@znight/graphql 0.0.0 → 0.2.0

package/dist/plugin-BdBxr5NQ.mjs

@@ -0,0 +1,3222 @@
+import { a as SPECIFIED_SCALARS, o as isGraphQLName, r as RESERVED_ENUM_VALUES, s as parseTypeRef, t as BUILTIN_SCALARS } from "./names-BlzDM5cF.mjs";
+import { ErrorCode, ZnightError, displayName, resolveOptions } from "@znight/core";
+import DataLoader from "dataloader";
+import { EventChannel, HttpResponse, HttpTokens, ValidationException, isHttpException, isThenable, parseByteSize, parseMediaType } from "@znight/http";
+import { AbortedGraphQLExecutionError, GraphQLBoolean, GraphQLEnumType, GraphQLError, GraphQLFloat, GraphQLID, GraphQLInputObjectType, GraphQLInt, GraphQLList, GraphQLNonNull, GraphQLObjectType, GraphQLScalarType, GraphQLSchema, GraphQLString, GraphQLUnionType, Kind, NoSchemaIntrospectionCustomRule, createSourceEventStream, execute, executeSubscriptionEvent, getNamedType, isObjectType, parse, printSchema, specifiedRules, validate, validateSchema, validateSubscriptionArgs, valueFromASTUntyped } from "graphql";
+import { createHash, randomUUID } from "node:crypto";
+// src/errors.ts
+/**
+* GraphQL errors shown to clients (RFC 0005 §5.10, §8.8): `GraphQLException` and the
+* `extensions.code` values the plugin produces (Apollo conventions, which clients already know).
+*
+* Import-free: the exception is a plain `Error` subclass, rendered by the runtime as
+* `{ message, locations, path, extensions: { code, ...extensions } }`.
+*/
+/** `extensions.code` values produced by `@znight/graphql`. Applications may use their own codes too. */
+const GraphQLErrorCode = Object.freeze({
+	ParseFailed: "GRAPHQL_PARSE_FAILED",
+	ValidationFailed: "GRAPHQL_VALIDATION_FAILED",
+	BadUserInput: "BAD_USER_INPUT",
+	QueryTooComplex: "QUERY_TOO_COMPLEX",
+	Unauthenticated: "UNAUTHENTICATED",
+	Forbidden: "FORBIDDEN",
+	NotFound: "NOT_FOUND",
+	Conflict: "CONFLICT",
+	TooManyRequests: "TOO_MANY_REQUESTS",
+	BadRequest: "BAD_REQUEST",
+	SubscriptionOverflow: "SUBSCRIPTION_OVERFLOW",
+	ServiceUnavailable: "SERVICE_UNAVAILABLE",
+	InternalServerError: "INTERNAL_SERVER_ERROR"
+});
+/**
+* An error whose message and extensions are sent to the client as they are (§5.10): throw it from a
+* resolver or return it from a `GraphQLErrorMapper`.
+*
+* ```ts
+* throw new GraphQLException(`No book ${id}`, { code: 'NOT_FOUND', extensions: { bookId: id } })
+* ```
+*/
+var GraphQLException = class extends Error {
+	/** `extensions.code`. */
+	code;
+	/** Extra `extensions` entries. */
+	extensions;
+	constructor(message, options) {
+		super(message, options.cause === void 0 ? void 0 : { cause: options.cause });
+		this.name = "GraphQLException";
+		this.code = options.code;
+		this.extensions = options.extensions;
+	}
+};
+// src/loaders.ts
+/**
+* Creates the per-execution DataLoaders of loader providers: the provider is resolved in the
+* current scope (loaders may be request-scoped), its `options` are read once per token.
+*/
+var LoaderFactory = class {
+	#container;
+	#options = /* @__PURE__ */ new Map();
+	constructor(container) {
+		this.#container = container;
+	}
+	/** A new DataLoader for the loader provider `token`, bound to the instance of the current scope. */
+	create(token) {
+		const provider = this.#container.get(token);
+		if (provider === null || typeof provider !== "object" || typeof provider.load !== "function") throw new ZnightError(ErrorCode.InvalidLoader, `The loader ${token} does not implement BatchLoad (no load(keys) method)`, { hints: ["A loader is a provider implementing BatchLoad<K, V>: async load(keys) { ... }"] });
+		let options = this.#options.get(token);
+		if (options === void 0) {
+			options = readOptions(token, provider.options);
+			this.#options.set(token, options);
+		}
+		return new DataLoader((keys) => loadBatch(token, keys, provider), options);
+	}
+};
+/**
+* The values of a batch, or ZNIGHT065 (failing every key) when there is not one value per key.
+* `async` so that a `load()` throwing synchronously rejects with its own error (DataLoader would
+* replace it with a TypeError).
+*/
+async function loadBatch(token, keys, provider) {
+	const values = await provider.load(keys);
+	if (Array.isArray(values) && values.length === keys.length) return values;
+	throw new ZnightError(ErrorCode.InvalidLoader, `The loader ${token} returned ${Array.isArray(values) ? `${values.length} values` : "no array"} for ${keys.length} keys`, { hints: ["load(keys) returns one value (or Error) per key, in the order of the keys: use orderByKeys()"] });
+}
+function readOptions(token, options) {
+	if (options === void 0) return {};
+	const invalid = (reason) => new ZnightError(ErrorCode.InvalidLoader, `Invalid options of the loader ${token}: ${reason}`, { hints: ["options: { maxBatchSize?: positive integer, cache?: boolean, cacheKeyFn?: (key) => unknown }"] });
+	if (options === null || typeof options !== "object") throw invalid("expected an object");
+	const { maxBatchSize, cache, cacheKeyFn } = options;
+	if (maxBatchSize !== void 0 && !(Number.isSafeInteger(maxBatchSize) && maxBatchSize >= 1)) throw invalid(`maxBatchSize must be a positive integer (received ${String(maxBatchSize)})`);
+	if (cache !== void 0 && typeof cache !== "boolean") throw invalid("cache must be a boolean");
+	if (cacheKeyFn !== void 0 && typeof cacheKeyFn !== "function") throw invalid("cacheKeyFn must be a function");
+	return {
+		...maxBatchSize === void 0 ? {} : { maxBatchSize },
+		...cache === void 0 ? {} : { cache },
+		...cacheKeyFn === void 0 ? {} : { cacheKeyFn: (key) => cacheKeyFn.call(options, key) }
+	};
+}
+function orderByKeys(keys, values, keyOf, options = {}) {
+	const missing = options.missing ?? "error";
+	if (missing !== "error" && missing !== "null") throw new TypeError(`orderByKeys(): missing must be 'error' or 'null' (received ${String(missing)})`);
+	const byKey = /* @__PURE__ */ new Map();
+	for (const value of values) byKey.set(keyOf(value), value);
+	const result = new Array(keys.length);
+	for (let index = 0; index < keys.length; index++) {
+		const key = keys[index];
+		const value = byKey.get(key);
+		if (value !== void 0 || byKey.has(key)) result[index] = value;
+		else result[index] = missing === "null" ? null : notFound(key);
+	}
+	return result;
+}
+function notFound(key) {
+	return new GraphQLException(`Not found: ${typeof key === "string" ? key : String(key)}`, { code: GraphQLErrorCode.NotFound });
+}
+// src/pubsub.ts
+/**
+* Publishes events to the subscribers of a topic. `Events` maps each topic to its payload type.
+*
+* ```ts
+* interface CatalogEvents {
+*   bookAdded: Book
+* }
+*
+* constructor(private readonly events: PubSub<CatalogEvents>) {}
+*
+* await this.events.publish('bookAdded', book)
+* for await (const book of this.events.subscribe('bookAdded', { signal: ctx.signal })) yield book
+* ```
+*/
+var PubSub = class {};
+// src/memory-pubsub.ts
+const DEFAULT_BUFFER_SIZE = 100;
+const PUBLISHED = Promise.resolve();
+/** One subscriber: its channel, and whether it overflowed. */
+var Subscriber = class {
+	channel;
+	#iterator;
+	overflowed = false;
+	constructor(channel) {
+		this.channel = channel;
+		this.#iterator = channel[Symbol.asyncIterator]();
+	}
+	async next() {
+		const step = await this.#iterator.next();
+		if (step.done === true && this.overflowed) {
+			this.overflowed = false;
+			throw new GraphQLException("The subscriber fell behind the events: the subscription ended", { code: GraphQLErrorCode.SubscriptionOverflow });
+		}
+		return step;
+	}
+	return() {
+		this.overflowed = false;
+		return this.#iterator.return?.() ?? Promise.resolve({
+			done: true,
+			value: void 0
+		});
+	}
+	[Symbol.asyncIterator]() {
+		return this;
+	}
+};
+/**
+* In-process fan-out of events to subscribers: what `GraphQLPlugin` provides as `PubSub` by default.
+* Deployments with several instances supply their own `PubSub` (`pubsub` option).
+*
+* ```ts
+* GraphQLPlugin.configure({ pubsub: new MemoryPubSub({ bufferSize: 500 }) })
+* ```
+*/
+var MemoryPubSub = class extends PubSub {
+	#bufferSize;
+	#topics = /* @__PURE__ */ new Map();
+	#closed = false;
+	constructor(options = {}) {
+		super();
+		const bufferSize = options.bufferSize ?? DEFAULT_BUFFER_SIZE;
+		if (!(Number.isSafeInteger(bufferSize) && bufferSize >= 1)) throw new TypeError(`MemoryPubSub: bufferSize must be a positive integer (received ${String(bufferSize)})`);
+		this.#bufferSize = bufferSize;
+	}
+	/** Subscribers of every topic. */
+	get subscribers() {
+		let count = 0;
+		for (const subscribers of this.#topics.values()) count += subscribers.size;
+		return count;
+	}
+	publish(topic, payload) {
+		const subscribers = this.#topics.get(topic);
+		if (subscribers !== void 0) for (const subscriber of subscribers) {
+			const channel = subscriber.channel;
+			if (!channel.closed && !channel.push(payload)) subscriber.overflowed = true;
+		}
+		return PUBLISHED;
+	}
+	subscribe(topic, options = {}) {
+		const channel = new EventChannel({
+			capacity: this.#bufferSize,
+			overflow: "close",
+			...options.signal === void 0 ? {} : { signal: options.signal }
+		});
+		const subscriber = new Subscriber(channel);
+		if (this.#closed) {
+			channel.close();
+			return subscriber;
+		}
+		let subscribers = this.#topics.get(topic);
+		if (subscribers === void 0) {
+			subscribers = /* @__PURE__ */ new Set();
+			this.#topics.set(topic, subscribers);
+		}
+		const set = subscribers;
+		set.add(subscriber);
+		channel.onClose(() => {
+			set.delete(subscriber);
+			if (set.size === 0 && this.#topics.get(topic) === set) this.#topics.delete(topic);
+		});
+		return subscriber;
+	}
+	/** Ends every subscription; later subscriptions end at once. */
+	close() {
+		this.#closed = true;
+		for (const subscribers of [...this.#topics.values()]) for (const subscriber of [...subscribers]) subscriber.channel.close();
+		this.#topics.clear();
+	}
+};
+// src/decisions.ts
+/** The groups listed by `static enforces` of a guard class (ZNIGHT005 when malformed). */
+function enforcedBy(guard, name) {
+	if (typeof guard !== "function") return [];
+	let enforces;
+	try {
+		enforces = guard.enforces;
+	} catch (error) {
+		throw invalidEnforces(name, "reading it threw", error);
+	}
+	if (enforces === void 0) return [];
+	if (!Array.isArray(enforces)) throw invalidEnforces(name, "expected an array of route decorators");
+	for (const entry of enforces) {
+		const info = typeof entry === "function" || typeof entry === "object" && entry !== null ? entry : {};
+		if (typeof info.key !== "string" || typeof info.group !== "string" || typeof info.required !== "boolean") throw invalidEnforces(name, "every entry must be a route decorator ({ key, group, required })");
+	}
+	return enforces;
+}
+function invalidEnforces(name, reason, cause) {
+	return new ZnightError(ErrorCode.InvalidDecorator, `GraphQLPlugin: invalid static enforces of the guard ${name}: ${reason}`, {
+		hints: ["static readonly enforces = [Public, Authenticated, Roles] (decorators created with createRouteDecorator)"],
+		...cause === void 0 ? {} : { cause }
+	});
+}
+/** Runs the check. `groups`: `metadata.extensions.graphql.groups`. */
+function checkFieldDecisions(fields, groups, mode, logger) {
+	const keys = /* @__PURE__ */ new Map();
+	const required = /* @__PURE__ */ new Set();
+	for (const [group, definition] of Object.entries(groups ?? {})) {
+		for (const key of definition.keys) keys.set(key, {
+			group,
+			required: definition.required
+		});
+		if (definition.required) required.add(group);
+	}
+	const enforcedOf = /* @__PURE__ */ new Map();
+	const enforced = (guard) => {
+		let groupsOf = enforcedOf.get(guard.cls);
+		if (groupsOf === void 0) {
+			const infos = enforcedBy(guard.cls, guard.name);
+			for (const info of infos) {
+				if (!keys.has(info.key)) keys.set(info.key, {
+					group: info.group,
+					required: info.required
+				});
+				if (info.required) required.add(info.group);
+			}
+			groupsOf = new Set(infos.map((info) => info.group));
+			enforcedOf.set(guard.cls, groupsOf);
+		}
+		return groupsOf;
+	};
+	const chains = fields.map((field) => {
+		const set = /* @__PURE__ */ new Set();
+		for (const guard of field.guards) for (const group of enforced(guard)) set.add(group);
+		return set;
+	});
+	const known = /* @__PURE__ */ new Set();
+	for (const chain of chains) for (const group of chain) known.add(group);
+	const groupOf = (key) => keys.get(key)?.group ?? key;
+	const problems = /* @__PURE__ */ new Map();
+	const problem = (group) => {
+		let entry = problems.get(group);
+		if (entry === void 0) {
+			entry = {
+				missing: [],
+				unenforced: []
+			};
+			problems.set(group, entry);
+		}
+		return entry;
+	};
+	fields.forEach((field, index) => {
+		const decided = new Set(Object.keys(field.meta).map(groupOf));
+		if (field.root) {
+			for (const group of required) if (!decided.has(group)) problem(group).missing.push(field.description);
+		}
+		const chain = chains[index];
+		for (const group of decided) if ((required.has(group) || known.has(group)) && !chain.has(group)) problem(group).unenforced.push(field.description);
+	});
+	if (problems.size === 0) return;
+	const messages = [];
+	const hints = [];
+	for (const group of [...problems.keys()].sort()) {
+		const entry = problems.get(group);
+		const members = [...keys].filter(([, info]) => info.group === group).map(([key]) => key).sort();
+		const parts = [];
+		if (entry.missing.length > 0) {
+			parts.push(`${count$1(entry.missing.length)} ${entry.missing.length === 1 ? "has" : "have"} no "${group}" decision: ${entry.missing.join(", ")}`);
+			hints.push(`Add a decision of the "${group}" group (${members.join(", ") || group}) to the resolver method or to its class`);
+		}
+		if (entry.unenforced.length > 0) {
+			parts.push(`no guard enforces the "${group}" group on ${count$1(entry.unenforced.length)}: ${entry.unenforced.join(", ")}`);
+			hints.push(`Register a GraphQL guard declaring \`static enforces\` with the decorators of the "${group}" group: GraphQLPlugin.configure({ guards: [...] }) or @UseGuard(...)`);
+		}
+		const message = parts.join("; ");
+		if (mode === "warn") logger.warn(`GraphQLPlugin: ${message}`, {
+			code: ErrorCode.MissingRouteDecision,
+			group
+		});
+		else messages.push(message);
+	}
+	if (mode === "error") {
+		hints.push("Tests that deliberately run without guards can set enforcement: 'warn'");
+		const text = messages.join("; ");
+		throw new ZnightError(ErrorCode.MissingRouteDecision, `GraphQLPlugin: ${text.charAt(0).toUpperCase()}${text.slice(1)}`, { hints });
+	}
+}
+function count$1(fields) {
+	return fields === 1 ? "1 field" : `${fields} fields`;
+}
+// src/context.ts
+const NO_VARIABLES = Object.freeze({});
+/**
+* The `GraphQLContext` of one operation. Built from references the executor already holds (the
+* operation node, the request, the options, the enclosing scope): one allocation per operation,
+* every field read on demand.
+*/
+var OperationContext = class {
+	document;
+	#runtime;
+	#operation;
+	#request;
+	#options;
+	#scope;
+	#requestId;
+	#http;
+	#signal;
+	#ended;
+	#state;
+	#loaders;
+	constructor(runtime, document, operation, request, options, scope) {
+		this.#runtime = runtime;
+		this.document = document;
+		this.#operation = operation;
+		this.#request = request;
+		this.#options = options;
+		this.#scope = scope;
+		this.#requestId = options.requestId;
+	}
+	get transport() {
+		return this.#options.transport ?? "direct";
+	}
+	get operationType() {
+		return this.#operation.operation;
+	}
+	get operationName() {
+		return this.#operation.name?.value;
+	}
+	get requestId() {
+		let id = this.#requestId;
+		if (id === void 0) {
+			const http = this.http;
+			const scoped = http === void 0 ? this.#scope?.get(HttpTokens.RequestId) : void 0;
+			id = http?.requestId ?? (typeof scoped === "string" ? scoped : randomUUID());
+			this.#requestId = id;
+		}
+		return id;
+	}
+	get http() {
+		let http = this.#http;
+		if (http === void 0) {
+			http = this.#options.http ?? this.#scope?.get(HttpTokens.Context) ?? null;
+			this.#http = http;
+		}
+		return http ?? void 0;
+	}
+	get variables() {
+		return this.#request.variables ?? NO_VARIABLES;
+	}
+	get signal() {
+		let signal = this.#signal;
+		if (signal === void 0) {
+			const base = this.#options.signal ?? this.http?.signal ?? this.#runtime.signal;
+			const ended = this.#ended;
+			signal = ended === void 0 ? base : AbortSignal.any([base, ended]);
+			this.#signal = signal;
+		}
+		return signal;
+	}
+	/**
+	* Ties {@link signal} to the end of a subscription: it also aborts when `ended` does (the stream
+	* ended by itself or with `return()`). Called before any resolver runs.
+	*/
+	endsWith(ended) {
+		this.#ended = ended;
+	}
+	get state() {
+		this.#state ??= /* @__PURE__ */ new Map();
+		return this.#state;
+	}
+	loader(key) {
+		const token = typeof key === "string" ? key : this.#tokenOf(key);
+		let loaders = this.#loaders;
+		if (loaders === void 0) {
+			loaders = /* @__PURE__ */ new Map();
+			this.#loaders = loaders;
+		}
+		let loader = loaders.get(token);
+		if (loader === void 0) {
+			loader = this.#runtime.loaders.create(token);
+			loaders.set(token, loader);
+		}
+		return loader;
+	}
+	/** Starts a new execution (a subscription event): loaders and their caches are renewed. */
+	resetLoaders() {
+		this.#loaders = void 0;
+	}
+	#tokenOf(loader) {
+		const token = typeof loader === "function" ? this.#runtime.container.tokenOf(loader) : void 0;
+		if (token === void 0) {
+			const name = typeof loader === "function" ? loader.name || "<anonymous>" : String(loader);
+			throw new ZnightError(ErrorCode.MissingProvider, `GraphQLContext.loader(): ${name} is not a provider`, { hints: ["Add @Injectable() to the loader class (it implements BatchLoad<K, V>)"] });
+		}
+		return token;
+	}
+};
+// src/format.ts
+/** Resolves a {@link Resolvable} (in the current scope for scoped providers). */
+function resolveIn(container, resolvable) {
+	return resolvable.token === void 0 ? resolvable.instance : container.get(resolvable.token);
+}
+/** Message of masked errors. */
+const MASKED_MESSAGE = "Unexpected error.";
+/** `HttpException` status → `extensions.code` (other 4xx: `BAD_REQUEST`, 5xx: masked). */
+const STATUS_CODES = /* @__PURE__ */ new Map([
+	[400, GraphQLErrorCode.BadUserInput],
+	[401, GraphQLErrorCode.Unauthenticated],
+	[403, GraphQLErrorCode.Forbidden],
+	[404, GraphQLErrorCode.NotFound],
+	[409, GraphQLErrorCode.Conflict],
+	[429, GraphQLErrorCode.TooManyRequests]
+]);
+/** Formats the errors of execution results. One per plugin, built at boot. */
+var ErrorFormatter = class {
+	#container;
+	#mappers;
+	#expose;
+	#logger;
+	#schema;
+	constructor(options) {
+		this.#container = options.container;
+		this.#mappers = options.mappers;
+		this.#expose = options.exposeErrors;
+		this.#logger = options.logger;
+		this.#schema = options.schema;
+	}
+	/** Formats the errors of an executed operation (field errors). */
+	format(errors, ctx) {
+		const result = new Array(errors.length);
+		let logged;
+		for (let index = 0; index < errors.length; index++) {
+			const error = errors[index];
+			const original = error.originalError;
+			if (original === void 0 || original === null) {
+				result[index] = withCode(error, error.extensions["code"] === void 0 ? GraphQLErrorCode.InternalServerError : void 0);
+				continue;
+			}
+			const exposed = this.#exposed(original, ctx);
+			if (exposed !== void 0) {
+				result[index] = render(error, exposed);
+				const cause = exposed.cause;
+				if (cause !== void 0) {
+					logged ??= /* @__PURE__ */ new Set();
+					if (!logged.has(cause)) {
+						logged.add(cause);
+						this.#log(error, cause, ctx, exposed.code);
+					}
+				}
+				continue;
+			}
+			if (original instanceof GraphQLError && !isCompletionError(original)) {
+				result[index] = {
+					...original.toJSON(),
+					...located(error)
+				};
+				continue;
+			}
+			logged ??= /* @__PURE__ */ new Set();
+			if (!logged.has(original)) {
+				logged.add(original);
+				this.#log(error, original, ctx, void 0);
+			}
+			result[index] = {
+				message: this.#expose && original instanceof Error ? original.message : MASKED_MESSAGE,
+				...located(error),
+				extensions: { code: GraphQLErrorCode.InternalServerError }
+			};
+		}
+		return result;
+	}
+	/** The exception shown for `original`, `undefined` when it must be masked. */
+	#exposed(original, ctx) {
+		if (original instanceof GraphQLException) return original;
+		for (const resolvable of this.#mappers) {
+			let mapped;
+			try {
+				mapped = resolveIn(this.#container, resolvable).map(original, ctx);
+			} catch (error) {
+				this.#logger.error("GraphQLPlugin: an error mapper failed", {
+					err: error,
+					requestId: ctx.requestId
+				});
+				continue;
+			}
+			if (mapped !== void 0) return mapped;
+		}
+		if (isHttpException(original)) {
+			const status = original.status;
+			if (original instanceof ValidationException) return new GraphQLException(original.message, {
+				code: GraphQLErrorCode.BadUserInput,
+				extensions: { issues: original.details }
+			});
+			if (status >= 500) return void 0;
+			return new GraphQLException(original.message, { code: STATUS_CODES.get(status) ?? GraphQLErrorCode.BadRequest });
+		}
+	}
+	/** Logs an unexpected error, or the cause of a presented one (`code`), at `error` level. */
+	#log(error, cause, ctx, code) {
+		const coordinate = coordinateOf(this.#schema, ctx.document, ctx.operationName, error.path);
+		const what = code === void 0 ? "unexpected error" : `${code} error`;
+		this.#logger.error(`GraphQL: ${what}${coordinate === void 0 ? "" : ` in ${coordinate}`}`, {
+			err: cause,
+			requestId: ctx.requestId,
+			...code === void 0 ? {} : { code },
+			...coordinate === void 0 ? {} : { coordinate },
+			...error.path === void 0 ? {} : { path: error.path.join(".") }
+		});
+	}
+};
+/**
+* What graphql-js raises while completing a resolver's value: a built-in scalar or an enum that
+* cannot represent it (`String cannot represent value: { passwordHash: ... }`), a list value that
+* is not iterable, a union or interface value that resolves to no member. A server bug whose message
+* holds the value, masked and logged like any unexpected error. graphql-js throws plain
+* `GraphQLError`s without code there, told apart from the ones of user code by their message.
+*/
+const COMPLETION_ERROR = /^(?:(?:Int|Float|String|Boolean|ID) cannot represent |Enum "[^"]*" cannot represent |Expected Iterable, but did not find one for field "|Abstract type "|Runtime Object type ")/;
+function isCompletionError(error) {
+	return error.constructor === GraphQLError && error.extensions["code"] === void 0 && COMPLETION_ERROR.test(error.message);
+}
+function located(error) {
+	return {
+		...error.locations === void 0 ? {} : { locations: error.locations },
+		...error.path === void 0 ? {} : { path: error.path }
+	};
+}
+/** `{ message, locations, path, extensions: { ...extensions, code } }`. */
+function render(error, exception) {
+	return {
+		message: exception.message,
+		...located(error),
+		extensions: {
+			...exception.extensions,
+			code: exception.code
+		}
+	};
+}
+/** A graphql-js error formatted with `extensions.code` set to `code` (kept as is without code). */
+function withCode(error, code) {
+	const formatted = error.toJSON();
+	if (code === void 0) return formatted;
+	return {
+		...formatted,
+		extensions: {
+			...formatted.extensions,
+			code
+		}
+	};
+}
+/** A request error (no location): `{ message, extensions: { code } }`. */
+function requestError(message, code, nodes) {
+	return withCode(new GraphQLError(message, nodes === void 0 ? {} : { nodes }), code);
+}
+/**
+* The schema coordinate (`Book.author`) of the field at `path`, found by walking the operation's
+* selections (aliases, fragments, inline fragments). Best effort, for logs: `undefined` when the
+* path crosses a union without a type condition.
+*/
+function coordinateOf(schema, document, operationName, path) {
+	if (path === void 0 || path.length === 0) return void 0;
+	const fragments = /* @__PURE__ */ new Map();
+	let operation;
+	for (const definition of document.definitions) if (definition.kind === Kind.FRAGMENT_DEFINITION) fragments.set(definition.name.value, definition);
+	else if (definition.kind === Kind.OPERATION_DEFINITION && (operationName === void 0 || definition.name?.value === operationName)) operation ??= definition;
+	if (operation === void 0) return void 0;
+	let type = schema.getRootType(operation.operation);
+	let selections = [operation.selectionSet];
+	let coordinate;
+	for (const segment of path) {
+		if (typeof segment === "number") continue;
+		const found = findField(selections, segment, fragments, type?.name);
+		if (found === void 0 || type === void 0 || type === null) return void 0;
+		const parent = found.typeCondition === void 0 ? type : schema.getType(found.typeCondition);
+		if (!isObjectType(parent)) return void 0;
+		const field = parent.getFields()[found.field.name.value];
+		coordinate = `${parent.name}.${found.field.name.value}`;
+		if (field === void 0) return coordinate;
+		type = getNamedType(field.type);
+		selections = found.field.selectionSet === void 0 ? [] : [found.field.selectionSet];
+	}
+	return coordinate;
+}
+function findField(sets, key, fragments, typeCondition) {
+	for (const set of sets) for (const selection of set.selections) if (selection.kind === Kind.FIELD) {
+		if ((selection.alias ?? selection.name).value === key) return {
+			field: selection,
+			typeCondition
+		};
+	} else {
+		const nested = selection.kind === Kind.INLINE_FRAGMENT ? selection : fragments.get(selection.name.value);
+		if (nested === void 0) continue;
+		const found = findField([nested.selectionSet], key, fragments, nested.typeCondition?.name.value ?? typeCondition);
+		if (found !== void 0) return found;
+	}
+}
+// src/limits.ts
+/** The limit errors of `document` (`QUERY_TOO_COMPLEX`), `undefined` when it is within its limits. */
+function checkLimits(document, limits) {
+	const { maxDepth, maxAliases, maxDirectives } = limits;
+	if (maxDepth === void 0 && maxAliases === void 0 && maxDirectives === void 0) return void 0;
+	const counter = {
+		aliases: 0,
+		directives: 0,
+		spreads: 0
+	};
+	const fragments = /* @__PURE__ */ new Map();
+	for (const definition of document.definitions) if (definition.kind === Kind.FRAGMENT_DEFINITION) fragments.set(definition.name.value, definition);
+	let errors;
+	const fail = (message) => {
+		errors ??= [];
+		errors.push(new GraphQLError(message, { extensions: { code: GraphQLErrorCode.QueryTooComplex } }));
+	};
+	for (const definition of document.definitions) if (definition.kind === Kind.OPERATION_DEFINITION || definition.kind === Kind.FRAGMENT_DEFINITION) {
+		countDirectives(definition.directives, counter);
+		if (definition.kind === Kind.OPERATION_DEFINITION) for (const variable of definition.variableDefinitions ?? []) countDirectives(variable.directives, counter);
+		count(definition.selectionSet, counter);
+	}
+	if (maxAliases !== void 0) {
+		if (counter.aliases > maxAliases) fail(`The document has ${counter.aliases} aliases, more than the limit of ${maxAliases}.`);
+		else if (counter.spreads > 0) {
+			const memo = /* @__PURE__ */ new Map();
+			for (const definition of document.definitions) {
+				if (definition.kind !== Kind.OPERATION_DEFINITION) continue;
+				if (aliasesOf(definition.selectionSet, fragments, memo, /* @__PURE__ */ new Set(), maxAliases + 1) > maxAliases) {
+					fail(`${definition.name === void 0 ? "The operation" : `The operation ${definition.name.value}`} has more than ${maxAliases} aliases once its fragments are expanded.`);
+					break;
+				}
+			}
+		}
+	}
+	if (maxDirectives !== void 0 && counter.directives > maxDirectives) fail(`The document has ${counter.directives} directives, more than the limit of ${maxDirectives}.`);
+	if (maxDepth !== void 0) {
+		const depths = /* @__PURE__ */ new Map();
+		for (const definition of document.definitions) {
+			if (definition.kind !== Kind.OPERATION_DEFINITION) continue;
+			const depth = depthOf(definition.selectionSet, fragments, depths, /* @__PURE__ */ new Set());
+			if (depth > maxDepth) fail(`${definition.name === void 0 ? "The operation" : `The operation ${definition.name.value}`} is ${depth} levels deep, more than the limit of ${maxDepth}.`);
+		}
+	}
+	return errors;
+}
+function countDirectives(directives, counter) {
+	if (directives !== void 0) counter.directives += directives.length;
+}
+function count(set, counter) {
+	for (const selection of set.selections) {
+		countDirectives(selection.directives, counter);
+		if (selection.kind === Kind.FIELD) {
+			if (selection.alias !== void 0) counter.aliases++;
+			if (selection.selectionSet !== void 0) count(selection.selectionSet, counter);
+		} else if (selection.kind === Kind.INLINE_FRAGMENT) count(selection.selectionSet, counter);
+		else counter.spreads++;
+	}
+}
+/**
+* Aliases a selection set executes, fragment spreads expanded (`a: f { ...F } b: f { ...F }` counts
+* the aliases of `F` twice). Fragment counts are memoised, so the walk stays linear in the document;
+* counts saturate at `cap` (one more than the limit) and a fragment cycle counts 0 (validation
+* rejects it).
+*/
+function aliasesOf(set, fragments, memo, visiting, cap) {
+	let total = 0;
+	for (const selection of set.selections) {
+		if (selection.kind === Kind.FIELD) {
+			if (selection.alias !== void 0) total++;
+			if (selection.selectionSet !== void 0) total += aliasesOf(selection.selectionSet, fragments, memo, visiting, cap);
+		} else if (selection.kind === Kind.INLINE_FRAGMENT) total += aliasesOf(selection.selectionSet, fragments, memo, visiting, cap);
+		else {
+			const name = selection.name.value;
+			let known = memo.get(name);
+			if (known === void 0) {
+				const fragment = fragments.get(name);
+				if (fragment === void 0 || visiting.has(name)) continue;
+				visiting.add(name);
+				known = aliasesOf(fragment.selectionSet, fragments, memo, visiting, cap);
+				visiting.delete(name);
+				memo.set(name, known);
+			}
+			total += known;
+		}
+		if (total >= cap) return cap;
+	}
+	return total;
+}
+/**
+* Field nesting of a selection set (`{ a { b } }` is 2). Introspection fields (`__schema`,
+* `__type`) do not count: `MaxIntrospectionDepthRule` bounds them. Fragment depths are memoised; a
+* fragment cycle counts 0 (validation rejects it).
+*/
+function depthOf(set, fragments, depths, visiting) {
+	let max = 0;
+	for (const selection of set.selections) {
+		let depth = 0;
+		if (selection.kind === Kind.FIELD) {
+			if (selection.name.value.startsWith("__")) continue;
+			depth = selection.selectionSet === void 0 ? 1 : 1 + depthOf(selection.selectionSet, fragments, depths, visiting);
+		} else if (selection.kind === Kind.INLINE_FRAGMENT) depth = depthOf(selection.selectionSet, fragments, depths, visiting);
+		else {
+			const name = selection.name.value;
+			const known = depths.get(name);
+			if (known === void 0) {
+				const fragment = fragments.get(name);
+				if (fragment === void 0 || visiting.has(name)) continue;
+				visiting.add(name);
+				depth = depthOf(fragment.selectionSet, fragments, depths, visiting);
+				visiting.delete(name);
+				depths.set(name, depth);
+			} else depth = known;
+		}
+		if (depth > max) max = depth;
+	}
+	return max;
+}
+// src/tokens.ts
+/**
+* Tokens of the values `GraphQLPlugin` supplies to the container (declared in the package
+* manifest). `GraphQLContext` is a request-scoped external: inject it in request-scoped providers
+* or through `Lazy<GraphQLContext>`.
+*/
+const GraphQLTokens = Object.freeze({
+	Context: "@znight/graphql#GraphQLContext",
+	PubSub: "@znight/graphql#PubSub",
+	Plugin: "@znight/graphql#GraphQLPlugin"
+});
+// src/execution.ts
+/**
+* The answer of {@link GraphQLExecutor.execute} to a subscription with
+* {@link ExecuteOptions.streamSubscriptions}: start it with {@link GraphQLExecutor.subscribe}.
+*/
+const SUBSCRIBE = Object.freeze({
+	status: 0,
+	result: Object.freeze({})
+});
+const OPERATION_HOOK = "graphql:operation";
+const DIRECT$1 = Object.freeze({});
+const DONE$1 = Object.freeze({
+	done: true,
+	value: void 0
+});
+/** SHA-256 (hex) of a query text: `GraphQLOperationEvent.documentId`. */
+function documentId(query) {
+	return createHash("sha256").update(query, "utf8").digest("hex");
+}
+/** A parsed and validated document, kept by the document cache. */
+var CachedDocument = class {
+	query;
+	document;
+	/** The operation of a single-operation document. */
+	single;
+	/** Operations by name (documents with several operations). */
+	named;
+	#id;
+	constructor(query, document) {
+		this.query = query;
+		this.document = document;
+		let single;
+		let named;
+		let count = 0;
+		for (const definition of document.definitions) {
+			if (definition.kind !== Kind.OPERATION_DEFINITION) continue;
+			count++;
+			single = definition;
+			if (definition.name !== void 0) {
+				named ??= /* @__PURE__ */ new Map();
+				named.set(definition.name.value, definition);
+			}
+		}
+		this.single = count === 1 ? single : void 0;
+		this.named = named;
+	}
+	/** SHA-256 of the query, computed on first read (only the hook needs it). */
+	get id() {
+		this.#id ??= documentId(this.query);
+		return this.#id;
+	}
+};
+/** A bounded LRU of documents by exact query text. */
+var DocumentCache = class {
+	#max;
+	#entries = /* @__PURE__ */ new Map();
+	#last;
+	constructor(max) {
+		this.#max = max;
+	}
+	get size() {
+		return this.#entries.size;
+	}
+	get(query) {
+		const entry = this.#entries.get(query);
+		if (entry !== void 0 && this.#last !== query) {
+			this.#entries.delete(query);
+			this.#entries.set(query, entry);
+			this.#last = query;
+		}
+		return entry;
+	}
+	set(query, entry) {
+		if (this.#max === 0) return;
+		if (this.#entries.size >= this.#max) {
+			const oldest = this.#entries.keys().next();
+			if (oldest.done !== true) this.#entries.delete(oldest.value);
+		}
+		this.#entries.set(query, entry);
+		this.#last = query;
+	}
+	clear() {
+		this.#entries.clear();
+		this.#last = void 0;
+	}
+};
+/** A request refused before execution. */
+var Rejection = class {
+	status;
+	errors;
+	operationType;
+	operationName;
+	documentId;
+	headers;
+	constructor(status, errors, documentId, operation, headers) {
+		this.status = status;
+		this.errors = errors;
+		this.documentId = documentId;
+		this.operationType = operation?.operation;
+		this.operationName = operation?.name?.value;
+		this.headers = headers;
+	}
+	response() {
+		return {
+			status: this.status,
+			result: { errors: this.errors },
+			...this.headers === void 0 ? {} : { headers: this.headers }
+		};
+	}
+};
+/** The GraphQL executor of a plugin. */
+var GraphQLExecutor = class {
+	#schema;
+	#container;
+	#hooks;
+	#logger;
+	#formatter;
+	#runtime;
+	#rules;
+	#limits;
+	#maxTokens;
+	#hideSuggestions;
+	#cache;
+	#maxActive;
+	#streams = /* @__PURE__ */ new Set();
+	#direct = /* @__PURE__ */ new Set();
+	/** Subscriptions counted against `maxActive` while their source starts (not yet in `#streams`). */
+	#starting = 0;
+	constructor(options) {
+		this.#schema = options.schema;
+		this.#container = options.container;
+		this.#hooks = options.hooks;
+		this.#logger = options.logger;
+		this.#formatter = options.formatter;
+		this.#runtime = options.runtime;
+		this.#rules = options.introspection ? specifiedRules : [...specifiedRules, NoSchemaIntrospectionCustomRule];
+		this.#limits = options.limits;
+		this.#maxTokens = options.limits.maxTokens;
+		this.#hideSuggestions = !options.introspection;
+		this.#cache = new DocumentCache(options.documentCache);
+		this.#maxActive = options.maxActiveSubscriptions;
+	}
+	/** Active subscriptions (every transport). */
+	get activeSubscriptions() {
+		return this.#streams.size;
+	}
+	/** Documents in the cache. */
+	get cachedDocuments() {
+		return this.#cache.size;
+	}
+	/**
+	* Executes a query or a mutation. Resolves (or returns, when every resolver is synchronous) a
+	* response; rejects only when `options.signal` aborts the execution (with the signal's reason).
+	* A subscription is a 400: it needs {@link subscribe} ({@link SUBSCRIBE} with
+	* `streamSubscriptions`).
+	*/
+	execute(request, options = DIRECT$1) {
+		const prepared = this.#prepare(request, options);
+		if (prepared instanceof Rejection) return this.#reject(prepared, request, options);
+		if (prepared.operation.operation === "subscription") {
+			if (options.streamSubscriptions === true) return SUBSCRIBE;
+			return this.#reject(new Rejection(400, [requestError("Subscriptions are delivered as a stream: send the request with accept: text/event-stream (GraphQL over SSE), or call GraphQLPlugin.subscribe()", GraphQLErrorCode.BadRequest)], prepared.entry.id, prepared.operation), request, options);
+		}
+		const scope = this.#container.currentScope();
+		const ctx = this.#context(prepared, request, options, scope);
+		const hooks = this.#hooks;
+		if (!hooks.hasWrappers(OPERATION_HOOK) && !hooks.hasListeners(OPERATION_HOOK)) return this.#inScope(scope, ctx, () => this.#run(prepared, request, options, ctx));
+		return this.#inScope(scope, ctx, () => this.#observed(ctx, prepared.entry.id, () => this.#run(prepared, request, options, ctx)));
+	}
+	/**
+	* Subscribes: a stream of results, one per source event, or a rejection (status 400, 405 or 503).
+	* A query or a mutation gives a stream of its single result. The stream ends when the source
+	* ends, when `options.signal` aborts, or with `return()`; a source failure ends it with a final
+	* error result (`SUBSCRIPTION_OVERFLOW` for a subscriber that fell behind `MemoryPubSub`).
+	*/
+	async subscribe(request, options = DIRECT$1) {
+		const prepared = this.#prepare(request, options);
+		if (prepared instanceof Rejection) return this.#reject(prepared, request, options);
+		if (prepared.operation.operation !== "subscription") {
+			const response = await this.execute(request, options);
+			return response.status === 200 ? new SingleResultStream(response.result) : response;
+		}
+		const limited = this.#maxActive !== void 0;
+		if (limited && this.#streams.size + this.#starting >= this.#maxActive) return this.#reject(new Rejection(503, [requestError("Too many active subscriptions, retry later", GraphQLErrorCode.ServiceUnavailable)], prepared.entry.id, prepared.operation), request, options);
+		let reserved = limited;
+		if (reserved) this.#starting++;
+		const release = () => {
+			if (reserved) {
+				reserved = false;
+				this.#starting--;
+			}
+		};
+		const outer = this.#container.currentScope();
+		const ctx = this.#context(prepared, request, options, outer);
+		const ended = new AbortController();
+		ctx.endsWith(ended.signal);
+		let run;
+		let close;
+		if (outer === void 0) {
+			const opened = this.#container.openScope([[GraphQLTokens.Context, ctx]]);
+			run = (fn) => opened.run(fn);
+			close = () => {
+				ended.abort();
+				opened.close()?.catch((error) => this.#runtimeLogError("Failed to close the scope of a subscription", error));
+			};
+		} else {
+			outer.set(GraphQLTokens.Context, ctx);
+			run = (fn) => fn();
+			close = () => ended.abort();
+		}
+		const observer = this.#observer(ctx, prepared.entry.id);
+		try {
+			const stream = await run(() => this.#startSubscription(prepared, request, options, ctx, observer, run, close, release));
+			release();
+			if (stream instanceof Rejection) {
+				close();
+				observer?.end("rejected", stream.errors);
+				return stream.response();
+			}
+			return stream;
+		} catch (error) {
+			release();
+			close();
+			observer?.end("error", void 0);
+			throw error;
+		}
+	}
+	/** Ends every subscription started with `transport: 'direct'` (plugin `onStop`). */
+	async stopDirect() {
+		await Promise.all([...this.#direct].map((stream) => stream.return()));
+	}
+	/** Forgets every cached document. */
+	clear() {
+		this.#cache.clear();
+	}
+	/** Request checks, the document (cached, or parsed, limited and validated), the operation. */
+	#prepare(request, options) {
+		const query = request?.query;
+		if (typeof query !== "string" || query === "") return badRequest(typeof query === "string" ? "The query is empty" : "Missing query (a string)");
+		const operationName = request.operationName;
+		if (operationName !== void 0 && operationName !== null && typeof operationName !== "string") return badRequest("operationName must be a string");
+		const variables = request.variables;
+		if (variables !== void 0 && variables !== null && (typeof variables !== "object" || Array.isArray(variables))) return badRequest("variables must be an object");
+		const entry = this.#cache.get(query) ?? this.#load(query);
+		if (entry instanceof Rejection) return entry;
+		let operation;
+		if (operationName === void 0 || operationName === null) {
+			operation = entry.single;
+			if (operation === void 0) return new Rejection(400, [requestError("Must provide operation name if query contains multiple operations.", GraphQLErrorCode.BadRequest)], entry.id);
+		} else {
+			operation = entry.named?.get(operationName);
+			if (operation === void 0) return new Rejection(400, [requestError(`Unknown operation named "${operationName}".`, GraphQLErrorCode.BadRequest)], entry.id);
+		}
+		if (options.queriesOnly === true && operation.operation !== "query") return new Rejection(405, [requestError(`A ${operation.operation} cannot be sent with GET: use POST`, GraphQLErrorCode.BadRequest)], entry.id, operation, { allow: "POST" });
+		return {
+			entry,
+			operation
+		};
+	}
+	/** Parses, limits and validates a document; caches it when valid (rejected documents are not cached). */
+	#load(query) {
+		let document;
+		try {
+			document = parse(query, this.#maxTokens === void 0 ? void 0 : { maxTokens: this.#maxTokens });
+		} catch (error) {
+			if (!(error instanceof GraphQLError)) throw error;
+			return new Rejection(400, [withCode(error, GraphQLErrorCode.ParseFailed)], documentId(query));
+		}
+		const limited = checkLimits(document, this.#limits);
+		if (limited !== void 0) return new Rejection(400, limited.map((error) => withCode(error, void 0)), documentId(query));
+		const errors = validate(this.#schema, document, this.#rules, { hideSuggestions: this.#hideSuggestions });
+		if (errors.length > 0) return new Rejection(400, errors.map((error) => withCode(error, GraphQLErrorCode.ValidationFailed)), documentId(query));
+		const entry = new CachedDocument(query, document);
+		this.#cache.set(query, entry);
+		return entry;
+	}
+	#context(prepared, request, options, scope) {
+		return new OperationContext(this.#runtime, prepared.entry.document, prepared.operation, request, options, scope);
+	}
+	/** Runs `fn` in the current scope (the GraphQL context set in it) or in a new one, closed after. */
+	#inScope(scope, ctx, fn) {
+		if (scope !== void 0) {
+			scope.set(GraphQLTokens.Context, ctx);
+			return fn();
+		}
+		const opened = this.#container.openScope([[GraphQLTokens.Context, ctx]]);
+		let result;
+		try {
+			result = opened.run(fn);
+		} catch (error) {
+			const closing = opened.close();
+			if (closing === void 0) throw error;
+			return closing.then(() => Promise.reject(error), () => Promise.reject(error));
+		}
+		if (isPromise$2(result)) return result.then((value) => {
+			const closing = opened.close();
+			return closing === void 0 ? value : closing.then(() => value);
+		}, (error) => {
+			const closing = opened.close();
+			if (closing === void 0) throw error;
+			return closing.then(() => Promise.reject(error), () => Promise.reject(error));
+		});
+		const closing = opened.close();
+		return closing === void 0 ? result : closing.then(() => result);
+	}
+	#run(prepared, request, options, ctx) {
+		let result;
+		try {
+			result = execute({
+				schema: this.#schema,
+				document: prepared.entry.document,
+				operationName: request.operationName,
+				variableValues: request.variables,
+				contextValue: ctx,
+				abortSignal: options.abortSignal ?? options.signal,
+				hideSuggestions: this.#hideSuggestions
+			});
+		} catch (error) {
+			return Promise.reject(abortReason(error, options));
+		}
+		if (isPromise$2(result)) return result.then((settled) => this.#respond(settled, ctx), (error) => Promise.reject(abortReason(error, options)));
+		return this.#respond(result, ctx);
+	}
+	/** The response of an execution result: as is without errors, formatted errors otherwise. */
+	#respond(result, ctx) {
+		const errors = result.errors;
+		if (errors === void 0) return {
+			status: 200,
+			result
+		};
+		if (!("data" in result)) return {
+			status: 400,
+			result: { errors: errors.map(variableError) }
+		};
+		return {
+			status: 200,
+			result: {
+				data: result.data,
+				errors: this.#formatter.format(errors, ctx),
+				...result.extensions === void 0 ? {} : { extensions: result.extensions }
+			}
+		};
+	}
+	/** Formats a subscription result: an event, a source that could not start or failed (field errors). */
+	formatEvent(result, ctx) {
+		const errors = result.errors;
+		if (errors === void 0) return result;
+		return {
+			..."data" in result ? { data: result.data } : {},
+			errors: this.#formatter.format(errors, ctx)
+		};
+	}
+	#startSubscription(prepared, request, options, ctx, observer, run, close, release) {
+		const validated = validateSubscriptionArgs({
+			schema: this.#schema,
+			document: prepared.entry.document,
+			operationName: request.operationName,
+			variableValues: request.variables,
+			contextValue: ctx,
+			abortSignal: options.signal,
+			hideSuggestions: this.#hideSuggestions
+		});
+		if (!("schema" in validated)) return new Rejection(400, validated.map(variableError), prepared.entry.id, prepared.operation);
+		const start = (source) => {
+			release();
+			if (!isAsyncIterable(source)) {
+				const result = this.formatEvent(source, ctx);
+				close();
+				observer?.end("error", result.errors);
+				return new SingleResultStream(result);
+			}
+			const stream = new SubscriptionStream({
+				executor: this,
+				source: source[Symbol.asyncIterator](),
+				validated,
+				ctx,
+				run,
+				signal: options.signal,
+				field: responseKey(prepared.operation),
+				onEnd: (outcome, errors) => {
+					this.#streams.delete(stream);
+					this.#direct.delete(stream);
+					close();
+					observer?.end(outcome, errors);
+				}
+			});
+			this.#streams.add(stream);
+			if (ctx.transport === "direct") this.#direct.add(stream);
+			return stream;
+		};
+		const source = createSourceEventStream(validated);
+		return isPromise$2(source) ? source.then(start) : start(source);
+	}
+	/** A rejection as a response, observed by the hook (outcome `rejected`). */
+	#reject(rejection, request, options) {
+		const hooks = this.#hooks;
+		const wrapped = hooks.hasWrappers(OPERATION_HOOK);
+		if (!wrapped && !hooks.hasListeners(OPERATION_HOOK)) return rejection.response();
+		const event = {
+			operationType: rejection.operationType,
+			operationName: rejection.operationName ?? (typeof request?.operationName === "string" ? request.operationName : void 0),
+			documentId: rejection.documentId,
+			transport: options.transport ?? "direct",
+			requestId: options.requestId ?? options.http?.requestId ?? this.#scopedRequestId(),
+			context: void 0,
+			startTime: performance.now(),
+			outcome: "rejected",
+			errors: summaries(rejection.errors)
+		};
+		if (!wrapped) {
+			hooks.emit(OPERATION_HOOK, event);
+			return rejection.response();
+		}
+		return hooks.run(OPERATION_HOOK, event, () => Promise.resolve(rejection.response())).then((response) => {
+			if (hooks.hasListeners(OPERATION_HOOK)) hooks.emit(OPERATION_HOOK, event);
+			return response;
+		});
+	}
+	/** An executed query or mutation, observed by the hook. */
+	#observed(ctx, id, run) {
+		const hooks = this.#hooks;
+		const event = operationEvent(ctx, id);
+		const done = (response) => {
+			event.outcome = outcomeOf(response);
+			if (response.result.errors !== void 0) event.errors = summaries(response.result.errors);
+			return response;
+		};
+		const failed = (error) => {
+			event.outcome = "error";
+			throw error;
+		};
+		const emit = () => {
+			if (hooks.hasListeners(OPERATION_HOOK)) hooks.emit(OPERATION_HOOK, event);
+		};
+		if (hooks.hasWrappers(OPERATION_HOOK)) return hooks.run(OPERATION_HOOK, event, () => Promise.resolve(run()).then(done, failed)).then((response) => {
+			emit();
+			return response;
+		}, (error) => {
+			emit();
+			throw error;
+		});
+		let response;
+		try {
+			response = run();
+		} catch (error) {
+			event.outcome = "error";
+			emit();
+			throw error;
+		}
+		if (!isPromise$2(response)) {
+			done(response);
+			emit();
+			return response;
+		}
+		return response.then((settled) => {
+			done(settled);
+			emit();
+			return settled;
+		}, (error) => {
+			event.outcome = "error";
+			emit();
+			throw error;
+		});
+	}
+	/** The hook of a subscription, for its whole life (`end()` settles it), or `undefined` without wrappers nor listeners. */
+	#observer(ctx, id) {
+		const hooks = this.#hooks;
+		const wrapped = hooks.hasWrappers(OPERATION_HOOK);
+		if (!wrapped && !hooks.hasListeners(OPERATION_HOOK)) return void 0;
+		const event = operationEvent(ctx, id);
+		let resolve;
+		if (wrapped) {
+			const ended = new Promise((settle) => {
+				resolve = settle;
+			});
+			hooks.run(OPERATION_HOOK, event, () => ended).catch((error) => this.#runtimeLogError("A \"graphql:operation\" hook wrapper failed", error));
+		}
+		let ended = false;
+		return { end: (outcome, errors) => {
+			if (ended) return;
+			ended = true;
+			event.outcome = outcome;
+			if (errors !== void 0 && errors.length > 0) event.errors = summaries(errors);
+			resolve?.();
+			if (hooks.hasListeners(OPERATION_HOOK)) hooks.emit(OPERATION_HOOK, event);
+		} };
+	}
+	/** The request id of the enclosing scope (a controller calling GraphQL), or a new one. */
+	#scopedRequestId() {
+		const id = this.#container.currentScope()?.get(HttpTokens.RequestId);
+		return typeof id === "string" ? id : randomUUID();
+	}
+	#runtimeLogError(message, error) {
+		this.#logger.error(`GraphQLPlugin: ${message}`, { err: error });
+	}
+};
+function noop() {}
+function badRequest(message) {
+	return new Rejection(400, [requestError(message, GraphQLErrorCode.BadRequest)], void 0);
+}
+function variableError(error) {
+	return withCode(error, error.extensions["code"] === void 0 ? GraphQLErrorCode.BadUserInput : void 0);
+}
+/** graphql-js rejects with `AbortedGraphQLExecutionError`: callers get the reason of their signal. */
+function abortReason(error, options) {
+	const signal = options.abortSignal ?? options.signal;
+	if (error instanceof AbortedGraphQLExecutionError && signal?.aborted === true) return signal.reason;
+	return error;
+}
+function operationEvent(ctx, id) {
+	return {
+		operationType: ctx.operationType,
+		operationName: ctx.operationName,
+		documentId: id,
+		transport: ctx.transport,
+		requestId: ctx.requestId,
+		context: ctx,
+		startTime: performance.now()
+	};
+}
+function outcomeOf(response) {
+	if (response.status !== 200) return "rejected";
+	const result = response.result;
+	if (result.errors === void 0 || result.errors.length === 0) return "success";
+	return result.data === null || result.data === void 0 ? "error" : "partial";
+}
+function summaries(errors) {
+	return errors.map((error) => {
+		const code = error.extensions?.["code"];
+		return {
+			message: error.message,
+			code: typeof code === "string" ? code : void 0,
+			...error.path === void 0 ? {} : { path: error.path }
+		};
+	});
+}
+/** The response key of the root field of a subscription (its single selection). */
+function responseKey(operation) {
+	const selection = operation.selectionSet.selections[0];
+	return selection?.kind === Kind.FIELD ? (selection.alias ?? selection.name).value : void 0;
+}
+function isPromise$2(value) {
+	return typeof value?.then === "function";
+}
+function isAsyncIterable(value) {
+	return value !== null && typeof value === "object" && typeof value[Symbol.asyncIterator] === "function";
+}
+/** A stream of one result (a query sent as a stream, a rejection for `plugin.subscribe()`). */
+function singleResult(result) {
+	return new SingleResultStream(result);
+}
+/** The stream of a query or a mutation sent as a stream (SSE): its single result. */
+var SingleResultStream = class {
+	#result;
+	constructor(result) {
+		this.#result = result;
+	}
+	next() {
+		const result = this.#result;
+		if (result === void 0) return Promise.resolve(DONE$1);
+		this.#result = void 0;
+		return Promise.resolve({
+			done: false,
+			value: result
+		});
+	}
+	return() {
+		this.#result = void 0;
+		return Promise.resolve(DONE$1);
+	}
+	[Symbol.asyncIterator]() {
+		return this;
+	}
+};
+/**
+* The results of a subscription: each source event executed with `executeSubscriptionEvent`, a
+* fresh per-execution state (loaders) and the operation's `GraphQLContext`.
+*
+* The source is started at once: its first `next()` is requested when the stream is created, so
+* that a resolver written as an async generator (`for await (const x of pubsub.subscribe(...))`)
+* has subscribed when `subscribe()` resolves, whatever the transport and however late its consumer
+* reads (an SSE body pulled on demand). Only that first event is read ahead; the next ones are read
+* when the consumer asks (backpressure).
+*/
+var SubscriptionStream = class {
+	#init;
+	#onAbort;
+	/** The first `next()` of the source, requested at creation and consumed by the first read. */
+	#first;
+	/** `next()` calls of the source still pending. */
+	#reading = 0;
+	#ended = false;
+	#partial = false;
+	constructor(init) {
+		this.#init = init;
+		const signal = init.signal;
+		if (signal !== void 0) {
+			this.#onAbort = () => {
+				this.return();
+			};
+			signal.addEventListener("abort", this.#onAbort, { once: true });
+		}
+		const first = init.run(() => this.#read());
+		first.catch(noop);
+		this.#first = first;
+		if (signal?.aborted === true) this.return();
+	}
+	next() {
+		if (this.#ended) return Promise.resolve(DONE$1);
+		return this.#init.run(() => this.#pull());
+	}
+	/** The next event of the source. */
+	async #read() {
+		this.#reading++;
+		try {
+			return await this.#init.source.next();
+		} finally {
+			this.#reading--;
+		}
+	}
+	async #pull() {
+		const init = this.#init;
+		let step;
+		try {
+			const first = this.#first;
+			this.#first = void 0;
+			step = await (first ?? this.#read());
+		} catch (error) {
+			if (this.#ended) return DONE$1;
+			const result = init.executor.formatEvent({ errors: [new GraphQLError(errorMessage(error), {
+				originalError: asError(error),
+				path: init.field === void 0 ? void 0 : [init.field]
+			})] }, init.ctx);
+			this.#end("error", result.errors);
+			return {
+				done: false,
+				value: result
+			};
+		}
+		if (step.done === true || this.#ended) {
+			this.#end(this.#partial ? "partial" : "success", void 0);
+			return DONE$1;
+		}
+		init.ctx.resetLoaders();
+		const executed = executeSubscriptionEvent({
+			...init.validated,
+			rootValue: step.value
+		});
+		const result = init.executor.formatEvent(isPromise$2(executed) ? await executed : executed, init.ctx);
+		if (result.errors !== void 0) this.#partial = true;
+		return {
+			done: false,
+			value: result
+		};
+	}
+	async return() {
+		if (this.#ended) return DONE$1;
+		this.#first = void 0;
+		this.#end(this.#partial ? "partial" : "success", void 0);
+		const reading = this.#reading > 0;
+		try {
+			const returned = Promise.resolve(this.#init.source.return?.());
+			if (reading) returned.catch(noop);
+			else await returned;
+		} catch {}
+		return DONE$1;
+	}
+	throw() {
+		return this.return();
+	}
+	[Symbol.asyncIterator]() {
+		return this;
+	}
+	#end(outcome, errors) {
+		if (this.#ended) return;
+		this.#ended = true;
+		if (this.#onAbort !== void 0) this.#init.signal?.removeEventListener("abort", this.#onAbort);
+		this.#init.onEnd(outcome, errors);
+	}
+};
+function asError(error) {
+	return error instanceof Error ? error : new Error(String(error));
+}
+function errorMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+// src/options.ts
+const KEYS = /* @__PURE__ */ new Set([
+	"path",
+	"http",
+	"guards",
+	"errorMappers",
+	"exposeErrors",
+	"introspection",
+	"graphiql",
+	"limits",
+	"documentCache",
+	"subscriptions",
+	"pubsub",
+	"enforcement"
+]);
+const PATH = /^\/[A-Za-z0-9\-._~!$&'()*+,;=:@/]*$/;
+const LIMIT_DEFAULTS = {
+	maxTokens: 2e3,
+	maxDepth: 12,
+	maxAliases: 30,
+	maxDirectives: 50
+};
+function show$1(value) {
+	if (typeof value === "function") return "a function";
+	try {
+		return JSON.stringify(value) ?? String(value);
+	} catch {
+		return typeof value;
+	}
+}
+/** ZNIGHT066 for an invalid option. */
+function invalidOption(name, expected, received) {
+	return new ZnightError(ErrorCode.InvalidGraphQLSetup, `GraphQLPlugin: invalid option ${name}: expected ${expected} (received ${show$1(received)})`, { hints: ["See the options of GraphQLPlugin.configure() (RFC 0005 §5.11)"] });
+}
+function isRecord$1(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function boolean(name, value, fallback) {
+	if (value === void 0) return fallback;
+	if (typeof value !== "boolean") throw invalidOption(name, "a boolean", value);
+	return value;
+}
+function positiveInteger(name, value, fallback) {
+	if (value === void 0) return fallback;
+	if (!(Number.isSafeInteger(value) && value >= 1)) throw invalidOption(name, "a positive integer", value);
+	return value;
+}
+function limit(name, value) {
+	if (value === false) return void 0;
+	return positiveInteger(`limits.${name}`, value, LIMIT_DEFAULTS[name]);
+}
+/** Refs given as classes or instances with `method`. */
+function refs(name, value, method) {
+	if (value === void 0) return [];
+	if (!Array.isArray(value)) throw invalidOption(name, `an array of classes or objects with a ${method}() method`, value);
+	for (const ref of value) if (!(typeof ref === "function" || ref !== null && typeof ref === "object" && typeof ref[method] === "function")) throw invalidOption(name, `classes or objects with a ${method}() method`, ref);
+	return value;
+}
+/** Validates the options and applies the defaults (`env`: `process.env`). */
+function resolveGraphQLOptions(options, env = process.env) {
+	if (!isRecord$1(options)) throw invalidOption("options", "an object", options);
+	for (const key of Object.keys(options)) if (!KEYS.has(key)) throw invalidOption(key, `one of ${[...KEYS].join(", ")}`, key);
+	const nodeEnv = env["NODE_ENV"];
+	const path = options["path"] ?? "/graphql";
+	if (typeof path !== "string" || !PATH.test(path)) throw invalidOption("path", "a path starting with '/'", path);
+	const rawHttp = options["http"] ?? {};
+	let http;
+	if (rawHttp === false) http = false;
+	else {
+		if (!isRecord$1(rawHttp)) throw invalidOption("http", "false or { meta?, guards?, bodyLimit?, get? }", rawHttp);
+		const meta = rawHttp["meta"] ?? [];
+		if (!Array.isArray(meta) || !meta.every((entry) => isRecord$1(entry) && typeof entry["key"] === "string" && entry["key"] !== "")) throw invalidOption("http.meta", "an array of route metadata entries (Decorator.meta())", meta);
+		const bodyLimit = rawHttp["bodyLimit"] ?? "100kb";
+		if (parseByteSize(bodyLimit) === void 0) throw invalidOption("http.bodyLimit", "a byte size ('100kb', 1048576)", bodyLimit);
+		http = {
+			meta,
+			guards: refs("http.guards", rawHttp["guards"], "canActivate"),
+			bodyLimit,
+			get: boolean("http.get", rawHttp["get"], true)
+		};
+	}
+	const rawLimits = options["limits"] ?? {};
+	if (!isRecord$1(rawLimits)) throw invalidOption("limits", "{ maxTokens?, maxDepth?, maxAliases?, maxDirectives? }", rawLimits);
+	for (const key of Object.keys(rawLimits)) if (!(key in LIMIT_DEFAULTS)) throw invalidOption(`limits.${key}`, "maxTokens, maxDepth, maxAliases or maxDirectives", key);
+	const documentCache = options["documentCache"] ?? 1e3;
+	if (!(Number.isSafeInteger(documentCache) && documentCache >= 0)) throw invalidOption("documentCache", "a non-negative integer", documentCache);
+	const rawSubscriptions = options["subscriptions"] ?? {};
+	let subscriptions;
+	let bufferSize = 100;
+	if (rawSubscriptions === false) subscriptions = false;
+	else {
+		if (!isRecord$1(rawSubscriptions)) throw invalidOption("subscriptions", "false or { maxActive?, bufferSize?, heartbeat?, maxDuration? }", rawSubscriptions);
+		bufferSize = positiveInteger("subscriptions.bufferSize", rawSubscriptions["bufferSize"], 100);
+		const heartbeat = rawSubscriptions["heartbeat"];
+		if (heartbeat !== void 0 && heartbeat !== false && !(typeof heartbeat === "number" && heartbeat > 0)) throw invalidOption("subscriptions.heartbeat", "a positive number of milliseconds or false", heartbeat);
+		const maxDuration = rawSubscriptions["maxDuration"];
+		if (maxDuration !== void 0 && !(typeof maxDuration === "number" && maxDuration > 0)) throw invalidOption("subscriptions.maxDuration", "a positive number of milliseconds", maxDuration);
+		subscriptions = {
+			maxActive: positiveInteger("subscriptions.maxActive", rawSubscriptions["maxActive"], 1e4),
+			bufferSize,
+			heartbeat,
+			maxDuration
+		};
+	}
+	const pubsub = options["pubsub"];
+	if (pubsub !== void 0 && !(isRecord$1(pubsub) && typeof pubsub.publish === "function" && typeof pubsub.subscribe === "function")) throw invalidOption("pubsub", "a PubSub (publish() and subscribe() methods)", pubsub);
+	const enforcement = options["enforcement"] ?? "error";
+	if (enforcement !== "error" && enforcement !== "warn") throw invalidOption("enforcement", "'error' or 'warn'", enforcement);
+	return {
+		path,
+		http,
+		guards: refs("guards", options["guards"], "canResolve"),
+		errorMappers: refs("errorMappers", options["errorMappers"], "map"),
+		exposeErrors: boolean("exposeErrors", options["exposeErrors"], false),
+		introspection: boolean("introspection", options["introspection"], nodeEnv !== "production"),
+		graphiql: boolean("graphiql", options["graphiql"], nodeEnv === "development"),
+		limits: {
+			maxTokens: limit("maxTokens", rawLimits["maxTokens"]),
+			maxDepth: limit("maxDepth", rawLimits["maxDepth"]),
+			maxAliases: limit("maxAliases", rawLimits["maxAliases"]),
+			maxDirectives: limit("maxDirectives", rawLimits["maxDirectives"])
+		},
+		documentCache,
+		subscriptions,
+		bufferSize,
+		pubsub,
+		enforcement
+	};
+}
+// src/pipeline.ts
+/** Whether global guards run on a field: root fields always, field resolvers when they carry metadata (§5.9). */
+function globalGuardsApply(binding) {
+	return binding.operation !== "field" || Object.keys(binding.meta).length > 0;
+}
+/** The {@link FieldFunctionsFactory} of the plugin. */
+function pipelineFactory(options) {
+	const normalizers = new NormalizerBuilder(options.inputs);
+	return (binding, coordinate, field, parent) => fieldFunctions(options, normalizers, binding, coordinate, field, parent);
+}
+function fieldFunctions(options, normalizers, binding, coordinate, field, parent) {
+	const container = options.container;
+	const invoke = binding.invoke;
+	const target = options.resolver(binding, coordinate);
+	const guards = [...globalGuardsApply(binding) ? options.globalGuards : [], ...binding.guards.map((token) => options.guard(token, coordinate))];
+	const normalize = field.args === void 0 ? void 0 : normalizers.args(field.args);
+	let resolve;
+	if (guards.length === 0) {
+		if (target.token === void 0) {
+			const instance = target.instance;
+			resolve = normalize === void 0 ? (p, a, c, i) => invoke(instance, p, a, c, i) : (p, a, c, i) => {
+				normalize(a);
+				return invoke(instance, p, a, c, i);
+			};
+		} else {
+			const token = target.token;
+			resolve = normalize === void 0 ? (p, a, c, i) => invoke(container.get(token), p, a, c, i) : (p, a, c, i) => {
+				normalize(a);
+				return invoke(container.get(token), p, a, c, i);
+			};
+		}
+	} else {
+		const route = Object.freeze({
+			meta: binding.meta,
+			coordinate
+		});
+		const parentType = parent.name;
+		const fieldName = field.name;
+		const forbidden = () => {
+			throw new GraphQLException(`Not allowed to resolve ${coordinate}`, { code: GraphQLErrorCode.Forbidden });
+		};
+		resolve = (p, a, c, i) => {
+			const operation = c;
+			const args = a;
+			const allowed = runGuards(container, guards, new FieldContext(route, operation, parentType, fieldName, args, p, i));
+			const call = () => {
+				if (normalize !== void 0) normalize(args);
+				return invoke(resolveIn(container, target), p, args, operation, i);
+			};
+			if (allowed === true) return call();
+			if (allowed === false) return forbidden();
+			return allowed.then((ok) => ok ? call() : forbidden());
+		};
+	}
+	if (binding.operation === "subscription") return {
+		subscribe: resolve,
+		resolve: identity$1
+	};
+	return { resolve };
+}
+function identity$1(payload) {
+	return payload;
+}
+/** Runs guards in order, synchronously until one returns a promise. */
+function runGuards(container, guards, ctx, start = 0) {
+	for (let index = start; index < guards.length; index++) {
+		const result = resolveIn(container, guards[index]).canResolve(ctx);
+		if (isThenable(result)) return Promise.resolve(result).then((ok) => ok ? runGuards(container, guards, ctx, index + 1) : false);
+		if (!result) return false;
+	}
+	return true;
+}
+/** What a guard receives (§5.9): a `RouteMetaCarrier` with the field's effective metadata. */
+var FieldContext = class {
+	route;
+	operation;
+	parentType;
+	field;
+	args;
+	parent;
+	info;
+	constructor(route, operation, parentType, field, args, parent, info) {
+		this.route = route;
+		this.operation = operation;
+		this.parentType = parentType;
+		this.field = field;
+		this.args = args;
+		this.parent = parent;
+		this.info = info;
+	}
+	get http() {
+		return this.operation.http;
+	}
+};
+/**
+* Builds normalisers (§7.3) at boot. Values are mutated in place: graphql-js creates the argument
+* object of every call and the coerced input objects, and the flags of an input type are the same
+* wherever it is used, so a value shared through a variable is normalised the same way twice.
+*/
+var NormalizerBuilder = class {
+	#inputs;
+	/** Input type → its normaliser (`null`: nothing to do), `PENDING` while being built (cycles). */
+	#types = /* @__PURE__ */ new Map();
+	constructor(inputs) {
+		this.#inputs = inputs;
+	}
+	/** The normaliser of a field's arguments, `undefined` when no flag is reachable. */
+	args(args) {
+		const steps = this.#steps(args);
+		return steps === void 0 ? void 0 : (record) => applySteps(record, steps);
+	}
+	#steps(values) {
+		const steps = [];
+		for (const value of values) {
+			const own = value.nullAsUndefined === true;
+			const ref = parseTypeRef(value.type);
+			const nested = ref === void 0 ? void 0 : this.#value(ref);
+			if (own || nested !== void 0) steps.push({
+				name: value.name,
+				own,
+				nested
+			});
+		}
+		return steps.length === 0 ? void 0 : steps;
+	}
+	#value(ref) {
+		if (ref.kind === "list") {
+			const item = this.#value(ref.of);
+			return item === void 0 ? void 0 : (value) => {
+				if (Array.isArray(value)) for (const entry of value) item(entry);
+			};
+		}
+		return this.#input(ref.name);
+	}
+	#input(name) {
+		const known = this.#types.get(name);
+		if (known === PENDING) return (value) => {
+			const normalize = this.#types.get(name);
+			if (typeof normalize === "function") normalize(value);
+		};
+		if (known !== void 0) return known ?? void 0;
+		const type = this.#inputs.get(name);
+		if (type === void 0) return void 0;
+		this.#types.set(name, PENDING);
+		const steps = this.#steps(type.fields);
+		const normalize = steps === void 0 ? null : (value) => applySteps(value, steps);
+		this.#types.set(name, normalize);
+		return normalize ?? void 0;
+	}
+};
+const PENDING = Symbol("pending");
+function applySteps(value, steps) {
+	if (value === null || typeof value !== "object") return;
+	const record = value;
+	for (const step of steps) {
+		const entry = record[step.name];
+		if (entry === null) {
+			if (step.own) record[step.name] = void 0;
+		} else if (entry !== void 0 && step.nested !== void 0) step.nested(entry);
+	}
+}
+// src/scalars.ts
+/** RFC 3339 date-time with a mandatory offset (`2026-11-02T10:00:00Z`, `...+01:00`). */
+const DATE_TIME = /^(\d{4})-(0[1-9]|1[0-2])-(0[1-9]|[12]\d|3[01])[Tt]([01]\d|2[0-3]):([0-5]\d):([0-5]\d|60)(\.\d+)?([Zz]|[+-]([01]\d|2[0-3]):[0-5]\d)$/;
+/** An integer in decimal notation (`BigInt` on the wire). */
+const DECIMAL_INTEGER = /^-?\d+$/;
+function describe(value) {
+	if (typeof value === "string") return JSON.stringify(value);
+	if (typeof value === "bigint") return `${value}n`;
+	if (value === null || typeof value !== "object") return String(value);
+	return Array.isArray(value) ? "a list" : "an object";
+}
+function parseDateTime(value) {
+	if (typeof value === "string" && DATE_TIME.test(value)) {
+		const date = new Date(value);
+		if (!Number.isNaN(date.getTime())) return date;
+	}
+	throw new TypeError(`DateTime cannot represent ${describe(value)}: expected an RFC 3339 date-time with an offset`);
+}
+function serializeDateTime(value) {
+	if (value instanceof Date) {
+		if (Number.isNaN(value.getTime())) throw new TypeError("DateTime cannot represent an invalid Date");
+		return value.toISOString();
+	}
+	if (typeof value === "string" && DATE_TIME.test(value) && !Number.isNaN(Date.parse(value))) return value;
+	throw new TypeError(`DateTime cannot represent ${describe(value)}: expected a Date`);
+}
+function parseBigInt(value) {
+	if (typeof value === "string" && DECIMAL_INTEGER.test(value)) return BigInt(value);
+	if (typeof value === "number" && Number.isSafeInteger(value)) return BigInt(value);
+	throw new TypeError(`BigInt cannot represent ${describe(value)}: expected an integer as a decimal string`);
+}
+function serializeBigInt(value) {
+	if (typeof value === "bigint") return value.toString();
+	if (typeof value === "number" && Number.isSafeInteger(value)) return String(value);
+	if (typeof value === "string" && DECIMAL_INTEGER.test(value)) return value;
+	throw new TypeError(`BigInt cannot represent ${describe(value)}: expected a bigint`);
+}
+function identity(value) {
+	return value;
+}
+function specifiedBy(name) {
+	const url = BUILTIN_SCALARS.get(name)?.specifiedByURL;
+	return url === void 0 ? {} : { specifiedByURL: url };
+}
+function createBuiltin(name) {
+	switch (name) {
+		case "DateTime": return new GraphQLScalarType({
+			name,
+			...specifiedBy(name),
+			coerceOutputValue: serializeDateTime,
+			coerceInputValue: parseDateTime,
+			coerceInputLiteral: (node) => parseDateTime(node.kind === Kind.STRING ? node.value : node)
+		});
+		case "BigInt": return new GraphQLScalarType({
+			name,
+			...specifiedBy(name),
+			coerceOutputValue: serializeBigInt,
+			coerceInputValue: parseBigInt,
+			coerceInputLiteral: (node) => parseBigInt(node.kind === Kind.STRING || node.kind === Kind.INT ? node.value : node)
+		});
+		case "JSON": return new GraphQLScalarType({
+			name,
+			...specifiedBy(name),
+			coerceOutputValue: identity,
+			coerceInputValue: identity,
+			coerceInputLiteral: (node) => valueFromASTUntyped(node)
+		});
+		default: return;
+	}
+}
+/** Built-in scalars, created on first use and shared by every schema (they hold no state). */
+const builtins = /* @__PURE__ */ new Map();
+/** The built-in scalar `name` (`DateTime`, `BigInt`, `JSON`), `undefined` for another name. */
+function builtinScalar(name) {
+	let scalar = builtins.get(name);
+	if (scalar === void 0) {
+		scalar = createBuiltin(name);
+		if (scalar !== void 0) builtins.set(name, scalar);
+	}
+	return scalar;
+}
+/**
+* The graphql-js scalar of a {@link ScalarDefinition}: `serialize` → `coerceOutputValue`,
+* `parseValue` → `coerceInputValue`, `parseLiteral` → `coerceInputLiteral` (default: `parseValue`
+* of the literal's JSON value). The definition's methods are called on the definition.
+*/
+function definitionScalar(name, definition) {
+	const parseLiteral = definition.parseLiteral;
+	return new GraphQLScalarType({
+		name,
+		...definition.description === void 0 ? {} : { description: definition.description },
+		...definition.specifiedByURL === void 0 ? {} : { specifiedByURL: definition.specifiedByURL },
+		coerceOutputValue: (value) => definition.serialize(value),
+		coerceInputValue: (value) => definition.parseValue(value),
+		coerceInputLiteral: parseLiteral === void 0 ? (node) => definition.parseValue(valueFromASTUntyped(node)) : (node) => parseLiteral.call(definition, node)
+	});
+}
+// src/schema.ts
+/** The graphql section of the metadata, or ZNIGHT066 when the application has none. */
+function graphqlSection(metadata) {
+	const section = metadata.extensions?.graphql;
+	if (section === void 0) throw new ZnightError(ErrorCode.InvalidGraphQLSetup, "GraphQLPlugin: the metadata has no GraphQL schema (metadata.extensions.graphql)", { hints: ["Declare at least one @Resolver() class with a @Query() method", "Regenerate the metadata (znight generate) when resolvers exist"] });
+	return section;
+}
+const OPERATIONS = /* @__PURE__ */ new Set([
+	"query",
+	"mutation",
+	"subscription",
+	"field"
+]);
+const INPUT_KINDS = /* @__PURE__ */ new Set([
+	"input",
+	"enum",
+	"scalar"
+]);
+const OUTPUT_KINDS = /* @__PURE__ */ new Set([
+	"object",
+	"enum",
+	"scalar",
+	"union"
+]);
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function show(value) {
+	if (typeof value === "function") return "a function";
+	try {
+		return JSON.stringify(value) ?? String(value);
+	} catch {
+		return typeof value;
+	}
+}
+/**
+* The structural problems of a graphql section (empty when it can be built): version, roots,
+* names, kinds, type references, resolver bindings, discriminators, scalars and groups.
+*/
+function checkGraphQLSection(section) {
+	const problems = [];
+	if (!isRecord(section)) return [`expected an object (received ${show(section)})`];
+	if (section["version"] !== 1) {
+		problems.push(`unsupported version ${show(section["version"])}: this @znight/graphql reads version 1 (rebuild the application with the same @znight/graphql version)`);
+		return problems;
+	}
+	if (typeof section["schemaHash"] !== "string") problems.push("schemaHash must be a string");
+	const types = section["types"];
+	if (!Array.isArray(types)) {
+		problems.push("types must be an array");
+		return problems;
+	}
+	const kinds = /* @__PURE__ */ new Map();
+	for (const [index, type] of types.entries()) {
+		if (!isRecord(type) || typeof type["name"] !== "string" || typeof type["kind"] !== "string") {
+			problems.push(`types[${index}] must be { kind, name, ... } (received ${show(type)})`);
+			continue;
+		}
+		const name = type["name"];
+		if (!isGraphQLName(name)) problems.push(`invalid type name ${show(name)}`);
+		else if (SPECIFIED_SCALARS.has(name)) problems.push(`the specified scalar ${name} must not be declared`);
+		else if (kinds.has(name)) problems.push(`the type ${name} is declared twice`);
+		kinds.set(name, type["kind"]);
+	}
+	const kindOf = (name) => SPECIFIED_SCALARS.has(name) ? "scalar" : kinds.get(name);
+	const checkRef = (where, text, allowed, position) => {
+		const ref = typeof text === "string" ? parseTypeRef(text) : void 0;
+		if (ref === void 0) {
+			problems.push(`${where}: invalid type reference ${show(text)}`);
+			return;
+		}
+		let named = ref;
+		while (named.kind === "list") named = named.of;
+		const kind = kindOf(named.name);
+		if (kind === void 0) problems.push(`${where}: unknown type ${named.name}`);
+		else if (!allowed.has(kind)) problems.push(`${where}: ${named.name} (${kind}) cannot be used as an ${position} type`);
+	};
+	const checkInputValues = (where, values, required) => {
+		if (!Array.isArray(values) || required && values.length === 0) {
+			problems.push(`${where} must be a ${required ? "non-empty " : ""}array`);
+			return;
+		}
+		const seen = /* @__PURE__ */ new Set();
+		for (const value of values) {
+			if (!isRecord(value) || typeof value["name"] !== "string") {
+				problems.push(`${where}: expected { name, type } (received ${show(value)})`);
+				continue;
+			}
+			const name = value["name"];
+			if (!isGraphQLName(name)) problems.push(`${where}: invalid name ${show(name)}`);
+			if (seen.has(name)) problems.push(`${where}: ${name} is declared twice`);
+			seen.add(name);
+			checkRef(`${where}.${name}`, value["type"], INPUT_KINDS, "input");
+		}
+	};
+	for (const type of types) {
+		if (!isRecord(type) || typeof type["name"] !== "string") continue;
+		const name = type["name"];
+		switch (type["kind"]) {
+			case "object": {
+				const fields = type["fields"];
+				if (!Array.isArray(fields) || fields.length === 0) {
+					problems.push(`${name}: fields must be a non-empty array`);
+					break;
+				}
+				const seen = /* @__PURE__ */ new Set();
+				for (const field of fields) {
+					if (!isRecord(field) || typeof field["name"] !== "string") {
+						problems.push(`${name}: expected fields { name, type } (received ${show(field)})`);
+						continue;
+					}
+					const coordinate = `${name}.${field["name"]}`;
+					if (!isGraphQLName(field["name"])) problems.push(`${name}: invalid field name ${show(field["name"])}`);
+					if (seen.has(field["name"])) problems.push(`${coordinate} is declared twice`);
+					seen.add(field["name"]);
+					checkRef(coordinate, field["type"], OUTPUT_KINDS, "output");
+					if (field["args"] !== void 0) checkInputValues(`${coordinate} arguments`, field["args"], false);
+					if (field["resolver"] !== void 0) checkBinding(coordinate, field["resolver"], problems);
+				}
+				break;
+			}
+			case "input":
+				checkInputValues(`${name} fields`, type["fields"], true);
+				break;
+			case "enum": {
+				const values = type["values"];
+				if (!Array.isArray(values) || values.length === 0) {
+					problems.push(`${name}: values must be a non-empty array`);
+					break;
+				}
+				const seen = /* @__PURE__ */ new Set();
+				for (const value of values) {
+					const valueName = isRecord(value) ? value["name"] : void 0;
+					if (!isRecord(value) || typeof valueName !== "string" || !isGraphQLName(valueName) || RESERVED_ENUM_VALUES.has(valueName) || typeof value["value"] !== "string" && typeof value["value"] !== "number") {
+						problems.push(`${name}: invalid enum value ${show(value)} (expected { name, value: string | number })`);
+						continue;
+					}
+					if (seen.has(valueName)) problems.push(`${name}.${valueName} is declared twice`);
+					seen.add(valueName);
+				}
+				break;
+			}
+			case "union": {
+				const members = type["members"];
+				if (!Array.isArray(members) || members.length === 0) {
+					problems.push(`${name}: members must be a non-empty array`);
+					break;
+				}
+				for (const member of members) if (typeof member !== "string" || kinds.get(member) !== "object") problems.push(`${name}: the member ${show(member)} is not an object type`);
+				checkDiscriminator(name, type["discriminator"], members, problems);
+				break;
+			}
+			case "scalar":
+				if (type["builtin"] === true) {
+					if (!BUILTIN_SCALARS.has(name)) problems.push(`${name} is not a built-in scalar (${[...BUILTIN_SCALARS.keys()].join(", ")})`);
+				} else {
+					const scalar = type["scalar"];
+					if (scalar instanceof GraphQLScalarType) {
+						if (scalar.name !== name) problems.push(`the scalar ${name} is implemented by the graphql-js scalar ${scalar.name} (names must match)`);
+					} else if (!isRecord(scalar) || typeof scalar["serialize"] !== "function" || typeof scalar["parseValue"] !== "function" || scalar["parseLiteral"] !== void 0 && typeof scalar["parseLiteral"] !== "function") problems.push(`the scalar ${name} needs a definition { serialize, parseValue, parseLiteral? } or a GraphQLScalarType (received ${show(scalar)})`);
+				}
+				break;
+			default: problems.push(`${name}: unknown kind ${show(type["kind"])}`);
+		}
+	}
+	checkRoots(section["roots"], kinds, types, problems);
+	checkGroups(section["groups"], problems);
+	return problems;
+}
+function checkBinding(coordinate, binding, problems) {
+	if (!isRecord(binding)) {
+		problems.push(`${coordinate}: resolver must be an object (received ${show(binding)})`);
+		return;
+	}
+	const invalid = [];
+	if (typeof binding["token"] !== "string" || binding["token"] === "") invalid.push("token");
+	if (typeof binding["method"] !== "string") invalid.push("method");
+	if (typeof binding["operation"] !== "string" || !OPERATIONS.has(binding["operation"])) invalid.push("operation");
+	const guards = binding["guards"];
+	if (!Array.isArray(guards) || !guards.every((guard) => typeof guard === "string" && guard !== "")) invalid.push("guards");
+	if (!isRecord(binding["meta"])) invalid.push("meta");
+	if (typeof binding["invoke"] !== "function") invalid.push("invoke");
+	if (invalid.length > 0) problems.push(`${coordinate}: invalid resolver binding (${invalid.join(", ")})`);
+}
+function checkDiscriminator(name, discriminator, members, problems) {
+	const memberSet = new Set(members);
+	if (!isRecord(discriminator)) {
+		problems.push(`${name}: discriminator must be an object (received ${show(discriminator)})`);
+		return;
+	}
+	switch (discriminator["by"]) {
+		case "typename": return;
+		case "property": {
+			const values = discriminator["values"];
+			if (typeof discriminator["property"] !== "string" || !isRecord(values)) {
+				problems.push(`${name}: a property discriminator needs { property, values }`);
+				return;
+			}
+			for (const member of Object.values(values)) if (!memberSet.has(member)) problems.push(`${name}: the discriminator names ${show(member)}, not a member`);
+			return;
+		}
+		case "class": {
+			const classes = discriminator["classes"];
+			if (!Array.isArray(classes)) {
+				problems.push(`${name}: a class discriminator needs classes: [Class, member][]`);
+				return;
+			}
+			for (const entry of classes) if (!Array.isArray(entry) || typeof entry[0] !== "function" || !memberSet.has(entry[1])) problems.push(`${name}: invalid class discriminator entry ${show(entry)} (expected [Class, member])`);
+			return;
+		}
+		default: problems.push(`${name}: unknown discriminator ${show(discriminator["by"])}`);
+	}
+}
+function checkRoots(roots, kinds, types, problems) {
+	if (!isRecord(roots) || typeof roots["query"] !== "string") {
+		problems.push(`roots must be { query, mutation?, subscription? } (received ${show(roots)})`);
+		return;
+	}
+	for (const operation of [
+		"query",
+		"mutation",
+		"subscription"
+	]) {
+		const root = roots[operation];
+		if (root === void 0) continue;
+		if (typeof root !== "string" || kinds.get(root) !== "object") problems.push(`the ${operation} root ${show(root)} is not an object type`);
+	}
+	const subscription = roots["subscription"];
+	if (typeof subscription !== "string") return;
+	for (const type of types) {
+		if (!isRecord(type) || type["name"] !== subscription || !Array.isArray(type["fields"])) continue;
+		for (const field of type["fields"]) {
+			if (!isRecord(field)) continue;
+			const binding = field["resolver"];
+			if (!isRecord(binding) || binding["operation"] !== "subscription") problems.push(`${subscription}.${show(field["name"])} needs a subscription resolver (its source event stream)`);
+		}
+	}
+}
+function checkGroups(groups, problems) {
+	if (groups === void 0) return;
+	if (!isRecord(groups)) {
+		problems.push(`groups must be an object (received ${show(groups)})`);
+		return;
+	}
+	for (const [group, entry] of Object.entries(groups)) {
+		const keys = isRecord(entry) ? entry["keys"] : void 0;
+		if (!isRecord(entry) || !Array.isArray(keys) || keys.length === 0 || !keys.every((key) => typeof key === "string" && key !== "") || typeof entry["required"] !== "boolean") problems.push(`group ${show(group)} must be { keys: [non-empty strings], required: boolean }`);
+	}
+}
+/** Throws one ZNIGHT066 error listing `problems`. */
+function invalidSchema(problems) {
+	throw new ZnightError(ErrorCode.InvalidGraphQLSetup, `GraphQLPlugin: invalid GraphQL schema (metadata.extensions.graphql), ${problems.length} ${problems.length === 1 ? "problem" : "problems"}:\n${problems.map((problem) => `  - ${problem}`).join("\n")}`, { hints: ["Regenerate the metadata with the @znight/graphql version the application runs (znight generate)", "Hand-written metadata must follow GraphQLMetadata (@znight/graphql, RFC 0005 §7.1)"] });
+}
+/** A union's `resolveType`, from its discriminator: data read once, at boot. */
+function typeResolver(discriminator) {
+	switch (discriminator.by) {
+		case "property": {
+			const property = discriminator.property;
+			const values = new Map(Object.entries(discriminator.values));
+			return (value) => value !== null && typeof value === "object" ? values.get(String(value[property])) ?? typenameOf(value) : void 0;
+		}
+		case "class": {
+			const classes = discriminator.classes;
+			return (value) => {
+				for (const [cls, name] of classes) if (value instanceof cls) return name;
+				return typenameOf(value);
+			};
+		}
+		default: return typenameOf;
+	}
+}
+function typenameOf(value) {
+	if (value === null || typeof value !== "object") return void 0;
+	const name = value.__typename;
+	return typeof name === "string" ? name : void 0;
+}
+/**
+* Builds the schema of a section. `functions` decides the resolve functions of every
+* resolver-backed field; plain property fields keep the graphql-js default resolver.
+*
+* @throws ZnightError ZNIGHT066 listing every structural, construction and `validateSchema` problem.
+*/
+function buildGraphQLSchema(section, functions) {
+	const structural = checkGraphQLSection(section);
+	if (structural.length > 0) invalidSchema(structural);
+	const named = /* @__PURE__ */ new Map([
+		["String", GraphQLString],
+		["Int", GraphQLInt],
+		["Float", GraphQLFloat],
+		["Boolean", GraphQLBoolean],
+		["ID", GraphQLID]
+	]);
+	const problems = [];
+	const lookup = (name) => named.get(name);
+	const typeOf = (ref) => {
+		const inner = ref.kind === "named" ? lookup(ref.name) : new GraphQLList(typeOf(ref.of));
+		return ref.nonNull ? new GraphQLNonNull(inner) : inner;
+	};
+	const typeRef = (text) => typeOf(parseTypeRef(text));
+	const inputValue = (value) => ({
+		type: typeRef(value.type),
+		...value.description === void 0 ? {} : { description: value.description },
+		...value.deprecationReason === void 0 ? {} : { deprecationReason: value.deprecationReason },
+		...value.defaultValue === void 0 ? {} : { default: { value: value.defaultValue } }
+	});
+	const fieldConfig = (type, field) => {
+		const config = {
+			type: typeRef(field.type),
+			...field.description === void 0 ? {} : { description: field.description },
+			...field.deprecationReason === void 0 ? {} : { deprecationReason: field.deprecationReason },
+			...field.args === void 0 || field.args.length === 0 ? {} : { args: Object.fromEntries(field.args.map((arg) => [arg.name, inputValue(arg)])) }
+		};
+		if (field.resolver === void 0) return config;
+		const resolved = functions(field.resolver, `${type.name}.${field.name}`, field, type);
+		return {
+			...config,
+			...resolved.resolve === void 0 ? {} : { resolve: resolved.resolve },
+			...resolved.subscribe === void 0 ? {} : { subscribe: resolved.subscribe }
+		};
+	};
+	try {
+		for (const type of section.types) named.set(type.name, createType(type, fieldConfig, inputValue, lookup));
+	} catch (error) {
+		invalidSchema([`cannot build the schema: ${error instanceof Error ? error.message : String(error)}`]);
+	}
+	const root = (name) => name === void 0 ? void 0 : lookup(name);
+	let schema;
+	try {
+		schema = new GraphQLSchema({
+			query: root(section.roots.query),
+			mutation: root(section.roots.mutation),
+			subscription: root(section.roots.subscription),
+			types: section.types.map((type) => lookup(type.name))
+		});
+		for (const error of validateSchema(schema)) problems.push(error.message);
+	} catch (error) {
+		if (error instanceof ZnightError) throw error;
+		problems.push(error instanceof Error ? error.message : String(error));
+	}
+	if (problems.length > 0 || schema === void 0) invalidSchema(problems);
+	return schema;
+}
+function createType(type, fieldConfig, inputValue, lookup) {
+	const description = "description" in type && type.description !== void 0 ? { description: type.description } : {};
+	switch (type.kind) {
+		case "object": return new GraphQLObjectType({
+			name: type.name,
+			...description,
+			fields: () => Object.fromEntries(type.fields.map((field) => [field.name, fieldConfig(type, field)]))
+		});
+		case "input": return new GraphQLInputObjectType({
+			name: type.name,
+			...description,
+			fields: () => Object.fromEntries(type.fields.map((field) => [field.name, inputValue(field)]))
+		});
+		case "enum": return new GraphQLEnumType({
+			name: type.name,
+			...description,
+			values: Object.fromEntries(type.values.map((value) => [value.name, {
+				value: value.value,
+				...value.description === void 0 ? {} : { description: value.description },
+				...value.deprecationReason === void 0 ? {} : { deprecationReason: value.deprecationReason }
+			}]))
+		});
+		case "union": return new GraphQLUnionType({
+			name: type.name,
+			...description,
+			types: () => type.members.map((member) => lookup(member)),
+			resolveType: typeResolver(type.discriminator)
+		});
+		default: {
+			if ("builtin" in type) return builtinScalar(type.name);
+			const scalar = type.scalar;
+			return scalar instanceof GraphQLScalarType ? scalar : definitionScalar(type.name, scalar);
+		}
+	}
+}
+// src/transport/abort.ts
+/** The stand-in passed as graphql-js `abortSignal` by the HTTP transport (one per request). */
+var DeferredAbort = class {
+	aborted = false;
+	reason = void 0;
+	/** graphql-js registers one listener per execution; more are kept in {@link #others}. */
+	#listener = void 0;
+	#others = void 0;
+	throwIfAborted() {
+		if (this.aborted) throw this.reason;
+	}
+	addEventListener(type, listener) {
+		if (type !== "abort") return;
+		if (this.#listener === void 0) {
+			this.#listener = listener;
+			return;
+		}
+		this.#others ??= [];
+		this.#others.push(listener);
+	}
+	removeEventListener(type, listener) {
+		if (type !== "abort") return;
+		if (this.#listener === listener) {
+			this.#listener = void 0;
+			return;
+		}
+		const others = this.#others;
+		const index = others === void 0 ? -1 : others.indexOf(listener);
+		if (index !== -1) others?.splice(index, 1);
+	}
+	/**
+	* The execution is asynchronous: from now on, `signal` aborting aborts the execution. Reads the
+	* signal only when graphql-js still listens (a pending execution).
+	*/
+	follow(read) {
+		if (this.#listener === void 0 && (this.#others === void 0 || this.#others.length === 0)) return;
+		const signal = read();
+		if (signal.aborted) {
+			this.#abort(signal.reason);
+			return;
+		}
+		signal.addEventListener("abort", () => this.#abort(signal.reason), { once: true });
+	}
+	/** This stand-in, typed as the `AbortSignal` graphql-js expects. */
+	asSignal() {
+		return this;
+	}
+	#abort(reason) {
+		if (this.aborted) return;
+		this.aborted = true;
+		this.reason = reason;
+		const listener = this.#listener;
+		const others = this.#others;
+		this.#listener = void 0;
+		this.#others = void 0;
+		listener?.();
+		if (others !== void 0) for (const other of others) other();
+	}
+};
+// src/transport/accept.ts
+/**
+* Content negotiation of the GraphQL endpoint (RFC 0005 §8.3): which of the media types the
+* endpoint produces a request accepts best. Import-free.
+*
+* `application/json` is the only type matched by wildcards (`*\/*`, `application/*`): the
+* GraphQL-over-HTTP draft asks for `application/json` when the client accepts anything, and the
+* other types change the protocol (`application/graphql-response+json` statuses, an event stream,
+* the GraphiQL page), so they are chosen only when listed. Among types of equal quality,
+* `application/graphql-response+json` wins, then `application/json`, then HTML (a browser listing
+* `text/html` first gets GraphiQL). An event stream is chosen only when it is strictly preferred, or
+* the only acceptable type: a client listing JSON and `text/event-stream` alike (urql, for
+* incremental delivery) gets its queries and mutations as one JSON body, and its subscriptions as
+* a stream ({@link STREAMABLE}).
+*/
+/** What a response is encoded as. */
+const Media = Object.freeze({
+	EventStream: 0,
+	GraphQLJson: 1,
+	Json: 2,
+	Html: 3,
+	None: 4
+});
+/** The media type names, by {@link Media} value (`None` excluded). */
+const NAMES = [
+	["text", "event-stream"],
+	["application", "graphql-response+json"],
+	["application", "json"],
+	["text", "html"]
+];
+/** The media ranges of an `accept` header (lower-case, without parameters other than `q`). */
+function parseRanges(header) {
+	const ranges = [];
+	for (const item of header.split(",")) {
+		const parts = item.split(";");
+		const media = parts[0].trim().toLowerCase();
+		const slash = media.indexOf("/");
+		if (slash <= 0 || slash === media.length - 1) continue;
+		let q = 1;
+		for (let index = 1; index < parts.length; index++) {
+			const parameter = parts[index].trim();
+			if (parameter.length < 2 || (parameter.charCodeAt(0) | 32) !== 113 || parameter[1] !== "=") continue;
+			const value = Number(parameter.slice(2));
+			if (value >= 0 && value <= 1) q = value;
+		}
+		ranges.push({
+			type: media.slice(0, slash),
+			subtype: media.slice(slash + 1),
+			q
+		});
+	}
+	return ranges;
+}
+/**
+* The quality of `type/subtype` in `ranges`: that of the most specific matching range (RFC 9110
+* §12.5.1), wildcards only when `wildcards` is set; 0 when nothing matches.
+*/
+function quality(ranges, type, subtype, wildcards) {
+	let best = -1;
+	let specificity = -1;
+	for (const range of ranges) {
+		let level;
+		if (range.type === type && range.subtype === subtype) level = 2;
+		else if (!wildcards) continue;
+		else if (range.type === type && range.subtype === "*") level = 1;
+		else if (range.type === "*" && range.subtype === "*") level = 0;
+		else continue;
+		if (level > specificity || level === specificity && range.q > best) {
+			specificity = level;
+			best = range.q;
+		}
+	}
+	return best < 0 ? 0 : best;
+}
+/**
+* Chooses the media type of a response among `produced` (a bit mask of `1 << Media.X`), per
+* `accept` (`undefined`: no header, i.e. `application/json`): a {@link MediaKind}, plus
+* {@link STREAMABLE} when a JSON type wins and an event stream is acceptable too.
+*/
+function negotiate(accept, produced) {
+	if (accept === void 0) return produced & 1 << Media.Json ? Media.Json : Media.None;
+	const ranges = parseRanges(accept);
+	if (ranges.length === 0) return produced & 1 << Media.Json ? Media.Json : Media.None;
+	let chosen = Media.None;
+	let best = 0;
+	for (let media = Media.GraphQLJson; media < NAMES.length; media++) {
+		if ((produced & 1 << media) === 0) continue;
+		const [type, subtype] = NAMES[media];
+		const q = quality(ranges, type, subtype, media === Media.Json);
+		if (q > best) {
+			best = q;
+			chosen = media;
+		}
+	}
+	if (produced & 1 << Media.EventStream) {
+		const q = quality(ranges, "text", "event-stream", false);
+		if (q > best) return Media.EventStream;
+		if (q > 0 && (chosen === Media.GraphQLJson || chosen === Media.Json)) chosen |= 8;
+	}
+	return chosen;
+}
+const CACHE_MAX = 64;
+/**
+* {@link negotiate} for one route, memoised by header value: a server sees a handful of `accept`
+* values, so a request costs a map lookup. Bounded, since clients choose the values: cleared when
+* full.
+*/
+var Negotiator = class {
+	#produced;
+	#cache = /* @__PURE__ */ new Map();
+	/** The answer without `accept` header. */
+	#absent;
+	/** `produced`: a bit mask of `1 << Media.X`. */
+	constructor(produced) {
+		this.#produced = produced;
+		this.#absent = negotiate(void 0, produced);
+	}
+	/** The {@link negotiate} answer: a {@link MediaKind}, possibly with {@link STREAMABLE}. */
+	choose(accept) {
+		if (accept === void 0) return this.#absent;
+		let media = this.#cache.get(accept);
+		if (media === void 0) {
+			media = negotiate(accept, this.#produced);
+			if (this.#cache.size === CACHE_MAX) this.#cache.clear();
+			this.#cache.set(accept, media);
+		}
+		return media;
+	}
+};
+// src/transport/graphiql.ts
+/**
+* The GraphiQL page (RFC 0005 §8.3, §8.9): served on `GET path` with `accept: text/html` when the
+* `graphiql` option is on (default: `NODE_ENV === 'development'`). React and GraphiQL load from a
+* pinned CDN with Subresource Integrity; the inline script is fixed at boot and allowed by hash in
+* the page's own `content-security-policy`, which overrides the strict API default of RFC 0001 on
+* this response only.
+*/
+/** jsDelivr. */
+const GRAPHIQL_CDN = "https://cdn.jsdelivr.net";
+/**
+* The assets of the page: GraphiQL 3 (the last major with a UMD build) on React 18. Bumped by hand,
+* with their SRI hashes (`sha384` of the files on the CDN).
+*/
+const GRAPHIQL_ASSETS = Object.freeze([
+	{
+		url: `${GRAPHIQL_CDN}/npm/graphiql@3.9.0/graphiql.min.css`,
+		integrity: "sha384-QMux00XgRtwRLSYIY3kw2rj1ovk5AuuliAchk+HSQbqdbGFnz9GYuqIlOqxhwCE2",
+		kind: "style"
+	},
+	{
+		url: `${GRAPHIQL_CDN}/npm/react@18.3.1/umd/react.production.min.js`,
+		integrity: "sha384-DGyLxAyjq0f9SPpVevD6IgztCFlnMF6oW/XQGmfe+IsZ8TqEiDrcHkMLKI6fiB/Z",
+		kind: "script"
+	},
+	{
+		url: `${GRAPHIQL_CDN}/npm/react-dom@18.3.1/umd/react-dom.production.min.js`,
+		integrity: "sha384-gTGxhz21lVGYNMcdJOyq01Edg0jhn/c22nsx0kyqP0TxaV5WVdsSH1fSDUf5YJj1",
+		kind: "script"
+	},
+	{
+		url: `${GRAPHIQL_CDN}/npm/graphiql@3.9.0/graphiql.min.js`,
+		integrity: "sha384-8NGfVj4CVlqHajlZj+bPJT4thxPMHMJYn7DWK2CvtopLd02E7qsPHazniBYvVjOO",
+		kind: "script"
+	}
+]);
+/** `<`, `>` and `&` escaped: JSON safe inside a `<script>` element. */
+function scriptJson(value) {
+	return JSON.stringify(value).replace(/</g, "\\u003c").replace(/>/g, "\\u003e").replace(/&/g, "\\u0026");
+}
+function escapeHtml(text) {
+	return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+/** The GraphiQL page of the endpoint `endpoint` (an absolute path, prefix included) and its CSP. */
+function renderGraphiQL(endpoint) {
+	const tags = GRAPHIQL_ASSETS.map((asset) => asset.kind === "style" ? `<link rel="stylesheet" href="${escapeHtml(asset.url)}" integrity="${asset.integrity}" crossorigin="anonymous">` : `<script src="${escapeHtml(asset.url)}" integrity="${asset.integrity}" crossorigin="anonymous"><\/script>`);
+	const inline = [`const fetcher = GraphiQL.createFetcher({ url: ${scriptJson(endpoint)} })`, `ReactDOM.createRoot(document.getElementById('graphiql')).render(React.createElement(GraphiQL, { fetcher }))`].join("\n");
+	const hash = `'sha256-${createHash("sha256").update(inline).digest("base64")}'`;
+	return {
+		html: [
+			"<!doctype html>",
+			"<html lang=\"en\">",
+			"<head>",
+			"<meta charset=\"utf-8\">",
+			"<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">",
+			"<title>GraphiQL</title>",
+			"<style>body { margin: 0; } #graphiql { height: 100dvh; }</style>",
+			...tags.filter((tag) => tag.startsWith("<link")),
+			"</head>",
+			"<body>",
+			"<div id=\"graphiql\">Loading GraphiQL…</div>",
+			...tags.filter((tag) => tag.startsWith("<script")),
+			`<script>${inline}<\/script>`,
+			"</body>",
+			"</html>",
+			""
+		].join("\n"),
+		csp: [
+			"default-src 'none'",
+			`script-src ${GRAPHIQL_CDN} ${hash}`,
+			`style-src 'unsafe-inline' ${GRAPHIQL_CDN}`,
+			`font-src data: ${GRAPHIQL_CDN}`,
+			"img-src 'self' data:",
+			"connect-src 'self'",
+			"base-uri 'none'",
+			"form-action 'none'",
+			"frame-ancestors 'self'"
+		].join("; ")
+	};
+}
+// src/transport/sse.ts
+/** The last event of a stream that ended normally. */
+const COMPLETE = Object.freeze({
+	event: "complete",
+	data: ""
+});
+const DONE = Object.freeze({
+	done: true,
+	value: void 0
+});
+/**
+* The event source of an operation: one `next` event per result, then `complete` when the
+* operation ended by itself. A stream ended by `ctx.signal` (client gone, shutdown, `maxDuration`)
+* gets no `complete`: GraphQL-over-SSE clients then treat it as a lost connection and retry.
+*/
+var ResultEvents = class {
+	#results;
+	#signal;
+	#done = false;
+	constructor(results, signal) {
+		this.#results = results;
+		this.#signal = signal;
+	}
+	async next() {
+		if (this.#done) return DONE;
+		const step = await this.#results.next();
+		if (step.done !== true) return {
+			done: false,
+			value: {
+				event: "next",
+				data: step.value
+			}
+		};
+		this.#done = true;
+		return this.#signal.aborted ? DONE : {
+			done: false,
+			value: COMPLETE
+		};
+	}
+	async return() {
+		this.#done = true;
+		await this.#results.return();
+		return DONE;
+	}
+	[Symbol.asyncIterator]() {
+		return this;
+	}
+};
+// src/transport/http.ts
+const JSON_TYPE = "application/json; charset=utf-8";
+const GRAPHQL_JSON_TYPE = "application/graphql-response+json; charset=utf-8";
+/** Response options of `application/graphql-response+json` replies, by status. */
+const GRAPHQL_JSON_200 = Object.freeze({
+	status: 200,
+	headers: Object.freeze({ "content-type": GRAPHQL_JSON_TYPE })
+});
+const GRAPHQL_JSON_400 = Object.freeze({
+	status: 400,
+	headers: Object.freeze({ "content-type": GRAPHQL_JSON_TYPE })
+});
+/** `application/json` is what the serialiser gives an object body: only the status is set. */
+const JSON_200 = Object.freeze({ status: 200 });
+const UTF8 = new TextDecoder("utf-8", { fatal: true });
+/** A request error before execution: `{ errors: [{ message, extensions: { code } }] }`. */
+function errorBody(message, code = GraphQLErrorCode.BadRequest) {
+	return { errors: [{
+		message,
+		extensions: { code }
+	}] };
+}
+/** A reply of `status` carrying a GraphQL error body in the negotiated JSON type (`application/json` before negotiation). */
+function errorReply(media, status, body, headers) {
+	const type = media === Media.GraphQLJson ? GRAPHQL_JSON_TYPE : JSON_TYPE;
+	return new HttpResponse(body, {
+		status,
+		headers: {
+			...headers,
+			"content-type": type
+		}
+	});
+}
+const NOT_ACCEPTABLE = errorReply(Media.Json, 406, errorBody("None of the accepted media types can be produced: accept application/graphql-response+json, application/json or text/event-stream"));
+const GET_NOT_ALLOWED = errorReply(Media.Json, 405, errorBody("GraphQL operations are sent with POST on this endpoint"), Object.freeze({ allow: "POST" }));
+/** `content-type` values of JSON bodies seen most often, compared before parsing. */
+function isJsonRequest(contentType) {
+	if (contentType === "application/json" || contentType === "application/json; charset=utf-8") return true;
+	const media = parseMediaType(contentType);
+	if (media === void 0 || media.type !== "application/json") return false;
+	return media.charset === void 0 || media.charset === "utf-8" || media.charset === "utf8";
+}
+/** Why the parameters of a request are invalid, `undefined` when they are valid. */
+function invalidParams(params) {
+	const query = params["query"];
+	if (typeof query !== "string") return query === void 0 || query === null ? "Missing query: send { query, variables?, operationName?, extensions? }" : "The query must be a string";
+	const operationName = params["operationName"];
+	if (operationName !== void 0 && operationName !== null && typeof operationName !== "string") return "operationName must be a string";
+	if (!isMapOrNull(params["variables"])) return "variables must be an object";
+	if (!isMapOrNull(params["extensions"])) return "extensions must be an object";
+}
+/** The parameters of a GraphQL `GET` request. */
+const GET_PARAMS = [
+	"query",
+	"operationName",
+	"variables",
+	"extensions"
+];
+/** A query string component decoded like `URLSearchParams` (`+` is a space); `undefined` when malformed. */
+function decodeComponent(text) {
+	if (text.indexOf("%") === -1 && text.indexOf("+") === -1) return text;
+	try {
+		return decodeURIComponent(text.replaceAll("+", " "));
+	} catch {
+		return;
+	}
+}
+/**
+* The GraphQL parameters of a request target, read directly: `ctx.query` builds a record of every
+* parameter through `URLSearchParams` (about 0.35 µs of a `GET` on Node.js, 0.15 µs on Bun, see
+* `test/bench/http.bench.ts`). A repeated parameter
+* becomes an array, like `ctx.query`. `undefined` when a component is malformed percent-encoding:
+* the caller falls back to `ctx.query` (which keeps such sequences as they are).
+*/
+function readGetParams(url) {
+	const params = {};
+	const mark = url.indexOf("?");
+	if (mark === -1) return params;
+	const length = url.length;
+	let start = mark + 1;
+	while (start < length) {
+		let end = url.indexOf("&", start);
+		if (end === -1) end = length;
+		if (end > start) {
+			let equals = url.indexOf("=", start);
+			if (equals === -1 || equals > end) equals = end;
+			const name = decodeComponent(url.slice(start, equals));
+			if (name === void 0) return void 0;
+			if (name === "query" || name === "operationName" || name === "variables" || name === "extensions") {
+				const value = equals === end ? "" : decodeComponent(url.slice(equals + 1, end));
+				if (value === void 0) return void 0;
+				const existing = params[name];
+				if (existing === void 0) params[name] = value;
+				else params[name] = typeof existing === "string" ? [existing, value] : [...existing, value];
+			}
+		}
+		start = end + 1;
+	}
+	return params;
+}
+function isMapOrNull(value) {
+	return value === void 0 || value === null || typeof value === "object" && !Array.isArray(value);
+}
+function isPromise$1(value) {
+	return typeof value?.then === "function";
+}
+/** The handlers of the GraphQL endpoint. */
+var HttpTransport = class {
+	#resolveExecutor;
+	#executor;
+	#getQueries;
+	#sse;
+	#post;
+	#get;
+	/** The GraphiQL page, `undefined` when disabled. */
+	#graphiql;
+	constructor(options) {
+		this.#resolveExecutor = options.executor;
+		this.#getQueries = options.get;
+		this.#sse = options.sse;
+		const json = 1 << Media.GraphQLJson | 1 << Media.Json | (options.sse === false ? 0 : 1 << Media.EventStream);
+		this.#post = new Negotiator(json);
+		this.#get = new Negotiator(options.graphiql ? json | 1 << Media.Html : json);
+		if (options.graphiql) {
+			const page = renderGraphiQL(options.endpoint);
+			this.#graphiql = new HttpResponse(new TextEncoder().encode(page.html), {
+				status: 200,
+				headers: {
+					"content-type": "text/html; charset=utf-8",
+					"content-security-policy": page.csp,
+					"cache-control": "no-store"
+				}
+			});
+		}
+	}
+	/** `POST path`. */
+	post = (ctx) => {
+		const headers = ctx.headers;
+		const negotiated = this.#post.choose(headers["accept"]);
+		const media = negotiated & 7;
+		if (media === Media.None) return NOT_ACCEPTABLE;
+		if (!isJsonRequest(headers["content-type"])) return errorReply(media, 415, errorBody("Send GraphQL requests as application/json (content-type: application/json)"));
+		const encoding = headers["content-encoding"];
+		if (encoding !== void 0 && encoding.trim().toLowerCase() !== "identity" && encoding.trim() !== "") return errorReply(media, 415, errorBody(`Unsupported content encoding "${encoding}"`));
+		return ctx.rawBody().then((bytes) => this.#posted(ctx, bytes, media, negotiated >= 8), (error) => transportError(error, media));
+	};
+	/** `GET path`. */
+	get = (ctx) => {
+		const media = this.#get.choose(ctx.headers["accept"]) & 7;
+		if (media === Media.Html) return this.#graphiql;
+		if (media === Media.None) return NOT_ACCEPTABLE;
+		if (!this.#getQueries) return GET_NOT_ALLOWED;
+		const params = readGetParams(ctx.url) ?? ctx.query;
+		const request = {};
+		for (const name of GET_PARAMS) {
+			const value = params[name];
+			if (value === void 0) continue;
+			if (typeof value !== "string") return errorReply(media, 400, errorBody(`Repeated ${name} parameter`));
+			if (name === "variables" || name === "extensions") try {
+				request[name] = JSON.parse(value);
+			} catch {
+				return errorReply(media, 400, errorBody(`The ${name} parameter must be JSON`));
+			}
+			else request[name] = value;
+		}
+		const invalid = invalidParams(request);
+		if (invalid !== void 0) return errorReply(media, 400, errorBody(invalid));
+		if (media === Media.EventStream) return this.#stream(ctx, request, true);
+		return this.#execute(ctx, request, media, true, false);
+	};
+	/** A `POST` body read: parsed, checked, executed or streamed. */
+	#posted(ctx, bytes, media, streamable) {
+		if (bytes.byteLength === 0) return errorReply(media, 400, errorBody("Missing request body: send { query, variables?, operationName? }"));
+		let body;
+		try {
+			body = JSON.parse(UTF8.decode(bytes));
+		} catch {
+			return errorReply(media, 400, errorBody("Malformed JSON body"));
+		}
+		if (body === null || typeof body !== "object") return errorReply(media, 400, errorBody("The body must be a JSON object: { query, variables?, operationName? }"));
+		if (Array.isArray(body)) return errorReply(media, 400, errorBody("Operation batching is not supported: send one operation per request"));
+		const invalid = invalidParams(body);
+		if (invalid !== void 0) return errorReply(media, 400, errorBody(invalid));
+		if (media === Media.EventStream) return this.#stream(ctx, body, false);
+		return this.#execute(ctx, body, media, false, streamable);
+	}
+	/**
+	* Executes a query or a mutation; synchronous while the execution is. A subscription is streamed
+	* when the client accepts an event stream (`streamable`), a 400 otherwise.
+	*/
+	#execute(ctx, request, media, get, streamable) {
+		const executor = this.#executor ?? this.#bind();
+		const abort = new DeferredAbort();
+		const options = {
+			transport: "http",
+			http: ctx,
+			abortSignal: abort.asSignal(),
+			queriesOnly: get,
+			streamSubscriptions: streamable
+		};
+		const response = executor.execute(request, options);
+		if (response === SUBSCRIBE) return this.#stream(ctx, request, get);
+		if (!isPromise$1(response)) return reply(response, media, get);
+		abort.follow(() => ctx.signal);
+		return response.then((settled) => reply(settled, media, get), (error) => {
+			if (!abort.aborted || error !== abort.reason) throw error;
+			return errorReply(media, 503, errorBody("The request was aborted", GraphQLErrorCode.ServiceUnavailable));
+		});
+	}
+	/** GraphQL over SSE: any operation, its results as `next` events. */
+	#stream(ctx, request, get) {
+		const executor = this.#executor ?? this.#bind();
+		const signal = ctx.signal;
+		const options = {
+			transport: "sse",
+			http: ctx,
+			signal,
+			queriesOnly: get
+		};
+		return executor.subscribe(request, options).then((outcome) => {
+			if ("status" in outcome) return errorReply(Media.Json, outcome.status, outcome.result, outcome.headers);
+			return HttpResponse.sse(new ResultEvents(outcome, signal), this.#sse);
+		}, (error) => {
+			if (!signal.aborted || error !== signal.reason) throw error;
+			return errorReply(Media.Json, 503, errorBody("The request was aborted", GraphQLErrorCode.ServiceUnavailable));
+		});
+	}
+	#bind() {
+		this.#executor = this.#resolveExecutor();
+		return this.#executor;
+	}
+};
+/**
+* The HTTP reply of an executor response. `application/json` answers 200 to every well-formed
+* request (request errors included); `application/graphql-response+json` keeps the status.
+*/
+function reply(response, media, get) {
+	const status = response.status;
+	const result = response.result;
+	if (media === Media.Json) {
+		if (status === 200 || status === 400) return get ? result : new HttpResponse(result, JSON_200);
+		return errorReply(media, status, result, response.headers);
+	}
+	if (response.headers === void 0) {
+		if (status === 200) return new HttpResponse(result, GRAPHQL_JSON_200);
+		if (status === 400) return new HttpResponse(result, GRAPHQL_JSON_400);
+	}
+	return errorReply(media, status, result, response.headers);
+}
+/** A failure reading the body (413 past the body limit, 400 for an aborted body) with a GraphQL error body. */
+function transportError(error, media) {
+	if (!isHttpException(error)) throw error;
+	return errorReply(media, error.status, errorBody(error.message));
+}
+/** Checks the SSE options once (`HttpResponse.sse()` validates them): `undefined` when they are valid. */
+function checkSseOptions(options) {
+	try {
+		HttpResponse.sse([], options);
+		return;
+	} catch (error) {
+		return error instanceof Error ? error.message : String(error);
+	}
+}
+// src/plugin.ts
+let readExecutor;
+let readEndpoint;
+/**
+* The executor of a bootstrapped plugin: the internal API of the transports (statuses, streams).
+* Not exported from the package entry.
+*/
+function executorOf(plugin) {
+	return readExecutor(plugin);
+}
+/**
+* The absolute path of the GraphQL-over-HTTP endpoint (prefix included), `undefined` without HTTP
+* transport (`http: false`, or before `HttpPlugin` collected the routes). Not exported from the
+* package entry: `@znight/graphql/testing` sends its requests there.
+*/
+function endpointOf(plugin) {
+	return readEndpoint(plugin);
+}
+/**
+* The GraphQL plugin: `GraphQLPlugin.configure(options)` (name `graphql`).
+*
+* ```ts
+* await Application.create({
+*   metadata: __ZNIGHT_METADATA__,
+*   plugins: [HttpPlugin.configure(), GraphQLPlugin.configure({ guards: [AccessGuard] })],
+* })
+* ```
+*/
+var GraphQLPlugin = class GraphQLPlugin {
+	name = "graphql";
+	#options;
+	#resolved;
+	#container;
+	#metadata;
+	#logger;
+	#hooks;
+	#pubsub;
+	#ownPubSub;
+	#runtime;
+	#stop;
+	#endpoint;
+	#active = false;
+	constructor(options) {
+		this.#options = options;
+	}
+	static {
+		readExecutor = (plugin) => plugin.#ready().executor;
+		readEndpoint = (plugin) => plugin.#endpoint;
+	}
+	/**
+	* Creates the plugin. `options` may be a function of the container, evaluated once, when first
+	* needed after the container is initialised: `GraphQLPlugin.configure(c => ({ exposeErrors: c.get(Env).dev }))`.
+	*/
+	static configure(options = {}) {
+		return new GraphQLPlugin(options);
+	}
+	/**
+	* Providers `TestApp` creates at boot: the classes of the `guards` and `errorMappers` options, and
+	* the resolvers, guards and loaders of the metadata.
+	*/
+	initRoots(context) {
+		const roots = /* @__PURE__ */ new Set();
+		try {
+			const options = this.#options;
+			if (options !== null && typeof options === "object") for (const key of ["guards", "errorMappers"]) {
+				const refs = options[key];
+				if (Array.isArray(refs)) {
+					for (const ref of refs) if (typeof ref === "function") roots.add(ref);
+				}
+			}
+			const types = (context?.metadata.extensions?.graphql)?.types;
+			if (Array.isArray(types)) for (const type of types) {
+				if (!Array.isArray(type?.fields)) continue;
+				for (const field of type.fields) {
+					const binding = field?.resolver;
+					if (binding === void 0 || typeof binding.token !== "string") continue;
+					roots.add(binding.token);
+					for (const token of [...binding.guards ?? [], ...binding.loaders ?? []]) if (typeof token === "string") roots.add(token);
+				}
+			}
+		} catch {}
+		return [...roots];
+	}
+	register(ctx) {
+		if (this.#active) throw new ZnightError(ErrorCode.DuplicateProvider, "This GraphQLPlugin is already used by another application", { hints: ["Call GraphQLPlugin.configure() once per application"] });
+		this.#resolved = void 0;
+		this.#runtime = void 0;
+		this.#ownPubSub = void 0;
+		this.#endpoint = void 0;
+		this.#container = ctx.container;
+		this.#metadata = ctx.metadata;
+		this.#logger = ctx.logger;
+		this.#hooks = ctx.hooks;
+		if (typeof this.#options !== "function") this.#checkHttp(ctx, this.#resolve());
+		this.#active = true;
+		this.#stop = new AbortController();
+		ctx.container.registerExternal({
+			token: GraphQLTokens.Context,
+			scope: "request",
+			providedBy: "GraphQLPlugin"
+		});
+		ctx.container.registerValue(GraphQLTokens.PubSub, typeof this.#options === "function" ? new DeferredPubSub(() => this.pubsub) : this.pubsub);
+		ctx.container.registerValue(GraphQLTokens.Plugin, this);
+	}
+	/**
+	* The `PluginHttpRoutes` contract of `@znight/http`: the GraphQL endpoint (`GET` and `POST` on
+	* `path`). `[]` with `http: false`.
+	*/
+	httpRoutes(context) {
+		this.#container ??= context.container;
+		const options = this.#resolve();
+		const http = options.http;
+		if (http === false) return [];
+		const endpoint = endpointPath(context.prefix, options.path);
+		const transport = new HttpTransport({
+			executor: () => this.#ready().executor,
+			endpoint,
+			get: http.get,
+			graphiql: options.graphiql,
+			sse: sseOptions(options)
+		});
+		this.#endpoint = endpoint;
+		const common = {
+			name: "handle",
+			path: options.path,
+			...http.meta.length === 0 ? {} : { meta: http.meta },
+			...http.guards.length === 0 ? {} : { guards: http.guards }
+		};
+		const routes = [{
+			...common,
+			method: "POST",
+			handler: transport.post,
+			bodyLimit: http.bodyLimit
+		}];
+		if (http.get || options.graphiql) routes.unshift({
+			...common,
+			method: "GET",
+			handler: transport.get
+		});
+		return routes;
+	}
+	onBootstrap(ctx) {
+		this.#container = ctx.container;
+		const options = this.#resolve();
+		if (typeof this.#options === "function") this.#checkHttp(ctx, options);
+		this.#checkSse(options);
+		this.#runtime = this.#build(ctx, options);
+	}
+	onStart(ctx) {
+		const runtime = this.#runtime;
+		const options = this.#resolved;
+		if (runtime === void 0 || options === void 0) return;
+		const details = {
+			types: runtime.section.types.length,
+			schemaHash: runtime.section.schemaHash
+		};
+		if (options.http === false) ctx.logger.info("GraphQL schema ready", details);
+		else ctx.logger.info("GraphQL endpoint ready", {
+			path: options.path,
+			...details
+		});
+	}
+	async onStop() {
+		this.#stop?.abort(/* @__PURE__ */ new Error("The application is stopping"));
+		await this.#runtime?.executor.stopDirect();
+	}
+	onDispose() {
+		this.#active = false;
+		this.#ownPubSub?.close();
+		this.#ownPubSub = void 0;
+		this.#pubsub = void 0;
+		this.#runtime?.executor.clear();
+		this.#runtime = void 0;
+		this.#resolved = void 0;
+	}
+	/** The schema (after bootstrap). */
+	get schema() {
+		return this.#ready().schema;
+	}
+	/** The SDL of the schema (graphql-js `printSchema`). */
+	printSchema() {
+		return printSchema(this.#ready().schema);
+	}
+	/** The `PubSub` of the application: the `pubsub` option, or the plugin's `MemoryPubSub`. */
+	get pubsub() {
+		let pubsub = this.#pubsub;
+		if (pubsub === void 0) {
+			const options = this.#resolve();
+			if (options.pubsub === void 0) {
+				this.#ownPubSub = new MemoryPubSub({ bufferSize: options.bufferSize });
+				pubsub = this.#ownPubSub;
+			} else pubsub = options.pubsub;
+			this.#pubsub = pubsub;
+		}
+		return pubsub;
+	}
+	/** Active subscriptions (every transport). */
+	get activeSubscriptions() {
+		return this.#runtime?.executor.activeSubscriptions ?? 0;
+	}
+	/**
+	* Executes a query or a mutation outside of HTTP (custom transports, tests, a controller calling
+	* GraphQL), in the current request scope or in a scope of its own. Returns the result directly
+	* when every resolver is synchronous; `await` it. A subscription is an error result: use
+	* {@link subscribe}. Rejects only when `options.signal` aborts the execution.
+	*/
+	execute(request, options) {
+		const response = this.#ready().executor.execute(request, direct(options));
+		return isPromise(response) ? response.then((settled) => settled.result) : response.result;
+	}
+	/**
+	* Subscribes outside of HTTP: the results of the subscription, one per event, until the source
+	* ends, `options.signal` aborts, `return()` is called or the application stops. A request error
+	* or a query gives a stream of one result.
+	*/
+	async subscribe(request, options) {
+		const response = await this.#ready().executor.subscribe(request, direct(options));
+		return "status" in response ? singleResult(response.result) : response;
+	}
+	#ready() {
+		const runtime = this.#runtime;
+		if (runtime === void 0) throw new ZnightError(ErrorCode.LifecycleFailed, "GraphQLPlugin is not bootstrapped yet", { hints: ["The schema and execute() are available once Application.create() resolved"] });
+		return runtime;
+	}
+	#resolve() {
+		if (this.#resolved !== void 0) return this.#resolved;
+		const container = this.#container;
+		if (container === void 0 && typeof this.#options === "function") throw new ZnightError(ErrorCode.LifecycleFailed, "GraphQLPlugin: the options are not available before register()");
+		this.#resolved = resolveGraphQLOptions(resolveOptions(this.#options, container));
+		return this.#resolved;
+	}
+	/** The SSE options are those of `HttpResponse.sse()` (heartbeat and maxDuration from 1 000 ms): checked at boot. */
+	#checkSse(options) {
+		const sse = sseOptions(options);
+		if (sse === false) return;
+		const problem = checkSseOptions(sse);
+		if (problem !== void 0) throw invalidOption("subscriptions", `valid event stream options (${problem})`, sse);
+	}
+	#checkHttp(ctx, options) {
+		if (options.http !== false && ctx.getPlugin("http") === void 0) throw new ZnightError(ErrorCode.InvalidGraphQLSetup, "GraphQLPlugin serves its endpoint through HttpPlugin, which is not registered", { hints: ["Add HttpPlugin.configure() to the plugins of the application", "Or set http: false to use the schema and execute() only"] });
+	}
+	#build(ctx, options) {
+		const container = ctx.container;
+		const metadata = ctx.metadata;
+		const section = graphqlSection(metadata);
+		const providers = new Providers(container, metadata);
+		const globalGuards = options.guards.map((ref) => providers.ref(ref, "guard", "canResolve"));
+		const mappers = options.errorMappers.map((ref) => providers.ref(ref, "error mapper", "map"));
+		const inputs = /* @__PURE__ */ new Map();
+		const fields = [];
+		const types = Array.isArray(section?.types) ? section.types : [];
+		for (const type of types) {
+			if (type?.kind === "input") inputs.set(type.name, type);
+			if (type?.kind !== "object" || !Array.isArray(type.fields)) continue;
+			for (const field of type.fields) {
+				const binding = field?.resolver;
+				if (binding === void 0 || binding === null || typeof binding !== "object") continue;
+				const root = binding.operation !== "field";
+				const guardRefs = Array.isArray(binding.guards) ? binding.guards : [];
+				fields.push({
+					description: `${type.name}.${field.name} (${displayName(String(binding.token))}.${String(binding.method)})`,
+					root,
+					meta: binding.meta ?? {},
+					guards: [...globalGuardsApply(binding) ? globalGuards.map((guard) => ({
+						cls: guard.cls,
+						name: guard.name
+					})) : [], ...guardRefs.map((token) => ({
+						cls: metadata.providers[token]?.class,
+						name: displayName(token)
+					}))]
+				});
+			}
+		}
+		const schema = buildGraphQLSchema(section, pipelineFactory({
+			container,
+			globalGuards: globalGuards.map((guard) => guard.resolvable),
+			guard: (token, coordinate) => providers.token(token, `guard of ${coordinate}`, "canResolve"),
+			resolver: (binding, coordinate) => providers.token(binding.token, `resolver of ${coordinate}`, binding.method),
+			inputs
+		}));
+		checkFieldDecisions(fields, section.groups, options.enforcement, ctx.logger);
+		const formatter = new ErrorFormatter({
+			container,
+			mappers: mappers.map((mapper) => mapper.resolvable),
+			exposeErrors: options.exposeErrors,
+			logger: ctx.logger,
+			schema
+		});
+		const executor = new GraphQLExecutor({
+			schema,
+			container,
+			hooks: ctx.hooks,
+			logger: ctx.logger,
+			formatter,
+			runtime: {
+				container,
+				loaders: new LoaderFactory(container),
+				signal: this.#stop.signal
+			},
+			limits: options.limits,
+			introspection: options.introspection,
+			documentCache: options.documentCache,
+			maxActiveSubscriptions: options.subscriptions === false ? void 0 : options.subscriptions.maxActive
+		});
+		ctx.logger.debug("GraphQL schema built", {
+			types: types.length,
+			schemaHash: section.schemaHash
+		});
+		return {
+			schema,
+			section,
+			executor
+		};
+	}
+};
+function direct(options) {
+	if (options === void 0) return DIRECT;
+	return {
+		transport: "direct",
+		...options.signal === void 0 ? {} : { signal: options.signal },
+		...options.requestId === void 0 ? {} : { requestId: options.requestId }
+	};
+}
+const DIRECT = Object.freeze({ transport: "direct" });
+/** `prefix` (`''`, `/api`) joined with `path` (`/graphql`), without trailing slash: `/api/graphql`. */
+function endpointPath(prefix, path) {
+	const joined = `${prefix.replace(/\/+$/, "")}/${path.replace(/^\/+|\/+$/g, "")}`;
+	return joined.length > 1 && joined.endsWith("/") ? joined.slice(0, -1) : joined;
+}
+/** The `HttpResponse.sse()` options of GraphQL over SSE (`subscriptions`), `false` when disabled. */
+function sseOptions(options) {
+	const subscriptions = options.subscriptions;
+	if (subscriptions === false) return false;
+	return Object.freeze({
+		...subscriptions.heartbeat === void 0 ? {} : { heartbeat: subscriptions.heartbeat },
+		...subscriptions.maxDuration === void 0 ? {} : { maxDuration: subscriptions.maxDuration }
+	});
+}
+function isPromise(value) {
+	return typeof value?.then === "function";
+}
+/**
+* Resolves providers once at bootstrap: singletons (and registered values) to their instance,
+* request-scoped and transient providers to their token, resolved per use in the current scope.
+*/
+var Providers = class {
+	#container;
+	#metadata;
+	#resolvables = /* @__PURE__ */ new Map();
+	constructor(container, metadata) {
+		this.#container = container;
+		this.#metadata = metadata;
+	}
+	/** A provider token (`@UseGuard`, a resolver), checked to have `method` when its class is known. */
+	token(token, what, method) {
+		const cls = Object.hasOwn(this.#metadata.providers, token) ? this.#metadata.providers[token]?.class : void 0;
+		if (typeof cls === "function" && typeof cls.prototype?.[method] !== "function") throw new ZnightError(ErrorCode.InvalidGraphQLSetup, `GraphQLPlugin: the ${what} (${displayName(token)}) has no ${method}() method`, { hints: method === "canResolve" ? ["A GraphQL guard implements GraphQLGuard: canResolve(ctx: ResolverContext)"] : [] });
+		return this.#resolvable(token, what);
+	}
+	/** A global ref: a provider class or an instance with `method`. */
+	ref(ref, what, method) {
+		if (typeof ref === "function") {
+			const token = this.#container.tokenOf(ref);
+			if (token === void 0) {
+				const name = ref.name || "<anonymous>";
+				throw new ZnightError(ErrorCode.MissingProvider, `GraphQLPlugin: the global ${what} ${name} is not a provider`, { hints: ["Add @Injectable() to the class, or pass an instance"] });
+			}
+			if (typeof ref.prototype?.[method] !== "function") throw invalidOption(`${what}s`, `classes with a ${method}() method`, ref);
+			return {
+				resolvable: this.#resolvable(token, `global ${what}`),
+				cls: ref,
+				name: displayName(token)
+			};
+		}
+		const cls = ref.constructor;
+		const name = typeof cls === "function" && cls !== Object ? cls.name : void 0;
+		return {
+			resolvable: { instance: ref },
+			cls,
+			name: name || `${what} instance`
+		};
+	}
+	#resolvable(token, what) {
+		let found = this.#resolvables.get(token);
+		if (found === void 0) {
+			found = this.#create(token, what);
+			this.#resolvables.set(token, found);
+		}
+		return found;
+	}
+	#create(token, what) {
+		const container = this.#container;
+		if (!container.has(token)) throw new ZnightError(ErrorCode.MissingProvider, `GraphQLPlugin: the ${what} (${token}) is not a provider`, { hints: ["Add @Injectable() to the class (resolvers are providers through @Resolver())"] });
+		const scope = Object.hasOwn(this.#metadata.providers, token) ? this.#metadata.providers[token]?.scope : void 0;
+		if (scope === "request" || scope === "transient") return { token };
+		try {
+			return { instance: container.get(token) };
+		} catch (error) {
+			if (error?.code === ErrorCode.NoActiveScope) return { token };
+			throw error;
+		}
+	}
+};
+/**
+* The `PubSub` registered when the options are a function of the container (they are only known
+* after `container.init()`): delegates to the plugin's `PubSub`, resolved on first use.
+*/
+var DeferredPubSub = class extends PubSub {
+	#target;
+	constructor(target) {
+		super();
+		this.#target = target;
+	}
+	publish(topic, payload) {
+		return this.#target().publish(topic, payload);
+	}
+	subscribe(topic, options) {
+		return this.#target().subscribe(topic, options);
+	}
+};
+export { MemoryPubSub as a, GraphQLErrorCode as c, GraphQLTokens as i, GraphQLException as l, endpointOf as n, PubSub as o, executorOf as r, orderByKeys as s, GraphQLPlugin as t };
+
+//# sourceMappingURL=plugin-BdBxr5NQ.mjs.map