@shivaedev/identity 0.0.0-stage → 0.1.0

package/dist/server/better-auth/signInPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signInPolicy.d.ts","sourceRoot":"","sources":["../../../src/server/better-auth/signInPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAErG,OAAO,EAAE,MAAM,EAAQ,MAAM,QAAQ,CAAC;AAEtC,OAAO,EAAe,KAAK,aAAa,EAAE,KAAK,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAIrG,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;AAwB1E,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuC5I"}

package/dist/server/better-auth/signInPolicy.js

@@ -0,0 +1,61 @@
+import { APIError } from "better-auth/api";
+import { Effect, Exit } from "effect";
+import { redact } from "@shivaedev/errors/redact.ts";
+import { fromStorage } from "#server/better-auth/signInGate.ts";
+const REFUSED_MESSAGE = "This account may not sign in";
+const UNAVAILABLE_MESSAGE = "Sign-in is temporarily unavailable";
+const refused = { error: "sign_in_refused", errorDescription: REFUSED_MESSAGE };
+const unavailable = { error: "sign_in_unavailable", errorDescription: UNAVAILABLE_MESSAGE };
+function logged(effect) {
+    return Effect.tapCause(effect, (cause) => Effect.logError("Sign-in policy check failed", redact(cause)));
+}
+async function signingInAccount(source, providers) {
+    const profile = source.oauth?.profile;
+    const provider = providers.find(({ id }) => id === source.oauth?.providerId);
+    if (source.method !== "oauth" || profile === undefined || provider === undefined) {
+        return undefined;
+    }
+    const subject = await provider.accountSubject({ profile, tokens: {} });
+    return typeof subject === "string" || typeof subject === "number" ? { accountId: String(subject), providerId: provider.id } : undefined;
+}
+export function signInPolicyOptions(options, gate, run, storage) {
+    const sessionBefore = options.databaseHooks?.session?.create?.before;
+    const before = async (session, endpoint) => {
+        const own = await sessionBefore?.(session, endpoint);
+        if (own === false) {
+            return own;
+        }
+        const userId = typeof own === "object" && typeof own.data.userId === "string" ? own.data.userId : session.userId;
+        const exit = await run(Effect.exit(logged(Effect.flatMap(fromStorage(storage), (auth) => gate.admitsUser(auth, userId)))));
+        if (Exit.isFailure(exit)) {
+            throw new APIError("SERVICE_UNAVAILABLE", { code: unavailable.error, message: UNAVAILABLE_MESSAGE });
+        }
+        if (!exit.value) {
+            throw new APIError("FORBIDDEN", { code: refused.error, message: REFUSED_MESSAGE });
+        }
+        return own;
+    };
+    const validateUserInfo = async (data, endpoint) => {
+        const own = await options.user?.validateUserInfo?.(data, endpoint);
+        if (own !== undefined || data.source.action !== "create-user") {
+            return own;
+        }
+        const account = await signingInAccount(data.source, endpoint.context.socialProviders).catch(() => undefined);
+        if (account === undefined) {
+            return refused;
+        }
+        const exit = await run(Effect.exit(logged(gate.admits([account]))));
+        if (Exit.isFailure(exit)) {
+            return unavailable;
+        }
+        return exit.value ? undefined : refused;
+    };
+    return {
+        databaseHooks: {
+            ...options.databaseHooks,
+            session: { ...options.databaseHooks?.session, create: { ...options.databaseHooks?.session?.create, before } },
+        },
+        user: { ...options.user, validateUserInfo },
+    };
+}
+//# sourceMappingURL=signInPolicy.js.map

package/dist/server/better-auth/signInPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signInPolicy.js","sourceRoot":"","sources":["../../../src/server/better-auth/signInPolicy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AACrD,OAAO,EAAE,WAAW,EAAuC,MAAM,mCAAmC,CAAC;AAMrG,MAAM,eAAe,GAAG,8BAA8B,CAAC;AACvD,MAAM,mBAAmB,GAAG,oCAAoC,CAAC;AACjE,MAAM,OAAO,GAA2B,EAAE,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,eAAe,EAAE,CAAC;AACxG,MAAM,WAAW,GAA2B,EAAE,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,CAAC;AAEpH,SAAS,MAAM,CAAO,MAA2B;IAChD,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,6BAA6B,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC1G,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC9B,MAA8B,EAC9B,SAAiI;IAEjI,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC;IACtC,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC7E,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,IAAI,OAAO,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClF,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IACvE,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACzI,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAI,OAA0B,EAAE,IAAmB,EAAE,GAAc,EAAE,OAAqC;IAC5I,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC;IACrE,MAAM,MAAM,GAAwB,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QAC/D,MAAM,GAAG,GAAG,MAAM,aAAa,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACrD,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;YACnB,OAAO,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QACjH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3H,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,QAAQ,CAAC,qBAAqB,EAAE,EAAE,IAAI,EAAE,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACjB,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,GAAG,CAAC;IACZ,CAAC,CAAC;IACF,MAAM,gBAAgB,GAAqB,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;QACnE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,gBAAgB,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnE,IAAI,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;YAC/D,OAAO,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC7G,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,OAAO,CAAC;QAChB,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,OAAO,WAAW,CAAC;QACpB,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;IACzC,CAAC,CAAC;IACF,OAAO;QACN,aAAa,EAAE;YACd,GAAG,OAAO,CAAC,aAAa;YACxB,OAAO,EAAE,EAAE,GAAG,OAAO,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,OAAO,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;SAC7G;QACD,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,gBAAgB,EAAE;KAC3C,CAAC;AACH,CAAC"}

package/dist/server/better-auth/testDatabase.d.ts

@@ -0,0 +1,19 @@
+import { Effect } from "effect";
+import type { Pool } from "pg";
+export declare function authTestDatabase(pool: Pool): {
+    expireSessions: Effect.Effect<void, import("effect/Cause").UnknownError, never>;
+    omitImageColumn: Effect.Effect<void, import("effect/Cause").UnknownError, never>;
+    sessionIpAddresses: Effect.Effect<{
+        ipAddress: string | null;
+    }[], import("effect/Cause").UnknownError, never>;
+    sessions: Effect.Effect<{
+        email: string;
+        id: string;
+        userId: string;
+    }[], import("effect/Cause").UnknownError, never>;
+    users: Effect.Effect<{
+        email: string;
+        id: string;
+    }[], import("effect/Cause").UnknownError, never>;
+};
+//# sourceMappingURL=testDatabase.d.ts.map

package/dist/server/better-auth/testDatabase.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"testDatabase.d.ts","sourceRoot":"","sources":["../../../src/server/better-auth/testDatabase.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAE/B,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,IAAI;IAEzC,cAAc;IAGd,eAAe;IAGf,kBAAkB;mBAC4B,MAAM,GAAG,IAAI;;IAG3D,QAAQ;eACkC,MAAM;YAAM,MAAM;gBAAU,MAAM;;IAK5E,KAAK;eACqC,MAAM;YAAM,MAAM;;EAI7D"}

package/dist/server/better-auth/testDatabase.js

@@ -0,0 +1,24 @@
+import { Effect } from "effect";
+export function authTestDatabase(pool) {
+    return {
+        expireSessions: Effect.tryPromise(async () => {
+            await pool.query('update "session" set "expiresAt" = now() - interval \'1 second\'');
+        }),
+        omitImageColumn: Effect.tryPromise(async () => {
+            await pool.query('alter table "user" drop column image');
+        }),
+        sessionIpAddresses: Effect.tryPromise(async () => {
+            const result = await pool.query('select "ipAddress" from "session" order by "createdAt", id');
+            return result.rows;
+        }),
+        sessions: Effect.tryPromise(async () => {
+            const result = await pool.query('select s.id, s."userId", u.email from "session" s join "user" u on u.id = s."userId" order by u.email, s.id');
+            return result.rows;
+        }),
+        users: Effect.tryPromise(async () => {
+            const result = await pool.query('select id, email from "user" order by email');
+            return result.rows;
+        }),
+    };
+}
+//# sourceMappingURL=testDatabase.js.map

package/dist/server/better-auth/testDatabase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"testDatabase.js","sourceRoot":"","sources":["../../../src/server/better-auth/testDatabase.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAGhC,MAAM,UAAU,gBAAgB,CAAC,IAAU;IAC1C,OAAO;QACN,cAAc,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE;YAC5C,MAAM,IAAI,CAAC,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACtF,CAAC,CAAC;QACF,eAAe,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE;YAC7C,MAAM,IAAI,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC,CAAC;QACF,kBAAkB,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE;YAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAA+B,4DAA4D,CAAC,CAAC;YAC5H,OAAO,MAAM,CAAC,IAAI,CAAC;QACpB,CAAC,CAAC;QACF,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE;YACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC9B,6GAA6G,CAC7G,CAAC;YACF,OAAO,MAAM,CAAC,IAAI,CAAC;QACpB,CAAC,CAAC;QACF,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE;YACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAgC,6CAA6C,CAAC,CAAC;YAC9G,OAAO,MAAM,CAAC,IAAI,CAAC;QACpB,CAAC,CAAC;KACF,CAAC;AACH,CAAC"}

package/dist/server/better-auth/testing.d.ts

@@ -0,0 +1,24 @@
+import type { AuthContext } from "better-auth";
+import type { testUtils } from "better-auth/plugins";
+type TestContext = ReturnType<ReturnType<typeof testUtils>["init"]>["context"];
+type AccountContext = Pick<AuthContext, "internalAdapter">;
+export declare function signedInUser(auth: {
+    readonly $context: Promise<TestContext & AccountContext>;
+}, { providerAccounts, ...fields }: Parameters<TestContext["test"]["createUser"]>[0] & {
+    readonly providerAccounts?: readonly {
+        readonly providerId: string;
+        readonly accountId: string;
+    }[];
+}): Promise<import("better-auth/plugins").LoginResult>;
+export declare function storedProviderAccounts(auth: {
+    readonly $context: Promise<AccountContext>;
+}, userId: string): Promise<{
+    accountId: string;
+    hasAccessToken: boolean;
+    hasIdToken: boolean;
+    hasPassword: boolean;
+    hasRefreshToken: boolean;
+    providerId: string;
+}[]>;
+export {};
+//# sourceMappingURL=testing.d.ts.map

package/dist/server/better-auth/testing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../../../src/server/better-auth/testing.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD,KAAK,WAAW,GAAG,UAAU,CAAC,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAC/E,KAAK,cAAc,GAAG,IAAI,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;AAE3D,wBAAsB,YAAY,CACjC,IAAI,EAAE;IAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,WAAW,GAAG,cAAc,CAAC,CAAA;CAAE,EAClE,EACC,gBAAqB,EACrB,GAAG,MAAM,EACT,EAAE,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG;IACrD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS;QAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACnG,sDAQD;AAED,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,cAAc,CAAC,CAAA;CAAE,EAAE,MAAM,EAAE,MAAM;;;;;;;KAWhH"}

package/dist/server/better-auth/testing.js

@@ -0,0 +1,21 @@
+export async function signedInUser(auth, { providerAccounts = [], ...fields }) {
+    const { test, internalAdapter } = await auth.$context;
+    const user = await test.saveUser(test.createUser(fields));
+    for (const { providerId, accountId } of providerAccounts) {
+        await internalAdapter.createAccount({ accountId, providerId, userId: user.id });
+    }
+    return test.login({ userId: user.id });
+}
+export async function storedProviderAccounts(auth, userId) {
+    const { internalAdapter } = await auth.$context;
+    const accounts = await internalAdapter.findAccounts(userId);
+    return accounts.map(({ providerId, accountId, accessToken, refreshToken, idToken, password }) => ({
+        accountId,
+        hasAccessToken: Boolean(accessToken),
+        hasIdToken: Boolean(idToken),
+        hasPassword: Boolean(password),
+        hasRefreshToken: Boolean(refreshToken),
+        providerId,
+    }));
+}
+//# sourceMappingURL=testing.js.map

package/dist/server/better-auth/testing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"testing.js","sourceRoot":"","sources":["../../../src/server/better-auth/testing.ts"],"names":[],"mappings":"AAMA,MAAM,CAAC,KAAK,UAAU,YAAY,CACjC,IAAkE,EAClE,EACC,gBAAgB,GAAG,EAAE,EACrB,GAAG,MAAM,EAGT;IAED,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;IACtD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1D,KAAK,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,gBAAgB,EAAE,CAAC;QAC1D,MAAM,eAAe,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAAoD,EAAE,MAAc;IAChH,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;IAChD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAC5D,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QACjG,SAAS;QACT,cAAc,EAAE,OAAO,CAAC,WAAW,CAAC;QACpC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC;QAC5B,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC;QAC9B,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC;QACtC,UAAU;KACV,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/server/better-auth/userProfiles.d.ts

@@ -0,0 +1,14 @@
+import type { Auth } from "better-auth";
+import { Effect } from "effect";
+import { AuthUnavailable } from "@shivaedev/errors/taxonomy.ts";
+export interface UserProfile {
+    readonly id: string;
+    readonly image: string | null;
+    readonly name: string;
+}
+export declare const userProfiles: (auth: {
+    readonly $context: Promise<{
+        readonly adapter: Pick<Awaited<Auth["$context"]>["adapter"], "findMany">;
+    }>;
+}, userIds: readonly string[]) => Effect.Effect<readonly UserProfile[], AuthUnavailable, never>;
+//# sourceMappingURL=userProfiles.d.ts.map

package/dist/server/better-auth/userProfiles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"userProfiles.d.ts","sourceRoot":"","sources":["../../../src/server/better-auth/userProfiles.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAEhE,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACtB;AAED,eAAO,MAAM,YAAY;uBACG,OAAO,CAAC;QAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,CAAA;KAAE,CAAC;+FAwB/G,CAAC"}

package/dist/server/better-auth/userProfiles.js

@@ -0,0 +1,20 @@
+import { Effect } from "effect";
+import { redact } from "@shivaedev/errors/redact.ts";
+import { AuthUnavailable } from "@shivaedev/errors/taxonomy.ts";
+export const userProfiles = Effect.fn("Platform.userProfiles")(function* (auth, userIds) {
+    const ids = [...new Set(userIds)];
+    if (ids.length === 0) {
+        return [];
+    }
+    const users = yield* Effect.tryPromise(async () => {
+        const { adapter } = await auth.$context;
+        return adapter.findMany({
+            limit: ids.length,
+            model: "user",
+            select: ["id", "name", "image"],
+            where: [{ field: "id", operator: "in", value: ids }],
+        });
+    }).pipe(Effect.catch((error) => Effect.andThen(Effect.logError("Authentication provider failed", redact(error.cause)), Effect.fail(new AuthUnavailable({ message: "Authentication is temporarily unavailable" })))));
+    return users.map(({ id, name, image }) => ({ id, image: image ?? null, name }));
+});
+//# sourceMappingURL=userProfiles.js.map

package/dist/server/better-auth/userProfiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"userProfiles.js","sourceRoot":"","sources":["../../../src/server/better-auth/userProfiles.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAQhE,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC,QAAQ,CAAC,EACvE,IAAkH,EAClH,OAA0B;IAE1B,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAClC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,CAAC;IACX,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE;QACjD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;QACxC,OAAO,OAAO,CAAC,QAAQ,CAAc;YACpC,KAAK,EAAE,GAAG,CAAC,MAAM;YACjB,KAAK,EAAE,MAAM;YACb,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC;YAC/B,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;SACpD,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC,IAAI,CACN,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CACtB,MAAM,CAAC,OAAO,CACb,MAAM,CAAC,QAAQ,CAAC,gCAAgC,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EACtE,MAAM,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC,CAAC,CAC1F,CACD,CACD,CAAC;IACF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,IAAI,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACjF,CAAC,CAAC,CAAC"}

package/dist/server/commandChanges.d.ts

@@ -0,0 +1,5 @@
+import { Effect } from "effect";
+import type { Rpc } from "effect/rpc";
+export declare function sessionCommandChanges<A, E, R>(effect: Effect.Effect<A, E, R>, rpc: Rpc.AnyWithProps, payload: unknown): Effect.Effect<A, E, R>;
+export declare function commandChanges<A, E, R>(effect: Effect.Effect<A, E, R>, rpc: Rpc.AnyWithProps, payload: unknown): Effect.Effect<A, E, R>;
+//# sourceMappingURL=commandChanges.d.ts.map

package/dist/server/commandChanges.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commandChanges.d.ts","sourceRoot":"","sources":["../../src/server/commandChanges.ts"],"names":[],"mappings":"AAAA,OAAO,EAAW,MAAM,EAAU,MAAM,QAAQ,CAAC;AAEjD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AAOtC,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,YAAY,EAAE,OAAO,EAAE,OAAO,0BAErH;AAED,wBAAgB,cAAc,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,YAAY,EAAE,OAAO,EAAE,OAAO,0BAsC9G"}

package/dist/server/commandChanges.js

@@ -0,0 +1,44 @@
+import { Context, Effect, Option } from "effect";
+import * as Reactivity from "effect/reactivity/Reactivity";
+import { SqlClient } from "effect/sql";
+import { invalidationKeys } from "@shivaedev/contract/keys.ts";
+import { CommandInvalidation, KeyScope } from "@shivaedev/contract/serverMetadata.ts";
+import { ChangeObserver, invalidateOnCommit, transact } from "@shivaedev/sql/transact.ts";
+import { sessionKeyContext } from "#server/sessionKeys.ts";
+export function sessionCommandChanges(effect, rpc, payload) {
+    return Option.isSome(Context.getOption(rpc.annotations, KeyScope)) ? commandChanges(effect, rpc, payload) : effect;
+}
+export function commandChanges(effect, rpc, payload) {
+    const invalidates = Context.getOption(rpc.annotations, CommandInvalidation);
+    if (Option.isNone(invalidates)) {
+        return effect;
+    }
+    const declared = invalidates.value;
+    return Effect.gen(function* () {
+        const context = yield* sessionKeyContext(rpc);
+        const sql = yield* Effect.serviceOption(SqlClient.SqlClient);
+        const reactivity = yield* Effect.serviceOption(Reactivity.Reactivity);
+        if (Option.isNone(reactivity)) {
+            return yield* effect;
+        }
+        const published = new Set();
+        const observer = yield* ChangeObserver;
+        const result = yield* effect.pipe(Effect.provideService(ChangeObserver, (event) => {
+            if (event._tag === "Published") {
+                for (const key of event.changes) {
+                    published.add(key);
+                }
+            }
+            return observer(event);
+        }));
+        const keys = invalidationKeys(declared(payload, result), context).filter((key) => !published.has(key));
+        if (keys.length > 0) {
+            const announce = Option.isNone(sql)
+                ? reactivity.value.invalidate(keys)
+                : invalidateOnCommit(keys).pipe(transact({ onSqlError: (error) => error }), Effect.provideService(SqlClient.SqlClient, sql.value), Effect.provideService(Reactivity.Reactivity, reactivity.value));
+            yield* announce.pipe(Effect.catchCause((cause) => Effect.logError("Committed command invalidation failed", cause)));
+        }
+        return result;
+    });
+}
+//# sourceMappingURL=commandChanges.js.map

package/dist/server/commandChanges.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commandChanges.js","sourceRoot":"","sources":["../../src/server/commandChanges.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,KAAK,UAAU,MAAM,8BAA8B,CAAC;AAE3D,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AAC1F,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,MAAM,UAAU,qBAAqB,CAAU,MAA8B,EAAE,GAAqB,EAAE,OAAgB;IACrH,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AACpH,CAAC;AAED,MAAM,UAAU,cAAc,CAAU,MAA8B,EAAE,GAAqB,EAAE,OAAgB;IAC9G,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;IAC5E,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC;IACnC,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC7D,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QACtE,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC;QACtB,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAW,CAAC;QACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC;QACvC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAChC,MAAM,CAAC,cAAc,CAAC,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE;YAC/C,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAChC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;oBACjC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACpB,CAAC;YACF,CAAC;YACD,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC,CAAC,CACF,CAAC;QACF,MAAM,IAAI,GAAG,gBAAgB,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACvG,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;gBAClC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;gBACnC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,IAAI,CAC7B,QAAQ,CAAC,EAAE,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,EAC1C,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,EACrD,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC,CAC9D,CAAC;YACJ,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,uCAAuC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QACrH,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC,CAAC,CAAC;AACJ,CAAC"}

package/dist/server/local.d.ts

@@ -0,0 +1,10 @@
+import { Effect } from "effect";
+import { HttpServerRequest, HttpServerResponse } from "effect/http";
+import { RpcSerialization } from "effect/rpc";
+export declare function sameOrigin(request: HttpServerRequest.HttpServerRequest): boolean;
+export declare function loopbackOnly<E, R>(handler: (request: HttpServerRequest.HttpServerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, E, R>): (request: HttpServerRequest.HttpServerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, E, R>;
+export declare function trustedProxyPeer(trustedProxy?: string): (address: string) => boolean;
+export declare function trustedProxyRanges(trustedProxy?: string): string[];
+export declare function localTransport(trustedProxy?: string, nativeOrigins?: readonly string[]): (request: HttpServerRequest.HttpServerRequest) => boolean;
+export declare function localRpcGuard<E, R>(effect: Effect.Effect<HttpServerResponse.HttpServerResponse, E, R>, trustedProxy?: string, nativeOrigins?: readonly string[]): Effect.Effect<HttpServerResponse.HttpServerResponse, E, R | HttpServerRequest.HttpServerRequest | RpcSerialization.RpcSerialization>;
+//# sourceMappingURL=local.d.ts.map

package/dist/server/local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local.d.ts","sourceRoot":"","sources":["../../src/server/local.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAU,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAoB,MAAM,aAAa,CAAC;AACtF,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAsB9C,wBAAgB,UAAU,CAAC,OAAO,EAAE,iBAAiB,CAAC,iBAAiB,GAAG,OAAO,CAWhF;AACD,wBAAgB,YAAY,CAAC,CAAC,EAAE,CAAC,EAChC,OAAO,EAAE,CAAC,OAAO,EAAE,iBAAiB,CAAC,iBAAiB,KAAK,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,CAAC,EAAE,CAAC,CAAC,aAEpG,iBAAiB,CAAC,iBAAiB,gEAIpD;AACD,wBAAgB,gBAAgB,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAGpF;AACD,wBAAgB,kBAAkB,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAElE;AAkBD,wBAAgB,cAAc,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,aAAa,GAAE,SAAS,MAAM,EAAO,aAEzE,iBAAiB,CAAC,iBAAiB,KAAG,OAAO,CAK9D;AACD,wBAAgB,aAAa,CAAC,CAAC,EAAE,CAAC,EACjC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,CAAC,EAAE,CAAC,CAAC,EAClE,YAAY,CAAC,EAAE,MAAM,EACrB,aAAa,GAAE,SAAS,MAAM,EAAO,wIAWrC"}

package/dist/server/local.js

@@ -0,0 +1,93 @@
+import { Effect, Option } from "effect";
+import { HttpServerRequest, HttpServerResponse, HttpTraceContext } from "effect/http";
+import { RpcSerialization } from "effect/rpc";
+import { proxyAddresses, proxyMatches } from "./trustedProxy.js";
+import { trustedProxyRanges as normalizedRanges } from "./trustedProxyRanges.js";
+function loopbackAddress(address) {
+    const unmapped = unmapAddress(address);
+    return unmapped === "::1" || (/^127(?:\.\d{1,3}){3}$/u.test(unmapped) && unmapped.split(".").every((part) => Number(part) <= 255));
+}
+function unmapAddress(address) {
+    return address.replace(/^::ffff:/iu, "");
+}
+function loopbackHost(host) {
+    if (host === undefined) {
+        return false;
+    }
+    const authority = /^(?<hostname>\[[^\]]+\]|[^:]+)(?::(?<port>\d{1,5}))?$/u.exec(host)?.groups;
+    if (authority === undefined || (authority.port !== undefined && Number(authority.port) > 65_535)) {
+        return false;
+    }
+    const hostname = authority.hostname?.toLowerCase();
+    return hostname !== undefined && (hostname === "localhost" || hostname === "[::1]" || loopbackAddress(hostname));
+}
+export function sameOrigin(request) {
+    const origin = request.headers.origin;
+    if (origin === undefined) {
+        return true;
+    }
+    try {
+        const url = new URL(origin);
+        return url.protocol === "http:" && url.origin === origin && url.host === request.headers.host;
+    }
+    catch {
+        return false;
+    }
+}
+export function loopbackOnly(handler) {
+    return (request) => loopbackHost(request.headers.host) && Option.match(request.remoteAddress, { onNone: () => true, onSome: loopbackAddress })
+        ? handler(request)
+        : Effect.succeed(HttpServerResponse.text("Only loopback hosts are served", { status: 403 }));
+}
+export function trustedProxyPeer(trustedProxy) {
+    const addresses = trustedProxy === undefined ? undefined : proxyAddresses(trustedProxy);
+    return (address) => addresses !== undefined && proxyMatches(addresses, address);
+}
+export function trustedProxyRanges(trustedProxy) {
+    return normalizedRanges(trustedProxy);
+}
+function proxyOrigin(request, isTrustedProxy, native) {
+    if (!Option.exists(request.remoteAddress, isTrustedProxy)) {
+        return false;
+    }
+    const host = request.headers["x-forwarded-host"];
+    const protocol = request.headers["x-forwarded-proto"];
+    if (host === undefined || !/^(?:\[[\da-f:]+\]|[\da-z.-]+)(?::\d{1,5})?$/iu.test(host) || (protocol !== "http" && protocol !== "https")) {
+        return false;
+    }
+    try {
+        const url = new URL(`${protocol}://${host}`);
+        return native || request.headers.origin === undefined || request.headers.origin === url.origin;
+    }
+    catch {
+        return false;
+    }
+}
+export function localTransport(trustedProxy, nativeOrigins = []) {
+    const isTrustedProxy = trustedProxyPeer(trustedProxy);
+    return (request) => {
+        const native = nativeOrigins.includes(request.headers.origin ?? "");
+        const local = loopbackHost(request.headers.host) && Option.exists(request.remoteAddress, loopbackAddress);
+        return (local && (native || sameOrigin(request))) || proxyOrigin(request, isTrustedProxy, native);
+    };
+}
+export function localRpcGuard(effect, trustedProxy, nativeOrigins = []) {
+    const allowed = localTransport(trustedProxy, nativeOrigins);
+    return Effect.gen(function* () {
+        const request = yield* HttpServerRequest.HttpServerRequest;
+        const serialization = yield* RpcSerialization.RpcSerialization;
+        const contentType = request.headers["content-type"]?.split(";")[0]?.trim().toLowerCase();
+        return allowed(request) && contentType === serialization.contentType
+            ? yield* continueHttpTrace(effect, request)
+            : HttpServerResponse.text("Local same-origin requests only", { status: 403 });
+    });
+}
+const continueHttpTrace = Effect.fnUntraced(function* (effect, request) {
+    const incoming = HttpTraceContext.w3c(request.headers);
+    if (Option.isNone(incoming)) {
+        return yield* effect;
+    }
+    const parent = Option.getOrElse(yield* Effect.option(Effect.currentParentSpan), () => incoming.value);
+    return yield* Effect.withParentSpan(effect, parent);
+});
+//# sourceMappingURL=local.js.map

package/dist/server/local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local.js","sourceRoot":"","sources":["../../src/server/local.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACtF,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,kBAAkB,IAAI,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAEjF,SAAS,eAAe,CAAC,OAAe;IACvC,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACvC,OAAO,QAAQ,KAAK,KAAK,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;AACpI,CAAC;AACD,SAAS,YAAY,CAAC,OAAe;IACpC,OAAO,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AAC1C,CAAC;AACD,SAAS,YAAY,CAAC,IAAwB;IAC7C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GAAG,wDAAwD,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAC9F,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC;QAClG,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC;IACnD,OAAO,QAAQ,KAAK,SAAS,IAAI,CAAC,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,OAAO,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;AAClH,CAAC;AACD,MAAM,UAAU,UAAU,CAAC,OAA4C;IACtE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;IACtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;IAC/F,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AACD,MAAM,UAAU,YAAY,CAC3B,OAAqH;IAErH,OAAO,CAAC,OAA4C,EAAE,EAAE,CACvD,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QACzH,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QAClB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;AAChG,CAAC;AACD,MAAM,UAAU,gBAAgB,CAAC,YAAqB;IACrD,MAAM,SAAS,GAAG,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;IACxF,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,KAAK,SAAS,IAAI,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AACjF,CAAC;AACD,MAAM,UAAU,kBAAkB,CAAC,YAAqB;IACvD,OAAO,gBAAgB,CAAC,YAAY,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,WAAW,CAAC,OAA4C,EAAE,cAA4C,EAAE,MAAe;IAC/H,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,cAAc,CAAC,EAAE,CAAC;QAC3D,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACtD,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,+CAA+C,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,OAAO,CAAC,EAAE,CAAC;QACxI,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,QAAQ,MAAM,IAAI,EAAE,CAAC,CAAC;QAC7C,OAAO,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC;IAChG,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AACD,MAAM,UAAU,cAAc,CAAC,YAAqB,EAAE,aAAa,GAAsB,EAAE;IAC1F,MAAM,cAAc,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;IACtD,OAAO,CAAC,OAA4C,EAAW,EAAE;QAChE,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACpE,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QAC1G,OAAO,CAAC,KAAK,IAAI,CAAC,MAAM,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;IACnG,CAAC,CAAC;AACH,CAAC;AACD,MAAM,UAAU,aAAa,CAC5B,MAAkE,EAClE,YAAqB,EACrB,aAAa,GAAsB,EAAE;IAErC,MAAM,OAAO,GAAG,cAAc,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,iBAAiB,CAAC;QAC3D,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC,gBAAgB,CAAC;QAC/D,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACzF,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,WAAW,KAAK,aAAa,CAAC,WAAW;YACnE,CAAC,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC;YAC3C,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,iBAAiB,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAW,MAA8B,EAAE,OAA4C;IAC3I,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC;IACtB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACtG,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACrD,CAAC,CAAC,CAAC"}

package/dist/server/origin.d.ts

@@ -0,0 +1,15 @@
+import { Option } from "effect";
+import { Headers } from "effect/http";
+export interface OriginRequest {
+    readonly headers: Headers.Headers;
+    readonly origin: Option.Option<string>;
+    readonly rpc: string;
+}
+export type OriginPolicy = (request: OriginRequest) => boolean;
+export interface TrustedOriginsOptions {
+    readonly allow: readonly string[];
+    readonly missing: "allow" | "reject";
+}
+export declare function trustedOrigins(options: TrustedOriginsOptions): OriginPolicy;
+export declare function originRequest(headers: Headers.Headers, rpc: string): OriginRequest;
+//# sourceMappingURL=origin.d.ts.map

package/dist/server/origin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin.d.ts","sourceRoot":"","sources":["../../src/server/origin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACvC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACrB;AACD,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC;AAC/D,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,QAAQ,CAAC;CACrC;AACD,wBAAgB,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,YAAY,CAM3E;AACD,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,aAAa,CAMlF"}

package/dist/server/origin.js

@@ -0,0 +1,16 @@
+import { Option } from "effect";
+import { Headers } from "effect/http";
+export function trustedOrigins(options) {
+    return ({ origin }) => Option.match(origin, {
+        onNone: () => options.missing === "allow",
+        onSome: (value) => options.allow.includes(value),
+    });
+}
+export function originRequest(headers, rpc) {
+    return {
+        headers,
+        origin: Headers.get(headers, "origin"),
+        rpc,
+    };
+}
+//# sourceMappingURL=origin.js.map

package/dist/server/origin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin.js","sourceRoot":"","sources":["../../src/server/origin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAWtC,MAAM,UAAU,cAAc,CAAC,OAA8B;IAC5D,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CACrB,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE;QACpB,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,KAAK,OAAO;QACzC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;KAChD,CAAC,CAAC;AACL,CAAC;AACD,MAAM,UAAU,aAAa,CAAC,OAAwB,EAAE,GAAW;IAClE,OAAO;QACN,OAAO;QACP,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC;QACtC,GAAG;KACH,CAAC;AACH,CAAC"}

package/dist/server/permissions.d.ts

@@ -0,0 +1,9 @@
+import { Effect, Layer } from "effect";
+import { type HttpServerRequest, HttpServerResponse } from "effect/http";
+import type { Permission } from "@shivaedev/access/permission.ts";
+import { Identity, type SessionUser } from "#identity.ts";
+import { type permissionMiddleware } from "#permission.ts";
+import { type SessionPolicy, type UserSessionShape } from "./session.ts";
+export declare function permissionLayer<TMiddleware, TSession extends UserSessionShape>(middleware: ReturnType<ReturnType<typeof permissionMiddleware<TMiddleware>>>, policy: SessionPolicy<TSession>): Layer.Layer<TMiddleware, never, never>;
+export declare function permissionRoute<TSession extends UserSessionShape>(policy: SessionPolicy<TSession>, permission: Permission): <E, R>(handler: (request: HttpServerRequest.HttpServerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, E, R>) => (request: HttpServerRequest.HttpServerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, E, Exclude<R, Identity | SessionUser>>;
+//# sourceMappingURL=permissions.d.ts.map

package/dist/server/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/server/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAU,MAAM,QAAQ,CAAC;AAC/C,OAAO,EAAE,KAAK,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEzE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAElE,OAAO,EAAE,QAAQ,EAAE,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAiB,KAAK,oBAAoB,EAAqB,MAAM,gBAAgB,CAAC;AAG7F,OAAO,EAAkB,KAAK,aAAa,EAAE,KAAK,gBAAgB,EAAmB,MAAM,cAAc,CAAC;AAE1G,wBAAgB,eAAe,CAAC,WAAW,EAAE,QAAQ,SAAS,gBAAgB,EAC7E,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC,OAAO,oBAAoB,CAAC,WAAW,CAAC,CAAC,CAAC,EAC5E,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,0CAmB/B;AAQD,wBAAgB,eAAe,CAAC,QAAQ,SAAS,gBAAgB,EAAE,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,UAAU,IACjH,CAAC,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,iBAAiB,CAAC,iBAAiB,KAAK,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,CAAC,EAAE,CAAC,CAAC,eACxH,iBAAiB,CAAC,iBAAiB,KAAG,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,QAAQ,GAAG,WAAW,CAAC,CAAC,CAQ5I"}

package/dist/server/permissions.js

@@ -0,0 +1,31 @@
+import { Effect, Layer, Option } from "effect";
+import { HttpServerResponse } from "effect/http";
+import { Forbidden } from "@shivaedev/errors/taxonomy.ts";
+import { Identity } from "#identity.ts";
+import { hasPermission, requirePermission } from "#permission.ts";
+import { sessionCommandChanges } from "#server/commandChanges.ts";
+import { revalidateStream } from "./revalidateStream.js";
+import { resolveSession, withSessionUser } from "./session.js";
+export function permissionLayer(middleware, policy) {
+    const permission = middleware.permission;
+    const guard = (effect, { headers, rpc, payload }) => {
+        const lookup = Effect.tap(resolveSession(policy, headers, rpc._tag), (session) => Option.isSome(session) && !hasPermission(session.value.user, permission)
+            ? Effect.fail(new Forbidden({ message: `Permission required: ${permission.name} (${permission.strength})` }))
+            : Effect.void);
+        return sessionCommandChanges(effect, rpc, payload).pipe((invocation) => Effect.flatMap(Identity, ({ id }) => invocation.pipe(revalidateStream(policy, rpc, id, lookup))), (invocation) => Effect.andThen(requirePermission(permission), invocation), withSessionUser(policy, headers, rpc._tag));
+    };
+    return Layer.succeed(middleware, guard);
+}
+function rejection(error) {
+    return HttpServerResponse.empty({
+        headers: { "cache-control": "private, no-store" },
+        status: { AuthUnavailable: 503, Forbidden: 403, Unauthorized: 401 }[error._tag],
+    });
+}
+export function permissionRoute(policy, permission) {
+    return (handler) => (request) => Effect.andThen(requirePermission(permission), Effect.context()).pipe(withSessionUser(policy, request.headers, request.url), Effect.matchEffect({
+        onFailure: (error) => Effect.succeed(rejection(error)),
+        onSuccess: (context) => Effect.provideContext(handler(request), context),
+    }));
+}
+//# sourceMappingURL=permissions.js.map

package/dist/server/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/server/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC/C,OAAO,EAA0B,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAGzE,OAAO,EAAwB,SAAS,EAAqB,MAAM,+BAA+B,CAAC;AACnG,OAAO,EAAE,QAAQ,EAAoB,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,aAAa,EAA6B,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAC7F,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,cAAc,EAA6C,eAAe,EAAE,MAAM,cAAc,CAAC;AAE1G,MAAM,UAAU,eAAe,CAC9B,UAA4E,EAC5E,MAA+B;IAE/B,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IACzC,MAAM,KAAK,GAA2G,CACrH,MAAM,EACN,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,EACxB,EAAE;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAChF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC;YACvE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,EAAE,OAAO,EAAE,wBAAwB,UAAU,CAAC,IAAI,KAAK,UAAU,CAAC,QAAQ,GAAG,EAAE,CAAC,CAAC;YAC7G,CAAC,CAAC,MAAM,CAAC,IAAI,CACd,CAAC;QACF,OAAO,qBAAqB,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,IAAI,CACtD,CAAC,UAAU,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAChH,CAAC,UAAU,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,EACzE,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAC1C,CAAC;IACH,CAAC,CAAC;IACF,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;AACzC,CAAC;AACD,SAAS,SAAS,CAAC,KAAiD;IACnE,OAAO,kBAAkB,CAAC,KAAK,CAAC;QAC/B,OAAO,EAAE,EAAE,eAAe,EAAE,mBAAmB,EAAE;QACjD,MAAM,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;KAC/E,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAoC,MAA+B,EAAE,UAAsB;IACzH,OAAO,CAAO,OAAqH,EAAE,EAAE,CACtI,CAAC,OAA4C,EAA+F,EAAE,CAC7I,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,OAAO,EAA0B,CAAC,CAAC,IAAI,CAC3F,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,EACrD,MAAM,CAAC,WAAW,CAAC;QAClB,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACtD,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;KACxE,CAAC,CACF,CAAC;AACL,CAAC"}

package/dist/server/proxyRanges.d.ts

@@ -0,0 +1,4 @@
+import { BlockList } from "node:net";
+export declare function addProxyAddress(addresses: BlockList, entry: string): boolean;
+export declare function proxyRanges(value: string): string[] | undefined;
+//# sourceMappingURL=proxyRanges.d.ts.map

package/dist/server/proxyRanges.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxyRanges.d.ts","sourceRoot":"","sources":["../../src/server/proxyRanges.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAQ,MAAM,UAAU,CAAC;AAE3C,wBAAgB,eAAe,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAkB5E;AA8BD,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAU/D"}

package/dist/server/proxyRanges.js

@@ -0,0 +1,62 @@
+import { BlockList, isIP } from "node:net";
+export function addProxyAddress(addresses, entry) {
+    const parts = entry.trim().split("/");
+    const address = parts[0] ?? "";
+    const family = isIP(address);
+    if (family === 0 || address.includes("%") || parts.length > 2) {
+        return false;
+    }
+    const type = family === 4 ? "ipv4" : "ipv6";
+    const prefix = parts[1];
+    if (prefix === undefined) {
+        addresses.addAddress(address, type);
+    }
+    else {
+        if (!/^\d+$/u.test(prefix) || Number(prefix) > (family === 4 ? 32 : 128)) {
+            return false;
+        }
+        addresses.addSubnet(address, Number(prefix), type);
+    }
+    return true;
+}
+function mappedIpv4(address) {
+    const groups = /^\[::ffff:(?<high>[\da-f]+):(?<low>[\da-f]+)\]$/u.exec(new URL(`http://[${address}]`).hostname)?.groups;
+    if (groups?.high === undefined || groups.low === undefined) {
+        return undefined;
+    }
+    const high = Number.parseInt(groups.high, 16);
+    const low = Number.parseInt(groups.low, 16);
+    return [high >>> 8, high & 255, low >>> 8, low & 255].join(".");
+}
+function normalizedProxyRange(entry) {
+    const range = new BlockList();
+    if (!addProxyAddress(range, entry)) {
+        return undefined;
+    }
+    const [address = "", prefix] = entry.split("/");
+    if (isIP(address) !== 6) {
+        return [entry];
+    }
+    const ipv4 = mappedIpv4(address);
+    const bits = prefix === undefined ? 128 : Number(prefix);
+    if (ipv4 !== undefined) {
+        if (bits >= 96) {
+            return [prefix === undefined ? ipv4 : `${ipv4}/${bits - 96}`];
+        }
+        const network = bits <= 80 ? "::" : `::${((0xff_ff << (96 - bits)) & 0xff_ff).toString(16)}:0:0`;
+        return [`${network}/${bits}`, "0.0.0.0/0"];
+    }
+    return bits < 96 && range.check("::ffff:0:0", "ipv6") ? [entry, "0.0.0.0/0"] : [entry];
+}
+export function proxyRanges(value) {
+    const ranges = [];
+    for (const entry of value.split(",")) {
+        const normalized = normalizedProxyRange(entry.trim());
+        if (normalized === undefined) {
+            return undefined;
+        }
+        ranges.push(...normalized);
+    }
+    return ranges;
+}
+//# sourceMappingURL=proxyRanges.js.map

package/dist/server/proxyRanges.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxyRanges.js","sourceRoot":"","sources":["../../src/server/proxyRanges.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAE3C,MAAM,UAAU,eAAe,CAAC,SAAoB,EAAE,KAAa;IAClE,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/D,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC1B,SAAS,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC;SAAM,CAAC;QACP,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1E,OAAO,KAAK,CAAC;QACd,CAAC;QACD,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AACD,SAAS,UAAU,CAAC,OAAe;IAClC,MAAM,MAAM,GAAG,kDAAkD,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,WAAW,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IACxH,IAAI,MAAM,EAAE,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC5D,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,IAAI,KAAK,CAAC,EAAE,IAAI,GAAG,GAAG,EAAE,GAAG,KAAK,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACjE,CAAC;AACD,SAAS,oBAAoB,CAAC,KAAa;IAC1C,MAAM,KAAK,GAAG,IAAI,SAAS,EAAE,CAAC;IAC9B,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,CAAC,OAAO,GAAG,EAAE,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;YAChB,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC;QACjG,OAAO,CAAC,GAAG,OAAO,IAAI,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,GAAG,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AACxF,CAAC;AACD,MAAM,UAAU,WAAW,CAAC,KAAa;IACxC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,UAAU,GAAG,oBAAoB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACtD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC"}

package/dist/server/resolveRole.d.ts

@@ -0,0 +1,11 @@
+import { Effect } from "effect";
+import type { RoleSet } from "@shivaedev/access/roleSet.ts";
+import { AuthUnavailable } from "@shivaedev/errors/taxonomy.ts";
+export declare function resolveRole(roles: RoleSet, stored: unknown): Effect.Effect<{
+    permissions: {
+        name: string;
+        strength: "any" | "own";
+    }[];
+    role: string;
+}, AuthUnavailable, never>;
+//# sourceMappingURL=resolveRole.d.ts.map

package/dist/server/resolveRole.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveRole.d.ts","sourceRoot":"","sources":["../../src/server/resolveRole.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAEhE,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO;;;;;;2BAE1D"}