@nestjs-kit/better-auth 0.0.0-stage → 2.1.0

package/dist/organization.mjs

@@ -0,0 +1,177 @@
+import { n as BetterAuthConfigurationError } from "./auth-errors-C3rbTV9p.mjs";
+import { u as Require, v as defineInvocationParam } from "./auth-decorators-B1mFnGJ6.mjs";
+import { isAPIError } from "better-auth/api";
+//#region src/organization.ts
+const ACTIVE_ORGANIZATION_ID = Symbol.for("@nestjs-kit/better-auth:org:active-organization-id");
+const ACTIVE_MEMBER_ROLE = Symbol.for("@nestjs-kit/better-auth:org:active-member-role");
+const ActiveOrganizationId = defineInvocationParam(ACTIVE_ORGANIZATION_ID, { missing: "ORGANIZATION_REQUIRED" });
+const ActiveMemberRole = defineInvocationParam(ACTIVE_MEMBER_ROLE, { missing: "MEMBER_ROLE_REQUIRED" });
+const REF = Symbol.for("@nestjs-kit/better-auth:org:ref");
+function organizationRef(resolve, options = {}) {
+	return Object.assign((ctx) => resolve(ctx), options);
+}
+function activeOrganization() {
+	return Object.assign(organizationRef(async (ctx) => {
+		const value = ctx.principal.session.session?.activeOrganizationId;
+		if (value !== void 0) return value;
+		if (!await ctx.auth.hasPlugin("custom-session")) return;
+		try {
+			return (await ctx.memo(JSON.stringify(["org:activeMember"]), () => ctx.auth.run({
+				cookies: ctx.cookies,
+				inbound: () => ctx.headers,
+				internal: true
+			}, () => ctx.auth.api.getActiveMember({ headers: ctx.headers }))))?.organizationId;
+		} catch (error) {
+			if (isAPIError(error) && error.statusCode === 400 && (error.body?.code === "NO_ACTIVE_ORGANIZATION" || error.body?.code === "MEMBER_NOT_FOUND")) return;
+			throw error;
+		}
+	}, { missingReason: "NO_ACTIVE_ORGANIZATION" }), { [REF]: { kind: "active" } });
+}
+function fromParam(name) {
+	return Object.assign(organizationRef((ctx) => ctx.param(name)), { [REF]: {
+		kind: "param",
+		name
+	} });
+}
+function fromHeader(name) {
+	return organizationRef((ctx) => ctx.headers.get(name));
+}
+function requirements(expressions) {
+	return expressions.flatMap((expression) => "anyOf" in expression ? requirements(expression.anyOf) : "allOf" in expression ? requirements(expression.allOf) : [expression]);
+}
+function advise(ctx, policy) {
+	const advice = [];
+	for (const handler of ctx.handlers) for (const requirement of requirements(handler.plan.requirements)) {
+		if (requirement.policy !== policy) continue;
+		const marker = requirement.params.organization[REF];
+		if (marker?.kind === "active") {
+			const input = handler.inputs.find((name) => [
+				"orgId",
+				"organizationId",
+				"organization",
+				"orgSlug"
+			].includes(name));
+			if (input) advice.push({
+				level: "warn",
+				code: "W_ORG_PARAM_IGNORED",
+				message: `${handler.plan.site} checks the active organization but accepts ${input}.`,
+				hint: input === "orgSlug" ? "Map the slug to an ID with organizationRef and auth.api.listOrganizations({ headers })." : `Use fromParam('${input}').`
+			});
+		} else if (marker?.kind === "param" && !handler.inputs.includes(marker.name)) advice.push({
+			level: "warn",
+			code: "W_ORG_PARAM_MISSING",
+			message: `${handler.plan.site} reads ${marker.name}, absent from claimed inputs: ${handler.inputs.join(", ") || "none"}.`,
+			hint: "Use the correct input name, a method-level organizationRef, or SkipDefaultRequirements with a method-level requirement."
+		});
+	}
+	return advice;
+}
+const requires = {
+	plugins: ["organization"],
+	principals: ["session"],
+	presentsCredentials: true
+};
+const orgPermissionPolicy = {
+	id: "better-auth:organization/permission",
+	requires,
+	advise: (ctx) => advise(ctx, orgPermissionPolicy),
+	validate({ permissions }) {
+		if (!Object.keys(permissions).length || Object.values(permissions).some((actions) => !Array.isArray(actions) || !actions.length)) throw new BetterAuthConfigurationError("EMPTY_PERMISSIONS", "Organization permissions must contain a resource and actions.");
+	},
+	async evaluate({ permissions, organization }, context) {
+		const organizationId = await organization(context);
+		if (typeof organizationId !== "string" || !organizationId.trim()) return {
+			effect: "deny",
+			reason: organization.missingReason ?? "ORGANIZATION_REQUIRED"
+		};
+		const stable = Object.entries(permissions).sort(([a], [b]) => a.localeCompare(b)).map(([resource, actions]) => [resource, [...actions].sort()]);
+		try {
+			if (!(await context.memo(JSON.stringify([
+				"org:hasPermission",
+				organizationId,
+				stable
+			]), () => context.auth.run({
+				cookies: context.cookies,
+				inbound: () => context.headers,
+				internal: true
+			}, () => context.auth.api.hasPermission({
+				headers: context.headers,
+				body: {
+					organizationId,
+					permissions
+				}
+			})))).success) return {
+				effect: "deny",
+				reason: "MISSING_PERMISSION"
+			};
+			context.provide(ACTIVE_ORGANIZATION_ID, organizationId);
+			return { effect: "allow" };
+		} catch (error) {
+			if (isAPIError(error) && error.body?.code === "USER_IS_NOT_A_MEMBER_OF_THE_ORGANIZATION") return {
+				effect: "deny",
+				reason: "USER_IS_NOT_A_MEMBER_OF_THE_ORGANIZATION"
+			};
+			throw error;
+		}
+	}
+};
+const orgMemberPolicy = {
+	id: "better-auth:organization/member",
+	requires,
+	advise: (ctx) => advise(ctx, orgMemberPolicy),
+	async evaluate({ organization }, context) {
+		const organizationId = await organization(context);
+		if (typeof organizationId !== "string" || !organizationId.trim()) return {
+			effect: "deny",
+			reason: organization.missingReason ?? "ORGANIZATION_REQUIRED"
+		};
+		try {
+			const result = await context.memo(JSON.stringify(["org:activeMemberRole", organizationId]), () => context.auth.run({
+				cookies: context.cookies,
+				inbound: () => context.headers,
+				internal: true
+			}, () => context.auth.api.getActiveMemberRole({
+				headers: context.headers,
+				query: { organizationId }
+			})));
+			if (typeof result.role !== "string" || !result.role.trim()) return {
+				effect: "deny",
+				reason: "YOU_ARE_NOT_A_MEMBER_OF_THIS_ORGANIZATION"
+			};
+			context.provide(ACTIVE_ORGANIZATION_ID, organizationId);
+			context.provide(ACTIVE_MEMBER_ROLE, result.role);
+			return { effect: "allow" };
+		} catch (error) {
+			if (isAPIError(error) && error.body?.code === "YOU_ARE_NOT_A_MEMBER_OF_THIS_ORGANIZATION") return {
+				effect: "deny",
+				reason: "YOU_ARE_NOT_A_MEMBER_OF_THIS_ORGANIZATION"
+			};
+			throw error;
+		}
+	}
+};
+function orgPermission(permissions, options = {}) {
+	return {
+		policy: orgPermissionPolicy,
+		params: {
+			permissions,
+			organization: options.organization ?? activeOrganization()
+		}
+	};
+}
+function RequireOrgPermission(permissions, options) {
+	return Require(orgPermission(permissions, options));
+}
+function orgMember(options = {}) {
+	return {
+		policy: orgMemberPolicy,
+		params: { organization: options.organization ?? activeOrganization() }
+	};
+}
+function RequireOrgMember(options) {
+	return Require(orgMember(options));
+}
+//#endregion
+export { ACTIVE_MEMBER_ROLE, ACTIVE_ORGANIZATION_ID, ActiveMemberRole, ActiveOrganizationId, RequireOrgMember, RequireOrgPermission, activeOrganization, fromHeader, fromParam, orgMember, orgMemberPolicy, orgPermission, orgPermissionPolicy, organizationRef };
+
+//# sourceMappingURL=organization.mjs.map

package/dist/organization.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"organization.mjs","names":[],"sources":["../src/organization.ts"],"sourcesContent":["import { isAPIError } from \"better-auth/api\";\nimport type {\n  AuthorizationContext,\n  AuthorizationPolicy,\n  BootAdvice,\n  BootAdviceContext,\n  Requirement,\n  RequirementExpr,\n} from \"./auth-contracts.js\";\nimport { defineInvocationParam, Require } from \"./auth-decorators.js\";\nimport { BetterAuthConfigurationError } from \"./auth-errors.js\";\nimport type { OrgPermissions, SessionPrincipal } from \"./auth-types.js\";\nexport type { OrgPermissions } from \"./auth-types.js\";\nexport interface OrganizationRef {\n  (ctx: AuthorizationContext): unknown | Promise<unknown>;\n  readonly missingReason?: string;\n}\nexport interface OrgPermissionParams {\n  readonly permissions: OrgPermissions;\n  readonly organization: OrganizationRef;\n}\nexport interface OrgMemberParams {\n  readonly organization: OrganizationRef;\n}\nexport const ACTIVE_ORGANIZATION_ID = Symbol.for(\n  \"@nestjs-kit/better-auth:org:active-organization-id\",\n);\nexport const ACTIVE_MEMBER_ROLE = Symbol.for(\n  \"@nestjs-kit/better-auth:org:active-member-role\",\n);\nexport const ActiveOrganizationId = defineInvocationParam(\n  ACTIVE_ORGANIZATION_ID,\n  { missing: \"ORGANIZATION_REQUIRED\" },\n);\nexport const ActiveMemberRole = defineInvocationParam(ACTIVE_MEMBER_ROLE, {\n  missing: \"MEMBER_ROLE_REQUIRED\",\n});\nconst REF = Symbol.for(\"@nestjs-kit/better-auth:org:ref\");\ntype MarkedRef = OrganizationRef & {\n  readonly [REF]?: { kind: \"active\" } | { kind: \"param\"; name: string };\n};\ninterface OrgApi {\n  hasPermission(input: {\n    headers: Headers;\n    body: { organizationId: string; permissions: OrgPermissions };\n  }): Promise<{ success: boolean }>;\n  getActiveMemberRole(input: {\n    headers: Headers;\n    query: { organizationId: string };\n  }): Promise<{ role?: string | null }>;\n  getActiveMember(input: {\n    headers: Headers;\n  }): Promise<{ organizationId?: string }>;\n}\nexport function organizationRef(\n  resolve: (ctx: AuthorizationContext) => unknown | Promise<unknown>,\n  options: { missingReason?: string } = {},\n): OrganizationRef {\n  return Object.assign((ctx: AuthorizationContext) => resolve(ctx), options);\n}\nexport function activeOrganization(): OrganizationRef {\n  return Object.assign(\n    organizationRef(\n      async (ctx) => {\n        const session = (ctx.principal as SessionPrincipal).session as {\n          session?: { activeOrganizationId?: unknown };\n        };\n        const value = session.session?.activeOrganizationId;\n        if (value !== undefined) {\n          return value;\n        }\n        if (!(await ctx.auth.hasPlugin(\"custom-session\"))) {\n          return undefined;\n        }\n        try {\n          const member = await ctx.memo(\n            JSON.stringify([\"org:activeMember\"]),\n            () =>\n              ctx.auth.run(\n                {\n                  cookies: ctx.cookies,\n                  inbound: () => ctx.headers,\n                  internal: true,\n                },\n                () =>\n                  (ctx.auth.api as unknown as OrgApi).getActiveMember({\n                    headers: ctx.headers,\n                  }),\n              ),\n          );\n          return member?.organizationId;\n        } catch (error) {\n          if (\n            isAPIError(error) &&\n            error.statusCode === 400 &&\n            (error.body?.code === \"NO_ACTIVE_ORGANIZATION\" ||\n              error.body?.code === \"MEMBER_NOT_FOUND\")\n          ) {\n            return undefined;\n          }\n          throw error;\n        }\n      },\n      { missingReason: \"NO_ACTIVE_ORGANIZATION\" },\n    ),\n    { [REF]: { kind: \"active\" as const } },\n  );\n}\nexport function fromParam(name: string): OrganizationRef {\n  return Object.assign(\n    organizationRef((ctx) => ctx.param(name)),\n    { [REF]: { kind: \"param\" as const, name } },\n  );\n}\nexport function fromHeader(name: string): OrganizationRef {\n  return organizationRef((ctx) => ctx.headers.get(name));\n}\nfunction requirements(expressions: readonly RequirementExpr[]): Requirement[] {\n  return expressions.flatMap((expression) =>\n    \"anyOf\" in expression\n      ? requirements(expression.anyOf)\n      : \"allOf\" in expression\n        ? requirements(expression.allOf)\n        : [expression],\n  );\n}\nfunction advise(\n  ctx: BootAdviceContext,\n  policy: AuthorizationPolicy<any, any>,\n): BootAdvice[] {\n  const advice: BootAdvice[] = [];\n  for (const handler of ctx.handlers) {\n    for (const requirement of requirements(handler.plan.requirements)) {\n      if (requirement.policy !== policy) {\n        continue;\n      }\n      const ref = (requirement.params as OrgMemberParams)\n        .organization as MarkedRef;\n      const marker = ref[REF];\n      if (marker?.kind === \"active\") {\n        const input = handler.inputs.find((name) =>\n          [\"orgId\", \"organizationId\", \"organization\", \"orgSlug\"].includes(name),\n        );\n        if (input) {\n          advice.push({\n            level: \"warn\",\n            code: \"W_ORG_PARAM_IGNORED\",\n            message: `${handler.plan.site} checks the active organization but accepts ${input}.`,\n            hint:\n              input === \"orgSlug\"\n                ? \"Map the slug to an ID with organizationRef and auth.api.listOrganizations({ headers }).\"\n                : `Use fromParam('${input}').`,\n          });\n        }\n      } else if (\n        marker?.kind === \"param\" &&\n        !handler.inputs.includes(marker.name)\n      ) {\n        advice.push({\n          level: \"warn\",\n          code: \"W_ORG_PARAM_MISSING\",\n          message: `${handler.plan.site} reads ${marker.name}, absent from claimed inputs: ${handler.inputs.join(\", \") || \"none\"}.`,\n          hint: \"Use the correct input name, a method-level organizationRef, or SkipDefaultRequirements with a method-level requirement.\",\n        });\n      }\n    }\n  }\n  return advice;\n}\nconst requires = {\n  plugins: [\"organization\"],\n  principals: [\"session\" as const],\n  presentsCredentials: true,\n};\nexport const orgPermissionPolicy: AuthorizationPolicy<\n  OrgPermissionParams,\n  SessionPrincipal\n> = {\n  id: \"better-auth:organization/permission\", // gitleaks:allow: public policy identifier\n  requires,\n  advise: (ctx) => advise(ctx, orgPermissionPolicy),\n  validate({ permissions }) {\n    if (\n      !Object.keys(permissions).length ||\n      Object.values(permissions).some(\n        (actions) => !Array.isArray(actions) || !actions.length,\n      )\n    ) {\n      throw new BetterAuthConfigurationError(\n        \"EMPTY_PERMISSIONS\",\n        \"Organization permissions must contain a resource and actions.\",\n      );\n    }\n  },\n  async evaluate({ permissions, organization }, context) {\n    const organizationId = await organization(context);\n    if (typeof organizationId !== \"string\" || !organizationId.trim()) {\n      return {\n        effect: \"deny\",\n        reason: organization.missingReason ?? \"ORGANIZATION_REQUIRED\",\n      };\n    }\n    const stable = Object.entries(permissions)\n      .sort(([a], [b]) => a.localeCompare(b))\n      .map(([resource, actions]) => [resource, [...actions].sort()]);\n    try {\n      const result = await context.memo(\n        JSON.stringify([\"org:hasPermission\", organizationId, stable]),\n        () =>\n          context.auth.run(\n            {\n              cookies: context.cookies,\n              inbound: () => context.headers,\n              internal: true,\n            },\n            () =>\n              (context.auth.api as unknown as OrgApi).hasPermission({\n                headers: context.headers,\n                body: { organizationId, permissions },\n              }),\n          ),\n      );\n      if (!result.success) {\n        return { effect: \"deny\", reason: \"MISSING_PERMISSION\" };\n      }\n      context.provide(ACTIVE_ORGANIZATION_ID, organizationId);\n      return { effect: \"allow\" };\n    } catch (error) {\n      if (\n        isAPIError(error) &&\n        error.body?.code === \"USER_IS_NOT_A_MEMBER_OF_THE_ORGANIZATION\"\n      ) {\n        return {\n          effect: \"deny\",\n          reason: \"USER_IS_NOT_A_MEMBER_OF_THE_ORGANIZATION\",\n        };\n      }\n      throw error;\n    }\n  },\n};\nexport const orgMemberPolicy: AuthorizationPolicy<\n  OrgMemberParams,\n  SessionPrincipal\n> = {\n  id: \"better-auth:organization/member\",\n  requires,\n  advise: (ctx) => advise(ctx, orgMemberPolicy),\n  async evaluate({ organization }, context) {\n    const organizationId = await organization(context);\n    if (typeof organizationId !== \"string\" || !organizationId.trim()) {\n      return {\n        effect: \"deny\",\n        reason: organization.missingReason ?? \"ORGANIZATION_REQUIRED\",\n      };\n    }\n    try {\n      const result = await context.memo(\n        JSON.stringify([\"org:activeMemberRole\", organizationId]),\n        () =>\n          context.auth.run(\n            {\n              cookies: context.cookies,\n              inbound: () => context.headers,\n              internal: true,\n            },\n            () =>\n              (context.auth.api as unknown as OrgApi).getActiveMemberRole({\n                headers: context.headers,\n                query: { organizationId },\n              }),\n          ),\n      );\n      if (typeof result.role !== \"string\" || !result.role.trim()) {\n        return {\n          effect: \"deny\",\n          reason: \"YOU_ARE_NOT_A_MEMBER_OF_THIS_ORGANIZATION\",\n        };\n      }\n      context.provide(ACTIVE_ORGANIZATION_ID, organizationId);\n      context.provide(ACTIVE_MEMBER_ROLE, result.role);\n      return { effect: \"allow\" };\n    } catch (error) {\n      if (\n        isAPIError(error) &&\n        error.body?.code === \"YOU_ARE_NOT_A_MEMBER_OF_THIS_ORGANIZATION\"\n      ) {\n        return {\n          effect: \"deny\",\n          reason: \"YOU_ARE_NOT_A_MEMBER_OF_THIS_ORGANIZATION\",\n        };\n      }\n      throw error;\n    }\n  },\n};\nexport function orgPermission<N extends string = \"default\">(\n  permissions: OrgPermissions<N>,\n  options: { organization?: OrganizationRef } = {},\n): Requirement<OrgPermissionParams> {\n  return {\n    policy: orgPermissionPolicy,\n    params: {\n      permissions: permissions as OrgPermissions,\n      organization: options.organization ?? activeOrganization(),\n    },\n  };\n}\nexport function RequireOrgPermission<N extends string = \"default\">(\n  permissions: OrgPermissions<N>,\n  options?: { organization?: OrganizationRef },\n): ClassDecorator & MethodDecorator {\n  return Require(orgPermission<N>(permissions, options));\n}\nexport function orgMember(\n  options: { organization?: OrganizationRef } = {},\n): Requirement<OrgMemberParams> {\n  return {\n    policy: orgMemberPolicy,\n    params: { organization: options.organization ?? activeOrganization() },\n  };\n}\nexport function RequireOrgMember(options?: {\n  organization?: OrganizationRef;\n}): ClassDecorator & MethodDecorator {\n  return Require(orgMember(options));\n}\n"],"mappings":";;;;AAwBA,MAAa,yBAAyB,OAAO,IAC3C,oDACF;AACA,MAAa,qBAAqB,OAAO,IACvC,gDACF;AACA,MAAa,uBAAuB,sBAClC,wBACA,EAAE,SAAS,wBAAwB,CACrC;AACA,MAAa,mBAAmB,sBAAsB,oBAAoB,EACxE,SAAS,uBACX,CAAC;AACD,MAAM,MAAM,OAAO,IAAI,iCAAiC;AAiBxD,SAAgB,gBACd,SACA,UAAsC,CAAC,GACtB;CACjB,OAAO,OAAO,QAAQ,QAA8B,QAAQ,GAAG,GAAG,OAAO;AAC3E;AACA,SAAgB,qBAAsC;CACpD,OAAO,OAAO,OACZ,gBACE,OAAO,QAAQ;EAIb,MAAM,QAHW,IAAI,UAA+B,QAG9B,SAAS;EAC/B,IAAI,UAAU,KAAA,GACZ,OAAO;EAET,IAAI,CAAE,MAAM,IAAI,KAAK,UAAU,gBAAgB,GAC7C;EAEF,IAAI;GAgBF,QAAO,MAfc,IAAI,KACvB,KAAK,UAAU,CAAC,kBAAkB,CAAC,SAEjC,IAAI,KAAK,IACP;IACE,SAAS,IAAI;IACb,eAAe,IAAI;IACnB,UAAU;GACZ,SAEG,IAAI,KAAK,IAA0B,gBAAgB,EAClD,SAAS,IAAI,QACf,CAAC,CACL,CACJ,EAAA,EACe;EACjB,SAAS,OAAO;GACd,IACE,WAAW,KAAK,KAChB,MAAM,eAAe,QACpB,MAAM,MAAM,SAAS,4BACpB,MAAM,MAAM,SAAS,qBAEvB;GAEF,MAAM;EACR;CACF,GACA,EAAE,eAAe,yBAAyB,CAC5C,GACA,GAAG,MAAM,EAAE,MAAM,SAAkB,EAAE,CACvC;AACF;AACA,SAAgB,UAAU,MAA+B;CACvD,OAAO,OAAO,OACZ,iBAAiB,QAAQ,IAAI,MAAM,IAAI,CAAC,GACxC,GAAG,MAAM;EAAE,MAAM;EAAkB;CAAK,EAAE,CAC5C;AACF;AACA,SAAgB,WAAW,MAA+B;CACxD,OAAO,iBAAiB,QAAQ,IAAI,QAAQ,IAAI,IAAI,CAAC;AACvD;AACA,SAAS,aAAa,aAAwD;CAC5E,OAAO,YAAY,SAAS,eAC1B,WAAW,aACP,aAAa,WAAW,KAAK,IAC7B,WAAW,aACT,aAAa,WAAW,KAAK,IAC7B,CAAC,UAAU,CACnB;AACF;AACA,SAAS,OACP,KACA,QACc;CACd,MAAM,SAAuB,CAAC;CAC9B,KAAK,MAAM,WAAW,IAAI,UACxB,KAAK,MAAM,eAAe,aAAa,QAAQ,KAAK,YAAY,GAAG;EACjE,IAAI,YAAY,WAAW,QACzB;EAIF,MAAM,SAFO,YAAY,OACtB,aACgB;EACnB,IAAI,QAAQ,SAAS,UAAU;GAC7B,MAAM,QAAQ,QAAQ,OAAO,MAAM,SACjC;IAAC;IAAS;IAAkB;IAAgB;GAAS,CAAC,CAAC,SAAS,IAAI,CACtE;GACA,IAAI,OACF,OAAO,KAAK;IACV,OAAO;IACP,MAAM;IACN,SAAS,GAAG,QAAQ,KAAK,KAAK,8CAA8C,MAAM;IAClF,MACE,UAAU,YACN,4FACA,kBAAkB,MAAM;GAChC,CAAC;EAEL,OAAO,IACL,QAAQ,SAAS,WACjB,CAAC,QAAQ,OAAO,SAAS,OAAO,IAAI,GAEpC,OAAO,KAAK;GACV,OAAO;GACP,MAAM;GACN,SAAS,GAAG,QAAQ,KAAK,KAAK,SAAS,OAAO,KAAK,gCAAgC,QAAQ,OAAO,KAAK,IAAI,KAAK,OAAO;GACvH,MAAM;EACR,CAAC;CAEL;CAEF,OAAO;AACT;AACA,MAAM,WAAW;CACf,SAAS,CAAC,cAAc;CACxB,YAAY,CAAC,SAAkB;CAC/B,qBAAqB;AACvB;AACA,MAAa,sBAGT;CACF,IAAI;CACJ;CACA,SAAS,QAAQ,OAAO,KAAK,mBAAmB;CAChD,SAAS,EAAE,eAAe;EACxB,IACE,CAAC,OAAO,KAAK,WAAW,CAAC,CAAC,UAC1B,OAAO,OAAO,WAAW,CAAC,CAAC,MACxB,YAAY,CAAC,MAAM,QAAQ,OAAO,KAAK,CAAC,QAAQ,MACnD,GAEA,MAAM,IAAI,6BACR,qBACA,+DACF;CAEJ;CACA,MAAM,SAAS,EAAE,aAAa,gBAAgB,SAAS;EACrD,MAAM,iBAAiB,MAAM,aAAa,OAAO;EACjD,IAAI,OAAO,mBAAmB,YAAY,CAAC,eAAe,KAAK,GAC7D,OAAO;GACL,QAAQ;GACR,QAAQ,aAAa,iBAAiB;EACxC;EAEF,MAAM,SAAS,OAAO,QAAQ,WAAW,CAAC,CACvC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,CACtC,KAAK,CAAC,UAAU,aAAa,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC;EAC/D,IAAI;GAiBF,IAAI,EAAC,MAhBgB,QAAQ,KAC3B,KAAK,UAAU;IAAC;IAAqB;IAAgB;GAAM,CAAC,SAE1D,QAAQ,KAAK,IACX;IACE,SAAS,QAAQ;IACjB,eAAe,QAAQ;IACvB,UAAU;GACZ,SAEG,QAAQ,KAAK,IAA0B,cAAc;IACpD,SAAS,QAAQ;IACjB,MAAM;KAAE;KAAgB;IAAY;GACtC,CAAC,CACL,CACJ,EAAA,CACY,SACV,OAAO;IAAE,QAAQ;IAAQ,QAAQ;GAAqB;GAExD,QAAQ,QAAQ,wBAAwB,cAAc;GACtD,OAAO,EAAE,QAAQ,QAAQ;EAC3B,SAAS,OAAO;GACd,IACE,WAAW,KAAK,KAChB,MAAM,MAAM,SAAS,4CAErB,OAAO;IACL,QAAQ;IACR,QAAQ;GACV;GAEF,MAAM;EACR;CACF;AACF;AACA,MAAa,kBAGT;CACF,IAAI;CACJ;CACA,SAAS,QAAQ,OAAO,KAAK,eAAe;CAC5C,MAAM,SAAS,EAAE,gBAAgB,SAAS;EACxC,MAAM,iBAAiB,MAAM,aAAa,OAAO;EACjD,IAAI,OAAO,mBAAmB,YAAY,CAAC,eAAe,KAAK,GAC7D,OAAO;GACL,QAAQ;GACR,QAAQ,aAAa,iBAAiB;EACxC;EAEF,IAAI;GACF,MAAM,SAAS,MAAM,QAAQ,KAC3B,KAAK,UAAU,CAAC,wBAAwB,cAAc,CAAC,SAErD,QAAQ,KAAK,IACX;IACE,SAAS,QAAQ;IACjB,eAAe,QAAQ;IACvB,UAAU;GACZ,SAEG,QAAQ,KAAK,IAA0B,oBAAoB;IAC1D,SAAS,QAAQ;IACjB,OAAO,EAAE,eAAe;GAC1B,CAAC,CACL,CACJ;GACA,IAAI,OAAO,OAAO,SAAS,YAAY,CAAC,OAAO,KAAK,KAAK,GACvD,OAAO;IACL,QAAQ;IACR,QAAQ;GACV;GAEF,QAAQ,QAAQ,wBAAwB,cAAc;GACtD,QAAQ,QAAQ,oBAAoB,OAAO,IAAI;GAC/C,OAAO,EAAE,QAAQ,QAAQ;EAC3B,SAAS,OAAO;GACd,IACE,WAAW,KAAK,KAChB,MAAM,MAAM,SAAS,6CAErB,OAAO;IACL,QAAQ;IACR,QAAQ;GACV;GAEF,MAAM;EACR;CACF;AACF;AACA,SAAgB,cACd,aACA,UAA8C,CAAC,GACb;CAClC,OAAO;EACL,QAAQ;EACR,QAAQ;GACO;GACb,cAAc,QAAQ,gBAAgB,mBAAmB;EAC3D;CACF;AACF;AACA,SAAgB,qBACd,aACA,SACkC;CAClC,OAAO,QAAQ,cAAiB,aAAa,OAAO,CAAC;AACvD;AACA,SAAgB,UACd,UAA8C,CAAC,GACjB;CAC9B,OAAO;EACL,QAAQ;EACR,QAAQ,EAAE,cAAc,QAAQ,gBAAgB,mBAAmB,EAAE;CACvE;AACF;AACA,SAAgB,iBAAiB,SAEI;CACnC,OAAO,QAAQ,UAAU,OAAO,CAAC;AACnC"}

package/dist/platform-CZl7TY8j.mjs

@@ -0,0 +1,414 @@
+import { AsyncResource } from "node:async_hooks";
+//#region src/set-cookies.ts
+/** Set-Cookie line handling shared by the built-in platforms' cookie sinks. */
+function cookieName(line) {
+	const separator = line.indexOf("=");
+	return (separator === -1 ? line : line.slice(0, separator)).trim();
+}
+/** A header value as the list of lines it holds. */
+function headerLines(value) {
+	return Array.isArray(value) ? value.map(String) : value === void 0 ? [] : [String(value)];
+}
+/**
+* The lines of `values` to append after `existing`. A line identical to the latest line already set for its cookie name
+* changes nothing and is skipped (ADR-09: the kernel's cookie sink de-duplicates identical Set-Cookie values, for example
+* a source that appends a call's cookies that the bridge also forwarded). Any other line is kept, so an identical line
+* after a different one for the same cookie still restores it.
+*/
+function setCookieAdditions(existing, values) {
+	const latest = /* @__PURE__ */ new Map();
+	for (const line of existing) latest.set(cookieName(line), line);
+	const additions = [];
+	for (const line of values) {
+		const name = cookieName(line);
+		if (latest.get(name) === line) continue;
+		latest.set(name, line);
+		additions.push(line);
+	}
+	return additions;
+}
+//#endregion
+//#region src/platform.ts
+function appendHeaderValue(headers, name, value) {
+	if (typeof value === "string") {
+		headers.append(name, value);
+		return;
+	}
+	if (Array.isArray(value)) {
+		for (const item of value) if (typeof item === "string") headers.append(name, item);
+	}
+}
+/** Convert Node headers to Web headers without exposing HTTP/2 metadata. */
+function toWebHeaders(raw) {
+	const headers = new Headers();
+	let authority;
+	for (const [name, value] of Object.entries(raw)) {
+		if (name === ":authority") authority = value;
+		if (name.startsWith(":")) continue;
+		appendHeaderValue(headers, name, value);
+	}
+	if (!headers.has("host")) appendHeaderValue(headers, "host", authority);
+	return headers;
+}
+/** Determine whether Node request framing permits a request body. */
+function mayHaveBody(method, headers) {
+	const normalizedMethod = method.toUpperCase();
+	if (normalizedMethod === "GET" || normalizedMethod === "HEAD") return false;
+	if (headers["transfer-encoding"] !== void 0) return true;
+	const declaredLength = headers["content-length"]?.trim();
+	return declaredLength !== void 0 && /^\d+$/.test(declaredLength) && BigInt(declaredLength) > 0n;
+}
+function assertByteLimit(value, name) {
+	if (!Number.isSafeInteger(value) || value < 0) throw new RangeError(`${name} must be a non-negative safe integer`);
+}
+function joinBytes(chunks, length) {
+	const bytes = new Uint8Array(length);
+	let offset = 0;
+	for (const chunk of chunks) {
+		bytes.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return bytes;
+}
+async function readBoundedWebBody(stream, options) {
+	const reader = stream.getReader();
+	const chunks = [];
+	let length = 0;
+	try {
+		if (options.declaredLength !== void 0 && options.declaredLength > options.limit) {
+			await reader.cancel().catch(() => void 0);
+			return {
+				ok: false,
+				reason: "too-large"
+			};
+		}
+		while (true) {
+			const next = await reader.read();
+			if (next.done) return {
+				ok: true,
+				bytes: joinBytes(chunks, length)
+			};
+			length += next.value.byteLength;
+			if (length > options.limit) {
+				await reader.cancel().catch(() => void 0);
+				return {
+					ok: false,
+					reason: "too-large"
+				};
+			}
+			chunks.push(next.value);
+		}
+	} catch {
+		await reader.cancel().catch(() => void 0);
+		return {
+			ok: false,
+			reason: "aborted"
+		};
+	} finally {
+		reader.releaseLock();
+	}
+}
+function nodeChunkBytes(chunk) {
+	if (typeof chunk === "string") return Buffer.from(chunk);
+	if (chunk instanceof Uint8Array) return chunk;
+	return null;
+}
+function readBoundedNodeBody(stream, options) {
+	const drainCap = options.drainCap ?? options.limit * 8;
+	assertByteLimit(drainCap, "drainCap");
+	return new Promise((resolve) => {
+		const chunks = [];
+		let length = 0;
+		let overflow = options.declaredLength !== void 0 && options.declaredLength > options.limit;
+		let settled = false;
+		const cleanup = () => {
+			stream.removeListener("data", onData);
+			stream.removeListener("end", onEnd);
+			stream.removeListener("aborted", onAborted);
+			stream.removeListener("error", onAborted);
+			stream.removeListener("close", onClose);
+		};
+		const destroy = () => {
+			if (!stream.destroyed) {
+				const absorbDestroyError = () => void 0;
+				const removeDestroyErrorHandler = () => {
+					stream.removeListener("error", absorbDestroyError);
+				};
+				stream.once("error", absorbDestroyError);
+				stream.once("close", removeDestroyErrorHandler);
+				try {
+					stream.destroy?.();
+				} catch {
+					stream.removeListener("error", absorbDestroyError);
+					stream.removeListener("close", removeDestroyErrorHandler);
+				}
+			}
+		};
+		const finish = (result, destroyStream = false) => {
+			if (settled) return;
+			settled = true;
+			cleanup();
+			resolve(result);
+			if (destroyStream) destroy();
+		};
+		const tooLarge = () => {
+			finish({
+				ok: false,
+				reason: "too-large"
+			}, true);
+		};
+		const onData = (chunk) => {
+			const bytes = nodeChunkBytes(chunk);
+			if (bytes === null) {
+				finish({
+					ok: false,
+					reason: "aborted"
+				}, true);
+				return;
+			}
+			length += bytes.byteLength;
+			if (!overflow && length <= options.limit) {
+				chunks.push(bytes);
+				return;
+			}
+			overflow = true;
+			chunks.length = 0;
+			if (!options.drainOnOverflow || length > drainCap) tooLarge();
+		};
+		const onEnd = () => {
+			if (overflow) {
+				finish({
+					ok: false,
+					reason: "too-large"
+				});
+				return;
+			}
+			finish({
+				ok: true,
+				bytes: joinBytes(chunks, length)
+			});
+		};
+		const onAborted = () => {
+			finish({
+				ok: false,
+				reason: "aborted"
+			}, true);
+		};
+		const onClose = () => {
+			finish({
+				ok: false,
+				reason: "aborted"
+			});
+		};
+		stream.once("end", onEnd);
+		stream.once("aborted", onAborted);
+		stream.once("error", onAborted);
+		stream.once("close", onClose);
+		if (overflow && !options.drainOnOverflow) {
+			tooLarge();
+			return;
+		}
+		if (overflow && options.declaredLength !== void 0 && options.declaredLength > drainCap) {
+			tooLarge();
+			return;
+		}
+		stream.on("data", onData);
+	});
+}
+/** Read a Node or Web body stream without retaining bytes past the limit. */
+function readBoundedBody(stream, options) {
+	assertByteLimit(options.limit, "limit");
+	if (options.declaredLength !== void 0 && (!Number.isSafeInteger(options.declaredLength) || options.declaredLength < 0)) throw new RangeError("declaredLength must be a non-negative safe integer");
+	if ("getReader" in stream) return readBoundedWebBody(stream, options);
+	return readBoundedNodeBody(stream, options);
+}
+/** Append response cookies without replacing values already set by the host. */
+function appendSetCookie(res, values) {
+	if (res.headersSent) return false;
+	const existing = headerLines(res.getHeader("set-cookie"));
+	const additions = setCookieAdditions(existing, values);
+	if (additions.length > 0) res.setHeader("set-cookie", [...existing, ...additions]);
+	return true;
+}
+function varyValues(value) {
+	return (Array.isArray(value) ? value : value === void 0 ? [] : [value]).flatMap((item) => String(item).split(","));
+}
+function mergeVary(current, added) {
+	const values = [...varyValues(current), ...varyValues(added)].map((value) => value.trim()).filter(Boolean);
+	if (values.includes("*")) return "*";
+	const seen = /* @__PURE__ */ new Set();
+	return values.filter((value) => {
+		const normalized = value.toLowerCase();
+		if (seen.has(normalized)) return false;
+		seen.add(normalized);
+		return true;
+	}).join(", ");
+}
+function endServerResponse(res) {
+	if (res.writableEnded) return Promise.resolve();
+	return new Promise((resolve, reject) => {
+		let settled = false;
+		const cleanup = () => {
+			res.removeListener("error", onError);
+			res.removeListener("close", onClose);
+		};
+		const finish = (error) => {
+			if (settled) return;
+			settled = true;
+			cleanup();
+			if (error) reject(error);
+			else resolve();
+		};
+		const onError = (error) => {
+			finish(error);
+		};
+		const onClose = () => {
+			finish();
+		};
+		res.once("error", onError);
+		res.once("close", onClose);
+		res.end(() => finish());
+	});
+}
+function waitForDrainOrStop(res, stopped) {
+	return new Promise((resolve) => {
+		let settled = false;
+		const finish = () => {
+			if (settled) return;
+			settled = true;
+			res.removeListener("drain", finish);
+			resolve();
+		};
+		res.once("drain", finish);
+		stopped.then(finish);
+	});
+}
+/** Write a Web response while retaining host headers and Node backpressure. */
+async function writeWebResponse(res, response, options) {
+	res.statusCode = response.status;
+	for (const [name, value] of response.headers) {
+		if (name === "set-cookie") continue;
+		if (name === "vary") res.setHeader("vary", mergeVary(res.getHeader("vary"), value));
+		else res.setHeader(name, value);
+	}
+	appendSetCookie(res, response.headers.getSetCookie());
+	if (options?.head || response.body === null) {
+		if (options?.head && response.body !== null) await response.body.cancel().catch(() => void 0);
+		await endServerResponse(res);
+		return;
+	}
+	const reader = response.body.getReader();
+	let stopped = false;
+	let writeError;
+	let stop;
+	const stoppedPromise = new Promise((resolve) => {
+		stop = resolve;
+	});
+	const onClose = () => {
+		stopped = true;
+		stop();
+		reader.cancel().catch(() => void 0);
+	};
+	const onError = (error) => {
+		writeError = error;
+		stopped = true;
+		stop();
+		reader.cancel(error).catch(() => void 0);
+	};
+	res.once("close", onClose);
+	res.once("error", onError);
+	try {
+		while (!stopped) {
+			const read = reader.read().then((value) => ({
+				type: "read",
+				value
+			}), (error) => ({
+				type: "read-error",
+				error
+			}));
+			const outcome = await Promise.race([read, stoppedPromise.then(() => ({ type: "stopped" }))]);
+			if (outcome.type === "stopped") break;
+			if (outcome.type === "read-error") throw outcome.error;
+			if (outcome.value.done) break;
+			if (!res.write(outcome.value.value)) await waitForDrainOrStop(res, stoppedPromise);
+		}
+	} catch (error) {
+		await reader.cancel(error).catch(() => void 0);
+		throw error;
+	} finally {
+		res.removeListener("close", onClose);
+		res.removeListener("error", onError);
+		reader.releaseLock();
+	}
+	if (writeError) throw writeError;
+	if (!stopped) await endServerResponse(res);
+}
+/** Capture the active async resource for a later stream continuation. */
+function bindAsyncContext(fn) {
+	return AsyncResource.bind(fn);
+}
+function contentTypeOf(req) {
+	const raw = req.headers["content-type"];
+	return (Array.isArray(raw) ? raw[0] : raw)?.split(";", 1)[0]?.trim().toLowerCase() ?? "";
+}
+function serializeFormBody(body) {
+	if (typeof body === "string" || body instanceof URLSearchParams) return new URLSearchParams(body).toString();
+	if (body === null || typeof body !== "object" || Array.isArray(body)) return null;
+	const parameters = new URLSearchParams();
+	for (const [name, value] of Object.entries(body)) if (Array.isArray(value)) for (const item of value) parameters.append(name, String(item));
+	else parameters.append(name, String(value));
+	return parameters.toString();
+}
+/** Recover bytes after an earlier host parser consumed the request stream. */
+function recoverConsumedBody(req) {
+	if (Buffer.isBuffer(req.rawBody)) return Uint8Array.from(req.rawBody);
+	const contentType = contentTypeOf(req);
+	try {
+		if (contentType === "application/json" || contentType.endsWith("+json")) {
+			const serialized = JSON.stringify(req.body);
+			return serialized === void 0 ? null : new TextEncoder().encode(serialized);
+		}
+		if (contentType === "application/x-www-form-urlencoded") {
+			const serialized = serializeFormBody(req.body);
+			return serialized === null ? null : new TextEncoder().encode(serialized);
+		}
+	} catch {
+		return null;
+	}
+	return null;
+}
+function hostHeader(headers) {
+	if (headers instanceof Headers) return headers.get("host");
+	for (const [name, value] of Object.entries(headers)) {
+		if (name.toLowerCase() !== "host") continue;
+		if (typeof value === "string") return value;
+		if (Array.isArray(value) && typeof value[0] === "string") return value[0];
+	}
+	return null;
+}
+/** Build an upgrade URL from socket TLS state, Host, and the raw target. */
+function upgradeRequestUrl(request) {
+	const scheme = request.secure || request.socket?.encrypted ? "https" : "http";
+	const host = hostHeader(request.headers);
+	if (host === null || host.length === 0 || [...host].some((character) => {
+		const code = character.charCodeAt(0);
+		return code <= 32 || code === 127 || "/\\?#@".includes(character);
+	})) throw new TypeError("A valid Host header is required for an upgrade URL");
+	let origin;
+	try {
+		origin = new URL(`${scheme}://${host}`);
+	} catch {
+		throw new TypeError("A valid Host header is required for an upgrade URL");
+	}
+	if (origin.username !== "" || origin.password !== "" || origin.pathname !== "/" || origin.search !== "" || origin.hash !== "" || origin.host === "") throw new TypeError("A valid Host header is required for an upgrade URL");
+	const target = request.url ?? "/";
+	if ([...target].some((character) => {
+		const code = character.charCodeAt(0);
+		return code <= 32 || code === 127 || character === "#";
+	})) throw new TypeError("A valid request target is required for an upgrade URL");
+	return `${scheme}://${host}${target.startsWith("/") ? target : `/${target}`}`;
+}
+//#endregion
+export { recoverConsumedBody as a, writeWebResponse as c, readBoundedBody as i, headerLines as l, bindAsyncContext as n, toWebHeaders as o, mayHaveBody as r, upgradeRequestUrl as s, appendSetCookie as t, setCookieAdditions as u };
+
+//# sourceMappingURL=platform-CZl7TY8j.mjs.map