nestjs-slightly-better-auth 1.0.0

package/dist/auth-decorators-DfAJbHar.mjs

@@ -0,0 +1,849 @@
+import { c as isConfigurationError, i as createInfrastructureError, l as isInfrastructureError, n as BetterAuthConfigurationError, s as isAuthFailure, t as AuthFailures, u as normalizeThrown } from "./auth-errors-CQjfgjaO.mjs";
+import { Inject, Injectable, SetMetadata, UseGuards, UseInterceptors, applyDecorators, createParamDecorator } from "@nestjs/common";
+import { Observable } from "rxjs";
+import { AsyncLocalStorage } from "node:async_hooks";
+import { IntrinsicException } from "@nestjs/common/exceptions/intrinsic.exception.js";
+//#region src/auth-tokens.ts
+/** Stable Nest injection tokens shared by every package copy and module format. */
+function instanceToken(base, alias) {
+	return alias === void 0 || alias === "" || alias === "default" ? base : `${base}_${alias}`;
+}
+function getBetterAuthInstanceToken(alias) {
+	return instanceToken("NESTJS_SLIGHTLY_BETTER_AUTH_INSTANCE", alias);
+}
+function getBetterAuthOptionsToken(alias) {
+	return instanceToken("NESTJS_SLIGHTLY_BETTER_AUTH_OPTIONS", alias);
+}
+function getBetterAuthServiceToken(alias) {
+	return instanceToken("NESTJS_SLIGHTLY_BETTER_AUTH_SERVICE", alias);
+}
+function getBetterAuthHandleToken(alias) {
+	return instanceToken("NESTJS_SLIGHTLY_BETTER_AUTH_HANDLE", alias);
+}
+const INSTANCE_REGISTRY = Symbol.for("nestjs-slightly-better-auth:instance-registry");
+const REQUEST_SCOPE = Symbol.for("nestjs-slightly-better-auth:request-scope");
+const PRINCIPAL_READINGS = Symbol.for("nestjs-slightly-better-auth:principal-readings");
+const ROUTE_PLANNER = Symbol.for("nestjs-slightly-better-auth:route-planner");
+const TRANSPORT_REGISTRY = Symbol.for("nestjs-slightly-better-auth:transport-registry");
+const POLICY_RESOLVER = Symbol.for("nestjs-slightly-better-auth:policy-resolver");
+const MOUNT_COORDINATOR = Symbol.for("nestjs-slightly-better-auth:mount-coordinator");
+const GUARD_CORE = Symbol.for("nestjs-slightly-better-auth:guard-core");
+const SCOPE_CORE = Symbol.for("nestjs-slightly-better-auth:scope-core");
+const PRINCIPAL_RESOLVER = Symbol.for("nestjs-slightly-better-auth:principal-resolver");
+const POLICY_INVOKER = Symbol.for("nestjs-slightly-better-auth:policy-invoker");
+const PLATFORMS = Symbol.for("nestjs-slightly-better-auth:platforms");
+const TRANSPORTS = Symbol.for("nestjs-slightly-better-auth:transports");
+const ACCESS_METADATA = Symbol.for("nestjs-slightly-better-auth:access");
+const ACCEPT_PRINCIPALS_METADATA = Symbol.for("nestjs-slightly-better-auth:accept-principals");
+const REQUIREMENTS_METADATA = Symbol.for("nestjs-slightly-better-auth:requirements");
+const SKIP_DEFAULT_REQUIREMENTS_METADATA = Symbol.for("nestjs-slightly-better-auth:skip-default-requirements");
+const FRESHNESS_METADATA = Symbol.for("nestjs-slightly-better-auth:freshness");
+const AUTH_INSTANCE_METADATA = Symbol.for("nestjs-slightly-better-auth:auth-instance");
+const PRINCIPAL_PARAMS_METADATA = Symbol.for("nestjs-slightly-better-auth:principal-params");
+const INVOCATION_PARAMS_METADATA = Symbol.for("nestjs-slightly-better-auth:invocation-params");
+const FORWARD_COOKIES_METADATA = Symbol.for("nestjs-slightly-better-auth:forward-cookies");
+const SKIP_ORIGIN_CHECK_METADATA = Symbol.for("nestjs-slightly-better-auth:skip-origin-check");
+const USE_BETTER_AUTH_METADATA = Symbol.for("nestjs-slightly-better-auth:use-better-auth");
+const HOOK_METADATA = Symbol.for("nestjs-slightly-better-auth:hook");
+const DB_HOOK_METADATA = Symbol.for("nestjs-slightly-better-auth:db-hook");
+const AUTH_ENHANCER = Symbol.for("nestjs-slightly-better-auth:enhancer");
+function getPrincipalSourcesToken(instance) {
+	return Symbol.for(`nestjs-slightly-better-auth:principal-sources:${instance}`);
+}
+function getExtensionToken(point, instance, index) {
+	return Symbol.for(`nestjs-slightly-better-auth:ext:${point}:${instance}:${index}`);
+}
+const READER_CONTEXT = Symbol.for("nestjs-slightly-better-auth:reader-context");
+const INVOCATION_VALUES = Symbol.for("nestjs-slightly-better-auth:invocation");
+//#endregion
+//#region src/principal-resolver.ts
+const definePrincipalSource = (source) => source;
+const authenticated = (principal) => ({
+	outcome: "authenticated",
+	principal
+});
+const absent = () => ({ outcome: "absent" });
+const rejected = (failure) => ({
+	outcome: "rejected",
+	failure
+});
+var MemoKeys = class {
+	owners = /* @__PURE__ */ new WeakMap();
+	key(owner, namespace, value) {
+		if (typeof value === "string") return JSON.stringify([
+			namespace,
+			"string",
+			value
+		]);
+		let identities = this.owners.get(owner);
+		if (!identities) {
+			identities = {
+				objects: /* @__PURE__ */ new WeakMap(),
+				symbols: /* @__PURE__ */ new Map(),
+				next: 0
+			};
+			this.owners.set(owner, identities);
+		}
+		let id = typeof value === "symbol" ? identities.symbols.get(value) : identities.objects.get(value);
+		if (id === void 0) {
+			id = ++identities.next;
+			if (typeof value === "symbol") identities.symbols.set(value, id);
+			else identities.objects.set(value, id);
+		}
+		return JSON.stringify([
+			namespace,
+			typeof value,
+			id
+		]);
+	}
+};
+function requestHeaders(call, entry) {
+	const headers = new Headers(call.headers());
+	for (const name of [...headers.keys()]) if (name.startsWith(":") || name.startsWith("x-nsba-ip-") || name === entry.bridge.clientIpHeader) headers.delete(name);
+	if (entry.bridge.clientIpHeader && call.clientIp) headers.set(entry.bridge.clientIpHeader, call.clientIp);
+	return headers;
+}
+function normalizeForRequest(error, where, site, entry, headers) {
+	try {
+		return normalizeThrown(error, where, site, [], entry.options.errors);
+	} catch (normalized) {
+		if (isConfigurationError(normalized) || isInfrastructureError(error) && normalized === error) throw normalized;
+		throw createInfrastructureError(error, {
+			headers,
+			credentialHeaders: entry.credentialHeaders,
+			exposeRawCause: entry.options.errors?.exposeRawCause
+		});
+	}
+}
+var ChainPrincipalResolver = class {
+	instances;
+	scope;
+	transports;
+	keys = new MemoKeys();
+	constructor(instances, scope, transports) {
+		this.instances = instances;
+		this.scope = scope;
+		this.transports = transports;
+	}
+	resolve(call, request) {
+		const entry = this.instances.get(request.auth.name);
+		const compute = async () => {
+			const headers = requestHeaders(call, entry);
+			const sources = request.reclassify ? entry.sources.filter((source) => source.id === request.reclassify.sourceId && source.sessionBacked) : entry.sources.filter((source) => source.kinds.some((kind) => request.accepts.has(kind)));
+			return request.auth.run({
+				cookies: call.cookies,
+				forward: "same-credential",
+				inbound: () => headers,
+				internal: true
+			}, async () => {
+				for (const source of sources) {
+					const input = {
+						headers,
+						cookies: call.cookies,
+						transport: this.transports.idOf(call),
+						request: call.request,
+						freshness: request.freshness,
+						auth: request.auth,
+						memo: (key, fn) => this.scope.memoPolicyIo(call.key, entry.name, this.keys.key(call.key, `source:${source.id}`, key), fn, entry.options.limits?.maxAuthorizationCallsPerRequest)
+					};
+					try {
+						if (source.appliesTo && !source.appliesTo(input)) continue;
+						const result = await source.resolve(input);
+						if (result.outcome === "authenticated" && (!source.kinds.includes(result.principal.kind) || result.principal.source !== source.id || Boolean(result.principal.delegation) !== Boolean(source.delegates))) throw new Error(`Principal source ${source.id} violated its declared principal contract`);
+						if (result.outcome !== "absent") return result;
+					} catch (error) {
+						const failure = normalizeForRequest(error, "source", source.id, entry, headers);
+						if (isAuthFailure(failure)) return rejected(failure);
+						throw error;
+					}
+				}
+				return absent();
+			});
+		};
+		return request.reclassify ? compute() : this.scope.memoPrincipal(call, {
+			instance: entry.name,
+			freshness: request.freshness,
+			sourceSet: request.sourceSet
+		}, compute);
+	}
+};
+//#endregion
+//#region \0@oxc-project+runtime@0.150.0/helpers/esm/decorateMetadata.js
+function __decorateMetadata(k, v) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.150.0/helpers/esm/decorateParam.js
+function __decorateParam(paramIndex, decorator) {
+	return function(target, key) {
+		decorator(target, key, paramIndex);
+	};
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.150.0/helpers/esm/decorate.js
+function __decorate(decorators, target, key, desc) {
+	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+	return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+//#endregion
+//#region src/auth-guard.ts
+let BetterAuthGuard = class BetterAuthGuard {
+	core;
+	static [AUTH_ENHANCER] = "guard";
+	[AUTH_ENHANCER] = "guard";
+	constructor(core) {
+		this.core = core;
+	}
+	canActivate(context) {
+		return this.core.canActivate(context);
+	}
+};
+BetterAuthGuard = __decorate([
+	Injectable(),
+	__decorateParam(0, Inject(GUARD_CORE)),
+	__decorateMetadata("design:paramtypes", [typeof Pick === "undefined" ? Object : Pick])
+], BetterAuthGuard);
+var GuardCore = class {
+	instances;
+	planner;
+	transports;
+	resolver;
+	evaluator;
+	scope;
+	readings;
+	constructor(instances, planner, transports, resolver, evaluator, scope, readings) {
+		this.instances = instances;
+		this.planner = planner;
+		this.transports = transports;
+		this.resolver = resolver;
+		this.evaluator = evaluator;
+		this.scope = scope;
+		this.readings = readings;
+	}
+	async canActivate(context) {
+		let transport;
+		let call;
+		let plan;
+		try {
+			plan = this.planner.forContext(context);
+			if (plan.access === "inherit") {
+				transport = this.transports.find(context);
+				const lineage = transport?.lineage?.(context);
+				if (lineage && !this.readings.enclosing(lineage, context.getArgs())) {
+					call = this.transports.describe(context, transport);
+					throw BetterAuthConfigurationError.atRequest("NO_ENCLOSING_DECISION", "An inherited invocation has no enclosing guard decision", { site: plan.site });
+				}
+				if (plan.originCheck !== "form") return true;
+			}
+			if (plan.access === "public" && plan.originCheck !== "form") {
+				const lineage = this.transports.find(context)?.lineage?.(context);
+				if (lineage && !plan.nested) this.readings.recordLineage(lineage, {
+					outcome: "no-identity",
+					instance: plan.instance
+				});
+				return true;
+			}
+			transport = this.transports.select(context);
+			call = this.transports.describe(context, transport);
+			const entry = this.instances.get(plan.instance);
+			if (plan.originCheck !== "off") {
+				const browser = call.browser;
+				if (browser) {
+					if (plan.originCheck === "form" || browser.enforce) {
+						const failure = await entry.origin.check(browser, plan.originCheck);
+						if (failure) throw failure;
+					} else await entry.origin.advisory(browser);
+				}
+			}
+			if (plan.access === "inherit") return true;
+			if (plan.access === "public") {
+				if (!plan.nested) this.readings.record(call, {
+					outcome: "no-identity",
+					instance: plan.instance
+				});
+				return true;
+			}
+			const result = await this.resolver.resolve(call, {
+				auth: entry.handle,
+				freshness: plan.freshness,
+				accepts: plan.accepts,
+				sourceSet: plan.sourceSet
+			});
+			this.readings.record(call, {
+				...result,
+				instance: plan.instance
+			});
+			if (result.outcome === "rejected") throw result.failure;
+			if (result.outcome === "absent") {
+				if (plan.access === "optional") return true;
+				throw AuthFailures.unauthenticated();
+			}
+			if (!plan.accepts.has(result.principal.kind)) throw AuthFailures.forbidden("PRINCIPAL_NOT_SUPPORTED");
+			const decision = await this.evaluator.evaluate(plan, result.principal, call, entry, context, transport.id);
+			if (decision.effect === "deny") throw AuthFailures.rejected({
+				status: decision.status ?? 403,
+				reason: decision.reason,
+				message: decision.message,
+				challenge: decision.challenge
+			});
+			return true;
+		} catch (error) {
+			if (isAuthFailure(error) && transport) {
+				const mapping = plan && this.instances.get(plan.instance).options.errors?.map;
+				throw mapping ? mapping(error, context, transport.id) : transport.toException(error, context);
+			}
+			if ((isConfigurationError(error) || isInfrastructureError(error)) && transport) {
+				const repeated = call ? this.scope.surfaced(call.key, error, {
+					instance: plan?.instance ?? "default",
+					site: plan?.site ?? "guard",
+					lineage: call.lineage
+				}) : false;
+				throw transport.toInternalException?.(error, context, { repeated }) ?? error;
+			}
+			throw error;
+		}
+	}
+};
+//#endregion
+//#region src/auth-scope-interceptor.ts
+let BetterAuthScopeInterceptor = class BetterAuthScopeInterceptor {
+	core;
+	static [AUTH_ENHANCER] = "scope";
+	[AUTH_ENHANCER] = "scope";
+	constructor(core) {
+		this.core = core;
+	}
+	intercept(context, next) {
+		return this.core.intercept(context, next);
+	}
+};
+BetterAuthScopeInterceptor = __decorate([
+	Injectable(),
+	__decorateParam(0, Inject(SCOPE_CORE)),
+	__decorateMetadata("design:paramtypes", [typeof Pick === "undefined" ? Object : Pick])
+], BetterAuthScopeInterceptor);
+var ScopeCore = class {
+	instances;
+	planner;
+	transports;
+	scope;
+	readings;
+	constructor(instances, planner, transports, scope, readings) {
+		this.instances = instances;
+		this.planner = planner;
+		this.transports = transports;
+		this.scope = scope;
+		this.readings = readings;
+	}
+	intercept(context, next) {
+		const plan = this.planner.forContext(context);
+		const entry = this.instances.get(plan.instance);
+		let described = false;
+		let call;
+		const getCall = () => {
+			if (!described) {
+				const transport = this.transports.find(context);
+				call = transport ? this.transports.describe(context, transport) : void 0;
+				described = true;
+			}
+			return call;
+		};
+		let reading;
+		const read = () => {
+			if (reading) return reading;
+			const lineage = this.transports.find(context)?.lineage?.(context);
+			reading = this.readings.read({
+				args: context.getArgs(),
+				plan,
+				lineage,
+				...plan.access === "public" || plan.access === "inherit" ? {} : { call: getCall() }
+			});
+			return reading;
+		};
+		const instances = this.instances;
+		const state = {
+			view: {
+				get cookies() {
+					return getCall()?.cookies ?? null;
+				},
+				forward: plan.forwardDirectCalls ? "same-credential" : "none",
+				internal: false,
+				get inbound() {
+					return () => {
+						const call = getCall();
+						return call ? requestHeaders(call, entry) : new Headers();
+					};
+				},
+				get browserHeaders() {
+					const browser = getCall()?.browser;
+					return browser ? () => browser.headers() : void 0;
+				},
+				get checkCallerSession() {
+					if (plan.originCheck === "off") return;
+					const browser = getCall()?.browser;
+					return browser ? (path, instance) => instances.get(instance).origin.assertCallerSession(browser, path, instance) : void 0;
+				}
+			},
+			plan,
+			reading: read,
+			get call() {
+				return getCall();
+			}
+		};
+		const args = context.getArgs();
+		const bridge = {
+			args: [...args],
+			reading: read,
+			scope: this.scope,
+			readings: this.readings
+		};
+		for (const arg of [args, ...args]) if (arg && (typeof arg === "object" || typeof arg === "function") && Object.isExtensible(arg)) Object.defineProperty(arg, READER_CONTEXT, {
+			value: bridge,
+			configurable: true
+		});
+		return new Observable((subscriber) => this.scope.run(state, () => {
+			const subscription = next.handle().subscribe({
+				next: (value) => this.scope.run(state, () => subscriber.next(value)),
+				error: (error) => this.scope.run(state, () => subscriber.error(error)),
+				complete: () => this.scope.run(state, () => subscriber.complete())
+			});
+			return () => this.scope.run(state, () => subscription.unsubscribe());
+		}));
+	}
+};
+//#endregion
+//#region src/request-scope.ts
+const SURFACED = Symbol.for("nestjs-slightly-better-auth:surfaced");
+function memoKey(instance, ...inputs) {
+	return JSON.stringify([instance, ...inputs]);
+}
+/** Shared by guards and readers that have only the transport's structural lineage. */
+function surfacedRecord(key, lineage) {
+	const carrier = lineage?.carrier ?? key;
+	const partition = lineage ? lineage.position.split(":", 1)[0] : "";
+	let records = Reflect.get(carrier, SURFACED);
+	if (!records) {
+		records = /* @__PURE__ */ new Map();
+		Object.defineProperty(carrier, SURFACED, { value: records });
+	}
+	let record = records.get(partition);
+	if (!record) {
+		record = /* @__PURE__ */ new Set();
+		records.set(partition, record);
+	}
+	return record;
+}
+var RequestScope = class {
+	#storage = new AsyncLocalStorage();
+	#states = /* @__PURE__ */ new WeakMap();
+	#valueKeys = /* @__PURE__ */ new Map();
+	#errorIds = /* @__PURE__ */ new WeakMap();
+	#nextError = 0;
+	run(state, fn) {
+		return this.#storage.run(state, fn);
+	}
+	exit(fn) {
+		return this.#storage.exit(fn);
+	}
+	current() {
+		return this.#storage.getStore();
+	}
+	stateFor(key) {
+		let state = this.#states.get(key);
+		if (!state) {
+			state = {
+				principal: /* @__PURE__ */ new Map(),
+				policyIo: /* @__PURE__ */ new Map(),
+				decisions: /* @__PURE__ */ new Map(),
+				values: /* @__PURE__ */ new Map(),
+				authorizationCalls: /* @__PURE__ */ new Set(),
+				origins: /* @__PURE__ */ new Map(),
+				surfaced: /* @__PURE__ */ new Set(),
+				connections: /* @__PURE__ */ new Map()
+			};
+			this.#states.set(key, state);
+		}
+		return state;
+	}
+	memoPrincipal(call, input, compute) {
+		const key = memoKey(input.instance, input.freshness, input.sourceSet);
+		const state = this.stateFor(call.key);
+		const existing = state.principal.get(key);
+		if (existing) return existing;
+		const connection = call.connection && input.freshness !== "authoritative" && (call.principalTtlMs ?? 0) > 0 ? this.stateFor(call.connection).connections : void 0;
+		const cached = connection?.get(key);
+		const promise = Promise.resolve().then(async () => {
+			if (cached && cached.expiresAt > Date.now()) return cached.value;
+			connection?.delete(key);
+			try {
+				const value = await compute();
+				if (value.outcome !== "rejected") connection?.set(key, {
+					value,
+					expiresAt: Date.now() + (call.principalTtlMs ?? 0)
+				});
+				return value;
+			} catch (error) {
+				connection?.delete(key);
+				throw error;
+			}
+		});
+		state.principal.set(key, promise);
+		return promise;
+	}
+	memoPolicyIo(request, instance, concreteKey, compute, limit = 100) {
+		const state = this.stateFor(request);
+		const key = memoKey(instance, concreteKey);
+		const existing = state.policyIo.get(key);
+		if (existing) return existing;
+		if (limit !== false && [...state.authorizationCalls].filter((entry) => JSON.parse(entry)[0] === instance).length >= limit) return Promise.reject(AuthFailures.rejected({
+			status: 429,
+			reason: "TOO_MANY_AUTHORIZATION_CHECKS"
+		}));
+		state.authorizationCalls.add(key);
+		const promise = Promise.resolve().then(compute);
+		state.policyIo.set(key, promise);
+		return promise;
+	}
+	memoDecision(invocation, instance, concreteKey, compute) {
+		const decisions = this.stateFor(invocation).decisions;
+		const key = memoKey(instance, concreteKey);
+		let promise = decisions.get(key);
+		if (!promise) {
+			promise = Promise.resolve().then(compute);
+			decisions.set(key, promise);
+		}
+		return promise;
+	}
+	valueKey(instance, key) {
+		let keys = this.#valueKeys.get(instance);
+		if (!keys) {
+			keys = /* @__PURE__ */ new Map();
+			this.#valueKeys.set(instance, keys);
+		}
+		let namespaced = keys.get(key);
+		if (!namespaced) {
+			namespaced = Symbol(key.description);
+			keys.set(key, namespaced);
+		}
+		return namespaced;
+	}
+	surfaced(key, error, context) {
+		let id = this.#errorIds.get(error);
+		if (!id) {
+			id = ++this.#nextError;
+			this.#errorIds.set(error, id);
+		}
+		const reason = isConfigurationError(error) ? memoKey(context.instance, error.code, context.site) : `error:${id}`;
+		const carrier = surfacedRecord(key, context.lineage);
+		const state = key === context.lineage?.carrier ? carrier : this.stateFor(key).surfaced;
+		const repeated = state.has(reason) || carrier.has(reason);
+		state.add(reason);
+		carrier.add(reason);
+		return repeated;
+	}
+};
+//#endregion
+//#region src/principal-readings.ts
+const RESOLUTION = Symbol.for("nestjs-slightly-better-auth:resolution");
+const TEST_STAMP = Symbol.for("nestjs-slightly-better-auth:test-stamp");
+function object(value) {
+	return value !== null && (typeof value === "object" || typeof value === "function");
+}
+function records(target, create = false) {
+	let value = Reflect.get(target, RESOLUTION);
+	if (!value && create) {
+		value = {
+			own: /* @__PURE__ */ new Map(),
+			positions: /* @__PURE__ */ new Map()
+		};
+		Object.defineProperty(target, RESOLUTION, { value });
+	}
+	return value;
+}
+function matchingStamp(args) {
+	for (const target of [args, ...args]) {
+		if (!object(target)) continue;
+		const stamp = Reflect.get(target, TEST_STAMP);
+		if (stamp && stamp.elements.length === args.length && stamp.elements.every((value, index) => value === args[index])) return stamp;
+	}
+}
+function lineageFromArgs(args) {
+	const targets = [args, ...args.filter(object)];
+	for (const target of targets) {
+		const own = records(target)?.invocationLineage;
+		if (own) return own;
+	}
+	for (const target of targets) {
+		const carrier = records(target)?.lineage;
+		if (!carrier) continue;
+		for (const position of carrier.enclosing(args)) return {
+			...carrier,
+			position
+		};
+	}
+}
+/** The intrinsic twin suppresses Nest's repeated log, while retaining the safe wire shape. */
+var RepeatedReaderError = class extends IntrinsicException {
+	constructor(error) {
+		super(error.message);
+		Object.defineProperties(this, Object.getOwnPropertyDescriptors(error));
+	}
+};
+var PrincipalReadings = class {
+	scope;
+	constructor(scope) {
+		this.scope = scope;
+	}
+	record(call, reading) {
+		const record = records(call.invocation, true);
+		record.own.set(reading.instance, reading);
+		if (call.lineage) {
+			record.invocationLineage = call.lineage;
+			this.recordLineage(call.lineage, reading);
+		}
+	}
+	recordLineage(lineage, reading) {
+		const value = records(lineage.carrier, true);
+		value.positions.set(lineage.position, reading);
+		value.lineage = lineage;
+	}
+	enclosing(lineage, args) {
+		const positions = records(lineage.carrier)?.positions;
+		for (const position of lineage.enclosing(args)) {
+			const reading = positions?.get(position);
+			if (reading) return reading;
+		}
+	}
+	read(input) {
+		const { plan, args, call } = input;
+		const lineage = input.lineage ?? call?.lineage;
+		let resolvedInstance = plan?.instance;
+		try {
+			if (plan?.access === "public") return {
+				outcome: "no-identity",
+				instance: plan.instance
+			};
+			let reading;
+			let validation = lineage ?? lineageFromArgs(args);
+			if (plan?.access === "inherit") reading = lineage && this.enclosing(lineage, args);
+			else {
+				const targets = call ? [call.invocation] : [args, ...args.filter(object)];
+				for (const target of targets) {
+					const own = records(target)?.own;
+					reading = plan ? own?.get(plan.instance) : own?.size === 1 ? own.values().next().value : void 0;
+					if (reading) break;
+				}
+				if (!reading && !plan) for (const target of [args, ...args.filter(object)]) {
+					const candidate = records(target)?.lineage;
+					if (!candidate) continue;
+					reading = this.enclosing(candidate, args);
+					if (reading) {
+						validation = candidate;
+						break;
+					}
+				}
+			}
+			if (!reading) {
+				const stamp = matchingStamp(args);
+				const instance = plan?.instance ?? "default";
+				const result = stamp?.results.get(instance);
+				if (result) reading = {
+					...result,
+					instance
+				};
+			}
+			if (!reading) throw BetterAuthConfigurationError.atRequest(input.beforeGuard && plan?.access !== "inherit" ? "PRINCIPAL_READ_BEFORE_GUARD" : "NO_AUTH_RESULT", "No authentication result: BetterAuthGuard did not run for this invocation", {
+				site: plan?.site ?? input.site,
+				hint: "Run BetterAuthGuard before reading a principal; test replacements must stampPrincipal()."
+			});
+			resolvedInstance = reading.instance;
+			if (reading.outcome === "authenticated") validation?.assertReadable?.(args);
+			return reading;
+		} catch (error) {
+			if (isConfigurationError(error)) throw this.deliver(error, input, resolvedInstance);
+			throw error;
+		}
+	}
+	current() {
+		const state = this.scope.current();
+		if (!state?.reading) throw BetterAuthConfigurationError.atRequest("NO_AUTH_SCOPE", "Principal readers require a handler scope");
+		return state.reading();
+	}
+	project(reading, spec, input) {
+		if (reading.outcome === "no-identity" || reading.outcome === "absent") return null;
+		if (reading.outcome === "rejected") throw reading.failure;
+		if (spec.kind && reading.principal.kind !== spec.kind) {
+			const error = BetterAuthConfigurationError.atRequest(spec.reason ?? "PRINCIPAL_KIND_REQUIRED", `This reader requires principal kind ${spec.kind}`, {
+				site: spec.site,
+				hint: "Use @CurrentPrincipal() or getPrincipal() and narrow p.kind."
+			});
+			throw this.deliver(error, input, reading.instance);
+		}
+		return spec.project(reading.principal);
+	}
+	deliver(error, input, instance) {
+		const state = this.scope.current();
+		const call = state?.call ?? input?.call;
+		const lineage = call?.lineage ?? input?.lineage ?? (input && lineageFromArgs(input.args));
+		const key = call?.key ?? lineage?.carrier ?? input?.args;
+		if (!key) return error;
+		return this.scope.surfaced(key, error, {
+			instance: instance ?? state?.plan?.instance ?? input?.plan?.instance ?? "default",
+			site: error.site ?? input?.site ?? input?.plan?.site ?? "principal reader",
+			lineage
+		}) ? new RepeatedReaderError(error) : error;
+	}
+	stamp(args, instance, result) {
+		const stamp = matchingStamp(args) ?? {
+			elements: [...args],
+			results: /* @__PURE__ */ new Map()
+		};
+		stamp.results.set(instance, result);
+		for (const target of [args, ...args]) if (object(target) && Object.isExtensible(target)) Object.defineProperty(target, TEST_STAMP, {
+			value: stamp,
+			configurable: true
+		});
+	}
+};
+//#endregion
+//#region src/auth-decorators.ts
+function append(target, key, value) {
+	Reflect.defineMetadata(key, Object.freeze([...Reflect.getOwnMetadata(key, target) ?? [], value]), target);
+}
+const Public = () => SetMetadata(ACCESS_METADATA, "public");
+const OptionalAuth = () => SetMetadata(ACCESS_METADATA, "optional");
+const RequireAuth = (options) => applyDecorators(SetMetadata(ACCESS_METADATA, "required"), SetMetadata(FRESHNESS_METADATA, options?.authoritative === true));
+const UseAuthInstance = (name) => SetMetadata(AUTH_INSTANCE_METADATA, name);
+const AcceptPrincipals = (...kinds) => SetMetadata(ACCEPT_PRINCIPALS_METADATA, Object.freeze([...kinds]));
+const SkipDefaultRequirements = () => SetMetadata(SKIP_DEFAULT_REQUIREMENTS_METADATA, true);
+const ForwardAuthCookies = (enabled = true) => SetMetadata(FORWARD_COOKIES_METADATA, enabled);
+const SkipOriginCheck = () => SetMetadata(SKIP_ORIGIN_CHECK_METADATA, true);
+const UseBetterAuth = () => applyDecorators(SetMetadata(USE_BETTER_AUTH_METADATA, true), UseGuards(BetterAuthGuard), UseInterceptors(BetterAuthScopeInterceptor));
+function Require(...requirements) {
+	return (target, _key, descriptor) => {
+		for (const expression of requirements) append(descriptor?.value ?? target, REQUIREMENTS_METADATA, expression);
+	};
+}
+const anyOf = (...requirements) => ({ anyOf: requirements });
+const allOf = (...requirements) => ({ allOf: requirements });
+const requirement = (policy, params, options) => ({
+	policy,
+	params,
+	...options
+});
+function readerContext(context) {
+	const args = context.getArgs();
+	for (const arg of [args, ...args]) {
+		if ((typeof arg !== "object" || arg === null) && typeof arg !== "function") continue;
+		const bridge = Reflect.get(arg, READER_CONTEXT);
+		if (bridge && bridge.args.length === args.length && bridge.args.every((value, index) => value === args[index]) && bridge.reading !== void 0 && bridge.scope.current()?.reading === bridge.reading) return bridge;
+	}
+	const scope = new RequestScope();
+	return {
+		args,
+		scope,
+		readings: new PrincipalReadings(scope)
+	};
+}
+function principalParam(spec) {
+	const decorator = createParamDecorator((_data, context) => {
+		const bridge = readerContext(context);
+		const input = {
+			args: context.getArgs(),
+			site: `${context.getClass().name}.${context.getHandler().name}`
+		};
+		const reading = bridge.reading !== void 0 && bridge.scope.current()?.reading === bridge.reading ? bridge.readings.current() : bridge.readings.read(input);
+		return bridge.readings.project(reading, {
+			...spec,
+			site: input.site,
+			project: spec?.project ?? ((p) => p)
+		}, input);
+	})();
+	return (target, propertyKey, index) => {
+		if (propertyKey === void 0) throw new BetterAuthConfigurationError("PRINCIPAL_PARAM_TARGET", "Principal parameters require a handler method");
+		append(Reflect.get(target, propertyKey), PRINCIPAL_PARAMS_METADATA, {
+			index,
+			...spec ? {
+				kind: spec.kind,
+				reason: spec.reason
+			} : {}
+		});
+		decorator(target, propertyKey, index);
+	};
+}
+const CurrentPrincipal = () => principalParam();
+function definePrincipalParam(spec) {
+	return () => principalParam(spec);
+}
+function defineInvocationParam(slot, spec) {
+	return () => {
+		const decorator = createParamDecorator((_data, context) => {
+			const bridge = readerContext(context);
+			const state = bridge.scope.current();
+			const input = {
+				args: context.getArgs(),
+				site: `${context.getClass().name}.${context.getHandler().name}`
+			};
+			const reading = state?.reading ? bridge.readings.current() : bridge.readings.read(input);
+			const candidates = state?.call ? [state.call.invocation] : [input.args, ...input.args];
+			for (const candidate of candidates) {
+				if (!candidate || typeof candidate !== "object" && typeof candidate !== "function") continue;
+				const values = Reflect.get(candidate, INVOCATION_VALUES);
+				if (values?.get(reading.instance)?.has(slot)) return values.get(reading.instance).get(slot);
+			}
+			throw bridge.readings.deliver(BetterAuthConfigurationError.atRequest("NO_INVOCATION_VALUE", spec.missing, { site: input.site }), input, reading.instance);
+		})();
+		return (target, key, index) => {
+			if (key === void 0) throw new BetterAuthConfigurationError("INVOCATION_PARAM_TARGET", "Invocation parameters require a handler method");
+			append(Reflect.get(target, key), INVOCATION_PARAMS_METADATA, {
+				index,
+				slot,
+				missing: spec.missing
+			});
+			decorator(target, key, index);
+		};
+	};
+}
+function readHookMetadata(handler) {
+	return {
+		hooks: Reflect.getOwnMetadata(HOOK_METADATA, handler) ?? [],
+		databaseHooks: Reflect.getOwnMetadata(DB_HOOK_METADATA, handler) ?? []
+	};
+}
+function hook(phase, match, options) {
+	return (_target, method, descriptor) => {
+		const handler = descriptor.value;
+		const records = readHookMetadata(handler).hooks;
+		append(handler, HOOK_METADATA, Object.freeze({
+			phase,
+			match: Array.isArray(match) ? Object.freeze([...match]) : match,
+			options: Object.freeze({ ...options }),
+			method,
+			handler,
+			declarationOrder: records.length
+		}));
+	};
+}
+const BeforeAuth = (match, options) => hook("before", match, options);
+const AfterAuth = (match, options) => hook("after", match, options);
+function databaseHook(phase, target, options) {
+	return (_prototype, method, descriptor) => {
+		const handler = descriptor.value;
+		append(handler, DB_HOOK_METADATA, Object.freeze({
+			phase,
+			target,
+			options: Object.freeze({ ...options }),
+			method,
+			handler,
+			declarationOrder: readHookMetadata(handler).databaseHooks.length
+		}));
+	};
+}
+const BeforeDatabase = (target, options) => databaseHook("before", target, options);
+const AfterDatabase = (target, options) => databaseHook("after", target, options);
+//#endregion
+export { POLICY_RESOLVER as $, __decorateParam as A, ACCEPT_PRINCIPALS_METADATA as B, RequestScope as C, BetterAuthGuard as D, ScopeCore as E, authenticated as F, FRESHNESS_METADATA as G, AUTH_ENHANCER as H, definePrincipalSource as I, INVOCATION_PARAMS_METADATA as J, GUARD_CORE as K, normalizeForRequest as L, ChainPrincipalResolver as M, MemoKeys as N, GuardCore as O, absent as P, POLICY_INVOKER as Q, rejected as R, PrincipalReadings as S, BetterAuthScopeInterceptor as T, AUTH_INSTANCE_METADATA as U, ACCESS_METADATA as V, FORWARD_COOKIES_METADATA as W, MOUNT_COORDINATOR as X, INVOCATION_VALUES as Y, PLATFORMS as Z, anyOf as _, getPrincipalSourcesToken as _t, BeforeDatabase as a, ROUTE_PLANNER as at, readHookMetadata as b, OptionalAuth as c, SKIP_ORIGIN_CHECK_METADATA as ct, RequireAuth as d, USE_BETTER_AUTH_METADATA as dt, PRINCIPAL_PARAMS_METADATA as et, SkipDefaultRequirements as f, getBetterAuthHandleToken as ft, allOf as g, getExtensionToken as gt, UseBetterAuth as h, getBetterAuthServiceToken as ht, BeforeAuth as i, REQUIREMENTS_METADATA as it, __decorateMetadata as j, __decorate as k, Public as l, TRANSPORTS as lt, UseAuthInstance as m, getBetterAuthOptionsToken as mt, AfterAuth as n, PRINCIPAL_RESOLVER as nt, CurrentPrincipal as o, SCOPE_CORE as ot, SkipOriginCheck as p, getBetterAuthInstanceToken as pt, INSTANCE_REGISTRY as q, AfterDatabase as r, REQUEST_SCOPE as rt, ForwardAuthCookies as s, SKIP_DEFAULT_REQUIREMENTS_METADATA as st, AcceptPrincipals as t, PRINCIPAL_READINGS as tt, Require as u, TRANSPORT_REGISTRY as ut, defineInvocationParam as v, memoKey as w, requirement as x, definePrincipalParam as y, requestHeaders as z };
+
+//# sourceMappingURL=auth-decorators-DfAJbHar.mjs.map