@nestjs-kit/better-auth 2.1.0 → 2.1.2

package/dist/{auth-scope-interceptor-BjxAL1-S.cjs → auth-scope-interceptor-Bui20-Ps.cjs}

@@ -1,8 +1,8 @@
-const require_auth_errors = require("./auth-errors-DmiKl0L_.cjs");
-const require_decorate = require("./decorate-Cr4Q7bNE.cjs");
+const require_decorate = require("./decorate-fMNf0caZ.cjs");
+const require_auth_errors = require("./auth-errors-RW7hOVI-.cjs");
 let _nestjs_common = require("@nestjs/common");
 let rxjs = require("rxjs");
-//#region src/principal-resolver.ts
+// src/principal-resolver.ts
 const definePrincipalSource = (source) => source;
 const authenticated = (principal) => ({
 	outcome: "authenticated",
@@ -118,8 +118,7 @@ var ChainPrincipalResolver = class {
 		}, compute);
 	}
 };
-//#endregion
-//#region src/auth-scope-interceptor.ts
+// src/auth-scope-interceptor.ts
 let BetterAuthScopeInterceptor = class BetterAuthScopeInterceptor {
 	core;
 	static [require_decorate.AUTH_ENHANCER] = "scope";
@@ -225,7 +224,6 @@ var ScopeCore = class {
 		}));
 	}
 };
-//#endregion
 Object.defineProperty(exports, "BetterAuthScopeInterceptor", {
 	enumerable: true,
 	get: function() {
@@ -287,4 +285,4 @@ Object.defineProperty(exports, "requestHeaders", {
 	}
 });
 
-//# sourceMappingURL=auth-scope-interceptor-BjxAL1-S.cjs.map
+//# sourceMappingURL=auth-scope-interceptor-Bui20-Ps.cjs.map

package/dist/{auth-scope-interceptor-BjxAL1-S.cjs.map → auth-scope-interceptor-Bui20-Ps.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"auth-scope-interceptor-BjxAL1-S.cjs","names":["normalizeThrown","isConfigurationError","isInfrastructureError","redactForRequest","createInfrastructureError","isAuthFailure","AUTH_ENHANCER","Injectable","Inject","SCOPE_CORE","READER_CONTEXT","Observable"],"sources":["../src/principal-resolver.ts","../src/auth-scope-interceptor.ts"],"sourcesContent":["import type {\n  AuthPrincipalBase,\n  PrincipalResolver,\n  PrincipalResult,\n  PrincipalSource,\n  ResolutionRequest,\n  TransportCall,\n} from \"./auth-contracts.js\";\nimport {\n  type AuthFailure,\n  isAuthFailure,\n  normalizeThrown,\n  createInfrastructureError,\n  isConfigurationError,\n  isInfrastructureError,\n  redactForRequest,\n} from \"./auth-errors.js\";\nimport type { InstanceEntry, InstanceLookup } from \"./instance-registry.js\";\nimport type { TransportRegistry } from \"./transport-registry.js\";\nimport type { RequestScope } from \"./request-scope.js\";\n\nexport const definePrincipalSource = <P extends AuthPrincipalBase>(\n  source: PrincipalSource<P>,\n): PrincipalSource<P> => source;\nexport const authenticated = <P extends AuthPrincipalBase>(\n  principal: P,\n): PrincipalResult<P> => ({ outcome: \"authenticated\", principal });\nexport const absent = (): PrincipalResult<never> => ({ outcome: \"absent\" });\nexport const rejected = (failure: AuthFailure): PrincipalResult<never> => ({\n  outcome: \"rejected\",\n  failure,\n});\n\nexport class MemoKeys {\n  private readonly owners = new WeakMap<\n    object,\n    {\n      objects: WeakMap<object, number>;\n      symbols: Map<symbol, number>;\n      next: number;\n    }\n  >();\n\n  key(\n    owner: object,\n    namespace: string,\n    value: string | object | symbol,\n  ): string {\n    if (typeof value === \"string\") {\n      return JSON.stringify([namespace, \"string\", value]);\n    }\n    let identities = this.owners.get(owner);\n    if (!identities) {\n      identities = { objects: new WeakMap(), symbols: new Map(), next: 0 };\n      this.owners.set(owner, identities);\n    }\n    let id =\n      typeof value === \"symbol\"\n        ? identities.symbols.get(value)\n        : identities.objects.get(value);\n    if (id === undefined) {\n      id = ++identities.next;\n      if (typeof value === \"symbol\") {\n        identities.symbols.set(value, id);\n      } else {\n        identities.objects.set(value, id);\n      }\n    }\n    return JSON.stringify([namespace, typeof value, id]);\n  }\n}\nexport function requestHeaders(\n  call: TransportCall,\n  entry: InstanceEntry,\n): Headers {\n  const headers = new Headers(call.headers());\n  for (const name of [...headers.keys()]) {\n    if (\n      name.startsWith(\":\") ||\n      name.startsWith(\"x-nestjs-kit-better-auth-ip-\") ||\n      name === entry.bridge.clientIpHeader\n    ) {\n      headers.delete(name);\n    }\n  }\n  if (entry.bridge.clientIpHeader && call.clientIp) {\n    headers.set(entry.bridge.clientIpHeader, call.clientIp);\n  }\n  return headers;\n}\nexport function normalizeForRequest(\n  error: unknown,\n  where: \"source\" | \"policy\",\n  site: string,\n  entry: InstanceEntry,\n  headers: Headers,\n) {\n  try {\n    return normalizeThrown(error, where, site, [], entry.options.errors);\n  } catch (normalized) {\n    if (isConfigurationError(normalized)) {\n      throw normalized;\n    }\n    if (isInfrastructureError(error) && normalized === error) {\n      // A source or policy classified this failure itself, redacting only what it knew.\n      throw redactForRequest(error, {\n        headers,\n        credentialHeaders: entry.credentialHeaders,\n        exposeRawCause: entry.options.errors?.exposeRawCause,\n      });\n    }\n    throw createInfrastructureError(error, {\n      headers,\n      credentialHeaders: entry.credentialHeaders,\n      exposeRawCause: entry.options.errors?.exposeRawCause,\n    });\n  }\n}\nexport class ChainPrincipalResolver implements PrincipalResolver {\n  private readonly keys = new MemoKeys();\n\n  constructor(\n    private readonly instances: InstanceLookup,\n    private readonly scope: RequestScope,\n    private readonly transports: TransportRegistry,\n  ) {}\n\n  resolve(\n    call: TransportCall,\n    request: ResolutionRequest,\n  ): Promise<PrincipalResult> {\n    const entry = this.instances.get(request.auth.name);\n    const compute = async (): Promise<PrincipalResult> => {\n      const headers = requestHeaders(call, entry);\n      const sources = request.reclassify\n        ? entry.sources.filter(\n            (source) =>\n              source.id === request.reclassify!.sourceId &&\n              source.sessionBacked,\n          )\n        : entry.sources.filter((source) =>\n            source.kinds.some((kind) => request.accepts.has(kind)),\n          );\n      return request.auth.run(\n        {\n          cookies: call.cookies,\n          forward: \"same-credential\",\n          inbound: () => headers,\n          internal: true,\n        },\n        async () => {\n          for (const source of sources) {\n            const input = {\n              headers,\n              cookies: call.cookies,\n              transport: this.transports.idOf(call),\n              request: call.request,\n              freshness: request.freshness,\n              auth: request.auth,\n              memo: <T>(\n                key: string | object | symbol,\n                fn: () => Promise<T>,\n              ): Promise<T> =>\n                this.scope.memoPolicyIo(\n                  call.key,\n                  entry.name,\n                  this.keys.key(call.key, `source:${source.id}`, key),\n                  fn,\n                  entry.options.limits?.maxAuthorizationCallsPerRequest,\n                ),\n            };\n            try {\n              if (source.appliesTo && !source.appliesTo(input)) {\n                continue;\n              }\n              const result = await source.resolve(input);\n              if (\n                result.outcome === \"authenticated\" &&\n                (!source.kinds.includes(result.principal.kind) ||\n                  result.principal.source !== source.id ||\n                  Boolean(result.principal.delegation) !==\n                    Boolean(source.delegates))\n              ) {\n                throw new Error(\n                  `Principal source ${source.id} violated its declared principal contract`,\n                );\n              }\n              if (result.outcome !== \"absent\") {\n                return result;\n              }\n            } catch (error) {\n              const failure = normalizeForRequest(\n                error,\n                \"source\",\n                source.id,\n                entry,\n                headers,\n              );\n              if (isAuthFailure(failure)) {\n                return rejected(failure);\n              }\n              throw error;\n            }\n          }\n          return absent();\n        },\n      );\n    };\n    return request.reclassify\n      ? compute()\n      : this.scope.memoPrincipal(\n          call,\n          {\n            instance: entry.name,\n            freshness: request.freshness,\n            sourceSet: request.sourceSet,\n          },\n          compute,\n        );\n  }\n}\n","import {\n  Inject,\n  Injectable,\n  type CallHandler,\n  type ExecutionContext,\n  type NestInterceptor,\n} from \"@nestjs/common\";\nimport { Observable } from \"rxjs\";\nimport type { PrincipalReading, TransportCall } from \"./auth-contracts.js\";\nimport { AUTH_ENHANCER, READER_CONTEXT, SCOPE_CORE } from \"./auth-tokens.js\";\nimport type { ScopeView } from \"./bridge-protocol.js\";\nimport type { InstanceLookup } from \"./instance-registry.js\";\nimport type { PrincipalReadings } from \"./principal-readings.js\";\nimport { requestHeaders } from \"./principal-resolver.js\";\nimport type { RequestScope, ScopeState } from \"./request-scope.js\";\nimport type { RoutePlanner } from \"./route-planner.js\";\nimport type { TransportRegistry } from \"./transport-registry.js\";\n\n@Injectable()\nexport class BetterAuthScopeInterceptor implements NestInterceptor {\n  static readonly [AUTH_ENHANCER] = \"scope\";\n  readonly [AUTH_ENHANCER] = \"scope\";\n\n  constructor(\n    @Inject(SCOPE_CORE) private readonly core: Pick<ScopeCore, \"intercept\">,\n  ) {}\n\n  intercept(context: ExecutionContext, next: CallHandler): Observable<unknown> {\n    return this.core.intercept(context, next);\n  }\n}\nexport class ScopeCore implements NestInterceptor {\n  constructor(\n    private readonly instances: InstanceLookup,\n    private readonly planner: RoutePlanner,\n    private readonly transports: TransportRegistry,\n    private readonly scope: RequestScope,\n    private readonly readings: PrincipalReadings,\n  ) {}\n\n  intercept(context: ExecutionContext, next: CallHandler): Observable<unknown> {\n    const plan = this.planner.forContext(context);\n    const entry = this.instances.get(plan.instance);\n    let described = false;\n    let call: TransportCall | undefined;\n    const getCall = (): TransportCall | undefined => {\n      if (!described) {\n        const transport = this.transports.find(context);\n        call = transport\n          ? this.transports.describe(context, transport)\n          : undefined;\n        described = true;\n      }\n      return call;\n    };\n    let reading: PrincipalReading | undefined;\n    const read = (): PrincipalReading => {\n      if (reading) {\n        return reading;\n      }\n      const lineage = this.transports.find(context)?.lineage?.(context);\n      reading = this.readings.read({\n        args: context.getArgs(),\n        plan,\n        lineage,\n        ...(plan.access === \"public\" || plan.access === \"inherit\"\n          ? {}\n          : { call: getCall() }),\n      });\n      return reading;\n    };\n    const instances = this.instances;\n    const view: ScopeView = {\n      get cookies() {\n        return getCall()?.cookies ?? null;\n      },\n      forward: plan.forwardDirectCalls ? \"same-credential\" : \"none\",\n      internal: false,\n      get inbound() {\n        return () => {\n          const call = getCall();\n          return call ? requestHeaders(call, entry) : new Headers();\n        };\n      },\n      get browserHeaders() {\n        const browser = getCall()?.browser;\n        return browser ? () => browser.headers() : undefined;\n      },\n      get checkCallerSession() {\n        if (plan.originCheck === \"off\") {\n          return undefined;\n        }\n        const browser = getCall()?.browser;\n        return browser\n          ? (path: string, instance: string) =>\n              instances\n                .get(instance)\n                .origin.assertCallerSession(browser, path, instance)\n          : undefined;\n      },\n    };\n    const state: ScopeState = {\n      view,\n      plan,\n      reading: read,\n      get call() {\n        return getCall();\n      },\n    };\n    const args = context.getArgs();\n    const bridge = {\n      args: [...args],\n      reading: read,\n      scope: this.scope,\n      readings: this.readings,\n    };\n    for (const arg of [args, ...args]) {\n      if (\n        arg &&\n        (typeof arg === \"object\" || typeof arg === \"function\") &&\n        Object.isExtensible(arg)\n      ) {\n        Object.defineProperty(arg, READER_CONTEXT, {\n          value: bridge,\n          configurable: true,\n        });\n      }\n    }\n    return new Observable((subscriber) =>\n      this.scope.run(state, () => {\n        const subscription = next.handle().subscribe({\n          next: (value) => this.scope.run(state, () => subscriber.next(value)),\n          error: (error) =>\n            this.scope.run(state, () => subscriber.error(error)),\n          complete: () => this.scope.run(state, () => subscriber.complete()),\n        });\n        return () => this.scope.run(state, () => subscription.unsubscribe());\n      }),\n    );\n  }\n}\n"],"mappings":";;;;;AAqBA,MAAa,yBACX,WACuB;AACzB,MAAa,iBACX,eACwB;CAAE,SAAS;CAAiB;AAAU;AAChE,MAAa,gBAAwC,EAAE,SAAS,SAAS;AACzE,MAAa,YAAY,aAAkD;CACzE,SAAS;CACT;AACF;AAEA,IAAa,WAAb,MAAsB;CACpB,yBAA0B,IAAI,QAO5B;CAEF,IACE,OACA,WACA,OACQ;EACR,IAAI,OAAO,UAAU,UACnB,OAAO,KAAK,UAAU;GAAC;GAAW;GAAU;EAAK,CAAC;EAEpD,IAAI,aAAa,KAAK,OAAO,IAAI,KAAK;EACtC,IAAI,CAAC,YAAY;GACf,aAAa;IAAE,yBAAS,IAAI,QAAQ;IAAG,yBAAS,IAAI,IAAI;IAAG,MAAM;GAAE;GACnE,KAAK,OAAO,IAAI,OAAO,UAAU;EACnC;EACA,IAAI,KACF,OAAO,UAAU,WACb,WAAW,QAAQ,IAAI,KAAK,IAC5B,WAAW,QAAQ,IAAI,KAAK;EAClC,IAAI,OAAO,KAAA,GAAW;GACpB,KAAK,EAAE,WAAW;GAClB,IAAI,OAAO,UAAU,UACnB,WAAW,QAAQ,IAAI,OAAO,EAAE;QAEhC,WAAW,QAAQ,IAAI,OAAO,EAAE;EAEpC;EACA,OAAO,KAAK,UAAU;GAAC;GAAW,OAAO;GAAO;EAAE,CAAC;CACrD;AACF;AACA,SAAgB,eACd,MACA,OACS;CACT,MAAM,UAAU,IAAI,QAAQ,KAAK,QAAQ,CAAC;CAC1C,KAAK,MAAM,QAAQ,CAAC,GAAG,QAAQ,KAAK,CAAC,GACnC,IACE,KAAK,WAAW,GAAG,KACnB,KAAK,WAAW,8BAA8B,KAC9C,SAAS,MAAM,OAAO,gBAEtB,QAAQ,OAAO,IAAI;CAGvB,IAAI,MAAM,OAAO,kBAAkB,KAAK,UACtC,QAAQ,IAAI,MAAM,OAAO,gBAAgB,KAAK,QAAQ;CAExD,OAAO;AACT;AACA,SAAgB,oBACd,OACA,OACA,MACA,OACA,SACA;CACA,IAAI;EACF,OAAOA,oBAAAA,gBAAgB,OAAO,OAAO,MAAM,CAAC,GAAG,MAAM,QAAQ,MAAM;CACrE,SAAS,YAAY;EACnB,IAAIC,oBAAAA,qBAAqB,UAAU,GACjC,MAAM;EAER,IAAIC,oBAAAA,sBAAsB,KAAK,KAAK,eAAe,OAEjD,MAAMC,oBAAAA,iBAAiB,OAAO;GAC5B;GACA,mBAAmB,MAAM;GACzB,gBAAgB,MAAM,QAAQ,QAAQ;EACxC,CAAC;EAEH,MAAMC,oBAAAA,0BAA0B,OAAO;GACrC;GACA,mBAAmB,MAAM;GACzB,gBAAgB,MAAM,QAAQ,QAAQ;EACxC,CAAC;CACH;AACF;AACA,IAAa,yBAAb,MAAiE;CAI5C;CACA;CACA;CALnB,OAAwB,IAAI,SAAS;CAErC,YACE,WACA,OACA,YACA;EAHiB,KAAA,YAAA;EACA,KAAA,QAAA;EACA,KAAA,aAAA;CAChB;CAEH,QACE,MACA,SAC0B;EAC1B,MAAM,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,IAAI;EAClD,MAAM,UAAU,YAAsC;GACpD,MAAM,UAAU,eAAe,MAAM,KAAK;GAC1C,MAAM,UAAU,QAAQ,aACpB,MAAM,QAAQ,QACX,WACC,OAAO,OAAO,QAAQ,WAAY,YAClC,OAAO,aACX,IACA,MAAM,QAAQ,QAAQ,WACpB,OAAO,MAAM,MAAM,SAAS,QAAQ,QAAQ,IAAI,IAAI,CAAC,CACvD;GACJ,OAAO,QAAQ,KAAK,IAClB;IACE,SAAS,KAAK;IACd,SAAS;IACT,eAAe;IACf,UAAU;GACZ,GACA,YAAY;IACV,KAAK,MAAM,UAAU,SAAS;KAC5B,MAAM,QAAQ;MACZ;MACA,SAAS,KAAK;MACd,WAAW,KAAK,WAAW,KAAK,IAAI;MACpC,SAAS,KAAK;MACd,WAAW,QAAQ;MACnB,MAAM,QAAQ;MACd,OACE,KACA,OAEA,KAAK,MAAM,aACT,KAAK,KACL,MAAM,MACN,KAAK,KAAK,IAAI,KAAK,KAAK,UAAU,OAAO,MAAM,GAAG,GAClD,IACA,MAAM,QAAQ,QAAQ,+BACxB;KACJ;KACA,IAAI;MACF,IAAI,OAAO,aAAa,CAAC,OAAO,UAAU,KAAK,GAC7C;MAEF,MAAM,SAAS,MAAM,OAAO,QAAQ,KAAK;MACzC,IACE,OAAO,YAAY,oBAClB,CAAC,OAAO,MAAM,SAAS,OAAO,UAAU,IAAI,KAC3C,OAAO,UAAU,WAAW,OAAO,MACnC,QAAQ,OAAO,UAAU,UAAU,MACjC,QAAQ,OAAO,SAAS,IAE5B,MAAM,IAAI,MACR,oBAAoB,OAAO,GAAG,0CAChC;MAEF,IAAI,OAAO,YAAY,UACrB,OAAO;KAEX,SAAS,OAAO;MACd,MAAM,UAAU,oBACd,OACA,UACA,OAAO,IACP,OACA,OACF;MACA,IAAIC,oBAAAA,cAAc,OAAO,GACvB,OAAO,SAAS,OAAO;MAEzB,MAAM;KACR;IACF;IACA,OAAO,OAAO;GAChB,CACF;EACF;EACA,OAAO,QAAQ,aACX,QAAQ,IACR,KAAK,MAAM,cACT,MACA;GACE,UAAU,MAAM;GAChB,WAAW,QAAQ;GACnB,WAAW,QAAQ;EACrB,GACA,OACF;CACN;AACF;;;ACzMO,IAAM,6BAAN,MAAM,2BAAsD;CAK1B;CAJvC,QAAiBC,iBAAAA,iBAAiB;CAClC,CAAUA,iBAAAA,iBAAiB;CAE3B,YACE,MACA;EADqC,KAAA,OAAA;CACpC;CAEH,UAAU,SAA2B,MAAwC;EAC3E,OAAO,KAAK,KAAK,UAAU,SAAS,IAAI;CAC1C;AACF;;EAZCC,GAAAA,eAAAA,WAAAA,CAAW;CAMPC,iBAAAA,gBAAAA,IAAAA,GAAAA,eAAAA,OAAAA,CAAOC,iBAAAA,UAAU,CAAA;;;AAOtB,IAAa,YAAb,MAAkD;CAE7B;CACA;CACA;CACA;CACA;CALnB,YACE,WACA,SACA,YACA,OACA,UACA;EALiB,KAAA,YAAA;EACA,KAAA,UAAA;EACA,KAAA,aAAA;EACA,KAAA,QAAA;EACA,KAAA,WAAA;CAChB;CAEH,UAAU,SAA2B,MAAwC;EAC3E,MAAM,OAAO,KAAK,QAAQ,WAAW,OAAO;EAC5C,MAAM,QAAQ,KAAK,UAAU,IAAI,KAAK,QAAQ;EAC9C,IAAI,YAAY;EAChB,IAAI;EACJ,MAAM,gBAA2C;GAC/C,IAAI,CAAC,WAAW;IACd,MAAM,YAAY,KAAK,WAAW,KAAK,OAAO;IAC9C,OAAO,YACH,KAAK,WAAW,SAAS,SAAS,SAAS,IAC3C,KAAA;IACJ,YAAY;GACd;GACA,OAAO;EACT;EACA,IAAI;EACJ,MAAM,aAA+B;GACnC,IAAI,SACF,OAAO;GAET,MAAM,UAAU,KAAK,WAAW,KAAK,OAAO,CAAC,EAAE,UAAU,OAAO;GAChE,UAAU,KAAK,SAAS,KAAK;IAC3B,MAAM,QAAQ,QAAQ;IACtB;IACA;IACA,GAAI,KAAK,WAAW,YAAY,KAAK,WAAW,YAC5C,CAAC,IACD,EAAE,MAAM,QAAQ,EAAE;GACxB,CAAC;GACD,OAAO;EACT;EACA,MAAM,YAAY,KAAK;EA8BvB,MAAM,QAAoB;GACxB,MAAA;IA7BA,IAAI,UAAU;KACZ,OAAO,QAAQ,CAAC,EAAE,WAAW;IAC/B;IACA,SAAS,KAAK,qBAAqB,oBAAoB;IACvD,UAAU;IACV,IAAI,UAAU;KACZ,aAAa;MACX,MAAM,OAAO,QAAQ;MACrB,OAAO,OAAO,eAAe,MAAM,KAAK,IAAI,IAAI,QAAQ;KAC1D;IACF;IACA,IAAI,iBAAiB;KACnB,MAAM,UAAU,QAAQ,CAAC,EAAE;KAC3B,OAAO,gBAAgB,QAAQ,QAAQ,IAAI,KAAA;IAC7C;IACA,IAAI,qBAAqB;KACvB,IAAI,KAAK,gBAAgB,OACvB;KAEF,MAAM,UAAU,QAAQ,CAAC,EAAE;KAC3B,OAAO,WACF,MAAc,aACb,UACG,IAAI,QAAQ,CAAC,CACb,OAAO,oBAAoB,SAAS,MAAM,QAAQ,IACvD,KAAA;IACN;GAGG;GACH;GACA,SAAS;GACT,IAAI,OAAO;IACT,OAAO,QAAQ;GACjB;EACF;EACA,MAAM,OAAO,QAAQ,QAAQ;EAC7B,MAAM,SAAS;GACb,MAAM,CAAC,GAAG,IAAI;GACd,SAAS;GACT,OAAO,KAAK;GACZ,UAAU,KAAK;EACjB;EACA,KAAK,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,GAC9B,IACE,QACC,OAAO,QAAQ,YAAY,OAAO,QAAQ,eAC3C,OAAO,aAAa,GAAG,GAEvB,OAAO,eAAe,KAAKC,iBAAAA,gBAAgB;GACzC,OAAO;GACP,cAAc;EAChB,CAAC;EAGL,OAAO,IAAIC,KAAAA,YAAY,eACrB,KAAK,MAAM,IAAI,aAAa;GAC1B,MAAM,eAAe,KAAK,OAAO,CAAC,CAAC,UAAU;IAC3C,OAAO,UAAU,KAAK,MAAM,IAAI,aAAa,WAAW,KAAK,KAAK,CAAC;IACnE,QAAQ,UACN,KAAK,MAAM,IAAI,aAAa,WAAW,MAAM,KAAK,CAAC;IACrD,gBAAgB,KAAK,MAAM,IAAI,aAAa,WAAW,SAAS,CAAC;GACnE,CAAC;GACD,aAAa,KAAK,MAAM,IAAI,aAAa,aAAa,YAAY,CAAC;EACrE,CAAC,CACH;CACF;AACF"}
+{"version":3,"file":"auth-scope-interceptor-Bui20-Ps.cjs","names":["normalizeThrown","isConfigurationError","isInfrastructureError","redactForRequest","createInfrastructureError","isAuthFailure","AUTH_ENHANCER","Injectable","Inject","SCOPE_CORE","READER_CONTEXT","Observable"],"sources":["../src/principal-resolver.ts","../src/auth-scope-interceptor.ts"],"sourcesContent":["import type {\n  AuthPrincipalBase,\n  PrincipalResolver,\n  PrincipalResult,\n  PrincipalSource,\n  ResolutionRequest,\n  TransportCall,\n} from \"./auth-contracts.js\";\nimport {\n  type AuthFailure,\n  isAuthFailure,\n  normalizeThrown,\n  createInfrastructureError,\n  isConfigurationError,\n  isInfrastructureError,\n  redactForRequest,\n} from \"./auth-errors.js\";\nimport type { InstanceEntry, InstanceLookup } from \"./instance-registry.js\";\nimport type { TransportRegistry } from \"./transport-registry.js\";\nimport type { RequestScope } from \"./request-scope.js\";\n\nexport const definePrincipalSource = <P extends AuthPrincipalBase>(\n  source: PrincipalSource<P>,\n): PrincipalSource<P> => source;\nexport const authenticated = <P extends AuthPrincipalBase>(\n  principal: P,\n): PrincipalResult<P> => ({ outcome: \"authenticated\", principal });\nexport const absent = (): PrincipalResult<never> => ({ outcome: \"absent\" });\nexport const rejected = (failure: AuthFailure): PrincipalResult<never> => ({\n  outcome: \"rejected\",\n  failure,\n});\n\nexport class MemoKeys {\n  private readonly owners = new WeakMap<\n    object,\n    {\n      objects: WeakMap<object, number>;\n      symbols: Map<symbol, number>;\n      next: number;\n    }\n  >();\n\n  key(\n    owner: object,\n    namespace: string,\n    value: string | object | symbol,\n  ): string {\n    if (typeof value === \"string\") {\n      return JSON.stringify([namespace, \"string\", value]);\n    }\n    let identities = this.owners.get(owner);\n    if (!identities) {\n      identities = { objects: new WeakMap(), symbols: new Map(), next: 0 };\n      this.owners.set(owner, identities);\n    }\n    let id =\n      typeof value === \"symbol\"\n        ? identities.symbols.get(value)\n        : identities.objects.get(value);\n    if (id === undefined) {\n      id = ++identities.next;\n      if (typeof value === \"symbol\") {\n        identities.symbols.set(value, id);\n      } else {\n        identities.objects.set(value, id);\n      }\n    }\n    return JSON.stringify([namespace, typeof value, id]);\n  }\n}\nexport function requestHeaders(\n  call: TransportCall,\n  entry: InstanceEntry,\n): Headers {\n  const headers = new Headers(call.headers());\n  for (const name of [...headers.keys()]) {\n    if (\n      name.startsWith(\":\") ||\n      name.startsWith(\"x-nestjs-kit-better-auth-ip-\") ||\n      name === entry.bridge.clientIpHeader\n    ) {\n      headers.delete(name);\n    }\n  }\n  if (entry.bridge.clientIpHeader && call.clientIp) {\n    headers.set(entry.bridge.clientIpHeader, call.clientIp);\n  }\n  return headers;\n}\nexport function normalizeForRequest(\n  error: unknown,\n  where: \"source\" | \"policy\",\n  site: string,\n  entry: InstanceEntry,\n  headers: Headers,\n) {\n  try {\n    return normalizeThrown(error, where, site, [], entry.options.errors);\n  } catch (normalized) {\n    if (isConfigurationError(normalized)) {\n      throw normalized;\n    }\n    if (isInfrastructureError(error) && normalized === error) {\n      // A source or policy classified this failure itself, redacting only what it knew.\n      throw redactForRequest(error, {\n        headers,\n        credentialHeaders: entry.credentialHeaders,\n        exposeRawCause: entry.options.errors?.exposeRawCause,\n      });\n    }\n    throw createInfrastructureError(error, {\n      headers,\n      credentialHeaders: entry.credentialHeaders,\n      exposeRawCause: entry.options.errors?.exposeRawCause,\n    });\n  }\n}\nexport class ChainPrincipalResolver implements PrincipalResolver {\n  private readonly keys = new MemoKeys();\n\n  constructor(\n    private readonly instances: InstanceLookup,\n    private readonly scope: RequestScope,\n    private readonly transports: TransportRegistry,\n  ) {}\n\n  resolve(\n    call: TransportCall,\n    request: ResolutionRequest,\n  ): Promise<PrincipalResult> {\n    const entry = this.instances.get(request.auth.name);\n    const compute = async (): Promise<PrincipalResult> => {\n      const headers = requestHeaders(call, entry);\n      const sources = request.reclassify\n        ? entry.sources.filter(\n            (source) =>\n              source.id === request.reclassify!.sourceId &&\n              source.sessionBacked,\n          )\n        : entry.sources.filter((source) =>\n            source.kinds.some((kind) => request.accepts.has(kind)),\n          );\n      return request.auth.run(\n        {\n          cookies: call.cookies,\n          forward: \"same-credential\",\n          inbound: () => headers,\n          internal: true,\n        },\n        async () => {\n          for (const source of sources) {\n            const input = {\n              headers,\n              cookies: call.cookies,\n              transport: this.transports.idOf(call),\n              request: call.request,\n              freshness: request.freshness,\n              auth: request.auth,\n              memo: <T>(\n                key: string | object | symbol,\n                fn: () => Promise<T>,\n              ): Promise<T> =>\n                this.scope.memoPolicyIo(\n                  call.key,\n                  entry.name,\n                  this.keys.key(call.key, `source:${source.id}`, key),\n                  fn,\n                  entry.options.limits?.maxAuthorizationCallsPerRequest,\n                ),\n            };\n            try {\n              if (source.appliesTo && !source.appliesTo(input)) {\n                continue;\n              }\n              const result = await source.resolve(input);\n              if (\n                result.outcome === \"authenticated\" &&\n                (!source.kinds.includes(result.principal.kind) ||\n                  result.principal.source !== source.id ||\n                  Boolean(result.principal.delegation) !==\n                    Boolean(source.delegates))\n              ) {\n                throw new Error(\n                  `Principal source ${source.id} violated its declared principal contract`,\n                );\n              }\n              if (result.outcome !== \"absent\") {\n                return result;\n              }\n            } catch (error) {\n              const failure = normalizeForRequest(\n                error,\n                \"source\",\n                source.id,\n                entry,\n                headers,\n              );\n              if (isAuthFailure(failure)) {\n                return rejected(failure);\n              }\n              throw error;\n            }\n          }\n          return absent();\n        },\n      );\n    };\n    return request.reclassify\n      ? compute()\n      : this.scope.memoPrincipal(\n          call,\n          {\n            instance: entry.name,\n            freshness: request.freshness,\n            sourceSet: request.sourceSet,\n          },\n          compute,\n        );\n  }\n}\n","import {\n  Inject,\n  Injectable,\n  type CallHandler,\n  type ExecutionContext,\n  type NestInterceptor,\n} from \"@nestjs/common\";\nimport { Observable } from \"rxjs\";\nimport type { PrincipalReading, TransportCall } from \"./auth-contracts.js\";\nimport { AUTH_ENHANCER, READER_CONTEXT, SCOPE_CORE } from \"./auth-tokens.js\";\nimport type { ScopeView } from \"./bridge-protocol.js\";\nimport type { InstanceLookup } from \"./instance-registry.js\";\nimport type { PrincipalReadings } from \"./principal-readings.js\";\nimport { requestHeaders } from \"./principal-resolver.js\";\nimport type { RequestScope, ScopeState } from \"./request-scope.js\";\nimport type { RoutePlanner } from \"./route-planner.js\";\nimport type { TransportRegistry } from \"./transport-registry.js\";\n\n@Injectable()\nexport class BetterAuthScopeInterceptor implements NestInterceptor {\n  static readonly [AUTH_ENHANCER] = \"scope\";\n  readonly [AUTH_ENHANCER] = \"scope\";\n\n  constructor(\n    @Inject(SCOPE_CORE) private readonly core: Pick<ScopeCore, \"intercept\">,\n  ) {}\n\n  intercept(context: ExecutionContext, next: CallHandler): Observable<unknown> {\n    return this.core.intercept(context, next);\n  }\n}\nexport class ScopeCore implements NestInterceptor {\n  constructor(\n    private readonly instances: InstanceLookup,\n    private readonly planner: RoutePlanner,\n    private readonly transports: TransportRegistry,\n    private readonly scope: RequestScope,\n    private readonly readings: PrincipalReadings,\n  ) {}\n\n  intercept(context: ExecutionContext, next: CallHandler): Observable<unknown> {\n    const plan = this.planner.forContext(context);\n    const entry = this.instances.get(plan.instance);\n    let described = false;\n    let call: TransportCall | undefined;\n    const getCall = (): TransportCall | undefined => {\n      if (!described) {\n        const transport = this.transports.find(context);\n        call = transport\n          ? this.transports.describe(context, transport)\n          : undefined;\n        described = true;\n      }\n      return call;\n    };\n    let reading: PrincipalReading | undefined;\n    const read = (): PrincipalReading => {\n      if (reading) {\n        return reading;\n      }\n      const lineage = this.transports.find(context)?.lineage?.(context);\n      reading = this.readings.read({\n        args: context.getArgs(),\n        plan,\n        lineage,\n        ...(plan.access === \"public\" || plan.access === \"inherit\"\n          ? {}\n          : { call: getCall() }),\n      });\n      return reading;\n    };\n    const instances = this.instances;\n    const view: ScopeView = {\n      get cookies() {\n        return getCall()?.cookies ?? null;\n      },\n      forward: plan.forwardDirectCalls ? \"same-credential\" : \"none\",\n      internal: false,\n      get inbound() {\n        return () => {\n          const call = getCall();\n          return call ? requestHeaders(call, entry) : new Headers();\n        };\n      },\n      get browserHeaders() {\n        const browser = getCall()?.browser;\n        return browser ? () => browser.headers() : undefined;\n      },\n      get checkCallerSession() {\n        if (plan.originCheck === \"off\") {\n          return undefined;\n        }\n        const browser = getCall()?.browser;\n        return browser\n          ? (path: string, instance: string) =>\n              instances\n                .get(instance)\n                .origin.assertCallerSession(browser, path, instance)\n          : undefined;\n      },\n    };\n    const state: ScopeState = {\n      view,\n      plan,\n      reading: read,\n      get call() {\n        return getCall();\n      },\n    };\n    const args = context.getArgs();\n    const bridge = {\n      args: [...args],\n      reading: read,\n      scope: this.scope,\n      readings: this.readings,\n    };\n    for (const arg of [args, ...args]) {\n      if (\n        arg &&\n        (typeof arg === \"object\" || typeof arg === \"function\") &&\n        Object.isExtensible(arg)\n      ) {\n        Object.defineProperty(arg, READER_CONTEXT, {\n          value: bridge,\n          configurable: true,\n        });\n      }\n    }\n    return new Observable((subscriber) =>\n      this.scope.run(state, () => {\n        const subscription = next.handle().subscribe({\n          next: (value) => this.scope.run(state, () => subscriber.next(value)),\n          error: (error) =>\n            this.scope.run(state, () => subscriber.error(error)),\n          complete: () => this.scope.run(state, () => subscriber.complete()),\n        });\n        return () => this.scope.run(state, () => subscription.unsubscribe());\n      }),\n    );\n  }\n}\n"],"mappings":";;;;;AAqBA,MAAa,yBACX,WACuB;AACzB,MAAa,iBACX,eACwB;CAAE,SAAS;CAAiB;AAAU;AAChE,MAAa,gBAAwC,EAAE,SAAS,SAAS;AACzE,MAAa,YAAY,aAAkD;CACzE,SAAS;CACT;AACF;AAEA,IAAa,WAAb,MAAsB;CACpB,yBAA0B,IAAI,QAO5B;CAEF,IACE,OACA,WACA,OACQ;EACR,IAAI,OAAO,UAAU,UACnB,OAAO,KAAK,UAAU;GAAC;GAAW;GAAU;EAAK,CAAC;EAEpD,IAAI,aAAa,KAAK,OAAO,IAAI,KAAK;EACtC,IAAI,CAAC,YAAY;GACf,aAAa;IAAE,yBAAS,IAAI,QAAQ;IAAG,yBAAS,IAAI,IAAI;IAAG,MAAM;GAAE;GACnE,KAAK,OAAO,IAAI,OAAO,UAAU;EACnC;EACA,IAAI,KACF,OAAO,UAAU,WACb,WAAW,QAAQ,IAAI,KAAK,IAC5B,WAAW,QAAQ,IAAI,KAAK;EAClC,IAAI,OAAO,KAAA,GAAW;GACpB,KAAK,EAAE,WAAW;GAClB,IAAI,OAAO,UAAU,UACnB,WAAW,QAAQ,IAAI,OAAO,EAAE;QAEhC,WAAW,QAAQ,IAAI,OAAO,EAAE;EAEpC;EACA,OAAO,KAAK,UAAU;GAAC;GAAW,OAAO;GAAO;EAAE,CAAC;CACrD;AACF;AACA,SAAgB,eACd,MACA,OACS;CACT,MAAM,UAAU,IAAI,QAAQ,KAAK,QAAQ,CAAC;CAC1C,KAAK,MAAM,QAAQ,CAAC,GAAG,QAAQ,KAAK,CAAC,GACnC,IACE,KAAK,WAAW,GAAG,KACnB,KAAK,WAAW,8BAA8B,KAC9C,SAAS,MAAM,OAAO,gBAEtB,QAAQ,OAAO,IAAI;CAGvB,IAAI,MAAM,OAAO,kBAAkB,KAAK,UACtC,QAAQ,IAAI,MAAM,OAAO,gBAAgB,KAAK,QAAQ;CAExD,OAAO;AACT;AACA,SAAgB,oBACd,OACA,OACA,MACA,OACA,SACA;CACA,IAAI;EACF,OAAOA,oBAAAA,gBAAgB,OAAO,OAAO,MAAM,CAAC,GAAG,MAAM,QAAQ,MAAM;CACrE,SAAS,YAAY;EACnB,IAAIC,oBAAAA,qBAAqB,UAAU,GACjC,MAAM;EAER,IAAIC,oBAAAA,sBAAsB,KAAK,KAAK,eAAe,OAEjD,MAAMC,oBAAAA,iBAAiB,OAAO;GAC5B;GACA,mBAAmB,MAAM;GACzB,gBAAgB,MAAM,QAAQ,QAAQ;EACxC,CAAC;EAEH,MAAMC,oBAAAA,0BAA0B,OAAO;GACrC;GACA,mBAAmB,MAAM;GACzB,gBAAgB,MAAM,QAAQ,QAAQ;EACxC,CAAC;CACH;AACF;AACA,IAAa,yBAAb,MAAiE;CAI5C;CACA;CACA;CALnB,OAAwB,IAAI,SAAS;CAErC,YACE,WACA,OACA,YACA;EAHiB,KAAA,YAAA;EACA,KAAA,QAAA;EACA,KAAA,aAAA;CAChB;CAEH,QACE,MACA,SAC0B;EAC1B,MAAM,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,IAAI;EAClD,MAAM,UAAU,YAAsC;GACpD,MAAM,UAAU,eAAe,MAAM,KAAK;GAC1C,MAAM,UAAU,QAAQ,aACpB,MAAM,QAAQ,QACX,WACC,OAAO,OAAO,QAAQ,WAAY,YAClC,OAAO,aACX,IACA,MAAM,QAAQ,QAAQ,WACpB,OAAO,MAAM,MAAM,SAAS,QAAQ,QAAQ,IAAI,IAAI,CAAC,CACvD;GACJ,OAAO,QAAQ,KAAK,IAClB;IACE,SAAS,KAAK;IACd,SAAS;IACT,eAAe;IACf,UAAU;GACZ,GACA,YAAY;IACV,KAAK,MAAM,UAAU,SAAS;KAC5B,MAAM,QAAQ;MACZ;MACA,SAAS,KAAK;MACd,WAAW,KAAK,WAAW,KAAK,IAAI;MACpC,SAAS,KAAK;MACd,WAAW,QAAQ;MACnB,MAAM,QAAQ;MACd,OACE,KACA,OAEA,KAAK,MAAM,aACT,KAAK,KACL,MAAM,MACN,KAAK,KAAK,IAAI,KAAK,KAAK,UAAU,OAAO,MAAM,GAAG,GAClD,IACA,MAAM,QAAQ,QAAQ,+BACxB;KACJ;KACA,IAAI;MACF,IAAI,OAAO,aAAa,CAAC,OAAO,UAAU,KAAK,GAC7C;MAEF,MAAM,SAAS,MAAM,OAAO,QAAQ,KAAK;MACzC,IACE,OAAO,YAAY,oBAClB,CAAC,OAAO,MAAM,SAAS,OAAO,UAAU,IAAI,KAC3C,OAAO,UAAU,WAAW,OAAO,MACnC,QAAQ,OAAO,UAAU,UAAU,MACjC,QAAQ,OAAO,SAAS,IAE5B,MAAM,IAAI,MACR,oBAAoB,OAAO,GAAG,0CAChC;MAEF,IAAI,OAAO,YAAY,UACrB,OAAO;KAEX,SAAS,OAAO;MACd,MAAM,UAAU,oBACd,OACA,UACA,OAAO,IACP,OACA,OACF;MACA,IAAIC,oBAAAA,cAAc,OAAO,GACvB,OAAO,SAAS,OAAO;MAEzB,MAAM;KACR;IACF;IACA,OAAO,OAAO;GAChB,CACF;EACF;EACA,OAAO,QAAQ,aACX,QAAQ,IACR,KAAK,MAAM,cACT,MACA;GACE,UAAU,MAAM;GAChB,WAAW,QAAQ;GACnB,WAAW,QAAQ;EACrB,GACA,OACF;CACN;AACF;;ACzMO,IAAM,6BAAN,MAAM,2BAAsD;CAK1B;CAJvC,QAAiBC,iBAAAA,iBAAiB;CAClC,CAAUA,iBAAAA,iBAAiB;CAE3B,YACE,MACA;EADqC,KAAA,OAAA;CACpC;CAEH,UAAU,SAA2B,MAAwC;EAC3E,OAAO,KAAK,KAAK,UAAU,SAAS,IAAI;CAC1C;AACF;;EAZCC,GAAAA,eAAAA,WAAAA,CAAW;CAMPC,iBAAAA,gBAAAA,IAAAA,GAAAA,eAAAA,OAAAA,CAAOC,iBAAAA,UAAU,CAAA;;;AAOtB,IAAa,YAAb,MAAkD;CAE7B;CACA;CACA;CACA;CACA;CALnB,YACE,WACA,SACA,YACA,OACA,UACA;EALiB,KAAA,YAAA;EACA,KAAA,UAAA;EACA,KAAA,aAAA;EACA,KAAA,QAAA;EACA,KAAA,WAAA;CAChB;CAEH,UAAU,SAA2B,MAAwC;EAC3E,MAAM,OAAO,KAAK,QAAQ,WAAW,OAAO;EAC5C,MAAM,QAAQ,KAAK,UAAU,IAAI,KAAK,QAAQ;EAC9C,IAAI,YAAY;EAChB,IAAI;EACJ,MAAM,gBAA2C;GAC/C,IAAI,CAAC,WAAW;IACd,MAAM,YAAY,KAAK,WAAW,KAAK,OAAO;IAC9C,OAAO,YACH,KAAK,WAAW,SAAS,SAAS,SAAS,IAC3C,KAAA;IACJ,YAAY;GACd;GACA,OAAO;EACT;EACA,IAAI;EACJ,MAAM,aAA+B;GACnC,IAAI,SACF,OAAO;GAET,MAAM,UAAU,KAAK,WAAW,KAAK,OAAO,CAAC,EAAE,UAAU,OAAO;GAChE,UAAU,KAAK,SAAS,KAAK;IAC3B,MAAM,QAAQ,QAAQ;IACtB;IACA;IACA,GAAI,KAAK,WAAW,YAAY,KAAK,WAAW,YAC5C,CAAC,IACD,EAAE,MAAM,QAAQ,EAAE;GACxB,CAAC;GACD,OAAO;EACT;EACA,MAAM,YAAY,KAAK;EA8BvB,MAAM,QAAoB;GACxB,MAAA;IA7BA,IAAI,UAAU;KACZ,OAAO,QAAQ,CAAC,EAAE,WAAW;IAC/B;IACA,SAAS,KAAK,qBAAqB,oBAAoB;IACvD,UAAU;IACV,IAAI,UAAU;KACZ,aAAa;MACX,MAAM,OAAO,QAAQ;MACrB,OAAO,OAAO,eAAe,MAAM,KAAK,IAAI,IAAI,QAAQ;KAC1D;IACF;IACA,IAAI,iBAAiB;KACnB,MAAM,UAAU,QAAQ,CAAC,EAAE;KAC3B,OAAO,gBAAgB,QAAQ,QAAQ,IAAI,KAAA;IAC7C;IACA,IAAI,qBAAqB;KACvB,IAAI,KAAK,gBAAgB,OACvB;KAEF,MAAM,UAAU,QAAQ,CAAC,EAAE;KAC3B,OAAO,WACF,MAAc,aACb,UACG,IAAI,QAAQ,CAAC,CACb,OAAO,oBAAoB,SAAS,MAAM,QAAQ,IACvD,KAAA;IACN;GAGG;GACH;GACA,SAAS;GACT,IAAI,OAAO;IACT,OAAO,QAAQ;GACjB;EACF;EACA,MAAM,OAAO,QAAQ,QAAQ;EAC7B,MAAM,SAAS;GACb,MAAM,CAAC,GAAG,IAAI;GACd,SAAS;GACT,OAAO,KAAK;GACZ,UAAU,KAAK;EACjB;EACA,KAAK,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,GAC9B,IACE,QACC,OAAO,QAAQ,YAAY,OAAO,QAAQ,eAC3C,OAAO,aAAa,GAAG,GAEvB,OAAO,eAAe,KAAKC,iBAAAA,gBAAgB;GACzC,OAAO;GACP,cAAc;EAChB,CAAC;EAGL,OAAO,IAAIC,KAAAA,YAAY,eACrB,KAAK,MAAM,IAAI,aAAa;GAC1B,MAAM,eAAe,KAAK,OAAO,CAAC,CAAC,UAAU;IAC3C,OAAO,UAAU,KAAK,MAAM,IAAI,aAAa,WAAW,KAAK,KAAK,CAAC;IACnE,QAAQ,UACN,KAAK,MAAM,IAAI,aAAa,WAAW,MAAM,KAAK,CAAC;IACrD,gBAAgB,KAAK,MAAM,IAAI,aAAa,WAAW,SAAS,CAAC;GACnE,CAAC;GACD,aAAa,KAAK,MAAM,IAAI,aAAa,aAAa,YAAY,CAAC;EACrE,CAAC,CACH;CACF;AACF"}

package/dist/{auth-scope-interceptor-DYPn3b8M.mjs → auth-scope-interceptor-CvCQ52dV.mjs}

@@ -1,8 +1,8 @@
-import { c as isConfigurationError, d as redactForRequest, i as createInfrastructureError, l as isInfrastructureError, s as isAuthFailure, u as normalizeThrown } from "./auth-errors-C3rbTV9p.mjs";
-import { O as SCOPE_CORE, n as __decorateParam, r as __decorateMetadata, s as AUTH_ENHANCER, t as __decorate, w as READER_CONTEXT } from "./decorate-Dt0e9K6R.mjs";
+import { O as SCOPE_CORE, n as __decorateParam, r as __decorateMetadata, s as AUTH_ENHANCER, t as __decorate, w as READER_CONTEXT } from "./decorate-bO-rBn-G.mjs";
+import { c as isConfigurationError, d as redactForRequest, i as createInfrastructureError, l as isInfrastructureError, s as isAuthFailure, u as normalizeThrown } from "./auth-errors-JjxGDVSt.mjs";
 import { Inject, Injectable } from "@nestjs/common";
 import { Observable } from "rxjs";
-//#region src/principal-resolver.ts
+// src/principal-resolver.ts
 const definePrincipalSource = (source) => source;
 const authenticated = (principal) => ({
 	outcome: "authenticated",
@@ -118,8 +118,7 @@ var ChainPrincipalResolver = class {
 		}, compute);
 	}
 };
-//#endregion
-//#region src/auth-scope-interceptor.ts
+// src/auth-scope-interceptor.ts
 let BetterAuthScopeInterceptor = class BetterAuthScopeInterceptor {
 	core;
 	static [AUTH_ENHANCER] = "scope";
@@ -225,7 +224,6 @@ var ScopeCore = class {
 		}));
 	}
 };
-//#endregion
 export { absent as a, normalizeForRequest as c, MemoKeys as i, rejected as l, ScopeCore as n, authenticated as o, ChainPrincipalResolver as r, definePrincipalSource as s, BetterAuthScopeInterceptor as t, requestHeaders as u };
 
-//# sourceMappingURL=auth-scope-interceptor-DYPn3b8M.mjs.map
+//# sourceMappingURL=auth-scope-interceptor-CvCQ52dV.mjs.map

package/dist/{auth-scope-interceptor-DYPn3b8M.mjs.map → auth-scope-interceptor-CvCQ52dV.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"auth-scope-interceptor-DYPn3b8M.mjs","names":[],"sources":["../src/principal-resolver.ts","../src/auth-scope-interceptor.ts"],"sourcesContent":["import type {\n  AuthPrincipalBase,\n  PrincipalResolver,\n  PrincipalResult,\n  PrincipalSource,\n  ResolutionRequest,\n  TransportCall,\n} from \"./auth-contracts.js\";\nimport {\n  type AuthFailure,\n  isAuthFailure,\n  normalizeThrown,\n  createInfrastructureError,\n  isConfigurationError,\n  isInfrastructureError,\n  redactForRequest,\n} from \"./auth-errors.js\";\nimport type { InstanceEntry, InstanceLookup } from \"./instance-registry.js\";\nimport type { TransportRegistry } from \"./transport-registry.js\";\nimport type { RequestScope } from \"./request-scope.js\";\n\nexport const definePrincipalSource = <P extends AuthPrincipalBase>(\n  source: PrincipalSource<P>,\n): PrincipalSource<P> => source;\nexport const authenticated = <P extends AuthPrincipalBase>(\n  principal: P,\n): PrincipalResult<P> => ({ outcome: \"authenticated\", principal });\nexport const absent = (): PrincipalResult<never> => ({ outcome: \"absent\" });\nexport const rejected = (failure: AuthFailure): PrincipalResult<never> => ({\n  outcome: \"rejected\",\n  failure,\n});\n\nexport class MemoKeys {\n  private readonly owners = new WeakMap<\n    object,\n    {\n      objects: WeakMap<object, number>;\n      symbols: Map<symbol, number>;\n      next: number;\n    }\n  >();\n\n  key(\n    owner: object,\n    namespace: string,\n    value: string | object | symbol,\n  ): string {\n    if (typeof value === \"string\") {\n      return JSON.stringify([namespace, \"string\", value]);\n    }\n    let identities = this.owners.get(owner);\n    if (!identities) {\n      identities = { objects: new WeakMap(), symbols: new Map(), next: 0 };\n      this.owners.set(owner, identities);\n    }\n    let id =\n      typeof value === \"symbol\"\n        ? identities.symbols.get(value)\n        : identities.objects.get(value);\n    if (id === undefined) {\n      id = ++identities.next;\n      if (typeof value === \"symbol\") {\n        identities.symbols.set(value, id);\n      } else {\n        identities.objects.set(value, id);\n      }\n    }\n    return JSON.stringify([namespace, typeof value, id]);\n  }\n}\nexport function requestHeaders(\n  call: TransportCall,\n  entry: InstanceEntry,\n): Headers {\n  const headers = new Headers(call.headers());\n  for (const name of [...headers.keys()]) {\n    if (\n      name.startsWith(\":\") ||\n      name.startsWith(\"x-nestjs-kit-better-auth-ip-\") ||\n      name === entry.bridge.clientIpHeader\n    ) {\n      headers.delete(name);\n    }\n  }\n  if (entry.bridge.clientIpHeader && call.clientIp) {\n    headers.set(entry.bridge.clientIpHeader, call.clientIp);\n  }\n  return headers;\n}\nexport function normalizeForRequest(\n  error: unknown,\n  where: \"source\" | \"policy\",\n  site: string,\n  entry: InstanceEntry,\n  headers: Headers,\n) {\n  try {\n    return normalizeThrown(error, where, site, [], entry.options.errors);\n  } catch (normalized) {\n    if (isConfigurationError(normalized)) {\n      throw normalized;\n    }\n    if (isInfrastructureError(error) && normalized === error) {\n      // A source or policy classified this failure itself, redacting only what it knew.\n      throw redactForRequest(error, {\n        headers,\n        credentialHeaders: entry.credentialHeaders,\n        exposeRawCause: entry.options.errors?.exposeRawCause,\n      });\n    }\n    throw createInfrastructureError(error, {\n      headers,\n      credentialHeaders: entry.credentialHeaders,\n      exposeRawCause: entry.options.errors?.exposeRawCause,\n    });\n  }\n}\nexport class ChainPrincipalResolver implements PrincipalResolver {\n  private readonly keys = new MemoKeys();\n\n  constructor(\n    private readonly instances: InstanceLookup,\n    private readonly scope: RequestScope,\n    private readonly transports: TransportRegistry,\n  ) {}\n\n  resolve(\n    call: TransportCall,\n    request: ResolutionRequest,\n  ): Promise<PrincipalResult> {\n    const entry = this.instances.get(request.auth.name);\n    const compute = async (): Promise<PrincipalResult> => {\n      const headers = requestHeaders(call, entry);\n      const sources = request.reclassify\n        ? entry.sources.filter(\n            (source) =>\n              source.id === request.reclassify!.sourceId &&\n              source.sessionBacked,\n          )\n        : entry.sources.filter((source) =>\n            source.kinds.some((kind) => request.accepts.has(kind)),\n          );\n      return request.auth.run(\n        {\n          cookies: call.cookies,\n          forward: \"same-credential\",\n          inbound: () => headers,\n          internal: true,\n        },\n        async () => {\n          for (const source of sources) {\n            const input = {\n              headers,\n              cookies: call.cookies,\n              transport: this.transports.idOf(call),\n              request: call.request,\n              freshness: request.freshness,\n              auth: request.auth,\n              memo: <T>(\n                key: string | object | symbol,\n                fn: () => Promise<T>,\n              ): Promise<T> =>\n                this.scope.memoPolicyIo(\n                  call.key,\n                  entry.name,\n                  this.keys.key(call.key, `source:${source.id}`, key),\n                  fn,\n                  entry.options.limits?.maxAuthorizationCallsPerRequest,\n                ),\n            };\n            try {\n              if (source.appliesTo && !source.appliesTo(input)) {\n                continue;\n              }\n              const result = await source.resolve(input);\n              if (\n                result.outcome === \"authenticated\" &&\n                (!source.kinds.includes(result.principal.kind) ||\n                  result.principal.source !== source.id ||\n                  Boolean(result.principal.delegation) !==\n                    Boolean(source.delegates))\n              ) {\n                throw new Error(\n                  `Principal source ${source.id} violated its declared principal contract`,\n                );\n              }\n              if (result.outcome !== \"absent\") {\n                return result;\n              }\n            } catch (error) {\n              const failure = normalizeForRequest(\n                error,\n                \"source\",\n                source.id,\n                entry,\n                headers,\n              );\n              if (isAuthFailure(failure)) {\n                return rejected(failure);\n              }\n              throw error;\n            }\n          }\n          return absent();\n        },\n      );\n    };\n    return request.reclassify\n      ? compute()\n      : this.scope.memoPrincipal(\n          call,\n          {\n            instance: entry.name,\n            freshness: request.freshness,\n            sourceSet: request.sourceSet,\n          },\n          compute,\n        );\n  }\n}\n","import {\n  Inject,\n  Injectable,\n  type CallHandler,\n  type ExecutionContext,\n  type NestInterceptor,\n} from \"@nestjs/common\";\nimport { Observable } from \"rxjs\";\nimport type { PrincipalReading, TransportCall } from \"./auth-contracts.js\";\nimport { AUTH_ENHANCER, READER_CONTEXT, SCOPE_CORE } from \"./auth-tokens.js\";\nimport type { ScopeView } from \"./bridge-protocol.js\";\nimport type { InstanceLookup } from \"./instance-registry.js\";\nimport type { PrincipalReadings } from \"./principal-readings.js\";\nimport { requestHeaders } from \"./principal-resolver.js\";\nimport type { RequestScope, ScopeState } from \"./request-scope.js\";\nimport type { RoutePlanner } from \"./route-planner.js\";\nimport type { TransportRegistry } from \"./transport-registry.js\";\n\n@Injectable()\nexport class BetterAuthScopeInterceptor implements NestInterceptor {\n  static readonly [AUTH_ENHANCER] = \"scope\";\n  readonly [AUTH_ENHANCER] = \"scope\";\n\n  constructor(\n    @Inject(SCOPE_CORE) private readonly core: Pick<ScopeCore, \"intercept\">,\n  ) {}\n\n  intercept(context: ExecutionContext, next: CallHandler): Observable<unknown> {\n    return this.core.intercept(context, next);\n  }\n}\nexport class ScopeCore implements NestInterceptor {\n  constructor(\n    private readonly instances: InstanceLookup,\n    private readonly planner: RoutePlanner,\n    private readonly transports: TransportRegistry,\n    private readonly scope: RequestScope,\n    private readonly readings: PrincipalReadings,\n  ) {}\n\n  intercept(context: ExecutionContext, next: CallHandler): Observable<unknown> {\n    const plan = this.planner.forContext(context);\n    const entry = this.instances.get(plan.instance);\n    let described = false;\n    let call: TransportCall | undefined;\n    const getCall = (): TransportCall | undefined => {\n      if (!described) {\n        const transport = this.transports.find(context);\n        call = transport\n          ? this.transports.describe(context, transport)\n          : undefined;\n        described = true;\n      }\n      return call;\n    };\n    let reading: PrincipalReading | undefined;\n    const read = (): PrincipalReading => {\n      if (reading) {\n        return reading;\n      }\n      const lineage = this.transports.find(context)?.lineage?.(context);\n      reading = this.readings.read({\n        args: context.getArgs(),\n        plan,\n        lineage,\n        ...(plan.access === \"public\" || plan.access === \"inherit\"\n          ? {}\n          : { call: getCall() }),\n      });\n      return reading;\n    };\n    const instances = this.instances;\n    const view: ScopeView = {\n      get cookies() {\n        return getCall()?.cookies ?? null;\n      },\n      forward: plan.forwardDirectCalls ? \"same-credential\" : \"none\",\n      internal: false,\n      get inbound() {\n        return () => {\n          const call = getCall();\n          return call ? requestHeaders(call, entry) : new Headers();\n        };\n      },\n      get browserHeaders() {\n        const browser = getCall()?.browser;\n        return browser ? () => browser.headers() : undefined;\n      },\n      get checkCallerSession() {\n        if (plan.originCheck === \"off\") {\n          return undefined;\n        }\n        const browser = getCall()?.browser;\n        return browser\n          ? (path: string, instance: string) =>\n              instances\n                .get(instance)\n                .origin.assertCallerSession(browser, path, instance)\n          : undefined;\n      },\n    };\n    const state: ScopeState = {\n      view,\n      plan,\n      reading: read,\n      get call() {\n        return getCall();\n      },\n    };\n    const args = context.getArgs();\n    const bridge = {\n      args: [...args],\n      reading: read,\n      scope: this.scope,\n      readings: this.readings,\n    };\n    for (const arg of [args, ...args]) {\n      if (\n        arg &&\n        (typeof arg === \"object\" || typeof arg === \"function\") &&\n        Object.isExtensible(arg)\n      ) {\n        Object.defineProperty(arg, READER_CONTEXT, {\n          value: bridge,\n          configurable: true,\n        });\n      }\n    }\n    return new Observable((subscriber) =>\n      this.scope.run(state, () => {\n        const subscription = next.handle().subscribe({\n          next: (value) => this.scope.run(state, () => subscriber.next(value)),\n          error: (error) =>\n            this.scope.run(state, () => subscriber.error(error)),\n          complete: () => this.scope.run(state, () => subscriber.complete()),\n        });\n        return () => this.scope.run(state, () => subscription.unsubscribe());\n      }),\n    );\n  }\n}\n"],"mappings":";;;;;AAqBA,MAAa,yBACX,WACuB;AACzB,MAAa,iBACX,eACwB;CAAE,SAAS;CAAiB;AAAU;AAChE,MAAa,gBAAwC,EAAE,SAAS,SAAS;AACzE,MAAa,YAAY,aAAkD;CACzE,SAAS;CACT;AACF;AAEA,IAAa,WAAb,MAAsB;CACpB,yBAA0B,IAAI,QAO5B;CAEF,IACE,OACA,WACA,OACQ;EACR,IAAI,OAAO,UAAU,UACnB,OAAO,KAAK,UAAU;GAAC;GAAW;GAAU;EAAK,CAAC;EAEpD,IAAI,aAAa,KAAK,OAAO,IAAI,KAAK;EACtC,IAAI,CAAC,YAAY;GACf,aAAa;IAAE,yBAAS,IAAI,QAAQ;IAAG,yBAAS,IAAI,IAAI;IAAG,MAAM;GAAE;GACnE,KAAK,OAAO,IAAI,OAAO,UAAU;EACnC;EACA,IAAI,KACF,OAAO,UAAU,WACb,WAAW,QAAQ,IAAI,KAAK,IAC5B,WAAW,QAAQ,IAAI,KAAK;EAClC,IAAI,OAAO,KAAA,GAAW;GACpB,KAAK,EAAE,WAAW;GAClB,IAAI,OAAO,UAAU,UACnB,WAAW,QAAQ,IAAI,OAAO,EAAE;QAEhC,WAAW,QAAQ,IAAI,OAAO,EAAE;EAEpC;EACA,OAAO,KAAK,UAAU;GAAC;GAAW,OAAO;GAAO;EAAE,CAAC;CACrD;AACF;AACA,SAAgB,eACd,MACA,OACS;CACT,MAAM,UAAU,IAAI,QAAQ,KAAK,QAAQ,CAAC;CAC1C,KAAK,MAAM,QAAQ,CAAC,GAAG,QAAQ,KAAK,CAAC,GACnC,IACE,KAAK,WAAW,GAAG,KACnB,KAAK,WAAW,8BAA8B,KAC9C,SAAS,MAAM,OAAO,gBAEtB,QAAQ,OAAO,IAAI;CAGvB,IAAI,MAAM,OAAO,kBAAkB,KAAK,UACtC,QAAQ,IAAI,MAAM,OAAO,gBAAgB,KAAK,QAAQ;CAExD,OAAO;AACT;AACA,SAAgB,oBACd,OACA,OACA,MACA,OACA,SACA;CACA,IAAI;EACF,OAAO,gBAAgB,OAAO,OAAO,MAAM,CAAC,GAAG,MAAM,QAAQ,MAAM;CACrE,SAAS,YAAY;EACnB,IAAI,qBAAqB,UAAU,GACjC,MAAM;EAER,IAAI,sBAAsB,KAAK,KAAK,eAAe,OAEjD,MAAM,iBAAiB,OAAO;GAC5B;GACA,mBAAmB,MAAM;GACzB,gBAAgB,MAAM,QAAQ,QAAQ;EACxC,CAAC;EAEH,MAAM,0BAA0B,OAAO;GACrC;GACA,mBAAmB,MAAM;GACzB,gBAAgB,MAAM,QAAQ,QAAQ;EACxC,CAAC;CACH;AACF;AACA,IAAa,yBAAb,MAAiE;CAI5C;CACA;CACA;CALnB,OAAwB,IAAI,SAAS;CAErC,YACE,WACA,OACA,YACA;EAHiB,KAAA,YAAA;EACA,KAAA,QAAA;EACA,KAAA,aAAA;CAChB;CAEH,QACE,MACA,SAC0B;EAC1B,MAAM,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,IAAI;EAClD,MAAM,UAAU,YAAsC;GACpD,MAAM,UAAU,eAAe,MAAM,KAAK;GAC1C,MAAM,UAAU,QAAQ,aACpB,MAAM,QAAQ,QACX,WACC,OAAO,OAAO,QAAQ,WAAY,YAClC,OAAO,aACX,IACA,MAAM,QAAQ,QAAQ,WACpB,OAAO,MAAM,MAAM,SAAS,QAAQ,QAAQ,IAAI,IAAI,CAAC,CACvD;GACJ,OAAO,QAAQ,KAAK,IAClB;IACE,SAAS,KAAK;IACd,SAAS;IACT,eAAe;IACf,UAAU;GACZ,GACA,YAAY;IACV,KAAK,MAAM,UAAU,SAAS;KAC5B,MAAM,QAAQ;MACZ;MACA,SAAS,KAAK;MACd,WAAW,KAAK,WAAW,KAAK,IAAI;MACpC,SAAS,KAAK;MACd,WAAW,QAAQ;MACnB,MAAM,QAAQ;MACd,OACE,KACA,OAEA,KAAK,MAAM,aACT,KAAK,KACL,MAAM,MACN,KAAK,KAAK,IAAI,KAAK,KAAK,UAAU,OAAO,MAAM,GAAG,GAClD,IACA,MAAM,QAAQ,QAAQ,+BACxB;KACJ;KACA,IAAI;MACF,IAAI,OAAO,aAAa,CAAC,OAAO,UAAU,KAAK,GAC7C;MAEF,MAAM,SAAS,MAAM,OAAO,QAAQ,KAAK;MACzC,IACE,OAAO,YAAY,oBAClB,CAAC,OAAO,MAAM,SAAS,OAAO,UAAU,IAAI,KAC3C,OAAO,UAAU,WAAW,OAAO,MACnC,QAAQ,OAAO,UAAU,UAAU,MACjC,QAAQ,OAAO,SAAS,IAE5B,MAAM,IAAI,MACR,oBAAoB,OAAO,GAAG,0CAChC;MAEF,IAAI,OAAO,YAAY,UACrB,OAAO;KAEX,SAAS,OAAO;MACd,MAAM,UAAU,oBACd,OACA,UACA,OAAO,IACP,OACA,OACF;MACA,IAAI,cAAc,OAAO,GACvB,OAAO,SAAS,OAAO;MAEzB,MAAM;KACR;IACF;IACA,OAAO,OAAO;GAChB,CACF;EACF;EACA,OAAO,QAAQ,aACX,QAAQ,IACR,KAAK,MAAM,cACT,MACA;GACE,UAAU,MAAM;GAChB,WAAW,QAAQ;GACnB,WAAW,QAAQ;EACrB,GACA,OACF;CACN;AACF;;;ACzMO,IAAM,6BAAN,MAAM,2BAAsD;CAK1B;CAJvC,QAAiB,iBAAiB;CAClC,CAAU,iBAAiB;CAE3B,YACE,MACA;EADqC,KAAA,OAAA;CACpC;CAEH,UAAU,SAA2B,MAAwC;EAC3E,OAAO,KAAK,KAAK,UAAU,SAAS,IAAI;CAC1C;AACF;;CAZC,WAAW;CAMP,gBAAA,GAAA,OAAO,UAAU,CAAA;;;AAOtB,IAAa,YAAb,MAAkD;CAE7B;CACA;CACA;CACA;CACA;CALnB,YACE,WACA,SACA,YACA,OACA,UACA;EALiB,KAAA,YAAA;EACA,KAAA,UAAA;EACA,KAAA,aAAA;EACA,KAAA,QAAA;EACA,KAAA,WAAA;CAChB;CAEH,UAAU,SAA2B,MAAwC;EAC3E,MAAM,OAAO,KAAK,QAAQ,WAAW,OAAO;EAC5C,MAAM,QAAQ,KAAK,UAAU,IAAI,KAAK,QAAQ;EAC9C,IAAI,YAAY;EAChB,IAAI;EACJ,MAAM,gBAA2C;GAC/C,IAAI,CAAC,WAAW;IACd,MAAM,YAAY,KAAK,WAAW,KAAK,OAAO;IAC9C,OAAO,YACH,KAAK,WAAW,SAAS,SAAS,SAAS,IAC3C,KAAA;IACJ,YAAY;GACd;GACA,OAAO;EACT;EACA,IAAI;EACJ,MAAM,aAA+B;GACnC,IAAI,SACF,OAAO;GAET,MAAM,UAAU,KAAK,WAAW,KAAK,OAAO,CAAC,EAAE,UAAU,OAAO;GAChE,UAAU,KAAK,SAAS,KAAK;IAC3B,MAAM,QAAQ,QAAQ;IACtB;IACA;IACA,GAAI,KAAK,WAAW,YAAY,KAAK,WAAW,YAC5C,CAAC,IACD,EAAE,MAAM,QAAQ,EAAE;GACxB,CAAC;GACD,OAAO;EACT;EACA,MAAM,YAAY,KAAK;EA8BvB,MAAM,QAAoB;GACxB,MAAA;IA7BA,IAAI,UAAU;KACZ,OAAO,QAAQ,CAAC,EAAE,WAAW;IAC/B;IACA,SAAS,KAAK,qBAAqB,oBAAoB;IACvD,UAAU;IACV,IAAI,UAAU;KACZ,aAAa;MACX,MAAM,OAAO,QAAQ;MACrB,OAAO,OAAO,eAAe,MAAM,KAAK,IAAI,IAAI,QAAQ;KAC1D;IACF;IACA,IAAI,iBAAiB;KACnB,MAAM,UAAU,QAAQ,CAAC,EAAE;KAC3B,OAAO,gBAAgB,QAAQ,QAAQ,IAAI,KAAA;IAC7C;IACA,IAAI,qBAAqB;KACvB,IAAI,KAAK,gBAAgB,OACvB;KAEF,MAAM,UAAU,QAAQ,CAAC,EAAE;KAC3B,OAAO,WACF,MAAc,aACb,UACG,IAAI,QAAQ,CAAC,CACb,OAAO,oBAAoB,SAAS,MAAM,QAAQ,IACvD,KAAA;IACN;GAGG;GACH;GACA,SAAS;GACT,IAAI,OAAO;IACT,OAAO,QAAQ;GACjB;EACF;EACA,MAAM,OAAO,QAAQ,QAAQ;EAC7B,MAAM,SAAS;GACb,MAAM,CAAC,GAAG,IAAI;GACd,SAAS;GACT,OAAO,KAAK;GACZ,UAAU,KAAK;EACjB;EACA,KAAK,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,GAC9B,IACE,QACC,OAAO,QAAQ,YAAY,OAAO,QAAQ,eAC3C,OAAO,aAAa,GAAG,GAEvB,OAAO,eAAe,KAAK,gBAAgB;GACzC,OAAO;GACP,cAAc;EAChB,CAAC;EAGL,OAAO,IAAI,YAAY,eACrB,KAAK,MAAM,IAAI,aAAa;GAC1B,MAAM,eAAe,KAAK,OAAO,CAAC,CAAC,UAAU;IAC3C,OAAO,UAAU,KAAK,MAAM,IAAI,aAAa,WAAW,KAAK,KAAK,CAAC;IACnE,QAAQ,UACN,KAAK,MAAM,IAAI,aAAa,WAAW,MAAM,KAAK,CAAC;IACrD,gBAAgB,KAAK,MAAM,IAAI,aAAa,WAAW,SAAS,CAAC;GACnE,CAAC;GACD,aAAa,KAAK,MAAM,IAAI,aAAa,aAAa,YAAY,CAAC;EACrE,CAAC,CACH;CACF;AACF"}
+{"version":3,"file":"auth-scope-interceptor-CvCQ52dV.mjs","names":[],"sources":["../src/principal-resolver.ts","../src/auth-scope-interceptor.ts"],"sourcesContent":["import type {\n  AuthPrincipalBase,\n  PrincipalResolver,\n  PrincipalResult,\n  PrincipalSource,\n  ResolutionRequest,\n  TransportCall,\n} from \"./auth-contracts.js\";\nimport {\n  type AuthFailure,\n  isAuthFailure,\n  normalizeThrown,\n  createInfrastructureError,\n  isConfigurationError,\n  isInfrastructureError,\n  redactForRequest,\n} from \"./auth-errors.js\";\nimport type { InstanceEntry, InstanceLookup } from \"./instance-registry.js\";\nimport type { TransportRegistry } from \"./transport-registry.js\";\nimport type { RequestScope } from \"./request-scope.js\";\n\nexport const definePrincipalSource = <P extends AuthPrincipalBase>(\n  source: PrincipalSource<P>,\n): PrincipalSource<P> => source;\nexport const authenticated = <P extends AuthPrincipalBase>(\n  principal: P,\n): PrincipalResult<P> => ({ outcome: \"authenticated\", principal });\nexport const absent = (): PrincipalResult<never> => ({ outcome: \"absent\" });\nexport const rejected = (failure: AuthFailure): PrincipalResult<never> => ({\n  outcome: \"rejected\",\n  failure,\n});\n\nexport class MemoKeys {\n  private readonly owners = new WeakMap<\n    object,\n    {\n      objects: WeakMap<object, number>;\n      symbols: Map<symbol, number>;\n      next: number;\n    }\n  >();\n\n  key(\n    owner: object,\n    namespace: string,\n    value: string | object | symbol,\n  ): string {\n    if (typeof value === \"string\") {\n      return JSON.stringify([namespace, \"string\", value]);\n    }\n    let identities = this.owners.get(owner);\n    if (!identities) {\n      identities = { objects: new WeakMap(), symbols: new Map(), next: 0 };\n      this.owners.set(owner, identities);\n    }\n    let id =\n      typeof value === \"symbol\"\n        ? identities.symbols.get(value)\n        : identities.objects.get(value);\n    if (id === undefined) {\n      id = ++identities.next;\n      if (typeof value === \"symbol\") {\n        identities.symbols.set(value, id);\n      } else {\n        identities.objects.set(value, id);\n      }\n    }\n    return JSON.stringify([namespace, typeof value, id]);\n  }\n}\nexport function requestHeaders(\n  call: TransportCall,\n  entry: InstanceEntry,\n): Headers {\n  const headers = new Headers(call.headers());\n  for (const name of [...headers.keys()]) {\n    if (\n      name.startsWith(\":\") ||\n      name.startsWith(\"x-nestjs-kit-better-auth-ip-\") ||\n      name === entry.bridge.clientIpHeader\n    ) {\n      headers.delete(name);\n    }\n  }\n  if (entry.bridge.clientIpHeader && call.clientIp) {\n    headers.set(entry.bridge.clientIpHeader, call.clientIp);\n  }\n  return headers;\n}\nexport function normalizeForRequest(\n  error: unknown,\n  where: \"source\" | \"policy\",\n  site: string,\n  entry: InstanceEntry,\n  headers: Headers,\n) {\n  try {\n    return normalizeThrown(error, where, site, [], entry.options.errors);\n  } catch (normalized) {\n    if (isConfigurationError(normalized)) {\n      throw normalized;\n    }\n    if (isInfrastructureError(error) && normalized === error) {\n      // A source or policy classified this failure itself, redacting only what it knew.\n      throw redactForRequest(error, {\n        headers,\n        credentialHeaders: entry.credentialHeaders,\n        exposeRawCause: entry.options.errors?.exposeRawCause,\n      });\n    }\n    throw createInfrastructureError(error, {\n      headers,\n      credentialHeaders: entry.credentialHeaders,\n      exposeRawCause: entry.options.errors?.exposeRawCause,\n    });\n  }\n}\nexport class ChainPrincipalResolver implements PrincipalResolver {\n  private readonly keys = new MemoKeys();\n\n  constructor(\n    private readonly instances: InstanceLookup,\n    private readonly scope: RequestScope,\n    private readonly transports: TransportRegistry,\n  ) {}\n\n  resolve(\n    call: TransportCall,\n    request: ResolutionRequest,\n  ): Promise<PrincipalResult> {\n    const entry = this.instances.get(request.auth.name);\n    const compute = async (): Promise<PrincipalResult> => {\n      const headers = requestHeaders(call, entry);\n      const sources = request.reclassify\n        ? entry.sources.filter(\n            (source) =>\n              source.id === request.reclassify!.sourceId &&\n              source.sessionBacked,\n          )\n        : entry.sources.filter((source) =>\n            source.kinds.some((kind) => request.accepts.has(kind)),\n          );\n      return request.auth.run(\n        {\n          cookies: call.cookies,\n          forward: \"same-credential\",\n          inbound: () => headers,\n          internal: true,\n        },\n        async () => {\n          for (const source of sources) {\n            const input = {\n              headers,\n              cookies: call.cookies,\n              transport: this.transports.idOf(call),\n              request: call.request,\n              freshness: request.freshness,\n              auth: request.auth,\n              memo: <T>(\n                key: string | object | symbol,\n                fn: () => Promise<T>,\n              ): Promise<T> =>\n                this.scope.memoPolicyIo(\n                  call.key,\n                  entry.name,\n                  this.keys.key(call.key, `source:${source.id}`, key),\n                  fn,\n                  entry.options.limits?.maxAuthorizationCallsPerRequest,\n                ),\n            };\n            try {\n              if (source.appliesTo && !source.appliesTo(input)) {\n                continue;\n              }\n              const result = await source.resolve(input);\n              if (\n                result.outcome === \"authenticated\" &&\n                (!source.kinds.includes(result.principal.kind) ||\n                  result.principal.source !== source.id ||\n                  Boolean(result.principal.delegation) !==\n                    Boolean(source.delegates))\n              ) {\n                throw new Error(\n                  `Principal source ${source.id} violated its declared principal contract`,\n                );\n              }\n              if (result.outcome !== \"absent\") {\n                return result;\n              }\n            } catch (error) {\n              const failure = normalizeForRequest(\n                error,\n                \"source\",\n                source.id,\n                entry,\n                headers,\n              );\n              if (isAuthFailure(failure)) {\n                return rejected(failure);\n              }\n              throw error;\n            }\n          }\n          return absent();\n        },\n      );\n    };\n    return request.reclassify\n      ? compute()\n      : this.scope.memoPrincipal(\n          call,\n          {\n            instance: entry.name,\n            freshness: request.freshness,\n            sourceSet: request.sourceSet,\n          },\n          compute,\n        );\n  }\n}\n","import {\n  Inject,\n  Injectable,\n  type CallHandler,\n  type ExecutionContext,\n  type NestInterceptor,\n} from \"@nestjs/common\";\nimport { Observable } from \"rxjs\";\nimport type { PrincipalReading, TransportCall } from \"./auth-contracts.js\";\nimport { AUTH_ENHANCER, READER_CONTEXT, SCOPE_CORE } from \"./auth-tokens.js\";\nimport type { ScopeView } from \"./bridge-protocol.js\";\nimport type { InstanceLookup } from \"./instance-registry.js\";\nimport type { PrincipalReadings } from \"./principal-readings.js\";\nimport { requestHeaders } from \"./principal-resolver.js\";\nimport type { RequestScope, ScopeState } from \"./request-scope.js\";\nimport type { RoutePlanner } from \"./route-planner.js\";\nimport type { TransportRegistry } from \"./transport-registry.js\";\n\n@Injectable()\nexport class BetterAuthScopeInterceptor implements NestInterceptor {\n  static readonly [AUTH_ENHANCER] = \"scope\";\n  readonly [AUTH_ENHANCER] = \"scope\";\n\n  constructor(\n    @Inject(SCOPE_CORE) private readonly core: Pick<ScopeCore, \"intercept\">,\n  ) {}\n\n  intercept(context: ExecutionContext, next: CallHandler): Observable<unknown> {\n    return this.core.intercept(context, next);\n  }\n}\nexport class ScopeCore implements NestInterceptor {\n  constructor(\n    private readonly instances: InstanceLookup,\n    private readonly planner: RoutePlanner,\n    private readonly transports: TransportRegistry,\n    private readonly scope: RequestScope,\n    private readonly readings: PrincipalReadings,\n  ) {}\n\n  intercept(context: ExecutionContext, next: CallHandler): Observable<unknown> {\n    const plan = this.planner.forContext(context);\n    const entry = this.instances.get(plan.instance);\n    let described = false;\n    let call: TransportCall | undefined;\n    const getCall = (): TransportCall | undefined => {\n      if (!described) {\n        const transport = this.transports.find(context);\n        call = transport\n          ? this.transports.describe(context, transport)\n          : undefined;\n        described = true;\n      }\n      return call;\n    };\n    let reading: PrincipalReading | undefined;\n    const read = (): PrincipalReading => {\n      if (reading) {\n        return reading;\n      }\n      const lineage = this.transports.find(context)?.lineage?.(context);\n      reading = this.readings.read({\n        args: context.getArgs(),\n        plan,\n        lineage,\n        ...(plan.access === \"public\" || plan.access === \"inherit\"\n          ? {}\n          : { call: getCall() }),\n      });\n      return reading;\n    };\n    const instances = this.instances;\n    const view: ScopeView = {\n      get cookies() {\n        return getCall()?.cookies ?? null;\n      },\n      forward: plan.forwardDirectCalls ? \"same-credential\" : \"none\",\n      internal: false,\n      get inbound() {\n        return () => {\n          const call = getCall();\n          return call ? requestHeaders(call, entry) : new Headers();\n        };\n      },\n      get browserHeaders() {\n        const browser = getCall()?.browser;\n        return browser ? () => browser.headers() : undefined;\n      },\n      get checkCallerSession() {\n        if (plan.originCheck === \"off\") {\n          return undefined;\n        }\n        const browser = getCall()?.browser;\n        return browser\n          ? (path: string, instance: string) =>\n              instances\n                .get(instance)\n                .origin.assertCallerSession(browser, path, instance)\n          : undefined;\n      },\n    };\n    const state: ScopeState = {\n      view,\n      plan,\n      reading: read,\n      get call() {\n        return getCall();\n      },\n    };\n    const args = context.getArgs();\n    const bridge = {\n      args: [...args],\n      reading: read,\n      scope: this.scope,\n      readings: this.readings,\n    };\n    for (const arg of [args, ...args]) {\n      if (\n        arg &&\n        (typeof arg === \"object\" || typeof arg === \"function\") &&\n        Object.isExtensible(arg)\n      ) {\n        Object.defineProperty(arg, READER_CONTEXT, {\n          value: bridge,\n          configurable: true,\n        });\n      }\n    }\n    return new Observable((subscriber) =>\n      this.scope.run(state, () => {\n        const subscription = next.handle().subscribe({\n          next: (value) => this.scope.run(state, () => subscriber.next(value)),\n          error: (error) =>\n            this.scope.run(state, () => subscriber.error(error)),\n          complete: () => this.scope.run(state, () => subscriber.complete()),\n        });\n        return () => this.scope.run(state, () => subscription.unsubscribe());\n      }),\n    );\n  }\n}\n"],"mappings":";;;;;AAqBA,MAAa,yBACX,WACuB;AACzB,MAAa,iBACX,eACwB;CAAE,SAAS;CAAiB;AAAU;AAChE,MAAa,gBAAwC,EAAE,SAAS,SAAS;AACzE,MAAa,YAAY,aAAkD;CACzE,SAAS;CACT;AACF;AAEA,IAAa,WAAb,MAAsB;CACpB,yBAA0B,IAAI,QAO5B;CAEF,IACE,OACA,WACA,OACQ;EACR,IAAI,OAAO,UAAU,UACnB,OAAO,KAAK,UAAU;GAAC;GAAW;GAAU;EAAK,CAAC;EAEpD,IAAI,aAAa,KAAK,OAAO,IAAI,KAAK;EACtC,IAAI,CAAC,YAAY;GACf,aAAa;IAAE,yBAAS,IAAI,QAAQ;IAAG,yBAAS,IAAI,IAAI;IAAG,MAAM;GAAE;GACnE,KAAK,OAAO,IAAI,OAAO,UAAU;EACnC;EACA,IAAI,KACF,OAAO,UAAU,WACb,WAAW,QAAQ,IAAI,KAAK,IAC5B,WAAW,QAAQ,IAAI,KAAK;EAClC,IAAI,OAAO,KAAA,GAAW;GACpB,KAAK,EAAE,WAAW;GAClB,IAAI,OAAO,UAAU,UACnB,WAAW,QAAQ,IAAI,OAAO,EAAE;QAEhC,WAAW,QAAQ,IAAI,OAAO,EAAE;EAEpC;EACA,OAAO,KAAK,UAAU;GAAC;GAAW,OAAO;GAAO;EAAE,CAAC;CACrD;AACF;AACA,SAAgB,eACd,MACA,OACS;CACT,MAAM,UAAU,IAAI,QAAQ,KAAK,QAAQ,CAAC;CAC1C,KAAK,MAAM,QAAQ,CAAC,GAAG,QAAQ,KAAK,CAAC,GACnC,IACE,KAAK,WAAW,GAAG,KACnB,KAAK,WAAW,8BAA8B,KAC9C,SAAS,MAAM,OAAO,gBAEtB,QAAQ,OAAO,IAAI;CAGvB,IAAI,MAAM,OAAO,kBAAkB,KAAK,UACtC,QAAQ,IAAI,MAAM,OAAO,gBAAgB,KAAK,QAAQ;CAExD,OAAO;AACT;AACA,SAAgB,oBACd,OACA,OACA,MACA,OACA,SACA;CACA,IAAI;EACF,OAAO,gBAAgB,OAAO,OAAO,MAAM,CAAC,GAAG,MAAM,QAAQ,MAAM;CACrE,SAAS,YAAY;EACnB,IAAI,qBAAqB,UAAU,GACjC,MAAM;EAER,IAAI,sBAAsB,KAAK,KAAK,eAAe,OAEjD,MAAM,iBAAiB,OAAO;GAC5B;GACA,mBAAmB,MAAM;GACzB,gBAAgB,MAAM,QAAQ,QAAQ;EACxC,CAAC;EAEH,MAAM,0BAA0B,OAAO;GACrC;GACA,mBAAmB,MAAM;GACzB,gBAAgB,MAAM,QAAQ,QAAQ;EACxC,CAAC;CACH;AACF;AACA,IAAa,yBAAb,MAAiE;CAI5C;CACA;CACA;CALnB,OAAwB,IAAI,SAAS;CAErC,YACE,WACA,OACA,YACA;EAHiB,KAAA,YAAA;EACA,KAAA,QAAA;EACA,KAAA,aAAA;CAChB;CAEH,QACE,MACA,SAC0B;EAC1B,MAAM,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,IAAI;EAClD,MAAM,UAAU,YAAsC;GACpD,MAAM,UAAU,eAAe,MAAM,KAAK;GAC1C,MAAM,UAAU,QAAQ,aACpB,MAAM,QAAQ,QACX,WACC,OAAO,OAAO,QAAQ,WAAY,YAClC,OAAO,aACX,IACA,MAAM,QAAQ,QAAQ,WACpB,OAAO,MAAM,MAAM,SAAS,QAAQ,QAAQ,IAAI,IAAI,CAAC,CACvD;GACJ,OAAO,QAAQ,KAAK,IAClB;IACE,SAAS,KAAK;IACd,SAAS;IACT,eAAe;IACf,UAAU;GACZ,GACA,YAAY;IACV,KAAK,MAAM,UAAU,SAAS;KAC5B,MAAM,QAAQ;MACZ;MACA,SAAS,KAAK;MACd,WAAW,KAAK,WAAW,KAAK,IAAI;MACpC,SAAS,KAAK;MACd,WAAW,QAAQ;MACnB,MAAM,QAAQ;MACd,OACE,KACA,OAEA,KAAK,MAAM,aACT,KAAK,KACL,MAAM,MACN,KAAK,KAAK,IAAI,KAAK,KAAK,UAAU,OAAO,MAAM,GAAG,GAClD,IACA,MAAM,QAAQ,QAAQ,+BACxB;KACJ;KACA,IAAI;MACF,IAAI,OAAO,aAAa,CAAC,OAAO,UAAU,KAAK,GAC7C;MAEF,MAAM,SAAS,MAAM,OAAO,QAAQ,KAAK;MACzC,IACE,OAAO,YAAY,oBAClB,CAAC,OAAO,MAAM,SAAS,OAAO,UAAU,IAAI,KAC3C,OAAO,UAAU,WAAW,OAAO,MACnC,QAAQ,OAAO,UAAU,UAAU,MACjC,QAAQ,OAAO,SAAS,IAE5B,MAAM,IAAI,MACR,oBAAoB,OAAO,GAAG,0CAChC;MAEF,IAAI,OAAO,YAAY,UACrB,OAAO;KAEX,SAAS,OAAO;MACd,MAAM,UAAU,oBACd,OACA,UACA,OAAO,IACP,OACA,OACF;MACA,IAAI,cAAc,OAAO,GACvB,OAAO,SAAS,OAAO;MAEzB,MAAM;KACR;IACF;IACA,OAAO,OAAO;GAChB,CACF;EACF;EACA,OAAO,QAAQ,aACX,QAAQ,IACR,KAAK,MAAM,cACT,MACA;GACE,UAAU,MAAM;GAChB,WAAW,QAAQ;GACnB,WAAW,QAAQ;EACrB,GACA,OACF;CACN;AACF;;ACzMO,IAAM,6BAAN,MAAM,2BAAsD;CAK1B;CAJvC,QAAiB,iBAAiB;CAClC,CAAU,iBAAiB;CAE3B,YACE,MACA;EADqC,KAAA,OAAA;CACpC;CAEH,UAAU,SAA2B,MAAwC;EAC3E,OAAO,KAAK,KAAK,UAAU,SAAS,IAAI;CAC1C;AACF;;CAZC,WAAW;CAMP,gBAAA,GAAA,OAAO,UAAU,CAAA;;;AAOtB,IAAa,YAAb,MAAkD;CAE7B;CACA;CACA;CACA;CACA;CALnB,YACE,WACA,SACA,YACA,OACA,UACA;EALiB,KAAA,YAAA;EACA,KAAA,UAAA;EACA,KAAA,aAAA;EACA,KAAA,QAAA;EACA,KAAA,WAAA;CAChB;CAEH,UAAU,SAA2B,MAAwC;EAC3E,MAAM,OAAO,KAAK,QAAQ,WAAW,OAAO;EAC5C,MAAM,QAAQ,KAAK,UAAU,IAAI,KAAK,QAAQ;EAC9C,IAAI,YAAY;EAChB,IAAI;EACJ,MAAM,gBAA2C;GAC/C,IAAI,CAAC,WAAW;IACd,MAAM,YAAY,KAAK,WAAW,KAAK,OAAO;IAC9C,OAAO,YACH,KAAK,WAAW,SAAS,SAAS,SAAS,IAC3C,KAAA;IACJ,YAAY;GACd;GACA,OAAO;EACT;EACA,IAAI;EACJ,MAAM,aAA+B;GACnC,IAAI,SACF,OAAO;GAET,MAAM,UAAU,KAAK,WAAW,KAAK,OAAO,CAAC,EAAE,UAAU,OAAO;GAChE,UAAU,KAAK,SAAS,KAAK;IAC3B,MAAM,QAAQ,QAAQ;IACtB;IACA;IACA,GAAI,KAAK,WAAW,YAAY,KAAK,WAAW,YAC5C,CAAC,IACD,EAAE,MAAM,QAAQ,EAAE;GACxB,CAAC;GACD,OAAO;EACT;EACA,MAAM,YAAY,KAAK;EA8BvB,MAAM,QAAoB;GACxB,MAAA;IA7BA,IAAI,UAAU;KACZ,OAAO,QAAQ,CAAC,EAAE,WAAW;IAC/B;IACA,SAAS,KAAK,qBAAqB,oBAAoB;IACvD,UAAU;IACV,IAAI,UAAU;KACZ,aAAa;MACX,MAAM,OAAO,QAAQ;MACrB,OAAO,OAAO,eAAe,MAAM,KAAK,IAAI,IAAI,QAAQ;KAC1D;IACF;IACA,IAAI,iBAAiB;KACnB,MAAM,UAAU,QAAQ,CAAC,EAAE;KAC3B,OAAO,gBAAgB,QAAQ,QAAQ,IAAI,KAAA;IAC7C;IACA,IAAI,qBAAqB;KACvB,IAAI,KAAK,gBAAgB,OACvB;KAEF,MAAM,UAAU,QAAQ,CAAC,EAAE;KAC3B,OAAO,WACF,MAAc,aACb,UACG,IAAI,QAAQ,CAAC,CACb,OAAO,oBAAoB,SAAS,MAAM,QAAQ,IACvD,KAAA;IACN;GAGG;GACH;GACA,SAAS;GACT,IAAI,OAAO;IACT,OAAO,QAAQ;GACjB;EACF;EACA,MAAM,OAAO,QAAQ,QAAQ;EAC7B,MAAM,SAAS;GACb,MAAM,CAAC,GAAG,IAAI;GACd,SAAS;GACT,OAAO,KAAK;GACZ,UAAU,KAAK;EACjB;EACA,KAAK,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,GAC9B,IACE,QACC,OAAO,QAAQ,YAAY,OAAO,QAAQ,eAC3C,OAAO,aAAa,GAAG,GAEvB,OAAO,eAAe,KAAK,gBAAgB;GACzC,OAAO;GACP,cAAc;EAChB,CAAC;EAGL,OAAO,IAAI,YAAY,eACrB,KAAK,MAAM,IAAI,aAAa;GAC1B,MAAM,eAAe,KAAK,OAAO,CAAC,CAAC,UAAU;IAC3C,OAAO,UAAU,KAAK,MAAM,IAAI,aAAa,WAAW,KAAK,KAAK,CAAC;IACnE,QAAQ,UACN,KAAK,MAAM,IAAI,aAAa,WAAW,MAAM,KAAK,CAAC;IACrD,gBAAgB,KAAK,MAAM,IAAI,aAAa,WAAW,SAAS,CAAC;GACnE,CAAC;GACD,aAAa,KAAK,MAAM,IAAI,aAAa,aAAa,YAAY,CAAC;EACrE,CAAC,CACH;CACF;AACF"}

package/dist/{bridge-protocol-c66aEkr5.mjs → bridge-protocol-CmRsff2P.mjs}

@@ -1,8 +1,7 @@
-//#region src/bridge-protocol.ts
+// src/bridge-protocol.ts
 const BRIDGE_HANDLE = Symbol.for("@nestjs-kit/better-auth:bridge");
 const EXTENSION_DEFINITION = Symbol.for("@nestjs-kit/better-auth:extension");
 const UPGRADE_REQUEST = Symbol.for("@nestjs-kit/better-auth:upgrade-request");
-//#endregion
 export { EXTENSION_DEFINITION as n, UPGRADE_REQUEST as r, BRIDGE_HANDLE as t };
 
-//# sourceMappingURL=bridge-protocol-c66aEkr5.mjs.map
+//# sourceMappingURL=bridge-protocol-CmRsff2P.mjs.map

package/dist/{bridge-protocol-BDw8opAG.cjs.map → bridge-protocol-CmRsff2P.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"bridge-protocol-BDw8opAG.cjs","names":[],"sources":["../src/bridge-protocol.ts"],"sourcesContent":["import type { HookEndpointContext } from \"better-auth\";\nimport type { CookieSink, DatabaseHookTarget } from \"./auth-contracts.js\";\nimport type { DatabaseHookMethod } from \"./auth-types.js\";\n\nexport const BRIDGE_HANDLE = Symbol.for(\"@nestjs-kit/better-auth:bridge\");\nexport const EXTENSION_DEFINITION = Symbol.for(\n  \"@nestjs-kit/better-auth:extension\",\n);\nexport const UPGRADE_REQUEST = Symbol.for(\n  \"@nestjs-kit/better-auth:upgrade-request\",\n);\n\nexport interface BridgeHandle {\n  readonly protocol: 4; // checked by core (B04); v5: binding state and instance, the caller-session check\n  readonly clientIpHeader: string | null; // single source of truth for the header name (§6.8)\n  /** 'unbound' until the first bind(); 'bound' while an application's hooks are registered; 'closed' after its shutdown, hooks still registered. */\n  readonly state: \"unbound\" | \"bound\" | \"closed\";\n  /** Endpoint dispatches and database-hook dispatches (writes) seen before the first binding, reset by every bind() (B26). */\n  readonly unboundDispatches: number;\n  /**\n   * Registers the application's hooks and returns close(), which the kernel calls in onApplicationShutdown: a closed binding keeps\n   * dispatching until another application binds (§10.6). A second bind() from the same owner for the same instance is a no-op that\n   * returns the existing registration (NestMicroservice.init() runs lifecycle hooks twice); from the same owner for another instance it\n   * throws PLUGIN_SHARED_BETWEEN_INSTANCES (B03). Throws INSTANCE_ALREADY_BOUND if another bootstrapped application is bound; takes over\n   * a never-bootstrapped one (reported, B06) and a closed one (silently). A never-bootstrapped binding it takes over becomes\n   * 'displaced': an application whose init() was still running when another bound fails in onApplicationBootstrap (B06).\n   */\n  bind(binding: BridgeBinding): { close(): void; tookOverFrom?: string };\n  /** true when an endpoint returned `value` (an object) in a non-router dispatch observed while bound; false for before-hook short-circuits (LEAD-V37). */\n  producedByEndpoint(value: unknown): boolean;\n}\nexport interface BridgeBinding {\n  /** The application: compared by identity for the same-owner no-op; `description` goes into the B06 message. */\n  readonly owner: { readonly description: string };\n  /** The instance this plugin object serves; one plugin object serves one instance (B03). */\n  readonly instance: string;\n  /**\n   * 'initialized' at bind; the kernel sets 'bootstrapped' in onApplicationBootstrap; close() sets 'closed'; bind() of another\n   * application sets 'displaced' on an 'initialized' binding it takes over.\n   */\n  state: \"initialized\" | \"bootstrapped\" | \"closed\" | \"displaced\";\n  /** View of the kernel's RequestScope; the plugin never owns an AsyncLocalStorage. [C] */\n  current(): ScopeView | undefined;\n  /** Credential header names declared by the instance's principal sources (credential matching, §7.5). */\n  readonly credentialHeaders: readonly string[];\n  readonly before: readonly CompiledHook[]; // sorted by order, then discovery order\n  readonly after: readonly CompiledHook[];\n  readonly database: Readonly<{\n    [E in DatabaseHookTarget]: {\n      readonly before: readonly DatabaseHookMethod<E, \"before\">[];\n      readonly after: readonly DatabaseHookMethod<E, \"after\">[];\n    };\n  }>;\n  /** Debug log when the bridge drops a direct call's cookies because its credential is foreign. */\n  onDropped(path: string): void;\n}\nexport interface ScopeView {\n  /** Cookie-capable forwarding handlers have already passed the enforcing form check on every method/operation (§7.10). */\n  readonly cookies: CookieSink | null;\n  readonly forward: \"none\" | \"same-credential\" | \"any\";\n  readonly inbound: (() => Headers) | undefined;\n  readonly internal: boolean;\n  /**\n   * Present in EVERY handler scope whose transport exposes a browser leg, unless the plan's origin check is 'off' — enforcing or not,\n   * so safe methods and GraphQL queries are covered too (§7.5). Returns when this leg has a passing origin verdict for `instance`, or\n   * the single kernel disable predicate (§7.10 item 4) holds; a guard run without a passing verdict is insufficient. Otherwise throws the kernel's\n   * BetterAuthConfigurationError PUBLIC_HANDLER_USED_CALLER_SESSION.\n   */\n  readonly checkCallerSession?: (path: string, instance: string) => void;\n  /** The browser leg's OWN headers (TransportCall.browser.headers()), before any transport credential mapping replaced them; undefined\n   * when the transport exposes no browser leg. Entry 2 recognizes an ambiently carried session cookie with it. */\n  readonly browserHeaders: (() => Headers) | undefined;\n}\nexport interface CompiledHook {\n  /**\n   * Evaluate the user predicate once and let it throw. The dispatcher logs and\n   * converts before-hook matcher failures to APIError 500; after-hook matcher\n   * failures cross the next fixed SDK matcher boundary unchanged, so the SDK\n   * cannot recover them as handler APIErrors. Never swallow a failure as a\n   * non-match or evaluate the predicate again in run().\n   */\n  matches(ctx: HookEndpointContext, scope: ScopeView | undefined): boolean;\n  run(ctx: HookEndpointContext): Promise<unknown>;\n}\n"],"mappings":";AAIA,MAAa,gBAAgB,OAAO,IAAI,gCAAgC;AACxE,MAAa,uBAAuB,OAAO,IACzC,mCACF;AACA,MAAa,kBAAkB,OAAO,IACpC,yCACF"}
+{"version":3,"file":"bridge-protocol-CmRsff2P.mjs","names":[],"sources":["../src/bridge-protocol.ts"],"sourcesContent":["import type { HookEndpointContext } from \"better-auth\";\nimport type { CookieSink, DatabaseHookTarget } from \"./auth-contracts.js\";\nimport type { DatabaseHookMethod } from \"./auth-types.js\";\n\nexport const BRIDGE_HANDLE = Symbol.for(\"@nestjs-kit/better-auth:bridge\");\nexport const EXTENSION_DEFINITION = Symbol.for(\n  \"@nestjs-kit/better-auth:extension\",\n);\nexport const UPGRADE_REQUEST = Symbol.for(\n  \"@nestjs-kit/better-auth:upgrade-request\",\n);\n\nexport interface BridgeHandle {\n  readonly protocol: 4; // checked by core (B04); v5: binding state and instance, the caller-session check\n  readonly clientIpHeader: string | null; // single source of truth for the header name (§6.8)\n  /** 'unbound' until the first bind(); 'bound' while an application's hooks are registered; 'closed' after its shutdown, hooks still registered. */\n  readonly state: \"unbound\" | \"bound\" | \"closed\";\n  /** Endpoint dispatches and database-hook dispatches (writes) seen before the first binding, reset by every bind() (B26). */\n  readonly unboundDispatches: number;\n  /**\n   * Registers the application's hooks and returns close(), which the kernel calls in onApplicationShutdown: a closed binding keeps\n   * dispatching until another application binds (§10.6). A second bind() from the same owner for the same instance is a no-op that\n   * returns the existing registration (NestMicroservice.init() runs lifecycle hooks twice); from the same owner for another instance it\n   * throws PLUGIN_SHARED_BETWEEN_INSTANCES (B03). Throws INSTANCE_ALREADY_BOUND if another bootstrapped application is bound; takes over\n   * a never-bootstrapped one (reported, B06) and a closed one (silently). A never-bootstrapped binding it takes over becomes\n   * 'displaced': an application whose init() was still running when another bound fails in onApplicationBootstrap (B06).\n   */\n  bind(binding: BridgeBinding): { close(): void; tookOverFrom?: string };\n  /** true when an endpoint returned `value` (an object) in a non-router dispatch observed while bound; false for before-hook short-circuits (LEAD-V37). */\n  producedByEndpoint(value: unknown): boolean;\n}\nexport interface BridgeBinding {\n  /** The application: compared by identity for the same-owner no-op; `description` goes into the B06 message. */\n  readonly owner: { readonly description: string };\n  /** The instance this plugin object serves; one plugin object serves one instance (B03). */\n  readonly instance: string;\n  /**\n   * 'initialized' at bind; the kernel sets 'bootstrapped' in onApplicationBootstrap; close() sets 'closed'; bind() of another\n   * application sets 'displaced' on an 'initialized' binding it takes over.\n   */\n  state: \"initialized\" | \"bootstrapped\" | \"closed\" | \"displaced\";\n  /** View of the kernel's RequestScope; the plugin never owns an AsyncLocalStorage. [C] */\n  current(): ScopeView | undefined;\n  /** Credential header names declared by the instance's principal sources (credential matching, §7.5). */\n  readonly credentialHeaders: readonly string[];\n  readonly before: readonly CompiledHook[]; // sorted by order, then discovery order\n  readonly after: readonly CompiledHook[];\n  readonly database: Readonly<{\n    [E in DatabaseHookTarget]: {\n      readonly before: readonly DatabaseHookMethod<E, \"before\">[];\n      readonly after: readonly DatabaseHookMethod<E, \"after\">[];\n    };\n  }>;\n  /** Debug log when the bridge drops a direct call's cookies because its credential is foreign. */\n  onDropped(path: string): void;\n}\nexport interface ScopeView {\n  /** Cookie-capable forwarding handlers have already passed the enforcing form check on every method/operation (§7.10). */\n  readonly cookies: CookieSink | null;\n  readonly forward: \"none\" | \"same-credential\" | \"any\";\n  readonly inbound: (() => Headers) | undefined;\n  readonly internal: boolean;\n  /**\n   * Present in EVERY handler scope whose transport exposes a browser leg, unless the plan's origin check is 'off' — enforcing or not,\n   * so safe methods and GraphQL queries are covered too (§7.5). Returns when this leg has a passing origin verdict for `instance`, or\n   * the single kernel disable predicate (§7.10 item 4) holds; a guard run without a passing verdict is insufficient. Otherwise throws the kernel's\n   * BetterAuthConfigurationError PUBLIC_HANDLER_USED_CALLER_SESSION.\n   */\n  readonly checkCallerSession?: (path: string, instance: string) => void;\n  /** The browser leg's OWN headers (TransportCall.browser.headers()), before any transport credential mapping replaced them; undefined\n   * when the transport exposes no browser leg. Entry 2 recognizes an ambiently carried session cookie with it. */\n  readonly browserHeaders: (() => Headers) | undefined;\n}\nexport interface CompiledHook {\n  /**\n   * Evaluate the user predicate once and let it throw. The dispatcher logs and\n   * converts before-hook matcher failures to APIError 500; after-hook matcher\n   * failures cross the next fixed SDK matcher boundary unchanged, so the SDK\n   * cannot recover them as handler APIErrors. Never swallow a failure as a\n   * non-match or evaluate the predicate again in run().\n   */\n  matches(ctx: HookEndpointContext, scope: ScopeView | undefined): boolean;\n  run(ctx: HookEndpointContext): Promise<unknown>;\n}\n"],"mappings":";AAIA,MAAa,gBAAgB,OAAO,IAAI,gCAAgC;AACxE,MAAa,uBAAuB,OAAO,IACzC,mCACF;AACA,MAAa,kBAAkB,OAAO,IACpC,yCACF"}

package/dist/{bridge-protocol-BDw8opAG.cjs → bridge-protocol-DNFhIKdo.cjs}

@@ -1,8 +1,7 @@
-//#region src/bridge-protocol.ts
+// src/bridge-protocol.ts
 const BRIDGE_HANDLE = Symbol.for("@nestjs-kit/better-auth:bridge");
 const EXTENSION_DEFINITION = Symbol.for("@nestjs-kit/better-auth:extension");
 const UPGRADE_REQUEST = Symbol.for("@nestjs-kit/better-auth:upgrade-request");
-//#endregion
 Object.defineProperty(exports, "BRIDGE_HANDLE", {
 	enumerable: true,
 	get: function() {
@@ -22,4 +21,4 @@ Object.defineProperty(exports, "UPGRADE_REQUEST", {
 	}
 });
 
-//# sourceMappingURL=bridge-protocol-BDw8opAG.cjs.map
+//# sourceMappingURL=bridge-protocol-DNFhIKdo.cjs.map

package/dist/{bridge-protocol-c66aEkr5.mjs.map → bridge-protocol-DNFhIKdo.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"bridge-protocol-c66aEkr5.mjs","names":[],"sources":["../src/bridge-protocol.ts"],"sourcesContent":["import type { HookEndpointContext } from \"better-auth\";\nimport type { CookieSink, DatabaseHookTarget } from \"./auth-contracts.js\";\nimport type { DatabaseHookMethod } from \"./auth-types.js\";\n\nexport const BRIDGE_HANDLE = Symbol.for(\"@nestjs-kit/better-auth:bridge\");\nexport const EXTENSION_DEFINITION = Symbol.for(\n  \"@nestjs-kit/better-auth:extension\",\n);\nexport const UPGRADE_REQUEST = Symbol.for(\n  \"@nestjs-kit/better-auth:upgrade-request\",\n);\n\nexport interface BridgeHandle {\n  readonly protocol: 4; // checked by core (B04); v5: binding state and instance, the caller-session check\n  readonly clientIpHeader: string | null; // single source of truth for the header name (§6.8)\n  /** 'unbound' until the first bind(); 'bound' while an application's hooks are registered; 'closed' after its shutdown, hooks still registered. */\n  readonly state: \"unbound\" | \"bound\" | \"closed\";\n  /** Endpoint dispatches and database-hook dispatches (writes) seen before the first binding, reset by every bind() (B26). */\n  readonly unboundDispatches: number;\n  /**\n   * Registers the application's hooks and returns close(), which the kernel calls in onApplicationShutdown: a closed binding keeps\n   * dispatching until another application binds (§10.6). A second bind() from the same owner for the same instance is a no-op that\n   * returns the existing registration (NestMicroservice.init() runs lifecycle hooks twice); from the same owner for another instance it\n   * throws PLUGIN_SHARED_BETWEEN_INSTANCES (B03). Throws INSTANCE_ALREADY_BOUND if another bootstrapped application is bound; takes over\n   * a never-bootstrapped one (reported, B06) and a closed one (silently). A never-bootstrapped binding it takes over becomes\n   * 'displaced': an application whose init() was still running when another bound fails in onApplicationBootstrap (B06).\n   */\n  bind(binding: BridgeBinding): { close(): void; tookOverFrom?: string };\n  /** true when an endpoint returned `value` (an object) in a non-router dispatch observed while bound; false for before-hook short-circuits (LEAD-V37). */\n  producedByEndpoint(value: unknown): boolean;\n}\nexport interface BridgeBinding {\n  /** The application: compared by identity for the same-owner no-op; `description` goes into the B06 message. */\n  readonly owner: { readonly description: string };\n  /** The instance this plugin object serves; one plugin object serves one instance (B03). */\n  readonly instance: string;\n  /**\n   * 'initialized' at bind; the kernel sets 'bootstrapped' in onApplicationBootstrap; close() sets 'closed'; bind() of another\n   * application sets 'displaced' on an 'initialized' binding it takes over.\n   */\n  state: \"initialized\" | \"bootstrapped\" | \"closed\" | \"displaced\";\n  /** View of the kernel's RequestScope; the plugin never owns an AsyncLocalStorage. [C] */\n  current(): ScopeView | undefined;\n  /** Credential header names declared by the instance's principal sources (credential matching, §7.5). */\n  readonly credentialHeaders: readonly string[];\n  readonly before: readonly CompiledHook[]; // sorted by order, then discovery order\n  readonly after: readonly CompiledHook[];\n  readonly database: Readonly<{\n    [E in DatabaseHookTarget]: {\n      readonly before: readonly DatabaseHookMethod<E, \"before\">[];\n      readonly after: readonly DatabaseHookMethod<E, \"after\">[];\n    };\n  }>;\n  /** Debug log when the bridge drops a direct call's cookies because its credential is foreign. */\n  onDropped(path: string): void;\n}\nexport interface ScopeView {\n  /** Cookie-capable forwarding handlers have already passed the enforcing form check on every method/operation (§7.10). */\n  readonly cookies: CookieSink | null;\n  readonly forward: \"none\" | \"same-credential\" | \"any\";\n  readonly inbound: (() => Headers) | undefined;\n  readonly internal: boolean;\n  /**\n   * Present in EVERY handler scope whose transport exposes a browser leg, unless the plan's origin check is 'off' — enforcing or not,\n   * so safe methods and GraphQL queries are covered too (§7.5). Returns when this leg has a passing origin verdict for `instance`, or\n   * the single kernel disable predicate (§7.10 item 4) holds; a guard run without a passing verdict is insufficient. Otherwise throws the kernel's\n   * BetterAuthConfigurationError PUBLIC_HANDLER_USED_CALLER_SESSION.\n   */\n  readonly checkCallerSession?: (path: string, instance: string) => void;\n  /** The browser leg's OWN headers (TransportCall.browser.headers()), before any transport credential mapping replaced them; undefined\n   * when the transport exposes no browser leg. Entry 2 recognizes an ambiently carried session cookie with it. */\n  readonly browserHeaders: (() => Headers) | undefined;\n}\nexport interface CompiledHook {\n  /**\n   * Evaluate the user predicate once and let it throw. The dispatcher logs and\n   * converts before-hook matcher failures to APIError 500; after-hook matcher\n   * failures cross the next fixed SDK matcher boundary unchanged, so the SDK\n   * cannot recover them as handler APIErrors. Never swallow a failure as a\n   * non-match or evaluate the predicate again in run().\n   */\n  matches(ctx: HookEndpointContext, scope: ScopeView | undefined): boolean;\n  run(ctx: HookEndpointContext): Promise<unknown>;\n}\n"],"mappings":";AAIA,MAAa,gBAAgB,OAAO,IAAI,gCAAgC;AACxE,MAAa,uBAAuB,OAAO,IACzC,mCACF;AACA,MAAa,kBAAkB,OAAO,IACpC,yCACF"}
+{"version":3,"file":"bridge-protocol-DNFhIKdo.cjs","names":[],"sources":["../src/bridge-protocol.ts"],"sourcesContent":["import type { HookEndpointContext } from \"better-auth\";\nimport type { CookieSink, DatabaseHookTarget } from \"./auth-contracts.js\";\nimport type { DatabaseHookMethod } from \"./auth-types.js\";\n\nexport const BRIDGE_HANDLE = Symbol.for(\"@nestjs-kit/better-auth:bridge\");\nexport const EXTENSION_DEFINITION = Symbol.for(\n  \"@nestjs-kit/better-auth:extension\",\n);\nexport const UPGRADE_REQUEST = Symbol.for(\n  \"@nestjs-kit/better-auth:upgrade-request\",\n);\n\nexport interface BridgeHandle {\n  readonly protocol: 4; // checked by core (B04); v5: binding state and instance, the caller-session check\n  readonly clientIpHeader: string | null; // single source of truth for the header name (§6.8)\n  /** 'unbound' until the first bind(); 'bound' while an application's hooks are registered; 'closed' after its shutdown, hooks still registered. */\n  readonly state: \"unbound\" | \"bound\" | \"closed\";\n  /** Endpoint dispatches and database-hook dispatches (writes) seen before the first binding, reset by every bind() (B26). */\n  readonly unboundDispatches: number;\n  /**\n   * Registers the application's hooks and returns close(), which the kernel calls in onApplicationShutdown: a closed binding keeps\n   * dispatching until another application binds (§10.6). A second bind() from the same owner for the same instance is a no-op that\n   * returns the existing registration (NestMicroservice.init() runs lifecycle hooks twice); from the same owner for another instance it\n   * throws PLUGIN_SHARED_BETWEEN_INSTANCES (B03). Throws INSTANCE_ALREADY_BOUND if another bootstrapped application is bound; takes over\n   * a never-bootstrapped one (reported, B06) and a closed one (silently). A never-bootstrapped binding it takes over becomes\n   * 'displaced': an application whose init() was still running when another bound fails in onApplicationBootstrap (B06).\n   */\n  bind(binding: BridgeBinding): { close(): void; tookOverFrom?: string };\n  /** true when an endpoint returned `value` (an object) in a non-router dispatch observed while bound; false for before-hook short-circuits (LEAD-V37). */\n  producedByEndpoint(value: unknown): boolean;\n}\nexport interface BridgeBinding {\n  /** The application: compared by identity for the same-owner no-op; `description` goes into the B06 message. */\n  readonly owner: { readonly description: string };\n  /** The instance this plugin object serves; one plugin object serves one instance (B03). */\n  readonly instance: string;\n  /**\n   * 'initialized' at bind; the kernel sets 'bootstrapped' in onApplicationBootstrap; close() sets 'closed'; bind() of another\n   * application sets 'displaced' on an 'initialized' binding it takes over.\n   */\n  state: \"initialized\" | \"bootstrapped\" | \"closed\" | \"displaced\";\n  /** View of the kernel's RequestScope; the plugin never owns an AsyncLocalStorage. [C] */\n  current(): ScopeView | undefined;\n  /** Credential header names declared by the instance's principal sources (credential matching, §7.5). */\n  readonly credentialHeaders: readonly string[];\n  readonly before: readonly CompiledHook[]; // sorted by order, then discovery order\n  readonly after: readonly CompiledHook[];\n  readonly database: Readonly<{\n    [E in DatabaseHookTarget]: {\n      readonly before: readonly DatabaseHookMethod<E, \"before\">[];\n      readonly after: readonly DatabaseHookMethod<E, \"after\">[];\n    };\n  }>;\n  /** Debug log when the bridge drops a direct call's cookies because its credential is foreign. */\n  onDropped(path: string): void;\n}\nexport interface ScopeView {\n  /** Cookie-capable forwarding handlers have already passed the enforcing form check on every method/operation (§7.10). */\n  readonly cookies: CookieSink | null;\n  readonly forward: \"none\" | \"same-credential\" | \"any\";\n  readonly inbound: (() => Headers) | undefined;\n  readonly internal: boolean;\n  /**\n   * Present in EVERY handler scope whose transport exposes a browser leg, unless the plan's origin check is 'off' — enforcing or not,\n   * so safe methods and GraphQL queries are covered too (§7.5). Returns when this leg has a passing origin verdict for `instance`, or\n   * the single kernel disable predicate (§7.10 item 4) holds; a guard run without a passing verdict is insufficient. Otherwise throws the kernel's\n   * BetterAuthConfigurationError PUBLIC_HANDLER_USED_CALLER_SESSION.\n   */\n  readonly checkCallerSession?: (path: string, instance: string) => void;\n  /** The browser leg's OWN headers (TransportCall.browser.headers()), before any transport credential mapping replaced them; undefined\n   * when the transport exposes no browser leg. Entry 2 recognizes an ambiently carried session cookie with it. */\n  readonly browserHeaders: (() => Headers) | undefined;\n}\nexport interface CompiledHook {\n  /**\n   * Evaluate the user predicate once and let it throw. The dispatcher logs and\n   * converts before-hook matcher failures to APIError 500; after-hook matcher\n   * failures cross the next fixed SDK matcher boundary unchanged, so the SDK\n   * cannot recover them as handler APIErrors. Never swallow a failure as a\n   * non-match or evaluate the predicate again in run().\n   */\n  matches(ctx: HookEndpointContext, scope: ScopeView | undefined): boolean;\n  run(ctx: HookEndpointContext): Promise<unknown>;\n}\n"],"mappings":";AAIA,MAAa,gBAAgB,OAAO,IAAI,gCAAgC;AACxE,MAAa,uBAAuB,OAAO,IACzC,mCACF;AACA,MAAa,kBAAkB,OAAO,IACpC,yCACF"}

package/dist/{decorate-Dt0e9K6R.mjs → decorate-bO-rBn-G.mjs}

@@ -1,4 +1,4 @@
-//#region src/auth-tokens.ts
+// src/auth-tokens.ts
 /** Stable Nest injection tokens shared by every package copy and module format. */
 function instanceToken(base, alias) {
 	return alias === void 0 || alias === "" || alias === "default" ? base : `${base}_${alias}`;
@@ -54,27 +54,23 @@ const READER_CONTEXT = Symbol.for("@nestjs-kit/better-auth:reader-context");
 const INVOCATION_VALUES = Symbol.for("@nestjs-kit/better-auth:invocation");
 /** Stored in place of an invocation value that two contributing policy runs published differently. */
 const AMBIGUOUS_INVOCATION_VALUE = Symbol.for("@nestjs-kit/better-auth:ambiguous-invocation-value");
-//#endregion
-//#region \0@oxc-project+runtime@0.153.0/helpers/esm/decorateMetadata.js
+// \0@oxc-project+runtime@0.156.0/helpers/esm/decorateMetadata.js
 function __decorateMetadata(k, v) {
 	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-//#endregion
-//#region \0@oxc-project+runtime@0.153.0/helpers/esm/decorateParam.js
+// \0@oxc-project+runtime@0.156.0/helpers/esm/decorateParam.js
 function __decorateParam(paramIndex, decorator) {
 	return function(target, key) {
 		decorator(target, key, paramIndex);
 	};
 }
-//#endregion
-//#region \0@oxc-project+runtime@0.153.0/helpers/esm/decorate.js
+// \0@oxc-project+runtime@0.156.0/helpers/esm/decorate.js
 function __decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
 	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
 	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
 	return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-//#endregion
 export { SKIP_ORIGIN_CHECK_METADATA as A, getPrincipalSourcesToken as B, PRINCIPAL_RESOLVER as C, ROUTE_PLANNER as D, REQUIREMENTS_METADATA as E, getBetterAuthHandleToken as F, getBetterAuthInstanceToken as I, getBetterAuthOptionsToken as L, TRANSPORT_REGISTRY as M, USE_BETTER_AUTH_METADATA as N, SCOPE_CORE as O, WS_CONNECTION_AUTH as P, getBetterAuthServiceToken as R, PRINCIPAL_READINGS as S, REQUEST_SCOPE as T, MOUNT_COORDINATOR as _, ACCESS_METADATA as a, POLICY_RESOLVER as b, AUTH_INSTANCE_METADATA as c, FRESHNESS_METADATA as d, GUARD_CORE as f, INVOCATION_VALUES as g, INVOCATION_PARAMS_METADATA as h, ACCEPT_PRINCIPALS_METADATA as i, TRANSPORTS as j, SKIP_DEFAULT_REQUIREMENTS_METADATA as k, DB_HOOK_METADATA as l, INSTANCE_REGISTRY as m, __decorateParam as n, AMBIGUOUS_INVOCATION_VALUE as o, HOOK_METADATA as p, __decorateMetadata as r, AUTH_ENHANCER as s, __decorate as t, FORWARD_COOKIES_METADATA as u, PLATFORMS as v, READER_CONTEXT as w, PRINCIPAL_PARAMS_METADATA as x, POLICY_INVOKER as y, getExtensionToken as z };
 
-//# sourceMappingURL=decorate-Dt0e9K6R.mjs.map
+//# sourceMappingURL=decorate-bO-rBn-G.mjs.map

package/dist/{decorate-Dt0e9K6R.mjs.map → decorate-bO-rBn-G.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"decorate-Dt0e9K6R.mjs","names":[],"sources":["../src/auth-tokens.ts"],"sourcesContent":["/** Stable Nest injection tokens shared by every package copy and module format. */\nfunction instanceToken(base: string, alias?: string): string {\n  return alias === undefined || alias === \"\" || alias === \"default\"\n    ? base\n    : `${base}_${alias}`;\n}\n\nexport function getBetterAuthInstanceToken(alias?: string): string {\n  return instanceToken(\"NESTJS_KIT_BETTER_AUTH_INSTANCE\", alias);\n}\n\nexport function getBetterAuthOptionsToken(alias?: string): string {\n  return instanceToken(\"NESTJS_KIT_BETTER_AUTH_OPTIONS\", alias);\n}\n\nexport function getBetterAuthServiceToken(alias?: string): string {\n  return instanceToken(\"NESTJS_KIT_BETTER_AUTH_SERVICE\", alias);\n}\n\nexport function getBetterAuthHandleToken(alias?: string): string {\n  return instanceToken(\"NESTJS_KIT_BETTER_AUTH_HANDLE\", alias);\n}\n\n// Shared application collaborators and metadata must also survive duplicate copies.\nexport const INSTANCE_REGISTRY = Symbol.for(\n  \"@nestjs-kit/better-auth:instance-registry\",\n);\nexport const REQUEST_SCOPE = Symbol.for(\n  \"@nestjs-kit/better-auth:request-scope\",\n);\nexport const PRINCIPAL_READINGS = Symbol.for(\n  \"@nestjs-kit/better-auth:principal-readings\",\n);\nexport const ROUTE_PLANNER = Symbol.for(\n  \"@nestjs-kit/better-auth:route-planner\",\n);\nexport const TRANSPORT_REGISTRY = Symbol.for(\n  \"@nestjs-kit/better-auth:transport-registry\",\n);\nexport const POLICY_RESOLVER = Symbol.for(\n  \"@nestjs-kit/better-auth:policy-resolver\",\n);\nexport const MOUNT_COORDINATOR = Symbol.for(\n  \"@nestjs-kit/better-auth:mount-coordinator\",\n);\nexport const GUARD_CORE = Symbol.for(\"@nestjs-kit/better-auth:guard-core\");\nexport const SCOPE_CORE = Symbol.for(\"@nestjs-kit/better-auth:scope-core\");\nexport const PRINCIPAL_RESOLVER = Symbol.for(\n  \"@nestjs-kit/better-auth:principal-resolver\",\n);\nexport const POLICY_INVOKER = Symbol.for(\n  \"@nestjs-kit/better-auth:policy-invoker\",\n);\nexport const PLATFORMS = Symbol.for(\"@nestjs-kit/better-auth:platforms\");\nexport const TRANSPORTS = Symbol.for(\"@nestjs-kit/better-auth:transports\");\nexport const ACCESS_METADATA = Symbol.for(\"@nestjs-kit/better-auth:access\");\nexport const ACCEPT_PRINCIPALS_METADATA = Symbol.for(\n  \"@nestjs-kit/better-auth:accept-principals\",\n);\nexport const REQUIREMENTS_METADATA = Symbol.for(\n  \"@nestjs-kit/better-auth:requirements\",\n);\nexport const SKIP_DEFAULT_REQUIREMENTS_METADATA = Symbol.for(\n  \"@nestjs-kit/better-auth:skip-default-requirements\",\n);\nexport const FRESHNESS_METADATA = Symbol.for(\n  \"@nestjs-kit/better-auth:freshness\",\n);\nexport const AUTH_INSTANCE_METADATA = Symbol.for(\n  \"@nestjs-kit/better-auth:auth-instance\",\n);\nexport const PRINCIPAL_PARAMS_METADATA = Symbol.for(\n  \"@nestjs-kit/better-auth:principal-params\",\n);\nexport const INVOCATION_PARAMS_METADATA = Symbol.for(\n  \"@nestjs-kit/better-auth:invocation-params\",\n);\nexport const FORWARD_COOKIES_METADATA = Symbol.for(\n  \"@nestjs-kit/better-auth:forward-cookies\",\n);\nexport const SKIP_ORIGIN_CHECK_METADATA = Symbol.for(\n  \"@nestjs-kit/better-auth:skip-origin-check\",\n);\nexport const USE_BETTER_AUTH_METADATA = Symbol.for(\n  \"@nestjs-kit/better-auth:use-better-auth\",\n);\nexport const HOOK_METADATA = Symbol.for(\"@nestjs-kit/better-auth:hook\");\nexport const DB_HOOK_METADATA = Symbol.for(\"@nestjs-kit/better-auth:db-hook\");\nexport const AUTH_ENHANCER = Symbol.for(\"@nestjs-kit/better-auth:enhancer\");\n/** Connection-time WebSocket authentication, provided by the socket.io and ws transport definitions. */\nexport const WS_CONNECTION_AUTH: unique symbol = Symbol.for(\n  \"@nestjs-kit/better-auth:ws-connection-auth\",\n);\n\nexport function getPrincipalSourcesToken(instance: string): symbol {\n  return Symbol.for(`@nestjs-kit/better-auth:principal-sources:${instance}`);\n}\n\nexport function getExtensionToken(\n  point: \"platforms\" | \"transports\" | \"principals\",\n  instance: string,\n  index: number,\n): symbol {\n  return Symbol.for(\n    `@nestjs-kit/better-auth:ext:${point}:${instance}:${index}`,\n  );\n}\n\nexport const READER_CONTEXT = Symbol.for(\n  \"@nestjs-kit/better-auth:reader-context\",\n);\nexport const INVOCATION_VALUES = Symbol.for(\n  \"@nestjs-kit/better-auth:invocation\",\n);\n/** Stored in place of an invocation value that two contributing policy runs published differently. */\nexport const AMBIGUOUS_INVOCATION_VALUE = Symbol.for(\n  \"@nestjs-kit/better-auth:ambiguous-invocation-value\",\n);\n"],"mappings":";;AACA,SAAS,cAAc,MAAc,OAAwB;CAC3D,OAAO,UAAU,KAAA,KAAa,UAAU,MAAM,UAAU,YACpD,OACA,GAAG,KAAK,GAAG;AACjB;AAEA,SAAgB,2BAA2B,OAAwB;CACjE,OAAO,cAAc,mCAAmC,KAAK;AAC/D;AAEA,SAAgB,0BAA0B,OAAwB;CAChE,OAAO,cAAc,kCAAkC,KAAK;AAC9D;AAEA,SAAgB,0BAA0B,OAAwB;CAChE,OAAO,cAAc,kCAAkC,KAAK;AAC9D;AAEA,SAAgB,yBAAyB,OAAwB;CAC/D,OAAO,cAAc,iCAAiC,KAAK;AAC7D;AAGA,MAAa,oBAAoB,OAAO,IACtC,2CACF;AACA,MAAa,gBAAgB,OAAO,IAClC,uCACF;AACA,MAAa,qBAAqB,OAAO,IACvC,4CACF;AACA,MAAa,gBAAgB,OAAO,IAClC,uCACF;AACA,MAAa,qBAAqB,OAAO,IACvC,4CACF;AACA,MAAa,kBAAkB,OAAO,IACpC,yCACF;AACA,MAAa,oBAAoB,OAAO,IACtC,2CACF;AACA,MAAa,aAAa,OAAO,IAAI,oCAAoC;AACzE,MAAa,aAAa,OAAO,IAAI,oCAAoC;AACzE,MAAa,qBAAqB,OAAO,IACvC,4CACF;AACA,MAAa,iBAAiB,OAAO,IACnC,wCACF;AACA,MAAa,YAAY,OAAO,IAAI,mCAAmC;AACvE,MAAa,aAAa,OAAO,IAAI,oCAAoC;AACzE,MAAa,kBAAkB,OAAO,IAAI,gCAAgC;AAC1E,MAAa,6BAA6B,OAAO,IAC/C,2CACF;AACA,MAAa,wBAAwB,OAAO,IAC1C,sCACF;AACA,MAAa,qCAAqC,OAAO,IACvD,mDACF;AACA,MAAa,qBAAqB,OAAO,IACvC,mCACF;AACA,MAAa,yBAAyB,OAAO,IAC3C,uCACF;AACA,MAAa,4BAA4B,OAAO,IAC9C,0CACF;AACA,MAAa,6BAA6B,OAAO,IAC/C,2CACF;AACA,MAAa,2BAA2B,OAAO,IAC7C,yCACF;AACA,MAAa,6BAA6B,OAAO,IAC/C,2CACF;AACA,MAAa,2BAA2B,OAAO,IAC7C,yCACF;AACA,MAAa,gBAAgB,OAAO,IAAI,8BAA8B;AACtE,MAAa,mBAAmB,OAAO,IAAI,iCAAiC;AAC5E,MAAa,gBAAgB,OAAO,IAAI,kCAAkC;;AAE1E,MAAa,qBAAoC,OAAO,IACtD,4CACF;AAEA,SAAgB,yBAAyB,UAA0B;CACjE,OAAO,OAAO,IAAI,6CAA6C,UAAU;AAC3E;AAEA,SAAgB,kBACd,OACA,UACA,OACQ;CACR,OAAO,OAAO,IACZ,+BAA+B,MAAM,GAAG,SAAS,GAAG,OACtD;AACF;AAEA,MAAa,iBAAiB,OAAO,IACnC,wCACF;AACA,MAAa,oBAAoB,OAAO,IACtC,oCACF;;AAEA,MAAa,6BAA6B,OAAO,IAC/C,oDACF"}
+{"version":3,"file":"decorate-bO-rBn-G.mjs","names":[],"sources":["../src/auth-tokens.ts"],"sourcesContent":["/** Stable Nest injection tokens shared by every package copy and module format. */\nfunction instanceToken(base: string, alias?: string): string {\n  return alias === undefined || alias === \"\" || alias === \"default\"\n    ? base\n    : `${base}_${alias}`;\n}\n\nexport function getBetterAuthInstanceToken(alias?: string): string {\n  return instanceToken(\"NESTJS_KIT_BETTER_AUTH_INSTANCE\", alias);\n}\n\nexport function getBetterAuthOptionsToken(alias?: string): string {\n  return instanceToken(\"NESTJS_KIT_BETTER_AUTH_OPTIONS\", alias);\n}\n\nexport function getBetterAuthServiceToken(alias?: string): string {\n  return instanceToken(\"NESTJS_KIT_BETTER_AUTH_SERVICE\", alias);\n}\n\nexport function getBetterAuthHandleToken(alias?: string): string {\n  return instanceToken(\"NESTJS_KIT_BETTER_AUTH_HANDLE\", alias);\n}\n\n// Shared application collaborators and metadata must also survive duplicate copies.\nexport const INSTANCE_REGISTRY = Symbol.for(\n  \"@nestjs-kit/better-auth:instance-registry\",\n);\nexport const REQUEST_SCOPE = Symbol.for(\n  \"@nestjs-kit/better-auth:request-scope\",\n);\nexport const PRINCIPAL_READINGS = Symbol.for(\n  \"@nestjs-kit/better-auth:principal-readings\",\n);\nexport const ROUTE_PLANNER = Symbol.for(\n  \"@nestjs-kit/better-auth:route-planner\",\n);\nexport const TRANSPORT_REGISTRY = Symbol.for(\n  \"@nestjs-kit/better-auth:transport-registry\",\n);\nexport const POLICY_RESOLVER = Symbol.for(\n  \"@nestjs-kit/better-auth:policy-resolver\",\n);\nexport const MOUNT_COORDINATOR = Symbol.for(\n  \"@nestjs-kit/better-auth:mount-coordinator\",\n);\nexport const GUARD_CORE = Symbol.for(\"@nestjs-kit/better-auth:guard-core\");\nexport const SCOPE_CORE = Symbol.for(\"@nestjs-kit/better-auth:scope-core\");\nexport const PRINCIPAL_RESOLVER = Symbol.for(\n  \"@nestjs-kit/better-auth:principal-resolver\",\n);\nexport const POLICY_INVOKER = Symbol.for(\n  \"@nestjs-kit/better-auth:policy-invoker\",\n);\nexport const PLATFORMS = Symbol.for(\"@nestjs-kit/better-auth:platforms\");\nexport const TRANSPORTS = Symbol.for(\"@nestjs-kit/better-auth:transports\");\nexport const ACCESS_METADATA = Symbol.for(\"@nestjs-kit/better-auth:access\");\nexport const ACCEPT_PRINCIPALS_METADATA = Symbol.for(\n  \"@nestjs-kit/better-auth:accept-principals\",\n);\nexport const REQUIREMENTS_METADATA = Symbol.for(\n  \"@nestjs-kit/better-auth:requirements\",\n);\nexport const SKIP_DEFAULT_REQUIREMENTS_METADATA = Symbol.for(\n  \"@nestjs-kit/better-auth:skip-default-requirements\",\n);\nexport const FRESHNESS_METADATA = Symbol.for(\n  \"@nestjs-kit/better-auth:freshness\",\n);\nexport const AUTH_INSTANCE_METADATA = Symbol.for(\n  \"@nestjs-kit/better-auth:auth-instance\",\n);\nexport const PRINCIPAL_PARAMS_METADATA = Symbol.for(\n  \"@nestjs-kit/better-auth:principal-params\",\n);\nexport const INVOCATION_PARAMS_METADATA = Symbol.for(\n  \"@nestjs-kit/better-auth:invocation-params\",\n);\nexport const FORWARD_COOKIES_METADATA = Symbol.for(\n  \"@nestjs-kit/better-auth:forward-cookies\",\n);\nexport const SKIP_ORIGIN_CHECK_METADATA = Symbol.for(\n  \"@nestjs-kit/better-auth:skip-origin-check\",\n);\nexport const USE_BETTER_AUTH_METADATA = Symbol.for(\n  \"@nestjs-kit/better-auth:use-better-auth\",\n);\nexport const HOOK_METADATA = Symbol.for(\"@nestjs-kit/better-auth:hook\");\nexport const DB_HOOK_METADATA = Symbol.for(\"@nestjs-kit/better-auth:db-hook\");\nexport const AUTH_ENHANCER = Symbol.for(\"@nestjs-kit/better-auth:enhancer\");\n/** Connection-time WebSocket authentication, provided by the socket.io and ws transport definitions. */\nexport const WS_CONNECTION_AUTH: unique symbol = Symbol.for(\n  \"@nestjs-kit/better-auth:ws-connection-auth\",\n);\n\nexport function getPrincipalSourcesToken(instance: string): symbol {\n  return Symbol.for(`@nestjs-kit/better-auth:principal-sources:${instance}`);\n}\n\nexport function getExtensionToken(\n  point: \"platforms\" | \"transports\" | \"principals\",\n  instance: string,\n  index: number,\n): symbol {\n  return Symbol.for(\n    `@nestjs-kit/better-auth:ext:${point}:${instance}:${index}`,\n  );\n}\n\nexport const READER_CONTEXT = Symbol.for(\n  \"@nestjs-kit/better-auth:reader-context\",\n);\nexport const INVOCATION_VALUES = Symbol.for(\n  \"@nestjs-kit/better-auth:invocation\",\n);\n/** Stored in place of an invocation value that two contributing policy runs published differently. */\nexport const AMBIGUOUS_INVOCATION_VALUE = Symbol.for(\n  \"@nestjs-kit/better-auth:ambiguous-invocation-value\",\n);\n"],"mappings":";;AACA,SAAS,cAAc,MAAc,OAAwB;CAC3D,OAAO,UAAU,KAAA,KAAa,UAAU,MAAM,UAAU,YACpD,OACA,GAAG,KAAK,GAAG;AACjB;AAEA,SAAgB,2BAA2B,OAAwB;CACjE,OAAO,cAAc,mCAAmC,KAAK;AAC/D;AAEA,SAAgB,0BAA0B,OAAwB;CAChE,OAAO,cAAc,kCAAkC,KAAK;AAC9D;AAEA,SAAgB,0BAA0B,OAAwB;CAChE,OAAO,cAAc,kCAAkC,KAAK;AAC9D;AAEA,SAAgB,yBAAyB,OAAwB;CAC/D,OAAO,cAAc,iCAAiC,KAAK;AAC7D;AAGA,MAAa,oBAAoB,OAAO,IACtC,2CACF;AACA,MAAa,gBAAgB,OAAO,IAClC,uCACF;AACA,MAAa,qBAAqB,OAAO,IACvC,4CACF;AACA,MAAa,gBAAgB,OAAO,IAClC,uCACF;AACA,MAAa,qBAAqB,OAAO,IACvC,4CACF;AACA,MAAa,kBAAkB,OAAO,IACpC,yCACF;AACA,MAAa,oBAAoB,OAAO,IACtC,2CACF;AACA,MAAa,aAAa,OAAO,IAAI,oCAAoC;AACzE,MAAa,aAAa,OAAO,IAAI,oCAAoC;AACzE,MAAa,qBAAqB,OAAO,IACvC,4CACF;AACA,MAAa,iBAAiB,OAAO,IACnC,wCACF;AACA,MAAa,YAAY,OAAO,IAAI,mCAAmC;AACvE,MAAa,aAAa,OAAO,IAAI,oCAAoC;AACzE,MAAa,kBAAkB,OAAO,IAAI,gCAAgC;AAC1E,MAAa,6BAA6B,OAAO,IAC/C,2CACF;AACA,MAAa,wBAAwB,OAAO,IAC1C,sCACF;AACA,MAAa,qCAAqC,OAAO,IACvD,mDACF;AACA,MAAa,qBAAqB,OAAO,IACvC,mCACF;AACA,MAAa,yBAAyB,OAAO,IAC3C,uCACF;AACA,MAAa,4BAA4B,OAAO,IAC9C,0CACF;AACA,MAAa,6BAA6B,OAAO,IAC/C,2CACF;AACA,MAAa,2BAA2B,OAAO,IAC7C,yCACF;AACA,MAAa,6BAA6B,OAAO,IAC/C,2CACF;AACA,MAAa,2BAA2B,OAAO,IAC7C,yCACF;AACA,MAAa,gBAAgB,OAAO,IAAI,8BAA8B;AACtE,MAAa,mBAAmB,OAAO,IAAI,iCAAiC;AAC5E,MAAa,gBAAgB,OAAO,IAAI,kCAAkC;;AAE1E,MAAa,qBAAoC,OAAO,IACtD,4CACF;AAEA,SAAgB,yBAAyB,UAA0B;CACjE,OAAO,OAAO,IAAI,6CAA6C,UAAU;AAC3E;AAEA,SAAgB,kBACd,OACA,UACA,OACQ;CACR,OAAO,OAAO,IACZ,+BAA+B,MAAM,GAAG,SAAS,GAAG,OACtD;AACF;AAEA,MAAa,iBAAiB,OAAO,IACnC,wCACF;AACA,MAAa,oBAAoB,OAAO,IACtC,oCACF;;AAEA,MAAa,6BAA6B,OAAO,IAC/C,oDACF"}

package/dist/{decorate-Cr4Q7bNE.cjs → decorate-fMNf0caZ.cjs}

@@ -1,4 +1,4 @@
-//#region src/auth-tokens.ts
+// src/auth-tokens.ts
 /** Stable Nest injection tokens shared by every package copy and module format. */
 function instanceToken(base, alias) {
 	return alias === void 0 || alias === "" || alias === "default" ? base : `${base}_${alias}`;
@@ -54,27 +54,23 @@ const READER_CONTEXT = Symbol.for("@nestjs-kit/better-auth:reader-context");
 const INVOCATION_VALUES = Symbol.for("@nestjs-kit/better-auth:invocation");
 /** Stored in place of an invocation value that two contributing policy runs published differently. */
 const AMBIGUOUS_INVOCATION_VALUE = Symbol.for("@nestjs-kit/better-auth:ambiguous-invocation-value");
-//#endregion
-//#region \0@oxc-project+runtime@0.153.0/helpers/esm/decorateMetadata.js
+// \0@oxc-project+runtime@0.156.0/helpers/esm/decorateMetadata.js
 function __decorateMetadata(k, v) {
 	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-//#endregion
-//#region \0@oxc-project+runtime@0.153.0/helpers/esm/decorateParam.js
+// \0@oxc-project+runtime@0.156.0/helpers/esm/decorateParam.js
 function __decorateParam(paramIndex, decorator) {
 	return function(target, key) {
 		decorator(target, key, paramIndex);
 	};
 }
-//#endregion
-//#region \0@oxc-project+runtime@0.153.0/helpers/esm/decorate.js
+// \0@oxc-project+runtime@0.156.0/helpers/esm/decorate.js
 function __decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
 	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
 	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
 	return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-//#endregion
 Object.defineProperty(exports, "ACCEPT_PRINCIPALS_METADATA", {
 	enumerable: true,
 	get: function() {
@@ -316,4 +312,4 @@ Object.defineProperty(exports, "getPrincipalSourcesToken", {
 	}
 });
 
-//# sourceMappingURL=decorate-Cr4Q7bNE.cjs.map
+//# sourceMappingURL=decorate-fMNf0caZ.cjs.map

package/dist/{decorate-Cr4Q7bNE.cjs.map → decorate-fMNf0caZ.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"decorate-Cr4Q7bNE.cjs","names":[],"sources":["../src/auth-tokens.ts"],"sourcesContent":["/** Stable Nest injection tokens shared by every package copy and module format. */\nfunction instanceToken(base: string, alias?: string): string {\n  return alias === undefined || alias === \"\" || alias === \"default\"\n    ? base\n    : `${base}_${alias}`;\n}\n\nexport function getBetterAuthInstanceToken(alias?: string): string {\n  return instanceToken(\"NESTJS_KIT_BETTER_AUTH_INSTANCE\", alias);\n}\n\nexport function getBetterAuthOptionsToken(alias?: string): string {\n  return instanceToken(\"NESTJS_KIT_BETTER_AUTH_OPTIONS\", alias);\n}\n\nexport function getBetterAuthServiceToken(alias?: string): string {\n  return instanceToken(\"NESTJS_KIT_BETTER_AUTH_SERVICE\", alias);\n}\n\nexport function getBetterAuthHandleToken(alias?: string): string {\n  return instanceToken(\"NESTJS_KIT_BETTER_AUTH_HANDLE\", alias);\n}\n\n// Shared application collaborators and metadata must also survive duplicate copies.\nexport const INSTANCE_REGISTRY = Symbol.for(\n  \"@nestjs-kit/better-auth:instance-registry\",\n);\nexport const REQUEST_SCOPE = Symbol.for(\n  \"@nestjs-kit/better-auth:request-scope\",\n);\nexport const PRINCIPAL_READINGS = Symbol.for(\n  \"@nestjs-kit/better-auth:principal-readings\",\n);\nexport const ROUTE_PLANNER = Symbol.for(\n  \"@nestjs-kit/better-auth:route-planner\",\n);\nexport const TRANSPORT_REGISTRY = Symbol.for(\n  \"@nestjs-kit/better-auth:transport-registry\",\n);\nexport const POLICY_RESOLVER = Symbol.for(\n  \"@nestjs-kit/better-auth:policy-resolver\",\n);\nexport const MOUNT_COORDINATOR = Symbol.for(\n  \"@nestjs-kit/better-auth:mount-coordinator\",\n);\nexport const GUARD_CORE = Symbol.for(\"@nestjs-kit/better-auth:guard-core\");\nexport const SCOPE_CORE = Symbol.for(\"@nestjs-kit/better-auth:scope-core\");\nexport const PRINCIPAL_RESOLVER = Symbol.for(\n  \"@nestjs-kit/better-auth:principal-resolver\",\n);\nexport const POLICY_INVOKER = Symbol.for(\n  \"@nestjs-kit/better-auth:policy-invoker\",\n);\nexport const PLATFORMS = Symbol.for(\"@nestjs-kit/better-auth:platforms\");\nexport const TRANSPORTS = Symbol.for(\"@nestjs-kit/better-auth:transports\");\nexport const ACCESS_METADATA = Symbol.for(\"@nestjs-kit/better-auth:access\");\nexport const ACCEPT_PRINCIPALS_METADATA = Symbol.for(\n  \"@nestjs-kit/better-auth:accept-principals\",\n);\nexport const REQUIREMENTS_METADATA = Symbol.for(\n  \"@nestjs-kit/better-auth:requirements\",\n);\nexport const SKIP_DEFAULT_REQUIREMENTS_METADATA = Symbol.for(\n  \"@nestjs-kit/better-auth:skip-default-requirements\",\n);\nexport const FRESHNESS_METADATA = Symbol.for(\n  \"@nestjs-kit/better-auth:freshness\",\n);\nexport const AUTH_INSTANCE_METADATA = Symbol.for(\n  \"@nestjs-kit/better-auth:auth-instance\",\n);\nexport const PRINCIPAL_PARAMS_METADATA = Symbol.for(\n  \"@nestjs-kit/better-auth:principal-params\",\n);\nexport const INVOCATION_PARAMS_METADATA = Symbol.for(\n  \"@nestjs-kit/better-auth:invocation-params\",\n);\nexport const FORWARD_COOKIES_METADATA = Symbol.for(\n  \"@nestjs-kit/better-auth:forward-cookies\",\n);\nexport const SKIP_ORIGIN_CHECK_METADATA = Symbol.for(\n  \"@nestjs-kit/better-auth:skip-origin-check\",\n);\nexport const USE_BETTER_AUTH_METADATA = Symbol.for(\n  \"@nestjs-kit/better-auth:use-better-auth\",\n);\nexport const HOOK_METADATA = Symbol.for(\"@nestjs-kit/better-auth:hook\");\nexport const DB_HOOK_METADATA = Symbol.for(\"@nestjs-kit/better-auth:db-hook\");\nexport const AUTH_ENHANCER = Symbol.for(\"@nestjs-kit/better-auth:enhancer\");\n/** Connection-time WebSocket authentication, provided by the socket.io and ws transport definitions. */\nexport const WS_CONNECTION_AUTH: unique symbol = Symbol.for(\n  \"@nestjs-kit/better-auth:ws-connection-auth\",\n);\n\nexport function getPrincipalSourcesToken(instance: string): symbol {\n  return Symbol.for(`@nestjs-kit/better-auth:principal-sources:${instance}`);\n}\n\nexport function getExtensionToken(\n  point: \"platforms\" | \"transports\" | \"principals\",\n  instance: string,\n  index: number,\n): symbol {\n  return Symbol.for(\n    `@nestjs-kit/better-auth:ext:${point}:${instance}:${index}`,\n  );\n}\n\nexport const READER_CONTEXT = Symbol.for(\n  \"@nestjs-kit/better-auth:reader-context\",\n);\nexport const INVOCATION_VALUES = Symbol.for(\n  \"@nestjs-kit/better-auth:invocation\",\n);\n/** Stored in place of an invocation value that two contributing policy runs published differently. */\nexport const AMBIGUOUS_INVOCATION_VALUE = Symbol.for(\n  \"@nestjs-kit/better-auth:ambiguous-invocation-value\",\n);\n"],"mappings":";;AACA,SAAS,cAAc,MAAc,OAAwB;CAC3D,OAAO,UAAU,KAAA,KAAa,UAAU,MAAM,UAAU,YACpD,OACA,GAAG,KAAK,GAAG;AACjB;AAEA,SAAgB,2BAA2B,OAAwB;CACjE,OAAO,cAAc,mCAAmC,KAAK;AAC/D;AAEA,SAAgB,0BAA0B,OAAwB;CAChE,OAAO,cAAc,kCAAkC,KAAK;AAC9D;AAEA,SAAgB,0BAA0B,OAAwB;CAChE,OAAO,cAAc,kCAAkC,KAAK;AAC9D;AAEA,SAAgB,yBAAyB,OAAwB;CAC/D,OAAO,cAAc,iCAAiC,KAAK;AAC7D;AAGA,MAAa,oBAAoB,OAAO,IACtC,2CACF;AACA,MAAa,gBAAgB,OAAO,IAClC,uCACF;AACA,MAAa,qBAAqB,OAAO,IACvC,4CACF;AACA,MAAa,gBAAgB,OAAO,IAClC,uCACF;AACA,MAAa,qBAAqB,OAAO,IACvC,4CACF;AACA,MAAa,kBAAkB,OAAO,IACpC,yCACF;AACA,MAAa,oBAAoB,OAAO,IACtC,2CACF;AACA,MAAa,aAAa,OAAO,IAAI,oCAAoC;AACzE,MAAa,aAAa,OAAO,IAAI,oCAAoC;AACzE,MAAa,qBAAqB,OAAO,IACvC,4CACF;AACA,MAAa,iBAAiB,OAAO,IACnC,wCACF;AACA,MAAa,YAAY,OAAO,IAAI,mCAAmC;AACvE,MAAa,aAAa,OAAO,IAAI,oCAAoC;AACzE,MAAa,kBAAkB,OAAO,IAAI,gCAAgC;AAC1E,MAAa,6BAA6B,OAAO,IAC/C,2CACF;AACA,MAAa,wBAAwB,OAAO,IAC1C,sCACF;AACA,MAAa,qCAAqC,OAAO,IACvD,mDACF;AACA,MAAa,qBAAqB,OAAO,IACvC,mCACF;AACA,MAAa,yBAAyB,OAAO,IAC3C,uCACF;AACA,MAAa,4BAA4B,OAAO,IAC9C,0CACF;AACA,MAAa,6BAA6B,OAAO,IAC/C,2CACF;AACA,MAAa,2BAA2B,OAAO,IAC7C,yCACF;AACA,MAAa,6BAA6B,OAAO,IAC/C,2CACF;AACA,MAAa,2BAA2B,OAAO,IAC7C,yCACF;AACA,MAAa,gBAAgB,OAAO,IAAI,8BAA8B;AACtE,MAAa,mBAAmB,OAAO,IAAI,iCAAiC;AAC5E,MAAa,gBAAgB,OAAO,IAAI,kCAAkC;;AAE1E,MAAa,qBAAoC,OAAO,IACtD,4CACF;AAEA,SAAgB,yBAAyB,UAA0B;CACjE,OAAO,OAAO,IAAI,6CAA6C,UAAU;AAC3E;AAEA,SAAgB,kBACd,OACA,UACA,OACQ;CACR,OAAO,OAAO,IACZ,+BAA+B,MAAM,GAAG,SAAS,GAAG,OACtD;AACF;AAEA,MAAa,iBAAiB,OAAO,IACnC,wCACF;AACA,MAAa,oBAAoB,OAAO,IACtC,oCACF;;AAEA,MAAa,6BAA6B,OAAO,IAC/C,oDACF"}
+{"version":3,"file":"decorate-fMNf0caZ.cjs","names":[],"sources":["../src/auth-tokens.ts"],"sourcesContent":["/** Stable Nest injection tokens shared by every package copy and module format. */\nfunction instanceToken(base: string, alias?: string): string {\n  return alias === undefined || alias === \"\" || alias === \"default\"\n    ? base\n    : `${base}_${alias}`;\n}\n\nexport function getBetterAuthInstanceToken(alias?: string): string {\n  return instanceToken(\"NESTJS_KIT_BETTER_AUTH_INSTANCE\", alias);\n}\n\nexport function getBetterAuthOptionsToken(alias?: string): string {\n  return instanceToken(\"NESTJS_KIT_BETTER_AUTH_OPTIONS\", alias);\n}\n\nexport function getBetterAuthServiceToken(alias?: string): string {\n  return instanceToken(\"NESTJS_KIT_BETTER_AUTH_SERVICE\", alias);\n}\n\nexport function getBetterAuthHandleToken(alias?: string): string {\n  return instanceToken(\"NESTJS_KIT_BETTER_AUTH_HANDLE\", alias);\n}\n\n// Shared application collaborators and metadata must also survive duplicate copies.\nexport const INSTANCE_REGISTRY = Symbol.for(\n  \"@nestjs-kit/better-auth:instance-registry\",\n);\nexport const REQUEST_SCOPE = Symbol.for(\n  \"@nestjs-kit/better-auth:request-scope\",\n);\nexport const PRINCIPAL_READINGS = Symbol.for(\n  \"@nestjs-kit/better-auth:principal-readings\",\n);\nexport const ROUTE_PLANNER = Symbol.for(\n  \"@nestjs-kit/better-auth:route-planner\",\n);\nexport const TRANSPORT_REGISTRY = Symbol.for(\n  \"@nestjs-kit/better-auth:transport-registry\",\n);\nexport const POLICY_RESOLVER = Symbol.for(\n  \"@nestjs-kit/better-auth:policy-resolver\",\n);\nexport const MOUNT_COORDINATOR = Symbol.for(\n  \"@nestjs-kit/better-auth:mount-coordinator\",\n);\nexport const GUARD_CORE = Symbol.for(\"@nestjs-kit/better-auth:guard-core\");\nexport const SCOPE_CORE = Symbol.for(\"@nestjs-kit/better-auth:scope-core\");\nexport const PRINCIPAL_RESOLVER = Symbol.for(\n  \"@nestjs-kit/better-auth:principal-resolver\",\n);\nexport const POLICY_INVOKER = Symbol.for(\n  \"@nestjs-kit/better-auth:policy-invoker\",\n);\nexport const PLATFORMS = Symbol.for(\"@nestjs-kit/better-auth:platforms\");\nexport const TRANSPORTS = Symbol.for(\"@nestjs-kit/better-auth:transports\");\nexport const ACCESS_METADATA = Symbol.for(\"@nestjs-kit/better-auth:access\");\nexport const ACCEPT_PRINCIPALS_METADATA = Symbol.for(\n  \"@nestjs-kit/better-auth:accept-principals\",\n);\nexport const REQUIREMENTS_METADATA = Symbol.for(\n  \"@nestjs-kit/better-auth:requirements\",\n);\nexport const SKIP_DEFAULT_REQUIREMENTS_METADATA = Symbol.for(\n  \"@nestjs-kit/better-auth:skip-default-requirements\",\n);\nexport const FRESHNESS_METADATA = Symbol.for(\n  \"@nestjs-kit/better-auth:freshness\",\n);\nexport const AUTH_INSTANCE_METADATA = Symbol.for(\n  \"@nestjs-kit/better-auth:auth-instance\",\n);\nexport const PRINCIPAL_PARAMS_METADATA = Symbol.for(\n  \"@nestjs-kit/better-auth:principal-params\",\n);\nexport const INVOCATION_PARAMS_METADATA = Symbol.for(\n  \"@nestjs-kit/better-auth:invocation-params\",\n);\nexport const FORWARD_COOKIES_METADATA = Symbol.for(\n  \"@nestjs-kit/better-auth:forward-cookies\",\n);\nexport const SKIP_ORIGIN_CHECK_METADATA = Symbol.for(\n  \"@nestjs-kit/better-auth:skip-origin-check\",\n);\nexport const USE_BETTER_AUTH_METADATA = Symbol.for(\n  \"@nestjs-kit/better-auth:use-better-auth\",\n);\nexport const HOOK_METADATA = Symbol.for(\"@nestjs-kit/better-auth:hook\");\nexport const DB_HOOK_METADATA = Symbol.for(\"@nestjs-kit/better-auth:db-hook\");\nexport const AUTH_ENHANCER = Symbol.for(\"@nestjs-kit/better-auth:enhancer\");\n/** Connection-time WebSocket authentication, provided by the socket.io and ws transport definitions. */\nexport const WS_CONNECTION_AUTH: unique symbol = Symbol.for(\n  \"@nestjs-kit/better-auth:ws-connection-auth\",\n);\n\nexport function getPrincipalSourcesToken(instance: string): symbol {\n  return Symbol.for(`@nestjs-kit/better-auth:principal-sources:${instance}`);\n}\n\nexport function getExtensionToken(\n  point: \"platforms\" | \"transports\" | \"principals\",\n  instance: string,\n  index: number,\n): symbol {\n  return Symbol.for(\n    `@nestjs-kit/better-auth:ext:${point}:${instance}:${index}`,\n  );\n}\n\nexport const READER_CONTEXT = Symbol.for(\n  \"@nestjs-kit/better-auth:reader-context\",\n);\nexport const INVOCATION_VALUES = Symbol.for(\n  \"@nestjs-kit/better-auth:invocation\",\n);\n/** Stored in place of an invocation value that two contributing policy runs published differently. */\nexport const AMBIGUOUS_INVOCATION_VALUE = Symbol.for(\n  \"@nestjs-kit/better-auth:ambiguous-invocation-value\",\n);\n"],"mappings":";;AACA,SAAS,cAAc,MAAc,OAAwB;CAC3D,OAAO,UAAU,KAAA,KAAa,UAAU,MAAM,UAAU,YACpD,OACA,GAAG,KAAK,GAAG;AACjB;AAEA,SAAgB,2BAA2B,OAAwB;CACjE,OAAO,cAAc,mCAAmC,KAAK;AAC/D;AAEA,SAAgB,0BAA0B,OAAwB;CAChE,OAAO,cAAc,kCAAkC,KAAK;AAC9D;AAEA,SAAgB,0BAA0B,OAAwB;CAChE,OAAO,cAAc,kCAAkC,KAAK;AAC9D;AAEA,SAAgB,yBAAyB,OAAwB;CAC/D,OAAO,cAAc,iCAAiC,KAAK;AAC7D;AAGA,MAAa,oBAAoB,OAAO,IACtC,2CACF;AACA,MAAa,gBAAgB,OAAO,IAClC,uCACF;AACA,MAAa,qBAAqB,OAAO,IACvC,4CACF;AACA,MAAa,gBAAgB,OAAO,IAClC,uCACF;AACA,MAAa,qBAAqB,OAAO,IACvC,4CACF;AACA,MAAa,kBAAkB,OAAO,IACpC,yCACF;AACA,MAAa,oBAAoB,OAAO,IACtC,2CACF;AACA,MAAa,aAAa,OAAO,IAAI,oCAAoC;AACzE,MAAa,aAAa,OAAO,IAAI,oCAAoC;AACzE,MAAa,qBAAqB,OAAO,IACvC,4CACF;AACA,MAAa,iBAAiB,OAAO,IACnC,wCACF;AACA,MAAa,YAAY,OAAO,IAAI,mCAAmC;AACvE,MAAa,aAAa,OAAO,IAAI,oCAAoC;AACzE,MAAa,kBAAkB,OAAO,IAAI,gCAAgC;AAC1E,MAAa,6BAA6B,OAAO,IAC/C,2CACF;AACA,MAAa,wBAAwB,OAAO,IAC1C,sCACF;AACA,MAAa,qCAAqC,OAAO,IACvD,mDACF;AACA,MAAa,qBAAqB,OAAO,IACvC,mCACF;AACA,MAAa,yBAAyB,OAAO,IAC3C,uCACF;AACA,MAAa,4BAA4B,OAAO,IAC9C,0CACF;AACA,MAAa,6BAA6B,OAAO,IAC/C,2CACF;AACA,MAAa,2BAA2B,OAAO,IAC7C,yCACF;AACA,MAAa,6BAA6B,OAAO,IAC/C,2CACF;AACA,MAAa,2BAA2B,OAAO,IAC7C,yCACF;AACA,MAAa,gBAAgB,OAAO,IAAI,8BAA8B;AACtE,MAAa,mBAAmB,OAAO,IAAI,iCAAiC;AAC5E,MAAa,gBAAgB,OAAO,IAAI,kCAAkC;;AAE1E,MAAa,qBAAoC,OAAO,IACtD,4CACF;AAEA,SAAgB,yBAAyB,UAA0B;CACjE,OAAO,OAAO,IAAI,6CAA6C,UAAU;AAC3E;AAEA,SAAgB,kBACd,OACA,UACA,OACQ;CACR,OAAO,OAAO,IACZ,+BAA+B,MAAM,GAAG,SAAS,GAAG,OACtD;AACF;AAEA,MAAa,iBAAiB,OAAO,IACnC,wCACF;AACA,MAAa,oBAAoB,OAAO,IACtC,oCACF;;AAEA,MAAa,6BAA6B,OAAO,IAC/C,oDACF"}

package/dist/express.cjs

@@ -1,10 +1,10 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_auth_errors = require("./auth-errors-DmiKl0L_.cjs");
-const require_platform = require("./platform-YICqqYv6.cjs");
+const require_auth_errors = require("./auth-errors-RW7hOVI-.cjs");
+const require_platform = require("./platform-C67dxSls.cjs");
 let node_http = require("node:http");
 let node_stream = require("node:stream");
 let path_to_regexp = require("path-to-regexp");
-//#region src/express-platform.ts
+// src/express-platform.ts
 const RAW_BODY = Symbol.for("@nestjs-kit/better-auth:raw-body");
 function application(adapter) {
 	return adapter.getInstance();
@@ -249,7 +249,6 @@ var ExpressPlatform = class {
 function expressPlatform(options) {
 	return new ExpressPlatform(options);
 }
-//#endregion
 exports.ExpressPlatform = ExpressPlatform;
 exports.expressPlatform = expressPlatform;
 

package/dist/express.d.cts

@@ -1,6 +1,5 @@
-import { J as PlatformMountContext, P as ExpressPlatformOptions, U as HttpPlatform, Y as PlatformPrepareContext, at as ProxyTrust, n as ApplicationRouteDescriptor, s as AuthRouteBinding } from "./auth-contracts-Brh_Qko9.cjs";
+import { J as PlatformMountContext, P as ExpressPlatformOptions, U as HttpPlatform, Y as PlatformPrepareContext, at as ProxyTrust, n as ApplicationRouteDescriptor, s as AuthRouteBinding } from "./auth-contracts-zvt8ysoZ.cjs";
 import { AbstractHttpAdapter } from "@nestjs/core";
-//#region src/express-platform.d.ts
 /** Express-specific two-phase HTTP integration. */
 export declare class ExpressPlatform implements HttpPlatform {
   #private;
@@ -32,6 +31,5 @@ export declare class ExpressPlatform implements HttpPlatform {
   private dispatch;
 }
 export declare function expressPlatform(options?: ExpressPlatformOptions): ExpressPlatform;
-//#endregion
 export type { ExpressPlatformOptions };
 //# sourceMappingURL=express.d.cts.map

package/dist/express.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"express.d.cts","names":[],"sources":["../src/express-platform.ts"],"mappings":";;;;qBAuNa,2BAA2B;;mBAMT;WALpB;EAKT,YAA6B,UAAS;WAE7B;IACP,YAAS;IACT,SAAM;IAEN,MAAG;IACH,UAAO,mBAAoB;IAE3B,UAAO;MAEI;MAA6B;;IAExC,WAAQ;IAER,QAAK,gBAAiB;IAItB,aAAU,kBAAmB;MAMH,SAAA;;;EAM5B,SAAS,SAAS;EAIlB,QAAQ,KAAK;EAkDb,kBACE,iBAAiB,8BACjB,mBAAmB;EAwCrB,MAAM,KAAK;EAmBX,WAAW,SAAS,sBAAsB;UAIlC;UAOA;UAQM;;wBAmCA,gBACd,UAAU,yBACT"}
+{"version":3,"file":"express.d.cts","names":[],"sources":["../src/express-platform.ts"],"mappings":";;;qBAuNa,2BAA2B;;mBAMT;WALpB;EAKoB,YAAA,UAAS;WAE7B;IACY,YAAA;IACH,SAAA;IAEH,MAAA;IACI,UAAA,mBAAU;IAEV,UAAA;;;;IAIC,WAAA;IAEH,QAAA,gBAAO;IAIA,aAAA,kBAAO;MAMH,SAAA;;;EAM5B,SAAS,SAAS;EAIlB,QAAQ,KAAK;EAkDb,kBACE,iBAAiB,8BACjB,mBAAmB;EAwCrB,MAAM,KAAK;EAmBX,WAAW,SAAS,sBAAsB;UAIlC;UAOA;UAQM;;wBAmCA,gBACd,UAAU,yBACT"}

package/dist/express.d.mts

@@ -1,6 +1,5 @@
-import { J as PlatformMountContext, P as ExpressPlatformOptions, U as HttpPlatform, Y as PlatformPrepareContext, at as ProxyTrust, n as ApplicationRouteDescriptor, s as AuthRouteBinding } from "./auth-contracts-Cz7C4_Ch.mjs";
+import { J as PlatformMountContext, P as ExpressPlatformOptions, U as HttpPlatform, Y as PlatformPrepareContext, at as ProxyTrust, n as ApplicationRouteDescriptor, s as AuthRouteBinding } from "./auth-contracts-CADGyI0O.mjs";
 import { AbstractHttpAdapter } from "@nestjs/core";
-//#region src/express-platform.d.ts
 /** Express-specific two-phase HTTP integration. */
 export declare class ExpressPlatform implements HttpPlatform {
   #private;
@@ -32,6 +31,5 @@ export declare class ExpressPlatform implements HttpPlatform {
   private dispatch;
 }
 export declare function expressPlatform(options?: ExpressPlatformOptions): ExpressPlatform;
-//#endregion
 export type { ExpressPlatformOptions };
 //# sourceMappingURL=express.d.mts.map

package/dist/express.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"express.d.mts","names":[],"sources":["../src/express-platform.ts"],"mappings":";;;;qBAuNa,2BAA2B;;mBAMT;WALpB;EAKT,YAA6B,UAAS;WAE7B;IACP,YAAS;IACT,SAAM;IAEN,MAAG;IACH,UAAO,mBAAoB;IAE3B,UAAO;MAEI;MAA6B;;IAExC,WAAQ;IAER,QAAK,gBAAiB;IAItB,aAAU,kBAAmB;MAMH,SAAA;;;EAM5B,SAAS,SAAS;EAIlB,QAAQ,KAAK;EAkDb,kBACE,iBAAiB,8BACjB,mBAAmB;EAwCrB,MAAM,KAAK;EAmBX,WAAW,SAAS,sBAAsB;UAIlC;UAOA;UAQM;;wBAmCA,gBACd,UAAU,yBACT"}
+{"version":3,"file":"express.d.mts","names":[],"sources":["../src/express-platform.ts"],"mappings":";;;qBAuNa,2BAA2B;;mBAMT;WALpB;EAKoB,YAAA,UAAS;WAE7B;IACY,YAAA;IACH,SAAA;IAEH,MAAA;IACI,UAAA,mBAAU;IAEV,UAAA;;;;IAIC,WAAA;IAEH,QAAA,gBAAO;IAIA,aAAA,kBAAO;MAMH,SAAA;;;EAM5B,SAAS,SAAS;EAIlB,QAAQ,KAAK;EAkDb,kBACE,iBAAiB,8BACjB,mBAAmB;EAwCrB,MAAM,KAAK;EAmBX,WAAW,SAAS,sBAAsB;UAIlC;UAOA;UAQM;;wBAmCA,gBACd,UAAU,yBACT"}

package/dist/express.mjs

@@ -1,9 +1,9 @@
-import { n as BetterAuthConfigurationError } from "./auth-errors-C3rbTV9p.mjs";
-import { a as recoverConsumedBody, c as writeWebResponse, i as readBoundedBody, n as bindAsyncContext, o as toWebHeaders, r as mayHaveBody, t as appendSetCookie } from "./platform-CZl7TY8j.mjs";
+import { n as BetterAuthConfigurationError } from "./auth-errors-JjxGDVSt.mjs";
+import { a as recoverConsumedBody, c as writeWebResponse, i as readBoundedBody, n as bindAsyncContext, o as toWebHeaders, r as mayHaveBody, t as appendSetCookie } from "./platform-BKYVzAv1.mjs";
 import { IncomingMessage, ServerResponse } from "node:http";
 import { Readable } from "node:stream";
 import { parse, pathToRegexp } from "path-to-regexp";
-//#region src/express-platform.ts
+// src/express-platform.ts
 const RAW_BODY = Symbol.for("@nestjs-kit/better-auth:raw-body");
 function application(adapter) {
 	return adapter.getInstance();
@@ -248,7 +248,6 @@ var ExpressPlatform = class {
 function expressPlatform(options) {
 	return new ExpressPlatform(options);
 }
-//#endregion
 export { ExpressPlatform, expressPlatform };
 
 //# sourceMappingURL=express.mjs.map

package/dist/fastify.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_platform = require("./platform-YICqqYv6.cjs");
-//#region src/fastify-platform.ts
+const require_platform = require("./platform-C67dxSls.cjs");
+// src/fastify-platform.ts
 function instanceOf(adapter) {
 	return adapter.getInstance();
 }
@@ -211,7 +211,6 @@ var FastifyPlatform = class {
 function fastifyPlatform(options) {
 	return new FastifyPlatform(options);
 }
-//#endregion
 exports.FastifyPlatform = FastifyPlatform;
 exports.fastifyPlatform = fastifyPlatform;
 

package/dist/fastify.d.cts

@@ -1,6 +1,5 @@
-import { I as ExtensionRef, J as PlatformMountContext, L as FastifyPlatformOptions, U as HttpPlatform, W as HttpRequestAccessor, Y as PlatformPrepareContext } from "./auth-contracts-Brh_Qko9.cjs";
+import { I as ExtensionRef, J as PlatformMountContext, L as FastifyPlatformOptions, U as HttpPlatform, W as HttpRequestAccessor, Y as PlatformPrepareContext } from "./auth-contracts-zvt8ysoZ.cjs";
 import { AbstractHttpAdapter } from "@nestjs/core";
-//#region src/fastify-platform.d.ts
 /**
  * Fastify's encapsulated auth-route platform adapter.
  *
@@ -23,6 +22,5 @@ export declare class FastifyPlatform implements HttpPlatform {
   mount(context: PlatformMountContext): Promise<void>;
 }
 export declare function fastifyPlatform(options?: FastifyPlatformOptions): ExtensionRef<HttpPlatform>;
-//#endregion
 export type { FastifyPlatformOptions };
 //# sourceMappingURL=fastify.d.cts.map