//#region src/auth/trusted-proxy.ts
/**
* RFC 7230 token — valid characters for an HTTP header name. Invalid names
* passed to `Headers.get()` throw a TypeError at runtime, which would
* otherwise surface as a 500 from every auth route.
*/
const HEADER_NAME_PATTERN = /^[!#$%&'*+\-.^_`|~0-9a-z]+$/;
/**
* Normalise a list of header names the way both the config path and any
* caller passing a pre-resolved list should do: trim, lowercase, drop
* empty, drop anything that isn't a valid RFC 7230 token. Invalid names
* would crash `Headers.get()` at runtime.
*/
function normalizeTrustedHeaders(names) {
	return names.map((h) => h.trim().toLowerCase()).filter((h) => h.length > 0 && HEADER_NAME_PATTERN.test(h));
}
function isValidHeaderName(name) {
	return HEADER_NAME_PATTERN.test(name);
}
/** Cache for the env-derived value. `null` means "not yet parsed". */
let _envCache = null;
function getEnvTrustedHeaders() {
	if (_envCache !== null) return _envCache;
	let raw;
	try {
		const importMetaEnv = import.meta.env;
		raw = (typeof process !== "undefined" ? process.env?.EMDASH_TRUSTED_PROXY_HEADERS : void 0) || importMetaEnv?.EMDASH_TRUSTED_PROXY_HEADERS;
	} catch {
		raw = void 0;
	}
	if (!raw) {
		_envCache = [];
		return _envCache;
	}
	_envCache = raw.split(",").map((s) => s.trim().toLowerCase()).filter((s) => s.length > 0 && isValidHeaderName(s));
	return _envCache;
}
/**
* Return the lowercased list of headers to trust for client-IP resolution.
*
* When `config?.trustedProxyHeaders` is explicitly set (even to `[]`), it
* wins. Otherwise fall through to the env var, then to `[]`.
*/
function getTrustedProxyHeaders(config) {
	if (config && config.trustedProxyHeaders !== void 0) return config.trustedProxyHeaders.map((h) => h.trim().toLowerCase()).filter((h) => h.length > 0 && isValidHeaderName(h));
	return getEnvTrustedHeaders();
}

//#endregion
export { normalizeTrustedHeaders as n, getTrustedProxyHeaders as t };
//# sourceMappingURL=trusted-proxy-VTPRiX2s.mjs.map