@nestjs-kit/better-auth 0.0.0-stage → 2.0.0

package/dist/express.cjs

@@ -0,0 +1,256 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_auth_errors = require("./auth-errors-DmiKl0L_.cjs");
+const require_platform = require("./platform-YICqqYv6.cjs");
+let node_http = require("node:http");
+let node_stream = require("node:stream");
+let path_to_regexp = require("path-to-regexp");
+//#region src/express-platform.ts
+const RAW_BODY = Symbol.for("@nestjs-kit/better-auth:raw-body");
+function application(adapter) {
+	return adapter.getInstance();
+}
+function routerOptions(app) {
+	const router = app?.router;
+	if (typeof router !== "object" && typeof router !== "function" || router === null) throw new require_auth_errors.BetterAuthConfigurationError("UNSUPPORTED_EXPRESS_ROUTER", "The Express application does not expose its initialized router.", "Use Express 5.2.x with @nestjs/platform-express 12.x, or move controller routes outside the auth mount.");
+	const options = router;
+	if (typeof options.caseSensitive !== "boolean" || typeof options.strict !== "boolean") throw new require_auth_errors.BetterAuthConfigurationError("UNSUPPORTED_EXPRESS_ROUTER", "The initialized Express router does not expose compatible routing options.", "Use Express 5.2.x with @nestjs/platform-express 12.x, or move controller routes outside the auth mount.");
+	return {
+		caseSensitive: options.caseSensitive,
+		strict: options.strict
+	};
+}
+function routeMayOverlapMount(path, basePath) {
+	const { tokens } = (0, path_to_regexp.parse)(path);
+	let literalPrefix = "";
+	let dynamic = false;
+	for (const token of tokens) {
+		if (token.type !== "text") {
+			dynamic = true;
+			break;
+		}
+		literalPrefix += token.value;
+	}
+	const route = literalPrefix.toLowerCase();
+	const base = basePath.toLowerCase().replace(/(?<!\/)\/+$/, "") || "/";
+	if (base === "/") return route.startsWith("/");
+	if (!dynamic) {
+		const exact = route.replace(/(?<!\/)\/+$/, "") || "/";
+		return exact === base || exact.startsWith(`${base}/`);
+	}
+	if (base.startsWith(route)) return true;
+	return route === base || route.startsWith(`${base}/`);
+}
+function rawTarget(req) {
+	return req.originalUrl ?? req.url ?? "/";
+}
+function rawPath(req) {
+	const target = rawTarget(req);
+	const query = target.indexOf("?");
+	return query === -1 ? target : target.slice(0, query);
+}
+function declaredLength(headers, limit) {
+	const value = headers["content-length"];
+	const first = Array.isArray(value) ? value[0] : value;
+	if (typeof first !== "string" || !/^\d+$/.test(first)) return;
+	const parsed = Number(first);
+	return Number.isSafeInteger(parsed) ? parsed : limit + 1;
+}
+function requestUrl(req) {
+	const socket = req.socket;
+	return `${req.protocol ?? (socket.encrypted ? "https" : "http")}://${req.host ?? ""}${rawTarget(req)}`;
+}
+/**
+* Identifies Express's request by the Node objects it extends, never by shape: a GraphQL
+* context can carry client-parsed data, and JSON can reproduce any structural check.
+* light-my-request's inject() re-parents Express's shared request prototype onto its own
+* Readable-based request for the whole process, so a stream request is accepted too; its
+* response must still be a ServerResponse bound to it in both directions.
+*/
+function isExpressRequest(value) {
+	if (!(value instanceof node_http.IncomingMessage || value instanceof node_stream.Readable)) return false;
+	const res = Reflect.get(value, "res");
+	return res instanceof node_http.ServerResponse && res.req === value && Reflect.get(value, "res") === res && typeof res.setHeader === "function" && typeof res.getHeader === "function";
+}
+function nativeResponse(value) {
+	if (typeof value !== "object" || value === null) return null;
+	const response = value;
+	return typeof response.setHeader === "function" && typeof response.getHeader === "function" ? value : null;
+}
+function proxyTrustOf(value) {
+	if (value === false || value === void 0) return {
+		mode: "none",
+		detail: "trust proxy = false"
+	};
+	if (value === true) return {
+		mode: "all",
+		detail: "trust proxy = true"
+	};
+	return {
+		mode: "partial",
+		detail: `trust proxy = ${typeof value === "function" ? "<function>" : Array.isArray(value) ? JSON.stringify(value) : String(value)}`
+	};
+}
+function abortOnDisconnect(req, res) {
+	const controller = new AbortController();
+	const abort = () => controller.abort();
+	req.once("aborted", abort);
+	res.once("close", abort);
+	if (req.aborted || res.destroyed) abort();
+	return {
+		signal: controller.signal,
+		dispose: () => {
+			req.removeListener("aborted", abort);
+			res.removeListener("close", abort);
+		}
+	};
+}
+/** Express-specific two-phase HTTP integration. */
+var ExpressPlatform = class {
+	options;
+	id = "express";
+	#warnedConsumedBody = false;
+	#applicationRoutes = [];
+	#application;
+	constructor(options = {}) {
+		this.options = options;
+	}
+	requests = {
+		isRequest: (value) => isExpressRequest(value),
+		isLive: (value) => isExpressRequest(value) && value.res?.writableEnded === false,
+		key: (value) => value,
+		headers: (value) => require_platform.toWebHeaders(value.headers),
+		request: (value) => {
+			const req = value;
+			return {
+				method: req.method ?? "GET",
+				url: requestUrl(req)
+			};
+		},
+		clientIp: (value) => this.clientIp(value),
+		param: (value, name) => {
+			const parameter = value.params?.[name];
+			return typeof parameter === "string" ? parameter : void 0;
+		},
+		cookieSink: (request, response) => {
+			const req = request;
+			const res = nativeResponse(response) ?? nativeResponse(req.res);
+			return res === null ? null : { append: (cookies) => require_platform.appendSetCookie(res, cookies) };
+		}
+	};
+	supports(adapter) {
+		return adapter.getType?.() === "express";
+	}
+	prepare(ctx) {
+		const app = application(ctx.adapter);
+		this.#application = app;
+		app.use((req, _res, next) => {
+			const binding = ctx.route(rawPath(req));
+			const method = (req.method ?? "GET").toUpperCase();
+			if (!binding || this.isApplicationRoute(method, rawPath(req)) || method === "GET" || method === "HEAD" || method === "OPTIONS" || !require_platform.mayHaveBody(method, req.headers)) {
+				next();
+				return;
+			}
+			const continueRequest = require_platform.bindAsyncContext(next);
+			if (req.readableEnded || req.readable === false) {
+				const recovered = require_platform.recoverConsumedBody(req);
+				req[RAW_BODY] = {
+					ok: true,
+					bytes: recovered ?? /* @__PURE__ */ new Uint8Array()
+				};
+				if (!this.#warnedConsumedBody) {
+					this.#warnedConsumedBody = true;
+					ctx.logger.warn("W_BODY_ALREADY_CONSUMED: an Express body parser ran before the auth capture; raw-signature webhooks may receive re-serialized bytes.");
+				}
+				continueRequest();
+				return;
+			}
+			require_platform.readBoundedBody(req, {
+				limit: binding.bodyLimit,
+				declaredLength: declaredLength(req.headers, binding.bodyLimit),
+				drainOnOverflow: true,
+				drainCap: Math.min(Number.MAX_SAFE_INTEGER, binding.bodyLimit * 8)
+			}).then((captured) => {
+				req[RAW_BODY] = captured;
+				continueRequest();
+			}, (error) => continueRequest(error));
+		});
+	}
+	applicationRoutes(routes, bindings) {
+		const bodyRoutes = routes.flatMap((route) => {
+			if ([
+				"GET",
+				"HEAD",
+				"OPTIONS"
+			].includes(route.method)) return [];
+			const paths = route.paths.filter((path) => bindings.some((binding) => routeMayOverlapMount(path, binding.basePath)));
+			return paths.length ? [{
+				...route,
+				paths
+			}] : [];
+		});
+		const conditional = bodyRoutes.find((route) => route.conditions.length > 0);
+		if (conditional) throw new require_auth_errors.BetterAuthConfigurationError("CONDITIONAL_ROUTE_SHADOW", `${conditional.source} at '${conditional.paths.join(", ")}' uses ${conditional.conditions.join(" and ")} routing under an auth mount.`, "Move the controller route outside the auth mount or make its host and version routing unconditional.");
+		if (bodyRoutes.length === 0) {
+			this.#applicationRoutes = [];
+			return;
+		}
+		const { caseSensitive, strict } = routerOptions(this.#application);
+		this.#applicationRoutes = Object.freeze(bodyRoutes.flatMap((route) => route.paths.map((path) => ({
+			method: route.method,
+			regexp: (0, path_to_regexp.pathToRegexp)(path, {
+				end: true,
+				sensitive: caseSensitive,
+				trailing: !strict
+			}).regexp
+		}))));
+	}
+	mount(ctx) {
+		application(ctx.adapter).use((req, res, next) => {
+			if (!ctx.binding.matches(rawPath(req))) {
+				next();
+				return;
+			}
+			const disconnect = abortOnDisconnect(req, res);
+			this.dispatch(ctx.binding, req, res, disconnect.signal).then(() => disconnect.dispose(), (error) => {
+				disconnect.dispose();
+				if (!disconnect.signal.aborted) next(error);
+			});
+		});
+	}
+	proxyTrust(adapter) {
+		return proxyTrustOf(application(adapter).get("trust proxy"));
+	}
+	clientIp(req) {
+		if (this.options.clientIp) return this.options.clientIp(req);
+		return req.ip ?? null;
+	}
+	isApplicationRoute(method, pathname) {
+		return this.#applicationRoutes.some((route) => (route.method === "ALL" || route.method === method) && route.regexp.test(pathname));
+	}
+	async dispatch(binding, req, res, signal) {
+		const captured = req[RAW_BODY];
+		if (captured && !captured.ok && captured.reason === "aborted" || signal.aborted) return;
+		const response = captured && !captured.ok && captured.reason === "too-large" ? binding.payloadTooLarge() : await binding.handle({
+			method: req.method ?? "GET",
+			url: requestUrl(req),
+			headers: require_platform.toWebHeaders(req.headers),
+			body: captured?.ok ? captured.bytes : null,
+			clientIp: this.clientIp(req),
+			platformRequest: req,
+			signal
+		});
+		if (signal.aborted) {
+			await response.body?.cancel().catch(() => void 0);
+			return;
+		}
+		await require_platform.writeWebResponse(res, response, { head: req.method?.toUpperCase() === "HEAD" });
+	}
+};
+function expressPlatform(options) {
+	return new ExpressPlatform(options);
+}
+//#endregion
+exports.ExpressPlatform = ExpressPlatform;
+exports.expressPlatform = expressPlatform;
+
+//# sourceMappingURL=express.cjs.map

package/dist/express.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"express.cjs","names":["BetterAuthConfigurationError","parse","IncomingMessage","Readable","ServerResponse","toWebHeaders","appendSetCookie","mayHaveBody","bindAsyncContext","recoverConsumedBody","readBoundedBody","pathToRegexp","writeWebResponse"],"sources":["../src/express-platform.ts"],"sourcesContent":["import {\n  type IncomingHttpHeaders,\n  IncomingMessage,\n  ServerResponse,\n} from \"node:http\";\nimport { Readable } from \"node:stream\";\nimport type { AbstractHttpAdapter } from \"@nestjs/core\";\nimport { parse, pathToRegexp } from \"path-to-regexp\";\nimport type {\n  ApplicationRouteDescriptor,\n  AuthRouteBinding,\n  ExpressPlatformOptions,\n  HttpPlatform,\n  PlatformMountContext,\n  PlatformPrepareContext,\n  ProxyTrust,\n} from \"./auth-contracts.js\";\nimport { BetterAuthConfigurationError } from \"./auth-errors.js\";\nimport {\n  appendSetCookie,\n  bindAsyncContext,\n  mayHaveBody,\n  readBoundedBody,\n  recoverConsumedBody,\n  toWebHeaders,\n  writeWebResponse,\n} from \"./platform.js\";\n\nconst RAW_BODY = Symbol.for(\"@nestjs-kit/better-auth:raw-body\");\n\ntype Next = (error?: unknown) => void;\ntype CapturedBody = Awaited<ReturnType<typeof readBoundedBody>>;\ntype ExpressResponse = ServerResponse & { req?: ExpressRequest };\ntype ExpressRequest = IncomingMessage & {\n  readonly originalUrl?: string;\n  readonly protocol?: string;\n  readonly host?: string;\n  readonly ip?: string;\n  readonly res?: ExpressResponse;\n  readonly params?: Record<string, unknown>;\n  readonly body?: unknown;\n  readonly rawBody?: Buffer;\n  [RAW_BODY]?: CapturedBody;\n};\ntype ExpressApplication = {\n  use(\n    handler: (req: ExpressRequest, res: ExpressResponse, next: Next) => void,\n  ): unknown;\n  get(setting: string): unknown;\n  readonly router?: unknown;\n};\ntype ExpressRouterOptions = {\n  readonly caseSensitive: boolean;\n  readonly strict: boolean;\n};\ntype ApplicationRouteMatcher = {\n  readonly method: string;\n  readonly regexp: RegExp;\n};\n\nfunction application(adapter: AbstractHttpAdapter): ExpressApplication {\n  return adapter.getInstance() as ExpressApplication;\n}\n\nfunction routerOptions(\n  app: ExpressApplication | undefined,\n): ExpressRouterOptions {\n  const router = app?.router;\n  if (\n    (typeof router !== \"object\" && typeof router !== \"function\") ||\n    router === null\n  ) {\n    throw new BetterAuthConfigurationError(\n      \"UNSUPPORTED_EXPRESS_ROUTER\",\n      \"The Express application does not expose its initialized router.\",\n      \"Use Express 5.2.x with @nestjs/platform-express 12.x, or move controller routes outside the auth mount.\",\n    );\n  }\n  const options = router as Partial<ExpressRouterOptions>;\n  if (\n    typeof options.caseSensitive !== \"boolean\" ||\n    typeof options.strict !== \"boolean\"\n  ) {\n    throw new BetterAuthConfigurationError(\n      \"UNSUPPORTED_EXPRESS_ROUTER\",\n      \"The initialized Express router does not expose compatible routing options.\",\n      \"Use Express 5.2.x with @nestjs/platform-express 12.x, or move controller routes outside the auth mount.\",\n    );\n  }\n  return { caseSensitive: options.caseSensitive, strict: options.strict };\n}\n\nfunction routeMayOverlapMount(path: string, basePath: string): boolean {\n  const { tokens } = parse(path);\n  let literalPrefix = \"\";\n  let dynamic = false;\n  for (const token of tokens) {\n    if (token.type !== \"text\") {\n      dynamic = true;\n      break;\n    }\n    literalPrefix += token.value;\n  }\n  const route = literalPrefix.toLowerCase();\n  const base = basePath.toLowerCase().replace(/(?<!\\/)\\/+$/, \"\") || \"/\";\n  if (base === \"/\") {\n    return route.startsWith(\"/\");\n  }\n  if (!dynamic) {\n    const exact = route.replace(/(?<!\\/)\\/+$/, \"\") || \"/\";\n    return exact === base || exact.startsWith(`${base}/`);\n  }\n  if (base.startsWith(route)) {\n    return true;\n  }\n  return route === base || route.startsWith(`${base}/`);\n}\n\nfunction rawTarget(req: ExpressRequest): string {\n  return req.originalUrl ?? req.url ?? \"/\";\n}\n\nfunction rawPath(req: ExpressRequest): string {\n  const target = rawTarget(req);\n  const query = target.indexOf(\"?\");\n  return query === -1 ? target : target.slice(0, query);\n}\n\nfunction declaredLength(\n  headers: IncomingHttpHeaders,\n  limit: number,\n): number | undefined {\n  const value = headers[\"content-length\"];\n  const first = Array.isArray(value) ? value[0] : value;\n  if (typeof first !== \"string\" || !/^\\d+$/.test(first)) {\n    return undefined;\n  }\n  const parsed = Number(first);\n  return Number.isSafeInteger(parsed) ? parsed : limit + 1;\n}\n\nfunction requestUrl(req: ExpressRequest): string {\n  const socket = req.socket as typeof req.socket & { encrypted?: boolean };\n  return `${req.protocol ?? (socket.encrypted ? \"https\" : \"http\")}://${req.host ?? \"\"}${rawTarget(req)}`;\n}\n\n/**\n * Identifies Express's request by the Node objects it extends, never by shape: a GraphQL\n * context can carry client-parsed data, and JSON can reproduce any structural check.\n * light-my-request's inject() re-parents Express's shared request prototype onto its own\n * Readable-based request for the whole process, so a stream request is accepted too; its\n * response must still be a ServerResponse bound to it in both directions.\n */\nfunction isExpressRequest(value: unknown): value is ExpressRequest {\n  if (!(value instanceof IncomingMessage || value instanceof Readable)) {\n    return false;\n  }\n  const res: unknown = Reflect.get(value, \"res\");\n  return (\n    res instanceof ServerResponse &&\n    res.req === value &&\n    Reflect.get(value, \"res\") === res &&\n    typeof res.setHeader === \"function\" &&\n    typeof res.getHeader === \"function\"\n  );\n}\n\nfunction nativeResponse(value: unknown): ServerResponse | null {\n  if (typeof value !== \"object\" || value === null) {\n    return null;\n  }\n  const response = value as Partial<ServerResponse>;\n  return typeof response.setHeader === \"function\" &&\n    typeof response.getHeader === \"function\"\n    ? (value as ServerResponse)\n    : null;\n}\n\nfunction proxyTrustOf(value: unknown): ProxyTrust {\n  if (value === false || value === undefined) {\n    return { mode: \"none\", detail: \"trust proxy = false\" };\n  }\n  if (value === true) {\n    return { mode: \"all\", detail: \"trust proxy = true\" };\n  }\n  const rendered =\n    typeof value === \"function\"\n      ? \"<function>\"\n      : Array.isArray(value)\n        ? JSON.stringify(value)\n        : String(value);\n  return { mode: \"partial\", detail: `trust proxy = ${rendered}` };\n}\n\nfunction abortOnDisconnect(\n  req: ExpressRequest,\n  res: ExpressResponse,\n): { signal: AbortSignal; dispose(): void } {\n  const controller = new AbortController();\n  const abort = () => controller.abort();\n  req.once(\"aborted\", abort);\n  res.once(\"close\", abort);\n  if (req.aborted || res.destroyed) {\n    abort();\n  }\n  return {\n    signal: controller.signal,\n    dispose: () => {\n      req.removeListener(\"aborted\", abort);\n      res.removeListener(\"close\", abort);\n    },\n  };\n}\n\n/** Express-specific two-phase HTTP integration. */\nexport class ExpressPlatform implements HttpPlatform {\n  readonly id = \"express\";\n  #warnedConsumedBody = false;\n  #applicationRoutes: readonly ApplicationRouteMatcher[] = [];\n  #application: ExpressApplication | undefined;\n\n  constructor(private readonly options: ExpressPlatformOptions = {}) {}\n\n  readonly requests = {\n    isRequest: (value: unknown): boolean => isExpressRequest(value),\n    isLive: (value: unknown): boolean =>\n      isExpressRequest(value) && value.res?.writableEnded === false,\n    key: (value: unknown): object => value as object,\n    headers: (value: unknown): Headers =>\n      toWebHeaders((value as ExpressRequest).headers),\n    request: (value: unknown) => {\n      const req = value as ExpressRequest;\n      return { method: req.method ?? \"GET\", url: requestUrl(req) };\n    },\n    clientIp: (value: unknown): string | null =>\n      this.clientIp(value as ExpressRequest),\n    param: (value: unknown, name: string): string | undefined => {\n      const parameter = (value as ExpressRequest).params?.[name];\n      return typeof parameter === \"string\" ? parameter : undefined;\n    },\n    cookieSink: (request: unknown, response: unknown) => {\n      const req = request as ExpressRequest;\n      const res = nativeResponse(response) ?? nativeResponse(req.res);\n      return res === null\n        ? null\n        : {\n            append: (cookies: readonly string[]) =>\n              appendSetCookie(res, cookies),\n          };\n    },\n  };\n\n  supports(adapter: AbstractHttpAdapter): boolean {\n    return adapter.getType?.() === \"express\";\n  }\n\n  prepare(ctx: PlatformPrepareContext): void {\n    const app = application(ctx.adapter);\n    this.#application = app;\n    app.use((req, _res, next) => {\n      const binding = ctx.route(rawPath(req));\n      const method = (req.method ?? \"GET\").toUpperCase();\n      if (\n        !binding ||\n        this.isApplicationRoute(method, rawPath(req)) ||\n        method === \"GET\" ||\n        method === \"HEAD\" ||\n        method === \"OPTIONS\" ||\n        !mayHaveBody(method, req.headers)\n      ) {\n        next();\n        return;\n      }\n\n      const continueRequest = bindAsyncContext(next);\n      if (req.readableEnded || req.readable === false) {\n        const recovered = recoverConsumedBody(req);\n        req[RAW_BODY] = {\n          ok: true,\n          bytes: recovered ?? new Uint8Array(),\n        };\n        if (!this.#warnedConsumedBody) {\n          this.#warnedConsumedBody = true;\n          ctx.logger.warn(\n            \"W_BODY_ALREADY_CONSUMED: an Express body parser ran before the auth capture; raw-signature webhooks may receive re-serialized bytes.\",\n          );\n        }\n        continueRequest();\n        return;\n      }\n\n      void readBoundedBody(req, {\n        limit: binding.bodyLimit,\n        declaredLength: declaredLength(req.headers, binding.bodyLimit),\n        drainOnOverflow: true,\n        drainCap: Math.min(Number.MAX_SAFE_INTEGER, binding.bodyLimit * 8),\n      }).then(\n        (captured) => {\n          req[RAW_BODY] = captured;\n          continueRequest();\n        },\n        (error: unknown) => continueRequest(error),\n      );\n    });\n  }\n\n  applicationRoutes(\n    routes: readonly ApplicationRouteDescriptor[],\n    bindings: readonly AuthRouteBinding[],\n  ): void {\n    const bodyRoutes = routes.flatMap((route) => {\n      if ([\"GET\", \"HEAD\", \"OPTIONS\"].includes(route.method)) {\n        return [];\n      }\n      const paths = route.paths.filter((path) =>\n        bindings.some((binding) =>\n          routeMayOverlapMount(path, binding.basePath),\n        ),\n      );\n      return paths.length ? [{ ...route, paths }] : [];\n    });\n    const conditional = bodyRoutes.find((route) => route.conditions.length > 0);\n    if (conditional) {\n      throw new BetterAuthConfigurationError(\n        \"CONDITIONAL_ROUTE_SHADOW\",\n        `${conditional.source} at '${conditional.paths.join(\", \")}' uses ${conditional.conditions.join(\" and \")} routing under an auth mount.`,\n        \"Move the controller route outside the auth mount or make its host and version routing unconditional.\",\n      );\n    }\n    if (bodyRoutes.length === 0) {\n      this.#applicationRoutes = [];\n      return;\n    }\n    const { caseSensitive, strict } = routerOptions(this.#application);\n    this.#applicationRoutes = Object.freeze(\n      bodyRoutes.flatMap((route) =>\n        route.paths.map((path) => ({\n          method: route.method,\n          regexp: pathToRegexp(path, {\n            end: true,\n            sensitive: caseSensitive,\n            trailing: !strict,\n          }).regexp,\n        })),\n      ),\n    );\n  }\n\n  mount(ctx: PlatformMountContext): void {\n    application(ctx.adapter).use((req, res, next) => {\n      if (!ctx.binding.matches(rawPath(req))) {\n        next();\n        return;\n      }\n      const disconnect = abortOnDisconnect(req, res);\n      void this.dispatch(ctx.binding, req, res, disconnect.signal).then(\n        () => disconnect.dispose(),\n        (error: unknown) => {\n          disconnect.dispose();\n          if (!disconnect.signal.aborted) {\n            next(error);\n          }\n        },\n      );\n    });\n  }\n\n  proxyTrust(adapter: AbstractHttpAdapter): ProxyTrust {\n    return proxyTrustOf(application(adapter).get(\"trust proxy\"));\n  }\n\n  private clientIp(req: ExpressRequest): string | null {\n    if (this.options.clientIp) {\n      return this.options.clientIp(req);\n    }\n    return req.ip ?? null;\n  }\n\n  private isApplicationRoute(method: string, pathname: string): boolean {\n    return this.#applicationRoutes.some(\n      (route) =>\n        (route.method === \"ALL\" || route.method === method) &&\n        route.regexp.test(pathname),\n    );\n  }\n\n  private async dispatch(\n    binding: AuthRouteBinding,\n    req: ExpressRequest,\n    res: ExpressResponse,\n    signal: AbortSignal,\n  ): Promise<void> {\n    const captured = req[RAW_BODY];\n    if (\n      (captured && !captured.ok && captured.reason === \"aborted\") ||\n      signal.aborted\n    ) {\n      return;\n    }\n    const response =\n      captured && !captured.ok && captured.reason === \"too-large\"\n        ? binding.payloadTooLarge()\n        : await binding.handle({\n            method: req.method ?? \"GET\",\n            url: requestUrl(req),\n            headers: toWebHeaders(req.headers),\n            body: captured?.ok ? captured.bytes : null,\n            clientIp: this.clientIp(req),\n            platformRequest: req,\n            signal,\n          });\n    if (signal.aborted) {\n      await response.body?.cancel().catch(() => undefined);\n      return;\n    }\n    await writeWebResponse(res, response, {\n      head: req.method?.toUpperCase() === \"HEAD\",\n    });\n  }\n}\n\nexport function expressPlatform(\n  options?: ExpressPlatformOptions,\n): ExpressPlatform {\n  return new ExpressPlatform(options);\n}\n"],"mappings":";;;;;;;AA4BA,MAAM,WAAW,OAAO,IAAI,kCAAkC;AAgC9D,SAAS,YAAY,SAAkD;CACrE,OAAO,QAAQ,YAAY;AAC7B;AAEA,SAAS,cACP,KACsB;CACtB,MAAM,SAAS,KAAK;CACpB,IACG,OAAO,WAAW,YAAY,OAAO,WAAW,cACjD,WAAW,MAEX,MAAM,IAAIA,oBAAAA,6BACR,8BACA,mEACA,yGACF;CAEF,MAAM,UAAU;CAChB,IACE,OAAO,QAAQ,kBAAkB,aACjC,OAAO,QAAQ,WAAW,WAE1B,MAAM,IAAIA,oBAAAA,6BACR,8BACA,8EACA,yGACF;CAEF,OAAO;EAAE,eAAe,QAAQ;EAAe,QAAQ,QAAQ;CAAO;AACxE;AAEA,SAAS,qBAAqB,MAAc,UAA2B;CACrE,MAAM,EAAE,YAAA,GAAWC,eAAAA,MAAAA,CAAM,IAAI;CAC7B,IAAI,gBAAgB;CACpB,IAAI,UAAU;CACd,KAAK,MAAM,SAAS,QAAQ;EAC1B,IAAI,MAAM,SAAS,QAAQ;GACzB,UAAU;GACV;EACF;EACA,iBAAiB,MAAM;CACzB;CACA,MAAM,QAAQ,cAAc,YAAY;CACxC,MAAM,OAAO,SAAS,YAAY,CAAC,CAAC,QAAQ,eAAe,EAAE,KAAK;CAClE,IAAI,SAAS,KACX,OAAO,MAAM,WAAW,GAAG;CAE7B,IAAI,CAAC,SAAS;EACZ,MAAM,QAAQ,MAAM,QAAQ,eAAe,EAAE,KAAK;EAClD,OAAO,UAAU,QAAQ,MAAM,WAAW,GAAG,KAAK,EAAE;CACtD;CACA,IAAI,KAAK,WAAW,KAAK,GACvB,OAAO;CAET,OAAO,UAAU,QAAQ,MAAM,WAAW,GAAG,KAAK,EAAE;AACtD;AAEA,SAAS,UAAU,KAA6B;CAC9C,OAAO,IAAI,eAAe,IAAI,OAAO;AACvC;AAEA,SAAS,QAAQ,KAA6B;CAC5C,MAAM,SAAS,UAAU,GAAG;CAC5B,MAAM,QAAQ,OAAO,QAAQ,GAAG;CAChC,OAAO,UAAU,KAAK,SAAS,OAAO,MAAM,GAAG,KAAK;AACtD;AAEA,SAAS,eACP,SACA,OACoB;CACpB,MAAM,QAAQ,QAAQ;CACtB,MAAM,QAAQ,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK;CAChD,IAAI,OAAO,UAAU,YAAY,CAAC,QAAQ,KAAK,KAAK,GAClD;CAEF,MAAM,SAAS,OAAO,KAAK;CAC3B,OAAO,OAAO,cAAc,MAAM,IAAI,SAAS,QAAQ;AACzD;AAEA,SAAS,WAAW,KAA6B;CAC/C,MAAM,SAAS,IAAI;CACnB,OAAO,GAAG,IAAI,aAAa,OAAO,YAAY,UAAU,QAAQ,KAAK,IAAI,QAAQ,KAAK,UAAU,GAAG;AACrG;;;;;;;;AASA,SAAS,iBAAiB,OAAyC;CACjE,IAAI,EAAE,iBAAiBC,UAAAA,mBAAmB,iBAAiBC,YAAAA,WACzD,OAAO;CAET,MAAM,MAAe,QAAQ,IAAI,OAAO,KAAK;CAC7C,OACE,eAAeC,UAAAA,kBACf,IAAI,QAAQ,SACZ,QAAQ,IAAI,OAAO,KAAK,MAAM,OAC9B,OAAO,IAAI,cAAc,cACzB,OAAO,IAAI,cAAc;AAE7B;AAEA,SAAS,eAAe,OAAuC;CAC7D,IAAI,OAAO,UAAU,YAAY,UAAU,MACzC,OAAO;CAET,MAAM,WAAW;CACjB,OAAO,OAAO,SAAS,cAAc,cACnC,OAAO,SAAS,cAAc,aAC3B,QACD;AACN;AAEA,SAAS,aAAa,OAA4B;CAChD,IAAI,UAAU,SAAS,UAAU,KAAA,GAC/B,OAAO;EAAE,MAAM;EAAQ,QAAQ;CAAsB;CAEvD,IAAI,UAAU,MACZ,OAAO;EAAE,MAAM;EAAO,QAAQ;CAAqB;CAQrD,OAAO;EAAE,MAAM;EAAW,QAAQ,iBALhC,OAAO,UAAU,aACb,eACA,MAAM,QAAQ,KAAK,IACjB,KAAK,UAAU,KAAK,IACpB,OAAO,KAAK;CAC0C;AAChE;AAEA,SAAS,kBACP,KACA,KAC0C;CAC1C,MAAM,aAAa,IAAI,gBAAgB;CACvC,MAAM,cAAc,WAAW,MAAM;CACrC,IAAI,KAAK,WAAW,KAAK;CACzB,IAAI,KAAK,SAAS,KAAK;CACvB,IAAI,IAAI,WAAW,IAAI,WACrB,MAAM;CAER,OAAO;EACL,QAAQ,WAAW;EACnB,eAAe;GACb,IAAI,eAAe,WAAW,KAAK;GACnC,IAAI,eAAe,SAAS,KAAK;EACnC;CACF;AACF;;AAGA,IAAa,kBAAb,MAAqD;CAMtB;CAL7B,KAAc;CACd,sBAAsB;CACtB,qBAAyD,CAAC;CAC1D;CAEA,YAAY,UAAmD,CAAC,GAAG;EAAtC,KAAA,UAAA;CAAuC;CAEpE,WAAoB;EAClB,YAAY,UAA4B,iBAAiB,KAAK;EAC9D,SAAS,UACP,iBAAiB,KAAK,KAAK,MAAM,KAAK,kBAAkB;EAC1D,MAAM,UAA2B;EACjC,UAAU,UACRC,iBAAAA,aAAc,MAAyB,OAAO;EAChD,UAAU,UAAmB;GAC3B,MAAM,MAAM;GACZ,OAAO;IAAE,QAAQ,IAAI,UAAU;IAAO,KAAK,WAAW,GAAG;GAAE;EAC7D;EACA,WAAW,UACT,KAAK,SAAS,KAAuB;EACvC,QAAQ,OAAgB,SAAqC;GAC3D,MAAM,YAAa,MAAyB,SAAS;GACrD,OAAO,OAAO,cAAc,WAAW,YAAY,KAAA;EACrD;EACA,aAAa,SAAkB,aAAsB;GACnD,MAAM,MAAM;GACZ,MAAM,MAAM,eAAe,QAAQ,KAAK,eAAe,IAAI,GAAG;GAC9D,OAAO,QAAQ,OACX,OACA,EACE,SAAS,YACPC,iBAAAA,gBAAgB,KAAK,OAAO,EAChC;EACN;CACF;CAEA,SAAS,SAAuC;EAC9C,OAAO,QAAQ,UAAU,MAAM;CACjC;CAEA,QAAQ,KAAmC;EACzC,MAAM,MAAM,YAAY,IAAI,OAAO;EACnC,KAAK,eAAe;EACpB,IAAI,KAAK,KAAK,MAAM,SAAS;GAC3B,MAAM,UAAU,IAAI,MAAM,QAAQ,GAAG,CAAC;GACtC,MAAM,UAAU,IAAI,UAAU,MAAA,CAAO,YAAY;GACjD,IACE,CAAC,WACD,KAAK,mBAAmB,QAAQ,QAAQ,GAAG,CAAC,KAC5C,WAAW,SACX,WAAW,UACX,WAAW,aACX,CAACC,iBAAAA,YAAY,QAAQ,IAAI,OAAO,GAChC;IACA,KAAK;IACL;GACF;GAEA,MAAM,kBAAkBC,iBAAAA,iBAAiB,IAAI;GAC7C,IAAI,IAAI,iBAAiB,IAAI,aAAa,OAAO;IAC/C,MAAM,YAAYC,iBAAAA,oBAAoB,GAAG;IACzC,IAAI,YAAY;KACd,IAAI;KACJ,OAAO,6BAAa,IAAI,WAAW;IACrC;IACA,IAAI,CAAC,KAAK,qBAAqB;KAC7B,KAAK,sBAAsB;KAC3B,IAAI,OAAO,KACT,sIACF;IACF;IACA,gBAAgB;IAChB;GACF;GAEA,iBAAKC,gBAAgB,KAAK;IACxB,OAAO,QAAQ;IACf,gBAAgB,eAAe,IAAI,SAAS,QAAQ,SAAS;IAC7D,iBAAiB;IACjB,UAAU,KAAK,IAAI,OAAO,kBAAkB,QAAQ,YAAY,CAAC;GACnE,CAAC,CAAC,CAAC,MACA,aAAa;IACZ,IAAI,YAAY;IAChB,gBAAgB;GAClB,IACC,UAAmB,gBAAgB,KAAK,CAC3C;EACF,CAAC;CACH;CAEA,kBACE,QACA,UACM;EACN,MAAM,aAAa,OAAO,SAAS,UAAU;GAC3C,IAAI;IAAC;IAAO;IAAQ;GAAS,CAAC,CAAC,SAAS,MAAM,MAAM,GAClD,OAAO,CAAC;GAEV,MAAM,QAAQ,MAAM,MAAM,QAAQ,SAChC,SAAS,MAAM,YACb,qBAAqB,MAAM,QAAQ,QAAQ,CAC7C,CACF;GACA,OAAO,MAAM,SAAS,CAAC;IAAE,GAAG;IAAO;GAAM,CAAC,IAAI,CAAC;EACjD,CAAC;EACD,MAAM,cAAc,WAAW,MAAM,UAAU,MAAM,WAAW,SAAS,CAAC;EAC1E,IAAI,aACF,MAAM,IAAIV,oBAAAA,6BACR,4BACA,GAAG,YAAY,OAAO,OAAO,YAAY,MAAM,KAAK,IAAI,EAAE,SAAS,YAAY,WAAW,KAAK,OAAO,EAAE,gCACxG,sGACF;EAEF,IAAI,WAAW,WAAW,GAAG;GAC3B,KAAK,qBAAqB,CAAC;GAC3B;EACF;EACA,MAAM,EAAE,eAAe,WAAW,cAAc,KAAK,YAAY;EACjE,KAAK,qBAAqB,OAAO,OAC/B,WAAW,SAAS,UAClB,MAAM,MAAM,KAAK,UAAU;GACzB,QAAQ,MAAM;GACd,SAAA,GAAQW,eAAAA,aAAAA,CAAa,MAAM;IACzB,KAAK;IACL,WAAW;IACX,UAAU,CAAC;GACb,CAAC,CAAC,CAAC;EACL,EAAE,CACJ,CACF;CACF;CAEA,MAAM,KAAiC;EACrC,YAAY,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,KAAK,SAAS;GAC/C,IAAI,CAAC,IAAI,QAAQ,QAAQ,QAAQ,GAAG,CAAC,GAAG;IACtC,KAAK;IACL;GACF;GACA,MAAM,aAAa,kBAAkB,KAAK,GAAG;GAC7C,KAAU,SAAS,IAAI,SAAS,KAAK,KAAK,WAAW,MAAM,CAAC,CAAC,WACrD,WAAW,QAAQ,IACxB,UAAmB;IAClB,WAAW,QAAQ;IACnB,IAAI,CAAC,WAAW,OAAO,SACrB,KAAK,KAAK;GAEd,CACF;EACF,CAAC;CACH;CAEA,WAAW,SAA0C;EACnD,OAAO,aAAa,YAAY,OAAO,CAAC,CAAC,IAAI,aAAa,CAAC;CAC7D;CAEA,SAAiB,KAAoC;EACnD,IAAI,KAAK,QAAQ,UACf,OAAO,KAAK,QAAQ,SAAS,GAAG;EAElC,OAAO,IAAI,MAAM;CACnB;CAEA,mBAA2B,QAAgB,UAA2B;EACpE,OAAO,KAAK,mBAAmB,MAC5B,WACE,MAAM,WAAW,SAAS,MAAM,WAAW,WAC5C,MAAM,OAAO,KAAK,QAAQ,CAC9B;CACF;CAEA,MAAc,SACZ,SACA,KACA,KACA,QACe;EACf,MAAM,WAAW,IAAI;EACrB,IACG,YAAY,CAAC,SAAS,MAAM,SAAS,WAAW,aACjD,OAAO,SAEP;EAEF,MAAM,WACJ,YAAY,CAAC,SAAS,MAAM,SAAS,WAAW,cAC5C,QAAQ,gBAAgB,IACxB,MAAM,QAAQ,OAAO;GACnB,QAAQ,IAAI,UAAU;GACtB,KAAK,WAAW,GAAG;GACnB,SAASN,iBAAAA,aAAa,IAAI,OAAO;GACjC,MAAM,UAAU,KAAK,SAAS,QAAQ;GACtC,UAAU,KAAK,SAAS,GAAG;GAC3B,iBAAiB;GACjB;EACF,CAAC;EACP,IAAI,OAAO,SAAS;GAClB,MAAM,SAAS,MAAM,OAAO,CAAC,CAAC,YAAY,KAAA,CAAS;GACnD;EACF;EACA,MAAMO,iBAAAA,iBAAiB,KAAK,UAAU,EACpC,MAAM,IAAI,QAAQ,YAAY,MAAM,OACtC,CAAC;CACH;AACF;AAEA,SAAgB,gBACd,SACiB;CACjB,OAAO,IAAI,gBAAgB,OAAO;AACpC"}

package/dist/express.d.cts

@@ -0,0 +1,37 @@
+import { J as PlatformMountContext, P as ExpressPlatformOptions, U as HttpPlatform, Y as PlatformPrepareContext, at as ProxyTrust, n as ApplicationRouteDescriptor, s as AuthRouteBinding } from "./auth-contracts-Brh_Qko9.cjs";
+import { AbstractHttpAdapter } from "@nestjs/core";
+//#region src/express-platform.d.ts
+/** Express-specific two-phase HTTP integration. */
+export declare class ExpressPlatform implements HttpPlatform {
+  #private;
+  private readonly options;
+  readonly id = "express";
+  constructor(options?: ExpressPlatformOptions);
+  readonly requests: {
+    isRequest: (value: unknown) => boolean;
+    isLive: (value: unknown) => boolean;
+    key: (value: unknown) => object;
+    headers: (value: unknown) => Headers;
+    request: (value: unknown) => {
+      method: string;
+      url: string;
+    };
+    clientIp: (value: unknown) => string | null;
+    param: (value: unknown, name: string) => string | undefined;
+    cookieSink: (request: unknown, response: unknown) => {
+      append: (cookies: readonly string[]) => boolean;
+    } | null;
+  };
+  supports(adapter: AbstractHttpAdapter): boolean;
+  prepare(ctx: PlatformPrepareContext): void;
+  applicationRoutes(routes: readonly ApplicationRouteDescriptor[], bindings: readonly AuthRouteBinding[]): void;
+  mount(ctx: PlatformMountContext): void;
+  proxyTrust(adapter: AbstractHttpAdapter): ProxyTrust;
+  private clientIp;
+  private isApplicationRoute;
+  private dispatch;
+}
+export declare function expressPlatform(options?: ExpressPlatformOptions): ExpressPlatform;
+//#endregion
+export type { ExpressPlatformOptions };
+//# sourceMappingURL=express.d.cts.map

package/dist/express.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"express.d.cts","names":[],"sources":["../src/express-platform.ts"],"mappings":";;;;qBAuNa,2BAA2B;;mBAMT;WALpB;EAKT,YAA6B,UAAS;WAE7B;IACP,YAAS;IACT,SAAM;IAEN,MAAG;IACH,UAAO,mBAAoB;IAE3B,UAAO;MAEI;MAA6B;;IAExC,WAAQ;IAER,QAAK,gBAAiB;IAItB,aAAU,kBAAmB;MAMH,SAAA;;;EAM5B,SAAS,SAAS;EAIlB,QAAQ,KAAK;EAkDb,kBACE,iBAAiB,8BACjB,mBAAmB;EAwCrB,MAAM,KAAK;EAmBX,WAAW,SAAS,sBAAsB;UAIlC;UAOA;UAQM;;wBAmCA,gBACd,UAAU,yBACT"}

package/dist/express.d.mts

@@ -0,0 +1,37 @@
+import { J as PlatformMountContext, P as ExpressPlatformOptions, U as HttpPlatform, Y as PlatformPrepareContext, at as ProxyTrust, n as ApplicationRouteDescriptor, s as AuthRouteBinding } from "./auth-contracts-Cz7C4_Ch.mjs";
+import { AbstractHttpAdapter } from "@nestjs/core";
+//#region src/express-platform.d.ts
+/** Express-specific two-phase HTTP integration. */
+export declare class ExpressPlatform implements HttpPlatform {
+  #private;
+  private readonly options;
+  readonly id = "express";
+  constructor(options?: ExpressPlatformOptions);
+  readonly requests: {
+    isRequest: (value: unknown) => boolean;
+    isLive: (value: unknown) => boolean;
+    key: (value: unknown) => object;
+    headers: (value: unknown) => Headers;
+    request: (value: unknown) => {
+      method: string;
+      url: string;
+    };
+    clientIp: (value: unknown) => string | null;
+    param: (value: unknown, name: string) => string | undefined;
+    cookieSink: (request: unknown, response: unknown) => {
+      append: (cookies: readonly string[]) => boolean;
+    } | null;
+  };
+  supports(adapter: AbstractHttpAdapter): boolean;
+  prepare(ctx: PlatformPrepareContext): void;
+  applicationRoutes(routes: readonly ApplicationRouteDescriptor[], bindings: readonly AuthRouteBinding[]): void;
+  mount(ctx: PlatformMountContext): void;
+  proxyTrust(adapter: AbstractHttpAdapter): ProxyTrust;
+  private clientIp;
+  private isApplicationRoute;
+  private dispatch;
+}
+export declare function expressPlatform(options?: ExpressPlatformOptions): ExpressPlatform;
+//#endregion
+export type { ExpressPlatformOptions };
+//# sourceMappingURL=express.d.mts.map

package/dist/express.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"express.d.mts","names":[],"sources":["../src/express-platform.ts"],"mappings":";;;;qBAuNa,2BAA2B;;mBAMT;WALpB;EAKT,YAA6B,UAAS;WAE7B;IACP,YAAS;IACT,SAAM;IAEN,MAAG;IACH,UAAO,mBAAoB;IAE3B,UAAO;MAEI;MAA6B;;IAExC,WAAQ;IAER,QAAK,gBAAiB;IAItB,aAAU,kBAAmB;MAMH,SAAA;;;EAM5B,SAAS,SAAS;EAIlB,QAAQ,KAAK;EAkDb,kBACE,iBAAiB,8BACjB,mBAAmB;EAwCrB,MAAM,KAAK;EAmBX,WAAW,SAAS,sBAAsB;UAIlC;UAOA;UAQM;;wBAmCA,gBACd,UAAU,yBACT"}

package/dist/express.mjs

@@ -0,0 +1,254 @@
+import { n as BetterAuthConfigurationError } from "./auth-errors-C3rbTV9p.mjs";
+import { a as recoverConsumedBody, c as writeWebResponse, i as readBoundedBody, n as bindAsyncContext, o as toWebHeaders, r as mayHaveBody, t as appendSetCookie } from "./platform-CZl7TY8j.mjs";
+import { IncomingMessage, ServerResponse } from "node:http";
+import { Readable } from "node:stream";
+import { parse, pathToRegexp } from "path-to-regexp";
+//#region src/express-platform.ts
+const RAW_BODY = Symbol.for("@nestjs-kit/better-auth:raw-body");
+function application(adapter) {
+	return adapter.getInstance();
+}
+function routerOptions(app) {
+	const router = app?.router;
+	if (typeof router !== "object" && typeof router !== "function" || router === null) throw new BetterAuthConfigurationError("UNSUPPORTED_EXPRESS_ROUTER", "The Express application does not expose its initialized router.", "Use Express 5.2.x with @nestjs/platform-express 12.x, or move controller routes outside the auth mount.");
+	const options = router;
+	if (typeof options.caseSensitive !== "boolean" || typeof options.strict !== "boolean") throw new BetterAuthConfigurationError("UNSUPPORTED_EXPRESS_ROUTER", "The initialized Express router does not expose compatible routing options.", "Use Express 5.2.x with @nestjs/platform-express 12.x, or move controller routes outside the auth mount.");
+	return {
+		caseSensitive: options.caseSensitive,
+		strict: options.strict
+	};
+}
+function routeMayOverlapMount(path, basePath) {
+	const { tokens } = parse(path);
+	let literalPrefix = "";
+	let dynamic = false;
+	for (const token of tokens) {
+		if (token.type !== "text") {
+			dynamic = true;
+			break;
+		}
+		literalPrefix += token.value;
+	}
+	const route = literalPrefix.toLowerCase();
+	const base = basePath.toLowerCase().replace(/(?<!\/)\/+$/, "") || "/";
+	if (base === "/") return route.startsWith("/");
+	if (!dynamic) {
+		const exact = route.replace(/(?<!\/)\/+$/, "") || "/";
+		return exact === base || exact.startsWith(`${base}/`);
+	}
+	if (base.startsWith(route)) return true;
+	return route === base || route.startsWith(`${base}/`);
+}
+function rawTarget(req) {
+	return req.originalUrl ?? req.url ?? "/";
+}
+function rawPath(req) {
+	const target = rawTarget(req);
+	const query = target.indexOf("?");
+	return query === -1 ? target : target.slice(0, query);
+}
+function declaredLength(headers, limit) {
+	const value = headers["content-length"];
+	const first = Array.isArray(value) ? value[0] : value;
+	if (typeof first !== "string" || !/^\d+$/.test(first)) return;
+	const parsed = Number(first);
+	return Number.isSafeInteger(parsed) ? parsed : limit + 1;
+}
+function requestUrl(req) {
+	const socket = req.socket;
+	return `${req.protocol ?? (socket.encrypted ? "https" : "http")}://${req.host ?? ""}${rawTarget(req)}`;
+}
+/**
+* Identifies Express's request by the Node objects it extends, never by shape: a GraphQL
+* context can carry client-parsed data, and JSON can reproduce any structural check.
+* light-my-request's inject() re-parents Express's shared request prototype onto its own
+* Readable-based request for the whole process, so a stream request is accepted too; its
+* response must still be a ServerResponse bound to it in both directions.
+*/
+function isExpressRequest(value) {
+	if (!(value instanceof IncomingMessage || value instanceof Readable)) return false;
+	const res = Reflect.get(value, "res");
+	return res instanceof ServerResponse && res.req === value && Reflect.get(value, "res") === res && typeof res.setHeader === "function" && typeof res.getHeader === "function";
+}
+function nativeResponse(value) {
+	if (typeof value !== "object" || value === null) return null;
+	const response = value;
+	return typeof response.setHeader === "function" && typeof response.getHeader === "function" ? value : null;
+}
+function proxyTrustOf(value) {
+	if (value === false || value === void 0) return {
+		mode: "none",
+		detail: "trust proxy = false"
+	};
+	if (value === true) return {
+		mode: "all",
+		detail: "trust proxy = true"
+	};
+	return {
+		mode: "partial",
+		detail: `trust proxy = ${typeof value === "function" ? "<function>" : Array.isArray(value) ? JSON.stringify(value) : String(value)}`
+	};
+}
+function abortOnDisconnect(req, res) {
+	const controller = new AbortController();
+	const abort = () => controller.abort();
+	req.once("aborted", abort);
+	res.once("close", abort);
+	if (req.aborted || res.destroyed) abort();
+	return {
+		signal: controller.signal,
+		dispose: () => {
+			req.removeListener("aborted", abort);
+			res.removeListener("close", abort);
+		}
+	};
+}
+/** Express-specific two-phase HTTP integration. */
+var ExpressPlatform = class {
+	options;
+	id = "express";
+	#warnedConsumedBody = false;
+	#applicationRoutes = [];
+	#application;
+	constructor(options = {}) {
+		this.options = options;
+	}
+	requests = {
+		isRequest: (value) => isExpressRequest(value),
+		isLive: (value) => isExpressRequest(value) && value.res?.writableEnded === false,
+		key: (value) => value,
+		headers: (value) => toWebHeaders(value.headers),
+		request: (value) => {
+			const req = value;
+			return {
+				method: req.method ?? "GET",
+				url: requestUrl(req)
+			};
+		},
+		clientIp: (value) => this.clientIp(value),
+		param: (value, name) => {
+			const parameter = value.params?.[name];
+			return typeof parameter === "string" ? parameter : void 0;
+		},
+		cookieSink: (request, response) => {
+			const req = request;
+			const res = nativeResponse(response) ?? nativeResponse(req.res);
+			return res === null ? null : { append: (cookies) => appendSetCookie(res, cookies) };
+		}
+	};
+	supports(adapter) {
+		return adapter.getType?.() === "express";
+	}
+	prepare(ctx) {
+		const app = application(ctx.adapter);
+		this.#application = app;
+		app.use((req, _res, next) => {
+			const binding = ctx.route(rawPath(req));
+			const method = (req.method ?? "GET").toUpperCase();
+			if (!binding || this.isApplicationRoute(method, rawPath(req)) || method === "GET" || method === "HEAD" || method === "OPTIONS" || !mayHaveBody(method, req.headers)) {
+				next();
+				return;
+			}
+			const continueRequest = bindAsyncContext(next);
+			if (req.readableEnded || req.readable === false) {
+				const recovered = recoverConsumedBody(req);
+				req[RAW_BODY] = {
+					ok: true,
+					bytes: recovered ?? /* @__PURE__ */ new Uint8Array()
+				};
+				if (!this.#warnedConsumedBody) {
+					this.#warnedConsumedBody = true;
+					ctx.logger.warn("W_BODY_ALREADY_CONSUMED: an Express body parser ran before the auth capture; raw-signature webhooks may receive re-serialized bytes.");
+				}
+				continueRequest();
+				return;
+			}
+			readBoundedBody(req, {
+				limit: binding.bodyLimit,
+				declaredLength: declaredLength(req.headers, binding.bodyLimit),
+				drainOnOverflow: true,
+				drainCap: Math.min(Number.MAX_SAFE_INTEGER, binding.bodyLimit * 8)
+			}).then((captured) => {
+				req[RAW_BODY] = captured;
+				continueRequest();
+			}, (error) => continueRequest(error));
+		});
+	}
+	applicationRoutes(routes, bindings) {
+		const bodyRoutes = routes.flatMap((route) => {
+			if ([
+				"GET",
+				"HEAD",
+				"OPTIONS"
+			].includes(route.method)) return [];
+			const paths = route.paths.filter((path) => bindings.some((binding) => routeMayOverlapMount(path, binding.basePath)));
+			return paths.length ? [{
+				...route,
+				paths
+			}] : [];
+		});
+		const conditional = bodyRoutes.find((route) => route.conditions.length > 0);
+		if (conditional) throw new BetterAuthConfigurationError("CONDITIONAL_ROUTE_SHADOW", `${conditional.source} at '${conditional.paths.join(", ")}' uses ${conditional.conditions.join(" and ")} routing under an auth mount.`, "Move the controller route outside the auth mount or make its host and version routing unconditional.");
+		if (bodyRoutes.length === 0) {
+			this.#applicationRoutes = [];
+			return;
+		}
+		const { caseSensitive, strict } = routerOptions(this.#application);
+		this.#applicationRoutes = Object.freeze(bodyRoutes.flatMap((route) => route.paths.map((path) => ({
+			method: route.method,
+			regexp: pathToRegexp(path, {
+				end: true,
+				sensitive: caseSensitive,
+				trailing: !strict
+			}).regexp
+		}))));
+	}
+	mount(ctx) {
+		application(ctx.adapter).use((req, res, next) => {
+			if (!ctx.binding.matches(rawPath(req))) {
+				next();
+				return;
+			}
+			const disconnect = abortOnDisconnect(req, res);
+			this.dispatch(ctx.binding, req, res, disconnect.signal).then(() => disconnect.dispose(), (error) => {
+				disconnect.dispose();
+				if (!disconnect.signal.aborted) next(error);
+			});
+		});
+	}
+	proxyTrust(adapter) {
+		return proxyTrustOf(application(adapter).get("trust proxy"));
+	}
+	clientIp(req) {
+		if (this.options.clientIp) return this.options.clientIp(req);
+		return req.ip ?? null;
+	}
+	isApplicationRoute(method, pathname) {
+		return this.#applicationRoutes.some((route) => (route.method === "ALL" || route.method === method) && route.regexp.test(pathname));
+	}
+	async dispatch(binding, req, res, signal) {
+		const captured = req[RAW_BODY];
+		if (captured && !captured.ok && captured.reason === "aborted" || signal.aborted) return;
+		const response = captured && !captured.ok && captured.reason === "too-large" ? binding.payloadTooLarge() : await binding.handle({
+			method: req.method ?? "GET",
+			url: requestUrl(req),
+			headers: toWebHeaders(req.headers),
+			body: captured?.ok ? captured.bytes : null,
+			clientIp: this.clientIp(req),
+			platformRequest: req,
+			signal
+		});
+		if (signal.aborted) {
+			await response.body?.cancel().catch(() => void 0);
+			return;
+		}
+		await writeWebResponse(res, response, { head: req.method?.toUpperCase() === "HEAD" });
+	}
+};
+function expressPlatform(options) {
+	return new ExpressPlatform(options);
+}
+//#endregion
+export { ExpressPlatform, expressPlatform };
+
+//# sourceMappingURL=express.mjs.map