nestjs-slightly-better-auth 1.0.0

package/dist/auth-decorators-CwW5JY4y.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-decorators-CwW5JY4y.cjs","names":["normalizeThrown","isConfigurationError","isInfrastructureError","createInfrastructureError","isAuthFailure","Injectable","Inject","BetterAuthConfigurationError","AuthFailures","isAuthFailure","isConfigurationError","isInfrastructureError","Injectable","Inject","Observable","AsyncLocalStorage","AuthFailures","isConfigurationError","IntrinsicException","BetterAuthConfigurationError","isConfigurationError","SetMetadata","tokens.ACCESS_METADATA","applyDecorators","tokens.FRESHNESS_METADATA","tokens.AUTH_INSTANCE_METADATA","tokens.ACCEPT_PRINCIPALS_METADATA","tokens.SKIP_DEFAULT_REQUIREMENTS_METADATA","tokens.FORWARD_COOKIES_METADATA","tokens.SKIP_ORIGIN_CHECK_METADATA","tokens.USE_BETTER_AUTH_METADATA","UseGuards","UseInterceptors","tokens.REQUIREMENTS_METADATA","tokens.READER_CONTEXT","createParamDecorator","BetterAuthConfigurationError","tokens.PRINCIPAL_PARAMS_METADATA","tokens.INVOCATION_VALUES","tokens.INVOCATION_PARAMS_METADATA","tokens.HOOK_METADATA","tokens.DB_HOOK_METADATA"],"sources":["../src/auth-tokens.ts","../src/principal-resolver.ts","../src/auth-guard.ts","../src/auth-scope-interceptor.ts","../src/request-scope.ts","../src/principal-readings.ts","../src/auth-decorators.ts"],"sourcesContent":["/** Stable Nest injection tokens shared by every package copy and module format. */\nfunction instanceToken(base: string, alias?: string): string {\n  return alias === undefined || alias === \"\" || alias === \"default\"\n    ? base\n    : `${base}_${alias}`;\n}\n\nexport function getBetterAuthInstanceToken(alias?: string): string {\n  return instanceToken(\"NESTJS_SLIGHTLY_BETTER_AUTH_INSTANCE\", alias);\n}\n\nexport function getBetterAuthOptionsToken(alias?: string): string {\n  return instanceToken(\"NESTJS_SLIGHTLY_BETTER_AUTH_OPTIONS\", alias);\n}\n\nexport function getBetterAuthServiceToken(alias?: string): string {\n  return instanceToken(\"NESTJS_SLIGHTLY_BETTER_AUTH_SERVICE\", alias);\n}\n\nexport function getBetterAuthHandleToken(alias?: string): string {\n  return instanceToken(\"NESTJS_SLIGHTLY_BETTER_AUTH_HANDLE\", alias);\n}\n\n// Shared application collaborators and metadata must also survive duplicate copies.\nexport const INSTANCE_REGISTRY = Symbol.for(\n  \"nestjs-slightly-better-auth:instance-registry\",\n);\nexport const REQUEST_SCOPE = Symbol.for(\n  \"nestjs-slightly-better-auth:request-scope\",\n);\nexport const PRINCIPAL_READINGS = Symbol.for(\n  \"nestjs-slightly-better-auth:principal-readings\",\n);\nexport const ROUTE_PLANNER = Symbol.for(\n  \"nestjs-slightly-better-auth:route-planner\",\n);\nexport const TRANSPORT_REGISTRY = Symbol.for(\n  \"nestjs-slightly-better-auth:transport-registry\",\n);\nexport const POLICY_RESOLVER = Symbol.for(\n  \"nestjs-slightly-better-auth:policy-resolver\",\n);\nexport const MOUNT_COORDINATOR = Symbol.for(\n  \"nestjs-slightly-better-auth:mount-coordinator\",\n);\nexport const GUARD_CORE = Symbol.for(\"nestjs-slightly-better-auth:guard-core\");\nexport const SCOPE_CORE = Symbol.for(\"nestjs-slightly-better-auth:scope-core\");\nexport const PRINCIPAL_RESOLVER = Symbol.for(\n  \"nestjs-slightly-better-auth:principal-resolver\",\n);\nexport const POLICY_INVOKER = Symbol.for(\n  \"nestjs-slightly-better-auth:policy-invoker\",\n);\nexport const PLATFORMS = Symbol.for(\"nestjs-slightly-better-auth:platforms\");\nexport const TRANSPORTS = Symbol.for(\"nestjs-slightly-better-auth:transports\");\nexport const ACCESS_METADATA = Symbol.for(\"nestjs-slightly-better-auth:access\");\nexport const ACCEPT_PRINCIPALS_METADATA = Symbol.for(\n  \"nestjs-slightly-better-auth:accept-principals\",\n);\nexport const REQUIREMENTS_METADATA = Symbol.for(\n  \"nestjs-slightly-better-auth:requirements\",\n);\nexport const SKIP_DEFAULT_REQUIREMENTS_METADATA = Symbol.for(\n  \"nestjs-slightly-better-auth:skip-default-requirements\",\n);\nexport const FRESHNESS_METADATA = Symbol.for(\n  \"nestjs-slightly-better-auth:freshness\",\n);\nexport const AUTH_INSTANCE_METADATA = Symbol.for(\n  \"nestjs-slightly-better-auth:auth-instance\",\n);\nexport const PRINCIPAL_PARAMS_METADATA = Symbol.for(\n  \"nestjs-slightly-better-auth:principal-params\",\n);\nexport const INVOCATION_PARAMS_METADATA = Symbol.for(\n  \"nestjs-slightly-better-auth:invocation-params\",\n);\nexport const FORWARD_COOKIES_METADATA = Symbol.for(\n  \"nestjs-slightly-better-auth:forward-cookies\",\n);\nexport const SKIP_ORIGIN_CHECK_METADATA = Symbol.for(\n  \"nestjs-slightly-better-auth:skip-origin-check\",\n);\nexport const USE_BETTER_AUTH_METADATA = Symbol.for(\n  \"nestjs-slightly-better-auth:use-better-auth\",\n);\nexport const HOOK_METADATA = Symbol.for(\"nestjs-slightly-better-auth:hook\");\nexport const DB_HOOK_METADATA = Symbol.for(\n  \"nestjs-slightly-better-auth:db-hook\",\n);\nexport const AUTH_ENHANCER = Symbol.for(\"nestjs-slightly-better-auth:enhancer\");\n\nexport function getPrincipalSourcesToken(instance: string): symbol {\n  return Symbol.for(\n    `nestjs-slightly-better-auth:principal-sources:${instance}`,\n  );\n}\n\nexport function getExtensionToken(\n  point: \"platforms\" | \"transports\" | \"principals\",\n  instance: string,\n  index: number,\n): symbol {\n  return Symbol.for(\n    `nestjs-slightly-better-auth:ext:${point}:${instance}:${index}`,\n  );\n}\n\nexport const READER_CONTEXT = Symbol.for(\n  \"nestjs-slightly-better-auth:reader-context\",\n);\nexport const INVOCATION_VALUES = Symbol.for(\n  \"nestjs-slightly-better-auth:invocation\",\n);\n","import type {\n  AuthPrincipalBase,\n  PrincipalResolver,\n  PrincipalResult,\n  PrincipalSource,\n  ResolutionRequest,\n  TransportCall,\n} from \"./auth-contracts.js\";\nimport {\n  type AuthFailure,\n  isAuthFailure,\n  normalizeThrown,\n  createInfrastructureError,\n  isConfigurationError,\n  isInfrastructureError,\n} from \"./auth-errors.js\";\nimport type { InstanceEntry, InstanceLookup } from \"./instance-registry.js\";\nimport type { TransportRegistry } from \"./transport-registry.js\";\nimport type { RequestScope } from \"./request-scope.js\";\n\nexport const definePrincipalSource = <P extends AuthPrincipalBase>(\n  source: PrincipalSource<P>,\n): PrincipalSource<P> => source;\nexport const authenticated = <P extends AuthPrincipalBase>(\n  principal: P,\n): PrincipalResult<P> => ({ outcome: \"authenticated\", principal });\nexport const absent = (): PrincipalResult<never> => ({ outcome: \"absent\" });\nexport const rejected = (failure: AuthFailure): PrincipalResult<never> => ({\n  outcome: \"rejected\",\n  failure,\n});\n\nexport class MemoKeys {\n  private readonly owners = new WeakMap<\n    object,\n    {\n      objects: WeakMap<object, number>;\n      symbols: Map<symbol, number>;\n      next: number;\n    }\n  >();\n\n  key(\n    owner: object,\n    namespace: string,\n    value: string | object | symbol,\n  ): string {\n    if (typeof value === \"string\") {\n      return JSON.stringify([namespace, \"string\", value]);\n    }\n    let identities = this.owners.get(owner);\n    if (!identities) {\n      identities = { objects: new WeakMap(), symbols: new Map(), next: 0 };\n      this.owners.set(owner, identities);\n    }\n    let id =\n      typeof value === \"symbol\"\n        ? identities.symbols.get(value)\n        : identities.objects.get(value);\n    if (id === undefined) {\n      id = ++identities.next;\n      if (typeof value === \"symbol\") {\n        identities.symbols.set(value, id);\n      } else {\n        identities.objects.set(value, id);\n      }\n    }\n    return JSON.stringify([namespace, typeof value, id]);\n  }\n}\nexport function requestHeaders(\n  call: TransportCall,\n  entry: InstanceEntry,\n): Headers {\n  const headers = new Headers(call.headers());\n  for (const name of [...headers.keys()]) {\n    if (\n      name.startsWith(\":\") ||\n      name.startsWith(\"x-nsba-ip-\") ||\n      name === entry.bridge.clientIpHeader\n    ) {\n      headers.delete(name);\n    }\n  }\n  if (entry.bridge.clientIpHeader && call.clientIp) {\n    headers.set(entry.bridge.clientIpHeader, call.clientIp);\n  }\n  return headers;\n}\nexport function normalizeForRequest(\n  error: unknown,\n  where: \"source\" | \"policy\",\n  site: string,\n  entry: InstanceEntry,\n  headers: Headers,\n) {\n  try {\n    return normalizeThrown(error, where, site, [], entry.options.errors);\n  } catch (normalized) {\n    if (\n      isConfigurationError(normalized) ||\n      (isInfrastructureError(error) && normalized === error)\n    ) {\n      throw normalized;\n    }\n    throw createInfrastructureError(error, {\n      headers,\n      credentialHeaders: entry.credentialHeaders,\n      exposeRawCause: entry.options.errors?.exposeRawCause,\n    });\n  }\n}\nexport class ChainPrincipalResolver implements PrincipalResolver {\n  private readonly keys = new MemoKeys();\n\n  constructor(\n    private readonly instances: InstanceLookup,\n    private readonly scope: RequestScope,\n    private readonly transports: TransportRegistry,\n  ) {}\n\n  resolve(\n    call: TransportCall,\n    request: ResolutionRequest,\n  ): Promise<PrincipalResult> {\n    const entry = this.instances.get(request.auth.name);\n    const compute = async (): Promise<PrincipalResult> => {\n      const headers = requestHeaders(call, entry);\n      const sources = request.reclassify\n        ? entry.sources.filter(\n            (source) =>\n              source.id === request.reclassify!.sourceId &&\n              source.sessionBacked,\n          )\n        : entry.sources.filter((source) =>\n            source.kinds.some((kind) => request.accepts.has(kind)),\n          );\n      return request.auth.run(\n        {\n          cookies: call.cookies,\n          forward: \"same-credential\",\n          inbound: () => headers,\n          internal: true,\n        },\n        async () => {\n          for (const source of sources) {\n            const input = {\n              headers,\n              cookies: call.cookies,\n              transport: this.transports.idOf(call),\n              request: call.request,\n              freshness: request.freshness,\n              auth: request.auth,\n              memo: <T>(\n                key: string | object | symbol,\n                fn: () => Promise<T>,\n              ): Promise<T> =>\n                this.scope.memoPolicyIo(\n                  call.key,\n                  entry.name,\n                  this.keys.key(call.key, `source:${source.id}`, key),\n                  fn,\n                  entry.options.limits?.maxAuthorizationCallsPerRequest,\n                ),\n            };\n            try {\n              if (source.appliesTo && !source.appliesTo(input)) {\n                continue;\n              }\n              const result = await source.resolve(input);\n              if (\n                result.outcome === \"authenticated\" &&\n                (!source.kinds.includes(result.principal.kind) ||\n                  result.principal.source !== source.id ||\n                  Boolean(result.principal.delegation) !==\n                    Boolean(source.delegates))\n              ) {\n                throw new Error(\n                  `Principal source ${source.id} violated its declared principal contract`,\n                );\n              }\n              if (result.outcome !== \"absent\") {\n                return result;\n              }\n            } catch (error) {\n              const failure = normalizeForRequest(\n                error,\n                \"source\",\n                source.id,\n                entry,\n                headers,\n              );\n              if (isAuthFailure(failure)) {\n                return rejected(failure);\n              }\n              throw error;\n            }\n          }\n          return absent();\n        },\n      );\n    };\n    return request.reclassify\n      ? compute()\n      : this.scope.memoPrincipal(\n          call,\n          {\n            instance: entry.name,\n            freshness: request.freshness,\n            sourceSet: request.sourceSet,\n          },\n          compute,\n        );\n  }\n}\n","import {\n  Inject,\n  Injectable,\n  type CanActivate,\n  type ExecutionContext,\n} from \"@nestjs/common\";\nimport type {\n  AuthTransport,\n  PrincipalResolver,\n  RoutePlan,\n  TransportCall,\n} from \"./auth-contracts.js\";\nimport {\n  AuthFailures,\n  BetterAuthConfigurationError,\n  isAuthFailure,\n  isConfigurationError,\n  isInfrastructureError,\n} from \"./auth-errors.js\";\nimport { AUTH_ENHANCER, GUARD_CORE } from \"./auth-tokens.js\";\nimport type { AuthorizationEvaluator } from \"./authorization-evaluator.js\";\nimport type { InstanceLookup } from \"./instance-registry.js\";\nimport type { PrincipalReadings } from \"./principal-readings.js\";\nimport type { RequestScope } from \"./request-scope.js\";\nimport type { RoutePlanner } from \"./route-planner.js\";\nimport type { TransportRegistry } from \"./transport-registry.js\";\n\n@Injectable()\nexport class BetterAuthGuard implements CanActivate {\n  static readonly [AUTH_ENHANCER] = \"guard\";\n  readonly [AUTH_ENHANCER] = \"guard\";\n\n  constructor(\n    @Inject(GUARD_CORE) private readonly core: Pick<GuardCore, \"canActivate\">,\n  ) {}\n\n  canActivate(context: ExecutionContext): Promise<boolean> {\n    return this.core.canActivate(context);\n  }\n}\nexport class GuardCore implements CanActivate {\n  constructor(\n    private readonly instances: InstanceLookup,\n    private readonly planner: RoutePlanner,\n    private readonly transports: TransportRegistry,\n    private readonly resolver: PrincipalResolver,\n    private readonly evaluator: AuthorizationEvaluator,\n    private readonly scope: RequestScope,\n    private readonly readings: PrincipalReadings,\n  ) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    let transport: AuthTransport | undefined;\n    let call: TransportCall | undefined;\n    let plan: RoutePlan | undefined;\n    try {\n      plan = this.planner.forContext(context);\n      if (plan.access === \"inherit\") {\n        transport = this.transports.find(context);\n        const lineage = transport?.lineage?.(context);\n        if (lineage && !this.readings.enclosing(lineage, context.getArgs())) {\n          call = this.transports.describe(context, transport);\n          throw BetterAuthConfigurationError.atRequest(\n            \"NO_ENCLOSING_DECISION\",\n            \"An inherited invocation has no enclosing guard decision\",\n            { site: plan.site },\n          );\n        }\n        if (plan.originCheck !== \"form\") {\n          return true;\n        }\n      }\n      if (plan.access === \"public\" && plan.originCheck !== \"form\") {\n        const lineage = this.transports.find(context)?.lineage?.(context);\n        if (lineage && !plan.nested) {\n          this.readings.recordLineage(lineage, {\n            outcome: \"no-identity\",\n            instance: plan.instance,\n          });\n        }\n        return true;\n      }\n      transport = this.transports.select(context);\n      call = this.transports.describe(context, transport);\n      const entry = this.instances.get(plan.instance);\n      if (plan.originCheck !== \"off\") {\n        const browser = call.browser;\n        if (browser) {\n          if (plan.originCheck === \"form\" || browser.enforce) {\n            const failure = await entry.origin.check(browser, plan.originCheck);\n            if (failure) {\n              throw failure;\n            }\n          } else {\n            await entry.origin.advisory(browser);\n          }\n        }\n      }\n      if (plan.access === \"inherit\") {\n        return true;\n      }\n      if (plan.access === \"public\") {\n        if (!plan.nested) {\n          this.readings.record(call, {\n            outcome: \"no-identity\",\n            instance: plan.instance,\n          });\n        }\n        return true;\n      }\n      const result = await this.resolver.resolve(call, {\n        auth: entry.handle,\n        freshness: plan.freshness,\n        accepts: plan.accepts,\n        sourceSet: plan.sourceSet,\n      });\n      this.readings.record(call, { ...result, instance: plan.instance });\n      if (result.outcome === \"rejected\") {\n        throw result.failure;\n      }\n      if (result.outcome === \"absent\") {\n        if (plan.access === \"optional\") {\n          return true;\n        }\n        throw AuthFailures.unauthenticated();\n      }\n      if (!plan.accepts.has(result.principal.kind)) {\n        throw AuthFailures.forbidden(\"PRINCIPAL_NOT_SUPPORTED\");\n      }\n      const decision = await this.evaluator.evaluate(\n        plan,\n        result.principal,\n        call,\n        entry,\n        context,\n        transport.id,\n      );\n      if (decision.effect === \"deny\") {\n        throw AuthFailures.rejected({\n          status: decision.status ?? 403,\n          reason: decision.reason,\n          message: decision.message,\n          challenge: decision.challenge,\n        });\n      }\n      return true;\n    } catch (error) {\n      if (isAuthFailure(error) && transport) {\n        const mapping =\n          plan && this.instances.get(plan.instance).options.errors?.map;\n        throw mapping\n          ? mapping(error, context, transport.id)\n          : transport.toException(error, context);\n      }\n      if (\n        (isConfigurationError(error) || isInfrastructureError(error)) &&\n        transport\n      ) {\n        const repeated = call\n          ? this.scope.surfaced(call.key, error, {\n              instance: plan?.instance ?? \"default\",\n              site: plan?.site ?? \"guard\",\n              lineage: call.lineage,\n            })\n          : false;\n        throw (\n          transport.toInternalException?.(error, context, { repeated }) ?? error\n        );\n      }\n      throw error;\n    }\n  }\n}\n","import {\n  Inject,\n  Injectable,\n  type CallHandler,\n  type ExecutionContext,\n  type NestInterceptor,\n} from \"@nestjs/common\";\nimport { Observable } from \"rxjs\";\nimport type { PrincipalReading, TransportCall } from \"./auth-contracts.js\";\nimport { AUTH_ENHANCER, READER_CONTEXT, SCOPE_CORE } from \"./auth-tokens.js\";\nimport type { ScopeView } from \"./bridge-protocol.js\";\nimport type { InstanceLookup } from \"./instance-registry.js\";\nimport type { PrincipalReadings } from \"./principal-readings.js\";\nimport { requestHeaders } from \"./principal-resolver.js\";\nimport type { RequestScope, ScopeState } from \"./request-scope.js\";\nimport type { RoutePlanner } from \"./route-planner.js\";\nimport type { TransportRegistry } from \"./transport-registry.js\";\n\n@Injectable()\nexport class BetterAuthScopeInterceptor implements NestInterceptor {\n  static readonly [AUTH_ENHANCER] = \"scope\";\n  readonly [AUTH_ENHANCER] = \"scope\";\n\n  constructor(\n    @Inject(SCOPE_CORE) private readonly core: Pick<ScopeCore, \"intercept\">,\n  ) {}\n\n  intercept(context: ExecutionContext, next: CallHandler): Observable<unknown> {\n    return this.core.intercept(context, next);\n  }\n}\nexport class ScopeCore implements NestInterceptor {\n  constructor(\n    private readonly instances: InstanceLookup,\n    private readonly planner: RoutePlanner,\n    private readonly transports: TransportRegistry,\n    private readonly scope: RequestScope,\n    private readonly readings: PrincipalReadings,\n  ) {}\n\n  intercept(context: ExecutionContext, next: CallHandler): Observable<unknown> {\n    const plan = this.planner.forContext(context);\n    const entry = this.instances.get(plan.instance);\n    let described = false;\n    let call: TransportCall | undefined;\n    const getCall = (): TransportCall | undefined => {\n      if (!described) {\n        const transport = this.transports.find(context);\n        call = transport\n          ? this.transports.describe(context, transport)\n          : undefined;\n        described = true;\n      }\n      return call;\n    };\n    let reading: PrincipalReading | undefined;\n    const read = (): PrincipalReading => {\n      if (reading) {\n        return reading;\n      }\n      const lineage = this.transports.find(context)?.lineage?.(context);\n      reading = this.readings.read({\n        args: context.getArgs(),\n        plan,\n        lineage,\n        ...(plan.access === \"public\" || plan.access === \"inherit\"\n          ? {}\n          : { call: getCall() }),\n      });\n      return reading;\n    };\n    const instances = this.instances;\n    const view: ScopeView = {\n      get cookies() {\n        return getCall()?.cookies ?? null;\n      },\n      forward: plan.forwardDirectCalls ? \"same-credential\" : \"none\",\n      internal: false,\n      get inbound() {\n        return () => {\n          const call = getCall();\n          return call ? requestHeaders(call, entry) : new Headers();\n        };\n      },\n      get browserHeaders() {\n        const browser = getCall()?.browser;\n        return browser ? () => browser.headers() : undefined;\n      },\n      get checkCallerSession() {\n        if (plan.originCheck === \"off\") {\n          return undefined;\n        }\n        const browser = getCall()?.browser;\n        return browser\n          ? (path: string, instance: string) =>\n              instances\n                .get(instance)\n                .origin.assertCallerSession(browser, path, instance)\n          : undefined;\n      },\n    };\n    const state: ScopeState = {\n      view,\n      plan,\n      reading: read,\n      get call() {\n        return getCall();\n      },\n    };\n    const args = context.getArgs();\n    const bridge = {\n      args: [...args],\n      reading: read,\n      scope: this.scope,\n      readings: this.readings,\n    };\n    for (const arg of [args, ...args]) {\n      if (\n        arg &&\n        (typeof arg === \"object\" || typeof arg === \"function\") &&\n        Object.isExtensible(arg)\n      ) {\n        Object.defineProperty(arg, READER_CONTEXT, {\n          value: bridge,\n          configurable: true,\n        });\n      }\n    }\n    return new Observable((subscriber) =>\n      this.scope.run(state, () => {\n        const subscription = next.handle().subscribe({\n          next: (value) => this.scope.run(state, () => subscriber.next(value)),\n          error: (error) =>\n            this.scope.run(state, () => subscriber.error(error)),\n          complete: () => this.scope.run(state, () => subscriber.complete()),\n        });\n        return () => this.scope.run(state, () => subscription.unsubscribe());\n      }),\n    );\n  }\n}\n","import { AsyncLocalStorage } from \"node:async_hooks\";\nimport type {\n  AuthorizationDecision,\n  InvocationLineage,\n  PrincipalReading,\n  PrincipalResult,\n  RoutePlan,\n  TransportCall,\n} from \"./auth-contracts.js\";\nimport {\n  AuthFailures,\n  type AuthFailure,\n  isConfigurationError,\n} from \"./auth-errors.js\";\nimport type { ScopeView } from \"./bridge-protocol.js\";\n\nexport interface ScopeState {\n  readonly view: ScopeView;\n  readonly call?: TransportCall;\n  readonly plan?: RoutePlan;\n  readonly reading?: () => PrincipalReading;\n}\nexport interface RequestState {\n  readonly principal: Map<string, Promise<PrincipalResult>>;\n  readonly policyIo: Map<string, Promise<unknown>>;\n  readonly decisions: Map<string, Promise<AuthorizationDecision>>;\n  readonly values: Map<symbol, unknown>;\n  readonly authorizationCalls: Set<string>;\n  readonly origins: Map<string, Promise<AuthFailure | null>>;\n  readonly surfaced: Set<string>;\n  readonly connections: Map<\n    string,\n    {\n      value: Extract<PrincipalResult, { outcome: \"authenticated\" | \"absent\" }>;\n      expiresAt: number;\n    }\n  >;\n}\n\nconst SURFACED = Symbol.for(\"nestjs-slightly-better-auth:surfaced\");\nexport function memoKey(\n  instance: string,\n  ...inputs: readonly unknown[]\n): string {\n  return JSON.stringify([instance, ...inputs]);\n}\n\n/** Shared by guards and readers that have only the transport's structural lineage. */\nexport function surfacedRecord(\n  key: object,\n  lineage?: InvocationLineage,\n): Set<string> {\n  const carrier = lineage?.carrier ?? key;\n  const partition = lineage ? lineage.position.split(\":\", 1)[0]! : \"\";\n  let records = Reflect.get(carrier, SURFACED) as\n    | Map<string, Set<string>>\n    | undefined;\n  if (!records) {\n    records = new Map();\n    Object.defineProperty(carrier, SURFACED, { value: records });\n  }\n  let record = records.get(partition);\n  if (!record) {\n    record = new Set();\n    records.set(partition, record);\n  }\n  return record;\n}\n\nexport class RequestScope {\n  readonly #storage = new AsyncLocalStorage<ScopeState>();\n  readonly #states = new WeakMap<object, RequestState>();\n  readonly #valueKeys = new Map<string, Map<symbol, symbol>>();\n  readonly #errorIds = new WeakMap<object, number>();\n  #nextError = 0;\n\n  run<T>(state: ScopeState, fn: () => T): T {\n    return this.#storage.run(state, fn);\n  }\n\n  exit<T>(fn: () => T): T {\n    return this.#storage.exit(fn);\n  }\n\n  current(): ScopeState | undefined {\n    return this.#storage.getStore();\n  }\n\n  stateFor(key: object): RequestState {\n    let state = this.#states.get(key);\n    if (!state) {\n      state = {\n        principal: new Map(),\n        policyIo: new Map(),\n        decisions: new Map(),\n        values: new Map(),\n        authorizationCalls: new Set(),\n        origins: new Map(),\n        surfaced: new Set(),\n        connections: new Map(),\n      };\n      this.#states.set(key, state);\n    }\n    return state;\n  }\n\n  memoPrincipal(\n    call: Pick<TransportCall, \"key\" | \"connection\" | \"principalTtlMs\">,\n    input: {\n      instance: string;\n      freshness: \"default\" | \"authoritative\";\n      sourceSet: string;\n    },\n    compute: () => Promise<PrincipalResult>,\n  ): Promise<PrincipalResult> {\n    const key = memoKey(input.instance, input.freshness, input.sourceSet);\n    const state = this.stateFor(call.key);\n    const existing = state.principal.get(key);\n    if (existing) {\n      return existing;\n    }\n    const connection =\n      call.connection &&\n      input.freshness !== \"authoritative\" &&\n      (call.principalTtlMs ?? 0) > 0\n        ? this.stateFor(call.connection).connections\n        : undefined;\n    const cached = connection?.get(key);\n    const promise = Promise.resolve().then(async () => {\n      if (cached && cached.expiresAt > Date.now()) {\n        return cached.value;\n      }\n      connection?.delete(key);\n      try {\n        const value = await compute();\n        if (value.outcome !== \"rejected\") {\n          connection?.set(key, {\n            value,\n            expiresAt: Date.now() + (call.principalTtlMs ?? 0),\n          });\n        }\n        return value;\n      } catch (error) {\n        connection?.delete(key);\n        throw error;\n      }\n    });\n    state.principal.set(key, promise);\n    return promise;\n  }\n\n  memoPolicyIo<T>(\n    request: object,\n    instance: string,\n    concreteKey: string,\n    compute: () => Promise<T>,\n    limit: number | false = 100,\n  ): Promise<T> {\n    const state = this.stateFor(request);\n    const key = memoKey(instance, concreteKey);\n    const existing = state.policyIo.get(key);\n    if (existing) {\n      return existing as Promise<T>;\n    }\n    if (\n      limit !== false &&\n      [...state.authorizationCalls].filter(\n        (entry) => JSON.parse(entry)[0] === instance,\n      ).length >= limit\n    ) {\n      return Promise.reject(\n        AuthFailures.rejected({\n          status: 429,\n          reason: \"TOO_MANY_AUTHORIZATION_CHECKS\",\n        }),\n      );\n    }\n    state.authorizationCalls.add(key);\n    const promise = Promise.resolve().then(compute);\n    state.policyIo.set(key, promise);\n    return promise;\n  }\n\n  memoDecision(\n    invocation: object,\n    instance: string,\n    concreteKey: string,\n    compute: () => Promise<AuthorizationDecision>,\n  ): Promise<AuthorizationDecision> {\n    const decisions = this.stateFor(invocation).decisions;\n    const key = memoKey(instance, concreteKey);\n    let promise = decisions.get(key);\n    if (!promise) {\n      promise = Promise.resolve().then(compute);\n      decisions.set(key, promise);\n    }\n    return promise;\n  }\n\n  valueKey(instance: string, key: symbol): symbol {\n    let keys = this.#valueKeys.get(instance);\n    if (!keys) {\n      keys = new Map();\n      this.#valueKeys.set(instance, keys);\n    }\n    let namespaced = keys.get(key);\n    if (!namespaced) {\n      namespaced = Symbol(key.description);\n      keys.set(key, namespaced);\n    }\n    return namespaced;\n  }\n\n  surfaced(\n    key: object,\n    error: object,\n    context: { instance: string; site: string; lineage?: InvocationLineage },\n  ): boolean {\n    let id = this.#errorIds.get(error);\n    if (!id) {\n      id = ++this.#nextError;\n      this.#errorIds.set(error, id);\n    }\n    const reason = isConfigurationError(error)\n      ? memoKey(context.instance, error.code, context.site)\n      : `error:${id}`;\n    const carrier = surfacedRecord(key, context.lineage);\n    const state =\n      key === context.lineage?.carrier ? carrier : this.stateFor(key).surfaced;\n    const repeated = state.has(reason) || carrier.has(reason);\n    state.add(reason);\n    carrier.add(reason);\n    return repeated;\n  }\n}\n","import { IntrinsicException } from \"@nestjs/common/exceptions/intrinsic.exception.js\";\nimport type {\n  InvocationLineage,\n  PrincipalReading,\n  PrincipalResult,\n  RoutePlan,\n  TransportCall,\n} from \"./auth-contracts.js\";\nimport {\n  BetterAuthConfigurationError,\n  isConfigurationError,\n} from \"./auth-errors.js\";\nimport type { AuthPrincipal } from \"./auth-types.js\";\nimport { RequestScope } from \"./request-scope.js\";\n\nconst RESOLUTION = Symbol.for(\"nestjs-slightly-better-auth:resolution\");\nconst TEST_STAMP = Symbol.for(\"nestjs-slightly-better-auth:test-stamp\");\ninterface Records {\n  own: Map<string, PrincipalReading>;\n  positions: Map<string, PrincipalReading>;\n  lineage?: InvocationLineage;\n  invocationLineage?: InvocationLineage;\n}\ninterface TestStamp {\n  elements: readonly unknown[];\n  results: Map<string, PrincipalResult>;\n}\nexport interface ReadingInput {\n  readonly args: readonly unknown[];\n  readonly call?: TransportCall;\n  readonly lineage?: InvocationLineage;\n  readonly plan?: Pick<RoutePlan, \"access\" | \"instance\" | \"site\">;\n  readonly beforeGuard?: boolean;\n  readonly site?: string;\n}\n\nfunction object(value: unknown): value is object {\n  return (\n    value !== null && (typeof value === \"object\" || typeof value === \"function\")\n  );\n}\nfunction records(target: object, create = false): Records | undefined {\n  let value = Reflect.get(target, RESOLUTION) as Records | undefined;\n  if (!value && create) {\n    value = { own: new Map(), positions: new Map() };\n    Object.defineProperty(target, RESOLUTION, { value });\n  }\n  return value;\n}\nfunction matchingStamp(args: readonly unknown[]): TestStamp | undefined {\n  for (const target of [args, ...args]) {\n    if (!object(target)) {\n      continue;\n    }\n    const stamp = Reflect.get(target, TEST_STAMP) as TestStamp | undefined;\n    if (\n      stamp &&\n      stamp.elements.length === args.length &&\n      stamp.elements.every((value, index) => value === args[index])\n    ) {\n      return stamp;\n    }\n  }\n  return undefined;\n}\n\nfunction lineageFromArgs(\n  args: readonly unknown[],\n): InvocationLineage | undefined {\n  const targets = [args, ...args.filter(object)];\n  for (const target of targets) {\n    const own = records(target)?.invocationLineage;\n    if (own) {\n      return own;\n    }\n  }\n  for (const target of targets) {\n    const carrier = records(target)?.lineage;\n    if (!carrier) {\n      continue;\n    }\n    // The recorded callback is structural, but its recorded position may belong\n    // to a sibling operation in the same batched GraphQL carrier.\n    for (const position of carrier.enclosing(args)) {\n      return { ...carrier, position };\n    }\n  }\n  return undefined;\n}\n\n/** The intrinsic twin suppresses Nest's repeated log, while retaining the safe wire shape. */\nexport class RepeatedReaderError extends IntrinsicException {\n  constructor(error: BetterAuthConfigurationError) {\n    super(error.message);\n    Object.defineProperties(this, Object.getOwnPropertyDescriptors(error));\n  }\n}\n\nexport class PrincipalReadings {\n  constructor(private readonly scope: RequestScope) {}\n\n  record(\n    call: Pick<TransportCall, \"invocation\" | \"lineage\">,\n    reading: PrincipalReading,\n  ): void {\n    const record = records(call.invocation, true)!;\n    record.own.set(reading.instance, reading);\n    if (call.lineage) {\n      record.invocationLineage = call.lineage;\n      this.recordLineage(call.lineage, reading);\n    }\n  }\n\n  recordLineage(lineage: InvocationLineage, reading: PrincipalReading): void {\n    const value = records(lineage.carrier, true)!;\n    value.positions.set(lineage.position, reading);\n    value.lineage = lineage;\n  }\n\n  enclosing(\n    lineage: InvocationLineage,\n    args: readonly unknown[],\n  ): PrincipalReading | undefined {\n    const positions = records(lineage.carrier)?.positions;\n    for (const position of lineage.enclosing(args)) {\n      const reading = positions?.get(position);\n      if (reading) {\n        return reading;\n      }\n    }\n    return undefined;\n  }\n\n  read(input: ReadingInput): PrincipalReading {\n    const { plan, args, call } = input;\n    const lineage = input.lineage ?? call?.lineage;\n    let resolvedInstance = plan?.instance;\n    try {\n      if (plan?.access === \"public\") {\n        return { outcome: \"no-identity\", instance: plan.instance };\n      }\n      let reading: PrincipalReading | undefined;\n      let validation = lineage ?? lineageFromArgs(args);\n      if (plan?.access === \"inherit\") {\n        reading = lineage && this.enclosing(lineage, args);\n      } else {\n        const targets = call\n          ? [call.invocation]\n          : [args, ...args.filter(object)];\n        for (const target of targets) {\n          const own = records(target)?.own;\n          reading = plan\n            ? own?.get(plan.instance)\n            : own?.size === 1\n              ? own.values().next().value\n              : undefined;\n          if (reading) {\n            break;\n          }\n        }\n        if (!reading && !plan) {\n          for (const target of [args, ...args.filter(object)]) {\n            const candidate = records(target)?.lineage;\n            if (!candidate) {\n              continue;\n            }\n            reading = this.enclosing(candidate, args);\n            if (reading) {\n              validation = candidate;\n              break;\n            }\n          }\n        }\n      }\n      if (!reading) {\n        const stamp = matchingStamp(args);\n        const instance = plan?.instance ?? \"default\";\n        const result = stamp?.results.get(instance);\n        if (result) {\n          reading = { ...result, instance };\n        }\n      }\n      if (!reading) {\n        throw BetterAuthConfigurationError.atRequest(\n          input.beforeGuard && plan?.access !== \"inherit\"\n            ? \"PRINCIPAL_READ_BEFORE_GUARD\"\n            : \"NO_AUTH_RESULT\",\n          \"No authentication result: BetterAuthGuard did not run for this invocation\",\n          {\n            site: plan?.site ?? input.site,\n            hint: \"Run BetterAuthGuard before reading a principal; test replacements must stampPrincipal().\",\n          },\n        );\n      }\n      resolvedInstance = reading.instance;\n      if (reading.outcome === \"authenticated\") {\n        validation?.assertReadable?.(args);\n      }\n      return reading;\n    } catch (error) {\n      if (isConfigurationError(error)) {\n        throw this.deliver(error, input, resolvedInstance);\n      }\n      throw error;\n    }\n  }\n\n  current(): PrincipalReading {\n    const state = this.scope.current();\n    if (!state?.reading) {\n      throw BetterAuthConfigurationError.atRequest(\n        \"NO_AUTH_SCOPE\",\n        \"Principal readers require a handler scope\",\n      );\n    }\n    return state.reading();\n  }\n\n  project<T>(\n    reading: PrincipalReading,\n    spec: {\n      kind?: string;\n      reason?: string;\n      site: string;\n      project: (principal: AuthPrincipal) => T;\n    },\n    input?: ReadingInput,\n  ): T | null {\n    if (reading.outcome === \"no-identity\" || reading.outcome === \"absent\") {\n      return null;\n    }\n    if (reading.outcome === \"rejected\") {\n      throw reading.failure;\n    }\n    if (spec.kind && reading.principal.kind !== spec.kind) {\n      const error = BetterAuthConfigurationError.atRequest(\n        spec.reason ?? \"PRINCIPAL_KIND_REQUIRED\",\n        `This reader requires principal kind ${spec.kind}`,\n        {\n          site: spec.site,\n          hint: \"Use @CurrentPrincipal() or getPrincipal() and narrow p.kind.\",\n        },\n      );\n      throw this.deliver(error, input, reading.instance);\n    }\n    return spec.project(reading.principal);\n  }\n\n  deliver(\n    error: BetterAuthConfigurationError,\n    input?: ReadingInput,\n    instance?: string,\n  ): BetterAuthConfigurationError | RepeatedReaderError {\n    const state = this.scope.current();\n    const call = state?.call ?? input?.call;\n    const lineage =\n      call?.lineage ?? input?.lineage ?? (input && lineageFromArgs(input.args));\n    const key = call?.key ?? lineage?.carrier ?? input?.args;\n    if (!key) {\n      return error;\n    }\n    const repeated = this.scope.surfaced(key, error, {\n      instance:\n        instance ?? state?.plan?.instance ?? input?.plan?.instance ?? \"default\",\n      site:\n        error.site ?? input?.site ?? input?.plan?.site ?? \"principal reader\",\n      lineage,\n    });\n    return repeated ? new RepeatedReaderError(error) : error;\n  }\n\n  stamp(\n    args: readonly unknown[],\n    instance: string,\n    result: PrincipalResult,\n  ): void {\n    const stamp = matchingStamp(args) ?? {\n      elements: [...args],\n      results: new Map(),\n    };\n    stamp.results.set(instance, result);\n    for (const target of [args, ...args]) {\n      if (object(target) && Object.isExtensible(target)) {\n        Object.defineProperty(target, TEST_STAMP, {\n          value: stamp,\n          configurable: true,\n        });\n      }\n    }\n  }\n}\n","import {\n  applyDecorators,\n  createParamDecorator,\n  SetMetadata,\n  UseGuards,\n  UseInterceptors,\n  type ExecutionContext,\n} from \"@nestjs/common\";\nimport type {\n  DatabaseHookTarget,\n  DbHookMethodDecorator,\n  DbHookOptions,\n  HookMethodDecorator,\n  HookOptions,\n  HookPredicate,\n  PolicyRef,\n  PrincipalReading,\n  Requirement,\n  RequirementExpr,\n  RequirementOptions,\n} from \"./auth-contracts.js\";\nimport type {\n  EndpointPath,\n  PrincipalKind,\n  PrincipalOfKind,\n} from \"./auth-types.js\";\nimport { BetterAuthConfigurationError } from \"./auth-errors.js\";\nimport * as tokens from \"./auth-tokens.js\";\nimport { BetterAuthGuard } from \"./auth-guard.js\";\nimport { BetterAuthScopeInterceptor } from \"./auth-scope-interceptor.js\";\nimport { PrincipalReadings } from \"./principal-readings.js\";\nimport { RequestScope } from \"./request-scope.js\";\n\nfunction append(target: object, key: symbol, value: unknown): void {\n  Reflect.defineMetadata(\n    key,\n    Object.freeze([...(Reflect.getOwnMetadata(key, target) ?? []), value]),\n    target,\n  );\n}\nexport const Public = () => SetMetadata(tokens.ACCESS_METADATA, \"public\");\nexport const OptionalAuth = () =>\n  SetMetadata(tokens.ACCESS_METADATA, \"optional\");\nexport const RequireAuth = (options?: { authoritative?: boolean }) =>\n  applyDecorators(\n    SetMetadata(tokens.ACCESS_METADATA, \"required\"),\n    SetMetadata(tokens.FRESHNESS_METADATA, options?.authoritative === true),\n  );\nexport const UseAuthInstance = (name: string) =>\n  SetMetadata(tokens.AUTH_INSTANCE_METADATA, name);\nexport const AcceptPrincipals = (\n  ...kinds: readonly [PrincipalKind, ...PrincipalKind[]]\n) => SetMetadata(tokens.ACCEPT_PRINCIPALS_METADATA, Object.freeze([...kinds]));\nexport const SkipDefaultRequirements = () =>\n  SetMetadata(tokens.SKIP_DEFAULT_REQUIREMENTS_METADATA, true);\nexport const ForwardAuthCookies = (enabled = true) =>\n  SetMetadata(tokens.FORWARD_COOKIES_METADATA, enabled);\nexport const SkipOriginCheck = () =>\n  SetMetadata(tokens.SKIP_ORIGIN_CHECK_METADATA, true);\nexport const UseBetterAuth = () =>\n  applyDecorators(\n    SetMetadata(tokens.USE_BETTER_AUTH_METADATA, true),\n    UseGuards(BetterAuthGuard),\n    UseInterceptors(BetterAuthScopeInterceptor),\n  );\nexport function Require(\n  ...requirements: readonly RequirementExpr[]\n): ClassDecorator & MethodDecorator {\n  return (\n    target: object,\n    _key?: string | symbol,\n    descriptor?: PropertyDescriptor,\n  ) => {\n    for (const expression of requirements) {\n      append(\n        descriptor?.value ?? target,\n        tokens.REQUIREMENTS_METADATA,\n        expression,\n      );\n    }\n  };\n}\nexport const anyOf = (\n  ...requirements: readonly RequirementExpr[]\n): RequirementExpr => ({ anyOf: requirements });\nexport const allOf = (\n  ...requirements: readonly RequirementExpr[]\n): RequirementExpr => ({ allOf: requirements });\nexport const requirement = <P>(\n  policy: PolicyRef<P>,\n  params: P,\n  options?: RequirementOptions,\n): Requirement<P> => ({ policy, params, ...options });\n\nexport interface ReaderContext {\n  readonly args: readonly unknown[];\n  readonly readings: PrincipalReadings;\n  readonly scope: RequestScope;\n  readonly reading?: () => PrincipalReading;\n}\nexport function readerContext(context: ExecutionContext): ReaderContext {\n  const args = context.getArgs();\n  for (const arg of [args, ...args]) {\n    if (\n      (typeof arg !== \"object\" || arg === null) &&\n      typeof arg !== \"function\"\n    ) {\n      continue;\n    }\n    const bridge = Reflect.get(arg, tokens.READER_CONTEXT) as\n      | ReaderContext\n      | undefined;\n    if (\n      bridge &&\n      bridge.args.length === args.length &&\n      bridge.args.every((value, index) => value === args[index]) &&\n      bridge.reading !== undefined &&\n      bridge.scope.current()?.reading === bridge.reading\n    ) {\n      return bridge;\n    }\n  }\n  // No application state is created or retained by a DI-free lineage-only reader.\n  const scope = new RequestScope();\n  return { args, scope, readings: new PrincipalReadings(scope) };\n}\nfunction principalParam(spec?: {\n  kind: string;\n  reason: string;\n  project: (p: any) => unknown;\n}): ParameterDecorator {\n  const decorator = createParamDecorator(\n    (_data: unknown, context: ExecutionContext) => {\n      const bridge = readerContext(context);\n      const input = {\n        args: context.getArgs(),\n        site: `${context.getClass().name}.${context.getHandler().name}`,\n      };\n      const reading =\n        bridge.reading !== undefined &&\n        bridge.scope.current()?.reading === bridge.reading\n          ? bridge.readings.current()\n          : bridge.readings.read(input);\n      return bridge.readings.project(\n        reading,\n        { ...spec, site: input.site, project: spec?.project ?? ((p) => p) },\n        input,\n      );\n    },\n  )();\n  return (target, propertyKey, index) => {\n    if (propertyKey === undefined) {\n      throw new BetterAuthConfigurationError(\n        \"PRINCIPAL_PARAM_TARGET\",\n        \"Principal parameters require a handler method\",\n      );\n    }\n    const handler = Reflect.get(target, propertyKey);\n    append(handler, tokens.PRINCIPAL_PARAMS_METADATA, {\n      index,\n      ...(spec ? { kind: spec.kind, reason: spec.reason } : {}),\n    });\n    decorator(target, propertyKey, index);\n  };\n}\nexport const CurrentPrincipal = (): ParameterDecorator => principalParam();\nexport function definePrincipalParam<K extends PrincipalKind, R>(spec: {\n  readonly kind: K;\n  readonly reason: string;\n  readonly project: (principal: PrincipalOfKind<K>) => R;\n}): () => ParameterDecorator {\n  return () => principalParam(spec);\n}\nexport function defineInvocationParam(\n  slot: symbol,\n  spec: { readonly missing: string },\n): () => ParameterDecorator {\n  return () => {\n    const decorator = createParamDecorator(\n      (_data: unknown, context: ExecutionContext) => {\n        const bridge = readerContext(context);\n        const state = bridge.scope.current();\n        const input = {\n          args: context.getArgs(),\n          site: `${context.getClass().name}.${context.getHandler().name}`,\n        };\n        const reading = state?.reading\n          ? bridge.readings.current()\n          : bridge.readings.read(input);\n        const candidates = state?.call\n          ? [state.call.invocation]\n          : [input.args, ...input.args];\n        for (const candidate of candidates) {\n          if (\n            !candidate ||\n            (typeof candidate !== \"object\" && typeof candidate !== \"function\")\n          ) {\n            continue;\n          }\n          const values = Reflect.get(candidate, tokens.INVOCATION_VALUES) as\n            | Map<string, Map<symbol, unknown>>\n            | undefined;\n          if (values?.get(reading.instance)?.has(slot)) {\n            return values.get(reading.instance)!.get(slot);\n          }\n        }\n        throw bridge.readings.deliver(\n          BetterAuthConfigurationError.atRequest(\n            \"NO_INVOCATION_VALUE\",\n            spec.missing,\n            { site: input.site },\n          ),\n          input,\n          reading.instance,\n        );\n      },\n    )();\n    return (target, key, index) => {\n      if (key === undefined) {\n        throw new BetterAuthConfigurationError(\n          \"INVOCATION_PARAM_TARGET\",\n          \"Invocation parameters require a handler method\",\n        );\n      }\n      append(Reflect.get(target, key), tokens.INVOCATION_PARAMS_METADATA, {\n        index,\n        slot,\n        missing: spec.missing,\n      });\n      decorator(target, key, index);\n    };\n  };\n}\nexport interface EndpointHookDeclaration {\n  readonly phase: \"before\" | \"after\";\n  readonly match: string | readonly string[] | HookPredicate | undefined;\n  readonly options: Readonly<HookOptions>;\n  readonly method: string | symbol;\n  // biome-ignore lint/complexity/noBannedTypes: Nest handler metadata preserves the framework function identity.\n  readonly handler: Function;\n  readonly declarationOrder: number;\n}\nexport interface DatabaseHookDeclaration {\n  readonly phase: \"before\" | \"after\";\n  readonly target: DatabaseHookTarget;\n  readonly options: Readonly<DbHookOptions>;\n  readonly method: string | symbol;\n  // biome-ignore lint/complexity/noBannedTypes: Nest handler metadata preserves the framework function identity.\n  readonly handler: Function;\n  readonly declarationOrder: number;\n}\n// biome-ignore lint/complexity/noBannedTypes: Nest handler metadata preserves the framework function identity.\nexport function readHookMetadata(handler: Function): {\n  readonly hooks: readonly EndpointHookDeclaration[];\n  readonly databaseHooks: readonly DatabaseHookDeclaration[];\n} {\n  return {\n    hooks: Reflect.getOwnMetadata(tokens.HOOK_METADATA, handler) ?? [],\n    databaseHooks:\n      Reflect.getOwnMetadata(tokens.DB_HOOK_METADATA, handler) ?? [],\n  };\n}\nfunction hook<P extends string>(\n  phase: \"before\" | \"after\",\n  match?: P | readonly P[] | HookPredicate,\n  options?: HookOptions,\n): HookMethodDecorator<P> {\n  return (_target, method, descriptor) => {\n    const handler = descriptor.value!;\n    const records = readHookMetadata(handler).hooks;\n    append(\n      handler,\n      tokens.HOOK_METADATA,\n      Object.freeze({\n        phase,\n        match: Array.isArray(match) ? Object.freeze([...match]) : match,\n        options: Object.freeze({ ...options }),\n        method,\n        handler,\n        declarationOrder: records.length,\n      }),\n    );\n  };\n}\nexport const BeforeAuth = <const P extends EndpointPath | (string & {})>(\n  match?: P | readonly P[] | HookPredicate,\n  options?: HookOptions,\n): HookMethodDecorator<P> => hook(\"before\", match, options);\nexport const AfterAuth = <const P extends EndpointPath | (string & {})>(\n  match?: P | readonly P[] | HookPredicate,\n  options?: HookOptions,\n): HookMethodDecorator<P> => hook(\"after\", match, options);\nfunction databaseHook<\n  E extends DatabaseHookTarget,\n  Ph extends \"before\" | \"after\",\n>(phase: Ph, target: E, options?: DbHookOptions): DbHookMethodDecorator<E, Ph> {\n  return (_prototype, method, descriptor) => {\n    const handler = descriptor.value!;\n    append(\n      handler,\n      tokens.DB_HOOK_METADATA,\n      Object.freeze({\n        phase,\n        target,\n        options: Object.freeze({ ...options }),\n        method,\n        handler,\n        declarationOrder: readHookMetadata(handler).databaseHooks.length,\n      }),\n    );\n  };\n}\nexport const BeforeDatabase = <E extends DatabaseHookTarget>(\n  target: E,\n  options?: DbHookOptions,\n): DbHookMethodDecorator<E, \"before\"> =>\n  databaseHook(\"before\", target, options);\nexport const AfterDatabase = <E extends DatabaseHookTarget>(\n  target: E,\n  options?: DbHookOptions,\n): DbHookMethodDecorator<E, \"after\"> => databaseHook(\"after\", target, options);\n"],"mappings":";;;;;;;AACA,SAAS,cAAc,MAAc,OAAwB;CAC3D,OAAO,UAAU,KAAA,KAAa,UAAU,MAAM,UAAU,YACpD,OACA,GAAG,KAAK,GAAG;AACjB;AAEA,SAAgB,2BAA2B,OAAwB;CACjE,OAAO,cAAc,wCAAwC,KAAK;AACpE;AAEA,SAAgB,0BAA0B,OAAwB;CAChE,OAAO,cAAc,uCAAuC,KAAK;AACnE;AAEA,SAAgB,0BAA0B,OAAwB;CAChE,OAAO,cAAc,uCAAuC,KAAK;AACnE;AAEA,SAAgB,yBAAyB,OAAwB;CAC/D,OAAO,cAAc,sCAAsC,KAAK;AAClE;AAGA,MAAa,oBAAoB,OAAO,IACtC,+CACF;AACA,MAAa,gBAAgB,OAAO,IAClC,2CACF;AACA,MAAa,qBAAqB,OAAO,IACvC,gDACF;AACA,MAAa,gBAAgB,OAAO,IAClC,2CACF;AACA,MAAa,qBAAqB,OAAO,IACvC,gDACF;AACA,MAAa,kBAAkB,OAAO,IACpC,6CACF;AACA,MAAa,oBAAoB,OAAO,IACtC,+CACF;AACA,MAAa,aAAa,OAAO,IAAI,wCAAwC;AAC7E,MAAa,aAAa,OAAO,IAAI,wCAAwC;AAC7E,MAAa,qBAAqB,OAAO,IACvC,gDACF;AACA,MAAa,iBAAiB,OAAO,IACnC,4CACF;AACA,MAAa,YAAY,OAAO,IAAI,uCAAuC;AAC3E,MAAa,aAAa,OAAO,IAAI,wCAAwC;AAC7E,MAAa,kBAAkB,OAAO,IAAI,oCAAoC;AAC9E,MAAa,6BAA6B,OAAO,IAC/C,+CACF;AACA,MAAa,wBAAwB,OAAO,IAC1C,0CACF;AACA,MAAa,qCAAqC,OAAO,IACvD,uDACF;AACA,MAAa,qBAAqB,OAAO,IACvC,uCACF;AACA,MAAa,yBAAyB,OAAO,IAC3C,2CACF;AACA,MAAa,4BAA4B,OAAO,IAC9C,8CACF;AACA,MAAa,6BAA6B,OAAO,IAC/C,+CACF;AACA,MAAa,2BAA2B,OAAO,IAC7C,6CACF;AACA,MAAa,6BAA6B,OAAO,IAC/C,+CACF;AACA,MAAa,2BAA2B,OAAO,IAC7C,6CACF;AACA,MAAa,gBAAgB,OAAO,IAAI,kCAAkC;AAC1E,MAAa,mBAAmB,OAAO,IACrC,qCACF;AACA,MAAa,gBAAgB,OAAO,IAAI,sCAAsC;AAE9E,SAAgB,yBAAyB,UAA0B;CACjE,OAAO,OAAO,IACZ,iDAAiD,UACnD;AACF;AAEA,SAAgB,kBACd,OACA,UACA,OACQ;CACR,OAAO,OAAO,IACZ,mCAAmC,MAAM,GAAG,SAAS,GAAG,OAC1D;AACF;AAEA,MAAa,iBAAiB,OAAO,IACnC,4CACF;AACA,MAAa,oBAAoB,OAAO,IACtC,wCACF;;;AC7FA,MAAa,yBACX,WACuB;AACzB,MAAa,iBACX,eACwB;CAAE,SAAS;CAAiB;AAAU;AAChE,MAAa,gBAAwC,EAAE,SAAS,SAAS;AACzE,MAAa,YAAY,aAAkD;CACzE,SAAS;CACT;AACF;AAEA,IAAa,WAAb,MAAsB;CACpB,yBAA0B,IAAI,QAO5B;CAEF,IACE,OACA,WACA,OACQ;EACR,IAAI,OAAO,UAAU,UACnB,OAAO,KAAK,UAAU;GAAC;GAAW;GAAU;EAAK,CAAC;EAEpD,IAAI,aAAa,KAAK,OAAO,IAAI,KAAK;EACtC,IAAI,CAAC,YAAY;GACf,aAAa;IAAE,yBAAS,IAAI,QAAQ;IAAG,yBAAS,IAAI,IAAI;IAAG,MAAM;GAAE;GACnE,KAAK,OAAO,IAAI,OAAO,UAAU;EACnC;EACA,IAAI,KACF,OAAO,UAAU,WACb,WAAW,QAAQ,IAAI,KAAK,IAC5B,WAAW,QAAQ,IAAI,KAAK;EAClC,IAAI,OAAO,KAAA,GAAW;GACpB,KAAK,EAAE,WAAW;GAClB,IAAI,OAAO,UAAU,UACnB,WAAW,QAAQ,IAAI,OAAO,EAAE;QAEhC,WAAW,QAAQ,IAAI,OAAO,EAAE;EAEpC;EACA,OAAO,KAAK,UAAU;GAAC;GAAW,OAAO;GAAO;EAAE,CAAC;CACrD;AACF;AACA,SAAgB,eACd,MACA,OACS;CACT,MAAM,UAAU,IAAI,QAAQ,KAAK,QAAQ,CAAC;CAC1C,KAAK,MAAM,QAAQ,CAAC,GAAG,QAAQ,KAAK,CAAC,GACnC,IACE,KAAK,WAAW,GAAG,KACnB,KAAK,WAAW,YAAY,KAC5B,SAAS,MAAM,OAAO,gBAEtB,QAAQ,OAAO,IAAI;CAGvB,IAAI,MAAM,OAAO,kBAAkB,KAAK,UACtC,QAAQ,IAAI,MAAM,OAAO,gBAAgB,KAAK,QAAQ;CAExD,OAAO;AACT;AACA,SAAgB,oBACd,OACA,OACA,MACA,OACA,SACA;CACA,IAAI;EACF,OAAOA,oBAAAA,gBAAgB,OAAO,OAAO,MAAM,CAAC,GAAG,MAAM,QAAQ,MAAM;CACrE,SAAS,YAAY;EACnB,IACEC,oBAAAA,qBAAqB,UAAU,KAC9BC,oBAAAA,sBAAsB,KAAK,KAAK,eAAe,OAEhD,MAAM;EAER,MAAMC,oBAAAA,0BAA0B,OAAO;GACrC;GACA,mBAAmB,MAAM;GACzB,gBAAgB,MAAM,QAAQ,QAAQ;EACxC,CAAC;CACH;AACF;AACA,IAAa,yBAAb,MAAiE;CAI5C;CACA;CACA;CALnB,OAAwB,IAAI,SAAS;CAErC,YACE,WACA,OACA,YACA;EAHiB,KAAA,YAAA;EACA,KAAA,QAAA;EACA,KAAA,aAAA;CAChB;CAEH,QACE,MACA,SAC0B;EAC1B,MAAM,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,IAAI;EAClD,MAAM,UAAU,YAAsC;GACpD,MAAM,UAAU,eAAe,MAAM,KAAK;GAC1C,MAAM,UAAU,QAAQ,aACpB,MAAM,QAAQ,QACX,WACC,OAAO,OAAO,QAAQ,WAAY,YAClC,OAAO,aACX,IACA,MAAM,QAAQ,QAAQ,WACpB,OAAO,MAAM,MAAM,SAAS,QAAQ,QAAQ,IAAI,IAAI,CAAC,CACvD;GACJ,OAAO,QAAQ,KAAK,IAClB;IACE,SAAS,KAAK;IACd,SAAS;IACT,eAAe;IACf,UAAU;GACZ,GACA,YAAY;IACV,KAAK,MAAM,UAAU,SAAS;KAC5B,MAAM,QAAQ;MACZ;MACA,SAAS,KAAK;MACd,WAAW,KAAK,WAAW,KAAK,IAAI;MACpC,SAAS,KAAK;MACd,WAAW,QAAQ;MACnB,MAAM,QAAQ;MACd,OACE,KACA,OAEA,KAAK,MAAM,aACT,KAAK,KACL,MAAM,MACN,KAAK,KAAK,IAAI,KAAK,KAAK,UAAU,OAAO,MAAM,GAAG,GAClD,IACA,MAAM,QAAQ,QAAQ,+BACxB;KACJ;KACA,IAAI;MACF,IAAI,OAAO,aAAa,CAAC,OAAO,UAAU,KAAK,GAC7C;MAEF,MAAM,SAAS,MAAM,OAAO,QAAQ,KAAK;MACzC,IACE,OAAO,YAAY,oBAClB,CAAC,OAAO,MAAM,SAAS,OAAO,UAAU,IAAI,KAC3C,OAAO,UAAU,WAAW,OAAO,MACnC,QAAQ,OAAO,UAAU,UAAU,MACjC,QAAQ,OAAO,SAAS,IAE5B,MAAM,IAAI,MACR,oBAAoB,OAAO,GAAG,0CAChC;MAEF,IAAI,OAAO,YAAY,UACrB,OAAO;KAEX,SAAS,OAAO;MACd,MAAM,UAAU,oBACd,OACA,UACA,OAAO,IACP,OACA,OACF;MACA,IAAIC,oBAAAA,cAAc,OAAO,GACvB,OAAO,SAAS,OAAO;MAEzB,MAAM;KACR;IACF;IACA,OAAO,OAAO;GAChB,CACF;EACF;EACA,OAAO,QAAQ,aACX,QAAQ,IACR,KAAK,MAAM,cACT,MACA;GACE,UAAU,MAAM;GAChB,WAAW,QAAQ;GACnB,WAAW,QAAQ;EACrB,GACA,OACF;CACN;AACF;;;;;;;;;;;;;;;;;;;;;;;AC1LO,IAAM,kBAAN,MAAM,gBAAuC;CAKX;CAJvC,QAAiB,iBAAiB;CAClC,CAAU,iBAAiB;CAE3B,YACE,MACA;EADqC,KAAA,OAAA;CACpC;CAEH,YAAY,SAA6C;EACvD,OAAO,KAAK,KAAK,YAAY,OAAO;CACtC;AACF;;EAZCC,GAAAA,eAAAA,WAAAA,CAAW;CAMPC,gBAAAA,IAAAA,GAAAA,eAAAA,OAAAA,CAAO,UAAU,CAAA;;;AAOtB,IAAa,YAAb,MAA8C;CAEzB;CACA;CACA;CACA;CACA;CACA;CACA;CAPnB,YACE,WACA,SACA,YACA,UACA,WACA,OACA,UACA;EAPiB,KAAA,YAAA;EACA,KAAA,UAAA;EACA,KAAA,aAAA;EACA,KAAA,WAAA;EACA,KAAA,YAAA;EACA,KAAA,QAAA;EACA,KAAA,WAAA;CAChB;CAEH,MAAM,YAAY,SAA6C;EAC7D,IAAI;EACJ,IAAI;EACJ,IAAI;EACJ,IAAI;GACF,OAAO,KAAK,QAAQ,WAAW,OAAO;GACtC,IAAI,KAAK,WAAW,WAAW;IAC7B,YAAY,KAAK,WAAW,KAAK,OAAO;IACxC,MAAM,UAAU,WAAW,UAAU,OAAO;IAC5C,IAAI,WAAW,CAAC,KAAK,SAAS,UAAU,SAAS,QAAQ,QAAQ,CAAC,GAAG;KACnE,OAAO,KAAK,WAAW,SAAS,SAAS,SAAS;KAClD,MAAMC,oBAAAA,6BAA6B,UACjC,yBACA,2DACA,EAAE,MAAM,KAAK,KAAK,CACpB;IACF;IACA,IAAI,KAAK,gBAAgB,QACvB,OAAO;GAEX;GACA,IAAI,KAAK,WAAW,YAAY,KAAK,gBAAgB,QAAQ;IAC3D,MAAM,UAAU,KAAK,WAAW,KAAK,OAAO,CAAC,EAAE,UAAU,OAAO;IAChE,IAAI,WAAW,CAAC,KAAK,QACnB,KAAK,SAAS,cAAc,SAAS;KACnC,SAAS;KACT,UAAU,KAAK;IACjB,CAAC;IAEH,OAAO;GACT;GACA,YAAY,KAAK,WAAW,OAAO,OAAO;GAC1C,OAAO,KAAK,WAAW,SAAS,SAAS,SAAS;GAClD,MAAM,QAAQ,KAAK,UAAU,IAAI,KAAK,QAAQ;GAC9C,IAAI,KAAK,gBAAgB,OAAO;IAC9B,MAAM,UAAU,KAAK;IACrB,IAAI,SAAS;KACX,IAAI,KAAK,gBAAgB,UAAU,QAAQ,SAAS;MAClD,MAAM,UAAU,MAAM,MAAM,OAAO,MAAM,SAAS,KAAK,WAAW;MAClE,IAAI,SACF,MAAM;KAEV,OACE,MAAM,MAAM,OAAO,SAAS,OAAO;IAEvC;GACF;GACA,IAAI,KAAK,WAAW,WAClB,OAAO;GAET,IAAI,KAAK,WAAW,UAAU;IAC5B,IAAI,CAAC,KAAK,QACR,KAAK,SAAS,OAAO,MAAM;KACzB,SAAS;KACT,UAAU,KAAK;IACjB,CAAC;IAEH,OAAO;GACT;GACA,MAAM,SAAS,MAAM,KAAK,SAAS,QAAQ,MAAM;IAC/C,MAAM,MAAM;IACZ,WAAW,KAAK;IAChB,SAAS,KAAK;IACd,WAAW,KAAK;GAClB,CAAC;GACD,KAAK,SAAS,OAAO,MAAM;IAAE,GAAG;IAAQ,UAAU,KAAK;GAAS,CAAC;GACjE,IAAI,OAAO,YAAY,YACrB,MAAM,OAAO;GAEf,IAAI,OAAO,YAAY,UAAU;IAC/B,IAAI,KAAK,WAAW,YAClB,OAAO;IAET,MAAMC,oBAAAA,aAAa,gBAAgB;GACrC;GACA,IAAI,CAAC,KAAK,QAAQ,IAAI,OAAO,UAAU,IAAI,GACzC,MAAMA,oBAAAA,aAAa,UAAU,yBAAyB;GAExD,MAAM,WAAW,MAAM,KAAK,UAAU,SACpC,MACA,OAAO,WACP,MACA,OACA,SACA,UAAU,EACZ;GACA,IAAI,SAAS,WAAW,QACtB,MAAMA,oBAAAA,aAAa,SAAS;IAC1B,QAAQ,SAAS,UAAU;IAC3B,QAAQ,SAAS;IACjB,SAAS,SAAS;IAClB,WAAW,SAAS;GACtB,CAAC;GAEH,OAAO;EACT,SAAS,OAAO;GACd,IAAIC,oBAAAA,cAAc,KAAK,KAAK,WAAW;IACrC,MAAM,UACJ,QAAQ,KAAK,UAAU,IAAI,KAAK,QAAQ,CAAC,CAAC,QAAQ,QAAQ;IAC5D,MAAM,UACF,QAAQ,OAAO,SAAS,UAAU,EAAE,IACpC,UAAU,YAAY,OAAO,OAAO;GAC1C;GACA,KACGC,oBAAAA,qBAAqB,KAAK,KAAKC,oBAAAA,sBAAsB,KAAK,MAC3D,WACA;IACA,MAAM,WAAW,OACb,KAAK,MAAM,SAAS,KAAK,KAAK,OAAO;KACnC,UAAU,MAAM,YAAY;KAC5B,MAAM,MAAM,QAAQ;KACpB,SAAS,KAAK;IAChB,CAAC,IACD;IACJ,MACE,UAAU,sBAAsB,OAAO,SAAS,EAAE,SAAS,CAAC,KAAK;GAErE;GACA,MAAM;EACR;CACF;AACF;;;ACzJO,IAAM,6BAAN,MAAM,2BAAsD;CAK1B;CAJvC,QAAiB,iBAAiB;CAClC,CAAU,iBAAiB;CAE3B,YACE,MACA;EADqC,KAAA,OAAA;CACpC;CAEH,UAAU,SAA2B,MAAwC;EAC3E,OAAO,KAAK,KAAK,UAAU,SAAS,IAAI;CAC1C;AACF;;EAZCC,GAAAA,eAAAA,WAAAA,CAAW;CAMPC,gBAAAA,IAAAA,GAAAA,eAAAA,OAAAA,CAAO,UAAU,CAAA;;;AAOtB,IAAa,YAAb,MAAkD;CAE7B;CACA;CACA;CACA;CACA;CALnB,YACE,WACA,SACA,YACA,OACA,UACA;EALiB,KAAA,YAAA;EACA,KAAA,UAAA;EACA,KAAA,aAAA;EACA,KAAA,QAAA;EACA,KAAA,WAAA;CAChB;CAEH,UAAU,SAA2B,MAAwC;EAC3E,MAAM,OAAO,KAAK,QAAQ,WAAW,OAAO;EAC5C,MAAM,QAAQ,KAAK,UAAU,IAAI,KAAK,QAAQ;EAC9C,IAAI,YAAY;EAChB,IAAI;EACJ,MAAM,gBAA2C;GAC/C,IAAI,CAAC,WAAW;IACd,MAAM,YAAY,KAAK,WAAW,KAAK,OAAO;IAC9C,OAAO,YACH,KAAK,WAAW,SAAS,SAAS,SAAS,IAC3C,KAAA;IACJ,YAAY;GACd;GACA,OAAO;EACT;EACA,IAAI;EACJ,MAAM,aAA+B;GACnC,IAAI,SACF,OAAO;GAET,MAAM,UAAU,KAAK,WAAW,KAAK,OAAO,CAAC,EAAE,UAAU,OAAO;GAChE,UAAU,KAAK,SAAS,KAAK;IAC3B,MAAM,QAAQ,QAAQ;IACtB;IACA;IACA,GAAI,KAAK,WAAW,YAAY,KAAK,WAAW,YAC5C,CAAC,IACD,EAAE,MAAM,QAAQ,EAAE;GACxB,CAAC;GACD,OAAO;EACT;EACA,MAAM,YAAY,KAAK;EA8BvB,MAAM,QAAoB;GACxB,MAAA;IA7BA,IAAI,UAAU;KACZ,OAAO,QAAQ,CAAC,EAAE,WAAW;IAC/B;IACA,SAAS,KAAK,qBAAqB,oBAAoB;IACvD,UAAU;IACV,IAAI,UAAU;KACZ,aAAa;MACX,MAAM,OAAO,QAAQ;MACrB,OAAO,OAAO,eAAe,MAAM,KAAK,IAAI,IAAI,QAAQ;KAC1D;IACF;IACA,IAAI,iBAAiB;KACnB,MAAM,UAAU,QAAQ,CAAC,EAAE;KAC3B,OAAO,gBAAgB,QAAQ,QAAQ,IAAI,KAAA;IAC7C;IACA,IAAI,qBAAqB;KACvB,IAAI,KAAK,gBAAgB,OACvB;KAEF,MAAM,UAAU,QAAQ,CAAC,EAAE;KAC3B,OAAO,WACF,MAAc,aACb,UACG,IAAI,QAAQ,CAAC,CACb,OAAO,oBAAoB,SAAS,MAAM,QAAQ,IACvD,KAAA;IACN;GAGG;GACH;GACA,SAAS;GACT,IAAI,OAAO;IACT,OAAO,QAAQ;GACjB;EACF;EACA,MAAM,OAAO,QAAQ,QAAQ;EAC7B,MAAM,SAAS;GACb,MAAM,CAAC,GAAG,IAAI;GACd,SAAS;GACT,OAAO,KAAK;GACZ,UAAU,KAAK;EACjB;EACA,KAAK,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,GAC9B,IACE,QACC,OAAO,QAAQ,YAAY,OAAO,QAAQ,eAC3C,OAAO,aAAa,GAAG,GAEvB,OAAO,eAAe,KAAK,gBAAgB;GACzC,OAAO;GACP,cAAc;EAChB,CAAC;EAGL,OAAO,IAAIC,KAAAA,YAAY,eACrB,KAAK,MAAM,IAAI,aAAa;GAC1B,MAAM,eAAe,KAAK,OAAO,CAAC,CAAC,UAAU;IAC3C,OAAO,UAAU,KAAK,MAAM,IAAI,aAAa,WAAW,KAAK,KAAK,CAAC;IACnE,QAAQ,UACN,KAAK,MAAM,IAAI,aAAa,WAAW,MAAM,KAAK,CAAC;IACrD,gBAAgB,KAAK,MAAM,IAAI,aAAa,WAAW,SAAS,CAAC;GACnE,CAAC;GACD,aAAa,KAAK,MAAM,IAAI,aAAa,aAAa,YAAY,CAAC;EACrE,CAAC,CACH;CACF;AACF;;;ACrGA,MAAM,WAAW,OAAO,IAAI,sCAAsC;AAClE,SAAgB,QACd,UACA,GAAG,QACK;CACR,OAAO,KAAK,UAAU,CAAC,UAAU,GAAG,MAAM,CAAC;AAC7C;;AAGA,SAAgB,eACd,KACA,SACa;CACb,MAAM,UAAU,SAAS,WAAW;CACpC,MAAM,YAAY,UAAU,QAAQ,SAAS,MAAM,KAAK,CAAC,CAAC,CAAC,KAAM;CACjE,IAAI,UAAU,QAAQ,IAAI,SAAS,QAAQ;CAG3C,IAAI,CAAC,SAAS;EACZ,0BAAU,IAAI,IAAI;EAClB,OAAO,eAAe,SAAS,UAAU,EAAE,OAAO,QAAQ,CAAC;CAC7D;CACA,IAAI,SAAS,QAAQ,IAAI,SAAS;CAClC,IAAI,CAAC,QAAQ;EACX,yBAAS,IAAI,IAAI;EACjB,QAAQ,IAAI,WAAW,MAAM;CAC/B;CACA,OAAO;AACT;AAEA,IAAa,eAAb,MAA0B;CACxB,WAAoB,IAAIC,iBAAAA,kBAA8B;CACtD,0BAAmB,IAAI,QAA8B;CACrD,6BAAsB,IAAI,IAAiC;CAC3D,4BAAqB,IAAI,QAAwB;CACjD,aAAa;CAEb,IAAO,OAAmB,IAAgB;EACxC,OAAO,KAAK,SAAS,IAAI,OAAO,EAAE;CACpC;CAEA,KAAQ,IAAgB;EACtB,OAAO,KAAK,SAAS,KAAK,EAAE;CAC9B;CAEA,UAAkC;EAChC,OAAO,KAAK,SAAS,SAAS;CAChC;CAEA,SAAS,KAA2B;EAClC,IAAI,QAAQ,KAAK,QAAQ,IAAI,GAAG;EAChC,IAAI,CAAC,OAAO;GACV,QAAQ;IACN,2BAAW,IAAI,IAAI;IACnB,0BAAU,IAAI,IAAI;IAClB,2BAAW,IAAI,IAAI;IACnB,wBAAQ,IAAI,IAAI;IAChB,oCAAoB,IAAI,IAAI;IAC5B,yBAAS,IAAI,IAAI;IACjB,0BAAU,IAAI,IAAI;IAClB,6BAAa,IAAI,IAAI;GACvB;GACA,KAAK,QAAQ,IAAI,KAAK,KAAK;EAC7B;EACA,OAAO;CACT;CAEA,cACE,MACA,OAKA,SAC0B;EAC1B,MAAM,MAAM,QAAQ,MAAM,UAAU,MAAM,WAAW,MAAM,SAAS;EACpE,MAAM,QAAQ,KAAK,SAAS,KAAK,GAAG;EACpC,MAAM,WAAW,MAAM,UAAU,IAAI,GAAG;EACxC,IAAI,UACF,OAAO;EAET,MAAM,aACJ,KAAK,cACL,MAAM,cAAc,oBACnB,KAAK,kBAAkB,KAAK,IACzB,KAAK,SAAS,KAAK,UAAU,CAAC,CAAC,cAC/B,KAAA;EACN,MAAM,SAAS,YAAY,IAAI,GAAG;EAClC,MAAM,UAAU,QAAQ,QAAQ,CAAC,CAAC,KAAK,YAAY;GACjD,IAAI,UAAU,OAAO,YAAY,KAAK,IAAI,GACxC,OAAO,OAAO;GAEhB,YAAY,OAAO,GAAG;GACtB,IAAI;IACF,MAAM,QAAQ,MAAM,QAAQ;IAC5B,IAAI,MAAM,YAAY,YACpB,YAAY,IAAI,KAAK;KACnB;KACA,WAAW,KAAK,IAAI,KAAK,KAAK,kBAAkB;IAClD,CAAC;IAEH,OAAO;GACT,SAAS,OAAO;IACd,YAAY,OAAO,GAAG;IACtB,MAAM;GACR;EACF,CAAC;EACD,MAAM,UAAU,IAAI,KAAK,OAAO;EAChC,OAAO;CACT;CAEA,aACE,SACA,UACA,aACA,SACA,QAAwB,KACZ;EACZ,MAAM,QAAQ,KAAK,SAAS,OAAO;EACnC,MAAM,MAAM,QAAQ,UAAU,WAAW;EACzC,MAAM,WAAW,MAAM,SAAS,IAAI,GAAG;EACvC,IAAI,UACF,OAAO;EAET,IACE,UAAU,SACV,CAAC,GAAG,MAAM,kBAAkB,CAAC,CAAC,QAC3B,UAAU,KAAK,MAAM,KAAK,CAAC,CAAC,OAAO,QACtC,CAAC,CAAC,UAAU,OAEZ,OAAO,QAAQ,OACbC,oBAAAA,aAAa,SAAS;GACpB,QAAQ;GACR,QAAQ;EACV,CAAC,CACH;EAEF,MAAM,mBAAmB,IAAI,GAAG;EAChC,MAAM,UAAU,QAAQ,QAAQ,CAAC,CAAC,KAAK,OAAO;EAC9C,MAAM,SAAS,IAAI,KAAK,OAAO;EAC/B,OAAO;CACT;CAEA,aACE,YACA,UACA,aACA,SACgC;EAChC,MAAM,YAAY,KAAK,SAAS,UAAU,CAAC,CAAC;EAC5C,MAAM,MAAM,QAAQ,UAAU,WAAW;EACzC,IAAI,UAAU,UAAU,IAAI,GAAG;EAC/B,IAAI,CAAC,SAAS;GACZ,UAAU,QAAQ,QAAQ,CAAC,CAAC,KAAK,OAAO;GACxC,UAAU,IAAI,KAAK,OAAO;EAC5B;EACA,OAAO;CACT;CAEA,SAAS,UAAkB,KAAqB;EAC9C,IAAI,OAAO,KAAK,WAAW,IAAI,QAAQ;EACvC,IAAI,CAAC,MAAM;GACT,uBAAO,IAAI,IAAI;GACf,KAAK,WAAW,IAAI,UAAU,IAAI;EACpC;EACA,IAAI,aAAa,KAAK,IAAI,GAAG;EAC7B,IAAI,CAAC,YAAY;GACf,aAAa,OAAO,IAAI,WAAW;GACnC,KAAK,IAAI,KAAK,UAAU;EAC1B;EACA,OAAO;CACT;CAEA,SACE,KACA,OACA,SACS;EACT,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK;EACjC,IAAI,CAAC,IAAI;GACP,KAAK,EAAE,KAAK;GACZ,KAAK,UAAU,IAAI,OAAO,EAAE;EAC9B;EACA,MAAM,SAASC,oBAAAA,qBAAqB,KAAK,IACrC,QAAQ,QAAQ,UAAU,MAAM,MAAM,QAAQ,IAAI,IAClD,SAAS;EACb,MAAM,UAAU,eAAe,KAAK,QAAQ,OAAO;EACnD,MAAM,QACJ,QAAQ,QAAQ,SAAS,UAAU,UAAU,KAAK,SAAS,GAAG,CAAC,CAAC;EAClE,MAAM,WAAW,MAAM,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM;EACxD,MAAM,IAAI,MAAM;EAChB,QAAQ,IAAI,MAAM;EAClB,OAAO;CACT;AACF;;;AC3NA,MAAM,aAAa,OAAO,IAAI,wCAAwC;AACtE,MAAM,aAAa,OAAO,IAAI,wCAAwC;AAoBtE,SAAS,OAAO,OAAiC;CAC/C,OACE,UAAU,SAAS,OAAO,UAAU,YAAY,OAAO,UAAU;AAErE;AACA,SAAS,QAAQ,QAAgB,SAAS,OAA4B;CACpE,IAAI,QAAQ,QAAQ,IAAI,QAAQ,UAAU;CAC1C,IAAI,CAAC,SAAS,QAAQ;EACpB,QAAQ;GAAE,qBAAK,IAAI,IAAI;GAAG,2BAAW,IAAI,IAAI;EAAE;EAC/C,OAAO,eAAe,QAAQ,YAAY,EAAE,MAAM,CAAC;CACrD;CACA,OAAO;AACT;AACA,SAAS,cAAc,MAAiD;CACtE,KAAK,MAAM,UAAU,CAAC,MAAM,GAAG,IAAI,GAAG;EACpC,IAAI,CAAC,OAAO,MAAM,GAChB;EAEF,MAAM,QAAQ,QAAQ,IAAI,QAAQ,UAAU;EAC5C,IACE,SACA,MAAM,SAAS,WAAW,KAAK,UAC/B,MAAM,SAAS,OAAO,OAAO,UAAU,UAAU,KAAK,MAAM,GAE5D,OAAO;CAEX;AAEF;AAEA,SAAS,gBACP,MAC+B;CAC/B,MAAM,UAAU,CAAC,MAAM,GAAG,KAAK,OAAO,MAAM,CAAC;CAC7C,KAAK,MAAM,UAAU,SAAS;EAC5B,MAAM,MAAM,QAAQ,MAAM,CAAC,EAAE;EAC7B,IAAI,KACF,OAAO;CAEX;CACA,KAAK,MAAM,UAAU,SAAS;EAC5B,MAAM,UAAU,QAAQ,MAAM,CAAC,EAAE;EACjC,IAAI,CAAC,SACH;EAIF,KAAK,MAAM,YAAY,QAAQ,UAAU,IAAI,GAC3C,OAAO;GAAE,GAAG;GAAS;EAAS;CAElC;AAEF;;AAGA,IAAa,sBAAb,cAAyCC,iDAAAA,mBAAmB;CAC1D,YAAY,OAAqC;EAC/C,MAAM,MAAM,OAAO;EACnB,OAAO,iBAAiB,MAAM,OAAO,0BAA0B,KAAK,CAAC;CACvE;AACF;AAEA,IAAa,oBAAb,MAA+B;CACA;CAA7B,YAAY,OAAsC;EAArB,KAAA,QAAA;CAAsB;CAEnD,OACE,MACA,SACM;EACN,MAAM,SAAS,QAAQ,KAAK,YAAY,IAAI;EAC5C,OAAO,IAAI,IAAI,QAAQ,UAAU,OAAO;EACxC,IAAI,KAAK,SAAS;GAChB,OAAO,oBAAoB,KAAK;GAChC,KAAK,cAAc,KAAK,SAAS,OAAO;EAC1C;CACF;CAEA,cAAc,SAA4B,SAAiC;EACzE,MAAM,QAAQ,QAAQ,QAAQ,SAAS,IAAI;EAC3C,MAAM,UAAU,IAAI,QAAQ,UAAU,OAAO;EAC7C,MAAM,UAAU;CAClB;CAEA,UACE,SACA,MAC8B;EAC9B,MAAM,YAAY,QAAQ,QAAQ,OAAO,CAAC,EAAE;EAC5C,KAAK,MAAM,YAAY,QAAQ,UAAU,IAAI,GAAG;GAC9C,MAAM,UAAU,WAAW,IAAI,QAAQ;GACvC,IAAI,SACF,OAAO;EAEX;CAEF;CAEA,KAAK,OAAuC;EAC1C,MAAM,EAAE,MAAM,MAAM,SAAS;EAC7B,MAAM,UAAU,MAAM,WAAW,MAAM;EACvC,IAAI,mBAAmB,MAAM;EAC7B,IAAI;GACF,IAAI,MAAM,WAAW,UACnB,OAAO;IAAE,SAAS;IAAe,UAAU,KAAK;GAAS;GAE3D,IAAI;GACJ,IAAI,aAAa,WAAW,gBAAgB,IAAI;GAChD,IAAI,MAAM,WAAW,WACnB,UAAU,WAAW,KAAK,UAAU,SAAS,IAAI;QAC5C;IACL,MAAM,UAAU,OACZ,CAAC,KAAK,UAAU,IAChB,CAAC,MAAM,GAAG,KAAK,OAAO,MAAM,CAAC;IACjC,KAAK,MAAM,UAAU,SAAS;KAC5B,MAAM,MAAM,QAAQ,MAAM,CAAC,EAAE;KAC7B,UAAU,OACN,KAAK,IAAI,KAAK,QAAQ,IACtB,KAAK,SAAS,IACZ,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,QACpB,KAAA;KACN,IAAI,SACF;IAEJ;IACA,IAAI,CAAC,WAAW,CAAC,MACf,KAAK,MAAM,UAAU,CAAC,MAAM,GAAG,KAAK,OAAO,MAAM,CAAC,GAAG;KACnD,MAAM,YAAY,QAAQ,MAAM,CAAC,EAAE;KACnC,IAAI,CAAC,WACH;KAEF,UAAU,KAAK,UAAU,WAAW,IAAI;KACxC,IAAI,SAAS;MACX,aAAa;MACb;KACF;IACF;GAEJ;GACA,IAAI,CAAC,SAAS;IACZ,MAAM,QAAQ,cAAc,IAAI;IAChC,MAAM,WAAW,MAAM,YAAY;IACnC,MAAM,SAAS,OAAO,QAAQ,IAAI,QAAQ;IAC1C,IAAI,QACF,UAAU;KAAE,GAAG;KAAQ;IAAS;GAEpC;GACA,IAAI,CAAC,SACH,MAAMC,oBAAAA,6BAA6B,UACjC,MAAM,eAAe,MAAM,WAAW,YAClC,gCACA,kBACJ,6EACA;IACE,MAAM,MAAM,QAAQ,MAAM;IAC1B,MAAM;GACR,CACF;GAEF,mBAAmB,QAAQ;GAC3B,IAAI,QAAQ,YAAY,iBACtB,YAAY,iBAAiB,IAAI;GAEnC,OAAO;EACT,SAAS,OAAO;GACd,IAAIC,oBAAAA,qBAAqB,KAAK,GAC5B,MAAM,KAAK,QAAQ,OAAO,OAAO,gBAAgB;GAEnD,MAAM;EACR;CACF;CAEA,UAA4B;EAC1B,MAAM,QAAQ,KAAK,MAAM,QAAQ;EACjC,IAAI,CAAC,OAAO,SACV,MAAMD,oBAAAA,6BAA6B,UACjC,iBACA,2CACF;EAEF,OAAO,MAAM,QAAQ;CACvB;CAEA,QACE,SACA,MAMA,OACU;EACV,IAAI,QAAQ,YAAY,iBAAiB,QAAQ,YAAY,UAC3D,OAAO;EAET,IAAI,QAAQ,YAAY,YACtB,MAAM,QAAQ;EAEhB,IAAI,KAAK,QAAQ,QAAQ,UAAU,SAAS,KAAK,MAAM;GACrD,MAAM,QAAQA,oBAAAA,6BAA6B,UACzC,KAAK,UAAU,2BACf,uCAAuC,KAAK,QAC5C;IACE,MAAM,KAAK;IACX,MAAM;GACR,CACF;GACA,MAAM,KAAK,QAAQ,OAAO,OAAO,QAAQ,QAAQ;EACnD;EACA,OAAO,KAAK,QAAQ,QAAQ,SAAS;CACvC;CAEA,QACE,OACA,OACA,UACoD;EACpD,MAAM,QAAQ,KAAK,MAAM,QAAQ;EACjC,MAAM,OAAO,OAAO,QAAQ,OAAO;EACnC,MAAM,UACJ,MAAM,WAAW,OAAO,YAAY,SAAS,gBAAgB,MAAM,IAAI;EACzE,MAAM,MAAM,MAAM,OAAO,SAAS,WAAW,OAAO;EACpD,IAAI,CAAC,KACH,OAAO;EAST,OAPiB,KAAK,MAAM,SAAS,KAAK,OAAO;GAC/C,UACE,YAAY,OAAO,MAAM,YAAY,OAAO,MAAM,YAAY;GAChE,MACE,MAAM,QAAQ,OAAO,QAAQ,OAAO,MAAM,QAAQ;GACpD;EACF,CACc,IAAI,IAAI,oBAAoB,KAAK,IAAI;CACrD;CAEA,MACE,MACA,UACA,QACM;EACN,MAAM,QAAQ,cAAc,IAAI,KAAK;GACnC,UAAU,CAAC,GAAG,IAAI;GAClB,yBAAS,IAAI,IAAI;EACnB;EACA,MAAM,QAAQ,IAAI,UAAU,MAAM;EAClC,KAAK,MAAM,UAAU,CAAC,MAAM,GAAG,IAAI,GACjC,IAAI,OAAO,MAAM,KAAK,OAAO,aAAa,MAAM,GAC9C,OAAO,eAAe,QAAQ,YAAY;GACxC,OAAO;GACP,cAAc;EAChB,CAAC;CAGP;AACF;;;ACjQA,SAAS,OAAO,QAAgB,KAAa,OAAsB;CACjE,QAAQ,eACN,KACA,OAAO,OAAO,CAAC,GAAI,QAAQ,eAAe,KAAK,MAAM,KAAK,CAAC,GAAI,KAAK,CAAC,GACrE,MACF;AACF;AACA,MAAa,gBAAA,GAAeE,eAAAA,YAAAA,CAAYC,iBAAwB,QAAQ;AACxE,MAAa,sBAAA,GACXD,eAAAA,YAAAA,CAAYC,iBAAwB,UAAU;AAChD,MAAa,eAAe,aAAA,GAC1BC,eAAAA,gBAAAA,EAAAA,GACEF,eAAAA,YAAAA,CAAYC,iBAAwB,UAAU,IAAA,GAC9CD,eAAAA,YAAAA,CAAYG,oBAA2B,SAAS,kBAAkB,IAAI,CACxE;AACF,MAAa,mBAAmB,UAAA,GAC9BH,eAAAA,YAAAA,CAAYI,wBAA+B,IAAI;AACjD,MAAa,oBACX,GAAG,WAAA,GACAJ,eAAAA,YAAAA,CAAYK,4BAAmC,OAAO,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AAC7E,MAAa,iCAAA,GACXL,eAAAA,YAAAA,CAAYM,oCAA2C,IAAI;AAC7D,MAAa,sBAAsB,UAAU,UAAA,GAC3CN,eAAAA,YAAAA,CAAYO,0BAAiC,OAAO;AACtD,MAAa,yBAAA,GACXP,eAAAA,YAAAA,CAAYQ,4BAAmC,IAAI;AACrD,MAAa,uBAAA,GACXN,eAAAA,gBAAAA,EAAAA,GACEF,eAAAA,YAAAA,CAAYS,0BAAiC,IAAI,IAAA,GACjDC,eAAAA,UAAAA,CAAU,eAAe,IAAA,GACzBC,eAAAA,gBAAAA,CAAgB,0BAA0B,CAC5C;AACF,SAAgB,QACd,GAAG,cAC+B;CAClC,QACE,QACA,MACA,eACG;EACH,KAAK,MAAM,cAAc,cACvB,OACE,YAAY,SAAS,QACrBC,uBACA,UACF;CAEJ;AACF;AACA,MAAa,SACX,GAAG,kBACkB,EAAE,OAAO,aAAa;AAC7C,MAAa,SACX,GAAG,kBACkB,EAAE,OAAO,aAAa;AAC7C,MAAa,eACX,QACA,QACA,aACoB;CAAE;CAAQ;CAAQ,GAAG;AAAQ;AAQnD,SAAgB,cAAc,SAA0C;CACtE,MAAM,OAAO,QAAQ,QAAQ;CAC7B,KAAK,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG;EACjC,KACG,OAAO,QAAQ,YAAY,QAAQ,SACpC,OAAO,QAAQ,YAEf;EAEF,MAAM,SAAS,QAAQ,IAAI,KAAKC,cAAqB;EAGrD,IACE,UACA,OAAO,KAAK,WAAW,KAAK,UAC5B,OAAO,KAAK,OAAO,OAAO,UAAU,UAAU,KAAK,MAAM,KACzD,OAAO,YAAY,KAAA,KACnB,OAAO,MAAM,QAAQ,CAAC,EAAE,YAAY,OAAO,SAE3C,OAAO;CAEX;CAEA,MAAM,QAAQ,IAAI,aAAa;CAC/B,OAAO;EAAE;EAAM;EAAO,UAAU,IAAI,kBAAkB,KAAK;CAAE;AAC/D;AACA,SAAS,eAAe,MAID;CACrB,MAAM,aAAA,GAAYC,eAAAA,qBAAAA,EACf,OAAgB,YAA8B;EAC7C,MAAM,SAAS,cAAc,OAAO;EACpC,MAAM,QAAQ;GACZ,MAAM,QAAQ,QAAQ;GACtB,MAAM,GAAG,QAAQ,SAAS,CAAC,CAAC,KAAK,GAAG,QAAQ,WAAW,CAAC,CAAC;EAC3D;EACA,MAAM,UACJ,OAAO,YAAY,KAAA,KACnB,OAAO,MAAM,QAAQ,CAAC,EAAE,YAAY,OAAO,UACvC,OAAO,SAAS,QAAQ,IACxB,OAAO,SAAS,KAAK,KAAK;EAChC,OAAO,OAAO,SAAS,QACrB,SACA;GAAE,GAAG;GAAM,MAAM,MAAM;GAAM,SAAS,MAAM,aAAa,MAAM;EAAG,GAClE,KACF;CACF,CACF,CAAC,CAAC;CACF,QAAQ,QAAQ,aAAa,UAAU;EACrC,IAAI,gBAAgB,KAAA,GAClB,MAAM,IAAIC,oBAAAA,6BACR,0BACA,+CACF;EAGF,OADgB,QAAQ,IAAI,QAAQ,WACvB,GAAGC,2BAAkC;GAChD;GACA,GAAI,OAAO;IAAE,MAAM,KAAK;IAAM,QAAQ,KAAK;GAAO,IAAI,CAAC;EACzD,CAAC;EACD,UAAU,QAAQ,aAAa,KAAK;CACtC;AACF;AACA,MAAa,yBAA6C,eAAe;AACzE,SAAgB,qBAAiD,MAIpC;CAC3B,aAAa,eAAe,IAAI;AAClC;AACA,SAAgB,sBACd,MACA,MAC0B;CAC1B,aAAa;EACX,MAAM,aAAA,GAAYF,eAAAA,qBAAAA,EACf,OAAgB,YAA8B;GAC7C,MAAM,SAAS,cAAc,OAAO;GACpC,MAAM,QAAQ,OAAO,MAAM,QAAQ;GACnC,MAAM,QAAQ;IACZ,MAAM,QAAQ,QAAQ;IACtB,MAAM,GAAG,QAAQ,SAAS,CAAC,CAAC,KAAK,GAAG,QAAQ,WAAW,CAAC,CAAC;GAC3D;GACA,MAAM,UAAU,OAAO,UACnB,OAAO,SAAS,QAAQ,IACxB,OAAO,SAAS,KAAK,KAAK;GAC9B,MAAM,aAAa,OAAO,OACtB,CAAC,MAAM,KAAK,UAAU,IACtB,CAAC,MAAM,MAAM,GAAG,MAAM,IAAI;GAC9B,KAAK,MAAM,aAAa,YAAY;IAClC,IACE,CAAC,aACA,OAAO,cAAc,YAAY,OAAO,cAAc,YAEvD;IAEF,MAAM,SAAS,QAAQ,IAAI,WAAWG,iBAAwB;IAG9D,IAAI,QAAQ,IAAI,QAAQ,QAAQ,CAAC,EAAE,IAAI,IAAI,GACzC,OAAO,OAAO,IAAI,QAAQ,QAAQ,CAAC,CAAE,IAAI,IAAI;GAEjD;GACA,MAAM,OAAO,SAAS,QACpBF,oBAAAA,6BAA6B,UAC3B,uBACA,KAAK,SACL,EAAE,MAAM,MAAM,KAAK,CACrB,GACA,OACA,QAAQ,QACV;EACF,CACF,CAAC,CAAC;EACF,QAAQ,QAAQ,KAAK,UAAU;GAC7B,IAAI,QAAQ,KAAA,GACV,MAAM,IAAIA,oBAAAA,6BACR,2BACA,gDACF;GAEF,OAAO,QAAQ,IAAI,QAAQ,GAAG,GAAGG,4BAAmC;IAClE;IACA;IACA,SAAS,KAAK;GAChB,CAAC;GACD,UAAU,QAAQ,KAAK,KAAK;EAC9B;CACF;AACF;AAoBA,SAAgB,iBAAiB,SAG/B;CACA,OAAO;EACL,OAAO,QAAQ,eAAeC,eAAsB,OAAO,KAAK,CAAC;EACjE,eACE,QAAQ,eAAeC,kBAAyB,OAAO,KAAK,CAAC;CACjE;AACF;AACA,SAAS,KACP,OACA,OACA,SACwB;CACxB,QAAQ,SAAS,QAAQ,eAAe;EACtC,MAAM,UAAU,WAAW;EAC3B,MAAM,UAAU,iBAAiB,OAAO,CAAC,CAAC;EAC1C,OACE,SACAD,eACA,OAAO,OAAO;GACZ;GACA,OAAO,MAAM,QAAQ,KAAK,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,CAAC,IAAI;GAC1D,SAAS,OAAO,OAAO,EAAE,GAAG,QAAQ,CAAC;GACrC;GACA;GACA,kBAAkB,QAAQ;EAC5B,CAAC,CACH;CACF;AACF;AACA,MAAa,cACX,OACA,YAC2B,KAAK,UAAU,OAAO,OAAO;AAC1D,MAAa,aACX,OACA,YAC2B,KAAK,SAAS,OAAO,OAAO;AACzD,SAAS,aAGP,OAAW,QAAW,SAAuD;CAC7E,QAAQ,YAAY,QAAQ,eAAe;EACzC,MAAM,UAAU,WAAW;EAC3B,OACE,SACAC,kBACA,OAAO,OAAO;GACZ;GACA;GACA,SAAS,OAAO,OAAO,EAAE,GAAG,QAAQ,CAAC;GACrC;GACA;GACA,kBAAkB,iBAAiB,OAAO,CAAC,CAAC,cAAc;EAC5D,CAAC,CACH;CACF;AACF;AACA,MAAa,kBACX,QACA,YAEA,aAAa,UAAU,QAAQ,OAAO;AACxC,MAAa,iBACX,QACA,YACsC,aAAa,SAAS,QAAQ,OAAO"}