nestjs-slightly-better-auth 1.12.0 → 1.12.1

package/README.md

@@ -61,7 +61,8 @@ Nest's gRPC transport uses `@grpc/grpc-js` and `@grpc/proto-loader`, Kafka uses
 | Node.js                          | 24.11.0 or newer                                  | 24.11.0 and the current LTS                                                      |
 | `@nestjs/common`, `@nestjs/core` | `^12.0.3`                                         | 12.0.3 and the newest 12.x release, with the matching `@nestjs/platform-express` |
 | `better-auth`                    | `>=1.7.5 <2`                                      | 1.7.5 and the newest 1.x release                                                 |
-| TypeScript declarations          | `nodenext`, `node16` ESM and `bundler` resolution | TypeScript 7 in each resolution mode                                             |
+| TypeScript declarations          | `nodenext`, `node16` ESM and `bundler` resolution | TypeScript 5.9, the newest 6.x and 7 in each resolution mode                     |
+| Bundlers                         | esbuild, `nest build --webpack`                   | esbuild 0.28 and Nest CLI 12 with webpack 5                                      |
 
 The packaging tests pack this package, install the tarball with pnpm into temporary applications outside the workspace and run them with the peers installed at their declared floors and at the newest versions inside the peer ranges. The newest versions are those that pnpm's default minimum release age admits, so a new release enters the matrix after that delay. Each application compiles one Nest source as ESM and as CommonJS, signs up users of a default and a named Better Auth instance, calls a guarded route of each with its session cookie, checks that neither instance accepts the other's cookie, and closes. CI runs these tests on the current Node.js LTS and on Node.js 24.11.0.
 
@@ -74,6 +75,24 @@ Module systems:
 - With TypeScript `module: nodenext`, ESM and CommonJS files compile against the published declarations; `module: preserve` with `moduleResolution: bundler` uses the ESM declarations. With `module: node16`, ESM files compile, but CommonJS files cannot import NestJS 12 or Better Auth, whose declarations are ESM only; use `nodenext` for CommonJS applications.
 - Each optional entry loads with only its own optional peers installed, and every other entry loads without any optional peer.
 
+Toolchains:
+
+- TypeScript 5.9, the newest 6.x and 7 compile the application, a `node16` CommonJS file that imports only this package, and a principal-kind check in each resolution mode. That check runs once with and once without an import of `./api-key`: `'api-key'` is a `PrincipalKind` only in programs that import it.
+- esbuild bundles the compiled application, including this package and Better Auth, as ESM and as CommonJS, and each bundle authenticates both instances from a directory without `node_modules`. The ESM bundle needs a `createRequire` banner for bundled CommonJS dependencies and `--splitting`: without it, esbuild 0.28 leaves Better Auth's `memoryAdapter`, which Better Auth also imports dynamically, uninitialized. Mark Nest's optional `@nestjs/microservices`, `@nestjs/websockets`, `class-transformer` and `class-validator` external when the application does not install them.
+- `nest build --webpack` compiles the application with the Nest CLI's default webpack configuration, which keeps `node_modules` external, and the build authenticates both instances.
+
+| Setup                                                                                                   | Status                                              |
+| ------------------------------------------------------------------------------------------------------- | --------------------------------------------------- |
+| ESM and CommonJS applications on Node.js 24.11.0 or newer                                               | Supported and tested                                |
+| TypeScript 5.9, 6.x and 7 with `nodenext`, `node16` ESM or `bundler` resolution                         | Supported and tested                                |
+| esbuild ESM bundles with `--splitting`, esbuild CommonJS bundles, `nest build --webpack`                | Supported and tested                                |
+| TypeScript `node16` CommonJS files that import NestJS 12 or Better Auth                                 | Unsupported: their declarations are ESM only        |
+| CommonJS with `--no-experimental-require-module`                                                        | Unsupported: only `./platform` and `./fastify` load |
+| NestJS 11, Better Auth before 1.7.5                                                                     | Unsupported: outside the peer ranges                |
+| TypeScript before 5.9, the Nest CLI's rspack builder, webpack bundles of `node_modules`, other bundlers | Untested                                            |
+
+The packaging tests also inspect the packed archive. It contains only `package.json`, this README, the license and the `dist` files that the export map reaches; source maps name only this package's sources, and runtime maps embed them. Each entry exports exactly the names listed in [`fixtures/public-api.json`](fixtures/public-api.json), and no emitted file has a default export or top-level `await`.
+
 ## Entry points
 
 Every entry ships ESM and CommonJS builds with declarations. The `module-sync` export condition gives Node `import` and `require()` consumers one shared ESM module identity, and optional peers load only through the entry that needs them. The [changelog](CHANGELOG.md) records the version that introduces each entry.
@@ -728,7 +747,7 @@ export class ViewerResolver {
 export class AppModule {}
 ```
 
-For Mercurius, use `MercuriusDriver`, `fastifyPlatform()` from `nestjs-slightly-better-auth/fastify` and `mercuriusTransport()`. `mercuriusSubscriptionContext()` returns a Mercurius `subscription.context` function that keeps the upgrade request and its original browser headers with every socket operation; the socket tests cover Mercurius with and without it. A custom GraphQL `context` must be a function that returns a fresh object for every operation. For Apollo HTTP operations, it keeps the platform request at `context.req`: the Express request, or the Fastify request that the context function receives as its first argument, not that request's `raw` `IncomingMessage`. For Apollo socket operations, it either leaves `context.req` unset, so Nest assigns the graphql-ws context, or keeps graphql-ws's `extra` at `context.extra` and the connection parameters at `context.connectionParams`; the upgrade request alone is not recognized. An operation whose context carries neither fails closed with `AUTH_MISCONFIGURED` (`GRAPHQL_CONTEXT_UNRECOGNIZED`). Startup fails with `GRAPHQL_STATIC_CONTEXT` for a static context object and with `GRAPHQL_DRIVER_MISMATCH` when the transport does not match the configured driver.
+For Mercurius, use `MercuriusDriver`, `fastifyPlatform()` from `nestjs-slightly-better-auth/fastify` and `mercuriusTransport()`. `mercuriusSubscriptionContext()` returns a Mercurius `subscription.context` function that keeps the upgrade request and its original browser headers with every socket operation; the socket tests cover Mercurius with and without it. A custom GraphQL `context` must be a function that returns a fresh object for every operation and every graphql-ws connection; a function that returns a cached object is a configuration error that the transports cannot always detect. An HTTP operation whose context carries an answered request fails closed with `AUTH_MISCONFIGURED` (`GRAPHQL_CONTEXT_STALE_REQUEST`). The Apollo transport classifies an operation's graphql-ws socket once, when the operation starts. When that socket is not open, the operation reads no credential of its connection (connection parameters, cookies, `subscriptionCredentials`, upgrade-request headers or the upgrade-request query string) and runs anonymously: required operations answer the unauthenticated denial, and optional and public operations run without a principal. Its request URL, which principal sources receive as `PrincipalRequest.request` and policies as the context's `request`, is the upgrade URL without its query string or fragment, so a source that authenticates a URL query token finds none; the origin check still reads the connection's handshake, which grants no credential. The transport logs nothing at ERROR for it, because a client that closes its connection while graphql-ws prepares an operation leaves the same socket state. An operation whose socket closes after the operation started keeps its connection's credentials. A cached context of a closed connection therefore authenticates nothing. While the earlier request or connection is still open, its context is indistinguishable from the current operation's own, and the operation authenticates with the earlier caller's credentials, so the fresh-object rule is mandatory. Mercurius socket operations take their context from `subscription.context`, which Mercurius builds for every connection, so the GraphQL `context` option does not carry one connection's socket into another. For Apollo HTTP operations, it keeps the platform request at `context.req`: the Express request, or the Fastify request that the context function receives as its first argument, not that request's `raw` `IncomingMessage`. For Apollo socket operations, it either leaves `context.req` unset, so Nest assigns the graphql-ws context, or keeps graphql-ws's `extra` at `context.extra` and the connection parameters at `context.connectionParams`; the upgrade request alone is not recognized. An operation whose context carries neither fails closed with `AUTH_MISCONFIGURED` (`GRAPHQL_CONTEXT_UNRECOGNIZED`). Startup fails with `GRAPHQL_STATIC_CONTEXT` for a static context object and with `GRAPHQL_DRIVER_MISMATCH` when the transport does not match the configured driver.
 
 ### Operations and fields
 
@@ -948,7 +967,7 @@ Better Auth treats a process with `NODE_ENV=test` or a truthy `TEST` variable (V
 
 The kits verify extension units against the invariants of the [reviewed specification](docs/design/design-v7.md) (§4 and §14.1). Each kit returns `ConformanceCase[]` (`{ id, title, skip?, run() }`) that `runConformance(cases, { describe, it })` registers with Vitest, Jest or `node:test`. Assertions use `node:assert/strict`; the kits import no test runner.
 
-Applicability comes from the unit, not from the options a harness passes. A platform that declares `capabilities.http2` needs the `http2` option. The platform kit's trusted-hop rows need `trustOneProxy`, which trusts one forwarding hop on a created application (Express `app.set("trust proxy", 1)`), or `createTrustingHttpAdapter` (and `http2.createTrustingHttpAdapter` for their HTTP/2 rows), which returns a fresh adapter that already trusts it, for platforms that fix proxy trust at construction (Fastify `new FastifyAdapter({ trustProxy: "loopback" })`; the kit's requests come from loopback). Its microservice rows of `H-no-adapter` need `microservice`, which returns the transport options to boot with (for example `{ transport: Transport.TCP, options: { host: "127.0.0.1", port: 0 } }`); the kit does not load the optional `@nestjs/microservices` peer itself. The production-mode rows set `process.env.NODE_ENV` to `production` while they run and restore it afterwards, so run the kit's cases sequentially. A transport with a lineage needs `invokeTwice`, one that nests handlers (`defaultAccessFor`) needs `invokeGraph`, and one that claims the kit's federation reference resolver needs `invokeEntities`. A transport whose browser leg is a connection's handshake, shared by the connection's messages (the WebSocket transports), runs the `T-ws-origin-*` cases instead of the `T-csrf-*` cases and needs `invokeConnection`, plus `authenticateConnection` when the app provides `WS_CONNECTION_AUTH`. Such a case fails when the helper is missing, and `T-selection` fails `expectBrowserLeg: false` for a transport that describes a browser leg. A transport that nests handlers needs `graphqlContexts` to list `'static'` and `'cached'` for `T-stale-context`, whose cached-context row runs where the browser leg follows each operation; the custom-context rows of `T-subscription-origin` run for the listed `'fresh'` and `'plain-request'` contexts. The `T-subscription-*` cases run when `invocationShapes` includes `'subscriptions'` and need `invokeConnection` with its `connectionParams` option. `T-inherited-handler` runs with `invokeInherited`; harnesses of transports that address a handler by a name one inherited method shares across subclasses (an RPC pattern, a GraphQL root field) omit it, and the case is skipped with the reason. A case whose optional capability is absent is skipped with the reason. The kits read these members from unit objects before running; for classes and `defineExtension()` definitions they boot once and read the resolved unit. A case known to be inapplicable registers with its reason in the test name. A case that finds out at run time resolves with `{ skipped: reason }`, which `runConformance` reports through the runner's `context.skip(reason)` (Vitest, `node:test`; Jest has no runtime skip, so the test passes).
+Applicability comes from the unit, not from the options a harness passes. A platform that declares `capabilities.http2` needs the `http2` option. The platform kit's trusted-hop rows need `trustOneProxy`, which trusts one forwarding hop on a created application (Express `app.set("trust proxy", 1)`), or `createTrustingHttpAdapter` (and `http2.createTrustingHttpAdapter` for their HTTP/2 rows), which returns a fresh adapter that already trusts it, for platforms that fix proxy trust at construction (Fastify `new FastifyAdapter({ trustProxy: "loopback" })`; the kit's requests come from loopback). Its microservice rows of `H-no-adapter` need `microservice`, which returns the transport options to boot with (for example `{ transport: Transport.TCP, options: { host: "127.0.0.1", port: 0 } }`); the kit does not load the optional `@nestjs/microservices` peer itself. The production-mode rows set `process.env.NODE_ENV` to `production` while they run and restore it afterwards, so run the kit's cases sequentially. A transport with a lineage needs `invokeTwice`, one that nests handlers (`defaultAccessFor`) needs `invokeGraph`, and one that claims the kit's federation reference resolver needs `invokeEntities`. A transport whose browser leg is a connection's handshake, shared by the connection's messages (the WebSocket transports), runs the `T-ws-origin-*` cases instead of the `T-csrf-*` cases and needs `invokeConnection`, plus `authenticateConnection` when the app provides `WS_CONNECTION_AUTH`. Such a case fails when the helper is missing, and `T-selection` fails `expectBrowserLeg: false` for a transport that describes a browser leg. A transport that nests handlers needs `graphqlContexts` to list `'static'` and `'cached'` for `T-stale-context`. Its cached-context row closes the first caller's request or connection before a later caller runs. After a completed request, it expects the later caller's own principal or `GRAPHQL_CONTEXT_STALE_REQUEST`. Where the browser leg is a connection's handshake, it runs through `invokeConnection`, which resolves only after the server has observed the connection's close, and expects the later caller's own principal, an anonymous answer or the unauthenticated denial, never the first caller's principal, with nothing logged at ERROR; the custom-context rows of `T-subscription-origin` run for the listed `'fresh'` and `'plain-request'` contexts. The `T-subscription-*` cases run when `invocationShapes` includes `'subscriptions'` and need `invokeConnection` with its `connectionParams` option. `T-inherited-handler` runs with `invokeInherited`; harnesses of transports that address a handler by a name one inherited method shares across subclasses (an RPC pattern, a GraphQL root field) omit it, and the case is skipped with the reason. A case whose optional capability is absent is skipped with the reason. The kits read these members from unit objects before running; for classes and `defineExtension()` definitions they boot once and read the resolved unit. A case known to be inapplicable registers with its reason in the test name. A case that finds out at run time resolves with `{ skipped: reason }`, which `runConformance` reports through the runner's `context.skip(reason)` (Vitest, `node:test`; Jest has no runtime skip, so the test passes).
 
 ```ts
 import { ExpressAdapter } from "@nestjs/platform-express";
@@ -1010,7 +1029,7 @@ The kit sends the probe plugin's trusted `Origin` with every delivered request.
 - `Z-apikey-quota-per-request`, the API-key session setup
 - `Z-admin-banned` on one connection. It runs when `connect` and a positive `connectionPrincipalTtlMs` are present, and first checks that a default-freshness handler reuses the connection's principal after sign-out.
 
-This repository runs the platform kit against Express and Fastify, including the Fastify HTTP/2 adapter for the HTTP/2 rows; the transport kit against the built-in HTTP transport, an in-process reference transport, Socket.IO and `ws` (each with and without a principal TTL), the RPC transport over TCP (standalone and hybrid), gRPC, NATS, RabbitMQ, MQTT, Redis and Kafka, and the Apollo (Express and Fastify) and Mercurius transports over HTTP and over graphql-ws (with and without a subscription principal TTL; Mercurius also without `mercuriusSubscriptionContext()`), with federation 2 subgraphs and a federation 1 run of `T-reference-resolver`; the principal-source kit against the session source (its HTTP-route and `S-bridge-*` rows on Express and Fastify), the API-key source with user-owned and organization-owned keys, and the design's JWT source sketch with derived and explicit claims; and the policy kit against the admin, organization (also with `customSession`), API-key and fresh-session policies. The policy kit's delivery rows run over Socket.IO and `ws` with a 300 s principal TTL, over RPC over TCP (standalone and hybrid), and over the Apollo (Express and Fastify) and Mercurius transports over HTTP and over graphql-ws with a 300 s subscription principal TTL. `Z-admin-null-role` also runs on PGlite with Better Auth's Kysely adapter and migrations. gRPC skips `T-error-shape`, because it delivers only a status and a message. The kit reads each call's browser leg while its invocation runs, because the GraphQL transports reject a completed request. Mutation tests confirm that each of these defects fails the intended case: a platform merging `Set-Cookie`, handing Better Auth no client IP, ignoring its proxy trust, dropping the request host or stripping forwarding headers, a kernel that unbinds hooks on `close()`, reports taking over a closed binding or keeps a microservice's binding open, a transport sharing invocation state across aliases, a transport without a browser leg on safe operations, a `defineExtension()` transport with a lineage or nesting and no helper, a WebSocket transport that enforces its handshake like a safe read, exempts handshakes that carry a token, builds its leg URL from the bare handshake path or from forwarded headers, or answers internal errors with their cause, a GraphQL transport whose aliases share one invocation, whose lineage gives every field of an operation one position, whose field resolvers do not inherit their root's access, or that serves reference resolvers without field guards, a GraphQL harness that omits `invokeGraph`, `invokeEntities` or `invokeConnection`, a transport that claims every context type, runs no metadata canary, claims classes without handlers or drops the `Host` header without declaring hostless calls, a planner that caches plans by handler function, ignores `@SkipOriginCheck()` or skips the origin check of safe operations, a kernel that treats Better Auth's boolean origin skip as its own, a harness that boots without the summary `T-coverage-claims` asks for, an HTTP transport whose invocation is not the handler's request (Fastify), a WebSocket transport whose messages on one socket share their invocation, a GraphQL transport that treats a completed request as live, ignores `connectionParams` credentials, treats socket operations as safe reads, exempts `connectionParams` tokens, serves inherited forwarding fields without field guards, omits `W_FIELD_RESOLVER_INHERITS` or `I_CLASS_METADATA_OPERATIONS_ONLY`, a planner that applies class-level acceptance to field resolvers or records a reading on a form-mode nested public field, a source throwing its denial, a source dropping its refresh cookie, a source turning a storage outage into a 401, API-key sources that report every failure as an invalid key, verify once per call, run without the outage probe or latency signal, probe on every invalid key, touch key rows, or map organization keys to users, a session source that trusts hook answers on authoritative routes, a source that wraps errors without the request's credentials, JWT sources that expect the basePath URL as issuer or deny a key-set outage, sources that drop the host or forwarded headers, a route planner that forwards every handler's direct calls, a `forwardForeignCookies()` without a declaration check or without forwarding, a policy widening delegated principals, a policy turning a lost session or a storage outage into a denial, an organization policy coercing non-string inputs (also over `ws`) or repeating its Better Auth call, admin policies that admit API keys by default, lack fresh identity (also over RPC) or hostless calls, ignore a key owner's ban, judge the session's role or trust the stored user row (also on PGlite), a request scope that reuses a connection's principal for authoritative handlers (Socket.IO, graphql-ws), a WebSocket transport that declares a principal TTL it does not apply, a graphql-ws delivery that opens a new socket for each operation, and boot validation or route planning that ignore request-scoped dependencies or a class policy's `requires` field.
+This repository runs the platform kit against Express and Fastify, including the Fastify HTTP/2 adapter for the HTTP/2 rows; the transport kit against the built-in HTTP transport, an in-process reference transport, Socket.IO and `ws` (each with and without a principal TTL), the RPC transport over TCP (standalone and hybrid), gRPC, NATS, RabbitMQ, MQTT, Redis and Kafka, and the Apollo (Express and Fastify) and Mercurius transports over HTTP and over graphql-ws (with and without a subscription principal TTL; Mercurius also without `mercuriusSubscriptionContext()`), with federation 2 subgraphs and a federation 1 run of `T-reference-resolver`; the principal-source kit against the session source (its HTTP-route and `S-bridge-*` rows on Express and Fastify), the API-key source with user-owned and organization-owned keys, and the design's JWT source sketch with derived and explicit claims; and the policy kit against the admin, organization (also with `customSession`), API-key and fresh-session policies. The policy kit's delivery rows run over Socket.IO and `ws` with a 300 s principal TTL, over RPC over TCP (standalone and hybrid), and over the Apollo (Express and Fastify) and Mercurius transports over HTTP and over graphql-ws with a 300 s subscription principal TTL. `Z-admin-null-role` also runs on PGlite with Better Auth's Kysely adapter and migrations. gRPC skips `T-error-shape`, because it delivers only a status and a message. The kit reads each call's browser leg while its invocation runs, because the GraphQL transports reject a completed request. Mutation tests confirm that each of these defects fails the intended case: a platform merging `Set-Cookie`, handing Better Auth no client IP, ignoring its proxy trust, dropping the request host or stripping forwarding headers, a kernel that unbinds hooks on `close()`, reports taking over a closed binding or keeps a microservice's binding open, a transport sharing invocation state across aliases, a transport without a browser leg on safe operations, a `defineExtension()` transport with a lineage or nesting and no helper, a WebSocket transport that enforces its handshake like a safe read, exempts handshakes that carry a token, builds its leg URL from the bare handshake path or from forwarded headers, or answers internal errors with their cause, a GraphQL transport whose aliases share one invocation, whose lineage gives every field of an operation one position, whose field resolvers do not inherit their root's access, or that serves reference resolvers without field guards, a GraphQL harness that omits `invokeGraph`, `invokeEntities` or `invokeConnection`, a transport that claims every context type, runs no metadata canary, claims classes without handlers or drops the `Host` header without declaring hostless calls, a planner that caches plans by handler function, ignores `@SkipOriginCheck()` or skips the origin check of safe operations, a kernel that treats Better Auth's boolean origin skip as its own, a harness that boots without the summary `T-coverage-claims` asks for, an HTTP transport whose invocation is not the handler's request (Fastify), a WebSocket transport whose messages on one socket share their invocation, a GraphQL transport that treats a completed request as live or keeps using the credentials of a graphql-ws connection that closed before an operation started, ignores `connectionParams` credentials, treats socket operations as safe reads, exempts `connectionParams` tokens, serves inherited forwarding fields without field guards, omits `W_FIELD_RESOLVER_INHERITS` or `I_CLASS_METADATA_OPERATIONS_ONLY`, a planner that applies class-level acceptance to field resolvers or records a reading on a form-mode nested public field, a source throwing its denial, a source dropping its refresh cookie, a source turning a storage outage into a 401, API-key sources that report every failure as an invalid key, verify once per call, run without the outage probe or latency signal, probe on every invalid key, touch key rows, or map organization keys to users, a session source that trusts hook answers on authoritative routes, a source that wraps errors without the request's credentials, JWT sources that expect the basePath URL as issuer or deny a key-set outage, sources that drop the host or forwarded headers, a route planner that forwards every handler's direct calls, a `forwardForeignCookies()` without a declaration check or without forwarding, a policy widening delegated principals, a policy turning a lost session or a storage outage into a denial, an organization policy coercing non-string inputs (also over `ws`) or repeating its Better Auth call, admin policies that admit API keys by default, lack fresh identity (also over RPC) or hostless calls, ignore a key owner's ban, judge the session's role or trust the stored user row (also on PGlite), a request scope that reuses a connection's principal for authoritative handlers (Socket.IO, graphql-ws), a WebSocket transport that declares a principal TTL it does not apply, a graphql-ws delivery that opens a new socket for each operation, and boot validation or route planning that ignore request-scoped dependencies or a class policy's `requires` field.
 
 ## Develop in this monorepo
 

package/dist/graphql.cjs

@@ -115,17 +115,61 @@ function upgrade(value) {
 	const candidate = record(value);
 	return candidate && record(candidate.headers) ? candidate : void 0;
 }
+/** The WebSocket of a graphql-ws `extra` ({ socket, request }): a socket with function-typed send and close. */
+function graphqlWsSocket(value) {
+	const socket = record(record(value)?.socket);
+	return socket && typeof socket.send === "function" && typeof socket.close === "function" ? socket : void 0;
+}
 /**
 * The upgrade request of a graphql-ws `extra` ({ socket, request }) whose socket is a
 * WebSocket. Only the graphql-ws server creates that pair; parsed request data cannot carry
 * functions, so a client-sent header or field never selects the socket path. The socket's
-* state is deliberately ignored: a connection closing during authentication stays a socket
-* operation instead of turning into an unrecognized context.
+* state does not change this recognition: the transport classifies it once per operation
+* (GraphqlTransport.openAtStart).
 */
 function graphqlWsUpgrade(value) {
-	const extra = record(value);
-	const socket = record(extra?.socket);
-	return socket && typeof socket.send === "function" && typeof socket.close === "function" ? upgrade(extra?.request) : void 0;
+	return graphqlWsSocket(value) ? upgrade(record(value)?.request) : void 0;
+}
+/** WebSocket.OPEN of the `ws` sockets that Nest's graphql-ws server creates. */
+const WEBSOCKET_OPEN = 1;
+/** Upgrade-request headers that locate the server for Better Auth; none of them is a credential. */
+const HOST_METADATA = [
+	"host",
+	"x-forwarded-host",
+	"x-forwarded-proto"
+];
+/**
+* The upgrade request's URL without the target's query string and fragment. A query string can
+* carry a connection's credential (`?access_token=`), which an operation that reads no credential
+* of its connection must not expose to principal sources or policies.
+*/
+function upgradePathUrl(request) {
+	const target = request.url ?? "/";
+	const end = target.search(/[?#]/);
+	return require_platform.upgradeRequestUrl({
+		headers: request.headers,
+		url: end === -1 ? target : target.slice(0, end),
+		secure: request.secure,
+		socket: request.socket
+	});
+}
+/** Copies the host metadata of `ambient` into `into` where `into` has none of its own. */
+function withHostMetadata(into, ambient) {
+	for (const name of HOST_METADATA) {
+		const value = ambient.get(name);
+		if (!into.has(name) && value !== null) into.set(name, value);
+	}
+	return into;
+}
+/**
+* The identity of one GraphQL execution, shared by every resolver of that execution. graphql-js
+* coerces the variable values into a fresh object for every execution, including one
+* subscription and its events; a parsed operation can be cached across executions, so it
+* serves only as the fallback.
+*/
+function executionOf(info) {
+	const value = record(info);
+	return record(value?.variableValues) ?? record(value?.operation);
 }
 function ambientHeaders(request) {
 	const value = record(request);
@@ -153,7 +197,8 @@ function carrierDetails(context, driver, http) {
 	const extra = record(carrier.extra);
 	const httpRequest = driver === "apollo" ? http?.isRequest(req) === true || http?.isRequest(extra?.request) === true : platformReply(http, carrier.reply);
 	const wsContext = driver === "apollo" && !httpRequest && graphqlWsUpgrade(req?.extra) ? req : void 0;
-	const socket = httpRequest ? void 0 : driver === "apollo" ? graphqlWsUpgrade(wsContext ? wsContext.extra : extra) : upgrade(carrier[MERCURIUS_UPGRADE]) ?? ("_connectionInit" in carrier ? upgrade(carrier.request) ?? upgrade(record(carrier.reply)?.request) ?? upgrade(carrier.req) : void 0);
+	const wsExtra = driver === "apollo" && !httpRequest ? wsContext ? wsContext.extra : extra : void 0;
+	const socket = httpRequest ? void 0 : driver === "apollo" ? graphqlWsUpgrade(wsExtra) : upgrade(carrier[MERCURIUS_UPGRADE]) ?? ("_connectionInit" in carrier ? upgrade(carrier.request) ?? upgrade(record(carrier.reply)?.request) ?? upgrade(carrier.req) : void 0);
 	const connection = wsContext ? req : carrier;
 	const params = record(wsContext ? req?.connectionParams : carrier.connectionParams ?? carrier._connectionInit);
 	const request = driver === "apollo" ? carrier.req : record(carrier.reply)?.request ?? carrier.req;
@@ -161,6 +206,7 @@ function carrierDetails(context, driver, http) {
 	return {
 		carrier,
 		socket,
+		webSocket: socket ? graphqlWsSocket(wsExtra) : void 0,
 		connection,
 		params,
 		request,
@@ -176,6 +222,8 @@ var GraphqlTransport = class {
 	plans = [];
 	enhancerAdvice;
 	filterAdvice;
+	/** Whether each execution's graphql-ws socket was open when the execution first reached the transport. */
+	socketsAtStart = /* @__PURE__ */ new WeakMap();
 	constructor(id, options) {
 		this.id = id;
 		this.options = options;
@@ -193,18 +241,38 @@ var GraphqlTransport = class {
 		return typeof handler === "function" && !Reflect.getMetadata(_nestjs_graphql.RESOLVER_REFERENCE_METADATA, handler) && Reflect.getMetadata(_nestjs_graphql.RESOLVER_PROPERTY_METADATA, handler) ? "inherit" : void 0;
 	}
 	lineage(context) {
+		const args = context.getArgs();
+		const normalized = graphqlArgs(args);
+		this.openAtStart(carrierDetails(normalized.context, this.id, this.kit?.http ?? null).webSocket, normalized.info);
 		return {
-			...graphqlLineage(context.getArgs(), this.reference(context)),
+			...graphqlLineage(args, this.reference(context)),
 			assertReadable: (args) => {
 				if (this.kit) this.assertRequest(args, this.kit);
 			}
 		};
 	}
+	/**
+	* Whether the operation's graphql-ws socket was open when the operation started. The first
+	* classification of an execution holds for every later reader of it, so a connection that
+	* closes during authentication keeps its credentials. A socket that is not open when an
+	* operation starts belongs either to a connection that closed while graphql-ws prepared the
+	* operation or to an earlier connection that a cached context carries; its state cannot tell
+	* the two apart, so the operation reads no credential of that connection in either case.
+	*/
+	openAtStart(webSocket, info) {
+		if (!webSocket) return true;
+		const execution = executionOf(info);
+		const known = execution ? this.socketsAtStart.get(execution) : void 0;
+		if (known !== void 0) return known;
+		const open = webSocket.readyState === WEBSOCKET_OPEN;
+		if (execution) this.socketsAtStart.set(execution, open);
+		return open;
+	}
 	assertRequest(args, kit) {
 		const details = carrierDetails(graphqlArgs(args).context, this.id, kit.http);
 		if (details.socket) return details;
 		if (!kit.http?.isRequest(details.request)) throw require_auth_errors.BetterAuthConfigurationError.atRequest("GRAPHQL_CONTEXT_UNRECOGNIZED", "GraphQL context has no recognized platform or upgrade request", { hint: "Keep the native request at context.req or context.extra.request; use mercuriusSubscriptionContext() for Mercurius sockets." });
-		if (!kit.http.isLive(details.request)) throw require_auth_errors.BetterAuthConfigurationError.atRequest("GRAPHQL_CONTEXT_STALE_REQUEST", "GraphQL context contains a completed request", { hint: "Return a fresh context object for every operation." });
+		if (!kit.http.isLive(details.request)) throw require_auth_errors.BetterAuthConfigurationError.atRequest("GRAPHQL_CONTEXT_STALE_REQUEST", "GraphQL context contains a completed request", { hint: "Return a fresh context object for every operation and every graphql-ws connection." });
 		return details;
 	}
 	describe(context, kit) {
@@ -212,12 +280,14 @@ var GraphqlTransport = class {
 		const args = context.getArgs();
 		const normalized = graphqlArgs(args);
 		const initial = carrierDetails(normalized.context, this.id, kit.http);
-		const key = !initial.socket && kit.http?.isRequest(initial.request) ? kit.http.key(initial.request) : normalized.context;
+		const open = this.openAtStart(initial.webSocket, normalized.info);
+		const key = !initial.socket && kit.http?.isRequest(initial.request) ? kit.http.key(initial.request) : open ? normalized.context : executionOf(normalized.info) ?? args;
 		const checked = () => this.assertRequest(args, kit);
 		const headers = () => {
 			const details = checked();
 			if (!details.socket) return kit.http.headers(details.request);
 			const ambient = details.ambient();
+			if (!open) return withHostMetadata(new Headers(), ambient);
 			if (this.options.subscriptionCredentials) {
 				const input = this.options.subscriptionCredentials(details.connection);
 				let mapped;
@@ -229,15 +299,7 @@ var GraphqlTransport = class {
 						reason: "MALFORMED_CREDENTIALS"
 					});
 				}
-				for (const name of [
-					"host",
-					"x-forwarded-host",
-					"x-forwarded-proto"
-				]) {
-					const value = ambient.get(name);
-					if (!mapped.has(name) && value !== null) mapped.set(name, value);
-				}
-				return mapped;
+				return withHostMetadata(mapped, ambient);
 			}
 			const credentials = new Headers(ambient);
 			const allow = new Set((this.options.connectionParamHeaders ?? ["authorization", "cookie"]).map((name) => name.toLowerCase()));
@@ -262,7 +324,7 @@ var GraphqlTransport = class {
 			key,
 			invocation: graphqlInvocation(args, this.reference(context)),
 			lineage: this.lineage(context),
-			...initial.socket ? {
+			...initial.socket && open ? {
 				connection: initial.socket,
 				principalTtlMs: this.connectionTtlMs
 			} : {},
@@ -277,10 +339,11 @@ var GraphqlTransport = class {
 			},
 			get request() {
 				const details = checked();
-				return details.socket ? {
+				if (!details.socket) return kit.http.request(details.request);
+				return {
 					method: "GET",
-					url: require_platform.upgradeRequestUrl(details.socket)
-				} : kit.http.request(details.request);
+					url: open ? require_platform.upgradeRequestUrl(details.socket) : upgradePathUrl(details.socket)
+				};
 			},
 			param: (name) => (this.reference(context) ? normalized.root?.[name] : normalized.args?.[name]) ?? (!initial.socket && kit.http?.isRequest(initial.request) ? kit.http.param(initial.request, name) : void 0),
 			get browser() {

package/dist/graphql.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"graphql.cjs","names":["IntrinsicException","isConfigurationError","toWebHeaders","BetterAuthConfigurationError","RESOLVER_REFERENCE_METADATA","RESOLVER_PROPERTY_METADATA","AuthFailures","upgradeRequestUrl","GRAPHQL_MODULE_OPTIONS","Query","RESOLVER_TYPE_METADATA","ResolveField","ResolveReference","PARAM_ARGS_METADATA","MetadataScanner","ApplicationConfig","BetterAuthGuard","BetterAuthScopeInterceptor","AUTH_ENHANCER","ACCESS_METADATA","ACCEPT_PRINCIPALS_METADATA","REQUIREMENTS_METADATA"],"sources":["../src/graphql-lineage.ts","../src/graphql-transport.ts"],"sourcesContent":["import type { InvocationLineage } from \"./auth-contracts.js\";\n\nconst OPERATIONS = Symbol.for(\"nestjs-slightly-better-auth:graphql-operations\");\ninterface Path {\n  readonly key: string | number;\n  readonly prev?: Path;\n  readonly typename?: string;\n}\nexport interface GraphInfo {\n  readonly operation: object & { operation?: string };\n  readonly path: Path;\n}\nexport function record(\n  value: unknown,\n): Record<PropertyKey, unknown> | undefined {\n  return typeof value === \"object\" && value !== null\n    ? (value as Record<PropertyKey, unknown>)\n    : undefined;\n}\n/** Apollo reference resolvers omit the argument object; parameter readers see the original array. */\nexport function graphqlArgs(args: readonly unknown[]) {\n  const reference = args.length === 3;\n  return {\n    root: record(args[0]),\n    args: reference ? undefined : record(args[1]),\n    context: record(args[reference ? 1 : 2]) ?? args,\n    info: record(args[reference ? 2 : 3]) as unknown as GraphInfo | undefined,\n  };\n}\ninterface Operation {\n  id: number;\n  references: Set<string>;\n}\nfunction operationState(carrier: object, operation: object): Operation {\n  let operations = Reflect.get(carrier, OPERATIONS) as\n    | Map<object, Operation>\n    | undefined;\n  if (!operations) {\n    operations = new Map();\n    Object.defineProperty(carrier, OPERATIONS, { value: operations });\n  }\n  let state = operations.get(operation);\n  if (state === undefined) {\n    state = { id: operations.size + 1, references: new Set() };\n    operations.set(operation, state);\n  }\n  return state;\n}\nfunction keys(path: Path | undefined): (string | number)[] {\n  return path ? [...keys(path.prev), path.key] : [];\n}\nfunction position(id: number, path: Path | undefined): string {\n  return `${id}:${JSON.stringify(keys(path))}`;\n}\nexport function graphqlInvocation(\n  args: readonly unknown[],\n  reference = false,\n): object {\n  const normalized = graphqlArgs(args);\n  return (reference ? normalized.root : normalized.info) ?? args;\n}\nexport function graphqlLineage(\n  args: readonly unknown[],\n  reference = false,\n): InvocationLineage {\n  const normalized = graphqlArgs(args);\n  const carrier = normalized.context;\n  const state = operationState(carrier, normalized.info?.operation ?? carrier);\n  const { id } = state;\n  if (reference) {\n    state.references.add(JSON.stringify(keys(normalized.info?.path)));\n  }\n  return {\n    carrier,\n    position: reference\n      ? `${id}:_entities#${String(normalized.root?.__typename ?? \"\")}`\n      : position(id, normalized.info?.path),\n    *enclosing(currentArgs) {\n      const current = graphqlArgs(currentArgs);\n      const operation = operationState(\n        current.context,\n        current.info?.operation ?? current.context,\n      );\n      const path = current.info?.path;\n      for (\n        let child = path, parent = path?.prev;\n        parent;\n        child = parent, parent = parent.prev\n      ) {\n        // The child path supplies the concrete entity type below the list index.\n        if (\n          typeof parent.key === \"number\" &&\n          parent.prev &&\n          (parent.prev.key === \"_entities\" ||\n            operation.references.has(JSON.stringify(keys(parent.prev))))\n        ) {\n          yield `${operation.id}:_entities#${child?.typename ?? String(current.root?.__typename ?? \"\")}`;\n        }\n        yield position(operation.id, parent);\n      }\n    },\n  };\n}\n","import type { IncomingHttpHeaders } from \"node:http\";\nimport { type ExecutionContext, IntrinsicException } from \"@nestjs/common\";\nimport { ApplicationConfig, MetadataScanner } from \"@nestjs/core\";\nimport {\n  Args,\n  GRAPHQL_MODULE_OPTIONS,\n  PARAM_ARGS_METADATA,\n  RESOLVER_PROPERTY_METADATA,\n  RESOLVER_REFERENCE_METADATA,\n  RESOLVER_TYPE_METADATA,\n  Query,\n  ResolveField,\n  ResolveReference,\n} from \"@nestjs/graphql\";\nimport type {\n  AuthTransport,\n  BootAdvice,\n  BootAdviceContext,\n  ExtensionRef,\n  RoutePlan,\n  TransportCall,\n  TransportKit,\n  TransportValidationContext,\n} from \"./auth-contracts.js\";\nimport {\n  BetterAuthConfigurationError,\n  AuthFailures,\n  isConfigurationError,\n} from \"./auth-errors.js\";\nimport type {\n  AuthFailure,\n  AuthGraphqlExtensions,\n  BetterAuthInfrastructureError,\n} from \"./auth-errors.js\";\nimport { BetterAuthGuard } from \"./auth-guard.js\";\nimport { BetterAuthScopeInterceptor } from \"./auth-scope-interceptor.js\";\nimport {\n  AUTH_ENHANCER,\n  ACCESS_METADATA,\n  ACCEPT_PRINCIPALS_METADATA,\n  REQUIREMENTS_METADATA,\n} from \"./auth-tokens.js\";\nimport {\n  graphqlArgs,\n  graphqlInvocation,\n  graphqlLineage,\n  record,\n} from \"./graphql-lineage.js\";\nimport { toWebHeaders, upgradeRequestUrl } from \"./platform.js\";\n\nconst MERCURIUS_AMBIENT = Symbol.for(\n  \"nestjs-slightly-better-auth:mercurius-ambient\",\n);\nconst MERCURIUS_UPGRADE = Symbol.for(\n  \"nestjs-slightly-better-auth:mercurius-upgrade\",\n);\nexport interface GraphqlTransportOptions {\n  /** Case-insensitive connection-init credential keys; defaults to authorization and cookie. */\n  connectionParamHeaders?: readonly string[];\n  /**\n   * Replaces socket credentials, preserving absent host and forwarded-host/proto headers.\n   * Returning undefined presents no credentials: neither connectionParamHeaders nor the\n   * upgrade request's credential headers are used.\n   */\n  subscriptionCredentials?: (\n    connectionContext: unknown,\n  ) => HeadersInit | undefined;\n  /** Connection principal reuse; zero by default. Authoritative plans bypass the TTL. */\n  subscriptionPrincipalTtlMs?: number;\n  fieldResolverCoverage?: \"error\" | \"warn\" | \"off\";\n  federationCoverage?: \"error\" | \"warn\" | \"off\";\n}\nexport class BetterAuthGraphqlDenial extends IntrinsicException {\n  readonly extensions: AuthGraphqlExtensions;\n\n  constructor(failure: AuthFailure) {\n    super(failure.message);\n    this.extensions = {\n      code: failure.code,\n      statusCode: failure.status,\n      ...(failure.reason ? { reason: failure.reason } : {}),\n    };\n  }\n}\nfunction internalExtensions(\n  error: BetterAuthInfrastructureError | BetterAuthConfigurationError,\n): AuthGraphqlExtensions {\n  return {\n    code: \"INTERNAL_SERVER_ERROR\",\n    reason: isConfigurationError(error)\n      ? \"AUTH_MISCONFIGURED\"\n      : \"AUTH_UNAVAILABLE\",\n    statusCode: 500,\n  };\n}\nexport class BetterAuthGraphqlInternalError extends Error {\n  readonly extensions: AuthGraphqlExtensions;\n\n  constructor(\n    error: BetterAuthInfrastructureError | BetterAuthConfigurationError,\n  ) {\n    super(\"Internal server error\", { cause: error });\n    this.extensions = internalExtensions(error);\n  }\n}\nexport class BetterAuthGraphqlRepeatedInternalError extends IntrinsicException {\n  readonly extensions: AuthGraphqlExtensions;\n\n  constructor(\n    error: BetterAuthInfrastructureError | BetterAuthConfigurationError,\n  ) {\n    super(\"Internal server error\", { cause: error });\n    this.extensions = internalExtensions(error);\n  }\n}\n/** Keeps the upgrade request and its original browser headers across Mercurius operation spreads. */\nexport function mercuriusSubscriptionContext() {\n  return (\n    _connection: unknown,\n    request: { headers: Record<string, unknown> },\n  ): Record<string | symbol, unknown> => ({\n    [MERCURIUS_UPGRADE]: request,\n    [MERCURIUS_AMBIENT]: ambientHeaders(request),\n  });\n}\ninterface Upgrade {\n  headers: IncomingHttpHeaders;\n  url?: string;\n  socket?: { encrypted?: boolean };\n}\nfunction upgrade(value: unknown): Upgrade | undefined {\n  const candidate = record(value);\n  return candidate && record(candidate.headers)\n    ? (candidate as unknown as Upgrade)\n    : undefined;\n}\n/**\n * The upgrade request of a graphql-ws `extra` ({ socket, request }) whose socket is a\n * WebSocket. Only the graphql-ws server creates that pair; parsed request data cannot carry\n * functions, so a client-sent header or field never selects the socket path. The socket's\n * state is deliberately ignored: a connection closing during authentication stays a socket\n * operation instead of turning into an unrecognized context.\n */\nfunction graphqlWsUpgrade(value: unknown): Upgrade | undefined {\n  const extra = record(value);\n  const socket = record(extra?.socket);\n  return socket &&\n    typeof socket.send === \"function\" &&\n    typeof socket.close === \"function\"\n    ? upgrade(extra?.request)\n    : undefined;\n}\nfunction ambientHeaders(request: unknown): Headers {\n  const value = record(request);\n  const raw = record(value?.raw) ?? value;\n  // Mercurius copies connection-init values into missing request.headers keys.\n  // Node rawHeaders retains the actual browser leg even after that mutation.\n  const rawHeaders = raw?.rawHeaders;\n  if (Array.isArray(rawHeaders)) {\n    const headers = new Headers();\n    for (let index = 0; index + 1 < rawHeaders.length; index += 2) {\n      if (\n        typeof rawHeaders[index] === \"string\" &&\n        typeof rawHeaders[index + 1] === \"string\"\n      ) {\n        headers.append(rawHeaders[index], rawHeaders[index + 1]);\n      }\n    }\n    return headers;\n  }\n  return toWebHeaders((value?.headers ?? {}) as IncomingHttpHeaders);\n}\n/**\n * Mercurius assigns the route's Fastify reply to context.reply for HTTP operations. Its\n * subscription contexts carry the platform-recognized upgrade request inside a plain reply\n * object instead, so the reply's identity, not the request alone, marks an HTTP operation.\n */\nfunction platformReply(http: TransportKit[\"http\"], value: unknown): boolean {\n  const request = record(value)?.request;\n  if (http?.isRequest(request) !== true) {\n    return false;\n  }\n  return http.responseFor ? http.responseFor(request) === value : true;\n}\nfunction carrierDetails(\n  context: unknown,\n  driver: \"apollo\" | \"mercurius\",\n  http: TransportKit[\"http\"],\n) {\n  const carrier = record(context) ?? {};\n  const req = record(carrier.req);\n  const extra = record(carrier.extra);\n  // A positive platform answer keeps the HTTP path and its liveness check, before any socket\n  // heuristic: a custom context can spread client data such as _connectionInit into its root.\n  const httpRequest =\n    driver === \"apollo\"\n      ? http?.isRequest(req) === true ||\n        http?.isRequest(extra?.request) === true\n      : platformReply(http, carrier.reply);\n  // Nest assigns the graphql-ws Context to context.req unless a custom context sets req. Its\n  // server-created extra identifies it: graphql-ws sets connectionParams only for an object\n  // connection_init payload, and an absent payload presents no connection credentials.\n  const wsContext =\n    driver === \"apollo\" && !httpRequest && graphqlWsUpgrade(req?.extra)\n      ? req\n      : undefined;\n  const socket = httpRequest\n    ? undefined\n    : driver === \"apollo\"\n      ? graphqlWsUpgrade(wsContext ? wsContext.extra : extra)\n      : (upgrade(carrier[MERCURIUS_UPGRADE]) ??\n        (\"_connectionInit\" in carrier\n          ? (upgrade(carrier.request) ??\n            upgrade(record(carrier.reply)?.request) ??\n            upgrade(carrier.req))\n          : undefined));\n  const connection = wsContext ? req : carrier;\n  const params = record(\n    wsContext\n      ? req?.connectionParams\n      : (carrier.connectionParams ?? carrier._connectionInit),\n  );\n  const request =\n    driver === \"apollo\"\n      ? carrier.req\n      : (record(carrier.reply)?.request ?? carrier.req);\n  const ambient = () =>\n    carrier[MERCURIUS_AMBIENT] instanceof Headers\n      ? new Headers(carrier[MERCURIUS_AMBIENT])\n      : ambientHeaders(socket);\n  return { carrier, socket, connection, params, request, ambient };\n}\nclass GraphqlTransport implements AuthTransport {\n  readonly requires = { hostlessCalls: false };\n  readonly connectionTtlMs: number;\n  private kit?: TransportKit;\n  private plans: {\n    plan: RoutePlan;\n    field: boolean;\n    reference: boolean;\n    target: object;\n    method: string;\n  }[] = [];\n  private enhancerAdvice?: BootAdvice;\n  private filterAdvice?: BootAdvice;\n\n  constructor(\n    readonly id: \"apollo\" | \"mercurius\",\n    private readonly options: GraphqlTransportOptions,\n  ) {\n    this.connectionTtlMs = options.subscriptionPrincipalTtlMs ?? 0;\n    if (!Number.isFinite(this.connectionTtlMs) || this.connectionTtlMs < 0) {\n      throw new BetterAuthConfigurationError(\n        \"INVALID_SUBSCRIPTION_TTL\",\n        \"subscriptionPrincipalTtlMs must be a finite nonnegative number\",\n      );\n    }\n  }\n\n  handles(context: ExecutionContext): boolean {\n    return context.getType<string>() === \"graphql\";\n  }\n\n  private reference(context: ExecutionContext): boolean {\n    return (\n      Reflect.getMetadata(RESOLVER_REFERENCE_METADATA, context.getHandler()) ===\n      true\n    );\n  }\n\n  defaultAccessFor(target: object, method: string): \"inherit\" | undefined {\n    const handler = Reflect.get(\n      Reflect.get(target, \"prototype\") ?? target,\n      method,\n    );\n    return typeof handler === \"function\" &&\n      !Reflect.getMetadata(RESOLVER_REFERENCE_METADATA, handler) &&\n      Reflect.getMetadata(RESOLVER_PROPERTY_METADATA, handler)\n      ? \"inherit\"\n      : undefined;\n  }\n\n  lineage(context: ExecutionContext) {\n    return {\n      ...graphqlLineage(context.getArgs(), this.reference(context)),\n      assertReadable: (args: readonly unknown[]) => {\n        if (this.kit) {\n          this.assertRequest(args, this.kit);\n        }\n      },\n    };\n  }\n\n  private assertRequest(args: readonly unknown[], kit: TransportKit) {\n    const details = carrierDetails(\n      graphqlArgs(args).context,\n      this.id,\n      kit.http,\n    );\n    if (details.socket) {\n      return details;\n    }\n    if (!kit.http?.isRequest(details.request)) {\n      throw BetterAuthConfigurationError.atRequest(\n        \"GRAPHQL_CONTEXT_UNRECOGNIZED\",\n        \"GraphQL context has no recognized platform or upgrade request\",\n        {\n          hint: \"Keep the native request at context.req or context.extra.request; use mercuriusSubscriptionContext() for Mercurius sockets.\",\n        },\n      );\n    }\n    if (!kit.http.isLive(details.request)) {\n      throw BetterAuthConfigurationError.atRequest(\n        \"GRAPHQL_CONTEXT_STALE_REQUEST\",\n        \"GraphQL context contains a completed request\",\n        { hint: \"Return a fresh context object for every operation.\" },\n      );\n    }\n    return details;\n  }\n\n  describe(context: ExecutionContext, kit: TransportKit): TransportCall {\n    this.kit = kit;\n    const args = context.getArgs();\n    const normalized = graphqlArgs(args);\n    const initial = carrierDetails(normalized.context, this.id, kit.http);\n    const key =\n      !initial.socket && kit.http?.isRequest(initial.request)\n        ? kit.http.key(initial.request)\n        : normalized.context;\n    const checked = () => this.assertRequest(args, kit);\n    const headers = () => {\n      const details = checked();\n      if (!details.socket) {\n        return kit.http!.headers(details.request);\n      }\n      const ambient = details.ambient();\n      if (this.options.subscriptionCredentials) {\n        // Keep callback errors outside the conversion boundary: application\n        // programming failures are not malformed credential denials.\n        const input = this.options.subscriptionCredentials(details.connection);\n        let mapped: Headers;\n        try {\n          mapped = new Headers(input);\n        } catch {\n          // Web Headers errors embed rejected values, including server secrets.\n          // Discard the exception entirely; never retain its message or cause.\n          throw AuthFailures.rejected({\n            status: 401,\n            reason: \"MALFORMED_CREDENTIALS\",\n          });\n        }\n        for (const name of [\"host\", \"x-forwarded-host\", \"x-forwarded-proto\"]) {\n          const value = ambient.get(name);\n          if (!mapped.has(name) && value !== null) {\n            mapped.set(name, value);\n          }\n        }\n        return mapped;\n      }\n      const credentials = new Headers(ambient);\n      const allow = new Set(\n        (\n          this.options.connectionParamHeaders ?? [\"authorization\", \"cookie\"]\n        ).map((name) => name.toLowerCase()),\n      );\n      for (const [name, value] of Object.entries(details.params ?? {})) {\n        if (!allow.has(name.toLowerCase())) {\n          continue;\n        }\n        if (typeof value !== \"string\" || /[\\r\\n\\0]/.test(value)) {\n          throw AuthFailures.rejected({\n            status: 401,\n            reason: \"MALFORMED_CREDENTIALS\",\n          });\n        }\n        try {\n          credentials.set(name, value);\n        } catch {\n          // One malformed selected credential rejects the whole extraction,\n          // without falling back to another credential or exposing its value.\n          throw AuthFailures.rejected({\n            status: 401,\n            reason: \"MALFORMED_CREDENTIALS\",\n          });\n        }\n      }\n      return credentials;\n    };\n    return {\n      key,\n      invocation: graphqlInvocation(args, this.reference(context)),\n      lineage: this.lineage(context),\n      ...(initial.socket\n        ? { connection: initial.socket, principalTtlMs: this.connectionTtlMs }\n        : {}),\n      headers,\n      get clientIp() {\n        const details = checked();\n        return details.socket ? null : kit.http!.clientIp(details.request);\n      },\n      get cookies() {\n        const details = checked();\n        return details.socket\n          ? null\n          : kit.http!.cookieSink(\n              details.request,\n              details.carrier.reply ??\n                record(details.request)?.res ??\n                kit.http!.responseFor?.(details.request),\n            );\n      },\n      get request() {\n        const details = checked();\n        return details.socket\n          ? { method: \"GET\", url: upgradeRequestUrl(details.socket) }\n          : kit.http!.request(details.request);\n      },\n      param: (name) =>\n        (this.reference(context)\n          ? normalized.root?.[name]\n          : normalized.args?.[name]) ??\n        (!initial.socket && kit.http?.isRequest(initial.request)\n          ? kit.http.param(initial.request, name)\n          : undefined),\n      get browser() {\n        const details = checked();\n        return details.socket\n          ? {\n              enforce: true,\n              headers: details.ambient,\n              url: upgradeRequestUrl(details.socket),\n              key: details.socket,\n            }\n          : {\n              enforce: normalized.info?.operation.operation === \"mutation\",\n              headers: () => kit.http!.headers(details.request),\n              url: kit.http!.request(details.request).url,\n              key,\n            };\n      },\n    };\n  }\n\n  toException(failure: AuthFailure): unknown {\n    return new BetterAuthGraphqlDenial(failure);\n  }\n\n  toInternalException(\n    error: BetterAuthInfrastructureError | BetterAuthConfigurationError,\n    _context: ExecutionContext,\n    info: { repeated: boolean },\n  ): unknown {\n    return info.repeated\n      ? new BetterAuthGraphqlRepeatedInternalError(error)\n      : new BetterAuthGraphqlInternalError(error);\n  }\n\n  validate(context: TransportValidationContext): void {\n    const options = context.moduleRef.get<{\n      driver?: object;\n      context?: unknown;\n      fieldResolverEnhancers?: string[];\n    }>(GRAPHQL_MODULE_OPTIONS, { strict: false });\n    const names: string[] = [];\n    for (\n      let driver = options.driver;\n      typeof driver === \"function\";\n      driver = Object.getPrototypeOf(driver)\n    ) {\n      names.push(driver.name);\n    }\n    if (\n      names.some((name) =>\n        name.startsWith(this.id === \"apollo\" ? \"Mercurius\" : \"Apollo\"),\n      )\n    ) {\n      throw new BetterAuthConfigurationError(\n        \"GRAPHQL_DRIVER_MISMATCH\",\n        `${this.id} transport does not match ${names.join(\" / \")}`,\n      );\n    }\n    if (\n      options.context !== undefined &&\n      typeof options.context !== \"function\"\n    ) {\n      throw new BetterAuthConfigurationError(\n        \"GRAPHQL_STATIC_CONTEXT\",\n        \"GraphQL context must be a function returning a fresh object\",\n        \"context: ({ req }) => ({ req, loaders: createLoaders() })\",\n      );\n    }\n    class Probe {\n      query() {}\n      field() {}\n      reference() {}\n    }\n    for (const [name, decorator, key] of [\n      [\"query\", Query(() => String), RESOLVER_TYPE_METADATA],\n      [\"field\", ResolveField(() => String), RESOLVER_PROPERTY_METADATA],\n      [\"reference\", ResolveReference(), RESOLVER_REFERENCE_METADATA],\n    ] as const) {\n      decorator(\n        Probe.prototype,\n        name,\n        Object.getOwnPropertyDescriptor(Probe.prototype, name)!,\n      );\n      if (!Reflect.getMetadata(key, Probe.prototype[name])) {\n        throw new BetterAuthConfigurationError(\n          \"NEST_METADATA_KEY_CHANGED\",\n          `GraphQL metadata canary failed: ${key}`,\n        );\n      }\n    }\n    Args(\"probe\", { type: () => String })(Probe.prototype, \"query\", 0);\n    const argumentMetadata = record(\n      Reflect.getMetadata(PARAM_ARGS_METADATA, Probe, \"query\"),\n    );\n    if (\n      !argumentMetadata ||\n      !Object.entries(argumentMetadata).some(\n        ([key, value]) =>\n          key.startsWith(\"3:\") && record(value)?.data === \"probe\",\n      )\n    ) {\n      throw new BetterAuthConfigurationError(\n        \"NEST_METADATA_KEY_CHANGED\",\n        \"GraphQL argument metadata failed its parameter canary\",\n      );\n    }\n    const guards = options.fieldResolverEnhancers?.includes(\"guards\") === true;\n    const scanner = new MetadataScanner();\n    this.plans = [];\n    for (const wrapper of context.discovery.getProviders()) {\n      const target = wrapper.metatype;\n      if (!target?.prototype || wrapper.isAlias) {\n        continue;\n      }\n      for (const method of scanner.getAllMethodNames(target.prototype)) {\n        const handler = Reflect.get(target.prototype, method);\n        const field =\n          Reflect.getMetadata(RESOLVER_PROPERTY_METADATA, handler) === true;\n        const reference =\n          Reflect.getMetadata(RESOLVER_REFERENCE_METADATA, handler) === true;\n        if (\n          !field &&\n          !reference &&\n          !Reflect.getMetadata(RESOLVER_TYPE_METADATA, handler)\n        ) {\n          continue;\n        }\n        const metadata = record(\n          Reflect.getMetadata(PARAM_ARGS_METADATA, target, method),\n        );\n        const inputs = reference\n          ? []\n          : Object.entries(metadata ?? {}).flatMap(([key, entry]) =>\n              key.startsWith(\"3:\") && typeof record(entry)?.data === \"string\"\n                ? [String(record(entry)!.data)]\n                : [],\n            );\n        context.claim(\n          target,\n          method,\n          field || reference ? (guards ? \"global\" : \"none\") : \"global\",\n          {\n            code: reference\n              ? \"REFERENCE_RESOLVER_UNGUARDED\"\n              : field\n                ? \"FIELD_RESOLVER_UNGUARDED\"\n                : \"GRAPHQL_OPERATION_UNGUARDED\",\n            hint: \"Set fieldResolverEnhancers: ['guards', 'interceptors'], or declare @Public() where appropriate.\",\n            coverage: reference\n              ? this.options.federationCoverage\n              : field\n                ? this.options.fieldResolverCoverage\n                : \"error\",\n            everyHandler: reference,\n            inputs,\n          },\n        );\n        this.plans.push({\n          plan: context.planOf(target, method),\n          field,\n          reference,\n          target,\n          method,\n        });\n      }\n    }\n    const federation =\n      names.some((name) => name.includes(\"Federation\")) ||\n      this.plans.some((entry) => entry.reference);\n    const needsGuards = this.plans.some(\n      (entry) => entry.field || entry.reference,\n    );\n    if (\n      federation &&\n      needsGuards &&\n      !guards &&\n      this.options.federationCoverage !== \"off\"\n    ) {\n      const message =\n        \"Federation field and reference resolvers require fieldResolverEnhancers: ['guards', 'interceptors']; this runs every global guard once per field invocation.\";\n      if (this.options.federationCoverage === \"warn\") {\n        context.logger.warn(`FEDERATION_FIELD_GUARDS_REQUIRED: ${message}`);\n      } else {\n        throw new BetterAuthConfigurationError(\n          \"FEDERATION_FIELD_GUARDS_REQUIRED\",\n          message,\n        );\n      }\n    }\n    if (needsGuards && !options.fieldResolverEnhancers?.includes(\"filters\")) {\n      this.filterAdvice = {\n        level: \"warn\",\n        code: \"W_FIELD_EXCEPTION_FILTERS_DISABLED\",\n        message:\n          \"Nested GraphQL errors bypass Nest exception filters and ERROR logging while fieldResolverEnhancers omits filters.\",\n        hint: \"Include 'filters' with 'guards' in fieldResolverEnhancers to deliver nested authentication errors through Nest's exception pipeline; 'interceptors' enables per-field scopes.\",\n      };\n    }\n    if (needsGuards) {\n      const config = context.moduleRef.get(ApplicationConfig, {\n        strict: false,\n      });\n      const owned = new Set<unknown>([\n        context.moduleRef.get(BetterAuthGuard, { strict: false }),\n        context.moduleRef.get(BetterAuthScopeInterceptor, { strict: false }),\n      ]);\n      const names = [\n        ...config.getGlobalGuards(),\n        ...config.getGlobalInterceptors(),\n      ]\n        .filter(\n          (value) =>\n            !owned.has(value) &&\n            ![\"guard\", \"scope\"].includes(Reflect.get(value, AUTH_ENHANCER)),\n        )\n        .map((value) => value.constructor.name);\n      if (names.length) {\n        this.enhancerAdvice = {\n          level: \"warn\",\n          code: \"W_FIELD_GUARDS_MULTIPLY_GLOBAL_ENHANCERS\",\n          message: `${names.join(\", \")} run once per field-resolver invocation when their corresponding field enhancer is enabled: guards for global guards, interceptors for global interceptors.`,\n          hint: \"Use @SkipThrottle() or equivalent, move global guards to controllers, or use coverage: 'warn' behind an authenticating router.\",\n        };\n      }\n    }\n  }\n\n  advise(context: BootAdviceContext): readonly BootAdvice[] {\n    const advice: BootAdvice[] = [\n      this.enhancerAdvice,\n      this.filterAdvice,\n    ].filter((value): value is BootAdvice => value !== undefined);\n    const entries = this.plans;\n    const publicEntries = entries.filter(\n      ({ plan, field }) =>\n        !field && [\"public\", \"optional\"].includes(plan.access),\n    );\n    const inheriting = entries.filter(({ plan }) => plan.access === \"inherit\");\n    if (publicEntries.length && inheriting.length) {\n      advice.push({\n        level: \"warn\",\n        code: \"W_FIELD_RESOLVER_INHERITS\",\n        message: `${inheriting\n          .map(({ plan }) => plan.site)\n          .slice(0, 20)\n          .join(\n            \", \",\n          )} inherit readings from entry points including ${publicEntries\n          .map(({ plan }) => plan.site)\n          .slice(0, 20)\n          .join(\", \")}.`,\n        hint: \"Use @RequireAuth() and fieldResolverEnhancers: ['guards'] for sensitive fields.\",\n      });\n    }\n    for (const { plan } of inheriting) {\n      if (\n        plan.principalParams.some((param) =>\n          entries.some((entry) =>\n            [...entry.plan.accepts].some((kind) => kind !== param.kind),\n          ),\n        )\n      ) {\n        advice.push({\n          level: \"warn\",\n          code: \"W_NESTED_PRINCIPAL_PARAM\",\n          message: `${plan.site} can inherit a different principal kind from another schema entry point.`,\n          hint: \"Use @CurrentPrincipal() and narrow p.kind, or declare field access and acceptance.\",\n        });\n      }\n    }\n    const targets = new Set(\n      entries.filter(({ field }) => field).map(({ target }) => target),\n    );\n    for (const target of targets) {\n      if (\n        [\n          ACCESS_METADATA,\n          ACCEPT_PRINCIPALS_METADATA,\n          REQUIREMENTS_METADATA,\n        ].some((key) => Reflect.hasMetadata(key, target))\n      ) {\n        advice.push({\n          level: \"info\",\n          code: \"I_CLASS_METADATA_OPERATIONS_ONLY\",\n          message: `Class metadata of ${(target as { name?: string }).name} excludes inherited fields ${entries\n            .filter(\n              (entry) =>\n                entry.target === target && entry.plan.access === \"inherit\",\n            )\n            .map((entry) => entry.method)\n            .join(\", \")}; it applies to operations and reference resolvers ${\n            entries\n              .filter((entry) => entry.target === target && entry.reference)\n              .map((entry) => entry.method)\n              .join(\", \") || \"(none)\"\n          }.`,\n        });\n      }\n    }\n    if (\n      !this.connectionTtlMs &&\n      context.sources.some(\n        (source) => source.effects?.consumesQuota || source.effects?.writes,\n      )\n    ) {\n      advice.push({\n        level: \"warn\",\n        code: \"W_QUOTA_PER_MESSAGE\",\n        message:\n          \"Each socket operation resolves quota-consuming or writing principal sources.\",\n        hint: \"Consider subscriptionPrincipalTtlMs and its revocation delay.\",\n      });\n    }\n    return advice;\n  }\n}\nexport function apolloTransport(\n  options: GraphqlTransportOptions = {},\n): ExtensionRef<AuthTransport> {\n  return new GraphqlTransport(\"apollo\", options);\n}\nexport function mercuriusTransport(\n  options: GraphqlTransportOptions = {},\n): ExtensionRef<AuthTransport> {\n  return new GraphqlTransport(\"mercurius\", options);\n}\n"],"mappings":";;;;;;;;;;AAEA,MAAM,aAAa,OAAO,IAAI,gDAAgD;AAU9E,SAAgB,OACd,OAC0C;CAC1C,OAAO,OAAO,UAAU,YAAY,UAAU,OACzC,QACD,KAAA;AACN;;AAEA,SAAgB,YAAY,MAA0B;CACpD,MAAM,YAAY,KAAK,WAAW;CAClC,OAAO;EACL,MAAM,OAAO,KAAK,EAAE;EACpB,MAAM,YAAY,KAAA,IAAY,OAAO,KAAK,EAAE;EAC5C,SAAS,OAAO,KAAK,YAAY,IAAI,EAAE,KAAK;EAC5C,MAAM,OAAO,KAAK,YAAY,IAAI,EAAE;CACtC;AACF;AAKA,SAAS,eAAe,SAAiB,WAA8B;CACrE,IAAI,aAAa,QAAQ,IAAI,SAAS,UAAU;CAGhD,IAAI,CAAC,YAAY;EACf,6BAAa,IAAI,IAAI;EACrB,OAAO,eAAe,SAAS,YAAY,EAAE,OAAO,WAAW,CAAC;CAClE;CACA,IAAI,QAAQ,WAAW,IAAI,SAAS;CACpC,IAAI,UAAU,KAAA,GAAW;EACvB,QAAQ;GAAE,IAAI,WAAW,OAAO;GAAG,4BAAY,IAAI,IAAI;EAAE;EACzD,WAAW,IAAI,WAAW,KAAK;CACjC;CACA,OAAO;AACT;AACA,SAAS,KAAK,MAA6C;CACzD,OAAO,OAAO,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,GAAG,IAAI,CAAC;AAClD;AACA,SAAS,SAAS,IAAY,MAAgC;CAC5D,OAAO,GAAG,GAAG,GAAG,KAAK,UAAU,KAAK,IAAI,CAAC;AAC3C;AACA,SAAgB,kBACd,MACA,YAAY,OACJ;CACR,MAAM,aAAa,YAAY,IAAI;CACnC,QAAQ,YAAY,WAAW,OAAO,WAAW,SAAS;AAC5D;AACA,SAAgB,eACd,MACA,YAAY,OACO;CACnB,MAAM,aAAa,YAAY,IAAI;CACnC,MAAM,UAAU,WAAW;CAC3B,MAAM,QAAQ,eAAe,SAAS,WAAW,MAAM,aAAa,OAAO;CAC3E,MAAM,EAAE,OAAO;CACf,IAAI,WACF,MAAM,WAAW,IAAI,KAAK,UAAU,KAAK,WAAW,MAAM,IAAI,CAAC,CAAC;CAElE,OAAO;EACL;EACA,UAAU,YACN,GAAG,GAAG,aAAa,OAAO,WAAW,MAAM,cAAc,EAAE,MAC3D,SAAS,IAAI,WAAW,MAAM,IAAI;EACtC,CAAC,UAAU,aAAa;GACtB,MAAM,UAAU,YAAY,WAAW;GACvC,MAAM,YAAY,eAChB,QAAQ,SACR,QAAQ,MAAM,aAAa,QAAQ,OACrC;GACA,MAAM,OAAO,QAAQ,MAAM;GAC3B,KACE,IAAI,QAAQ,MAAM,SAAS,MAAM,MACjC,QACA,QAAQ,QAAQ,SAAS,OAAO,MAChC;IAEA,IACE,OAAO,OAAO,QAAQ,YACtB,OAAO,SACN,OAAO,KAAK,QAAQ,eACnB,UAAU,WAAW,IAAI,KAAK,UAAU,KAAK,OAAO,IAAI,CAAC,CAAC,IAE5D,MAAM,GAAG,UAAU,GAAG,aAAa,OAAO,YAAY,OAAO,QAAQ,MAAM,cAAc,EAAE;IAE7F,MAAM,SAAS,UAAU,IAAI,MAAM;GACrC;EACF;CACF;AACF;;;ACpDA,MAAM,oBAAoB,OAAO,IAC/B,+CACF;AACA,MAAM,oBAAoB,OAAO,IAC/B,+CACF;AAiBA,IAAa,0BAAb,cAA6CA,eAAAA,mBAAmB;CAC9D;CAEA,YAAY,SAAsB;EAChC,MAAM,QAAQ,OAAO;EACrB,KAAK,aAAa;GAChB,MAAM,QAAQ;GACd,YAAY,QAAQ;GACpB,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;EACrD;CACF;AACF;AACA,SAAS,mBACP,OACuB;CACvB,OAAO;EACL,MAAM;EACN,QAAQC,oBAAAA,qBAAqB,KAAK,IAC9B,uBACA;EACJ,YAAY;CACd;AACF;AACA,IAAa,iCAAb,cAAoD,MAAM;CACxD;CAEA,YACE,OACA;EACA,MAAM,yBAAyB,EAAE,OAAO,MAAM,CAAC;EAC/C,KAAK,aAAa,mBAAmB,KAAK;CAC5C;AACF;AACA,IAAa,yCAAb,cAA4DD,eAAAA,mBAAmB;CAC7E;CAEA,YACE,OACA;EACA,MAAM,yBAAyB,EAAE,OAAO,MAAM,CAAC;EAC/C,KAAK,aAAa,mBAAmB,KAAK;CAC5C;AACF;;AAEA,SAAgB,+BAA+B;CAC7C,QACE,aACA,aACsC;GACrC,oBAAoB;GACpB,oBAAoB,eAAe,OAAO;CAC7C;AACF;AAMA,SAAS,QAAQ,OAAqC;CACpD,MAAM,YAAY,OAAO,KAAK;CAC9B,OAAO,aAAa,OAAO,UAAU,OAAO,IACvC,YACD,KAAA;AACN;;;;;;;;AAQA,SAAS,iBAAiB,OAAqC;CAC7D,MAAM,QAAQ,OAAO,KAAK;CAC1B,MAAM,SAAS,OAAO,OAAO,MAAM;CACnC,OAAO,UACL,OAAO,OAAO,SAAS,cACvB,OAAO,OAAO,UAAU,aACtB,QAAQ,OAAO,OAAO,IACtB,KAAA;AACN;AACA,SAAS,eAAe,SAA2B;CACjD,MAAM,QAAQ,OAAO,OAAO;CAI5B,MAAM,cAHM,OAAO,OAAO,GAAG,KAAK,MAAA,EAGV;CACxB,IAAI,MAAM,QAAQ,UAAU,GAAG;EAC7B,MAAM,UAAU,IAAI,QAAQ;EAC5B,KAAK,IAAI,QAAQ,GAAG,QAAQ,IAAI,WAAW,QAAQ,SAAS,GAC1D,IACE,OAAO,WAAW,WAAW,YAC7B,OAAO,WAAW,QAAQ,OAAO,UAEjC,QAAQ,OAAO,WAAW,QAAQ,WAAW,QAAQ,EAAE;EAG3D,OAAO;CACT;CACA,OAAOE,iBAAAA,aAAc,OAAO,WAAW,CAAC,CAAyB;AACnE;;;;;;AAMA,SAAS,cAAc,MAA4B,OAAyB;CAC1E,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE;CAC/B,IAAI,MAAM,UAAU,OAAO,MAAM,MAC/B,OAAO;CAET,OAAO,KAAK,cAAc,KAAK,YAAY,OAAO,MAAM,QAAQ;AAClE;AACA,SAAS,eACP,SACA,QACA,MACA;CACA,MAAM,UAAU,OAAO,OAAO,KAAK,CAAC;CACpC,MAAM,MAAM,OAAO,QAAQ,GAAG;CAC9B,MAAM,QAAQ,OAAO,QAAQ,KAAK;CAGlC,MAAM,cACJ,WAAW,WACP,MAAM,UAAU,GAAG,MAAM,QACzB,MAAM,UAAU,OAAO,OAAO,MAAM,OACpC,cAAc,MAAM,QAAQ,KAAK;CAIvC,MAAM,YACJ,WAAW,YAAY,CAAC,eAAe,iBAAiB,KAAK,KAAK,IAC9D,MACA,KAAA;CACN,MAAM,SAAS,cACX,KAAA,IACA,WAAW,WACT,iBAAiB,YAAY,UAAU,QAAQ,KAAK,IACnD,QAAQ,QAAQ,kBAAkB,MAClC,qBAAqB,UACjB,QAAQ,QAAQ,OAAO,KACxB,QAAQ,OAAO,QAAQ,KAAK,CAAC,EAAE,OAAO,KACtC,QAAQ,QAAQ,GAAG,IACnB,KAAA;CACV,MAAM,aAAa,YAAY,MAAM;CACrC,MAAM,SAAS,OACb,YACI,KAAK,mBACJ,QAAQ,oBAAoB,QAAQ,eAC3C;CACA,MAAM,UACJ,WAAW,WACP,QAAQ,MACP,OAAO,QAAQ,KAAK,CAAC,EAAE,WAAW,QAAQ;CACjD,MAAM,gBACJ,QAAQ,8BAA8B,UAClC,IAAI,QAAQ,QAAQ,kBAAkB,IACtC,eAAe,MAAM;CAC3B,OAAO;EAAE;EAAS;EAAQ;EAAY;EAAQ;EAAS;CAAQ;AACjE;AACA,IAAM,mBAAN,MAAgD;CAenC;CACQ;CAfnB,WAAoB,EAAE,eAAe,MAAM;CAC3C;CACA;CACA,QAMM,CAAC;CACP;CACA;CAEA,YACE,IACA,SACA;EAFS,KAAA,KAAA;EACQ,KAAA,UAAA;EAEjB,KAAK,kBAAkB,QAAQ,8BAA8B;EAC7D,IAAI,CAAC,OAAO,SAAS,KAAK,eAAe,KAAK,KAAK,kBAAkB,GACnE,MAAM,IAAIC,oBAAAA,6BACR,4BACA,gEACF;CAEJ;CAEA,QAAQ,SAAoC;EAC1C,OAAO,QAAQ,QAAgB,MAAM;CACvC;CAEA,UAAkB,SAAoC;EACpD,OACE,QAAQ,YAAYC,gBAAAA,6BAA6B,QAAQ,WAAW,CAAC,MACrE;CAEJ;CAEA,iBAAiB,QAAgB,QAAuC;EACtE,MAAM,UAAU,QAAQ,IACtB,QAAQ,IAAI,QAAQ,WAAW,KAAK,QACpC,MACF;EACA,OAAO,OAAO,YAAY,cACxB,CAAC,QAAQ,YAAYA,gBAAAA,6BAA6B,OAAO,KACzD,QAAQ,YAAYC,gBAAAA,4BAA4B,OAAO,IACrD,YACA,KAAA;CACN;CAEA,QAAQ,SAA2B;EACjC,OAAO;GACL,GAAG,eAAe,QAAQ,QAAQ,GAAG,KAAK,UAAU,OAAO,CAAC;GAC5D,iBAAiB,SAA6B;IAC5C,IAAI,KAAK,KACP,KAAK,cAAc,MAAM,KAAK,GAAG;GAErC;EACF;CACF;CAEA,cAAsB,MAA0B,KAAmB;EACjE,MAAM,UAAU,eACd,YAAY,IAAI,CAAC,CAAC,SAClB,KAAK,IACL,IAAI,IACN;EACA,IAAI,QAAQ,QACV,OAAO;EAET,IAAI,CAAC,IAAI,MAAM,UAAU,QAAQ,OAAO,GACtC,MAAMF,oBAAAA,6BAA6B,UACjC,gCACA,iEACA,EACE,MAAM,6HACR,CACF;EAEF,IAAI,CAAC,IAAI,KAAK,OAAO,QAAQ,OAAO,GAClC,MAAMA,oBAAAA,6BAA6B,UACjC,iCACA,gDACA,EAAE,MAAM,qDAAqD,CAC/D;EAEF,OAAO;CACT;CAEA,SAAS,SAA2B,KAAkC;EACpE,KAAK,MAAM;EACX,MAAM,OAAO,QAAQ,QAAQ;EAC7B,MAAM,aAAa,YAAY,IAAI;EACnC,MAAM,UAAU,eAAe,WAAW,SAAS,KAAK,IAAI,IAAI,IAAI;EACpE,MAAM,MACJ,CAAC,QAAQ,UAAU,IAAI,MAAM,UAAU,QAAQ,OAAO,IAClD,IAAI,KAAK,IAAI,QAAQ,OAAO,IAC5B,WAAW;EACjB,MAAM,gBAAgB,KAAK,cAAc,MAAM,GAAG;EAClD,MAAM,gBAAgB;GACpB,MAAM,UAAU,QAAQ;GACxB,IAAI,CAAC,QAAQ,QACX,OAAO,IAAI,KAAM,QAAQ,QAAQ,OAAO;GAE1C,MAAM,UAAU,QAAQ,QAAQ;GAChC,IAAI,KAAK,QAAQ,yBAAyB;IAGxC,MAAM,QAAQ,KAAK,QAAQ,wBAAwB,QAAQ,UAAU;IACrE,IAAI;IACJ,IAAI;KACF,SAAS,IAAI,QAAQ,KAAK;IAC5B,QAAQ;KAGN,MAAMG,oBAAAA,aAAa,SAAS;MAC1B,QAAQ;MACR,QAAQ;KACV,CAAC;IACH;IACA,KAAK,MAAM,QAAQ;KAAC;KAAQ;KAAoB;IAAmB,GAAG;KACpE,MAAM,QAAQ,QAAQ,IAAI,IAAI;KAC9B,IAAI,CAAC,OAAO,IAAI,IAAI,KAAK,UAAU,MACjC,OAAO,IAAI,MAAM,KAAK;IAE1B;IACA,OAAO;GACT;GACA,MAAM,cAAc,IAAI,QAAQ,OAAO;GACvC,MAAM,QAAQ,IAAI,KAEd,KAAK,QAAQ,0BAA0B,CAAC,iBAAiB,QAAQ,EAAA,CACjE,KAAK,SAAS,KAAK,YAAY,CAAC,CACpC;GACA,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,QAAQ,UAAU,CAAC,CAAC,GAAG;IAChE,IAAI,CAAC,MAAM,IAAI,KAAK,YAAY,CAAC,GAC/B;IAEF,IAAI,OAAO,UAAU,YAAY,WAAW,KAAK,KAAK,GACpD,MAAMA,oBAAAA,aAAa,SAAS;KAC1B,QAAQ;KACR,QAAQ;IACV,CAAC;IAEH,IAAI;KACF,YAAY,IAAI,MAAM,KAAK;IAC7B,QAAQ;KAGN,MAAMA,oBAAAA,aAAa,SAAS;MAC1B,QAAQ;MACR,QAAQ;KACV,CAAC;IACH;GACF;GACA,OAAO;EACT;EACA,OAAO;GACL;GACA,YAAY,kBAAkB,MAAM,KAAK,UAAU,OAAO,CAAC;GAC3D,SAAS,KAAK,QAAQ,OAAO;GAC7B,GAAI,QAAQ,SACR;IAAE,YAAY,QAAQ;IAAQ,gBAAgB,KAAK;GAAgB,IACnE,CAAC;GACL;GACA,IAAI,WAAW;IACb,MAAM,UAAU,QAAQ;IACxB,OAAO,QAAQ,SAAS,OAAO,IAAI,KAAM,SAAS,QAAQ,OAAO;GACnE;GACA,IAAI,UAAU;IACZ,MAAM,UAAU,QAAQ;IACxB,OAAO,QAAQ,SACX,OACA,IAAI,KAAM,WACR,QAAQ,SACR,QAAQ,QAAQ,SACd,OAAO,QAAQ,OAAO,CAAC,EAAE,OACzB,IAAI,KAAM,cAAc,QAAQ,OAAO,CAC3C;GACN;GACA,IAAI,UAAU;IACZ,MAAM,UAAU,QAAQ;IACxB,OAAO,QAAQ,SACX;KAAE,QAAQ;KAAO,KAAKC,iBAAAA,kBAAkB,QAAQ,MAAM;IAAE,IACxD,IAAI,KAAM,QAAQ,QAAQ,OAAO;GACvC;GACA,QAAQ,UACL,KAAK,UAAU,OAAO,IACnB,WAAW,OAAO,QAClB,WAAW,OAAO,WACrB,CAAC,QAAQ,UAAU,IAAI,MAAM,UAAU,QAAQ,OAAO,IACnD,IAAI,KAAK,MAAM,QAAQ,SAAS,IAAI,IACpC,KAAA;GACN,IAAI,UAAU;IACZ,MAAM,UAAU,QAAQ;IACxB,OAAO,QAAQ,SACX;KACE,SAAS;KACT,SAAS,QAAQ;KACjB,KAAKA,iBAAAA,kBAAkB,QAAQ,MAAM;KACrC,KAAK,QAAQ;IACf,IACA;KACE,SAAS,WAAW,MAAM,UAAU,cAAc;KAClD,eAAe,IAAI,KAAM,QAAQ,QAAQ,OAAO;KAChD,KAAK,IAAI,KAAM,QAAQ,QAAQ,OAAO,CAAC,CAAC;KACxC;IACF;GACN;EACF;CACF;CAEA,YAAY,SAA+B;EACzC,OAAO,IAAI,wBAAwB,OAAO;CAC5C;CAEA,oBACE,OACA,UACA,MACS;EACT,OAAO,KAAK,WACR,IAAI,uCAAuC,KAAK,IAChD,IAAI,+BAA+B,KAAK;CAC9C;CAEA,SAAS,SAA2C;EAClD,MAAM,UAAU,QAAQ,UAAU,IAI/BC,gBAAAA,wBAAwB,EAAE,QAAQ,MAAM,CAAC;EAC5C,MAAM,QAAkB,CAAC;EACzB,KACE,IAAI,SAAS,QAAQ,QACrB,OAAO,WAAW,YAClB,SAAS,OAAO,eAAe,MAAM,GAErC,MAAM,KAAK,OAAO,IAAI;EAExB,IACE,MAAM,MAAM,SACV,KAAK,WAAW,KAAK,OAAO,WAAW,cAAc,QAAQ,CAC/D,GAEA,MAAM,IAAIL,oBAAAA,6BACR,2BACA,GAAG,KAAK,GAAG,4BAA4B,MAAM,KAAK,KAAK,GACzD;EAEF,IACE,QAAQ,YAAY,KAAA,KACpB,OAAO,QAAQ,YAAY,YAE3B,MAAM,IAAIA,oBAAAA,6BACR,0BACA,+DACA,2DACF;EAEF,MAAM,MAAM;GACV,QAAQ,CAAC;GACT,QAAQ,CAAC;GACT,YAAY,CAAC;EACf;EACA,KAAK,MAAM,CAAC,MAAM,WAAW,QAAQ;GACnC;IAAC;KAASM,GAAAA,gBAAAA,MAAAA,OAAY,MAAM;IAAGC,gBAAAA;GAAsB;GACrD;IAAC;KAASC,GAAAA,gBAAAA,aAAAA,OAAmB,MAAM;IAAGN,gBAAAA;GAA0B;GAChE;IAAC;KAAaO,GAAAA,gBAAAA,iBAAAA,CAAiB;IAAGR,gBAAAA;GAA2B;EAC/D,GAAY;GACV,UACE,MAAM,WACN,MACA,OAAO,yBAAyB,MAAM,WAAW,IAAI,CACvD;GACA,IAAI,CAAC,QAAQ,YAAY,KAAK,MAAM,UAAU,KAAK,GACjD,MAAM,IAAID,oBAAAA,6BACR,6BACA,mCAAmC,KACrC;EAEJ;EACA,CAAA,GAAA,gBAAA,KAAA,CAAK,SAAS,EAAE,YAAY,OAAO,CAAC,CAAC,CAAC,MAAM,WAAW,SAAS,CAAC;EACjE,MAAM,mBAAmB,OACvB,QAAQ,YAAYU,gBAAAA,qBAAqB,OAAO,OAAO,CACzD;EACA,IACE,CAAC,oBACD,CAAC,OAAO,QAAQ,gBAAgB,CAAC,CAAC,MAC/B,CAAC,KAAK,WACL,IAAI,WAAW,IAAI,KAAK,OAAO,KAAK,CAAC,EAAE,SAAS,OACpD,GAEA,MAAM,IAAIV,oBAAAA,6BACR,6BACA,uDACF;EAEF,MAAM,SAAS,QAAQ,wBAAwB,SAAS,QAAQ,MAAM;EACtE,MAAM,UAAU,IAAIW,aAAAA,gBAAgB;EACpC,KAAK,QAAQ,CAAC;EACd,KAAK,MAAM,WAAW,QAAQ,UAAU,aAAa,GAAG;GACtD,MAAM,SAAS,QAAQ;GACvB,IAAI,CAAC,QAAQ,aAAa,QAAQ,SAChC;GAEF,KAAK,MAAM,UAAU,QAAQ,kBAAkB,OAAO,SAAS,GAAG;IAChE,MAAM,UAAU,QAAQ,IAAI,OAAO,WAAW,MAAM;IACpD,MAAM,QACJ,QAAQ,YAAYT,gBAAAA,4BAA4B,OAAO,MAAM;IAC/D,MAAM,YACJ,QAAQ,YAAYD,gBAAAA,6BAA6B,OAAO,MAAM;IAChE,IACE,CAAC,SACD,CAAC,aACD,CAAC,QAAQ,YAAYM,gBAAAA,wBAAwB,OAAO,GAEpD;IAEF,MAAM,WAAW,OACf,QAAQ,YAAYG,gBAAAA,qBAAqB,QAAQ,MAAM,CACzD;IACA,MAAM,SAAS,YACX,CAAC,IACD,OAAO,QAAQ,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,WAC5C,IAAI,WAAW,IAAI,KAAK,OAAO,OAAO,KAAK,CAAC,EAAE,SAAS,WACnD,CAAC,OAAO,OAAO,KAAK,CAAC,CAAE,IAAI,CAAC,IAC5B,CAAC,CACP;IACJ,QAAQ,MACN,QACA,QACA,SAAS,YAAa,SAAS,WAAW,SAAU,UACpD;KACE,MAAM,YACF,iCACA,QACE,6BACA;KACN,MAAM;KACN,UAAU,YACN,KAAK,QAAQ,qBACb,QACE,KAAK,QAAQ,wBACb;KACN,cAAc;KACd;IACF,CACF;IACA,KAAK,MAAM,KAAK;KACd,MAAM,QAAQ,OAAO,QAAQ,MAAM;KACnC;KACA;KACA;KACA;IACF,CAAC;GACH;EACF;EACA,MAAM,aACJ,MAAM,MAAM,SAAS,KAAK,SAAS,YAAY,CAAC,KAChD,KAAK,MAAM,MAAM,UAAU,MAAM,SAAS;EAC5C,MAAM,cAAc,KAAK,MAAM,MAC5B,UAAU,MAAM,SAAS,MAAM,SAClC;EACA,IACE,cACA,eACA,CAAC,UACD,KAAK,QAAQ,uBAAuB,OACpC;GACA,MAAM,UACJ;GACF,IAAI,KAAK,QAAQ,uBAAuB,QACtC,QAAQ,OAAO,KAAK,qCAAqC,SAAS;QAElE,MAAM,IAAIV,oBAAAA,6BACR,oCACA,OACF;EAEJ;EACA,IAAI,eAAe,CAAC,QAAQ,wBAAwB,SAAS,SAAS,GACpE,KAAK,eAAe;GAClB,OAAO;GACP,MAAM;GACN,SACE;GACF,MAAM;EACR;EAEF,IAAI,aAAa;GACf,MAAM,SAAS,QAAQ,UAAU,IAAIY,aAAAA,mBAAmB,EACtD,QAAQ,MACV,CAAC;GACD,MAAM,wBAAQ,IAAI,IAAa,CAC7B,QAAQ,UAAU,IAAIC,mBAAAA,iBAAiB,EAAE,QAAQ,MAAM,CAAC,GACxD,QAAQ,UAAU,IAAIC,+BAAAA,4BAA4B,EAAE,QAAQ,MAAM,CAAC,CACrE,CAAC;GACD,MAAM,QAAQ,CACZ,GAAG,OAAO,gBAAgB,GAC1B,GAAG,OAAO,sBAAsB,CAClC,CAAC,CACE,QACE,UACC,CAAC,MAAM,IAAI,KAAK,KAChB,CAAC,CAAC,SAAS,OAAO,CAAC,CAAC,SAAS,QAAQ,IAAI,OAAOC,iBAAAA,aAAa,CAAC,CAClE,CAAC,CACA,KAAK,UAAU,MAAM,YAAY,IAAI;GACxC,IAAI,MAAM,QACR,KAAK,iBAAiB;IACpB,OAAO;IACP,MAAM;IACN,SAAS,GAAG,MAAM,KAAK,IAAI,EAAE;IAC7B,MAAM;GACR;EAEJ;CACF;CAEA,OAAO,SAAmD;EACxD,MAAM,SAAuB,CAC3B,KAAK,gBACL,KAAK,YACP,CAAC,CAAC,QAAQ,UAA+B,UAAU,KAAA,CAAS;EAC5D,MAAM,UAAU,KAAK;EACrB,MAAM,gBAAgB,QAAQ,QAC3B,EAAE,MAAM,YACP,CAAC,SAAS,CAAC,UAAU,UAAU,CAAC,CAAC,SAAS,KAAK,MAAM,CACzD;EACA,MAAM,aAAa,QAAQ,QAAQ,EAAE,WAAW,KAAK,WAAW,SAAS;EACzE,IAAI,cAAc,UAAU,WAAW,QACrC,OAAO,KAAK;GACV,OAAO;GACP,MAAM;GACN,SAAS,GAAG,WACT,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC,CAC5B,MAAM,GAAG,EAAE,CAAC,CACZ,KACC,IACF,EAAE,gDAAgD,cACjD,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC,CAC5B,MAAM,GAAG,EAAE,CAAC,CACZ,KAAK,IAAI,EAAE;GACd,MAAM;EACR,CAAC;EAEH,KAAK,MAAM,EAAE,UAAU,YACrB,IACE,KAAK,gBAAgB,MAAM,UACzB,QAAQ,MAAM,UACZ,CAAC,GAAG,MAAM,KAAK,OAAO,CAAC,CAAC,MAAM,SAAS,SAAS,MAAM,IAAI,CAC5D,CACF,GAEA,OAAO,KAAK;GACV,OAAO;GACP,MAAM;GACN,SAAS,GAAG,KAAK,KAAK;GACtB,MAAM;EACR,CAAC;EAGL,MAAM,UAAU,IAAI,IAClB,QAAQ,QAAQ,EAAE,YAAY,KAAK,CAAC,CAAC,KAAK,EAAE,aAAa,MAAM,CACjE;EACA,KAAK,MAAM,UAAU,SACnB,IACE;GACEC,iBAAAA;GACAC,iBAAAA;GACAC,iBAAAA;EACF,CAAC,CAAC,MAAM,QAAQ,QAAQ,YAAY,KAAK,MAAM,CAAC,GAEhD,OAAO,KAAK;GACV,OAAO;GACP,MAAM;GACN,SAAS,qBAAsB,OAA6B,KAAK,6BAA6B,QAC3F,QACE,UACC,MAAM,WAAW,UAAU,MAAM,KAAK,WAAW,SACrD,CAAC,CACA,KAAK,UAAU,MAAM,MAAM,CAAC,CAC5B,KAAK,IAAI,EAAE,qDACZ,QACG,QAAQ,UAAU,MAAM,WAAW,UAAU,MAAM,SAAS,CAAC,CAC7D,KAAK,UAAU,MAAM,MAAM,CAAC,CAC5B,KAAK,IAAI,KAAK,SAClB;EACH,CAAC;EAGL,IACE,CAAC,KAAK,mBACN,QAAQ,QAAQ,MACb,WAAW,OAAO,SAAS,iBAAiB,OAAO,SAAS,MAC/D,GAEA,OAAO,KAAK;GACV,OAAO;GACP,MAAM;GACN,SACE;GACF,MAAM;EACR,CAAC;EAEH,OAAO;CACT;AACF;AACA,SAAgB,gBACd,UAAmC,CAAC,GACP;CAC7B,OAAO,IAAI,iBAAiB,UAAU,OAAO;AAC/C;AACA,SAAgB,mBACd,UAAmC,CAAC,GACP;CAC7B,OAAO,IAAI,iBAAiB,aAAa,OAAO;AAClD"}
+{"version":3,"file":"graphql.cjs","names":["IntrinsicException","isConfigurationError","upgradeRequestUrl","toWebHeaders","BetterAuthConfigurationError","RESOLVER_REFERENCE_METADATA","RESOLVER_PROPERTY_METADATA","AuthFailures","GRAPHQL_MODULE_OPTIONS","Query","RESOLVER_TYPE_METADATA","ResolveField","ResolveReference","PARAM_ARGS_METADATA","MetadataScanner","ApplicationConfig","BetterAuthGuard","BetterAuthScopeInterceptor","AUTH_ENHANCER","ACCESS_METADATA","ACCEPT_PRINCIPALS_METADATA","REQUIREMENTS_METADATA"],"sources":["../src/graphql-lineage.ts","../src/graphql-transport.ts"],"sourcesContent":["import type { InvocationLineage } from \"./auth-contracts.js\";\n\nconst OPERATIONS = Symbol.for(\"nestjs-slightly-better-auth:graphql-operations\");\ninterface Path {\n  readonly key: string | number;\n  readonly prev?: Path;\n  readonly typename?: string;\n}\nexport interface GraphInfo {\n  readonly operation: object & { operation?: string };\n  readonly path: Path;\n}\nexport function record(\n  value: unknown,\n): Record<PropertyKey, unknown> | undefined {\n  return typeof value === \"object\" && value !== null\n    ? (value as Record<PropertyKey, unknown>)\n    : undefined;\n}\n/** Apollo reference resolvers omit the argument object; parameter readers see the original array. */\nexport function graphqlArgs(args: readonly unknown[]) {\n  const reference = args.length === 3;\n  return {\n    root: record(args[0]),\n    args: reference ? undefined : record(args[1]),\n    context: record(args[reference ? 1 : 2]) ?? args,\n    info: record(args[reference ? 2 : 3]) as unknown as GraphInfo | undefined,\n  };\n}\ninterface Operation {\n  id: number;\n  references: Set<string>;\n}\nfunction operationState(carrier: object, operation: object): Operation {\n  let operations = Reflect.get(carrier, OPERATIONS) as\n    | Map<object, Operation>\n    | undefined;\n  if (!operations) {\n    operations = new Map();\n    Object.defineProperty(carrier, OPERATIONS, { value: operations });\n  }\n  let state = operations.get(operation);\n  if (state === undefined) {\n    state = { id: operations.size + 1, references: new Set() };\n    operations.set(operation, state);\n  }\n  return state;\n}\nfunction keys(path: Path | undefined): (string | number)[] {\n  return path ? [...keys(path.prev), path.key] : [];\n}\nfunction position(id: number, path: Path | undefined): string {\n  return `${id}:${JSON.stringify(keys(path))}`;\n}\nexport function graphqlInvocation(\n  args: readonly unknown[],\n  reference = false,\n): object {\n  const normalized = graphqlArgs(args);\n  return (reference ? normalized.root : normalized.info) ?? args;\n}\nexport function graphqlLineage(\n  args: readonly unknown[],\n  reference = false,\n): InvocationLineage {\n  const normalized = graphqlArgs(args);\n  const carrier = normalized.context;\n  const state = operationState(carrier, normalized.info?.operation ?? carrier);\n  const { id } = state;\n  if (reference) {\n    state.references.add(JSON.stringify(keys(normalized.info?.path)));\n  }\n  return {\n    carrier,\n    position: reference\n      ? `${id}:_entities#${String(normalized.root?.__typename ?? \"\")}`\n      : position(id, normalized.info?.path),\n    *enclosing(currentArgs) {\n      const current = graphqlArgs(currentArgs);\n      const operation = operationState(\n        current.context,\n        current.info?.operation ?? current.context,\n      );\n      const path = current.info?.path;\n      for (\n        let child = path, parent = path?.prev;\n        parent;\n        child = parent, parent = parent.prev\n      ) {\n        // The child path supplies the concrete entity type below the list index.\n        if (\n          typeof parent.key === \"number\" &&\n          parent.prev &&\n          (parent.prev.key === \"_entities\" ||\n            operation.references.has(JSON.stringify(keys(parent.prev))))\n        ) {\n          yield `${operation.id}:_entities#${child?.typename ?? String(current.root?.__typename ?? \"\")}`;\n        }\n        yield position(operation.id, parent);\n      }\n    },\n  };\n}\n","import type { IncomingHttpHeaders } from \"node:http\";\nimport { type ExecutionContext, IntrinsicException } from \"@nestjs/common\";\nimport { ApplicationConfig, MetadataScanner } from \"@nestjs/core\";\nimport {\n  Args,\n  GRAPHQL_MODULE_OPTIONS,\n  PARAM_ARGS_METADATA,\n  RESOLVER_PROPERTY_METADATA,\n  RESOLVER_REFERENCE_METADATA,\n  RESOLVER_TYPE_METADATA,\n  Query,\n  ResolveField,\n  ResolveReference,\n} from \"@nestjs/graphql\";\nimport type {\n  AuthTransport,\n  BootAdvice,\n  BootAdviceContext,\n  ExtensionRef,\n  RoutePlan,\n  TransportCall,\n  TransportKit,\n  TransportValidationContext,\n} from \"./auth-contracts.js\";\nimport {\n  BetterAuthConfigurationError,\n  AuthFailures,\n  isConfigurationError,\n} from \"./auth-errors.js\";\nimport type {\n  AuthFailure,\n  AuthGraphqlExtensions,\n  BetterAuthInfrastructureError,\n} from \"./auth-errors.js\";\nimport { BetterAuthGuard } from \"./auth-guard.js\";\nimport { BetterAuthScopeInterceptor } from \"./auth-scope-interceptor.js\";\nimport {\n  AUTH_ENHANCER,\n  ACCESS_METADATA,\n  ACCEPT_PRINCIPALS_METADATA,\n  REQUIREMENTS_METADATA,\n} from \"./auth-tokens.js\";\nimport {\n  type GraphInfo,\n  graphqlArgs,\n  graphqlInvocation,\n  graphqlLineage,\n  record,\n} from \"./graphql-lineage.js\";\nimport { toWebHeaders, upgradeRequestUrl } from \"./platform.js\";\n\nconst MERCURIUS_AMBIENT = Symbol.for(\n  \"nestjs-slightly-better-auth:mercurius-ambient\",\n);\nconst MERCURIUS_UPGRADE = Symbol.for(\n  \"nestjs-slightly-better-auth:mercurius-upgrade\",\n);\nexport interface GraphqlTransportOptions {\n  /** Case-insensitive connection-init credential keys; defaults to authorization and cookie. */\n  connectionParamHeaders?: readonly string[];\n  /**\n   * Replaces socket credentials, preserving absent host and forwarded-host/proto headers.\n   * Returning undefined presents no credentials: neither connectionParamHeaders nor the\n   * upgrade request's credential headers are used.\n   */\n  subscriptionCredentials?: (\n    connectionContext: unknown,\n  ) => HeadersInit | undefined;\n  /** Connection principal reuse; zero by default. Authoritative plans bypass the TTL. */\n  subscriptionPrincipalTtlMs?: number;\n  fieldResolverCoverage?: \"error\" | \"warn\" | \"off\";\n  federationCoverage?: \"error\" | \"warn\" | \"off\";\n}\nexport class BetterAuthGraphqlDenial extends IntrinsicException {\n  readonly extensions: AuthGraphqlExtensions;\n\n  constructor(failure: AuthFailure) {\n    super(failure.message);\n    this.extensions = {\n      code: failure.code,\n      statusCode: failure.status,\n      ...(failure.reason ? { reason: failure.reason } : {}),\n    };\n  }\n}\nfunction internalExtensions(\n  error: BetterAuthInfrastructureError | BetterAuthConfigurationError,\n): AuthGraphqlExtensions {\n  return {\n    code: \"INTERNAL_SERVER_ERROR\",\n    reason: isConfigurationError(error)\n      ? \"AUTH_MISCONFIGURED\"\n      : \"AUTH_UNAVAILABLE\",\n    statusCode: 500,\n  };\n}\nexport class BetterAuthGraphqlInternalError extends Error {\n  readonly extensions: AuthGraphqlExtensions;\n\n  constructor(\n    error: BetterAuthInfrastructureError | BetterAuthConfigurationError,\n  ) {\n    super(\"Internal server error\", { cause: error });\n    this.extensions = internalExtensions(error);\n  }\n}\nexport class BetterAuthGraphqlRepeatedInternalError extends IntrinsicException {\n  readonly extensions: AuthGraphqlExtensions;\n\n  constructor(\n    error: BetterAuthInfrastructureError | BetterAuthConfigurationError,\n  ) {\n    super(\"Internal server error\", { cause: error });\n    this.extensions = internalExtensions(error);\n  }\n}\n/** Keeps the upgrade request and its original browser headers across Mercurius operation spreads. */\nexport function mercuriusSubscriptionContext() {\n  return (\n    _connection: unknown,\n    request: { headers: Record<string, unknown> },\n  ): Record<string | symbol, unknown> => ({\n    [MERCURIUS_UPGRADE]: request,\n    [MERCURIUS_AMBIENT]: ambientHeaders(request),\n  });\n}\ninterface Upgrade {\n  headers: IncomingHttpHeaders;\n  url?: string;\n  secure?: boolean;\n  socket?: { encrypted?: boolean };\n}\nfunction upgrade(value: unknown): Upgrade | undefined {\n  const candidate = record(value);\n  return candidate && record(candidate.headers)\n    ? (candidate as unknown as Upgrade)\n    : undefined;\n}\n/** The WebSocket of a graphql-ws `extra` ({ socket, request }): a socket with function-typed send and close. */\nfunction graphqlWsSocket(\n  value: unknown,\n): Record<PropertyKey, unknown> | undefined {\n  const socket = record(record(value)?.socket);\n  return socket &&\n    typeof socket.send === \"function\" &&\n    typeof socket.close === \"function\"\n    ? socket\n    : undefined;\n}\n/**\n * The upgrade request of a graphql-ws `extra` ({ socket, request }) whose socket is a\n * WebSocket. Only the graphql-ws server creates that pair; parsed request data cannot carry\n * functions, so a client-sent header or field never selects the socket path. The socket's\n * state does not change this recognition: the transport classifies it once per operation\n * (GraphqlTransport.openAtStart).\n */\nfunction graphqlWsUpgrade(value: unknown): Upgrade | undefined {\n  return graphqlWsSocket(value) ? upgrade(record(value)?.request) : undefined;\n}\n/** WebSocket.OPEN of the `ws` sockets that Nest's graphql-ws server creates. */\nconst WEBSOCKET_OPEN = 1;\n/** Upgrade-request headers that locate the server for Better Auth; none of them is a credential. */\nconst HOST_METADATA = [\"host\", \"x-forwarded-host\", \"x-forwarded-proto\"];\n/**\n * The upgrade request's URL without the target's query string and fragment. A query string can\n * carry a connection's credential (`?access_token=`), which an operation that reads no credential\n * of its connection must not expose to principal sources or policies.\n */\nfunction upgradePathUrl(request: Upgrade): string {\n  const target = request.url ?? \"/\";\n  const end = target.search(/[?#]/);\n  return upgradeRequestUrl({\n    headers: request.headers,\n    url: end === -1 ? target : target.slice(0, end),\n    secure: request.secure,\n    socket: request.socket,\n  });\n}\n/** Copies the host metadata of `ambient` into `into` where `into` has none of its own. */\nfunction withHostMetadata(into: Headers, ambient: Headers): Headers {\n  for (const name of HOST_METADATA) {\n    const value = ambient.get(name);\n    if (!into.has(name) && value !== null) {\n      into.set(name, value);\n    }\n  }\n  return into;\n}\n/**\n * The identity of one GraphQL execution, shared by every resolver of that execution. graphql-js\n * coerces the variable values into a fresh object for every execution, including one\n * subscription and its events; a parsed operation can be cached across executions, so it\n * serves only as the fallback.\n */\nfunction executionOf(info: GraphInfo | undefined): object | undefined {\n  const value = record(info);\n  return record(value?.variableValues) ?? record(value?.operation);\n}\nfunction ambientHeaders(request: unknown): Headers {\n  const value = record(request);\n  const raw = record(value?.raw) ?? value;\n  // Mercurius copies connection-init values into missing request.headers keys.\n  // Node rawHeaders retains the actual browser leg even after that mutation.\n  const rawHeaders = raw?.rawHeaders;\n  if (Array.isArray(rawHeaders)) {\n    const headers = new Headers();\n    for (let index = 0; index + 1 < rawHeaders.length; index += 2) {\n      if (\n        typeof rawHeaders[index] === \"string\" &&\n        typeof rawHeaders[index + 1] === \"string\"\n      ) {\n        headers.append(rawHeaders[index], rawHeaders[index + 1]);\n      }\n    }\n    return headers;\n  }\n  return toWebHeaders((value?.headers ?? {}) as IncomingHttpHeaders);\n}\n/**\n * Mercurius assigns the route's Fastify reply to context.reply for HTTP operations. Its\n * subscription contexts carry the platform-recognized upgrade request inside a plain reply\n * object instead, so the reply's identity, not the request alone, marks an HTTP operation.\n */\nfunction platformReply(http: TransportKit[\"http\"], value: unknown): boolean {\n  const request = record(value)?.request;\n  if (http?.isRequest(request) !== true) {\n    return false;\n  }\n  return http.responseFor ? http.responseFor(request) === value : true;\n}\nfunction carrierDetails(\n  context: unknown,\n  driver: \"apollo\" | \"mercurius\",\n  http: TransportKit[\"http\"],\n) {\n  const carrier = record(context) ?? {};\n  const req = record(carrier.req);\n  const extra = record(carrier.extra);\n  // A positive platform answer keeps the HTTP path and its liveness check, before any socket\n  // heuristic: a custom context can spread client data such as _connectionInit into its root.\n  const httpRequest =\n    driver === \"apollo\"\n      ? http?.isRequest(req) === true ||\n        http?.isRequest(extra?.request) === true\n      : platformReply(http, carrier.reply);\n  // Nest assigns the graphql-ws Context to context.req unless a custom context sets req. Its\n  // server-created extra identifies it: graphql-ws sets connectionParams only for an object\n  // connection_init payload, and an absent payload presents no connection credentials.\n  const wsContext =\n    driver === \"apollo\" && !httpRequest && graphqlWsUpgrade(req?.extra)\n      ? req\n      : undefined;\n  const wsExtra =\n    driver === \"apollo\" && !httpRequest\n      ? wsContext\n        ? wsContext.extra\n        : extra\n      : undefined;\n  const socket = httpRequest\n    ? undefined\n    : driver === \"apollo\"\n      ? graphqlWsUpgrade(wsExtra)\n      : (upgrade(carrier[MERCURIUS_UPGRADE]) ??\n        (\"_connectionInit\" in carrier\n          ? (upgrade(carrier.request) ??\n            upgrade(record(carrier.reply)?.request) ??\n            upgrade(carrier.req))\n          : undefined));\n  const connection = wsContext ? req : carrier;\n  const params = record(\n    wsContext\n      ? req?.connectionParams\n      : (carrier.connectionParams ?? carrier._connectionInit),\n  );\n  const request =\n    driver === \"apollo\"\n      ? carrier.req\n      : (record(carrier.reply)?.request ?? carrier.req);\n  const ambient = () =>\n    carrier[MERCURIUS_AMBIENT] instanceof Headers\n      ? new Headers(carrier[MERCURIUS_AMBIENT])\n      : ambientHeaders(socket);\n  // Mercurius socket contexts carry no graphql-ws extra: its subscription context is per connection.\n  const webSocket = socket ? graphqlWsSocket(wsExtra) : undefined;\n  return { carrier, socket, webSocket, connection, params, request, ambient };\n}\nclass GraphqlTransport implements AuthTransport {\n  readonly requires = { hostlessCalls: false };\n  readonly connectionTtlMs: number;\n  private kit?: TransportKit;\n  private plans: {\n    plan: RoutePlan;\n    field: boolean;\n    reference: boolean;\n    target: object;\n    method: string;\n  }[] = [];\n  private enhancerAdvice?: BootAdvice;\n  private filterAdvice?: BootAdvice;\n  /** Whether each execution's graphql-ws socket was open when the execution first reached the transport. */\n  private readonly socketsAtStart = new WeakMap<object, boolean>();\n\n  constructor(\n    readonly id: \"apollo\" | \"mercurius\",\n    private readonly options: GraphqlTransportOptions,\n  ) {\n    this.connectionTtlMs = options.subscriptionPrincipalTtlMs ?? 0;\n    if (!Number.isFinite(this.connectionTtlMs) || this.connectionTtlMs < 0) {\n      throw new BetterAuthConfigurationError(\n        \"INVALID_SUBSCRIPTION_TTL\",\n        \"subscriptionPrincipalTtlMs must be a finite nonnegative number\",\n      );\n    }\n  }\n\n  handles(context: ExecutionContext): boolean {\n    return context.getType<string>() === \"graphql\";\n  }\n\n  private reference(context: ExecutionContext): boolean {\n    return (\n      Reflect.getMetadata(RESOLVER_REFERENCE_METADATA, context.getHandler()) ===\n      true\n    );\n  }\n\n  defaultAccessFor(target: object, method: string): \"inherit\" | undefined {\n    const handler = Reflect.get(\n      Reflect.get(target, \"prototype\") ?? target,\n      method,\n    );\n    return typeof handler === \"function\" &&\n      !Reflect.getMetadata(RESOLVER_REFERENCE_METADATA, handler) &&\n      Reflect.getMetadata(RESOLVER_PROPERTY_METADATA, handler)\n      ? \"inherit\"\n      : undefined;\n  }\n\n  lineage(context: ExecutionContext) {\n    const args = context.getArgs();\n    const normalized = graphqlArgs(args);\n    // A public root reaches the transport through its lineage alone, so an operation can start\n    // here: its socket's classification then holds for the guarded fields nested in it.\n    this.openAtStart(\n      carrierDetails(normalized.context, this.id, this.kit?.http ?? null)\n        .webSocket,\n      normalized.info,\n    );\n    return {\n      ...graphqlLineage(args, this.reference(context)),\n      assertReadable: (args: readonly unknown[]) => {\n        if (this.kit) {\n          this.assertRequest(args, this.kit);\n        }\n      },\n    };\n  }\n\n  /**\n   * Whether the operation's graphql-ws socket was open when the operation started. The first\n   * classification of an execution holds for every later reader of it, so a connection that\n   * closes during authentication keeps its credentials. A socket that is not open when an\n   * operation starts belongs either to a connection that closed while graphql-ws prepared the\n   * operation or to an earlier connection that a cached context carries; its state cannot tell\n   * the two apart, so the operation reads no credential of that connection in either case.\n   */\n  private openAtStart(\n    webSocket: Record<PropertyKey, unknown> | undefined,\n    info: GraphInfo | undefined,\n  ): boolean {\n    if (!webSocket) {\n      return true;\n    }\n    const execution = executionOf(info);\n    const known = execution ? this.socketsAtStart.get(execution) : undefined;\n    if (known !== undefined) {\n      return known;\n    }\n    const open = webSocket.readyState === WEBSOCKET_OPEN;\n    if (execution) {\n      this.socketsAtStart.set(execution, open);\n    }\n    return open;\n  }\n\n  private assertRequest(args: readonly unknown[], kit: TransportKit) {\n    const normalized = graphqlArgs(args);\n    const details = carrierDetails(normalized.context, this.id, kit.http);\n    if (details.socket) {\n      return details;\n    }\n    if (!kit.http?.isRequest(details.request)) {\n      throw BetterAuthConfigurationError.atRequest(\n        \"GRAPHQL_CONTEXT_UNRECOGNIZED\",\n        \"GraphQL context has no recognized platform or upgrade request\",\n        {\n          hint: \"Keep the native request at context.req or context.extra.request; use mercuriusSubscriptionContext() for Mercurius sockets.\",\n        },\n      );\n    }\n    if (!kit.http.isLive(details.request)) {\n      throw BetterAuthConfigurationError.atRequest(\n        \"GRAPHQL_CONTEXT_STALE_REQUEST\",\n        \"GraphQL context contains a completed request\",\n        {\n          hint: \"Return a fresh context object for every operation and every graphql-ws connection.\",\n        },\n      );\n    }\n    return details;\n  }\n\n  describe(context: ExecutionContext, kit: TransportKit): TransportCall {\n    this.kit = kit;\n    const args = context.getArgs();\n    const normalized = graphqlArgs(args);\n    const initial = carrierDetails(normalized.context, this.id, kit.http);\n    // Classified here, at the start of the operation. The operation of a socket that is not open\n    // runs without that connection's credentials: it keeps no key or connection of the context,\n    // so no memoized or connection principal answers it, its headers carry host metadata only,\n    // and its request URL carries the upgrade request's path without the query string.\n    const open = this.openAtStart(initial.webSocket, normalized.info);\n    const key =\n      !initial.socket && kit.http?.isRequest(initial.request)\n        ? kit.http.key(initial.request)\n        : open\n          ? normalized.context\n          : (executionOf(normalized.info) ?? args);\n    const checked = () => this.assertRequest(args, kit);\n    const headers = () => {\n      const details = checked();\n      if (!details.socket) {\n        return kit.http!.headers(details.request);\n      }\n      const ambient = details.ambient();\n      if (!open) {\n        // Neither the upgrade request's credentials nor the connection's client data are read.\n        return withHostMetadata(new Headers(), ambient);\n      }\n      if (this.options.subscriptionCredentials) {\n        // Keep callback errors outside the conversion boundary: application\n        // programming failures are not malformed credential denials.\n        const input = this.options.subscriptionCredentials(details.connection);\n        let mapped: Headers;\n        try {\n          mapped = new Headers(input);\n        } catch {\n          // Web Headers errors embed rejected values, including server secrets.\n          // Discard the exception entirely; never retain its message or cause.\n          throw AuthFailures.rejected({\n            status: 401,\n            reason: \"MALFORMED_CREDENTIALS\",\n          });\n        }\n        return withHostMetadata(mapped, ambient);\n      }\n      const credentials = new Headers(ambient);\n      const allow = new Set(\n        (\n          this.options.connectionParamHeaders ?? [\"authorization\", \"cookie\"]\n        ).map((name) => name.toLowerCase()),\n      );\n      for (const [name, value] of Object.entries(details.params ?? {})) {\n        if (!allow.has(name.toLowerCase())) {\n          continue;\n        }\n        if (typeof value !== \"string\" || /[\\r\\n\\0]/.test(value)) {\n          throw AuthFailures.rejected({\n            status: 401,\n            reason: \"MALFORMED_CREDENTIALS\",\n          });\n        }\n        try {\n          credentials.set(name, value);\n        } catch {\n          // One malformed selected credential rejects the whole extraction,\n          // without falling back to another credential or exposing its value.\n          throw AuthFailures.rejected({\n            status: 401,\n            reason: \"MALFORMED_CREDENTIALS\",\n          });\n        }\n      }\n      return credentials;\n    };\n    return {\n      key,\n      invocation: graphqlInvocation(args, this.reference(context)),\n      lineage: this.lineage(context),\n      ...(initial.socket && open\n        ? { connection: initial.socket, principalTtlMs: this.connectionTtlMs }\n        : {}),\n      headers,\n      get clientIp() {\n        const details = checked();\n        return details.socket ? null : kit.http!.clientIp(details.request);\n      },\n      get cookies() {\n        const details = checked();\n        return details.socket\n          ? null\n          : kit.http!.cookieSink(\n              details.request,\n              details.carrier.reply ??\n                record(details.request)?.res ??\n                kit.http!.responseFor?.(details.request),\n            );\n      },\n      get request() {\n        const details = checked();\n        if (!details.socket) {\n          return kit.http!.request(details.request);\n        }\n        return {\n          method: \"GET\",\n          url: open\n            ? upgradeRequestUrl(details.socket)\n            : upgradePathUrl(details.socket),\n        };\n      },\n      param: (name) =>\n        (this.reference(context)\n          ? normalized.root?.[name]\n          : normalized.args?.[name]) ??\n        (!initial.socket && kit.http?.isRequest(initial.request)\n          ? kit.http.param(initial.request, name)\n          : undefined),\n      get browser() {\n        const details = checked();\n        // The origin check reads the handshake of the connection, open or not: its verdict grants\n        // no credential, and neither principal sources nor policies receive the browser leg.\n        return details.socket\n          ? {\n              enforce: true,\n              headers: details.ambient,\n              url: upgradeRequestUrl(details.socket),\n              key: details.socket,\n            }\n          : {\n              enforce: normalized.info?.operation.operation === \"mutation\",\n              headers: () => kit.http!.headers(details.request),\n              url: kit.http!.request(details.request).url,\n              key,\n            };\n      },\n    };\n  }\n\n  toException(failure: AuthFailure): unknown {\n    return new BetterAuthGraphqlDenial(failure);\n  }\n\n  toInternalException(\n    error: BetterAuthInfrastructureError | BetterAuthConfigurationError,\n    _context: ExecutionContext,\n    info: { repeated: boolean },\n  ): unknown {\n    return info.repeated\n      ? new BetterAuthGraphqlRepeatedInternalError(error)\n      : new BetterAuthGraphqlInternalError(error);\n  }\n\n  validate(context: TransportValidationContext): void {\n    const options = context.moduleRef.get<{\n      driver?: object;\n      context?: unknown;\n      fieldResolverEnhancers?: string[];\n    }>(GRAPHQL_MODULE_OPTIONS, { strict: false });\n    const names: string[] = [];\n    for (\n      let driver = options.driver;\n      typeof driver === \"function\";\n      driver = Object.getPrototypeOf(driver)\n    ) {\n      names.push(driver.name);\n    }\n    if (\n      names.some((name) =>\n        name.startsWith(this.id === \"apollo\" ? \"Mercurius\" : \"Apollo\"),\n      )\n    ) {\n      throw new BetterAuthConfigurationError(\n        \"GRAPHQL_DRIVER_MISMATCH\",\n        `${this.id} transport does not match ${names.join(\" / \")}`,\n      );\n    }\n    if (\n      options.context !== undefined &&\n      typeof options.context !== \"function\"\n    ) {\n      throw new BetterAuthConfigurationError(\n        \"GRAPHQL_STATIC_CONTEXT\",\n        \"GraphQL context must be a function returning a fresh object\",\n        \"context: ({ req }) => ({ req, loaders: createLoaders() })\",\n      );\n    }\n    class Probe {\n      query() {}\n      field() {}\n      reference() {}\n    }\n    for (const [name, decorator, key] of [\n      [\"query\", Query(() => String), RESOLVER_TYPE_METADATA],\n      [\"field\", ResolveField(() => String), RESOLVER_PROPERTY_METADATA],\n      [\"reference\", ResolveReference(), RESOLVER_REFERENCE_METADATA],\n    ] as const) {\n      decorator(\n        Probe.prototype,\n        name,\n        Object.getOwnPropertyDescriptor(Probe.prototype, name)!,\n      );\n      if (!Reflect.getMetadata(key, Probe.prototype[name])) {\n        throw new BetterAuthConfigurationError(\n          \"NEST_METADATA_KEY_CHANGED\",\n          `GraphQL metadata canary failed: ${key}`,\n        );\n      }\n    }\n    Args(\"probe\", { type: () => String })(Probe.prototype, \"query\", 0);\n    const argumentMetadata = record(\n      Reflect.getMetadata(PARAM_ARGS_METADATA, Probe, \"query\"),\n    );\n    if (\n      !argumentMetadata ||\n      !Object.entries(argumentMetadata).some(\n        ([key, value]) =>\n          key.startsWith(\"3:\") && record(value)?.data === \"probe\",\n      )\n    ) {\n      throw new BetterAuthConfigurationError(\n        \"NEST_METADATA_KEY_CHANGED\",\n        \"GraphQL argument metadata failed its parameter canary\",\n      );\n    }\n    const guards = options.fieldResolverEnhancers?.includes(\"guards\") === true;\n    const scanner = new MetadataScanner();\n    this.plans = [];\n    for (const wrapper of context.discovery.getProviders()) {\n      const target = wrapper.metatype;\n      if (!target?.prototype || wrapper.isAlias) {\n        continue;\n      }\n      for (const method of scanner.getAllMethodNames(target.prototype)) {\n        const handler = Reflect.get(target.prototype, method);\n        const field =\n          Reflect.getMetadata(RESOLVER_PROPERTY_METADATA, handler) === true;\n        const reference =\n          Reflect.getMetadata(RESOLVER_REFERENCE_METADATA, handler) === true;\n        if (\n          !field &&\n          !reference &&\n          !Reflect.getMetadata(RESOLVER_TYPE_METADATA, handler)\n        ) {\n          continue;\n        }\n        const metadata = record(\n          Reflect.getMetadata(PARAM_ARGS_METADATA, target, method),\n        );\n        const inputs = reference\n          ? []\n          : Object.entries(metadata ?? {}).flatMap(([key, entry]) =>\n              key.startsWith(\"3:\") && typeof record(entry)?.data === \"string\"\n                ? [String(record(entry)!.data)]\n                : [],\n            );\n        context.claim(\n          target,\n          method,\n          field || reference ? (guards ? \"global\" : \"none\") : \"global\",\n          {\n            code: reference\n              ? \"REFERENCE_RESOLVER_UNGUARDED\"\n              : field\n                ? \"FIELD_RESOLVER_UNGUARDED\"\n                : \"GRAPHQL_OPERATION_UNGUARDED\",\n            hint: \"Set fieldResolverEnhancers: ['guards', 'interceptors'], or declare @Public() where appropriate.\",\n            coverage: reference\n              ? this.options.federationCoverage\n              : field\n                ? this.options.fieldResolverCoverage\n                : \"error\",\n            everyHandler: reference,\n            inputs,\n          },\n        );\n        this.plans.push({\n          plan: context.planOf(target, method),\n          field,\n          reference,\n          target,\n          method,\n        });\n      }\n    }\n    const federation =\n      names.some((name) => name.includes(\"Federation\")) ||\n      this.plans.some((entry) => entry.reference);\n    const needsGuards = this.plans.some(\n      (entry) => entry.field || entry.reference,\n    );\n    if (\n      federation &&\n      needsGuards &&\n      !guards &&\n      this.options.federationCoverage !== \"off\"\n    ) {\n      const message =\n        \"Federation field and reference resolvers require fieldResolverEnhancers: ['guards', 'interceptors']; this runs every global guard once per field invocation.\";\n      if (this.options.federationCoverage === \"warn\") {\n        context.logger.warn(`FEDERATION_FIELD_GUARDS_REQUIRED: ${message}`);\n      } else {\n        throw new BetterAuthConfigurationError(\n          \"FEDERATION_FIELD_GUARDS_REQUIRED\",\n          message,\n        );\n      }\n    }\n    if (needsGuards && !options.fieldResolverEnhancers?.includes(\"filters\")) {\n      this.filterAdvice = {\n        level: \"warn\",\n        code: \"W_FIELD_EXCEPTION_FILTERS_DISABLED\",\n        message:\n          \"Nested GraphQL errors bypass Nest exception filters and ERROR logging while fieldResolverEnhancers omits filters.\",\n        hint: \"Include 'filters' with 'guards' in fieldResolverEnhancers to deliver nested authentication errors through Nest's exception pipeline; 'interceptors' enables per-field scopes.\",\n      };\n    }\n    if (needsGuards) {\n      const config = context.moduleRef.get(ApplicationConfig, {\n        strict: false,\n      });\n      const owned = new Set<unknown>([\n        context.moduleRef.get(BetterAuthGuard, { strict: false }),\n        context.moduleRef.get(BetterAuthScopeInterceptor, { strict: false }),\n      ]);\n      const names = [\n        ...config.getGlobalGuards(),\n        ...config.getGlobalInterceptors(),\n      ]\n        .filter(\n          (value) =>\n            !owned.has(value) &&\n            ![\"guard\", \"scope\"].includes(Reflect.get(value, AUTH_ENHANCER)),\n        )\n        .map((value) => value.constructor.name);\n      if (names.length) {\n        this.enhancerAdvice = {\n          level: \"warn\",\n          code: \"W_FIELD_GUARDS_MULTIPLY_GLOBAL_ENHANCERS\",\n          message: `${names.join(\", \")} run once per field-resolver invocation when their corresponding field enhancer is enabled: guards for global guards, interceptors for global interceptors.`,\n          hint: \"Use @SkipThrottle() or equivalent, move global guards to controllers, or use coverage: 'warn' behind an authenticating router.\",\n        };\n      }\n    }\n  }\n\n  advise(context: BootAdviceContext): readonly BootAdvice[] {\n    const advice: BootAdvice[] = [\n      this.enhancerAdvice,\n      this.filterAdvice,\n    ].filter((value): value is BootAdvice => value !== undefined);\n    const entries = this.plans;\n    const publicEntries = entries.filter(\n      ({ plan, field }) =>\n        !field && [\"public\", \"optional\"].includes(plan.access),\n    );\n    const inheriting = entries.filter(({ plan }) => plan.access === \"inherit\");\n    if (publicEntries.length && inheriting.length) {\n      advice.push({\n        level: \"warn\",\n        code: \"W_FIELD_RESOLVER_INHERITS\",\n        message: `${inheriting\n          .map(({ plan }) => plan.site)\n          .slice(0, 20)\n          .join(\n            \", \",\n          )} inherit readings from entry points including ${publicEntries\n          .map(({ plan }) => plan.site)\n          .slice(0, 20)\n          .join(\", \")}.`,\n        hint: \"Use @RequireAuth() and fieldResolverEnhancers: ['guards'] for sensitive fields.\",\n      });\n    }\n    for (const { plan } of inheriting) {\n      if (\n        plan.principalParams.some((param) =>\n          entries.some((entry) =>\n            [...entry.plan.accepts].some((kind) => kind !== param.kind),\n          ),\n        )\n      ) {\n        advice.push({\n          level: \"warn\",\n          code: \"W_NESTED_PRINCIPAL_PARAM\",\n          message: `${plan.site} can inherit a different principal kind from another schema entry point.`,\n          hint: \"Use @CurrentPrincipal() and narrow p.kind, or declare field access and acceptance.\",\n        });\n      }\n    }\n    const targets = new Set(\n      entries.filter(({ field }) => field).map(({ target }) => target),\n    );\n    for (const target of targets) {\n      if (\n        [\n          ACCESS_METADATA,\n          ACCEPT_PRINCIPALS_METADATA,\n          REQUIREMENTS_METADATA,\n        ].some((key) => Reflect.hasMetadata(key, target))\n      ) {\n        advice.push({\n          level: \"info\",\n          code: \"I_CLASS_METADATA_OPERATIONS_ONLY\",\n          message: `Class metadata of ${(target as { name?: string }).name} excludes inherited fields ${entries\n            .filter(\n              (entry) =>\n                entry.target === target && entry.plan.access === \"inherit\",\n            )\n            .map((entry) => entry.method)\n            .join(\", \")}; it applies to operations and reference resolvers ${\n            entries\n              .filter((entry) => entry.target === target && entry.reference)\n              .map((entry) => entry.method)\n              .join(\", \") || \"(none)\"\n          }.`,\n        });\n      }\n    }\n    if (\n      !this.connectionTtlMs &&\n      context.sources.some(\n        (source) => source.effects?.consumesQuota || source.effects?.writes,\n      )\n    ) {\n      advice.push({\n        level: \"warn\",\n        code: \"W_QUOTA_PER_MESSAGE\",\n        message:\n          \"Each socket operation resolves quota-consuming or writing principal sources.\",\n        hint: \"Consider subscriptionPrincipalTtlMs and its revocation delay.\",\n      });\n    }\n    return advice;\n  }\n}\nexport function apolloTransport(\n  options: GraphqlTransportOptions = {},\n): ExtensionRef<AuthTransport> {\n  return new GraphqlTransport(\"apollo\", options);\n}\nexport function mercuriusTransport(\n  options: GraphqlTransportOptions = {},\n): ExtensionRef<AuthTransport> {\n  return new GraphqlTransport(\"mercurius\", options);\n}\n"],"mappings":";;;;;;;;;;AAEA,MAAM,aAAa,OAAO,IAAI,gDAAgD;AAU9E,SAAgB,OACd,OAC0C;CAC1C,OAAO,OAAO,UAAU,YAAY,UAAU,OACzC,QACD,KAAA;AACN;;AAEA,SAAgB,YAAY,MAA0B;CACpD,MAAM,YAAY,KAAK,WAAW;CAClC,OAAO;EACL,MAAM,OAAO,KAAK,EAAE;EACpB,MAAM,YAAY,KAAA,IAAY,OAAO,KAAK,EAAE;EAC5C,SAAS,OAAO,KAAK,YAAY,IAAI,EAAE,KAAK;EAC5C,MAAM,OAAO,KAAK,YAAY,IAAI,EAAE;CACtC;AACF;AAKA,SAAS,eAAe,SAAiB,WAA8B;CACrE,IAAI,aAAa,QAAQ,IAAI,SAAS,UAAU;CAGhD,IAAI,CAAC,YAAY;EACf,6BAAa,IAAI,IAAI;EACrB,OAAO,eAAe,SAAS,YAAY,EAAE,OAAO,WAAW,CAAC;CAClE;CACA,IAAI,QAAQ,WAAW,IAAI,SAAS;CACpC,IAAI,UAAU,KAAA,GAAW;EACvB,QAAQ;GAAE,IAAI,WAAW,OAAO;GAAG,4BAAY,IAAI,IAAI;EAAE;EACzD,WAAW,IAAI,WAAW,KAAK;CACjC;CACA,OAAO;AACT;AACA,SAAS,KAAK,MAA6C;CACzD,OAAO,OAAO,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,GAAG,IAAI,CAAC;AAClD;AACA,SAAS,SAAS,IAAY,MAAgC;CAC5D,OAAO,GAAG,GAAG,GAAG,KAAK,UAAU,KAAK,IAAI,CAAC;AAC3C;AACA,SAAgB,kBACd,MACA,YAAY,OACJ;CACR,MAAM,aAAa,YAAY,IAAI;CACnC,QAAQ,YAAY,WAAW,OAAO,WAAW,SAAS;AAC5D;AACA,SAAgB,eACd,MACA,YAAY,OACO;CACnB,MAAM,aAAa,YAAY,IAAI;CACnC,MAAM,UAAU,WAAW;CAC3B,MAAM,QAAQ,eAAe,SAAS,WAAW,MAAM,aAAa,OAAO;CAC3E,MAAM,EAAE,OAAO;CACf,IAAI,WACF,MAAM,WAAW,IAAI,KAAK,UAAU,KAAK,WAAW,MAAM,IAAI,CAAC,CAAC;CAElE,OAAO;EACL;EACA,UAAU,YACN,GAAG,GAAG,aAAa,OAAO,WAAW,MAAM,cAAc,EAAE,MAC3D,SAAS,IAAI,WAAW,MAAM,IAAI;EACtC,CAAC,UAAU,aAAa;GACtB,MAAM,UAAU,YAAY,WAAW;GACvC,MAAM,YAAY,eAChB,QAAQ,SACR,QAAQ,MAAM,aAAa,QAAQ,OACrC;GACA,MAAM,OAAO,QAAQ,MAAM;GAC3B,KACE,IAAI,QAAQ,MAAM,SAAS,MAAM,MACjC,QACA,QAAQ,QAAQ,SAAS,OAAO,MAChC;IAEA,IACE,OAAO,OAAO,QAAQ,YACtB,OAAO,SACN,OAAO,KAAK,QAAQ,eACnB,UAAU,WAAW,IAAI,KAAK,UAAU,KAAK,OAAO,IAAI,CAAC,CAAC,IAE5D,MAAM,GAAG,UAAU,GAAG,aAAa,OAAO,YAAY,OAAO,QAAQ,MAAM,cAAc,EAAE;IAE7F,MAAM,SAAS,UAAU,IAAI,MAAM;GACrC;EACF;CACF;AACF;;;ACnDA,MAAM,oBAAoB,OAAO,IAC/B,+CACF;AACA,MAAM,oBAAoB,OAAO,IAC/B,+CACF;AAiBA,IAAa,0BAAb,cAA6CA,eAAAA,mBAAmB;CAC9D;CAEA,YAAY,SAAsB;EAChC,MAAM,QAAQ,OAAO;EACrB,KAAK,aAAa;GAChB,MAAM,QAAQ;GACd,YAAY,QAAQ;GACpB,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;EACrD;CACF;AACF;AACA,SAAS,mBACP,OACuB;CACvB,OAAO;EACL,MAAM;EACN,QAAQC,oBAAAA,qBAAqB,KAAK,IAC9B,uBACA;EACJ,YAAY;CACd;AACF;AACA,IAAa,iCAAb,cAAoD,MAAM;CACxD;CAEA,YACE,OACA;EACA,MAAM,yBAAyB,EAAE,OAAO,MAAM,CAAC;EAC/C,KAAK,aAAa,mBAAmB,KAAK;CAC5C;AACF;AACA,IAAa,yCAAb,cAA4DD,eAAAA,mBAAmB;CAC7E;CAEA,YACE,OACA;EACA,MAAM,yBAAyB,EAAE,OAAO,MAAM,CAAC;EAC/C,KAAK,aAAa,mBAAmB,KAAK;CAC5C;AACF;;AAEA,SAAgB,+BAA+B;CAC7C,QACE,aACA,aACsC;GACrC,oBAAoB;GACpB,oBAAoB,eAAe,OAAO;CAC7C;AACF;AAOA,SAAS,QAAQ,OAAqC;CACpD,MAAM,YAAY,OAAO,KAAK;CAC9B,OAAO,aAAa,OAAO,UAAU,OAAO,IACvC,YACD,KAAA;AACN;;AAEA,SAAS,gBACP,OAC0C;CAC1C,MAAM,SAAS,OAAO,OAAO,KAAK,CAAC,EAAE,MAAM;CAC3C,OAAO,UACL,OAAO,OAAO,SAAS,cACvB,OAAO,OAAO,UAAU,aACtB,SACA,KAAA;AACN;;;;;;;;AAQA,SAAS,iBAAiB,OAAqC;CAC7D,OAAO,gBAAgB,KAAK,IAAI,QAAQ,OAAO,KAAK,CAAC,EAAE,OAAO,IAAI,KAAA;AACpE;;AAEA,MAAM,iBAAiB;;AAEvB,MAAM,gBAAgB;CAAC;CAAQ;CAAoB;AAAmB;;;;;;AAMtE,SAAS,eAAe,SAA0B;CAChD,MAAM,SAAS,QAAQ,OAAO;CAC9B,MAAM,MAAM,OAAO,OAAO,MAAM;CAChC,OAAOE,iBAAAA,kBAAkB;EACvB,SAAS,QAAQ;EACjB,KAAK,QAAQ,KAAK,SAAS,OAAO,MAAM,GAAG,GAAG;EAC9C,QAAQ,QAAQ;EAChB,QAAQ,QAAQ;CAClB,CAAC;AACH;;AAEA,SAAS,iBAAiB,MAAe,SAA2B;CAClE,KAAK,MAAM,QAAQ,eAAe;EAChC,MAAM,QAAQ,QAAQ,IAAI,IAAI;EAC9B,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,UAAU,MAC/B,KAAK,IAAI,MAAM,KAAK;CAExB;CACA,OAAO;AACT;;;;;;;AAOA,SAAS,YAAY,MAAiD;CACpE,MAAM,QAAQ,OAAO,IAAI;CACzB,OAAO,OAAO,OAAO,cAAc,KAAK,OAAO,OAAO,SAAS;AACjE;AACA,SAAS,eAAe,SAA2B;CACjD,MAAM,QAAQ,OAAO,OAAO;CAI5B,MAAM,cAHM,OAAO,OAAO,GAAG,KAAK,MAAA,EAGV;CACxB,IAAI,MAAM,QAAQ,UAAU,GAAG;EAC7B,MAAM,UAAU,IAAI,QAAQ;EAC5B,KAAK,IAAI,QAAQ,GAAG,QAAQ,IAAI,WAAW,QAAQ,SAAS,GAC1D,IACE,OAAO,WAAW,WAAW,YAC7B,OAAO,WAAW,QAAQ,OAAO,UAEjC,QAAQ,OAAO,WAAW,QAAQ,WAAW,QAAQ,EAAE;EAG3D,OAAO;CACT;CACA,OAAOC,iBAAAA,aAAc,OAAO,WAAW,CAAC,CAAyB;AACnE;;;;;;AAMA,SAAS,cAAc,MAA4B,OAAyB;CAC1E,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE;CAC/B,IAAI,MAAM,UAAU,OAAO,MAAM,MAC/B,OAAO;CAET,OAAO,KAAK,cAAc,KAAK,YAAY,OAAO,MAAM,QAAQ;AAClE;AACA,SAAS,eACP,SACA,QACA,MACA;CACA,MAAM,UAAU,OAAO,OAAO,KAAK,CAAC;CACpC,MAAM,MAAM,OAAO,QAAQ,GAAG;CAC9B,MAAM,QAAQ,OAAO,QAAQ,KAAK;CAGlC,MAAM,cACJ,WAAW,WACP,MAAM,UAAU,GAAG,MAAM,QACzB,MAAM,UAAU,OAAO,OAAO,MAAM,OACpC,cAAc,MAAM,QAAQ,KAAK;CAIvC,MAAM,YACJ,WAAW,YAAY,CAAC,eAAe,iBAAiB,KAAK,KAAK,IAC9D,MACA,KAAA;CACN,MAAM,UACJ,WAAW,YAAY,CAAC,cACpB,YACE,UAAU,QACV,QACF,KAAA;CACN,MAAM,SAAS,cACX,KAAA,IACA,WAAW,WACT,iBAAiB,OAAO,IACvB,QAAQ,QAAQ,kBAAkB,MAClC,qBAAqB,UACjB,QAAQ,QAAQ,OAAO,KACxB,QAAQ,OAAO,QAAQ,KAAK,CAAC,EAAE,OAAO,KACtC,QAAQ,QAAQ,GAAG,IACnB,KAAA;CACV,MAAM,aAAa,YAAY,MAAM;CACrC,MAAM,SAAS,OACb,YACI,KAAK,mBACJ,QAAQ,oBAAoB,QAAQ,eAC3C;CACA,MAAM,UACJ,WAAW,WACP,QAAQ,MACP,OAAO,QAAQ,KAAK,CAAC,EAAE,WAAW,QAAQ;CACjD,MAAM,gBACJ,QAAQ,8BAA8B,UAClC,IAAI,QAAQ,QAAQ,kBAAkB,IACtC,eAAe,MAAM;CAG3B,OAAO;EAAE;EAAS;EAAQ,WADR,SAAS,gBAAgB,OAAO,IAAI,KAAA;EACjB;EAAY;EAAQ;EAAS;CAAQ;AAC5E;AACA,IAAM,mBAAN,MAAgD;CAiBnC;CACQ;CAjBnB,WAAoB,EAAE,eAAe,MAAM;CAC3C;CACA;CACA,QAMM,CAAC;CACP;CACA;;CAEA,iCAAkC,IAAI,QAAyB;CAE/D,YACE,IACA,SACA;EAFS,KAAA,KAAA;EACQ,KAAA,UAAA;EAEjB,KAAK,kBAAkB,QAAQ,8BAA8B;EAC7D,IAAI,CAAC,OAAO,SAAS,KAAK,eAAe,KAAK,KAAK,kBAAkB,GACnE,MAAM,IAAIC,oBAAAA,6BACR,4BACA,gEACF;CAEJ;CAEA,QAAQ,SAAoC;EAC1C,OAAO,QAAQ,QAAgB,MAAM;CACvC;CAEA,UAAkB,SAAoC;EACpD,OACE,QAAQ,YAAYC,gBAAAA,6BAA6B,QAAQ,WAAW,CAAC,MACrE;CAEJ;CAEA,iBAAiB,QAAgB,QAAuC;EACtE,MAAM,UAAU,QAAQ,IACtB,QAAQ,IAAI,QAAQ,WAAW,KAAK,QACpC,MACF;EACA,OAAO,OAAO,YAAY,cACxB,CAAC,QAAQ,YAAYA,gBAAAA,6BAA6B,OAAO,KACzD,QAAQ,YAAYC,gBAAAA,4BAA4B,OAAO,IACrD,YACA,KAAA;CACN;CAEA,QAAQ,SAA2B;EACjC,MAAM,OAAO,QAAQ,QAAQ;EAC7B,MAAM,aAAa,YAAY,IAAI;EAGnC,KAAK,YACH,eAAe,WAAW,SAAS,KAAK,IAAI,KAAK,KAAK,QAAQ,IAAI,CAAC,CAChE,WACH,WAAW,IACb;EACA,OAAO;GACL,GAAG,eAAe,MAAM,KAAK,UAAU,OAAO,CAAC;GAC/C,iBAAiB,SAA6B;IAC5C,IAAI,KAAK,KACP,KAAK,cAAc,MAAM,KAAK,GAAG;GAErC;EACF;CACF;;;;;;;;;CAUA,YACE,WACA,MACS;EACT,IAAI,CAAC,WACH,OAAO;EAET,MAAM,YAAY,YAAY,IAAI;EAClC,MAAM,QAAQ,YAAY,KAAK,eAAe,IAAI,SAAS,IAAI,KAAA;EAC/D,IAAI,UAAU,KAAA,GACZ,OAAO;EAET,MAAM,OAAO,UAAU,eAAe;EACtC,IAAI,WACF,KAAK,eAAe,IAAI,WAAW,IAAI;EAEzC,OAAO;CACT;CAEA,cAAsB,MAA0B,KAAmB;EAEjE,MAAM,UAAU,eADG,YAAY,IACS,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,IAAI;EACpE,IAAI,QAAQ,QACV,OAAO;EAET,IAAI,CAAC,IAAI,MAAM,UAAU,QAAQ,OAAO,GACtC,MAAMF,oBAAAA,6BAA6B,UACjC,gCACA,iEACA,EACE,MAAM,6HACR,CACF;EAEF,IAAI,CAAC,IAAI,KAAK,OAAO,QAAQ,OAAO,GAClC,MAAMA,oBAAAA,6BAA6B,UACjC,iCACA,gDACA,EACE,MAAM,qFACR,CACF;EAEF,OAAO;CACT;CAEA,SAAS,SAA2B,KAAkC;EACpE,KAAK,MAAM;EACX,MAAM,OAAO,QAAQ,QAAQ;EAC7B,MAAM,aAAa,YAAY,IAAI;EACnC,MAAM,UAAU,eAAe,WAAW,SAAS,KAAK,IAAI,IAAI,IAAI;EAKpE,MAAM,OAAO,KAAK,YAAY,QAAQ,WAAW,WAAW,IAAI;EAChE,MAAM,MACJ,CAAC,QAAQ,UAAU,IAAI,MAAM,UAAU,QAAQ,OAAO,IAClD,IAAI,KAAK,IAAI,QAAQ,OAAO,IAC5B,OACE,WAAW,UACV,YAAY,WAAW,IAAI,KAAK;EACzC,MAAM,gBAAgB,KAAK,cAAc,MAAM,GAAG;EAClD,MAAM,gBAAgB;GACpB,MAAM,UAAU,QAAQ;GACxB,IAAI,CAAC,QAAQ,QACX,OAAO,IAAI,KAAM,QAAQ,QAAQ,OAAO;GAE1C,MAAM,UAAU,QAAQ,QAAQ;GAChC,IAAI,CAAC,MAEH,OAAO,iBAAiB,IAAI,QAAQ,GAAG,OAAO;GAEhD,IAAI,KAAK,QAAQ,yBAAyB;IAGxC,MAAM,QAAQ,KAAK,QAAQ,wBAAwB,QAAQ,UAAU;IACrE,IAAI;IACJ,IAAI;KACF,SAAS,IAAI,QAAQ,KAAK;IAC5B,QAAQ;KAGN,MAAMG,oBAAAA,aAAa,SAAS;MAC1B,QAAQ;MACR,QAAQ;KACV,CAAC;IACH;IACA,OAAO,iBAAiB,QAAQ,OAAO;GACzC;GACA,MAAM,cAAc,IAAI,QAAQ,OAAO;GACvC,MAAM,QAAQ,IAAI,KAEd,KAAK,QAAQ,0BAA0B,CAAC,iBAAiB,QAAQ,EAAA,CACjE,KAAK,SAAS,KAAK,YAAY,CAAC,CACpC;GACA,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,QAAQ,UAAU,CAAC,CAAC,GAAG;IAChE,IAAI,CAAC,MAAM,IAAI,KAAK,YAAY,CAAC,GAC/B;IAEF,IAAI,OAAO,UAAU,YAAY,WAAW,KAAK,KAAK,GACpD,MAAMA,oBAAAA,aAAa,SAAS;KAC1B,QAAQ;KACR,QAAQ;IACV,CAAC;IAEH,IAAI;KACF,YAAY,IAAI,MAAM,KAAK;IAC7B,QAAQ;KAGN,MAAMA,oBAAAA,aAAa,SAAS;MAC1B,QAAQ;MACR,QAAQ;KACV,CAAC;IACH;GACF;GACA,OAAO;EACT;EACA,OAAO;GACL;GACA,YAAY,kBAAkB,MAAM,KAAK,UAAU,OAAO,CAAC;GAC3D,SAAS,KAAK,QAAQ,OAAO;GAC7B,GAAI,QAAQ,UAAU,OAClB;IAAE,YAAY,QAAQ;IAAQ,gBAAgB,KAAK;GAAgB,IACnE,CAAC;GACL;GACA,IAAI,WAAW;IACb,MAAM,UAAU,QAAQ;IACxB,OAAO,QAAQ,SAAS,OAAO,IAAI,KAAM,SAAS,QAAQ,OAAO;GACnE;GACA,IAAI,UAAU;IACZ,MAAM,UAAU,QAAQ;IACxB,OAAO,QAAQ,SACX,OACA,IAAI,KAAM,WACR,QAAQ,SACR,QAAQ,QAAQ,SACd,OAAO,QAAQ,OAAO,CAAC,EAAE,OACzB,IAAI,KAAM,cAAc,QAAQ,OAAO,CAC3C;GACN;GACA,IAAI,UAAU;IACZ,MAAM,UAAU,QAAQ;IACxB,IAAI,CAAC,QAAQ,QACX,OAAO,IAAI,KAAM,QAAQ,QAAQ,OAAO;IAE1C,OAAO;KACL,QAAQ;KACR,KAAK,OACDL,iBAAAA,kBAAkB,QAAQ,MAAM,IAChC,eAAe,QAAQ,MAAM;IACnC;GACF;GACA,QAAQ,UACL,KAAK,UAAU,OAAO,IACnB,WAAW,OAAO,QAClB,WAAW,OAAO,WACrB,CAAC,QAAQ,UAAU,IAAI,MAAM,UAAU,QAAQ,OAAO,IACnD,IAAI,KAAK,MAAM,QAAQ,SAAS,IAAI,IACpC,KAAA;GACN,IAAI,UAAU;IACZ,MAAM,UAAU,QAAQ;IAGxB,OAAO,QAAQ,SACX;KACE,SAAS;KACT,SAAS,QAAQ;KACjB,KAAKA,iBAAAA,kBAAkB,QAAQ,MAAM;KACrC,KAAK,QAAQ;IACf,IACA;KACE,SAAS,WAAW,MAAM,UAAU,cAAc;KAClD,eAAe,IAAI,KAAM,QAAQ,QAAQ,OAAO;KAChD,KAAK,IAAI,KAAM,QAAQ,QAAQ,OAAO,CAAC,CAAC;KACxC;IACF;GACN;EACF;CACF;CAEA,YAAY,SAA+B;EACzC,OAAO,IAAI,wBAAwB,OAAO;CAC5C;CAEA,oBACE,OACA,UACA,MACS;EACT,OAAO,KAAK,WACR,IAAI,uCAAuC,KAAK,IAChD,IAAI,+BAA+B,KAAK;CAC9C;CAEA,SAAS,SAA2C;EAClD,MAAM,UAAU,QAAQ,UAAU,IAI/BM,gBAAAA,wBAAwB,EAAE,QAAQ,MAAM,CAAC;EAC5C,MAAM,QAAkB,CAAC;EACzB,KACE,IAAI,SAAS,QAAQ,QACrB,OAAO,WAAW,YAClB,SAAS,OAAO,eAAe,MAAM,GAErC,MAAM,KAAK,OAAO,IAAI;EAExB,IACE,MAAM,MAAM,SACV,KAAK,WAAW,KAAK,OAAO,WAAW,cAAc,QAAQ,CAC/D,GAEA,MAAM,IAAIJ,oBAAAA,6BACR,2BACA,GAAG,KAAK,GAAG,4BAA4B,MAAM,KAAK,KAAK,GACzD;EAEF,IACE,QAAQ,YAAY,KAAA,KACpB,OAAO,QAAQ,YAAY,YAE3B,MAAM,IAAIA,oBAAAA,6BACR,0BACA,+DACA,2DACF;EAEF,MAAM,MAAM;GACV,QAAQ,CAAC;GACT,QAAQ,CAAC;GACT,YAAY,CAAC;EACf;EACA,KAAK,MAAM,CAAC,MAAM,WAAW,QAAQ;GACnC;IAAC;KAASK,GAAAA,gBAAAA,MAAAA,OAAY,MAAM;IAAGC,gBAAAA;GAAsB;GACrD;IAAC;KAASC,GAAAA,gBAAAA,aAAAA,OAAmB,MAAM;IAAGL,gBAAAA;GAA0B;GAChE;IAAC;KAAaM,GAAAA,gBAAAA,iBAAAA,CAAiB;IAAGP,gBAAAA;GAA2B;EAC/D,GAAY;GACV,UACE,MAAM,WACN,MACA,OAAO,yBAAyB,MAAM,WAAW,IAAI,CACvD;GACA,IAAI,CAAC,QAAQ,YAAY,KAAK,MAAM,UAAU,KAAK,GACjD,MAAM,IAAID,oBAAAA,6BACR,6BACA,mCAAmC,KACrC;EAEJ;EACA,CAAA,GAAA,gBAAA,KAAA,CAAK,SAAS,EAAE,YAAY,OAAO,CAAC,CAAC,CAAC,MAAM,WAAW,SAAS,CAAC;EACjE,MAAM,mBAAmB,OACvB,QAAQ,YAAYS,gBAAAA,qBAAqB,OAAO,OAAO,CACzD;EACA,IACE,CAAC,oBACD,CAAC,OAAO,QAAQ,gBAAgB,CAAC,CAAC,MAC/B,CAAC,KAAK,WACL,IAAI,WAAW,IAAI,KAAK,OAAO,KAAK,CAAC,EAAE,SAAS,OACpD,GAEA,MAAM,IAAIT,oBAAAA,6BACR,6BACA,uDACF;EAEF,MAAM,SAAS,QAAQ,wBAAwB,SAAS,QAAQ,MAAM;EACtE,MAAM,UAAU,IAAIU,aAAAA,gBAAgB;EACpC,KAAK,QAAQ,CAAC;EACd,KAAK,MAAM,WAAW,QAAQ,UAAU,aAAa,GAAG;GACtD,MAAM,SAAS,QAAQ;GACvB,IAAI,CAAC,QAAQ,aAAa,QAAQ,SAChC;GAEF,KAAK,MAAM,UAAU,QAAQ,kBAAkB,OAAO,SAAS,GAAG;IAChE,MAAM,UAAU,QAAQ,IAAI,OAAO,WAAW,MAAM;IACpD,MAAM,QACJ,QAAQ,YAAYR,gBAAAA,4BAA4B,OAAO,MAAM;IAC/D,MAAM,YACJ,QAAQ,YAAYD,gBAAAA,6BAA6B,OAAO,MAAM;IAChE,IACE,CAAC,SACD,CAAC,aACD,CAAC,QAAQ,YAAYK,gBAAAA,wBAAwB,OAAO,GAEpD;IAEF,MAAM,WAAW,OACf,QAAQ,YAAYG,gBAAAA,qBAAqB,QAAQ,MAAM,CACzD;IACA,MAAM,SAAS,YACX,CAAC,IACD,OAAO,QAAQ,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,WAC5C,IAAI,WAAW,IAAI,KAAK,OAAO,OAAO,KAAK,CAAC,EAAE,SAAS,WACnD,CAAC,OAAO,OAAO,KAAK,CAAC,CAAE,IAAI,CAAC,IAC5B,CAAC,CACP;IACJ,QAAQ,MACN,QACA,QACA,SAAS,YAAa,SAAS,WAAW,SAAU,UACpD;KACE,MAAM,YACF,iCACA,QACE,6BACA;KACN,MAAM;KACN,UAAU,YACN,KAAK,QAAQ,qBACb,QACE,KAAK,QAAQ,wBACb;KACN,cAAc;KACd;IACF,CACF;IACA,KAAK,MAAM,KAAK;KACd,MAAM,QAAQ,OAAO,QAAQ,MAAM;KACnC;KACA;KACA;KACA;IACF,CAAC;GACH;EACF;EACA,MAAM,aACJ,MAAM,MAAM,SAAS,KAAK,SAAS,YAAY,CAAC,KAChD,KAAK,MAAM,MAAM,UAAU,MAAM,SAAS;EAC5C,MAAM,cAAc,KAAK,MAAM,MAC5B,UAAU,MAAM,SAAS,MAAM,SAClC;EACA,IACE,cACA,eACA,CAAC,UACD,KAAK,QAAQ,uBAAuB,OACpC;GACA,MAAM,UACJ;GACF,IAAI,KAAK,QAAQ,uBAAuB,QACtC,QAAQ,OAAO,KAAK,qCAAqC,SAAS;QAElE,MAAM,IAAIT,oBAAAA,6BACR,oCACA,OACF;EAEJ;EACA,IAAI,eAAe,CAAC,QAAQ,wBAAwB,SAAS,SAAS,GACpE,KAAK,eAAe;GAClB,OAAO;GACP,MAAM;GACN,SACE;GACF,MAAM;EACR;EAEF,IAAI,aAAa;GACf,MAAM,SAAS,QAAQ,UAAU,IAAIW,aAAAA,mBAAmB,EACtD,QAAQ,MACV,CAAC;GACD,MAAM,wBAAQ,IAAI,IAAa,CAC7B,QAAQ,UAAU,IAAIC,mBAAAA,iBAAiB,EAAE,QAAQ,MAAM,CAAC,GACxD,QAAQ,UAAU,IAAIC,+BAAAA,4BAA4B,EAAE,QAAQ,MAAM,CAAC,CACrE,CAAC;GACD,MAAM,QAAQ,CACZ,GAAG,OAAO,gBAAgB,GAC1B,GAAG,OAAO,sBAAsB,CAClC,CAAC,CACE,QACE,UACC,CAAC,MAAM,IAAI,KAAK,KAChB,CAAC,CAAC,SAAS,OAAO,CAAC,CAAC,SAAS,QAAQ,IAAI,OAAOC,iBAAAA,aAAa,CAAC,CAClE,CAAC,CACA,KAAK,UAAU,MAAM,YAAY,IAAI;GACxC,IAAI,MAAM,QACR,KAAK,iBAAiB;IACpB,OAAO;IACP,MAAM;IACN,SAAS,GAAG,MAAM,KAAK,IAAI,EAAE;IAC7B,MAAM;GACR;EAEJ;CACF;CAEA,OAAO,SAAmD;EACxD,MAAM,SAAuB,CAC3B,KAAK,gBACL,KAAK,YACP,CAAC,CAAC,QAAQ,UAA+B,UAAU,KAAA,CAAS;EAC5D,MAAM,UAAU,KAAK;EACrB,MAAM,gBAAgB,QAAQ,QAC3B,EAAE,MAAM,YACP,CAAC,SAAS,CAAC,UAAU,UAAU,CAAC,CAAC,SAAS,KAAK,MAAM,CACzD;EACA,MAAM,aAAa,QAAQ,QAAQ,EAAE,WAAW,KAAK,WAAW,SAAS;EACzE,IAAI,cAAc,UAAU,WAAW,QACrC,OAAO,KAAK;GACV,OAAO;GACP,MAAM;GACN,SAAS,GAAG,WACT,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC,CAC5B,MAAM,GAAG,EAAE,CAAC,CACZ,KACC,IACF,EAAE,gDAAgD,cACjD,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC,CAC5B,MAAM,GAAG,EAAE,CAAC,CACZ,KAAK,IAAI,EAAE;GACd,MAAM;EACR,CAAC;EAEH,KAAK,MAAM,EAAE,UAAU,YACrB,IACE,KAAK,gBAAgB,MAAM,UACzB,QAAQ,MAAM,UACZ,CAAC,GAAG,MAAM,KAAK,OAAO,CAAC,CAAC,MAAM,SAAS,SAAS,MAAM,IAAI,CAC5D,CACF,GAEA,OAAO,KAAK;GACV,OAAO;GACP,MAAM;GACN,SAAS,GAAG,KAAK,KAAK;GACtB,MAAM;EACR,CAAC;EAGL,MAAM,UAAU,IAAI,IAClB,QAAQ,QAAQ,EAAE,YAAY,KAAK,CAAC,CAAC,KAAK,EAAE,aAAa,MAAM,CACjE;EACA,KAAK,MAAM,UAAU,SACnB,IACE;GACEC,iBAAAA;GACAC,iBAAAA;GACAC,iBAAAA;EACF,CAAC,CAAC,MAAM,QAAQ,QAAQ,YAAY,KAAK,MAAM,CAAC,GAEhD,OAAO,KAAK;GACV,OAAO;GACP,MAAM;GACN,SAAS,qBAAsB,OAA6B,KAAK,6BAA6B,QAC3F,QACE,UACC,MAAM,WAAW,UAAU,MAAM,KAAK,WAAW,SACrD,CAAC,CACA,KAAK,UAAU,MAAM,MAAM,CAAC,CAC5B,KAAK,IAAI,EAAE,qDACZ,QACG,QAAQ,UAAU,MAAM,WAAW,UAAU,MAAM,SAAS,CAAC,CAC7D,KAAK,UAAU,MAAM,MAAM,CAAC,CAC5B,KAAK,IAAI,KAAK,SAClB;EACH,CAAC;EAGL,IACE,CAAC,KAAK,mBACN,QAAQ,QAAQ,MACb,WAAW,OAAO,SAAS,iBAAiB,OAAO,SAAS,MAC/D,GAEA,OAAO,KAAK;GACV,OAAO;GACP,MAAM;GACN,SACE;GACF,MAAM;EACR,CAAC;EAEH,OAAO;CACT;AACF;AACA,SAAgB,gBACd,UAAmC,CAAC,GACP;CAC7B,OAAO,IAAI,iBAAiB,UAAU,OAAO;AAC/C;AACA,SAAgB,mBACd,UAAmC,CAAC,GACP;CAC7B,OAAO,IAAI,iBAAiB,aAAa,OAAO;AAClD"}

package/dist/graphql.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"graphql.d.cts","names":[],"sources":["../src/graphql-transport.ts"],"mappings":";;;UAwDiB;;EAEf;;;;;;EAMA,2BACE,+BACG;;EAEL;EACA;EACA;;qBAEW,gCAAgC;WAClC,YAAY;EAErB,YAAY,SAAS;;qBAoBV,uCAAuC;WACzC,YAAY;EAErB,YACE,OAAO,gCAAgC;;qBAM9B,+CAA+C;WACjD,YAAY;EAErB,YACE,OAAO,gCAAgC;;;wBAO3B,iCAA4B,sBAEpB;EACT,SAAS;MACnB;wBA4mBW,gBACd,UAAS,0BACR,aAAa;wBAGA,mBACd,UAAS,0BACR,aAAa"}
+{"version":3,"file":"graphql.d.cts","names":[],"sources":["../src/graphql-transport.ts"],"mappings":";;;UAyDiB;;EAEf;;;;;;EAMA,2BACE,+BACG;;EAEL;EACA;EACA;;qBAEW,gCAAgC;WAClC,YAAY;EAErB,YAAY,SAAS;;qBAoBV,uCAAuC;WACzC,YAAY;EAErB,YACE,OAAO,gCAAgC;;qBAM9B,+CAA+C;WACjD,YAAY;EAErB,YACE,OAAO,gCAAgC;;;wBAO3B,iCAA4B,sBAEpB;EACT,SAAS;MACnB;wBAmtBW,gBACd,UAAS,0BACR,aAAa;wBAGA,mBACd,UAAS,0BACR,aAAa"}

package/dist/graphql.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"graphql.d.mts","names":[],"sources":["../src/graphql-transport.ts"],"mappings":";;;UAwDiB;;EAEf;;;;;;EAMA,2BACE,+BACG;;EAEL;EACA;EACA;;qBAEW,gCAAgC;WAClC,YAAY;EAErB,YAAY,SAAS;;qBAoBV,uCAAuC;WACzC,YAAY;EAErB,YACE,OAAO,gCAAgC;;qBAM9B,+CAA+C;WACjD,YAAY;EAErB,YACE,OAAO,gCAAgC;;;wBAO3B,iCAA4B,sBAEpB;EACT,SAAS;MACnB;wBA4mBW,gBACd,UAAS,0BACR,aAAa;wBAGA,mBACd,UAAS,0BACR,aAAa"}
+{"version":3,"file":"graphql.d.mts","names":[],"sources":["../src/graphql-transport.ts"],"mappings":";;;UAyDiB;;EAEf;;;;;;EAMA,2BACE,+BACG;;EAEL;EACA;EACA;;qBAEW,gCAAgC;WAClC,YAAY;EAErB,YAAY,SAAS;;qBAoBV,uCAAuC;WACzC,YAAY;EAErB,YACE,OAAO,gCAAgC;;qBAM9B,+CAA+C;WACjD,YAAY;EAErB,YACE,OAAO,gCAAgC;;;wBAO3B,iCAA4B,sBAEpB;EACT,SAAS;MACnB;wBAmtBW,gBACd,UAAS,0BACR,aAAa;wBAGA,mBACd,UAAS,0BACR,aAAa"}