@nxgt/shared-graphql 2.0.1 → 3.0.0

package/dist/plugins/auth.d.ts

@@ -1,4 +1,20 @@
 import type { Plugin } from 'graphql-yoga';
 import type { GraphQLBaseContext } from '../types';
-export declare function useAuth(): Plugin<GraphQLBaseContext>;
+import { type GatewayTrustOptions } from './gateway-trust';
+export type UseAuthOptions = GatewayTrustOptions;
+/**
+ * The caller a gateway resolved, read from the GraphQL request's `extensions`
+ * — `user` and `token` — and ONLY for a request `trustedGateway` vouches for.
+ *
+ * `extensions` sits in the request body, which any client writes. A request
+ * without the gateway's proof leaves the context as it was: no `user`, no
+ * `token`, whatever its `extensions` claim. Without a `trustedGateway` this
+ * throws when it is called, so a server cannot boot trusting the body.
+ *
+ *     useAuth({ trustedGateway: gatewaySecret({ secret: env.GATEWAY_SECRET }) })
+ *
+ * An API that resolves its own callers — a Kratos session, a Hydra token —
+ * uses `useOryAuth(ory)` instead.
+ */
+export declare function useAuth(options: UseAuthOptions): Plugin<GraphQLBaseContext>;
 //# sourceMappingURL=auth.d.ts.map

package/dist/plugins/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/plugins/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAEnD,wBAAgB,OAAO,IAAI,MAAM,CAAC,kBAAkB,CAAC,CASpD"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/plugins/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AACnD,OAAO,EACN,KAAK,mBAAmB,EAGxB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,MAAM,cAAc,GAAG,mBAAmB,CAAC;AAEjD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAmB3E"}

package/dist/plugins/authenticated.d.ts

@@ -0,0 +1,14 @@
+import type { Plugin } from 'graphql-yoga';
+import type { AuthenticatedOptions } from '../directives/authenticated';
+import type { GraphQLBaseContext } from '../types';
+import type { OryContext } from './ory-auth';
+/**
+ * Enforces `@authenticated` and `@authenticated(type:)` on every schema the
+ * server uses. Goes after the plugin that sets the caller — `useOryAuth(ory)`
+ * or `useAuth({ trustedGateway })`.
+ *
+ * `applyAuthenticated` returns a schema with no field left to guard as it is,
+ * so the replacement settles alongside `useKetoChecks` whatever their order.
+ */
+export declare function useAuthenticated(options?: AuthenticatedOptions): Plugin<GraphQLBaseContext & OryContext>;
+//# sourceMappingURL=authenticated.d.ts.map

package/dist/plugins/authenticated.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticated.d.ts","sourceRoot":"","sources":["../../src/plugins/authenticated.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAEnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC/B,OAAO,GAAE,oBAAyB,GAChC,MAAM,CAAC,kBAAkB,GAAG,UAAU,CAAC,CAOzC"}

package/dist/plugins/extract-jwt.d.ts

@@ -1,9 +1,22 @@
+import type { ApolloServerPlugin } from '@apollo/server';
 import type { TokenPrincipal } from '@nxgt/shared';
-export declare const extractJwtPlugin: {
-    requestDidStart({ request, contextValue }: import("@apollo/server").GraphQLRequestContext<{
-        jwt?: {
-            payload: TokenPrincipal;
-        };
-    }>): Promise<void>;
+import { type GatewayTrustOptions } from './gateway-trust';
+export type ExtractJwtOptions = GatewayTrustOptions;
+/** What `extractJwtPlugin()` sets on an Apollo context. */
+export type JwtContext = {
+    jwt?: {
+        payload: TokenPrincipal;
+    };
 };
+/**
+ * Apollo Server's counterpart of `useAuth()`: the JWT payload a gateway
+ * verified and forwarded in `request.extensions.payload`, copied onto
+ * `context.jwt` — ONLY for a request `trustedGateway` vouches for.
+ *
+ * A request without the gateway's proof leaves `context.jwt` as the context
+ * function built it, whatever its `extensions` claim.
+ *
+ *     plugins: [extractJwtPlugin({ trustedGateway: gatewaySecret({ secret }) })]
+ */
+export declare function extractJwtPlugin(options: ExtractJwtOptions): ApolloServerPlugin<JwtContext>;
 //# sourceMappingURL=extract-jwt.d.ts.map

package/dist/plugins/extract-jwt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extract-jwt.d.ts","sourceRoot":"","sources":["../../src/plugins/extract-jwt.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAGnD,eAAO,MAAM,gBAAgB;;cAWtB;YAAE,OAAO,EAAE,cAAc,CAAA;SAAE;;CAChC,CAAC"}
+{"version":3,"file":"extract-jwt.d.ts","sourceRoot":"","sources":["../../src/plugins/extract-jwt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EACN,KAAK,mBAAmB,EAGxB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAEpD,2DAA2D;AAC3D,MAAM,MAAM,UAAU,GAAG;IACxB,GAAG,CAAC,EAAE;QAAE,OAAO,EAAE,cAAc,CAAA;KAAE,CAAC;CAClC,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC/B,OAAO,EAAE,iBAAiB,GACxB,kBAAkB,CAAC,UAAU,CAAC,CAUhC"}

package/dist/plugins/field-guard.d.ts

@@ -0,0 +1,30 @@
+import { type GraphQLFieldConfig } from 'graphql';
+type FieldConfig = GraphQLFieldConfig<unknown, unknown>;
+/** What a guard asks before a field runs; it throws to refuse. */
+export type FieldCheck = (source: unknown, args: Record<string, unknown>, context: unknown) => void | Promise<void>;
+/**
+ * One transform's guard on one field: its mark, its rank (lower runs first),
+ * its check, and whether the check can run before a subscription's stream is
+ * opened — only when it reads nothing off an event (`parent.<path>`).
+ */
+export type FieldGuard = {
+    mark: string;
+    rank: number;
+    check: FieldCheck;
+    onSubscribe: boolean;
+};
+/**
+ * Whether the transform owning `mark` guards this field as it stands. A
+ * merged schema's unguarded half, or a field whose resolver was replaced,
+ * is not — so a transform run again wraps it, never one twice.
+ */
+export declare function isGuarded(config: FieldConfig, mark: string): boolean;
+/**
+ * The field with `guard` added. Every guard runs by rank — `@authenticated`
+ * before `@permission`, whichever transform ran first — before the resolver;
+ * those with `onSubscribe` also run before `subscribe`, so a refused
+ * subscription opens no stream.
+ */
+export declare function guardField(config: FieldConfig, guard: FieldGuard): FieldConfig;
+export {};
+//# sourceMappingURL=field-guard.d.ts.map

package/dist/plugins/field-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"field-guard.d.ts","sourceRoot":"","sources":["../../src/plugins/field-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAEN,KAAK,kBAAkB,EAEvB,MAAM,SAAS,CAAC;AAEjB,KAAK,WAAW,GAAG,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAGxD,kEAAkE;AAClE,MAAM,MAAM,UAAU,GAAG,CACxB,MAAM,EAAE,OAAO,EACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,EAAE,OAAO,KACZ,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1B;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,UAAU,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;CACrB,CAAC;AA6BF;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpE;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CACzB,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,UAAU,GACf,WAAW,CA6Bb"}

package/dist/plugins/gateway-trust.d.ts

@@ -0,0 +1,47 @@
+import type { TokenPrincipal } from '@nxgt/shared';
+/** One request header — a fetch `Headers`, or Apollo Server's `HeaderMap`. */
+export type HeaderReader = {
+    get(name: string): string | null | undefined;
+};
+/**
+ * Whether a request came from the gateway allowed to name the caller in the
+ * GraphQL request's `extensions`.
+ *
+ * `extensions` is part of the request body, which any client writes. It names
+ * the caller only when this answers `true` — for a request carrying proof the
+ * client cannot forge. `gatewaySecret()` is the usual proof; a function of
+ * your own (an mTLS header set by your proxy, say) works as well.
+ */
+export type GatewayTrust = (headers: HeaderReader) => boolean | Promise<boolean>;
+/** What `useAuth()` and `extractJwtPlugin()` take: who may set the caller. */
+export type GatewayTrustOptions = {
+    trustedGateway: GatewayTrust;
+};
+export type GatewaySecretOptions = {
+    /** Shared with the gateway only. At least 16 characters. */
+    secret: string;
+    /** The header the gateway sends it in. `x-gateway-secret` by default. */
+    header?: string;
+};
+export declare const GATEWAY_SECRET_HEADER = "x-gateway-secret";
+/**
+ * A `GatewayTrust` that holds for a request whose `header` carries `secret`,
+ * compared in constant time. The gateway adds the header to every subgraph
+ * request; a client reaching the service directly does not know it.
+ *
+ * Refuses, when it is built, a secret shorter than 16 characters: an unset
+ * environment variable must stop the server, not trust an empty header.
+ */
+export declare function gatewaySecret({ secret, header, }: GatewaySecretOptions): GatewayTrust;
+/**
+ * The `trustedGateway` a plugin was given, or a `TypeError` naming the plugin:
+ * without one there is no caller it could read, and a plugin that silently
+ * reads none is a server whose every caller is anonymous.
+ */
+export declare function requireGatewayTrust(options: Partial<GatewayTrustOptions> | undefined, plugin: string): GatewayTrust;
+/**
+ * The caller a trusted gateway put in `extensions`, when it is shaped like
+ * one: an object with a non-empty string `sub`. Anything else names nobody.
+ */
+export declare function principalOf(value: unknown): TokenPrincipal | undefined;
+//# sourceMappingURL=gateway-trust.d.ts.map

package/dist/plugins/gateway-trust.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-trust.d.ts","sourceRoot":"","sources":["../../src/plugins/gateway-trust.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnD,8EAA8E;AAC9E,MAAM,MAAM,YAAY,GAAG;IAC1B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CAC7C,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,YAAY,GAAG,CAC1B,OAAO,EAAE,YAAY,KACjB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC,8EAA8E;AAC9E,MAAM,MAAM,mBAAmB,GAAG;IACjC,cAAc,EAAE,YAAY,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAClC,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,qBAAqB,qBAAqB,CAAC;AAKxD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,EAC7B,MAAM,EACN,MAA8B,GAC9B,EAAE,oBAAoB,GAAG,YAAY,CAYrC;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAClC,OAAO,EAAE,OAAO,CAAC,mBAAmB,CAAC,GAAG,SAAS,EACjD,MAAM,EAAE,MAAM,GACZ,YAAY,CAQd;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,GAAG,SAAS,CAMtE"}

package/dist/plugins/index.d.ts

@@ -1,5 +1,11 @@
+export * from './apply-authenticated';
+export * from './apply-keto-checks';
 export * from './auth';
+export * from './authenticated';
 export * from './extract-jwt';
+export * from './gateway-trust';
+export * from './keto-checker';
 export * from './keto-checks';
+export * from './keto-helpers';
 export * from './ory-auth';
 //# sourceMappingURL=index.d.ts.map

package/dist/plugins/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/plugins/index.ts"],"names":[],"mappings":"AAAA,cAAc,QAAQ,CAAC;AACvB,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/plugins/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,QAAQ,CAAC;AACvB,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC"}

package/dist/plugins/keto-checker.d.ts

@@ -0,0 +1,24 @@
+import { type Ory, type Permission, type Subject } from '@nxgt/ory-sdk';
+/**
+ * The per-request answer cache, and the reason `@check` / `@permission` cost
+ * nothing on top of the access layer that already asks Keto.
+ *
+ * `DataLoader` here does two things: it **batches** distinct questions into
+ * one `POST /relation-tuples/batch/check`, and it **memoises** identical ones
+ * for the life of the request. So a field guarded by `@permission(view)` and a
+ * service that then calls `require<M>Access` — which asks the same question —
+ * pay for one round trip between them.
+ *
+ * A failed batch is not memoised: `DataLoader` clears the keys of a batch that
+ * rejected, so an outage answers `OryUnavailable` to every question it touched
+ * and the next ask goes back to Keto.
+ *
+ * The key is Keto's own notation, `Note:n1#view@idn-7`, so a cache hit is
+ * legible in a log line.
+ */
+export type KetoChecker = (permission: Permission, subject: Subject) => Promise<boolean>;
+export type KetoChecksContext = {
+    ketoChecks?: KetoChecker;
+};
+export declare function createKetoChecks(ory: Ory): KetoChecker;
+//# sourceMappingURL=keto-checker.d.ts.map

package/dist/plugins/keto-checker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keto-checker.d.ts","sourceRoot":"","sources":["../../src/plugins/keto-checker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,GAAG,EAAE,KAAK,UAAU,EAAE,KAAK,OAAO,EAAS,MAAM,eAAe,CAAC;AAG/E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,WAAW,GAAG,CACzB,UAAU,EAAE,UAAU,EACtB,OAAO,EAAE,OAAO,KACZ,OAAO,CAAC,OAAO,CAAC,CAAC;AAEtB,MAAM,MAAM,iBAAiB,GAAG;IAC/B,UAAU,CAAC,EAAE,WAAW,CAAC;CACzB,CAAC;AAEF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,GAAG,GAAG,WAAW,CAUtD"}

package/dist/plugins/keto-checks.d.ts

@@ -1,48 +1,25 @@
-import { type Ory, type Permission, type Subject } from '@nxgt/ory-sdk';
-import { type GraphQLSchema } from 'graphql';
+import type { Ory } from '@nxgt/ory-sdk';
 import type { Plugin } from 'graphql-yoga';
+import type { ReadOptions } from '../directives';
 import type { GraphQLBaseContext } from '../types';
+import { type KetoChecksContext } from './keto-checker';
 import type { OryContext } from './ory-auth';
-/**
- * The per-request answer cache, and the reason `@check` costs nothing on top
- * of the access layer that already asks Keto.
- *
- * `DataLoader` here does two things: it **batches** distinct questions into
- * one `POST /relation-tuples/batch/check`, and it **memoises** identical ones
- * for the life of the request. So a field guarded by `@check(view)` and a
- * service that then calls `require<M>Access` — which asks the same question —
- * pay for one round trip between them.
- *
- * The key is Keto's own notation, `Note:n1#view@idn-7`, so a cache hit is
- * legible in a log line.
- */
-export type KetoChecker = (permission: Permission, subject: Subject) => Promise<boolean>;
-export type KetoChecksContext = {
-    ketoChecks?: KetoChecker;
-};
-export declare function createKetoChecks(ory: Ory): KetoChecker;
-/**
- * Wraps every field carrying `@check` so the permission is answered before its
- * resolver runs.
- *
- * Modelled on `applyGraphqlPolicy` in `@nxgt/security` — same `mapSchema` over
- * `MapperKind.OBJECT_FIELD`, same `fieldConfig.resolve ?? defaultFieldResolver`.
- * Exported on its own because a schema transform is far easier to test than a
- * plugin, and `useKetoChecks` is a three-line wrapper over it.
- */
-export declare function applyKetoChecks(schema: GraphQLSchema): GraphQLSchema;
+/** What `useKetoChecks` and `applyKetoChecks` take besides the `Ory` client. */
+export type KetoChecksOptions = ReadOptions;
 /**
  * Registers the whole thing: the schema transform, and the per-request checker
- * the transform — and the app's own access layer — read off the context.
+ * the transform — and the app's own access layer, through `can` — read off the
+ * context.
  *
  * Goes after `useOryAuth(ory)`, which is what puts `ory.subject` there.
  *
  * `replaceSchema` inside `onSchemaChange` re-enters this hook with the new
- * schema, so transformed schemas are remembered and passed through. Without
- * the guard this loops until the stack gives out.
+ * schema, and with every schema another plugin makes of it. `applyKetoChecks`
+ * returns a schema with no field left to guard as it is, so the replacement settles
+ * instead of looping, alongside `useAuthenticated` whatever their order.
  *
  * `OryUnavailable` is deliberately not caught anywhere here: a Keto outage is
  * a 503 through `createMaskError`, never a denial.
  */
-export declare function useKetoChecks(ory: Ory): Plugin<GraphQLBaseContext & OryContext & KetoChecksContext>;
+export declare function useKetoChecks(ory: Ory, options?: KetoChecksOptions): Plugin<GraphQLBaseContext & OryContext & KetoChecksContext>;
 //# sourceMappingURL=keto-checks.d.ts.map

package/dist/plugins/keto-checks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keto-checks.d.ts","sourceRoot":"","sources":["../../src/plugins/keto-checks.ts"],"names":[],"mappings":"AACA,OAAO,EAEN,KAAK,GAAG,EACR,KAAK,UAAU,EAEf,KAAK,OAAO,EAEZ,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,SAAS,CAAC;AACnE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAO3C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,WAAW,GAAG,CACzB,UAAU,EAAE,UAAU,EACtB,OAAO,EAAE,OAAO,KACZ,OAAO,CAAC,OAAO,CAAC,CAAC;AAEtB,MAAM,MAAM,iBAAiB,GAAG;IAC/B,UAAU,CAAC,EAAE,WAAW,CAAC;CACzB,CAAC;AAEF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,GAAG,GAAG,WAAW,CAUtD;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,aAAa,GAAG,aAAa,CA4CpE;AAmCD;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAC5B,GAAG,EAAE,GAAG,GACN,MAAM,CAAC,kBAAkB,GAAG,UAAU,GAAG,iBAAiB,CAAC,CAc7D"}
+{"version":3,"file":"keto-checks.d.ts","sourceRoot":"","sources":["../../src/plugins/keto-checks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAEnD,OAAO,EAAoB,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,gFAAgF;AAChF,MAAM,MAAM,iBAAiB,GAAG,WAAW,CAAC;AAE5C;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAC5B,GAAG,EAAE,GAAG,EACR,OAAO,GAAE,iBAAsB,GAC7B,MAAM,CAAC,kBAAkB,GAAG,UAAU,GAAG,iBAAiB,CAAC,CAU7D"}

package/dist/plugins/keto-helpers.d.ts

@@ -0,0 +1,38 @@
+import type { TokenPrincipal } from '@nxgt/shared';
+import type { GraphQLBaseContext } from '../types';
+import type { KetoChecksContext } from './keto-checker';
+import type { OryContext } from './ory-auth';
+/**
+ * The context `useOryAuth(ory)` and `useKetoChecks(ory)` build together —
+ * what a resolver of an Ory-native API receives.
+ *
+ *     createYoga<{}, OryGraphQLContext>({ plugins: [useOryAuth(ory), useKetoChecks(ory)] })
+ */
+export type OryGraphQLContext = GraphQLBaseContext & OryContext & KetoChecksContext;
+/** The question `can` asks, in `@permission`'s words. */
+export type CanQuestion = {
+    /** The permit, e.g. `view`. */
+    name: string;
+    /** The Keto namespace, e.g. `Note`. */
+    type: string;
+    /** The object id itself — a value, not a path. */
+    id: string;
+};
+/**
+ * The caller, or an `UNAUTHENTICATED` refusal: a `GraphQLError` answered 401.
+ * An absent caller is not an error to swallow in a resolver that needs one.
+ */
+export declare function requireUser(context: {
+    user?: TokenPrincipal | null;
+}): TokenPrincipal;
+/**
+ * Asks Keto what `@permission` would, from a resolver — through the same
+ * per-request memo, so a question the directive already asked is free.
+ *
+ * `true` or `false` is Keto's answer. Everything else throws: no caller is
+ * `UNAUTHENTICATED`, a missing `useKetoChecks` is a wiring error, and an
+ * outage is `OryUnavailable` (a 503) — never a `false` a caller could take
+ * for a denial.
+ */
+export declare function can(context: OryContext & KetoChecksContext, question: CanQuestion): Promise<boolean>;
+//# sourceMappingURL=keto-helpers.d.ts.map

package/dist/plugins/keto-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keto-helpers.d.ts","sourceRoot":"","sources":["../../src/plugins/keto-helpers.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAEnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,kBAAkB,GACjD,UAAU,GACV,iBAAiB,CAAC;AAEnB,yDAAyD;AACzD,MAAM,MAAM,WAAW,GAAG;IACzB,+BAA+B;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,EAAE,EAAE,MAAM,CAAC;CACX,CAAC;AAEF;;;GAGG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE;IACpC,IAAI,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;CAC7B,GAAG,cAAc,CAKjB;AAED;;;;;;;;GAQG;AACH,wBAAsB,GAAG,CACxB,OAAO,EAAE,UAAU,GAAG,iBAAiB,EACvC,QAAQ,EAAE,WAAW,GACnB,OAAO,CAAC,OAAO,CAAC,CAgBlB"}

package/dist/plugins/ory-auth.d.ts

@@ -1,7 +1,7 @@
-import { type Ory, type OryPrincipal, OryUnavailable } from '@nxgt/ory-sdk';
+import { type Ory, type OryPrincipal, type OryUnavailable } from '@nxgt/ory-sdk';
 import type { PolicyClaims } from '@nxgt/security/policy';
 import type { TokenPrincipal } from '@nxgt/shared';
-import { GraphQLError } from 'graphql';
+import type { GraphQLError } from 'graphql';
 import type { Plugin } from 'graphql-yoga';
 import type { GraphQLBaseContext } from '../types';
 /**
@@ -60,9 +60,9 @@ export declare function resolveOryPrincipal(ory: Ory, headers: Headers): Promise
 /**
  * `useAuth()` for an Ory-native API: resolves the caller through Kratos
  * (session cookie, session token) or Hydra (Bearer, introspected) and puts
- * `user`, `claims`, `token` and `ory` on the context. Wire it exactly where the
- * standalone APIs wire `useAuth()`, ahead of `useGenericAuth` — which then
- * enforces `@authenticated` from `context.user` unchanged.
+ * `user`, `claims`, `token` and `ory` on the context. Wire it ahead of
+ * `useAuthenticated()`, which enforces `@authenticated` from `context.user`
+ * and `context.ory.kind`.
  *
  * The `Ory` instance comes from the app's `createOry()` — one per process —
  * and is the same one the services use for `isAllowed`.

package/dist/plugins/ory-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ory-auth.d.ts","sourceRoot":"","sources":["../../src/plugins/ory-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAEN,KAAK,GAAG,EACR,KAAK,YAAY,EACjB,cAAc,EACd,MAAM,eAAe,CAAC;AAEvB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG;IACxB,GAAG,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IAC1B;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;CACtB,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,YAAY,GAAG,cAAc,CAc7D;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,cAAc,GAAG,YAAY,CAQvE;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACxC,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,OAAO,GACd,OAAO,CAAC,UAAU,GAAG;IAAE,IAAI,CAAC,EAAE,cAAc,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAejE;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,CAAC,kBAAkB,GAAG,UAAU,CAAC,CAM5E"}
+{"version":3,"file":"ory-auth.d.ts","sourceRoot":"","sources":["../../src/plugins/ory-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAEN,KAAK,GAAG,EACR,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,MAAM,eAAe,CAAC;AAEvB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAMnD;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG;IACxB,GAAG,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IAC1B;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;CACtB,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,YAAY,GAAG,cAAc,CAc7D;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,cAAc,GAAG,YAAY,CAEvE;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACxC,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,OAAO,GACd,OAAO,CAAC,UAAU,GAAG;IAAE,IAAI,CAAC,EAAE,cAAc,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAejE;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,CAAC,kBAAkB,GAAG,UAAU,CAAC,CAM5E"}

package/dist/scalars/custom/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../src/scalars/custom/utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAG5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAE5C,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,CAAC,EACpC,MAAM,EAAE,iBAAiB,CAAC,CAAC,EAAE,CAAC,CAAC,EAC/B,EACC,IAAI,EACJ,WAAW,EACX,YAAY,GACZ,EAAE;IACF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;CAClC,2BA2CD"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../src/scalars/custom/utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAG5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAE5C,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,CAAC,EACpC,MAAM,EAAE,iBAAiB,CAAC,CAAC,EAAE,CAAC,CAAC,EAC/B,EACC,IAAI,EACJ,WAAW,EACX,YAAY,GACZ,EAAE;IACF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;CAClC,2BA4CD"}

package/dist/shared.d.ts

@@ -1,2 +1,2 @@
-export declare const SHARED_TYPE_DEFS = "\ntype Query {\n\t_empty: String\n}\ntype Mutation {\n\t_empty: String\n}\ntype Subscription {\n\t_empty: String\n}\n\ndirective @authenticated on FIELD_DEFINITION | OBJECT | INTERFACE | SCALAR | ENUM\n\ndirective @policy(policies: [[String!]!]!) on FIELD_DEFINITION | OBJECT | INTERFACE | SCALAR | ENUM\n\ndirective @shareable on OBJECT | FIELD_DEFINITION\n\ndirective @link(url: String!, import: [String!]) on SCHEMA\n\n";
+export declare const SHARED_TYPE_DEFS = "\ntype Query {\n\t_empty: String\n}\ntype Mutation {\n\t_empty: String\n}\ntype Subscription {\n\t_empty: String\n}\n\n\"\"\"\nA signed-in caller \u2014 of one of the types `type` names, when it names some.\n\"\"\"\ndirective @authenticated(\n\t\"\"\"\n\tThe kinds of caller admitted: \"session\" or \"token\" by default. Any caller\n\twhen omitted.\n\t\"\"\"\n\ttype: [String!]\n) on FIELD_DEFINITION | OBJECT | INTERFACE | SCALAR | ENUM\n\ndirective @policy(policies: [[String!]!]!) on FIELD_DEFINITION | OBJECT | INTERFACE | SCALAR | ENUM\n\ndirective @shareable on OBJECT | FIELD_DEFINITION\n\ndirective @link(url: String!, import: [String!]) on SCHEMA\n\n";
 //# sourceMappingURL=shared.d.ts.map

package/dist/shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../src/shared.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,gBAAgB,2aAmB5B,CAAC"}
+{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../src/shared.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,gBAAgB,ypBAkB5B,CAAC"}

package/dist/utils/errors/create-error.d.ts

@@ -0,0 +1,3 @@
+import { GraphQLError, type GraphQLErrorOptions } from 'graphql';
+export declare function createGraphQLError(message: string, options?: GraphQLErrorOptions): GraphQLError;
+//# sourceMappingURL=create-error.d.ts.map

package/dist/utils/errors/create-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-error.d.ts","sourceRoot":"","sources":["../../../src/utils/errors/create-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,KAAK,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAEjE,wBAAgB,kBAAkB,CACjC,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,mBAAmB,GAC3B,YAAY,CAEd"}

package/dist/utils/errors/denial.d.ts

@@ -0,0 +1,20 @@
+import { ErrorCode } from '@nxgt/shared-exceptions';
+import { GraphQLError } from 'graphql';
+/** The refusals a guard answers, each with its HTTP status. */
+export type DenialCode = ErrorCode.Unauthenticated | ErrorCode.Forbidden | ErrorCode.NotFound;
+/**
+ * A refusal, as the `GraphQLError` a client reads: `extensions.code` and
+ * `extensions.http.status` — `UNAUTHENTICATED` 401, `FORBIDDEN` 403,
+ * `NOT_FOUND` 404 — so any server answers it with its status, with or without
+ * `createMaskError`. What `@permission`, `@authenticated`, `requireUser` and
+ * `can` throw.
+ *
+ * `message` is an i18n key (the shared `errors.*` one by default). It is
+ * translated here with `@nxgt/i18n`'s resources, in the request's language
+ * when one is known; `createMaskError(translate)` and
+ * `createFormatError(translate)` translate it again with yours.
+ */
+export declare function denial(code: DenialCode, message?: string): GraphQLError;
+/** The i18n key of a `denial()`, or `undefined` for any other error. */
+export declare function denialMessageKey(error: unknown): string | undefined;
+//# sourceMappingURL=denial.d.ts.map

package/dist/utils/errors/denial.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"denial.d.ts","sourceRoot":"","sources":["../../../src/utils/errors/denial.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,+DAA+D;AAC/D,MAAM,MAAM,UAAU,GACnB,SAAS,CAAC,eAAe,GACzB,SAAS,CAAC,SAAS,GACnB,SAAS,CAAC,QAAQ,CAAC;AAsBtB;;;;;;;;;;;GAWG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,YAAY,CAOvE;AAED,wEAAwE;AACxE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAInE"}

package/dist/utils/errors/format-error.d.ts

@@ -0,0 +1,12 @@
+import type { ApolloServerOptions } from '@apollo/server';
+import { type LocaleKey, type TranslationContext } from '@nxgt/i18n';
+import type { GraphQLBaseContext } from '../../types';
+/**
+ * Apollo Server's `formatError`, taught this repo's exceptions — the Apollo
+ * counterpart of `createMaskError`. `OryUnavailable` answers
+ * `SERVICE_UNAVAILABLE`, never a denial and never an opaque
+ * `INTERNAL_SERVER_ERROR`; a `denial()` keeps its code, and its message is
+ * translated with `translate`.
+ */
+export declare function createFormatError<K extends LocaleKey, C extends GraphQLBaseContext = GraphQLBaseContext>(translate?: (message: K, context?: TranslationContext) => string, production?: boolean): ApolloServerOptions<C>['formatError'];
+//# sourceMappingURL=format-error.d.ts.map

package/dist/utils/errors/format-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"format-error.d.ts","sourceRoot":"","sources":["../../../src/utils/errors/format-error.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAK1D,OAAO,EACN,KAAK,SAAS,EACd,KAAK,kBAAkB,EAEvB,MAAM,YAAY,CAAC;AAIpB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAItD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAChC,CAAC,SAAS,SAAS,EACnB,CAAC,SAAS,kBAAkB,GAAG,kBAAkB,EAEjD,SAAS,GAAE,CACV,OAAO,EAAE,CAAC,EACV,OAAO,CAAC,EAAE,kBAAkB,KACxB,MAAsB,EAC3B,UAAU,CAAC,EAAE,OAAO,GAClB,mBAAmB,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAgEvC"}

package/dist/utils/errors/index.d.ts

@@ -0,0 +1,6 @@
+export * from './create-error';
+export * from './denial';
+export * from './format-error';
+export * from './mask-error';
+export * from './ory-unavailable';
+//# sourceMappingURL=index.d.ts.map

package/dist/utils/errors/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/utils/errors/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,UAAU,CAAC;AACzB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,mBAAmB,CAAC"}

package/dist/utils/errors/mask-error.d.ts

@@ -0,0 +1,25 @@
+import { type LocaleKey, type TranslationContext } from '@nxgt/i18n';
+import type { MaskError } from 'graphql-yoga';
+type Translate<K extends LocaleKey> = (message: K, context?: TranslationContext) => string;
+/**
+ * Yoga's `maskedErrors.maskError`, taught this repo's exceptions.
+ *
+ * Yoga masks anything that is not a `GraphQLError` as "Unexpected error." —
+ * and `CustomException` extends `Error`, so out of the box a service's
+ * `notFound()` or `forbidden()` reaches the client as an opaque 500. This
+ * turns one into a `GraphQLError` with the translated message, the
+ * exception's `code` in `extensions`, and a matching HTTP status
+ * (`UNAUTHENTICATED` 401, `FORBIDDEN` 403, `NOT_FOUND` 404); a Mongoose error
+ * goes through `castError` first, as `createFormatError` does for Apollo.
+ * `OryUnavailable` (@nxgt/ory-sdk) becomes a 503 `SERVICE_UNAVAILABLE`, never
+ * a denial. A `denial()` — what the directives, `requireUser` and `can` throw
+ * — keeps its code and status, and its message is translated with `translate`. Everything else is masked as Yoga's default masks it: a
+ * `GraphQLError` thrown on purpose — or raised by validation — passes, and one
+ * that only wraps a plain `Error` a resolver threw is replaced by `message`,
+ * so an internal message never reaches the client.
+ *
+ *     createYoga({ maskedErrors: { maskError: createMaskError(translate) } })
+ */
+export declare function createMaskError<K extends LocaleKey>(translate?: Translate<K>): MaskError;
+export {};
+//# sourceMappingURL=mask-error.d.ts.map

package/dist/utils/errors/mask-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mask-error.d.ts","sourceRoot":"","sources":["../../../src/utils/errors/mask-error.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,SAAS,EACd,KAAK,kBAAkB,EAEvB,MAAM,YAAY,CAAC;AAIpB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAI9C,KAAK,SAAS,CAAC,CAAC,SAAS,SAAS,IAAI,CACrC,OAAO,EAAE,CAAC,EACV,OAAO,CAAC,EAAE,kBAAkB,KACxB,MAAM,CAAC;AAEZ;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,SAAS,EAClD,SAAS,GAAE,SAAS,CAAC,CAAC,CAAiB,GACrC,SAAS,CAmCX"}

package/dist/utils/errors/ory-unavailable.d.ts

@@ -0,0 +1,19 @@
+import type { OryUnavailable } from '@nxgt/ory-sdk';
+import { GraphQLError } from 'graphql';
+/**
+ * Whether an error is `@nxgt/ory-sdk`'s `OryUnavailable` — Kratos, Hydra or
+ * Keto could not answer.
+ *
+ * By name and shape as well as by class: an install that resolves two copies
+ * of `@nxgt/ory-sdk` (one under this package, one under the app) throws an
+ * `OryUnavailable` this module's `instanceof` does not recognise, and an
+ * outage that slips past here is masked as a 500 instead of answered as a 503.
+ */
+export declare function isOryUnavailable(error: unknown): error is OryUnavailable;
+/**
+ * A 503 the client can read as one — a real `GraphQLError` so Yoga's masking
+ * leaves it alone, `extensions.http.status` so the transport says 503 too.
+ * Never a denial: an outage must not read as "not signed in" or "not allowed".
+ */
+export declare function serviceUnavailableError(error: OryUnavailable): GraphQLError;
+//# sourceMappingURL=ory-unavailable.d.ts.map

package/dist/utils/errors/ory-unavailable.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ory-unavailable.d.ts","sourceRoot":"","sources":["../../../src/utils/errors/ory-unavailable.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAIxE;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,cAAc,GAAG,YAAY,CAQ3E"}

package/dist/utils/index.d.ts

@@ -1,7 +1,7 @@
 export * from './change-resolvers.utils';
 export * from './codegen.utils';
 export * from './data-loader.utils';
-export * from './errors.utils';
+export * from './errors';
 export * from './publish';
 export * from './sandbox';
 export * from './schema.utils';

package/dist/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,0BAA0B,CAAC;AACzC,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC;AAC1B,cAAc,WAAW,CAAC;AAC1B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,0BAA0B,CAAC;AACzC,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,WAAW,CAAC;AAC1B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC"}

package/dist/utils/ws-context.d.ts

@@ -8,7 +8,7 @@ export interface ResolvedWsUser {
 }
 /**
  * Resolves the authenticated TokenPrincipal for a `graphql-ws` connection - the
- * WS-transport equivalent of the HTTP-path `useAuth()`/`useGenericAuth()`
+ * WS-transport equivalent of the HTTP-path `useOryAuth()` / `useAuth()`
  * plugins. There is no gateway hop for WS connections, so each app performs
  * the OAuth introspection call itself using its own `auth` client.
  *

package/docs/README.md

@@ -0,0 +1,13 @@
+# `@nxgt/shared-graphql` docs
+
+The package's [README](../README.md) is the short version, with one example
+per section. These pages are the long one.
+
+| Page | Read it when |
+| --- | --- |
+| [Migrating to 3.0](./guide/migrating-to-3.md) | you upgrade from 2.x: every break, with the code before and after |
+| [Authentication](./guide/authentication.md) | you wire `useOryAuth`, `useAuth` behind a trusted gateway, or `@authenticated(type:)` |
+| [Permissions](./guide/permissions.md) | you guard a field with `@permission`, or call `requireUser` / `can` |
+| [Errors](./guide/errors.md) | you decide what a client receives: denials, `createMaskError`, `createFormatError`, outages |
+| [Troubleshooting](./troubleshooting.md) | you have an error message in hand |
+| [Roadmap](./roadmap.md) | you want to know what is next, and what shipped in 3.0 |