@shivaedev/platform 0.17.0 → 0.18.0

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## 0.18.0 - 2026-10-18
+
+### Added
+
+- effect-sql exports `clientOptions(options, { snakeCase? })` and `SqlNameTransforms` from `clientOptions.ts`. New clients configured with this helper use Effect SQL's native camelCase-to-snake_case query names and snake_case-to-camelCase results by default. Pass `{ snakeCase: false }` to preserve native names, or supply native transform functions in the options.
+- Platform's app database and app host configuration accept native `transformQueryNames` and `transformResultNames`, so applications can use effect-sql's client options without replacing the host's database layer.
+- Declare public client configuration once with `publicConfig(schema)` from `rpc/publicConfig.ts`. Load it at host startup with `publicConfigLayer` from `server/rpc-server/publicConfigLayer.ts` and read the generated contract through native atoms and effect-react's `useQuery`. Only declared fields reach the client; missing or invalid required values fail startup with a typed `ConfigError`.
+- `@shivaedev/platform/better-auth.ts` exposes `betterAuthMount(options)`, returning a typed Better Auth instance and native `/api/auth/*` route Layer with a 503 fallback, trusted-peer forwarded-IP handling and Config-controlled rate limiting. Applications supply their Better Auth options and RPC session policy.
+- `authDatabase(url)` scopes the Better Auth PostgreSQL pool, logs idle-client errors at Debug and waits for clients to disconnect on release. The entry uses the existing Better Auth integration and the optional `pg` peer.
+- Platform exports `authTestUtils(options?)` and `signedInUser(auth, fields)` from `server/better-auth/testing.ts` for typed Better Auth test utilities and signed-in story preconditions with user fields and roles, without OAuth or password hashing.
+- Test-story exports `seedCookies(cookies)` and `DomCookie` from `seedCookies.ts` to seed happy-dom's cookie container, including HttpOnly session cookies accepted by a real HTTP host.
+
+### Changed
+
+- Newly generated applications configure snake_case SQL columns through effect-sql. The starter migrates existing note ownership and word-count columns while retaining camelCase model fields.
+- Import `betterAuthMount` and `authDatabase` from `@shivaedev/platform/server/better-auth/mount.ts`, the module's own path under the package's wildcard export. The separate `@shivaedev/platform/better-auth.ts` entry is removed.
+
+### Breaking
+
+- Provider accounts load when a handler asks for them. Replace `SessionUser.providerAccounts` array reads with `yield* (yield* SessionUserWithProviderAccounts).providerAccounts`, declare `AuthenticatedUserWithProviderAccounts` on the RPC, and install `authenticatedUserWithProviderAccountsLayer(sessions)`. Add `AuthUnavailable` and `Unauthorized` to the RPC's error schema because account lookup failures now fail the reading handler. Base `SessionUserValue` no longer has `providerAccounts`.
+- A custom session provider supplies `user.providerAccounts` as `Effect<readonly ProviderAccountValue[], AuthUnavailable | Unauthorized>`, described by the new `ProviderAccountsSessionShape`, instead of an array. The request boundary memoizes this Effect and projects its results to provider and account IDs. `betterAuthSessions(getSession, getProviderAccounts)` supplies this shape; without a lookup its session user has no accounts field. `SessionUserWithProviderAccountsValue` describes the accounts-capable handler profile. Identity-only requests do not call the lookup, and repeated reads share one lookup per request.
+
 ## 0.17.0 - 2026-10-18
 
 ### Added

package/README.md

@@ -144,6 +144,65 @@ For a deployment behind a proxy, set `HOST=0.0.0.0` and `TRUSTED_PROXY` to a com
 
 A subscription handler reads `AppChanges` and returns `changes.stream(keys)` after its authorization check. Writes use `transact` and `invalidateOnCommit` from effect-sql: local streams receive committed invalidations and rollback emits none. For delivery between processes, set `config.changes: { channel: "app_changes" }`; the host binds PostgreSQL LISTEN/NOTIFY to the same SQL pool and resyncs streams when its listener recovers. The native heartbeat and retry options may be supplied in `changes`. A worker can provide `appDatabase({ migrations, config })` to its service Layer to share this database and delivery composition without starting HTTP.
 
+### Public client configuration
+
+Use one `publicConfig` declaration per application as the one path for server configuration that a client needs. Declare only public fields in a shared Schema; the declaration creates a standard effect-contract query, so applications write no config RPC. Keep private configuration in server modules.
+
+```ts
+import { Schema } from "effect";
+import { publicConfig } from "@shivaedev/platform/rpc/publicConfig.ts";
+
+export const PublicConfig = publicConfig(
+  Schema.Struct({ installUrl: Schema.URL }).pipe(
+    Schema.encodeKeys({ installUrl: "INSTALL_URL" }),
+  ),
+);
+```
+
+On the server, merge the declaration into the application's group and its generated handler Layer into the handlers:
+
+```ts
+import { Layer } from "effect";
+import { appHost } from "@shivaedev/platform/server/appHost.ts";
+import { publicConfigLayer } from "@shivaedev/platform/server/rpc-server/publicConfigLayer.ts";
+import { Api, Handlers, sessions } from "./app.ts";
+import { PublicConfig } from "./public-config.ts";
+
+export const Server = appHost({
+  group: Api.merge(PublicConfig),
+  handlers: Layer.merge(Handlers, publicConfigLayer(PublicConfig)),
+  sessions,
+});
+```
+
+`publicConfigLayer` reads `Config.schema` from the host's native ConfigProvider when the handler Layer builds. Missing or invalid required fields fail startup with a typed `ConfigError`. An optional second argument supplies a native Config path: `publicConfigLayer(PublicConfig, "PUBLIC")` reads `PUBLIC_INSTALL_URL` with the default environment provider. Only schema-declared fields are loaded and serialized; other server values never enter this response. The generated query has no session middleware, so it can supply public configuration before sign-in. Merge it alongside authenticated contracts rather than applying authentication to the merged group.
+
+On the client, use the same native `AtomRpc.Service`, NDJSON HTTP protocol and effect-contract `bind` as other queries:
+
+```ts
+import { Layer } from "effect";
+import { FetchHttpClient } from "effect/http";
+import * as AtomRpc from "effect/reactivity/AtomRpc";
+import { RpcClient, RpcSerialization } from "effect/rpc";
+import { bind } from "@shivaedev/effect-contract/bind.ts";
+import { useQuery } from "@shivaedev/effect-react/client/resultState.ts";
+import { PublicConfig } from "./public-config.ts";
+
+class ConfigClient extends AtomRpc.Service<ConfigClient>()("app/ConfigClient", {
+  group: PublicConfig,
+  protocol: RpcClient.layerProtocolHttp({ url: "/rpc" }).pipe(
+    Layer.provide([FetchHttpClient.layer, RpcSerialization.layerNdjson]),
+  ),
+}) {}
+const config = bind(PublicConfig, ConfigClient);
+
+export function usePublicConfig() {
+  return useQuery(config.get.query());
+}
+```
+
+Render inside the application's native registry provider. The query's `data` is an `Option<{ readonly installUrl: URL }>`: the same codec validates server configuration and decodes the RPC response on the client. Public configuration uses the existing atom registry and query lifecycle.
+
 ### 1. Once per application: contracts and session policy
 
 Declare the RPC group in a shared module:
@@ -153,7 +212,7 @@ import { Effect, Schema } from "effect";
 import { Rpc, RpcGroup } from "effect/rpc";
 import { Forbidden } from "@shivaedev/platform/errors/taxonomy.ts";
 import { Identity } from "@shivaedev/platform/rpc/identity.ts";
-import { Authenticated, RequestTracing } from "@shivaedev/platform/rpc/middleware.ts";
+import { Authenticated } from "@shivaedev/platform/rpc/middleware.ts";
 
 export const Account = RpcGroup.make(
   Rpc.make("ReadOwn", {
@@ -161,7 +220,7 @@ export const Account = RpcGroup.make(
     payload: { userId: Schema.String },
     success: Schema.String,
   }),
-).middleware(Authenticated).middleware(RequestTracing);
+).middleware(Authenticated);
 
 export const Handlers = Account.toLayer({
   ReadOwn: ({ userId }) =>
@@ -222,9 +281,14 @@ Here `sessions` is the application's policy from the previous example, with a Be
 
 #### Reading provider account IDs
 
-Opt in to provider account IDs by passing Better Auth's account lookup as the second argument to `betterAuthSessions`. It runs after a session is found, using the same transport headers:
+Pass Better Auth's account lookup as the second argument to `betterAuthSessions`. Declare `AuthenticatedUserWithProviderAccounts` on account-reading RPCs and merge `authenticatedUserWithProviderAccountsLayer(sessions)` alongside their handlers. This boundary requires a provider whose user has a `providerAccounts` Effect; a provider without the second lookup does not satisfy that type.
 
 ```ts
+import { SessionUserWithProviderAccounts } from "@shivaedev/platform/rpc/identity.ts";
+import { AuthenticatedUserWithProviderAccounts } from "@shivaedev/platform/rpc/middleware.ts";
+import { AuthUnavailable, Unauthorized } from "@shivaedev/platform/errors/taxonomy.ts";
+import { authenticatedUserWithProviderAccountsLayer } from "@shivaedev/platform/server/rpc-server/session.ts";
+
 const sessions = {
   origin: trustedOrigins({ allow: ["https://app.example"], missing: "reject" }),
   provider: betterAuthSessions(
@@ -233,14 +297,18 @@ const sessions = {
   ),
 };
 
-const githubAccount = Effect.map(SessionUser, (user) =>
-  user.providerAccounts?.find((account) => account.providerId === "github"),
-);
+const githubAccount = Effect.gen(function* () {
+  const user = yield* SessionUserWithProviderAccounts;
+  const accounts = yield* user.providerAccounts;
+  return accounts.find((account) => account.providerId === "github");
+});
 ```
 
-Use `authenticatedUserLayer(sessions)` as above. `SessionUserValue.providerAccounts` is an optional readonly array of `ProviderAccountValue`, each containing only `{ providerId: string, accountId: string }`. GitHub's numeric user ID is represented as a string, for example `{ providerId: "github", accountId: "123" }`; it is not Better Auth's account-row id. A user without a GitHub account has no matching entry. Without the second lookup, the profile omits `providerAccounts`. No application SQL against Better Auth's `account` table is needed.
+Declare `Schema.Union([AuthUnavailable, Unauthorized])` in the account-reading RPC's `error` schema: lookup failures now come from the handler's Effect. An outage fails with `AuthUnavailable`; a session that expires before the lookup fails with `Unauthorized`. Neither failure exposes provider exception details.
 
-An account lookup failure follows the same `AuthUnavailable` path as a session lookup failure.
+The lookup uses the same transport headers and runs only when the handler evaluates `user.providerAccounts`. The boundary memoizes its result in that invocation's Effect context, including concurrent reads, without sharing it across requests or users. Identity-only handlers never run the accounts lookup. `SessionUserWithProviderAccountsValue.providerAccounts` is a required `Effect<readonly ProviderAccountValue[], AuthUnavailable | Unauthorized>`. Each result contains only `{ providerId: string, accountId: string }`; for example, GitHub's numeric user ID is the string `"123"`, not Better Auth's account-row id. `SessionUser` and `SessionUserValue` contain the base profile without accounts.
+
+A custom session provider supplies `user.providerAccounts` as a lazy Effect with that same result and failure type, described by `ProviderAccountsSessionShape`. The boundary owns request-local memoization and the reduction to public IDs; custom providers need not cache or project the returned account objects.
 
 ### Requiring an admin
 
@@ -441,6 +509,53 @@ export async function consumeSubscription(
 
 The signal aborts on an additional signal, socket close, incomplete request close or an already destroyed connection. Normal completion of a request does not abort a continuing response. Without an explicit `nodeRequest`, the helper can read one from an srvx Web request's `runtime.node.req`. `dispose()` removes Node listeners and can be called repeatedly.
 
+### Mount Better Auth
+
+`betterAuthMount(options)` returns the Better Auth instance and a native route Layer for `/api/auth/*`. It accepts Better Auth options, including application plugins and session policy. Merge `routes` into the HTTP host and use `auth.api.getSession` with `betterAuthSessions` for the application's RPC session provider.
+
+```ts
+import { Config, Effect } from "effect";
+import { authDatabase, betterAuthMount } from "@shivaedev/platform/server/better-auth/mount.ts";
+
+const authentication = Effect.gen(function* () {
+  const database = yield* authDatabase(yield* Config.Redacted("DATABASE_URL"));
+  return yield* betterAuthMount({
+    database,
+    emailAndPassword: { enabled: true },
+    session: { cookieCache: { enabled: false } },
+  });
+});
+```
+
+Run this Effect in the host's scope. The pool logs idle-client errors at Debug and replaces failed connections on the next query; closing the scope disconnects its clients. A rejected auth handler returns HTTP 503 with `Authentication is temporarily unavailable`.
+
+The mount reads `BETTER_AUTH_SECRET` unless options supply `secret`. `PUBLIC_URL` supplies the default base URL, trusted origin and HTTPS secure-cookie setting; without it, the defaults accept loopback HTTP. Application options can override those defaults. RPC Origin policy remains an application choice.
+
+`AUTH_RATE_LIMIT_ENABLED` is a Config boolean that defaults to true and takes precedence over `options.rateLimit.enabled`; other Better Auth rate-limit options pass through. `TRUSTED_PROXY` supplies the same address and CIDR policy used by the host. An untrusted transport peer loses `x-forwarded-for` and the configured client-IP header before Better Auth sees the request. `AUTH_CLIENT_IP_HEADER` defaults to `x-forwarded-for`. With no trusted proxy, Better Auth ignores forwarded IPs and shares a rate-limit bucket per path.
+
+### Signed-in story preconditions
+
+Use `authTestUtils()` from `@shivaedev/platform/server/better-auth/testing.ts` in a test-only Better Auth instance with the host's database, secret and cookie policy. The wrapper preserves the plugin's typed `$context.test` under `exactOptionalPropertyTypes`. Keep the plugin out of production auth options.
+
+```ts
+import { betterAuth } from "better-auth";
+import { authTestUtils, signedInUser } from "@shivaedev/platform/server/better-auth/testing.ts";
+
+const testAuth = betterAuth({
+  ...options,
+  plugins: [...(options.plugins ?? []), authTestUtils()],
+});
+const { user, headers, cookies } = await signedInUser(testAuth, {
+  email: "member@example.test",
+  name: "Member",
+  role: "user,admin",
+});
+```
+
+`options` is the application's auth configuration. `signedInUser` saves the supplied user fields and mints one session through Better Auth's `testUtils`, without OAuth or password hashing. It returns Better Auth's login result: the user, session, signed request headers, browser cookies and token. Roles require the application's role plugin, such as Better Auth's `admin()`. Send `headers` to the real host, or pass `cookies` to test-story's `seedCookies` in a DOM story after setting its host location with `domFetch`. Keep a real sign-in story for each sign-in flow; feature stories start from the minted precondition.
+
+With database-backed sessions and cookie caching disabled, revocation rejects that same minted session on the next protected HTTP or RPC request. Cookie caching and secondary storage can change revocation timing.
+
 ### Optional Better Auth storage on Effect Prisma
 
 When Better Auth's rows belong to an Effect Prisma database, give its adapter the same database service and runtime:
@@ -514,13 +629,13 @@ Import the module that defines the name; there is no package-root entry. Paths b
 | --- | --- |
 | `errors/taxonomy.ts` | `NotFound`, `Unauthorized`, `Forbidden`, `BadRequest`, `Conflict`, `PreconditionFailed`, `TooManyRequests`, `AuthUnavailable`, `InternalServerError`, `ServiceUnavailable`: Schema tagged error classes with a `message`; `BadRequest` and `Conflict` also accept an optional `field`. |
 | `errors/rejectedField.ts` | `rejectedField(unknown)`: the field and message of a field rejection. |
-| `rpc/identity.ts` | `RequestId`, `Identity`, `OptionalIdentity`, `SessionUser`: request-local services. |
-| `rpc/middleware.ts` | `RequestTracing`, `Authenticated`, `AuthenticatedUser`, `MaybeAuthenticated`: native RPC middleware declarations. |
+| `rpc/identity.ts` | `RequestId`, `Identity`, `OptionalIdentity`, `SessionUser`, `SessionUserWithProviderAccounts`: request-local services. |
+| `rpc/middleware.ts` | `RequestTracing`, `Authenticated`, `AuthenticatedUser`, `AuthenticatedUserWithProviderAccounts`, `MaybeAuthenticated`: native RPC middleware declarations. |
 | `rpc/requireAdmin.ts` | `requireAdmin`: the signed-in user with an admin role. |
 | `server/appHost.ts` | `appHost`, `appDatabase`, `AppChanges`: scoped HTTP and PostgreSQL composition with loopback defaults and optional proxy trust. |
 | `server/boundedBody.ts` | `readBoundedBody`, `RequestBodyTooLarge`: bounded body bytes and a typed HTTP 413 failure. |
 | `server/otlpTracing.ts` | `otlpTracing`: opt-in Effect OTLP trace export for worker Layers. |
-| `server/rpc-server/session.ts` | `authenticatedLayer`, `maybeAuthenticatedLayer`, `authenticatedUserLayer`, `withSessionUser`, `resolveSession`: session middleware implementations and the identity boundary. |
+| `server/rpc-server/session.ts` | `authenticatedLayer`, `maybeAuthenticatedLayer`, `authenticatedUserLayer`, `authenticatedUserWithProviderAccountsLayer`, `withSessionUser`, `resolveSession`: session middleware implementations and the identity boundary. |
 | `server/rpc-server/adapters/betterAuthSessions.ts` | `betterAuthSessions(getSession, getProviderAccounts?)`: a session provider from Better Auth lookups. |
 | `server/rpc-server/origin.ts` | `trustedOrigins({ allow, missing })`: an exact Origin allowlist. |
 | `server/rpc-server/local.ts` | `localRpcGuard`, `loopbackOnly`, `sameOrigin`, `trustedProxyPeer`, `trustedProxyRanges`: loopback and proxy guards. |
@@ -530,6 +645,8 @@ Import the module that defines the name; there is no package-root entry. Paths b
 | `server/rpc-server/redact.ts`, `server/rpc-server/redactCause.ts`, `server/rpc-server/sensitive.ts` | `redact`, `redactCause`, `redactDefect`, `redactingErrorReporter`, `isSensitiveKey`, `redactText`: diagnostic redaction. |
 | `server/runtime/makePlatform.ts` | `makePlatformRuntime(layer, { developmentCacheKey? })`. |
 | `server/node-http/subscriptionSignal.ts` | `nodeSubscriptionSignal({ nodeRequest?, request?, signals? })`, returning `{ signal, dispose }`. |
+| `server/better-auth/mount.ts` | `betterAuthMount(options)`, `authDatabase(url)`: native auth routes and a scoped PostgreSQL pool. |
+| `server/better-auth/testing.ts` | `authTestUtils(options?)`, `signedInUser(auth, fields)`: test-only typed Better Auth helpers and minted user sessions. |
 | `server/better-auth/adapter.ts` | `effectPrismaAdapter(Database, runtime, options?)`: a Better Auth adapter over Effect Prisma; `modelName` maps model names. |
 | `server/testing/makePlatformIt.ts` | `makePlatformIt(Database)({ adapter, createCaller, layer, extend? })`. |
 
@@ -547,13 +664,14 @@ Install the optional peers for the selected integration:
 | --- | --- |
 | `server/boundedBody.ts` | `@effect/platform-node` |
 | `server/appHost.ts` | `@effect/platform-node`, `@effect/sql-pg` |
+| `server/better-auth/mount.ts` | `better-auth`, `pg` |
 | `server/better-auth/adapter.ts` | `better-auth`, `@shivaedev/effect-prisma`, `@prisma-next/sql-orm-client` |
 | `server/testing/makePlatformIt.ts` | `@effect/vitest`, `@shivaedev/effect-prisma`, `@shivaedev/effect-trpc`, `@trpc/server` |
 
 - The package needs Node 24 or newer.
 - Keep the auth provider's configuration, cookie settings and resource authorization in the application. The session adapter takes a session lookup and an optional provider-account lookup and returns a session result; it does not write provider refresh cookies into RPC responses.
 - Without an `HttpServerRequest`, `transportHeaders` falls back to the supplied RPC headers. An application using another transport must decide what headers it can trust.
-- `appHost` adds tracing last on its server-side copy of the group. When composing a native RPC server directly, add `RequestTracing` last on the group, as in the example, so it wraps authentication too. Middleware outside that tracing boundary is responsible for its own diagnostics.
+- `appHost` adds tracing last on its server-side copy of the group. When composing a native RPC server directly, add `RequestTracing` last on the group so it wraps authentication too; see the [native-server example](https://github.com/ShivaeDev/platform/blob/main/docs/framework/request-context.md#request-id-identity-and-logging). Middleware outside that tracing boundary is responsible for its own diagnostics.
 - Redaction recognizes common shapes. Keep secrets out of messages and extend the key predicate for application-specific sensitive fields.
 - A development cache key is ignored when `NODE_ENV` is `production`. The application owns runtime disposal.
 - The Better Auth storage adapter's default model mapping capitalizes the model name. Supply `modelName` for a generated schema with another naming convention. Native Better Auth joins (`advanced.database.joins`) are rejected; leave that option off so Better Auth reads related rows with separate queries.

package/dist/rpc/identity.d.ts

@@ -1,4 +1,5 @@
-import { Context, type Option } from "effect";
+import { Context, type Effect, type Option } from "effect";
+import type { AuthUnavailable, Unauthorized } from "#errors/taxonomy.ts";
 declare const RequestId_base: Context.ServiceClass<RequestId, "@shivaedev/platform/rpc/RequestId", string>;
 export declare class RequestId extends RequestId_base {
 }
@@ -18,11 +19,16 @@ export interface ProviderAccountValue {
 export interface SessionUserValue extends IdentityValue {
     readonly email: string;
     readonly name: string;
-    readonly providerAccounts?: readonly ProviderAccountValue[];
     readonly role?: string | null | undefined;
 }
 declare const SessionUser_base: Context.ServiceClass<SessionUser, "@shivaedev/platform/rpc/SessionUser", SessionUserValue>;
 export declare class SessionUser extends SessionUser_base {
 }
+export interface SessionUserWithProviderAccountsValue extends SessionUserValue {
+    readonly providerAccounts: Effect.Effect<readonly ProviderAccountValue[], AuthUnavailable | Unauthorized>;
+}
+declare const SessionUserWithProviderAccounts_base: Context.ServiceClass<SessionUserWithProviderAccounts, "@shivaedev/platform/rpc/SessionUserWithProviderAccounts", SessionUserWithProviderAccountsValue>;
+export declare class SessionUserWithProviderAccounts extends SessionUserWithProviderAccounts_base {
+}
 export {};
 //# sourceMappingURL=identity.d.ts.map

package/dist/rpc/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/rpc/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,QAAQ,CAAC;;AAC9C,qBAAa,SAAU,SAAQ,cAAyE;CAAG;AAC3G,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACpB;;AACD,qBAAa,QAAS,SAAQ,aAA8E;CAAG;;AAC/G,qBAAa,gBAAiB,SAAQ,qBAA6G;CAAG;AACtJ,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC5B;AACD,MAAM,WAAW,gBAAiB,SAAQ,aAAa;IACtD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC5D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CAC1C;;AACD,qBAAa,WAAY,SAAQ,gBAAuF;CAAG"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/rpc/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,MAAM,EAAE,KAAK,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC3D,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;;AACzE,qBAAa,SAAU,SAAQ,cAAyE;CAAG;AAC3G,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACpB;;AACD,qBAAa,QAAS,SAAQ,aAA8E;CAAG;;AAC/G,qBAAa,gBAAiB,SAAQ,qBAA6G;CAAG;AACtJ,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC5B;AACD,MAAM,WAAW,gBAAiB,SAAQ,aAAa;IACtD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CAC1C;;AACD,qBAAa,WAAY,SAAQ,gBAAuF;CAAG;AAC3H,MAAM,WAAW,oCAAqC,SAAQ,gBAAgB;IAC7E,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,oBAAoB,EAAE,EAAE,eAAe,GAAG,YAAY,CAAC,CAAC;CAC1G;;AACD,qBAAa,+BAAgC,SAAQ,oCAEpD;CAAG"}

package/dist/rpc/identity.js

@@ -7,4 +7,6 @@ export class OptionalIdentity extends Context.Service()("@shivaedev/platform/rpc
 }
 export class SessionUser extends Context.Service()("@shivaedev/platform/rpc/SessionUser") {
 }
+export class SessionUserWithProviderAccounts extends Context.Service()("@shivaedev/platform/rpc/SessionUserWithProviderAccounts") {
+}
 //# sourceMappingURL=identity.js.map

package/dist/rpc/identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/rpc/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAe,MAAM,QAAQ,CAAC;AAC9C,MAAM,OAAO,SAAU,SAAQ,OAAO,CAAC,OAAO,EAAqB,CAAC,mCAAmC,CAAC;CAAG;AAI3G,MAAM,OAAO,QAAS,SAAQ,OAAO,CAAC,OAAO,EAA2B,CAAC,kCAAkC,CAAC;CAAG;AAC/G,MAAM,OAAO,gBAAiB,SAAQ,OAAO,CAAC,OAAO,EAAkD,CAAC,0CAA0C,CAAC;CAAG;AAWtJ,MAAM,OAAO,WAAY,SAAQ,OAAO,CAAC,OAAO,EAAiC,CAAC,qCAAqC,CAAC;CAAG"}
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/rpc/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAA4B,MAAM,QAAQ,CAAC;AAE3D,MAAM,OAAO,SAAU,SAAQ,OAAO,CAAC,OAAO,EAAqB,CAAC,mCAAmC,CAAC;CAAG;AAI3G,MAAM,OAAO,QAAS,SAAQ,OAAO,CAAC,OAAO,EAA2B,CAAC,kCAAkC,CAAC;CAAG;AAC/G,MAAM,OAAO,gBAAiB,SAAQ,OAAO,CAAC,OAAO,EAAkD,CAAC,0CAA0C,CAAC;CAAG;AAUtJ,MAAM,OAAO,WAAY,SAAQ,OAAO,CAAC,OAAO,EAAiC,CAAC,qCAAqC,CAAC;CAAG;AAI3H,MAAM,OAAO,+BAAgC,SAAQ,OAAO,CAAC,OAAO,EAAyE,CAC5I,yDAAyD,CACzD;CAAG"}

package/dist/rpc/middleware.d.ts

@@ -1,7 +1,7 @@
 import { Schema } from "effect";
 import { RpcMiddleware } from "effect/rpc";
 import { AuthUnavailable, Forbidden, Unauthorized } from "#errors/taxonomy.ts";
-import type { Identity, OptionalIdentity, RequestId, SessionUser } from "./identity.ts";
+import type { Identity, OptionalIdentity, RequestId, SessionUser, SessionUserWithProviderAccounts } from "./identity.ts";
 declare const RequestTracing_base: RpcMiddleware.ServiceClass<RequestTracing, "@shivaedev/platform/rpc/RequestTracing", RequestId, Schema.Never, never, never, false>;
 export declare class RequestTracing extends RequestTracing_base {
 }
@@ -14,5 +14,8 @@ export declare class MaybeAuthenticated extends MaybeAuthenticated_base {
 declare const AuthenticatedUser_base: RpcMiddleware.ServiceClass<AuthenticatedUser, "@shivaedev/platform/rpc/AuthenticatedUser", Identity | SessionUser, Schema.Union<readonly [typeof Unauthorized, typeof AuthUnavailable, typeof Forbidden]>, never, never, false>;
 export declare class AuthenticatedUser extends AuthenticatedUser_base {
 }
+declare const AuthenticatedUserWithProviderAccounts_base: RpcMiddleware.ServiceClass<AuthenticatedUserWithProviderAccounts, "@shivaedev/platform/rpc/AuthenticatedUserWithProviderAccounts", Identity | SessionUser | SessionUserWithProviderAccounts, Schema.Union<readonly [typeof Unauthorized, typeof AuthUnavailable, typeof Forbidden]>, never, never, false>;
+export declare class AuthenticatedUserWithProviderAccounts extends AuthenticatedUserWithProviderAccounts_base {
+}
 export {};
 //# sourceMappingURL=middleware.d.ts.map

package/dist/rpc/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/rpc/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAC/E,OAAO,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;;AACxF,qBAAa,cAAe,SAAQ,mBAKS;CAAG;;AAChD,qBAAa,aAAc,SAAQ,kBAOjC;CAAG;;AACL,qBAAa,kBAAmB,SAAQ,uBAKgE;CAAG;;AAC3G,qBAAa,iBAAkB,SAAQ,sBAOrC;CAAG"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/rpc/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAC/E,OAAO,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE,SAAS,EAAE,WAAW,EAAE,+BAA+B,EAAE,MAAM,eAAe,CAAC;;AACzH,qBAAa,cAAe,SAAQ,mBAKS;CAAG;;AAChD,qBAAa,aAAc,SAAQ,kBAOjC;CAAG;;AACL,qBAAa,kBAAmB,SAAQ,uBAKgE;CAAG;;AAC3G,qBAAa,iBAAkB,SAAQ,sBAOrC;CAAG;;AACL,qBAAa,qCAAsC,SAAQ,0CAKzD;CAAG"}

package/dist/rpc/middleware.js

@@ -13,4 +13,8 @@ export class AuthenticatedUser extends RpcMiddleware.Service()("@shivaedev/platf
     error: Schema.Union([Unauthorized, AuthUnavailable, Forbidden]),
 }) {
 }
+export class AuthenticatedUserWithProviderAccounts extends RpcMiddleware.Service()("@shivaedev/platform/rpc/AuthenticatedUserWithProviderAccounts", {
+    error: Schema.Union([Unauthorized, AuthUnavailable, Forbidden]),
+}) {
+}
 //# sourceMappingURL=middleware.js.map

package/dist/rpc/middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/rpc/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAE/E,MAAM,OAAO,cAAe,SAAQ,aAAa,CAAC,OAAO,EAKtD,CAAC,wCAAwC,CAAC;CAAG;AAChD,MAAM,OAAO,aAAc,SAAQ,aAAa,CAAC,OAAO,EAKrD,CAAC,uCAAuC,EAAE;IAC5C,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC;CAC/D,CAAC;CAAG;AACL,MAAM,OAAO,kBAAmB,SAAQ,aAAa,CAAC,OAAO,EAK1D,CAAC,4CAA4C,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;CAAG;AAC3G,MAAM,OAAO,iBAAkB,SAAQ,aAAa,CAAC,OAAO,EAKzD,CAAC,2CAA2C,EAAE;IAChD,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC;CAC/D,CAAC;CAAG"}
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/rpc/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAE/E,MAAM,OAAO,cAAe,SAAQ,aAAa,CAAC,OAAO,EAKtD,CAAC,wCAAwC,CAAC;CAAG;AAChD,MAAM,OAAO,aAAc,SAAQ,aAAa,CAAC,OAAO,EAKrD,CAAC,uCAAuC,EAAE;IAC5C,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC;CAC/D,CAAC;CAAG;AACL,MAAM,OAAO,kBAAmB,SAAQ,aAAa,CAAC,OAAO,EAK1D,CAAC,4CAA4C,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;CAAG;AAC3G,MAAM,OAAO,iBAAkB,SAAQ,aAAa,CAAC,OAAO,EAKzD,CAAC,2CAA2C,EAAE;IAChD,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC;CAC/D,CAAC;CAAG;AACL,MAAM,OAAO,qCAAsC,SAAQ,aAAa,CAAC,OAAO,EAG7E,CAAC,+DAA+D,EAAE;IACpE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC;CAC/D,CAAC;CAAG"}

package/dist/rpc/publicConfig.d.ts

@@ -0,0 +1,3 @@
+import type { Schema } from "effect";
+export declare function publicConfig<T, E>(schema: Schema.Codec<T, E>): import("@shivaedev/effect-contract/contract.ts").Contract<"platform.publicConfig", readonly [NoInfer<import("@shivaedev/effect-contract/operation.ts").Query<"get", Schema.Void, Schema.Codec<T, E, never, never>, {}>>], readonly [], import("effect/rpc/Rpc").Rpc<"platform.publicConfig.get", Schema.Void, Schema.Codec<T, E, never, never>, Schema.Never, never, never>, readonly []>;
+//# sourceMappingURL=publicConfig.d.ts.map

package/dist/rpc/publicConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publicConfig.d.ts","sourceRoot":"","sources":["../../src/rpc/publicConfig.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAIrC,wBAAgB,YAAY,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,6XAI5D"}

package/dist/rpc/publicConfig.js

@@ -0,0 +1,8 @@
+import { contract } from "@shivaedev/effect-contract/contract.ts";
+import { query } from "@shivaedev/effect-contract/operation.ts";
+export function publicConfig(schema) {
+    return contract("platform.publicConfig", {
+        queries: [query("get", { reads: () => [], success: schema })],
+    });
+}
+//# sourceMappingURL=publicConfig.js.map

package/dist/rpc/publicConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publicConfig.js","sourceRoot":"","sources":["../../src/rpc/publicConfig.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,wCAAwC,CAAC;AAClE,OAAO,EAAE,KAAK,EAAE,MAAM,yCAAyC,CAAC;AAEhE,MAAM,UAAU,YAAY,CAAO,MAA0B;IAC5D,OAAO,QAAQ,CAAC,uBAAuB,EAAE;QACxC,OAAO,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;KAC7D,CAAC,CAAC;AACJ,CAAC"}

package/dist/server/better-auth/mount.d.ts

@@ -0,0 +1,61 @@
+import { type BetterAuthOptions } from "better-auth";
+import { Config, Effect, Redacted } from "effect";
+import { HttpRouter } from "effect/http";
+import { Pool } from "pg";
+export declare const betterAuthMount: <const TOptions extends BetterAuthOptions>(options: TOptions) => Effect.Effect<{
+    auth: import("better-auth").Auth<TOptions & {
+        advanced: {
+            disableCSRFCheck?: boolean | undefined;
+            disableOriginCheck?: boolean | undefined;
+            crossSubDomainCookies?: {
+                enabled: boolean;
+                additionalCookies?: string[];
+                domain?: string;
+            } | undefined;
+            cookies?: {
+                [key: string]: {
+                    name?: string;
+                    attributes?: import("better-auth").CookieOptions;
+                };
+            } | undefined;
+            defaultCookieAttributes?: import("better-auth").CookieOptions | undefined;
+            cookiePrefix?: string | undefined;
+            database?: {
+                defaultFindManyLimit?: number;
+                generateId?: import("better-auth").GenerateIdFn | false | "serial" | "uuid";
+                joins?: boolean;
+                validateSchema?: boolean;
+            } | undefined;
+            trustedProxyHeaders?: boolean | undefined;
+            backgroundTasks?: {
+                handler: (promise: Promise<unknown>) => void;
+            };
+            skipTrailingSlashes?: boolean;
+            useSecureCookies: boolean | undefined;
+            ipAddress: {
+                disableIpTracking?: boolean;
+                ipv6Subnet?: number;
+                ipAddressHeaders: string[];
+                trustedProxies: string[];
+            };
+        };
+        baseURL: import("better-auth").BaseURLConfig;
+        rateLimit: {
+            window?: number | undefined;
+            max?: number | undefined;
+            modelName?: "rateLimit" | import("better-auth").LiteralString;
+            fields?: Partial<Record<"count" | "key" | "lastRequest", string>>;
+            customRules?: {
+                [key: string]: import("better-auth").BetterAuthRateLimitRule | false | ((request: Request, currentRule: import("better-auth").BetterAuthRateLimitRule) => import("better-auth").Awaitable<false | import("better-auth").BetterAuthRateLimitRule>);
+            } | undefined;
+            storage?: ("memory" | "database" | "secondary-storage") | undefined;
+            customStorage?: import("better-auth").BetterAuthRateLimitStorage;
+            enabled: boolean;
+        };
+        secret: string;
+        trustedOrigins: string[] | ((request?: Request | undefined) => import("better-auth").Awaitable<(string | undefined | null)[]>);
+    }>;
+    routes: import("effect/Layer").Layer<never, never, HttpRouter.HttpRouter>;
+}, Config.ConfigError, never>;
+export declare const authDatabase: (url: Redacted.Redacted<string>) => Effect.Effect<Pool, never, import("effect/Scope").Scope>;
+//# sourceMappingURL=mount.d.ts.map

package/dist/server/better-auth/mount.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mount.d.ts","sourceRoot":"","sources":["../../../src/server/better-auth/mount.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,iBAAiB,EAAc,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAU,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAyC,MAAM,aAAa,CAAC;AAChF,OAAO,EAAE,IAAI,EAAmB,MAAM,IAAI,CAAC;AAG3C,eAAO,MAAM,eAAe,SAA0D,QAAQ,SAAS,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6BAsCtH,CAAC;AAEH,eAAO,MAAM,YAAY,8FAqBvB,CAAC"}

package/dist/server/better-auth/mount.js

@@ -0,0 +1,59 @@
+import { betterAuth } from "better-auth";
+import { Config, Effect, Option, Redacted } from "effect";
+import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/http";
+import { Pool } from "pg";
+import { trustedProxyPeer, trustedProxyRanges } from "#server/rpc-server/local.ts";
+export const betterAuthMount = Effect.fn("Platform.betterAuthMount")(function* (options) {
+    const secret = options.secret ?? Redacted.value(yield* Config.Redacted("BETTER_AUTH_SECRET"));
+    const publicUrl = yield* Config.URL("PUBLIC_URL").pipe(Config.option);
+    const origin = Option.map(publicUrl, (url) => url.origin);
+    const trustedProxy = Option.getOrUndefined(yield* Config.String("TRUSTED_PROXY").pipe(Config.option));
+    const clientIpHeader = yield* Config.String("AUTH_CLIENT_IP_HEADER").pipe(Config.withDefault("x-forwarded-for"));
+    const rateLimitEnabled = yield* Config.Boolean("AUTH_RATE_LIMIT_ENABLED").pipe(Config.withDefault(true));
+    const isTrustedProxy = trustedProxyPeer(trustedProxy);
+    const trustedProxies = trustedProxyRanges(trustedProxy);
+    const auth = betterAuth({
+        ...options,
+        advanced: {
+            useSecureCookies: Option.isSome(publicUrl) && publicUrl.value.protocol === "https:",
+            ...options.advanced,
+            ipAddress: {
+                ...options.advanced?.ipAddress,
+                ipAddressHeaders: trustedProxies.length === 0 ? [] : [clientIpHeader],
+                trustedProxies,
+            },
+        },
+        "baseURL": options.baseURL ?? Option.getOrElse(origin, () => ({ allowedHosts: ["127.0.0.1:*"], protocol: "http" })),
+        rateLimit: { ...options.rateLimit, enabled: rateLimitEnabled },
+        secret,
+        trustedOrigins: options.trustedOrigins ?? [Option.getOrElse(origin, () => "http://127.0.0.1:*")],
+    });
+    const routes = HttpRouter.use((router) => router.add("*", "/api/auth/*", (request) => Effect.gen(function* () {
+        const web = yield* HttpServerRequest.toWeb(request);
+        if (!Option.exists(request.remoteAddress, isTrustedProxy)) {
+            web.headers.delete("x-forwarded-for");
+            web.headers.delete(clientIpHeader);
+        }
+        return HttpServerResponse.fromWeb(yield* Effect.tryPromise(() => auth.handler(web)));
+    }).pipe(Effect.catch(() => Effect.succeed(HttpServerResponse.text("Authentication is temporarily unavailable", { status: 503 }))))));
+    return { auth, routes };
+});
+export const authDatabase = Effect.fn("Platform.authDatabase")(function* (url) {
+    const clients = new Set();
+    const run = Effect.runForkWith(yield* Effect.context());
+    return yield* Effect.acquireRelease(Effect.sync(() => {
+        const pool = new Pool({ connectionString: Redacted.value(url) });
+        pool.on("connect", (client) => clients.add(client));
+        pool.on("remove", (client) => clients.delete(client));
+        pool.on("error", (error) => {
+            run(Effect.logDebug({ event: "auth_database_idle_client_failed", message: error.message }));
+        });
+        return pool;
+    }), (pool) => Effect.promise(async () => {
+        // pg-pool resolves end before its clients finish disconnecting.
+        const disconnected = [...clients].map((client) => new Promise((resolve) => client.once("end", resolve)));
+        await pool.end();
+        await Promise.all(disconnected);
+    }));
+});
+//# sourceMappingURL=mount.js.map

package/dist/server/better-auth/mount.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mount.js","sourceRoot":"","sources":["../../../src/server/better-auth/mount.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0B,UAAU,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,EAAE,IAAI,EAAmB,MAAM,IAAI,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEnF,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAAC,QAAQ,CAAC,EAA4C,OAAiB;IAC1I,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC9F,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACtG,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACjH,MAAM,gBAAgB,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IACzG,MAAM,cAAc,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;IACtD,MAAM,cAAc,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,UAAU,CAAC;QACvB,GAAG,OAAO;QACV,QAAQ,EAAE;YACT,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,QAAQ,KAAK,QAAQ;YACnF,GAAG,OAAO,CAAC,QAAQ;YACnB,SAAS,EAAE;gBACV,GAAG,OAAO,CAAC,QAAQ,EAAE,SAAS;gBAC9B,gBAAgB,EAAE,cAAc,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;gBACrE,cAAc;aACd;SACD;QACD,SAAS,EAAE,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,MAAe,EAAE,CAAC,CAAC;QAC5H,SAAS,EAAE,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,gBAAgB,EAAE;QAC9D,MAAM;QACN,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,oBAAoB,CAAC,CAAC;KAChG,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACxC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,EAAE,CAAC,OAAO,EAAE,EAAE,CAC1C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,cAAc,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;YACtC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,2CAA2C,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAClI,CACD,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACzB,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC,QAAQ,CAAC,EAAE,GAA8B;IACvG,MAAM,OAAO,GAAG,IAAI,GAAG,EAAc,CAAC;IACtC,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,EAAS,CAAC,CAAC;IAC/D,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CAClC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;QAChB,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,EAAE,gBAAgB,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACpD,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC7F,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACb,CAAC,CAAC,EACF,CAAC,IAAI,EAAE,EAAE,CACR,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;QACzB,gEAAgE;QAChE,MAAM,YAAY,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAC/G,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;QACjB,MAAM,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACjC,CAAC,CAAC,CACH,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/server/better-auth/testing.d.ts

@@ -0,0 +1,50 @@
+import { testUtils } from "better-auth/plugins";
+export declare function authTestUtils(options?: Parameters<typeof testUtils>[0]): {
+    id: "test-utils";
+    version: string;
+    options: import("better-auth/plugins").TestUtilsOptions;
+    init(context: Parameters<(ctx: import("better-auth").AuthContext) => {
+        context: {
+            test: import("better-auth/plugins").TestHelpers;
+        };
+        options: {
+            databaseHooks: {
+                verification: {
+                    create: {
+                        after(verification: {
+                            identifier: string;
+                            value: string;
+                        } | null): Promise<void>;
+                    };
+                };
+            };
+        } | undefined;
+    }>[0]): {
+        context: {
+            test: import("better-auth/plugins").TestHelpers;
+        };
+        options?: never;
+    } | {
+        context: {
+            test: import("better-auth/plugins").TestHelpers;
+        };
+        options: {
+            databaseHooks: {
+                verification: {
+                    create: {
+                        after(verification: {
+                            identifier: string;
+                            value: string;
+                        } | null): Promise<void>;
+                    };
+                };
+            };
+        };
+    };
+};
+type TestContext = ReturnType<ReturnType<typeof authTestUtils>["init"]>["context"];
+export declare function signedInUser(auth: {
+    readonly $context: Promise<TestContext>;
+}, fields: Parameters<TestContext["test"]["createUser"]>[0]): Promise<import("better-auth/plugins").LoginResult>;
+export {};
+//# sourceMappingURL=testing.d.ts.map

package/dist/server/better-auth/testing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../../../src/server/better-auth/testing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD,wBAAgB,aAAa,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC;;;;kBAIvD,UAAU;;;;;;;;;;;;;;;;MAAoB,CAAC,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;EAMhD;AAED,KAAK,WAAW,GAAG,UAAU,CAAC,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAEnF,wBAAsB,YAAY,CAAC,IAAI,EAAE;IAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAA;CAAE,EAAE,MAAM,EAAE,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,sDAI7I"}

package/dist/server/better-auth/testing.js

@@ -0,0 +1,18 @@
+import { testUtils } from "better-auth/plugins";
+export function authTestUtils(options) {
+    const plugin = testUtils(options);
+    return {
+        ...plugin,
+        init(context) {
+            const result = plugin.init(context);
+            // Remove this wrapper once Better Auth's testUtils omits undefined options.
+            return result.options === undefined ? { context: result.context } : { context: result.context, options: result.options };
+        },
+    };
+}
+export async function signedInUser(auth, fields) {
+    const { test } = await auth.$context;
+    const user = await test.saveUser(test.createUser(fields));
+    return test.login({ userId: user.id });
+}
+//# sourceMappingURL=testing.js.map

package/dist/server/better-auth/testing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"testing.js","sourceRoot":"","sources":["../../../src/server/better-auth/testing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD,MAAM,UAAU,aAAa,CAAC,OAAyC;IACtE,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO;QACN,GAAG,MAAM;QACT,IAAI,CAAC,OAA0C;YAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpC,4EAA4E;YAC5E,OAAO,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QAC1H,CAAC;KACD,CAAC;AACH,CAAC;AAID,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAiD,EAAE,MAAwD;IAC7I,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;IACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1D,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;AACxC,CAAC"}

package/dist/server/databaseLayer.d.ts

@@ -1,9 +1,10 @@
 import * as PgClient from "@effect/sql-pg/PgClient";
 import { Config, Layer, type Redacted } from "effect";
 import * as Reactivity from "effect/reactivity/Reactivity";
+import type { SqlNameTransforms } from "@shivaedev/effect-sql/clientOptions.ts";
 import { type PostgresChangesOptions } from "@shivaedev/effect-sql/postgresChanges.ts";
 import type { AppChanges, AppDatabaseOptions } from "#server/appHost.ts";
-export interface DatabaseConfig {
+export interface DatabaseConfig extends SqlNameTransforms {
     readonly applicationName?: string;
     readonly changes?: Omit<PostgresChangesOptions, "client" | "resync">;
     readonly databaseUrl?: Redacted.Redacted<string>;

package/dist/server/databaseLayer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"databaseLayer.d.ts","sourceRoot":"","sources":["../../src/server/databaseLayer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAU,KAAK,EAAE,KAAK,QAAQ,EAAY,MAAM,QAAQ,CAAC;AACxE,OAAO,KAAK,UAAU,MAAM,8BAA8B,CAAC;AAI3D,OAAO,EAAE,KAAK,sBAAsB,EAAmB,MAAM,0CAA0C,CAAC;AACxG,OAAO,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAGzE,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,sBAAsB,EAAE,QAAQ,GAAG,QAAQ,CAAC,CAAC;IACrE,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,wBAAgB,aAAa,CAAC,CAAC,EAAE,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,UAAU,+UA0BjG"}
+{"version":3,"file":"databaseLayer.d.ts","sourceRoot":"","sources":["../../src/server/databaseLayer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAU,KAAK,EAAE,KAAK,QAAQ,EAAY,MAAM,QAAQ,CAAC;AACxE,OAAO,KAAK,UAAU,MAAM,8BAA8B,CAAC;AAG3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAEhF,OAAO,EAAE,KAAK,sBAAsB,EAAmB,MAAM,0CAA0C,CAAC;AACxG,OAAO,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAGzE,MAAM,WAAW,cAAe,SAAQ,iBAAiB;IACxD,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,sBAAsB,EAAE,QAAQ,GAAG,QAAQ,CAAC,CAAC;IACrE,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,wBAAgB,aAAa,CAAC,CAAC,EAAE,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,UAAU,+UA4BjG"}

package/dist/server/databaseLayer.js

@@ -10,6 +10,8 @@ export function databaseLayer(options, changesService) {
     const pool = Layer.unwrap(Effect.gen(function* () {
         const url = options.config?.databaseUrl ?? (yield* Config.Redacted("DATABASE_URL"));
         return PgClient.layer({
+            transformQueryNames: options.config?.transformQueryNames,
+            transformResultNames: options.config?.transformResultNames,
             url,
             ...databaseAddress(url),
             ...(options.config?.maxConnections === undefined ? {} : { maxConnections: options.config.maxConnections }),