@nestjs-kit/better-auth 2.0.0 → 2.1.2

package/dist/fastify.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"fastify.d.cts","names":[],"sources":["../src/fastify-platform.ts"],"mappings":";;;;;;;;;;qBA+Oa,2BAA2B;;mBAMT;WALpB;WACA;aAAiB;aAAa;;WAC9B,UAAU;EAGnB,YAA6B,UAAS;EAgFtC,SAAS,SAAS;EAIlB,QAAQ,SAAS;EASX,MAAM,SAAS,uBAAuB;;wBAwE9B,gBACd,UAAU,yBACT,aAAa"}
+{"version":3,"file":"fastify.d.cts","names":[],"sources":["../src/fastify-platform.ts"],"mappings":";;;;;;;;;qBA+Oa,2BAA2B;;mBAMT;WALpB;WACA;;;;WACA,UAAU;EAGU,YAAA,UAAS;EAgFtC,SAAS,SAAS;EAIlB,QAAQ,SAAS;EASX,MAAM,SAAS,uBAAuB;;wBAwE9B,gBACd,UAAU,yBACT,aAAa"}

package/dist/fastify.d.mts

@@ -1,6 +1,5 @@
-import { I as ExtensionRef, J as PlatformMountContext, L as FastifyPlatformOptions, U as HttpPlatform, W as HttpRequestAccessor, Y as PlatformPrepareContext } from "./auth-contracts-Cz7C4_Ch.mjs";
+import { I as ExtensionRef, J as PlatformMountContext, L as FastifyPlatformOptions, U as HttpPlatform, W as HttpRequestAccessor, Y as PlatformPrepareContext } from "./auth-contracts-CADGyI0O.mjs";
 import { AbstractHttpAdapter } from "@nestjs/core";
-//#region src/fastify-platform.d.ts
 /**
  * Fastify's encapsulated auth-route platform adapter.
  *
@@ -23,6 +22,5 @@ export declare class FastifyPlatform implements HttpPlatform {
   mount(context: PlatformMountContext): Promise<void>;
 }
 export declare function fastifyPlatform(options?: FastifyPlatformOptions): ExtensionRef<HttpPlatform>;
-//#endregion
 export type { FastifyPlatformOptions };
 //# sourceMappingURL=fastify.d.mts.map

package/dist/fastify.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"fastify.d.mts","names":[],"sources":["../src/fastify-platform.ts"],"mappings":";;;;;;;;;;qBA+Oa,2BAA2B;;mBAMT;WALpB;WACA;aAAiB;aAAa;;WAC9B,UAAU;EAGnB,YAA6B,UAAS;EAgFtC,SAAS,SAAS;EAIlB,QAAQ,SAAS;EASX,MAAM,SAAS,uBAAuB;;wBAwE9B,gBACd,UAAU,yBACT,aAAa"}
+{"version":3,"file":"fastify.d.mts","names":[],"sources":["../src/fastify-platform.ts"],"mappings":";;;;;;;;;qBA+Oa,2BAA2B;;mBAMT;WALpB;WACA;;;;WACA,UAAU;EAGU,YAAA,UAAS;EAgFtC,SAAS,SAAS;EAIlB,QAAQ,SAAS;EASX,MAAM,SAAS,uBAAuB;;wBAwE9B,gBACd,UAAU,yBACT,aAAa"}

package/dist/fastify.mjs

@@ -1,5 +1,5 @@
-import { l as headerLines, o as toWebHeaders, u as setCookieAdditions } from "./platform-CZl7TY8j.mjs";
-//#region src/fastify-platform.ts
+import { l as headerLines, o as toWebHeaders, u as setCookieAdditions } from "./platform-BKYVzAv1.mjs";
+// src/fastify-platform.ts
 function instanceOf(adapter) {
 	return adapter.getInstance();
 }
@@ -210,7 +210,6 @@ var FastifyPlatform = class {
 function fastifyPlatform(options) {
 	return new FastifyPlatform(options);
 }
-//#endregion
 export { FastifyPlatform, fastifyPlatform };
 
 //# sourceMappingURL=fastify.mjs.map

package/dist/graphql.cjs

@@ -1,13 +1,13 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_auth_errors = require("./auth-errors-DmiKl0L_.cjs");
-const require_decorate = require("./decorate-Cr4Q7bNE.cjs");
-const require_auth_scope_interceptor = require("./auth-scope-interceptor-BjxAL1-S.cjs");
-const require_auth_guard = require("./auth-guard-CLyhAEEj.cjs");
-const require_platform = require("./platform-YICqqYv6.cjs");
+const require_auth_errors = require("./auth-errors-RW7hOVI-.cjs");
+const require_auth_guard = require("./auth-guard-wapEh_M_.cjs");
+const require_auth_scope_interceptor = require("./auth-scope-interceptor-Bui20-Ps.cjs");
+const require_decorate = require("./decorate-fMNf0caZ.cjs");
+const require_platform = require("./platform-C67dxSls.cjs");
 let _nestjs_common = require("@nestjs/common");
 let _nestjs_core = require("@nestjs/core");
 let _nestjs_graphql = require("@nestjs/graphql");
-//#region src/graphql-lineage.ts
+// src/graphql-lineage.ts
 const OPERATIONS = Symbol.for("@nestjs-kit/better-auth:graphql-operations");
 function record(value) {
 	return typeof value === "object" && value !== null ? value : void 0;
@@ -68,8 +68,7 @@ function graphqlLineage(args, reference = false) {
 		}
 	};
 }
-//#endregion
-//#region src/graphql-transport.ts
+// src/graphql-transport.ts
 const MERCURIUS_AMBIENT = Symbol.for("@nestjs-kit/better-auth:mercurius-ambient");
 const MERCURIUS_UPGRADE = Symbol.for("@nestjs-kit/better-auth:mercurius-upgrade");
 var BetterAuthGraphqlDenial = class extends _nestjs_common.IntrinsicException {
@@ -498,7 +497,6 @@ function apolloTransport(options = {}) {
 function mercuriusTransport(options = {}) {
 	return new GraphqlTransport("mercurius", options);
 }
-//#endregion
 exports.BetterAuthGraphqlDenial = BetterAuthGraphqlDenial;
 exports.BetterAuthGraphqlInternalError = BetterAuthGraphqlInternalError;
 exports.BetterAuthGraphqlRepeatedInternalError = BetterAuthGraphqlRepeatedInternalError;

package/dist/graphql.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"graphql.cjs","names":["IntrinsicException","isConfigurationError","upgradeRequestUrl","toWebHeaders","BetterAuthConfigurationError","RESOLVER_REFERENCE_METADATA","RESOLVER_PROPERTY_METADATA","AuthFailures","GRAPHQL_MODULE_OPTIONS","Query","RESOLVER_TYPE_METADATA","ResolveField","ResolveReference","PARAM_ARGS_METADATA","MetadataScanner","ApplicationConfig","BetterAuthGuard","BetterAuthScopeInterceptor","AUTH_ENHANCER","ACCESS_METADATA","ACCEPT_PRINCIPALS_METADATA","REQUIREMENTS_METADATA"],"sources":["../src/graphql-lineage.ts","../src/graphql-transport.ts"],"sourcesContent":["import type { InvocationLineage } from \"./auth-contracts.js\";\n\nconst OPERATIONS = Symbol.for(\"@nestjs-kit/better-auth:graphql-operations\");\ninterface Path {\n  readonly key: string | number;\n  readonly prev?: Path;\n  readonly typename?: string;\n}\nexport interface GraphInfo {\n  readonly operation: object & { operation?: string };\n  readonly path: Path;\n}\nexport function record(\n  value: unknown,\n): Record<PropertyKey, unknown> | undefined {\n  return typeof value === \"object\" && value !== null\n    ? (value as Record<PropertyKey, unknown>)\n    : undefined;\n}\n/** Apollo reference resolvers omit the argument object; parameter readers see the original array. */\nexport function graphqlArgs(args: readonly unknown[]) {\n  const reference = args.length === 3;\n  return {\n    root: record(args[0]),\n    args: reference ? undefined : record(args[1]),\n    context: record(args[reference ? 1 : 2]) ?? args,\n    info: record(args[reference ? 2 : 3]) as unknown as GraphInfo | undefined,\n  };\n}\ninterface Operation {\n  id: number;\n  references: Set<string>;\n}\nfunction operationState(carrier: object, operation: object): Operation {\n  let operations = Reflect.get(carrier, OPERATIONS) as\n    | Map<object, Operation>\n    | undefined;\n  if (!operations) {\n    operations = new Map();\n    Object.defineProperty(carrier, OPERATIONS, { value: operations });\n  }\n  let state = operations.get(operation);\n  if (state === undefined) {\n    state = { id: operations.size + 1, references: new Set() };\n    operations.set(operation, state);\n  }\n  return state;\n}\nfunction keys(path: Path | undefined): (string | number)[] {\n  return path ? [...keys(path.prev), path.key] : [];\n}\nfunction position(id: number, path: Path | undefined): string {\n  return `${id}:${JSON.stringify(keys(path))}`;\n}\nexport function graphqlInvocation(\n  args: readonly unknown[],\n  reference = false,\n): object {\n  const normalized = graphqlArgs(args);\n  return (reference ? normalized.root : normalized.info) ?? args;\n}\nexport function graphqlLineage(\n  args: readonly unknown[],\n  reference = false,\n): InvocationLineage {\n  const normalized = graphqlArgs(args);\n  const carrier = normalized.context;\n  const state = operationState(carrier, normalized.info?.operation ?? carrier);\n  const { id } = state;\n  if (reference) {\n    state.references.add(JSON.stringify(keys(normalized.info?.path)));\n  }\n  return {\n    carrier,\n    position: reference\n      ? `${id}:_entities#${String(normalized.root?.__typename ?? \"\")}`\n      : position(id, normalized.info?.path),\n    *enclosing(currentArgs) {\n      const current = graphqlArgs(currentArgs);\n      const operation = operationState(\n        current.context,\n        current.info?.operation ?? current.context,\n      );\n      const path = current.info?.path;\n      for (\n        let child = path, parent = path?.prev;\n        parent;\n        child = parent, parent = parent.prev\n      ) {\n        // The child path supplies the concrete entity type below the list index.\n        if (\n          typeof parent.key === \"number\" &&\n          parent.prev &&\n          (parent.prev.key === \"_entities\" ||\n            operation.references.has(JSON.stringify(keys(parent.prev))))\n        ) {\n          yield `${operation.id}:_entities#${child?.typename ?? String(current.root?.__typename ?? \"\")}`;\n        }\n        yield position(operation.id, parent);\n      }\n    },\n  };\n}\n","import type { IncomingHttpHeaders } from \"node:http\";\nimport { type ExecutionContext, IntrinsicException } from \"@nestjs/common\";\nimport { ApplicationConfig, MetadataScanner } from \"@nestjs/core\";\nimport {\n  Args,\n  GRAPHQL_MODULE_OPTIONS,\n  PARAM_ARGS_METADATA,\n  RESOLVER_PROPERTY_METADATA,\n  RESOLVER_REFERENCE_METADATA,\n  RESOLVER_TYPE_METADATA,\n  Query,\n  ResolveField,\n  ResolveReference,\n} from \"@nestjs/graphql\";\nimport type {\n  AuthTransport,\n  BootAdvice,\n  BootAdviceContext,\n  ExtensionRef,\n  RoutePlan,\n  TransportCall,\n  TransportKit,\n  TransportValidationContext,\n} from \"./auth-contracts.js\";\nimport {\n  BetterAuthConfigurationError,\n  AuthFailures,\n  isConfigurationError,\n} from \"./auth-errors.js\";\nimport type {\n  AuthFailure,\n  AuthGraphqlExtensions,\n  BetterAuthInfrastructureError,\n} from \"./auth-errors.js\";\nimport { BetterAuthGuard } from \"./auth-guard.js\";\nimport { BetterAuthScopeInterceptor } from \"./auth-scope-interceptor.js\";\nimport {\n  AUTH_ENHANCER,\n  ACCESS_METADATA,\n  ACCEPT_PRINCIPALS_METADATA,\n  REQUIREMENTS_METADATA,\n} from \"./auth-tokens.js\";\nimport {\n  type GraphInfo,\n  graphqlArgs,\n  graphqlInvocation,\n  graphqlLineage,\n  record,\n} from \"./graphql-lineage.js\";\nimport { toWebHeaders, upgradeRequestUrl } from \"./platform.js\";\n\nconst MERCURIUS_AMBIENT = Symbol.for(\n  \"@nestjs-kit/better-auth:mercurius-ambient\",\n);\nconst MERCURIUS_UPGRADE = Symbol.for(\n  \"@nestjs-kit/better-auth:mercurius-upgrade\",\n);\nexport interface GraphqlTransportOptions {\n  /** Case-insensitive connection-init credential keys; defaults to authorization and cookie. */\n  connectionParamHeaders?: readonly string[];\n  /**\n   * Replaces socket credentials, preserving absent host and forwarded-host/proto headers.\n   * Returning undefined presents no credentials: neither connectionParamHeaders nor the\n   * upgrade request's credential headers are used.\n   */\n  subscriptionCredentials?: (\n    connectionContext: unknown,\n  ) => HeadersInit | undefined;\n  /** Connection principal reuse; zero by default. Authoritative plans bypass the TTL. */\n  subscriptionPrincipalTtlMs?: number;\n  fieldResolverCoverage?: \"error\" | \"warn\" | \"off\";\n  federationCoverage?: \"error\" | \"warn\" | \"off\";\n}\nexport class BetterAuthGraphqlDenial extends IntrinsicException {\n  readonly extensions: AuthGraphqlExtensions;\n\n  constructor(failure: AuthFailure) {\n    super(failure.message);\n    this.extensions = {\n      code: failure.code,\n      statusCode: failure.status,\n      ...(failure.reason ? { reason: failure.reason } : {}),\n    };\n  }\n}\nfunction internalExtensions(\n  error: BetterAuthInfrastructureError | BetterAuthConfigurationError,\n): AuthGraphqlExtensions {\n  return {\n    code: \"INTERNAL_SERVER_ERROR\",\n    reason: isConfigurationError(error)\n      ? \"AUTH_MISCONFIGURED\"\n      : \"AUTH_UNAVAILABLE\",\n    statusCode: 500,\n  };\n}\nexport class BetterAuthGraphqlInternalError extends Error {\n  readonly extensions: AuthGraphqlExtensions;\n\n  constructor(\n    error: BetterAuthInfrastructureError | BetterAuthConfigurationError,\n  ) {\n    super(\"Internal server error\", { cause: error });\n    this.extensions = internalExtensions(error);\n  }\n}\nexport class BetterAuthGraphqlRepeatedInternalError extends IntrinsicException {\n  readonly extensions: AuthGraphqlExtensions;\n\n  constructor(\n    error: BetterAuthInfrastructureError | BetterAuthConfigurationError,\n  ) {\n    super(\"Internal server error\", { cause: error });\n    this.extensions = internalExtensions(error);\n  }\n}\n/** Keeps the upgrade request and its original browser headers across Mercurius operation spreads. */\nexport function mercuriusSubscriptionContext() {\n  return (\n    _connection: unknown,\n    request: { headers: Record<string, unknown> },\n  ): Record<string | symbol, unknown> => ({\n    [MERCURIUS_UPGRADE]: request,\n    [MERCURIUS_AMBIENT]: ambientHeaders(request),\n  });\n}\ninterface Upgrade {\n  headers: IncomingHttpHeaders;\n  url?: string;\n  secure?: boolean;\n  socket?: { encrypted?: boolean };\n}\nfunction upgrade(value: unknown): Upgrade | undefined {\n  const candidate = record(value);\n  return candidate && record(candidate.headers)\n    ? (candidate as unknown as Upgrade)\n    : undefined;\n}\n/** The WebSocket of a graphql-ws `extra` ({ socket, request }): a socket with function-typed send and close. */\nfunction graphqlWsSocket(\n  value: unknown,\n): Record<PropertyKey, unknown> | undefined {\n  const socket = record(record(value)?.socket);\n  return socket &&\n    typeof socket.send === \"function\" &&\n    typeof socket.close === \"function\"\n    ? socket\n    : undefined;\n}\n/**\n * The upgrade request of a graphql-ws `extra` ({ socket, request }) whose socket is a\n * WebSocket. Only the graphql-ws server creates that pair; parsed request data cannot carry\n * functions, so a client-sent header or field never selects the socket path. The socket's\n * state does not change this recognition: the transport classifies it once per operation\n * (GraphqlTransport.openAtStart).\n */\nfunction graphqlWsUpgrade(value: unknown): Upgrade | undefined {\n  return graphqlWsSocket(value) ? upgrade(record(value)?.request) : undefined;\n}\n/** WebSocket.OPEN of the `ws` sockets that Nest's graphql-ws server creates. */\nconst WEBSOCKET_OPEN = 1;\n/** Upgrade-request headers that locate the server for Better Auth; none of them is a credential. */\nconst HOST_METADATA = [\"host\", \"x-forwarded-host\", \"x-forwarded-proto\"];\n/**\n * The upgrade request's URL without the target's query string and fragment. A query string can\n * carry a connection's credential (`?access_token=`), which an operation that reads no credential\n * of its connection must not expose to principal sources or policies.\n */\nfunction upgradePathUrl(request: Upgrade): string {\n  const target = request.url ?? \"/\";\n  const end = target.search(/[?#]/);\n  return upgradeRequestUrl({\n    headers: request.headers,\n    url: end === -1 ? target : target.slice(0, end),\n    secure: request.secure,\n    socket: request.socket,\n  });\n}\n/** Copies the host metadata of `ambient` into `into` where `into` has none of its own. */\nfunction withHostMetadata(into: Headers, ambient: Headers): Headers {\n  for (const name of HOST_METADATA) {\n    const value = ambient.get(name);\n    if (!into.has(name) && value !== null) {\n      into.set(name, value);\n    }\n  }\n  return into;\n}\n/**\n * The identity of one GraphQL execution, shared by every resolver of that execution. graphql-js\n * coerces the variable values into a fresh object for every execution, including one\n * subscription and its events; a parsed operation can be cached across executions, so it\n * serves only as the fallback.\n */\nfunction executionOf(info: GraphInfo | undefined): object | undefined {\n  const value = record(info);\n  return record(value?.variableValues) ?? record(value?.operation);\n}\nfunction ambientHeaders(request: unknown): Headers {\n  const value = record(request);\n  const raw = record(value?.raw) ?? value;\n  // Mercurius copies connection-init values into missing request.headers keys.\n  // Node rawHeaders retains the actual browser leg even after that mutation.\n  const rawHeaders = raw?.rawHeaders;\n  if (Array.isArray(rawHeaders)) {\n    const headers = new Headers();\n    for (let index = 0; index + 1 < rawHeaders.length; index += 2) {\n      if (\n        typeof rawHeaders[index] === \"string\" &&\n        typeof rawHeaders[index + 1] === \"string\"\n      ) {\n        headers.append(rawHeaders[index], rawHeaders[index + 1]);\n      }\n    }\n    return headers;\n  }\n  return toWebHeaders((value?.headers ?? {}) as IncomingHttpHeaders);\n}\n/**\n * Mercurius assigns the route's Fastify reply to context.reply for HTTP operations. Its\n * subscription contexts carry the platform-recognized upgrade request inside a plain reply\n * object instead, so the reply's identity, not the request alone, marks an HTTP operation.\n */\nfunction platformReply(http: TransportKit[\"http\"], value: unknown): boolean {\n  const request = record(value)?.request;\n  if (http?.isRequest(request) !== true) {\n    return false;\n  }\n  return http.responseFor ? http.responseFor(request) === value : true;\n}\nfunction carrierDetails(\n  context: unknown,\n  driver: \"apollo\" | \"mercurius\",\n  http: TransportKit[\"http\"],\n) {\n  const carrier = record(context) ?? {};\n  const req = record(carrier.req);\n  const extra = record(carrier.extra);\n  // A positive platform answer keeps the HTTP path and its liveness check, before any socket\n  // heuristic: a custom context can spread client data such as _connectionInit into its root.\n  const httpRequest =\n    driver === \"apollo\"\n      ? http?.isRequest(req) === true ||\n        http?.isRequest(extra?.request) === true\n      : platformReply(http, carrier.reply);\n  // Nest assigns the graphql-ws Context to context.req unless a custom context sets req. Its\n  // server-created extra identifies it: graphql-ws sets connectionParams only for an object\n  // connection_init payload, and an absent payload presents no connection credentials.\n  const wsContext =\n    driver === \"apollo\" && !httpRequest && graphqlWsUpgrade(req?.extra)\n      ? req\n      : undefined;\n  const wsExtra =\n    driver === \"apollo\" && !httpRequest\n      ? wsContext\n        ? wsContext.extra\n        : extra\n      : undefined;\n  const socket = httpRequest\n    ? undefined\n    : driver === \"apollo\"\n      ? graphqlWsUpgrade(wsExtra)\n      : (upgrade(carrier[MERCURIUS_UPGRADE]) ??\n        (\"_connectionInit\" in carrier\n          ? (upgrade(carrier.request) ??\n            upgrade(record(carrier.reply)?.request) ??\n            upgrade(carrier.req))\n          : undefined));\n  const connection = wsContext ? req : carrier;\n  const params = record(\n    wsContext\n      ? req?.connectionParams\n      : (carrier.connectionParams ?? carrier._connectionInit),\n  );\n  const request =\n    driver === \"apollo\"\n      ? carrier.req\n      : (record(carrier.reply)?.request ?? carrier.req);\n  const ambient = () =>\n    carrier[MERCURIUS_AMBIENT] instanceof Headers\n      ? new Headers(carrier[MERCURIUS_AMBIENT])\n      : ambientHeaders(socket);\n  // Mercurius socket contexts carry no graphql-ws extra: its subscription context is per connection.\n  const webSocket = socket ? graphqlWsSocket(wsExtra) : undefined;\n  return { carrier, socket, webSocket, connection, params, request, ambient };\n}\nclass GraphqlTransport implements AuthTransport {\n  readonly requires = { hostlessCalls: false };\n  readonly connectionTtlMs: number;\n  private kit?: TransportKit;\n  private plans: {\n    plan: RoutePlan;\n    field: boolean;\n    reference: boolean;\n    target: object;\n    method: string;\n  }[] = [];\n  private enhancerAdvice?: BootAdvice;\n  private filterAdvice?: BootAdvice;\n  /** Whether each execution's graphql-ws socket was open when the execution first reached the transport. */\n  private readonly socketsAtStart = new WeakMap<object, boolean>();\n\n  constructor(\n    readonly id: \"apollo\" | \"mercurius\",\n    private readonly options: GraphqlTransportOptions,\n  ) {\n    this.connectionTtlMs = options.subscriptionPrincipalTtlMs ?? 0;\n    if (!Number.isFinite(this.connectionTtlMs) || this.connectionTtlMs < 0) {\n      throw new BetterAuthConfigurationError(\n        \"INVALID_SUBSCRIPTION_TTL\",\n        \"subscriptionPrincipalTtlMs must be a finite nonnegative number\",\n      );\n    }\n  }\n\n  handles(context: ExecutionContext): boolean {\n    return context.getType<string>() === \"graphql\";\n  }\n\n  private reference(context: ExecutionContext): boolean {\n    return (\n      Reflect.getMetadata(RESOLVER_REFERENCE_METADATA, context.getHandler()) ===\n      true\n    );\n  }\n\n  defaultAccessFor(target: object, method: string): \"inherit\" | undefined {\n    const handler = Reflect.get(\n      Reflect.get(target, \"prototype\") ?? target,\n      method,\n    );\n    return typeof handler === \"function\" &&\n      !Reflect.getMetadata(RESOLVER_REFERENCE_METADATA, handler) &&\n      Reflect.getMetadata(RESOLVER_PROPERTY_METADATA, handler)\n      ? \"inherit\"\n      : undefined;\n  }\n\n  lineage(context: ExecutionContext) {\n    const args = context.getArgs();\n    const normalized = graphqlArgs(args);\n    // A public root reaches the transport through its lineage alone, so an operation can start\n    // here: its socket's classification then holds for the guarded fields nested in it.\n    this.openAtStart(\n      carrierDetails(normalized.context, this.id, this.kit?.http ?? null)\n        .webSocket,\n      normalized.info,\n    );\n    return {\n      ...graphqlLineage(args, this.reference(context)),\n      assertReadable: (args: readonly unknown[]) => {\n        if (this.kit) {\n          this.assertRequest(args, this.kit);\n        }\n      },\n    };\n  }\n\n  /**\n   * Whether the operation's graphql-ws socket was open when the operation started. The first\n   * classification of an execution holds for every later reader of it, so a connection that\n   * closes during authentication keeps its credentials. A socket that is not open when an\n   * operation starts belongs either to a connection that closed while graphql-ws prepared the\n   * operation or to an earlier connection that a cached context carries; its state cannot tell\n   * the two apart, so the operation reads no credential of that connection in either case.\n   */\n  private openAtStart(\n    webSocket: Record<PropertyKey, unknown> | undefined,\n    info: GraphInfo | undefined,\n  ): boolean {\n    if (!webSocket) {\n      return true;\n    }\n    const execution = executionOf(info);\n    const known = execution ? this.socketsAtStart.get(execution) : undefined;\n    if (known !== undefined) {\n      return known;\n    }\n    const open = webSocket.readyState === WEBSOCKET_OPEN;\n    if (execution) {\n      this.socketsAtStart.set(execution, open);\n    }\n    return open;\n  }\n\n  private assertRequest(args: readonly unknown[], kit: TransportKit) {\n    const normalized = graphqlArgs(args);\n    const details = carrierDetails(normalized.context, this.id, kit.http);\n    if (details.socket) {\n      return details;\n    }\n    if (!kit.http?.isRequest(details.request)) {\n      throw BetterAuthConfigurationError.atRequest(\n        \"GRAPHQL_CONTEXT_UNRECOGNIZED\",\n        \"GraphQL context has no recognized platform or upgrade request\",\n        {\n          hint: \"Keep the native request at context.req or context.extra.request; use mercuriusSubscriptionContext() for Mercurius sockets.\",\n        },\n      );\n    }\n    if (!kit.http.isLive(details.request)) {\n      throw BetterAuthConfigurationError.atRequest(\n        \"GRAPHQL_CONTEXT_STALE_REQUEST\",\n        \"GraphQL context contains a completed request\",\n        {\n          hint: \"Return a fresh context object for every operation and every graphql-ws connection.\",\n        },\n      );\n    }\n    return details;\n  }\n\n  describe(context: ExecutionContext, kit: TransportKit): TransportCall {\n    this.kit = kit;\n    const args = context.getArgs();\n    const normalized = graphqlArgs(args);\n    const initial = carrierDetails(normalized.context, this.id, kit.http);\n    // Classified here, at the start of the operation. The operation of a socket that is not open\n    // runs without that connection's credentials: it keeps no key or connection of the context,\n    // so no memoized or connection principal answers it, its headers carry host metadata only,\n    // and its request URL carries the upgrade request's path without the query string.\n    const open = this.openAtStart(initial.webSocket, normalized.info);\n    const key =\n      !initial.socket && kit.http?.isRequest(initial.request)\n        ? kit.http.key(initial.request)\n        : open\n          ? normalized.context\n          : (executionOf(normalized.info) ?? args);\n    const checked = () => this.assertRequest(args, kit);\n    const headers = () => {\n      const details = checked();\n      if (!details.socket) {\n        return kit.http!.headers(details.request);\n      }\n      const ambient = details.ambient();\n      if (!open) {\n        // Neither the upgrade request's credentials nor the connection's client data are read.\n        return withHostMetadata(new Headers(), ambient);\n      }\n      if (this.options.subscriptionCredentials) {\n        // Keep callback errors outside the conversion boundary: application\n        // programming failures are not malformed credential denials.\n        const input = this.options.subscriptionCredentials(details.connection);\n        let mapped: Headers;\n        try {\n          mapped = new Headers(input);\n        } catch {\n          // Web Headers errors embed rejected values, including server secrets.\n          // Discard the exception entirely; never retain its message or cause.\n          throw AuthFailures.rejected({\n            status: 401,\n            reason: \"MALFORMED_CREDENTIALS\",\n          });\n        }\n        return withHostMetadata(mapped, ambient);\n      }\n      const credentials = new Headers(ambient);\n      const allow = new Set(\n        (\n          this.options.connectionParamHeaders ?? [\"authorization\", \"cookie\"]\n        ).map((name) => name.toLowerCase()),\n      );\n      for (const [name, value] of Object.entries(details.params ?? {})) {\n        if (!allow.has(name.toLowerCase())) {\n          continue;\n        }\n        if (typeof value !== \"string\" || /[\\r\\n\\0]/.test(value)) {\n          throw AuthFailures.rejected({\n            status: 401,\n            reason: \"MALFORMED_CREDENTIALS\",\n          });\n        }\n        try {\n          credentials.set(name, value);\n        } catch {\n          // One malformed selected credential rejects the whole extraction,\n          // without falling back to another credential or exposing its value.\n          throw AuthFailures.rejected({\n            status: 401,\n            reason: \"MALFORMED_CREDENTIALS\",\n          });\n        }\n      }\n      return credentials;\n    };\n    return {\n      key,\n      invocation: graphqlInvocation(args, this.reference(context)),\n      lineage: this.lineage(context),\n      ...(initial.socket && open\n        ? { connection: initial.socket, principalTtlMs: this.connectionTtlMs }\n        : {}),\n      headers,\n      get clientIp() {\n        const details = checked();\n        return details.socket ? null : kit.http!.clientIp(details.request);\n      },\n      get cookies() {\n        const details = checked();\n        return details.socket\n          ? null\n          : kit.http!.cookieSink(\n              details.request,\n              details.carrier.reply ??\n                record(details.request)?.res ??\n                kit.http!.responseFor?.(details.request),\n            );\n      },\n      get request() {\n        const details = checked();\n        if (!details.socket) {\n          return kit.http!.request(details.request);\n        }\n        return {\n          method: \"GET\",\n          url: open\n            ? upgradeRequestUrl(details.socket)\n            : upgradePathUrl(details.socket),\n        };\n      },\n      param: (name) =>\n        (this.reference(context)\n          ? normalized.root?.[name]\n          : normalized.args?.[name]) ??\n        (!initial.socket && kit.http?.isRequest(initial.request)\n          ? kit.http.param(initial.request, name)\n          : undefined),\n      get browser() {\n        const details = checked();\n        // The origin check reads the handshake of the connection, open or not: its verdict grants\n        // no credential, and neither principal sources nor policies receive the browser leg.\n        return details.socket\n          ? {\n              enforce: true,\n              headers: details.ambient,\n              url: upgradeRequestUrl(details.socket),\n              key: details.socket,\n            }\n          : {\n              enforce: normalized.info?.operation.operation === \"mutation\",\n              headers: () => kit.http!.headers(details.request),\n              url: kit.http!.request(details.request).url,\n              key,\n            };\n      },\n    };\n  }\n\n  toException(failure: AuthFailure): unknown {\n    return new BetterAuthGraphqlDenial(failure);\n  }\n\n  toInternalException(\n    error: BetterAuthInfrastructureError | BetterAuthConfigurationError,\n    _context: ExecutionContext,\n    info: { repeated: boolean },\n  ): unknown {\n    return info.repeated\n      ? new BetterAuthGraphqlRepeatedInternalError(error)\n      : new BetterAuthGraphqlInternalError(error);\n  }\n\n  validate(context: TransportValidationContext): void {\n    const options = context.moduleRef.get<{\n      driver?: object;\n      context?: unknown;\n      fieldResolverEnhancers?: string[];\n    }>(GRAPHQL_MODULE_OPTIONS, { strict: false });\n    const names: string[] = [];\n    for (\n      let driver = options.driver;\n      typeof driver === \"function\";\n      driver = Object.getPrototypeOf(driver)\n    ) {\n      names.push(driver.name);\n    }\n    if (\n      names.some((name) =>\n        name.startsWith(this.id === \"apollo\" ? \"Mercurius\" : \"Apollo\"),\n      )\n    ) {\n      throw new BetterAuthConfigurationError(\n        \"GRAPHQL_DRIVER_MISMATCH\",\n        `${this.id} transport does not match ${names.join(\" / \")}`,\n      );\n    }\n    if (\n      options.context !== undefined &&\n      typeof options.context !== \"function\"\n    ) {\n      throw new BetterAuthConfigurationError(\n        \"GRAPHQL_STATIC_CONTEXT\",\n        \"GraphQL context must be a function returning a fresh object\",\n        \"context: ({ req }) => ({ req, loaders: createLoaders() })\",\n      );\n    }\n    class Probe {\n      query() {}\n      field() {}\n      reference() {}\n    }\n    for (const [name, decorator, key] of [\n      [\"query\", Query(() => String), RESOLVER_TYPE_METADATA],\n      [\"field\", ResolveField(() => String), RESOLVER_PROPERTY_METADATA],\n      [\"reference\", ResolveReference(), RESOLVER_REFERENCE_METADATA],\n    ] as const) {\n      decorator(\n        Probe.prototype,\n        name,\n        Object.getOwnPropertyDescriptor(Probe.prototype, name)!,\n      );\n      if (!Reflect.getMetadata(key, Probe.prototype[name])) {\n        throw new BetterAuthConfigurationError(\n          \"NEST_METADATA_KEY_CHANGED\",\n          `GraphQL metadata canary failed: ${key}`,\n        );\n      }\n    }\n    Args(\"probe\", { type: () => String })(Probe.prototype, \"query\", 0);\n    const argumentMetadata = record(\n      Reflect.getMetadata(PARAM_ARGS_METADATA, Probe, \"query\"),\n    );\n    if (\n      !argumentMetadata ||\n      !Object.entries(argumentMetadata).some(\n        ([key, value]) =>\n          key.startsWith(\"3:\") && record(value)?.data === \"probe\",\n      )\n    ) {\n      throw new BetterAuthConfigurationError(\n        \"NEST_METADATA_KEY_CHANGED\",\n        \"GraphQL argument metadata failed its parameter canary\",\n      );\n    }\n    const guards = options.fieldResolverEnhancers?.includes(\"guards\") === true;\n    const scanner = new MetadataScanner();\n    this.plans = [];\n    for (const wrapper of context.discovery.getProviders()) {\n      const target = wrapper.metatype;\n      if (!target?.prototype || wrapper.isAlias) {\n        continue;\n      }\n      for (const method of scanner.getAllMethodNames(target.prototype)) {\n        const handler = Reflect.get(target.prototype, method);\n        const field =\n          Reflect.getMetadata(RESOLVER_PROPERTY_METADATA, handler) === true;\n        const reference =\n          Reflect.getMetadata(RESOLVER_REFERENCE_METADATA, handler) === true;\n        if (\n          !field &&\n          !reference &&\n          !Reflect.getMetadata(RESOLVER_TYPE_METADATA, handler)\n        ) {\n          continue;\n        }\n        const metadata = record(\n          Reflect.getMetadata(PARAM_ARGS_METADATA, target, method),\n        );\n        const inputs = reference\n          ? []\n          : Object.entries(metadata ?? {}).flatMap(([key, entry]) =>\n              key.startsWith(\"3:\") && typeof record(entry)?.data === \"string\"\n                ? [String(record(entry)!.data)]\n                : [],\n            );\n        context.claim(\n          target,\n          method,\n          field || reference ? (guards ? \"global\" : \"none\") : \"global\",\n          {\n            code: reference\n              ? \"REFERENCE_RESOLVER_UNGUARDED\"\n              : field\n                ? \"FIELD_RESOLVER_UNGUARDED\"\n                : \"GRAPHQL_OPERATION_UNGUARDED\",\n            hint: \"Set fieldResolverEnhancers: ['guards', 'interceptors'], or declare @Public() where appropriate.\",\n            coverage: reference\n              ? this.options.federationCoverage\n              : field\n                ? this.options.fieldResolverCoverage\n                : \"error\",\n            everyHandler: reference,\n            inputs,\n          },\n        );\n        this.plans.push({\n          plan: context.planOf(target, method),\n          field,\n          reference,\n          target,\n          method,\n        });\n      }\n    }\n    const federation =\n      names.some((name) => name.includes(\"Federation\")) ||\n      this.plans.some((entry) => entry.reference);\n    const needsGuards = this.plans.some(\n      (entry) => entry.field || entry.reference,\n    );\n    if (\n      federation &&\n      needsGuards &&\n      !guards &&\n      this.options.federationCoverage !== \"off\"\n    ) {\n      const message =\n        \"Federation field and reference resolvers require fieldResolverEnhancers: ['guards', 'interceptors']; this runs every global guard once per field invocation.\";\n      if (this.options.federationCoverage === \"warn\") {\n        context.logger.warn(`FEDERATION_FIELD_GUARDS_REQUIRED: ${message}`);\n      } else {\n        throw new BetterAuthConfigurationError(\n          \"FEDERATION_FIELD_GUARDS_REQUIRED\",\n          message,\n        );\n      }\n    }\n    if (needsGuards && !options.fieldResolverEnhancers?.includes(\"filters\")) {\n      this.filterAdvice = {\n        level: \"warn\",\n        code: \"W_FIELD_EXCEPTION_FILTERS_DISABLED\",\n        message:\n          \"Nested GraphQL errors bypass Nest exception filters and ERROR logging while fieldResolverEnhancers omits filters.\",\n        hint: \"Include 'filters' with 'guards' in fieldResolverEnhancers to deliver nested authentication errors through Nest's exception pipeline; 'interceptors' enables per-field scopes.\",\n      };\n    }\n    if (needsGuards) {\n      const config = context.moduleRef.get(ApplicationConfig, {\n        strict: false,\n      });\n      const owned = new Set<unknown>([\n        context.moduleRef.get(BetterAuthGuard, { strict: false }),\n        context.moduleRef.get(BetterAuthScopeInterceptor, { strict: false }),\n      ]);\n      const names = [\n        ...config.getGlobalGuards(),\n        ...config.getGlobalInterceptors(),\n      ]\n        .filter(\n          (value) =>\n            !owned.has(value) &&\n            ![\"guard\", \"scope\"].includes(Reflect.get(value, AUTH_ENHANCER)),\n        )\n        .map((value) => value.constructor.name);\n      if (names.length) {\n        this.enhancerAdvice = {\n          level: \"warn\",\n          code: \"W_FIELD_GUARDS_MULTIPLY_GLOBAL_ENHANCERS\",\n          message: `${names.join(\", \")} run once per field-resolver invocation when their corresponding field enhancer is enabled: guards for global guards, interceptors for global interceptors.`,\n          hint: \"Use @SkipThrottle() or equivalent, move global guards to controllers, or use coverage: 'warn' behind an authenticating router.\",\n        };\n      }\n    }\n  }\n\n  advise(context: BootAdviceContext): readonly BootAdvice[] {\n    const advice: BootAdvice[] = [\n      this.enhancerAdvice,\n      this.filterAdvice,\n    ].filter((value): value is BootAdvice => value !== undefined);\n    const entries = this.plans;\n    const publicEntries = entries.filter(\n      ({ plan, field }) =>\n        !field && [\"public\", \"optional\"].includes(plan.access),\n    );\n    const inheriting = entries.filter(({ plan }) => plan.access === \"inherit\");\n    if (publicEntries.length && inheriting.length) {\n      advice.push({\n        level: \"warn\",\n        code: \"W_FIELD_RESOLVER_INHERITS\",\n        message: `${inheriting\n          .map(({ plan }) => plan.site)\n          .slice(0, 20)\n          .join(\n            \", \",\n          )} inherit readings from entry points including ${publicEntries\n          .map(({ plan }) => plan.site)\n          .slice(0, 20)\n          .join(\", \")}.`,\n        hint: \"Use @RequireAuth() and fieldResolverEnhancers: ['guards'] for sensitive fields.\",\n      });\n    }\n    for (const { plan } of inheriting) {\n      if (\n        plan.principalParams.some((param) =>\n          entries.some((entry) =>\n            [...entry.plan.accepts].some((kind) => kind !== param.kind),\n          ),\n        )\n      ) {\n        advice.push({\n          level: \"warn\",\n          code: \"W_NESTED_PRINCIPAL_PARAM\",\n          message: `${plan.site} can inherit a different principal kind from another schema entry point.`,\n          hint: \"Use @CurrentPrincipal() and narrow p.kind, or declare field access and acceptance.\",\n        });\n      }\n    }\n    const targets = new Set(\n      entries.filter(({ field }) => field).map(({ target }) => target),\n    );\n    for (const target of targets) {\n      if (\n        [\n          ACCESS_METADATA,\n          ACCEPT_PRINCIPALS_METADATA,\n          REQUIREMENTS_METADATA,\n        ].some((key) => Reflect.hasMetadata(key, target))\n      ) {\n        advice.push({\n          level: \"info\",\n          code: \"I_CLASS_METADATA_OPERATIONS_ONLY\",\n          message: `Class metadata of ${(target as { name?: string }).name} excludes inherited fields ${entries\n            .filter(\n              (entry) =>\n                entry.target === target && entry.plan.access === \"inherit\",\n            )\n            .map((entry) => entry.method)\n            .join(\", \")}; it applies to operations and reference resolvers ${\n            entries\n              .filter((entry) => entry.target === target && entry.reference)\n              .map((entry) => entry.method)\n              .join(\", \") || \"(none)\"\n          }.`,\n        });\n      }\n    }\n    if (\n      !this.connectionTtlMs &&\n      context.sources.some(\n        (source) => source.effects?.consumesQuota || source.effects?.writes,\n      )\n    ) {\n      advice.push({\n        level: \"warn\",\n        code: \"W_QUOTA_PER_MESSAGE\",\n        message:\n          \"Each socket operation resolves quota-consuming or writing principal sources.\",\n        hint: \"Consider subscriptionPrincipalTtlMs and its revocation delay.\",\n      });\n    }\n    return advice;\n  }\n}\nexport function apolloTransport(\n  options: GraphqlTransportOptions = {},\n): ExtensionRef<AuthTransport> {\n  return new GraphqlTransport(\"apollo\", options);\n}\nexport function mercuriusTransport(\n  options: GraphqlTransportOptions = {},\n): ExtensionRef<AuthTransport> {\n  return new GraphqlTransport(\"mercurius\", options);\n}\n"],"mappings":";;;;;;;;;;AAEA,MAAM,aAAa,OAAO,IAAI,4CAA4C;AAU1E,SAAgB,OACd,OAC0C;CAC1C,OAAO,OAAO,UAAU,YAAY,UAAU,OACzC,QACD,KAAA;AACN;;AAEA,SAAgB,YAAY,MAA0B;CACpD,MAAM,YAAY,KAAK,WAAW;CAClC,OAAO;EACL,MAAM,OAAO,KAAK,EAAE;EACpB,MAAM,YAAY,KAAA,IAAY,OAAO,KAAK,EAAE;EAC5C,SAAS,OAAO,KAAK,YAAY,IAAI,EAAE,KAAK;EAC5C,MAAM,OAAO,KAAK,YAAY,IAAI,EAAE;CACtC;AACF;AAKA,SAAS,eAAe,SAAiB,WAA8B;CACrE,IAAI,aAAa,QAAQ,IAAI,SAAS,UAAU;CAGhD,IAAI,CAAC,YAAY;EACf,6BAAa,IAAI,IAAI;EACrB,OAAO,eAAe,SAAS,YAAY,EAAE,OAAO,WAAW,CAAC;CAClE;CACA,IAAI,QAAQ,WAAW,IAAI,SAAS;CACpC,IAAI,UAAU,KAAA,GAAW;EACvB,QAAQ;GAAE,IAAI,WAAW,OAAO;GAAG,4BAAY,IAAI,IAAI;EAAE;EACzD,WAAW,IAAI,WAAW,KAAK;CACjC;CACA,OAAO;AACT;AACA,SAAS,KAAK,MAA6C;CACzD,OAAO,OAAO,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,GAAG,IAAI,CAAC;AAClD;AACA,SAAS,SAAS,IAAY,MAAgC;CAC5D,OAAO,GAAG,GAAG,GAAG,KAAK,UAAU,KAAK,IAAI,CAAC;AAC3C;AACA,SAAgB,kBACd,MACA,YAAY,OACJ;CACR,MAAM,aAAa,YAAY,IAAI;CACnC,QAAQ,YAAY,WAAW,OAAO,WAAW,SAAS;AAC5D;AACA,SAAgB,eACd,MACA,YAAY,OACO;CACnB,MAAM,aAAa,YAAY,IAAI;CACnC,MAAM,UAAU,WAAW;CAC3B,MAAM,QAAQ,eAAe,SAAS,WAAW,MAAM,aAAa,OAAO;CAC3E,MAAM,EAAE,OAAO;CACf,IAAI,WACF,MAAM,WAAW,IAAI,KAAK,UAAU,KAAK,WAAW,MAAM,IAAI,CAAC,CAAC;CAElE,OAAO;EACL;EACA,UAAU,YACN,GAAG,GAAG,aAAa,OAAO,WAAW,MAAM,cAAc,EAAE,MAC3D,SAAS,IAAI,WAAW,MAAM,IAAI;EACtC,CAAC,UAAU,aAAa;GACtB,MAAM,UAAU,YAAY,WAAW;GACvC,MAAM,YAAY,eAChB,QAAQ,SACR,QAAQ,MAAM,aAAa,QAAQ,OACrC;GACA,MAAM,OAAO,QAAQ,MAAM;GAC3B,KACE,IAAI,QAAQ,MAAM,SAAS,MAAM,MACjC,QACA,QAAQ,QAAQ,SAAS,OAAO,MAChC;IAEA,IACE,OAAO,OAAO,QAAQ,YACtB,OAAO,SACN,OAAO,KAAK,QAAQ,eACnB,UAAU,WAAW,IAAI,KAAK,UAAU,KAAK,OAAO,IAAI,CAAC,CAAC,IAE5D,MAAM,GAAG,UAAU,GAAG,aAAa,OAAO,YAAY,OAAO,QAAQ,MAAM,cAAc,EAAE;IAE7F,MAAM,SAAS,UAAU,IAAI,MAAM;GACrC;EACF;CACF;AACF;;;ACnDA,MAAM,oBAAoB,OAAO,IAC/B,2CACF;AACA,MAAM,oBAAoB,OAAO,IAC/B,2CACF;AAiBA,IAAa,0BAAb,cAA6CA,eAAAA,mBAAmB;CAC9D;CAEA,YAAY,SAAsB;EAChC,MAAM,QAAQ,OAAO;EACrB,KAAK,aAAa;GAChB,MAAM,QAAQ;GACd,YAAY,QAAQ;GACpB,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;EACrD;CACF;AACF;AACA,SAAS,mBACP,OACuB;CACvB,OAAO;EACL,MAAM;EACN,QAAQC,oBAAAA,qBAAqB,KAAK,IAC9B,uBACA;EACJ,YAAY;CACd;AACF;AACA,IAAa,iCAAb,cAAoD,MAAM;CACxD;CAEA,YACE,OACA;EACA,MAAM,yBAAyB,EAAE,OAAO,MAAM,CAAC;EAC/C,KAAK,aAAa,mBAAmB,KAAK;CAC5C;AACF;AACA,IAAa,yCAAb,cAA4DD,eAAAA,mBAAmB;CAC7E;CAEA,YACE,OACA;EACA,MAAM,yBAAyB,EAAE,OAAO,MAAM,CAAC;EAC/C,KAAK,aAAa,mBAAmB,KAAK;CAC5C;AACF;;AAEA,SAAgB,+BAA+B;CAC7C,QACE,aACA,aACsC;GACrC,oBAAoB;GACpB,oBAAoB,eAAe,OAAO;CAC7C;AACF;AAOA,SAAS,QAAQ,OAAqC;CACpD,MAAM,YAAY,OAAO,KAAK;CAC9B,OAAO,aAAa,OAAO,UAAU,OAAO,IACvC,YACD,KAAA;AACN;;AAEA,SAAS,gBACP,OAC0C;CAC1C,MAAM,SAAS,OAAO,OAAO,KAAK,CAAC,EAAE,MAAM;CAC3C,OAAO,UACL,OAAO,OAAO,SAAS,cACvB,OAAO,OAAO,UAAU,aACtB,SACA,KAAA;AACN;;;;;;;;AAQA,SAAS,iBAAiB,OAAqC;CAC7D,OAAO,gBAAgB,KAAK,IAAI,QAAQ,OAAO,KAAK,CAAC,EAAE,OAAO,IAAI,KAAA;AACpE;;AAEA,MAAM,iBAAiB;;AAEvB,MAAM,gBAAgB;CAAC;CAAQ;CAAoB;AAAmB;;;;;;AAMtE,SAAS,eAAe,SAA0B;CAChD,MAAM,SAAS,QAAQ,OAAO;CAC9B,MAAM,MAAM,OAAO,OAAO,MAAM;CAChC,OAAOE,iBAAAA,kBAAkB;EACvB,SAAS,QAAQ;EACjB,KAAK,QAAQ,KAAK,SAAS,OAAO,MAAM,GAAG,GAAG;EAC9C,QAAQ,QAAQ;EAChB,QAAQ,QAAQ;CAClB,CAAC;AACH;;AAEA,SAAS,iBAAiB,MAAe,SAA2B;CAClE,KAAK,MAAM,QAAQ,eAAe;EAChC,MAAM,QAAQ,QAAQ,IAAI,IAAI;EAC9B,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,UAAU,MAC/B,KAAK,IAAI,MAAM,KAAK;CAExB;CACA,OAAO;AACT;;;;;;;AAOA,SAAS,YAAY,MAAiD;CACpE,MAAM,QAAQ,OAAO,IAAI;CACzB,OAAO,OAAO,OAAO,cAAc,KAAK,OAAO,OAAO,SAAS;AACjE;AACA,SAAS,eAAe,SAA2B;CACjD,MAAM,QAAQ,OAAO,OAAO;CAI5B,MAAM,cAHM,OAAO,OAAO,GAAG,KAAK,MAAA,EAGV;CACxB,IAAI,MAAM,QAAQ,UAAU,GAAG;EAC7B,MAAM,UAAU,IAAI,QAAQ;EAC5B,KAAK,IAAI,QAAQ,GAAG,QAAQ,IAAI,WAAW,QAAQ,SAAS,GAC1D,IACE,OAAO,WAAW,WAAW,YAC7B,OAAO,WAAW,QAAQ,OAAO,UAEjC,QAAQ,OAAO,WAAW,QAAQ,WAAW,QAAQ,EAAE;EAG3D,OAAO;CACT;CACA,OAAOC,iBAAAA,aAAc,OAAO,WAAW,CAAC,CAAyB;AACnE;;;;;;AAMA,SAAS,cAAc,MAA4B,OAAyB;CAC1E,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE;CAC/B,IAAI,MAAM,UAAU,OAAO,MAAM,MAC/B,OAAO;CAET,OAAO,KAAK,cAAc,KAAK,YAAY,OAAO,MAAM,QAAQ;AAClE;AACA,SAAS,eACP,SACA,QACA,MACA;CACA,MAAM,UAAU,OAAO,OAAO,KAAK,CAAC;CACpC,MAAM,MAAM,OAAO,QAAQ,GAAG;CAC9B,MAAM,QAAQ,OAAO,QAAQ,KAAK;CAGlC,MAAM,cACJ,WAAW,WACP,MAAM,UAAU,GAAG,MAAM,QACzB,MAAM,UAAU,OAAO,OAAO,MAAM,OACpC,cAAc,MAAM,QAAQ,KAAK;CAIvC,MAAM,YACJ,WAAW,YAAY,CAAC,eAAe,iBAAiB,KAAK,KAAK,IAC9D,MACA,KAAA;CACN,MAAM,UACJ,WAAW,YAAY,CAAC,cACpB,YACE,UAAU,QACV,QACF,KAAA;CACN,MAAM,SAAS,cACX,KAAA,IACA,WAAW,WACT,iBAAiB,OAAO,IACvB,QAAQ,QAAQ,kBAAkB,MAClC,qBAAqB,UACjB,QAAQ,QAAQ,OAAO,KACxB,QAAQ,OAAO,QAAQ,KAAK,CAAC,EAAE,OAAO,KACtC,QAAQ,QAAQ,GAAG,IACnB,KAAA;CACV,MAAM,aAAa,YAAY,MAAM;CACrC,MAAM,SAAS,OACb,YACI,KAAK,mBACJ,QAAQ,oBAAoB,QAAQ,eAC3C;CACA,MAAM,UACJ,WAAW,WACP,QAAQ,MACP,OAAO,QAAQ,KAAK,CAAC,EAAE,WAAW,QAAQ;CACjD,MAAM,gBACJ,QAAQ,8BAA8B,UAClC,IAAI,QAAQ,QAAQ,kBAAkB,IACtC,eAAe,MAAM;CAG3B,OAAO;EAAE;EAAS;EAAQ,WADR,SAAS,gBAAgB,OAAO,IAAI,KAAA;EACjB;EAAY;EAAQ;EAAS;CAAQ;AAC5E;AACA,IAAM,mBAAN,MAAgD;CAiBnC;CACQ;CAjBnB,WAAoB,EAAE,eAAe,MAAM;CAC3C;CACA;CACA,QAMM,CAAC;CACP;CACA;;CAEA,iCAAkC,IAAI,QAAyB;CAE/D,YACE,IACA,SACA;EAFS,KAAA,KAAA;EACQ,KAAA,UAAA;EAEjB,KAAK,kBAAkB,QAAQ,8BAA8B;EAC7D,IAAI,CAAC,OAAO,SAAS,KAAK,eAAe,KAAK,KAAK,kBAAkB,GACnE,MAAM,IAAIC,oBAAAA,6BACR,4BACA,gEACF;CAEJ;CAEA,QAAQ,SAAoC;EAC1C,OAAO,QAAQ,QAAgB,MAAM;CACvC;CAEA,UAAkB,SAAoC;EACpD,OACE,QAAQ,YAAYC,gBAAAA,6BAA6B,QAAQ,WAAW,CAAC,MACrE;CAEJ;CAEA,iBAAiB,QAAgB,QAAuC;EACtE,MAAM,UAAU,QAAQ,IACtB,QAAQ,IAAI,QAAQ,WAAW,KAAK,QACpC,MACF;EACA,OAAO,OAAO,YAAY,cACxB,CAAC,QAAQ,YAAYA,gBAAAA,6BAA6B,OAAO,KACzD,QAAQ,YAAYC,gBAAAA,4BAA4B,OAAO,IACrD,YACA,KAAA;CACN;CAEA,QAAQ,SAA2B;EACjC,MAAM,OAAO,QAAQ,QAAQ;EAC7B,MAAM,aAAa,YAAY,IAAI;EAGnC,KAAK,YACH,eAAe,WAAW,SAAS,KAAK,IAAI,KAAK,KAAK,QAAQ,IAAI,CAAC,CAChE,WACH,WAAW,IACb;EACA,OAAO;GACL,GAAG,eAAe,MAAM,KAAK,UAAU,OAAO,CAAC;GAC/C,iBAAiB,SAA6B;IAC5C,IAAI,KAAK,KACP,KAAK,cAAc,MAAM,KAAK,GAAG;GAErC;EACF;CACF;;;;;;;;;CAUA,YACE,WACA,MACS;EACT,IAAI,CAAC,WACH,OAAO;EAET,MAAM,YAAY,YAAY,IAAI;EAClC,MAAM,QAAQ,YAAY,KAAK,eAAe,IAAI,SAAS,IAAI,KAAA;EAC/D,IAAI,UAAU,KAAA,GACZ,OAAO;EAET,MAAM,OAAO,UAAU,eAAe;EACtC,IAAI,WACF,KAAK,eAAe,IAAI,WAAW,IAAI;EAEzC,OAAO;CACT;CAEA,cAAsB,MAA0B,KAAmB;EAEjE,MAAM,UAAU,eADG,YAAY,IACS,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,IAAI;EACpE,IAAI,QAAQ,QACV,OAAO;EAET,IAAI,CAAC,IAAI,MAAM,UAAU,QAAQ,OAAO,GACtC,MAAMF,oBAAAA,6BAA6B,UACjC,gCACA,iEACA,EACE,MAAM,6HACR,CACF;EAEF,IAAI,CAAC,IAAI,KAAK,OAAO,QAAQ,OAAO,GAClC,MAAMA,oBAAAA,6BAA6B,UACjC,iCACA,gDACA,EACE,MAAM,qFACR,CACF;EAEF,OAAO;CACT;CAEA,SAAS,SAA2B,KAAkC;EACpE,KAAK,MAAM;EACX,MAAM,OAAO,QAAQ,QAAQ;EAC7B,MAAM,aAAa,YAAY,IAAI;EACnC,MAAM,UAAU,eAAe,WAAW,SAAS,KAAK,IAAI,IAAI,IAAI;EAKpE,MAAM,OAAO,KAAK,YAAY,QAAQ,WAAW,WAAW,IAAI;EAChE,MAAM,MACJ,CAAC,QAAQ,UAAU,IAAI,MAAM,UAAU,QAAQ,OAAO,IAClD,IAAI,KAAK,IAAI,QAAQ,OAAO,IAC5B,OACE,WAAW,UACV,YAAY,WAAW,IAAI,KAAK;EACzC,MAAM,gBAAgB,KAAK,cAAc,MAAM,GAAG;EAClD,MAAM,gBAAgB;GACpB,MAAM,UAAU,QAAQ;GACxB,IAAI,CAAC,QAAQ,QACX,OAAO,IAAI,KAAM,QAAQ,QAAQ,OAAO;GAE1C,MAAM,UAAU,QAAQ,QAAQ;GAChC,IAAI,CAAC,MAEH,OAAO,iBAAiB,IAAI,QAAQ,GAAG,OAAO;GAEhD,IAAI,KAAK,QAAQ,yBAAyB;IAGxC,MAAM,QAAQ,KAAK,QAAQ,wBAAwB,QAAQ,UAAU;IACrE,IAAI;IACJ,IAAI;KACF,SAAS,IAAI,QAAQ,KAAK;IAC5B,QAAQ;KAGN,MAAMG,oBAAAA,aAAa,SAAS;MAC1B,QAAQ;MACR,QAAQ;KACV,CAAC;IACH;IACA,OAAO,iBAAiB,QAAQ,OAAO;GACzC;GACA,MAAM,cAAc,IAAI,QAAQ,OAAO;GACvC,MAAM,QAAQ,IAAI,KAEd,KAAK,QAAQ,0BAA0B,CAAC,iBAAiB,QAAQ,EAAA,CACjE,KAAK,SAAS,KAAK,YAAY,CAAC,CACpC;GACA,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,QAAQ,UAAU,CAAC,CAAC,GAAG;IAChE,IAAI,CAAC,MAAM,IAAI,KAAK,YAAY,CAAC,GAC/B;IAEF,IAAI,OAAO,UAAU,YAAY,WAAW,KAAK,KAAK,GACpD,MAAMA,oBAAAA,aAAa,SAAS;KAC1B,QAAQ;KACR,QAAQ;IACV,CAAC;IAEH,IAAI;KACF,YAAY,IAAI,MAAM,KAAK;IAC7B,QAAQ;KAGN,MAAMA,oBAAAA,aAAa,SAAS;MAC1B,QAAQ;MACR,QAAQ;KACV,CAAC;IACH;GACF;GACA,OAAO;EACT;EACA,OAAO;GACL;GACA,YAAY,kBAAkB,MAAM,KAAK,UAAU,OAAO,CAAC;GAC3D,SAAS,KAAK,QAAQ,OAAO;GAC7B,GAAI,QAAQ,UAAU,OAClB;IAAE,YAAY,QAAQ;IAAQ,gBAAgB,KAAK;GAAgB,IACnE,CAAC;GACL;GACA,IAAI,WAAW;IACb,MAAM,UAAU,QAAQ;IACxB,OAAO,QAAQ,SAAS,OAAO,IAAI,KAAM,SAAS,QAAQ,OAAO;GACnE;GACA,IAAI,UAAU;IACZ,MAAM,UAAU,QAAQ;IACxB,OAAO,QAAQ,SACX,OACA,IAAI,KAAM,WACR,QAAQ,SACR,QAAQ,QAAQ,SACd,OAAO,QAAQ,OAAO,CAAC,EAAE,OACzB,IAAI,KAAM,cAAc,QAAQ,OAAO,CAC3C;GACN;GACA,IAAI,UAAU;IACZ,MAAM,UAAU,QAAQ;IACxB,IAAI,CAAC,QAAQ,QACX,OAAO,IAAI,KAAM,QAAQ,QAAQ,OAAO;IAE1C,OAAO;KACL,QAAQ;KACR,KAAK,OACDL,iBAAAA,kBAAkB,QAAQ,MAAM,IAChC,eAAe,QAAQ,MAAM;IACnC;GACF;GACA,QAAQ,UACL,KAAK,UAAU,OAAO,IACnB,WAAW,OAAO,QAClB,WAAW,OAAO,WACrB,CAAC,QAAQ,UAAU,IAAI,MAAM,UAAU,QAAQ,OAAO,IACnD,IAAI,KAAK,MAAM,QAAQ,SAAS,IAAI,IACpC,KAAA;GACN,IAAI,UAAU;IACZ,MAAM,UAAU,QAAQ;IAGxB,OAAO,QAAQ,SACX;KACE,SAAS;KACT,SAAS,QAAQ;KACjB,KAAKA,iBAAAA,kBAAkB,QAAQ,MAAM;KACrC,KAAK,QAAQ;IACf,IACA;KACE,SAAS,WAAW,MAAM,UAAU,cAAc;KAClD,eAAe,IAAI,KAAM,QAAQ,QAAQ,OAAO;KAChD,KAAK,IAAI,KAAM,QAAQ,QAAQ,OAAO,CAAC,CAAC;KACxC;IACF;GACN;EACF;CACF;CAEA,YAAY,SAA+B;EACzC,OAAO,IAAI,wBAAwB,OAAO;CAC5C;CAEA,oBACE,OACA,UACA,MACS;EACT,OAAO,KAAK,WACR,IAAI,uCAAuC,KAAK,IAChD,IAAI,+BAA+B,KAAK;CAC9C;CAEA,SAAS,SAA2C;EAClD,MAAM,UAAU,QAAQ,UAAU,IAI/BM,gBAAAA,wBAAwB,EAAE,QAAQ,MAAM,CAAC;EAC5C,MAAM,QAAkB,CAAC;EACzB,KACE,IAAI,SAAS,QAAQ,QACrB,OAAO,WAAW,YAClB,SAAS,OAAO,eAAe,MAAM,GAErC,MAAM,KAAK,OAAO,IAAI;EAExB,IACE,MAAM,MAAM,SACV,KAAK,WAAW,KAAK,OAAO,WAAW,cAAc,QAAQ,CAC/D,GAEA,MAAM,IAAIJ,oBAAAA,6BACR,2BACA,GAAG,KAAK,GAAG,4BAA4B,MAAM,KAAK,KAAK,GACzD;EAEF,IACE,QAAQ,YAAY,KAAA,KACpB,OAAO,QAAQ,YAAY,YAE3B,MAAM,IAAIA,oBAAAA,6BACR,0BACA,+DACA,2DACF;EAEF,MAAM,MAAM;GACV,QAAQ,CAAC;GACT,QAAQ,CAAC;GACT,YAAY,CAAC;EACf;EACA,KAAK,MAAM,CAAC,MAAM,WAAW,QAAQ;GACnC;IAAC;KAASK,GAAAA,gBAAAA,MAAAA,OAAY,MAAM;IAAGC,gBAAAA;GAAsB;GACrD;IAAC;KAASC,GAAAA,gBAAAA,aAAAA,OAAmB,MAAM;IAAGL,gBAAAA;GAA0B;GAChE;IAAC;KAAaM,GAAAA,gBAAAA,iBAAAA,CAAiB;IAAGP,gBAAAA;GAA2B;EAC/D,GAAY;GACV,UACE,MAAM,WACN,MACA,OAAO,yBAAyB,MAAM,WAAW,IAAI,CACvD;GACA,IAAI,CAAC,QAAQ,YAAY,KAAK,MAAM,UAAU,KAAK,GACjD,MAAM,IAAID,oBAAAA,6BACR,6BACA,mCAAmC,KACrC;EAEJ;EACA,CAAA,GAAA,gBAAA,KAAA,CAAK,SAAS,EAAE,YAAY,OAAO,CAAC,CAAC,CAAC,MAAM,WAAW,SAAS,CAAC;EACjE,MAAM,mBAAmB,OACvB,QAAQ,YAAYS,gBAAAA,qBAAqB,OAAO,OAAO,CACzD;EACA,IACE,CAAC,oBACD,CAAC,OAAO,QAAQ,gBAAgB,CAAC,CAAC,MAC/B,CAAC,KAAK,WACL,IAAI,WAAW,IAAI,KAAK,OAAO,KAAK,CAAC,EAAE,SAAS,OACpD,GAEA,MAAM,IAAIT,oBAAAA,6BACR,6BACA,uDACF;EAEF,MAAM,SAAS,QAAQ,wBAAwB,SAAS,QAAQ,MAAM;EACtE,MAAM,UAAU,IAAIU,aAAAA,gBAAgB;EACpC,KAAK,QAAQ,CAAC;EACd,KAAK,MAAM,WAAW,QAAQ,UAAU,aAAa,GAAG;GACtD,MAAM,SAAS,QAAQ;GACvB,IAAI,CAAC,QAAQ,aAAa,QAAQ,SAChC;GAEF,KAAK,MAAM,UAAU,QAAQ,kBAAkB,OAAO,SAAS,GAAG;IAChE,MAAM,UAAU,QAAQ,IAAI,OAAO,WAAW,MAAM;IACpD,MAAM,QACJ,QAAQ,YAAYR,gBAAAA,4BAA4B,OAAO,MAAM;IAC/D,MAAM,YACJ,QAAQ,YAAYD,gBAAAA,6BAA6B,OAAO,MAAM;IAChE,IACE,CAAC,SACD,CAAC,aACD,CAAC,QAAQ,YAAYK,gBAAAA,wBAAwB,OAAO,GAEpD;IAEF,MAAM,WAAW,OACf,QAAQ,YAAYG,gBAAAA,qBAAqB,QAAQ,MAAM,CACzD;IACA,MAAM,SAAS,YACX,CAAC,IACD,OAAO,QAAQ,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,WAC5C,IAAI,WAAW,IAAI,KAAK,OAAO,OAAO,KAAK,CAAC,EAAE,SAAS,WACnD,CAAC,OAAO,OAAO,KAAK,CAAC,CAAE,IAAI,CAAC,IAC5B,CAAC,CACP;IACJ,QAAQ,MACN,QACA,QACA,SAAS,YAAa,SAAS,WAAW,SAAU,UACpD;KACE,MAAM,YACF,iCACA,QACE,6BACA;KACN,MAAM;KACN,UAAU,YACN,KAAK,QAAQ,qBACb,QACE,KAAK,QAAQ,wBACb;KACN,cAAc;KACd;IACF,CACF;IACA,KAAK,MAAM,KAAK;KACd,MAAM,QAAQ,OAAO,QAAQ,MAAM;KACnC;KACA;KACA;KACA;IACF,CAAC;GACH;EACF;EACA,MAAM,aACJ,MAAM,MAAM,SAAS,KAAK,SAAS,YAAY,CAAC,KAChD,KAAK,MAAM,MAAM,UAAU,MAAM,SAAS;EAC5C,MAAM,cAAc,KAAK,MAAM,MAC5B,UAAU,MAAM,SAAS,MAAM,SAClC;EACA,IACE,cACA,eACA,CAAC,UACD,KAAK,QAAQ,uBAAuB,OACpC;GACA,MAAM,UACJ;GACF,IAAI,KAAK,QAAQ,uBAAuB,QACtC,QAAQ,OAAO,KAAK,qCAAqC,SAAS;QAElE,MAAM,IAAIT,oBAAAA,6BACR,oCACA,OACF;EAEJ;EACA,IAAI,eAAe,CAAC,QAAQ,wBAAwB,SAAS,SAAS,GACpE,KAAK,eAAe;GAClB,OAAO;GACP,MAAM;GACN,SACE;GACF,MAAM;EACR;EAEF,IAAI,aAAa;GACf,MAAM,SAAS,QAAQ,UAAU,IAAIW,aAAAA,mBAAmB,EACtD,QAAQ,MACV,CAAC;GACD,MAAM,wBAAQ,IAAI,IAAa,CAC7B,QAAQ,UAAU,IAAIC,mBAAAA,iBAAiB,EAAE,QAAQ,MAAM,CAAC,GACxD,QAAQ,UAAU,IAAIC,+BAAAA,4BAA4B,EAAE,QAAQ,MAAM,CAAC,CACrE,CAAC;GACD,MAAM,QAAQ,CACZ,GAAG,OAAO,gBAAgB,GAC1B,GAAG,OAAO,sBAAsB,CAClC,CAAC,CACE,QACE,UACC,CAAC,MAAM,IAAI,KAAK,KAChB,CAAC,CAAC,SAAS,OAAO,CAAC,CAAC,SAAS,QAAQ,IAAI,OAAOC,iBAAAA,aAAa,CAAC,CAClE,CAAC,CACA,KAAK,UAAU,MAAM,YAAY,IAAI;GACxC,IAAI,MAAM,QACR,KAAK,iBAAiB;IACpB,OAAO;IACP,MAAM;IACN,SAAS,GAAG,MAAM,KAAK,IAAI,EAAE;IAC7B,MAAM;GACR;EAEJ;CACF;CAEA,OAAO,SAAmD;EACxD,MAAM,SAAuB,CAC3B,KAAK,gBACL,KAAK,YACP,CAAC,CAAC,QAAQ,UAA+B,UAAU,KAAA,CAAS;EAC5D,MAAM,UAAU,KAAK;EACrB,MAAM,gBAAgB,QAAQ,QAC3B,EAAE,MAAM,YACP,CAAC,SAAS,CAAC,UAAU,UAAU,CAAC,CAAC,SAAS,KAAK,MAAM,CACzD;EACA,MAAM,aAAa,QAAQ,QAAQ,EAAE,WAAW,KAAK,WAAW,SAAS;EACzE,IAAI,cAAc,UAAU,WAAW,QACrC,OAAO,KAAK;GACV,OAAO;GACP,MAAM;GACN,SAAS,GAAG,WACT,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC,CAC5B,MAAM,GAAG,EAAE,CAAC,CACZ,KACC,IACF,EAAE,gDAAgD,cACjD,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC,CAC5B,MAAM,GAAG,EAAE,CAAC,CACZ,KAAK,IAAI,EAAE;GACd,MAAM;EACR,CAAC;EAEH,KAAK,MAAM,EAAE,UAAU,YACrB,IACE,KAAK,gBAAgB,MAAM,UACzB,QAAQ,MAAM,UACZ,CAAC,GAAG,MAAM,KAAK,OAAO,CAAC,CAAC,MAAM,SAAS,SAAS,MAAM,IAAI,CAC5D,CACF,GAEA,OAAO,KAAK;GACV,OAAO;GACP,MAAM;GACN,SAAS,GAAG,KAAK,KAAK;GACtB,MAAM;EACR,CAAC;EAGL,MAAM,UAAU,IAAI,IAClB,QAAQ,QAAQ,EAAE,YAAY,KAAK,CAAC,CAAC,KAAK,EAAE,aAAa,MAAM,CACjE;EACA,KAAK,MAAM,UAAU,SACnB,IACE;GACEC,iBAAAA;GACAC,iBAAAA;GACAC,iBAAAA;EACF,CAAC,CAAC,MAAM,QAAQ,QAAQ,YAAY,KAAK,MAAM,CAAC,GAEhD,OAAO,KAAK;GACV,OAAO;GACP,MAAM;GACN,SAAS,qBAAsB,OAA6B,KAAK,6BAA6B,QAC3F,QACE,UACC,MAAM,WAAW,UAAU,MAAM,KAAK,WAAW,SACrD,CAAC,CACA,KAAK,UAAU,MAAM,MAAM,CAAC,CAC5B,KAAK,IAAI,EAAE,qDACZ,QACG,QAAQ,UAAU,MAAM,WAAW,UAAU,MAAM,SAAS,CAAC,CAC7D,KAAK,UAAU,MAAM,MAAM,CAAC,CAC5B,KAAK,IAAI,KAAK,SAClB;EACH,CAAC;EAGL,IACE,CAAC,KAAK,mBACN,QAAQ,QAAQ,MACb,WAAW,OAAO,SAAS,iBAAiB,OAAO,SAAS,MAC/D,GAEA,OAAO,KAAK;GACV,OAAO;GACP,MAAM;GACN,SACE;GACF,MAAM;EACR,CAAC;EAEH,OAAO;CACT;AACF;AACA,SAAgB,gBACd,UAAmC,CAAC,GACP;CAC7B,OAAO,IAAI,iBAAiB,UAAU,OAAO;AAC/C;AACA,SAAgB,mBACd,UAAmC,CAAC,GACP;CAC7B,OAAO,IAAI,iBAAiB,aAAa,OAAO;AAClD"}
+{"version":3,"file":"graphql.cjs","names":["IntrinsicException","isConfigurationError","upgradeRequestUrl","toWebHeaders","BetterAuthConfigurationError","RESOLVER_REFERENCE_METADATA","RESOLVER_PROPERTY_METADATA","AuthFailures","GRAPHQL_MODULE_OPTIONS","Query","RESOLVER_TYPE_METADATA","ResolveField","ResolveReference","PARAM_ARGS_METADATA","MetadataScanner","ApplicationConfig","BetterAuthGuard","BetterAuthScopeInterceptor","AUTH_ENHANCER","ACCESS_METADATA","ACCEPT_PRINCIPALS_METADATA","REQUIREMENTS_METADATA"],"sources":["../src/graphql-lineage.ts","../src/graphql-transport.ts"],"sourcesContent":["import type { InvocationLineage } from \"./auth-contracts.js\";\n\nconst OPERATIONS = Symbol.for(\"@nestjs-kit/better-auth:graphql-operations\");\ninterface Path {\n  readonly key: string | number;\n  readonly prev?: Path;\n  readonly typename?: string;\n}\nexport interface GraphInfo {\n  readonly operation: object & { operation?: string };\n  readonly path: Path;\n}\nexport function record(\n  value: unknown,\n): Record<PropertyKey, unknown> | undefined {\n  return typeof value === \"object\" && value !== null\n    ? (value as Record<PropertyKey, unknown>)\n    : undefined;\n}\n/** Apollo reference resolvers omit the argument object; parameter readers see the original array. */\nexport function graphqlArgs(args: readonly unknown[]) {\n  const reference = args.length === 3;\n  return {\n    root: record(args[0]),\n    args: reference ? undefined : record(args[1]),\n    context: record(args[reference ? 1 : 2]) ?? args,\n    info: record(args[reference ? 2 : 3]) as unknown as GraphInfo | undefined,\n  };\n}\ninterface Operation {\n  id: number;\n  references: Set<string>;\n}\nfunction operationState(carrier: object, operation: object): Operation {\n  let operations = Reflect.get(carrier, OPERATIONS) as\n    | Map<object, Operation>\n    | undefined;\n  if (!operations) {\n    operations = new Map();\n    Object.defineProperty(carrier, OPERATIONS, { value: operations });\n  }\n  let state = operations.get(operation);\n  if (state === undefined) {\n    state = { id: operations.size + 1, references: new Set() };\n    operations.set(operation, state);\n  }\n  return state;\n}\nfunction keys(path: Path | undefined): (string | number)[] {\n  return path ? [...keys(path.prev), path.key] : [];\n}\nfunction position(id: number, path: Path | undefined): string {\n  return `${id}:${JSON.stringify(keys(path))}`;\n}\nexport function graphqlInvocation(\n  args: readonly unknown[],\n  reference = false,\n): object {\n  const normalized = graphqlArgs(args);\n  return (reference ? normalized.root : normalized.info) ?? args;\n}\nexport function graphqlLineage(\n  args: readonly unknown[],\n  reference = false,\n): InvocationLineage {\n  const normalized = graphqlArgs(args);\n  const carrier = normalized.context;\n  const state = operationState(carrier, normalized.info?.operation ?? carrier);\n  const { id } = state;\n  if (reference) {\n    state.references.add(JSON.stringify(keys(normalized.info?.path)));\n  }\n  return {\n    carrier,\n    position: reference\n      ? `${id}:_entities#${String(normalized.root?.__typename ?? \"\")}`\n      : position(id, normalized.info?.path),\n    *enclosing(currentArgs) {\n      const current = graphqlArgs(currentArgs);\n      const operation = operationState(\n        current.context,\n        current.info?.operation ?? current.context,\n      );\n      const path = current.info?.path;\n      for (\n        let child = path, parent = path?.prev;\n        parent;\n        child = parent, parent = parent.prev\n      ) {\n        // The child path supplies the concrete entity type below the list index.\n        if (\n          typeof parent.key === \"number\" &&\n          parent.prev &&\n          (parent.prev.key === \"_entities\" ||\n            operation.references.has(JSON.stringify(keys(parent.prev))))\n        ) {\n          yield `${operation.id}:_entities#${child?.typename ?? String(current.root?.__typename ?? \"\")}`;\n        }\n        yield position(operation.id, parent);\n      }\n    },\n  };\n}\n","import type { IncomingHttpHeaders } from \"node:http\";\nimport { type ExecutionContext, IntrinsicException } from \"@nestjs/common\";\nimport { ApplicationConfig, MetadataScanner } from \"@nestjs/core\";\nimport {\n  Args,\n  GRAPHQL_MODULE_OPTIONS,\n  PARAM_ARGS_METADATA,\n  RESOLVER_PROPERTY_METADATA,\n  RESOLVER_REFERENCE_METADATA,\n  RESOLVER_TYPE_METADATA,\n  Query,\n  ResolveField,\n  ResolveReference,\n} from \"@nestjs/graphql\";\nimport type {\n  AuthTransport,\n  BootAdvice,\n  BootAdviceContext,\n  ExtensionRef,\n  RoutePlan,\n  TransportCall,\n  TransportKit,\n  TransportValidationContext,\n} from \"./auth-contracts.js\";\nimport {\n  BetterAuthConfigurationError,\n  AuthFailures,\n  isConfigurationError,\n} from \"./auth-errors.js\";\nimport type {\n  AuthFailure,\n  AuthGraphqlExtensions,\n  BetterAuthInfrastructureError,\n} from \"./auth-errors.js\";\nimport { BetterAuthGuard } from \"./auth-guard.js\";\nimport { BetterAuthScopeInterceptor } from \"./auth-scope-interceptor.js\";\nimport {\n  AUTH_ENHANCER,\n  ACCESS_METADATA,\n  ACCEPT_PRINCIPALS_METADATA,\n  REQUIREMENTS_METADATA,\n} from \"./auth-tokens.js\";\nimport {\n  type GraphInfo,\n  graphqlArgs,\n  graphqlInvocation,\n  graphqlLineage,\n  record,\n} from \"./graphql-lineage.js\";\nimport { toWebHeaders, upgradeRequestUrl } from \"./platform.js\";\n\nconst MERCURIUS_AMBIENT = Symbol.for(\n  \"@nestjs-kit/better-auth:mercurius-ambient\",\n);\nconst MERCURIUS_UPGRADE = Symbol.for(\n  \"@nestjs-kit/better-auth:mercurius-upgrade\",\n);\nexport interface GraphqlTransportOptions {\n  /** Case-insensitive connection-init credential keys; defaults to authorization and cookie. */\n  connectionParamHeaders?: readonly string[];\n  /**\n   * Replaces socket credentials, preserving absent host and forwarded-host/proto headers.\n   * Returning undefined presents no credentials: neither connectionParamHeaders nor the\n   * upgrade request's credential headers are used.\n   */\n  subscriptionCredentials?: (\n    connectionContext: unknown,\n  ) => HeadersInit | undefined;\n  /** Connection principal reuse; zero by default. Authoritative plans bypass the TTL. */\n  subscriptionPrincipalTtlMs?: number;\n  fieldResolverCoverage?: \"error\" | \"warn\" | \"off\";\n  federationCoverage?: \"error\" | \"warn\" | \"off\";\n}\nexport class BetterAuthGraphqlDenial extends IntrinsicException {\n  readonly extensions: AuthGraphqlExtensions;\n\n  constructor(failure: AuthFailure) {\n    super(failure.message);\n    this.extensions = {\n      code: failure.code,\n      statusCode: failure.status,\n      ...(failure.reason ? { reason: failure.reason } : {}),\n    };\n  }\n}\nfunction internalExtensions(\n  error: BetterAuthInfrastructureError | BetterAuthConfigurationError,\n): AuthGraphqlExtensions {\n  return {\n    code: \"INTERNAL_SERVER_ERROR\",\n    reason: isConfigurationError(error)\n      ? \"AUTH_MISCONFIGURED\"\n      : \"AUTH_UNAVAILABLE\",\n    statusCode: 500,\n  };\n}\nexport class BetterAuthGraphqlInternalError extends Error {\n  readonly extensions: AuthGraphqlExtensions;\n\n  constructor(\n    error: BetterAuthInfrastructureError | BetterAuthConfigurationError,\n  ) {\n    super(\"Internal server error\", { cause: error });\n    this.extensions = internalExtensions(error);\n  }\n}\nexport class BetterAuthGraphqlRepeatedInternalError extends IntrinsicException {\n  readonly extensions: AuthGraphqlExtensions;\n\n  constructor(\n    error: BetterAuthInfrastructureError | BetterAuthConfigurationError,\n  ) {\n    super(\"Internal server error\", { cause: error });\n    this.extensions = internalExtensions(error);\n  }\n}\n/** Keeps the upgrade request and its original browser headers across Mercurius operation spreads. */\nexport function mercuriusSubscriptionContext() {\n  return (\n    _connection: unknown,\n    request: { headers: Record<string, unknown> },\n  ): Record<string | symbol, unknown> => ({\n    [MERCURIUS_UPGRADE]: request,\n    [MERCURIUS_AMBIENT]: ambientHeaders(request),\n  });\n}\ninterface Upgrade {\n  headers: IncomingHttpHeaders;\n  url?: string;\n  secure?: boolean;\n  socket?: { encrypted?: boolean };\n}\nfunction upgrade(value: unknown): Upgrade | undefined {\n  const candidate = record(value);\n  return candidate && record(candidate.headers)\n    ? (candidate as unknown as Upgrade)\n    : undefined;\n}\n/** The WebSocket of a graphql-ws `extra` ({ socket, request }): a socket with function-typed send and close. */\nfunction graphqlWsSocket(\n  value: unknown,\n): Record<PropertyKey, unknown> | undefined {\n  const socket = record(record(value)?.socket);\n  return socket &&\n    typeof socket.send === \"function\" &&\n    typeof socket.close === \"function\"\n    ? socket\n    : undefined;\n}\n/**\n * The upgrade request of a graphql-ws `extra` ({ socket, request }) whose socket is a\n * WebSocket. Only the graphql-ws server creates that pair; parsed request data cannot carry\n * functions, so a client-sent header or field never selects the socket path. The socket's\n * state does not change this recognition: the transport classifies it once per operation\n * (GraphqlTransport.openAtStart).\n */\nfunction graphqlWsUpgrade(value: unknown): Upgrade | undefined {\n  return graphqlWsSocket(value) ? upgrade(record(value)?.request) : undefined;\n}\n/** WebSocket.OPEN of the `ws` sockets that Nest's graphql-ws server creates. */\nconst WEBSOCKET_OPEN = 1;\n/** Upgrade-request headers that locate the server for Better Auth; none of them is a credential. */\nconst HOST_METADATA = [\"host\", \"x-forwarded-host\", \"x-forwarded-proto\"];\n/**\n * The upgrade request's URL without the target's query string and fragment. A query string can\n * carry a connection's credential (`?access_token=`), which an operation that reads no credential\n * of its connection must not expose to principal sources or policies.\n */\nfunction upgradePathUrl(request: Upgrade): string {\n  const target = request.url ?? \"/\";\n  const end = target.search(/[?#]/);\n  return upgradeRequestUrl({\n    headers: request.headers,\n    url: end === -1 ? target : target.slice(0, end),\n    secure: request.secure,\n    socket: request.socket,\n  });\n}\n/** Copies the host metadata of `ambient` into `into` where `into` has none of its own. */\nfunction withHostMetadata(into: Headers, ambient: Headers): Headers {\n  for (const name of HOST_METADATA) {\n    const value = ambient.get(name);\n    if (!into.has(name) && value !== null) {\n      into.set(name, value);\n    }\n  }\n  return into;\n}\n/**\n * The identity of one GraphQL execution, shared by every resolver of that execution. graphql-js\n * coerces the variable values into a fresh object for every execution, including one\n * subscription and its events; a parsed operation can be cached across executions, so it\n * serves only as the fallback.\n */\nfunction executionOf(info: GraphInfo | undefined): object | undefined {\n  const value = record(info);\n  return record(value?.variableValues) ?? record(value?.operation);\n}\nfunction ambientHeaders(request: unknown): Headers {\n  const value = record(request);\n  const raw = record(value?.raw) ?? value;\n  // Mercurius copies connection-init values into missing request.headers keys.\n  // Node rawHeaders retains the actual browser leg even after that mutation.\n  const rawHeaders = raw?.rawHeaders;\n  if (Array.isArray(rawHeaders)) {\n    const headers = new Headers();\n    for (let index = 0; index + 1 < rawHeaders.length; index += 2) {\n      if (\n        typeof rawHeaders[index] === \"string\" &&\n        typeof rawHeaders[index + 1] === \"string\"\n      ) {\n        headers.append(rawHeaders[index], rawHeaders[index + 1]);\n      }\n    }\n    return headers;\n  }\n  return toWebHeaders((value?.headers ?? {}) as IncomingHttpHeaders);\n}\n/**\n * Mercurius assigns the route's Fastify reply to context.reply for HTTP operations. Its\n * subscription contexts carry the platform-recognized upgrade request inside a plain reply\n * object instead, so the reply's identity, not the request alone, marks an HTTP operation.\n */\nfunction platformReply(http: TransportKit[\"http\"], value: unknown): boolean {\n  const request = record(value)?.request;\n  if (http?.isRequest(request) !== true) {\n    return false;\n  }\n  return http.responseFor ? http.responseFor(request) === value : true;\n}\nfunction carrierDetails(\n  context: unknown,\n  driver: \"apollo\" | \"mercurius\",\n  http: TransportKit[\"http\"],\n) {\n  const carrier = record(context) ?? {};\n  const req = record(carrier.req);\n  const extra = record(carrier.extra);\n  // A positive platform answer keeps the HTTP path and its liveness check, before any socket\n  // heuristic: a custom context can spread client data such as _connectionInit into its root.\n  const httpRequest =\n    driver === \"apollo\"\n      ? http?.isRequest(req) === true ||\n        http?.isRequest(extra?.request) === true\n      : platformReply(http, carrier.reply);\n  // Nest assigns the graphql-ws Context to context.req unless a custom context sets req. Its\n  // server-created extra identifies it: graphql-ws sets connectionParams only for an object\n  // connection_init payload, and an absent payload presents no connection credentials.\n  const wsContext =\n    driver === \"apollo\" && !httpRequest && graphqlWsUpgrade(req?.extra)\n      ? req\n      : undefined;\n  const wsExtra =\n    driver === \"apollo\" && !httpRequest\n      ? wsContext\n        ? wsContext.extra\n        : extra\n      : undefined;\n  const socket = httpRequest\n    ? undefined\n    : driver === \"apollo\"\n      ? graphqlWsUpgrade(wsExtra)\n      : (upgrade(carrier[MERCURIUS_UPGRADE]) ??\n        (\"_connectionInit\" in carrier\n          ? (upgrade(carrier.request) ??\n            upgrade(record(carrier.reply)?.request) ??\n            upgrade(carrier.req))\n          : undefined));\n  const connection = wsContext ? req : carrier;\n  const params = record(\n    wsContext\n      ? req?.connectionParams\n      : (carrier.connectionParams ?? carrier._connectionInit),\n  );\n  const request =\n    driver === \"apollo\"\n      ? carrier.req\n      : (record(carrier.reply)?.request ?? carrier.req);\n  const ambient = () =>\n    carrier[MERCURIUS_AMBIENT] instanceof Headers\n      ? new Headers(carrier[MERCURIUS_AMBIENT])\n      : ambientHeaders(socket);\n  // Mercurius socket contexts carry no graphql-ws extra: its subscription context is per connection.\n  const webSocket = socket ? graphqlWsSocket(wsExtra) : undefined;\n  return { carrier, socket, webSocket, connection, params, request, ambient };\n}\nclass GraphqlTransport implements AuthTransport {\n  readonly requires = { hostlessCalls: false };\n  readonly connectionTtlMs: number;\n  private kit?: TransportKit;\n  private plans: {\n    plan: RoutePlan;\n    field: boolean;\n    reference: boolean;\n    target: object;\n    method: string;\n  }[] = [];\n  private enhancerAdvice?: BootAdvice;\n  private filterAdvice?: BootAdvice;\n  /** Whether each execution's graphql-ws socket was open when the execution first reached the transport. */\n  private readonly socketsAtStart = new WeakMap<object, boolean>();\n\n  constructor(\n    readonly id: \"apollo\" | \"mercurius\",\n    private readonly options: GraphqlTransportOptions,\n  ) {\n    this.connectionTtlMs = options.subscriptionPrincipalTtlMs ?? 0;\n    if (!Number.isFinite(this.connectionTtlMs) || this.connectionTtlMs < 0) {\n      throw new BetterAuthConfigurationError(\n        \"INVALID_SUBSCRIPTION_TTL\",\n        \"subscriptionPrincipalTtlMs must be a finite nonnegative number\",\n      );\n    }\n  }\n\n  handles(context: ExecutionContext): boolean {\n    return context.getType<string>() === \"graphql\";\n  }\n\n  private reference(context: ExecutionContext): boolean {\n    return (\n      Reflect.getMetadata(RESOLVER_REFERENCE_METADATA, context.getHandler()) ===\n      true\n    );\n  }\n\n  defaultAccessFor(target: object, method: string): \"inherit\" | undefined {\n    const handler = Reflect.get(\n      Reflect.get(target, \"prototype\") ?? target,\n      method,\n    );\n    return typeof handler === \"function\" &&\n      !Reflect.getMetadata(RESOLVER_REFERENCE_METADATA, handler) &&\n      Reflect.getMetadata(RESOLVER_PROPERTY_METADATA, handler)\n      ? \"inherit\"\n      : undefined;\n  }\n\n  lineage(context: ExecutionContext) {\n    const args = context.getArgs();\n    const normalized = graphqlArgs(args);\n    // A public root reaches the transport through its lineage alone, so an operation can start\n    // here: its socket's classification then holds for the guarded fields nested in it.\n    this.openAtStart(\n      carrierDetails(normalized.context, this.id, this.kit?.http ?? null)\n        .webSocket,\n      normalized.info,\n    );\n    return {\n      ...graphqlLineage(args, this.reference(context)),\n      assertReadable: (args: readonly unknown[]) => {\n        if (this.kit) {\n          this.assertRequest(args, this.kit);\n        }\n      },\n    };\n  }\n\n  /**\n   * Whether the operation's graphql-ws socket was open when the operation started. The first\n   * classification of an execution holds for every later reader of it, so a connection that\n   * closes during authentication keeps its credentials. A socket that is not open when an\n   * operation starts belongs either to a connection that closed while graphql-ws prepared the\n   * operation or to an earlier connection that a cached context carries; its state cannot tell\n   * the two apart, so the operation reads no credential of that connection in either case.\n   */\n  private openAtStart(\n    webSocket: Record<PropertyKey, unknown> | undefined,\n    info: GraphInfo | undefined,\n  ): boolean {\n    if (!webSocket) {\n      return true;\n    }\n    const execution = executionOf(info);\n    const known = execution ? this.socketsAtStart.get(execution) : undefined;\n    if (known !== undefined) {\n      return known;\n    }\n    const open = webSocket.readyState === WEBSOCKET_OPEN;\n    if (execution) {\n      this.socketsAtStart.set(execution, open);\n    }\n    return open;\n  }\n\n  private assertRequest(args: readonly unknown[], kit: TransportKit) {\n    const normalized = graphqlArgs(args);\n    const details = carrierDetails(normalized.context, this.id, kit.http);\n    if (details.socket) {\n      return details;\n    }\n    if (!kit.http?.isRequest(details.request)) {\n      throw BetterAuthConfigurationError.atRequest(\n        \"GRAPHQL_CONTEXT_UNRECOGNIZED\",\n        \"GraphQL context has no recognized platform or upgrade request\",\n        {\n          hint: \"Keep the native request at context.req or context.extra.request; use mercuriusSubscriptionContext() for Mercurius sockets.\",\n        },\n      );\n    }\n    if (!kit.http.isLive(details.request)) {\n      throw BetterAuthConfigurationError.atRequest(\n        \"GRAPHQL_CONTEXT_STALE_REQUEST\",\n        \"GraphQL context contains a completed request\",\n        {\n          hint: \"Return a fresh context object for every operation and every graphql-ws connection.\",\n        },\n      );\n    }\n    return details;\n  }\n\n  describe(context: ExecutionContext, kit: TransportKit): TransportCall {\n    this.kit = kit;\n    const args = context.getArgs();\n    const normalized = graphqlArgs(args);\n    const initial = carrierDetails(normalized.context, this.id, kit.http);\n    // Classified here, at the start of the operation. The operation of a socket that is not open\n    // runs without that connection's credentials: it keeps no key or connection of the context,\n    // so no memoized or connection principal answers it, its headers carry host metadata only,\n    // and its request URL carries the upgrade request's path without the query string.\n    const open = this.openAtStart(initial.webSocket, normalized.info);\n    const key =\n      !initial.socket && kit.http?.isRequest(initial.request)\n        ? kit.http.key(initial.request)\n        : open\n          ? normalized.context\n          : (executionOf(normalized.info) ?? args);\n    const checked = () => this.assertRequest(args, kit);\n    const headers = () => {\n      const details = checked();\n      if (!details.socket) {\n        return kit.http!.headers(details.request);\n      }\n      const ambient = details.ambient();\n      if (!open) {\n        // Neither the upgrade request's credentials nor the connection's client data are read.\n        return withHostMetadata(new Headers(), ambient);\n      }\n      if (this.options.subscriptionCredentials) {\n        // Keep callback errors outside the conversion boundary: application\n        // programming failures are not malformed credential denials.\n        const input = this.options.subscriptionCredentials(details.connection);\n        let mapped: Headers;\n        try {\n          mapped = new Headers(input);\n        } catch {\n          // Web Headers errors embed rejected values, including server secrets.\n          // Discard the exception entirely; never retain its message or cause.\n          throw AuthFailures.rejected({\n            status: 401,\n            reason: \"MALFORMED_CREDENTIALS\",\n          });\n        }\n        return withHostMetadata(mapped, ambient);\n      }\n      const credentials = new Headers(ambient);\n      const allow = new Set(\n        (\n          this.options.connectionParamHeaders ?? [\"authorization\", \"cookie\"]\n        ).map((name) => name.toLowerCase()),\n      );\n      for (const [name, value] of Object.entries(details.params ?? {})) {\n        if (!allow.has(name.toLowerCase())) {\n          continue;\n        }\n        if (typeof value !== \"string\" || /[\\r\\n\\0]/.test(value)) {\n          throw AuthFailures.rejected({\n            status: 401,\n            reason: \"MALFORMED_CREDENTIALS\",\n          });\n        }\n        try {\n          credentials.set(name, value);\n        } catch {\n          // One malformed selected credential rejects the whole extraction,\n          // without falling back to another credential or exposing its value.\n          throw AuthFailures.rejected({\n            status: 401,\n            reason: \"MALFORMED_CREDENTIALS\",\n          });\n        }\n      }\n      return credentials;\n    };\n    return {\n      key,\n      invocation: graphqlInvocation(args, this.reference(context)),\n      lineage: this.lineage(context),\n      ...(initial.socket && open\n        ? { connection: initial.socket, principalTtlMs: this.connectionTtlMs }\n        : {}),\n      headers,\n      get clientIp() {\n        const details = checked();\n        return details.socket ? null : kit.http!.clientIp(details.request);\n      },\n      get cookies() {\n        const details = checked();\n        return details.socket\n          ? null\n          : kit.http!.cookieSink(\n              details.request,\n              details.carrier.reply ??\n                record(details.request)?.res ??\n                kit.http!.responseFor?.(details.request),\n            );\n      },\n      get request() {\n        const details = checked();\n        if (!details.socket) {\n          return kit.http!.request(details.request);\n        }\n        return {\n          method: \"GET\",\n          url: open\n            ? upgradeRequestUrl(details.socket)\n            : upgradePathUrl(details.socket),\n        };\n      },\n      param: (name) =>\n        (this.reference(context)\n          ? normalized.root?.[name]\n          : normalized.args?.[name]) ??\n        (!initial.socket && kit.http?.isRequest(initial.request)\n          ? kit.http.param(initial.request, name)\n          : undefined),\n      get browser() {\n        const details = checked();\n        // The origin check reads the handshake of the connection, open or not: its verdict grants\n        // no credential, and neither principal sources nor policies receive the browser leg.\n        return details.socket\n          ? {\n              enforce: true,\n              headers: details.ambient,\n              url: upgradeRequestUrl(details.socket),\n              key: details.socket,\n            }\n          : {\n              enforce: normalized.info?.operation.operation === \"mutation\",\n              headers: () => kit.http!.headers(details.request),\n              url: kit.http!.request(details.request).url,\n              key,\n            };\n      },\n    };\n  }\n\n  toException(failure: AuthFailure): unknown {\n    return new BetterAuthGraphqlDenial(failure);\n  }\n\n  toInternalException(\n    error: BetterAuthInfrastructureError | BetterAuthConfigurationError,\n    _context: ExecutionContext,\n    info: { repeated: boolean },\n  ): unknown {\n    return info.repeated\n      ? new BetterAuthGraphqlRepeatedInternalError(error)\n      : new BetterAuthGraphqlInternalError(error);\n  }\n\n  validate(context: TransportValidationContext): void {\n    const options = context.moduleRef.get<{\n      driver?: object;\n      context?: unknown;\n      fieldResolverEnhancers?: string[];\n    }>(GRAPHQL_MODULE_OPTIONS, { strict: false });\n    const names: string[] = [];\n    for (\n      let driver = options.driver;\n      typeof driver === \"function\";\n      driver = Object.getPrototypeOf(driver)\n    ) {\n      names.push(driver.name);\n    }\n    if (\n      names.some((name) =>\n        name.startsWith(this.id === \"apollo\" ? \"Mercurius\" : \"Apollo\"),\n      )\n    ) {\n      throw new BetterAuthConfigurationError(\n        \"GRAPHQL_DRIVER_MISMATCH\",\n        `${this.id} transport does not match ${names.join(\" / \")}`,\n      );\n    }\n    if (\n      options.context !== undefined &&\n      typeof options.context !== \"function\"\n    ) {\n      throw new BetterAuthConfigurationError(\n        \"GRAPHQL_STATIC_CONTEXT\",\n        \"GraphQL context must be a function returning a fresh object\",\n        \"context: ({ req }) => ({ req, loaders: createLoaders() })\",\n      );\n    }\n    class Probe {\n      query() {}\n      field() {}\n      reference() {}\n    }\n    for (const [name, decorator, key] of [\n      [\"query\", Query(() => String), RESOLVER_TYPE_METADATA],\n      [\"field\", ResolveField(() => String), RESOLVER_PROPERTY_METADATA],\n      [\"reference\", ResolveReference(), RESOLVER_REFERENCE_METADATA],\n    ] as const) {\n      decorator(\n        Probe.prototype,\n        name,\n        Object.getOwnPropertyDescriptor(Probe.prototype, name)!,\n      );\n      if (!Reflect.getMetadata(key, Probe.prototype[name])) {\n        throw new BetterAuthConfigurationError(\n          \"NEST_METADATA_KEY_CHANGED\",\n          `GraphQL metadata canary failed: ${key}`,\n        );\n      }\n    }\n    Args(\"probe\", { type: () => String })(Probe.prototype, \"query\", 0);\n    const argumentMetadata = record(\n      Reflect.getMetadata(PARAM_ARGS_METADATA, Probe, \"query\"),\n    );\n    if (\n      !argumentMetadata ||\n      !Object.entries(argumentMetadata).some(\n        ([key, value]) =>\n          key.startsWith(\"3:\") && record(value)?.data === \"probe\",\n      )\n    ) {\n      throw new BetterAuthConfigurationError(\n        \"NEST_METADATA_KEY_CHANGED\",\n        \"GraphQL argument metadata failed its parameter canary\",\n      );\n    }\n    const guards = options.fieldResolverEnhancers?.includes(\"guards\") === true;\n    const scanner = new MetadataScanner();\n    this.plans = [];\n    for (const wrapper of context.discovery.getProviders()) {\n      const target = wrapper.metatype;\n      if (!target?.prototype || wrapper.isAlias) {\n        continue;\n      }\n      for (const method of scanner.getAllMethodNames(target.prototype)) {\n        const handler = Reflect.get(target.prototype, method);\n        const field =\n          Reflect.getMetadata(RESOLVER_PROPERTY_METADATA, handler) === true;\n        const reference =\n          Reflect.getMetadata(RESOLVER_REFERENCE_METADATA, handler) === true;\n        if (\n          !field &&\n          !reference &&\n          !Reflect.getMetadata(RESOLVER_TYPE_METADATA, handler)\n        ) {\n          continue;\n        }\n        const metadata = record(\n          Reflect.getMetadata(PARAM_ARGS_METADATA, target, method),\n        );\n        const inputs = reference\n          ? []\n          : Object.entries(metadata ?? {}).flatMap(([key, entry]) =>\n              key.startsWith(\"3:\") && typeof record(entry)?.data === \"string\"\n                ? [String(record(entry)!.data)]\n                : [],\n            );\n        context.claim(\n          target,\n          method,\n          field || reference ? (guards ? \"global\" : \"none\") : \"global\",\n          {\n            code: reference\n              ? \"REFERENCE_RESOLVER_UNGUARDED\"\n              : field\n                ? \"FIELD_RESOLVER_UNGUARDED\"\n                : \"GRAPHQL_OPERATION_UNGUARDED\",\n            hint: \"Set fieldResolverEnhancers: ['guards', 'interceptors'], or declare @Public() where appropriate.\",\n            coverage: reference\n              ? this.options.federationCoverage\n              : field\n                ? this.options.fieldResolverCoverage\n                : \"error\",\n            everyHandler: reference,\n            inputs,\n          },\n        );\n        this.plans.push({\n          plan: context.planOf(target, method),\n          field,\n          reference,\n          target,\n          method,\n        });\n      }\n    }\n    const federation =\n      names.some((name) => name.includes(\"Federation\")) ||\n      this.plans.some((entry) => entry.reference);\n    const needsGuards = this.plans.some(\n      (entry) => entry.field || entry.reference,\n    );\n    if (\n      federation &&\n      needsGuards &&\n      !guards &&\n      this.options.federationCoverage !== \"off\"\n    ) {\n      const message =\n        \"Federation field and reference resolvers require fieldResolverEnhancers: ['guards', 'interceptors']; this runs every global guard once per field invocation.\";\n      if (this.options.federationCoverage === \"warn\") {\n        context.logger.warn(`FEDERATION_FIELD_GUARDS_REQUIRED: ${message}`);\n      } else {\n        throw new BetterAuthConfigurationError(\n          \"FEDERATION_FIELD_GUARDS_REQUIRED\",\n          message,\n        );\n      }\n    }\n    if (needsGuards && !options.fieldResolverEnhancers?.includes(\"filters\")) {\n      this.filterAdvice = {\n        level: \"warn\",\n        code: \"W_FIELD_EXCEPTION_FILTERS_DISABLED\",\n        message:\n          \"Nested GraphQL errors bypass Nest exception filters and ERROR logging while fieldResolverEnhancers omits filters.\",\n        hint: \"Include 'filters' with 'guards' in fieldResolverEnhancers to deliver nested authentication errors through Nest's exception pipeline; 'interceptors' enables per-field scopes.\",\n      };\n    }\n    if (needsGuards) {\n      const config = context.moduleRef.get(ApplicationConfig, {\n        strict: false,\n      });\n      const owned = new Set<unknown>([\n        context.moduleRef.get(BetterAuthGuard, { strict: false }),\n        context.moduleRef.get(BetterAuthScopeInterceptor, { strict: false }),\n      ]);\n      const names = [\n        ...config.getGlobalGuards(),\n        ...config.getGlobalInterceptors(),\n      ]\n        .filter(\n          (value) =>\n            !owned.has(value) &&\n            ![\"guard\", \"scope\"].includes(Reflect.get(value, AUTH_ENHANCER)),\n        )\n        .map((value) => value.constructor.name);\n      if (names.length) {\n        this.enhancerAdvice = {\n          level: \"warn\",\n          code: \"W_FIELD_GUARDS_MULTIPLY_GLOBAL_ENHANCERS\",\n          message: `${names.join(\", \")} run once per field-resolver invocation when their corresponding field enhancer is enabled: guards for global guards, interceptors for global interceptors.`,\n          hint: \"Use @SkipThrottle() or equivalent, move global guards to controllers, or use coverage: 'warn' behind an authenticating router.\",\n        };\n      }\n    }\n  }\n\n  advise(context: BootAdviceContext): readonly BootAdvice[] {\n    const advice: BootAdvice[] = [\n      this.enhancerAdvice,\n      this.filterAdvice,\n    ].filter((value): value is BootAdvice => value !== undefined);\n    const entries = this.plans;\n    const publicEntries = entries.filter(\n      ({ plan, field }) =>\n        !field && [\"public\", \"optional\"].includes(plan.access),\n    );\n    const inheriting = entries.filter(({ plan }) => plan.access === \"inherit\");\n    if (publicEntries.length && inheriting.length) {\n      advice.push({\n        level: \"warn\",\n        code: \"W_FIELD_RESOLVER_INHERITS\",\n        message: `${inheriting\n          .map(({ plan }) => plan.site)\n          .slice(0, 20)\n          .join(\n            \", \",\n          )} inherit readings from entry points including ${publicEntries\n          .map(({ plan }) => plan.site)\n          .slice(0, 20)\n          .join(\", \")}.`,\n        hint: \"Use @RequireAuth() and fieldResolverEnhancers: ['guards'] for sensitive fields.\",\n      });\n    }\n    for (const { plan } of inheriting) {\n      if (\n        plan.principalParams.some((param) =>\n          entries.some((entry) =>\n            [...entry.plan.accepts].some((kind) => kind !== param.kind),\n          ),\n        )\n      ) {\n        advice.push({\n          level: \"warn\",\n          code: \"W_NESTED_PRINCIPAL_PARAM\",\n          message: `${plan.site} can inherit a different principal kind from another schema entry point.`,\n          hint: \"Use @CurrentPrincipal() and narrow p.kind, or declare field access and acceptance.\",\n        });\n      }\n    }\n    const targets = new Set(\n      entries.filter(({ field }) => field).map(({ target }) => target),\n    );\n    for (const target of targets) {\n      if (\n        [\n          ACCESS_METADATA,\n          ACCEPT_PRINCIPALS_METADATA,\n          REQUIREMENTS_METADATA,\n        ].some((key) => Reflect.hasMetadata(key, target))\n      ) {\n        advice.push({\n          level: \"info\",\n          code: \"I_CLASS_METADATA_OPERATIONS_ONLY\",\n          message: `Class metadata of ${(target as { name?: string }).name} excludes inherited fields ${entries\n            .filter(\n              (entry) =>\n                entry.target === target && entry.plan.access === \"inherit\",\n            )\n            .map((entry) => entry.method)\n            .join(\", \")}; it applies to operations and reference resolvers ${\n            entries\n              .filter((entry) => entry.target === target && entry.reference)\n              .map((entry) => entry.method)\n              .join(\", \") || \"(none)\"\n          }.`,\n        });\n      }\n    }\n    if (\n      !this.connectionTtlMs &&\n      context.sources.some(\n        (source) => source.effects?.consumesQuota || source.effects?.writes,\n      )\n    ) {\n      advice.push({\n        level: \"warn\",\n        code: \"W_QUOTA_PER_MESSAGE\",\n        message:\n          \"Each socket operation resolves quota-consuming or writing principal sources.\",\n        hint: \"Consider subscriptionPrincipalTtlMs and its revocation delay.\",\n      });\n    }\n    return advice;\n  }\n}\nexport function apolloTransport(\n  options: GraphqlTransportOptions = {},\n): ExtensionRef<AuthTransport> {\n  return new GraphqlTransport(\"apollo\", options);\n}\nexport function mercuriusTransport(\n  options: GraphqlTransportOptions = {},\n): ExtensionRef<AuthTransport> {\n  return new GraphqlTransport(\"mercurius\", options);\n}\n"],"mappings":";;;;;;;;;;AAEA,MAAM,aAAa,OAAO,IAAI,4CAA4C;AAU1E,SAAgB,OACd,OAC0C;CAC1C,OAAO,OAAO,UAAU,YAAY,UAAU,OACzC,QACD,KAAA;AACN;;AAEA,SAAgB,YAAY,MAA0B;CACpD,MAAM,YAAY,KAAK,WAAW;CAClC,OAAO;EACL,MAAM,OAAO,KAAK,EAAE;EACpB,MAAM,YAAY,KAAA,IAAY,OAAO,KAAK,EAAE;EAC5C,SAAS,OAAO,KAAK,YAAY,IAAI,EAAE,KAAK;EAC5C,MAAM,OAAO,KAAK,YAAY,IAAI,EAAE;CACtC;AACF;AAKA,SAAS,eAAe,SAAiB,WAA8B;CACrE,IAAI,aAAa,QAAQ,IAAI,SAAS,UAAU;CAGhD,IAAI,CAAC,YAAY;EACf,6BAAa,IAAI,IAAI;EACrB,OAAO,eAAe,SAAS,YAAY,EAAE,OAAO,WAAW,CAAC;CAClE;CACA,IAAI,QAAQ,WAAW,IAAI,SAAS;CACpC,IAAI,UAAU,KAAA,GAAW;EACvB,QAAQ;GAAE,IAAI,WAAW,OAAO;GAAG,4BAAY,IAAI,IAAI;EAAE;EACzD,WAAW,IAAI,WAAW,KAAK;CACjC;CACA,OAAO;AACT;AACA,SAAS,KAAK,MAA6C;CACzD,OAAO,OAAO,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,GAAG,IAAI,CAAC;AAClD;AACA,SAAS,SAAS,IAAY,MAAgC;CAC5D,OAAO,GAAG,GAAG,GAAG,KAAK,UAAU,KAAK,IAAI,CAAC;AAC3C;AACA,SAAgB,kBACd,MACA,YAAY,OACJ;CACR,MAAM,aAAa,YAAY,IAAI;CACnC,QAAQ,YAAY,WAAW,OAAO,WAAW,SAAS;AAC5D;AACA,SAAgB,eACd,MACA,YAAY,OACO;CACnB,MAAM,aAAa,YAAY,IAAI;CACnC,MAAM,UAAU,WAAW;CAC3B,MAAM,QAAQ,eAAe,SAAS,WAAW,MAAM,aAAa,OAAO;CAC3E,MAAM,EAAE,OAAO;CACf,IAAI,WACF,MAAM,WAAW,IAAI,KAAK,UAAU,KAAK,WAAW,MAAM,IAAI,CAAC,CAAC;CAElE,OAAO;EACL;EACA,UAAU,YACN,GAAG,GAAG,aAAa,OAAO,WAAW,MAAM,cAAc,EAAE,MAC3D,SAAS,IAAI,WAAW,MAAM,IAAI;EACtC,CAAC,UAAU,aAAa;GACtB,MAAM,UAAU,YAAY,WAAW;GACvC,MAAM,YAAY,eAChB,QAAQ,SACR,QAAQ,MAAM,aAAa,QAAQ,OACrC;GACA,MAAM,OAAO,QAAQ,MAAM;GAC3B,KACE,IAAI,QAAQ,MAAM,SAAS,MAAM,MACjC,QACA,QAAQ,QAAQ,SAAS,OAAO,MAChC;IAEA,IACE,OAAO,OAAO,QAAQ,YACtB,OAAO,SACN,OAAO,KAAK,QAAQ,eACnB,UAAU,WAAW,IAAI,KAAK,UAAU,KAAK,OAAO,IAAI,CAAC,CAAC,IAE5D,MAAM,GAAG,UAAU,GAAG,aAAa,OAAO,YAAY,OAAO,QAAQ,MAAM,cAAc,EAAE;IAE7F,MAAM,SAAS,UAAU,IAAI,MAAM;GACrC;EACF;CACF;AACF;;ACnDA,MAAM,oBAAoB,OAAO,IAC/B,2CACF;AACA,MAAM,oBAAoB,OAAO,IAC/B,2CACF;AAiBA,IAAa,0BAAb,cAA6CA,eAAAA,mBAAmB;CAC9D;CAEA,YAAY,SAAsB;EAChC,MAAM,QAAQ,OAAO;EACrB,KAAK,aAAa;GAChB,MAAM,QAAQ;GACd,YAAY,QAAQ;GACpB,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;EACrD;CACF;AACF;AACA,SAAS,mBACP,OACuB;CACvB,OAAO;EACL,MAAM;EACN,QAAQC,oBAAAA,qBAAqB,KAAK,IAC9B,uBACA;EACJ,YAAY;CACd;AACF;AACA,IAAa,iCAAb,cAAoD,MAAM;CACxD;CAEA,YACE,OACA;EACA,MAAM,yBAAyB,EAAE,OAAO,MAAM,CAAC;EAC/C,KAAK,aAAa,mBAAmB,KAAK;CAC5C;AACF;AACA,IAAa,yCAAb,cAA4DD,eAAAA,mBAAmB;CAC7E;CAEA,YACE,OACA;EACA,MAAM,yBAAyB,EAAE,OAAO,MAAM,CAAC;EAC/C,KAAK,aAAa,mBAAmB,KAAK;CAC5C;AACF;;AAEA,SAAgB,+BAA+B;CAC7C,QACE,aACA,aACsC;GACrC,oBAAoB;GACpB,oBAAoB,eAAe,OAAO;CAC7C;AACF;AAOA,SAAS,QAAQ,OAAqC;CACpD,MAAM,YAAY,OAAO,KAAK;CAC9B,OAAO,aAAa,OAAO,UAAU,OAAO,IACvC,YACD,KAAA;AACN;;AAEA,SAAS,gBACP,OAC0C;CAC1C,MAAM,SAAS,OAAO,OAAO,KAAK,CAAC,EAAE,MAAM;CAC3C,OAAO,UACL,OAAO,OAAO,SAAS,cACvB,OAAO,OAAO,UAAU,aACtB,SACA,KAAA;AACN;;;;;;;;AAQA,SAAS,iBAAiB,OAAqC;CAC7D,OAAO,gBAAgB,KAAK,IAAI,QAAQ,OAAO,KAAK,CAAC,EAAE,OAAO,IAAI,KAAA;AACpE;;AAEA,MAAM,iBAAiB;;AAEvB,MAAM,gBAAgB;CAAC;CAAQ;CAAoB;AAAmB;;;;;;AAMtE,SAAS,eAAe,SAA0B;CAChD,MAAM,SAAS,QAAQ,OAAO;CAC9B,MAAM,MAAM,OAAO,OAAO,MAAM;CAChC,OAAOE,iBAAAA,kBAAkB;EACvB,SAAS,QAAQ;EACjB,KAAK,QAAQ,KAAK,SAAS,OAAO,MAAM,GAAG,GAAG;EAC9C,QAAQ,QAAQ;EAChB,QAAQ,QAAQ;CAClB,CAAC;AACH;;AAEA,SAAS,iBAAiB,MAAe,SAA2B;CAClE,KAAK,MAAM,QAAQ,eAAe;EAChC,MAAM,QAAQ,QAAQ,IAAI,IAAI;EAC9B,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,UAAU,MAC/B,KAAK,IAAI,MAAM,KAAK;CAExB;CACA,OAAO;AACT;;;;;;;AAOA,SAAS,YAAY,MAAiD;CACpE,MAAM,QAAQ,OAAO,IAAI;CACzB,OAAO,OAAO,OAAO,cAAc,KAAK,OAAO,OAAO,SAAS;AACjE;AACA,SAAS,eAAe,SAA2B;CACjD,MAAM,QAAQ,OAAO,OAAO;CAI5B,MAAM,cAHM,OAAO,OAAO,GAAG,KAAK,MAAA,EAGV;CACxB,IAAI,MAAM,QAAQ,UAAU,GAAG;EAC7B,MAAM,UAAU,IAAI,QAAQ;EAC5B,KAAK,IAAI,QAAQ,GAAG,QAAQ,IAAI,WAAW,QAAQ,SAAS,GAC1D,IACE,OAAO,WAAW,WAAW,YAC7B,OAAO,WAAW,QAAQ,OAAO,UAEjC,QAAQ,OAAO,WAAW,QAAQ,WAAW,QAAQ,EAAE;EAG3D,OAAO;CACT;CACA,OAAOC,iBAAAA,aAAc,OAAO,WAAW,CAAC,CAAyB;AACnE;;;;;;AAMA,SAAS,cAAc,MAA4B,OAAyB;CAC1E,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE;CAC/B,IAAI,MAAM,UAAU,OAAO,MAAM,MAC/B,OAAO;CAET,OAAO,KAAK,cAAc,KAAK,YAAY,OAAO,MAAM,QAAQ;AAClE;AACA,SAAS,eACP,SACA,QACA,MACA;CACA,MAAM,UAAU,OAAO,OAAO,KAAK,CAAC;CACpC,MAAM,MAAM,OAAO,QAAQ,GAAG;CAC9B,MAAM,QAAQ,OAAO,QAAQ,KAAK;CAGlC,MAAM,cACJ,WAAW,WACP,MAAM,UAAU,GAAG,MAAM,QACzB,MAAM,UAAU,OAAO,OAAO,MAAM,OACpC,cAAc,MAAM,QAAQ,KAAK;CAIvC,MAAM,YACJ,WAAW,YAAY,CAAC,eAAe,iBAAiB,KAAK,KAAK,IAC9D,MACA,KAAA;CACN,MAAM,UACJ,WAAW,YAAY,CAAC,cACpB,YACE,UAAU,QACV,QACF,KAAA;CACN,MAAM,SAAS,cACX,KAAA,IACA,WAAW,WACT,iBAAiB,OAAO,IACvB,QAAQ,QAAQ,kBAAkB,MAClC,qBAAqB,UACjB,QAAQ,QAAQ,OAAO,KACxB,QAAQ,OAAO,QAAQ,KAAK,CAAC,EAAE,OAAO,KACtC,QAAQ,QAAQ,GAAG,IACnB,KAAA;CACV,MAAM,aAAa,YAAY,MAAM;CACrC,MAAM,SAAS,OACb,YACI,KAAK,mBACJ,QAAQ,oBAAoB,QAAQ,eAC3C;CACA,MAAM,UACJ,WAAW,WACP,QAAQ,MACP,OAAO,QAAQ,KAAK,CAAC,EAAE,WAAW,QAAQ;CACjD,MAAM,gBACJ,QAAQ,8BAA8B,UAClC,IAAI,QAAQ,QAAQ,kBAAkB,IACtC,eAAe,MAAM;CAG3B,OAAO;EAAE;EAAS;EAAQ,WADR,SAAS,gBAAgB,OAAO,IAAI,KAAA;EACjB;EAAY;EAAQ;EAAS;CAAQ;AAC5E;AACA,IAAM,mBAAN,MAAgD;CAiBnC;CACQ;CAjBnB,WAAoB,EAAE,eAAe,MAAM;CAC3C;CACA;CACA,QAMM,CAAC;CACP;CACA;;CAEA,iCAAkC,IAAI,QAAyB;CAE/D,YACE,IACA,SACA;EAFS,KAAA,KAAA;EACQ,KAAA,UAAA;EAEjB,KAAK,kBAAkB,QAAQ,8BAA8B;EAC7D,IAAI,CAAC,OAAO,SAAS,KAAK,eAAe,KAAK,KAAK,kBAAkB,GACnE,MAAM,IAAIC,oBAAAA,6BACR,4BACA,gEACF;CAEJ;CAEA,QAAQ,SAAoC;EAC1C,OAAO,QAAQ,QAAgB,MAAM;CACvC;CAEA,UAAkB,SAAoC;EACpD,OACE,QAAQ,YAAYC,gBAAAA,6BAA6B,QAAQ,WAAW,CAAC,MACrE;CAEJ;CAEA,iBAAiB,QAAgB,QAAuC;EACtE,MAAM,UAAU,QAAQ,IACtB,QAAQ,IAAI,QAAQ,WAAW,KAAK,QACpC,MACF;EACA,OAAO,OAAO,YAAY,cACxB,CAAC,QAAQ,YAAYA,gBAAAA,6BAA6B,OAAO,KACzD,QAAQ,YAAYC,gBAAAA,4BAA4B,OAAO,IACrD,YACA,KAAA;CACN;CAEA,QAAQ,SAA2B;EACjC,MAAM,OAAO,QAAQ,QAAQ;EAC7B,MAAM,aAAa,YAAY,IAAI;EAGnC,KAAK,YACH,eAAe,WAAW,SAAS,KAAK,IAAI,KAAK,KAAK,QAAQ,IAAI,CAAC,CAChE,WACH,WAAW,IACb;EACA,OAAO;GACL,GAAG,eAAe,MAAM,KAAK,UAAU,OAAO,CAAC;GAC/C,iBAAiB,SAA6B;IAC5C,IAAI,KAAK,KACP,KAAK,cAAc,MAAM,KAAK,GAAG;GAErC;EACF;CACF;;;;;;;;;CAUA,YACE,WACA,MACS;EACT,IAAI,CAAC,WACH,OAAO;EAET,MAAM,YAAY,YAAY,IAAI;EAClC,MAAM,QAAQ,YAAY,KAAK,eAAe,IAAI,SAAS,IAAI,KAAA;EAC/D,IAAI,UAAU,KAAA,GACZ,OAAO;EAET,MAAM,OAAO,UAAU,eAAe;EACtC,IAAI,WACF,KAAK,eAAe,IAAI,WAAW,IAAI;EAEzC,OAAO;CACT;CAEA,cAAsB,MAA0B,KAAmB;EAEjE,MAAM,UAAU,eADG,YAAY,IACS,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,IAAI;EACpE,IAAI,QAAQ,QACV,OAAO;EAET,IAAI,CAAC,IAAI,MAAM,UAAU,QAAQ,OAAO,GACtC,MAAMF,oBAAAA,6BAA6B,UACjC,gCACA,iEACA,EACE,MAAM,6HACR,CACF;EAEF,IAAI,CAAC,IAAI,KAAK,OAAO,QAAQ,OAAO,GAClC,MAAMA,oBAAAA,6BAA6B,UACjC,iCACA,gDACA,EACE,MAAM,qFACR,CACF;EAEF,OAAO;CACT;CAEA,SAAS,SAA2B,KAAkC;EACpE,KAAK,MAAM;EACX,MAAM,OAAO,QAAQ,QAAQ;EAC7B,MAAM,aAAa,YAAY,IAAI;EACnC,MAAM,UAAU,eAAe,WAAW,SAAS,KAAK,IAAI,IAAI,IAAI;EAKpE,MAAM,OAAO,KAAK,YAAY,QAAQ,WAAW,WAAW,IAAI;EAChE,MAAM,MACJ,CAAC,QAAQ,UAAU,IAAI,MAAM,UAAU,QAAQ,OAAO,IAClD,IAAI,KAAK,IAAI,QAAQ,OAAO,IAC5B,OACE,WAAW,UACV,YAAY,WAAW,IAAI,KAAK;EACzC,MAAM,gBAAgB,KAAK,cAAc,MAAM,GAAG;EAClD,MAAM,gBAAgB;GACpB,MAAM,UAAU,QAAQ;GACxB,IAAI,CAAC,QAAQ,QACX,OAAO,IAAI,KAAM,QAAQ,QAAQ,OAAO;GAE1C,MAAM,UAAU,QAAQ,QAAQ;GAChC,IAAI,CAAC,MAEH,OAAO,iBAAiB,IAAI,QAAQ,GAAG,OAAO;GAEhD,IAAI,KAAK,QAAQ,yBAAyB;IAGxC,MAAM,QAAQ,KAAK,QAAQ,wBAAwB,QAAQ,UAAU;IACrE,IAAI;IACJ,IAAI;KACF,SAAS,IAAI,QAAQ,KAAK;IAC5B,QAAQ;KAGN,MAAMG,oBAAAA,aAAa,SAAS;MAC1B,QAAQ;MACR,QAAQ;KACV,CAAC;IACH;IACA,OAAO,iBAAiB,QAAQ,OAAO;GACzC;GACA,MAAM,cAAc,IAAI,QAAQ,OAAO;GACvC,MAAM,QAAQ,IAAI,KAEd,KAAK,QAAQ,0BAA0B,CAAC,iBAAiB,QAAQ,EAAA,CACjE,KAAK,SAAS,KAAK,YAAY,CAAC,CACpC;GACA,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,QAAQ,UAAU,CAAC,CAAC,GAAG;IAChE,IAAI,CAAC,MAAM,IAAI,KAAK,YAAY,CAAC,GAC/B;IAEF,IAAI,OAAO,UAAU,YAAY,WAAW,KAAK,KAAK,GACpD,MAAMA,oBAAAA,aAAa,SAAS;KAC1B,QAAQ;KACR,QAAQ;IACV,CAAC;IAEH,IAAI;KACF,YAAY,IAAI,MAAM,KAAK;IAC7B,QAAQ;KAGN,MAAMA,oBAAAA,aAAa,SAAS;MAC1B,QAAQ;MACR,QAAQ;KACV,CAAC;IACH;GACF;GACA,OAAO;EACT;EACA,OAAO;GACL;GACA,YAAY,kBAAkB,MAAM,KAAK,UAAU,OAAO,CAAC;GAC3D,SAAS,KAAK,QAAQ,OAAO;GAC7B,GAAI,QAAQ,UAAU,OAClB;IAAE,YAAY,QAAQ;IAAQ,gBAAgB,KAAK;GAAgB,IACnE,CAAC;GACL;GACA,IAAI,WAAW;IACb,MAAM,UAAU,QAAQ;IACxB,OAAO,QAAQ,SAAS,OAAO,IAAI,KAAM,SAAS,QAAQ,OAAO;GACnE;GACA,IAAI,UAAU;IACZ,MAAM,UAAU,QAAQ;IACxB,OAAO,QAAQ,SACX,OACA,IAAI,KAAM,WACR,QAAQ,SACR,QAAQ,QAAQ,SACd,OAAO,QAAQ,OAAO,CAAC,EAAE,OACzB,IAAI,KAAM,cAAc,QAAQ,OAAO,CAC3C;GACN;GACA,IAAI,UAAU;IACZ,MAAM,UAAU,QAAQ;IACxB,IAAI,CAAC,QAAQ,QACX,OAAO,IAAI,KAAM,QAAQ,QAAQ,OAAO;IAE1C,OAAO;KACL,QAAQ;KACR,KAAK,OACDL,iBAAAA,kBAAkB,QAAQ,MAAM,IAChC,eAAe,QAAQ,MAAM;IACnC;GACF;GACA,QAAQ,UACL,KAAK,UAAU,OAAO,IACnB,WAAW,OAAO,QAClB,WAAW,OAAO,WACrB,CAAC,QAAQ,UAAU,IAAI,MAAM,UAAU,QAAQ,OAAO,IACnD,IAAI,KAAK,MAAM,QAAQ,SAAS,IAAI,IACpC,KAAA;GACN,IAAI,UAAU;IACZ,MAAM,UAAU,QAAQ;IAGxB,OAAO,QAAQ,SACX;KACE,SAAS;KACT,SAAS,QAAQ;KACjB,KAAKA,iBAAAA,kBAAkB,QAAQ,MAAM;KACrC,KAAK,QAAQ;IACf,IACA;KACE,SAAS,WAAW,MAAM,UAAU,cAAc;KAClD,eAAe,IAAI,KAAM,QAAQ,QAAQ,OAAO;KAChD,KAAK,IAAI,KAAM,QAAQ,QAAQ,OAAO,CAAC,CAAC;KACxC;IACF;GACN;EACF;CACF;CAEA,YAAY,SAA+B;EACzC,OAAO,IAAI,wBAAwB,OAAO;CAC5C;CAEA,oBACE,OACA,UACA,MACS;EACT,OAAO,KAAK,WACR,IAAI,uCAAuC,KAAK,IAChD,IAAI,+BAA+B,KAAK;CAC9C;CAEA,SAAS,SAA2C;EAClD,MAAM,UAAU,QAAQ,UAAU,IAI/BM,gBAAAA,wBAAwB,EAAE,QAAQ,MAAM,CAAC;EAC5C,MAAM,QAAkB,CAAC;EACzB,KACE,IAAI,SAAS,QAAQ,QACrB,OAAO,WAAW,YAClB,SAAS,OAAO,eAAe,MAAM,GAErC,MAAM,KAAK,OAAO,IAAI;EAExB,IACE,MAAM,MAAM,SACV,KAAK,WAAW,KAAK,OAAO,WAAW,cAAc,QAAQ,CAC/D,GAEA,MAAM,IAAIJ,oBAAAA,6BACR,2BACA,GAAG,KAAK,GAAG,4BAA4B,MAAM,KAAK,KAAK,GACzD;EAEF,IACE,QAAQ,YAAY,KAAA,KACpB,OAAO,QAAQ,YAAY,YAE3B,MAAM,IAAIA,oBAAAA,6BACR,0BACA,+DACA,2DACF;EAEF,MAAM,MAAM;GACV,QAAQ,CAAC;GACT,QAAQ,CAAC;GACT,YAAY,CAAC;EACf;EACA,KAAK,MAAM,CAAC,MAAM,WAAW,QAAQ;GACnC;IAAC;KAASK,GAAAA,gBAAAA,MAAAA,OAAY,MAAM;IAAGC,gBAAAA;GAAsB;GACrD;IAAC;KAASC,GAAAA,gBAAAA,aAAAA,OAAmB,MAAM;IAAGL,gBAAAA;GAA0B;GAChE;IAAC;KAAaM,GAAAA,gBAAAA,iBAAAA,CAAiB;IAAGP,gBAAAA;GAA2B;EAC/D,GAAY;GACV,UACE,MAAM,WACN,MACA,OAAO,yBAAyB,MAAM,WAAW,IAAI,CACvD;GACA,IAAI,CAAC,QAAQ,YAAY,KAAK,MAAM,UAAU,KAAK,GACjD,MAAM,IAAID,oBAAAA,6BACR,6BACA,mCAAmC,KACrC;EAEJ;EACA,CAAA,GAAA,gBAAA,KAAA,CAAK,SAAS,EAAE,YAAY,OAAO,CAAC,CAAC,CAAC,MAAM,WAAW,SAAS,CAAC;EACjE,MAAM,mBAAmB,OACvB,QAAQ,YAAYS,gBAAAA,qBAAqB,OAAO,OAAO,CACzD;EACA,IACE,CAAC,oBACD,CAAC,OAAO,QAAQ,gBAAgB,CAAC,CAAC,MAC/B,CAAC,KAAK,WACL,IAAI,WAAW,IAAI,KAAK,OAAO,KAAK,CAAC,EAAE,SAAS,OACpD,GAEA,MAAM,IAAIT,oBAAAA,6BACR,6BACA,uDACF;EAEF,MAAM,SAAS,QAAQ,wBAAwB,SAAS,QAAQ,MAAM;EACtE,MAAM,UAAU,IAAIU,aAAAA,gBAAgB;EACpC,KAAK,QAAQ,CAAC;EACd,KAAK,MAAM,WAAW,QAAQ,UAAU,aAAa,GAAG;GACtD,MAAM,SAAS,QAAQ;GACvB,IAAI,CAAC,QAAQ,aAAa,QAAQ,SAChC;GAEF,KAAK,MAAM,UAAU,QAAQ,kBAAkB,OAAO,SAAS,GAAG;IAChE,MAAM,UAAU,QAAQ,IAAI,OAAO,WAAW,MAAM;IACpD,MAAM,QACJ,QAAQ,YAAYR,gBAAAA,4BAA4B,OAAO,MAAM;IAC/D,MAAM,YACJ,QAAQ,YAAYD,gBAAAA,6BAA6B,OAAO,MAAM;IAChE,IACE,CAAC,SACD,CAAC,aACD,CAAC,QAAQ,YAAYK,gBAAAA,wBAAwB,OAAO,GAEpD;IAEF,MAAM,WAAW,OACf,QAAQ,YAAYG,gBAAAA,qBAAqB,QAAQ,MAAM,CACzD;IACA,MAAM,SAAS,YACX,CAAC,IACD,OAAO,QAAQ,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,WAC5C,IAAI,WAAW,IAAI,KAAK,OAAO,OAAO,KAAK,CAAC,EAAE,SAAS,WACnD,CAAC,OAAO,OAAO,KAAK,CAAC,CAAE,IAAI,CAAC,IAC5B,CAAC,CACP;IACJ,QAAQ,MACN,QACA,QACA,SAAS,YAAa,SAAS,WAAW,SAAU,UACpD;KACE,MAAM,YACF,iCACA,QACE,6BACA;KACN,MAAM;KACN,UAAU,YACN,KAAK,QAAQ,qBACb,QACE,KAAK,QAAQ,wBACb;KACN,cAAc;KACd;IACF,CACF;IACA,KAAK,MAAM,KAAK;KACd,MAAM,QAAQ,OAAO,QAAQ,MAAM;KACnC;KACA;KACA;KACA;IACF,CAAC;GACH;EACF;EACA,MAAM,aACJ,MAAM,MAAM,SAAS,KAAK,SAAS,YAAY,CAAC,KAChD,KAAK,MAAM,MAAM,UAAU,MAAM,SAAS;EAC5C,MAAM,cAAc,KAAK,MAAM,MAC5B,UAAU,MAAM,SAAS,MAAM,SAClC;EACA,IACE,cACA,eACA,CAAC,UACD,KAAK,QAAQ,uBAAuB,OACpC;GACA,MAAM,UACJ;GACF,IAAI,KAAK,QAAQ,uBAAuB,QACtC,QAAQ,OAAO,KAAK,qCAAqC,SAAS;QAElE,MAAM,IAAIT,oBAAAA,6BACR,oCACA,OACF;EAEJ;EACA,IAAI,eAAe,CAAC,QAAQ,wBAAwB,SAAS,SAAS,GACpE,KAAK,eAAe;GAClB,OAAO;GACP,MAAM;GACN,SACE;GACF,MAAM;EACR;EAEF,IAAI,aAAa;GACf,MAAM,SAAS,QAAQ,UAAU,IAAIW,aAAAA,mBAAmB,EACtD,QAAQ,MACV,CAAC;GACD,MAAM,wBAAQ,IAAI,IAAa,CAC7B,QAAQ,UAAU,IAAIC,mBAAAA,iBAAiB,EAAE,QAAQ,MAAM,CAAC,GACxD,QAAQ,UAAU,IAAIC,+BAAAA,4BAA4B,EAAE,QAAQ,MAAM,CAAC,CACrE,CAAC;GACD,MAAM,QAAQ,CACZ,GAAG,OAAO,gBAAgB,GAC1B,GAAG,OAAO,sBAAsB,CAClC,CAAC,CACE,QACE,UACC,CAAC,MAAM,IAAI,KAAK,KAChB,CAAC,CAAC,SAAS,OAAO,CAAC,CAAC,SAAS,QAAQ,IAAI,OAAOC,iBAAAA,aAAa,CAAC,CAClE,CAAC,CACA,KAAK,UAAU,MAAM,YAAY,IAAI;GACxC,IAAI,MAAM,QACR,KAAK,iBAAiB;IACpB,OAAO;IACP,MAAM;IACN,SAAS,GAAG,MAAM,KAAK,IAAI,EAAE;IAC7B,MAAM;GACR;EAEJ;CACF;CAEA,OAAO,SAAmD;EACxD,MAAM,SAAuB,CAC3B,KAAK,gBACL,KAAK,YACP,CAAC,CAAC,QAAQ,UAA+B,UAAU,KAAA,CAAS;EAC5D,MAAM,UAAU,KAAK;EACrB,MAAM,gBAAgB,QAAQ,QAC3B,EAAE,MAAM,YACP,CAAC,SAAS,CAAC,UAAU,UAAU,CAAC,CAAC,SAAS,KAAK,MAAM,CACzD;EACA,MAAM,aAAa,QAAQ,QAAQ,EAAE,WAAW,KAAK,WAAW,SAAS;EACzE,IAAI,cAAc,UAAU,WAAW,QACrC,OAAO,KAAK;GACV,OAAO;GACP,MAAM;GACN,SAAS,GAAG,WACT,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC,CAC5B,MAAM,GAAG,EAAE,CAAC,CACZ,KACC,IACF,EAAE,gDAAgD,cACjD,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC,CAC5B,MAAM,GAAG,EAAE,CAAC,CACZ,KAAK,IAAI,EAAE;GACd,MAAM;EACR,CAAC;EAEH,KAAK,MAAM,EAAE,UAAU,YACrB,IACE,KAAK,gBAAgB,MAAM,UACzB,QAAQ,MAAM,UACZ,CAAC,GAAG,MAAM,KAAK,OAAO,CAAC,CAAC,MAAM,SAAS,SAAS,MAAM,IAAI,CAC5D,CACF,GAEA,OAAO,KAAK;GACV,OAAO;GACP,MAAM;GACN,SAAS,GAAG,KAAK,KAAK;GACtB,MAAM;EACR,CAAC;EAGL,MAAM,UAAU,IAAI,IAClB,QAAQ,QAAQ,EAAE,YAAY,KAAK,CAAC,CAAC,KAAK,EAAE,aAAa,MAAM,CACjE;EACA,KAAK,MAAM,UAAU,SACnB,IACE;GACEC,iBAAAA;GACAC,iBAAAA;GACAC,iBAAAA;EACF,CAAC,CAAC,MAAM,QAAQ,QAAQ,YAAY,KAAK,MAAM,CAAC,GAEhD,OAAO,KAAK;GACV,OAAO;GACP,MAAM;GACN,SAAS,qBAAsB,OAA6B,KAAK,6BAA6B,QAC3F,QACE,UACC,MAAM,WAAW,UAAU,MAAM,KAAK,WAAW,SACrD,CAAC,CACA,KAAK,UAAU,MAAM,MAAM,CAAC,CAC5B,KAAK,IAAI,EAAE,qDACZ,QACG,QAAQ,UAAU,MAAM,WAAW,UAAU,MAAM,SAAS,CAAC,CAC7D,KAAK,UAAU,MAAM,MAAM,CAAC,CAC5B,KAAK,IAAI,KAAK,SAClB;EACH,CAAC;EAGL,IACE,CAAC,KAAK,mBACN,QAAQ,QAAQ,MACb,WAAW,OAAO,SAAS,iBAAiB,OAAO,SAAS,MAC/D,GAEA,OAAO,KAAK;GACV,OAAO;GACP,MAAM;GACN,SACE;GACF,MAAM;EACR,CAAC;EAEH,OAAO;CACT;AACF;AACA,SAAgB,gBACd,UAAmC,CAAC,GACP;CAC7B,OAAO,IAAI,iBAAiB,UAAU,OAAO;AAC/C;AACA,SAAgB,mBACd,UAAmC,CAAC,GACP;CAC7B,OAAO,IAAI,iBAAiB,aAAa,OAAO;AAClD"}

package/dist/graphql.d.cts

@@ -1,6 +1,5 @@
-import { I as ExtensionRef, Qn as BetterAuthInfrastructureError, Yn as AuthGraphqlExtensions, Zn as BetterAuthConfigurationError, c as AuthTransport, qn as AuthFailure } from "./auth-contracts-Brh_Qko9.cjs";
+import { I as ExtensionRef, Qn as BetterAuthInfrastructureError, Yn as AuthGraphqlExtensions, Zn as BetterAuthConfigurationError, c as AuthTransport, qn as AuthFailure } from "./auth-contracts-zvt8ysoZ.cjs";
 import { IntrinsicException } from "@nestjs/common";
-//#region src/graphql-transport.d.ts
 interface GraphqlTransportOptions {
   /** Case-insensitive connection-init credential keys; defaults to authorization and cookie. */
   connectionParamHeaders?: readonly string[];
@@ -33,6 +32,5 @@ export declare function mercuriusSubscriptionContext(): (_connection: unknown, r
 }) => Record<string | symbol, unknown>;
 export declare function apolloTransport(options?: GraphqlTransportOptions): ExtensionRef<AuthTransport>;
 export declare function mercuriusTransport(options?: GraphqlTransportOptions): ExtensionRef<AuthTransport>;
-//#endregion
 export type { GraphqlTransportOptions };
 //# sourceMappingURL=graphql.d.cts.map

package/dist/graphql.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"graphql.d.cts","names":[],"sources":["../src/graphql-transport.ts"],"mappings":";;;UAyDiB;;EAEf;;;;;;EAMA,2BACE,+BACG;;EAEL;EACA;EACA;;qBAEW,gCAAgC;WAClC,YAAY;EAErB,YAAY,SAAS;;qBAoBV,uCAAuC;WACzC,YAAY;EAErB,YACE,OAAO,gCAAgC;;qBAM9B,+CAA+C;WACjD,YAAY;EAErB,YACE,OAAO,gCAAgC;;;wBAO3B,iCAA4B,sBAEpB;EACT,SAAS;MACnB;wBAmtBW,gBACd,UAAS,0BACR,aAAa;wBAGA,mBACd,UAAS,0BACR,aAAa"}
+{"version":3,"file":"graphql.d.cts","names":[],"sources":["../src/graphql-transport.ts"],"mappings":";;UAyDiB;;EAEf;;;;;;EAMA,2BACE,+BACG;;EAEL;EACA;EACA;;qBAEW,gCAAgC;WAClC,YAAY;EAET,YAAA,SAAS;;qBAoBV,uCAAuC;WACzC,YAAY;EAGnB,YAAA,OAAO,gCAAgC;;qBAM9B,+CAA+C;WACjD,YAAY;EAGnB,YAAA,OAAO,gCAAgC;;;wBAO3B,iCAEZ,sBACA;EAAW,SAAS;MACnB;wBAmtBW,gBACd,UAAS,0BACR,aAAa;wBAGA,mBACd,UAAS,0BACR,aAAa"}

package/dist/graphql.d.mts

@@ -1,6 +1,5 @@
-import { I as ExtensionRef, Qn as BetterAuthInfrastructureError, Yn as AuthGraphqlExtensions, Zn as BetterAuthConfigurationError, c as AuthTransport, qn as AuthFailure } from "./auth-contracts-Cz7C4_Ch.mjs";
+import { I as ExtensionRef, Qn as BetterAuthInfrastructureError, Yn as AuthGraphqlExtensions, Zn as BetterAuthConfigurationError, c as AuthTransport, qn as AuthFailure } from "./auth-contracts-CADGyI0O.mjs";
 import { IntrinsicException } from "@nestjs/common";
-//#region src/graphql-transport.d.ts
 interface GraphqlTransportOptions {
   /** Case-insensitive connection-init credential keys; defaults to authorization and cookie. */
   connectionParamHeaders?: readonly string[];
@@ -33,6 +32,5 @@ export declare function mercuriusSubscriptionContext(): (_connection: unknown, r
 }) => Record<string | symbol, unknown>;
 export declare function apolloTransport(options?: GraphqlTransportOptions): ExtensionRef<AuthTransport>;
 export declare function mercuriusTransport(options?: GraphqlTransportOptions): ExtensionRef<AuthTransport>;
-//#endregion
 export type { GraphqlTransportOptions };
 //# sourceMappingURL=graphql.d.mts.map

package/dist/graphql.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"graphql.d.mts","names":[],"sources":["../src/graphql-transport.ts"],"mappings":";;;UAyDiB;;EAEf;;;;;;EAMA,2BACE,+BACG;;EAEL;EACA;EACA;;qBAEW,gCAAgC;WAClC,YAAY;EAErB,YAAY,SAAS;;qBAoBV,uCAAuC;WACzC,YAAY;EAErB,YACE,OAAO,gCAAgC;;qBAM9B,+CAA+C;WACjD,YAAY;EAErB,YACE,OAAO,gCAAgC;;;wBAO3B,iCAA4B,sBAEpB;EACT,SAAS;MACnB;wBAmtBW,gBACd,UAAS,0BACR,aAAa;wBAGA,mBACd,UAAS,0BACR,aAAa"}
+{"version":3,"file":"graphql.d.mts","names":[],"sources":["../src/graphql-transport.ts"],"mappings":";;UAyDiB;;EAEf;;;;;;EAMA,2BACE,+BACG;;EAEL;EACA;EACA;;qBAEW,gCAAgC;WAClC,YAAY;EAET,YAAA,SAAS;;qBAoBV,uCAAuC;WACzC,YAAY;EAGnB,YAAA,OAAO,gCAAgC;;qBAM9B,+CAA+C;WACjD,YAAY;EAGnB,YAAA,OAAO,gCAAgC;;;wBAO3B,iCAEZ,sBACA;EAAW,SAAS;MACnB;wBAmtBW,gBACd,UAAS,0BACR,aAAa;wBAGA,mBACd,UAAS,0BACR,aAAa"}

package/dist/graphql.mjs

@@ -1,12 +1,12 @@
-import { c as isConfigurationError, n as BetterAuthConfigurationError, t as AuthFailures } from "./auth-errors-C3rbTV9p.mjs";
-import { E as REQUIREMENTS_METADATA, a as ACCESS_METADATA, i as ACCEPT_PRINCIPALS_METADATA, s as AUTH_ENHANCER } from "./decorate-Dt0e9K6R.mjs";
-import { t as BetterAuthScopeInterceptor } from "./auth-scope-interceptor-DYPn3b8M.mjs";
-import { t as BetterAuthGuard } from "./auth-guard-h9QB_l11.mjs";
-import { o as toWebHeaders, s as upgradeRequestUrl } from "./platform-CZl7TY8j.mjs";
+import { c as isConfigurationError, n as BetterAuthConfigurationError, t as AuthFailures } from "./auth-errors-JjxGDVSt.mjs";
+import { t as BetterAuthGuard } from "./auth-guard-Da92QEK5.mjs";
+import { t as BetterAuthScopeInterceptor } from "./auth-scope-interceptor-CvCQ52dV.mjs";
+import { E as REQUIREMENTS_METADATA, a as ACCESS_METADATA, i as ACCEPT_PRINCIPALS_METADATA, s as AUTH_ENHANCER } from "./decorate-bO-rBn-G.mjs";
+import { o as toWebHeaders, s as upgradeRequestUrl } from "./platform-BKYVzAv1.mjs";
 import { IntrinsicException } from "@nestjs/common";
 import { ApplicationConfig, MetadataScanner } from "@nestjs/core";
 import { Args, GRAPHQL_MODULE_OPTIONS, PARAM_ARGS_METADATA, Query, RESOLVER_PROPERTY_METADATA, RESOLVER_REFERENCE_METADATA, RESOLVER_TYPE_METADATA, ResolveField, ResolveReference } from "@nestjs/graphql";
-//#region src/graphql-lineage.ts
+// src/graphql-lineage.ts
 const OPERATIONS = Symbol.for("@nestjs-kit/better-auth:graphql-operations");
 function record(value) {
 	return typeof value === "object" && value !== null ? value : void 0;
@@ -67,8 +67,7 @@ function graphqlLineage(args, reference = false) {
 		}
 	};
 }
-//#endregion
-//#region src/graphql-transport.ts
+// src/graphql-transport.ts
 const MERCURIUS_AMBIENT = Symbol.for("@nestjs-kit/better-auth:mercurius-ambient");
 const MERCURIUS_UPGRADE = Symbol.for("@nestjs-kit/better-auth:mercurius-upgrade");
 var BetterAuthGraphqlDenial = class extends IntrinsicException {
@@ -497,7 +496,6 @@ function apolloTransport(options = {}) {
 function mercuriusTransport(options = {}) {
 	return new GraphqlTransport("mercurius", options);
 }
-//#endregion
 export { BetterAuthGraphqlDenial, BetterAuthGraphqlInternalError, BetterAuthGraphqlRepeatedInternalError, apolloTransport, mercuriusSubscriptionContext, mercuriusTransport };
 
 //# sourceMappingURL=graphql.mjs.map