@nxgt/shared-graphql 2.0.1 → 3.0.0

package/dist/index.js

@@ -3,44 +3,41 @@ import DataLoader3 from "dataloader";
 
 export * from "graphql-subscriptions";
 
-// src/directives/check.ts
+// src/directives/authenticated.ts
 import { getDirective } from "@graphql-tools/utils";
-import {
-  assertRequirement
-} from "@nxgt/ory-sdk";
-var CHECK_DIRECTIVE_NAME = "check";
-function readChecks(schema, node, where) {
-  const found = getDirective(schema, node, CHECK_DIRECTIVE_NAME) ?? [];
-  return found.map((raw) => {
-    const permissions = raw.permissions ?? [];
-    assertRequirement(permissions, `@check on ${where}`);
-    for (const group of permissions) {
-      for (const term of group)
-        assertReadablePath(term, where);
+var AUTHENTICATED_DIRECTIVE_NAME = "authenticated";
+var CALLER_TYPES = ["session", "token"];
+function readAuthenticated(schema, node, where, known) {
+  const [found] = getDirective(schema, node, AUTHENTICATED_DIRECTIVE_NAME) ?? [];
+  if (!found)
+    return null;
+  const types = found.type;
+  if (types === undefined || types === null)
+    return {};
+  if (!Array.isArray(types) || types.length === 0) {
+    throw new TypeError(`@authenticated on ${where}: \`type: []\` admits no caller — name a type, or drop \`type\``);
+  }
+  for (const type of types) {
+    if (!known.includes(type)) {
+      throw new TypeError(`@authenticated on ${where}: unknown type ${JSON.stringify(type)} — known: ${known.join(", ")}`);
     }
-    return {
-      permissions,
-      onDeny: raw.onDeny ?? "NOT_FOUND",
-      message: raw.message
-    };
-  });
-}
-function assertReadablePath(term, where) {
-  if (!/^(args|source)(\.[A-Za-z0-9_]+)+$/.test(term.id)) {
-    throw new Error(`@check on ${where}: \`id\` must be "args.<path>" or "source.<path>", got ${JSON.stringify(term.id)}`);
   }
+  return { types };
 }
-function readPath(path, source, args) {
-  const [root, ...rest] = path.split(".");
-  let value = root === "args" ? args : source;
-  for (const key of rest) {
-    value = value?.[key];
+function combineRequirements(found, where) {
+  const applying = found.filter((one) => !!one);
+  if (applying.length === 0)
+    return null;
+  let types;
+  for (const { types: these } of applying) {
+    if (!these)
+      continue;
+    types = types ? types.filter((type) => these.includes(type)) : these;
   }
-  return value;
-}
-function objectIds(value) {
-  const values = Array.isArray(value) ? value : [value];
-  return values.filter((item) => typeof item === "string" && item.length > 0);
+  if (types?.length === 0) {
+    throw new TypeError(`@authenticated on ${where}: the field's, its type's and its interfaces' \`type\`s have none in common — no caller could pass`);
+  }
+  return types ? { types } : {};
 }
 // src/directives/federation.ts
 var FEDERATION_DIRECTIVES = `
@@ -56,559 +53,620 @@ directive @composeDirective(name: String!) repeatable on SCHEMA
 directive @interfaceObject on OBJECT
 directive @authenticated on FIELD_DEFINITION | OBJECT | INTERFACE | SCALAR | ENUM
 `;
+// src/directives/paths.ts
+var PATH = /^(args|parent|source)(\.[A-Za-z0-9_]+)+$/;
+var DEFAULT_ID_PATH = "args.id";
+function assertReadablePath(term, where) {
+  if (!PATH.test(term.id)) {
+    throw new TypeError(`${where}: \`id\` must be "args.<path>", "parent.<path>" or "source.<path>", got ${JSON.stringify(term.id)}`);
+  }
+}
+function assertDeclaredArgument(term, argumentNames, where) {
+  const [root, name] = term.id.split(".");
+  if (root !== "args" || !name || argumentNames.includes(name))
+    return;
+  const declared = argumentNames.length ? argumentNames.join(", ") : "no arguments";
+  throw new TypeError(`${where}: \`id\` reads "${term.id}", but the field declares ${declared}`);
+}
+function readPath(path, source, args) {
+  const [root, ...rest] = path.split(".");
+  let value = root === "args" ? args : source;
+  for (const key of rest) {
+    value = value?.[key];
+  }
+  return value;
+}
+function objectIds(value) {
+  const values = Array.isArray(value) ? value : [value];
+  return values.filter((item) => typeof item === "string" && item.length > 0);
+}
+// src/directives/permission.ts
+import { getDirective as getDirective2 } from "@graphql-tools/utils";
+
+// src/directives/scope.ts
+function scopeOf(node, where, options) {
+  return {
+    where,
+    argumentNames: argumentNamesOf(node),
+    namespaces: options.namespaces
+  };
+}
+function argumentNamesOf(node) {
+  const field = node;
+  if (Array.isArray(field.args))
+    return field.args.map((arg) => arg.name);
+  if (field.args)
+    return Object.keys(field.args);
+  return field.arguments?.map((arg) => arg.name.value) ?? [];
+}
+
+// src/directives/validate.ts
+import { assertRequirement } from "@nxgt/ory-sdk";
+function assertRequirementShape(permissions, scope) {
+  const { where, argumentNames, namespaces } = scope;
+  try {
+    assertRequirement(permissions, where);
+  } catch (error) {
+    throw new TypeError(error.message);
+  }
+  for (const group of permissions) {
+    for (const term of group) {
+      assertReadablePath(term, where);
+      assertDeclaredArgument(term, argumentNames, where);
+      if (namespaces && !namespaces.includes(term.namespace)) {
+        throw new TypeError(`${where}: unknown namespace ${JSON.stringify(term.namespace)} — known: ${namespaces.join(", ")}`);
+      }
+    }
+  }
+}
+
+// src/directives/permission.ts
+var PERMISSION_DIRECTIVE_NAME = "permission";
+function readPermissions(schema, node, where, options = {}) {
+  if (!isOurs(schema))
+    return [];
+  const found = getDirective2(schema, node, PERMISSION_DIRECTIVE_NAME) ?? [];
+  const scope = scopeOf(node, `@permission on ${where}`, options);
+  return found.map((raw) => {
+    const args = permissionArgs(raw);
+    const permissions = [
+      [{ namespace: args.type, permit: args.name, id: args.id }]
+    ];
+    assertRequirementShape(permissions, scope);
+    return { permissions, onDeny: args.onDeny, message: args.message };
+  });
+}
+function permissionArgs(raw) {
+  return {
+    name: raw.name,
+    type: raw.type,
+    id: raw.id ?? DEFAULT_ID_PATH,
+    onDeny: raw.onDeny ?? "NOT_FOUND",
+    message: raw.message ?? undefined
+  };
+}
+function isOurs(schema) {
+  const declared = schema.getDirective(PERMISSION_DIRECTIVE_NAME);
+  const names = declared?.args.map((arg) => arg.name) ?? [];
+  return names.includes("name") && names.includes("type");
+}
+// src/directives/sdl.ts
+var PERMISSION_DIRECTIVE_SDL = `"""
+What a refused @permission looks like from outside.
+"""
+enum PermissionDenial {
+	"""
+	The same answer as for an id that never existed, so ids cannot be probed.
+	The default.
+	"""
+	NOT_FOUND
+
+	"""
+	For a permission asked of an object the caller can already see: a viewer
+	asked to edit already knows it exists, and "you may not change it" is
+	honest.
+	"""
+	FORBIDDEN
+}
+
+"""
+The permission a field requires: the caller must hold the permit \`name\` on the
+\`type\` object whose id \`id\` points at.
+
+Repeatable, and repeated ones are AND, evaluated in declaration order — the
+404-then-403 ladder:
+
+    updateNote(id: ID!, input: UpdateNoteInput!): Note!
+      @permission(name: "view", type: "Note")
+      @permission(name: "edit", type: "Note", onDeny: FORBIDDEN)
+
+NOT for a field that answers a LIST the caller is entitled to: fold a Keto
+query into the database filter before the read instead.
+"""
+directive @permission(
+	"""
+	The permit asked of Keto, e.g. "view". A plain relation works too; Keto
+	answers \`false\`, not an error, for a name it does not know.
+	"""
+	name: String!
+
+	"""
+	The Keto namespace, e.g. "Note" — from the stack's OPL document.
+	"""
+	type: String!
+
+	"""
+	Where the object id is read: \`args.<path>\` or \`parent.<path>\`, dotted
+	paths allowed, \`args.id\` when omitted. A value that turns out to be a LIST
+	requires the permit on every element.
+	"""
+	id: String
+
+	onDeny: PermissionDenial! = NOT_FOUND
+
+	"""
+	The i18n key the denial carries, e.g. "notes.errors.not-found". Defaults to
+	\`errors.not-found\` / \`errors.insufficient-permissions\`, the shared keys.
+	Set it when the service layer words the same refusal with a domain message,
+	so the wording does not tell a caller which layer refused.
+	"""
+	message: String
+) repeatable on FIELD_DEFINITION
+`;
+var KETO_DIRECTIVES_SDL = PERMISSION_DIRECTIVE_SDL;
+var AUTHENTICATED_DIRECTIVE_SDL = `"""
+A signed-in caller — of one of the types \`type\` names, when it names some.
+"""
+directive @authenticated(
+	"""
+	The kinds of caller admitted: "session" or "token" by default. Any caller
+	when omitted.
+	"""
+	type: [String!]
+) on FIELD_DEFINITION | OBJECT | INTERFACE | SCALAR | ENUM
+`;
 // src/integrations/hono.ts
 import { Hono } from "hono";
 import { contextStorage } from "hono/context-storage";
 import { createMiddleware } from "hono/factory";
 import { languageDetector } from "hono/language";
 
-// src/utils/change-resolvers.utils.ts
+// src/utils/sandbox.ts
+import { html } from "hono/html";
+var renderSandbox = ({
+  port = 8080,
+  hostname = "localhost",
+  graphqlEndpoint = "graphql",
+  protocol = "http",
+  title = "Sandbox Explorer"
+}) => html`
+<title>${title}</title>
+<div id="sandbox" style="position:absolute;top:0;right:0;bottom:0;left:0"></div>
+<script src="https://embeddable-sandbox.cdn.apollographql.com/_latest/embeddable-sandbox.umd.production.min.js"></script>
+<script>
+    new window.EmbeddedSandbox({
+        target: "#sandbox",
+        // Pass through your server href if you are embedding on an endpoint.
+        // Otherwise, you can pass whatever endpoint you want Sandbox to start up with here.
+        initialEndpoint: "${protocol}://${hostname}:${port}/${graphqlEndpoint}",
+        handleRequest: (endpointUrl, options) => {
+            return fetch(endpointUrl, {
+                ...options,
+                headers: {
+                    ...options.headers
+                },
+            })
+        },
+        hideCookieToggle: true,
+    });
+    // advanced options: https://www.apollographql.com/docs/studio/explorer/sandbox#embedding-sandbox
+</script>
+
+`;
+
+// src/integrations/hono.ts
+function sandboxExplorer(options) {
+  return createMiddleware(async (ctx) => {
+    return ctx.html(renderSandbox(options));
+  });
+}
+function honoYoga(yoga) {
+  return createMiddleware(async (ctx) => {
+    const response = await yoga.fetch(ctx.req.raw);
+    return response;
+  });
+}
+function createYogaHono(yoga, options) {
+  const app = new Hono;
+  app.use(contextStorage());
+  app.use(languageDetector({
+    order: ["header"],
+    supportedLanguages: ["en", "fr"],
+    fallbackLanguage: "en",
+    caches: []
+  }));
+  app.get("/health", (ctx) => {
+    return ctx.json({ status: "ok" }, 200);
+  });
+  app.get(options?.sandbox?.endpoint || "sandbox", sandboxExplorer(options?.sandbox || {}));
+  app.use(yoga.graphqlEndpoint, honoYoga(yoga));
+  return app;
+}
+// src/plugins/apply-authenticated.ts
+import { MapperKind, mapSchema } from "@graphql-tools/utils";
+import { ErrorCode as ErrorCode2 } from "@nxgt/shared-exceptions";
 import {
-  AUDIT_EVENT,
-  CommitType
-} from "@nxgt/shared-mongo";
-import { withFilter } from "graphql-subscriptions";
-function createChangeResolvers(config) {
-  const { entity, collection, service, pubsub } = config;
-  const resolvePubSub = () => typeof pubsub === "function" ? pubsub() : pubsub;
+  getNamedType,
+  isEnumType,
+  isObjectType,
+  isScalarType
+} from "graphql";
+
+// src/utils/errors/denial.ts
+import { translate } from "@nxgt/i18n";
+import { ErrorCode } from "@nxgt/shared-exceptions";
+import { GraphQLError } from "graphql";
+var STATUS = {
+  [ErrorCode.Unauthenticated]: 401,
+  [ErrorCode.Forbidden]: 403,
+  [ErrorCode.NotFound]: 404
+};
+var DEFAULT_MESSAGE = {
+  [ErrorCode.Unauthenticated]: "errors.unauthenticated",
+  [ErrorCode.Forbidden]: "errors.insufficient-permissions",
+  [ErrorCode.NotFound]: "errors.not-found"
+};
+var MESSAGE_KEY = Symbol.for("@nxgt/shared-graphql/denial-message");
+function denial(code, message) {
+  const key = message ?? DEFAULT_MESSAGE[code];
+  const error = new GraphQLError(translate(key), {
+    extensions: { code, http: { status: STATUS[code] } }
+  });
+  Object.defineProperty(error, MESSAGE_KEY, { value: key });
+  return error;
+}
+function denialMessageKey(error) {
+  if (!error || typeof error !== "object")
+    return;
+  const key = error[MESSAGE_KEY];
+  return typeof key === "string" ? key : undefined;
+}
+
+// src/plugins/field-guard.ts
+import {
+  defaultFieldResolver
+} from "graphql";
+var GUARDS = "@nxgt/shared-graphql:guards";
+function intactGuards(config) {
+  const record = config.extensions?.[GUARDS];
+  if (!record || record.wrapped.resolve !== config.resolve)
+    return;
+  if (record.wrapped.subscribe !== config.subscribe)
+    return;
+  return record;
+}
+function isGuarded(config, mark) {
+  return !!intactGuards(config)?.guards.some((guard) => guard.mark === mark);
+}
+function guardField(config, guard) {
+  const previous = intactGuards(config);
+  const base = previous ? { resolve: previous.resolve, subscribe: previous.subscribe } : {
+    resolve: config.resolve ?? defaultFieldResolver,
+    subscribe: config.subscribe
+  };
+  const guards = [...previous?.guards ?? [], guard].sort((a, b) => a.rank - b.rank);
+  const wrapped = {
+    resolve: checked(guards, base.resolve),
+    subscribe: base.subscribe && checked(guards.filter((one) => one.onSubscribe), base.subscribe)
+  };
   return {
-    Query: {
-      [`${entity}Changes`]: async (_parent, args, context) => context.services.audit.findChangesPaginatedByCollection(collection, args),
-      [`${entity}ChangesById`]: async (_parent, args, context) => context.services.audit.findChangesPaginatedByCollectionAndOid(args.id, collection, args)
+    ...config,
+    extensions: {
+      ...config.extensions,
+      [GUARDS]: { guards, ...base, wrapped }
     },
-    Subscription: {
-      [`${entity}Changed`]: {
-        resolve: async (payload, _args, context) => ({
-          id: context.services.audit.extractId(payload),
-          data: payload.type !== CommitType.TERMINAL ? await context.services[service].findById(payload.state._id) : null,
-          type: payload.type
-        }),
-        subscribe: withFilter(() => resolvePubSub().subscribe(AUDIT_EVENT), (payload, _variables, context) => context ? context.services.audit.matches(payload, { collection }) : false)
-      }
-    }
+    resolve: wrapped.resolve,
+    subscribe: wrapped.subscribe
   };
 }
-// src/utils/codegen.utils.ts
-var SCALARS_MAPPING = {
-  ID: "any",
-  DateTime: "any",
-  Date: "any",
-  Any: "any",
-  BigInt: "number",
-  EmailAddress: "string",
-  GeoJSON: "any",
-  HSL: "string",
-  HSLA: "string",
-  HexColorCode: "string",
-  Hexadecimal: "string",
-  IBAN: "string",
-  IP: "string",
-  Time: "string",
-  LocalTime: "string",
-  UUID: "string",
-  PositiveInt: "number",
-  NegativeInt: "number",
-  NonPositiveInt: "number",
-  NonNegativeInt: "number",
-  PositiveFloat: "number",
-  NegativeFloat: "number",
-  NonPositiveFloat: "number",
-  NonNegativeFloat: "number",
-  NonEmptyString: "string",
-  PostalCode: "string",
-  RGB: "string",
-  RGBA: "string",
-  SESSN: "string",
-  Timestamp: "string",
-  URL: "string",
-  USCurrency: "string",
-  UTCOffset: "string",
-  Long: "number",
-  Short: "number",
-  Byte: "number",
-  BigDecimal: "string",
-  BigInteger: "string",
-  Char: "string",
-  Locale: "string",
-  CountryCode: "string",
-  CountryName: "string",
-  AccountNumber: "string",
-  CurrencyCode: "string",
-  Duration: "string",
-  Url: "string",
-  JSONObject: "Record<string, any>",
-  JSON: "any",
-  Void: "void",
-  ObjectID: "any",
-  Upload: "File | Blob",
-  Email: "string",
-  Port: "number",
-  IPv4: "string",
-  IPv6: "string",
-  MAC: "string",
-  Password: "string",
-  PhoneNumber: "string",
-  ZIPCode: "string",
-  SSN: "string",
-  GUID: "string",
-  ISBN: "string",
-  Latitude: "number",
-  Longitude: "number",
-  JWT: "string"
-};
-// src/utils/data-loader.utils.ts
-import { cast } from "@nxgt/shared/helpers";
-import {
-  paginateList
-} from "@nxgt/shared-mongo";
-import DataLoader from "dataloader";
-import { isArray } from "lodash";
-function createDataLoader(batchLoadFn, options) {
-  return new DataLoader(batchLoadFn, options);
+function checked(guards, next) {
+  return async (source, args, context, info) => {
+    for (const { check } of guards)
+      await check(source, args, context);
+    return next(source, args, context, info);
+  };
 }
-function createConnectionListDataLoader(path, model, options) {
-  return createDataLoader(async (docs) => {
-    const data = await model.find({
-      ...options.filter ?? {},
-      _id: docs.flatMap((doc) => {
-        const ids = doc[path] ?? [];
-        return isArray(ids) ? cast(ids.filter((item) => !!item && !["undefined", "null"].includes(item?.toString()))) : [];
-      })
-    }).exec();
-    return cast(docs.map((doc) => model.paginateList(data.filter((child) => cast(doc[path] ?? []).map((item) => item.toString()).includes(child._id.toString())), options)));
+
+// src/plugins/apply-authenticated.ts
+var MARK = "@nxgt/shared-graphql:authenticated";
+function applyAuthenticated(schema, options = {}) {
+  const known = options.types ?? CALLER_TYPES;
+  let guardedNow = 0;
+  const mapped = mapSchema(schema, {
+    [MapperKind.OBJECT_FIELD]: (fieldConfig, fieldName, typeName) => {
+      const where = `${typeName}.${fieldName}`;
+      const requirement = requirementOf(schema, fieldConfig, where, known);
+      if (!requirement || isGuarded(fieldConfig, MARK))
+        return fieldConfig;
+      guardedNow += 1;
+      return guarded(fieldConfig, requirement);
+    }
   });
+  return guardedNow > 0 ? mapped : schema;
 }
-function createChildrenConnectionDataLoader(path, model, options) {
-  return createDataLoader(async (docs) => {
-    const filter = {};
-    filter[path] = docs.map((doc) => doc._id);
-    const data = await model.find(filter).exec();
-    return cast(docs.map((doc) => paginateList(data.filter((child) => doc._id?.toString() === child[path]?.toString()), options)));
-  });
+function requirementOf(schema, fieldConfig, where, known) {
+  const [typeName = "", fieldName = ""] = where.split(".");
+  const type = schema.getType(typeName);
+  const interfaces = isObjectType(type) ? type.getInterfaces() : [];
+  const read = (node, at) => readAuthenticated(schema, node, at, known);
+  return combineRequirements([
+    read(fieldConfig, where),
+    type ? read(type, typeName) : null,
+    ...interfaces.flatMap((iface) => {
+      const field = iface.getFields()[fieldName];
+      return [
+        read(iface, iface.name),
+        field ? read(field, `${iface.name}.${fieldName}`) : null
+      ];
+    }),
+    leafRequirement(schema, fieldConfig, read)
+  ], where);
 }
-function createSimpleListDataLoader(path, model, options) {
-  return createDataLoader(async (docs) => {
-    const filter = options?.filter ?? {};
-    const ids = docs.flatMap((doc) => {
-      const ids = doc[path] ?? [];
-      return isArray(ids) ? cast(ids) : [];
-    });
-    filter._id = ids;
-    const query = model.find(filter);
-    const data = await query.exec();
-    return cast(docs.map((doc) => {
-      const result = data.filter((child) => cast(doc[path] ?? []).map((item) => item.toString()).includes(child._id.toString()));
-      if (options?.skip && options?.limit) {
-        return result.slice(options.skip, options.skip + options.limit);
-      }
-      if (options?.limit) {
-        return result.slice(0, options.limit);
-      }
-      if (options?.skip) {
-        return result.slice(options.skip);
+function leafRequirement(schema, fieldConfig, read) {
+  const leaf = schema.getType(getNamedType(fieldConfig.type).name);
+  if (!leaf || !(isScalarType(leaf) || isEnumType(leaf)))
+    return null;
+  return read(leaf, leaf.name);
+}
+function guarded(fieldConfig, { types }) {
+  return guardField(fieldConfig, {
+    mark: MARK,
+    rank: 0,
+    onSubscribe: true,
+    check: (_source, _args, context) => {
+      const ctx = context ?? {};
+      if (!ctx.user)
+        throw denial(ErrorCode2.Unauthenticated);
+      if (types && !types.includes(callerTypeOf(ctx) ?? "")) {
+        throw denial(ErrorCode2.Forbidden);
       }
-      return result;
-    }));
+    }
   });
 }
-function createChildrenListDataLoader(path, model, options) {
-  return createDataLoader(async (docs) => {
-    const filter = options?.filter ?? {};
-    const key = path;
-    filter[key] = docs.map((doc) => doc._id);
-    const query = model.find(filter);
-    const data = await query.exec();
-    return cast(docs.map((doc) => {
-      const result = data.filter((child) => child[path]?.toString() === doc._id.toString());
-      if (options?.skip && options?.limit) {
-        return result.slice(options.skip, options.skip + options.limit);
+function callerTypeOf(ctx) {
+  return ctx.ory?.kind ?? ctx.user?.tokenType;
+}
+// src/plugins/apply-keto-checks.ts
+import { MapperKind as MapperKind2, mapSchema as mapSchema2 } from "@graphql-tools/utils";
+import { evaluateRequirement } from "@nxgt/ory-sdk";
+import { ErrorCode as ErrorCode3 } from "@nxgt/shared-exceptions";
+
+// src/directives/removed-check.ts
+import { getDirective as getDirective3 } from "@graphql-tools/utils";
+function refuseRemovedCheck(schema, node, where) {
+  const declared = schema.getDirective("check");
+  if (!declared?.args.some((arg) => arg.name === "permissions"))
+    return;
+  if (!getDirective3(schema, node, "check")?.length)
+    return;
+  throw new TypeError(`@check on ${where}: @check was removed in @nxgt/shared-graphql 3.0 — write one @permission(name: "<permit>", type: "<namespace>") per term, and move an OR into the Keto model`);
+}
+
+// src/plugins/apply-keto-checks.ts
+var MARK2 = "@nxgt/shared-graphql:keto-checks";
+function applyKetoChecks(schema, options = {}) {
+  let guardedNow = 0;
+  const mapped = mapSchema2(schema, {
+    [MapperKind2.INTERFACE_FIELD]: (fieldConfig, fieldName, typeName) => {
+      refuseOnInterface(schema, fieldConfig, `${typeName}.${fieldName}`);
+      return fieldConfig;
+    },
+    [MapperKind2.OBJECT_FIELD]: (fieldConfig, fieldName, typeName) => {
+      const where = `${typeName}.${fieldName}`;
+      refuseRemovedCheck(schema, fieldConfig, where);
+      const requirements = readPermissions(schema, fieldConfig, where, options);
+      if (requirements.length === 0 || isGuarded(fieldConfig, MARK2)) {
+        return fieldConfig;
       }
-      if (options?.limit) {
-        return result.slice(0, options.limit);
+      guardedNow += 1;
+      return guarded2(fieldConfig, requirements, where);
+    }
+  });
+  return guardedNow > 0 ? mapped : schema;
+}
+function refuseOnInterface(schema, fieldConfig, where) {
+  refuseRemovedCheck(schema, fieldConfig, where);
+  if (readPermissions(schema, fieldConfig, where).length > 0) {
+    throw new TypeError(`${where}: @permission on an interface field guards nothing — no resolver runs there. Put it on each implementing type's field`);
+  }
+}
+function guarded2(fieldConfig, requirements, where) {
+  return guardField(fieldConfig, {
+    mark: MARK2,
+    rank: 1,
+    onSubscribe: requirements.every(({ permissions }) => permissions.every((group) => group.every((term) => term.id.startsWith("args.")))),
+    check: async (source, args, context) => {
+      const ctx = context;
+      const subject = ctx.ory?.subject;
+      if (!subject)
+        throw denial(ErrorCode3.Unauthenticated);
+      const check = ctx.ketoChecks;
+      if (!check) {
+        throw new Error(`${where}: no checker on the context — useKetoChecks(ory) is not registered`);
       }
-      if (options?.skip) {
-        return result.slice(options.skip);
+      for (const { permissions, onDeny, message } of requirements) {
+        const allowed = await evaluateRequirement(permissions, (term) => objectsOf(term, source, args, where), check, subject);
+        if (!allowed)
+          throw refusal(onDeny, message);
       }
-      return result;
-    }));
+    }
   });
 }
-function createSingleChildDataLoader(path, model) {
-  return createDataLoader(async (docs) => {
-    const data = await model.find({
-      _id: docs.map((doc) => cast(doc[path])).filter((item) => !!item && !["undefined", "null"].includes(item?.toString()))
-    }).exec();
-    const map = new Map(data.map((doc) => [doc.id, doc]));
-    return docs.map((doc) => map.get(doc[path]?.toString() ?? "") ?? null);
-  });
+function objectsOf(term, source, args, where) {
+  const ids = objectIds(readPath(term.id, source, args));
+  if (ids.length === 0) {
+    throw new Error(`${where}: "${term.id}" resolved no object id`);
+  }
+  return ids;
 }
-function createEntitiesReferenceLoader(model) {
-  return createDataLoader(async (ids) => {
-    const docs = await model.find({
-      _id: ids.filter((item) => !!item && !["undefined", "null"].includes(item?.toString()))
-    }).exec();
-    const map = new Map(docs.map((doc) => [doc.id, doc]));
-    return ids.map((id) => map.get(id) ?? null);
-  });
+function refusal(onDeny, message) {
+  return denial(onDeny === "FORBIDDEN" ? ErrorCode3.Forbidden : ErrorCode3.NotFound, message);
 }
-// src/utils/errors.utils.ts
-import {
-  ApolloServerErrorCode,
-  unwrapResolverError
-} from "@apollo/server/errors";
-import {
-  translate as translateBase
-} from "@nxgt/i18n";
-import { OryUnavailable } from "@nxgt/ory-sdk";
-import { CustomException, ErrorCode } from "@nxgt/shared-exceptions";
-import { MONGO_UTILS, mongoose } from "@nxgt/shared-mongo";
-import { GraphQLError } from "graphql";
-import { kebabCase } from "lodash";
-function createGraphQLError(message, options) {
-  return new GraphQLError(message, options);
+// src/plugins/gateway-trust.ts
+var GATEWAY_SECRET_HEADER = "x-gateway-secret";
+var MIN_SECRET_LENGTH = 16;
+function gatewaySecret({
+  secret,
+  header = GATEWAY_SECRET_HEADER
+}) {
+  if (typeof secret !== "string" || secret.length < MIN_SECRET_LENGTH) {
+    throw new TypeError(`gatewaySecret(): \`secret\` must be a string of at least ${MIN_SECRET_LENGTH} characters — is its environment variable set?`);
+  }
+  const expected = new TextEncoder().encode(secret);
+  return (headers) => {
+    const sent = headers.get(header);
+    if (typeof sent !== "string")
+      return false;
+    return constantTimeEqual(new TextEncoder().encode(sent), expected);
+  };
 }
-function createFormatError(translate = translateBase, production) {
-  return (formattedError, graphQLError) => {
-    if (production && formattedError.extensions?.stacktrace) {
-      formattedError.extensions.stacktrace = undefined;
-    }
-    const error = unwrapResolverError(graphQLError);
-    if (error instanceof CustomException || error instanceof mongoose.MongooseError) {
-      const exception = error instanceof mongoose.MongooseError ? MONGO_UTILS.castError(error) : error;
-      return {
-        ...formattedError,
-        message: exception.errorCode === ErrorCode.ValidationError ? exception.message : translate(exception.message, exception.options),
-        extensions: {
-          ...formattedError.extensions,
-          code: exception.errorCode,
-          debugMessage: exception.debugMessage
-        }
-      };
-    }
-    if ([
-      ApolloServerErrorCode.GRAPHQL_VALIDATION_FAILED,
-      ApolloServerErrorCode.BAD_REQUEST,
-      ApolloServerErrorCode.BAD_USER_INPUT,
-      ApolloServerErrorCode.GRAPHQL_PARSE_FAILED,
-      ApolloServerErrorCode.OPERATION_RESOLUTION_FAILURE,
-      ApolloServerErrorCode.PERSISTED_QUERY_NOT_FOUND,
-      ApolloServerErrorCode.PERSISTED_QUERY_NOT_SUPPORTED
-    ].includes(formattedError.extensions?.code)) {
-      return {
-        ...formattedError,
-        message: translate(`errors.${kebabCase(formattedError.extensions?.code)}`, {}),
-        extensions: {
-          ...formattedError.extensions,
-          debugMessage: formattedError.message
-        }
-      };
+function requireGatewayTrust(options, plugin) {
+  const trust = options?.trustedGateway;
+  if (typeof trust !== "function") {
+    throw new TypeError(`${plugin}: name the gateway allowed to set the caller — ${plugin.replace("()", "")}({ trustedGateway: gatewaySecret({ secret }) }). The request's extensions are written by the client; an API that resolves its own callers uses useOryAuth(ory)`);
+  }
+  return trust;
+}
+function principalOf(value) {
+  if (!value || typeof value !== "object")
+    return;
+  const sub = value.sub;
+  return typeof sub === "string" && sub.length > 0 ? value : undefined;
+}
+function constantTimeEqual(sent, expected) {
+  let difference = sent.length ^ expected.length;
+  for (let index = 0;index < expected.length; index++) {
+    difference |= (sent[index] ?? 0) ^ (expected[index] ?? 0);
+  }
+  return difference === 0;
+}
+
+// src/plugins/auth.ts
+function useAuth(options) {
+  const trusted = requireGatewayTrust(options, "useAuth()");
+  return {
+    onContextBuilding: async ({ context, extendContext }) => {
+      const headers = context.request?.headers;
+      if (typeof headers?.get !== "function")
+        return;
+      if (!await trusted(headers))
+        return;
+      const user = principalOf(context.params?.extensions?.user);
+      if (!user)
+        return;
+      const token = context.params.extensions?.token;
+      extendContext({
+        user,
+        token: typeof token === "string" ? token : undefined
+      });
     }
-    return formattedError;
   };
 }
-var HTTP_STATUS_BY_CODE = {
-  [ErrorCode.BadRequest]: 400,
-  [ErrorCode.ValidationError]: 400,
-  [ErrorCode.Unauthenticated]: 401,
-  [ErrorCode.Forbidden]: 403,
-  [ErrorCode.NotFound]: 404,
-  [ErrorCode.Conflict]: 409,
-  [ErrorCode.ServiceUnavailable]: 503
-};
-function createMaskError(translate = translateBase) {
-  return (error, message, isDev) => {
-    const original = error instanceof GraphQLError && error.originalError ? error.originalError : error;
-    if (original instanceof OryUnavailable) {
-      return new GraphQLError(`ory: ${original.service} is unavailable`, {
-        extensions: {
-          code: ErrorCode.ServiceUnavailable,
-          http: { status: 503 },
-          debugMessage: original.message
-        }
-      });
+// src/plugins/authenticated.ts
+function useAuthenticated(options = {}) {
+  return {
+    onSchemaChange: ({ schema, replaceSchema }) => {
+      const next = applyAuthenticated(schema, options);
+      if (next !== schema)
+        replaceSchema(next);
     }
-    if (original instanceof CustomException || original instanceof mongoose.MongooseError) {
-      const exception = original instanceof mongoose.MongooseError ? MONGO_UTILS.castError(original) : original;
-      const status = exception.code;
-      return new GraphQLError(exception.errorCode === ErrorCode.ValidationError ? exception.message : translate(exception.message, exception.options), {
-        extensions: {
-          code: exception.errorCode,
-          ...status ? { http: { status } } : {},
-          ...exception.debugMessage ? { debugMessage: exception.debugMessage } : {}
-        }
-      });
+  };
+}
+// src/plugins/extract-jwt.ts
+function extractJwtPlugin(options) {
+  const trusted = requireGatewayTrust(options, "extractJwtPlugin()");
+  return {
+    async requestDidStart({ request, contextValue }) {
+      const headers = request.http?.headers;
+      if (!headers || !await trusted(headers))
+        return;
+      const payload = principalOf(request.extensions?.payload);
+      if (payload)
+        contextValue.jwt = { payload };
     }
-    if (error instanceof GraphQLError)
-      return error;
-    return new GraphQLError(message, {
-      extensions: isDev ? { code: ErrorCode.InternalServerError, debugMessage: String(error) } : { code: ErrorCode.InternalServerError }
-    });
   };
 }
-// src/utils/publish.ts
-import { createRedisEventTarget } from "@graphql-yoga/redis-event-target";
-import { createPubSub } from "graphql-yoga";
-var createYogaPubSub = ({
-  publishClient,
-  subscribeClient
-}) => {
-  const eventTarget = createRedisEventTarget({
-    publishClient,
-    subscribeClient
+// src/plugins/keto-checker.ts
+import { tuple } from "@nxgt/ory-sdk";
+import DataLoader from "dataloader";
+function createKetoChecks(ory) {
+  const loader = new DataLoader((questions) => ory.checkMany([...questions]), {
+    cacheKeyFn: ({ permission, subject }) => tuple(permission, subject)
   });
-  return createPubSub({ eventTarget });
-};
-// src/utils/sandbox.ts
-import { html } from "hono/html";
-var renderSandbox = ({
-  port = 8080,
-  hostname = "localhost",
-  graphqlEndpoint = "graphql",
-  protocol = "http",
-  title = "Sandbox Explorer"
-}) => html`
-<title>${title}</title>
-<div id="sandbox" style="position:absolute;top:0;right:0;bottom:0;left:0"></div>
-<script src="https://embeddable-sandbox.cdn.apollographql.com/_latest/embeddable-sandbox.umd.production.min.js"></script>
-<script>
-    new window.EmbeddedSandbox({
-        target: "#sandbox",
-        // Pass through your server href if you are embedding on an endpoint.
-        // Otherwise, you can pass whatever endpoint you want Sandbox to start up with here.
-        initialEndpoint: "${protocol}://${hostname}:${port}/${graphqlEndpoint}",
-        handleRequest: (endpointUrl, options) => {
-            return fetch(endpointUrl, {
-                ...options,
-                headers: {
-                    ...options.headers
-                },
-            })
-        },
-        hideCookieToggle: true,
-    });
-    // advanced options: https://www.apollographql.com/docs/studio/explorer/sandbox#embedding-sandbox
-</script>
-
-`;
-// src/utils/schema.utils.ts
-import { existsSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
-import { buildSubgraphSchema as buildSubgraphSchemaBase } from "@apollo/subgraph";
-import { loadFilesSync } from "@graphql-tools/load-files";
-import { mergeTypeDefs } from "@graphql-tools/merge";
-import { pruneSchema } from "@graphql-tools/utils";
-import { printSchema } from "graphql";
-function packageRoot() {
-  let dir = dirname(fileURLToPath(import.meta.url));
-  while (!existsSync(join(dir, "package.json"))) {
-    const parent = dirname(dir);
-    if (parent === dir)
-      throw new Error("@nxgt/shared-graphql: no package root");
-    dir = parent;
-  }
-  return dir;
+  return (permission, subject) => loader.load({ permission, subject });
 }
-var SHARED_SCHEMA_PATH = join(packageRoot(), "graphql/**/*.graphqls");
-function loadTypeDefs(...paths) {
-  const typeDefs = mergeTypeDefs([
-    ...paths.flatMap((path) => loadFilesSync(path, {
-      recursive: true
-    }))
-  ]);
-  return typeDefs;
+// src/plugins/keto-checks.ts
+function useKetoChecks(ory, options = {}) {
+  return {
+    onSchemaChange: ({ schema, replaceSchema }) => {
+      const next = applyKetoChecks(schema, options);
+      if (next !== schema)
+        replaceSchema(next);
+    },
+    onContextBuilding: ({ extendContext }) => {
+      extendContext({ ketoChecks: createKetoChecks(ory) });
+    }
+  };
 }
-function buildSubgraphSchema(modulesOrSdl) {
-  return pruneSchema(buildSubgraphSchemaBase(modulesOrSdl), {
-    skipUnusedTypesPruning: false
-  });
+// src/plugins/keto-helpers.ts
+import { ErrorCode as ErrorCode4 } from "@nxgt/shared-exceptions";
+function requireUser(context) {
+  if (!context.user) {
+    throw denial(ErrorCode4.Unauthenticated);
+  }
+  return context.user;
 }
-async function generateSchema(output, ...paths) {
-  await Bun.write(output, printSchema(buildSubgraphSchema(loadTypeDefs(...paths))));
+async function can(context, question) {
+  const subject = context.ory?.subject;
+  if (!subject) {
+    throw denial(ErrorCode4.Unauthenticated);
+  }
+  if (!context.ketoChecks) {
+    throw new Error("can(): no checker on the context — useKetoChecks(ory) is not registered");
+  }
+  const permission = {
+    namespace: question.type,
+    object: question.id,
+    relation: question.name
+  };
+  return context.ketoChecks(permission, subject);
 }
-// src/utils/websocket.ts
-import { createServer } from "node:http";
-import { useServer } from "graphql-ws/use/ws";
-import { WebSocketServer } from "ws";
-function setupYogaWebSocketServer({
-  yoga,
-  context
-}) {
-  const httpServer = createServer(yoga);
-  const wsServer = new WebSocketServer({
-    server: httpServer,
-    path: yoga.graphqlEndpoint
-  });
-  useServer({
-    execute: (args) => args.rootValue.execute(args),
-    subscribe: (args) => args.rootValue.subscribe(args),
-    onSubscribe: async (ctx, _id, params) => {
-      const { schema, execute, subscribe, contextFactory, parse, validate } = yoga.getEnveloped({
-        ...ctx,
-        req: ctx.extra.request,
-        socket: ctx.extra.socket,
-        params
-      });
-      const args = {
-        schema,
-        operationName: params.operationName,
-        document: parse(params.query),
-        variableValues: params.variables,
-        contextValue: await contextFactory(),
-        rootValue: {
-          execute,
-          subscribe
-        }
-      };
-      const errors = validate(args.schema, args.document);
-      if (errors.length)
-        return errors;
-      return args;
-    },
-    context
-  }, wsServer);
-  const startServer = (port) => new Promise((resolve) => httpServer.listen({ port }, resolve));
-  return { yoga, httpServer, startServer };
-}
-// src/utils/ws-context.ts
-async function resolveWsUser(connectionParams, authClient) {
-  const rawToken = connectionParams?.authorization ?? connectionParams?.Authorization;
-  const token = rawToken?.replace("Bearer ", "");
-  const { data } = token ? await authClient.POST("/oauth/introspect", { body: { token } }) : { data: null };
-  const user = data?.active ? { ...data, name: data.sub } : undefined;
-  return { user, token };
-}
-// src/integrations/hono.ts
-function sandboxExpolorer(options) {
-  return createMiddleware(async (ctx) => {
-    return ctx.html(renderSandbox(options));
-  });
-}
-function honoYoga(yoga) {
-  return createMiddleware(async (ctx) => {
-    const response = await yoga.fetch(ctx.req.raw);
-    return response;
-  });
-}
-function createYogaHono(yoga, options) {
-  const app = new Hono;
-  app.use(contextStorage());
-  app.use(languageDetector({
-    order: ["header"],
-    supportedLanguages: ["en", "fr"],
-    fallbackLanguage: "en",
-    caches: []
-  }));
-  app.get("/health", (ctx) => {
-    return ctx.json({ status: "ok" }, 200);
-  });
-  app.get(options?.sandbox?.endpoint || "sandbox", sandboxExpolorer(options?.sandbox || {}));
-  app.use(yoga.graphqlEndpoint, honoYoga(yoga));
-  return app;
-}
-// src/plugins/auth.ts
-function useAuth() {
-  return {
-    onContextBuilding: async ({ context, extendContext }) => {
-      extendContext({
-        user: context.params.extensions?.user,
-        token: context.params.extensions?.token
-      });
-    }
-  };
-}
-// src/plugins/extract-jwt.ts
-import { logger } from "@nxgt/shared-logging";
-var extractJwtPlugin = {
-  async requestDidStart({ request, contextValue }) {
-    logger.info(`[${request.extensions?.subgraphName}] Extracting JWT from request extensions: ${request.extensions?.payload?.sub}`, request.extensions);
-    contextValue.jwt = {
-      payload: request.extensions?.payload
-    };
-  }
-};
-// src/plugins/keto-checks.ts
-import { MapperKind, mapSchema } from "@graphql-tools/utils";
+// src/plugins/ory-auth.ts
 import {
-  evaluateRequirement,
-  tuple
+  bearerOf
 } from "@nxgt/ory-sdk";
-import { CustomException as CustomException2 } from "@nxgt/shared-exceptions";
-import DataLoader2 from "dataloader";
-import { defaultFieldResolver } from "graphql";
-function createKetoChecks(ory) {
-  const loader = new DataLoader2((questions) => ory.checkMany([...questions]), {
-    cacheKeyFn: ({ permission, subject }) => tuple(permission, subject)
-  });
-  return (permission, subject) => loader.load({ permission, subject });
+import { claimsFromOryPrincipal } from "@nxgt/security/integrations/ory";
+
+// src/utils/errors/ory-unavailable.ts
+import { ErrorCode as ErrorCode5 } from "@nxgt/shared-exceptions";
+import { GraphQLError as GraphQLError2 } from "graphql";
+function isOryUnavailable(error) {
+  if (!(error instanceof Error))
+    return false;
+  const service = error.service;
+  return error.name === "OryUnavailable" && typeof service === "string";
 }
-function applyKetoChecks(schema) {
-  return mapSchema(schema, {
-    [MapperKind.OBJECT_FIELD]: (fieldConfig, fieldName, typeName) => {
-      const where = `${typeName}.${fieldName}`;
-      const checks = readChecks(schema, fieldConfig, where);
-      if (checks.length === 0)
-        return fieldConfig;
-      const resolve = fieldConfig.resolve ?? defaultFieldResolver;
-      return {
-        ...fieldConfig,
-        resolve: async (source, args, context, info) => {
-          const ctx = context;
-          const subject = ctx.ory?.subject;
-          if (!subject) {
-            throw CustomException2.unauthenticated({
-              message: "errors.unauthenticated"
-            });
-          }
-          const check = ctx.ketoChecks;
-          if (!check) {
-            throw new Error(`@check on ${where}: no checker on the context — useKetoChecks(ory) is not registered`);
-          }
-          for (const { permissions, onDeny, message } of checks) {
-            const allowed = await evaluateRequirement(permissions, (term) => objectsOf(term, source, args, where), check, subject);
-            if (!allowed)
-              throw denial(onDeny, message);
-          }
-          return resolve(source, args, context, info);
-        }
-      };
+function serviceUnavailableError(error) {
+  return new GraphQLError2(`ory: ${error.service} is unavailable`, {
+    extensions: {
+      code: ErrorCode5.ServiceUnavailable,
+      http: { status: 503 },
+      debugMessage: error.message
     }
   });
 }
-function objectsOf(term, source, args, where) {
-  const ids = objectIds(readPath(term.id, source, args));
-  if (ids.length === 0) {
-    throw new Error(`@check on ${where}: "${term.id}" resolved no object id`);
-  }
-  return ids;
-}
-function denial(onDeny, message) {
-  return onDeny === "FORBIDDEN" ? CustomException2.forbidden({
-    message: message ?? "errors.insufficient-permissions"
-  }) : CustomException2.notFound({ message: message ?? "errors.not-found" });
-}
-function useKetoChecks(ory) {
-  const transformed = new WeakSet;
-  return {
-    onSchemaChange: ({ schema, replaceSchema }) => {
-      if (transformed.has(schema))
-        return;
-      const next = applyKetoChecks(schema);
-      transformed.add(next);
-      replaceSchema(next);
-    },
-    onContextBuilding: ({ extendContext }) => {
-      extendContext({ ketoChecks: createKetoChecks(ory) });
-    }
-  };
-}
+
 // src/plugins/ory-auth.ts
-import {
-  bearerOf,
-  OryUnavailable as OryUnavailable2
-} from "@nxgt/ory-sdk";
-import { claimsFromOryPrincipal } from "@nxgt/security/integrations/ory";
-import { GraphQLError as GraphQLError2 } from "graphql";
 function toPrincipal(ory) {
   const email = ory.identity?.email;
   return {
@@ -625,20 +683,14 @@ function toPrincipal(ory) {
   };
 }
 function oryUnavailableError(error) {
-  return new GraphQLError2(`ory: ${error.service} is unavailable`, {
-    extensions: {
-      code: "SERVICE_UNAVAILABLE",
-      http: { status: 503 },
-      debugMessage: error.message
-    }
-  });
+  return serviceUnavailableError(error);
 }
 async function resolveOryPrincipal(ory, headers) {
   let principal;
   try {
     principal = await ory.resolve(headers);
   } catch (error) {
-    if (error instanceof OryUnavailable2)
+    if (isOryUnavailable(error))
       throw oryUnavailableError(error);
     throw error;
   }
@@ -747,15 +799,15 @@ import {
 } from "graphql-scalars";
 
 // src/scalars/custom/utils.ts
-import { CustomException as CustomException3 } from "@nxgt/shared-exceptions";
-import { logger as logger2 } from "@nxgt/shared-logging";
+import { CustomException } from "@nxgt/shared-exceptions";
+import { logger } from "@nxgt/shared-logging";
 import { GraphQLScalarType as GraphQLScalarType2 } from "graphql";
 function createScalarFrom(scalar, {
   name,
   description,
   errorMessage
 }) {
-  const exception = CustomException3.badRequest({
+  const exception = CustomException.badRequest({
     message: errorMessage
   });
   return new GraphQLScalarType2({
@@ -769,7 +821,7 @@ function createScalarFrom(scalar, {
       try {
         return scalar.serialize(value);
       } catch (e) {
-        logger2.error(e);
+        logger.error(e);
         throw exception;
       }
     },
@@ -780,18 +832,18 @@ function createScalarFrom(scalar, {
       try {
         return scalar.parseValue(value);
       } catch (e) {
-        logger2.error(e);
+        logger.error(e);
         throw exception;
       }
     },
-    parseLiteral(ast) {
+    parseLiteral(ast, variables) {
       if (!errorMessage) {
-        return scalar.parseLiteral(ast);
+        return scalar.parseLiteral(ast, variables);
       }
       try {
-        return scalar.parseLiteral(ast);
+        return scalar.parseLiteral(ast, variables);
       } catch (e) {
-        logger2.error(e);
+        logger.error(e);
         throw exception;
       }
     }
@@ -982,8 +1034,7 @@ type Subscription {
 	_empty: String
 }
 
-directive @authenticated on FIELD_DEFINITION | OBJECT | INTERFACE | SCALAR | ENUM
-
+${AUTHENTICATED_DIRECTIVE_SDL}
 directive @policy(policies: [[String!]!]!) on FIELD_DEFINITION | OBJECT | INTERFACE | SCALAR | ENUM
 
 directive @shareable on OBJECT | FIELD_DEFINITION
@@ -993,17 +1044,441 @@ directive @link(url: String!, import: [String!]) on SCHEMA
 `;
 // src/upload.ts
 import graphqlUploadExpress from "graphql-upload/graphqlUploadExpress.mjs";
+// src/utils/change-resolvers.utils.ts
+import {
+  AUDIT_EVENT,
+  CommitType
+} from "@nxgt/shared-mongo";
+import { withFilter } from "graphql-subscriptions";
+function createChangeResolvers(config) {
+  const { entity, collection, service, pubsub } = config;
+  const resolvePubSub = () => typeof pubsub === "function" ? pubsub() : pubsub;
+  return {
+    Query: {
+      [`${entity}Changes`]: async (_parent, args, context) => context.services.audit.findChangesPaginatedByCollection(collection, args),
+      [`${entity}ChangesById`]: async (_parent, args, context) => context.services.audit.findChangesPaginatedByCollectionAndOid(args.id, collection, args)
+    },
+    Subscription: {
+      [`${entity}Changed`]: {
+        resolve: async (payload, _args, context) => ({
+          id: context.services.audit.extractId(payload),
+          data: payload.type !== CommitType.TERMINAL ? await context.services[service].findById(payload.state._id) : null,
+          type: payload.type
+        }),
+        subscribe: withFilter(() => resolvePubSub().subscribe(AUDIT_EVENT), (payload, _variables, context) => context ? context.services.audit.matches(payload, { collection }) : false)
+      }
+    }
+  };
+}
+// src/utils/codegen.utils.ts
+var SCALARS_MAPPING = {
+  ID: "any",
+  DateTime: "any",
+  Date: "any",
+  Any: "any",
+  BigInt: "number",
+  EmailAddress: "string",
+  GeoJSON: "any",
+  HSL: "string",
+  HSLA: "string",
+  HexColorCode: "string",
+  Hexadecimal: "string",
+  IBAN: "string",
+  IP: "string",
+  Time: "string",
+  LocalTime: "string",
+  UUID: "string",
+  PositiveInt: "number",
+  NegativeInt: "number",
+  NonPositiveInt: "number",
+  NonNegativeInt: "number",
+  PositiveFloat: "number",
+  NegativeFloat: "number",
+  NonPositiveFloat: "number",
+  NonNegativeFloat: "number",
+  NonEmptyString: "string",
+  PostalCode: "string",
+  RGB: "string",
+  RGBA: "string",
+  SESSN: "string",
+  Timestamp: "string",
+  URL: "string",
+  USCurrency: "string",
+  UTCOffset: "string",
+  Long: "number",
+  Short: "number",
+  Byte: "number",
+  BigDecimal: "string",
+  BigInteger: "string",
+  Char: "string",
+  Locale: "string",
+  CountryCode: "string",
+  CountryName: "string",
+  AccountNumber: "string",
+  CurrencyCode: "string",
+  Duration: "string",
+  Url: "string",
+  JSONObject: "Record<string, any>",
+  JSON: "any",
+  Void: "void",
+  ObjectID: "any",
+  Upload: "File | Blob",
+  Email: "string",
+  Port: "number",
+  IPv4: "string",
+  IPv6: "string",
+  MAC: "string",
+  Password: "string",
+  PhoneNumber: "string",
+  ZIPCode: "string",
+  SSN: "string",
+  GUID: "string",
+  ISBN: "string",
+  Latitude: "number",
+  Longitude: "number",
+  JWT: "string"
+};
+// src/utils/data-loader.utils.ts
+import { cast } from "@nxgt/shared/helpers";
+import {
+  paginateList
+} from "@nxgt/shared-mongo";
+import DataLoader2 from "dataloader";
+import { isArray } from "lodash";
+function createDataLoader(batchLoadFn, options) {
+  return new DataLoader2(batchLoadFn, options);
+}
+function createConnectionListDataLoader(path, model, options) {
+  return createDataLoader(async (docs) => {
+    const data = await model.find({
+      ...options.filter ?? {},
+      _id: docs.flatMap((doc) => {
+        const ids = doc[path] ?? [];
+        return isArray(ids) ? cast(ids.filter((item) => !!item && !["undefined", "null"].includes(item?.toString()))) : [];
+      })
+    }).exec();
+    return cast(docs.map((doc) => model.paginateList(data.filter((child) => cast(doc[path] ?? []).map((item) => item.toString()).includes(child._id.toString())), options)));
+  });
+}
+function createChildrenConnectionDataLoader(path, model, options) {
+  return createDataLoader(async (docs) => {
+    const filter = {};
+    filter[path] = docs.map((doc) => doc._id);
+    const data = await model.find(filter).exec();
+    return cast(docs.map((doc) => paginateList(data.filter((child) => doc._id?.toString() === child[path]?.toString()), options)));
+  });
+}
+function createSimpleListDataLoader(path, model, options) {
+  return createDataLoader(async (docs) => {
+    const filter = options?.filter ?? {};
+    const ids = docs.flatMap((doc) => {
+      const ids = doc[path] ?? [];
+      return isArray(ids) ? cast(ids) : [];
+    });
+    filter._id = ids;
+    const query = model.find(filter);
+    const data = await query.exec();
+    return cast(docs.map((doc) => {
+      const result = data.filter((child) => cast(doc[path] ?? []).map((item) => item.toString()).includes(child._id.toString()));
+      if (options?.skip && options?.limit) {
+        return result.slice(options.skip, options.skip + options.limit);
+      }
+      if (options?.limit) {
+        return result.slice(0, options.limit);
+      }
+      if (options?.skip) {
+        return result.slice(options.skip);
+      }
+      return result;
+    }));
+  });
+}
+function createChildrenListDataLoader(path, model, options) {
+  return createDataLoader(async (docs) => {
+    const filter = options?.filter ?? {};
+    const key = path;
+    filter[key] = docs.map((doc) => doc._id);
+    const query = model.find(filter);
+    const data = await query.exec();
+    return cast(docs.map((doc) => {
+      const result = data.filter((child) => child[path]?.toString() === doc._id.toString());
+      if (options?.skip && options?.limit) {
+        return result.slice(options.skip, options.skip + options.limit);
+      }
+      if (options?.limit) {
+        return result.slice(0, options.limit);
+      }
+      if (options?.skip) {
+        return result.slice(options.skip);
+      }
+      return result;
+    }));
+  });
+}
+function createSingleChildDataLoader(path, model) {
+  return createDataLoader(async (docs) => {
+    const data = await model.find({
+      _id: docs.map((doc) => cast(doc[path])).filter((item) => !!item && !["undefined", "null"].includes(item?.toString()))
+    }).exec();
+    const map = new Map(data.map((doc) => [doc.id, doc]));
+    return docs.map((doc) => map.get(doc[path]?.toString() ?? "") ?? null);
+  });
+}
+function createEntitiesReferenceLoader(model) {
+  return createDataLoader(async (ids) => {
+    const docs = await model.find({
+      _id: ids.filter((item) => !!item && !["undefined", "null"].includes(item?.toString()))
+    }).exec();
+    const map = new Map(docs.map((doc) => [doc.id, doc]));
+    return ids.map((id) => map.get(id) ?? null);
+  });
+}
+// src/utils/errors/create-error.ts
+import { GraphQLError as GraphQLError3 } from "graphql";
+function createGraphQLError(message, options) {
+  return new GraphQLError3(message, options);
+}
+// src/utils/errors/format-error.ts
+import {
+  ApolloServerErrorCode,
+  unwrapResolverError
+} from "@apollo/server/errors";
+import {
+  translate as translateBase
+} from "@nxgt/i18n";
+import { CustomException as CustomException2, ErrorCode as ErrorCode6 } from "@nxgt/shared-exceptions";
+import { MONGO_UTILS, mongoose } from "@nxgt/shared-mongo";
+import { kebabCase } from "lodash";
+function createFormatError(translate = translateBase, production) {
+  return (formattedError, graphQLError) => {
+    if (production && formattedError.extensions?.stacktrace) {
+      formattedError.extensions.stacktrace = undefined;
+    }
+    const error = unwrapResolverError(graphQLError);
+    if (isOryUnavailable(error)) {
+      const unavailable = serviceUnavailableError(error);
+      return {
+        ...formattedError,
+        message: unavailable.message,
+        extensions: { ...formattedError.extensions, ...unavailable.extensions }
+      };
+    }
+    const key = denialMessageKey(error);
+    if (key !== undefined) {
+      return { ...formattedError, message: translate(key) };
+    }
+    if (error instanceof CustomException2 || error instanceof mongoose.MongooseError) {
+      const exception = error instanceof mongoose.MongooseError ? MONGO_UTILS.castError(error) : error;
+      return {
+        ...formattedError,
+        message: exception.errorCode === ErrorCode6.ValidationError ? exception.message : translate(exception.message, exception.options),
+        extensions: {
+          ...formattedError.extensions,
+          code: exception.errorCode,
+          debugMessage: exception.debugMessage
+        }
+      };
+    }
+    if ([
+      ApolloServerErrorCode.GRAPHQL_VALIDATION_FAILED,
+      ApolloServerErrorCode.BAD_REQUEST,
+      ApolloServerErrorCode.BAD_USER_INPUT,
+      ApolloServerErrorCode.GRAPHQL_PARSE_FAILED,
+      ApolloServerErrorCode.OPERATION_RESOLUTION_FAILURE,
+      ApolloServerErrorCode.PERSISTED_QUERY_NOT_FOUND,
+      ApolloServerErrorCode.PERSISTED_QUERY_NOT_SUPPORTED
+    ].includes(formattedError.extensions?.code)) {
+      return {
+        ...formattedError,
+        message: translate(`errors.${kebabCase(formattedError.extensions?.code)}`, {}),
+        extensions: {
+          ...formattedError.extensions,
+          debugMessage: formattedError.message
+        }
+      };
+    }
+    return formattedError;
+  };
+}
+// src/utils/errors/mask-error.ts
+import {
+  translate as translateBase2
+} from "@nxgt/i18n";
+import { CustomException as CustomException3, ErrorCode as ErrorCode7 } from "@nxgt/shared-exceptions";
+import { MONGO_UTILS as MONGO_UTILS2, mongoose as mongoose2 } from "@nxgt/shared-mongo";
+import { GraphQLError as GraphQLError4 } from "graphql";
+function createMaskError(translate = translateBase2) {
+  return (error, message, isDev) => {
+    const original = error instanceof GraphQLError4 && error.originalError ? error.originalError : error;
+    if (isOryUnavailable(original))
+      return serviceUnavailableError(original);
+    const key = denialMessageKey(original);
+    if (key !== undefined) {
+      return new GraphQLError4(translate(key), {
+        ...locationOf(error),
+        extensions: original.extensions
+      });
+    }
+    if (original instanceof CustomException3 || original instanceof mongoose2.MongooseError) {
+      return exceptionError(original, translate);
+    }
+    if (isOriginalGraphQLError(error))
+      return error;
+    return new GraphQLError4(message, {
+      ...locationOf(error),
+      extensions: isDev ? {
+        code: ErrorCode7.InternalServerError,
+        debugMessage: String(original)
+      } : { code: ErrorCode7.InternalServerError }
+    });
+  };
+}
+function exceptionError(original, translate) {
+  const exception = original instanceof mongoose2.MongooseError ? MONGO_UTILS2.castError(original) : original;
+  const status = exception.code;
+  return new GraphQLError4(exception.errorCode === ErrorCode7.ValidationError ? exception.message : translate(exception.message, exception.options), {
+    extensions: {
+      code: exception.errorCode,
+      ...status ? { http: { status } } : {},
+      ...exception.debugMessage ? { debugMessage: exception.debugMessage } : {}
+    }
+  });
+}
+function isOriginalGraphQLError(error) {
+  if (!(error instanceof GraphQLError4))
+    return false;
+  return error.originalError == null ? true : isOriginalGraphQLError(error.originalError);
+}
+function locationOf(error) {
+  if (!(error instanceof GraphQLError4))
+    return {};
+  return {
+    nodes: error.nodes,
+    source: error.source,
+    positions: error.positions,
+    path: error.path
+  };
+}
+// src/utils/publish.ts
+import { createRedisEventTarget } from "@graphql-yoga/redis-event-target";
+import { createPubSub } from "graphql-yoga";
+var createYogaPubSub = ({
+  publishClient,
+  subscribeClient
+}) => {
+  const eventTarget = createRedisEventTarget({
+    publishClient,
+    subscribeClient
+  });
+  return createPubSub({ eventTarget });
+};
+// src/utils/schema.utils.ts
+import { existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { buildSubgraphSchema as buildSubgraphSchemaBase } from "@apollo/subgraph";
+import { loadFilesSync } from "@graphql-tools/load-files";
+import { mergeTypeDefs } from "@graphql-tools/merge";
+import { pruneSchema } from "@graphql-tools/utils";
+import { printSchema } from "graphql";
+function packageRoot() {
+  let dir = dirname(fileURLToPath(import.meta.url));
+  while (!existsSync(join(dir, "package.json"))) {
+    const parent = dirname(dir);
+    if (parent === dir)
+      throw new Error("@nxgt/shared-graphql: no package root");
+    dir = parent;
+  }
+  return dir;
+}
+var SHARED_SCHEMA_PATH = join(packageRoot(), "graphql/**/*.graphqls");
+function loadTypeDefs(...paths) {
+  const typeDefs = mergeTypeDefs([
+    ...paths.flatMap((path) => loadFilesSync(path, {
+      recursive: true
+    }))
+  ]);
+  return typeDefs;
+}
+function buildSubgraphSchema(modulesOrSdl) {
+  return pruneSchema(buildSubgraphSchemaBase(modulesOrSdl), {
+    skipUnusedTypesPruning: false
+  });
+}
+async function generateSchema(output, ...paths) {
+  await Bun.write(output, printSchema(buildSubgraphSchema(loadTypeDefs(...paths))));
+}
+// src/utils/websocket.ts
+import { createServer } from "node:http";
+import { useServer } from "graphql-ws/use/ws";
+import { WebSocketServer } from "ws";
+function setupYogaWebSocketServer({
+  yoga,
+  context
+}) {
+  const httpServer = createServer(yoga);
+  const wsServer = new WebSocketServer({
+    server: httpServer,
+    path: yoga.graphqlEndpoint
+  });
+  useServer({
+    execute: (args) => args.rootValue.execute(args),
+    subscribe: (args) => args.rootValue.subscribe(args),
+    onSubscribe: async (ctx, _id, params) => {
+      const { schema, execute, subscribe, contextFactory, parse, validate } = yoga.getEnveloped({
+        ...ctx,
+        req: ctx.extra.request,
+        socket: ctx.extra.socket,
+        params
+      });
+      const args = {
+        schema,
+        operationName: params.operationName,
+        document: parse(params.query),
+        variableValues: params.variables,
+        contextValue: await contextFactory(),
+        rootValue: {
+          execute,
+          subscribe
+        }
+      };
+      const errors = validate(args.schema, args.document);
+      if (errors.length)
+        return errors;
+      return args;
+    },
+    context
+  }, wsServer);
+  const startServer = (port) => new Promise((resolve) => httpServer.listen({ port }, resolve));
+  return { yoga, httpServer, startServer };
+}
+// src/utils/ws-context.ts
+async function resolveWsUser(connectionParams, authClient) {
+  const rawToken = connectionParams?.authorization ?? connectionParams?.Authorization;
+  const token = rawToken?.replace("Bearer ", "");
+  const { data } = token ? await authClient.POST("/oauth/introspect", { body: { token } }) : { data: null };
+  const user = data?.active ? { ...data, name: data.sub } : undefined;
+  return { user, token };
+}
 export {
-  CHECK_DIRECTIVE_NAME,
+  AUTHENTICATED_DIRECTIVE_NAME,
+  AUTHENTICATED_DIRECTIVE_SDL,
+  CALLER_TYPES,
   DataLoader3 as DataLoader,
   FEDERATION_DIRECTIVES,
+  GATEWAY_SECRET_HEADER,
+  KETO_DIRECTIVES_SDL,
+  PERMISSION_DIRECTIVE_NAME,
+  PERMISSION_DIRECTIVE_SDL,
   SCALARS_MAPPING,
   SCALAR_RESOLVERS,
   SHARED_SCHEMA_PATH,
   SHARED_TYPE_DEFS,
+  applyAuthenticated,
   applyKetoChecks,
   assertReadablePath,
   buildSubgraphSchema,
+  can,
   createChangeResolvers,
   createChildrenConnectionDataLoader,
   createChildrenListDataLoader,
@@ -1018,25 +1493,34 @@ export {
   createSingleChildDataLoader,
   createYogaHono,
   createYogaPubSub,
+  denial,
+  denialMessageKey,
   extractJwtPlugin,
+  gatewaySecret,
   generateSchema,
   graphqlUploadExpress,
   honoYoga,
+  isOryUnavailable,
   loadTypeDefs,
   objectIds,
   oryUnavailableError,
-  readChecks,
+  principalOf,
   readPath,
+  readPermissions,
   renderSandbox,
+  requireGatewayTrust,
+  requireUser,
   resolveOryPrincipal,
   resolveWsUser,
-  sandboxExpolorer,
+  sandboxExplorer,
+  serviceUnavailableError,
   setupYogaWebSocketServer,
   toPrincipal,
   useAuth,
+  useAuthenticated,
   useKetoChecks,
   useOryAuth
 };
 
-//# debugId=6FBEA5C770B5605F64756E2164756E21
+//# debugId=D1F8FC67079E823264756E2164756E21
 //# sourceMappingURL=index.js.map