@nxgt/shared-graphql 2.1.0 → 3.0.0

package/dist/index.js

@@ -3,15 +3,56 @@ import DataLoader3 from "dataloader";
 
 export * from "graphql-subscriptions";
 
-// src/directives/check.ts
+// src/directives/authenticated.ts
 import { getDirective } from "@graphql-tools/utils";
-
-// src/directives/deprecation.ts
-import { logger } from "@nxgt/shared-logging";
-function warnCheckMistake(message) {
-  logger.warn(`${message} — @check still boots with this; the next major refuses it, as @permission does`);
+var AUTHENTICATED_DIRECTIVE_NAME = "authenticated";
+var CALLER_TYPES = ["session", "token"];
+function readAuthenticated(schema, node, where, known) {
+  const [found] = getDirective(schema, node, AUTHENTICATED_DIRECTIVE_NAME) ?? [];
+  if (!found)
+    return null;
+  const types = found.type;
+  if (types === undefined || types === null)
+    return {};
+  if (!Array.isArray(types) || types.length === 0) {
+    throw new TypeError(`@authenticated on ${where}: \`type: []\` admits no caller — name a type, or drop \`type\``);
+  }
+  for (const type of types) {
+    if (!known.includes(type)) {
+      throw new TypeError(`@authenticated on ${where}: unknown type ${JSON.stringify(type)} — known: ${known.join(", ")}`);
+    }
+  }
+  return { types };
 }
-
+function combineRequirements(found, where) {
+  const applying = found.filter((one) => !!one);
+  if (applying.length === 0)
+    return null;
+  let types;
+  for (const { types: these } of applying) {
+    if (!these)
+      continue;
+    types = types ? types.filter((type) => these.includes(type)) : these;
+  }
+  if (types?.length === 0) {
+    throw new TypeError(`@authenticated on ${where}: the field's, its type's and its interfaces' \`type\`s have none in common — no caller could pass`);
+  }
+  return types ? { types } : {};
+}
+// src/directives/federation.ts
+var FEDERATION_DIRECTIVES = `
+directive @external on FIELD_DEFINITION | OBJECT
+directive @requires(fields: FieldSet!) on FIELD_DEFINITION
+directive @provides(fields: FieldSet!) on FIELD_DEFINITION
+directive @key(fields: FieldSet!, resolvable: Boolean = true) repeatable on OBJECT | INTERFACE
+directive @shareable repeatable on OBJECT | FIELD_DEFINITION
+directive @inaccessible on FIELD_DEFINITION | OBJECT | INTERFACE | UNION | ARGUMENT_DEFINITION | SCALAR | ENUM | ENUM_VALUE | INPUT_OBJECT | INPUT_FIELD_DEFINITION
+directive @tag(name: String!) repeatable on FIELD_DEFINITION | INTERFACE | OBJECT | UNION | ARGUMENT_DEFINITION | SCALAR | ENUM | ENUM_VALUE | INPUT_OBJECT | INPUT_FIELD_DEFINITION
+directive @override(from: String!) on FIELD_DEFINITION
+directive @composeDirective(name: String!) repeatable on SCHEMA
+directive @interfaceObject on OBJECT
+directive @authenticated on FIELD_DEFINITION | OBJECT | INTERFACE | SCALAR | ENUM
+`;
 // src/directives/paths.ts
 var PATH = /^(args|parent|source)(\.[A-Za-z0-9_]+)+$/;
 var DEFAULT_ID_PATH = "args.id";
@@ -39,6 +80,8 @@ function objectIds(value) {
   const values = Array.isArray(value) ? value : [value];
   return values.filter((item) => typeof item === "string" && item.length > 0);
 }
+// src/directives/permission.ts
+import { getDirective as getDirective2 } from "@graphql-tools/utils";
 
 // src/directives/scope.ts
 function scopeOf(node, where, options) {
@@ -69,64 +112,15 @@ function assertRequirementShape(permissions, scope) {
   for (const group of permissions) {
     for (const term of group) {
       assertReadablePath(term, where);
-      declaredOrReported(term, argumentNames, scope);
+      assertDeclaredArgument(term, argumentNames, where);
       if (namespaces && !namespaces.includes(term.namespace)) {
         throw new TypeError(`${where}: unknown namespace ${JSON.stringify(term.namespace)} — known: ${namespaces.join(", ")}`);
       }
     }
   }
 }
-function declaredOrReported(term, argumentNames, scope) {
-  if (!scope.lenient) {
-    assertDeclaredArgument(term, argumentNames, scope.where);
-    return;
-  }
-  try {
-    assertDeclaredArgument(term, argumentNames, scope.where);
-  } catch (error) {
-    scope.lenient(error.message);
-  }
-}
 
-// src/directives/check.ts
-var CHECK_DIRECTIVE_NAME = "check";
-function readChecks(schema, node, where, options = {}) {
-  const found = getDirective(schema, node, CHECK_DIRECTIVE_NAME) ?? [];
-  const scope = {
-    ...scopeOf(node, `@check on ${where}`, options),
-    lenient: warnCheckMistake
-  };
-  return found.map((raw) => {
-    const permissions = withDefaultIds(raw.permissions);
-    assertRequirementShape(permissions, scope);
-    return {
-      permissions,
-      onDeny: raw.onDeny ?? "NOT_FOUND",
-      message: raw.message ?? undefined
-    };
-  });
-}
-function withDefaultIds(raw) {
-  if (!Array.isArray(raw))
-    return raw;
-  return raw.map((group) => Array.isArray(group) ? group.map((term) => term && typeof term === "object" ? { ...term, id: term.id ?? DEFAULT_ID_PATH } : term) : group);
-}
-// src/directives/federation.ts
-var FEDERATION_DIRECTIVES = `
-directive @external on FIELD_DEFINITION | OBJECT
-directive @requires(fields: FieldSet!) on FIELD_DEFINITION
-directive @provides(fields: FieldSet!) on FIELD_DEFINITION
-directive @key(fields: FieldSet!, resolvable: Boolean = true) repeatable on OBJECT | INTERFACE
-directive @shareable repeatable on OBJECT | FIELD_DEFINITION
-directive @inaccessible on FIELD_DEFINITION | OBJECT | INTERFACE | UNION | ARGUMENT_DEFINITION | SCALAR | ENUM | ENUM_VALUE | INPUT_OBJECT | INPUT_FIELD_DEFINITION
-directive @tag(name: String!) repeatable on FIELD_DEFINITION | INTERFACE | OBJECT | UNION | ARGUMENT_DEFINITION | SCALAR | ENUM | ENUM_VALUE | INPUT_OBJECT | INPUT_FIELD_DEFINITION
-directive @override(from: String!) on FIELD_DEFINITION
-directive @composeDirective(name: String!) repeatable on SCHEMA
-directive @interfaceObject on OBJECT
-directive @authenticated on FIELD_DEFINITION | OBJECT | INTERFACE | SCALAR | ENUM
-`;
 // src/directives/permission.ts
-import { getDirective as getDirective2 } from "@graphql-tools/utils";
 var PERMISSION_DIRECTIVE_NAME = "permission";
 function readPermissions(schema, node, where, options = {}) {
   if (!isOurs(schema))
@@ -156,109 +150,7 @@ function isOurs(schema) {
   const names = declared?.args.map((arg) => arg.name) ?? [];
   return names.includes("name") && names.includes("type");
 }
-// src/directives/requirements.ts
-function readRequirements(schema, node, where, options = {}) {
-  const queues = {
-    [CHECK_DIRECTIVE_NAME]: readChecks(schema, node, where, options),
-    [PERMISSION_DIRECTIVE_NAME]: readPermissions(schema, node, where, options)
-  };
-  const ordered = [];
-  for (const directive of directivesOf(node)) {
-    const next = queues[directive.name.value]?.shift();
-    if (next)
-      ordered.push(next);
-  }
-  return [
-    ...ordered,
-    ...queues[CHECK_DIRECTIVE_NAME] ?? [],
-    ...queues[PERMISSION_DIRECTIVE_NAME] ?? []
-  ];
-}
-function directivesOf(node) {
-  const field = node;
-  return field.astNode?.directives ?? field.directives ?? [];
-}
 // src/directives/sdl.ts
-var CHECK_DIRECTIVE_SDL = `"""
-One question, with the object left as a path instead of a value.
-"""
-input CheckPermission {
-	"""
-	The Keto namespace, e.g. "Note" — from the stack's OPL document.
-	"""
-	namespace: String!
-
-	"""
-	The permit asked of it, e.g. "view". A plain relation works too; Keto
-	answers \`false\`, not an error, for a name it does not know.
-	"""
-	permit: String!
-
-	"""
-	Where the object id is read: \`args.<path>\`, or \`parent.<path>\` /
-	\`source.<path>\` (the same root under two names), dotted paths allowed. A value that turns out to be a LIST requires the permit on every
-	element — that is what a mutation taking \`ids: [ID!]!\` means.
-	"""
-	id: String = "args.id"
-}
-
-"""
-What a denial looks like from outside.
-"""
-enum CheckDenial {
-	"""
-	The same answer as for an id that never existed, so ids cannot be probed.
-	The default, and the one to keep unless the caller already knows the object
-	is there.
-	"""
-	NOT_FOUND
-
-	"""
-	For a second check on an object the caller can already see: a viewer asked
-	to edit already knows it exists, and "you may not change it" is honest.
-	"""
-	FORBIDDEN
-}
-
-"""
-Deprecated: write \`@permission(name:, type:)\` in a new schema — one Keto
-question per directive, repeated for AND, with OR kept in the Keto model. This
-form keeps working and is evaluated in declaration order with @permission.
-
-The permission a field requires, in disjunctive normal form: the OUTER list is
-OR, the INNER list is AND. \`[[A, B], [C]]\` reads "(A and B) or C" — the same
-shape \`@policy(policies: [["ADMIN"]])\` uses.
-
-Repeatable, and evaluated in declaration order, each with its own \`onDeny\`.
-That is how the 404-then-403 ladder is written:
-
-    updateNote(id: ID!, input: UpdateNoteInput!): Note!
-      @check(permissions: [[{ namespace: "Note", permit: "view" }]])
-      @check(permissions: [[{ namespace: "Note", permit: "edit" }]], onDeny: FORBIDDEN)
-
-NOT for a field that answers a LIST the caller is entitled to. "Which notes may
-I see" is not a check, it is a Keto query folded into the database filter
-before the read. A directive there would have to fetch everything and filter
-after, which makes \`totalCount\` and the cursors lie.
-"""
-directive @check(
-	permissions: [[CheckPermission!]!]!
-	onDeny: CheckDenial! = NOT_FOUND
-
-	"""
-	The i18n key the denial carries, e.g. "notes.errors.not-found". Defaults to
-	\`errors.not-found\` / \`errors.insufficient-permissions\`, the shared keys.
-
-	Set it whenever the API's own service layer answers the same refusal with a
-	domain message. Two layers guard these fields — the directive, and the
-	\`require<M>Access\` the service calls — and if they word the same 404
-	differently, the wording tells a caller WHICH one refused: a generic message
-	means "you may not", a domain one means "it is gone". That is precisely the
-	distinction NOT_FOUND exists to hide.
-	"""
-	message: String
-) repeatable on FIELD_DEFINITION
-`;
 var PERMISSION_DIRECTIVE_SDL = `"""
 What a refused @permission looks like from outside.
 """
@@ -321,222 +213,442 @@ directive @permission(
 	message: String
 ) repeatable on FIELD_DEFINITION
 `;
-var KETO_DIRECTIVES_SDL = `${CHECK_DIRECTIVE_SDL}
-${PERMISSION_DIRECTIVE_SDL}`;
+var KETO_DIRECTIVES_SDL = PERMISSION_DIRECTIVE_SDL;
+var AUTHENTICATED_DIRECTIVE_SDL = `"""
+A signed-in caller — of one of the types \`type\` names, when it names some.
+"""
+directive @authenticated(
+	"""
+	The kinds of caller admitted: "session" or "token" by default. Any caller
+	when omitted.
+	"""
+	type: [String!]
+) on FIELD_DEFINITION | OBJECT | INTERFACE | SCALAR | ENUM
+`;
 // src/integrations/hono.ts
 import { Hono } from "hono";
 import { contextStorage } from "hono/context-storage";
 import { createMiddleware } from "hono/factory";
 import { languageDetector } from "hono/language";
 
-// src/utils/change-resolvers.utils.ts
+// src/utils/sandbox.ts
+import { html } from "hono/html";
+var renderSandbox = ({
+  port = 8080,
+  hostname = "localhost",
+  graphqlEndpoint = "graphql",
+  protocol = "http",
+  title = "Sandbox Explorer"
+}) => html`
+<title>${title}</title>
+<div id="sandbox" style="position:absolute;top:0;right:0;bottom:0;left:0"></div>
+<script src="https://embeddable-sandbox.cdn.apollographql.com/_latest/embeddable-sandbox.umd.production.min.js"></script>
+<script>
+    new window.EmbeddedSandbox({
+        target: "#sandbox",
+        // Pass through your server href if you are embedding on an endpoint.
+        // Otherwise, you can pass whatever endpoint you want Sandbox to start up with here.
+        initialEndpoint: "${protocol}://${hostname}:${port}/${graphqlEndpoint}",
+        handleRequest: (endpointUrl, options) => {
+            return fetch(endpointUrl, {
+                ...options,
+                headers: {
+                    ...options.headers
+                },
+            })
+        },
+        hideCookieToggle: true,
+    });
+    // advanced options: https://www.apollographql.com/docs/studio/explorer/sandbox#embedding-sandbox
+</script>
+
+`;
+
+// src/integrations/hono.ts
+function sandboxExplorer(options) {
+  return createMiddleware(async (ctx) => {
+    return ctx.html(renderSandbox(options));
+  });
+}
+function honoYoga(yoga) {
+  return createMiddleware(async (ctx) => {
+    const response = await yoga.fetch(ctx.req.raw);
+    return response;
+  });
+}
+function createYogaHono(yoga, options) {
+  const app = new Hono;
+  app.use(contextStorage());
+  app.use(languageDetector({
+    order: ["header"],
+    supportedLanguages: ["en", "fr"],
+    fallbackLanguage: "en",
+    caches: []
+  }));
+  app.get("/health", (ctx) => {
+    return ctx.json({ status: "ok" }, 200);
+  });
+  app.get(options?.sandbox?.endpoint || "sandbox", sandboxExplorer(options?.sandbox || {}));
+  app.use(yoga.graphqlEndpoint, honoYoga(yoga));
+  return app;
+}
+// src/plugins/apply-authenticated.ts
+import { MapperKind, mapSchema } from "@graphql-tools/utils";
+import { ErrorCode as ErrorCode2 } from "@nxgt/shared-exceptions";
 import {
-  AUDIT_EVENT,
-  CommitType
-} from "@nxgt/shared-mongo";
-import { withFilter } from "graphql-subscriptions";
-function createChangeResolvers(config) {
-  const { entity, collection, service, pubsub } = config;
-  const resolvePubSub = () => typeof pubsub === "function" ? pubsub() : pubsub;
+  getNamedType,
+  isEnumType,
+  isObjectType,
+  isScalarType
+} from "graphql";
+
+// src/utils/errors/denial.ts
+import { translate } from "@nxgt/i18n";
+import { ErrorCode } from "@nxgt/shared-exceptions";
+import { GraphQLError } from "graphql";
+var STATUS = {
+  [ErrorCode.Unauthenticated]: 401,
+  [ErrorCode.Forbidden]: 403,
+  [ErrorCode.NotFound]: 404
+};
+var DEFAULT_MESSAGE = {
+  [ErrorCode.Unauthenticated]: "errors.unauthenticated",
+  [ErrorCode.Forbidden]: "errors.insufficient-permissions",
+  [ErrorCode.NotFound]: "errors.not-found"
+};
+var MESSAGE_KEY = Symbol.for("@nxgt/shared-graphql/denial-message");
+function denial(code, message) {
+  const key = message ?? DEFAULT_MESSAGE[code];
+  const error = new GraphQLError(translate(key), {
+    extensions: { code, http: { status: STATUS[code] } }
+  });
+  Object.defineProperty(error, MESSAGE_KEY, { value: key });
+  return error;
+}
+function denialMessageKey(error) {
+  if (!error || typeof error !== "object")
+    return;
+  const key = error[MESSAGE_KEY];
+  return typeof key === "string" ? key : undefined;
+}
+
+// src/plugins/field-guard.ts
+import {
+  defaultFieldResolver
+} from "graphql";
+var GUARDS = "@nxgt/shared-graphql:guards";
+function intactGuards(config) {
+  const record = config.extensions?.[GUARDS];
+  if (!record || record.wrapped.resolve !== config.resolve)
+    return;
+  if (record.wrapped.subscribe !== config.subscribe)
+    return;
+  return record;
+}
+function isGuarded(config, mark) {
+  return !!intactGuards(config)?.guards.some((guard) => guard.mark === mark);
+}
+function guardField(config, guard) {
+  const previous = intactGuards(config);
+  const base = previous ? { resolve: previous.resolve, subscribe: previous.subscribe } : {
+    resolve: config.resolve ?? defaultFieldResolver,
+    subscribe: config.subscribe
+  };
+  const guards = [...previous?.guards ?? [], guard].sort((a, b) => a.rank - b.rank);
+  const wrapped = {
+    resolve: checked(guards, base.resolve),
+    subscribe: base.subscribe && checked(guards.filter((one) => one.onSubscribe), base.subscribe)
+  };
   return {
-    Query: {
-      [`${entity}Changes`]: async (_parent, args, context) => context.services.audit.findChangesPaginatedByCollection(collection, args),
-      [`${entity}ChangesById`]: async (_parent, args, context) => context.services.audit.findChangesPaginatedByCollectionAndOid(args.id, collection, args)
+    ...config,
+    extensions: {
+      ...config.extensions,
+      [GUARDS]: { guards, ...base, wrapped }
     },
-    Subscription: {
-      [`${entity}Changed`]: {
-        resolve: async (payload, _args, context) => ({
-          id: context.services.audit.extractId(payload),
-          data: payload.type !== CommitType.TERMINAL ? await context.services[service].findById(payload.state._id) : null,
-          type: payload.type
-        }),
-        subscribe: withFilter(() => resolvePubSub().subscribe(AUDIT_EVENT), (payload, _variables, context) => context ? context.services.audit.matches(payload, { collection }) : false)
+    resolve: wrapped.resolve,
+    subscribe: wrapped.subscribe
+  };
+}
+function checked(guards, next) {
+  return async (source, args, context, info) => {
+    for (const { check } of guards)
+      await check(source, args, context);
+    return next(source, args, context, info);
+  };
+}
+
+// src/plugins/apply-authenticated.ts
+var MARK = "@nxgt/shared-graphql:authenticated";
+function applyAuthenticated(schema, options = {}) {
+  const known = options.types ?? CALLER_TYPES;
+  let guardedNow = 0;
+  const mapped = mapSchema(schema, {
+    [MapperKind.OBJECT_FIELD]: (fieldConfig, fieldName, typeName) => {
+      const where = `${typeName}.${fieldName}`;
+      const requirement = requirementOf(schema, fieldConfig, where, known);
+      if (!requirement || isGuarded(fieldConfig, MARK))
+        return fieldConfig;
+      guardedNow += 1;
+      return guarded(fieldConfig, requirement);
+    }
+  });
+  return guardedNow > 0 ? mapped : schema;
+}
+function requirementOf(schema, fieldConfig, where, known) {
+  const [typeName = "", fieldName = ""] = where.split(".");
+  const type = schema.getType(typeName);
+  const interfaces = isObjectType(type) ? type.getInterfaces() : [];
+  const read = (node, at) => readAuthenticated(schema, node, at, known);
+  return combineRequirements([
+    read(fieldConfig, where),
+    type ? read(type, typeName) : null,
+    ...interfaces.flatMap((iface) => {
+      const field = iface.getFields()[fieldName];
+      return [
+        read(iface, iface.name),
+        field ? read(field, `${iface.name}.${fieldName}`) : null
+      ];
+    }),
+    leafRequirement(schema, fieldConfig, read)
+  ], where);
+}
+function leafRequirement(schema, fieldConfig, read) {
+  const leaf = schema.getType(getNamedType(fieldConfig.type).name);
+  if (!leaf || !(isScalarType(leaf) || isEnumType(leaf)))
+    return null;
+  return read(leaf, leaf.name);
+}
+function guarded(fieldConfig, { types }) {
+  return guardField(fieldConfig, {
+    mark: MARK,
+    rank: 0,
+    onSubscribe: true,
+    check: (_source, _args, context) => {
+      const ctx = context ?? {};
+      if (!ctx.user)
+        throw denial(ErrorCode2.Unauthenticated);
+      if (types && !types.includes(callerTypeOf(ctx) ?? "")) {
+        throw denial(ErrorCode2.Forbidden);
       }
     }
-  };
+  });
 }
-// src/utils/codegen.utils.ts
-var SCALARS_MAPPING = {
-  ID: "any",
-  DateTime: "any",
-  Date: "any",
-  Any: "any",
-  BigInt: "number",
-  EmailAddress: "string",
-  GeoJSON: "any",
-  HSL: "string",
-  HSLA: "string",
-  HexColorCode: "string",
-  Hexadecimal: "string",
-  IBAN: "string",
-  IP: "string",
-  Time: "string",
-  LocalTime: "string",
-  UUID: "string",
-  PositiveInt: "number",
-  NegativeInt: "number",
-  NonPositiveInt: "number",
-  NonNegativeInt: "number",
-  PositiveFloat: "number",
-  NegativeFloat: "number",
-  NonPositiveFloat: "number",
-  NonNegativeFloat: "number",
-  NonEmptyString: "string",
-  PostalCode: "string",
-  RGB: "string",
-  RGBA: "string",
-  SESSN: "string",
-  Timestamp: "string",
-  URL: "string",
-  USCurrency: "string",
-  UTCOffset: "string",
-  Long: "number",
-  Short: "number",
-  Byte: "number",
-  BigDecimal: "string",
-  BigInteger: "string",
-  Char: "string",
-  Locale: "string",
-  CountryCode: "string",
-  CountryName: "string",
-  AccountNumber: "string",
-  CurrencyCode: "string",
-  Duration: "string",
-  Url: "string",
-  JSONObject: "Record<string, any>",
-  JSON: "any",
-  Void: "void",
-  ObjectID: "any",
-  Upload: "File | Blob",
-  Email: "string",
-  Port: "number",
-  IPv4: "string",
-  IPv6: "string",
-  MAC: "string",
-  Password: "string",
-  PhoneNumber: "string",
-  ZIPCode: "string",
-  SSN: "string",
-  GUID: "string",
-  ISBN: "string",
-  Latitude: "number",
-  Longitude: "number",
-  JWT: "string"
-};
-// src/utils/data-loader.utils.ts
-import { cast } from "@nxgt/shared/helpers";
-import {
-  paginateList
-} from "@nxgt/shared-mongo";
-import DataLoader from "dataloader";
-import { isArray } from "lodash";
-function createDataLoader(batchLoadFn, options) {
-  return new DataLoader(batchLoadFn, options);
-}
-function createConnectionListDataLoader(path, model, options) {
-  return createDataLoader(async (docs) => {
-    const data = await model.find({
-      ...options.filter ?? {},
-      _id: docs.flatMap((doc) => {
-        const ids = doc[path] ?? [];
-        return isArray(ids) ? cast(ids.filter((item) => !!item && !["undefined", "null"].includes(item?.toString()))) : [];
-      })
-    }).exec();
-    return cast(docs.map((doc) => model.paginateList(data.filter((child) => cast(doc[path] ?? []).map((item) => item.toString()).includes(child._id.toString())), options)));
-  });
+function callerTypeOf(ctx) {
+  return ctx.ory?.kind ?? ctx.user?.tokenType;
 }
-function createChildrenConnectionDataLoader(path, model, options) {
-  return createDataLoader(async (docs) => {
-    const filter = {};
-    filter[path] = docs.map((doc) => doc._id);
-    const data = await model.find(filter).exec();
-    return cast(docs.map((doc) => paginateList(data.filter((child) => doc._id?.toString() === child[path]?.toString()), options)));
-  });
+// src/plugins/apply-keto-checks.ts
+import { MapperKind as MapperKind2, mapSchema as mapSchema2 } from "@graphql-tools/utils";
+import { evaluateRequirement } from "@nxgt/ory-sdk";
+import { ErrorCode as ErrorCode3 } from "@nxgt/shared-exceptions";
+
+// src/directives/removed-check.ts
+import { getDirective as getDirective3 } from "@graphql-tools/utils";
+function refuseRemovedCheck(schema, node, where) {
+  const declared = schema.getDirective("check");
+  if (!declared?.args.some((arg) => arg.name === "permissions"))
+    return;
+  if (!getDirective3(schema, node, "check")?.length)
+    return;
+  throw new TypeError(`@check on ${where}: @check was removed in @nxgt/shared-graphql 3.0 — write one @permission(name: "<permit>", type: "<namespace>") per term, and move an OR into the Keto model`);
 }
-function createSimpleListDataLoader(path, model, options) {
-  return createDataLoader(async (docs) => {
-    const filter = options?.filter ?? {};
-    const ids = docs.flatMap((doc) => {
-      const ids = doc[path] ?? [];
-      return isArray(ids) ? cast(ids) : [];
-    });
-    filter._id = ids;
-    const query = model.find(filter);
-    const data = await query.exec();
-    return cast(docs.map((doc) => {
-      const result = data.filter((child) => cast(doc[path] ?? []).map((item) => item.toString()).includes(child._id.toString()));
-      if (options?.skip && options?.limit) {
-        return result.slice(options.skip, options.skip + options.limit);
-      }
-      if (options?.limit) {
-        return result.slice(0, options.limit);
-      }
-      if (options?.skip) {
-        return result.slice(options.skip);
+
+// src/plugins/apply-keto-checks.ts
+var MARK2 = "@nxgt/shared-graphql:keto-checks";
+function applyKetoChecks(schema, options = {}) {
+  let guardedNow = 0;
+  const mapped = mapSchema2(schema, {
+    [MapperKind2.INTERFACE_FIELD]: (fieldConfig, fieldName, typeName) => {
+      refuseOnInterface(schema, fieldConfig, `${typeName}.${fieldName}`);
+      return fieldConfig;
+    },
+    [MapperKind2.OBJECT_FIELD]: (fieldConfig, fieldName, typeName) => {
+      const where = `${typeName}.${fieldName}`;
+      refuseRemovedCheck(schema, fieldConfig, where);
+      const requirements = readPermissions(schema, fieldConfig, where, options);
+      if (requirements.length === 0 || isGuarded(fieldConfig, MARK2)) {
+        return fieldConfig;
       }
-      return result;
-    }));
+      guardedNow += 1;
+      return guarded2(fieldConfig, requirements, where);
+    }
   });
+  return guardedNow > 0 ? mapped : schema;
 }
-function createChildrenListDataLoader(path, model, options) {
-  return createDataLoader(async (docs) => {
-    const filter = options?.filter ?? {};
-    const key = path;
-    filter[key] = docs.map((doc) => doc._id);
-    const query = model.find(filter);
-    const data = await query.exec();
-    return cast(docs.map((doc) => {
-      const result = data.filter((child) => child[path]?.toString() === doc._id.toString());
-      if (options?.skip && options?.limit) {
-        return result.slice(options.skip, options.skip + options.limit);
-      }
-      if (options?.limit) {
-        return result.slice(0, options.limit);
+function refuseOnInterface(schema, fieldConfig, where) {
+  refuseRemovedCheck(schema, fieldConfig, where);
+  if (readPermissions(schema, fieldConfig, where).length > 0) {
+    throw new TypeError(`${where}: @permission on an interface field guards nothing — no resolver runs there. Put it on each implementing type's field`);
+  }
+}
+function guarded2(fieldConfig, requirements, where) {
+  return guardField(fieldConfig, {
+    mark: MARK2,
+    rank: 1,
+    onSubscribe: requirements.every(({ permissions }) => permissions.every((group) => group.every((term) => term.id.startsWith("args.")))),
+    check: async (source, args, context) => {
+      const ctx = context;
+      const subject = ctx.ory?.subject;
+      if (!subject)
+        throw denial(ErrorCode3.Unauthenticated);
+      const check = ctx.ketoChecks;
+      if (!check) {
+        throw new Error(`${where}: no checker on the context — useKetoChecks(ory) is not registered`);
       }
-      if (options?.skip) {
-        return result.slice(options.skip);
+      for (const { permissions, onDeny, message } of requirements) {
+        const allowed = await evaluateRequirement(permissions, (term) => objectsOf(term, source, args, where), check, subject);
+        if (!allowed)
+          throw refusal(onDeny, message);
       }
-      return result;
-    }));
+    }
   });
 }
-function createSingleChildDataLoader(path, model) {
-  return createDataLoader(async (docs) => {
-    const data = await model.find({
-      _id: docs.map((doc) => cast(doc[path])).filter((item) => !!item && !["undefined", "null"].includes(item?.toString()))
-    }).exec();
-    const map = new Map(data.map((doc) => [doc.id, doc]));
-    return docs.map((doc) => map.get(doc[path]?.toString() ?? "") ?? null);
-  });
+function objectsOf(term, source, args, where) {
+  const ids = objectIds(readPath(term.id, source, args));
+  if (ids.length === 0) {
+    throw new Error(`${where}: "${term.id}" resolved no object id`);
+  }
+  return ids;
 }
-function createEntitiesReferenceLoader(model) {
-  return createDataLoader(async (ids) => {
-    const docs = await model.find({
-      _id: ids.filter((item) => !!item && !["undefined", "null"].includes(item?.toString()))
-    }).exec();
-    const map = new Map(docs.map((doc) => [doc.id, doc]));
-    return ids.map((id) => map.get(id) ?? null);
+function refusal(onDeny, message) {
+  return denial(onDeny === "FORBIDDEN" ? ErrorCode3.Forbidden : ErrorCode3.NotFound, message);
+}
+// src/plugins/gateway-trust.ts
+var GATEWAY_SECRET_HEADER = "x-gateway-secret";
+var MIN_SECRET_LENGTH = 16;
+function gatewaySecret({
+  secret,
+  header = GATEWAY_SECRET_HEADER
+}) {
+  if (typeof secret !== "string" || secret.length < MIN_SECRET_LENGTH) {
+    throw new TypeError(`gatewaySecret(): \`secret\` must be a string of at least ${MIN_SECRET_LENGTH} characters — is its environment variable set?`);
+  }
+  const expected = new TextEncoder().encode(secret);
+  return (headers) => {
+    const sent = headers.get(header);
+    if (typeof sent !== "string")
+      return false;
+    return constantTimeEqual(new TextEncoder().encode(sent), expected);
+  };
+}
+function requireGatewayTrust(options, plugin) {
+  const trust = options?.trustedGateway;
+  if (typeof trust !== "function") {
+    throw new TypeError(`${plugin}: name the gateway allowed to set the caller — ${plugin.replace("()", "")}({ trustedGateway: gatewaySecret({ secret }) }). The request's extensions are written by the client; an API that resolves its own callers uses useOryAuth(ory)`);
+  }
+  return trust;
+}
+function principalOf(value) {
+  if (!value || typeof value !== "object")
+    return;
+  const sub = value.sub;
+  return typeof sub === "string" && sub.length > 0 ? value : undefined;
+}
+function constantTimeEqual(sent, expected) {
+  let difference = sent.length ^ expected.length;
+  for (let index = 0;index < expected.length; index++) {
+    difference |= (sent[index] ?? 0) ^ (expected[index] ?? 0);
+  }
+  return difference === 0;
+}
+
+// src/plugins/auth.ts
+function useAuth(options) {
+  const trusted = requireGatewayTrust(options, "useAuth()");
+  return {
+    onContextBuilding: async ({ context, extendContext }) => {
+      const headers = context.request?.headers;
+      if (typeof headers?.get !== "function")
+        return;
+      if (!await trusted(headers))
+        return;
+      const user = principalOf(context.params?.extensions?.user);
+      if (!user)
+        return;
+      const token = context.params.extensions?.token;
+      extendContext({
+        user,
+        token: typeof token === "string" ? token : undefined
+      });
+    }
+  };
+}
+// src/plugins/authenticated.ts
+function useAuthenticated(options = {}) {
+  return {
+    onSchemaChange: ({ schema, replaceSchema }) => {
+      const next = applyAuthenticated(schema, options);
+      if (next !== schema)
+        replaceSchema(next);
+    }
+  };
+}
+// src/plugins/extract-jwt.ts
+function extractJwtPlugin(options) {
+  const trusted = requireGatewayTrust(options, "extractJwtPlugin()");
+  return {
+    async requestDidStart({ request, contextValue }) {
+      const headers = request.http?.headers;
+      if (!headers || !await trusted(headers))
+        return;
+      const payload = principalOf(request.extensions?.payload);
+      if (payload)
+        contextValue.jwt = { payload };
+    }
+  };
+}
+// src/plugins/keto-checker.ts
+import { tuple } from "@nxgt/ory-sdk";
+import DataLoader from "dataloader";
+function createKetoChecks(ory) {
+  const loader = new DataLoader((questions) => ory.checkMany([...questions]), {
+    cacheKeyFn: ({ permission, subject }) => tuple(permission, subject)
   });
+  return (permission, subject) => loader.load({ permission, subject });
 }
-// src/utils/errors/create-error.ts
-import { GraphQLError } from "graphql";
-function createGraphQLError(message, options) {
-  return new GraphQLError(message, options);
+// src/plugins/keto-checks.ts
+function useKetoChecks(ory, options = {}) {
+  return {
+    onSchemaChange: ({ schema, replaceSchema }) => {
+      const next = applyKetoChecks(schema, options);
+      if (next !== schema)
+        replaceSchema(next);
+    },
+    onContextBuilding: ({ extendContext }) => {
+      extendContext({ ketoChecks: createKetoChecks(ory) });
+    }
+  };
 }
-// src/utils/errors/format-error.ts
-import {
-  ApolloServerErrorCode,
-  unwrapResolverError
-} from "@apollo/server/errors";
+// src/plugins/keto-helpers.ts
+import { ErrorCode as ErrorCode4 } from "@nxgt/shared-exceptions";
+function requireUser(context) {
+  if (!context.user) {
+    throw denial(ErrorCode4.Unauthenticated);
+  }
+  return context.user;
+}
+async function can(context, question) {
+  const subject = context.ory?.subject;
+  if (!subject) {
+    throw denial(ErrorCode4.Unauthenticated);
+  }
+  if (!context.ketoChecks) {
+    throw new Error("can(): no checker on the context — useKetoChecks(ory) is not registered");
+  }
+  const permission = {
+    namespace: question.type,
+    object: question.id,
+    relation: question.name
+  };
+  return context.ketoChecks(permission, subject);
+}
+// src/plugins/ory-auth.ts
 import {
-  translate as translateBase
-} from "@nxgt/i18n";
-import { CustomException, ErrorCode as ErrorCode2 } from "@nxgt/shared-exceptions";
-import { MONGO_UTILS, mongoose } from "@nxgt/shared-mongo";
-import { kebabCase } from "lodash";
+  bearerOf
+} from "@nxgt/ory-sdk";
+import { claimsFromOryPrincipal } from "@nxgt/security/integrations/ory";
 
 // src/utils/errors/ory-unavailable.ts
-import { ErrorCode } from "@nxgt/shared-exceptions";
+import { ErrorCode as ErrorCode5 } from "@nxgt/shared-exceptions";
 import { GraphQLError as GraphQLError2 } from "graphql";
 function isOryUnavailable(error) {
   if (!(error instanceof Error))
@@ -547,598 +659,192 @@ function isOryUnavailable(error) {
 function serviceUnavailableError(error) {
   return new GraphQLError2(`ory: ${error.service} is unavailable`, {
     extensions: {
-      code: ErrorCode.ServiceUnavailable,
+      code: ErrorCode5.ServiceUnavailable,
       http: { status: 503 },
       debugMessage: error.message
     }
   });
 }
 
-// src/utils/errors/format-error.ts
-function createFormatError(translate = translateBase, production) {
-  return (formattedError, graphQLError) => {
-    if (production && formattedError.extensions?.stacktrace) {
-      formattedError.extensions.stacktrace = undefined;
-    }
-    const error = unwrapResolverError(graphQLError);
-    if (isOryUnavailable(error)) {
-      const unavailable = serviceUnavailableError(error);
-      return {
-        ...formattedError,
-        message: unavailable.message,
-        extensions: { ...formattedError.extensions, ...unavailable.extensions }
-      };
-    }
-    if (error instanceof CustomException || error instanceof mongoose.MongooseError) {
-      const exception = error instanceof mongoose.MongooseError ? MONGO_UTILS.castError(error) : error;
-      return {
-        ...formattedError,
-        message: exception.errorCode === ErrorCode2.ValidationError ? exception.message : translate(exception.message, exception.options),
-        extensions: {
-          ...formattedError.extensions,
-          code: exception.errorCode,
-          debugMessage: exception.debugMessage
-        }
-      };
-    }
-    if ([
-      ApolloServerErrorCode.GRAPHQL_VALIDATION_FAILED,
-      ApolloServerErrorCode.BAD_REQUEST,
-      ApolloServerErrorCode.BAD_USER_INPUT,
-      ApolloServerErrorCode.GRAPHQL_PARSE_FAILED,
-      ApolloServerErrorCode.OPERATION_RESOLUTION_FAILURE,
-      ApolloServerErrorCode.PERSISTED_QUERY_NOT_FOUND,
-      ApolloServerErrorCode.PERSISTED_QUERY_NOT_SUPPORTED
-    ].includes(formattedError.extensions?.code)) {
-      return {
-        ...formattedError,
-        message: translate(`errors.${kebabCase(formattedError.extensions?.code)}`, {}),
-        extensions: {
-          ...formattedError.extensions,
-          debugMessage: formattedError.message
-        }
-      };
-    }
-    return formattedError;
-  };
-}
-// src/utils/errors/mask-error.ts
-import {
-  translate as translateBase2
-} from "@nxgt/i18n";
-import { CustomException as CustomException2, ErrorCode as ErrorCode3 } from "@nxgt/shared-exceptions";
-import { MONGO_UTILS as MONGO_UTILS2, mongoose as mongoose2 } from "@nxgt/shared-mongo";
-import { GraphQLError as GraphQLError3 } from "graphql";
-function createMaskError(translate = translateBase2) {
-  return (error, message, isDev) => {
-    const original = error instanceof GraphQLError3 && error.originalError ? error.originalError : error;
-    if (isOryUnavailable(original))
-      return serviceUnavailableError(original);
-    if (original instanceof CustomException2 || original instanceof mongoose2.MongooseError) {
-      return exceptionError(original, translate);
-    }
-    if (isOriginalGraphQLError(error))
-      return error;
-    return new GraphQLError3(message, {
-      ...locationOf(error),
-      extensions: isDev ? {
-        code: ErrorCode3.InternalServerError,
-        debugMessage: String(original)
-      } : { code: ErrorCode3.InternalServerError }
-    });
+// src/plugins/ory-auth.ts
+function toPrincipal(ory) {
+  const email = ory.identity?.email;
+  return {
+    sub: ory.subject,
+    uid: ory.subject,
+    name: email ?? ory.clientId ?? ory.subject,
+    username: email,
+    clientId: ory.clientId,
+    scope: ory.scopes.join(" ") || undefined,
+    tokenType: ory.kind,
+    exp: ory.expiresAt ? Math.floor(ory.expiresAt.getTime() / 1000) : undefined,
+    authorities: [],
+    roles: []
   };
 }
-function exceptionError(original, translate) {
-  const exception = original instanceof mongoose2.MongooseError ? MONGO_UTILS2.castError(original) : original;
-  const status = exception.code;
-  return new GraphQLError3(exception.errorCode === ErrorCode3.ValidationError ? exception.message : translate(exception.message, exception.options), {
-    extensions: {
-      code: exception.errorCode,
-      ...status ? { http: { status } } : {},
-      ...exception.debugMessage ? { debugMessage: exception.debugMessage } : {}
-    }
-  });
+function oryUnavailableError(error) {
+  return serviceUnavailableError(error);
 }
-function isOriginalGraphQLError(error) {
-  if (!(error instanceof GraphQLError3))
-    return false;
-  return error.originalError == null ? true : isOriginalGraphQLError(error.originalError);
+async function resolveOryPrincipal(ory, headers) {
+  let principal;
+  try {
+    principal = await ory.resolve(headers);
+  } catch (error) {
+    if (isOryUnavailable(error))
+      throw oryUnavailableError(error);
+    throw error;
+  }
+  return {
+    ory: principal,
+    user: principal ? toPrincipal(principal) : undefined,
+    claims: principal ? claimsFromOryPrincipal(principal) : undefined,
+    token: bearerOf(headers) ?? undefined
+  };
 }
-function locationOf(error) {
-  if (!(error instanceof GraphQLError3))
-    return {};
+function useOryAuth(ory) {
   return {
-    nodes: error.nodes,
-    source: error.source,
-    positions: error.positions,
-    path: error.path
+    onContextBuilding: async ({ context, extendContext }) => {
+      extendContext(await resolveOryPrincipal(ory, context.request.headers));
+    }
   };
 }
-// src/utils/publish.ts
-import { createRedisEventTarget } from "@graphql-yoga/redis-event-target";
-import { createPubSub } from "graphql-yoga";
-var createYogaPubSub = ({
-  publishClient,
-  subscribeClient
-}) => {
-  const eventTarget = createRedisEventTarget({
-    publishClient,
-    subscribeClient
-  });
-  return createPubSub({ eventTarget });
+// src/scalars/any/any.scalars.ts
+import { GraphQLScalarType, Kind } from "graphql";
+var ANY_SCALAR = {
+  Any: new GraphQLScalarType({
+    name: "Any",
+    description: "Generic scalar to represent any type",
+    serialize(value) {
+      return value;
+    },
+    parseValue(value) {
+      return value;
+    },
+    parseLiteral(ast, variables) {
+      switch (ast.kind) {
+        case Kind.STRING:
+        case Kind.BOOLEAN:
+          return ast.value;
+        case Kind.INT:
+        case Kind.FLOAT:
+          return parseFloat(ast.value);
+        case Kind.OBJECT:
+          return Object.fromEntries(ast.fields.map((field) => [field.name, field.value]));
+        case Kind.LIST:
+          return ast.values.map((n) => this?.parseLiteral?.(n, variables));
+        case Kind.NULL:
+          return null;
+        case Kind.VARIABLE: {
+          const name = ast.name.value;
+          return variables ? variables[name] : undefined;
+        }
+      }
+    }
+  })
 };
-// src/utils/sandbox.ts
-import { html } from "hono/html";
-var renderSandbox = ({
-  port = 8080,
-  hostname = "localhost",
-  graphqlEndpoint = "graphql",
-  protocol = "http",
-  title = "Sandbox Explorer"
-}) => html`
-<title>${title}</title>
-<div id="sandbox" style="position:absolute;top:0;right:0;bottom:0;left:0"></div>
-<script src="https://embeddable-sandbox.cdn.apollographql.com/_latest/embeddable-sandbox.umd.production.min.js"></script>
-<script>
-    new window.EmbeddedSandbox({
-        target: "#sandbox",
-        // Pass through your server href if you are embedding on an endpoint.
-        // Otherwise, you can pass whatever endpoint you want Sandbox to start up with here.
-        initialEndpoint: "${protocol}://${hostname}:${port}/${graphqlEndpoint}",
-        handleRequest: (endpointUrl, options) => {
-            return fetch(endpointUrl, {
-                ...options,
-                headers: {
-                    ...options.headers
-                },
-            })
-        },
-        hideCookieToggle: true,
-    });
-    // advanced options: https://www.apollographql.com/docs/studio/explorer/sandbox#embedding-sandbox
-</script>
+// src/scalars/custom/custom.scalars.ts
+import {
+  AccountNumberResolver,
+  BigIntResolver,
+  CountryCodeResolver,
+  CountryNameResolver,
+  CuidResolver,
+  CurrencyResolver,
+  DateResolver,
+  DateTimeISOResolver,
+  DurationResolver,
+  EmailAddressResolver,
+  GeoJSONResolver,
+  GUIDResolver,
+  HexadecimalResolver,
+  HexColorCodeResolver,
+  HSLAResolver,
+  HSLResolver,
+  IBANResolver,
+  IPResolver,
+  IPv4Resolver,
+  IPv6Resolver,
+  ISBNResolver,
+  JSONObjectResolver,
+  JSONResolver,
+  JWTResolver,
+  LatitudeResolver,
+  LocaleResolver,
+  LongitudeResolver,
+  LongResolver,
+  MACResolver,
+  NegativeFloatResolver,
+  NegativeIntResolver,
+  NonEmptyStringResolver,
+  NonNegativeFloatResolver,
+  NonNegativeIntResolver,
+  NonPositiveFloatResolver,
+  NonPositiveIntResolver,
+  ObjectIDResolver,
+  PhoneNumberResolver,
+  PortResolver,
+  PositiveFloatResolver,
+  PositiveIntResolver,
+  PostalCodeResolver,
+  RGBAResolver,
+  RGBResolver,
+  SESSNResolver,
+  TimeResolver,
+  TimestampResolver,
+  URLResolver,
+  USCurrencyResolver,
+  UtcOffsetResolver,
+  UUIDResolver,
+  VoidResolver
+} from "graphql-scalars";
 
-`;
-// src/utils/schema.utils.ts
-import { existsSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
-import { buildSubgraphSchema as buildSubgraphSchemaBase } from "@apollo/subgraph";
-import { loadFilesSync } from "@graphql-tools/load-files";
-import { mergeTypeDefs } from "@graphql-tools/merge";
-import { pruneSchema } from "@graphql-tools/utils";
-import { printSchema } from "graphql";
-function packageRoot() {
-  let dir = dirname(fileURLToPath(import.meta.url));
-  while (!existsSync(join(dir, "package.json"))) {
-    const parent = dirname(dir);
-    if (parent === dir)
-      throw new Error("@nxgt/shared-graphql: no package root");
-    dir = parent;
-  }
-  return dir;
-}
-var SHARED_SCHEMA_PATH = join(packageRoot(), "graphql/**/*.graphqls");
-function loadTypeDefs(...paths) {
-  const typeDefs = mergeTypeDefs([
-    ...paths.flatMap((path) => loadFilesSync(path, {
-      recursive: true
-    }))
-  ]);
-  return typeDefs;
-}
-function buildSubgraphSchema(modulesOrSdl) {
-  return pruneSchema(buildSubgraphSchemaBase(modulesOrSdl), {
-    skipUnusedTypesPruning: false
-  });
-}
-async function generateSchema(output, ...paths) {
-  await Bun.write(output, printSchema(buildSubgraphSchema(loadTypeDefs(...paths))));
-}
-// src/utils/websocket.ts
-import { createServer } from "node:http";
-import { useServer } from "graphql-ws/use/ws";
-import { WebSocketServer } from "ws";
-function setupYogaWebSocketServer({
-  yoga,
-  context
+// src/scalars/custom/utils.ts
+import { CustomException } from "@nxgt/shared-exceptions";
+import { logger } from "@nxgt/shared-logging";
+import { GraphQLScalarType as GraphQLScalarType2 } from "graphql";
+function createScalarFrom(scalar, {
+  name,
+  description,
+  errorMessage
 }) {
-  const httpServer = createServer(yoga);
-  const wsServer = new WebSocketServer({
-    server: httpServer,
-    path: yoga.graphqlEndpoint
-  });
-  useServer({
-    execute: (args) => args.rootValue.execute(args),
-    subscribe: (args) => args.rootValue.subscribe(args),
-    onSubscribe: async (ctx, _id, params) => {
-      const { schema, execute, subscribe, contextFactory, parse, validate } = yoga.getEnveloped({
-        ...ctx,
-        req: ctx.extra.request,
-        socket: ctx.extra.socket,
-        params
-      });
-      const args = {
-        schema,
-        operationName: params.operationName,
-        document: parse(params.query),
-        variableValues: params.variables,
-        contextValue: await contextFactory(),
-        rootValue: {
-          execute,
-          subscribe
-        }
-      };
-      const errors = validate(args.schema, args.document);
-      if (errors.length)
-        return errors;
-      return args;
-    },
-    context
-  }, wsServer);
-  const startServer = (port) => new Promise((resolve) => httpServer.listen({ port }, resolve));
-  return { yoga, httpServer, startServer };
-}
-// src/utils/ws-context.ts
-async function resolveWsUser(connectionParams, authClient) {
-  const rawToken = connectionParams?.authorization ?? connectionParams?.Authorization;
-  const token = rawToken?.replace("Bearer ", "");
-  const { data } = token ? await authClient.POST("/oauth/introspect", { body: { token } }) : { data: null };
-  const user = data?.active ? { ...data, name: data.sub } : undefined;
-  return { user, token };
-}
-// src/integrations/hono.ts
-function sandboxExpolorer(options) {
-  return createMiddleware(async (ctx) => {
-    return ctx.html(renderSandbox(options));
-  });
-}
-function honoYoga(yoga) {
-  return createMiddleware(async (ctx) => {
-    const response = await yoga.fetch(ctx.req.raw);
-    return response;
-  });
-}
-function createYogaHono(yoga, options) {
-  const app = new Hono;
-  app.use(contextStorage());
-  app.use(languageDetector({
-    order: ["header"],
-    supportedLanguages: ["en", "fr"],
-    fallbackLanguage: "en",
-    caches: []
-  }));
-  app.get("/health", (ctx) => {
-    return ctx.json({ status: "ok" }, 200);
+  const exception = CustomException.badRequest({
+    message: errorMessage
   });
-  app.get(options?.sandbox?.endpoint || "sandbox", sandboxExpolorer(options?.sandbox || {}));
-  app.use(yoga.graphqlEndpoint, honoYoga(yoga));
-  return app;
-}
-// src/plugins/apply-keto-checks.ts
-import { getDirective as getDirective3, MapperKind, mapSchema } from "@graphql-tools/utils";
-import { evaluateRequirement } from "@nxgt/ory-sdk";
-import { CustomException as CustomException3 } from "@nxgt/shared-exceptions";
-import {
-  defaultFieldResolver
-} from "graphql";
-function applyKetoChecks(schema, options = {}) {
-  return mapSchema(schema, {
-    [MapperKind.INTERFACE_FIELD]: (fieldConfig, fieldName, typeName) => {
-      refuseOnInterface(schema, fieldConfig, `${typeName}.${fieldName}`);
-      return fieldConfig;
+  return new GraphQLScalarType2({
+    ...scalar,
+    name: name ?? scalar.name,
+    description: (description ?? scalar.description)?.replaceAll("`", "'"),
+    serialize(value) {
+      if (!errorMessage) {
+        return scalar.serialize(value);
+      }
+      try {
+        return scalar.serialize(value);
+      } catch (e) {
+        logger.error(e);
+        throw exception;
+      }
     },
-    [MapperKind.OBJECT_FIELD]: (fieldConfig, fieldName, typeName) => {
-      const where = `${typeName}.${fieldName}`;
-      const requirements = readRequirements(schema, fieldConfig, where, options);
-      if (requirements.length === 0)
-        return fieldConfig;
-      return guarded(fieldConfig, requirements, where);
-    }
-  });
-}
-function refuseOnInterface(schema, fieldConfig, where) {
-  const message = `${where}: @check / @permission on an interface field guards nothing — no resolver runs there. Put it on each implementing type's field`;
-  if (readPermissions(schema, fieldConfig, where).length > 0) {
-    throw new TypeError(message);
-  }
-  if (getDirective3(schema, fieldConfig, CHECK_DIRECTIVE_NAME)?.length) {
-    warnCheckMistake(message);
-  }
-}
-function guarded(fieldConfig, requirements, where) {
-  const resolve = fieldConfig.resolve ?? defaultFieldResolver;
-  return {
-    ...fieldConfig,
-    resolve: async (source, args, context, info) => {
-      const ctx = context;
-      const subject = ctx.ory?.subject;
-      if (!subject) {
-        throw CustomException3.unauthenticated({
-          message: "errors.unauthenticated"
-        });
+    parseValue(value) {
+      if (!errorMessage) {
+        return scalar.parseValue(value);
       }
-      const check = ctx.ketoChecks;
-      if (!check) {
-        throw new Error(`${where}: no checker on the context — useKetoChecks(ory) is not registered`);
+      try {
+        return scalar.parseValue(value);
+      } catch (e) {
+        logger.error(e);
+        throw exception;
       }
-      for (const { permissions, onDeny, message } of requirements) {
-        const allowed = await evaluateRequirement(permissions, (term) => objectsOf(term, source, args, where), check, subject);
-        if (!allowed)
-          throw denial(onDeny, message);
-      }
-      return resolve(source, args, context, info);
-    }
-  };
-}
-function objectsOf(term, source, args, where) {
-  const ids = objectIds(readPath(term.id, source, args));
-  if (ids.length === 0) {
-    throw new Error(`${where}: "${term.id}" resolved no object id`);
-  }
-  return ids;
-}
-function denial(onDeny, message) {
-  return onDeny === "FORBIDDEN" ? CustomException3.forbidden({
-    message: message ?? "errors.insufficient-permissions"
-  }) : CustomException3.notFound({ message: message ?? "errors.not-found" });
-}
-// src/plugins/auth.ts
-function useAuth() {
-  return {
-    onContextBuilding: async ({ context, extendContext }) => {
-      extendContext({
-        user: context.params.extensions?.user,
-        token: context.params.extensions?.token
-      });
-    }
-  };
-}
-// src/plugins/extract-jwt.ts
-import { logger as logger2 } from "@nxgt/shared-logging";
-var extractJwtPlugin = {
-  async requestDidStart({ request, contextValue }) {
-    logger2.info(`[${request.extensions?.subgraphName}] Extracting JWT from request extensions: ${request.extensions?.payload?.sub}`, request.extensions);
-    contextValue.jwt = {
-      payload: request.extensions?.payload
-    };
-  }
-};
-// src/plugins/keto-checker.ts
-import { tuple } from "@nxgt/ory-sdk";
-import DataLoader2 from "dataloader";
-function createKetoChecks(ory) {
-  const loader = new DataLoader2((questions) => ory.checkMany([...questions]), {
-    cacheKeyFn: ({ permission, subject }) => tuple(permission, subject)
-  });
-  return (permission, subject) => loader.load({ permission, subject });
-}
-// src/plugins/keto-checks.ts
-function useKetoChecks(ory, options = {}) {
-  const transformed = new WeakSet;
-  return {
-    onSchemaChange: ({ schema, replaceSchema }) => {
-      if (transformed.has(schema))
-        return;
-      const next = applyKetoChecks(schema, options);
-      transformed.add(next);
-      replaceSchema(next);
-    },
-    onContextBuilding: ({ extendContext }) => {
-      extendContext({ ketoChecks: createKetoChecks(ory) });
-    }
-  };
-}
-// src/plugins/keto-helpers.ts
-import { CustomException as CustomException4 } from "@nxgt/shared-exceptions";
-function requireUser(context) {
-  if (!context.user) {
-    throw CustomException4.unauthenticated({
-      message: "errors.unauthenticated"
-    });
-  }
-  return context.user;
-}
-async function can(context, question) {
-  const subject = context.ory?.subject;
-  if (!subject) {
-    throw CustomException4.unauthenticated({
-      message: "errors.unauthenticated"
-    });
-  }
-  if (!context.ketoChecks) {
-    throw new Error("can(): no checker on the context — useKetoChecks(ory) is not registered");
-  }
-  const permission = {
-    namespace: question.type,
-    object: question.id,
-    relation: question.name
-  };
-  return context.ketoChecks(permission, subject);
-}
-// src/plugins/ory-auth.ts
-import {
-  bearerOf
-} from "@nxgt/ory-sdk";
-import { claimsFromOryPrincipal } from "@nxgt/security/integrations/ory";
-function toPrincipal(ory) {
-  const email = ory.identity?.email;
-  return {
-    sub: ory.subject,
-    uid: ory.subject,
-    name: email ?? ory.clientId ?? ory.subject,
-    username: email,
-    clientId: ory.clientId,
-    scope: ory.scopes.join(" ") || undefined,
-    tokenType: ory.kind,
-    exp: ory.expiresAt ? Math.floor(ory.expiresAt.getTime() / 1000) : undefined,
-    authorities: [],
-    roles: []
-  };
-}
-function oryUnavailableError(error) {
-  return serviceUnavailableError(error);
-}
-async function resolveOryPrincipal(ory, headers) {
-  let principal;
-  try {
-    principal = await ory.resolve(headers);
-  } catch (error) {
-    if (isOryUnavailable(error))
-      throw oryUnavailableError(error);
-    throw error;
-  }
-  return {
-    ory: principal,
-    user: principal ? toPrincipal(principal) : undefined,
-    claims: principal ? claimsFromOryPrincipal(principal) : undefined,
-    token: bearerOf(headers) ?? undefined
-  };
-}
-function useOryAuth(ory) {
-  return {
-    onContextBuilding: async ({ context, extendContext }) => {
-      extendContext(await resolveOryPrincipal(ory, context.request.headers));
-    }
-  };
-}
-// src/scalars/any/any.scalars.ts
-import { GraphQLScalarType, Kind } from "graphql";
-var ANY_SCALAR = {
-  Any: new GraphQLScalarType({
-    name: "Any",
-    description: "Generic scalar to represent any type",
-    serialize(value) {
-      return value;
-    },
-    parseValue(value) {
-      return value;
-    },
-    parseLiteral(ast, variables) {
-      switch (ast.kind) {
-        case Kind.STRING:
-        case Kind.BOOLEAN:
-          return ast.value;
-        case Kind.INT:
-        case Kind.FLOAT:
-          return parseFloat(ast.value);
-        case Kind.OBJECT:
-          return Object.fromEntries(ast.fields.map((field) => [field.name, field.value]));
-        case Kind.LIST:
-          return ast.values.map((n) => this?.parseLiteral?.(n, variables));
-        case Kind.NULL:
-          return null;
-        case Kind.VARIABLE: {
-          const name = ast.name.value;
-          return variables ? variables[name] : undefined;
-        }
-      }
-    }
-  })
-};
-// src/scalars/custom/custom.scalars.ts
-import {
-  AccountNumberResolver,
-  BigIntResolver,
-  CountryCodeResolver,
-  CountryNameResolver,
-  CuidResolver,
-  CurrencyResolver,
-  DateResolver,
-  DateTimeISOResolver,
-  DurationResolver,
-  EmailAddressResolver,
-  GeoJSONResolver,
-  GUIDResolver,
-  HexadecimalResolver,
-  HexColorCodeResolver,
-  HSLAResolver,
-  HSLResolver,
-  IBANResolver,
-  IPResolver,
-  IPv4Resolver,
-  IPv6Resolver,
-  ISBNResolver,
-  JSONObjectResolver,
-  JSONResolver,
-  JWTResolver,
-  LatitudeResolver,
-  LocaleResolver,
-  LongitudeResolver,
-  LongResolver,
-  MACResolver,
-  NegativeFloatResolver,
-  NegativeIntResolver,
-  NonEmptyStringResolver,
-  NonNegativeFloatResolver,
-  NonNegativeIntResolver,
-  NonPositiveFloatResolver,
-  NonPositiveIntResolver,
-  ObjectIDResolver,
-  PhoneNumberResolver,
-  PortResolver,
-  PositiveFloatResolver,
-  PositiveIntResolver,
-  PostalCodeResolver,
-  RGBAResolver,
-  RGBResolver,
-  SESSNResolver,
-  TimeResolver,
-  TimestampResolver,
-  URLResolver,
-  USCurrencyResolver,
-  UtcOffsetResolver,
-  UUIDResolver,
-  VoidResolver
-} from "graphql-scalars";
-
-// src/scalars/custom/utils.ts
-import { CustomException as CustomException5 } from "@nxgt/shared-exceptions";
-import { logger as logger3 } from "@nxgt/shared-logging";
-import { GraphQLScalarType as GraphQLScalarType2 } from "graphql";
-function createScalarFrom(scalar, {
-  name,
-  description,
-  errorMessage
-}) {
-  const exception = CustomException5.badRequest({
-    message: errorMessage
-  });
-  return new GraphQLScalarType2({
-    ...scalar,
-    name: name ?? scalar.name,
-    description: (description ?? scalar.description)?.replaceAll("`", "'"),
-    serialize(value) {
-      if (!errorMessage) {
-        return scalar.serialize(value);
-      }
-      try {
-        return scalar.serialize(value);
-      } catch (e) {
-        logger3.error(e);
-        throw exception;
-      }
-    },
-    parseValue(value) {
-      if (!errorMessage) {
-        return scalar.parseValue(value);
-      }
-      try {
-        return scalar.parseValue(value);
-      } catch (e) {
-        logger3.error(e);
-        throw exception;
-      }
-    },
-    parseLiteral(ast, variables) {
-      if (!errorMessage) {
-        return scalar.parseLiteral(ast, variables);
-      }
-      try {
-        return scalar.parseLiteral(ast, variables);
-      } catch (e) {
-        logger3.error(e);
-        throw exception;
+    },
+    parseLiteral(ast, variables) {
+      if (!errorMessage) {
+        return scalar.parseLiteral(ast, variables);
+      }
+      try {
+        return scalar.parseLiteral(ast, variables);
+      } catch (e) {
+        logger.error(e);
+        throw exception;
       }
     }
   });
@@ -1328,8 +1034,7 @@ type Subscription {
 	_empty: String
 }
 
-directive @authenticated on FIELD_DEFINITION | OBJECT | INTERFACE | SCALAR | ENUM
-
+${AUTHENTICATED_DIRECTIVE_SDL}
 directive @policy(policies: [[String!]!]!) on FIELD_DEFINITION | OBJECT | INTERFACE | SCALAR | ENUM
 
 directive @shareable on OBJECT | FIELD_DEFINITION
@@ -1339,11 +1044,429 @@ directive @link(url: String!, import: [String!]) on SCHEMA
 `;
 // src/upload.ts
 import graphqlUploadExpress from "graphql-upload/graphqlUploadExpress.mjs";
+// src/utils/change-resolvers.utils.ts
+import {
+  AUDIT_EVENT,
+  CommitType
+} from "@nxgt/shared-mongo";
+import { withFilter } from "graphql-subscriptions";
+function createChangeResolvers(config) {
+  const { entity, collection, service, pubsub } = config;
+  const resolvePubSub = () => typeof pubsub === "function" ? pubsub() : pubsub;
+  return {
+    Query: {
+      [`${entity}Changes`]: async (_parent, args, context) => context.services.audit.findChangesPaginatedByCollection(collection, args),
+      [`${entity}ChangesById`]: async (_parent, args, context) => context.services.audit.findChangesPaginatedByCollectionAndOid(args.id, collection, args)
+    },
+    Subscription: {
+      [`${entity}Changed`]: {
+        resolve: async (payload, _args, context) => ({
+          id: context.services.audit.extractId(payload),
+          data: payload.type !== CommitType.TERMINAL ? await context.services[service].findById(payload.state._id) : null,
+          type: payload.type
+        }),
+        subscribe: withFilter(() => resolvePubSub().subscribe(AUDIT_EVENT), (payload, _variables, context) => context ? context.services.audit.matches(payload, { collection }) : false)
+      }
+    }
+  };
+}
+// src/utils/codegen.utils.ts
+var SCALARS_MAPPING = {
+  ID: "any",
+  DateTime: "any",
+  Date: "any",
+  Any: "any",
+  BigInt: "number",
+  EmailAddress: "string",
+  GeoJSON: "any",
+  HSL: "string",
+  HSLA: "string",
+  HexColorCode: "string",
+  Hexadecimal: "string",
+  IBAN: "string",
+  IP: "string",
+  Time: "string",
+  LocalTime: "string",
+  UUID: "string",
+  PositiveInt: "number",
+  NegativeInt: "number",
+  NonPositiveInt: "number",
+  NonNegativeInt: "number",
+  PositiveFloat: "number",
+  NegativeFloat: "number",
+  NonPositiveFloat: "number",
+  NonNegativeFloat: "number",
+  NonEmptyString: "string",
+  PostalCode: "string",
+  RGB: "string",
+  RGBA: "string",
+  SESSN: "string",
+  Timestamp: "string",
+  URL: "string",
+  USCurrency: "string",
+  UTCOffset: "string",
+  Long: "number",
+  Short: "number",
+  Byte: "number",
+  BigDecimal: "string",
+  BigInteger: "string",
+  Char: "string",
+  Locale: "string",
+  CountryCode: "string",
+  CountryName: "string",
+  AccountNumber: "string",
+  CurrencyCode: "string",
+  Duration: "string",
+  Url: "string",
+  JSONObject: "Record<string, any>",
+  JSON: "any",
+  Void: "void",
+  ObjectID: "any",
+  Upload: "File | Blob",
+  Email: "string",
+  Port: "number",
+  IPv4: "string",
+  IPv6: "string",
+  MAC: "string",
+  Password: "string",
+  PhoneNumber: "string",
+  ZIPCode: "string",
+  SSN: "string",
+  GUID: "string",
+  ISBN: "string",
+  Latitude: "number",
+  Longitude: "number",
+  JWT: "string"
+};
+// src/utils/data-loader.utils.ts
+import { cast } from "@nxgt/shared/helpers";
+import {
+  paginateList
+} from "@nxgt/shared-mongo";
+import DataLoader2 from "dataloader";
+import { isArray } from "lodash";
+function createDataLoader(batchLoadFn, options) {
+  return new DataLoader2(batchLoadFn, options);
+}
+function createConnectionListDataLoader(path, model, options) {
+  return createDataLoader(async (docs) => {
+    const data = await model.find({
+      ...options.filter ?? {},
+      _id: docs.flatMap((doc) => {
+        const ids = doc[path] ?? [];
+        return isArray(ids) ? cast(ids.filter((item) => !!item && !["undefined", "null"].includes(item?.toString()))) : [];
+      })
+    }).exec();
+    return cast(docs.map((doc) => model.paginateList(data.filter((child) => cast(doc[path] ?? []).map((item) => item.toString()).includes(child._id.toString())), options)));
+  });
+}
+function createChildrenConnectionDataLoader(path, model, options) {
+  return createDataLoader(async (docs) => {
+    const filter = {};
+    filter[path] = docs.map((doc) => doc._id);
+    const data = await model.find(filter).exec();
+    return cast(docs.map((doc) => paginateList(data.filter((child) => doc._id?.toString() === child[path]?.toString()), options)));
+  });
+}
+function createSimpleListDataLoader(path, model, options) {
+  return createDataLoader(async (docs) => {
+    const filter = options?.filter ?? {};
+    const ids = docs.flatMap((doc) => {
+      const ids = doc[path] ?? [];
+      return isArray(ids) ? cast(ids) : [];
+    });
+    filter._id = ids;
+    const query = model.find(filter);
+    const data = await query.exec();
+    return cast(docs.map((doc) => {
+      const result = data.filter((child) => cast(doc[path] ?? []).map((item) => item.toString()).includes(child._id.toString()));
+      if (options?.skip && options?.limit) {
+        return result.slice(options.skip, options.skip + options.limit);
+      }
+      if (options?.limit) {
+        return result.slice(0, options.limit);
+      }
+      if (options?.skip) {
+        return result.slice(options.skip);
+      }
+      return result;
+    }));
+  });
+}
+function createChildrenListDataLoader(path, model, options) {
+  return createDataLoader(async (docs) => {
+    const filter = options?.filter ?? {};
+    const key = path;
+    filter[key] = docs.map((doc) => doc._id);
+    const query = model.find(filter);
+    const data = await query.exec();
+    return cast(docs.map((doc) => {
+      const result = data.filter((child) => child[path]?.toString() === doc._id.toString());
+      if (options?.skip && options?.limit) {
+        return result.slice(options.skip, options.skip + options.limit);
+      }
+      if (options?.limit) {
+        return result.slice(0, options.limit);
+      }
+      if (options?.skip) {
+        return result.slice(options.skip);
+      }
+      return result;
+    }));
+  });
+}
+function createSingleChildDataLoader(path, model) {
+  return createDataLoader(async (docs) => {
+    const data = await model.find({
+      _id: docs.map((doc) => cast(doc[path])).filter((item) => !!item && !["undefined", "null"].includes(item?.toString()))
+    }).exec();
+    const map = new Map(data.map((doc) => [doc.id, doc]));
+    return docs.map((doc) => map.get(doc[path]?.toString() ?? "") ?? null);
+  });
+}
+function createEntitiesReferenceLoader(model) {
+  return createDataLoader(async (ids) => {
+    const docs = await model.find({
+      _id: ids.filter((item) => !!item && !["undefined", "null"].includes(item?.toString()))
+    }).exec();
+    const map = new Map(docs.map((doc) => [doc.id, doc]));
+    return ids.map((id) => map.get(id) ?? null);
+  });
+}
+// src/utils/errors/create-error.ts
+import { GraphQLError as GraphQLError3 } from "graphql";
+function createGraphQLError(message, options) {
+  return new GraphQLError3(message, options);
+}
+// src/utils/errors/format-error.ts
+import {
+  ApolloServerErrorCode,
+  unwrapResolverError
+} from "@apollo/server/errors";
+import {
+  translate as translateBase
+} from "@nxgt/i18n";
+import { CustomException as CustomException2, ErrorCode as ErrorCode6 } from "@nxgt/shared-exceptions";
+import { MONGO_UTILS, mongoose } from "@nxgt/shared-mongo";
+import { kebabCase } from "lodash";
+function createFormatError(translate = translateBase, production) {
+  return (formattedError, graphQLError) => {
+    if (production && formattedError.extensions?.stacktrace) {
+      formattedError.extensions.stacktrace = undefined;
+    }
+    const error = unwrapResolverError(graphQLError);
+    if (isOryUnavailable(error)) {
+      const unavailable = serviceUnavailableError(error);
+      return {
+        ...formattedError,
+        message: unavailable.message,
+        extensions: { ...formattedError.extensions, ...unavailable.extensions }
+      };
+    }
+    const key = denialMessageKey(error);
+    if (key !== undefined) {
+      return { ...formattedError, message: translate(key) };
+    }
+    if (error instanceof CustomException2 || error instanceof mongoose.MongooseError) {
+      const exception = error instanceof mongoose.MongooseError ? MONGO_UTILS.castError(error) : error;
+      return {
+        ...formattedError,
+        message: exception.errorCode === ErrorCode6.ValidationError ? exception.message : translate(exception.message, exception.options),
+        extensions: {
+          ...formattedError.extensions,
+          code: exception.errorCode,
+          debugMessage: exception.debugMessage
+        }
+      };
+    }
+    if ([
+      ApolloServerErrorCode.GRAPHQL_VALIDATION_FAILED,
+      ApolloServerErrorCode.BAD_REQUEST,
+      ApolloServerErrorCode.BAD_USER_INPUT,
+      ApolloServerErrorCode.GRAPHQL_PARSE_FAILED,
+      ApolloServerErrorCode.OPERATION_RESOLUTION_FAILURE,
+      ApolloServerErrorCode.PERSISTED_QUERY_NOT_FOUND,
+      ApolloServerErrorCode.PERSISTED_QUERY_NOT_SUPPORTED
+    ].includes(formattedError.extensions?.code)) {
+      return {
+        ...formattedError,
+        message: translate(`errors.${kebabCase(formattedError.extensions?.code)}`, {}),
+        extensions: {
+          ...formattedError.extensions,
+          debugMessage: formattedError.message
+        }
+      };
+    }
+    return formattedError;
+  };
+}
+// src/utils/errors/mask-error.ts
+import {
+  translate as translateBase2
+} from "@nxgt/i18n";
+import { CustomException as CustomException3, ErrorCode as ErrorCode7 } from "@nxgt/shared-exceptions";
+import { MONGO_UTILS as MONGO_UTILS2, mongoose as mongoose2 } from "@nxgt/shared-mongo";
+import { GraphQLError as GraphQLError4 } from "graphql";
+function createMaskError(translate = translateBase2) {
+  return (error, message, isDev) => {
+    const original = error instanceof GraphQLError4 && error.originalError ? error.originalError : error;
+    if (isOryUnavailable(original))
+      return serviceUnavailableError(original);
+    const key = denialMessageKey(original);
+    if (key !== undefined) {
+      return new GraphQLError4(translate(key), {
+        ...locationOf(error),
+        extensions: original.extensions
+      });
+    }
+    if (original instanceof CustomException3 || original instanceof mongoose2.MongooseError) {
+      return exceptionError(original, translate);
+    }
+    if (isOriginalGraphQLError(error))
+      return error;
+    return new GraphQLError4(message, {
+      ...locationOf(error),
+      extensions: isDev ? {
+        code: ErrorCode7.InternalServerError,
+        debugMessage: String(original)
+      } : { code: ErrorCode7.InternalServerError }
+    });
+  };
+}
+function exceptionError(original, translate) {
+  const exception = original instanceof mongoose2.MongooseError ? MONGO_UTILS2.castError(original) : original;
+  const status = exception.code;
+  return new GraphQLError4(exception.errorCode === ErrorCode7.ValidationError ? exception.message : translate(exception.message, exception.options), {
+    extensions: {
+      code: exception.errorCode,
+      ...status ? { http: { status } } : {},
+      ...exception.debugMessage ? { debugMessage: exception.debugMessage } : {}
+    }
+  });
+}
+function isOriginalGraphQLError(error) {
+  if (!(error instanceof GraphQLError4))
+    return false;
+  return error.originalError == null ? true : isOriginalGraphQLError(error.originalError);
+}
+function locationOf(error) {
+  if (!(error instanceof GraphQLError4))
+    return {};
+  return {
+    nodes: error.nodes,
+    source: error.source,
+    positions: error.positions,
+    path: error.path
+  };
+}
+// src/utils/publish.ts
+import { createRedisEventTarget } from "@graphql-yoga/redis-event-target";
+import { createPubSub } from "graphql-yoga";
+var createYogaPubSub = ({
+  publishClient,
+  subscribeClient
+}) => {
+  const eventTarget = createRedisEventTarget({
+    publishClient,
+    subscribeClient
+  });
+  return createPubSub({ eventTarget });
+};
+// src/utils/schema.utils.ts
+import { existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { buildSubgraphSchema as buildSubgraphSchemaBase } from "@apollo/subgraph";
+import { loadFilesSync } from "@graphql-tools/load-files";
+import { mergeTypeDefs } from "@graphql-tools/merge";
+import { pruneSchema } from "@graphql-tools/utils";
+import { printSchema } from "graphql";
+function packageRoot() {
+  let dir = dirname(fileURLToPath(import.meta.url));
+  while (!existsSync(join(dir, "package.json"))) {
+    const parent = dirname(dir);
+    if (parent === dir)
+      throw new Error("@nxgt/shared-graphql: no package root");
+    dir = parent;
+  }
+  return dir;
+}
+var SHARED_SCHEMA_PATH = join(packageRoot(), "graphql/**/*.graphqls");
+function loadTypeDefs(...paths) {
+  const typeDefs = mergeTypeDefs([
+    ...paths.flatMap((path) => loadFilesSync(path, {
+      recursive: true
+    }))
+  ]);
+  return typeDefs;
+}
+function buildSubgraphSchema(modulesOrSdl) {
+  return pruneSchema(buildSubgraphSchemaBase(modulesOrSdl), {
+    skipUnusedTypesPruning: false
+  });
+}
+async function generateSchema(output, ...paths) {
+  await Bun.write(output, printSchema(buildSubgraphSchema(loadTypeDefs(...paths))));
+}
+// src/utils/websocket.ts
+import { createServer } from "node:http";
+import { useServer } from "graphql-ws/use/ws";
+import { WebSocketServer } from "ws";
+function setupYogaWebSocketServer({
+  yoga,
+  context
+}) {
+  const httpServer = createServer(yoga);
+  const wsServer = new WebSocketServer({
+    server: httpServer,
+    path: yoga.graphqlEndpoint
+  });
+  useServer({
+    execute: (args) => args.rootValue.execute(args),
+    subscribe: (args) => args.rootValue.subscribe(args),
+    onSubscribe: async (ctx, _id, params) => {
+      const { schema, execute, subscribe, contextFactory, parse, validate } = yoga.getEnveloped({
+        ...ctx,
+        req: ctx.extra.request,
+        socket: ctx.extra.socket,
+        params
+      });
+      const args = {
+        schema,
+        operationName: params.operationName,
+        document: parse(params.query),
+        variableValues: params.variables,
+        contextValue: await contextFactory(),
+        rootValue: {
+          execute,
+          subscribe
+        }
+      };
+      const errors = validate(args.schema, args.document);
+      if (errors.length)
+        return errors;
+      return args;
+    },
+    context
+  }, wsServer);
+  const startServer = (port) => new Promise((resolve) => httpServer.listen({ port }, resolve));
+  return { yoga, httpServer, startServer };
+}
+// src/utils/ws-context.ts
+async function resolveWsUser(connectionParams, authClient) {
+  const rawToken = connectionParams?.authorization ?? connectionParams?.Authorization;
+  const token = rawToken?.replace("Bearer ", "");
+  const { data } = token ? await authClient.POST("/oauth/introspect", { body: { token } }) : { data: null };
+  const user = data?.active ? { ...data, name: data.sub } : undefined;
+  return { user, token };
+}
 export {
-  CHECK_DIRECTIVE_NAME,
-  CHECK_DIRECTIVE_SDL,
+  AUTHENTICATED_DIRECTIVE_NAME,
+  AUTHENTICATED_DIRECTIVE_SDL,
+  CALLER_TYPES,
   DataLoader3 as DataLoader,
   FEDERATION_DIRECTIVES,
+  GATEWAY_SECRET_HEADER,
   KETO_DIRECTIVES_SDL,
   PERMISSION_DIRECTIVE_NAME,
   PERMISSION_DIRECTIVE_SDL,
@@ -1351,6 +1474,7 @@ export {
   SCALAR_RESOLVERS,
   SHARED_SCHEMA_PATH,
   SHARED_TYPE_DEFS,
+  applyAuthenticated,
   applyKetoChecks,
   assertReadablePath,
   buildSubgraphSchema,
@@ -1369,7 +1493,10 @@ export {
   createSingleChildDataLoader,
   createYogaHono,
   createYogaPubSub,
+  denial,
+  denialMessageKey,
   extractJwtPlugin,
+  gatewaySecret,
   generateSchema,
   graphqlUploadExpress,
   honoYoga,
@@ -1377,22 +1504,23 @@ export {
   loadTypeDefs,
   objectIds,
   oryUnavailableError,
-  readChecks,
+  principalOf,
   readPath,
   readPermissions,
-  readRequirements,
   renderSandbox,
+  requireGatewayTrust,
   requireUser,
   resolveOryPrincipal,
   resolveWsUser,
-  sandboxExpolorer,
+  sandboxExplorer,
   serviceUnavailableError,
   setupYogaWebSocketServer,
   toPrincipal,
   useAuth,
+  useAuthenticated,
   useKetoChecks,
   useOryAuth
 };
 
-//# debugId=E72214B01404888264756E2164756E21
+//# debugId=D1F8FC67079E823264756E2164756E21
 //# sourceMappingURL=index.js.map