srvx-nightly 0.11.21 → 0.11.22-20260711-160642-e093402

package/dist/_chunks/_trust-proxy.mjs

@@ -0,0 +1,58 @@
+function isTrustedProxy(trustProxy, remoteAddress) {
+	if (trustProxy === void 0 || trustProxy === false) return false;
+	if (trustProxy === true) return true;
+	if (trustProxy === "loopback") return isLoopbackAddress(remoteAddress);
+	if (remoteAddress === void 0) return false;
+	if (trustProxy.includes(remoteAddress)) return true;
+	const mapped = ipv4FromMapped(remoteAddress);
+	return mapped !== void 0 && trustProxy.includes(mapped);
+}
+function ipv4FromMapped(address) {
+	return address.startsWith("::ffff:") && address.includes(".") ? address.slice(7) : void 0;
+}
+function isLoopbackAddress(address) {
+	return !!address && (address === "::1" || address.startsWith("127.") || address.startsWith("::ffff:127."));
+}
+const HOST_RE = /^(\[(?:[A-Fa-f0-9:.]+)\]|(?:[A-Za-z0-9_-]+\.)*[A-Za-z0-9_-]+|(?:\d{1,3}\.){3}\d{1,3})(:\d{1,5})?$/;
+function forwardedHostHasPort(host) {
+	const bracket = host.lastIndexOf("]");
+	return bracket === -1 ? host.includes(":") : host.indexOf(":", bracket) !== -1;
+}
+function firstForwardedValue(value) {
+	if (!value) return;
+	return (Array.isArray(value) ? value[0] : value).split(",")[0].trim() || void 0;
+}
+const trustProxyPlugin = (server) => {
+	const trustProxy = server.options.trustProxy;
+	if (trustProxy === void 0 || trustProxy === false) return;
+	server.options.middleware.unshift((request, next) => {
+		applyTrustedProxy(request, trustProxy);
+		return next();
+	});
+};
+function applyTrustedProxy(request, trustProxy) {
+	if (!isTrustedProxy(trustProxy, request.ip)) return;
+	const headers = request.headers;
+	const forwardedProto = firstForwardedValue(headers.get("x-forwarded-proto"));
+	const forwardedHost = firstForwardedValue(headers.get("x-forwarded-host"));
+	if (forwardedProto || forwardedHost) {
+		const url = new URL(request.url);
+		if (forwardedProto === "https" || forwardedProto === "http") url.protocol = `${forwardedProto}:`;
+		if (forwardedHost && HOST_RE.test(forwardedHost)) {
+			url.host = forwardedHost;
+			if (url.port && !forwardedHostHasPort(forwardedHost)) url.port = "";
+		}
+		Object.defineProperty(request, "url", {
+			value: url.href,
+			enumerable: true,
+			configurable: true
+		});
+	}
+	const forwardedFor = firstForwardedValue(headers.get("x-forwarded-for"));
+	if (forwardedFor) Object.defineProperty(request, "ip", {
+		value: forwardedFor,
+		enumerable: true,
+		configurable: true
+	});
+}
+export { HOST_RE, firstForwardedValue, isTrustedProxy, trustProxyPlugin };

package/dist/_chunks/_utils2.mjs

@@ -72,4 +72,4 @@ function createWaitUntil() {
 		}
 	};
 }
-export { createWaitUntil, fmtURL, printListening, resolvePortAndHost, resolveTLSOptions, toNativeResponse };
+export { createWaitUntil, fmtURL, printListening, resolveCertOrKey, resolvePortAndHost, resolveTLSOptions, toNativeResponse };

package/dist/_chunks/types.d.mts

@@ -0,0 +1,363 @@
+import * as NodeHttp from "node:http";
+import * as NodeHttps from "node:https";
+import * as NodeHttp2 from "node:http2";
+import * as AWS from "aws-lambda";
+import * as NodeNet from "node:net";
+import * as Bun from "bun";
+import * as CF from "@cloudflare/workers-types";
+/**
+* Controls whether `X-Forwarded-*` headers (proto, host, for, and the HTTP/2
+* `:scheme` pseudo-header) are trusted when deriving request metadata.
+*
+* These headers are set by the client on the wire, so they can only be trusted
+* when a proxy you control sits in front and overwrites them. See
+* {@link ServerOptions.trustProxy}.
+*
+*   - `false` (default): never trust forwarded headers; derive protocol, host
+*     and client IP from the real transport only.
+*   - `true`: always trust forwarded headers.
+*   - `"loopback"`: trust only when the immediate peer is a loopback address
+*     (`127.0.0.0/8` or `::1`), i.e. a proxy running on the same host.
+*   - `string[]`: trust only when the immediate peer address is in the allowlist.
+*/
+type TrustProxyOption = boolean | "loopback" | string[];
+type MaybePromise<T> = T | Promise<T>;
+type IsAny<T> = Equal<T, any> extends true ? true : false;
+type Equal<X, Y> = (<T>() => T extends X ? 1 : 2) extends (<T>() => T extends Y ? 1 : 2) ? true : false;
+/**
+* Faster URL constructor with lazy access to pathname and search params (For Node, Deno, and Bun).
+*/
+declare const FastURL: typeof globalThis.URL;
+/**
+* Faster Response constructor optimized for Node.js (same as Response for other runtimes).
+*/
+declare const FastResponse: typeof globalThis.Response;
+/**
+* Create a new server instance.
+*/
+declare function serve(options: ServerOptions): Server;
+/**
+* Web fetch compatible request handler
+*/
+type ServerHandler = (request: ServerRequest) => MaybePromise<Response>;
+type ServerMiddleware = (request: ServerRequest, next: () => Response | Promise<Response>) => Response | Promise<Response>;
+type ServerPlugin = (server: Server) => void;
+/**
+* Server options
+*/
+interface ServerOptions {
+  /**
+  * The fetch handler handles incoming requests.
+  */
+  fetch: ServerHandler;
+  /**
+  * Handle lifecycle errors.
+  *
+  * @note This handler will set built-in Bun and Deno error handler.
+  */
+  error?: ErrorHandler;
+  /**
+  * Server middleware handlers to run before the main fetch handler.
+  */
+  middleware?: ServerMiddleware[];
+  /**
+  * Server plugins.
+  */
+  plugins?: ServerPlugin[];
+  /**
+  * If set to `true`, server will not start listening automatically.
+  */
+  manual?: boolean;
+  /**
+  * The port server should be listening to.
+  *
+  * Default is read from `PORT` environment variable or will be `3000`.
+  *
+  * **Tip:** You can set the port to `0` to use a random port.
+  */
+  port?: string | number;
+  /**
+  * The hostname (IP or resolvable host) server listener should bound to.
+  *
+  * When not provided, server with listen to all network interfaces by default.
+  *
+  * **Important:** If you are running a server that is not expected to be exposed to the network, use `hostname: "localhost"`.
+  */
+  hostname?: string;
+  /**
+  * Enabling this option allows multiple processes to bind to the same port, which is useful for load balancing.
+  *
+  * **Note:** Despite Node.js built-in behavior that has `exclusive` flag (opposite of `reusePort`) enabled by default, srvx uses non-exclusive mode for consistency.
+  */
+  reusePort?: boolean;
+  /**
+  * The protocol to use for the server.
+  *
+  * Possible values are `http` and `https`.
+  *
+  * If `protocol` is not set, Server will use `http` as the default protocol or `https` if both `tls.cert` and `tls.key` options are provided.
+  */
+  protocol?: "http" | "https";
+  /**
+  * If set to `true`, server will not print the listening address.
+  */
+  silent?: boolean;
+  /**
+  * Graceful shutdown on SIGINT and SIGTERM signals.
+  *
+  * Supported for Node.js, Deno and Bun runtimes.
+  *
+  * @default true (disabled in test and ci environments)
+  */
+  gracefulShutdown?: boolean | {
+    gracefulTimeout?: number;
+    forceTimeout?: number;
+  };
+  /**
+  * Maximum allowed size (in bytes) for the request body.
+  *
+  * As the body is read, its accumulated length is tracked and, once it exceeds
+  * this limit, reading is aborted and rejects with a `413`-style error (the error
+  * has `statusCode: 413`, `status: 413` and `code: "ERR_BODY_TOO_LARGE"`) so a
+  * handler can map it to an HTTP 413 (Payload Too Large) response.
+  *
+  * The limit covers the buffered reads (`request.text()` / `request.json()`) as
+  * well as the streamed body (`request.body`, and therefore `arrayBuffer()` /
+  * `blob()` / `bytes()` / `formData()`).
+  *
+  * Runtime support:
+  * - **Node**: enforced by srvx (body stream is size-limited).
+  * - **Bun**: mapped to Bun's native `maxRequestBodySize` (413 before the handler).
+  * - **Deno**: enforced by srvx (request body stream is size-limited).
+  *
+  * @default undefined (no limit)
+  */
+  maxRequestBodySize?: number;
+  /**
+  * Whether to trust `X-Forwarded-*` headers (`X-Forwarded-Proto`,
+  * `X-Forwarded-Host`, `X-Forwarded-For`, and the HTTP/2 `:scheme`) when
+  * deriving `request.url` and `request.ip`.
+  *
+  * Any client can send `X-Forwarded-Proto: https`, `X-Forwarded-Host` or
+  * `X-Forwarded-For`, so trusting them lets a request masquerade as `https:`,
+  * forge its host, or spoof its client IP. Only enable this when a proxy you
+  * control sits in front and overwrites the headers.
+  *
+  * - `false` (default): ignore the headers; use the real connection protocol,
+  *   the on-the-wire `Host` header and the socket peer address.
+  * - `true`: always trust the headers.
+  * - `"loopback"`: trust them only when the proxy connects from a loopback
+  *   address (`127.0.0.0/8` or `::1`).
+  * - `string[]`: trust them only when the proxy's address is in the list.
+  *
+  * Applies to the Node, AWS Lambda, Bun and Deno adapters.
+  *
+  * @default false
+  */
+  trustProxy?: TrustProxyOption;
+  /**
+  * TLS server options.
+  */
+  tls?: {
+    /**
+    * File path or inlined TLS certificate in PEM format (required).
+    */
+    cert?: string;
+    /**
+    * File path or inlined TLS private key in PEM format (required).
+    */
+    key?: string;
+    /**
+    * Passphrase for the private key (optional).
+    */
+    passphrase?: string;
+  };
+  /**
+  * Node.js server options.
+  */
+  node?: (NodeHttp.ServerOptions | NodeHttps.ServerOptions | NodeHttp2.ServerOptions) & NodeNet.ListenOptions & {
+    http2?: boolean;
+  };
+  /**
+  * Bun server options
+  *
+  * @docs https://bun.sh/docs/api/http
+  */
+  bun?: Omit<Bun.Serve.Options<any>, "fetch">;
+  /**
+  * Deno server options
+  *
+  * @docs https://docs.deno.com/api/deno/~/Deno.serve
+  */
+  deno?: Deno.ServeOptions;
+  /**
+  * Service worker options
+  */
+  serviceWorker?: {
+    /**
+    * The path to the service worker file to be registered.
+    */
+    url?: string;
+    /**
+    * The scope of the service worker.
+    *
+    */
+    scope?: string;
+  };
+}
+interface Server<Handler = ServerHandler> {
+  /**
+  * Current runtime name
+  */
+  readonly runtime: "node" | "deno" | "bun" | "bunny" | "cloudflare" | "service-worker" | "aws-lambda" | "generic";
+  /**
+  * Server options
+  */
+  readonly options: ServerOptions & {
+    middleware: ServerMiddleware[];
+  };
+  /**
+  * Server URL address.
+  */
+  readonly url?: string;
+  /**
+  * Node.js context.
+  */
+  readonly node?: {
+    server?: NodeHttp.Server | NodeHttp2.Http2Server;
+    handler: (req: NodeServerRequest, res: NodeServerResponse) => void | Promise<void>;
+  };
+  /**
+  * Bun context.
+  */
+  readonly bun?: {
+    server?: Bun.Server<any>;
+  };
+  /**
+  * Deno context.
+  */
+  readonly deno?: {
+    server?: Deno.HttpServer;
+  };
+  /**
+  * Server fetch handler
+  */
+  readonly fetch: Handler;
+  /**
+  * Start listening for incoming requests.
+  * When `manual` option is enabled, this method needs to be called explicitly to begin accepting connections.
+  */
+  serve(): void | Promise<Server<Handler>>;
+  /**
+  * Returns a promise that resolves when the server is ready.
+  */
+  ready(): Promise<Server<Handler>>;
+  /**
+  * Register a background task that the server should await before closing.
+  *
+  * Same as `request.waitUntil` but available at the server level for use outside of request handlers.
+  */
+  readonly waitUntil?: (promise: Promise<unknown>) => void;
+  /**
+  * Stop listening to prevent new connections from being accepted.
+  *
+  * By default, it does not cancel in-flight requests or websockets. That means it may take some time before all network activity stops.
+  *
+  * @param closeActiveConnections Immediately terminate in-flight requests, websockets, and stop accepting new connections.
+  * @default false
+  */
+  close(closeActiveConnections?: boolean): Promise<void>;
+}
+interface ServerRuntimeContext {
+  name: "node" | "deno" | "bun" | "bunny" | "cloudflare" | "aws-lambda" | (string & {});
+  /**
+  * Underlying Node.js server request info.
+  */
+  node?: {
+    req: NodeServerRequest;
+    res?: NodeServerResponse;
+  };
+  /**
+  * Underlying Deno server request info.
+  */
+  deno?: {
+    info: Deno.ServeHandlerInfo<Deno.NetAddr>;
+  };
+  /**
+  * Underlying Bun server request context.
+  */
+  bun?: {
+    server: Bun.Server<any>;
+  };
+  /**
+  * Underlying Cloudflare request context.
+  */
+  cloudflare?: {
+    context: CF.ExecutionContext;
+    env: IsAny<typeof import("cloudflare:workers")> extends true ? Record<string, unknown> : typeof import("cloudflare:workers").env;
+  };
+  awsLambda?: {
+    context: AWS.Context;
+    event: AWS.APIGatewayProxyEvent | AWS.APIGatewayProxyEventV2;
+  };
+  serviceWorker?: {
+    event: FetchEvent;
+  };
+  netlify?: {
+    context: any;
+  };
+  stormkit?: {
+    event: any;
+    context: any;
+  };
+  vercel?: {
+    context: {
+      waitUntil?: (promise: Promise<any>) => void;
+    };
+  };
+}
+interface ServerRequestContext {
+  [key: string]: unknown;
+}
+interface ServerRequest extends Request {
+  /**
+  * Access to Node.js native instance of request.
+  *
+  * See https://srvx.h3.dev/guide/node#noderequest
+  */
+  _request?: Request;
+  /**
+  * Access to the parsed URL
+  */
+  _url?: URL;
+  /**
+  * Runtime specific request context.
+  */
+  runtime?: ServerRuntimeContext;
+  /**
+  * IP address of the client.
+  */
+  ip?: string | undefined;
+  /**
+  * Arbitrary context related to the request.
+  */
+  context?: ServerRequestContext;
+  /**
+  * Tell the runtime about an ongoing operation that shouldn't close until the promise resolves.
+  */
+  waitUntil?: (promise: Promise<unknown>) => void | Promise<void>;
+}
+type FetchHandler = (request: Request) => Response | Promise<Response>;
+type ErrorHandler = (error: unknown) => Response | Promise<Response>;
+type BunFetchHandler = (request: Request, server?: Bun.Server<any>) => Response | Promise<Response>;
+type DenoFetchHandler = (request: Request, info?: Deno.ServeHandlerInfo<Deno.NetAddr>) => Response | Promise<Response>;
+type NodeServerRequest = NodeHttp.IncomingMessage | NodeHttp2.Http2ServerRequest;
+type NodeServerResponse = NodeHttp.ServerResponse | NodeHttp2.Http2ServerResponse;
+type NodeHttp1Handler = (req: NodeHttp.IncomingMessage, res: NodeHttp.ServerResponse) => void | Promise<void>;
+type NodeHttp2Handler = (req: NodeHttp2.Http2ServerRequest, res: NodeHttp2.Http2ServerResponse) => void | Promise<void>;
+type NodeHttpHandler = NodeHttp1Handler | NodeHttp2Handler;
+type NodeHTTP1Middleware = (req: NodeHttp.IncomingMessage, res: NodeHttp.ServerResponse, next: (error?: Error) => void) => unknown | Promise<unknown>;
+type NodeHTTP2Middleware = (req: NodeHttp2.Http2ServerRequest, res: NodeHttp2.Http2ServerResponse, next: (error?: Error) => void) => unknown | Promise<unknown>;
+type NodeHTTPMiddleware = NodeHTTP1Middleware | NodeHTTP2Middleware;
+type CloudflareFetchHandler = CF.ExportedHandlerFetchHandler;
+export { BunFetchHandler, CloudflareFetchHandler, DenoFetchHandler, ErrorHandler, FastResponse, FastURL, FetchHandler, NodeHTTP1Middleware, NodeHTTP2Middleware, NodeHTTPMiddleware, NodeHttp1Handler, NodeHttp2Handler, NodeHttpHandler, NodeServerRequest, NodeServerResponse, Server, ServerHandler, ServerMiddleware, ServerOptions, ServerPlugin, ServerRequest, ServerRequestContext, ServerRuntimeContext, TrustProxyOption, serve };

package/dist/adapters/aws-lambda.d.mts

@@ -1,4 +1,4 @@
-import { FetchHandler, ServerOptions } from "../types.mjs";
+import { FetchHandler, ServerOptions, TrustProxyOption } from "../_chunks/types.mjs";
 import * as AWS from "aws-lambda";
 type AWSLambdaResponseStream = NodeJS.WritableStream & {
   setContentType(contentType: string): void;
@@ -8,7 +8,7 @@ type AwsLambdaEvent = AWS.APIGatewayProxyEvent | AWS.APIGatewayProxyEventV2;
 type AWSLambdaHandler = (event: AwsLambdaEvent, context: AWS.Context) => MaybePromise<AWS.APIGatewayProxyResult | AWS.APIGatewayProxyResultV2>;
 type AWSLambdaStreamingHandler = (event: AwsLambdaEvent, responseStream: AWSLambdaResponseStream, context: AWS.Context) => MaybePromise<void>;
 declare function toLambdaHandler(options: ServerOptions): AWSLambdaHandler;
-declare function handleLambdaEvent(fetchHandler: FetchHandler, event: AwsLambdaEvent, context: AWS.Context): Promise<AWS.APIGatewayProxyResult | AWS.APIGatewayProxyResultV2>;
-declare function handleLambdaEventWithStream(fetchHandler: FetchHandler, event: AwsLambdaEvent, responseStream: AWSLambdaResponseStream, context: AWS.Context): Promise<void>;
+declare function handleLambdaEvent(fetchHandler: FetchHandler, event: AwsLambdaEvent, context: AWS.Context, trustProxy?: TrustProxyOption): Promise<AWS.APIGatewayProxyResult | AWS.APIGatewayProxyResultV2>;
+declare function handleLambdaEventWithStream(fetchHandler: FetchHandler, event: AwsLambdaEvent, responseStream: AWSLambdaResponseStream, context: AWS.Context, trustProxy?: TrustProxyOption): Promise<void>;
 declare function invokeLambdaHandler(handler: AWSLambdaHandler, request: Request): Promise<Response>;
 export { AWSLambdaHandler, type AWSLambdaResponseStream, AWSLambdaStreamingHandler, AwsLambdaEvent, handleLambdaEvent, handleLambdaEventWithStream, invokeLambdaHandler, toLambdaHandler };

package/dist/adapters/aws-lambda.mjs

@@ -1,6 +1,9 @@
 import { errorPlugin, wrapFetch } from "../_chunks/_plugins.mjs";
-function awsRequest(event, context) {
-	const req = new Request(awsEventURL(event), {
+import { firstForwardedValue, isTrustedProxy } from "../_chunks/_trust-proxy.mjs";
+function awsRequest(event, context, trustProxy) {
+	const sourceIp = awsEventIP(event);
+	const trusted = isTrustedProxy(trustProxy, sourceIp);
+	const req = new Request(awsEventURL(event, trusted), {
 		method: awsEventMethod(event),
 		headers: awsEventHeaders(event),
 		body: awsEventBody(event)
@@ -12,7 +15,7 @@ function awsRequest(event, context) {
 			context
 		}
 	};
-	req.ip = awsEventIP(event);
+	req.ip = awsEventClientIP(event, sourceIp, trusted);
 	return req;
 }
 function awsEventMethod(event) {
@@ -21,11 +24,18 @@ function awsEventMethod(event) {
 function awsEventIP(event) {
 	return event.requestContext?.http?.sourceIp || event.requestContext?.identity?.sourceIp;
 }
-function awsEventURL(event) {
-	const hostname = event.headers.host || event.headers.Host || event.requestContext?.domainName || ".";
+function awsEventClientIP(event, sourceIp, trusted) {
+	if (trusted) {
+		const forwarded = firstForwardedValue(event.headers["X-Forwarded-For"] || event.headers["x-forwarded-for"]);
+		if (forwarded) return forwarded;
+	}
+	return sourceIp;
+}
+function awsEventURL(event, trusted) {
 	const path = event.path || event.rawPath;
 	const query = awsEventQuery(event);
-	const protocol = (event.headers["X-Forwarded-Proto"] || event.headers["x-forwarded-proto"]) === "http" ? "http" : "https";
+	const hostname = (trusted ? firstForwardedValue(event.headers["X-Forwarded-Host"] || event.headers["x-forwarded-host"]) : void 0) || event.headers.host || event.headers.Host || event.requestContext?.domainName || ".";
+	const protocol = (trusted ? firstForwardedValue(event.headers["X-Forwarded-Proto"] || event.headers["x-forwarded-proto"]) : void 0) === "http" ? "http" : "https";
 	return new URL(`${path}${query ? `?${query}` : ""}`, `${protocol}://${hostname}`);
 }
 function awsEventQuery(event) {
@@ -253,16 +263,16 @@ function toLambdaHandler(options) {
 	const server = new AWSLambdaServer(options);
 	return (event, context) => server.fetch(event, context);
 }
-async function handleLambdaEvent(fetchHandler, event, context) {
-	const response = await fetchHandler(awsRequest(event, context));
+async function handleLambdaEvent(fetchHandler, event, context, trustProxy) {
+	const response = await fetchHandler(awsRequest(event, context, trustProxy));
 	return {
 		statusCode: response.status,
 		...awsResponseHeaders(response, event),
 		...await awsResponseBody(response)
 	};
 }
-async function handleLambdaEventWithStream(fetchHandler, event, responseStream, context) {
-	await awsStreamResponse(await fetchHandler(awsRequest(event, context)), responseStream, event);
+async function handleLambdaEventWithStream(fetchHandler, event, responseStream, context, trustProxy) {
+	await awsStreamResponse(await fetchHandler(awsRequest(event, context, trustProxy)), responseStream, event);
 }
 async function invokeLambdaHandler(handler, request) {
 	return awsResultToResponse(await handler(await requestToAwsEvent(request), createMockContext()));
@@ -279,7 +289,7 @@ var AWSLambdaServer = class {
 		for (const plugin of options.plugins || []) plugin(this);
 		errorPlugin(this);
 		const fetchHandler = wrapFetch(this);
-		this.fetch = (event, context) => handleLambdaEvent(fetchHandler, event, context);
+		this.fetch = (event, context) => handleLambdaEvent(fetchHandler, event, context, this.options.trustProxy);
 	}
 	serve() {}
 	ready() {

package/dist/adapters/bun.d.mts

@@ -1,4 +1,4 @@
-import { BunFetchHandler, Server, ServerOptions } from "../types.mjs";
+import { BunFetchHandler, Server, ServerOptions } from "../_chunks/types.mjs";
 import { FastURL } from "../_chunks/_url.mjs";
 import * as bun from "bun";
 declare const FastResponse: typeof globalThis.Response;

package/dist/adapters/bun.mjs

@@ -1,6 +1,7 @@
 import { FastURL } from "../_chunks/_url.mjs";
 import { createWaitUntil, fmtURL, printListening, resolvePortAndHost, resolveTLSOptions, toNativeResponse } from "../_chunks/_utils2.mjs";
 import { gracefulShutdownPlugin, wrapFetch } from "../_chunks/_plugins.mjs";
+import { trustProxyPlugin } from "../_chunks/_trust-proxy.mjs";
 const FastResponse = Response;
 function serve(options) {
 	return new BunServer(options);
@@ -19,6 +20,7 @@ var BunServer = class {
 			middleware: [...options.middleware || []]
 		};
 		for (const plugin of options.plugins || []) plugin(this);
+		trustProxyPlugin(this);
 		gracefulShutdownPlugin(this);
 		const fetchHandler = wrapFetch(this);
 		const loader = globalThis.__srvxLoader__;
@@ -41,6 +43,7 @@ var BunServer = class {
 				},
 				ip: {
 					enumerable: true,
+					configurable: true,
 					get() {
 						return server?.requestIP(request)?.address;
 					}

package/dist/adapters/bunny.d.mts

@@ -1,4 +1,4 @@
-import { Server, ServerOptions } from "../types.mjs";
+import { Server, ServerOptions } from "../_chunks/types.mjs";
 declare const FastURL: typeof globalThis.URL;
 declare const FastResponse: typeof globalThis.Response;
 declare function serve(options: ServerOptions): Server;

package/dist/adapters/cloudflare.d.mts

@@ -1,4 +1,4 @@
-import { Server, ServerOptions } from "../types.mjs";
+import { Server, ServerOptions } from "../_chunks/types.mjs";
 import * as CF from "@cloudflare/workers-types";
 declare const FastURL: typeof globalThis.URL;
 declare const FastResponse: typeof globalThis.Response;

package/dist/adapters/deno.d.mts

@@ -1,4 +1,4 @@
-import { DenoFetchHandler, Server, ServerOptions } from "../types.mjs";
+import { DenoFetchHandler, Server, ServerOptions } from "../_chunks/types.mjs";
 import { FastURL } from "../_chunks/_url.mjs";
 declare const FastResponse: typeof globalThis.Response;
 declare function serve(options: ServerOptions): DenoServer;

package/dist/adapters/deno.mjs

@@ -1,6 +1,7 @@
 import { FastURL } from "../_chunks/_url.mjs";
 import { createWaitUntil, fmtURL, printListening, resolvePortAndHost, resolveTLSOptions, toNativeResponse } from "../_chunks/_utils2.mjs";
 import { gracefulShutdownPlugin, wrapFetch } from "../_chunks/_plugins.mjs";
+import { trustProxyPlugin } from "../_chunks/_trust-proxy.mjs";
 import { limitRequestBody } from "../_chunks/_body-limit.mjs";
 const FastResponse = Response;
 function serve(options) {
@@ -22,6 +23,7 @@ var DenoServer = class {
 			middleware: [...options.middleware || []]
 		};
 		for (const plugin of options.plugins || []) plugin(this);
+		trustProxyPlugin(this);
 		gracefulShutdownPlugin(this);
 		const fetchHandler = wrapFetch(this);
 		const loader = globalThis.__srvxLoader__;
@@ -49,6 +51,7 @@ var DenoServer = class {
 				},
 				ip: {
 					enumerable: true,
+					configurable: true,
 					get() {
 						return (info?.remoteAddr)?.hostname;
 					}

package/dist/adapters/generic.d.mts

@@ -1,4 +1,4 @@
-import { Server, ServerOptions } from "../types.mjs";
+import { Server, ServerOptions } from "../_chunks/types.mjs";
 declare const FastURL: typeof globalThis.URL;
 declare const FastResponse: typeof globalThis.Response;
 declare function serve(options: ServerOptions): Server;

package/dist/adapters/node.d.mts

@@ -1,4 +1,4 @@
-import { FetchHandler, NodeHttpHandler, NodeServerRequest, NodeServerResponse, Server, ServerOptions, ServerRequest } from "../types.mjs";
+import { FetchHandler, NodeHttpHandler, NodeServerRequest, NodeServerResponse, Server, ServerOptions, ServerRequest, TrustProxyOption } from "../_chunks/types.mjs";
 import { FastURL } from "../_chunks/_url.mjs";
 import { Readable } from "node:stream";
 type NodeRequestContext = {
@@ -9,6 +9,11 @@ type NodeRequestContext = {
   * buffered reads and the streamed body. See `ServerOptions.maxRequestBodySize`.
   */
   maxRequestBodySize?: number;
+  /**
+  * Whether to trust `X-Forwarded-*` / `:scheme` headers when deriving the
+  * request protocol, host and client IP. See `ServerOptions.trustProxy`.
+  */
+  trustProxy?: TrustProxyOption;
 };
 declare const NodeRequest: {
   new (nodeCtx: NodeRequestContext): ServerRequest;
@@ -68,6 +73,7 @@ type AdapterMeta = {
 */
 declare function toNodeHandler(handler: FetchHandler & AdapterMeta, options?: {
   maxRequestBodySize?: number;
+  trustProxy?: TrustProxyOption;
 }): NodeHttpHandler & AdapterMeta;
 /**
 * Converts a Node.js HTTP handler into a Fetch API handler.

package/dist/adapters/node.mjs

@@ -1,6 +1,7 @@
 import { FastURL, lazyInherit } from "../_chunks/_url.mjs";
 import { createWaitUntil, fmtURL, printListening, resolvePortAndHost, resolveTLSOptions } from "../_chunks/_utils2.mjs";
 import { errorPlugin, gracefulShutdownPlugin, wrapFetch } from "../_chunks/_plugins.mjs";
+import { HOST_RE, firstForwardedValue, isTrustedProxy } from "../_chunks/_trust-proxy.mjs";
 import { createBodyTooLargeError, limitBodyStream } from "../_chunks/_body-limit.mjs";
 import nodeHTTP, { IncomingMessage, ServerResponse } from "node:http";
 import { Duplex, PassThrough, Readable, addAbortSignal } from "node:stream";
@@ -122,15 +123,16 @@ function streamBody(stream, nodeRes) {
 		nodeRes.off("error", streamCancel);
 	});
 }
-const HOST_RE = /^(\[(?:[A-Fa-f0-9:.]+)\]|(?:[A-Za-z0-9_-]+\.)*[A-Za-z0-9_-]+|(?:\d{1,3}\.){3}\d{1,3})(:\d{1,5})?$/;
 var NodeRequestURL = class extends FastURL {
-	constructor({ req }) {
+	constructor({ req, trusted = false }) {
 		const path = req.url || "/";
-		let host = req.headers.host || req.headers[":authority"];
+		const forwardedHost = trusted ? firstForwardedValue(req.headers["x-forwarded-host"]) : void 0;
+		let host = (forwardedHost && HOST_RE.test(forwardedHost) ? forwardedHost : void 0) || req.headers.host || req.headers[":authority"];
 		if (host && !HOST_RE.test(host)) host = "_invalid_";
 		else if (!host) if (req.socket) host = `${req.socket.localFamily === "IPv6" ? "[" + req.socket.localAddress + "]" : req.socket.localAddress}:${req.socket?.localPort || "80"}`;
 		else host = "localhost";
-		const protocol = req.socket?.encrypted || req.headers["x-forwarded-proto"] === "https" || req.headers[":scheme"] === "https" ? "https:" : "http:";
+		const forwardedProto = trusted ? firstForwardedValue(req.headers["x-forwarded-proto"]) : void 0;
+		const protocol = req.socket?.encrypted || forwardedProto === "https" || trusted && req.headers[":scheme"] === "https" ? "https:" : "http:";
 		if (path[0] === "/") {
 			const qIndex = path.indexOf("?");
 			super({
@@ -252,9 +254,15 @@ const NodeRequest = /* @__PURE__ */ (() => {
 		#headers;
 		#abortController;
 		#maxRequestBodySize;
+		#trustProxy;
+		#ip;
+		#ipResolved = false;
+		#remoteAddress;
+		#trusted;
 		constructor(ctx) {
 			this.#req = ctx.req;
 			this.#maxRequestBodySize = ctx.maxRequestBodySize;
+			this.#trustProxy = ctx.trustProxy;
 			this.runtime = {
 				name: "node",
 				node: ctx
@@ -263,15 +271,31 @@ const NodeRequest = /* @__PURE__ */ (() => {
 		static [Symbol.hasInstance](val) {
 			return val instanceof NativeRequest;
 		}
+		#resolveTrusted() {
+			if (this.#trusted === void 0) {
+				this.#remoteAddress = this.#req.socket?.remoteAddress;
+				this.#trusted = isTrustedProxy(this.#trustProxy, this.#remoteAddress);
+			}
+			return this.#trusted;
+		}
 		get ip() {
-			return this.#req.socket?.remoteAddress;
+			if (this.#ipResolved) return this.#ip;
+			this.#ipResolved = true;
+			if (this.#resolveTrusted()) {
+				const forwarded = firstForwardedValue(this.#req.headers["x-forwarded-for"]);
+				if (forwarded) return this.#ip = forwarded;
+			}
+			return this.#ip = this.#remoteAddress;
 		}
 		get method() {
 			if (this.#request) return this.#request.method;
 			return this.#req.method || "GET";
 		}
 		get _url() {
-			return this.#url ||= new NodeRequestURL({ req: this.#req });
+			return this.#url ||= new NodeRequestURL({
+				req: this.#req,
+				trusted: this.#resolveTrusted()
+			});
 		}
 		set _url(url) {
 			this.#url = url;
@@ -813,7 +837,8 @@ function toNodeHandler(handler, options) {
 		const res = handler(new NodeRequest({
 			req: nodeReq,
 			res: nodeRes,
-			maxRequestBodySize: options?.maxRequestBodySize
+			maxRequestBodySize: options?.maxRequestBodySize,
+			trustProxy: options?.trustProxy
 		}));
 		return res instanceof Promise ? res.then((resolvedRes) => sendNodeResponse(nodeRes, resolvedRes)) : sendNodeResponse(nodeRes, res);
 	}
@@ -867,7 +892,8 @@ var NodeServer = class {
 			const request = new NodeRequest({
 				req: nodeReq,
 				res: nodeRes,
-				maxRequestBodySize: this.options.maxRequestBodySize
+				maxRequestBodySize: this.options.maxRequestBodySize,
+				trustProxy: this.options.trustProxy
 			});
 			request.waitUntil = this.#wait?.waitUntil;
 			const res = fetchHandler(request);
@@ -891,11 +917,7 @@ var NodeServer = class {
 			port,
 			host,
 			exclusive: !this.options.reusePort,
-			...tls ? {
-				cert: tls.cert,
-				key: tls.key,
-				passphrase: tls.passphrase
-			} : {},
+			...tls,
 			...this.options.node
 		};
 		let server;

package/dist/adapters/service-worker.d.mts

@@ -1,4 +1,4 @@
-import { Server, ServerOptions, ServerRequest } from "../types.mjs";
+import { Server, ServerOptions, ServerRequest } from "../_chunks/types.mjs";
 declare const FastURL: typeof globalThis.URL;
 declare const FastResponse: typeof globalThis.Response;
 type ServiceWorkerHandler = (request: ServerRequest, event: FetchEvent) => Response | Promise<Response>;

package/dist/cli.mjs

@@ -179,7 +179,7 @@ function getResponseFormat(res) {
 }
 const srvxMeta = {
 	name: "srvx-nightly",
-	version: "0.11.21",
+	version: "0.11.22-20260711-160642-e093402",
 	description: "Universal Server."
 };
 function usage(mainOpts) {

package/dist/log.d.mts

@@ -1,4 +1,4 @@
-import { ServerMiddleware } from "./types.mjs";
+import { ServerMiddleware } from "./_chunks/types.mjs";
 interface LogOptions {}
 declare const log: (options?: LogOptions) => ServerMiddleware;
 export { LogOptions, log };

package/dist/mtls.d.mts

@@ -0,0 +1,114 @@
+import { ServerPlugin } from "./_chunks/types.mjs";
+import * as TLS from "node:tls";
+/**
+* TLS connection state for the current request.
+*
+* Available when the request was served over TLS. The peer certificate fields are populated only when the server requested a client certificate (`tls.requestCert`) and the client presented one.
+*
+* @note Available only on srvx's Node.js adapter — on Node.js, or on Deno (2.8+) via `node:https`. It is **not** available on Bun: neither native `Bun.serve` nor Bun's `node:http(s)` server exposes the peer certificate to the handler (they enforce `requestCert` / `rejectUnauthorized` at the handshake, but drop the certificate), so unlike Deno the `srvx/node` adapter is not a workaround. Verified against the real Bun runtime (Bun 1.3.14); `bun vitest` without the `--bun` flag silently falls back to Node, which can mask this. See https://github.com/oven-sh/bun/issues/16254
+*/
+interface ServerRequestTLS {
+  /**
+  * The client (peer) certificate, if one was requested and presented.
+  *
+  * Empty object (`{}`) if the peer did not provide a certificate.
+  */
+  peerCertificate?: TLS.PeerCertificate;
+  /**
+  * `true` if the peer certificate was signed by one of the trusted CAs.
+  */
+  authorized?: boolean;
+  /**
+  * The reason the peer certificate failed verification, if any.
+  */
+  authorizationError?: Error | string;
+  /**
+  * The negotiated TLS protocol version, e.g. `"TLSv1.3"`.
+  */
+  protocol?: string | null;
+  /**
+  * The negotiated cipher suite.
+  */
+  cipher?: TLS.CipherNameAndProtocol;
+}
+declare module "srvx" {
+  interface ServerRequest {
+    /**
+    * TLS connection state, including the client (peer) certificate for mutual TLS.
+    *
+    * Populated by the {@link mtls} plugin. `undefined` when the request was not served over TLS.
+    */
+    tls?: ServerRequestTLS | undefined;
+  }
+}
+declare module "./types.ts" {
+  interface ServerRequest {
+    tls?: ServerRequestTLS | undefined;
+  }
+}
+/**
+* Options for the {@link mtls} plugin.
+*/
+interface MTLSOptions {
+  /**
+  * File path(s) or inlined CA certificate(s) in PEM format used to verify client certificates.
+  *
+  * When set, the well-known Mozilla CAs are replaced by the provided ones.
+  */
+  ca?: string | string[];
+  /**
+  * Request a certificate from connecting clients.
+  *
+  * @default true
+  */
+  requestCert?: boolean;
+  /**
+  * Reject the TLS handshake itself when the client certificate is not signed by one of
+  * the trusted `ca` certificates — the connection never reaches the `fetch` handler, so
+  * checking `request.tls.authorized` in application code is unreachable at this setting.
+  *
+  * Set to `false` to let the handshake complete regardless and instead expose the
+  * unverified certificate via `request.tls` with `authorized: false`, so your handler
+  * can decide how to respond.
+  *
+  * @default true (Node.js default when `requestCert` is enabled)
+  */
+  rejectUnauthorized?: boolean;
+}
+/**
+* Mutual TLS (mTLS) plugin for the Node.js adapter.
+*
+* Requests a client certificate during the TLS handshake and exposes it — together
+* with the negotiated protocol and cipher — on {@link ServerRequestTLS | `request.tls`}.
+*
+* Only srvx's Node.js adapter can deliver this (`import { serve } from "srvx/node"`),
+* on Node.js or Deno (via `node:https`). Native `Deno.serve` / `Bun.serve` and Bun's
+* `node:http(s)` server do not expose the peer certificate, so the plugin throws there
+* rather than silently doing nothing. It also requires the server to be configured for
+* TLS (`tls.cert` / `tls.key`) and throws otherwise, since mutual TLS cannot run over
+* plain HTTP.
+*
+* With the default `rejectUnauthorized: true`, unauthenticated clients are rejected
+* during the TLS handshake and never reach the `fetch` handler. Set it to `false` to
+* let every handshake complete and enforce authorization yourself via
+* `request.tls.authorized`, as in the example below.
+*
+* @example
+* ```js
+* import { serve } from "srvx/node";
+* import { mtls } from "srvx/mtls";
+*
+* serve({
+*   tls: { cert, key },
+*   plugins: [mtls({ ca, requestCert: true, rejectUnauthorized: false })],
+*   fetch: (request) => {
+*     if (!request.tls?.authorized) {
+*       return new Response("client certificate required", { status: 401 });
+*     }
+*     return new Response(`Hello, ${request.tls.peerCertificate?.subject?.CN}`);
+*   },
+* });
+* ```
+*/
+declare function mtls(options?: MTLSOptions): ServerPlugin;
+export { MTLSOptions, ServerRequestTLS, mtls };

package/dist/mtls.mjs

@@ -0,0 +1,32 @@
+import { resolveCertOrKey } from "./_chunks/_utils2.mjs";
+function mtls(options = {}) {
+	return (server) => {
+		if (server.runtime !== "node") throw new Error(`[srvx] mtls() requires srvx's Node.js adapter (import { serve } from "srvx/node"). The "${server.runtime}" server cannot request or expose client certificates.`);
+		if ("Bun" in globalThis) throw new Error("[srvx] mtls() is not available on Bun: Bun does not expose the peer certificate to node:http(s) request handlers. See https://github.com/oven-sh/bun/issues/16254");
+		if (server.options.protocol === "http" || !server.options.tls?.cert || !server.options.tls?.key) throw new Error("[srvx] mtls() requires an HTTPS server: set `tls.cert` and `tls.key`. Mutual TLS cannot run over plain HTTP.");
+		let ca;
+		if (options.ca !== void 0) ca = (Array.isArray(options.ca) ? options.ca : [options.ca]).map((entry) => {
+			const resolved = resolveCertOrKey(entry);
+			if (!resolved) throw new TypeError("mtls() `ca` entries must be non-empty PEM strings or file paths.");
+			return resolved;
+		});
+		server.options.node = {
+			...server.options.node,
+			...ca ? { ca } : {},
+			requestCert: options.requestCert ?? true,
+			...options.rejectUnauthorized === void 0 ? {} : { rejectUnauthorized: options.rejectUnauthorized }
+		};
+		server.options.middleware.unshift((request, next) => {
+			const socket = request.runtime?.node?.req?.socket;
+			if (socket && typeof socket.getPeerCertificate === "function") request.tls = {
+				peerCertificate: socket.getPeerCertificate(),
+				authorized: socket.authorized,
+				authorizationError: socket.authorizationError ?? void 0,
+				protocol: socket.getProtocol?.() ?? void 0,
+				cipher: socket.getCipher?.()
+			};
+			return next();
+		});
+	};
+}
+export { mtls };

package/dist/static.d.mts

@@ -1,4 +1,4 @@
-import { ServerMiddleware } from "./types.mjs";
+import { ServerMiddleware } from "./_chunks/types.mjs";
 interface ServeStaticOptions {
   /**
   * The directory to serve static files from.

package/dist/tracing.d.mts

@@ -1,4 +1,4 @@
-import { Server, ServerMiddleware, ServerPlugin, ServerRequest } from "./types.mjs";
+import { Server, ServerMiddleware, ServerPlugin, ServerRequest } from "./_chunks/types.mjs";
 /**
 * @experimental Channel names, event types and config options may change in future releases.
 */

package/dist/types.d.mts

@@ -1,325 +1,2 @@
-import * as NodeHttp from "node:http";
-import * as NodeHttps from "node:https";
-import * as NodeHttp2 from "node:http2";
-import * as AWS from "aws-lambda";
-import * as NodeNet from "node:net";
-import * as Bun from "bun";
-import * as CF from "@cloudflare/workers-types";
-type MaybePromise<T> = T | Promise<T>;
-type IsAny<T> = Equal<T, any> extends true ? true : false;
-type Equal<X, Y> = (<T>() => T extends X ? 1 : 2) extends (<T>() => T extends Y ? 1 : 2) ? true : false;
-/**
-* Faster URL constructor with lazy access to pathname and search params (For Node, Deno, and Bun).
-*/
-declare const FastURL: typeof globalThis.URL;
-/**
-* Faster Response constructor optimized for Node.js (same as Response for other runtimes).
-*/
-declare const FastResponse: typeof globalThis.Response;
-/**
-* Create a new server instance.
-*/
-declare function serve(options: ServerOptions): Server;
-/**
-* Web fetch compatible request handler
-*/
-type ServerHandler = (request: ServerRequest) => MaybePromise<Response>;
-type ServerMiddleware = (request: ServerRequest, next: () => Response | Promise<Response>) => Response | Promise<Response>;
-type ServerPlugin = (server: Server) => void;
-/**
-* Server options
-*/
-interface ServerOptions {
-  /**
-  * The fetch handler handles incoming requests.
-  */
-  fetch: ServerHandler;
-  /**
-  * Handle lifecycle errors.
-  *
-  * @note This handler will set built-in Bun and Deno error handler.
-  */
-  error?: ErrorHandler;
-  /**
-  * Server middleware handlers to run before the main fetch handler.
-  */
-  middleware?: ServerMiddleware[];
-  /**
-  * Server plugins.
-  */
-  plugins?: ServerPlugin[];
-  /**
-  * If set to `true`, server will not start listening automatically.
-  */
-  manual?: boolean;
-  /**
-  * The port server should be listening to.
-  *
-  * Default is read from `PORT` environment variable or will be `3000`.
-  *
-  * **Tip:** You can set the port to `0` to use a random port.
-  */
-  port?: string | number;
-  /**
-  * The hostname (IP or resolvable host) server listener should bound to.
-  *
-  * When not provided, server with listen to all network interfaces by default.
-  *
-  * **Important:** If you are running a server that is not expected to be exposed to the network, use `hostname: "localhost"`.
-  */
-  hostname?: string;
-  /**
-  * Enabling this option allows multiple processes to bind to the same port, which is useful for load balancing.
-  *
-  * **Note:** Despite Node.js built-in behavior that has `exclusive` flag (opposite of `reusePort`) enabled by default, srvx uses non-exclusive mode for consistency.
-  */
-  reusePort?: boolean;
-  /**
-  * The protocol to use for the server.
-  *
-  * Possible values are `http` and `https`.
-  *
-  * If `protocol` is not set, Server will use `http` as the default protocol or `https` if both `tls.cert` and `tls.key` options are provided.
-  */
-  protocol?: "http" | "https";
-  /**
-  * If set to `true`, server will not print the listening address.
-  */
-  silent?: boolean;
-  /**
-  * Graceful shutdown on SIGINT and SIGTERM signals.
-  *
-  * Supported for Node.js, Deno and Bun runtimes.
-  *
-  * @default true (disabled in test and ci environments)
-  */
-  gracefulShutdown?: boolean | {
-    gracefulTimeout?: number;
-    forceTimeout?: number;
-  };
-  /**
-  * Maximum allowed size (in bytes) for the request body.
-  *
-  * As the body is read, its accumulated length is tracked and, once it exceeds
-  * this limit, reading is aborted and rejects with a `413`-style error (the error
-  * has `statusCode: 413`, `status: 413` and `code: "ERR_BODY_TOO_LARGE"`) so a
-  * handler can map it to an HTTP 413 (Payload Too Large) response.
-  *
-  * The limit covers the buffered reads (`request.text()` / `request.json()`) as
-  * well as the streamed body (`request.body`, and therefore `arrayBuffer()` /
-  * `blob()` / `bytes()` / `formData()`).
-  *
-  * Runtime support:
-  * - **Node**: enforced by srvx (body stream is size-limited).
-  * - **Bun**: mapped to Bun's native `maxRequestBodySize` (413 before the handler).
-  * - **Deno**: enforced by srvx (request body stream is size-limited).
-  *
-  * @default undefined (no limit)
-  */
-  maxRequestBodySize?: number;
-  /**
-  * TLS server options.
-  */
-  tls?: {
-    /**
-    * File path or inlined TLS certificate in PEM format (required).
-    */
-    cert?: string;
-    /**
-    * File path or inlined TLS private key in PEM format (required).
-    */
-    key?: string;
-    /**
-    * Passphrase for the private key (optional).
-    */
-    passphrase?: string;
-  };
-  /**
-  * Node.js server options.
-  */
-  node?: (NodeHttp.ServerOptions | NodeHttps.ServerOptions | NodeHttp2.ServerOptions) & NodeNet.ListenOptions & {
-    http2?: boolean;
-  };
-  /**
-  * Bun server options
-  *
-  * @docs https://bun.sh/docs/api/http
-  */
-  bun?: Omit<Bun.Serve.Options<any>, "fetch">;
-  /**
-  * Deno server options
-  *
-  * @docs https://docs.deno.com/api/deno/~/Deno.serve
-  */
-  deno?: Deno.ServeOptions;
-  /**
-  * Service worker options
-  */
-  serviceWorker?: {
-    /**
-    * The path to the service worker file to be registered.
-    */
-    url?: string;
-    /**
-    * The scope of the service worker.
-    *
-    */
-    scope?: string;
-  };
-}
-interface Server<Handler = ServerHandler> {
-  /**
-  * Current runtime name
-  */
-  readonly runtime: "node" | "deno" | "bun" | "bunny" | "cloudflare" | "service-worker" | "aws-lambda" | "generic";
-  /**
-  * Server options
-  */
-  readonly options: ServerOptions & {
-    middleware: ServerMiddleware[];
-  };
-  /**
-  * Server URL address.
-  */
-  readonly url?: string;
-  /**
-  * Node.js context.
-  */
-  readonly node?: {
-    server?: NodeHttp.Server | NodeHttp2.Http2Server;
-    handler: (req: NodeServerRequest, res: NodeServerResponse) => void | Promise<void>;
-  };
-  /**
-  * Bun context.
-  */
-  readonly bun?: {
-    server?: Bun.Server<any>;
-  };
-  /**
-  * Deno context.
-  */
-  readonly deno?: {
-    server?: Deno.HttpServer;
-  };
-  /**
-  * Server fetch handler
-  */
-  readonly fetch: Handler;
-  /**
-  * Start listening for incoming requests.
-  * When `manual` option is enabled, this method needs to be called explicitly to begin accepting connections.
-  */
-  serve(): void | Promise<Server<Handler>>;
-  /**
-  * Returns a promise that resolves when the server is ready.
-  */
-  ready(): Promise<Server<Handler>>;
-  /**
-  * Register a background task that the server should await before closing.
-  *
-  * Same as `request.waitUntil` but available at the server level for use outside of request handlers.
-  */
-  readonly waitUntil?: (promise: Promise<unknown>) => void;
-  /**
-  * Stop listening to prevent new connections from being accepted.
-  *
-  * By default, it does not cancel in-flight requests or websockets. That means it may take some time before all network activity stops.
-  *
-  * @param closeActiveConnections Immediately terminate in-flight requests, websockets, and stop accepting new connections.
-  * @default false
-  */
-  close(closeActiveConnections?: boolean): Promise<void>;
-}
-interface ServerRuntimeContext {
-  name: "node" | "deno" | "bun" | "bunny" | "cloudflare" | "aws-lambda" | (string & {});
-  /**
-  * Underlying Node.js server request info.
-  */
-  node?: {
-    req: NodeServerRequest;
-    res?: NodeServerResponse;
-  };
-  /**
-  * Underlying Deno server request info.
-  */
-  deno?: {
-    info: Deno.ServeHandlerInfo<Deno.NetAddr>;
-  };
-  /**
-  * Underlying Bun server request context.
-  */
-  bun?: {
-    server: Bun.Server<any>;
-  };
-  /**
-  * Underlying Cloudflare request context.
-  */
-  cloudflare?: {
-    context: CF.ExecutionContext;
-    env: IsAny<typeof import("cloudflare:workers")> extends true ? Record<string, unknown> : typeof import("cloudflare:workers").env;
-  };
-  awsLambda?: {
-    context: AWS.Context;
-    event: AWS.APIGatewayProxyEvent | AWS.APIGatewayProxyEventV2;
-  };
-  serviceWorker?: {
-    event: FetchEvent;
-  };
-  netlify?: {
-    context: any;
-  };
-  stormkit?: {
-    event: any;
-    context: any;
-  };
-  vercel?: {
-    context: {
-      waitUntil?: (promise: Promise<any>) => void;
-    };
-  };
-}
-interface ServerRequestContext {
-  [key: string]: unknown;
-}
-interface ServerRequest extends Request {
-  /**
-  * Access to Node.js native instance of request.
-  *
-  * See https://srvx.h3.dev/guide/node#noderequest
-  */
-  _request?: Request;
-  /**
-  * Access to the parsed URL
-  */
-  _url?: URL;
-  /**
-  * Runtime specific request context.
-  */
-  runtime?: ServerRuntimeContext;
-  /**
-  * IP address of the client.
-  */
-  ip?: string | undefined;
-  /**
-  * Arbitrary context related to the request.
-  */
-  context?: ServerRequestContext;
-  /**
-  * Tell the runtime about an ongoing operation that shouldn't close until the promise resolves.
-  */
-  waitUntil?: (promise: Promise<unknown>) => void | Promise<void>;
-}
-type FetchHandler = (request: Request) => Response | Promise<Response>;
-type ErrorHandler = (error: unknown) => Response | Promise<Response>;
-type BunFetchHandler = (request: Request, server?: Bun.Server<any>) => Response | Promise<Response>;
-type DenoFetchHandler = (request: Request, info?: Deno.ServeHandlerInfo<Deno.NetAddr>) => Response | Promise<Response>;
-type NodeServerRequest = NodeHttp.IncomingMessage | NodeHttp2.Http2ServerRequest;
-type NodeServerResponse = NodeHttp.ServerResponse | NodeHttp2.Http2ServerResponse;
-type NodeHttp1Handler = (req: NodeHttp.IncomingMessage, res: NodeHttp.ServerResponse) => void | Promise<void>;
-type NodeHttp2Handler = (req: NodeHttp2.Http2ServerRequest, res: NodeHttp2.Http2ServerResponse) => void | Promise<void>;
-type NodeHttpHandler = NodeHttp1Handler | NodeHttp2Handler;
-type NodeHTTP1Middleware = (req: NodeHttp.IncomingMessage, res: NodeHttp.ServerResponse, next: (error?: Error) => void) => unknown | Promise<unknown>;
-type NodeHTTP2Middleware = (req: NodeHttp2.Http2ServerRequest, res: NodeHttp2.Http2ServerResponse, next: (error?: Error) => void) => unknown | Promise<unknown>;
-type NodeHTTPMiddleware = NodeHTTP1Middleware | NodeHTTP2Middleware;
-type CloudflareFetchHandler = CF.ExportedHandlerFetchHandler;
-export { BunFetchHandler, CloudflareFetchHandler, DenoFetchHandler, ErrorHandler, FastResponse, FastURL, FetchHandler, NodeHTTP1Middleware, NodeHTTP2Middleware, NodeHTTPMiddleware, NodeHttp1Handler, NodeHttp2Handler, NodeHttpHandler, NodeServerRequest, NodeServerResponse, Server, ServerHandler, ServerMiddleware, ServerOptions, ServerPlugin, ServerRequest, ServerRequestContext, ServerRuntimeContext, serve };
+import { BunFetchHandler, CloudflareFetchHandler, DenoFetchHandler, ErrorHandler, FastResponse, FastURL, FetchHandler, NodeHTTP1Middleware, NodeHTTP2Middleware, NodeHTTPMiddleware, NodeHttp1Handler, NodeHttp2Handler, NodeHttpHandler, NodeServerRequest, NodeServerResponse, Server, ServerHandler, ServerMiddleware, ServerOptions, ServerPlugin, ServerRequest, ServerRequestContext, ServerRuntimeContext, TrustProxyOption, serve } from "./_chunks/types.mjs";
+export { BunFetchHandler, CloudflareFetchHandler, DenoFetchHandler, ErrorHandler, FastResponse, FastURL, FetchHandler, NodeHTTP1Middleware, NodeHTTP2Middleware, NodeHTTPMiddleware, NodeHttp1Handler, NodeHttp2Handler, NodeHttpHandler, NodeServerRequest, NodeServerResponse, Server, ServerHandler, ServerMiddleware, ServerOptions, ServerPlugin, ServerRequest, ServerRequestContext, ServerRuntimeContext, type TrustProxyOption, serve };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "srvx-nightly",
-  "version": "0.11.21",
+  "version": "0.11.22-20260711-160642-e093402",
   "description": "Universal Server.",
   "homepage": "https://srvx.h3.dev",
   "license": "MIT",
@@ -25,6 +25,7 @@
     "./service-worker": "./dist/adapters/service-worker.mjs",
     "./aws-lambda": "./dist/adapters/aws-lambda.mjs",
     "./cli": "./dist/cli.mjs",
+    "./mtls": "./dist/mtls.mjs",
     "./static": "./dist/static.mjs",
     "./log": "./dist/log.mjs",
     "./tracing": "./dist/tracing.mjs",