nestjs-slightly-better-auth 1.0.0 → 1.1.0

package/README.md

@@ -6,7 +6,7 @@
 
 A NestJS integration for [Better Auth](https://www.better-auth.com), built on an independently reviewed specification.
 
-> **Scope of 1.0.0.** This release covers HTTP: the Nest authentication kernel, the Better Auth construction plugin, the Express and Fastify platforms, and the admin, organization and API-key authorization units. GraphQL, WebSocket and RPC transports and the conformance testing kit are not included; they arrive in later minor versions behind their own entry points.
+> **Scope.** The package covers HTTP and RPC. HTTP support comprises the Nest authentication kernel, the Better Auth construction plugin, the Express and Fastify platforms, and the admin, organization and API-key authorization units. The `./microservices` entry authenticates Nest microservice messages. GraphQL and WebSocket transports and the conformance testing kit are not included; they arrive in later minor versions behind their own entry points. The [changelog](CHANGELOG.md) records the version that introduces each entry point.
 
 ## Install
 
@@ -16,9 +16,17 @@ pnpm add nestjs-slightly-better-auth better-auth
 
 Peer dependencies: `@nestjs/common` and `@nestjs/core` 12, `better-auth` 1.7.5 or newer, `reflect-metadata` and `rxjs`. Node.js 24.11 or newer.
 
+The `./microservices` entry also needs the optional peer `@nestjs/microservices` 12 and the client library Nest uses for your transport, for example:
+
+```sh
+pnpm add @nestjs/microservices @nats-io/transport-node
+```
+
+Nest's gRPC transport uses `@grpc/grpc-js` and `@grpc/proto-loader`, Kafka uses `kafkajs`, RabbitMQ uses `amqplib` and `amqp-connection-manager`, MQTT uses `mqtt`, and Redis uses `ioredis`. TCP needs no client library. Applications that do not import `./microservices` do not need any of these packages.
+
 ## What this release covers
 
-The library separates a Better Auth construction plugin, a NestJS integration kernel and optional transports. The `./plugin` entry installs the hook and cookie bridge before Better Auth creates its pipeline. The `./platform` entry provides Node/Web request and response helpers. Neither entry requires Express, Fastify, GraphQL or WebSocket packages.
+The library separates a Better Auth construction plugin, a NestJS integration kernel and optional transports. The `./plugin` entry installs the hook and cookie bridge before Better Auth creates its pipeline. The `./platform` entry provides Node/Web request and response helpers. Neither entry requires Express, Fastify, GraphQL, WebSocket or microservice packages.
 
 The root entry provides synchronous and asynchronous module registration, default and named instances, service readers, guards, scoped execution and compositional authorization. Tests exercise actual Nest dependency injection and Better Auth sessions, including isolation between instances, caller-origin enforcement and application shutdown. Built ESM and CommonJS consumers verify the same registration and type contracts.
 
@@ -28,10 +36,74 @@ Express preserves native controller parsing for unconditional routes that overla
 
 Fastify does not expose its configured `trustProxy` value through a public inspection API. The boot summary therefore reports proxy trust as `unknown`, and diagnostics that depend on the setting are unavailable. Client IP resolution still uses the native Fastify request. Configure proxy trust on your Nest Fastify adapter and verify it against your deployment topology.
 
-GraphQL, WebSocket and microservice integrations have separate implementation and end-to-end acceptance gates. They will use optional entry points so applications can install the transports they use. HTTP platform tests do not establish that those integrations are ready.
+GraphQL and WebSocket integrations have separate implementation and end-to-end acceptance gates. They will use optional entry points so applications install only the transports they use.
 
 Start with the [design workspace](docs/design/README.md), [reviewed specification](docs/design/design-v7.md), [review ledger](docs/design/ledger.md) and [implementation plan](../../docs/superpowers/plans/2026-09-21-better-auth.md). Independent Better Auth, NestJS and security reviews approved the final v7 snapshot after resolving the round-6 and round-7 findings. The remaining entry points are tracked in [issue #534](https://github.com/thilllon/nestjs-kit/issues/534).
 
+## RPC authentication
+
+The `./microservices` entry authenticates messages in standalone and hybrid Nest microservices. `rpcTransport()` reads credentials from the transport's native carrier: gRPC metadata, NATS headers, Kafka headers, RabbitMQ message headers and MQTT 5 user properties. TCP and Redis messages have no header carrier, so they send credentials in a payload envelope field, `auth` by default. Every message is authenticated separately.
+
+```ts
+import { Controller, Module } from "@nestjs/common";
+import { NestFactory } from "@nestjs/core";
+import {
+  MessagePattern,
+  Transport,
+  type MicroserviceOptions,
+} from "@nestjs/microservices";
+import { betterAuth } from "better-auth";
+import { bearer } from "better-auth/plugins";
+import {
+  BetterAuthModule,
+  CurrentUser,
+  Public,
+} from "nestjs-slightly-better-auth";
+import { rpcTransport } from "nestjs-slightly-better-auth/microservices";
+import { nestjs } from "nestjs-slightly-better-auth/plugin";
+
+const auth = betterAuth({
+  // RPC messages have no HTTP origin, so the base URL must be static.
+  baseURL: "https://auth.example.com",
+  // Add your database adapter and other Better Auth options.
+  plugins: [bearer(), nestjs()],
+});
+
+@Controller()
+class ProfileController {
+  @MessagePattern("profile.get")
+  profile(@CurrentUser() user: { id: string }) {
+    return { userId: user.id };
+  }
+
+  @Public()
+  @MessagePattern("health")
+  health() {
+    return { ok: true };
+  }
+}
+
+@Module({
+  imports: [BetterAuthModule.forRoot({ auth, transports: [rpcTransport()] })],
+  controllers: [ProfileController],
+})
+class AppModule {}
+
+const app = await NestFactory.createMicroservice<MicroserviceOptions>(
+  AppModule,
+  { transport: Transport.TCP, options: { host: "127.0.0.1", port: 4000 } },
+);
+await app.listen();
+```
+
+A TCP client puts credentials in the envelope, for example `{ auth: { authorization: "Bearer <token>" }, id: 1 }`; a NATS client sets an `authorization` header through `NatsRecordBuilder`. Carriers accept only the `authorization`, `cookie` and `x-api-key` fields by default. Pass carrier factories such as `grpcCarrier({ metadata: ["authorization"] })` or `payloadCarrier({ field: "credentials" })` in `rpcTransport({ carriers })` to change the accepted fields or the envelope. Host, forwarding and `set-cookie` metadata never reach Better Auth, so a broker message cannot claim an HTTP origin.
+
+Configure a static Better Auth base URL, or a fallback for a dynamic one: RPC transports have no request host, and startup fails with `DYNAMIC_BASE_URL_WITHOUT_FALLBACK` otherwise. Message authentication never refreshes or sets cookies. Public messages run without credentials; protected messages without a matching carrier are rejected as unauthenticated. Malformed credential values, such as values containing CR, LF or NUL, are rejected with reason `MALFORMED_CREDENTIALS` without reaching Better Auth, the handler or logs.
+
+In a hybrid application, Nest applies global guards to microservice handlers only when `connectMicroservice()` receives `{ inheritAppConfig: true }`. Either pass that option to every `connectMicroservice()` call and pass `rpcTransport({ inheritAppConfig: true })`, or apply `@UseBetterAuth()` to message controllers and `@Public()` to public handlers. Startup verifies the explicit form and fails with `RPC_HANDLER_UNGUARDED` for an uncovered message or event handler; `hybridCoverage: "warn"` or `"off"` lowers that check. The inheritance option is an assertion that the application passes the same flag to Nest, and startup logs the `W_RPC_INHERIT_APP_CONFIG_ASSERTED` warning for it.
+
+Failures become `RpcException` payloads with `statusCode`, `code` and, where present, `reason`. gRPC calls receive native status codes: 16 for authentication, 7 for authorization, 8 for throttling and 13 for redacted infrastructure failures. End-to-end tests run real TCP and gRPC servers and real NATS, Kafka, RabbitMQ, MQTT 5 and Redis brokers against Nest 12.0.3, including hybrid applications with both coverage modes and default plus named instances.
+
 ## Develop in this monorepo
 
 From the repository root:

package/dist/microservices.cjs

@@ -0,0 +1,252 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region \0rolldown/runtime.js
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule || !__hasOwnProp.call(mod, "default") ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+//#endregion
+const require_auth_errors = require("./auth-errors-CsERBNWI.cjs");
+let _nestjs_common = require("@nestjs/common");
+let _nestjs_core = require("@nestjs/core");
+let _nestjs_microservices = require("@nestjs/microservices");
+_nestjs_microservices = __toESM(_nestjs_microservices, 1);
+//#region src/rpc-carriers.ts
+const credentialNames = [
+	"authorization",
+	"cookie",
+	"x-api-key"
+];
+function record(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+function method(value, name) {
+	const candidate = record(value)?.[name];
+	return typeof candidate === "function" ? candidate.bind(value) : void 0;
+}
+function contextOf(context) {
+	return context.switchToRpc().getContext();
+}
+function extract(input, allow) {
+	const headers = new Headers();
+	const allowed = new Set(allow.map((name) => name.toLowerCase()));
+	for (const name of [
+		"host",
+		"x-forwarded-host",
+		"x-forwarded-proto",
+		"set-cookie"
+	]) allowed.delete(name);
+	const source = record(input);
+	if (!source) return headers;
+	for (const name of Object.keys(source)) {
+		const normalized = name.toLowerCase();
+		if (!allowed.has(normalized)) continue;
+		const value = source[name];
+		const values = Array.isArray(value) ? value : [value];
+		if (values.length === 0) throw require_auth_errors.AuthFailures.rejected({
+			status: 401,
+			reason: "MALFORMED_CREDENTIALS"
+		});
+		for (const item of values) {
+			const text = typeof item === "string" ? item : Buffer.isBuffer(item) ? item.toString("utf8") : void 0;
+			if (text === void 0 || /[\r\n\0]/.test(text)) throw require_auth_errors.AuthFailures.rejected({
+				status: 401,
+				reason: "MALFORMED_CREDENTIALS"
+			});
+			try {
+				headers.append(normalized, text);
+			} catch {
+				throw require_auth_errors.AuthFailures.rejected({
+					status: 401,
+					reason: "MALFORMED_CREDENTIALS"
+				});
+			}
+		}
+	}
+	return headers;
+}
+function grpcCarrier(options = {}) {
+	return {
+		id: "grpc",
+		matches: (context) => !!method(context.getArgByIndex(1), "get") && !!method(context.getArgByIndex(1), "getMap"),
+		headers: (context) => extract(method(context.getArgByIndex(1), "getMap")?.(), options.metadata ?? credentialNames),
+		toException(failure) {
+			const name = failure.status === 401 ? "GrpcUnauthenticatedException" : failure.status === 403 ? "GrpcPermissionDeniedException" : "GrpcResourceExhaustedException";
+			const Native = _nestjs_microservices[name];
+			return new _nestjs_microservices.RpcException(Native ? new Native(failure.message).getError() : {
+				code: failure.status === 401 ? 16 : failure.status === 403 ? 7 : 8,
+				message: failure.message
+			});
+		}
+	};
+}
+function natsCarrier(options = {}) {
+	return {
+		id: "nats",
+		matches: (context) => !!method(contextOf(context), "getHeaders"),
+		headers(context) {
+			const input = method(contextOf(context), "getHeaders")?.();
+			const keys = method(input, "keys")?.();
+			const get = method(input, "get");
+			const values = Object.create(null);
+			if (Array.isArray(keys) && get) {
+				for (const key of keys) if (typeof key === "string") values[key] = get(key);
+			}
+			return extract(values, options.headers ?? credentialNames);
+		}
+	};
+}
+function kafkaCarrier(options = {}) {
+	const message = (context) => record(method(contextOf(context), "getMessage")?.());
+	return {
+		id: "kafka",
+		matches: (context) => message(context) !== void 0 && "headers" in message(context),
+		headers: (context) => extract(message(context)?.headers, options.headers ?? credentialNames)
+	};
+}
+function rmqCarrier(options = {}) {
+	const message = (context) => record(method(contextOf(context), "getMessage")?.());
+	return {
+		id: "rmq",
+		matches: (context) => message(context) !== void 0 && "properties" in message(context),
+		headers: (context) => extract(record(message(context)?.properties)?.headers, options.headers ?? credentialNames)
+	};
+}
+function mqttCarrier(options = {}) {
+	return {
+		id: "mqtt",
+		matches: (context) => !!method(contextOf(context), "getPacket"),
+		headers: (context) => extract(record(record(method(contextOf(context), "getPacket")?.())?.properties)?.userProperties, options.userProperties ?? credentialNames)
+	};
+}
+function payloadCarrier(options = {}) {
+	const payload = (context) => {
+		const data = record(context.switchToRpc().getData());
+		const field = options.field ?? "auth";
+		return data && Object.hasOwn(data, field) ? record(data[field]) : void 0;
+	};
+	return {
+		id: "payload",
+		matches: (context) => payload(context) !== void 0,
+		headers: (context) => extract(payload(context), credentialNames)
+	};
+}
+const defaultCarriers = Object.freeze([
+	grpcCarrier(),
+	natsCarrier(),
+	kafkaCarrier(),
+	rmqCarrier(),
+	mqttCarrier(),
+	payloadCarrier()
+]);
+//#endregion
+//#region src/rpc-transport.ts
+function rpcTransport(options = {}) {
+	const carriers = [...options.carriers ?? defaultCarriers];
+	const select = (context) => carriers.find((carrier) => carrier.matches(context));
+	const grpc = grpcCarrier();
+	return {
+		id: "rpc",
+		requires: { hostlessCalls: true },
+		handles: (context) => context.getType() === "rpc",
+		describe(context) {
+			const candidate = context.switchToRpc().getContext();
+			const key = candidate !== null && typeof candidate === "object" ? candidate : context.getArgs();
+			return {
+				key,
+				invocation: key,
+				cookies: null,
+				clientIp: null,
+				headers() {
+					const input = select(context)?.headers(context);
+					try {
+						return new Headers(input);
+					} catch {
+						throw require_auth_errors.AuthFailures.rejected({
+							status: 401,
+							reason: "MALFORMED_CREDENTIALS"
+						});
+					}
+				},
+				param(name) {
+					const data = context.switchToRpc().getData();
+					return data !== null && typeof data === "object" && Object.hasOwn(data, name) ? data[name] : void 0;
+				}
+			};
+		},
+		toException(failure, context) {
+			const carrier = select(context);
+			return carrier?.toException ? carrier.toException(failure, context) : new _nestjs_microservices.RpcException({
+				status: "error",
+				statusCode: failure.status,
+				code: failure.code,
+				...failure.reason ? { reason: failure.reason } : {},
+				message: failure.message
+			});
+		},
+		toInternalException(error, context, info) {
+			if (!grpc.matches(context)) return error;
+			if (!info.repeated) new _nestjs_common.Logger("BetterAuthRpc").error(error);
+			return new _nestjs_microservices.RpcException({
+				code: 13,
+				message: "Internal server error"
+			});
+		},
+		validate(context) {
+			class Probe {
+				handler() {}
+			}
+			(0, _nestjs_microservices.MessagePattern)("nsba-probe")(Probe.prototype, "handler", Object.getOwnPropertyDescriptor(Probe.prototype, "handler"));
+			const patterns = Reflect.getMetadata("microservices:pattern", Probe.prototype.handler);
+			if (!Array.isArray(patterns) || patterns[0] !== "nsba-probe") throw new require_auth_errors.BetterAuthConfigurationError("NEST_METADATA_KEY_CHANGED", "Nest RPC pattern metadata failed its canary");
+			const explicit = context.hasHttpAdapter && !options.inheritAppConfig;
+			const scanner = new _nestjs_core.MetadataScanner();
+			for (const wrapper of context.discovery.getControllers()) {
+				const target = wrapper.metatype;
+				if (!target?.prototype || wrapper.isAlias) continue;
+				for (const name of scanner.getAllMethodNames(target.prototype)) {
+					if (Reflect.getMetadata("microservices:pattern", target.prototype[name]) === void 0) continue;
+					context.claim(target, name, explicit ? "explicit" : "global", {
+						code: "RPC_HANDLER_UNGUARDED",
+						everyHandler: explicit,
+						coverage: explicit ? options.hybridCoverage ?? "error" : "error",
+						hint: "Add @UseBetterAuth() or @Public() to the RPC controller/handler, or assert inheritAppConfig and pass { inheritAppConfig: true } to every connectMicroservice call."
+					});
+				}
+			}
+		},
+		advise() {
+			return options.inheritAppConfig ? [{
+				level: "warn",
+				code: "W_RPC_INHERIT_APP_CONFIG_ASSERTED",
+				message: "RPC coverage assumes every connectMicroservice() call passes { inheritAppConfig: true }. Prefer @UseBetterAuth() on message controllers for verifiable coverage."
+			}] : [];
+		}
+	};
+}
+//#endregion
+exports.defaultCarriers = defaultCarriers;
+exports.grpcCarrier = grpcCarrier;
+exports.kafkaCarrier = kafkaCarrier;
+exports.mqttCarrier = mqttCarrier;
+exports.natsCarrier = natsCarrier;
+exports.payloadCarrier = payloadCarrier;
+exports.rmqCarrier = rmqCarrier;
+exports.rpcTransport = rpcTransport;
+
+//# sourceMappingURL=microservices.cjs.map

package/dist/microservices.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"microservices.cjs","names":["AuthFailures","microservices","AuthFailures","RpcException","Logger","BetterAuthConfigurationError","MetadataScanner"],"sources":["../src/rpc-carriers.ts","../src/rpc-transport.ts"],"sourcesContent":["import type { ExecutionContext } from \"@nestjs/common\";\nimport * as microservices from \"@nestjs/microservices\";\nimport { AuthFailures, type AuthFailure } from \"./auth-errors.js\";\n\nexport interface RpcCredentialCarrier {\n  readonly id: string;\n  matches(context: ExecutionContext): boolean;\n  headers(context: ExecutionContext): HeadersInit | undefined;\n  toException?(failure: AuthFailure, context: ExecutionContext): unknown;\n}\n\nconst credentialNames = [\"authorization\", \"cookie\", \"x-api-key\"] as const;\n\ntype RecordValue = Record<string, unknown>;\nfunction record(value: unknown): RecordValue | undefined {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value)\n    ? (value as RecordValue)\n    : undefined;\n}\nfunction method(\n  value: unknown,\n  name: string,\n): ((...args: unknown[]) => unknown) | undefined {\n  const target = record(value);\n  const candidate = target?.[name];\n  return typeof candidate === \"function\" ? candidate.bind(value) : undefined;\n}\nfunction contextOf(context: ExecutionContext): unknown {\n  return context.switchToRpc().getContext<unknown>();\n}\nfunction extract(input: unknown, allow: readonly string[]): Headers {\n  const headers = new Headers();\n  const allowed = new Set(allow.map((name) => name.toLowerCase()));\n  // Host and forwarding metadata must never influence hostless authentication.\n  for (const name of [\n    \"host\",\n    \"x-forwarded-host\",\n    \"x-forwarded-proto\",\n    \"set-cookie\",\n  ]) {\n    allowed.delete(name);\n  }\n  const source = record(input);\n  if (!source) {\n    return headers;\n  }\n  for (const name of Object.keys(source)) {\n    const normalized = name.toLowerCase();\n    if (!allowed.has(normalized)) {\n      continue;\n    }\n    const value = source[name];\n    const values = Array.isArray(value) ? value : [value];\n    if (values.length === 0) {\n      throw AuthFailures.rejected({\n        status: 401,\n        reason: \"MALFORMED_CREDENTIALS\",\n      });\n    }\n    for (const item of values) {\n      const text =\n        typeof item === \"string\"\n          ? item\n          : Buffer.isBuffer(item)\n            ? item.toString(\"utf8\")\n            : undefined;\n      if (text === undefined || /[\\r\\n\\0]/.test(text)) {\n        throw AuthFailures.rejected({\n          status: 401,\n          reason: \"MALFORMED_CREDENTIALS\",\n        });\n      }\n      try {\n        headers.append(normalized, text);\n      } catch {\n        // Web Headers errors can embed credentials in their message. Never retain\n        // that error, and never discard one bad credential to try another one.\n        throw AuthFailures.rejected({\n          status: 401,\n          reason: \"MALFORMED_CREDENTIALS\",\n        });\n      }\n    }\n  }\n  return headers;\n}\n\nexport function grpcCarrier(\n  options: { metadata?: readonly string[] } = {},\n): RpcCredentialCarrier {\n  return {\n    id: \"grpc\",\n    matches: (context) =>\n      !!method(context.getArgByIndex(1), \"get\") &&\n      !!method(context.getArgByIndex(1), \"getMap\"),\n    headers: (context) =>\n      extract(\n        method(context.getArgByIndex(1), \"getMap\")?.(),\n        options.metadata ?? credentialNames,\n      ),\n    toException(failure) {\n      const name =\n        failure.status === 401\n          ? \"GrpcUnauthenticatedException\"\n          : failure.status === 403\n            ? \"GrpcPermissionDeniedException\"\n            : \"GrpcResourceExhaustedException\";\n      const Native = (\n        microservices as unknown as Record<\n          string,\n          new (\n            message: string,\n          ) => Error & { getError(): object }\n        >\n      )[name];\n      // Native gRPC exceptions require an opt-in Nest filter. Wrap their payload\n      // so the default RPC filter also delivers the numeric status.\n      return new microservices.RpcException(\n        Native\n          ? new Native(failure.message).getError()\n          : {\n              code:\n                failure.status === 401 ? 16 : failure.status === 403 ? 7 : 8,\n              message: failure.message,\n            },\n      );\n    },\n  };\n}\n\nexport function natsCarrier(\n  options: { headers?: readonly string[] } = {},\n): RpcCredentialCarrier {\n  return {\n    id: \"nats\",\n    matches: (context) => !!method(contextOf(context), \"getHeaders\"),\n    headers(context) {\n      const input = method(contextOf(context), \"getHeaders\")?.();\n      const keys = method(input, \"keys\")?.();\n      const get = method(input, \"get\");\n      const values: RecordValue = Object.create(null);\n      if (Array.isArray(keys) && get) {\n        for (const key of keys) {\n          if (typeof key === \"string\") {\n            values[key] = get(key);\n          }\n        }\n      }\n      return extract(values, options.headers ?? credentialNames);\n    },\n  };\n}\n\nexport function kafkaCarrier(\n  options: { headers?: readonly string[] } = {},\n): RpcCredentialCarrier {\n  const message = (context: ExecutionContext) =>\n    record(method(contextOf(context), \"getMessage\")?.());\n  return {\n    id: \"kafka\",\n    matches: (context) =>\n      message(context) !== undefined && \"headers\" in message(context)!,\n    headers: (context) =>\n      extract(message(context)?.headers, options.headers ?? credentialNames),\n  };\n}\n\nexport function rmqCarrier(\n  options: { headers?: readonly string[] } = {},\n): RpcCredentialCarrier {\n  const message = (context: ExecutionContext) =>\n    record(method(contextOf(context), \"getMessage\")?.());\n  return {\n    id: \"rmq\",\n    matches: (context) =>\n      message(context) !== undefined && \"properties\" in message(context)!,\n    headers: (context) =>\n      extract(\n        record(message(context)?.properties)?.headers,\n        options.headers ?? credentialNames,\n      ),\n  };\n}\n\nexport function mqttCarrier(\n  options: { userProperties?: readonly string[] } = {},\n): RpcCredentialCarrier {\n  return {\n    id: \"mqtt\",\n    matches: (context) => !!method(contextOf(context), \"getPacket\"),\n    headers: (context) =>\n      extract(\n        record(record(method(contextOf(context), \"getPacket\")?.())?.properties)\n          ?.userProperties,\n        options.userProperties ?? credentialNames,\n      ),\n  };\n}\n\nexport function payloadCarrier(\n  options: { field?: string } = {},\n): RpcCredentialCarrier {\n  const payload = (context: ExecutionContext) => {\n    const data = record(context.switchToRpc().getData<unknown>());\n    const field = options.field ?? \"auth\";\n    return data && Object.hasOwn(data, field) ? record(data[field]) : undefined;\n  };\n  return {\n    id: \"payload\",\n    matches: (context) => payload(context) !== undefined,\n    headers: (context) => extract(payload(context), credentialNames),\n  };\n}\n\nexport const defaultCarriers: readonly RpcCredentialCarrier[] = Object.freeze([\n  grpcCarrier(),\n  natsCarrier(),\n  kafkaCarrier(),\n  rmqCarrier(),\n  mqttCarrier(),\n  payloadCarrier(),\n]);\n","import { Logger, type ExecutionContext } from \"@nestjs/common\";\nimport { MetadataScanner } from \"@nestjs/core\";\nimport { MessagePattern, RpcException } from \"@nestjs/microservices\";\nimport type {\n  AuthTransport,\n  BootAdvice,\n  ExtensionRef,\n  TransportCall,\n  TransportValidationContext,\n} from \"./auth-contracts.js\";\nimport {\n  BetterAuthConfigurationError,\n  AuthFailures,\n  type AuthFailure,\n} from \"./auth-errors.js\";\nimport {\n  defaultCarriers,\n  grpcCarrier,\n  type RpcCredentialCarrier,\n} from \"./rpc-carriers.js\";\n\nexport interface RpcTransportOptions {\n  carriers?: readonly RpcCredentialCarrier[];\n  hybridCoverage?: \"error\" | \"warn\" | \"off\";\n  inheritAppConfig?: boolean;\n}\n\nexport function rpcTransport(\n  options: RpcTransportOptions = {},\n): ExtensionRef<AuthTransport> {\n  const carriers = [...(options.carriers ?? defaultCarriers)];\n  const select = (context: ExecutionContext) =>\n    carriers.find((carrier) => carrier.matches(context));\n  const grpc = grpcCarrier();\n  return {\n    id: \"rpc\",\n    requires: { hostlessCalls: true },\n    handles: (context) => context.getType() === \"rpc\",\n    describe(context): TransportCall {\n      const candidate = context.switchToRpc().getContext<unknown>();\n      const key =\n        candidate !== null && typeof candidate === \"object\"\n          ? candidate\n          : context.getArgs();\n      return {\n        key,\n        invocation: key,\n        cookies: null,\n        clientIp: null,\n        headers() {\n          const input = select(context)?.headers(context);\n          try {\n            return new Headers(input);\n          } catch {\n            // Custom carriers may return a raw HeadersInit. Conversion errors\n            // include its values, so discard the original error and its cause.\n            throw AuthFailures.rejected({\n              status: 401,\n              reason: \"MALFORMED_CREDENTIALS\",\n            });\n          }\n        },\n        param(name) {\n          const data = context.switchToRpc().getData<unknown>();\n          return data !== null &&\n            typeof data === \"object\" &&\n            Object.hasOwn(data, name)\n            ? (data as Record<string, unknown>)[name]\n            : undefined;\n        },\n      };\n    },\n    toException(failure: AuthFailure, context) {\n      const carrier = select(context);\n      return carrier?.toException\n        ? carrier.toException(failure, context)\n        : new RpcException({\n            status: \"error\",\n            statusCode: failure.status,\n            code: failure.code,\n            ...(failure.reason ? { reason: failure.reason } : {}),\n            message: failure.message,\n          });\n    },\n    toInternalException(error, context, info) {\n      if (!grpc.matches(context)) {\n        return error;\n      }\n      if (!info.repeated) {\n        new Logger(\"BetterAuthRpc\").error(error);\n      }\n      return new RpcException({ code: 13, message: \"Internal server error\" });\n    },\n    validate(context: TransportValidationContext) {\n      class Probe {\n        handler(): void {}\n      }\n      MessagePattern(\"nsba-probe\")(\n        Probe.prototype,\n        \"handler\",\n        Object.getOwnPropertyDescriptor(Probe.prototype, \"handler\")!,\n      );\n      const patterns: unknown = Reflect.getMetadata(\n        \"microservices:pattern\",\n        Probe.prototype.handler,\n      );\n      if (!Array.isArray(patterns) || patterns[0] !== \"nsba-probe\") {\n        throw new BetterAuthConfigurationError(\n          \"NEST_METADATA_KEY_CHANGED\",\n          \"Nest RPC pattern metadata failed its canary\",\n        );\n      }\n      const explicit = context.hasHttpAdapter && !options.inheritAppConfig;\n      const scanner = new MetadataScanner();\n      for (const wrapper of context.discovery.getControllers()) {\n        const target = wrapper.metatype;\n        if (!target?.prototype || wrapper.isAlias) {\n          continue;\n        }\n        for (const name of scanner.getAllMethodNames(target.prototype)) {\n          if (\n            Reflect.getMetadata(\n              \"microservices:pattern\",\n              target.prototype[name],\n            ) === undefined\n          ) {\n            continue;\n          }\n          context.claim(target, name, explicit ? \"explicit\" : \"global\", {\n            code: \"RPC_HANDLER_UNGUARDED\",\n            everyHandler: explicit,\n            coverage: explicit ? (options.hybridCoverage ?? \"error\") : \"error\",\n            hint: \"Add @UseBetterAuth() or @Public() to the RPC controller/handler, or assert inheritAppConfig and pass { inheritAppConfig: true } to every connectMicroservice call.\",\n          });\n        }\n      }\n    },\n    advise(): readonly BootAdvice[] {\n      return options.inheritAppConfig\n        ? [\n            {\n              level: \"warn\",\n              code: \"W_RPC_INHERIT_APP_CONFIG_ASSERTED\",\n              message:\n                \"RPC coverage assumes every connectMicroservice() call passes { inheritAppConfig: true }. Prefer @UseBetterAuth() on message controllers for verifiable coverage.\",\n            },\n          ]\n        : [];\n    },\n  } satisfies AuthTransport;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAWA,MAAM,kBAAkB;CAAC;CAAiB;CAAU;AAAW;AAG/D,SAAS,OAAO,OAAyC;CACvD,OAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IACrE,QACD,KAAA;AACN;AACA,SAAS,OACP,OACA,MAC+C;CAE/C,MAAM,YADS,OAAO,KACC,CAAC,GAAG;CAC3B,OAAO,OAAO,cAAc,aAAa,UAAU,KAAK,KAAK,IAAI,KAAA;AACnE;AACA,SAAS,UAAU,SAAoC;CACrD,OAAO,QAAQ,YAAY,CAAC,CAAC,WAAoB;AACnD;AACA,SAAS,QAAQ,OAAgB,OAAmC;CAClE,MAAM,UAAU,IAAI,QAAQ;CAC5B,MAAM,UAAU,IAAI,IAAI,MAAM,KAAK,SAAS,KAAK,YAAY,CAAC,CAAC;CAE/D,KAAK,MAAM,QAAQ;EACjB;EACA;EACA;EACA;CACF,GACE,QAAQ,OAAO,IAAI;CAErB,MAAM,SAAS,OAAO,KAAK;CAC3B,IAAI,CAAC,QACH,OAAO;CAET,KAAK,MAAM,QAAQ,OAAO,KAAK,MAAM,GAAG;EACtC,MAAM,aAAa,KAAK,YAAY;EACpC,IAAI,CAAC,QAAQ,IAAI,UAAU,GACzB;EAEF,MAAM,QAAQ,OAAO;EACrB,MAAM,SAAS,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK;EACpD,IAAI,OAAO,WAAW,GACpB,MAAMA,oBAAAA,aAAa,SAAS;GAC1B,QAAQ;GACR,QAAQ;EACV,CAAC;EAEH,KAAK,MAAM,QAAQ,QAAQ;GACzB,MAAM,OACJ,OAAO,SAAS,WACZ,OACA,OAAO,SAAS,IAAI,IAClB,KAAK,SAAS,MAAM,IACpB,KAAA;GACR,IAAI,SAAS,KAAA,KAAa,WAAW,KAAK,IAAI,GAC5C,MAAMA,oBAAAA,aAAa,SAAS;IAC1B,QAAQ;IACR,QAAQ;GACV,CAAC;GAEH,IAAI;IACF,QAAQ,OAAO,YAAY,IAAI;GACjC,QAAQ;IAGN,MAAMA,oBAAAA,aAAa,SAAS;KAC1B,QAAQ;KACR,QAAQ;IACV,CAAC;GACH;EACF;CACF;CACA,OAAO;AACT;AAEA,SAAgB,YACd,UAA4C,CAAC,GACvB;CACtB,OAAO;EACL,IAAI;EACJ,UAAU,YACR,CAAC,CAAC,OAAO,QAAQ,cAAc,CAAC,GAAG,KAAK,KACxC,CAAC,CAAC,OAAO,QAAQ,cAAc,CAAC,GAAG,QAAQ;EAC7C,UAAU,YACR,QACE,OAAO,QAAQ,cAAc,CAAC,GAAG,QAAQ,CAAC,GAAG,GAC7C,QAAQ,YAAY,eACtB;EACF,YAAY,SAAS;GACnB,MAAM,OACJ,QAAQ,WAAW,MACf,iCACA,QAAQ,WAAW,MACjB,kCACA;GACR,MAAM,SACJC,sBAMA;GAGF,OAAO,IAAIA,sBAAc,aACvB,SACI,IAAI,OAAO,QAAQ,OAAO,CAAC,CAAC,SAAS,IACrC;IACE,MACE,QAAQ,WAAW,MAAM,KAAK,QAAQ,WAAW,MAAM,IAAI;IAC7D,SAAS,QAAQ;GACnB,CACN;EACF;CACF;AACF;AAEA,SAAgB,YACd,UAA2C,CAAC,GACtB;CACtB,OAAO;EACL,IAAI;EACJ,UAAU,YAAY,CAAC,CAAC,OAAO,UAAU,OAAO,GAAG,YAAY;EAC/D,QAAQ,SAAS;GACf,MAAM,QAAQ,OAAO,UAAU,OAAO,GAAG,YAAY,CAAC,GAAG;GACzD,MAAM,OAAO,OAAO,OAAO,MAAM,CAAC,GAAG;GACrC,MAAM,MAAM,OAAO,OAAO,KAAK;GAC/B,MAAM,SAAsB,OAAO,OAAO,IAAI;GAC9C,IAAI,MAAM,QAAQ,IAAI,KAAK,KACpB;SAAA,MAAM,OAAO,MAChB,IAAI,OAAO,QAAQ,UACjB,OAAO,OAAO,IAAI,GAAG;GAAA;GAI3B,OAAO,QAAQ,QAAQ,QAAQ,WAAW,eAAe;EAC3D;CACF;AACF;AAEA,SAAgB,aACd,UAA2C,CAAC,GACtB;CACtB,MAAM,WAAW,YACf,OAAO,OAAO,UAAU,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC;CACrD,OAAO;EACL,IAAI;EACJ,UAAU,YACR,QAAQ,OAAO,MAAM,KAAA,KAAa,aAAa,QAAQ,OAAO;EAChE,UAAU,YACR,QAAQ,QAAQ,OAAO,CAAC,EAAE,SAAS,QAAQ,WAAW,eAAe;CACzE;AACF;AAEA,SAAgB,WACd,UAA2C,CAAC,GACtB;CACtB,MAAM,WAAW,YACf,OAAO,OAAO,UAAU,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC;CACrD,OAAO;EACL,IAAI;EACJ,UAAU,YACR,QAAQ,OAAO,MAAM,KAAA,KAAa,gBAAgB,QAAQ,OAAO;EACnE,UAAU,YACR,QACE,OAAO,QAAQ,OAAO,CAAC,EAAE,UAAU,CAAC,EAAE,SACtC,QAAQ,WAAW,eACrB;CACJ;AACF;AAEA,SAAgB,YACd,UAAkD,CAAC,GAC7B;CACtB,OAAO;EACL,IAAI;EACJ,UAAU,YAAY,CAAC,CAAC,OAAO,UAAU,OAAO,GAAG,WAAW;EAC9D,UAAU,YACR,QACE,OAAO,OAAO,OAAO,UAAU,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,EACnE,gBACJ,QAAQ,kBAAkB,eAC5B;CACJ;AACF;AAEA,SAAgB,eACd,UAA8B,CAAC,GACT;CACtB,MAAM,WAAW,YAA8B;EAC7C,MAAM,OAAO,OAAO,QAAQ,YAAY,CAAC,CAAC,QAAiB,CAAC;EAC5D,MAAM,QAAQ,QAAQ,SAAS;EAC/B,OAAO,QAAQ,OAAO,OAAO,MAAM,KAAK,IAAI,OAAO,KAAK,MAAM,IAAI,KAAA;CACpE;CACA,OAAO;EACL,IAAI;EACJ,UAAU,YAAY,QAAQ,OAAO,MAAM,KAAA;EAC3C,UAAU,YAAY,QAAQ,QAAQ,OAAO,GAAG,eAAe;CACjE;AACF;AAEA,MAAa,kBAAmD,OAAO,OAAO;CAC5E,YAAY;CACZ,YAAY;CACZ,aAAa;CACb,WAAW;CACX,YAAY;CACZ,eAAe;AACjB,CAAC;;;AClMD,SAAgB,aACd,UAA+B,CAAC,GACH;CAC7B,MAAM,WAAW,CAAC,GAAI,QAAQ,YAAY,eAAgB;CAC1D,MAAM,UAAU,YACd,SAAS,MAAM,YAAY,QAAQ,QAAQ,OAAO,CAAC;CACrD,MAAM,OAAO,YAAY;CACzB,OAAO;EACL,IAAI;EACJ,UAAU,EAAE,eAAe,KAAK;EAChC,UAAU,YAAY,QAAQ,QAAQ,MAAM;EAC5C,SAAS,SAAwB;GAC/B,MAAM,YAAY,QAAQ,YAAY,CAAC,CAAC,WAAoB;GAC5D,MAAM,MACJ,cAAc,QAAQ,OAAO,cAAc,WACvC,YACA,QAAQ,QAAQ;GACtB,OAAO;IACL;IACA,YAAY;IACZ,SAAS;IACT,UAAU;IACV,UAAU;KACR,MAAM,QAAQ,OAAO,OAAO,CAAC,EAAE,QAAQ,OAAO;KAC9C,IAAI;MACF,OAAO,IAAI,QAAQ,KAAK;KAC1B,QAAQ;MAGN,MAAMC,oBAAAA,aAAa,SAAS;OAC1B,QAAQ;OACR,QAAQ;MACV,CAAC;KACH;IACF;IACA,MAAM,MAAM;KACV,MAAM,OAAO,QAAQ,YAAY,CAAC,CAAC,QAAiB;KACpD,OAAO,SAAS,QACd,OAAO,SAAS,YAChB,OAAO,OAAO,MAAM,IAAI,IACrB,KAAiC,QAClC,KAAA;IACN;GACF;EACF;EACA,YAAY,SAAsB,SAAS;GACzC,MAAM,UAAU,OAAO,OAAO;GAC9B,OAAO,SAAS,cACZ,QAAQ,YAAY,SAAS,OAAO,IACpC,IAAIC,sBAAAA,aAAa;IACf,QAAQ;IACR,YAAY,QAAQ;IACpB,MAAM,QAAQ;IACd,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;IACnD,SAAS,QAAQ;GACnB,CAAC;EACP;EACA,oBAAoB,OAAO,SAAS,MAAM;GACxC,IAAI,CAAC,KAAK,QAAQ,OAAO,GACvB,OAAO;GAET,IAAI,CAAC,KAAK,UACR,IAAIC,eAAAA,OAAO,eAAe,CAAC,CAAC,MAAM,KAAK;GAEzC,OAAO,IAAID,sBAAAA,aAAa;IAAE,MAAM;IAAI,SAAS;GAAwB,CAAC;EACxE;EACA,SAAS,SAAqC;GAC5C,MAAM,MAAM;IACV,UAAgB,CAAC;GACnB;GACA,CAAA,GAAA,sBAAA,eAAA,CAAe,YAAY,CAAC,CAC1B,MAAM,WACN,WACA,OAAO,yBAAyB,MAAM,WAAW,SAAS,CAC5D;GACA,MAAM,WAAoB,QAAQ,YAChC,yBACA,MAAM,UAAU,OAClB;GACA,IAAI,CAAC,MAAM,QAAQ,QAAQ,KAAK,SAAS,OAAO,cAC9C,MAAM,IAAIE,oBAAAA,6BACR,6BACA,6CACF;GAEF,MAAM,WAAW,QAAQ,kBAAkB,CAAC,QAAQ;GACpD,MAAM,UAAU,IAAIC,aAAAA,gBAAgB;GACpC,KAAK,MAAM,WAAW,QAAQ,UAAU,eAAe,GAAG;IACxD,MAAM,SAAS,QAAQ;IACvB,IAAI,CAAC,QAAQ,aAAa,QAAQ,SAChC;IAEF,KAAK,MAAM,QAAQ,QAAQ,kBAAkB,OAAO,SAAS,GAAG;KAC9D,IACE,QAAQ,YACN,yBACA,OAAO,UAAU,KACnB,MAAM,KAAA,GAEN;KAEF,QAAQ,MAAM,QAAQ,MAAM,WAAW,aAAa,UAAU;MAC5D,MAAM;MACN,cAAc;MACd,UAAU,WAAY,QAAQ,kBAAkB,UAAW;MAC3D,MAAM;KACR,CAAC;IACH;GACF;EACF;EACA,SAAgC;GAC9B,OAAO,QAAQ,mBACX,CACE;IACE,OAAO;IACP,MAAM;IACN,SACE;GACJ,CACF,IACA,CAAC;EACP;CACF;AACF"}

package/dist/microservices.d.cts

@@ -0,0 +1,39 @@
+import { M as ExtensionRef, c as AuthTransport, zn as AuthFailure } from "./auth-contracts-BBA1C1gj.cjs";
+import { ExecutionContext } from "@nestjs/common";
+//#region src/rpc-carriers.d.ts
+interface RpcCredentialCarrier {
+  readonly id: string;
+  matches(context: ExecutionContext): boolean;
+  headers(context: ExecutionContext): HeadersInit | undefined;
+  toException?(failure: AuthFailure, context: ExecutionContext): unknown;
+}
+export declare function grpcCarrier(options?: {
+  metadata?: readonly string[];
+}): RpcCredentialCarrier;
+export declare function natsCarrier(options?: {
+  headers?: readonly string[];
+}): RpcCredentialCarrier;
+export declare function kafkaCarrier(options?: {
+  headers?: readonly string[];
+}): RpcCredentialCarrier;
+export declare function rmqCarrier(options?: {
+  headers?: readonly string[];
+}): RpcCredentialCarrier;
+export declare function mqttCarrier(options?: {
+  userProperties?: readonly string[];
+}): RpcCredentialCarrier;
+export declare function payloadCarrier(options?: {
+  field?: string;
+}): RpcCredentialCarrier;
+export declare const defaultCarriers: readonly RpcCredentialCarrier[];
+//#endregion
+//#region src/rpc-transport.d.ts
+interface RpcTransportOptions {
+  carriers?: readonly RpcCredentialCarrier[];
+  hybridCoverage?: "error" | "warn" | "off";
+  inheritAppConfig?: boolean;
+}
+export declare function rpcTransport(options?: RpcTransportOptions): ExtensionRef<AuthTransport>;
+//#endregion
+export type { RpcCredentialCarrier, RpcTransportOptions };
+//# sourceMappingURL=microservices.d.cts.map

package/dist/microservices.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"microservices.d.cts","names":[],"sources":["../src/rpc-carriers.ts","../src/rpc-transport.ts"],"mappings":";;;UAIiB;WACN;EACT,QAAQ,SAAS;EACjB,QAAQ,SAAS,mBAAmB;EACpC,aAAa,SAAS,aAAa,SAAS;;wBA+E9B,YACd;EAAW;IACV;wBAyCa,YACd;EAAW;IACV;wBAqBa,aACd;EAAW;IACV;wBAYa,WACd;EAAW;IACV;wBAea,YACd;EAAW;IACV;wBAaa,eACd;EAAW;IACV;qBAaU,0BAA0B;;;UCjMtB;EACf,oBAAoB;EACpB;EACA;;wBAGc,aACd,UAAS,sBACR,aAAa"}

package/dist/microservices.d.mts

@@ -0,0 +1,39 @@
+import { M as ExtensionRef, c as AuthTransport, zn as AuthFailure } from "./auth-contracts-tqsfBZ8B.mjs";
+import { ExecutionContext } from "@nestjs/common";
+//#region src/rpc-carriers.d.ts
+interface RpcCredentialCarrier {
+  readonly id: string;
+  matches(context: ExecutionContext): boolean;
+  headers(context: ExecutionContext): HeadersInit | undefined;
+  toException?(failure: AuthFailure, context: ExecutionContext): unknown;
+}
+export declare function grpcCarrier(options?: {
+  metadata?: readonly string[];
+}): RpcCredentialCarrier;
+export declare function natsCarrier(options?: {
+  headers?: readonly string[];
+}): RpcCredentialCarrier;
+export declare function kafkaCarrier(options?: {
+  headers?: readonly string[];
+}): RpcCredentialCarrier;
+export declare function rmqCarrier(options?: {
+  headers?: readonly string[];
+}): RpcCredentialCarrier;
+export declare function mqttCarrier(options?: {
+  userProperties?: readonly string[];
+}): RpcCredentialCarrier;
+export declare function payloadCarrier(options?: {
+  field?: string;
+}): RpcCredentialCarrier;
+export declare const defaultCarriers: readonly RpcCredentialCarrier[];
+//#endregion
+//#region src/rpc-transport.d.ts
+interface RpcTransportOptions {
+  carriers?: readonly RpcCredentialCarrier[];
+  hybridCoverage?: "error" | "warn" | "off";
+  inheritAppConfig?: boolean;
+}
+export declare function rpcTransport(options?: RpcTransportOptions): ExtensionRef<AuthTransport>;
+//#endregion
+export type { RpcCredentialCarrier, RpcTransportOptions };
+//# sourceMappingURL=microservices.d.mts.map

package/dist/microservices.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"microservices.d.mts","names":[],"sources":["../src/rpc-carriers.ts","../src/rpc-transport.ts"],"mappings":";;;UAIiB;WACN;EACT,QAAQ,SAAS;EACjB,QAAQ,SAAS,mBAAmB;EACpC,aAAa,SAAS,aAAa,SAAS;;wBA+E9B,YACd;EAAW;IACV;wBAyCa,YACd;EAAW;IACV;wBAqBa,aACd;EAAW;IACV;wBAYa,WACd;EAAW;IACV;wBAea,YACd;EAAW;IACV;wBAaa,eACd;EAAW;IACV;qBAaU,0BAA0B;;;UCjMtB;EACf,oBAAoB;EACpB;EACA;;wBAGc,aACd,UAAS,sBACR,aAAa"}

package/dist/microservices.mjs

@@ -0,0 +1,222 @@
+import { n as BetterAuthConfigurationError, t as AuthFailures } from "./auth-errors-CQjfgjaO.mjs";
+import { Logger } from "@nestjs/common";
+import { MetadataScanner } from "@nestjs/core";
+import * as microservices from "@nestjs/microservices";
+import { MessagePattern, RpcException } from "@nestjs/microservices";
+//#region src/rpc-carriers.ts
+const credentialNames = [
+	"authorization",
+	"cookie",
+	"x-api-key"
+];
+function record(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+function method(value, name) {
+	const candidate = record(value)?.[name];
+	return typeof candidate === "function" ? candidate.bind(value) : void 0;
+}
+function contextOf(context) {
+	return context.switchToRpc().getContext();
+}
+function extract(input, allow) {
+	const headers = new Headers();
+	const allowed = new Set(allow.map((name) => name.toLowerCase()));
+	for (const name of [
+		"host",
+		"x-forwarded-host",
+		"x-forwarded-proto",
+		"set-cookie"
+	]) allowed.delete(name);
+	const source = record(input);
+	if (!source) return headers;
+	for (const name of Object.keys(source)) {
+		const normalized = name.toLowerCase();
+		if (!allowed.has(normalized)) continue;
+		const value = source[name];
+		const values = Array.isArray(value) ? value : [value];
+		if (values.length === 0) throw AuthFailures.rejected({
+			status: 401,
+			reason: "MALFORMED_CREDENTIALS"
+		});
+		for (const item of values) {
+			const text = typeof item === "string" ? item : Buffer.isBuffer(item) ? item.toString("utf8") : void 0;
+			if (text === void 0 || /[\r\n\0]/.test(text)) throw AuthFailures.rejected({
+				status: 401,
+				reason: "MALFORMED_CREDENTIALS"
+			});
+			try {
+				headers.append(normalized, text);
+			} catch {
+				throw AuthFailures.rejected({
+					status: 401,
+					reason: "MALFORMED_CREDENTIALS"
+				});
+			}
+		}
+	}
+	return headers;
+}
+function grpcCarrier(options = {}) {
+	return {
+		id: "grpc",
+		matches: (context) => !!method(context.getArgByIndex(1), "get") && !!method(context.getArgByIndex(1), "getMap"),
+		headers: (context) => extract(method(context.getArgByIndex(1), "getMap")?.(), options.metadata ?? credentialNames),
+		toException(failure) {
+			const name = failure.status === 401 ? "GrpcUnauthenticatedException" : failure.status === 403 ? "GrpcPermissionDeniedException" : "GrpcResourceExhaustedException";
+			const Native = microservices[name];
+			return new microservices.RpcException(Native ? new Native(failure.message).getError() : {
+				code: failure.status === 401 ? 16 : failure.status === 403 ? 7 : 8,
+				message: failure.message
+			});
+		}
+	};
+}
+function natsCarrier(options = {}) {
+	return {
+		id: "nats",
+		matches: (context) => !!method(contextOf(context), "getHeaders"),
+		headers(context) {
+			const input = method(contextOf(context), "getHeaders")?.();
+			const keys = method(input, "keys")?.();
+			const get = method(input, "get");
+			const values = Object.create(null);
+			if (Array.isArray(keys) && get) {
+				for (const key of keys) if (typeof key === "string") values[key] = get(key);
+			}
+			return extract(values, options.headers ?? credentialNames);
+		}
+	};
+}
+function kafkaCarrier(options = {}) {
+	const message = (context) => record(method(contextOf(context), "getMessage")?.());
+	return {
+		id: "kafka",
+		matches: (context) => message(context) !== void 0 && "headers" in message(context),
+		headers: (context) => extract(message(context)?.headers, options.headers ?? credentialNames)
+	};
+}
+function rmqCarrier(options = {}) {
+	const message = (context) => record(method(contextOf(context), "getMessage")?.());
+	return {
+		id: "rmq",
+		matches: (context) => message(context) !== void 0 && "properties" in message(context),
+		headers: (context) => extract(record(message(context)?.properties)?.headers, options.headers ?? credentialNames)
+	};
+}
+function mqttCarrier(options = {}) {
+	return {
+		id: "mqtt",
+		matches: (context) => !!method(contextOf(context), "getPacket"),
+		headers: (context) => extract(record(record(method(contextOf(context), "getPacket")?.())?.properties)?.userProperties, options.userProperties ?? credentialNames)
+	};
+}
+function payloadCarrier(options = {}) {
+	const payload = (context) => {
+		const data = record(context.switchToRpc().getData());
+		const field = options.field ?? "auth";
+		return data && Object.hasOwn(data, field) ? record(data[field]) : void 0;
+	};
+	return {
+		id: "payload",
+		matches: (context) => payload(context) !== void 0,
+		headers: (context) => extract(payload(context), credentialNames)
+	};
+}
+const defaultCarriers = Object.freeze([
+	grpcCarrier(),
+	natsCarrier(),
+	kafkaCarrier(),
+	rmqCarrier(),
+	mqttCarrier(),
+	payloadCarrier()
+]);
+//#endregion
+//#region src/rpc-transport.ts
+function rpcTransport(options = {}) {
+	const carriers = [...options.carriers ?? defaultCarriers];
+	const select = (context) => carriers.find((carrier) => carrier.matches(context));
+	const grpc = grpcCarrier();
+	return {
+		id: "rpc",
+		requires: { hostlessCalls: true },
+		handles: (context) => context.getType() === "rpc",
+		describe(context) {
+			const candidate = context.switchToRpc().getContext();
+			const key = candidate !== null && typeof candidate === "object" ? candidate : context.getArgs();
+			return {
+				key,
+				invocation: key,
+				cookies: null,
+				clientIp: null,
+				headers() {
+					const input = select(context)?.headers(context);
+					try {
+						return new Headers(input);
+					} catch {
+						throw AuthFailures.rejected({
+							status: 401,
+							reason: "MALFORMED_CREDENTIALS"
+						});
+					}
+				},
+				param(name) {
+					const data = context.switchToRpc().getData();
+					return data !== null && typeof data === "object" && Object.hasOwn(data, name) ? data[name] : void 0;
+				}
+			};
+		},
+		toException(failure, context) {
+			const carrier = select(context);
+			return carrier?.toException ? carrier.toException(failure, context) : new RpcException({
+				status: "error",
+				statusCode: failure.status,
+				code: failure.code,
+				...failure.reason ? { reason: failure.reason } : {},
+				message: failure.message
+			});
+		},
+		toInternalException(error, context, info) {
+			if (!grpc.matches(context)) return error;
+			if (!info.repeated) new Logger("BetterAuthRpc").error(error);
+			return new RpcException({
+				code: 13,
+				message: "Internal server error"
+			});
+		},
+		validate(context) {
+			class Probe {
+				handler() {}
+			}
+			MessagePattern("nsba-probe")(Probe.prototype, "handler", Object.getOwnPropertyDescriptor(Probe.prototype, "handler"));
+			const patterns = Reflect.getMetadata("microservices:pattern", Probe.prototype.handler);
+			if (!Array.isArray(patterns) || patterns[0] !== "nsba-probe") throw new BetterAuthConfigurationError("NEST_METADATA_KEY_CHANGED", "Nest RPC pattern metadata failed its canary");
+			const explicit = context.hasHttpAdapter && !options.inheritAppConfig;
+			const scanner = new MetadataScanner();
+			for (const wrapper of context.discovery.getControllers()) {
+				const target = wrapper.metatype;
+				if (!target?.prototype || wrapper.isAlias) continue;
+				for (const name of scanner.getAllMethodNames(target.prototype)) {
+					if (Reflect.getMetadata("microservices:pattern", target.prototype[name]) === void 0) continue;
+					context.claim(target, name, explicit ? "explicit" : "global", {
+						code: "RPC_HANDLER_UNGUARDED",
+						everyHandler: explicit,
+						coverage: explicit ? options.hybridCoverage ?? "error" : "error",
+						hint: "Add @UseBetterAuth() or @Public() to the RPC controller/handler, or assert inheritAppConfig and pass { inheritAppConfig: true } to every connectMicroservice call."
+					});
+				}
+			}
+		},
+		advise() {
+			return options.inheritAppConfig ? [{
+				level: "warn",
+				code: "W_RPC_INHERIT_APP_CONFIG_ASSERTED",
+				message: "RPC coverage assumes every connectMicroservice() call passes { inheritAppConfig: true }. Prefer @UseBetterAuth() on message controllers for verifiable coverage."
+			}] : [];
+		}
+	};
+}
+//#endregion
+export { defaultCarriers, grpcCarrier, kafkaCarrier, mqttCarrier, natsCarrier, payloadCarrier, rmqCarrier, rpcTransport };
+
+//# sourceMappingURL=microservices.mjs.map

package/dist/microservices.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"microservices.mjs","names":[],"sources":["../src/rpc-carriers.ts","../src/rpc-transport.ts"],"sourcesContent":["import type { ExecutionContext } from \"@nestjs/common\";\nimport * as microservices from \"@nestjs/microservices\";\nimport { AuthFailures, type AuthFailure } from \"./auth-errors.js\";\n\nexport interface RpcCredentialCarrier {\n  readonly id: string;\n  matches(context: ExecutionContext): boolean;\n  headers(context: ExecutionContext): HeadersInit | undefined;\n  toException?(failure: AuthFailure, context: ExecutionContext): unknown;\n}\n\nconst credentialNames = [\"authorization\", \"cookie\", \"x-api-key\"] as const;\n\ntype RecordValue = Record<string, unknown>;\nfunction record(value: unknown): RecordValue | undefined {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value)\n    ? (value as RecordValue)\n    : undefined;\n}\nfunction method(\n  value: unknown,\n  name: string,\n): ((...args: unknown[]) => unknown) | undefined {\n  const target = record(value);\n  const candidate = target?.[name];\n  return typeof candidate === \"function\" ? candidate.bind(value) : undefined;\n}\nfunction contextOf(context: ExecutionContext): unknown {\n  return context.switchToRpc().getContext<unknown>();\n}\nfunction extract(input: unknown, allow: readonly string[]): Headers {\n  const headers = new Headers();\n  const allowed = new Set(allow.map((name) => name.toLowerCase()));\n  // Host and forwarding metadata must never influence hostless authentication.\n  for (const name of [\n    \"host\",\n    \"x-forwarded-host\",\n    \"x-forwarded-proto\",\n    \"set-cookie\",\n  ]) {\n    allowed.delete(name);\n  }\n  const source = record(input);\n  if (!source) {\n    return headers;\n  }\n  for (const name of Object.keys(source)) {\n    const normalized = name.toLowerCase();\n    if (!allowed.has(normalized)) {\n      continue;\n    }\n    const value = source[name];\n    const values = Array.isArray(value) ? value : [value];\n    if (values.length === 0) {\n      throw AuthFailures.rejected({\n        status: 401,\n        reason: \"MALFORMED_CREDENTIALS\",\n      });\n    }\n    for (const item of values) {\n      const text =\n        typeof item === \"string\"\n          ? item\n          : Buffer.isBuffer(item)\n            ? item.toString(\"utf8\")\n            : undefined;\n      if (text === undefined || /[\\r\\n\\0]/.test(text)) {\n        throw AuthFailures.rejected({\n          status: 401,\n          reason: \"MALFORMED_CREDENTIALS\",\n        });\n      }\n      try {\n        headers.append(normalized, text);\n      } catch {\n        // Web Headers errors can embed credentials in their message. Never retain\n        // that error, and never discard one bad credential to try another one.\n        throw AuthFailures.rejected({\n          status: 401,\n          reason: \"MALFORMED_CREDENTIALS\",\n        });\n      }\n    }\n  }\n  return headers;\n}\n\nexport function grpcCarrier(\n  options: { metadata?: readonly string[] } = {},\n): RpcCredentialCarrier {\n  return {\n    id: \"grpc\",\n    matches: (context) =>\n      !!method(context.getArgByIndex(1), \"get\") &&\n      !!method(context.getArgByIndex(1), \"getMap\"),\n    headers: (context) =>\n      extract(\n        method(context.getArgByIndex(1), \"getMap\")?.(),\n        options.metadata ?? credentialNames,\n      ),\n    toException(failure) {\n      const name =\n        failure.status === 401\n          ? \"GrpcUnauthenticatedException\"\n          : failure.status === 403\n            ? \"GrpcPermissionDeniedException\"\n            : \"GrpcResourceExhaustedException\";\n      const Native = (\n        microservices as unknown as Record<\n          string,\n          new (\n            message: string,\n          ) => Error & { getError(): object }\n        >\n      )[name];\n      // Native gRPC exceptions require an opt-in Nest filter. Wrap their payload\n      // so the default RPC filter also delivers the numeric status.\n      return new microservices.RpcException(\n        Native\n          ? new Native(failure.message).getError()\n          : {\n              code:\n                failure.status === 401 ? 16 : failure.status === 403 ? 7 : 8,\n              message: failure.message,\n            },\n      );\n    },\n  };\n}\n\nexport function natsCarrier(\n  options: { headers?: readonly string[] } = {},\n): RpcCredentialCarrier {\n  return {\n    id: \"nats\",\n    matches: (context) => !!method(contextOf(context), \"getHeaders\"),\n    headers(context) {\n      const input = method(contextOf(context), \"getHeaders\")?.();\n      const keys = method(input, \"keys\")?.();\n      const get = method(input, \"get\");\n      const values: RecordValue = Object.create(null);\n      if (Array.isArray(keys) && get) {\n        for (const key of keys) {\n          if (typeof key === \"string\") {\n            values[key] = get(key);\n          }\n        }\n      }\n      return extract(values, options.headers ?? credentialNames);\n    },\n  };\n}\n\nexport function kafkaCarrier(\n  options: { headers?: readonly string[] } = {},\n): RpcCredentialCarrier {\n  const message = (context: ExecutionContext) =>\n    record(method(contextOf(context), \"getMessage\")?.());\n  return {\n    id: \"kafka\",\n    matches: (context) =>\n      message(context) !== undefined && \"headers\" in message(context)!,\n    headers: (context) =>\n      extract(message(context)?.headers, options.headers ?? credentialNames),\n  };\n}\n\nexport function rmqCarrier(\n  options: { headers?: readonly string[] } = {},\n): RpcCredentialCarrier {\n  const message = (context: ExecutionContext) =>\n    record(method(contextOf(context), \"getMessage\")?.());\n  return {\n    id: \"rmq\",\n    matches: (context) =>\n      message(context) !== undefined && \"properties\" in message(context)!,\n    headers: (context) =>\n      extract(\n        record(message(context)?.properties)?.headers,\n        options.headers ?? credentialNames,\n      ),\n  };\n}\n\nexport function mqttCarrier(\n  options: { userProperties?: readonly string[] } = {},\n): RpcCredentialCarrier {\n  return {\n    id: \"mqtt\",\n    matches: (context) => !!method(contextOf(context), \"getPacket\"),\n    headers: (context) =>\n      extract(\n        record(record(method(contextOf(context), \"getPacket\")?.())?.properties)\n          ?.userProperties,\n        options.userProperties ?? credentialNames,\n      ),\n  };\n}\n\nexport function payloadCarrier(\n  options: { field?: string } = {},\n): RpcCredentialCarrier {\n  const payload = (context: ExecutionContext) => {\n    const data = record(context.switchToRpc().getData<unknown>());\n    const field = options.field ?? \"auth\";\n    return data && Object.hasOwn(data, field) ? record(data[field]) : undefined;\n  };\n  return {\n    id: \"payload\",\n    matches: (context) => payload(context) !== undefined,\n    headers: (context) => extract(payload(context), credentialNames),\n  };\n}\n\nexport const defaultCarriers: readonly RpcCredentialCarrier[] = Object.freeze([\n  grpcCarrier(),\n  natsCarrier(),\n  kafkaCarrier(),\n  rmqCarrier(),\n  mqttCarrier(),\n  payloadCarrier(),\n]);\n","import { Logger, type ExecutionContext } from \"@nestjs/common\";\nimport { MetadataScanner } from \"@nestjs/core\";\nimport { MessagePattern, RpcException } from \"@nestjs/microservices\";\nimport type {\n  AuthTransport,\n  BootAdvice,\n  ExtensionRef,\n  TransportCall,\n  TransportValidationContext,\n} from \"./auth-contracts.js\";\nimport {\n  BetterAuthConfigurationError,\n  AuthFailures,\n  type AuthFailure,\n} from \"./auth-errors.js\";\nimport {\n  defaultCarriers,\n  grpcCarrier,\n  type RpcCredentialCarrier,\n} from \"./rpc-carriers.js\";\n\nexport interface RpcTransportOptions {\n  carriers?: readonly RpcCredentialCarrier[];\n  hybridCoverage?: \"error\" | \"warn\" | \"off\";\n  inheritAppConfig?: boolean;\n}\n\nexport function rpcTransport(\n  options: RpcTransportOptions = {},\n): ExtensionRef<AuthTransport> {\n  const carriers = [...(options.carriers ?? defaultCarriers)];\n  const select = (context: ExecutionContext) =>\n    carriers.find((carrier) => carrier.matches(context));\n  const grpc = grpcCarrier();\n  return {\n    id: \"rpc\",\n    requires: { hostlessCalls: true },\n    handles: (context) => context.getType() === \"rpc\",\n    describe(context): TransportCall {\n      const candidate = context.switchToRpc().getContext<unknown>();\n      const key =\n        candidate !== null && typeof candidate === \"object\"\n          ? candidate\n          : context.getArgs();\n      return {\n        key,\n        invocation: key,\n        cookies: null,\n        clientIp: null,\n        headers() {\n          const input = select(context)?.headers(context);\n          try {\n            return new Headers(input);\n          } catch {\n            // Custom carriers may return a raw HeadersInit. Conversion errors\n            // include its values, so discard the original error and its cause.\n            throw AuthFailures.rejected({\n              status: 401,\n              reason: \"MALFORMED_CREDENTIALS\",\n            });\n          }\n        },\n        param(name) {\n          const data = context.switchToRpc().getData<unknown>();\n          return data !== null &&\n            typeof data === \"object\" &&\n            Object.hasOwn(data, name)\n            ? (data as Record<string, unknown>)[name]\n            : undefined;\n        },\n      };\n    },\n    toException(failure: AuthFailure, context) {\n      const carrier = select(context);\n      return carrier?.toException\n        ? carrier.toException(failure, context)\n        : new RpcException({\n            status: \"error\",\n            statusCode: failure.status,\n            code: failure.code,\n            ...(failure.reason ? { reason: failure.reason } : {}),\n            message: failure.message,\n          });\n    },\n    toInternalException(error, context, info) {\n      if (!grpc.matches(context)) {\n        return error;\n      }\n      if (!info.repeated) {\n        new Logger(\"BetterAuthRpc\").error(error);\n      }\n      return new RpcException({ code: 13, message: \"Internal server error\" });\n    },\n    validate(context: TransportValidationContext) {\n      class Probe {\n        handler(): void {}\n      }\n      MessagePattern(\"nsba-probe\")(\n        Probe.prototype,\n        \"handler\",\n        Object.getOwnPropertyDescriptor(Probe.prototype, \"handler\")!,\n      );\n      const patterns: unknown = Reflect.getMetadata(\n        \"microservices:pattern\",\n        Probe.prototype.handler,\n      );\n      if (!Array.isArray(patterns) || patterns[0] !== \"nsba-probe\") {\n        throw new BetterAuthConfigurationError(\n          \"NEST_METADATA_KEY_CHANGED\",\n          \"Nest RPC pattern metadata failed its canary\",\n        );\n      }\n      const explicit = context.hasHttpAdapter && !options.inheritAppConfig;\n      const scanner = new MetadataScanner();\n      for (const wrapper of context.discovery.getControllers()) {\n        const target = wrapper.metatype;\n        if (!target?.prototype || wrapper.isAlias) {\n          continue;\n        }\n        for (const name of scanner.getAllMethodNames(target.prototype)) {\n          if (\n            Reflect.getMetadata(\n              \"microservices:pattern\",\n              target.prototype[name],\n            ) === undefined\n          ) {\n            continue;\n          }\n          context.claim(target, name, explicit ? \"explicit\" : \"global\", {\n            code: \"RPC_HANDLER_UNGUARDED\",\n            everyHandler: explicit,\n            coverage: explicit ? (options.hybridCoverage ?? \"error\") : \"error\",\n            hint: \"Add @UseBetterAuth() or @Public() to the RPC controller/handler, or assert inheritAppConfig and pass { inheritAppConfig: true } to every connectMicroservice call.\",\n          });\n        }\n      }\n    },\n    advise(): readonly BootAdvice[] {\n      return options.inheritAppConfig\n        ? [\n            {\n              level: \"warn\",\n              code: \"W_RPC_INHERIT_APP_CONFIG_ASSERTED\",\n              message:\n                \"RPC coverage assumes every connectMicroservice() call passes { inheritAppConfig: true }. Prefer @UseBetterAuth() on message controllers for verifiable coverage.\",\n            },\n          ]\n        : [];\n    },\n  } satisfies AuthTransport;\n}\n"],"mappings":";;;;;;AAWA,MAAM,kBAAkB;CAAC;CAAiB;CAAU;AAAW;AAG/D,SAAS,OAAO,OAAyC;CACvD,OAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IACrE,QACD,KAAA;AACN;AACA,SAAS,OACP,OACA,MAC+C;CAE/C,MAAM,YADS,OAAO,KACC,CAAC,GAAG;CAC3B,OAAO,OAAO,cAAc,aAAa,UAAU,KAAK,KAAK,IAAI,KAAA;AACnE;AACA,SAAS,UAAU,SAAoC;CACrD,OAAO,QAAQ,YAAY,CAAC,CAAC,WAAoB;AACnD;AACA,SAAS,QAAQ,OAAgB,OAAmC;CAClE,MAAM,UAAU,IAAI,QAAQ;CAC5B,MAAM,UAAU,IAAI,IAAI,MAAM,KAAK,SAAS,KAAK,YAAY,CAAC,CAAC;CAE/D,KAAK,MAAM,QAAQ;EACjB;EACA;EACA;EACA;CACF,GACE,QAAQ,OAAO,IAAI;CAErB,MAAM,SAAS,OAAO,KAAK;CAC3B,IAAI,CAAC,QACH,OAAO;CAET,KAAK,MAAM,QAAQ,OAAO,KAAK,MAAM,GAAG;EACtC,MAAM,aAAa,KAAK,YAAY;EACpC,IAAI,CAAC,QAAQ,IAAI,UAAU,GACzB;EAEF,MAAM,QAAQ,OAAO;EACrB,MAAM,SAAS,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK;EACpD,IAAI,OAAO,WAAW,GACpB,MAAM,aAAa,SAAS;GAC1B,QAAQ;GACR,QAAQ;EACV,CAAC;EAEH,KAAK,MAAM,QAAQ,QAAQ;GACzB,MAAM,OACJ,OAAO,SAAS,WACZ,OACA,OAAO,SAAS,IAAI,IAClB,KAAK,SAAS,MAAM,IACpB,KAAA;GACR,IAAI,SAAS,KAAA,KAAa,WAAW,KAAK,IAAI,GAC5C,MAAM,aAAa,SAAS;IAC1B,QAAQ;IACR,QAAQ;GACV,CAAC;GAEH,IAAI;IACF,QAAQ,OAAO,YAAY,IAAI;GACjC,QAAQ;IAGN,MAAM,aAAa,SAAS;KAC1B,QAAQ;KACR,QAAQ;IACV,CAAC;GACH;EACF;CACF;CACA,OAAO;AACT;AAEA,SAAgB,YACd,UAA4C,CAAC,GACvB;CACtB,OAAO;EACL,IAAI;EACJ,UAAU,YACR,CAAC,CAAC,OAAO,QAAQ,cAAc,CAAC,GAAG,KAAK,KACxC,CAAC,CAAC,OAAO,QAAQ,cAAc,CAAC,GAAG,QAAQ;EAC7C,UAAU,YACR,QACE,OAAO,QAAQ,cAAc,CAAC,GAAG,QAAQ,CAAC,GAAG,GAC7C,QAAQ,YAAY,eACtB;EACF,YAAY,SAAS;GACnB,MAAM,OACJ,QAAQ,WAAW,MACf,iCACA,QAAQ,WAAW,MACjB,kCACA;GACR,MAAM,SACJ,cAMA;GAGF,OAAO,IAAI,cAAc,aACvB,SACI,IAAI,OAAO,QAAQ,OAAO,CAAC,CAAC,SAAS,IACrC;IACE,MACE,QAAQ,WAAW,MAAM,KAAK,QAAQ,WAAW,MAAM,IAAI;IAC7D,SAAS,QAAQ;GACnB,CACN;EACF;CACF;AACF;AAEA,SAAgB,YACd,UAA2C,CAAC,GACtB;CACtB,OAAO;EACL,IAAI;EACJ,UAAU,YAAY,CAAC,CAAC,OAAO,UAAU,OAAO,GAAG,YAAY;EAC/D,QAAQ,SAAS;GACf,MAAM,QAAQ,OAAO,UAAU,OAAO,GAAG,YAAY,CAAC,GAAG;GACzD,MAAM,OAAO,OAAO,OAAO,MAAM,CAAC,GAAG;GACrC,MAAM,MAAM,OAAO,OAAO,KAAK;GAC/B,MAAM,SAAsB,OAAO,OAAO,IAAI;GAC9C,IAAI,MAAM,QAAQ,IAAI,KAAK,KACpB;SAAA,MAAM,OAAO,MAChB,IAAI,OAAO,QAAQ,UACjB,OAAO,OAAO,IAAI,GAAG;GAAA;GAI3B,OAAO,QAAQ,QAAQ,QAAQ,WAAW,eAAe;EAC3D;CACF;AACF;AAEA,SAAgB,aACd,UAA2C,CAAC,GACtB;CACtB,MAAM,WAAW,YACf,OAAO,OAAO,UAAU,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC;CACrD,OAAO;EACL,IAAI;EACJ,UAAU,YACR,QAAQ,OAAO,MAAM,KAAA,KAAa,aAAa,QAAQ,OAAO;EAChE,UAAU,YACR,QAAQ,QAAQ,OAAO,CAAC,EAAE,SAAS,QAAQ,WAAW,eAAe;CACzE;AACF;AAEA,SAAgB,WACd,UAA2C,CAAC,GACtB;CACtB,MAAM,WAAW,YACf,OAAO,OAAO,UAAU,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC;CACrD,OAAO;EACL,IAAI;EACJ,UAAU,YACR,QAAQ,OAAO,MAAM,KAAA,KAAa,gBAAgB,QAAQ,OAAO;EACnE,UAAU,YACR,QACE,OAAO,QAAQ,OAAO,CAAC,EAAE,UAAU,CAAC,EAAE,SACtC,QAAQ,WAAW,eACrB;CACJ;AACF;AAEA,SAAgB,YACd,UAAkD,CAAC,GAC7B;CACtB,OAAO;EACL,IAAI;EACJ,UAAU,YAAY,CAAC,CAAC,OAAO,UAAU,OAAO,GAAG,WAAW;EAC9D,UAAU,YACR,QACE,OAAO,OAAO,OAAO,UAAU,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,EACnE,gBACJ,QAAQ,kBAAkB,eAC5B;CACJ;AACF;AAEA,SAAgB,eACd,UAA8B,CAAC,GACT;CACtB,MAAM,WAAW,YAA8B;EAC7C,MAAM,OAAO,OAAO,QAAQ,YAAY,CAAC,CAAC,QAAiB,CAAC;EAC5D,MAAM,QAAQ,QAAQ,SAAS;EAC/B,OAAO,QAAQ,OAAO,OAAO,MAAM,KAAK,IAAI,OAAO,KAAK,MAAM,IAAI,KAAA;CACpE;CACA,OAAO;EACL,IAAI;EACJ,UAAU,YAAY,QAAQ,OAAO,MAAM,KAAA;EAC3C,UAAU,YAAY,QAAQ,QAAQ,OAAO,GAAG,eAAe;CACjE;AACF;AAEA,MAAa,kBAAmD,OAAO,OAAO;CAC5E,YAAY;CACZ,YAAY;CACZ,aAAa;CACb,WAAW;CACX,YAAY;CACZ,eAAe;AACjB,CAAC;;;AClMD,SAAgB,aACd,UAA+B,CAAC,GACH;CAC7B,MAAM,WAAW,CAAC,GAAI,QAAQ,YAAY,eAAgB;CAC1D,MAAM,UAAU,YACd,SAAS,MAAM,YAAY,QAAQ,QAAQ,OAAO,CAAC;CACrD,MAAM,OAAO,YAAY;CACzB,OAAO;EACL,IAAI;EACJ,UAAU,EAAE,eAAe,KAAK;EAChC,UAAU,YAAY,QAAQ,QAAQ,MAAM;EAC5C,SAAS,SAAwB;GAC/B,MAAM,YAAY,QAAQ,YAAY,CAAC,CAAC,WAAoB;GAC5D,MAAM,MACJ,cAAc,QAAQ,OAAO,cAAc,WACvC,YACA,QAAQ,QAAQ;GACtB,OAAO;IACL;IACA,YAAY;IACZ,SAAS;IACT,UAAU;IACV,UAAU;KACR,MAAM,QAAQ,OAAO,OAAO,CAAC,EAAE,QAAQ,OAAO;KAC9C,IAAI;MACF,OAAO,IAAI,QAAQ,KAAK;KAC1B,QAAQ;MAGN,MAAM,aAAa,SAAS;OAC1B,QAAQ;OACR,QAAQ;MACV,CAAC;KACH;IACF;IACA,MAAM,MAAM;KACV,MAAM,OAAO,QAAQ,YAAY,CAAC,CAAC,QAAiB;KACpD,OAAO,SAAS,QACd,OAAO,SAAS,YAChB,OAAO,OAAO,MAAM,IAAI,IACrB,KAAiC,QAClC,KAAA;IACN;GACF;EACF;EACA,YAAY,SAAsB,SAAS;GACzC,MAAM,UAAU,OAAO,OAAO;GAC9B,OAAO,SAAS,cACZ,QAAQ,YAAY,SAAS,OAAO,IACpC,IAAI,aAAa;IACf,QAAQ;IACR,YAAY,QAAQ;IACpB,MAAM,QAAQ;IACd,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;IACnD,SAAS,QAAQ;GACnB,CAAC;EACP;EACA,oBAAoB,OAAO,SAAS,MAAM;GACxC,IAAI,CAAC,KAAK,QAAQ,OAAO,GACvB,OAAO;GAET,IAAI,CAAC,KAAK,UACR,IAAI,OAAO,eAAe,CAAC,CAAC,MAAM,KAAK;GAEzC,OAAO,IAAI,aAAa;IAAE,MAAM;IAAI,SAAS;GAAwB,CAAC;EACxE;EACA,SAAS,SAAqC;GAC5C,MAAM,MAAM;IACV,UAAgB,CAAC;GACnB;GACA,eAAe,YAAY,CAAC,CAC1B,MAAM,WACN,WACA,OAAO,yBAAyB,MAAM,WAAW,SAAS,CAC5D;GACA,MAAM,WAAoB,QAAQ,YAChC,yBACA,MAAM,UAAU,OAClB;GACA,IAAI,CAAC,MAAM,QAAQ,QAAQ,KAAK,SAAS,OAAO,cAC9C,MAAM,IAAI,6BACR,6BACA,6CACF;GAEF,MAAM,WAAW,QAAQ,kBAAkB,CAAC,QAAQ;GACpD,MAAM,UAAU,IAAI,gBAAgB;GACpC,KAAK,MAAM,WAAW,QAAQ,UAAU,eAAe,GAAG;IACxD,MAAM,SAAS,QAAQ;IACvB,IAAI,CAAC,QAAQ,aAAa,QAAQ,SAChC;IAEF,KAAK,MAAM,QAAQ,QAAQ,kBAAkB,OAAO,SAAS,GAAG;KAC9D,IACE,QAAQ,YACN,yBACA,OAAO,UAAU,KACnB,MAAM,KAAA,GAEN;KAEF,QAAQ,MAAM,QAAQ,MAAM,WAAW,aAAa,UAAU;MAC5D,MAAM;MACN,cAAc;MACd,UAAU,WAAY,QAAQ,kBAAkB,UAAW;MAC3D,MAAM;KACR,CAAC;IACH;GACF;EACF;EACA,SAAgC;GAC9B,OAAO,QAAQ,mBACX,CACE;IACE,OAAO;IACP,MAAM;IACN,SACE;GACJ,CACF,IACA,CAAC;EACP;CACF;AACF"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "nestjs-slightly-better-auth",
-  "version": "1.0.0",
-  "description": "A Better Auth integration for NestJS with Express and Fastify platforms, admin, organization and API-key authorization",
+  "version": "1.1.0",
+  "description": "A Better Auth integration for NestJS with Express and Fastify platforms, microservice RPC transports, and admin, organization and API-key authorization",
   "license": "MIT",
   "author": "thilllon",
   "type": "module",
@@ -79,6 +79,20 @@
         "default": "./dist/fastify.cjs"
       }
     },
+    "./microservices": {
+      "module-sync": {
+        "types": "./dist/microservices.d.mts",
+        "default": "./dist/microservices.mjs"
+      },
+      "import": {
+        "types": "./dist/microservices.d.mts",
+        "default": "./dist/microservices.mjs"
+      },
+      "require": {
+        "types": "./dist/microservices.d.cts",
+        "default": "./dist/microservices.cjs"
+      }
+    },
     "./admin": {
       "module-sync": {
         "types": "./dist/admin.d.mts",
@@ -150,11 +164,20 @@
     "nest",
     "better-auth",
     "authentication",
+    "microservices",
+    "rpc",
+    "grpc",
     "typescript"
   ],
+  "peerDependenciesMeta": {
+    "@nestjs/microservices": {
+      "optional": true
+    }
+  },
   "peerDependencies": {
     "@nestjs/common": "^12.0.3",
     "@nestjs/core": "^12.0.3",
+    "@nestjs/microservices": "^12.0.3",
     "better-auth": ">=1.7.5 <2",
     "reflect-metadata": "^0.2.2",
     "rxjs": "^7.8.2"
@@ -165,22 +188,31 @@
   },
   "devDependencies": {
     "@better-auth/api-key": "1.7.5",
+    "@grpc/grpc-js": "1.14.5",
+    "@grpc/proto-loader": "0.8.1",
+    "@nats-io/transport-node": "3.4.0",
     "@nestjs/common": "12.0.3",
     "@nestjs/core": "12.0.3",
+    "@nestjs/microservices": "12.0.3",
     "@nestjs/platform-express": "12.0.3",
     "@nestjs/platform-fastify": "12.0.3",
     "@nestjs/testing": "12.0.3",
     "@types/express": "5.0.6",
     "@types/node": "24.13.5",
     "@types/pg": "8.23.1",
+    "amqp-connection-manager": "5.0.0",
+    "amqplib": "2.0.1",
     "better-auth": "1.7.5",
     "express": "5.2.1",
+    "ioredis": "6.0.0",
+    "kafkajs": "2.2.4",
+    "mqtt": "5.16.0",
     "pg": "8.23.0",
     "reflect-metadata": "0.2.2",
     "rxjs": "7.8.2"
   },
   "scripts": {
-    "typecheck": "tsc -p tsconfig.test.json",
+    "typecheck": "tsc --project tsconfig.test.json",
     "build": "tsdown"
   }
 }