@vritti/api-sdk 0.3.16 → 0.4.1

package/dist/auth.cjs

@@ -31,11 +31,11 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/auth/index.ts
 var auth_exports = {};
 __export(auth_exports, {
-  APP_SESSION_TYPE: () => APP_SESSION_TYPE,
   AUTH_CONFIG: () => AUTH_CONFIG,
   AUTH_CONFIG_DEFAULTS: () => AUTH_CONFIG_DEFAULTS,
   AccessToken: () => AccessToken,
   AuthConfigModule: () => AuthConfigModule,
+  AuthType: () => AuthType,
   CLIENT_ID_HEADER: () => CLIENT_ID_HEADER,
   ClientIp: () => ClientIp,
   CookieDomain: () => CookieDomain,
@@ -43,13 +43,10 @@ __export(auth_exports, {
   Hostname: () => Hostname,
   MAX_CLOCK_SKEW_SECONDS: () => MAX_CLOCK_SKEW_SECONDS,
   PARTY_ID_HEADER: () => PARTY_ID_HEADER,
-  Public: () => Public,
-  REQUIRE_APP_KEY: () => REQUIRE_APP_KEY,
-  REQUIRE_SESSION_KEY: () => REQUIRE_SESSION_KEY,
+  REQUIRE_AUTH_KEY: () => REQUIRE_AUTH_KEY,
   RefreshCookieOptions: () => RefreshCookieOptions,
   RefreshTokenCookie: () => RefreshTokenCookie,
-  RequireApp: () => RequireApp,
-  RequireSession: () => RequireSession,
+  Require: () => Require,
   SKIP_CSRF_KEY: () => SKIP_CSRF_KEY,
   SessionData: () => SessionData,
   SkipCsrf: () => SkipCsrf,
@@ -78,7 +75,6 @@ var WORKSPACE_HEADER_ORDER = [
 var CLIENT_ID_HEADER = "x-vritti-client-id";
 var PARTY_ID_HEADER = "x-party-id";
 var MAX_CLOCK_SKEW_SECONDS = 300;
-var APP_SESSION_TYPE = "APP";
 
 // src/auth/auth.config.ts
 var AUTH_CONFIG = Symbol("AUTH_CONFIG");
@@ -106,7 +102,7 @@ var TokenType = /* @__PURE__ */ (function(TokenType2) {
 })({});
 
 // src/auth/auth-config.module.ts
-var import_common8 = require("@nestjs/common");
+var import_common7 = require("@nestjs/common");
 var import_config = require("@nestjs/config");
 var import_core3 = require("@nestjs/core");
 var import_jwt2 = require("@nestjs/jwt");
@@ -223,6 +219,15 @@ var RequestService = class {
     return index === -1 ? "" : url.slice(index + 1);
   }
   /**
+  * Returns a single decoded query param, or undefined when absent.
+  *
+  * Reads the raw URL rather than Fastify's parsed `query` so it is usable from the
+  * guard, which runs before a route's own parsing is meaningful.
+  */
+  getQueryParam(key) {
+    return new URLSearchParams(this.getQuery()).get(key) ?? void 0;
+  }
+  /**
   * Returns the raw request body, as `fastify-raw-body` leaves it.
   *
   * Read structurally rather than through a module augmentation: that plugin is the
@@ -276,7 +281,7 @@ RequestModule = _ts_decorate2([
 ], RequestModule);
 
 // src/auth/guards/vritti-auth.guard.ts
-var import_common7 = require("@nestjs/common");
+var import_common6 = require("@nestjs/common");
 var import_constants = require("@nestjs/common/constants");
 var import_core2 = require("@nestjs/core");
 
@@ -320,23 +325,28 @@ function getResponseFromContext(host) {
 }
 __name(getResponseFromContext, "getResponseFromContext");
 
-// src/auth/decorators/require-app.decorator.ts
+// src/auth/decorators/require.decorator.ts
 var import_common3 = require("@nestjs/common");
-var REQUIRE_APP_KEY = "requiredAppTypes";
-var RequireApp = /* @__PURE__ */ __name((...types) => (0, import_common3.SetMetadata)(REQUIRE_APP_KEY, types), "RequireApp");
-
-// src/auth/decorators/require-session.decorator.ts
-var import_common4 = require("@nestjs/common");
-var REQUIRE_SESSION_KEY = "requiredSessionTypes";
-var RequireSession = /* @__PURE__ */ __name((...types) => (0, import_common4.SetMetadata)(REQUIRE_SESSION_KEY, types), "RequireSession");
+var REQUIRE_AUTH_KEY = "requireAuth";
+var AuthType = /* @__PURE__ */ (function(AuthType2) {
+  AuthType2["Session"] = "session";
+  AuthType2["App"] = "app";
+  AuthType2["Cloud"] = "cloud";
+  AuthType2["Public"] = "public";
+  return AuthType2;
+})({});
+var Require = /* @__PURE__ */ __name((type, ...subtypes) => (0, import_common3.SetMetadata)(REQUIRE_AUTH_KEY, {
+  type,
+  subtypes
+}), "Require");
 
 // src/auth/decorators/skip-csrf.decorator.ts
-var import_common5 = require("@nestjs/common");
+var import_common4 = require("@nestjs/common");
 var SKIP_CSRF_KEY = "skipCsrf";
-var SkipCsrf = /* @__PURE__ */ __name(() => (0, import_common5.SetMetadata)(SKIP_CSRF_KEY, true), "SkipCsrf");
+var SkipCsrf = /* @__PURE__ */ __name(() => (0, import_common4.SetMetadata)(SKIP_CSRF_KEY, true), "SkipCsrf");
 
 // src/auth/services/token.service.ts
-var import_common6 = require("@nestjs/common");
+var import_common5 = require("@nestjs/common");
 var import_jwt = require("@nestjs/jwt");
 
 // src/utils/time.utils.ts
@@ -396,7 +406,7 @@ var TokenService = class _TokenService {
   }
   jwtService;
   config;
-  logger = new import_common6.Logger(_TokenService.name);
+  logger = new import_common5.Logger(_TokenService.name);
   constructor(jwtService, config) {
     this.jwtService = jwtService;
     this.config = config;
@@ -460,21 +470,21 @@ var TokenService = class _TokenService {
     try {
       const decoded = this.jwtService.verify(token);
       if (decoded.tokenType !== TokenType.ACCESS) {
-        throw new import_common6.UnauthorizedException("Invalid token type");
+        throw new import_common5.UnauthorizedException("Invalid token type");
       }
       return decoded;
     } catch (error) {
-      if (error instanceof import_common6.UnauthorizedException) throw error;
+      if (error instanceof import_common5.UnauthorizedException) throw error;
       const jwtError = error;
       switch (jwtError.name) {
         case "TokenExpiredError":
-          throw new import_common6.UnauthorizedException("Access token has expired");
+          throw new import_common5.UnauthorizedException("Access token has expired");
         case "JsonWebTokenError":
-          throw new import_common6.UnauthorizedException("Invalid access token");
+          throw new import_common5.UnauthorizedException("Invalid access token");
         case "NotBeforeError":
-          throw new import_common6.UnauthorizedException("Access token not yet valid");
+          throw new import_common5.UnauthorizedException("Access token not yet valid");
         default:
-          throw new import_common6.UnauthorizedException("Access token validation failed");
+          throw new import_common5.UnauthorizedException("Access token validation failed");
       }
     }
   }
@@ -483,24 +493,24 @@ var TokenService = class _TokenService {
     try {
       const decoded = this.jwtService.verify(token);
       if (decoded.tokenType !== TokenType.REFRESH) {
-        throw new import_common6.UnauthorizedException("Invalid token type");
+        throw new import_common5.UnauthorizedException("Invalid token type");
       }
       return decoded;
     } catch (error) {
-      if (error instanceof import_common6.UnauthorizedException) throw error;
-      throw new import_common6.UnauthorizedException("Invalid or expired session");
+      if (error instanceof import_common5.UnauthorizedException) throw error;
+      throw new import_common5.UnauthorizedException("Invalid or expired session");
     }
   }
   // Validates that the access token is bound to the refresh token
   validateTokenBinding(accessToken, refreshToken) {
     if (!verifyTokenHash(refreshToken, accessToken.refreshTokenHash)) {
-      throw new import_common6.UnauthorizedException("Session validation failed");
+      throw new import_common5.UnauthorizedException("Session validation failed");
     }
   }
 };
 TokenService = _ts_decorate3([
-  (0, import_common6.Injectable)(),
-  _ts_param2(1, (0, import_common6.Inject)(AUTH_CONFIG)),
+  (0, import_common5.Injectable)(),
+  _ts_param2(1, (0, import_common5.Inject)(AUTH_CONFIG)),
   _ts_metadata2("design:type", Function),
   _ts_metadata2("design:paramtypes", [
     typeof import_jwt.JwtService === "undefined" ? Object : import_jwt.JwtService,
@@ -534,7 +544,7 @@ var VrittiAuthGuard = class _VrittiAuthGuard {
   requestService;
   tokenService;
   config;
-  logger = new import_common7.Logger(_VrittiAuthGuard.name);
+  logger = new import_common6.Logger(_VrittiAuthGuard.name);
   constructor(reflector, requestService, tokenService, config) {
     this.reflector = reflector;
     this.requestService = requestService;
@@ -551,38 +561,64 @@ var VrittiAuthGuard = class _VrittiAuthGuard {
       context.getHandler(),
       context.getClass()
     ]) || csrfExemptTransports.includes(context.getType());
-    const requiredAppTypes = this.reflector.getAllAndOverride(REQUIRE_APP_KEY, [
+    const requirement = this.reflector.getAllAndOverride(REQUIRE_AUTH_KEY, [
       context.getHandler(),
       context.getClass()
-    ]);
-    if (requiredAppTypes) {
-      return this.handleAppAuth(request, requiredAppTypes, route);
-    }
-    const isPublic = this.reflector.getAllAndOverride("isPublic", [
-      context.getHandler(),
-      context.getClass()
-    ]);
-    if (isPublic) {
-      if (!skipCsrf) {
-        await this.validateCsrf(request, reply);
+    ]) ?? {
+      type: AuthType.Session,
+      subtypes: []
+    };
+    switch (requirement.type) {
+      // Signed server-to-server calls return before CSRF is ever reached. Neither carries a
+      // cookie for CSRF to protect, and that holds on REST too — which a transport-level
+      // exemption would not cover.
+      case AuthType.App:
+        return this.handleAppAuth(request, requirement.subtypes, route);
+      case AuthType.Cloud:
+        return this.handleCloudAuth(request, route);
+      case AuthType.Public: {
+        if (!skipCsrf) {
+          await this.validateCsrf(request, reply);
+        }
+        this.logger.debug(`${route} \u2014 public endpoint, skipping auth`);
+        return true;
+      }
+      case AuthType.Session: {
+        const isSseEndpoint = this.reflector.get(import_constants.SSE_METADATA, context.getHandler());
+        if (isSseEndpoint) {
+          this.logger.debug(`${route} \u2014 SSE endpoint, authenticating via refresh cookie`);
+          return this.handleSseAuth(request, requirement.subtypes);
+        }
+        const sessionType = await this.handleHttpAuth(request, requirement.subtypes);
+        const csrfExemptSessionTypes = this.config.guard.csrfExemptSessionTypes ?? [];
+        if (!skipCsrf && !csrfExemptSessionTypes.includes(sessionType)) {
+          await this.validateCsrf(request, reply);
+        }
+        return true;
       }
-      this.logger.debug(`${route} \u2014 public endpoint, skipping auth`);
-      return true;
-    }
-    const requiredSessionTypes = this.reflector.getAllAndOverride(REQUIRE_SESSION_KEY, [
-      context.getHandler(),
-      context.getClass()
-    ]);
-    const isSseEndpoint = this.reflector.get(import_constants.SSE_METADATA, context.getHandler());
-    if (isSseEndpoint) {
-      this.logger.debug(`${route} \u2014 SSE endpoint, authenticating via refresh cookie`);
-      return this.handleSseAuth(request, requiredSessionTypes);
     }
-    const sessionType = await this.handleHttpAuth(request, requiredSessionTypes);
-    const csrfExemptSessionTypes = this.config.guard.csrfExemptSessionTypes ?? [];
-    if (!skipCsrf && !csrfExemptSessionTypes.includes(sessionType)) {
-      await this.validateCsrf(request, reply);
+  }
+  /**
+  * Authenticates a signed request from the control plane.
+  *
+  * Same shape as the app branch and for the same reason: verifying the signature needs a key
+  * the consuming server holds, so this delegates to `guard.onAuthenticated` and keeps only
+  * what this side can do — recognising the decorator and seeding the context.
+  *
+  * There is no subtype filter. Cloud is one caller, not a family of them.
+  */
+  async handleCloudAuth(request, route) {
+    const onAuthenticated = this.config.guard.onAuthenticated;
+    if (!onAuthenticated) {
+      this.logger.error(`${route} \u2014 @Require(AuthType.Cloud) requires guard.onAuthenticated to be configured`);
+      throw new import_common6.UnauthorizedException("Cloud authentication is not configured");
     }
+    const auth = {
+      kind: "cloud"
+    };
+    request.auth = auth;
+    await onAuthenticated(this.requestService, auth);
+    this.logger.debug(`${route} \u2014 authenticated cloud request`);
     return true;
   }
   /**
@@ -604,18 +640,19 @@ var VrittiAuthGuard = class _VrittiAuthGuard {
     const onAuthenticated = this.config.guard.onAuthenticated;
     if (!onAuthenticated) {
       this.logger.error(`${route} \u2014 @RequireApp() requires guard.onAuthenticated to be configured`);
-      throw new import_common7.UnauthorizedException("App authentication is not configured");
+      throw new import_common6.UnauthorizedException("App authentication is not configured");
     }
-    const sessionInfo = {
-      sessionType: APP_SESSION_TYPE
+    const auth = {
+      kind: "app"
     };
-    request.sessionInfo = sessionInfo;
-    await onAuthenticated(this.requestService, sessionInfo);
-    if (requiredAppTypes.length && !requiredAppTypes.includes(sessionInfo.appType ?? "")) {
-      this.logger.warn(`${route} \u2014 app type ${sessionInfo.appType ?? "unknown"} not in allowed: [${requiredAppTypes.join(", ")}]`);
-      throw new import_common7.UnauthorizedException("This client is not recognised.");
+    request.auth = auth;
+    await onAuthenticated(this.requestService, auth);
+    const appType = auth.kind === "app" ? auth.appType : void 0;
+    if (requiredAppTypes.length && !requiredAppTypes.includes(appType ?? "")) {
+      this.logger.warn(`${route} \u2014 app type ${appType ?? "unknown"} not in allowed: [${requiredAppTypes.join(", ")}]`);
+      throw new import_common6.UnauthorizedException("This client is not recognised.");
     }
-    this.logger.debug(`${route} \u2014 authenticated app (${sessionInfo.appType})`);
+    this.logger.debug(`${route} \u2014 authenticated app (${appType})`);
     return true;
   }
   // Authenticates standard HTTP requests using the access token from Authorization header
@@ -624,44 +661,56 @@ var VrittiAuthGuard = class _VrittiAuthGuard {
     const accessToken = this.requestService.getAccessToken();
     if (!accessToken) {
       this.logger.warn(`${route} \u2014 no access token found`);
-      throw new import_common7.UnauthorizedException("Access token not found");
+      throw new import_common6.UnauthorizedException("Access token not found");
     }
     const decoded = this.tokenService.validateAccessToken(accessToken);
     const refreshTokenBindingExemptSessionTypes = this.config.guard.refreshTokenBindingExemptSessionTypes ?? [];
     if (!refreshTokenBindingExemptSessionTypes.includes(decoded.sessionType)) {
       const refreshToken = this.requestService.getRefreshToken();
       if (!refreshToken) {
-        throw new import_common7.UnauthorizedException("Session validation failed");
+        throw new import_common6.UnauthorizedException("Session validation failed");
       }
       this.tokenService.validateTokenBinding(decoded, refreshToken);
     }
     if (requiredSessionTypes?.length && !requiredSessionTypes.includes(decoded.sessionType)) {
       this.logger.warn(`${route} \u2014 session type ${decoded.sessionType} not in allowed: [${requiredSessionTypes.join(", ")}]`);
-      throw new import_common7.UnauthorizedException(`${decoded.sessionType} sessions cannot access this endpoint`);
+      throw new import_common6.UnauthorizedException(`${decoded.sessionType} sessions cannot access this endpoint`);
     }
-    const { tokenType: _tokenType, refreshTokenHash: _hash, exp: _exp, iat: _iat, ...sessionInfo } = decoded;
-    request.sessionInfo = sessionInfo;
+    const { tokenType: _tokenType, refreshTokenHash: _hash, exp: _exp, iat: _iat, ...claims } = decoded;
+    const auth = {
+      kind: "session",
+      ...claims
+    };
+    request.auth = auth;
     const onAuthenticated = this.config.guard.onAuthenticated;
     if (onAuthenticated) {
-      await onAuthenticated(this.requestService, request.sessionInfo);
+      await onAuthenticated(this.requestService, auth);
     }
     this.logger.debug(`${route} \u2014 authenticated user: ${decoded.userId} (${decoded.sessionType})`);
     return decoded.sessionType;
   }
   // Authenticates SSE connections using the refresh token httpOnly cookie
-  handleSseAuth(request, requiredSessionTypes) {
+  async handleSseAuth(request, requiredSessionTypes) {
     const refreshToken = this.requestService.getRefreshToken();
     if (!refreshToken) {
       this.logger.warn(`SSE ${request.url} \u2014 no refresh token cookie`);
-      throw new import_common7.UnauthorizedException("Authentication required");
+      throw new import_common6.UnauthorizedException("Authentication required");
     }
     const decoded = this.tokenService.validateRefreshToken(refreshToken);
     if (requiredSessionTypes?.length && !requiredSessionTypes.includes(decoded.sessionType)) {
       this.logger.warn(`SSE ${request.url} \u2014 session type ${decoded.sessionType} not allowed`);
-      throw new import_common7.UnauthorizedException(`${decoded.sessionType} sessions cannot access this endpoint`);
+      throw new import_common6.UnauthorizedException(`${decoded.sessionType} sessions cannot access this endpoint`);
+    }
+    const { tokenType: _tokenType, exp: _exp, iat: _iat, ...claims } = decoded;
+    const auth = {
+      kind: "session",
+      ...claims
+    };
+    request.auth = auth;
+    const onAuthenticated = this.config.guard.onAuthenticated;
+    if (onAuthenticated) {
+      await onAuthenticated(this.requestService, auth);
     }
-    const { tokenType: _tokenType, exp: _exp, iat: _iat, ...sessionInfo } = decoded;
-    request.sessionInfo = sessionInfo;
     this.logger.debug(`SSE ${request.url} \u2014 authenticated user: ${decoded.userId} (${decoded.sessionType})`);
     return true;
   }
@@ -677,7 +726,7 @@ var VrittiAuthGuard = class _VrittiAuthGuard {
       const fastifyInstance = request.server;
       const csrfProtection = fastifyInstance.csrfProtection;
       if (!csrfProtection) {
-        throw new import_common7.ForbiddenException("CSRF protection not configured");
+        throw new import_common6.ForbiddenException("CSRF protection not configured");
       }
       await new Promise((resolve, reject) => {
         const originalSend = reply.send.bind(reply);
@@ -694,7 +743,7 @@ var VrittiAuthGuard = class _VrittiAuthGuard {
       });
     } catch (_error) {
       this.logger.warn(`${request.method} ${request.url} \u2014 CSRF validation failed`);
-      throw new import_common7.ForbiddenException({
+      throw new import_common6.ForbiddenException({
         errors: [
           {
             field: "csrf",
@@ -707,10 +756,10 @@ var VrittiAuthGuard = class _VrittiAuthGuard {
   }
 };
 VrittiAuthGuard = _ts_decorate4([
-  (0, import_common7.Injectable)({
-    scope: import_common7.Scope.REQUEST
+  (0, import_common6.Injectable)({
+    scope: import_common6.Scope.REQUEST
   }),
-  _ts_param3(3, (0, import_common7.Inject)(AUTH_CONFIG)),
+  _ts_param3(3, (0, import_common6.Inject)(AUTH_CONFIG)),
   _ts_metadata3("design:type", Function),
   _ts_metadata3("design:paramtypes", [
     typeof import_core2.Reflector === "undefined" ? Object : import_core2.Reflector,
@@ -797,27 +846,27 @@ var AuthConfigModule = class _AuthConfigModule {
   }
 };
 AuthConfigModule = _ts_decorate5([
-  (0, import_common8.Global)(),
-  (0, import_common8.Module)({})
+  (0, import_common7.Global)(),
+  (0, import_common7.Module)({})
 ], AuthConfigModule);
 
 // src/auth/decorators/access-token.decorator.ts
-var import_common9 = require("@nestjs/common");
-var AccessToken = (0, import_common9.createParamDecorator)((_data, ctx) => {
+var import_common8 = require("@nestjs/common");
+var AccessToken = (0, import_common8.createParamDecorator)((_data, ctx) => {
   const request = getRequestFromContext(ctx);
   const authHeader = request.headers.authorization;
   return authHeader?.replace("Bearer ", "") || "";
 });
 
 // src/auth/decorators/client-ip.decorator.ts
-var import_common10 = require("@nestjs/common");
-var ClientIp = (0, import_common10.createParamDecorator)((_data, ctx) => {
+var import_common9 = require("@nestjs/common");
+var ClientIp = (0, import_common9.createParamDecorator)((_data, ctx) => {
   return getRequestFromContext(ctx).ip;
 });
 
 // src/auth/decorators/cookie-domain.decorator.ts
-var import_common11 = require("@nestjs/common");
-var CookieDomain = (0, import_common11.createParamDecorator)((_data, ctx) => {
+var import_common10 = require("@nestjs/common");
+var CookieDomain = (0, import_common10.createParamDecorator)((_data, ctx) => {
   const request = getRequestFromContext(ctx);
   const forwarded = request.headers["x-forwarded-host"];
   const raw = Array.isArray(forwarded) ? forwarded[0] : forwarded;
@@ -828,15 +877,15 @@ var CookieDomain = (0, import_common11.createParamDecorator)((_data, ctx) => {
 });
 
 // src/auth/decorators/cookie-name.decorator.ts
-var import_common12 = require("@nestjs/common");
-var CookieName = (0, import_common12.createParamDecorator)((_data, ctx) => {
+var import_common11 = require("@nestjs/common");
+var CookieName = (0, import_common11.createParamDecorator)((_data, ctx) => {
   const request = getRequestFromContext(ctx);
   return request.authConfig?.cookie.refreshCookieName ?? AUTH_CONFIG_DEFAULTS.cookie.refreshCookieName;
 });
 
 // src/auth/decorators/hostname.decorator.ts
-var import_common13 = require("@nestjs/common");
-var Hostname = (0, import_common13.createParamDecorator)((_data, ctx) => {
+var import_common12 = require("@nestjs/common");
+var Hostname = (0, import_common12.createParamDecorator)((_data, ctx) => {
   const request = getRequestFromContext(ctx);
   const forwarded = request.headers["x-forwarded-host"];
   const raw = Array.isArray(forwarded) ? forwarded[0] : forwarded;
@@ -844,19 +893,15 @@ var Hostname = (0, import_common13.createParamDecorator)((_data, ctx) => {
   return hostStr.split(":")[0] ?? hostStr;
 });
 
-// src/auth/decorators/public.decorator.ts
-var import_common14 = require("@nestjs/common");
-var Public = /* @__PURE__ */ __name(() => (0, import_common14.SetMetadata)("isPublic", true), "Public");
-
 // src/auth/decorators/refresh-cookie-options.decorator.ts
-var import_common34 = require("@nestjs/common");
+var import_common32 = require("@nestjs/common");
 
 // src/exceptions/bad-gateway.exception.ts
-var import_common16 = require("@nestjs/common");
+var import_common14 = require("@nestjs/common");
 
 // src/exceptions/base-field.exception.ts
-var import_common15 = require("@nestjs/common");
-var HttpProblemException = class extends import_common15.HttpException {
+var import_common13 = require("@nestjs/common");
+var HttpProblemException = class extends import_common13.HttpException {
   static {
     __name(this, "HttpProblemException");
   }
@@ -874,63 +919,63 @@ var HttpProblemException = class extends import_common15.HttpException {
 };
 
 // src/exceptions/bad-request.exception.ts
-var import_common17 = require("@nestjs/common");
+var import_common15 = require("@nestjs/common");
 
 // src/exceptions/conflict.exception.ts
-var import_common18 = require("@nestjs/common");
+var import_common16 = require("@nestjs/common");
 
 // src/exceptions/forbidden.exception.ts
-var import_common19 = require("@nestjs/common");
+var import_common17 = require("@nestjs/common");
 
 // src/exceptions/gone.exception.ts
-var import_common20 = require("@nestjs/common");
+var import_common18 = require("@nestjs/common");
 
 // src/exceptions/internal-server-error.exception.ts
-var import_common21 = require("@nestjs/common");
+var import_common19 = require("@nestjs/common");
 
 // src/exceptions/method-not-allowed.exception.ts
-var import_common22 = require("@nestjs/common");
+var import_common20 = require("@nestjs/common");
 
 // src/exceptions/not-acceptable.exception.ts
-var import_common23 = require("@nestjs/common");
+var import_common21 = require("@nestjs/common");
 
 // src/exceptions/not-found.exception.ts
-var import_common24 = require("@nestjs/common");
+var import_common22 = require("@nestjs/common");
 
 // src/exceptions/not-implemented.exception.ts
-var import_common25 = require("@nestjs/common");
+var import_common23 = require("@nestjs/common");
 
 // src/exceptions/payload-too-large.exception.ts
-var import_common26 = require("@nestjs/common");
+var import_common24 = require("@nestjs/common");
 
 // src/exceptions/request-timeout.exception.ts
-var import_common27 = require("@nestjs/common");
+var import_common25 = require("@nestjs/common");
 
 // src/exceptions/service-unavailable.exception.ts
-var import_common28 = require("@nestjs/common");
+var import_common26 = require("@nestjs/common");
 
 // src/exceptions/too-many-requests.exception.ts
-var import_common29 = require("@nestjs/common");
+var import_common27 = require("@nestjs/common");
 
 // src/exceptions/unauthorized.exception.ts
-var import_common30 = require("@nestjs/common");
+var import_common28 = require("@nestjs/common");
 var UnauthorizedException3 = class extends HttpProblemException {
   static {
     __name(this, "UnauthorizedException");
   }
   constructor(detailOrOptions) {
-    super(detailOrOptions ?? "Unauthorized", import_common30.HttpStatus.UNAUTHORIZED);
+    super(detailOrOptions ?? "Unauthorized", import_common28.HttpStatus.UNAUTHORIZED);
   }
 };
 
 // src/exceptions/unprocessable-entity.exception.ts
-var import_common31 = require("@nestjs/common");
+var import_common29 = require("@nestjs/common");
 
 // src/exceptions/unsupported-media-type.exception.ts
-var import_common32 = require("@nestjs/common");
+var import_common30 = require("@nestjs/common");
 
 // src/exceptions/validation.exception.ts
-var import_common33 = require("@nestjs/common");
+var import_common31 = require("@nestjs/common");
 
 // src/auth/decorators/refresh-cookie-options.decorator.ts
 function buildCookieOptionsForHost(cookieConfig, hostname) {
@@ -951,7 +996,7 @@ function buildCookieOptionsForHost(cookieConfig, hostname) {
   };
 }
 __name(buildCookieOptionsForHost, "buildCookieOptionsForHost");
-var RefreshCookieOptions = (0, import_common34.createParamDecorator)((_data, ctx) => {
+var RefreshCookieOptions = (0, import_common32.createParamDecorator)((_data, ctx) => {
   const request = getRequestFromContext(ctx);
   const forwarded = request.headers["x-forwarded-host"];
   const raw = Array.isArray(forwarded) ? forwarded[0] : forwarded;
@@ -962,8 +1007,8 @@ var RefreshCookieOptions = (0, import_common34.createParamDecorator)((_data, ctx
 });
 
 // src/auth/decorators/refresh-token-cookie.decorator.ts
-var import_common35 = require("@nestjs/common");
-var RefreshTokenCookie = (0, import_common35.createParamDecorator)((_data, ctx) => {
+var import_common33 = require("@nestjs/common");
+var RefreshTokenCookie = (0, import_common33.createParamDecorator)((_data, ctx) => {
   const request = getRequestFromContext(ctx);
   const cookies = request.cookies ?? {};
   const cookieName = request.authConfig?.cookie.refreshCookieName ?? AUTH_CONFIG_DEFAULTS.cookie.refreshCookieName;
@@ -971,23 +1016,22 @@ var RefreshTokenCookie = (0, import_common35.createParamDecorator)((_data, ctx)
 });
 
 // src/auth/decorators/session-data.decorator.ts
-var import_common36 = require("@nestjs/common");
-var SessionData = (0, import_common36.createParamDecorator)((_data, ctx) => {
-  const request = getRequestFromContext(ctx);
-  const sessionInfo = request.sessionInfo;
-  if (!sessionInfo?.sessionId) {
-    throw new Error("Session info not found on request. Ensure route is protected by auth guard.");
+var import_common34 = require("@nestjs/common");
+var SessionData = (0, import_common34.createParamDecorator)((_data, ctx) => {
+  const auth = getRequestFromContext(ctx).auth;
+  if (auth?.kind !== "session") {
+    throw new Error(`No session on this request (auth: ${auth?.kind ?? "none"}). @SessionData() is session-only.`);
   }
   return {
-    userId: sessionInfo.userId,
-    sessionId: sessionInfo.sessionId,
-    sessionType: sessionInfo.sessionType
+    userId: auth.userId,
+    sessionId: auth.sessionId,
+    sessionType: auth.sessionType
   };
 });
 
 // src/auth/decorators/subdomain.decorator.ts
-var import_common37 = require("@nestjs/common");
-var Subdomain = (0, import_common37.createParamDecorator)((_data, ctx) => {
+var import_common35 = require("@nestjs/common");
+var Subdomain = (0, import_common35.createParamDecorator)((_data, ctx) => {
   const request = getRequestFromContext(ctx);
   const forwarded = request.headers["x-forwarded-host"];
   const raw = Array.isArray(forwarded) ? forwarded[0] : forwarded;
@@ -998,29 +1042,28 @@ var Subdomain = (0, import_common37.createParamDecorator)((_data, ctx) => {
 });
 
 // src/auth/decorators/user-agent.decorator.ts
-var import_common38 = require("@nestjs/common");
-var UserAgent = (0, import_common38.createParamDecorator)((_data, ctx) => {
+var import_common36 = require("@nestjs/common");
+var UserAgent = (0, import_common36.createParamDecorator)((_data, ctx) => {
   const userAgent = getRequestFromContext(ctx).headers["user-agent"];
   return Array.isArray(userAgent) ? userAgent[0] : userAgent;
 });
 
 // src/auth/decorators/user-id.decorator.ts
-var import_common39 = require("@nestjs/common");
-var UserId = (0, import_common39.createParamDecorator)((_data, ctx) => {
-  const request = getRequestFromContext(ctx);
-  const sessionInfo = request.sessionInfo;
-  if (!sessionInfo?.userId) {
-    throw new Error("User ID not found on request. Ensure route is protected by auth guard.");
+var import_common37 = require("@nestjs/common");
+var UserId = (0, import_common37.createParamDecorator)((_data, ctx) => {
+  const auth = getRequestFromContext(ctx).auth;
+  if (auth?.kind !== "session") {
+    throw new Error(`No user on this request (auth: ${auth?.kind ?? "none"}). @UserId() is session-only.`);
   }
-  return sessionInfo.userId;
+  return auth.userId;
 });
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  APP_SESSION_TYPE,
   AUTH_CONFIG,
   AUTH_CONFIG_DEFAULTS,
   AccessToken,
   AuthConfigModule,
+  AuthType,
   CLIENT_ID_HEADER,
   ClientIp,
   CookieDomain,
@@ -1028,13 +1071,10 @@ var UserId = (0, import_common39.createParamDecorator)((_data, ctx) => {
   Hostname,
   MAX_CLOCK_SKEW_SECONDS,
   PARTY_ID_HEADER,
-  Public,
-  REQUIRE_APP_KEY,
-  REQUIRE_SESSION_KEY,
+  REQUIRE_AUTH_KEY,
   RefreshCookieOptions,
   RefreshTokenCookie,
-  RequireApp,
-  RequireSession,
+  Require,
   SKIP_CSRF_KEY,
   SessionData,
   SkipCsrf,