nestjs-slightly-better-auth 1.0.0

package/dist/index.mjs

@@ -0,0 +1,2556 @@
+import { a as getAPIErrorHeaders, c as isConfigurationError, d as ErrorRedactor, i as createInfrastructureError, l as isInfrastructureError, n as BetterAuthConfigurationError, o as getRawCause, r as BetterAuthInfrastructureError, s as isAuthFailure, t as AuthFailures } from "./auth-errors-CQjfgjaO.mjs";
+import { $ as POLICY_RESOLVER, A as __decorateParam, B as ACCEPT_PRINCIPALS_METADATA, C as RequestScope, D as BetterAuthGuard, E as ScopeCore, F as authenticated, G as FRESHNESS_METADATA, H as AUTH_ENHANCER, I as definePrincipalSource, J as INVOCATION_PARAMS_METADATA, K as GUARD_CORE, L as normalizeForRequest, M as ChainPrincipalResolver, N as MemoKeys, O as GuardCore, P as absent, Q as POLICY_INVOKER, R as rejected, S as PrincipalReadings, T as BetterAuthScopeInterceptor, U as AUTH_INSTANCE_METADATA, V as ACCESS_METADATA, W as FORWARD_COOKIES_METADATA, X as MOUNT_COORDINATOR, Y as INVOCATION_VALUES, Z as PLATFORMS, _ as anyOf, _t as getPrincipalSourcesToken, a as BeforeDatabase, at as ROUTE_PLANNER, b as readHookMetadata, c as OptionalAuth, ct as SKIP_ORIGIN_CHECK_METADATA, d as RequireAuth, dt as USE_BETTER_AUTH_METADATA, et as PRINCIPAL_PARAMS_METADATA, f as SkipDefaultRequirements, ft as getBetterAuthHandleToken, g as allOf, gt as getExtensionToken, h as UseBetterAuth, ht as getBetterAuthServiceToken, i as BeforeAuth, it as REQUIREMENTS_METADATA, j as __decorateMetadata, k as __decorate, l as Public, lt as TRANSPORTS, m as UseAuthInstance, mt as getBetterAuthOptionsToken, n as AfterAuth, nt as PRINCIPAL_RESOLVER, o as CurrentPrincipal, ot as SCOPE_CORE, p as SkipOriginCheck, pt as getBetterAuthInstanceToken, q as INSTANCE_REGISTRY, r as AfterDatabase, rt as REQUEST_SCOPE, s as ForwardAuthCookies, st as SKIP_DEFAULT_REQUIREMENTS_METADATA, t as AcceptPrincipals, tt as PRINCIPAL_READINGS, u as Require, ut as TRANSPORT_REGISTRY, v as defineInvocationParam, w as memoKey, x as requirement, y as definePrincipalParam, z as requestHeaders } from "./auth-decorators-DfAJbHar.mjs";
+import { readBoundedBody } from "./platform.mjs";
+import { isAPIError } from "better-auth/api";
+import { Controller, ForbiddenException, Get, Global, HttpException, Inject, Logger, Module, RequestMethod, UnauthorizedException, UseGuards, UseInterceptors, VERSION_NEUTRAL, VersioningType } from "@nestjs/common";
+import { APP_GUARD, APP_INTERCEPTOR, ApplicationConfig, DiscoveryModule, DiscoveryService, HttpAdapterHost, MetadataScanner, ModuleRef, ModulesContainer, Reflector } from "@nestjs/core";
+import { RoutePathFactory } from "@nestjs/core/router/route-path-factory.js";
+//#region src/route-planner.ts
+function classes(target) {
+	const result = [];
+	for (let current = target; current && current !== Function.prototype; current = Object.getPrototypeOf(current)) result.push(current);
+	return result;
+}
+function own(key, target) {
+	return Reflect.getOwnMetadata(key, target);
+}
+function closest(key, targets) {
+	for (const target of targets) {
+		const value = own(key, target);
+		if (value !== void 0) return value;
+	}
+}
+function methodName(target, handler) {
+	for (let prototype = target.prototype; prototype && prototype !== Object.prototype; prototype = Object.getPrototypeOf(prototype)) for (const name of Object.getOwnPropertyNames(prototype)) if (name !== "constructor" && Object.getOwnPropertyDescriptor(prototype, name)?.value === handler) return name;
+	throw new BetterAuthConfigurationError("UNKNOWN_HANDLER", `Cannot locate handler on ${target.name}`);
+}
+var RoutePlanner = class {
+	instances;
+	policies;
+	transports;
+	cache = /* @__PURE__ */ new WeakMap();
+	constructor(instances, policies, transports) {
+		this.instances = instances;
+		this.policies = policies;
+		this.transports = transports;
+	}
+	prepare(target, method) {
+		const handler = Reflect.get(target.prototype, method);
+		if (typeof handler !== "function") throw new BetterAuthConfigurationError("UNKNOWN_HANDLER", `${target.name}.${method} is not a handler`);
+		const chain = classes(target);
+		const nested = this.transports.defaultAccessFor(target, method) === "inherit";
+		const levels = nested ? [handler] : [handler, ...chain];
+		const site = `${target.name}.${method}`;
+		for (const level of levels) {
+			const access = own(ACCESS_METADATA, level);
+			if ((access === "public" || access === "optional") && (own(REQUIREMENTS_METADATA, level)?.length ?? 0) > 0) throw new BetterAuthConfigurationError("CONTRADICTORY_ACCESS", `${site} combines anonymous access and requirements at the same level`);
+		}
+		const instance = closest(AUTH_INSTANCE_METADATA, [handler, ...chain]) ?? "default";
+		const entry = this.instances.get(instance);
+		let access = nested ? "inherit" : entry.options.defaultAccess === "public" ? "public" : "required";
+		for (const level of levels) {
+			const declared = own(ACCESS_METADATA, level);
+			if (declared) {
+				access = declared;
+				break;
+			}
+			if ((own(REQUIREMENTS_METADATA, level)?.length ?? 0) > 0 || nested && own(ACCEPT_PRINCIPALS_METADATA, level) !== void 0) {
+				access = "required";
+				break;
+			}
+		}
+		const skips = closest(SKIP_DEFAULT_REQUIREMENTS_METADATA, levels) === true;
+		const declaredRequirements = access === "required" ? [
+			...(skips ? [] : entry.options.defaultRequirements ?? []).map((expression) => ({
+				expression,
+				origin: "defaultRequirements"
+			})),
+			...nested ? [] : [...chain].reverse().flatMap((level) => (own(REQUIREMENTS_METADATA, level) ?? []).map((expression) => ({
+				expression,
+				origin: `${level.name} (class)`
+			}))),
+			...(own(REQUIREMENTS_METADATA, handler) ?? []).map((expression) => ({
+				expression,
+				origin: `${site} (method)`
+			}))
+		] : [];
+		const requirements = declaredRequirements.map((item) => item.expression);
+		return {
+			handler,
+			chain,
+			levels,
+			nested,
+			site,
+			instance,
+			entry,
+			access,
+			skips,
+			requirements,
+			declaredRequirements
+		};
+	}
+	requirementsOf(target, method) {
+		return Object.freeze(this.prepare(target, method).requirements);
+	}
+	forContext(context) {
+		try {
+			return this.plan(context.getClass(), methodName(context.getClass(), context.getHandler()));
+		} catch (error) {
+			if (isConfigurationError(error) && error.phase !== "request") throw BetterAuthConfigurationError.atRequest(error.code, error.detail, {
+				site: `${context.getClass().name}.${context.getHandler().name}`,
+				hint: error.hint
+			});
+			throw error;
+		}
+	}
+	plan(target, method) {
+		const handler = Reflect.get(target.prototype, method);
+		let cache = this.cache.get(target);
+		const previous = cache?.get(handler);
+		if (previous) return previous;
+		const p = this.prepare(target, method);
+		const { entry, levels, chain } = p;
+		const allKinds = new Set(entry.sources.flatMap((source) => [...source.kinds]));
+		const accepts = new Set(closest(ACCEPT_PRINCIPALS_METADATA, levels) ?? entry.sources.filter((source) => source.acceptance === "default").flatMap((source) => [...source.kinds]));
+		let fresh = closest(FRESHNESS_METADATA, levels) === true || entry.options.session !== false && entry.options.session?.freshness === "authoritative";
+		const admitted = (expression) => {
+			if ("anyOf" in expression) return new Set(expression.anyOf.flatMap((child) => [...admitted(child)]));
+			if ("allOf" in expression) return intersection(expression.allOf.map(admitted), allKinds);
+			const policy = this.policies.resolve(expression.policy);
+			const kinds = expression.principals ?? policy.requires?.principals;
+			if (expression.freshIdentity ?? policy.requires?.freshIdentity) fresh = true;
+			if (kinds) for (const kind of kinds) accepts.add(kind);
+			return new Set(kinds ?? entry.sources.filter((source) => !source.delegates).flatMap((source) => [...source.kinds]));
+		};
+		const permitted = p.requirements.map(admitted);
+		for (const kind of accepts) if (!allKinds.has(kind)) throw new BetterAuthConfigurationError("UNKNOWN_PRINCIPAL_KIND", `${p.site} accepts unavailable principal kind ${kind}`);
+		const parameters = own(PRINCIPAL_PARAMS_METADATA, handler) ?? [];
+		if (p.access === "public" && parameters.length) throw new BetterAuthConfigurationError("PUBLIC_READS_PRINCIPAL", `${p.site} reads a principal on a public handler`, "Use OptionalAuth");
+		const principalParams = parameters.flatMap((param) => param.kind ? [{
+			kind: param.kind,
+			reason: param.reason
+		}] : []);
+		if (p.access !== "inherit") {
+			for (const param of principalParams) if ([...accepts].some((kind) => kind !== param.kind)) throw new BetterAuthConfigurationError("PRINCIPAL_PARAM_CONFLICT", `${p.site} admits a kind rejected by its principal parameter`, "Use CurrentPrincipal and narrow kind");
+		}
+		if (p.access === "required" && !intersection([accepts, ...permitted], allKinds).size) {
+			const describe = (expression) => {
+				if ("anyOf" in expression) return `anyOf(${expression.anyOf.map(describe).join(", ")})`;
+				if ("allOf" in expression) return `allOf(${expression.allOf.map(describe).join(", ")})`;
+				return expression.label ?? this.policies.resolve(expression.policy).id;
+			};
+			const declarations = p.declaredRequirements.map(({ expression, origin }) => `${origin}: ${describe(expression)}`);
+			throw new BetterAuthConfigurationError("UNSATISFIABLE_PRINCIPAL_KINDS", `${p.site} has no eligible principal kind satisfying its requirements. Accepted kinds: ${[...accepts].join(", ") || "none"}.${declarations.length ? ` Requirements: ${declarations.join("; ")}.` : ""}`, p.declaredRequirements.some((item) => item.origin === "defaultRequirements") ? "Review the conflicting requirements; use @SkipDefaultRequirements() to explicitly opt this handler out of instance defaults." : "Review accepted kinds and requirement restrictions; configure a default source or explicitly accept a registered principal kind.");
+		}
+		const forwardDirectCalls = closest(FORWARD_COOKIES_METADATA, [handler, ...chain]) ?? entry.options.cookies?.forwardDirectCalls ?? false;
+		const originCheck = closest(SKIP_ORIGIN_CHECK_METADATA, [handler, ...chain]) || entry.options.originCheck?.mode === "off" ? "off" : forwardDirectCalls ? "form" : "cookie";
+		const declares = forwardDirectCalls || levels.some((level) => {
+			const access = own(ACCESS_METADATA, level);
+			return access === "required" || access === "optional" || [
+				ACCEPT_PRINCIPALS_METADATA,
+				REQUIREMENTS_METADATA,
+				PRINCIPAL_PARAMS_METADATA,
+				INVOCATION_PARAMS_METADATA
+			].some((key) => own(key, level) !== void 0);
+		});
+		const plan = Object.freeze({
+			instance: p.instance,
+			access: p.access,
+			nested: p.nested,
+			site: p.site,
+			requirements: Object.freeze(p.requirements),
+			skipsDefaultRequirements: p.access === "required" && p.skips,
+			freshness: fresh ? "authoritative" : "default",
+			accepts,
+			principalParams: Object.freeze(principalParams),
+			originCheck,
+			sourceSet: JSON.stringify(entry.sources.flatMap((source, index) => source.kinds.some((kind) => accepts.has(kind)) ? [index] : [])),
+			forwardDirectCalls,
+			declares
+		});
+		if (!cache) {
+			cache = /* @__PURE__ */ new WeakMap();
+			this.cache.set(target, cache);
+		}
+		cache.set(handler, plan);
+		return plan;
+	}
+};
+function intersection(sets, universe) {
+	return new Set([...universe].filter((kind) => sets.every((set) => set.has(kind))));
+}
+//#endregion
+//#region src/authorization-evaluator.ts
+const allow = () => ({ effect: "allow" });
+const deny = (input) => ({
+	effect: "deny",
+	...input
+});
+function definePolicy(policy) {
+	return (params, options) => ({
+		policy,
+		params,
+		...options
+	});
+}
+var DefaultPolicyInvoker = class {
+	async invoke(policy, params, context) {
+		return policy.evaluate(params, context);
+	}
+};
+var AuthorizationEvaluator = class {
+	policies;
+	invoker;
+	resolver;
+	scope;
+	keys = new MemoKeys();
+	constructor(policies, invoker, resolver, scope) {
+		this.policies = policies;
+		this.invoker = invoker;
+		this.resolver = resolver;
+		this.scope = scope;
+	}
+	async evaluate(plan, principal, call, entry, execution, transport) {
+		if (!plan.requirements.length) return allow();
+		const headers = requestHeaders(call, entry);
+		const context = {
+			principal,
+			instance: entry.name,
+			transport,
+			headers,
+			cookies: call.cookies,
+			request: call.request,
+			param: (name) => call.param(name),
+			handler: {
+				class: execution.getClass(),
+				method: methodName(execution.getClass(), execution.getHandler())
+			},
+			auth: entry.handle,
+			execution,
+			memo: (key, fn) => this.scope.memoPolicyIo(call.key, entry.name, this.keys.key(call.key, "policy-io", key), fn, entry.options.limits?.maxAuthorizationCallsPerRequest),
+			provide: (slot, value) => {
+				this.scope.stateFor(call.invocation).values.set(this.scope.valueKey(entry.name, slot), value);
+				let instances = Reflect.get(call.invocation, INVOCATION_VALUES);
+				if (!instances) {
+					instances = /* @__PURE__ */ new Map();
+					Object.defineProperty(call.invocation, INVOCATION_VALUES, { value: instances });
+				}
+				let values = instances.get(entry.name);
+				if (!values) {
+					values = /* @__PURE__ */ new Map();
+					instances.set(entry.name, values);
+				}
+				values.set(slot, value);
+			}
+		};
+		const evaluate = (expression) => this.scope.memoDecision(call.invocation, entry.name, this.keys.key(call.invocation, "decision", expression), async () => {
+			if ("anyOf" in expression || "allOf" in expression) {
+				const disjunction = "anyOf" in expression;
+				const children = "anyOf" in expression ? expression.anyOf : expression.allOf;
+				const denials = [];
+				for (const child of children) {
+					const decision = await evaluate(child);
+					if (decision.effect === "allow" && disjunction) return decision;
+					if (decision.effect === "deny") {
+						if (!disjunction) return decision;
+						denials.push(decision);
+					}
+				}
+				if (!disjunction) return allow();
+				return deny({
+					reason: denials[0]?.reason ?? "NO_REQUIREMENT_SATISFIED",
+					status: denials.some((d) => d.status === 401) ? 401 : 403,
+					message: children.map((child) => "policy" in child ? child.label ?? this.policies.resolve(child.policy).id : "requirement group").join(" or ")
+				});
+			}
+			const policy = this.policies.resolve(expression.policy);
+			const kinds = expression.principals ?? policy.requires?.principals;
+			if (kinds && !kinds.includes(principal.kind) || !kinds && principal.delegation) return deny({ reason: "PRINCIPAL_NOT_SUPPORTED" });
+			try {
+				return await entry.handle.run({
+					cookies: call.cookies,
+					forward: "same-credential",
+					inbound: () => headers,
+					internal: true
+				}, () => this.invoker.invoke(policy, expression.params, context));
+			} catch (error) {
+				const normalized = normalizeForRequest(error, "policy", plan.site, entry, headers);
+				if (isAuthFailure(normalized)) {
+					if (normalized.status === 429) throw normalized;
+					return deny({
+						status: normalized.status,
+						reason: normalized.reason ?? normalized.code,
+						message: normalized.message,
+						challenge: normalized.challenge
+					});
+				}
+				const source = entry.sources.find((item) => item.id === principal.source && item.sessionBacked);
+				if (source) await this.scope.memoPolicyIo(call.key, entry.name, JSON.stringify(["reclassify", source.id]), async () => {
+					const result = await this.resolver.resolve(call, {
+						auth: entry.handle,
+						freshness: "authoritative",
+						accepts: plan.accepts,
+						sourceSet: plan.sourceSet,
+						reclassify: { sourceId: source.id }
+					});
+					if (result.outcome === "authenticated") throw createInfrastructureError(normalized.sessionLoss, {
+						headers,
+						credentialHeaders: entry.credentialHeaders,
+						exposeRawCause: entry.options.errors?.exposeRawCause
+					});
+					return result;
+				}, entry.options.limits?.maxAuthorizationCallsPerRequest);
+				return deny({
+					status: 401,
+					reason: normalized.reason ?? "UNAUTHENTICATED"
+				});
+			}
+		});
+		for (const expression of plan.requirements) {
+			const decision = await evaluate(expression);
+			if (decision.effect === "deny") return decision;
+		}
+		return allow();
+	}
+};
+//#endregion
+//#region src/trusted-origins.ts
+/** Auth route path exceptions never exempt application operations. */
+function originChecksDisabled(context) {
+	return context.skipCSRFCheck || context.skipOriginCheck === true && context.options.advanced?.disableCSRFCheck === void 0;
+}
+var TrustedOrigins = class {
+	context;
+	constructor(context) {
+		this.context = context;
+	}
+	async list(request) {
+		const context = await this.context();
+		const configured = context.options.trustedOrigins;
+		const contributed = typeof configured === "function" ? await configured(request) : configured;
+		const origins = new Set(context.trustedOrigins);
+		if (Array.isArray(contributed)) {
+			for (const origin of contributed) if (typeof origin === "string" && origin) origins.add(origin);
+		}
+		if (request && !context.options.baseURL && !context.baseURL) origins.add(new URL(request.url).origin);
+		return [...origins];
+	}
+	async isTrusted(origin, request) {
+		const [context, trustedOrigins] = await Promise.all([this.context(), this.list(request)]);
+		return context.isTrustedOrigin.call({ trustedOrigins }, origin, { allowRelativePaths: false });
+	}
+};
+//#endregion
+//#region src/bridge-client.ts
+/** Preserve capabilities lazily; spreading a ScopeView can extract credentials. */
+function derivedScope(scope, init) {
+	const outer = scope.current();
+	return {
+		view: {
+			get cookies() {
+				return init.cookies;
+			},
+			get forward() {
+				return init.forward ?? "same-credential";
+			},
+			get inbound() {
+				return init.inbound;
+			},
+			get internal() {
+				return init.internal ?? false;
+			},
+			get browserHeaders() {
+				return outer?.view.browserHeaders;
+			},
+			get checkCallerSession() {
+				return outer?.view.checkCallerSession;
+			}
+		},
+		get call() {
+			return outer?.call;
+		},
+		get plan() {
+			return outer?.plan;
+		},
+		get reading() {
+			return outer?.reading;
+		}
+	};
+}
+function createAuthHandle(name, instance, scope, ready) {
+	const context = () => instance.$context;
+	const trusted = new TrustedOrigins(context);
+	return {
+		name,
+		instance,
+		get api() {
+			return instance.api;
+		},
+		context,
+		async hasPlugin(id) {
+			return (await context()).hasPlugin(id);
+		},
+		run(init, fn) {
+			return scope.run(derivedScope(scope, init), fn);
+		},
+		checkOrigin(browser, mode) {
+			return ready().origin.check(browser, mode);
+		},
+		producedByEndpoint(value) {
+			return ready().bridge.producedByEndpoint(value);
+		},
+		isTrustedOrigin(origin, request) {
+			return trusted.isTrusted(origin, request);
+		}
+	};
+}
+var BridgeClient = class {
+	#registrations = [];
+	bind(entry, binding) {
+		const result = entry.bridge.bind(binding);
+		this.#registrations.push({
+			binding,
+			close: result.close
+		});
+		return result;
+	}
+	bootstrap() {
+		for (const { binding } of this.#registrations) binding.state = "bootstrapped";
+	}
+	close() {
+		for (const registration of this.#registrations) registration.close();
+		this.#registrations.length = 0;
+	}
+};
+//#endregion
+//#region src/bridge-protocol.ts
+const BRIDGE_HANDLE = Symbol.for("nestjs-slightly-better-auth:bridge");
+const EXTENSION_DEFINITION = Symbol.for("nestjs-slightly-better-auth:extension");
+//#endregion
+//#region src/origin-check.ts
+const ORIGIN_PROOF = Symbol.for("nestjs-slightly-better-auth:origin-proof");
+const ORIGIN_CALCULATION_FAILURES = Symbol.for("nestjs-slightly-better-auth:origin-calculation-failures");
+function diagnosticOrigin(headers) {
+	const origin = headers.get("origin");
+	const referer = headers.get("referer");
+	let value = origin || referer || "(missing)";
+	if (!origin && referer) try {
+		value = new URL(referer).origin;
+	} catch {
+		value = "(invalid referer)";
+	}
+	return value.replace(/[\u0000-\u001f\u007f]/g, "").slice(0, 100);
+}
+/** Bounded, per-application diagnostics; the next denial rolls the window without timers. */
+var OriginDiagnostics = class {
+	logger;
+	#openedAt;
+	#pairs = /* @__PURE__ */ new Set();
+	#further = /* @__PURE__ */ new Map();
+	#origins = /* @__PURE__ */ new Map();
+	constructor(logger) {
+		this.logger = logger;
+	}
+	record(instance, failure, headers, trustedCount) {
+		const now = Date.now();
+		if (this.#openedAt !== void 0 && now - this.#openedAt >= 36e5) {
+			this.logger.warn(`Origin check window closed: further denials ${JSON.stringify([...this.#further])}; frequent origins ${JSON.stringify([...this.#origins].sort((a, b) => b[1] - a[1]).slice(0, 5))}`);
+			this.#pairs.clear();
+			this.#further.clear();
+			this.#origins.clear();
+			this.#openedAt = void 0;
+		}
+		this.#openedAt ??= now;
+		const origin = diagnosticOrigin(headers);
+		const reason = failure.reason ?? failure.code;
+		const pair = JSON.stringify([reason, origin]);
+		const message = `Origin check ${instance}: ${reason}, origin ${origin}, trusted origins ${trustedCount}. Add the origin to trustedOrigins or send Origin from non-browser clients.`;
+		if (!this.#pairs.has(pair) && this.#pairs.size < 100) {
+			this.#pairs.add(pair);
+			this.logger.warn(message);
+		} else this.#further.set(reason, (this.#further.get(reason) ?? 0) + 1);
+		if (this.#origins.has(origin) || this.#origins.size < 100) this.#origins.set(origin, (this.#origins.get(origin) ?? 0) + 1);
+		this.logger.debug(message);
+	}
+	advisoryFailure(instance, headers, trustedCount) {
+		this.record(instance, AuthFailures.forbidden("ORIGIN_CHECK_UNAVAILABLE"), headers, trustedCount);
+	}
+};
+var OriginCheck = class {
+	scope;
+	init;
+	#trusted;
+	#trustedCounts = /* @__PURE__ */ new WeakMap();
+	constructor(scope, init) {
+		this.scope = scope;
+		this.init = init;
+		this.#trusted = new TrustedOrigins(async () => init.context);
+	}
+	check(browser, mode) {
+		const origins = this.scope.stateFor(browser.key).origins;
+		const key = memoKey(this.init.instance, mode);
+		const existing = origins.get(key);
+		if (existing) return existing;
+		let headers;
+		let calculationFailed = false;
+		const promise = Promise.resolve().then(async () => {
+			if (this.init.options?.mode === "off" || originChecksDisabled(this.init.context)) return null;
+			headers = browser.headers();
+			const failure = await this.verdict(browser, headers, mode, () => {
+				calculationFailed = true;
+			});
+			if (failure) this.init.diagnostics?.record(this.init.instance, failure, headers, this.#trustedCounts.get(browser.key) ?? this.init.context.trustedOrigins.length);
+			else if (mode === "form" || headers.has("cookie")) this.scope.stateFor(browser.key).values.set(this.scope.valueKey(this.init.instance, ORIGIN_PROOF), true);
+			return failure;
+		}).catch((error) => {
+			if (origins.get(key) === promise) origins.delete(key);
+			if (isConfigurationError(error)) throw error;
+			const failure = isInfrastructureError(error) ? error : createInfrastructureError(error, {
+				headers,
+				credentialHeaders: this.init.credentialHeaders,
+				exposeRawCause: this.init.exposeRawCause
+			});
+			if (calculationFailed && headers) this.calculationFailures(browser).set(promise, headers);
+			throw failure;
+		});
+		origins.set(key, promise);
+		return promise;
+	}
+	async advisory(browser) {
+		const verdict = this.check(browser, "cookie");
+		try {
+			await verdict;
+		} catch (error) {
+			const headers = this.calculationFailures(browser).get(verdict);
+			if (!isInfrastructureError(error) || !headers) throw error;
+			this.init.diagnostics?.advisoryFailure(this.init.instance, headers, this.init.context.trustedOrigins.length);
+		}
+	}
+	assertCallerSession(browser, path, instance) {
+		if (instance === this.init.instance && (this.init.options?.mode === "off" || originChecksDisabled(this.init.context) || this.scope.stateFor(browser.key).values.get(this.scope.valueKey(this.init.instance, ORIGIN_PROOF)) === true)) return;
+		throw BetterAuthConfigurationError.atRequest("PUBLIC_HANDLER_USED_CALLER_SESSION", "A direct caller-session call requires a passing origin verdict for this browser leg and instance", {
+			site: path,
+			hint: "Guard the handler and pass its origin check before making this call."
+		});
+	}
+	calculationFailures(browser) {
+		const values = this.scope.stateFor(browser.key).values;
+		const key = this.scope.valueKey(this.init.instance, ORIGIN_CALCULATION_FAILURES);
+		let failures = values.get(key);
+		if (!failures) {
+			failures = /* @__PURE__ */ new WeakMap();
+			values.set(key, failures);
+		}
+		return failures;
+	}
+	async verdict(browser, headers, mode, onCalculationFailure) {
+		if (!headers.has("cookie")) {
+			if (mode === "cookie") return null;
+			const site = headers.get("sec-fetch-site");
+			const navigation = headers.get("sec-fetch-mode");
+			const metadata = [
+				site,
+				navigation,
+				headers.get("sec-fetch-dest")
+			].some((value) => Boolean(value?.trim()));
+			if (metadata && site === "cross-site" && navigation === "navigate") return AuthFailures.forbidden("CROSS_SITE_NAVIGATION_LOGIN_BLOCKED");
+			if (!metadata && !headers.get("origin") && !headers.get("referer")) return null;
+		}
+		const origin = headers.get("origin");
+		const referer = headers.get("referer");
+		const site = headers.get("sec-fetch-site");
+		const value = origin === "null" && site === "same-origin" ? new URL(browser.url).origin : origin || referer;
+		if (!value || value === "null") {
+			if (this.init.options?.missingOrigin === "allow-non-browser" && !headers.has("origin") && !headers.has("referer") && !headers.has("sec-fetch-site")) return null;
+			return AuthFailures.forbidden("MISSING_OR_NULL_ORIGIN");
+		}
+		const request = new Request(browser.url, { headers });
+		const trustedOrigins = await this.#trusted.list(request).catch((error) => {
+			onCalculationFailure();
+			throw error;
+		});
+		this.#trustedCounts.set(browser.key, trustedOrigins.length);
+		return this.init.context.isTrustedOrigin.call({ trustedOrigins }, value, { allowRelativePaths: false }) ? null : AuthFailures.forbidden("INVALID_ORIGIN");
+	}
+};
+//#endregion
+//#region src/instance-registry.ts
+/** Nest considers transient providers static; auth collaborators require singleton trees. */
+function isSingletonDependencyTree(root) {
+	const pending = [root];
+	const seen = /* @__PURE__ */ new Set();
+	while (pending.length) {
+		const wrapper = pending.pop();
+		if (seen.has(wrapper)) continue;
+		seen.add(wrapper);
+		if (wrapper.isTransient || !wrapper.isDependencyTreeStatic()) return false;
+		for (const dependency of wrapper.getCtorMetadata() ?? []) if (dependency) pending.push(dependency);
+		for (const property of wrapper.getPropertiesMetadata() ?? []) pending.push(property.wrapper);
+		for (const enhancer of wrapper.getEnhancersMetadata() ?? []) pending.push(enhancer);
+	}
+	return true;
+}
+function configurationIssue(error, code, detail) {
+	if (isConfigurationError(error)) return error;
+	const issue = new BetterAuthConfigurationError(code, detail);
+	Object.defineProperty(issue, "cause", { value: error });
+	return issue;
+}
+let InstanceRegistry = class InstanceRegistry {
+	scope;
+	#registrations = [];
+	#entries = /* @__PURE__ */ new Map();
+	logger = new Logger("BetterAuth");
+	diagnostics = new OriginDiagnostics(this.logger);
+	state = "new";
+	adapter = null;
+	owner = { description: "Nest application" };
+	constructor(scope) {
+		this.scope = scope;
+	}
+	register(options, staticOptions, sources, appOptions) {
+		const name = staticOptions.name || "default";
+		const registration = {
+			name,
+			options,
+			staticOptions,
+			sources,
+			appOptions,
+			instance: options.auth,
+			handle: createAuthHandle(name, options.auth, this.scope, () => this.get(name))
+		};
+		this.#registrations.push(registration);
+		return registration;
+	}
+	registrations() {
+		return [...this.#registrations];
+	}
+	get(name) {
+		const entry = this.#entries.get(name);
+		if (!entry) throw new BetterAuthConfigurationError("UNKNOWN_INSTANCE", `Auth instance '${name}' is unknown or not initialized.`, "Register the instance once with BetterAuthModule.forRoot().");
+		return entry;
+	}
+	list() {
+		return [...this.#entries.values()];
+	}
+	begin(adapter) {
+		if (this.state !== "new") {
+			if (this.adapter !== adapter) throw new BetterAuthConfigurationError("LATE_HTTP_ADAPTER", "Another application changed the active HTTP adapter.", "Close the first application before creating another.");
+			return false;
+		}
+		this.adapter = adapter;
+		this.state = "initialized";
+		this.owner = { description: `Nest application ${globalThis.crypto.randomUUID()}` };
+		return true;
+	}
+	async initialize(issues) {
+		this.#entries.clear();
+		const seen = /* @__PURE__ */ new Set();
+		const bridgeOwners = /* @__PURE__ */ new Map();
+		const shared = /* @__PURE__ */ new Set();
+		let globals = 0;
+		for (const registration of this.#registrations) {
+			const { name, instance, options, staticOptions, appOptions, sources, handle } = registration;
+			if (seen.has(name)) issues.push(new BetterAuthConfigurationError("DUPLICATE_INSTANCE", `Instance '${name}' was registered more than once.`, "Import BetterAuthModule.forRoot() once per instance."));
+			seen.add(name);
+			if (staticOptions.globalGuard ?? name === "default") globals++;
+			if (name !== "default" && (appOptions.platforms !== void 0 || appOptions.transports !== void 0)) issues.push(new BetterAuthConfigurationError("APP_EXTENSIONS_ON_NAMED_INSTANCE", `Instance '${name}' declares app-wide extensions.`, "Declare platforms and transports on the default instance."));
+			if (!instance || typeof instance.handler !== "function" || typeof instance.api?.getSession !== "function" || typeof instance.$context?.then !== "function") {
+				issues.push(new BetterAuthConfigurationError("NOT_AN_AUTH_INSTANCE", `Instance '${name}' must be the object returned by betterAuth().`));
+				continue;
+			}
+			let context;
+			try {
+				context = await instance.$context;
+			} catch (error) {
+				issues.push(configurationIssue(error, "AUTH_CONTEXT_FAILED", `Instance '${name}' failed to initialize its auth context.`));
+				continue;
+			}
+			const plugin = context.getPlugin("nestjs-slightly-better-auth");
+			const bridge = plugin && typeof plugin === "object" ? Reflect.get(plugin, BRIDGE_HANDLE) : void 0;
+			if (!bridge) {
+				issues.push(new BetterAuthConfigurationError("PLUGIN_MISSING", `Instance '${name}' has no nestjs() bridge.`, "Add nestjs() as the LAST betterAuth plugins entry."));
+				continue;
+			}
+			if (bridge.protocol !== 4 || typeof bridge.bind !== "function") {
+				issues.push(new BetterAuthConfigurationError("PLUGIN_PROTOCOL_MISMATCH", `Instance '${name}' has bridge protocol ${bridge.protocol}; expected 4.`, "Align the module and plugin package versions."));
+				continue;
+			}
+			const previous = bridgeOwners.get(bridge);
+			if (previous !== void 0) {
+				shared.add(name);
+				shared.add(previous);
+				issues.push(new BetterAuthConfigurationError("PLUGIN_SHARED_BETWEEN_INSTANCES", `'${previous}' and '${name}' share one plugin object.`, "Call nestjs() separately inside every betterAuth() construction."));
+			}
+			bridgeOwners.set(bridge, name);
+			const plugins = context.options.plugins ?? [];
+			const index = plugins.findIndex((value) => value.id === "nestjs-slightly-better-auth");
+			if (index >= 0 && plugins.slice(index + 1).some((value) => value.hooks?.after?.length)) this.logger.warn(`W_PLUGIN_NOT_LAST: '${name}': put nestjs() after plugins with after hooks.`);
+			const credentialHeaders = [...new Set(sources.flatMap((source) => source.credentialHeaders ?? []).map((value) => value.toLowerCase()))];
+			this.#entries.set(name, {
+				name,
+				instance,
+				options,
+				staticOptions,
+				sources,
+				handle,
+				context,
+				bridge,
+				credentialHeaders,
+				origin: new OriginCheck(this.scope, {
+					instance: name,
+					context,
+					options: options.originCheck,
+					diagnostics: this.diagnostics,
+					credentialHeaders,
+					exposeRawCause: options.errors?.exposeRawCause
+				})
+			});
+		}
+		for (const name of shared) this.#entries.delete(name);
+		if (globals > 1) issues.push(new BetterAuthConfigurationError("DUPLICATE_GLOBAL_GUARD", "More than one registration enables the global guard.", "Enable globalGuard on only one instance."));
+		if (!seen.has("default")) issues.push(new BetterAuthConfigurationError("NO_DEFAULT_INSTANCE", "Named registrations require one default instance.", "Add BetterAuthModule.forRoot({ auth })."));
+	}
+	reset() {
+		this.state = "new";
+		this.#entries.clear();
+	}
+};
+InstanceRegistry = __decorate([__decorateParam(0, Inject(REQUEST_SCOPE)), __decorateMetadata("design:paramtypes", [Object])], InstanceRegistry);
+//#endregion
+//#region src/boot-validator.ts
+function requirementLeaves(expressions) {
+	return expressions.flatMap((expression) => "anyOf" in expression ? requirementLeaves(expression.anyOf) : "allOf" in expression ? requirementLeaves(expression.allOf) : [expression]);
+}
+function productionMode() {
+	return ![
+		"development",
+		"dev",
+		"test"
+	].includes(process.env.NODE_ENV ?? "");
+}
+function ancestors(target) {
+	const result = [];
+	for (let current = target; typeof current === "function" && current !== Function.prototype; current = Object.getPrototypeOf(current)) result.push(current);
+	return result;
+}
+function domainsOverlap(a, b) {
+	if (!a || !b) return true;
+	const left = a.replace(/^\./, "").toLowerCase();
+	const right = b.replace(/^\./, "").toLowerCase();
+	return left === right || left.endsWith(`.${right}`) || right.endsWith(`.${left}`);
+}
+function pathsOverlap(a = "/", b = "/") {
+	return a === b || a.startsWith(b.endsWith("/") ? b : `${b}/`) || b.startsWith(a.endsWith("/") ? a : `${a}/`);
+}
+function routeMayWarnAboutMount(path, basePath) {
+	const route = path.toLowerCase().replace(/(?<!\/)\/+$/, "") || "/";
+	const base = basePath.toLowerCase().replace(/(?<!\/)\/+$/, "") || "/";
+	if (base === "/") return route.startsWith("/");
+	if (route === base || route.startsWith(`${base}/`)) return true;
+	const marker = route.search(/[:*{]/);
+	if (marker === -1) return false;
+	const literal = route.slice(0, marker);
+	return base.startsWith(literal) || literal.startsWith(`${base}/`);
+}
+let BootValidator = class BootValidator {
+	discovery;
+	scanner;
+	reflector;
+	moduleRef;
+	appConfig;
+	instances;
+	planner;
+	policies;
+	transports;
+	mounts;
+	logger = new Logger("BetterAuth");
+	#plans = [];
+	#claims = [];
+	#globalGuard = false;
+	#globalScope = false;
+	constructor(discovery, scanner, reflector, moduleRef, appConfig, instances, planner, policies, transports, mounts) {
+		this.discovery = discovery;
+		this.scanner = scanner;
+		this.reflector = reflector;
+		this.moduleRef = moduleRef;
+		this.appConfig = appConfig;
+		this.instances = instances;
+		this.planner = planner;
+		this.policies = policies;
+		this.transports = transports;
+		this.mounts = mounts;
+	}
+	warn(code, message) {
+		this.logger.warn(`${code}: ${message}`);
+	}
+	sites() {
+		const sites = [];
+		const seen = /* @__PURE__ */ new Map();
+		for (const wrapper of [...this.discovery.getControllers(), ...this.discovery.getProviders()]) {
+			if (wrapper.isAlias || !wrapper.instance || typeof wrapper.instance !== "object" && typeof wrapper.instance !== "function") continue;
+			const prototype = Object.getPrototypeOf(wrapper.instance);
+			const target = prototype?.constructor;
+			if (!prototype || !target || target === Object || target === Function) continue;
+			const methods = seen.get(target) ?? /* @__PURE__ */ new Set();
+			seen.set(target, methods);
+			for (const method of this.scanner.getAllMethodNames(prototype)) {
+				if (methods.has(method)) continue;
+				methods.add(method);
+				const handler = Reflect.get(prototype, method);
+				if (typeof handler === "function") sites.push({
+					target,
+					method,
+					handler
+				});
+			}
+		}
+		return sites;
+	}
+	singletonChecks(issues, references) {
+		const refs = new Set(references.map((value) => value.policy));
+		for (const wrapper of this.discovery.getProviders()) if (((typeof wrapper.token === "symbol" ? Symbol.keyFor(wrapper.token) : void 0)?.startsWith("nestjs-slightly-better-auth:ext:") || refs.has(wrapper.token) || refs.has(wrapper.metatype)) && !isSingletonDependencyTree(wrapper)) issues.push(new BetterAuthConfigurationError("NON_SINGLETON_EXTENSION", `Extension/policy '${String(wrapper.name)}' has a non-static dependency tree.`, "Use singleton extensions and singleton dependencies."));
+	}
+	canaries() {
+		let Probe = class Probe {
+			run() {}
+		};
+		__decorate([
+			Get("handler"),
+			__decorateMetadata("design:type", Function),
+			__decorateMetadata("design:paramtypes", []),
+			__decorateMetadata("design:returntype", void 0)
+		], Probe.prototype, "run", null);
+		Probe = __decorate([Controller("coverage-probe")], Probe);
+		if (Reflect.getOwnMetadata("path", Probe) !== "coverage-probe" || Reflect.getOwnMetadata("path", Probe.prototype.run) !== "handler" || Reflect.getOwnMetadata("method", Probe.prototype.run) !== 0) throw new BetterAuthConfigurationError("NEST_METADATA_KEY_CHANGED", "Boot route checks cannot read Nest path/method metadata.");
+		UseGuards(BetterAuthGuard)(Probe);
+		UseInterceptors(BetterAuthScopeInterceptor)(Probe);
+		if (!Reflect.getOwnMetadata("__guards__", Probe)?.includes(BetterAuthGuard) || !Reflect.getOwnMetadata("__interceptors__", Probe)?.includes(BetterAuthScopeInterceptor)) throw new BetterAuthConfigurationError("NEST_METADATA_KEY_CHANGED", "Boot coverage cannot read Nest '__guards__' / '__interceptors__' metadata.", "Use a compatible Nest version and report the metadata change.");
+	}
+	enhancer(value, kind) {
+		const token = kind === "guard" ? BetterAuthGuard : BetterAuthScopeInterceptor;
+		let actual;
+		try {
+			actual = this.moduleRef.get(token, { strict: false });
+		} catch {
+			actual = void 0;
+		}
+		if (value === token || actual !== void 0 && value === actual) return true;
+		if (value && (typeof value === "object" || typeof value === "function")) {
+			const brand = Reflect.get(value, AUTH_ENHANCER) ?? (typeof value === "function" ? Reflect.get(value.prototype ?? {}, AUTH_ENHANCER) : Reflect.get(Object.getPrototypeOf(value) ?? {}, AUTH_ENHANCER));
+			return brand === kind || kind === "scope" && brand === "interceptor" || typeof brand === "object" && brand !== null && Reflect.get(brand, kind) === true;
+		}
+		return false;
+	}
+	local(site, kind) {
+		const handler = site.method ? Reflect.get(site.target.prototype ?? {}, site.method) : void 0;
+		const targets = [...ancestors(site.target), ...handler ? [handler] : []];
+		if (targets.some((target) => Reflect.getOwnMetadata(USE_BETTER_AUTH_METADATA, target) === true)) return true;
+		const key = kind === "guard" ? "__guards__" : "__interceptors__";
+		return targets.some((target) => (Reflect.getOwnMetadata(key, target) ?? []).some((value) => this.enhancer(value, kind)));
+	}
+	trigger(target) {
+		const access = Reflect.getOwnMetadata(ACCESS_METADATA, target);
+		if (access === "required" || access === "optional" || access === "authenticated") return true;
+		return [
+			ACCEPT_PRINCIPALS_METADATA,
+			REQUIREMENTS_METADATA,
+			PRINCIPAL_PARAMS_METADATA,
+			INVOCATION_PARAMS_METADATA,
+			FORWARD_COOKIES_METADATA,
+			FRESHNESS_METADATA,
+			AUTH_INSTANCE_METADATA,
+			USE_BETTER_AUTH_METADATA
+		].some((key) => Reflect.hasOwnMetadata(key, target));
+	}
+	coverage(sites, issues) {
+		this.#globalGuard = [...this.appConfig.getGlobalGuards(), ...this.appConfig.getGlobalRequestGuards().map((wrapper) => wrapper.instance)].some((value) => this.enhancer(value, "guard"));
+		this.#globalScope = [...this.appConfig.getGlobalInterceptors(), ...this.appConfig.getGlobalRequestInterceptors().map((wrapper) => wrapper.instance)].some((value) => this.enhancer(value, "scope"));
+		for (const claim of this.#claims) {
+			let plan;
+			try {
+				plan = claim.method ? this.planner.plan(claim.target, claim.method) : void 0;
+			} catch {
+				continue;
+			}
+			const classEntry = this.instances.list().find((entry) => entry.name === (Reflect.getMetadata(AUTH_INSTANCE_METADATA, claim.target) ?? "default"));
+			const classForm = (Reflect.getMetadata(FORWARD_COOKIES_METADATA, claim.target) ?? classEntry?.options.cookies?.forwardDirectCalls ?? false) && Reflect.getMetadata(SKIP_ORIGIN_CHECK_METADATA, claim.target) !== true && classEntry?.options.originCheck?.mode !== "off";
+			const accessCovered = plan ? (plan.access === "public" || plan.access === "inherit") && plan.originCheck !== "form" : Reflect.getMetadata(ACCESS_METADATA, claim.target) === "public" && !classForm;
+			const localGuard = this.local(claim, "guard");
+			const localScope = this.local(claim, "scope");
+			const covered = accessCovered || claim.reach === "global" && (this.#globalGuard || localGuard) || claim.reach === "explicit" && localGuard && localScope;
+			const declares = plan?.declares ?? ancestors(claim.target).some((target) => this.trigger(target));
+			if (!covered && (claim.options.everyHandler || declares) && claim.options.coverage !== "off") {
+				const message = `${claim.target.name}${claim.method ? `.${claim.method}` : ""} is not covered by the required auth enhancers.`;
+				if (claim.options.coverage === "warn") this.warn(claim.options.code, `${message} ${claim.options.hint}`);
+				else issues.push(new BetterAuthConfigurationError(claim.options.code, message, claim.options.hint));
+			}
+		}
+		for (const site of sites) {
+			const classClaims = this.#claims.filter((claim) => claim.target === site.target);
+			if (classClaims.some((claim) => claim.method === void 0 || claim.method === site.method)) continue;
+			if (this.trigger(site.handler) || !classClaims.length && ancestors(site.target).some((target) => this.trigger(target))) issues.push(new BetterAuthConfigurationError("UNGUARDED_AUTH_METADATA", `${site.target.name}.${site.method} declares auth metadata but no transport claims it. Registered transports: ${this.transports.list().map((value) => value.id).join(", ")}.`, "Register a transport that claims this handler."));
+		}
+		if (!this.#globalScope) {
+			const affected = this.#claims.flatMap((claim) => {
+				if (this.local(claim, "scope")) return [];
+				const plan = this.#plans.find((site) => site.target === claim.target && site.method === claim.method)?.plan;
+				if (plan) return plan.declares ? [{
+					claim,
+					forwarding: plan.forwardDirectCalls
+				}] : [];
+				if (claim.method !== void 0) return [];
+				const entry = this.instances.list().find((value) => value.name === (Reflect.getMetadata(AUTH_INSTANCE_METADATA, claim.target) ?? "default"));
+				const forwarding = Reflect.getMetadata(FORWARD_COOKIES_METADATA, claim.target) ?? entry?.options.cookies?.forwardDirectCalls ?? false;
+				return forwarding || ancestors(claim.target).some((target) => this.trigger(target)) ? [{
+					claim,
+					forwarding: Boolean(forwarding)
+				}] : [];
+			});
+			const seen = /* @__PURE__ */ new Map();
+			const uncovered = affected.sort((left, right) => Number(right.forwarding) - Number(left.forwarding)).filter(({ claim }) => {
+				const methods = seen.get(claim.target) ?? /* @__PURE__ */ new Set();
+				seen.set(claim.target, methods);
+				if (methods.has(claim.method)) return false;
+				methods.add(claim.method);
+				return true;
+			}).slice(0, 20).map(({ claim }) => `${claim.target.name}.${claim.method ?? "*"}`);
+			this.warn("W_NO_GLOBAL_SCOPE", `BetterAuthScopeInterceptor is not global; unscoped direct auth.api calls have no origin proof, refresh suppression or cookie bridge. Enable globalScope or apply @UseBetterAuth(). ${uncovered.join(", ")}`);
+		}
+	}
+	entryChecks(entry, policies, issues) {
+		const { name, context, options, sources, bridge } = entry;
+		for (const unit of [...sources, ...policies]) for (const plugin of unit.requires?.plugins ?? []) if (!context.hasPlugin(plugin)) issues.push(new BetterAuthConfigurationError("PLUGIN_PREREQUISITE", `'${name}': '${unit.id}' requires the '${plugin}' plugin.`, `Add the '${plugin}' Better Auth plugin.`));
+		const base = context.options.baseURL;
+		const dynamic = !!base && typeof base === "object" && "allowedHosts" in base;
+		if (dynamic && !("fallback" in base && base.fallback)) {
+			const hostless = [
+				...sources,
+				...policies,
+				...this.transports.list()
+			].filter((unit) => unit.requires?.hostlessCalls);
+			if (hostless.length) issues.push(new BetterAuthConfigurationError("DYNAMIC_BASE_URL_WITHOUT_FALLBACK", `'${name}': ${hostless.map((unit) => unit.id).join(", ")} make hostless calls.`, "Add baseURL.fallback to the dynamic allowedHosts configuration."));
+			else this.warn("W_DYNAMIC_HOST", `'${name}': dynamic baseURL has no fallback; rejected hosts may make auth.handler throw.`);
+		}
+		const production = productionMode();
+		if (production && !context.baseURL && !dynamic) {
+			if (options.http?.allowRequestDerivedBaseURL) this.warn("W_REQUEST_DERIVED_BASE_URL", `'${name}': requests choose the origin of token links and trusted origins.`);
+			else issues.push(new BetterAuthConfigurationError("UNSAFE_BASE_URL", `'${name}' has no safe baseURL in production.`, "Set baseURL / BETTER_AUTH_URL, or dynamic baseURL.allowedHosts."));
+		}
+		if (production && context.secret === "better-auth-secret-12345678901234567890") issues.push(new BetterAuthConfigurationError("DEFAULT_SECRET", `'${name}' uses Better Auth's public default signing secret.`, "Set BETTER_AUTH_SECRET or betterAuth({ secret })."));
+		if (context.skipCSRFCheck || context.skipOriginCheck === true) {
+			const explicit = context.options.advanced;
+			const cause = `disableCSRFCheck=${String(explicit?.disableCSRFCheck)}, disableOriginCheck=${String(explicit?.disableOriginCheck)}; unset flags use Better Auth's import-time NODE_ENV/TEST defaults`;
+			const exception = context.skipOriginCheck === true && explicit?.disableCSRFCheck === false ? "; disableCSRFCheck:false does not re-enable SDK origin checks; app-route checks remain on" : "";
+			this.warn("W_ORIGIN_CHECK", `'${name}': resolved skipCSRFCheck=${context.skipCSRFCheck}, skipOriginCheck=${String(context.skipOriginCheck)} (${cause})${exception}.`);
+		}
+		if (Array.isArray(context.skipOriginCheck) && context.skipOriginCheck.length) this.logger.log(`I_AUTH_ORIGIN_PATH_SKIPS: '${name}': ${context.skipOriginCheck.join(", ")}; app-route checks are unchanged.`);
+		if (production && options.originCheck?.mode === "off") this.warn("W_ORIGIN_CHECK", `'${name}': application origin checks are disabled.`);
+		if (name === "default" && options.cookies?.forwardDirectCalls) this.warn("W_FORWARD_DIRECT_CALLS", "The default instance forwards same-credential direct-call cookies app-wide; every handler requires form-CSRF enforcement.");
+		const proxy = this.mounts.adapter && this.mounts.platform?.proxyTrust?.(this.mounts.adapter);
+		const ip = context.options.advanced?.ipAddress;
+		const role = context.rateLimit.enabled ? "rate-limit buckets and session IP" : "session IP only (rate limiter disabled)";
+		if (production && bridge.clientIpHeader && ip?.ipAddressHeaders?.[0] !== bridge.clientIpHeader) this.warn("W_CLIENT_IP", `'${name}': the bridge IP header is not first in effective ipAddressHeaders (${role}).`);
+		if (production && !bridge.clientIpHeader && !ip?.ipAddressHeaders?.length && !ip?.trustedProxies?.length) this.warn("W_CLIENT_IP", `'${name}': no bridge IP header or SDK IP configuration (${role}).`);
+		if (production && bridge.clientIpHeader && ip?.trustedProxies?.length && proxy && proxy.mode === "none") this.warn("W_CLIENT_IP", `'${name}': SDK trustedProxies rechecks the socket IP without platform proxy trust (${role}); configure platform trust or set clientIpHeader:false.`);
+		if (production && proxy && proxy.mode === "all") this.warn("W_PROXY_TRUST_ALL", `'${name}': the platform trusts every proxy; clients can choose ${role}.`);
+		if (production && !context.rateLimit.enabled && context.options.rateLimit?.enabled === void 0) {
+			const contradiction = process.env.NODE_ENV === "production" ? " while process.env.NODE_ENV is production; Better Auth imported before that value existed" : "";
+			this.warn("W_RATE_LIMIT_DISABLED", `'${name}': better-auth resolved rateLimit.enabled=false${contradiction}. Set NODE_ENV=production before auth.ts is imported, rateLimit.enabled:true, or explicitly disable it when an edge proxy limits traffic.`);
+		}
+	}
+	cookies(issues) {
+		const entries = this.instances.list();
+		for (let i = 0; i < entries.length; i++) for (const right of entries.slice(i + 1)) {
+			const left = entries[i];
+			for (const a of Object.values(left.context.authCookies)) for (const b of Object.values(right.context.authCookies)) if (a.name === b.name && domainsOverlap(a.attributes.domain, b.attributes.domain) && pathsOverlap(a.attributes.path, b.attributes.path)) issues.push(new BetterAuthConfigurationError("COOKIE_NAME_COLLISION", `'${left.name}' and '${right.name}' both use cookie '${a.name}' on overlapping scopes.`, "Set advanced.cookiePrefix on one instance."));
+		}
+	}
+	async validate(issues) {
+		this.#plans.length = 0;
+		this.#claims.length = 0;
+		const sites = this.sites();
+		const candidates = /* @__PURE__ */ new Map();
+		const prepared = /* @__PURE__ */ new Set();
+		const compiled = /* @__PURE__ */ new Map();
+		const failures = /* @__PURE__ */ new Map();
+		const reported = /* @__PURE__ */ new Set();
+		const references = [];
+		const report = (error, detail) => {
+			if (!reported.has(error)) {
+				reported.add(error);
+				issues.push(configurationIssue(error, "UNRESOLVED_POLICY", detail));
+			}
+		};
+		const candidate = (target, method) => {
+			let methods = candidates.get(target);
+			if (!methods) {
+				methods = /* @__PURE__ */ new Map();
+				candidates.set(target, methods);
+			}
+			const existing = methods.get(method);
+			if (existing) return existing;
+			const handler = Reflect.get(target.prototype ?? {}, method);
+			if (typeof handler !== "function") throw new BetterAuthConfigurationError("UNKNOWN_HANDLER", `${target.name}.${method} is not a handler.`);
+			const site = {
+				target,
+				method,
+				handler
+			};
+			methods.set(method, site);
+			return site;
+		};
+		const prepare = (site) => {
+			if (failures.has(site)) throw failures.get(site);
+			if (prepared.has(site)) return;
+			try {
+				const leaves = requirementLeaves(this.planner.requirementsOf(site.target, site.method));
+				references.push(...leaves);
+				for (const requirement of leaves) this.policies.resolve(requirement.policy);
+				prepared.add(site);
+			} catch (error) {
+				failures.set(site, error);
+				throw error;
+			}
+		};
+		const planOf = (target, method) => {
+			const site = candidate(target, method);
+			prepare(site);
+			const cached = compiled.get(site);
+			if (cached) return cached;
+			try {
+				const plan = this.planner.plan(site.target, site.method);
+				compiled.set(site, plan);
+				this.#plans.push({
+					...site,
+					plan
+				});
+				return plan;
+			} catch (error) {
+				failures.set(site, error);
+				throw error;
+			}
+		};
+		for (const site of sites) if (this.trigger(site.handler) || [
+			ACCESS_METADATA,
+			FRESHNESS_METADATA,
+			SKIP_ORIGIN_CHECK_METADATA,
+			SKIP_DEFAULT_REQUIREMENTS_METADATA
+		].some((key) => Reflect.hasOwnMetadata(key, site.handler))) {
+			const selected = candidate(site.target, site.method);
+			try {
+				prepare(selected);
+			} catch (error) {
+				report(error, `Cannot prepare ${site.target.name}.${site.method}.`);
+			}
+		}
+		let canariesPassed = false;
+		try {
+			this.canaries();
+			canariesPassed = true;
+		} catch (error) {
+			issues.push(configurationIssue(error, "NEST_METADATA_KEY_CHANGED", "Coverage metadata canaries failed."));
+		}
+		if (canariesPassed) for (const transport of this.transports.list()) try {
+			await transport.validate?.({
+				discovery: this.discovery,
+				reflector: this.reflector,
+				moduleRef: this.moduleRef,
+				hasHttpAdapter: this.mounts.adapter !== null,
+				planOf,
+				claim: (target, method, reach, options) => {
+					this.#claims.push({
+						transport,
+						target,
+						method,
+						reach,
+						options
+					});
+					if (method !== void 0) candidate(target, method);
+				},
+				logger: this.logger
+			});
+		} catch (error) {
+			if (!reported.has(error)) {
+				reported.add(error);
+				issues.push(configurationIssue(error, "TRANSPORT_VALIDATION_FAILED", `Transport '${transport.id}' failed validation.`));
+			}
+		}
+		for (const methods of candidates.values()) for (const site of methods.values()) try {
+			prepare(site);
+		} catch (error) {
+			report(error, `Cannot prepare ${site.target.name}.${site.method}.`);
+		}
+		this.singletonChecks(issues, references);
+		for (const methods of candidates.values()) for (const site of methods.values()) try {
+			planOf(site.target, site.method);
+		} catch (error) {
+			report(error, `Cannot compile ${site.target.name}.${site.method}.`);
+		}
+		for (const site of this.#plans) try {
+			const entry = this.instances.get(site.plan.instance);
+			for (const requirement of requirementLeaves(site.plan.requirements)) await this.policies.resolve(requirement.policy).validate?.(requirement.params, {
+				auth: entry.handle,
+				context: entry.context,
+				site: site.plan.site
+			});
+		} catch (error) {
+			report(error, `Cannot validate ${site.target.name}.${site.method}.`);
+		}
+		if (canariesPassed) {
+			this.coverage(sites, issues);
+			const applicationRoutes = [];
+			const routePathFactory = new RoutePathFactory(this.appConfig);
+			const globalPrefix = this.appConfig.getGlobalPrefix();
+			const versioningOptions = this.appConfig.getVersioning();
+			const modules = this.moduleRef.get(ModulesContainer, { strict: false });
+			for (const wrapper of this.discovery.getControllers()) {
+				const target = wrapper.metatype;
+				if (!target?.prototype) continue;
+				const moduleType = wrapper.host?.metatype;
+				const modulePath = moduleType ? Reflect.getMetadata(`__module_path__${modules.applicationId}`, moduleType) ?? Reflect.getMetadata("__module_path__", moduleType) : void 0;
+				const host = Reflect.getMetadata("host", target);
+				const controllerVersion = versioningOptions ? Reflect.getMetadata("__version__", target) ?? versioningOptions.defaultVersion : void 0;
+				const rawPrefixes = Reflect.getMetadata("path", target);
+				const prefixes = Array.isArray(rawPrefixes) ? rawPrefixes : [rawPrefixes ?? ""];
+				for (const method of this.scanner.getAllMethodNames(target.prototype)) {
+					const handler = Reflect.get(target.prototype, method);
+					const rawPaths = Reflect.getMetadata("path", handler);
+					const requestMethod = Reflect.getMetadata("method", handler);
+					if (rawPaths === void 0 || requestMethod === void 0) continue;
+					const methodVersion = Reflect.getMetadata("__version__", handler);
+					const effectiveVersion = methodVersion ?? controllerVersion;
+					const conditions = [];
+					if (host !== void 0) conditions.push("host");
+					if (versioningOptions && versioningOptions.type !== VersioningType.URI && effectiveVersion !== void 0 && effectiveVersion !== VERSION_NEUTRAL) conditions.push("version");
+					for (const prefix of prefixes) for (const path of Array.isArray(rawPaths) ? rawPaths : [rawPaths]) {
+						const resolvedPaths = routePathFactory.create({
+							ctrlPath: prefix,
+							methodPath: path,
+							modulePath,
+							globalPrefix,
+							controllerVersion,
+							methodVersion,
+							versioningOptions
+						}, requestMethod).map((route) => this.mounts.normalizeApplicationRoute(route));
+						const source = `${target.name}.${method}`;
+						applicationRoutes.push(Object.freeze({
+							method: RequestMethod[requestMethod] ?? String(requestMethod),
+							paths: Object.freeze([...resolvedPaths]),
+							conditions: Object.freeze([...conditions]),
+							source
+						}));
+						for (const route of resolvedPaths) {
+							const binding = this.mounts.bindings().find((candidate) => routeMayWarnAboutMount(route, candidate.basePath));
+							if (!binding) continue;
+							this.warn("W_ROUTE_SHADOWS_AUTH", `${source} at '${route}' may shadow auth mount '${binding.basePath}'.`);
+						}
+					}
+				}
+			}
+			this.mounts.registerApplicationRoutes(Object.freeze(applicationRoutes), issues);
+		}
+		this.cookies(issues);
+		for (const entry of this.instances.list()) {
+			const plans = this.#plans.filter((site) => site.plan.instance === entry.name);
+			const policies = [...new Set(plans.flatMap((site) => requirementLeaves(site.plan.requirements).map((requirement) => this.policies.resolve(requirement.policy))))];
+			this.entryChecks(entry, policies, issues);
+			const handlers = plans.map((site) => {
+				const claims = this.#claims.filter((claim) => claim.target === site.target && (claim.method === void 0 || claim.method === site.method));
+				return {
+					plan: site.plan,
+					transports: [...new Set(claims.map((claim) => claim.transport.id))],
+					inputs: [...new Set(claims.flatMap((claim) => claim.options.inputs ?? []))]
+				};
+			});
+			const advice = {
+				instance: entry.name,
+				auth: entry.handle,
+				context: entry.context,
+				production: productionMode(),
+				hasHttpAdapter: this.mounts.adapter !== null,
+				originCheck: {
+					mode: entry.options.originCheck?.mode ?? "cookie",
+					missingOrigin: entry.options.originCheck?.missingOrigin ?? "reject"
+				},
+				handlers,
+				transports: this.transports.list().map((transport) => ({ id: transport.id })),
+				sources: entry.sources,
+				policies
+			};
+			for (const unit of [
+				...entry.sources,
+				...policies,
+				...this.transports.list(),
+				...this.mounts.platform ? [this.mounts.platform] : []
+			]) try {
+				for (const item of await unit.advise?.(advice) ?? []) {
+					const line = `${item.code}: '${entry.name}' ${unit.id}: ${item.message}${item.hint ? ` ${item.hint}` : ""}`;
+					if (item.level === "warn") this.logger.warn(line);
+					else this.logger.log(line);
+				}
+			} catch (error) {
+				issues.push(configurationIssue(error, "EXTENSION_ADVICE_FAILED", `Advice from '${unit.id}' failed.`));
+			}
+		}
+	}
+	summary(hooks) {
+		for (const entry of this.instances.list()) {
+			if (entry.options.logSummary === false) continue;
+			const mount = this.mounts.binding(entry.name);
+			const plans = this.#plans.filter((site) => site.plan.instance === entry.name).map((site) => site.plan);
+			const rate = entry.context.rateLimit.enabled ? "on" : entry.context.options.rateLimit?.enabled === false ? "off (rateLimit.enabled:false)" : process.env.NODE_ENV === "production" ? "off (Better Auth saw no NODE_ENV=production at import time; see W_RATE_LIMIT_DISABLED)" : `off (NODE_ENV ${process.env.NODE_ENV ?? "unset"}; Better Auth enables it for NODE_ENV=production)`;
+			const table = hooks.get(entry.name);
+			const hookSummary = table ? `${table.before.length} before, ${table.after.length} after, ${Object.values(table.database).reduce((count, value) => count + value.before.length + value.after.length, 0)} database` : "none";
+			const proxy = this.mounts.adapter ? this.mounts.platform?.proxyTrust?.(this.mounts.adapter) : void 0;
+			const defaults = `access: ${entry.options.defaultAccess ?? "authenticated"}; origin: ${entry.options.originCheck?.mode ?? "cookie"}/${entry.options.originCheck?.missingOrigin ?? "reject"}; direct-call cookies: ${entry.options.cookies?.forwardDirectCalls ? "same-credential" : "opt-in"}`;
+			const guardOrder = this.appConfig.getGlobalGuards().map((guard) => guard.constructor.name).join(" → ");
+			this.logger.log(`'${entry.name}': ${mount ? `mounted at ${mount.basePath} (${mount.bodyLimit} bytes)` : "not mounted"}; platform: ${this.mounts.platform?.id ?? "none"} (trust proxy: ${proxy?.mode ?? "unknown"}${proxy?.detail ? ` ${proxy.detail}` : ""}); outside global prefix '${this.appConfig.getGlobalPrefix()}'; hooks: ${hookSummary}; defaults: ${defaults}; transports: ${this.transports.list().map((unit) => unit.id).join(", ")}; principals: ${entry.sources.map((unit) => `${unit.id} (${unit.acceptance ?? "explicit"})`).join(" → ")}; handlers: ${plans.length} (${plans.filter((plan) => plan.access === "public").length} public, ${plans.filter((plan) => plan.access === "optional").length} optional, ${plans.filter((plan) => plan.access === "inherit").length} inherit, ${plans.filter((plan) => plan.skipsDefaultRequirements).length} skip defaults); environment: ${productionMode() ? "production" : "development"} (NODE_ENV ${process.env.NODE_ENV ?? "unset"}); rate limit: ${rate}; scope: ${this.#globalScope ? "global" : "off — see W_NO_GLOBAL_SCOPE"}; global guards: ${guardOrder}`);
+		}
+	}
+};
+BootValidator = __decorate([
+	__decorateParam(0, Inject(DiscoveryService)),
+	__decorateParam(1, Inject(MetadataScanner)),
+	__decorateParam(2, Inject(Reflector)),
+	__decorateParam(3, Inject(ModuleRef)),
+	__decorateParam(4, Inject(ApplicationConfig)),
+	__decorateParam(5, Inject(INSTANCE_REGISTRY)),
+	__decorateParam(6, Inject(ROUTE_PLANNER)),
+	__decorateParam(7, Inject(POLICY_RESOLVER)),
+	__decorateParam(8, Inject(TRANSPORT_REGISTRY)),
+	__decorateParam(9, Inject(MOUNT_COORDINATOR))
+], BootValidator);
+//#endregion
+//#region src/hook-binder.ts
+const DATABASE_TARGETS = [
+	"user",
+	"session",
+	"account",
+	"verification"
+].flatMap((model) => [
+	"create",
+	"update",
+	"delete"
+].map((operation) => `${model}.${operation}`));
+function emptyHookTables() {
+	return {
+		before: [],
+		after: [],
+		database: Object.fromEntries(DATABASE_TARGETS.map((target) => [target, {
+			before: [],
+			after: []
+		}]))
+	};
+}
+function distance$1(a, b) {
+	let row = Array.from({ length: b.length + 1 }, (_, i) => i);
+	for (let i = 1; i <= a.length; i++) {
+		const next = [i];
+		for (let j = 1; j <= b.length; j++) next[j] = Math.min(next[j - 1] + 1, row[j] + 1, row[j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1));
+		row = next;
+	}
+	return row[b.length];
+}
+let HookBinder = class HookBinder {
+	discovery;
+	scanner;
+	logger = new Logger("BetterAuth");
+	constructor(discovery, scanner) {
+		this.discovery = discovery;
+		this.scanner = scanner;
+	}
+	discover(registry, issues) {
+		const endpoint = /* @__PURE__ */ new Map();
+		const database = /* @__PURE__ */ new Map();
+		const registrations = new Set(registry.registrations().map((item) => item.name));
+		const discovered = /* @__PURE__ */ new Map();
+		for (const wrapper of this.discovery.getProviders()) {
+			if (wrapper.isAlias || !wrapper.instance || typeof wrapper.instance !== "object" && typeof wrapper.instance !== "function") continue;
+			const instance = wrapper.instance;
+			if (!Object.getPrototypeOf(instance)) continue;
+			const methods = new Set(this.scanner.getAllMethodNames(instance));
+			for (let current = instance; current && current !== Object.prototype; current = Object.getPrototypeOf(current)) for (const key of Object.getOwnPropertySymbols(current)) if (typeof Object.getOwnPropertyDescriptor(current, key)?.value === "function") methods.add(key);
+			let found = false;
+			for (const method of methods) {
+				const handler = Reflect.get(instance, method);
+				if (typeof handler !== "function") continue;
+				const metadata = readHookMetadata(handler);
+				if (!metadata.hooks.length && !metadata.databaseHooks.length) continue;
+				found = true;
+				if (!isSingletonDependencyTree(wrapper)) {
+					issues.push(new BetterAuthConfigurationError("NON_SINGLETON_EXTENSION", `Hook provider '${wrapper.name}' is not a static singleton.`, "Remove request/transient dependencies from hook providers."));
+					continue;
+				}
+				for (const declaration of metadata.hooks) {
+					const name = declaration.options.instance ?? "default";
+					if (!registrations.has(name)) {
+						issues.push(new BetterAuthConfigurationError("UNKNOWN_INSTANCE", `Hook '${wrapper.name}.${String(method)}' names unknown instance '${name}'.`));
+						continue;
+					}
+					const entry = registry.list().find((value) => value.name === name);
+					if (!entry) continue;
+					const paths = Object.values(entry.instance.api).flatMap((api) => typeof api === "function" && typeof Reflect.get(api, "path") === "string" ? [Reflect.get(api, "path")] : []);
+					const { match, options } = declaration;
+					const patterns = typeof match === "string" ? [match] : Array.isArray(match) ? match : [];
+					for (const pattern of patterns) if (!paths.includes(pattern)) {
+						const closest = [...paths].sort((a, b) => distance$1(a, pattern) - distance$1(b, pattern))[0];
+						issues.push(new BetterAuthConfigurationError("UNKNOWN_HOOK_PATH", `Hook '${wrapper.name}.${String(method)}' has unknown path '${pattern}'.`, closest ? `Did you mean '${closest}'?` : "Use an endpoint path exposed by this auth instance."));
+					}
+					const hook = {
+						matches(ctx, scope) {
+							const router = Reflect.get(ctx, "_flag") === "router";
+							if (options.calls === "http" && !router || options.calls === "server" && router || options.skipInternal && scope?.internal) return false;
+							if (match === void 0) return true;
+							if (typeof match === "function") return match(ctx);
+							return typeof match === "string" ? ctx.path === match : match.includes(ctx.path ?? "");
+						},
+						async run(ctx) {
+							return handler.call(instance, ctx);
+						}
+					};
+					const list = endpoint.get(name) ?? [];
+					list.push({
+						phase: declaration.phase,
+						order: options.order ?? 0,
+						hook
+					});
+					endpoint.set(name, list);
+				}
+				for (const declaration of metadata.databaseHooks) {
+					const name = declaration.options.instance ?? "default";
+					if (!registrations.has(name)) {
+						issues.push(new BetterAuthConfigurationError("UNKNOWN_INSTANCE", `Database hook '${wrapper.name}.${String(method)}' names unknown instance '${name}'.`));
+						continue;
+					}
+					const list = database.get(name) ?? [];
+					list.push({
+						phase: declaration.phase,
+						target: declaration.target,
+						order: declaration.options.order ?? 0,
+						hook: handler.bind(instance)
+					});
+					database.set(name, list);
+				}
+			}
+			if (found) {
+				const owner = wrapper.host?.name ?? "unknown module";
+				const previous = discovered.get(wrapper.metatype);
+				if (previous) this.logger.warn(`W_DUPLICATE_HOOK_PROVIDER: '${wrapper.name}' is provided in '${previous}' and '${owner}'; both registrations run.`);
+				discovered.set(wrapper.metatype, owner);
+			}
+		}
+		const tables = /* @__PURE__ */ new Map();
+		for (const name of registrations) {
+			const hooks = (endpoint.get(name) ?? []).sort((a, b) => a.order - b.order);
+			const db = (database.get(name) ?? []).sort((a, b) => a.order - b.order);
+			tables.set(name, {
+				before: hooks.filter((value) => value.phase === "before").map((value) => value.hook),
+				after: hooks.filter((value) => value.phase === "after").map((value) => value.hook),
+				database: Object.fromEntries(DATABASE_TARGETS.map((target) => [target, {
+					before: db.filter((value) => value.target === target && value.phase === "before").map((value) => value.hook),
+					after: db.filter((value) => value.target === target && value.phase === "after").map((value) => value.hook)
+				}]))
+			});
+		}
+		return tables;
+	}
+};
+HookBinder = __decorate([
+	__decorateParam(0, Inject(DiscoveryService)),
+	__decorateParam(1, Inject(MetadataScanner)),
+	__decorateMetadata("design:paramtypes", [typeof DiscoveryService === "undefined" ? Object : DiscoveryService, typeof MetadataScanner === "undefined" ? Object : MetadataScanner])
+], HookBinder);
+//#endregion
+//#region src/auth-exchange.ts
+const HOP_HEADERS = [
+	"connection",
+	"keep-alive",
+	"proxy-connection",
+	"transfer-encoding",
+	"te",
+	"trailer",
+	"upgrade",
+	"proxy-authenticate",
+	"proxy-authorization"
+];
+function sdkAPIError(error) {
+	try {
+		return isAPIError(error);
+	} catch {
+		return false;
+	}
+}
+function production() {
+	return ![
+		"development",
+		"dev",
+		"test"
+	].includes(process.env.NODE_ENV ?? "");
+}
+function distance(left, right) {
+	let previous = Array.from({ length: right.length + 1 }, (_, index) => index);
+	for (let row = 0; row < left.length; row++) {
+		const current = [row + 1];
+		for (let column = 0; column < right.length; column++) current.push(Math.min(current[column] + 1, previous[column + 1] + 1, previous[column] + Number(left[row] !== right[column])));
+		previous = current;
+	}
+	return previous[right.length];
+}
+/** App-owned exchange; all platform request and response operations stay outside core. */
+var AuthExchange = class {
+	scope;
+	#warnedProxy = false;
+	constructor(scope) {
+		this.scope = scope;
+	}
+	create(entry, init) {
+		const paths = [...new Set(Object.values(entry.instance.api).flatMap((endpoint) => {
+			const path = Reflect.get(endpoint, "path");
+			return typeof path === "string" ? [path] : [];
+		}))];
+		const seen = /* @__PURE__ */ new Set();
+		const binding = Object.freeze({
+			instance: entry.name,
+			basePath: init.basePath,
+			bodyLimit: init.bodyLimit,
+			staticOrigin: init.staticOrigin,
+			matches: (pathname) => init.basePath === "/" ? pathname.startsWith("/") : pathname === init.basePath || pathname.startsWith(`${init.basePath}/`),
+			payloadTooLarge: () => Response.json({
+				code: "PAYLOAD_TOO_LARGE",
+				message: "Request body exceeds the configured limit"
+			}, { status: 413 }),
+			handle: async (inbound) => {
+				const response = await this.handle(entry, init, binding, inbound);
+				if (response.status === 404 && (entry.options.http?.diagnostics ?? !production())) {
+					const pathname = new URL(inbound.url).pathname;
+					const key = `${inbound.method.toUpperCase()} ${pathname}`;
+					if (binding.matches(pathname) && !seen.has(key) && seen.size < 100) {
+						seen.add(key);
+						const requested = pathname.slice(init.basePath === "/" ? 0 : init.basePath.length);
+						const closest = paths.reduce((best, path) => best === void 0 || distance(requested, path) < distance(requested, best) ? path : best, void 0);
+						const suggestion = closest ? ` Did you mean ${init.basePath === "/" ? "" : init.basePath}${closest}?` : "";
+						init.logger.warn(`better-auth has no route for ${key} (mounted at ${init.basePath}).${suggestion}`);
+					}
+				}
+				return response;
+			}
+		});
+		return binding;
+	}
+	async handle(entry, init, binding, inbound) {
+		const redactors = [new ErrorRedactor({
+			secrets: [entry.context.secret],
+			headers: inbound.headers,
+			credentialHeaders: entry.credentialHeaders
+		})];
+		try {
+			const method = inbound.method.toUpperCase();
+			let body = null;
+			if (method !== "GET" && method !== "HEAD") {
+				if (inbound.body instanceof Uint8Array) {
+					if (inbound.body.byteLength > init.bodyLimit) return binding.payloadTooLarge();
+					body = inbound.body;
+				} else if (inbound.body !== null) {
+					const bounded = await readBoundedBody(inbound.body, { limit: init.bodyLimit });
+					if (!bounded.ok) {
+						if (bounded.reason === "too-large") return binding.payloadTooLarge();
+						throw new Error("Authentication request body was aborted");
+					}
+					body = bounded.bytes;
+				}
+			}
+			let url;
+			try {
+				url = new URL(inbound.url);
+				if (!["http:", "https:"].includes(url.protocol) || url.username || url.password) throw new TypeError("Invalid request URL");
+				if (init.staticOrigin) url = new URL(`${init.staticOrigin}${url.pathname}${url.search}`);
+			} catch {
+				return Response.json({
+					code: "INVALID_REQUEST_URL",
+					message: "Invalid request URL"
+				}, { status: 400 });
+			}
+			const headers = new Headers(inbound.headers);
+			const nominated = (headers.get("connection") ?? "").split(",").map((name) => name.trim()).filter(Boolean);
+			for (const name of [...HOP_HEADERS, ...nominated]) headers.delete(name);
+			const ipHeader = entry.bridge.clientIpHeader;
+			for (const name of [...headers.keys()]) if (name.startsWith("x-nsba-ip-") || name === ipHeader?.toLowerCase()) headers.delete(name);
+			if (ipHeader && inbound.clientIp !== null) headers.set(ipHeader, inbound.clientIp);
+			this.warnProxy(entry, init, inbound);
+			const request = new Request(url, {
+				method,
+				headers,
+				body: body === null ? null : Uint8Array.from(body),
+				signal: inbound.signal
+			});
+			const interceptors = entry.options.http?.around ?? [];
+			const dispatch = (index, current) => {
+				redactors.push(new ErrorRedactor({
+					headers: current.headers,
+					credentialHeaders: entry.credentialHeaders
+				}));
+				const interceptor = interceptors[index];
+				return interceptor ? interceptor({
+					request: current,
+					platformRequest: inbound.platformRequest,
+					instance: entry.name
+				}, (replacement = current) => dispatch(index + 1, replacement)) : this.scope.exit(() => entry.instance.handler(current));
+			};
+			return await dispatch(0, request);
+		} catch (error) {
+			if (sdkAPIError(error)) {
+				if (entry.context.options.onAPIError?.throw) throw error;
+				return Response.json(error.body ?? { message: error.message }, {
+					status: error.statusCode,
+					headers: getAPIErrorHeaders(error)
+				});
+			}
+			let cause = error;
+			for (const redactor of redactors) cause = redactor.redact(cause);
+			const wrapped = createInfrastructureError(cause);
+			if (entry.options.errors?.exposeRawCause) {
+				const raw = createInfrastructureError(error, { exposeRawCause: true });
+				Object.defineProperty(raw, "cause", { value: wrapped.cause });
+				throw raw;
+			}
+			throw wrapped;
+		}
+	}
+	warnProxy(entry, init, inbound) {
+		if (this.#warnedProxy || !production() || init.proxyTrust?.mode !== "none" || ![
+			"x-forwarded-for",
+			"forwarded",
+			"x-real-ip"
+		].some((name) => inbound.headers.has(name))) return;
+		this.#warnedProxy = true;
+		const ip = entry.context.options.advanced?.ipAddress;
+		const bridgeHeader = entry.bridge.clientIpHeader;
+		const bridgeHeaderFirst = bridgeHeader !== null && ip?.ipAddressHeaders?.[0]?.toLowerCase() === bridgeHeader.toLowerCase();
+		let effect;
+		if (!entry.context.rateLimit.enabled) {
+			if (bridgeHeader === null) effect = "Rate limiting is disabled; the bridge does not insert this socket IP, so better-auth's configured IP resolution determines the session IP.";
+			else if (!bridgeHeaderFirst) effect = "Rate limiting is disabled; a configured better-auth IP header precedes the bridge header, so this socket IP is not necessarily recorded on sessions.";
+			else effect = "Rate limiting is disabled; this IP is recorded on sessions only.";
+		} else if (bridgeHeader === null) effect = "The bridge does not insert this socket IP; better-auth's configured IP resolution determines the rate-limit key.";
+		else if (!bridgeHeaderFirst) effect = "A configured better-auth IP header precedes the bridge header, so this socket IP is not necessarily the rate-limit key.";
+		else if (ip?.trustedProxies?.length) effect = "If better-auth trustedProxies covers this address, no client IP remains and all clients share one rate-limit bucket. Otherwise this socket IP is the rate-limit key.";
+		else effect = "This socket IP is the rate-limit key, so clients behind the proxy share its bucket.";
+		init.logger.warn(`W_PROXY_UNTRUSTED: platform resolved socket IP ${inbound.clientIp ?? "unknown"}. ${effect} Configure platform proxy trust (${init.proxyTrust.detail}).`);
+	}
+};
+/** Credentialed CORS for the auth mount, using the initialized SDK trusted origins. */
+function betterAuthCorsOrigin(auth, options) {
+	const context = async () => await auth.$context;
+	const trusted = new TrustedOrigins(context);
+	return (origin, callback) => {
+		(async () => {
+			if (typeof (await context()).options.trustedOrigins === "function") throw new BetterAuthConfigurationError("DYNAMIC_CORS_ORIGIN", "Function-valued trustedOrigins needs a request that a CORS origin callback cannot provide", "Supply a request-aware CORS origin function instead of betterAuthCorsOrigin.");
+			if (!origin) return false;
+			if (options?.allowPatterns) return trusted.isTrusted(origin);
+			return (await trusted.list()).some((candidate) => {
+				try {
+					const parsed = new URL(candidate);
+					return (parsed.protocol === "http:" || parsed.protocol === "https:") && !candidate.includes("*") && candidate === parsed.origin && origin === candidate;
+				} catch {
+					return false;
+				}
+			});
+		})().then((allow) => callback(null, allow), (error) => callback(error instanceof Error ? error : /* @__PURE__ */ new Error("Failed to resolve trusted CORS origins")));
+	};
+}
+//#endregion
+//#region src/mount-coordinator.ts
+const MOUNTED = Symbol.for("nestjs-slightly-better-auth:mounted");
+function parseBodyLimit(input) {
+	if (input === void 0) return 1048576;
+	const match = typeof input === "string" ? /^(\d+(?:\.\d+)?)(b|kb|mb)$/i.exec(input) : null;
+	const value = typeof input === "number" ? input : match ? Number(match[1]) * ({
+		b: 1,
+		kb: 1024,
+		mb: 1048576
+	}[match[2].toLowerCase()] ?? 0) : NaN;
+	if (!Number.isSafeInteger(value) || value < 0) throw new BetterAuthConfigurationError("INVALID_BODY_LIMIT", `Invalid auth body limit '${input}'.`, "Use a nonnegative byte count or a value such as '1mb'.");
+	return value;
+}
+let MountCoordinator = class MountCoordinator {
+	host;
+	registry;
+	logger = new Logger("BetterAuth");
+	#exchange;
+	#bindings = /* @__PURE__ */ new Map();
+	#platforms;
+	#prepared = null;
+	#selected;
+	#preparationErrors = [];
+	constructor(host, registry, scope) {
+		this.host = host;
+		this.registry = registry;
+		this.#exchange = new AuthExchange(scope);
+		host.init$.subscribe(() => this.tryPrepare(false));
+	}
+	registerPlatforms(platforms) {
+		this.#platforms = platforms;
+		this.tryPrepare(false);
+	}
+	get platform() {
+		return this.#selected;
+	}
+	get adapter() {
+		return this.host.httpAdapter ?? null;
+	}
+	tryPrepare(atInit) {
+		const adapter = this.adapter;
+		if (!adapter || !this.#platforms || this.#prepared === adapter) return;
+		try {
+			if (this.registry.state !== "new" && this.registry.adapter !== adapter) throw new BetterAuthConfigurationError("LATE_HTTP_ADAPTER", "The HTTP adapter changed while the application is active.", "Close the first application before starting another.");
+			const supported = this.#platforms.filter((platform) => platform.supports(adapter));
+			if (supported.length !== 1) throw new BetterAuthConfigurationError(supported.length ? "AMBIGUOUS_PLATFORM" : "NO_PLATFORM", `Expected exactly one supporting HTTP platform; found ${supported.length}.`, "Register the platform for your HTTP adapter on the default instance.");
+			const platform = supported[0];
+			if (atInit && this.#prepared !== null && !platform.capabilities?.prepareAtInit) throw new BetterAuthConfigurationError("APP_ADAPTER_CHANGED", "The application uses a different HTTP adapter after preparation.", "Compile a new TestingModule for each application (or use NestFactory).");
+			platform.prepare?.({
+				adapter,
+				logger: this.logger,
+				route: (pathname) => this.route(pathname)
+			});
+			this.#selected = platform;
+			this.#prepared = adapter;
+		} catch (error) {
+			this.#preparationErrors.push(configurationIssue(error, "PLATFORM_PREPARATION_FAILED", "HTTP platform preparation failed."));
+		}
+	}
+	prepareAtInit(issues) {
+		this.tryPrepare(true);
+		issues.push(...this.#preparationErrors);
+		this.#preparationErrors = [];
+		if (this.adapter && this.#selected) try {
+			this.#selected.validate?.(this.adapter);
+		} catch (error) {
+			issues.push(configurationIssue(error, "PLATFORM_VALIDATION_FAILED", "HTTP platform validation failed."));
+		}
+	}
+	resolve(issues) {
+		this.#bindings.clear();
+		const adapter = this.adapter;
+		if (!adapter || !this.#selected) return;
+		const server = adapter.getInstance();
+		const mounted = Reflect.get(server, MOUNTED);
+		for (const entry of this.registry.list()) {
+			if (entry.options.http?.mount === false) continue;
+			try {
+				const raw = entry.context.baseURL ? new URL(entry.context.baseURL).pathname : entry.context.options.basePath || "/api/auth";
+				const basePath = raw.length > 1 ? raw.replace(/\/+$/, "") : raw;
+				if (!basePath.startsWith("/") || basePath === "/" && !entry.options.http?.allowRootMount) throw new BetterAuthConfigurationError("INVALID_MOUNT_PATH", `Invalid auth mount path '${basePath}'.`, "Use an absolute path; opt into root mounting with http.allowRootMount.");
+				if (mounted?.has(basePath)) throw new BetterAuthConfigurationError("DUPLICATE_MOUNT", `Auth path '${basePath}' is already mounted on this server.`, "Create a fresh application and adapter.");
+				for (const existing of this.#bindings.values()) if (basePath === "/" || existing.basePath === "/" || existing.matches(basePath) || basePath.startsWith(`${existing.basePath}/`) || existing.basePath.startsWith(`${basePath}/`)) throw new BetterAuthConfigurationError("OVERLAPPING_MOUNTS", `Mounts '${existing.basePath}' and '${basePath}' overlap.`, "Use separate basePath values for named instances.");
+				this.#bindings.set(entry.name, this.#exchange.create(entry, {
+					basePath,
+					bodyLimit: parseBodyLimit(entry.options.http?.bodyLimit),
+					staticOrigin: entry.context.baseURL ? new URL(entry.context.baseURL).origin : void 0,
+					logger: this.logger,
+					proxyTrust: this.#selected.proxyTrust?.(adapter)
+				}));
+			} catch (error) {
+				issues.push(configurationIssue(error, "INVALID_MOUNT_PATH", `Cannot resolve mount for '${entry.name}'.`));
+			}
+		}
+	}
+	route(pathname) {
+		return [...this.#bindings.values()].find((binding) => binding.matches(pathname));
+	}
+	binding(name) {
+		return this.#bindings.get(name);
+	}
+	bindings() {
+		return [...this.#bindings.values()];
+	}
+	normalizeApplicationRoute(path) {
+		const adapter = this.adapter;
+		return adapter && typeof adapter.normalizePath === "function" ? adapter.normalizePath(path) : path;
+	}
+	registerApplicationRoutes(routes, issues) {
+		try {
+			this.#selected?.applicationRoutes?.(routes, Object.freeze([...this.#bindings.values()]));
+		} catch (error) {
+			issues.push(configurationIssue(error, "APPLICATION_ROUTE_REGISTRATION_FAILED", "Cannot register application routes with the HTTP platform."));
+		}
+	}
+	async mount() {
+		const adapter = this.adapter;
+		const platform = this.#selected;
+		if (!adapter || !platform) return;
+		const server = adapter.getInstance();
+		let mounted = Reflect.get(server, MOUNTED);
+		if (!mounted) {
+			mounted = /* @__PURE__ */ new Set();
+			Object.defineProperty(server, MOUNTED, { value: mounted });
+		}
+		for (const binding of this.#bindings.values()) {
+			if (mounted.has(binding.basePath)) throw new BetterAuthConfigurationError("DUPLICATE_MOUNT", `Auth path '${binding.basePath}' is already mounted.`);
+			await platform.mount({
+				adapter,
+				logger: this.logger,
+				binding
+			});
+			mounted.add(binding.basePath);
+		}
+	}
+	reset() {
+		this.#bindings.clear();
+		this.#preparationErrors = [];
+	}
+};
+MountCoordinator = __decorate([
+	__decorateParam(0, Inject(HttpAdapterHost)),
+	__decorateParam(1, Inject(INSTANCE_REGISTRY)),
+	__decorateParam(2, Inject(REQUEST_SCOPE)),
+	__decorateMetadata("design:paramtypes", [
+		typeof HttpAdapterHost === "undefined" ? Object : HttpAdapterHost,
+		Object,
+		Object
+	])
+], MountCoordinator);
+//#endregion
+//#region src/policy-resolver.ts
+var PolicyResolver = class {
+	moduleRef;
+	cache = /* @__PURE__ */ new Map();
+	constructor(moduleRef) {
+		this.moduleRef = moduleRef;
+	}
+	resolve(reference) {
+		const cached = this.cache.get(reference);
+		if (cached) return cached;
+		let policy;
+		try {
+			policy = typeof reference === "object" && reference !== null && "evaluate" in reference ? reference : this.moduleRef.get(reference, { strict: false });
+		} catch {
+			throw new BetterAuthConfigurationError("UNRESOLVED_POLICY", "A requirement references a policy that is not registered as a provider");
+		}
+		if (!policy || typeof policy.evaluate !== "function" || typeof policy.id !== "string") throw new BetterAuthConfigurationError("UNRESOLVED_POLICY", "A requirement must reference an authorization policy");
+		this.cache.set(reference, policy);
+		return policy;
+	}
+};
+//#endregion
+//#region src/transport-registry.ts
+var TransportRegistry = class {
+	transports = [];
+	owners = /* @__PURE__ */ new WeakMap();
+	kit = { http: null };
+	register(transports) {
+		this.transports = [...transports];
+	}
+	setKit(kit) {
+		this.kit = kit;
+	}
+	list() {
+		return [...this.transports];
+	}
+	defaultAccessFor(target, method) {
+		for (const transport of this.transports) {
+			const answer = transport.defaultAccessFor?.(target, method);
+			if (answer !== void 0) return answer;
+		}
+	}
+	find(context) {
+		return this.transports.find((unit) => unit.handles(context));
+	}
+	select(context) {
+		const transport = this.find(context);
+		if (!transport) throw BetterAuthConfigurationError.atRequest("NO_TRANSPORT", "No registered transport handles this execution context");
+		return transport;
+	}
+	idOf(call) {
+		return this.owners.get(call) ?? "unknown";
+	}
+	describe(context, transport = this.select(context)) {
+		const call = transport.describe(context, this.kit);
+		this.owners.set(call, transport.id);
+		return call;
+	}
+};
+//#endregion
+//#region src/auth-core-module.ts
+const EVALUATOR = Symbol("authorization-evaluator");
+const exports = [
+	INSTANCE_REGISTRY,
+	REQUEST_SCOPE,
+	PRINCIPAL_READINGS,
+	MOUNT_COORDINATOR,
+	POLICY_RESOLVER,
+	ROUTE_PLANNER,
+	TRANSPORT_REGISTRY,
+	PRINCIPAL_RESOLVER,
+	POLICY_INVOKER,
+	GUARD_CORE,
+	SCOPE_CORE,
+	BetterAuthGuard,
+	BetterAuthScopeInterceptor
+];
+let BetterAuthCoreModule = class BetterAuthCoreModule {
+	instances;
+	scope;
+	transports;
+	mounts;
+	hooks;
+	bridges;
+	validator;
+	#initialization;
+	#ready = false;
+	constructor(instances, scope, transports, mounts, hooks, bridges, validator) {
+		this.instances = instances;
+		this.scope = scope;
+		this.transports = transports;
+		this.mounts = mounts;
+		this.hooks = hooks;
+		this.bridges = bridges;
+		this.validator = validator;
+	}
+	onModuleInit() {
+		if (!this.instances.begin(this.mounts.adapter)) return this.#initialization ?? Promise.resolve();
+		this.#initialization = this.initialize();
+		return this.#initialization;
+	}
+	async initialize() {
+		const issues = [];
+		await this.instances.initialize(issues);
+		const hooks = this.hooks.discover(this.instances, issues);
+		for (const entry of this.instances.list()) {
+			const tables = hooks.get(entry.name) ?? emptyHookTables();
+			const unbound = entry.bridge.unboundDispatches;
+			const count = tables.before.length + tables.after.length + Object.values(tables.database).reduce((sum, value) => sum + value.before.length + value.after.length, 0);
+			try {
+				const result = this.bridges.bind(entry, {
+					owner: this.instances.owner,
+					instance: entry.name,
+					state: "initialized",
+					current: () => this.scope.current()?.view,
+					credentialHeaders: entry.credentialHeaders,
+					...tables,
+					onDropped: (path) => this.instances.logger.debug(`Direct auth call '${path}' used foreign credentials; cookies dropped for '${entry.name}'.`)
+				});
+				if (result.tookOverFrom) this.instances.logger.warn(`W_INSTANCE_TAKEN_OVER: '${entry.name}' took over from never-bootstrapped '${result.tookOverFrom}'.`);
+				if (unbound > 0 && count > 0) this.instances.logger.warn(`W_CALLS_BEFORE_BIND: '${entry.name}': ${unbound} auth dispatches or database writes ran before Nest hooks; move seeding to onApplicationBootstrap.`);
+			} catch (error) {
+				issues.push(configurationIssue(error, "INSTANCE_ALREADY_BOUND", `Cannot bind '${entry.name}' to this application.`));
+			}
+		}
+		this.mounts.prepareAtInit(issues);
+		this.mounts.resolve(issues);
+		this.transports.setKit({ http: this.mounts.platform?.requests ?? null });
+		await this.validator.validate(issues);
+		if (issues.length) {
+			const failure = new BetterAuthConfigurationError("AUTH_BOOT_FAILED", `Authentication bootstrap failed:\n${issues.map((issue) => `[${issue.code}] ${issue.detail}${issue.hint ? ` Hint: ${issue.hint}` : ""}`).join("\n")}`, "Resolve every reported configuration problem before starting the application.");
+			Object.defineProperty(failure, "issues", {
+				value: Object.freeze([...issues]),
+				enumerable: true
+			});
+			throw failure;
+		}
+		this.validator.summary(hooks);
+		await this.mounts.mount();
+		this.#ready = true;
+	}
+	onApplicationBootstrap() {
+		if (this.#ready && this.instances.state !== "bootstrapped") {
+			this.bridges.bootstrap();
+			this.instances.state = "bootstrapped";
+		}
+	}
+	onApplicationShutdown() {
+		this.bridges.close();
+		this.instances.reset();
+		this.mounts.reset();
+		this.#initialization = void 0;
+		this.#ready = false;
+	}
+};
+BetterAuthCoreModule = __decorate([
+	Global(),
+	Module({
+		imports: [DiscoveryModule],
+		providers: [
+			MetadataScanner,
+			{
+				provide: REQUEST_SCOPE,
+				useFactory: () => new RequestScope()
+			},
+			{
+				provide: INSTANCE_REGISTRY,
+				inject: [REQUEST_SCOPE],
+				useFactory: (scope) => new InstanceRegistry(scope)
+			},
+			{
+				provide: PRINCIPAL_READINGS,
+				inject: [REQUEST_SCOPE],
+				useFactory: (scope) => new PrincipalReadings(scope)
+			},
+			{
+				provide: TRANSPORT_REGISTRY,
+				useFactory: () => new TransportRegistry()
+			},
+			{
+				provide: POLICY_RESOLVER,
+				inject: [ModuleRef],
+				useFactory: (ref) => new PolicyResolver(ref)
+			},
+			{
+				provide: ROUTE_PLANNER,
+				inject: [
+					INSTANCE_REGISTRY,
+					POLICY_RESOLVER,
+					TRANSPORT_REGISTRY
+				],
+				useFactory: (instances, policies, transports) => new RoutePlanner(instances, policies, transports)
+			},
+			{
+				provide: MOUNT_COORDINATOR,
+				inject: [
+					HttpAdapterHost,
+					INSTANCE_REGISTRY,
+					REQUEST_SCOPE
+				],
+				useFactory: (host, instances, scope) => new MountCoordinator(host, instances, scope)
+			},
+			{
+				provide: PRINCIPAL_RESOLVER,
+				inject: [
+					INSTANCE_REGISTRY,
+					REQUEST_SCOPE,
+					TRANSPORT_REGISTRY
+				],
+				useFactory: (instances, scope, transports) => new ChainPrincipalResolver(instances, scope, transports)
+			},
+			{
+				provide: POLICY_INVOKER,
+				useFactory: () => new DefaultPolicyInvoker()
+			},
+			{
+				provide: EVALUATOR,
+				inject: [
+					POLICY_RESOLVER,
+					POLICY_INVOKER,
+					PRINCIPAL_RESOLVER,
+					REQUEST_SCOPE
+				],
+				useFactory: (policies, invoker, resolver, scope) => new AuthorizationEvaluator(policies, invoker, resolver, scope)
+			},
+			{
+				provide: GUARD_CORE,
+				inject: [
+					INSTANCE_REGISTRY,
+					ROUTE_PLANNER,
+					TRANSPORT_REGISTRY,
+					PRINCIPAL_RESOLVER,
+					EVALUATOR,
+					REQUEST_SCOPE,
+					PRINCIPAL_READINGS
+				],
+				useFactory: (instances, planner, transports, resolver, evaluator, scope, readings) => new GuardCore(instances, planner, transports, resolver, evaluator, scope, readings)
+			},
+			{
+				provide: SCOPE_CORE,
+				inject: [
+					INSTANCE_REGISTRY,
+					ROUTE_PLANNER,
+					TRANSPORT_REGISTRY,
+					REQUEST_SCOPE,
+					PRINCIPAL_READINGS
+				],
+				useFactory: (instances, planner, transports, scope, readings) => new ScopeCore(instances, planner, transports, scope, readings)
+			},
+			BetterAuthGuard,
+			BetterAuthScopeInterceptor,
+			HookBinder,
+			BridgeClient,
+			{
+				provide: BootValidator,
+				inject: [
+					DiscoveryService,
+					MetadataScanner,
+					Reflector,
+					ModuleRef,
+					ApplicationConfig,
+					INSTANCE_REGISTRY,
+					ROUTE_PLANNER,
+					POLICY_RESOLVER,
+					TRANSPORT_REGISTRY,
+					MOUNT_COORDINATOR
+				],
+				useFactory: (discovery, scanner, reflector, moduleRef, appConfig, instances, planner, policies, transports, mounts) => new BootValidator(discovery, scanner, reflector, moduleRef, appConfig, instances, planner, policies, transports, mounts)
+			}
+		],
+		exports
+	}),
+	__decorateParam(0, Inject(INSTANCE_REGISTRY)),
+	__decorateParam(1, Inject(REQUEST_SCOPE)),
+	__decorateParam(2, Inject(TRANSPORT_REGISTRY)),
+	__decorateParam(3, Inject(MOUNT_COORDINATOR)),
+	__decorateParam(4, Inject(HookBinder)),
+	__decorateParam(5, Inject(BridgeClient)),
+	__decorateParam(6, Inject(BootValidator)),
+	__decorateMetadata("design:paramtypes", [
+		typeof InstanceRegistry === "undefined" ? Object : InstanceRegistry,
+		typeof RequestScope === "undefined" ? Object : RequestScope,
+		typeof TransportRegistry === "undefined" ? Object : TransportRegistry,
+		typeof MountCoordinator === "undefined" ? Object : MountCoordinator,
+		typeof HookBinder === "undefined" ? Object : HookBinder,
+		typeof BridgeClient === "undefined" ? Object : BridgeClient,
+		typeof BootValidator === "undefined" ? Object : BootValidator
+	])
+], BetterAuthCoreModule);
+//#endregion
+//#region src/session-principal.ts
+const SESSION_PRINCIPAL_KIND = "session";
+const CurrentSession = definePrincipalParam({
+	kind: SESSION_PRINCIPAL_KIND,
+	reason: "SESSION_REQUIRED",
+	project: (principal) => principal.session
+});
+const CurrentUser = definePrincipalParam({
+	kind: SESSION_PRINCIPAL_KIND,
+	reason: "SESSION_REQUIRED",
+	project: (principal) => "user" in principal.session ? principal.session.user : void 0
+});
+function readCurrentSession(readings) {
+	return readings.project(readings.current(), {
+		kind: SESSION_PRINCIPAL_KIND,
+		reason: "SESSION_REQUIRED",
+		site: "BetterAuthService.getSession",
+		project: (principal) => principal.session
+	});
+}
+function sessionPrincipal(options = {}) {
+	return {
+		id: "better-auth:session",
+		kinds: [SESSION_PRINCIPAL_KIND],
+		acceptance: "default",
+		credentialHeaders: ["cookie", "authorization"],
+		sessionBacked: true,
+		async resolve(request) {
+			const context = await request.auth.context();
+			const authoritative = request.freshness === "authoritative";
+			const query = {
+				...authoritative && (context.options.database || context.options.secondaryStorage) ? { disableCookieCache: true } : {},
+				...request.cookies === null ? { disableRefresh: true } : {}
+			};
+			let result;
+			try {
+				result = await request.auth.run({
+					cookies: request.cookies,
+					forward: "none",
+					internal: true
+				}, () => request.auth.api.getSession({
+					headers: request.headers,
+					returnHeaders: true,
+					query
+				}));
+			} catch (error) {
+				const failure = AuthFailures.fromAPIError(error);
+				if (!failure) throw error;
+				const cookies = getAPIErrorHeaders(error).getSetCookie();
+				if (cookies.length) request.cookies?.append(cookies);
+				return rejected(failure);
+			}
+			const cookies = result.headers?.getSetCookie() ?? [];
+			if (cookies.length) request.cookies?.append(cookies);
+			if (result.response == null || authoritative && !request.auth.producedByEndpoint(result.response)) return absent();
+			const userId = options.userId ? options.userId(result.response) : result.response.user?.id ?? null;
+			if (typeof userId !== "string" || !userId) throw BetterAuthConfigurationError.atRequest("SESSION_USER_ID", "session.userId must return a nonempty user id for a resolved session");
+			return authenticated({
+				kind: SESSION_PRINCIPAL_KIND,
+				source: "better-auth:session",
+				userId,
+				session: result.response
+			});
+		},
+		advise(context) {
+			const warnings = [];
+			if (context.context.hasPlugin("jwt")) warnings.push({
+				level: "info",
+				code: "I_SESSION_JWT_COST",
+				message: "Unless disableSettingJwtHeader is enabled, session reads may also sign a JWT."
+			});
+			if (context.context.hasPlugin("bearer")) warnings.push({
+				level: "info",
+				code: "I_SESSION_BEARER_COST",
+				message: "Without requireSignature, foreign bearer tokens can trigger a session lookup."
+			});
+			const sites = context.handlers.filter(({ plan }) => (plan.access === "required" || plan.access === "optional") && [...plan.accepts].some((kind) => kind !== "session")).map(({ plan }) => plan.site);
+			if (sites.length) warnings.push({
+				level: "warn",
+				code: "W_MIXED_KIND_SESSION_READER",
+				message: `If these handlers read getSession(), another authenticated kind throws SESSION_REQUIRED: ${sites.slice(0, 10).join(", ")}`,
+				hint: "Use getPrincipal() and narrow p.kind."
+			});
+			if (context.context.hasPlugin("api-key") && options.apiKeySessions !== false) {
+				warnings.push({
+					level: "warn",
+					code: "W_API_KEY_FULL_SESSION",
+					message: `${options.apiKeySessions ? "API-key sessions grant" : "If enableSessionForAPIKeys is enabled, API-key sessions grant"} full session access on ordinary authenticated routes.`
+				});
+				if (context.policies.some((policy) => policy.requires?.presentsCredentials)) warnings.push({
+					level: "warn",
+					code: "W_API_KEY_SESSION_MULTIPLIER",
+					message: "Policies presenting credentials can validate API-key sessions again and consume additional quota."
+				});
+			}
+			if (context.context.hasPlugin("expo") && context.originCheck.missingOrigin === "reject") warnings.push({
+				level: "warn",
+				code: "W_ORIGIN_CHECK_NATIVE_CLIENTS",
+				message: "Native clients must send a trusted Origin for cookie-carrying operations."
+			});
+			return warnings;
+		}
+	};
+}
+const freshPolicy = {
+	id: "better-auth:session/fresh",
+	requires: { principals: [SESSION_PRINCIPAL_KIND] },
+	validate(params) {
+		if (params.maxAgeSeconds !== void 0 && (!Number.isFinite(params.maxAgeSeconds) || params.maxAgeSeconds < 0)) throw new BetterAuthConfigurationError("INVALID_FRESH_AGE", "maxAgeSeconds must be finite and nonnegative");
+	},
+	advise(context) {
+		return context.context.hasPlugin("custom-session") ? [{
+			level: "warn",
+			code: "W_FRESH_SESSION_SHAPE",
+			message: "freshSession requires custom session results to retain session.createdAt; unsupported shapes deny PRINCIPAL_NOT_SUPPORTED."
+		}] : [];
+	},
+	async evaluate(params, context) {
+		const createdAt = context.principal.session.session?.createdAt;
+		const age = params.maxAgeSeconds ?? (await context.auth.context()).sessionConfig.freshAge;
+		if (age === 0) return { effect: "allow" };
+		if (!(createdAt instanceof Date) && typeof createdAt !== "string" && typeof createdAt !== "number") return {
+			effect: "deny",
+			reason: "PRINCIPAL_NOT_SUPPORTED"
+		};
+		const time = new Date(createdAt).getTime();
+		return Number.isFinite(time) && Date.now() - time < age * 1e3 ? { effect: "allow" } : {
+			effect: "deny",
+			status: 403,
+			reason: "SESSION_NOT_FRESH"
+		};
+	}
+};
+const freshSession = (options = {}) => ({
+	policy: freshPolicy,
+	params: options
+});
+const RequireFreshSession = (options) => Require(freshSession(options));
+//#endregion
+//#region src/auth-service.ts
+let BetterAuthService = class BetterAuthService {
+	registry;
+	scope;
+	readings;
+	planner;
+	transports;
+	coordinator;
+	name;
+	instance;
+	api;
+	#context;
+	constructor(options, registry, scope, readings, planner, transports, coordinator) {
+		this.registry = registry;
+		this.scope = scope;
+		this.readings = readings;
+		this.planner = planner;
+		this.transports = transports;
+		this.coordinator = coordinator;
+		const registration = registry.registrations().find((value) => value.options === options);
+		if (!registration) throw new BetterAuthConfigurationError("UNKNOWN_INSTANCE", "The service options have no registered instance.");
+		this.name = registration.name;
+		this.instance = options.auth;
+		this.api = options.auth?.api;
+		this.#context = options.auth?.$context;
+	}
+	context() {
+		return this.#context;
+	}
+	mount() {
+		const binding = this.coordinator.binding(this.name);
+		const platform = this.coordinator.platform;
+		return binding && platform ? {
+			basePath: binding.basePath,
+			bodyLimit: binding.bodyLimit,
+			platform: platform.id
+		} : void 0;
+	}
+	getPrincipal() {
+		const reading = this.readings.current();
+		return Promise.resolve(this.readings.project(reading, {
+			site: "BetterAuthService.getPrincipal",
+			project: (principal) => principal
+		}));
+	}
+	getSession() {
+		return Promise.resolve(readCurrentSession(this.readings));
+	}
+	principalFor(context) {
+		const plan = this.planner.forContext(context);
+		const transport = this.transports.find(context);
+		const lineage = transport?.lineage?.(context);
+		const call = plan.access !== "public" && plan.access !== "inherit" && transport ? this.transports.describe(context, transport) : void 0;
+		return this.readings.read({
+			args: context.getArgs(),
+			plan,
+			call,
+			lineage,
+			beforeGuard: true
+		});
+	}
+	headersFrom(platformRequest) {
+		const accessor = this.coordinator.platform?.requests;
+		if (!accessor?.isRequest(platformRequest)) throw BetterAuthConfigurationError.atRequest("NO_HTTP_REQUEST", "headersFrom needs a request from the selected HTTP platform.");
+		const entry = this.registry.get(this.name);
+		const headers = new Headers(accessor.headers(platformRequest));
+		for (const name of [...headers.keys()]) if (name.startsWith(":") || name.startsWith("x-nsba-ip-") || name === entry.bridge.clientIpHeader?.toLowerCase()) headers.delete(name);
+		const clientIp = accessor.clientIp(platformRequest);
+		if (entry.bridge.clientIpHeader && clientIp !== null) headers.set(entry.bridge.clientIpHeader, clientIp);
+		return headers;
+	}
+	forwardForeignCookies(fn) {
+		const outer = this.scope.current();
+		if (!outer?.plan?.forwardDirectCalls) throw BetterAuthConfigurationError.atRequest("FORWARDING_NOT_DECLARED", "Declare cookie forwarding on the active handler before forwarding foreign credentials.", { hint: "Use @ForwardAuthCookies() on a guarded handler." });
+		return this.scope.run(derivedScope(this.scope, {
+			get cookies() {
+				return outer.view.cookies;
+			},
+			get inbound() {
+				return outer.view.inbound;
+			},
+			get internal() {
+				return outer.view.internal;
+			},
+			forward: "any"
+		}), fn);
+	}
+	withoutCookies(fn) {
+		const outer = this.scope.current();
+		return this.scope.run(derivedScope(this.scope, {
+			cookies: null,
+			forward: "none",
+			get inbound() {
+				return outer?.view.inbound;
+			},
+			get internal() {
+				return outer?.view.internal ?? false;
+			}
+		}), fn);
+	}
+	runOutsideScope(fn) {
+		return this.scope.exit(fn);
+	}
+};
+BetterAuthService = __decorate([
+	__decorateParam(0, Inject(getBetterAuthOptionsToken())),
+	__decorateParam(1, Inject(INSTANCE_REGISTRY)),
+	__decorateParam(2, Inject(REQUEST_SCOPE)),
+	__decorateParam(3, Inject(PRINCIPAL_READINGS)),
+	__decorateParam(4, Inject(ROUTE_PLANNER)),
+	__decorateParam(5, Inject(TRANSPORT_REGISTRY)),
+	__decorateParam(6, Inject(MOUNT_COORDINATOR)),
+	__decorateMetadata("design:paramtypes", [
+		Object,
+		Object,
+		Object,
+		Object,
+		Object,
+		Object,
+		Object
+	])
+], BetterAuthService);
+//#endregion
+//#region src/http-transport.ts
+let HttpTransport = class HttpTransport {
+	adapterHost;
+	id = "http";
+	constructor(adapterHost) {
+		this.adapterHost = adapterHost;
+	}
+	handles(context) {
+		return context.getType() === "http";
+	}
+	describe(context, kit) {
+		const http = context.switchToHttp();
+		const request = http.getRequest();
+		const response = http.getResponse();
+		const key = kit.http ? kit.http.key(request) : typeof request === "object" && request !== null ? request : context.getArgs();
+		const accessor = () => {
+			if (!kit.http) throw BetterAuthConfigurationError.atRequest("HTTP_PLATFORM_MISSING", "No HTTP platform is available for this request", { hint: "Register the HTTP platform that supports the application's adapter." });
+			return kit.http;
+		};
+		return {
+			key,
+			invocation: key,
+			headers: () => accessor().headers(request),
+			get clientIp() {
+				return accessor().clientIp(request);
+			},
+			get cookies() {
+				return accessor().cookieSink(request, response);
+			},
+			get request() {
+				return accessor().request(request);
+			},
+			param: (name) => accessor().param(request, name),
+			get browser() {
+				const info = accessor().request(request);
+				return {
+					enforce: ![
+						"GET",
+						"HEAD",
+						"OPTIONS"
+					].includes(info.method.toUpperCase()),
+					headers: () => accessor().headers(request),
+					url: info.url,
+					key
+				};
+			}
+		};
+	}
+	toException(failure, context) {
+		const adapter = this.adapterHost.httpAdapter;
+		const response = context.switchToHttp().getResponse();
+		if (adapter && response) {
+			if (failure.challenge) adapter.setHeader(response, "WWW-Authenticate", failure.challenge);
+			const retryAfter = failure.headers?.get("retry-after");
+			if (failure.status === 429 && retryAfter !== null && retryAfter !== void 0) adapter.setHeader(response, "Retry-After", retryAfter);
+		}
+		const body = {
+			statusCode: failure.status,
+			error: failure.status === 401 ? "Unauthorized" : failure.status === 403 ? "Forbidden" : "Too Many Requests",
+			code: failure.code,
+			...failure.reason ? { reason: failure.reason } : {},
+			message: failure.message
+		};
+		if (failure.status === 401) return new UnauthorizedException(body);
+		if (failure.status === 403) return new ForbiddenException(body);
+		return new HttpException(body, 429);
+	}
+	validate(context) {
+		class Probe {
+			route() {}
+		}
+		Get("/nsba-canary/:id")(Probe.prototype, "route", Object.getOwnPropertyDescriptor(Probe.prototype, "route"));
+		if (Reflect.getMetadata("path", Probe.prototype.route) !== "/nsba-canary/:id" || Reflect.getMetadata("method", Probe.prototype.route) !== RequestMethod.GET) throw new BetterAuthConfigurationError("NEST_METADATA_KEY_CHANGED", "Nest HTTP route metadata failed its path/method canary");
+		const scanner = new MetadataScanner();
+		for (const wrapper of context.discovery.getControllers()) {
+			const target = wrapper.metatype;
+			if (!target?.prototype || wrapper.isAlias) continue;
+			const controllerPaths = Reflect.getMetadata("path", target);
+			for (const method of scanner.getAllMethodNames(target.prototype)) {
+				const handler = target.prototype[method];
+				if (typeof handler !== "function" || Reflect.getMetadata("method", handler) === void 0) continue;
+				const paths = [controllerPaths, Reflect.getMetadata("path", handler)].flatMap((value) => typeof value === "string" ? [value] : Array.isArray(value) ? value.filter((item) => typeof item === "string") : []);
+				const inputs = [...new Set(paths.flatMap((path) => [...path.matchAll(/:([A-Za-z0-9_]+)/g)].map((match) => match[1])))];
+				context.claim(target, method, "global", {
+					code: "ROUTE_UNGUARDED",
+					inputs,
+					hint: "Register the global guard (globalGuard: true) or add @UseBetterAuth() to the controller."
+				});
+			}
+		}
+	}
+};
+HttpTransport = __decorate([__decorateParam(0, Inject(HttpAdapterHost)), __decorateMetadata("design:paramtypes", [typeof HttpAdapterHost === "undefined" ? Object : HttpAdapterHost])], HttpTransport);
+function httpTransport() {
+	return HttpTransport;
+}
+//#endregion
+//#region src/auth-module-definition.ts
+function defineExtension(definition) {
+	return {
+		...definition,
+		[EXTENSION_DEFINITION]: true
+	};
+}
+function defineHttpPlatform(platform) {
+	return platform;
+}
+function defineTransport(transport) {
+	return transport;
+}
+const STATIC_KEYS = [
+	"name",
+	"isGlobal",
+	"globalGuard",
+	"globalScope",
+	"principals",
+	"platforms",
+	"transports"
+];
+function moduleDefinition(module, definition, async) {
+	const name = definition.name || "default";
+	const providers = [];
+	const imports = [BetterAuthCoreModule];
+	const exports = [];
+	const registrationToken = Symbol(`registration:${name}`);
+	const staticOptions = {
+		name,
+		isGlobal: definition.isGlobal,
+		globalGuard: definition.globalGuard,
+		globalScope: definition.globalScope,
+		principals: definition.principals
+	};
+	const appOptions = {
+		platforms: definition.platforms,
+		transports: definition.transports
+	};
+	const optionsToken = getBetterAuthOptionsToken(name);
+	if (async) {
+		const factory = definition;
+		imports.push(...factory.imports ?? []);
+		providers.push({
+			provide: optionsToken,
+			inject: [...factory.inject ?? []],
+			useFactory: async (...deps) => {
+				const options = await factory.useFactory(...deps);
+				for (const key of STATIC_KEYS) if (Object.hasOwn(options, key)) throw new BetterAuthConfigurationError("STATIC_OPTION_IN_FACTORY", `'${key}' was returned from useFactory.`, `Pass '${key}' next to useFactory in forRootAsync().`);
+				return options;
+			}
+		});
+	} else {
+		const runtime = { ...definition };
+		for (const key of STATIC_KEYS) delete runtime[key];
+		providers.push({
+			provide: optionsToken,
+			useValue: runtime
+		});
+	}
+	function extensions(point, refs) {
+		return refs.map((ref, index) => {
+			const token = getExtensionToken(point, name, index);
+			if (typeof ref === "function") providers.push({
+				provide: token,
+				useClass: ref
+			});
+			else if (ref && typeof ref === "object" && Reflect.get(ref, EXTENSION_DEFINITION) === true) {
+				const definition = ref;
+				imports.push(...definition.imports ?? []);
+				providers.push(...definition.providers ?? []);
+				if ("useClass" in definition.use) providers.push({
+					provide: token,
+					useClass: definition.use.useClass
+				});
+				else if ("useExisting" in definition.use) providers.push({
+					provide: token,
+					useExisting: definition.use.useExisting
+				});
+				else providers.push({
+					provide: token,
+					useFactory: definition.use.useFactory,
+					inject: [...definition.use.inject ?? []]
+				});
+				exports.push(...definition.exports ?? []);
+			} else providers.push({
+				provide: token,
+				useValue: ref
+			});
+			return token;
+		});
+	}
+	const sourceTokens = extensions("principals", definition.principals ?? []);
+	providers.push({
+		provide: getPrincipalSourcesToken(name),
+		inject: [optionsToken, ...sourceTokens],
+		useFactory: (options, ...sources) => {
+			const builtIn = sessionPrincipal(options.session === false ? void 0 : options.session);
+			return options.session === false ? sources : [...sources, builtIn];
+		}
+	});
+	providers.push({
+		provide: registrationToken,
+		inject: [
+			INSTANCE_REGISTRY,
+			optionsToken,
+			getPrincipalSourcesToken(name)
+		],
+		useFactory: (registry, options, sources) => registry.register(options, staticOptions, sources, appOptions)
+	});
+	providers.push({
+		provide: getBetterAuthInstanceToken(name),
+		inject: [registrationToken],
+		useFactory: (registration) => registration.instance
+	});
+	providers.push({
+		provide: getBetterAuthHandleToken(name),
+		inject: [registrationToken],
+		useFactory: (registration) => registration.handle
+	});
+	const serviceProvider = {
+		provide: getBetterAuthServiceToken(name),
+		inject: [
+			registrationToken,
+			INSTANCE_REGISTRY,
+			REQUEST_SCOPE,
+			PRINCIPAL_READINGS,
+			ROUTE_PLANNER,
+			TRANSPORT_REGISTRY,
+			MOUNT_COORDINATOR
+		],
+		useFactory: (registration, registry, scope, readings, planner, transports, mounts) => new BetterAuthService(registration.options, registry, scope, readings, planner, transports, mounts)
+	};
+	if (name === "default") {
+		providers.push({
+			...serviceProvider,
+			provide: BetterAuthService
+		}, {
+			provide: getBetterAuthServiceToken(name),
+			useExisting: BetterAuthService
+		});
+		exports.push(BetterAuthService);
+		const platformTokens = extensions("platforms", definition.platforms ?? []);
+		const transportTokens = extensions("transports", [...definition.transports ?? [], httpTransport()]);
+		providers.push({
+			provide: PLATFORMS,
+			inject: [MOUNT_COORDINATOR, ...platformTokens],
+			useFactory: (mounts, ...platforms) => {
+				mounts.registerPlatforms(platforms);
+				return platforms;
+			}
+		});
+		providers.push({
+			provide: TRANSPORTS,
+			inject: [TRANSPORT_REGISTRY, ...transportTokens],
+			useFactory: (registry, ...transports) => {
+				registry.register(transports);
+				return transports;
+			}
+		});
+	} else providers.push(serviceProvider);
+	if (definition.globalGuard ?? name === "default") providers.push({
+		provide: APP_GUARD,
+		useExisting: BetterAuthGuard
+	});
+	if (name === "default" && (definition.globalScope ?? true)) providers.push({
+		provide: APP_INTERCEPTOR,
+		useExisting: BetterAuthScopeInterceptor
+	});
+	exports.push(optionsToken, getBetterAuthInstanceToken(name), getBetterAuthHandleToken(name), getBetterAuthServiceToken(name));
+	return {
+		module,
+		global: definition.isGlobal ?? true,
+		imports,
+		providers,
+		exports
+	};
+}
+//#endregion
+//#region src/auth-module.ts
+var _BetterAuthModule;
+let BetterAuthModule = _BetterAuthModule = class BetterAuthModule {
+	static forRoot(options) {
+		return moduleDefinition(_BetterAuthModule, options, false);
+	}
+	static forRootAsync(options) {
+		return moduleDefinition(_BetterAuthModule, options, true);
+	}
+};
+BetterAuthModule = _BetterAuthModule = __decorate([Module({})], BetterAuthModule);
+//#endregion
+export { AcceptPrincipals, AfterAuth, AfterDatabase, AuthFailures, BeforeAuth, BeforeDatabase, BetterAuthConfigurationError, BetterAuthGuard, BetterAuthInfrastructureError, BetterAuthModule, BetterAuthScopeInterceptor, BetterAuthService, CurrentPrincipal, CurrentSession, CurrentUser, EXTENSION_DEFINITION, ForwardAuthCookies, GUARD_CORE, OptionalAuth, POLICY_INVOKER, PRINCIPAL_RESOLVER, Public, Require, RequireAuth, RequireFreshSession, SCOPE_CORE, SESSION_PRINCIPAL_KIND, SkipDefaultRequirements, SkipOriginCheck, UseAuthInstance, UseBetterAuth, absent, allOf, allow, anyOf, authenticated, betterAuthCorsOrigin, defineExtension, defineHttpPlatform, defineInvocationParam, definePolicy, definePrincipalParam, definePrincipalSource, defineTransport, deny, freshSession, getBetterAuthHandleToken, getBetterAuthInstanceToken, getBetterAuthOptionsToken, getBetterAuthServiceToken, getRawCause, httpTransport, isAuthFailure, isConfigurationError, isInfrastructureError, rejected, requirement, sessionPrincipal };
+
+//# sourceMappingURL=index.mjs.map