@nestjs-kit/better-auth 0.0.0-stage → 2.0.0

package/dist/plugin.mjs

@@ -0,0 +1,321 @@
+import { APIError, createAuthMiddleware, isAPIError, setShouldSkipSessionRefresh } from "better-auth/api";
+import { parseCookies } from "better-auth/cookies";
+import { createDefu } from "defu";
+//#region src/bridge-protocol.ts
+const BRIDGE_HANDLE = Symbol.for("@nestjs-kit/better-auth:bridge");
+//#endregion
+//#region src/database-hook-dispatcher.ts
+/**
+* Construct all dispatchers once; bindings supply only the late-bound methods.
+*
+* The dispatchers take the SDK's own parameter types, so they satisfy `databaseHooks` whatever
+* instance the program registers. Bound hooks declare `DatabaseHookData`, which adds the
+* registered instance's plugin and additional fields (for example admin()'s `banned`) to the
+* same rows; the dispatcher states that narrowing once when it forwards a payload.
+*/
+function createDatabaseDispatchers(getBinding, countUnbound) {
+	function operation(target) {
+		const before = async (...[data, ctx]) => {
+			const binding = getBinding();
+			if (!binding) {
+				countUnbound();
+				return;
+			}
+			const hooks = binding.database[target].before;
+			let accumulated = {};
+			let changed = false;
+			for (const hook of hooks) {
+				const result = await hook(target.endsWith(".create") ? {
+					...data,
+					...accumulated
+				} : data, ctx);
+				if (result === false) return false;
+				if (!target.endsWith(".delete") && result && typeof result === "object" && "data" in result) {
+					accumulated = {
+						...accumulated,
+						...result.data
+					};
+					changed = true;
+				}
+			}
+			return changed ? { data: accumulated } : void 0;
+		};
+		const after = async (...[data, ctx]) => {
+			const binding = getBinding();
+			if (!binding) {
+				countUnbound();
+				return;
+			}
+			for (const hook of binding.database[target].after) await hook(data, ctx);
+		};
+		return {
+			before,
+			after
+		};
+	}
+	return {
+		user: {
+			create: operation("user.create"),
+			update: operation("user.update"),
+			delete: operation("user.delete")
+		},
+		session: {
+			create: operation("session.create"),
+			update: operation("session.update"),
+			delete: operation("session.delete")
+		},
+		account: {
+			create: operation("account.create"),
+			update: operation("account.update"),
+			delete: operation("account.delete")
+		},
+		verification: {
+			create: operation("verification.create"),
+			update: operation("verification.update"),
+			delete: operation("verification.delete")
+		}
+	};
+}
+//#endregion
+//#region src/hook-dispatcher.ts
+const API_ERROR_HEADERS = Symbol.for("better-call:api-error-headers");
+const mergeContext = createDefu((object, key, value) => {
+	if (Array.isArray(object[key]) && Array.isArray(value)) {
+		object[key] = value;
+		return true;
+	}
+});
+function mergeHeaders(target, source) {
+	source?.forEach((value, key) => {
+		if (key === "set-cookie") target.append(key, value);
+		else target.set(key, value);
+	});
+}
+function errorHeaders(error) {
+	const attached = error[API_ERROR_HEADERS];
+	if (!attached && !error.headers) return;
+	const headers = new Headers(attached);
+	if (error.headers && error.headers !== attached) mergeHeaders(headers, new Headers(error.headers));
+	return headers;
+}
+/** Run each method through the SDK middleware so its cookie/header state is isolated. */
+async function runBefore(binding, ctx, scope) {
+	let accumulated = {};
+	for (const hook of binding.before) {
+		let matched;
+		try {
+			matched = hook.matches(ctx, scope);
+		} catch (error) {
+			ctx.context.logger.error("An error occurred during Nest hook matcher execution:", error);
+			throw new APIError("INTERNAL_SERVER_ERROR", { message: "An error occurred during hook matcher execution. Check the logs for more details." });
+		}
+		if (!matched) continue;
+		let result;
+		try {
+			result = await createAuthMiddleware(hook.run)({
+				...ctx,
+				returnHeaders: true
+			});
+		} catch (error) {
+			if (isAPIError(error)) ctx.responseHeaders = error[API_ERROR_HEADERS] ?? new Headers();
+			throw error;
+		}
+		ctx.context.responseHeaders ??= new Headers();
+		mergeHeaders(ctx.context.responseHeaders, result.headers);
+		const value = result.response;
+		if (value && typeof value === "object") {
+			if ("context" in value && typeof value.context === "object") {
+				const { headers, ...rest } = value.context;
+				if (headers instanceof Headers) {
+					const requestHeaders = accumulated.headers instanceof Headers ? accumulated.headers : new Headers();
+					headers.forEach((header, key) => {
+						requestHeaders.set(key, header);
+					});
+					accumulated.headers = requestHeaders;
+				}
+				accumulated = mergeContext(rest, accumulated);
+			} else return value;
+		}
+	}
+	return Object.keys(accumulated).length ? { context: accumulated } : void 0;
+}
+async function runAfter(binding, ctx, scope, relayMatcherError) {
+	for (const hook of binding.after) {
+		let matched;
+		try {
+			matched = hook.matches(ctx, scope);
+		} catch (error) {
+			if (!relayMatcherError) throw error;
+			relayMatcherError(error);
+			return;
+		}
+		if (!matched) continue;
+		let result;
+		try {
+			result = await createAuthMiddleware(hook.run)({
+				...ctx,
+				returnHeaders: true
+			});
+		} catch (error) {
+			if (!isAPIError(error)) throw error;
+			result = {
+				response: error,
+				headers: errorHeaders(error)
+			};
+		}
+		if (result.headers) {
+			ctx.context.responseHeaders ??= new Headers();
+			mergeHeaders(ctx.context.responseHeaders, result.headers);
+		}
+		if (result.response !== void 0) ctx.context.returned = result.response;
+	}
+	return ctx.context.returned;
+}
+//#endregion
+//#region src/plugin.ts
+const NESTJS_PLUGIN_ID = "@nestjs-kit/better-auth";
+const isRouter = (ctx) => "_flag" in ctx && ctx._flag === "router";
+const separator = "\0";
+function sessionToken(headers, ctx) {
+	return parseCookies(headers?.get("cookie") ?? "").get(ctx.context.authCookies.sessionToken.name) ?? "";
+}
+function credential(headers, ctx, extra) {
+	return [
+		sessionToken(headers, ctx),
+		headers?.get("authorization") ?? "",
+		...extra.map((name) => headers?.get(name) ?? "")
+	].join(separator);
+}
+function sameCredential(ctx, scope, extra) {
+	const call = credential(ctx.headers, ctx, extra);
+	return call === separator.repeat(extra.length + 1) || call === credential(scope.inbound?.(), ctx, extra);
+}
+/** Pure construction-time Better Auth plugin; the Nest kernel binds through a global symbol. */
+function nestjs(options = {}) {
+	let binding = null;
+	let registration;
+	let unboundDispatches = 0;
+	const endpointResults = /* @__PURE__ */ new WeakSet();
+	const afterMatcherErrors = /* @__PURE__ */ new WeakMap();
+	const scope = () => binding?.current();
+	const clientIpHeader = options.clientIpHeader === false ? null : options.clientIpHeader ?? `x-nestjs-kit-better-auth-ip-${globalThis.crypto.randomUUID().replaceAll("-", "")}`;
+	const handle = {
+		protocol: 4,
+		clientIpHeader,
+		get state() {
+			return binding === null ? "unbound" : binding.state === "closed" ? "closed" : "bound";
+		},
+		get unboundDispatches() {
+			return unboundDispatches;
+		},
+		bind(next) {
+			if (binding && binding.instance !== next.instance) throw new Error(`PLUGIN_SHARED_BETWEEN_INSTANCES: '${binding.instance}' and '${next.instance}'`);
+			if (binding?.owner === next.owner && registration) return registration;
+			if (binding?.state === "bootstrapped") throw new Error(`INSTANCE_ALREADY_BOUND: bound to ${binding.owner.description}`);
+			let tookOverFrom;
+			if (binding?.state === "initialized") {
+				tookOverFrom = binding.owner.description;
+				binding.state = "displaced";
+			}
+			binding = next;
+			unboundDispatches = 0;
+			registration = {
+				tookOverFrom,
+				close: () => {
+					next.state = "closed";
+				}
+			};
+			return registration;
+		},
+		producedByEndpoint(value) {
+			return typeof value === "object" && value !== null && endpointResults.has(value);
+		}
+	};
+	return {
+		id: NESTJS_PLUGIN_ID,
+		[BRIDGE_HANDLE]: handle,
+		init: () => ({ options: {
+			databaseHooks: createDatabaseDispatchers(() => binding, () => {
+				unboundDispatches++;
+			}),
+			...clientIpHeader ? { advanced: { ipAddress: { ipAddressHeaders: [clientIpHeader] } } } : {}
+		} }),
+		hooks: {
+			before: [
+				{
+					matcher: (ctx) => {
+						if (!binding) {
+							unboundDispatches++;
+							return false;
+						}
+						return !isRouter(ctx) && scope()?.cookies === null;
+					},
+					handler: createAuthMiddleware(async () => {
+						await setShouldSkipSessionRefresh(true);
+					})
+				},
+				{
+					matcher: (ctx) => {
+						if (!binding || isRouter(ctx)) return false;
+						const current = scope();
+						if (!current || current.internal) return false;
+						const check = current.checkCallerSession;
+						current.inbound?.();
+						const browser = current.browserHeaders?.();
+						const token = sessionToken(ctx.headers, ctx);
+						return !!check && token !== "" && token === sessionToken(browser, ctx);
+					},
+					handler: createAuthMiddleware(async (ctx) => {
+						scope()?.checkCallerSession?.(ctx.path, binding.instance);
+					})
+				},
+				{
+					matcher: () => binding !== null && binding.before.length > 0,
+					handler: createAuthMiddleware((ctx) => runBefore(binding, ctx, scope()))
+				}
+			],
+			after: [
+				{
+					matcher: () => binding !== null && binding.after.length > 0,
+					handler: createAuthMiddleware((ctx) => runAfter(binding, ctx, scope(), (error) => {
+						afterMatcherErrors.set(ctx.context, error);
+					}))
+				},
+				{
+					matcher: (ctx) => {
+						if (afterMatcherErrors.has(ctx.context)) {
+							const error = afterMatcherErrors.get(ctx.context);
+							afterMatcherErrors.delete(ctx.context);
+							throw error;
+						}
+						return binding !== null && !isRouter(ctx);
+					},
+					handler: createAuthMiddleware(async (ctx) => {
+						const value = ctx.context.returned;
+						if (typeof value === "object" && value !== null) endpointResults.add(value);
+					})
+				},
+				{
+					matcher: (ctx) => {
+						if (isRouter(ctx)) return false;
+						const current = scope();
+						return !!current?.cookies && current.forward !== "none";
+					},
+					handler: createAuthMiddleware(async (ctx) => {
+						const current = scope();
+						if (current.forward === "same-credential" && !sameCredential(ctx, current, binding.credentialHeaders)) {
+							binding.onDropped(ctx.path);
+							return;
+						}
+						const cookies = ctx.context.responseHeaders?.getSetCookie() ?? [];
+						if (cookies.length) current.cookies.append(cookies);
+					})
+				}
+			]
+		}
+	};
+}
+//#endregion
+export { NESTJS_PLUGIN_ID, nestjs };
+
+//# sourceMappingURL=plugin.mjs.map

package/dist/plugin.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.mjs","names":[],"sources":["../src/bridge-protocol.ts","../src/database-hook-dispatcher.ts","../src/hook-dispatcher.ts","../src/plugin.ts"],"sourcesContent":["import type { HookEndpointContext } from \"better-auth\";\nimport type { CookieSink, DatabaseHookTarget } from \"./auth-contracts.js\";\nimport type { DatabaseHookMethod } from \"./auth-types.js\";\n\nexport const BRIDGE_HANDLE = Symbol.for(\"@nestjs-kit/better-auth:bridge\");\nexport const EXTENSION_DEFINITION = Symbol.for(\n  \"@nestjs-kit/better-auth:extension\",\n);\nexport const UPGRADE_REQUEST = Symbol.for(\n  \"@nestjs-kit/better-auth:upgrade-request\",\n);\n\nexport interface BridgeHandle {\n  readonly protocol: 4; // checked by core (B04); v5: binding state and instance, the caller-session check\n  readonly clientIpHeader: string | null; // single source of truth for the header name (§6.8)\n  /** 'unbound' until the first bind(); 'bound' while an application's hooks are registered; 'closed' after its shutdown, hooks still registered. */\n  readonly state: \"unbound\" | \"bound\" | \"closed\";\n  /** Endpoint dispatches and database-hook dispatches (writes) seen before the first binding, reset by every bind() (B26). */\n  readonly unboundDispatches: number;\n  /**\n   * Registers the application's hooks and returns close(), which the kernel calls in onApplicationShutdown: a closed binding keeps\n   * dispatching until another application binds (§10.6). A second bind() from the same owner for the same instance is a no-op that\n   * returns the existing registration (NestMicroservice.init() runs lifecycle hooks twice); from the same owner for another instance it\n   * throws PLUGIN_SHARED_BETWEEN_INSTANCES (B03). Throws INSTANCE_ALREADY_BOUND if another bootstrapped application is bound; takes over\n   * a never-bootstrapped one (reported, B06) and a closed one (silently). A never-bootstrapped binding it takes over becomes\n   * 'displaced': an application whose init() was still running when another bound fails in onApplicationBootstrap (B06).\n   */\n  bind(binding: BridgeBinding): { close(): void; tookOverFrom?: string };\n  /** true when an endpoint returned `value` (an object) in a non-router dispatch observed while bound; false for before-hook short-circuits (LEAD-V37). */\n  producedByEndpoint(value: unknown): boolean;\n}\nexport interface BridgeBinding {\n  /** The application: compared by identity for the same-owner no-op; `description` goes into the B06 message. */\n  readonly owner: { readonly description: string };\n  /** The instance this plugin object serves; one plugin object serves one instance (B03). */\n  readonly instance: string;\n  /**\n   * 'initialized' at bind; the kernel sets 'bootstrapped' in onApplicationBootstrap; close() sets 'closed'; bind() of another\n   * application sets 'displaced' on an 'initialized' binding it takes over.\n   */\n  state: \"initialized\" | \"bootstrapped\" | \"closed\" | \"displaced\";\n  /** View of the kernel's RequestScope; the plugin never owns an AsyncLocalStorage. [C] */\n  current(): ScopeView | undefined;\n  /** Credential header names declared by the instance's principal sources (credential matching, §7.5). */\n  readonly credentialHeaders: readonly string[];\n  readonly before: readonly CompiledHook[]; // sorted by order, then discovery order\n  readonly after: readonly CompiledHook[];\n  readonly database: Readonly<{\n    [E in DatabaseHookTarget]: {\n      readonly before: readonly DatabaseHookMethod<E, \"before\">[];\n      readonly after: readonly DatabaseHookMethod<E, \"after\">[];\n    };\n  }>;\n  /** Debug log when the bridge drops a direct call's cookies because its credential is foreign. */\n  onDropped(path: string): void;\n}\nexport interface ScopeView {\n  /** Cookie-capable forwarding handlers have already passed the enforcing form check on every method/operation (§7.10). */\n  readonly cookies: CookieSink | null;\n  readonly forward: \"none\" | \"same-credential\" | \"any\";\n  readonly inbound: (() => Headers) | undefined;\n  readonly internal: boolean;\n  /**\n   * Present in EVERY handler scope whose transport exposes a browser leg, unless the plan's origin check is 'off' — enforcing or not,\n   * so safe methods and GraphQL queries are covered too (§7.5). Returns when this leg has a passing origin verdict for `instance`, or\n   * the single kernel disable predicate (§7.10 item 4) holds; a guard run without a passing verdict is insufficient. Otherwise throws the kernel's\n   * BetterAuthConfigurationError PUBLIC_HANDLER_USED_CALLER_SESSION.\n   */\n  readonly checkCallerSession?: (path: string, instance: string) => void;\n  /** The browser leg's OWN headers (TransportCall.browser.headers()), before any transport credential mapping replaced them; undefined\n   * when the transport exposes no browser leg. Entry 2 recognizes an ambiently carried session cookie with it. */\n  readonly browserHeaders: (() => Headers) | undefined;\n}\nexport interface CompiledHook {\n  /**\n   * Evaluate the user predicate once and let it throw. The dispatcher logs and\n   * converts before-hook matcher failures to APIError 500; after-hook matcher\n   * failures cross the next fixed SDK matcher boundary unchanged, so the SDK\n   * cannot recover them as handler APIErrors. Never swallow a failure as a\n   * non-match or evaluate the predicate again in run().\n   */\n  matches(ctx: HookEndpointContext, scope: ScopeView | undefined): boolean;\n  run(ctx: HookEndpointContext): Promise<unknown>;\n}\n","import type { BetterAuthOptions } from \"better-auth\";\nimport type { DatabaseHookTarget } from \"./auth-contracts.js\";\nimport type {\n  DatabaseHookData,\n  DatabaseHookResult,\n  DbHookFn,\n} from \"./auth-types.js\";\nimport type { BridgeBinding } from \"./bridge-protocol.js\";\n\n/**\n * Construct all dispatchers once; bindings supply only the late-bound methods.\n *\n * The dispatchers take the SDK's own parameter types, so they satisfy `databaseHooks` whatever\n * instance the program registers. Bound hooks declare `DatabaseHookData`, which adds the\n * registered instance's plugin and additional fields (for example admin()'s `banned`) to the\n * same rows; the dispatcher states that narrowing once when it forwards a payload.\n */\nexport function createDatabaseDispatchers(\n  getBinding: () => BridgeBinding | null,\n  countUnbound: () => void,\n): NonNullable<BetterAuthOptions[\"databaseHooks\"]> {\n  function operation<E extends DatabaseHookTarget>(target: E) {\n    const before = async (\n      ...[data, ctx]: Parameters<DbHookFn<E, \"before\">>\n    ): Promise<DatabaseHookResult<E, \"before\">> => {\n      const binding = getBinding();\n      if (!binding) {\n        countUnbound();\n        return undefined as DatabaseHookResult<E, \"before\">;\n      }\n      const hooks = binding.database[target].before;\n      let accumulated: Record<string, unknown> = {};\n      let changed = false;\n      for (const hook of hooks) {\n        const result = await hook(\n          (target.endsWith(\".create\")\n            ? { ...data, ...accumulated }\n            : data) as DatabaseHookData<E, \"before\">,\n          ctx,\n        );\n        if (result === false) {\n          return false as DatabaseHookResult<E, \"before\">;\n        }\n        if (\n          !target.endsWith(\".delete\") &&\n          result &&\n          typeof result === \"object\" &&\n          \"data\" in result\n        ) {\n          accumulated = { ...accumulated, ...result.data };\n          changed = true;\n        }\n      }\n      // A generic target cannot express the runtime delete narrowing. Delete\n      // never reaches this branch; the public binding keeps its void/false type.\n      return (\n        changed ? { data: accumulated } : undefined\n      ) as DatabaseHookResult<E, \"before\">;\n    };\n    const after = async (\n      ...[data, ctx]: Parameters<DbHookFn<E, \"after\">>\n    ): Promise<void> => {\n      const binding = getBinding();\n      if (!binding) {\n        countUnbound();\n        return;\n      }\n      for (const hook of binding.database[target].after) {\n        await hook(data as DatabaseHookData<E, \"after\">, ctx);\n      }\n    };\n    return { before, after };\n  }\n  return {\n    user: {\n      create: operation(\"user.create\"),\n      update: operation(\"user.update\"),\n      delete: operation(\"user.delete\"),\n    },\n    session: {\n      create: operation(\"session.create\"),\n      update: operation(\"session.update\"),\n      delete: operation(\"session.delete\"),\n    },\n    account: {\n      create: operation(\"account.create\"),\n      update: operation(\"account.update\"),\n      delete: operation(\"account.delete\"),\n    },\n    verification: {\n      create: operation(\"verification.create\"),\n      update: operation(\"verification.update\"),\n      delete: operation(\"verification.delete\"),\n    },\n  };\n}\n","import type { HookEndpointContext } from \"better-auth\";\nimport { APIError, createAuthMiddleware, isAPIError } from \"better-auth/api\";\nimport { createDefu } from \"defu\";\nimport type { BridgeBinding, ScopeView } from \"./bridge-protocol.js\";\n\nconst API_ERROR_HEADERS = Symbol.for(\"better-call:api-error-headers\");\nconst mergeContext = createDefu((object, key, value) => {\n  if (Array.isArray(object[key]) && Array.isArray(value)) {\n    object[key] = value;\n    return true;\n  }\n});\n\nfunction mergeHeaders(\n  target: Headers,\n  source: Headers | null | undefined,\n): void {\n  source?.forEach((value, key) => {\n    if (key === \"set-cookie\") {\n      target.append(key, value);\n    } else {\n      target.set(key, value);\n    }\n  });\n}\n\nfunction errorHeaders(error: APIError): Headers | undefined {\n  const attached = (error as unknown as Record<symbol, Headers | undefined>)[\n    API_ERROR_HEADERS\n  ];\n  if (!attached && !error.headers) {\n    return undefined;\n  }\n  const headers = new Headers(attached);\n  if (error.headers && error.headers !== attached) {\n    mergeHeaders(headers, new Headers(error.headers));\n  }\n  return headers;\n}\n\n/** Run each method through the SDK middleware so its cookie/header state is isolated. */\nexport async function runBefore(\n  binding: BridgeBinding,\n  ctx: HookEndpointContext,\n  scope: ScopeView | undefined,\n): Promise<unknown> {\n  let accumulated: Record<string, unknown> = {};\n  for (const hook of binding.before) {\n    let matched: boolean;\n    try {\n      matched = hook.matches(ctx, scope);\n    } catch (error) {\n      ctx.context.logger.error(\n        \"An error occurred during Nest hook matcher execution:\",\n        error,\n      );\n      throw new APIError(\"INTERNAL_SERVER_ERROR\", {\n        message:\n          \"An error occurred during hook matcher execution. Check the logs for more details.\",\n      });\n    }\n    if (!matched) {\n      continue;\n    }\n    let result: { response: unknown; headers: Headers };\n    try {\n      result = (await createAuthMiddleware(hook.run)({\n        ...ctx,\n        returnHeaders: true,\n      })) as { response: unknown; headers: Headers };\n    } catch (error) {\n      if (isAPIError(error)) {\n        // The enclosing SDK middleware reattaches its own header object. Keep\n        // the throwing method's headers, including non-enumerable cookie state.\n        ctx.responseHeaders =\n          (error as unknown as Record<symbol, Headers | undefined>)[\n            API_ERROR_HEADERS\n          ] ?? new Headers();\n      }\n      throw error;\n    }\n    ctx.context.responseHeaders ??= new Headers();\n    mergeHeaders(ctx.context.responseHeaders, result.headers);\n    const value = result.response;\n    if (value && typeof value === \"object\") {\n      if (\"context\" in value && typeof value.context === \"object\") {\n        const { headers, ...rest } = value.context as Record<string, unknown>;\n        if (headers instanceof Headers) {\n          const requestHeaders =\n            accumulated.headers instanceof Headers\n              ? accumulated.headers\n              : new Headers();\n          headers.forEach((header, key) => {\n            requestHeaders.set(key, header);\n          });\n          accumulated.headers = requestHeaders;\n        }\n        accumulated = mergeContext(rest, accumulated);\n      } else {\n        return value;\n      }\n    }\n  }\n  return Object.keys(accumulated).length ? { context: accumulated } : undefined;\n}\n\nexport async function runAfter(\n  binding: BridgeBinding,\n  ctx: HookEndpointContext,\n  scope: ScopeView | undefined,\n  relayMatcherError?: (error: unknown) => void,\n): Promise<unknown> {\n  for (const hook of binding.after) {\n    let matched: boolean;\n    try {\n      matched = hook.matches(ctx, scope);\n    } catch (error) {\n      if (!relayMatcherError) {\n        throw error;\n      }\n      // A surrounding SDK handler catches APIErrors as recoverable results.\n      // Stop here and rethrow from the next fixed SDK matcher instead.\n      relayMatcherError(error);\n      return undefined;\n    }\n    if (!matched) {\n      continue;\n    }\n    let result: { response: unknown; headers?: Headers | null };\n    try {\n      result = (await createAuthMiddleware(hook.run)({\n        ...ctx,\n        returnHeaders: true,\n      })) as { response: unknown; headers: Headers };\n    } catch (error) {\n      if (!isAPIError(error)) {\n        throw error;\n      }\n      result = { response: error, headers: errorHeaders(error) };\n    }\n    if (result.headers) {\n      ctx.context.responseHeaders ??= new Headers();\n      mergeHeaders(ctx.context.responseHeaders, result.headers);\n    }\n    if (result.response !== undefined) {\n      ctx.context.returned = result.response;\n    }\n  }\n  return ctx.context.returned;\n}\n","import type { BetterAuthPlugin, HookEndpointContext } from \"better-auth\";\nimport {\n  createAuthMiddleware,\n  setShouldSkipSessionRefresh,\n} from \"better-auth/api\";\nimport { parseCookies } from \"better-auth/cookies\";\nimport type { NestjsPluginOptions } from \"./auth-contracts.js\";\nimport {\n  BRIDGE_HANDLE,\n  type BridgeBinding,\n  type BridgeHandle,\n  type ScopeView,\n} from \"./bridge-protocol.js\";\nimport { createDatabaseDispatchers } from \"./database-hook-dispatcher.js\";\nimport { runAfter, runBefore } from \"./hook-dispatcher.js\";\n\nexport type { NestjsPluginOptions } from \"./auth-contracts.js\";\nexport const NESTJS_PLUGIN_ID = \"@nestjs-kit/better-auth\";\n\nconst isRouter = (ctx: object): boolean =>\n  \"_flag\" in ctx && ctx._flag === \"router\";\nconst separator = \"\\u0000\";\n\nfunction sessionToken(\n  headers: Headers | undefined,\n  ctx: HookEndpointContext,\n): string {\n  return (\n    parseCookies(headers?.get(\"cookie\") ?? \"\").get(\n      ctx.context.authCookies.sessionToken.name,\n    ) ?? \"\"\n  );\n}\n\nfunction credential(\n  headers: Headers | undefined,\n  ctx: HookEndpointContext,\n  extra: readonly string[],\n): string {\n  return [\n    sessionToken(headers, ctx),\n    headers?.get(\"authorization\") ?? \"\",\n    ...extra.map((name) => headers?.get(name) ?? \"\"),\n  ].join(separator);\n}\n\nfunction sameCredential(\n  ctx: HookEndpointContext,\n  scope: ScopeView,\n  extra: readonly string[],\n): boolean {\n  const call = credential(ctx.headers, ctx, extra);\n  return (\n    call === separator.repeat(extra.length + 1) ||\n    call === credential(scope.inbound?.(), ctx, extra)\n  );\n}\n\n/** Pure construction-time Better Auth plugin; the Nest kernel binds through a global symbol. */\nexport function nestjs(\n  options: NestjsPluginOptions = {},\n): BetterAuthPlugin & { id: typeof NESTJS_PLUGIN_ID } {\n  let binding: BridgeBinding | null = null;\n  let registration: ReturnType<BridgeHandle[\"bind\"]> | undefined;\n  let unboundDispatches = 0;\n  const endpointResults = new WeakSet<object>();\n  const afterMatcherErrors = new WeakMap<object, unknown>();\n  const scope = () => binding?.current();\n  const clientIpHeader =\n    options.clientIpHeader === false\n      ? null\n      : (options.clientIpHeader ??\n        `x-nestjs-kit-better-auth-ip-${globalThis.crypto.randomUUID().replaceAll(\"-\", \"\")}`);\n  const handle: BridgeHandle = {\n    protocol: 4,\n    clientIpHeader,\n    get state() {\n      return binding === null\n        ? \"unbound\"\n        : binding.state === \"closed\"\n          ? \"closed\"\n          : \"bound\";\n    },\n    get unboundDispatches() {\n      return unboundDispatches;\n    },\n    bind(next) {\n      if (binding && binding.instance !== next.instance) {\n        throw new Error(\n          `PLUGIN_SHARED_BETWEEN_INSTANCES: '${binding.instance}' and '${next.instance}'`,\n        );\n      }\n      if (binding?.owner === next.owner && registration) {\n        return registration;\n      }\n      if (binding?.state === \"bootstrapped\") {\n        throw new Error(\n          `INSTANCE_ALREADY_BOUND: bound to ${binding.owner.description}`,\n        );\n      }\n      let tookOverFrom: string | undefined;\n      if (binding?.state === \"initialized\") {\n        tookOverFrom = binding.owner.description;\n        // Its application may still be initializing: its bootstrap must fail rather than run without hooks.\n        binding.state = \"displaced\";\n      }\n      binding = next;\n      unboundDispatches = 0;\n      registration = {\n        tookOverFrom,\n        close: () => {\n          next.state = \"closed\";\n        },\n      };\n      return registration;\n    },\n    producedByEndpoint(value) {\n      return (\n        typeof value === \"object\" &&\n        value !== null &&\n        endpointResults.has(value)\n      );\n    },\n  };\n  const plugin = {\n    id: NESTJS_PLUGIN_ID,\n    [BRIDGE_HANDLE]: handle,\n    init: () => ({\n      options: {\n        databaseHooks: createDatabaseDispatchers(\n          () => binding,\n          () => {\n            unboundDispatches++;\n          },\n        ),\n        ...(clientIpHeader\n          ? { advanced: { ipAddress: { ipAddressHeaders: [clientIpHeader] } } }\n          : {}),\n      },\n    }),\n    hooks: {\n      before: [\n        {\n          matcher: (ctx) => {\n            if (!binding) {\n              unboundDispatches++;\n              return false;\n            }\n            return !isRouter(ctx) && scope()?.cookies === null;\n          },\n          handler: createAuthMiddleware(async () => {\n            await setShouldSkipSessionRefresh(true);\n          }),\n        },\n        {\n          matcher: (ctx) => {\n            if (!binding || isRouter(ctx)) {\n              return false;\n            }\n            const current = scope();\n            if (!current || current.internal) {\n              return false;\n            }\n            // Access capabilities before testing credentials: extraction errors\n            // must fail even a credential-free direct endpoint call.\n            const check = current.checkCallerSession;\n            current.inbound?.();\n            const browser = current.browserHeaders?.();\n            const token = sessionToken(ctx.headers, ctx);\n            // Only the browser leg's own cookie is ambient. A session cookie that a\n            // transport mapped in-band (graphql-ws connectionParams, socket\n            // credentials) cannot ride a cross-site request.\n            return (\n              !!check && token !== \"\" && token === sessionToken(browser, ctx)\n            );\n          },\n          handler: createAuthMiddleware(async (ctx) => {\n            scope()?.checkCallerSession?.(ctx.path, binding!.instance);\n          }),\n        },\n        {\n          matcher: () => binding !== null && binding.before.length > 0,\n          handler: createAuthMiddleware((ctx) =>\n            runBefore(binding!, ctx, scope()),\n          ),\n        },\n      ],\n      after: [\n        {\n          matcher: () => binding !== null && binding.after.length > 0,\n          handler: createAuthMiddleware((ctx) =>\n            runAfter(binding!, ctx, scope(), (error) => {\n              afterMatcherErrors.set(ctx.context, error);\n            }),\n          ),\n        },\n        {\n          matcher: (ctx) => {\n            // Each endpoint dispatch owns this shared context, including nested\n            // calls. Rethrow outside the SDK's recoverable handler-error catch.\n            if (afterMatcherErrors.has(ctx.context)) {\n              const error = afterMatcherErrors.get(ctx.context);\n              afterMatcherErrors.delete(ctx.context);\n              throw error;\n            }\n            return binding !== null && !isRouter(ctx);\n          },\n          handler: createAuthMiddleware(async (ctx) => {\n            const value = ctx.context.returned;\n            if (typeof value === \"object\" && value !== null) {\n              endpointResults.add(value);\n            }\n          }),\n        },\n        {\n          matcher: (ctx) => {\n            if (isRouter(ctx)) {\n              return false;\n            }\n            const current = scope();\n            return !!current?.cookies && current.forward !== \"none\";\n          },\n          handler: createAuthMiddleware(async (ctx) => {\n            const current = scope()!;\n            if (\n              current.forward === \"same-credential\" &&\n              !sameCredential(ctx, current, binding!.credentialHeaders)\n            ) {\n              binding!.onDropped(ctx.path);\n              return;\n            }\n            const cookies = ctx.context.responseHeaders?.getSetCookie() ?? [];\n            if (cookies.length) {\n              current.cookies!.append(cookies);\n            }\n          }),\n        },\n      ],\n    },\n  } satisfies BetterAuthPlugin & { [BRIDGE_HANDLE]: BridgeHandle };\n  return plugin;\n}\n"],"mappings":";;;;AAIA,MAAa,gBAAgB,OAAO,IAAI,gCAAgC;;;;;;;;;;;ACaxE,SAAgB,0BACd,YACA,cACiD;CACjD,SAAS,UAAwC,QAAW;EAC1D,MAAM,SAAS,OACb,GAAG,CAAC,MAAM,SACmC;GAC7C,MAAM,UAAU,WAAW;GAC3B,IAAI,CAAC,SAAS;IACZ,aAAa;IACb;GACF;GACA,MAAM,QAAQ,QAAQ,SAAS,OAAO,CAAC;GACvC,IAAI,cAAuC,CAAC;GAC5C,IAAI,UAAU;GACd,KAAK,MAAM,QAAQ,OAAO;IACxB,MAAM,SAAS,MAAM,KAClB,OAAO,SAAS,SAAS,IACtB;KAAE,GAAG;KAAM,GAAG;IAAY,IAC1B,MACJ,GACF;IACA,IAAI,WAAW,OACb,OAAO;IAET,IACE,CAAC,OAAO,SAAS,SAAS,KAC1B,UACA,OAAO,WAAW,YAClB,UAAU,QACV;KACA,cAAc;MAAE,GAAG;MAAa,GAAG,OAAO;KAAK;KAC/C,UAAU;IACZ;GACF;GAGA,OACE,UAAU,EAAE,MAAM,YAAY,IAAI,KAAA;EAEtC;EACA,MAAM,QAAQ,OACZ,GAAG,CAAC,MAAM,SACQ;GAClB,MAAM,UAAU,WAAW;GAC3B,IAAI,CAAC,SAAS;IACZ,aAAa;IACb;GACF;GACA,KAAK,MAAM,QAAQ,QAAQ,SAAS,OAAO,CAAC,OAC1C,MAAM,KAAK,MAAsC,GAAG;EAExD;EACA,OAAO;GAAE;GAAQ;EAAM;CACzB;CACA,OAAO;EACL,MAAM;GACJ,QAAQ,UAAU,aAAa;GAC/B,QAAQ,UAAU,aAAa;GAC/B,QAAQ,UAAU,aAAa;EACjC;EACA,SAAS;GACP,QAAQ,UAAU,gBAAgB;GAClC,QAAQ,UAAU,gBAAgB;GAClC,QAAQ,UAAU,gBAAgB;EACpC;EACA,SAAS;GACP,QAAQ,UAAU,gBAAgB;GAClC,QAAQ,UAAU,gBAAgB;GAClC,QAAQ,UAAU,gBAAgB;EACpC;EACA,cAAc;GACZ,QAAQ,UAAU,qBAAqB;GACvC,QAAQ,UAAU,qBAAqB;GACvC,QAAQ,UAAU,qBAAqB;EACzC;CACF;AACF;;;AC1FA,MAAM,oBAAoB,OAAO,IAAI,+BAA+B;AACpE,MAAM,eAAe,YAAY,QAAQ,KAAK,UAAU;CACtD,IAAI,MAAM,QAAQ,OAAO,IAAI,KAAK,MAAM,QAAQ,KAAK,GAAG;EACtD,OAAO,OAAO;EACd,OAAO;CACT;AACF,CAAC;AAED,SAAS,aACP,QACA,QACM;CACN,QAAQ,SAAS,OAAO,QAAQ;EAC9B,IAAI,QAAQ,cACV,OAAO,OAAO,KAAK,KAAK;OAExB,OAAO,IAAI,KAAK,KAAK;CAEzB,CAAC;AACH;AAEA,SAAS,aAAa,OAAsC;CAC1D,MAAM,WAAY,MAChB;CAEF,IAAI,CAAC,YAAY,CAAC,MAAM,SACtB;CAEF,MAAM,UAAU,IAAI,QAAQ,QAAQ;CACpC,IAAI,MAAM,WAAW,MAAM,YAAY,UACrC,aAAa,SAAS,IAAI,QAAQ,MAAM,OAAO,CAAC;CAElD,OAAO;AACT;;AAGA,eAAsB,UACpB,SACA,KACA,OACkB;CAClB,IAAI,cAAuC,CAAC;CAC5C,KAAK,MAAM,QAAQ,QAAQ,QAAQ;EACjC,IAAI;EACJ,IAAI;GACF,UAAU,KAAK,QAAQ,KAAK,KAAK;EACnC,SAAS,OAAO;GACd,IAAI,QAAQ,OAAO,MACjB,yDACA,KACF;GACA,MAAM,IAAI,SAAS,yBAAyB,EAC1C,SACE,oFACJ,CAAC;EACH;EACA,IAAI,CAAC,SACH;EAEF,IAAI;EACJ,IAAI;GACF,SAAU,MAAM,qBAAqB,KAAK,GAAG,CAAC,CAAC;IAC7C,GAAG;IACH,eAAe;GACjB,CAAC;EACH,SAAS,OAAO;GACd,IAAI,WAAW,KAAK,GAGlB,IAAI,kBACD,MACC,sBACG,IAAI,QAAQ;GAErB,MAAM;EACR;EACA,IAAI,QAAQ,oBAAoB,IAAI,QAAQ;EAC5C,aAAa,IAAI,QAAQ,iBAAiB,OAAO,OAAO;EACxD,MAAM,QAAQ,OAAO;EACrB,IAAI,SAAS,OAAO,UAAU,UAAU;GACtC,IAAI,aAAa,SAAS,OAAO,MAAM,YAAY,UAAU;IAC3D,MAAM,EAAE,SAAS,GAAG,SAAS,MAAM;IACnC,IAAI,mBAAmB,SAAS;KAC9B,MAAM,iBACJ,YAAY,mBAAmB,UAC3B,YAAY,UACZ,IAAI,QAAQ;KAClB,QAAQ,SAAS,QAAQ,QAAQ;MAC/B,eAAe,IAAI,KAAK,MAAM;KAChC,CAAC;KACD,YAAY,UAAU;IACxB;IACA,cAAc,aAAa,MAAM,WAAW;GAC9C,OACE,OAAO;EAEX;CACF;CACA,OAAO,OAAO,KAAK,WAAW,CAAC,CAAC,SAAS,EAAE,SAAS,YAAY,IAAI,KAAA;AACtE;AAEA,eAAsB,SACpB,SACA,KACA,OACA,mBACkB;CAClB,KAAK,MAAM,QAAQ,QAAQ,OAAO;EAChC,IAAI;EACJ,IAAI;GACF,UAAU,KAAK,QAAQ,KAAK,KAAK;EACnC,SAAS,OAAO;GACd,IAAI,CAAC,mBACH,MAAM;GAIR,kBAAkB,KAAK;GACvB;EACF;EACA,IAAI,CAAC,SACH;EAEF,IAAI;EACJ,IAAI;GACF,SAAU,MAAM,qBAAqB,KAAK,GAAG,CAAC,CAAC;IAC7C,GAAG;IACH,eAAe;GACjB,CAAC;EACH,SAAS,OAAO;GACd,IAAI,CAAC,WAAW,KAAK,GACnB,MAAM;GAER,SAAS;IAAE,UAAU;IAAO,SAAS,aAAa,KAAK;GAAE;EAC3D;EACA,IAAI,OAAO,SAAS;GAClB,IAAI,QAAQ,oBAAoB,IAAI,QAAQ;GAC5C,aAAa,IAAI,QAAQ,iBAAiB,OAAO,OAAO;EAC1D;EACA,IAAI,OAAO,aAAa,KAAA,GACtB,IAAI,QAAQ,WAAW,OAAO;CAElC;CACA,OAAO,IAAI,QAAQ;AACrB;;;ACpIA,MAAa,mBAAmB;AAEhC,MAAM,YAAY,QAChB,WAAW,OAAO,IAAI,UAAU;AAClC,MAAM,YAAY;AAElB,SAAS,aACP,SACA,KACQ;CACR,OACE,aAAa,SAAS,IAAI,QAAQ,KAAK,EAAE,CAAC,CAAC,IACzC,IAAI,QAAQ,YAAY,aAAa,IACvC,KAAK;AAET;AAEA,SAAS,WACP,SACA,KACA,OACQ;CACR,OAAO;EACL,aAAa,SAAS,GAAG;EACzB,SAAS,IAAI,eAAe,KAAK;EACjC,GAAG,MAAM,KAAK,SAAS,SAAS,IAAI,IAAI,KAAK,EAAE;CACjD,CAAC,CAAC,KAAK,SAAS;AAClB;AAEA,SAAS,eACP,KACA,OACA,OACS;CACT,MAAM,OAAO,WAAW,IAAI,SAAS,KAAK,KAAK;CAC/C,OACE,SAAS,UAAU,OAAO,MAAM,SAAS,CAAC,KAC1C,SAAS,WAAW,MAAM,UAAU,GAAG,KAAK,KAAK;AAErD;;AAGA,SAAgB,OACd,UAA+B,CAAC,GACoB;CACpD,IAAI,UAAgC;CACpC,IAAI;CACJ,IAAI,oBAAoB;CACxB,MAAM,kCAAkB,IAAI,QAAgB;CAC5C,MAAM,qCAAqB,IAAI,QAAyB;CACxD,MAAM,cAAc,SAAS,QAAQ;CACrC,MAAM,iBACJ,QAAQ,mBAAmB,QACvB,OACC,QAAQ,kBACT,+BAA+B,WAAW,OAAO,WAAW,CAAC,CAAC,WAAW,KAAK,EAAE;CACtF,MAAM,SAAuB;EAC3B,UAAU;EACV;EACA,IAAI,QAAQ;GACV,OAAO,YAAY,OACf,YACA,QAAQ,UAAU,WAChB,WACA;EACR;EACA,IAAI,oBAAoB;GACtB,OAAO;EACT;EACA,KAAK,MAAM;GACT,IAAI,WAAW,QAAQ,aAAa,KAAK,UACvC,MAAM,IAAI,MACR,qCAAqC,QAAQ,SAAS,SAAS,KAAK,SAAS,EAC/E;GAEF,IAAI,SAAS,UAAU,KAAK,SAAS,cACnC,OAAO;GAET,IAAI,SAAS,UAAU,gBACrB,MAAM,IAAI,MACR,oCAAoC,QAAQ,MAAM,aACpD;GAEF,IAAI;GACJ,IAAI,SAAS,UAAU,eAAe;IACpC,eAAe,QAAQ,MAAM;IAE7B,QAAQ,QAAQ;GAClB;GACA,UAAU;GACV,oBAAoB;GACpB,eAAe;IACb;IACA,aAAa;KACX,KAAK,QAAQ;IACf;GACF;GACA,OAAO;EACT;EACA,mBAAmB,OAAO;GACxB,OACE,OAAO,UAAU,YACjB,UAAU,QACV,gBAAgB,IAAI,KAAK;EAE7B;CACF;CAqHA,OAAO;EAnHL,IAAI;GACH,gBAAgB;EACjB,aAAa,EACX,SAAS;GACP,eAAe,gCACP,eACA;IACJ;GACF,CACF;GACA,GAAI,iBACA,EAAE,UAAU,EAAE,WAAW,EAAE,kBAAkB,CAAC,cAAc,EAAE,EAAE,EAAE,IAClE,CAAC;EACP,EACF;EACA,OAAO;GACL,QAAQ;IACN;KACE,UAAU,QAAQ;MAChB,IAAI,CAAC,SAAS;OACZ;OACA,OAAO;MACT;MACA,OAAO,CAAC,SAAS,GAAG,KAAK,MAAM,CAAC,EAAE,YAAY;KAChD;KACA,SAAS,qBAAqB,YAAY;MACxC,MAAM,4BAA4B,IAAI;KACxC,CAAC;IACH;IACA;KACE,UAAU,QAAQ;MAChB,IAAI,CAAC,WAAW,SAAS,GAAG,GAC1B,OAAO;MAET,MAAM,UAAU,MAAM;MACtB,IAAI,CAAC,WAAW,QAAQ,UACtB,OAAO;MAIT,MAAM,QAAQ,QAAQ;MACtB,QAAQ,UAAU;MAClB,MAAM,UAAU,QAAQ,iBAAiB;MACzC,MAAM,QAAQ,aAAa,IAAI,SAAS,GAAG;MAI3C,OACE,CAAC,CAAC,SAAS,UAAU,MAAM,UAAU,aAAa,SAAS,GAAG;KAElE;KACA,SAAS,qBAAqB,OAAO,QAAQ;MAC3C,MAAM,CAAC,EAAE,qBAAqB,IAAI,MAAM,QAAS,QAAQ;KAC3D,CAAC;IACH;IACA;KACE,eAAe,YAAY,QAAQ,QAAQ,OAAO,SAAS;KAC3D,SAAS,sBAAsB,QAC7B,UAAU,SAAU,KAAK,MAAM,CAAC,CAClC;IACF;GACF;GACA,OAAO;IACL;KACE,eAAe,YAAY,QAAQ,QAAQ,MAAM,SAAS;KAC1D,SAAS,sBAAsB,QAC7B,SAAS,SAAU,KAAK,MAAM,IAAI,UAAU;MAC1C,mBAAmB,IAAI,IAAI,SAAS,KAAK;KAC3C,CAAC,CACH;IACF;IACA;KACE,UAAU,QAAQ;MAGhB,IAAI,mBAAmB,IAAI,IAAI,OAAO,GAAG;OACvC,MAAM,QAAQ,mBAAmB,IAAI,IAAI,OAAO;OAChD,mBAAmB,OAAO,IAAI,OAAO;OACrC,MAAM;MACR;MACA,OAAO,YAAY,QAAQ,CAAC,SAAS,GAAG;KAC1C;KACA,SAAS,qBAAqB,OAAO,QAAQ;MAC3C,MAAM,QAAQ,IAAI,QAAQ;MAC1B,IAAI,OAAO,UAAU,YAAY,UAAU,MACzC,gBAAgB,IAAI,KAAK;KAE7B,CAAC;IACH;IACA;KACE,UAAU,QAAQ;MAChB,IAAI,SAAS,GAAG,GACd,OAAO;MAET,MAAM,UAAU,MAAM;MACtB,OAAO,CAAC,CAAC,SAAS,WAAW,QAAQ,YAAY;KACnD;KACA,SAAS,qBAAqB,OAAO,QAAQ;MAC3C,MAAM,UAAU,MAAM;MACtB,IACE,QAAQ,YAAY,qBACpB,CAAC,eAAe,KAAK,SAAS,QAAS,iBAAiB,GACxD;OACA,QAAS,UAAU,IAAI,IAAI;OAC3B;MACF;MACA,MAAM,UAAU,IAAI,QAAQ,iBAAiB,aAAa,KAAK,CAAC;MAChE,IAAI,QAAQ,QACV,QAAQ,QAAS,OAAO,OAAO;KAEnC,CAAC;IACH;GACF;EACF;CAEU;AACd"}

package/dist/principal-readings-Chmt6rQV.cjs

@@ -0,0 +1,208 @@
+const require_auth_errors = require("./auth-errors-DmiKl0L_.cjs");
+let _nestjs_common = require("@nestjs/common");
+//#region src/principal-readings.ts
+const RESOLUTION = Symbol.for("@nestjs-kit/better-auth:resolution");
+const TEST_STAMP = Symbol.for("@nestjs-kit/better-auth:test-stamp");
+function object(value) {
+	return value !== null && (typeof value === "object" || typeof value === "function");
+}
+function records(target, create = false) {
+	let value = Reflect.get(target, RESOLUTION);
+	if (!value && create) {
+		value = {
+			own: /* @__PURE__ */ new Map(),
+			positions: /* @__PURE__ */ new Map()
+		};
+		Object.defineProperty(target, RESOLUTION, { value });
+	}
+	return value;
+}
+function sameElements(stamp, args) {
+	return stamp.elements.length === args.length && stamp.elements.every((value, index) => value === args[index]);
+}
+/**
+* The stamp of this invocation: the one on the args array itself (WS, RPC and GraphQL guards and interceptors share
+* that array), or one on its elements when the elements identify the invocation. That takes at least two object
+* elements (an HTTP request and its response): a lone object, such as a WS socket beside a primitive payload, is shared
+* by every message on its connection, so a stamp found only through it may belong to another invocation.
+*/
+function matchingStamp(args) {
+	const own = Reflect.get(args, TEST_STAMP);
+	if (own && sameElements(own, args)) return own;
+	const objects = args.filter(object);
+	if (objects.length < 2) return;
+	for (const target of objects) {
+		const stamp = Reflect.get(target, TEST_STAMP);
+		if (stamp && sameElements(stamp, args)) return stamp;
+	}
+}
+function lineageFromArgs(args) {
+	const targets = [args, ...args.filter(object)];
+	for (const target of targets) {
+		const own = records(target)?.invocationLineage;
+		if (own) return own;
+	}
+	for (const target of targets) {
+		const carrier = records(target)?.lineage;
+		if (!carrier) continue;
+		for (const position of carrier.enclosing(args)) return {
+			...carrier,
+			position
+		};
+	}
+}
+/** The intrinsic twin suppresses Nest's repeated log, while retaining the safe wire shape. */
+var RepeatedReaderError = class extends _nestjs_common.IntrinsicException {
+	constructor(error) {
+		super(error.message);
+		Object.defineProperties(this, Object.getOwnPropertyDescriptors(error));
+	}
+};
+var PrincipalReadings = class {
+	scope;
+	constructor(scope) {
+		this.scope = scope;
+	}
+	record(call, reading) {
+		const record = records(call.invocation, true);
+		record.own.set(reading.instance, reading);
+		if (call.lineage) {
+			record.invocationLineage = call.lineage;
+			this.recordLineage(call.lineage, reading);
+		}
+	}
+	recordLineage(lineage, reading) {
+		const value = records(lineage.carrier, true);
+		value.positions.set(lineage.position, reading);
+		value.lineage = lineage;
+	}
+	enclosing(lineage, args) {
+		const positions = records(lineage.carrier)?.positions;
+		for (const position of lineage.enclosing(args)) {
+			const reading = positions?.get(position);
+			if (reading) return reading;
+		}
+	}
+	read(input) {
+		const { plan, args, call } = input;
+		const lineage = input.lineage ?? call?.lineage;
+		let resolvedInstance = plan?.instance;
+		try {
+			if (plan?.access === "public") return {
+				outcome: "no-identity",
+				instance: plan.instance
+			};
+			let reading;
+			let validation = lineage ?? lineageFromArgs(args);
+			if (plan?.access === "inherit") reading = lineage && this.enclosing(lineage, args);
+			else {
+				const targets = call ? [call.invocation] : [args, ...args.filter(object)];
+				for (const target of targets) {
+					const own = records(target)?.own;
+					reading = plan ? own?.get(plan.instance) : own?.size === 1 ? own.values().next().value : void 0;
+					if (reading) break;
+				}
+				if (!reading && !plan) for (const target of [args, ...args.filter(object)]) {
+					const candidate = records(target)?.lineage;
+					if (!candidate) continue;
+					reading = this.enclosing(candidate, args);
+					if (reading) {
+						validation = candidate;
+						break;
+					}
+				}
+			}
+			if (!reading) {
+				const stamp = matchingStamp(args);
+				const instance = plan?.instance ?? "default";
+				const result = stamp?.results.get(instance);
+				if (result) reading = {
+					...result,
+					instance
+				};
+			}
+			if (!reading) throw require_auth_errors.BetterAuthConfigurationError.atRequest(input.beforeGuard && plan?.access !== "inherit" ? "PRINCIPAL_READ_BEFORE_GUARD" : "NO_AUTH_RESULT", "No authentication result: BetterAuthGuard did not run for this invocation", {
+				site: plan?.site ?? input.site,
+				hint: "Run BetterAuthGuard before reading a principal; test replacements must stampPrincipal()."
+			});
+			resolvedInstance = reading.instance;
+			if (reading.outcome === "authenticated") validation?.assertReadable?.(args);
+			return reading;
+		} catch (error) {
+			if (require_auth_errors.isConfigurationError(error)) throw this.deliver(error, input, resolvedInstance);
+			throw error;
+		}
+	}
+	current() {
+		const state = this.scope.current();
+		if (!state?.reading) throw require_auth_errors.BetterAuthConfigurationError.atRequest("NO_AUTH_SCOPE", "Principal readers require a handler scope");
+		return state.reading();
+	}
+	project(reading, spec, input) {
+		if (reading.outcome === "no-identity" || reading.outcome === "absent") return null;
+		if (reading.outcome === "rejected") throw reading.failure;
+		if (spec.kind && reading.principal.kind !== spec.kind) {
+			const error = require_auth_errors.BetterAuthConfigurationError.atRequest(spec.reason ?? "PRINCIPAL_KIND_REQUIRED", `This reader requires principal kind ${spec.kind}`, {
+				site: spec.site,
+				hint: "Use @CurrentPrincipal() or getPrincipal() and narrow p.kind."
+			});
+			throw this.deliver(error, input, reading.instance);
+		}
+		return spec.project(reading.principal);
+	}
+	deliver(error, input, instance) {
+		const state = this.scope.current();
+		const call = state?.call ?? input?.call;
+		const lineage = call?.lineage ?? input?.lineage ?? (input && lineageFromArgs(input.args));
+		const key = call?.key ?? lineage?.carrier ?? input?.args;
+		if (!key) return error;
+		return this.scope.surfaced(key, error, {
+			instance: instance ?? state?.plan?.instance ?? input?.plan?.instance ?? "default",
+			site: error.site ?? input?.site ?? input?.plan?.site ?? "principal reader",
+			lineage
+		}) ? new RepeatedReaderError(error) : error;
+	}
+	stamp(args, instance, result) {
+		stampResult(args, instance, result);
+	}
+};
+/** Test stamps are verified by array or element identity (see matchingStamp), so a stamp never leaks into another invocation. */
+function stampResult(args, instance, result) {
+	const stamp = matchingStamp(args) ?? {
+		elements: [...args],
+		results: /* @__PURE__ */ new Map()
+	};
+	stamp.results.set(instance, result);
+	for (const target of [args, ...args]) if (object(target) && Object.isExtensible(target)) Object.defineProperty(target, TEST_STAMP, {
+		value: stamp,
+		configurable: true
+	});
+}
+function stampedReading(args, instance) {
+	const result = matchingStamp(args)?.results.get(instance);
+	return result ? {
+		...result,
+		instance
+	} : void 0;
+}
+//#endregion
+Object.defineProperty(exports, "PrincipalReadings", {
+	enumerable: true,
+	get: function() {
+		return PrincipalReadings;
+	}
+});
+Object.defineProperty(exports, "stampResult", {
+	enumerable: true,
+	get: function() {
+		return stampResult;
+	}
+});
+Object.defineProperty(exports, "stampedReading", {
+	enumerable: true,
+	get: function() {
+		return stampedReading;
+	}
+});
+
+//# sourceMappingURL=principal-readings-Chmt6rQV.cjs.map

package/dist/principal-readings-Chmt6rQV.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal-readings-Chmt6rQV.cjs","names":["IntrinsicException","BetterAuthConfigurationError","isConfigurationError"],"sources":["../src/principal-readings.ts"],"sourcesContent":["import { IntrinsicException } from \"@nestjs/common\";\nimport type {\n  InvocationLineage,\n  PrincipalReading,\n  PrincipalResult,\n  RoutePlan,\n  TransportCall,\n} from \"./auth-contracts.js\";\nimport {\n  BetterAuthConfigurationError,\n  isConfigurationError,\n} from \"./auth-errors.js\";\nimport type { AuthPrincipal } from \"./auth-types.js\";\nimport { RequestScope } from \"./request-scope.js\";\n\nconst RESOLUTION = Symbol.for(\"@nestjs-kit/better-auth:resolution\");\nconst TEST_STAMP = Symbol.for(\"@nestjs-kit/better-auth:test-stamp\");\ninterface Records {\n  own: Map<string, PrincipalReading>;\n  positions: Map<string, PrincipalReading>;\n  lineage?: InvocationLineage;\n  invocationLineage?: InvocationLineage;\n}\ninterface TestStamp {\n  elements: readonly unknown[];\n  results: Map<string, PrincipalResult>;\n}\nexport interface ReadingInput {\n  readonly args: readonly unknown[];\n  readonly call?: TransportCall;\n  readonly lineage?: InvocationLineage;\n  readonly plan?: Pick<RoutePlan, \"access\" | \"instance\" | \"site\">;\n  readonly beforeGuard?: boolean;\n  readonly site?: string;\n}\n\nfunction object(value: unknown): value is object {\n  return (\n    value !== null && (typeof value === \"object\" || typeof value === \"function\")\n  );\n}\nfunction records(target: object, create = false): Records | undefined {\n  let value = Reflect.get(target, RESOLUTION) as Records | undefined;\n  if (!value && create) {\n    value = { own: new Map(), positions: new Map() };\n    Object.defineProperty(target, RESOLUTION, { value });\n  }\n  return value;\n}\nfunction sameElements(stamp: TestStamp, args: readonly unknown[]): boolean {\n  return (\n    stamp.elements.length === args.length &&\n    stamp.elements.every((value, index) => value === args[index])\n  );\n}\n\n/**\n * The stamp of this invocation: the one on the args array itself (WS, RPC and GraphQL guards and interceptors share\n * that array), or one on its elements when the elements identify the invocation. That takes at least two object\n * elements (an HTTP request and its response): a lone object, such as a WS socket beside a primitive payload, is shared\n * by every message on its connection, so a stamp found only through it may belong to another invocation.\n */\nfunction matchingStamp(args: readonly unknown[]): TestStamp | undefined {\n  const own = Reflect.get(args, TEST_STAMP) as TestStamp | undefined;\n  if (own && sameElements(own, args)) {\n    return own;\n  }\n  const objects = args.filter(object);\n  if (objects.length < 2) {\n    return undefined;\n  }\n  for (const target of objects) {\n    const stamp = Reflect.get(target, TEST_STAMP) as TestStamp | undefined;\n    if (stamp && sameElements(stamp, args)) {\n      return stamp;\n    }\n  }\n  return undefined;\n}\n\nfunction lineageFromArgs(\n  args: readonly unknown[],\n): InvocationLineage | undefined {\n  const targets = [args, ...args.filter(object)];\n  for (const target of targets) {\n    const own = records(target)?.invocationLineage;\n    if (own) {\n      return own;\n    }\n  }\n  for (const target of targets) {\n    const carrier = records(target)?.lineage;\n    if (!carrier) {\n      continue;\n    }\n    // The recorded callback is structural, but its recorded position may belong\n    // to a sibling operation in the same batched GraphQL carrier.\n    for (const position of carrier.enclosing(args)) {\n      return { ...carrier, position };\n    }\n  }\n  return undefined;\n}\n\n/** The intrinsic twin suppresses Nest's repeated log, while retaining the safe wire shape. */\nexport class RepeatedReaderError extends IntrinsicException {\n  constructor(error: BetterAuthConfigurationError) {\n    super(error.message);\n    Object.defineProperties(this, Object.getOwnPropertyDescriptors(error));\n  }\n}\n\nexport class PrincipalReadings {\n  constructor(private readonly scope: RequestScope) {}\n\n  record(\n    call: Pick<TransportCall, \"invocation\" | \"lineage\">,\n    reading: PrincipalReading,\n  ): void {\n    const record = records(call.invocation, true)!;\n    record.own.set(reading.instance, reading);\n    if (call.lineage) {\n      record.invocationLineage = call.lineage;\n      this.recordLineage(call.lineage, reading);\n    }\n  }\n\n  recordLineage(lineage: InvocationLineage, reading: PrincipalReading): void {\n    const value = records(lineage.carrier, true)!;\n    value.positions.set(lineage.position, reading);\n    value.lineage = lineage;\n  }\n\n  enclosing(\n    lineage: InvocationLineage,\n    args: readonly unknown[],\n  ): PrincipalReading | undefined {\n    const positions = records(lineage.carrier)?.positions;\n    for (const position of lineage.enclosing(args)) {\n      const reading = positions?.get(position);\n      if (reading) {\n        return reading;\n      }\n    }\n    return undefined;\n  }\n\n  read(input: ReadingInput): PrincipalReading {\n    const { plan, args, call } = input;\n    const lineage = input.lineage ?? call?.lineage;\n    let resolvedInstance = plan?.instance;\n    try {\n      if (plan?.access === \"public\") {\n        return { outcome: \"no-identity\", instance: plan.instance };\n      }\n      let reading: PrincipalReading | undefined;\n      let validation = lineage ?? lineageFromArgs(args);\n      if (plan?.access === \"inherit\") {\n        reading = lineage && this.enclosing(lineage, args);\n      } else {\n        const targets = call\n          ? [call.invocation]\n          : [args, ...args.filter(object)];\n        for (const target of targets) {\n          const own = records(target)?.own;\n          reading = plan\n            ? own?.get(plan.instance)\n            : own?.size === 1\n              ? own.values().next().value\n              : undefined;\n          if (reading) {\n            break;\n          }\n        }\n        if (!reading && !plan) {\n          for (const target of [args, ...args.filter(object)]) {\n            const candidate = records(target)?.lineage;\n            if (!candidate) {\n              continue;\n            }\n            reading = this.enclosing(candidate, args);\n            if (reading) {\n              validation = candidate;\n              break;\n            }\n          }\n        }\n      }\n      if (!reading) {\n        const stamp = matchingStamp(args);\n        const instance = plan?.instance ?? \"default\";\n        const result = stamp?.results.get(instance);\n        if (result) {\n          reading = { ...result, instance };\n        }\n      }\n      if (!reading) {\n        throw BetterAuthConfigurationError.atRequest(\n          input.beforeGuard && plan?.access !== \"inherit\"\n            ? \"PRINCIPAL_READ_BEFORE_GUARD\"\n            : \"NO_AUTH_RESULT\",\n          \"No authentication result: BetterAuthGuard did not run for this invocation\",\n          {\n            site: plan?.site ?? input.site,\n            hint: \"Run BetterAuthGuard before reading a principal; test replacements must stampPrincipal().\",\n          },\n        );\n      }\n      resolvedInstance = reading.instance;\n      if (reading.outcome === \"authenticated\") {\n        validation?.assertReadable?.(args);\n      }\n      return reading;\n    } catch (error) {\n      if (isConfigurationError(error)) {\n        throw this.deliver(error, input, resolvedInstance);\n      }\n      throw error;\n    }\n  }\n\n  current(): PrincipalReading {\n    const state = this.scope.current();\n    if (!state?.reading) {\n      throw BetterAuthConfigurationError.atRequest(\n        \"NO_AUTH_SCOPE\",\n        \"Principal readers require a handler scope\",\n      );\n    }\n    return state.reading();\n  }\n\n  project<T>(\n    reading: PrincipalReading,\n    spec: {\n      kind?: string;\n      reason?: string;\n      site: string;\n      project: (principal: AuthPrincipal) => T;\n    },\n    input?: ReadingInput,\n  ): T | null {\n    if (reading.outcome === \"no-identity\" || reading.outcome === \"absent\") {\n      return null;\n    }\n    if (reading.outcome === \"rejected\") {\n      throw reading.failure;\n    }\n    if (spec.kind && reading.principal.kind !== spec.kind) {\n      const error = BetterAuthConfigurationError.atRequest(\n        spec.reason ?? \"PRINCIPAL_KIND_REQUIRED\",\n        `This reader requires principal kind ${spec.kind}`,\n        {\n          site: spec.site,\n          hint: \"Use @CurrentPrincipal() or getPrincipal() and narrow p.kind.\",\n        },\n      );\n      throw this.deliver(error, input, reading.instance);\n    }\n    return spec.project(reading.principal);\n  }\n\n  deliver(\n    error: BetterAuthConfigurationError,\n    input?: ReadingInput,\n    instance?: string,\n  ): BetterAuthConfigurationError | RepeatedReaderError {\n    const state = this.scope.current();\n    const call = state?.call ?? input?.call;\n    const lineage =\n      call?.lineage ?? input?.lineage ?? (input && lineageFromArgs(input.args));\n    const key = call?.key ?? lineage?.carrier ?? input?.args;\n    if (!key) {\n      return error;\n    }\n    const repeated = this.scope.surfaced(key, error, {\n      instance:\n        instance ?? state?.plan?.instance ?? input?.plan?.instance ?? \"default\",\n      site:\n        error.site ?? input?.site ?? input?.plan?.site ?? \"principal reader\",\n      lineage,\n    });\n    return repeated ? new RepeatedReaderError(error) : error;\n  }\n\n  stamp(\n    args: readonly unknown[],\n    instance: string,\n    result: PrincipalResult,\n  ): void {\n    stampResult(args, instance, result);\n  }\n}\n\n/** Test stamps are verified by array or element identity (see matchingStamp), so a stamp never leaks into another invocation. */\nexport function stampResult(\n  args: readonly unknown[],\n  instance: string,\n  result: PrincipalResult,\n): void {\n  const stamp = matchingStamp(args) ?? {\n    elements: [...args],\n    results: new Map(),\n  };\n  stamp.results.set(instance, result);\n  for (const target of [args, ...args]) {\n    if (object(target) && Object.isExtensible(target)) {\n      Object.defineProperty(target, TEST_STAMP, {\n        value: stamp,\n        configurable: true,\n      });\n    }\n  }\n}\n\nexport function stampedReading(\n  args: readonly unknown[],\n  instance: string,\n): PrincipalReading | undefined {\n  const result = matchingStamp(args)?.results.get(instance);\n  return result ? { ...result, instance } : undefined;\n}\n"],"mappings":";;;AAeA,MAAM,aAAa,OAAO,IAAI,oCAAoC;AAClE,MAAM,aAAa,OAAO,IAAI,oCAAoC;AAoBlE,SAAS,OAAO,OAAiC;CAC/C,OACE,UAAU,SAAS,OAAO,UAAU,YAAY,OAAO,UAAU;AAErE;AACA,SAAS,QAAQ,QAAgB,SAAS,OAA4B;CACpE,IAAI,QAAQ,QAAQ,IAAI,QAAQ,UAAU;CAC1C,IAAI,CAAC,SAAS,QAAQ;EACpB,QAAQ;GAAE,qBAAK,IAAI,IAAI;GAAG,2BAAW,IAAI,IAAI;EAAE;EAC/C,OAAO,eAAe,QAAQ,YAAY,EAAE,MAAM,CAAC;CACrD;CACA,OAAO;AACT;AACA,SAAS,aAAa,OAAkB,MAAmC;CACzE,OACE,MAAM,SAAS,WAAW,KAAK,UAC/B,MAAM,SAAS,OAAO,OAAO,UAAU,UAAU,KAAK,MAAM;AAEhE;;;;;;;AAQA,SAAS,cAAc,MAAiD;CACtE,MAAM,MAAM,QAAQ,IAAI,MAAM,UAAU;CACxC,IAAI,OAAO,aAAa,KAAK,IAAI,GAC/B,OAAO;CAET,MAAM,UAAU,KAAK,OAAO,MAAM;CAClC,IAAI,QAAQ,SAAS,GACnB;CAEF,KAAK,MAAM,UAAU,SAAS;EAC5B,MAAM,QAAQ,QAAQ,IAAI,QAAQ,UAAU;EAC5C,IAAI,SAAS,aAAa,OAAO,IAAI,GACnC,OAAO;CAEX;AAEF;AAEA,SAAS,gBACP,MAC+B;CAC/B,MAAM,UAAU,CAAC,MAAM,GAAG,KAAK,OAAO,MAAM,CAAC;CAC7C,KAAK,MAAM,UAAU,SAAS;EAC5B,MAAM,MAAM,QAAQ,MAAM,CAAC,EAAE;EAC7B,IAAI,KACF,OAAO;CAEX;CACA,KAAK,MAAM,UAAU,SAAS;EAC5B,MAAM,UAAU,QAAQ,MAAM,CAAC,EAAE;EACjC,IAAI,CAAC,SACH;EAIF,KAAK,MAAM,YAAY,QAAQ,UAAU,IAAI,GAC3C,OAAO;GAAE,GAAG;GAAS;EAAS;CAElC;AAEF;;AAGA,IAAa,sBAAb,cAAyCA,eAAAA,mBAAmB;CAC1D,YAAY,OAAqC;EAC/C,MAAM,MAAM,OAAO;EACnB,OAAO,iBAAiB,MAAM,OAAO,0BAA0B,KAAK,CAAC;CACvE;AACF;AAEA,IAAa,oBAAb,MAA+B;CACA;CAA7B,YAAY,OAAsC;EAArB,KAAA,QAAA;CAAsB;CAEnD,OACE,MACA,SACM;EACN,MAAM,SAAS,QAAQ,KAAK,YAAY,IAAI;EAC5C,OAAO,IAAI,IAAI,QAAQ,UAAU,OAAO;EACxC,IAAI,KAAK,SAAS;GAChB,OAAO,oBAAoB,KAAK;GAChC,KAAK,cAAc,KAAK,SAAS,OAAO;EAC1C;CACF;CAEA,cAAc,SAA4B,SAAiC;EACzE,MAAM,QAAQ,QAAQ,QAAQ,SAAS,IAAI;EAC3C,MAAM,UAAU,IAAI,QAAQ,UAAU,OAAO;EAC7C,MAAM,UAAU;CAClB;CAEA,UACE,SACA,MAC8B;EAC9B,MAAM,YAAY,QAAQ,QAAQ,OAAO,CAAC,EAAE;EAC5C,KAAK,MAAM,YAAY,QAAQ,UAAU,IAAI,GAAG;GAC9C,MAAM,UAAU,WAAW,IAAI,QAAQ;GACvC,IAAI,SACF,OAAO;EAEX;CAEF;CAEA,KAAK,OAAuC;EAC1C,MAAM,EAAE,MAAM,MAAM,SAAS;EAC7B,MAAM,UAAU,MAAM,WAAW,MAAM;EACvC,IAAI,mBAAmB,MAAM;EAC7B,IAAI;GACF,IAAI,MAAM,WAAW,UACnB,OAAO;IAAE,SAAS;IAAe,UAAU,KAAK;GAAS;GAE3D,IAAI;GACJ,IAAI,aAAa,WAAW,gBAAgB,IAAI;GAChD,IAAI,MAAM,WAAW,WACnB,UAAU,WAAW,KAAK,UAAU,SAAS,IAAI;QAC5C;IACL,MAAM,UAAU,OACZ,CAAC,KAAK,UAAU,IAChB,CAAC,MAAM,GAAG,KAAK,OAAO,MAAM,CAAC;IACjC,KAAK,MAAM,UAAU,SAAS;KAC5B,MAAM,MAAM,QAAQ,MAAM,CAAC,EAAE;KAC7B,UAAU,OACN,KAAK,IAAI,KAAK,QAAQ,IACtB,KAAK,SAAS,IACZ,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,QACpB,KAAA;KACN,IAAI,SACF;IAEJ;IACA,IAAI,CAAC,WAAW,CAAC,MACf,KAAK,MAAM,UAAU,CAAC,MAAM,GAAG,KAAK,OAAO,MAAM,CAAC,GAAG;KACnD,MAAM,YAAY,QAAQ,MAAM,CAAC,EAAE;KACnC,IAAI,CAAC,WACH;KAEF,UAAU,KAAK,UAAU,WAAW,IAAI;KACxC,IAAI,SAAS;MACX,aAAa;MACb;KACF;IACF;GAEJ;GACA,IAAI,CAAC,SAAS;IACZ,MAAM,QAAQ,cAAc,IAAI;IAChC,MAAM,WAAW,MAAM,YAAY;IACnC,MAAM,SAAS,OAAO,QAAQ,IAAI,QAAQ;IAC1C,IAAI,QACF,UAAU;KAAE,GAAG;KAAQ;IAAS;GAEpC;GACA,IAAI,CAAC,SACH,MAAMC,oBAAAA,6BAA6B,UACjC,MAAM,eAAe,MAAM,WAAW,YAClC,gCACA,kBACJ,6EACA;IACE,MAAM,MAAM,QAAQ,MAAM;IAC1B,MAAM;GACR,CACF;GAEF,mBAAmB,QAAQ;GAC3B,IAAI,QAAQ,YAAY,iBACtB,YAAY,iBAAiB,IAAI;GAEnC,OAAO;EACT,SAAS,OAAO;GACd,IAAIC,oBAAAA,qBAAqB,KAAK,GAC5B,MAAM,KAAK,QAAQ,OAAO,OAAO,gBAAgB;GAEnD,MAAM;EACR;CACF;CAEA,UAA4B;EAC1B,MAAM,QAAQ,KAAK,MAAM,QAAQ;EACjC,IAAI,CAAC,OAAO,SACV,MAAMD,oBAAAA,6BAA6B,UACjC,iBACA,2CACF;EAEF,OAAO,MAAM,QAAQ;CACvB;CAEA,QACE,SACA,MAMA,OACU;EACV,IAAI,QAAQ,YAAY,iBAAiB,QAAQ,YAAY,UAC3D,OAAO;EAET,IAAI,QAAQ,YAAY,YACtB,MAAM,QAAQ;EAEhB,IAAI,KAAK,QAAQ,QAAQ,UAAU,SAAS,KAAK,MAAM;GACrD,MAAM,QAAQA,oBAAAA,6BAA6B,UACzC,KAAK,UAAU,2BACf,uCAAuC,KAAK,QAC5C;IACE,MAAM,KAAK;IACX,MAAM;GACR,CACF;GACA,MAAM,KAAK,QAAQ,OAAO,OAAO,QAAQ,QAAQ;EACnD;EACA,OAAO,KAAK,QAAQ,QAAQ,SAAS;CACvC;CAEA,QACE,OACA,OACA,UACoD;EACpD,MAAM,QAAQ,KAAK,MAAM,QAAQ;EACjC,MAAM,OAAO,OAAO,QAAQ,OAAO;EACnC,MAAM,UACJ,MAAM,WAAW,OAAO,YAAY,SAAS,gBAAgB,MAAM,IAAI;EACzE,MAAM,MAAM,MAAM,OAAO,SAAS,WAAW,OAAO;EACpD,IAAI,CAAC,KACH,OAAO;EAST,OAPiB,KAAK,MAAM,SAAS,KAAK,OAAO;GAC/C,UACE,YAAY,OAAO,MAAM,YAAY,OAAO,MAAM,YAAY;GAChE,MACE,MAAM,QAAQ,OAAO,QAAQ,OAAO,MAAM,QAAQ;GACpD;EACF,CACc,IAAI,IAAI,oBAAoB,KAAK,IAAI;CACrD;CAEA,MACE,MACA,UACA,QACM;EACN,YAAY,MAAM,UAAU,MAAM;CACpC;AACF;;AAGA,SAAgB,YACd,MACA,UACA,QACM;CACN,MAAM,QAAQ,cAAc,IAAI,KAAK;EACnC,UAAU,CAAC,GAAG,IAAI;EAClB,yBAAS,IAAI,IAAI;CACnB;CACA,MAAM,QAAQ,IAAI,UAAU,MAAM;CAClC,KAAK,MAAM,UAAU,CAAC,MAAM,GAAG,IAAI,GACjC,IAAI,OAAO,MAAM,KAAK,OAAO,aAAa,MAAM,GAC9C,OAAO,eAAe,QAAQ,YAAY;EACxC,OAAO;EACP,cAAc;CAChB,CAAC;AAGP;AAEA,SAAgB,eACd,MACA,UAC8B;CAC9B,MAAM,SAAS,cAAc,IAAI,CAAC,EAAE,QAAQ,IAAI,QAAQ;CACxD,OAAO,SAAS;EAAE,GAAG;EAAQ;CAAS,IAAI,KAAA;AAC5C"}