@shivaedev/platform 0.25.0 → 0.28.0

package/src/http-client/body.ts

@@ -0,0 +1,37 @@
+import { Effect, Schema, Stream } from "effect";
+import type { HttpClientResponse } from "effect/http";
+import { ResponseBodyTooLarge } from "./errors.ts";
+
+export const readBoundedBody = Effect.fnUntraced(function* (response: HttpClientResponse.HttpClientResponse, limit: number) {
+	const length = response.headers["content-length"];
+	if (length !== undefined && Number(length) > limit) {
+		return yield* new ResponseBodyTooLarge({ limit });
+	}
+	const chunks: Uint8Array[] = [];
+	let size = 0;
+	yield* response.stream.pipe(
+		Stream.runForEach((chunk) => {
+			size += chunk.byteLength;
+			if (size > limit) {
+				return Effect.fail(new ResponseBodyTooLarge({ limit }));
+			}
+			chunks.push(chunk);
+			return Effect.void;
+		}),
+	);
+	const bytes = new Uint8Array(size);
+	let offset = 0;
+	for (const chunk of chunks) {
+		bytes.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return bytes;
+});
+
+export function readBoundedText(response: HttpClientResponse.HttpClientResponse, limit: number) {
+	return Effect.map(readBoundedBody(response, limit), (bytes) => new TextDecoder().decode(bytes));
+}
+
+export function readBoundedJson<TSchema extends Schema.Constraint>(response: HttpClientResponse.HttpClientResponse, limit: number, schema: TSchema) {
+	return Effect.flatMap(readBoundedText(response, limit), Schema.decodeUnknownEffect(Schema.fromJsonString(schema)));
+}

package/src/http-client/errors.ts

@@ -0,0 +1,23 @@
+import { Schema } from "effect";
+
+const answer = { method: Schema.String, status: Schema.Number, url: Schema.String };
+
+export class RemoteUnauthorized extends Schema.TaggedError<RemoteUnauthorized>()("RemoteUnauthorized", answer) {}
+export class RemoteNotFound extends Schema.TaggedError<RemoteNotFound>()("RemoteNotFound", answer) {}
+export class RemoteGone extends Schema.TaggedError<RemoteGone>()("RemoteGone", answer) {}
+export class RemoteRateLimited extends Schema.TaggedError<RemoteRateLimited>()("RemoteRateLimited", {
+	...answer,
+	retryAfter: Schema.optionalKey(Schema.DateTimeUtc),
+}) {}
+export class RemoteHttpError extends Schema.TaggedError<RemoteHttpError>()("RemoteHttpError", answer) {}
+
+export type RemoteStatusError = RemoteUnauthorized | RemoteNotFound | RemoteGone | RemoteRateLimited | RemoteHttpError;
+
+export class PaginationLinkError extends Schema.TaggedError<PaginationLinkError>()("PaginationLinkError", {
+	reason: Schema.Literals(["cross-origin", "invalid"]),
+	url: Schema.String,
+}) {}
+
+export class ResponseBodyTooLarge extends Schema.TaggedError<ResponseBodyTooLarge>()("ResponseBodyTooLarge", {
+	limit: Schema.Number,
+}) {}

package/src/http-client/filterStatus.ts

@@ -0,0 +1,38 @@
+import { DateTime, Effect } from "effect";
+import { HttpClient, type HttpClientResponse } from "effect/http";
+import { RemoteGone, RemoteHttpError, RemoteNotFound, RemoteRateLimited, type RemoteStatusError, RemoteUnauthorized } from "./errors.ts";
+import { parseRetryAfter } from "./parseRetryAfter.ts";
+
+const checkStatus = Effect.fnUntraced(function* (response: HttpClientResponse.HttpClientResponse) {
+	const { status, request } = response;
+	if (status >= 200 && status < 300) {
+		return response;
+	}
+	const fields = { method: request.method, status, url: request.url.split(/[?#]/u)[0] ?? request.url };
+	let error: RemoteStatusError;
+	switch (status) {
+		case 401:
+			error = new RemoteUnauthorized(fields);
+			break;
+		case 404:
+			error = new RemoteNotFound(fields);
+			break;
+		case 410:
+			error = new RemoteGone(fields);
+			break;
+		default: {
+			const header = response.headers["retry-after"];
+			if (status === 429 || (status === 503 && header !== undefined)) {
+				const retryAfter = parseRetryAfter(header, yield* DateTime.now);
+				error = new RemoteRateLimited({ ...fields, ...(retryAfter === undefined ? {} : { retryAfter }) });
+			} else {
+				error = new RemoteHttpError(fields);
+			}
+		}
+	}
+	return yield* Effect.fail(error);
+});
+
+export function filterStatus<E, R>(client: HttpClient.HttpClient.With<E, R>): HttpClient.HttpClient.With<E | RemoteStatusError, R> {
+	return HttpClient.transformResponse(client, Effect.flatMap(checkStatus));
+}

package/src/http-client/nextLink.ts

@@ -0,0 +1,10 @@
+export function nextLink(header: string | undefined): string | undefined {
+	for (const link of header?.matchAll(/<(?<url>[^>]*)>(?<parameters>(?:[^<",]|"(?:\\.|[^"\\])*")*)/gu) ?? []) {
+		const relation = link.groups?.parameters?.match(/(?:^|;)\s*rel\s*=\s*(?:"(?<quoted>[^"]*)"|(?<unquoted>[^;\s,]+))/iu);
+		const relations = relation?.groups?.quoted ?? relation?.groups?.unquoted;
+		if (relations?.toLowerCase().split(/\s+/u).includes("next")) {
+			return link.groups?.url;
+		}
+	}
+	return undefined;
+}

package/src/http-client/paginate.ts

@@ -0,0 +1,39 @@
+import { Effect, Stream } from "effect";
+import { type HttpClient, HttpClientRequest, type HttpClientResponse } from "effect/http";
+import { PaginationLinkError } from "./errors.ts";
+import { nextLink } from "./nextLink.ts";
+
+const nextRequest = Effect.fnUntraced(function* (response: HttpClientResponse.HttpClientResponse) {
+	const link = nextLink(response.headers.link);
+	if (link === undefined) {
+		return undefined;
+	}
+	const current = response.url || response.request.url;
+	const url = current.split(/[?#]/u)[0] ?? current;
+	const next = yield* Effect.try({
+		catch: () => new PaginationLinkError({ reason: "invalid", url }),
+		try: () => new URL(link, current),
+	});
+	if (next.origin !== new URL(current).origin) {
+		return yield* new PaginationLinkError({ reason: "cross-origin", url });
+	}
+	return HttpClientRequest.setUrl(response.request, next);
+});
+
+export function paginate<E, R>(client: HttpClient.HttpClient.With<E, R>, first: HttpClientRequest.HttpClientRequest) {
+	return Stream.unfold<
+		HttpClientRequest.HttpClientRequest | HttpClientResponse.HttpClientResponse,
+		HttpClientResponse.HttpClientResponse,
+		E | PaginationLinkError,
+		R
+	>(first, (state) =>
+		Effect.gen(function* () {
+			const request = HttpClientRequest.isHttpClientRequest(state) ? state : yield* nextRequest(state);
+			if (request === undefined) {
+				return undefined;
+			}
+			const response = yield* client.execute(request);
+			return [response, response] as const;
+		}),
+	);
+}

package/src/http-client/parseRetryAfter.ts

@@ -0,0 +1,17 @@
+import { DateTime, Option } from "effect";
+
+const httpDate = /^(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun), \d{2} [A-Z][a-z]{2} \d{4} \d{2}:\d{2}:\d{2} GMT$/u;
+
+export function parseRetryAfter(header: string | undefined, now: DateTime.Utc): DateTime.Utc | undefined {
+	if (header === undefined) {
+		return undefined;
+	}
+	const value = header.trim();
+	let millis = Number.NaN;
+	if (/^\d+$/u.test(value)) {
+		millis = DateTime.toEpochMillis(now) + Number(value) * 1000;
+	} else if (httpDate.test(value)) {
+		millis = Date.parse(value);
+	}
+	return Option.getOrUndefined(DateTime.make(millis));
+}

package/src/server/MigrationOptions.ts

@@ -8,6 +8,8 @@ export interface MigrationOptions<R = never> {
 	readonly lockTimeout?: Duration.Input;
 	readonly mode?: "migrate" | "check" | "wait";
 	readonly pollInterval?: Duration.Input;
+	readonly progressInterval?: Duration.Input;
+	readonly release?: string;
 	readonly table?: string;
 	readonly waitTimeout?: Duration.Input;
 }

package/src/server/better-auth/mount.ts

@@ -1,7 +1,7 @@
 import { type BetterAuthOptions, betterAuth } from "better-auth";
 import { Config, Effect, Option, Redacted } from "effect";
 import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/http";
-import { Pool, type PoolClient } from "pg";
+import { Pool, type PoolClient, type PoolConfig } from "pg";
 import { type RevokeUnadmitted, revokeUnadmitted } from "#server/better-auth/revokeUnadmitted.ts";
 import { type PolicyStorage, type SignInPolicy, signInGate } from "#server/better-auth/signInGate.ts";
 import { signInPolicyOptions } from "#server/better-auth/signInPolicy.ts";
@@ -96,12 +96,15 @@ export const betterAuthMount = Effect.fn("Platform.betterAuthMount")(function* <
 	return { admittedSessions, auth, revokeUnadmitted: revoke, routes };
 });
 
-export const authDatabase = Effect.fn("Platform.authDatabase")(function* (url: Redacted.Redacted<string>) {
+export const authDatabase = Effect.fn("Platform.authDatabase")(function* (
+	url: Redacted.Redacted<string>,
+	options: Pick<PoolConfig, "max" | "application_name"> = {},
+) {
 	const clients = new Set<PoolClient>();
 	const run = Effect.runForkWith(yield* Effect.context<never>());
 	return yield* Effect.acquireRelease(
 		Effect.sync(() => {
-			const pool = new Pool({ connectionString: Redacted.value(url) });
+			const pool = new Pool({ ...options, connectionString: Redacted.value(url) });
 			pool.on("connect", (client) => clients.add(client));
 			pool.on("remove", (client) => clients.delete(client));
 			pool.on("error", (error) => {

package/src/server/better-auth/testing.ts

@@ -1,3 +1,4 @@
+import type { AuthContext } from "better-auth";
 import { testUtils } from "better-auth/plugins";
 
 export function authTestUtils(options?: Parameters<typeof testUtils>[0]) {
@@ -13,9 +14,34 @@ export function authTestUtils(options?: Parameters<typeof testUtils>[0]) {
 }
 
 type TestContext = ReturnType<ReturnType<typeof authTestUtils>["init"]>["context"];
+type AccountContext = Pick<AuthContext, "internalAdapter">;
 
-export async function signedInUser(auth: { readonly $context: Promise<TestContext> }, fields: Parameters<TestContext["test"]["createUser"]>[0]) {
-	const { test } = await auth.$context;
+export async function signedInUser(
+	auth: { readonly $context: Promise<TestContext & AccountContext> },
+	{
+		providerAccounts = [],
+		...fields
+	}: Parameters<TestContext["test"]["createUser"]>[0] & {
+		readonly providerAccounts?: readonly { readonly providerId: string; readonly accountId: string }[];
+	},
+) {
+	const { test, internalAdapter } = await auth.$context;
 	const user = await test.saveUser(test.createUser(fields));
+	for (const { providerId, accountId } of providerAccounts) {
+		await internalAdapter.createAccount({ accountId, providerId, userId: user.id });
+	}
 	return test.login({ userId: user.id });
 }
+
+export async function storedProviderAccounts(auth: { readonly $context: Promise<AccountContext> }, userId: string) {
+	const { internalAdapter } = await auth.$context;
+	const accounts = await internalAdapter.findAccounts(userId);
+	return accounts.map(({ providerId, accountId, accessToken, refreshToken, idToken, password }) => ({
+		accountId,
+		hasAccessToken: Boolean(accessToken),
+		hasIdToken: Boolean(idToken),
+		hasPassword: Boolean(password),
+		hasRefreshToken: Boolean(refreshToken),
+		providerId,
+	}));
+}

package/src/server/better-auth/userProfiles.ts

@@ -0,0 +1,37 @@
+import type { Auth } from "better-auth";
+import { Effect } from "effect";
+import { AuthUnavailable } from "#errors/taxonomy.ts";
+import { redact } from "#server/rpc-server/redact.ts";
+
+export interface UserProfile {
+	readonly id: string;
+	readonly image: string | null;
+	readonly name: string;
+}
+
+export const userProfiles = Effect.fn("Platform.userProfiles")(function* (
+	auth: { readonly $context: Promise<{ readonly adapter: Pick<Awaited<Auth["$context"]>["adapter"], "findMany"> }> },
+	userIds: readonly string[],
+): Effect.fn.Return<readonly UserProfile[], AuthUnavailable> {
+	const ids = [...new Set(userIds)];
+	if (ids.length === 0) {
+		return [];
+	}
+	const users = yield* Effect.tryPromise(async () => {
+		const { adapter } = await auth.$context;
+		return adapter.findMany<UserProfile>({
+			limit: ids.length,
+			model: "user",
+			select: ["id", "name", "image"],
+			where: [{ field: "id", operator: "in", value: ids }],
+		});
+	}).pipe(
+		Effect.catch((error) =>
+			Effect.andThen(
+				Effect.logError("Authentication provider failed", redact(error.cause)),
+				Effect.fail(new AuthUnavailable({ message: "Authentication is temporarily unavailable" })),
+			),
+		),
+	);
+	return users.map(({ id, name, image }) => ({ id, image: image ?? null, name }));
+});

package/src/server/databaseLayer.ts

@@ -1,13 +1,16 @@
 import { createHash } from "node:crypto";
 import { createConnection } from "node:net";
 import * as PgClient from "@effect/sql-pg/PgClient";
-import { Config, Effect, Layer, Redacted, Schedule } from "effect";
+import { Config, Duration, Effect, Fiber, Layer, Redacted, Schedule } from "effect";
 import * as Reactivity from "effect/reactivity/Reactivity";
 import { makeLiveServer } from "@shivaedev/effect-contract/makeLiveServer.ts";
-import { assertPostgresMigrations } from "@shivaedev/effect-sql/assertPostgresMigrations.ts";
+import { assertPostgresMigrations, postgresMigrationError } from "@shivaedev/effect-sql/assertPostgresMigrations.ts";
 import type { SqlNameTransforms } from "@shivaedev/effect-sql/clientOptions.ts";
+import { coordinateWorkerRelease } from "@shivaedev/effect-sql/coordinateWorkerRelease.ts";
 import { migratePostgres } from "@shivaedev/effect-sql/migrations.ts";
+import { type PendingPostgresMigrations, pendingPostgresMigrations } from "@shivaedev/effect-sql/pendingPostgresMigrations.ts";
 import { type PostgresChangesOptions, postgresChanges } from "@shivaedev/effect-sql/postgresChanges.ts";
+import { WorkerRelease } from "@shivaedev/effect-sql/WorkerRelease.ts";
 import type { AppChanges, AppDatabaseOptions } from "#server/appHost.ts";
 import { databaseAddress } from "./databaseAddress.ts";
 
@@ -52,7 +55,12 @@ export function databaseLayer<R>(options: AppDatabaseOptions<R>, changesService:
 	);
 	const prepared = Layer.effectDiscard(prepareMigrations(options.migrations)).pipe(Layer.provideMerge(pool));
 	const live = Layer.effect(changesService, makeLiveServer).pipe(Layer.provideMerge(Reactivity.layer));
-	const base = Layer.merge(prepared, live);
+	const migrations = options.migrations;
+	const worker =
+		migrations.mode === "wait" && migrations.release !== undefined
+			? Layer.effect(WorkerRelease, coordinateWorkerRelease(migrations.release, migrations.pollInterval, migrations.table))
+			: Layer.empty;
+	const base = Layer.merge(worker.pipe(Layer.provideMerge(prepared)), live);
 	const changes = options.config?.changes;
 	return Layer.unwrap(
 		Effect.gen(function* () {
@@ -68,20 +76,52 @@ export function databaseLayer<R>(options: AppDatabaseOptions<R>, changesService:
 
 function prepareMigrations<R>(migrations: AppDatabaseOptions<R>["migrations"]) {
 	switch (migrations.mode) {
-		case "check":
-			return assertPostgresMigrations(migrations);
+		case "check": {
+			const schema = { ...migrations };
+			delete schema.release;
+			return assertPostgresMigrations(schema);
+		}
 		case "wait":
 			return waitForMigrations(migrations);
 		default:
-			return migratePostgres({ ...migrations, lockTimeout: migrations.lockTimeout ?? "5 seconds" });
+			return migratePostgres({ ...migrations, lockTimeout: migrations.lockTimeout ?? "5 seconds" }).pipe(Effect.asVoid);
 	}
 }
 
 function waitForMigrations<R>(migrations: AppDatabaseOptions<R>["migrations"]) {
-	return assertPostgresMigrations(migrations).pipe(
-		Effect.retry({
-			schedule: Schedule.max([Schedule.spaced(migrations.pollInterval ?? "1 second"), Schedule.during(migrations.waitTimeout ?? "5 minutes")]),
-			while: (error) => error._tag === "MigrationError" && error.kind === "BadState",
-		}),
-	);
+	return Effect.gen(function* () {
+		const progressInterval = Duration.fromInputUnsafe(migrations.progressInterval ?? "30 seconds");
+		let pending: PendingPostgresMigrations = { components: [], migrations: [] };
+		let progress: Fiber.Fiber<never> | undefined;
+		function log(message: string) {
+			return Effect.suspend(() =>
+				Effect.logInfo(message).pipe(Effect.annotateLogs({ pendingComponents: pending.components, pendingMigrations: pending.migrations })),
+			);
+		}
+		yield* Effect.gen(function* () {
+			pending = yield* pendingPostgresMigrations(migrations);
+			if (pending.migrations.length === 0 && pending.components.length === 0) {
+				return;
+			}
+			if (progress === undefined) {
+				yield* log("Waiting for database migrations");
+				progress = yield* Effect.forever(Effect.sleep(progressInterval).pipe(Effect.andThen(log("Still waiting for database migrations")))).pipe(
+					Effect.forkScoped,
+				);
+			}
+			return yield* Effect.fail(postgresMigrationError(pending));
+		}).pipe(
+			Effect.retry({
+				schedule: Schedule.max([Schedule.spaced(migrations.pollInterval ?? "1 second"), Schedule.during(migrations.waitTimeout ?? "5 minutes")]),
+				while: (error) => error._tag === "MigrationError" && error.kind === "BadState",
+			}),
+			Effect.tapError((error) =>
+				error._tag === "MigrationError" && error.kind === "BadState" ? log("Timed out waiting for database migrations") : Effect.void,
+			),
+		);
+		if (progress !== undefined) {
+			yield* Fiber.interrupt(progress);
+			yield* Effect.logInfo("Database migrations current");
+		}
+	}).pipe(Effect.scoped);
 }

package/src/server/hostChanges.ts

@@ -1,6 +1,6 @@
 import { Context, Effect, Layer, Option, Stream } from "effect";
 import type { Rpc, RpcGroup } from "effect/rpc";
-import type { Key } from "@shivaedev/effect-contract/keys.ts";
+import { ChangesReads, type QueryReference } from "@shivaedev/effect-contract/serverMetadata.ts";
 import type { AppChanges } from "./appHost.ts";
 
 export function hostChanges<R extends Rpc.Any>(group: RpcGroup.RpcGroup<R>, changesService: typeof AppChanges) {
@@ -18,8 +18,9 @@ export function hostChanges<R extends Rpc.Any>(group: RpcGroup.RpcGroup<R>, chan
 					handlers.set(rpc.key, provided);
 					continue;
 				}
-				function handler({ keys }: { readonly keys: readonly Key[] }) {
-					return Option.isSome(changes) ? changes.value.stream(keys) : Stream.never;
+				const reads = Context.getUnsafe(rpc.annotations, ChangesReads);
+				function handler({ queries }: { readonly queries: readonly QueryReference[] }) {
+					return Option.isSome(changes) ? changes.value.stream(reads(queries)) : Stream.never;
 				}
 				handlers.set(rpc.key, { context: services, handler, tag: rpc._tag });
 			}

package/src/server/rpc-server/local.ts

@@ -1,7 +1,8 @@
 import { Effect, Option } from "effect";
 import { HttpServerRequest, HttpServerResponse, HttpTraceContext } from "effect/http";
 import { RpcSerialization } from "effect/rpc";
-import { proxyAddresses, proxyMatches, proxyRanges } from "./trustedProxy.ts";
+import { proxyAddresses, proxyMatches } from "./trustedProxy.ts";
+import { trustedProxyRanges as normalizedRanges } from "./trustedProxyRanges.ts";
 
 function loopbackAddress(address: string): boolean {
 	const unmapped = unmapAddress(address);
@@ -46,8 +47,9 @@ export function trustedProxyPeer(trustedProxy?: string): (address: string) => bo
 	return (address) => addresses !== undefined && proxyMatches(addresses, address);
 }
 export function trustedProxyRanges(trustedProxy?: string): string[] {
-	return trustedProxy === undefined ? [] : (proxyRanges(trustedProxy) ?? []);
+	return normalizedRanges(trustedProxy);
 }
+
 function proxyOrigin(request: HttpServerRequest.HttpServerRequest, isTrustedProxy: (address: string) => boolean): boolean {
 	if (!Option.exists(request.remoteAddress, isTrustedProxy)) {
 		return false;

package/src/server/rpc-server/proxyRanges.ts

@@ -0,0 +1,61 @@
+import { BlockList, isIP } from "node:net";
+
+export function addProxyAddress(addresses: BlockList, entry: string): boolean {
+	const parts = entry.trim().split("/");
+	const address = parts[0] ?? "";
+	const family = isIP(address);
+	if (family === 0 || address.includes("%") || parts.length > 2) {
+		return false;
+	}
+	const type = family === 4 ? "ipv4" : "ipv6";
+	const prefix = parts[1];
+	if (prefix === undefined) {
+		addresses.addAddress(address, type);
+	} else {
+		if (!/^\d+$/u.test(prefix) || Number(prefix) > (family === 4 ? 32 : 128)) {
+			return false;
+		}
+		addresses.addSubnet(address, Number(prefix), type);
+	}
+	return true;
+}
+function mappedIpv4(address: string): string | undefined {
+	const groups = /^\[::ffff:(?<high>[\da-f]+):(?<low>[\da-f]+)\]$/u.exec(new URL(`http://[${address}]`).hostname)?.groups;
+	if (groups?.high === undefined || groups.low === undefined) {
+		return undefined;
+	}
+	const high = Number.parseInt(groups.high, 16);
+	const low = Number.parseInt(groups.low, 16);
+	return [high >>> 8, high & 255, low >>> 8, low & 255].join(".");
+}
+function normalizedProxyRange(entry: string): string[] | undefined {
+	const range = new BlockList();
+	if (!addProxyAddress(range, entry)) {
+		return undefined;
+	}
+	const [address = "", prefix] = entry.split("/");
+	if (isIP(address) !== 6) {
+		return [entry];
+	}
+	const ipv4 = mappedIpv4(address);
+	const bits = prefix === undefined ? 128 : Number(prefix);
+	if (ipv4 !== undefined) {
+		if (bits >= 96) {
+			return [prefix === undefined ? ipv4 : `${ipv4}/${bits - 96}`];
+		}
+		const network = bits <= 80 ? "::" : `::${((0xff_ff << (96 - bits)) & 0xff_ff).toString(16)}:0:0`;
+		return [`${network}/${bits}`, "0.0.0.0/0"];
+	}
+	return bits < 96 && range.check("::ffff:0:0", "ipv6") ? [entry, "0.0.0.0/0"] : [entry];
+}
+export function proxyRanges(value: string): string[] | undefined {
+	const ranges: string[] = [];
+	for (const entry of value.split(",")) {
+		const normalized = normalizedProxyRange(entry.trim());
+		if (normalized === undefined) {
+			return undefined;
+		}
+		ranges.push(...normalized);
+	}
+	return ranges;
+}

package/src/server/rpc-server/trustedProxy.ts

@@ -1,65 +1,11 @@
 import { BlockList, isIP } from "node:net";
 import { Schema } from "effect";
+import { addProxyAddress, proxyRanges as normalizedRanges } from "./proxyRanges.ts";
 
-function addProxyAddress(addresses: BlockList, entry: string): boolean {
-	const parts = entry.trim().split("/");
-	const address = parts[0] ?? "";
-	const family = isIP(address);
-	if (family === 0 || address.includes("%") || parts.length > 2) {
-		return false;
-	}
-	const type = family === 4 ? "ipv4" : "ipv6";
-	const prefix = parts[1];
-	if (prefix === undefined) {
-		addresses.addAddress(address, type);
-	} else {
-		if (!/^\d+$/u.test(prefix) || Number(prefix) > (family === 4 ? 32 : 128)) {
-			return false;
-		}
-		addresses.addSubnet(address, Number(prefix), type);
-	}
-	return true;
-}
-function mappedIpv4(address: string): string | undefined {
-	const groups = /^\[::ffff:(?<high>[\da-f]+):(?<low>[\da-f]+)\]$/u.exec(new URL(`http://[${address}]`).hostname)?.groups;
-	if (groups?.high === undefined || groups.low === undefined) {
-		return undefined;
-	}
-	const high = Number.parseInt(groups.high, 16);
-	const low = Number.parseInt(groups.low, 16);
-	return [high >>> 8, high & 255, low >>> 8, low & 255].join(".");
-}
-function normalizedProxyRange(entry: string): string[] | undefined {
-	const range = new BlockList();
-	if (!addProxyAddress(range, entry)) {
-		return undefined;
-	}
-	const [address = "", prefix] = entry.split("/");
-	if (isIP(address) !== 6) {
-		return [entry];
-	}
-	const ipv4 = mappedIpv4(address);
-	const bits = prefix === undefined ? 128 : Number(prefix);
-	if (ipv4 !== undefined) {
-		if (bits >= 96) {
-			return [prefix === undefined ? ipv4 : `${ipv4}/${bits - 96}`];
-		}
-		const network = bits <= 80 ? "::" : `::${((0xff_ff << (96 - bits)) & 0xff_ff).toString(16)}:0:0`;
-		return [`${network}/${bits}`, "0.0.0.0/0"];
-	}
-	return bits < 96 && range.check("::ffff:0:0", "ipv6") ? [entry, "0.0.0.0/0"] : [entry];
-}
 export function proxyRanges(value: string): string[] | undefined {
-	const ranges: string[] = [];
-	for (const entry of value.split(",")) {
-		const normalized = normalizedProxyRange(entry.trim());
-		if (normalized === undefined) {
-			return undefined;
-		}
-		ranges.push(...normalized);
-	}
-	return ranges;
+	return normalizedRanges(value);
 }
+
 export function proxyAddresses(value: string): BlockList | undefined {
 	const addresses = new BlockList();
 	return proxyRanges(value)?.every((entry) => addProxyAddress(addresses, entry)) ? addresses : undefined;

package/src/server/rpc-server/trustedProxyRanges.ts

@@ -0,0 +1,5 @@
+import { proxyRanges } from "./proxyRanges.ts";
+
+export function trustedProxyRanges(trustedProxy?: string): string[] {
+	return trustedProxy === undefined ? [] : (proxyRanges(trustedProxy) ?? []);
+}

package/src/server/testing/makePlatformIt.ts

@@ -6,7 +6,7 @@ import type { EffectTRPCAdapter } from "@shivaedev/effect-trpc/server/adapter.ts
 import type { EffectCallerFactory } from "@shivaedev/effect-trpc/server/testing/caller.ts";
 import type { CallerOptions, CallerResult } from "@shivaedev/effect-trpc/server/testing/types.ts";
 import { makeTrpcHarnessIt } from "@shivaedev/effect-trpc/server/testing/vitest.ts";
-import type { Bivariant } from "@shivaedev/types/bivariant.ts";
+import type { Bivariant } from "@shivaedev/types/Bivariant.ts";
 import type { MakePlatformItOptions, PlatformHarness, PlatformIt } from "./types.ts";
 
 interface LooseOptions {