nestjs-slightly-better-auth 1.0.0

package/dist/auth-decorators-DfAJbHar.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-decorators-DfAJbHar.mjs","names":["tokens.ACCESS_METADATA","tokens.FRESHNESS_METADATA","tokens.AUTH_INSTANCE_METADATA","tokens.ACCEPT_PRINCIPALS_METADATA","tokens.SKIP_DEFAULT_REQUIREMENTS_METADATA","tokens.FORWARD_COOKIES_METADATA","tokens.SKIP_ORIGIN_CHECK_METADATA","tokens.USE_BETTER_AUTH_METADATA","tokens.REQUIREMENTS_METADATA","tokens.READER_CONTEXT","tokens.PRINCIPAL_PARAMS_METADATA","tokens.INVOCATION_VALUES","tokens.INVOCATION_PARAMS_METADATA","tokens.HOOK_METADATA","tokens.DB_HOOK_METADATA"],"sources":["../src/auth-tokens.ts","../src/principal-resolver.ts","../src/auth-guard.ts","../src/auth-scope-interceptor.ts","../src/request-scope.ts","../src/principal-readings.ts","../src/auth-decorators.ts"],"sourcesContent":["/** Stable Nest injection tokens shared by every package copy and module format. */\nfunction instanceToken(base: string, alias?: string): string {\n  return alias === undefined || alias === \"\" || alias === \"default\"\n    ? base\n    : `${base}_${alias}`;\n}\n\nexport function getBetterAuthInstanceToken(alias?: string): string {\n  return instanceToken(\"NESTJS_SLIGHTLY_BETTER_AUTH_INSTANCE\", alias);\n}\n\nexport function getBetterAuthOptionsToken(alias?: string): string {\n  return instanceToken(\"NESTJS_SLIGHTLY_BETTER_AUTH_OPTIONS\", alias);\n}\n\nexport function getBetterAuthServiceToken(alias?: string): string {\n  return instanceToken(\"NESTJS_SLIGHTLY_BETTER_AUTH_SERVICE\", alias);\n}\n\nexport function getBetterAuthHandleToken(alias?: string): string {\n  return instanceToken(\"NESTJS_SLIGHTLY_BETTER_AUTH_HANDLE\", alias);\n}\n\n// Shared application collaborators and metadata must also survive duplicate copies.\nexport const INSTANCE_REGISTRY = Symbol.for(\n  \"nestjs-slightly-better-auth:instance-registry\",\n);\nexport const REQUEST_SCOPE = Symbol.for(\n  \"nestjs-slightly-better-auth:request-scope\",\n);\nexport const PRINCIPAL_READINGS = Symbol.for(\n  \"nestjs-slightly-better-auth:principal-readings\",\n);\nexport const ROUTE_PLANNER = Symbol.for(\n  \"nestjs-slightly-better-auth:route-planner\",\n);\nexport const TRANSPORT_REGISTRY = Symbol.for(\n  \"nestjs-slightly-better-auth:transport-registry\",\n);\nexport const POLICY_RESOLVER = Symbol.for(\n  \"nestjs-slightly-better-auth:policy-resolver\",\n);\nexport const MOUNT_COORDINATOR = Symbol.for(\n  \"nestjs-slightly-better-auth:mount-coordinator\",\n);\nexport const GUARD_CORE = Symbol.for(\"nestjs-slightly-better-auth:guard-core\");\nexport const SCOPE_CORE = Symbol.for(\"nestjs-slightly-better-auth:scope-core\");\nexport const PRINCIPAL_RESOLVER = Symbol.for(\n  \"nestjs-slightly-better-auth:principal-resolver\",\n);\nexport const POLICY_INVOKER = Symbol.for(\n  \"nestjs-slightly-better-auth:policy-invoker\",\n);\nexport const PLATFORMS = Symbol.for(\"nestjs-slightly-better-auth:platforms\");\nexport const TRANSPORTS = Symbol.for(\"nestjs-slightly-better-auth:transports\");\nexport const ACCESS_METADATA = Symbol.for(\"nestjs-slightly-better-auth:access\");\nexport const ACCEPT_PRINCIPALS_METADATA = Symbol.for(\n  \"nestjs-slightly-better-auth:accept-principals\",\n);\nexport const REQUIREMENTS_METADATA = Symbol.for(\n  \"nestjs-slightly-better-auth:requirements\",\n);\nexport const SKIP_DEFAULT_REQUIREMENTS_METADATA = Symbol.for(\n  \"nestjs-slightly-better-auth:skip-default-requirements\",\n);\nexport const FRESHNESS_METADATA = Symbol.for(\n  \"nestjs-slightly-better-auth:freshness\",\n);\nexport const AUTH_INSTANCE_METADATA = Symbol.for(\n  \"nestjs-slightly-better-auth:auth-instance\",\n);\nexport const PRINCIPAL_PARAMS_METADATA = Symbol.for(\n  \"nestjs-slightly-better-auth:principal-params\",\n);\nexport const INVOCATION_PARAMS_METADATA = Symbol.for(\n  \"nestjs-slightly-better-auth:invocation-params\",\n);\nexport const FORWARD_COOKIES_METADATA = Symbol.for(\n  \"nestjs-slightly-better-auth:forward-cookies\",\n);\nexport const SKIP_ORIGIN_CHECK_METADATA = Symbol.for(\n  \"nestjs-slightly-better-auth:skip-origin-check\",\n);\nexport const USE_BETTER_AUTH_METADATA = Symbol.for(\n  \"nestjs-slightly-better-auth:use-better-auth\",\n);\nexport const HOOK_METADATA = Symbol.for(\"nestjs-slightly-better-auth:hook\");\nexport const DB_HOOK_METADATA = Symbol.for(\n  \"nestjs-slightly-better-auth:db-hook\",\n);\nexport const AUTH_ENHANCER = Symbol.for(\"nestjs-slightly-better-auth:enhancer\");\n\nexport function getPrincipalSourcesToken(instance: string): symbol {\n  return Symbol.for(\n    `nestjs-slightly-better-auth:principal-sources:${instance}`,\n  );\n}\n\nexport function getExtensionToken(\n  point: \"platforms\" | \"transports\" | \"principals\",\n  instance: string,\n  index: number,\n): symbol {\n  return Symbol.for(\n    `nestjs-slightly-better-auth:ext:${point}:${instance}:${index}`,\n  );\n}\n\nexport const READER_CONTEXT = Symbol.for(\n  \"nestjs-slightly-better-auth:reader-context\",\n);\nexport const INVOCATION_VALUES = Symbol.for(\n  \"nestjs-slightly-better-auth:invocation\",\n);\n","import type {\n  AuthPrincipalBase,\n  PrincipalResolver,\n  PrincipalResult,\n  PrincipalSource,\n  ResolutionRequest,\n  TransportCall,\n} from \"./auth-contracts.js\";\nimport {\n  type AuthFailure,\n  isAuthFailure,\n  normalizeThrown,\n  createInfrastructureError,\n  isConfigurationError,\n  isInfrastructureError,\n} from \"./auth-errors.js\";\nimport type { InstanceEntry, InstanceLookup } from \"./instance-registry.js\";\nimport type { TransportRegistry } from \"./transport-registry.js\";\nimport type { RequestScope } from \"./request-scope.js\";\n\nexport const definePrincipalSource = <P extends AuthPrincipalBase>(\n  source: PrincipalSource<P>,\n): PrincipalSource<P> => source;\nexport const authenticated = <P extends AuthPrincipalBase>(\n  principal: P,\n): PrincipalResult<P> => ({ outcome: \"authenticated\", principal });\nexport const absent = (): PrincipalResult<never> => ({ outcome: \"absent\" });\nexport const rejected = (failure: AuthFailure): PrincipalResult<never> => ({\n  outcome: \"rejected\",\n  failure,\n});\n\nexport class MemoKeys {\n  private readonly owners = new WeakMap<\n    object,\n    {\n      objects: WeakMap<object, number>;\n      symbols: Map<symbol, number>;\n      next: number;\n    }\n  >();\n\n  key(\n    owner: object,\n    namespace: string,\n    value: string | object | symbol,\n  ): string {\n    if (typeof value === \"string\") {\n      return JSON.stringify([namespace, \"string\", value]);\n    }\n    let identities = this.owners.get(owner);\n    if (!identities) {\n      identities = { objects: new WeakMap(), symbols: new Map(), next: 0 };\n      this.owners.set(owner, identities);\n    }\n    let id =\n      typeof value === \"symbol\"\n        ? identities.symbols.get(value)\n        : identities.objects.get(value);\n    if (id === undefined) {\n      id = ++identities.next;\n      if (typeof value === \"symbol\") {\n        identities.symbols.set(value, id);\n      } else {\n        identities.objects.set(value, id);\n      }\n    }\n    return JSON.stringify([namespace, typeof value, id]);\n  }\n}\nexport function requestHeaders(\n  call: TransportCall,\n  entry: InstanceEntry,\n): Headers {\n  const headers = new Headers(call.headers());\n  for (const name of [...headers.keys()]) {\n    if (\n      name.startsWith(\":\") ||\n      name.startsWith(\"x-nsba-ip-\") ||\n      name === entry.bridge.clientIpHeader\n    ) {\n      headers.delete(name);\n    }\n  }\n  if (entry.bridge.clientIpHeader && call.clientIp) {\n    headers.set(entry.bridge.clientIpHeader, call.clientIp);\n  }\n  return headers;\n}\nexport function normalizeForRequest(\n  error: unknown,\n  where: \"source\" | \"policy\",\n  site: string,\n  entry: InstanceEntry,\n  headers: Headers,\n) {\n  try {\n    return normalizeThrown(error, where, site, [], entry.options.errors);\n  } catch (normalized) {\n    if (\n      isConfigurationError(normalized) ||\n      (isInfrastructureError(error) && normalized === error)\n    ) {\n      throw normalized;\n    }\n    throw createInfrastructureError(error, {\n      headers,\n      credentialHeaders: entry.credentialHeaders,\n      exposeRawCause: entry.options.errors?.exposeRawCause,\n    });\n  }\n}\nexport class ChainPrincipalResolver implements PrincipalResolver {\n  private readonly keys = new MemoKeys();\n\n  constructor(\n    private readonly instances: InstanceLookup,\n    private readonly scope: RequestScope,\n    private readonly transports: TransportRegistry,\n  ) {}\n\n  resolve(\n    call: TransportCall,\n    request: ResolutionRequest,\n  ): Promise<PrincipalResult> {\n    const entry = this.instances.get(request.auth.name);\n    const compute = async (): Promise<PrincipalResult> => {\n      const headers = requestHeaders(call, entry);\n      const sources = request.reclassify\n        ? entry.sources.filter(\n            (source) =>\n              source.id === request.reclassify!.sourceId &&\n              source.sessionBacked,\n          )\n        : entry.sources.filter((source) =>\n            source.kinds.some((kind) => request.accepts.has(kind)),\n          );\n      return request.auth.run(\n        {\n          cookies: call.cookies,\n          forward: \"same-credential\",\n          inbound: () => headers,\n          internal: true,\n        },\n        async () => {\n          for (const source of sources) {\n            const input = {\n              headers,\n              cookies: call.cookies,\n              transport: this.transports.idOf(call),\n              request: call.request,\n              freshness: request.freshness,\n              auth: request.auth,\n              memo: <T>(\n                key: string | object | symbol,\n                fn: () => Promise<T>,\n              ): Promise<T> =>\n                this.scope.memoPolicyIo(\n                  call.key,\n                  entry.name,\n                  this.keys.key(call.key, `source:${source.id}`, key),\n                  fn,\n                  entry.options.limits?.maxAuthorizationCallsPerRequest,\n                ),\n            };\n            try {\n              if (source.appliesTo && !source.appliesTo(input)) {\n                continue;\n              }\n              const result = await source.resolve(input);\n              if (\n                result.outcome === \"authenticated\" &&\n                (!source.kinds.includes(result.principal.kind) ||\n                  result.principal.source !== source.id ||\n                  Boolean(result.principal.delegation) !==\n                    Boolean(source.delegates))\n              ) {\n                throw new Error(\n                  `Principal source ${source.id} violated its declared principal contract`,\n                );\n              }\n              if (result.outcome !== \"absent\") {\n                return result;\n              }\n            } catch (error) {\n              const failure = normalizeForRequest(\n                error,\n                \"source\",\n                source.id,\n                entry,\n                headers,\n              );\n              if (isAuthFailure(failure)) {\n                return rejected(failure);\n              }\n              throw error;\n            }\n          }\n          return absent();\n        },\n      );\n    };\n    return request.reclassify\n      ? compute()\n      : this.scope.memoPrincipal(\n          call,\n          {\n            instance: entry.name,\n            freshness: request.freshness,\n            sourceSet: request.sourceSet,\n          },\n          compute,\n        );\n  }\n}\n","import {\n  Inject,\n  Injectable,\n  type CanActivate,\n  type ExecutionContext,\n} from \"@nestjs/common\";\nimport type {\n  AuthTransport,\n  PrincipalResolver,\n  RoutePlan,\n  TransportCall,\n} from \"./auth-contracts.js\";\nimport {\n  AuthFailures,\n  BetterAuthConfigurationError,\n  isAuthFailure,\n  isConfigurationError,\n  isInfrastructureError,\n} from \"./auth-errors.js\";\nimport { AUTH_ENHANCER, GUARD_CORE } from \"./auth-tokens.js\";\nimport type { AuthorizationEvaluator } from \"./authorization-evaluator.js\";\nimport type { InstanceLookup } from \"./instance-registry.js\";\nimport type { PrincipalReadings } from \"./principal-readings.js\";\nimport type { RequestScope } from \"./request-scope.js\";\nimport type { RoutePlanner } from \"./route-planner.js\";\nimport type { TransportRegistry } from \"./transport-registry.js\";\n\n@Injectable()\nexport class BetterAuthGuard implements CanActivate {\n  static readonly [AUTH_ENHANCER] = \"guard\";\n  readonly [AUTH_ENHANCER] = \"guard\";\n\n  constructor(\n    @Inject(GUARD_CORE) private readonly core: Pick<GuardCore, \"canActivate\">,\n  ) {}\n\n  canActivate(context: ExecutionContext): Promise<boolean> {\n    return this.core.canActivate(context);\n  }\n}\nexport class GuardCore implements CanActivate {\n  constructor(\n    private readonly instances: InstanceLookup,\n    private readonly planner: RoutePlanner,\n    private readonly transports: TransportRegistry,\n    private readonly resolver: PrincipalResolver,\n    private readonly evaluator: AuthorizationEvaluator,\n    private readonly scope: RequestScope,\n    private readonly readings: PrincipalReadings,\n  ) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    let transport: AuthTransport | undefined;\n    let call: TransportCall | undefined;\n    let plan: RoutePlan | undefined;\n    try {\n      plan = this.planner.forContext(context);\n      if (plan.access === \"inherit\") {\n        transport = this.transports.find(context);\n        const lineage = transport?.lineage?.(context);\n        if (lineage && !this.readings.enclosing(lineage, context.getArgs())) {\n          call = this.transports.describe(context, transport);\n          throw BetterAuthConfigurationError.atRequest(\n            \"NO_ENCLOSING_DECISION\",\n            \"An inherited invocation has no enclosing guard decision\",\n            { site: plan.site },\n          );\n        }\n        if (plan.originCheck !== \"form\") {\n          return true;\n        }\n      }\n      if (plan.access === \"public\" && plan.originCheck !== \"form\") {\n        const lineage = this.transports.find(context)?.lineage?.(context);\n        if (lineage && !plan.nested) {\n          this.readings.recordLineage(lineage, {\n            outcome: \"no-identity\",\n            instance: plan.instance,\n          });\n        }\n        return true;\n      }\n      transport = this.transports.select(context);\n      call = this.transports.describe(context, transport);\n      const entry = this.instances.get(plan.instance);\n      if (plan.originCheck !== \"off\") {\n        const browser = call.browser;\n        if (browser) {\n          if (plan.originCheck === \"form\" || browser.enforce) {\n            const failure = await entry.origin.check(browser, plan.originCheck);\n            if (failure) {\n              throw failure;\n            }\n          } else {\n            await entry.origin.advisory(browser);\n          }\n        }\n      }\n      if (plan.access === \"inherit\") {\n        return true;\n      }\n      if (plan.access === \"public\") {\n        if (!plan.nested) {\n          this.readings.record(call, {\n            outcome: \"no-identity\",\n            instance: plan.instance,\n          });\n        }\n        return true;\n      }\n      const result = await this.resolver.resolve(call, {\n        auth: entry.handle,\n        freshness: plan.freshness,\n        accepts: plan.accepts,\n        sourceSet: plan.sourceSet,\n      });\n      this.readings.record(call, { ...result, instance: plan.instance });\n      if (result.outcome === \"rejected\") {\n        throw result.failure;\n      }\n      if (result.outcome === \"absent\") {\n        if (plan.access === \"optional\") {\n          return true;\n        }\n        throw AuthFailures.unauthenticated();\n      }\n      if (!plan.accepts.has(result.principal.kind)) {\n        throw AuthFailures.forbidden(\"PRINCIPAL_NOT_SUPPORTED\");\n      }\n      const decision = await this.evaluator.evaluate(\n        plan,\n        result.principal,\n        call,\n        entry,\n        context,\n        transport.id,\n      );\n      if (decision.effect === \"deny\") {\n        throw AuthFailures.rejected({\n          status: decision.status ?? 403,\n          reason: decision.reason,\n          message: decision.message,\n          challenge: decision.challenge,\n        });\n      }\n      return true;\n    } catch (error) {\n      if (isAuthFailure(error) && transport) {\n        const mapping =\n          plan && this.instances.get(plan.instance).options.errors?.map;\n        throw mapping\n          ? mapping(error, context, transport.id)\n          : transport.toException(error, context);\n      }\n      if (\n        (isConfigurationError(error) || isInfrastructureError(error)) &&\n        transport\n      ) {\n        const repeated = call\n          ? this.scope.surfaced(call.key, error, {\n              instance: plan?.instance ?? \"default\",\n              site: plan?.site ?? \"guard\",\n              lineage: call.lineage,\n            })\n          : false;\n        throw (\n          transport.toInternalException?.(error, context, { repeated }) ?? error\n        );\n      }\n      throw error;\n    }\n  }\n}\n","import {\n  Inject,\n  Injectable,\n  type CallHandler,\n  type ExecutionContext,\n  type NestInterceptor,\n} from \"@nestjs/common\";\nimport { Observable } from \"rxjs\";\nimport type { PrincipalReading, TransportCall } from \"./auth-contracts.js\";\nimport { AUTH_ENHANCER, READER_CONTEXT, SCOPE_CORE } from \"./auth-tokens.js\";\nimport type { ScopeView } from \"./bridge-protocol.js\";\nimport type { InstanceLookup } from \"./instance-registry.js\";\nimport type { PrincipalReadings } from \"./principal-readings.js\";\nimport { requestHeaders } from \"./principal-resolver.js\";\nimport type { RequestScope, ScopeState } from \"./request-scope.js\";\nimport type { RoutePlanner } from \"./route-planner.js\";\nimport type { TransportRegistry } from \"./transport-registry.js\";\n\n@Injectable()\nexport class BetterAuthScopeInterceptor implements NestInterceptor {\n  static readonly [AUTH_ENHANCER] = \"scope\";\n  readonly [AUTH_ENHANCER] = \"scope\";\n\n  constructor(\n    @Inject(SCOPE_CORE) private readonly core: Pick<ScopeCore, \"intercept\">,\n  ) {}\n\n  intercept(context: ExecutionContext, next: CallHandler): Observable<unknown> {\n    return this.core.intercept(context, next);\n  }\n}\nexport class ScopeCore implements NestInterceptor {\n  constructor(\n    private readonly instances: InstanceLookup,\n    private readonly planner: RoutePlanner,\n    private readonly transports: TransportRegistry,\n    private readonly scope: RequestScope,\n    private readonly readings: PrincipalReadings,\n  ) {}\n\n  intercept(context: ExecutionContext, next: CallHandler): Observable<unknown> {\n    const plan = this.planner.forContext(context);\n    const entry = this.instances.get(plan.instance);\n    let described = false;\n    let call: TransportCall | undefined;\n    const getCall = (): TransportCall | undefined => {\n      if (!described) {\n        const transport = this.transports.find(context);\n        call = transport\n          ? this.transports.describe(context, transport)\n          : undefined;\n        described = true;\n      }\n      return call;\n    };\n    let reading: PrincipalReading | undefined;\n    const read = (): PrincipalReading => {\n      if (reading) {\n        return reading;\n      }\n      const lineage = this.transports.find(context)?.lineage?.(context);\n      reading = this.readings.read({\n        args: context.getArgs(),\n        plan,\n        lineage,\n        ...(plan.access === \"public\" || plan.access === \"inherit\"\n          ? {}\n          : { call: getCall() }),\n      });\n      return reading;\n    };\n    const instances = this.instances;\n    const view: ScopeView = {\n      get cookies() {\n        return getCall()?.cookies ?? null;\n      },\n      forward: plan.forwardDirectCalls ? \"same-credential\" : \"none\",\n      internal: false,\n      get inbound() {\n        return () => {\n          const call = getCall();\n          return call ? requestHeaders(call, entry) : new Headers();\n        };\n      },\n      get browserHeaders() {\n        const browser = getCall()?.browser;\n        return browser ? () => browser.headers() : undefined;\n      },\n      get checkCallerSession() {\n        if (plan.originCheck === \"off\") {\n          return undefined;\n        }\n        const browser = getCall()?.browser;\n        return browser\n          ? (path: string, instance: string) =>\n              instances\n                .get(instance)\n                .origin.assertCallerSession(browser, path, instance)\n          : undefined;\n      },\n    };\n    const state: ScopeState = {\n      view,\n      plan,\n      reading: read,\n      get call() {\n        return getCall();\n      },\n    };\n    const args = context.getArgs();\n    const bridge = {\n      args: [...args],\n      reading: read,\n      scope: this.scope,\n      readings: this.readings,\n    };\n    for (const arg of [args, ...args]) {\n      if (\n        arg &&\n        (typeof arg === \"object\" || typeof arg === \"function\") &&\n        Object.isExtensible(arg)\n      ) {\n        Object.defineProperty(arg, READER_CONTEXT, {\n          value: bridge,\n          configurable: true,\n        });\n      }\n    }\n    return new Observable((subscriber) =>\n      this.scope.run(state, () => {\n        const subscription = next.handle().subscribe({\n          next: (value) => this.scope.run(state, () => subscriber.next(value)),\n          error: (error) =>\n            this.scope.run(state, () => subscriber.error(error)),\n          complete: () => this.scope.run(state, () => subscriber.complete()),\n        });\n        return () => this.scope.run(state, () => subscription.unsubscribe());\n      }),\n    );\n  }\n}\n","import { AsyncLocalStorage } from \"node:async_hooks\";\nimport type {\n  AuthorizationDecision,\n  InvocationLineage,\n  PrincipalReading,\n  PrincipalResult,\n  RoutePlan,\n  TransportCall,\n} from \"./auth-contracts.js\";\nimport {\n  AuthFailures,\n  type AuthFailure,\n  isConfigurationError,\n} from \"./auth-errors.js\";\nimport type { ScopeView } from \"./bridge-protocol.js\";\n\nexport interface ScopeState {\n  readonly view: ScopeView;\n  readonly call?: TransportCall;\n  readonly plan?: RoutePlan;\n  readonly reading?: () => PrincipalReading;\n}\nexport interface RequestState {\n  readonly principal: Map<string, Promise<PrincipalResult>>;\n  readonly policyIo: Map<string, Promise<unknown>>;\n  readonly decisions: Map<string, Promise<AuthorizationDecision>>;\n  readonly values: Map<symbol, unknown>;\n  readonly authorizationCalls: Set<string>;\n  readonly origins: Map<string, Promise<AuthFailure | null>>;\n  readonly surfaced: Set<string>;\n  readonly connections: Map<\n    string,\n    {\n      value: Extract<PrincipalResult, { outcome: \"authenticated\" | \"absent\" }>;\n      expiresAt: number;\n    }\n  >;\n}\n\nconst SURFACED = Symbol.for(\"nestjs-slightly-better-auth:surfaced\");\nexport function memoKey(\n  instance: string,\n  ...inputs: readonly unknown[]\n): string {\n  return JSON.stringify([instance, ...inputs]);\n}\n\n/** Shared by guards and readers that have only the transport's structural lineage. */\nexport function surfacedRecord(\n  key: object,\n  lineage?: InvocationLineage,\n): Set<string> {\n  const carrier = lineage?.carrier ?? key;\n  const partition = lineage ? lineage.position.split(\":\", 1)[0]! : \"\";\n  let records = Reflect.get(carrier, SURFACED) as\n    | Map<string, Set<string>>\n    | undefined;\n  if (!records) {\n    records = new Map();\n    Object.defineProperty(carrier, SURFACED, { value: records });\n  }\n  let record = records.get(partition);\n  if (!record) {\n    record = new Set();\n    records.set(partition, record);\n  }\n  return record;\n}\n\nexport class RequestScope {\n  readonly #storage = new AsyncLocalStorage<ScopeState>();\n  readonly #states = new WeakMap<object, RequestState>();\n  readonly #valueKeys = new Map<string, Map<symbol, symbol>>();\n  readonly #errorIds = new WeakMap<object, number>();\n  #nextError = 0;\n\n  run<T>(state: ScopeState, fn: () => T): T {\n    return this.#storage.run(state, fn);\n  }\n\n  exit<T>(fn: () => T): T {\n    return this.#storage.exit(fn);\n  }\n\n  current(): ScopeState | undefined {\n    return this.#storage.getStore();\n  }\n\n  stateFor(key: object): RequestState {\n    let state = this.#states.get(key);\n    if (!state) {\n      state = {\n        principal: new Map(),\n        policyIo: new Map(),\n        decisions: new Map(),\n        values: new Map(),\n        authorizationCalls: new Set(),\n        origins: new Map(),\n        surfaced: new Set(),\n        connections: new Map(),\n      };\n      this.#states.set(key, state);\n    }\n    return state;\n  }\n\n  memoPrincipal(\n    call: Pick<TransportCall, \"key\" | \"connection\" | \"principalTtlMs\">,\n    input: {\n      instance: string;\n      freshness: \"default\" | \"authoritative\";\n      sourceSet: string;\n    },\n    compute: () => Promise<PrincipalResult>,\n  ): Promise<PrincipalResult> {\n    const key = memoKey(input.instance, input.freshness, input.sourceSet);\n    const state = this.stateFor(call.key);\n    const existing = state.principal.get(key);\n    if (existing) {\n      return existing;\n    }\n    const connection =\n      call.connection &&\n      input.freshness !== \"authoritative\" &&\n      (call.principalTtlMs ?? 0) > 0\n        ? this.stateFor(call.connection).connections\n        : undefined;\n    const cached = connection?.get(key);\n    const promise = Promise.resolve().then(async () => {\n      if (cached && cached.expiresAt > Date.now()) {\n        return cached.value;\n      }\n      connection?.delete(key);\n      try {\n        const value = await compute();\n        if (value.outcome !== \"rejected\") {\n          connection?.set(key, {\n            value,\n            expiresAt: Date.now() + (call.principalTtlMs ?? 0),\n          });\n        }\n        return value;\n      } catch (error) {\n        connection?.delete(key);\n        throw error;\n      }\n    });\n    state.principal.set(key, promise);\n    return promise;\n  }\n\n  memoPolicyIo<T>(\n    request: object,\n    instance: string,\n    concreteKey: string,\n    compute: () => Promise<T>,\n    limit: number | false = 100,\n  ): Promise<T> {\n    const state = this.stateFor(request);\n    const key = memoKey(instance, concreteKey);\n    const existing = state.policyIo.get(key);\n    if (existing) {\n      return existing as Promise<T>;\n    }\n    if (\n      limit !== false &&\n      [...state.authorizationCalls].filter(\n        (entry) => JSON.parse(entry)[0] === instance,\n      ).length >= limit\n    ) {\n      return Promise.reject(\n        AuthFailures.rejected({\n          status: 429,\n          reason: \"TOO_MANY_AUTHORIZATION_CHECKS\",\n        }),\n      );\n    }\n    state.authorizationCalls.add(key);\n    const promise = Promise.resolve().then(compute);\n    state.policyIo.set(key, promise);\n    return promise;\n  }\n\n  memoDecision(\n    invocation: object,\n    instance: string,\n    concreteKey: string,\n    compute: () => Promise<AuthorizationDecision>,\n  ): Promise<AuthorizationDecision> {\n    const decisions = this.stateFor(invocation).decisions;\n    const key = memoKey(instance, concreteKey);\n    let promise = decisions.get(key);\n    if (!promise) {\n      promise = Promise.resolve().then(compute);\n      decisions.set(key, promise);\n    }\n    return promise;\n  }\n\n  valueKey(instance: string, key: symbol): symbol {\n    let keys = this.#valueKeys.get(instance);\n    if (!keys) {\n      keys = new Map();\n      this.#valueKeys.set(instance, keys);\n    }\n    let namespaced = keys.get(key);\n    if (!namespaced) {\n      namespaced = Symbol(key.description);\n      keys.set(key, namespaced);\n    }\n    return namespaced;\n  }\n\n  surfaced(\n    key: object,\n    error: object,\n    context: { instance: string; site: string; lineage?: InvocationLineage },\n  ): boolean {\n    let id = this.#errorIds.get(error);\n    if (!id) {\n      id = ++this.#nextError;\n      this.#errorIds.set(error, id);\n    }\n    const reason = isConfigurationError(error)\n      ? memoKey(context.instance, error.code, context.site)\n      : `error:${id}`;\n    const carrier = surfacedRecord(key, context.lineage);\n    const state =\n      key === context.lineage?.carrier ? carrier : this.stateFor(key).surfaced;\n    const repeated = state.has(reason) || carrier.has(reason);\n    state.add(reason);\n    carrier.add(reason);\n    return repeated;\n  }\n}\n","import { IntrinsicException } from \"@nestjs/common/exceptions/intrinsic.exception.js\";\nimport type {\n  InvocationLineage,\n  PrincipalReading,\n  PrincipalResult,\n  RoutePlan,\n  TransportCall,\n} from \"./auth-contracts.js\";\nimport {\n  BetterAuthConfigurationError,\n  isConfigurationError,\n} from \"./auth-errors.js\";\nimport type { AuthPrincipal } from \"./auth-types.js\";\nimport { RequestScope } from \"./request-scope.js\";\n\nconst RESOLUTION = Symbol.for(\"nestjs-slightly-better-auth:resolution\");\nconst TEST_STAMP = Symbol.for(\"nestjs-slightly-better-auth:test-stamp\");\ninterface Records {\n  own: Map<string, PrincipalReading>;\n  positions: Map<string, PrincipalReading>;\n  lineage?: InvocationLineage;\n  invocationLineage?: InvocationLineage;\n}\ninterface TestStamp {\n  elements: readonly unknown[];\n  results: Map<string, PrincipalResult>;\n}\nexport interface ReadingInput {\n  readonly args: readonly unknown[];\n  readonly call?: TransportCall;\n  readonly lineage?: InvocationLineage;\n  readonly plan?: Pick<RoutePlan, \"access\" | \"instance\" | \"site\">;\n  readonly beforeGuard?: boolean;\n  readonly site?: string;\n}\n\nfunction object(value: unknown): value is object {\n  return (\n    value !== null && (typeof value === \"object\" || typeof value === \"function\")\n  );\n}\nfunction records(target: object, create = false): Records | undefined {\n  let value = Reflect.get(target, RESOLUTION) as Records | undefined;\n  if (!value && create) {\n    value = { own: new Map(), positions: new Map() };\n    Object.defineProperty(target, RESOLUTION, { value });\n  }\n  return value;\n}\nfunction matchingStamp(args: readonly unknown[]): TestStamp | undefined {\n  for (const target of [args, ...args]) {\n    if (!object(target)) {\n      continue;\n    }\n    const stamp = Reflect.get(target, TEST_STAMP) as TestStamp | undefined;\n    if (\n      stamp &&\n      stamp.elements.length === args.length &&\n      stamp.elements.every((value, index) => value === args[index])\n    ) {\n      return stamp;\n    }\n  }\n  return undefined;\n}\n\nfunction lineageFromArgs(\n  args: readonly unknown[],\n): InvocationLineage | undefined {\n  const targets = [args, ...args.filter(object)];\n  for (const target of targets) {\n    const own = records(target)?.invocationLineage;\n    if (own) {\n      return own;\n    }\n  }\n  for (const target of targets) {\n    const carrier = records(target)?.lineage;\n    if (!carrier) {\n      continue;\n    }\n    // The recorded callback is structural, but its recorded position may belong\n    // to a sibling operation in the same batched GraphQL carrier.\n    for (const position of carrier.enclosing(args)) {\n      return { ...carrier, position };\n    }\n  }\n  return undefined;\n}\n\n/** The intrinsic twin suppresses Nest's repeated log, while retaining the safe wire shape. */\nexport class RepeatedReaderError extends IntrinsicException {\n  constructor(error: BetterAuthConfigurationError) {\n    super(error.message);\n    Object.defineProperties(this, Object.getOwnPropertyDescriptors(error));\n  }\n}\n\nexport class PrincipalReadings {\n  constructor(private readonly scope: RequestScope) {}\n\n  record(\n    call: Pick<TransportCall, \"invocation\" | \"lineage\">,\n    reading: PrincipalReading,\n  ): void {\n    const record = records(call.invocation, true)!;\n    record.own.set(reading.instance, reading);\n    if (call.lineage) {\n      record.invocationLineage = call.lineage;\n      this.recordLineage(call.lineage, reading);\n    }\n  }\n\n  recordLineage(lineage: InvocationLineage, reading: PrincipalReading): void {\n    const value = records(lineage.carrier, true)!;\n    value.positions.set(lineage.position, reading);\n    value.lineage = lineage;\n  }\n\n  enclosing(\n    lineage: InvocationLineage,\n    args: readonly unknown[],\n  ): PrincipalReading | undefined {\n    const positions = records(lineage.carrier)?.positions;\n    for (const position of lineage.enclosing(args)) {\n      const reading = positions?.get(position);\n      if (reading) {\n        return reading;\n      }\n    }\n    return undefined;\n  }\n\n  read(input: ReadingInput): PrincipalReading {\n    const { plan, args, call } = input;\n    const lineage = input.lineage ?? call?.lineage;\n    let resolvedInstance = plan?.instance;\n    try {\n      if (plan?.access === \"public\") {\n        return { outcome: \"no-identity\", instance: plan.instance };\n      }\n      let reading: PrincipalReading | undefined;\n      let validation = lineage ?? lineageFromArgs(args);\n      if (plan?.access === \"inherit\") {\n        reading = lineage && this.enclosing(lineage, args);\n      } else {\n        const targets = call\n          ? [call.invocation]\n          : [args, ...args.filter(object)];\n        for (const target of targets) {\n          const own = records(target)?.own;\n          reading = plan\n            ? own?.get(plan.instance)\n            : own?.size === 1\n              ? own.values().next().value\n              : undefined;\n          if (reading) {\n            break;\n          }\n        }\n        if (!reading && !plan) {\n          for (const target of [args, ...args.filter(object)]) {\n            const candidate = records(target)?.lineage;\n            if (!candidate) {\n              continue;\n            }\n            reading = this.enclosing(candidate, args);\n            if (reading) {\n              validation = candidate;\n              break;\n            }\n          }\n        }\n      }\n      if (!reading) {\n        const stamp = matchingStamp(args);\n        const instance = plan?.instance ?? \"default\";\n        const result = stamp?.results.get(instance);\n        if (result) {\n          reading = { ...result, instance };\n        }\n      }\n      if (!reading) {\n        throw BetterAuthConfigurationError.atRequest(\n          input.beforeGuard && plan?.access !== \"inherit\"\n            ? \"PRINCIPAL_READ_BEFORE_GUARD\"\n            : \"NO_AUTH_RESULT\",\n          \"No authentication result: BetterAuthGuard did not run for this invocation\",\n          {\n            site: plan?.site ?? input.site,\n            hint: \"Run BetterAuthGuard before reading a principal; test replacements must stampPrincipal().\",\n          },\n        );\n      }\n      resolvedInstance = reading.instance;\n      if (reading.outcome === \"authenticated\") {\n        validation?.assertReadable?.(args);\n      }\n      return reading;\n    } catch (error) {\n      if (isConfigurationError(error)) {\n        throw this.deliver(error, input, resolvedInstance);\n      }\n      throw error;\n    }\n  }\n\n  current(): PrincipalReading {\n    const state = this.scope.current();\n    if (!state?.reading) {\n      throw BetterAuthConfigurationError.atRequest(\n        \"NO_AUTH_SCOPE\",\n        \"Principal readers require a handler scope\",\n      );\n    }\n    return state.reading();\n  }\n\n  project<T>(\n    reading: PrincipalReading,\n    spec: {\n      kind?: string;\n      reason?: string;\n      site: string;\n      project: (principal: AuthPrincipal) => T;\n    },\n    input?: ReadingInput,\n  ): T | null {\n    if (reading.outcome === \"no-identity\" || reading.outcome === \"absent\") {\n      return null;\n    }\n    if (reading.outcome === \"rejected\") {\n      throw reading.failure;\n    }\n    if (spec.kind && reading.principal.kind !== spec.kind) {\n      const error = BetterAuthConfigurationError.atRequest(\n        spec.reason ?? \"PRINCIPAL_KIND_REQUIRED\",\n        `This reader requires principal kind ${spec.kind}`,\n        {\n          site: spec.site,\n          hint: \"Use @CurrentPrincipal() or getPrincipal() and narrow p.kind.\",\n        },\n      );\n      throw this.deliver(error, input, reading.instance);\n    }\n    return spec.project(reading.principal);\n  }\n\n  deliver(\n    error: BetterAuthConfigurationError,\n    input?: ReadingInput,\n    instance?: string,\n  ): BetterAuthConfigurationError | RepeatedReaderError {\n    const state = this.scope.current();\n    const call = state?.call ?? input?.call;\n    const lineage =\n      call?.lineage ?? input?.lineage ?? (input && lineageFromArgs(input.args));\n    const key = call?.key ?? lineage?.carrier ?? input?.args;\n    if (!key) {\n      return error;\n    }\n    const repeated = this.scope.surfaced(key, error, {\n      instance:\n        instance ?? state?.plan?.instance ?? input?.plan?.instance ?? \"default\",\n      site:\n        error.site ?? input?.site ?? input?.plan?.site ?? \"principal reader\",\n      lineage,\n    });\n    return repeated ? new RepeatedReaderError(error) : error;\n  }\n\n  stamp(\n    args: readonly unknown[],\n    instance: string,\n    result: PrincipalResult,\n  ): void {\n    const stamp = matchingStamp(args) ?? {\n      elements: [...args],\n      results: new Map(),\n    };\n    stamp.results.set(instance, result);\n    for (const target of [args, ...args]) {\n      if (object(target) && Object.isExtensible(target)) {\n        Object.defineProperty(target, TEST_STAMP, {\n          value: stamp,\n          configurable: true,\n        });\n      }\n    }\n  }\n}\n","import {\n  applyDecorators,\n  createParamDecorator,\n  SetMetadata,\n  UseGuards,\n  UseInterceptors,\n  type ExecutionContext,\n} from \"@nestjs/common\";\nimport type {\n  DatabaseHookTarget,\n  DbHookMethodDecorator,\n  DbHookOptions,\n  HookMethodDecorator,\n  HookOptions,\n  HookPredicate,\n  PolicyRef,\n  PrincipalReading,\n  Requirement,\n  RequirementExpr,\n  RequirementOptions,\n} from \"./auth-contracts.js\";\nimport type {\n  EndpointPath,\n  PrincipalKind,\n  PrincipalOfKind,\n} from \"./auth-types.js\";\nimport { BetterAuthConfigurationError } from \"./auth-errors.js\";\nimport * as tokens from \"./auth-tokens.js\";\nimport { BetterAuthGuard } from \"./auth-guard.js\";\nimport { BetterAuthScopeInterceptor } from \"./auth-scope-interceptor.js\";\nimport { PrincipalReadings } from \"./principal-readings.js\";\nimport { RequestScope } from \"./request-scope.js\";\n\nfunction append(target: object, key: symbol, value: unknown): void {\n  Reflect.defineMetadata(\n    key,\n    Object.freeze([...(Reflect.getOwnMetadata(key, target) ?? []), value]),\n    target,\n  );\n}\nexport const Public = () => SetMetadata(tokens.ACCESS_METADATA, \"public\");\nexport const OptionalAuth = () =>\n  SetMetadata(tokens.ACCESS_METADATA, \"optional\");\nexport const RequireAuth = (options?: { authoritative?: boolean }) =>\n  applyDecorators(\n    SetMetadata(tokens.ACCESS_METADATA, \"required\"),\n    SetMetadata(tokens.FRESHNESS_METADATA, options?.authoritative === true),\n  );\nexport const UseAuthInstance = (name: string) =>\n  SetMetadata(tokens.AUTH_INSTANCE_METADATA, name);\nexport const AcceptPrincipals = (\n  ...kinds: readonly [PrincipalKind, ...PrincipalKind[]]\n) => SetMetadata(tokens.ACCEPT_PRINCIPALS_METADATA, Object.freeze([...kinds]));\nexport const SkipDefaultRequirements = () =>\n  SetMetadata(tokens.SKIP_DEFAULT_REQUIREMENTS_METADATA, true);\nexport const ForwardAuthCookies = (enabled = true) =>\n  SetMetadata(tokens.FORWARD_COOKIES_METADATA, enabled);\nexport const SkipOriginCheck = () =>\n  SetMetadata(tokens.SKIP_ORIGIN_CHECK_METADATA, true);\nexport const UseBetterAuth = () =>\n  applyDecorators(\n    SetMetadata(tokens.USE_BETTER_AUTH_METADATA, true),\n    UseGuards(BetterAuthGuard),\n    UseInterceptors(BetterAuthScopeInterceptor),\n  );\nexport function Require(\n  ...requirements: readonly RequirementExpr[]\n): ClassDecorator & MethodDecorator {\n  return (\n    target: object,\n    _key?: string | symbol,\n    descriptor?: PropertyDescriptor,\n  ) => {\n    for (const expression of requirements) {\n      append(\n        descriptor?.value ?? target,\n        tokens.REQUIREMENTS_METADATA,\n        expression,\n      );\n    }\n  };\n}\nexport const anyOf = (\n  ...requirements: readonly RequirementExpr[]\n): RequirementExpr => ({ anyOf: requirements });\nexport const allOf = (\n  ...requirements: readonly RequirementExpr[]\n): RequirementExpr => ({ allOf: requirements });\nexport const requirement = <P>(\n  policy: PolicyRef<P>,\n  params: P,\n  options?: RequirementOptions,\n): Requirement<P> => ({ policy, params, ...options });\n\nexport interface ReaderContext {\n  readonly args: readonly unknown[];\n  readonly readings: PrincipalReadings;\n  readonly scope: RequestScope;\n  readonly reading?: () => PrincipalReading;\n}\nexport function readerContext(context: ExecutionContext): ReaderContext {\n  const args = context.getArgs();\n  for (const arg of [args, ...args]) {\n    if (\n      (typeof arg !== \"object\" || arg === null) &&\n      typeof arg !== \"function\"\n    ) {\n      continue;\n    }\n    const bridge = Reflect.get(arg, tokens.READER_CONTEXT) as\n      | ReaderContext\n      | undefined;\n    if (\n      bridge &&\n      bridge.args.length === args.length &&\n      bridge.args.every((value, index) => value === args[index]) &&\n      bridge.reading !== undefined &&\n      bridge.scope.current()?.reading === bridge.reading\n    ) {\n      return bridge;\n    }\n  }\n  // No application state is created or retained by a DI-free lineage-only reader.\n  const scope = new RequestScope();\n  return { args, scope, readings: new PrincipalReadings(scope) };\n}\nfunction principalParam(spec?: {\n  kind: string;\n  reason: string;\n  project: (p: any) => unknown;\n}): ParameterDecorator {\n  const decorator = createParamDecorator(\n    (_data: unknown, context: ExecutionContext) => {\n      const bridge = readerContext(context);\n      const input = {\n        args: context.getArgs(),\n        site: `${context.getClass().name}.${context.getHandler().name}`,\n      };\n      const reading =\n        bridge.reading !== undefined &&\n        bridge.scope.current()?.reading === bridge.reading\n          ? bridge.readings.current()\n          : bridge.readings.read(input);\n      return bridge.readings.project(\n        reading,\n        { ...spec, site: input.site, project: spec?.project ?? ((p) => p) },\n        input,\n      );\n    },\n  )();\n  return (target, propertyKey, index) => {\n    if (propertyKey === undefined) {\n      throw new BetterAuthConfigurationError(\n        \"PRINCIPAL_PARAM_TARGET\",\n        \"Principal parameters require a handler method\",\n      );\n    }\n    const handler = Reflect.get(target, propertyKey);\n    append(handler, tokens.PRINCIPAL_PARAMS_METADATA, {\n      index,\n      ...(spec ? { kind: spec.kind, reason: spec.reason } : {}),\n    });\n    decorator(target, propertyKey, index);\n  };\n}\nexport const CurrentPrincipal = (): ParameterDecorator => principalParam();\nexport function definePrincipalParam<K extends PrincipalKind, R>(spec: {\n  readonly kind: K;\n  readonly reason: string;\n  readonly project: (principal: PrincipalOfKind<K>) => R;\n}): () => ParameterDecorator {\n  return () => principalParam(spec);\n}\nexport function defineInvocationParam(\n  slot: symbol,\n  spec: { readonly missing: string },\n): () => ParameterDecorator {\n  return () => {\n    const decorator = createParamDecorator(\n      (_data: unknown, context: ExecutionContext) => {\n        const bridge = readerContext(context);\n        const state = bridge.scope.current();\n        const input = {\n          args: context.getArgs(),\n          site: `${context.getClass().name}.${context.getHandler().name}`,\n        };\n        const reading = state?.reading\n          ? bridge.readings.current()\n          : bridge.readings.read(input);\n        const candidates = state?.call\n          ? [state.call.invocation]\n          : [input.args, ...input.args];\n        for (const candidate of candidates) {\n          if (\n            !candidate ||\n            (typeof candidate !== \"object\" && typeof candidate !== \"function\")\n          ) {\n            continue;\n          }\n          const values = Reflect.get(candidate, tokens.INVOCATION_VALUES) as\n            | Map<string, Map<symbol, unknown>>\n            | undefined;\n          if (values?.get(reading.instance)?.has(slot)) {\n            return values.get(reading.instance)!.get(slot);\n          }\n        }\n        throw bridge.readings.deliver(\n          BetterAuthConfigurationError.atRequest(\n            \"NO_INVOCATION_VALUE\",\n            spec.missing,\n            { site: input.site },\n          ),\n          input,\n          reading.instance,\n        );\n      },\n    )();\n    return (target, key, index) => {\n      if (key === undefined) {\n        throw new BetterAuthConfigurationError(\n          \"INVOCATION_PARAM_TARGET\",\n          \"Invocation parameters require a handler method\",\n        );\n      }\n      append(Reflect.get(target, key), tokens.INVOCATION_PARAMS_METADATA, {\n        index,\n        slot,\n        missing: spec.missing,\n      });\n      decorator(target, key, index);\n    };\n  };\n}\nexport interface EndpointHookDeclaration {\n  readonly phase: \"before\" | \"after\";\n  readonly match: string | readonly string[] | HookPredicate | undefined;\n  readonly options: Readonly<HookOptions>;\n  readonly method: string | symbol;\n  // biome-ignore lint/complexity/noBannedTypes: Nest handler metadata preserves the framework function identity.\n  readonly handler: Function;\n  readonly declarationOrder: number;\n}\nexport interface DatabaseHookDeclaration {\n  readonly phase: \"before\" | \"after\";\n  readonly target: DatabaseHookTarget;\n  readonly options: Readonly<DbHookOptions>;\n  readonly method: string | symbol;\n  // biome-ignore lint/complexity/noBannedTypes: Nest handler metadata preserves the framework function identity.\n  readonly handler: Function;\n  readonly declarationOrder: number;\n}\n// biome-ignore lint/complexity/noBannedTypes: Nest handler metadata preserves the framework function identity.\nexport function readHookMetadata(handler: Function): {\n  readonly hooks: readonly EndpointHookDeclaration[];\n  readonly databaseHooks: readonly DatabaseHookDeclaration[];\n} {\n  return {\n    hooks: Reflect.getOwnMetadata(tokens.HOOK_METADATA, handler) ?? [],\n    databaseHooks:\n      Reflect.getOwnMetadata(tokens.DB_HOOK_METADATA, handler) ?? [],\n  };\n}\nfunction hook<P extends string>(\n  phase: \"before\" | \"after\",\n  match?: P | readonly P[] | HookPredicate,\n  options?: HookOptions,\n): HookMethodDecorator<P> {\n  return (_target, method, descriptor) => {\n    const handler = descriptor.value!;\n    const records = readHookMetadata(handler).hooks;\n    append(\n      handler,\n      tokens.HOOK_METADATA,\n      Object.freeze({\n        phase,\n        match: Array.isArray(match) ? Object.freeze([...match]) : match,\n        options: Object.freeze({ ...options }),\n        method,\n        handler,\n        declarationOrder: records.length,\n      }),\n    );\n  };\n}\nexport const BeforeAuth = <const P extends EndpointPath | (string & {})>(\n  match?: P | readonly P[] | HookPredicate,\n  options?: HookOptions,\n): HookMethodDecorator<P> => hook(\"before\", match, options);\nexport const AfterAuth = <const P extends EndpointPath | (string & {})>(\n  match?: P | readonly P[] | HookPredicate,\n  options?: HookOptions,\n): HookMethodDecorator<P> => hook(\"after\", match, options);\nfunction databaseHook<\n  E extends DatabaseHookTarget,\n  Ph extends \"before\" | \"after\",\n>(phase: Ph, target: E, options?: DbHookOptions): DbHookMethodDecorator<E, Ph> {\n  return (_prototype, method, descriptor) => {\n    const handler = descriptor.value!;\n    append(\n      handler,\n      tokens.DB_HOOK_METADATA,\n      Object.freeze({\n        phase,\n        target,\n        options: Object.freeze({ ...options }),\n        method,\n        handler,\n        declarationOrder: readHookMetadata(handler).databaseHooks.length,\n      }),\n    );\n  };\n}\nexport const BeforeDatabase = <E extends DatabaseHookTarget>(\n  target: E,\n  options?: DbHookOptions,\n): DbHookMethodDecorator<E, \"before\"> =>\n  databaseHook(\"before\", target, options);\nexport const AfterDatabase = <E extends DatabaseHookTarget>(\n  target: E,\n  options?: DbHookOptions,\n): DbHookMethodDecorator<E, \"after\"> => databaseHook(\"after\", target, options);\n"],"mappings":";;;;;;;AACA,SAAS,cAAc,MAAc,OAAwB;CAC3D,OAAO,UAAU,KAAA,KAAa,UAAU,MAAM,UAAU,YACpD,OACA,GAAG,KAAK,GAAG;AACjB;AAEA,SAAgB,2BAA2B,OAAwB;CACjE,OAAO,cAAc,wCAAwC,KAAK;AACpE;AAEA,SAAgB,0BAA0B,OAAwB;CAChE,OAAO,cAAc,uCAAuC,KAAK;AACnE;AAEA,SAAgB,0BAA0B,OAAwB;CAChE,OAAO,cAAc,uCAAuC,KAAK;AACnE;AAEA,SAAgB,yBAAyB,OAAwB;CAC/D,OAAO,cAAc,sCAAsC,KAAK;AAClE;AAGA,MAAa,oBAAoB,OAAO,IACtC,+CACF;AACA,MAAa,gBAAgB,OAAO,IAClC,2CACF;AACA,MAAa,qBAAqB,OAAO,IACvC,gDACF;AACA,MAAa,gBAAgB,OAAO,IAClC,2CACF;AACA,MAAa,qBAAqB,OAAO,IACvC,gDACF;AACA,MAAa,kBAAkB,OAAO,IACpC,6CACF;AACA,MAAa,oBAAoB,OAAO,IACtC,+CACF;AACA,MAAa,aAAa,OAAO,IAAI,wCAAwC;AAC7E,MAAa,aAAa,OAAO,IAAI,wCAAwC;AAC7E,MAAa,qBAAqB,OAAO,IACvC,gDACF;AACA,MAAa,iBAAiB,OAAO,IACnC,4CACF;AACA,MAAa,YAAY,OAAO,IAAI,uCAAuC;AAC3E,MAAa,aAAa,OAAO,IAAI,wCAAwC;AAC7E,MAAa,kBAAkB,OAAO,IAAI,oCAAoC;AAC9E,MAAa,6BAA6B,OAAO,IAC/C,+CACF;AACA,MAAa,wBAAwB,OAAO,IAC1C,0CACF;AACA,MAAa,qCAAqC,OAAO,IACvD,uDACF;AACA,MAAa,qBAAqB,OAAO,IACvC,uCACF;AACA,MAAa,yBAAyB,OAAO,IAC3C,2CACF;AACA,MAAa,4BAA4B,OAAO,IAC9C,8CACF;AACA,MAAa,6BAA6B,OAAO,IAC/C,+CACF;AACA,MAAa,2BAA2B,OAAO,IAC7C,6CACF;AACA,MAAa,6BAA6B,OAAO,IAC/C,+CACF;AACA,MAAa,2BAA2B,OAAO,IAC7C,6CACF;AACA,MAAa,gBAAgB,OAAO,IAAI,kCAAkC;AAC1E,MAAa,mBAAmB,OAAO,IACrC,qCACF;AACA,MAAa,gBAAgB,OAAO,IAAI,sCAAsC;AAE9E,SAAgB,yBAAyB,UAA0B;CACjE,OAAO,OAAO,IACZ,iDAAiD,UACnD;AACF;AAEA,SAAgB,kBACd,OACA,UACA,OACQ;CACR,OAAO,OAAO,IACZ,mCAAmC,MAAM,GAAG,SAAS,GAAG,OAC1D;AACF;AAEA,MAAa,iBAAiB,OAAO,IACnC,4CACF;AACA,MAAa,oBAAoB,OAAO,IACtC,wCACF;;;AC7FA,MAAa,yBACX,WACuB;AACzB,MAAa,iBACX,eACwB;CAAE,SAAS;CAAiB;AAAU;AAChE,MAAa,gBAAwC,EAAE,SAAS,SAAS;AACzE,MAAa,YAAY,aAAkD;CACzE,SAAS;CACT;AACF;AAEA,IAAa,WAAb,MAAsB;CACpB,yBAA0B,IAAI,QAO5B;CAEF,IACE,OACA,WACA,OACQ;EACR,IAAI,OAAO,UAAU,UACnB,OAAO,KAAK,UAAU;GAAC;GAAW;GAAU;EAAK,CAAC;EAEpD,IAAI,aAAa,KAAK,OAAO,IAAI,KAAK;EACtC,IAAI,CAAC,YAAY;GACf,aAAa;IAAE,yBAAS,IAAI,QAAQ;IAAG,yBAAS,IAAI,IAAI;IAAG,MAAM;GAAE;GACnE,KAAK,OAAO,IAAI,OAAO,UAAU;EACnC;EACA,IAAI,KACF,OAAO,UAAU,WACb,WAAW,QAAQ,IAAI,KAAK,IAC5B,WAAW,QAAQ,IAAI,KAAK;EAClC,IAAI,OAAO,KAAA,GAAW;GACpB,KAAK,EAAE,WAAW;GAClB,IAAI,OAAO,UAAU,UACnB,WAAW,QAAQ,IAAI,OAAO,EAAE;QAEhC,WAAW,QAAQ,IAAI,OAAO,EAAE;EAEpC;EACA,OAAO,KAAK,UAAU;GAAC;GAAW,OAAO;GAAO;EAAE,CAAC;CACrD;AACF;AACA,SAAgB,eACd,MACA,OACS;CACT,MAAM,UAAU,IAAI,QAAQ,KAAK,QAAQ,CAAC;CAC1C,KAAK,MAAM,QAAQ,CAAC,GAAG,QAAQ,KAAK,CAAC,GACnC,IACE,KAAK,WAAW,GAAG,KACnB,KAAK,WAAW,YAAY,KAC5B,SAAS,MAAM,OAAO,gBAEtB,QAAQ,OAAO,IAAI;CAGvB,IAAI,MAAM,OAAO,kBAAkB,KAAK,UACtC,QAAQ,IAAI,MAAM,OAAO,gBAAgB,KAAK,QAAQ;CAExD,OAAO;AACT;AACA,SAAgB,oBACd,OACA,OACA,MACA,OACA,SACA;CACA,IAAI;EACF,OAAO,gBAAgB,OAAO,OAAO,MAAM,CAAC,GAAG,MAAM,QAAQ,MAAM;CACrE,SAAS,YAAY;EACnB,IACE,qBAAqB,UAAU,KAC9B,sBAAsB,KAAK,KAAK,eAAe,OAEhD,MAAM;EAER,MAAM,0BAA0B,OAAO;GACrC;GACA,mBAAmB,MAAM;GACzB,gBAAgB,MAAM,QAAQ,QAAQ;EACxC,CAAC;CACH;AACF;AACA,IAAa,yBAAb,MAAiE;CAI5C;CACA;CACA;CALnB,OAAwB,IAAI,SAAS;CAErC,YACE,WACA,OACA,YACA;EAHiB,KAAA,YAAA;EACA,KAAA,QAAA;EACA,KAAA,aAAA;CAChB;CAEH,QACE,MACA,SAC0B;EAC1B,MAAM,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,IAAI;EAClD,MAAM,UAAU,YAAsC;GACpD,MAAM,UAAU,eAAe,MAAM,KAAK;GAC1C,MAAM,UAAU,QAAQ,aACpB,MAAM,QAAQ,QACX,WACC,OAAO,OAAO,QAAQ,WAAY,YAClC,OAAO,aACX,IACA,MAAM,QAAQ,QAAQ,WACpB,OAAO,MAAM,MAAM,SAAS,QAAQ,QAAQ,IAAI,IAAI,CAAC,CACvD;GACJ,OAAO,QAAQ,KAAK,IAClB;IACE,SAAS,KAAK;IACd,SAAS;IACT,eAAe;IACf,UAAU;GACZ,GACA,YAAY;IACV,KAAK,MAAM,UAAU,SAAS;KAC5B,MAAM,QAAQ;MACZ;MACA,SAAS,KAAK;MACd,WAAW,KAAK,WAAW,KAAK,IAAI;MACpC,SAAS,KAAK;MACd,WAAW,QAAQ;MACnB,MAAM,QAAQ;MACd,OACE,KACA,OAEA,KAAK,MAAM,aACT,KAAK,KACL,MAAM,MACN,KAAK,KAAK,IAAI,KAAK,KAAK,UAAU,OAAO,MAAM,GAAG,GAClD,IACA,MAAM,QAAQ,QAAQ,+BACxB;KACJ;KACA,IAAI;MACF,IAAI,OAAO,aAAa,CAAC,OAAO,UAAU,KAAK,GAC7C;MAEF,MAAM,SAAS,MAAM,OAAO,QAAQ,KAAK;MACzC,IACE,OAAO,YAAY,oBAClB,CAAC,OAAO,MAAM,SAAS,OAAO,UAAU,IAAI,KAC3C,OAAO,UAAU,WAAW,OAAO,MACnC,QAAQ,OAAO,UAAU,UAAU,MACjC,QAAQ,OAAO,SAAS,IAE5B,MAAM,IAAI,MACR,oBAAoB,OAAO,GAAG,0CAChC;MAEF,IAAI,OAAO,YAAY,UACrB,OAAO;KAEX,SAAS,OAAO;MACd,MAAM,UAAU,oBACd,OACA,UACA,OAAO,IACP,OACA,OACF;MACA,IAAI,cAAc,OAAO,GACvB,OAAO,SAAS,OAAO;MAEzB,MAAM;KACR;IACF;IACA,OAAO,OAAO;GAChB,CACF;EACF;EACA,OAAO,QAAQ,aACX,QAAQ,IACR,KAAK,MAAM,cACT,MACA;GACE,UAAU,MAAM;GAChB,WAAW,QAAQ;GACnB,WAAW,QAAQ;EACrB,GACA,OACF;CACN;AACF;;;;;;;;;;;;;;;;;;;;;;;AC1LO,IAAM,kBAAN,MAAM,gBAAuC;CAKX;CAJvC,QAAiB,iBAAiB;CAClC,CAAU,iBAAiB;CAE3B,YACE,MACA;EADqC,KAAA,OAAA;CACpC;CAEH,YAAY,SAA6C;EACvD,OAAO,KAAK,KAAK,YAAY,OAAO;CACtC;AACF;;CAZC,WAAW;CAMP,gBAAA,GAAA,OAAO,UAAU,CAAA;;;AAOtB,IAAa,YAAb,MAA8C;CAEzB;CACA;CACA;CACA;CACA;CACA;CACA;CAPnB,YACE,WACA,SACA,YACA,UACA,WACA,OACA,UACA;EAPiB,KAAA,YAAA;EACA,KAAA,UAAA;EACA,KAAA,aAAA;EACA,KAAA,WAAA;EACA,KAAA,YAAA;EACA,KAAA,QAAA;EACA,KAAA,WAAA;CAChB;CAEH,MAAM,YAAY,SAA6C;EAC7D,IAAI;EACJ,IAAI;EACJ,IAAI;EACJ,IAAI;GACF,OAAO,KAAK,QAAQ,WAAW,OAAO;GACtC,IAAI,KAAK,WAAW,WAAW;IAC7B,YAAY,KAAK,WAAW,KAAK,OAAO;IACxC,MAAM,UAAU,WAAW,UAAU,OAAO;IAC5C,IAAI,WAAW,CAAC,KAAK,SAAS,UAAU,SAAS,QAAQ,QAAQ,CAAC,GAAG;KACnE,OAAO,KAAK,WAAW,SAAS,SAAS,SAAS;KAClD,MAAM,6BAA6B,UACjC,yBACA,2DACA,EAAE,MAAM,KAAK,KAAK,CACpB;IACF;IACA,IAAI,KAAK,gBAAgB,QACvB,OAAO;GAEX;GACA,IAAI,KAAK,WAAW,YAAY,KAAK,gBAAgB,QAAQ;IAC3D,MAAM,UAAU,KAAK,WAAW,KAAK,OAAO,CAAC,EAAE,UAAU,OAAO;IAChE,IAAI,WAAW,CAAC,KAAK,QACnB,KAAK,SAAS,cAAc,SAAS;KACnC,SAAS;KACT,UAAU,KAAK;IACjB,CAAC;IAEH,OAAO;GACT;GACA,YAAY,KAAK,WAAW,OAAO,OAAO;GAC1C,OAAO,KAAK,WAAW,SAAS,SAAS,SAAS;GAClD,MAAM,QAAQ,KAAK,UAAU,IAAI,KAAK,QAAQ;GAC9C,IAAI,KAAK,gBAAgB,OAAO;IAC9B,MAAM,UAAU,KAAK;IACrB,IAAI,SAAS;KACX,IAAI,KAAK,gBAAgB,UAAU,QAAQ,SAAS;MAClD,MAAM,UAAU,MAAM,MAAM,OAAO,MAAM,SAAS,KAAK,WAAW;MAClE,IAAI,SACF,MAAM;KAEV,OACE,MAAM,MAAM,OAAO,SAAS,OAAO;IAEvC;GACF;GACA,IAAI,KAAK,WAAW,WAClB,OAAO;GAET,IAAI,KAAK,WAAW,UAAU;IAC5B,IAAI,CAAC,KAAK,QACR,KAAK,SAAS,OAAO,MAAM;KACzB,SAAS;KACT,UAAU,KAAK;IACjB,CAAC;IAEH,OAAO;GACT;GACA,MAAM,SAAS,MAAM,KAAK,SAAS,QAAQ,MAAM;IAC/C,MAAM,MAAM;IACZ,WAAW,KAAK;IAChB,SAAS,KAAK;IACd,WAAW,KAAK;GAClB,CAAC;GACD,KAAK,SAAS,OAAO,MAAM;IAAE,GAAG;IAAQ,UAAU,KAAK;GAAS,CAAC;GACjE,IAAI,OAAO,YAAY,YACrB,MAAM,OAAO;GAEf,IAAI,OAAO,YAAY,UAAU;IAC/B,IAAI,KAAK,WAAW,YAClB,OAAO;IAET,MAAM,aAAa,gBAAgB;GACrC;GACA,IAAI,CAAC,KAAK,QAAQ,IAAI,OAAO,UAAU,IAAI,GACzC,MAAM,aAAa,UAAU,yBAAyB;GAExD,MAAM,WAAW,MAAM,KAAK,UAAU,SACpC,MACA,OAAO,WACP,MACA,OACA,SACA,UAAU,EACZ;GACA,IAAI,SAAS,WAAW,QACtB,MAAM,aAAa,SAAS;IAC1B,QAAQ,SAAS,UAAU;IAC3B,QAAQ,SAAS;IACjB,SAAS,SAAS;IAClB,WAAW,SAAS;GACtB,CAAC;GAEH,OAAO;EACT,SAAS,OAAO;GACd,IAAI,cAAc,KAAK,KAAK,WAAW;IACrC,MAAM,UACJ,QAAQ,KAAK,UAAU,IAAI,KAAK,QAAQ,CAAC,CAAC,QAAQ,QAAQ;IAC5D,MAAM,UACF,QAAQ,OAAO,SAAS,UAAU,EAAE,IACpC,UAAU,YAAY,OAAO,OAAO;GAC1C;GACA,KACG,qBAAqB,KAAK,KAAK,sBAAsB,KAAK,MAC3D,WACA;IACA,MAAM,WAAW,OACb,KAAK,MAAM,SAAS,KAAK,KAAK,OAAO;KACnC,UAAU,MAAM,YAAY;KAC5B,MAAM,MAAM,QAAQ;KACpB,SAAS,KAAK;IAChB,CAAC,IACD;IACJ,MACE,UAAU,sBAAsB,OAAO,SAAS,EAAE,SAAS,CAAC,KAAK;GAErE;GACA,MAAM;EACR;CACF;AACF;;;ACzJO,IAAM,6BAAN,MAAM,2BAAsD;CAK1B;CAJvC,QAAiB,iBAAiB;CAClC,CAAU,iBAAiB;CAE3B,YACE,MACA;EADqC,KAAA,OAAA;CACpC;CAEH,UAAU,SAA2B,MAAwC;EAC3E,OAAO,KAAK,KAAK,UAAU,SAAS,IAAI;CAC1C;AACF;;CAZC,WAAW;CAMP,gBAAA,GAAA,OAAO,UAAU,CAAA;;;AAOtB,IAAa,YAAb,MAAkD;CAE7B;CACA;CACA;CACA;CACA;CALnB,YACE,WACA,SACA,YACA,OACA,UACA;EALiB,KAAA,YAAA;EACA,KAAA,UAAA;EACA,KAAA,aAAA;EACA,KAAA,QAAA;EACA,KAAA,WAAA;CAChB;CAEH,UAAU,SAA2B,MAAwC;EAC3E,MAAM,OAAO,KAAK,QAAQ,WAAW,OAAO;EAC5C,MAAM,QAAQ,KAAK,UAAU,IAAI,KAAK,QAAQ;EAC9C,IAAI,YAAY;EAChB,IAAI;EACJ,MAAM,gBAA2C;GAC/C,IAAI,CAAC,WAAW;IACd,MAAM,YAAY,KAAK,WAAW,KAAK,OAAO;IAC9C,OAAO,YACH,KAAK,WAAW,SAAS,SAAS,SAAS,IAC3C,KAAA;IACJ,YAAY;GACd;GACA,OAAO;EACT;EACA,IAAI;EACJ,MAAM,aAA+B;GACnC,IAAI,SACF,OAAO;GAET,MAAM,UAAU,KAAK,WAAW,KAAK,OAAO,CAAC,EAAE,UAAU,OAAO;GAChE,UAAU,KAAK,SAAS,KAAK;IAC3B,MAAM,QAAQ,QAAQ;IACtB;IACA;IACA,GAAI,KAAK,WAAW,YAAY,KAAK,WAAW,YAC5C,CAAC,IACD,EAAE,MAAM,QAAQ,EAAE;GACxB,CAAC;GACD,OAAO;EACT;EACA,MAAM,YAAY,KAAK;EA8BvB,MAAM,QAAoB;GACxB,MAAA;IA7BA,IAAI,UAAU;KACZ,OAAO,QAAQ,CAAC,EAAE,WAAW;IAC/B;IACA,SAAS,KAAK,qBAAqB,oBAAoB;IACvD,UAAU;IACV,IAAI,UAAU;KACZ,aAAa;MACX,MAAM,OAAO,QAAQ;MACrB,OAAO,OAAO,eAAe,MAAM,KAAK,IAAI,IAAI,QAAQ;KAC1D;IACF;IACA,IAAI,iBAAiB;KACnB,MAAM,UAAU,QAAQ,CAAC,EAAE;KAC3B,OAAO,gBAAgB,QAAQ,QAAQ,IAAI,KAAA;IAC7C;IACA,IAAI,qBAAqB;KACvB,IAAI,KAAK,gBAAgB,OACvB;KAEF,MAAM,UAAU,QAAQ,CAAC,EAAE;KAC3B,OAAO,WACF,MAAc,aACb,UACG,IAAI,QAAQ,CAAC,CACb,OAAO,oBAAoB,SAAS,MAAM,QAAQ,IACvD,KAAA;IACN;GAGG;GACH;GACA,SAAS;GACT,IAAI,OAAO;IACT,OAAO,QAAQ;GACjB;EACF;EACA,MAAM,OAAO,QAAQ,QAAQ;EAC7B,MAAM,SAAS;GACb,MAAM,CAAC,GAAG,IAAI;GACd,SAAS;GACT,OAAO,KAAK;GACZ,UAAU,KAAK;EACjB;EACA,KAAK,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,GAC9B,IACE,QACC,OAAO,QAAQ,YAAY,OAAO,QAAQ,eAC3C,OAAO,aAAa,GAAG,GAEvB,OAAO,eAAe,KAAK,gBAAgB;GACzC,OAAO;GACP,cAAc;EAChB,CAAC;EAGL,OAAO,IAAI,YAAY,eACrB,KAAK,MAAM,IAAI,aAAa;GAC1B,MAAM,eAAe,KAAK,OAAO,CAAC,CAAC,UAAU;IAC3C,OAAO,UAAU,KAAK,MAAM,IAAI,aAAa,WAAW,KAAK,KAAK,CAAC;IACnE,QAAQ,UACN,KAAK,MAAM,IAAI,aAAa,WAAW,MAAM,KAAK,CAAC;IACrD,gBAAgB,KAAK,MAAM,IAAI,aAAa,WAAW,SAAS,CAAC;GACnE,CAAC;GACD,aAAa,KAAK,MAAM,IAAI,aAAa,aAAa,YAAY,CAAC;EACrE,CAAC,CACH;CACF;AACF;;;ACrGA,MAAM,WAAW,OAAO,IAAI,sCAAsC;AAClE,SAAgB,QACd,UACA,GAAG,QACK;CACR,OAAO,KAAK,UAAU,CAAC,UAAU,GAAG,MAAM,CAAC;AAC7C;;AAGA,SAAgB,eACd,KACA,SACa;CACb,MAAM,UAAU,SAAS,WAAW;CACpC,MAAM,YAAY,UAAU,QAAQ,SAAS,MAAM,KAAK,CAAC,CAAC,CAAC,KAAM;CACjE,IAAI,UAAU,QAAQ,IAAI,SAAS,QAAQ;CAG3C,IAAI,CAAC,SAAS;EACZ,0BAAU,IAAI,IAAI;EAClB,OAAO,eAAe,SAAS,UAAU,EAAE,OAAO,QAAQ,CAAC;CAC7D;CACA,IAAI,SAAS,QAAQ,IAAI,SAAS;CAClC,IAAI,CAAC,QAAQ;EACX,yBAAS,IAAI,IAAI;EACjB,QAAQ,IAAI,WAAW,MAAM;CAC/B;CACA,OAAO;AACT;AAEA,IAAa,eAAb,MAA0B;CACxB,WAAoB,IAAI,kBAA8B;CACtD,0BAAmB,IAAI,QAA8B;CACrD,6BAAsB,IAAI,IAAiC;CAC3D,4BAAqB,IAAI,QAAwB;CACjD,aAAa;CAEb,IAAO,OAAmB,IAAgB;EACxC,OAAO,KAAK,SAAS,IAAI,OAAO,EAAE;CACpC;CAEA,KAAQ,IAAgB;EACtB,OAAO,KAAK,SAAS,KAAK,EAAE;CAC9B;CAEA,UAAkC;EAChC,OAAO,KAAK,SAAS,SAAS;CAChC;CAEA,SAAS,KAA2B;EAClC,IAAI,QAAQ,KAAK,QAAQ,IAAI,GAAG;EAChC,IAAI,CAAC,OAAO;GACV,QAAQ;IACN,2BAAW,IAAI,IAAI;IACnB,0BAAU,IAAI,IAAI;IAClB,2BAAW,IAAI,IAAI;IACnB,wBAAQ,IAAI,IAAI;IAChB,oCAAoB,IAAI,IAAI;IAC5B,yBAAS,IAAI,IAAI;IACjB,0BAAU,IAAI,IAAI;IAClB,6BAAa,IAAI,IAAI;GACvB;GACA,KAAK,QAAQ,IAAI,KAAK,KAAK;EAC7B;EACA,OAAO;CACT;CAEA,cACE,MACA,OAKA,SAC0B;EAC1B,MAAM,MAAM,QAAQ,MAAM,UAAU,MAAM,WAAW,MAAM,SAAS;EACpE,MAAM,QAAQ,KAAK,SAAS,KAAK,GAAG;EACpC,MAAM,WAAW,MAAM,UAAU,IAAI,GAAG;EACxC,IAAI,UACF,OAAO;EAET,MAAM,aACJ,KAAK,cACL,MAAM,cAAc,oBACnB,KAAK,kBAAkB,KAAK,IACzB,KAAK,SAAS,KAAK,UAAU,CAAC,CAAC,cAC/B,KAAA;EACN,MAAM,SAAS,YAAY,IAAI,GAAG;EAClC,MAAM,UAAU,QAAQ,QAAQ,CAAC,CAAC,KAAK,YAAY;GACjD,IAAI,UAAU,OAAO,YAAY,KAAK,IAAI,GACxC,OAAO,OAAO;GAEhB,YAAY,OAAO,GAAG;GACtB,IAAI;IACF,MAAM,QAAQ,MAAM,QAAQ;IAC5B,IAAI,MAAM,YAAY,YACpB,YAAY,IAAI,KAAK;KACnB;KACA,WAAW,KAAK,IAAI,KAAK,KAAK,kBAAkB;IAClD,CAAC;IAEH,OAAO;GACT,SAAS,OAAO;IACd,YAAY,OAAO,GAAG;IACtB,MAAM;GACR;EACF,CAAC;EACD,MAAM,UAAU,IAAI,KAAK,OAAO;EAChC,OAAO;CACT;CAEA,aACE,SACA,UACA,aACA,SACA,QAAwB,KACZ;EACZ,MAAM,QAAQ,KAAK,SAAS,OAAO;EACnC,MAAM,MAAM,QAAQ,UAAU,WAAW;EACzC,MAAM,WAAW,MAAM,SAAS,IAAI,GAAG;EACvC,IAAI,UACF,OAAO;EAET,IACE,UAAU,SACV,CAAC,GAAG,MAAM,kBAAkB,CAAC,CAAC,QAC3B,UAAU,KAAK,MAAM,KAAK,CAAC,CAAC,OAAO,QACtC,CAAC,CAAC,UAAU,OAEZ,OAAO,QAAQ,OACb,aAAa,SAAS;GACpB,QAAQ;GACR,QAAQ;EACV,CAAC,CACH;EAEF,MAAM,mBAAmB,IAAI,GAAG;EAChC,MAAM,UAAU,QAAQ,QAAQ,CAAC,CAAC,KAAK,OAAO;EAC9C,MAAM,SAAS,IAAI,KAAK,OAAO;EAC/B,OAAO;CACT;CAEA,aACE,YACA,UACA,aACA,SACgC;EAChC,MAAM,YAAY,KAAK,SAAS,UAAU,CAAC,CAAC;EAC5C,MAAM,MAAM,QAAQ,UAAU,WAAW;EACzC,IAAI,UAAU,UAAU,IAAI,GAAG;EAC/B,IAAI,CAAC,SAAS;GACZ,UAAU,QAAQ,QAAQ,CAAC,CAAC,KAAK,OAAO;GACxC,UAAU,IAAI,KAAK,OAAO;EAC5B;EACA,OAAO;CACT;CAEA,SAAS,UAAkB,KAAqB;EAC9C,IAAI,OAAO,KAAK,WAAW,IAAI,QAAQ;EACvC,IAAI,CAAC,MAAM;GACT,uBAAO,IAAI,IAAI;GACf,KAAK,WAAW,IAAI,UAAU,IAAI;EACpC;EACA,IAAI,aAAa,KAAK,IAAI,GAAG;EAC7B,IAAI,CAAC,YAAY;GACf,aAAa,OAAO,IAAI,WAAW;GACnC,KAAK,IAAI,KAAK,UAAU;EAC1B;EACA,OAAO;CACT;CAEA,SACE,KACA,OACA,SACS;EACT,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK;EACjC,IAAI,CAAC,IAAI;GACP,KAAK,EAAE,KAAK;GACZ,KAAK,UAAU,IAAI,OAAO,EAAE;EAC9B;EACA,MAAM,SAAS,qBAAqB,KAAK,IACrC,QAAQ,QAAQ,UAAU,MAAM,MAAM,QAAQ,IAAI,IAClD,SAAS;EACb,MAAM,UAAU,eAAe,KAAK,QAAQ,OAAO;EACnD,MAAM,QACJ,QAAQ,QAAQ,SAAS,UAAU,UAAU,KAAK,SAAS,GAAG,CAAC,CAAC;EAClE,MAAM,WAAW,MAAM,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM;EACxD,MAAM,IAAI,MAAM;EAChB,QAAQ,IAAI,MAAM;EAClB,OAAO;CACT;AACF;;;AC3NA,MAAM,aAAa,OAAO,IAAI,wCAAwC;AACtE,MAAM,aAAa,OAAO,IAAI,wCAAwC;AAoBtE,SAAS,OAAO,OAAiC;CAC/C,OACE,UAAU,SAAS,OAAO,UAAU,YAAY,OAAO,UAAU;AAErE;AACA,SAAS,QAAQ,QAAgB,SAAS,OAA4B;CACpE,IAAI,QAAQ,QAAQ,IAAI,QAAQ,UAAU;CAC1C,IAAI,CAAC,SAAS,QAAQ;EACpB,QAAQ;GAAE,qBAAK,IAAI,IAAI;GAAG,2BAAW,IAAI,IAAI;EAAE;EAC/C,OAAO,eAAe,QAAQ,YAAY,EAAE,MAAM,CAAC;CACrD;CACA,OAAO;AACT;AACA,SAAS,cAAc,MAAiD;CACtE,KAAK,MAAM,UAAU,CAAC,MAAM,GAAG,IAAI,GAAG;EACpC,IAAI,CAAC,OAAO,MAAM,GAChB;EAEF,MAAM,QAAQ,QAAQ,IAAI,QAAQ,UAAU;EAC5C,IACE,SACA,MAAM,SAAS,WAAW,KAAK,UAC/B,MAAM,SAAS,OAAO,OAAO,UAAU,UAAU,KAAK,MAAM,GAE5D,OAAO;CAEX;AAEF;AAEA,SAAS,gBACP,MAC+B;CAC/B,MAAM,UAAU,CAAC,MAAM,GAAG,KAAK,OAAO,MAAM,CAAC;CAC7C,KAAK,MAAM,UAAU,SAAS;EAC5B,MAAM,MAAM,QAAQ,MAAM,CAAC,EAAE;EAC7B,IAAI,KACF,OAAO;CAEX;CACA,KAAK,MAAM,UAAU,SAAS;EAC5B,MAAM,UAAU,QAAQ,MAAM,CAAC,EAAE;EACjC,IAAI,CAAC,SACH;EAIF,KAAK,MAAM,YAAY,QAAQ,UAAU,IAAI,GAC3C,OAAO;GAAE,GAAG;GAAS;EAAS;CAElC;AAEF;;AAGA,IAAa,sBAAb,cAAyC,mBAAmB;CAC1D,YAAY,OAAqC;EAC/C,MAAM,MAAM,OAAO;EACnB,OAAO,iBAAiB,MAAM,OAAO,0BAA0B,KAAK,CAAC;CACvE;AACF;AAEA,IAAa,oBAAb,MAA+B;CACA;CAA7B,YAAY,OAAsC;EAArB,KAAA,QAAA;CAAsB;CAEnD,OACE,MACA,SACM;EACN,MAAM,SAAS,QAAQ,KAAK,YAAY,IAAI;EAC5C,OAAO,IAAI,IAAI,QAAQ,UAAU,OAAO;EACxC,IAAI,KAAK,SAAS;GAChB,OAAO,oBAAoB,KAAK;GAChC,KAAK,cAAc,KAAK,SAAS,OAAO;EAC1C;CACF;CAEA,cAAc,SAA4B,SAAiC;EACzE,MAAM,QAAQ,QAAQ,QAAQ,SAAS,IAAI;EAC3C,MAAM,UAAU,IAAI,QAAQ,UAAU,OAAO;EAC7C,MAAM,UAAU;CAClB;CAEA,UACE,SACA,MAC8B;EAC9B,MAAM,YAAY,QAAQ,QAAQ,OAAO,CAAC,EAAE;EAC5C,KAAK,MAAM,YAAY,QAAQ,UAAU,IAAI,GAAG;GAC9C,MAAM,UAAU,WAAW,IAAI,QAAQ;GACvC,IAAI,SACF,OAAO;EAEX;CAEF;CAEA,KAAK,OAAuC;EAC1C,MAAM,EAAE,MAAM,MAAM,SAAS;EAC7B,MAAM,UAAU,MAAM,WAAW,MAAM;EACvC,IAAI,mBAAmB,MAAM;EAC7B,IAAI;GACF,IAAI,MAAM,WAAW,UACnB,OAAO;IAAE,SAAS;IAAe,UAAU,KAAK;GAAS;GAE3D,IAAI;GACJ,IAAI,aAAa,WAAW,gBAAgB,IAAI;GAChD,IAAI,MAAM,WAAW,WACnB,UAAU,WAAW,KAAK,UAAU,SAAS,IAAI;QAC5C;IACL,MAAM,UAAU,OACZ,CAAC,KAAK,UAAU,IAChB,CAAC,MAAM,GAAG,KAAK,OAAO,MAAM,CAAC;IACjC,KAAK,MAAM,UAAU,SAAS;KAC5B,MAAM,MAAM,QAAQ,MAAM,CAAC,EAAE;KAC7B,UAAU,OACN,KAAK,IAAI,KAAK,QAAQ,IACtB,KAAK,SAAS,IACZ,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,QACpB,KAAA;KACN,IAAI,SACF;IAEJ;IACA,IAAI,CAAC,WAAW,CAAC,MACf,KAAK,MAAM,UAAU,CAAC,MAAM,GAAG,KAAK,OAAO,MAAM,CAAC,GAAG;KACnD,MAAM,YAAY,QAAQ,MAAM,CAAC,EAAE;KACnC,IAAI,CAAC,WACH;KAEF,UAAU,KAAK,UAAU,WAAW,IAAI;KACxC,IAAI,SAAS;MACX,aAAa;MACb;KACF;IACF;GAEJ;GACA,IAAI,CAAC,SAAS;IACZ,MAAM,QAAQ,cAAc,IAAI;IAChC,MAAM,WAAW,MAAM,YAAY;IACnC,MAAM,SAAS,OAAO,QAAQ,IAAI,QAAQ;IAC1C,IAAI,QACF,UAAU;KAAE,GAAG;KAAQ;IAAS;GAEpC;GACA,IAAI,CAAC,SACH,MAAM,6BAA6B,UACjC,MAAM,eAAe,MAAM,WAAW,YAClC,gCACA,kBACJ,6EACA;IACE,MAAM,MAAM,QAAQ,MAAM;IAC1B,MAAM;GACR,CACF;GAEF,mBAAmB,QAAQ;GAC3B,IAAI,QAAQ,YAAY,iBACtB,YAAY,iBAAiB,IAAI;GAEnC,OAAO;EACT,SAAS,OAAO;GACd,IAAI,qBAAqB,KAAK,GAC5B,MAAM,KAAK,QAAQ,OAAO,OAAO,gBAAgB;GAEnD,MAAM;EACR;CACF;CAEA,UAA4B;EAC1B,MAAM,QAAQ,KAAK,MAAM,QAAQ;EACjC,IAAI,CAAC,OAAO,SACV,MAAM,6BAA6B,UACjC,iBACA,2CACF;EAEF,OAAO,MAAM,QAAQ;CACvB;CAEA,QACE,SACA,MAMA,OACU;EACV,IAAI,QAAQ,YAAY,iBAAiB,QAAQ,YAAY,UAC3D,OAAO;EAET,IAAI,QAAQ,YAAY,YACtB,MAAM,QAAQ;EAEhB,IAAI,KAAK,QAAQ,QAAQ,UAAU,SAAS,KAAK,MAAM;GACrD,MAAM,QAAQ,6BAA6B,UACzC,KAAK,UAAU,2BACf,uCAAuC,KAAK,QAC5C;IACE,MAAM,KAAK;IACX,MAAM;GACR,CACF;GACA,MAAM,KAAK,QAAQ,OAAO,OAAO,QAAQ,QAAQ;EACnD;EACA,OAAO,KAAK,QAAQ,QAAQ,SAAS;CACvC;CAEA,QACE,OACA,OACA,UACoD;EACpD,MAAM,QAAQ,KAAK,MAAM,QAAQ;EACjC,MAAM,OAAO,OAAO,QAAQ,OAAO;EACnC,MAAM,UACJ,MAAM,WAAW,OAAO,YAAY,SAAS,gBAAgB,MAAM,IAAI;EACzE,MAAM,MAAM,MAAM,OAAO,SAAS,WAAW,OAAO;EACpD,IAAI,CAAC,KACH,OAAO;EAST,OAPiB,KAAK,MAAM,SAAS,KAAK,OAAO;GAC/C,UACE,YAAY,OAAO,MAAM,YAAY,OAAO,MAAM,YAAY;GAChE,MACE,MAAM,QAAQ,OAAO,QAAQ,OAAO,MAAM,QAAQ;GACpD;EACF,CACc,IAAI,IAAI,oBAAoB,KAAK,IAAI;CACrD;CAEA,MACE,MACA,UACA,QACM;EACN,MAAM,QAAQ,cAAc,IAAI,KAAK;GACnC,UAAU,CAAC,GAAG,IAAI;GAClB,yBAAS,IAAI,IAAI;EACnB;EACA,MAAM,QAAQ,IAAI,UAAU,MAAM;EAClC,KAAK,MAAM,UAAU,CAAC,MAAM,GAAG,IAAI,GACjC,IAAI,OAAO,MAAM,KAAK,OAAO,aAAa,MAAM,GAC9C,OAAO,eAAe,QAAQ,YAAY;GACxC,OAAO;GACP,cAAc;EAChB,CAAC;CAGP;AACF;;;ACjQA,SAAS,OAAO,QAAgB,KAAa,OAAsB;CACjE,QAAQ,eACN,KACA,OAAO,OAAO,CAAC,GAAI,QAAQ,eAAe,KAAK,MAAM,KAAK,CAAC,GAAI,KAAK,CAAC,GACrE,MACF;AACF;AACA,MAAa,eAAe,YAAYA,iBAAwB,QAAQ;AACxE,MAAa,qBACX,YAAYA,iBAAwB,UAAU;AAChD,MAAa,eAAe,YAC1B,gBACE,YAAYA,iBAAwB,UAAU,GAC9C,YAAYC,oBAA2B,SAAS,kBAAkB,IAAI,CACxE;AACF,MAAa,mBAAmB,SAC9B,YAAYC,wBAA+B,IAAI;AACjD,MAAa,oBACX,GAAG,UACA,YAAYC,4BAAmC,OAAO,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AAC7E,MAAa,gCACX,YAAYC,oCAA2C,IAAI;AAC7D,MAAa,sBAAsB,UAAU,SAC3C,YAAYC,0BAAiC,OAAO;AACtD,MAAa,wBACX,YAAYC,4BAAmC,IAAI;AACrD,MAAa,sBACX,gBACE,YAAYC,0BAAiC,IAAI,GACjD,UAAU,eAAe,GACzB,gBAAgB,0BAA0B,CAC5C;AACF,SAAgB,QACd,GAAG,cAC+B;CAClC,QACE,QACA,MACA,eACG;EACH,KAAK,MAAM,cAAc,cACvB,OACE,YAAY,SAAS,QACrBC,uBACA,UACF;CAEJ;AACF;AACA,MAAa,SACX,GAAG,kBACkB,EAAE,OAAO,aAAa;AAC7C,MAAa,SACX,GAAG,kBACkB,EAAE,OAAO,aAAa;AAC7C,MAAa,eACX,QACA,QACA,aACoB;CAAE;CAAQ;CAAQ,GAAG;AAAQ;AAQnD,SAAgB,cAAc,SAA0C;CACtE,MAAM,OAAO,QAAQ,QAAQ;CAC7B,KAAK,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG;EACjC,KACG,OAAO,QAAQ,YAAY,QAAQ,SACpC,OAAO,QAAQ,YAEf;EAEF,MAAM,SAAS,QAAQ,IAAI,KAAKC,cAAqB;EAGrD,IACE,UACA,OAAO,KAAK,WAAW,KAAK,UAC5B,OAAO,KAAK,OAAO,OAAO,UAAU,UAAU,KAAK,MAAM,KACzD,OAAO,YAAY,KAAA,KACnB,OAAO,MAAM,QAAQ,CAAC,EAAE,YAAY,OAAO,SAE3C,OAAO;CAEX;CAEA,MAAM,QAAQ,IAAI,aAAa;CAC/B,OAAO;EAAE;EAAM;EAAO,UAAU,IAAI,kBAAkB,KAAK;CAAE;AAC/D;AACA,SAAS,eAAe,MAID;CACrB,MAAM,YAAY,sBACf,OAAgB,YAA8B;EAC7C,MAAM,SAAS,cAAc,OAAO;EACpC,MAAM,QAAQ;GACZ,MAAM,QAAQ,QAAQ;GACtB,MAAM,GAAG,QAAQ,SAAS,CAAC,CAAC,KAAK,GAAG,QAAQ,WAAW,CAAC,CAAC;EAC3D;EACA,MAAM,UACJ,OAAO,YAAY,KAAA,KACnB,OAAO,MAAM,QAAQ,CAAC,EAAE,YAAY,OAAO,UACvC,OAAO,SAAS,QAAQ,IACxB,OAAO,SAAS,KAAK,KAAK;EAChC,OAAO,OAAO,SAAS,QACrB,SACA;GAAE,GAAG;GAAM,MAAM,MAAM;GAAM,SAAS,MAAM,aAAa,MAAM;EAAG,GAClE,KACF;CACF,CACF,CAAC,CAAC;CACF,QAAQ,QAAQ,aAAa,UAAU;EACrC,IAAI,gBAAgB,KAAA,GAClB,MAAM,IAAI,6BACR,0BACA,+CACF;EAGF,OADgB,QAAQ,IAAI,QAAQ,WACvB,GAAGC,2BAAkC;GAChD;GACA,GAAI,OAAO;IAAE,MAAM,KAAK;IAAM,QAAQ,KAAK;GAAO,IAAI,CAAC;EACzD,CAAC;EACD,UAAU,QAAQ,aAAa,KAAK;CACtC;AACF;AACA,MAAa,yBAA6C,eAAe;AACzE,SAAgB,qBAAiD,MAIpC;CAC3B,aAAa,eAAe,IAAI;AAClC;AACA,SAAgB,sBACd,MACA,MAC0B;CAC1B,aAAa;EACX,MAAM,YAAY,sBACf,OAAgB,YAA8B;GAC7C,MAAM,SAAS,cAAc,OAAO;GACpC,MAAM,QAAQ,OAAO,MAAM,QAAQ;GACnC,MAAM,QAAQ;IACZ,MAAM,QAAQ,QAAQ;IACtB,MAAM,GAAG,QAAQ,SAAS,CAAC,CAAC,KAAK,GAAG,QAAQ,WAAW,CAAC,CAAC;GAC3D;GACA,MAAM,UAAU,OAAO,UACnB,OAAO,SAAS,QAAQ,IACxB,OAAO,SAAS,KAAK,KAAK;GAC9B,MAAM,aAAa,OAAO,OACtB,CAAC,MAAM,KAAK,UAAU,IACtB,CAAC,MAAM,MAAM,GAAG,MAAM,IAAI;GAC9B,KAAK,MAAM,aAAa,YAAY;IAClC,IACE,CAAC,aACA,OAAO,cAAc,YAAY,OAAO,cAAc,YAEvD;IAEF,MAAM,SAAS,QAAQ,IAAI,WAAWC,iBAAwB;IAG9D,IAAI,QAAQ,IAAI,QAAQ,QAAQ,CAAC,EAAE,IAAI,IAAI,GACzC,OAAO,OAAO,IAAI,QAAQ,QAAQ,CAAC,CAAE,IAAI,IAAI;GAEjD;GACA,MAAM,OAAO,SAAS,QACpB,6BAA6B,UAC3B,uBACA,KAAK,SACL,EAAE,MAAM,MAAM,KAAK,CACrB,GACA,OACA,QAAQ,QACV;EACF,CACF,CAAC,CAAC;EACF,QAAQ,QAAQ,KAAK,UAAU;GAC7B,IAAI,QAAQ,KAAA,GACV,MAAM,IAAI,6BACR,2BACA,gDACF;GAEF,OAAO,QAAQ,IAAI,QAAQ,GAAG,GAAGC,4BAAmC;IAClE;IACA;IACA,SAAS,KAAK;GAChB,CAAC;GACD,UAAU,QAAQ,KAAK,KAAK;EAC9B;CACF;AACF;AAoBA,SAAgB,iBAAiB,SAG/B;CACA,OAAO;EACL,OAAO,QAAQ,eAAeC,eAAsB,OAAO,KAAK,CAAC;EACjE,eACE,QAAQ,eAAeC,kBAAyB,OAAO,KAAK,CAAC;CACjE;AACF;AACA,SAAS,KACP,OACA,OACA,SACwB;CACxB,QAAQ,SAAS,QAAQ,eAAe;EACtC,MAAM,UAAU,WAAW;EAC3B,MAAM,UAAU,iBAAiB,OAAO,CAAC,CAAC;EAC1C,OACE,SACAD,eACA,OAAO,OAAO;GACZ;GACA,OAAO,MAAM,QAAQ,KAAK,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,CAAC,IAAI;GAC1D,SAAS,OAAO,OAAO,EAAE,GAAG,QAAQ,CAAC;GACrC;GACA;GACA,kBAAkB,QAAQ;EAC5B,CAAC,CACH;CACF;AACF;AACA,MAAa,cACX,OACA,YAC2B,KAAK,UAAU,OAAO,OAAO;AAC1D,MAAa,aACX,OACA,YAC2B,KAAK,SAAS,OAAO,OAAO;AACzD,SAAS,aAGP,OAAW,QAAW,SAAuD;CAC7E,QAAQ,YAAY,QAAQ,eAAe;EACzC,MAAM,UAAU,WAAW;EAC3B,OACE,SACAC,kBACA,OAAO,OAAO;GACZ;GACA;GACA,SAAS,OAAO,OAAO,EAAE,GAAG,QAAQ,CAAC;GACrC;GACA;GACA,kBAAkB,iBAAiB,OAAO,CAAC,CAAC,cAAc;EAC5D,CAAC,CACH;CACF;AACF;AACA,MAAa,kBACX,QACA,YAEA,aAAa,UAAU,QAAQ,OAAO;AACxC,MAAa,iBACX,QACA,YACsC,aAAa,SAAS,QAAQ,OAAO"}

package/dist/auth-errors-CQjfgjaO.mjs

@@ -0,0 +1,283 @@
+import { isAPIError } from "better-auth/api";
+//#region src/error-redactor.ts
+/** Reading an arbitrary thrown value must not invoke another escaping fault. */
+function readErrorProperty(value, key) {
+	if ((typeof value !== "object" || value === null) && typeof value !== "function") return;
+	try {
+		return Reflect.get(value, key);
+	} catch {
+		return;
+	}
+}
+var ErrorRedactor = class {
+	#secrets;
+	constructor(options = {}) {
+		const values = /* @__PURE__ */ new Set();
+		const add = (value) => {
+			if (!value) return;
+			values.add(value);
+			let decoded = value;
+			try {
+				decoded = decodeURIComponent(value);
+				values.add(decoded);
+			} catch {}
+			for (const form of [value, decoded]) {
+				const separator = form.lastIndexOf(".");
+				if (separator >= 16) values.add(form.slice(0, separator));
+			}
+		};
+		for (const value of options.secrets ?? []) add(value);
+		const headers = options.headers;
+		for (const cookie of (headers?.get("cookie") ?? "").split(";")) {
+			const separator = cookie.indexOf("=");
+			if (separator >= 0) {
+				const value = cookie.slice(separator + 1).trim();
+				add(value);
+				if (value.startsWith("\"") && value.endsWith("\"")) add(value.slice(1, -1));
+			}
+		}
+		const authorization = headers?.get("authorization");
+		if (authorization) {
+			add(authorization);
+			const credential = /^\S+\s+(.+)$/.exec(authorization)?.[1];
+			if (credential) add(credential);
+		}
+		for (const name of options.credentialHeaders ?? []) {
+			const value = headers?.get(name);
+			if (value) add(value);
+		}
+		this.#secrets = [...values].sort((left, right) => right.length - left.length);
+	}
+	redact(cause) {
+		return this.redactCause(cause, 0, /* @__PURE__ */ new Set());
+	}
+	replaceSecrets(value) {
+		for (const secret of this.#secrets) value = value.split(secret).join("[REDACTED]");
+		return value;
+	}
+	diagnostic(value) {
+		return this.replaceSecrets(value).split(/[\r\n]/, 1)[0].slice(0, 300);
+	}
+	redactCause(cause, depth, seen) {
+		const message = readErrorProperty(cause, "message");
+		const error = new Error(this.diagnostic(typeof message === "string" ? message : typeof cause === "string" ? cause : "Unknown authentication infrastructure failure"));
+		const name = readErrorProperty(cause, "name");
+		error.name = typeof name === "string" ? this.diagnostic(name) : "Error";
+		for (const key of [
+			"code",
+			"errno",
+			"syscall"
+		]) {
+			const value = readErrorProperty(cause, key);
+			if (typeof value === "string" || typeof value === "number" && Number.isFinite(value)) Object.defineProperty(error, key, {
+				value: typeof value === "string" ? this.diagnostic(value) : value,
+				enumerable: true
+			});
+		}
+		const stack = readErrorProperty(cause, "stack");
+		const frames = typeof stack === "string" ? stack.split(/\r?\n/).filter((line) => /^\s+at .+:\d+:\d+\)?$/.test(line)).map((line) => this.replaceSecrets(line)) : [];
+		error.stack = [`${error.name}: ${error.message}`, ...frames].join("\n");
+		seen.add(cause);
+		const nested = readErrorProperty(cause, "cause");
+		if (nested !== void 0 && depth < 3 && !seen.has(nested)) Object.defineProperty(error, "cause", {
+			value: this.redactCause(nested, depth + 1, seen),
+			enumerable: false
+		});
+		return error;
+	}
+};
+//#endregion
+//#region src/auth-errors.ts
+const FAILURE_BRAND = Symbol.for("nestjs-slightly-better-auth:auth-failure");
+const INFRASTRUCTURE_BRAND = Symbol.for("nestjs-slightly-better-auth:infrastructure-error");
+const CONFIGURATION_BRAND = Symbol.for("nestjs-slightly-better-auth:configuration-error");
+const RAW_CAUSE = Symbol.for("nestjs-slightly-better-auth:raw-cause");
+const SDK_HEADERS = Symbol.for("better-call:api-error-headers");
+function branded(value, brand) {
+	Object.defineProperty(value, brand, { value: true });
+	return value;
+}
+function isAuthFailure(value) {
+	return readErrorProperty(value, FAILURE_BRAND) === true;
+}
+function isInfrastructureError(value) {
+	return readErrorProperty(value, INFRASTRUCTURE_BRAND) === true;
+}
+function isConfigurationError(value) {
+	return readErrorProperty(value, CONFIGURATION_BRAND) === true;
+}
+function sdkStatus(error) {
+	try {
+		if (!isAPIError(error)) return;
+		const status = readErrorProperty(error, "statusCode");
+		return typeof status === "number" && Number.isInteger(status) && status >= 100 && status <= 599 ? status : void 0;
+	} catch {
+		return;
+	}
+}
+function sdkReason(error) {
+	const reason = readErrorProperty(readErrorProperty(error, "body"), "code");
+	return typeof reason === "string" ? reason : void 0;
+}
+/** Internal: preserve cookie lines for the exchange's separately governed cleanup. */
+function getAPIErrorHeaders(error) {
+	const result = new Headers();
+	for (const value of [readErrorProperty(error, SDK_HEADERS), readErrorProperty(error, "headers")]) {
+		if (value === void 0 || value === null) continue;
+		try {
+			const headers = new Headers(value);
+			for (const [name, value] of headers) if (name !== "set-cookie") result.set(name, value);
+			for (const cookie of headers.getSetCookie()) result.append("set-cookie", cookie);
+		} catch {}
+	}
+	return result;
+}
+function rejection(input) {
+	const codes = {
+		401: "UNAUTHENTICATED",
+		403: "FORBIDDEN",
+		429: "RATE_LIMITED"
+	};
+	const messages = {
+		401: "Unauthorized",
+		403: "Forbidden",
+		429: "Too Many Requests"
+	};
+	const headers = new Headers();
+	const retry = input.retryAfterSeconds;
+	if (retry !== void 0 && Number.isFinite(retry) && retry >= 0) headers.set("retry-after", String(Math.ceil(retry)));
+	return branded({
+		status: input.status,
+		code: codes[input.status],
+		reason: input.reason,
+		message: input.message ?? messages[input.status],
+		challenge: input.challenge,
+		...headers.has("retry-after") ? { headers } : {}
+	}, FAILURE_BRAND);
+}
+const AuthFailures = {
+	unauthenticated(message) {
+		return rejection({
+			status: 401,
+			message
+		});
+	},
+	rejected: rejection,
+	forbidden(reason, message) {
+		return rejection({
+			status: 403,
+			reason,
+			message
+		});
+	},
+	fromAPIError(error) {
+		const status = sdkStatus(error);
+		if (status !== 401 && status !== 403 && status !== 429) return null;
+		const originalHeaders = getAPIErrorHeaders(error);
+		const delay = readErrorProperty(readErrorProperty(readErrorProperty(error, "body"), "details"), "tryAgainIn");
+		const failure = rejection({
+			status,
+			reason: sdkReason(error),
+			challenge: originalHeaders.get("www-authenticate") ?? void 0,
+			retryAfterSeconds: status === 429 && typeof delay === "number" ? delay / 1e3 : void 0
+		});
+		const retryAfter = originalHeaders.get("retry-after");
+		if (retryAfter !== null) {
+			const headers = new Headers(failure.headers);
+			headers.set("retry-after", retryAfter);
+			return branded({
+				...failure,
+				headers
+			}, FAILURE_BRAND);
+		}
+		return failure;
+	}
+};
+var BetterAuthConfigurationError = class BetterAuthConfigurationError extends Error {
+	code;
+	detail;
+	site;
+	hint;
+	phase;
+	extensions = {
+		code: "INTERNAL_SERVER_ERROR",
+		reason: "AUTH_MISCONFIGURED",
+		statusCode: 500
+	};
+	issues;
+	constructor(code, detail, hint) {
+		super(detail);
+		this.name = "BetterAuthConfigurationError";
+		this.code = code;
+		this.detail = detail;
+		this.hint = hint;
+		this.phase = "boot";
+		branded(this, CONFIGURATION_BRAND);
+	}
+	static atRequest(code, detail, options) {
+		const error = new BetterAuthConfigurationError(code, "Authentication is misconfigured", options?.hint);
+		Object.defineProperties(error, {
+			detail: {
+				value: detail,
+				enumerable: true
+			},
+			site: {
+				value: options?.site,
+				enumerable: true
+			},
+			phase: {
+				value: "request",
+				enumerable: true
+			}
+		});
+		return error;
+	}
+};
+var BetterAuthInfrastructureError = class extends Error {
+	cause;
+	extensions = {
+		code: "INTERNAL_SERVER_ERROR",
+		reason: "AUTH_UNAVAILABLE",
+		statusCode: 500
+	};
+	constructor(cause, options) {
+		super("Authentication service unavailable");
+		this.name = "BetterAuthInfrastructureError";
+		this.cause = new ErrorRedactor(options).redact(cause);
+		branded(this, INFRASTRUCTURE_BRAND);
+	}
+};
+/** Internal factory for an instance's explicit diagnostic opt-in, never global state. */
+function createInfrastructureError(cause, options) {
+	const error = new BetterAuthInfrastructureError(cause, options);
+	if (options?.exposeRawCause === true) Object.defineProperty(error, RAW_CAUSE, {
+		value: cause,
+		enumerable: false
+	});
+	return error;
+}
+function getRawCause(error) {
+	return readErrorProperty(error, RAW_CAUSE);
+}
+/** Internal safety net. Evaluation performs the authoritative session-loss recheck. */
+function normalizeThrown(error, where, site, secrets, options) {
+	if (isAuthFailure(error)) return error;
+	if (isInfrastructureError(error) || isConfigurationError(error)) throw error;
+	const status = sdkStatus(error);
+	const reason = sdkReason(error);
+	if (status === 429) return AuthFailures.fromAPIError(error);
+	if (status === 401 && where === "policy" && (reason === void 0 || reason === "UNAUTHORIZED")) return {
+		sessionLoss: error,
+		reason
+	};
+	if (status === 401 || status === 403) return where === "source" ? AuthFailures.fromAPIError(error) : AuthFailures.forbidden(reason ?? "FORBIDDEN");
+	if (status !== void 0 && status < 500) throw BetterAuthConfigurationError.atRequest("BETTER_AUTH_REJECTED_CALL", `better-auth rejected the library's call (${status} ${reason})`, { site });
+	throw createInfrastructureError(error, {
+		secrets,
+		exposeRawCause: options?.exposeRawCause
+	});
+}
+//#endregion
+export { getAPIErrorHeaders as a, isConfigurationError as c, ErrorRedactor as d, createInfrastructureError as i, isInfrastructureError as l, BetterAuthConfigurationError as n, getRawCause as o, BetterAuthInfrastructureError as r, isAuthFailure as s, AuthFailures as t, normalizeThrown as u };
+
+//# sourceMappingURL=auth-errors-CQjfgjaO.mjs.map

package/dist/auth-errors-CQjfgjaO.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-errors-CQjfgjaO.mjs","names":[],"sources":["../src/error-redactor.ts","../src/auth-errors.ts"],"sourcesContent":["/** Inputs come from the active request's owner; the redactor retains no scope. */\nexport interface ErrorRedactorOptions {\n  secrets?: readonly string[];\n  headers?: Headers;\n  credentialHeaders?: readonly string[];\n}\n\n/** Reading an arbitrary thrown value must not invoke another escaping fault. */\nexport function readErrorProperty(value: unknown, key: PropertyKey): unknown {\n  if (\n    (typeof value !== \"object\" || value === null) &&\n    typeof value !== \"function\"\n  ) {\n    return undefined;\n  }\n  try {\n    return Reflect.get(value, key);\n  } catch {\n    return undefined;\n  }\n}\n\nexport class ErrorRedactor {\n  readonly #secrets: readonly string[];\n\n  constructor(options: ErrorRedactorOptions = {}) {\n    const values = new Set<string>();\n    const add = (value: string) => {\n      if (!value) {\n        return;\n      }\n      values.add(value);\n      let decoded = value;\n      try {\n        decoded = decodeURIComponent(value);\n        values.add(decoded);\n      } catch {\n        // Invalid escaping must not prevent redaction of the raw credential.\n      }\n      for (const form of [value, decoded]) {\n        const separator = form.lastIndexOf(\".\");\n        if (separator >= 16) {\n          values.add(form.slice(0, separator));\n        }\n      }\n    };\n    for (const value of options.secrets ?? []) {\n      add(value);\n    }\n    const headers = options.headers;\n    for (const cookie of (headers?.get(\"cookie\") ?? \"\").split(\";\")) {\n      const separator = cookie.indexOf(\"=\");\n      if (separator >= 0) {\n        const value = cookie.slice(separator + 1).trim();\n        add(value);\n        if (value.startsWith('\"') && value.endsWith('\"')) {\n          add(value.slice(1, -1));\n        }\n      }\n    }\n    const authorization = headers?.get(\"authorization\");\n    if (authorization) {\n      add(authorization);\n      const credential = /^\\S+\\s+(.+)$/.exec(authorization)?.[1];\n      if (credential) {\n        add(credential);\n      }\n    }\n    for (const name of options.credentialHeaders ?? []) {\n      const value = headers?.get(name);\n      if (value) {\n        add(value);\n      }\n    }\n    this.#secrets = [...values].sort(\n      (left, right) => right.length - left.length,\n    );\n  }\n\n  redact(cause: unknown): Error {\n    return this.redactCause(cause, 0, new Set());\n  }\n\n  private replaceSecrets(value: string): string {\n    for (const secret of this.#secrets) {\n      value = value.split(secret).join(\"[REDACTED]\");\n    }\n    return value;\n  }\n\n  private diagnostic(value: string): string {\n    return this.replaceSecrets(value)\n      .split(/[\\r\\n]/, 1)[0]\n      .slice(0, 300);\n  }\n\n  private redactCause(\n    cause: unknown,\n    depth: number,\n    seen: Set<unknown>,\n  ): Error {\n    const message = readErrorProperty(cause, \"message\");\n    const error = new Error(\n      this.diagnostic(\n        typeof message === \"string\"\n          ? message\n          : typeof cause === \"string\"\n            ? cause\n            : \"Unknown authentication infrastructure failure\",\n      ),\n    );\n    const name = readErrorProperty(cause, \"name\");\n    error.name = typeof name === \"string\" ? this.diagnostic(name) : \"Error\";\n    for (const key of [\"code\", \"errno\", \"syscall\"] as const) {\n      const value = readErrorProperty(cause, key);\n      if (\n        typeof value === \"string\" ||\n        (typeof value === \"number\" && Number.isFinite(value))\n      ) {\n        Object.defineProperty(error, key, {\n          value: typeof value === \"string\" ? this.diagnostic(value) : value,\n          enumerable: true,\n        });\n      }\n    }\n    const stack = readErrorProperty(cause, \"stack\");\n    const frames =\n      typeof stack === \"string\"\n        ? stack\n            .split(/\\r?\\n/)\n            .filter((line) => /^\\s+at .+:\\d+:\\d+\\)?$/.test(line))\n            .map((line) => this.replaceSecrets(line))\n        : [];\n    error.stack = [`${error.name}: ${error.message}`, ...frames].join(\"\\n\");\n    seen.add(cause);\n    const nested = readErrorProperty(cause, \"cause\");\n    if (nested !== undefined && depth < 3 && !seen.has(nested)) {\n      Object.defineProperty(error, \"cause\", {\n        value: this.redactCause(nested, depth + 1, seen),\n        enumerable: false,\n      });\n    }\n    return error;\n  }\n}\n","import type { ExecutionContext } from \"@nestjs/common\";\nimport { isAPIError } from \"better-auth/api\";\nimport {\n  ErrorRedactor,\n  type ErrorRedactorOptions,\n  readErrorProperty,\n} from \"./error-redactor.js\";\n\nconst FAILURE_BRAND = Symbol.for(\"nestjs-slightly-better-auth:auth-failure\");\nconst INFRASTRUCTURE_BRAND = Symbol.for(\n  \"nestjs-slightly-better-auth:infrastructure-error\",\n);\nconst CONFIGURATION_BRAND = Symbol.for(\n  \"nestjs-slightly-better-auth:configuration-error\",\n);\nconst RAW_CAUSE = Symbol.for(\"nestjs-slightly-better-auth:raw-cause\");\nconst SDK_HEADERS = Symbol.for(\"better-call:api-error-headers\");\n\nexport type AuthErrorCode = \"UNAUTHENTICATED\" | \"FORBIDDEN\" | \"RATE_LIMITED\";\n\n/** A transport-neutral denial. Only transports make it throwable. */\nexport interface AuthFailure {\n  readonly status: 401 | 403 | 429;\n  readonly code: AuthErrorCode;\n  readonly reason?: string;\n  readonly message: string;\n  readonly challenge?: string;\n  readonly headers?: Headers;\n}\n\nexport interface AuthErrorBody {\n  statusCode: 401 | 403 | 429;\n  error: string;\n  code: AuthErrorCode;\n  reason?: string;\n  message: string;\n}\n\nexport interface AuthGraphqlExtensions {\n  code: AuthErrorCode | \"INTERNAL_SERVER_ERROR\";\n  reason?: string;\n  statusCode: number;\n}\n\nexport interface AuthTransportErrorPayload {\n  status: \"error\";\n  statusCode: number;\n  code: AuthErrorCode;\n  reason?: string;\n  message: string;\n}\n\nexport interface ErrorMappingOptions {\n  map?: (\n    failure: AuthFailure,\n    context: ExecutionContext,\n    transport: string,\n  ) => unknown;\n  exposeRawCause?: boolean;\n}\n\nfunction branded<T extends object>(value: T, brand: symbol): T {\n  Object.defineProperty(value, brand, { value: true });\n  return value;\n}\n\nexport function isAuthFailure(value: unknown): value is AuthFailure {\n  return readErrorProperty(value, FAILURE_BRAND) === true;\n}\n\nexport function isInfrastructureError(\n  value: unknown,\n): value is BetterAuthInfrastructureError {\n  return readErrorProperty(value, INFRASTRUCTURE_BRAND) === true;\n}\n\nexport function isConfigurationError(\n  value: unknown,\n): value is BetterAuthConfigurationError {\n  return readErrorProperty(value, CONFIGURATION_BRAND) === true;\n}\n\nfunction sdkStatus(error: unknown): number | undefined {\n  try {\n    if (!isAPIError(error)) {\n      return undefined;\n    }\n    const status = readErrorProperty(error, \"statusCode\");\n    return typeof status === \"number\" &&\n      Number.isInteger(status) &&\n      status >= 100 &&\n      status <= 599\n      ? status\n      : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction sdkReason(error: unknown): string | undefined {\n  const reason = readErrorProperty(readErrorProperty(error, \"body\"), \"code\");\n  return typeof reason === \"string\" ? reason : undefined;\n}\n\n/** Internal: preserve cookie lines for the exchange's separately governed cleanup. */\nexport function getAPIErrorHeaders(error: unknown): Headers {\n  const result = new Headers();\n  for (const value of [\n    readErrorProperty(error, SDK_HEADERS),\n    readErrorProperty(error, \"headers\"),\n  ]) {\n    if (value === undefined || value === null) {\n      continue;\n    }\n    try {\n      const headers = new Headers(value as HeadersInit);\n      for (const [name, value] of headers) {\n        if (name !== \"set-cookie\") {\n          result.set(name, value);\n        }\n      }\n      for (const cookie of headers.getSetCookie()) {\n        result.append(\"set-cookie\", cookie);\n      }\n    } catch {\n      // A malformed optional header collection must not mask the original fault.\n    }\n  }\n  return result;\n}\n\nfunction rejection(input: {\n  status: 401 | 403 | 429;\n  reason?: string;\n  message?: string;\n  challenge?: string;\n  retryAfterSeconds?: number;\n}): AuthFailure {\n  const codes = {\n    401: \"UNAUTHENTICATED\",\n    403: \"FORBIDDEN\",\n    429: \"RATE_LIMITED\",\n  } as const;\n  const messages = {\n    401: \"Unauthorized\",\n    403: \"Forbidden\",\n    429: \"Too Many Requests\",\n  } as const;\n  const headers = new Headers();\n  const retry = input.retryAfterSeconds;\n  if (retry !== undefined && Number.isFinite(retry) && retry >= 0) {\n    headers.set(\"retry-after\", String(Math.ceil(retry)));\n  }\n  return branded(\n    {\n      status: input.status,\n      code: codes[input.status],\n      reason: input.reason,\n      message: input.message ?? messages[input.status],\n      challenge: input.challenge,\n      ...(headers.has(\"retry-after\") ? { headers } : {}),\n    },\n    FAILURE_BRAND,\n  );\n}\n\nexport const AuthFailures = {\n  unauthenticated(message?: string): AuthFailure {\n    return rejection({ status: 401, message });\n  },\n  rejected: rejection,\n  forbidden(reason: string, message?: string): AuthFailure {\n    return rejection({ status: 403, reason, message });\n  },\n  fromAPIError(error: unknown): AuthFailure | null {\n    const status = sdkStatus(error);\n    if (status !== 401 && status !== 403 && status !== 429) {\n      return null;\n    }\n    const originalHeaders = getAPIErrorHeaders(error);\n    const details = readErrorProperty(\n      readErrorProperty(error, \"body\"),\n      \"details\",\n    );\n    const delay = readErrorProperty(details, \"tryAgainIn\");\n    const failure = rejection({\n      status,\n      reason: sdkReason(error),\n      challenge: originalHeaders.get(\"www-authenticate\") ?? undefined,\n      retryAfterSeconds:\n        status === 429 && typeof delay === \"number\" ? delay / 1000 : undefined,\n    });\n    const retryAfter = originalHeaders.get(\"retry-after\");\n    if (retryAfter !== null) {\n      const headers = new Headers(failure.headers);\n      headers.set(\"retry-after\", retryAfter);\n      return branded({ ...failure, headers }, FAILURE_BRAND);\n    }\n    return failure;\n  },\n};\n\nexport class BetterAuthConfigurationError extends Error {\n  readonly code: string;\n  readonly detail: string;\n  readonly site?: string;\n  readonly hint?: string;\n  readonly phase: \"boot\" | \"request\";\n  readonly extensions = {\n    code: \"INTERNAL_SERVER_ERROR\",\n    reason: \"AUTH_MISCONFIGURED\",\n    statusCode: 500,\n  } as const;\n  readonly issues?: readonly BetterAuthConfigurationError[];\n\n  constructor(code: string, detail: string, hint?: string) {\n    super(detail);\n    this.name = \"BetterAuthConfigurationError\";\n    this.code = code;\n    this.detail = detail;\n    this.hint = hint;\n    this.phase = \"boot\";\n    branded(this, CONFIGURATION_BRAND);\n  }\n\n  static atRequest(\n    code: string,\n    detail: string,\n    options?: { site?: string; hint?: string },\n  ): BetterAuthConfigurationError {\n    const error = new BetterAuthConfigurationError(\n      code,\n      \"Authentication is misconfigured\",\n      options?.hint,\n    );\n    Object.defineProperties(error, {\n      detail: { value: detail, enumerable: true },\n      site: { value: options?.site, enumerable: true },\n      phase: { value: \"request\", enumerable: true },\n    });\n    return error;\n  }\n}\n\nexport class BetterAuthInfrastructureError extends Error {\n  readonly cause: Error;\n  readonly extensions = {\n    code: \"INTERNAL_SERVER_ERROR\",\n    reason: \"AUTH_UNAVAILABLE\",\n    statusCode: 500,\n  } as const;\n\n  constructor(cause: unknown, options?: { secrets?: readonly string[] }) {\n    super(\"Authentication service unavailable\");\n    this.name = \"BetterAuthInfrastructureError\";\n    this.cause = new ErrorRedactor(options).redact(cause);\n    branded(this, INFRASTRUCTURE_BRAND);\n  }\n}\n\n/** Internal factory for an instance's explicit diagnostic opt-in, never global state. */\nexport function createInfrastructureError(\n  cause: unknown,\n  options?: ErrorRedactorOptions & { exposeRawCause?: boolean },\n): BetterAuthInfrastructureError {\n  // Preserve request-owned redaction inputs without widening the public constructor.\n  const error = new BetterAuthInfrastructureError(cause, options);\n  if (options?.exposeRawCause === true) {\n    Object.defineProperty(error, RAW_CAUSE, {\n      value: cause,\n      enumerable: false,\n    });\n  }\n  return error;\n}\n\nexport function getRawCause(error: BetterAuthInfrastructureError): unknown {\n  return readErrorProperty(error, RAW_CAUSE);\n}\n\n/** Internal: evaluation must distinguish session loss from a failed session read. */\nexport interface SessionLossCandidate {\n  readonly sessionLoss: unknown;\n  readonly reason?: string;\n}\n\n/** Internal safety net. Evaluation performs the authoritative session-loss recheck. */\nexport function normalizeThrown(\n  error: unknown,\n  where: \"source\" | \"policy\",\n  site: string,\n  secrets: readonly string[],\n  options?: { exposeRawCause?: boolean },\n): AuthFailure | SessionLossCandidate {\n  if (isAuthFailure(error)) {\n    return error;\n  }\n  if (isInfrastructureError(error) || isConfigurationError(error)) {\n    throw error;\n  }\n  const status = sdkStatus(error);\n  const reason = sdkReason(error);\n  if (status === 429) {\n    return AuthFailures.fromAPIError(error)!;\n  }\n  if (\n    status === 401 &&\n    where === \"policy\" &&\n    (reason === undefined || reason === \"UNAUTHORIZED\")\n  ) {\n    return { sessionLoss: error, reason };\n  }\n  if (status === 401 || status === 403) {\n    return where === \"source\"\n      ? AuthFailures.fromAPIError(error)!\n      : AuthFailures.forbidden(reason ?? \"FORBIDDEN\");\n  }\n  if (status !== undefined && status < 500) {\n    throw BetterAuthConfigurationError.atRequest(\n      \"BETTER_AUTH_REJECTED_CALL\",\n      `better-auth rejected the library's call (${status} ${reason})`,\n      { site },\n    );\n  }\n  throw createInfrastructureError(error, {\n    secrets,\n    exposeRawCause: options?.exposeRawCause,\n  });\n}\n"],"mappings":";;;AAQA,SAAgB,kBAAkB,OAAgB,KAA2B;CAC3E,KACG,OAAO,UAAU,YAAY,UAAU,SACxC,OAAO,UAAU,YAEjB;CAEF,IAAI;EACF,OAAO,QAAQ,IAAI,OAAO,GAAG;CAC/B,QAAQ;EACN;CACF;AACF;AAEA,IAAa,gBAAb,MAA2B;CACzB;CAEA,YAAY,UAAgC,CAAC,GAAG;EAC9C,MAAM,yBAAS,IAAI,IAAY;EAC/B,MAAM,OAAO,UAAkB;GAC7B,IAAI,CAAC,OACH;GAEF,OAAO,IAAI,KAAK;GAChB,IAAI,UAAU;GACd,IAAI;IACF,UAAU,mBAAmB,KAAK;IAClC,OAAO,IAAI,OAAO;GACpB,QAAQ,CAER;GACA,KAAK,MAAM,QAAQ,CAAC,OAAO,OAAO,GAAG;IACnC,MAAM,YAAY,KAAK,YAAY,GAAG;IACtC,IAAI,aAAa,IACf,OAAO,IAAI,KAAK,MAAM,GAAG,SAAS,CAAC;GAEvC;EACF;EACA,KAAK,MAAM,SAAS,QAAQ,WAAW,CAAC,GACtC,IAAI,KAAK;EAEX,MAAM,UAAU,QAAQ;EACxB,KAAK,MAAM,WAAW,SAAS,IAAI,QAAQ,KAAK,GAAA,CAAI,MAAM,GAAG,GAAG;GAC9D,MAAM,YAAY,OAAO,QAAQ,GAAG;GACpC,IAAI,aAAa,GAAG;IAClB,MAAM,QAAQ,OAAO,MAAM,YAAY,CAAC,CAAC,CAAC,KAAK;IAC/C,IAAI,KAAK;IACT,IAAI,MAAM,WAAW,IAAG,KAAK,MAAM,SAAS,IAAG,GAC7C,IAAI,MAAM,MAAM,GAAG,EAAE,CAAC;GAE1B;EACF;EACA,MAAM,gBAAgB,SAAS,IAAI,eAAe;EAClD,IAAI,eAAe;GACjB,IAAI,aAAa;GACjB,MAAM,aAAa,eAAe,KAAK,aAAa,CAAC,GAAG;GACxD,IAAI,YACF,IAAI,UAAU;EAElB;EACA,KAAK,MAAM,QAAQ,QAAQ,qBAAqB,CAAC,GAAG;GAClD,MAAM,QAAQ,SAAS,IAAI,IAAI;GAC/B,IAAI,OACF,IAAI,KAAK;EAEb;EACA,KAAK,WAAW,CAAC,GAAG,MAAM,CAAC,CAAC,MACzB,MAAM,UAAU,MAAM,SAAS,KAAK,MACvC;CACF;CAEA,OAAO,OAAuB;EAC5B,OAAO,KAAK,YAAY,OAAO,mBAAG,IAAI,IAAI,CAAC;CAC7C;CAEA,eAAuB,OAAuB;EAC5C,KAAK,MAAM,UAAU,KAAK,UACxB,QAAQ,MAAM,MAAM,MAAM,CAAC,CAAC,KAAK,YAAY;EAE/C,OAAO;CACT;CAEA,WAAmB,OAAuB;EACxC,OAAO,KAAK,eAAe,KAAK,CAAC,CAC9B,MAAM,UAAU,CAAC,CAAC,CAAC,EAAE,CACrB,MAAM,GAAG,GAAG;CACjB;CAEA,YACE,OACA,OACA,MACO;EACP,MAAM,UAAU,kBAAkB,OAAO,SAAS;EAClD,MAAM,QAAQ,IAAI,MAChB,KAAK,WACH,OAAO,YAAY,WACf,UACA,OAAO,UAAU,WACf,QACA,+CACR,CACF;EACA,MAAM,OAAO,kBAAkB,OAAO,MAAM;EAC5C,MAAM,OAAO,OAAO,SAAS,WAAW,KAAK,WAAW,IAAI,IAAI;EAChE,KAAK,MAAM,OAAO;GAAC;GAAQ;GAAS;EAAS,GAAY;GACvD,MAAM,QAAQ,kBAAkB,OAAO,GAAG;GAC1C,IACE,OAAO,UAAU,YAChB,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,GAEnD,OAAO,eAAe,OAAO,KAAK;IAChC,OAAO,OAAO,UAAU,WAAW,KAAK,WAAW,KAAK,IAAI;IAC5D,YAAY;GACd,CAAC;EAEL;EACA,MAAM,QAAQ,kBAAkB,OAAO,OAAO;EAC9C,MAAM,SACJ,OAAO,UAAU,WACb,MACG,MAAM,OAAO,CAAC,CACd,QAAQ,SAAS,wBAAwB,KAAK,IAAI,CAAC,CAAC,CACpD,KAAK,SAAS,KAAK,eAAe,IAAI,CAAC,IAC1C,CAAC;EACP,MAAM,QAAQ,CAAC,GAAG,MAAM,KAAK,IAAI,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,KAAK,IAAI;EACtE,KAAK,IAAI,KAAK;EACd,MAAM,SAAS,kBAAkB,OAAO,OAAO;EAC/C,IAAI,WAAW,KAAA,KAAa,QAAQ,KAAK,CAAC,KAAK,IAAI,MAAM,GACvD,OAAO,eAAe,OAAO,SAAS;GACpC,OAAO,KAAK,YAAY,QAAQ,QAAQ,GAAG,IAAI;GAC/C,YAAY;EACd,CAAC;EAEH,OAAO;CACT;AACF;;;ACxIA,MAAM,gBAAgB,OAAO,IAAI,0CAA0C;AAC3E,MAAM,uBAAuB,OAAO,IAClC,kDACF;AACA,MAAM,sBAAsB,OAAO,IACjC,iDACF;AACA,MAAM,YAAY,OAAO,IAAI,uCAAuC;AACpE,MAAM,cAAc,OAAO,IAAI,+BAA+B;AA6C9D,SAAS,QAA0B,OAAU,OAAkB;CAC7D,OAAO,eAAe,OAAO,OAAO,EAAE,OAAO,KAAK,CAAC;CACnD,OAAO;AACT;AAEA,SAAgB,cAAc,OAAsC;CAClE,OAAO,kBAAkB,OAAO,aAAa,MAAM;AACrD;AAEA,SAAgB,sBACd,OACwC;CACxC,OAAO,kBAAkB,OAAO,oBAAoB,MAAM;AAC5D;AAEA,SAAgB,qBACd,OACuC;CACvC,OAAO,kBAAkB,OAAO,mBAAmB,MAAM;AAC3D;AAEA,SAAS,UAAU,OAAoC;CACrD,IAAI;EACF,IAAI,CAAC,WAAW,KAAK,GACnB;EAEF,MAAM,SAAS,kBAAkB,OAAO,YAAY;EACpD,OAAO,OAAO,WAAW,YACvB,OAAO,UAAU,MAAM,KACvB,UAAU,OACV,UAAU,MACR,SACA,KAAA;CACN,QAAQ;EACN;CACF;AACF;AAEA,SAAS,UAAU,OAAoC;CACrD,MAAM,SAAS,kBAAkB,kBAAkB,OAAO,MAAM,GAAG,MAAM;CACzE,OAAO,OAAO,WAAW,WAAW,SAAS,KAAA;AAC/C;;AAGA,SAAgB,mBAAmB,OAAyB;CAC1D,MAAM,SAAS,IAAI,QAAQ;CAC3B,KAAK,MAAM,SAAS,CAClB,kBAAkB,OAAO,WAAW,GACpC,kBAAkB,OAAO,SAAS,CACpC,GAAG;EACD,IAAI,UAAU,KAAA,KAAa,UAAU,MACnC;EAEF,IAAI;GACF,MAAM,UAAU,IAAI,QAAQ,KAAoB;GAChD,KAAK,MAAM,CAAC,MAAM,UAAU,SAC1B,IAAI,SAAS,cACX,OAAO,IAAI,MAAM,KAAK;GAG1B,KAAK,MAAM,UAAU,QAAQ,aAAa,GACxC,OAAO,OAAO,cAAc,MAAM;EAEtC,QAAQ,CAER;CACF;CACA,OAAO;AACT;AAEA,SAAS,UAAU,OAMH;CACd,MAAM,QAAQ;EACZ,KAAK;EACL,KAAK;EACL,KAAK;CACP;CACA,MAAM,WAAW;EACf,KAAK;EACL,KAAK;EACL,KAAK;CACP;CACA,MAAM,UAAU,IAAI,QAAQ;CAC5B,MAAM,QAAQ,MAAM;CACpB,IAAI,UAAU,KAAA,KAAa,OAAO,SAAS,KAAK,KAAK,SAAS,GAC5D,QAAQ,IAAI,eAAe,OAAO,KAAK,KAAK,KAAK,CAAC,CAAC;CAErD,OAAO,QACL;EACE,QAAQ,MAAM;EACd,MAAM,MAAM,MAAM;EAClB,QAAQ,MAAM;EACd,SAAS,MAAM,WAAW,SAAS,MAAM;EACzC,WAAW,MAAM;EACjB,GAAI,QAAQ,IAAI,aAAa,IAAI,EAAE,QAAQ,IAAI,CAAC;CAClD,GACA,aACF;AACF;AAEA,MAAa,eAAe;CAC1B,gBAAgB,SAA+B;EAC7C,OAAO,UAAU;GAAE,QAAQ;GAAK;EAAQ,CAAC;CAC3C;CACA,UAAU;CACV,UAAU,QAAgB,SAA+B;EACvD,OAAO,UAAU;GAAE,QAAQ;GAAK;GAAQ;EAAQ,CAAC;CACnD;CACA,aAAa,OAAoC;EAC/C,MAAM,SAAS,UAAU,KAAK;EAC9B,IAAI,WAAW,OAAO,WAAW,OAAO,WAAW,KACjD,OAAO;EAET,MAAM,kBAAkB,mBAAmB,KAAK;EAKhD,MAAM,QAAQ,kBAJE,kBACd,kBAAkB,OAAO,MAAM,GAC/B,SAE8B,GAAS,YAAY;EACrD,MAAM,UAAU,UAAU;GACxB;GACA,QAAQ,UAAU,KAAK;GACvB,WAAW,gBAAgB,IAAI,kBAAkB,KAAK,KAAA;GACtD,mBACE,WAAW,OAAO,OAAO,UAAU,WAAW,QAAQ,MAAO,KAAA;EACjE,CAAC;EACD,MAAM,aAAa,gBAAgB,IAAI,aAAa;EACpD,IAAI,eAAe,MAAM;GACvB,MAAM,UAAU,IAAI,QAAQ,QAAQ,OAAO;GAC3C,QAAQ,IAAI,eAAe,UAAU;GACrC,OAAO,QAAQ;IAAE,GAAG;IAAS;GAAQ,GAAG,aAAa;EACvD;EACA,OAAO;CACT;AACF;AAEA,IAAa,+BAAb,MAAa,qCAAqC,MAAM;CACtD;CACA;CACA;CACA;CACA;CACA,aAAsB;EACpB,MAAM;EACN,QAAQ;EACR,YAAY;CACd;CACA;CAEA,YAAY,MAAc,QAAgB,MAAe;EACvD,MAAM,MAAM;EACZ,KAAK,OAAO;EACZ,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,KAAK,OAAO;EACZ,KAAK,QAAQ;EACb,QAAQ,MAAM,mBAAmB;CACnC;CAEA,OAAO,UACL,MACA,QACA,SAC8B;EAC9B,MAAM,QAAQ,IAAI,6BAChB,MACA,mCACA,SAAS,IACX;EACA,OAAO,iBAAiB,OAAO;GAC7B,QAAQ;IAAE,OAAO;IAAQ,YAAY;GAAK;GAC1C,MAAM;IAAE,OAAO,SAAS;IAAM,YAAY;GAAK;GAC/C,OAAO;IAAE,OAAO;IAAW,YAAY;GAAK;EAC9C,CAAC;EACD,OAAO;CACT;AACF;AAEA,IAAa,gCAAb,cAAmD,MAAM;CACvD;CACA,aAAsB;EACpB,MAAM;EACN,QAAQ;EACR,YAAY;CACd;CAEA,YAAY,OAAgB,SAA2C;EACrE,MAAM,oCAAoC;EAC1C,KAAK,OAAO;EACZ,KAAK,QAAQ,IAAI,cAAc,OAAO,CAAC,CAAC,OAAO,KAAK;EACpD,QAAQ,MAAM,oBAAoB;CACpC;AACF;;AAGA,SAAgB,0BACd,OACA,SAC+B;CAE/B,MAAM,QAAQ,IAAI,8BAA8B,OAAO,OAAO;CAC9D,IAAI,SAAS,mBAAmB,MAC9B,OAAO,eAAe,OAAO,WAAW;EACtC,OAAO;EACP,YAAY;CACd,CAAC;CAEH,OAAO;AACT;AAEA,SAAgB,YAAY,OAA+C;CACzE,OAAO,kBAAkB,OAAO,SAAS;AAC3C;;AASA,SAAgB,gBACd,OACA,OACA,MACA,SACA,SACoC;CACpC,IAAI,cAAc,KAAK,GACrB,OAAO;CAET,IAAI,sBAAsB,KAAK,KAAK,qBAAqB,KAAK,GAC5D,MAAM;CAER,MAAM,SAAS,UAAU,KAAK;CAC9B,MAAM,SAAS,UAAU,KAAK;CAC9B,IAAI,WAAW,KACb,OAAO,aAAa,aAAa,KAAK;CAExC,IACE,WAAW,OACX,UAAU,aACT,WAAW,KAAA,KAAa,WAAW,iBAEpC,OAAO;EAAE,aAAa;EAAO;CAAO;CAEtC,IAAI,WAAW,OAAO,WAAW,KAC/B,OAAO,UAAU,WACb,aAAa,aAAa,KAAK,IAC/B,aAAa,UAAU,UAAU,WAAW;CAElD,IAAI,WAAW,KAAA,KAAa,SAAS,KACnC,MAAM,6BAA6B,UACjC,6BACA,4CAA4C,OAAO,GAAG,OAAO,IAC7D,EAAE,KAAK,CACT;CAEF,MAAM,0BAA0B,OAAO;EACrC;EACA,gBAAgB,SAAS;CAC3B,CAAC;AACH"}