUnavailable, Forbidden, Unauthorized } from "@shivaedev/errors/taxonomy.ts";
+import type { Identity, OptionalIdentity, RequestId, SessionUser, SessionUserWithProviderAccounts } from "./identity.ts";
+declare const RequestTracing_base: RpcMiddleware.ServiceClass<RequestTracing, "@shivaedev/identity/RequestTracing", RequestId, Schema.Never, never, never, false>;
+export declare class RequestTracing extends RequestTracing_base {
+}
+declare const Authenticated_base: RpcMiddleware.ServiceClass<Authenticated, "@shivaedev/identity/Authenticated", Identity, Schema.Union<readonly [typeof Unauthorized, typeof AuthUnavailable, typeof Forbidden]>, never, never, false>;
+export declare class Authenticated extends Authenticated_base {
+}
+declare const MaybeAuthenticated_base: RpcMiddleware.ServiceClass<MaybeAuthenticated, "@shivaedev/identity/MaybeAuthenticated", OptionalIdentity, Schema.Union<readonly [typeof Unauthorized, typeof AuthUnavailable, typeof Forbidden]>, never, never, false>;
+export declare class MaybeAuthenticated extends MaybeAuthenticated_base {
+}
+declare const AuthenticatedUser_base: RpcMiddleware.ServiceClass<AuthenticatedUser, "@shivaedev/identity/AuthenticatedUser", Identity | SessionUser, Schema.Union<readonly [typeof Unauthorized, typeof AuthUnavailable, typeof Forbidden]>, never, never, false>;
+export declare class AuthenticatedUser extends AuthenticatedUser_base {
+}
+declare const AuthenticatedUserWithProviderAccounts_base: RpcMiddleware.ServiceClass<AuthenticatedUserWithProviderAccounts, "@shivaedev/identity/AuthenticatedUserWithProviderAccounts", Identity | SessionUser | SessionUserWithProviderAccounts, Schema.Union<readonly [typeof Unauthorized, typeof AuthUnavailable, typeof Forbidden]>, never, never, false>;
+export declare class AuthenticatedUserWithProviderAccounts extends AuthenticatedUserWithProviderAccounts_base {
+}
+export {};
+//# sourceMappingURL=middleware.d.ts.map

package/dist/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AACzF,OAAO,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE,SAAS,EAAE,WAAW,EAAE,+BAA+B,EAAE,MAAM,eAAe,CAAC;;AACzH,qBAAa,cAAe,SAAQ,mBAKK;CAAG;;AAC5C,qBAAa,aAAc,SAAQ,kBAOjC;CAAG;;AACL,qBAAa,kBAAmB,SAAQ,uBAK0E;CAAG;;AACrH,qBAAa,iBAAkB,SAAQ,sBAOrC;CAAG;;AACL,qBAAa,qCAAsC,SAAQ,0CAKzD;CAAG"}

package/dist/middleware.js

@@ -0,0 +1,20 @@
+import { Schema } from "effect";
+import { RpcMiddleware } from "effect/rpc";
+import { AuthUnavailable, Forbidden, Unauthorized } from "@shivaedev/errors/taxonomy.ts";
+export class RequestTracing extends RpcMiddleware.Service()("@shivaedev/identity/RequestTracing") {
+}
+export class Authenticated extends RpcMiddleware.Service()("@shivaedev/identity/Authenticated", {
+    error: Schema.Union([Unauthorized, AuthUnavailable, Forbidden]),
+}) {
+}
+export class MaybeAuthenticated extends RpcMiddleware.Service()("@shivaedev/identity/MaybeAuthenticated", { error: Schema.Union([Unauthorized, AuthUnavailable, Forbidden]) }) {
+}
+export class AuthenticatedUser extends RpcMiddleware.Service()("@shivaedev/identity/AuthenticatedUser", {
+    error: Schema.Union([Unauthorized, AuthUnavailable, Forbidden]),
+}) {
+}
+export class AuthenticatedUserWithProviderAccounts extends RpcMiddleware.Service()("@shivaedev/identity/AuthenticatedUserWithProviderAccounts", {
+    error: Schema.Union([Unauthorized, AuthUnavailable, Forbidden]),
+}) {
+}
+//# sourceMappingURL=middleware.js.map

package/dist/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAEzF,MAAM,OAAO,cAAe,SAAQ,aAAa,CAAC,OAAO,EAKtD,CAAC,oCAAoC,CAAC;CAAG;AAC5C,MAAM,OAAO,aAAc,SAAQ,aAAa,CAAC,OAAO,EAKrD,CAAC,mCAAmC,EAAE;IACxC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC;CAC/D,CAAC;CAAG;AACL,MAAM,OAAO,kBAAmB,SAAQ,aAAa,CAAC,OAAO,EAK1D,CAAC,wCAAwC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;CAAG;AACrH,MAAM,OAAO,iBAAkB,SAAQ,aAAa,CAAC,OAAO,EAKzD,CAAC,uCAAuC,EAAE;IAC5C,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC;CAC/D,CAAC;CAAG;AACL,MAAM,OAAO,qCAAsC,SAAQ,aAAa,CAAC,OAAO,EAG7E,CAAC,2DAA2D,EAAE;IAChE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC;CAC/D,CAAC;CAAG"}

package/dist/permission.d.ts

@@ -0,0 +1,11 @@
+import { Effect, Schema } from "effect";
+import { RpcMiddleware } from "effect/rpc";
+import type { Permission } from "@shivaedev/access/permission.ts";
+import { AuthUnavailable, Forbidden, Unauthorized } from "@shivaedev/errors/taxonomy.ts";
+import { type Identity, SessionUser, type SessionUserValue } from "./identity.ts";
+export declare function permissionMiddleware<TSelf>(): <const TName extends string>(name: TName, permission: Permission) => RpcMiddleware.ServiceClass<TSelf, TName, Identity | SessionUser, Schema.Union<readonly [typeof Unauthorized, typeof AuthUnavailable, typeof Forbidden]>, never, never, false> & {
+    permission: Permission;
+};
+export declare function hasPermission(user: Pick<SessionUserValue, "id" | "permissions">, permission: Permission): boolean;
+export declare function requirePermission(permission: Permission): Effect.Effect<SessionUserValue, Forbidden, SessionUser>;
+//# sourceMappingURL=permission.d.ts.map

package/dist/permission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.d.ts","sourceRoot":"","sources":["../src/permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AACzF,OAAO,EAAE,KAAK,QAAQ,EAAE,WAAW,EAAE,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAIlF,wBAAgB,oBAAoB,CAAC,KAAK,MACjC,KAAK,CAAC,KAAK,SAAS,MAAM,QAAQ,KAAK,cAAc,UAAU;;EAEvE;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,GAAG,aAAa,CAAC,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAEjH;AAED,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,UAAU,2DAMvD"}

package/dist/permission.js

@@ -0,0 +1,17 @@
+import { Effect, Schema } from "effect";
+import { RpcMiddleware } from "effect/rpc";
+import { AuthUnavailable, Forbidden, Unauthorized } from "@shivaedev/errors/taxonomy.ts";
+import { SessionUser } from "./identity.js";
+const Failures = Schema.Union([Unauthorized, AuthUnavailable, Forbidden]);
+export function permissionMiddleware() {
+    return (name, permission) => Object.assign(RpcMiddleware.Service()(name, { error: Failures }), { permission });
+}
+export function hasPermission(user, permission) {
+    return user.permissions?.some((grant) => grant.name === permission.name && grant.strength === permission.strength) ?? false;
+}
+export function requirePermission(permission) {
+    return Effect.flatMap(SessionUser, (user) => hasPermission(user, permission)
+        ? Effect.succeed(user)
+        : Effect.fail(new Forbidden({ message: `Permission required: ${permission.name} (${permission.strength})` })));
+}
+//# sourceMappingURL=permission.js.map

package/dist/permission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.js","sourceRoot":"","sources":["../src/permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AACzF,OAAO,EAAiB,WAAW,EAAyB,MAAM,eAAe,CAAC;AAElF,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC,CAAC;AAE1E,MAAM,UAAU,oBAAoB;IACnC,OAAO,CAA6B,IAAW,EAAE,UAAsB,EAAE,EAAE,CAC1E,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,EAA+C,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;AACjI,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAkD,EAAE,UAAsB;IACvG,OAAO,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC;AAC7H,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,UAAsB;IACvD,OAAO,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAC3C,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC;QAC9B,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QACtB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,EAAE,OAAO,EAAE,wBAAwB,UAAU,CAAC,IAAI,KAAK,UAAU,CAAC,QAAQ,GAAG,EAAE,CAAC,CAAC,CAC9G,CAAC;AACH,CAAC"}

package/dist/server/adapters/betterAuthSessions.d.ts

@@ -0,0 +1,14 @@
+import { Effect } from "effect";
+import { AuthUnavailable, Unauthorized } from "@shivaedev/errors/taxonomy.ts";
+import type { ProviderAccountValue } from "#identity.ts";
+import type { SessionProvider, SessionShape } from "#server/session.ts";
+export type GetSession<TSession extends SessionShape> = (headers: globalThis.Headers) => Promise<TSession | null>;
+export type GetProviderAccounts = (headers: globalThis.Headers) => Promise<readonly ProviderAccountValue[]>;
+export type SessionWithProviderAccounts<TSession extends SessionShape> = TSession & {
+    readonly user: TSession["user"] & {
+        readonly providerAccounts: Effect.Effect<readonly ProviderAccountValue[], AuthUnavailable | Unauthorized>;
+    };
+};
+export declare function betterAuthSessions<TSession extends SessionShape>(getSession: GetSession<TSession>): SessionProvider<TSession>;
+export declare function betterAuthSessions<TSession extends SessionShape>(getSession: GetSession<TSession>, getProviderAccounts: GetProviderAccounts): SessionProvider<SessionWithProviderAccounts<TSession>>;
+//# sourceMappingURL=betterAuthSessions.d.ts.map

package/dist/server/adapters/betterAuthSessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"betterAuthSessions.d.ts","sourceRoot":"","sources":["../../../src/server/adapters/betterAuthSessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAqB,MAAM,QAAQ,CAAC;AAGnD,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC9E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACxE,MAAM,MAAM,UAAU,CAAC,QAAQ,SAAS,YAAY,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;AAClH,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,KAAK,OAAO,CAAC,SAAS,oBAAoB,EAAE,CAAC,CAAC;AAC5G,MAAM,MAAM,2BAA2B,CAAC,QAAQ,SAAS,YAAY,IAAI,QAAQ,GAAG;IACnF,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG;QAAE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,oBAAoB,EAAE,EAAE,eAAe,GAAG,YAAY,CAAC,CAAA;KAAE,CAAC;CAChJ,CAAC;AAOF,wBAAgB,kBAAkB,CAAC,QAAQ,SAAS,YAAY,EAAE,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;AAC/H,wBAAgB,kBAAkB,CAAC,QAAQ,SAAS,YAAY,EAC/D,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,EAChC,mBAAmB,EAAE,mBAAmB,GACtC,eAAe,CAAC,2BAA2B,CAAC,QAAQ,CAAC,CAAC,CAAC"}

package/dist/server/adapters/betterAuthSessions.js

@@ -0,0 +1,24 @@
+import { Effect, Option, Predicate } from "effect";
+import { redact } from "@shivaedev/errors/redact.ts";
+import { AuthUnavailable, Unauthorized } from "@shivaedev/errors/taxonomy.ts";
+function unavailable(cause) {
+    return Effect.andThen(Effect.logError("Authentication provider failed", redact(cause)), Effect.fail(new AuthUnavailable({ message: "Authentication is temporarily unavailable" })));
+}
+export function betterAuthSessions(getSession, getProviderAccounts) {
+    const betterAuthSession = Effect.fn("PlatformRpc.betterAuthSession")(function* (headers) {
+        const transport = new globalThis.Headers(headers);
+        const session = yield* Effect.tryPromise(() => getSession(transport)).pipe(Effect.catch((error) => unavailable(error.cause)));
+        if (session === null || getProviderAccounts === undefined) {
+            return Option.fromNullishOr(session);
+        }
+        const providerAccounts = Effect.tryPromise({
+            catch: (cause) => cause,
+            try: () => getProviderAccounts(transport),
+        }).pipe(Effect.catch((cause) => Predicate.hasProperty(cause, "statusCode") && cause.statusCode === 401
+            ? Effect.fail(new Unauthorized({ message: "Authentication required" }))
+            : unavailable(cause)));
+        return Option.some({ ...session, user: { ...session.user, providerAccounts } });
+    });
+    return { get: betterAuthSession };
+}
+//# sourceMappingURL=betterAuthSessions.js.map

package/dist/server/adapters/betterAuthSessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"betterAuthSessions.js","sourceRoot":"","sources":["../../../src/server/adapters/betterAuthSessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAEnD,OAAO,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAQ9E,SAAS,WAAW,CAAC,KAAc;IAClC,OAAO,MAAM,CAAC,OAAO,CACpB,MAAM,CAAC,QAAQ,CAAC,gCAAgC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAChE,MAAM,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC,CAAC,CAC1F,CAAC;AACH,CAAC;AAMD,MAAM,UAAU,kBAAkB,CAAgC,UAAgC,EAAE,mBAAyC;IAC5I,MAAM,iBAAiB,GAAG,MAAM,CAAC,EAAE,CAAC,+BAA+B,CAAC,CAAC,QAAQ,CAAC,EAAE,OAAwB;QACvG,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9H,IAAI,OAAO,KAAK,IAAI,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;YAC3D,OAAO,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,CAAC;YAC1C,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;YACvB,GAAG,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,SAAS,CAAC;SACzC,CAAC,CAAC,IAAI,CACN,MAAM,CAAC,KAAK,CACX,CAAC,KAAK,EAAwD,EAAE,CAC/D,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,KAAK,CAAC,UAAU,KAAK,GAAG;YACrE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;YACvE,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CACtB,CACD,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,EAAE,iBAAiB,EAAE,CAAC;AACnC,CAAC"}

package/dist/server/better-auth/allowedAccounts.d.ts

@@ -0,0 +1,10 @@
+import { Config, Schema } from "effect";
+export declare const AllowedAccounts: Schema.decodeTo<Schema.$Array<Schema.decodeTo<Schema.Struct<{
+    readonly accountId: Schema.NonEmptyString;
+    readonly providerId: Schema.NonEmptyString;
+}>, Schema.String, never, never>>, Schema.String, never, never>;
+export declare const allowedAccounts: Config.Config<readonly {
+    readonly accountId: string;
+    readonly providerId: string;
+}[]>;
+//# sourceMappingURL=allowedAccounts.d.ts.map

package/dist/server/better-auth/allowedAccounts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowedAccounts.d.ts","sourceRoot":"","sources":["../../../src/server/better-auth/allowedAccounts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAgB,MAAM,QAAQ,CAAC;AAgBtD,eAAO,MAAM,eAAe;;;+DAU3B,CAAC;AAEF,eAAO,MAAM,eAAe;;;IAA0D,CAAC"}

package/dist/server/better-auth/allowedAccounts.js

@@ -0,0 +1,20 @@
+import { Config, Schema, SchemaGetter } from "effect";
+const ProviderAccount = Schema.Struct({ accountId: Schema.NonEmptyString, providerId: Schema.NonEmptyString });
+const AccountEntry = Schema.String.pipe(Schema.decodeTo(ProviderAccount, {
+    decode: SchemaGetter.transform((entry) => {
+        const separator = entry.indexOf(":");
+        return separator < 0
+            ? { accountId: "", providerId: entry }
+            : { accountId: entry.slice(separator + 1).trim(), providerId: entry.slice(0, separator).trim() };
+    }),
+    encode: SchemaGetter.transform(({ accountId, providerId }) => `${providerId}:${accountId}`),
+}));
+export const AllowedAccounts = Schema.String.pipe(Schema.decodeTo(Schema.Array(AccountEntry).check(Schema.isMinLength(1)), {
+    decode: SchemaGetter.transform((value) => value
+        .split(",")
+        .map((entry) => entry.trim())
+        .filter((entry) => entry.length > 0)),
+    encode: SchemaGetter.transform((entries) => entries.join(",")),
+}));
+export const allowedAccounts = Config.schema(AllowedAccounts, "AUTH_ALLOWED_ACCOUNTS");
+//# sourceMappingURL=allowedAccounts.js.map

package/dist/server/better-auth/allowedAccounts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowedAccounts.js","sourceRoot":"","sources":["../../../src/server/better-auth/allowedAccounts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAEtD,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,cAAc,EAAE,UAAU,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;AAE/G,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CACtC,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE;IAChC,MAAM,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE;QACxC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,OAAO,SAAS,GAAG,CAAC;YACnB,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE;YACtC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACnG,CAAC,CAAC;IACF,MAAM,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,GAAG,UAAU,IAAI,SAAS,EAAE,CAAC;CAC3F,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAChD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE;IACxE,MAAM,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CACxC,KAAK;SACH,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CACrC;IACD,MAAM,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;CAC9D,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,uBAAuB,CAAC,CAAC"}

package/dist/server/better-auth/bearerSessions.d.ts

@@ -0,0 +1,9 @@
+import type { BetterAuthOptions } from "better-auth";
+export interface BearerSessionsOptions {
+    readonly origins: readonly string[];
+}
+export declare function withBearerSessions<TOptions extends BetterAuthOptions>(options: TOptions, enabled: boolean): TOptions;
+export declare function hasSessionCookie(headers: Headers, cookieName: string): boolean;
+export declare function sessionHeaders(headers: Headers, cookieName: string): Headers;
+export declare function cookieSessionResponse(response: Response): Promise<Response>;
+//# sourceMappingURL=bearerSessions.d.ts.map

package/dist/server/better-auth/bearerSessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearerSessions.d.ts","sourceRoot":"","sources":["../../../src/server/better-auth/bearerSessions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGrD,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,SAAS,iBAAiB,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,QAAQ,CAEpH;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAO9E;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAQ5E;AAED,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAmBjF"}

package/dist/server/better-auth/bearerSessions.js

@@ -0,0 +1,38 @@
+import { bearer } from "better-auth/plugins/bearer";
+export function withBearerSessions(options, enabled) {
+    return enabled ? { ...options, plugins: [...(options.plugins ?? []), bearer({ requireSignature: true })] } : options;
+}
+export function hasSessionCookie(headers, cookieName) {
+    return (headers
+        .get("cookie")
+        ?.split(";")
+        .some((cookie) => cookie.trim().startsWith(`${cookieName}=`)) === true);
+}
+export function sessionHeaders(headers, cookieName) {
+    const result = new Headers(headers);
+    if (hasSessionCookie(headers, cookieName)) {
+        result.delete("authorization");
+    }
+    else if (/^bearer\s/iu.test(headers.get("authorization") ?? "")) {
+        result.delete("cookie");
+    }
+    return result;
+}
+export async function cookieSessionResponse(response) {
+    const headers = new Headers(response.headers);
+    headers.delete("set-auth-token");
+    const exposed = headers.get("access-control-expose-headers");
+    if (exposed !== null) {
+        headers.set("access-control-expose-headers", exposed
+            .split(",")
+            .filter((header) => header.trim().toLowerCase() !== "set-auth-token")
+            .join(","));
+    }
+    if (!headers.get("content-type")?.includes("application/json")) {
+        return new Response(response.body, { headers, status: response.status });
+    }
+    const body = JSON.parse(await response.text(), (key, value) => (key === "token" ? undefined : value));
+    headers.delete("content-length");
+    return Response.json(body, { headers, status: response.status });
+}
+//# sourceMappingURL=bearerSessions.js.map

package/dist/server/better-auth/bearerSessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearerSessions.js","sourceRoot":"","sources":["../../../src/server/better-auth/bearerSessions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAMpD,MAAM,UAAU,kBAAkB,CAAqC,OAAiB,EAAE,OAAgB;IACzG,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;AACtH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAgB,EAAE,UAAkB;IACpE,OAAO,CACN,OAAO;SACL,GAAG,CAAC,QAAQ,CAAC;QACd,EAAE,KAAK,CAAC,GAAG,CAAC;SACX,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC,CAAC,KAAK,IAAI,CACvE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAgB,EAAE,UAAkB;IAClE,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,gBAAgB,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAChC,CAAC;SAAM,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QACnE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,QAAkB;IAC7D,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;IAC7D,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CACV,+BAA+B,EAC/B,OAAO;aACL,KAAK,CAAC,GAAG,CAAC;aACV,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,gBAAgB,CAAC;aACpE,IAAI,CAAC,GAAG,CAAC,CACX,CAAC;IACH,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAChE,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,KAAc,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACxH,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACjC,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;AAClE,CAAC"}

package/dist/server/better-auth/memoryRateLimit.d.ts

@@ -0,0 +1,3 @@
+import { Effect } from "effect";
+export declare const memoryRateLimit: Effect.Effect<import("better-auth").BetterAuthRateLimitStorage, never, import("effect/Scope").Scope>;
+//# sourceMappingURL=memoryRateLimit.d.ts.map

package/dist/server/better-auth/memoryRateLimit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memoryRateLimit.d.ts","sourceRoot":"","sources":["../../../src/server/better-auth/memoryRateLimit.ts"],"names":[],"mappings":"AACA,OAAO,EAAS,MAAM,EAAE,MAAM,QAAQ,CAAC;AAUvC,eAAO,MAAM,eAAe,sGA4C1B,CAAC"}

package/dist/server/better-auth/memoryRateLimit.js

@@ -0,0 +1,46 @@
+import { Clock, Effect } from "effect";
+const MAX_ENTRIES = 100_000;
+export const memoryRateLimit = Effect.gen(function* () {
+    const clock = yield* Clock.Clock;
+    const buckets = yield* Effect.acquireRelease(Effect.sync(() => new Map()), (entries) => Effect.sync(() => entries.clear()));
+    let nextExpiry = Number.POSITIVE_INFINITY;
+    function prune(now) {
+        if (now >= nextExpiry) {
+            nextExpiry = Number.POSITIVE_INFINITY;
+            for (const [entryKey, entry] of buckets) {
+                if (now >= entry.expiresAt) {
+                    buckets.delete(entryKey);
+                }
+                else {
+                    nextExpiry = Math.min(nextExpiry, entry.expiresAt);
+                }
+            }
+        }
+    }
+    const storage = {
+        consume(key, rule) {
+            const now = clock.currentTimeMillisUnsafe();
+            prune(now);
+            const bucket = buckets.get(key);
+            const window = rule.window * 1000;
+            if (bucket !== undefined && now - bucket.lastRequest < window && bucket.count >= rule.max) {
+                return Promise.resolve({ allowed: false, retryAfter: Math.ceil((bucket.lastRequest + window - now) / 1000) });
+            }
+            nextExpiry = Math.min(nextExpiry, now + window);
+            buckets.set(key, {
+                count: bucket === undefined || now - bucket.lastRequest >= window ? 1 : bucket.count + 1,
+                expiresAt: now + window,
+                lastRequest: now,
+            });
+            if (buckets.size > MAX_ENTRIES) {
+                for (const oldest of buckets.keys()) {
+                    buckets.delete(oldest);
+                    break;
+                }
+            }
+            return Promise.resolve({ allowed: true, retryAfter: null });
+        },
+    };
+    return storage;
+});
+//# sourceMappingURL=memoryRateLimit.js.map

package/dist/server/better-auth/memoryRateLimit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memoryRateLimit.js","sourceRoot":"","sources":["../../../src/server/better-auth/memoryRateLimit.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAQvC,MAAM,WAAW,GAAG,OAAO,CAAC;AAE5B,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;IACjC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CAC3C,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,GAAG,EAAkB,CAAC,EAC5C,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAC/C,CAAC;IACF,IAAI,UAAU,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAC1C,SAAS,KAAK,CAAC,GAAW;QACzB,IAAI,GAAG,IAAI,UAAU,EAAE,CAAC;YACvB,UAAU,GAAG,MAAM,CAAC,iBAAiB,CAAC;YACtC,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;gBACzC,IAAI,GAAG,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;oBAC5B,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAC1B,CAAC;qBAAM,CAAC;oBACP,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;gBACpD,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IACD,MAAM,OAAO,GAA6D;QACzE,OAAO,CAAC,GAAG,EAAE,IAAI;YAChB,MAAM,GAAG,GAAG,KAAK,CAAC,uBAAuB,EAAE,CAAC;YAC5C,KAAK,CAAC,GAAG,CAAC,CAAC;YACX,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YAClC,IAAI,MAAM,KAAK,SAAS,IAAI,GAAG,GAAG,MAAM,CAAC,WAAW,GAAG,MAAM,IAAI,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC3F,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,GAAG,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/G,CAAC;YACD,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,GAAG,MAAM,CAAC,CAAC;YAChD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE;gBAChB,KAAK,EAAE,MAAM,KAAK,SAAS,IAAI,GAAG,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC;gBACxF,SAAS,EAAE,GAAG,GAAG,MAAM;gBACvB,WAAW,EAAE,GAAG;aAChB,CAAC,CAAC;YACH,IAAI,OAAO,CAAC,IAAI,GAAG,WAAW,EAAE,CAAC;gBAChC,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;oBACrC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;oBACvB,MAAM;gBACP,CAAC;YACF,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,CAAC;KACD,CAAC;IACF,OAAO,OAAO,CAAC;AAChB,CAAC,CAAC,CAAC"}

package/dist/server/better-auth/mount.d.ts

@@ -0,0 +1,265 @@
+import { type BetterAuthOptions } from "better-auth";
+import { Config, Effect, Redacted } from "effect";
+import { Pool, type PoolConfig } from "pg";
+import type { RoleSet } from "@shivaedev/access/roleSet.ts";
+import type { GetSession } from "#server/adapters/betterAuthSessions.ts";
+import { type BearerSessionsOptions } from "#server/better-auth/bearerSessions.ts";
+import { type RevokeUnadmitted } from "#server/better-auth/revokeUnadmitted.ts";
+import { type SignInPolicy } from "#server/better-auth/signInGate.ts";
+import type { SessionShape } from "#server/session.ts";
+export interface BetterAuthMountOptions<E = never, R = never> {
+    readonly bearerSessions?: BearerSessionsOptions | undefined;
+    readonly roles?: RoleSet;
+    readonly signIn?: SignInPolicy<E, R> | undefined;
+}
+export declare const betterAuthMount: <const TOptions extends BetterAuthOptions, E = never, R = never>(options: TOptions, mount?: BetterAuthMountOptions<E, R> | undefined) => Effect.Effect<{
+    admittedSessions: <TSession extends SessionShape>(getSession: GetSession<TSession>) => GetSession<TSession>;
+    auth: import("better-auth").Auth<TOptions & {
+        advanced: {
+            disableCSRFCheck?: boolean | undefined;
+            disableOriginCheck?: boolean | undefined;
+            crossSubDomainCookies?: {
+                enabled: boolean;
+                additionalCookies?: string[];
+                domain?: string;
+            } | undefined;
+            cookies?: {
+                [key: string]: {
+                    name?: string;
+                    attributes?: import("better-auth").CookieOptions;
+                };
+            } | undefined;
+            defaultCookieAttributes?: import("better-auth").CookieOptions | undefined;
+            cookiePrefix?: string | undefined;
+            database?: {
+                defaultFindManyLimit?: number;
+                generateId?: import("better-auth").GenerateIdFn | false | "serial" | "uuid";
+                joins?: boolean;
+                validateSchema?: boolean;
+            } | undefined;
+            trustedProxyHeaders?: boolean | undefined;
+            backgroundTasks?: {
+                handler: (promise: Promise<unknown>) => void;
+            };
+            skipTrailingSlashes?: boolean;
+            useSecureCookies: boolean | undefined;
+            ipAddress: {
+                disableIpTracking?: boolean;
+                ipv6Subnet?: number;
+                ipAddressHeaders: string[];
+                trustedProxies: string[];
+            };
+        };
+        baseURL: import("better-auth").BaseURLConfig;
+        databaseHooks: {
+            user?: {
+                create?: {
+                    before?: (user: import("better-auth").User & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                        data: {
+                            id?: string | undefined;
+                            createdAt?: Date | undefined;
+                            updatedAt?: Date | undefined;
+                            email?: string | undefined;
+                            emailVerified?: boolean | undefined;
+                            name?: string | undefined;
+                            image?: string | null | undefined;
+                        } & Record<string, any>;
+                    }>;
+                    after?: (user: import("better-auth").User & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+                };
+                update?: {
+                    before?: (user: Partial<import("better-auth").User> & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                        data: {
+                            [x: string]: any;
+                            id?: string | undefined;
+                            createdAt?: Date | undefined;
+                            updatedAt?: Date | undefined;
+                            email?: string | undefined;
+                            emailVerified?: boolean | undefined;
+                            name?: string | undefined;
+                            image?: string | null | undefined;
+                        };
+                    }>;
+                    after?: (user: import("better-auth").User & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+                };
+                delete?: {
+                    before?: (user: import("better-auth").User & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void>;
+                    after?: (user: import("better-auth").User & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+                };
+            };
+            session?: {
+                create?: {
+                    before?: (session: import("better-auth").Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                        data: {
+                            id?: string | undefined;
+                            createdAt?: Date | undefined;
+                            updatedAt?: Date | undefined;
+                            userId?: string | undefined;
+                            expiresAt?: Date | undefined;
+                            token?: string | undefined;
+                            ipAddress?: string | null | undefined;
+                            userAgent?: string | null | undefined;
+                        } & Record<string, any>;
+                    }>;
+                    after?: (session: import("better-auth").Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+                };
+                update?: {
+                    before?: (session: Partial<import("better-auth").Session> & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                        data: {
+                            [x: string]: any;
+                            id?: string | undefined;
+                            createdAt?: Date | undefined;
+                            updatedAt?: Date | undefined;
+                            userId?: string | undefined;
+                            expiresAt?: Date | undefined;
+                            token?: string | undefined;
+                            ipAddress?: string | null | undefined;
+                            userAgent?: string | null | undefined;
+                        };
+                    }>;
+                    after?: (session: import("better-auth").Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+                };
+                delete?: {
+                    before?: (session: import("better-auth").Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void>;
+                    after?: (session: import("better-auth").Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+                };
+            };
+            account?: {
+                create?: {
+                    before?: (account: import("better-auth").Account, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                        data: {
+                            id?: string | undefined;
+                            createdAt?: Date | undefined;
+                            updatedAt?: Date | undefined;
+                            providerId?: string | undefined;
+                            accountId?: string | undefined;
+                            userId?: string | undefined;
+                            accessToken?: string | null | undefined;
+                            refreshToken?: string | null | undefined;
+                            idToken?: string | null | undefined;
+                            accessTokenExpiresAt?: Date | null | undefined;
+                            refreshTokenExpiresAt?: Date | null | undefined;
+                            scope?: string | null | undefined;
+                            password?: string | null | undefined;
+                        } & Record<string, any>;
+                    }>;
+                    after?: (account: import("better-auth").Account, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+                };
+                update?: {
+                    before?: (account: Partial<import("better-auth").Account> & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                        data: {
+                            [x: string]: any;
+                            id?: string | undefined;
+                            createdAt?: Date | undefined;
+                            updatedAt?: Date | undefined;
+                            providerId?: string | undefined;
+                            accountId?: string | undefined;
+                            userId?: string | undefined;
+                            accessToken?: string | null | undefined;
+                            refreshToken?: string | null | undefined;
+                            idToken?: string | null | undefined;
+                            accessTokenExpiresAt?: Date | null | undefined;
+                            refreshTokenExpiresAt?: Date | null | undefined;
+                            scope?: string | null | undefined;
+                            password?: string | null | undefined;
+                        };
+                    }>;
+                    after?: (account: import("better-auth").Account & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+                };
+                delete?: {
+                    before?: (account: import("better-auth").Account & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void>;
+                    after?: (account: import("better-auth").Account & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+                };
+            };
+            verification?: {
+                create?: {
+                    before?: (verification: import("better-auth").Verification & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                        data: {
+                            id?: string | undefined;
+                            createdAt?: Date | undefined;
+                            updatedAt?: Date | undefined;
+                            value?: string | undefined;
+                            expiresAt?: Date | undefined;
+                            identifier?: string | undefined;
+                        } & Record<string, any>;
+                    }>;
+                    after?: (verification: import("better-auth").Verification & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+                };
+                update?: {
+                    before?: (verification: Partial<import("better-auth").Verification> & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                        data: {
+                            [x: string]: any;
+                            id?: string | undefined;
+                            createdAt?: Date | undefined;
+                            updatedAt?: Date | undefined;
+                            value?: string | undefined;
+                            expiresAt?: Date | undefined;
+                            identifier?: string | undefined;
+                        };
+                    }>;
+                    after?: (verification: import("better-auth").Verification & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+                };
+                delete?: {
+                    before?: (verification: import("better-auth").Verification & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void>;
+                    after?: (verification: import("better-auth").Verification & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+                };
+            };
+        } | undefined;
+        rateLimit: {
+            window?: number | undefined;
+            max?: number | undefined;
+            modelName?: "rateLimit" | import("better-auth").LiteralString;
+            fields?: Partial<Record<"count" | "key" | "lastRequest", string>>;
+            customRules?: {
+                [key: string]: import("better-auth").BetterAuthRateLimitRule | false | ((request: Request, currentRule: import("better-auth").BetterAuthRateLimitRule) => import("better-auth").Awaitable<false | import("better-auth").BetterAuthRateLimitRule>);
+            } | undefined;
+            storage?: ("memory" | "database" | "secondary-storage") | undefined;
+            customStorage?: import("better-auth").BetterAuthRateLimitStorage;
+            enabled: boolean;
+        };
+        secret: string;
+        trustedOrigins: string[] | ((request?: Request | undefined) => import("better-auth").Awaitable<(string | undefined | null)[]>);
+        user: (import("better-auth").BetterAuthDBOptions<"user", "createdAt" | "email" | "emailVerified" | "id" | "image" | "name" | "updatedAt"> & {
+            validateUserInfo?: (data: {
+                user: Partial<import("better-auth").User> & Record<string, unknown>;
+                source: import("better-auth").ValidateUserInfoSource;
+            }, context: import("better-auth").GenericEndpointContext) => import("better-auth").Awaitable<void | import("better-auth").ValidateUserInfoResult>;
+            changeEmail?: {
+                enabled: boolean;
+                sendChangeEmailConfirmation?: (data: {
+                    user: import("better-auth").User;
+                    newEmail: string;
+                    url: string;
+                    token: string;
+                }, request?: Request) => Promise<void>;
+                updateEmailWithoutVerification?: boolean;
+            };
+            deleteUser?: {
+                enabled?: boolean;
+                sendDeleteAccountVerification?: (data: {
+                    user: import("better-auth").User;
+                    url: string;
+                    token: string;
+                }, request?: Request) => Promise<void>;
+                beforeDelete?: (user: import("better-auth").User, request?: Request) => Promise<void>;
+                afterDelete?: (user: import("better-auth").User, request?: Request) => Promise<void>;
+                deleteTokenExpiresIn?: number;
+            };
+        }) | undefined;
+    }>;
+    revokeUnadmitted: RevokeUnadmitted<E>;
+    routes: import("effect/Layer").Layer<never, never, import("effect/http/HttpRouter").HttpRouter>;
+    sessions: {
+        roles?: RoleSet;
+        provider: import("#server/session.ts").SessionProvider<{
+            readonly user: {
+                readonly email: string;
+                readonly id: string;
+                readonly name: string;
+                readonly role?: string | null;
+            };
+        }>;
+    };
+}, Config.ConfigError, R | import("effect/Scope").Scope>;
+export declare const authDatabase: (url: Redacted.Redacted<string>, options?: Pick<PoolConfig, "application_name" | "max"> | undefined) => Effect.Effect<Pool, never, import("effect/Scope").Scope>;
+//# sourceMappingURL=mount.d.ts.map

package/dist/server/better-auth/mount.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mount.d.ts","sourceRoot":"","sources":["../../../src/server/better-auth/mount.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,iBAAiB,EAAc,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAU,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,EAAE,IAAI,EAAmB,KAAK,UAAU,EAAE,MAAM,IAAI,CAAC;AAC5D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,KAAK,qBAAqB,EAAsC,MAAM,uCAAuC,CAAC;AAGvH,OAAO,EAAE,KAAK,gBAAgB,EAAoB,MAAM,yCAAyC,CAAC;AAClG,OAAO,EAAsB,KAAK,YAAY,EAAc,MAAM,mCAAmC,CAAC;AAGtG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,MAAM,WAAW,sBAAsB,CAAC,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,KAAK;IAC3D,QAAQ,CAAC,cAAc,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAC5D,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC;CACjD;AAED,eAAO,MAAM,eAAe,SAA0D,QAAQ,SAAS,iBAAiB,EAAE,CAAC,UAAU,CAAC;uBAuD3G,QAAQ,SAAS,YAAY,cAAc,UAAU,CAAC,QAAQ,CAAC,KAAG,UAAU,CAAC,QAAQ,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wDAkC/G,CAAC;AAEH,eAAO,MAAM,YAAY,kKAgCvB,CAAC"}