@nestjs-kit/better-auth 0.0.0-stage → 2.0.0

package/dist/websockets.mjs

@@ -0,0 +1,383 @@
+import { c as isConfigurationError, l as isInfrastructureError, n as BetterAuthConfigurationError, p as readErrorProperty, s as isAuthFailure, t as AuthFailures } from "./auth-errors-C3rbTV9p.mjs";
+import { C as PRINCIPAL_RESOLVER, M as TRANSPORT_REGISTRY, P as WS_CONNECTION_AUTH, m as INSTANCE_REGISTRY, n as __decorateParam, r as __decorateMetadata, t as __decorate } from "./decorate-Dt0e9K6R.mjs";
+import { n as EXTENSION_DEFINITION, r as UPGRADE_REQUEST } from "./bridge-protocol-c66aEkr5.mjs";
+import { o as toWebHeaders, s as upgradeRequestUrl } from "./platform-CZl7TY8j.mjs";
+import { Inject, Logger } from "@nestjs/common";
+import { MetadataScanner } from "@nestjs/core";
+import { SubscribeMessage, WebSocketGateway, WsException } from "@nestjs/websockets";
+//#region src/ws-connection-auth.ts
+function wsCloseCodeFor(failure) {
+	return failure.status === 401 ? 4401 : failure.status === 403 ? 4403 : 4429;
+}
+const STACK_FRAME = /^\s+at .+:\d+:\d+\)?$/;
+/**
+* Describes an unexpected connection-authentication error for the server log. Package
+* errors carry fixed messages and already-redacted causes. Application and runtime error
+* messages can quote client credentials (native Headers errors do), so only their name
+* and stack frames are kept.
+*/
+function connectionErrorLog(error) {
+	const text = (value) => typeof value === "string" ? value : void 0;
+	let summary;
+	if (isConfigurationError(error)) summary = `${error.code}: ${error.detail}`;
+	else if (isInfrastructureError(error)) {
+		const cause = readErrorProperty(error, "cause");
+		summary = `${error.message} (${text(readErrorProperty(cause, "name")) ?? "Error"}: ${text(readErrorProperty(cause, "message")) ?? ""})`;
+	} else {
+		const name = text(readErrorProperty(error, "name"));
+		summary = `${name !== void 0 && /^[\w$.]{1,64}$/.test(name) ? name : typeof error} (message withheld)`;
+	}
+	const frames = (text(readErrorProperty(error, "stack")) ?? "").split(/\r?\n/).filter((line) => STACK_FRAME.test(line));
+	return {
+		message: `WebSocket connection authentication failed: ${summary}`,
+		stack: frames.length > 0 ? [summary, ...frames].join("\n") : void 0
+	};
+}
+/**
+* The `ws` execution context of a connection before any gateway handler runs. Nest exports no
+* public factory for execution contexts, so this implements the public `ExecutionContext`
+* interface with the values Nest's internal host reports for the arguments `[client, undefined]`.
+*/
+var ConnectionExecutionContext = class {
+	#args;
+	constructor(client) {
+		this.#args = [client, void 0];
+	}
+	getType() {
+		return "ws";
+	}
+	/** No handler runs yet, so there is no class; Nest's host reports `null` as well. */
+	getClass() {
+		return null;
+	}
+	/** No handler runs yet; Nest's host reports `null` as well. */
+	getHandler() {
+		return null;
+	}
+	getArgs() {
+		return this.#args;
+	}
+	getArgByIndex(index) {
+		return this.#args[index];
+	}
+	switchToHttp() {
+		return {
+			getRequest: () => this.getArgByIndex(0),
+			getResponse: () => this.getArgByIndex(1),
+			getNext: () => this.getArgByIndex(2)
+		};
+	}
+	switchToRpc() {
+		return {
+			getData: () => this.getArgByIndex(0),
+			getContext: () => this.getArgByIndex(1)
+		};
+	}
+	switchToWs() {
+		return {
+			getClient: () => this.getArgByIndex(0),
+			getData: () => this.getArgByIndex(1),
+			getPattern: () => this.getArgByIndex(this.#args.length - 1)
+		};
+	}
+};
+let WsConnectionAuth = class WsConnectionAuth {
+	instances;
+	resolver;
+	transports;
+	logger = new Logger("BetterAuth");
+	constructor(instances, resolver, transports) {
+		this.instances = instances;
+		this.resolver = resolver;
+		this.transports = transports;
+	}
+	async authenticate(client, options = {}) {
+		if (typeof client !== "object" || client === null) throw BetterAuthConfigurationError.atRequest("INVALID_WS_CLIENT", "Connection authentication requires a WebSocket client.");
+		const context = new ConnectionExecutionContext(client);
+		const transport = this.transports.select(context);
+		const call = this.transports.describe(context, transport);
+		const entry = this.instances.get(options.instance ?? "default");
+		const browser = call.browser;
+		if (browser && entry.options.originCheck?.mode !== "off") {
+			const failure = await entry.handle.checkOrigin(browser, "cookie");
+			if (failure) return {
+				outcome: "rejected",
+				failure
+			};
+		}
+		const accepts = new Set(entry.sources.filter((source) => source.acceptance === "default").flatMap((source) => [...source.kinds]));
+		try {
+			return await this.resolver.resolve(call, {
+				auth: entry.handle,
+				accepts,
+				sourceSet: JSON.stringify(entry.sources.flatMap((source, index) => source.kinds.some((kind) => accepts.has(kind)) ? [index] : [])),
+				freshness: entry.options.session !== false && entry.options.session?.freshness === "authoritative" ? "authoritative" : "default"
+			});
+		} catch (error) {
+			if (isAuthFailure(error)) return {
+				outcome: "rejected",
+				failure: error
+			};
+			throw error;
+		}
+	}
+	socketIoMiddleware(options = {}) {
+		return (socket, next) => {
+			this.authenticate(socket, options).then((result) => {
+				const failure = result.outcome === "rejected" ? result.failure : result.outcome === "absent" && options.required ? AuthFailures.unauthenticated() : void 0;
+				if (!failure) {
+					next();
+					return;
+				}
+				next(Object.assign(new Error(failure.message), { data: {
+					status: "error",
+					statusCode: failure.status,
+					code: failure.code,
+					...failure.reason ? { reason: failure.reason } : {},
+					message: failure.message
+				} }));
+			}, (error) => {
+				const log = connectionErrorLog(error);
+				this.logger.error(log.message, log.stack);
+				next(Object.assign(/* @__PURE__ */ new Error("Internal server error"), { data: {
+					status: "error",
+					statusCode: 500,
+					message: "Internal server error"
+				} }));
+			});
+		};
+	}
+};
+WsConnectionAuth = __decorate([
+	__decorateParam(0, Inject(INSTANCE_REGISTRY)),
+	__decorateParam(1, Inject(PRINCIPAL_RESOLVER)),
+	__decorateParam(2, Inject(TRANSPORT_REGISTRY)),
+	__decorateMetadata("design:paramtypes", [
+		Object,
+		Object,
+		Object
+	])
+], WsConnectionAuth);
+//#endregion
+//#region src/socket-io-transport.ts
+/** Convert only mapped headers here: native Headers errors can quote the credential. */
+function mappedCredentialHeaders(input) {
+	const headers = new Headers();
+	if (input === void 0) return headers;
+	const malformed = () => AuthFailures.rejected({
+		status: 401,
+		reason: "MALFORMED_CREDENTIALS"
+	});
+	if (input === null || typeof input !== "object") throw malformed();
+	const iterable = input[Symbol.iterator];
+	if (iterable !== void 0 && typeof iterable !== "function") throw malformed();
+	const entries = typeof iterable === "function" ? input : Object.entries(input);
+	for (const entry of entries) {
+		if (!Array.isArray(entry) || entry.length !== 2) throw malformed();
+		const [name, value] = entry;
+		if (typeof name !== "string" || typeof value !== "string" || /[\r\n\0]/.test(value)) throw malformed();
+		try {
+			headers.append(name, value);
+		} catch {
+			throw malformed();
+		}
+	}
+	return headers;
+}
+function isSocketIo(client) {
+	return typeof client === "object" && client !== null && "handshake" in client;
+}
+function wsException(failure) {
+	return new WsException({
+		status: "error",
+		statusCode: failure.status,
+		code: failure.code,
+		...failure.reason ? { reason: failure.reason } : {},
+		message: failure.message
+	});
+}
+function validateGateways(context, coverage) {
+	class Probe {
+		message() {}
+	}
+	WebSocketGateway()(Probe);
+	SubscribeMessage("probe")(Probe.prototype, "message", Object.getOwnPropertyDescriptor(Probe.prototype, "message"));
+	if (Reflect.getMetadata("websockets:is_gateway", Probe) !== true || Reflect.getMetadata("websockets:message_mapping", Probe.prototype.message) !== true) throw new BetterAuthConfigurationError("NEST_METADATA_KEY_CHANGED", "Nest WebSocket gateway/message metadata failed its canary.");
+	const scanner = new MetadataScanner();
+	for (const wrapper of context.discovery.getProviders()) {
+		const target = wrapper.metatype;
+		if (!target?.prototype || wrapper.isAlias || !Reflect.getMetadata("websockets:is_gateway", target)) continue;
+		for (const method of scanner.getAllMethodNames(target.prototype)) if (Reflect.getMetadata("websockets:message_mapping", target.prototype[method])) context.claim(target, method, "explicit", {
+			everyHandler: true,
+			code: "GATEWAY_UNGUARDED",
+			coverage: coverage ?? "error",
+			hint: `Add @UseBetterAuth() to ${target.name} (or @Public() to opt out). Global guards and interceptors do not reach gateways on NestJS 11, and this check does not depend on the version.`
+		});
+	}
+}
+function quotaAdvice(context, ttl) {
+	return ttl === 0 && context.sources.some((source) => source.effects?.consumesQuota) ? [{
+		level: "warn",
+		code: "W_QUOTA_PER_MESSAGE",
+		message: "Quota-consuming WebSocket principals verify on every message.",
+		hint: "Consider connection-time authentication and principalTtlMs; a positive TTL delays revocation on non-authoritative handlers."
+	}] : [];
+}
+function transportDefinition(transport) {
+	return {
+		[EXTENSION_DEFINITION]: true,
+		use: { useFactory: () => transport },
+		providers: [WsConnectionAuth, {
+			provide: WS_CONNECTION_AUTH,
+			useExisting: WsConnectionAuth
+		}],
+		exports: [WsConnectionAuth, WS_CONNECTION_AUTH]
+	};
+}
+function principalTtl(value = 0) {
+	if (!Number.isFinite(value) || value < 0) throw new BetterAuthConfigurationError("INVALID_WS_TTL", "principalTtlMs must be a finite non-negative number.");
+	return value;
+}
+function socketIoTransport(options = {}) {
+	const ttl = principalTtl(options.principalTtlMs);
+	return transportDefinition({
+		id: "socket.io",
+		handles: (context) => context.getType() === "ws" && isSocketIo(context.switchToWs().getClient()),
+		describe(context) {
+			const client = context.switchToWs().getClient();
+			const original = () => toWebHeaders(client.handshake.headers);
+			return {
+				key: context.getArgs(),
+				invocation: context.getArgs(),
+				connection: client,
+				principalTtlMs: ttl,
+				headers: () => {
+					const headers = original();
+					let mapped;
+					if (options.credentials) mapped = options.credentials(client);
+					else if (!headers.has("authorization")) {
+						const token = client.handshake.auth?.token;
+						if (token !== void 0) {
+							if (typeof token !== "string") throw AuthFailures.rejected({
+								status: 401,
+								reason: "MALFORMED_CREDENTIALS"
+							});
+							mapped = { authorization: `Bearer ${token}` };
+						}
+					}
+					mappedCredentialHeaders(mapped).forEach((value, name) => {
+						headers.set(name, value);
+					});
+					return headers;
+				},
+				get clientIp() {
+					return client.handshake.address ?? null;
+				},
+				cookies: null,
+				get request() {
+					return {
+						method: "GET",
+						url: upgradeRequestUrl(client.handshake)
+					};
+				},
+				param: (name) => context.switchToWs().getData()?.[name],
+				get browser() {
+					return {
+						enforce: true,
+						key: client,
+						headers: original,
+						url: upgradeRequestUrl(client.handshake)
+					};
+				}
+			};
+		},
+		toException: wsException,
+		validate: (context) => validateGateways(context, options.gatewayCoverage),
+		advise: (context) => quotaAdvice(context, ttl)
+	});
+}
+//#endregion
+//#region src/ws-transport.ts
+function recordUpgradeRequest(client, request) {
+	Object.defineProperty(client, UPGRADE_REQUEST, {
+		value: Object.freeze({
+			headers: toWebHeaders(request.headers),
+			url: request.url,
+			remoteAddress: request.socket?.remoteAddress,
+			encrypted: request.socket?.encrypted
+		}),
+		configurable: true
+	});
+}
+function withUpgradeRequest(Base) {
+	return class extends Base {
+		bindClientConnect(server, callback) {
+			return super.bindClientConnect(server, (client, request, ...rest) => {
+				recordUpgradeRequest(client, request);
+				callback(client, request, ...rest);
+			});
+		}
+	};
+}
+function wsTransport(options = {}) {
+	const ttl = principalTtl(options.principalTtlMs);
+	return transportDefinition({
+		id: "ws",
+		handles: (context) => context.getType() === "ws" && !isSocketIo(context.switchToWs().getClient()),
+		describe(context) {
+			const client = context.switchToWs().getClient();
+			const upgrade = () => {
+				const request = client[UPGRADE_REQUEST];
+				if (!request) throw BetterAuthConfigurationError.atRequest("WS_UPGRADE_REQUEST_MISSING", "WebSocket authentication requires its upgrade request.", { hint: "app.useWebSocketAdapter(new (withUpgradeRequest(WsAdapter))(app));" });
+				return request;
+			};
+			const url = () => {
+				const request = upgrade();
+				return upgradeRequestUrl({
+					headers: request.headers,
+					url: request.url,
+					secure: request.encrypted
+				});
+			};
+			return {
+				key: context.getArgs(),
+				invocation: context.getArgs(),
+				connection: client,
+				principalTtlMs: ttl,
+				headers: () => {
+					const headers = new Headers(upgrade().headers);
+					mappedCredentialHeaders(options.credentials?.(client)).forEach((value, name) => {
+						headers.set(name, value);
+					});
+					return headers;
+				},
+				get clientIp() {
+					return upgrade().remoteAddress ?? null;
+				},
+				cookies: null,
+				get request() {
+					return {
+						method: "GET",
+						url: url()
+					};
+				},
+				param: (name) => context.switchToWs().getData()?.[name],
+				get browser() {
+					return {
+						enforce: true,
+						key: client,
+						headers: () => new Headers(upgrade().headers),
+						url: url()
+					};
+				}
+			};
+		},
+		toException: wsException,
+		validate: (context) => validateGateways(context, options.gatewayCoverage),
+		advise: (context) => quotaAdvice(context, ttl)
+	});
+}
+//#endregion
+export { UPGRADE_REQUEST, WS_CONNECTION_AUTH, WsConnectionAuth, recordUpgradeRequest, socketIoTransport, withUpgradeRequest, wsCloseCodeFor, wsTransport };
+
+//# sourceMappingURL=websockets.mjs.map

package/dist/websockets.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"websockets.mjs","names":[],"sources":["../src/ws-connection-auth.ts","../src/socket-io-transport.ts","../src/ws-transport.ts"],"sourcesContent":["import {\n  type ContextType,\n  type ExecutionContext,\n  Inject,\n  Logger,\n  type Type,\n} from \"@nestjs/common\";\nimport type { PrincipalResolver, PrincipalResult } from \"./auth-contracts.js\";\nimport {\n  AuthFailures,\n  isAuthFailure,\n  isConfigurationError,\n  isInfrastructureError,\n  BetterAuthConfigurationError,\n  type AuthFailure,\n} from \"./auth-errors.js\";\nimport {\n  INSTANCE_REGISTRY,\n  PRINCIPAL_RESOLVER,\n  TRANSPORT_REGISTRY,\n} from \"./auth-tokens.js\";\nimport { readErrorProperty } from \"./error-redactor.js\";\nimport type { InstanceLookup } from \"./instance-registry.js\";\nimport type { TransportRegistry } from \"./transport-registry.js\";\n\nexport { WS_CONNECTION_AUTH } from \"./auth-tokens.js\";\nexport function wsCloseCodeFor(failure: AuthFailure): 4401 | 4403 | 4429 {\n  return failure.status === 401 ? 4401 : failure.status === 403 ? 4403 : 4429;\n}\n\nconst STACK_FRAME = /^\\s+at .+:\\d+:\\d+\\)?$/;\n\n/**\n * Describes an unexpected connection-authentication error for the server log. Package\n * errors carry fixed messages and already-redacted causes. Application and runtime error\n * messages can quote client credentials (native Headers errors do), so only their name\n * and stack frames are kept.\n */\nexport function connectionErrorLog(error: unknown): {\n  message: string;\n  stack?: string;\n} {\n  const text = (value: unknown) =>\n    typeof value === \"string\" ? value : undefined;\n  let summary: string;\n  if (isConfigurationError(error)) {\n    summary = `${error.code}: ${error.detail}`;\n  } else if (isInfrastructureError(error)) {\n    const cause = readErrorProperty(error, \"cause\");\n    summary = `${error.message} (${text(readErrorProperty(cause, \"name\")) ?? \"Error\"}: ${text(readErrorProperty(cause, \"message\")) ?? \"\"})`;\n  } else {\n    const name = text(readErrorProperty(error, \"name\"));\n    summary = `${name !== undefined && /^[\\w$.]{1,64}$/.test(name) ? name : typeof error} (message withheld)`;\n  }\n  const frames = (text(readErrorProperty(error, \"stack\")) ?? \"\")\n    .split(/\\r?\\n/)\n    .filter((line) => STACK_FRAME.test(line));\n  return {\n    message: `WebSocket connection authentication failed: ${summary}`,\n    stack: frames.length > 0 ? [summary, ...frames].join(\"\\n\") : undefined,\n  };\n}\n\n/**\n * The `ws` execution context of a connection before any gateway handler runs. Nest exports no\n * public factory for execution contexts, so this implements the public `ExecutionContext`\n * interface with the values Nest's internal host reports for the arguments `[client, undefined]`.\n */\nexport class ConnectionExecutionContext implements ExecutionContext {\n  readonly #args: unknown[];\n\n  constructor(client: object) {\n    this.#args = [client, undefined];\n  }\n\n  getType<TContext extends string = ContextType>(): TContext {\n    return \"ws\" as TContext;\n  }\n\n  /** No handler runs yet, so there is no class; Nest's host reports `null` as well. */\n  getClass<T>(): Type<T> {\n    return null as unknown as Type<T>;\n  }\n\n  /** No handler runs yet; Nest's host reports `null` as well. */\n  getHandler(): ReturnType<ExecutionContext[\"getHandler\"]> {\n    return null as unknown as ReturnType<ExecutionContext[\"getHandler\"]>;\n  }\n\n  getArgs<T extends unknown[] = unknown[]>(): T {\n    return this.#args as T;\n  }\n\n  getArgByIndex<T>(index: number): T {\n    return this.#args[index] as T;\n  }\n\n  switchToHttp(): ReturnType<ExecutionContext[\"switchToHttp\"]> {\n    return {\n      getRequest: <T>() => this.getArgByIndex<T>(0),\n      getResponse: <T>() => this.getArgByIndex<T>(1),\n      getNext: <T>() => this.getArgByIndex<T>(2),\n    };\n  }\n\n  switchToRpc(): ReturnType<ExecutionContext[\"switchToRpc\"]> {\n    return {\n      getData: <T>() => this.getArgByIndex<T>(0),\n      getContext: <T>() => this.getArgByIndex<T>(1),\n    };\n  }\n\n  switchToWs(): ReturnType<ExecutionContext[\"switchToWs\"]> {\n    return {\n      getClient: <T>() => this.getArgByIndex<T>(0),\n      getData: <T>() => this.getArgByIndex<T>(1),\n      getPattern: () => this.getArgByIndex<string>(this.#args.length - 1),\n    };\n  }\n}\n\n/** Connection authentication delegates to the same origin and principal kernel as messages. */\nexport class WsConnectionAuth {\n  private readonly logger = new Logger(\"BetterAuth\");\n\n  constructor(\n    @Inject(INSTANCE_REGISTRY) private readonly instances: InstanceLookup,\n    @Inject(PRINCIPAL_RESOLVER) private readonly resolver: PrincipalResolver,\n    @Inject(TRANSPORT_REGISTRY) private readonly transports: TransportRegistry,\n  ) {}\n\n  async authenticate(\n    client: unknown,\n    options: { instance?: string } = {},\n  ): Promise<PrincipalResult> {\n    if (typeof client !== \"object\" || client === null) {\n      throw BetterAuthConfigurationError.atRequest(\n        \"INVALID_WS_CLIENT\",\n        \"Connection authentication requires a WebSocket client.\",\n      );\n    }\n    const context = new ConnectionExecutionContext(client);\n    const transport = this.transports.select(context);\n    const call = this.transports.describe(context, transport);\n    const entry = this.instances.get(options.instance ?? \"default\");\n    const browser = call.browser;\n    if (browser && entry.options.originCheck?.mode !== \"off\") {\n      const failure = await entry.handle.checkOrigin(browser, \"cookie\");\n      if (failure) {\n        return { outcome: \"rejected\", failure };\n      }\n    }\n    const accepts = new Set(\n      entry.sources\n        .filter((source) => source.acceptance === \"default\")\n        .flatMap((source) => [...source.kinds]),\n    );\n    try {\n      return await this.resolver.resolve(call, {\n        auth: entry.handle,\n        accepts,\n        sourceSet: JSON.stringify(\n          entry.sources.flatMap((source, index) =>\n            source.kinds.some((kind) => accepts.has(kind)) ? [index] : [],\n          ),\n        ),\n        freshness:\n          entry.options.session !== false &&\n          entry.options.session?.freshness === \"authoritative\"\n            ? \"authoritative\"\n            : \"default\",\n      });\n    } catch (error) {\n      if (isAuthFailure(error)) {\n        return { outcome: \"rejected\", failure: error };\n      }\n      throw error;\n    }\n  }\n\n  socketIoMiddleware(\n    options: { required?: boolean; instance?: string } = {},\n  ): (socket: unknown, next: (error?: Error) => void) => void {\n    return (socket, next) => {\n      void this.authenticate(socket, options).then(\n        (result) => {\n          const failure =\n            result.outcome === \"rejected\"\n              ? result.failure\n              : result.outcome === \"absent\" && options.required\n                ? AuthFailures.unauthenticated()\n                : undefined;\n          if (!failure) {\n            next();\n            return;\n          }\n          next(\n            Object.assign(new Error(failure.message), {\n              data: {\n                status: \"error\",\n                statusCode: failure.status,\n                code: failure.code,\n                ...(failure.reason ? { reason: failure.reason } : {}),\n                message: failure.message,\n              },\n            }),\n          );\n        },\n        (error: unknown) => {\n          const log = connectionErrorLog(error);\n          this.logger.error(log.message, log.stack);\n          next(\n            Object.assign(new Error(\"Internal server error\"), {\n              data: {\n                status: \"error\",\n                statusCode: 500,\n                message: \"Internal server error\",\n              },\n            }),\n          );\n        },\n      );\n    };\n  }\n}\n","import type { IncomingHttpHeaders } from \"node:http\";\nimport type { ExecutionContext } from \"@nestjs/common\";\nimport { MetadataScanner } from \"@nestjs/core\";\nimport {\n  SubscribeMessage,\n  WebSocketGateway,\n  WsException,\n} from \"@nestjs/websockets\";\nimport {\n  type AuthTransport,\n  type BootAdvice,\n  type BootAdviceContext,\n  type ExtensionDefinition,\n  type TransportCall,\n  type TransportValidationContext,\n} from \"./auth-contracts.js\";\nimport {\n  AuthFailures,\n  BetterAuthConfigurationError,\n  type AuthFailure,\n} from \"./auth-errors.js\";\nimport { EXTENSION_DEFINITION } from \"./bridge-protocol.js\";\nimport { toWebHeaders, upgradeRequestUrl } from \"./platform.js\";\nimport { WsConnectionAuth, WS_CONNECTION_AUTH } from \"./ws-connection-auth.js\";\n\nexport interface WsTransportOptions<C> {\n  /** Replaces principal credentials without changing the browser handshake used for origin checks. */\n  credentials?: (client: C) => HeadersInit | undefined;\n  /** Defaults to zero. Positive values delay revocation for non-authoritative messages. */\n  principalTtlMs?: number;\n  /** Every message handler requires explicit guard and scope coverage on every Nest major. */\n  gatewayCoverage?: \"error\" | \"warn\" | \"off\";\n}\nexport interface SocketIoClientLike {\n  readonly handshake: {\n    readonly headers: IncomingHttpHeaders;\n    readonly auth?: Record<string, unknown>;\n    readonly address?: string;\n    readonly url?: string;\n    readonly secure?: boolean;\n  };\n}\n/** Convert only mapped headers here: native Headers errors can quote the credential. */\nexport function mappedCredentialHeaders(\n  input: HeadersInit | undefined,\n): Headers {\n  const headers = new Headers();\n  if (input === undefined) {\n    return headers;\n  }\n  const malformed = () =>\n    AuthFailures.rejected({ status: 401, reason: \"MALFORMED_CREDENTIALS\" });\n  if (input === null || typeof input !== \"object\") {\n    throw malformed();\n  }\n  // Read caller-provided getters/iterators outside the conversion catch so their\n  // programming errors remain errors, as do errors thrown by the mapper itself.\n  const iterable = (input as { [Symbol.iterator]?: unknown })[Symbol.iterator];\n  if (iterable !== undefined && typeof iterable !== \"function\") {\n    throw malformed();\n  }\n  const entries: Iterable<unknown> =\n    typeof iterable === \"function\"\n      ? (input as Iterable<unknown>)\n      : Object.entries(input);\n  for (const entry of entries) {\n    if (!Array.isArray(entry) || entry.length !== 2) {\n      throw malformed();\n    }\n    const [name, value] = entry;\n    if (\n      typeof name !== \"string\" ||\n      typeof value !== \"string\" ||\n      /[\\r\\n\\0]/.test(value)\n    ) {\n      throw malformed();\n    }\n    try {\n      headers.append(name, value);\n    } catch {\n      throw malformed();\n    }\n  }\n  return headers;\n}\nexport function isSocketIo(client: unknown): client is SocketIoClientLike {\n  return typeof client === \"object\" && client !== null && \"handshake\" in client;\n}\nexport function wsException(failure: AuthFailure): WsException {\n  return new WsException({\n    status: \"error\",\n    statusCode: failure.status,\n    code: failure.code,\n    ...(failure.reason ? { reason: failure.reason } : {}),\n    message: failure.message,\n  });\n}\nexport function validateGateways(\n  context: TransportValidationContext,\n  coverage: WsTransportOptions<unknown>[\"gatewayCoverage\"],\n): void {\n  class Probe {\n    message(): void {}\n  }\n  WebSocketGateway()(Probe);\n  SubscribeMessage(\"probe\")(\n    Probe.prototype,\n    \"message\",\n    Object.getOwnPropertyDescriptor(Probe.prototype, \"message\")!,\n  );\n  if (\n    Reflect.getMetadata(\"websockets:is_gateway\", Probe) !== true ||\n    Reflect.getMetadata(\n      \"websockets:message_mapping\",\n      Probe.prototype.message,\n    ) !== true\n  ) {\n    throw new BetterAuthConfigurationError(\n      \"NEST_METADATA_KEY_CHANGED\",\n      \"Nest WebSocket gateway/message metadata failed its canary.\",\n    );\n  }\n  const scanner = new MetadataScanner();\n  for (const wrapper of context.discovery.getProviders()) {\n    const target = wrapper.metatype;\n    if (\n      !target?.prototype ||\n      wrapper.isAlias ||\n      !Reflect.getMetadata(\"websockets:is_gateway\", target)\n    ) {\n      continue;\n    }\n    for (const method of scanner.getAllMethodNames(target.prototype)) {\n      if (\n        Reflect.getMetadata(\n          \"websockets:message_mapping\",\n          target.prototype[method],\n        )\n      ) {\n        context.claim(target, method, \"explicit\", {\n          everyHandler: true,\n          code: \"GATEWAY_UNGUARDED\",\n          coverage: coverage ?? \"error\",\n          hint: `Add @UseBetterAuth() to ${target.name} (or @Public() to opt out). Global guards and interceptors do not reach gateways on NestJS 11, and this check does not depend on the version.`,\n        });\n      }\n    }\n  }\n}\nexport function quotaAdvice(\n  context: BootAdviceContext,\n  ttl: number,\n): readonly BootAdvice[] {\n  return ttl === 0 &&\n    context.sources.some((source) => source.effects?.consumesQuota)\n    ? [\n        {\n          level: \"warn\",\n          code: \"W_QUOTA_PER_MESSAGE\",\n          message:\n            \"Quota-consuming WebSocket principals verify on every message.\",\n          hint: \"Consider connection-time authentication and principalTtlMs; a positive TTL delays revocation on non-authoritative handlers.\",\n        },\n      ]\n    : [];\n}\nexport function transportDefinition(\n  transport: AuthTransport,\n): ExtensionDefinition<AuthTransport> {\n  return {\n    [EXTENSION_DEFINITION]: true,\n    use: { useFactory: () => transport },\n    providers: [\n      WsConnectionAuth,\n      { provide: WS_CONNECTION_AUTH, useExisting: WsConnectionAuth },\n    ],\n    exports: [WsConnectionAuth, WS_CONNECTION_AUTH],\n  };\n}\nexport function principalTtl(value = 0): number {\n  if (!Number.isFinite(value) || value < 0) {\n    throw new BetterAuthConfigurationError(\n      \"INVALID_WS_TTL\",\n      \"principalTtlMs must be a finite non-negative number.\",\n    );\n  }\n  return value;\n}\nexport function socketIoTransport(\n  options: WsTransportOptions<SocketIoClientLike> = {},\n): ExtensionDefinition<AuthTransport> {\n  const ttl = principalTtl(options.principalTtlMs);\n  return transportDefinition({\n    id: \"socket.io\",\n    handles: (context) =>\n      context.getType() === \"ws\" &&\n      isSocketIo(context.switchToWs().getClient()),\n    describe(context: ExecutionContext): TransportCall {\n      const client = context.switchToWs().getClient<SocketIoClientLike>();\n      const original = () => toWebHeaders(client.handshake.headers);\n      return {\n        key: context.getArgs(),\n        invocation: context.getArgs(),\n        connection: client,\n        principalTtlMs: ttl,\n        headers: () => {\n          const headers = original();\n          let mapped: HeadersInit | undefined;\n          if (options.credentials) {\n            mapped = options.credentials(client);\n          } else if (!headers.has(\"authorization\")) {\n            const token = client.handshake.auth?.token;\n            if (token !== undefined) {\n              if (typeof token !== \"string\") {\n                throw AuthFailures.rejected({\n                  status: 401,\n                  reason: \"MALFORMED_CREDENTIALS\",\n                });\n              }\n              mapped = { authorization: `Bearer ${token}` };\n            }\n          }\n          mappedCredentialHeaders(mapped).forEach((value, name) => {\n            headers.set(name, value);\n          });\n          return headers;\n        },\n        get clientIp() {\n          return client.handshake.address ?? null;\n        },\n        cookies: null,\n        get request() {\n          return { method: \"GET\", url: upgradeRequestUrl(client.handshake) };\n        },\n        param: (name) => context.switchToWs().getData()?.[name],\n        get browser() {\n          return {\n            enforce: true,\n            key: client,\n            headers: original,\n            url: upgradeRequestUrl(client.handshake),\n          };\n        },\n      };\n    },\n    toException: wsException,\n    validate: (context) => validateGateways(context, options.gatewayCoverage),\n    advise: (context) => quotaAdvice(context, ttl),\n  });\n}\n","import type { IncomingHttpHeaders } from \"node:http\";\nimport type { AuthTransport, ExtensionDefinition } from \"./auth-contracts.js\";\nimport { UPGRADE_REQUEST } from \"./bridge-protocol.js\";\nimport { BetterAuthConfigurationError } from \"./auth-errors.js\";\nimport { toWebHeaders, upgradeRequestUrl } from \"./platform.js\";\nimport {\n  isSocketIo,\n  mappedCredentialHeaders,\n  principalTtl,\n  quotaAdvice,\n  transportDefinition,\n  validateGateways,\n  wsException,\n  type WsTransportOptions,\n} from \"./socket-io-transport.js\";\n\nexport { UPGRADE_REQUEST } from \"./bridge-protocol.js\";\nexport interface WsClientLike {\n  readonly [UPGRADE_REQUEST]?: {\n    readonly headers: Headers;\n    readonly url?: string;\n    readonly remoteAddress?: string;\n    readonly encrypted?: boolean;\n  };\n}\nexport interface WsAdapterLike {\n  bindClientConnect(\n    server: unknown,\n    callback: (...args: any[]) => void,\n  ): unknown;\n}\nexport function recordUpgradeRequest(\n  client: object,\n  request: {\n    headers: IncomingHttpHeaders;\n    url?: string;\n    socket?: { remoteAddress?: string; encrypted?: boolean };\n  },\n): void {\n  Object.defineProperty(client, UPGRADE_REQUEST, {\n    value: Object.freeze({\n      headers: toWebHeaders(request.headers),\n      url: request.url,\n      remoteAddress: request.socket?.remoteAddress,\n      encrypted: request.socket?.encrypted,\n    }),\n    configurable: true,\n  });\n}\nexport function withUpgradeRequest<\n  T extends new (\n    ...args: any[]\n  ) => WsAdapterLike,\n>(Base: T): T {\n  return class extends Base {\n    override bindClientConnect(\n      server: unknown,\n      callback: (...args: any[]) => void,\n    ): unknown {\n      return super.bindClientConnect(server, (client, request, ...rest) => {\n        recordUpgradeRequest(client, request);\n        callback(client, request, ...rest);\n      });\n    }\n  };\n}\nexport function wsTransport(\n  options: WsTransportOptions<WsClientLike> = {},\n): ExtensionDefinition<AuthTransport> {\n  const ttl = principalTtl(options.principalTtlMs);\n  return transportDefinition({\n    id: \"ws\",\n    handles: (context) =>\n      context.getType() === \"ws\" &&\n      !isSocketIo(context.switchToWs().getClient()),\n    describe(context) {\n      const client = context.switchToWs().getClient<WsClientLike>();\n      const upgrade = () => {\n        const request = client[UPGRADE_REQUEST];\n        if (!request) {\n          throw BetterAuthConfigurationError.atRequest(\n            \"WS_UPGRADE_REQUEST_MISSING\",\n            \"WebSocket authentication requires its upgrade request.\",\n            {\n              hint: \"app.useWebSocketAdapter(new (withUpgradeRequest(WsAdapter))(app));\",\n            },\n          );\n        }\n        return request;\n      };\n      const url = () => {\n        const request = upgrade();\n        return upgradeRequestUrl({\n          headers: request.headers,\n          url: request.url,\n          secure: request.encrypted,\n        });\n      };\n      return {\n        key: context.getArgs(),\n        invocation: context.getArgs(),\n        connection: client,\n        principalTtlMs: ttl,\n        headers: () => {\n          const headers = new Headers(upgrade().headers);\n          mappedCredentialHeaders(options.credentials?.(client)).forEach(\n            (value, name) => {\n              headers.set(name, value);\n            },\n          );\n          return headers;\n        },\n        get clientIp() {\n          return upgrade().remoteAddress ?? null;\n        },\n        cookies: null,\n        get request() {\n          return { method: \"GET\", url: url() };\n        },\n        param: (name) => context.switchToWs().getData()?.[name],\n        get browser() {\n          return {\n            enforce: true,\n            key: client,\n            headers: () => new Headers(upgrade().headers),\n            url: url(),\n          };\n        },\n      };\n    },\n    toException: wsException,\n    validate: (context) => validateGateways(context, options.gatewayCoverage),\n    advise: (context) => quotaAdvice(context, ttl),\n  });\n}\n"],"mappings":";;;;;;;;AA0BA,SAAgB,eAAe,SAA0C;CACvE,OAAO,QAAQ,WAAW,MAAM,OAAO,QAAQ,WAAW,MAAM,OAAO;AACzE;AAEA,MAAM,cAAc;;;;;;;AAQpB,SAAgB,mBAAmB,OAGjC;CACA,MAAM,QAAQ,UACZ,OAAO,UAAU,WAAW,QAAQ,KAAA;CACtC,IAAI;CACJ,IAAI,qBAAqB,KAAK,GAC5B,UAAU,GAAG,MAAM,KAAK,IAAI,MAAM;MAC7B,IAAI,sBAAsB,KAAK,GAAG;EACvC,MAAM,QAAQ,kBAAkB,OAAO,OAAO;EAC9C,UAAU,GAAG,MAAM,QAAQ,IAAI,KAAK,kBAAkB,OAAO,MAAM,CAAC,KAAK,QAAQ,IAAI,KAAK,kBAAkB,OAAO,SAAS,CAAC,KAAK,GAAG;CACvI,OAAO;EACL,MAAM,OAAO,KAAK,kBAAkB,OAAO,MAAM,CAAC;EAClD,UAAU,GAAG,SAAS,KAAA,KAAa,iBAAiB,KAAK,IAAI,IAAI,OAAO,OAAO,MAAM;CACvF;CACA,MAAM,UAAU,KAAK,kBAAkB,OAAO,OAAO,CAAC,KAAK,GAAA,CACxD,MAAM,OAAO,CAAC,CACd,QAAQ,SAAS,YAAY,KAAK,IAAI,CAAC;CAC1C,OAAO;EACL,SAAS,+CAA+C;EACxD,OAAO,OAAO,SAAS,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,CAAC,KAAK,IAAI,IAAI,KAAA;CAC/D;AACF;;;;;;AAOA,IAAa,6BAAb,MAAoE;CAClE;CAEA,YAAY,QAAgB;EAC1B,KAAK,QAAQ,CAAC,QAAQ,KAAA,CAAS;CACjC;CAEA,UAA2D;EACzD,OAAO;CACT;;CAGA,WAAuB;EACrB,OAAO;CACT;;CAGA,aAAyD;EACvD,OAAO;CACT;CAEA,UAA8C;EAC5C,OAAO,KAAK;CACd;CAEA,cAAiB,OAAkB;EACjC,OAAO,KAAK,MAAM;CACpB;CAEA,eAA6D;EAC3D,OAAO;GACL,kBAAqB,KAAK,cAAiB,CAAC;GAC5C,mBAAsB,KAAK,cAAiB,CAAC;GAC7C,eAAkB,KAAK,cAAiB,CAAC;EAC3C;CACF;CAEA,cAA2D;EACzD,OAAO;GACL,eAAkB,KAAK,cAAiB,CAAC;GACzC,kBAAqB,KAAK,cAAiB,CAAC;EAC9C;CACF;CAEA,aAAyD;EACvD,OAAO;GACL,iBAAoB,KAAK,cAAiB,CAAC;GAC3C,eAAkB,KAAK,cAAiB,CAAC;GACzC,kBAAkB,KAAK,cAAsB,KAAK,MAAM,SAAS,CAAC;EACpE;CACF;AACF;AAGO,IAAM,mBAAN,MAAM,iBAAiB;CAIkB;CACC;CACA;CAL/C,SAA0B,IAAI,OAAO,YAAY;CAEjD,YACE,WACA,UACA,YACA;EAH4C,KAAA,YAAA;EACC,KAAA,WAAA;EACA,KAAA,aAAA;CAC5C;CAEH,MAAM,aACJ,QACA,UAAiC,CAAC,GACR;EAC1B,IAAI,OAAO,WAAW,YAAY,WAAW,MAC3C,MAAM,6BAA6B,UACjC,qBACA,wDACF;EAEF,MAAM,UAAU,IAAI,2BAA2B,MAAM;EACrD,MAAM,YAAY,KAAK,WAAW,OAAO,OAAO;EAChD,MAAM,OAAO,KAAK,WAAW,SAAS,SAAS,SAAS;EACxD,MAAM,QAAQ,KAAK,UAAU,IAAI,QAAQ,YAAY,SAAS;EAC9D,MAAM,UAAU,KAAK;EACrB,IAAI,WAAW,MAAM,QAAQ,aAAa,SAAS,OAAO;GACxD,MAAM,UAAU,MAAM,MAAM,OAAO,YAAY,SAAS,QAAQ;GAChE,IAAI,SACF,OAAO;IAAE,SAAS;IAAY;GAAQ;EAE1C;EACA,MAAM,UAAU,IAAI,IAClB,MAAM,QACH,QAAQ,WAAW,OAAO,eAAe,SAAS,CAAC,CACnD,SAAS,WAAW,CAAC,GAAG,OAAO,KAAK,CAAC,CAC1C;EACA,IAAI;GACF,OAAO,MAAM,KAAK,SAAS,QAAQ,MAAM;IACvC,MAAM,MAAM;IACZ;IACA,WAAW,KAAK,UACd,MAAM,QAAQ,SAAS,QAAQ,UAC7B,OAAO,MAAM,MAAM,SAAS,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAC9D,CACF;IACA,WACE,MAAM,QAAQ,YAAY,SAC1B,MAAM,QAAQ,SAAS,cAAc,kBACjC,kBACA;GACR,CAAC;EACH,SAAS,OAAO;GACd,IAAI,cAAc,KAAK,GACrB,OAAO;IAAE,SAAS;IAAY,SAAS;GAAM;GAE/C,MAAM;EACR;CACF;CAEA,mBACE,UAAqD,CAAC,GACI;EAC1D,QAAQ,QAAQ,SAAS;GACvB,KAAU,aAAa,QAAQ,OAAO,CAAC,CAAC,MACrC,WAAW;IACV,MAAM,UACJ,OAAO,YAAY,aACf,OAAO,UACP,OAAO,YAAY,YAAY,QAAQ,WACrC,aAAa,gBAAgB,IAC7B,KAAA;IACR,IAAI,CAAC,SAAS;KACZ,KAAK;KACL;IACF;IACA,KACE,OAAO,OAAO,IAAI,MAAM,QAAQ,OAAO,GAAG,EACxC,MAAM;KACJ,QAAQ;KACR,YAAY,QAAQ;KACpB,MAAM,QAAQ;KACd,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;KACnD,SAAS,QAAQ;IACnB,EACF,CAAC,CACH;GACF,IACC,UAAmB;IAClB,MAAM,MAAM,mBAAmB,KAAK;IACpC,KAAK,OAAO,MAAM,IAAI,SAAS,IAAI,KAAK;IACxC,KACE,OAAO,uBAAO,IAAI,MAAM,uBAAuB,GAAG,EAChD,MAAM;KACJ,QAAQ;KACR,YAAY;KACZ,SAAS;IACX,EACF,CAAC,CACH;GACF,CACF;EACF;CACF;AACF;;CAlGK,gBAAA,GAAA,OAAO,iBAAiB,CAAA;CACxB,gBAAA,GAAA,OAAO,kBAAkB,CAAA;CACzB,gBAAA,GAAA,OAAO,kBAAkB,CAAA;;;;;;;;;;ACrF9B,SAAgB,wBACd,OACS;CACT,MAAM,UAAU,IAAI,QAAQ;CAC5B,IAAI,UAAU,KAAA,GACZ,OAAO;CAET,MAAM,kBACJ,aAAa,SAAS;EAAE,QAAQ;EAAK,QAAQ;CAAwB,CAAC;CACxE,IAAI,UAAU,QAAQ,OAAO,UAAU,UACrC,MAAM,UAAU;CAIlB,MAAM,WAAY,MAA0C,OAAO;CACnE,IAAI,aAAa,KAAA,KAAa,OAAO,aAAa,YAChD,MAAM,UAAU;CAElB,MAAM,UACJ,OAAO,aAAa,aACf,QACD,OAAO,QAAQ,KAAK;CAC1B,KAAK,MAAM,SAAS,SAAS;EAC3B,IAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,WAAW,GAC5C,MAAM,UAAU;EAElB,MAAM,CAAC,MAAM,SAAS;EACtB,IACE,OAAO,SAAS,YAChB,OAAO,UAAU,YACjB,WAAW,KAAK,KAAK,GAErB,MAAM,UAAU;EAElB,IAAI;GACF,QAAQ,OAAO,MAAM,KAAK;EAC5B,QAAQ;GACN,MAAM,UAAU;EAClB;CACF;CACA,OAAO;AACT;AACA,SAAgB,WAAW,QAA+C;CACxE,OAAO,OAAO,WAAW,YAAY,WAAW,QAAQ,eAAe;AACzE;AACA,SAAgB,YAAY,SAAmC;CAC7D,OAAO,IAAI,YAAY;EACrB,QAAQ;EACR,YAAY,QAAQ;EACpB,MAAM,QAAQ;EACd,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;EACnD,SAAS,QAAQ;CACnB,CAAC;AACH;AACA,SAAgB,iBACd,SACA,UACM;CACN,MAAM,MAAM;EACV,UAAgB,CAAC;CACnB;CACA,iBAAiB,CAAC,CAAC,KAAK;CACxB,iBAAiB,OAAO,CAAC,CACvB,MAAM,WACN,WACA,OAAO,yBAAyB,MAAM,WAAW,SAAS,CAC5D;CACA,IACE,QAAQ,YAAY,yBAAyB,KAAK,MAAM,QACxD,QAAQ,YACN,8BACA,MAAM,UAAU,OAClB,MAAM,MAEN,MAAM,IAAI,6BACR,6BACA,4DACF;CAEF,MAAM,UAAU,IAAI,gBAAgB;CACpC,KAAK,MAAM,WAAW,QAAQ,UAAU,aAAa,GAAG;EACtD,MAAM,SAAS,QAAQ;EACvB,IACE,CAAC,QAAQ,aACT,QAAQ,WACR,CAAC,QAAQ,YAAY,yBAAyB,MAAM,GAEpD;EAEF,KAAK,MAAM,UAAU,QAAQ,kBAAkB,OAAO,SAAS,GAC7D,IACE,QAAQ,YACN,8BACA,OAAO,UAAU,OACnB,GAEA,QAAQ,MAAM,QAAQ,QAAQ,YAAY;GACxC,cAAc;GACd,MAAM;GACN,UAAU,YAAY;GACtB,MAAM,2BAA2B,OAAO,KAAK;EAC/C,CAAC;CAGP;AACF;AACA,SAAgB,YACd,SACA,KACuB;CACvB,OAAO,QAAQ,KACb,QAAQ,QAAQ,MAAM,WAAW,OAAO,SAAS,aAAa,IAC5D,CACE;EACE,OAAO;EACP,MAAM;EACN,SACE;EACF,MAAM;CACR,CACF,IACA,CAAC;AACP;AACA,SAAgB,oBACd,WACoC;CACpC,OAAO;GACJ,uBAAuB;EACxB,KAAK,EAAE,kBAAkB,UAAU;EACnC,WAAW,CACT,kBACA;GAAE,SAAS;GAAoB,aAAa;EAAiB,CAC/D;EACA,SAAS,CAAC,kBAAkB,kBAAkB;CAChD;AACF;AACA,SAAgB,aAAa,QAAQ,GAAW;CAC9C,IAAI,CAAC,OAAO,SAAS,KAAK,KAAK,QAAQ,GACrC,MAAM,IAAI,6BACR,kBACA,sDACF;CAEF,OAAO;AACT;AACA,SAAgB,kBACd,UAAkD,CAAC,GACf;CACpC,MAAM,MAAM,aAAa,QAAQ,cAAc;CAC/C,OAAO,oBAAoB;EACzB,IAAI;EACJ,UAAU,YACR,QAAQ,QAAQ,MAAM,QACtB,WAAW,QAAQ,WAAW,CAAC,CAAC,UAAU,CAAC;EAC7C,SAAS,SAA0C;GACjD,MAAM,SAAS,QAAQ,WAAW,CAAC,CAAC,UAA8B;GAClE,MAAM,iBAAiB,aAAa,OAAO,UAAU,OAAO;GAC5D,OAAO;IACL,KAAK,QAAQ,QAAQ;IACrB,YAAY,QAAQ,QAAQ;IAC5B,YAAY;IACZ,gBAAgB;IAChB,eAAe;KACb,MAAM,UAAU,SAAS;KACzB,IAAI;KACJ,IAAI,QAAQ,aACV,SAAS,QAAQ,YAAY,MAAM;UAC9B,IAAI,CAAC,QAAQ,IAAI,eAAe,GAAG;MACxC,MAAM,QAAQ,OAAO,UAAU,MAAM;MACrC,IAAI,UAAU,KAAA,GAAW;OACvB,IAAI,OAAO,UAAU,UACnB,MAAM,aAAa,SAAS;QAC1B,QAAQ;QACR,QAAQ;OACV,CAAC;OAEH,SAAS,EAAE,eAAe,UAAU,QAAQ;MAC9C;KACF;KACA,wBAAwB,MAAM,CAAC,CAAC,SAAS,OAAO,SAAS;MACvD,QAAQ,IAAI,MAAM,KAAK;KACzB,CAAC;KACD,OAAO;IACT;IACA,IAAI,WAAW;KACb,OAAO,OAAO,UAAU,WAAW;IACrC;IACA,SAAS;IACT,IAAI,UAAU;KACZ,OAAO;MAAE,QAAQ;MAAO,KAAK,kBAAkB,OAAO,SAAS;KAAE;IACnE;IACA,QAAQ,SAAS,QAAQ,WAAW,CAAC,CAAC,QAAQ,CAAC,GAAG;IAClD,IAAI,UAAU;KACZ,OAAO;MACL,SAAS;MACT,KAAK;MACL,SAAS;MACT,KAAK,kBAAkB,OAAO,SAAS;KACzC;IACF;GACF;EACF;EACA,aAAa;EACb,WAAW,YAAY,iBAAiB,SAAS,QAAQ,eAAe;EACxE,SAAS,YAAY,YAAY,SAAS,GAAG;CAC/C,CAAC;AACH;;;AC1NA,SAAgB,qBACd,QACA,SAKM;CACN,OAAO,eAAe,QAAQ,iBAAiB;EAC7C,OAAO,OAAO,OAAO;GACnB,SAAS,aAAa,QAAQ,OAAO;GACrC,KAAK,QAAQ;GACb,eAAe,QAAQ,QAAQ;GAC/B,WAAW,QAAQ,QAAQ;EAC7B,CAAC;EACD,cAAc;CAChB,CAAC;AACH;AACA,SAAgB,mBAId,MAAY;CACZ,OAAO,cAAc,KAAK;EACxB,kBACE,QACA,UACS;GACT,OAAO,MAAM,kBAAkB,SAAS,QAAQ,SAAS,GAAG,SAAS;IACnE,qBAAqB,QAAQ,OAAO;IACpC,SAAS,QAAQ,SAAS,GAAG,IAAI;GACnC,CAAC;EACH;CACF;AACF;AACA,SAAgB,YACd,UAA4C,CAAC,GACT;CACpC,MAAM,MAAM,aAAa,QAAQ,cAAc;CAC/C,OAAO,oBAAoB;EACzB,IAAI;EACJ,UAAU,YACR,QAAQ,QAAQ,MAAM,QACtB,CAAC,WAAW,QAAQ,WAAW,CAAC,CAAC,UAAU,CAAC;EAC9C,SAAS,SAAS;GAChB,MAAM,SAAS,QAAQ,WAAW,CAAC,CAAC,UAAwB;GAC5D,MAAM,gBAAgB;IACpB,MAAM,UAAU,OAAO;IACvB,IAAI,CAAC,SACH,MAAM,6BAA6B,UACjC,8BACA,0DACA,EACE,MAAM,qEACR,CACF;IAEF,OAAO;GACT;GACA,MAAM,YAAY;IAChB,MAAM,UAAU,QAAQ;IACxB,OAAO,kBAAkB;KACvB,SAAS,QAAQ;KACjB,KAAK,QAAQ;KACb,QAAQ,QAAQ;IAClB,CAAC;GACH;GACA,OAAO;IACL,KAAK,QAAQ,QAAQ;IACrB,YAAY,QAAQ,QAAQ;IAC5B,YAAY;IACZ,gBAAgB;IAChB,eAAe;KACb,MAAM,UAAU,IAAI,QAAQ,QAAQ,CAAC,CAAC,OAAO;KAC7C,wBAAwB,QAAQ,cAAc,MAAM,CAAC,CAAC,CAAC,SACpD,OAAO,SAAS;MACf,QAAQ,IAAI,MAAM,KAAK;KACzB,CACF;KACA,OAAO;IACT;IACA,IAAI,WAAW;KACb,OAAO,QAAQ,CAAC,CAAC,iBAAiB;IACpC;IACA,SAAS;IACT,IAAI,UAAU;KACZ,OAAO;MAAE,QAAQ;MAAO,KAAK,IAAI;KAAE;IACrC;IACA,QAAQ,SAAS,QAAQ,WAAW,CAAC,CAAC,QAAQ,CAAC,GAAG;IAClD,IAAI,UAAU;KACZ,OAAO;MACL,SAAS;MACT,KAAK;MACL,eAAe,IAAI,QAAQ,QAAQ,CAAC,CAAC,OAAO;MAC5C,KAAK,IAAI;KACX;IACF;GACF;EACF;EACA,aAAa;EACb,WAAW,YAAY,iBAAiB,SAAS,QAAQ,eAAe;EACxE,SAAS,YAAY,YAAY,SAAS,GAAG;CAC/C,CAAC;AACH"}