@stratal/framework 0.0.25 → 0.0.26

package/dist/access-control/index.d.mts

@@ -1,5 +1,5 @@
 import { n as RolePermissions, t as AccessControlOptions } from "../types-DabF8LGz.mjs";
-import { M as DatabaseService } from "../index-DTXzJzpy.mjs";
+import { M as DatabaseService } from "../index-Dt0YUA7r.mjs";
 import { t as AuthContext } from "../auth-context-CGVbiSX3.mjs";
 import { HttpException } from "stratal/errors";
 import { AccessControl, Role, Statements } from "better-auth/plugins/access";

package/dist/auth/index.d.mts

@@ -73,6 +73,9 @@ declare class InvalidEmailError extends HttpException {
 declare class SessionExpiredError extends HttpException {
   constructor();
 }
+declare class FreshSessionRequiredError extends HttpException {
+  constructor();
+}
 declare class EmailNotVerifiedError extends HttpException {
   readonly email?: string | undefined;
   constructor(email?: string | undefined);
@@ -255,5 +258,5 @@ declare function mapBetterAuthError(error: APIError): ApplicationError;
  */
 declare function isAPIError(error: unknown): error is APIError;
 //#endregion
-export { AUTH_OPTIONS, AUTH_SERVICE, AccountAlreadyExistsError, AccountNotFoundError, AuthModule, AuthModuleAsyncOptions, AuthService, AuthValidationFailedError, CannotUnlinkLastAccountError, CredentialAccountNotFoundError, EmailAlreadyVerifiedError, EmailCannotBeUpdatedError, EmailMismatchError, EmailNotVerifiedError, IdTokenNotSupportedError, InvalidCallbackUrlError, InvalidCredentialsError, InvalidEmailError, InvalidOriginError, InvalidPasswordError, InvalidTokenError, OrganizationConflictError, OrganizationInvitationNotFoundError, OrganizationInvitationRecipientMismatchError, OrganizationLimitReachedError, OrganizationMemberNotFoundError, OrganizationMembershipError, OrganizationNotFoundError, OrganizationPermissionDeniedError, OrganizationRoleNotFoundError, OrganizationTeamNotFoundError, PasswordTooLongError, PasswordTooShortError, ProviderNotFoundError, SessionExpiredError, SessionVerificationMiddleware, SocialAccountLinkedError, TokenExpiredError, TokenRequiredError, UserAlreadyHasPasswordError, UserEmailNotFoundError, UserNotFoundError, getErrorHandlerConfig, isAPIError, mapBetterAuthError, wrapBetterAuth };
+export { AUTH_OPTIONS, AUTH_SERVICE, AccountAlreadyExistsError, AccountNotFoundError, AuthModule, AuthModuleAsyncOptions, AuthService, AuthValidationFailedError, CannotUnlinkLastAccountError, CredentialAccountNotFoundError, EmailAlreadyVerifiedError, EmailCannotBeUpdatedError, EmailMismatchError, EmailNotVerifiedError, FreshSessionRequiredError, IdTokenNotSupportedError, InvalidCallbackUrlError, InvalidCredentialsError, InvalidEmailError, InvalidOriginError, InvalidPasswordError, InvalidTokenError, OrganizationConflictError, OrganizationInvitationNotFoundError, OrganizationInvitationRecipientMismatchError, OrganizationLimitReachedError, OrganizationMemberNotFoundError, OrganizationMembershipError, OrganizationNotFoundError, OrganizationPermissionDeniedError, OrganizationRoleNotFoundError, OrganizationTeamNotFoundError, PasswordTooLongError, PasswordTooShortError, ProviderNotFoundError, SessionExpiredError, SessionVerificationMiddleware, SocialAccountLinkedError, TokenExpiredError, TokenRequiredError, UserAlreadyHasPasswordError, UserEmailNotFoundError, UserNotFoundError, getErrorHandlerConfig, isAPIError, mapBetterAuthError, wrapBetterAuth };
 //# sourceMappingURL=index.d.mts.map

package/dist/auth/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/context/router-context.augment.ts","../../src/auth/auth.module.ts","../../src/auth/auth.tokens.ts","../../src/auth/errors/auth-errors.ts","../../src/auth/errors/invalid-token.error.ts","../../src/auth/errors/organization-errors.ts","../../src/auth/errors/token-required.error.ts","../../src/auth/services/auth.service.ts","../../src/auth/middleware/session-verification.middleware.ts","../../src/auth/utils/auth-helpers.ts","../../src/auth/utils/better-auth-error-handler.ts"],"mappings":";;;;;;;;;;;YAaY,aAAA;;;;;;;IAOR,IAAA,IAAQ,QAAQ;EAAA;AAAA;;;UCqDH,sBAAA,kBAAwC,iBAAA,GAAoB,iBAAA,UACnE,kBAAA,CAAmB,QAAA;EAWuB;;;;EANlD,aAAA,GAAgB,oBAAA;AAAA;AAAA,cAML,UAAA,YAAsB,iBAAA;EAqBI;;;;;;EAdrC,eAAA,CAAgB,MAAA,EAAQ,MAAA;;;;AC3F1B;;;;AAA8D;AAG9D;;SDsGS,YAAA,kBAA8B,iBAAA,EACnC,OAAA,EAAS,sBAAA,CAAuB,QAAA,IAC/B,aAAA;AAAA;;;;cC3GQ,YAAA;;cAGA,YAAA;;;cCFA,iBAAA,SAA0B,aAAa;EAAA,SACtB,KAAA;cAAA,KAAA;AAAA;AAAA,cAKjB,uBAAA,SAAgC,aAAa;EAAb,WAAA;AAAA;AAAA,cAIhC,oBAAA,SAA6B,aAAa;EAAb,WAAA;AAAA;AAAA,cAI7B,iBAAA,SAA0B,aAAa;EAAA,SACtB,KAAA;cAAA,KAAA;AAAA;AAAA,cAKjB,mBAAA,SAA4B,aAAa;EAAb,WAAA;AAAA;AAAA,cAI5B,qBAAA,SAA8B,aAAa;EAAA,SAC1B,KAAA;cAAA,KAAA;AAAA;AAAA,cAKjB,qBAAA,SAA8B,aAAa;EAAA,SAC1B,SAAA;cAAA,SAAA;AAAA;AAAA,cAKjB,oBAAA,SAA6B,aAAa;EAAA,SACzB,SAAA;cAAA,SAAA;AAAA;AAAA,cAKjB,yBAAA,SAAkC,aAAa;EAAA,SAC9B,KAAA;cAAA,KAAA;AAAA;AAAA,cAKjB,wBAAA,SAAiC,aAAa;EAAA,SAC7B,QAAA;cAAA,QAAA;AAAA;AAAA,cAKjB,4BAAA,SAAqC,aAAa;EAAb,WAAA;AAAA;AAAA,cAIrC,qBAAA,SAA8B,aAAa;EAAA,SAC1B,QAAA;cAAA,QAAA;AAAA;AAAA,cAKjB,sBAAA,SAA+B,aAAa;EAAb,WAAA;AAAA;AAAA,cAI/B,oBAAA,SAA6B,aAAa;EAAb,WAAA;AAAA;AAAA,cAI7B,8BAAA,SAAuC,aAAa;EAAb,WAAA;AAAA;AAAA,cAIvC,2BAAA,SAAoC,aAAa;EAAb,WAAA;AAAA;AAAA,cAIpC,yBAAA,SAAkC,aAAa;EAAA,SAC9B,MAAA;cAAA,MAAA;AAAA;AAAA,cAKjB,wBAAA,SAAiC,aAAa;EAAb,WAAA;AAAA;AAAA,cAIjC,iBAAA,SAA0B,aAAa;EAAb,WAAA;AAAA;AAAA,cAI1B,uBAAA,SAAgC,aAAa;EAAb,WAAA;AAAA;AAAA,cAIhC,kBAAA,SAA2B,aAAa;EAAb,WAAA;AAAA;AAAA,cAI3B,yBAAA,SAAkC,aAAa;EAAb,WAAA;AAAA;AAAA,cAIlC,yBAAA,SAAkC,aAAa;EAAb,WAAA;AAAA;AAAA,cAIlC,kBAAA,SAA2B,aAAa;EAAb,WAAA;AAAA;;;cC9G3B,iBAAA,SAA0B,aAAa;EAAb,WAAA;AAAA;;;cCA1B,yBAAA,SAAkC,aAAa;EAAb,WAAA;AAAA;AAAA,cAGlC,+BAAA,SAAwC,aAAa;EAAb,WAAA;AAAA;AAAA,cAGxC,mCAAA,SAA4C,aAAa;EAAb,WAAA;AAAA;AAAA,cAG5C,iCAAA,SAA0C,aAAa;EAAb,WAAA;AAAA;AAAA,cAG1C,4CAAA,SAAqD,aAAa;EAAb,WAAA;AAAA;AAAA,cAGrD,yBAAA,SAAkC,aAAa;EAAb,WAAA;AAAA;AAAA,cAGlC,6BAAA,SAAsC,aAAa;EAAb,WAAA;AAAA;AAAA,cAGtC,2BAAA,SAAoC,aAAa;EAAb,WAAA;AAAA;AAAA,cAGpC,6BAAA,SAAsC,aAAa;EAAb,WAAA;AAAA;AAAA,cAGtC,6BAAA,SAAsC,aAAa;EAAb,WAAA;AAAA;;;cC3BtC,kBAAA,SAA2B,aAAa;EAAb,WAAA;AAAA;;;;;;;;;;;;ANQmB;;;;;;;;;AAUvC;;;;cOSP,WAAA,kBAA6B,iBAAA,GAAoB,iBAAA;EAAA,mBAIjB,OAAA,EAAS,QAAA;EAAA,QAH5C,aAAA;cAGmC,OAAA,EAAS,QAAA;ENwCuB;;;EAAA,IMlCvE,IAAA,IAAQ,IAAA,CAAK,QAAA;AAAA;;;;;;;;;;AP7BwC;;;;cQS9C,6BAAA,YAAyC,UAAA;EAAA,iBAGjC,WAAA;EAAA,QAC4B,MAAA;cAD5B,WAAA,EAAa,WAAA,EACe,MAAA,EAAQ,aAAA;EAGjD,MAAA,CAAO,GAAA,EAAK,aAAA,EAAe,IAAA,EAAM,IAAA,GAAO,OAAA;AAAA;;;;;;;iBCnBhC,qBAAA,IAAyB,iBAAiB;;;;cAe7C,cAAA,MAA2B,EAAA,QAAU,OAAA,CAAQ,CAAA,MAAK,OAAA,CAAQ,CAAA;;;;;;iBCsBvD,kBAAA,CAAmB,KAAA,EAAO,QAAA,GAAW,gBAAgB;;;;;AVlCV;iBUmP3C,UAAA,CAAW,KAAA,YAAiB,KAAA,IAAS,QAAQ"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/context/router-context.augment.ts","../../src/auth/auth.module.ts","../../src/auth/auth.tokens.ts","../../src/auth/errors/auth-errors.ts","../../src/auth/errors/invalid-token.error.ts","../../src/auth/errors/organization-errors.ts","../../src/auth/errors/token-required.error.ts","../../src/auth/services/auth.service.ts","../../src/auth/middleware/session-verification.middleware.ts","../../src/auth/utils/auth-helpers.ts","../../src/auth/utils/better-auth-error-handler.ts"],"mappings":";;;;;;;;;;;YAaY,aAAA;;;;;;;IAOR,IAAA,IAAQ,QAAQ;EAAA;AAAA;;;UCqDH,sBAAA,kBAAwC,iBAAA,GAAoB,iBAAA,UACnE,kBAAA,CAAmB,QAAA;EAWuB;;;;EANlD,aAAA,GAAgB,oBAAA;AAAA;AAAA,cAML,UAAA,YAAsB,iBAAA;EAqBI;;;;;;EAdrC,eAAA,CAAgB,MAAA,EAAQ,MAAA;;;;AC3F1B;;;;AAA8D;AAG9D;;SDsGS,YAAA,kBAA8B,iBAAA,EACnC,OAAA,EAAS,sBAAA,CAAuB,QAAA,IAC/B,aAAA;AAAA;;;;cC3GQ,YAAA;;cAGA,YAAA;;;cCFA,iBAAA,SAA0B,aAAa;EAAA,SACtB,KAAA;cAAA,KAAA;AAAA;AAAA,cAKjB,uBAAA,SAAgC,aAAa;EAAb,WAAA;AAAA;AAAA,cAIhC,oBAAA,SAA6B,aAAa;EAAb,WAAA;AAAA;AAAA,cAI7B,iBAAA,SAA0B,aAAa;EAAA,SACtB,KAAA;cAAA,KAAA;AAAA;AAAA,cAKjB,mBAAA,SAA4B,aAAa;EAAb,WAAA;AAAA;AAAA,cAI5B,yBAAA,SAAkC,aAAa;EAAb,WAAA;AAAA;AAAA,cAIlC,qBAAA,SAA8B,aAAa;EAAA,SAC1B,KAAA;cAAA,KAAA;AAAA;AAAA,cAKjB,qBAAA,SAA8B,aAAa;EAAA,SAC1B,SAAA;cAAA,SAAA;AAAA;AAAA,cAKjB,oBAAA,SAA6B,aAAa;EAAA,SACzB,SAAA;cAAA,SAAA;AAAA;AAAA,cAKjB,yBAAA,SAAkC,aAAa;EAAA,SAC9B,KAAA;cAAA,KAAA;AAAA;AAAA,cAKjB,wBAAA,SAAiC,aAAa;EAAA,SAC7B,QAAA;cAAA,QAAA;AAAA;AAAA,cAKjB,4BAAA,SAAqC,aAAa;EAAb,WAAA;AAAA;AAAA,cAIrC,qBAAA,SAA8B,aAAa;EAAA,SAC1B,QAAA;cAAA,QAAA;AAAA;AAAA,cAKjB,sBAAA,SAA+B,aAAa;EAAb,WAAA;AAAA;AAAA,cAI/B,oBAAA,SAA6B,aAAa;EAAb,WAAA;AAAA;AAAA,cAI7B,8BAAA,SAAuC,aAAa;EAAb,WAAA;AAAA;AAAA,cAIvC,2BAAA,SAAoC,aAAa;EAAb,WAAA;AAAA;AAAA,cAIpC,yBAAA,SAAkC,aAAa;EAAA,SAC9B,MAAA;cAAA,MAAA;AAAA;AAAA,cAKjB,wBAAA,SAAiC,aAAa;EAAb,WAAA;AAAA;AAAA,cAIjC,iBAAA,SAA0B,aAAa;EAAb,WAAA;AAAA;AAAA,cAI1B,uBAAA,SAAgC,aAAa;EAAb,WAAA;AAAA;AAAA,cAIhC,kBAAA,SAA2B,aAAa;EAAb,WAAA;AAAA;AAAA,cAI3B,yBAAA,SAAkC,aAAa;EAAb,WAAA;AAAA;AAAA,cAIlC,yBAAA,SAAkC,aAAa;EAAb,WAAA;AAAA;AAAA,cAIlC,kBAAA,SAA2B,aAAa;EAAb,WAAA;AAAA;;;cClH3B,iBAAA,SAA0B,aAAa;EAAb,WAAA;AAAA;;;cCA1B,yBAAA,SAAkC,aAAa;EAAb,WAAA;AAAA;AAAA,cAGlC,+BAAA,SAAwC,aAAa;EAAb,WAAA;AAAA;AAAA,cAGxC,mCAAA,SAA4C,aAAa;EAAb,WAAA;AAAA;AAAA,cAG5C,iCAAA,SAA0C,aAAa;EAAb,WAAA;AAAA;AAAA,cAG1C,4CAAA,SAAqD,aAAa;EAAb,WAAA;AAAA;AAAA,cAGrD,yBAAA,SAAkC,aAAa;EAAb,WAAA;AAAA;AAAA,cAGlC,6BAAA,SAAsC,aAAa;EAAb,WAAA;AAAA;AAAA,cAGtC,2BAAA,SAAoC,aAAa;EAAb,WAAA;AAAA;AAAA,cAGpC,6BAAA,SAAsC,aAAa;EAAb,WAAA;AAAA;AAAA,cAGtC,6BAAA,SAAsC,aAAa;EAAb,WAAA;AAAA;;;cC3BtC,kBAAA,SAA2B,aAAa;EAAb,WAAA;AAAA;;;;;;;;;;;;ANQmB;;;;;;;;;AAUvC;;;;cOSP,WAAA,kBAA6B,iBAAA,GAAoB,iBAAA;EAAA,mBAIjB,OAAA,EAAS,QAAA;EAAA,QAH5C,aAAA;cAGmC,OAAA,EAAS,QAAA;ENwCuB;;;EAAA,IMlCvE,IAAA,IAAQ,IAAA,CAAK,QAAA;AAAA;;;;;;;;;;AP7BwC;;;;cQS9C,6BAAA,YAAyC,UAAA;EAAA,iBAGjC,WAAA;EAAA,QAC4B,MAAA;cAD5B,WAAA,EAAa,WAAA,EACe,MAAA,EAAQ,aAAA;EAGjD,MAAA,CAAO,GAAA,EAAK,aAAA,EAAe,IAAA,EAAM,IAAA,GAAO,OAAA;AAAA;;;;;;;iBCnBhC,qBAAA,IAAyB,iBAAiB;;;;cAe7C,cAAA,MAA2B,EAAA,QAAU,OAAA,CAAQ,CAAA,MAAK,OAAA,CAAQ,CAAA;;;;;;iBCuBvD,kBAAA,CAAmB,KAAA,EAAO,QAAA,GAAW,gBAAgB;;;;;AVnCV;iBUqP3C,UAAA,CAAW,KAAA,YAAiB,KAAA,IAAS,QAAQ"}

package/dist/auth/index.mjs

@@ -166,6 +166,11 @@ var SessionExpiredError = class extends HttpException {
 		super(401, "Session expired");
 	}
 };
+var FreshSessionRequiredError = class extends HttpException {
+	constructor() {
+		super(403, "Fresh session required");
+	}
+};
 var EmailNotVerifiedError = class extends HttpException {
 	email;
 	constructor(email) {
@@ -363,7 +368,8 @@ function mapBetterAuthError(error) {
 	if (errorCode === "INVALID_EMAIL_OR_PASSWORD") return new InvalidCredentialsError();
 	if (errorCode === "INVALID_PASSWORD") return new InvalidPasswordError();
 	if (errorCode === "INVALID_EMAIL") return new InvalidEmailError();
-	if (errorCode === "SESSION_EXPIRED" || errorCode === "SESSION_NOT_FRESH") return new SessionExpiredError();
+	if (errorCode === "SESSION_EXPIRED") return new SessionExpiredError();
+	if (errorCode === "SESSION_NOT_FRESH") return new FreshSessionRequiredError();
 	if (errorCode === "FAILED_TO_CREATE_SESSION") return new AuthError("Failed to create session");
 	if (errorCode === "FAILED_TO_GET_SESSION") return new AuthError("Failed to retrieve session");
 	if (errorCode === "EMAIL_NOT_VERIFIED") return new EmailNotVerifiedError();
@@ -532,6 +538,6 @@ let AuthModule = _AuthModule = class AuthModule {
 };
 AuthModule = _AuthModule = __decorate([Module({ providers: [AuthContext] })], AuthModule);
 //#endregion
-export { AUTH_OPTIONS, AUTH_SERVICE, AccountAlreadyExistsError, AccountNotFoundError, AuthModule, AuthService, AuthValidationFailedError, CannotUnlinkLastAccountError, CredentialAccountNotFoundError, EmailAlreadyVerifiedError, EmailCannotBeUpdatedError, EmailMismatchError, EmailNotVerifiedError, IdTokenNotSupportedError, InvalidCallbackUrlError, InvalidCredentialsError, InvalidEmailError, InvalidOriginError, InvalidPasswordError, InvalidTokenError, OrganizationConflictError, OrganizationInvitationNotFoundError, OrganizationInvitationRecipientMismatchError, OrganizationLimitReachedError, OrganizationMemberNotFoundError, OrganizationMembershipError, OrganizationNotFoundError, OrganizationPermissionDeniedError, OrganizationRoleNotFoundError, OrganizationTeamNotFoundError, PasswordTooLongError, PasswordTooShortError, ProviderNotFoundError, SessionExpiredError, SessionVerificationMiddleware, SocialAccountLinkedError, TokenExpiredError, TokenRequiredError, UserAlreadyHasPasswordError, UserEmailNotFoundError, UserNotFoundError, getErrorHandlerConfig, isAPIError, mapBetterAuthError, wrapBetterAuth };
+export { AUTH_OPTIONS, AUTH_SERVICE, AccountAlreadyExistsError, AccountNotFoundError, AuthModule, AuthService, AuthValidationFailedError, CannotUnlinkLastAccountError, CredentialAccountNotFoundError, EmailAlreadyVerifiedError, EmailCannotBeUpdatedError, EmailMismatchError, EmailNotVerifiedError, FreshSessionRequiredError, IdTokenNotSupportedError, InvalidCallbackUrlError, InvalidCredentialsError, InvalidEmailError, InvalidOriginError, InvalidPasswordError, InvalidTokenError, OrganizationConflictError, OrganizationInvitationNotFoundError, OrganizationInvitationRecipientMismatchError, OrganizationLimitReachedError, OrganizationMemberNotFoundError, OrganizationMembershipError, OrganizationNotFoundError, OrganizationPermissionDeniedError, OrganizationRoleNotFoundError, OrganizationTeamNotFoundError, PasswordTooLongError, PasswordTooShortError, ProviderNotFoundError, SessionExpiredError, SessionVerificationMiddleware, SocialAccountLinkedError, TokenExpiredError, TokenRequiredError, UserAlreadyHasPasswordError, UserEmailNotFoundError, UserNotFoundError, getErrorHandlerConfig, isAPIError, mapBetterAuthError, wrapBetterAuth };
 
 //# sourceMappingURL=index.mjs.map

package/dist/auth/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../src/context/router-context.augment.ts","../../src/auth/auth.tokens.ts","../../src/auth/middleware/session-verification.middleware.ts","../../src/auth/rate-limit-bridge.ts","../../src/auth/errors/auth-errors.ts","../../src/auth/errors/invalid-token.error.ts","../../src/auth/errors/organization-errors.ts","../../src/auth/errors/token-required.error.ts","../../src/auth/utils/better-auth-error-handler.ts","../../src/auth/utils/auth-helpers.ts","../../src/auth/services/auth.service.ts","../../src/auth/auth.module.ts"],"sourcesContent":["/**\n * Augments Stratal's `RouterContext` with a `user()` accessor backed by the\n * request-scoped {@link AuthContext}.\n *\n * Side-effect import: registers the `user` macro on `RouterContext` and the\n * `declare module` augmentation that exposes it at the type level. Imported by\n * {@link AuthModule} so it runs whenever auth is configured.\n */\nimport { DI_TOKENS } from 'stratal/di'\nimport { RouterContext } from 'stratal/router'\nimport type { AuthContext, AuthUser } from './auth-context'\n\ndeclare module 'stratal/router' {\n  interface RouterContext {\n    /**\n     * The authenticated user for the current request.\n     *\n     * Throws `UserNotAuthenticatedError` if the request is unauthenticated.\n     * Provided by `@stratal/framework`'s `AuthModule` via {@link AuthContext}.\n     */\n    user(): AuthUser\n  }\n}\n\nRouterContext.macro('user', function (this: RouterContext): AuthUser {\n  return this.getContainer().resolve<AuthContext>(DI_TOKENS.AuthContext).requireUser()\n})\n","/** Token for AuthService - core authentication service */\nexport const AUTH_SERVICE = Symbol.for('stratal:auth:service')\n\n/** Token for Better Auth options configuration */\nexport const AUTH_OPTIONS = Symbol.for('stratal:auth:options')\n","import { DI_TOKENS, inject, Transient } from 'stratal/di'\nimport { LOGGER_TOKENS, type LoggerService } from 'stratal/logger'\nimport type { Middleware, Next, RouterContext } from 'stratal/router'\nimport { type AuthContext } from '../../context/auth-context'\nimport { AUTH_SERVICE } from '../auth.tokens'\nimport type { AuthService } from '../services/auth.service'\n\n/**\n * Session Verification Middleware\n *\n * Verifies user session via Better Auth and populates AuthContext with\n * the authenticated user.\n *\n * **Responsibilities:**\n * - Calls Better Auth's getSession() API\n * - Populates AuthContext with the user record if the session is valid\n * - Continues request chain regardless of session status\n */\n@Transient()\nexport class SessionVerificationMiddleware implements Middleware {\n  constructor(\n    @inject(AUTH_SERVICE)\n    private readonly authService: AuthService,\n    @inject(LOGGER_TOKENS.LoggerService) private logger: LoggerService\n  ) { }\n\n  async handle(ctx: RouterContext, next: Next): Promise<void> {\n    try {\n      const result = await this.authService.auth.api.getSession({\n        headers: ctx.c.req.raw.headers\n      })\n\n      if (result) {\n        const authContext = ctx.getContainer().resolve<AuthContext>(DI_TOKENS.AuthContext)\n        authContext.setAuthContext({\n          user: result.user,\n        })\n      }\n    } catch (error: unknown) {\n      this.logger.debug('Session validation failed (e.g., invalidated in DB)', { error })\n    }\n\n    return next()\n  }\n}\n","/**\n * Rate-limit bridge between Stratal's `RateLimiterModule` and better-auth.\n *\n * Importing this file (transitively, via `auth.module.ts`) does two things:\n *\n *  1. Augments `RateLimiterRegistry` with `forPath()` + `pathEntries()` via\n *     Stratal's `Macroable`. Path-keyed rules registered on the same registry\n *     used for Stratal's own throttling are projected into better-auth's\n *     `customRules` by {@link projectCustomRules}.\n *  2. Exports {@link createBetterAuthRateLimitStorage} — adapts Stratal's\n *     {@link IRateLimiterStore} into better-auth's `customStorage`, so both\n *     systems share one backing store.\n *\n * `AuthModule.forRootAsync` wires both automatically when `RateLimiterModule`\n * is imported. Users with explicit `rateLimit.customStorage` /\n * `rateLimit.customRules` keys in their auth factory keep precedence.\n *\n * Frictions, documented for path-keyed entries:\n *\n *  - `Limit.by(...)` is meaningless. Better-auth scopes per-IP+path.\n *  - Multiple `Limit`s reduce to the most restrictive (smallest max-per-second).\n *  - `Limit.none()` projects to `false` (better-auth's \"disable\" sentinel).\n *  - `Limit.response(...)` is a no-op. Better-auth renders its own 429.\n *  - Snapshot caveat: `customRules` is built once at AuthService construction,\n *    so register all `forPath()` entries inside `OnInitialize` hooks.\n */\nimport { type IRateLimiterStore, type Limit, RateLimiterRegistry } from 'stratal/rate-limiter'\n\n/**\n * Resolver attached to a path-keyed limiter entry. Receives the native\n * `Request` (better-auth's customRules invokes us with the live Request)\n * and returns one or more `Limit`s. Async is supported.\n */\nexport type PathLimitResolver = (\n  req: Request,\n) => Limit | Limit[] | Promise<Limit | Limit[]>\n\ninterface BetterAuthRateLimit {\n  key: string\n  count: number\n  lastRequest: number\n}\n\ninterface BetterAuthRateLimitRule {\n  window: number\n  max: number\n}\n\ntype BetterAuthCustomRule =\n  | BetterAuthRateLimitRule\n  | false\n  | ((req: Request) => Promise<BetterAuthRateLimitRule | false>)\n\n// Per-instance path map — keyed by registry so we don't pin GC roots.\nconst pathResolvers = new WeakMap<RateLimiterRegistry, Map<string, PathLimitResolver>>()\n\nfunction getOrCreatePathMap(registry: RateLimiterRegistry): Map<string, PathLimitResolver> {\n  let map = pathResolvers.get(registry)\n  if (!map) {\n    map = new Map()\n    pathResolvers.set(registry, map)\n  }\n  return map\n}\n\nRateLimiterRegistry.macro('forPath', function (\n  this: RateLimiterRegistry,\n  path: string,\n  resolver: PathLimitResolver,\n): void {\n  getOrCreatePathMap(this).set(path, resolver)\n})\n\nRateLimiterRegistry.macro('pathEntries', function (\n  this: RateLimiterRegistry,\n): IterableIterator<[string, PathLimitResolver]> {\n  return (pathResolvers.get(this) ?? new Map<string, PathLimitResolver>()).entries()\n})\n\ndeclare module 'stratal/rate-limiter' {\n  interface RateLimiterRegistry {\n    /**\n     * Register a rate-limit rule for a better-auth path pattern. The rule\n     * is projected into better-auth's `rateLimit.customRules` automatically\n     * when both modules are imported.\n     *\n     * @example\n     * limiter.forPath('/sign-in/email', () => Limit.perSeconds(10, 3))\n     * limiter.forPath('/two-factor/*', async (req) => { ... })\n     * limiter.forPath('/forget-password', () => Limit.none())\n     */\n    forPath(path: string, resolver: PathLimitResolver): void\n\n    /**\n     * Iterate every path-keyed entry registered via `forPath`. Used by the\n     * auth bridge to project entries into better-auth's `customRules`.\n     */\n    pathEntries(): IterableIterator<[string, PathLimitResolver]>\n  }\n}\n\n// Better-auth manages window expiry itself by reading `lastRequest`. We still\n// need a TTL on the underlying KV so dead records don't accumulate. 1 day\n// covers any reasonable better-auth window without colliding with the next.\nconst BETTER_AUTH_TTL_SECONDS = 86_400\nconst BETTER_AUTH_KEY_PREFIX = 'ba-rl:'\n\n/**\n * Adapt Stratal's `IRateLimiterStore` into better-auth's `customStorage` shape.\n * Better-auth supplies its own `RateLimit` records (`{ key, count, lastRequest }`);\n * the adapter just persists them under a separate key namespace.\n */\nexport function createBetterAuthRateLimitStorage(store: IRateLimiterStore): {\n  get: (key: string) => Promise<BetterAuthRateLimit | null>\n  set: (key: string, value: BetterAuthRateLimit, update?: boolean) => Promise<void>\n} {\n  return {\n    async get(key) {\n      return await store.get<BetterAuthRateLimit>(`${BETTER_AUTH_KEY_PREFIX}${key}`)\n    },\n    async set(key, value, _update) {\n      await store.set(`${BETTER_AUTH_KEY_PREFIX}${key}`, value, BETTER_AUTH_TTL_SECONDS)\n    },\n  }\n}\n\n/**\n * Project every `forPath` entry on the registry into better-auth's\n * `customRules` shape. Each entry becomes an async function that resolves\n * the user's `Limit`(s) and reduces them to a single `{ window, max }` pair\n * (or `false` for `Limit.none()`).\n *\n * Multi-`Limit` reduction picks the most restrictive — smallest\n * `max / windowSeconds` ratio; ties favour the first.\n */\nexport function projectCustomRules(\n  registry: RateLimiterRegistry,\n): Record<string, BetterAuthCustomRule> {\n  const rules: Record<string, BetterAuthCustomRule> = {}\n\n  for (const [path, resolver] of registry.pathEntries()) {\n    rules[path] = async (req: Request): Promise<BetterAuthRateLimitRule | false> => {\n      const resolved = await resolver(req)\n      const candidates = (Array.isArray(resolved) ? resolved : [resolved]).filter((l) => !l.disabled)\n      if (candidates.length === 0) return false\n\n      const chosen = candidates.reduce((a, b) =>\n        a.max / a.windowSeconds <= b.max / b.windowSeconds ? a : b,\n      )\n\n      return { window: chosen.windowSeconds, max: chosen.max }\n    }\n  }\n\n  return rules\n}\n","import { HttpException } from 'stratal/errors'\n\nexport class UserNotFoundError extends HttpException {\n  constructor(public readonly email?: string) {\n    super(404, 'User not found')\n  }\n}\n\nexport class InvalidCredentialsError extends HttpException {\n  constructor() { super(401, 'Invalid email or password') }\n}\n\nexport class InvalidPasswordError extends HttpException {\n  constructor() { super(401, 'Invalid password') }\n}\n\nexport class InvalidEmailError extends HttpException {\n  constructor(public readonly email?: string) {\n    super(422, 'Invalid email address')\n  }\n}\n\nexport class SessionExpiredError extends HttpException {\n  constructor() { super(401, 'Session expired') }\n}\n\nexport class EmailNotVerifiedError extends HttpException {\n  constructor(public readonly email?: string) {\n    super(403, 'Email not verified')\n  }\n}\n\nexport class PasswordTooShortError extends HttpException {\n  constructor(public readonly minLength?: number) {\n    super(422, 'Password too short')\n  }\n}\n\nexport class PasswordTooLongError extends HttpException {\n  constructor(public readonly maxLength?: number) {\n    super(422, 'Password too long')\n  }\n}\n\nexport class AccountAlreadyExistsError extends HttpException {\n  constructor(public readonly email?: string) {\n    super(409, 'Account already exists')\n  }\n}\n\nexport class SocialAccountLinkedError extends HttpException {\n  constructor(public readonly provider?: string) {\n    super(409, 'Social account already linked')\n  }\n}\n\nexport class CannotUnlinkLastAccountError extends HttpException {\n  constructor() { super(409, 'Cannot unlink last account') }\n}\n\nexport class ProviderNotFoundError extends HttpException {\n  constructor(public readonly provider?: string) {\n    super(404, 'Authentication provider not found')\n  }\n}\n\nexport class UserEmailNotFoundError extends HttpException {\n  constructor() { super(404, 'User email not found') }\n}\n\nexport class AccountNotFoundError extends HttpException {\n  constructor() { super(404, 'Account not found') }\n}\n\nexport class CredentialAccountNotFoundError extends HttpException {\n  constructor() { super(404, 'Credential account not found') }\n}\n\nexport class UserAlreadyHasPasswordError extends HttpException {\n  constructor() { super(409, 'User already has a password') }\n}\n\nexport class EmailCannotBeUpdatedError extends HttpException {\n  constructor(public readonly reason?: string) {\n    super(422, 'Email cannot be updated')\n  }\n}\n\nexport class IdTokenNotSupportedError extends HttpException {\n  constructor() { super(422, 'ID token not supported') }\n}\n\nexport class TokenExpiredError extends HttpException {\n  constructor() { super(401, 'Token expired') }\n}\n\nexport class InvalidCallbackUrlError extends HttpException {\n  constructor() { super(422, 'Invalid callback URL') }\n}\n\nexport class InvalidOriginError extends HttpException {\n  constructor() { super(403, 'Invalid request origin') }\n}\n\nexport class AuthValidationFailedError extends HttpException {\n  constructor() { super(422, 'Authentication validation failed') }\n}\n\nexport class EmailAlreadyVerifiedError extends HttpException {\n  constructor() { super(409, 'Email already verified') }\n}\n\nexport class EmailMismatchError extends HttpException {\n  constructor() { super(422, 'Email mismatch') }\n}\n","import { HttpException } from 'stratal/errors'\n\nexport class InvalidTokenError extends HttpException {\n  constructor() { super(401, 'Invalid or expired token') }\n}\n","import { HttpException } from 'stratal/errors'\n\nexport class OrganizationNotFoundError extends HttpException {\n  constructor() { super(404, 'Organization not found') }\n}\nexport class OrganizationMemberNotFoundError extends HttpException {\n  constructor() { super(404, 'Organization member not found') }\n}\nexport class OrganizationInvitationNotFoundError extends HttpException {\n  constructor() { super(404, 'Invitation not found') }\n}\nexport class OrganizationPermissionDeniedError extends HttpException {\n  constructor() { super(403, 'Organization permission denied') }\n}\nexport class OrganizationInvitationRecipientMismatchError extends HttpException {\n  constructor() { super(403, 'Invitation recipient mismatch') }\n}\nexport class OrganizationConflictError extends HttpException {\n  constructor() { super(409, 'Organization resource conflict') }\n}\nexport class OrganizationLimitReachedError extends HttpException {\n  constructor() { super(422, 'Organization limit reached') }\n}\nexport class OrganizationMembershipError extends HttpException {\n  constructor() { super(422, 'Organization membership constraint violated') }\n}\nexport class OrganizationTeamNotFoundError extends HttpException {\n  constructor() { super(404, 'Team not found') }\n}\nexport class OrganizationRoleNotFoundError extends HttpException {\n  constructor() { super(404, 'Role not found') }\n}\n","import { HttpException } from 'stratal/errors'\n\nexport class TokenRequiredError extends HttpException {\n  constructor() { super(401, 'Verification token is required') }\n}\n","import { APIError } from 'better-auth/api'\nimport { AuthError } from 'stratal/errors'\nimport type { ApplicationError } from 'stratal/errors'\nimport {\n  AccountAlreadyExistsError,\n  AccountNotFoundError,\n  AuthValidationFailedError,\n  CannotUnlinkLastAccountError,\n  CredentialAccountNotFoundError,\n  EmailAlreadyVerifiedError,\n  EmailCannotBeUpdatedError,\n  EmailMismatchError,\n  EmailNotVerifiedError,\n  IdTokenNotSupportedError,\n  InvalidCallbackUrlError,\n  InvalidCredentialsError,\n  InvalidEmailError,\n  InvalidOriginError,\n  InvalidPasswordError,\n  InvalidTokenError,\n  OrganizationConflictError,\n  OrganizationInvitationNotFoundError,\n  OrganizationInvitationRecipientMismatchError,\n  OrganizationLimitReachedError,\n  OrganizationMemberNotFoundError,\n  OrganizationMembershipError,\n  OrganizationNotFoundError,\n  OrganizationPermissionDeniedError,\n  OrganizationRoleNotFoundError,\n  OrganizationTeamNotFoundError,\n  PasswordTooLongError,\n  PasswordTooShortError,\n  ProviderNotFoundError,\n  SessionExpiredError,\n  SocialAccountLinkedError,\n  TokenExpiredError,\n  UserAlreadyHasPasswordError,\n  UserEmailNotFoundError,\n  UserNotFoundError,\n} from '../errors'\n\n/**\n * Maps Better Auth API error codes to ApplicationError instances.\n */\nexport function mapBetterAuthError(error: APIError): ApplicationError {\n  const errorCode = error.body?.code\n\n  if (error.status === 'FOUND') {\n    const headers = error.headers as Headers\n    const location = headers.get('location') ?? ''\n\n    if (location.includes('INVALID_TOKEN')) return new InvalidTokenError()\n    if (location.includes('EXPIRED_TOKEN')) return new TokenExpiredError()\n    if (location.includes('ATTEMPTS_EXCEEDED')) return new InvalidTokenError()\n    if (location.includes('new_user_signup_disabled')) return new UserNotFoundError()\n    if (location.includes('failed_to_create_user')) return new AuthError('Failed to create user')\n    if (location.includes('failed_to_create_session')) return new AuthError('Failed to create session')\n  }\n\n  if (!errorCode) {\n    return new AuthError('An authentication error occurred')\n  }\n\n  // ── Base Error Codes ──────────────────────────────────────────────────\n\n  // User errors\n  if (errorCode === 'USER_NOT_FOUND' || errorCode === 'INVALID_USER') return new UserNotFoundError()\n  if (errorCode === 'USER_EMAIL_NOT_FOUND') return new UserEmailNotFoundError()\n\n  // Credential errors\n  if (errorCode === 'INVALID_EMAIL_OR_PASSWORD') return new InvalidCredentialsError()\n  if (errorCode === 'INVALID_PASSWORD') return new InvalidPasswordError()\n  if (errorCode === 'INVALID_EMAIL') return new InvalidEmailError()\n\n  // Session errors\n  if (errorCode === 'SESSION_EXPIRED' || errorCode === 'SESSION_NOT_FRESH') return new SessionExpiredError()\n  if (errorCode === 'FAILED_TO_CREATE_SESSION') return new AuthError('Failed to create session')\n  if (errorCode === 'FAILED_TO_GET_SESSION') return new AuthError('Failed to retrieve session')\n\n  // Email verification\n  if (errorCode === 'EMAIL_NOT_VERIFIED') return new EmailNotVerifiedError()\n  if (errorCode === 'EMAIL_CAN_NOT_BE_UPDATED') return new EmailCannotBeUpdatedError()\n  if (errorCode === 'EMAIL_ALREADY_VERIFIED') return new EmailAlreadyVerifiedError()\n  if (errorCode === 'EMAIL_MISMATCH') return new EmailMismatchError()\n\n  // Password validation\n  if (errorCode === 'PASSWORD_TOO_SHORT') return new PasswordTooShortError(8)\n  if (errorCode === 'PASSWORD_TOO_LONG') return new PasswordTooLongError(128)\n\n  // Account errors\n  if (errorCode === 'USER_ALREADY_EXISTS' || errorCode === 'USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL') {\n    return new AccountAlreadyExistsError()\n  }\n  if (errorCode === 'ACCOUNT_NOT_FOUND') return new AccountNotFoundError()\n  if (errorCode === 'CREDENTIAL_ACCOUNT_NOT_FOUND') return new CredentialAccountNotFoundError()\n  if (errorCode === 'FAILED_TO_UNLINK_LAST_ACCOUNT') return new CannotUnlinkLastAccountError()\n\n  // User creation/update errors\n  if (errorCode === 'FAILED_TO_CREATE_USER') return new AuthError('Failed to create user')\n  if (errorCode === 'FAILED_TO_UPDATE_USER') return new AuthError('Failed to update user')\n  if (errorCode === 'FAILED_TO_GET_USER_INFO') return new AuthError('Failed to retrieve user info')\n\n  // Social account errors\n  if (errorCode === 'SOCIAL_ACCOUNT_ALREADY_LINKED' || errorCode === 'LINKED_ACCOUNT_ALREADY_EXISTS') {\n    return new SocialAccountLinkedError()\n  }\n  if (errorCode === 'PROVIDER_NOT_FOUND') return new ProviderNotFoundError()\n\n  // Token errors\n  if (errorCode === 'ID_TOKEN_NOT_SUPPORTED') return new IdTokenNotSupportedError()\n  if (errorCode === 'INVALID_TOKEN') return new InvalidTokenError()\n  if (errorCode === 'TOKEN_EXPIRED') return new TokenExpiredError()\n\n  // Password management\n  if (errorCode === 'USER_ALREADY_HAS_PASSWORD' || errorCode === 'PASSWORD_ALREADY_SET') {\n    return new UserAlreadyHasPasswordError()\n  }\n\n  // Callback/redirect URL errors\n  if (\n    errorCode === 'INVALID_CALLBACK_URL'\n    || errorCode === 'INVALID_REDIRECT_URL'\n    || errorCode === 'INVALID_NEW_USER_CALLBACK_URL'\n    || errorCode === 'INVALID_ERROR_CALLBACK_URL'\n    || errorCode === 'CALLBACK_URL_REQUIRED'\n  ) {\n    return new InvalidCallbackUrlError()\n  }\n\n  // Origin/CORS errors\n  if (\n    errorCode === 'INVALID_ORIGIN'\n    || errorCode === 'MISSING_OR_NULL_ORIGIN'\n    || errorCode === 'CROSS_SITE_NAVIGATION_LOGIN_BLOCKED'\n  ) {\n    return new InvalidOriginError()\n  }\n\n  // Validation errors\n  if (\n    errorCode === 'VALIDATION_ERROR'\n    || errorCode === 'MISSING_FIELD'\n    || errorCode === 'FIELD_NOT_ALLOWED'\n    || errorCode === 'BODY_MUST_BE_AN_OBJECT'\n    || errorCode === 'ASYNC_VALIDATION_NOT_SUPPORTED'\n    || errorCode === 'METHOD_NOT_ALLOWED_DEFER_SESSION_REQUIRED'\n  ) {\n    return new AuthValidationFailedError()\n  }\n\n  // Verification errors\n  if (errorCode === 'FAILED_TO_CREATE_VERIFICATION' || errorCode === 'VERIFICATION_EMAIL_NOT_ENABLED') {\n    return new AuthError('Failed to create session')\n  }\n\n  // ── Organization Plugin Error Codes ───────────────────────────────────\n\n  // Organization not found\n  if (errorCode === 'ORGANIZATION_NOT_FOUND' || errorCode === 'NO_ACTIVE_ORGANIZATION') {\n    return new OrganizationNotFoundError()\n  }\n\n  // Member not found\n  if (\n    errorCode === 'MEMBER_NOT_FOUND'\n    || errorCode === 'USER_IS_NOT_A_MEMBER_OF_THE_ORGANIZATION'\n    || errorCode === 'USER_IS_NOT_A_MEMBER_OF_THE_TEAM'\n  ) {\n    return new OrganizationMemberNotFoundError()\n  }\n\n  // Invitation not found\n  if (errorCode === 'INVITATION_NOT_FOUND' || errorCode === 'FAILED_TO_RETRIEVE_INVITATION') {\n    return new OrganizationInvitationNotFoundError()\n  }\n\n  // Invitation recipient mismatch\n  if (\n    errorCode === 'YOU_ARE_NOT_THE_RECIPIENT_OF_THE_INVITATION'\n    || errorCode === 'EMAIL_VERIFICATION_REQUIRED_BEFORE_ACCEPTING_OR_REJECTING_INVITATION'\n  ) {\n    return new OrganizationInvitationRecipientMismatchError()\n  }\n\n  // Team not found\n  if (errorCode === 'TEAM_NOT_FOUND' || errorCode === 'YOU_DO_NOT_HAVE_AN_ACTIVE_TEAM') {\n    return new OrganizationTeamNotFoundError()\n  }\n\n  // Role not found\n  if (errorCode === 'ROLE_NOT_FOUND' || errorCode === 'INVALID_RESOURCE') {\n    return new OrganizationRoleNotFoundError()\n  }\n\n  // Organization conflict/already exists\n  if (\n    errorCode === 'ORGANIZATION_ALREADY_EXISTS'\n    || errorCode === 'ORGANIZATION_SLUG_ALREADY_TAKEN'\n    || errorCode === 'USER_IS_ALREADY_A_MEMBER_OF_THIS_ORGANIZATION'\n    || errorCode === 'USER_IS_ALREADY_INVITED_TO_THIS_ORGANIZATION'\n    || errorCode === 'TEAM_ALREADY_EXISTS'\n    || errorCode === 'ROLE_NAME_IS_ALREADY_TAKEN'\n  ) {\n    return new OrganizationConflictError()\n  }\n\n  // Organization limit reached\n  if (\n    errorCode === 'YOU_HAVE_REACHED_THE_MAXIMUM_NUMBER_OF_ORGANIZATIONS'\n    || errorCode === 'YOU_HAVE_REACHED_THE_MAXIMUM_NUMBER_OF_TEAMS'\n    || errorCode === 'ORGANIZATION_MEMBERSHIP_LIMIT_REACHED'\n    || errorCode === 'INVITATION_LIMIT_REACHED'\n    || errorCode === 'TEAM_MEMBER_LIMIT_REACHED'\n    || errorCode === 'TOO_MANY_ROLES'\n  ) {\n    return new OrganizationLimitReachedError()\n  }\n\n  // Organization membership constraints\n  if (\n    errorCode === 'YOU_CANNOT_LEAVE_THE_ORGANIZATION_AS_THE_ONLY_OWNER'\n    || errorCode === 'YOU_CANNOT_LEAVE_THE_ORGANIZATION_WITHOUT_AN_OWNER'\n    || errorCode === 'UNABLE_TO_REMOVE_LAST_TEAM'\n    || errorCode === 'CANNOT_DELETE_A_PRE_DEFINED_ROLE'\n    || errorCode === 'ROLE_IS_ASSIGNED_TO_MEMBERS'\n    || errorCode === 'YOU_CANNOT_IMPERSONATE_ADMINS'\n    || errorCode === 'YOU_CANNOT_BAN_YOURSELF'\n    || errorCode === 'YOU_CANNOT_REMOVE_YOURSELF'\n    || errorCode === 'INVITER_IS_NO_LONGER_A_MEMBER_OF_THE_ORGANIZATION'\n  ) {\n    return new OrganizationMembershipError()\n  }\n\n  // Organization permission denied (catch-all for YOU_ARE_NOT_ALLOWED_TO_* patterns)\n  if (\n    errorCode.startsWith('YOU_ARE_NOT_ALLOWED_TO_')\n    || errorCode === 'YOU_ARE_NOT_A_MEMBER_OF_THIS_ORGANIZATION'\n    || errorCode === 'YOU_CAN_NOT_ACCESS_THE_MEMBERS_OF_THIS_TEAM'\n    || errorCode === 'YOU_MUST_BE_IN_AN_ORGANIZATION_TO_CREATE_A_ROLE'\n    || errorCode === 'MISSING_AC_INSTANCE'\n  ) {\n    return new OrganizationPermissionDeniedError()\n  }\n\n  // Unknown error code\n  return new AuthError('An authentication error occurred')\n}\n\n/**\n * Type guard to check if an error is a Better Auth APIError.\n * Uses duck typing to handle bundler environments (e.g. Vite)\n * where instanceof may fail across module boundaries.\n */\nexport function isAPIError(error: unknown): error is APIError {\n  if (error instanceof APIError) return true\n\n  return (\n    error instanceof Error\n    && error.name === 'APIError'\n    && 'status' in error\n    && 'statusCode' in error\n  )\n}\n","import type { BetterAuthOptions } from 'better-auth'\nimport { isAPIError, mapBetterAuthError } from './better-auth-error-handler'\n\n/**\n * Get shared Better Auth error handler configuration.\n * Use this in Better Auth config's onAPIError option.\n */\nexport function getErrorHandlerConfig(): BetterAuthOptions['onAPIError'] {\n  return {\n    throw: false,\n    onError: (error) => {\n      if (isAPIError(error)) {\n        throw mapBetterAuthError(error)\n      }\n      throw error\n    },\n  }\n}\n\n/**\n * Wrap a Better Auth function in a try/catch block and map errors to ApplicationError.\n */\nexport const wrapBetterAuth = async <T>(fn: () => Promise<T>): Promise<T> => {\n  try {\n    return await fn()\n  } catch (error) {\n    if (isAPIError(error)) {\n      throw mapBetterAuthError(error)\n    }\n    throw error\n  }\n}\n","import type { Auth, BetterAuthOptions } from 'better-auth';\nimport { betterAuth } from 'better-auth/minimal';\nimport { inject, Request } from 'stratal/di';\nimport { AUTH_OPTIONS, AUTH_SERVICE } from '../auth.tokens';\nimport { getErrorHandlerConfig } from '../utils';\n\n/**\n * AuthService\n *\n * Base authentication service using Better Auth.\n * Configured via AuthModule.forRootAsync() from the application layer.\n *\n * **Extensibility:**\n * Extend this class to add custom methods. Subclasses inherit\n * `@Request(AUTH_SERVICE)` scope automatically — no decorator needed.\n *\n * @example\n * ```typescript\n * @Request(AUTH_SERVICE)\n * export class AppAuthService extends AuthService<AuthOptions> {\n *   async signInMagicLink(email: string) {\n *     return wrapBetterAuth(async () => {\n *       return this.auth.api.signInMagicLink({ body: { email }, headers: new Headers() })\n *     })\n *   }\n * }\n * ```\n */\n@Request(AUTH_SERVICE)\nexport class AuthService<TOptions extends BetterAuthOptions = BetterAuthOptions> {\n  private _authInstance?: Auth<TOptions>\n\n  constructor(\n    @inject(AUTH_OPTIONS) protected readonly options: TOptions\n  ) {}\n\n  /**\n   * Get the Better Auth instance.\n   */\n  get auth(): Auth<TOptions> {\n    this._authInstance ??= betterAuth({\n        ...this.options,\n        onAPIError: getErrorHandlerConfig()\n    }) as Auth<TOptions>;\n\n    return this._authInstance\n  }\n}\n","/**\n * Auth Module\n *\n * Provides configurable authentication using Better Auth.\n * Use `forRootAsync` to configure Better Auth options from the application layer.\n *\n * Optionally pass `accessControl` to enable permission-based authorization.\n * This auto-adds the Stratal AC plugin to Better Auth and registers `AccessService`.\n *\n * @example Without access control\n * ```typescript\n * @Module({\n *   imports: [\n *     AuthModule.forRootAsync({\n *       inject: [DI_TOKENS.Database, CONFIG_TOKENS.ConfigService],\n *       useFactory: (db, config) => createAuthOptions(db, config)\n *     })\n *   ]\n * })\n * export class AppModule {}\n * ```\n *\n * @example With access control\n * ```typescript\n * import { createAccessControl } from '@stratal/framework/access-control'\n * import { admin } from 'better-auth/plugins'\n *\n * const permissions = createAccessControl({\n *   resources: { posts: ['create', 'read', 'update', 'delete'] } as const,\n *   roles: { admin: { posts: ['create', 'read', 'update', 'delete'] }, user: { posts: ['read'] } },\n * })\n *\n * @Module({\n *   imports: [\n *     AuthModule.forRootAsync({\n *       inject: [DI_TOKENS.Database],\n *       useFactory: (db) => ({\n *         database: ...,\n *         plugins: [admin({ ...permissions })],\n *       }),\n *       accessControl: permissions,\n *     })\n *   ]\n * })\n * ```\n */\n\nimport type { BetterAuthOptions } from 'better-auth'\nimport { CONTAINER_TOKEN, type Container } from 'stratal/di'\nimport type { AsyncModuleOptions, DynamicModule } from 'stratal/module'\nimport { Module } from 'stratal/module'\nimport type { IRateLimiterStore, RateLimiterRegistry } from 'stratal/rate-limiter'\nimport { RATE_LIMITER_TOKENS } from 'stratal/rate-limiter'\nimport type { RouteConfigurable, Router } from 'stratal/router'\nimport { createStratalAcPlugin } from '../access-control/plugin'\nimport { AccessService } from '../access-control/services/access.service'\nimport { AC_TOKENS } from '../access-control/tokens'\nimport type { AccessControlOptions } from '../access-control/types'\nimport { AuthContext } from '../context/auth-context'\n// Side-effect import: registers the `user()` macro on `RouterContext` and its\n// type augmentation, backed by the request-scoped `AuthContext`.\nimport '../context/router-context.augment'\nimport { AUTH_OPTIONS, AUTH_SERVICE } from './auth.tokens'\nimport { SessionVerificationMiddleware } from './middleware/session-verification.middleware'\n// Side-effect import: registers `forPath`/`pathEntries` macros on\n// `RateLimiterRegistry` and the `declare module` augmentation that exposes\n// them at the type level. Must run before any consumer calls `forPath()`.\nimport {\n  createBetterAuthRateLimitStorage,\n  projectCustomRules,\n} from './rate-limit-bridge'\nimport { AuthService } from './services/auth.service'\n\nexport interface AuthModuleAsyncOptions<TOptions extends BetterAuthOptions = BetterAuthOptions>\n  extends AsyncModuleOptions<TOptions> {\n  /**\n   * Optional access control configuration.\n   * When provided, registers AccessService and auto-adds the Stratal AC plugin to Better Auth.\n   */\n  accessControl?: AccessControlOptions\n}\n\n@Module({\n  providers: [AuthContext]\n})\nexport class AuthModule implements RouteConfigurable {\n  /**\n   * Configure auth middleware globally.\n   *\n   * SessionVerificationMiddleware verifies the session and populates the\n   * request-scoped AuthContext with the authenticated user.\n   */\n  configureRoutes(router: Router): void {\n    router.use(SessionVerificationMiddleware)\n  }\n\n  /**\n   * Configure AuthModule with async options factory.\n   * Optionally provide `accessControl` to enable permission-based authorization.\n   *\n   * When `RateLimiterModule` is also imported, better-auth's `rateLimit`\n   * block is auto-wired: `customStorage` shares Stratal's backing store, and\n   * any `RateLimiterRegistry.forPath(...)` entries are projected into\n   * `customRules`. User-supplied `rateLimit.{customStorage, customRules}` keys\n   * take precedence on a per-key basis.\n   */\n  static forRootAsync<TOptions extends BetterAuthOptions>(\n    options: AuthModuleAsyncOptions<TOptions>\n  ): DynamicModule {\n    const { accessControl } = options\n    const userInject = options.inject ?? []\n    const userFactory = options.useFactory as (...args: unknown[]) => TOptions\n\n    const authOptionsProvider = {\n      provide: AUTH_OPTIONS,\n      useFactory: (container: Container, ...userDeps: unknown[]): BetterAuthOptions => {\n        let raw = userFactory(...userDeps) as BetterAuthOptions\n\n        if (accessControl) {\n          raw = {\n            ...raw,\n            plugins: [createStratalAcPlugin(accessControl), ...(raw.plugins ?? [])],\n          }\n        }\n\n        const rateLimiterPresent = container.isRegistered(\n          RATE_LIMITER_TOKENS.ModuleMarker,\n        )\n\n        if (rateLimiterPresent) {\n          const store = container.resolve<IRateLimiterStore>(RATE_LIMITER_TOKENS.Store)\n          const registry = container.resolve<RateLimiterRegistry>(RATE_LIMITER_TOKENS.Registry)\n\n          raw = {\n            ...raw,\n            rateLimit: {\n              enabled: true,\n              ...raw.rateLimit,\n              customStorage: raw.rateLimit?.customStorage ?? createBetterAuthRateLimitStorage(store),\n              customRules: {\n                ...projectCustomRules(registry),\n                ...(raw.rateLimit?.customRules ?? {}),\n              },\n            },\n          }\n        }\n\n        return raw\n      },\n      inject: [CONTAINER_TOKEN, ...userInject],\n    }\n\n    return {\n      module: AuthModule,\n      providers: [\n        authOptionsProvider,\n        {\n          provide: AUTH_SERVICE,\n          useClass: AuthService,\n        },\n        ...(accessControl\n          ? [\n            { provide: AC_TOKENS.Options, useValue: accessControl as unknown as object },\n            { provide: AC_TOKENS.AccessService, useClass: AccessService },\n          ]\n          : []),\n      ],\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAwBA,cAAc,MAAM,QAAQ,WAAyC;CACnE,OAAO,KAAK,aAAa,EAAE,QAAqB,UAAU,WAAW,EAAE,YAAY;AACrF,CAAC;;;;ACzBD,MAAa,eAAe,OAAO,IAAI,sBAAsB;;AAG7D,MAAa,eAAe,OAAO,IAAI,sBAAsB;;;ACetD,IAAA,gCAAA,MAAM,8BAAoD;CAG5C;CAC4B;CAH/C,YACE,aAEA,QACA;EAFiB,KAAA,cAAA;EAC4B,KAAA,SAAA;CAC3C;CAEJ,MAAM,OAAO,KAAoB,MAA2B;EAC1D,IAAI;GACF,MAAM,SAAS,MAAM,KAAK,YAAY,KAAK,IAAI,WAAW,EACxD,SAAS,IAAI,EAAE,IAAI,IAAI,QACzB,CAAC;GAED,IAAI,QAEF,IADwB,aAAa,EAAE,QAAqB,UAAU,WAC5D,EAAE,eAAe,EACzB,MAAM,OAAO,KACf,CAAC;EAEL,SAAS,OAAgB;GACvB,KAAK,OAAO,MAAM,uDAAuD,EAAE,MAAM,CAAC;EACpF;EAEA,OAAO,KAAK;CACd;AACF;;CA1BC,UAAU;oBAGN,OAAO,YAAY,CAAA;oBAEnB,OAAO,cAAc,aAAa,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC+BvC,MAAM,gCAAgB,IAAI,QAA6D;AAEvF,SAAS,mBAAmB,UAA+D;CACzF,IAAI,MAAM,cAAc,IAAI,QAAQ;CACpC,IAAI,CAAC,KAAK;EACR,sBAAM,IAAI,IAAI;EACd,cAAc,IAAI,UAAU,GAAG;CACjC;CACA,OAAO;AACT;AAEA,oBAAoB,MAAM,WAAW,SAEnC,MACA,UACM;CACN,mBAAmB,IAAI,EAAE,IAAI,MAAM,QAAQ;AAC7C,CAAC;AAED,oBAAoB,MAAM,eAAe,WAEQ;CAC/C,QAAQ,cAAc,IAAI,IAAI,qBAAK,IAAI,IAA+B,GAAG,QAAQ;AACnF,CAAC;AA2BD,MAAM,0BAA0B;AAChC,MAAM,yBAAyB;;;;;;AAO/B,SAAgB,iCAAiC,OAG/C;CACA,OAAO;EACL,MAAM,IAAI,KAAK;GACb,OAAO,MAAM,MAAM,IAAyB,GAAG,yBAAyB,KAAK;EAC/E;EACA,MAAM,IAAI,KAAK,OAAO,SAAS;GAC7B,MAAM,MAAM,IAAI,GAAG,yBAAyB,OAAO,OAAO,uBAAuB;EACnF;CACF;AACF;;;;;;;;;;AAWA,SAAgB,mBACd,UACsC;CACtC,MAAM,QAA8C,CAAC;CAErD,KAAK,MAAM,CAAC,MAAM,aAAa,SAAS,YAAY,GAClD,MAAM,QAAQ,OAAO,QAA2D;EAC9E,MAAM,WAAW,MAAM,SAAS,GAAG;EACnC,MAAM,cAAc,MAAM,QAAQ,QAAQ,IAAI,WAAW,CAAC,QAAQ,GAAG,QAAQ,MAAM,CAAC,EAAE,QAAQ;EAC9F,IAAI,WAAW,WAAW,GAAG,OAAO;EAEpC,MAAM,SAAS,WAAW,QAAQ,GAAG,MACnC,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,gBAAgB,IAAI,CAC3D;EAEA,OAAO;GAAE,QAAQ,OAAO;GAAe,KAAK,OAAO;EAAI;CACzD;CAGF,OAAO;AACT;;;ACzJA,IAAa,oBAAb,cAAuC,cAAc;CACvB;CAA5B,YAAY,OAAgC;EAC1C,MAAM,KAAK,gBAAgB;EADD,KAAA,QAAA;CAE5B;AACF;AAEA,IAAa,0BAAb,cAA6C,cAAc;CACzD,cAAc;EAAE,MAAM,KAAK,2BAA2B;CAAE;AAC1D;AAEA,IAAa,uBAAb,cAA0C,cAAc;CACtD,cAAc;EAAE,MAAM,KAAK,kBAAkB;CAAE;AACjD;AAEA,IAAa,oBAAb,cAAuC,cAAc;CACvB;CAA5B,YAAY,OAAgC;EAC1C,MAAM,KAAK,uBAAuB;EADR,KAAA,QAAA;CAE5B;AACF;AAEA,IAAa,sBAAb,cAAyC,cAAc;CACrD,cAAc;EAAE,MAAM,KAAK,iBAAiB;CAAE;AAChD;AAEA,IAAa,wBAAb,cAA2C,cAAc;CAC3B;CAA5B,YAAY,OAAgC;EAC1C,MAAM,KAAK,oBAAoB;EADL,KAAA,QAAA;CAE5B;AACF;AAEA,IAAa,wBAAb,cAA2C,cAAc;CAC3B;CAA5B,YAAY,WAAoC;EAC9C,MAAM,KAAK,oBAAoB;EADL,KAAA,YAAA;CAE5B;AACF;AAEA,IAAa,uBAAb,cAA0C,cAAc;CAC1B;CAA5B,YAAY,WAAoC;EAC9C,MAAM,KAAK,mBAAmB;EADJ,KAAA,YAAA;CAE5B;AACF;AAEA,IAAa,4BAAb,cAA+C,cAAc;CAC/B;CAA5B,YAAY,OAAgC;EAC1C,MAAM,KAAK,wBAAwB;EADT,KAAA,QAAA;CAE5B;AACF;AAEA,IAAa,2BAAb,cAA8C,cAAc;CAC9B;CAA5B,YAAY,UAAmC;EAC7C,MAAM,KAAK,+BAA+B;EADhB,KAAA,WAAA;CAE5B;AACF;AAEA,IAAa,+BAAb,cAAkD,cAAc;CAC9D,cAAc;EAAE,MAAM,KAAK,4BAA4B;CAAE;AAC3D;AAEA,IAAa,wBAAb,cAA2C,cAAc;CAC3B;CAA5B,YAAY,UAAmC;EAC7C,MAAM,KAAK,mCAAmC;EADpB,KAAA,WAAA;CAE5B;AACF;AAEA,IAAa,yBAAb,cAA4C,cAAc;CACxD,cAAc;EAAE,MAAM,KAAK,sBAAsB;CAAE;AACrD;AAEA,IAAa,uBAAb,cAA0C,cAAc;CACtD,cAAc;EAAE,MAAM,KAAK,mBAAmB;CAAE;AAClD;AAEA,IAAa,iCAAb,cAAoD,cAAc;CAChE,cAAc;EAAE,MAAM,KAAK,8BAA8B;CAAE;AAC7D;AAEA,IAAa,8BAAb,cAAiD,cAAc;CAC7D,cAAc;EAAE,MAAM,KAAK,6BAA6B;CAAE;AAC5D;AAEA,IAAa,4BAAb,cAA+C,cAAc;CAC/B;CAA5B,YAAY,QAAiC;EAC3C,MAAM,KAAK,yBAAyB;EADV,KAAA,SAAA;CAE5B;AACF;AAEA,IAAa,2BAAb,cAA8C,cAAc;CAC1D,cAAc;EAAE,MAAM,KAAK,wBAAwB;CAAE;AACvD;AAEA,IAAa,oBAAb,cAAuC,cAAc;CACnD,cAAc;EAAE,MAAM,KAAK,eAAe;CAAE;AAC9C;AAEA,IAAa,0BAAb,cAA6C,cAAc;CACzD,cAAc;EAAE,MAAM,KAAK,sBAAsB;CAAE;AACrD;AAEA,IAAa,qBAAb,cAAwC,cAAc;CACpD,cAAc;EAAE,MAAM,KAAK,wBAAwB;CAAE;AACvD;AAEA,IAAa,4BAAb,cAA+C,cAAc;CAC3D,cAAc;EAAE,MAAM,KAAK,kCAAkC;CAAE;AACjE;AAEA,IAAa,4BAAb,cAA+C,cAAc;CAC3D,cAAc;EAAE,MAAM,KAAK,wBAAwB;CAAE;AACvD;AAEA,IAAa,qBAAb,cAAwC,cAAc;CACpD,cAAc;EAAE,MAAM,KAAK,gBAAgB;CAAE;AAC/C;;;AChHA,IAAa,oBAAb,cAAuC,cAAc;CACnD,cAAc;EAAE,MAAM,KAAK,0BAA0B;CAAE;AACzD;;;ACFA,IAAa,4BAAb,cAA+C,cAAc;CAC3D,cAAc;EAAE,MAAM,KAAK,wBAAwB;CAAE;AACvD;AACA,IAAa,kCAAb,cAAqD,cAAc;CACjE,cAAc;EAAE,MAAM,KAAK,+BAA+B;CAAE;AAC9D;AACA,IAAa,sCAAb,cAAyD,cAAc;CACrE,cAAc;EAAE,MAAM,KAAK,sBAAsB;CAAE;AACrD;AACA,IAAa,oCAAb,cAAuD,cAAc;CACnE,cAAc;EAAE,MAAM,KAAK,gCAAgC;CAAE;AAC/D;AACA,IAAa,+CAAb,cAAkE,cAAc;CAC9E,cAAc;EAAE,MAAM,KAAK,+BAA+B;CAAE;AAC9D;AACA,IAAa,4BAAb,cAA+C,cAAc;CAC3D,cAAc;EAAE,MAAM,KAAK,gCAAgC;CAAE;AAC/D;AACA,IAAa,gCAAb,cAAmD,cAAc;CAC/D,cAAc;EAAE,MAAM,KAAK,4BAA4B;CAAE;AAC3D;AACA,IAAa,8BAAb,cAAiD,cAAc;CAC7D,cAAc;EAAE,MAAM,KAAK,6CAA6C;CAAE;AAC5E;AACA,IAAa,gCAAb,cAAmD,cAAc;CAC/D,cAAc;EAAE,MAAM,KAAK,gBAAgB;CAAE;AAC/C;AACA,IAAa,gCAAb,cAAmD,cAAc;CAC/D,cAAc;EAAE,MAAM,KAAK,gBAAgB;CAAE;AAC/C;;;AC7BA,IAAa,qBAAb,cAAwC,cAAc;CACpD,cAAc;EAAE,MAAM,KAAK,gCAAgC;CAAE;AAC/D;;;;;;ACwCA,SAAgB,mBAAmB,OAAmC;CACpE,MAAM,YAAY,MAAM,MAAM;CAE9B,IAAI,MAAM,WAAW,SAAS;EAE5B,MAAM,WADU,MAAM,QACG,IAAI,UAAU,KAAK;EAE5C,IAAI,SAAS,SAAS,eAAe,GAAG,OAAO,IAAI,kBAAkB;EACrE,IAAI,SAAS,SAAS,eAAe,GAAG,OAAO,IAAI,kBAAkB;EACrE,IAAI,SAAS,SAAS,mBAAmB,GAAG,OAAO,IAAI,kBAAkB;EACzE,IAAI,SAAS,SAAS,0BAA0B,GAAG,OAAO,IAAI,kBAAkB;EAChF,IAAI,SAAS,SAAS,uBAAuB,GAAG,OAAO,IAAI,UAAU,uBAAuB;EAC5F,IAAI,SAAS,SAAS,0BAA0B,GAAG,OAAO,IAAI,UAAU,0BAA0B;CACpG;CAEA,IAAI,CAAC,WACH,OAAO,IAAI,UAAU,kCAAkC;CAMzD,IAAI,cAAc,oBAAoB,cAAc,gBAAgB,OAAO,IAAI,kBAAkB;CACjG,IAAI,cAAc,wBAAwB,OAAO,IAAI,uBAAuB;CAG5E,IAAI,cAAc,6BAA6B,OAAO,IAAI,wBAAwB;CAClF,IAAI,cAAc,oBAAoB,OAAO,IAAI,qBAAqB;CACtE,IAAI,cAAc,iBAAiB,OAAO,IAAI,kBAAkB;CAGhE,IAAI,cAAc,qBAAqB,cAAc,qBAAqB,OAAO,IAAI,oBAAoB;CACzG,IAAI,cAAc,4BAA4B,OAAO,IAAI,UAAU,0BAA0B;CAC7F,IAAI,cAAc,yBAAyB,OAAO,IAAI,UAAU,4BAA4B;CAG5F,IAAI,cAAc,sBAAsB,OAAO,IAAI,sBAAsB;CACzE,IAAI,cAAc,4BAA4B,OAAO,IAAI,0BAA0B;CACnF,IAAI,cAAc,0BAA0B,OAAO,IAAI,0BAA0B;CACjF,IAAI,cAAc,kBAAkB,OAAO,IAAI,mBAAmB;CAGlE,IAAI,cAAc,sBAAsB,OAAO,IAAI,sBAAsB,CAAC;CAC1E,IAAI,cAAc,qBAAqB,OAAO,IAAI,qBAAqB,GAAG;CAG1E,IAAI,cAAc,yBAAyB,cAAc,yCACvD,OAAO,IAAI,0BAA0B;CAEvC,IAAI,cAAc,qBAAqB,OAAO,IAAI,qBAAqB;CACvE,IAAI,cAAc,gCAAgC,OAAO,IAAI,+BAA+B;CAC5F,IAAI,cAAc,iCAAiC,OAAO,IAAI,6BAA6B;CAG3F,IAAI,cAAc,yBAAyB,OAAO,IAAI,UAAU,uBAAuB;CACvF,IAAI,cAAc,yBAAyB,OAAO,IAAI,UAAU,uBAAuB;CACvF,IAAI,cAAc,2BAA2B,OAAO,IAAI,UAAU,8BAA8B;CAGhG,IAAI,cAAc,mCAAmC,cAAc,iCACjE,OAAO,IAAI,yBAAyB;CAEtC,IAAI,cAAc,sBAAsB,OAAO,IAAI,sBAAsB;CAGzE,IAAI,cAAc,0BAA0B,OAAO,IAAI,yBAAyB;CAChF,IAAI,cAAc,iBAAiB,OAAO,IAAI,kBAAkB;CAChE,IAAI,cAAc,iBAAiB,OAAO,IAAI,kBAAkB;CAGhE,IAAI,cAAc,+BAA+B,cAAc,wBAC7D,OAAO,IAAI,4BAA4B;CAIzC,IACE,cAAc,0BACX,cAAc,0BACd,cAAc,mCACd,cAAc,gCACd,cAAc,yBAEjB,OAAO,IAAI,wBAAwB;CAIrC,IACE,cAAc,oBACX,cAAc,4BACd,cAAc,uCAEjB,OAAO,IAAI,mBAAmB;CAIhC,IACE,cAAc,sBACX,cAAc,mBACd,cAAc,uBACd,cAAc,4BACd,cAAc,oCACd,cAAc,6CAEjB,OAAO,IAAI,0BAA0B;CAIvC,IAAI,cAAc,mCAAmC,cAAc,kCACjE,OAAO,IAAI,UAAU,0BAA0B;CAMjD,IAAI,cAAc,4BAA4B,cAAc,0BAC1D,OAAO,IAAI,0BAA0B;CAIvC,IACE,cAAc,sBACX,cAAc,8CACd,cAAc,oCAEjB,OAAO,IAAI,gCAAgC;CAI7C,IAAI,cAAc,0BAA0B,cAAc,iCACxD,OAAO,IAAI,oCAAoC;CAIjD,IACE,cAAc,iDACX,cAAc,wEAEjB,OAAO,IAAI,6CAA6C;CAI1D,IAAI,cAAc,oBAAoB,cAAc,kCAClD,OAAO,IAAI,8BAA8B;CAI3C,IAAI,cAAc,oBAAoB,cAAc,oBAClD,OAAO,IAAI,8BAA8B;CAI3C,IACE,cAAc,iCACX,cAAc,qCACd,cAAc,mDACd,cAAc,kDACd,cAAc,yBACd,cAAc,8BAEjB,OAAO,IAAI,0BAA0B;CAIvC,IACE,cAAc,0DACX,cAAc,kDACd,cAAc,2CACd,cAAc,8BACd,cAAc,+BACd,cAAc,kBAEjB,OAAO,IAAI,8BAA8B;CAI3C,IACE,cAAc,yDACX,cAAc,wDACd,cAAc,gCACd,cAAc,sCACd,cAAc,iCACd,cAAc,mCACd,cAAc,6BACd,cAAc,gCACd,cAAc,qDAEjB,OAAO,IAAI,4BAA4B;CAIzC,IACE,UAAU,WAAW,yBAAyB,KAC3C,cAAc,+CACd,cAAc,iDACd,cAAc,qDACd,cAAc,uBAEjB,OAAO,IAAI,kCAAkC;CAI/C,OAAO,IAAI,UAAU,kCAAkC;AACzD;;;;;;AAOA,SAAgB,WAAW,OAAmC;CAC5D,IAAI,iBAAiB,UAAU,OAAO;CAEtC,OACE,iBAAiB,SACd,MAAM,SAAS,cACf,YAAY,SACZ,gBAAgB;AAEvB;;;;;;;AC/PA,SAAgB,wBAAyD;CACvE,OAAO;EACL,OAAO;EACP,UAAU,UAAU;GAClB,IAAI,WAAW,KAAK,GAClB,MAAM,mBAAmB,KAAK;GAEhC,MAAM;EACR;CACF;AACF;;;;AAKA,MAAa,iBAAiB,OAAU,OAAqC;CAC3E,IAAI;EACF,OAAO,MAAM,GAAG;CAClB,SAAS,OAAO;EACd,IAAI,WAAW,KAAK,GAClB,MAAM,mBAAmB,KAAK;EAEhC,MAAM;CACR;AACF;;;ACFO,IAAA,cAAA,MAAM,YAAoE;CAIpC;CAH3C;CAEA,YACE,SACA;EADyC,KAAA,UAAA;CACxC;;;;CAKH,IAAI,OAAuB;EACzB,KAAK,kBAAkB,WAAW;GAC9B,GAAG,KAAK;GACR,YAAY,sBAAsB;EACtC,CAAC;EAED,OAAO,KAAK;CACd;AACF;0BAnBC,QAAQ,YAAY,GAAA,gBAAA,GAKhB,OAAO,YAAY,CAAA,CAAA,GAAA,WAAA;;;;ACoDjB,IAAA,aAAA,cAAA,MAAM,WAAwC;;;;;;;CAOnD,gBAAgB,QAAsB;EACpC,OAAO,IAAI,6BAA6B;CAC1C;;;;;;;;;;;CAYA,OAAO,aACL,SACe;EACf,MAAM,EAAE,kBAAkB;EAC1B,MAAM,aAAa,QAAQ,UAAU,CAAC;EACtC,MAAM,cAAc,QAAQ;EAE5B,MAAM,sBAAsB;GAC1B,SAAS;GACT,aAAa,WAAsB,GAAG,aAA2C;IAC/E,IAAI,MAAM,YAAY,GAAG,QAAQ;IAEjC,IAAI,eACF,MAAM;KACJ,GAAG;KACH,SAAS,CAAC,sBAAsB,aAAa,GAAG,GAAI,IAAI,WAAW,CAAC,CAAE;IACxE;IAOF,IAJ2B,UAAU,aACnC,oBAAoB,YAGD,GAAG;KACtB,MAAM,QAAQ,UAAU,QAA2B,oBAAoB,KAAK;KAC5E,MAAM,WAAW,UAAU,QAA6B,oBAAoB,QAAQ;KAEpF,MAAM;MACJ,GAAG;MACH,WAAW;OACT,SAAS;OACT,GAAG,IAAI;OACP,eAAe,IAAI,WAAW,iBAAiB,iCAAiC,KAAK;OACrF,aAAa;QACX,GAAG,mBAAmB,QAAQ;QAC9B,GAAI,IAAI,WAAW,eAAe,CAAC;OACrC;MACF;KACF;IACF;IAEA,OAAO;GACT;GACA,QAAQ,CAAC,iBAAiB,GAAG,UAAU;EACzC;EAEA,OAAO;GACL,QAAA;GACA,WAAW;IACT;IACA;KACE,SAAS;KACT,UAAU;IACZ;IACA,GAAI,gBACA,CACA;KAAE,SAAS,UAAU;KAAS,UAAU;IAAmC,GAC3E;KAAE,SAAS,UAAU;KAAe,UAAU;IAAc,CAC9D,IACE,CAAC;GACP;EACF;CACF;AACF;uCAvFC,OAAO,EACN,WAAW,CAAC,WAAW,EACzB,CAAC,CAAA,GAAA,UAAA"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../src/context/router-context.augment.ts","../../src/auth/auth.tokens.ts","../../src/auth/middleware/session-verification.middleware.ts","../../src/auth/rate-limit-bridge.ts","../../src/auth/errors/auth-errors.ts","../../src/auth/errors/invalid-token.error.ts","../../src/auth/errors/organization-errors.ts","../../src/auth/errors/token-required.error.ts","../../src/auth/utils/better-auth-error-handler.ts","../../src/auth/utils/auth-helpers.ts","../../src/auth/services/auth.service.ts","../../src/auth/auth.module.ts"],"sourcesContent":["/**\n * Augments Stratal's `RouterContext` with a `user()` accessor backed by the\n * request-scoped {@link AuthContext}.\n *\n * Side-effect import: registers the `user` macro on `RouterContext` and the\n * `declare module` augmentation that exposes it at the type level. Imported by\n * {@link AuthModule} so it runs whenever auth is configured.\n */\nimport { DI_TOKENS } from 'stratal/di'\nimport { RouterContext } from 'stratal/router'\nimport type { AuthContext, AuthUser } from './auth-context'\n\ndeclare module 'stratal/router' {\n  interface RouterContext {\n    /**\n     * The authenticated user for the current request.\n     *\n     * Throws `UserNotAuthenticatedError` if the request is unauthenticated.\n     * Provided by `@stratal/framework`'s `AuthModule` via {@link AuthContext}.\n     */\n    user(): AuthUser\n  }\n}\n\nRouterContext.macro('user', function (this: RouterContext): AuthUser {\n  return this.getContainer().resolve<AuthContext>(DI_TOKENS.AuthContext).requireUser()\n})\n","/** Token for AuthService - core authentication service */\nexport const AUTH_SERVICE = Symbol.for('stratal:auth:service')\n\n/** Token for Better Auth options configuration */\nexport const AUTH_OPTIONS = Symbol.for('stratal:auth:options')\n","import { DI_TOKENS, inject, Transient } from 'stratal/di'\nimport { LOGGER_TOKENS, type LoggerService } from 'stratal/logger'\nimport type { Middleware, Next, RouterContext } from 'stratal/router'\nimport { type AuthContext } from '../../context/auth-context'\nimport { AUTH_SERVICE } from '../auth.tokens'\nimport type { AuthService } from '../services/auth.service'\n\n/**\n * Session Verification Middleware\n *\n * Verifies user session via Better Auth and populates AuthContext with\n * the authenticated user.\n *\n * **Responsibilities:**\n * - Calls Better Auth's getSession() API\n * - Populates AuthContext with the user record if the session is valid\n * - Continues request chain regardless of session status\n */\n@Transient()\nexport class SessionVerificationMiddleware implements Middleware {\n  constructor(\n    @inject(AUTH_SERVICE)\n    private readonly authService: AuthService,\n    @inject(LOGGER_TOKENS.LoggerService) private logger: LoggerService\n  ) { }\n\n  async handle(ctx: RouterContext, next: Next): Promise<void> {\n    try {\n      const result = await this.authService.auth.api.getSession({\n        headers: ctx.c.req.raw.headers\n      })\n\n      if (result) {\n        const authContext = ctx.getContainer().resolve<AuthContext>(DI_TOKENS.AuthContext)\n        authContext.setAuthContext({\n          user: result.user,\n        })\n      }\n    } catch (error: unknown) {\n      this.logger.debug('Session validation failed (e.g., invalidated in DB)', { error })\n    }\n\n    return next()\n  }\n}\n","/**\n * Rate-limit bridge between Stratal's `RateLimiterModule` and better-auth.\n *\n * Importing this file (transitively, via `auth.module.ts`) does two things:\n *\n *  1. Augments `RateLimiterRegistry` with `forPath()` + `pathEntries()` via\n *     Stratal's `Macroable`. Path-keyed rules registered on the same registry\n *     used for Stratal's own throttling are projected into better-auth's\n *     `customRules` by {@link projectCustomRules}.\n *  2. Exports {@link createBetterAuthRateLimitStorage} — adapts Stratal's\n *     {@link IRateLimiterStore} into better-auth's `customStorage`, so both\n *     systems share one backing store.\n *\n * `AuthModule.forRootAsync` wires both automatically when `RateLimiterModule`\n * is imported. Users with explicit `rateLimit.customStorage` /\n * `rateLimit.customRules` keys in their auth factory keep precedence.\n *\n * Frictions, documented for path-keyed entries:\n *\n *  - `Limit.by(...)` is meaningless. Better-auth scopes per-IP+path.\n *  - Multiple `Limit`s reduce to the most restrictive (smallest max-per-second).\n *  - `Limit.none()` projects to `false` (better-auth's \"disable\" sentinel).\n *  - `Limit.response(...)` is a no-op. Better-auth renders its own 429.\n *  - Snapshot caveat: `customRules` is built once at AuthService construction,\n *    so register all `forPath()` entries inside `OnInitialize` hooks.\n */\nimport { type IRateLimiterStore, type Limit, RateLimiterRegistry } from 'stratal/rate-limiter'\n\n/**\n * Resolver attached to a path-keyed limiter entry. Receives the native\n * `Request` (better-auth's customRules invokes us with the live Request)\n * and returns one or more `Limit`s. Async is supported.\n */\nexport type PathLimitResolver = (\n  req: Request,\n) => Limit | Limit[] | Promise<Limit | Limit[]>\n\ninterface BetterAuthRateLimit {\n  key: string\n  count: number\n  lastRequest: number\n}\n\ninterface BetterAuthRateLimitRule {\n  window: number\n  max: number\n}\n\ntype BetterAuthCustomRule =\n  | BetterAuthRateLimitRule\n  | false\n  | ((req: Request) => Promise<BetterAuthRateLimitRule | false>)\n\n// Per-instance path map — keyed by registry so we don't pin GC roots.\nconst pathResolvers = new WeakMap<RateLimiterRegistry, Map<string, PathLimitResolver>>()\n\nfunction getOrCreatePathMap(registry: RateLimiterRegistry): Map<string, PathLimitResolver> {\n  let map = pathResolvers.get(registry)\n  if (!map) {\n    map = new Map()\n    pathResolvers.set(registry, map)\n  }\n  return map\n}\n\nRateLimiterRegistry.macro('forPath', function (\n  this: RateLimiterRegistry,\n  path: string,\n  resolver: PathLimitResolver,\n): void {\n  getOrCreatePathMap(this).set(path, resolver)\n})\n\nRateLimiterRegistry.macro('pathEntries', function (\n  this: RateLimiterRegistry,\n): IterableIterator<[string, PathLimitResolver]> {\n  return (pathResolvers.get(this) ?? new Map<string, PathLimitResolver>()).entries()\n})\n\ndeclare module 'stratal/rate-limiter' {\n  interface RateLimiterRegistry {\n    /**\n     * Register a rate-limit rule for a better-auth path pattern. The rule\n     * is projected into better-auth's `rateLimit.customRules` automatically\n     * when both modules are imported.\n     *\n     * @example\n     * limiter.forPath('/sign-in/email', () => Limit.perSeconds(10, 3))\n     * limiter.forPath('/two-factor/*', async (req) => { ... })\n     * limiter.forPath('/forget-password', () => Limit.none())\n     */\n    forPath(path: string, resolver: PathLimitResolver): void\n\n    /**\n     * Iterate every path-keyed entry registered via `forPath`. Used by the\n     * auth bridge to project entries into better-auth's `customRules`.\n     */\n    pathEntries(): IterableIterator<[string, PathLimitResolver]>\n  }\n}\n\n// Better-auth manages window expiry itself by reading `lastRequest`. We still\n// need a TTL on the underlying KV so dead records don't accumulate. 1 day\n// covers any reasonable better-auth window without colliding with the next.\nconst BETTER_AUTH_TTL_SECONDS = 86_400\nconst BETTER_AUTH_KEY_PREFIX = 'ba-rl:'\n\n/**\n * Adapt Stratal's `IRateLimiterStore` into better-auth's `customStorage` shape.\n * Better-auth supplies its own `RateLimit` records (`{ key, count, lastRequest }`);\n * the adapter just persists them under a separate key namespace.\n */\nexport function createBetterAuthRateLimitStorage(store: IRateLimiterStore): {\n  get: (key: string) => Promise<BetterAuthRateLimit | null>\n  set: (key: string, value: BetterAuthRateLimit, update?: boolean) => Promise<void>\n} {\n  return {\n    async get(key) {\n      return await store.get<BetterAuthRateLimit>(`${BETTER_AUTH_KEY_PREFIX}${key}`)\n    },\n    async set(key, value, _update) {\n      await store.set(`${BETTER_AUTH_KEY_PREFIX}${key}`, value, BETTER_AUTH_TTL_SECONDS)\n    },\n  }\n}\n\n/**\n * Project every `forPath` entry on the registry into better-auth's\n * `customRules` shape. Each entry becomes an async function that resolves\n * the user's `Limit`(s) and reduces them to a single `{ window, max }` pair\n * (or `false` for `Limit.none()`).\n *\n * Multi-`Limit` reduction picks the most restrictive — smallest\n * `max / windowSeconds` ratio; ties favour the first.\n */\nexport function projectCustomRules(\n  registry: RateLimiterRegistry,\n): Record<string, BetterAuthCustomRule> {\n  const rules: Record<string, BetterAuthCustomRule> = {}\n\n  for (const [path, resolver] of registry.pathEntries()) {\n    rules[path] = async (req: Request): Promise<BetterAuthRateLimitRule | false> => {\n      const resolved = await resolver(req)\n      const candidates = (Array.isArray(resolved) ? resolved : [resolved]).filter((l) => !l.disabled)\n      if (candidates.length === 0) return false\n\n      const chosen = candidates.reduce((a, b) =>\n        a.max / a.windowSeconds <= b.max / b.windowSeconds ? a : b,\n      )\n\n      return { window: chosen.windowSeconds, max: chosen.max }\n    }\n  }\n\n  return rules\n}\n","import { HttpException } from 'stratal/errors'\n\nexport class UserNotFoundError extends HttpException {\n  constructor(public readonly email?: string) {\n    super(404, 'User not found')\n  }\n}\n\nexport class InvalidCredentialsError extends HttpException {\n  constructor() { super(401, 'Invalid email or password') }\n}\n\nexport class InvalidPasswordError extends HttpException {\n  constructor() { super(401, 'Invalid password') }\n}\n\nexport class InvalidEmailError extends HttpException {\n  constructor(public readonly email?: string) {\n    super(422, 'Invalid email address')\n  }\n}\n\nexport class SessionExpiredError extends HttpException {\n  constructor() { super(401, 'Session expired') }\n}\n\nexport class FreshSessionRequiredError extends HttpException {\n  constructor() { super(403, 'Fresh session required') }\n}\n\nexport class EmailNotVerifiedError extends HttpException {\n  constructor(public readonly email?: string) {\n    super(403, 'Email not verified')\n  }\n}\n\nexport class PasswordTooShortError extends HttpException {\n  constructor(public readonly minLength?: number) {\n    super(422, 'Password too short')\n  }\n}\n\nexport class PasswordTooLongError extends HttpException {\n  constructor(public readonly maxLength?: number) {\n    super(422, 'Password too long')\n  }\n}\n\nexport class AccountAlreadyExistsError extends HttpException {\n  constructor(public readonly email?: string) {\n    super(409, 'Account already exists')\n  }\n}\n\nexport class SocialAccountLinkedError extends HttpException {\n  constructor(public readonly provider?: string) {\n    super(409, 'Social account already linked')\n  }\n}\n\nexport class CannotUnlinkLastAccountError extends HttpException {\n  constructor() { super(409, 'Cannot unlink last account') }\n}\n\nexport class ProviderNotFoundError extends HttpException {\n  constructor(public readonly provider?: string) {\n    super(404, 'Authentication provider not found')\n  }\n}\n\nexport class UserEmailNotFoundError extends HttpException {\n  constructor() { super(404, 'User email not found') }\n}\n\nexport class AccountNotFoundError extends HttpException {\n  constructor() { super(404, 'Account not found') }\n}\n\nexport class CredentialAccountNotFoundError extends HttpException {\n  constructor() { super(404, 'Credential account not found') }\n}\n\nexport class UserAlreadyHasPasswordError extends HttpException {\n  constructor() { super(409, 'User already has a password') }\n}\n\nexport class EmailCannotBeUpdatedError extends HttpException {\n  constructor(public readonly reason?: string) {\n    super(422, 'Email cannot be updated')\n  }\n}\n\nexport class IdTokenNotSupportedError extends HttpException {\n  constructor() { super(422, 'ID token not supported') }\n}\n\nexport class TokenExpiredError extends HttpException {\n  constructor() { super(401, 'Token expired') }\n}\n\nexport class InvalidCallbackUrlError extends HttpException {\n  constructor() { super(422, 'Invalid callback URL') }\n}\n\nexport class InvalidOriginError extends HttpException {\n  constructor() { super(403, 'Invalid request origin') }\n}\n\nexport class AuthValidationFailedError extends HttpException {\n  constructor() { super(422, 'Authentication validation failed') }\n}\n\nexport class EmailAlreadyVerifiedError extends HttpException {\n  constructor() { super(409, 'Email already verified') }\n}\n\nexport class EmailMismatchError extends HttpException {\n  constructor() { super(422, 'Email mismatch') }\n}\n","import { HttpException } from 'stratal/errors'\n\nexport class InvalidTokenError extends HttpException {\n  constructor() { super(401, 'Invalid or expired token') }\n}\n","import { HttpException } from 'stratal/errors'\n\nexport class OrganizationNotFoundError extends HttpException {\n  constructor() { super(404, 'Organization not found') }\n}\nexport class OrganizationMemberNotFoundError extends HttpException {\n  constructor() { super(404, 'Organization member not found') }\n}\nexport class OrganizationInvitationNotFoundError extends HttpException {\n  constructor() { super(404, 'Invitation not found') }\n}\nexport class OrganizationPermissionDeniedError extends HttpException {\n  constructor() { super(403, 'Organization permission denied') }\n}\nexport class OrganizationInvitationRecipientMismatchError extends HttpException {\n  constructor() { super(403, 'Invitation recipient mismatch') }\n}\nexport class OrganizationConflictError extends HttpException {\n  constructor() { super(409, 'Organization resource conflict') }\n}\nexport class OrganizationLimitReachedError extends HttpException {\n  constructor() { super(422, 'Organization limit reached') }\n}\nexport class OrganizationMembershipError extends HttpException {\n  constructor() { super(422, 'Organization membership constraint violated') }\n}\nexport class OrganizationTeamNotFoundError extends HttpException {\n  constructor() { super(404, 'Team not found') }\n}\nexport class OrganizationRoleNotFoundError extends HttpException {\n  constructor() { super(404, 'Role not found') }\n}\n","import { HttpException } from 'stratal/errors'\n\nexport class TokenRequiredError extends HttpException {\n  constructor() { super(401, 'Verification token is required') }\n}\n","import { APIError } from 'better-auth/api'\nimport { AuthError } from 'stratal/errors'\nimport type { ApplicationError } from 'stratal/errors'\nimport {\n  AccountAlreadyExistsError,\n  AccountNotFoundError,\n  AuthValidationFailedError,\n  CannotUnlinkLastAccountError,\n  CredentialAccountNotFoundError,\n  EmailAlreadyVerifiedError,\n  EmailCannotBeUpdatedError,\n  EmailMismatchError,\n  EmailNotVerifiedError,\n  FreshSessionRequiredError,\n  IdTokenNotSupportedError,\n  InvalidCallbackUrlError,\n  InvalidCredentialsError,\n  InvalidEmailError,\n  InvalidOriginError,\n  InvalidPasswordError,\n  InvalidTokenError,\n  OrganizationConflictError,\n  OrganizationInvitationNotFoundError,\n  OrganizationInvitationRecipientMismatchError,\n  OrganizationLimitReachedError,\n  OrganizationMemberNotFoundError,\n  OrganizationMembershipError,\n  OrganizationNotFoundError,\n  OrganizationPermissionDeniedError,\n  OrganizationRoleNotFoundError,\n  OrganizationTeamNotFoundError,\n  PasswordTooLongError,\n  PasswordTooShortError,\n  ProviderNotFoundError,\n  SessionExpiredError,\n  SocialAccountLinkedError,\n  TokenExpiredError,\n  UserAlreadyHasPasswordError,\n  UserEmailNotFoundError,\n  UserNotFoundError,\n} from '../errors'\n\n/**\n * Maps Better Auth API error codes to ApplicationError instances.\n */\nexport function mapBetterAuthError(error: APIError): ApplicationError {\n  const errorCode = error.body?.code\n\n  if (error.status === 'FOUND') {\n    const headers = error.headers as Headers\n    const location = headers.get('location') ?? ''\n\n    if (location.includes('INVALID_TOKEN')) return new InvalidTokenError()\n    if (location.includes('EXPIRED_TOKEN')) return new TokenExpiredError()\n    if (location.includes('ATTEMPTS_EXCEEDED')) return new InvalidTokenError()\n    if (location.includes('new_user_signup_disabled')) return new UserNotFoundError()\n    if (location.includes('failed_to_create_user')) return new AuthError('Failed to create user')\n    if (location.includes('failed_to_create_session')) return new AuthError('Failed to create session')\n  }\n\n  if (!errorCode) {\n    return new AuthError('An authentication error occurred')\n  }\n\n  // ── Base Error Codes ──────────────────────────────────────────────────\n\n  // User errors\n  if (errorCode === 'USER_NOT_FOUND' || errorCode === 'INVALID_USER') return new UserNotFoundError()\n  if (errorCode === 'USER_EMAIL_NOT_FOUND') return new UserEmailNotFoundError()\n\n  // Credential errors\n  if (errorCode === 'INVALID_EMAIL_OR_PASSWORD') return new InvalidCredentialsError()\n  if (errorCode === 'INVALID_PASSWORD') return new InvalidPasswordError()\n  if (errorCode === 'INVALID_EMAIL') return new InvalidEmailError()\n\n  // Session errors\n  if (errorCode === 'SESSION_EXPIRED') return new SessionExpiredError()\n  if (errorCode === 'SESSION_NOT_FRESH') return new FreshSessionRequiredError()\n  if (errorCode === 'FAILED_TO_CREATE_SESSION') return new AuthError('Failed to create session')\n  if (errorCode === 'FAILED_TO_GET_SESSION') return new AuthError('Failed to retrieve session')\n\n  // Email verification\n  if (errorCode === 'EMAIL_NOT_VERIFIED') return new EmailNotVerifiedError()\n  if (errorCode === 'EMAIL_CAN_NOT_BE_UPDATED') return new EmailCannotBeUpdatedError()\n  if (errorCode === 'EMAIL_ALREADY_VERIFIED') return new EmailAlreadyVerifiedError()\n  if (errorCode === 'EMAIL_MISMATCH') return new EmailMismatchError()\n\n  // Password validation\n  if (errorCode === 'PASSWORD_TOO_SHORT') return new PasswordTooShortError(8)\n  if (errorCode === 'PASSWORD_TOO_LONG') return new PasswordTooLongError(128)\n\n  // Account errors\n  if (errorCode === 'USER_ALREADY_EXISTS' || errorCode === 'USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL') {\n    return new AccountAlreadyExistsError()\n  }\n  if (errorCode === 'ACCOUNT_NOT_FOUND') return new AccountNotFoundError()\n  if (errorCode === 'CREDENTIAL_ACCOUNT_NOT_FOUND') return new CredentialAccountNotFoundError()\n  if (errorCode === 'FAILED_TO_UNLINK_LAST_ACCOUNT') return new CannotUnlinkLastAccountError()\n\n  // User creation/update errors\n  if (errorCode === 'FAILED_TO_CREATE_USER') return new AuthError('Failed to create user')\n  if (errorCode === 'FAILED_TO_UPDATE_USER') return new AuthError('Failed to update user')\n  if (errorCode === 'FAILED_TO_GET_USER_INFO') return new AuthError('Failed to retrieve user info')\n\n  // Social account errors\n  if (errorCode === 'SOCIAL_ACCOUNT_ALREADY_LINKED' || errorCode === 'LINKED_ACCOUNT_ALREADY_EXISTS') {\n    return new SocialAccountLinkedError()\n  }\n  if (errorCode === 'PROVIDER_NOT_FOUND') return new ProviderNotFoundError()\n\n  // Token errors\n  if (errorCode === 'ID_TOKEN_NOT_SUPPORTED') return new IdTokenNotSupportedError()\n  if (errorCode === 'INVALID_TOKEN') return new InvalidTokenError()\n  if (errorCode === 'TOKEN_EXPIRED') return new TokenExpiredError()\n\n  // Password management\n  if (errorCode === 'USER_ALREADY_HAS_PASSWORD' || errorCode === 'PASSWORD_ALREADY_SET') {\n    return new UserAlreadyHasPasswordError()\n  }\n\n  // Callback/redirect URL errors\n  if (\n    errorCode === 'INVALID_CALLBACK_URL'\n    || errorCode === 'INVALID_REDIRECT_URL'\n    || errorCode === 'INVALID_NEW_USER_CALLBACK_URL'\n    || errorCode === 'INVALID_ERROR_CALLBACK_URL'\n    || errorCode === 'CALLBACK_URL_REQUIRED'\n  ) {\n    return new InvalidCallbackUrlError()\n  }\n\n  // Origin/CORS errors\n  if (\n    errorCode === 'INVALID_ORIGIN'\n    || errorCode === 'MISSING_OR_NULL_ORIGIN'\n    || errorCode === 'CROSS_SITE_NAVIGATION_LOGIN_BLOCKED'\n  ) {\n    return new InvalidOriginError()\n  }\n\n  // Validation errors\n  if (\n    errorCode === 'VALIDATION_ERROR'\n    || errorCode === 'MISSING_FIELD'\n    || errorCode === 'FIELD_NOT_ALLOWED'\n    || errorCode === 'BODY_MUST_BE_AN_OBJECT'\n    || errorCode === 'ASYNC_VALIDATION_NOT_SUPPORTED'\n    || errorCode === 'METHOD_NOT_ALLOWED_DEFER_SESSION_REQUIRED'\n  ) {\n    return new AuthValidationFailedError()\n  }\n\n  // Verification errors\n  if (errorCode === 'FAILED_TO_CREATE_VERIFICATION' || errorCode === 'VERIFICATION_EMAIL_NOT_ENABLED') {\n    return new AuthError('Failed to create session')\n  }\n\n  // ── Organization Plugin Error Codes ───────────────────────────────────\n\n  // Organization not found\n  if (errorCode === 'ORGANIZATION_NOT_FOUND' || errorCode === 'NO_ACTIVE_ORGANIZATION') {\n    return new OrganizationNotFoundError()\n  }\n\n  // Member not found\n  if (\n    errorCode === 'MEMBER_NOT_FOUND'\n    || errorCode === 'USER_IS_NOT_A_MEMBER_OF_THE_ORGANIZATION'\n    || errorCode === 'USER_IS_NOT_A_MEMBER_OF_THE_TEAM'\n  ) {\n    return new OrganizationMemberNotFoundError()\n  }\n\n  // Invitation not found\n  if (errorCode === 'INVITATION_NOT_FOUND' || errorCode === 'FAILED_TO_RETRIEVE_INVITATION') {\n    return new OrganizationInvitationNotFoundError()\n  }\n\n  // Invitation recipient mismatch\n  if (\n    errorCode === 'YOU_ARE_NOT_THE_RECIPIENT_OF_THE_INVITATION'\n    || errorCode === 'EMAIL_VERIFICATION_REQUIRED_BEFORE_ACCEPTING_OR_REJECTING_INVITATION'\n  ) {\n    return new OrganizationInvitationRecipientMismatchError()\n  }\n\n  // Team not found\n  if (errorCode === 'TEAM_NOT_FOUND' || errorCode === 'YOU_DO_NOT_HAVE_AN_ACTIVE_TEAM') {\n    return new OrganizationTeamNotFoundError()\n  }\n\n  // Role not found\n  if (errorCode === 'ROLE_NOT_FOUND' || errorCode === 'INVALID_RESOURCE') {\n    return new OrganizationRoleNotFoundError()\n  }\n\n  // Organization conflict/already exists\n  if (\n    errorCode === 'ORGANIZATION_ALREADY_EXISTS'\n    || errorCode === 'ORGANIZATION_SLUG_ALREADY_TAKEN'\n    || errorCode === 'USER_IS_ALREADY_A_MEMBER_OF_THIS_ORGANIZATION'\n    || errorCode === 'USER_IS_ALREADY_INVITED_TO_THIS_ORGANIZATION'\n    || errorCode === 'TEAM_ALREADY_EXISTS'\n    || errorCode === 'ROLE_NAME_IS_ALREADY_TAKEN'\n  ) {\n    return new OrganizationConflictError()\n  }\n\n  // Organization limit reached\n  if (\n    errorCode === 'YOU_HAVE_REACHED_THE_MAXIMUM_NUMBER_OF_ORGANIZATIONS'\n    || errorCode === 'YOU_HAVE_REACHED_THE_MAXIMUM_NUMBER_OF_TEAMS'\n    || errorCode === 'ORGANIZATION_MEMBERSHIP_LIMIT_REACHED'\n    || errorCode === 'INVITATION_LIMIT_REACHED'\n    || errorCode === 'TEAM_MEMBER_LIMIT_REACHED'\n    || errorCode === 'TOO_MANY_ROLES'\n  ) {\n    return new OrganizationLimitReachedError()\n  }\n\n  // Organization membership constraints\n  if (\n    errorCode === 'YOU_CANNOT_LEAVE_THE_ORGANIZATION_AS_THE_ONLY_OWNER'\n    || errorCode === 'YOU_CANNOT_LEAVE_THE_ORGANIZATION_WITHOUT_AN_OWNER'\n    || errorCode === 'UNABLE_TO_REMOVE_LAST_TEAM'\n    || errorCode === 'CANNOT_DELETE_A_PRE_DEFINED_ROLE'\n    || errorCode === 'ROLE_IS_ASSIGNED_TO_MEMBERS'\n    || errorCode === 'YOU_CANNOT_IMPERSONATE_ADMINS'\n    || errorCode === 'YOU_CANNOT_BAN_YOURSELF'\n    || errorCode === 'YOU_CANNOT_REMOVE_YOURSELF'\n    || errorCode === 'INVITER_IS_NO_LONGER_A_MEMBER_OF_THE_ORGANIZATION'\n  ) {\n    return new OrganizationMembershipError()\n  }\n\n  // Organization permission denied (catch-all for YOU_ARE_NOT_ALLOWED_TO_* patterns)\n  if (\n    errorCode.startsWith('YOU_ARE_NOT_ALLOWED_TO_')\n    || errorCode === 'YOU_ARE_NOT_A_MEMBER_OF_THIS_ORGANIZATION'\n    || errorCode === 'YOU_CAN_NOT_ACCESS_THE_MEMBERS_OF_THIS_TEAM'\n    || errorCode === 'YOU_MUST_BE_IN_AN_ORGANIZATION_TO_CREATE_A_ROLE'\n    || errorCode === 'MISSING_AC_INSTANCE'\n  ) {\n    return new OrganizationPermissionDeniedError()\n  }\n\n  // Unknown error code\n  return new AuthError('An authentication error occurred')\n}\n\n/**\n * Type guard to check if an error is a Better Auth APIError.\n * Uses duck typing to handle bundler environments (e.g. Vite)\n * where instanceof may fail across module boundaries.\n */\nexport function isAPIError(error: unknown): error is APIError {\n  if (error instanceof APIError) return true\n\n  return (\n    error instanceof Error\n    && error.name === 'APIError'\n    && 'status' in error\n    && 'statusCode' in error\n  )\n}\n","import type { BetterAuthOptions } from 'better-auth'\nimport { isAPIError, mapBetterAuthError } from './better-auth-error-handler'\n\n/**\n * Get shared Better Auth error handler configuration.\n * Use this in Better Auth config's onAPIError option.\n */\nexport function getErrorHandlerConfig(): BetterAuthOptions['onAPIError'] {\n  return {\n    throw: false,\n    onError: (error) => {\n      if (isAPIError(error)) {\n        throw mapBetterAuthError(error)\n      }\n      throw error\n    },\n  }\n}\n\n/**\n * Wrap a Better Auth function in a try/catch block and map errors to ApplicationError.\n */\nexport const wrapBetterAuth = async <T>(fn: () => Promise<T>): Promise<T> => {\n  try {\n    return await fn()\n  } catch (error) {\n    if (isAPIError(error)) {\n      throw mapBetterAuthError(error)\n    }\n    throw error\n  }\n}\n","import type { Auth, BetterAuthOptions } from 'better-auth';\nimport { betterAuth } from 'better-auth/minimal';\nimport { inject, Request } from 'stratal/di';\nimport { AUTH_OPTIONS, AUTH_SERVICE } from '../auth.tokens';\nimport { getErrorHandlerConfig } from '../utils';\n\n/**\n * AuthService\n *\n * Base authentication service using Better Auth.\n * Configured via AuthModule.forRootAsync() from the application layer.\n *\n * **Extensibility:**\n * Extend this class to add custom methods. Subclasses inherit\n * `@Request(AUTH_SERVICE)` scope automatically — no decorator needed.\n *\n * @example\n * ```typescript\n * @Request(AUTH_SERVICE)\n * export class AppAuthService extends AuthService<AuthOptions> {\n *   async signInMagicLink(email: string) {\n *     return wrapBetterAuth(async () => {\n *       return this.auth.api.signInMagicLink({ body: { email }, headers: new Headers() })\n *     })\n *   }\n * }\n * ```\n */\n@Request(AUTH_SERVICE)\nexport class AuthService<TOptions extends BetterAuthOptions = BetterAuthOptions> {\n  private _authInstance?: Auth<TOptions>\n\n  constructor(\n    @inject(AUTH_OPTIONS) protected readonly options: TOptions\n  ) {}\n\n  /**\n   * Get the Better Auth instance.\n   */\n  get auth(): Auth<TOptions> {\n    this._authInstance ??= betterAuth({\n        ...this.options,\n        onAPIError: getErrorHandlerConfig()\n    }) as Auth<TOptions>;\n\n    return this._authInstance\n  }\n}\n","/**\n * Auth Module\n *\n * Provides configurable authentication using Better Auth.\n * Use `forRootAsync` to configure Better Auth options from the application layer.\n *\n * Optionally pass `accessControl` to enable permission-based authorization.\n * This auto-adds the Stratal AC plugin to Better Auth and registers `AccessService`.\n *\n * @example Without access control\n * ```typescript\n * @Module({\n *   imports: [\n *     AuthModule.forRootAsync({\n *       inject: [DI_TOKENS.Database, CONFIG_TOKENS.ConfigService],\n *       useFactory: (db, config) => createAuthOptions(db, config)\n *     })\n *   ]\n * })\n * export class AppModule {}\n * ```\n *\n * @example With access control\n * ```typescript\n * import { createAccessControl } from '@stratal/framework/access-control'\n * import { admin } from 'better-auth/plugins'\n *\n * const permissions = createAccessControl({\n *   resources: { posts: ['create', 'read', 'update', 'delete'] } as const,\n *   roles: { admin: { posts: ['create', 'read', 'update', 'delete'] }, user: { posts: ['read'] } },\n * })\n *\n * @Module({\n *   imports: [\n *     AuthModule.forRootAsync({\n *       inject: [DI_TOKENS.Database],\n *       useFactory: (db) => ({\n *         database: ...,\n *         plugins: [admin({ ...permissions })],\n *       }),\n *       accessControl: permissions,\n *     })\n *   ]\n * })\n * ```\n */\n\nimport type { BetterAuthOptions } from 'better-auth'\nimport { CONTAINER_TOKEN, type Container } from 'stratal/di'\nimport type { AsyncModuleOptions, DynamicModule } from 'stratal/module'\nimport { Module } from 'stratal/module'\nimport type { IRateLimiterStore, RateLimiterRegistry } from 'stratal/rate-limiter'\nimport { RATE_LIMITER_TOKENS } from 'stratal/rate-limiter'\nimport type { RouteConfigurable, Router } from 'stratal/router'\nimport { createStratalAcPlugin } from '../access-control/plugin'\nimport { AccessService } from '../access-control/services/access.service'\nimport { AC_TOKENS } from '../access-control/tokens'\nimport type { AccessControlOptions } from '../access-control/types'\nimport { AuthContext } from '../context/auth-context'\n// Side-effect import: registers the `user()` macro on `RouterContext` and its\n// type augmentation, backed by the request-scoped `AuthContext`.\nimport '../context/router-context.augment'\nimport { AUTH_OPTIONS, AUTH_SERVICE } from './auth.tokens'\nimport { SessionVerificationMiddleware } from './middleware/session-verification.middleware'\n// Side-effect import: registers `forPath`/`pathEntries` macros on\n// `RateLimiterRegistry` and the `declare module` augmentation that exposes\n// them at the type level. Must run before any consumer calls `forPath()`.\nimport {\n  createBetterAuthRateLimitStorage,\n  projectCustomRules,\n} from './rate-limit-bridge'\nimport { AuthService } from './services/auth.service'\n\nexport interface AuthModuleAsyncOptions<TOptions extends BetterAuthOptions = BetterAuthOptions>\n  extends AsyncModuleOptions<TOptions> {\n  /**\n   * Optional access control configuration.\n   * When provided, registers AccessService and auto-adds the Stratal AC plugin to Better Auth.\n   */\n  accessControl?: AccessControlOptions\n}\n\n@Module({\n  providers: [AuthContext]\n})\nexport class AuthModule implements RouteConfigurable {\n  /**\n   * Configure auth middleware globally.\n   *\n   * SessionVerificationMiddleware verifies the session and populates the\n   * request-scoped AuthContext with the authenticated user.\n   */\n  configureRoutes(router: Router): void {\n    router.use(SessionVerificationMiddleware)\n  }\n\n  /**\n   * Configure AuthModule with async options factory.\n   * Optionally provide `accessControl` to enable permission-based authorization.\n   *\n   * When `RateLimiterModule` is also imported, better-auth's `rateLimit`\n   * block is auto-wired: `customStorage` shares Stratal's backing store, and\n   * any `RateLimiterRegistry.forPath(...)` entries are projected into\n   * `customRules`. User-supplied `rateLimit.{customStorage, customRules}` keys\n   * take precedence on a per-key basis.\n   */\n  static forRootAsync<TOptions extends BetterAuthOptions>(\n    options: AuthModuleAsyncOptions<TOptions>\n  ): DynamicModule {\n    const { accessControl } = options\n    const userInject = options.inject ?? []\n    const userFactory = options.useFactory as (...args: unknown[]) => TOptions\n\n    const authOptionsProvider = {\n      provide: AUTH_OPTIONS,\n      useFactory: (container: Container, ...userDeps: unknown[]): BetterAuthOptions => {\n        let raw = userFactory(...userDeps) as BetterAuthOptions\n\n        if (accessControl) {\n          raw = {\n            ...raw,\n            plugins: [createStratalAcPlugin(accessControl), ...(raw.plugins ?? [])],\n          }\n        }\n\n        const rateLimiterPresent = container.isRegistered(\n          RATE_LIMITER_TOKENS.ModuleMarker,\n        )\n\n        if (rateLimiterPresent) {\n          const store = container.resolve<IRateLimiterStore>(RATE_LIMITER_TOKENS.Store)\n          const registry = container.resolve<RateLimiterRegistry>(RATE_LIMITER_TOKENS.Registry)\n\n          raw = {\n            ...raw,\n            rateLimit: {\n              enabled: true,\n              ...raw.rateLimit,\n              customStorage: raw.rateLimit?.customStorage ?? createBetterAuthRateLimitStorage(store),\n              customRules: {\n                ...projectCustomRules(registry),\n                ...(raw.rateLimit?.customRules ?? {}),\n              },\n            },\n          }\n        }\n\n        return raw\n      },\n      inject: [CONTAINER_TOKEN, ...userInject],\n    }\n\n    return {\n      module: AuthModule,\n      providers: [\n        authOptionsProvider,\n        {\n          provide: AUTH_SERVICE,\n          useClass: AuthService,\n        },\n        ...(accessControl\n          ? [\n            { provide: AC_TOKENS.Options, useValue: accessControl as unknown as object },\n            { provide: AC_TOKENS.AccessService, useClass: AccessService },\n          ]\n          : []),\n      ],\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAwBA,cAAc,MAAM,QAAQ,WAAyC;CACnE,OAAO,KAAK,aAAa,EAAE,QAAqB,UAAU,WAAW,EAAE,YAAY;AACrF,CAAC;;;;ACzBD,MAAa,eAAe,OAAO,IAAI,sBAAsB;;AAG7D,MAAa,eAAe,OAAO,IAAI,sBAAsB;;;ACetD,IAAA,gCAAA,MAAM,8BAAoD;CAG5C;CAC4B;CAH/C,YACE,aAEA,QACA;EAFiB,KAAA,cAAA;EAC4B,KAAA,SAAA;CAC3C;CAEJ,MAAM,OAAO,KAAoB,MAA2B;EAC1D,IAAI;GACF,MAAM,SAAS,MAAM,KAAK,YAAY,KAAK,IAAI,WAAW,EACxD,SAAS,IAAI,EAAE,IAAI,IAAI,QACzB,CAAC;GAED,IAAI,QAEF,IADwB,aAAa,EAAE,QAAqB,UAAU,WAC5D,EAAE,eAAe,EACzB,MAAM,OAAO,KACf,CAAC;EAEL,SAAS,OAAgB;GACvB,KAAK,OAAO,MAAM,uDAAuD,EAAE,MAAM,CAAC;EACpF;EAEA,OAAO,KAAK;CACd;AACF;;CA1BC,UAAU;oBAGN,OAAO,YAAY,CAAA;oBAEnB,OAAO,cAAc,aAAa,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC+BvC,MAAM,gCAAgB,IAAI,QAA6D;AAEvF,SAAS,mBAAmB,UAA+D;CACzF,IAAI,MAAM,cAAc,IAAI,QAAQ;CACpC,IAAI,CAAC,KAAK;EACR,sBAAM,IAAI,IAAI;EACd,cAAc,IAAI,UAAU,GAAG;CACjC;CACA,OAAO;AACT;AAEA,oBAAoB,MAAM,WAAW,SAEnC,MACA,UACM;CACN,mBAAmB,IAAI,EAAE,IAAI,MAAM,QAAQ;AAC7C,CAAC;AAED,oBAAoB,MAAM,eAAe,WAEQ;CAC/C,QAAQ,cAAc,IAAI,IAAI,qBAAK,IAAI,IAA+B,GAAG,QAAQ;AACnF,CAAC;AA2BD,MAAM,0BAA0B;AAChC,MAAM,yBAAyB;;;;;;AAO/B,SAAgB,iCAAiC,OAG/C;CACA,OAAO;EACL,MAAM,IAAI,KAAK;GACb,OAAO,MAAM,MAAM,IAAyB,GAAG,yBAAyB,KAAK;EAC/E;EACA,MAAM,IAAI,KAAK,OAAO,SAAS;GAC7B,MAAM,MAAM,IAAI,GAAG,yBAAyB,OAAO,OAAO,uBAAuB;EACnF;CACF;AACF;;;;;;;;;;AAWA,SAAgB,mBACd,UACsC;CACtC,MAAM,QAA8C,CAAC;CAErD,KAAK,MAAM,CAAC,MAAM,aAAa,SAAS,YAAY,GAClD,MAAM,QAAQ,OAAO,QAA2D;EAC9E,MAAM,WAAW,MAAM,SAAS,GAAG;EACnC,MAAM,cAAc,MAAM,QAAQ,QAAQ,IAAI,WAAW,CAAC,QAAQ,GAAG,QAAQ,MAAM,CAAC,EAAE,QAAQ;EAC9F,IAAI,WAAW,WAAW,GAAG,OAAO;EAEpC,MAAM,SAAS,WAAW,QAAQ,GAAG,MACnC,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,gBAAgB,IAAI,CAC3D;EAEA,OAAO;GAAE,QAAQ,OAAO;GAAe,KAAK,OAAO;EAAI;CACzD;CAGF,OAAO;AACT;;;ACzJA,IAAa,oBAAb,cAAuC,cAAc;CACvB;CAA5B,YAAY,OAAgC;EAC1C,MAAM,KAAK,gBAAgB;EADD,KAAA,QAAA;CAE5B;AACF;AAEA,IAAa,0BAAb,cAA6C,cAAc;CACzD,cAAc;EAAE,MAAM,KAAK,2BAA2B;CAAE;AAC1D;AAEA,IAAa,uBAAb,cAA0C,cAAc;CACtD,cAAc;EAAE,MAAM,KAAK,kBAAkB;CAAE;AACjD;AAEA,IAAa,oBAAb,cAAuC,cAAc;CACvB;CAA5B,YAAY,OAAgC;EAC1C,MAAM,KAAK,uBAAuB;EADR,KAAA,QAAA;CAE5B;AACF;AAEA,IAAa,sBAAb,cAAyC,cAAc;CACrD,cAAc;EAAE,MAAM,KAAK,iBAAiB;CAAE;AAChD;AAEA,IAAa,4BAAb,cAA+C,cAAc;CAC3D,cAAc;EAAE,MAAM,KAAK,wBAAwB;CAAE;AACvD;AAEA,IAAa,wBAAb,cAA2C,cAAc;CAC3B;CAA5B,YAAY,OAAgC;EAC1C,MAAM,KAAK,oBAAoB;EADL,KAAA,QAAA;CAE5B;AACF;AAEA,IAAa,wBAAb,cAA2C,cAAc;CAC3B;CAA5B,YAAY,WAAoC;EAC9C,MAAM,KAAK,oBAAoB;EADL,KAAA,YAAA;CAE5B;AACF;AAEA,IAAa,uBAAb,cAA0C,cAAc;CAC1B;CAA5B,YAAY,WAAoC;EAC9C,MAAM,KAAK,mBAAmB;EADJ,KAAA,YAAA;CAE5B;AACF;AAEA,IAAa,4BAAb,cAA+C,cAAc;CAC/B;CAA5B,YAAY,OAAgC;EAC1C,MAAM,KAAK,wBAAwB;EADT,KAAA,QAAA;CAE5B;AACF;AAEA,IAAa,2BAAb,cAA8C,cAAc;CAC9B;CAA5B,YAAY,UAAmC;EAC7C,MAAM,KAAK,+BAA+B;EADhB,KAAA,WAAA;CAE5B;AACF;AAEA,IAAa,+BAAb,cAAkD,cAAc;CAC9D,cAAc;EAAE,MAAM,KAAK,4BAA4B;CAAE;AAC3D;AAEA,IAAa,wBAAb,cAA2C,cAAc;CAC3B;CAA5B,YAAY,UAAmC;EAC7C,MAAM,KAAK,mCAAmC;EADpB,KAAA,WAAA;CAE5B;AACF;AAEA,IAAa,yBAAb,cAA4C,cAAc;CACxD,cAAc;EAAE,MAAM,KAAK,sBAAsB;CAAE;AACrD;AAEA,IAAa,uBAAb,cAA0C,cAAc;CACtD,cAAc;EAAE,MAAM,KAAK,mBAAmB;CAAE;AAClD;AAEA,IAAa,iCAAb,cAAoD,cAAc;CAChE,cAAc;EAAE,MAAM,KAAK,8BAA8B;CAAE;AAC7D;AAEA,IAAa,8BAAb,cAAiD,cAAc;CAC7D,cAAc;EAAE,MAAM,KAAK,6BAA6B;CAAE;AAC5D;AAEA,IAAa,4BAAb,cAA+C,cAAc;CAC/B;CAA5B,YAAY,QAAiC;EAC3C,MAAM,KAAK,yBAAyB;EADV,KAAA,SAAA;CAE5B;AACF;AAEA,IAAa,2BAAb,cAA8C,cAAc;CAC1D,cAAc;EAAE,MAAM,KAAK,wBAAwB;CAAE;AACvD;AAEA,IAAa,oBAAb,cAAuC,cAAc;CACnD,cAAc;EAAE,MAAM,KAAK,eAAe;CAAE;AAC9C;AAEA,IAAa,0BAAb,cAA6C,cAAc;CACzD,cAAc;EAAE,MAAM,KAAK,sBAAsB;CAAE;AACrD;AAEA,IAAa,qBAAb,cAAwC,cAAc;CACpD,cAAc;EAAE,MAAM,KAAK,wBAAwB;CAAE;AACvD;AAEA,IAAa,4BAAb,cAA+C,cAAc;CAC3D,cAAc;EAAE,MAAM,KAAK,kCAAkC;CAAE;AACjE;AAEA,IAAa,4BAAb,cAA+C,cAAc;CAC3D,cAAc;EAAE,MAAM,KAAK,wBAAwB;CAAE;AACvD;AAEA,IAAa,qBAAb,cAAwC,cAAc;CACpD,cAAc;EAAE,MAAM,KAAK,gBAAgB;CAAE;AAC/C;;;ACpHA,IAAa,oBAAb,cAAuC,cAAc;CACnD,cAAc;EAAE,MAAM,KAAK,0BAA0B;CAAE;AACzD;;;ACFA,IAAa,4BAAb,cAA+C,cAAc;CAC3D,cAAc;EAAE,MAAM,KAAK,wBAAwB;CAAE;AACvD;AACA,IAAa,kCAAb,cAAqD,cAAc;CACjE,cAAc;EAAE,MAAM,KAAK,+BAA+B;CAAE;AAC9D;AACA,IAAa,sCAAb,cAAyD,cAAc;CACrE,cAAc;EAAE,MAAM,KAAK,sBAAsB;CAAE;AACrD;AACA,IAAa,oCAAb,cAAuD,cAAc;CACnE,cAAc;EAAE,MAAM,KAAK,gCAAgC;CAAE;AAC/D;AACA,IAAa,+CAAb,cAAkE,cAAc;CAC9E,cAAc;EAAE,MAAM,KAAK,+BAA+B;CAAE;AAC9D;AACA,IAAa,4BAAb,cAA+C,cAAc;CAC3D,cAAc;EAAE,MAAM,KAAK,gCAAgC;CAAE;AAC/D;AACA,IAAa,gCAAb,cAAmD,cAAc;CAC/D,cAAc;EAAE,MAAM,KAAK,4BAA4B;CAAE;AAC3D;AACA,IAAa,8BAAb,cAAiD,cAAc;CAC7D,cAAc;EAAE,MAAM,KAAK,6CAA6C;CAAE;AAC5E;AACA,IAAa,gCAAb,cAAmD,cAAc;CAC/D,cAAc;EAAE,MAAM,KAAK,gBAAgB;CAAE;AAC/C;AACA,IAAa,gCAAb,cAAmD,cAAc;CAC/D,cAAc;EAAE,MAAM,KAAK,gBAAgB;CAAE;AAC/C;;;AC7BA,IAAa,qBAAb,cAAwC,cAAc;CACpD,cAAc;EAAE,MAAM,KAAK,gCAAgC;CAAE;AAC/D;;;;;;ACyCA,SAAgB,mBAAmB,OAAmC;CACpE,MAAM,YAAY,MAAM,MAAM;CAE9B,IAAI,MAAM,WAAW,SAAS;EAE5B,MAAM,WADU,MAAM,QACG,IAAI,UAAU,KAAK;EAE5C,IAAI,SAAS,SAAS,eAAe,GAAG,OAAO,IAAI,kBAAkB;EACrE,IAAI,SAAS,SAAS,eAAe,GAAG,OAAO,IAAI,kBAAkB;EACrE,IAAI,SAAS,SAAS,mBAAmB,GAAG,OAAO,IAAI,kBAAkB;EACzE,IAAI,SAAS,SAAS,0BAA0B,GAAG,OAAO,IAAI,kBAAkB;EAChF,IAAI,SAAS,SAAS,uBAAuB,GAAG,OAAO,IAAI,UAAU,uBAAuB;EAC5F,IAAI,SAAS,SAAS,0BAA0B,GAAG,OAAO,IAAI,UAAU,0BAA0B;CACpG;CAEA,IAAI,CAAC,WACH,OAAO,IAAI,UAAU,kCAAkC;CAMzD,IAAI,cAAc,oBAAoB,cAAc,gBAAgB,OAAO,IAAI,kBAAkB;CACjG,IAAI,cAAc,wBAAwB,OAAO,IAAI,uBAAuB;CAG5E,IAAI,cAAc,6BAA6B,OAAO,IAAI,wBAAwB;CAClF,IAAI,cAAc,oBAAoB,OAAO,IAAI,qBAAqB;CACtE,IAAI,cAAc,iBAAiB,OAAO,IAAI,kBAAkB;CAGhE,IAAI,cAAc,mBAAmB,OAAO,IAAI,oBAAoB;CACpE,IAAI,cAAc,qBAAqB,OAAO,IAAI,0BAA0B;CAC5E,IAAI,cAAc,4BAA4B,OAAO,IAAI,UAAU,0BAA0B;CAC7F,IAAI,cAAc,yBAAyB,OAAO,IAAI,UAAU,4BAA4B;CAG5F,IAAI,cAAc,sBAAsB,OAAO,IAAI,sBAAsB;CACzE,IAAI,cAAc,4BAA4B,OAAO,IAAI,0BAA0B;CACnF,IAAI,cAAc,0BAA0B,OAAO,IAAI,0BAA0B;CACjF,IAAI,cAAc,kBAAkB,OAAO,IAAI,mBAAmB;CAGlE,IAAI,cAAc,sBAAsB,OAAO,IAAI,sBAAsB,CAAC;CAC1E,IAAI,cAAc,qBAAqB,OAAO,IAAI,qBAAqB,GAAG;CAG1E,IAAI,cAAc,yBAAyB,cAAc,yCACvD,OAAO,IAAI,0BAA0B;CAEvC,IAAI,cAAc,qBAAqB,OAAO,IAAI,qBAAqB;CACvE,IAAI,cAAc,gCAAgC,OAAO,IAAI,+BAA+B;CAC5F,IAAI,cAAc,iCAAiC,OAAO,IAAI,6BAA6B;CAG3F,IAAI,cAAc,yBAAyB,OAAO,IAAI,UAAU,uBAAuB;CACvF,IAAI,cAAc,yBAAyB,OAAO,IAAI,UAAU,uBAAuB;CACvF,IAAI,cAAc,2BAA2B,OAAO,IAAI,UAAU,8BAA8B;CAGhG,IAAI,cAAc,mCAAmC,cAAc,iCACjE,OAAO,IAAI,yBAAyB;CAEtC,IAAI,cAAc,sBAAsB,OAAO,IAAI,sBAAsB;CAGzE,IAAI,cAAc,0BAA0B,OAAO,IAAI,yBAAyB;CAChF,IAAI,cAAc,iBAAiB,OAAO,IAAI,kBAAkB;CAChE,IAAI,cAAc,iBAAiB,OAAO,IAAI,kBAAkB;CAGhE,IAAI,cAAc,+BAA+B,cAAc,wBAC7D,OAAO,IAAI,4BAA4B;CAIzC,IACE,cAAc,0BACX,cAAc,0BACd,cAAc,mCACd,cAAc,gCACd,cAAc,yBAEjB,OAAO,IAAI,wBAAwB;CAIrC,IACE,cAAc,oBACX,cAAc,4BACd,cAAc,uCAEjB,OAAO,IAAI,mBAAmB;CAIhC,IACE,cAAc,sBACX,cAAc,mBACd,cAAc,uBACd,cAAc,4BACd,cAAc,oCACd,cAAc,6CAEjB,OAAO,IAAI,0BAA0B;CAIvC,IAAI,cAAc,mCAAmC,cAAc,kCACjE,OAAO,IAAI,UAAU,0BAA0B;CAMjD,IAAI,cAAc,4BAA4B,cAAc,0BAC1D,OAAO,IAAI,0BAA0B;CAIvC,IACE,cAAc,sBACX,cAAc,8CACd,cAAc,oCAEjB,OAAO,IAAI,gCAAgC;CAI7C,IAAI,cAAc,0BAA0B,cAAc,iCACxD,OAAO,IAAI,oCAAoC;CAIjD,IACE,cAAc,iDACX,cAAc,wEAEjB,OAAO,IAAI,6CAA6C;CAI1D,IAAI,cAAc,oBAAoB,cAAc,kCAClD,OAAO,IAAI,8BAA8B;CAI3C,IAAI,cAAc,oBAAoB,cAAc,oBAClD,OAAO,IAAI,8BAA8B;CAI3C,IACE,cAAc,iCACX,cAAc,qCACd,cAAc,mDACd,cAAc,kDACd,cAAc,yBACd,cAAc,8BAEjB,OAAO,IAAI,0BAA0B;CAIvC,IACE,cAAc,0DACX,cAAc,kDACd,cAAc,2CACd,cAAc,8BACd,cAAc,+BACd,cAAc,kBAEjB,OAAO,IAAI,8BAA8B;CAI3C,IACE,cAAc,yDACX,cAAc,wDACd,cAAc,gCACd,cAAc,sCACd,cAAc,iCACd,cAAc,mCACd,cAAc,6BACd,cAAc,gCACd,cAAc,qDAEjB,OAAO,IAAI,4BAA4B;CAIzC,IACE,UAAU,WAAW,yBAAyB,KAC3C,cAAc,+CACd,cAAc,iDACd,cAAc,qDACd,cAAc,uBAEjB,OAAO,IAAI,kCAAkC;CAI/C,OAAO,IAAI,UAAU,kCAAkC;AACzD;;;;;;AAOA,SAAgB,WAAW,OAAmC;CAC5D,IAAI,iBAAiB,UAAU,OAAO;CAEtC,OACE,iBAAiB,SACd,MAAM,SAAS,cACf,YAAY,SACZ,gBAAgB;AAEvB;;;;;;;ACjQA,SAAgB,wBAAyD;CACvE,OAAO;EACL,OAAO;EACP,UAAU,UAAU;GAClB,IAAI,WAAW,KAAK,GAClB,MAAM,mBAAmB,KAAK;GAEhC,MAAM;EACR;CACF;AACF;;;;AAKA,MAAa,iBAAiB,OAAU,OAAqC;CAC3E,IAAI;EACF,OAAO,MAAM,GAAG;CAClB,SAAS,OAAO;EACd,IAAI,WAAW,KAAK,GAClB,MAAM,mBAAmB,KAAK;EAEhC,MAAM;CACR;AACF;;;ACFO,IAAA,cAAA,MAAM,YAAoE;CAIpC;CAH3C;CAEA,YACE,SACA;EADyC,KAAA,UAAA;CACxC;;;;CAKH,IAAI,OAAuB;EACzB,KAAK,kBAAkB,WAAW;GAC9B,GAAG,KAAK;GACR,YAAY,sBAAsB;EACtC,CAAC;EAED,OAAO,KAAK;CACd;AACF;0BAnBC,QAAQ,YAAY,GAAA,gBAAA,GAKhB,OAAO,YAAY,CAAA,CAAA,GAAA,WAAA;;;;ACoDjB,IAAA,aAAA,cAAA,MAAM,WAAwC;;;;;;;CAOnD,gBAAgB,QAAsB;EACpC,OAAO,IAAI,6BAA6B;CAC1C;;;;;;;;;;;CAYA,OAAO,aACL,SACe;EACf,MAAM,EAAE,kBAAkB;EAC1B,MAAM,aAAa,QAAQ,UAAU,CAAC;EACtC,MAAM,cAAc,QAAQ;EAE5B,MAAM,sBAAsB;GAC1B,SAAS;GACT,aAAa,WAAsB,GAAG,aAA2C;IAC/E,IAAI,MAAM,YAAY,GAAG,QAAQ;IAEjC,IAAI,eACF,MAAM;KACJ,GAAG;KACH,SAAS,CAAC,sBAAsB,aAAa,GAAG,GAAI,IAAI,WAAW,CAAC,CAAE;IACxE;IAOF,IAJ2B,UAAU,aACnC,oBAAoB,YAGD,GAAG;KACtB,MAAM,QAAQ,UAAU,QAA2B,oBAAoB,KAAK;KAC5E,MAAM,WAAW,UAAU,QAA6B,oBAAoB,QAAQ;KAEpF,MAAM;MACJ,GAAG;MACH,WAAW;OACT,SAAS;OACT,GAAG,IAAI;OACP,eAAe,IAAI,WAAW,iBAAiB,iCAAiC,KAAK;OACrF,aAAa;QACX,GAAG,mBAAmB,QAAQ;QAC9B,GAAI,IAAI,WAAW,eAAe,CAAC;OACrC;MACF;KACF;IACF;IAEA,OAAO;GACT;GACA,QAAQ,CAAC,iBAAiB,GAAG,UAAU;EACzC;EAEA,OAAO;GACL,QAAA;GACA,WAAW;IACT;IACA;KACE,SAAS;KACT,UAAU;IACZ;IACA,GAAI,gBACA,CACA;KAAE,SAAS,UAAU;KAAS,UAAU;IAAmC,GAC3E;KAAE,SAAS,UAAU;KAAe,UAAU;IAAc,CAC9D,IACE,CAAC;GACP;EACF;CACF;AACF;uCAvFC,OAAO,EACN,WAAW,CAAC,WAAW,EACzB,CAAC,CAAA,GAAA,UAAA"}

package/dist/database/index.d.mts

@@ -1,3 +1,3 @@
 import { a as InferConnectionSchema, i as InferConnectionExtensions, n as DefaultConnectionName, o as InternalDatabaseEventContext, r as InferAnySchema, s as StratalDatabase, t as ConnectionName } from "../types-CWZ9q74G.mjs";
-import { A as DATABASE_TOKENS, C as GetResult, D as UniqueConstraintError, E as fromZenStackError, F as DatabaseModuleConfig, M as DatabaseService, N as DatabaseConnectionConfig, O as RecordNotFoundError, P as DatabaseModule, S as GetEntity, T as ParseEvent, _ as EntityEventName, a as DbPushCommand, b as EventPhase, c as ZenStackCommand, d as EventEmitterPluginOptions, f as ErrorHandlerPlugin, g as DatabaseOperation, h as DatabaseEvents, i as MigrateDeployCommand, j as connectionSymbol, k as InjectDB, l as SchemaSwitcher, m as DatabaseEventName, n as MigrateResetCommand, o as DbPullCommand, p as databaseMessages, r as MigrateDevCommand, s as DbGenerateCommand, t as MigrateStatusCommand, u as EventEmitterPlugin, v as EntityEvents, w as ModelName, x as GetData, y as EntityMutationVerb } from "../index-DTXzJzpy.mjs";
+import { A as DATABASE_TOKENS, C as GetResult, D as UniqueConstraintError, E as fromZenStackError, F as DatabaseModuleConfig, M as DatabaseService, N as DatabaseConnectionConfig, O as RecordNotFoundError, P as DatabaseModule, S as GetEntity, T as ParseEvent, _ as EntityEventName, a as DbPushCommand, b as EventPhase, c as ZenStackCommand, d as EventEmitterPluginOptions, f as ErrorHandlerPlugin, g as DatabaseOperation, h as DatabaseEvents, i as MigrateDeployCommand, j as connectionSymbol, k as InjectDB, l as SchemaSwitcher, m as DatabaseEventName, n as MigrateResetCommand, o as DbPullCommand, p as databaseMessages, r as MigrateDevCommand, s as DbGenerateCommand, t as MigrateStatusCommand, u as EventEmitterPlugin, v as EntityEvents, w as ModelName, x as GetData, y as EntityMutationVerb } from "../index-Dt0YUA7r.mjs";
 export { ConnectionName, DATABASE_TOKENS, DatabaseConnectionConfig, DatabaseEventName, DatabaseEvents, DatabaseModule, DatabaseModuleConfig, DatabaseOperation, DatabaseService, DbGenerateCommand, DbPullCommand, DbPushCommand, DefaultConnectionName, EntityEventName, EntityEvents, EntityMutationVerb, ErrorHandlerPlugin, EventEmitterPlugin, EventEmitterPluginOptions, EventPhase, GetData, GetEntity, GetResult, InferAnySchema, InferConnectionExtensions, InferConnectionSchema, InjectDB, InternalDatabaseEventContext, MigrateDeployCommand, MigrateDevCommand, MigrateResetCommand, MigrateStatusCommand, ModelName, ParseEvent, RecordNotFoundError, SchemaSwitcher, StratalDatabase, UniqueConstraintError, ZenStackCommand, connectionSymbol, databaseMessages, fromZenStackError };

package/dist/database/index.mjs

@@ -357,6 +357,7 @@ z.object({
 */
 function makeReentrantTransaction(client, activeTransaction) {
 	return new Proxy(client, { get(target, prop, receiver) {
+		if (prop === Symbol.asyncDispose) return () => target.$disconnect();
 		if (prop !== "$transaction") return Reflect.get(target, prop, receiver);
 		const transaction = Reflect.get(target, prop);
 		return (input, options) => {
@@ -374,6 +375,7 @@ function createDatabaseService(conn, eventRegistry) {
 		...conn.plugins ?? []
 	];
 	const activeTransaction = new AsyncLocalStorage();
+	const instances = /* @__PURE__ */ new Set();
 	let DatabaseClient = class DatabaseClient extends ZenStackClient {
 		constructor() {
 			const dialect = conn.dialect();
@@ -382,7 +384,23 @@ function createDatabaseService(conn, eventRegistry) {
 				plugins,
 				computedFields: conn.computedFields
 			});
-			return makeReentrantTransaction(this, activeTransaction);
+			const client = makeReentrantTransaction(this, activeTransaction);
+			for (const ref of instances) if (ref.deref() === void 0) instances.delete(ref);
+			instances.add(new WeakRef(client));
+			return client;
+		}
+		static async disposeInstances() {
+			const live = [...instances];
+			instances.clear();
+			await Promise.all(live.map(async (ref) => {
+				const client = ref.deref();
+				if (!client) return;
+				try {
+					await client.$disconnect();
+				} catch (error) {
+					console.error(`[stratal] Failed to disconnect database client "${conn.name}":`, error);
+				}
+			}));
 		}
 	};
 	DatabaseClient = __decorate([Transient()], DatabaseClient);
@@ -410,6 +428,7 @@ const databaseMessages = { en: {
 //#region src/database/database.module.ts
 var _DatabaseModule;
 let DatabaseModule = _DatabaseModule = class DatabaseModule {
+	services = [];
 	static forRoot(config) {
 		return {
 			module: _DatabaseModule,
@@ -434,12 +453,15 @@ let DatabaseModule = _DatabaseModule = class DatabaseModule {
 		const eventRegistry = (await context.container.resolve(DI_TOKENS.LazyModuleLoader).load(() => import("stratal/events").then((m) => m.EventsModule))).get(DI_TOKENS.EventRegistry);
 		for (const conn of config.connections) {
 			const Service = createDatabaseService(conn, eventRegistry);
+			this.services.push(Service);
 			context.container.register(connectionSymbol(conn.name), lazy(() => Service));
 		}
 		context.container.registerExisting(DI_TOKENS.Database, connectionSymbol(config.default));
 		context.logger.info("DatabaseModule initialized");
 	}
-	onShutdown(context) {
+	async onShutdown(context) {
+		await Promise.all(this.services.map((service) => service.disposeInstances()));
+		this.services.length = 0;
 		context.logger.info("DatabaseModule shutdown");
 	}
 };

package/dist/database/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../src/database/commands/zenstack.command.ts","../../src/database/commands/db-generate.command.ts","../../src/database/commands/db-pull.command.ts","../../src/database/commands/db-push.command.ts","../../src/database/commands/migrate-deploy.command.ts","../../src/database/commands/migrate-dev.command.ts","../../src/database/commands/migrate-reset.command.ts","../../src/database/commands/migrate-status.command.ts","../../src/database/errors/record-not-found.error.ts","../../src/database/errors/unique-constraint.error.ts","../../src/database/errors/from-zenstack-error.ts","../../src/database/plugins/error-handler.plugin.ts","../../src/database/plugins/event-emitter.plugin.ts","../../src/database/plugins/schema-switcher.ts","../../src/database/database.helpers.ts","../../src/database/database.tokens.ts","../../src/database/i18n/en.ts","../../src/database/database.module.ts","../../src/database/decorators/inject-db.decorator.ts"],"sourcesContent":["import { Command } from 'stratal/quarry'\n\n/**\n * Base command for ZenStack CLI wrappers.\n * Uses execFileSync with array arguments to prevent shell injection.\n */\nexport abstract class ZenStackCommand extends Command {\n  protected async zenstack(args: string[]): Promise<number> {\n    // Dynamic import — node:child_process is only available in the Quarry CLI (Node) context\n    const { execFileSync } = await import('node:child_process')\n\n    try {\n      const output = execFileSync('npx', ['zenstack', ...args], {\n        encoding: 'utf-8',\n        stdio: 'pipe',\n      })\n      if (output) this.info(output.trim())\n      return 0\n    } catch (err) {\n      const error = err as { stderr?: string; stdout?: string; status?: number }\n      if (error.stderr) this.error(error.stderr.trim())\n      if (error.stdout) this.info(error.stdout.trim())\n      return error.status ?? 1\n    }\n  }\n}\n","import { ZenStackCommand } from './zenstack.command'\n\nexport class DbGenerateCommand extends ZenStackCommand {\n  static command = 'db:generate {--schema= : Path to schema file} {--watch : Enable watch mode}'\n  static description = 'Generate ZenStack ORM client'\n\n  async handle(): Promise<number> {\n    const args = ['generate']\n    const schema = this.string('schema')\n\n    if (schema) args.push('--schema', schema)\n    if (this.boolean('watch')) args.push('--watch')\n\n    return this.zenstack(args)\n  }\n}\n","import { ZenStackCommand } from './zenstack.command'\n\nexport class DbPullCommand extends ZenStackCommand {\n  static command = 'db:pull {--schema= : Path to schema file}'\n  static description = 'Introspect database and generate schema'\n\n  async handle(): Promise<number> {\n    const args = ['db', 'pull']\n    const schema = this.string('schema')\n\n    if (schema) args.push('--schema', schema)\n\n    return this.zenstack(args)\n  }\n}\n","import { ZenStackCommand } from './zenstack.command'\n\nexport class DbPushCommand extends ZenStackCommand {\n  static command = 'db:push {--schema= : Path to schema file} {--accept-data-loss : Accept data loss} {--force-reset : Force reset database}'\n  static description = 'Push database schema changes'\n\n  async handle(): Promise<number> {\n    const args = ['db', 'push']\n    const schema = this.string('schema')\n\n    if (schema) args.push('--schema', schema)\n    if (this.boolean('accept-data-loss')) args.push('--accept-data-loss')\n    if (this.boolean('force-reset')) args.push('--force-reset')\n\n    return this.zenstack(args)\n  }\n}\n","import { ZenStackCommand } from './zenstack.command'\n\nexport class MigrateDeployCommand extends ZenStackCommand {\n  static command = 'migrate:deploy {--schema= : Path to schema file}'\n  static description = 'Deploy pending migrations'\n\n  async handle(): Promise<number> {\n    const args = ['migrate', 'deploy']\n    const schema = this.string('schema')\n\n    if (schema) args.push('--schema', schema)\n\n    return this.zenstack(args)\n  }\n}\n","import { ZenStackCommand } from './zenstack.command'\n\nexport class MigrateDevCommand extends ZenStackCommand {\n  static command = 'migrate:dev {--schema= : Path to schema file} {--name= : Migration name} {--create-only : Create without applying}'\n  static description = 'Create and apply migration'\n\n  async handle(): Promise<number> {\n    const args = ['migrate', 'dev']\n    const schema = this.string('schema')\n    const name = this.string('name')\n\n    if (schema) args.push('--schema', schema)\n    if (name) args.push('--name', name)\n    if (this.boolean('create-only')) args.push('--create-only')\n\n    return this.zenstack(args)\n  }\n}\n","import { ZenStackCommand } from './zenstack.command'\n\nexport class MigrateResetCommand extends ZenStackCommand {\n  static command = 'migrate:reset {--schema= : Path to schema file} {--force : Skip confirmation} {--skip-seed : Skip seeding}'\n  static description = 'Reset database'\n\n  async handle(): Promise<number> {\n    const args = ['migrate', 'reset']\n    const schema = this.string('schema')\n\n    if (schema) args.push('--schema', schema)\n    if (this.boolean('force')) args.push('--force')\n    if (this.boolean('skip-seed')) args.push('--skip-seed')\n\n    return this.zenstack(args)\n  }\n}\n","import { ZenStackCommand } from './zenstack.command'\n\nexport class MigrateStatusCommand extends ZenStackCommand {\n  static command = 'migrate:status {--schema= : Path to schema file}'\n  static description = 'Check migration status'\n\n  async handle(): Promise<number> {\n    const args = ['migrate', 'status']\n    const schema = this.string('schema')\n\n    if (schema) args.push('--schema', schema)\n\n    return this.zenstack(args)\n  }\n}\n","import { HttpException } from 'stratal/errors'\n\nexport class RecordNotFoundError extends HttpException {\n  constructor(public readonly details?: string, cause?: unknown) {\n    super(404, 'Record not found', cause)\n  }\n}\n","import { HttpException } from 'stratal/errors'\n\nexport class UniqueConstraintError extends HttpException {\n  constructor(public readonly fields?: string[], cause?: unknown) {\n    super(409, 'Record already exists', cause)\n  }\n}\n","import { ORMError, ORMErrorReason } from '@zenstackhq/orm';\nimport { type ApplicationError, DatabaseError } from 'stratal/errors';\nimport { RecordNotFoundError } from './record-not-found.error';\nimport { UniqueConstraintError } from './unique-constraint.error';\n\nexport function fromZenStackError(error: unknown): ApplicationError {\n  if (error instanceof ORMError) {\n    switch (error.reason) {\n      case ORMErrorReason.NOT_FOUND:\n        return new RecordNotFoundError(error.model, error)\n      case ORMErrorReason.DB_QUERY_ERROR:\n        return parseDatabaseError(error)\n      case ORMErrorReason.INVALID_INPUT:\n        return new DatabaseError('Invalid database query', error)\n      case ORMErrorReason.CONFIG_ERROR:\n        return new DatabaseError('Database configuration error', error)\n      case ORMErrorReason.NOT_SUPPORTED:\n        return new DatabaseError('Operation not supported', error)\n      case ORMErrorReason.INTERNAL_ERROR:\n        return new DatabaseError('Database internal error', error)\n      default:\n        return new DatabaseError('Database error', error)\n    }\n  }\n  return new DatabaseError('Database error', error)\n}\n\nfunction parseDatabaseError(error: ORMError): ApplicationError {\n  const dbErrorCode = error.dbErrorCode as string | undefined\n  if (dbErrorCode) {\n    if (dbErrorCode === '23505') return new UniqueConstraintError([error.model ?? 'unknown'], error)\n    if (dbErrorCode === '23503') return new DatabaseError('Foreign key constraint violation', error)\n    if (dbErrorCode === '23502') return new DatabaseError('Required field is missing', error)\n    if (dbErrorCode === '23514') return new DatabaseError('Database constraint violated', error)\n    if (dbErrorCode === '42P01') return new DatabaseError('Table does not exist', error)\n    if (dbErrorCode === '42703') return new DatabaseError('Column does not exist', error)\n    if (dbErrorCode.startsWith('42')) return new DatabaseError('Database syntax or access error', error)\n    if (dbErrorCode.startsWith('08')) return new DatabaseError('Database connection failed', error)\n    if (dbErrorCode === '57014') return new DatabaseError('Database query timeout', error)\n    if (dbErrorCode.startsWith('40')) return new DatabaseError('Transaction conflict or deadlock', error)\n    if (dbErrorCode === '53300') return new DatabaseError('Too many database connections', error)\n  }\n  return new DatabaseError('Database error', error)\n}\n","import { type RuntimePlugin } from '@zenstackhq/orm'\nimport { type SchemaDef } from '@zenstackhq/orm/schema'\nimport { fromZenStackError } from '../errors'\n\n/**\n * ZenStack runtime plugin that transforms ORM errors into ApplicationError instances.\n *\n * @example\n * ```typescript\n * super(schema, {\n *   dialect: new PostgresDialect({ pool }),\n *   plugins: [new ErrorHandlerPlugin()]\n * })\n * ```\n */\nexport class ErrorHandlerPlugin implements RuntimePlugin<SchemaDef, Record<string, unknown>, Record<string, unknown>, {}> {\n  readonly id = 'error-handler'\n\n  onQuery = async ({ args, proceed }: {\n    args: Record<string, unknown> | undefined\n    proceed: (args: Record<string, unknown> | undefined) => Promise<unknown>\n  }): Promise<unknown> => {\n    try {\n      return await proceed(args)\n    } catch (error) {\n      throw fromZenStackError(error)\n    }\n  }\n}\n","import { type EntityMutationHooksDef, type RuntimePlugin } from '@zenstackhq/orm';\nimport { type SchemaDef } from '@zenstackhq/orm/schema';\nimport type { EventContext, EventName, IEventRegistry } from 'stratal/events';\nimport type { ModelName } from '../event-types';\n\nexport interface EventEmitterPluginOptions {\n  eventRegistry: IEventRegistry\n}\n\ntype EntityMutationAction = 'create' | 'update' | 'delete'\n\nconst ENTITY_ACTION_VERB = {\n  create: 'created',\n  update: 'updated',\n  delete: 'deleted',\n} as const satisfies Record<EntityMutationAction, string>\n\ntype Entity = Record<string, unknown>\n\n/**\n * Pair before/after entity snapshots for a mutation. Rows are matched by\n * `id` when both sides carry one, falling back to positional pairing.\n */\nfunction pairEntities(\n  before: Entity[] | undefined,\n  after: Entity[] | undefined\n): { before: Entity | undefined; after: Entity | undefined }[] {\n  const primary = after ?? before ?? []\n  const counterpart = after ? before : undefined\n  const counterpartById = counterpart\n    ? new Map(counterpart.filter((c) => c.id !== undefined).map((c) => [c.id, c]))\n    : undefined\n\n  return primary.map((entity, index) => {\n    const match = counterpart\n      ? (entity.id !== undefined ? counterpartById?.get(entity.id) : undefined) ?? counterpart[index]\n      : undefined\n\n    return after\n      ? { before: match, after: entity }\n      : { before: entity, after: undefined }\n  })\n}\n\n/**\n * ZenStack runtime plugin that emits before/after events for database operations.\n *\n * Emits events in the format:\n * - `before.{Model}.{operation}` - Before the database operation\n * - `after.{Model}.{operation}` - After the database operation\n *\n * Additionally emits entity-mutation events carrying full entity snapshots:\n * - `entity.{Model}.created` - `{ after }`\n * - `entity.{Model}.updated` - `{ before, after }`\n * - `entity.{Model}.deleted` - `{ before }`\n *\n * Entity events are listener-driven: the pre-mutation snapshot is only\n * loaded (inside the mutation's transaction) when `hasListeners()` reports\n * a matching subscription, so models nobody observes pay no cost. Note that\n * a wildcard subscription (`entity`) therefore makes every model pay the\n * pre-read — subscribe per model when cost matters.\n *\n * @example\n * ```typescript\n * super(schema, {\n *   dialect: new PostgresDialect({ pool }),\n *   plugins: [\n *     new EventEmitterPlugin({\n *       eventRegistry,\n *     })\n *   ]\n * })\n * ```\n */\nexport class EventEmitterPlugin implements RuntimePlugin<SchemaDef, Record<string, unknown>, Record<string, unknown>, {}> {\n  readonly id = 'event-emitter'\n\n  constructor(private options: EventEmitterPluginOptions) { }\n\n  onEntityMutation: EntityMutationHooksDef<SchemaDef> = {\n    // Run after-hooks inside the mutation's transaction boundary so they\n    // execute within the caller's async context (AsyncLocalStorage intact):\n    // listeners resolve from the live request scope and tenant schema\n    // switching still applies. Post-commit hooks would run detached from the\n    // request's ALS. Listeners registered `blocking: false` still do their\n    // real work outside the transaction via waitUntil.\n    runAfterMutationWithinTransaction: true,\n\n    beforeEntityMutation: async (args) => {\n      // Created rows have no prior state to snapshot\n      if (args.action === 'create') return\n\n      const event = `entity.${args.model}.${ENTITY_ACTION_VERB[args.action]}` as EventName\n      if (!this.options.eventRegistry.hasListeners(event)) return\n\n      // Runs inside the mutation's transaction; ZenStack hands the result\n      // to afterEntityMutation as `beforeMutationEntities`\n      await args.loadBeforeMutationEntities()\n    },\n\n    afterEntityMutation: async (args) => {\n      const { model, action, beforeMutationEntities } = args\n      const verb = ENTITY_ACTION_VERB[action]\n      const event = `entity.${model}.${verb}` as EventName\n      const { eventRegistry } = this.options\n\n      if (!eventRegistry.hasListeners(event)) return\n\n      const after = action === 'delete' ? undefined : await args.loadAfterMutationEntities()\n\n      for (const pair of pairEntities(beforeMutationEntities, after)) {\n        // Producer boundary: ZenStack types `model` as plain string, but at\n        // runtime it is always a schema model name — assert that one fact.\n        const context: EventContext<'entity'> = {\n          model: model as ModelName,\n          action: verb,\n          before: pair.before,\n          after: pair.after,\n        }\n        await eventRegistry.emit(event, context)\n      }\n    },\n  }\n\n  onQuery = async ({ model, operation, args, proceed }: {\n    model: string\n    operation: string\n    args: Record<string, unknown> | undefined\n    proceed: (args: Record<string, unknown> | undefined) => Promise<unknown>\n  }): Promise<unknown> => {\n    const { eventRegistry } = this.options\n    const eventBase = `${model}.${operation}`\n\n    // Emit BEFORE event\n    await eventRegistry.emit(`before.${eventBase}` as EventName, {\n      data: args,\n    })\n\n    // Execute the actual database operation\n    const result = await proceed(args)\n\n    // Emit AFTER event\n    await eventRegistry.emit(`after.${eventBase}` as EventName, {\n      data: args,\n      result,\n    })\n\n    return result\n  }\n}\n","interface SwitchableClient {\n  $schema: { provider: { defaultSchema: string } } & Record<string, unknown>\n  schema: unknown\n}\n\n/**\n * Switches the active schema on a ZenStack/Kysely database client by mutating\n * `$schema.provider.defaultSchema`. This causes ZenStack's QueryNameMapper to\n * generate fully-qualified table references (e.g. `\"tenant_123\".\"User\"`).\n *\n * Must be called BEFORE any queries are made on the client.\n *\n * Note: The ZenStack RuntimePlugin `onQuery` hook fires after table names are\n * already resolved, so a plugin-based approach cannot set the schema prefix.\n * Direct client mutation is the only supported method.\n */\nexport class SchemaSwitcher {\n  static apply<T>(client: T, schemaName: string): T {\n    const c = client as unknown as SwitchableClient\n    const switched = {\n      ...c.$schema,\n      provider: { ...c.$schema.provider, defaultSchema: schemaName },\n    }\n    c.$schema = switched\n    c.schema = switched\n    return client\n  }\n}\n","import { ZenStackClient, type AnyPlugin } from '@zenstackhq/orm';\nimport { AsyncLocalStorage } from 'node:async_hooks';\nimport { Transient } from 'stratal/di';\nimport type { IEventRegistry } from 'stratal/events';\nimport { withZodI18n, z } from 'stratal/validation';\nimport type { DatabaseConnectionConfig } from './database.module';\nimport { ErrorHandlerPlugin, EventEmitterPlugin } from './plugins';\n\nconst databaseConnectionSchema = z.object({\n  name: z.string().min(1, withZodI18n('database.connectionNameRequired')),\n  schema: z.object({}).loose(),\n  dialect: z.function(),\n  plugins: z.array(z.object({}).loose()).optional(),\n  computedFields: z.object({}).loose().optional(),\n})\n\nexport const databaseModuleConfigSchema = z.object({\n  default: z.string().min(1, withZodI18n('database.defaultConnectionRequired')),\n  connections: z.array(databaseConnectionSchema).min(1, withZodI18n('database.connectionRequired')),\n}).refine(\n  (config) => {\n    const names = config.connections.map(c => c.name)\n    return new Set(names).size === names.length\n  },\n  withZodI18n('database.duplicateConnections')\n).refine(\n  (config) => config.connections.some(c => c.name === config.default),\n  withZodI18n('database.defaultConnectionNotFound')\n)\n\ntype ZenStackClientInstance = InstanceType<typeof ZenStackClient>\n\n/**\n * Wrap a ZenStack client so `$transaction` is reentrant: when a transaction is\n * already open on this connection (tracked per-connection via\n * {@link AsyncLocalStorage}), nested calls run within the active transaction's\n * client instead of opening a new one. ZenStack only reuses a connection when\n * `$transaction` is called on a transaction client; callers holding the base\n * client (e.g. the better-auth adapter, which since better-auth 1.6.11 nests\n * transactions to atomically consume verification rows) would otherwise open a\n * fresh transaction. On a small pool (e.g. a Hyperdrive-fronted `max: 1` pg\n * pool) that inner transaction blocks forever waiting for the connection the\n * outer one holds — a deadlock surfacing as a backend stuck `idle in\n * transaction`. Reusing the active client is also the correct semantics: nested\n * transactions form a single atomic unit.\n *\n * ZenStackClient's constructor returns a Proxy (for dynamic model accessors), so\n * a subclass method override is shadowed — hence the proxy wrapper here.\n */\nfunction makeReentrantTransaction<T extends object>(\n  client: T,\n  activeTransaction: AsyncLocalStorage<ZenStackClientInstance>,\n): T {\n  return new Proxy(client, {\n    get(target, prop, receiver) {\n      if (prop !== '$transaction') {\n        // Forward the receiver so getters/methods resolve `this` against the\n        // proxy (correct for layered proxies / accessor properties).\n        return Reflect.get(target, prop, receiver)\n      }\n      // Read the original `$transaction` off the target WITHOUT the receiver — a\n      // receiver of the proxy would re-enter this trap and recurse infinitely.\n      const transaction = Reflect.get(target, prop) as (\n        input: unknown,\n        options?: unknown,\n      ) => unknown\n      return (input: unknown, options?: unknown) => {\n        const active = activeTransaction.getStore()\n        if (active) {\n          return typeof input === 'function'\n            ? (input as (tx: ZenStackClientInstance) => unknown)(active)\n            : (active.$transaction as (i: unknown, o?: unknown) => unknown)(input, options)\n        }\n        if (typeof input !== 'function') {\n          return transaction.call(target, input, options)\n        }\n        return transaction.call(\n          target,\n          (tx: ZenStackClientInstance) =>\n            activeTransaction.run(tx, () => (input as (t: ZenStackClientInstance) => unknown)(tx)),\n          options,\n        )\n      }\n    },\n  })\n}\n\nexport function createDatabaseService(\n  conn: DatabaseConnectionConfig,\n  eventRegistry: IEventRegistry,\n): new () => InstanceType<typeof ZenStackClient> {\n  const plugins: AnyPlugin[] = [\n    new ErrorHandlerPlugin(),\n    new EventEmitterPlugin({\n      eventRegistry,\n    }),\n    ...(conn.plugins ?? []),\n  ]\n\n  // Tracks the in-flight interactive transaction client for this connection so\n  // nested `$transaction` calls reuse it instead of acquiring a second\n  // connection. ZenStack's own reuse only triggers when `$transaction` is\n  // invoked on a transaction client; callers that hold the base client (e.g.\n  // the better-auth adapter, which since better-auth 1.6.11 nests transactions\n  // to atomically consume verification rows) instead open a fresh transaction.\n  // On a small pool (e.g. a Hyperdrive-fronted `max: 1` pg pool) the inner\n  // transaction then blocks forever waiting for the connection the outer one\n  // holds — a deadlock that surfaces as a Postgres backend stuck `idle in\n  // transaction`. Reusing the active client makes nested transactions share the\n  // single connection, which is also the correct semantics (one atomic unit).\n  const activeTransaction = new AsyncLocalStorage<InstanceType<typeof ZenStackClient>>()\n\n  @Transient()\n  class DatabaseClient extends ZenStackClient<typeof conn.schema> {\n    constructor() {\n      const dialect = conn.dialect()\n      // ZenStack 3+ requires `computedFields` whenever the schema declares any\n      // `@computed` fields, so pass them through when the consumer provides them.\n      super(conn.schema, {\n        dialect,\n        plugins,\n        // @ts-expect-error - ZenStack 3+ requires `computedFields` whenever the schema declares any `@computed` fields, so pass them through when the consumer provides them.\n        computedFields: conn.computedFields\n      })\n      // ZenStackClient's constructor returns a Proxy (for dynamic model\n      // accessors), so subclass method overrides are shadowed. Wrap it in a\n      // proxy that makes `$transaction` reentrant. Returning from the\n      // constructor replaces the instance DI receives.\n      return makeReentrantTransaction(this as InstanceType<typeof ZenStackClient>, activeTransaction)\n    }\n  }\n\n  return DatabaseClient\n}\n","export const DATABASE_TOKENS = {\n  Options: Symbol.for('stratal:database:options'),\n  Services: Symbol.for('stratal:database:services'),\n} as const\n\nimport type { ConnectionName } from './types'\n\nexport function connectionSymbol(name: ConnectionName): symbol {\n  return Symbol.for(`stratal:database:connection:${name}`)\n}\n","export const databaseMessages = {\n  en: {\n    connectionNameRequired: 'Connection name is required',\n    defaultConnectionRequired: 'Default connection name is required',\n    connectionRequired: 'At least one connection is required',\n    duplicateConnections: 'Duplicate connection names found',\n    defaultConnectionNotFound: 'Default connection not found in connections',\n  },\n} as const\n\ndeclare module 'stratal/i18n' {\n  interface AppMessageNamespaces {\n    database: typeof databaseMessages['en']\n  }\n}\n","import type { AnyPlugin, ClientOptions, ComputedFieldsOptions } from '@zenstackhq/orm';\nimport type { SchemaDef } from '@zenstackhq/schema';\nimport { DI_TOKENS, lazy } from 'stratal/di';\nimport type { IEventRegistry } from 'stratal/events';\nimport { I18nModule } from 'stratal/i18n';\nimport {\n    Module,\n    type AsyncModuleOptions,\n    type DynamicModule,\n    type LazyModuleLoader,\n    type ModuleContext,\n    type OnInitialize,\n    type OnShutdown,\n} from 'stratal/module';\nimport { DbGenerateCommand } from './commands/db-generate.command';\nimport { DbPullCommand } from './commands/db-pull.command';\nimport { DbPushCommand } from './commands/db-push.command';\nimport { MigrateDeployCommand } from './commands/migrate-deploy.command';\nimport { MigrateDevCommand } from './commands/migrate-dev.command';\nimport { MigrateResetCommand } from './commands/migrate-reset.command';\nimport { MigrateStatusCommand } from './commands/migrate-status.command';\nimport { createDatabaseService } from './database.helpers';\nimport { connectionSymbol, DATABASE_TOKENS } from './database.tokens';\nimport { databaseMessages } from './i18n';\nimport type { ConnectionName, DefaultConnectionName } from './types';\n\nexport interface DatabaseConnectionConfig<\n  Schema extends SchemaDef = SchemaDef,\n  Name extends ConnectionName = ConnectionName,\n> {\n  name: Name\n  schema: Schema\n  dialect: () => ClientOptions<SchemaDef>['dialect']\n  plugins?: AnyPlugin[]\n  /**\n   * Schema-level @computed field implementations. Required when the schema\n   * declares any `@computed` fields. Keyed by uncapitalized model name; values\n   * map field name to a Kysely-expression compute callback.\n   */\n  computedFields?: ComputedFieldsOptions<Schema>\n}\n\nexport interface DatabaseModuleConfig {\n  default: DefaultConnectionName\n  connections: DatabaseConnectionConfig[]\n}\n\n@Module({\n  imports: [\n    I18nModule.registerMessages({ en: { database: databaseMessages.en } }),\n  ],\n  providers: [\n    DbGenerateCommand,\n    DbPushCommand,\n    DbPullCommand,\n    MigrateDevCommand,\n    MigrateDeployCommand,\n    MigrateStatusCommand,\n    MigrateResetCommand,\n  ],\n})\nexport class DatabaseModule implements OnInitialize, OnShutdown {\n  static forRoot(config: DatabaseModuleConfig): DynamicModule {\n    return {\n      module: DatabaseModule,\n      providers: [\n        { provide: DATABASE_TOKENS.Options, useValue: config as unknown as object },\n      ],\n    }\n  }\n\n  static forRootAsync(options: AsyncModuleOptions<DatabaseModuleConfig>): DynamicModule {\n    return {\n      module: DatabaseModule,\n      providers: [\n        {\n          provide: DATABASE_TOKENS.Options,\n          useFactory: options.useFactory,\n          inject: options.inject,\n        },\n      ],\n    }\n  }\n\n  async onInitialize(context: ModuleContext): Promise<void> {\n    const config = context.container.resolve<DatabaseModuleConfig>(DATABASE_TOKENS.Options)\n    // EventRegistry is loaded on demand — pull in EventsModule via the loader.\n    const loader = context.container.resolve<LazyModuleLoader>(DI_TOKENS.LazyModuleLoader)\n    const eventsRef = await loader.load(() => import('stratal/events').then((m) => m.EventsModule))\n    const eventRegistry = eventsRef.get<IEventRegistry>(DI_TOKENS.EventRegistry)\n    for (const conn of config.connections) {\n      const Service = createDatabaseService(conn, eventRegistry);\n\n      context.container.register(connectionSymbol(conn.name), lazy(() => Service))\n    }\n\n    context.container.registerExisting(DI_TOKENS.Database, connectionSymbol(config.default))\n\n    context.logger.info('DatabaseModule initialized')\n  }\n\n  onShutdown(context: ModuleContext): void {\n    context.logger.info('DatabaseModule shutdown')\n  }\n}\n","import { inject } from 'stratal/di'\nimport type { ConnectionName } from '../types'\nimport { connectionSymbol } from '../database.tokens'\n\nexport function InjectDB(name: ConnectionName): ParameterDecorator {\n  return inject(connectionSymbol(name))\n}\n"],"mappings":";;;;;;;;;;;;;;AAMA,IAAsB,kBAAtB,cAA8C,QAAQ;CACpD,MAAgB,SAAS,MAAiC;EAExD,MAAM,EAAE,iBAAiB,MAAM,OAAO;EAEtC,IAAI;GACF,MAAM,SAAS,aAAa,OAAO,CAAC,YAAY,GAAG,IAAI,GAAG;IACxD,UAAU;IACV,OAAO;GACT,CAAC;GACD,IAAI,QAAQ,KAAK,KAAK,OAAO,KAAK,CAAC;GACnC,OAAO;EACT,SAAS,KAAK;GACZ,MAAM,QAAQ;GACd,IAAI,MAAM,QAAQ,KAAK,MAAM,MAAM,OAAO,KAAK,CAAC;GAChD,IAAI,MAAM,QAAQ,KAAK,KAAK,MAAM,OAAO,KAAK,CAAC;GAC/C,OAAO,MAAM,UAAU;EACzB;CACF;AACF;;;ACvBA,IAAa,oBAAb,cAAuC,gBAAgB;CACrD,OAAO,UAAU;CACjB,OAAO,cAAc;CAErB,MAAM,SAA0B;EAC9B,MAAM,OAAO,CAAC,UAAU;EACxB,MAAM,SAAS,KAAK,OAAO,QAAQ;EAEnC,IAAI,QAAQ,KAAK,KAAK,YAAY,MAAM;EACxC,IAAI,KAAK,QAAQ,OAAO,GAAG,KAAK,KAAK,SAAS;EAE9C,OAAO,KAAK,SAAS,IAAI;CAC3B;AACF;;;ACbA,IAAa,gBAAb,cAAmC,gBAAgB;CACjD,OAAO,UAAU;CACjB,OAAO,cAAc;CAErB,MAAM,SAA0B;EAC9B,MAAM,OAAO,CAAC,MAAM,MAAM;EAC1B,MAAM,SAAS,KAAK,OAAO,QAAQ;EAEnC,IAAI,QAAQ,KAAK,KAAK,YAAY,MAAM;EAExC,OAAO,KAAK,SAAS,IAAI;CAC3B;AACF;;;ACZA,IAAa,gBAAb,cAAmC,gBAAgB;CACjD,OAAO,UAAU;CACjB,OAAO,cAAc;CAErB,MAAM,SAA0B;EAC9B,MAAM,OAAO,CAAC,MAAM,MAAM;EAC1B,MAAM,SAAS,KAAK,OAAO,QAAQ;EAEnC,IAAI,QAAQ,KAAK,KAAK,YAAY,MAAM;EACxC,IAAI,KAAK,QAAQ,kBAAkB,GAAG,KAAK,KAAK,oBAAoB;EACpE,IAAI,KAAK,QAAQ,aAAa,GAAG,KAAK,KAAK,eAAe;EAE1D,OAAO,KAAK,SAAS,IAAI;CAC3B;AACF;;;ACdA,IAAa,uBAAb,cAA0C,gBAAgB;CACxD,OAAO,UAAU;CACjB,OAAO,cAAc;CAErB,MAAM,SAA0B;EAC9B,MAAM,OAAO,CAAC,WAAW,QAAQ;EACjC,MAAM,SAAS,KAAK,OAAO,QAAQ;EAEnC,IAAI,QAAQ,KAAK,KAAK,YAAY,MAAM;EAExC,OAAO,KAAK,SAAS,IAAI;CAC3B;AACF;;;ACZA,IAAa,oBAAb,cAAuC,gBAAgB;CACrD,OAAO,UAAU;CACjB,OAAO,cAAc;CAErB,MAAM,SAA0B;EAC9B,MAAM,OAAO,CAAC,WAAW,KAAK;EAC9B,MAAM,SAAS,KAAK,OAAO,QAAQ;EACnC,MAAM,OAAO,KAAK,OAAO,MAAM;EAE/B,IAAI,QAAQ,KAAK,KAAK,YAAY,MAAM;EACxC,IAAI,MAAM,KAAK,KAAK,UAAU,IAAI;EAClC,IAAI,KAAK,QAAQ,aAAa,GAAG,KAAK,KAAK,eAAe;EAE1D,OAAO,KAAK,SAAS,IAAI;CAC3B;AACF;;;ACfA,IAAa,sBAAb,cAAyC,gBAAgB;CACvD,OAAO,UAAU;CACjB,OAAO,cAAc;CAErB,MAAM,SAA0B;EAC9B,MAAM,OAAO,CAAC,WAAW,OAAO;EAChC,MAAM,SAAS,KAAK,OAAO,QAAQ;EAEnC,IAAI,QAAQ,KAAK,KAAK,YAAY,MAAM;EACxC,IAAI,KAAK,QAAQ,OAAO,GAAG,KAAK,KAAK,SAAS;EAC9C,IAAI,KAAK,QAAQ,WAAW,GAAG,KAAK,KAAK,aAAa;EAEtD,OAAO,KAAK,SAAS,IAAI;CAC3B;AACF;;;ACdA,IAAa,uBAAb,cAA0C,gBAAgB;CACxD,OAAO,UAAU;CACjB,OAAO,cAAc;CAErB,MAAM,SAA0B;EAC9B,MAAM,OAAO,CAAC,WAAW,QAAQ;EACjC,MAAM,SAAS,KAAK,OAAO,QAAQ;EAEnC,IAAI,QAAQ,KAAK,KAAK,YAAY,MAAM;EAExC,OAAO,KAAK,SAAS,IAAI;CAC3B;AACF;;;ACZA,IAAa,sBAAb,cAAyC,cAAc;CACzB;CAA5B,YAAY,SAAkC,OAAiB;EAC7D,MAAM,KAAK,oBAAoB,KAAK;EADV,KAAA,UAAA;CAE5B;AACF;;;ACJA,IAAa,wBAAb,cAA2C,cAAc;CAC3B;CAA5B,YAAY,QAAmC,OAAiB;EAC9D,MAAM,KAAK,yBAAyB,KAAK;EADf,KAAA,SAAA;CAE5B;AACF;;;ACDA,SAAgB,kBAAkB,OAAkC;CAClE,IAAI,iBAAiB,UACnB,QAAQ,MAAM,QAAd;EACE,KAAK,eAAe,WAClB,OAAO,IAAI,oBAAoB,MAAM,OAAO,KAAK;EACnD,KAAK,eAAe,gBAClB,OAAO,mBAAmB,KAAK;EACjC,KAAK,eAAe,eAClB,OAAO,IAAI,cAAc,0BAA0B,KAAK;EAC1D,KAAK,eAAe,cAClB,OAAO,IAAI,cAAc,gCAAgC,KAAK;EAChE,KAAK,eAAe,eAClB,OAAO,IAAI,cAAc,2BAA2B,KAAK;EAC3D,KAAK,eAAe,gBAClB,OAAO,IAAI,cAAc,2BAA2B,KAAK;EAC3D,SACE,OAAO,IAAI,cAAc,kBAAkB,KAAK;CACpD;CAEF,OAAO,IAAI,cAAc,kBAAkB,KAAK;AAClD;AAEA,SAAS,mBAAmB,OAAmC;CAC7D,MAAM,cAAc,MAAM;CAC1B,IAAI,aAAa;EACf,IAAI,gBAAgB,SAAS,OAAO,IAAI,sBAAsB,CAAC,MAAM,SAAS,SAAS,GAAG,KAAK;EAC/F,IAAI,gBAAgB,SAAS,OAAO,IAAI,cAAc,oCAAoC,KAAK;EAC/F,IAAI,gBAAgB,SAAS,OAAO,IAAI,cAAc,6BAA6B,KAAK;EACxF,IAAI,gBAAgB,SAAS,OAAO,IAAI,cAAc,gCAAgC,KAAK;EAC3F,IAAI,gBAAgB,SAAS,OAAO,IAAI,cAAc,wBAAwB,KAAK;EACnF,IAAI,gBAAgB,SAAS,OAAO,IAAI,cAAc,yBAAyB,KAAK;EACpF,IAAI,YAAY,WAAW,IAAI,GAAG,OAAO,IAAI,cAAc,mCAAmC,KAAK;EACnG,IAAI,YAAY,WAAW,IAAI,GAAG,OAAO,IAAI,cAAc,8BAA8B,KAAK;EAC9F,IAAI,gBAAgB,SAAS,OAAO,IAAI,cAAc,0BAA0B,KAAK;EACrF,IAAI,YAAY,WAAW,IAAI,GAAG,OAAO,IAAI,cAAc,oCAAoC,KAAK;EACpG,IAAI,gBAAgB,SAAS,OAAO,IAAI,cAAc,iCAAiC,KAAK;CAC9F;CACA,OAAO,IAAI,cAAc,kBAAkB,KAAK;AAClD;;;;;;;;;;;;;;AC5BA,IAAa,qBAAb,MAA0H;CACxH,KAAc;CAEd,UAAU,OAAO,EAAE,MAAM,cAGD;EACtB,IAAI;GACF,OAAO,MAAM,QAAQ,IAAI;EAC3B,SAAS,OAAO;GACd,MAAM,kBAAkB,KAAK;EAC/B;CACF;AACF;;;ACjBA,MAAM,qBAAqB;CACzB,QAAQ;CACR,QAAQ;CACR,QAAQ;AACV;;;;;AAQA,SAAS,aACP,QACA,OAC6D;CAC7D,MAAM,UAAU,SAAS,UAAU,CAAC;CACpC,MAAM,cAAc,QAAQ,SAAS,KAAA;CACrC,MAAM,kBAAkB,cACpB,IAAI,IAAI,YAAY,QAAQ,MAAM,EAAE,OAAO,KAAA,CAAS,EAAE,KAAK,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,IAC3E,KAAA;CAEJ,OAAO,QAAQ,KAAK,QAAQ,UAAU;EACpC,MAAM,QAAQ,eACT,OAAO,OAAO,KAAA,IAAY,iBAAiB,IAAI,OAAO,EAAE,IAAI,KAAA,MAAc,YAAY,SACvF,KAAA;EAEJ,OAAO,QACH;GAAE,QAAQ;GAAO,OAAO;EAAO,IAC/B;GAAE,QAAQ;GAAQ,OAAO,KAAA;EAAU;CACzC,CAAC;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,IAAa,qBAAb,MAA0H;CAGpG;CAFpB,KAAc;CAEd,YAAY,SAA4C;EAApC,KAAA,UAAA;CAAsC;CAE1D,mBAAsD;EAOpD,mCAAmC;EAEnC,sBAAsB,OAAO,SAAS;GAEpC,IAAI,KAAK,WAAW,UAAU;GAE9B,MAAM,QAAQ,UAAU,KAAK,MAAM,GAAG,mBAAmB,KAAK;GAC9D,IAAI,CAAC,KAAK,QAAQ,cAAc,aAAa,KAAK,GAAG;GAIrD,MAAM,KAAK,2BAA2B;EACxC;EAEA,qBAAqB,OAAO,SAAS;GACnC,MAAM,EAAE,OAAO,QAAQ,2BAA2B;GAClD,MAAM,OAAO,mBAAmB;GAChC,MAAM,QAAQ,UAAU,MAAM,GAAG;GACjC,MAAM,EAAE,kBAAkB,KAAK;GAE/B,IAAI,CAAC,cAAc,aAAa,KAAK,GAAG;GAExC,MAAM,QAAQ,WAAW,WAAW,KAAA,IAAY,MAAM,KAAK,0BAA0B;GAErF,KAAK,MAAM,QAAQ,aAAa,wBAAwB,KAAK,GAAG;IAG9D,MAAM,UAAkC;KAC/B;KACP,QAAQ;KACR,QAAQ,KAAK;KACb,OAAO,KAAK;IACd;IACA,MAAM,cAAc,KAAK,OAAO,OAAO;GACzC;EACF;CACF;CAEA,UAAU,OAAO,EAAE,OAAO,WAAW,MAAM,cAKnB;EACtB,MAAM,EAAE,kBAAkB,KAAK;EAC/B,MAAM,YAAY,GAAG,MAAM,GAAG;EAG9B,MAAM,cAAc,KAAK,UAAU,aAA0B,EAC3D,MAAM,KACR,CAAC;EAGD,MAAM,SAAS,MAAM,QAAQ,IAAI;EAGjC,MAAM,cAAc,KAAK,SAAS,aAA0B;GAC1D,MAAM;GACN;EACF,CAAC;EAED,OAAO;CACT;AACF;;;;;;;;;;;;;;ACrIA,IAAa,iBAAb,MAA4B;CAC1B,OAAO,MAAS,QAAW,YAAuB;EAChD,MAAM,IAAI;EACV,MAAM,WAAW;GACf,GAAG,EAAE;GACL,UAAU;IAAE,GAAG,EAAE,QAAQ;IAAU,eAAe;GAAW;EAC/D;EACA,EAAE,UAAU;EACZ,EAAE,SAAS;EACX,OAAO;CACT;AACF;;;ACnBA,MAAM,2BAA2B,EAAE,OAAO;CACxC,MAAM,EAAE,OAAO,EAAE,IAAI,GAAG,YAAY,iCAAiC,CAAC;CACtE,QAAQ,EAAE,OAAO,CAAC,CAAC,EAAE,MAAM;CAC3B,SAAS,EAAE,SAAS;CACpB,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,SAAS;CAChD,gBAAgB,EAAE,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS;AAChD,CAAC;AAEyC,EAAE,OAAO;CACjD,SAAS,EAAE,OAAO,EAAE,IAAI,GAAG,YAAY,oCAAoC,CAAC;CAC5E,aAAa,EAAE,MAAM,wBAAwB,EAAE,IAAI,GAAG,YAAY,6BAA6B,CAAC;AAClG,CAAC,EAAE,QACA,WAAW;CACV,MAAM,QAAQ,OAAO,YAAY,KAAI,MAAK,EAAE,IAAI;CAChD,OAAO,IAAI,IAAI,KAAK,EAAE,SAAS,MAAM;AACvC,GACA,YAAY,+BAA+B,CAC7C,EAAE,QACC,WAAW,OAAO,YAAY,MAAK,MAAK,EAAE,SAAS,OAAO,OAAO,GAClE,YAAY,oCAAoC,CAClD;;;;;;;;;;;;;;;;;;AAqBA,SAAS,yBACP,QACA,mBACG;CACH,OAAO,IAAI,MAAM,QAAQ,EACvB,IAAI,QAAQ,MAAM,UAAU;EAC1B,IAAI,SAAS,gBAGX,OAAO,QAAQ,IAAI,QAAQ,MAAM,QAAQ;EAI3C,MAAM,cAAc,QAAQ,IAAI,QAAQ,IAAI;EAI5C,QAAQ,OAAgB,YAAsB;GAC5C,MAAM,SAAS,kBAAkB,SAAS;GAC1C,IAAI,QACF,OAAO,OAAO,UAAU,aACnB,MAAkD,MAAM,IACxD,OAAO,aAAsD,OAAO,OAAO;GAElF,IAAI,OAAO,UAAU,YACnB,OAAO,YAAY,KAAK,QAAQ,OAAO,OAAO;GAEhD,OAAO,YAAY,KACjB,SACC,OACC,kBAAkB,IAAI,UAAW,MAAiD,EAAE,CAAC,GACvF,OACF;EACF;CACF,EACF,CAAC;AACH;AAEA,SAAgB,sBACd,MACA,eAC+C;CAC/C,MAAM,UAAuB;EAC3B,IAAI,mBAAmB;EACvB,IAAI,mBAAmB,EACrB,cACF,CAAC;EACD,GAAI,KAAK,WAAW,CAAC;CACvB;CAaA,MAAM,oBAAoB,IAAI,kBAAuD;CAErF,IAAA,iBAAA,MACM,uBAAuB,eAAmC;EAC9D,cAAc;GACZ,MAAM,UAAU,KAAK,QAAQ;GAG7B,MAAM,KAAK,QAAQ;IACjB;IACA;IAEA,gBAAgB,KAAK;GACvB,CAAC;GAKD,OAAO,yBAAyB,MAA6C,iBAAiB;EAChG;CACF;8BAlBC,UAAU,CAAA,GAAA,cAAA;CAoBX,OAAO;AACT;;;ACrIA,MAAa,kBAAkB;CAC7B,SAAS,OAAO,IAAI,0BAA0B;CAC9C,UAAU,OAAO,IAAI,2BAA2B;AAClD;AAIA,SAAgB,iBAAiB,MAA8B;CAC7D,OAAO,OAAO,IAAI,+BAA+B,MAAM;AACzD;;;ACTA,MAAa,mBAAmB,EAC9B,IAAI;CACF,wBAAwB;CACxB,2BAA2B;CAC3B,oBAAoB;CACpB,sBAAsB;CACtB,2BAA2B;AAC7B,EACF;;;;ACqDO,IAAA,iBAAA,kBAAA,MAAM,eAAmD;CAC9D,OAAO,QAAQ,QAA6C;EAC1D,OAAO;GACL,QAAA;GACA,WAAW,CACT;IAAE,SAAS,gBAAgB;IAAS,UAAU;GAA4B,CAC5E;EACF;CACF;CAEA,OAAO,aAAa,SAAkE;EACpF,OAAO;GACL,QAAA;GACA,WAAW,CACT;IACE,SAAS,gBAAgB;IACzB,YAAY,QAAQ;IACpB,QAAQ,QAAQ;GAClB,CACF;EACF;CACF;CAEA,MAAM,aAAa,SAAuC;EACxD,MAAM,SAAS,QAAQ,UAAU,QAA8B,gBAAgB,OAAO;EAItF,MAAM,iBAAgB,MAFP,QAAQ,UAAU,QAA0B,UAAU,gBACxC,EAAE,WAAW,OAAO,kBAAkB,MAAM,MAAM,EAAE,YAAY,CAAC,GAC9D,IAAoB,UAAU,aAAa;EAC3E,KAAK,MAAM,QAAQ,OAAO,aAAa;GACrC,MAAM,UAAU,sBAAsB,MAAM,aAAa;GAEzD,QAAQ,UAAU,SAAS,iBAAiB,KAAK,IAAI,GAAG,WAAW,OAAO,CAAC;EAC7E;EAEA,QAAQ,UAAU,iBAAiB,UAAU,UAAU,iBAAiB,OAAO,OAAO,CAAC;EAEvF,QAAQ,OAAO,KAAK,4BAA4B;CAClD;CAEA,WAAW,SAA8B;EACvC,QAAQ,OAAO,KAAK,yBAAyB;CAC/C;AACF;+CAzDC,OAAO;CACN,SAAS,CACP,WAAW,iBAAiB,EAAE,IAAI,EAAE,UAAU,iBAAiB,GAAG,EAAE,CAAC,CACvE;CACA,WAAW;EACT;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF,CAAC,CAAA,GAAA,cAAA;;;ACxDD,SAAgB,SAAS,MAA0C;CACjE,OAAO,OAAO,iBAAiB,IAAI,CAAC;AACtC"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../src/database/commands/zenstack.command.ts","../../src/database/commands/db-generate.command.ts","../../src/database/commands/db-pull.command.ts","../../src/database/commands/db-push.command.ts","../../src/database/commands/migrate-deploy.command.ts","../../src/database/commands/migrate-dev.command.ts","../../src/database/commands/migrate-reset.command.ts","../../src/database/commands/migrate-status.command.ts","../../src/database/errors/record-not-found.error.ts","../../src/database/errors/unique-constraint.error.ts","../../src/database/errors/from-zenstack-error.ts","../../src/database/plugins/error-handler.plugin.ts","../../src/database/plugins/event-emitter.plugin.ts","../../src/database/plugins/schema-switcher.ts","../../src/database/database.helpers.ts","../../src/database/database.tokens.ts","../../src/database/i18n/en.ts","../../src/database/database.module.ts","../../src/database/decorators/inject-db.decorator.ts"],"sourcesContent":["import { Command } from 'stratal/quarry'\n\n/**\n * Base command for ZenStack CLI wrappers.\n * Uses execFileSync with array arguments to prevent shell injection.\n */\nexport abstract class ZenStackCommand extends Command {\n  protected async zenstack(args: string[]): Promise<number> {\n    // Dynamic import — node:child_process is only available in the Quarry CLI (Node) context\n    const { execFileSync } = await import('node:child_process')\n\n    try {\n      const output = execFileSync('npx', ['zenstack', ...args], {\n        encoding: 'utf-8',\n        stdio: 'pipe',\n      })\n      if (output) this.info(output.trim())\n      return 0\n    } catch (err) {\n      const error = err as { stderr?: string; stdout?: string; status?: number }\n      if (error.stderr) this.error(error.stderr.trim())\n      if (error.stdout) this.info(error.stdout.trim())\n      return error.status ?? 1\n    }\n  }\n}\n","import { ZenStackCommand } from './zenstack.command'\n\nexport class DbGenerateCommand extends ZenStackCommand {\n  static command = 'db:generate {--schema= : Path to schema file} {--watch : Enable watch mode}'\n  static description = 'Generate ZenStack ORM client'\n\n  async handle(): Promise<number> {\n    const args = ['generate']\n    const schema = this.string('schema')\n\n    if (schema) args.push('--schema', schema)\n    if (this.boolean('watch')) args.push('--watch')\n\n    return this.zenstack(args)\n  }\n}\n","import { ZenStackCommand } from './zenstack.command'\n\nexport class DbPullCommand extends ZenStackCommand {\n  static command = 'db:pull {--schema= : Path to schema file}'\n  static description = 'Introspect database and generate schema'\n\n  async handle(): Promise<number> {\n    const args = ['db', 'pull']\n    const schema = this.string('schema')\n\n    if (schema) args.push('--schema', schema)\n\n    return this.zenstack(args)\n  }\n}\n","import { ZenStackCommand } from './zenstack.command'\n\nexport class DbPushCommand extends ZenStackCommand {\n  static command = 'db:push {--schema= : Path to schema file} {--accept-data-loss : Accept data loss} {--force-reset : Force reset database}'\n  static description = 'Push database schema changes'\n\n  async handle(): Promise<number> {\n    const args = ['db', 'push']\n    const schema = this.string('schema')\n\n    if (schema) args.push('--schema', schema)\n    if (this.boolean('accept-data-loss')) args.push('--accept-data-loss')\n    if (this.boolean('force-reset')) args.push('--force-reset')\n\n    return this.zenstack(args)\n  }\n}\n","import { ZenStackCommand } from './zenstack.command'\n\nexport class MigrateDeployCommand extends ZenStackCommand {\n  static command = 'migrate:deploy {--schema= : Path to schema file}'\n  static description = 'Deploy pending migrations'\n\n  async handle(): Promise<number> {\n    const args = ['migrate', 'deploy']\n    const schema = this.string('schema')\n\n    if (schema) args.push('--schema', schema)\n\n    return this.zenstack(args)\n  }\n}\n","import { ZenStackCommand } from './zenstack.command'\n\nexport class MigrateDevCommand extends ZenStackCommand {\n  static command = 'migrate:dev {--schema= : Path to schema file} {--name= : Migration name} {--create-only : Create without applying}'\n  static description = 'Create and apply migration'\n\n  async handle(): Promise<number> {\n    const args = ['migrate', 'dev']\n    const schema = this.string('schema')\n    const name = this.string('name')\n\n    if (schema) args.push('--schema', schema)\n    if (name) args.push('--name', name)\n    if (this.boolean('create-only')) args.push('--create-only')\n\n    return this.zenstack(args)\n  }\n}\n","import { ZenStackCommand } from './zenstack.command'\n\nexport class MigrateResetCommand extends ZenStackCommand {\n  static command = 'migrate:reset {--schema= : Path to schema file} {--force : Skip confirmation} {--skip-seed : Skip seeding}'\n  static description = 'Reset database'\n\n  async handle(): Promise<number> {\n    const args = ['migrate', 'reset']\n    const schema = this.string('schema')\n\n    if (schema) args.push('--schema', schema)\n    if (this.boolean('force')) args.push('--force')\n    if (this.boolean('skip-seed')) args.push('--skip-seed')\n\n    return this.zenstack(args)\n  }\n}\n","import { ZenStackCommand } from './zenstack.command'\n\nexport class MigrateStatusCommand extends ZenStackCommand {\n  static command = 'migrate:status {--schema= : Path to schema file}'\n  static description = 'Check migration status'\n\n  async handle(): Promise<number> {\n    const args = ['migrate', 'status']\n    const schema = this.string('schema')\n\n    if (schema) args.push('--schema', schema)\n\n    return this.zenstack(args)\n  }\n}\n","import { HttpException } from 'stratal/errors'\n\nexport class RecordNotFoundError extends HttpException {\n  constructor(public readonly details?: string, cause?: unknown) {\n    super(404, 'Record not found', cause)\n  }\n}\n","import { HttpException } from 'stratal/errors'\n\nexport class UniqueConstraintError extends HttpException {\n  constructor(public readonly fields?: string[], cause?: unknown) {\n    super(409, 'Record already exists', cause)\n  }\n}\n","import { ORMError, ORMErrorReason } from '@zenstackhq/orm';\nimport { type ApplicationError, DatabaseError } from 'stratal/errors';\nimport { RecordNotFoundError } from './record-not-found.error';\nimport { UniqueConstraintError } from './unique-constraint.error';\n\nexport function fromZenStackError(error: unknown): ApplicationError {\n  if (error instanceof ORMError) {\n    switch (error.reason) {\n      case ORMErrorReason.NOT_FOUND:\n        return new RecordNotFoundError(error.model, error)\n      case ORMErrorReason.DB_QUERY_ERROR:\n        return parseDatabaseError(error)\n      case ORMErrorReason.INVALID_INPUT:\n        return new DatabaseError('Invalid database query', error)\n      case ORMErrorReason.CONFIG_ERROR:\n        return new DatabaseError('Database configuration error', error)\n      case ORMErrorReason.NOT_SUPPORTED:\n        return new DatabaseError('Operation not supported', error)\n      case ORMErrorReason.INTERNAL_ERROR:\n        return new DatabaseError('Database internal error', error)\n      default:\n        return new DatabaseError('Database error', error)\n    }\n  }\n  return new DatabaseError('Database error', error)\n}\n\nfunction parseDatabaseError(error: ORMError): ApplicationError {\n  const dbErrorCode = error.dbErrorCode as string | undefined\n  if (dbErrorCode) {\n    if (dbErrorCode === '23505') return new UniqueConstraintError([error.model ?? 'unknown'], error)\n    if (dbErrorCode === '23503') return new DatabaseError('Foreign key constraint violation', error)\n    if (dbErrorCode === '23502') return new DatabaseError('Required field is missing', error)\n    if (dbErrorCode === '23514') return new DatabaseError('Database constraint violated', error)\n    if (dbErrorCode === '42P01') return new DatabaseError('Table does not exist', error)\n    if (dbErrorCode === '42703') return new DatabaseError('Column does not exist', error)\n    if (dbErrorCode.startsWith('42')) return new DatabaseError('Database syntax or access error', error)\n    if (dbErrorCode.startsWith('08')) return new DatabaseError('Database connection failed', error)\n    if (dbErrorCode === '57014') return new DatabaseError('Database query timeout', error)\n    if (dbErrorCode.startsWith('40')) return new DatabaseError('Transaction conflict or deadlock', error)\n    if (dbErrorCode === '53300') return new DatabaseError('Too many database connections', error)\n  }\n  return new DatabaseError('Database error', error)\n}\n","import { type RuntimePlugin } from '@zenstackhq/orm'\nimport { type SchemaDef } from '@zenstackhq/orm/schema'\nimport { fromZenStackError } from '../errors'\n\n/**\n * ZenStack runtime plugin that transforms ORM errors into ApplicationError instances.\n *\n * @example\n * ```typescript\n * super(schema, {\n *   dialect: new PostgresDialect({ pool }),\n *   plugins: [new ErrorHandlerPlugin()]\n * })\n * ```\n */\nexport class ErrorHandlerPlugin implements RuntimePlugin<SchemaDef, Record<string, unknown>, Record<string, unknown>, {}> {\n  readonly id = 'error-handler'\n\n  onQuery = async ({ args, proceed }: {\n    args: Record<string, unknown> | undefined\n    proceed: (args: Record<string, unknown> | undefined) => Promise<unknown>\n  }): Promise<unknown> => {\n    try {\n      return await proceed(args)\n    } catch (error) {\n      throw fromZenStackError(error)\n    }\n  }\n}\n","import { type EntityMutationHooksDef, type RuntimePlugin } from '@zenstackhq/orm';\nimport { type SchemaDef } from '@zenstackhq/orm/schema';\nimport type { EventContext, EventName, IEventRegistry } from 'stratal/events';\nimport type { ModelName } from '../event-types';\n\nexport interface EventEmitterPluginOptions {\n  eventRegistry: IEventRegistry\n}\n\ntype EntityMutationAction = 'create' | 'update' | 'delete'\n\nconst ENTITY_ACTION_VERB = {\n  create: 'created',\n  update: 'updated',\n  delete: 'deleted',\n} as const satisfies Record<EntityMutationAction, string>\n\ntype Entity = Record<string, unknown>\n\n/**\n * Pair before/after entity snapshots for a mutation. Rows are matched by\n * `id` when both sides carry one, falling back to positional pairing.\n */\nfunction pairEntities(\n  before: Entity[] | undefined,\n  after: Entity[] | undefined\n): { before: Entity | undefined; after: Entity | undefined }[] {\n  const primary = after ?? before ?? []\n  const counterpart = after ? before : undefined\n  const counterpartById = counterpart\n    ? new Map(counterpart.filter((c) => c.id !== undefined).map((c) => [c.id, c]))\n    : undefined\n\n  return primary.map((entity, index) => {\n    const match = counterpart\n      ? (entity.id !== undefined ? counterpartById?.get(entity.id) : undefined) ?? counterpart[index]\n      : undefined\n\n    return after\n      ? { before: match, after: entity }\n      : { before: entity, after: undefined }\n  })\n}\n\n/**\n * ZenStack runtime plugin that emits before/after events for database operations.\n *\n * Emits events in the format:\n * - `before.{Model}.{operation}` - Before the database operation\n * - `after.{Model}.{operation}` - After the database operation\n *\n * Additionally emits entity-mutation events carrying full entity snapshots:\n * - `entity.{Model}.created` - `{ after }`\n * - `entity.{Model}.updated` - `{ before, after }`\n * - `entity.{Model}.deleted` - `{ before }`\n *\n * Entity events are listener-driven: the pre-mutation snapshot is only\n * loaded (inside the mutation's transaction) when `hasListeners()` reports\n * a matching subscription, so models nobody observes pay no cost. Note that\n * a wildcard subscription (`entity`) therefore makes every model pay the\n * pre-read — subscribe per model when cost matters.\n *\n * @example\n * ```typescript\n * super(schema, {\n *   dialect: new PostgresDialect({ pool }),\n *   plugins: [\n *     new EventEmitterPlugin({\n *       eventRegistry,\n *     })\n *   ]\n * })\n * ```\n */\nexport class EventEmitterPlugin implements RuntimePlugin<SchemaDef, Record<string, unknown>, Record<string, unknown>, {}> {\n  readonly id = 'event-emitter'\n\n  constructor(private options: EventEmitterPluginOptions) { }\n\n  onEntityMutation: EntityMutationHooksDef<SchemaDef> = {\n    // Run after-hooks inside the mutation's transaction boundary so they\n    // execute within the caller's async context (AsyncLocalStorage intact):\n    // listeners resolve from the live request scope and tenant schema\n    // switching still applies. Post-commit hooks would run detached from the\n    // request's ALS. Listeners registered `blocking: false` still do their\n    // real work outside the transaction via waitUntil.\n    runAfterMutationWithinTransaction: true,\n\n    beforeEntityMutation: async (args) => {\n      // Created rows have no prior state to snapshot\n      if (args.action === 'create') return\n\n      const event = `entity.${args.model}.${ENTITY_ACTION_VERB[args.action]}` as EventName\n      if (!this.options.eventRegistry.hasListeners(event)) return\n\n      // Runs inside the mutation's transaction; ZenStack hands the result\n      // to afterEntityMutation as `beforeMutationEntities`\n      await args.loadBeforeMutationEntities()\n    },\n\n    afterEntityMutation: async (args) => {\n      const { model, action, beforeMutationEntities } = args\n      const verb = ENTITY_ACTION_VERB[action]\n      const event = `entity.${model}.${verb}` as EventName\n      const { eventRegistry } = this.options\n\n      if (!eventRegistry.hasListeners(event)) return\n\n      const after = action === 'delete' ? undefined : await args.loadAfterMutationEntities()\n\n      for (const pair of pairEntities(beforeMutationEntities, after)) {\n        // Producer boundary: ZenStack types `model` as plain string, but at\n        // runtime it is always a schema model name — assert that one fact.\n        const context: EventContext<'entity'> = {\n          model: model as ModelName,\n          action: verb,\n          before: pair.before,\n          after: pair.after,\n        }\n        await eventRegistry.emit(event, context)\n      }\n    },\n  }\n\n  onQuery = async ({ model, operation, args, proceed }: {\n    model: string\n    operation: string\n    args: Record<string, unknown> | undefined\n    proceed: (args: Record<string, unknown> | undefined) => Promise<unknown>\n  }): Promise<unknown> => {\n    const { eventRegistry } = this.options\n    const eventBase = `${model}.${operation}`\n\n    // Emit BEFORE event\n    await eventRegistry.emit(`before.${eventBase}` as EventName, {\n      data: args,\n    })\n\n    // Execute the actual database operation\n    const result = await proceed(args)\n\n    // Emit AFTER event\n    await eventRegistry.emit(`after.${eventBase}` as EventName, {\n      data: args,\n      result,\n    })\n\n    return result\n  }\n}\n","interface SwitchableClient {\n  $schema: { provider: { defaultSchema: string } } & Record<string, unknown>\n  schema: unknown\n}\n\n/**\n * Switches the active schema on a ZenStack/Kysely database client by mutating\n * `$schema.provider.defaultSchema`. This causes ZenStack's QueryNameMapper to\n * generate fully-qualified table references (e.g. `\"tenant_123\".\"User\"`).\n *\n * Must be called BEFORE any queries are made on the client.\n *\n * Note: The ZenStack RuntimePlugin `onQuery` hook fires after table names are\n * already resolved, so a plugin-based approach cannot set the schema prefix.\n * Direct client mutation is the only supported method.\n */\nexport class SchemaSwitcher {\n  static apply<T>(client: T, schemaName: string): T {\n    const c = client as unknown as SwitchableClient\n    const switched = {\n      ...c.$schema,\n      provider: { ...c.$schema.provider, defaultSchema: schemaName },\n    }\n    c.$schema = switched\n    c.schema = switched\n    return client\n  }\n}\n","import { ZenStackClient, type AnyPlugin } from '@zenstackhq/orm';\nimport { AsyncLocalStorage } from 'node:async_hooks';\nimport { Transient } from 'stratal/di';\nimport type { IEventRegistry } from 'stratal/events';\nimport { withZodI18n, z } from 'stratal/validation';\nimport type { DatabaseConnectionConfig } from './database.module';\nimport { ErrorHandlerPlugin, EventEmitterPlugin } from './plugins';\n\nconst databaseConnectionSchema = z.object({\n  name: z.string().min(1, withZodI18n('database.connectionNameRequired')),\n  schema: z.object({}).loose(),\n  dialect: z.function(),\n  plugins: z.array(z.object({}).loose()).optional(),\n  computedFields: z.object({}).loose().optional(),\n})\n\nexport const databaseModuleConfigSchema = z.object({\n  default: z.string().min(1, withZodI18n('database.defaultConnectionRequired')),\n  connections: z.array(databaseConnectionSchema).min(1, withZodI18n('database.connectionRequired')),\n}).refine(\n  (config) => {\n    const names = config.connections.map(c => c.name)\n    return new Set(names).size === names.length\n  },\n  withZodI18n('database.duplicateConnections')\n).refine(\n  (config) => config.connections.some(c => c.name === config.default),\n  withZodI18n('database.defaultConnectionNotFound')\n)\n\ntype ZenStackClientInstance = InstanceType<typeof ZenStackClient>\n\n/**\n * Wrap a ZenStack client so `$transaction` is reentrant: when a transaction is\n * already open on this connection (tracked per-connection via\n * {@link AsyncLocalStorage}), nested calls run within the active transaction's\n * client instead of opening a new one. ZenStack only reuses a connection when\n * `$transaction` is called on a transaction client; callers holding the base\n * client (e.g. the better-auth adapter, which since better-auth 1.6.11 nests\n * transactions to atomically consume verification rows) would otherwise open a\n * fresh transaction. On a small pool (e.g. a Hyperdrive-fronted `max: 1` pg\n * pool) that inner transaction blocks forever waiting for the connection the\n * outer one holds — a deadlock surfacing as a backend stuck `idle in\n * transaction`. Reusing the active client is also the correct semantics: nested\n * transactions form a single atomic unit.\n *\n * ZenStackClient's constructor returns a Proxy (for dynamic model accessors), so\n * a subclass method override is shadowed — hence the proxy wrapper here.\n */\nexport function makeReentrantTransaction<T extends object>(\n  client: T,\n  activeTransaction: AsyncLocalStorage<ZenStackClientInstance>,\n): T {\n  return new Proxy(client, {\n    get(target, prop, receiver) {\n      // DI disposal contract (stratal `Disposable`): release the underlying\n      // pool/socket when the owning container shuts down (e.g. a Vite HMR\n      // reload replacing the Application). Handled here because ZenStack's\n      // own constructor proxy shadows subclass method definitions.\n      if (prop === Symbol.asyncDispose) {\n        return () => (target as ZenStackClientInstance).$disconnect()\n      }\n      if (prop !== '$transaction') {\n        // Forward the receiver so getters/methods resolve `this` against the\n        // proxy (correct for layered proxies / accessor properties).\n        return Reflect.get(target, prop, receiver)\n      }\n      // Read the original `$transaction` off the target WITHOUT the receiver — a\n      // receiver of the proxy would re-enter this trap and recurse infinitely.\n      const transaction = Reflect.get(target, prop) as (\n        input: unknown,\n        options?: unknown,\n      ) => unknown\n      return (input: unknown, options?: unknown) => {\n        const active = activeTransaction.getStore()\n        if (active) {\n          return typeof input === 'function'\n            ? (input as (tx: ZenStackClientInstance) => unknown)(active)\n            : (active.$transaction as (i: unknown, o?: unknown) => unknown)(input, options)\n        }\n        if (typeof input !== 'function') {\n          return transaction.call(target, input, options)\n        }\n        return transaction.call(\n          target,\n          (tx: ZenStackClientInstance) =>\n            activeTransaction.run(tx, () => (input as (t: ZenStackClientInstance) => unknown)(tx)),\n          options,\n        )\n      }\n    },\n  })\n}\n\nexport interface DatabaseServiceClass {\n  new (): InstanceType<typeof ZenStackClient>\n  /**\n   * Disconnects every still-live client created from this service class.\n   * Called by `DatabaseModule.onShutdown` so pools/sockets are released when\n   * the Application is torn down (e.g. a Vite HMR reload).\n   */\n  disposeInstances(): Promise<void>\n}\n\nexport function createDatabaseService(\n  conn: DatabaseConnectionConfig,\n  eventRegistry: IEventRegistry,\n): DatabaseServiceClass {\n  const plugins: AnyPlugin[] = [\n    new ErrorHandlerPlugin(),\n    new EventEmitterPlugin({\n      eventRegistry,\n    }),\n    ...(conn.plugins ?? []),\n  ]\n\n  // Tracks the in-flight interactive transaction client for this connection so\n  // nested `$transaction` calls reuse it instead of acquiring a second\n  // connection. ZenStack's own reuse only triggers when `$transaction` is\n  // invoked on a transaction client; callers that hold the base client (e.g.\n  // the better-auth adapter, which since better-auth 1.6.11 nests transactions\n  // to atomically consume verification rows) instead open a fresh transaction.\n  // On a small pool (e.g. a Hyperdrive-fronted `max: 1` pg pool) the inner\n  // transaction then blocks forever waiting for the connection the outer one\n  // holds — a deadlock that surfaces as a Postgres backend stuck `idle in\n  // transaction`. Reusing the active client makes nested transactions share the\n  // single connection, which is also the correct semantics (one atomic unit).\n  const activeTransaction = new AsyncLocalStorage<InstanceType<typeof ZenStackClient>>()\n\n  // Live clients created from this service class, tracked weakly: the client\n  // is `@Transient`, so request-scoped resolutions must stay GC-able with\n  // their request. Dead refs are pruned on each add; live ones are\n  // disconnected by `disposeInstances()` on module shutdown.\n  const instances = new Set<WeakRef<ZenStackClientInstance>>()\n\n  @Transient()\n  class DatabaseClient extends ZenStackClient<typeof conn.schema> {\n    constructor() {\n      const dialect = conn.dialect()\n      // ZenStack 3+ requires `computedFields` whenever the schema declares any\n      // `@computed` fields, so pass them through when the consumer provides them.\n      super(conn.schema, {\n        dialect,\n        plugins,\n        // @ts-expect-error - ZenStack 3+ requires `computedFields` whenever the schema declares any `@computed` fields, so pass them through when the consumer provides them.\n        computedFields: conn.computedFields\n      })\n      // ZenStackClient's constructor returns a Proxy (for dynamic model\n      // accessors), so subclass method overrides are shadowed. Wrap it in a\n      // proxy that makes `$transaction` reentrant. Returning from the\n      // constructor replaces the instance DI receives.\n      const client = makeReentrantTransaction(this as InstanceType<typeof ZenStackClient>, activeTransaction)\n      for (const ref of instances) {\n        if (ref.deref() === undefined) instances.delete(ref)\n      }\n      instances.add(new WeakRef(client))\n      return client\n    }\n\n    static async disposeInstances(): Promise<void> {\n      const live = [...instances]\n      instances.clear()\n      await Promise.all(live.map(async (ref) => {\n        const client = ref.deref()\n        if (!client) return\n        try {\n          await client.$disconnect()\n        } catch (error) {\n          console.error(`[stratal] Failed to disconnect database client \"${conn.name}\":`, error)\n        }\n      }))\n    }\n  }\n\n  return DatabaseClient\n}\n","export const DATABASE_TOKENS = {\n  Options: Symbol.for('stratal:database:options'),\n  Services: Symbol.for('stratal:database:services'),\n} as const\n\nimport type { ConnectionName } from './types'\n\nexport function connectionSymbol(name: ConnectionName): symbol {\n  return Symbol.for(`stratal:database:connection:${name}`)\n}\n","export const databaseMessages = {\n  en: {\n    connectionNameRequired: 'Connection name is required',\n    defaultConnectionRequired: 'Default connection name is required',\n    connectionRequired: 'At least one connection is required',\n    duplicateConnections: 'Duplicate connection names found',\n    defaultConnectionNotFound: 'Default connection not found in connections',\n  },\n} as const\n\ndeclare module 'stratal/i18n' {\n  interface AppMessageNamespaces {\n    database: typeof databaseMessages['en']\n  }\n}\n","import type { AnyPlugin, ClientOptions, ComputedFieldsOptions } from '@zenstackhq/orm';\nimport type { SchemaDef } from '@zenstackhq/schema';\nimport { DI_TOKENS, lazy } from 'stratal/di';\nimport type { IEventRegistry } from 'stratal/events';\nimport { I18nModule } from 'stratal/i18n';\nimport {\n    Module,\n    type AsyncModuleOptions,\n    type DynamicModule,\n    type LazyModuleLoader,\n    type ModuleContext,\n    type OnInitialize,\n    type OnShutdown,\n} from 'stratal/module';\nimport { DbGenerateCommand } from './commands/db-generate.command';\nimport { DbPullCommand } from './commands/db-pull.command';\nimport { DbPushCommand } from './commands/db-push.command';\nimport { MigrateDeployCommand } from './commands/migrate-deploy.command';\nimport { MigrateDevCommand } from './commands/migrate-dev.command';\nimport { MigrateResetCommand } from './commands/migrate-reset.command';\nimport { MigrateStatusCommand } from './commands/migrate-status.command';\nimport { createDatabaseService, type DatabaseServiceClass } from './database.helpers';\nimport { connectionSymbol, DATABASE_TOKENS } from './database.tokens';\nimport { databaseMessages } from './i18n';\nimport type { ConnectionName, DefaultConnectionName } from './types';\n\nexport interface DatabaseConnectionConfig<\n  Schema extends SchemaDef = SchemaDef,\n  Name extends ConnectionName = ConnectionName,\n> {\n  name: Name\n  schema: Schema\n  dialect: () => ClientOptions<SchemaDef>['dialect']\n  plugins?: AnyPlugin[]\n  /**\n   * Schema-level @computed field implementations. Required when the schema\n   * declares any `@computed` fields. Keyed by uncapitalized model name; values\n   * map field name to a Kysely-expression compute callback.\n   */\n  computedFields?: ComputedFieldsOptions<Schema>\n}\n\nexport interface DatabaseModuleConfig {\n  default: DefaultConnectionName\n  connections: DatabaseConnectionConfig[]\n}\n\n@Module({\n  imports: [\n    I18nModule.registerMessages({ en: { database: databaseMessages.en } }),\n  ],\n  providers: [\n    DbGenerateCommand,\n    DbPushCommand,\n    DbPullCommand,\n    MigrateDevCommand,\n    MigrateDeployCommand,\n    MigrateStatusCommand,\n    MigrateResetCommand,\n  ],\n})\nexport class DatabaseModule implements OnInitialize, OnShutdown {\n  private readonly services: DatabaseServiceClass[] = []\n\n  static forRoot(config: DatabaseModuleConfig): DynamicModule {\n    return {\n      module: DatabaseModule,\n      providers: [\n        { provide: DATABASE_TOKENS.Options, useValue: config as unknown as object },\n      ],\n    }\n  }\n\n  static forRootAsync(options: AsyncModuleOptions<DatabaseModuleConfig>): DynamicModule {\n    return {\n      module: DatabaseModule,\n      providers: [\n        {\n          provide: DATABASE_TOKENS.Options,\n          useFactory: options.useFactory,\n          inject: options.inject,\n        },\n      ],\n    }\n  }\n\n  async onInitialize(context: ModuleContext): Promise<void> {\n    const config = context.container.resolve<DatabaseModuleConfig>(DATABASE_TOKENS.Options)\n    // EventRegistry is loaded on demand — pull in EventsModule via the loader.\n    const loader = context.container.resolve<LazyModuleLoader>(DI_TOKENS.LazyModuleLoader)\n    const eventsRef = await loader.load(() => import('stratal/events').then((m) => m.EventsModule))\n    const eventRegistry = eventsRef.get<IEventRegistry>(DI_TOKENS.EventRegistry)\n    for (const conn of config.connections) {\n      const Service = createDatabaseService(conn, eventRegistry);\n\n      this.services.push(Service)\n      context.container.register(connectionSymbol(conn.name), lazy(() => Service))\n    }\n\n    context.container.registerExisting(DI_TOKENS.Database, connectionSymbol(config.default))\n\n    context.logger.info('DatabaseModule initialized')\n  }\n\n  async onShutdown(context: ModuleContext): Promise<void> {\n    // Disconnect every live client so pools/sockets don't outlive the\n    // Application across dev-server hot reloads.\n    await Promise.all(this.services.map(service => service.disposeInstances()))\n    this.services.length = 0\n    context.logger.info('DatabaseModule shutdown')\n  }\n}\n","import { inject } from 'stratal/di'\nimport type { ConnectionName } from '../types'\nimport { connectionSymbol } from '../database.tokens'\n\nexport function InjectDB(name: ConnectionName): ParameterDecorator {\n  return inject(connectionSymbol(name))\n}\n"],"mappings":";;;;;;;;;;;;;;AAMA,IAAsB,kBAAtB,cAA8C,QAAQ;CACpD,MAAgB,SAAS,MAAiC;EAExD,MAAM,EAAE,iBAAiB,MAAM,OAAO;EAEtC,IAAI;GACF,MAAM,SAAS,aAAa,OAAO,CAAC,YAAY,GAAG,IAAI,GAAG;IACxD,UAAU;IACV,OAAO;GACT,CAAC;GACD,IAAI,QAAQ,KAAK,KAAK,OAAO,KAAK,CAAC;GACnC,OAAO;EACT,SAAS,KAAK;GACZ,MAAM,QAAQ;GACd,IAAI,MAAM,QAAQ,KAAK,MAAM,MAAM,OAAO,KAAK,CAAC;GAChD,IAAI,MAAM,QAAQ,KAAK,KAAK,MAAM,OAAO,KAAK,CAAC;GAC/C,OAAO,MAAM,UAAU;EACzB;CACF;AACF;;;ACvBA,IAAa,oBAAb,cAAuC,gBAAgB;CACrD,OAAO,UAAU;CACjB,OAAO,cAAc;CAErB,MAAM,SAA0B;EAC9B,MAAM,OAAO,CAAC,UAAU;EACxB,MAAM,SAAS,KAAK,OAAO,QAAQ;EAEnC,IAAI,QAAQ,KAAK,KAAK,YAAY,MAAM;EACxC,IAAI,KAAK,QAAQ,OAAO,GAAG,KAAK,KAAK,SAAS;EAE9C,OAAO,KAAK,SAAS,IAAI;CAC3B;AACF;;;ACbA,IAAa,gBAAb,cAAmC,gBAAgB;CACjD,OAAO,UAAU;CACjB,OAAO,cAAc;CAErB,MAAM,SAA0B;EAC9B,MAAM,OAAO,CAAC,MAAM,MAAM;EAC1B,MAAM,SAAS,KAAK,OAAO,QAAQ;EAEnC,IAAI,QAAQ,KAAK,KAAK,YAAY,MAAM;EAExC,OAAO,KAAK,SAAS,IAAI;CAC3B;AACF;;;ACZA,IAAa,gBAAb,cAAmC,gBAAgB;CACjD,OAAO,UAAU;CACjB,OAAO,cAAc;CAErB,MAAM,SAA0B;EAC9B,MAAM,OAAO,CAAC,MAAM,MAAM;EAC1B,MAAM,SAAS,KAAK,OAAO,QAAQ;EAEnC,IAAI,QAAQ,KAAK,KAAK,YAAY,MAAM;EACxC,IAAI,KAAK,QAAQ,kBAAkB,GAAG,KAAK,KAAK,oBAAoB;EACpE,IAAI,KAAK,QAAQ,aAAa,GAAG,KAAK,KAAK,eAAe;EAE1D,OAAO,KAAK,SAAS,IAAI;CAC3B;AACF;;;ACdA,IAAa,uBAAb,cAA0C,gBAAgB;CACxD,OAAO,UAAU;CACjB,OAAO,cAAc;CAErB,MAAM,SAA0B;EAC9B,MAAM,OAAO,CAAC,WAAW,QAAQ;EACjC,MAAM,SAAS,KAAK,OAAO,QAAQ;EAEnC,IAAI,QAAQ,KAAK,KAAK,YAAY,MAAM;EAExC,OAAO,KAAK,SAAS,IAAI;CAC3B;AACF;;;ACZA,IAAa,oBAAb,cAAuC,gBAAgB;CACrD,OAAO,UAAU;CACjB,OAAO,cAAc;CAErB,MAAM,SAA0B;EAC9B,MAAM,OAAO,CAAC,WAAW,KAAK;EAC9B,MAAM,SAAS,KAAK,OAAO,QAAQ;EACnC,MAAM,OAAO,KAAK,OAAO,MAAM;EAE/B,IAAI,QAAQ,KAAK,KAAK,YAAY,MAAM;EACxC,IAAI,MAAM,KAAK,KAAK,UAAU,IAAI;EAClC,IAAI,KAAK,QAAQ,aAAa,GAAG,KAAK,KAAK,eAAe;EAE1D,OAAO,KAAK,SAAS,IAAI;CAC3B;AACF;;;ACfA,IAAa,sBAAb,cAAyC,gBAAgB;CACvD,OAAO,UAAU;CACjB,OAAO,cAAc;CAErB,MAAM,SAA0B;EAC9B,MAAM,OAAO,CAAC,WAAW,OAAO;EAChC,MAAM,SAAS,KAAK,OAAO,QAAQ;EAEnC,IAAI,QAAQ,KAAK,KAAK,YAAY,MAAM;EACxC,IAAI,KAAK,QAAQ,OAAO,GAAG,KAAK,KAAK,SAAS;EAC9C,IAAI,KAAK,QAAQ,WAAW,GAAG,KAAK,KAAK,aAAa;EAEtD,OAAO,KAAK,SAAS,IAAI;CAC3B;AACF;;;ACdA,IAAa,uBAAb,cAA0C,gBAAgB;CACxD,OAAO,UAAU;CACjB,OAAO,cAAc;CAErB,MAAM,SAA0B;EAC9B,MAAM,OAAO,CAAC,WAAW,QAAQ;EACjC,MAAM,SAAS,KAAK,OAAO,QAAQ;EAEnC,IAAI,QAAQ,KAAK,KAAK,YAAY,MAAM;EAExC,OAAO,KAAK,SAAS,IAAI;CAC3B;AACF;;;ACZA,IAAa,sBAAb,cAAyC,cAAc;CACzB;CAA5B,YAAY,SAAkC,OAAiB;EAC7D,MAAM,KAAK,oBAAoB,KAAK;EADV,KAAA,UAAA;CAE5B;AACF;;;ACJA,IAAa,wBAAb,cAA2C,cAAc;CAC3B;CAA5B,YAAY,QAAmC,OAAiB;EAC9D,MAAM,KAAK,yBAAyB,KAAK;EADf,KAAA,SAAA;CAE5B;AACF;;;ACDA,SAAgB,kBAAkB,OAAkC;CAClE,IAAI,iBAAiB,UACnB,QAAQ,MAAM,QAAd;EACE,KAAK,eAAe,WAClB,OAAO,IAAI,oBAAoB,MAAM,OAAO,KAAK;EACnD,KAAK,eAAe,gBAClB,OAAO,mBAAmB,KAAK;EACjC,KAAK,eAAe,eAClB,OAAO,IAAI,cAAc,0BAA0B,KAAK;EAC1D,KAAK,eAAe,cAClB,OAAO,IAAI,cAAc,gCAAgC,KAAK;EAChE,KAAK,eAAe,eAClB,OAAO,IAAI,cAAc,2BAA2B,KAAK;EAC3D,KAAK,eAAe,gBAClB,OAAO,IAAI,cAAc,2BAA2B,KAAK;EAC3D,SACE,OAAO,IAAI,cAAc,kBAAkB,KAAK;CACpD;CAEF,OAAO,IAAI,cAAc,kBAAkB,KAAK;AAClD;AAEA,SAAS,mBAAmB,OAAmC;CAC7D,MAAM,cAAc,MAAM;CAC1B,IAAI,aAAa;EACf,IAAI,gBAAgB,SAAS,OAAO,IAAI,sBAAsB,CAAC,MAAM,SAAS,SAAS,GAAG,KAAK;EAC/F,IAAI,gBAAgB,SAAS,OAAO,IAAI,cAAc,oCAAoC,KAAK;EAC/F,IAAI,gBAAgB,SAAS,OAAO,IAAI,cAAc,6BAA6B,KAAK;EACxF,IAAI,gBAAgB,SAAS,OAAO,IAAI,cAAc,gCAAgC,KAAK;EAC3F,IAAI,gBAAgB,SAAS,OAAO,IAAI,cAAc,wBAAwB,KAAK;EACnF,IAAI,gBAAgB,SAAS,OAAO,IAAI,cAAc,yBAAyB,KAAK;EACpF,IAAI,YAAY,WAAW,IAAI,GAAG,OAAO,IAAI,cAAc,mCAAmC,KAAK;EACnG,IAAI,YAAY,WAAW,IAAI,GAAG,OAAO,IAAI,cAAc,8BAA8B,KAAK;EAC9F,IAAI,gBAAgB,SAAS,OAAO,IAAI,cAAc,0BAA0B,KAAK;EACrF,IAAI,YAAY,WAAW,IAAI,GAAG,OAAO,IAAI,cAAc,oCAAoC,KAAK;EACpG,IAAI,gBAAgB,SAAS,OAAO,IAAI,cAAc,iCAAiC,KAAK;CAC9F;CACA,OAAO,IAAI,cAAc,kBAAkB,KAAK;AAClD;;;;;;;;;;;;;;AC5BA,IAAa,qBAAb,MAA0H;CACxH,KAAc;CAEd,UAAU,OAAO,EAAE,MAAM,cAGD;EACtB,IAAI;GACF,OAAO,MAAM,QAAQ,IAAI;EAC3B,SAAS,OAAO;GACd,MAAM,kBAAkB,KAAK;EAC/B;CACF;AACF;;;ACjBA,MAAM,qBAAqB;CACzB,QAAQ;CACR,QAAQ;CACR,QAAQ;AACV;;;;;AAQA,SAAS,aACP,QACA,OAC6D;CAC7D,MAAM,UAAU,SAAS,UAAU,CAAC;CACpC,MAAM,cAAc,QAAQ,SAAS,KAAA;CACrC,MAAM,kBAAkB,cACpB,IAAI,IAAI,YAAY,QAAQ,MAAM,EAAE,OAAO,KAAA,CAAS,EAAE,KAAK,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,IAC3E,KAAA;CAEJ,OAAO,QAAQ,KAAK,QAAQ,UAAU;EACpC,MAAM,QAAQ,eACT,OAAO,OAAO,KAAA,IAAY,iBAAiB,IAAI,OAAO,EAAE,IAAI,KAAA,MAAc,YAAY,SACvF,KAAA;EAEJ,OAAO,QACH;GAAE,QAAQ;GAAO,OAAO;EAAO,IAC/B;GAAE,QAAQ;GAAQ,OAAO,KAAA;EAAU;CACzC,CAAC;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,IAAa,qBAAb,MAA0H;CAGpG;CAFpB,KAAc;CAEd,YAAY,SAA4C;EAApC,KAAA,UAAA;CAAsC;CAE1D,mBAAsD;EAOpD,mCAAmC;EAEnC,sBAAsB,OAAO,SAAS;GAEpC,IAAI,KAAK,WAAW,UAAU;GAE9B,MAAM,QAAQ,UAAU,KAAK,MAAM,GAAG,mBAAmB,KAAK;GAC9D,IAAI,CAAC,KAAK,QAAQ,cAAc,aAAa,KAAK,GAAG;GAIrD,MAAM,KAAK,2BAA2B;EACxC;EAEA,qBAAqB,OAAO,SAAS;GACnC,MAAM,EAAE,OAAO,QAAQ,2BAA2B;GAClD,MAAM,OAAO,mBAAmB;GAChC,MAAM,QAAQ,UAAU,MAAM,GAAG;GACjC,MAAM,EAAE,kBAAkB,KAAK;GAE/B,IAAI,CAAC,cAAc,aAAa,KAAK,GAAG;GAExC,MAAM,QAAQ,WAAW,WAAW,KAAA,IAAY,MAAM,KAAK,0BAA0B;GAErF,KAAK,MAAM,QAAQ,aAAa,wBAAwB,KAAK,GAAG;IAG9D,MAAM,UAAkC;KAC/B;KACP,QAAQ;KACR,QAAQ,KAAK;KACb,OAAO,KAAK;IACd;IACA,MAAM,cAAc,KAAK,OAAO,OAAO;GACzC;EACF;CACF;CAEA,UAAU,OAAO,EAAE,OAAO,WAAW,MAAM,cAKnB;EACtB,MAAM,EAAE,kBAAkB,KAAK;EAC/B,MAAM,YAAY,GAAG,MAAM,GAAG;EAG9B,MAAM,cAAc,KAAK,UAAU,aAA0B,EAC3D,MAAM,KACR,CAAC;EAGD,MAAM,SAAS,MAAM,QAAQ,IAAI;EAGjC,MAAM,cAAc,KAAK,SAAS,aAA0B;GAC1D,MAAM;GACN;EACF,CAAC;EAED,OAAO;CACT;AACF;;;;;;;;;;;;;;ACrIA,IAAa,iBAAb,MAA4B;CAC1B,OAAO,MAAS,QAAW,YAAuB;EAChD,MAAM,IAAI;EACV,MAAM,WAAW;GACf,GAAG,EAAE;GACL,UAAU;IAAE,GAAG,EAAE,QAAQ;IAAU,eAAe;GAAW;EAC/D;EACA,EAAE,UAAU;EACZ,EAAE,SAAS;EACX,OAAO;CACT;AACF;;;ACnBA,MAAM,2BAA2B,EAAE,OAAO;CACxC,MAAM,EAAE,OAAO,EAAE,IAAI,GAAG,YAAY,iCAAiC,CAAC;CACtE,QAAQ,EAAE,OAAO,CAAC,CAAC,EAAE,MAAM;CAC3B,SAAS,EAAE,SAAS;CACpB,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,SAAS;CAChD,gBAAgB,EAAE,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS;AAChD,CAAC;AAEyC,EAAE,OAAO;CACjD,SAAS,EAAE,OAAO,EAAE,IAAI,GAAG,YAAY,oCAAoC,CAAC;CAC5E,aAAa,EAAE,MAAM,wBAAwB,EAAE,IAAI,GAAG,YAAY,6BAA6B,CAAC;AAClG,CAAC,EAAE,QACA,WAAW;CACV,MAAM,QAAQ,OAAO,YAAY,KAAI,MAAK,EAAE,IAAI;CAChD,OAAO,IAAI,IAAI,KAAK,EAAE,SAAS,MAAM;AACvC,GACA,YAAY,+BAA+B,CAC7C,EAAE,QACC,WAAW,OAAO,YAAY,MAAK,MAAK,EAAE,SAAS,OAAO,OAAO,GAClE,YAAY,oCAAoC,CAClD;;;;;;;;;;;;;;;;;;AAqBA,SAAgB,yBACd,QACA,mBACG;CACH,OAAO,IAAI,MAAM,QAAQ,EACvB,IAAI,QAAQ,MAAM,UAAU;EAK1B,IAAI,SAAS,OAAO,cAClB,aAAc,OAAkC,YAAY;EAE9D,IAAI,SAAS,gBAGX,OAAO,QAAQ,IAAI,QAAQ,MAAM,QAAQ;EAI3C,MAAM,cAAc,QAAQ,IAAI,QAAQ,IAAI;EAI5C,QAAQ,OAAgB,YAAsB;GAC5C,MAAM,SAAS,kBAAkB,SAAS;GAC1C,IAAI,QACF,OAAO,OAAO,UAAU,aACnB,MAAkD,MAAM,IACxD,OAAO,aAAsD,OAAO,OAAO;GAElF,IAAI,OAAO,UAAU,YACnB,OAAO,YAAY,KAAK,QAAQ,OAAO,OAAO;GAEhD,OAAO,YAAY,KACjB,SACC,OACC,kBAAkB,IAAI,UAAW,MAAiD,EAAE,CAAC,GACvF,OACF;EACF;CACF,EACF,CAAC;AACH;AAYA,SAAgB,sBACd,MACA,eACsB;CACtB,MAAM,UAAuB;EAC3B,IAAI,mBAAmB;EACvB,IAAI,mBAAmB,EACrB,cACF,CAAC;EACD,GAAI,KAAK,WAAW,CAAC;CACvB;CAaA,MAAM,oBAAoB,IAAI,kBAAuD;CAMrF,MAAM,4BAAY,IAAI,IAAqC;CAE3D,IAAA,iBAAA,MACM,uBAAuB,eAAmC;EAC9D,cAAc;GACZ,MAAM,UAAU,KAAK,QAAQ;GAG7B,MAAM,KAAK,QAAQ;IACjB;IACA;IAEA,gBAAgB,KAAK;GACvB,CAAC;GAKD,MAAM,SAAS,yBAAyB,MAA6C,iBAAiB;GACtG,KAAK,MAAM,OAAO,WAChB,IAAI,IAAI,MAAM,MAAM,KAAA,GAAW,UAAU,OAAO,GAAG;GAErD,UAAU,IAAI,IAAI,QAAQ,MAAM,CAAC;GACjC,OAAO;EACT;EAEA,aAAa,mBAAkC;GAC7C,MAAM,OAAO,CAAC,GAAG,SAAS;GAC1B,UAAU,MAAM;GAChB,MAAM,QAAQ,IAAI,KAAK,IAAI,OAAO,QAAQ;IACxC,MAAM,SAAS,IAAI,MAAM;IACzB,IAAI,CAAC,QAAQ;IACb,IAAI;KACF,MAAM,OAAO,YAAY;IAC3B,SAAS,OAAO;KACd,QAAQ,MAAM,mDAAmD,KAAK,KAAK,KAAK,KAAK;IACvF;GACF,CAAC,CAAC;EACJ;CACF;8BArCC,UAAU,CAAA,GAAA,cAAA;CAuCX,OAAO;AACT;;;AC/KA,MAAa,kBAAkB;CAC7B,SAAS,OAAO,IAAI,0BAA0B;CAC9C,UAAU,OAAO,IAAI,2BAA2B;AAClD;AAIA,SAAgB,iBAAiB,MAA8B;CAC7D,OAAO,OAAO,IAAI,+BAA+B,MAAM;AACzD;;;ACTA,MAAa,mBAAmB,EAC9B,IAAI;CACF,wBAAwB;CACxB,2BAA2B;CAC3B,oBAAoB;CACpB,sBAAsB;CACtB,2BAA2B;AAC7B,EACF;;;;ACqDO,IAAA,iBAAA,kBAAA,MAAM,eAAmD;CAC9D,WAAoD,CAAC;CAErD,OAAO,QAAQ,QAA6C;EAC1D,OAAO;GACL,QAAA;GACA,WAAW,CACT;IAAE,SAAS,gBAAgB;IAAS,UAAU;GAA4B,CAC5E;EACF;CACF;CAEA,OAAO,aAAa,SAAkE;EACpF,OAAO;GACL,QAAA;GACA,WAAW,CACT;IACE,SAAS,gBAAgB;IACzB,YAAY,QAAQ;IACpB,QAAQ,QAAQ;GAClB,CACF;EACF;CACF;CAEA,MAAM,aAAa,SAAuC;EACxD,MAAM,SAAS,QAAQ,UAAU,QAA8B,gBAAgB,OAAO;EAItF,MAAM,iBAAgB,MAFP,QAAQ,UAAU,QAA0B,UAAU,gBACxC,EAAE,WAAW,OAAO,kBAAkB,MAAM,MAAM,EAAE,YAAY,CAAC,GAC9D,IAAoB,UAAU,aAAa;EAC3E,KAAK,MAAM,QAAQ,OAAO,aAAa;GACrC,MAAM,UAAU,sBAAsB,MAAM,aAAa;GAEzD,KAAK,SAAS,KAAK,OAAO;GAC1B,QAAQ,UAAU,SAAS,iBAAiB,KAAK,IAAI,GAAG,WAAW,OAAO,CAAC;EAC7E;EAEA,QAAQ,UAAU,iBAAiB,UAAU,UAAU,iBAAiB,OAAO,OAAO,CAAC;EAEvF,QAAQ,OAAO,KAAK,4BAA4B;CAClD;CAEA,MAAM,WAAW,SAAuC;EAGtD,MAAM,QAAQ,IAAI,KAAK,SAAS,KAAI,YAAW,QAAQ,iBAAiB,CAAC,CAAC;EAC1E,KAAK,SAAS,SAAS;EACvB,QAAQ,OAAO,KAAK,yBAAyB;CAC/C;AACF;+CAhEC,OAAO;CACN,SAAS,CACP,WAAW,iBAAiB,EAAE,IAAI,EAAE,UAAU,iBAAiB,GAAG,EAAE,CAAC,CACvE;CACA,WAAW;EACT;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF,CAAC,CAAA,GAAA,cAAA;;;ACxDD,SAAgB,SAAS,MAA0C;CACjE,OAAO,OAAO,iBAAiB,IAAI,CAAC;AACtC"}

package/dist/factory/index.d.mts

@@ -1,4 +1,4 @@
-import { M as DatabaseService } from "../index-DTXzJzpy.mjs";
+import { M as DatabaseService } from "../index-Dt0YUA7r.mjs";
 import { Faker } from "@faker-js/faker";
 
 //#region src/factory/factory.d.ts

package/dist/{index-DTXzJzpy.d.mts → index-Dt0YUA7r.d.mts}

@@ -25,10 +25,11 @@ interface DatabaseModuleConfig {
   connections: DatabaseConnectionConfig[];
 }
 declare class DatabaseModule implements OnInitialize, OnShutdown {
+  private readonly services;
   static forRoot(config: DatabaseModuleConfig): DynamicModule;
   static forRootAsync(options: AsyncModuleOptions<DatabaseModuleConfig>): DynamicModule;
   onInitialize(context: ModuleContext): Promise<void>;
-  onShutdown(context: ModuleContext): void;
+  onShutdown(context: ModuleContext): Promise<void>;
 }
 //#endregion
 //#region src/database/database.service.d.ts
@@ -442,4 +443,4 @@ declare class MigrateStatusCommand extends ZenStackCommand {
 }
 //#endregion
 export { DATABASE_TOKENS as A, GetResult as C, UniqueConstraintError as D, fromZenStackError as E, DatabaseModuleConfig as F, DatabaseService as M, DatabaseConnectionConfig as N, RecordNotFoundError as O, DatabaseModule as P, GetEntity as S, ParseEvent as T, EntityEventName as _, DbPushCommand as a, EventPhase as b, ZenStackCommand as c, EventEmitterPluginOptions as d, ErrorHandlerPlugin as f, DatabaseOperation as g, DatabaseEvents as h, MigrateDeployCommand as i, connectionSymbol as j, InjectDB as k, SchemaSwitcher as l, DatabaseEventName as m, MigrateResetCommand as n, DbPullCommand as o, databaseMessages as p, MigrateDevCommand as r, DbGenerateCommand as s, MigrateStatusCommand as t, EventEmitterPlugin as u, EntityEvents as v, ModelName as w, GetData as x, EntityMutationVerb as y };
-//# sourceMappingURL=index-DTXzJzpy.d.mts.map
+//# sourceMappingURL=index-Dt0YUA7r.d.mts.map

package/dist/index-Dt0YUA7r.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index-Dt0YUA7r.d.mts","names":[],"sources":["../src/database/database.module.ts","../src/database/database.service.ts","../src/database/database.tokens.ts","../src/database/decorators/inject-db.decorator.ts","../src/database/errors/record-not-found.error.ts","../src/database/errors/unique-constraint.error.ts","../src/database/errors/from-zenstack-error.ts","../src/database/event-types.ts","../src/database/i18n/en.ts","../src/database/plugins/error-handler.plugin.ts","../src/database/plugins/event-emitter.plugin.ts","../src/database/plugins/schema-switcher.ts","../src/database/commands/zenstack.command.ts","../src/database/commands/db-generate.command.ts","../src/database/commands/db-pull.command.ts","../src/database/commands/db-push.command.ts","../src/database/commands/migrate-deploy.command.ts","../src/database/commands/migrate-dev.command.ts","../src/database/commands/migrate-reset.command.ts","../src/database/commands/migrate-status.command.ts"],"mappings":";;;;;;;;;;UA0BiB,wBAAA,gBACA,SAAA,GAAY,SAAA,eACd,cAAA,GAAiB,cAAA;EAE9B,IAAA,EAAM,IAAA;EACN,MAAA,EAAQ,MAAA;EACR,OAAA,QAAe,aAAA,CAAc,SAAA;EAC7B,OAAA,GAAU,SAAA;;AAPZ;;;;EAaE,cAAA,GAAiB,qBAAA,CAAsB,MAAA;AAAA;AAAA,UAGxB,oBAAA;EACf,OAAA,EAAS,qBAAA;EACT,WAAA,EAAa,wBAAwB;AAAA;AAAA,cAiB1B,cAAA,YAA0B,YAAA,EAAc,UAAA;EAAA,iBAClC,QAAA;EAAA,OAEV,OAAA,CAAQ,MAAA,EAAQ,oBAAA,GAAuB,aAAA;EAAA,OASvC,YAAA,CAAa,OAAA,EAAS,kBAAA,CAAmB,oBAAA,IAAwB,aAAA;EAalE,YAAA,CAAa,OAAA,EAAS,aAAA,GAAgB,OAAA;EAkBtC,UAAA,CAAW,OAAA,EAAS,aAAA,GAAgB,OAAA;AAAA;;;;;;;;;;;AA9E5C;;;;;;;KCRY,eAAA,WACA,cAAA,GAAiB,qBAAA,IACzB,cAAA,CACF,qBAAA,CAAsB,CAAA,GACtB,aAAA,CAAc,qBAAA,CAAsB,CAAA,IACpC,yBAAA,CAA0B,CAAA,mBAC1B,yBAAA,CAA0B,CAAA,uBAE1B,yBAAA,CAA0B,CAAA;;;cC1Bf,eAAA;EAAA,SAGH,OAAA;EAAA,SAAA,QAAA;AAAA;AAAA,iBAIM,gBAAA,CAAiB,IAAoB,EAAd,cAAc;;;iBCHrC,QAAA,CAAS,IAAA,EAAM,cAAA,GAAiB,kBAAkB;;;cCFrD,mBAAA,SAA4B,aAAa;EAAA,SACxB,OAAA;cAAA,OAAA,uBAAkB,KAAA;AAAA;;;cCDnC,qBAAA,SAA8B,aAAa;EAAA,SAC1B,MAAA;cAAA,MAAA,yBAAmB,KAAA;AAAA;;;iBCEjC,iBAAA,CAAkB,KAAA,YAAiB,gBAAgB;;;;;;KCkCvD,UAAA;;;;KAKA,iBAAA,GAAoB,iBAAiB;;;;;;KAO5C,kBAAA,MAAwB,CAAA;EAAY,MAAA;AAAA,IAAoB,OAAA,OAAc,CAAA;;;;;KAM/D,SAAA,GAAY,kBAAkB,CAAC,cAAA;;;;KAS/B,iBAAA,MACL,UAAA,IAAc,SAAA,IAAa,iBAAA,QAC3B,UAAA,IAAc,SAAA,QACd,UAAA,IAAc,iBAAA,KACjB,UAAA;;;;KASC,gBAAA,WACO,SAAA,YACA,OAAA,OAAc,CAAA,+BACd,iBAAA,IAEV,CAAA,oBAAqB,UAAA,CAAW,CAAA,EAAG,CAAA,IACnC,CAAA,wBAAyB,cAAA,CAAe,CAAA,EAAG,CAAA,IAC3C,CAAA,oBAAqB,UAAA,CAAW,CAAA,EAAG,CAAA,IACnC,CAAA,wBAAyB,cAAA,CAAe,CAAA,EAAG,CAAA,IAC3C,CAAA,oBAAqB,UAAA,CAAW,CAAA,EAAG,CAAA,IACnC,CAAA,wBAAyB,cAAA,CAAe,CAAA,EAAG,CAAA,IAC3C,CAAA,wBAAyB,cAAA,CAAe,CAAA,EAAG,CAAA,IAC3C,CAAA,uBAAwB,aAAA,CAAc,CAAA,EAAG,CAAA,IACzC,CAAA,sBAAuB,YAAA,CAAa,CAAA,EAAG,CAAA,IACvC,CAAA,oBAAqB,UAAA,CAAW,CAAA,EAAG,CAAA,IACnC,CAAA,mBAAoB,SAAA,CAAU,CAAA,EAAG,CAAA,IACjC,CAAA,uBAAwB,aAAA,CAAc,CAAA,EAAG,CAAA,IACzC,CAAA,qBAAsB,WAAA,CAAY,CAAA,EAAG,CAAA;;;APzDQ;KO+D1C,YAAA,gCAA4C,iBAAA,IAC/C,CAAA,SAAU,SAAA,GACR,CAAA,SAAU,OAAA,OAAc,CAAA,sBACxB,gBAAA,CAAiB,CAAA,EAAG,CAAA,EAAG,CAAA;EAAa,IAAA;AAAA,IACpC,CAAA,GACA,gBAAA,CAAiB,CAAA,EAAG,CAAA,EAAG,CAAA;EAAa,KAAA;AAAA,IACpC,CAAA,GACA,gBAAA,CAAiB,CAAA,EAAG,CAAA,EAAG,CAAA;;;;;KAQf,OAAA,WAAkB,SAAA,YAAqB,iBAAA,IACjD,YAAA,CAAa,cAAA,EAAgB,CAAA,EAAG,CAAA,4BAA6B,YAAA,CAAa,cAAA,EAAgB,CAAA,EAAG,CAAA;APvE/F;;;AAAA,KO4EK,cAAA,gCAA8C,iBAAA,IACjD,CAAA,SAAU,SAAA,GACR,CAAA,SAAU,OAAA,OAAc,CAAA,sBACxB,CAAA,mEACA,WAAA,CAAY,CAAA,EAAG,CAAA,MACf,CAAA,4BAEA,WAAA,CAAY,CAAA,EAAG,CAAA;;;;;KAQP,SAAA,WAAoB,SAAA,YAAqB,iBAAA,IACnD,cAAA,CAAe,cAAA,EAAgB,CAAA,EAAG,CAAA,4BAA6B,cAAA,CAAe,cAAA,EAAgB,CAAA,EAAG,CAAA;;;;KASvF,kBAAA;;;;;;;;;;;KAYA,eAAA,aACE,SAAA,IAAa,kBAAA,eACb,SAAA,eACA,kBAAA;;;;KAMT,cAAA,wBACH,CAAA,SAAU,SAAA,GACR,CAAA,SAAU,OAAA,OAAc,CAAA,sBACxB,WAAA,CAAY,CAAA,EAAG,CAAA;;;;KAOP,SAAA,WAAoB,SAAA,IAC9B,cAAA,CAAe,cAAA,EAAgB,CAAA,4BAA6B,cAAA,CAAe,cAAA,EAAgB,CAAA;AAAA,UAEnF,yBAAA,WAAoC,SAAA;EAC5C,KAAA,EAAO,CAAA;EACP,MAAA;EACA,MAAA;EACA,KAAA,EAAO,SAAA,CAAU,CAAA;AAAA;AAAA,UAGT,yBAAA,WAAoC,SAAA;EAC5C,KAAA,EAAO,CAAA;EACP,MAAA;EACA,MAAA,EAAQ,SAAA,CAAU,CAAA;EAClB,KAAA,EAAO,SAAA,CAAU,CAAA;AAAA;AAAA,UAGT,yBAAA,WAAoC,SAAA;EAC5C,KAAA,EAAO,CAAA;EACP,MAAA;EACA,MAAA,EAAQ,SAAA,CAAU,CAAA;EAClB,KAAA;AAAA;;UAIQ,0BAAA,WAAqC,SAAA;EAC7C,KAAA,EAAO,CAAA;EACP,MAAA,EAAQ,kBAAA;EACR,MAAA,EAAQ,SAAA,CAAU,CAAA;EAClB,KAAA,EAAO,SAAA,CAAU,CAAA;AAAA;;UAIT,yBAAA,WAAoC,kBAAA;EAC5C,KAAA,EAAO,SAAA;EACP,MAAA,EAAQ,CAAA;EACR,MAAA,EAAQ,CAAA;EACR,KAAA,EAAO,CAAA;AAAA;;UAIC,qBAAA;EACR,KAAA,EAAO,SAAA;EACP,MAAA,EAAQ,kBAAkB;EAC1B,MAAA;EACA,KAAA;AAAA;AAAA,KAGG,kBAAA,qBACH,CAAA,mCAAoC,SAAA,aAAsB,yBAAA,CAA0B,CAAA,IAClF,CAAA,mCAAoC,SAAA,aAAsB,yBAAA,CAA0B,CAAA,IACpF,CAAA,mCAAoC,SAAA,aAAsB,yBAAA,CAA0B,CAAA,IACpF,CAAA,mCAAoC,SAAA,KAAc,0BAAA,CAA2B,CAAA,IAC7E,CAAA,mCAAoC,kBAAA,KAAuB,yBAAA,CAA0B,CAAA,IACrF,qBAAA;;;;KAKQ,YAAA,WACJ,eAAA,GAAkB,kBAAA,CAAmB,CAAA;;;AL/O7C;KKyPY,UAAA,qBACV,CAAA,gCAAiC,UAAA,wBAAkC,SAAA,qBAA8B,iBAAA;EAC7F,KAAA,EAAO,KAAA;EAAO,KAAA,EAAO,KAAA;EAAO,SAAA,EAAW,EAAA;EAAI,IAAA;AAAA,IAC7C,CAAA,gCAAiC,UAAA,qBACjC,MAAA,SAAe,SAAA;EACb,KAAA,EAAO,KAAA;EAAO,KAAA,EAAO,MAAA;EAAQ,IAAA;AAAA,IAC/B,MAAA,SAAe,iBAAA;EACb,KAAA,EAAO,KAAA;EAAO,SAAA,EAAW,MAAA;EAAQ,IAAA;AAAA,YAEnC,CAAA,SAAU,UAAA;EACR,KAAA,EAAO,CAAA;EAAG,IAAA;AAAA;;UAQN,gBAAA;AJvQwD;AAAA,UI2QxD,yBAAA,WACE,SAAA,YACA,iBAAA,gBACI,UAAA,UACN,gBAAA;EACR,IAAA,EAAM,KAAA,oBAAyB,OAAA,CAAQ,CAAA,EAAG,CAAA,IAAK,QAAA,CAAS,OAAA,CAAQ,CAAA,EAAG,CAAA;EACnE,MAAA,EAAQ,KAAA,mBAAwB,SAAA,CAAU,CAAA,EAAG,CAAA;AAAA;;UAIrC,yBAAA,eACM,UAAA,UACN,gBAAA;EACR,SAAA,EAAW,iBAAA;EACX,IAAA,EAAM,KAAA,8BAAmC,QAAA;EACzC,MAAA,EAAQ,KAAA;AAAA;;UAIA,6BAAA,eACM,UAAA,UACN,gBAAA;EACR,KAAA,EAAO,SAAA;EACP,IAAA,EAAM,KAAA,8BAAmC,QAAA;EACzC,MAAA,EAAQ,KAAA;AAAA;;UAIA,yBAAA,eACM,UAAA,UACN,gBAAA;EACR,KAAA,EAAO,SAAA;EACP,SAAA,EAAW,iBAAA;EACX,IAAA,EAAM,KAAA,8BAAmC,QAAA;EACzC,MAAA,EAAQ,KAAA;AAAA;;;;KAUL,oBAAA,qBACH,UAAA,CAAW,CAAA;EACT,KAAA,kBAAuB,UAAA;EACvB,KAAA,kBAAuB,SAAA;EACvB,SAAA,kBAA2B,iBAAA;EAC3B,IAAA;AAAA,IAEA,yBAAA,CAA0B,CAAA,EAAG,CAAA,EAAG,CAAA,IAChC,UAAA,CAAW,CAAA;EACX,KAAA,kBAAuB,UAAA;EACvB,KAAA,mBAAwB,SAAA;EACxB,IAAA;AAAA,IAEA,yBAAA,CAA0B,CAAA,IAC1B,UAAA,CAAW,CAAA;EACX,KAAA,kBAAuB,UAAA;EACvB,SAAA,mBAA4B,iBAAA;EAC5B,IAAA;AAAA,IAEA,6BAAA,CAA8B,CAAA,IAC9B,UAAA,CAAW,CAAA;EAAa,KAAA,kBAAuB,UAAA;EAAY,IAAA;AAAA,IAC3D,yBAAA,CAA0B,CAAA,IAC1B,gBAAA;AA1SkB;AAKtB;;;;AAAiD;AAAA;;;;;;AAL3B,KA4TV,cAAA,WACJ,iBAAA,GAAoB,oBAAA,CAAqB,CAAA;AAAA;EAAA,UAQrC,mBAAA,SAA4B,cAAA,EAAgB,YAAY;AAAA;;;cC5WvD,gBAAA;EAAA;;;;;;;;;YAWD,oBAAA;IACR,QAAA,SAAiB,gBAAgB;EAAA;AAAA;;;;;;;;;;;ARcrC;;;cSXa,kBAAA,YAA8B,aAAA,CAAc,WAAA,EAAW,MAAA,mBAAyB,MAAA;EAAA,SAClF,EAAA;EAET,OAAA;IAAiB,IAAA;IAAA;EAAA;IACf,IAAA,EAAM,MAAA;IACN,OAAA,GAAU,IAAA,EAAM,MAAA,kCAAwC,OAAA;EAAA,MACtD,OAAA;AAAA;;;UChBW,yBAAA;EACf,aAAA,EAAe,cAAc;AAAA;;;;;AVoB/B;;;;;;;;;;;;;;;;;;;;;;;;;;cUgDa,kBAAA,YAA8B,aAAA,CAAc,WAAA,EAAW,MAAA,mBAAyB,MAAA;EAAA,QAGvE,OAAA;EAAA,SAFX,EAAA;cAEW,OAAA,EAAS,yBAAA;EAE7B,gBAAA,EAAkB,sBAAA,CAAuB,WAAA;EA6CzC,OAAA;IAAiB,KAAA;IAAA,SAAA;IAAA,IAAA;IAAA;EAAA;IACf,KAAA;IACA,SAAA;IACA,IAAA,EAAM,MAAA;IACN,OAAA,GAAU,IAAA,EAAM,MAAA,kCAAwC,OAAA;EAAA,MACtD,OAAA;AAAA;;;;;;;;;;;;;AVvGN;cWVa,cAAA;EAAA,OACJ,KAAA,IAAS,MAAA,EAAQ,CAAA,EAAG,UAAA,WAAqB,CAAC;AAAA;;;;;;;uBCX7B,eAAA,SAAwB,OAAO;EAAA,UACnC,QAAA,CAAS,IAAA,aAAiB,OAAA;AAAA;;;cCL/B,iBAAA,SAA0B,eAAe;EAAA,OAC7C,OAAA;EAAA,OACA,WAAA;EAED,MAAA,IAAU,OAAA;AAAA;;;cCJL,aAAA,SAAsB,eAAe;EAAA,OACzC,OAAA;EAAA,OACA,WAAA;EAED,MAAA,IAAU,OAAA;AAAA;;;cCJL,aAAA,SAAsB,eAAe;EAAA,OACzC,OAAA;EAAA,OACA,WAAA;EAED,MAAA,IAAU,OAAA;AAAA;;;cCJL,oBAAA,SAA6B,eAAe;EAAA,OAChD,OAAA;EAAA,OACA,WAAA;EAED,MAAA,IAAU,OAAA;AAAA;;;cCJL,iBAAA,SAA0B,eAAe;EAAA,OAC7C,OAAA;EAAA,OACA,WAAA;EAED,MAAA,IAAU,OAAA;AAAA;;;cCJL,mBAAA,SAA4B,eAAe;EAAA,OAC/C,OAAA;EAAA,OACA,WAAA;EAED,MAAA,IAAU,OAAA;AAAA;;;cCJL,oBAAA,SAA6B,eAAe;EAAA,OAChD,OAAA;EAAA,OACA,WAAA;EAED,MAAA,IAAU,OAAA;AAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stratal/framework",
-  "version": "0.0.25",
+  "version": "0.0.26",
   "type": "module",
   "license": "MIT",
   "author": "Temitayo Fadojutimi",
@@ -77,7 +77,7 @@
     "@zenstackhq/schema": ">=3.6",
     "better-auth": ">=1.6",
     "pg": "^8.0.0",
-    "stratal": "^0.0.25"
+    "stratal": "^0.0.26"
   },
   "devDependencies": {
     "@better-auth/core": "^1.6.14",

package/dist/index-DTXzJzpy.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index-DTXzJzpy.d.mts","names":[],"sources":["../src/database/database.module.ts","../src/database/database.service.ts","../src/database/database.tokens.ts","../src/database/decorators/inject-db.decorator.ts","../src/database/errors/record-not-found.error.ts","../src/database/errors/unique-constraint.error.ts","../src/database/errors/from-zenstack-error.ts","../src/database/event-types.ts","../src/database/i18n/en.ts","../src/database/plugins/error-handler.plugin.ts","../src/database/plugins/event-emitter.plugin.ts","../src/database/plugins/schema-switcher.ts","../src/database/commands/zenstack.command.ts","../src/database/commands/db-generate.command.ts","../src/database/commands/db-pull.command.ts","../src/database/commands/db-push.command.ts","../src/database/commands/migrate-deploy.command.ts","../src/database/commands/migrate-dev.command.ts","../src/database/commands/migrate-reset.command.ts","../src/database/commands/migrate-status.command.ts"],"mappings":";;;;;;;;;;UA0BiB,wBAAA,gBACA,SAAA,GAAY,SAAA,eACd,cAAA,GAAiB,cAAA;EAE9B,IAAA,EAAM,IAAA;EACN,MAAA,EAAQ,MAAA;EACR,OAAA,QAAe,aAAA,CAAc,SAAA;EAC7B,OAAA,GAAU,SAAA;;AAPZ;;;;EAaE,cAAA,GAAiB,qBAAA,CAAsB,MAAA;AAAA;AAAA,UAGxB,oBAAA;EACf,OAAA,EAAS,qBAAA;EACT,WAAA,EAAa,wBAAwB;AAAA;AAAA,cAiB1B,cAAA,YAA0B,YAAA,EAAc,UAAA;EAAA,OAC5C,OAAA,CAAQ,MAAA,EAAQ,oBAAA,GAAuB,aAAA;EAAA,OASvC,YAAA,CAAa,OAAA,EAAS,kBAAA,CAAmB,oBAAA,IAAwB,aAAA;EAalE,YAAA,CAAa,OAAA,EAAS,aAAA,GAAgB,OAAA;EAiB5C,UAAA,CAAW,OAAA,EAAS,aAAA;AAAA;;;;;;;;;;;AA3EtB;;;;;;;KCRY,eAAA,WACA,cAAA,GAAiB,qBAAA,IACzB,cAAA,CACF,qBAAA,CAAsB,CAAA,GACtB,aAAA,CAAc,qBAAA,CAAsB,CAAA,IACpC,yBAAA,CAA0B,CAAA,mBAC1B,yBAAA,CAA0B,CAAA,uBAE1B,yBAAA,CAA0B,CAAA;;;cC1Bf,eAAA;EAAA,SAGH,OAAA;EAAA,SAAA,QAAA;AAAA;AAAA,iBAIM,gBAAA,CAAiB,IAAoB,EAAd,cAAc;;;iBCHrC,QAAA,CAAS,IAAA,EAAM,cAAA,GAAiB,kBAAkB;;;cCFrD,mBAAA,SAA4B,aAAa;EAAA,SACxB,OAAA;cAAA,OAAA,uBAAkB,KAAA;AAAA;;;cCDnC,qBAAA,SAA8B,aAAa;EAAA,SAC1B,MAAA;cAAA,MAAA,yBAAmB,KAAA;AAAA;;;iBCEjC,iBAAA,CAAkB,KAAA,YAAiB,gBAAgB;;;;;;KCkCvD,UAAA;;;;KAKA,iBAAA,GAAoB,iBAAiB;;;;;;KAO5C,kBAAA,MAAwB,CAAA;EAAY,MAAA;AAAA,IAAoB,OAAA,OAAc,CAAA;;;;;KAM/D,SAAA,GAAY,kBAAkB,CAAC,cAAA;;;;KAS/B,iBAAA,MACL,UAAA,IAAc,SAAA,IAAa,iBAAA,QAC3B,UAAA,IAAc,SAAA,QACd,UAAA,IAAc,iBAAA,KACjB,UAAA;;;;KASC,gBAAA,WACO,SAAA,YACA,OAAA,OAAc,CAAA,+BACd,iBAAA,IAEV,CAAA,oBAAqB,UAAA,CAAW,CAAA,EAAG,CAAA,IACnC,CAAA,wBAAyB,cAAA,CAAe,CAAA,EAAG,CAAA,IAC3C,CAAA,oBAAqB,UAAA,CAAW,CAAA,EAAG,CAAA,IACnC,CAAA,wBAAyB,cAAA,CAAe,CAAA,EAAG,CAAA,IAC3C,CAAA,oBAAqB,UAAA,CAAW,CAAA,EAAG,CAAA,IACnC,CAAA,wBAAyB,cAAA,CAAe,CAAA,EAAG,CAAA,IAC3C,CAAA,wBAAyB,cAAA,CAAe,CAAA,EAAG,CAAA,IAC3C,CAAA,uBAAwB,aAAA,CAAc,CAAA,EAAG,CAAA,IACzC,CAAA,sBAAuB,YAAA,CAAa,CAAA,EAAG,CAAA,IACvC,CAAA,oBAAqB,UAAA,CAAW,CAAA,EAAG,CAAA,IACnC,CAAA,mBAAoB,SAAA,CAAU,CAAA,EAAG,CAAA,IACjC,CAAA,uBAAwB,aAAA,CAAc,CAAA,EAAG,CAAA,IACzC,CAAA,qBAAsB,WAAA,CAAY,CAAA,EAAG,CAAA;;;APzDQ;KO+D1C,YAAA,gCAA4C,iBAAA,IAC/C,CAAA,SAAU,SAAA,GACR,CAAA,SAAU,OAAA,OAAc,CAAA,sBACxB,gBAAA,CAAiB,CAAA,EAAG,CAAA,EAAG,CAAA;EAAa,IAAA;AAAA,IACpC,CAAA,GACA,gBAAA,CAAiB,CAAA,EAAG,CAAA,EAAG,CAAA;EAAa,KAAA;AAAA,IACpC,CAAA,GACA,gBAAA,CAAiB,CAAA,EAAG,CAAA,EAAG,CAAA;;;;;KAQf,OAAA,WAAkB,SAAA,YAAqB,iBAAA,IACjD,YAAA,CAAa,cAAA,EAAgB,CAAA,EAAG,CAAA,4BAA6B,YAAA,CAAa,cAAA,EAAgB,CAAA,EAAG,CAAA;APvE/F;;;AAAA,KO4EK,cAAA,gCAA8C,iBAAA,IACjD,CAAA,SAAU,SAAA,GACR,CAAA,SAAU,OAAA,OAAc,CAAA,sBACxB,CAAA,mEACA,WAAA,CAAY,CAAA,EAAG,CAAA,MACf,CAAA,4BAEA,WAAA,CAAY,CAAA,EAAG,CAAA;;;;;KAQP,SAAA,WAAoB,SAAA,YAAqB,iBAAA,IACnD,cAAA,CAAe,cAAA,EAAgB,CAAA,EAAG,CAAA,4BAA6B,cAAA,CAAe,cAAA,EAAgB,CAAA,EAAG,CAAA;;;;KASvF,kBAAA;;;;;;;;;;;KAYA,eAAA,aACE,SAAA,IAAa,kBAAA,eACb,SAAA,eACA,kBAAA;;;;KAMT,cAAA,wBACH,CAAA,SAAU,SAAA,GACR,CAAA,SAAU,OAAA,OAAc,CAAA,sBACxB,WAAA,CAAY,CAAA,EAAG,CAAA;;;;KAOP,SAAA,WAAoB,SAAA,IAC9B,cAAA,CAAe,cAAA,EAAgB,CAAA,4BAA6B,cAAA,CAAe,cAAA,EAAgB,CAAA;AAAA,UAEnF,yBAAA,WAAoC,SAAA;EAC5C,KAAA,EAAO,CAAA;EACP,MAAA;EACA,MAAA;EACA,KAAA,EAAO,SAAA,CAAU,CAAA;AAAA;AAAA,UAGT,yBAAA,WAAoC,SAAA;EAC5C,KAAA,EAAO,CAAA;EACP,MAAA;EACA,MAAA,EAAQ,SAAA,CAAU,CAAA;EAClB,KAAA,EAAO,SAAA,CAAU,CAAA;AAAA;AAAA,UAGT,yBAAA,WAAoC,SAAA;EAC5C,KAAA,EAAO,CAAA;EACP,MAAA;EACA,MAAA,EAAQ,SAAA,CAAU,CAAA;EAClB,KAAA;AAAA;;UAIQ,0BAAA,WAAqC,SAAA;EAC7C,KAAA,EAAO,CAAA;EACP,MAAA,EAAQ,kBAAA;EACR,MAAA,EAAQ,SAAA,CAAU,CAAA;EAClB,KAAA,EAAO,SAAA,CAAU,CAAA;AAAA;;UAIT,yBAAA,WAAoC,kBAAA;EAC5C,KAAA,EAAO,SAAA;EACP,MAAA,EAAQ,CAAA;EACR,MAAA,EAAQ,CAAA;EACR,KAAA,EAAO,CAAA;AAAA;;UAIC,qBAAA;EACR,KAAA,EAAO,SAAA;EACP,MAAA,EAAQ,kBAAkB;EAC1B,MAAA;EACA,KAAA;AAAA;AAAA,KAGG,kBAAA,qBACH,CAAA,mCAAoC,SAAA,aAAsB,yBAAA,CAA0B,CAAA,IAClF,CAAA,mCAAoC,SAAA,aAAsB,yBAAA,CAA0B,CAAA,IACpF,CAAA,mCAAoC,SAAA,aAAsB,yBAAA,CAA0B,CAAA,IACpF,CAAA,mCAAoC,SAAA,KAAc,0BAAA,CAA2B,CAAA,IAC7E,CAAA,mCAAoC,kBAAA,KAAuB,yBAAA,CAA0B,CAAA,IACrF,qBAAA;;AN/MyB;;KMoNjB,YAAA,WACJ,eAAA,GAAkB,kBAAA,CAAmB,CAAA;;;;KAUjC,UAAA,qBACV,CAAA,gCAAiC,UAAA,wBAAkC,SAAA,qBAA8B,iBAAA;EAC7F,KAAA,EAAO,KAAA;EAAO,KAAA,EAAO,KAAA;EAAO,SAAA,EAAW,EAAA;EAAI,IAAA;AAAA,IAC7C,CAAA,gCAAiC,UAAA,qBACjC,MAAA,SAAe,SAAA;EACb,KAAA,EAAO,KAAA;EAAO,KAAA,EAAO,MAAA;EAAQ,IAAA;AAAA,IAC/B,MAAA,SAAe,iBAAA;EACb,KAAA,EAAO,KAAA;EAAO,SAAA,EAAW,MAAA;EAAQ,IAAA;AAAA,YAEnC,CAAA,SAAU,UAAA;EACR,KAAA,EAAO,CAAA;EAAG,IAAA;AAAA;AJ/PkD;AAAA,UIuQxD,gBAAA;;UAIA,yBAAA,WACE,SAAA,YACA,iBAAA,gBACI,UAAA,UACN,gBAAA;EACR,IAAA,EAAM,KAAA,oBAAyB,OAAA,CAAQ,CAAA,EAAG,CAAA,IAAK,QAAA,CAAS,OAAA,CAAQ,CAAA,EAAG,CAAA;EACnE,MAAA,EAAQ,KAAA,mBAAwB,SAAA,CAAU,CAAA,EAAG,CAAA;AAAA;;UAIrC,yBAAA,eACM,UAAA,UACN,gBAAA;EACR,SAAA,EAAW,iBAAA;EACX,IAAA,EAAM,KAAA,8BAAmC,QAAA;EACzC,MAAA,EAAQ,KAAA;AAAA;AH3RqD;AAAA,UG+RrD,6BAAA,eACM,UAAA,UACN,gBAAA;EACR,KAAA,EAAO,SAAA;EACP,IAAA,EAAM,KAAA,8BAAmC,QAAA;EACzC,MAAA,EAAQ,KAAA;AAAA;;UAIA,yBAAA,eACM,UAAA,UACN,gBAAA;EACR,KAAA,EAAO,SAAA;EACP,SAAA,EAAW,iBAAA;EACX,IAAA,EAAM,KAAA,8BAAmC,QAAA;EACzC,MAAA,EAAQ,KAAA;AAAA;;AF9SsD;;KEwT3D,oBAAA,qBACH,UAAA,CAAW,CAAA;EACT,KAAA,kBAAuB,UAAA;EACvB,KAAA,kBAAuB,SAAA;EACvB,SAAA,kBAA2B,iBAAA;EAC3B,IAAA;AAAA,IAEA,yBAAA,CAA0B,CAAA,EAAG,CAAA,EAAG,CAAA,IAChC,UAAA,CAAW,CAAA;EACX,KAAA,kBAAuB,UAAA;EACvB,KAAA,mBAAwB,SAAA;EACxB,IAAA;AAAA,IAEA,yBAAA,CAA0B,CAAA,IAC1B,UAAA,CAAW,CAAA;EACX,KAAA,kBAAuB,UAAA;EACvB,SAAA,mBAA4B,iBAAA;EAC5B,IAAA;AAAA,IAEA,6BAAA,CAA8B,CAAA,IAC9B,UAAA,CAAW,CAAA;EAAa,KAAA,kBAAuB,UAAA;EAAY,IAAA;AAAA,IAC3D,yBAAA,CAA0B,CAAA,IAC1B,gBAAA;;;AArS6C;AAAA;;;;;;;;;KAuTrC,cAAA,WACJ,iBAAA,GAAoB,oBAAA,CAAqB,CAAA;AAAA;EAAA,UAQrC,mBAAA,SAA4B,cAAA,EAAgB,YAAY;AAAA;;;cC5WvD,gBAAA;EAAA;;;;;;;;;YAWD,oBAAA;IACR,QAAA,SAAiB,gBAAgB;EAAA;AAAA;;;;;;;;;;;ARcrC;;;cSXa,kBAAA,YAA8B,aAAA,CAAc,WAAA,EAAW,MAAA,mBAAyB,MAAA;EAAA,SAClF,EAAA;EAET,OAAA;IAAiB,IAAA;IAAA;EAAA;IACf,IAAA,EAAM,MAAA;IACN,OAAA,GAAU,IAAA,EAAM,MAAA,kCAAwC,OAAA;EAAA,MACtD,OAAA;AAAA;;;UChBW,yBAAA;EACf,aAAA,EAAe,cAAc;AAAA;;;;;AVoB/B;;;;;;;;;;;;;;;;;;;;;;;;;;cUgDa,kBAAA,YAA8B,aAAA,CAAc,WAAA,EAAW,MAAA,mBAAyB,MAAA;EAAA,QAGvE,OAAA;EAAA,SAFX,EAAA;cAEW,OAAA,EAAS,yBAAA;EAE7B,gBAAA,EAAkB,sBAAA,CAAuB,WAAA;EA6CzC,OAAA;IAAiB,KAAA;IAAA,SAAA;IAAA,IAAA;IAAA;EAAA;IACf,KAAA;IACA,SAAA;IACA,IAAA,EAAM,MAAA;IACN,OAAA,GAAU,IAAA,EAAM,MAAA,kCAAwC,OAAA;EAAA,MACtD,OAAA;AAAA;;;;;;;;;;;;;AVvGN;cWVa,cAAA;EAAA,OACJ,KAAA,IAAS,MAAA,EAAQ,CAAA,EAAG,UAAA,WAAqB,CAAC;AAAA;;;;;;;uBCX7B,eAAA,SAAwB,OAAO;EAAA,UACnC,QAAA,CAAS,IAAA,aAAiB,OAAA;AAAA;;;cCL/B,iBAAA,SAA0B,eAAe;EAAA,OAC7C,OAAA;EAAA,OACA,WAAA;EAED,MAAA,IAAU,OAAA;AAAA;;;cCJL,aAAA,SAAsB,eAAe;EAAA,OACzC,OAAA;EAAA,OACA,WAAA;EAED,MAAA,IAAU,OAAA;AAAA;;;cCJL,aAAA,SAAsB,eAAe;EAAA,OACzC,OAAA;EAAA,OACA,WAAA;EAED,MAAA,IAAU,OAAA;AAAA;;;cCJL,oBAAA,SAA6B,eAAe;EAAA,OAChD,OAAA;EAAA,OACA,WAAA;EAED,MAAA,IAAU,OAAA;AAAA;;;cCJL,iBAAA,SAA0B,eAAe;EAAA,OAC7C,OAAA;EAAA,OACA,WAAA;EAED,MAAA,IAAU,OAAA;AAAA;;;cCJL,mBAAA,SAA4B,eAAe;EAAA,OAC/C,OAAA;EAAA,OACA,WAAA;EAED,MAAA,IAAU,OAAA;AAAA;;;cCJL,oBAAA,SAA6B,eAAe;EAAA,OAChD,OAAA;EAAA,OACA,WAAA;EAED,MAAA,IAAU,OAAA;AAAA"}