nestjs-slightly-better-auth 1.0.0

package/dist/auth-errors-CsERBNWI.cjs

@@ -0,0 +1,348 @@
+let better_auth_api = require("better-auth/api");
+//#region src/error-redactor.ts
+/** Reading an arbitrary thrown value must not invoke another escaping fault. */
+function readErrorProperty(value, key) {
+	if ((typeof value !== "object" || value === null) && typeof value !== "function") return;
+	try {
+		return Reflect.get(value, key);
+	} catch {
+		return;
+	}
+}
+var ErrorRedactor = class {
+	#secrets;
+	constructor(options = {}) {
+		const values = /* @__PURE__ */ new Set();
+		const add = (value) => {
+			if (!value) return;
+			values.add(value);
+			let decoded = value;
+			try {
+				decoded = decodeURIComponent(value);
+				values.add(decoded);
+			} catch {}
+			for (const form of [value, decoded]) {
+				const separator = form.lastIndexOf(".");
+				if (separator >= 16) values.add(form.slice(0, separator));
+			}
+		};
+		for (const value of options.secrets ?? []) add(value);
+		const headers = options.headers;
+		for (const cookie of (headers?.get("cookie") ?? "").split(";")) {
+			const separator = cookie.indexOf("=");
+			if (separator >= 0) {
+				const value = cookie.slice(separator + 1).trim();
+				add(value);
+				if (value.startsWith("\"") && value.endsWith("\"")) add(value.slice(1, -1));
+			}
+		}
+		const authorization = headers?.get("authorization");
+		if (authorization) {
+			add(authorization);
+			const credential = /^\S+\s+(.+)$/.exec(authorization)?.[1];
+			if (credential) add(credential);
+		}
+		for (const name of options.credentialHeaders ?? []) {
+			const value = headers?.get(name);
+			if (value) add(value);
+		}
+		this.#secrets = [...values].sort((left, right) => right.length - left.length);
+	}
+	redact(cause) {
+		return this.redactCause(cause, 0, /* @__PURE__ */ new Set());
+	}
+	replaceSecrets(value) {
+		for (const secret of this.#secrets) value = value.split(secret).join("[REDACTED]");
+		return value;
+	}
+	diagnostic(value) {
+		return this.replaceSecrets(value).split(/[\r\n]/, 1)[0].slice(0, 300);
+	}
+	redactCause(cause, depth, seen) {
+		const message = readErrorProperty(cause, "message");
+		const error = new Error(this.diagnostic(typeof message === "string" ? message : typeof cause === "string" ? cause : "Unknown authentication infrastructure failure"));
+		const name = readErrorProperty(cause, "name");
+		error.name = typeof name === "string" ? this.diagnostic(name) : "Error";
+		for (const key of [
+			"code",
+			"errno",
+			"syscall"
+		]) {
+			const value = readErrorProperty(cause, key);
+			if (typeof value === "string" || typeof value === "number" && Number.isFinite(value)) Object.defineProperty(error, key, {
+				value: typeof value === "string" ? this.diagnostic(value) : value,
+				enumerable: true
+			});
+		}
+		const stack = readErrorProperty(cause, "stack");
+		const frames = typeof stack === "string" ? stack.split(/\r?\n/).filter((line) => /^\s+at .+:\d+:\d+\)?$/.test(line)).map((line) => this.replaceSecrets(line)) : [];
+		error.stack = [`${error.name}: ${error.message}`, ...frames].join("\n");
+		seen.add(cause);
+		const nested = readErrorProperty(cause, "cause");
+		if (nested !== void 0 && depth < 3 && !seen.has(nested)) Object.defineProperty(error, "cause", {
+			value: this.redactCause(nested, depth + 1, seen),
+			enumerable: false
+		});
+		return error;
+	}
+};
+//#endregion
+//#region src/auth-errors.ts
+const FAILURE_BRAND = Symbol.for("nestjs-slightly-better-auth:auth-failure");
+const INFRASTRUCTURE_BRAND = Symbol.for("nestjs-slightly-better-auth:infrastructure-error");
+const CONFIGURATION_BRAND = Symbol.for("nestjs-slightly-better-auth:configuration-error");
+const RAW_CAUSE = Symbol.for("nestjs-slightly-better-auth:raw-cause");
+const SDK_HEADERS = Symbol.for("better-call:api-error-headers");
+function branded(value, brand) {
+	Object.defineProperty(value, brand, { value: true });
+	return value;
+}
+function isAuthFailure(value) {
+	return readErrorProperty(value, FAILURE_BRAND) === true;
+}
+function isInfrastructureError(value) {
+	return readErrorProperty(value, INFRASTRUCTURE_BRAND) === true;
+}
+function isConfigurationError(value) {
+	return readErrorProperty(value, CONFIGURATION_BRAND) === true;
+}
+function sdkStatus(error) {
+	try {
+		if (!(0, better_auth_api.isAPIError)(error)) return;
+		const status = readErrorProperty(error, "statusCode");
+		return typeof status === "number" && Number.isInteger(status) && status >= 100 && status <= 599 ? status : void 0;
+	} catch {
+		return;
+	}
+}
+function sdkReason(error) {
+	const reason = readErrorProperty(readErrorProperty(error, "body"), "code");
+	return typeof reason === "string" ? reason : void 0;
+}
+/** Internal: preserve cookie lines for the exchange's separately governed cleanup. */
+function getAPIErrorHeaders(error) {
+	const result = new Headers();
+	for (const value of [readErrorProperty(error, SDK_HEADERS), readErrorProperty(error, "headers")]) {
+		if (value === void 0 || value === null) continue;
+		try {
+			const headers = new Headers(value);
+			for (const [name, value] of headers) if (name !== "set-cookie") result.set(name, value);
+			for (const cookie of headers.getSetCookie()) result.append("set-cookie", cookie);
+		} catch {}
+	}
+	return result;
+}
+function rejection(input) {
+	const codes = {
+		401: "UNAUTHENTICATED",
+		403: "FORBIDDEN",
+		429: "RATE_LIMITED"
+	};
+	const messages = {
+		401: "Unauthorized",
+		403: "Forbidden",
+		429: "Too Many Requests"
+	};
+	const headers = new Headers();
+	const retry = input.retryAfterSeconds;
+	if (retry !== void 0 && Number.isFinite(retry) && retry >= 0) headers.set("retry-after", String(Math.ceil(retry)));
+	return branded({
+		status: input.status,
+		code: codes[input.status],
+		reason: input.reason,
+		message: input.message ?? messages[input.status],
+		challenge: input.challenge,
+		...headers.has("retry-after") ? { headers } : {}
+	}, FAILURE_BRAND);
+}
+const AuthFailures = {
+	unauthenticated(message) {
+		return rejection({
+			status: 401,
+			message
+		});
+	},
+	rejected: rejection,
+	forbidden(reason, message) {
+		return rejection({
+			status: 403,
+			reason,
+			message
+		});
+	},
+	fromAPIError(error) {
+		const status = sdkStatus(error);
+		if (status !== 401 && status !== 403 && status !== 429) return null;
+		const originalHeaders = getAPIErrorHeaders(error);
+		const delay = readErrorProperty(readErrorProperty(readErrorProperty(error, "body"), "details"), "tryAgainIn");
+		const failure = rejection({
+			status,
+			reason: sdkReason(error),
+			challenge: originalHeaders.get("www-authenticate") ?? void 0,
+			retryAfterSeconds: status === 429 && typeof delay === "number" ? delay / 1e3 : void 0
+		});
+		const retryAfter = originalHeaders.get("retry-after");
+		if (retryAfter !== null) {
+			const headers = new Headers(failure.headers);
+			headers.set("retry-after", retryAfter);
+			return branded({
+				...failure,
+				headers
+			}, FAILURE_BRAND);
+		}
+		return failure;
+	}
+};
+var BetterAuthConfigurationError = class BetterAuthConfigurationError extends Error {
+	code;
+	detail;
+	site;
+	hint;
+	phase;
+	extensions = {
+		code: "INTERNAL_SERVER_ERROR",
+		reason: "AUTH_MISCONFIGURED",
+		statusCode: 500
+	};
+	issues;
+	constructor(code, detail, hint) {
+		super(detail);
+		this.name = "BetterAuthConfigurationError";
+		this.code = code;
+		this.detail = detail;
+		this.hint = hint;
+		this.phase = "boot";
+		branded(this, CONFIGURATION_BRAND);
+	}
+	static atRequest(code, detail, options) {
+		const error = new BetterAuthConfigurationError(code, "Authentication is misconfigured", options?.hint);
+		Object.defineProperties(error, {
+			detail: {
+				value: detail,
+				enumerable: true
+			},
+			site: {
+				value: options?.site,
+				enumerable: true
+			},
+			phase: {
+				value: "request",
+				enumerable: true
+			}
+		});
+		return error;
+	}
+};
+var BetterAuthInfrastructureError = class extends Error {
+	cause;
+	extensions = {
+		code: "INTERNAL_SERVER_ERROR",
+		reason: "AUTH_UNAVAILABLE",
+		statusCode: 500
+	};
+	constructor(cause, options) {
+		super("Authentication service unavailable");
+		this.name = "BetterAuthInfrastructureError";
+		this.cause = new ErrorRedactor(options).redact(cause);
+		branded(this, INFRASTRUCTURE_BRAND);
+	}
+};
+/** Internal factory for an instance's explicit diagnostic opt-in, never global state. */
+function createInfrastructureError(cause, options) {
+	const error = new BetterAuthInfrastructureError(cause, options);
+	if (options?.exposeRawCause === true) Object.defineProperty(error, RAW_CAUSE, {
+		value: cause,
+		enumerable: false
+	});
+	return error;
+}
+function getRawCause(error) {
+	return readErrorProperty(error, RAW_CAUSE);
+}
+/** Internal safety net. Evaluation performs the authoritative session-loss recheck. */
+function normalizeThrown(error, where, site, secrets, options) {
+	if (isAuthFailure(error)) return error;
+	if (isInfrastructureError(error) || isConfigurationError(error)) throw error;
+	const status = sdkStatus(error);
+	const reason = sdkReason(error);
+	if (status === 429) return AuthFailures.fromAPIError(error);
+	if (status === 401 && where === "policy" && (reason === void 0 || reason === "UNAUTHORIZED")) return {
+		sessionLoss: error,
+		reason
+	};
+	if (status === 401 || status === 403) return where === "source" ? AuthFailures.fromAPIError(error) : AuthFailures.forbidden(reason ?? "FORBIDDEN");
+	if (status !== void 0 && status < 500) throw BetterAuthConfigurationError.atRequest("BETTER_AUTH_REJECTED_CALL", `better-auth rejected the library's call (${status} ${reason})`, { site });
+	throw createInfrastructureError(error, {
+		secrets,
+		exposeRawCause: options?.exposeRawCause
+	});
+}
+//#endregion
+Object.defineProperty(exports, "AuthFailures", {
+	enumerable: true,
+	get: function() {
+		return AuthFailures;
+	}
+});
+Object.defineProperty(exports, "BetterAuthConfigurationError", {
+	enumerable: true,
+	get: function() {
+		return BetterAuthConfigurationError;
+	}
+});
+Object.defineProperty(exports, "BetterAuthInfrastructureError", {
+	enumerable: true,
+	get: function() {
+		return BetterAuthInfrastructureError;
+	}
+});
+Object.defineProperty(exports, "ErrorRedactor", {
+	enumerable: true,
+	get: function() {
+		return ErrorRedactor;
+	}
+});
+Object.defineProperty(exports, "createInfrastructureError", {
+	enumerable: true,
+	get: function() {
+		return createInfrastructureError;
+	}
+});
+Object.defineProperty(exports, "getAPIErrorHeaders", {
+	enumerable: true,
+	get: function() {
+		return getAPIErrorHeaders;
+	}
+});
+Object.defineProperty(exports, "getRawCause", {
+	enumerable: true,
+	get: function() {
+		return getRawCause;
+	}
+});
+Object.defineProperty(exports, "isAuthFailure", {
+	enumerable: true,
+	get: function() {
+		return isAuthFailure;
+	}
+});
+Object.defineProperty(exports, "isConfigurationError", {
+	enumerable: true,
+	get: function() {
+		return isConfigurationError;
+	}
+});
+Object.defineProperty(exports, "isInfrastructureError", {
+	enumerable: true,
+	get: function() {
+		return isInfrastructureError;
+	}
+});
+Object.defineProperty(exports, "normalizeThrown", {
+	enumerable: true,
+	get: function() {
+		return normalizeThrown;
+	}
+});
+
+//# sourceMappingURL=auth-errors-CsERBNWI.cjs.map

package/dist/auth-errors-CsERBNWI.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-errors-CsERBNWI.cjs","names":["isAPIError"],"sources":["../src/error-redactor.ts","../src/auth-errors.ts"],"sourcesContent":["/** Inputs come from the active request's owner; the redactor retains no scope. */\nexport interface ErrorRedactorOptions {\n  secrets?: readonly string[];\n  headers?: Headers;\n  credentialHeaders?: readonly string[];\n}\n\n/** Reading an arbitrary thrown value must not invoke another escaping fault. */\nexport function readErrorProperty(value: unknown, key: PropertyKey): unknown {\n  if (\n    (typeof value !== \"object\" || value === null) &&\n    typeof value !== \"function\"\n  ) {\n    return undefined;\n  }\n  try {\n    return Reflect.get(value, key);\n  } catch {\n    return undefined;\n  }\n}\n\nexport class ErrorRedactor {\n  readonly #secrets: readonly string[];\n\n  constructor(options: ErrorRedactorOptions = {}) {\n    const values = new Set<string>();\n    const add = (value: string) => {\n      if (!value) {\n        return;\n      }\n      values.add(value);\n      let decoded = value;\n      try {\n        decoded = decodeURIComponent(value);\n        values.add(decoded);\n      } catch {\n        // Invalid escaping must not prevent redaction of the raw credential.\n      }\n      for (const form of [value, decoded]) {\n        const separator = form.lastIndexOf(\".\");\n        if (separator >= 16) {\n          values.add(form.slice(0, separator));\n        }\n      }\n    };\n    for (const value of options.secrets ?? []) {\n      add(value);\n    }\n    const headers = options.headers;\n    for (const cookie of (headers?.get(\"cookie\") ?? \"\").split(\";\")) {\n      const separator = cookie.indexOf(\"=\");\n      if (separator >= 0) {\n        const value = cookie.slice(separator + 1).trim();\n        add(value);\n        if (value.startsWith('\"') && value.endsWith('\"')) {\n          add(value.slice(1, -1));\n        }\n      }\n    }\n    const authorization = headers?.get(\"authorization\");\n    if (authorization) {\n      add(authorization);\n      const credential = /^\\S+\\s+(.+)$/.exec(authorization)?.[1];\n      if (credential) {\n        add(credential);\n      }\n    }\n    for (const name of options.credentialHeaders ?? []) {\n      const value = headers?.get(name);\n      if (value) {\n        add(value);\n      }\n    }\n    this.#secrets = [...values].sort(\n      (left, right) => right.length - left.length,\n    );\n  }\n\n  redact(cause: unknown): Error {\n    return this.redactCause(cause, 0, new Set());\n  }\n\n  private replaceSecrets(value: string): string {\n    for (const secret of this.#secrets) {\n      value = value.split(secret).join(\"[REDACTED]\");\n    }\n    return value;\n  }\n\n  private diagnostic(value: string): string {\n    return this.replaceSecrets(value)\n      .split(/[\\r\\n]/, 1)[0]\n      .slice(0, 300);\n  }\n\n  private redactCause(\n    cause: unknown,\n    depth: number,\n    seen: Set<unknown>,\n  ): Error {\n    const message = readErrorProperty(cause, \"message\");\n    const error = new Error(\n      this.diagnostic(\n        typeof message === \"string\"\n          ? message\n          : typeof cause === \"string\"\n            ? cause\n            : \"Unknown authentication infrastructure failure\",\n      ),\n    );\n    const name = readErrorProperty(cause, \"name\");\n    error.name = typeof name === \"string\" ? this.diagnostic(name) : \"Error\";\n    for (const key of [\"code\", \"errno\", \"syscall\"] as const) {\n      const value = readErrorProperty(cause, key);\n      if (\n        typeof value === \"string\" ||\n        (typeof value === \"number\" && Number.isFinite(value))\n      ) {\n        Object.defineProperty(error, key, {\n          value: typeof value === \"string\" ? this.diagnostic(value) : value,\n          enumerable: true,\n        });\n      }\n    }\n    const stack = readErrorProperty(cause, \"stack\");\n    const frames =\n      typeof stack === \"string\"\n        ? stack\n            .split(/\\r?\\n/)\n            .filter((line) => /^\\s+at .+:\\d+:\\d+\\)?$/.test(line))\n            .map((line) => this.replaceSecrets(line))\n        : [];\n    error.stack = [`${error.name}: ${error.message}`, ...frames].join(\"\\n\");\n    seen.add(cause);\n    const nested = readErrorProperty(cause, \"cause\");\n    if (nested !== undefined && depth < 3 && !seen.has(nested)) {\n      Object.defineProperty(error, \"cause\", {\n        value: this.redactCause(nested, depth + 1, seen),\n        enumerable: false,\n      });\n    }\n    return error;\n  }\n}\n","import type { ExecutionContext } from \"@nestjs/common\";\nimport { isAPIError } from \"better-auth/api\";\nimport {\n  ErrorRedactor,\n  type ErrorRedactorOptions,\n  readErrorProperty,\n} from \"./error-redactor.js\";\n\nconst FAILURE_BRAND = Symbol.for(\"nestjs-slightly-better-auth:auth-failure\");\nconst INFRASTRUCTURE_BRAND = Symbol.for(\n  \"nestjs-slightly-better-auth:infrastructure-error\",\n);\nconst CONFIGURATION_BRAND = Symbol.for(\n  \"nestjs-slightly-better-auth:configuration-error\",\n);\nconst RAW_CAUSE = Symbol.for(\"nestjs-slightly-better-auth:raw-cause\");\nconst SDK_HEADERS = Symbol.for(\"better-call:api-error-headers\");\n\nexport type AuthErrorCode = \"UNAUTHENTICATED\" | \"FORBIDDEN\" | \"RATE_LIMITED\";\n\n/** A transport-neutral denial. Only transports make it throwable. */\nexport interface AuthFailure {\n  readonly status: 401 | 403 | 429;\n  readonly code: AuthErrorCode;\n  readonly reason?: string;\n  readonly message: string;\n  readonly challenge?: string;\n  readonly headers?: Headers;\n}\n\nexport interface AuthErrorBody {\n  statusCode: 401 | 403 | 429;\n  error: string;\n  code: AuthErrorCode;\n  reason?: string;\n  message: string;\n}\n\nexport interface AuthGraphqlExtensions {\n  code: AuthErrorCode | \"INTERNAL_SERVER_ERROR\";\n  reason?: string;\n  statusCode: number;\n}\n\nexport interface AuthTransportErrorPayload {\n  status: \"error\";\n  statusCode: number;\n  code: AuthErrorCode;\n  reason?: string;\n  message: string;\n}\n\nexport interface ErrorMappingOptions {\n  map?: (\n    failure: AuthFailure,\n    context: ExecutionContext,\n    transport: string,\n  ) => unknown;\n  exposeRawCause?: boolean;\n}\n\nfunction branded<T extends object>(value: T, brand: symbol): T {\n  Object.defineProperty(value, brand, { value: true });\n  return value;\n}\n\nexport function isAuthFailure(value: unknown): value is AuthFailure {\n  return readErrorProperty(value, FAILURE_BRAND) === true;\n}\n\nexport function isInfrastructureError(\n  value: unknown,\n): value is BetterAuthInfrastructureError {\n  return readErrorProperty(value, INFRASTRUCTURE_BRAND) === true;\n}\n\nexport function isConfigurationError(\n  value: unknown,\n): value is BetterAuthConfigurationError {\n  return readErrorProperty(value, CONFIGURATION_BRAND) === true;\n}\n\nfunction sdkStatus(error: unknown): number | undefined {\n  try {\n    if (!isAPIError(error)) {\n      return undefined;\n    }\n    const status = readErrorProperty(error, \"statusCode\");\n    return typeof status === \"number\" &&\n      Number.isInteger(status) &&\n      status >= 100 &&\n      status <= 599\n      ? status\n      : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction sdkReason(error: unknown): string | undefined {\n  const reason = readErrorProperty(readErrorProperty(error, \"body\"), \"code\");\n  return typeof reason === \"string\" ? reason : undefined;\n}\n\n/** Internal: preserve cookie lines for the exchange's separately governed cleanup. */\nexport function getAPIErrorHeaders(error: unknown): Headers {\n  const result = new Headers();\n  for (const value of [\n    readErrorProperty(error, SDK_HEADERS),\n    readErrorProperty(error, \"headers\"),\n  ]) {\n    if (value === undefined || value === null) {\n      continue;\n    }\n    try {\n      const headers = new Headers(value as HeadersInit);\n      for (const [name, value] of headers) {\n        if (name !== \"set-cookie\") {\n          result.set(name, value);\n        }\n      }\n      for (const cookie of headers.getSetCookie()) {\n        result.append(\"set-cookie\", cookie);\n      }\n    } catch {\n      // A malformed optional header collection must not mask the original fault.\n    }\n  }\n  return result;\n}\n\nfunction rejection(input: {\n  status: 401 | 403 | 429;\n  reason?: string;\n  message?: string;\n  challenge?: string;\n  retryAfterSeconds?: number;\n}): AuthFailure {\n  const codes = {\n    401: \"UNAUTHENTICATED\",\n    403: \"FORBIDDEN\",\n    429: \"RATE_LIMITED\",\n  } as const;\n  const messages = {\n    401: \"Unauthorized\",\n    403: \"Forbidden\",\n    429: \"Too Many Requests\",\n  } as const;\n  const headers = new Headers();\n  const retry = input.retryAfterSeconds;\n  if (retry !== undefined && Number.isFinite(retry) && retry >= 0) {\n    headers.set(\"retry-after\", String(Math.ceil(retry)));\n  }\n  return branded(\n    {\n      status: input.status,\n      code: codes[input.status],\n      reason: input.reason,\n      message: input.message ?? messages[input.status],\n      challenge: input.challenge,\n      ...(headers.has(\"retry-after\") ? { headers } : {}),\n    },\n    FAILURE_BRAND,\n  );\n}\n\nexport const AuthFailures = {\n  unauthenticated(message?: string): AuthFailure {\n    return rejection({ status: 401, message });\n  },\n  rejected: rejection,\n  forbidden(reason: string, message?: string): AuthFailure {\n    return rejection({ status: 403, reason, message });\n  },\n  fromAPIError(error: unknown): AuthFailure | null {\n    const status = sdkStatus(error);\n    if (status !== 401 && status !== 403 && status !== 429) {\n      return null;\n    }\n    const originalHeaders = getAPIErrorHeaders(error);\n    const details = readErrorProperty(\n      readErrorProperty(error, \"body\"),\n      \"details\",\n    );\n    const delay = readErrorProperty(details, \"tryAgainIn\");\n    const failure = rejection({\n      status,\n      reason: sdkReason(error),\n      challenge: originalHeaders.get(\"www-authenticate\") ?? undefined,\n      retryAfterSeconds:\n        status === 429 && typeof delay === \"number\" ? delay / 1000 : undefined,\n    });\n    const retryAfter = originalHeaders.get(\"retry-after\");\n    if (retryAfter !== null) {\n      const headers = new Headers(failure.headers);\n      headers.set(\"retry-after\", retryAfter);\n      return branded({ ...failure, headers }, FAILURE_BRAND);\n    }\n    return failure;\n  },\n};\n\nexport class BetterAuthConfigurationError extends Error {\n  readonly code: string;\n  readonly detail: string;\n  readonly site?: string;\n  readonly hint?: string;\n  readonly phase: \"boot\" | \"request\";\n  readonly extensions = {\n    code: \"INTERNAL_SERVER_ERROR\",\n    reason: \"AUTH_MISCONFIGURED\",\n    statusCode: 500,\n  } as const;\n  readonly issues?: readonly BetterAuthConfigurationError[];\n\n  constructor(code: string, detail: string, hint?: string) {\n    super(detail);\n    this.name = \"BetterAuthConfigurationError\";\n    this.code = code;\n    this.detail = detail;\n    this.hint = hint;\n    this.phase = \"boot\";\n    branded(this, CONFIGURATION_BRAND);\n  }\n\n  static atRequest(\n    code: string,\n    detail: string,\n    options?: { site?: string; hint?: string },\n  ): BetterAuthConfigurationError {\n    const error = new BetterAuthConfigurationError(\n      code,\n      \"Authentication is misconfigured\",\n      options?.hint,\n    );\n    Object.defineProperties(error, {\n      detail: { value: detail, enumerable: true },\n      site: { value: options?.site, enumerable: true },\n      phase: { value: \"request\", enumerable: true },\n    });\n    return error;\n  }\n}\n\nexport class BetterAuthInfrastructureError extends Error {\n  readonly cause: Error;\n  readonly extensions = {\n    code: \"INTERNAL_SERVER_ERROR\",\n    reason: \"AUTH_UNAVAILABLE\",\n    statusCode: 500,\n  } as const;\n\n  constructor(cause: unknown, options?: { secrets?: readonly string[] }) {\n    super(\"Authentication service unavailable\");\n    this.name = \"BetterAuthInfrastructureError\";\n    this.cause = new ErrorRedactor(options).redact(cause);\n    branded(this, INFRASTRUCTURE_BRAND);\n  }\n}\n\n/** Internal factory for an instance's explicit diagnostic opt-in, never global state. */\nexport function createInfrastructureError(\n  cause: unknown,\n  options?: ErrorRedactorOptions & { exposeRawCause?: boolean },\n): BetterAuthInfrastructureError {\n  // Preserve request-owned redaction inputs without widening the public constructor.\n  const error = new BetterAuthInfrastructureError(cause, options);\n  if (options?.exposeRawCause === true) {\n    Object.defineProperty(error, RAW_CAUSE, {\n      value: cause,\n      enumerable: false,\n    });\n  }\n  return error;\n}\n\nexport function getRawCause(error: BetterAuthInfrastructureError): unknown {\n  return readErrorProperty(error, RAW_CAUSE);\n}\n\n/** Internal: evaluation must distinguish session loss from a failed session read. */\nexport interface SessionLossCandidate {\n  readonly sessionLoss: unknown;\n  readonly reason?: string;\n}\n\n/** Internal safety net. Evaluation performs the authoritative session-loss recheck. */\nexport function normalizeThrown(\n  error: unknown,\n  where: \"source\" | \"policy\",\n  site: string,\n  secrets: readonly string[],\n  options?: { exposeRawCause?: boolean },\n): AuthFailure | SessionLossCandidate {\n  if (isAuthFailure(error)) {\n    return error;\n  }\n  if (isInfrastructureError(error) || isConfigurationError(error)) {\n    throw error;\n  }\n  const status = sdkStatus(error);\n  const reason = sdkReason(error);\n  if (status === 429) {\n    return AuthFailures.fromAPIError(error)!;\n  }\n  if (\n    status === 401 &&\n    where === \"policy\" &&\n    (reason === undefined || reason === \"UNAUTHORIZED\")\n  ) {\n    return { sessionLoss: error, reason };\n  }\n  if (status === 401 || status === 403) {\n    return where === \"source\"\n      ? AuthFailures.fromAPIError(error)!\n      : AuthFailures.forbidden(reason ?? \"FORBIDDEN\");\n  }\n  if (status !== undefined && status < 500) {\n    throw BetterAuthConfigurationError.atRequest(\n      \"BETTER_AUTH_REJECTED_CALL\",\n      `better-auth rejected the library's call (${status} ${reason})`,\n      { site },\n    );\n  }\n  throw createInfrastructureError(error, {\n    secrets,\n    exposeRawCause: options?.exposeRawCause,\n  });\n}\n"],"mappings":";;;AAQA,SAAgB,kBAAkB,OAAgB,KAA2B;CAC3E,KACG,OAAO,UAAU,YAAY,UAAU,SACxC,OAAO,UAAU,YAEjB;CAEF,IAAI;EACF,OAAO,QAAQ,IAAI,OAAO,GAAG;CAC/B,QAAQ;EACN;CACF;AACF;AAEA,IAAa,gBAAb,MAA2B;CACzB;CAEA,YAAY,UAAgC,CAAC,GAAG;EAC9C,MAAM,yBAAS,IAAI,IAAY;EAC/B,MAAM,OAAO,UAAkB;GAC7B,IAAI,CAAC,OACH;GAEF,OAAO,IAAI,KAAK;GAChB,IAAI,UAAU;GACd,IAAI;IACF,UAAU,mBAAmB,KAAK;IAClC,OAAO,IAAI,OAAO;GACpB,QAAQ,CAER;GACA,KAAK,MAAM,QAAQ,CAAC,OAAO,OAAO,GAAG;IACnC,MAAM,YAAY,KAAK,YAAY,GAAG;IACtC,IAAI,aAAa,IACf,OAAO,IAAI,KAAK,MAAM,GAAG,SAAS,CAAC;GAEvC;EACF;EACA,KAAK,MAAM,SAAS,QAAQ,WAAW,CAAC,GACtC,IAAI,KAAK;EAEX,MAAM,UAAU,QAAQ;EACxB,KAAK,MAAM,WAAW,SAAS,IAAI,QAAQ,KAAK,GAAA,CAAI,MAAM,GAAG,GAAG;GAC9D,MAAM,YAAY,OAAO,QAAQ,GAAG;GACpC,IAAI,aAAa,GAAG;IAClB,MAAM,QAAQ,OAAO,MAAM,YAAY,CAAC,CAAC,CAAC,KAAK;IAC/C,IAAI,KAAK;IACT,IAAI,MAAM,WAAW,IAAG,KAAK,MAAM,SAAS,IAAG,GAC7C,IAAI,MAAM,MAAM,GAAG,EAAE,CAAC;GAE1B;EACF;EACA,MAAM,gBAAgB,SAAS,IAAI,eAAe;EAClD,IAAI,eAAe;GACjB,IAAI,aAAa;GACjB,MAAM,aAAa,eAAe,KAAK,aAAa,CAAC,GAAG;GACxD,IAAI,YACF,IAAI,UAAU;EAElB;EACA,KAAK,MAAM,QAAQ,QAAQ,qBAAqB,CAAC,GAAG;GAClD,MAAM,QAAQ,SAAS,IAAI,IAAI;GAC/B,IAAI,OACF,IAAI,KAAK;EAEb;EACA,KAAK,WAAW,CAAC,GAAG,MAAM,CAAC,CAAC,MACzB,MAAM,UAAU,MAAM,SAAS,KAAK,MACvC;CACF;CAEA,OAAO,OAAuB;EAC5B,OAAO,KAAK,YAAY,OAAO,mBAAG,IAAI,IAAI,CAAC;CAC7C;CAEA,eAAuB,OAAuB;EAC5C,KAAK,MAAM,UAAU,KAAK,UACxB,QAAQ,MAAM,MAAM,MAAM,CAAC,CAAC,KAAK,YAAY;EAE/C,OAAO;CACT;CAEA,WAAmB,OAAuB;EACxC,OAAO,KAAK,eAAe,KAAK,CAAC,CAC9B,MAAM,UAAU,CAAC,CAAC,CAAC,EAAE,CACrB,MAAM,GAAG,GAAG;CACjB;CAEA,YACE,OACA,OACA,MACO;EACP,MAAM,UAAU,kBAAkB,OAAO,SAAS;EAClD,MAAM,QAAQ,IAAI,MAChB,KAAK,WACH,OAAO,YAAY,WACf,UACA,OAAO,UAAU,WACf,QACA,+CACR,CACF;EACA,MAAM,OAAO,kBAAkB,OAAO,MAAM;EAC5C,MAAM,OAAO,OAAO,SAAS,WAAW,KAAK,WAAW,IAAI,IAAI;EAChE,KAAK,MAAM,OAAO;GAAC;GAAQ;GAAS;EAAS,GAAY;GACvD,MAAM,QAAQ,kBAAkB,OAAO,GAAG;GAC1C,IACE,OAAO,UAAU,YAChB,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,GAEnD,OAAO,eAAe,OAAO,KAAK;IAChC,OAAO,OAAO,UAAU,WAAW,KAAK,WAAW,KAAK,IAAI;IAC5D,YAAY;GACd,CAAC;EAEL;EACA,MAAM,QAAQ,kBAAkB,OAAO,OAAO;EAC9C,MAAM,SACJ,OAAO,UAAU,WACb,MACG,MAAM,OAAO,CAAC,CACd,QAAQ,SAAS,wBAAwB,KAAK,IAAI,CAAC,CAAC,CACpD,KAAK,SAAS,KAAK,eAAe,IAAI,CAAC,IAC1C,CAAC;EACP,MAAM,QAAQ,CAAC,GAAG,MAAM,KAAK,IAAI,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,KAAK,IAAI;EACtE,KAAK,IAAI,KAAK;EACd,MAAM,SAAS,kBAAkB,OAAO,OAAO;EAC/C,IAAI,WAAW,KAAA,KAAa,QAAQ,KAAK,CAAC,KAAK,IAAI,MAAM,GACvD,OAAO,eAAe,OAAO,SAAS;GACpC,OAAO,KAAK,YAAY,QAAQ,QAAQ,GAAG,IAAI;GAC/C,YAAY;EACd,CAAC;EAEH,OAAO;CACT;AACF;;;ACxIA,MAAM,gBAAgB,OAAO,IAAI,0CAA0C;AAC3E,MAAM,uBAAuB,OAAO,IAClC,kDACF;AACA,MAAM,sBAAsB,OAAO,IACjC,iDACF;AACA,MAAM,YAAY,OAAO,IAAI,uCAAuC;AACpE,MAAM,cAAc,OAAO,IAAI,+BAA+B;AA6C9D,SAAS,QAA0B,OAAU,OAAkB;CAC7D,OAAO,eAAe,OAAO,OAAO,EAAE,OAAO,KAAK,CAAC;CACnD,OAAO;AACT;AAEA,SAAgB,cAAc,OAAsC;CAClE,OAAO,kBAAkB,OAAO,aAAa,MAAM;AACrD;AAEA,SAAgB,sBACd,OACwC;CACxC,OAAO,kBAAkB,OAAO,oBAAoB,MAAM;AAC5D;AAEA,SAAgB,qBACd,OACuC;CACvC,OAAO,kBAAkB,OAAO,mBAAmB,MAAM;AAC3D;AAEA,SAAS,UAAU,OAAoC;CACrD,IAAI;EACF,IAAI,EAAA,GAACA,gBAAAA,WAAAA,CAAW,KAAK,GACnB;EAEF,MAAM,SAAS,kBAAkB,OAAO,YAAY;EACpD,OAAO,OAAO,WAAW,YACvB,OAAO,UAAU,MAAM,KACvB,UAAU,OACV,UAAU,MACR,SACA,KAAA;CACN,QAAQ;EACN;CACF;AACF;AAEA,SAAS,UAAU,OAAoC;CACrD,MAAM,SAAS,kBAAkB,kBAAkB,OAAO,MAAM,GAAG,MAAM;CACzE,OAAO,OAAO,WAAW,WAAW,SAAS,KAAA;AAC/C;;AAGA,SAAgB,mBAAmB,OAAyB;CAC1D,MAAM,SAAS,IAAI,QAAQ;CAC3B,KAAK,MAAM,SAAS,CAClB,kBAAkB,OAAO,WAAW,GACpC,kBAAkB,OAAO,SAAS,CACpC,GAAG;EACD,IAAI,UAAU,KAAA,KAAa,UAAU,MACnC;EAEF,IAAI;GACF,MAAM,UAAU,IAAI,QAAQ,KAAoB;GAChD,KAAK,MAAM,CAAC,MAAM,UAAU,SAC1B,IAAI,SAAS,cACX,OAAO,IAAI,MAAM,KAAK;GAG1B,KAAK,MAAM,UAAU,QAAQ,aAAa,GACxC,OAAO,OAAO,cAAc,MAAM;EAEtC,QAAQ,CAER;CACF;CACA,OAAO;AACT;AAEA,SAAS,UAAU,OAMH;CACd,MAAM,QAAQ;EACZ,KAAK;EACL,KAAK;EACL,KAAK;CACP;CACA,MAAM,WAAW;EACf,KAAK;EACL,KAAK;EACL,KAAK;CACP;CACA,MAAM,UAAU,IAAI,QAAQ;CAC5B,MAAM,QAAQ,MAAM;CACpB,IAAI,UAAU,KAAA,KAAa,OAAO,SAAS,KAAK,KAAK,SAAS,GAC5D,QAAQ,IAAI,eAAe,OAAO,KAAK,KAAK,KAAK,CAAC,CAAC;CAErD,OAAO,QACL;EACE,QAAQ,MAAM;EACd,MAAM,MAAM,MAAM;EAClB,QAAQ,MAAM;EACd,SAAS,MAAM,WAAW,SAAS,MAAM;EACzC,WAAW,MAAM;EACjB,GAAI,QAAQ,IAAI,aAAa,IAAI,EAAE,QAAQ,IAAI,CAAC;CAClD,GACA,aACF;AACF;AAEA,MAAa,eAAe;CAC1B,gBAAgB,SAA+B;EAC7C,OAAO,UAAU;GAAE,QAAQ;GAAK;EAAQ,CAAC;CAC3C;CACA,UAAU;CACV,UAAU,QAAgB,SAA+B;EACvD,OAAO,UAAU;GAAE,QAAQ;GAAK;GAAQ;EAAQ,CAAC;CACnD;CACA,aAAa,OAAoC;EAC/C,MAAM,SAAS,UAAU,KAAK;EAC9B,IAAI,WAAW,OAAO,WAAW,OAAO,WAAW,KACjD,OAAO;EAET,MAAM,kBAAkB,mBAAmB,KAAK;EAKhD,MAAM,QAAQ,kBAJE,kBACd,kBAAkB,OAAO,MAAM,GAC/B,SAE8B,GAAS,YAAY;EACrD,MAAM,UAAU,UAAU;GACxB;GACA,QAAQ,UAAU,KAAK;GACvB,WAAW,gBAAgB,IAAI,kBAAkB,KAAK,KAAA;GACtD,mBACE,WAAW,OAAO,OAAO,UAAU,WAAW,QAAQ,MAAO,KAAA;EACjE,CAAC;EACD,MAAM,aAAa,gBAAgB,IAAI,aAAa;EACpD,IAAI,eAAe,MAAM;GACvB,MAAM,UAAU,IAAI,QAAQ,QAAQ,OAAO;GAC3C,QAAQ,IAAI,eAAe,UAAU;GACrC,OAAO,QAAQ;IAAE,GAAG;IAAS;GAAQ,GAAG,aAAa;EACvD;EACA,OAAO;CACT;AACF;AAEA,IAAa,+BAAb,MAAa,qCAAqC,MAAM;CACtD;CACA;CACA;CACA;CACA;CACA,aAAsB;EACpB,MAAM;EACN,QAAQ;EACR,YAAY;CACd;CACA;CAEA,YAAY,MAAc,QAAgB,MAAe;EACvD,MAAM,MAAM;EACZ,KAAK,OAAO;EACZ,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,KAAK,OAAO;EACZ,KAAK,QAAQ;EACb,QAAQ,MAAM,mBAAmB;CACnC;CAEA,OAAO,UACL,MACA,QACA,SAC8B;EAC9B,MAAM,QAAQ,IAAI,6BAChB,MACA,mCACA,SAAS,IACX;EACA,OAAO,iBAAiB,OAAO;GAC7B,QAAQ;IAAE,OAAO;IAAQ,YAAY;GAAK;GAC1C,MAAM;IAAE,OAAO,SAAS;IAAM,YAAY;GAAK;GAC/C,OAAO;IAAE,OAAO;IAAW,YAAY;GAAK;EAC9C,CAAC;EACD,OAAO;CACT;AACF;AAEA,IAAa,gCAAb,cAAmD,MAAM;CACvD;CACA,aAAsB;EACpB,MAAM;EACN,QAAQ;EACR,YAAY;CACd;CAEA,YAAY,OAAgB,SAA2C;EACrE,MAAM,oCAAoC;EAC1C,KAAK,OAAO;EACZ,KAAK,QAAQ,IAAI,cAAc,OAAO,CAAC,CAAC,OAAO,KAAK;EACpD,QAAQ,MAAM,oBAAoB;CACpC;AACF;;AAGA,SAAgB,0BACd,OACA,SAC+B;CAE/B,MAAM,QAAQ,IAAI,8BAA8B,OAAO,OAAO;CAC9D,IAAI,SAAS,mBAAmB,MAC9B,OAAO,eAAe,OAAO,WAAW;EACtC,OAAO;EACP,YAAY;CACd,CAAC;CAEH,OAAO;AACT;AAEA,SAAgB,YAAY,OAA+C;CACzE,OAAO,kBAAkB,OAAO,SAAS;AAC3C;;AASA,SAAgB,gBACd,OACA,OACA,MACA,SACA,SACoC;CACpC,IAAI,cAAc,KAAK,GACrB,OAAO;CAET,IAAI,sBAAsB,KAAK,KAAK,qBAAqB,KAAK,GAC5D,MAAM;CAER,MAAM,SAAS,UAAU,KAAK;CAC9B,MAAM,SAAS,UAAU,KAAK;CAC9B,IAAI,WAAW,KACb,OAAO,aAAa,aAAa,KAAK;CAExC,IACE,WAAW,OACX,UAAU,aACT,WAAW,KAAA,KAAa,WAAW,iBAEpC,OAAO;EAAE,aAAa;EAAO;CAAO;CAEtC,IAAI,WAAW,OAAO,WAAW,KAC/B,OAAO,UAAU,WACb,aAAa,aAAa,KAAK,IAC/B,aAAa,UAAU,UAAU,WAAW;CAElD,IAAI,WAAW,KAAA,KAAa,SAAS,KACnC,MAAM,6BAA6B,UACjC,6BACA,4CAA4C,OAAO,GAAG,OAAO,IAC7D,EAAE,KAAK,CACT;CAEF,MAAM,0BAA0B,OAAO;EACrC;EACA,gBAAgB,SAAS;CAC3B,CAAC;AACH"}

package/dist/express.cjs

@@ -0,0 +1,247 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_auth_errors = require("./auth-errors-CsERBNWI.cjs");
+const require_platform = require("./platform.cjs");
+let path_to_regexp = require("path-to-regexp");
+//#region src/express-platform.ts
+const RAW_BODY = Symbol.for("nestjs-slightly-better-auth:raw-body");
+function application(adapter) {
+	return adapter.getInstance();
+}
+function routerOptions(app) {
+	const router = app?.router;
+	if (typeof router !== "object" && typeof router !== "function" || router === null) throw new require_auth_errors.BetterAuthConfigurationError("UNSUPPORTED_EXPRESS_ROUTER", "The Express application does not expose its initialized router.", "Use Express 5.2.x with @nestjs/platform-express 12.x, or move controller routes outside the auth mount.");
+	const options = router;
+	if (typeof options.caseSensitive !== "boolean" || typeof options.strict !== "boolean") throw new require_auth_errors.BetterAuthConfigurationError("UNSUPPORTED_EXPRESS_ROUTER", "The initialized Express router does not expose compatible routing options.", "Use Express 5.2.x with @nestjs/platform-express 12.x, or move controller routes outside the auth mount.");
+	return {
+		caseSensitive: options.caseSensitive,
+		strict: options.strict
+	};
+}
+function routeMayOverlapMount(path, basePath) {
+	const tokens = (0, path_to_regexp.parse)(path).tokens;
+	let literalPrefix = "";
+	let dynamic = false;
+	for (const token of tokens) {
+		if (token.type !== "text") {
+			dynamic = true;
+			break;
+		}
+		literalPrefix += token.value;
+	}
+	const route = literalPrefix.toLowerCase();
+	const base = basePath.toLowerCase().replace(/(?<!\/)\/+$/, "") || "/";
+	if (base === "/") return route.startsWith("/");
+	if (!dynamic) {
+		const exact = route.replace(/(?<!\/)\/+$/, "") || "/";
+		return exact === base || exact.startsWith(`${base}/`);
+	}
+	if (base.startsWith(route)) return true;
+	return route === base || route.startsWith(`${base}/`);
+}
+function rawTarget(req) {
+	return req.originalUrl ?? req.url ?? "/";
+}
+function rawPath(req) {
+	const target = rawTarget(req);
+	const query = target.indexOf("?");
+	return query === -1 ? target : target.slice(0, query);
+}
+function declaredLength(headers, limit) {
+	const value = headers["content-length"];
+	const first = Array.isArray(value) ? value[0] : value;
+	if (typeof first !== "string" || !/^\d+$/.test(first)) return;
+	const parsed = Number(first);
+	return Number.isSafeInteger(parsed) ? parsed : limit + 1;
+}
+function requestUrl(req) {
+	const socket = req.socket;
+	return `${req.protocol ?? (socket.encrypted ? "https" : "http")}://${req.host ?? ""}${rawTarget(req)}`;
+}
+function isExpressRequest(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const req = value;
+	return typeof req.method === "string" && typeof req.headers === "object" && typeof req.res === "object" && req.res !== null && (req.res.req === void 0 || req.res.req === value);
+}
+function nativeResponse(value) {
+	if (typeof value !== "object" || value === null) return null;
+	const response = value;
+	return typeof response.setHeader === "function" && typeof response.getHeader === "function" ? value : null;
+}
+function proxyTrustOf(value) {
+	if (value === false || value === void 0) return {
+		mode: "none",
+		detail: "trust proxy = false"
+	};
+	if (value === true) return {
+		mode: "all",
+		detail: "trust proxy = true"
+	};
+	return {
+		mode: "partial",
+		detail: `trust proxy = ${typeof value === "function" ? "<function>" : Array.isArray(value) ? JSON.stringify(value) : String(value)}`
+	};
+}
+function abortOnDisconnect(req, res) {
+	const controller = new AbortController();
+	const abort = () => controller.abort();
+	req.once("aborted", abort);
+	res.once("close", abort);
+	if (req.aborted || res.destroyed) abort();
+	return {
+		signal: controller.signal,
+		dispose: () => {
+			req.removeListener("aborted", abort);
+			res.removeListener("close", abort);
+		}
+	};
+}
+/** Express-specific two-phase HTTP integration. */
+var ExpressPlatform = class {
+	options;
+	id = "express";
+	#warnedConsumedBody = false;
+	#applicationRoutes = [];
+	#application;
+	constructor(options = {}) {
+		this.options = options;
+	}
+	requests = {
+		isRequest: (value) => isExpressRequest(value),
+		isLive: (value) => isExpressRequest(value) && value.res?.writableEnded === false,
+		key: (value) => value,
+		headers: (value) => require_platform.toWebHeaders(value.headers),
+		request: (value) => {
+			const req = value;
+			return {
+				method: req.method ?? "GET",
+				url: requestUrl(req)
+			};
+		},
+		clientIp: (value) => this.clientIp(value),
+		param: (value, name) => {
+			const parameter = value.params?.[name];
+			return typeof parameter === "string" ? parameter : void 0;
+		},
+		cookieSink: (request, response) => {
+			const req = request;
+			const res = nativeResponse(response) ?? nativeResponse(req.res);
+			return res === null ? null : { append: (cookies) => require_platform.appendSetCookie(res, cookies) };
+		}
+	};
+	supports(adapter) {
+		return adapter.getType?.() === "express";
+	}
+	prepare(ctx) {
+		const app = application(ctx.adapter);
+		this.#application = app;
+		app.use((req, _res, next) => {
+			const binding = ctx.route(rawPath(req));
+			const method = (req.method ?? "GET").toUpperCase();
+			if (!binding || this.isApplicationRoute(method, rawPath(req)) || method === "GET" || method === "HEAD" || method === "OPTIONS" || !require_platform.mayHaveBody(method, req.headers)) {
+				next();
+				return;
+			}
+			const continueRequest = require_platform.bindAsyncContext(next);
+			if (req.readableEnded || req.readable === false) {
+				const recovered = require_platform.recoverConsumedBody(req);
+				req[RAW_BODY] = {
+					ok: true,
+					bytes: recovered ?? /* @__PURE__ */ new Uint8Array()
+				};
+				if (!this.#warnedConsumedBody) {
+					this.#warnedConsumedBody = true;
+					ctx.logger.warn("W_BODY_ALREADY_CONSUMED: an Express body parser ran before the auth capture; raw-signature webhooks may receive re-serialized bytes.");
+				}
+				continueRequest();
+				return;
+			}
+			require_platform.readBoundedBody(req, {
+				limit: binding.bodyLimit,
+				declaredLength: declaredLength(req.headers, binding.bodyLimit),
+				drainOnOverflow: true,
+				drainCap: Math.min(Number.MAX_SAFE_INTEGER, binding.bodyLimit * 8)
+			}).then((captured) => {
+				req[RAW_BODY] = captured;
+				continueRequest();
+			}, (error) => continueRequest(error));
+		});
+	}
+	applicationRoutes(routes, bindings) {
+		const bodyRoutes = routes.flatMap((route) => {
+			if ([
+				"GET",
+				"HEAD",
+				"OPTIONS"
+			].includes(route.method)) return [];
+			const paths = route.paths.filter((path) => bindings.some((binding) => routeMayOverlapMount(path, binding.basePath)));
+			return paths.length ? [{
+				...route,
+				paths
+			}] : [];
+		});
+		const conditional = bodyRoutes.find((route) => route.conditions.length > 0);
+		if (conditional) throw new require_auth_errors.BetterAuthConfigurationError("CONDITIONAL_ROUTE_SHADOW", `${conditional.source} at '${conditional.paths.join(", ")}' uses ${conditional.conditions.join(" and ")} routing under an auth mount.`, "Move the controller route outside the auth mount or make its host and version routing unconditional.");
+		if (bodyRoutes.length === 0) {
+			this.#applicationRoutes = [];
+			return;
+		}
+		const { caseSensitive, strict } = routerOptions(this.#application);
+		this.#applicationRoutes = Object.freeze(bodyRoutes.flatMap((route) => route.paths.map((path) => ({
+			method: route.method,
+			regexp: (0, path_to_regexp.pathToRegexp)(path, {
+				end: true,
+				sensitive: caseSensitive,
+				trailing: !strict
+			}).regexp
+		}))));
+	}
+	mount(ctx) {
+		application(ctx.adapter).use((req, res, next) => {
+			if (!ctx.binding.matches(rawPath(req))) {
+				next();
+				return;
+			}
+			const disconnect = abortOnDisconnect(req, res);
+			this.dispatch(ctx.binding, req, res, disconnect.signal).then(() => disconnect.dispose(), (error) => {
+				disconnect.dispose();
+				if (!disconnect.signal.aborted) next(error);
+			});
+		});
+	}
+	proxyTrust(adapter) {
+		return proxyTrustOf(application(adapter).get("trust proxy"));
+	}
+	clientIp(req) {
+		if (this.options.clientIp) return this.options.clientIp(req);
+		return req.ip ?? null;
+	}
+	isApplicationRoute(method, pathname) {
+		return this.#applicationRoutes.some((route) => (route.method === "ALL" || route.method === method) && route.regexp.test(pathname));
+	}
+	async dispatch(binding, req, res, signal) {
+		const captured = req[RAW_BODY];
+		if (captured && !captured.ok && captured.reason === "aborted" || signal.aborted) return;
+		const response = captured && !captured.ok && captured.reason === "too-large" ? binding.payloadTooLarge() : await binding.handle({
+			method: req.method ?? "GET",
+			url: requestUrl(req),
+			headers: require_platform.toWebHeaders(req.headers),
+			body: captured?.ok ? captured.bytes : null,
+			clientIp: this.clientIp(req),
+			platformRequest: req,
+			signal
+		});
+		if (signal.aborted) {
+			await response.body?.cancel().catch(() => void 0);
+			return;
+		}
+		await require_platform.writeWebResponse(res, response, { head: req.method?.toUpperCase() === "HEAD" });
+	}
+};
+function expressPlatform(options) {
+	return new ExpressPlatform(options);
+}
+//#endregion
+exports.ExpressPlatform = ExpressPlatform;
+exports.expressPlatform = expressPlatform;
+
+//# sourceMappingURL=express.cjs.map