@nestjs-kit/better-auth 0.0.0-stage → 2.1.0

package/dist/graphql.d.cts

@@ -0,0 +1,38 @@
+import { I as ExtensionRef, Qn as BetterAuthInfrastructureError, Yn as AuthGraphqlExtensions, Zn as BetterAuthConfigurationError, c as AuthTransport, qn as AuthFailure } from "./auth-contracts-Brh_Qko9.cjs";
+import { IntrinsicException } from "@nestjs/common";
+//#region src/graphql-transport.d.ts
+interface GraphqlTransportOptions {
+  /** Case-insensitive connection-init credential keys; defaults to authorization and cookie. */
+  connectionParamHeaders?: readonly string[];
+  /**
+   * Replaces socket credentials, preserving absent host and forwarded-host/proto headers.
+   * Returning undefined presents no credentials: neither connectionParamHeaders nor the
+   * upgrade request's credential headers are used.
+   */
+  subscriptionCredentials?: (connectionContext: unknown) => HeadersInit | undefined;
+  /** Connection principal reuse; zero by default. Authoritative plans bypass the TTL. */
+  subscriptionPrincipalTtlMs?: number;
+  fieldResolverCoverage?: "error" | "warn" | "off";
+  federationCoverage?: "error" | "warn" | "off";
+}
+export declare class BetterAuthGraphqlDenial extends IntrinsicException {
+  readonly extensions: AuthGraphqlExtensions;
+  constructor(failure: AuthFailure);
+}
+export declare class BetterAuthGraphqlInternalError extends Error {
+  readonly extensions: AuthGraphqlExtensions;
+  constructor(error: BetterAuthInfrastructureError | BetterAuthConfigurationError);
+}
+export declare class BetterAuthGraphqlRepeatedInternalError extends IntrinsicException {
+  readonly extensions: AuthGraphqlExtensions;
+  constructor(error: BetterAuthInfrastructureError | BetterAuthConfigurationError);
+}
+/** Keeps the upgrade request and its original browser headers across Mercurius operation spreads. */
+export declare function mercuriusSubscriptionContext(): (_connection: unknown, request: {
+  headers: Record<string, unknown>;
+}) => Record<string | symbol, unknown>;
+export declare function apolloTransport(options?: GraphqlTransportOptions): ExtensionRef<AuthTransport>;
+export declare function mercuriusTransport(options?: GraphqlTransportOptions): ExtensionRef<AuthTransport>;
+//#endregion
+export type { GraphqlTransportOptions };
+//# sourceMappingURL=graphql.d.cts.map

package/dist/graphql.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"graphql.d.cts","names":[],"sources":["../src/graphql-transport.ts"],"mappings":";;;UAyDiB;;EAEf;;;;;;EAMA,2BACE,+BACG;;EAEL;EACA;EACA;;qBAEW,gCAAgC;WAClC,YAAY;EAErB,YAAY,SAAS;;qBAoBV,uCAAuC;WACzC,YAAY;EAErB,YACE,OAAO,gCAAgC;;qBAM9B,+CAA+C;WACjD,YAAY;EAErB,YACE,OAAO,gCAAgC;;;wBAO3B,iCAA4B,sBAEpB;EACT,SAAS;MACnB;wBAmtBW,gBACd,UAAS,0BACR,aAAa;wBAGA,mBACd,UAAS,0BACR,aAAa"}

package/dist/graphql.d.mts

@@ -0,0 +1,38 @@
+import { I as ExtensionRef, Qn as BetterAuthInfrastructureError, Yn as AuthGraphqlExtensions, Zn as BetterAuthConfigurationError, c as AuthTransport, qn as AuthFailure } from "./auth-contracts-Cz7C4_Ch.mjs";
+import { IntrinsicException } from "@nestjs/common";
+//#region src/graphql-transport.d.ts
+interface GraphqlTransportOptions {
+  /** Case-insensitive connection-init credential keys; defaults to authorization and cookie. */
+  connectionParamHeaders?: readonly string[];
+  /**
+   * Replaces socket credentials, preserving absent host and forwarded-host/proto headers.
+   * Returning undefined presents no credentials: neither connectionParamHeaders nor the
+   * upgrade request's credential headers are used.
+   */
+  subscriptionCredentials?: (connectionContext: unknown) => HeadersInit | undefined;
+  /** Connection principal reuse; zero by default. Authoritative plans bypass the TTL. */
+  subscriptionPrincipalTtlMs?: number;
+  fieldResolverCoverage?: "error" | "warn" | "off";
+  federationCoverage?: "error" | "warn" | "off";
+}
+export declare class BetterAuthGraphqlDenial extends IntrinsicException {
+  readonly extensions: AuthGraphqlExtensions;
+  constructor(failure: AuthFailure);
+}
+export declare class BetterAuthGraphqlInternalError extends Error {
+  readonly extensions: AuthGraphqlExtensions;
+  constructor(error: BetterAuthInfrastructureError | BetterAuthConfigurationError);
+}
+export declare class BetterAuthGraphqlRepeatedInternalError extends IntrinsicException {
+  readonly extensions: AuthGraphqlExtensions;
+  constructor(error: BetterAuthInfrastructureError | BetterAuthConfigurationError);
+}
+/** Keeps the upgrade request and its original browser headers across Mercurius operation spreads. */
+export declare function mercuriusSubscriptionContext(): (_connection: unknown, request: {
+  headers: Record<string, unknown>;
+}) => Record<string | symbol, unknown>;
+export declare function apolloTransport(options?: GraphqlTransportOptions): ExtensionRef<AuthTransport>;
+export declare function mercuriusTransport(options?: GraphqlTransportOptions): ExtensionRef<AuthTransport>;
+//#endregion
+export type { GraphqlTransportOptions };
+//# sourceMappingURL=graphql.d.mts.map

package/dist/graphql.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"graphql.d.mts","names":[],"sources":["../src/graphql-transport.ts"],"mappings":";;;UAyDiB;;EAEf;;;;;;EAMA,2BACE,+BACG;;EAEL;EACA;EACA;;qBAEW,gCAAgC;WAClC,YAAY;EAErB,YAAY,SAAS;;qBAoBV,uCAAuC;WACzC,YAAY;EAErB,YACE,OAAO,gCAAgC;;qBAM9B,+CAA+C;WACjD,YAAY;EAErB,YACE,OAAO,gCAAgC;;;wBAO3B,iCAA4B,sBAEpB;EACT,SAAS;MACnB;wBAmtBW,gBACd,UAAS,0BACR,aAAa;wBAGA,mBACd,UAAS,0BACR,aAAa"}

package/dist/graphql.mjs

@@ -0,0 +1,503 @@
+import { c as isConfigurationError, n as BetterAuthConfigurationError, t as AuthFailures } from "./auth-errors-C3rbTV9p.mjs";
+import { E as REQUIREMENTS_METADATA, a as ACCESS_METADATA, i as ACCEPT_PRINCIPALS_METADATA, s as AUTH_ENHANCER } from "./decorate-Dt0e9K6R.mjs";
+import { t as BetterAuthScopeInterceptor } from "./auth-scope-interceptor-DYPn3b8M.mjs";
+import { t as BetterAuthGuard } from "./auth-guard-h9QB_l11.mjs";
+import { o as toWebHeaders, s as upgradeRequestUrl } from "./platform-CZl7TY8j.mjs";
+import { IntrinsicException } from "@nestjs/common";
+import { ApplicationConfig, MetadataScanner } from "@nestjs/core";
+import { Args, GRAPHQL_MODULE_OPTIONS, PARAM_ARGS_METADATA, Query, RESOLVER_PROPERTY_METADATA, RESOLVER_REFERENCE_METADATA, RESOLVER_TYPE_METADATA, ResolveField, ResolveReference } from "@nestjs/graphql";
+//#region src/graphql-lineage.ts
+const OPERATIONS = Symbol.for("@nestjs-kit/better-auth:graphql-operations");
+function record(value) {
+	return typeof value === "object" && value !== null ? value : void 0;
+}
+/** Apollo reference resolvers omit the argument object; parameter readers see the original array. */
+function graphqlArgs(args) {
+	const reference = args.length === 3;
+	return {
+		root: record(args[0]),
+		args: reference ? void 0 : record(args[1]),
+		context: record(args[reference ? 1 : 2]) ?? args,
+		info: record(args[reference ? 2 : 3])
+	};
+}
+function operationState(carrier, operation) {
+	let operations = Reflect.get(carrier, OPERATIONS);
+	if (!operations) {
+		operations = /* @__PURE__ */ new Map();
+		Object.defineProperty(carrier, OPERATIONS, { value: operations });
+	}
+	let state = operations.get(operation);
+	if (state === void 0) {
+		state = {
+			id: operations.size + 1,
+			references: /* @__PURE__ */ new Set()
+		};
+		operations.set(operation, state);
+	}
+	return state;
+}
+function keys(path) {
+	return path ? [...keys(path.prev), path.key] : [];
+}
+function position(id, path) {
+	return `${id}:${JSON.stringify(keys(path))}`;
+}
+function graphqlInvocation(args, reference = false) {
+	const normalized = graphqlArgs(args);
+	return (reference ? normalized.root : normalized.info) ?? args;
+}
+function graphqlLineage(args, reference = false) {
+	const normalized = graphqlArgs(args);
+	const carrier = normalized.context;
+	const state = operationState(carrier, normalized.info?.operation ?? carrier);
+	const { id } = state;
+	if (reference) state.references.add(JSON.stringify(keys(normalized.info?.path)));
+	return {
+		carrier,
+		position: reference ? `${id}:_entities#${String(normalized.root?.__typename ?? "")}` : position(id, normalized.info?.path),
+		*enclosing(currentArgs) {
+			const current = graphqlArgs(currentArgs);
+			const operation = operationState(current.context, current.info?.operation ?? current.context);
+			const path = current.info?.path;
+			for (let child = path, parent = path?.prev; parent; child = parent, parent = parent.prev) {
+				if (typeof parent.key === "number" && parent.prev && (parent.prev.key === "_entities" || operation.references.has(JSON.stringify(keys(parent.prev))))) yield `${operation.id}:_entities#${child?.typename ?? String(current.root?.__typename ?? "")}`;
+				yield position(operation.id, parent);
+			}
+		}
+	};
+}
+//#endregion
+//#region src/graphql-transport.ts
+const MERCURIUS_AMBIENT = Symbol.for("@nestjs-kit/better-auth:mercurius-ambient");
+const MERCURIUS_UPGRADE = Symbol.for("@nestjs-kit/better-auth:mercurius-upgrade");
+var BetterAuthGraphqlDenial = class extends IntrinsicException {
+	extensions;
+	constructor(failure) {
+		super(failure.message);
+		this.extensions = {
+			code: failure.code,
+			statusCode: failure.status,
+			...failure.reason ? { reason: failure.reason } : {}
+		};
+	}
+};
+function internalExtensions(error) {
+	return {
+		code: "INTERNAL_SERVER_ERROR",
+		reason: isConfigurationError(error) ? "AUTH_MISCONFIGURED" : "AUTH_UNAVAILABLE",
+		statusCode: 500
+	};
+}
+var BetterAuthGraphqlInternalError = class extends Error {
+	extensions;
+	constructor(error) {
+		super("Internal server error", { cause: error });
+		this.extensions = internalExtensions(error);
+	}
+};
+var BetterAuthGraphqlRepeatedInternalError = class extends IntrinsicException {
+	extensions;
+	constructor(error) {
+		super("Internal server error", { cause: error });
+		this.extensions = internalExtensions(error);
+	}
+};
+/** Keeps the upgrade request and its original browser headers across Mercurius operation spreads. */
+function mercuriusSubscriptionContext() {
+	return (_connection, request) => ({
+		[MERCURIUS_UPGRADE]: request,
+		[MERCURIUS_AMBIENT]: ambientHeaders(request)
+	});
+}
+function upgrade(value) {
+	const candidate = record(value);
+	return candidate && record(candidate.headers) ? candidate : void 0;
+}
+/** The WebSocket of a graphql-ws `extra` ({ socket, request }): a socket with function-typed send and close. */
+function graphqlWsSocket(value) {
+	const socket = record(record(value)?.socket);
+	return socket && typeof socket.send === "function" && typeof socket.close === "function" ? socket : void 0;
+}
+/**
+* The upgrade request of a graphql-ws `extra` ({ socket, request }) whose socket is a
+* WebSocket. Only the graphql-ws server creates that pair; parsed request data cannot carry
+* functions, so a client-sent header or field never selects the socket path. The socket's
+* state does not change this recognition: the transport classifies it once per operation
+* (GraphqlTransport.openAtStart).
+*/
+function graphqlWsUpgrade(value) {
+	return graphqlWsSocket(value) ? upgrade(record(value)?.request) : void 0;
+}
+/** WebSocket.OPEN of the `ws` sockets that Nest's graphql-ws server creates. */
+const WEBSOCKET_OPEN = 1;
+/** Upgrade-request headers that locate the server for Better Auth; none of them is a credential. */
+const HOST_METADATA = [
+	"host",
+	"x-forwarded-host",
+	"x-forwarded-proto"
+];
+/**
+* The upgrade request's URL without the target's query string and fragment. A query string can
+* carry a connection's credential (`?access_token=`), which an operation that reads no credential
+* of its connection must not expose to principal sources or policies.
+*/
+function upgradePathUrl(request) {
+	const target = request.url ?? "/";
+	const end = target.search(/[?#]/);
+	return upgradeRequestUrl({
+		headers: request.headers,
+		url: end === -1 ? target : target.slice(0, end),
+		secure: request.secure,
+		socket: request.socket
+	});
+}
+/** Copies the host metadata of `ambient` into `into` where `into` has none of its own. */
+function withHostMetadata(into, ambient) {
+	for (const name of HOST_METADATA) {
+		const value = ambient.get(name);
+		if (!into.has(name) && value !== null) into.set(name, value);
+	}
+	return into;
+}
+/**
+* The identity of one GraphQL execution, shared by every resolver of that execution. graphql-js
+* coerces the variable values into a fresh object for every execution, including one
+* subscription and its events; a parsed operation can be cached across executions, so it
+* serves only as the fallback.
+*/
+function executionOf(info) {
+	const value = record(info);
+	return record(value?.variableValues) ?? record(value?.operation);
+}
+function ambientHeaders(request) {
+	const value = record(request);
+	const rawHeaders = (record(value?.raw) ?? value)?.rawHeaders;
+	if (Array.isArray(rawHeaders)) {
+		const headers = new Headers();
+		for (let index = 0; index + 1 < rawHeaders.length; index += 2) if (typeof rawHeaders[index] === "string" && typeof rawHeaders[index + 1] === "string") headers.append(rawHeaders[index], rawHeaders[index + 1]);
+		return headers;
+	}
+	return toWebHeaders(value?.headers ?? {});
+}
+/**
+* Mercurius assigns the route's Fastify reply to context.reply for HTTP operations. Its
+* subscription contexts carry the platform-recognized upgrade request inside a plain reply
+* object instead, so the reply's identity, not the request alone, marks an HTTP operation.
+*/
+function platformReply(http, value) {
+	const request = record(value)?.request;
+	if (http?.isRequest(request) !== true) return false;
+	return http.responseFor ? http.responseFor(request) === value : true;
+}
+function carrierDetails(context, driver, http) {
+	const carrier = record(context) ?? {};
+	const req = record(carrier.req);
+	const extra = record(carrier.extra);
+	const httpRequest = driver === "apollo" ? http?.isRequest(req) === true || http?.isRequest(extra?.request) === true : platformReply(http, carrier.reply);
+	const wsContext = driver === "apollo" && !httpRequest && graphqlWsUpgrade(req?.extra) ? req : void 0;
+	const wsExtra = driver === "apollo" && !httpRequest ? wsContext ? wsContext.extra : extra : void 0;
+	const socket = httpRequest ? void 0 : driver === "apollo" ? graphqlWsUpgrade(wsExtra) : upgrade(carrier[MERCURIUS_UPGRADE]) ?? ("_connectionInit" in carrier ? upgrade(carrier.request) ?? upgrade(record(carrier.reply)?.request) ?? upgrade(carrier.req) : void 0);
+	const connection = wsContext ? req : carrier;
+	const params = record(wsContext ? req?.connectionParams : carrier.connectionParams ?? carrier._connectionInit);
+	const request = driver === "apollo" ? carrier.req : record(carrier.reply)?.request ?? carrier.req;
+	const ambient = () => carrier[MERCURIUS_AMBIENT] instanceof Headers ? new Headers(carrier[MERCURIUS_AMBIENT]) : ambientHeaders(socket);
+	return {
+		carrier,
+		socket,
+		webSocket: socket ? graphqlWsSocket(wsExtra) : void 0,
+		connection,
+		params,
+		request,
+		ambient
+	};
+}
+var GraphqlTransport = class {
+	id;
+	options;
+	requires = { hostlessCalls: false };
+	connectionTtlMs;
+	kit;
+	plans = [];
+	enhancerAdvice;
+	filterAdvice;
+	/** Whether each execution's graphql-ws socket was open when the execution first reached the transport. */
+	socketsAtStart = /* @__PURE__ */ new WeakMap();
+	constructor(id, options) {
+		this.id = id;
+		this.options = options;
+		this.connectionTtlMs = options.subscriptionPrincipalTtlMs ?? 0;
+		if (!Number.isFinite(this.connectionTtlMs) || this.connectionTtlMs < 0) throw new BetterAuthConfigurationError("INVALID_SUBSCRIPTION_TTL", "subscriptionPrincipalTtlMs must be a finite nonnegative number");
+	}
+	handles(context) {
+		return context.getType() === "graphql";
+	}
+	reference(context) {
+		return Reflect.getMetadata(RESOLVER_REFERENCE_METADATA, context.getHandler()) === true;
+	}
+	defaultAccessFor(target, method) {
+		const handler = Reflect.get(Reflect.get(target, "prototype") ?? target, method);
+		return typeof handler === "function" && !Reflect.getMetadata(RESOLVER_REFERENCE_METADATA, handler) && Reflect.getMetadata(RESOLVER_PROPERTY_METADATA, handler) ? "inherit" : void 0;
+	}
+	lineage(context) {
+		const args = context.getArgs();
+		const normalized = graphqlArgs(args);
+		this.openAtStart(carrierDetails(normalized.context, this.id, this.kit?.http ?? null).webSocket, normalized.info);
+		return {
+			...graphqlLineage(args, this.reference(context)),
+			assertReadable: (args) => {
+				if (this.kit) this.assertRequest(args, this.kit);
+			}
+		};
+	}
+	/**
+	* Whether the operation's graphql-ws socket was open when the operation started. The first
+	* classification of an execution holds for every later reader of it, so a connection that
+	* closes during authentication keeps its credentials. A socket that is not open when an
+	* operation starts belongs either to a connection that closed while graphql-ws prepared the
+	* operation or to an earlier connection that a cached context carries; its state cannot tell
+	* the two apart, so the operation reads no credential of that connection in either case.
+	*/
+	openAtStart(webSocket, info) {
+		if (!webSocket) return true;
+		const execution = executionOf(info);
+		const known = execution ? this.socketsAtStart.get(execution) : void 0;
+		if (known !== void 0) return known;
+		const open = webSocket.readyState === WEBSOCKET_OPEN;
+		if (execution) this.socketsAtStart.set(execution, open);
+		return open;
+	}
+	assertRequest(args, kit) {
+		const details = carrierDetails(graphqlArgs(args).context, this.id, kit.http);
+		if (details.socket) return details;
+		if (!kit.http?.isRequest(details.request)) throw BetterAuthConfigurationError.atRequest("GRAPHQL_CONTEXT_UNRECOGNIZED", "GraphQL context has no recognized platform or upgrade request", { hint: "Keep the native request at context.req or context.extra.request; use mercuriusSubscriptionContext() for Mercurius sockets." });
+		if (!kit.http.isLive(details.request)) throw BetterAuthConfigurationError.atRequest("GRAPHQL_CONTEXT_STALE_REQUEST", "GraphQL context contains a completed request", { hint: "Return a fresh context object for every operation and every graphql-ws connection." });
+		return details;
+	}
+	describe(context, kit) {
+		this.kit = kit;
+		const args = context.getArgs();
+		const normalized = graphqlArgs(args);
+		const initial = carrierDetails(normalized.context, this.id, kit.http);
+		const open = this.openAtStart(initial.webSocket, normalized.info);
+		const key = !initial.socket && kit.http?.isRequest(initial.request) ? kit.http.key(initial.request) : open ? normalized.context : executionOf(normalized.info) ?? args;
+		const checked = () => this.assertRequest(args, kit);
+		const headers = () => {
+			const details = checked();
+			if (!details.socket) return kit.http.headers(details.request);
+			const ambient = details.ambient();
+			if (!open) return withHostMetadata(new Headers(), ambient);
+			if (this.options.subscriptionCredentials) {
+				const input = this.options.subscriptionCredentials(details.connection);
+				let mapped;
+				try {
+					mapped = new Headers(input);
+				} catch {
+					throw AuthFailures.rejected({
+						status: 401,
+						reason: "MALFORMED_CREDENTIALS"
+					});
+				}
+				return withHostMetadata(mapped, ambient);
+			}
+			const credentials = new Headers(ambient);
+			const allow = new Set((this.options.connectionParamHeaders ?? ["authorization", "cookie"]).map((name) => name.toLowerCase()));
+			for (const [name, value] of Object.entries(details.params ?? {})) {
+				if (!allow.has(name.toLowerCase())) continue;
+				if (typeof value !== "string" || /[\r\n\0]/.test(value)) throw AuthFailures.rejected({
+					status: 401,
+					reason: "MALFORMED_CREDENTIALS"
+				});
+				try {
+					credentials.set(name, value);
+				} catch {
+					throw AuthFailures.rejected({
+						status: 401,
+						reason: "MALFORMED_CREDENTIALS"
+					});
+				}
+			}
+			return credentials;
+		};
+		return {
+			key,
+			invocation: graphqlInvocation(args, this.reference(context)),
+			lineage: this.lineage(context),
+			...initial.socket && open ? {
+				connection: initial.socket,
+				principalTtlMs: this.connectionTtlMs
+			} : {},
+			headers,
+			get clientIp() {
+				const details = checked();
+				return details.socket ? null : kit.http.clientIp(details.request);
+			},
+			get cookies() {
+				const details = checked();
+				return details.socket ? null : kit.http.cookieSink(details.request, details.carrier.reply ?? record(details.request)?.res ?? kit.http.responseFor?.(details.request));
+			},
+			get request() {
+				const details = checked();
+				if (!details.socket) return kit.http.request(details.request);
+				return {
+					method: "GET",
+					url: open ? upgradeRequestUrl(details.socket) : upgradePathUrl(details.socket)
+				};
+			},
+			param: (name) => (this.reference(context) ? normalized.root?.[name] : normalized.args?.[name]) ?? (!initial.socket && kit.http?.isRequest(initial.request) ? kit.http.param(initial.request, name) : void 0),
+			get browser() {
+				const details = checked();
+				return details.socket ? {
+					enforce: true,
+					headers: details.ambient,
+					url: upgradeRequestUrl(details.socket),
+					key: details.socket
+				} : {
+					enforce: normalized.info?.operation.operation === "mutation",
+					headers: () => kit.http.headers(details.request),
+					url: kit.http.request(details.request).url,
+					key
+				};
+			}
+		};
+	}
+	toException(failure) {
+		return new BetterAuthGraphqlDenial(failure);
+	}
+	toInternalException(error, _context, info) {
+		return info.repeated ? new BetterAuthGraphqlRepeatedInternalError(error) : new BetterAuthGraphqlInternalError(error);
+	}
+	validate(context) {
+		const options = context.moduleRef.get(GRAPHQL_MODULE_OPTIONS, { strict: false });
+		const names = [];
+		for (let driver = options.driver; typeof driver === "function"; driver = Object.getPrototypeOf(driver)) names.push(driver.name);
+		if (names.some((name) => name.startsWith(this.id === "apollo" ? "Mercurius" : "Apollo"))) throw new BetterAuthConfigurationError("GRAPHQL_DRIVER_MISMATCH", `${this.id} transport does not match ${names.join(" / ")}`);
+		if (options.context !== void 0 && typeof options.context !== "function") throw new BetterAuthConfigurationError("GRAPHQL_STATIC_CONTEXT", "GraphQL context must be a function returning a fresh object", "context: ({ req }) => ({ req, loaders: createLoaders() })");
+		class Probe {
+			query() {}
+			field() {}
+			reference() {}
+		}
+		for (const [name, decorator, key] of [
+			[
+				"query",
+				Query(() => String),
+				RESOLVER_TYPE_METADATA
+			],
+			[
+				"field",
+				ResolveField(() => String),
+				RESOLVER_PROPERTY_METADATA
+			],
+			[
+				"reference",
+				ResolveReference(),
+				RESOLVER_REFERENCE_METADATA
+			]
+		]) {
+			decorator(Probe.prototype, name, Object.getOwnPropertyDescriptor(Probe.prototype, name));
+			if (!Reflect.getMetadata(key, Probe.prototype[name])) throw new BetterAuthConfigurationError("NEST_METADATA_KEY_CHANGED", `GraphQL metadata canary failed: ${key}`);
+		}
+		Args("probe", { type: () => String })(Probe.prototype, "query", 0);
+		const argumentMetadata = record(Reflect.getMetadata(PARAM_ARGS_METADATA, Probe, "query"));
+		if (!argumentMetadata || !Object.entries(argumentMetadata).some(([key, value]) => key.startsWith("3:") && record(value)?.data === "probe")) throw new BetterAuthConfigurationError("NEST_METADATA_KEY_CHANGED", "GraphQL argument metadata failed its parameter canary");
+		const guards = options.fieldResolverEnhancers?.includes("guards") === true;
+		const scanner = new MetadataScanner();
+		this.plans = [];
+		for (const wrapper of context.discovery.getProviders()) {
+			const target = wrapper.metatype;
+			if (!target?.prototype || wrapper.isAlias) continue;
+			for (const method of scanner.getAllMethodNames(target.prototype)) {
+				const handler = Reflect.get(target.prototype, method);
+				const field = Reflect.getMetadata(RESOLVER_PROPERTY_METADATA, handler) === true;
+				const reference = Reflect.getMetadata(RESOLVER_REFERENCE_METADATA, handler) === true;
+				if (!field && !reference && !Reflect.getMetadata(RESOLVER_TYPE_METADATA, handler)) continue;
+				const metadata = record(Reflect.getMetadata(PARAM_ARGS_METADATA, target, method));
+				const inputs = reference ? [] : Object.entries(metadata ?? {}).flatMap(([key, entry]) => key.startsWith("3:") && typeof record(entry)?.data === "string" ? [String(record(entry).data)] : []);
+				context.claim(target, method, field || reference ? guards ? "global" : "none" : "global", {
+					code: reference ? "REFERENCE_RESOLVER_UNGUARDED" : field ? "FIELD_RESOLVER_UNGUARDED" : "GRAPHQL_OPERATION_UNGUARDED",
+					hint: "Set fieldResolverEnhancers: ['guards', 'interceptors'], or declare @Public() where appropriate.",
+					coverage: reference ? this.options.federationCoverage : field ? this.options.fieldResolverCoverage : "error",
+					everyHandler: reference,
+					inputs
+				});
+				this.plans.push({
+					plan: context.planOf(target, method),
+					field,
+					reference,
+					target,
+					method
+				});
+			}
+		}
+		const federation = names.some((name) => name.includes("Federation")) || this.plans.some((entry) => entry.reference);
+		const needsGuards = this.plans.some((entry) => entry.field || entry.reference);
+		if (federation && needsGuards && !guards && this.options.federationCoverage !== "off") {
+			const message = "Federation field and reference resolvers require fieldResolverEnhancers: ['guards', 'interceptors']; this runs every global guard once per field invocation.";
+			if (this.options.federationCoverage === "warn") context.logger.warn(`FEDERATION_FIELD_GUARDS_REQUIRED: ${message}`);
+			else throw new BetterAuthConfigurationError("FEDERATION_FIELD_GUARDS_REQUIRED", message);
+		}
+		if (needsGuards && !options.fieldResolverEnhancers?.includes("filters")) this.filterAdvice = {
+			level: "warn",
+			code: "W_FIELD_EXCEPTION_FILTERS_DISABLED",
+			message: "Nested GraphQL errors bypass Nest exception filters and ERROR logging while fieldResolverEnhancers omits filters.",
+			hint: "Include 'filters' with 'guards' in fieldResolverEnhancers to deliver nested authentication errors through Nest's exception pipeline; 'interceptors' enables per-field scopes."
+		};
+		if (needsGuards) {
+			const config = context.moduleRef.get(ApplicationConfig, { strict: false });
+			const owned = /* @__PURE__ */ new Set([context.moduleRef.get(BetterAuthGuard, { strict: false }), context.moduleRef.get(BetterAuthScopeInterceptor, { strict: false })]);
+			const names = [...config.getGlobalGuards(), ...config.getGlobalInterceptors()].filter((value) => !owned.has(value) && !["guard", "scope"].includes(Reflect.get(value, AUTH_ENHANCER))).map((value) => value.constructor.name);
+			if (names.length) this.enhancerAdvice = {
+				level: "warn",
+				code: "W_FIELD_GUARDS_MULTIPLY_GLOBAL_ENHANCERS",
+				message: `${names.join(", ")} run once per field-resolver invocation when their corresponding field enhancer is enabled: guards for global guards, interceptors for global interceptors.`,
+				hint: "Use @SkipThrottle() or equivalent, move global guards to controllers, or use coverage: 'warn' behind an authenticating router."
+			};
+		}
+	}
+	advise(context) {
+		const advice = [this.enhancerAdvice, this.filterAdvice].filter((value) => value !== void 0);
+		const entries = this.plans;
+		const publicEntries = entries.filter(({ plan, field }) => !field && ["public", "optional"].includes(plan.access));
+		const inheriting = entries.filter(({ plan }) => plan.access === "inherit");
+		if (publicEntries.length && inheriting.length) advice.push({
+			level: "warn",
+			code: "W_FIELD_RESOLVER_INHERITS",
+			message: `${inheriting.map(({ plan }) => plan.site).slice(0, 20).join(", ")} inherit readings from entry points including ${publicEntries.map(({ plan }) => plan.site).slice(0, 20).join(", ")}.`,
+			hint: "Use @RequireAuth() and fieldResolverEnhancers: ['guards'] for sensitive fields."
+		});
+		for (const { plan } of inheriting) if (plan.principalParams.some((param) => entries.some((entry) => [...entry.plan.accepts].some((kind) => kind !== param.kind)))) advice.push({
+			level: "warn",
+			code: "W_NESTED_PRINCIPAL_PARAM",
+			message: `${plan.site} can inherit a different principal kind from another schema entry point.`,
+			hint: "Use @CurrentPrincipal() and narrow p.kind, or declare field access and acceptance."
+		});
+		const targets = new Set(entries.filter(({ field }) => field).map(({ target }) => target));
+		for (const target of targets) if ([
+			ACCESS_METADATA,
+			ACCEPT_PRINCIPALS_METADATA,
+			REQUIREMENTS_METADATA
+		].some((key) => Reflect.hasMetadata(key, target))) advice.push({
+			level: "info",
+			code: "I_CLASS_METADATA_OPERATIONS_ONLY",
+			message: `Class metadata of ${target.name} excludes inherited fields ${entries.filter((entry) => entry.target === target && entry.plan.access === "inherit").map((entry) => entry.method).join(", ")}; it applies to operations and reference resolvers ${entries.filter((entry) => entry.target === target && entry.reference).map((entry) => entry.method).join(", ") || "(none)"}.`
+		});
+		if (!this.connectionTtlMs && context.sources.some((source) => source.effects?.consumesQuota || source.effects?.writes)) advice.push({
+			level: "warn",
+			code: "W_QUOTA_PER_MESSAGE",
+			message: "Each socket operation resolves quota-consuming or writing principal sources.",
+			hint: "Consider subscriptionPrincipalTtlMs and its revocation delay."
+		});
+		return advice;
+	}
+};
+function apolloTransport(options = {}) {
+	return new GraphqlTransport("apollo", options);
+}
+function mercuriusTransport(options = {}) {
+	return new GraphqlTransport("mercurius", options);
+}
+//#endregion
+export { BetterAuthGraphqlDenial, BetterAuthGraphqlInternalError, BetterAuthGraphqlRepeatedInternalError, apolloTransport, mercuriusSubscriptionContext, mercuriusTransport };
+
+//# sourceMappingURL=graphql.mjs.map