@nestjs-kit/better-auth 0.0.0-stage → 2.1.0

package/dist/testing.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"testing.mjs","names":[],"sources":["../src/testing.ts"],"sourcesContent":["import type {\n  CanActivate,\n  ExecutionContext,\n  INestApplication,\n} from \"@nestjs/common\";\nimport type { TestingModuleBuilder } from \"@nestjs/testing\";\nimport { isObservable, lastValueFrom } from \"rxjs\";\nimport type {\n  AuthorizationDecision,\n  PolicyInvoker,\n  PrincipalRequest,\n  PrincipalResolver,\n  PrincipalResult,\n  PrincipalSource,\n  TransportCall,\n} from \"./auth-contracts.js\";\nimport { BetterAuthConfigurationError } from \"./auth-errors.js\";\nimport { ScopeCore } from \"./auth-scope-interceptor.js\";\nimport {\n  GUARD_CORE,\n  INSTANCE_REGISTRY,\n  POLICY_INVOKER,\n  PRINCIPAL_RESOLVER,\n  REQUEST_SCOPE,\n  ROUTE_PLANNER,\n  SCOPE_CORE,\n  TRANSPORT_REGISTRY,\n} from \"./auth-tokens.js\";\nimport type { AuthLike, AuthPrincipal } from \"./auth-types.js\";\nimport { BRIDGE_HANDLE, type BridgeHandle } from \"./bridge-protocol.js\";\nimport type { InstanceRegistry } from \"./instance-registry.js\";\nimport {\n  PrincipalReadings,\n  stampedReading,\n  stampResult,\n  type ReadingInput,\n} from \"./principal-readings.js\";\nimport {\n  absent,\n  authenticated,\n  ChainPrincipalResolver,\n} from \"./principal-resolver.js\";\nimport type { RequestScope } from \"./request-scope.js\";\nimport type { RoutePlanner } from \"./route-planner.js\";\nimport type { TransportRegistry } from \"./transport-registry.js\";\n\nconst TEST_APP = Symbol.for(\"@nestjs-kit/better-auth:test-app\");\nconst TEST_APP_CLOSE = Symbol.for(\"@nestjs-kit/better-auth:test-app-close\");\nconst TEST_OVERRIDES = Symbol.for(\"@nestjs-kit/better-auth:test-overrides\");\nconst PLUGIN_ID = \"@nestjs-kit/better-auth\";\nconst TEST_PRINCIPAL_SOURCE = \"@nestjs-kit/better-auth:test-principal\";\n\ntype FixedPrincipal =\n  | AuthPrincipal\n  | null\n  | ((call: TransportCall) => AuthPrincipal | null);\ntype Decide = (\n  policyId: string,\n  params: unknown,\n  principal: AuthPrincipal,\n) =>\n  | AuthorizationDecision\n  | undefined\n  | Promise<AuthorizationDecision | undefined>;\n\ninterface TestOverrides {\n  readonly principals: Map<string, FixedPrincipal>;\n  readonly deciders: Decide[];\n}\n\n/**\n * TestingModuleBuilder keys overrides by token, so repeated helper calls share one provider and its configuration.\n * The configuration lives on the builder under a global symbol, so the ESM and CommonJS copies of this entry compose.\n */\nfunction overridesOf(builder: TestingModuleBuilder): TestOverrides {\n  let overrides = Reflect.get(builder, TEST_OVERRIDES) as\n    | TestOverrides\n    | undefined;\n  if (!overrides) {\n    overrides = { principals: new Map(), deciders: [] };\n    Object.defineProperty(builder, TEST_OVERRIDES, { value: overrides });\n  }\n  return overrides;\n}\n\n/** Make app.close() run Nest's shutdown once, whoever calls it: initTestApp, a registered hook or the test. */\nfunction closeOnce(app: INestApplication): () => Promise<void> {\n  const existing = Reflect.get(app, TEST_APP_CLOSE) as\n    | (() => Promise<void>)\n    | undefined;\n  if (existing) {\n    return existing;\n  }\n  const close = app.close.bind(app);\n  let pending: Promise<void> | undefined;\n  const once = () => {\n    pending ??= close();\n    return pending;\n  };\n  Object.defineProperty(app, TEST_APP_CLOSE, { value: once });\n  app.close = once;\n  return once;\n}\n\nasync function bridgeOf(auth: AuthLike): Promise<BridgeHandle | undefined> {\n  const context = (await auth.$context) as {\n    getPlugin?(id: string): unknown;\n  };\n  const plugin = context.getPlugin?.(PLUGIN_ID);\n  return plugin && typeof plugin === \"object\"\n    ? (Reflect.get(plugin, BRIDGE_HANDLE) as BridgeHandle | undefined)\n    : undefined;\n}\n\nfunction registryOf(app: INestApplication): InstanceRegistry | undefined {\n  try {\n    return app.get<InstanceRegistry>(INSTANCE_REGISTRY, { strict: false });\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * init() plus Fastify ready() when the adapter exposes it. Before init, closes the previous application that\n * initTestApp initialized for the same Better Auth instance and that is still bound to it: an instance binds\n * exclusively to one application (B06). A failed init() leaves its binding for the next application, which takes it\n * over with W_INSTANCE_TAKEN_OVER. app.close() becomes idempotent, and `closeWith` receives it: a per-test cleanup such as\n * Vitest's onTestFinished or node:test's t.after, or a list that a suite-level afterEach drains (Jest registers no hooks\n * while a test runs). Without `closeWith`, close the last application yourself. On Express, compile one TestingModule per application: a\n * second application of one container fails init() with APP_ADAPTER_CHANGED.\n */\nexport async function initTestApp<T extends INestApplication>(\n  app: T,\n  options: { closeWith?: (close: () => Promise<void>) => void } = {},\n): Promise<T> {\n  const close = closeOnce(app);\n  const bridges: BridgeHandle[] = [];\n  for (const registration of registryOf(app)?.registrations() ?? []) {\n    const bridge = registration.instance\n      ? await bridgeOf(registration.instance)\n      : undefined;\n    if (!bridge) {\n      continue;\n    }\n    const previous = Reflect.get(bridge, TEST_APP) as\n      | INestApplication\n      | undefined;\n    if (previous && previous !== app && bridge.state === \"bound\") {\n      // initTestApp made previous.close() idempotent, so a registered close of the same app does nothing later.\n      await previous.close();\n    }\n    Object.defineProperty(bridge, TEST_APP, {\n      value: undefined,\n      configurable: true,\n      writable: true,\n    });\n    bridges.push(bridge);\n  }\n  await app.init();\n  const server = (\n    app.getHttpAdapter?.() as { getInstance?(): unknown } | undefined\n  )?.getInstance?.() as { ready?: () => unknown } | undefined;\n  if (typeof server?.ready === \"function\") {\n    await server.ready();\n  }\n  for (const bridge of bridges) {\n    Object.defineProperty(bridge, TEST_APP, {\n      value: app,\n      configurable: true,\n      writable: true,\n    });\n  }\n  options.closeWith?.(close);\n  return app;\n}\n\n/** Real session headers for `userId` through Better Auth's testUtils() plugin, which the instance must include. */\nexport async function authHeadersFor(\n  auth: AuthLike,\n  userId: string,\n): Promise<Headers> {\n  const context = (await auth.$context) as {\n    test?: { getAuthHeaders?(options: { userId: string }): Promise<Headers> };\n  };\n  if (typeof context.test?.getAuthHeaders !== \"function\") {\n    throw new BetterAuthConfigurationError(\n      \"TEST_UTILS_MISSING\",\n      \"authHeadersFor requires Better Auth's testUtils() plugin on the instance.\",\n      \"Add testUtils() from better-auth/plugins to the test instance.\",\n    );\n  }\n  return context.test.getAuthHeaders({ userId });\n}\n\n/**\n * Replace principal resolution for one instance (default: 'default') without Better Auth I/O. Acceptance, the\n * origin check and policies still run. A policy's re-classification read of a generic 401 answers absent,\n * because the request carries no session; other instances keep the real resolver.\n */\nexport function overridePrincipal(\n  builder: TestingModuleBuilder,\n  principal: FixedPrincipal,\n  options: { instance?: string } = {},\n): TestingModuleBuilder {\n  const configured = overridesOf(builder).principals;\n  configured.set(options.instance || \"default\", principal);\n  builder.overrideProvider(PRINCIPAL_RESOLVER).useFactory({\n    inject: [INSTANCE_REGISTRY, REQUEST_SCOPE, TRANSPORT_REGISTRY],\n    factory: (\n      instances: InstanceRegistry,\n      scope: RequestScope,\n      transports: TransportRegistry,\n    ): PrincipalResolver => {\n      const real = new ChainPrincipalResolver(instances, scope, transports);\n      return {\n        resolve(call, request): Promise<PrincipalResult> {\n          if (!configured.has(request.auth.name)) {\n            return real.resolve(call, request);\n          }\n          if (request.reclassify) {\n            return Promise.resolve(absent());\n          }\n          const fixed = configured.get(request.auth.name);\n          const value = typeof fixed === \"function\" ? fixed(call) : fixed;\n          return Promise.resolve(value ? authenticated(value) : absent());\n        },\n      };\n    },\n  });\n  return builder;\n}\n\n/**\n * Replace the policy invoker: `decide` answers per requirement, and undefined runs the real policy. Acceptance,\n * the delegation gate, the origin check and the decision memo still run. Later calls are consulted after earlier ones.\n */\nexport function overrideDecisions(\n  builder: TestingModuleBuilder,\n  decide: Decide,\n): TestingModuleBuilder {\n  const configured = overridesOf(builder).deciders;\n  configured.push(decide);\n  const invoker: PolicyInvoker = {\n    async invoke(policy, params, context) {\n      for (const decider of configured) {\n        const decision = await decider(policy.id, params, context.principal);\n        if (decision !== undefined) {\n          return decision;\n        }\n      }\n      return policy.evaluate(params, context);\n    },\n  };\n  builder.overrideProvider(POLICY_INVOKER).useValue(invoker);\n  return builder;\n}\n\n/** A principal source that answers a fixed principal (or null for absent), for test module composition. */\nexport function testPrincipal(\n  principal: AuthPrincipal | ((req: PrincipalRequest) => AuthPrincipal | null),\n  options: {\n    kinds?: readonly string[];\n    acceptance?: \"default\" | \"explicit\";\n    delegates?: boolean;\n  } = {},\n): PrincipalSource {\n  const fixed = typeof principal === \"function\" ? undefined : principal;\n  const id = fixed?.source ?? TEST_PRINCIPAL_SOURCE;\n  const kinds = options.kinds ?? (fixed ? [fixed.kind] : [\"session\"]);\n  return {\n    id,\n    kinds: kinds as PrincipalSource[\"kinds\"],\n    acceptance: options.acceptance ?? \"default\",\n    delegates: options.delegates ?? Boolean(fixed?.delegation),\n    async resolve(request) {\n      const value =\n        typeof principal === \"function\" ? principal(request) : principal;\n      return value\n        ? authenticated({ ...value, source: id } as AuthPrincipal)\n        : absent();\n    },\n  };\n}\n\n/**\n * Publish a principal for this invocation from a hand-written guard. The stamp lives on ctx.getArgs() and its\n * object elements. Readers accept it from the same args array (WS, RPC and GraphQL share it between guards and\n * interceptors) or from another array with the same elements when at least two elements are objects (an HTTP request\n * and its response); a lone shared element such as a socket never identifies an invocation. Pass `instance` for\n * handlers of a named instance.\n */\nexport function stampPrincipal(\n  context: ExecutionContext,\n  principal: AuthPrincipal | null,\n  options: { instance?: string } = {},\n): void {\n  stampResult(\n    context.getArgs(),\n    options.instance || \"default\",\n    principal ? authenticated(principal) : absent(),\n  );\n}\n\nclass StampFirstReadings extends PrincipalReadings {\n  override read(input: ReadingInput) {\n    const stamped =\n      input.plan && input.plan.access !== \"public\"\n        ? stampedReading(input.args, input.plan.instance)\n        : undefined;\n    return stamped ?? super.read(input);\n  }\n}\n\nfunction planInstance(planner: RoutePlanner, context: ExecutionContext) {\n  try {\n    return planner.forContext(context).instance;\n  } catch {\n    return \"default\";\n  }\n}\n\n/**\n * Replace the guard and scope bodies everywhere with one override each of GUARD_CORE and SCOPE_CORE: the APP_GUARD\n * alias and every @UseBetterAuth()/@UseGuards(BetterAuthGuard) site delegate to the same collaborator, which\n * overrideProvider(BetterAuthGuard) plus overrideGuard(BetterAuthGuard) cannot achieve. With `{ principal }` the\n * stand-in stamps the principal (for the handler's instance) and allows; with a CanActivate, that guard runs as the\n * whole guard body and may call stampPrincipal(); an object with a canActivate method is always treated as a guard,\n * even when it also has a `principal` property. The stand-in interceptor opens the same transport-described scope\n * as the real one, reading the test stamp first, so readers and BetterAuthService perform no Better Auth I/O.\n */\nexport function overrideAuthGuard(\n  builder: TestingModuleBuilder,\n  impl:\n    | CanActivate\n    | {\n        principal:\n          | AuthPrincipal\n          | null\n          | ((ctx: ExecutionContext) => AuthPrincipal | null);\n      },\n): TestingModuleBuilder {\n  builder.overrideProvider(GUARD_CORE).useFactory({\n    inject: [ROUTE_PLANNER],\n    factory: (planner: RoutePlanner) => ({\n      async canActivate(context: ExecutionContext): Promise<boolean> {\n        // A CanActivate may hold its own `principal` field; its canActivate always runs.\n        if (typeof (impl as Partial<CanActivate>).canActivate === \"function\") {\n          const result = (impl as CanActivate).canActivate(context);\n          return isObservable(result) ? lastValueFrom(result) : result;\n        }\n        const { principal } = impl as {\n          principal:\n            | AuthPrincipal\n            | null\n            | ((ctx: ExecutionContext) => AuthPrincipal | null);\n        };\n        const value =\n          typeof principal === \"function\" ? principal(context) : principal;\n        stampResult(\n          context.getArgs(),\n          planInstance(planner, context),\n          value ? authenticated(value) : absent(),\n        );\n        return true;\n      },\n    }),\n  });\n  builder.overrideProvider(SCOPE_CORE).useFactory({\n    inject: [\n      INSTANCE_REGISTRY,\n      ROUTE_PLANNER,\n      TRANSPORT_REGISTRY,\n      REQUEST_SCOPE,\n    ],\n    factory: (\n      instances: InstanceRegistry,\n      planner: RoutePlanner,\n      transports: TransportRegistry,\n      scope: RequestScope,\n    ) =>\n      new ScopeCore(\n        instances,\n        planner,\n        transports,\n        scope,\n        new StampFirstReadings(scope),\n      ),\n  });\n  return builder;\n}\n"],"mappings":";;;;;;;AA8CA,MAAM,WAAW,OAAO,IAAI,kCAAkC;AAC9D,MAAM,iBAAiB,OAAO,IAAI,wCAAwC;AAC1E,MAAM,iBAAiB,OAAO,IAAI,wCAAwC;AAC1E,MAAM,YAAY;AAClB,MAAM,wBAAwB;;;;;AAwB9B,SAAS,YAAY,SAA8C;CACjE,IAAI,YAAY,QAAQ,IAAI,SAAS,cAAc;CAGnD,IAAI,CAAC,WAAW;EACd,YAAY;GAAE,4BAAY,IAAI,IAAI;GAAG,UAAU,CAAC;EAAE;EAClD,OAAO,eAAe,SAAS,gBAAgB,EAAE,OAAO,UAAU,CAAC;CACrE;CACA,OAAO;AACT;;AAGA,SAAS,UAAU,KAA4C;CAC7D,MAAM,WAAW,QAAQ,IAAI,KAAK,cAAc;CAGhD,IAAI,UACF,OAAO;CAET,MAAM,QAAQ,IAAI,MAAM,KAAK,GAAG;CAChC,IAAI;CACJ,MAAM,aAAa;EACjB,YAAY,MAAM;EAClB,OAAO;CACT;CACA,OAAO,eAAe,KAAK,gBAAgB,EAAE,OAAO,KAAK,CAAC;CAC1D,IAAI,QAAQ;CACZ,OAAO;AACT;AAEA,eAAe,SAAS,MAAmD;CAIzE,MAAM,UAAS,MAHQ,KAAK,SAAA,CAGL,YAAY,SAAS;CAC5C,OAAO,UAAU,OAAO,WAAW,WAC9B,QAAQ,IAAI,QAAQ,aAAa,IAClC,KAAA;AACN;AAEA,SAAS,WAAW,KAAqD;CACvE,IAAI;EACF,OAAO,IAAI,IAAsB,mBAAmB,EAAE,QAAQ,MAAM,CAAC;CACvE,QAAQ;EACN;CACF;AACF;;;;;;;;;;AAWA,eAAsB,YACpB,KACA,UAAgE,CAAC,GACrD;CACZ,MAAM,QAAQ,UAAU,GAAG;CAC3B,MAAM,UAA0B,CAAC;CACjC,KAAK,MAAM,gBAAgB,WAAW,GAAG,CAAC,EAAE,cAAc,KAAK,CAAC,GAAG;EACjE,MAAM,SAAS,aAAa,WACxB,MAAM,SAAS,aAAa,QAAQ,IACpC,KAAA;EACJ,IAAI,CAAC,QACH;EAEF,MAAM,WAAW,QAAQ,IAAI,QAAQ,QAAQ;EAG7C,IAAI,YAAY,aAAa,OAAO,OAAO,UAAU,SAEnD,MAAM,SAAS,MAAM;EAEvB,OAAO,eAAe,QAAQ,UAAU;GACtC,OAAO,KAAA;GACP,cAAc;GACd,UAAU;EACZ,CAAC;EACD,QAAQ,KAAK,MAAM;CACrB;CACA,MAAM,IAAI,KAAK;CACf,MAAM,UACJ,IAAI,iBAAiB,EAAA,EACpB,cAAc;CACjB,IAAI,OAAO,QAAQ,UAAU,YAC3B,MAAM,OAAO,MAAM;CAErB,KAAK,MAAM,UAAU,SACnB,OAAO,eAAe,QAAQ,UAAU;EACtC,OAAO;EACP,cAAc;EACd,UAAU;CACZ,CAAC;CAEH,QAAQ,YAAY,KAAK;CACzB,OAAO;AACT;;AAGA,eAAsB,eACpB,MACA,QACkB;CAClB,MAAM,UAAW,MAAM,KAAK;CAG5B,IAAI,OAAO,QAAQ,MAAM,mBAAmB,YAC1C,MAAM,IAAI,6BACR,sBACA,6EACA,gEACF;CAEF,OAAO,QAAQ,KAAK,eAAe,EAAE,OAAO,CAAC;AAC/C;;;;;;AAOA,SAAgB,kBACd,SACA,WACA,UAAiC,CAAC,GACZ;CACtB,MAAM,aAAa,YAAY,OAAO,CAAC,CAAC;CACxC,WAAW,IAAI,QAAQ,YAAY,WAAW,SAAS;CACvD,QAAQ,iBAAiB,kBAAkB,CAAC,CAAC,WAAW;EACtD,QAAQ;GAAC;GAAmB;GAAe;EAAkB;EAC7D,UACE,WACA,OACA,eACsB;GACtB,MAAM,OAAO,IAAI,uBAAuB,WAAW,OAAO,UAAU;GACpE,OAAO,EACL,QAAQ,MAAM,SAAmC;IAC/C,IAAI,CAAC,WAAW,IAAI,QAAQ,KAAK,IAAI,GACnC,OAAO,KAAK,QAAQ,MAAM,OAAO;IAEnC,IAAI,QAAQ,YACV,OAAO,QAAQ,QAAQ,OAAO,CAAC;IAEjC,MAAM,QAAQ,WAAW,IAAI,QAAQ,KAAK,IAAI;IAC9C,MAAM,QAAQ,OAAO,UAAU,aAAa,MAAM,IAAI,IAAI;IAC1D,OAAO,QAAQ,QAAQ,QAAQ,cAAc,KAAK,IAAI,OAAO,CAAC;GAChE,EACF;EACF;CACF,CAAC;CACD,OAAO;AACT;;;;;AAMA,SAAgB,kBACd,SACA,QACsB;CACtB,MAAM,aAAa,YAAY,OAAO,CAAC,CAAC;CACxC,WAAW,KAAK,MAAM;CAYtB,QAAQ,iBAAiB,cAAc,CAAC,CAAC,SAAS,EAVhD,MAAM,OAAO,QAAQ,QAAQ,SAAS;EACpC,KAAK,MAAM,WAAW,YAAY;GAChC,MAAM,WAAW,MAAM,QAAQ,OAAO,IAAI,QAAQ,QAAQ,SAAS;GACnE,IAAI,aAAa,KAAA,GACf,OAAO;EAEX;EACA,OAAO,OAAO,SAAS,QAAQ,OAAO;CACxC,EAEsD,CAAC;CACzD,OAAO;AACT;;AAGA,SAAgB,cACd,WACA,UAII,CAAC,GACY;CACjB,MAAM,QAAQ,OAAO,cAAc,aAAa,KAAA,IAAY;CAC5D,MAAM,KAAK,OAAO,UAAU;CAE5B,OAAO;EACL;EACA,OAHY,QAAQ,UAAU,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS;EAI/D,YAAY,QAAQ,cAAc;EAClC,WAAW,QAAQ,aAAa,QAAQ,OAAO,UAAU;EACzD,MAAM,QAAQ,SAAS;GACrB,MAAM,QACJ,OAAO,cAAc,aAAa,UAAU,OAAO,IAAI;GACzD,OAAO,QACH,cAAc;IAAE,GAAG;IAAO,QAAQ;GAAG,CAAkB,IACvD,OAAO;EACb;CACF;AACF;;;;;;;;AASA,SAAgB,eACd,SACA,WACA,UAAiC,CAAC,GAC5B;CACN,YACE,QAAQ,QAAQ,GAChB,QAAQ,YAAY,WACpB,YAAY,cAAc,SAAS,IAAI,OAAO,CAChD;AACF;AAEA,IAAM,qBAAN,cAAiC,kBAAkB;CACjD,KAAc,OAAqB;EAKjC,QAHE,MAAM,QAAQ,MAAM,KAAK,WAAW,WAChC,eAAe,MAAM,MAAM,MAAM,KAAK,QAAQ,IAC9C,KAAA,MACY,MAAM,KAAK,KAAK;CACpC;AACF;AAEA,SAAS,aAAa,SAAuB,SAA2B;CACtE,IAAI;EACF,OAAO,QAAQ,WAAW,OAAO,CAAC,CAAC;CACrC,QAAQ;EACN,OAAO;CACT;AACF;;;;;;;;;;AAWA,SAAgB,kBACd,SACA,MAQsB;CACtB,QAAQ,iBAAiB,UAAU,CAAC,CAAC,WAAW;EAC9C,QAAQ,CAAC,aAAa;EACtB,UAAU,aAA2B,EACnC,MAAM,YAAY,SAA6C;GAE7D,IAAI,OAAQ,KAA8B,gBAAgB,YAAY;IACpE,MAAM,SAAU,KAAqB,YAAY,OAAO;IACxD,OAAO,aAAa,MAAM,IAAI,cAAc,MAAM,IAAI;GACxD;GACA,MAAM,EAAE,cAAc;GAMtB,MAAM,QACJ,OAAO,cAAc,aAAa,UAAU,OAAO,IAAI;GACzD,YACE,QAAQ,QAAQ,GAChB,aAAa,SAAS,OAAO,GAC7B,QAAQ,cAAc,KAAK,IAAI,OAAO,CACxC;GACA,OAAO;EACT,EACF;CACF,CAAC;CACD,QAAQ,iBAAiB,UAAU,CAAC,CAAC,WAAW;EAC9C,QAAQ;GACN;GACA;GACA;GACA;EACF;EACA,UACE,WACA,SACA,YACA,UAEA,IAAI,UACF,WACA,SACA,YACA,OACA,IAAI,mBAAmB,KAAK,CAC9B;CACJ,CAAC;CACD,OAAO;AACT"}

package/dist/websockets.cjs

@@ -0,0 +1,396 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_auth_errors = require("./auth-errors-DmiKl0L_.cjs");
+const require_decorate = require("./decorate-Cr4Q7bNE.cjs");
+const require_bridge_protocol = require("./bridge-protocol-BDw8opAG.cjs");
+const require_platform = require("./platform-YICqqYv6.cjs");
+let _nestjs_common = require("@nestjs/common");
+let _nestjs_core = require("@nestjs/core");
+let _nestjs_websockets = require("@nestjs/websockets");
+//#region src/ws-connection-auth.ts
+function wsCloseCodeFor(failure) {
+	return failure.status === 401 ? 4401 : failure.status === 403 ? 4403 : 4429;
+}
+const STACK_FRAME = /^\s+at .+:\d+:\d+\)?$/;
+/**
+* Describes an unexpected connection-authentication error for the server log. Package
+* errors carry fixed messages and already-redacted causes. Application and runtime error
+* messages can quote client credentials (native Headers errors do), so only their name
+* and stack frames are kept.
+*/
+function connectionErrorLog(error) {
+	const text = (value) => typeof value === "string" ? value : void 0;
+	let summary;
+	if (require_auth_errors.isConfigurationError(error)) summary = `${error.code}: ${error.detail}`;
+	else if (require_auth_errors.isInfrastructureError(error)) {
+		const cause = require_auth_errors.readErrorProperty(error, "cause");
+		summary = `${error.message} (${text(require_auth_errors.readErrorProperty(cause, "name")) ?? "Error"}: ${text(require_auth_errors.readErrorProperty(cause, "message")) ?? ""})`;
+	} else {
+		const name = text(require_auth_errors.readErrorProperty(error, "name"));
+		summary = `${name !== void 0 && /^[\w$.]{1,64}$/.test(name) ? name : typeof error} (message withheld)`;
+	}
+	const frames = (text(require_auth_errors.readErrorProperty(error, "stack")) ?? "").split(/\r?\n/).filter((line) => STACK_FRAME.test(line));
+	return {
+		message: `WebSocket connection authentication failed: ${summary}`,
+		stack: frames.length > 0 ? [summary, ...frames].join("\n") : void 0
+	};
+}
+/**
+* The `ws` execution context of a connection before any gateway handler runs. Nest exports no
+* public factory for execution contexts, so this implements the public `ExecutionContext`
+* interface with the values Nest's internal host reports for the arguments `[client, undefined]`.
+*/
+var ConnectionExecutionContext = class {
+	#args;
+	constructor(client) {
+		this.#args = [client, void 0];
+	}
+	getType() {
+		return "ws";
+	}
+	/** No handler runs yet, so there is no class; Nest's host reports `null` as well. */
+	getClass() {
+		return null;
+	}
+	/** No handler runs yet; Nest's host reports `null` as well. */
+	getHandler() {
+		return null;
+	}
+	getArgs() {
+		return this.#args;
+	}
+	getArgByIndex(index) {
+		return this.#args[index];
+	}
+	switchToHttp() {
+		return {
+			getRequest: () => this.getArgByIndex(0),
+			getResponse: () => this.getArgByIndex(1),
+			getNext: () => this.getArgByIndex(2)
+		};
+	}
+	switchToRpc() {
+		return {
+			getData: () => this.getArgByIndex(0),
+			getContext: () => this.getArgByIndex(1)
+		};
+	}
+	switchToWs() {
+		return {
+			getClient: () => this.getArgByIndex(0),
+			getData: () => this.getArgByIndex(1),
+			getPattern: () => this.getArgByIndex(this.#args.length - 1)
+		};
+	}
+};
+let WsConnectionAuth = class WsConnectionAuth {
+	instances;
+	resolver;
+	transports;
+	logger = new _nestjs_common.Logger("BetterAuth");
+	constructor(instances, resolver, transports) {
+		this.instances = instances;
+		this.resolver = resolver;
+		this.transports = transports;
+	}
+	async authenticate(client, options = {}) {
+		if (typeof client !== "object" || client === null) throw require_auth_errors.BetterAuthConfigurationError.atRequest("INVALID_WS_CLIENT", "Connection authentication requires a WebSocket client.");
+		const context = new ConnectionExecutionContext(client);
+		const transport = this.transports.select(context);
+		const call = this.transports.describe(context, transport);
+		const entry = this.instances.get(options.instance ?? "default");
+		const browser = call.browser;
+		if (browser && entry.options.originCheck?.mode !== "off") {
+			const failure = await entry.handle.checkOrigin(browser, "cookie");
+			if (failure) return {
+				outcome: "rejected",
+				failure
+			};
+		}
+		const accepts = new Set(entry.sources.filter((source) => source.acceptance === "default").flatMap((source) => [...source.kinds]));
+		try {
+			return await this.resolver.resolve(call, {
+				auth: entry.handle,
+				accepts,
+				sourceSet: JSON.stringify(entry.sources.flatMap((source, index) => source.kinds.some((kind) => accepts.has(kind)) ? [index] : [])),
+				freshness: entry.options.session !== false && entry.options.session?.freshness === "authoritative" ? "authoritative" : "default"
+			});
+		} catch (error) {
+			if (require_auth_errors.isAuthFailure(error)) return {
+				outcome: "rejected",
+				failure: error
+			};
+			throw error;
+		}
+	}
+	socketIoMiddleware(options = {}) {
+		return (socket, next) => {
+			this.authenticate(socket, options).then((result) => {
+				const failure = result.outcome === "rejected" ? result.failure : result.outcome === "absent" && options.required ? require_auth_errors.AuthFailures.unauthenticated() : void 0;
+				if (!failure) {
+					next();
+					return;
+				}
+				next(Object.assign(new Error(failure.message), { data: {
+					status: "error",
+					statusCode: failure.status,
+					code: failure.code,
+					...failure.reason ? { reason: failure.reason } : {},
+					message: failure.message
+				} }));
+			}, (error) => {
+				const log = connectionErrorLog(error);
+				this.logger.error(log.message, log.stack);
+				next(Object.assign(/* @__PURE__ */ new Error("Internal server error"), { data: {
+					status: "error",
+					statusCode: 500,
+					message: "Internal server error"
+				} }));
+			});
+		};
+	}
+};
+WsConnectionAuth = require_decorate.__decorate([
+	require_decorate.__decorateParam(0, (0, _nestjs_common.Inject)(require_decorate.INSTANCE_REGISTRY)),
+	require_decorate.__decorateParam(1, (0, _nestjs_common.Inject)(require_decorate.PRINCIPAL_RESOLVER)),
+	require_decorate.__decorateParam(2, (0, _nestjs_common.Inject)(require_decorate.TRANSPORT_REGISTRY)),
+	require_decorate.__decorateMetadata("design:paramtypes", [
+		Object,
+		Object,
+		Object
+	])
+], WsConnectionAuth);
+//#endregion
+//#region src/socket-io-transport.ts
+/** Convert only mapped headers here: native Headers errors can quote the credential. */
+function mappedCredentialHeaders(input) {
+	const headers = new Headers();
+	if (input === void 0) return headers;
+	const malformed = () => require_auth_errors.AuthFailures.rejected({
+		status: 401,
+		reason: "MALFORMED_CREDENTIALS"
+	});
+	if (input === null || typeof input !== "object") throw malformed();
+	const iterable = input[Symbol.iterator];
+	if (iterable !== void 0 && typeof iterable !== "function") throw malformed();
+	const entries = typeof iterable === "function" ? input : Object.entries(input);
+	for (const entry of entries) {
+		if (!Array.isArray(entry) || entry.length !== 2) throw malformed();
+		const [name, value] = entry;
+		if (typeof name !== "string" || typeof value !== "string" || /[\r\n\0]/.test(value)) throw malformed();
+		try {
+			headers.append(name, value);
+		} catch {
+			throw malformed();
+		}
+	}
+	return headers;
+}
+function isSocketIo(client) {
+	return typeof client === "object" && client !== null && "handshake" in client;
+}
+function wsException(failure) {
+	return new _nestjs_websockets.WsException({
+		status: "error",
+		statusCode: failure.status,
+		code: failure.code,
+		...failure.reason ? { reason: failure.reason } : {},
+		message: failure.message
+	});
+}
+function validateGateways(context, coverage) {
+	class Probe {
+		message() {}
+	}
+	(0, _nestjs_websockets.WebSocketGateway)()(Probe);
+	(0, _nestjs_websockets.SubscribeMessage)("probe")(Probe.prototype, "message", Object.getOwnPropertyDescriptor(Probe.prototype, "message"));
+	if (Reflect.getMetadata("websockets:is_gateway", Probe) !== true || Reflect.getMetadata("websockets:message_mapping", Probe.prototype.message) !== true) throw new require_auth_errors.BetterAuthConfigurationError("NEST_METADATA_KEY_CHANGED", "Nest WebSocket gateway/message metadata failed its canary.");
+	const scanner = new _nestjs_core.MetadataScanner();
+	for (const wrapper of context.discovery.getProviders()) {
+		const target = wrapper.metatype;
+		if (!target?.prototype || wrapper.isAlias || !Reflect.getMetadata("websockets:is_gateway", target)) continue;
+		for (const method of scanner.getAllMethodNames(target.prototype)) if (Reflect.getMetadata("websockets:message_mapping", target.prototype[method])) context.claim(target, method, "explicit", {
+			everyHandler: true,
+			code: "GATEWAY_UNGUARDED",
+			coverage: coverage ?? "error",
+			hint: `Add @UseBetterAuth() to ${target.name} (or @Public() to opt out). Global guards and interceptors do not reach gateways on NestJS 11, and this check does not depend on the version.`
+		});
+	}
+}
+function quotaAdvice(context, ttl) {
+	return ttl === 0 && context.sources.some((source) => source.effects?.consumesQuota) ? [{
+		level: "warn",
+		code: "W_QUOTA_PER_MESSAGE",
+		message: "Quota-consuming WebSocket principals verify on every message.",
+		hint: "Consider connection-time authentication and principalTtlMs; a positive TTL delays revocation on non-authoritative handlers."
+	}] : [];
+}
+function transportDefinition(transport) {
+	return {
+		[require_bridge_protocol.EXTENSION_DEFINITION]: true,
+		use: { useFactory: () => transport },
+		providers: [WsConnectionAuth, {
+			provide: require_decorate.WS_CONNECTION_AUTH,
+			useExisting: WsConnectionAuth
+		}],
+		exports: [WsConnectionAuth, require_decorate.WS_CONNECTION_AUTH]
+	};
+}
+function principalTtl(value = 0) {
+	if (!Number.isFinite(value) || value < 0) throw new require_auth_errors.BetterAuthConfigurationError("INVALID_WS_TTL", "principalTtlMs must be a finite non-negative number.");
+	return value;
+}
+function socketIoTransport(options = {}) {
+	const ttl = principalTtl(options.principalTtlMs);
+	return transportDefinition({
+		id: "socket.io",
+		handles: (context) => context.getType() === "ws" && isSocketIo(context.switchToWs().getClient()),
+		describe(context) {
+			const client = context.switchToWs().getClient();
+			const original = () => require_platform.toWebHeaders(client.handshake.headers);
+			return {
+				key: context.getArgs(),
+				invocation: context.getArgs(),
+				connection: client,
+				principalTtlMs: ttl,
+				headers: () => {
+					const headers = original();
+					let mapped;
+					if (options.credentials) mapped = options.credentials(client);
+					else if (!headers.has("authorization")) {
+						const token = client.handshake.auth?.token;
+						if (token !== void 0) {
+							if (typeof token !== "string") throw require_auth_errors.AuthFailures.rejected({
+								status: 401,
+								reason: "MALFORMED_CREDENTIALS"
+							});
+							mapped = { authorization: `Bearer ${token}` };
+						}
+					}
+					mappedCredentialHeaders(mapped).forEach((value, name) => {
+						headers.set(name, value);
+					});
+					return headers;
+				},
+				get clientIp() {
+					return client.handshake.address ?? null;
+				},
+				cookies: null,
+				get request() {
+					return {
+						method: "GET",
+						url: require_platform.upgradeRequestUrl(client.handshake)
+					};
+				},
+				param: (name) => context.switchToWs().getData()?.[name],
+				get browser() {
+					return {
+						enforce: true,
+						key: client,
+						headers: original,
+						url: require_platform.upgradeRequestUrl(client.handshake)
+					};
+				}
+			};
+		},
+		toException: wsException,
+		validate: (context) => validateGateways(context, options.gatewayCoverage),
+		advise: (context) => quotaAdvice(context, ttl)
+	});
+}
+//#endregion
+//#region src/ws-transport.ts
+function recordUpgradeRequest(client, request) {
+	Object.defineProperty(client, require_bridge_protocol.UPGRADE_REQUEST, {
+		value: Object.freeze({
+			headers: require_platform.toWebHeaders(request.headers),
+			url: request.url,
+			remoteAddress: request.socket?.remoteAddress,
+			encrypted: request.socket?.encrypted
+		}),
+		configurable: true
+	});
+}
+function withUpgradeRequest(Base) {
+	return class extends Base {
+		bindClientConnect(server, callback) {
+			return super.bindClientConnect(server, (client, request, ...rest) => {
+				recordUpgradeRequest(client, request);
+				callback(client, request, ...rest);
+			});
+		}
+	};
+}
+function wsTransport(options = {}) {
+	const ttl = principalTtl(options.principalTtlMs);
+	return transportDefinition({
+		id: "ws",
+		handles: (context) => context.getType() === "ws" && !isSocketIo(context.switchToWs().getClient()),
+		describe(context) {
+			const client = context.switchToWs().getClient();
+			const upgrade = () => {
+				const request = client[require_bridge_protocol.UPGRADE_REQUEST];
+				if (!request) throw require_auth_errors.BetterAuthConfigurationError.atRequest("WS_UPGRADE_REQUEST_MISSING", "WebSocket authentication requires its upgrade request.", { hint: "app.useWebSocketAdapter(new (withUpgradeRequest(WsAdapter))(app));" });
+				return request;
+			};
+			const url = () => {
+				const request = upgrade();
+				return require_platform.upgradeRequestUrl({
+					headers: request.headers,
+					url: request.url,
+					secure: request.encrypted
+				});
+			};
+			return {
+				key: context.getArgs(),
+				invocation: context.getArgs(),
+				connection: client,
+				principalTtlMs: ttl,
+				headers: () => {
+					const headers = new Headers(upgrade().headers);
+					mappedCredentialHeaders(options.credentials?.(client)).forEach((value, name) => {
+						headers.set(name, value);
+					});
+					return headers;
+				},
+				get clientIp() {
+					return upgrade().remoteAddress ?? null;
+				},
+				cookies: null,
+				get request() {
+					return {
+						method: "GET",
+						url: url()
+					};
+				},
+				param: (name) => context.switchToWs().getData()?.[name],
+				get browser() {
+					return {
+						enforce: true,
+						key: client,
+						headers: () => new Headers(upgrade().headers),
+						url: url()
+					};
+				}
+			};
+		},
+		toException: wsException,
+		validate: (context) => validateGateways(context, options.gatewayCoverage),
+		advise: (context) => quotaAdvice(context, ttl)
+	});
+}
+//#endregion
+exports.UPGRADE_REQUEST = require_bridge_protocol.UPGRADE_REQUEST;
+exports.WS_CONNECTION_AUTH = require_decorate.WS_CONNECTION_AUTH;
+Object.defineProperty(exports, "WsConnectionAuth", {
+	enumerable: true,
+	get: function() {
+		return WsConnectionAuth;
+	}
+});
+exports.recordUpgradeRequest = recordUpgradeRequest;
+exports.socketIoTransport = socketIoTransport;
+exports.withUpgradeRequest = withUpgradeRequest;
+exports.wsCloseCodeFor = wsCloseCodeFor;
+exports.wsTransport = wsTransport;
+
+//# sourceMappingURL=websockets.cjs.map

package/dist/websockets.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"websockets.cjs","names":["isConfigurationError","isInfrastructureError","readErrorProperty","Logger","BetterAuthConfigurationError","isAuthFailure","AuthFailures","Inject","INSTANCE_REGISTRY","PRINCIPAL_RESOLVER","TRANSPORT_REGISTRY","AuthFailures","WsException","BetterAuthConfigurationError","MetadataScanner","EXTENSION_DEFINITION","WS_CONNECTION_AUTH","toWebHeaders","upgradeRequestUrl","UPGRADE_REQUEST","toWebHeaders","BetterAuthConfigurationError","upgradeRequestUrl"],"sources":["../src/ws-connection-auth.ts","../src/socket-io-transport.ts","../src/ws-transport.ts"],"sourcesContent":["import {\n  type ContextType,\n  type ExecutionContext,\n  Inject,\n  Logger,\n  type Type,\n} from \"@nestjs/common\";\nimport type { PrincipalResolver, PrincipalResult } from \"./auth-contracts.js\";\nimport {\n  AuthFailures,\n  isAuthFailure,\n  isConfigurationError,\n  isInfrastructureError,\n  BetterAuthConfigurationError,\n  type AuthFailure,\n} from \"./auth-errors.js\";\nimport {\n  INSTANCE_REGISTRY,\n  PRINCIPAL_RESOLVER,\n  TRANSPORT_REGISTRY,\n} from \"./auth-tokens.js\";\nimport { readErrorProperty } from \"./error-redactor.js\";\nimport type { InstanceLookup } from \"./instance-registry.js\";\nimport type { TransportRegistry } from \"./transport-registry.js\";\n\nexport { WS_CONNECTION_AUTH } from \"./auth-tokens.js\";\nexport function wsCloseCodeFor(failure: AuthFailure): 4401 | 4403 | 4429 {\n  return failure.status === 401 ? 4401 : failure.status === 403 ? 4403 : 4429;\n}\n\nconst STACK_FRAME = /^\\s+at .+:\\d+:\\d+\\)?$/;\n\n/**\n * Describes an unexpected connection-authentication error for the server log. Package\n * errors carry fixed messages and already-redacted causes. Application and runtime error\n * messages can quote client credentials (native Headers errors do), so only their name\n * and stack frames are kept.\n */\nexport function connectionErrorLog(error: unknown): {\n  message: string;\n  stack?: string;\n} {\n  const text = (value: unknown) =>\n    typeof value === \"string\" ? value : undefined;\n  let summary: string;\n  if (isConfigurationError(error)) {\n    summary = `${error.code}: ${error.detail}`;\n  } else if (isInfrastructureError(error)) {\n    const cause = readErrorProperty(error, \"cause\");\n    summary = `${error.message} (${text(readErrorProperty(cause, \"name\")) ?? \"Error\"}: ${text(readErrorProperty(cause, \"message\")) ?? \"\"})`;\n  } else {\n    const name = text(readErrorProperty(error, \"name\"));\n    summary = `${name !== undefined && /^[\\w$.]{1,64}$/.test(name) ? name : typeof error} (message withheld)`;\n  }\n  const frames = (text(readErrorProperty(error, \"stack\")) ?? \"\")\n    .split(/\\r?\\n/)\n    .filter((line) => STACK_FRAME.test(line));\n  return {\n    message: `WebSocket connection authentication failed: ${summary}`,\n    stack: frames.length > 0 ? [summary, ...frames].join(\"\\n\") : undefined,\n  };\n}\n\n/**\n * The `ws` execution context of a connection before any gateway handler runs. Nest exports no\n * public factory for execution contexts, so this implements the public `ExecutionContext`\n * interface with the values Nest's internal host reports for the arguments `[client, undefined]`.\n */\nexport class ConnectionExecutionContext implements ExecutionContext {\n  readonly #args: unknown[];\n\n  constructor(client: object) {\n    this.#args = [client, undefined];\n  }\n\n  getType<TContext extends string = ContextType>(): TContext {\n    return \"ws\" as TContext;\n  }\n\n  /** No handler runs yet, so there is no class; Nest's host reports `null` as well. */\n  getClass<T>(): Type<T> {\n    return null as unknown as Type<T>;\n  }\n\n  /** No handler runs yet; Nest's host reports `null` as well. */\n  getHandler(): ReturnType<ExecutionContext[\"getHandler\"]> {\n    return null as unknown as ReturnType<ExecutionContext[\"getHandler\"]>;\n  }\n\n  getArgs<T extends unknown[] = unknown[]>(): T {\n    return this.#args as T;\n  }\n\n  getArgByIndex<T>(index: number): T {\n    return this.#args[index] as T;\n  }\n\n  switchToHttp(): ReturnType<ExecutionContext[\"switchToHttp\"]> {\n    return {\n      getRequest: <T>() => this.getArgByIndex<T>(0),\n      getResponse: <T>() => this.getArgByIndex<T>(1),\n      getNext: <T>() => this.getArgByIndex<T>(2),\n    };\n  }\n\n  switchToRpc(): ReturnType<ExecutionContext[\"switchToRpc\"]> {\n    return {\n      getData: <T>() => this.getArgByIndex<T>(0),\n      getContext: <T>() => this.getArgByIndex<T>(1),\n    };\n  }\n\n  switchToWs(): ReturnType<ExecutionContext[\"switchToWs\"]> {\n    return {\n      getClient: <T>() => this.getArgByIndex<T>(0),\n      getData: <T>() => this.getArgByIndex<T>(1),\n      getPattern: () => this.getArgByIndex<string>(this.#args.length - 1),\n    };\n  }\n}\n\n/** Connection authentication delegates to the same origin and principal kernel as messages. */\nexport class WsConnectionAuth {\n  private readonly logger = new Logger(\"BetterAuth\");\n\n  constructor(\n    @Inject(INSTANCE_REGISTRY) private readonly instances: InstanceLookup,\n    @Inject(PRINCIPAL_RESOLVER) private readonly resolver: PrincipalResolver,\n    @Inject(TRANSPORT_REGISTRY) private readonly transports: TransportRegistry,\n  ) {}\n\n  async authenticate(\n    client: unknown,\n    options: { instance?: string } = {},\n  ): Promise<PrincipalResult> {\n    if (typeof client !== \"object\" || client === null) {\n      throw BetterAuthConfigurationError.atRequest(\n        \"INVALID_WS_CLIENT\",\n        \"Connection authentication requires a WebSocket client.\",\n      );\n    }\n    const context = new ConnectionExecutionContext(client);\n    const transport = this.transports.select(context);\n    const call = this.transports.describe(context, transport);\n    const entry = this.instances.get(options.instance ?? \"default\");\n    const browser = call.browser;\n    if (browser && entry.options.originCheck?.mode !== \"off\") {\n      const failure = await entry.handle.checkOrigin(browser, \"cookie\");\n      if (failure) {\n        return { outcome: \"rejected\", failure };\n      }\n    }\n    const accepts = new Set(\n      entry.sources\n        .filter((source) => source.acceptance === \"default\")\n        .flatMap((source) => [...source.kinds]),\n    );\n    try {\n      return await this.resolver.resolve(call, {\n        auth: entry.handle,\n        accepts,\n        sourceSet: JSON.stringify(\n          entry.sources.flatMap((source, index) =>\n            source.kinds.some((kind) => accepts.has(kind)) ? [index] : [],\n          ),\n        ),\n        freshness:\n          entry.options.session !== false &&\n          entry.options.session?.freshness === \"authoritative\"\n            ? \"authoritative\"\n            : \"default\",\n      });\n    } catch (error) {\n      if (isAuthFailure(error)) {\n        return { outcome: \"rejected\", failure: error };\n      }\n      throw error;\n    }\n  }\n\n  socketIoMiddleware(\n    options: { required?: boolean; instance?: string } = {},\n  ): (socket: unknown, next: (error?: Error) => void) => void {\n    return (socket, next) => {\n      void this.authenticate(socket, options).then(\n        (result) => {\n          const failure =\n            result.outcome === \"rejected\"\n              ? result.failure\n              : result.outcome === \"absent\" && options.required\n                ? AuthFailures.unauthenticated()\n                : undefined;\n          if (!failure) {\n            next();\n            return;\n          }\n          next(\n            Object.assign(new Error(failure.message), {\n              data: {\n                status: \"error\",\n                statusCode: failure.status,\n                code: failure.code,\n                ...(failure.reason ? { reason: failure.reason } : {}),\n                message: failure.message,\n              },\n            }),\n          );\n        },\n        (error: unknown) => {\n          const log = connectionErrorLog(error);\n          this.logger.error(log.message, log.stack);\n          next(\n            Object.assign(new Error(\"Internal server error\"), {\n              data: {\n                status: \"error\",\n                statusCode: 500,\n                message: \"Internal server error\",\n              },\n            }),\n          );\n        },\n      );\n    };\n  }\n}\n","import type { IncomingHttpHeaders } from \"node:http\";\nimport type { ExecutionContext } from \"@nestjs/common\";\nimport { MetadataScanner } from \"@nestjs/core\";\nimport {\n  SubscribeMessage,\n  WebSocketGateway,\n  WsException,\n} from \"@nestjs/websockets\";\nimport {\n  type AuthTransport,\n  type BootAdvice,\n  type BootAdviceContext,\n  type ExtensionDefinition,\n  type TransportCall,\n  type TransportValidationContext,\n} from \"./auth-contracts.js\";\nimport {\n  AuthFailures,\n  BetterAuthConfigurationError,\n  type AuthFailure,\n} from \"./auth-errors.js\";\nimport { EXTENSION_DEFINITION } from \"./bridge-protocol.js\";\nimport { toWebHeaders, upgradeRequestUrl } from \"./platform.js\";\nimport { WsConnectionAuth, WS_CONNECTION_AUTH } from \"./ws-connection-auth.js\";\n\nexport interface WsTransportOptions<C> {\n  /** Replaces principal credentials without changing the browser handshake used for origin checks. */\n  credentials?: (client: C) => HeadersInit | undefined;\n  /** Defaults to zero. Positive values delay revocation for non-authoritative messages. */\n  principalTtlMs?: number;\n  /** Every message handler requires explicit guard and scope coverage on every Nest major. */\n  gatewayCoverage?: \"error\" | \"warn\" | \"off\";\n}\nexport interface SocketIoClientLike {\n  readonly handshake: {\n    readonly headers: IncomingHttpHeaders;\n    readonly auth?: Record<string, unknown>;\n    readonly address?: string;\n    readonly url?: string;\n    readonly secure?: boolean;\n  };\n}\n/** Convert only mapped headers here: native Headers errors can quote the credential. */\nexport function mappedCredentialHeaders(\n  input: HeadersInit | undefined,\n): Headers {\n  const headers = new Headers();\n  if (input === undefined) {\n    return headers;\n  }\n  const malformed = () =>\n    AuthFailures.rejected({ status: 401, reason: \"MALFORMED_CREDENTIALS\" });\n  if (input === null || typeof input !== \"object\") {\n    throw malformed();\n  }\n  // Read caller-provided getters/iterators outside the conversion catch so their\n  // programming errors remain errors, as do errors thrown by the mapper itself.\n  const iterable = (input as { [Symbol.iterator]?: unknown })[Symbol.iterator];\n  if (iterable !== undefined && typeof iterable !== \"function\") {\n    throw malformed();\n  }\n  const entries: Iterable<unknown> =\n    typeof iterable === \"function\"\n      ? (input as Iterable<unknown>)\n      : Object.entries(input);\n  for (const entry of entries) {\n    if (!Array.isArray(entry) || entry.length !== 2) {\n      throw malformed();\n    }\n    const [name, value] = entry;\n    if (\n      typeof name !== \"string\" ||\n      typeof value !== \"string\" ||\n      /[\\r\\n\\0]/.test(value)\n    ) {\n      throw malformed();\n    }\n    try {\n      headers.append(name, value);\n    } catch {\n      throw malformed();\n    }\n  }\n  return headers;\n}\nexport function isSocketIo(client: unknown): client is SocketIoClientLike {\n  return typeof client === \"object\" && client !== null && \"handshake\" in client;\n}\nexport function wsException(failure: AuthFailure): WsException {\n  return new WsException({\n    status: \"error\",\n    statusCode: failure.status,\n    code: failure.code,\n    ...(failure.reason ? { reason: failure.reason } : {}),\n    message: failure.message,\n  });\n}\nexport function validateGateways(\n  context: TransportValidationContext,\n  coverage: WsTransportOptions<unknown>[\"gatewayCoverage\"],\n): void {\n  class Probe {\n    message(): void {}\n  }\n  WebSocketGateway()(Probe);\n  SubscribeMessage(\"probe\")(\n    Probe.prototype,\n    \"message\",\n    Object.getOwnPropertyDescriptor(Probe.prototype, \"message\")!,\n  );\n  if (\n    Reflect.getMetadata(\"websockets:is_gateway\", Probe) !== true ||\n    Reflect.getMetadata(\n      \"websockets:message_mapping\",\n      Probe.prototype.message,\n    ) !== true\n  ) {\n    throw new BetterAuthConfigurationError(\n      \"NEST_METADATA_KEY_CHANGED\",\n      \"Nest WebSocket gateway/message metadata failed its canary.\",\n    );\n  }\n  const scanner = new MetadataScanner();\n  for (const wrapper of context.discovery.getProviders()) {\n    const target = wrapper.metatype;\n    if (\n      !target?.prototype ||\n      wrapper.isAlias ||\n      !Reflect.getMetadata(\"websockets:is_gateway\", target)\n    ) {\n      continue;\n    }\n    for (const method of scanner.getAllMethodNames(target.prototype)) {\n      if (\n        Reflect.getMetadata(\n          \"websockets:message_mapping\",\n          target.prototype[method],\n        )\n      ) {\n        context.claim(target, method, \"explicit\", {\n          everyHandler: true,\n          code: \"GATEWAY_UNGUARDED\",\n          coverage: coverage ?? \"error\",\n          hint: `Add @UseBetterAuth() to ${target.name} (or @Public() to opt out). Global guards and interceptors do not reach gateways on NestJS 11, and this check does not depend on the version.`,\n        });\n      }\n    }\n  }\n}\nexport function quotaAdvice(\n  context: BootAdviceContext,\n  ttl: number,\n): readonly BootAdvice[] {\n  return ttl === 0 &&\n    context.sources.some((source) => source.effects?.consumesQuota)\n    ? [\n        {\n          level: \"warn\",\n          code: \"W_QUOTA_PER_MESSAGE\",\n          message:\n            \"Quota-consuming WebSocket principals verify on every message.\",\n          hint: \"Consider connection-time authentication and principalTtlMs; a positive TTL delays revocation on non-authoritative handlers.\",\n        },\n      ]\n    : [];\n}\nexport function transportDefinition(\n  transport: AuthTransport,\n): ExtensionDefinition<AuthTransport> {\n  return {\n    [EXTENSION_DEFINITION]: true,\n    use: { useFactory: () => transport },\n    providers: [\n      WsConnectionAuth,\n      { provide: WS_CONNECTION_AUTH, useExisting: WsConnectionAuth },\n    ],\n    exports: [WsConnectionAuth, WS_CONNECTION_AUTH],\n  };\n}\nexport function principalTtl(value = 0): number {\n  if (!Number.isFinite(value) || value < 0) {\n    throw new BetterAuthConfigurationError(\n      \"INVALID_WS_TTL\",\n      \"principalTtlMs must be a finite non-negative number.\",\n    );\n  }\n  return value;\n}\nexport function socketIoTransport(\n  options: WsTransportOptions<SocketIoClientLike> = {},\n): ExtensionDefinition<AuthTransport> {\n  const ttl = principalTtl(options.principalTtlMs);\n  return transportDefinition({\n    id: \"socket.io\",\n    handles: (context) =>\n      context.getType() === \"ws\" &&\n      isSocketIo(context.switchToWs().getClient()),\n    describe(context: ExecutionContext): TransportCall {\n      const client = context.switchToWs().getClient<SocketIoClientLike>();\n      const original = () => toWebHeaders(client.handshake.headers);\n      return {\n        key: context.getArgs(),\n        invocation: context.getArgs(),\n        connection: client,\n        principalTtlMs: ttl,\n        headers: () => {\n          const headers = original();\n          let mapped: HeadersInit | undefined;\n          if (options.credentials) {\n            mapped = options.credentials(client);\n          } else if (!headers.has(\"authorization\")) {\n            const token = client.handshake.auth?.token;\n            if (token !== undefined) {\n              if (typeof token !== \"string\") {\n                throw AuthFailures.rejected({\n                  status: 401,\n                  reason: \"MALFORMED_CREDENTIALS\",\n                });\n              }\n              mapped = { authorization: `Bearer ${token}` };\n            }\n          }\n          mappedCredentialHeaders(mapped).forEach((value, name) => {\n            headers.set(name, value);\n          });\n          return headers;\n        },\n        get clientIp() {\n          return client.handshake.address ?? null;\n        },\n        cookies: null,\n        get request() {\n          return { method: \"GET\", url: upgradeRequestUrl(client.handshake) };\n        },\n        param: (name) => context.switchToWs().getData()?.[name],\n        get browser() {\n          return {\n            enforce: true,\n            key: client,\n            headers: original,\n            url: upgradeRequestUrl(client.handshake),\n          };\n        },\n      };\n    },\n    toException: wsException,\n    validate: (context) => validateGateways(context, options.gatewayCoverage),\n    advise: (context) => quotaAdvice(context, ttl),\n  });\n}\n","import type { IncomingHttpHeaders } from \"node:http\";\nimport type { AuthTransport, ExtensionDefinition } from \"./auth-contracts.js\";\nimport { UPGRADE_REQUEST } from \"./bridge-protocol.js\";\nimport { BetterAuthConfigurationError } from \"./auth-errors.js\";\nimport { toWebHeaders, upgradeRequestUrl } from \"./platform.js\";\nimport {\n  isSocketIo,\n  mappedCredentialHeaders,\n  principalTtl,\n  quotaAdvice,\n  transportDefinition,\n  validateGateways,\n  wsException,\n  type WsTransportOptions,\n} from \"./socket-io-transport.js\";\n\nexport { UPGRADE_REQUEST } from \"./bridge-protocol.js\";\nexport interface WsClientLike {\n  readonly [UPGRADE_REQUEST]?: {\n    readonly headers: Headers;\n    readonly url?: string;\n    readonly remoteAddress?: string;\n    readonly encrypted?: boolean;\n  };\n}\nexport interface WsAdapterLike {\n  bindClientConnect(\n    server: unknown,\n    callback: (...args: any[]) => void,\n  ): unknown;\n}\nexport function recordUpgradeRequest(\n  client: object,\n  request: {\n    headers: IncomingHttpHeaders;\n    url?: string;\n    socket?: { remoteAddress?: string; encrypted?: boolean };\n  },\n): void {\n  Object.defineProperty(client, UPGRADE_REQUEST, {\n    value: Object.freeze({\n      headers: toWebHeaders(request.headers),\n      url: request.url,\n      remoteAddress: request.socket?.remoteAddress,\n      encrypted: request.socket?.encrypted,\n    }),\n    configurable: true,\n  });\n}\nexport function withUpgradeRequest<\n  T extends new (\n    ...args: any[]\n  ) => WsAdapterLike,\n>(Base: T): T {\n  return class extends Base {\n    override bindClientConnect(\n      server: unknown,\n      callback: (...args: any[]) => void,\n    ): unknown {\n      return super.bindClientConnect(server, (client, request, ...rest) => {\n        recordUpgradeRequest(client, request);\n        callback(client, request, ...rest);\n      });\n    }\n  };\n}\nexport function wsTransport(\n  options: WsTransportOptions<WsClientLike> = {},\n): ExtensionDefinition<AuthTransport> {\n  const ttl = principalTtl(options.principalTtlMs);\n  return transportDefinition({\n    id: \"ws\",\n    handles: (context) =>\n      context.getType() === \"ws\" &&\n      !isSocketIo(context.switchToWs().getClient()),\n    describe(context) {\n      const client = context.switchToWs().getClient<WsClientLike>();\n      const upgrade = () => {\n        const request = client[UPGRADE_REQUEST];\n        if (!request) {\n          throw BetterAuthConfigurationError.atRequest(\n            \"WS_UPGRADE_REQUEST_MISSING\",\n            \"WebSocket authentication requires its upgrade request.\",\n            {\n              hint: \"app.useWebSocketAdapter(new (withUpgradeRequest(WsAdapter))(app));\",\n            },\n          );\n        }\n        return request;\n      };\n      const url = () => {\n        const request = upgrade();\n        return upgradeRequestUrl({\n          headers: request.headers,\n          url: request.url,\n          secure: request.encrypted,\n        });\n      };\n      return {\n        key: context.getArgs(),\n        invocation: context.getArgs(),\n        connection: client,\n        principalTtlMs: ttl,\n        headers: () => {\n          const headers = new Headers(upgrade().headers);\n          mappedCredentialHeaders(options.credentials?.(client)).forEach(\n            (value, name) => {\n              headers.set(name, value);\n            },\n          );\n          return headers;\n        },\n        get clientIp() {\n          return upgrade().remoteAddress ?? null;\n        },\n        cookies: null,\n        get request() {\n          return { method: \"GET\", url: url() };\n        },\n        param: (name) => context.switchToWs().getData()?.[name],\n        get browser() {\n          return {\n            enforce: true,\n            key: client,\n            headers: () => new Headers(upgrade().headers),\n            url: url(),\n          };\n        },\n      };\n    },\n    toException: wsException,\n    validate: (context) => validateGateways(context, options.gatewayCoverage),\n    advise: (context) => quotaAdvice(context, ttl),\n  });\n}\n"],"mappings":";;;;;;;;;AA0BA,SAAgB,eAAe,SAA0C;CACvE,OAAO,QAAQ,WAAW,MAAM,OAAO,QAAQ,WAAW,MAAM,OAAO;AACzE;AAEA,MAAM,cAAc;;;;;;;AAQpB,SAAgB,mBAAmB,OAGjC;CACA,MAAM,QAAQ,UACZ,OAAO,UAAU,WAAW,QAAQ,KAAA;CACtC,IAAI;CACJ,IAAIA,oBAAAA,qBAAqB,KAAK,GAC5B,UAAU,GAAG,MAAM,KAAK,IAAI,MAAM;MAC7B,IAAIC,oBAAAA,sBAAsB,KAAK,GAAG;EACvC,MAAM,QAAQC,oBAAAA,kBAAkB,OAAO,OAAO;EAC9C,UAAU,GAAG,MAAM,QAAQ,IAAI,KAAKA,oBAAAA,kBAAkB,OAAO,MAAM,CAAC,KAAK,QAAQ,IAAI,KAAKA,oBAAAA,kBAAkB,OAAO,SAAS,CAAC,KAAK,GAAG;CACvI,OAAO;EACL,MAAM,OAAO,KAAKA,oBAAAA,kBAAkB,OAAO,MAAM,CAAC;EAClD,UAAU,GAAG,SAAS,KAAA,KAAa,iBAAiB,KAAK,IAAI,IAAI,OAAO,OAAO,MAAM;CACvF;CACA,MAAM,UAAU,KAAKA,oBAAAA,kBAAkB,OAAO,OAAO,CAAC,KAAK,GAAA,CACxD,MAAM,OAAO,CAAC,CACd,QAAQ,SAAS,YAAY,KAAK,IAAI,CAAC;CAC1C,OAAO;EACL,SAAS,+CAA+C;EACxD,OAAO,OAAO,SAAS,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,CAAC,KAAK,IAAI,IAAI,KAAA;CAC/D;AACF;;;;;;AAOA,IAAa,6BAAb,MAAoE;CAClE;CAEA,YAAY,QAAgB;EAC1B,KAAK,QAAQ,CAAC,QAAQ,KAAA,CAAS;CACjC;CAEA,UAA2D;EACzD,OAAO;CACT;;CAGA,WAAuB;EACrB,OAAO;CACT;;CAGA,aAAyD;EACvD,OAAO;CACT;CAEA,UAA8C;EAC5C,OAAO,KAAK;CACd;CAEA,cAAiB,OAAkB;EACjC,OAAO,KAAK,MAAM;CACpB;CAEA,eAA6D;EAC3D,OAAO;GACL,kBAAqB,KAAK,cAAiB,CAAC;GAC5C,mBAAsB,KAAK,cAAiB,CAAC;GAC7C,eAAkB,KAAK,cAAiB,CAAC;EAC3C;CACF;CAEA,cAA2D;EACzD,OAAO;GACL,eAAkB,KAAK,cAAiB,CAAC;GACzC,kBAAqB,KAAK,cAAiB,CAAC;EAC9C;CACF;CAEA,aAAyD;EACvD,OAAO;GACL,iBAAoB,KAAK,cAAiB,CAAC;GAC3C,eAAkB,KAAK,cAAiB,CAAC;GACzC,kBAAkB,KAAK,cAAsB,KAAK,MAAM,SAAS,CAAC;EACpE;CACF;AACF;AAGO,IAAM,mBAAN,MAAM,iBAAiB;CAIkB;CACC;CACA;CAL/C,SAA0B,IAAIC,eAAAA,OAAO,YAAY;CAEjD,YACE,WACA,UACA,YACA;EAH4C,KAAA,YAAA;EACC,KAAA,WAAA;EACA,KAAA,aAAA;CAC5C;CAEH,MAAM,aACJ,QACA,UAAiC,CAAC,GACR;EAC1B,IAAI,OAAO,WAAW,YAAY,WAAW,MAC3C,MAAMC,oBAAAA,6BAA6B,UACjC,qBACA,wDACF;EAEF,MAAM,UAAU,IAAI,2BAA2B,MAAM;EACrD,MAAM,YAAY,KAAK,WAAW,OAAO,OAAO;EAChD,MAAM,OAAO,KAAK,WAAW,SAAS,SAAS,SAAS;EACxD,MAAM,QAAQ,KAAK,UAAU,IAAI,QAAQ,YAAY,SAAS;EAC9D,MAAM,UAAU,KAAK;EACrB,IAAI,WAAW,MAAM,QAAQ,aAAa,SAAS,OAAO;GACxD,MAAM,UAAU,MAAM,MAAM,OAAO,YAAY,SAAS,QAAQ;GAChE,IAAI,SACF,OAAO;IAAE,SAAS;IAAY;GAAQ;EAE1C;EACA,MAAM,UAAU,IAAI,IAClB,MAAM,QACH,QAAQ,WAAW,OAAO,eAAe,SAAS,CAAC,CACnD,SAAS,WAAW,CAAC,GAAG,OAAO,KAAK,CAAC,CAC1C;EACA,IAAI;GACF,OAAO,MAAM,KAAK,SAAS,QAAQ,MAAM;IACvC,MAAM,MAAM;IACZ;IACA,WAAW,KAAK,UACd,MAAM,QAAQ,SAAS,QAAQ,UAC7B,OAAO,MAAM,MAAM,SAAS,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAC9D,CACF;IACA,WACE,MAAM,QAAQ,YAAY,SAC1B,MAAM,QAAQ,SAAS,cAAc,kBACjC,kBACA;GACR,CAAC;EACH,SAAS,OAAO;GACd,IAAIC,oBAAAA,cAAc,KAAK,GACrB,OAAO;IAAE,SAAS;IAAY,SAAS;GAAM;GAE/C,MAAM;EACR;CACF;CAEA,mBACE,UAAqD,CAAC,GACI;EAC1D,QAAQ,QAAQ,SAAS;GACvB,KAAU,aAAa,QAAQ,OAAO,CAAC,CAAC,MACrC,WAAW;IACV,MAAM,UACJ,OAAO,YAAY,aACf,OAAO,UACP,OAAO,YAAY,YAAY,QAAQ,WACrCC,oBAAAA,aAAa,gBAAgB,IAC7B,KAAA;IACR,IAAI,CAAC,SAAS;KACZ,KAAK;KACL;IACF;IACA,KACE,OAAO,OAAO,IAAI,MAAM,QAAQ,OAAO,GAAG,EACxC,MAAM;KACJ,QAAQ;KACR,YAAY,QAAQ;KACpB,MAAM,QAAQ;KACd,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;KACnD,SAAS,QAAQ;IACnB,EACF,CAAC,CACH;GACF,IACC,UAAmB;IAClB,MAAM,MAAM,mBAAmB,KAAK;IACpC,KAAK,OAAO,MAAM,IAAI,SAAS,IAAI,KAAK;IACxC,KACE,OAAO,uBAAO,IAAI,MAAM,uBAAuB,GAAG,EAChD,MAAM;KACJ,QAAQ;KACR,YAAY;KACZ,SAAS;IACX,EACF,CAAC,CACH;GACF,CACF;EACF;CACF;AACF;;CAlGKC,iBAAAA,gBAAAA,IAAAA,GAAAA,eAAAA,OAAAA,CAAOC,iBAAAA,iBAAiB,CAAA;CACxBD,iBAAAA,gBAAAA,IAAAA,GAAAA,eAAAA,OAAAA,CAAOE,iBAAAA,kBAAkB,CAAA;CACzBF,iBAAAA,gBAAAA,IAAAA,GAAAA,eAAAA,OAAAA,CAAOG,iBAAAA,kBAAkB,CAAA;;;;;;;;;;ACrF9B,SAAgB,wBACd,OACS;CACT,MAAM,UAAU,IAAI,QAAQ;CAC5B,IAAI,UAAU,KAAA,GACZ,OAAO;CAET,MAAM,kBACJC,oBAAAA,aAAa,SAAS;EAAE,QAAQ;EAAK,QAAQ;CAAwB,CAAC;CACxE,IAAI,UAAU,QAAQ,OAAO,UAAU,UACrC,MAAM,UAAU;CAIlB,MAAM,WAAY,MAA0C,OAAO;CACnE,IAAI,aAAa,KAAA,KAAa,OAAO,aAAa,YAChD,MAAM,UAAU;CAElB,MAAM,UACJ,OAAO,aAAa,aACf,QACD,OAAO,QAAQ,KAAK;CAC1B,KAAK,MAAM,SAAS,SAAS;EAC3B,IAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,WAAW,GAC5C,MAAM,UAAU;EAElB,MAAM,CAAC,MAAM,SAAS;EACtB,IACE,OAAO,SAAS,YAChB,OAAO,UAAU,YACjB,WAAW,KAAK,KAAK,GAErB,MAAM,UAAU;EAElB,IAAI;GACF,QAAQ,OAAO,MAAM,KAAK;EAC5B,QAAQ;GACN,MAAM,UAAU;EAClB;CACF;CACA,OAAO;AACT;AACA,SAAgB,WAAW,QAA+C;CACxE,OAAO,OAAO,WAAW,YAAY,WAAW,QAAQ,eAAe;AACzE;AACA,SAAgB,YAAY,SAAmC;CAC7D,OAAO,IAAIC,mBAAAA,YAAY;EACrB,QAAQ;EACR,YAAY,QAAQ;EACpB,MAAM,QAAQ;EACd,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;EACnD,SAAS,QAAQ;CACnB,CAAC;AACH;AACA,SAAgB,iBACd,SACA,UACM;CACN,MAAM,MAAM;EACV,UAAgB,CAAC;CACnB;CACA,CAAA,GAAA,mBAAA,iBAAA,CAAiB,CAAC,CAAC,KAAK;CACxB,CAAA,GAAA,mBAAA,iBAAA,CAAiB,OAAO,CAAC,CACvB,MAAM,WACN,WACA,OAAO,yBAAyB,MAAM,WAAW,SAAS,CAC5D;CACA,IACE,QAAQ,YAAY,yBAAyB,KAAK,MAAM,QACxD,QAAQ,YACN,8BACA,MAAM,UAAU,OAClB,MAAM,MAEN,MAAM,IAAIC,oBAAAA,6BACR,6BACA,4DACF;CAEF,MAAM,UAAU,IAAIC,aAAAA,gBAAgB;CACpC,KAAK,MAAM,WAAW,QAAQ,UAAU,aAAa,GAAG;EACtD,MAAM,SAAS,QAAQ;EACvB,IACE,CAAC,QAAQ,aACT,QAAQ,WACR,CAAC,QAAQ,YAAY,yBAAyB,MAAM,GAEpD;EAEF,KAAK,MAAM,UAAU,QAAQ,kBAAkB,OAAO,SAAS,GAC7D,IACE,QAAQ,YACN,8BACA,OAAO,UAAU,OACnB,GAEA,QAAQ,MAAM,QAAQ,QAAQ,YAAY;GACxC,cAAc;GACd,MAAM;GACN,UAAU,YAAY;GACtB,MAAM,2BAA2B,OAAO,KAAK;EAC/C,CAAC;CAGP;AACF;AACA,SAAgB,YACd,SACA,KACuB;CACvB,OAAO,QAAQ,KACb,QAAQ,QAAQ,MAAM,WAAW,OAAO,SAAS,aAAa,IAC5D,CACE;EACE,OAAO;EACP,MAAM;EACN,SACE;EACF,MAAM;CACR,CACF,IACA,CAAC;AACP;AACA,SAAgB,oBACd,WACoC;CACpC,OAAO;GACJC,wBAAAA,uBAAuB;EACxB,KAAK,EAAE,kBAAkB,UAAU;EACnC,WAAW,CACT,kBACA;GAAE,SAASC,iBAAAA;GAAoB,aAAa;EAAiB,CAC/D;EACA,SAAS,CAAC,kBAAkBA,iBAAAA,kBAAkB;CAChD;AACF;AACA,SAAgB,aAAa,QAAQ,GAAW;CAC9C,IAAI,CAAC,OAAO,SAAS,KAAK,KAAK,QAAQ,GACrC,MAAM,IAAIH,oBAAAA,6BACR,kBACA,sDACF;CAEF,OAAO;AACT;AACA,SAAgB,kBACd,UAAkD,CAAC,GACf;CACpC,MAAM,MAAM,aAAa,QAAQ,cAAc;CAC/C,OAAO,oBAAoB;EACzB,IAAI;EACJ,UAAU,YACR,QAAQ,QAAQ,MAAM,QACtB,WAAW,QAAQ,WAAW,CAAC,CAAC,UAAU,CAAC;EAC7C,SAAS,SAA0C;GACjD,MAAM,SAAS,QAAQ,WAAW,CAAC,CAAC,UAA8B;GAClE,MAAM,iBAAiBI,iBAAAA,aAAa,OAAO,UAAU,OAAO;GAC5D,OAAO;IACL,KAAK,QAAQ,QAAQ;IACrB,YAAY,QAAQ,QAAQ;IAC5B,YAAY;IACZ,gBAAgB;IAChB,eAAe;KACb,MAAM,UAAU,SAAS;KACzB,IAAI;KACJ,IAAI,QAAQ,aACV,SAAS,QAAQ,YAAY,MAAM;UAC9B,IAAI,CAAC,QAAQ,IAAI,eAAe,GAAG;MACxC,MAAM,QAAQ,OAAO,UAAU,MAAM;MACrC,IAAI,UAAU,KAAA,GAAW;OACvB,IAAI,OAAO,UAAU,UACnB,MAAMN,oBAAAA,aAAa,SAAS;QAC1B,QAAQ;QACR,QAAQ;OACV,CAAC;OAEH,SAAS,EAAE,eAAe,UAAU,QAAQ;MAC9C;KACF;KACA,wBAAwB,MAAM,CAAC,CAAC,SAAS,OAAO,SAAS;MACvD,QAAQ,IAAI,MAAM,KAAK;KACzB,CAAC;KACD,OAAO;IACT;IACA,IAAI,WAAW;KACb,OAAO,OAAO,UAAU,WAAW;IACrC;IACA,SAAS;IACT,IAAI,UAAU;KACZ,OAAO;MAAE,QAAQ;MAAO,KAAKO,iBAAAA,kBAAkB,OAAO,SAAS;KAAE;IACnE;IACA,QAAQ,SAAS,QAAQ,WAAW,CAAC,CAAC,QAAQ,CAAC,GAAG;IAClD,IAAI,UAAU;KACZ,OAAO;MACL,SAAS;MACT,KAAK;MACL,SAAS;MACT,KAAKA,iBAAAA,kBAAkB,OAAO,SAAS;KACzC;IACF;GACF;EACF;EACA,aAAa;EACb,WAAW,YAAY,iBAAiB,SAAS,QAAQ,eAAe;EACxE,SAAS,YAAY,YAAY,SAAS,GAAG;CAC/C,CAAC;AACH;;;AC1NA,SAAgB,qBACd,QACA,SAKM;CACN,OAAO,eAAe,QAAQC,wBAAAA,iBAAiB;EAC7C,OAAO,OAAO,OAAO;GACnB,SAASC,iBAAAA,aAAa,QAAQ,OAAO;GACrC,KAAK,QAAQ;GACb,eAAe,QAAQ,QAAQ;GAC/B,WAAW,QAAQ,QAAQ;EAC7B,CAAC;EACD,cAAc;CAChB,CAAC;AACH;AACA,SAAgB,mBAId,MAAY;CACZ,OAAO,cAAc,KAAK;EACxB,kBACE,QACA,UACS;GACT,OAAO,MAAM,kBAAkB,SAAS,QAAQ,SAAS,GAAG,SAAS;IACnE,qBAAqB,QAAQ,OAAO;IACpC,SAAS,QAAQ,SAAS,GAAG,IAAI;GACnC,CAAC;EACH;CACF;AACF;AACA,SAAgB,YACd,UAA4C,CAAC,GACT;CACpC,MAAM,MAAM,aAAa,QAAQ,cAAc;CAC/C,OAAO,oBAAoB;EACzB,IAAI;EACJ,UAAU,YACR,QAAQ,QAAQ,MAAM,QACtB,CAAC,WAAW,QAAQ,WAAW,CAAC,CAAC,UAAU,CAAC;EAC9C,SAAS,SAAS;GAChB,MAAM,SAAS,QAAQ,WAAW,CAAC,CAAC,UAAwB;GAC5D,MAAM,gBAAgB;IACpB,MAAM,UAAU,OAAOD,wBAAAA;IACvB,IAAI,CAAC,SACH,MAAME,oBAAAA,6BAA6B,UACjC,8BACA,0DACA,EACE,MAAM,qEACR,CACF;IAEF,OAAO;GACT;GACA,MAAM,YAAY;IAChB,MAAM,UAAU,QAAQ;IACxB,OAAOC,iBAAAA,kBAAkB;KACvB,SAAS,QAAQ;KACjB,KAAK,QAAQ;KACb,QAAQ,QAAQ;IAClB,CAAC;GACH;GACA,OAAO;IACL,KAAK,QAAQ,QAAQ;IACrB,YAAY,QAAQ,QAAQ;IAC5B,YAAY;IACZ,gBAAgB;IAChB,eAAe;KACb,MAAM,UAAU,IAAI,QAAQ,QAAQ,CAAC,CAAC,OAAO;KAC7C,wBAAwB,QAAQ,cAAc,MAAM,CAAC,CAAC,CAAC,SACpD,OAAO,SAAS;MACf,QAAQ,IAAI,MAAM,KAAK;KACzB,CACF;KACA,OAAO;IACT;IACA,IAAI,WAAW;KACb,OAAO,QAAQ,CAAC,CAAC,iBAAiB;IACpC;IACA,SAAS;IACT,IAAI,UAAU;KACZ,OAAO;MAAE,QAAQ;MAAO,KAAK,IAAI;KAAE;IACrC;IACA,QAAQ,SAAS,QAAQ,WAAW,CAAC,CAAC,QAAQ,CAAC,GAAG;IAClD,IAAI,UAAU;KACZ,OAAO;MACL,SAAS;MACT,KAAK;MACL,eAAe,IAAI,QAAQ,QAAQ,CAAC,CAAC,OAAO;MAC5C,KAAK,IAAI;KACX;IACF;GACF;EACF;EACA,aAAa;EACb,WAAW,YAAY,iBAAiB,SAAS,QAAQ,eAAe;EACxE,SAAS,YAAY,YAAY,SAAS,GAAG;CAC/C,CAAC;AACH"}

package/dist/websockets.d.cts

@@ -0,0 +1,67 @@
+import { Bn as WS_CONNECTION_AUTH, F as ExtensionDefinition, Mn as InstanceLookup, Pn as UPGRADE_REQUEST, c as AuthTransport, jn as TransportRegistry, nt as PrincipalResolver, qn as AuthFailure, rt as PrincipalResult } from "./auth-contracts-Brh_Qko9.cjs";
+import { IncomingHttpHeaders } from "node:http";
+import { ExecutionContext, Type } from "@nestjs/common";
+import "@nestjs/websockets";
+//#region src/socket-io-transport.d.ts
+interface WsTransportOptions<C> {
+  /** Replaces principal credentials without changing the browser handshake used for origin checks. */
+  credentials?: (client: C) => HeadersInit | undefined;
+  /** Defaults to zero. Positive values delay revocation for non-authoritative messages. */
+  principalTtlMs?: number;
+  /** Every message handler requires explicit guard and scope coverage on every Nest major. */
+  gatewayCoverage?: "error" | "warn" | "off";
+}
+interface SocketIoClientLike {
+  readonly handshake: {
+    readonly headers: IncomingHttpHeaders;
+    readonly auth?: Record<string, unknown>;
+    readonly address?: string;
+    readonly url?: string;
+    readonly secure?: boolean;
+  };
+}
+export declare function socketIoTransport(options?: WsTransportOptions<SocketIoClientLike>): ExtensionDefinition<AuthTransport>;
+//#endregion
+//#region src/ws-transport.d.ts
+interface WsClientLike {
+  readonly [UPGRADE_REQUEST]?: {
+    readonly headers: Headers;
+    readonly url?: string;
+    readonly remoteAddress?: string;
+    readonly encrypted?: boolean;
+  };
+}
+interface WsAdapterLike {
+  bindClientConnect(server: unknown, callback: (...args: any[]) => void): unknown;
+}
+export declare function recordUpgradeRequest(client: object, request: {
+  headers: IncomingHttpHeaders;
+  url?: string;
+  socket?: {
+    remoteAddress?: string;
+    encrypted?: boolean;
+  };
+}): void;
+export declare function withUpgradeRequest<T extends new (...args: any[]) => WsAdapterLike>(Base: T): T;
+export declare function wsTransport(options?: WsTransportOptions<WsClientLike>): ExtensionDefinition<AuthTransport>;
+//#endregion
+//#region src/ws-connection-auth.d.ts
+export declare function wsCloseCodeFor(failure: AuthFailure): 4401 | 4403 | 4429;
+/** Connection authentication delegates to the same origin and principal kernel as messages. */
+export declare class WsConnectionAuth {
+  private readonly instances;
+  private readonly resolver;
+  private readonly transports;
+  private readonly logger;
+  constructor(instances: InstanceLookup, resolver: PrincipalResolver, transports: TransportRegistry);
+  authenticate(client: unknown, options?: {
+    instance?: string;
+  }): Promise<PrincipalResult>;
+  socketIoMiddleware(options?: {
+    required?: boolean;
+    instance?: string;
+  }): (socket: unknown, next: (error?: Error) => void) => void;
+}
+//#endregion
+export { type SocketIoClientLike, UPGRADE_REQUEST, WS_CONNECTION_AUTH, type WsAdapterLike, type WsClientLike, type WsTransportOptions };
+//# sourceMappingURL=websockets.d.cts.map

package/dist/websockets.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"websockets.d.cts","names":[],"sources":["../src/socket-io-transport.ts","../src/ws-transport.ts","../src/ws-connection-auth.ts"],"mappings":";;;;;UAyBiB,mBAAmB;;EAElC,eAAe,QAAQ,MAAM;;EAE7B;;EAEA;;UAEe;WACN;aACE,SAAS;aACT,OAAO;aACP;aACA;aACA;;;wBAqJG,kBACd,UAAS,mBAAmB,sBAC3B,oBAAoB;;;UC7KN;YACL;aACC,SAAS;aACT;aACA;aACA;;;UAGI;EACf,kBACE,iBACA,cAAc;;wBAGF,qBACd,gBACA;EACE,SAAS;EACT;EACA;IAAW;IAAwB;;;wBAavB,mBACd,kBACK,gBACA,eACL,MAAM,IAAI;wBAaI,YACd,UAAS,mBAAmB,gBAC3B,oBAAoB;;;wBC1CP,eAAe,SAAS;;qBAgG3B;mBAImC;mBACC;mBACA;mBAL9B;EAEjB,YAC8C,WAAW,gBACV,UAAU,mBACV,YAAY;EAGrD,aACJ,iBACA;IAAW;MACV,QAAQ;EA8CX,mBACE;IAAW;IAAoB;OAC7B,iBAAiB,OAAO,QAAQ"}

package/dist/websockets.d.mts

@@ -0,0 +1,67 @@
+import { Bn as WS_CONNECTION_AUTH, F as ExtensionDefinition, Mn as InstanceLookup, Pn as UPGRADE_REQUEST, c as AuthTransport, jn as TransportRegistry, nt as PrincipalResolver, qn as AuthFailure, rt as PrincipalResult } from "./auth-contracts-Cz7C4_Ch.mjs";
+import { ExecutionContext, Type } from "@nestjs/common";
+import { IncomingHttpHeaders } from "node:http";
+import { WsException } from "@nestjs/websockets";
+//#region src/socket-io-transport.d.ts
+interface WsTransportOptions<C> {
+  /** Replaces principal credentials without changing the browser handshake used for origin checks. */
+  credentials?: (client: C) => HeadersInit | undefined;
+  /** Defaults to zero. Positive values delay revocation for non-authoritative messages. */
+  principalTtlMs?: number;
+  /** Every message handler requires explicit guard and scope coverage on every Nest major. */
+  gatewayCoverage?: "error" | "warn" | "off";
+}
+interface SocketIoClientLike {
+  readonly handshake: {
+    readonly headers: IncomingHttpHeaders;
+    readonly auth?: Record<string, unknown>;
+    readonly address?: string;
+    readonly url?: string;
+    readonly secure?: boolean;
+  };
+}
+export declare function socketIoTransport(options?: WsTransportOptions<SocketIoClientLike>): ExtensionDefinition<AuthTransport>;
+//#endregion
+//#region src/ws-transport.d.ts
+interface WsClientLike {
+  readonly [UPGRADE_REQUEST]?: {
+    readonly headers: Headers;
+    readonly url?: string;
+    readonly remoteAddress?: string;
+    readonly encrypted?: boolean;
+  };
+}
+interface WsAdapterLike {
+  bindClientConnect(server: unknown, callback: (...args: any[]) => void): unknown;
+}
+export declare function recordUpgradeRequest(client: object, request: {
+  headers: IncomingHttpHeaders;
+  url?: string;
+  socket?: {
+    remoteAddress?: string;
+    encrypted?: boolean;
+  };
+}): void;
+export declare function withUpgradeRequest<T extends new (...args: any[]) => WsAdapterLike>(Base: T): T;
+export declare function wsTransport(options?: WsTransportOptions<WsClientLike>): ExtensionDefinition<AuthTransport>;
+//#endregion
+//#region src/ws-connection-auth.d.ts
+export declare function wsCloseCodeFor(failure: AuthFailure): 4401 | 4403 | 4429;
+/** Connection authentication delegates to the same origin and principal kernel as messages. */
+export declare class WsConnectionAuth {
+  private readonly instances;
+  private readonly resolver;
+  private readonly transports;
+  private readonly logger;
+  constructor(instances: InstanceLookup, resolver: PrincipalResolver, transports: TransportRegistry);
+  authenticate(client: unknown, options?: {
+    instance?: string;
+  }): Promise<PrincipalResult>;
+  socketIoMiddleware(options?: {
+    required?: boolean;
+    instance?: string;
+  }): (socket: unknown, next: (error?: Error) => void) => void;
+}
+//#endregion
+export { type SocketIoClientLike, UPGRADE_REQUEST, WS_CONNECTION_AUTH, type WsAdapterLike, type WsClientLike, type WsTransportOptions };
+//# sourceMappingURL=websockets.d.mts.map

package/dist/websockets.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"websockets.d.mts","names":[],"sources":["../src/socket-io-transport.ts","../src/ws-transport.ts","../src/ws-connection-auth.ts"],"mappings":";;;;;UAyBiB,mBAAmB;;EAElC,eAAe,QAAQ,MAAM;;EAE7B;;EAEA;;UAEe;WACN;aACE,SAAS;aACT,OAAO;aACP;aACA;aACA;;;wBAqJG,kBACd,UAAS,mBAAmB,sBAC3B,oBAAoB;;;UC7KN;YACL;aACC,SAAS;aACT;aACA;aACA;;;UAGI;EACf,kBACE,iBACA,cAAc;;wBAGF,qBACd,gBACA;EACE,SAAS;EACT;EACA;IAAW;IAAwB;;;wBAavB,mBACd,kBACK,gBACA,eACL,MAAM,IAAI;wBAaI,YACd,UAAS,mBAAmB,gBAC3B,oBAAoB;;;wBC1CP,eAAe,SAAS;;qBAgG3B;mBAImC;mBACC;mBACA;mBAL9B;EAEjB,YAC8C,WAAW,gBACV,UAAU,mBACV,YAAY;EAGrD,aACJ,iBACA;IAAW;MACV,QAAQ;EA8CX,mBACE;IAAW;IAAoB;OAC7B,iBAAiB,OAAO,QAAQ"}