@shivaedev/server 0.3.1 → 0.5.0

package/README.md

@@ -35,7 +35,7 @@ The optional modules solve different boundaries. `runtime/` carries Effect servi
 
 ### Host the application
 
-`appHost` is the server entry point for an Effect app. For a PostgreSQL app, supply the native RPC group, handler and service Layers, migration loader, session policy and static asset directory. The host completes migrations before acquiring application services, starts Node HTTP with NDJSON RPC at `/rpc`, and provides SQL, Reactivity and `AppChanges` to those Layers.
+`appHost` is the server entry point for an Effect app. For a PostgreSQL app, supply the native RPC group, handler and service Layers, migration loader, session policy and static asset directory. The host completes migrations before acquiring application services, starts Node HTTP with native Effect RPC over a WebSocket upgrade at `/rpc`, and provides SQL, Reactivity and `AppChanges` to those Layers.
 
 ```ts
 import { NodeRuntime } from "@effect/platform-node";
@@ -89,7 +89,7 @@ RPC request bodies are limited to 1 MiB by default. Set `MAX_BODY_SIZE` to a byt
 
 For a native Node HTTP route outside RPC, read the request body with `readBoundedBody` from [`@shivaedev/http`](https://github.com/ShivaeDev/platform/tree/main/packages/http#readme), which rejects oversized bodies with a typed 413 failure.
 
-RPC uses `localRpcGuard` from `@shivaedev/identity/server/local.ts`: it requires a loopback peer and Host, same-origin or absent Origin, and the NDJSON content type. Session lookup uses transport headers. The host applies `RequestTracing` last to every served RPC, including loopback RPC, so it wraps authentication and handlers without a per-contract tracing declaration. Existing tracing declarations run once at that outermost boundary. With a session policy, contracts declare `Authenticated` and `MaybeAuthenticated` as needed; the host supplies their implementations. For `AuthenticatedUser`, merge `authenticatedUserLayer(sessions)` from `@shivaedev/identity/server/session.ts` beside the handlers. Declared errors retain their Schema types. Applications still own resource authorization and use `rpcBoundary` when they need to map unexpected failures.
+Ordinary POST RPC uses `localRpcGuard` from `@shivaedev/identity/server/local.ts`: it requires a loopback peer and Host, same-origin or absent Origin, and the NDJSON content type. The WebSocket upgrade uses the same loopback, origin and trusted-proxy checks without an HTTP body content type. Session lookup uses the upgrade's transport headers; RPC message headers cannot replace its cookie or Origin. Session middleware revalidates authenticated streams at `streamRevalidationInterval` and ends revoked subscriptions with typed `Unauthorized`. The shared socket remains open; later protected calls use the same session checks. Automatic live subscriptions also recheck the session and query policy before each hint. POST RPC has no `$changes` stream. The host applies `RequestTracing` last to every served RPC, including loopback RPC, so it wraps authentication and handlers without a per-contract tracing declaration. Existing tracing declarations run once at that outermost boundary. With a session policy, contracts declare `Authenticated` and `MaybeAuthenticated` as needed; the host supplies their implementations. For `AuthenticatedUser`, merge `authenticatedUserLayer(sessions)` from `@shivaedev/identity/server/session.ts` beside the handlers. Declared errors retain their Schema types. Applications still own resource authorization and use `rpcBoundary` when they need to map unexpected failures.
 
 Every response from the host's native RPC endpoint carries `Cache-Control: private, no-store`, including mixed public and authenticated batches, typed failures, transport rejections, body-read failures and streams. The host sets this at the outer response boundary without inspecting batch contents.
 
@@ -153,7 +153,7 @@ Both JSON and protobuf export serialization apply sensitive-key and credential-t
 
 Set `config.maxConnections` on `appDatabase` or a migrated `appHost` to bound the PostgreSQL pool. The change listener reserves one connection; when transactions hold the remaining connections, another query waits until a transaction releases its connection. A daemon with long-lived RPC streams can use `config.disablePreemptiveShutdown: true` so scope closure interrupts an active HTTP RPC stream and runs its finalizer before host disposal completes, without waiting for Node's preemptive graceful-shutdown timeout. Omitting it keeps Node's native graceful-shutdown default.
 
-For a deployment behind a proxy, set `HOST=0.0.0.0` and `TRUSTED_PROXY` to a comma-separated list of proxy peer IPs or CIDR ranges (IPv4 or IPv6), or use `config.host` and `config.trustedProxy`. Only matching peers may supply `X-Forwarded-Host` and `X-Forwarded-Proto` (`http` or `https`) for the guard's same-origin check; the proxy must overwrite both headers and preserve Origin. A single authority is required, and comma-separated forwarding chains are refused. IPv4-mapped IPv6 peers match their IPv4 address. Malformed addresses or ranges fail `appHost` startup with a typed `ConfigError`. NDJSON and the application's session Origin policy still apply. See the [deployment quickstart](https://github.com/ShivaeDev/platform/blob/main/docs/framework/quickstart.md#deploy).
+For a deployment behind a proxy, set `HOST=0.0.0.0` and `TRUSTED_PROXY` to a comma-separated list of proxy peer IPs or CIDR ranges (IPv4 or IPv6), or use `config.host` and `config.trustedProxy`. Only matching peers may supply `X-Forwarded-Host` and `X-Forwarded-Proto` (`http` or `https`) for the guard's same-origin check; the proxy must overwrite both headers and preserve Origin. A single authority is required, and comma-separated forwarding chains are refused. IPv4-mapped IPv6 peers match their IPv4 address. A session host bound to a non-loopback address refuses to boot without `TRUSTED_PROXY` or `config.trustedProxy`, with a typed `TrustedProxyRequired` error from `@shivaedev/server/TrustedProxyRequired.ts` naming both settings and how to supply proxy peer addresses or CIDR ranges. Local loopback hosts keep working without proxy trust; `policy: "loopback"` does not use proxy trust. Malformed addresses or ranges fail `appHost` startup with a typed `ConfigError`. The starter's Railway deployment works out of the box: its web configuration supplies `TRUSTED_PROXY=100.64.0.0/10` and `AUTH_CLIENT_IP_HEADER=x-real-ip`, so matching peers supply forwarded client IPs for auth and the HTTPS authority for RPC origin checks. Set `PUBLIC_URL` to the app's HTTPS URL for secure session cookies. NDJSON and the application's session Origin policy still apply. See the [deployment quickstart](https://github.com/ShivaeDev/platform/blob/main/docs/framework/quickstart.md#deploy).
 
 Build application handlers with `Api.application.toLayer(...)` (and `Api.application.of(...)` for an Effect-built handler map), then pass the full `Api` to the host and client. `Api.application` is the native RPC group without the reserved `$changes` stream; the host supplies that handler. The explicit `Api.omit("<namespace>.$changes")` form also works.
 
@@ -188,22 +188,16 @@ export const Server = appHost({
 
 `publicConfigLayer` reads `Config.schema` from the host's native ConfigProvider when the handler Layer builds. Missing or invalid required fields fail startup with a typed `ConfigError`. An optional second argument supplies a native Config path: `publicConfigLayer(PublicConfig, "PUBLIC")` reads `PUBLIC_INSTALL_URL` with the default environment provider. Only schema-declared fields are loaded and serialized; other server values never enter this response. The generated query has no session middleware, so it can supply public configuration before sign-in. Merge it alongside authenticated contracts rather than applying authentication to the merged group.
 
-On the client, use the same native `AtomRpc.Service`, NDJSON HTTP protocol and contract `bind` as other queries:
+On the client, use the same contract `makeClient` and shared WebSocket as other queries:
 
 ```ts
-import { Layer } from "effect";
-import { FetchHttpClient } from "effect/http";
-import * as AtomRpc from "effect/reactivity/AtomRpc";
-import { RpcClient, RpcSerialization } from "effect/rpc";
-import { bind } from "@shivaedev/contract/bind.ts";
+import { makeClient } from "@shivaedev/contract/bind.ts";
 import { useQuery } from "@shivaedev/react/client/resultState.ts";
 import { PublicConfig } from "./public-config.ts";
 
-class ConfigClient extends AtomRpc.Service<ConfigClient>()("app/ConfigClient", {
-	group: PublicConfig,
-	protocol: RpcClient.layerProtocolHttp({ url: "/rpc" }).pipe(Layer.provide([FetchHttpClient.layer, RpcSerialization.layerNdjson])),
-}) {}
-const config = bind(PublicConfig, ConfigClient);
+const { api: config } = makeClient(PublicConfig, {
+	url: new URL("/rpc", window.location.href).href,
+});
 
 export function usePublicConfig() {
 	return useQuery(config.get.query());

package/dist/TrustedProxyRequired.d.ts

@@ -0,0 +1,8 @@
+declare const TrustedProxyRequired_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "TrustedProxyRequired";
+} & Readonly<A>;
+export declare class TrustedProxyRequired extends TrustedProxyRequired_base {
+    readonly message = "A non-loopback session host requires proxy trust. Set TRUSTED_PROXY to your proxy's peer IP addresses or CIDR ranges, or set config.trustedProxy. The starter's Railway configuration supplies TRUSTED_PROXY automatically.";
+}
+export {};
+//# sourceMappingURL=TrustedProxyRequired.d.ts.map

package/dist/TrustedProxyRequired.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TrustedProxyRequired.d.ts","sourceRoot":"","sources":["../src/TrustedProxyRequired.ts"],"names":[],"mappings":";;;AAEA,qBAAa,oBAAqB,SAAQ,yBAAwC;IACjF,SAAkB,OAAO,iOACsM;CAC/N"}

package/dist/TrustedProxyRequired.js

@@ -0,0 +1,5 @@
+import { Data } from "effect";
+export class TrustedProxyRequired extends Data.TaggedError("TrustedProxyRequired") {
+    message = "A non-loopback session host requires proxy trust. Set TRUSTED_PROXY to your proxy's peer IP addresses or CIDR ranges, or set config.trustedProxy. The starter's Railway configuration supplies TRUSTED_PROXY automatically.";
+}
+//# sourceMappingURL=TrustedProxyRequired.js.map

package/dist/TrustedProxyRequired.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TrustedProxyRequired.js","sourceRoot":"","sources":["../src/TrustedProxyRequired.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAE9B,MAAM,OAAO,oBAAqB,SAAQ,IAAI,CAAC,WAAW,CAAC,sBAAsB,CAAC;IAC/D,OAAO,GACxB,6NAA6N,CAAC;CAC/N"}

package/dist/appHostHttp.d.ts

@@ -6,7 +6,7 @@ import type { AppChanges, AppHttpHostOptions } from "#appHost.ts";
 import type { databaseLayer } from "#databaseLayer.ts";
 import type { HostOptions, HostPolicy, HostRouteRequirements } from "#hostOptions.ts";
 import type { MigrationOptions } from "#MigrationOptions.ts";
-export declare function appHostHttp<TRpcs extends Rpc.Any, THandlers, THandlerError, THandlerRequirements, TServices, TServiceError, TServiceRequirements, TSession extends SessionShape, TRouteError = never, TRouteRequirements = HostRouteRequirements>(options: HostOptions<TRpcs, THandlers, THandlerError, THandlerRequirements, TServices, TServiceError, TServiceRequirements, TRouteError, TRouteRequirements> & HostPolicy<TSession>, changesService: typeof AppChanges): Layer.Layer<TServices | import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | HttpServer.HttpServer | import("@effect/platform-node/NodeServices").NodeServices, TServiceError | import("effect/Config").ConfigError | import("effect/PlatformError").PlatformError | import("effect/http/HttpServerError").ServeError | HttpRouter.Request.Without<THandlerError> | HttpRouter.Request.Without<TRouteError>, Exclude<Exclude<Exclude<Exclude<TServiceRequirements, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("@effect/platform-node/NodeServices").NodeServices>, never>, never>, never> | Exclude<Exclude<Exclude<Exclude<Exclude<import("effect/FileSystem").FileSystem, TServices>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("@effect/platform-node/NodeServices").NodeServices>, never>, never>, never> | Exclude<Exclude<Exclude<Exclude<Exclude<import("effect/http/HttpPlatform").HttpPlatform, TServices>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("@effect/platform-node/NodeServices").NodeServices>, never>, never>, never> | Exclude<Exclude<Exclude<Exclude<Exclude<import("effect/Path").Path, TServices>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("@effect/platform-node/NodeServices").NodeServices>, never>, never>, never> | Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<HttpRouter.Request.Only<"GlobalRequires", Exclude<Exclude<Exclude<THandlerRequirements, import("effect/rpc/RpcSerialization").RpcSerialization>, never>, never>>, import("effect/http/HttpServerRequest").HttpServerRequest | import("effect/Scope").Scope>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | HttpServer.HttpServer | import("@effect/platform-node/NodeServices").NodeServices>, TServices>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("@effect/platform-node/NodeServices").NodeServices>, never>, never>, never> | Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<HttpRouter.Request.Only<"GlobalRequires", Exclude<Exclude<Exclude<TRouteRequirements, never>, never>, never>>, import("effect/http/HttpServerRequest").HttpServerRequest | import("effect/Scope").Scope>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | HttpServer.HttpServer | import("@effect/platform-node/NodeServices").NodeServices>, TServices>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("@effect/platform-node/NodeServices").NodeServices>, never>, never>, never> | Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<HttpRouter.Request.Only<"GlobalRequires", Exclude<Exclude<Exclude<Exclude<HttpRouter.HttpRouter, THandlers | import("@shivaedev/identity/middleware.ts").RequestTracing | Rpc.ToHandler<Extract<TRpcs, {
+export declare function appHostHttp<TRpcs extends Rpc.Any, THandlers, THandlerError, THandlerRequirements, TServices, TServiceError, TServiceRequirements, TSession extends SessionShape, TRouteError = never, TRouteRequirements = HostRouteRequirements>(options: HostOptions<TRpcs, THandlers, THandlerError, THandlerRequirements, TServices, TServiceError, TServiceRequirements, TRouteError, TRouteRequirements> & HostPolicy<TSession>, changesService: typeof AppChanges): Layer.Layer<TServices | import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | HttpServer.HttpServer | import("@effect/platform-node/NodeServices").NodeServices, TServiceError | import("effect/Config").ConfigError | import("effect/PlatformError").PlatformError | import("effect/http/HttpServerError").ServeError | import("./TrustedProxyRequired.ts").TrustedProxyRequired | HttpRouter.Request.Without<THandlerError> | HttpRouter.Request.Without<TRouteError>, Exclude<Exclude<Exclude<Exclude<TServiceRequirements, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("@effect/platform-node/NodeServices").NodeServices>, never>, never>, never> | Exclude<Exclude<Exclude<Exclude<Exclude<import("effect/FileSystem").FileSystem, TServices>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("@effect/platform-node/NodeServices").NodeServices>, never>, never>, never> | Exclude<Exclude<Exclude<Exclude<Exclude<import("effect/http/HttpPlatform").HttpPlatform, TServices>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("@effect/platform-node/NodeServices").NodeServices>, never>, never>, never> | Exclude<Exclude<Exclude<Exclude<Exclude<import("effect/Path").Path, TServices>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("@effect/platform-node/NodeServices").NodeServices>, never>, never>, never> | Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<HttpRouter.Request.Only<"GlobalRequires", Exclude<Exclude<Exclude<THandlerRequirements, import("effect/rpc/RpcSerialization").RpcSerialization>, never>, never>>, import("effect/http/HttpServerRequest").HttpServerRequest | import("effect/Scope").Scope>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | HttpServer.HttpServer | import("@effect/platform-node/NodeServices").NodeServices>, TServices>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("@effect/platform-node/NodeServices").NodeServices>, never>, never>, never> | Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<HttpRouter.Request.Only<"GlobalRequires", Exclude<Exclude<Exclude<TRouteRequirements, never>, never>, never>>, import("effect/http/HttpServerRequest").HttpServerRequest | import("effect/Scope").Scope>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | HttpServer.HttpServer | import("@effect/platform-node/NodeServices").NodeServices>, TServices>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("@effect/platform-node/NodeServices").NodeServices>, never>, never>, never> | Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<HttpRouter.Request.Only<"GlobalRequires", Exclude<Exclude<Exclude<Exclude<HttpRouter.HttpRouter, THandlers | import("@shivaedev/identity/middleware.ts").RequestTracing | Rpc.ToHandler<Extract<TRpcs, {
     readonly _tag: `${string}.$changes`;
 }>>>, import("effect/rpc/RpcSerialization").RpcSerialization>, never>, never>>, import("effect/http/HttpServerRequest").HttpServerRequest | import("effect/Scope").Scope>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | HttpServer.HttpServer | import("@effect/platform-node/NodeServices").NodeServices>, TServices>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("@effect/platform-node/NodeServices").NodeServices>, never>, never>, never> | Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<HttpRouter.Request.Only<"GlobalRequires", Exclude<Exclude<Exclude<Exclude<import("effect/rpc/RpcSerialization").RpcSerialization, THandlers | import("@shivaedev/identity/middleware.ts").RequestTracing | Rpc.ToHandler<Extract<TRpcs, {
     readonly _tag: `${string}.$changes`;
@@ -33,7 +33,7 @@ export declare function appHostHttp<TRpcs extends Rpc.Any, THandlers, THandlerEr
 }>>>, import("effect/rpc/RpcSerialization").RpcSerialization>, never>, never>>, HttpRouter.HttpRouter>, import("effect/Scope").Scope>, TServices>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("@effect/platform-node/NodeServices").NodeServices>, never>, never>, never>>;
 export declare function migratedHost<TRpcs extends Rpc.Any, THandlers, THandlerError, THandlerRequirements, TServices, TServiceError, TServiceRequirements, TMigrations, TSession extends SessionShape, TRouteError = never, TRouteRequirements = HostRouteRequirements>(options: HostOptions<TRpcs, THandlers, THandlerError, THandlerRequirements, TServices, TServiceError, TServiceRequirements, TRouteError, TRouteRequirements> & HostPolicy<TSession> & {
     readonly migrations: MigrationOptions<TMigrations>;
-}, database: ReturnType<typeof databaseLayer<TMigrations>>, changesService: typeof AppChanges): Layer.Layer<TServices | AppChanges | import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | HttpServer.HttpServer | import("@effect/sql-pg/PgClient").PgClient | import("effect/reactivity/Reactivity").Reactivity | import("effect/sql/SqlClient").SqlClient | import("@effect/platform-node/NodeServices").NodeServices, TServiceError | import("effect/Config").ConfigError | import("effect/sql/Migrator").MigrationError | import("effect/PlatformError").PlatformError | import("effect/http/HttpServerError").ServeError | import("effect/sql/SqlError").SqlError | HttpRouter.Request.Without<THandlerError> | HttpRouter.Request.Without<TRouteError>, Exclude<Exclude<Exclude<Exclude<Exclude<TServiceRequirements, AppChanges | import("@effect/sql-pg/PgClient").PgClient | import("effect/reactivity/Reactivity").Reactivity | import("effect/sql/SqlClient").SqlClient>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("@effect/platform-node/NodeServices").NodeServices>, never>, never>, never> | Exclude<Exclude<Exclude<Exclude<Exclude<import("effect/FileSystem").FileSystem, TServices | AppChanges | import("@effect/sql-pg/PgClient").PgClient | import("effect/reactivity/Reactivity").Reactivity | import("effect/sql/SqlClient").SqlClient>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("@effect/platform-node/NodeServices").NodeServices>, never>, never>, never> | Exclude<Exclude<Exclude<Exclude<Exclude<import("effect/http/HttpPlatform").HttpPlatform, TServices | AppChanges | import("@effect/sql-pg/PgClient").PgClient | import("effect/reactivity/Reactivity").Reactivity | import("effect/sql/SqlClient").SqlClient>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("@effect/platform-node/NodeServices").NodeServices>, never>, never>, never> | Exclude<Exclude<Exclude<Exclude<Exclude<import("effect/Path").Path, TServices | AppChanges | import("@effect/sql-pg/PgClient").PgClient | import("effect/reactivity/Reactivity").Reactivity | import("effect/sql/SqlClient").SqlClient>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("@effect/platform-node/NodeServices").NodeServices>, never>, never>, never> | Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<TMigrations, import("effect/Scope").Scope>, import("@effect/sql-pg/PgClient").PgClient | import("effect/sql/SqlClient").SqlClient>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("@effect/platform-node/NodeServices").NodeServices>, never>, never>, never> | Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<HttpRouter.Request.Only<"GlobalRequires", Exclude<Exclude<Exclude<THandlerRequirements, import("effect/rpc/RpcSerialization").RpcSerialization>, never>, never>>, import("effect/http/HttpServerRequest").HttpServerRequest | import("effect/Scope").Scope>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | HttpServer.HttpServer | import("@effect/platform-node/NodeServices").NodeServices>, TServices | AppChanges | import("@effect/sql-pg/PgClient").PgClient | import("effect/reactivity/Reactivity").Reactivity | import("effect/sql/SqlClient").SqlClient>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("@effect/platform-node/NodeServices").NodeServices>, never>, never>, never> | Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<HttpRouter.Request.Only<"GlobalRequires", Exclude<Exclude<Exclude<TRouteRequirements, never>, never>, never>>, import("effect/http/HttpServerRequest").HttpServerRequest | import("effect/Scope").Scope>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | HttpServer.HttpServer | import("@effect/platform-node/NodeServices").NodeServices>, TServices | AppChanges | import("@effect/sql-pg/PgClient").PgClient | import("effect/reactivity/Reactivity").Reactivity | import("effect/sql/SqlClient").SqlClient>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("@effect/platform-node/NodeServices").NodeServices>, never>, never>, never> | Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<HttpRouter.Request.Only<"GlobalRequires", Exclude<Exclude<Exclude<Exclude<HttpRouter.HttpRouter, THandlers | import("@shivaedev/identity/middleware.ts").RequestTracing | Rpc.ToHandler<Extract<TRpcs, {
+}, database: ReturnType<typeof databaseLayer<TMigrations>>, changesService: typeof AppChanges): Layer.Layer<TServices | AppChanges | import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | HttpServer.HttpServer | import("@effect/sql-pg/PgClient").PgClient | import("effect/reactivity/Reactivity").Reactivity | import("effect/sql/SqlClient").SqlClient | import("@effect/platform-node/NodeServices").NodeServices, TServiceError | import("effect/Config").ConfigError | import("effect/sql/Migrator").MigrationError | import("effect/PlatformError").PlatformError | import("effect/http/HttpServerError").ServeError | import("effect/sql/SqlError").SqlError | import("./TrustedProxyRequired.ts").TrustedProxyRequired | HttpRouter.Request.Without<THandlerError> | HttpRouter.Request.Without<TRouteError>, Exclude<Exclude<Exclude<Exclude<Exclude<TServiceRequirements, AppChanges | import("@effect/sql-pg/PgClient").PgClient | import("effect/reactivity/Reactivity").Reactivity | import("effect/sql/SqlClient").SqlClient>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("@effect/platform-node/NodeServices").NodeServices>, never>, never>, never> | Exclude<Exclude<Exclude<Exclude<Exclude<import("effect/FileSystem").FileSystem, TServices | AppChanges | import("@effect/sql-pg/PgClient").PgClient | import("effect/reactivity/Reactivity").Reactivity | import("effect/sql/SqlClient").SqlClient>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("@effect/platform-node/NodeServices").NodeServices>, never>, never>, never> | Exclude<Exclude<Exclude<Exclude<Exclude<import("effect/http/HttpPlatform").HttpPlatform, TServices | AppChanges | import("@effect/sql-pg/PgClient").PgClient | import("effect/reactivity/Reactivity").Reactivity | import("effect/sql/SqlClient").SqlClient>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("@effect/platform-node/NodeServices").NodeServices>, never>, never>, never> | Exclude<Exclude<Exclude<Exclude<Exclude<import("effect/Path").Path, TServices | AppChanges | import("@effect/sql-pg/PgClient").PgClient | import("effect/reactivity/Reactivity").Reactivity | import("effect/sql/SqlClient").SqlClient>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("@effect/platform-node/NodeServices").NodeServices>, never>, never>, never> | Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<TMigrations, import("effect/Scope").Scope>, import("@effect/sql-pg/PgClient").PgClient | import("effect/sql/SqlClient").SqlClient>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("@effect/platform-node/NodeServices").NodeServices>, never>, never>, never> | Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<HttpRouter.Request.Only<"GlobalRequires", Exclude<Exclude<Exclude<THandlerRequirements, import("effect/rpc/RpcSerialization").RpcSerialization>, never>, never>>, import("effect/http/HttpServerRequest").HttpServerRequest | import("effect/Scope").Scope>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | HttpServer.HttpServer | import("@effect/platform-node/NodeServices").NodeServices>, TServices | AppChanges | import("@effect/sql-pg/PgClient").PgClient | import("effect/reactivity/Reactivity").Reactivity | import("effect/sql/SqlClient").SqlClient>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("@effect/platform-node/NodeServices").NodeServices>, never>, never>, never> | Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<HttpRouter.Request.Only<"GlobalRequires", Exclude<Exclude<Exclude<TRouteRequirements, never>, never>, never>>, import("effect/http/HttpServerRequest").HttpServerRequest | import("effect/Scope").Scope>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | HttpServer.HttpServer | import("@effect/platform-node/NodeServices").NodeServices>, TServices | AppChanges | import("@effect/sql-pg/PgClient").PgClient | import("effect/reactivity/Reactivity").Reactivity | import("effect/sql/SqlClient").SqlClient>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("@effect/platform-node/NodeServices").NodeServices>, never>, never>, never> | Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<HttpRouter.Request.Only<"GlobalRequires", Exclude<Exclude<Exclude<Exclude<HttpRouter.HttpRouter, THandlers | import("@shivaedev/identity/middleware.ts").RequestTracing | Rpc.ToHandler<Extract<TRpcs, {
     readonly _tag: `${string}.$changes`;
 }>>>, import("effect/rpc/RpcSerialization").RpcSerialization>, never>, never>>, import("effect/http/HttpServerRequest").HttpServerRequest | import("effect/Scope").Scope>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | HttpServer.HttpServer | import("@effect/platform-node/NodeServices").NodeServices>, TServices | AppChanges | import("@effect/sql-pg/PgClient").PgClient | import("effect/reactivity/Reactivity").Reactivity | import("effect/sql/SqlClient").SqlClient>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("@effect/platform-node/NodeServices").NodeServices>, never>, never>, never> | Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<HttpRouter.Request.Only<"GlobalRequires", Exclude<Exclude<Exclude<Exclude<import("effect/rpc/RpcSerialization").RpcSerialization, THandlers | import("@shivaedev/identity/middleware.ts").RequestTracing | Rpc.ToHandler<Extract<TRpcs, {
     readonly _tag: `${string}.$changes`;
@@ -58,7 +58,7 @@ export declare function migratedHost<TRpcs extends Rpc.Any, THandlers, THandlerE
 }>>>, import("effect/rpc/RpcSerialization").RpcSerialization>, never>, never>>, HttpRouter.HttpRouter>, import("effect/Scope").Scope>, TServices | AppChanges | import("@effect/sql-pg/PgClient").PgClient | import("effect/reactivity/Reactivity").Reactivity | import("effect/sql/SqlClient").SqlClient>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("@effect/platform-node/NodeServices").NodeServices>, never>, never>, never> | Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<HttpRouter.Request.Without<Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<Rpc.ToHandler<Rpc.AddMiddleware<Rpc.AddMiddleware<TRpcs, typeof import("./hostRpc.ts").HostedReadPolicy>, typeof import("@shivaedev/identity/middleware.ts").RequestTracing>>, import("./hostRpc.ts").HostedReadPolicy>, import("effect/rpc/RpcSerialization").RpcSerialization>, import("effect/Scope").Scope>, THandlers | import("@shivaedev/identity/middleware.ts").RequestTracing | Rpc.ToHandler<Extract<TRpcs, {
     readonly _tag: `${string}.$changes`;
 }>>>, import("effect/rpc/RpcSerialization").RpcSerialization>, never>, never>>, HttpRouter.HttpRouter>, import("effect/Scope").Scope>, TServices | AppChanges | import("@effect/sql-pg/PgClient").PgClient | import("effect/reactivity/Reactivity").Reactivity | import("effect/sql/SqlClient").SqlClient>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("@effect/platform-node/NodeServices").NodeServices>, never>, never>, never>>;
-export declare function deferredHost<TRpcs extends Rpc.Any, THandlers, THandlerError, THandlerRequirements, TServices, TServiceError, TServiceRequirements, TMigrations, TSession extends SessionShape, TApplicationError, TApplicationRequirements, TRouteError = never, TRouteRequirements = HostRouteRequirements>(application: Effect.Effect<AppHttpHostOptions<TRpcs, THandlers, THandlerError, THandlerRequirements, TServices, TServiceError, TServiceRequirements, TSession, never, never, never, TRouteError, TRouteRequirements>, TApplicationError, TApplicationRequirements>, database: ReturnType<typeof databaseLayer<TMigrations>>, changesService: typeof AppChanges): Layer.Layer<TServices | AppChanges | import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | HttpServer.HttpServer | import("@effect/sql-pg/PgClient").PgClient | import("effect/reactivity/Reactivity").Reactivity | import("effect/sql/SqlClient").SqlClient | import("@effect/platform-node/NodeServices").NodeServices, TApplicationError | TServiceError | import("effect/Config").ConfigError | import("effect/sql/Migrator").MigrationError | import("effect/PlatformError").PlatformError | import("effect/http/HttpServerError").ServeError | import("effect/sql/SqlError").SqlError | HttpRouter.Request.Without<THandlerError> | HttpRouter.Request.Without<TRouteError>, Exclude<Exclude<TApplicationRequirements, import("effect/Scope").Scope>, AppChanges | import("@effect/sql-pg/PgClient").PgClient | import("effect/reactivity/Reactivity").Reactivity | import("effect/sql/SqlClient").SqlClient> | Exclude<Exclude<TMigrations, import("effect/Scope").Scope>, import("@effect/sql-pg/PgClient").PgClient | import("effect/sql/SqlClient").SqlClient> | Exclude<Exclude<Exclude<Exclude<Exclude<TServiceRequirements, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("@effect/platform-node/NodeServices").NodeServices>, never>, never>, never>, AppChanges | import("@effect/sql-pg/PgClient").PgClient | import("effect/reactivity/Reactivity").Reactivity | import("effect/sql/SqlClient").SqlClient> | Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<import("effect/FileSystem").FileSystem, TServices>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("@effect/platform-node/NodeServices").NodeServices>, never>, never>, never>, AppChanges | import("@effect/sql-pg/PgClient").PgClient | import("effect/reactivity/Reactivity").Reactivity | import("effect/sql/SqlClient").SqlClient> | Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<import("effect/http/HttpPlatform").HttpPlatform, TServices>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("@effect/platform-node/NodeServices").NodeServices>, never>, never>, never>, AppChanges | import("@effect/sql-pg/PgClient").PgClient | import("effect/reactivity/Reactivity").Reactivity | import("effect/sql/SqlClient").SqlClient> | Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<import("effect/Path").Path, TServices>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("@effect/platform-node/NodeServices").NodeServices>, never>, never>, never>, AppChanges | import("@effect/sql-pg/PgClient").PgClient | import("effect/reactivity/Reactivity").Reactivity | import("effect/sql/SqlClient").SqlClient> | Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<HttpRouter.Request.Only<"GlobalRequires", Exclude<Exclude<Exclude<THandlerRequirements, import("effect/rpc/RpcSerialization").RpcSerialization>, never>, never>>, import("effect/http/HttpServerRequest").HttpServerRequest | import("effect/Scope").Scope>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | HttpServer.HttpServer | import("@effect/platform-node/NodeServices").NodeServices>, TServices>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("@effect/platform-node/NodeServices").NodeServices>, never>, never>, never>, AppChanges | import("@effect/sql-pg/PgClient").PgClient | import("effect/reactivity/Reactivity").Reactivity | import("effect/sql/SqlClient").SqlClient> | Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<HttpRouter.Request.Only<"GlobalRequires", Exclude<Exclude<Exclude<TRouteRequirements, never>, never>, never>>, import("effect/http/HttpServerRequest").HttpServerRequest | import("effect/Scope").Scope>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | HttpServer.HttpServer | import("@effect/platform-node/NodeServices").NodeServices>, TServices>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("@effect/platform-node/NodeServices").NodeServices>, never>, never>, never>, AppChanges | import("@effect/sql-pg/PgClient").PgClient | import("effect/reactivity/Reactivity").Reactivity | import("effect/sql/SqlClient").SqlClient> | Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<HttpRouter.Request.Only<"GlobalRequires", Exclude<Exclude<Exclude<Exclude<HttpRouter.HttpRouter, THandlers | import("@shivaedev/identity/middleware.ts").RequestTracing | Rpc.ToHandler<Extract<TRpcs, {
+export declare function deferredHost<TRpcs extends Rpc.Any, THandlers, THandlerError, THandlerRequirements, TServices, TServiceError, TServiceRequirements, TMigrations, TSession extends SessionShape, TApplicationError, TApplicationRequirements, TRouteError = never, TRouteRequirements = HostRouteRequirements>(application: Effect.Effect<AppHttpHostOptions<TRpcs, THandlers, THandlerError, THandlerRequirements, TServices, TServiceError, TServiceRequirements, TSession, never, never, never, TRouteError, TRouteRequirements>, TApplicationError, TApplicationRequirements>, database: ReturnType<typeof databaseLayer<TMigrations>>, changesService: typeof AppChanges): Layer.Layer<TServices | AppChanges | import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | HttpServer.HttpServer | import("@effect/sql-pg/PgClient").PgClient | import("effect/reactivity/Reactivity").Reactivity | import("effect/sql/SqlClient").SqlClient | import("@effect/platform-node/NodeServices").NodeServices, TApplicationError | TServiceError | import("effect/Config").ConfigError | import("effect/sql/Migrator").MigrationError | import("effect/PlatformError").PlatformError | import("effect/http/HttpServerError").ServeError | import("effect/sql/SqlError").SqlError | import("./TrustedProxyRequired.ts").TrustedProxyRequired | HttpRouter.Request.Without<THandlerError> | HttpRouter.Request.Without<TRouteError>, Exclude<Exclude<TApplicationRequirements, import("effect/Scope").Scope>, AppChanges | import("@effect/sql-pg/PgClient").PgClient | import("effect/reactivity/Reactivity").Reactivity | import("effect/sql/SqlClient").SqlClient> | Exclude<Exclude<TMigrations, import("effect/Scope").Scope>, import("@effect/sql-pg/PgClient").PgClient | import("effect/sql/SqlClient").SqlClient> | Exclude<Exclude<Exclude<Exclude<Exclude<TServiceRequirements, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("@effect/platform-node/NodeServices").NodeServices>, never>, never>, never>, AppChanges | import("@effect/sql-pg/PgClient").PgClient | import("effect/reactivity/Reactivity").Reactivity | import("effect/sql/SqlClient").SqlClient> | Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<import("effect/FileSystem").FileSystem, TServices>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("@effect/platform-node/NodeServices").NodeServices>, never>, never>, never>, AppChanges | import("@effect/sql-pg/PgClient").PgClient | import("effect/reactivity/Reactivity").Reactivity | import("effect/sql/SqlClient").SqlClient> | Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<import("effect/http/HttpPlatform").HttpPlatform, TServices>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("@effect/platform-node/NodeServices").NodeServices>, never>, never>, never>, AppChanges | import("@effect/sql-pg/PgClient").PgClient | import("effect/reactivity/Reactivity").Reactivity | import("effect/sql/SqlClient").SqlClient> | Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<import("effect/Path").Path, TServices>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("@effect/platform-node/NodeServices").NodeServices>, never>, never>, never>, AppChanges | import("@effect/sql-pg/PgClient").PgClient | import("effect/reactivity/Reactivity").Reactivity | import("effect/sql/SqlClient").SqlClient> | Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<HttpRouter.Request.Only<"GlobalRequires", Exclude<Exclude<Exclude<THandlerRequirements, import("effect/rpc/RpcSerialization").RpcSerialization>, never>, never>>, import("effect/http/HttpServerRequest").HttpServerRequest | import("effect/Scope").Scope>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | HttpServer.HttpServer | import("@effect/platform-node/NodeServices").NodeServices>, TServices>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("@effect/platform-node/NodeServices").NodeServices>, never>, never>, never>, AppChanges | import("@effect/sql-pg/PgClient").PgClient | import("effect/reactivity/Reactivity").Reactivity | import("effect/sql/SqlClient").SqlClient> | Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<HttpRouter.Request.Only<"GlobalRequires", Exclude<Exclude<Exclude<TRouteRequirements, never>, never>, never>>, import("effect/http/HttpServerRequest").HttpServerRequest | import("effect/Scope").Scope>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | HttpServer.HttpServer | import("@effect/platform-node/NodeServices").NodeServices>, TServices>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("@effect/platform-node/NodeServices").NodeServices>, never>, never>, never>, AppChanges | import("@effect/sql-pg/PgClient").PgClient | import("effect/reactivity/Reactivity").Reactivity | import("effect/sql/SqlClient").SqlClient> | Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<HttpRouter.Request.Only<"GlobalRequires", Exclude<Exclude<Exclude<Exclude<HttpRouter.HttpRouter, THandlers | import("@shivaedev/identity/middleware.ts").RequestTracing | Rpc.ToHandler<Extract<TRpcs, {
     readonly _tag: `${string}.$changes`;
 }>>>, import("effect/rpc/RpcSerialization").RpcSerialization>, never>, never>>, import("effect/http/HttpServerRequest").HttpServerRequest | import("effect/Scope").Scope>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | HttpServer.HttpServer | import("@effect/platform-node/NodeServices").NodeServices>, TServices>, import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("@effect/platform-node/NodeServices").NodeServices>, never>, never>, never>, AppChanges | import("@effect/sql-pg/PgClient").PgClient | import("effect/reactivity/Reactivity").Reactivity | import("effect/sql/SqlClient").SqlClient> | Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<HttpRouter.Request.Only<"GlobalRequires", Exclude<Exclude<Exclude<Exclude<import("effect/rpc/RpcSerialization").RpcSerialization, THandlers | import("@shivaedev/identity/middleware.ts").RequestTracing | Rpc.ToHandler<Extract<TRpcs, {
     readonly _tag: `${string}.$changes`;

package/dist/hostChanges.d.ts

@@ -1,7 +1,8 @@
 import { Layer } from "effect";
 import type { Rpc, RpcGroup } from "effect/rpc";
+import { type SessionPolicy, type SessionShape } from "@shivaedev/identity/server/session.ts";
 import type { AppChanges } from "./appHost.ts";
-export declare function hostChanges<R extends Rpc.Any>(group: RpcGroup.RpcGroup<R>, changesService: typeof AppChanges): Layer.Layer<Rpc.ToHandler<Extract<R, {
+export declare function hostChanges<R extends Rpc.Any, TSession extends SessionShape>(group: RpcGroup.RpcGroup<R>, changesService: typeof AppChanges, sessions?: SessionPolicy<TSession>): Layer.Layer<Rpc.ToHandler<Extract<R, {
     readonly _tag: `${string}.$changes`;
 }>>, never, never>;
 //# sourceMappingURL=hostChanges.d.ts.map

package/dist/hostChanges.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hostChanges.d.ts","sourceRoot":"","sources":["../src/hostChanges.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,KAAK,EAAkB,MAAM,QAAQ,CAAC;AAChE,OAAO,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAGhD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C,wBAAgB,WAAW,CAAC,CAAC,SAAS,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,UAAU;mBAwBtC,GAAG,MAAM,WAAW;mBAG1F"}
+{"version":3,"file":"hostChanges.d.ts","sourceRoot":"","sources":["../src/hostChanges.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,KAAK,EAAkB,MAAM,QAAQ,CAAC;AAEhE,OAAO,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAIhD,OAAO,EAAkB,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAE9G,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C,wBAAgB,WAAW,CAAC,CAAC,SAAS,GAAG,CAAC,GAAG,EAAE,QAAQ,SAAS,YAAY,EAC3E,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAC3B,cAAc,EAAE,OAAO,UAAU,EACjC,QAAQ,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC;mBAsCoC,GAAG,MAAM,WAAW;mBAG1F"}

package/dist/hostChanges.js

@@ -1,10 +1,28 @@
 import { Context, Effect, Layer, Option, Stream } from "effect";
+import { Headers } from "effect/http";
+import { CurrentViewer } from "@shivaedev/contract/readPolicy.ts";
+import { Unauthorized } from "@shivaedev/errors/taxonomy.ts";
+import { resolveSession } from "@shivaedev/identity/server/session.ts";
 import { resolveChanges } from "@shivaedev/identity/server/sessionKeys.ts";
-export function hostChanges(group, changesService) {
+export function hostChanges(group, changesService, sessions) {
     return Layer.effectContext(Effect.gen(function* () {
         const changes = yield* Effect.serviceOption(changesService);
         const services = yield* Effect.context();
         const handlers = new Map();
+        function subscribe(rpc, queries) {
+            return Stream.unwrap(Effect.gen(function* () {
+                const { subscription, context } = yield* resolveChanges(rpc, queries);
+                const viewer = yield* CurrentViewer;
+                const authorized = authorizeSession(sessions, rpc._tag, viewer, subscription.authorized);
+                const stream = Option.isSome(changes)
+                    ? changes.value.subscribe({ ...subscription, authorized }, context)
+                    : Stream.concat(Stream.succeed({ _tag: "Resync" }), Stream.never);
+                if (sessions === undefined || Option.isNone(viewer)) {
+                    return stream;
+                }
+                return Stream.interruptWhen(stream, sessionRevoked(sessions, rpc._tag, viewer.value.id));
+            }));
+        }
         for (const rpc of group.requests.values()) {
             if (!rpc._tag.endsWith(".$changes")) {
                 continue;
@@ -14,12 +32,28 @@ export function hostChanges(group, changesService) {
                 handlers.set(rpc.key, provided);
                 continue;
             }
-            function handler({ queries }) {
-                return Stream.unwrap(Effect.map(resolveChanges(rpc, queries), ({ subscription, context }) => Option.isSome(changes) ? changes.value.subscribe(subscription, context) : Stream.never));
-            }
-            handlers.set(rpc.key, { context: services, handler, tag: rpc._tag });
+            handlers.set(rpc.key, {
+                context: services,
+                handler: ({ queries }) => subscribe(rpc, queries),
+                tag: rpc._tag,
+            });
         }
         return Context.makeUnsafe(handlers);
     }));
 }
+function authorizeSession(sessions, tag, viewer, policy) {
+    if (sessions === undefined) {
+        return policy;
+    }
+    return resolveSession(sessions, Headers.empty, tag).pipe(Effect.map((current) => Option.isNone(viewer) || (Option.isSome(current) && current.value.user.id === viewer.value.id)), Effect.catch(() => Effect.succeed(false)), Effect.flatMap((allowed) => (allowed ? policy : Effect.succeed(false))));
+}
+function sessionRevoked(sessions, tag, id) {
+    return Effect.gen(function* () {
+        yield* Effect.sleep(sessions.streamRevalidationInterval ?? "30 seconds");
+        const current = yield* resolveSession(sessions, Headers.empty, tag).pipe(Effect.catchTag("AuthUnavailable", () => Effect.succeed(undefined)));
+        if (current !== undefined && (Option.isNone(current) || current.value.user.id !== id)) {
+            return yield* new Unauthorized({ message: "Authentication required" });
+        }
+    }).pipe(Effect.forever);
+}
 //# sourceMappingURL=hostChanges.js.map

package/dist/hostChanges.js.map

@@ -1 +1 @@
-{"version":3,"file":"hostChanges.js","sourceRoot":"","sources":["../src/hostChanges.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAGhE,OAAO,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAG3E,MAAM,UAAU,WAAW,CAAoB,KAA2B,EAAE,cAAiC;IAC5G,OAAO,KAAK,CAAC,aAAa,CACzB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,EAAS,CAAC;QAChD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;QAC5C,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3C,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBACrC,SAAS;YACV,CAAC;YACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjD,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACtD,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBAChC,SAAS;YACV,CAAC;YACD,SAAS,OAAO,CAAC,EAAE,OAAO,EAAmD;gBAC5E,OAAO,MAAM,CAAC,MAAM,CACnB,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE,EAAE,CACtE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACtF,CACD,CAAC;YACH,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,OAAO,CAAC,UAAU,CAAqE,QAAQ,CAAC,CAAC;IACzG,CAAC,CAAC,CACF,CAAC;AACH,CAAC"}
+{"version":3,"file":"hostChanges.js","sourceRoot":"","sources":["../src/hostChanges.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtC,OAAO,EAAE,aAAa,EAAe,MAAM,mCAAmC,CAAC;AAE/E,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAyC,MAAM,uCAAuC,CAAC;AAC9G,OAAO,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAG3E,MAAM,UAAU,WAAW,CAC1B,KAA2B,EAC3B,cAAiC,EACjC,QAAkC;IAElC,OAAO,KAAK,CAAC,aAAa,CACzB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,EAAS,CAAC;QAChD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;QAC5C,SAAS,SAAS,CAAC,GAAY,EAAE,OAAkC;YAClE,OAAO,MAAM,CAAC,MAAM,CACnB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBACnB,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBACtE,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC;gBACpC,MAAM,UAAU,GAAG,gBAAgB,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC;gBACzF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;oBACpC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,YAAY,EAAE,UAAU,EAAE,EAAE,OAAO,CAAC;oBACnE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAW,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC5E,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;oBACrD,OAAO,MAAM,CAAC;gBACf,CAAC;gBACD,OAAO,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;YAC1F,CAAC,CAAC,CACF,CAAC;QACH,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3C,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBACrC,SAAS;YACV,CAAC;YACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjD,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACtD,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBAChC,SAAS;YACV,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE;gBACrB,OAAO,EAAE,QAAQ;gBACjB,OAAO,EAAE,CAAC,EAAE,OAAO,EAAmD,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC;gBAClG,GAAG,EAAE,GAAG,CAAC,IAAI;aACb,CAAC,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC,UAAU,CAAqE,QAAQ,CAAC,CAAC;IACzG,CAAC,CAAC,CACF,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CACxB,QAA6C,EAC7C,GAAW,EACX,MAA6B,EAC7B,MAA8B;IAE9B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC;IACf,CAAC;IACD,OAAO,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CACvD,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EACvH,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EACzC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CACvE,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAgC,QAAiC,EAAE,GAAW,EAAE,EAAU;IAChH,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC1B,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,0BAA0B,IAAI,YAAY,CAAC,CAAC;QACzE,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC9I,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YACvF,OAAO,KAAK,CAAC,CAAC,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACxE,CAAC;IACF,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACzB,CAAC"}

package/dist/hostRpc.d.ts

@@ -7,5 +7,5 @@ declare class HostedReadPolicy extends HostedReadPolicy_base {
 }
 export type { HostedReadPolicy };
 export declare const rpcCacheControl: HttpEffect.PreResponseHandler;
-export declare const hostRpc: <R extends Rpc.Any>(group: RpcGroup.RpcGroup<R>) => Effect.Effect<Effect.Effect<HttpServerResponse.HttpServerResponse, never, import("effect/http/HttpServerRequest").HttpServerRequest | import("effect/Scope").Scope>, never, import("effect/rpc/RpcSerialization").RpcSerialization | import("effect/Scope").Scope | Exclude<Rpc.Middleware<Rpc.AddMiddleware<Rpc.AddMiddleware<R, typeof HostedReadPolicy>, typeof import("@shivaedev/identity/middleware.ts").RequestTracing>>, HostedReadPolicy> | Exclude<Rpc.ServicesServer<Rpc.AddMiddleware<Rpc.AddMiddleware<R, typeof HostedReadPolicy>, typeof import("@shivaedev/identity/middleware.ts").RequestTracing>>, HostedReadPolicy> | Exclude<Rpc.ToHandler<Rpc.AddMiddleware<Rpc.AddMiddleware<R, typeof HostedReadPolicy>, typeof import("@shivaedev/identity/middleware.ts").RequestTracing>>, HostedReadPolicy>>;
+export declare const hostRpc: <R extends Rpc.Any>(group: RpcGroup.RpcGroup<R>, websocket?: boolean | undefined) => Effect.Effect<Effect.Effect<HttpServerResponse.HttpServerResponse, never, import("effect/http/HttpServerRequest").HttpServerRequest | import("effect/Scope").Scope>, never, import("effect/rpc/RpcSerialization").RpcSerialization | import("effect/Scope").Scope | Exclude<Rpc.Middleware<Rpc.AddMiddleware<Rpc.AddMiddleware<R, typeof HostedReadPolicy>, typeof import("@shivaedev/identity/middleware.ts").RequestTracing>>, HostedReadPolicy> | Exclude<Rpc.ServicesServer<Rpc.AddMiddleware<Rpc.AddMiddleware<R, typeof HostedReadPolicy>, typeof import("@shivaedev/identity/middleware.ts").RequestTracing>>, HostedReadPolicy> | Exclude<Rpc.ToHandler<Rpc.AddMiddleware<Rpc.AddMiddleware<R, typeof HostedReadPolicy>, typeof import("@shivaedev/identity/middleware.ts").RequestTracing>>, HostedReadPolicy>>;
 //# sourceMappingURL=hostRpc.d.ts.map

package/dist/hostRpc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hostRpc.d.ts","sourceRoot":"","sources":["../src/hostRpc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,KAAK,UAAU,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,KAAK,GAAG,EAAE,KAAK,QAAQ,EAAE,aAAa,EAAa,MAAM,YAAY,CAAC;AAE/E,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;;AAG7F,cAAM,gBAAiB,SAAQ,qBAE7B;CAAG;AAEL,YAAY,EAAE,gBAAgB,EAAE,CAAC;AAEjC,eAAO,MAAM,eAAe,EAAE,UAAU,CAAC,kBACoD,CAAC;AAE9F,eAAO,MAAM,OAAO,GAAgC,CAAC,SAAS,GAAG,CAAC,GAAG,0zBASnE,CAAC"}
+{"version":3,"file":"hostRpc.d.ts","sourceRoot":"","sources":["../src/hostRpc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,KAAK,UAAU,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,KAAK,GAAG,EAAE,KAAK,QAAQ,EAAE,aAAa,EAAa,MAAM,YAAY,CAAC;AAE/E,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;;AAG7F,cAAM,gBAAiB,SAAQ,qBAE7B;CAAG;AAEL,YAAY,EAAE,gBAAgB,EAAE,CAAC;AAEjC,eAAO,MAAM,eAAe,EAAE,UAAU,CAAC,kBACoD,CAAC;AAE9F,eAAO,MAAM,OAAO,GAAgC,CAAC,SAAS,GAAG,CAAC,GAAG,21BAWnE,CAAC"}

package/dist/hostRpc.js

@@ -9,12 +9,14 @@ class HostedReadPolicy extends RpcMiddleware.Service()("@shivaedev/server/Hosted
 }) {
 }
 export const rpcCacheControl = (_, response) => Effect.succeed(HttpServerResponse.setHeader(response, "cache-control", "private, no-store"));
-export const hostRpc = Effect.fnUntraced(function* (group) {
+export const hostRpc = Effect.fnUntraced(function* (group, websocket = false) {
     const guarded = group.middleware(HostedReadPolicy);
     // Keep the policy inside identity middleware so it sees the request's viewer.
     for (const rpc of guarded.requests.values()) {
         Object.assign(rpc, { middlewares: new Set([HostedReadPolicy, ...rpc.middlewares]) });
     }
-    return yield* RpcServer.toHttpEffect(tracedGroup(guarded)).pipe(Effect.provideService(HostedReadPolicy, (effect, request) => Effect.flatMap(CurrentViewer, (viewer) => authorizeReads(effect, request, viewer))));
+    const traced = tracedGroup(guarded);
+    const handler = websocket ? RpcServer.toHttpEffectWebsocket(traced) : RpcServer.toHttpEffect(traced);
+    return yield* handler.pipe(Effect.provideService(HostedReadPolicy, (effect, request) => Effect.flatMap(CurrentViewer, (viewer) => authorizeReads(effect, request, viewer))));
 });
 //# sourceMappingURL=hostRpc.js.map

package/dist/hostRpc.js.map

@@ -1 +1 @@
-{"version":3,"file":"hostRpc.js","sourceRoot":"","sources":["../src/hostRpc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAmB,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAA2B,aAAa,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAC7F,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,MAAM,gBAAiB,SAAQ,aAAa,CAAC,OAAO,EAAoB,CAAC,oCAAoC,EAAE;IAC9G,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,iBAAiB,EAAE,eAAe,CAAC,CAAC;CACzD,CAAC;CAAG;AAIL,MAAM,CAAC,MAAM,eAAe,GAAkC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,CAC7E,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,SAAS,CAAC,QAAQ,EAAE,eAAe,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAE9F,MAAM,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAqB,KAA2B;IACjG,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;IACnD,8EAA8E;IAC9E,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAC9D,MAAM,CAAC,cAAc,CAAC,gBAAgB,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAChJ,CAAC;AACH,CAAC,CAAC,CAAC"}
+{"version":3,"file":"hostRpc.js","sourceRoot":"","sources":["../src/hostRpc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAmB,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAA2B,aAAa,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAC7F,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,MAAM,gBAAiB,SAAQ,aAAa,CAAC,OAAO,EAAoB,CAAC,oCAAoC,EAAE;IAC9G,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,iBAAiB,EAAE,eAAe,CAAC,CAAC;CACzD,CAAC;CAAG;AAIL,MAAM,CAAC,MAAM,eAAe,GAAkC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,CAC7E,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,SAAS,CAAC,QAAQ,EAAE,eAAe,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAE9F,MAAM,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAqB,KAA2B,EAAE,SAAS,GAAG,KAAK;IACpH,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;IACnD,8EAA8E;IAC9E,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACrG,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CACzB,MAAM,CAAC,cAAc,CAAC,gBAAgB,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAChJ,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/hostRpcRoutes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hostRpcRoutes.d.ts","sourceRoot":"","sources":["../src/hostRpcRoutes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,EAAmC,UAAU,EAAyC,MAAM,aAAa,CAAC;AAEjH,OAAO,EAAE,KAAK,GAAG,EAAE,KAAK,QAAQ,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,KAAK,EAAqC,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAE3G,OAAO,EAA+C,KAAK,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAEvH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAG9C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAEnE,wBAAgB,aAAa,CAAC,KAAK,SAAS,GAAG,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,SAAS,YAAY,EACnH,OAAO,EAAE;IACR,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzC,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;IACjE,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC;CACxC,GAAG,UAAU,CAAC,QAAQ,CAAC,EACxB,cAAc,EAAE,OAAO,UAAU,EACjC,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC,EAC3F,SAAS,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC;;;;;;;;0CA+BjD"}
+{"version":3,"file":"hostRpcRoutes.d.ts","sourceRoot":"","sources":["../src/hostRpcRoutes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,EAAmC,UAAU,EAAyC,MAAM,aAAa,CAAC;AAEjH,OAAO,EAAE,KAAK,GAAG,EAAE,KAAK,QAAQ,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,KAAK,EAAqC,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAE3G,OAAO,EAA+C,KAAK,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAEvH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAG9C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAGnE,wBAAgB,aAAa,CAAC,KAAK,SAAS,GAAG,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,SAAS,YAAY,EACnH,OAAO,EAAE;IACR,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzC,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;IACjE,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC;CACxC,GAAG,UAAU,CAAC,QAAQ,CAAC,EACxB,cAAc,EAAE,OAAO,UAAU,EACjC,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC,EAC3F,SAAS,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC;;;;;;;;0CA6CjD"}

package/dist/hostRpcRoutes.js

@@ -9,21 +9,22 @@ import { boundedRpcRequest } from "#boundedRpcRequest.ts";
 import { hostChanges } from "#hostChanges.ts";
 import { hostRpc, rpcCacheControl } from "#hostRpc.ts";
 import { redactingRpcSerialization } from "#redactingRpcSerialization.ts";
+import { socketRpc } from "#socketRpc.ts";
 export function hostRpcRoutes(options, changesService, { bodySize, trustedProxy, nativeOrigins }, sensitive) {
     const middleware = options.policy === "loopback"
         ? requestTracingLayer({ sensitive })
         : Layer.mergeAll(authenticatedLayer(options.sessions), maybeAuthenticatedLayer(options.sessions), requestTracingLayer({ sensitive }));
     return HttpRouter.use((router) => Effect.gen(function* () {
         const wire = redactingRpcSerialization(yield* RpcSerialization.RpcSerialization, sensitive, sensitive.maskFailure);
-        const handler = yield* hostRpc(options.group).pipe(Effect.provideService(RpcSerialization.RpcSerialization, wire));
+        const httpGroup = options.group.omit(...[...options.group.requests.keys()].filter((tag) => tag.endsWith(".$changes")));
+        const handler = yield* hostRpc(httpGroup).pipe(Effect.provideService(RpcSerialization.RpcSerialization, wire));
         const guarded = localRpcGuard(handler, trustedProxy, nativeOrigins);
+        const websocket = yield* hostRpc(options.group, true).pipe(Effect.provideService(RpcSerialization.RpcSerialization, wire));
         yield* router.add("OPTIONS", options.rpcPath ?? "/rpc", HttpServerResponse.text("Local same-origin requests only", {
             status: HttpStatus.fromLiteral("Forbidden"),
         }));
-        yield* router.add("POST", options.rpcPath ?? "/rpc", (request) => {
-            HttpEffect.appendPreResponseHandlerUnsafe(request, rpcCacheControl);
-            return guarded.pipe(Effect.provideService(HttpIncomingMessage.MaxBodySize, ByteSize.bytes(bodySize)), Effect.provideService(HttpServerRequest.HttpServerRequest, boundedRpcRequest(request)), Effect.provideService(RpcSerialization.RpcSerialization, wire));
-        });
-    })).pipe(Layer.provide(Layer.merge(middleware, hostChanges(options.group, changesService).pipe(Layer.provideMerge(options.handlers)))), Layer.provide(RpcSerialization.layerNdjson));
+        yield* router.add("GET", options.rpcPath ?? "/rpc", socketRpc(websocket, options, trustedProxy, nativeOrigins).pipe(Effect.provideService(RpcSerialization.RpcSerialization, wire)));
+        yield* router.add("POST", options.rpcPath ?? "/rpc", (request) => guarded.pipe(Effect.provideService(HttpIncomingMessage.MaxBodySize, ByteSize.bytes(bodySize)), Effect.provideService(HttpServerRequest.HttpServerRequest, boundedRpcRequest(request)), Effect.provideService(RpcSerialization.RpcSerialization, wire), HttpEffect.withPreResponseHandler(rpcCacheControl)));
+    })).pipe(Layer.provide(Layer.merge(middleware, hostChanges(options.group, changesService, options.policy === "loopback" ? undefined : options.sessions).pipe(Layer.provideMerge(options.handlers)))), Layer.provide(RpcSerialization.layerNdjson));
 }
 //# sourceMappingURL=hostRpcRoutes.js.map

package/dist/hostRpcRoutes.js.map

@@ -1 +1 @@
-{"version":3,"file":"hostRpcRoutes.js","sourceRoot":"","sources":["../src/hostRpcRoutes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,UAAU,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjH,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAA2B,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEvE,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,EAAqB,MAAM,uCAAuC,CAAC;AACvH,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAE5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAG1E,MAAM,UAAU,aAAa,CAC5B,OAIwB,EACxB,cAAiC,EACjC,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAoD,EAC3F,SAAiD;IAEjD,MAAM,UAAU,GACf,OAAO,CAAC,MAAM,KAAK,UAAU;QAC5B,CAAC,CAAC,mBAAmB,CAAC,EAAE,SAAS,EAAE,CAAC;QACpC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,uBAAuB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,mBAAmB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IACxI,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAChC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnB,MAAM,IAAI,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,SAAS,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC;QACnH,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC;QACnH,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;QACpE,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAChB,SAAS,EACT,OAAO,CAAC,OAAO,IAAI,MAAM,EACzB,kBAAkB,CAAC,IAAI,CAAC,iCAAiC,EAAE;YAC1D,MAAM,EAAE,UAAU,CAAC,WAAW,CAAC,WAAW,CAAC;SAC3C,CAAC,CACF,CAAC;QACF,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,IAAI,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE;YAChE,UAAU,CAAC,8BAA8B,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YACpE,OAAO,OAAO,CAAC,IAAI,CAClB,MAAM,CAAC,cAAc,CAAC,mBAAmB,CAAC,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAChF,MAAM,CAAC,cAAc,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC,EACtF,MAAM,CAAC,cAAc,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAC9D,CAAC;QACH,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC,CACF,CAAC,IAAI,CACL,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAC7H,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAC3C,CAAC;AACH,CAAC"}
+{"version":3,"file":"hostRpcRoutes.js","sourceRoot":"","sources":["../src/hostRpcRoutes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,UAAU,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjH,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAA2B,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEvE,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,EAAqB,MAAM,uCAAuC,CAAC;AACvH,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAE5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAE1E,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE1C,MAAM,UAAU,aAAa,CAC5B,OAIwB,EACxB,cAAiC,EACjC,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAoD,EAC3F,SAAiD;IAEjD,MAAM,UAAU,GACf,OAAO,CAAC,MAAM,KAAK,UAAU;QAC5B,CAAC,CAAC,mBAAmB,CAAC,EAAE,SAAS,EAAE,CAAC;QACpC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,uBAAuB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,mBAAmB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IACxI,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAChC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnB,MAAM,IAAI,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,SAAS,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC;QACnH,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QACvH,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC;QAC/G,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;QACpE,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC;QAC3H,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAChB,SAAS,EACT,OAAO,CAAC,OAAO,IAAI,MAAM,EACzB,kBAAkB,CAAC,IAAI,CAAC,iCAAiC,EAAE;YAC1D,MAAM,EAAE,UAAU,CAAC,WAAW,CAAC,WAAW,CAAC;SAC3C,CAAC,CACF,CAAC;QACF,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAChB,KAAK,EACL,OAAO,CAAC,OAAO,IAAI,MAAM,EACzB,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAC/H,CAAC;QACF,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,IAAI,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAChE,OAAO,CAAC,IAAI,CACX,MAAM,CAAC,cAAc,CAAC,mBAAmB,CAAC,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAChF,MAAM,CAAC,cAAc,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC,EACtF,MAAM,CAAC,cAAc,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,IAAI,CAAC,EAC9D,UAAU,CAAC,sBAAsB,CAAC,eAAe,CAAC,CAClD,CACD,CAAC;IACH,CAAC,CAAC,CACF,CAAC,IAAI,CACL,KAAK,CAAC,OAAO,CACZ,KAAK,CAAC,KAAK,CACV,UAAU,EACV,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,EAAE,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAC5G,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CACpC,CACD,CACD,EACD,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAC3C,CAAC;AACH,CAAC"}

package/dist/hostTransport.d.ts

@@ -1,4 +1,5 @@
 import { Config, Effect } from "effect";
+import { TrustedProxyRequired } from "#TrustedProxyRequired.ts";
 interface Options {
     readonly config?: {
         readonly host?: string;
@@ -13,6 +14,6 @@ export declare const hostTransport: (options: Options) => Effect.Effect<{
     host: string;
     nativeOrigins: readonly string[];
     trustedProxy: string | undefined;
-}, Config.ConfigError, never>;
+}, Config.ConfigError | TrustedProxyRequired, never>;
 export {};
 //# sourceMappingURL=hostTransport.d.ts.map

package/dist/hostTransport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hostTransport.d.ts","sourceRoot":"","sources":["../src/hostTransport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAA0B,MAAM,QAAQ,CAAC;AAKhE,UAAU,OAAO;IAChB,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5G,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;CACzC;AACD,eAAO,MAAM,aAAa;;;;;6BA4BxB,CAAC"}
+{"version":3,"file":"hostTransport.d.ts","sourceRoot":"","sources":["../src/hostTransport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAA0B,MAAM,QAAQ,CAAC;AAIhE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAEhE,UAAU,OAAO;IAChB,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5G,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;CACzC;AACD,eAAO,MAAM,aAAa;;;;;oDA0BxB,CAAC"}

package/dist/hostTransport.js

@@ -2,6 +2,7 @@ import { Config, Effect, Option, Result, Schema } from "effect";
 import * as NetAddress from "effect/net/NetAddress";
 import { TrustedProxy } from "@shivaedev/identity/server/trustedProxy.ts";
 import { NativeOrigins } from "#nativeClientOrigins.ts";
+import { TrustedProxyRequired } from "#TrustedProxyRequired.ts";
 export const hostTransport = Effect.fn("Platform.hostTransport")(function* (options) {
     const maxBodySize = options.config?.maxBodySize ?? (yield* Config.Int("MAX_BODY_SIZE").pipe(Config.withDefault(1024 * 1024)));
     const bodySize = yield* Schema.decodeUnknownEffect(Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)))(maxBodySize).pipe(Effect.mapError((cause) => new Config.ConfigError(cause)));
@@ -18,7 +19,7 @@ export const hostTransport = Effect.fn("Platform.hostTransport")(function* (opti
             onSuccess: (address) => NetAddress.isLoopback(NetAddress.toCanonical(address)),
         });
     if (options.policy !== "loopback" && !loopback && trustedProxy === undefined) {
-        yield* Effect.logWarning("RPC forwarding is refused without a trusted proxy. Set TRUSTED_PROXY or config.trustedProxy for this non-loopback HOST.");
+        return yield* Effect.fail(new TrustedProxyRequired());
     }
     const nativeOrigins = yield* Schema.decodeUnknownEffect(NativeOrigins)(options.nativeOrigins ?? []).pipe(Effect.mapError((cause) => new Config.ConfigError(cause)));
     return { bodySize, host, nativeOrigins, trustedProxy };

package/dist/hostTransport.js.map

@@ -1 +1 @@
-{"version":3,"file":"hostTransport.js","sourceRoot":"","sources":["../src/hostTransport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChE,OAAO,KAAK,UAAU,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,4CAA4C,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAOxD,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,EAAE,CAAC,wBAAwB,CAAC,CAAC,QAAQ,CAAC,EAAE,OAAgB;IAC3F,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,WAAW,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9H,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CACvH,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CACzD,CAAC;IACF,MAAM,YAAY,GACjB,OAAO,CAAC,MAAM,KAAK,UAAU;QAC5B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACvH,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAChC,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/H,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAC1G,MAAM,QAAQ,GACb,IAAI,CAAC,WAAW,EAAE,KAAK,WAAW;WAC/B,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE;YAC9C,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK;YACtB,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;SAC9E,CAAC,CAAC;IACJ,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,QAAQ,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC9E,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CACvB,yHAAyH,CACzH,CAAC;IACH,CAAC;IACD,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,CACvG,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CACzD,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;AACxD,CAAC,CAAC,CAAC"}
+{"version":3,"file":"hostTransport.js","sourceRoot":"","sources":["../src/hostTransport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChE,OAAO,KAAK,UAAU,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,4CAA4C,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAOhE,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,EAAE,CAAC,wBAAwB,CAAC,CAAC,QAAQ,CAAC,EAAE,OAAgB;IAC3F,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,WAAW,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9H,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CACvH,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CACzD,CAAC;IACF,MAAM,YAAY,GACjB,OAAO,CAAC,MAAM,KAAK,UAAU;QAC5B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACvH,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAChC,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/H,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAC1G,MAAM,QAAQ,GACb,IAAI,CAAC,WAAW,EAAE,KAAK,WAAW;WAC/B,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE;YAC9C,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK;YACtB,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;SAC9E,CAAC,CAAC;IACJ,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,QAAQ,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC9E,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,CACvG,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CACzD,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;AACxD,CAAC,CAAC,CAAC"}

package/dist/node-http/subscriptionSignal.js

@@ -36,7 +36,7 @@ export function nodeSubscriptionSignal(options) {
     }
     nodeRequest.once("close", onRequestClose);
     socket.once("close", onSocketClose);
-    if (nodeRequest.destroyed || socket.destroyed) {
+    if ((nodeRequest.destroyed && !nodeRequest.complete) || socket.destroyed) {
         controller.abort();
     }
     let disposed = false;

package/dist/node-http/subscriptionSignal.js.map

@@ -1 +1 @@
-{"version":3,"file":"subscriptionSignal.js","sourceRoot":"","sources":["../../src/node-http/subscriptionSignal.ts"],"names":[],"mappings":"AAUA,SAAS,QAAQ,CAAC,KAAc,EAAE,GAAW;IAC5C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1F,CAAC;AACD,SAAS,iBAAiB,CAAC,KAAc;IACxC,OAAO,OAAO,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,QAAQ,IAAI,OAAO,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,UAAU,CAAC;AACvG,CAAC;AACD,SAAS,eAAe,CAAC,OAA4B;IACpD,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5E,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACjD,CAAC;AACD,gJAAgJ;AAChJ,MAAM,UAAU,sBAAsB,CAAC,OAAsC;IAC5E,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAkB,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QAC5C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;IACF,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5E,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,GAAS,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7E,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,CAAC;IAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,SAAS,cAAc;QACtB,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACvB,UAAU,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC;IACF,CAAC;IACD,SAAS,aAAa;QACrB,OAAO,UAAU,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;IACD,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACpC,IAAI,WAAW,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QAC/C,UAAU,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC;IACD,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,OAAO;QACN,OAAO,EAAE,GAAG,EAAE;YACb,IAAI,QAAQ,EAAE,CAAC;gBACd,OAAO;YACR,CAAC;YACD,QAAQ,GAAG,IAAI,CAAC;YAChB,WAAW,CAAC,cAAc,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;YACpD,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC;KAChC,CAAC;AACH,CAAC"}
+{"version":3,"file":"subscriptionSignal.js","sourceRoot":"","sources":["../../src/node-http/subscriptionSignal.ts"],"names":[],"mappings":"AAUA,SAAS,QAAQ,CAAC,KAAc,EAAE,GAAW;IAC5C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1F,CAAC;AACD,SAAS,iBAAiB,CAAC,KAAc;IACxC,OAAO,OAAO,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,QAAQ,IAAI,OAAO,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,UAAU,CAAC;AACvG,CAAC;AACD,SAAS,eAAe,CAAC,OAA4B;IACpD,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5E,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACjD,CAAC;AACD,gJAAgJ;AAChJ,MAAM,UAAU,sBAAsB,CAAC,OAAsC;IAC5E,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAkB,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QAC5C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;IACF,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5E,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,GAAS,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7E,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,CAAC;IAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,SAAS,cAAc;QACtB,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACvB,UAAU,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC;IACF,CAAC;IACD,SAAS,aAAa;QACrB,OAAO,UAAU,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;IACD,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACpC,IAAI,CAAC,WAAW,CAAC,SAAS,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QAC1E,UAAU,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC;IACD,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,OAAO;QACN,OAAO,EAAE,GAAG,EAAE;YACb,IAAI,QAAQ,EAAE,CAAC;gBACd,OAAO;YACR,CAAC;YACD,QAAQ,GAAG,IAAI,CAAC;YAChB,WAAW,CAAC,cAAc,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;YACpD,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC;KAChC,CAAC;AACH,CAAC"}

package/dist/socketRpc.d.ts

@@ -0,0 +1,6 @@
+import { Effect, type Scope } from "effect";
+import { HttpServerRequest, HttpServerResponse } from "effect/http";
+import { type SessionShape } from "@shivaedev/identity/server/session.ts";
+import type { HostPolicy } from "#hostOptions.ts";
+export declare function socketRpc<TSession extends SessionShape>(handler: Effect.Effect<HttpServerResponse.HttpServerResponse, never, HttpServerRequest.HttpServerRequest | Scope.Scope>, policy: HostPolicy<TSession>, trustedProxy: string | undefined, nativeOrigins: readonly string[]): Effect.Effect<HttpServerResponse.HttpServerResponse, never, HttpServerRequest.HttpServerRequest | Scope.Scope>;
+//# sourceMappingURL=socketRpc.d.ts.map

package/dist/socketRpc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"socketRpc.d.ts","sourceRoot":"","sources":["../src/socketRpc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,KAAK,EAAE,MAAM,QAAQ,CAAC;AAC5C,OAAO,EAAW,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAG7E,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,wBAAgB,SAAS,CAAC,QAAQ,SAAS,YAAY,EACtD,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,KAAK,EAAE,iBAAiB,CAAC,iBAAiB,GAAG,KAAK,CAAC,KAAK,CAAC,EACvH,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,EAC5B,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,aAAa,EAAE,SAAS,MAAM,EAAE,kHAiBhC"}

package/dist/socketRpc.js

@@ -0,0 +1,27 @@
+import { Effect } from "effect";
+import { Headers, HttpServerRequest, HttpServerResponse } from "effect/http";
+import * as HttpStatus from "effect/http/HttpStatus";
+import { localTransport } from "@shivaedev/identity/server/local.ts";
+import { resolveSession } from "@shivaedev/identity/server/session.ts";
+export function socketRpc(handler, policy, trustedProxy, nativeOrigins) {
+    return Effect.gen(function* () {
+        const request = yield* HttpServerRequest.HttpServerRequest;
+        if (!localTransport(trustedProxy, nativeOrigins)(request)) {
+            return HttpServerResponse.text("Local same-origin requests only", { status: HttpStatus.fromLiteral("Forbidden") });
+        }
+        if (policy.policy !== "loopback") {
+            yield* resolveSession(policy.sessions, Headers.empty, "$connect");
+        }
+        return yield* handler;
+    }).pipe(Effect.catchTags({
+        AuthUnavailable: authUnavailable,
+        Forbidden: forbidden,
+    }));
+}
+function authUnavailable() {
+    return Effect.succeed(HttpServerResponse.empty({ status: HttpStatus.fromLiteral("ServiceUnavailable") }));
+}
+function forbidden() {
+    return Effect.succeed(HttpServerResponse.empty({ status: HttpStatus.fromLiteral("Forbidden") }));
+}
+//# sourceMappingURL=socketRpc.js.map

package/dist/socketRpc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"socketRpc.js","sourceRoot":"","sources":["../src/socketRpc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAc,MAAM,QAAQ,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAC7E,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AACrE,OAAO,EAAE,cAAc,EAAqB,MAAM,uCAAuC,CAAC;AAG1F,MAAM,UAAU,SAAS,CACxB,OAAuH,EACvH,MAA4B,EAC5B,YAAgC,EAChC,aAAgC;IAEhC,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,iBAAiB,CAAC;QAC3D,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3D,OAAO,kBAAkB,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACpH,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAClC,KAAK,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC;IACvB,CAAC,CAAC,CAAC,IAAI,CACN,MAAM,CAAC,SAAS,CAAC;QAChB,eAAe,EAAE,eAAe;QAChC,SAAS,EAAE,SAAS;KACpB,CAAC,CACF,CAAC;AACH,CAAC;AAED,SAAS,eAAe;IACvB,OAAO,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,WAAW,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC,CAAC;AAC3G,CAAC;AACD,SAAS,SAAS;IACjB,OAAO,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;AAClG,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shivaedev/server",
-  "version": "0.3.1",
+  "version": "0.5.0",
   "description": "The Effect application host: HTTP and RPC serving, health, OTLP export, database and migrations, and development mode",
   "keywords": [
     "effect"
@@ -44,38 +44,38 @@
     "README.md"
   ],
   "dependencies": {
-    "@shivaedev/changes": "0.5.0",
-    "@shivaedev/contract": "0.19.1",
-    "@shivaedev/errors": "0.1.0",
-    "@shivaedev/http": "0.1.1",
-    "@shivaedev/identity": "0.3.1",
+    "@shivaedev/changes": "0.5.1",
+    "@shivaedev/contract": "0.21.0",
+    "@shivaedev/errors": "0.1.1",
+    "@shivaedev/http": "0.2.0",
+    "@shivaedev/identity": "0.4.0",
     "@shivaedev/local-postgres": "0.7.0",
-    "@shivaedev/sql": "0.24.0"
+    "@shivaedev/sql": "0.25.0"
   },
   "devDependencies": {
-    "@effect/platform-node": "4.0.5",
-    "@effect/sql-pg": "4.0.5",
-    "@effect/vitest": "4.0.5",
-    "@shivaedev/jobs": "0.22.0",
-    "@shivaedev/quality": "0.44.0",
-    "@shivaedev/test": "0.10.0",
-    "@shivaedev/test-sql": "0.10.2",
-    "@shivaedev/test-story": "0.22.0",
+    "@effect/platform-node": "4.0.6",
+    "@effect/sql-pg": "4.0.6",
+    "@effect/vitest": "4.0.6",
+    "@shivaedev/jobs": "0.22.1",
+    "@shivaedev/quality": "0.45.0",
+    "@shivaedev/test": "0.10.1",
+    "@shivaedev/test-sql": "0.11.0",
+    "@shivaedev/test-story": "0.24.0",
     "@types/node": "24.19.2",
     "@types/pg": "8.20.0",
     "better-auth": "1.7.12",
-    "effect": "4.0.5",
+    "effect": "4.0.6",
     "pg": "8.23.0",
     "pg-boss": "12.38.0",
     "typescript": "7.0.2",
     "vitest": "5.0.5"
   },
   "peerDependencies": {
-    "@effect/platform-node": "4.0.5",
-    "@effect/sql-pg": "4.0.5",
-    "@effect/vitest": "4.0.5",
+    "@effect/platform-node": "4.0.6",
+    "@effect/sql-pg": "4.0.6",
+    "@effect/vitest": "4.0.6",
     "better-auth": "1.7.12",
-    "effect": "4.0.5",
+    "effect": "4.0.6",
     "pg": "8.23.0"
   },
   "peerDependenciesMeta": {

package/src/TrustedProxyRequired.ts

@@ -0,0 +1,6 @@
+import { Data } from "effect";
+
+export class TrustedProxyRequired extends Data.TaggedError("TrustedProxyRequired") {
+	override readonly message =
+		"A non-loopback session host requires proxy trust. Set TRUSTED_PROXY to your proxy's peer IP addresses or CIDR ranges, or set config.trustedProxy. The starter's Railway configuration supplies TRUSTED_PROXY automatically.";
+}

package/src/hostChanges.ts

@@ -1,15 +1,39 @@
 import { Context, Effect, Layer, Option, Stream } from "effect";
+import { Headers } from "effect/http";
 import type { Rpc, RpcGroup } from "effect/rpc";
+import { CurrentViewer, type Viewer } from "@shivaedev/contract/readPolicy.ts";
 import type { QueryReference } from "@shivaedev/contract/serverMetadata.ts";
+import { Unauthorized } from "@shivaedev/errors/taxonomy.ts";
+import { resolveSession, type SessionPolicy, type SessionShape } from "@shivaedev/identity/server/session.ts";
 import { resolveChanges } from "@shivaedev/identity/server/sessionKeys.ts";
 import type { AppChanges } from "./appHost.ts";
 
-export function hostChanges<R extends Rpc.Any>(group: RpcGroup.RpcGroup<R>, changesService: typeof AppChanges) {
+export function hostChanges<R extends Rpc.Any, TSession extends SessionShape>(
+	group: RpcGroup.RpcGroup<R>,
+	changesService: typeof AppChanges,
+	sessions?: SessionPolicy<TSession>,
+) {
 	return Layer.effectContext(
 		Effect.gen(function* () {
 			const changes = yield* Effect.serviceOption(changesService);
 			const services = yield* Effect.context<never>();
 			const handlers = new Map<string, unknown>();
+			function subscribe(rpc: Rpc.Any, queries: readonly QueryReference[]) {
+				return Stream.unwrap(
+					Effect.gen(function* () {
+						const { subscription, context } = yield* resolveChanges(rpc, queries);
+						const viewer = yield* CurrentViewer;
+						const authorized = authorizeSession(sessions, rpc._tag, viewer, subscription.authorized);
+						const stream = Option.isSome(changes)
+							? changes.value.subscribe({ ...subscription, authorized }, context)
+							: Stream.concat(Stream.succeed({ _tag: "Resync" } as const), Stream.never);
+						if (sessions === undefined || Option.isNone(viewer)) {
+							return stream;
+						}
+						return Stream.interruptWhen(stream, sessionRevoked(sessions, rpc._tag, viewer.value.id));
+					}),
+				);
+			}
 			for (const rpc of group.requests.values()) {
 				if (!rpc._tag.endsWith(".$changes")) {
 					continue;
@@ -19,16 +43,39 @@ export function hostChanges<R extends Rpc.Any>(group: RpcGroup.RpcGroup<R>, chan
 					handlers.set(rpc.key, provided);
 					continue;
 				}
-				function handler({ queries }: { readonly queries: readonly QueryReference[] }) {
-					return Stream.unwrap(
-						Effect.map(resolveChanges(rpc, queries), ({ subscription, context }) =>
-							Option.isSome(changes) ? changes.value.subscribe(subscription, context) : Stream.never,
-						),
-					);
-				}
-				handlers.set(rpc.key, { context: services, handler, tag: rpc._tag });
+				handlers.set(rpc.key, {
+					context: services,
+					handler: ({ queries }: { readonly queries: readonly QueryReference[] }) => subscribe(rpc, queries),
+					tag: rpc._tag,
+				});
 			}
 			return Context.makeUnsafe<Rpc.ToHandler<Extract<R, { readonly _tag: `${string}.$changes` }>>>(handlers);
 		}),
 	);
 }
+
+function authorizeSession<TSession extends SessionShape>(
+	sessions: SessionPolicy<TSession> | undefined,
+	tag: string,
+	viewer: Option.Option<Viewer>,
+	policy: Effect.Effect<boolean>,
+) {
+	if (sessions === undefined) {
+		return policy;
+	}
+	return resolveSession(sessions, Headers.empty, tag).pipe(
+		Effect.map((current) => Option.isNone(viewer) || (Option.isSome(current) && current.value.user.id === viewer.value.id)),
+		Effect.catch(() => Effect.succeed(false)),
+		Effect.flatMap((allowed) => (allowed ? policy : Effect.succeed(false))),
+	);
+}
+
+function sessionRevoked<TSession extends SessionShape>(sessions: SessionPolicy<TSession>, tag: string, id: string) {
+	return Effect.gen(function* () {
+		yield* Effect.sleep(sessions.streamRevalidationInterval ?? "30 seconds");
+		const current = yield* resolveSession(sessions, Headers.empty, tag).pipe(Effect.catchTag("AuthUnavailable", () => Effect.succeed(undefined)));
+		if (current !== undefined && (Option.isNone(current) || current.value.user.id !== id)) {
+			return yield* new Unauthorized({ message: "Authentication required" });
+		}
+	}).pipe(Effect.forever);
+}

package/src/hostRpc.ts

@@ -14,13 +14,15 @@ export type { HostedReadPolicy };
 export const rpcCacheControl: HttpEffect.PreResponseHandler = (_, response) =>
 	Effect.succeed(HttpServerResponse.setHeader(response, "cache-control", "private, no-store"));
 
-export const hostRpc = Effect.fnUntraced(function* <R extends Rpc.Any>(group: RpcGroup.RpcGroup<R>) {
+export const hostRpc = Effect.fnUntraced(function* <R extends Rpc.Any>(group: RpcGroup.RpcGroup<R>, websocket = false) {
 	const guarded = group.middleware(HostedReadPolicy);
 	// Keep the policy inside identity middleware so it sees the request's viewer.
 	for (const rpc of guarded.requests.values()) {
 		Object.assign(rpc, { middlewares: new Set([HostedReadPolicy, ...rpc.middlewares]) });
 	}
-	return yield* RpcServer.toHttpEffect(tracedGroup(guarded)).pipe(
+	const traced = tracedGroup(guarded);
+	const handler = websocket ? RpcServer.toHttpEffectWebsocket(traced) : RpcServer.toHttpEffect(traced);
+	return yield* handler.pipe(
 		Effect.provideService(HostedReadPolicy, (effect, request) => Effect.flatMap(CurrentViewer, (viewer) => authorizeReads(effect, request, viewer))),
 	);
 });

package/src/hostRpcRoutes.ts

@@ -14,6 +14,7 @@ import { hostRpc, rpcCacheControl } from "#hostRpc.ts";
 import type { hostTransport } from "#hostTransport.ts";
 import { redactingRpcSerialization } from "#redactingRpcSerialization.ts";
 import type { schemaSensitiveKeys } from "#schemaSensitiveKeys.ts";
+import { socketRpc } from "#socketRpc.ts";
 
 export function hostRpcRoutes<TRpcs extends Rpc.Any, THandlers, TError, TRequirements, TSession extends SessionShape>(
 	options: {
@@ -32,8 +33,10 @@ export function hostRpcRoutes<TRpcs extends Rpc.Any, THandlers, TError, TRequire
 	return HttpRouter.use((router) =>
 		Effect.gen(function* () {
 			const wire = redactingRpcSerialization(yield* RpcSerialization.RpcSerialization, sensitive, sensitive.maskFailure);
-			const handler = yield* hostRpc(options.group).pipe(Effect.provideService(RpcSerialization.RpcSerialization, wire));
+			const httpGroup = options.group.omit(...[...options.group.requests.keys()].filter((tag) => tag.endsWith(".$changes")));
+			const handler = yield* hostRpc(httpGroup).pipe(Effect.provideService(RpcSerialization.RpcSerialization, wire));
 			const guarded = localRpcGuard(handler, trustedProxy, nativeOrigins);
+			const websocket = yield* hostRpc(options.group, true).pipe(Effect.provideService(RpcSerialization.RpcSerialization, wire));
 			yield* router.add(
 				"OPTIONS",
 				options.rpcPath ?? "/rpc",
@@ -41,17 +44,29 @@ export function hostRpcRoutes<TRpcs extends Rpc.Any, THandlers, TError, TRequire
 					status: HttpStatus.fromLiteral("Forbidden"),
 				}),
 			);
-			yield* router.add("POST", options.rpcPath ?? "/rpc", (request) => {
-				HttpEffect.appendPreResponseHandlerUnsafe(request, rpcCacheControl);
-				return guarded.pipe(
+			yield* router.add(
+				"GET",
+				options.rpcPath ?? "/rpc",
+				socketRpc(websocket, options, trustedProxy, nativeOrigins).pipe(Effect.provideService(RpcSerialization.RpcSerialization, wire)),
+			);
+			yield* router.add("POST", options.rpcPath ?? "/rpc", (request) =>
+				guarded.pipe(
 					Effect.provideService(HttpIncomingMessage.MaxBodySize, ByteSize.bytes(bodySize)),
 					Effect.provideService(HttpServerRequest.HttpServerRequest, boundedRpcRequest(request)),
 					Effect.provideService(RpcSerialization.RpcSerialization, wire),
-				);
-			});
+					HttpEffect.withPreResponseHandler(rpcCacheControl),
+				),
+			);
 		}),
 	).pipe(
-		Layer.provide(Layer.merge(middleware, hostChanges(options.group, changesService).pipe(Layer.provideMerge(options.handlers)))),
+		Layer.provide(
+			Layer.merge(
+				middleware,
+				hostChanges(options.group, changesService, options.policy === "loopback" ? undefined : options.sessions).pipe(
+					Layer.provideMerge(options.handlers),
+				),
+			),
+		),
 		Layer.provide(RpcSerialization.layerNdjson),
 	);
 }

package/src/hostTransport.ts

@@ -2,6 +2,7 @@ import { Config, Effect, Option, Result, Schema } from "effect";
 import * as NetAddress from "effect/net/NetAddress";
 import { TrustedProxy } from "@shivaedev/identity/server/trustedProxy.ts";
 import { NativeOrigins } from "#nativeClientOrigins.ts";
+import { TrustedProxyRequired } from "#TrustedProxyRequired.ts";
 
 interface Options {
 	readonly config?: { readonly host?: string; readonly maxBodySize?: number; readonly trustedProxy?: string };
@@ -28,9 +29,7 @@ export const hostTransport = Effect.fn("Platform.hostTransport")(function* (opti
 			onSuccess: (address) => NetAddress.isLoopback(NetAddress.toCanonical(address)),
 		});
 	if (options.policy !== "loopback" && !loopback && trustedProxy === undefined) {
-		yield* Effect.logWarning(
-			"RPC forwarding is refused without a trusted proxy. Set TRUSTED_PROXY or config.trustedProxy for this non-loopback HOST.",
-		);
+		return yield* Effect.fail(new TrustedProxyRequired());
 	}
 	const nativeOrigins = yield* Schema.decodeUnknownEffect(NativeOrigins)(options.nativeOrigins ?? []).pipe(
 		Effect.mapError((cause) => new Config.ConfigError(cause)),

package/src/node-http/subscriptionSignal.ts

@@ -46,7 +46,7 @@ export function nodeSubscriptionSignal(options: NodeSubscriptionSignalOptions):
 	}
 	nodeRequest.once("close", onRequestClose);
 	socket.once("close", onSocketClose);
-	if (nodeRequest.destroyed || socket.destroyed) {
+	if ((nodeRequest.destroyed && !nodeRequest.complete) || socket.destroyed) {
 		controller.abort();
 	}
 	let disposed = false;

package/src/socketRpc.ts

@@ -0,0 +1,36 @@
+import { Effect, type Scope } from "effect";
+import { Headers, HttpServerRequest, HttpServerResponse } from "effect/http";
+import * as HttpStatus from "effect/http/HttpStatus";
+import { localTransport } from "@shivaedev/identity/server/local.ts";
+import { resolveSession, type SessionShape } from "@shivaedev/identity/server/session.ts";
+import type { HostPolicy } from "#hostOptions.ts";
+
+export function socketRpc<TSession extends SessionShape>(
+	handler: Effect.Effect<HttpServerResponse.HttpServerResponse, never, HttpServerRequest.HttpServerRequest | Scope.Scope>,
+	policy: HostPolicy<TSession>,
+	trustedProxy: string | undefined,
+	nativeOrigins: readonly string[],
+) {
+	return Effect.gen(function* () {
+		const request = yield* HttpServerRequest.HttpServerRequest;
+		if (!localTransport(trustedProxy, nativeOrigins)(request)) {
+			return HttpServerResponse.text("Local same-origin requests only", { status: HttpStatus.fromLiteral("Forbidden") });
+		}
+		if (policy.policy !== "loopback") {
+			yield* resolveSession(policy.sessions, Headers.empty, "$connect");
+		}
+		return yield* handler;
+	}).pipe(
+		Effect.catchTags({
+			AuthUnavailable: authUnavailable,
+			Forbidden: forbidden,
+		}),
+	);
+}
+
+function authUnavailable() {
+	return Effect.succeed(HttpServerResponse.empty({ status: HttpStatus.fromLiteral("ServiceUnavailable") }));
+}
+function forbidden() {
+	return Effect.succeed(HttpServerResponse.empty({ status: HttpStatus.fromLiteral("Forbidden") }));
+}