@shivaedev/identity 0.1.0 → 0.3.0

package/README.md

@@ -109,11 +109,11 @@ const authentication = Effect.gen(function* () {
 
 Run this Effect in the host's scope. The pool logs idle-client errors at Debug and replaces failed connections on the next query; closing the scope disconnects its clients. A rejected auth handler returns HTTP 503 with `Authentication is temporarily unavailable`.
 
-The mount reads `BETTER_AUTH_SECRET` unless options supply `secret`. `PUBLIC_URL` supplies the default base URL, trusted origin and HTTPS secure-cookie setting; without it, the defaults accept loopback HTTP. Application options can override those defaults. RPC Origin policy remains an application choice.
+The mount reads `BETTER_AUTH_SECRET` unless options supply `secret`. `PUBLIC_URL` supplies the default base URL, trusted origin and HTTPS secure-cookie setting. With it unset, `baseURL.allowedHosts` defaults to `["127.0.0.1:*", "localhost:*"]` over HTTP and `trustedOrigins` defaults to `["http://127.0.0.1:*", "http://localhost:*"]`, accepting both loopback names on any port through a development proxy. Explicit `baseURL` (including `baseURL.allowedHosts`) and `trustedOrigins` options each replace their corresponding default; their lists are not merged. RPC Origin policy remains an application choice.
 
 `AUTH_RATE_LIMIT_ENABLED` is a Config boolean that defaults to true and takes precedence over `options.rateLimit.enabled`. Each mount owns scoped in-memory buckets when `storage` is unset or `"memory"`. Application `customStorage`, `"database"` and `"secondary-storage"` selections pass through; Better Auth chooses the rules and client-IP keys.
 
-`TRUSTED_PROXY` supplies the same address and CIDR policy used by the host. An untrusted transport peer loses `x-forwarded-for` and the configured client-IP header before Better Auth sees the request. `AUTH_CLIENT_IP_HEADER` defaults to `x-forwarded-for`. With no trusted proxy, Better Auth ignores forwarded IPs and shares a rate-limit bucket per path.
+`TRUSTED_PROXY` supplies the same address and CIDR policy used by the host. An untrusted transport peer loses `x-forwarded-for` and the configured client-IP header before Better Auth sees the request. `AUTH_CLIENT_IP_HEADER` defaults to `x-forwarded-for`. Without a trusted proxy, auth rate limiting uses the connection peer address, so different peers have separate buckets and Better Auth receives a client IP without a missing-IP warning. A trusted peer's configured forwarded header takes precedence over the peer address.
 
 For email sign-in through `appHost`, the session record's `ipAddress` follows the same rule. With a trusted peer, `AUTH_CLIENT_IP_HEADER=x-real-ip` stores `X-Real-IP` even if `X-Forwarded-For` supplies a different address; the default header selects the rightmost untrusted address in the `X-Forwarded-For` chain, ignoring trusted proxy hops on the right. With an untrusted peer, neither header can supply the stored address. Sign-in attempts from an untrusted peer share one bucket per path; with a trusted peer and `x-real-ip`, changing `X-Forwarded-For` does not change the bucket, while changing `X-Real-IP` does.
 
@@ -365,8 +365,8 @@ import { resolveChanges } from "@shivaedev/identity/server/sessionKeys.ts";
 const changesRpc = Api.requests.get("preferences.$changes")!;
 const handlers = Api.toLayer({
   "preferences.$changes": ({ queries }) => Stream.unwrap(
-    Effect.map(resolveChanges(changesRpc, queries), ({ keys, context }) =>
-      changes.stream(keys, context)
+    Effect.map(resolveChanges(changesRpc, queries), ({ subscription, context }) =>
+      changes.subscribe(subscription, context)
     )
   ),
   "preferences.get": getPreference,
@@ -374,26 +374,27 @@ const handlers = Api.toLayer({
 });
 ```
 
-Here `changes` is the application's `makeLiveServer` service. Keep `resolveChanges` in the invocation; resolving it while building a shared Layer would lose request identity. Pass both returned arguments to `changes.stream`.
+Here `changes` is the application's `makeLiveServer` service. Keep `resolveChanges` in the invocation; resolving it while building a shared Layer would lose request identity. Pass the authorized subscription and context to `changes.subscribe`; it uses the query scopes to identify affected references and rechecks the same policies before hints leave.
 
-Custom authentication middleware supplies the same boundary by validating the transport session, then wrapping scoped commands with `sessionCommandChanges` before providing `Identity`:
+Custom authentication middleware supplies the same boundary by validating the transport session, then wrapping scoped commands with `commandChanges` before providing `Identity`:
 
 ```ts
-import { Effect, Layer } from "effect";
+import { Effect, Layer, Option } from "effect";
+import { authorizeReads } from "@shivaedev/contract/readPolicy.ts";
 import { Identity } from "@shivaedev/identity/identity.ts";
-import { sessionCommandChanges } from "@shivaedev/identity/server/commandChanges.ts";
+import { commandChanges } from "@shivaedev/identity/server/commandChanges.ts";
 
 const authentication = Layer.succeed(MyAuthentication, (effect, { headers, rpc, payload }) =>
   Effect.gen(function* () {
     const session = yield* requireTransportSession(headers, rpc);
-    return yield* sessionCommandChanges(effect, rpc, payload).pipe(
+    return yield* authorizeReads(commandChanges(effect, rpc, payload), { rpc, payload }, Option.some({ id: session.user.id })).pipe(
       Effect.provideService(Identity, { id: session.user.id })
     );
   })
 );
 ```
 
-`MyAuthentication` declares `provides: Identity` and its authentication errors. `requireTransportSession` is the application's session validation; use `transportHeaders` or `resolveSession` to read HTTP or WebSocket transport credentials. The identity comes from that validated session on each invocation. `requestTracingLayer` publishes only unscoped contract invalidations; custom auth middleware must apply `sessionCommandChanges` for scoped commands. If a transaction explicitly announces scoped dependencies, use `invalidationKeys(keys, { scope: identity.id })` with `invalidateOnCommit` inside `transact` so automatic command invalidation can deduplicate the same physical keys.
+`MyAuthentication` declares `provides: Identity`, its authentication errors and `MissingReadPolicy` and `QueryReadDenied` from `@shivaedev/contract/readPolicyErrors.ts`. Query policies receive the session viewer through `authorizeReads`. `requireTransportSession` is the application's session validation; use `transportHeaders` or `resolveSession` to read HTTP or WebSocket transport credentials. The identity comes from that validated session on each invocation. `requestTracingLayer` publishes only unscoped contract invalidations; custom auth middleware must apply `commandChanges` for scoped commands. If a transaction explicitly announces scoped dependencies, use `invalidationKeys(keys, { scope: identity.id })` with `invalidateOnCommit` inside `transact` so automatic command invalidation can deduplicate the same physical keys.
 
 ### Session freshness in streams
 
@@ -427,7 +428,7 @@ Caller-chosen request ids are correlation data. Keep authorization tied to the a
 
 Use `testUtils()` from `better-auth/plugins` in a test-only Better Auth instance with the host's database, secret and cookie policy. Keep the plugin out of production auth options.
 
-Use `authTestDatabase(pool)` from `@shivaedev/identity/server/better-auth/testDatabase.ts` when a story needs observations or faults in the default Better Auth PostgreSQL schema. It returns Effect readouts `users` (IDs and emails) and `sessions` (IDs, user IDs and emails), plus the test-only faults `expireSessions` and `omitImageColumn`. It never returns tokens, password hashes or provider credentials. These fixtures assume the default table and column mappings and operate on the supplied pool; use only an isolated test database. Application stories keep their auth SQL in this provider-owned boundary.
+Use `authTestDatabase(pool)` from `@shivaedev/identity/server/better-auth/testDatabase.ts` when a story needs observations or faults in the default Better Auth PostgreSQL schema. It returns Effect readouts `users` (IDs and emails) and `sessions` (IDs, user IDs and emails), plus the test-only faults `expireSessions(userId?)` and `omitImageColumn`. Pass a user id to expire only that user's sessions, or call `expireSessions()` to expire every session. It never returns tokens, password hashes or provider credentials. These fixtures assume the default table and column mappings and operate on the supplied pool; use only an isolated test database. Application stories keep their auth SQL in this provider-owned boundary.
 
 ```ts
 import { betterAuth } from "better-auth";
@@ -481,6 +482,12 @@ app.it("the member's provider account stores no credentials", [member], function
 
 With database-backed sessions and cookie caching disabled, revocation rejects that same minted session on the next protected HTTP or RPC request. Cookie caching and secondary storage can change revocation timing.
 
+### Sweep expired sessions in a worker
+
+Better Auth removes an expired session when it is presented. Use `sweepExpiredSessions` from `@shivaedev/identity/server/better-auth/sweepExpiredSessions.ts` to remove expired rows that are never presented again. The Effect reads the application's `SqlClient`, deletes sessions whose `expiresAt` is at or before PostgreSQL's current time, and returns the number removed. It preserves live sessions and needs no Better Auth mount or auth pool. It assumes the default Better Auth PostgreSQL table and column mappings.
+
+Register the Effect with a worker schedule, as the starter does at midnight UTC. SQL and result-decoding failures stay in the Effect's error channel.
+
 ### API
 
 Import the module that defines the name; there is no package-root entry. Paths below follow `@shivaedev/identity/`.
@@ -503,12 +510,13 @@ Import the module that defines the name; there is no package-root entry. Paths b
 | `server/better-auth/signInGate.ts` | `SignInPolicy`: the `accounts`, `rule` and `recheckInterval` of a sign-in policy. |
 | `server/better-auth/revokeUnadmitted.ts` | `RevokedSessions`: the `{ users, sessions }` counts of a revocation. |
 | `server/better-auth/userProfiles.ts` | Public profile lookups for other users. |
+| `server/better-auth/sweepExpiredSessions.ts` | `sweepExpiredSessions`: delete expired sessions through the application's SQL client and return the number removed. |
 | `server/better-auth/testDatabase.ts` | `authTestDatabase(pool)`: test-only identity/session readouts and faults for the default PostgreSQL auth schema. |
 | `server/better-auth/testing.ts` | `signedInUser(auth, fields)`, `storedProviderAccounts(auth, userId)`: test-only minted user sessions and credential storage observations. |
 
 ### Install, setup and limits
 
-Install `@shivaedev/identity` with `effect` as its peer. Everything outside `server/better-auth/` works with only `effect` installed, including the Promise-based `betterAuthSessions` adapter. `server/better-auth/` needs the optional peers `better-auth` and `pg`. Browser code imports only `identity.ts`, `middleware.ts` and `permission.ts`.
+Install `@shivaedev/identity` with `effect` as its peer. Everything outside `server/better-auth/` works with only `effect` installed, including the Promise-based `betterAuthSessions` adapter. Better Auth mounts and test fixtures need the optional peers `better-auth` and `pg`; `sweepExpiredSessions` needs only the application's Effect SQL client. Browser code imports only `identity.ts`, `middleware.ts` and `permission.ts`.
 
 - The package needs Node 24 or newer.
 - Keep the auth provider's configuration, cookie settings and resource authorization in the application. The session adapter takes a session lookup and an optional provider-account lookup and returns a session result; it does not write provider refresh cookies into RPC responses.

package/dist/middleware.d.ts

@@ -1,20 +1,21 @@
 import { Schema } from "effect";
 import { RpcMiddleware } from "effect/rpc";
+import { MissingReadPolicy, QueryReadDenied } from "@shivaedev/contract/readPolicyErrors.ts";
 import { AuthUnavailable, Forbidden, Unauthorized } from "@shivaedev/errors/taxonomy.ts";
 import type { Identity, OptionalIdentity, RequestId, SessionUser, SessionUserWithProviderAccounts } from "./identity.ts";
 declare const RequestTracing_base: RpcMiddleware.ServiceClass<RequestTracing, "@shivaedev/identity/RequestTracing", RequestId, Schema.Never, never, never, false>;
 export declare class RequestTracing extends RequestTracing_base {
 }
-declare const Authenticated_base: RpcMiddleware.ServiceClass<Authenticated, "@shivaedev/identity/Authenticated", Identity, Schema.Union<readonly [typeof Unauthorized, typeof AuthUnavailable, typeof Forbidden]>, never, never, false>;
+declare const Authenticated_base: RpcMiddleware.ServiceClass<Authenticated, "@shivaedev/identity/Authenticated", Identity, Schema.Union<readonly [typeof Unauthorized, typeof AuthUnavailable, typeof Forbidden, typeof MissingReadPolicy, typeof QueryReadDenied]>, never, never, false>;
 export declare class Authenticated extends Authenticated_base {
 }
-declare const MaybeAuthenticated_base: RpcMiddleware.ServiceClass<MaybeAuthenticated, "@shivaedev/identity/MaybeAuthenticated", OptionalIdentity, Schema.Union<readonly [typeof Unauthorized, typeof AuthUnavailable, typeof Forbidden]>, never, never, false>;
+declare const MaybeAuthenticated_base: RpcMiddleware.ServiceClass<MaybeAuthenticated, "@shivaedev/identity/MaybeAuthenticated", OptionalIdentity, Schema.Union<readonly [typeof Unauthorized, typeof AuthUnavailable, typeof Forbidden, typeof MissingReadPolicy, typeof QueryReadDenied]>, never, never, false>;
 export declare class MaybeAuthenticated extends MaybeAuthenticated_base {
 }
-declare const AuthenticatedUser_base: RpcMiddleware.ServiceClass<AuthenticatedUser, "@shivaedev/identity/AuthenticatedUser", Identity | SessionUser, Schema.Union<readonly [typeof Unauthorized, typeof AuthUnavailable, typeof Forbidden]>, never, never, false>;
+declare const AuthenticatedUser_base: RpcMiddleware.ServiceClass<AuthenticatedUser, "@shivaedev/identity/AuthenticatedUser", Identity | SessionUser, Schema.Union<readonly [typeof Unauthorized, typeof AuthUnavailable, typeof Forbidden, typeof MissingReadPolicy, typeof QueryReadDenied]>, never, never, false>;
 export declare class AuthenticatedUser extends AuthenticatedUser_base {
 }
-declare const AuthenticatedUserWithProviderAccounts_base: RpcMiddleware.ServiceClass<AuthenticatedUserWithProviderAccounts, "@shivaedev/identity/AuthenticatedUserWithProviderAccounts", Identity | SessionUser | SessionUserWithProviderAccounts, Schema.Union<readonly [typeof Unauthorized, typeof AuthUnavailable, typeof Forbidden]>, never, never, false>;
+declare const AuthenticatedUserWithProviderAccounts_base: RpcMiddleware.ServiceClass<AuthenticatedUserWithProviderAccounts, "@shivaedev/identity/AuthenticatedUserWithProviderAccounts", Identity | SessionUser | SessionUserWithProviderAccounts, Schema.Union<readonly [typeof Unauthorized, typeof AuthUnavailable, typeof Forbidden, typeof MissingReadPolicy, typeof QueryReadDenied]>, never, never, false>;
 export declare class AuthenticatedUserWithProviderAccounts extends AuthenticatedUserWithProviderAccounts_base {
 }
 export {};

package/dist/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AACzF,OAAO,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE,SAAS,EAAE,WAAW,EAAE,+BAA+B,EAAE,MAAM,eAAe,CAAC;;AACzH,qBAAa,cAAe,SAAQ,mBAKK;CAAG;;AAC5C,qBAAa,aAAc,SAAQ,kBAOjC;CAAG;;AACL,qBAAa,kBAAmB,SAAQ,uBAK0E;CAAG;;AACrH,qBAAa,iBAAkB,SAAQ,sBAOrC;CAAG;;AACL,qBAAa,qCAAsC,SAAQ,0CAKzD;CAAG"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAC7F,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AACzF,OAAO,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE,SAAS,EAAE,WAAW,EAAE,+BAA+B,EAAE,MAAM,eAAe,CAAC;;AACzH,qBAAa,cAAe,SAAQ,mBAKK;CAAG;;AAC5C,qBAAa,aAAc,SAAQ,kBAOjC;CAAG;;AACL,qBAAa,kBAAmB,SAAQ,uBAOtC;CAAG;;AACL,qBAAa,iBAAkB,SAAQ,sBAOrC;CAAG;;AACL,qBAAa,qCAAsC,SAAQ,0CAKzD;CAAG"}

package/dist/middleware.js

@@ -1,20 +1,23 @@
 import { Schema } from "effect";
 import { RpcMiddleware } from "effect/rpc";
+import { MissingReadPolicy, QueryReadDenied } from "@shivaedev/contract/readPolicyErrors.ts";
 import { AuthUnavailable, Forbidden, Unauthorized } from "@shivaedev/errors/taxonomy.ts";
 export class RequestTracing extends RpcMiddleware.Service()("@shivaedev/identity/RequestTracing") {
 }
 export class Authenticated extends RpcMiddleware.Service()("@shivaedev/identity/Authenticated", {
-    error: Schema.Union([Unauthorized, AuthUnavailable, Forbidden]),
+    error: Schema.Union([Unauthorized, AuthUnavailable, Forbidden, MissingReadPolicy, QueryReadDenied]),
 }) {
 }
-export class MaybeAuthenticated extends RpcMiddleware.Service()("@shivaedev/identity/MaybeAuthenticated", { error: Schema.Union([Unauthorized, AuthUnavailable, Forbidden]) }) {
+export class MaybeAuthenticated extends RpcMiddleware.Service()("@shivaedev/identity/MaybeAuthenticated", {
+    error: Schema.Union([Unauthorized, AuthUnavailable, Forbidden, MissingReadPolicy, QueryReadDenied]),
+}) {
 }
 export class AuthenticatedUser extends RpcMiddleware.Service()("@shivaedev/identity/AuthenticatedUser", {
-    error: Schema.Union([Unauthorized, AuthUnavailable, Forbidden]),
+    error: Schema.Union([Unauthorized, AuthUnavailable, Forbidden, MissingReadPolicy, QueryReadDenied]),
 }) {
 }
 export class AuthenticatedUserWithProviderAccounts extends RpcMiddleware.Service()("@shivaedev/identity/AuthenticatedUserWithProviderAccounts", {
-    error: Schema.Union([Unauthorized, AuthUnavailable, Forbidden]),
+    error: Schema.Union([Unauthorized, AuthUnavailable, Forbidden, MissingReadPolicy, QueryReadDenied]),
 }) {
 }
 //# sourceMappingURL=middleware.js.map

package/dist/middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAEzF,MAAM,OAAO,cAAe,SAAQ,aAAa,CAAC,OAAO,EAKtD,CAAC,oCAAoC,CAAC;CAAG;AAC5C,MAAM,OAAO,aAAc,SAAQ,aAAa,CAAC,OAAO,EAKrD,CAAC,mCAAmC,EAAE;IACxC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC;CAC/D,CAAC;CAAG;AACL,MAAM,OAAO,kBAAmB,SAAQ,aAAa,CAAC,OAAO,EAK1D,CAAC,wCAAwC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;CAAG;AACrH,MAAM,OAAO,iBAAkB,SAAQ,aAAa,CAAC,OAAO,EAKzD,CAAC,uCAAuC,EAAE;IAC5C,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC;CAC/D,CAAC;CAAG;AACL,MAAM,OAAO,qCAAsC,SAAQ,aAAa,CAAC,OAAO,EAG7E,CAAC,2DAA2D,EAAE;IAChE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC;CAC/D,CAAC;CAAG"}
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAC7F,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAEzF,MAAM,OAAO,cAAe,SAAQ,aAAa,CAAC,OAAO,EAKtD,CAAC,oCAAoC,CAAC;CAAG;AAC5C,MAAM,OAAO,aAAc,SAAQ,aAAa,CAAC,OAAO,EAKrD,CAAC,mCAAmC,EAAE;IACxC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,iBAAiB,EAAE,eAAe,CAAC,CAAC;CACnG,CAAC;CAAG;AACL,MAAM,OAAO,kBAAmB,SAAQ,aAAa,CAAC,OAAO,EAK1D,CAAC,wCAAwC,EAAE;IAC7C,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,iBAAiB,EAAE,eAAe,CAAC,CAAC;CACnG,CAAC;CAAG;AACL,MAAM,OAAO,iBAAkB,SAAQ,aAAa,CAAC,OAAO,EAKzD,CAAC,uCAAuC,EAAE;IAC5C,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,iBAAiB,EAAE,eAAe,CAAC,CAAC;CACnG,CAAC;CAAG;AACL,MAAM,OAAO,qCAAsC,SAAQ,aAAa,CAAC,OAAO,EAG7E,CAAC,2DAA2D,EAAE;IAChE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,iBAAiB,EAAE,eAAe,CAAC,CAAC;CACnG,CAAC;CAAG"}

package/dist/permission.d.ts

@@ -1,9 +1,10 @@
 import { Effect, Schema } from "effect";
 import { RpcMiddleware } from "effect/rpc";
 import type { Permission } from "@shivaedev/access/permission.ts";
+import { MissingReadPolicy, QueryReadDenied } from "@shivaedev/contract/readPolicyErrors.ts";
 import { AuthUnavailable, Forbidden, Unauthorized } from "@shivaedev/errors/taxonomy.ts";
 import { type Identity, SessionUser, type SessionUserValue } from "./identity.ts";
-export declare function permissionMiddleware<TSelf>(): <const TName extends string>(name: TName, permission: Permission) => RpcMiddleware.ServiceClass<TSelf, TName, Identity | SessionUser, Schema.Union<readonly [typeof Unauthorized, typeof AuthUnavailable, typeof Forbidden]>, never, never, false> & {
+export declare function permissionMiddleware<TSelf>(): <const TName extends string>(name: TName, permission: Permission) => RpcMiddleware.ServiceClass<TSelf, TName, Identity | SessionUser, Schema.Union<readonly [typeof Unauthorized, typeof AuthUnavailable, typeof Forbidden, typeof MissingReadPolicy, typeof QueryReadDenied]>, never, never, false> & {
     permission: Permission;
 };
 export declare function hasPermission(user: Pick<SessionUserValue, "id" | "permissions">, permission: Permission): boolean;

package/dist/permission.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission.d.ts","sourceRoot":"","sources":["../src/permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AACzF,OAAO,EAAE,KAAK,QAAQ,EAAE,WAAW,EAAE,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAIlF,wBAAgB,oBAAoB,CAAC,KAAK,MACjC,KAAK,CAAC,KAAK,SAAS,MAAM,QAAQ,KAAK,cAAc,UAAU;;EAEvE;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,GAAG,aAAa,CAAC,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAEjH;AAED,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,UAAU,2DAMvD"}
+{"version":3,"file":"permission.d.ts","sourceRoot":"","sources":["../src/permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAC7F,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AACzF,OAAO,EAAE,KAAK,QAAQ,EAAE,WAAW,EAAE,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAIlF,wBAAgB,oBAAoB,CAAC,KAAK,MACjC,KAAK,CAAC,KAAK,SAAS,MAAM,QAAQ,KAAK,cAAc,UAAU;;EAEvE;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,GAAG,aAAa,CAAC,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAEjH;AAED,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,UAAU,2DAMvD"}

package/dist/permission.js

@@ -1,8 +1,9 @@
 import { Effect, Schema } from "effect";
 import { RpcMiddleware } from "effect/rpc";
+import { MissingReadPolicy, QueryReadDenied } from "@shivaedev/contract/readPolicyErrors.ts";
 import { AuthUnavailable, Forbidden, Unauthorized } from "@shivaedev/errors/taxonomy.ts";
 import { SessionUser } from "./identity.js";
-const Failures = Schema.Union([Unauthorized, AuthUnavailable, Forbidden]);
+const Failures = Schema.Union([Unauthorized, AuthUnavailable, Forbidden, MissingReadPolicy, QueryReadDenied]);
 export function permissionMiddleware() {
     return (name, permission) => Object.assign(RpcMiddleware.Service()(name, { error: Failures }), { permission });
 }

package/dist/permission.js.map

@@ -1 +1 @@
-{"version":3,"file":"permission.js","sourceRoot":"","sources":["../src/permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AACzF,OAAO,EAAiB,WAAW,EAAyB,MAAM,eAAe,CAAC;AAElF,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC,CAAC;AAE1E,MAAM,UAAU,oBAAoB;IACnC,OAAO,CAA6B,IAAW,EAAE,UAAsB,EAAE,EAAE,CAC1E,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,EAA+C,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;AACjI,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAkD,EAAE,UAAsB;IACvG,OAAO,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC;AAC7H,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,UAAsB;IACvD,OAAO,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAC3C,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC;QAC9B,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QACtB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,EAAE,OAAO,EAAE,wBAAwB,UAAU,CAAC,IAAI,KAAK,UAAU,CAAC,QAAQ,GAAG,EAAE,CAAC,CAAC,CAC9G,CAAC;AACH,CAAC"}
+{"version":3,"file":"permission.js","sourceRoot":"","sources":["../src/permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAC7F,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AACzF,OAAO,EAAiB,WAAW,EAAyB,MAAM,eAAe,CAAC;AAElF,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,iBAAiB,EAAE,eAAe,CAAC,CAAC,CAAC;AAE9G,MAAM,UAAU,oBAAoB;IACnC,OAAO,CAA6B,IAAW,EAAE,UAAsB,EAAE,EAAE,CAC1E,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,EAA+C,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;AACjI,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAkD,EAAE,UAAsB;IACvG,OAAO,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC;AAC7H,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,UAAsB;IACvD,OAAO,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAC3C,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC;QAC9B,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QACtB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,EAAE,OAAO,EAAE,wBAAwB,UAAU,CAAC,IAAI,KAAK,UAAU,CAAC,QAAQ,GAAG,EAAE,CAAC,CAAC,CAC9G,CAAC;AACH,CAAC"}

package/dist/server/adapters/betterAuthSessions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"betterAuthSessions.d.ts","sourceRoot":"","sources":["../../../src/server/adapters/betterAuthSessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAqB,MAAM,QAAQ,CAAC;AAGnD,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC9E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACxE,MAAM,MAAM,UAAU,CAAC,QAAQ,SAAS,YAAY,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;AAClH,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,KAAK,OAAO,CAAC,SAAS,oBAAoB,EAAE,CAAC,CAAC;AAC5G,MAAM,MAAM,2BAA2B,CAAC,QAAQ,SAAS,YAAY,IAAI,QAAQ,GAAG;IACnF,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG;QAAE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,oBAAoB,EAAE,EAAE,eAAe,GAAG,YAAY,CAAC,CAAA;KAAE,CAAC;CAChJ,CAAC;AAOF,wBAAgB,kBAAkB,CAAC,QAAQ,SAAS,YAAY,EAAE,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;AAC/H,wBAAgB,kBAAkB,CAAC,QAAQ,SAAS,YAAY,EAC/D,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,EAChC,mBAAmB,EAAE,mBAAmB,GACtC,eAAe,CAAC,2BAA2B,CAAC,QAAQ,CAAC,CAAC,CAAC"}
+{"version":3,"file":"betterAuthSessions.d.ts","sourceRoot":"","sources":["../../../src/server/adapters/betterAuthSessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAqB,MAAM,QAAQ,CAAC;AAInD,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC9E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACxE,MAAM,MAAM,UAAU,CAAC,QAAQ,SAAS,YAAY,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;AAClH,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,KAAK,OAAO,CAAC,SAAS,oBAAoB,EAAE,CAAC,CAAC;AAC5G,MAAM,MAAM,2BAA2B,CAAC,QAAQ,SAAS,YAAY,IAAI,QAAQ,GAAG;IACnF,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG;QAAE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,oBAAoB,EAAE,EAAE,eAAe,GAAG,YAAY,CAAC,CAAA;KAAE,CAAC;CAChJ,CAAC;AAOF,wBAAgB,kBAAkB,CAAC,QAAQ,SAAS,YAAY,EAAE,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;AAC/H,wBAAgB,kBAAkB,CAAC,QAAQ,SAAS,YAAY,EAC/D,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,EAChC,mBAAmB,EAAE,mBAAmB,GACtC,eAAe,CAAC,2BAA2B,CAAC,QAAQ,CAAC,CAAC,CAAC"}

package/dist/server/adapters/betterAuthSessions.js

@@ -1,4 +1,5 @@
 import { Effect, Option, Predicate } from "effect";
+import * as HttpStatus from "effect/http/HttpStatus";
 import { redact } from "@shivaedev/errors/redact.ts";
 import { AuthUnavailable, Unauthorized } from "@shivaedev/errors/taxonomy.ts";
 function unavailable(cause) {
@@ -14,7 +15,7 @@ export function betterAuthSessions(getSession, getProviderAccounts) {
         const providerAccounts = Effect.tryPromise({
             catch: (cause) => cause,
             try: () => getProviderAccounts(transport),
-        }).pipe(Effect.catch((cause) => Predicate.hasProperty(cause, "statusCode") && cause.statusCode === 401
+        }).pipe(Effect.catch((cause) => Predicate.hasProperty(cause, "statusCode") && cause.statusCode === HttpStatus.fromLiteral("Unauthorized")
             ? Effect.fail(new Unauthorized({ message: "Authentication required" }))
             : unavailable(cause)));
         return Option.some({ ...session, user: { ...session.user, providerAccounts } });

package/dist/server/adapters/betterAuthSessions.js.map

@@ -1 +1 @@
-{"version":3,"file":"betterAuthSessions.js","sourceRoot":"","sources":["../../../src/server/adapters/betterAuthSessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAEnD,OAAO,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAQ9E,SAAS,WAAW,CAAC,KAAc;IAClC,OAAO,MAAM,CAAC,OAAO,CACpB,MAAM,CAAC,QAAQ,CAAC,gCAAgC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAChE,MAAM,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC,CAAC,CAC1F,CAAC;AACH,CAAC;AAMD,MAAM,UAAU,kBAAkB,CAAgC,UAAgC,EAAE,mBAAyC;IAC5I,MAAM,iBAAiB,GAAG,MAAM,CAAC,EAAE,CAAC,+BAA+B,CAAC,CAAC,QAAQ,CAAC,EAAE,OAAwB;QACvG,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9H,IAAI,OAAO,KAAK,IAAI,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;YAC3D,OAAO,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,CAAC;YAC1C,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;YACvB,GAAG,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,SAAS,CAAC;SACzC,CAAC,CAAC,IAAI,CACN,MAAM,CAAC,KAAK,CACX,CAAC,KAAK,EAAwD,EAAE,CAC/D,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,KAAK,CAAC,UAAU,KAAK,GAAG;YACrE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;YACvE,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CACtB,CACD,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,EAAE,iBAAiB,EAAE,CAAC;AACnC,CAAC"}
+{"version":3,"file":"betterAuthSessions.js","sourceRoot":"","sources":["../../../src/server/adapters/betterAuthSessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAEnD,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAQ9E,SAAS,WAAW,CAAC,KAAc;IAClC,OAAO,MAAM,CAAC,OAAO,CACpB,MAAM,CAAC,QAAQ,CAAC,gCAAgC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAChE,MAAM,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC,CAAC,CAC1F,CAAC;AACH,CAAC;AAMD,MAAM,UAAU,kBAAkB,CAAgC,UAAgC,EAAE,mBAAyC;IAC5I,MAAM,iBAAiB,GAAG,MAAM,CAAC,EAAE,CAAC,+BAA+B,CAAC,CAAC,QAAQ,CAAC,EAAE,OAAwB;QACvG,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9H,IAAI,OAAO,KAAK,IAAI,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;YAC3D,OAAO,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,CAAC;YAC1C,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;YACvB,GAAG,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,SAAS,CAAC;SACzC,CAAC,CAAC,IAAI,CACN,MAAM,CAAC,KAAK,CACX,CAAC,KAAK,EAAwD,EAAE,CAC/D,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,KAAK,CAAC,UAAU,KAAK,UAAU,CAAC,WAAW,CAAC,cAAc,CAAC;YACxG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;YACvE,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CACtB,CACD,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,EAAE,iBAAiB,EAAE,CAAC;AACnC,CAAC"}

package/dist/server/better-auth/clientIp.d.ts

@@ -0,0 +1,8 @@
+import type { HttpServerRequest } from "effect/http";
+export declare const PEER_IP_HEADER = "x-platform-client-ip";
+export declare function clientIpHeaders(options: {
+    readonly clientIpHeader: string;
+    readonly ipv6Subnet?: number | undefined;
+    readonly trustedProxy?: string | undefined;
+}): (request: HttpServerRequest.HttpServerRequest, web: Request) => void;
+//# sourceMappingURL=clientIp.d.ts.map

package/dist/server/better-auth/clientIp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientIp.d.ts","sourceRoot":"","sources":["../../../src/server/better-auth/clientIp.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGrD,eAAO,MAAM,cAAc,yBAAyB,CAAC;AAErD,wBAAgB,eAAe,CAAC,OAAO,EAAE;IACxC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C,aASiB,iBAAiB,CAAC,iBAAiB,OAAO,OAAO,UAalE"}

package/dist/server/better-auth/clientIp.js

@@ -0,0 +1,28 @@
+import { getIP } from "better-auth/api";
+import { Option } from "effect";
+import { trustedProxyPeer, trustedProxyRanges } from "#server/local.ts";
+export const PEER_IP_HEADER = "x-platform-client-ip";
+export function clientIpHeaders(options) {
+    const trustedPeer = trustedProxyPeer(options.trustedProxy);
+    const advanced = {
+        ipAddress: {
+            ipAddressHeaders: [options.clientIpHeader],
+            ...(options.ipv6Subnet === undefined ? {} : { ipv6Subnet: options.ipv6Subnet }),
+            trustedProxies: trustedProxyRanges(options.trustedProxy),
+        },
+    };
+    return (request, web) => {
+        web.headers.delete(PEER_IP_HEADER);
+        const trusted = Option.exists(request.remoteAddress, trustedPeer);
+        const forwardedIp = trusted ? getIP(web, { advanced }) : null;
+        if (!trusted) {
+            web.headers.delete("x-forwarded-for");
+            web.headers.delete(options.clientIpHeader);
+        }
+        const address = forwardedIp ?? Option.getOrUndefined(request.remoteAddress);
+        if (address !== undefined) {
+            web.headers.set(PEER_IP_HEADER, address);
+        }
+    };
+}
+//# sourceMappingURL=clientIp.js.map

package/dist/server/better-auth/clientIp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientIp.js","sourceRoot":"","sources":["../../../src/server/better-auth/clientIp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAExE,MAAM,CAAC,MAAM,cAAc,GAAG,sBAAsB,CAAC;AAErD,MAAM,UAAU,eAAe,CAAC,OAI/B;IACA,MAAM,WAAW,GAAG,gBAAgB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG;QAChB,SAAS,EAAE;YACV,gBAAgB,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC;YAC1C,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;YAC/E,cAAc,EAAE,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC;SACxD;KACD,CAAC;IACF,OAAO,CAAC,OAA4C,EAAE,GAAY,EAAE,EAAE;QACrE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QAClE,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9D,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;YACtC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC5C,CAAC;QACD,MAAM,OAAO,GAAG,WAAW,IAAI,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAC5E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC3B,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QAC1C,CAAC;IACF,CAAC,CAAC;AACH,CAAC"}

package/dist/server/better-auth/mount.d.ts

@@ -47,7 +47,7 @@ export declare const betterAuthMount: <const TOptions extends BetterAuthOptions,
                 disableIpTracking?: boolean;
                 ipv6Subnet?: number;
                 ipAddressHeaders: string[];
-                trustedProxies: string[];
+                trustedProxies: never[];
             };
         };
         baseURL: import("better-auth").BaseURLConfig;

package/dist/server/better-auth/mount.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mount.d.ts","sourceRoot":"","sources":["../../../src/server/better-auth/mount.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,iBAAiB,EAAc,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAU,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,EAAE,IAAI,EAAmB,KAAK,UAAU,EAAE,MAAM,IAAI,CAAC;AAC5D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,KAAK,qBAAqB,EAAsC,MAAM,uCAAuC,CAAC;AAGvH,OAAO,EAAE,KAAK,gBAAgB,EAAoB,MAAM,yCAAyC,CAAC;AAClG,OAAO,EAAsB,KAAK,YAAY,EAAc,MAAM,mCAAmC,CAAC;AAGtG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,MAAM,WAAW,sBAAsB,CAAC,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,KAAK;IAC3D,QAAQ,CAAC,cAAc,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAC5D,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC;CACjD;AAED,eAAO,MAAM,eAAe,SAA0D,QAAQ,SAAS,iBAAiB,EAAE,CAAC,UAAU,CAAC;uBAuD3G,QAAQ,SAAS,YAAY,cAAc,UAAU,CAAC,QAAQ,CAAC,KAAG,UAAU,CAAC,QAAQ,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wDAkC/G,CAAC;AAEH,eAAO,MAAM,YAAY,kKAgCvB,CAAC"}
+{"version":3,"file":"mount.d.ts","sourceRoot":"","sources":["../../../src/server/better-auth/mount.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,iBAAiB,EAAc,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAU,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,EAAE,IAAI,EAAmB,KAAK,UAAU,EAAE,MAAM,IAAI,CAAC;AAC5D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,KAAK,qBAAqB,EAAsC,MAAM,uCAAuC,CAAC;AAIvH,OAAO,EAAE,KAAK,gBAAgB,EAAoB,MAAM,yCAAyC,CAAC;AAClG,OAAO,EAAsB,KAAK,YAAY,EAAc,MAAM,mCAAmC,CAAC;AAEtG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,MAAM,WAAW,sBAAsB,CAAC,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,KAAK;IAC3D,QAAQ,CAAC,cAAc,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAC5D,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC;CACjD;AAED,eAAO,MAAM,eAAe,SAA0D,QAAQ,SAAS,iBAAiB,EAAE,CAAC,UAAU,CAAC;uBAwD3G,QAAQ,SAAS,YAAY,cAAc,UAAU,CAAC,QAAQ,CAAC,KAAG,UAAU,CAAC,QAAQ,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wDAkC/G,CAAC;AAEH,eAAO,MAAM,YAAY,kKAgCvB,CAAC"}

package/dist/server/better-auth/mount.js

@@ -2,12 +2,12 @@ import { betterAuth } from "better-auth";
 import { Config, Effect, Option, Redacted } from "effect";
 import { Pool } from "pg";
 import { sessionHeaders, withBearerSessions } from "#server/better-auth/bearerSessions.ts";
+import { PEER_IP_HEADER } from "#server/better-auth/clientIp.ts";
 import { memoryRateLimit } from "#server/better-auth/memoryRateLimit.ts";
 import { mountRoutes } from "#server/better-auth/mountRoutes.ts";
 import { revokeUnadmitted } from "#server/better-auth/revokeUnadmitted.ts";
 import { signInGate } from "#server/better-auth/signInGate.ts";
 import { signInPolicyOptions } from "#server/better-auth/signInPolicy.ts";
-import { trustedProxyRanges } from "#server/local.ts";
 import { mountedSessions } from "./mountedSessions.js";
 export const betterAuthMount = Effect.fn("Platform.betterAuthMount")(function* (options, mount = {}) {
     const secret = options.secret ?? Redacted.value(yield* Config.Redacted("BETTER_AUTH_SECRET"));
@@ -16,7 +16,6 @@ export const betterAuthMount = Effect.fn("Platform.betterAuthMount")(function* (
     const trustedProxy = Option.getOrUndefined(yield* Config.String("TRUSTED_PROXY").pipe(Config.option));
     const clientIpHeader = yield* Config.String("AUTH_CLIENT_IP_HEADER").pipe(Config.withDefault("x-forwarded-for"));
     const rateLimitEnabled = yield* Config.Boolean("AUTH_RATE_LIMIT_ENABLED").pipe(Config.withDefault(true));
-    const trustedProxies = trustedProxyRanges(trustedProxy);
     const context = yield* Effect.context();
     const run = Effect.runPromiseWith(context);
     const policy = mount.signIn ?? {};
@@ -34,13 +33,13 @@ export const betterAuthMount = Effect.fn("Platform.betterAuthMount")(function* (
             ...options.advanced,
             ipAddress: {
                 ...options.advanced?.ipAddress,
-                ipAddressHeaders: trustedProxies.length === 0 ? [] : [clientIpHeader],
-                trustedProxies,
+                ipAddressHeaders: [PEER_IP_HEADER],
+                trustedProxies: [],
             },
         },
         "baseURL": options.baseURL
             ?? Option.getOrElse(origin, () => ({
-                allowedHosts: ["127.0.0.1:*"],
+                allowedHosts: ["127.0.0.1:*", "localhost:*"],
                 protocol: "http",
             })),
         databaseHooks: gate.active ? gated.databaseHooks : options.databaseHooks,
@@ -50,12 +49,13 @@ export const betterAuthMount = Effect.fn("Platform.betterAuthMount")(function* (
             enabled: rateLimitEnabled,
         },
         secret,
-        trustedOrigins: options.trustedOrigins ?? [Option.getOrElse(origin, () => "http://127.0.0.1:*")],
+        trustedOrigins: options.trustedOrigins ?? Option.match(origin, { onNone: () => ["http://127.0.0.1:*", "http://localhost:*"], onSome: (url) => [url] }),
         user: gate.active ? gated.user : options.user,
     });
     const authRoutes = mountRoutes(auth, {
         bearerSessions: mount.bearerSessions,
         clientIpHeader,
+        ipv6Subnet: options.advanced?.ipAddress?.ipv6Subnet,
         roles: mount.roles,
         trustedProxy,
     });

package/dist/server/better-auth/mount.js.map

@@ -1 +1 @@
-{"version":3,"file":"mount.js","sourceRoot":"","sources":["../../../src/server/better-auth/mount.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0B,UAAU,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,EAAE,IAAI,EAAoC,MAAM,IAAI,CAAC;AAG5D,OAAO,EAA8B,cAAc,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AACvH,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AACjE,OAAO,EAAyB,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAClG,OAAO,EAAyC,UAAU,EAAE,MAAM,mCAAmC,CAAC;AACtG,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAQvD,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAAC,QAAQ,CAAC,EAC7E,OAAiB,EACjB,KAAK,GAAiC,EAAE;IAExC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC9F,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACtG,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACjH,MAAM,gBAAgB,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IACzG,MAAM,cAAc,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,EAAK,CAAC;IAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;IAClC,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;IACxB,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,GAA2B,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnG,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACpC,MAAM,aAAa,GAClB,SAAS,EAAE,aAAa,IAAI,CAAC,SAAS,EAAE,OAAO,KAAK,SAAS,IAAI,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACvI,MAAM,IAAI,GAAG,UAAU,CAAC;QACvB,GAAG,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC;QAClE,QAAQ,EAAE;YACT,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,QAAQ,KAAK,QAAQ;YACnF,GAAG,OAAO,CAAC,QAAQ;YACnB,SAAS,EAAE;gBACV,GAAG,OAAO,CAAC,QAAQ,EAAE,SAAS;gBAC9B,gBAAgB,EAAE,cAAc,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;gBACrE,cAAc;aACd;SACD;QACD,SAAS,EACR,OAAO,CAAC,OAAO;eACZ,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBAClC,YAAY,EAAE,CAAC,aAAa,CAAC;gBAC7B,QAAQ,EAAE,MAAe;aACzB,CAAC,CAAC;QACJ,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa;QACxE,SAAS,EAAE;YACV,GAAG,SAAS;YACZ,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC;YACzD,OAAO,EAAE,gBAAgB;SACzB;QACD,MAAM;QACN,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,oBAAoB,CAAC,CAAC;QAChG,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI;KAC7C,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,EAAE;QACpC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,cAAc;QACd,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,YAAY;KACZ,CAAC,CAAC;IACH,SAAS,gBAAgB,CAAgC,UAAgC;QACxF,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACxD,OAAO,UAAU,CAAC;QACnB,CAAC;QACD,OAAO,CAAC,OAAO,EAAE,EAAE,CAClB,GAAG,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YACnB,MAAM,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACnE,MAAM,QAAQ,GAAG,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YACvH,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;YACrE,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACtC,OAAO,OAAO,CAAC;YAChB,CAAC;YACD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC9D,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;gBACtD,OAAO,OAAO,CAAC;YAChB,CAAC;YACD,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5F,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAC7H,OAAO,IAAI,CAAC;QACb,CAAC,CAAC,CACF,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAwB,MAAM,CAAC,cAAc,CACxD,gBAAgB,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAC3C,OAAO,CACP,CAAC;IACF,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,eAAe,CAC/B,CAAC,OAAO,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,EACrH,gBAAgB,EAChB,KAAK,CAAC,KAAK,CACX,CAAC;IACF,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAC3F,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC,QAAQ,CAAC,EACvE,GAA8B,EAC9B,OAAO,GAAiD,EAAE;IAE1D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAc,CAAC;IACtC,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,EAAS,CAAC,CAAC;IAC/D,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CAClC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;QAChB,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC;YACrB,GAAG,OAAO;YACV,gBAAgB,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC;SACrC,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACpD,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,GAAG,CACF,MAAM,CAAC,QAAQ,CAAC;gBACf,KAAK,EAAE,kCAAkC;gBACzC,OAAO,EAAE,KAAK,CAAC,OAAO;aACtB,CAAC,CACF,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACb,CAAC,CAAC,EACF,CAAC,IAAI,EAAE,EAAE,CACR,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;QACzB,gEAAgE;QAChE,MAAM,YAAY,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAC/G,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;QACjB,MAAM,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACjC,CAAC,CAAC,CACH,CAAC;AACH,CAAC,CAAC,CAAC"}
+{"version":3,"file":"mount.js","sourceRoot":"","sources":["../../../src/server/better-auth/mount.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0B,UAAU,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,EAAE,IAAI,EAAoC,MAAM,IAAI,CAAC;AAG5D,OAAO,EAA8B,cAAc,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AACvH,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AACjE,OAAO,EAAyB,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAClG,OAAO,EAAyC,UAAU,EAAE,MAAM,mCAAmC,CAAC;AACtG,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAE1E,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAQvD,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAAC,QAAQ,CAAC,EAC7E,OAAiB,EACjB,KAAK,GAAiC,EAAE;IAExC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC9F,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACtG,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACjH,MAAM,gBAAgB,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IACzG,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,EAAK,CAAC;IAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;IAClC,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;IACxB,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,GAA2B,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnG,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACpC,MAAM,aAAa,GAClB,SAAS,EAAE,aAAa,IAAI,CAAC,SAAS,EAAE,OAAO,KAAK,SAAS,IAAI,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACvI,MAAM,IAAI,GAAG,UAAU,CAAC;QACvB,GAAG,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC;QAClE,QAAQ,EAAE;YACT,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,QAAQ,KAAK,QAAQ;YACnF,GAAG,OAAO,CAAC,QAAQ;YACnB,SAAS,EAAE;gBACV,GAAG,OAAO,CAAC,QAAQ,EAAE,SAAS;gBAC9B,gBAAgB,EAAE,CAAC,cAAc,CAAC;gBAClC,cAAc,EAAE,EAAE;aAClB;SACD;QACD,SAAS,EACR,OAAO,CAAC,OAAO;eACZ,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBAClC,YAAY,EAAE,CAAC,aAAa,EAAE,aAAa,CAAC;gBAC5C,QAAQ,EAAE,MAAe;aACzB,CAAC,CAAC;QACJ,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa;QACxE,SAAS,EAAE;YACV,GAAG,SAAS;YACZ,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC;YACzD,OAAO,EAAE,gBAAgB;SACzB;QACD,MAAM;QACN,cAAc,EACb,OAAO,CAAC,cAAc,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,oBAAoB,EAAE,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACvI,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI;KAC7C,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,EAAE;QACpC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,cAAc;QACd,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU;QACnD,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,YAAY;KACZ,CAAC,CAAC;IACH,SAAS,gBAAgB,CAAgC,UAAgC;QACxF,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACxD,OAAO,UAAU,CAAC;QACnB,CAAC;QACD,OAAO,CAAC,OAAO,EAAE,EAAE,CAClB,GAAG,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YACnB,MAAM,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACnE,MAAM,QAAQ,GAAG,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YACvH,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;YACrE,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACtC,OAAO,OAAO,CAAC;YAChB,CAAC;YACD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC9D,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;gBACtD,OAAO,OAAO,CAAC;YAChB,CAAC;YACD,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5F,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAC7H,OAAO,IAAI,CAAC;QACb,CAAC,CAAC,CACF,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAwB,MAAM,CAAC,cAAc,CACxD,gBAAgB,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAC3C,OAAO,CACP,CAAC;IACF,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,eAAe,CAC/B,CAAC,OAAO,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,EACrH,gBAAgB,EAChB,KAAK,CAAC,KAAK,CACX,CAAC;IACF,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAC3F,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC,QAAQ,CAAC,EACvE,GAA8B,EAC9B,OAAO,GAAiD,EAAE;IAE1D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAc,CAAC;IACtC,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,EAAS,CAAC,CAAC;IAC/D,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CAClC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;QAChB,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC;YACrB,GAAG,OAAO;YACV,gBAAgB,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC;SACrC,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACpD,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,GAAG,CACF,MAAM,CAAC,QAAQ,CAAC;gBACf,KAAK,EAAE,kCAAkC;gBACzC,OAAO,EAAE,KAAK,CAAC,OAAO;aACtB,CAAC,CACF,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACb,CAAC,CAAC,EACF,CAAC,IAAI,EAAE,EAAE,CACR,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;QACzB,gEAAgE;QAChE,MAAM,YAAY,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAC/G,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;QACjB,MAAM,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACjC,CAAC,CAAC,CACH,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/server/better-auth/mountRoutes.d.ts

@@ -14,6 +14,7 @@ interface MountedAuth {
 interface MountRouteOptions {
     readonly bearerSessions?: BearerSessionsOptions | undefined;
     readonly clientIpHeader: string;
+    readonly ipv6Subnet?: number | undefined;
     readonly roles?: RoleSet | undefined;
     readonly trustedProxy?: string | undefined;
 }

package/dist/server/better-auth/mountRoutes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mountRoutes.d.ts","sourceRoot":"","sources":["../../../src/server/better-auth/mountRoutes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAyC,MAAM,aAAa,CAAC;AAChF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AAE5D,OAAO,EAAE,KAAK,qBAAqB,EAA2D,MAAM,uCAAuC,CAAC;AAI5I,UAAU,WAAW;IACpB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;QAAE,QAAQ,CAAC,WAAW,EAAE;YAAE,QAAQ,CAAC,YAAY,EAAE;gBAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,CAAA;KAAE,CAAC,CAAC;IAC3G,QAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC1D;AACD,UAAU,iBAAiB;IAC1B,QAAQ,CAAC,cAAc,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAC5D,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAuCD,wBAAgB,WAAW,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iBAAiB,qEAkBxE"}
+{"version":3,"file":"mountRoutes.d.ts","sourceRoot":"","sources":["../../../src/server/better-auth/mountRoutes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAyC,MAAM,aAAa,CAAC;AAEhF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AAE5D,OAAO,EAAE,KAAK,qBAAqB,EAA2D,MAAM,uCAAuC,CAAC;AAI5I,UAAU,WAAW;IACpB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;QAAE,QAAQ,CAAC,WAAW,EAAE;YAAE,QAAQ,CAAC,YAAY,EAAE;gBAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,CAAA;KAAE,CAAC,CAAC;IAC3G,QAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC1D;AACD,UAAU,iBAAiB;IAC1B,QAAQ,CAAC,cAAc,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAC5D,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAuCD,wBAAgB,WAAW,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iBAAiB,qEAqBxE"}

package/dist/server/better-auth/mountRoutes.js

@@ -1,8 +1,9 @@
-import { Effect, Option } from "effect";
+import { Effect } from "effect";
 import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/http";
+import * as HttpStatus from "effect/http/HttpStatus";
 import { redact } from "@shivaedev/errors/redact.ts";
 import { cookieSessionResponse, hasSessionCookie, sessionHeaders } from "#server/better-auth/bearerSessions.ts";
-import { trustedProxyPeer } from "#server/local.ts";
+import { clientIpHeaders } from "./clientIp.js";
 import { sessionPermissions } from "./sessionPermissions.js";
 function replacesSession(request, response, native) {
     return (native
@@ -41,14 +42,11 @@ async function authResponse(auth, web, options) {
     return sessionRequest && response.ok && options.roles !== undefined ? sessionPermissions(response, options.roles) : response;
 }
 export function mountRoutes(auth, options) {
-    const isTrustedProxy = trustedProxyPeer(options.trustedProxy);
+    const setClientIp = clientIpHeaders(options);
     return HttpRouter.use((router) => router.add("*", "/api/auth/*", (request) => Effect.gen(function* () {
         const web = yield* HttpServerRequest.toWeb(request);
-        if (!Option.exists(request.remoteAddress, isTrustedProxy)) {
-            web.headers.delete("x-forwarded-for");
-            web.headers.delete(options.clientIpHeader);
-        }
+        setClientIp(request, web);
         return HttpServerResponse.fromWeb(yield* Effect.tryPromise(() => authResponse(auth, web, options)).pipe(Effect.tapError((error) => Effect.logError("Authentication provider failed", redact(error.cause)))));
-    }).pipe(Effect.catch(() => Effect.succeed(HttpServerResponse.text("Authentication is temporarily unavailable", { status: 503 }))))));
+    }).pipe(Effect.catch(() => Effect.succeed(HttpServerResponse.text("Authentication is temporarily unavailable", { status: HttpStatus.fromLiteral("ServiceUnavailable") }))))));
 }
 //# sourceMappingURL=mountRoutes.js.map

package/dist/server/better-auth/mountRoutes.js.map

@@ -1 +1 @@
-{"version":3,"file":"mountRoutes.js","sourceRoot":"","sources":["../../../src/server/better-auth/mountRoutes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEhF,OAAO,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AACrD,OAAO,EAA8B,qBAAqB,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAC5I,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAY7D,SAAS,eAAe,CAAC,OAAgB,EAAE,QAAkB,EAAE,MAAe;IAC7E,OAAO,CACN,MAAM;WACH,QAAQ,CAAC,EAAE;WACX,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;WACtC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;WACpC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,oBAAoB,CAAC,CACjE,CAAC;AACH,CAAC;AACD,KAAK,UAAU,gBAAgB,CAAC,IAAiB,EAAE,GAAY,EAAE,OAA0B;IAC1F,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;IAC5C,MAAM,UAAU,GAAG,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC;IACjD,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACtI,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,eAAe,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,oBAAoB,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QACjI,MAAM,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAC/C,CAAC;IACF,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;AAC5D,CAAC;AACD,KAAK,UAAU,YAAY,CAAC,IAAiB,EAAE,GAAY,EAAE,OAA0B;IACtF,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,uBAAuB,CAAC;IAC5G,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,cAAc,EAAE,CAAC;QACpB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC7D,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAChE,OAAO,cAAc,IAAI,QAAQ,CAAC,EAAE,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC9H,CAAC;AACD,MAAM,UAAU,WAAW,CAAC,IAAiB,EAAE,OAA0B;IACxE,MAAM,cAAc,GAAG,gBAAgB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC9D,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAChC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,EAAE,CAAC,OAAO,EAAE,EAAE,CAC1C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,cAAc,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;YACtC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,kBAAkB,CAAC,OAAO,CAChC,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CACpE,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,gCAAgC,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAClG,CACD,CAAC;IACH,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,2CAA2C,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAClI,CACD,CAAC;AACH,CAAC"}
+{"version":3,"file":"mountRoutes.js","sourceRoot":"","sources":["../../../src/server/better-auth/mountRoutes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AAErD,OAAO,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AACrD,OAAO,EAA8B,qBAAqB,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAC5I,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAa7D,SAAS,eAAe,CAAC,OAAgB,EAAE,QAAkB,EAAE,MAAe;IAC7E,OAAO,CACN,MAAM;WACH,QAAQ,CAAC,EAAE;WACX,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;WACtC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;WACpC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,oBAAoB,CAAC,CACjE,CAAC;AACH,CAAC;AACD,KAAK,UAAU,gBAAgB,CAAC,IAAiB,EAAE,GAAY,EAAE,OAA0B;IAC1F,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;IAC5C,MAAM,UAAU,GAAG,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC;IACjD,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACtI,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,eAAe,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,oBAAoB,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QACjI,MAAM,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAC/C,CAAC;IACF,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;AAC5D,CAAC;AACD,KAAK,UAAU,YAAY,CAAC,IAAiB,EAAE,GAAY,EAAE,OAA0B;IACtF,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,uBAAuB,CAAC;IAC5G,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,cAAc,EAAE,CAAC;QACpB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC7D,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAChE,OAAO,cAAc,IAAI,QAAQ,CAAC,EAAE,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC9H,CAAC;AACD,MAAM,UAAU,WAAW,CAAC,IAAiB,EAAE,OAA0B;IACxE,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAChC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,EAAE,CAAC,OAAO,EAAE,EAAE,CAC1C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpD,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC1B,OAAO,kBAAkB,CAAC,OAAO,CAChC,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CACpE,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,gCAAgC,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAClG,CACD,CAAC;IACH,CAAC,CAAC,CAAC,IAAI,CACN,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CACjB,MAAM,CAAC,OAAO,CACb,kBAAkB,CAAC,IAAI,CAAC,2CAA2C,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,WAAW,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAC9H,CACD,CACD,CACD,CACD,CAAC;AACH,CAAC"}

package/dist/server/better-auth/sweepExpiredSessions.d.ts

@@ -0,0 +1,4 @@
+import { Effect, Schema } from "effect";
+import { SqlClient } from "effect/sql";
+export declare const sweepExpiredSessions: Effect.Effect<number, Schema.SchemaError | import("effect/sql/SqlError").SqlError, SqlClient.SqlClient>;
+//# sourceMappingURL=sweepExpiredSessions.d.ts.map

package/dist/server/better-auth/sweepExpiredSessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sweepExpiredSessions.d.ts","sourceRoot":"","sources":["../../../src/server/better-auth/sweepExpiredSessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAIvC,eAAO,MAAM,oBAAoB,yGAOwB,CAAC"}

package/dist/server/better-auth/sweepExpiredSessions.js

@@ -0,0 +1,12 @@
+import { Effect, Schema } from "effect";
+import { SqlClient } from "effect/sql";
+const SweepResult = Schema.Tuple([Schema.Struct({ removed: Schema.NumberFromString })]);
+export const sweepExpiredSessions = Effect.gen(function* () {
+    const sql = yield* SqlClient.SqlClient;
+    const rows = yield* sql `with expired as (
+		delete from "session" where "expiresAt" <= now() returning 1
+	) select count(*)::text as removed from expired`;
+    const [result] = yield* Schema.decodeUnknownEffect(SweepResult)(rows);
+    return result.removed;
+}).pipe(Effect.withSpan("Identity.sweepExpiredSessions"));
+//# sourceMappingURL=sweepExpiredSessions.js.map

package/dist/server/better-auth/sweepExpiredSessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sweepExpiredSessions.js","sourceRoot":"","sources":["../../../src/server/better-auth/sweepExpiredSessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC;AAExF,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IACvD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC;IACvC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,GAAG,CAAA;;iDAEyB,CAAC;IACjD,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC;IACtE,OAAO,MAAM,CAAC,OAAO,CAAC;AACvB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,+BAA+B,CAAC,CAAC,CAAC"}

package/dist/server/better-auth/testDatabase.d.ts

@@ -1,7 +1,7 @@
 import { Effect } from "effect";
 import type { Pool } from "pg";
 export declare function authTestDatabase(pool: Pool): {
-    expireSessions: Effect.Effect<void, import("effect/Cause").UnknownError, never>;
+    expireSessions: (userId?: string) => Effect.Effect<void, import("effect/Cause").UnknownError, never>;
     omitImageColumn: Effect.Effect<void, import("effect/Cause").UnknownError, never>;
     sessionIpAddresses: Effect.Effect<{
         ipAddress: string | null;

package/dist/server/better-auth/testDatabase.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testDatabase.d.ts","sourceRoot":"","sources":["../../../src/server/better-auth/testDatabase.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAE/B,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,IAAI;IAEzC,cAAc;IAGd,eAAe;IAGf,kBAAkB;mBAC4B,MAAM,GAAG,IAAI;;IAG3D,QAAQ;eACkC,MAAM;YAAM,MAAM;gBAAU,MAAM;;IAK5E,KAAK;eACqC,MAAM;YAAM,MAAM;;EAI7D"}
+{"version":3,"file":"testDatabase.d.ts","sourceRoot":"","sources":["../../../src/server/better-auth/testDatabase.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAE/B,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,IAAI;IAEzC,cAAc,YAAY,MAAM;IAOhC,eAAe;IAGf,kBAAkB;mBAC4B,MAAM,GAAG,IAAI;;IAG3D,QAAQ;eACkC,MAAM;YAAM,MAAM;gBAAU,MAAM;;IAK5E,KAAK;eACqC,MAAM;YAAM,MAAM;;EAI7D"}

package/dist/server/better-auth/testDatabase.js

@@ -1,8 +1,8 @@
 import { Effect } from "effect";
 export function authTestDatabase(pool) {
     return {
-        expireSessions: Effect.tryPromise(async () => {
-            await pool.query('update "session" set "expiresAt" = now() - interval \'1 second\'');
+        expireSessions: (userId) => Effect.tryPromise(async () => {
+            await pool.query(`update "session" set "expiresAt" = now() - interval '1 second'${userId === undefined ? "" : ' where "userId" = $1'}`, userId === undefined ? [] : [userId]);
         }),
         omitImageColumn: Effect.tryPromise(async () => {
             await pool.query('alter table "user" drop column image');

package/dist/server/better-auth/testDatabase.js.map

@@ -1 +1 @@
-{"version":3,"file":"testDatabase.js","sourceRoot":"","sources":["../../../src/server/better-auth/testDatabase.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAGhC,MAAM,UAAU,gBAAgB,CAAC,IAAU;IAC1C,OAAO;QACN,cAAc,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE;YAC5C,MAAM,IAAI,CAAC,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACtF,CAAC,CAAC;QACF,eAAe,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE;YAC7C,MAAM,IAAI,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC,CAAC;QACF,kBAAkB,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE;YAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAA+B,4DAA4D,CAAC,CAAC;YAC5H,OAAO,MAAM,CAAC,IAAI,CAAC;QACpB,CAAC,CAAC;QACF,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE;YACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC9B,6GAA6G,CAC7G,CAAC;YACF,OAAO,MAAM,CAAC,IAAI,CAAC;QACpB,CAAC,CAAC;QACF,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE;YACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAgC,6CAA6C,CAAC,CAAC;YAC9G,OAAO,MAAM,CAAC,IAAI,CAAC;QACpB,CAAC,CAAC;KACF,CAAC;AACH,CAAC"}
+{"version":3,"file":"testDatabase.js","sourceRoot":"","sources":["../../../src/server/better-auth/testDatabase.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAGhC,MAAM,UAAU,gBAAgB,CAAC,IAAU;IAC1C,OAAO;QACN,cAAc,EAAE,CAAC,MAAe,EAAE,EAAE,CACnC,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,IAAI,CAAC,KAAK,CACf,iEAAiE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,sBAAsB,EAAE,EACrH,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CACpC,CAAC;QACH,CAAC,CAAC;QACH,eAAe,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE;YAC7C,MAAM,IAAI,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC,CAAC;QACF,kBAAkB,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE;YAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAA+B,4DAA4D,CAAC,CAAC;YAC5H,OAAO,MAAM,CAAC,IAAI,CAAC;QACpB,CAAC,CAAC;QACF,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE;YACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC9B,6GAA6G,CAC7G,CAAC;YACF,OAAO,MAAM,CAAC,IAAI,CAAC;QACpB,CAAC,CAAC;QACF,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE;YACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAgC,6CAA6C,CAAC,CAAC;YAC9G,OAAO,MAAM,CAAC,IAAI,CAAC;QACpB,CAAC,CAAC;KACF,CAAC;AACH,CAAC"}

package/dist/server/commandChanges.d.ts

@@ -1,5 +1,4 @@
 import { Effect } from "effect";
 import type { Rpc } from "effect/rpc";
-export declare function sessionCommandChanges<A, E, R>(effect: Effect.Effect<A, E, R>, rpc: Rpc.AnyWithProps, payload: unknown): Effect.Effect<A, E, R>;
 export declare function commandChanges<A, E, R>(effect: Effect.Effect<A, E, R>, rpc: Rpc.AnyWithProps, payload: unknown): Effect.Effect<A, E, R>;
 //# sourceMappingURL=commandChanges.d.ts.map

package/dist/server/commandChanges.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commandChanges.d.ts","sourceRoot":"","sources":["../../src/server/commandChanges.ts"],"names":[],"mappings":"AAAA,OAAO,EAAW,MAAM,EAAU,MAAM,QAAQ,CAAC;AAEjD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AAOtC,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,YAAY,EAAE,OAAO,EAAE,OAAO,0BAErH;AAED,wBAAgB,cAAc,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,YAAY,EAAE,OAAO,EAAE,OAAO,0BAsC9G"}
+{"version":3,"file":"commandChanges.d.ts","sourceRoot":"","sources":["../../src/server/commandChanges.ts"],"names":[],"mappings":"AAAA,OAAO,EAAW,MAAM,EAAU,MAAM,QAAQ,CAAC;AAEjD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AAQtC,wBAAgB,cAAc,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,YAAY,EAAE,OAAO,EAAE,OAAO,0BAuC9G"}