@geekmidas/constructs 10.0.0-alpha.9 → 10.0.0-alpha.91

package/dist/auth.d.cts

@@ -1,108 +1,2 @@
-import { Construct, Consumable } from "./construct-interface-D9d4Gm4p.cjs";
-import { Service, ServiceRegisterOptions } from "@geekmidas/services";
-import { ConstructName, Declaration } from "@geekmidas/manifest";
-import { Hono } from "hono";
-import { betterAuth } from "better-auth";
-
-//#region src/auth.d.ts
-
-/** The server better-auth hands back. */
-type AuthServer = ReturnType<typeof betterAuth>;
-/** Everything better-auth takes, minus what the construct owns. */
-type BetterAuthOptions = Omit<Parameters<typeof betterAuth>[0], 'database' | 'secret' | 'basePath' | 'baseURL'>;
-interface BetterAuthConfig<TDatabase extends Consumable> {
-  /**
-   * The schema tenant its tables live in.
-   *
-   * A construct rather than a URL: the tenant already declares its schema and
-   * its role, and taking the declaration is what puts the edge in the graph
-   * instead of a connection string in two places.
-   */
-  database: TDatabase;
-  /**
-   * The app that serves this auth server, relative to the workspace root —
-   * `'apps/auth'`.
-   *
-   * Required, for the reason `RestApi.path` is. Not to be confused with
-   * `basePath`, which is where its routes are mounted in a URL.
-   */
-  path: string;
-  /**
-   * Where the auth routes are mounted, e.g. `/api/auth`.
-   *
-   * Structural — it is part of the URL every client calls, so it cannot differ
-   * between stages the way the host can.
-   */
-  basePath?: string;
-  /**
-   * The rest of better-auth's options: providers, plugins, email settings.
-   *
-   * A function when they need another construct — a magic-link plugin has to
-   * *send* the link, and the thing that sends mail is a construct whose client
-   * has to be registered. It is handed the same `ServiceRegisterOptions` this
-   * construct was, so the env parser flows through the graph rather than being
-   * imported out of application config.
-   */
-  options?: BetterAuthOptions | ((options: ServiceRegisterOptions) => BetterAuthOptions | Promise<BetterAuthOptions>);
-}
-declare class BetterAuth<TName extends string = string, TDatabase extends Consumable = Consumable> implements Construct<TName, AuthServer> {
-  private readonly config;
-  readonly id: TName;
-  readonly service: Service<Uncapitalize<TName>, AuthServer>;
-  readonly basePath: string;
-  /**
-   * Declared once and read by both `declare()` and `connect()`, so the keys the
-   * target publishes and the keys the server reads cannot drift.
-   */
-  private readonly keys;
-  constructor(id: ConstructName<TName>, config: BetterAuthConfig<TDatabase>);
-  /**
-   * A signing secret and a surface.
-   *
-   * The database is *not* declared here — the tenant that was passed in
-   * declares it, and declaring it twice is the duplication the whole model
-   * removes. What is declared is what this construct owns: the key it signs
-   * with, and the routes it answers on.
-   *
-   * One endpoint, wildcarded. Better Auth routes internally and the set of
-   * paths depends on which capabilities are enabled, so enumerating them here
-   * would be a copy of its router that goes stale on its next release. The
-   * surface's job is to send everything under `basePath` to one handler, which
-   * is exactly what the declaration says.
-   */
-  declare(): Declaration[];
-  /**
-   * Better Auth's own migrations, for the app's migrate step.
-   *
-   * It brings its own schema — users, sessions, accounts, verifications — so
-   * the app never writes those tables and never gets to drift from them.
-   */
-  migrations(options: ServiceRegisterOptions): Promise<() => Promise<void>>;
-  /**
-   * The server this surface runs as, built from its own declaration.
-   *
-   * A surface is a deploy unit, so something has to serve it, and the thing
-   * that knows how is the construct — not a generator writing a mount into
-   * somebody else's entry point. That is how the auth server came to be
-   * mounted by a hook in the application it was supposed to be separate from,
-   * and then to be served by nothing at all when the hook was deleted.
-   *
-   * The routes come from {@link declare}: one wildcard under `basePath`, read
-   * off the same declaration the manifest carries, so the surface the graph
-   * describes and the surface that answers requests cannot disagree.
-   *
-   * ```ts
-   * // .gkm/server/app.ts — the whole generated entry
-   * import { auth } from '@acme/constructs/auth.js';
-   * export const { app } = await auth.server({ envParser });
-   * ```
-   */
-  server(options: ServiceRegisterOptions): Promise<{
-    app: Hono;
-  }>;
-  private connect;
-}
-//# sourceMappingURL=auth.d.ts.map
-//#endregion
-export { AuthServer, BetterAuth, BetterAuthConfig, BetterAuthOptions };
-//# sourceMappingURL=auth.d.cts.map
+import { a as BetterAuth, c as BetterAuthOptionsContext, d as deviceLink, f as idempotent, i as AuthSession, l as ExpoPluginRequired, n as AuthServer, o as BetterAuthConfig, p as withTrustedClientIp, r as AuthServerUnreachable, s as BetterAuthOptions, t as AuthClient, u as SessionCheckFailed } from "./auth-BMCJN30Y.cjs";
+export { AuthClient, AuthServer, AuthServerUnreachable, AuthSession, BetterAuth, BetterAuthConfig, BetterAuthOptions, BetterAuthOptionsContext, ExpoPluginRequired, SessionCheckFailed, deviceLink, idempotent, withTrustedClientIp };

package/dist/auth.d.mts

@@ -1,108 +1,2 @@
-import { Construct, Consumable } from "./construct-interface-g5GM5pwR.mjs";
-import { ConstructName, Declaration } from "@geekmidas/manifest";
-import { betterAuth } from "better-auth";
-import { Service, ServiceRegisterOptions } from "@geekmidas/services";
-import { Hono } from "hono";
-
-//#region src/auth.d.ts
-
-/** The server better-auth hands back. */
-type AuthServer = ReturnType<typeof betterAuth>;
-/** Everything better-auth takes, minus what the construct owns. */
-type BetterAuthOptions = Omit<Parameters<typeof betterAuth>[0], 'database' | 'secret' | 'basePath' | 'baseURL'>;
-interface BetterAuthConfig<TDatabase extends Consumable> {
-  /**
-   * The schema tenant its tables live in.
-   *
-   * A construct rather than a URL: the tenant already declares its schema and
-   * its role, and taking the declaration is what puts the edge in the graph
-   * instead of a connection string in two places.
-   */
-  database: TDatabase;
-  /**
-   * The app that serves this auth server, relative to the workspace root —
-   * `'apps/auth'`.
-   *
-   * Required, for the reason `RestApi.path` is. Not to be confused with
-   * `basePath`, which is where its routes are mounted in a URL.
-   */
-  path: string;
-  /**
-   * Where the auth routes are mounted, e.g. `/api/auth`.
-   *
-   * Structural — it is part of the URL every client calls, so it cannot differ
-   * between stages the way the host can.
-   */
-  basePath?: string;
-  /**
-   * The rest of better-auth's options: providers, plugins, email settings.
-   *
-   * A function when they need another construct — a magic-link plugin has to
-   * *send* the link, and the thing that sends mail is a construct whose client
-   * has to be registered. It is handed the same `ServiceRegisterOptions` this
-   * construct was, so the env parser flows through the graph rather than being
-   * imported out of application config.
-   */
-  options?: BetterAuthOptions | ((options: ServiceRegisterOptions) => BetterAuthOptions | Promise<BetterAuthOptions>);
-}
-declare class BetterAuth<TName extends string = string, TDatabase extends Consumable = Consumable> implements Construct<TName, AuthServer> {
-  private readonly config;
-  readonly id: TName;
-  readonly service: Service<Uncapitalize<TName>, AuthServer>;
-  readonly basePath: string;
-  /**
-   * Declared once and read by both `declare()` and `connect()`, so the keys the
-   * target publishes and the keys the server reads cannot drift.
-   */
-  private readonly keys;
-  constructor(id: ConstructName<TName>, config: BetterAuthConfig<TDatabase>);
-  /**
-   * A signing secret and a surface.
-   *
-   * The database is *not* declared here — the tenant that was passed in
-   * declares it, and declaring it twice is the duplication the whole model
-   * removes. What is declared is what this construct owns: the key it signs
-   * with, and the routes it answers on.
-   *
-   * One endpoint, wildcarded. Better Auth routes internally and the set of
-   * paths depends on which capabilities are enabled, so enumerating them here
-   * would be a copy of its router that goes stale on its next release. The
-   * surface's job is to send everything under `basePath` to one handler, which
-   * is exactly what the declaration says.
-   */
-  declare(): Declaration[];
-  /**
-   * Better Auth's own migrations, for the app's migrate step.
-   *
-   * It brings its own schema — users, sessions, accounts, verifications — so
-   * the app never writes those tables and never gets to drift from them.
-   */
-  migrations(options: ServiceRegisterOptions): Promise<() => Promise<void>>;
-  /**
-   * The server this surface runs as, built from its own declaration.
-   *
-   * A surface is a deploy unit, so something has to serve it, and the thing
-   * that knows how is the construct — not a generator writing a mount into
-   * somebody else's entry point. That is how the auth server came to be
-   * mounted by a hook in the application it was supposed to be separate from,
-   * and then to be served by nothing at all when the hook was deleted.
-   *
-   * The routes come from {@link declare}: one wildcard under `basePath`, read
-   * off the same declaration the manifest carries, so the surface the graph
-   * describes and the surface that answers requests cannot disagree.
-   *
-   * ```ts
-   * // .gkm/server/app.ts — the whole generated entry
-   * import { auth } from '@acme/constructs/auth.js';
-   * export const { app } = await auth.server({ envParser });
-   * ```
-   */
-  server(options: ServiceRegisterOptions): Promise<{
-    app: Hono;
-  }>;
-  private connect;
-}
-//# sourceMappingURL=auth.d.ts.map
-//#endregion
-export { AuthServer, BetterAuth, BetterAuthConfig, BetterAuthOptions };
-//# sourceMappingURL=auth.d.mts.map
+import { a as BetterAuth, c as BetterAuthOptionsContext, d as deviceLink, f as idempotent, i as AuthSession, l as ExpoPluginRequired, n as AuthServer, o as BetterAuthConfig, p as withTrustedClientIp, r as AuthServerUnreachable, s as BetterAuthOptions, t as AuthClient, u as SessionCheckFailed } from "./auth-CcuceLYo.mjs";
+export { AuthClient, AuthServer, AuthServerUnreachable, AuthSession, BetterAuth, BetterAuthConfig, BetterAuthOptions, BetterAuthOptionsContext, ExpoPluginRequired, SessionCheckFailed, deviceLink, idempotent, withTrustedClientIp };

package/dist/auth.mjs

@@ -1,11 +1,22 @@
-import { edgeTo } from "./construct-interface-Z4CpS8tK.mjs";
-import { canonicalId, environmentCase, provideKey, serviceKey } from "@geekmidas/manifest";
-import { betterAuth } from "better-auth";
-
+import { edgeTo } from "./construct-interface.mjs";
+import { t as injectTraceContext } from "./tracing-CxaZ98IB.mjs";
+import { CLIENT_IP_HEADER, canonicalId, environmentCase, isWebOrigin, provideKey, serviceKey } from "@geekmidas/manifest";
 //#region src/auth.ts
 const DEFAULT_BASE_PATH = "/api/auth";
 var BetterAuth = class {
+	config;
 	id;
+	/**
+	* What `.dependsOn([auth])` injects: an {@link AuthClient}, never the server.
+	*
+	* Which of the two a process holds is decided by how it reaches the
+	* construct, not by asking where it is running. The auth app's process is
+	* its generated entry, which calls {@link server} and nothing else — a
+	* self-serving surface has no endpoints of its own for a `dependsOn` to sit
+	* on. Every other process reaches it through this. So the API, a worker, a
+	* test's in-process endpoints all get the client, and none of them needs
+	* the signing secret, the auth tenant's URL or the mailer to start.
+	*/
 	service;
 	basePath;
 	/**
@@ -28,7 +39,7 @@ var BetterAuth = class {
 		};
 		this.service = {
 			serviceName: serviceKey(canonical),
-			register: (options) => this.connect(options)
+			register: (options) => this.client(options.envParser)
 		};
 	}
 	/**
@@ -54,6 +65,8 @@ var BetterAuth = class {
 			kind: "rest-api",
 			id: this.id,
 			path: this.config.path,
+			...this.config.subdomain ? { subdomain: this.config.subdomain } : {},
+			...this.config.telemetry ? { telemetry: this.config.telemetry.id } : {},
 			provides: [
 				this.keys.url,
 				this.keys.trustedOrigins,
@@ -64,22 +77,63 @@ var BetterAuth = class {
 				handler: `${this.id}.handler`,
 				method: "ANY",
 				path: `${this.basePath}/*`,
-				dependencies: [edgeTo(this.config.database)],
+				dependencies: [edgeTo(this.config.database), ...(this.config.dependsOn ?? []).map(edgeTo)],
 				requires: [this.keys.secret]
 			}]
 		}];
 	}
 	/**
-	* Better Auth's own migrations, for the app's migrate step.
+	* Whose request this is: the session for these headers, or `null`.
+	*
+	* Asked of the auth server over HTTP, at the URL the `.auth()` edge injects —
+	* so it is the same call whether the server runs in this process, beside
+	* it, or behind MSW in a test. The same call {@link AuthClient} makes.
+	*/
+	async verify(headers, envParser) {
+		return this.client(envParser).api.getSession({ headers });
+	}
+	/**
+	* The client a caller of this server holds: its URL and nothing else.
+	*
+	* `<ID>_URL` is the one key a consumer is given for an edge to a surface —
+	* the compose network's address between containers, the public one where
+	* that is all there is — so this is everything it can know.
+	*/
+	client(envParser) {
+		const { url } = envParser.create((get) => ({ url: get(this.keys.url).string() })).parse();
+		const endpoint = `${url.replace(/\/$/, "")}${this.basePath}`;
+		return { api: { getSession: ({ headers }) => fetchSession(this.id, endpoint, new Headers(headers)) } };
+	}
+	/**
+	* The tenant this server keeps its tables in — whose migrations folder,
+	* `db/<tenant>/`, Better Auth's schema is written into.
+	*/
+	get databaseId() {
+		return this.config.database.id;
+	}
+	/**
+	* The SQL that brings the tenant up to Better Auth's schema, or `undefined`
+	* when it already matches.
+	*
+	* What `gkm migration` writes as the tenant's next migration, so Better
+	* Auth's tables are committed, reviewed and applied like any other — rather
+	* than diffed against the database at runtime, where a change nobody wrote
+	* down happens on whichever machine migrates first.
 	*
-	* It brings its own schema — users, sessions, accounts, verifications — so
-	* the app never writes those tables and never gets to drift from them.
+	* Compared as the owner, against the tenant `gkm migrate` has already brought
+	* up to date: what comes back is only what the committed files are missing.
 	*/
-	async migrations(options) {
-		const auth = await this.connect(options, { owner: true });
-		const { getMigrations } = await import("better-auth/db/migration");
-		const { runMigrations } = await getMigrations(auth.options);
-		return runMigrations;
+	async pendingMigration(options) {
+		const resolved = await this.optionsFor(options, { owner: true });
+		const db = resolved.database.db;
+		try {
+			const { getMigrations } = await import("better-auth/db/migration");
+			const { toBeCreated, toBeAdded, toBeAddedIndexes, compileMigrations } = await getMigrations(resolved);
+			if (toBeCreated.length === 0 && toBeAdded.length === 0 && toBeAddedIndexes.length === 0) return;
+			return idempotent(await compileMigrations());
+		} finally {
+			await db.destroy();
+		}
 	}
 	/**
 	* The server this surface runs as, built from its own declaration.
@@ -99,6 +153,11 @@ var BetterAuth = class {
 	* import { auth } from '@acme/constructs/auth.js';
 	* export const { app } = await auth.server({ envParser });
 	* ```
+	*
+	* The only way to the server: it is what reads the signing secret, opens
+	* the tenant and builds the mailer, so it is built here, in the auth app's
+	* own process, and `.dependsOn([auth])` everywhere else gets
+	* {@link AuthClient}. `auth` is the better-auth instance behind the app.
 	*/
 	async server(options) {
 		const { Hono } = await import("hono");
@@ -121,23 +180,60 @@ var BetterAuth = class {
 				"DELETE",
 				"OPTIONS"
 			] : [endpoint.method];
-			app.on([...methods], endpoint.path, (c) => server.handler(c.req.raw));
+			app.on([...methods], endpoint.path, (c) => server.handler(withTrustedClientIp(c.req.raw, remoteAddressOf(c))));
 		}
-		return { app };
+		return {
+			app,
+			auth: server
+		};
+	}
+	/**
+	* The ids of the better-auth plugins this server runs — what a client has
+	* to pair its own plugins with (`magic-link` with `magicLinkClient`).
+	* Resolved the way the server resolves them, options callback included.
+	*/
+	async pluginIds(options) {
+		const { plugins = [] } = await this.configured(options);
+		return plugins.map(({ id }) => id);
+	}
+	/** Better-auth's options as given — a value, or a callback of the environment. */
+	async configured(options) {
+		const configure = this.config.options;
+		if (typeof configure !== "function") return configure ?? {};
+		const services = {};
+		for (const construct of this.config.dependsOn ?? []) services[construct.service.serviceName] = await construct.service.register(options);
+		return configure({
+			...options,
+			services
+		});
 	}
 	async connect(options, as = {}) {
-		const { secret, baseUrl, trustedOrigins, cookieDomain } = options.envParser.create((get) => ({
+		const { betterAuth } = await import("better-auth");
+		return betterAuth(await this.optionsFor(options, as));
+	}
+	/**
+	* Everything better-auth is given: the app's options, and what the construct
+	* owns — its secret, its URL, its tenant's connection, the origins and cookie
+	* domain its graph derives. One place, so the server and its migrations are
+	* built from the same options.
+	*/
+	async optionsFor(options, as = {}) {
+		const { secret, baseUrl, trustedOrigins, cookieDomain, deviceUrl } = options.envParser.create((get) => ({
 			secret: get(this.keys.secret).string(),
 			baseUrl: get(this.keys.url).string(),
 			trustedOrigins: get(this.keys.trustedOrigins).string().default("").transform((value) => value.split(",").map((origin) => origin.trim()).filter(Boolean)),
-			cookieDomain: get(this.keys.cookieDomain).string().optional()
+			cookieDomain: get(this.keys.cookieDomain).string().optional(),
+			deviceUrl: get(provideKey(this.id, "deviceUrl")).string().optional()
 		})).parse();
 		const tenant = this.config.database;
-		const source = as.owner && tenant.owner ? tenant.owner : tenant.service;
-		const db = await source.register(options);
-		const configure = this.config.options;
-		const configured = typeof configure === "function" ? await configure(options) : configure ?? {};
-		return betterAuth({
+		const db = await (as.owner && tenant.owner ? tenant.owner : tenant.service).register(options);
+		const configured = await this.configured(options);
+		const origins = [...trustedOrigins, ...configured.trustedOrigins && Array.isArray(configured.trustedOrigins) ? configured.trustedOrigins : []];
+		const plugins = [...configured.plugins ?? []];
+		const mobile = trustedOrigins.filter((origin) => !isWebOrigin(origin));
+		if (mobile.length > 0 && !plugins.some((plugin) => plugin.id === "expo")) throw new ExpoPluginRequired(this.id, mobile);
+		if (deviceUrl) for (const plugin of plugins) reachableFromDevice(plugin, deviceUrl);
+		return {
 			...configured,
 			secret,
 			baseURL: baseUrl,
@@ -146,19 +242,185 @@ var BetterAuth = class {
 				db,
 				type: "postgres"
 			},
-			trustedOrigins: [...trustedOrigins, ...configured.trustedOrigins && Array.isArray(configured.trustedOrigins) ? configured.trustedOrigins : []],
+			plugins,
+			trustedOrigins: origins,
 			advanced: {
 				...configured.advanced,
+				ipAddress: {
+					...configured.advanced?.ipAddress,
+					ipAddressHeaders: [CLIENT_IP_HEADER, ...(configured.advanced?.ipAddress?.ipAddressHeaders ?? ["x-forwarded-for"]).filter((name) => name.toLowerCase() !== CLIENT_IP_HEADER)]
+				},
 				...cookieDomain ? { crossSubDomainCookies: {
 					enabled: true,
 					domain: cookieDomain,
 					...configured.advanced?.crossSubDomainCookies
 				} } : {}
 			}
-		});
+		};
 	}
 };
-
+/** Links already rewritten — an `options` object is reused across builds. */
+const rewritten = /* @__PURE__ */ new WeakSet();
+/**
+* Build the magic links an app asked for on the address a phone reaches.
+*
+* An app's link carries its scheme as the `callbackURL` (`shop://…`)
+* where a browser's carries a path or an `http(s)` URL — which is how the two
+* are told apart. A browser's link is left alone: it is opened on this
+* machine, where the server's own hostname resolves.
+*
+* Better Auth's magic-link plugin calls `sendMagicLink` through the options
+* object it returns, so wrapping it there is wrapping the call.
+*/
+function reachableFromDevice(plugin, deviceUrl) {
+	if (plugin.id !== "magic-link") return;
+	const options = plugin.options;
+	if (!options?.sendMagicLink || rewritten.has(options)) return;
+	rewritten.add(options);
+	const send = options.sendMagicLink;
+	options.sendMagicLink = (data, ...rest) => send({
+		...data,
+		url: deviceLink(data.url, deviceUrl)
+	}, ...rest);
+}
+/** A magic link moved to the device address when an app is its destination. */
+function deviceLink(url, deviceUrl) {
+	try {
+		const link = new URL(url);
+		const callback = link.searchParams.get("callbackURL") ?? "/";
+		if (callback.startsWith("/") || isWebOrigin(callback)) return url;
+		return new URL(`${link.pathname}${link.search}`, deviceUrl).toString();
+	} catch {
+		return url;
+	}
+}
+/** A mobile app depends on this auth server, which has no Expo plugin. */
+var ExpoPluginRequired = class extends Error {
+	server;
+	origins;
+	constructor(server, origins) {
+		super(`'${server}' is called by a mobile app (${origins[0]}), and a mobile app signs in through Better Auth's Expo plugin: add expo() from '@better-auth/expo' to this auth server's plugins.`);
+		this.server = server;
+		this.origins = origins;
+		this.name = "ExpoPluginRequired";
+	}
+};
+/** What is forwarded to the auth server: the headers a session travels in. */
+const SESSION_HEADERS = ["cookie", "authorization"];
+/**
+* `GET <basePath>/get-session`, read the way Better Auth answers it.
+*
+* Whose request it is travels in {@link CLIENT_IP_HEADER} — the server
+* rate-limits `/get-session` by the client's address, so without it every
+* caller shares the API's one bucket — and never as `X-Forwarded-For`. A
+* forwarding header is what marks a request as outside traffic, so the auth
+* server would start its span in a trace of its own rather than continue the
+* API's. Without one, this is an internal caller's request, and the trace
+* context it carries is continued.
+*/
+async function fetchSession(authenticator, endpoint, given) {
+	const headers = new Headers();
+	for (const name of SESSION_HEADERS) {
+		const value = given.get(name);
+		if (value) headers.set(name, value);
+	}
+	const client = given.get("x-forwarded-for");
+	if (client) headers.set(CLIENT_IP_HEADER, client);
+	injectTraceContext(headers);
+	const url = `${endpoint}/get-session`;
+	let response;
+	try {
+		response = await fetch(url, { headers });
+	} catch (cause) {
+		throw new AuthServerUnreachable(authenticator, url, cause);
+	}
+	if (response.status === 401) return null;
+	if (!response.ok) throw new SessionCheckFailed(authenticator, response.status);
+	return await response.json();
+}
+/** The auth server answered a session check with a failure. */
+var SessionCheckFailed = class extends Error {
+	authenticator;
+	status;
+	constructor(authenticator, status) {
+		super(`'${authenticator}' answered a session check with ${status}. A request with no session gets 200 and null, or 401; this is the server failing — check its logs, and that it is running at its URL.`);
+		this.authenticator = authenticator;
+		this.status = status;
+		this.name = "SessionCheckFailed";
+	}
+};
+/** A session check never reached the auth server. */
+var AuthServerUnreachable = class extends Error {
+	authenticator;
+	url;
+	constructor(authenticator, url, cause) {
+		super(`'${authenticator}' could not be reached at ${url} to check a session. Check that the auth app is running and that this app's ${provideKey(authenticator, "url")} points at it.`, { cause });
+		this.authenticator = authenticator;
+		this.url = url;
+		this.name = "AuthServerUnreachable";
+	}
+};
+/**
+* Better Auth's DDL, safe to run where its tables already exist.
+*
+* Its SQL is Kysely's, so its shape is known: `create table "…"`, `create index
+* "…"`, `alter table "…" add column "…"`. A database that has been running
+* already has those — Better Auth used to create them at runtime — and the
+* first committed migration would fail on them rather than recording that they
+* are there.
+*/
+function idempotent(statements) {
+	return statements.replace(/\bcreate table "/gi, "create table if not exists \"").replace(/\bcreate (unique )?index "/gi, (_, unique = "") => `create ${unique}index if not exists "`).replace(/\badd column "/gi, "add column if not exists \"");
+}
+/** Headers a reverse proxy or CDN adds on the way in. */
+const FORWARDING_HEADERS = [
+	"forwarded",
+	"x-forwarded-for",
+	"x-forwarded-host",
+	"x-real-ip",
+	"cf-connecting-ip",
+	"true-client-ip",
+	"fastly-client-ip",
+	"x-client-ip"
+];
+/**
+* `request`, without {@link CLIENT_IP_HEADER} unless an internal caller sent
+* it — no `Origin`, no forwarding header, a loopback or private peer: the
+* rule a request's span continues a trace by (`@geekmidas/telescope`'s
+* `isInternalCaller`).
+*
+* The stack's own edges strip the header already. This holds wherever one
+* does not — a platform's proxy, a port published straight to the internet —
+* so a stranger cannot pick the address Better Auth rate-limits them by.
+*/
+function withTrustedClientIp(request, remoteAddress) {
+	if (!request.headers.has(CLIENT_IP_HEADER)) return request;
+	if (!request.headers.has("origin") && !FORWARDING_HEADERS.some((name) => request.headers.has(name)) && isPrivateAddress(remoteAddress)) return request;
+	const headers = new Headers(request.headers);
+	headers.delete(CLIENT_IP_HEADER);
+	return new Request(request, { headers });
+}
+/** The TCP peer of a request served by `@hono/node-server`, when there is one. */
+function remoteAddressOf(c) {
+	return c.env?.incoming?.socket?.remoteAddress;
+}
+/**
+* Whether `address` is loopback or private: 127/8, 10/8, 172.16/12,
+* 192.168/16, 169.254/16, `::1`, `fc00::/7`, `fe80::/10`, and an IPv4 one
+* mapped into IPv6.
+*/
+function isPrivateAddress(address) {
+	if (!address) return false;
+	const ip = address.toLowerCase().replace(/^::ffff:/, "");
+	const v4 = ip.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+	if (v4) {
+		const [a, b] = [Number(v4[1]), Number(v4[2])];
+		return a === 127 || a === 10 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 169 && b === 254;
+	}
+	if (ip === "::1") return true;
+	return /^f[cd][0-9a-f]{2}:/.test(ip) || /^fe[89ab][0-9a-f]:/.test(ip);
+}
 //#endregion
-export { BetterAuth };
+export { AuthServerUnreachable, BetterAuth, ExpoPluginRequired, SessionCheckFailed, deviceLink, idempotent, withTrustedClientIp };
+
 //# sourceMappingURL=auth.mjs.map