@shivaedev/platform 0.22.1 → 0.23.1

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.23.1 - 2026-10-19
+
+### Fixed
+
+- Wait for application database query and listener sockets to disconnect before host and worker scopes finish closing.
+
+## 0.23.0 - 2026-10-19
+
+### Added
+
+- `betterAuthMount(options, { signIn })` takes a sign-in policy: provider accounts allowed through `allowedAccounts`, which reads `AUTH_ALLOWED_ACCOUNTS` (such as `github:1001,github:1002`) through Effect Config and the `AllowedAccounts` Schema, and an optional application rule Effect such as an organization membership check. Better Auth's `validateUserInfo` and `session.create.before` hooks refuse a sign-in the policy does not admit with `sign_in_refused`, before a user or session exists.
+- The mount returns `admittedSessions(getSession)`, which rechecks the policy for each resolved session: a user it no longer admits is refused with `Unauthorized` on the next request and loses every stored session. Rule answers are reused for `recheckInterval`, five minutes by default.
+- The mount returns `revokeUnadmitted`, an Effect that revokes the sessions of every user the current policy no longer admits and reports `{ users, sessions }`.
+
 ## 0.22.1 - 2026-10-19
 
 ### Changed

package/README.md

@@ -589,6 +589,44 @@ The mount reads `BETTER_AUTH_SECRET` unless options supply `secret`. `PUBLIC_URL
 
 `AUTH_RATE_LIMIT_ENABLED` is a Config boolean that defaults to true and takes precedence over `options.rateLimit.enabled`; other Better Auth rate-limit options pass through. `TRUSTED_PROXY` supplies the same address and CIDR policy used by the host. An untrusted transport peer loses `x-forwarded-for` and the configured client-IP header before Better Auth sees the request. `AUTH_CLIENT_IP_HEADER` defaults to `x-forwarded-for`. With no trusted proxy, Better Auth ignores forwarded IPs and shares a rate-limit bucket per path.
 
+### Decide who may sign in
+
+Give the mount a sign-in policy as its second argument, and resolve RPC sessions through `admittedSessions` so a removal ends access on the next request:
+
+```ts
+import { Config, Effect } from "effect";
+import { allowedAccounts } from "@shivaedev/platform/server/better-auth/allowedAccounts.ts";
+import { authDatabase, betterAuthMount } from "@shivaedev/platform/server/better-auth/mount.ts";
+import { betterAuthSessions } from "@shivaedev/platform/server/rpc-server/adapters/betterAuthSessions.ts";
+import { trustedOrigins } from "@shivaedev/platform/server/rpc-server/origin.ts";
+
+const authentication = Effect.gen(function* () {
+  const database = yield* authDatabase(yield* Config.Redacted("DATABASE_URL"));
+  const mounted = yield* betterAuthMount(
+    { database, session: { cookieCache: { enabled: false } }, socialProviders: { github } },
+    { signIn: { accounts: allowedAccounts, recheckInterval: "5 minutes", rule: inOrganization } },
+  );
+  yield* mounted.revokeUnadmitted;
+  const sessions = {
+    origin: trustedOrigins({ allow: ["https://app.example"], missing: "reject" }),
+    provider: betterAuthSessions(mounted.admittedSessions((headers) => mounted.auth.api.getSession({ headers }))),
+  };
+  return { ...mounted, sessions };
+});
+```
+
+`github` is the application's GitHub client settings. `inOrganization` is the application's rule, `(account: ProviderAccountValue) => Effect<boolean, E, R>`, which asks the provider whether that account belongs to its organization; the mount requires the rule's `R`, and its failures stay typed. Both parts are optional, and a user is admitted when one of their provider accounts is on the list and the rule admits that account.
+
+`allowedAccounts` reads `AUTH_ALLOWED_ACCOUNTS` through Effect Config and decodes it with the `AllowedAccounts` Schema: comma-separated `providerId:accountId` entries, such as `github:1001,github:1002` for two GitHub user IDs. A malformed or empty list stops the mount with a `ConfigError`. For another variable name, pass `Config.schema(AllowedAccounts, "NAME")` as `accounts`.
+
+At sign-in the mount installs the policy into Better Auth's own hooks. `user.validateUserInfo` checks the provider account from the provider's verified profile before Better Auth creates a user, so a refused sign-up leaves no user behind. Sign-ups without a provider account, such as email and password, are refused while a policy is set. `databaseHooks.session.create.before` checks the stored accounts of a returning user before Better Auth creates the session. A refused OAuth sign-in redirects to the error URL with `error=sign_in_refused`, and a refused API call answers HTTP 403 with code `sign_in_refused`. When the rule fails, the sign-in is refused with `sign_in_unavailable` and no user is created. The application's own `databaseHooks.session.create.before` runs before the policy's, and a session it refuses stays refused.
+
+A removal takes effect on the user's next request through `admittedSessions`: the list is read from Config at every check, the user is refused with `Unauthorized`, and Better Auth's internal adapter deletes every stored session of that user. With environment variables, the list changes when the application restarts with the new value; a Config provider whose values change at runtime applies a removal without a restart. The rule's answer for each provider account is reused for `recheckInterval`, five minutes by default, so a rule that turns false refuses the user on their first request after that interval. A failing rule, or a list that no longer decodes, answers `AuthUnavailable` and keeps the session.
+
+`revokeUnadmitted` checks every stored user against the current policy, deletes the sessions of each user it no longer admits and succeeds with `{ users, sessions }`, the number of users and sessions it revoked. Run it at startup, as above, or from an administrative command. It fails with the rule's error or with a `ConfigError`.
+
+Without `signIn`, the mount installs no hooks, `admittedSessions` returns the lookup unchanged and `revokeUnadmitted` revokes nothing.
+
 ### Signed-in story preconditions
 
 Use `authTestUtils()` from `@shivaedev/platform/server/better-auth/testing.ts` in a test-only Better Auth instance with the host's database, secret and cookie policy. The wrapper preserves the plugin's typed `$context.test` under `exactOptionalPropertyTypes`. Keep the plugin out of production auth options.
@@ -705,7 +743,10 @@ Import the module that defines the name; there is no package-root entry. Paths b
 | `server/redactingDiagnostics.ts`, `server/redactingTracer.ts`, `server/redactingRpcSerialization.ts` | `redactingDiagnostics(sensitive)`, `redactRecord(values, sensitive)`, `redactingTracer(sensitive)`, `redactingRpcSerialization(wire, sensitive)`: compose native diagnostic and NDJSON boundaries. |
 | `server/runtime/makePlatform.ts` | `makePlatformRuntime(layer, { developmentCacheKey? })`. |
 | `server/node-http/subscriptionSignal.ts` | `nodeSubscriptionSignal({ nodeRequest?, request?, signals? })`, returning `{ signal, dispose }`. |
-| `server/better-auth/mount.ts` | `betterAuthMount(options)`, `authDatabase(url)`: native auth routes and a scoped PostgreSQL pool. |
+| `server/better-auth/mount.ts` | `betterAuthMount(options, { signIn? })`, returning `{ auth, routes, admittedSessions, revokeUnadmitted }`, and `authDatabase(url)`: native auth routes, the sign-in policy and a scoped PostgreSQL pool. |
+| `server/better-auth/allowedAccounts.ts` | `AllowedAccounts`, `allowedAccounts`: the provider-account list Schema and its `AUTH_ALLOWED_ACCOUNTS` Config. |
+| `server/better-auth/signInGate.ts` | `SignInPolicy`: the `accounts`, `rule` and `recheckInterval` of a sign-in policy. |
+| `server/better-auth/revokeUnadmitted.ts` | `RevokedSessions`: the `{ users, sessions }` counts of a revocation. |
 | `server/better-auth/testing.ts` | `authTestUtils(options?)`, `signedInUser(auth, fields)`: test-only typed Better Auth helpers and minted user sessions. |
 | `server/better-auth/adapter.ts` | `effectPrismaAdapter(Database, runtime, options?)`: a Better Auth adapter over Effect Prisma; `modelName` maps model names. |
 | `server/testing/makePlatformIt.ts` | `makePlatformIt(Database)({ adapter, createCaller, layer, extend? })`. |

package/dist/server/better-auth/allowedAccounts.d.ts

@@ -0,0 +1,10 @@
+import { Config, Schema } from "effect";
+export declare const AllowedAccounts: Schema.decodeTo<Schema.$Array<Schema.decodeTo<Schema.Struct<{
+    readonly accountId: Schema.NonEmptyString;
+    readonly providerId: Schema.NonEmptyString;
+}>, Schema.String, never, never>>, Schema.String, never, never>;
+export declare const allowedAccounts: Config.Config<readonly {
+    readonly accountId: string;
+    readonly providerId: string;
+}[]>;
+//# sourceMappingURL=allowedAccounts.d.ts.map

package/dist/server/better-auth/allowedAccounts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowedAccounts.d.ts","sourceRoot":"","sources":["../../../src/server/better-auth/allowedAccounts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAgB,MAAM,QAAQ,CAAC;AAgBtD,eAAO,MAAM,eAAe;;;+DAU3B,CAAC;AAEF,eAAO,MAAM,eAAe;;;IAA0D,CAAC"}

package/dist/server/better-auth/allowedAccounts.js

@@ -0,0 +1,20 @@
+import { Config, Schema, SchemaGetter } from "effect";
+const ProviderAccount = Schema.Struct({ accountId: Schema.NonEmptyString, providerId: Schema.NonEmptyString });
+const AccountEntry = Schema.String.pipe(Schema.decodeTo(ProviderAccount, {
+    decode: SchemaGetter.transform((entry) => {
+        const separator = entry.indexOf(":");
+        return separator < 0
+            ? { accountId: "", providerId: entry }
+            : { accountId: entry.slice(separator + 1).trim(), providerId: entry.slice(0, separator).trim() };
+    }),
+    encode: SchemaGetter.transform(({ accountId, providerId }) => `${providerId}:${accountId}`),
+}));
+export const AllowedAccounts = Schema.String.pipe(Schema.decodeTo(Schema.Array(AccountEntry).check(Schema.isMinLength(1)), {
+    decode: SchemaGetter.transform((value) => value
+        .split(",")
+        .map((entry) => entry.trim())
+        .filter((entry) => entry.length > 0)),
+    encode: SchemaGetter.transform((entries) => entries.join(",")),
+}));
+export const allowedAccounts = Config.schema(AllowedAccounts, "AUTH_ALLOWED_ACCOUNTS");
+//# sourceMappingURL=allowedAccounts.js.map

package/dist/server/better-auth/allowedAccounts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowedAccounts.js","sourceRoot":"","sources":["../../../src/server/better-auth/allowedAccounts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAEtD,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,cAAc,EAAE,UAAU,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;AAE/G,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CACtC,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE;IAChC,MAAM,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE;QACxC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,OAAO,SAAS,GAAG,CAAC;YACnB,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE;YACtC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACnG,CAAC,CAAC;IACF,MAAM,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,GAAG,UAAU,IAAI,SAAS,EAAE,CAAC;CAC3F,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAChD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE;IACxE,MAAM,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CACxC,KAAK;SACH,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CACrC;IACD,MAAM,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;CAC9D,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,uBAAuB,CAAC,CAAC"}

package/dist/server/better-auth/mount.d.ts

@@ -2,7 +2,15 @@ import { type BetterAuthOptions } from "better-auth";
 import { Config, Effect, Redacted } from "effect";
 import { HttpRouter } from "effect/http";
 import { Pool } from "pg";
-export declare const betterAuthMount: <const TOptions extends BetterAuthOptions>(options: TOptions) => Effect.Effect<{
+import { type RevokeUnadmitted } from "#server/better-auth/revokeUnadmitted.ts";
+import { type SignInPolicy } from "#server/better-auth/signInGate.ts";
+import type { GetSession } from "#server/rpc-server/adapters/betterAuthSessions.ts";
+import type { SessionShape } from "#server/rpc-server/session.ts";
+export interface BetterAuthMountOptions<E = never, R = never> {
+    readonly signIn?: SignInPolicy<E, R> | undefined;
+}
+export declare const betterAuthMount: <const TOptions extends BetterAuthOptions, E = never, R = never>(options: TOptions, mount?: BetterAuthMountOptions<E, R> | undefined) => Effect.Effect<{
+    admittedSessions: <TSession extends SessionShape>(getSession: GetSession<TSession>) => GetSession<TSession>;
     auth: import("better-auth").Auth<TOptions & {
         advanced: {
             disableCSRFCheck?: boolean | undefined;
@@ -40,6 +48,160 @@ export declare const betterAuthMount: <const TOptions extends BetterAuthOptions>
             };
         };
         baseURL: import("better-auth").BaseURLConfig;
+        databaseHooks: {
+            user?: {
+                create?: {
+                    before?: (user: import("better-auth").User & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                        data: {
+                            id?: string | undefined;
+                            createdAt?: Date | undefined;
+                            updatedAt?: Date | undefined;
+                            email?: string | undefined;
+                            emailVerified?: boolean | undefined;
+                            name?: string | undefined;
+                            image?: string | null | undefined;
+                        } & Record<string, any>;
+                    }>;
+                    after?: (user: import("better-auth").User & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+                };
+                update?: {
+                    before?: (user: Partial<import("better-auth").User> & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                        data: {
+                            [x: string]: any;
+                            id?: string | undefined;
+                            createdAt?: Date | undefined;
+                            updatedAt?: Date | undefined;
+                            email?: string | undefined;
+                            emailVerified?: boolean | undefined;
+                            name?: string | undefined;
+                            image?: string | null | undefined;
+                        };
+                    }>;
+                    after?: (user: import("better-auth").User & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+                };
+                delete?: {
+                    before?: (user: import("better-auth").User & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void>;
+                    after?: (user: import("better-auth").User & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+                };
+            };
+            session?: {
+                create?: {
+                    before?: (session: import("better-auth").Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                        data: {
+                            id?: string | undefined;
+                            createdAt?: Date | undefined;
+                            updatedAt?: Date | undefined;
+                            userId?: string | undefined;
+                            expiresAt?: Date | undefined;
+                            token?: string | undefined;
+                            ipAddress?: string | null | undefined;
+                            userAgent?: string | null | undefined;
+                        } & Record<string, any>;
+                    }>;
+                    after?: (session: import("better-auth").Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+                };
+                update?: {
+                    before?: (session: Partial<import("better-auth").Session> & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                        data: {
+                            [x: string]: any;
+                            id?: string | undefined;
+                            createdAt?: Date | undefined;
+                            updatedAt?: Date | undefined;
+                            userId?: string | undefined;
+                            expiresAt?: Date | undefined;
+                            token?: string | undefined;
+                            ipAddress?: string | null | undefined;
+                            userAgent?: string | null | undefined;
+                        };
+                    }>;
+                    after?: (session: import("better-auth").Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+                };
+                delete?: {
+                    before?: (session: import("better-auth").Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void>;
+                    after?: (session: import("better-auth").Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+                };
+            };
+            account?: {
+                create?: {
+                    before?: (account: import("better-auth").Account, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                        data: {
+                            id?: string | undefined;
+                            createdAt?: Date | undefined;
+                            updatedAt?: Date | undefined;
+                            providerId?: string | undefined;
+                            accountId?: string | undefined;
+                            userId?: string | undefined;
+                            accessToken?: string | null | undefined;
+                            refreshToken?: string | null | undefined;
+                            idToken?: string | null | undefined;
+                            accessTokenExpiresAt?: Date | null | undefined;
+                            refreshTokenExpiresAt?: Date | null | undefined;
+                            scope?: string | null | undefined;
+                            password?: string | null | undefined;
+                        } & Record<string, any>;
+                    }>;
+                    after?: (account: import("better-auth").Account, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+                };
+                update?: {
+                    before?: (account: Partial<import("better-auth").Account> & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                        data: {
+                            [x: string]: any;
+                            id?: string | undefined;
+                            createdAt?: Date | undefined;
+                            updatedAt?: Date | undefined;
+                            providerId?: string | undefined;
+                            accountId?: string | undefined;
+                            userId?: string | undefined;
+                            accessToken?: string | null | undefined;
+                            refreshToken?: string | null | undefined;
+                            idToken?: string | null | undefined;
+                            accessTokenExpiresAt?: Date | null | undefined;
+                            refreshTokenExpiresAt?: Date | null | undefined;
+                            scope?: string | null | undefined;
+                            password?: string | null | undefined;
+                        };
+                    }>;
+                    after?: (account: import("better-auth").Account & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+                };
+                delete?: {
+                    before?: (account: import("better-auth").Account & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void>;
+                    after?: (account: import("better-auth").Account & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+                };
+            };
+            verification?: {
+                create?: {
+                    before?: (verification: import("better-auth").Verification & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                        data: {
+                            id?: string | undefined;
+                            createdAt?: Date | undefined;
+                            updatedAt?: Date | undefined;
+                            value?: string | undefined;
+                            expiresAt?: Date | undefined;
+                            identifier?: string | undefined;
+                        } & Record<string, any>;
+                    }>;
+                    after?: (verification: import("better-auth").Verification & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+                };
+                update?: {
+                    before?: (verification: Partial<import("better-auth").Verification> & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                        data: {
+                            [x: string]: any;
+                            id?: string | undefined;
+                            createdAt?: Date | undefined;
+                            updatedAt?: Date | undefined;
+                            value?: string | undefined;
+                            expiresAt?: Date | undefined;
+                            identifier?: string | undefined;
+                        };
+                    }>;
+                    after?: (verification: import("better-auth").Verification & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+                };
+                delete?: {
+                    before?: (verification: import("better-auth").Verification & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void>;
+                    after?: (verification: import("better-auth").Verification & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+                };
+            };
+        } | undefined;
         rateLimit: {
             window?: number | undefined;
             max?: number | undefined;
@@ -54,8 +216,36 @@ export declare const betterAuthMount: <const TOptions extends BetterAuthOptions>
         };
         secret: string;
         trustedOrigins: string[] | ((request?: Request | undefined) => import("better-auth").Awaitable<(string | undefined | null)[]>);
+        user: (import("better-auth").BetterAuthDBOptions<"user", "createdAt" | "email" | "emailVerified" | "id" | "image" | "name" | "updatedAt"> & {
+            validateUserInfo?: (data: {
+                user: Partial<import("better-auth").User> & Record<string, unknown>;
+                source: import("better-auth").ValidateUserInfoSource;
+            }, context: import("better-auth").GenericEndpointContext) => import("better-auth").Awaitable<void | import("better-auth").ValidateUserInfoResult>;
+            changeEmail?: {
+                enabled: boolean;
+                sendChangeEmailConfirmation?: (data: {
+                    user: import("better-auth").User;
+                    newEmail: string;
+                    url: string;
+                    token: string;
+                }, request?: Request) => Promise<void>;
+                updateEmailWithoutVerification?: boolean;
+            };
+            deleteUser?: {
+                enabled?: boolean;
+                sendDeleteAccountVerification?: (data: {
+                    user: import("better-auth").User;
+                    url: string;
+                    token: string;
+                }, request?: Request) => Promise<void>;
+                beforeDelete?: (user: import("better-auth").User, request?: Request) => Promise<void>;
+                afterDelete?: (user: import("better-auth").User, request?: Request) => Promise<void>;
+                deleteTokenExpiresIn?: number;
+            };
+        }) | undefined;
     }>;
+    revokeUnadmitted: RevokeUnadmitted<E>;
     routes: import("effect/Layer").Layer<never, never, HttpRouter.HttpRouter>;
-}, Config.ConfigError, never>;
+}, Config.ConfigError, R>;
 export declare const authDatabase: (url: Redacted.Redacted<string>) => Effect.Effect<Pool, never, import("effect/Scope").Scope>;
 //# sourceMappingURL=mount.d.ts.map

package/dist/server/better-auth/mount.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mount.d.ts","sourceRoot":"","sources":["../../../src/server/better-auth/mount.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,iBAAiB,EAAc,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAU,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAyC,MAAM,aAAa,CAAC;AAChF,OAAO,EAAE,IAAI,EAAmB,MAAM,IAAI,CAAC;AAG3C,eAAO,MAAM,eAAe,SAA0D,QAAQ,SAAS,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6BAsCtH,CAAC;AAEH,eAAO,MAAM,YAAY,8FAqBvB,CAAC"}
+{"version":3,"file":"mount.d.ts","sourceRoot":"","sources":["../../../src/server/better-auth/mount.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,iBAAiB,EAAc,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAU,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAyC,MAAM,aAAa,CAAC;AAChF,OAAO,EAAE,IAAI,EAAmB,MAAM,IAAI,CAAC;AAC3C,OAAO,EAAE,KAAK,gBAAgB,EAAoB,MAAM,yCAAyC,CAAC;AAClG,OAAO,EAAsB,KAAK,YAAY,EAAc,MAAM,mCAAmC,CAAC;AAEtG,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mDAAmD,CAAC;AAEpF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAElE,MAAM,WAAW,sBAAsB,CAAC,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,KAAK;IAC3D,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC;CACjD;AAED,eAAO,MAAM,eAAe,SAA0D,QAAQ,SAAS,iBAAiB,EAAE,CAAC,UAAU,CAAC;uBAkD3G,QAAQ,SAAS,YAAY,cAAc,UAAU,CAAC,QAAQ,CAAC,KAAG,UAAU,CAAC,QAAQ,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBA0B/G,CAAC;AAEH,eAAO,MAAM,YAAY,8FAqBvB,CAAC"}

package/dist/server/better-auth/mount.js

@@ -2,8 +2,11 @@ import { betterAuth } from "better-auth";
 import { Config, Effect, Option, Redacted } from "effect";
 import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/http";
 import { Pool } from "pg";
+import { revokeUnadmitted } from "#server/better-auth/revokeUnadmitted.ts";
+import { signInGate } from "#server/better-auth/signInGate.ts";
+import { signInPolicyOptions } from "#server/better-auth/signInPolicy.ts";
 import { trustedProxyPeer, trustedProxyRanges } from "#server/rpc-server/local.ts";
-export const betterAuthMount = Effect.fn("Platform.betterAuthMount")(function* (options) {
+export const betterAuthMount = Effect.fn("Platform.betterAuthMount")(function* (options, mount = {}) {
     const secret = options.secret ?? Redacted.value(yield* Config.Redacted("BETTER_AUTH_SECRET"));
     const publicUrl = yield* Config.URL("PUBLIC_URL").pipe(Config.option);
     const origin = Option.map(publicUrl, (url) => url.origin);
@@ -12,6 +15,14 @@ export const betterAuthMount = Effect.fn("Platform.betterAuthMount")(function* (
     const rateLimitEnabled = yield* Config.Boolean("AUTH_RATE_LIMIT_ENABLED").pipe(Config.withDefault(true));
     const isTrustedProxy = trustedProxyPeer(trustedProxy);
     const trustedProxies = trustedProxyRanges(trustedProxy);
+    const context = yield* Effect.context();
+    const run = Effect.runPromiseWith(context);
+    const policy = mount.signIn ?? {};
+    if (policy.accounts !== undefined) {
+        yield* policy.accounts;
+    }
+    const gate = yield* signInGate(policy);
+    const gated = signInPolicyOptions(options, gate, run, () => auth.$context);
     const auth = betterAuth({
         ...options,
         advanced: {
@@ -24,9 +35,11 @@ export const betterAuthMount = Effect.fn("Platform.betterAuthMount")(function* (
             },
         },
         "baseURL": options.baseURL ?? Option.getOrElse(origin, () => ({ allowedHosts: ["127.0.0.1:*"], protocol: "http" })),
+        databaseHooks: gate.active ? gated.databaseHooks : options.databaseHooks,
         rateLimit: { ...options.rateLimit, enabled: rateLimitEnabled },
         secret,
         trustedOrigins: options.trustedOrigins ?? [Option.getOrElse(origin, () => "http://127.0.0.1:*")],
+        user: gate.active ? gated.user : options.user,
     });
     const routes = HttpRouter.use((router) => router.add("*", "/api/auth/*", (request) => Effect.gen(function* () {
         const web = yield* HttpServerRequest.toWeb(request);
@@ -36,7 +49,26 @@ export const betterAuthMount = Effect.fn("Platform.betterAuthMount")(function* (
         }
         return HttpServerResponse.fromWeb(yield* Effect.tryPromise(() => auth.handler(web)));
     }).pipe(Effect.catch(() => Effect.succeed(HttpServerResponse.text("Authentication is temporarily unavailable", { status: 503 }))))));
-    return { auth, routes };
+    function admittedSessions(getSession) {
+        if (!gate.active) {
+            return getSession;
+        }
+        return (headers) => run(Effect.gen(function* () {
+            const session = yield* Effect.tryPromise(() => getSession(headers));
+            if (session === null) {
+                return null;
+            }
+            const storage = yield* Effect.tryPromise(() => auth.$context);
+            if (yield* gate.admitsUser(storage, session.user.id)) {
+                return session;
+            }
+            yield* Effect.tryPromise(() => storage.internalAdapter.deleteUserSessions(session.user.id));
+            yield* Effect.logInfo("The sign-in policy revoked a user's sessions").pipe(Effect.annotateLogs({ userId: session.user.id }));
+            return null;
+        }));
+    }
+    const revoke = Effect.provideContext(revokeUnadmitted(gate, () => auth.$context), context);
+    return { admittedSessions, auth, revokeUnadmitted: revoke, routes };
 });
 export const authDatabase = Effect.fn("Platform.authDatabase")(function* (url) {
     const clients = new Set();

package/dist/server/better-auth/mount.js.map

@@ -1 +1 @@
-{"version":3,"file":"mount.js","sourceRoot":"","sources":["../../../src/server/better-auth/mount.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0B,UAAU,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,EAAE,IAAI,EAAmB,MAAM,IAAI,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEnF,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAAC,QAAQ,CAAC,EAA4C,OAAiB;IAC1I,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC9F,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACtG,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACjH,MAAM,gBAAgB,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IACzG,MAAM,cAAc,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;IACtD,MAAM,cAAc,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,UAAU,CAAC;QACvB,GAAG,OAAO;QACV,QAAQ,EAAE;YACT,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,QAAQ,KAAK,QAAQ;YACnF,GAAG,OAAO,CAAC,QAAQ;YACnB,SAAS,EAAE;gBACV,GAAG,OAAO,CAAC,QAAQ,EAAE,SAAS;gBAC9B,gBAAgB,EAAE,cAAc,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;gBACrE,cAAc;aACd;SACD;QACD,SAAS,EAAE,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,MAAe,EAAE,CAAC,CAAC;QAC5H,SAAS,EAAE,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,gBAAgB,EAAE;QAC9D,MAAM;QACN,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,oBAAoB,CAAC,CAAC;KAChG,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACxC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,EAAE,CAAC,OAAO,EAAE,EAAE,CAC1C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,cAAc,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;YACtC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,2CAA2C,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAClI,CACD,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACzB,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC,QAAQ,CAAC,EAAE,GAA8B;IACvG,MAAM,OAAO,GAAG,IAAI,GAAG,EAAc,CAAC;IACtC,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,EAAS,CAAC,CAAC;IAC/D,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CAClC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;QAChB,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,EAAE,gBAAgB,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACpD,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC7F,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACb,CAAC,CAAC,EACF,CAAC,IAAI,EAAE,EAAE,CACR,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;QACzB,gEAAgE;QAChE,MAAM,YAAY,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAC/G,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;QACjB,MAAM,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACjC,CAAC,CAAC,CACH,CAAC;AACH,CAAC,CAAC,CAAC"}
+{"version":3,"file":"mount.js","sourceRoot":"","sources":["../../../src/server/better-auth/mount.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0B,UAAU,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,EAAE,IAAI,EAAmB,MAAM,IAAI,CAAC;AAC3C,OAAO,EAAyB,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAClG,OAAO,EAAyC,UAAU,EAAE,MAAM,mCAAmC,CAAC;AACtG,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAE1E,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAOnF,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAAC,QAAQ,CAAC,EAC7E,OAAiB,EACjB,KAAK,GAAiC,EAAE;IAExC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC9F,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACtG,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACjH,MAAM,gBAAgB,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IACzG,MAAM,cAAc,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;IACtD,MAAM,cAAc,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,EAAK,CAAC;IAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;IAClC,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;IACxB,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,GAA2B,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnG,MAAM,IAAI,GAAG,UAAU,CAAC;QACvB,GAAG,OAAO;QACV,QAAQ,EAAE;YACT,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,QAAQ,KAAK,QAAQ;YACnF,GAAG,OAAO,CAAC,QAAQ;YACnB,SAAS,EAAE;gBACV,GAAG,OAAO,CAAC,QAAQ,EAAE,SAAS;gBAC9B,gBAAgB,EAAE,cAAc,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;gBACrE,cAAc;aACd;SACD;QACD,SAAS,EAAE,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,MAAe,EAAE,CAAC,CAAC;QAC5H,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa;QACxE,SAAS,EAAE,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,gBAAgB,EAAE;QAC9D,MAAM;QACN,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,oBAAoB,CAAC,CAAC;QAChG,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI;KAC7C,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACxC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,EAAE,CAAC,OAAO,EAAE,EAAE,CAC1C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,cAAc,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;YACtC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,2CAA2C,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAClI,CACD,CAAC;IACF,SAAS,gBAAgB,CAAgC,UAAgC;QACxF,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAClB,OAAO,UAAU,CAAC;QACnB,CAAC;QACD,OAAO,CAAC,OAAO,EAAE,EAAE,CAClB,GAAG,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YACnB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;YACpE,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACtB,OAAO,IAAI,CAAC;YACb,CAAC;YACD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC9D,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;gBACtD,OAAO,OAAO,CAAC;YAChB,CAAC;YACD,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5F,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAC7H,OAAO,IAAI,CAAC;QACb,CAAC,CAAC,CACF,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAwB,MAAM,CAAC,cAAc,CACxD,gBAAgB,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAC3C,OAAO,CACP,CAAC;IACF,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACrE,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC,QAAQ,CAAC,EAAE,GAA8B;IACvG,MAAM,OAAO,GAAG,IAAI,GAAG,EAAc,CAAC;IACtC,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,EAAS,CAAC,CAAC;IAC/D,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CAClC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;QAChB,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,EAAE,gBAAgB,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACpD,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC7F,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACb,CAAC,CAAC,EACF,CAAC,IAAI,EAAE,EAAE,CACR,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;QACzB,gEAAgE;QAChE,MAAM,YAAY,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAC/G,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;QACjB,MAAM,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACjC,CAAC,CAAC,CACH,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/server/better-auth/revokeUnadmitted.d.ts

@@ -0,0 +1,10 @@
+import { type Config, Effect } from "effect";
+import type { AuthUnavailable } from "#errors/taxonomy.ts";
+import { type PolicyStorage, type SignInGate } from "#server/better-auth/signInGate.ts";
+export interface RevokedSessions {
+    readonly sessions: number;
+    readonly users: number;
+}
+export type RevokeUnadmitted<E> = Effect.Effect<RevokedSessions, E | Config.ConfigError | AuthUnavailable>;
+export declare const revokeUnadmitted: <E>(gate: SignInGate<E>, storage: () => Promise<PolicyStorage>) => Effect.Effect<RevokedSessions, E | AuthUnavailable | Config.ConfigError, never>;
+//# sourceMappingURL=revokeUnadmitted.d.ts.map

package/dist/server/better-auth/revokeUnadmitted.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revokeUnadmitted.d.ts","sourceRoot":"","sources":["../../../src/server/better-auth/revokeUnadmitted.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAe,KAAK,aAAa,EAAE,KAAK,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAErG,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,gBAAgB,CAAC,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC,GAAG,MAAM,CAAC,WAAW,GAAG,eAAe,CAAC,CAAC;AAI3G,eAAO,MAAM,gBAAgB,GAAgC,CAAC,sCAE9C,OAAO,CAAC,aAAa,CAAC,oFAyBpC,CAAC"}

package/dist/server/better-auth/revokeUnadmitted.js

@@ -0,0 +1,29 @@
+import { Effect } from "effect";
+import { fromStorage } from "#server/better-auth/signInGate.ts";
+const PAGE_SIZE = 100;
+export const revokeUnadmitted = Effect.fnUntraced(function* (gate, storage) {
+    if (!gate.active) {
+        return { sessions: 0, users: 0 };
+    }
+    const auth = yield* fromStorage(storage);
+    const revoked = [];
+    for (let offset = 0;; offset += PAGE_SIZE) {
+        const users = yield* fromStorage(() => auth.internalAdapter.listUsers(PAGE_SIZE, offset, { direction: "asc", field: "id" }));
+        for (const { id } of users) {
+            if (!(yield* gate.admitsUser(auth, id))) {
+                const sessions = Number(yield* fromStorage(() => auth.adapter.count({ model: "session", where: [{ field: "userId", value: id }] })));
+                if (sessions > 0) {
+                    revoked.push({ sessions, userId: id });
+                }
+            }
+        }
+        if (users.length < PAGE_SIZE) {
+            break;
+        }
+    }
+    for (const { userId } of revoked) {
+        yield* fromStorage(() => auth.internalAdapter.deleteUserSessions(userId));
+    }
+    return { sessions: revoked.reduce((total, user) => total + user.sessions, 0), users: revoked.length };
+});
+//# sourceMappingURL=revokeUnadmitted.js.map

package/dist/server/better-auth/revokeUnadmitted.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revokeUnadmitted.js","sourceRoot":"","sources":["../../../src/server/better-auth/revokeUnadmitted.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,MAAM,EAAE,MAAM,QAAQ,CAAC;AAE7C,OAAO,EAAE,WAAW,EAAuC,MAAM,mCAAmC,CAAC;AASrG,MAAM,SAAS,GAAG,GAAG,CAAC;AAEtB,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAC1D,IAAmB,EACnB,OAAqC;IAErC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAA4B,CAAC;IAC5D,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,OAAO,GAAkE,EAAE,CAAC;IAClF,KAAK,IAAI,MAAM,GAAG,CAAC,GAAI,MAAM,IAAI,SAAS,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC7H,KAAK,MAAM,EAAE,EAAE,EAAE,IAAI,KAAK,EAAE,CAAC;YAC5B,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;gBACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBACrI,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;oBAClB,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;gBACxC,CAAC;YACF,CAAC;QACF,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;YAC9B,MAAM;QACP,CAAC;IACF,CAAC;IACD,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QAClC,KAAK,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAA4B,CAAC;AACjI,CAAC,CAAC,CAAC"}

package/dist/server/better-auth/signInGate.d.ts

@@ -0,0 +1,37 @@
+import { type Config, Duration, Effect } from "effect";
+import { AuthUnavailable } from "#errors/taxonomy.ts";
+import type { ProviderAccountValue } from "#rpc/identity.ts";
+export interface SignInPolicy<E = never, R = never> {
+    readonly accounts?: Config.Config<readonly ProviderAccountValue[]> | undefined;
+    readonly recheckInterval?: Duration.Input | undefined;
+    readonly rule?: ((account: ProviderAccountValue) => Effect.Effect<boolean, E, R>) | undefined;
+}
+export interface PolicyStorage {
+    readonly adapter: {
+        readonly count: (query: {
+            readonly model: string;
+            readonly where: Array<{
+                readonly field: string;
+                readonly value: string;
+            }>;
+        }) => Promise<number>;
+    };
+    readonly internalAdapter: {
+        readonly deleteUserSessions: (userId: string) => Promise<void>;
+        readonly findAccounts: (userId: string) => Promise<readonly ProviderAccountValue[]>;
+        readonly listUsers: (limit: number, offset: number, sortBy: {
+            readonly direction: "asc" | "desc";
+            readonly field: string;
+        }) => Promise<readonly {
+            readonly id: string;
+        }[]>;
+    };
+}
+export interface SignInGate<E> {
+    readonly active: boolean;
+    readonly admits: (candidates: readonly ProviderAccountValue[]) => Effect.Effect<boolean, E | Config.ConfigError>;
+    readonly admitsUser: (storage: PolicyStorage, userId: string) => Effect.Effect<boolean, E | Config.ConfigError | AuthUnavailable>;
+}
+export declare function fromStorage<A>(read: () => Promise<A>): Effect.Effect<A, AuthUnavailable, never>;
+export declare const signInGate: <E, R>(policy: SignInPolicy<E, R>) => Effect.Effect<SignInGate<E>, never, R>;
+//# sourceMappingURL=signInGate.d.ts.map

package/dist/server/better-auth/signInGate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signInGate.d.ts","sourceRoot":"","sources":["../../../src/server/better-auth/signInGate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAS,KAAK,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAQ,MAAM,QAAQ,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAG7D,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,KAAK;IACjD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,oBAAoB,EAAE,CAAC,GAAG,SAAS,CAAC;IAC/E,QAAQ,CAAC,eAAe,CAAC,EAAE,QAAQ,CAAC,KAAK,GAAG,SAAS,CAAC;IACtD,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,oBAAoB,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC;CAC9F;AAED,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,OAAO,EAAE;QACjB,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE;YAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;gBAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;gBAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;aAAE,CAAC,CAAA;SAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;KAClJ,CAAC;IACF,QAAQ,CAAC,eAAe,EAAE;QACzB,QAAQ,CAAC,kBAAkB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/D,QAAQ,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,oBAAoB,EAAE,CAAC,CAAC;QACpF,QAAQ,CAAC,SAAS,EAAE,CACnB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,MAAM,EAAE;YAAE,QAAQ,CAAC,SAAS,EAAE,KAAK,GAAG,MAAM,CAAC;YAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;SAAE,KAClE,OAAO,CAAC,SAAS;YAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC,CAAC;KACjD,CAAC;CACF;AAED,MAAM,WAAW,UAAU,CAAC,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,SAAS,oBAAoB,EAAE,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IACjH,QAAQ,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,GAAG,MAAM,CAAC,WAAW,GAAG,eAAe,CAAC,CAAC;CAClI;AAID,wBAAgB,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,4CASpD;AAMD,eAAO,MAAM,UAAU,GAAgC,CAAC,EAAE,CAAC,uEA2BzD,CAAC"}

package/dist/server/better-auth/signInGate.js

@@ -0,0 +1,38 @@
+import { Cache, Duration, Effect, Exit } from "effect";
+import { AuthUnavailable } from "#errors/taxonomy.ts";
+import { redact } from "#server/rpc-server/redact.ts";
+const RULE_CACHE_CAPACITY = 10_000;
+export function fromStorage(read) {
+    return Effect.tryPromise(read).pipe(Effect.catch((error) => Effect.andThen(Effect.logError("Sign-in policy storage failed", redact(error.cause)), Effect.fail(new AuthUnavailable({ message: "Authentication is temporarily unavailable" })))));
+}
+function sameAccount(left, right) {
+    return left.providerId === right.providerId && left.accountId === right.accountId;
+}
+export const signInGate = Effect.fnUntraced(function* (policy) {
+    const { accounts, rule } = policy;
+    const recheckInterval = Duration.fromInputUnsafe(policy.recheckInterval ?? "5 minutes");
+    const verdicts = rule === undefined
+        ? undefined
+        : yield* Cache.makeWith(rule, {
+            capacity: RULE_CACHE_CAPACITY,
+            timeToLive: (exit) => (Exit.isSuccess(exit) ? recheckInterval : Duration.zero),
+        });
+    const admits = Effect.fnUntraced(function* (candidates) {
+        const allowed = accounts === undefined ? undefined : yield* accounts;
+        const listed = allowed === undefined ? candidates : candidates.filter((candidate) => allowed.some((entry) => sameAccount(entry, candidate)));
+        if (verdicts === undefined) {
+            return listed.length > 0;
+        }
+        for (const { accountId, providerId } of listed) {
+            if (yield* Cache.get(verdicts, { accountId, providerId })) {
+                return true;
+            }
+        }
+        return false;
+    });
+    const admitsUser = Effect.fnUntraced(function* (storage, userId) {
+        return yield* admits(yield* fromStorage(() => storage.internalAdapter.findAccounts(userId)));
+    });
+    return { active: accounts !== undefined || rule !== undefined, admits, admitsUser };
+});
+//# sourceMappingURL=signInGate.js.map

package/dist/server/better-auth/signInGate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signInGate.js","sourceRoot":"","sources":["../../../src/server/better-auth/signInGate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAe,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,MAAM,EAAE,MAAM,8BAA8B,CAAC;AA6BtD,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEnC,MAAM,UAAU,WAAW,CAAI,IAAsB;IACpD,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,CAClC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CACtB,MAAM,CAAC,OAAO,CACb,MAAM,CAAC,QAAQ,CAAC,+BAA+B,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EACrE,MAAM,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC,CAAC,CAC1F,CACD,CACD,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAA0B,EAAE,KAA2B;IAC3E,OAAO,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,CAAC;AACnF,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAQ,MAA0B;IACtF,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IAClC,MAAM,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,eAAe,IAAI,WAAW,CAAC,CAAC;IACxF,MAAM,QAAQ,GACb,IAAI,KAAK,SAAS;QACjB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE;YAC5B,QAAQ,EAAE,mBAAmB;YAC7B,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;SAC9E,CAAC,CAAC;IACN,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,UAA2C;QACtF,MAAM,OAAO,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC;QACrE,MAAM,MAAM,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;QAC7I,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QAC1B,CAAC;QACD,KAAK,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,MAAM,EAAE,CAAC;YAChD,IAAI,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;gBAC3D,OAAO,IAAI,CAAC;YACb,CAAC;QACF,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,OAAsB,EAAE,MAAc;QACrF,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9F,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,QAAQ,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AACrF,CAAC,CAAC,CAAC"}