@shivaedev/platform 0.6.0 → 0.7.0

package/src/{rpc-server/adapters/better-auth-sessions.ts → server/rpc-server/adapters/betterAuthSessions.ts}

@@ -1,22 +1,21 @@
 import { Effect, Option } from "effect";
-import type { Headers } from "effect/unstable/http";
+import type { Headers } from "effect/http";
 import { AuthUnavailable } from "#errors/taxonomy.ts";
 import { redact } from "#rpc-server/redact.ts";
 import type { SessionProvider, SessionShape } from "#rpc-server/session.ts";
-
-export type GetSession<Session extends SessionShape> = (headers: globalThis.Headers) => Promise<Session | null>;
-
-const unavailable = (cause: unknown) =>
-	Effect.andThen(
+export type GetSession<TSession extends SessionShape> = (headers: globalThis.Headers) => Promise<TSession | null>;
+function unavailable(cause: unknown) {
+	return Effect.andThen(
 		Effect.logError("Authentication provider failed", redact(cause)),
 		Effect.fail(new AuthUnavailable({ message: "Authentication is temporarily unavailable" })),
 	);
-
-export const betterAuthSessions = <Session extends SessionShape>(getSession: GetSession<Session>): SessionProvider<Session> => ({
-	get: Effect.fn("PlatformRpc.betterAuthSession")(function* (headers: Headers.Headers) {
+}
+export function betterAuthSessions<TSession extends SessionShape>(getSession: GetSession<TSession>): SessionProvider<TSession> {
+	const betterAuthSession = Effect.fn("PlatformRpc.betterAuthSession")(function* (headers: Headers.Headers) {
 		const session = yield* Effect.tryPromise(() => getSession(new globalThis.Headers(headers))).pipe(
 			Effect.catch((error) => unavailable(error.cause)),
 		);
 		return Option.fromNullishOr(session);
-	}),
-});
+	});
+	return { get: betterAuthSession };
+}

package/src/server/rpc-server/boundary.ts

@@ -0,0 +1,26 @@
+import { Cause, Effect, Schema } from "effect";
+import { isSensitiveKey, redactText } from "./sensitive.ts";
+export interface RpcBoundaryOptions<E> {
+	readonly message?: string;
+	readonly unexpected: (message: string) => E;
+}
+export function rpcBoundary<
+	TSchema extends Schema.ConstraintDecoder<{
+		readonly message: string;
+	}>,
+>(schema: TSchema, options: RpcBoundaryOptions<TSchema["Type"]>) {
+	const declared = Schema.is(schema);
+	return <A, E, R>(self: Effect.Effect<A, E, R>): Effect.Effect<A, TSchema["Type"], R> =>
+		Effect.catchCause(self, (cause) => {
+			if (Cause.hasInterruptsOnly(cause)) {
+				return Effect.failCause(Cause.fromReasons(cause.reasons.filter(Cause.isInterruptReason)));
+			}
+			const reason = cause.reasons[0];
+			if (cause.reasons.length === 1 && reason && Cause.isFailReason(reason) && declared(reason.error)) {
+				return Effect.fail(reason.error);
+			}
+			const rejection = options.unexpected(redactText(options.message ?? "Internal server error", isSensitiveKey));
+			Object.defineProperty(rejection, "cause", { configurable: true, enumerable: false, value: cause });
+			return Effect.failCause(Cause.fromReasons([...Cause.fail(rejection).reasons, ...cause.reasons.filter(Cause.isInterruptReason)]));
+		});
+}

package/src/server/rpc-server/local.ts

@@ -0,0 +1,72 @@
+import type { BlockList } from "node:net";
+import { Effect, Option } from "effect";
+import { HttpServerRequest, HttpServerResponse } from "effect/http";
+import { RpcSerialization } from "effect/rpc";
+import { proxyAddresses, proxyMatches } from "./trustedProxy.ts";
+
+function loopbackAddress(address: string): boolean {
+	const unmapped = unmapAddress(address);
+	return unmapped === "::1" || (/^127(?:\.\d{1,3}){3}$/u.test(unmapped) && unmapped.split(".").every((part) => Number(part) <= 255));
+}
+function unmapAddress(address: string): string {
+	return address.replace(/^::ffff:/iu, "");
+}
+function loopbackHost(host: string | undefined): boolean {
+	if (host === undefined) {
+		return false;
+	}
+	const authority = /^(?<hostname>\[[^\]]+\]|[^:]+)(?::(?<port>\d{1,5}))?$/u.exec(host)?.groups;
+	if (authority === undefined || (authority.port !== undefined && Number(authority.port) > 65_535)) {
+		return false;
+	}
+	const hostname = authority.hostname?.toLowerCase();
+	return hostname !== undefined && (hostname === "localhost" || hostname === "[::1]" || loopbackAddress(hostname));
+}
+export function sameOrigin(request: HttpServerRequest.HttpServerRequest): boolean {
+	const origin = request.headers.origin;
+	if (origin === undefined) {
+		return true;
+	}
+	try {
+		const url = new URL(origin);
+		return url.protocol === "http:" && url.origin === origin && url.host === request.headers.host;
+	} catch {
+		return false;
+	}
+}
+export function loopbackOnly<E, R>(
+	handler: (request: HttpServerRequest.HttpServerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, E, R>,
+) {
+	return (request: HttpServerRequest.HttpServerRequest) =>
+		loopbackHost(request.headers.host) && Option.match(request.remoteAddress, { onNone: () => true, onSome: loopbackAddress })
+			? handler(request)
+			: Effect.succeed(HttpServerResponse.text("Only loopback hosts are served", { status: 403 }));
+}
+function proxyOrigin(request: HttpServerRequest.HttpServerRequest, trustedProxy: BlockList | undefined): boolean {
+	if (trustedProxy === undefined || !Option.exists(request.remoteAddress, (address) => proxyMatches(trustedProxy, address))) {
+		return false;
+	}
+	const host = request.headers["x-forwarded-host"];
+	const protocol = request.headers["x-forwarded-proto"];
+	if (host === undefined || !/^(?:\[[\da-f:]+\]|[\da-z.-]+)(?::\d{1,5})?$/iu.test(host) || (protocol !== "http" && protocol !== "https")) {
+		return false;
+	}
+	try {
+		const url = new URL(`${protocol}://${host}`);
+		return request.headers.origin === undefined || request.headers.origin === url.origin;
+	} catch {
+		return false;
+	}
+}
+export function localRpcGuard<E, R>(effect: Effect.Effect<HttpServerResponse.HttpServerResponse, E, R>, trustedProxy?: string) {
+	const addresses = trustedProxy === undefined ? undefined : proxyAddresses(trustedProxy);
+	return Effect.gen(function* () {
+		const request = yield* HttpServerRequest.HttpServerRequest;
+		const serialization = yield* RpcSerialization.RpcSerialization;
+		const local = loopbackHost(request.headers.host) && Option.exists(request.remoteAddress, loopbackAddress);
+		const contentType = request.headers["content-type"]?.split(";")[0]?.trim().toLowerCase();
+		return ((local && sameOrigin(request)) || proxyOrigin(request, addresses)) && contentType === serialization.contentType
+			? yield* effect
+			: HttpServerResponse.text("Local same-origin requests only", { status: 403 });
+	});
+}

package/src/{rpc-server → server/rpc-server}/origin.ts

@@ -1,29 +1,26 @@
 import { Option } from "effect";
-import { Headers } from "effect/unstable/http";
-
+import { Headers } from "effect/http";
 export interface OriginRequest {
 	readonly headers: Headers.Headers;
 	readonly origin: Option.Option<string>;
 	readonly rpc: string;
 }
-
 export type OriginPolicy = (request: OriginRequest) => boolean;
-
 export interface TrustedOriginsOptions {
 	readonly allow: readonly string[];
 	readonly missing: "allow" | "reject";
 }
-
-export const trustedOrigins =
-	(options: TrustedOriginsOptions): OriginPolicy =>
-	({ origin }) =>
+export function trustedOrigins(options: TrustedOriginsOptions): OriginPolicy {
+	return ({ origin }) =>
 		Option.match(origin, {
 			onNone: () => options.missing === "allow",
 			onSome: (value) => options.allow.includes(value),
 		});
-
-export const originRequest = (headers: Headers.Headers, rpc: string): OriginRequest => ({
-	headers,
-	origin: Headers.get(headers, "origin"),
-	rpc,
-});
+}
+export function originRequest(headers: Headers.Headers, rpc: string): OriginRequest {
+	return {
+		headers,
+		origin: Headers.get(headers, "origin"),
+		rpc,
+	};
+}

package/src/{rpc-server → server/rpc-server}/redact.ts

@@ -3,8 +3,7 @@ import { isSensitiveKey, REDACTED, redactText, type SensitiveKey } from "./sensi
 
 const MAX_DEPTH = 8;
 const MAX_ENTRIES = 50;
-
-const binary = (value: object): string | undefined => {
+function binary(value: object): string | undefined {
 	if (ArrayBuffer.isView(value)) {
 		return `<${value.constructor.name} ${value.byteLength} bytes>`;
 	}
@@ -12,9 +11,8 @@ const binary = (value: object): string | undefined => {
 		return `<ArrayBuffer ${value.byteLength} bytes>`;
 	}
 	return undefined;
-};
-
-const entriesOf = (value: object): [string, unknown][] => {
+}
+function entriesOf(value: object): [string, unknown][] {
 	const entries = Object.entries(value);
 	if (!Predicate.isError(value)) {
 		return entries;
@@ -25,9 +23,8 @@ const entriesOf = (value: object): [string, unknown][] => {
 		["stack", value.stack],
 	];
 	return value.cause === undefined ? [...shape, ...entries] : [...shape, ...entries, ["cause", value.cause]];
-};
-
-const walk = (value: unknown, sensitive: SensitiveKey, depth: number): unknown => {
+}
+function walk(value: unknown, sensitive: SensitiveKey, depth: number): unknown {
 	if (Redacted.isRedacted(value)) {
 		return REDACTED;
 	}
@@ -53,6 +50,7 @@ const walk = (value: unknown, sensitive: SensitiveKey, depth: number): unknown =
 		.slice(0, MAX_ENTRIES)
 		.map(([key, nested]): [string, unknown] => [key, sensitive(key) ? REDACTED : walk(nested, sensitive, depth + 1)]);
 	return Object.fromEntries(entries.length > MAX_ENTRIES ? [...kept, ["<truncated>", `${entries.length - MAX_ENTRIES} more keys`]] : kept);
-};
-
-export const redact = (value: unknown, sensitive: SensitiveKey = isSensitiveKey): unknown => walk(value, sensitive, 0);
+}
+export function redact(value: unknown, sensitive: SensitiveKey = isSensitiveKey): unknown {
+	return walk(value, sensitive, 0);
+}

package/src/server/rpc-server/redactCause.ts

@@ -0,0 +1,40 @@
+import { Cause, Context, ErrorReporter, Predicate } from "effect";
+import { redact } from "./redact.ts";
+import { isSensitiveKey, redactText, type SensitiveKey } from "./sensitive.ts";
+
+function reporterHints(error: Error, sensitive: SensitiveKey) {
+	return {
+		...(ErrorReporter.isIgnored(error) ? { [ErrorReporter.ignore]: true } : {}),
+		...(ErrorReporter.severity in error ? { [ErrorReporter.severity]: ErrorReporter.getSeverity(error) } : {}),
+		...(ErrorReporter.attributes in error ? { [ErrorReporter.attributes]: redact(ErrorReporter.getAttributes(error), sensitive) } : {}),
+	};
+}
+function redactError(error: Error, sensitive: SensitiveKey): Error {
+	const options = error.cause === undefined ? undefined : { cause: redact(error.cause, sensitive) };
+	const copy = new Error(redactText(error.message, sensitive), options);
+	Object.defineProperty(copy, "name", { configurable: true, value: error.name, writable: true });
+	Object.defineProperty(copy, "stack", {
+		configurable: true,
+		value: error.stack === undefined ? undefined : redactText(error.stack, sensitive),
+		writable: true,
+	});
+	return Object.assign(copy, redact(Object.fromEntries(Object.entries(error)), sensitive), reporterHints(error, sensitive));
+}
+export function redactDefect(defect: unknown, sensitive: SensitiveKey = isSensitiveKey): unknown {
+	return Predicate.isError(defect) ? redactError(defect, sensitive) : redact(defect, sensitive);
+}
+export function redactCause<E>(cause: Cause.Cause<E>, sensitive: SensitiveKey = isSensitiveKey): Cause.Cause<E> {
+	return Cause.fromReasons(
+		cause.reasons.flatMap<Cause.Reason<E>>((reason) =>
+			Cause.isDieReason(reason)
+				? Cause.annotate(Cause.die(redactDefect(reason.defect, sensitive)), Context.makeUnsafe(reason.annotations)).reasons
+				: [reason],
+		),
+	);
+}
+export function redactingErrorReporter(reporter: ErrorReporter.ErrorReporter, sensitive: SensitiveKey = isSensitiveKey): ErrorReporter.ErrorReporter {
+	return {
+		[ErrorReporter.TypeId]: ErrorReporter.TypeId,
+		report: (options) => reporter.report({ ...options, cause: redactCause(options.cause, sensitive) }),
+	};
+}

package/src/{rpc-server → server/rpc-server}/sensitive.ts

@@ -1,5 +1,4 @@
 export const REDACTED = "<redacted>";
-
 const MAX_STRING = 2048;
 const SENSITIVE_PARTS = [
 	"password",
@@ -23,38 +22,34 @@ const SENSITIVE_PARTS = [
 ];
 const SENSITIVE_WORDS = ["otp", "pin", "cvv", "cvc", "ssn", "iban"];
 const SENSITIVE_NAMES = ["session", "pan"];
-
 export type SensitiveKey = (key: string) => boolean;
-
-const wordsOf = (key: string): string[] =>
-	key
-		.replaceAll(/([a-z0-9])([A-Z])/gu, "$1 $2")
-		.replaceAll(/([A-Z])([A-Z][a-z])/gu, "$1 $2")
+function wordsOf(key: string): string[] {
+	return key
+		.replaceAll(/(?<lower>[a-z0-9])(?<upper>[A-Z])/gu, "$<lower> $<upper>")
+		.replaceAll(/(?<initial>[A-Z])(?<word>[A-Z][a-z])/gu, "$<initial> $<word>")
 		.toLowerCase()
 		.split(/[\s_-]+/u);
-
-export const isSensitiveKey: SensitiveKey = (key) => {
+}
+export function isSensitiveKey(key: string): boolean {
 	const normalized = key.toLowerCase().replaceAll(/[-_]/gu, "");
 	return (
 		SENSITIVE_NAMES.includes(normalized)
 		|| SENSITIVE_PARTS.some((part) => normalized.includes(part))
 		|| wordsOf(key).some((word) => SENSITIVE_WORDS.includes(word))
 	);
-};
-
-const AUTH_SCHEME = /\b(Bearer|Basic)\s+[A-Za-z0-9._~+/-]+=*/giu;
+}
+const AUTH_SCHEME = /\b(?<scheme>Bearer|Basic)\s+[A-Za-z0-9._~+/-]+=*/giu;
 const JWT = /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*/gu;
-const URL_PASSWORD = /(\/\/[^:/\s@]+:)[^@/\s]+@/gu;
-const ASSIGNMENT = /([A-Za-z][\w.-]*)(["']?\s*[=:]\s*["']?)([^\s"'&,;]+)/gu;
-
-const scrub = (text: string, sensitive: SensitiveKey): string =>
-	text
-		.replaceAll(AUTH_SCHEME, `$1 ${REDACTED}`)
+const URL_PASSWORD = /(?<authority>\/\/[^:/\s@]+:)[^@/\s]+@/gu;
+const ASSIGNMENT = /(?<key>[A-Za-z][\w.-]*)(?<separator>["']?\s*[=:]\s*["']?)(?<value>[^\s"'&,;]+)/gu;
+function scrub(text: string, sensitive: SensitiveKey): string {
+	return text
+		.replaceAll(AUTH_SCHEME, `$<scheme> ${REDACTED}`)
 		.replaceAll(JWT, REDACTED)
-		.replaceAll(URL_PASSWORD, `$1${REDACTED}@`)
+		.replaceAll(URL_PASSWORD, `$<authority>${REDACTED}@`)
 		.replaceAll(ASSIGNMENT, (match: string, key: string, separator: string) => (sensitive(key) ? `${key}${separator}${REDACTED}` : match));
-
-export const redactText = (text: string, sensitive: SensitiveKey): string => {
+}
+export function redactText(text: string, sensitive: SensitiveKey): string {
 	const scrubbed = scrub(text, sensitive);
 	return scrubbed.length > MAX_STRING ? `${scrubbed.slice(0, MAX_STRING)}…<${scrubbed.length - MAX_STRING} more chars>` : scrubbed;
-};
+}

package/src/{rpc-server → server/rpc-server}/session.ts

@@ -1,42 +1,40 @@
 import { Effect, Layer, Option } from "effect";
-import type { Headers } from "effect/unstable/http";
+import type { Headers } from "effect/http";
 import { type AuthUnavailable, Forbidden, Unauthorized } from "#errors/taxonomy.ts";
 import { Identity, OptionalIdentity } from "#rpc/identity.ts";
 import { Authenticated, MaybeAuthenticated } from "#rpc/middleware.ts";
 import { type OriginPolicy, originRequest } from "./origin.ts";
-import { transportHeaders } from "./transport.ts";
-
+import { transportHeaders } from "./transportHeaders.ts";
 export interface SessionShape {
-	readonly user: { readonly id: string };
+	readonly user: {
+		readonly id: string;
+	};
 }
-
-export interface SessionProvider<Session extends SessionShape> {
-	readonly get: (headers: Headers.Headers) => Effect.Effect<Option.Option<Session>, AuthUnavailable>;
+export interface SessionProvider<TSession extends SessionShape> {
+	readonly get: (headers: Headers.Headers) => Effect.Effect<Option.Option<TSession>, AuthUnavailable>;
 }
-
-export interface SessionPolicy<Session extends SessionShape> {
+export interface SessionPolicy<TSession extends SessionShape> {
 	readonly origin: OriginPolicy;
-	readonly provider: SessionProvider<Session>;
+	readonly provider: SessionProvider<TSession>;
 }
-
-export const resolveSession: <Session extends SessionShape>(
-	policy: SessionPolicy<Session>,
+export const resolveSession: <TSession extends SessionShape>(
+	policy: SessionPolicy<TSession>,
 	headers: Headers.Headers,
 	rpc: string,
-) => Effect.Effect<Option.Option<Session>, AuthUnavailable | Forbidden> = Effect.fn("PlatformRpc.resolveSession")(function* <
-	Session extends SessionShape,
->(policy: SessionPolicy<Session>, headers: Headers.Headers, rpc: string) {
+) => Effect.Effect<Option.Option<TSession>, AuthUnavailable | Forbidden> = Effect.fn("PlatformRpc.resolveSession")(function* <
+	TSession extends SessionShape,
+>(policy: SessionPolicy<TSession>, headers: Headers.Headers, rpc: string) {
 	const transport = yield* transportHeaders(headers);
 	if (!policy.origin(originRequest(transport, rpc))) {
 		return yield* new Forbidden({ message: "Origin not allowed" });
 	}
 	return yield* policy.provider.get(transport);
 });
-
-const identified = (id: string) => Effect.andThen(Effect.annotateCurrentSpan("user.id", id), Effect.succeed(id));
-
-export const authenticatedLayer = <Session extends SessionShape>(policy: SessionPolicy<Session>): Layer.Layer<Authenticated> =>
-	Layer.succeed(Authenticated, (effect, { headers, rpc }) =>
+function identified(id: string) {
+	return Effect.andThen(Effect.annotateCurrentSpan("user.id", id), Effect.succeed(id));
+}
+export function authenticatedLayer<TSession extends SessionShape>(policy: SessionPolicy<TSession>): Layer.Layer<Authenticated> {
+	return Layer.succeed(Authenticated, (effect, { headers, rpc }) =>
 		Effect.gen(function* () {
 			const session = yield* resolveSession(policy, headers, rpc._tag);
 			if (Option.isNone(session)) {
@@ -46,9 +44,9 @@ export const authenticatedLayer = <Session extends SessionShape>(policy: Session
 			return yield* effect.pipe(Effect.provideService(Identity, { id }), Effect.annotateLogs({ userId: id }));
 		}),
 	);
-
-export const maybeAuthenticatedLayer = <Session extends SessionShape>(policy: SessionPolicy<Session>): Layer.Layer<MaybeAuthenticated> =>
-	Layer.succeed(MaybeAuthenticated, (effect, { headers, rpc }) =>
+}
+export function maybeAuthenticatedLayer<TSession extends SessionShape>(policy: SessionPolicy<TSession>): Layer.Layer<MaybeAuthenticated> {
+	return Layer.succeed(MaybeAuthenticated, (effect, { headers, rpc }) =>
 		Effect.gen(function* () {
 			const session = yield* resolveSession(policy, headers, rpc._tag);
 			if (Option.isNone(session)) {
@@ -58,3 +56,4 @@ export const maybeAuthenticatedLayer = <Session extends SessionShape>(policy: Se
 			return yield* effect.pipe(Effect.provideService(OptionalIdentity, Option.some({ id })), Effect.annotateLogs({ userId: id }));
 		}),
 	);
+}

package/src/{rpc-server → server/rpc-server}/tracing.ts

@@ -1,38 +1,35 @@
 import { Cause, Effect, Layer, Option, Predicate, Random } from "effect";
-import { Headers } from "effect/unstable/http";
+import { Headers } from "effect/http";
 import { RequestId } from "#rpc/identity.ts";
 import { RequestTracing } from "#rpc/middleware.ts";
 import { redact } from "./redact.ts";
-import { redactCause } from "./redact-cause.ts";
+import { redactCause } from "./redactCause.ts";
 import type { SensitiveKey } from "./sensitive.ts";
-
 export interface RequestTracingOptions {
 	readonly header?: string;
 	readonly sensitive?: SensitiveKey;
 }
-
 const ACCEPTED_REQUEST_ID = /^[A-Za-z0-9._:-]{1,128}$/u;
-
-const hex = (byte: number): string => byte.toString(16).padStart(2, "0");
-
+function hex(byte: number): string {
+	return byte.toString(16).padStart(2, "0");
+}
 const generateRequestId = Effect.map(Effect.all(Array.from({ length: 16 }, () => Random.nextIntBetween(0, 255))), (bytes) => bytes.map(hex).join(""));
-
-const requestIdOf = (headers: Headers.Headers, header: string): Effect.Effect<string> =>
-	Option.match(
+function requestIdOf(headers: Headers.Headers, header: string): Effect.Effect<string> {
+	return Option.match(
 		Option.filter(Headers.get(headers, header), (value) => ACCEPTED_REQUEST_ID.test(value)),
 		{
 			onNone: () => generateRequestId,
 			onSome: Effect.succeed,
 		},
 	);
-
-const failureTag = (cause: Cause.Cause<unknown>): string =>
-	Option.match(Cause.findErrorOption(cause), {
+}
+function failureTag(cause: Cause.Cause<unknown>): string {
+	return Option.match(Cause.findErrorOption(cause), {
 		onNone: () => "unknown",
 		onSome: (error) => (Predicate.hasProperty(error, "_tag") && Predicate.isString(error._tag) ? error._tag : "unknown"),
 	});
-
-const logFailure = (cause: Cause.Cause<unknown>, payload: unknown, sensitive: SensitiveKey | undefined): Effect.Effect<void> => {
+}
+function logFailure(cause: Cause.Cause<unknown>, payload: unknown, sensitive: SensitiveKey | undefined): Effect.Effect<void> {
 	if (Cause.hasInterruptsOnly(cause)) {
 		return Effect.void;
 	}
@@ -42,10 +39,9 @@ const logFailure = (cause: Cause.Cause<unknown>, payload: unknown, sensitive: Se
 	}
 	const defects = cause.reasons.filter(Cause.isDieReason).map((reason) => redact(reason.defect, sensitive));
 	return Effect.annotateLogs(Effect.logError("RPC defect"), { ...annotations, "rpc.defect": defects });
-};
-
-export const requestTracingLayer = (options: RequestTracingOptions = {}): Layer.Layer<RequestTracing> =>
-	Layer.succeed(RequestTracing, (effect, { headers, payload, rpc }) =>
+}
+export function requestTracingLayer(options: RequestTracingOptions = {}): Layer.Layer<RequestTracing> {
+	return Layer.succeed(RequestTracing, (effect, { headers, payload, rpc }) =>
 		Effect.gen(function* () {
 			const requestId = yield* requestIdOf(headers, options.header ?? "x-request-id");
 			yield* Effect.annotateCurrentSpan({ "request.id": requestId, "rpc.method": rpc._tag });
@@ -58,3 +54,4 @@ export const requestTracingLayer = (options: RequestTracingOptions = {}): Layer.
 			);
 		}),
 	);
+}

package/src/{rpc-server/transport.ts → server/rpc-server/transportHeaders.ts}

@@ -1,8 +1,8 @@
 import { Effect, Option } from "effect";
-import { type Headers, HttpServerRequest } from "effect/unstable/http";
-
-export const transportHeaders = (rpcHeaders: Headers.Headers): Effect.Effect<Headers.Headers> =>
-	Effect.map(
+import { type Headers, HttpServerRequest } from "effect/http";
+export function transportHeaders(rpcHeaders: Headers.Headers): Effect.Effect<Headers.Headers> {
+	return Effect.map(
 		Effect.serviceOption(HttpServerRequest.HttpServerRequest),
 		Option.match({ onNone: () => rpcHeaders, onSome: (request) => request.headers }),
 	);
+}

package/src/server/rpc-server/trustedProxy.ts

@@ -0,0 +1,36 @@
+import { BlockList, isIP } from "node:net";
+import { Schema } from "effect";
+
+function addProxyAddress(addresses: BlockList, entry: string): boolean {
+	const parts = entry.trim().split("/");
+	const address = parts[0] ?? "";
+	const family = isIP(address);
+	if (family === 0 || address.includes("%") || parts.length > 2) {
+		return false;
+	}
+	const type = family === 4 ? "ipv4" : "ipv6";
+	const prefix = parts[1];
+	if (prefix === undefined) {
+		addresses.addAddress(address, type);
+	} else {
+		if (!/^\d+$/u.test(prefix) || Number(prefix) > (family === 4 ? 32 : 128)) {
+			return false;
+		}
+		addresses.addSubnet(address, Number(prefix), type);
+	}
+	return true;
+}
+export function proxyAddresses(value: string): BlockList | undefined {
+	const addresses = new BlockList();
+	return value.split(",").every((entry) => addProxyAddress(addresses, entry)) ? addresses : undefined;
+}
+export const TrustedProxy = Schema.String.check(
+	Schema.makeFilter((value) => proxyAddresses(value) !== undefined, {
+		message: "Expected a comma-separated list of IPv4 or IPv6 addresses or CIDR ranges",
+	}),
+);
+export function proxyMatches(addresses: BlockList, address: string): boolean {
+	const unmapped = address.replace(/^::ffff:(?=\d+\.)/iu, "");
+	const family = isIP(unmapped);
+	return family !== 0 && !unmapped.includes("%") && addresses.check(unmapped, family === 4 ? "ipv4" : "ipv6");
+}

package/src/{runtime/make.ts → server/runtime/makePlatform.ts}

@@ -7,31 +7,28 @@ const RuntimeCacheKey = Symbol.for("@shivaedev/platform/runtime-cache");
 const sharedCache: unknown = Reflect.get(globalThis, RuntimeCacheKey);
 const runtimeCache: Map<string | symbol, unknown> = sharedCache instanceof Map ? sharedCache : new Map<string | symbol, unknown>();
 Reflect.set(globalThis, RuntimeCacheKey, runtimeCache);
-
 // One development cache key belongs to one makePlatformRuntime call site, so its entry has that site's services and build error.
-function cachedEntry<Services, BuildError>(runtime: unknown): PlatformRuntime<Services, BuildError>;
+function cachedEntry<TServices, TBuildError>(runtime: unknown): PlatformRuntime<TServices, TBuildError>;
 function cachedEntry(runtime: unknown): unknown {
 	return runtime;
 }
-
-const make = <Services, BuildError>(layer: Layer.Layer<Services, BuildError>): PlatformRuntime<Services, BuildError> => {
+function make<TServices, TBuildError>(layer: Layer.Layer<TServices, TBuildError>): PlatformRuntime<TServices, TBuildError> {
 	const managed = ManagedRuntime.make(layer);
 	const services = new AsyncLocalStorage<Context.Context<never>>();
-
-	const currentServices = () => services.getStore();
-	const withAmbient = <A, E, Requirements extends Services>(
-		effect: Effect.Effect<A, E, Requirements>,
-	): Effect.Effect<A, E | BuildError, Requirements> => {
+	function currentServices() {
+		return services.getStore();
+	}
+	function withAmbient<A, E, TRequirements extends TServices>(
+		effect: Effect.Effect<A, E, TRequirements>,
+	): Effect.Effect<A, E | TBuildError, TRequirements> {
 		const ambient = currentServices();
 		return ambient === undefined
 			? effect
 			: Effect.flatMap(managed.contextEffect, (base) => Effect.provideContext(effect, Context.merge(base, ambient)));
-	};
-
-	const runPromiseExit: PlatformRuntime<Services, BuildError>["runPromiseExit"] = (effect, options) =>
+	}
+	const runPromiseExit: PlatformRuntime<TServices, TBuildError>["runPromiseExit"] = (effect, options) =>
 		managed.runPromiseExit(withAmbient(effect), options);
-
-	const runtime: PlatformRuntime<Services, BuildError> = {
+	const runtime: PlatformRuntime<TServices, TBuildError> = {
 		contextEffect: Effect.map(managed.contextEffect, (base) => {
 			const ambient = currentServices();
 			return ambient === undefined ? base : Context.merge(base, ambient);
@@ -48,28 +45,23 @@ const make = <Services, BuildError>(layer: Layer.Layer<Services, BuildError>): P
 		runPromiseExit,
 		runWithServices: (context, evaluate) => services.run(context, evaluate),
 	};
-
 	return runtime;
-};
-
-const production = Effect.map(Effect.orDie(Config.string("NODE_ENV").pipe(Config.withDefault(""))), (environment) => environment === "production");
-
-export const makePlatformRuntime = <Services, BuildError>(
-	layer: Layer.Layer<Services, BuildError>,
+}
+const production = Effect.map(Effect.orDie(Config.String("NODE_ENV").pipe(Config.withDefault(""))), (environment) => environment === "production");
+export function makePlatformRuntime<TServices, TBuildError>(
+	layer: Layer.Layer<TServices, TBuildError>,
 	options: PlatformRuntimeOptions = {},
-): PlatformRuntime<Services, BuildError> => {
+): PlatformRuntime<TServices, TBuildError> {
 	const key = Effect.runSync(production) ? undefined : options.developmentCacheKey;
 	if (key === undefined) {
 		return make(layer);
 	}
-
 	const cached = runtimeCache.get(key);
 	if (cached !== undefined) {
-		return cachedEntry<Services, BuildError>(cached);
+		return cachedEntry<TServices, TBuildError>(cached);
 	}
-
 	const runtime = make(layer);
-	const cachedRuntime: PlatformRuntime<Services, BuildError> = {
+	const cachedRuntime: PlatformRuntime<TServices, TBuildError> = {
 		...runtime,
 		dispose: async () => {
 			if (runtimeCache.get(key) === cachedRuntime) {
@@ -80,4 +72,4 @@ export const makePlatformRuntime = <Services, BuildError>(
 	};
 	runtimeCache.set(key, cachedRuntime);
 	return cachedRuntime;
-};
+}

package/src/server/runtime/types.ts

@@ -0,0 +1,24 @@
+import type { Context, Effect, Exit } from "effect";
+export interface PlatformRuntimeOptions {
+	readonly developmentCacheKey?: string | symbol;
+}
+export interface PlatformRuntime<TServices, TBuildError> {
+	readonly contextEffect: Effect.Effect<Context.Context<TServices>, TBuildError>;
+	readonly currentServices: () => Context.Context<never> | undefined;
+	readonly dispose: () => Promise<void>;
+	readonly runPromise: <A, E, TRequirements extends TServices>(
+		effect: Effect.Effect<A, E, TRequirements>,
+		options?: {
+			readonly signal?: AbortSignal;
+		},
+	) => Promise<A>;
+	readonly runPromiseExit: <A, E, TRequirements extends TServices>(
+		effect: Effect.Effect<A, E, TRequirements>,
+		options?: {
+			readonly signal?: AbortSignal;
+		},
+	) => Promise<Exit.Exit<A, E | TBuildError>>;
+	readonly runWithServices: <TProvided, TValue>(services: Context.Context<TProvided>, evaluate: () => TValue) => TValue;
+}
+export type PlatformRuntimeServices<TRuntime> = TRuntime extends PlatformRuntime<infer TServices, infer _TBuildError> ? TServices : never;
+export type PlatformRuntimeBuildError<TRuntime> = TRuntime extends PlatformRuntime<infer _TServices, infer TBuildError> ? TBuildError : never;