@nestjs-kit/better-auth 2.0.0 → 2.1.2

package/dist/{auth-errors-C3rbTV9p.mjs.map → auth-errors-JjxGDVSt.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"auth-errors-C3rbTV9p.mjs","names":[],"sources":["../src/error-redactor.ts","../src/auth-errors.ts"],"sourcesContent":["/** Inputs come from the active request's owner; the redactor retains no scope. */\nexport interface ErrorRedactorOptions {\n  secrets?: readonly string[];\n  headers?: Headers;\n  credentialHeaders?: readonly string[];\n}\n\n/** Reading an arbitrary thrown value must not invoke another escaping fault. */\nexport function readErrorProperty(value: unknown, key: PropertyKey): unknown {\n  if (\n    (typeof value !== \"object\" || value === null) &&\n    typeof value !== \"function\"\n  ) {\n    return undefined;\n  }\n  try {\n    return Reflect.get(value, key);\n  } catch {\n    return undefined;\n  }\n}\n\nexport class ErrorRedactor {\n  readonly #secrets: readonly string[];\n\n  constructor(options: ErrorRedactorOptions = {}) {\n    const values = new Set<string>();\n    const add = (value: string) => {\n      if (!value) {\n        return;\n      }\n      values.add(value);\n      let decoded = value;\n      try {\n        decoded = decodeURIComponent(value);\n        values.add(decoded);\n      } catch {\n        // Invalid escaping must not prevent redaction of the raw credential.\n      }\n      for (const form of [value, decoded]) {\n        const separator = form.lastIndexOf(\".\");\n        if (separator >= 16) {\n          values.add(form.slice(0, separator));\n        }\n      }\n    };\n    for (const value of options.secrets ?? []) {\n      add(value);\n    }\n    const headers = options.headers;\n    for (const cookie of (headers?.get(\"cookie\") ?? \"\").split(\";\")) {\n      const separator = cookie.indexOf(\"=\");\n      if (separator >= 0) {\n        const value = cookie.slice(separator + 1).trim();\n        add(value);\n        if (value.startsWith('\"') && value.endsWith('\"')) {\n          add(value.slice(1, -1));\n        }\n      }\n    }\n    const authorization = headers?.get(\"authorization\");\n    if (authorization) {\n      add(authorization);\n      const credential = /^\\S+\\s+(.+)$/.exec(authorization)?.[1];\n      if (credential) {\n        add(credential);\n      }\n    }\n    for (const name of options.credentialHeaders ?? []) {\n      const value = headers?.get(name);\n      if (value) {\n        add(value);\n      }\n    }\n    this.#secrets = [...values].sort(\n      (left, right) => right.length - left.length,\n    );\n  }\n\n  redact(cause: unknown): Error {\n    return this.redactCause(cause, 0, new Set());\n  }\n\n  private replaceSecrets(value: string): string {\n    for (const secret of this.#secrets) {\n      value = value.split(secret).join(\"[REDACTED]\");\n    }\n    return value;\n  }\n\n  private diagnostic(value: string): string {\n    return this.replaceSecrets(value)\n      .split(/[\\r\\n]/, 1)[0]\n      .slice(0, 300);\n  }\n\n  private redactCause(\n    cause: unknown,\n    depth: number,\n    seen: Set<unknown>,\n  ): Error {\n    const message = readErrorProperty(cause, \"message\");\n    const error = new Error(\n      this.diagnostic(\n        typeof message === \"string\"\n          ? message\n          : typeof cause === \"string\"\n            ? cause\n            : \"Unknown authentication infrastructure failure\",\n      ),\n    );\n    const name = readErrorProperty(cause, \"name\");\n    error.name = typeof name === \"string\" ? this.diagnostic(name) : \"Error\";\n    for (const key of [\"code\", \"errno\", \"syscall\"] as const) {\n      const value = readErrorProperty(cause, key);\n      if (\n        typeof value === \"string\" ||\n        (typeof value === \"number\" && Number.isFinite(value))\n      ) {\n        Object.defineProperty(error, key, {\n          value: typeof value === \"string\" ? this.diagnostic(value) : value,\n          enumerable: true,\n        });\n      }\n    }\n    const stack = readErrorProperty(cause, \"stack\");\n    const frames =\n      typeof stack === \"string\"\n        ? stack\n            .split(/\\r?\\n/)\n            .filter((line) => /^\\s+at .+:\\d+:\\d+\\)?$/.test(line))\n            .map((line) => this.replaceSecrets(line))\n        : [];\n    error.stack = [`${error.name}: ${error.message}`, ...frames].join(\"\\n\");\n    seen.add(cause);\n    const nested = readErrorProperty(cause, \"cause\");\n    if (nested !== undefined && depth < 3 && !seen.has(nested)) {\n      Object.defineProperty(error, \"cause\", {\n        value: this.redactCause(nested, depth + 1, seen),\n        enumerable: false,\n      });\n    }\n    return error;\n  }\n}\n","import type { ExecutionContext } from \"@nestjs/common\";\nimport { isAPIError } from \"better-auth/api\";\nimport {\n  ErrorRedactor,\n  type ErrorRedactorOptions,\n  readErrorProperty,\n} from \"./error-redactor.js\";\n\nconst FAILURE_BRAND = Symbol.for(\"@nestjs-kit/better-auth:auth-failure\");\nconst INFRASTRUCTURE_BRAND = Symbol.for(\n  \"@nestjs-kit/better-auth:infrastructure-error\",\n);\nconst CONFIGURATION_BRAND = Symbol.for(\n  \"@nestjs-kit/better-auth:configuration-error\",\n);\nconst RAW_CAUSE = Symbol.for(\"@nestjs-kit/better-auth:raw-cause\");\n/** Unredacted causes stay module-private; only an instance's exposeRawCause opt-in attaches one (RAW_CAUSE). */\nconst ORIGINAL_CAUSES = new WeakMap<object, unknown>();\nconst SDK_HEADERS = Symbol.for(\"better-call:api-error-headers\");\n\nexport type AuthErrorCode = \"UNAUTHENTICATED\" | \"FORBIDDEN\" | \"RATE_LIMITED\";\n\n/** A transport-neutral denial. Only transports make it throwable. */\nexport interface AuthFailure {\n  readonly status: 401 | 403 | 429;\n  readonly code: AuthErrorCode;\n  readonly reason?: string;\n  readonly message: string;\n  readonly challenge?: string;\n  readonly headers?: Headers;\n}\n\nexport interface AuthErrorBody {\n  statusCode: 401 | 403 | 429;\n  error: string;\n  code: AuthErrorCode;\n  reason?: string;\n  message: string;\n}\n\nexport interface AuthGraphqlExtensions {\n  code: AuthErrorCode | \"INTERNAL_SERVER_ERROR\";\n  reason?: string;\n  statusCode: number;\n}\n\nexport interface AuthTransportErrorPayload {\n  status: \"error\";\n  statusCode: number;\n  code: AuthErrorCode;\n  reason?: string;\n  message: string;\n}\n\nexport interface ErrorMappingOptions {\n  map?: (\n    failure: AuthFailure,\n    context: ExecutionContext,\n    transport: string,\n  ) => unknown;\n  exposeRawCause?: boolean;\n}\n\nfunction branded<T extends object>(value: T, brand: symbol): T {\n  Object.defineProperty(value, brand, { value: true });\n  return value;\n}\n\nexport function isAuthFailure(value: unknown): value is AuthFailure {\n  return readErrorProperty(value, FAILURE_BRAND) === true;\n}\n\nexport function isInfrastructureError(\n  value: unknown,\n): value is BetterAuthInfrastructureError {\n  return readErrorProperty(value, INFRASTRUCTURE_BRAND) === true;\n}\n\nexport function isConfigurationError(\n  value: unknown,\n): value is BetterAuthConfigurationError {\n  return readErrorProperty(value, CONFIGURATION_BRAND) === true;\n}\n\nfunction sdkStatus(error: unknown): number | undefined {\n  try {\n    if (!isAPIError(error)) {\n      return undefined;\n    }\n    const status = readErrorProperty(error, \"statusCode\");\n    return typeof status === \"number\" &&\n      Number.isInteger(status) &&\n      status >= 100 &&\n      status <= 599\n      ? status\n      : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction sdkReason(error: unknown): string | undefined {\n  const reason = readErrorProperty(readErrorProperty(error, \"body\"), \"code\");\n  return typeof reason === \"string\" ? reason : undefined;\n}\n\n/** Internal: preserve cookie lines for the exchange's separately governed cleanup. */\nexport function getAPIErrorHeaders(error: unknown): Headers {\n  const result = new Headers();\n  for (const value of [\n    readErrorProperty(error, SDK_HEADERS),\n    readErrorProperty(error, \"headers\"),\n  ]) {\n    if (value === undefined || value === null) {\n      continue;\n    }\n    try {\n      const headers = new Headers(value as HeadersInit);\n      for (const [name, value] of headers) {\n        if (name !== \"set-cookie\") {\n          result.set(name, value);\n        }\n      }\n      for (const cookie of headers.getSetCookie()) {\n        result.append(\"set-cookie\", cookie);\n      }\n    } catch {\n      // A malformed optional header collection must not mask the original fault.\n    }\n  }\n  return result;\n}\n\nfunction rejection(input: {\n  status: 401 | 403 | 429;\n  reason?: string;\n  message?: string;\n  challenge?: string;\n  retryAfterSeconds?: number;\n}): AuthFailure {\n  const codes = {\n    401: \"UNAUTHENTICATED\",\n    403: \"FORBIDDEN\",\n    429: \"RATE_LIMITED\",\n  } as const;\n  const messages = {\n    401: \"Unauthorized\",\n    403: \"Forbidden\",\n    429: \"Too Many Requests\",\n  } as const;\n  const headers = new Headers();\n  const retry = input.retryAfterSeconds;\n  if (retry !== undefined && Number.isFinite(retry) && retry >= 0) {\n    headers.set(\"retry-after\", String(Math.ceil(retry)));\n  }\n  return branded(\n    {\n      status: input.status,\n      code: codes[input.status],\n      reason: input.reason,\n      message: input.message ?? messages[input.status],\n      challenge: input.challenge,\n      ...(headers.has(\"retry-after\") ? { headers } : {}),\n    },\n    FAILURE_BRAND,\n  );\n}\n\nexport const AuthFailures = {\n  unauthenticated(message?: string): AuthFailure {\n    return rejection({ status: 401, message });\n  },\n  rejected: rejection,\n  forbidden(reason: string, message?: string): AuthFailure {\n    return rejection({ status: 403, reason, message });\n  },\n  fromAPIError(error: unknown): AuthFailure | null {\n    const status = sdkStatus(error);\n    if (status !== 401 && status !== 403 && status !== 429) {\n      return null;\n    }\n    const originalHeaders = getAPIErrorHeaders(error);\n    const details = readErrorProperty(\n      readErrorProperty(error, \"body\"),\n      \"details\",\n    );\n    const delay = readErrorProperty(details, \"tryAgainIn\");\n    const failure = rejection({\n      status,\n      reason: sdkReason(error),\n      challenge: originalHeaders.get(\"www-authenticate\") ?? undefined,\n      retryAfterSeconds:\n        status === 429 && typeof delay === \"number\" ? delay / 1000 : undefined,\n    });\n    const retryAfter = originalHeaders.get(\"retry-after\");\n    if (retryAfter !== null) {\n      const headers = new Headers(failure.headers);\n      headers.set(\"retry-after\", retryAfter);\n      return branded({ ...failure, headers }, FAILURE_BRAND);\n    }\n    return failure;\n  },\n};\n\nexport class BetterAuthConfigurationError extends Error {\n  readonly code: string;\n  readonly detail: string;\n  readonly site?: string;\n  readonly hint?: string;\n  readonly phase: \"boot\" | \"request\";\n  readonly extensions = {\n    code: \"INTERNAL_SERVER_ERROR\",\n    reason: \"AUTH_MISCONFIGURED\",\n    statusCode: 500,\n  } as const;\n  readonly issues?: readonly BetterAuthConfigurationError[];\n\n  constructor(code: string, detail: string, hint?: string) {\n    super(detail);\n    this.name = \"BetterAuthConfigurationError\";\n    this.code = code;\n    this.detail = detail;\n    this.hint = hint;\n    this.phase = \"boot\";\n    branded(this, CONFIGURATION_BRAND);\n  }\n\n  static atRequest(\n    code: string,\n    detail: string,\n    options?: { site?: string; hint?: string },\n  ): BetterAuthConfigurationError {\n    const error = new BetterAuthConfigurationError(\n      code,\n      \"Authentication is misconfigured\",\n      options?.hint,\n    );\n    Object.defineProperties(error, {\n      detail: { value: detail, enumerable: true },\n      site: { value: options?.site, enumerable: true },\n      phase: { value: \"request\", enumerable: true },\n    });\n    return error;\n  }\n}\n\nexport class BetterAuthInfrastructureError extends Error {\n  readonly cause: Error;\n  readonly extensions = {\n    code: \"INTERNAL_SERVER_ERROR\",\n    reason: \"AUTH_UNAVAILABLE\",\n    statusCode: 500,\n  } as const;\n\n  constructor(cause: unknown, options?: { secrets?: readonly string[] }) {\n    super(\"Authentication service unavailable\");\n    this.name = \"BetterAuthInfrastructureError\";\n    this.cause = new ErrorRedactor(options).redact(cause);\n    ORIGINAL_CAUSES.set(this, cause);\n    branded(this, INFRASTRUCTURE_BRAND);\n  }\n}\n\n/** Internal factory for an instance's explicit diagnostic opt-in, never global state. */\nexport function createInfrastructureError(\n  cause: unknown,\n  options?: ErrorRedactorOptions & { exposeRawCause?: boolean },\n): BetterAuthInfrastructureError {\n  // Preserve request-owned redaction inputs without widening the public constructor.\n  const error = new BetterAuthInfrastructureError(cause, options);\n  if (options?.exposeRawCause === true) {\n    Object.defineProperty(error, RAW_CAUSE, {\n      value: cause,\n      enumerable: false,\n    });\n  }\n  return error;\n}\n\n/**\n * Internal: the form of an already-classified infrastructure error that one request delivers. The request's cookie,\n * authorization and declared credential values are redacted on top of the thrower's own redaction, and the original\n * cause is attached only when the instance opts in, as for errors the kernel classifies itself.\n */\nexport function redactForRequest(\n  error: BetterAuthInfrastructureError,\n  options: ErrorRedactorOptions & { exposeRawCause?: boolean },\n): BetterAuthInfrastructureError {\n  const original = ORIGINAL_CAUSES.has(error)\n    ? ORIGINAL_CAUSES.get(error)\n    : readErrorProperty(error, RAW_CAUSE);\n  const delivered = new BetterAuthInfrastructureError(\n    readErrorProperty(error, \"cause\"),\n    options,\n  );\n  ORIGINAL_CAUSES.set(delivered, original);\n  if (options.exposeRawCause === true && original !== undefined) {\n    Object.defineProperty(delivered, RAW_CAUSE, {\n      value: original,\n      enumerable: false,\n    });\n  }\n  return delivered;\n}\n\nexport function getRawCause(error: BetterAuthInfrastructureError): unknown {\n  return readErrorProperty(error, RAW_CAUSE);\n}\n\n/** Internal: evaluation must distinguish session loss from a failed session read. */\nexport interface SessionLossCandidate {\n  readonly sessionLoss: unknown;\n  readonly reason?: string;\n}\n\n/** Internal safety net. Evaluation performs the authoritative session-loss recheck. */\nexport function normalizeThrown(\n  error: unknown,\n  where: \"source\" | \"policy\",\n  site: string,\n  secrets: readonly string[],\n  options?: { exposeRawCause?: boolean },\n): AuthFailure | SessionLossCandidate {\n  if (isAuthFailure(error)) {\n    return error;\n  }\n  if (isInfrastructureError(error) || isConfigurationError(error)) {\n    throw error;\n  }\n  const status = sdkStatus(error);\n  const reason = sdkReason(error);\n  if (status === 429) {\n    return AuthFailures.fromAPIError(error)!;\n  }\n  if (\n    status === 401 &&\n    where === \"policy\" &&\n    (reason === undefined || reason === \"UNAUTHORIZED\")\n  ) {\n    return { sessionLoss: error, reason };\n  }\n  if (status === 401 || status === 403) {\n    return where === \"source\"\n      ? AuthFailures.fromAPIError(error)!\n      : AuthFailures.forbidden(reason ?? \"FORBIDDEN\");\n  }\n  if (status !== undefined && status < 500) {\n    throw BetterAuthConfigurationError.atRequest(\n      \"BETTER_AUTH_REJECTED_CALL\",\n      `better-auth rejected the library's call (${status} ${reason})`,\n      { site },\n    );\n  }\n  throw createInfrastructureError(error, {\n    secrets,\n    exposeRawCause: options?.exposeRawCause,\n  });\n}\n"],"mappings":";;;AAQA,SAAgB,kBAAkB,OAAgB,KAA2B;CAC3E,KACG,OAAO,UAAU,YAAY,UAAU,SACxC,OAAO,UAAU,YAEjB;CAEF,IAAI;EACF,OAAO,QAAQ,IAAI,OAAO,GAAG;CAC/B,QAAQ;EACN;CACF;AACF;AAEA,IAAa,gBAAb,MAA2B;CACzB;CAEA,YAAY,UAAgC,CAAC,GAAG;EAC9C,MAAM,yBAAS,IAAI,IAAY;EAC/B,MAAM,OAAO,UAAkB;GAC7B,IAAI,CAAC,OACH;GAEF,OAAO,IAAI,KAAK;GAChB,IAAI,UAAU;GACd,IAAI;IACF,UAAU,mBAAmB,KAAK;IAClC,OAAO,IAAI,OAAO;GACpB,QAAQ,CAER;GACA,KAAK,MAAM,QAAQ,CAAC,OAAO,OAAO,GAAG;IACnC,MAAM,YAAY,KAAK,YAAY,GAAG;IACtC,IAAI,aAAa,IACf,OAAO,IAAI,KAAK,MAAM,GAAG,SAAS,CAAC;GAEvC;EACF;EACA,KAAK,MAAM,SAAS,QAAQ,WAAW,CAAC,GACtC,IAAI,KAAK;EAEX,MAAM,UAAU,QAAQ;EACxB,KAAK,MAAM,WAAW,SAAS,IAAI,QAAQ,KAAK,GAAA,CAAI,MAAM,GAAG,GAAG;GAC9D,MAAM,YAAY,OAAO,QAAQ,GAAG;GACpC,IAAI,aAAa,GAAG;IAClB,MAAM,QAAQ,OAAO,MAAM,YAAY,CAAC,CAAC,CAAC,KAAK;IAC/C,IAAI,KAAK;IACT,IAAI,MAAM,WAAW,IAAG,KAAK,MAAM,SAAS,IAAG,GAC7C,IAAI,MAAM,MAAM,GAAG,EAAE,CAAC;GAE1B;EACF;EACA,MAAM,gBAAgB,SAAS,IAAI,eAAe;EAClD,IAAI,eAAe;GACjB,IAAI,aAAa;GACjB,MAAM,aAAa,eAAe,KAAK,aAAa,CAAC,GAAG;GACxD,IAAI,YACF,IAAI,UAAU;EAElB;EACA,KAAK,MAAM,QAAQ,QAAQ,qBAAqB,CAAC,GAAG;GAClD,MAAM,QAAQ,SAAS,IAAI,IAAI;GAC/B,IAAI,OACF,IAAI,KAAK;EAEb;EACA,KAAK,WAAW,CAAC,GAAG,MAAM,CAAC,CAAC,MACzB,MAAM,UAAU,MAAM,SAAS,KAAK,MACvC;CACF;CAEA,OAAO,OAAuB;EAC5B,OAAO,KAAK,YAAY,OAAO,mBAAG,IAAI,IAAI,CAAC;CAC7C;CAEA,eAAuB,OAAuB;EAC5C,KAAK,MAAM,UAAU,KAAK,UACxB,QAAQ,MAAM,MAAM,MAAM,CAAC,CAAC,KAAK,YAAY;EAE/C,OAAO;CACT;CAEA,WAAmB,OAAuB;EACxC,OAAO,KAAK,eAAe,KAAK,CAAC,CAC9B,MAAM,UAAU,CAAC,CAAC,CAAC,EAAE,CACrB,MAAM,GAAG,GAAG;CACjB;CAEA,YACE,OACA,OACA,MACO;EACP,MAAM,UAAU,kBAAkB,OAAO,SAAS;EAClD,MAAM,QAAQ,IAAI,MAChB,KAAK,WACH,OAAO,YAAY,WACf,UACA,OAAO,UAAU,WACf,QACA,+CACR,CACF;EACA,MAAM,OAAO,kBAAkB,OAAO,MAAM;EAC5C,MAAM,OAAO,OAAO,SAAS,WAAW,KAAK,WAAW,IAAI,IAAI;EAChE,KAAK,MAAM,OAAO;GAAC;GAAQ;GAAS;EAAS,GAAY;GACvD,MAAM,QAAQ,kBAAkB,OAAO,GAAG;GAC1C,IACE,OAAO,UAAU,YAChB,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,GAEnD,OAAO,eAAe,OAAO,KAAK;IAChC,OAAO,OAAO,UAAU,WAAW,KAAK,WAAW,KAAK,IAAI;IAC5D,YAAY;GACd,CAAC;EAEL;EACA,MAAM,QAAQ,kBAAkB,OAAO,OAAO;EAC9C,MAAM,SACJ,OAAO,UAAU,WACb,MACG,MAAM,OAAO,CAAC,CACd,QAAQ,SAAS,wBAAwB,KAAK,IAAI,CAAC,CAAC,CACpD,KAAK,SAAS,KAAK,eAAe,IAAI,CAAC,IAC1C,CAAC;EACP,MAAM,QAAQ,CAAC,GAAG,MAAM,KAAK,IAAI,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,KAAK,IAAI;EACtE,KAAK,IAAI,KAAK;EACd,MAAM,SAAS,kBAAkB,OAAO,OAAO;EAC/C,IAAI,WAAW,KAAA,KAAa,QAAQ,KAAK,CAAC,KAAK,IAAI,MAAM,GACvD,OAAO,eAAe,OAAO,SAAS;GACpC,OAAO,KAAK,YAAY,QAAQ,QAAQ,GAAG,IAAI;GAC/C,YAAY;EACd,CAAC;EAEH,OAAO;CACT;AACF;;;ACxIA,MAAM,gBAAgB,OAAO,IAAI,sCAAsC;AACvE,MAAM,uBAAuB,OAAO,IAClC,8CACF;AACA,MAAM,sBAAsB,OAAO,IACjC,6CACF;AACA,MAAM,YAAY,OAAO,IAAI,mCAAmC;;AAEhE,MAAM,kCAAkB,IAAI,QAAyB;AACrD,MAAM,cAAc,OAAO,IAAI,+BAA+B;AA6C9D,SAAS,QAA0B,OAAU,OAAkB;CAC7D,OAAO,eAAe,OAAO,OAAO,EAAE,OAAO,KAAK,CAAC;CACnD,OAAO;AACT;AAEA,SAAgB,cAAc,OAAsC;CAClE,OAAO,kBAAkB,OAAO,aAAa,MAAM;AACrD;AAEA,SAAgB,sBACd,OACwC;CACxC,OAAO,kBAAkB,OAAO,oBAAoB,MAAM;AAC5D;AAEA,SAAgB,qBACd,OACuC;CACvC,OAAO,kBAAkB,OAAO,mBAAmB,MAAM;AAC3D;AAEA,SAAS,UAAU,OAAoC;CACrD,IAAI;EACF,IAAI,CAAC,WAAW,KAAK,GACnB;EAEF,MAAM,SAAS,kBAAkB,OAAO,YAAY;EACpD,OAAO,OAAO,WAAW,YACvB,OAAO,UAAU,MAAM,KACvB,UAAU,OACV,UAAU,MACR,SACA,KAAA;CACN,QAAQ;EACN;CACF;AACF;AAEA,SAAS,UAAU,OAAoC;CACrD,MAAM,SAAS,kBAAkB,kBAAkB,OAAO,MAAM,GAAG,MAAM;CACzE,OAAO,OAAO,WAAW,WAAW,SAAS,KAAA;AAC/C;;AAGA,SAAgB,mBAAmB,OAAyB;CAC1D,MAAM,SAAS,IAAI,QAAQ;CAC3B,KAAK,MAAM,SAAS,CAClB,kBAAkB,OAAO,WAAW,GACpC,kBAAkB,OAAO,SAAS,CACpC,GAAG;EACD,IAAI,UAAU,KAAA,KAAa,UAAU,MACnC;EAEF,IAAI;GACF,MAAM,UAAU,IAAI,QAAQ,KAAoB;GAChD,KAAK,MAAM,CAAC,MAAM,UAAU,SAC1B,IAAI,SAAS,cACX,OAAO,IAAI,MAAM,KAAK;GAG1B,KAAK,MAAM,UAAU,QAAQ,aAAa,GACxC,OAAO,OAAO,cAAc,MAAM;EAEtC,QAAQ,CAER;CACF;CACA,OAAO;AACT;AAEA,SAAS,UAAU,OAMH;CACd,MAAM,QAAQ;EACZ,KAAK;EACL,KAAK;EACL,KAAK;CACP;CACA,MAAM,WAAW;EACf,KAAK;EACL,KAAK;EACL,KAAK;CACP;CACA,MAAM,UAAU,IAAI,QAAQ;CAC5B,MAAM,QAAQ,MAAM;CACpB,IAAI,UAAU,KAAA,KAAa,OAAO,SAAS,KAAK,KAAK,SAAS,GAC5D,QAAQ,IAAI,eAAe,OAAO,KAAK,KAAK,KAAK,CAAC,CAAC;CAErD,OAAO,QACL;EACE,QAAQ,MAAM;EACd,MAAM,MAAM,MAAM;EAClB,QAAQ,MAAM;EACd,SAAS,MAAM,WAAW,SAAS,MAAM;EACzC,WAAW,MAAM;EACjB,GAAI,QAAQ,IAAI,aAAa,IAAI,EAAE,QAAQ,IAAI,CAAC;CAClD,GACA,aACF;AACF;AAEA,MAAa,eAAe;CAC1B,gBAAgB,SAA+B;EAC7C,OAAO,UAAU;GAAE,QAAQ;GAAK;EAAQ,CAAC;CAC3C;CACA,UAAU;CACV,UAAU,QAAgB,SAA+B;EACvD,OAAO,UAAU;GAAE,QAAQ;GAAK;GAAQ;EAAQ,CAAC;CACnD;CACA,aAAa,OAAoC;EAC/C,MAAM,SAAS,UAAU,KAAK;EAC9B,IAAI,WAAW,OAAO,WAAW,OAAO,WAAW,KACjD,OAAO;EAET,MAAM,kBAAkB,mBAAmB,KAAK;EAKhD,MAAM,QAAQ,kBAJE,kBACd,kBAAkB,OAAO,MAAM,GAC/B,SAE8B,GAAS,YAAY;EACrD,MAAM,UAAU,UAAU;GACxB;GACA,QAAQ,UAAU,KAAK;GACvB,WAAW,gBAAgB,IAAI,kBAAkB,KAAK,KAAA;GACtD,mBACE,WAAW,OAAO,OAAO,UAAU,WAAW,QAAQ,MAAO,KAAA;EACjE,CAAC;EACD,MAAM,aAAa,gBAAgB,IAAI,aAAa;EACpD,IAAI,eAAe,MAAM;GACvB,MAAM,UAAU,IAAI,QAAQ,QAAQ,OAAO;GAC3C,QAAQ,IAAI,eAAe,UAAU;GACrC,OAAO,QAAQ;IAAE,GAAG;IAAS;GAAQ,GAAG,aAAa;EACvD;EACA,OAAO;CACT;AACF;AAEA,IAAa,+BAAb,MAAa,qCAAqC,MAAM;CACtD;CACA;CACA;CACA;CACA;CACA,aAAsB;EACpB,MAAM;EACN,QAAQ;EACR,YAAY;CACd;CACA;CAEA,YAAY,MAAc,QAAgB,MAAe;EACvD,MAAM,MAAM;EACZ,KAAK,OAAO;EACZ,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,KAAK,OAAO;EACZ,KAAK,QAAQ;EACb,QAAQ,MAAM,mBAAmB;CACnC;CAEA,OAAO,UACL,MACA,QACA,SAC8B;EAC9B,MAAM,QAAQ,IAAI,6BAChB,MACA,mCACA,SAAS,IACX;EACA,OAAO,iBAAiB,OAAO;GAC7B,QAAQ;IAAE,OAAO;IAAQ,YAAY;GAAK;GAC1C,MAAM;IAAE,OAAO,SAAS;IAAM,YAAY;GAAK;GAC/C,OAAO;IAAE,OAAO;IAAW,YAAY;GAAK;EAC9C,CAAC;EACD,OAAO;CACT;AACF;AAEA,IAAa,gCAAb,cAAmD,MAAM;CACvD;CACA,aAAsB;EACpB,MAAM;EACN,QAAQ;EACR,YAAY;CACd;CAEA,YAAY,OAAgB,SAA2C;EACrE,MAAM,oCAAoC;EAC1C,KAAK,OAAO;EACZ,KAAK,QAAQ,IAAI,cAAc,OAAO,CAAC,CAAC,OAAO,KAAK;EACpD,gBAAgB,IAAI,MAAM,KAAK;EAC/B,QAAQ,MAAM,oBAAoB;CACpC;AACF;;AAGA,SAAgB,0BACd,OACA,SAC+B;CAE/B,MAAM,QAAQ,IAAI,8BAA8B,OAAO,OAAO;CAC9D,IAAI,SAAS,mBAAmB,MAC9B,OAAO,eAAe,OAAO,WAAW;EACtC,OAAO;EACP,YAAY;CACd,CAAC;CAEH,OAAO;AACT;;;;;;AAOA,SAAgB,iBACd,OACA,SAC+B;CAC/B,MAAM,WAAW,gBAAgB,IAAI,KAAK,IACtC,gBAAgB,IAAI,KAAK,IACzB,kBAAkB,OAAO,SAAS;CACtC,MAAM,YAAY,IAAI,8BACpB,kBAAkB,OAAO,OAAO,GAChC,OACF;CACA,gBAAgB,IAAI,WAAW,QAAQ;CACvC,IAAI,QAAQ,mBAAmB,QAAQ,aAAa,KAAA,GAClD,OAAO,eAAe,WAAW,WAAW;EAC1C,OAAO;EACP,YAAY;CACd,CAAC;CAEH,OAAO;AACT;AAEA,SAAgB,YAAY,OAA+C;CACzE,OAAO,kBAAkB,OAAO,SAAS;AAC3C;;AASA,SAAgB,gBACd,OACA,OACA,MACA,SACA,SACoC;CACpC,IAAI,cAAc,KAAK,GACrB,OAAO;CAET,IAAI,sBAAsB,KAAK,KAAK,qBAAqB,KAAK,GAC5D,MAAM;CAER,MAAM,SAAS,UAAU,KAAK;CAC9B,MAAM,SAAS,UAAU,KAAK;CAC9B,IAAI,WAAW,KACb,OAAO,aAAa,aAAa,KAAK;CAExC,IACE,WAAW,OACX,UAAU,aACT,WAAW,KAAA,KAAa,WAAW,iBAEpC,OAAO;EAAE,aAAa;EAAO;CAAO;CAEtC,IAAI,WAAW,OAAO,WAAW,KAC/B,OAAO,UAAU,WACb,aAAa,aAAa,KAAK,IAC/B,aAAa,UAAU,UAAU,WAAW;CAElD,IAAI,WAAW,KAAA,KAAa,SAAS,KACnC,MAAM,6BAA6B,UACjC,6BACA,4CAA4C,OAAO,GAAG,OAAO,IAC7D,EAAE,KAAK,CACT;CAEF,MAAM,0BAA0B,OAAO;EACrC;EACA,gBAAgB,SAAS;CAC3B,CAAC;AACH"}
+{"version":3,"file":"auth-errors-JjxGDVSt.mjs","names":[],"sources":["../src/error-redactor.ts","../src/auth-errors.ts"],"sourcesContent":["/** Inputs come from the active request's owner; the redactor retains no scope. */\nexport interface ErrorRedactorOptions {\n  secrets?: readonly string[];\n  headers?: Headers;\n  credentialHeaders?: readonly string[];\n}\n\n/** Reading an arbitrary thrown value must not invoke another escaping fault. */\nexport function readErrorProperty(value: unknown, key: PropertyKey): unknown {\n  if (\n    (typeof value !== \"object\" || value === null) &&\n    typeof value !== \"function\"\n  ) {\n    return undefined;\n  }\n  try {\n    return Reflect.get(value, key);\n  } catch {\n    return undefined;\n  }\n}\n\nexport class ErrorRedactor {\n  readonly #secrets: readonly string[];\n\n  constructor(options: ErrorRedactorOptions = {}) {\n    const values = new Set<string>();\n    const add = (value: string) => {\n      if (!value) {\n        return;\n      }\n      values.add(value);\n      let decoded = value;\n      try {\n        decoded = decodeURIComponent(value);\n        values.add(decoded);\n      } catch {\n        // Invalid escaping must not prevent redaction of the raw credential.\n      }\n      for (const form of [value, decoded]) {\n        const separator = form.lastIndexOf(\".\");\n        if (separator >= 16) {\n          values.add(form.slice(0, separator));\n        }\n      }\n    };\n    for (const value of options.secrets ?? []) {\n      add(value);\n    }\n    const headers = options.headers;\n    for (const cookie of (headers?.get(\"cookie\") ?? \"\").split(\";\")) {\n      const separator = cookie.indexOf(\"=\");\n      if (separator >= 0) {\n        const value = cookie.slice(separator + 1).trim();\n        add(value);\n        if (value.startsWith('\"') && value.endsWith('\"')) {\n          add(value.slice(1, -1));\n        }\n      }\n    }\n    const authorization = headers?.get(\"authorization\");\n    if (authorization) {\n      add(authorization);\n      const credential = /^\\S+\\s+(.+)$/.exec(authorization)?.[1];\n      if (credential) {\n        add(credential);\n      }\n    }\n    for (const name of options.credentialHeaders ?? []) {\n      const value = headers?.get(name);\n      if (value) {\n        add(value);\n      }\n    }\n    this.#secrets = [...values].sort(\n      (left, right) => right.length - left.length,\n    );\n  }\n\n  redact(cause: unknown): Error {\n    return this.redactCause(cause, 0, new Set());\n  }\n\n  private replaceSecrets(value: string): string {\n    for (const secret of this.#secrets) {\n      value = value.split(secret).join(\"[REDACTED]\");\n    }\n    return value;\n  }\n\n  private diagnostic(value: string): string {\n    return this.replaceSecrets(value)\n      .split(/[\\r\\n]/, 1)[0]\n      .slice(0, 300);\n  }\n\n  private redactCause(\n    cause: unknown,\n    depth: number,\n    seen: Set<unknown>,\n  ): Error {\n    const message = readErrorProperty(cause, \"message\");\n    const error = new Error(\n      this.diagnostic(\n        typeof message === \"string\"\n          ? message\n          : typeof cause === \"string\"\n            ? cause\n            : \"Unknown authentication infrastructure failure\",\n      ),\n    );\n    const name = readErrorProperty(cause, \"name\");\n    error.name = typeof name === \"string\" ? this.diagnostic(name) : \"Error\";\n    for (const key of [\"code\", \"errno\", \"syscall\"] as const) {\n      const value = readErrorProperty(cause, key);\n      if (\n        typeof value === \"string\" ||\n        (typeof value === \"number\" && Number.isFinite(value))\n      ) {\n        Object.defineProperty(error, key, {\n          value: typeof value === \"string\" ? this.diagnostic(value) : value,\n          enumerable: true,\n        });\n      }\n    }\n    const stack = readErrorProperty(cause, \"stack\");\n    const frames =\n      typeof stack === \"string\"\n        ? stack\n            .split(/\\r?\\n/)\n            .filter((line) => /^\\s+at .+:\\d+:\\d+\\)?$/.test(line))\n            .map((line) => this.replaceSecrets(line))\n        : [];\n    error.stack = [`${error.name}: ${error.message}`, ...frames].join(\"\\n\");\n    seen.add(cause);\n    const nested = readErrorProperty(cause, \"cause\");\n    if (nested !== undefined && depth < 3 && !seen.has(nested)) {\n      Object.defineProperty(error, \"cause\", {\n        value: this.redactCause(nested, depth + 1, seen),\n        enumerable: false,\n      });\n    }\n    return error;\n  }\n}\n","import type { ExecutionContext } from \"@nestjs/common\";\nimport { isAPIError } from \"better-auth/api\";\nimport {\n  ErrorRedactor,\n  type ErrorRedactorOptions,\n  readErrorProperty,\n} from \"./error-redactor.js\";\n\nconst FAILURE_BRAND = Symbol.for(\"@nestjs-kit/better-auth:auth-failure\");\nconst INFRASTRUCTURE_BRAND = Symbol.for(\n  \"@nestjs-kit/better-auth:infrastructure-error\",\n);\nconst CONFIGURATION_BRAND = Symbol.for(\n  \"@nestjs-kit/better-auth:configuration-error\",\n);\nconst RAW_CAUSE = Symbol.for(\"@nestjs-kit/better-auth:raw-cause\");\n/** Unredacted causes stay module-private; only an instance's exposeRawCause opt-in attaches one (RAW_CAUSE). */\nconst ORIGINAL_CAUSES = new WeakMap<object, unknown>();\nconst SDK_HEADERS = Symbol.for(\"better-call:api-error-headers\");\n\nexport type AuthErrorCode = \"UNAUTHENTICATED\" | \"FORBIDDEN\" | \"RATE_LIMITED\";\n\n/** A transport-neutral denial. Only transports make it throwable. */\nexport interface AuthFailure {\n  readonly status: 401 | 403 | 429;\n  readonly code: AuthErrorCode;\n  readonly reason?: string;\n  readonly message: string;\n  readonly challenge?: string;\n  readonly headers?: Headers;\n}\n\nexport interface AuthErrorBody {\n  statusCode: 401 | 403 | 429;\n  error: string;\n  code: AuthErrorCode;\n  reason?: string;\n  message: string;\n}\n\nexport interface AuthGraphqlExtensions {\n  code: AuthErrorCode | \"INTERNAL_SERVER_ERROR\";\n  reason?: string;\n  statusCode: number;\n}\n\nexport interface AuthTransportErrorPayload {\n  status: \"error\";\n  statusCode: number;\n  code: AuthErrorCode;\n  reason?: string;\n  message: string;\n}\n\nexport interface ErrorMappingOptions {\n  map?: (\n    failure: AuthFailure,\n    context: ExecutionContext,\n    transport: string,\n  ) => unknown;\n  exposeRawCause?: boolean;\n}\n\nfunction branded<T extends object>(value: T, brand: symbol): T {\n  Object.defineProperty(value, brand, { value: true });\n  return value;\n}\n\nexport function isAuthFailure(value: unknown): value is AuthFailure {\n  return readErrorProperty(value, FAILURE_BRAND) === true;\n}\n\nexport function isInfrastructureError(\n  value: unknown,\n): value is BetterAuthInfrastructureError {\n  return readErrorProperty(value, INFRASTRUCTURE_BRAND) === true;\n}\n\nexport function isConfigurationError(\n  value: unknown,\n): value is BetterAuthConfigurationError {\n  return readErrorProperty(value, CONFIGURATION_BRAND) === true;\n}\n\nfunction sdkStatus(error: unknown): number | undefined {\n  try {\n    if (!isAPIError(error)) {\n      return undefined;\n    }\n    const status = readErrorProperty(error, \"statusCode\");\n    return typeof status === \"number\" &&\n      Number.isInteger(status) &&\n      status >= 100 &&\n      status <= 599\n      ? status\n      : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction sdkReason(error: unknown): string | undefined {\n  const reason = readErrorProperty(readErrorProperty(error, \"body\"), \"code\");\n  return typeof reason === \"string\" ? reason : undefined;\n}\n\n/** Internal: preserve cookie lines for the exchange's separately governed cleanup. */\nexport function getAPIErrorHeaders(error: unknown): Headers {\n  const result = new Headers();\n  for (const value of [\n    readErrorProperty(error, SDK_HEADERS),\n    readErrorProperty(error, \"headers\"),\n  ]) {\n    if (value === undefined || value === null) {\n      continue;\n    }\n    try {\n      const headers = new Headers(value as HeadersInit);\n      for (const [name, value] of headers) {\n        if (name !== \"set-cookie\") {\n          result.set(name, value);\n        }\n      }\n      for (const cookie of headers.getSetCookie()) {\n        result.append(\"set-cookie\", cookie);\n      }\n    } catch {\n      // A malformed optional header collection must not mask the original fault.\n    }\n  }\n  return result;\n}\n\nfunction rejection(input: {\n  status: 401 | 403 | 429;\n  reason?: string;\n  message?: string;\n  challenge?: string;\n  retryAfterSeconds?: number;\n}): AuthFailure {\n  const codes = {\n    401: \"UNAUTHENTICATED\",\n    403: \"FORBIDDEN\",\n    429: \"RATE_LIMITED\",\n  } as const;\n  const messages = {\n    401: \"Unauthorized\",\n    403: \"Forbidden\",\n    429: \"Too Many Requests\",\n  } as const;\n  const headers = new Headers();\n  const retry = input.retryAfterSeconds;\n  if (retry !== undefined && Number.isFinite(retry) && retry >= 0) {\n    headers.set(\"retry-after\", String(Math.ceil(retry)));\n  }\n  return branded(\n    {\n      status: input.status,\n      code: codes[input.status],\n      reason: input.reason,\n      message: input.message ?? messages[input.status],\n      challenge: input.challenge,\n      ...(headers.has(\"retry-after\") ? { headers } : {}),\n    },\n    FAILURE_BRAND,\n  );\n}\n\nexport const AuthFailures = {\n  unauthenticated(message?: string): AuthFailure {\n    return rejection({ status: 401, message });\n  },\n  rejected: rejection,\n  forbidden(reason: string, message?: string): AuthFailure {\n    return rejection({ status: 403, reason, message });\n  },\n  fromAPIError(error: unknown): AuthFailure | null {\n    const status = sdkStatus(error);\n    if (status !== 401 && status !== 403 && status !== 429) {\n      return null;\n    }\n    const originalHeaders = getAPIErrorHeaders(error);\n    const details = readErrorProperty(\n      readErrorProperty(error, \"body\"),\n      \"details\",\n    );\n    const delay = readErrorProperty(details, \"tryAgainIn\");\n    const failure = rejection({\n      status,\n      reason: sdkReason(error),\n      challenge: originalHeaders.get(\"www-authenticate\") ?? undefined,\n      retryAfterSeconds:\n        status === 429 && typeof delay === \"number\" ? delay / 1000 : undefined,\n    });\n    const retryAfter = originalHeaders.get(\"retry-after\");\n    if (retryAfter !== null) {\n      const headers = new Headers(failure.headers);\n      headers.set(\"retry-after\", retryAfter);\n      return branded({ ...failure, headers }, FAILURE_BRAND);\n    }\n    return failure;\n  },\n};\n\nexport class BetterAuthConfigurationError extends Error {\n  readonly code: string;\n  readonly detail: string;\n  readonly site?: string;\n  readonly hint?: string;\n  readonly phase: \"boot\" | \"request\";\n  readonly extensions = {\n    code: \"INTERNAL_SERVER_ERROR\",\n    reason: \"AUTH_MISCONFIGURED\",\n    statusCode: 500,\n  } as const;\n  readonly issues?: readonly BetterAuthConfigurationError[];\n\n  constructor(code: string, detail: string, hint?: string) {\n    super(detail);\n    this.name = \"BetterAuthConfigurationError\";\n    this.code = code;\n    this.detail = detail;\n    this.hint = hint;\n    this.phase = \"boot\";\n    branded(this, CONFIGURATION_BRAND);\n  }\n\n  static atRequest(\n    code: string,\n    detail: string,\n    options?: { site?: string; hint?: string },\n  ): BetterAuthConfigurationError {\n    const error = new BetterAuthConfigurationError(\n      code,\n      \"Authentication is misconfigured\",\n      options?.hint,\n    );\n    Object.defineProperties(error, {\n      detail: { value: detail, enumerable: true },\n      site: { value: options?.site, enumerable: true },\n      phase: { value: \"request\", enumerable: true },\n    });\n    return error;\n  }\n}\n\nexport class BetterAuthInfrastructureError extends Error {\n  readonly cause: Error;\n  readonly extensions = {\n    code: \"INTERNAL_SERVER_ERROR\",\n    reason: \"AUTH_UNAVAILABLE\",\n    statusCode: 500,\n  } as const;\n\n  constructor(cause: unknown, options?: { secrets?: readonly string[] }) {\n    super(\"Authentication service unavailable\");\n    this.name = \"BetterAuthInfrastructureError\";\n    this.cause = new ErrorRedactor(options).redact(cause);\n    ORIGINAL_CAUSES.set(this, cause);\n    branded(this, INFRASTRUCTURE_BRAND);\n  }\n}\n\n/** Internal factory for an instance's explicit diagnostic opt-in, never global state. */\nexport function createInfrastructureError(\n  cause: unknown,\n  options?: ErrorRedactorOptions & { exposeRawCause?: boolean },\n): BetterAuthInfrastructureError {\n  // Preserve request-owned redaction inputs without widening the public constructor.\n  const error = new BetterAuthInfrastructureError(cause, options);\n  if (options?.exposeRawCause === true) {\n    Object.defineProperty(error, RAW_CAUSE, {\n      value: cause,\n      enumerable: false,\n    });\n  }\n  return error;\n}\n\n/**\n * Internal: the form of an already-classified infrastructure error that one request delivers. The request's cookie,\n * authorization and declared credential values are redacted on top of the thrower's own redaction, and the original\n * cause is attached only when the instance opts in, as for errors the kernel classifies itself.\n */\nexport function redactForRequest(\n  error: BetterAuthInfrastructureError,\n  options: ErrorRedactorOptions & { exposeRawCause?: boolean },\n): BetterAuthInfrastructureError {\n  const original = ORIGINAL_CAUSES.has(error)\n    ? ORIGINAL_CAUSES.get(error)\n    : readErrorProperty(error, RAW_CAUSE);\n  const delivered = new BetterAuthInfrastructureError(\n    readErrorProperty(error, \"cause\"),\n    options,\n  );\n  ORIGINAL_CAUSES.set(delivered, original);\n  if (options.exposeRawCause === true && original !== undefined) {\n    Object.defineProperty(delivered, RAW_CAUSE, {\n      value: original,\n      enumerable: false,\n    });\n  }\n  return delivered;\n}\n\nexport function getRawCause(error: BetterAuthInfrastructureError): unknown {\n  return readErrorProperty(error, RAW_CAUSE);\n}\n\n/** Internal: evaluation must distinguish session loss from a failed session read. */\nexport interface SessionLossCandidate {\n  readonly sessionLoss: unknown;\n  readonly reason?: string;\n}\n\n/** Internal safety net. Evaluation performs the authoritative session-loss recheck. */\nexport function normalizeThrown(\n  error: unknown,\n  where: \"source\" | \"policy\",\n  site: string,\n  secrets: readonly string[],\n  options?: { exposeRawCause?: boolean },\n): AuthFailure | SessionLossCandidate {\n  if (isAuthFailure(error)) {\n    return error;\n  }\n  if (isInfrastructureError(error) || isConfigurationError(error)) {\n    throw error;\n  }\n  const status = sdkStatus(error);\n  const reason = sdkReason(error);\n  if (status === 429) {\n    return AuthFailures.fromAPIError(error)!;\n  }\n  if (\n    status === 401 &&\n    where === \"policy\" &&\n    (reason === undefined || reason === \"UNAUTHORIZED\")\n  ) {\n    return { sessionLoss: error, reason };\n  }\n  if (status === 401 || status === 403) {\n    return where === \"source\"\n      ? AuthFailures.fromAPIError(error)!\n      : AuthFailures.forbidden(reason ?? \"FORBIDDEN\");\n  }\n  if (status !== undefined && status < 500) {\n    throw BetterAuthConfigurationError.atRequest(\n      \"BETTER_AUTH_REJECTED_CALL\",\n      `better-auth rejected the library's call (${status} ${reason})`,\n      { site },\n    );\n  }\n  throw createInfrastructureError(error, {\n    secrets,\n    exposeRawCause: options?.exposeRawCause,\n  });\n}\n"],"mappings":";;;AAQA,SAAgB,kBAAkB,OAAgB,KAA2B;CAC3E,KACG,OAAO,UAAU,YAAY,UAAU,SACxC,OAAO,UAAU,YAEjB;CAEF,IAAI;EACF,OAAO,QAAQ,IAAI,OAAO,GAAG;CAC/B,QAAQ;EACN;CACF;AACF;AAEA,IAAa,gBAAb,MAA2B;CACzB;CAEA,YAAY,UAAgC,CAAC,GAAG;EAC9C,MAAM,yBAAS,IAAI,IAAY;EAC/B,MAAM,OAAO,UAAkB;GAC7B,IAAI,CAAC,OACH;GAEF,OAAO,IAAI,KAAK;GAChB,IAAI,UAAU;GACd,IAAI;IACF,UAAU,mBAAmB,KAAK;IAClC,OAAO,IAAI,OAAO;GACpB,QAAQ,CAER;GACA,KAAK,MAAM,QAAQ,CAAC,OAAO,OAAO,GAAG;IACnC,MAAM,YAAY,KAAK,YAAY,GAAG;IACtC,IAAI,aAAa,IACf,OAAO,IAAI,KAAK,MAAM,GAAG,SAAS,CAAC;GAEvC;EACF;EACA,KAAK,MAAM,SAAS,QAAQ,WAAW,CAAC,GACtC,IAAI,KAAK;EAEX,MAAM,UAAU,QAAQ;EACxB,KAAK,MAAM,WAAW,SAAS,IAAI,QAAQ,KAAK,GAAA,CAAI,MAAM,GAAG,GAAG;GAC9D,MAAM,YAAY,OAAO,QAAQ,GAAG;GACpC,IAAI,aAAa,GAAG;IAClB,MAAM,QAAQ,OAAO,MAAM,YAAY,CAAC,CAAC,CAAC,KAAK;IAC/C,IAAI,KAAK;IACT,IAAI,MAAM,WAAW,IAAG,KAAK,MAAM,SAAS,IAAG,GAC7C,IAAI,MAAM,MAAM,GAAG,EAAE,CAAC;GAE1B;EACF;EACA,MAAM,gBAAgB,SAAS,IAAI,eAAe;EAClD,IAAI,eAAe;GACjB,IAAI,aAAa;GACjB,MAAM,aAAa,eAAe,KAAK,aAAa,CAAC,GAAG;GACxD,IAAI,YACF,IAAI,UAAU;EAElB;EACA,KAAK,MAAM,QAAQ,QAAQ,qBAAqB,CAAC,GAAG;GAClD,MAAM,QAAQ,SAAS,IAAI,IAAI;GAC/B,IAAI,OACF,IAAI,KAAK;EAEb;EACA,KAAK,WAAW,CAAC,GAAG,MAAM,CAAC,CAAC,MACzB,MAAM,UAAU,MAAM,SAAS,KAAK,MACvC;CACF;CAEA,OAAO,OAAuB;EAC5B,OAAO,KAAK,YAAY,OAAO,mBAAG,IAAI,IAAI,CAAC;CAC7C;CAEA,eAAuB,OAAuB;EAC5C,KAAK,MAAM,UAAU,KAAK,UACxB,QAAQ,MAAM,MAAM,MAAM,CAAC,CAAC,KAAK,YAAY;EAE/C,OAAO;CACT;CAEA,WAAmB,OAAuB;EACxC,OAAO,KAAK,eAAe,KAAK,CAAC,CAC9B,MAAM,UAAU,CAAC,CAAC,CAAC,EAAE,CACrB,MAAM,GAAG,GAAG;CACjB;CAEA,YACE,OACA,OACA,MACO;EACP,MAAM,UAAU,kBAAkB,OAAO,SAAS;EAClD,MAAM,QAAQ,IAAI,MAChB,KAAK,WACH,OAAO,YAAY,WACf,UACA,OAAO,UAAU,WACf,QACA,+CACR,CACF;EACA,MAAM,OAAO,kBAAkB,OAAO,MAAM;EAC5C,MAAM,OAAO,OAAO,SAAS,WAAW,KAAK,WAAW,IAAI,IAAI;EAChE,KAAK,MAAM,OAAO;GAAC;GAAQ;GAAS;EAAS,GAAY;GACvD,MAAM,QAAQ,kBAAkB,OAAO,GAAG;GAC1C,IACE,OAAO,UAAU,YAChB,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,GAEnD,OAAO,eAAe,OAAO,KAAK;IAChC,OAAO,OAAO,UAAU,WAAW,KAAK,WAAW,KAAK,IAAI;IAC5D,YAAY;GACd,CAAC;EAEL;EACA,MAAM,QAAQ,kBAAkB,OAAO,OAAO;EAC9C,MAAM,SACJ,OAAO,UAAU,WACb,MACG,MAAM,OAAO,CAAC,CACd,QAAQ,SAAS,wBAAwB,KAAK,IAAI,CAAC,CAAC,CACpD,KAAK,SAAS,KAAK,eAAe,IAAI,CAAC,IAC1C,CAAC;EACP,MAAM,QAAQ,CAAC,GAAG,MAAM,KAAK,IAAI,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,KAAK,IAAI;EACtE,KAAK,IAAI,KAAK;EACd,MAAM,SAAS,kBAAkB,OAAO,OAAO;EAC/C,IAAI,WAAW,KAAA,KAAa,QAAQ,KAAK,CAAC,KAAK,IAAI,MAAM,GACvD,OAAO,eAAe,OAAO,SAAS;GACpC,OAAO,KAAK,YAAY,QAAQ,QAAQ,GAAG,IAAI;GAC/C,YAAY;EACd,CAAC;EAEH,OAAO;CACT;AACF;;ACxIA,MAAM,gBAAgB,OAAO,IAAI,sCAAsC;AACvE,MAAM,uBAAuB,OAAO,IAClC,8CACF;AACA,MAAM,sBAAsB,OAAO,IACjC,6CACF;AACA,MAAM,YAAY,OAAO,IAAI,mCAAmC;;AAEhE,MAAM,kCAAkB,IAAI,QAAyB;AACrD,MAAM,cAAc,OAAO,IAAI,+BAA+B;AA6C9D,SAAS,QAA0B,OAAU,OAAkB;CAC7D,OAAO,eAAe,OAAO,OAAO,EAAE,OAAO,KAAK,CAAC;CACnD,OAAO;AACT;AAEA,SAAgB,cAAc,OAAsC;CAClE,OAAO,kBAAkB,OAAO,aAAa,MAAM;AACrD;AAEA,SAAgB,sBACd,OACwC;CACxC,OAAO,kBAAkB,OAAO,oBAAoB,MAAM;AAC5D;AAEA,SAAgB,qBACd,OACuC;CACvC,OAAO,kBAAkB,OAAO,mBAAmB,MAAM;AAC3D;AAEA,SAAS,UAAU,OAAoC;CACrD,IAAI;EACF,IAAI,CAAC,WAAW,KAAK,GACnB;EAEF,MAAM,SAAS,kBAAkB,OAAO,YAAY;EACpD,OAAO,OAAO,WAAW,YACvB,OAAO,UAAU,MAAM,KACvB,UAAU,OACV,UAAU,MACR,SACA,KAAA;CACN,QAAQ;EACN;CACF;AACF;AAEA,SAAS,UAAU,OAAoC;CACrD,MAAM,SAAS,kBAAkB,kBAAkB,OAAO,MAAM,GAAG,MAAM;CACzE,OAAO,OAAO,WAAW,WAAW,SAAS,KAAA;AAC/C;;AAGA,SAAgB,mBAAmB,OAAyB;CAC1D,MAAM,SAAS,IAAI,QAAQ;CAC3B,KAAK,MAAM,SAAS,CAClB,kBAAkB,OAAO,WAAW,GACpC,kBAAkB,OAAO,SAAS,CACpC,GAAG;EACD,IAAI,UAAU,KAAA,KAAa,UAAU,MACnC;EAEF,IAAI;GACF,MAAM,UAAU,IAAI,QAAQ,KAAoB;GAChD,KAAK,MAAM,CAAC,MAAM,UAAU,SAC1B,IAAI,SAAS,cACX,OAAO,IAAI,MAAM,KAAK;GAG1B,KAAK,MAAM,UAAU,QAAQ,aAAa,GACxC,OAAO,OAAO,cAAc,MAAM;EAEtC,QAAQ,CAER;CACF;CACA,OAAO;AACT;AAEA,SAAS,UAAU,OAMH;CACd,MAAM,QAAQ;EACZ,KAAK;EACL,KAAK;EACL,KAAK;CACP;CACA,MAAM,WAAW;EACf,KAAK;EACL,KAAK;EACL,KAAK;CACP;CACA,MAAM,UAAU,IAAI,QAAQ;CAC5B,MAAM,QAAQ,MAAM;CACpB,IAAI,UAAU,KAAA,KAAa,OAAO,SAAS,KAAK,KAAK,SAAS,GAC5D,QAAQ,IAAI,eAAe,OAAO,KAAK,KAAK,KAAK,CAAC,CAAC;CAErD,OAAO,QACL;EACE,QAAQ,MAAM;EACd,MAAM,MAAM,MAAM;EAClB,QAAQ,MAAM;EACd,SAAS,MAAM,WAAW,SAAS,MAAM;EACzC,WAAW,MAAM;EACjB,GAAI,QAAQ,IAAI,aAAa,IAAI,EAAE,QAAQ,IAAI,CAAC;CAClD,GACA,aACF;AACF;AAEA,MAAa,eAAe;CAC1B,gBAAgB,SAA+B;EAC7C,OAAO,UAAU;GAAE,QAAQ;GAAK;EAAQ,CAAC;CAC3C;CACA,UAAU;CACV,UAAU,QAAgB,SAA+B;EACvD,OAAO,UAAU;GAAE,QAAQ;GAAK;GAAQ;EAAQ,CAAC;CACnD;CACA,aAAa,OAAoC;EAC/C,MAAM,SAAS,UAAU,KAAK;EAC9B,IAAI,WAAW,OAAO,WAAW,OAAO,WAAW,KACjD,OAAO;EAET,MAAM,kBAAkB,mBAAmB,KAAK;EAKhD,MAAM,QAAQ,kBAJE,kBACd,kBAAkB,OAAO,MAAM,GAC/B,SAE8B,GAAS,YAAY;EACrD,MAAM,UAAU,UAAU;GACxB;GACA,QAAQ,UAAU,KAAK;GACvB,WAAW,gBAAgB,IAAI,kBAAkB,KAAK,KAAA;GACtD,mBACE,WAAW,OAAO,OAAO,UAAU,WAAW,QAAQ,MAAO,KAAA;EACjE,CAAC;EACD,MAAM,aAAa,gBAAgB,IAAI,aAAa;EACpD,IAAI,eAAe,MAAM;GACvB,MAAM,UAAU,IAAI,QAAQ,QAAQ,OAAO;GAC3C,QAAQ,IAAI,eAAe,UAAU;GACrC,OAAO,QAAQ;IAAE,GAAG;IAAS;GAAQ,GAAG,aAAa;EACvD;EACA,OAAO;CACT;AACF;AAEA,IAAa,+BAAb,MAAa,qCAAqC,MAAM;CACtD;CACA;CACA;CACA;CACA;CACA,aAAsB;EACpB,MAAM;EACN,QAAQ;EACR,YAAY;CACd;CACA;CAEA,YAAY,MAAc,QAAgB,MAAe;EACvD,MAAM,MAAM;EACZ,KAAK,OAAO;EACZ,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,KAAK,OAAO;EACZ,KAAK,QAAQ;EACb,QAAQ,MAAM,mBAAmB;CACnC;CAEA,OAAO,UACL,MACA,QACA,SAC8B;EAC9B,MAAM,QAAQ,IAAI,6BAChB,MACA,mCACA,SAAS,IACX;EACA,OAAO,iBAAiB,OAAO;GAC7B,QAAQ;IAAE,OAAO;IAAQ,YAAY;GAAK;GAC1C,MAAM;IAAE,OAAO,SAAS;IAAM,YAAY;GAAK;GAC/C,OAAO;IAAE,OAAO;IAAW,YAAY;GAAK;EAC9C,CAAC;EACD,OAAO;CACT;AACF;AAEA,IAAa,gCAAb,cAAmD,MAAM;CACvD;CACA,aAAsB;EACpB,MAAM;EACN,QAAQ;EACR,YAAY;CACd;CAEA,YAAY,OAAgB,SAA2C;EACrE,MAAM,oCAAoC;EAC1C,KAAK,OAAO;EACZ,KAAK,QAAQ,IAAI,cAAc,OAAO,CAAC,CAAC,OAAO,KAAK;EACpD,gBAAgB,IAAI,MAAM,KAAK;EAC/B,QAAQ,MAAM,oBAAoB;CACpC;AACF;;AAGA,SAAgB,0BACd,OACA,SAC+B;CAE/B,MAAM,QAAQ,IAAI,8BAA8B,OAAO,OAAO;CAC9D,IAAI,SAAS,mBAAmB,MAC9B,OAAO,eAAe,OAAO,WAAW;EACtC,OAAO;EACP,YAAY;CACd,CAAC;CAEH,OAAO;AACT;;;;;;AAOA,SAAgB,iBACd,OACA,SAC+B;CAC/B,MAAM,WAAW,gBAAgB,IAAI,KAAK,IACtC,gBAAgB,IAAI,KAAK,IACzB,kBAAkB,OAAO,SAAS;CACtC,MAAM,YAAY,IAAI,8BACpB,kBAAkB,OAAO,OAAO,GAChC,OACF;CACA,gBAAgB,IAAI,WAAW,QAAQ;CACvC,IAAI,QAAQ,mBAAmB,QAAQ,aAAa,KAAA,GAClD,OAAO,eAAe,WAAW,WAAW;EAC1C,OAAO;EACP,YAAY;CACd,CAAC;CAEH,OAAO;AACT;AAEA,SAAgB,YAAY,OAA+C;CACzE,OAAO,kBAAkB,OAAO,SAAS;AAC3C;;AASA,SAAgB,gBACd,OACA,OACA,MACA,SACA,SACoC;CACpC,IAAI,cAAc,KAAK,GACrB,OAAO;CAET,IAAI,sBAAsB,KAAK,KAAK,qBAAqB,KAAK,GAC5D,MAAM;CAER,MAAM,SAAS,UAAU,KAAK;CAC9B,MAAM,SAAS,UAAU,KAAK;CAC9B,IAAI,WAAW,KACb,OAAO,aAAa,aAAa,KAAK;CAExC,IACE,WAAW,OACX,UAAU,aACT,WAAW,KAAA,KAAa,WAAW,iBAEpC,OAAO;EAAE,aAAa;EAAO;CAAO;CAEtC,IAAI,WAAW,OAAO,WAAW,KAC/B,OAAO,UAAU,WACb,aAAa,aAAa,KAAK,IAC/B,aAAa,UAAU,UAAU,WAAW;CAElD,IAAI,WAAW,KAAA,KAAa,SAAS,KACnC,MAAM,6BAA6B,UACjC,6BACA,4CAA4C,OAAO,GAAG,OAAO,IAC7D,EAAE,KAAK,CACT;CAEF,MAAM,0BAA0B,OAAO;EACrC;EACA,gBAAgB,SAAS;CAC3B,CAAC;AACH"}

package/dist/{auth-errors-DmiKl0L_.cjs → auth-errors-RW7hOVI-.cjs}

@@ -1,5 +1,5 @@
 let better_auth_api = require("better-auth/api");
-//#region src/error-redactor.ts
+// src/error-redactor.ts
 /** Reading an arbitrary thrown value must not invoke another escaping fault. */
 function readErrorProperty(value, key) {
 	if ((typeof value !== "object" || value === null) && typeof value !== "function") return;
@@ -86,8 +86,7 @@ var ErrorRedactor = class {
 		return error;
 	}
 };
-//#endregion
-//#region src/auth-errors.ts
+// src/auth-errors.ts
 const FAILURE_BRAND = Symbol.for("@nestjs-kit/better-auth:auth-failure");
 const INFRASTRUCTURE_BRAND = Symbol.for("@nestjs-kit/better-auth:infrastructure-error");
 const CONFIGURATION_BRAND = Symbol.for("@nestjs-kit/better-auth:configuration-error");
@@ -295,7 +294,6 @@ function normalizeThrown(error, where, site, secrets, options) {
 		exposeRawCause: options?.exposeRawCause
 	});
 }
-//#endregion
 Object.defineProperty(exports, "AuthFailures", {
 	enumerable: true,
 	get: function() {
@@ -375,4 +373,4 @@ Object.defineProperty(exports, "redactForRequest", {
 	}
 });
 
-//# sourceMappingURL=auth-errors-DmiKl0L_.cjs.map
+//# sourceMappingURL=auth-errors-RW7hOVI-.cjs.map

package/dist/{auth-errors-DmiKl0L_.cjs.map → auth-errors-RW7hOVI-.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"auth-errors-DmiKl0L_.cjs","names":["isAPIError"],"sources":["../src/error-redactor.ts","../src/auth-errors.ts"],"sourcesContent":["/** Inputs come from the active request's owner; the redactor retains no scope. */\nexport interface ErrorRedactorOptions {\n  secrets?: readonly string[];\n  headers?: Headers;\n  credentialHeaders?: readonly string[];\n}\n\n/** Reading an arbitrary thrown value must not invoke another escaping fault. */\nexport function readErrorProperty(value: unknown, key: PropertyKey): unknown {\n  if (\n    (typeof value !== \"object\" || value === null) &&\n    typeof value !== \"function\"\n  ) {\n    return undefined;\n  }\n  try {\n    return Reflect.get(value, key);\n  } catch {\n    return undefined;\n  }\n}\n\nexport class ErrorRedactor {\n  readonly #secrets: readonly string[];\n\n  constructor(options: ErrorRedactorOptions = {}) {\n    const values = new Set<string>();\n    const add = (value: string) => {\n      if (!value) {\n        return;\n      }\n      values.add(value);\n      let decoded = value;\n      try {\n        decoded = decodeURIComponent(value);\n        values.add(decoded);\n      } catch {\n        // Invalid escaping must not prevent redaction of the raw credential.\n      }\n      for (const form of [value, decoded]) {\n        const separator = form.lastIndexOf(\".\");\n        if (separator >= 16) {\n          values.add(form.slice(0, separator));\n        }\n      }\n    };\n    for (const value of options.secrets ?? []) {\n      add(value);\n    }\n    const headers = options.headers;\n    for (const cookie of (headers?.get(\"cookie\") ?? \"\").split(\";\")) {\n      const separator = cookie.indexOf(\"=\");\n      if (separator >= 0) {\n        const value = cookie.slice(separator + 1).trim();\n        add(value);\n        if (value.startsWith('\"') && value.endsWith('\"')) {\n          add(value.slice(1, -1));\n        }\n      }\n    }\n    const authorization = headers?.get(\"authorization\");\n    if (authorization) {\n      add(authorization);\n      const credential = /^\\S+\\s+(.+)$/.exec(authorization)?.[1];\n      if (credential) {\n        add(credential);\n      }\n    }\n    for (const name of options.credentialHeaders ?? []) {\n      const value = headers?.get(name);\n      if (value) {\n        add(value);\n      }\n    }\n    this.#secrets = [...values].sort(\n      (left, right) => right.length - left.length,\n    );\n  }\n\n  redact(cause: unknown): Error {\n    return this.redactCause(cause, 0, new Set());\n  }\n\n  private replaceSecrets(value: string): string {\n    for (const secret of this.#secrets) {\n      value = value.split(secret).join(\"[REDACTED]\");\n    }\n    return value;\n  }\n\n  private diagnostic(value: string): string {\n    return this.replaceSecrets(value)\n      .split(/[\\r\\n]/, 1)[0]\n      .slice(0, 300);\n  }\n\n  private redactCause(\n    cause: unknown,\n    depth: number,\n    seen: Set<unknown>,\n  ): Error {\n    const message = readErrorProperty(cause, \"message\");\n    const error = new Error(\n      this.diagnostic(\n        typeof message === \"string\"\n          ? message\n          : typeof cause === \"string\"\n            ? cause\n            : \"Unknown authentication infrastructure failure\",\n      ),\n    );\n    const name = readErrorProperty(cause, \"name\");\n    error.name = typeof name === \"string\" ? this.diagnostic(name) : \"Error\";\n    for (const key of [\"code\", \"errno\", \"syscall\"] as const) {\n      const value = readErrorProperty(cause, key);\n      if (\n        typeof value === \"string\" ||\n        (typeof value === \"number\" && Number.isFinite(value))\n      ) {\n        Object.defineProperty(error, key, {\n          value: typeof value === \"string\" ? this.diagnostic(value) : value,\n          enumerable: true,\n        });\n      }\n    }\n    const stack = readErrorProperty(cause, \"stack\");\n    const frames =\n      typeof stack === \"string\"\n        ? stack\n            .split(/\\r?\\n/)\n            .filter((line) => /^\\s+at .+:\\d+:\\d+\\)?$/.test(line))\n            .map((line) => this.replaceSecrets(line))\n        : [];\n    error.stack = [`${error.name}: ${error.message}`, ...frames].join(\"\\n\");\n    seen.add(cause);\n    const nested = readErrorProperty(cause, \"cause\");\n    if (nested !== undefined && depth < 3 && !seen.has(nested)) {\n      Object.defineProperty(error, \"cause\", {\n        value: this.redactCause(nested, depth + 1, seen),\n        enumerable: false,\n      });\n    }\n    return error;\n  }\n}\n","import type { ExecutionContext } from \"@nestjs/common\";\nimport { isAPIError } from \"better-auth/api\";\nimport {\n  ErrorRedactor,\n  type ErrorRedactorOptions,\n  readErrorProperty,\n} from \"./error-redactor.js\";\n\nconst FAILURE_BRAND = Symbol.for(\"@nestjs-kit/better-auth:auth-failure\");\nconst INFRASTRUCTURE_BRAND = Symbol.for(\n  \"@nestjs-kit/better-auth:infrastructure-error\",\n);\nconst CONFIGURATION_BRAND = Symbol.for(\n  \"@nestjs-kit/better-auth:configuration-error\",\n);\nconst RAW_CAUSE = Symbol.for(\"@nestjs-kit/better-auth:raw-cause\");\n/** Unredacted causes stay module-private; only an instance's exposeRawCause opt-in attaches one (RAW_CAUSE). */\nconst ORIGINAL_CAUSES = new WeakMap<object, unknown>();\nconst SDK_HEADERS = Symbol.for(\"better-call:api-error-headers\");\n\nexport type AuthErrorCode = \"UNAUTHENTICATED\" | \"FORBIDDEN\" | \"RATE_LIMITED\";\n\n/** A transport-neutral denial. Only transports make it throwable. */\nexport interface AuthFailure {\n  readonly status: 401 | 403 | 429;\n  readonly code: AuthErrorCode;\n  readonly reason?: string;\n  readonly message: string;\n  readonly challenge?: string;\n  readonly headers?: Headers;\n}\n\nexport interface AuthErrorBody {\n  statusCode: 401 | 403 | 429;\n  error: string;\n  code: AuthErrorCode;\n  reason?: string;\n  message: string;\n}\n\nexport interface AuthGraphqlExtensions {\n  code: AuthErrorCode | \"INTERNAL_SERVER_ERROR\";\n  reason?: string;\n  statusCode: number;\n}\n\nexport interface AuthTransportErrorPayload {\n  status: \"error\";\n  statusCode: number;\n  code: AuthErrorCode;\n  reason?: string;\n  message: string;\n}\n\nexport interface ErrorMappingOptions {\n  map?: (\n    failure: AuthFailure,\n    context: ExecutionContext,\n    transport: string,\n  ) => unknown;\n  exposeRawCause?: boolean;\n}\n\nfunction branded<T extends object>(value: T, brand: symbol): T {\n  Object.defineProperty(value, brand, { value: true });\n  return value;\n}\n\nexport function isAuthFailure(value: unknown): value is AuthFailure {\n  return readErrorProperty(value, FAILURE_BRAND) === true;\n}\n\nexport function isInfrastructureError(\n  value: unknown,\n): value is BetterAuthInfrastructureError {\n  return readErrorProperty(value, INFRASTRUCTURE_BRAND) === true;\n}\n\nexport function isConfigurationError(\n  value: unknown,\n): value is BetterAuthConfigurationError {\n  return readErrorProperty(value, CONFIGURATION_BRAND) === true;\n}\n\nfunction sdkStatus(error: unknown): number | undefined {\n  try {\n    if (!isAPIError(error)) {\n      return undefined;\n    }\n    const status = readErrorProperty(error, \"statusCode\");\n    return typeof status === \"number\" &&\n      Number.isInteger(status) &&\n      status >= 100 &&\n      status <= 599\n      ? status\n      : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction sdkReason(error: unknown): string | undefined {\n  const reason = readErrorProperty(readErrorProperty(error, \"body\"), \"code\");\n  return typeof reason === \"string\" ? reason : undefined;\n}\n\n/** Internal: preserve cookie lines for the exchange's separately governed cleanup. */\nexport function getAPIErrorHeaders(error: unknown): Headers {\n  const result = new Headers();\n  for (const value of [\n    readErrorProperty(error, SDK_HEADERS),\n    readErrorProperty(error, \"headers\"),\n  ]) {\n    if (value === undefined || value === null) {\n      continue;\n    }\n    try {\n      const headers = new Headers(value as HeadersInit);\n      for (const [name, value] of headers) {\n        if (name !== \"set-cookie\") {\n          result.set(name, value);\n        }\n      }\n      for (const cookie of headers.getSetCookie()) {\n        result.append(\"set-cookie\", cookie);\n      }\n    } catch {\n      // A malformed optional header collection must not mask the original fault.\n    }\n  }\n  return result;\n}\n\nfunction rejection(input: {\n  status: 401 | 403 | 429;\n  reason?: string;\n  message?: string;\n  challenge?: string;\n  retryAfterSeconds?: number;\n}): AuthFailure {\n  const codes = {\n    401: \"UNAUTHENTICATED\",\n    403: \"FORBIDDEN\",\n    429: \"RATE_LIMITED\",\n  } as const;\n  const messages = {\n    401: \"Unauthorized\",\n    403: \"Forbidden\",\n    429: \"Too Many Requests\",\n  } as const;\n  const headers = new Headers();\n  const retry = input.retryAfterSeconds;\n  if (retry !== undefined && Number.isFinite(retry) && retry >= 0) {\n    headers.set(\"retry-after\", String(Math.ceil(retry)));\n  }\n  return branded(\n    {\n      status: input.status,\n      code: codes[input.status],\n      reason: input.reason,\n      message: input.message ?? messages[input.status],\n      challenge: input.challenge,\n      ...(headers.has(\"retry-after\") ? { headers } : {}),\n    },\n    FAILURE_BRAND,\n  );\n}\n\nexport const AuthFailures = {\n  unauthenticated(message?: string): AuthFailure {\n    return rejection({ status: 401, message });\n  },\n  rejected: rejection,\n  forbidden(reason: string, message?: string): AuthFailure {\n    return rejection({ status: 403, reason, message });\n  },\n  fromAPIError(error: unknown): AuthFailure | null {\n    const status = sdkStatus(error);\n    if (status !== 401 && status !== 403 && status !== 429) {\n      return null;\n    }\n    const originalHeaders = getAPIErrorHeaders(error);\n    const details = readErrorProperty(\n      readErrorProperty(error, \"body\"),\n      \"details\",\n    );\n    const delay = readErrorProperty(details, \"tryAgainIn\");\n    const failure = rejection({\n      status,\n      reason: sdkReason(error),\n      challenge: originalHeaders.get(\"www-authenticate\") ?? undefined,\n      retryAfterSeconds:\n        status === 429 && typeof delay === \"number\" ? delay / 1000 : undefined,\n    });\n    const retryAfter = originalHeaders.get(\"retry-after\");\n    if (retryAfter !== null) {\n      const headers = new Headers(failure.headers);\n      headers.set(\"retry-after\", retryAfter);\n      return branded({ ...failure, headers }, FAILURE_BRAND);\n    }\n    return failure;\n  },\n};\n\nexport class BetterAuthConfigurationError extends Error {\n  readonly code: string;\n  readonly detail: string;\n  readonly site?: string;\n  readonly hint?: string;\n  readonly phase: \"boot\" | \"request\";\n  readonly extensions = {\n    code: \"INTERNAL_SERVER_ERROR\",\n    reason: \"AUTH_MISCONFIGURED\",\n    statusCode: 500,\n  } as const;\n  readonly issues?: readonly BetterAuthConfigurationError[];\n\n  constructor(code: string, detail: string, hint?: string) {\n    super(detail);\n    this.name = \"BetterAuthConfigurationError\";\n    this.code = code;\n    this.detail = detail;\n    this.hint = hint;\n    this.phase = \"boot\";\n    branded(this, CONFIGURATION_BRAND);\n  }\n\n  static atRequest(\n    code: string,\n    detail: string,\n    options?: { site?: string; hint?: string },\n  ): BetterAuthConfigurationError {\n    const error = new BetterAuthConfigurationError(\n      code,\n      \"Authentication is misconfigured\",\n      options?.hint,\n    );\n    Object.defineProperties(error, {\n      detail: { value: detail, enumerable: true },\n      site: { value: options?.site, enumerable: true },\n      phase: { value: \"request\", enumerable: true },\n    });\n    return error;\n  }\n}\n\nexport class BetterAuthInfrastructureError extends Error {\n  readonly cause: Error;\n  readonly extensions = {\n    code: \"INTERNAL_SERVER_ERROR\",\n    reason: \"AUTH_UNAVAILABLE\",\n    statusCode: 500,\n  } as const;\n\n  constructor(cause: unknown, options?: { secrets?: readonly string[] }) {\n    super(\"Authentication service unavailable\");\n    this.name = \"BetterAuthInfrastructureError\";\n    this.cause = new ErrorRedactor(options).redact(cause);\n    ORIGINAL_CAUSES.set(this, cause);\n    branded(this, INFRASTRUCTURE_BRAND);\n  }\n}\n\n/** Internal factory for an instance's explicit diagnostic opt-in, never global state. */\nexport function createInfrastructureError(\n  cause: unknown,\n  options?: ErrorRedactorOptions & { exposeRawCause?: boolean },\n): BetterAuthInfrastructureError {\n  // Preserve request-owned redaction inputs without widening the public constructor.\n  const error = new BetterAuthInfrastructureError(cause, options);\n  if (options?.exposeRawCause === true) {\n    Object.defineProperty(error, RAW_CAUSE, {\n      value: cause,\n      enumerable: false,\n    });\n  }\n  return error;\n}\n\n/**\n * Internal: the form of an already-classified infrastructure error that one request delivers. The request's cookie,\n * authorization and declared credential values are redacted on top of the thrower's own redaction, and the original\n * cause is attached only when the instance opts in, as for errors the kernel classifies itself.\n */\nexport function redactForRequest(\n  error: BetterAuthInfrastructureError,\n  options: ErrorRedactorOptions & { exposeRawCause?: boolean },\n): BetterAuthInfrastructureError {\n  const original = ORIGINAL_CAUSES.has(error)\n    ? ORIGINAL_CAUSES.get(error)\n    : readErrorProperty(error, RAW_CAUSE);\n  const delivered = new BetterAuthInfrastructureError(\n    readErrorProperty(error, \"cause\"),\n    options,\n  );\n  ORIGINAL_CAUSES.set(delivered, original);\n  if (options.exposeRawCause === true && original !== undefined) {\n    Object.defineProperty(delivered, RAW_CAUSE, {\n      value: original,\n      enumerable: false,\n    });\n  }\n  return delivered;\n}\n\nexport function getRawCause(error: BetterAuthInfrastructureError): unknown {\n  return readErrorProperty(error, RAW_CAUSE);\n}\n\n/** Internal: evaluation must distinguish session loss from a failed session read. */\nexport interface SessionLossCandidate {\n  readonly sessionLoss: unknown;\n  readonly reason?: string;\n}\n\n/** Internal safety net. Evaluation performs the authoritative session-loss recheck. */\nexport function normalizeThrown(\n  error: unknown,\n  where: \"source\" | \"policy\",\n  site: string,\n  secrets: readonly string[],\n  options?: { exposeRawCause?: boolean },\n): AuthFailure | SessionLossCandidate {\n  if (isAuthFailure(error)) {\n    return error;\n  }\n  if (isInfrastructureError(error) || isConfigurationError(error)) {\n    throw error;\n  }\n  const status = sdkStatus(error);\n  const reason = sdkReason(error);\n  if (status === 429) {\n    return AuthFailures.fromAPIError(error)!;\n  }\n  if (\n    status === 401 &&\n    where === \"policy\" &&\n    (reason === undefined || reason === \"UNAUTHORIZED\")\n  ) {\n    return { sessionLoss: error, reason };\n  }\n  if (status === 401 || status === 403) {\n    return where === \"source\"\n      ? AuthFailures.fromAPIError(error)!\n      : AuthFailures.forbidden(reason ?? \"FORBIDDEN\");\n  }\n  if (status !== undefined && status < 500) {\n    throw BetterAuthConfigurationError.atRequest(\n      \"BETTER_AUTH_REJECTED_CALL\",\n      `better-auth rejected the library's call (${status} ${reason})`,\n      { site },\n    );\n  }\n  throw createInfrastructureError(error, {\n    secrets,\n    exposeRawCause: options?.exposeRawCause,\n  });\n}\n"],"mappings":";;;AAQA,SAAgB,kBAAkB,OAAgB,KAA2B;CAC3E,KACG,OAAO,UAAU,YAAY,UAAU,SACxC,OAAO,UAAU,YAEjB;CAEF,IAAI;EACF,OAAO,QAAQ,IAAI,OAAO,GAAG;CAC/B,QAAQ;EACN;CACF;AACF;AAEA,IAAa,gBAAb,MAA2B;CACzB;CAEA,YAAY,UAAgC,CAAC,GAAG;EAC9C,MAAM,yBAAS,IAAI,IAAY;EAC/B,MAAM,OAAO,UAAkB;GAC7B,IAAI,CAAC,OACH;GAEF,OAAO,IAAI,KAAK;GAChB,IAAI,UAAU;GACd,IAAI;IACF,UAAU,mBAAmB,KAAK;IAClC,OAAO,IAAI,OAAO;GACpB,QAAQ,CAER;GACA,KAAK,MAAM,QAAQ,CAAC,OAAO,OAAO,GAAG;IACnC,MAAM,YAAY,KAAK,YAAY,GAAG;IACtC,IAAI,aAAa,IACf,OAAO,IAAI,KAAK,MAAM,GAAG,SAAS,CAAC;GAEvC;EACF;EACA,KAAK,MAAM,SAAS,QAAQ,WAAW,CAAC,GACtC,IAAI,KAAK;EAEX,MAAM,UAAU,QAAQ;EACxB,KAAK,MAAM,WAAW,SAAS,IAAI,QAAQ,KAAK,GAAA,CAAI,MAAM,GAAG,GAAG;GAC9D,MAAM,YAAY,OAAO,QAAQ,GAAG;GACpC,IAAI,aAAa,GAAG;IAClB,MAAM,QAAQ,OAAO,MAAM,YAAY,CAAC,CAAC,CAAC,KAAK;IAC/C,IAAI,KAAK;IACT,IAAI,MAAM,WAAW,IAAG,KAAK,MAAM,SAAS,IAAG,GAC7C,IAAI,MAAM,MAAM,GAAG,EAAE,CAAC;GAE1B;EACF;EACA,MAAM,gBAAgB,SAAS,IAAI,eAAe;EAClD,IAAI,eAAe;GACjB,IAAI,aAAa;GACjB,MAAM,aAAa,eAAe,KAAK,aAAa,CAAC,GAAG;GACxD,IAAI,YACF,IAAI,UAAU;EAElB;EACA,KAAK,MAAM,QAAQ,QAAQ,qBAAqB,CAAC,GAAG;GAClD,MAAM,QAAQ,SAAS,IAAI,IAAI;GAC/B,IAAI,OACF,IAAI,KAAK;EAEb;EACA,KAAK,WAAW,CAAC,GAAG,MAAM,CAAC,CAAC,MACzB,MAAM,UAAU,MAAM,SAAS,KAAK,MACvC;CACF;CAEA,OAAO,OAAuB;EAC5B,OAAO,KAAK,YAAY,OAAO,mBAAG,IAAI,IAAI,CAAC;CAC7C;CAEA,eAAuB,OAAuB;EAC5C,KAAK,MAAM,UAAU,KAAK,UACxB,QAAQ,MAAM,MAAM,MAAM,CAAC,CAAC,KAAK,YAAY;EAE/C,OAAO;CACT;CAEA,WAAmB,OAAuB;EACxC,OAAO,KAAK,eAAe,KAAK,CAAC,CAC9B,MAAM,UAAU,CAAC,CAAC,CAAC,EAAE,CACrB,MAAM,GAAG,GAAG;CACjB;CAEA,YACE,OACA,OACA,MACO;EACP,MAAM,UAAU,kBAAkB,OAAO,SAAS;EAClD,MAAM,QAAQ,IAAI,MAChB,KAAK,WACH,OAAO,YAAY,WACf,UACA,OAAO,UAAU,WACf,QACA,+CACR,CACF;EACA,MAAM,OAAO,kBAAkB,OAAO,MAAM;EAC5C,MAAM,OAAO,OAAO,SAAS,WAAW,KAAK,WAAW,IAAI,IAAI;EAChE,KAAK,MAAM,OAAO;GAAC;GAAQ;GAAS;EAAS,GAAY;GACvD,MAAM,QAAQ,kBAAkB,OAAO,GAAG;GAC1C,IACE,OAAO,UAAU,YAChB,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,GAEnD,OAAO,eAAe,OAAO,KAAK;IAChC,OAAO,OAAO,UAAU,WAAW,KAAK,WAAW,KAAK,IAAI;IAC5D,YAAY;GACd,CAAC;EAEL;EACA,MAAM,QAAQ,kBAAkB,OAAO,OAAO;EAC9C,MAAM,SACJ,OAAO,UAAU,WACb,MACG,MAAM,OAAO,CAAC,CACd,QAAQ,SAAS,wBAAwB,KAAK,IAAI,CAAC,CAAC,CACpD,KAAK,SAAS,KAAK,eAAe,IAAI,CAAC,IAC1C,CAAC;EACP,MAAM,QAAQ,CAAC,GAAG,MAAM,KAAK,IAAI,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,KAAK,IAAI;EACtE,KAAK,IAAI,KAAK;EACd,MAAM,SAAS,kBAAkB,OAAO,OAAO;EAC/C,IAAI,WAAW,KAAA,KAAa,QAAQ,KAAK,CAAC,KAAK,IAAI,MAAM,GACvD,OAAO,eAAe,OAAO,SAAS;GACpC,OAAO,KAAK,YAAY,QAAQ,QAAQ,GAAG,IAAI;GAC/C,YAAY;EACd,CAAC;EAEH,OAAO;CACT;AACF;;;ACxIA,MAAM,gBAAgB,OAAO,IAAI,sCAAsC;AACvE,MAAM,uBAAuB,OAAO,IAClC,8CACF;AACA,MAAM,sBAAsB,OAAO,IACjC,6CACF;AACA,MAAM,YAAY,OAAO,IAAI,mCAAmC;;AAEhE,MAAM,kCAAkB,IAAI,QAAyB;AACrD,MAAM,cAAc,OAAO,IAAI,+BAA+B;AA6C9D,SAAS,QAA0B,OAAU,OAAkB;CAC7D,OAAO,eAAe,OAAO,OAAO,EAAE,OAAO,KAAK,CAAC;CACnD,OAAO;AACT;AAEA,SAAgB,cAAc,OAAsC;CAClE,OAAO,kBAAkB,OAAO,aAAa,MAAM;AACrD;AAEA,SAAgB,sBACd,OACwC;CACxC,OAAO,kBAAkB,OAAO,oBAAoB,MAAM;AAC5D;AAEA,SAAgB,qBACd,OACuC;CACvC,OAAO,kBAAkB,OAAO,mBAAmB,MAAM;AAC3D;AAEA,SAAS,UAAU,OAAoC;CACrD,IAAI;EACF,IAAI,EAAA,GAACA,gBAAAA,WAAAA,CAAW,KAAK,GACnB;EAEF,MAAM,SAAS,kBAAkB,OAAO,YAAY;EACpD,OAAO,OAAO,WAAW,YACvB,OAAO,UAAU,MAAM,KACvB,UAAU,OACV,UAAU,MACR,SACA,KAAA;CACN,QAAQ;EACN;CACF;AACF;AAEA,SAAS,UAAU,OAAoC;CACrD,MAAM,SAAS,kBAAkB,kBAAkB,OAAO,MAAM,GAAG,MAAM;CACzE,OAAO,OAAO,WAAW,WAAW,SAAS,KAAA;AAC/C;;AAGA,SAAgB,mBAAmB,OAAyB;CAC1D,MAAM,SAAS,IAAI,QAAQ;CAC3B,KAAK,MAAM,SAAS,CAClB,kBAAkB,OAAO,WAAW,GACpC,kBAAkB,OAAO,SAAS,CACpC,GAAG;EACD,IAAI,UAAU,KAAA,KAAa,UAAU,MACnC;EAEF,IAAI;GACF,MAAM,UAAU,IAAI,QAAQ,KAAoB;GAChD,KAAK,MAAM,CAAC,MAAM,UAAU,SAC1B,IAAI,SAAS,cACX,OAAO,IAAI,MAAM,KAAK;GAG1B,KAAK,MAAM,UAAU,QAAQ,aAAa,GACxC,OAAO,OAAO,cAAc,MAAM;EAEtC,QAAQ,CAER;CACF;CACA,OAAO;AACT;AAEA,SAAS,UAAU,OAMH;CACd,MAAM,QAAQ;EACZ,KAAK;EACL,KAAK;EACL,KAAK;CACP;CACA,MAAM,WAAW;EACf,KAAK;EACL,KAAK;EACL,KAAK;CACP;CACA,MAAM,UAAU,IAAI,QAAQ;CAC5B,MAAM,QAAQ,MAAM;CACpB,IAAI,UAAU,KAAA,KAAa,OAAO,SAAS,KAAK,KAAK,SAAS,GAC5D,QAAQ,IAAI,eAAe,OAAO,KAAK,KAAK,KAAK,CAAC,CAAC;CAErD,OAAO,QACL;EACE,QAAQ,MAAM;EACd,MAAM,MAAM,MAAM;EAClB,QAAQ,MAAM;EACd,SAAS,MAAM,WAAW,SAAS,MAAM;EACzC,WAAW,MAAM;EACjB,GAAI,QAAQ,IAAI,aAAa,IAAI,EAAE,QAAQ,IAAI,CAAC;CAClD,GACA,aACF;AACF;AAEA,MAAa,eAAe;CAC1B,gBAAgB,SAA+B;EAC7C,OAAO,UAAU;GAAE,QAAQ;GAAK;EAAQ,CAAC;CAC3C;CACA,UAAU;CACV,UAAU,QAAgB,SAA+B;EACvD,OAAO,UAAU;GAAE,QAAQ;GAAK;GAAQ;EAAQ,CAAC;CACnD;CACA,aAAa,OAAoC;EAC/C,MAAM,SAAS,UAAU,KAAK;EAC9B,IAAI,WAAW,OAAO,WAAW,OAAO,WAAW,KACjD,OAAO;EAET,MAAM,kBAAkB,mBAAmB,KAAK;EAKhD,MAAM,QAAQ,kBAJE,kBACd,kBAAkB,OAAO,MAAM,GAC/B,SAE8B,GAAS,YAAY;EACrD,MAAM,UAAU,UAAU;GACxB;GACA,QAAQ,UAAU,KAAK;GACvB,WAAW,gBAAgB,IAAI,kBAAkB,KAAK,KAAA;GACtD,mBACE,WAAW,OAAO,OAAO,UAAU,WAAW,QAAQ,MAAO,KAAA;EACjE,CAAC;EACD,MAAM,aAAa,gBAAgB,IAAI,aAAa;EACpD,IAAI,eAAe,MAAM;GACvB,MAAM,UAAU,IAAI,QAAQ,QAAQ,OAAO;GAC3C,QAAQ,IAAI,eAAe,UAAU;GACrC,OAAO,QAAQ;IAAE,GAAG;IAAS;GAAQ,GAAG,aAAa;EACvD;EACA,OAAO;CACT;AACF;AAEA,IAAa,+BAAb,MAAa,qCAAqC,MAAM;CACtD;CACA;CACA;CACA;CACA;CACA,aAAsB;EACpB,MAAM;EACN,QAAQ;EACR,YAAY;CACd;CACA;CAEA,YAAY,MAAc,QAAgB,MAAe;EACvD,MAAM,MAAM;EACZ,KAAK,OAAO;EACZ,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,KAAK,OAAO;EACZ,KAAK,QAAQ;EACb,QAAQ,MAAM,mBAAmB;CACnC;CAEA,OAAO,UACL,MACA,QACA,SAC8B;EAC9B,MAAM,QAAQ,IAAI,6BAChB,MACA,mCACA,SAAS,IACX;EACA,OAAO,iBAAiB,OAAO;GAC7B,QAAQ;IAAE,OAAO;IAAQ,YAAY;GAAK;GAC1C,MAAM;IAAE,OAAO,SAAS;IAAM,YAAY;GAAK;GAC/C,OAAO;IAAE,OAAO;IAAW,YAAY;GAAK;EAC9C,CAAC;EACD,OAAO;CACT;AACF;AAEA,IAAa,gCAAb,cAAmD,MAAM;CACvD;CACA,aAAsB;EACpB,MAAM;EACN,QAAQ;EACR,YAAY;CACd;CAEA,YAAY,OAAgB,SAA2C;EACrE,MAAM,oCAAoC;EAC1C,KAAK,OAAO;EACZ,KAAK,QAAQ,IAAI,cAAc,OAAO,CAAC,CAAC,OAAO,KAAK;EACpD,gBAAgB,IAAI,MAAM,KAAK;EAC/B,QAAQ,MAAM,oBAAoB;CACpC;AACF;;AAGA,SAAgB,0BACd,OACA,SAC+B;CAE/B,MAAM,QAAQ,IAAI,8BAA8B,OAAO,OAAO;CAC9D,IAAI,SAAS,mBAAmB,MAC9B,OAAO,eAAe,OAAO,WAAW;EACtC,OAAO;EACP,YAAY;CACd,CAAC;CAEH,OAAO;AACT;;;;;;AAOA,SAAgB,iBACd,OACA,SAC+B;CAC/B,MAAM,WAAW,gBAAgB,IAAI,KAAK,IACtC,gBAAgB,IAAI,KAAK,IACzB,kBAAkB,OAAO,SAAS;CACtC,MAAM,YAAY,IAAI,8BACpB,kBAAkB,OAAO,OAAO,GAChC,OACF;CACA,gBAAgB,IAAI,WAAW,QAAQ;CACvC,IAAI,QAAQ,mBAAmB,QAAQ,aAAa,KAAA,GAClD,OAAO,eAAe,WAAW,WAAW;EAC1C,OAAO;EACP,YAAY;CACd,CAAC;CAEH,OAAO;AACT;AAEA,SAAgB,YAAY,OAA+C;CACzE,OAAO,kBAAkB,OAAO,SAAS;AAC3C;;AASA,SAAgB,gBACd,OACA,OACA,MACA,SACA,SACoC;CACpC,IAAI,cAAc,KAAK,GACrB,OAAO;CAET,IAAI,sBAAsB,KAAK,KAAK,qBAAqB,KAAK,GAC5D,MAAM;CAER,MAAM,SAAS,UAAU,KAAK;CAC9B,MAAM,SAAS,UAAU,KAAK;CAC9B,IAAI,WAAW,KACb,OAAO,aAAa,aAAa,KAAK;CAExC,IACE,WAAW,OACX,UAAU,aACT,WAAW,KAAA,KAAa,WAAW,iBAEpC,OAAO;EAAE,aAAa;EAAO;CAAO;CAEtC,IAAI,WAAW,OAAO,WAAW,KAC/B,OAAO,UAAU,WACb,aAAa,aAAa,KAAK,IAC/B,aAAa,UAAU,UAAU,WAAW;CAElD,IAAI,WAAW,KAAA,KAAa,SAAS,KACnC,MAAM,6BAA6B,UACjC,6BACA,4CAA4C,OAAO,GAAG,OAAO,IAC7D,EAAE,KAAK,CACT;CAEF,MAAM,0BAA0B,OAAO;EACrC;EACA,gBAAgB,SAAS;CAC3B,CAAC;AACH"}
+{"version":3,"file":"auth-errors-RW7hOVI-.cjs","names":["isAPIError"],"sources":["../src/error-redactor.ts","../src/auth-errors.ts"],"sourcesContent":["/** Inputs come from the active request's owner; the redactor retains no scope. */\nexport interface ErrorRedactorOptions {\n  secrets?: readonly string[];\n  headers?: Headers;\n  credentialHeaders?: readonly string[];\n}\n\n/** Reading an arbitrary thrown value must not invoke another escaping fault. */\nexport function readErrorProperty(value: unknown, key: PropertyKey): unknown {\n  if (\n    (typeof value !== \"object\" || value === null) &&\n    typeof value !== \"function\"\n  ) {\n    return undefined;\n  }\n  try {\n    return Reflect.get(value, key);\n  } catch {\n    return undefined;\n  }\n}\n\nexport class ErrorRedactor {\n  readonly #secrets: readonly string[];\n\n  constructor(options: ErrorRedactorOptions = {}) {\n    const values = new Set<string>();\n    const add = (value: string) => {\n      if (!value) {\n        return;\n      }\n      values.add(value);\n      let decoded = value;\n      try {\n        decoded = decodeURIComponent(value);\n        values.add(decoded);\n      } catch {\n        // Invalid escaping must not prevent redaction of the raw credential.\n      }\n      for (const form of [value, decoded]) {\n        const separator = form.lastIndexOf(\".\");\n        if (separator >= 16) {\n          values.add(form.slice(0, separator));\n        }\n      }\n    };\n    for (const value of options.secrets ?? []) {\n      add(value);\n    }\n    const headers = options.headers;\n    for (const cookie of (headers?.get(\"cookie\") ?? \"\").split(\";\")) {\n      const separator = cookie.indexOf(\"=\");\n      if (separator >= 0) {\n        const value = cookie.slice(separator + 1).trim();\n        add(value);\n        if (value.startsWith('\"') && value.endsWith('\"')) {\n          add(value.slice(1, -1));\n        }\n      }\n    }\n    const authorization = headers?.get(\"authorization\");\n    if (authorization) {\n      add(authorization);\n      const credential = /^\\S+\\s+(.+)$/.exec(authorization)?.[1];\n      if (credential) {\n        add(credential);\n      }\n    }\n    for (const name of options.credentialHeaders ?? []) {\n      const value = headers?.get(name);\n      if (value) {\n        add(value);\n      }\n    }\n    this.#secrets = [...values].sort(\n      (left, right) => right.length - left.length,\n    );\n  }\n\n  redact(cause: unknown): Error {\n    return this.redactCause(cause, 0, new Set());\n  }\n\n  private replaceSecrets(value: string): string {\n    for (const secret of this.#secrets) {\n      value = value.split(secret).join(\"[REDACTED]\");\n    }\n    return value;\n  }\n\n  private diagnostic(value: string): string {\n    return this.replaceSecrets(value)\n      .split(/[\\r\\n]/, 1)[0]\n      .slice(0, 300);\n  }\n\n  private redactCause(\n    cause: unknown,\n    depth: number,\n    seen: Set<unknown>,\n  ): Error {\n    const message = readErrorProperty(cause, \"message\");\n    const error = new Error(\n      this.diagnostic(\n        typeof message === \"string\"\n          ? message\n          : typeof cause === \"string\"\n            ? cause\n            : \"Unknown authentication infrastructure failure\",\n      ),\n    );\n    const name = readErrorProperty(cause, \"name\");\n    error.name = typeof name === \"string\" ? this.diagnostic(name) : \"Error\";\n    for (const key of [\"code\", \"errno\", \"syscall\"] as const) {\n      const value = readErrorProperty(cause, key);\n      if (\n        typeof value === \"string\" ||\n        (typeof value === \"number\" && Number.isFinite(value))\n      ) {\n        Object.defineProperty(error, key, {\n          value: typeof value === \"string\" ? this.diagnostic(value) : value,\n          enumerable: true,\n        });\n      }\n    }\n    const stack = readErrorProperty(cause, \"stack\");\n    const frames =\n      typeof stack === \"string\"\n        ? stack\n            .split(/\\r?\\n/)\n            .filter((line) => /^\\s+at .+:\\d+:\\d+\\)?$/.test(line))\n            .map((line) => this.replaceSecrets(line))\n        : [];\n    error.stack = [`${error.name}: ${error.message}`, ...frames].join(\"\\n\");\n    seen.add(cause);\n    const nested = readErrorProperty(cause, \"cause\");\n    if (nested !== undefined && depth < 3 && !seen.has(nested)) {\n      Object.defineProperty(error, \"cause\", {\n        value: this.redactCause(nested, depth + 1, seen),\n        enumerable: false,\n      });\n    }\n    return error;\n  }\n}\n","import type { ExecutionContext } from \"@nestjs/common\";\nimport { isAPIError } from \"better-auth/api\";\nimport {\n  ErrorRedactor,\n  type ErrorRedactorOptions,\n  readErrorProperty,\n} from \"./error-redactor.js\";\n\nconst FAILURE_BRAND = Symbol.for(\"@nestjs-kit/better-auth:auth-failure\");\nconst INFRASTRUCTURE_BRAND = Symbol.for(\n  \"@nestjs-kit/better-auth:infrastructure-error\",\n);\nconst CONFIGURATION_BRAND = Symbol.for(\n  \"@nestjs-kit/better-auth:configuration-error\",\n);\nconst RAW_CAUSE = Symbol.for(\"@nestjs-kit/better-auth:raw-cause\");\n/** Unredacted causes stay module-private; only an instance's exposeRawCause opt-in attaches one (RAW_CAUSE). */\nconst ORIGINAL_CAUSES = new WeakMap<object, unknown>();\nconst SDK_HEADERS = Symbol.for(\"better-call:api-error-headers\");\n\nexport type AuthErrorCode = \"UNAUTHENTICATED\" | \"FORBIDDEN\" | \"RATE_LIMITED\";\n\n/** A transport-neutral denial. Only transports make it throwable. */\nexport interface AuthFailure {\n  readonly status: 401 | 403 | 429;\n  readonly code: AuthErrorCode;\n  readonly reason?: string;\n  readonly message: string;\n  readonly challenge?: string;\n  readonly headers?: Headers;\n}\n\nexport interface AuthErrorBody {\n  statusCode: 401 | 403 | 429;\n  error: string;\n  code: AuthErrorCode;\n  reason?: string;\n  message: string;\n}\n\nexport interface AuthGraphqlExtensions {\n  code: AuthErrorCode | \"INTERNAL_SERVER_ERROR\";\n  reason?: string;\n  statusCode: number;\n}\n\nexport interface AuthTransportErrorPayload {\n  status: \"error\";\n  statusCode: number;\n  code: AuthErrorCode;\n  reason?: string;\n  message: string;\n}\n\nexport interface ErrorMappingOptions {\n  map?: (\n    failure: AuthFailure,\n    context: ExecutionContext,\n    transport: string,\n  ) => unknown;\n  exposeRawCause?: boolean;\n}\n\nfunction branded<T extends object>(value: T, brand: symbol): T {\n  Object.defineProperty(value, brand, { value: true });\n  return value;\n}\n\nexport function isAuthFailure(value: unknown): value is AuthFailure {\n  return readErrorProperty(value, FAILURE_BRAND) === true;\n}\n\nexport function isInfrastructureError(\n  value: unknown,\n): value is BetterAuthInfrastructureError {\n  return readErrorProperty(value, INFRASTRUCTURE_BRAND) === true;\n}\n\nexport function isConfigurationError(\n  value: unknown,\n): value is BetterAuthConfigurationError {\n  return readErrorProperty(value, CONFIGURATION_BRAND) === true;\n}\n\nfunction sdkStatus(error: unknown): number | undefined {\n  try {\n    if (!isAPIError(error)) {\n      return undefined;\n    }\n    const status = readErrorProperty(error, \"statusCode\");\n    return typeof status === \"number\" &&\n      Number.isInteger(status) &&\n      status >= 100 &&\n      status <= 599\n      ? status\n      : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction sdkReason(error: unknown): string | undefined {\n  const reason = readErrorProperty(readErrorProperty(error, \"body\"), \"code\");\n  return typeof reason === \"string\" ? reason : undefined;\n}\n\n/** Internal: preserve cookie lines for the exchange's separately governed cleanup. */\nexport function getAPIErrorHeaders(error: unknown): Headers {\n  const result = new Headers();\n  for (const value of [\n    readErrorProperty(error, SDK_HEADERS),\n    readErrorProperty(error, \"headers\"),\n  ]) {\n    if (value === undefined || value === null) {\n      continue;\n    }\n    try {\n      const headers = new Headers(value as HeadersInit);\n      for (const [name, value] of headers) {\n        if (name !== \"set-cookie\") {\n          result.set(name, value);\n        }\n      }\n      for (const cookie of headers.getSetCookie()) {\n        result.append(\"set-cookie\", cookie);\n      }\n    } catch {\n      // A malformed optional header collection must not mask the original fault.\n    }\n  }\n  return result;\n}\n\nfunction rejection(input: {\n  status: 401 | 403 | 429;\n  reason?: string;\n  message?: string;\n  challenge?: string;\n  retryAfterSeconds?: number;\n}): AuthFailure {\n  const codes = {\n    401: \"UNAUTHENTICATED\",\n    403: \"FORBIDDEN\",\n    429: \"RATE_LIMITED\",\n  } as const;\n  const messages = {\n    401: \"Unauthorized\",\n    403: \"Forbidden\",\n    429: \"Too Many Requests\",\n  } as const;\n  const headers = new Headers();\n  const retry = input.retryAfterSeconds;\n  if (retry !== undefined && Number.isFinite(retry) && retry >= 0) {\n    headers.set(\"retry-after\", String(Math.ceil(retry)));\n  }\n  return branded(\n    {\n      status: input.status,\n      code: codes[input.status],\n      reason: input.reason,\n      message: input.message ?? messages[input.status],\n      challenge: input.challenge,\n      ...(headers.has(\"retry-after\") ? { headers } : {}),\n    },\n    FAILURE_BRAND,\n  );\n}\n\nexport const AuthFailures = {\n  unauthenticated(message?: string): AuthFailure {\n    return rejection({ status: 401, message });\n  },\n  rejected: rejection,\n  forbidden(reason: string, message?: string): AuthFailure {\n    return rejection({ status: 403, reason, message });\n  },\n  fromAPIError(error: unknown): AuthFailure | null {\n    const status = sdkStatus(error);\n    if (status !== 401 && status !== 403 && status !== 429) {\n      return null;\n    }\n    const originalHeaders = getAPIErrorHeaders(error);\n    const details = readErrorProperty(\n      readErrorProperty(error, \"body\"),\n      \"details\",\n    );\n    const delay = readErrorProperty(details, \"tryAgainIn\");\n    const failure = rejection({\n      status,\n      reason: sdkReason(error),\n      challenge: originalHeaders.get(\"www-authenticate\") ?? undefined,\n      retryAfterSeconds:\n        status === 429 && typeof delay === \"number\" ? delay / 1000 : undefined,\n    });\n    const retryAfter = originalHeaders.get(\"retry-after\");\n    if (retryAfter !== null) {\n      const headers = new Headers(failure.headers);\n      headers.set(\"retry-after\", retryAfter);\n      return branded({ ...failure, headers }, FAILURE_BRAND);\n    }\n    return failure;\n  },\n};\n\nexport class BetterAuthConfigurationError extends Error {\n  readonly code: string;\n  readonly detail: string;\n  readonly site?: string;\n  readonly hint?: string;\n  readonly phase: \"boot\" | \"request\";\n  readonly extensions = {\n    code: \"INTERNAL_SERVER_ERROR\",\n    reason: \"AUTH_MISCONFIGURED\",\n    statusCode: 500,\n  } as const;\n  readonly issues?: readonly BetterAuthConfigurationError[];\n\n  constructor(code: string, detail: string, hint?: string) {\n    super(detail);\n    this.name = \"BetterAuthConfigurationError\";\n    this.code = code;\n    this.detail = detail;\n    this.hint = hint;\n    this.phase = \"boot\";\n    branded(this, CONFIGURATION_BRAND);\n  }\n\n  static atRequest(\n    code: string,\n    detail: string,\n    options?: { site?: string; hint?: string },\n  ): BetterAuthConfigurationError {\n    const error = new BetterAuthConfigurationError(\n      code,\n      \"Authentication is misconfigured\",\n      options?.hint,\n    );\n    Object.defineProperties(error, {\n      detail: { value: detail, enumerable: true },\n      site: { value: options?.site, enumerable: true },\n      phase: { value: \"request\", enumerable: true },\n    });\n    return error;\n  }\n}\n\nexport class BetterAuthInfrastructureError extends Error {\n  readonly cause: Error;\n  readonly extensions = {\n    code: \"INTERNAL_SERVER_ERROR\",\n    reason: \"AUTH_UNAVAILABLE\",\n    statusCode: 500,\n  } as const;\n\n  constructor(cause: unknown, options?: { secrets?: readonly string[] }) {\n    super(\"Authentication service unavailable\");\n    this.name = \"BetterAuthInfrastructureError\";\n    this.cause = new ErrorRedactor(options).redact(cause);\n    ORIGINAL_CAUSES.set(this, cause);\n    branded(this, INFRASTRUCTURE_BRAND);\n  }\n}\n\n/** Internal factory for an instance's explicit diagnostic opt-in, never global state. */\nexport function createInfrastructureError(\n  cause: unknown,\n  options?: ErrorRedactorOptions & { exposeRawCause?: boolean },\n): BetterAuthInfrastructureError {\n  // Preserve request-owned redaction inputs without widening the public constructor.\n  const error = new BetterAuthInfrastructureError(cause, options);\n  if (options?.exposeRawCause === true) {\n    Object.defineProperty(error, RAW_CAUSE, {\n      value: cause,\n      enumerable: false,\n    });\n  }\n  return error;\n}\n\n/**\n * Internal: the form of an already-classified infrastructure error that one request delivers. The request's cookie,\n * authorization and declared credential values are redacted on top of the thrower's own redaction, and the original\n * cause is attached only when the instance opts in, as for errors the kernel classifies itself.\n */\nexport function redactForRequest(\n  error: BetterAuthInfrastructureError,\n  options: ErrorRedactorOptions & { exposeRawCause?: boolean },\n): BetterAuthInfrastructureError {\n  const original = ORIGINAL_CAUSES.has(error)\n    ? ORIGINAL_CAUSES.get(error)\n    : readErrorProperty(error, RAW_CAUSE);\n  const delivered = new BetterAuthInfrastructureError(\n    readErrorProperty(error, \"cause\"),\n    options,\n  );\n  ORIGINAL_CAUSES.set(delivered, original);\n  if (options.exposeRawCause === true && original !== undefined) {\n    Object.defineProperty(delivered, RAW_CAUSE, {\n      value: original,\n      enumerable: false,\n    });\n  }\n  return delivered;\n}\n\nexport function getRawCause(error: BetterAuthInfrastructureError): unknown {\n  return readErrorProperty(error, RAW_CAUSE);\n}\n\n/** Internal: evaluation must distinguish session loss from a failed session read. */\nexport interface SessionLossCandidate {\n  readonly sessionLoss: unknown;\n  readonly reason?: string;\n}\n\n/** Internal safety net. Evaluation performs the authoritative session-loss recheck. */\nexport function normalizeThrown(\n  error: unknown,\n  where: \"source\" | \"policy\",\n  site: string,\n  secrets: readonly string[],\n  options?: { exposeRawCause?: boolean },\n): AuthFailure | SessionLossCandidate {\n  if (isAuthFailure(error)) {\n    return error;\n  }\n  if (isInfrastructureError(error) || isConfigurationError(error)) {\n    throw error;\n  }\n  const status = sdkStatus(error);\n  const reason = sdkReason(error);\n  if (status === 429) {\n    return AuthFailures.fromAPIError(error)!;\n  }\n  if (\n    status === 401 &&\n    where === \"policy\" &&\n    (reason === undefined || reason === \"UNAUTHORIZED\")\n  ) {\n    return { sessionLoss: error, reason };\n  }\n  if (status === 401 || status === 403) {\n    return where === \"source\"\n      ? AuthFailures.fromAPIError(error)!\n      : AuthFailures.forbidden(reason ?? \"FORBIDDEN\");\n  }\n  if (status !== undefined && status < 500) {\n    throw BetterAuthConfigurationError.atRequest(\n      \"BETTER_AUTH_REJECTED_CALL\",\n      `better-auth rejected the library's call (${status} ${reason})`,\n      { site },\n    );\n  }\n  throw createInfrastructureError(error, {\n    secrets,\n    exposeRawCause: options?.exposeRawCause,\n  });\n}\n"],"mappings":";;;AAQA,SAAgB,kBAAkB,OAAgB,KAA2B;CAC3E,KACG,OAAO,UAAU,YAAY,UAAU,SACxC,OAAO,UAAU,YAEjB;CAEF,IAAI;EACF,OAAO,QAAQ,IAAI,OAAO,GAAG;CAC/B,QAAQ;EACN;CACF;AACF;AAEA,IAAa,gBAAb,MAA2B;CACzB;CAEA,YAAY,UAAgC,CAAC,GAAG;EAC9C,MAAM,yBAAS,IAAI,IAAY;EAC/B,MAAM,OAAO,UAAkB;GAC7B,IAAI,CAAC,OACH;GAEF,OAAO,IAAI,KAAK;GAChB,IAAI,UAAU;GACd,IAAI;IACF,UAAU,mBAAmB,KAAK;IAClC,OAAO,IAAI,OAAO;GACpB,QAAQ,CAER;GACA,KAAK,MAAM,QAAQ,CAAC,OAAO,OAAO,GAAG;IACnC,MAAM,YAAY,KAAK,YAAY,GAAG;IACtC,IAAI,aAAa,IACf,OAAO,IAAI,KAAK,MAAM,GAAG,SAAS,CAAC;GAEvC;EACF;EACA,KAAK,MAAM,SAAS,QAAQ,WAAW,CAAC,GACtC,IAAI,KAAK;EAEX,MAAM,UAAU,QAAQ;EACxB,KAAK,MAAM,WAAW,SAAS,IAAI,QAAQ,KAAK,GAAA,CAAI,MAAM,GAAG,GAAG;GAC9D,MAAM,YAAY,OAAO,QAAQ,GAAG;GACpC,IAAI,aAAa,GAAG;IAClB,MAAM,QAAQ,OAAO,MAAM,YAAY,CAAC,CAAC,CAAC,KAAK;IAC/C,IAAI,KAAK;IACT,IAAI,MAAM,WAAW,IAAG,KAAK,MAAM,SAAS,IAAG,GAC7C,IAAI,MAAM,MAAM,GAAG,EAAE,CAAC;GAE1B;EACF;EACA,MAAM,gBAAgB,SAAS,IAAI,eAAe;EAClD,IAAI,eAAe;GACjB,IAAI,aAAa;GACjB,MAAM,aAAa,eAAe,KAAK,aAAa,CAAC,GAAG;GACxD,IAAI,YACF,IAAI,UAAU;EAElB;EACA,KAAK,MAAM,QAAQ,QAAQ,qBAAqB,CAAC,GAAG;GAClD,MAAM,QAAQ,SAAS,IAAI,IAAI;GAC/B,IAAI,OACF,IAAI,KAAK;EAEb;EACA,KAAK,WAAW,CAAC,GAAG,MAAM,CAAC,CAAC,MACzB,MAAM,UAAU,MAAM,SAAS,KAAK,MACvC;CACF;CAEA,OAAO,OAAuB;EAC5B,OAAO,KAAK,YAAY,OAAO,mBAAG,IAAI,IAAI,CAAC;CAC7C;CAEA,eAAuB,OAAuB;EAC5C,KAAK,MAAM,UAAU,KAAK,UACxB,QAAQ,MAAM,MAAM,MAAM,CAAC,CAAC,KAAK,YAAY;EAE/C,OAAO;CACT;CAEA,WAAmB,OAAuB;EACxC,OAAO,KAAK,eAAe,KAAK,CAAC,CAC9B,MAAM,UAAU,CAAC,CAAC,CAAC,EAAE,CACrB,MAAM,GAAG,GAAG;CACjB;CAEA,YACE,OACA,OACA,MACO;EACP,MAAM,UAAU,kBAAkB,OAAO,SAAS;EAClD,MAAM,QAAQ,IAAI,MAChB,KAAK,WACH,OAAO,YAAY,WACf,UACA,OAAO,UAAU,WACf,QACA,+CACR,CACF;EACA,MAAM,OAAO,kBAAkB,OAAO,MAAM;EAC5C,MAAM,OAAO,OAAO,SAAS,WAAW,KAAK,WAAW,IAAI,IAAI;EAChE,KAAK,MAAM,OAAO;GAAC;GAAQ;GAAS;EAAS,GAAY;GACvD,MAAM,QAAQ,kBAAkB,OAAO,GAAG;GAC1C,IACE,OAAO,UAAU,YAChB,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,GAEnD,OAAO,eAAe,OAAO,KAAK;IAChC,OAAO,OAAO,UAAU,WAAW,KAAK,WAAW,KAAK,IAAI;IAC5D,YAAY;GACd,CAAC;EAEL;EACA,MAAM,QAAQ,kBAAkB,OAAO,OAAO;EAC9C,MAAM,SACJ,OAAO,UAAU,WACb,MACG,MAAM,OAAO,CAAC,CACd,QAAQ,SAAS,wBAAwB,KAAK,IAAI,CAAC,CAAC,CACpD,KAAK,SAAS,KAAK,eAAe,IAAI,CAAC,IAC1C,CAAC;EACP,MAAM,QAAQ,CAAC,GAAG,MAAM,KAAK,IAAI,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,KAAK,IAAI;EACtE,KAAK,IAAI,KAAK;EACd,MAAM,SAAS,kBAAkB,OAAO,OAAO;EAC/C,IAAI,WAAW,KAAA,KAAa,QAAQ,KAAK,CAAC,KAAK,IAAI,MAAM,GACvD,OAAO,eAAe,OAAO,SAAS;GACpC,OAAO,KAAK,YAAY,QAAQ,QAAQ,GAAG,IAAI;GAC/C,YAAY;EACd,CAAC;EAEH,OAAO;CACT;AACF;;ACxIA,MAAM,gBAAgB,OAAO,IAAI,sCAAsC;AACvE,MAAM,uBAAuB,OAAO,IAClC,8CACF;AACA,MAAM,sBAAsB,OAAO,IACjC,6CACF;AACA,MAAM,YAAY,OAAO,IAAI,mCAAmC;;AAEhE,MAAM,kCAAkB,IAAI,QAAyB;AACrD,MAAM,cAAc,OAAO,IAAI,+BAA+B;AA6C9D,SAAS,QAA0B,OAAU,OAAkB;CAC7D,OAAO,eAAe,OAAO,OAAO,EAAE,OAAO,KAAK,CAAC;CACnD,OAAO;AACT;AAEA,SAAgB,cAAc,OAAsC;CAClE,OAAO,kBAAkB,OAAO,aAAa,MAAM;AACrD;AAEA,SAAgB,sBACd,OACwC;CACxC,OAAO,kBAAkB,OAAO,oBAAoB,MAAM;AAC5D;AAEA,SAAgB,qBACd,OACuC;CACvC,OAAO,kBAAkB,OAAO,mBAAmB,MAAM;AAC3D;AAEA,SAAS,UAAU,OAAoC;CACrD,IAAI;EACF,IAAI,EAAA,GAACA,gBAAAA,WAAAA,CAAW,KAAK,GACnB;EAEF,MAAM,SAAS,kBAAkB,OAAO,YAAY;EACpD,OAAO,OAAO,WAAW,YACvB,OAAO,UAAU,MAAM,KACvB,UAAU,OACV,UAAU,MACR,SACA,KAAA;CACN,QAAQ;EACN;CACF;AACF;AAEA,SAAS,UAAU,OAAoC;CACrD,MAAM,SAAS,kBAAkB,kBAAkB,OAAO,MAAM,GAAG,MAAM;CACzE,OAAO,OAAO,WAAW,WAAW,SAAS,KAAA;AAC/C;;AAGA,SAAgB,mBAAmB,OAAyB;CAC1D,MAAM,SAAS,IAAI,QAAQ;CAC3B,KAAK,MAAM,SAAS,CAClB,kBAAkB,OAAO,WAAW,GACpC,kBAAkB,OAAO,SAAS,CACpC,GAAG;EACD,IAAI,UAAU,KAAA,KAAa,UAAU,MACnC;EAEF,IAAI;GACF,MAAM,UAAU,IAAI,QAAQ,KAAoB;GAChD,KAAK,MAAM,CAAC,MAAM,UAAU,SAC1B,IAAI,SAAS,cACX,OAAO,IAAI,MAAM,KAAK;GAG1B,KAAK,MAAM,UAAU,QAAQ,aAAa,GACxC,OAAO,OAAO,cAAc,MAAM;EAEtC,QAAQ,CAER;CACF;CACA,OAAO;AACT;AAEA,SAAS,UAAU,OAMH;CACd,MAAM,QAAQ;EACZ,KAAK;EACL,KAAK;EACL,KAAK;CACP;CACA,MAAM,WAAW;EACf,KAAK;EACL,KAAK;EACL,KAAK;CACP;CACA,MAAM,UAAU,IAAI,QAAQ;CAC5B,MAAM,QAAQ,MAAM;CACpB,IAAI,UAAU,KAAA,KAAa,OAAO,SAAS,KAAK,KAAK,SAAS,GAC5D,QAAQ,IAAI,eAAe,OAAO,KAAK,KAAK,KAAK,CAAC,CAAC;CAErD,OAAO,QACL;EACE,QAAQ,MAAM;EACd,MAAM,MAAM,MAAM;EAClB,QAAQ,MAAM;EACd,SAAS,MAAM,WAAW,SAAS,MAAM;EACzC,WAAW,MAAM;EACjB,GAAI,QAAQ,IAAI,aAAa,IAAI,EAAE,QAAQ,IAAI,CAAC;CAClD,GACA,aACF;AACF;AAEA,MAAa,eAAe;CAC1B,gBAAgB,SAA+B;EAC7C,OAAO,UAAU;GAAE,QAAQ;GAAK;EAAQ,CAAC;CAC3C;CACA,UAAU;CACV,UAAU,QAAgB,SAA+B;EACvD,OAAO,UAAU;GAAE,QAAQ;GAAK;GAAQ;EAAQ,CAAC;CACnD;CACA,aAAa,OAAoC;EAC/C,MAAM,SAAS,UAAU,KAAK;EAC9B,IAAI,WAAW,OAAO,WAAW,OAAO,WAAW,KACjD,OAAO;EAET,MAAM,kBAAkB,mBAAmB,KAAK;EAKhD,MAAM,QAAQ,kBAJE,kBACd,kBAAkB,OAAO,MAAM,GAC/B,SAE8B,GAAS,YAAY;EACrD,MAAM,UAAU,UAAU;GACxB;GACA,QAAQ,UAAU,KAAK;GACvB,WAAW,gBAAgB,IAAI,kBAAkB,KAAK,KAAA;GACtD,mBACE,WAAW,OAAO,OAAO,UAAU,WAAW,QAAQ,MAAO,KAAA;EACjE,CAAC;EACD,MAAM,aAAa,gBAAgB,IAAI,aAAa;EACpD,IAAI,eAAe,MAAM;GACvB,MAAM,UAAU,IAAI,QAAQ,QAAQ,OAAO;GAC3C,QAAQ,IAAI,eAAe,UAAU;GACrC,OAAO,QAAQ;IAAE,GAAG;IAAS;GAAQ,GAAG,aAAa;EACvD;EACA,OAAO;CACT;AACF;AAEA,IAAa,+BAAb,MAAa,qCAAqC,MAAM;CACtD;CACA;CACA;CACA;CACA;CACA,aAAsB;EACpB,MAAM;EACN,QAAQ;EACR,YAAY;CACd;CACA;CAEA,YAAY,MAAc,QAAgB,MAAe;EACvD,MAAM,MAAM;EACZ,KAAK,OAAO;EACZ,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,KAAK,OAAO;EACZ,KAAK,QAAQ;EACb,QAAQ,MAAM,mBAAmB;CACnC;CAEA,OAAO,UACL,MACA,QACA,SAC8B;EAC9B,MAAM,QAAQ,IAAI,6BAChB,MACA,mCACA,SAAS,IACX;EACA,OAAO,iBAAiB,OAAO;GAC7B,QAAQ;IAAE,OAAO;IAAQ,YAAY;GAAK;GAC1C,MAAM;IAAE,OAAO,SAAS;IAAM,YAAY;GAAK;GAC/C,OAAO;IAAE,OAAO;IAAW,YAAY;GAAK;EAC9C,CAAC;EACD,OAAO;CACT;AACF;AAEA,IAAa,gCAAb,cAAmD,MAAM;CACvD;CACA,aAAsB;EACpB,MAAM;EACN,QAAQ;EACR,YAAY;CACd;CAEA,YAAY,OAAgB,SAA2C;EACrE,MAAM,oCAAoC;EAC1C,KAAK,OAAO;EACZ,KAAK,QAAQ,IAAI,cAAc,OAAO,CAAC,CAAC,OAAO,KAAK;EACpD,gBAAgB,IAAI,MAAM,KAAK;EAC/B,QAAQ,MAAM,oBAAoB;CACpC;AACF;;AAGA,SAAgB,0BACd,OACA,SAC+B;CAE/B,MAAM,QAAQ,IAAI,8BAA8B,OAAO,OAAO;CAC9D,IAAI,SAAS,mBAAmB,MAC9B,OAAO,eAAe,OAAO,WAAW;EACtC,OAAO;EACP,YAAY;CACd,CAAC;CAEH,OAAO;AACT;;;;;;AAOA,SAAgB,iBACd,OACA,SAC+B;CAC/B,MAAM,WAAW,gBAAgB,IAAI,KAAK,IACtC,gBAAgB,IAAI,KAAK,IACzB,kBAAkB,OAAO,SAAS;CACtC,MAAM,YAAY,IAAI,8BACpB,kBAAkB,OAAO,OAAO,GAChC,OACF;CACA,gBAAgB,IAAI,WAAW,QAAQ;CACvC,IAAI,QAAQ,mBAAmB,QAAQ,aAAa,KAAA,GAClD,OAAO,eAAe,WAAW,WAAW;EAC1C,OAAO;EACP,YAAY;CACd,CAAC;CAEH,OAAO;AACT;AAEA,SAAgB,YAAY,OAA+C;CACzE,OAAO,kBAAkB,OAAO,SAAS;AAC3C;;AASA,SAAgB,gBACd,OACA,OACA,MACA,SACA,SACoC;CACpC,IAAI,cAAc,KAAK,GACrB,OAAO;CAET,IAAI,sBAAsB,KAAK,KAAK,qBAAqB,KAAK,GAC5D,MAAM;CAER,MAAM,SAAS,UAAU,KAAK;CAC9B,MAAM,SAAS,UAAU,KAAK;CAC9B,IAAI,WAAW,KACb,OAAO,aAAa,aAAa,KAAK;CAExC,IACE,WAAW,OACX,UAAU,aACT,WAAW,KAAA,KAAa,WAAW,iBAEpC,OAAO;EAAE,aAAa;EAAO;CAAO;CAEtC,IAAI,WAAW,OAAO,WAAW,KAC/B,OAAO,UAAU,WACb,aAAa,aAAa,KAAK,IAC/B,aAAa,UAAU,UAAU,WAAW;CAElD,IAAI,WAAW,KAAA,KAAa,SAAS,KACnC,MAAM,6BAA6B,UACjC,6BACA,4CAA4C,OAAO,GAAG,OAAO,IAC7D,EAAE,KAAK,CACT;CAEF,MAAM,0BAA0B,OAAO;EACrC;EACA,gBAAgB,SAAS;CAC3B,CAAC;AACH"}

package/dist/{auth-guard-h9QB_l11.mjs → auth-guard-Da92QEK5.mjs}

@@ -1,7 +1,7 @@
-import { c as isConfigurationError, l as isInfrastructureError, n as BetterAuthConfigurationError, s as isAuthFailure, t as AuthFailures } from "./auth-errors-C3rbTV9p.mjs";
-import { f as GUARD_CORE, n as __decorateParam, r as __decorateMetadata, s as AUTH_ENHANCER, t as __decorate } from "./decorate-Dt0e9K6R.mjs";
+import { c as isConfigurationError, l as isInfrastructureError, n as BetterAuthConfigurationError, s as isAuthFailure, t as AuthFailures } from "./auth-errors-JjxGDVSt.mjs";
+import { f as GUARD_CORE, n as __decorateParam, r as __decorateMetadata, s as AUTH_ENHANCER, t as __decorate } from "./decorate-bO-rBn-G.mjs";
 import { Inject, Injectable } from "@nestjs/common";
-//#region src/auth-guard.ts
+// src/auth-guard.ts
 let BetterAuthGuard = class BetterAuthGuard {
 	core;
 	static [AUTH_ENHANCER] = "guard";
@@ -119,7 +119,6 @@ var GuardCore = class {
 		}
 	}
 };
-//#endregion
 export { GuardCore as n, BetterAuthGuard as t };
 
-//# sourceMappingURL=auth-guard-h9QB_l11.mjs.map
+//# sourceMappingURL=auth-guard-Da92QEK5.mjs.map

package/dist/{auth-guard-h9QB_l11.mjs.map → auth-guard-Da92QEK5.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"auth-guard-h9QB_l11.mjs","names":[],"sources":["../src/auth-guard.ts"],"sourcesContent":["import {\n  Inject,\n  Injectable,\n  type CanActivate,\n  type ExecutionContext,\n} from \"@nestjs/common\";\nimport type {\n  AuthTransport,\n  PrincipalResolver,\n  RoutePlan,\n  TransportCall,\n} from \"./auth-contracts.js\";\nimport {\n  AuthFailures,\n  BetterAuthConfigurationError,\n  isAuthFailure,\n  isConfigurationError,\n  isInfrastructureError,\n} from \"./auth-errors.js\";\nimport { AUTH_ENHANCER, GUARD_CORE } from \"./auth-tokens.js\";\nimport type { AuthorizationEvaluator } from \"./authorization-evaluator.js\";\nimport type { InstanceLookup } from \"./instance-registry.js\";\nimport type { PrincipalReadings } from \"./principal-readings.js\";\nimport type { RequestScope } from \"./request-scope.js\";\nimport type { RoutePlanner } from \"./route-planner.js\";\nimport type { TransportRegistry } from \"./transport-registry.js\";\n\n@Injectable()\nexport class BetterAuthGuard implements CanActivate {\n  static readonly [AUTH_ENHANCER] = \"guard\";\n  readonly [AUTH_ENHANCER] = \"guard\";\n\n  constructor(\n    @Inject(GUARD_CORE) private readonly core: Pick<GuardCore, \"canActivate\">,\n  ) {}\n\n  canActivate(context: ExecutionContext): Promise<boolean> {\n    return this.core.canActivate(context);\n  }\n}\nexport class GuardCore implements CanActivate {\n  constructor(\n    private readonly instances: InstanceLookup,\n    private readonly planner: RoutePlanner,\n    private readonly transports: TransportRegistry,\n    private readonly resolver: PrincipalResolver,\n    private readonly evaluator: AuthorizationEvaluator,\n    private readonly scope: RequestScope,\n    private readonly readings: PrincipalReadings,\n  ) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    let transport: AuthTransport | undefined;\n    let call: TransportCall | undefined;\n    let plan: RoutePlan | undefined;\n    try {\n      plan = this.planner.forContext(context);\n      if (plan.access === \"inherit\") {\n        transport = this.transports.find(context);\n        const lineage = transport?.lineage?.(context);\n        if (lineage && !this.readings.enclosing(lineage, context.getArgs())) {\n          call = this.transports.describe(context, transport);\n          throw BetterAuthConfigurationError.atRequest(\n            \"NO_ENCLOSING_DECISION\",\n            \"An inherited invocation has no enclosing guard decision\",\n            { site: plan.site },\n          );\n        }\n        if (plan.originCheck !== \"form\") {\n          return true;\n        }\n      }\n      if (plan.access === \"public\" && plan.originCheck !== \"form\") {\n        const lineage = this.transports.find(context)?.lineage?.(context);\n        if (lineage && !plan.nested) {\n          this.readings.recordLineage(lineage, {\n            outcome: \"no-identity\",\n            instance: plan.instance,\n          });\n        }\n        return true;\n      }\n      transport = this.transports.select(context);\n      call = this.transports.describe(context, transport);\n      const entry = this.instances.get(plan.instance);\n      if (plan.originCheck !== \"off\") {\n        const browser = call.browser;\n        if (browser) {\n          if (plan.originCheck === \"form\" || browser.enforce) {\n            const failure = await entry.origin.check(browser, plan.originCheck);\n            if (failure) {\n              throw failure;\n            }\n          } else {\n            await entry.origin.advisory(browser);\n          }\n        }\n      }\n      if (plan.access === \"inherit\") {\n        return true;\n      }\n      if (plan.access === \"public\") {\n        if (!plan.nested) {\n          this.readings.record(call, {\n            outcome: \"no-identity\",\n            instance: plan.instance,\n          });\n        }\n        return true;\n      }\n      const result = await this.resolver.resolve(call, {\n        auth: entry.handle,\n        freshness: plan.freshness,\n        accepts: plan.accepts,\n        sourceSet: plan.sourceSet,\n      });\n      this.readings.record(call, { ...result, instance: plan.instance });\n      if (result.outcome === \"rejected\") {\n        throw result.failure;\n      }\n      if (result.outcome === \"absent\") {\n        if (plan.access === \"optional\") {\n          return true;\n        }\n        throw AuthFailures.unauthenticated();\n      }\n      if (!plan.accepts.has(result.principal.kind)) {\n        throw AuthFailures.forbidden(\"PRINCIPAL_NOT_SUPPORTED\");\n      }\n      const decision = await this.evaluator.evaluate(\n        plan,\n        result.principal,\n        call,\n        entry,\n        context,\n        transport.id,\n      );\n      if (decision.effect === \"deny\") {\n        throw AuthFailures.rejected({\n          status: decision.status ?? 403,\n          reason: decision.reason,\n          message: decision.message,\n          challenge: decision.challenge,\n        });\n      }\n      return true;\n    } catch (error) {\n      if (isAuthFailure(error) && transport) {\n        const mapping =\n          plan && this.instances.get(plan.instance).options.errors?.map;\n        throw mapping\n          ? mapping(error, context, transport.id)\n          : transport.toException(error, context);\n      }\n      if (\n        (isConfigurationError(error) || isInfrastructureError(error)) &&\n        transport\n      ) {\n        const repeated = call\n          ? this.scope.surfaced(call.key, error, {\n              instance: plan?.instance ?? \"default\",\n              site: plan?.site ?? \"guard\",\n              lineage: call.lineage,\n            })\n          : false;\n        throw (\n          transport.toInternalException?.(error, context, { repeated }) ?? error\n        );\n      }\n      throw error;\n    }\n  }\n}\n"],"mappings":";;;;AA4BO,IAAM,kBAAN,MAAM,gBAAuC;CAKX;CAJvC,QAAiB,iBAAiB;CAClC,CAAU,iBAAiB;CAE3B,YACE,MACA;EADqC,KAAA,OAAA;CACpC;CAEH,YAAY,SAA6C;EACvD,OAAO,KAAK,KAAK,YAAY,OAAO;CACtC;AACF;;CAZC,WAAW;CAMP,gBAAA,GAAA,OAAO,UAAU,CAAA;;;AAOtB,IAAa,YAAb,MAA8C;CAEzB;CACA;CACA;CACA;CACA;CACA;CACA;CAPnB,YACE,WACA,SACA,YACA,UACA,WACA,OACA,UACA;EAPiB,KAAA,YAAA;EACA,KAAA,UAAA;EACA,KAAA,aAAA;EACA,KAAA,WAAA;EACA,KAAA,YAAA;EACA,KAAA,QAAA;EACA,KAAA,WAAA;CAChB;CAEH,MAAM,YAAY,SAA6C;EAC7D,IAAI;EACJ,IAAI;EACJ,IAAI;EACJ,IAAI;GACF,OAAO,KAAK,QAAQ,WAAW,OAAO;GACtC,IAAI,KAAK,WAAW,WAAW;IAC7B,YAAY,KAAK,WAAW,KAAK,OAAO;IACxC,MAAM,UAAU,WAAW,UAAU,OAAO;IAC5C,IAAI,WAAW,CAAC,KAAK,SAAS,UAAU,SAAS,QAAQ,QAAQ,CAAC,GAAG;KACnE,OAAO,KAAK,WAAW,SAAS,SAAS,SAAS;KAClD,MAAM,6BAA6B,UACjC,yBACA,2DACA,EAAE,MAAM,KAAK,KAAK,CACpB;IACF;IACA,IAAI,KAAK,gBAAgB,QACvB,OAAO;GAEX;GACA,IAAI,KAAK,WAAW,YAAY,KAAK,gBAAgB,QAAQ;IAC3D,MAAM,UAAU,KAAK,WAAW,KAAK,OAAO,CAAC,EAAE,UAAU,OAAO;IAChE,IAAI,WAAW,CAAC,KAAK,QACnB,KAAK,SAAS,cAAc,SAAS;KACnC,SAAS;KACT,UAAU,KAAK;IACjB,CAAC;IAEH,OAAO;GACT;GACA,YAAY,KAAK,WAAW,OAAO,OAAO;GAC1C,OAAO,KAAK,WAAW,SAAS,SAAS,SAAS;GAClD,MAAM,QAAQ,KAAK,UAAU,IAAI,KAAK,QAAQ;GAC9C,IAAI,KAAK,gBAAgB,OAAO;IAC9B,MAAM,UAAU,KAAK;IACrB,IAAI,SAAS;KACX,IAAI,KAAK,gBAAgB,UAAU,QAAQ,SAAS;MAClD,MAAM,UAAU,MAAM,MAAM,OAAO,MAAM,SAAS,KAAK,WAAW;MAClE,IAAI,SACF,MAAM;KAEV,OACE,MAAM,MAAM,OAAO,SAAS,OAAO;IAEvC;GACF;GACA,IAAI,KAAK,WAAW,WAClB,OAAO;GAET,IAAI,KAAK,WAAW,UAAU;IAC5B,IAAI,CAAC,KAAK,QACR,KAAK,SAAS,OAAO,MAAM;KACzB,SAAS;KACT,UAAU,KAAK;IACjB,CAAC;IAEH,OAAO;GACT;GACA,MAAM,SAAS,MAAM,KAAK,SAAS,QAAQ,MAAM;IAC/C,MAAM,MAAM;IACZ,WAAW,KAAK;IAChB,SAAS,KAAK;IACd,WAAW,KAAK;GAClB,CAAC;GACD,KAAK,SAAS,OAAO,MAAM;IAAE,GAAG;IAAQ,UAAU,KAAK;GAAS,CAAC;GACjE,IAAI,OAAO,YAAY,YACrB,MAAM,OAAO;GAEf,IAAI,OAAO,YAAY,UAAU;IAC/B,IAAI,KAAK,WAAW,YAClB,OAAO;IAET,MAAM,aAAa,gBAAgB;GACrC;GACA,IAAI,CAAC,KAAK,QAAQ,IAAI,OAAO,UAAU,IAAI,GACzC,MAAM,aAAa,UAAU,yBAAyB;GAExD,MAAM,WAAW,MAAM,KAAK,UAAU,SACpC,MACA,OAAO,WACP,MACA,OACA,SACA,UAAU,EACZ;GACA,IAAI,SAAS,WAAW,QACtB,MAAM,aAAa,SAAS;IAC1B,QAAQ,SAAS,UAAU;IAC3B,QAAQ,SAAS;IACjB,SAAS,SAAS;IAClB,WAAW,SAAS;GACtB,CAAC;GAEH,OAAO;EACT,SAAS,OAAO;GACd,IAAI,cAAc,KAAK,KAAK,WAAW;IACrC,MAAM,UACJ,QAAQ,KAAK,UAAU,IAAI,KAAK,QAAQ,CAAC,CAAC,QAAQ,QAAQ;IAC5D,MAAM,UACF,QAAQ,OAAO,SAAS,UAAU,EAAE,IACpC,UAAU,YAAY,OAAO,OAAO;GAC1C;GACA,KACG,qBAAqB,KAAK,KAAK,sBAAsB,KAAK,MAC3D,WACA;IACA,MAAM,WAAW,OACb,KAAK,MAAM,SAAS,KAAK,KAAK,OAAO;KACnC,UAAU,MAAM,YAAY;KAC5B,MAAM,MAAM,QAAQ;KACpB,SAAS,KAAK;IAChB,CAAC,IACD;IACJ,MACE,UAAU,sBAAsB,OAAO,SAAS,EAAE,SAAS,CAAC,KAAK;GAErE;GACA,MAAM;EACR;CACF;AACF"}
+{"version":3,"file":"auth-guard-Da92QEK5.mjs","names":[],"sources":["../src/auth-guard.ts"],"sourcesContent":["import {\n  Inject,\n  Injectable,\n  type CanActivate,\n  type ExecutionContext,\n} from \"@nestjs/common\";\nimport type {\n  AuthTransport,\n  PrincipalResolver,\n  RoutePlan,\n  TransportCall,\n} from \"./auth-contracts.js\";\nimport {\n  AuthFailures,\n  BetterAuthConfigurationError,\n  isAuthFailure,\n  isConfigurationError,\n  isInfrastructureError,\n} from \"./auth-errors.js\";\nimport { AUTH_ENHANCER, GUARD_CORE } from \"./auth-tokens.js\";\nimport type { AuthorizationEvaluator } from \"./authorization-evaluator.js\";\nimport type { InstanceLookup } from \"./instance-registry.js\";\nimport type { PrincipalReadings } from \"./principal-readings.js\";\nimport type { RequestScope } from \"./request-scope.js\";\nimport type { RoutePlanner } from \"./route-planner.js\";\nimport type { TransportRegistry } from \"./transport-registry.js\";\n\n@Injectable()\nexport class BetterAuthGuard implements CanActivate {\n  static readonly [AUTH_ENHANCER] = \"guard\";\n  readonly [AUTH_ENHANCER] = \"guard\";\n\n  constructor(\n    @Inject(GUARD_CORE) private readonly core: Pick<GuardCore, \"canActivate\">,\n  ) {}\n\n  canActivate(context: ExecutionContext): Promise<boolean> {\n    return this.core.canActivate(context);\n  }\n}\nexport class GuardCore implements CanActivate {\n  constructor(\n    private readonly instances: InstanceLookup,\n    private readonly planner: RoutePlanner,\n    private readonly transports: TransportRegistry,\n    private readonly resolver: PrincipalResolver,\n    private readonly evaluator: AuthorizationEvaluator,\n    private readonly scope: RequestScope,\n    private readonly readings: PrincipalReadings,\n  ) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    let transport: AuthTransport | undefined;\n    let call: TransportCall | undefined;\n    let plan: RoutePlan | undefined;\n    try {\n      plan = this.planner.forContext(context);\n      if (plan.access === \"inherit\") {\n        transport = this.transports.find(context);\n        const lineage = transport?.lineage?.(context);\n        if (lineage && !this.readings.enclosing(lineage, context.getArgs())) {\n          call = this.transports.describe(context, transport);\n          throw BetterAuthConfigurationError.atRequest(\n            \"NO_ENCLOSING_DECISION\",\n            \"An inherited invocation has no enclosing guard decision\",\n            { site: plan.site },\n          );\n        }\n        if (plan.originCheck !== \"form\") {\n          return true;\n        }\n      }\n      if (plan.access === \"public\" && plan.originCheck !== \"form\") {\n        const lineage = this.transports.find(context)?.lineage?.(context);\n        if (lineage && !plan.nested) {\n          this.readings.recordLineage(lineage, {\n            outcome: \"no-identity\",\n            instance: plan.instance,\n          });\n        }\n        return true;\n      }\n      transport = this.transports.select(context);\n      call = this.transports.describe(context, transport);\n      const entry = this.instances.get(plan.instance);\n      if (plan.originCheck !== \"off\") {\n        const browser = call.browser;\n        if (browser) {\n          if (plan.originCheck === \"form\" || browser.enforce) {\n            const failure = await entry.origin.check(browser, plan.originCheck);\n            if (failure) {\n              throw failure;\n            }\n          } else {\n            await entry.origin.advisory(browser);\n          }\n        }\n      }\n      if (plan.access === \"inherit\") {\n        return true;\n      }\n      if (plan.access === \"public\") {\n        if (!plan.nested) {\n          this.readings.record(call, {\n            outcome: \"no-identity\",\n            instance: plan.instance,\n          });\n        }\n        return true;\n      }\n      const result = await this.resolver.resolve(call, {\n        auth: entry.handle,\n        freshness: plan.freshness,\n        accepts: plan.accepts,\n        sourceSet: plan.sourceSet,\n      });\n      this.readings.record(call, { ...result, instance: plan.instance });\n      if (result.outcome === \"rejected\") {\n        throw result.failure;\n      }\n      if (result.outcome === \"absent\") {\n        if (plan.access === \"optional\") {\n          return true;\n        }\n        throw AuthFailures.unauthenticated();\n      }\n      if (!plan.accepts.has(result.principal.kind)) {\n        throw AuthFailures.forbidden(\"PRINCIPAL_NOT_SUPPORTED\");\n      }\n      const decision = await this.evaluator.evaluate(\n        plan,\n        result.principal,\n        call,\n        entry,\n        context,\n        transport.id,\n      );\n      if (decision.effect === \"deny\") {\n        throw AuthFailures.rejected({\n          status: decision.status ?? 403,\n          reason: decision.reason,\n          message: decision.message,\n          challenge: decision.challenge,\n        });\n      }\n      return true;\n    } catch (error) {\n      if (isAuthFailure(error) && transport) {\n        const mapping =\n          plan && this.instances.get(plan.instance).options.errors?.map;\n        throw mapping\n          ? mapping(error, context, transport.id)\n          : transport.toException(error, context);\n      }\n      if (\n        (isConfigurationError(error) || isInfrastructureError(error)) &&\n        transport\n      ) {\n        const repeated = call\n          ? this.scope.surfaced(call.key, error, {\n              instance: plan?.instance ?? \"default\",\n              site: plan?.site ?? \"guard\",\n              lineage: call.lineage,\n            })\n          : false;\n        throw (\n          transport.toInternalException?.(error, context, { repeated }) ?? error\n        );\n      }\n      throw error;\n    }\n  }\n}\n"],"mappings":";;;;AA4BO,IAAM,kBAAN,MAAM,gBAAuC;CAKX;CAJvC,QAAiB,iBAAiB;CAClC,CAAU,iBAAiB;CAE3B,YACE,MACA;EADqC,KAAA,OAAA;CACpC;CAEH,YAAY,SAA6C;EACvD,OAAO,KAAK,KAAK,YAAY,OAAO;CACtC;AACF;;CAZC,WAAW;CAMP,gBAAA,GAAA,OAAO,UAAU,CAAA;;;AAOtB,IAAa,YAAb,MAA8C;CAEzB;CACA;CACA;CACA;CACA;CACA;CACA;CAPnB,YACE,WACA,SACA,YACA,UACA,WACA,OACA,UACA;EAPiB,KAAA,YAAA;EACA,KAAA,UAAA;EACA,KAAA,aAAA;EACA,KAAA,WAAA;EACA,KAAA,YAAA;EACA,KAAA,QAAA;EACA,KAAA,WAAA;CAChB;CAEH,MAAM,YAAY,SAA6C;EAC7D,IAAI;EACJ,IAAI;EACJ,IAAI;EACJ,IAAI;GACF,OAAO,KAAK,QAAQ,WAAW,OAAO;GACtC,IAAI,KAAK,WAAW,WAAW;IAC7B,YAAY,KAAK,WAAW,KAAK,OAAO;IACxC,MAAM,UAAU,WAAW,UAAU,OAAO;IAC5C,IAAI,WAAW,CAAC,KAAK,SAAS,UAAU,SAAS,QAAQ,QAAQ,CAAC,GAAG;KACnE,OAAO,KAAK,WAAW,SAAS,SAAS,SAAS;KAClD,MAAM,6BAA6B,UACjC,yBACA,2DACA,EAAE,MAAM,KAAK,KAAK,CACpB;IACF;IACA,IAAI,KAAK,gBAAgB,QACvB,OAAO;GAEX;GACA,IAAI,KAAK,WAAW,YAAY,KAAK,gBAAgB,QAAQ;IAC3D,MAAM,UAAU,KAAK,WAAW,KAAK,OAAO,CAAC,EAAE,UAAU,OAAO;IAChE,IAAI,WAAW,CAAC,KAAK,QACnB,KAAK,SAAS,cAAc,SAAS;KACnC,SAAS;KACT,UAAU,KAAK;IACjB,CAAC;IAEH,OAAO;GACT;GACA,YAAY,KAAK,WAAW,OAAO,OAAO;GAC1C,OAAO,KAAK,WAAW,SAAS,SAAS,SAAS;GAClD,MAAM,QAAQ,KAAK,UAAU,IAAI,KAAK,QAAQ;GAC9C,IAAI,KAAK,gBAAgB,OAAO;IAC9B,MAAM,UAAU,KAAK;IACrB,IAAI,SAAS;KACX,IAAI,KAAK,gBAAgB,UAAU,QAAQ,SAAS;MAClD,MAAM,UAAU,MAAM,MAAM,OAAO,MAAM,SAAS,KAAK,WAAW;MAClE,IAAI,SACF,MAAM;KAEV,OACE,MAAM,MAAM,OAAO,SAAS,OAAO;IAEvC;GACF;GACA,IAAI,KAAK,WAAW,WAClB,OAAO;GAET,IAAI,KAAK,WAAW,UAAU;IAC5B,IAAI,CAAC,KAAK,QACR,KAAK,SAAS,OAAO,MAAM;KACzB,SAAS;KACT,UAAU,KAAK;IACjB,CAAC;IAEH,OAAO;GACT;GACA,MAAM,SAAS,MAAM,KAAK,SAAS,QAAQ,MAAM;IAC/C,MAAM,MAAM;IACZ,WAAW,KAAK;IAChB,SAAS,KAAK;IACd,WAAW,KAAK;GAClB,CAAC;GACD,KAAK,SAAS,OAAO,MAAM;IAAE,GAAG;IAAQ,UAAU,KAAK;GAAS,CAAC;GACjE,IAAI,OAAO,YAAY,YACrB,MAAM,OAAO;GAEf,IAAI,OAAO,YAAY,UAAU;IAC/B,IAAI,KAAK,WAAW,YAClB,OAAO;IAET,MAAM,aAAa,gBAAgB;GACrC;GACA,IAAI,CAAC,KAAK,QAAQ,IAAI,OAAO,UAAU,IAAI,GACzC,MAAM,aAAa,UAAU,yBAAyB;GAExD,MAAM,WAAW,MAAM,KAAK,UAAU,SACpC,MACA,OAAO,WACP,MACA,OACA,SACA,UAAU,EACZ;GACA,IAAI,SAAS,WAAW,QACtB,MAAM,aAAa,SAAS;IAC1B,QAAQ,SAAS,UAAU;IAC3B,QAAQ,SAAS;IACjB,SAAS,SAAS;IAClB,WAAW,SAAS;GACtB,CAAC;GAEH,OAAO;EACT,SAAS,OAAO;GACd,IAAI,cAAc,KAAK,KAAK,WAAW;IACrC,MAAM,UACJ,QAAQ,KAAK,UAAU,IAAI,KAAK,QAAQ,CAAC,CAAC,QAAQ,QAAQ;IAC5D,MAAM,UACF,QAAQ,OAAO,SAAS,UAAU,EAAE,IACpC,UAAU,YAAY,OAAO,OAAO;GAC1C;GACA,KACG,qBAAqB,KAAK,KAAK,sBAAsB,KAAK,MAC3D,WACA;IACA,MAAM,WAAW,OACb,KAAK,MAAM,SAAS,KAAK,KAAK,OAAO;KACnC,UAAU,MAAM,YAAY;KAC5B,MAAM,MAAM,QAAQ;KACpB,SAAS,KAAK;IAChB,CAAC,IACD;IACJ,MACE,UAAU,sBAAsB,OAAO,SAAS,EAAE,SAAS,CAAC,KAAK;GAErE;GACA,MAAM;EACR;CACF;AACF"}

package/dist/{auth-guard-CLyhAEEj.cjs → auth-guard-wapEh_M_.cjs}

@@ -1,7 +1,7 @@
-const require_auth_errors = require("./auth-errors-DmiKl0L_.cjs");
-const require_decorate = require("./decorate-Cr4Q7bNE.cjs");
+const require_auth_errors = require("./auth-errors-RW7hOVI-.cjs");
+const require_decorate = require("./decorate-fMNf0caZ.cjs");
 let _nestjs_common = require("@nestjs/common");
-//#region src/auth-guard.ts
+// src/auth-guard.ts
 let BetterAuthGuard = class BetterAuthGuard {
 	core;
 	static [require_decorate.AUTH_ENHANCER] = "guard";
@@ -119,7 +119,6 @@ var GuardCore = class {
 		}
 	}
 };
-//#endregion
 Object.defineProperty(exports, "BetterAuthGuard", {
 	enumerable: true,
 	get: function() {
@@ -133,4 +132,4 @@ Object.defineProperty(exports, "GuardCore", {
 	}
 });
 
-//# sourceMappingURL=auth-guard-CLyhAEEj.cjs.map
+//# sourceMappingURL=auth-guard-wapEh_M_.cjs.map

package/dist/{auth-guard-CLyhAEEj.cjs.map → auth-guard-wapEh_M_.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"auth-guard-CLyhAEEj.cjs","names":["AUTH_ENHANCER","Injectable","Inject","GUARD_CORE","BetterAuthConfigurationError","AuthFailures","isAuthFailure","isConfigurationError","isInfrastructureError"],"sources":["../src/auth-guard.ts"],"sourcesContent":["import {\n  Inject,\n  Injectable,\n  type CanActivate,\n  type ExecutionContext,\n} from \"@nestjs/common\";\nimport type {\n  AuthTransport,\n  PrincipalResolver,\n  RoutePlan,\n  TransportCall,\n} from \"./auth-contracts.js\";\nimport {\n  AuthFailures,\n  BetterAuthConfigurationError,\n  isAuthFailure,\n  isConfigurationError,\n  isInfrastructureError,\n} from \"./auth-errors.js\";\nimport { AUTH_ENHANCER, GUARD_CORE } from \"./auth-tokens.js\";\nimport type { AuthorizationEvaluator } from \"./authorization-evaluator.js\";\nimport type { InstanceLookup } from \"./instance-registry.js\";\nimport type { PrincipalReadings } from \"./principal-readings.js\";\nimport type { RequestScope } from \"./request-scope.js\";\nimport type { RoutePlanner } from \"./route-planner.js\";\nimport type { TransportRegistry } from \"./transport-registry.js\";\n\n@Injectable()\nexport class BetterAuthGuard implements CanActivate {\n  static readonly [AUTH_ENHANCER] = \"guard\";\n  readonly [AUTH_ENHANCER] = \"guard\";\n\n  constructor(\n    @Inject(GUARD_CORE) private readonly core: Pick<GuardCore, \"canActivate\">,\n  ) {}\n\n  canActivate(context: ExecutionContext): Promise<boolean> {\n    return this.core.canActivate(context);\n  }\n}\nexport class GuardCore implements CanActivate {\n  constructor(\n    private readonly instances: InstanceLookup,\n    private readonly planner: RoutePlanner,\n    private readonly transports: TransportRegistry,\n    private readonly resolver: PrincipalResolver,\n    private readonly evaluator: AuthorizationEvaluator,\n    private readonly scope: RequestScope,\n    private readonly readings: PrincipalReadings,\n  ) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    let transport: AuthTransport | undefined;\n    let call: TransportCall | undefined;\n    let plan: RoutePlan | undefined;\n    try {\n      plan = this.planner.forContext(context);\n      if (plan.access === \"inherit\") {\n        transport = this.transports.find(context);\n        const lineage = transport?.lineage?.(context);\n        if (lineage && !this.readings.enclosing(lineage, context.getArgs())) {\n          call = this.transports.describe(context, transport);\n          throw BetterAuthConfigurationError.atRequest(\n            \"NO_ENCLOSING_DECISION\",\n            \"An inherited invocation has no enclosing guard decision\",\n            { site: plan.site },\n          );\n        }\n        if (plan.originCheck !== \"form\") {\n          return true;\n        }\n      }\n      if (plan.access === \"public\" && plan.originCheck !== \"form\") {\n        const lineage = this.transports.find(context)?.lineage?.(context);\n        if (lineage && !plan.nested) {\n          this.readings.recordLineage(lineage, {\n            outcome: \"no-identity\",\n            instance: plan.instance,\n          });\n        }\n        return true;\n      }\n      transport = this.transports.select(context);\n      call = this.transports.describe(context, transport);\n      const entry = this.instances.get(plan.instance);\n      if (plan.originCheck !== \"off\") {\n        const browser = call.browser;\n        if (browser) {\n          if (plan.originCheck === \"form\" || browser.enforce) {\n            const failure = await entry.origin.check(browser, plan.originCheck);\n            if (failure) {\n              throw failure;\n            }\n          } else {\n            await entry.origin.advisory(browser);\n          }\n        }\n      }\n      if (plan.access === \"inherit\") {\n        return true;\n      }\n      if (plan.access === \"public\") {\n        if (!plan.nested) {\n          this.readings.record(call, {\n            outcome: \"no-identity\",\n            instance: plan.instance,\n          });\n        }\n        return true;\n      }\n      const result = await this.resolver.resolve(call, {\n        auth: entry.handle,\n        freshness: plan.freshness,\n        accepts: plan.accepts,\n        sourceSet: plan.sourceSet,\n      });\n      this.readings.record(call, { ...result, instance: plan.instance });\n      if (result.outcome === \"rejected\") {\n        throw result.failure;\n      }\n      if (result.outcome === \"absent\") {\n        if (plan.access === \"optional\") {\n          return true;\n        }\n        throw AuthFailures.unauthenticated();\n      }\n      if (!plan.accepts.has(result.principal.kind)) {\n        throw AuthFailures.forbidden(\"PRINCIPAL_NOT_SUPPORTED\");\n      }\n      const decision = await this.evaluator.evaluate(\n        plan,\n        result.principal,\n        call,\n        entry,\n        context,\n        transport.id,\n      );\n      if (decision.effect === \"deny\") {\n        throw AuthFailures.rejected({\n          status: decision.status ?? 403,\n          reason: decision.reason,\n          message: decision.message,\n          challenge: decision.challenge,\n        });\n      }\n      return true;\n    } catch (error) {\n      if (isAuthFailure(error) && transport) {\n        const mapping =\n          plan && this.instances.get(plan.instance).options.errors?.map;\n        throw mapping\n          ? mapping(error, context, transport.id)\n          : transport.toException(error, context);\n      }\n      if (\n        (isConfigurationError(error) || isInfrastructureError(error)) &&\n        transport\n      ) {\n        const repeated = call\n          ? this.scope.surfaced(call.key, error, {\n              instance: plan?.instance ?? \"default\",\n              site: plan?.site ?? \"guard\",\n              lineage: call.lineage,\n            })\n          : false;\n        throw (\n          transport.toInternalException?.(error, context, { repeated }) ?? error\n        );\n      }\n      throw error;\n    }\n  }\n}\n"],"mappings":";;;;AA4BO,IAAM,kBAAN,MAAM,gBAAuC;CAKX;CAJvC,QAAiBA,iBAAAA,iBAAiB;CAClC,CAAUA,iBAAAA,iBAAiB;CAE3B,YACE,MACA;EADqC,KAAA,OAAA;CACpC;CAEH,YAAY,SAA6C;EACvD,OAAO,KAAK,KAAK,YAAY,OAAO;CACtC;AACF;;EAZCC,GAAAA,eAAAA,WAAAA,CAAW;CAMPC,iBAAAA,gBAAAA,IAAAA,GAAAA,eAAAA,OAAAA,CAAOC,iBAAAA,UAAU,CAAA;;;AAOtB,IAAa,YAAb,MAA8C;CAEzB;CACA;CACA;CACA;CACA;CACA;CACA;CAPnB,YACE,WACA,SACA,YACA,UACA,WACA,OACA,UACA;EAPiB,KAAA,YAAA;EACA,KAAA,UAAA;EACA,KAAA,aAAA;EACA,KAAA,WAAA;EACA,KAAA,YAAA;EACA,KAAA,QAAA;EACA,KAAA,WAAA;CAChB;CAEH,MAAM,YAAY,SAA6C;EAC7D,IAAI;EACJ,IAAI;EACJ,IAAI;EACJ,IAAI;GACF,OAAO,KAAK,QAAQ,WAAW,OAAO;GACtC,IAAI,KAAK,WAAW,WAAW;IAC7B,YAAY,KAAK,WAAW,KAAK,OAAO;IACxC,MAAM,UAAU,WAAW,UAAU,OAAO;IAC5C,IAAI,WAAW,CAAC,KAAK,SAAS,UAAU,SAAS,QAAQ,QAAQ,CAAC,GAAG;KACnE,OAAO,KAAK,WAAW,SAAS,SAAS,SAAS;KAClD,MAAMC,oBAAAA,6BAA6B,UACjC,yBACA,2DACA,EAAE,MAAM,KAAK,KAAK,CACpB;IACF;IACA,IAAI,KAAK,gBAAgB,QACvB,OAAO;GAEX;GACA,IAAI,KAAK,WAAW,YAAY,KAAK,gBAAgB,QAAQ;IAC3D,MAAM,UAAU,KAAK,WAAW,KAAK,OAAO,CAAC,EAAE,UAAU,OAAO;IAChE,IAAI,WAAW,CAAC,KAAK,QACnB,KAAK,SAAS,cAAc,SAAS;KACnC,SAAS;KACT,UAAU,KAAK;IACjB,CAAC;IAEH,OAAO;GACT;GACA,YAAY,KAAK,WAAW,OAAO,OAAO;GAC1C,OAAO,KAAK,WAAW,SAAS,SAAS,SAAS;GAClD,MAAM,QAAQ,KAAK,UAAU,IAAI,KAAK,QAAQ;GAC9C,IAAI,KAAK,gBAAgB,OAAO;IAC9B,MAAM,UAAU,KAAK;IACrB,IAAI,SAAS;KACX,IAAI,KAAK,gBAAgB,UAAU,QAAQ,SAAS;MAClD,MAAM,UAAU,MAAM,MAAM,OAAO,MAAM,SAAS,KAAK,WAAW;MAClE,IAAI,SACF,MAAM;KAEV,OACE,MAAM,MAAM,OAAO,SAAS,OAAO;IAEvC;GACF;GACA,IAAI,KAAK,WAAW,WAClB,OAAO;GAET,IAAI,KAAK,WAAW,UAAU;IAC5B,IAAI,CAAC,KAAK,QACR,KAAK,SAAS,OAAO,MAAM;KACzB,SAAS;KACT,UAAU,KAAK;IACjB,CAAC;IAEH,OAAO;GACT;GACA,MAAM,SAAS,MAAM,KAAK,SAAS,QAAQ,MAAM;IAC/C,MAAM,MAAM;IACZ,WAAW,KAAK;IAChB,SAAS,KAAK;IACd,WAAW,KAAK;GAClB,CAAC;GACD,KAAK,SAAS,OAAO,MAAM;IAAE,GAAG;IAAQ,UAAU,KAAK;GAAS,CAAC;GACjE,IAAI,OAAO,YAAY,YACrB,MAAM,OAAO;GAEf,IAAI,OAAO,YAAY,UAAU;IAC/B,IAAI,KAAK,WAAW,YAClB,OAAO;IAET,MAAMC,oBAAAA,aAAa,gBAAgB;GACrC;GACA,IAAI,CAAC,KAAK,QAAQ,IAAI,OAAO,UAAU,IAAI,GACzC,MAAMA,oBAAAA,aAAa,UAAU,yBAAyB;GAExD,MAAM,WAAW,MAAM,KAAK,UAAU,SACpC,MACA,OAAO,WACP,MACA,OACA,SACA,UAAU,EACZ;GACA,IAAI,SAAS,WAAW,QACtB,MAAMA,oBAAAA,aAAa,SAAS;IAC1B,QAAQ,SAAS,UAAU;IAC3B,QAAQ,SAAS;IACjB,SAAS,SAAS;IAClB,WAAW,SAAS;GACtB,CAAC;GAEH,OAAO;EACT,SAAS,OAAO;GACd,IAAIC,oBAAAA,cAAc,KAAK,KAAK,WAAW;IACrC,MAAM,UACJ,QAAQ,KAAK,UAAU,IAAI,KAAK,QAAQ,CAAC,CAAC,QAAQ,QAAQ;IAC5D,MAAM,UACF,QAAQ,OAAO,SAAS,UAAU,EAAE,IACpC,UAAU,YAAY,OAAO,OAAO;GAC1C;GACA,KACGC,oBAAAA,qBAAqB,KAAK,KAAKC,oBAAAA,sBAAsB,KAAK,MAC3D,WACA;IACA,MAAM,WAAW,OACb,KAAK,MAAM,SAAS,KAAK,KAAK,OAAO;KACnC,UAAU,MAAM,YAAY;KAC5B,MAAM,MAAM,QAAQ;KACpB,SAAS,KAAK;IAChB,CAAC,IACD;IACJ,MACE,UAAU,sBAAsB,OAAO,SAAS,EAAE,SAAS,CAAC,KAAK;GAErE;GACA,MAAM;EACR;CACF;AACF"}
+{"version":3,"file":"auth-guard-wapEh_M_.cjs","names":["AUTH_ENHANCER","Injectable","Inject","GUARD_CORE","BetterAuthConfigurationError","AuthFailures","isAuthFailure","isConfigurationError","isInfrastructureError"],"sources":["../src/auth-guard.ts"],"sourcesContent":["import {\n  Inject,\n  Injectable,\n  type CanActivate,\n  type ExecutionContext,\n} from \"@nestjs/common\";\nimport type {\n  AuthTransport,\n  PrincipalResolver,\n  RoutePlan,\n  TransportCall,\n} from \"./auth-contracts.js\";\nimport {\n  AuthFailures,\n  BetterAuthConfigurationError,\n  isAuthFailure,\n  isConfigurationError,\n  isInfrastructureError,\n} from \"./auth-errors.js\";\nimport { AUTH_ENHANCER, GUARD_CORE } from \"./auth-tokens.js\";\nimport type { AuthorizationEvaluator } from \"./authorization-evaluator.js\";\nimport type { InstanceLookup } from \"./instance-registry.js\";\nimport type { PrincipalReadings } from \"./principal-readings.js\";\nimport type { RequestScope } from \"./request-scope.js\";\nimport type { RoutePlanner } from \"./route-planner.js\";\nimport type { TransportRegistry } from \"./transport-registry.js\";\n\n@Injectable()\nexport class BetterAuthGuard implements CanActivate {\n  static readonly [AUTH_ENHANCER] = \"guard\";\n  readonly [AUTH_ENHANCER] = \"guard\";\n\n  constructor(\n    @Inject(GUARD_CORE) private readonly core: Pick<GuardCore, \"canActivate\">,\n  ) {}\n\n  canActivate(context: ExecutionContext): Promise<boolean> {\n    return this.core.canActivate(context);\n  }\n}\nexport class GuardCore implements CanActivate {\n  constructor(\n    private readonly instances: InstanceLookup,\n    private readonly planner: RoutePlanner,\n    private readonly transports: TransportRegistry,\n    private readonly resolver: PrincipalResolver,\n    private readonly evaluator: AuthorizationEvaluator,\n    private readonly scope: RequestScope,\n    private readonly readings: PrincipalReadings,\n  ) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    let transport: AuthTransport | undefined;\n    let call: TransportCall | undefined;\n    let plan: RoutePlan | undefined;\n    try {\n      plan = this.planner.forContext(context);\n      if (plan.access === \"inherit\") {\n        transport = this.transports.find(context);\n        const lineage = transport?.lineage?.(context);\n        if (lineage && !this.readings.enclosing(lineage, context.getArgs())) {\n          call = this.transports.describe(context, transport);\n          throw BetterAuthConfigurationError.atRequest(\n            \"NO_ENCLOSING_DECISION\",\n            \"An inherited invocation has no enclosing guard decision\",\n            { site: plan.site },\n          );\n        }\n        if (plan.originCheck !== \"form\") {\n          return true;\n        }\n      }\n      if (plan.access === \"public\" && plan.originCheck !== \"form\") {\n        const lineage = this.transports.find(context)?.lineage?.(context);\n        if (lineage && !plan.nested) {\n          this.readings.recordLineage(lineage, {\n            outcome: \"no-identity\",\n            instance: plan.instance,\n          });\n        }\n        return true;\n      }\n      transport = this.transports.select(context);\n      call = this.transports.describe(context, transport);\n      const entry = this.instances.get(plan.instance);\n      if (plan.originCheck !== \"off\") {\n        const browser = call.browser;\n        if (browser) {\n          if (plan.originCheck === \"form\" || browser.enforce) {\n            const failure = await entry.origin.check(browser, plan.originCheck);\n            if (failure) {\n              throw failure;\n            }\n          } else {\n            await entry.origin.advisory(browser);\n          }\n        }\n      }\n      if (plan.access === \"inherit\") {\n        return true;\n      }\n      if (plan.access === \"public\") {\n        if (!plan.nested) {\n          this.readings.record(call, {\n            outcome: \"no-identity\",\n            instance: plan.instance,\n          });\n        }\n        return true;\n      }\n      const result = await this.resolver.resolve(call, {\n        auth: entry.handle,\n        freshness: plan.freshness,\n        accepts: plan.accepts,\n        sourceSet: plan.sourceSet,\n      });\n      this.readings.record(call, { ...result, instance: plan.instance });\n      if (result.outcome === \"rejected\") {\n        throw result.failure;\n      }\n      if (result.outcome === \"absent\") {\n        if (plan.access === \"optional\") {\n          return true;\n        }\n        throw AuthFailures.unauthenticated();\n      }\n      if (!plan.accepts.has(result.principal.kind)) {\n        throw AuthFailures.forbidden(\"PRINCIPAL_NOT_SUPPORTED\");\n      }\n      const decision = await this.evaluator.evaluate(\n        plan,\n        result.principal,\n        call,\n        entry,\n        context,\n        transport.id,\n      );\n      if (decision.effect === \"deny\") {\n        throw AuthFailures.rejected({\n          status: decision.status ?? 403,\n          reason: decision.reason,\n          message: decision.message,\n          challenge: decision.challenge,\n        });\n      }\n      return true;\n    } catch (error) {\n      if (isAuthFailure(error) && transport) {\n        const mapping =\n          plan && this.instances.get(plan.instance).options.errors?.map;\n        throw mapping\n          ? mapping(error, context, transport.id)\n          : transport.toException(error, context);\n      }\n      if (\n        (isConfigurationError(error) || isInfrastructureError(error)) &&\n        transport\n      ) {\n        const repeated = call\n          ? this.scope.surfaced(call.key, error, {\n              instance: plan?.instance ?? \"default\",\n              site: plan?.site ?? \"guard\",\n              lineage: call.lineage,\n            })\n          : false;\n        throw (\n          transport.toInternalException?.(error, context, { repeated }) ?? error\n        );\n      }\n      throw error;\n    }\n  }\n}\n"],"mappings":";;;;AA4BO,IAAM,kBAAN,MAAM,gBAAuC;CAKX;CAJvC,QAAiBA,iBAAAA,iBAAiB;CAClC,CAAUA,iBAAAA,iBAAiB;CAE3B,YACE,MACA;EADqC,KAAA,OAAA;CACpC;CAEH,YAAY,SAA6C;EACvD,OAAO,KAAK,KAAK,YAAY,OAAO;CACtC;AACF;;EAZCC,GAAAA,eAAAA,WAAAA,CAAW;CAMPC,iBAAAA,gBAAAA,IAAAA,GAAAA,eAAAA,OAAAA,CAAOC,iBAAAA,UAAU,CAAA;;;AAOtB,IAAa,YAAb,MAA8C;CAEzB;CACA;CACA;CACA;CACA;CACA;CACA;CAPnB,YACE,WACA,SACA,YACA,UACA,WACA,OACA,UACA;EAPiB,KAAA,YAAA;EACA,KAAA,UAAA;EACA,KAAA,aAAA;EACA,KAAA,WAAA;EACA,KAAA,YAAA;EACA,KAAA,QAAA;EACA,KAAA,WAAA;CAChB;CAEH,MAAM,YAAY,SAA6C;EAC7D,IAAI;EACJ,IAAI;EACJ,IAAI;EACJ,IAAI;GACF,OAAO,KAAK,QAAQ,WAAW,OAAO;GACtC,IAAI,KAAK,WAAW,WAAW;IAC7B,YAAY,KAAK,WAAW,KAAK,OAAO;IACxC,MAAM,UAAU,WAAW,UAAU,OAAO;IAC5C,IAAI,WAAW,CAAC,KAAK,SAAS,UAAU,SAAS,QAAQ,QAAQ,CAAC,GAAG;KACnE,OAAO,KAAK,WAAW,SAAS,SAAS,SAAS;KAClD,MAAMC,oBAAAA,6BAA6B,UACjC,yBACA,2DACA,EAAE,MAAM,KAAK,KAAK,CACpB;IACF;IACA,IAAI,KAAK,gBAAgB,QACvB,OAAO;GAEX;GACA,IAAI,KAAK,WAAW,YAAY,KAAK,gBAAgB,QAAQ;IAC3D,MAAM,UAAU,KAAK,WAAW,KAAK,OAAO,CAAC,EAAE,UAAU,OAAO;IAChE,IAAI,WAAW,CAAC,KAAK,QACnB,KAAK,SAAS,cAAc,SAAS;KACnC,SAAS;KACT,UAAU,KAAK;IACjB,CAAC;IAEH,OAAO;GACT;GACA,YAAY,KAAK,WAAW,OAAO,OAAO;GAC1C,OAAO,KAAK,WAAW,SAAS,SAAS,SAAS;GAClD,MAAM,QAAQ,KAAK,UAAU,IAAI,KAAK,QAAQ;GAC9C,IAAI,KAAK,gBAAgB,OAAO;IAC9B,MAAM,UAAU,KAAK;IACrB,IAAI,SAAS;KACX,IAAI,KAAK,gBAAgB,UAAU,QAAQ,SAAS;MAClD,MAAM,UAAU,MAAM,MAAM,OAAO,MAAM,SAAS,KAAK,WAAW;MAClE,IAAI,SACF,MAAM;KAEV,OACE,MAAM,MAAM,OAAO,SAAS,OAAO;IAEvC;GACF;GACA,IAAI,KAAK,WAAW,WAClB,OAAO;GAET,IAAI,KAAK,WAAW,UAAU;IAC5B,IAAI,CAAC,KAAK,QACR,KAAK,SAAS,OAAO,MAAM;KACzB,SAAS;KACT,UAAU,KAAK;IACjB,CAAC;IAEH,OAAO;GACT;GACA,MAAM,SAAS,MAAM,KAAK,SAAS,QAAQ,MAAM;IAC/C,MAAM,MAAM;IACZ,WAAW,KAAK;IAChB,SAAS,KAAK;IACd,WAAW,KAAK;GAClB,CAAC;GACD,KAAK,SAAS,OAAO,MAAM;IAAE,GAAG;IAAQ,UAAU,KAAK;GAAS,CAAC;GACjE,IAAI,OAAO,YAAY,YACrB,MAAM,OAAO;GAEf,IAAI,OAAO,YAAY,UAAU;IAC/B,IAAI,KAAK,WAAW,YAClB,OAAO;IAET,MAAMC,oBAAAA,aAAa,gBAAgB;GACrC;GACA,IAAI,CAAC,KAAK,QAAQ,IAAI,OAAO,UAAU,IAAI,GACzC,MAAMA,oBAAAA,aAAa,UAAU,yBAAyB;GAExD,MAAM,WAAW,MAAM,KAAK,UAAU,SACpC,MACA,OAAO,WACP,MACA,OACA,SACA,UAAU,EACZ;GACA,IAAI,SAAS,WAAW,QACtB,MAAMA,oBAAAA,aAAa,SAAS;IAC1B,QAAQ,SAAS,UAAU;IAC3B,QAAQ,SAAS;IACjB,SAAS,SAAS;IAClB,WAAW,SAAS;GACtB,CAAC;GAEH,OAAO;EACT,SAAS,OAAO;GACd,IAAIC,oBAAAA,cAAc,KAAK,KAAK,WAAW;IACrC,MAAM,UACJ,QAAQ,KAAK,UAAU,IAAI,KAAK,QAAQ,CAAC,CAAC,QAAQ,QAAQ;IAC5D,MAAM,UACF,QAAQ,OAAO,SAAS,UAAU,EAAE,IACpC,UAAU,YAAY,OAAO,OAAO;GAC1C;GACA,KACGC,oBAAAA,qBAAqB,KAAK,KAAKC,oBAAAA,sBAAsB,KAAK,MAC3D,WACA;IACA,MAAM,WAAW,OACb,KAAK,MAAM,SAAS,KAAK,KAAK,OAAO;KACnC,UAAU,MAAM,YAAY;KAC5B,MAAM,MAAM,QAAQ;KACpB,SAAS,KAAK;IAChB,CAAC,IACD;IACJ,MACE,UAAU,sBAAsB,OAAO,SAAS,EAAE,SAAS,CAAC,KAAK;GAErE;GACA,MAAM;EACR;CACF;AACF"}

package/dist/{auth-module-BgcY2HpA.cjs → auth-module-ab60-WJZ.cjs}

@@ -1,15 +1,15 @@
-const require_auth_errors = require("./auth-errors-DmiKl0L_.cjs");
-const require_decorate = require("./decorate-Cr4Q7bNE.cjs");
-const require_auth_scope_interceptor = require("./auth-scope-interceptor-BjxAL1-S.cjs");
-const require_auth_guard = require("./auth-guard-CLyhAEEj.cjs");
-const require_bridge_protocol = require("./bridge-protocol-BDw8opAG.cjs");
-const require_auth_decorators = require("./auth-decorators-Cu_nxWnF.cjs");
-const require_principal_readings = require("./principal-readings-Chmt6rQV.cjs");
-const require_platform = require("./platform-YICqqYv6.cjs");
+const require_auth_errors = require("./auth-errors-RW7hOVI-.cjs");
+const require_decorate = require("./decorate-fMNf0caZ.cjs");
+const require_auth_scope_interceptor = require("./auth-scope-interceptor-Bui20-Ps.cjs");
+const require_auth_guard = require("./auth-guard-wapEh_M_.cjs");
+const require_bridge_protocol = require("./bridge-protocol-DNFhIKdo.cjs");
+const require_auth_decorators = require("./auth-decorators-CJKE9wlT.cjs");
+const require_platform = require("./platform-C67dxSls.cjs");
+const require_principal_readings = require("./principal-readings-JLNT58k0.cjs");
 let better_auth_api = require("better-auth/api");
 let _nestjs_common = require("@nestjs/common");
 let _nestjs_core = require("@nestjs/core");
-//#region src/route-planner.ts
+// src/route-planner.ts
 function classes(target) {
 	const result = [];
 	for (let current = target; current && current !== Function.prototype; current = Object.getPrototypeOf(current)) result.push(current);
@@ -191,8 +191,7 @@ var RoutePlanner = class {
 function intersection(sets, universe) {
 	return new Set([...universe].filter((kind) => sets.every((set) => set.has(kind))));
 }
-//#endregion
-//#region src/authorization-evaluator.ts
+// src/authorization-evaluator.ts
 const allow = () => ({ effect: "allow" });
 const deny = (input) => ({
 	effect: "deny",
@@ -356,8 +355,7 @@ var AuthorizationEvaluator = class {
 		return allow();
 	}
 };
-//#endregion
-//#region src/trusted-origins.ts
+// src/trusted-origins.ts
 /** Auth route path exceptions never exempt application operations. */
 function originChecksDisabled(context) {
 	return context.skipCSRFCheck || context.skipOriginCheck === true && context.options.advanced?.disableCSRFCheck === void 0;
@@ -438,8 +436,7 @@ var TrustedOrigins = class {
 		return context.isTrustedOrigin.call({ trustedOrigins }, origin, { allowRelativePaths: false });
 	}
 };
-//#endregion
-//#region src/bridge-client.ts
+// src/bridge-client.ts
 /** Preserve capabilities lazily; spreading a ScopeView can extract credentials. */
 function derivedScope(scope, init) {
 	const outer = scope.current();
@@ -522,8 +519,7 @@ var BridgeClient = class {
 		this.#registrations.length = 0;
 	}
 };
-//#endregion
-//#region src/origin-check.ts
+// src/origin-check.ts
 const ORIGIN_PROOF = Symbol.for("@nestjs-kit/better-auth:origin-proof");
 const ORIGIN_CALCULATION_FAILURES = Symbol.for("@nestjs-kit/better-auth:origin-calculation-failures");
 function diagnosticOrigin(headers) {
@@ -668,8 +664,7 @@ var OriginCheck = class {
 		return this.init.context.isTrustedOrigin.call({ trustedOrigins }, value, { allowRelativePaths: false }) ? null : require_auth_errors.AuthFailures.forbidden("INVALID_ORIGIN");
 	}
 };
-//#endregion
-//#region src/instance-registry.ts
+// src/instance-registry.ts
 /** Nest considers transient providers static; auth collaborators require singleton trees. */
 function isSingletonDependencyTree(root) {
 	const pending = [root];
@@ -812,8 +807,7 @@ let InstanceRegistry = class InstanceRegistry {
 	}
 };
 InstanceRegistry = require_decorate.__decorate([require_decorate.__decorateParam(0, (0, _nestjs_common.Inject)(require_decorate.REQUEST_SCOPE)), require_decorate.__decorateMetadata("design:paramtypes", [Object])], InstanceRegistry);
-//#endregion
-//#region src/route-paths.ts
+// src/route-paths.ts
 function addLeadingSlash(path) {
 	if (typeof path !== "string" || path === "") return "";
 	return path.startsWith("/") || path.startsWith("{/") ? path : `/${path}`;
@@ -868,8 +862,7 @@ function composeRoutePaths(input, requestMethod, exclusions) {
 	}
 	return paths.map((path) => addLeadingSlash(path || "/")).map((path) => path === "/" ? path : stripEndSlash(path));
 }
-//#endregion
-//#region src/boot-validator.ts
+// src/boot-validator.ts
 function requirementLeaves(expressions) {
 	return expressions.flatMap((expression) => "anyOf" in expression ? requirementLeaves(expression.anyOf) : "allOf" in expression ? requirementLeaves(expression.allOf) : [expression]);
 }
@@ -1372,8 +1365,7 @@ BootValidator = require_decorate.__decorate([
 	require_decorate.__decorateParam(8, (0, _nestjs_common.Inject)(require_decorate.TRANSPORT_REGISTRY)),
 	require_decorate.__decorateParam(9, (0, _nestjs_common.Inject)(require_decorate.MOUNT_COORDINATOR))
 ], BootValidator);
-//#endregion
-//#region src/hook-binder.ts
+// src/hook-binder.ts
 const DATABASE_TARGETS = [
 	"user",
 	"session",
@@ -1512,8 +1504,7 @@ HookBinder = require_decorate.__decorate([
 	require_decorate.__decorateParam(1, (0, _nestjs_common.Inject)(_nestjs_core.MetadataScanner)),
 	require_decorate.__decorateMetadata("design:paramtypes", [typeof _nestjs_core.DiscoveryService === "undefined" ? Object : _nestjs_core.DiscoveryService, typeof _nestjs_core.MetadataScanner === "undefined" ? Object : _nestjs_core.MetadataScanner])
 ], HookBinder);
-//#endregion
-//#region src/auth-exchange.ts
+// src/auth-exchange.ts
 const HOP_HEADERS = [
 	"connection",
 	"keep-alive",
@@ -1710,8 +1701,7 @@ function betterAuthCorsOrigin(auth, options) {
 		})().then((allow) => callback(null, allow), (error) => callback(error instanceof Error ? error : /* @__PURE__ */ new Error("Failed to resolve trusted CORS origins")));
 	};
 }
-//#endregion
-//#region src/mount-coordinator.ts
+// src/mount-coordinator.ts
 const MOUNTED = Symbol.for("@nestjs-kit/better-auth:mounted");
 function parseBodyLimit(input) {
 	if (input === void 0) return 1048576;
@@ -1861,8 +1851,7 @@ MountCoordinator = require_decorate.__decorate([
 		Object
 	])
 ], MountCoordinator);
-//#endregion
-//#region src/policy-resolver.ts
+// src/policy-resolver.ts
 var PolicyResolver = class {
 	moduleRef;
 	cache = /* @__PURE__ */ new Map();
@@ -1883,8 +1872,7 @@ var PolicyResolver = class {
 		return policy;
 	}
 };
-//#endregion
-//#region src/transport-registry.ts
+// src/transport-registry.ts
 var TransportRegistry = class {
 	transports = [];
 	owners = /* @__PURE__ */ new WeakMap();
@@ -1921,8 +1909,7 @@ var TransportRegistry = class {
 		return call;
 	}
 };
-//#endregion
-//#region src/auth-core-module.ts
+// src/auth-core-module.ts
 const EVALUATOR = Symbol("authorization-evaluator");
 const exports$1 = [
 	require_decorate.INSTANCE_REGISTRY,
@@ -2151,8 +2138,7 @@ BetterAuthCoreModule = require_decorate.__decorate([
 		typeof BootValidator === "undefined" ? Object : BootValidator
 	])
 ], BetterAuthCoreModule);
-//#endregion
-//#region src/session-principal.ts
+// src/session-principal.ts
 const SESSION_PRINCIPAL_KIND = "session";
 const CurrentSession = require_auth_decorators.definePrincipalParam({
 	kind: SESSION_PRINCIPAL_KIND,
@@ -2291,8 +2277,7 @@ const freshSession = (options = {}) => ({
 	params: options
 });
 const RequireFreshSession = (options) => require_auth_decorators.Require(freshSession(options));
-//#endregion
-//#region src/auth-service.ts
+// src/auth-service.ts
 let BetterAuthService = class BetterAuthService {
 	registry;
 	scope;
@@ -2414,8 +2399,7 @@ BetterAuthService = require_decorate.__decorate([
 		Object
 	])
 ], BetterAuthService);
-//#endregion
-//#region src/http-transport.ts
+// src/http-transport.ts
 let HttpTransport = class HttpTransport {
 	adapterHost;
 	id = "http";
@@ -2511,8 +2495,7 @@ HttpTransport = require_decorate.__decorate([require_decorate.__decorateParam(0,
 function httpTransport() {
 	return HttpTransport;
 }
-//#endregion
-//#region src/auth-module-definition.ts
+// src/auth-module-definition.ts
 function defineExtension(definition) {
 	return {
 		...definition,
@@ -2690,8 +2673,7 @@ function moduleDefinition(module, definition, async) {
 		exports
 	};
 }
-//#endregion
-//#region src/auth-module.ts
+// src/auth-module.ts
 var _BetterAuthModule;
 let BetterAuthModule = _BetterAuthModule = class BetterAuthModule {
 	static forRoot(options) {
@@ -2702,7 +2684,6 @@ let BetterAuthModule = _BetterAuthModule = class BetterAuthModule {
 	}
 };
 BetterAuthModule = _BetterAuthModule = require_decorate.__decorate([(0, _nestjs_common.Module)({})], BetterAuthModule);
-//#endregion
 Object.defineProperty(exports, "AuthorizationEvaluator", {
 	enumerable: true,
 	get: function() {
@@ -2806,4 +2787,4 @@ Object.defineProperty(exports, "sessionPrincipal", {
 	}
 });
 
-//# sourceMappingURL=auth-module-BgcY2HpA.cjs.map
+//# sourceMappingURL=auth-module-ab60-WJZ.cjs.map