@nestjs-kit/better-auth 0.0.0-stage → 2.1.0

package/dist/auth-module-CtHx3gRU.mjs

@@ -0,0 +1,2708 @@
+import { a as getAPIErrorHeaders, c as isConfigurationError, f as ErrorRedactor, i as createInfrastructureError, l as isInfrastructureError, n as BetterAuthConfigurationError, s as isAuthFailure, t as AuthFailures } from "./auth-errors-C3rbTV9p.mjs";
+import { A as SKIP_ORIGIN_CHECK_METADATA, B as getPrincipalSourcesToken, C as PRINCIPAL_RESOLVER, D as ROUTE_PLANNER, E as REQUIREMENTS_METADATA, F as getBetterAuthHandleToken, I as getBetterAuthInstanceToken, L as getBetterAuthOptionsToken, M as TRANSPORT_REGISTRY, N as USE_BETTER_AUTH_METADATA, O as SCOPE_CORE, R as getBetterAuthServiceToken, S as PRINCIPAL_READINGS, T as REQUEST_SCOPE, _ as MOUNT_COORDINATOR, a as ACCESS_METADATA, b as POLICY_RESOLVER, c as AUTH_INSTANCE_METADATA, d as FRESHNESS_METADATA, f as GUARD_CORE, g as INVOCATION_VALUES, h as INVOCATION_PARAMS_METADATA, i as ACCEPT_PRINCIPALS_METADATA, j as TRANSPORTS, k as SKIP_DEFAULT_REQUIREMENTS_METADATA, m as INSTANCE_REGISTRY, n as __decorateParam, o as AMBIGUOUS_INVOCATION_VALUE, r as __decorateMetadata, s as AUTH_ENHANCER, t as __decorate, u as FORWARD_COOKIES_METADATA, v as PLATFORMS, x as PRINCIPAL_PARAMS_METADATA, y as POLICY_INVOKER, z as getExtensionToken } from "./decorate-Dt0e9K6R.mjs";
+import { a as absent, c as normalizeForRequest, i as MemoKeys, l as rejected, n as ScopeCore, o as authenticated, r as ChainPrincipalResolver, t as BetterAuthScopeInterceptor, u as requestHeaders } from "./auth-scope-interceptor-DYPn3b8M.mjs";
+import { n as GuardCore, t as BetterAuthGuard } from "./auth-guard-h9QB_l11.mjs";
+import { n as EXTENSION_DEFINITION, t as BRIDGE_HANDLE } from "./bridge-protocol-c66aEkr5.mjs";
+import { C as memoKey, S as RequestScope, b as readHookMetadata, u as Require, y as definePrincipalParam } from "./auth-decorators-B1mFnGJ6.mjs";
+import { t as PrincipalReadings } from "./principal-readings-Ied2staw.mjs";
+import { i as readBoundedBody } from "./platform-CZl7TY8j.mjs";
+import { isAPIError } from "better-auth/api";
+import { Controller, ForbiddenException, Get, Global, HttpException, Inject, Logger, Module, RequestMethod, UnauthorizedException, UseGuards, UseInterceptors, VERSION_NEUTRAL, VersioningType } from "@nestjs/common";
+import { APP_GUARD, APP_INTERCEPTOR, ApplicationConfig, DiscoveryModule, DiscoveryService, HttpAdapterHost, MetadataScanner, ModuleRef, ModulesContainer, Reflector } from "@nestjs/core";
+//#region src/route-planner.ts
+function classes(target) {
+	const result = [];
+	for (let current = target; current && current !== Function.prototype; current = Object.getPrototypeOf(current)) result.push(current);
+	return result;
+}
+function own(key, target) {
+	return Reflect.getOwnMetadata(key, target);
+}
+function closest(key, targets) {
+	for (const target of targets) {
+		const value = own(key, target);
+		if (value !== void 0) return value;
+	}
+}
+function methodName(target, handler) {
+	for (let prototype = target.prototype; prototype && prototype !== Object.prototype; prototype = Object.getPrototypeOf(prototype)) for (const name of Object.getOwnPropertyNames(prototype)) if (name !== "constructor" && Object.getOwnPropertyDescriptor(prototype, name)?.value === handler) return name;
+	throw new BetterAuthConfigurationError("UNKNOWN_HANDLER", `Cannot locate handler on ${target.name}`);
+}
+/** An empty allOf() would allow every caller and an empty anyOf() every denial; neither is a requirement. */
+function rejectEmptyGroups(expression, site, origin) {
+	if (!("anyOf" in expression) && !("allOf" in expression)) return;
+	const [name, children] = "anyOf" in expression ? ["anyOf", expression.anyOf] : ["allOf", expression.allOf];
+	if (!children.length) throw new BetterAuthConfigurationError("EMPTY_REQUIREMENT_GROUP", `${site} has an empty ${name}() requirement group (declared by ${origin})`, "Give the group at least one requirement, or omit the requirement when a configured list is empty.");
+	for (const child of children) rejectEmptyGroups(child, site, origin);
+}
+var RoutePlanner = class {
+	instances;
+	policies;
+	transports;
+	cache = /* @__PURE__ */ new WeakMap();
+	constructor(instances, policies, transports) {
+		this.instances = instances;
+		this.policies = policies;
+		this.transports = transports;
+	}
+	prepare(target, method) {
+		const handler = Reflect.get(target.prototype, method);
+		if (typeof handler !== "function") throw new BetterAuthConfigurationError("UNKNOWN_HANDLER", `${target.name}.${method} is not a handler`);
+		const chain = classes(target);
+		const nested = this.transports.defaultAccessFor(target, method) === "inherit";
+		const levels = nested ? [handler] : [handler, ...chain];
+		const site = `${target.name}.${method}`;
+		for (const level of levels) {
+			const access = own(ACCESS_METADATA, level);
+			if ((access === "public" || access === "optional") && (own(REQUIREMENTS_METADATA, level)?.length ?? 0) > 0) throw new BetterAuthConfigurationError("CONTRADICTORY_ACCESS", `${site} combines anonymous access and requirements at the same level`);
+		}
+		const instance = closest(AUTH_INSTANCE_METADATA, [handler, ...chain]) ?? "default";
+		const entry = this.instances.get(instance);
+		let access = nested ? "inherit" : entry.options.defaultAccess === "public" ? "public" : "required";
+		for (const level of levels) {
+			const declared = own(ACCESS_METADATA, level);
+			if (declared) {
+				access = declared;
+				break;
+			}
+			if ((own(REQUIREMENTS_METADATA, level)?.length ?? 0) > 0 || nested && own(ACCEPT_PRINCIPALS_METADATA, level) !== void 0) {
+				access = "required";
+				break;
+			}
+		}
+		const skips = closest(SKIP_DEFAULT_REQUIREMENTS_METADATA, levels) === true;
+		const declaredRequirements = access === "required" ? [
+			...(skips ? [] : entry.options.defaultRequirements ?? []).map((expression) => ({
+				expression,
+				origin: "defaultRequirements"
+			})),
+			...nested ? [] : [...chain].reverse().flatMap((level) => (own(REQUIREMENTS_METADATA, level) ?? []).map((expression) => ({
+				expression,
+				origin: `${level.name} (class)`
+			}))),
+			...(own(REQUIREMENTS_METADATA, handler) ?? []).map((expression) => ({
+				expression,
+				origin: `${site} (method)`
+			}))
+		] : [];
+		const requirements = declaredRequirements.map((item) => item.expression);
+		for (const { expression, origin } of declaredRequirements) rejectEmptyGroups(expression, site, origin);
+		return {
+			handler,
+			chain,
+			levels,
+			nested,
+			site,
+			instance,
+			entry,
+			access,
+			skips,
+			requirements,
+			declaredRequirements
+		};
+	}
+	requirementsOf(target, method) {
+		return Object.freeze(this.prepare(target, method).requirements);
+	}
+	forContext(context) {
+		try {
+			return this.plan(context.getClass(), methodName(context.getClass(), context.getHandler()));
+		} catch (error) {
+			if (isConfigurationError(error) && error.phase !== "request") throw BetterAuthConfigurationError.atRequest(error.code, error.detail, {
+				site: `${context.getClass().name}.${context.getHandler().name}`,
+				hint: error.hint
+			});
+			throw error;
+		}
+	}
+	plan(target, method) {
+		const handler = Reflect.get(target.prototype, method);
+		let cache = this.cache.get(target);
+		const previous = cache?.get(handler);
+		if (previous) return previous;
+		const p = this.prepare(target, method);
+		const { entry, levels, chain } = p;
+		const allKinds = new Set(entry.sources.flatMap((source) => [...source.kinds]));
+		const accepts = new Set(closest(ACCEPT_PRINCIPALS_METADATA, levels) ?? entry.sources.filter((source) => source.acceptance === "default").flatMap((source) => [...source.kinds]));
+		let fresh = closest(FRESHNESS_METADATA, levels) === true || entry.options.session !== false && entry.options.session?.freshness === "authoritative";
+		const admitted = (expression) => {
+			if ("anyOf" in expression) return new Set(expression.anyOf.flatMap((child) => [...admitted(child)]));
+			if ("allOf" in expression) return intersection(expression.allOf.map(admitted), allKinds);
+			const policy = this.policies.resolve(expression.policy);
+			const kinds = expression.principals ?? policy.requires?.principals;
+			if (expression.freshIdentity ?? policy.requires?.freshIdentity) fresh = true;
+			if (kinds) for (const kind of kinds) accepts.add(kind);
+			return new Set(kinds ?? entry.sources.filter((source) => !source.delegates).flatMap((source) => [...source.kinds]));
+		};
+		const permitted = p.requirements.map(admitted);
+		for (const kind of accepts) if (!allKinds.has(kind)) throw new BetterAuthConfigurationError("UNKNOWN_PRINCIPAL_KIND", `${p.site} accepts unavailable principal kind ${kind}`);
+		const parameters = own(PRINCIPAL_PARAMS_METADATA, handler) ?? [];
+		if (p.access === "public" && parameters.length) throw new BetterAuthConfigurationError("PUBLIC_READS_PRINCIPAL", `${p.site} reads a principal on a public handler`, "Use OptionalAuth");
+		const principalParams = parameters.flatMap((param) => param.kind ? [{
+			kind: param.kind,
+			reason: param.reason
+		}] : []);
+		if (p.access !== "inherit") {
+			for (const param of principalParams) if ([...accepts].some((kind) => kind !== param.kind)) throw new BetterAuthConfigurationError("PRINCIPAL_PARAM_CONFLICT", `${p.site} admits a kind rejected by its principal parameter`, "Use CurrentPrincipal and narrow kind");
+		}
+		if (p.access === "required" && !intersection([accepts, ...permitted], allKinds).size) {
+			const describe = (expression) => {
+				if ("anyOf" in expression) return `anyOf(${expression.anyOf.map(describe).join(", ")})`;
+				if ("allOf" in expression) return `allOf(${expression.allOf.map(describe).join(", ")})`;
+				return expression.label ?? this.policies.resolve(expression.policy).id;
+			};
+			const declarations = p.declaredRequirements.map(({ expression, origin }) => `${origin}: ${describe(expression)}`);
+			throw new BetterAuthConfigurationError("UNSATISFIABLE_PRINCIPAL_KINDS", `${p.site} has no eligible principal kind satisfying its requirements. Accepted kinds: ${[...accepts].join(", ") || "none"}.${declarations.length ? ` Requirements: ${declarations.join("; ")}.` : ""}`, p.declaredRequirements.some((item) => item.origin === "defaultRequirements") ? "Review the conflicting requirements; use @SkipDefaultRequirements() to explicitly opt this handler out of instance defaults." : "Review accepted kinds and requirement restrictions; configure a default source or explicitly accept a registered principal kind.");
+		}
+		const forwardDirectCalls = closest(FORWARD_COOKIES_METADATA, [handler, ...chain]) ?? entry.options.cookies?.forwardDirectCalls ?? false;
+		const originCheck = closest(SKIP_ORIGIN_CHECK_METADATA, [handler, ...chain]) || entry.options.originCheck?.mode === "off" ? "off" : forwardDirectCalls ? "form" : "cookie";
+		const declares = forwardDirectCalls || levels.some((level) => {
+			const access = own(ACCESS_METADATA, level);
+			return access === "required" || access === "optional" || [
+				ACCEPT_PRINCIPALS_METADATA,
+				REQUIREMENTS_METADATA,
+				PRINCIPAL_PARAMS_METADATA,
+				INVOCATION_PARAMS_METADATA
+			].some((key) => own(key, level) !== void 0);
+		});
+		const plan = Object.freeze({
+			instance: p.instance,
+			access: p.access,
+			nested: p.nested,
+			site: p.site,
+			requirements: Object.freeze(p.requirements),
+			skipsDefaultRequirements: p.access === "required" && p.skips,
+			freshness: fresh ? "authoritative" : "default",
+			accepts,
+			principalParams: Object.freeze(principalParams),
+			originCheck,
+			sourceSet: JSON.stringify(entry.sources.flatMap((source, index) => source.kinds.some((kind) => accepts.has(kind)) ? [index] : [])),
+			forwardDirectCalls,
+			declares
+		});
+		if (!cache) {
+			cache = /* @__PURE__ */ new WeakMap();
+			this.cache.set(target, cache);
+		}
+		cache.set(handler, plan);
+		return plan;
+	}
+};
+function intersection(sets, universe) {
+	return new Set([...universe].filter((kind) => sets.every((set) => set.has(kind))));
+}
+//#endregion
+//#region src/authorization-evaluator.ts
+const allow = () => ({ effect: "allow" });
+const deny = (input) => ({
+	effect: "deny",
+	...input
+});
+function definePolicy(policy) {
+	return (params, options) => ({
+		policy,
+		params,
+		...options
+	});
+}
+var DefaultPolicyInvoker = class {
+	async invoke(policy, params, context) {
+		return policy.evaluate(params, context);
+	}
+};
+var AuthorizationEvaluator = class {
+	policies;
+	invoker;
+	resolver;
+	scope;
+	keys = new MemoKeys();
+	constructor(policies, invoker, resolver, scope) {
+		this.policies = policies;
+		this.invoker = invoker;
+		this.resolver = resolver;
+		this.scope = scope;
+	}
+	async evaluate(plan, principal, call, entry, execution, transport) {
+		if (!plan.requirements.length) return allow();
+		const headers = requestHeaders(call, entry);
+		const context = {
+			principal,
+			instance: entry.name,
+			transport,
+			headers,
+			cookies: call.cookies,
+			request: call.request,
+			param: (name) => call.param(name),
+			handler: {
+				class: execution.getClass(),
+				method: methodName(execution.getClass(), execution.getHandler())
+			},
+			auth: entry.handle,
+			execution,
+			memo: (key, fn) => this.scope.memoPolicyIo(call.key, entry.name, this.keys.key(call.key, "policy-io", key), fn, entry.options.limits?.maxAuthorizationCallsPerRequest)
+		};
+		const publish = (runs) => {
+			const ambiguous = /* @__PURE__ */ new Set();
+			for (const [index, run] of runs.entries()) for (const other of runs.slice(index + 1)) if ([...run].some(([slot, value]) => other.has(slot) && !Object.is(other.get(slot), value))) for (const slot of [...run.keys(), ...other.keys()]) ambiguous.add(slot);
+			const merged = /* @__PURE__ */ new Map();
+			for (const run of runs) for (const [slot, value] of run) merged.set(slot, ambiguous.has(slot) ? AMBIGUOUS_INVOCATION_VALUE : value);
+			if (!merged.size) return;
+			let instances = Reflect.get(call.invocation, INVOCATION_VALUES);
+			if (!instances) {
+				instances = /* @__PURE__ */ new Map();
+				Object.defineProperty(call.invocation, INVOCATION_VALUES, { value: instances });
+			}
+			let values = instances.get(entry.name);
+			if (!values) {
+				values = /* @__PURE__ */ new Map();
+				instances.set(entry.name, values);
+			}
+			for (const [slot, value] of merged) {
+				this.scope.stateFor(call.invocation).values.set(this.scope.valueKey(entry.name, slot), value);
+				values.set(slot, value);
+			}
+		};
+		const withoutValues = (decision) => ({
+			decision,
+			published: []
+		});
+		const evaluate = (expression) => this.scope.memoDecision(call.invocation, entry.name, this.keys.key(call.invocation, "decision", expression), async () => {
+			if ("anyOf" in expression || "allOf" in expression) {
+				const disjunction = "anyOf" in expression;
+				const children = "anyOf" in expression ? expression.anyOf : expression.allOf;
+				const denials = [];
+				if (!children.length) return withoutValues(deny({ reason: "NO_REQUIREMENT_SATISFIED" }));
+				const published = [];
+				for (const child of children) {
+					const outcome = await evaluate(child);
+					const decision = outcome.decision;
+					if (decision.effect === "allow" && disjunction) return outcome;
+					if (decision.effect === "deny") {
+						if (!disjunction) return withoutValues(decision);
+						denials.push(decision);
+					} else published.push(...outcome.published);
+				}
+				if (!disjunction) return {
+					decision: allow(),
+					published
+				};
+				return withoutValues(deny({
+					reason: denials[0]?.reason ?? "NO_REQUIREMENT_SATISFIED",
+					status: denials.some((d) => d.status === 401) ? 401 : 403,
+					message: children.map((child) => "policy" in child ? child.label ?? this.policies.resolve(child.policy).id : "requirement group").join(" or ")
+				}));
+			}
+			const policy = this.policies.resolve(expression.policy);
+			const kinds = expression.principals ?? policy.requires?.principals;
+			if (kinds && !kinds.includes(principal.kind) || !kinds && principal.delegation) return withoutValues(deny({ reason: "PRINCIPAL_NOT_SUPPORTED" }));
+			const values = /* @__PURE__ */ new Map();
+			const leaf = {
+				...context,
+				provide: (slot, value) => {
+					values.set(slot, value);
+				}
+			};
+			try {
+				const decision = await entry.handle.run({
+					cookies: call.cookies,
+					forward: "same-credential",
+					inbound: () => headers,
+					internal: true
+				}, () => this.invoker.invoke(policy, expression.params, leaf));
+				return decision.effect === "allow" && values.size ? {
+					decision,
+					published: [values]
+				} : withoutValues(decision);
+			} catch (error) {
+				const normalized = normalizeForRequest(error, "policy", plan.site, entry, headers);
+				if (isAuthFailure(normalized)) {
+					if (normalized.status === 429) throw normalized;
+					return withoutValues(deny({
+						status: normalized.status,
+						reason: normalized.reason ?? normalized.code,
+						message: normalized.message,
+						challenge: normalized.challenge
+					}));
+				}
+				const source = entry.sources.find((item) => item.id === principal.source && item.sessionBacked);
+				if (source) await this.scope.memoPolicyIo(call.key, entry.name, JSON.stringify(["reclassify", source.id]), async () => {
+					const result = await this.resolver.resolve(call, {
+						auth: entry.handle,
+						freshness: "authoritative",
+						accepts: plan.accepts,
+						sourceSet: plan.sourceSet,
+						reclassify: { sourceId: source.id }
+					});
+					if (result.outcome === "authenticated") throw createInfrastructureError(normalized.sessionLoss, {
+						headers,
+						credentialHeaders: entry.credentialHeaders,
+						exposeRawCause: entry.options.errors?.exposeRawCause
+					});
+					return result;
+				}, entry.options.limits?.maxAuthorizationCallsPerRequest);
+				return withoutValues(deny({
+					status: 401,
+					reason: normalized.reason ?? "UNAUTHENTICATED"
+				}));
+			}
+		});
+		const published = [];
+		for (const expression of plan.requirements) {
+			const outcome = await evaluate(expression);
+			if (outcome.decision.effect === "deny") return outcome.decision;
+			published.push(...outcome.published);
+		}
+		publish(published);
+		return allow();
+	}
+};
+//#endregion
+//#region src/trusted-origins.ts
+/** Auth route path exceptions never exempt application operations. */
+function originChecksDisabled(context) {
+	return context.skipCSRFCheck || context.skipOriginCheck === true && context.options.advanced?.disableCSRFCheck === void 0;
+}
+function isDynamicBaseURL(value) {
+	return typeof value === "object" && value !== null && Array.isArray(value.allowedHosts);
+}
+/**
+* A subset of better-auth's loopback classification: every host accepted here is loopback there, so an unusual spelling
+* better-auth also accepts only makes the kernel stricter, never more lenient.
+*/
+function isLoopbackHost(host) {
+	let name = host.trim().toLowerCase();
+	if (name.startsWith("[")) return name.slice(1, name.indexOf("]")) === "::1";
+	const colon = name.indexOf(":");
+	if (colon !== -1 && name.indexOf(":", colon + 1) === -1) name = name.slice(0, colon);
+	name = name.replace(/\.+$/, "");
+	if (name === "localhost" || name.endsWith(".localhost") || name === "::1") return true;
+	const octets = /^127\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(name);
+	return !!octets && octets.slice(1).every((octet) => Number(octet) <= 255);
+}
+/** The origins better-auth's getTrustedOrigins() adds before the trustedOrigins option. */
+function baseOrigins(context) {
+	const configured = context.options.baseURL;
+	if (isDynamicBaseURL(configured)) {
+		const origins = [];
+		const protocol = configured.protocol;
+		for (const host of configured.allowedHosts) {
+			if (host.includes("://")) {
+				origins.push(host);
+				continue;
+			}
+			if (!protocol || protocol === "https" || protocol === "auto") origins.push(`https://${host}`);
+			if (protocol === "http" || protocol === "auto" || isLoopbackHost(host)) origins.push(`http://${host}`);
+		}
+		if (configured.fallback) try {
+			origins.push(new URL(configured.fallback).origin);
+		} catch {}
+		return origins;
+	}
+	try {
+		return context.baseURL ? [new URL(context.baseURL).origin] : [];
+	} catch {
+		return [];
+	}
+}
+function environmentOrigins() {
+	const value = globalThis.process?.env?.BETTER_AUTH_TRUSTED_ORIGINS;
+	return value ? value.split(",") : [];
+}
+var TrustedOrigins = class {
+	context;
+	constructor(context) {
+		this.context = context;
+	}
+	/**
+	* The router's per-request list (better-auth getTrustedOrigins(options, request)). An array option is already part of
+	* the init-time list; a function option is evaluated with the request only, because the init-time list also holds its
+	* no-request result, which the router never trusts.
+	*/
+	async list(request) {
+		const context = await this.context();
+		const configured = context.options.trustedOrigins;
+		const dynamic = typeof configured === "function";
+		const contributed = dynamic ? await configured(request) : configured;
+		const origins = new Set(dynamic ? baseOrigins(context) : context.trustedOrigins);
+		if (Array.isArray(contributed)) {
+			for (const origin of contributed) if (typeof origin === "string" && origin) origins.add(origin);
+		}
+		if (dynamic) {
+			for (const origin of environmentOrigins()) if (origin) origins.add(origin);
+		}
+		if (request && !context.options.baseURL && !context.baseURL) origins.add(new URL(request.url).origin);
+		return [...origins];
+	}
+	async isTrusted(origin, request) {
+		const [context, trustedOrigins] = await Promise.all([this.context(), this.list(request)]);
+		return context.isTrustedOrigin.call({ trustedOrigins }, origin, { allowRelativePaths: false });
+	}
+};
+//#endregion
+//#region src/bridge-client.ts
+/** Preserve capabilities lazily; spreading a ScopeView can extract credentials. */
+function derivedScope(scope, init) {
+	const outer = scope.current();
+	return {
+		view: {
+			get cookies() {
+				return init.cookies;
+			},
+			get forward() {
+				return init.forward ?? "same-credential";
+			},
+			get inbound() {
+				return init.inbound;
+			},
+			get internal() {
+				return init.internal ?? false;
+			},
+			get browserHeaders() {
+				return outer?.view.browserHeaders;
+			},
+			get checkCallerSession() {
+				return outer?.view.checkCallerSession;
+			}
+		},
+		get call() {
+			return outer?.call;
+		},
+		get plan() {
+			return outer?.plan;
+		},
+		get reading() {
+			return outer?.reading;
+		}
+	};
+}
+function createAuthHandle(name, instance, scope, ready) {
+	const context = () => instance.$context;
+	const trusted = new TrustedOrigins(context);
+	return {
+		name,
+		instance,
+		get api() {
+			return instance.api;
+		},
+		context,
+		async hasPlugin(id) {
+			return (await context()).hasPlugin(id);
+		},
+		run(init, fn) {
+			return scope.run(derivedScope(scope, init), fn);
+		},
+		checkOrigin(browser, mode) {
+			return ready().origin.check(browser, mode);
+		},
+		producedByEndpoint(value) {
+			return ready().bridge.producedByEndpoint(value);
+		},
+		isTrustedOrigin(origin, request) {
+			return trusted.isTrusted(origin, request);
+		}
+	};
+}
+var BridgeClient = class {
+	#registrations = [];
+	bind(entry, binding) {
+		const result = entry.bridge.bind(binding);
+		this.#registrations.push({
+			binding,
+			close: result.close
+		});
+		return result;
+	}
+	bootstrap() {
+		const displaced = this.#registrations.filter(({ binding }) => binding.state === "displaced");
+		if (displaced.length) throw new BetterAuthConfigurationError("INSTANCE_ALREADY_BOUND", `Another application bound ${displaced.map(({ binding }) => `'${binding.instance}'`).join(", ")} while this application initialized.`, "Initialize applications that share a Better Auth instance one after another, and close one before the next binds.");
+		for (const { binding } of this.#registrations) binding.state = "bootstrapped";
+	}
+	close() {
+		for (const registration of this.#registrations) registration.close();
+		this.#registrations.length = 0;
+	}
+};
+//#endregion
+//#region src/origin-check.ts
+const ORIGIN_PROOF = Symbol.for("@nestjs-kit/better-auth:origin-proof");
+const ORIGIN_CALCULATION_FAILURES = Symbol.for("@nestjs-kit/better-auth:origin-calculation-failures");
+function diagnosticOrigin(headers) {
+	const origin = headers.get("origin");
+	const referer = headers.get("referer");
+	let value = origin || referer || "(missing)";
+	if (!origin && referer) try {
+		value = new URL(referer).origin;
+	} catch {
+		value = "(invalid referer)";
+	}
+	return value.replace(/[\u0000-\u001f\u007f]/g, "").slice(0, 100);
+}
+/** Bounded, per-application diagnostics; the next denial rolls the window without timers. */
+var OriginDiagnostics = class {
+	logger;
+	#openedAt;
+	#pairs = /* @__PURE__ */ new Set();
+	#further = /* @__PURE__ */ new Map();
+	#origins = /* @__PURE__ */ new Map();
+	constructor(logger) {
+		this.logger = logger;
+	}
+	record(instance, failure, headers, trustedCount) {
+		const now = Date.now();
+		if (this.#openedAt !== void 0 && now - this.#openedAt >= 36e5) {
+			this.logger.warn(`Origin check window closed: further denials ${JSON.stringify([...this.#further])}; frequent origins ${JSON.stringify([...this.#origins].sort((a, b) => b[1] - a[1]).slice(0, 5))}`);
+			this.#pairs.clear();
+			this.#further.clear();
+			this.#origins.clear();
+			this.#openedAt = void 0;
+		}
+		this.#openedAt ??= now;
+		const origin = diagnosticOrigin(headers);
+		const reason = failure.reason ?? failure.code;
+		const pair = JSON.stringify([reason, origin]);
+		const message = `Origin check ${instance}: ${reason}, origin ${origin}, trusted origins ${trustedCount}. Add the origin to trustedOrigins or send Origin from non-browser clients.`;
+		if (!this.#pairs.has(pair) && this.#pairs.size < 100) {
+			this.#pairs.add(pair);
+			this.logger.warn(message);
+		} else this.#further.set(reason, (this.#further.get(reason) ?? 0) + 1);
+		if (this.#origins.has(origin) || this.#origins.size < 100) this.#origins.set(origin, (this.#origins.get(origin) ?? 0) + 1);
+		this.logger.debug(message);
+	}
+	advisoryFailure(instance, headers, trustedCount) {
+		this.record(instance, AuthFailures.forbidden("ORIGIN_CHECK_UNAVAILABLE"), headers, trustedCount);
+	}
+};
+var OriginCheck = class {
+	scope;
+	init;
+	#trusted;
+	#trustedCounts = /* @__PURE__ */ new WeakMap();
+	constructor(scope, init) {
+		this.scope = scope;
+		this.init = init;
+		this.#trusted = new TrustedOrigins(async () => init.context);
+	}
+	check(browser, mode) {
+		const origins = this.scope.stateFor(browser.key).origins;
+		const key = memoKey(this.init.instance, mode === "cookie" && !browser.enforce ? "cookie-advisory" : mode);
+		const existing = origins.get(key);
+		if (existing) return existing;
+		let headers;
+		let calculationFailed = false;
+		const promise = Promise.resolve().then(async () => {
+			if (this.init.options?.mode === "off" || originChecksDisabled(this.init.context)) return null;
+			headers = browser.headers();
+			const failure = await this.verdict(browser, headers, mode, () => {
+				calculationFailed = true;
+			});
+			if (failure) this.init.diagnostics?.record(this.init.instance, failure, headers, this.#trustedCounts.get(browser.key) ?? this.init.context.trustedOrigins.length);
+			else if (mode === "form" || headers.has("cookie")) this.scope.stateFor(browser.key).values.set(this.scope.valueKey(this.init.instance, ORIGIN_PROOF), true);
+			return failure;
+		}).catch((error) => {
+			if (origins.get(key) === promise) origins.delete(key);
+			if (isConfigurationError(error)) throw error;
+			const failure = isInfrastructureError(error) ? error : createInfrastructureError(error, {
+				headers,
+				credentialHeaders: this.init.credentialHeaders,
+				exposeRawCause: this.init.exposeRawCause
+			});
+			if (calculationFailed && headers) this.calculationFailures(browser).set(promise, headers);
+			throw failure;
+		});
+		origins.set(key, promise);
+		return promise;
+	}
+	async advisory(browser) {
+		const verdict = this.check(browser, "cookie");
+		try {
+			await verdict;
+		} catch (error) {
+			const headers = this.calculationFailures(browser).get(verdict);
+			if (!isInfrastructureError(error) || !headers) throw error;
+			this.init.diagnostics?.advisoryFailure(this.init.instance, headers, this.init.context.trustedOrigins.length);
+		}
+	}
+	assertCallerSession(browser, path, instance) {
+		if (instance === this.init.instance && (this.init.options?.mode === "off" || originChecksDisabled(this.init.context) || this.scope.stateFor(browser.key).values.get(this.scope.valueKey(this.init.instance, ORIGIN_PROOF)) === true)) return;
+		throw BetterAuthConfigurationError.atRequest("PUBLIC_HANDLER_USED_CALLER_SESSION", "A direct caller-session call requires a passing origin verdict for this browser leg and instance", {
+			site: path,
+			hint: "Guard the handler and pass its origin check before making this call."
+		});
+	}
+	calculationFailures(browser) {
+		const values = this.scope.stateFor(browser.key).values;
+		const key = this.scope.valueKey(this.init.instance, ORIGIN_CALCULATION_FAILURES);
+		let failures = values.get(key);
+		if (!failures) {
+			failures = /* @__PURE__ */ new WeakMap();
+			values.set(key, failures);
+		}
+		return failures;
+	}
+	async verdict(browser, headers, mode, onCalculationFailure) {
+		if (!headers.has("cookie")) {
+			if (mode === "cookie") return null;
+			const site = headers.get("sec-fetch-site");
+			const navigation = headers.get("sec-fetch-mode");
+			const metadata = [
+				site,
+				navigation,
+				headers.get("sec-fetch-dest")
+			].some((value) => Boolean(value?.trim()));
+			if (metadata && site === "cross-site" && navigation === "navigate") return AuthFailures.forbidden("CROSS_SITE_NAVIGATION_LOGIN_BLOCKED");
+			if (!metadata && !headers.get("origin") && !headers.get("referer")) return null;
+		}
+		const origin = headers.get("origin");
+		const referer = headers.get("referer");
+		const value = headers.get("sec-fetch-site") === "same-origin" && (origin === "null" || mode === "cookie" && !browser.enforce && !origin && !referer) ? new URL(browser.url).origin : origin || referer;
+		if (!value || value === "null") {
+			if (this.init.options?.missingOrigin === "allow-non-browser" && !headers.has("origin") && !headers.has("referer") && !headers.has("sec-fetch-site")) return null;
+			return AuthFailures.forbidden("MISSING_OR_NULL_ORIGIN");
+		}
+		const request = new Request(browser.url, { headers });
+		const trustedOrigins = await this.#trusted.list(request).catch((error) => {
+			onCalculationFailure();
+			throw error;
+		});
+		this.#trustedCounts.set(browser.key, trustedOrigins.length);
+		return this.init.context.isTrustedOrigin.call({ trustedOrigins }, value, { allowRelativePaths: false }) ? null : AuthFailures.forbidden("INVALID_ORIGIN");
+	}
+};
+//#endregion
+//#region src/instance-registry.ts
+/** Nest considers transient providers static; auth collaborators require singleton trees. */
+function isSingletonDependencyTree(root) {
+	const pending = [root];
+	const seen = /* @__PURE__ */ new Set();
+	while (pending.length) {
+		const wrapper = pending.pop();
+		if (seen.has(wrapper)) continue;
+		seen.add(wrapper);
+		if (wrapper.isTransient || !wrapper.isDependencyTreeStatic()) return false;
+		for (const dependency of wrapper.getCtorMetadata() ?? []) if (dependency) pending.push(dependency);
+		for (const property of wrapper.getPropertiesMetadata() ?? []) pending.push(property.wrapper);
+		for (const enhancer of wrapper.getEnhancersMetadata() ?? []) pending.push(enhancer);
+	}
+	return true;
+}
+function configurationIssue(error, code, detail) {
+	if (isConfigurationError(error)) return error;
+	const issue = new BetterAuthConfigurationError(code, detail);
+	Object.defineProperty(issue, "cause", { value: error });
+	return issue;
+}
+let InstanceRegistry = class InstanceRegistry {
+	scope;
+	#registrations = [];
+	#entries = /* @__PURE__ */ new Map();
+	logger = new Logger("BetterAuth");
+	diagnostics = new OriginDiagnostics(this.logger);
+	state = "new";
+	adapter = null;
+	owner = { description: "Nest application" };
+	constructor(scope) {
+		this.scope = scope;
+	}
+	register(options, staticOptions, sources, appOptions) {
+		const name = staticOptions.name || "default";
+		const registration = {
+			name,
+			options,
+			staticOptions,
+			sources,
+			appOptions,
+			instance: options.auth,
+			handle: createAuthHandle(name, options.auth, this.scope, () => this.get(name))
+		};
+		this.#registrations.push(registration);
+		return registration;
+	}
+	registrations() {
+		return [...this.#registrations];
+	}
+	get(name) {
+		const entry = this.#entries.get(name);
+		if (!entry) throw new BetterAuthConfigurationError("UNKNOWN_INSTANCE", `Auth instance '${name}' is unknown or not initialized.`, "Register the instance once with BetterAuthModule.forRoot().");
+		return entry;
+	}
+	list() {
+		return [...this.#entries.values()];
+	}
+	begin(adapter) {
+		if (this.state !== "new") {
+			if (this.adapter !== adapter) throw new BetterAuthConfigurationError("LATE_HTTP_ADAPTER", "Another application changed the active HTTP adapter.", "Close the first application before creating another.");
+			return false;
+		}
+		this.adapter = adapter;
+		this.state = "initialized";
+		this.owner = { description: `Nest application ${globalThis.crypto.randomUUID()}` };
+		return true;
+	}
+	async initialize(issues) {
+		this.#entries.clear();
+		const seen = /* @__PURE__ */ new Set();
+		const bridgeOwners = /* @__PURE__ */ new Map();
+		const shared = /* @__PURE__ */ new Set();
+		let globals = 0;
+		for (const registration of this.#registrations) {
+			const { name, instance, options, staticOptions, appOptions, sources, handle } = registration;
+			if (seen.has(name)) issues.push(new BetterAuthConfigurationError("DUPLICATE_INSTANCE", `Instance '${name}' was registered more than once.`, "Import BetterAuthModule.forRoot() once per instance."));
+			seen.add(name);
+			if (staticOptions.globalGuard ?? name === "default") globals++;
+			if (name !== "default" && (appOptions.platforms !== void 0 || appOptions.transports !== void 0)) issues.push(new BetterAuthConfigurationError("APP_EXTENSIONS_ON_NAMED_INSTANCE", `Instance '${name}' declares app-wide extensions.`, "Declare platforms and transports on the default instance."));
+			if (!instance || typeof instance.handler !== "function" || typeof instance.api?.getSession !== "function" || typeof instance.$context?.then !== "function") {
+				issues.push(new BetterAuthConfigurationError("NOT_AN_AUTH_INSTANCE", `Instance '${name}' must be the object returned by betterAuth().`));
+				continue;
+			}
+			let context;
+			try {
+				context = await instance.$context;
+			} catch (error) {
+				issues.push(configurationIssue(error, "AUTH_CONTEXT_FAILED", `Instance '${name}' failed to initialize its auth context.`));
+				continue;
+			}
+			const plugin = context.getPlugin("@nestjs-kit/better-auth");
+			const bridge = plugin && typeof plugin === "object" ? Reflect.get(plugin, BRIDGE_HANDLE) : void 0;
+			if (!bridge) {
+				issues.push(new BetterAuthConfigurationError("PLUGIN_MISSING", `Instance '${name}' has no nestjs() bridge.`, "Add nestjs() as the LAST betterAuth plugins entry."));
+				continue;
+			}
+			if (bridge.protocol !== 4 || typeof bridge.bind !== "function") {
+				issues.push(new BetterAuthConfigurationError("PLUGIN_PROTOCOL_MISMATCH", `Instance '${name}' has bridge protocol ${bridge.protocol}; expected 4.`, "Align the module and plugin package versions."));
+				continue;
+			}
+			const previous = bridgeOwners.get(bridge);
+			if (previous !== void 0) {
+				shared.add(name);
+				shared.add(previous);
+				issues.push(new BetterAuthConfigurationError("PLUGIN_SHARED_BETWEEN_INSTANCES", `'${previous}' and '${name}' share one plugin object.`, "Call nestjs() separately inside every betterAuth() construction."));
+			}
+			bridgeOwners.set(bridge, name);
+			const plugins = context.options.plugins ?? [];
+			const index = plugins.findIndex((value) => value.id === "@nestjs-kit/better-auth");
+			if (index >= 0 && plugins.slice(index + 1).some((value) => value.hooks?.after?.length)) this.logger.warn(`W_PLUGIN_NOT_LAST: '${name}': put nestjs() after plugins with after hooks.`);
+			const credentialHeaders = [...new Set(sources.flatMap((source) => source.credentialHeaders ?? []).map((value) => value.toLowerCase()))];
+			this.#entries.set(name, {
+				name,
+				instance,
+				options,
+				staticOptions,
+				sources,
+				handle,
+				context,
+				bridge,
+				credentialHeaders,
+				origin: new OriginCheck(this.scope, {
+					instance: name,
+					context,
+					options: options.originCheck,
+					diagnostics: this.diagnostics,
+					credentialHeaders,
+					exposeRawCause: options.errors?.exposeRawCause
+				})
+			});
+		}
+		for (const name of shared) this.#entries.delete(name);
+		if (globals > 1) issues.push(new BetterAuthConfigurationError("DUPLICATE_GLOBAL_GUARD", "More than one registration enables the global guard.", "Enable globalGuard on only one instance."));
+		if (!seen.has("default")) issues.push(new BetterAuthConfigurationError("NO_DEFAULT_INSTANCE", "Named registrations require one default instance.", "Add BetterAuthModule.forRoot({ auth })."));
+	}
+	reset() {
+		this.state = "new";
+		this.#entries.clear();
+	}
+};
+InstanceRegistry = __decorate([__decorateParam(0, Inject(REQUEST_SCOPE)), __decorateMetadata("design:paramtypes", [Object])], InstanceRegistry);
+//#endregion
+//#region src/route-paths.ts
+function addLeadingSlash(path) {
+	if (typeof path !== "string" || path === "") return "";
+	return path.startsWith("/") || path.startsWith("{/") ? path : `/${path}`;
+}
+function stripEndSlash(path) {
+	return path.endsWith("/") ? path.slice(0, -1) : path;
+}
+function versionPrefix(options) {
+	if (options.type === VersioningType.URI) {
+		if (options.prefix === false) return "";
+		if (options.prefix !== void 0) return options.prefix;
+	}
+	return "v";
+}
+function append(paths, fragment) {
+	return fragment ? paths.map((path) => stripEndSlash(path) + addLeadingSlash(fragment)) : [...paths];
+}
+function withoutVersionPrefix(path, version, options) {
+	if (typeof version !== "string") {
+		let stripped = path;
+		for (const value of version) if (typeof value === "string") stripped = withoutVersionPrefix(stripped, value, options);
+		return stripped;
+	}
+	const prefix = `/${versionPrefix(options)}${version}`;
+	return path.startsWith(prefix) ? path.replace(prefix, "") : path;
+}
+/**
+* Composes the paths Nest registers for a handler path, with the rules of Nest's router: URI
+* version segments, then the module, controller and handler paths, then the global prefix
+* unless an exclusion matches the method and the unversioned path. `@nestjs/core` does not
+* export its `RoutePathFactory`, so a test compares this function with that class.
+*/
+function composeRoutePaths(input, requestMethod, exclusions) {
+	const version = input.methodVersion || input.controllerVersion;
+	const options = input.versioningOptions;
+	let paths = [""];
+	if (version && options?.type === VersioningType.URI) {
+		const prefix = versionPrefix(options);
+		paths = (typeof version === "object" ? version : [version]).map((value) => value === VERSION_NEUTRAL ? "" : `/${prefix}${value}`);
+	}
+	paths = append(paths, input.modulePath);
+	paths = append(paths, input.ctrlPath);
+	paths = append(paths, input.methodPath);
+	const globalPrefix = input.globalPrefix;
+	if (globalPrefix) {
+		const excluded = (path) => {
+			if (requestMethod === void 0 || !Array.isArray(exclusions)) return false;
+			const candidate = addLeadingSlash(version && version !== VERSION_NEUTRAL && options?.type === VersioningType.URI ? withoutVersionPrefix(path, version, options) : path);
+			return exclusions.some((route) => (route.requestMethod === RequestMethod.ALL || route.requestMethod === -1 || route.requestMethod === requestMethod) && route.pathRegex.exec(candidate) !== null);
+		};
+		paths = paths.map((path) => excluded(path) ? path : stripEndSlash(globalPrefix) + path);
+	}
+	return paths.map((path) => addLeadingSlash(path || "/")).map((path) => path === "/" ? path : stripEndSlash(path));
+}
+//#endregion
+//#region src/boot-validator.ts
+function requirementLeaves(expressions) {
+	return expressions.flatMap((expression) => "anyOf" in expression ? requirementLeaves(expression.anyOf) : "allOf" in expression ? requirementLeaves(expression.allOf) : [expression]);
+}
+function productionMode() {
+	return ![
+		"development",
+		"dev",
+		"test"
+	].includes(process.env.NODE_ENV ?? "");
+}
+function ancestors(target) {
+	const result = [];
+	for (let current = target; typeof current === "function" && current !== Function.prototype; current = Object.getPrototypeOf(current)) result.push(current);
+	return result;
+}
+function domainsOverlap(a, b) {
+	if (!a || !b) return true;
+	const left = a.replace(/^\./, "").toLowerCase();
+	const right = b.replace(/^\./, "").toLowerCase();
+	return left === right || left.endsWith(`.${right}`) || right.endsWith(`.${left}`);
+}
+function pathsOverlap(a = "/", b = "/") {
+	return a === b || a.startsWith(b.endsWith("/") ? b : `${b}/`) || b.startsWith(a.endsWith("/") ? a : `${a}/`);
+}
+function routeMayWarnAboutMount(path, basePath) {
+	const route = path.toLowerCase().replace(/(?<!\/)\/+$/, "") || "/";
+	const base = basePath.toLowerCase().replace(/(?<!\/)\/+$/, "") || "/";
+	if (base === "/") return route.startsWith("/");
+	if (route === base || route.startsWith(`${base}/`)) return true;
+	const marker = route.search(/[:*{]/);
+	if (marker === -1) return false;
+	const literal = route.slice(0, marker);
+	return base.startsWith(literal) || literal.startsWith(`${base}/`);
+}
+let BootValidator = class BootValidator {
+	discovery;
+	scanner;
+	reflector;
+	moduleRef;
+	appConfig;
+	instances;
+	planner;
+	policies;
+	transports;
+	mounts;
+	logger = new Logger("BetterAuth");
+	#plans = [];
+	#claims = [];
+	#globalGuard = false;
+	#globalScope = false;
+	constructor(discovery, scanner, reflector, moduleRef, appConfig, instances, planner, policies, transports, mounts) {
+		this.discovery = discovery;
+		this.scanner = scanner;
+		this.reflector = reflector;
+		this.moduleRef = moduleRef;
+		this.appConfig = appConfig;
+		this.instances = instances;
+		this.planner = planner;
+		this.policies = policies;
+		this.transports = transports;
+		this.mounts = mounts;
+	}
+	warn(code, message) {
+		this.logger.warn(`${code}: ${message}`);
+	}
+	sites() {
+		const sites = [];
+		const seen = /* @__PURE__ */ new Map();
+		for (const wrapper of [...this.discovery.getControllers(), ...this.discovery.getProviders()]) {
+			if (wrapper.isAlias || !wrapper.instance || typeof wrapper.instance !== "object" && typeof wrapper.instance !== "function") continue;
+			const prototype = Object.getPrototypeOf(wrapper.instance);
+			const target = prototype?.constructor;
+			if (!prototype || !target || target === Object || target === Function) continue;
+			const methods = seen.get(target) ?? /* @__PURE__ */ new Set();
+			seen.set(target, methods);
+			for (const method of this.scanner.getAllMethodNames(prototype)) {
+				if (methods.has(method)) continue;
+				methods.add(method);
+				const handler = Reflect.get(prototype, method);
+				if (typeof handler === "function") sites.push({
+					target,
+					method,
+					handler
+				});
+			}
+		}
+		return sites;
+	}
+	singletonChecks(issues, references) {
+		const refs = new Set(references.map((value) => value.policy));
+		for (const wrapper of this.discovery.getProviders()) if (((typeof wrapper.token === "symbol" ? Symbol.keyFor(wrapper.token) : void 0)?.startsWith("@nestjs-kit/better-auth:ext:") || refs.has(wrapper.token) || refs.has(wrapper.metatype)) && !isSingletonDependencyTree(wrapper)) issues.push(new BetterAuthConfigurationError("NON_SINGLETON_EXTENSION", `Extension/policy '${String(wrapper.name)}' has a non-static dependency tree.`, "Use singleton extensions and singleton dependencies."));
+	}
+	canaries() {
+		let Probe = class Probe {
+			run() {}
+		};
+		__decorate([
+			Get("handler"),
+			__decorateMetadata("design:type", Function),
+			__decorateMetadata("design:paramtypes", []),
+			__decorateMetadata("design:returntype", void 0)
+		], Probe.prototype, "run", null);
+		Probe = __decorate([Controller("coverage-probe")], Probe);
+		if (Reflect.getOwnMetadata("path", Probe) !== "coverage-probe" || Reflect.getOwnMetadata("path", Probe.prototype.run) !== "handler" || Reflect.getOwnMetadata("method", Probe.prototype.run) !== 0) throw new BetterAuthConfigurationError("NEST_METADATA_KEY_CHANGED", "Boot route checks cannot read Nest path/method metadata.");
+		UseGuards(BetterAuthGuard)(Probe);
+		UseInterceptors(BetterAuthScopeInterceptor)(Probe);
+		if (!Reflect.getOwnMetadata("__guards__", Probe)?.includes(BetterAuthGuard) || !Reflect.getOwnMetadata("__interceptors__", Probe)?.includes(BetterAuthScopeInterceptor)) throw new BetterAuthConfigurationError("NEST_METADATA_KEY_CHANGED", "Boot coverage cannot read Nest '__guards__' / '__interceptors__' metadata.", "Use a compatible Nest version and report the metadata change.");
+	}
+	enhancer(value, kind) {
+		const token = kind === "guard" ? BetterAuthGuard : BetterAuthScopeInterceptor;
+		let actual;
+		try {
+			actual = this.moduleRef.get(token, { strict: false });
+		} catch {
+			actual = void 0;
+		}
+		if (value === token || actual !== void 0 && value === actual) return true;
+		if (value && (typeof value === "object" || typeof value === "function")) {
+			const brand = Reflect.get(value, AUTH_ENHANCER) ?? (typeof value === "function" ? Reflect.get(value.prototype ?? {}, AUTH_ENHANCER) : Reflect.get(Object.getPrototypeOf(value) ?? {}, AUTH_ENHANCER));
+			return brand === kind || kind === "scope" && brand === "interceptor" || typeof brand === "object" && brand !== null && Reflect.get(brand, kind) === true;
+		}
+		return false;
+	}
+	local(site, kind) {
+		const handler = site.method ? Reflect.get(site.target.prototype ?? {}, site.method) : void 0;
+		const targets = [...ancestors(site.target), ...handler ? [handler] : []];
+		if (targets.some((target) => Reflect.getOwnMetadata(USE_BETTER_AUTH_METADATA, target) === true)) return true;
+		const key = kind === "guard" ? "__guards__" : "__interceptors__";
+		return targets.some((target) => (Reflect.getOwnMetadata(key, target) ?? []).some((value) => this.enhancer(value, kind)));
+	}
+	trigger(target) {
+		const access = Reflect.getOwnMetadata(ACCESS_METADATA, target);
+		if (access === "required" || access === "optional" || access === "authenticated") return true;
+		return [
+			ACCEPT_PRINCIPALS_METADATA,
+			REQUIREMENTS_METADATA,
+			PRINCIPAL_PARAMS_METADATA,
+			INVOCATION_PARAMS_METADATA,
+			FORWARD_COOKIES_METADATA,
+			FRESHNESS_METADATA,
+			AUTH_INSTANCE_METADATA,
+			USE_BETTER_AUTH_METADATA
+		].some((key) => Reflect.hasOwnMetadata(key, target));
+	}
+	coverage(sites, issues) {
+		this.#globalGuard = [...this.appConfig.getGlobalGuards(), ...this.appConfig.getGlobalRequestGuards().map((wrapper) => wrapper.instance)].some((value) => this.enhancer(value, "guard"));
+		this.#globalScope = [...this.appConfig.getGlobalInterceptors(), ...this.appConfig.getGlobalRequestInterceptors().map((wrapper) => wrapper.instance)].some((value) => this.enhancer(value, "scope"));
+		for (const claim of this.#claims) {
+			let plan;
+			try {
+				plan = claim.method ? this.planner.plan(claim.target, claim.method) : void 0;
+			} catch {
+				continue;
+			}
+			const classEntry = this.instances.list().find((entry) => entry.name === (Reflect.getMetadata(AUTH_INSTANCE_METADATA, claim.target) ?? "default"));
+			const classForm = (Reflect.getMetadata(FORWARD_COOKIES_METADATA, claim.target) ?? classEntry?.options.cookies?.forwardDirectCalls ?? false) && Reflect.getMetadata(SKIP_ORIGIN_CHECK_METADATA, claim.target) !== true && classEntry?.options.originCheck?.mode !== "off";
+			const accessCovered = plan ? (plan.access === "public" || plan.access === "inherit") && plan.originCheck !== "form" : Reflect.getMetadata(ACCESS_METADATA, claim.target) === "public" && !classForm;
+			const localGuard = this.local(claim, "guard");
+			const localScope = this.local(claim, "scope");
+			const covered = accessCovered || claim.reach === "global" && (this.#globalGuard || localGuard) || claim.reach === "explicit" && localGuard && localScope;
+			const declares = plan?.declares ?? ancestors(claim.target).some((target) => this.trigger(target));
+			if (!covered && (claim.options.everyHandler || declares) && claim.options.coverage !== "off") {
+				const message = `${claim.target.name}${claim.method ? `.${claim.method}` : ""} is not covered by the required auth enhancers.`;
+				if (claim.options.coverage === "warn") this.warn(claim.options.code, `${message} ${claim.options.hint}`);
+				else issues.push(new BetterAuthConfigurationError(claim.options.code, message, claim.options.hint));
+			}
+		}
+		for (const site of sites) {
+			const classClaims = this.#claims.filter((claim) => claim.target === site.target);
+			if (classClaims.some((claim) => claim.method === void 0 || claim.method === site.method)) continue;
+			if (this.trigger(site.handler) || !classClaims.length && ancestors(site.target).some((target) => this.trigger(target))) issues.push(new BetterAuthConfigurationError("UNGUARDED_AUTH_METADATA", `${site.target.name}.${site.method} declares auth metadata but no transport claims it. Registered transports: ${this.transports.list().map((value) => value.id).join(", ")}.`, "Register a transport that claims this handler."));
+		}
+		if (!this.#globalScope) {
+			const affected = this.#claims.flatMap((claim) => {
+				if (this.local(claim, "scope")) return [];
+				const plan = this.#plans.find((site) => site.target === claim.target && site.method === claim.method)?.plan;
+				if (plan) return plan.declares ? [{
+					claim,
+					forwarding: plan.forwardDirectCalls
+				}] : [];
+				if (claim.method !== void 0) return [];
+				const entry = this.instances.list().find((value) => value.name === (Reflect.getMetadata(AUTH_INSTANCE_METADATA, claim.target) ?? "default"));
+				const forwarding = Reflect.getMetadata(FORWARD_COOKIES_METADATA, claim.target) ?? entry?.options.cookies?.forwardDirectCalls ?? false;
+				return forwarding || ancestors(claim.target).some((target) => this.trigger(target)) ? [{
+					claim,
+					forwarding: Boolean(forwarding)
+				}] : [];
+			});
+			const seen = /* @__PURE__ */ new Map();
+			const uncovered = affected.sort((left, right) => Number(right.forwarding) - Number(left.forwarding)).filter(({ claim }) => {
+				const methods = seen.get(claim.target) ?? /* @__PURE__ */ new Set();
+				seen.set(claim.target, methods);
+				if (methods.has(claim.method)) return false;
+				methods.add(claim.method);
+				return true;
+			}).slice(0, 20).map(({ claim }) => `${claim.target.name}.${claim.method ?? "*"}`);
+			this.warn("W_NO_GLOBAL_SCOPE", `BetterAuthScopeInterceptor is not global; unscoped direct auth.api calls have no origin proof, refresh suppression or cookie bridge. Enable globalScope or apply @UseBetterAuth(). ${uncovered.join(", ")}`);
+		}
+	}
+	entryChecks(entry, policies, issues) {
+		const { name, context, options, sources, bridge } = entry;
+		for (const unit of [...sources, ...policies]) for (const plugin of unit.requires?.plugins ?? []) if (!context.hasPlugin(plugin)) issues.push(new BetterAuthConfigurationError("PLUGIN_PREREQUISITE", `'${name}': '${unit.id}' requires the '${plugin}' plugin.`, `Add the '${plugin}' Better Auth plugin.`));
+		const base = context.options.baseURL;
+		const dynamic = !!base && typeof base === "object" && "allowedHosts" in base;
+		if (dynamic && !("fallback" in base && base.fallback)) {
+			const hostless = [
+				...sources,
+				...policies,
+				...this.transports.list()
+			].filter((unit) => unit.requires?.hostlessCalls);
+			if (hostless.length) issues.push(new BetterAuthConfigurationError("DYNAMIC_BASE_URL_WITHOUT_FALLBACK", `'${name}': ${hostless.map((unit) => unit.id).join(", ")} make hostless calls.`, "Add baseURL.fallback to the dynamic allowedHosts configuration."));
+			else this.warn("W_DYNAMIC_HOST", `'${name}': dynamic baseURL has no fallback; rejected hosts may make auth.handler throw.`);
+		}
+		const production = productionMode();
+		if (production && !context.baseURL && !dynamic) {
+			if (options.http?.allowRequestDerivedBaseURL) this.warn("W_REQUEST_DERIVED_BASE_URL", `'${name}': requests choose the origin of token links and trusted origins.`);
+			else issues.push(new BetterAuthConfigurationError("UNSAFE_BASE_URL", `'${name}' has no safe baseURL in production.`, "Set baseURL / BETTER_AUTH_URL, or dynamic baseURL.allowedHosts."));
+		}
+		if (production && context.secret === "better-auth-secret-12345678901234567890") issues.push(new BetterAuthConfigurationError("DEFAULT_SECRET", `'${name}' uses Better Auth's public default signing secret.`, "Set BETTER_AUTH_SECRET or betterAuth({ secret })."));
+		if (context.skipCSRFCheck || context.skipOriginCheck === true) {
+			const explicit = context.options.advanced;
+			const cause = `disableCSRFCheck=${String(explicit?.disableCSRFCheck)}, disableOriginCheck=${String(explicit?.disableOriginCheck)}; unset flags use Better Auth's import-time NODE_ENV/TEST defaults`;
+			const exception = context.skipOriginCheck === true && explicit?.disableCSRFCheck === false ? "; disableCSRFCheck:false does not re-enable SDK origin checks; app-route checks remain on" : "";
+			this.warn("W_ORIGIN_CHECK", `'${name}': resolved skipCSRFCheck=${context.skipCSRFCheck}, skipOriginCheck=${String(context.skipOriginCheck)} (${cause})${exception}.`);
+		}
+		if (Array.isArray(context.skipOriginCheck) && context.skipOriginCheck.length) this.logger.log(`I_AUTH_ORIGIN_PATH_SKIPS: '${name}': ${context.skipOriginCheck.join(", ")}; app-route checks are unchanged.`);
+		if (production && options.originCheck?.mode === "off") this.warn("W_ORIGIN_CHECK", `'${name}': application origin checks are disabled.`);
+		if (name === "default" && options.cookies?.forwardDirectCalls) this.warn("W_FORWARD_DIRECT_CALLS", "The default instance forwards same-credential direct-call cookies app-wide; every handler requires form-CSRF enforcement.");
+		const proxy = this.mounts.adapter && this.mounts.platform?.proxyTrust?.(this.mounts.adapter);
+		const ip = context.options.advanced?.ipAddress;
+		const role = context.rateLimit.enabled ? "rate-limit buckets and session IP" : "session IP only (rate limiter disabled)";
+		if (production && bridge.clientIpHeader && ip?.ipAddressHeaders?.[0] !== bridge.clientIpHeader) this.warn("W_CLIENT_IP", `'${name}': the bridge IP header is not first in effective ipAddressHeaders (${role}).`);
+		if (production && !bridge.clientIpHeader && !ip?.ipAddressHeaders?.length && !ip?.trustedProxies?.length) this.warn("W_CLIENT_IP", `'${name}': no bridge IP header or SDK IP configuration (${role}).`);
+		if (production && bridge.clientIpHeader && ip?.trustedProxies?.length && proxy && proxy.mode === "none") this.warn("W_CLIENT_IP", `'${name}': SDK trustedProxies rechecks the socket IP without platform proxy trust (${role}); configure platform trust or set clientIpHeader:false.`);
+		if (production && proxy && proxy.mode === "all") this.warn("W_PROXY_TRUST_ALL", `'${name}': the platform trusts every proxy; clients can choose ${role}.`);
+		if (production && !context.rateLimit.enabled && context.options.rateLimit?.enabled === void 0) {
+			const contradiction = process.env.NODE_ENV === "production" ? " while process.env.NODE_ENV is production; Better Auth imported before that value existed" : "";
+			this.warn("W_RATE_LIMIT_DISABLED", `'${name}': better-auth resolved rateLimit.enabled=false${contradiction}. Set NODE_ENV=production before auth.ts is imported, rateLimit.enabled:true, or explicitly disable it when an edge proxy limits traffic.`);
+		}
+	}
+	cookies(issues) {
+		const entries = this.instances.list();
+		for (let i = 0; i < entries.length; i++) for (const right of entries.slice(i + 1)) {
+			const left = entries[i];
+			for (const a of Object.values(left.context.authCookies)) for (const b of Object.values(right.context.authCookies)) if (a.name === b.name && domainsOverlap(a.attributes.domain, b.attributes.domain) && pathsOverlap(a.attributes.path, b.attributes.path)) issues.push(new BetterAuthConfigurationError("COOKIE_NAME_COLLISION", `'${left.name}' and '${right.name}' both use cookie '${a.name}' on overlapping scopes.`, "Set advanced.cookiePrefix on one instance."));
+		}
+	}
+	async validate(issues) {
+		this.#plans.length = 0;
+		this.#claims.length = 0;
+		const sites = this.sites();
+		const candidates = /* @__PURE__ */ new Map();
+		const prepared = /* @__PURE__ */ new Set();
+		const compiled = /* @__PURE__ */ new Map();
+		const failures = /* @__PURE__ */ new Map();
+		const reported = /* @__PURE__ */ new Set();
+		const references = [];
+		const report = (error, detail) => {
+			if (!reported.has(error)) {
+				reported.add(error);
+				issues.push(configurationIssue(error, "UNRESOLVED_POLICY", detail));
+			}
+		};
+		const candidate = (target, method) => {
+			let methods = candidates.get(target);
+			if (!methods) {
+				methods = /* @__PURE__ */ new Map();
+				candidates.set(target, methods);
+			}
+			const existing = methods.get(method);
+			if (existing) return existing;
+			const handler = Reflect.get(target.prototype ?? {}, method);
+			if (typeof handler !== "function") throw new BetterAuthConfigurationError("UNKNOWN_HANDLER", `${target.name}.${method} is not a handler.`);
+			const site = {
+				target,
+				method,
+				handler
+			};
+			methods.set(method, site);
+			return site;
+		};
+		const prepare = (site) => {
+			if (failures.has(site)) throw failures.get(site);
+			if (prepared.has(site)) return;
+			try {
+				const leaves = requirementLeaves(this.planner.requirementsOf(site.target, site.method));
+				references.push(...leaves);
+				for (const requirement of leaves) this.policies.resolve(requirement.policy);
+				prepared.add(site);
+			} catch (error) {
+				failures.set(site, error);
+				throw error;
+			}
+		};
+		const planOf = (target, method) => {
+			const site = candidate(target, method);
+			prepare(site);
+			const cached = compiled.get(site);
+			if (cached) return cached;
+			try {
+				const plan = this.planner.plan(site.target, site.method);
+				compiled.set(site, plan);
+				this.#plans.push({
+					...site,
+					plan
+				});
+				return plan;
+			} catch (error) {
+				failures.set(site, error);
+				throw error;
+			}
+		};
+		for (const site of sites) if (this.trigger(site.handler) || [
+			ACCESS_METADATA,
+			FRESHNESS_METADATA,
+			SKIP_ORIGIN_CHECK_METADATA,
+			SKIP_DEFAULT_REQUIREMENTS_METADATA
+		].some((key) => Reflect.hasOwnMetadata(key, site.handler))) {
+			const selected = candidate(site.target, site.method);
+			try {
+				prepare(selected);
+			} catch (error) {
+				report(error, `Cannot prepare ${site.target.name}.${site.method}.`);
+			}
+		}
+		let canariesPassed = false;
+		try {
+			this.canaries();
+			canariesPassed = true;
+		} catch (error) {
+			issues.push(configurationIssue(error, "NEST_METADATA_KEY_CHANGED", "Coverage metadata canaries failed."));
+		}
+		if (canariesPassed) for (const transport of this.transports.list()) try {
+			await transport.validate?.({
+				discovery: this.discovery,
+				reflector: this.reflector,
+				moduleRef: this.moduleRef,
+				hasHttpAdapter: this.mounts.adapter !== null,
+				planOf,
+				claim: (target, method, reach, options) => {
+					this.#claims.push({
+						transport,
+						target,
+						method,
+						reach,
+						options
+					});
+					if (method !== void 0) candidate(target, method);
+				},
+				logger: this.logger
+			});
+		} catch (error) {
+			if (!reported.has(error)) {
+				reported.add(error);
+				issues.push(configurationIssue(error, "TRANSPORT_VALIDATION_FAILED", `Transport '${transport.id}' failed validation.`));
+			}
+		}
+		for (const methods of candidates.values()) for (const site of methods.values()) try {
+			prepare(site);
+		} catch (error) {
+			report(error, `Cannot prepare ${site.target.name}.${site.method}.`);
+		}
+		this.singletonChecks(issues, references);
+		for (const methods of candidates.values()) for (const site of methods.values()) try {
+			planOf(site.target, site.method);
+		} catch (error) {
+			report(error, `Cannot compile ${site.target.name}.${site.method}.`);
+		}
+		for (const site of this.#plans) try {
+			const entry = this.instances.get(site.plan.instance);
+			for (const requirement of requirementLeaves(site.plan.requirements)) await this.policies.resolve(requirement.policy).validate?.(requirement.params, {
+				auth: entry.handle,
+				context: entry.context,
+				site: site.plan.site
+			});
+		} catch (error) {
+			report(error, `Cannot validate ${site.target.name}.${site.method}.`);
+		}
+		if (canariesPassed) {
+			this.coverage(sites, issues);
+			const applicationRoutes = [];
+			const globalPrefix = this.appConfig.getGlobalPrefix();
+			const globalPrefixExclusions = this.appConfig.getGlobalPrefixOptions().exclude;
+			const versioningOptions = this.appConfig.getVersioning();
+			const modules = this.moduleRef.get(ModulesContainer, { strict: false });
+			for (const wrapper of this.discovery.getControllers()) {
+				const target = wrapper.metatype;
+				if (!target?.prototype) continue;
+				const moduleType = wrapper.host?.metatype;
+				const modulePath = moduleType ? Reflect.getMetadata(`__module_path__${modules.applicationId}`, moduleType) ?? Reflect.getMetadata("__module_path__", moduleType) : void 0;
+				const host = Reflect.getMetadata("host", target);
+				const controllerVersion = versioningOptions ? Reflect.getMetadata("__version__", target) ?? versioningOptions.defaultVersion : void 0;
+				const rawPrefixes = Reflect.getMetadata("path", target);
+				const prefixes = Array.isArray(rawPrefixes) ? rawPrefixes : [rawPrefixes ?? ""];
+				for (const method of this.scanner.getAllMethodNames(target.prototype)) {
+					const handler = Reflect.get(target.prototype, method);
+					const rawPaths = Reflect.getMetadata("path", handler);
+					const requestMethod = Reflect.getMetadata("method", handler);
+					if (rawPaths === void 0 || requestMethod === void 0) continue;
+					const methodVersion = Reflect.getMetadata("__version__", handler);
+					const effectiveVersion = methodVersion ?? controllerVersion;
+					const conditions = [];
+					if (host !== void 0) conditions.push("host");
+					if (versioningOptions && versioningOptions.type !== VersioningType.URI && effectiveVersion !== void 0 && effectiveVersion !== VERSION_NEUTRAL) conditions.push("version");
+					for (const prefix of prefixes) for (const path of Array.isArray(rawPaths) ? rawPaths : [rawPaths]) {
+						const resolvedPaths = composeRoutePaths({
+							ctrlPath: prefix,
+							methodPath: path,
+							modulePath,
+							globalPrefix,
+							controllerVersion,
+							methodVersion,
+							versioningOptions
+						}, requestMethod, globalPrefixExclusions).map((route) => this.mounts.normalizeApplicationRoute(route));
+						const source = `${target.name}.${method}`;
+						applicationRoutes.push(Object.freeze({
+							method: RequestMethod[requestMethod] ?? String(requestMethod),
+							paths: Object.freeze([...resolvedPaths]),
+							conditions: Object.freeze([...conditions]),
+							source
+						}));
+						for (const route of resolvedPaths) {
+							const binding = this.mounts.bindings().find((candidate) => routeMayWarnAboutMount(route, candidate.basePath));
+							if (!binding) continue;
+							this.warn("W_ROUTE_SHADOWS_AUTH", `${source} at '${route}' may shadow auth mount '${binding.basePath}'.`);
+						}
+					}
+				}
+			}
+			this.mounts.registerApplicationRoutes(Object.freeze(applicationRoutes), issues);
+		}
+		this.cookies(issues);
+		for (const entry of this.instances.list()) {
+			const plans = this.#plans.filter((site) => site.plan.instance === entry.name);
+			const policies = [...new Set(plans.flatMap((site) => requirementLeaves(site.plan.requirements).map((requirement) => this.policies.resolve(requirement.policy))))];
+			this.entryChecks(entry, policies, issues);
+			const handlers = plans.map((site) => {
+				const claims = this.#claims.filter((claim) => claim.target === site.target && (claim.method === void 0 || claim.method === site.method));
+				return {
+					plan: site.plan,
+					transports: [...new Set(claims.map((claim) => claim.transport.id))],
+					inputs: [...new Set(claims.flatMap((claim) => claim.options.inputs ?? []))]
+				};
+			});
+			const advice = {
+				instance: entry.name,
+				auth: entry.handle,
+				context: entry.context,
+				production: productionMode(),
+				hasHttpAdapter: this.mounts.adapter !== null,
+				originCheck: {
+					mode: entry.options.originCheck?.mode ?? "cookie",
+					missingOrigin: entry.options.originCheck?.missingOrigin ?? "reject"
+				},
+				handlers,
+				transports: this.transports.list().map((transport) => ({ id: transport.id })),
+				sources: entry.sources,
+				policies
+			};
+			for (const unit of [
+				...entry.sources,
+				...policies,
+				...this.transports.list(),
+				...this.mounts.platform ? [this.mounts.platform] : []
+			]) try {
+				for (const item of await unit.advise?.(advice) ?? []) {
+					const line = `${item.code}: '${entry.name}' ${unit.id}: ${item.message}${item.hint ? ` ${item.hint}` : ""}`;
+					if (item.level === "warn") this.logger.warn(line);
+					else this.logger.log(line);
+				}
+			} catch (error) {
+				issues.push(configurationIssue(error, "EXTENSION_ADVICE_FAILED", `Advice from '${unit.id}' failed.`));
+			}
+		}
+	}
+	summary(hooks) {
+		for (const entry of this.instances.list()) {
+			if (entry.options.logSummary === false) continue;
+			const mount = this.mounts.binding(entry.name);
+			const plans = this.#plans.filter((site) => site.plan.instance === entry.name).map((site) => site.plan);
+			const rate = entry.context.rateLimit.enabled ? "on" : entry.context.options.rateLimit?.enabled === false ? "off (rateLimit.enabled:false)" : process.env.NODE_ENV === "production" ? "off (Better Auth saw no NODE_ENV=production at import time; see W_RATE_LIMIT_DISABLED)" : `off (NODE_ENV ${process.env.NODE_ENV ?? "unset"}; Better Auth enables it for NODE_ENV=production)`;
+			const table = hooks.get(entry.name);
+			const hookSummary = table ? `${table.before.length} before, ${table.after.length} after, ${Object.values(table.database).reduce((count, value) => count + value.before.length + value.after.length, 0)} database` : "none";
+			const proxy = this.mounts.adapter ? this.mounts.platform?.proxyTrust?.(this.mounts.adapter) : void 0;
+			const defaults = `access: ${entry.options.defaultAccess ?? "authenticated"}; origin: ${entry.options.originCheck?.mode ?? "cookie"}/${entry.options.originCheck?.missingOrigin ?? "reject"}; direct-call cookies: ${entry.options.cookies?.forwardDirectCalls ? "same-credential" : "opt-in"}`;
+			const guardOrder = this.appConfig.getGlobalGuards().map((guard) => guard.constructor.name).join(" → ");
+			this.logger.log(`'${entry.name}': ${mount ? `mounted at ${mount.basePath} (${mount.bodyLimit} bytes)` : "not mounted"}; platform: ${this.mounts.platform?.id ?? "none"} (trust proxy: ${proxy?.mode ?? "unknown"}${proxy?.detail ? ` ${proxy.detail}` : ""}); outside global prefix '${this.appConfig.getGlobalPrefix()}'; hooks: ${hookSummary}; defaults: ${defaults}; transports: ${this.transports.list().map((unit) => unit.id).join(", ")}; principals: ${entry.sources.map((unit) => `${unit.id} (${unit.acceptance ?? "explicit"})`).join(" → ")}; handlers: ${plans.length} (${plans.filter((plan) => plan.access === "public").length} public, ${plans.filter((plan) => plan.access === "optional").length} optional, ${plans.filter((plan) => plan.access === "inherit").length} inherit, ${plans.filter((plan) => plan.skipsDefaultRequirements).length} skip defaults); environment: ${productionMode() ? "production" : "development"} (NODE_ENV ${process.env.NODE_ENV ?? "unset"}); rate limit: ${rate}; scope: ${this.#globalScope ? "global" : "off — see W_NO_GLOBAL_SCOPE"}; global guards: ${guardOrder}`);
+		}
+	}
+};
+BootValidator = __decorate([
+	__decorateParam(0, Inject(DiscoveryService)),
+	__decorateParam(1, Inject(MetadataScanner)),
+	__decorateParam(2, Inject(Reflector)),
+	__decorateParam(3, Inject(ModuleRef)),
+	__decorateParam(4, Inject(ApplicationConfig)),
+	__decorateParam(5, Inject(INSTANCE_REGISTRY)),
+	__decorateParam(6, Inject(ROUTE_PLANNER)),
+	__decorateParam(7, Inject(POLICY_RESOLVER)),
+	__decorateParam(8, Inject(TRANSPORT_REGISTRY)),
+	__decorateParam(9, Inject(MOUNT_COORDINATOR))
+], BootValidator);
+//#endregion
+//#region src/hook-binder.ts
+const DATABASE_TARGETS = [
+	"user",
+	"session",
+	"account",
+	"verification"
+].flatMap((model) => [
+	"create",
+	"update",
+	"delete"
+].map((operation) => `${model}.${operation}`));
+function emptyHookTables() {
+	return {
+		before: [],
+		after: [],
+		database: Object.fromEntries(DATABASE_TARGETS.map((target) => [target, {
+			before: [],
+			after: []
+		}]))
+	};
+}
+function distance$1(a, b) {
+	let row = Array.from({ length: b.length + 1 }, (_, i) => i);
+	for (let i = 1; i <= a.length; i++) {
+		const next = [i];
+		for (let j = 1; j <= b.length; j++) next[j] = Math.min(next[j - 1] + 1, row[j] + 1, row[j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1));
+		row = next;
+	}
+	return row[b.length];
+}
+let HookBinder = class HookBinder {
+	discovery;
+	scanner;
+	logger = new Logger("BetterAuth");
+	constructor(discovery, scanner) {
+		this.discovery = discovery;
+		this.scanner = scanner;
+	}
+	discover(registry, issues) {
+		const endpoint = /* @__PURE__ */ new Map();
+		const database = /* @__PURE__ */ new Map();
+		const registrations = new Set(registry.registrations().map((item) => item.name));
+		const discovered = /* @__PURE__ */ new Map();
+		for (const wrapper of this.discovery.getProviders()) {
+			if (wrapper.isAlias || !wrapper.instance || typeof wrapper.instance !== "object" && typeof wrapper.instance !== "function") continue;
+			const instance = wrapper.instance;
+			if (!Object.getPrototypeOf(instance)) continue;
+			const methods = new Set(this.scanner.getAllMethodNames(instance));
+			for (let current = instance; current && current !== Object.prototype; current = Object.getPrototypeOf(current)) for (const key of Object.getOwnPropertySymbols(current)) if (typeof Object.getOwnPropertyDescriptor(current, key)?.value === "function") methods.add(key);
+			let found = false;
+			for (const method of methods) {
+				const handler = Reflect.get(instance, method);
+				if (typeof handler !== "function") continue;
+				const metadata = readHookMetadata(handler);
+				if (!metadata.hooks.length && !metadata.databaseHooks.length) continue;
+				found = true;
+				if (!isSingletonDependencyTree(wrapper)) {
+					issues.push(new BetterAuthConfigurationError("NON_SINGLETON_EXTENSION", `Hook provider '${wrapper.name}' is not a static singleton.`, "Remove request/transient dependencies from hook providers."));
+					continue;
+				}
+				for (const declaration of metadata.hooks) {
+					const name = declaration.options.instance ?? "default";
+					if (!registrations.has(name)) {
+						issues.push(new BetterAuthConfigurationError("UNKNOWN_INSTANCE", `Hook '${wrapper.name}.${String(method)}' names unknown instance '${name}'.`));
+						continue;
+					}
+					const entry = registry.list().find((value) => value.name === name);
+					if (!entry) continue;
+					const paths = Object.values(entry.instance.api).flatMap((api) => typeof api === "function" && typeof Reflect.get(api, "path") === "string" ? [Reflect.get(api, "path")] : []);
+					const { match, options } = declaration;
+					const patterns = typeof match === "string" ? [match] : Array.isArray(match) ? match : [];
+					for (const pattern of patterns) if (!paths.includes(pattern)) {
+						const closest = [...paths].sort((a, b) => distance$1(a, pattern) - distance$1(b, pattern))[0];
+						issues.push(new BetterAuthConfigurationError("UNKNOWN_HOOK_PATH", `Hook '${wrapper.name}.${String(method)}' has unknown path '${pattern}'.`, closest ? `Did you mean '${closest}'?` : "Use an endpoint path exposed by this auth instance."));
+					}
+					const hook = {
+						matches(ctx, scope) {
+							const router = Reflect.get(ctx, "_flag") === "router";
+							if (options.calls === "http" && !router || options.calls === "server" && router || options.skipInternal && scope?.internal) return false;
+							if (match === void 0) return true;
+							if (typeof match === "function") return match(ctx);
+							return typeof match === "string" ? ctx.path === match : match.includes(ctx.path ?? "");
+						},
+						async run(ctx) {
+							return handler.call(instance, ctx);
+						}
+					};
+					const list = endpoint.get(name) ?? [];
+					list.push({
+						phase: declaration.phase,
+						order: options.order ?? 0,
+						hook
+					});
+					endpoint.set(name, list);
+				}
+				for (const declaration of metadata.databaseHooks) {
+					const name = declaration.options.instance ?? "default";
+					if (!registrations.has(name)) {
+						issues.push(new BetterAuthConfigurationError("UNKNOWN_INSTANCE", `Database hook '${wrapper.name}.${String(method)}' names unknown instance '${name}'.`));
+						continue;
+					}
+					const list = database.get(name) ?? [];
+					list.push({
+						phase: declaration.phase,
+						target: declaration.target,
+						order: declaration.options.order ?? 0,
+						hook: handler.bind(instance)
+					});
+					database.set(name, list);
+				}
+			}
+			if (found) {
+				const owner = wrapper.host?.name ?? "unknown module";
+				const previous = discovered.get(wrapper.metatype);
+				if (previous) this.logger.warn(`W_DUPLICATE_HOOK_PROVIDER: '${wrapper.name}' is provided in '${previous}' and '${owner}'; both registrations run.`);
+				discovered.set(wrapper.metatype, owner);
+			}
+		}
+		const tables = /* @__PURE__ */ new Map();
+		for (const name of registrations) {
+			const hooks = (endpoint.get(name) ?? []).sort((a, b) => a.order - b.order);
+			const db = (database.get(name) ?? []).sort((a, b) => a.order - b.order);
+			tables.set(name, {
+				before: hooks.filter((value) => value.phase === "before").map((value) => value.hook),
+				after: hooks.filter((value) => value.phase === "after").map((value) => value.hook),
+				database: Object.fromEntries(DATABASE_TARGETS.map((target) => [target, {
+					before: db.filter((value) => value.target === target && value.phase === "before").map((value) => value.hook),
+					after: db.filter((value) => value.target === target && value.phase === "after").map((value) => value.hook)
+				}]))
+			});
+		}
+		return tables;
+	}
+};
+HookBinder = __decorate([
+	__decorateParam(0, Inject(DiscoveryService)),
+	__decorateParam(1, Inject(MetadataScanner)),
+	__decorateMetadata("design:paramtypes", [typeof DiscoveryService === "undefined" ? Object : DiscoveryService, typeof MetadataScanner === "undefined" ? Object : MetadataScanner])
+], HookBinder);
+//#endregion
+//#region src/auth-exchange.ts
+const HOP_HEADERS = [
+	"connection",
+	"keep-alive",
+	"proxy-connection",
+	"transfer-encoding",
+	"te",
+	"trailer",
+	"upgrade",
+	"proxy-authenticate",
+	"proxy-authorization"
+];
+function sdkAPIError(error) {
+	try {
+		return isAPIError(error);
+	} catch {
+		return false;
+	}
+}
+function production() {
+	return ![
+		"development",
+		"dev",
+		"test"
+	].includes(process.env.NODE_ENV ?? "");
+}
+function distance(left, right) {
+	let previous = Array.from({ length: right.length + 1 }, (_, index) => index);
+	for (let row = 0; row < left.length; row++) {
+		const current = [row + 1];
+		for (let column = 0; column < right.length; column++) current.push(Math.min(current[column] + 1, previous[column + 1] + 1, previous[column] + Number(left[row] !== right[column])));
+		previous = current;
+	}
+	return previous[right.length];
+}
+/** App-owned exchange; all platform request and response operations stay outside core. */
+var AuthExchange = class {
+	scope;
+	#warnedProxy = false;
+	constructor(scope) {
+		this.scope = scope;
+	}
+	create(entry, init) {
+		const paths = [...new Set(Object.values(entry.instance.api).flatMap((endpoint) => {
+			const path = Reflect.get(endpoint, "path");
+			return typeof path === "string" ? [path] : [];
+		}))];
+		const seen = /* @__PURE__ */ new Set();
+		const binding = Object.freeze({
+			instance: entry.name,
+			basePath: init.basePath,
+			bodyLimit: init.bodyLimit,
+			staticOrigin: init.staticOrigin,
+			matches: (pathname) => init.basePath === "/" ? pathname.startsWith("/") : pathname === init.basePath || pathname.startsWith(`${init.basePath}/`),
+			payloadTooLarge: () => Response.json({
+				code: "PAYLOAD_TOO_LARGE",
+				message: "Request body exceeds the configured limit"
+			}, { status: 413 }),
+			handle: async (inbound) => {
+				const response = await this.handle(entry, init, binding, inbound);
+				if (response.status === 404 && (entry.options.http?.diagnostics ?? !production())) {
+					const pathname = new URL(inbound.url).pathname;
+					const key = `${inbound.method.toUpperCase()} ${pathname}`;
+					if (binding.matches(pathname) && !seen.has(key) && seen.size < 100) {
+						seen.add(key);
+						const requested = pathname.slice(init.basePath === "/" ? 0 : init.basePath.length);
+						const closest = paths.reduce((best, path) => best === void 0 || distance(requested, path) < distance(requested, best) ? path : best, void 0);
+						const suggestion = closest ? ` Did you mean ${init.basePath === "/" ? "" : init.basePath}${closest}?` : "";
+						init.logger.warn(`better-auth has no route for ${key} (mounted at ${init.basePath}).${suggestion}`);
+					}
+				}
+				return response;
+			}
+		});
+		return binding;
+	}
+	async handle(entry, init, binding, inbound) {
+		const redactors = [new ErrorRedactor({
+			secrets: [entry.context.secret],
+			headers: inbound.headers,
+			credentialHeaders: entry.credentialHeaders
+		})];
+		try {
+			const method = inbound.method.toUpperCase();
+			let body = null;
+			if (method !== "GET" && method !== "HEAD") {
+				if (inbound.body instanceof Uint8Array) {
+					if (inbound.body.byteLength > init.bodyLimit) return binding.payloadTooLarge();
+					body = inbound.body;
+				} else if (inbound.body !== null) {
+					const bounded = await readBoundedBody(inbound.body, { limit: init.bodyLimit });
+					if (!bounded.ok) {
+						if (bounded.reason === "too-large") return binding.payloadTooLarge();
+						throw new Error("Authentication request body was aborted");
+					}
+					body = bounded.bytes;
+				}
+			}
+			let url;
+			try {
+				url = new URL(inbound.url);
+				if (!["http:", "https:"].includes(url.protocol) || url.username || url.password) throw new TypeError("Invalid request URL");
+				if (init.staticOrigin) url = new URL(`${init.staticOrigin}${url.pathname}${url.search}`);
+			} catch {
+				return Response.json({
+					code: "INVALID_REQUEST_URL",
+					message: "Invalid request URL"
+				}, { status: 400 });
+			}
+			const headers = new Headers(inbound.headers);
+			const nominated = (headers.get("connection") ?? "").split(",").map((name) => name.trim()).filter(Boolean);
+			for (const name of [...HOP_HEADERS, ...nominated]) headers.delete(name);
+			const ipHeader = entry.bridge.clientIpHeader;
+			for (const name of [...headers.keys()]) if (name.startsWith("x-nestjs-kit-better-auth-ip-") || name === ipHeader?.toLowerCase()) headers.delete(name);
+			if (ipHeader && inbound.clientIp !== null) headers.set(ipHeader, inbound.clientIp);
+			this.warnProxy(entry, init, inbound);
+			const request = new Request(url, {
+				method,
+				headers,
+				body: body === null ? null : Uint8Array.from(body),
+				signal: inbound.signal
+			});
+			const interceptors = entry.options.http?.around ?? [];
+			const dispatch = (index, current) => {
+				redactors.push(new ErrorRedactor({
+					headers: current.headers,
+					credentialHeaders: entry.credentialHeaders
+				}));
+				const interceptor = interceptors[index];
+				return interceptor ? interceptor({
+					request: current,
+					platformRequest: inbound.platformRequest,
+					instance: entry.name
+				}, (replacement = current) => dispatch(index + 1, replacement)) : this.scope.exit(() => entry.instance.handler(current));
+			};
+			return await dispatch(0, request);
+		} catch (error) {
+			if (sdkAPIError(error)) {
+				if (entry.context.options.onAPIError?.throw) throw error;
+				return Response.json(error.body ?? { message: error.message }, {
+					status: error.statusCode,
+					headers: getAPIErrorHeaders(error)
+				});
+			}
+			let cause = error;
+			for (const redactor of redactors) cause = redactor.redact(cause);
+			const wrapped = createInfrastructureError(cause);
+			if (entry.options.errors?.exposeRawCause) {
+				const raw = createInfrastructureError(error, { exposeRawCause: true });
+				Object.defineProperty(raw, "cause", { value: wrapped.cause });
+				throw raw;
+			}
+			throw wrapped;
+		}
+	}
+	warnProxy(entry, init, inbound) {
+		if (this.#warnedProxy || !production() || init.proxyTrust?.mode !== "none" || ![
+			"x-forwarded-for",
+			"forwarded",
+			"x-real-ip"
+		].some((name) => inbound.headers.has(name))) return;
+		this.#warnedProxy = true;
+		const ip = entry.context.options.advanced?.ipAddress;
+		const bridgeHeader = entry.bridge.clientIpHeader;
+		const bridgeHeaderFirst = bridgeHeader !== null && ip?.ipAddressHeaders?.[0]?.toLowerCase() === bridgeHeader.toLowerCase();
+		let effect;
+		if (!entry.context.rateLimit.enabled) {
+			if (bridgeHeader === null) effect = "Rate limiting is disabled; the bridge does not insert this socket IP, so better-auth's configured IP resolution determines the session IP.";
+			else if (!bridgeHeaderFirst) effect = "Rate limiting is disabled; a configured better-auth IP header precedes the bridge header, so this socket IP is not necessarily recorded on sessions.";
+			else effect = "Rate limiting is disabled; this IP is recorded on sessions only.";
+		} else if (bridgeHeader === null) effect = "The bridge does not insert this socket IP; better-auth's configured IP resolution determines the rate-limit key.";
+		else if (!bridgeHeaderFirst) effect = "A configured better-auth IP header precedes the bridge header, so this socket IP is not necessarily the rate-limit key.";
+		else if (ip?.trustedProxies?.length) effect = "If better-auth trustedProxies covers this address, no client IP remains and all clients share one rate-limit bucket. Otherwise this socket IP is the rate-limit key.";
+		else effect = "This socket IP is the rate-limit key, so clients behind the proxy share its bucket.";
+		init.logger.warn(`W_PROXY_UNTRUSTED: platform resolved socket IP ${inbound.clientIp ?? "unknown"}. ${effect} Configure platform proxy trust (${init.proxyTrust.detail}).`);
+	}
+};
+/** Credentialed CORS for the auth mount, using the initialized SDK trusted origins. */
+function betterAuthCorsOrigin(auth, options) {
+	const context = async () => await auth.$context;
+	const trusted = new TrustedOrigins(context);
+	return (origin, callback) => {
+		(async () => {
+			if (typeof (await context()).options.trustedOrigins === "function") throw new BetterAuthConfigurationError("DYNAMIC_CORS_ORIGIN", "Function-valued trustedOrigins needs a request that a CORS origin callback cannot provide", "Supply a request-aware CORS origin function instead of betterAuthCorsOrigin.");
+			if (!origin) return false;
+			if (options?.allowPatterns) return trusted.isTrusted(origin);
+			return (await trusted.list()).some((candidate) => {
+				try {
+					const parsed = new URL(candidate);
+					return (parsed.protocol === "http:" || parsed.protocol === "https:") && !candidate.includes("*") && candidate === parsed.origin && origin === candidate;
+				} catch {
+					return false;
+				}
+			});
+		})().then((allow) => callback(null, allow), (error) => callback(error instanceof Error ? error : /* @__PURE__ */ new Error("Failed to resolve trusted CORS origins")));
+	};
+}
+//#endregion
+//#region src/mount-coordinator.ts
+const MOUNTED = Symbol.for("@nestjs-kit/better-auth:mounted");
+function parseBodyLimit(input) {
+	if (input === void 0) return 1048576;
+	const match = typeof input === "string" ? /^(\d+(?:\.\d+)?)(b|kb|mb)$/i.exec(input) : null;
+	const value = typeof input === "number" ? input : match ? Number(match[1]) * ({
+		b: 1,
+		kb: 1024,
+		mb: 1048576
+	}[match[2].toLowerCase()] ?? 0) : NaN;
+	if (!Number.isSafeInteger(value) || value < 0) throw new BetterAuthConfigurationError("INVALID_BODY_LIMIT", `Invalid auth body limit '${input}'.`, "Use a nonnegative byte count or a value such as '1mb'.");
+	return value;
+}
+let MountCoordinator = class MountCoordinator {
+	host;
+	registry;
+	logger = new Logger("BetterAuth");
+	#exchange;
+	#bindings = /* @__PURE__ */ new Map();
+	#platforms;
+	#prepared = null;
+	#selected;
+	#preparationErrors = [];
+	constructor(host, registry, scope) {
+		this.host = host;
+		this.registry = registry;
+		this.#exchange = new AuthExchange(scope);
+		host.init$.subscribe(() => this.tryPrepare(false));
+	}
+	registerPlatforms(platforms) {
+		this.#platforms = platforms;
+		this.tryPrepare(false);
+	}
+	get platform() {
+		return this.#selected;
+	}
+	get adapter() {
+		return this.host.httpAdapter ?? null;
+	}
+	tryPrepare(atInit) {
+		const adapter = this.adapter;
+		if (!adapter || !this.#platforms || this.#prepared === adapter) return;
+		try {
+			if (this.registry.state !== "new" && this.registry.adapter !== adapter) throw new BetterAuthConfigurationError("LATE_HTTP_ADAPTER", "The HTTP adapter changed while the application is active.", "Close the first application before starting another.");
+			const supported = this.#platforms.filter((platform) => platform.supports(adapter));
+			if (supported.length !== 1) throw new BetterAuthConfigurationError(supported.length ? "AMBIGUOUS_PLATFORM" : "NO_PLATFORM", `Expected exactly one supporting HTTP platform; found ${supported.length}.`, "Register the platform for your HTTP adapter on the default instance.");
+			const platform = supported[0];
+			if (atInit && this.#prepared !== null && !platform.capabilities?.prepareAtInit) throw new BetterAuthConfigurationError("APP_ADAPTER_CHANGED", "The application uses a different HTTP adapter after preparation.", "Compile a new TestingModule for each application (or use NestFactory).");
+			platform.prepare?.({
+				adapter,
+				logger: this.logger,
+				route: (pathname) => this.route(pathname)
+			});
+			this.#selected = platform;
+			this.#prepared = adapter;
+		} catch (error) {
+			this.#preparationErrors.push(configurationIssue(error, "PLATFORM_PREPARATION_FAILED", "HTTP platform preparation failed."));
+		}
+	}
+	prepareAtInit(issues) {
+		this.tryPrepare(true);
+		issues.push(...this.#preparationErrors);
+		this.#preparationErrors = [];
+		if (this.adapter && this.#selected) try {
+			this.#selected.validate?.(this.adapter);
+		} catch (error) {
+			issues.push(configurationIssue(error, "PLATFORM_VALIDATION_FAILED", "HTTP platform validation failed."));
+		}
+	}
+	resolve(issues) {
+		this.#bindings.clear();
+		const adapter = this.adapter;
+		if (!adapter || !this.#selected) return;
+		const server = adapter.getInstance();
+		const mounted = Reflect.get(server, MOUNTED);
+		for (const entry of this.registry.list()) {
+			if (entry.options.http?.mount === false) continue;
+			try {
+				const raw = entry.context.baseURL ? new URL(entry.context.baseURL).pathname : entry.context.options.basePath || "/api/auth";
+				const basePath = raw.length > 1 ? raw.replace(/\/+$/, "") : raw;
+				if (!basePath.startsWith("/") || basePath === "/" && !entry.options.http?.allowRootMount) throw new BetterAuthConfigurationError("INVALID_MOUNT_PATH", `Invalid auth mount path '${basePath}'.`, "Use an absolute path; opt into root mounting with http.allowRootMount.");
+				if (mounted?.has(basePath)) throw new BetterAuthConfigurationError("DUPLICATE_MOUNT", `Auth path '${basePath}' is already mounted on this server.`, "Create a fresh application and adapter.");
+				for (const existing of this.#bindings.values()) if (basePath === "/" || existing.basePath === "/" || existing.matches(basePath) || basePath.startsWith(`${existing.basePath}/`) || existing.basePath.startsWith(`${basePath}/`)) throw new BetterAuthConfigurationError("OVERLAPPING_MOUNTS", `Mounts '${existing.basePath}' and '${basePath}' overlap.`, "Use separate basePath values for named instances.");
+				this.#bindings.set(entry.name, this.#exchange.create(entry, {
+					basePath,
+					bodyLimit: parseBodyLimit(entry.options.http?.bodyLimit),
+					staticOrigin: entry.context.baseURL ? new URL(entry.context.baseURL).origin : void 0,
+					logger: this.logger,
+					proxyTrust: this.#selected.proxyTrust?.(adapter)
+				}));
+			} catch (error) {
+				issues.push(configurationIssue(error, "INVALID_MOUNT_PATH", `Cannot resolve mount for '${entry.name}'.`));
+			}
+		}
+	}
+	route(pathname) {
+		return [...this.#bindings.values()].find((binding) => binding.matches(pathname));
+	}
+	binding(name) {
+		return this.#bindings.get(name);
+	}
+	bindings() {
+		return [...this.#bindings.values()];
+	}
+	normalizeApplicationRoute(path) {
+		const adapter = this.adapter;
+		return adapter && typeof adapter.normalizePath === "function" ? adapter.normalizePath(path) : path;
+	}
+	registerApplicationRoutes(routes, issues) {
+		try {
+			this.#selected?.applicationRoutes?.(routes, Object.freeze([...this.#bindings.values()]));
+		} catch (error) {
+			issues.push(configurationIssue(error, "APPLICATION_ROUTE_REGISTRATION_FAILED", "Cannot register application routes with the HTTP platform."));
+		}
+	}
+	async mount() {
+		const adapter = this.adapter;
+		const platform = this.#selected;
+		if (!adapter || !platform) return;
+		const server = adapter.getInstance();
+		let mounted = Reflect.get(server, MOUNTED);
+		if (!mounted) {
+			mounted = /* @__PURE__ */ new Set();
+			Object.defineProperty(server, MOUNTED, { value: mounted });
+		}
+		for (const binding of this.#bindings.values()) {
+			if (mounted.has(binding.basePath)) throw new BetterAuthConfigurationError("DUPLICATE_MOUNT", `Auth path '${binding.basePath}' is already mounted.`);
+			await platform.mount({
+				adapter,
+				logger: this.logger,
+				binding
+			});
+			mounted.add(binding.basePath);
+		}
+	}
+	reset() {
+		this.#bindings.clear();
+		this.#preparationErrors = [];
+	}
+};
+MountCoordinator = __decorate([
+	__decorateParam(0, Inject(HttpAdapterHost)),
+	__decorateParam(1, Inject(INSTANCE_REGISTRY)),
+	__decorateParam(2, Inject(REQUEST_SCOPE)),
+	__decorateMetadata("design:paramtypes", [
+		typeof HttpAdapterHost === "undefined" ? Object : HttpAdapterHost,
+		Object,
+		Object
+	])
+], MountCoordinator);
+//#endregion
+//#region src/policy-resolver.ts
+var PolicyResolver = class {
+	moduleRef;
+	cache = /* @__PURE__ */ new Map();
+	constructor(moduleRef) {
+		this.moduleRef = moduleRef;
+	}
+	resolve(reference) {
+		const cached = this.cache.get(reference);
+		if (cached) return cached;
+		let policy;
+		try {
+			policy = typeof reference === "object" && reference !== null && "evaluate" in reference ? reference : this.moduleRef.get(reference, { strict: false });
+		} catch {
+			throw new BetterAuthConfigurationError("UNRESOLVED_POLICY", "A requirement references a policy that is not registered as a provider");
+		}
+		if (!policy || typeof policy.evaluate !== "function" || typeof policy.id !== "string") throw new BetterAuthConfigurationError("UNRESOLVED_POLICY", "A requirement must reference an authorization policy");
+		this.cache.set(reference, policy);
+		return policy;
+	}
+};
+//#endregion
+//#region src/transport-registry.ts
+var TransportRegistry = class {
+	transports = [];
+	owners = /* @__PURE__ */ new WeakMap();
+	kit = { http: null };
+	register(transports) {
+		this.transports = [...transports];
+	}
+	setKit(kit) {
+		this.kit = kit;
+	}
+	list() {
+		return [...this.transports];
+	}
+	defaultAccessFor(target, method) {
+		for (const transport of this.transports) {
+			const answer = transport.defaultAccessFor?.(target, method);
+			if (answer !== void 0) return answer;
+		}
+	}
+	find(context) {
+		return this.transports.find((unit) => unit.handles(context));
+	}
+	select(context) {
+		const transport = this.find(context);
+		if (!transport) throw BetterAuthConfigurationError.atRequest("NO_TRANSPORT", "No registered transport handles this execution context");
+		return transport;
+	}
+	idOf(call) {
+		return this.owners.get(call) ?? "unknown";
+	}
+	describe(context, transport = this.select(context)) {
+		const call = transport.describe(context, this.kit);
+		this.owners.set(call, transport.id);
+		return call;
+	}
+};
+//#endregion
+//#region src/auth-core-module.ts
+const EVALUATOR = Symbol("authorization-evaluator");
+const exports = [
+	INSTANCE_REGISTRY,
+	REQUEST_SCOPE,
+	PRINCIPAL_READINGS,
+	MOUNT_COORDINATOR,
+	POLICY_RESOLVER,
+	ROUTE_PLANNER,
+	TRANSPORT_REGISTRY,
+	PRINCIPAL_RESOLVER,
+	POLICY_INVOKER,
+	GUARD_CORE,
+	SCOPE_CORE,
+	BetterAuthGuard,
+	BetterAuthScopeInterceptor
+];
+let BetterAuthCoreModule = class BetterAuthCoreModule {
+	instances;
+	scope;
+	transports;
+	mounts;
+	hooks;
+	bridges;
+	validator;
+	#initialization;
+	#ready = false;
+	constructor(instances, scope, transports, mounts, hooks, bridges, validator) {
+		this.instances = instances;
+		this.scope = scope;
+		this.transports = transports;
+		this.mounts = mounts;
+		this.hooks = hooks;
+		this.bridges = bridges;
+		this.validator = validator;
+	}
+	onModuleInit() {
+		if (!this.instances.begin(this.mounts.adapter)) return this.#initialization ?? Promise.resolve();
+		this.#initialization = this.initialize();
+		return this.#initialization;
+	}
+	async initialize() {
+		const issues = [];
+		await this.instances.initialize(issues);
+		const hooks = this.hooks.discover(this.instances, issues);
+		for (const entry of this.instances.list()) {
+			const tables = hooks.get(entry.name) ?? emptyHookTables();
+			const unbound = entry.bridge.unboundDispatches;
+			const count = tables.before.length + tables.after.length + Object.values(tables.database).reduce((sum, value) => sum + value.before.length + value.after.length, 0);
+			try {
+				const result = this.bridges.bind(entry, {
+					owner: this.instances.owner,
+					instance: entry.name,
+					state: "initialized",
+					current: () => this.scope.current()?.view,
+					credentialHeaders: entry.credentialHeaders,
+					...tables,
+					onDropped: (path) => this.instances.logger.debug(`Direct auth call '${path}' used foreign credentials; cookies dropped for '${entry.name}'.`)
+				});
+				if (result.tookOverFrom) this.instances.logger.warn(`W_INSTANCE_TAKEN_OVER: '${entry.name}' took over from never-bootstrapped '${result.tookOverFrom}'; that application fails at bootstrap if it is still initializing.`);
+				if (unbound > 0 && count > 0) this.instances.logger.warn(`W_CALLS_BEFORE_BIND: '${entry.name}': ${unbound} auth dispatches or database writes ran before Nest hooks; move seeding to onApplicationBootstrap.`);
+			} catch (error) {
+				issues.push(configurationIssue(error, "INSTANCE_ALREADY_BOUND", `Cannot bind '${entry.name}' to this application.`));
+			}
+		}
+		this.mounts.prepareAtInit(issues);
+		this.mounts.resolve(issues);
+		this.transports.setKit({ http: this.mounts.platform?.requests ?? null });
+		await this.validator.validate(issues);
+		if (issues.length) {
+			const failure = new BetterAuthConfigurationError("AUTH_BOOT_FAILED", `Authentication bootstrap failed:\n${issues.map((issue) => `[${issue.code}] ${issue.detail}${issue.hint ? ` Hint: ${issue.hint}` : ""}`).join("\n")}`, "Resolve every reported configuration problem before starting the application.");
+			Object.defineProperty(failure, "issues", {
+				value: Object.freeze([...issues]),
+				enumerable: true
+			});
+			throw failure;
+		}
+		this.validator.summary(hooks);
+		await this.mounts.mount();
+		this.#ready = true;
+	}
+	onApplicationBootstrap() {
+		if (this.#ready && this.instances.state !== "bootstrapped") {
+			this.bridges.bootstrap();
+			this.instances.state = "bootstrapped";
+		}
+	}
+	onApplicationShutdown() {
+		this.bridges.close();
+		this.instances.reset();
+		this.mounts.reset();
+		this.#initialization = void 0;
+		this.#ready = false;
+	}
+};
+BetterAuthCoreModule = __decorate([
+	Global(),
+	Module({
+		imports: [DiscoveryModule],
+		providers: [
+			MetadataScanner,
+			{
+				provide: REQUEST_SCOPE,
+				useFactory: () => new RequestScope()
+			},
+			{
+				provide: INSTANCE_REGISTRY,
+				inject: [REQUEST_SCOPE],
+				useFactory: (scope) => new InstanceRegistry(scope)
+			},
+			{
+				provide: PRINCIPAL_READINGS,
+				inject: [REQUEST_SCOPE],
+				useFactory: (scope) => new PrincipalReadings(scope)
+			},
+			{
+				provide: TRANSPORT_REGISTRY,
+				useFactory: () => new TransportRegistry()
+			},
+			{
+				provide: POLICY_RESOLVER,
+				inject: [ModuleRef],
+				useFactory: (ref) => new PolicyResolver(ref)
+			},
+			{
+				provide: ROUTE_PLANNER,
+				inject: [
+					INSTANCE_REGISTRY,
+					POLICY_RESOLVER,
+					TRANSPORT_REGISTRY
+				],
+				useFactory: (instances, policies, transports) => new RoutePlanner(instances, policies, transports)
+			},
+			{
+				provide: MOUNT_COORDINATOR,
+				inject: [
+					HttpAdapterHost,
+					INSTANCE_REGISTRY,
+					REQUEST_SCOPE
+				],
+				useFactory: (host, instances, scope) => new MountCoordinator(host, instances, scope)
+			},
+			{
+				provide: PRINCIPAL_RESOLVER,
+				inject: [
+					INSTANCE_REGISTRY,
+					REQUEST_SCOPE,
+					TRANSPORT_REGISTRY
+				],
+				useFactory: (instances, scope, transports) => new ChainPrincipalResolver(instances, scope, transports)
+			},
+			{
+				provide: POLICY_INVOKER,
+				useFactory: () => new DefaultPolicyInvoker()
+			},
+			{
+				provide: EVALUATOR,
+				inject: [
+					POLICY_RESOLVER,
+					POLICY_INVOKER,
+					PRINCIPAL_RESOLVER,
+					REQUEST_SCOPE
+				],
+				useFactory: (policies, invoker, resolver, scope) => new AuthorizationEvaluator(policies, invoker, resolver, scope)
+			},
+			{
+				provide: GUARD_CORE,
+				inject: [
+					INSTANCE_REGISTRY,
+					ROUTE_PLANNER,
+					TRANSPORT_REGISTRY,
+					PRINCIPAL_RESOLVER,
+					EVALUATOR,
+					REQUEST_SCOPE,
+					PRINCIPAL_READINGS
+				],
+				useFactory: (instances, planner, transports, resolver, evaluator, scope, readings) => new GuardCore(instances, planner, transports, resolver, evaluator, scope, readings)
+			},
+			{
+				provide: SCOPE_CORE,
+				inject: [
+					INSTANCE_REGISTRY,
+					ROUTE_PLANNER,
+					TRANSPORT_REGISTRY,
+					REQUEST_SCOPE,
+					PRINCIPAL_READINGS
+				],
+				useFactory: (instances, planner, transports, scope, readings) => new ScopeCore(instances, planner, transports, scope, readings)
+			},
+			BetterAuthGuard,
+			BetterAuthScopeInterceptor,
+			HookBinder,
+			BridgeClient,
+			{
+				provide: BootValidator,
+				inject: [
+					DiscoveryService,
+					MetadataScanner,
+					Reflector,
+					ModuleRef,
+					ApplicationConfig,
+					INSTANCE_REGISTRY,
+					ROUTE_PLANNER,
+					POLICY_RESOLVER,
+					TRANSPORT_REGISTRY,
+					MOUNT_COORDINATOR
+				],
+				useFactory: (discovery, scanner, reflector, moduleRef, appConfig, instances, planner, policies, transports, mounts) => new BootValidator(discovery, scanner, reflector, moduleRef, appConfig, instances, planner, policies, transports, mounts)
+			}
+		],
+		exports
+	}),
+	__decorateParam(0, Inject(INSTANCE_REGISTRY)),
+	__decorateParam(1, Inject(REQUEST_SCOPE)),
+	__decorateParam(2, Inject(TRANSPORT_REGISTRY)),
+	__decorateParam(3, Inject(MOUNT_COORDINATOR)),
+	__decorateParam(4, Inject(HookBinder)),
+	__decorateParam(5, Inject(BridgeClient)),
+	__decorateParam(6, Inject(BootValidator)),
+	__decorateMetadata("design:paramtypes", [
+		typeof InstanceRegistry === "undefined" ? Object : InstanceRegistry,
+		typeof RequestScope === "undefined" ? Object : RequestScope,
+		typeof TransportRegistry === "undefined" ? Object : TransportRegistry,
+		typeof MountCoordinator === "undefined" ? Object : MountCoordinator,
+		typeof HookBinder === "undefined" ? Object : HookBinder,
+		typeof BridgeClient === "undefined" ? Object : BridgeClient,
+		typeof BootValidator === "undefined" ? Object : BootValidator
+	])
+], BetterAuthCoreModule);
+//#endregion
+//#region src/session-principal.ts
+const SESSION_PRINCIPAL_KIND = "session";
+const CurrentSession = definePrincipalParam({
+	kind: SESSION_PRINCIPAL_KIND,
+	reason: "SESSION_REQUIRED",
+	project: (principal) => principal.session
+});
+const CurrentUser = definePrincipalParam({
+	kind: SESSION_PRINCIPAL_KIND,
+	reason: "SESSION_REQUIRED",
+	project: (principal) => "user" in principal.session ? principal.session.user : void 0
+});
+function readCurrentSession(readings) {
+	return readings.project(readings.current(), {
+		kind: SESSION_PRINCIPAL_KIND,
+		reason: "SESSION_REQUIRED",
+		site: "BetterAuthService.getSession",
+		project: (principal) => principal.session
+	});
+}
+function sessionPrincipal(options = {}) {
+	return {
+		id: "better-auth:session",
+		kinds: [SESSION_PRINCIPAL_KIND],
+		acceptance: "default",
+		credentialHeaders: ["cookie", "authorization"],
+		sessionBacked: true,
+		async resolve(request) {
+			const context = await request.auth.context();
+			const authoritative = request.freshness === "authoritative";
+			const query = {
+				...authoritative && (context.options.database || context.options.secondaryStorage) ? { disableCookieCache: true } : {},
+				...request.cookies === null ? { disableRefresh: true } : {}
+			};
+			let result;
+			try {
+				result = await request.auth.run({
+					cookies: request.cookies,
+					forward: "none",
+					internal: true
+				}, () => request.auth.api.getSession({
+					headers: request.headers,
+					returnHeaders: true,
+					query
+				}));
+			} catch (error) {
+				const failure = AuthFailures.fromAPIError(error);
+				if (!failure) throw error;
+				const cookies = getAPIErrorHeaders(error).getSetCookie();
+				if (cookies.length) request.cookies?.append(cookies);
+				return rejected(failure);
+			}
+			const cookies = result.headers?.getSetCookie() ?? [];
+			if (cookies.length) request.cookies?.append(cookies);
+			if (result.response == null || authoritative && !request.auth.producedByEndpoint(result.response)) return absent();
+			const userId = options.userId ? options.userId(result.response) : result.response.user?.id ?? null;
+			if (typeof userId !== "string" || !userId) throw BetterAuthConfigurationError.atRequest("SESSION_USER_ID", "session.userId must return a nonempty user id for a resolved session");
+			return authenticated({
+				kind: SESSION_PRINCIPAL_KIND,
+				source: "better-auth:session",
+				userId,
+				session: result.response
+			});
+		},
+		advise(context) {
+			const warnings = [];
+			if (context.context.hasPlugin("jwt")) warnings.push({
+				level: "info",
+				code: "I_SESSION_JWT_COST",
+				message: "Unless disableSettingJwtHeader is enabled, session reads may also sign a JWT."
+			});
+			if (context.context.hasPlugin("bearer")) warnings.push({
+				level: "info",
+				code: "I_SESSION_BEARER_COST",
+				message: "Without requireSignature, foreign bearer tokens can trigger a session lookup."
+			});
+			const sites = context.handlers.filter(({ plan }) => (plan.access === "required" || plan.access === "optional") && [...plan.accepts].some((kind) => kind !== "session")).map(({ plan }) => plan.site);
+			if (sites.length) warnings.push({
+				level: "warn",
+				code: "W_MIXED_KIND_SESSION_READER",
+				message: `If these handlers read getSession(), another authenticated kind throws SESSION_REQUIRED: ${sites.slice(0, 10).join(", ")}`,
+				hint: "Use getPrincipal() and narrow p.kind."
+			});
+			if (context.context.hasPlugin("api-key") && options.apiKeySessions !== false) {
+				warnings.push({
+					level: "warn",
+					code: "W_API_KEY_FULL_SESSION",
+					message: `${options.apiKeySessions ? "API-key sessions grant" : "If enableSessionForAPIKeys is enabled, API-key sessions grant"} full session access on ordinary authenticated routes.`
+				});
+				const presenting = context.policies.filter((policy) => policy.requires?.presentsCredentials).map((policy) => policy.id);
+				if (presenting.length) warnings.push({
+					level: "warn",
+					code: "W_API_KEY_SESSION_MULTIPLIER",
+					message: `${options.apiKeySessions ? "Each" : "If enableSessionForAPIKeys is enabled, each"} check of these policies validates the API key again and spends its quota once more per request: ${presenting.join(", ")}.`
+				});
+			}
+			if (context.context.hasPlugin("expo") && context.originCheck.missingOrigin === "reject") warnings.push({
+				level: "warn",
+				code: "W_ORIGIN_CHECK_NATIVE_CLIENTS",
+				message: "Native clients must send a trusted Origin for cookie-carrying operations."
+			});
+			return warnings;
+		}
+	};
+}
+const freshPolicy = {
+	id: "better-auth:session/fresh",
+	requires: { principals: [SESSION_PRINCIPAL_KIND] },
+	validate(params) {
+		if (params.maxAgeSeconds !== void 0 && (!Number.isFinite(params.maxAgeSeconds) || params.maxAgeSeconds < 0)) throw new BetterAuthConfigurationError("INVALID_FRESH_AGE", "maxAgeSeconds must be finite and nonnegative");
+	},
+	advise(context) {
+		return context.context.hasPlugin("custom-session") ? [{
+			level: "warn",
+			code: "W_FRESH_SESSION_SHAPE",
+			message: "freshSession requires custom session results to retain session.createdAt; unsupported shapes deny PRINCIPAL_NOT_SUPPORTED."
+		}] : [];
+	},
+	async evaluate(params, context) {
+		const createdAt = context.principal.session.session?.createdAt;
+		const age = params.maxAgeSeconds ?? (await context.auth.context()).sessionConfig.freshAge;
+		if (age === 0) return { effect: "allow" };
+		if (!(createdAt instanceof Date) && typeof createdAt !== "string" && typeof createdAt !== "number") return {
+			effect: "deny",
+			reason: "PRINCIPAL_NOT_SUPPORTED"
+		};
+		const time = new Date(createdAt).getTime();
+		return Number.isFinite(time) && Date.now() - time < age * 1e3 ? { effect: "allow" } : {
+			effect: "deny",
+			status: 403,
+			reason: "SESSION_NOT_FRESH"
+		};
+	}
+};
+const freshSession = (options = {}) => ({
+	policy: freshPolicy,
+	params: options
+});
+const RequireFreshSession = (options) => Require(freshSession(options));
+//#endregion
+//#region src/auth-service.ts
+let BetterAuthService = class BetterAuthService {
+	registry;
+	scope;
+	readings;
+	planner;
+	transports;
+	coordinator;
+	name;
+	instance;
+	api;
+	#context;
+	constructor(options, registry, scope, readings, planner, transports, coordinator) {
+		this.registry = registry;
+		this.scope = scope;
+		this.readings = readings;
+		this.planner = planner;
+		this.transports = transports;
+		this.coordinator = coordinator;
+		const registration = registry.registrations().find((value) => value.options === options);
+		if (!registration) throw new BetterAuthConfigurationError("UNKNOWN_INSTANCE", "The service options have no registered instance.");
+		this.name = registration.name;
+		this.instance = options.auth;
+		this.api = options.auth?.api;
+		this.#context = options.auth?.$context;
+	}
+	context() {
+		return this.#context;
+	}
+	mount() {
+		const binding = this.coordinator.binding(this.name);
+		const platform = this.coordinator.platform;
+		return binding && platform ? {
+			basePath: binding.basePath,
+			bodyLimit: binding.bodyLimit,
+			platform: platform.id
+		} : void 0;
+	}
+	getPrincipal() {
+		const reading = this.readings.current();
+		return Promise.resolve(this.readings.project(reading, {
+			site: "BetterAuthService.getPrincipal",
+			project: (principal) => principal
+		}));
+	}
+	getSession() {
+		return Promise.resolve(readCurrentSession(this.readings));
+	}
+	principalFor(context) {
+		const plan = this.planner.forContext(context);
+		const transport = this.transports.find(context);
+		const lineage = transport?.lineage?.(context);
+		const call = plan.access !== "public" && plan.access !== "inherit" && transport ? this.transports.describe(context, transport) : void 0;
+		return this.readings.read({
+			args: context.getArgs(),
+			plan,
+			call,
+			lineage,
+			beforeGuard: true
+		});
+	}
+	headersFrom(platformRequest) {
+		const accessor = this.coordinator.platform?.requests;
+		if (!accessor?.isRequest(platformRequest)) throw BetterAuthConfigurationError.atRequest("NO_HTTP_REQUEST", "headersFrom needs a request from the selected HTTP platform.");
+		const entry = this.registry.get(this.name);
+		const headers = new Headers(accessor.headers(platformRequest));
+		for (const name of [...headers.keys()]) if (name.startsWith(":") || name.startsWith("x-nestjs-kit-better-auth-ip-") || name === entry.bridge.clientIpHeader?.toLowerCase()) headers.delete(name);
+		const clientIp = accessor.clientIp(platformRequest);
+		if (entry.bridge.clientIpHeader && clientIp !== null) headers.set(entry.bridge.clientIpHeader, clientIp);
+		return headers;
+	}
+	forwardForeignCookies(fn) {
+		const outer = this.scope.current();
+		if (!outer?.plan?.forwardDirectCalls) throw BetterAuthConfigurationError.atRequest("FORWARDING_NOT_DECLARED", "Declare cookie forwarding on the active handler before forwarding foreign credentials.", { hint: "Use @ForwardAuthCookies() on a guarded handler." });
+		return this.scope.run(derivedScope(this.scope, {
+			get cookies() {
+				return outer.view.cookies;
+			},
+			get inbound() {
+				return outer.view.inbound;
+			},
+			get internal() {
+				return outer.view.internal;
+			},
+			forward: "any"
+		}), fn);
+	}
+	withoutCookies(fn) {
+		const outer = this.scope.current();
+		return this.scope.run(derivedScope(this.scope, {
+			cookies: null,
+			forward: "none",
+			get inbound() {
+				return outer?.view.inbound;
+			},
+			get internal() {
+				return outer?.view.internal ?? false;
+			}
+		}), fn);
+	}
+	runOutsideScope(fn) {
+		return this.scope.exit(fn);
+	}
+};
+BetterAuthService = __decorate([
+	__decorateParam(0, Inject(getBetterAuthOptionsToken())),
+	__decorateParam(1, Inject(INSTANCE_REGISTRY)),
+	__decorateParam(2, Inject(REQUEST_SCOPE)),
+	__decorateParam(3, Inject(PRINCIPAL_READINGS)),
+	__decorateParam(4, Inject(ROUTE_PLANNER)),
+	__decorateParam(5, Inject(TRANSPORT_REGISTRY)),
+	__decorateParam(6, Inject(MOUNT_COORDINATOR)),
+	__decorateMetadata("design:paramtypes", [
+		Object,
+		Object,
+		Object,
+		Object,
+		Object,
+		Object,
+		Object
+	])
+], BetterAuthService);
+//#endregion
+//#region src/http-transport.ts
+let HttpTransport = class HttpTransport {
+	adapterHost;
+	id = "http";
+	constructor(adapterHost) {
+		this.adapterHost = adapterHost;
+	}
+	handles(context) {
+		return context.getType() === "http";
+	}
+	describe(context, kit) {
+		const http = context.switchToHttp();
+		const request = http.getRequest();
+		const response = http.getResponse();
+		const key = kit.http ? kit.http.key(request) : typeof request === "object" && request !== null ? request : context.getArgs();
+		const accessor = () => {
+			if (!kit.http) throw BetterAuthConfigurationError.atRequest("HTTP_PLATFORM_MISSING", "No HTTP platform is available for this request", { hint: "Register the HTTP platform that supports the application's adapter." });
+			return kit.http;
+		};
+		return {
+			key,
+			invocation: typeof request === "object" && request !== null ? request : key,
+			headers: () => accessor().headers(request),
+			get clientIp() {
+				return accessor().clientIp(request);
+			},
+			get cookies() {
+				return accessor().cookieSink(request, response);
+			},
+			get request() {
+				return accessor().request(request);
+			},
+			param: (name) => accessor().param(request, name),
+			get browser() {
+				const info = accessor().request(request);
+				return {
+					enforce: ![
+						"GET",
+						"HEAD",
+						"OPTIONS"
+					].includes(info.method.toUpperCase()),
+					headers: () => accessor().headers(request),
+					url: info.url,
+					key
+				};
+			}
+		};
+	}
+	toException(failure, context) {
+		const adapter = this.adapterHost.httpAdapter;
+		const response = context.switchToHttp().getResponse();
+		if (adapter && response) {
+			if (failure.challenge) adapter.setHeader(response, "WWW-Authenticate", failure.challenge);
+			const retryAfter = failure.headers?.get("retry-after");
+			if (failure.status === 429 && retryAfter !== null && retryAfter !== void 0) adapter.setHeader(response, "Retry-After", retryAfter);
+		}
+		const body = {
+			statusCode: failure.status,
+			error: failure.status === 401 ? "Unauthorized" : failure.status === 403 ? "Forbidden" : "Too Many Requests",
+			code: failure.code,
+			...failure.reason ? { reason: failure.reason } : {},
+			message: failure.message
+		};
+		if (failure.status === 401) return new UnauthorizedException(body);
+		if (failure.status === 403) return new ForbiddenException(body);
+		return new HttpException(body, 429);
+	}
+	validate(context) {
+		class Probe {
+			route() {}
+		}
+		Get("/nestjs-kit-better-auth-canary/:id")(Probe.prototype, "route", Object.getOwnPropertyDescriptor(Probe.prototype, "route"));
+		if (Reflect.getMetadata("path", Probe.prototype.route) !== "/nestjs-kit-better-auth-canary/:id" || Reflect.getMetadata("method", Probe.prototype.route) !== RequestMethod.GET) throw new BetterAuthConfigurationError("NEST_METADATA_KEY_CHANGED", "Nest HTTP route metadata failed its path/method canary");
+		const scanner = new MetadataScanner();
+		for (const wrapper of context.discovery.getControllers()) {
+			const target = wrapper.metatype;
+			if (!target?.prototype || wrapper.isAlias) continue;
+			const controllerPaths = Reflect.getMetadata("path", target);
+			for (const method of scanner.getAllMethodNames(target.prototype)) {
+				const handler = target.prototype[method];
+				if (typeof handler !== "function" || Reflect.getMetadata("method", handler) === void 0) continue;
+				const paths = [controllerPaths, Reflect.getMetadata("path", handler)].flatMap((value) => typeof value === "string" ? [value] : Array.isArray(value) ? value.filter((item) => typeof item === "string") : []);
+				const inputs = [...new Set(paths.flatMap((path) => [...path.matchAll(/:([A-Za-z0-9_]+)/g)].map((match) => match[1])))];
+				context.claim(target, method, "global", {
+					code: "ROUTE_UNGUARDED",
+					inputs,
+					hint: "Register the global guard (globalGuard: true) or add @UseBetterAuth() to the controller."
+				});
+			}
+		}
+	}
+};
+HttpTransport = __decorate([__decorateParam(0, Inject(HttpAdapterHost)), __decorateMetadata("design:paramtypes", [typeof HttpAdapterHost === "undefined" ? Object : HttpAdapterHost])], HttpTransport);
+function httpTransport() {
+	return HttpTransport;
+}
+//#endregion
+//#region src/auth-module-definition.ts
+function defineExtension(definition) {
+	return {
+		...definition,
+		[EXTENSION_DEFINITION]: true
+	};
+}
+function defineHttpPlatform(platform) {
+	return platform;
+}
+function defineTransport(transport) {
+	return transport;
+}
+const STATIC_KEYS = [
+	"name",
+	"global",
+	"globalGuard",
+	"globalScope",
+	"principals",
+	"platforms",
+	"transports"
+];
+function moduleDefinition(module, definition, async) {
+	const name = definition.name || "default";
+	const providers = [];
+	const imports = [BetterAuthCoreModule];
+	const exports = [];
+	const registrationToken = Symbol(`registration:${name}`);
+	const staticOptions = {
+		name,
+		global: definition.global,
+		globalGuard: definition.globalGuard,
+		globalScope: definition.globalScope,
+		principals: definition.principals
+	};
+	const appOptions = {
+		platforms: definition.platforms,
+		transports: definition.transports
+	};
+	const optionsToken = getBetterAuthOptionsToken(name);
+	if (async) {
+		const factory = definition;
+		imports.push(...factory.imports ?? []);
+		providers.push({
+			provide: optionsToken,
+			inject: [...factory.inject ?? []],
+			useFactory: async (...deps) => {
+				const options = await factory.useFactory(...deps);
+				for (const key of STATIC_KEYS) if (Object.hasOwn(options, key)) throw new BetterAuthConfigurationError("STATIC_OPTION_IN_FACTORY", `'${key}' was returned from useFactory.`, `Pass '${key}' next to useFactory in forRootAsync().`);
+				return options;
+			}
+		});
+	} else {
+		const runtime = { ...definition };
+		for (const key of STATIC_KEYS) delete runtime[key];
+		providers.push({
+			provide: optionsToken,
+			useValue: runtime
+		});
+	}
+	function extensions(point, refs) {
+		return refs.map((ref, index) => {
+			const token = getExtensionToken(point, name, index);
+			if (typeof ref === "function") providers.push({
+				provide: token,
+				useClass: ref
+			});
+			else if (ref && typeof ref === "object" && Reflect.get(ref, EXTENSION_DEFINITION) === true) {
+				const definition = ref;
+				imports.push(...definition.imports ?? []);
+				providers.push(...definition.providers ?? []);
+				if ("useClass" in definition.use) providers.push({
+					provide: token,
+					useClass: definition.use.useClass
+				});
+				else if ("useExisting" in definition.use) providers.push({
+					provide: token,
+					useExisting: definition.use.useExisting
+				});
+				else providers.push({
+					provide: token,
+					useFactory: definition.use.useFactory,
+					inject: [...definition.use.inject ?? []]
+				});
+				exports.push(...definition.exports ?? []);
+			} else providers.push({
+				provide: token,
+				useValue: ref
+			});
+			return token;
+		});
+	}
+	const sourceTokens = extensions("principals", definition.principals ?? []);
+	providers.push({
+		provide: getPrincipalSourcesToken(name),
+		inject: [optionsToken, ...sourceTokens],
+		useFactory: (options, ...sources) => {
+			const builtIn = sessionPrincipal(options.session === false ? void 0 : options.session);
+			return options.session === false ? sources : [...sources, builtIn];
+		}
+	});
+	providers.push({
+		provide: registrationToken,
+		inject: [
+			INSTANCE_REGISTRY,
+			optionsToken,
+			getPrincipalSourcesToken(name)
+		],
+		useFactory: (registry, options, sources) => registry.register(options, staticOptions, sources, appOptions)
+	});
+	providers.push({
+		provide: getBetterAuthInstanceToken(name),
+		inject: [registrationToken],
+		useFactory: (registration) => registration.instance
+	});
+	providers.push({
+		provide: getBetterAuthHandleToken(name),
+		inject: [registrationToken],
+		useFactory: (registration) => registration.handle
+	});
+	const serviceProvider = {
+		provide: getBetterAuthServiceToken(name),
+		inject: [
+			registrationToken,
+			INSTANCE_REGISTRY,
+			REQUEST_SCOPE,
+			PRINCIPAL_READINGS,
+			ROUTE_PLANNER,
+			TRANSPORT_REGISTRY,
+			MOUNT_COORDINATOR
+		],
+		useFactory: (registration, registry, scope, readings, planner, transports, mounts) => new BetterAuthService(registration.options, registry, scope, readings, planner, transports, mounts)
+	};
+	if (name === "default") {
+		providers.push({
+			...serviceProvider,
+			provide: BetterAuthService
+		}, {
+			provide: getBetterAuthServiceToken(name),
+			useExisting: BetterAuthService
+		});
+		exports.push(BetterAuthService);
+		const platformTokens = extensions("platforms", definition.platforms ?? []);
+		const transportTokens = extensions("transports", [...definition.transports ?? [], httpTransport()]);
+		providers.push({
+			provide: PLATFORMS,
+			inject: [MOUNT_COORDINATOR, ...platformTokens],
+			useFactory: (mounts, ...platforms) => {
+				mounts.registerPlatforms(platforms);
+				return platforms;
+			}
+		});
+		providers.push({
+			provide: TRANSPORTS,
+			inject: [TRANSPORT_REGISTRY, ...transportTokens],
+			useFactory: (registry, ...transports) => {
+				registry.register(transports);
+				return transports;
+			}
+		});
+	} else providers.push(serviceProvider);
+	if (definition.globalGuard ?? name === "default") providers.push({
+		provide: APP_GUARD,
+		useExisting: BetterAuthGuard
+	});
+	if (name === "default" && (definition.globalScope ?? true)) providers.push({
+		provide: APP_INTERCEPTOR,
+		useExisting: BetterAuthScopeInterceptor
+	});
+	exports.push(optionsToken, getBetterAuthInstanceToken(name), getBetterAuthHandleToken(name), getBetterAuthServiceToken(name));
+	return {
+		module,
+		global: definition.global ?? true,
+		imports,
+		providers,
+		exports
+	};
+}
+//#endregion
+//#region src/auth-module.ts
+var _BetterAuthModule;
+let BetterAuthModule = _BetterAuthModule = class BetterAuthModule {
+	static forRoot(options) {
+		return moduleDefinition(_BetterAuthModule, options, false);
+	}
+	static forRootAsync(options) {
+		return moduleDefinition(_BetterAuthModule, options, true);
+	}
+};
+BetterAuthModule = _BetterAuthModule = __decorate([Module({})], BetterAuthModule);
+//#endregion
+export { deny as _, httpTransport as a, CurrentUser as c, freshSession as d, sessionPrincipal as f, definePolicy as g, allow as h, defineTransport as i, RequireFreshSession as l, AuthorizationEvaluator as m, defineExtension as n, BetterAuthService as o, betterAuthCorsOrigin as p, defineHttpPlatform as r, CurrentSession as s, BetterAuthModule as t, SESSION_PRINCIPAL_KIND as u };
+
+//# sourceMappingURL=auth-module-CtHx3gRU.mjs.map