nestjs-slightly-better-auth 1.4.0 → 1.5.1

package/README.md

@@ -343,7 +343,7 @@ Better Auth treats a process with `NODE_ENV=test` or a truthy `TEST` variable (V
 
 The kits verify extension units against the invariants of the [reviewed specification](docs/design/design-v7.md) (§4 and §14.1). Each kit returns `ConformanceCase[]` (`{ id, title, skip?, run() }`) that `runConformance(cases, { describe, it })` registers with Vitest, Jest or `node:test`. Assertions use `node:assert/strict`; the kits import no test runner.
 
-Applicability comes from the unit, not from the options a harness passes. A platform that declares `capabilities.http2` needs the `http2` option. A transport with a lineage needs `invokeTwice`, one that nests handlers (`defaultAccessFor`) needs `invokeGraph`, and one that claims the kit's federation reference resolver needs `invokeEntities`. Such a case fails when the helper is missing. A case whose optional capability is absent is skipped with the reason. The kits read these members from unit objects before running; for classes and `defineExtension()` definitions they boot once and read the resolved unit. A case known to be inapplicable registers with its reason in the test name. A case that finds out at run time resolves with `{ skipped: reason }`, which `runConformance` reports through the runner's `context.skip(reason)` (Vitest, `node:test`; Jest has no runtime skip, so the test passes).
+Applicability comes from the unit, not from the options a harness passes. A platform that declares `capabilities.http2` needs the `http2` option. A transport with a lineage needs `invokeTwice`, one that nests handlers (`defaultAccessFor`) needs `invokeGraph`, and one that claims the kit's federation reference resolver needs `invokeEntities`. A transport whose browser leg is a connection's handshake, shared by the connection's messages (the WebSocket transports), runs the `T-ws-origin-*` cases instead of the `T-csrf-*` cases and needs `invokeConnection`, plus `authenticateConnection` when the app provides `WS_CONNECTION_AUTH`. Such a case fails when the helper is missing, and `T-selection` fails `expectBrowserLeg: false` for a transport that describes a browser leg. A case whose optional capability is absent is skipped with the reason. The kits read these members from unit objects before running; for classes and `defineExtension()` definitions they boot once and read the resolved unit. A case known to be inapplicable registers with its reason in the test name. A case that finds out at run time resolves with `{ skipped: reason }`, which `runConformance` reports through the runner's `context.skip(reason)` (Vitest, `node:test`; Jest has no runtime skip, so the test passes).
 
 ```ts
 import { ExpressAdapter } from "@nestjs/platform-express";
@@ -378,16 +378,16 @@ runConformance(
 );
 ```
 
-| Kit                          | Unit                  | Covers                                                                                                                                                                                                                                                                                                                                                                                 |
-| ---------------------------- | --------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `httpPlatformConformance`    | `HttpPlatform`        | Mounting, byte-exact bodies, limits with host CORS, URL and header facts, client IP, HTTP/2, write-back, request accessors, error delivery, lifecycle (no adapter, late adapter, reused `TestingModule`, double `forRoot`), diagnostics and log hygiene                                                                                                                                |
-| `transportConformance`       | `AuthTransport`       | Selection, credentials, per-request memoization, per-invocation decisions, acceptance, cookie forwarding or refresh suppression, origin and form-CSRF rules including forwarding on safe operations, error shapes and logging, the exact coverage report of the transport's claims, `globalScope: false`, mixed-kind session reads, lazy scope construction and fail-closed extraction |
-| `principalSourceConformance` | `PrincipalSource`     | Rejection without throwing, storage outages, delivery of every own-credential `Set-Cookie` exactly once, refresh suppression, clean absence, principal shape, declared credential headers, `sessionBacked` and `delegates` declarations                                                                                                                                                |
-| `policyConformance`          | `AuthorizationPolicy` | Deny values, storage outages, APIError mapping and re-classification, delegation scope, unnamed-kind gating, per-invocation decisions with shared I/O and plugin prerequisites; requirements name policy objects (construct a DI policy with its dependencies)                                                                                                                         |
+| Kit                          | Unit                  | Covers                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+| ---------------------------- | --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `httpPlatformConformance`    | `HttpPlatform`        | Mounting, byte-exact bodies, limits with host CORS, URL and header facts, client IP, HTTP/2, write-back, request accessors, error delivery, lifecycle (no adapter, late adapter, reused `TestingModule`, double `forRoot`), diagnostics and log hygiene                                                                                                                                                                                                                                                                                                                  |
+| `transportConformance`       | `AuthTransport`       | Selection, credentials, per-request memoization, per-invocation decisions, acceptance, cookie forwarding or refresh suppression, origin and form-CSRF rules including forwarding on safe operations, WebSocket handshake origins on every message and at connection time (untrusted, missing and forwarded origins, junk tokens, dynamic base URLs, function-valued `trustedOrigins`), error shapes and logging, the exact coverage report of the transport's claims, `globalScope: false`, mixed-kind session reads, lazy scope construction and fail-closed extraction |
+| `principalSourceConformance` | `PrincipalSource`     | Rejection without throwing, storage outages, delivery of every own-credential `Set-Cookie` exactly once, refresh suppression, clean absence, principal shape, declared credential headers, `sessionBacked` and `delegates` declarations                                                                                                                                                                                                                                                                                                                                  |
+| `policyConformance`          | `AuthorizationPolicy` | Deny values, storage outages, APIError mapping and re-classification, delegation scope, unnamed-kind gating, per-invocation decisions with shared I/O and plugin prerequisites; requirements name policy objects (construct a DI policy with its dependencies)                                                                                                                                                                                                                                                                                                           |
 
-Every case boots real Nest applications or modules with a real Better Auth instance that includes `conformanceProbePlugin()`. The probe counts and faults every operation of the instance's database adapter, so storage outages reach endpoints that would swallow them, and records the `Set-Cookie` lines each call produces. `createConformanceAuth({ plugins })` builds such an instance: memory adapter, `testUtils()`, `bearer()`, the probe plugin, `nestjs()` last, and `session.updateAge: 0` and origin checks on, whatever `options` says. The principal-source and policy kits take that instance as `auth`; the principal-source kit rejects an instance without `session.updateAge: 0`. The transport kit creates its own instance and passes it to your `createApp` harness together with the kit's API-key source in `principals`, a `logger` to boot with, and the `globalScope`, `appEnhancers`, `fieldResolverEnhancers` and `federation` settings of each boot. Apply every fixture decorator, including the kit's `SetMetadata()` marker, which maps the transport's claims to fixtures.
+Every case boots real Nest applications or modules with a real Better Auth instance that includes `conformanceProbePlugin()`. The probe counts and faults every operation of the instance's database adapter, so storage outages reach endpoints that would swallow them, and records the `Set-Cookie` lines each call produces. `createConformanceAuth({ plugins })` builds such an instance: memory adapter, `testUtils()`, `bearer()`, the probe plugin, `nestjs()` last, and `session.updateAge: 0` and origin checks on, whatever `options` says. The principal-source and policy kits take that instance as `auth`; the principal-source kit rejects an instance without `session.updateAge: 0`. The transport kit creates its own instance and passes it to your `createApp` harness together with the kit's API-key source in `principals`, a `logger` to boot with, and the `globalScope`, `appEnhancers`, `fieldResolverEnhancers` and `federation` settings of each boot. Apply every fixture decorator, including the kit's `SetMetadata()` marker, which maps the transport's claims to fixtures. On a connection-shaped browser leg, the kit's cookie credential carries the instance's base URL, `http://localhost:3000`, as `Origin`, as a browser page of that origin does; the `T-ws-origin-*` cases pass their own `Origin`, `Host` and forwarding headers, which the harness sends in the handshake.
 
-This repository runs the platform kit against Express and Fastify, the transport kit against the built-in HTTP transport and an in-process reference transport, the principal-source kit against the session and API-key sources, and the policy kit against the admin, organization, API-key and fresh-session policies. Mutation tests confirm that each of these defects fails the intended case: a platform merging `Set-Cookie`, a transport sharing invocation state across aliases, a transport without a browser leg on safe operations, a `defineExtension()` transport with a lineage or nesting and no helper, a source throwing its denial, a source dropping its refresh cookie, a source turning a storage outage into a 401, and a policy widening delegated principals.
+This repository runs the platform kit against Express and Fastify; the transport kit against the built-in HTTP transport, an in-process reference transport, Socket.IO and `ws` (each with and without a principal TTL), the RPC transport over TCP (standalone and hybrid), gRPC, NATS, RabbitMQ, MQTT, Redis and Kafka, and the Apollo (Express and Fastify) and Mercurius transports over HTTP and over graphql-ws (with and without a subscription principal TTL; Mercurius also without `mercuriusSubscriptionContext()`), with federation 2 subgraphs and a federation 1 run of `T-reference-resolver`; the principal-source kit against the session and API-key sources; and the policy kit against the admin, organization, API-key and fresh-session policies. gRPC skips `T-error-shape`, because it delivers only a status and a message. The kit reads each call's browser leg while its invocation runs, because the GraphQL transports reject a completed request. Mutation tests confirm that each of these defects fails the intended case: a platform merging `Set-Cookie`, a transport sharing invocation state across aliases, a transport without a browser leg on safe operations, a `defineExtension()` transport with a lineage or nesting and no helper, a WebSocket transport that enforces its handshake like a safe read, exempts handshakes that carry a token, builds its leg URL from the bare handshake path or from forwarded headers, or answers internal errors with their cause, a GraphQL transport whose aliases share one invocation, whose lineage gives every field of an operation one position, whose field resolvers do not inherit their root's access, or that serves reference resolvers without field guards, a GraphQL harness that omits `invokeGraph`, `invokeEntities` or `invokeConnection`, a source throwing its denial, a source dropping its refresh cookie, a source turning a storage outage into a 401, and a policy widening delegated principals.
 
 ## Develop in this monorepo
 
@@ -407,7 +407,12 @@ The shared toolchain uses Node.js LTS, pnpm, tsdown, TypeScript and Vitest. Buil
 
 ## Examples
 
-The [Express](../../examples/better-auth-express/README.md) and [Fastify](../../examples/better-auth-fastify/README.md) example applications register a default and a named instance, guard routes and read the signed-in user through a principal parameter. They start without external services.
+Each example application registers a default and a named instance, reads the signed-in user through the `@CurrentUser()` principal parameter and starts without external services:
+
+- [Express](../../examples/better-auth-express/README.md) and [Fastify](../../examples/better-auth-fastify/README.md) guard HTTP routes on their platforms.
+- [Apollo GraphQL](../../examples/better-auth-graphql/README.md) authenticates queries and mutations over HTTP and every graphql-ws operation, with the named instance bound to its own resolver.
+- [Socket.IO](../../examples/better-auth-websockets/README.md) authenticates gateway connections and every message, with the named instance on its own namespace.
+- [TCP microservice](../../examples/better-auth-rpc/README.md) authenticates the messages of a hybrid application through the payload credential carrier.
 
 ## Releases
 

package/dist/admin.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_auth_errors = require("./auth-errors-1EdQ36D8.cjs");
-const require_auth_decorators = require("./auth-decorators-B7xasVk_.cjs");
+const require_auth_decorators = require("./auth-decorators-9L-UO_T3.cjs");
 let better_auth_api = require("better-auth/api");
 //#region src/admin.ts
 const adminPermissionPolicy = {

package/dist/admin.d.cts

@@ -1,4 +1,4 @@
-import { Ct as AuthPrincipal, Nt as PrincipalKind, f as AuthorizationPolicy, ot as Requirement, vt as AdminPermissions } from "./auth-contracts-CL8TEt5t.cjs";
+import { Ct as AuthPrincipal, Nt as PrincipalKind, f as AuthorizationPolicy, ot as Requirement, vt as AdminPermissions } from "./auth-contracts-mejJfv9d.cjs";
 //#region src/admin.d.ts
 export interface PermissionOptions {
   principals?: readonly PrincipalKind[];

package/dist/admin.d.mts

@@ -1,4 +1,4 @@
-import { Ct as AuthPrincipal, Nt as PrincipalKind, f as AuthorizationPolicy, ot as Requirement, vt as AdminPermissions } from "./auth-contracts-CnGaBzlg.mjs";
+import { Ct as AuthPrincipal, Nt as PrincipalKind, f as AuthorizationPolicy, ot as Requirement, vt as AdminPermissions } from "./auth-contracts-B2SAVlKT.mjs";
 //#region src/admin.d.ts
 export interface PermissionOptions {
   principals?: readonly PrincipalKind[];

package/dist/admin.mjs

@@ -1,5 +1,5 @@
 import { n as BetterAuthConfigurationError } from "./auth-errors-B6jLBpQu.mjs";
-import { u as Require } from "./auth-decorators-DUmQ-n_w.mjs";
+import { u as Require } from "./auth-decorators-CQYu3gaF.mjs";
 import { isAPIError } from "better-auth/api";
 //#region src/admin.ts
 const adminPermissionPolicy = {

package/dist/api-key.cjs

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_auth_errors = require("./auth-errors-1EdQ36D8.cjs");
-const require_auth_scope_interceptor = require("./auth-scope-interceptor-DU57SvDf.cjs");
-const require_auth_decorators = require("./auth-decorators-B7xasVk_.cjs");
+const require_auth_scope_interceptor = require("./auth-scope-interceptor-DJTO9RVP.cjs");
+const require_auth_decorators = require("./auth-decorators-9L-UO_T3.cjs");
 let better_auth_plugins_access = require("better-auth/plugins/access");
 //#region src/api-key.ts
 const API_KEY_PRINCIPAL_KIND = "api-key";

package/dist/api-key.d.cts

@@ -1,4 +1,4 @@
-import { $ as PrincipalDelegation, it as PrincipalSource, o as AuthPrincipalBase, ot as Requirement } from "./auth-contracts-CL8TEt5t.cjs";
+import { $ as PrincipalDelegation, it as PrincipalSource, o as AuthPrincipalBase, ot as Requirement } from "./auth-contracts-mejJfv9d.cjs";
 //#region src/api-key.d.ts
 export declare const API_KEY_PRINCIPAL_KIND: "api-key";
 export interface ApiKeyPrincipal extends AuthPrincipalBase {

package/dist/api-key.d.mts

@@ -1,4 +1,4 @@
-import { $ as PrincipalDelegation, it as PrincipalSource, o as AuthPrincipalBase, ot as Requirement } from "./auth-contracts-CnGaBzlg.mjs";
+import { $ as PrincipalDelegation, it as PrincipalSource, o as AuthPrincipalBase, ot as Requirement } from "./auth-contracts-B2SAVlKT.mjs";
 //#region src/api-key.d.ts
 export declare const API_KEY_PRINCIPAL_KIND: "api-key";
 export interface ApiKeyPrincipal extends AuthPrincipalBase {

package/dist/api-key.mjs

@@ -1,6 +1,6 @@
 import { n as BetterAuthConfigurationError, r as BetterAuthInfrastructureError, t as AuthFailures, u as normalizeThrown } from "./auth-errors-B6jLBpQu.mjs";
-import { a as absent, l as rejected, o as authenticated } from "./auth-scope-interceptor-ctnmljij.mjs";
-import { u as Require } from "./auth-decorators-DUmQ-n_w.mjs";
+import { a as absent, l as rejected, o as authenticated } from "./auth-scope-interceptor-C0NRu4uy.mjs";
+import { u as Require } from "./auth-decorators-CQYu3gaF.mjs";
 import { role } from "better-auth/plugins/access";
 //#region src/api-key.ts
 const API_KEY_PRINCIPAL_KIND = "api-key";

package/dist/{auth-contracts-CL8TEt5t.d.cts → auth-contracts-B2SAVlKT.d.mts}

@@ -1,10 +1,10 @@
-import { IncomingHttpHeaders, IncomingMessage } from "node:http";
 import { CallHandler, CanActivate, DynamicModule, ExecutionContext, InjectionToken, Logger, LoggerService, ModuleMetadata, NestInterceptor, OptionalFactoryDependency, Provider, Type } from "@nestjs/common";
 import { AbstractHttpAdapter, DiscoveryService, HttpAdapterHost, ModuleRef, Reflector } from "@nestjs/core";
-import "@nestjs/core/injector/instance-wrapper.js";
-import { HookEndpointContext } from "better-auth";
-import { IntrinsicException } from "@nestjs/common/exceptions/intrinsic.exception.js";
 import { Observable } from "rxjs";
+import { IntrinsicException } from "@nestjs/common/exceptions/intrinsic.exception.js";
+import { IncomingHttpHeaders, IncomingMessage } from "node:http";
+import { HookEndpointContext } from "better-auth";
+import "@nestjs/core/injector/instance-wrapper.js";
 //#endregion
 //#region src/auth-errors.d.ts
 type AuthErrorCode = "UNAUTHENTICATED" | "FORBIDDEN" | "RATE_LIMITED";
@@ -87,7 +87,7 @@ declare class BetterAuthInfrastructureError extends Error {
 }
 declare function getRawCause(error: BetterAuthInfrastructureError): unknown;
 declare namespace auth_tokens_d_exports {
-  export { ACCEPT_PRINCIPALS_METADATA, ACCESS_METADATA, AUTH_ENHANCER, AUTH_INSTANCE_METADATA, DB_HOOK_METADATA, FORWARD_COOKIES_METADATA, FRESHNESS_METADATA, GUARD_CORE, HOOK_METADATA, INSTANCE_REGISTRY, INVOCATION_PARAMS_METADATA, INVOCATION_VALUES, MOUNT_COORDINATOR, PLATFORMS, POLICY_INVOKER, POLICY_RESOLVER, PRINCIPAL_PARAMS_METADATA, PRINCIPAL_READINGS, PRINCIPAL_RESOLVER, READER_CONTEXT, REQUEST_SCOPE, REQUIREMENTS_METADATA, ROUTE_PLANNER, SCOPE_CORE, SKIP_DEFAULT_REQUIREMENTS_METADATA, SKIP_ORIGIN_CHECK_METADATA, TRANSPORTS, TRANSPORT_REGISTRY, USE_BETTER_AUTH_METADATA, getBetterAuthHandleToken, getBetterAuthInstanceToken, getBetterAuthOptionsToken, getBetterAuthServiceToken, getExtensionToken, getPrincipalSourcesToken };
+  export { ACCEPT_PRINCIPALS_METADATA, ACCESS_METADATA, AUTH_ENHANCER, AUTH_INSTANCE_METADATA, DB_HOOK_METADATA, FORWARD_COOKIES_METADATA, FRESHNESS_METADATA, GUARD_CORE, HOOK_METADATA, INSTANCE_REGISTRY, INVOCATION_PARAMS_METADATA, INVOCATION_VALUES, MOUNT_COORDINATOR, PLATFORMS, POLICY_INVOKER, POLICY_RESOLVER, PRINCIPAL_PARAMS_METADATA, PRINCIPAL_READINGS, PRINCIPAL_RESOLVER, READER_CONTEXT, REQUEST_SCOPE, REQUIREMENTS_METADATA, ROUTE_PLANNER, SCOPE_CORE, SKIP_DEFAULT_REQUIREMENTS_METADATA, SKIP_ORIGIN_CHECK_METADATA, TRANSPORTS, TRANSPORT_REGISTRY, USE_BETTER_AUTH_METADATA, WS_CONNECTION_AUTH, getBetterAuthHandleToken, getBetterAuthInstanceToken, getBetterAuthOptionsToken, getBetterAuthServiceToken, getExtensionToken, getPrincipalSourcesToken };
 }
 declare function getBetterAuthInstanceToken(alias?: string): string;
 declare function getBetterAuthOptionsToken(alias?: string): string;
@@ -120,6 +120,8 @@ declare const USE_BETTER_AUTH_METADATA: unique symbol;
 declare const HOOK_METADATA: unique symbol;
 declare const DB_HOOK_METADATA: unique symbol;
 declare const AUTH_ENHANCER: unique symbol;
+/** Connection-time WebSocket authentication, provided by the socket.io and ws transport definitions. */
+declare const WS_CONNECTION_AUTH: unique symbol;
 declare function getPrincipalSourcesToken(instance: string): symbol;
 declare function getExtensionToken(point: "platforms" | "transports" | "principals", instance: string, index: number): symbol;
 declare const READER_CONTEXT: unique symbol;
@@ -1657,5 +1659,5 @@ interface PolicyBootContext {
   readonly site: string;
 }
 //#endregion
-export { PrincipalDelegation as $, getRawCause as $n, SESSION_PRINCIPAL_KIND as $t, DatabaseHookTarget as A, BetterAuthService as An, GetSessionWithHeaders as At, HookOptions as B, getBetterAuthHandleToken as Bn, UnvalidatedBody as Bt, ConformanceCase as C, defineHttpPlatform as Cn, AuthPrincipal as Ct, CookieForwardingOptions as D, allow as Dn, DatabaseHookMethod as Dt, ConformanceSkip as E, BetterAuthGuard as En, DatabaseHookData as Et, ExtensionDefinition as F, BetterAuthModule as Fn, Register as Ft, InboundAuthRequest as G, AuthErrorCode as Gn, betterAuthCorsOrigin as Gt, HttpMountOptions as H, getBetterAuthOptionsToken as Hn, WithActiveOrganization as Ht, ExtensionRef as I, GUARD_CORE as In, RegisteredAuth as It, PlatformMountContext as J, AuthGraphqlExtensions as Jn, definePrincipalSource as Jt, InvocationLineage as K, AuthFailure as Kn, absent as Kt, FastifyPlatformOptions as L, POLICY_INVOKER as Ln, RegisteredInstances as Lt, DbHookOptions as M, InstanceLookup as Mn, OrgPermissions as Mt, DefaultInstanceCheck as N, EXTENSION_DEFINITION as Nn, PrincipalKind as Nt, CookieSink as O, definePolicy as On, DatabaseHookResult as Ot, ExpressPlatformOptions as P, UPGRADE_REQUEST as Pn, PrincipalOfKind as Pt, PolicyRef as Q, ErrorMappingOptions as Qn, RequireFreshSession as Qt, GuardReach as R, PRINCIPAL_RESOLVER as Rn, SessionOf as Rt, ClaimOptions as S, defineExtension as Sn, AuthOf as St, ConformanceRunner as T, BetterAuthScopeInterceptor as Tn, AuthUser as Tt, HttpPlatform as U, getBetterAuthServiceToken as Un, PrincipalKinds as Ut, HookPredicate as V, getBetterAuthInstanceToken as Vn, UserOf as Vt, HttpRequestAccessor as W, AuthErrorBody as Wn, httpTransport as Wt, PolicyBootContext as X, BetterAuthConfigurationError as Xn, CurrentSession as Xt, PlatformPrepareContext as Y, AuthTransportErrorPayload as Yn, rejected as Yt, PolicyInvoker as Z, BetterAuthInfrastructureError as Zn, CurrentUser as Zt, BetterAuthRuntimeOptions as _, allOf as _n, TransportValidationContext as _t, AuthHandlerInterceptor as a, BeforeAuth as an, ProxyTrust as at, BootAdviceContext as b, definePrincipalParam as bn, AuthHookContext as bt, AuthTransport as c, ForwardAuthCookies as cn, RequirementOptions as ct, AuthorizationLimits as d, Require as dn, ScopeInit as dt, freshSession as en, isAuthFailure as er, PrincipalReading as et, AuthorizationPolicy as f, RequireAuth as fn, SessionOption as ft, BetterAuthModuleOptions as g, UseBetterAuth as gn, TransportKit as gt, BetterAuthModuleAsyncOptions as h, UseAuthInstance as hn, TransportCall as ht, AuthHandle as i, AfterDatabase as in, PrincipalSource as it, DbHookMethodDecorator as j, TransportRegistry as jn, IsRegistered as jt, CorsOriginOptions as k, deny as kn, EndpointPath as kt, AuthorizationContext as l, OptionalAuth as ln, ResolutionRequest as lt, BetterAuthFactoryResult as m, SkipOriginCheck as mn, StaticOptionMustBePassedToForRootAsync as mt, ApplicationRouteDescriptor as n, AcceptPrincipals as nn, isInfrastructureError as nr, PrincipalResolver as nt, AuthPrincipalBase as o, BeforeDatabase as on, Requirement as ot, BetterAuthAppOptions as p, SkipDefaultRequirements as pn, SessionPrincipalOptions as pt, OriginCheckOptions as q, AuthFailures as qn, authenticated as qt, AuthContextView as r, AfterAuth as rn, PrincipalResult as rt, AuthRouteBinding as s, CurrentPrincipal as sn, RequirementExpr as st, AdvisedHandler as t, sessionPrincipal as tn, isConfigurationError as tr, PrincipalRequest as tt, AuthorizationDecision as u, Public as un, RoutePlan as ut, BetterAuthStaticOptions as v, anyOf as vn, AdminPermissions as vt, ConformanceOutcome as w, defineTransport as wn, AuthSession as wt, BrowserExposure as x, requirement as xn, AuthLike as xt, BootAdvice as y, defineInvocationParam as yn, AuthAfterHookContext as yt, HookMethodDecorator as z, SCOPE_CORE as zn, SessionPrincipal as zt };
-//# sourceMappingURL=auth-contracts-CL8TEt5t.d.cts.map
+export { PrincipalDelegation as $, ErrorMappingOptions as $n, SESSION_PRINCIPAL_KIND as $t, DatabaseHookTarget as A, BetterAuthService as An, GetSessionWithHeaders as At, HookOptions as B, WS_CONNECTION_AUTH as Bn, UnvalidatedBody as Bt, ConformanceCase as C, defineHttpPlatform as Cn, AuthPrincipal as Ct, CookieForwardingOptions as D, allow as Dn, DatabaseHookMethod as Dt, ConformanceSkip as E, BetterAuthGuard as En, DatabaseHookData as Et, ExtensionDefinition as F, BetterAuthModule as Fn, Register as Ft, InboundAuthRequest as G, AuthErrorBody as Gn, betterAuthCorsOrigin as Gt, HttpMountOptions as H, getBetterAuthInstanceToken as Hn, WithActiveOrganization as Ht, ExtensionRef as I, GUARD_CORE as In, RegisteredAuth as It, PlatformMountContext as J, AuthFailures as Jn, definePrincipalSource as Jt, InvocationLineage as K, AuthErrorCode as Kn, absent as Kt, FastifyPlatformOptions as L, POLICY_INVOKER as Ln, RegisteredInstances as Lt, DbHookOptions as M, InstanceLookup as Mn, OrgPermissions as Mt, DefaultInstanceCheck as N, EXTENSION_DEFINITION as Nn, PrincipalKind as Nt, CookieSink as O, definePolicy as On, DatabaseHookResult as Ot, ExpressPlatformOptions as P, UPGRADE_REQUEST as Pn, PrincipalOfKind as Pt, PolicyRef as Q, BetterAuthInfrastructureError as Qn, RequireFreshSession as Qt, GuardReach as R, PRINCIPAL_RESOLVER as Rn, SessionOf as Rt, ClaimOptions as S, defineExtension as Sn, AuthOf as St, ConformanceRunner as T, BetterAuthScopeInterceptor as Tn, AuthUser as Tt, HttpPlatform as U, getBetterAuthOptionsToken as Un, PrincipalKinds as Ut, HookPredicate as V, getBetterAuthHandleToken as Vn, UserOf as Vt, HttpRequestAccessor as W, getBetterAuthServiceToken as Wn, httpTransport as Wt, PolicyBootContext as X, AuthTransportErrorPayload as Xn, CurrentSession as Xt, PlatformPrepareContext as Y, AuthGraphqlExtensions as Yn, rejected as Yt, PolicyInvoker as Z, BetterAuthConfigurationError as Zn, CurrentUser as Zt, BetterAuthRuntimeOptions as _, allOf as _n, TransportValidationContext as _t, AuthHandlerInterceptor as a, BeforeAuth as an, ProxyTrust as at, BootAdviceContext as b, definePrincipalParam as bn, AuthHookContext as bt, AuthTransport as c, ForwardAuthCookies as cn, RequirementOptions as ct, AuthorizationLimits as d, Require as dn, ScopeInit as dt, freshSession as en, getRawCause as er, PrincipalReading as et, AuthorizationPolicy as f, RequireAuth as fn, SessionOption as ft, BetterAuthModuleOptions as g, UseBetterAuth as gn, TransportKit as gt, BetterAuthModuleAsyncOptions as h, UseAuthInstance as hn, TransportCall as ht, AuthHandle as i, AfterDatabase as in, PrincipalSource as it, DbHookMethodDecorator as j, TransportRegistry as jn, IsRegistered as jt, CorsOriginOptions as k, deny as kn, EndpointPath as kt, AuthorizationContext as l, OptionalAuth as ln, ResolutionRequest as lt, BetterAuthFactoryResult as m, SkipOriginCheck as mn, StaticOptionMustBePassedToForRootAsync as mt, ApplicationRouteDescriptor as n, AcceptPrincipals as nn, isConfigurationError as nr, PrincipalResolver as nt, AuthPrincipalBase as o, BeforeDatabase as on, Requirement as ot, BetterAuthAppOptions as p, SkipDefaultRequirements as pn, SessionPrincipalOptions as pt, OriginCheckOptions as q, AuthFailure as qn, authenticated as qt, AuthContextView as r, AfterAuth as rn, isInfrastructureError as rr, PrincipalResult as rt, AuthRouteBinding as s, CurrentPrincipal as sn, RequirementExpr as st, AdvisedHandler as t, sessionPrincipal as tn, isAuthFailure as tr, PrincipalRequest as tt, AuthorizationDecision as u, Public as un, RoutePlan as ut, BetterAuthStaticOptions as v, anyOf as vn, AdminPermissions as vt, ConformanceOutcome as w, defineTransport as wn, AuthSession as wt, BrowserExposure as x, requirement as xn, AuthLike as xt, BootAdvice as y, defineInvocationParam as yn, AuthAfterHookContext as yt, HookMethodDecorator as z, SCOPE_CORE as zn, SessionPrincipal as zt };
+//# sourceMappingURL=auth-contracts-B2SAVlKT.d.mts.map

package/dist/auth-contracts-B2SAVlKT.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-contracts-B2SAVlKT.d.mts","names":[],"sources":["../src/auth-errors.ts","../src/auth-tokens.ts","../src/auth-module.ts","../src/bridge-protocol.ts","../src/request-scope.ts","../src/origin-check.ts","../src/instance-registry.ts","../src/mount-coordinator.ts","../src/principal-readings.ts","../src/policy-resolver.ts","../src/transport-registry.ts","../src/route-planner.ts","../src/auth-service.ts","../src/authorization-evaluator.ts","../src/auth-guard.ts","../src/auth-scope-interceptor.ts","../src/auth-module-definition.ts","../src/auth-decorators.ts","../src/session-principal.ts","../src/principal-resolver.ts","../src/auth-exchange.ts","../src/http-transport.ts","../src/index.ts","../src/auth-types.ts","../src/auth-contracts.ts"],"mappings":";;;;;;;;;KAkBY;;UAGK;WACN;WACA,MAAM;WACN;WACA;WACA;WACA,UAAU;;UAGJ;EACf;EACA;EACA,MAAM;EACN;EACA;;UAGe;EACf,MAAM;EACN;EACA;;UAGe;EACf;EACA;EACA,MAAM;EACN;EACA;;UAGe;EACf,OACE,SAAS,aACT,SAAS,kBACT;EAEF;;iBAQc,cAAc,iBAAiB,SAAS;iBAIxC,sBACd,iBACC,SAAS;iBAII,qBACd,iBACC,SAAS;iBAqDH,UAAU;EACjB;EACA;EACA;EACA;EACA;IACE;cA6BS;EACX,gBAAe,mBAAoB;EAGnC,iBAAQ;EACR,UAAS,gBAAe,mBAAqB;EAG7C,aAAY,iBAAkB;;cA4BnB,qCAAqC;WACvC;WACA;WACA;WACA;WACA;WACA;aACP;aACA;aACA;;WAEO,kBAAkB;EAE3B,YAAY,cAAc,gBAAgB;SAUnC,UACL,cACA,gBACA;IAAY;IAAe;MAC1B;;cAeQ,sCAAsC;WACxC,OAAO;WACP;aACP;aACA;aACA;;EAGF,YAAY,gBAAgB;IAAY;;;iBAwB1B,YAAY,OAAO;;;;iBC7QnB,2BAA2B;iBAI3B,0BAA0B;iBAI1B,0BAA0B;iBAI1B,yBAAyB;cAK5B;cAGA;cAGA;cAGA;cAGA;cAGA;cAGA;cAGA;cACA;cACA;cAGA;cAGA;cACA;cACA;cACA;cAGA;cAGA;cAGA;cAGA;cAGA;cAGA;cAGA;cAGA;cAGA;cAGA;cACA;cAGA;;cAEA;iBAIG,yBAAyB;iBAMzB,kBACd,kDACA,kBACA;cAOW;cAGA;;;cCvGA;SACJ,QAAQ,UAAU,WAAW,gBAClC,SAAS,wBAAwB,KAC/B;IAAyB;MAAqB,qBAAqB,KACpE;SACI,QAAQ,UAAU,UACvB,SAAS,wBAAwB;IAAO;MAAiB,eACxD;SAWI,aAAa,UAAU,WAAW,gBACvC,SAAS,6BAA6B,KACpC;IAAyB;MAC1B;SACI,aAAa,UAAU,UAC5B,SAAS,6BAA6B;IAAO;MAAiB,eAC7D;;;;cC/BQ;cAGA;UAII;WACN;WACA;;WAEA;;WAEA;;;;;;;;EAQT,KAAK,SAAS;IAAkB;IAAe;;;EAE/C,mBAAmB;;UAEJ;;WAEN;aAAkB;;;WAElB;;EAET;;EAEA,WAAW;;WAEF;WACA,iBAAiB;WACjB,gBAAgB;WAChB,UAAU,YAChB,KAAK;aACK,iBAAiB,mBAAmB;aACpC,gBAAgB,mBAAmB;;;EAIhD,UAAU;;UAEK;;WAEN,SAAS;WACT;WACA,gBAAgB;WAChB;;;;;;;WAOA,sBAAsB,cAAc;;;WAGpC,uBAAuB;;UAEjB;;;;;;;;EAQf,QAAQ,KAAK,qBAAqB,OAAO;EACzC,IAAI,KAAK,sBAAsB;;;;UC9DhB;WACN,MAAM;WACN,OAAO;WACP,OAAO;WACP,gBAAgB;;UAEV;WACN,WAAW,YAAY,QAAQ;WAC/B,UAAU,YAAY;WACtB,WAAW,YAAY,QAAQ;WAC/B,QAAQ;WACR,oBAAoB;WACpB,SAAS,YAAY,QAAQ;WAC7B,UAAU;WACV,aAAa;IAGlB,OAAO,QAAQ;MAAmB;;IAClC;;;cAmCO;;EAOX,IAAI,GAAG,OAAO,YAAY,UAAU,IAAI;EAIxC,KAAK,GAAG,UAAU,IAAI;EAItB,WAAW;EAIX,SAAS,cAAc;EAkBvB,cACE,MAAM,KAAK,yDACX;IACE;IACA;IACA;KAEF,eAAe,QAAQ,mBACtB,QAAQ;EAqCX,aAAa,GACX,iBACA,kBACA,qBACA,eAAe,QAAQ,IACvB,yBACC,QAAQ;EA0BX,aACE,oBACA,kBACA,qBACA,eAAe,QAAQ,yBACtB,QAAQ;EAWX,SAAS,kBAAkB;EAc3B,SACE,aACA,eACA;IAAW;IAAkB;IAAc,UAAU;;;;;;cCnL5C;;mBAOQ;EADnB,YACmB;IACf,KAAK;IACL,MAAM;;EAIV,OACE,kBACA,SAAS,aACT,SAAS,SACT;EA6BF,gBACE,kBACA,SAAS,SACT;;UAWa;WACN;WACA,SAAS;WACT,UAAU;WACV,cAAc;WACd;WACA;;cAGE;;mBAKQ;mBACA;EAFnB,YACmB,OAAO,cACP,MAAM;EAKzB,MACE,SAAS,iBACT,0BACC,QAAQ;EAiEL,SAAS,SAAS,kBAAkB;EAkB1C,oBACE,SAAS,iBACT,cACA;UAuBM;UAkBM;;;;UCpMC;WACN;WACA,UAAU;WACV,SAAS,yBAAyB;WAClC,eAAe;WACf,kBAAkB;WAClB,QAAQ;WACR,SAAS;WACT,QAAQ;WACR,QAAQ;WACR;;UAEM;EACf,IAAI,eAAe;EACnB,iBAAiB;;UAEF;WACN;WACA,UAAU;WACV,SAAS,yBAAyB;WAClC,eAAe;WACf,YAAY;WACZ,kBAAkB;WAClB,QAAQ;;cAgBN,4BAA4B;;mBASa;WAN3C,QAAM;WACN,aAAW;EACpB;EACA,SAAS;EACT;IAAU;;EAEV,YAAoD,OAAO;EAE3D,SACE,SAAS,yBAAyB,WAClC,eAAe,yBACf,kBAAkB,mBAClB,YAAY,uBACX;EAiBH,0BAA0B;EAI1B,IAAI,eAAe;EAYnB,iBAAiB;EAIjB,MAAM,SAAS;EAmBT,WAAW,QAAQ,iCAAiC;EAyK1D;;;;cCjSW;;WAUyB,MAAM;mBACI;WAVrC,QAAM;EAQf,YACoC,MAAM,iBACI,UAAU,kBAC/B,OAAO;EAMhC,kBAAkB,oBAAoB;MAKlC,YAAY;MAIZ,WAAW;UAIP;EAqDR,cAAc,QAAQ;EAmBtB,QAAQ,QAAQ;EAyEhB,MAAM,mBAAmB;EAMzB,QAAQ,eAAe;EAIvB,qBAAqB;EAIrB,0BAA0B;EAO1B,0BACE,iBAAiB,8BACjB,QAAQ;EAkBJ,SAAS;EAwBf;;;;UChQe;WACN;WACA,OAAO;WACP,UAAU;WACV,OAAO,KAAK;WACZ;WACA;;;cAwEE,4BAA4B;EACvC,YAAY,OAAO;;cAMR;mBACkB;EAA7B,YAA6B,OAAO;EAEpC,OACE,MAAM,KAAK,0CACX,SAAS;EAUX,cAAc,SAAS,mBAAmB,SAAS;EAMnD,UACE,SAAS,mBACT,2BACC;EAWH,KAAK,OAAO,eAAe;EA0E3B,WAAW;EAWX,QAAQ,GACN,SAAS,kBACT;IACE;IACA;IACA;IACA,UAAU,WAAW,kBAAkB;KAEzC,QAAQ,eACP;EAqBH,QACE,OAAO,8BACP,QAAQ,cACR,oBACC,+BAA+B;EAmBlC,MACE,0BACA,kBACA,QAAQ;;;;cC5RC;mBAMkB;mBALZ;EAKjB,YAA6B,WAAW;EAExC,QAAQ,GAAG,WAAW,UAAU,KAAK,oBAAoB;;;;cCJ9C;UACH;mBACS;UACT;EAER,SAAS,qBAAqB;EAI9B,OAAO,KAAK;EAIZ,iBAAiB;EAKjB,iBAAiB,QAAQ,UAAU;EAUnC,KAAK,SAAS,mBAAmB;EAIjC,OAAO,SAAS,mBAAmB;EAWnC,KAAK,MAAM;EAIX,SACE,SAAS,kBACT,YAAS,gBACR;;;;cCHQ;mBAKQ;mBACA;mBACA;mBALF;EAEjB,YACmB,WAAW,gBACX,UAAU,gBACV,YAAY;UAGvB;EAiGR,eAAe,QAAQ,MAAM,0BAA0B;EAIvD,WAAW,SAAS,mBAAmB;EAiBvC,KAAK,QAAQ,MAAM,iBAAiB;;;;cCzJzB,kBAAkB,UAAU,WAAW;;mBAQJ;mBACJ;mBACK;mBACL;mBACK;mBACD;WAZrC;WACA,UAAU;WACV,KAAK;EAGd,YACuC,SAAS,yBAAyB,IAC3B,UAAU,kBACd,OAAO,cACF,UAAU,mBACf,SAAS,cACJ,YAAY,mBACb,aAAa;EAiB3D,WAAW,QAAQ,QAAQ;EAI3B;aAEe;aACA;aACA;;EAcf,gBAAgB,QAAQ;EAUxB,cAAc,QAAQ,UAAU;EAIhC,aAAa,SAAS,mBAAmB;EAiBzC,YAAY,2BAA2B;EA0BvC,sBAAsB,GAAG,UAAU,QAAQ,KAAK,QAAQ;EA0BxD,eAAe,GAAG,UAAU,QAAQ,KAAK,QAAQ;EAiBjD,gBAAgB,GAAG,UAAU,QAAQ,KAAK,QAAQ;;;;cCxJvC,aAAY;cACZ,OAAI;EACf;EACA;EACA;EACA;MACE;iBACY,aAAa,GAAG,UAAU,gBAAgB,eACxD,QAAQ,oBAAoB,GAAG,gBAAgB,OAC7C,QAAQ,GAAG,UAAU,uBAAuB,YAAY;cAY/C;mBAIQ;mBACA;mBACA;mBACA;mBANF;EAEjB,YACmB,UAAU,gBACV,SAAS,eACT,UAAU,mBACV,OAAO;EAGpB,SACJ,MAAM,WACN,WAAW,eACX,MAAM,eACN,OAAO,eACP,WAAW,kBACX,oBACC,QAAQ;;;;cCxCA,2BAA2B;mBAKC;mBAJtB;YACP;EAEV,YACuC,MAAM,KAAK;EAGlD,YAAY,SAAS,mBAAmB;;cAI7B,qBAAqB;mBAEb;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;EAPnB,YACmB,WAAW,gBACX,SAAS,cACT,YAAY,mBACZ,UAAU,mBACV,WAAW,wBACX,OAAO,cACP,UAAU;EAGvB,YAAY,SAAS,mBAAmB;;;;cChCnC,sCAAsC;mBAKV;mBAJtB;YACP;EAEV,YACuC,MAAM,KAAK;EAGlD,UAAU,SAAS,kBAAkB,MAAM,cAAc;;cAI9C,qBAAqB;mBAEb;mBACA;mBACA;mBACA;mBACA;EALnB,YACmB,WAAW,gBACX,SAAS,cACT,YAAY,mBACZ,OAAO,cACP,UAAU;EAG7B,UAAU,SAAS,kBAAkB,MAAM,cAAc;;;;iBCc3C,gBAAgB,GAC9B,YAAY,KAAK,oBAAoB,WAAW,wBAC/C,oBAAoB;iBAGP,mBAAmB,UAAU,cAAc,UAAU,IAAI;iBAGzD,gBAAgB,UAAU,eAAe,WAAW,IAAI;;;cCtB3D,uCAAM,uBAAA;cACN,6CAAY,uBAAA;cAEZ,cAAW;EAAgB;OAAyB,kBAAA,UAAA,GAAA,QAAA,oBAAA,+BAAA,aAAA,wBAAA;cAKpD,kBAAe,0CAAgB,uBAAA;cAE/B,sBAAgB,iBACP,kBAAkB,8CAAgB,uBAAA;cAE3C,wDAAuB,uBAAA;cAEvB,qBAAkB,+CAAA,uBAAA;cAElB,gDAAe,uBAAA;cAEf,sBAAa,kBAAA,UAAA,GAAA,QAAA,oBAAA,+BAAA,aAAA,wBAAA;iBAMV,WACX,uBAAuB,oBACzB,iBAAiB;cAeP,WAAK,uBACU,sBACzB;cACU,WAAK,uBACU,sBACzB;cACU,cAAe,GAAC,QACnB,UAAU,IAAE,QACZ,GAAC,UACC,uBACT,YAAY;cAyEF,wBAAuB;iBACpB,qBAAqB,UAAU,eAAe,GAAG;WACtD,MAAM;WACN;WACA,UAAU,WAAW,gBAAgB,OAAO;UAC7C;iBAGM,sBACd,cACA;WAAiB;UACV;cA4GI,mBAAoB,UAAU,8BAA4B,QAC7D,aAAa,MAAM,eAAa,UAC9B,gBACT,oBAAoB;cACV,kBAAmB,UAAU,8BAA4B,QAC5D,aAAa,MAAM,eAAa,UAC9B,gBACT,oBAAoB;cAqBV,iBAAkB,UAAU,oBAAkB,QACjD,GAAC,UACC,kBACT,sBAAsB;cAEZ,gBAAiB,UAAU,oBAAkB,QAChD,GAAC,UACC,kBACT,sBAAsB;;;cC3SZ;cACA,sBAAc;cAKd,mBAAW;iBAgBR,iBAAiB,IAAI,aACnC,UAAS,wBAAwB,KAChC,gBAAgB,iBAAiB;cAyLvB,eAAY;EACZ;MACV;EAAc;;cAIJ,sBAAmB;EAC9B;MACE,iBAAiB;;;cC1NR,wBAAyB,UAAU,mBAAiB,QACvD,gBAAgB,OACvB,gBAAgB;cACN,gBAAiB,UAAU,mBAAiB,WAC5C,MACV,gBAAgB;cACN,cAAa;cACb,WAAQ,SAAa,gBAAc;;;;iBCkShC,qBACd,MAAM,UACN,UAAU,qBAEV,4BACA,KAAK,KAAK,cAAc;;;iBC9IV,iBAAiB,aAAa;;;;UCjL7B;EACf,SAAS;;;;;UCIM;EACf,QAAQ,SAAS,UAAU,QAAQ;EACnC;IACE,WAAW;MACT,SAAS;MACT;QAAU;QAA8B;;MACxC;QACE;;EAEN,UAAU;;;UAGK;WACN,UAAU;WACV;;;UAKM;KACL,eAAe;EAAmB,MAAM;;KACxC,iBAAiB;EAAmB,YAAY,UAAU;IAClE,IACA;KACQ,sBAAsB;EAChC,iBAAiB,UAAU,eAAe;IAExC,IACA;KACQ,OAAO,gCAAgC,sBAC/C,iBACA,gBAAgB,sBACd,oBAAoB,KACpB;;KAGD;EACH,+BAA+B;EAC/B,4BAA4B;;KAElB,UAAU,KAAK;EAAY;IAAU,eAAe;;IAC5D,YAAY,KACZ;KACQ,OAAO,KAAK,UAAU;EAAa,YAAY;IAAM;KACrD,YAAY,gCAAgC,UAAU,OAAO;KAC7D,SAAS,gCAAgC,OAAO,OAAO;KACvD,UAAU,KAAK;EAAY;IAAQ;;;KAG1C,OAAO,KAAK,YAAW,WAAW,kBAClC,YAAY;EAAe,aAAa;KACvC,YAAY;KAGb,cAAc,GAAG,oBAAoB;EACxC,QAAQ,KAAK,UAAU;IAErB,OAAO;EAAa,oBAAoB;IACtC,YAAY;KAGN,iBAAiB,gCAC3B,4BACI,cAAc,OAAO,2BACrB;KACM,eAAe,gCACzB,4BACI,cAAc,OAAO,uBACrB;KAID,MAAM,KAAK;EAAY,WAAW;IAAQ;KACnC,aAAa,IAAI,qBAC1B,WAAW,MAAM,KAAK,MAAM,GAAG;EAAa,YAAY;IACrD,mBAEE,MAAM;KACT,WAAW,kBAAkB,IAAI,qBACnC,WAAW,MAAM,KAAK,MAAM,GAAG;EAAa,MAAM;IAAM,MAAM,GAAG,oBAC5D,MAAM;KACT,OAAO,qBAAqB,WAAW,gCAExC,OAAO,WAAW;;;;;KAKV,gBAAgB,MAAM,+BAE9B,+BACc,WAAW,kBAAiB,SAAS;KAE3C,gBAAgB,6BAA6B,2BACjC;EAElB,MAAM;EAAG,qBAAqB,cAAc,gBAAgB,OAAO;;KAC7D,qBAAqB,6BAC/B,gBAAgB;KAIb,UAAU,kCACS;KAEnB,SACH,UAAU,oBACV,iCACE,mBAAmB,gBAAgB,0BAA0B,6CAC7D,YAAY,YAAY,YAAY,QAAQ,IAAI,IAAI;;KAGnD,cAAc,KAAK,mBACpB,OAAO,kBACP,sBACE,UAAU;EAA0B,eAAe;IACjD;KAGH,YAAY,UAAU,sBACzB,mBAAmB,WAAW,OACzB,cAAc,sBACb,uBACA,qBACE,QAAQ,cAAc,MACtB,cAAc,KAClB;;KAEM,iBACV,UAAU,oBACV,4CACE,WAAW,SAAS,GAAG,UAAU,YAAY;;KAErC,mBACV,UAAU,oBACV,iCACE,QAAQ,WAAW,SAAS,GAAG;KACvB,mBACV,UAAU,oBACV,kCAEA,MAAM,iBAAiB,GAAG,KAC1B,2BAA2B,8CACxB,mBAAmB,GAAG,MAAM,QAAQ,mBAAmB,GAAG;;KAGnD,uBAAuB,KAAK;EACtC;IAAW;;;KAID,sBAAsB;KACtB,gBAAgB,eAAe;KAC/B,gBAAgB,UAAU,iBAAiB,eAAe;UACrD,iBAAiB,IAAI,qBAAqB;WAChD;WACA,SAAS;;;;UC7HH;;EAEf,qBAAqB,aAAa;;EAElC,sBAAsB,aAAa;;KAEzB;WACD;WACA;;;UAIM;;EAEf;;EAEA;;;;;EAKA;;;;;;;EAOA;;EAEA,sBAAsB,aAAa;;;KAIzB,yBAAyB,UAAU,WAAW;;EAExD,MAAM;;EAEN;;;;;;;;EAQA,+BAA+B;;EAE/B,OAAO;;EAEP,UAAU;;EAEV,cAAc;;EAEd,SAAS;;EAET,SAAS;;EAET;IACE,cAAc;UAED;;;;;;EAMf;;UAGe;;;;;;;;;EASf;;UAGe;;;;;EAKf;;;;;;;;EAQA;;;KAIU,cAAc,UAAU,YAClC,UAAU,UAAU;EACd,UAAU,wBAAwB,UAAU;;EAE5C,UACK,wBAAwB,UAAU;IACjC,SAAS,GAAG,UAAU;;;UAKnB,wBAAwB;;EAEvC,UAAU,SAAS;;EAEnB;;;;;;;EAOA;;UAGe;;EAEf;;EAEA;;EAEA,kBAAkB;;EAElB;;;;;;EAMA;;EAEA;;KAGU,0BACV;WACW,SAAS;WACT;WACA;GAEX,OAAO,UAAU,YAAY,QAAQ,cAClC,QAAQ;KAED,wBAAwB,UAAU,YAC5C,0BAA0B,yBAAyB;UAEpC,6BAA6B,UAAU,kBAC9C;EACR,UAAU;EACV,mBAAmB,iBAAiB;EACpC,gBACK,gBACA,wBAAwB,KAAK,QAAQ,wBAAwB;;;KAIxD,wBAAwB,UAAU,YAC5C,yBAAyB,QACtB,YAAY,0BACX,yBAAyB,uCAAuC;UAErD,uCAAuC;WAC7C,aAAa;;;KAGZ,qBAAqB,KAAK,4BAClC,UAAU;EAEN,MAAM;;;KAKF,aAAa,KAAK,KAAK,KAAK,IAAI,oBAAoB;UAC/C,oBAAoB;YACzB;WACD;aACM,UAAU,KAAK;;aAEf,gBAAgB,gBAAgB,IAAI,QAAQ;aAC5C,kBAAkB;;aAElB,aAAa,eAAe;;WAClC,qBAAqB;WACrB,UAAU;;WAEV,mBAAmB;;UAGb;WACN;;;;;;;WAOA;;WAEA;;;;;WAKA,uBAAuB;;WAEvB;;;;;;WAMA;;WAEA;;WAEA,SAAS;;WAET;aACE;aACA;;;;;;;WAOF;;WAEA;;WAEA;WACA;;KAKC,oBACR;WACW;;WACA;;;;;;UAME;EACf,QACE,MAAM,eACN,SAAS,oBACR,QAAQ;;UAEI;WACN,MAAM;WACN;;WAEA,SAAS;;WAET;;;;;;WAMA;aAAwB;;;;UAIlB;EACf,OAAO,GACL,QAAQ,oBAAoB,SAC5B,QAAQ,GACR,SAAS,uBACR,QAAQ;;UAGI;WACN;;WAEA,sBAAsB;;WAEtB;;UAGM;;EAEf;;EAEA;;EAEA;;EAEA;;UAEe;EACf;EACA;;KAEU,iBAAiB,KAAK;KACtB,oBAAoB,qBAAqB,GACnD,gBACA,sBACA,YAAY,yBAAyB,KAAK,gBAAgB,OAAO;KAEvD,sBACV,UAAU,oBACV,kCAEA,gBACA,sBACA,YAAY,wBAAwB,mBAAmB,GAAG;KAEhD;UAGK;;EAEf;;UAae;;EAEf,YAAY,KAAK;IAAoB;;;UAGtB;;EAEf,YAAY;IAAW;IAAa,KAAK;;;UAiJ1B;WACN;WACA;;WAEA;;;;;EAKT,OAAO,QAAQ;;;UAIA;WACN;;;KAKC,4BAA4B;UAEvB;EACf,SAAS,cAAc;;;;;EAKvB,GAAG,cAAc,KAAK,sBAAsB;;UAG7B;WACN;;WAEA;WACA;WACA;;UAEM;WACN;WACA,MAAM;;WAEN,SAAS;;WAET;WACA;;WAEA;aACE;aACA;;;WAGF,mBAAmB;WACnB;aACE;aACA;;WAEF,kBAAkB,KACzB;;WAIO,mBAAmB,KAAK;;UAElB;WACN,MAAM;;WAEN;;WAEA;;UAGM;;WAEN;;;;;;WAMA;aACE;aACA;;;EAGX,SAAS,SAAS;;;;;;;;;EASlB,SAAS,KAAK;;;;;;;EAOd,MAAM,KAAK,8BAA8B;;WAEhC,UAAU;;EAEnB,YAAY,SAAS,sBAAsB;;EAE3C,UAAU,SAAS;;;;;EAKnB,mBACE,iBAAiB,8BACjB,mBAAmB;;EAGrB,QACE,KAAK,6BACK,eAAe,iBAAiB;;UAG7B;;WAEN;;WAEA;;WAEA;;WAEA;;UAGM;;;;;;WAMN;WACA;;UAGM;WACN,SAAS;WACT,QAAQ;;EAEjB,MAAM,mBAAmB;;UAGV;WACN,SAAS;WACT,QAAQ;WACR,SAAS;;UAGH;WACN;;WAEA;WACA;;WAEA;;EAET,QAAQ;;;;;EAKR,OAAO,SAAS,qBAAqB,QAAQ;;EAE7C,mBAAmB;;UAGJ;WACN;;WAEA;;WAEA,SAAS;;WAET,MAAM,aAAa,eAAe;;WAElC;;WAEA;;WAEA,SAAS;;UAGH;;;;;;EAMf,UAAU;;;;;;;;EAQV,OAAO;;EAEP,IAAI;;EAEJ,QAAQ,eAAe;;EAEvB,QAAQ;aAA0B;aAAyB;;;EAE3D,SAAS;;EAET,MAAM,cAAc;;EAEpB,WAAW,cAAc,eAAe;;EAExC,aAAa;;UAGE;;EAEf,OAAO;;UAGQ;;WAEN;;;;;EAKT,QAAQ,SAAS;;;;;;EAMjB,SAAS,SAAS,kBAAkB,KAAK,eAAe;;EAExD,YAAY,SAAS,aAAa,SAAS;;;;;;;;EAQ3C,qBACE,OAAO,gCAAgC,8BACvC,SAAS,kBACT;aAAiB;;;;;;EAMnB,UAAU,KAAK,oCAAoC;;;;;;;;EASnD,kBAAkB,QAAQ,UAAU;;;;;;;EAOpC,SAAS,SAAS,mBAAmB;;WAE5B;aAAsB;;;EAE/B,QACE,KAAK,6BACK,eAAe,iBAAiB;;UAG7B;;;;;WAKN;;;;;;;;;;WAUA;;WAEA;;WAEA;;;;;;WAMA,UAAU;;;;;;EAMnB,WAAW;;WAEF;;WAEA,SAAS;;WAET;aAAqB;aAAyB;;;EAEvD,MAAM;;WAEG,UAAU;;UAGJ;;;;;;WAMN;;;;;EAKT,WAAW;;WAEF;;WAEA;;;UAIM;;WAEN;;;;;;;;WAQA;;;;;;;WAOA,YAAY,6BAA6B;;;;;;WAMzC,kBAAkB;;UAGZ;;WAEN,MAAM;;UAGA;WACN,WAAW;WACX,WAAW;WACX,WAAW;WACX;;WAGA,SAAS,QAAQ,UAAU,mBAAmB;;;;;EAKvD,MAEE,QAAQ,UACR,4BACA,OAAO,YACP,SAAS;WAEF,QAAQ;;;;;;;;;KASP;UACK;;WAEN;;WAEA;;WAEA;;WAEA;;;;;WAKA;;UAGM;WACN;;WAEA;;WAEA;;;;;WAKA,aAAa;;UAGP;;EAEf,OAAO,aAAa,SAAS;;WAEpB;;UAGM,gBAAgB,UAAU,oBAAoB;WACpD;;WAEA,gBAAgB;;;;;WAKhB;;;;;WAKA;;WAEA;aACE;aACA;;;;;;;;WAQF;;;;;;WAMA;;;;;WAKA;aACE;aACA;;;EAGX,WAAW,SAAS;;;;;EAKpB,QAAQ,SAAS,mBAAmB,QAAQ,gBAAgB;;EAE5D,QACE,KAAK,6BACK,eAAe,iBAAiB;;KAGlC,gBAAgB,UAAU,oBAAoB;WAC3C;WAAmC,WAAW;;WAC9C;;WACA;WAA8B,SAAS;;UAErC;WACN,SAAS;WACT,SAAS;WACT;WACA;aAAqB;aAAyB;;WAC9C;WACA,MAAM;;EAEf,KAAK,GAAG,+BAA+B,eAAe,QAAQ,KAAK,QAAQ;;;UAI5D,WAAW,UAAU,WAAW;WACtC;WACA,UAAU;WACV,KAAK;EACd,WAAW,QAAQ;EACnB,UAAU,aAAa;;EAEvB,IAAI,GAAG,MAAM,WAAW,UAAU,QAAQ,KAAK,QAAQ;;EAEvD,YACE,SAAS,iBACT,0BACC,QAAQ;;;;;EAKX,mBAAmB;;EAEnB,gBAAgB,gBAAgB,UAAU,UAAU;;UAErC;;WAEN,SAAS;;;;;WAKT;;WAEA,gBAAgB;;WAEhB;;;UAGM;WACN;WACA;WACA;WACA;;WAEA;;WAEA;aAAsB;;WACtB;aACE;aACA;aACA;aACA;;aAEA;eAAuB;;aACvB,uCAEH,UAAU;aACP;eACE;eACA;iBAAmB;;;aAErB;eAAwB;;aACxB;eACE;iBACE;iBACA;;eAEF;eACA;eACA;;;;WAIJ;IACP,aAAa,iBAAiB;eACnB;eACA;eACA;eACA,aAAa;;;WAGjB,aAAa,SACpB;aAGa;aACA;eACE;eACA;;;WAKR;aACE;aACA;aACA;;WAEF;IACP,QAAQ;MACN;MACA;QAAkB;QAAe;;QAC/B;IACJ,WAAW;MACT;MACA;QAAkB;QAAe;;MACjC,QAAQ;QACN;;EAEN,UAAU;EACV,UAAU;EACV,gBACE,aACA;IAAa;;;UAIA,oBACf,kBACA,UAAU,oBAAoB;;WAGrB;WACA;;aAEE;;;;;;;aAOA,sBAAsB;;aAEtB;;aAEA;;aAEA;;;EAGX,SACE,QAAQ,QACR,SAAS,qBAAqB,KAC7B,wBAAwB,QAAQ;;EAEnC,UAAU,QAAQ,QAAQ,MAAM,2BAA2B;;EAE3D,QACE,KAAK,6BACK,eAAe,iBAAiB;;;;;;KAOlC,UAAU,UAClB,oBAAoB,eACpB,KAAK,oBAAoB,gBACzB;UAEa,YAAY;WAClB,QAAQ,UAAU;WAClB,QAAQ;WACR;;WAEA;;WAEA;;KAEC,kBACR;WACW,gBAAgB;;WAChB,gBAAgB;;KAEnB;WACG;;WAEA;WACA;WACA;WACA;WACA;;UAGE,qBACf,UAAU,oBAAoB;WAErB,WAAW;WACX;WACA;WACA,SAAS;WACT,SAAS;WACT;aAAqB;aAAyB;;EACvD,MAAM;WACG;aAAoB,OAAO;aAAe;;WAC1C,MAAM;;;;;EAKf,KAAK,GAAG,+BAA+B,eAAe,QAAQ,KAAK,QAAQ;;EAE3E,QAAQ,cAAc;WACb,WAAW;;UAGL;WACN,MAAM;WACN,SAAS;WACT"}

package/dist/{auth-contracts-CnGaBzlg.d.mts → auth-contracts-mejJfv9d.d.cts}

@@ -1,10 +1,10 @@
+import { IncomingHttpHeaders, IncomingMessage } from "node:http";
 import { CallHandler, CanActivate, DynamicModule, ExecutionContext, InjectionToken, Logger, LoggerService, ModuleMetadata, NestInterceptor, OptionalFactoryDependency, Provider, Type } from "@nestjs/common";
 import { AbstractHttpAdapter, DiscoveryService, HttpAdapterHost, ModuleRef, Reflector } from "@nestjs/core";
-import { Observable } from "rxjs";
-import { IntrinsicException } from "@nestjs/common/exceptions/intrinsic.exception.js";
-import { IncomingHttpHeaders, IncomingMessage } from "node:http";
-import { HookEndpointContext } from "better-auth";
 import "@nestjs/core/injector/instance-wrapper.js";
+import { HookEndpointContext } from "better-auth";
+import { IntrinsicException } from "@nestjs/common/exceptions/intrinsic.exception.js";
+import { Observable } from "rxjs";
 //#endregion
 //#region src/auth-errors.d.ts
 type AuthErrorCode = "UNAUTHENTICATED" | "FORBIDDEN" | "RATE_LIMITED";
@@ -87,7 +87,7 @@ declare class BetterAuthInfrastructureError extends Error {
 }
 declare function getRawCause(error: BetterAuthInfrastructureError): unknown;
 declare namespace auth_tokens_d_exports {
-  export { ACCEPT_PRINCIPALS_METADATA, ACCESS_METADATA, AUTH_ENHANCER, AUTH_INSTANCE_METADATA, DB_HOOK_METADATA, FORWARD_COOKIES_METADATA, FRESHNESS_METADATA, GUARD_CORE, HOOK_METADATA, INSTANCE_REGISTRY, INVOCATION_PARAMS_METADATA, INVOCATION_VALUES, MOUNT_COORDINATOR, PLATFORMS, POLICY_INVOKER, POLICY_RESOLVER, PRINCIPAL_PARAMS_METADATA, PRINCIPAL_READINGS, PRINCIPAL_RESOLVER, READER_CONTEXT, REQUEST_SCOPE, REQUIREMENTS_METADATA, ROUTE_PLANNER, SCOPE_CORE, SKIP_DEFAULT_REQUIREMENTS_METADATA, SKIP_ORIGIN_CHECK_METADATA, TRANSPORTS, TRANSPORT_REGISTRY, USE_BETTER_AUTH_METADATA, getBetterAuthHandleToken, getBetterAuthInstanceToken, getBetterAuthOptionsToken, getBetterAuthServiceToken, getExtensionToken, getPrincipalSourcesToken };
+  export { ACCEPT_PRINCIPALS_METADATA, ACCESS_METADATA, AUTH_ENHANCER, AUTH_INSTANCE_METADATA, DB_HOOK_METADATA, FORWARD_COOKIES_METADATA, FRESHNESS_METADATA, GUARD_CORE, HOOK_METADATA, INSTANCE_REGISTRY, INVOCATION_PARAMS_METADATA, INVOCATION_VALUES, MOUNT_COORDINATOR, PLATFORMS, POLICY_INVOKER, POLICY_RESOLVER, PRINCIPAL_PARAMS_METADATA, PRINCIPAL_READINGS, PRINCIPAL_RESOLVER, READER_CONTEXT, REQUEST_SCOPE, REQUIREMENTS_METADATA, ROUTE_PLANNER, SCOPE_CORE, SKIP_DEFAULT_REQUIREMENTS_METADATA, SKIP_ORIGIN_CHECK_METADATA, TRANSPORTS, TRANSPORT_REGISTRY, USE_BETTER_AUTH_METADATA, WS_CONNECTION_AUTH, getBetterAuthHandleToken, getBetterAuthInstanceToken, getBetterAuthOptionsToken, getBetterAuthServiceToken, getExtensionToken, getPrincipalSourcesToken };
 }
 declare function getBetterAuthInstanceToken(alias?: string): string;
 declare function getBetterAuthOptionsToken(alias?: string): string;
@@ -120,6 +120,8 @@ declare const USE_BETTER_AUTH_METADATA: unique symbol;
 declare const HOOK_METADATA: unique symbol;
 declare const DB_HOOK_METADATA: unique symbol;
 declare const AUTH_ENHANCER: unique symbol;
+/** Connection-time WebSocket authentication, provided by the socket.io and ws transport definitions. */
+declare const WS_CONNECTION_AUTH: unique symbol;
 declare function getPrincipalSourcesToken(instance: string): symbol;
 declare function getExtensionToken(point: "platforms" | "transports" | "principals", instance: string, index: number): symbol;
 declare const READER_CONTEXT: unique symbol;
@@ -1657,5 +1659,5 @@ interface PolicyBootContext {
   readonly site: string;
 }
 //#endregion
-export { PrincipalDelegation as $, getRawCause as $n, SESSION_PRINCIPAL_KIND as $t, DatabaseHookTarget as A, BetterAuthService as An, GetSessionWithHeaders as At, HookOptions as B, getBetterAuthHandleToken as Bn, UnvalidatedBody as Bt, ConformanceCase as C, defineHttpPlatform as Cn, AuthPrincipal as Ct, CookieForwardingOptions as D, allow as Dn, DatabaseHookMethod as Dt, ConformanceSkip as E, BetterAuthGuard as En, DatabaseHookData as Et, ExtensionDefinition as F, BetterAuthModule as Fn, Register as Ft, InboundAuthRequest as G, AuthErrorCode as Gn, betterAuthCorsOrigin as Gt, HttpMountOptions as H, getBetterAuthOptionsToken as Hn, WithActiveOrganization as Ht, ExtensionRef as I, GUARD_CORE as In, RegisteredAuth as It, PlatformMountContext as J, AuthGraphqlExtensions as Jn, definePrincipalSource as Jt, InvocationLineage as K, AuthFailure as Kn, absent as Kt, FastifyPlatformOptions as L, POLICY_INVOKER as Ln, RegisteredInstances as Lt, DbHookOptions as M, InstanceLookup as Mn, OrgPermissions as Mt, DefaultInstanceCheck as N, EXTENSION_DEFINITION as Nn, PrincipalKind as Nt, CookieSink as O, definePolicy as On, DatabaseHookResult as Ot, ExpressPlatformOptions as P, UPGRADE_REQUEST as Pn, PrincipalOfKind as Pt, PolicyRef as Q, ErrorMappingOptions as Qn, RequireFreshSession as Qt, GuardReach as R, PRINCIPAL_RESOLVER as Rn, SessionOf as Rt, ClaimOptions as S, defineExtension as Sn, AuthOf as St, ConformanceRunner as T, BetterAuthScopeInterceptor as Tn, AuthUser as Tt, HttpPlatform as U, getBetterAuthServiceToken as Un, PrincipalKinds as Ut, HookPredicate as V, getBetterAuthInstanceToken as Vn, UserOf as Vt, HttpRequestAccessor as W, AuthErrorBody as Wn, httpTransport as Wt, PolicyBootContext as X, BetterAuthConfigurationError as Xn, CurrentSession as Xt, PlatformPrepareContext as Y, AuthTransportErrorPayload as Yn, rejected as Yt, PolicyInvoker as Z, BetterAuthInfrastructureError as Zn, CurrentUser as Zt, BetterAuthRuntimeOptions as _, allOf as _n, TransportValidationContext as _t, AuthHandlerInterceptor as a, BeforeAuth as an, ProxyTrust as at, BootAdviceContext as b, definePrincipalParam as bn, AuthHookContext as bt, AuthTransport as c, ForwardAuthCookies as cn, RequirementOptions as ct, AuthorizationLimits as d, Require as dn, ScopeInit as dt, freshSession as en, isAuthFailure as er, PrincipalReading as et, AuthorizationPolicy as f, RequireAuth as fn, SessionOption as ft, BetterAuthModuleOptions as g, UseBetterAuth as gn, TransportKit as gt, BetterAuthModuleAsyncOptions as h, UseAuthInstance as hn, TransportCall as ht, AuthHandle as i, AfterDatabase as in, PrincipalSource as it, DbHookMethodDecorator as j, TransportRegistry as jn, IsRegistered as jt, CorsOriginOptions as k, deny as kn, EndpointPath as kt, AuthorizationContext as l, OptionalAuth as ln, ResolutionRequest as lt, BetterAuthFactoryResult as m, SkipOriginCheck as mn, StaticOptionMustBePassedToForRootAsync as mt, ApplicationRouteDescriptor as n, AcceptPrincipals as nn, isInfrastructureError as nr, PrincipalResolver as nt, AuthPrincipalBase as o, BeforeDatabase as on, Requirement as ot, BetterAuthAppOptions as p, SkipDefaultRequirements as pn, SessionPrincipalOptions as pt, OriginCheckOptions as q, AuthFailures as qn, authenticated as qt, AuthContextView as r, AfterAuth as rn, PrincipalResult as rt, AuthRouteBinding as s, CurrentPrincipal as sn, RequirementExpr as st, AdvisedHandler as t, sessionPrincipal as tn, isConfigurationError as tr, PrincipalRequest as tt, AuthorizationDecision as u, Public as un, RoutePlan as ut, BetterAuthStaticOptions as v, anyOf as vn, AdminPermissions as vt, ConformanceOutcome as w, defineTransport as wn, AuthSession as wt, BrowserExposure as x, requirement as xn, AuthLike as xt, BootAdvice as y, defineInvocationParam as yn, AuthAfterHookContext as yt, HookMethodDecorator as z, SCOPE_CORE as zn, SessionPrincipal as zt };
-//# sourceMappingURL=auth-contracts-CnGaBzlg.d.mts.map
+export { PrincipalDelegation as $, ErrorMappingOptions as $n, SESSION_PRINCIPAL_KIND as $t, DatabaseHookTarget as A, BetterAuthService as An, GetSessionWithHeaders as At, HookOptions as B, WS_CONNECTION_AUTH as Bn, UnvalidatedBody as Bt, ConformanceCase as C, defineHttpPlatform as Cn, AuthPrincipal as Ct, CookieForwardingOptions as D, allow as Dn, DatabaseHookMethod as Dt, ConformanceSkip as E, BetterAuthGuard as En, DatabaseHookData as Et, ExtensionDefinition as F, BetterAuthModule as Fn, Register as Ft, InboundAuthRequest as G, AuthErrorBody as Gn, betterAuthCorsOrigin as Gt, HttpMountOptions as H, getBetterAuthInstanceToken as Hn, WithActiveOrganization as Ht, ExtensionRef as I, GUARD_CORE as In, RegisteredAuth as It, PlatformMountContext as J, AuthFailures as Jn, definePrincipalSource as Jt, InvocationLineage as K, AuthErrorCode as Kn, absent as Kt, FastifyPlatformOptions as L, POLICY_INVOKER as Ln, RegisteredInstances as Lt, DbHookOptions as M, InstanceLookup as Mn, OrgPermissions as Mt, DefaultInstanceCheck as N, EXTENSION_DEFINITION as Nn, PrincipalKind as Nt, CookieSink as O, definePolicy as On, DatabaseHookResult as Ot, ExpressPlatformOptions as P, UPGRADE_REQUEST as Pn, PrincipalOfKind as Pt, PolicyRef as Q, BetterAuthInfrastructureError as Qn, RequireFreshSession as Qt, GuardReach as R, PRINCIPAL_RESOLVER as Rn, SessionOf as Rt, ClaimOptions as S, defineExtension as Sn, AuthOf as St, ConformanceRunner as T, BetterAuthScopeInterceptor as Tn, AuthUser as Tt, HttpPlatform as U, getBetterAuthOptionsToken as Un, PrincipalKinds as Ut, HookPredicate as V, getBetterAuthHandleToken as Vn, UserOf as Vt, HttpRequestAccessor as W, getBetterAuthServiceToken as Wn, httpTransport as Wt, PolicyBootContext as X, AuthTransportErrorPayload as Xn, CurrentSession as Xt, PlatformPrepareContext as Y, AuthGraphqlExtensions as Yn, rejected as Yt, PolicyInvoker as Z, BetterAuthConfigurationError as Zn, CurrentUser as Zt, BetterAuthRuntimeOptions as _, allOf as _n, TransportValidationContext as _t, AuthHandlerInterceptor as a, BeforeAuth as an, ProxyTrust as at, BootAdviceContext as b, definePrincipalParam as bn, AuthHookContext as bt, AuthTransport as c, ForwardAuthCookies as cn, RequirementOptions as ct, AuthorizationLimits as d, Require as dn, ScopeInit as dt, freshSession as en, getRawCause as er, PrincipalReading as et, AuthorizationPolicy as f, RequireAuth as fn, SessionOption as ft, BetterAuthModuleOptions as g, UseBetterAuth as gn, TransportKit as gt, BetterAuthModuleAsyncOptions as h, UseAuthInstance as hn, TransportCall as ht, AuthHandle as i, AfterDatabase as in, PrincipalSource as it, DbHookMethodDecorator as j, TransportRegistry as jn, IsRegistered as jt, CorsOriginOptions as k, deny as kn, EndpointPath as kt, AuthorizationContext as l, OptionalAuth as ln, ResolutionRequest as lt, BetterAuthFactoryResult as m, SkipOriginCheck as mn, StaticOptionMustBePassedToForRootAsync as mt, ApplicationRouteDescriptor as n, AcceptPrincipals as nn, isConfigurationError as nr, PrincipalResolver as nt, AuthPrincipalBase as o, BeforeDatabase as on, Requirement as ot, BetterAuthAppOptions as p, SkipDefaultRequirements as pn, SessionPrincipalOptions as pt, OriginCheckOptions as q, AuthFailure as qn, authenticated as qt, AuthContextView as r, AfterAuth as rn, isInfrastructureError as rr, PrincipalResult as rt, AuthRouteBinding as s, CurrentPrincipal as sn, RequirementExpr as st, AdvisedHandler as t, sessionPrincipal as tn, isAuthFailure as tr, PrincipalRequest as tt, AuthorizationDecision as u, Public as un, RoutePlan as ut, BetterAuthStaticOptions as v, anyOf as vn, AdminPermissions as vt, ConformanceOutcome as w, defineTransport as wn, AuthSession as wt, BrowserExposure as x, requirement as xn, AuthLike as xt, BootAdvice as y, defineInvocationParam as yn, AuthAfterHookContext as yt, HookMethodDecorator as z, SCOPE_CORE as zn, SessionPrincipal as zt };
+//# sourceMappingURL=auth-contracts-mejJfv9d.d.cts.map

package/dist/auth-contracts-mejJfv9d.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-contracts-mejJfv9d.d.cts","names":[],"sources":["../src/auth-errors.ts","../src/auth-tokens.ts","../src/auth-module.ts","../src/bridge-protocol.ts","../src/request-scope.ts","../src/origin-check.ts","../src/instance-registry.ts","../src/mount-coordinator.ts","../src/principal-readings.ts","../src/policy-resolver.ts","../src/transport-registry.ts","../src/route-planner.ts","../src/auth-service.ts","../src/authorization-evaluator.ts","../src/auth-guard.ts","../src/auth-scope-interceptor.ts","../src/auth-module-definition.ts","../src/auth-decorators.ts","../src/session-principal.ts","../src/principal-resolver.ts","../src/auth-exchange.ts","../src/http-transport.ts","../src/index.ts","../src/auth-types.ts","../src/auth-contracts.ts"],"mappings":";;;;;;;;;KAkBY;;UAGK;WACN;WACA,MAAM;WACN;WACA;WACA;WACA,UAAU;;UAGJ;EACf;EACA;EACA,MAAM;EACN;EACA;;UAGe;EACf,MAAM;EACN;EACA;;UAGe;EACf;EACA;EACA,MAAM;EACN;EACA;;UAGe;EACf,OACE,SAAS,aACT,SAAS,kBACT;EAEF;;iBAQc,cAAc,iBAAiB,SAAS;iBAIxC,sBACd,iBACC,SAAS;iBAII,qBACd,iBACC,SAAS;iBAqDH,UAAU;EACjB;EACA;EACA;EACA;EACA;IACE;cA6BS;EACX,gBAAe,mBAAoB;EAGnC,iBAAQ;EACR,UAAS,gBAAe,mBAAqB;EAG7C,aAAY,iBAAkB;;cA4BnB,qCAAqC;WACvC;WACA;WACA;WACA;WACA;WACA;aACP;aACA;aACA;;WAEO,kBAAkB;EAE3B,YAAY,cAAc,gBAAgB;SAUnC,UACL,cACA,gBACA;IAAY;IAAe;MAC1B;;cAeQ,sCAAsC;WACxC,OAAO;WACP;aACP;aACA;aACA;;EAGF,YAAY,gBAAgB;IAAY;;;iBAwB1B,YAAY,OAAO;;;;iBC7QnB,2BAA2B;iBAI3B,0BAA0B;iBAI1B,0BAA0B;iBAI1B,yBAAyB;cAK5B;cAGA;cAGA;cAGA;cAGA;cAGA;cAGA;cAGA;cACA;cACA;cAGA;cAGA;cACA;cACA;cACA;cAGA;cAGA;cAGA;cAGA;cAGA;cAGA;cAGA;cAGA;cAGA;cAGA;cACA;cAGA;;cAEA;iBAIG,yBAAyB;iBAMzB,kBACd,kDACA,kBACA;cAOW;cAGA;;;cCvGA;SACJ,QAAQ,UAAU,WAAW,gBAClC,SAAS,wBAAwB,KAC/B;IAAyB;MAAqB,qBAAqB,KACpE;SACI,QAAQ,UAAU,UACvB,SAAS,wBAAwB;IAAO;MAAiB,eACxD;SAWI,aAAa,UAAU,WAAW,gBACvC,SAAS,6BAA6B,KACpC;IAAyB;MAC1B;SACI,aAAa,UAAU,UAC5B,SAAS,6BAA6B;IAAO;MAAiB,eAC7D;;;;cC/BQ;cAGA;UAII;WACN;WACA;;WAEA;;WAEA;;;;;;;;EAQT,KAAK,SAAS;IAAkB;IAAe;;;EAE/C,mBAAmB;;UAEJ;;WAEN;aAAkB;;;WAElB;;EAET;;EAEA,WAAW;;WAEF;WACA,iBAAiB;WACjB,gBAAgB;WAChB,UAAU,YAChB,KAAK;aACK,iBAAiB,mBAAmB;aACpC,gBAAgB,mBAAmB;;;EAIhD,UAAU;;UAEK;;WAEN,SAAS;WACT;WACA,gBAAgB;WAChB;;;;;;;WAOA,sBAAsB,cAAc;;;WAGpC,uBAAuB;;UAEjB;;;;;;;;EAQf,QAAQ,KAAK,qBAAqB,OAAO;EACzC,IAAI,KAAK,sBAAsB;;;;UC9DhB;WACN,MAAM;WACN,OAAO;WACP,OAAO;WACP,gBAAgB;;UAEV;WACN,WAAW,YAAY,QAAQ;WAC/B,UAAU,YAAY;WACtB,WAAW,YAAY,QAAQ;WAC/B,QAAQ;WACR,oBAAoB;WACpB,SAAS,YAAY,QAAQ;WAC7B,UAAU;WACV,aAAa;IAGlB,OAAO,QAAQ;MAAmB;;IAClC;;;cAmCO;;EAOX,IAAI,GAAG,OAAO,YAAY,UAAU,IAAI;EAIxC,KAAK,GAAG,UAAU,IAAI;EAItB,WAAW;EAIX,SAAS,cAAc;EAkBvB,cACE,MAAM,KAAK,yDACX;IACE;IACA;IACA;KAEF,eAAe,QAAQ,mBACtB,QAAQ;EAqCX,aAAa,GACX,iBACA,kBACA,qBACA,eAAe,QAAQ,IACvB,yBACC,QAAQ;EA0BX,aACE,oBACA,kBACA,qBACA,eAAe,QAAQ,yBACtB,QAAQ;EAWX,SAAS,kBAAkB;EAc3B,SACE,aACA,eACA;IAAW;IAAkB;IAAc,UAAU;;;;;;cCnL5C;;mBAOQ;EADnB,YACmB;IACf,KAAK;IACL,MAAM;;EAIV,OACE,kBACA,SAAS,aACT,SAAS,SACT;EA6BF,gBACE,kBACA,SAAS,SACT;;UAWa;WACN;WACA,SAAS;WACT,UAAU;WACV,cAAc;WACd;WACA;;cAGE;;mBAKQ;mBACA;EAFnB,YACmB,OAAO,cACP,MAAM;EAKzB,MACE,SAAS,iBACT,0BACC,QAAQ;EAiEL,SAAS,SAAS,kBAAkB;EAkB1C,oBACE,SAAS,iBACT,cACA;UAuBM;UAkBM;;;;UCpMC;WACN;WACA,UAAU;WACV,SAAS,yBAAyB;WAClC,eAAe;WACf,kBAAkB;WAClB,QAAQ;WACR,SAAS;WACT,QAAQ;WACR,QAAQ;WACR;;UAEM;EACf,IAAI,eAAe;EACnB,iBAAiB;;UAEF;WACN;WACA,UAAU;WACV,SAAS,yBAAyB;WAClC,eAAe;WACf,YAAY;WACZ,kBAAkB;WAClB,QAAQ;;cAgBN,4BAA4B;;mBASa;WAN3C,QAAM;WACN,aAAW;EACpB;EACA,SAAS;EACT;IAAU;;EAEV,YAAoD,OAAO;EAE3D,SACE,SAAS,yBAAyB,WAClC,eAAe,yBACf,kBAAkB,mBAClB,YAAY,uBACX;EAiBH,0BAA0B;EAI1B,IAAI,eAAe;EAYnB,iBAAiB;EAIjB,MAAM,SAAS;EAmBT,WAAW,QAAQ,iCAAiC;EAyK1D;;;;cCjSW;;WAUyB,MAAM;mBACI;WAVrC,QAAM;EAQf,YACoC,MAAM,iBACI,UAAU,kBAC/B,OAAO;EAMhC,kBAAkB,oBAAoB;MAKlC,YAAY;MAIZ,WAAW;UAIP;EAqDR,cAAc,QAAQ;EAmBtB,QAAQ,QAAQ;EAyEhB,MAAM,mBAAmB;EAMzB,QAAQ,eAAe;EAIvB,qBAAqB;EAIrB,0BAA0B;EAO1B,0BACE,iBAAiB,8BACjB,QAAQ;EAkBJ,SAAS;EAwBf;;;;UChQe;WACN;WACA,OAAO;WACP,UAAU;WACV,OAAO,KAAK;WACZ;WACA;;;cAwEE,4BAA4B;EACvC,YAAY,OAAO;;cAMR;mBACkB;EAA7B,YAA6B,OAAO;EAEpC,OACE,MAAM,KAAK,0CACX,SAAS;EAUX,cAAc,SAAS,mBAAmB,SAAS;EAMnD,UACE,SAAS,mBACT,2BACC;EAWH,KAAK,OAAO,eAAe;EA0E3B,WAAW;EAWX,QAAQ,GACN,SAAS,kBACT;IACE;IACA;IACA;IACA,UAAU,WAAW,kBAAkB;KAEzC,QAAQ,eACP;EAqBH,QACE,OAAO,8BACP,QAAQ,cACR,oBACC,+BAA+B;EAmBlC,MACE,0BACA,kBACA,QAAQ;;;;cC5RC;mBAMkB;mBALZ;EAKjB,YAA6B,WAAW;EAExC,QAAQ,GAAG,WAAW,UAAU,KAAK,oBAAoB;;;;cCJ9C;UACH;mBACS;UACT;EAER,SAAS,qBAAqB;EAI9B,OAAO,KAAK;EAIZ,iBAAiB;EAKjB,iBAAiB,QAAQ,UAAU;EAUnC,KAAK,SAAS,mBAAmB;EAIjC,OAAO,SAAS,mBAAmB;EAWnC,KAAK,MAAM;EAIX,SACE,SAAS,kBACT,YAAS,gBACR;;;;cCHQ;mBAKQ;mBACA;mBACA;mBALF;EAEjB,YACmB,WAAW,gBACX,UAAU,gBACV,YAAY;UAGvB;EAiGR,eAAe,QAAQ,MAAM,0BAA0B;EAIvD,WAAW,SAAS,mBAAmB;EAiBvC,KAAK,QAAQ,MAAM,iBAAiB;;;;cCzJzB,kBAAkB,UAAU,WAAW;;mBAQJ;mBACJ;mBACK;mBACL;mBACK;mBACD;WAZrC;WACA,UAAU;WACV,KAAK;EAGd,YACuC,SAAS,yBAAyB,IAC3B,UAAU,kBACd,OAAO,cACF,UAAU,mBACf,SAAS,cACJ,YAAY,mBACb,aAAa;EAiB3D,WAAW,QAAQ,QAAQ;EAI3B;aAEe;aACA;aACA;;EAcf,gBAAgB,QAAQ;EAUxB,cAAc,QAAQ,UAAU;EAIhC,aAAa,SAAS,mBAAmB;EAiBzC,YAAY,2BAA2B;EA0BvC,sBAAsB,GAAG,UAAU,QAAQ,KAAK,QAAQ;EA0BxD,eAAe,GAAG,UAAU,QAAQ,KAAK,QAAQ;EAiBjD,gBAAgB,GAAG,UAAU,QAAQ,KAAK,QAAQ;;;;cCxJvC,aAAY;cACZ,OAAI;EACf;EACA;EACA;EACA;MACE;iBACY,aAAa,GAAG,UAAU,gBAAgB,eACxD,QAAQ,oBAAoB,GAAG,gBAAgB,OAC7C,QAAQ,GAAG,UAAU,uBAAuB,YAAY;cAY/C;mBAIQ;mBACA;mBACA;mBACA;mBANF;EAEjB,YACmB,UAAU,gBACV,SAAS,eACT,UAAU,mBACV,OAAO;EAGpB,SACJ,MAAM,WACN,WAAW,eACX,MAAM,eACN,OAAO,eACP,WAAW,kBACX,oBACC,QAAQ;;;;cCxCA,2BAA2B;mBAKC;mBAJtB;YACP;EAEV,YACuC,MAAM,KAAK;EAGlD,YAAY,SAAS,mBAAmB;;cAI7B,qBAAqB;mBAEb;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;EAPnB,YACmB,WAAW,gBACX,SAAS,cACT,YAAY,mBACZ,UAAU,mBACV,WAAW,wBACX,OAAO,cACP,UAAU;EAGvB,YAAY,SAAS,mBAAmB;;;;cChCnC,sCAAsC;mBAKV;mBAJtB;YACP;EAEV,YACuC,MAAM,KAAK;EAGlD,UAAU,SAAS,kBAAkB,MAAM,cAAc;;cAI9C,qBAAqB;mBAEb;mBACA;mBACA;mBACA;mBACA;EALnB,YACmB,WAAW,gBACX,SAAS,cACT,YAAY,mBACZ,OAAO,cACP,UAAU;EAG7B,UAAU,SAAS,kBAAkB,MAAM,cAAc;;;;iBCc3C,gBAAgB,GAC9B,YAAY,KAAK,oBAAoB,WAAW,wBAC/C,oBAAoB;iBAGP,mBAAmB,UAAU,cAAc,UAAU,IAAI;iBAGzD,gBAAgB,UAAU,eAAe,WAAW,IAAI;;;cCtB3D,uCAAM,uBAAA;cACN,6CAAY,uBAAA;cAEZ,cAAW;EAAgB;OAAyB,kBAAA,UAAA,GAAA,QAAA,oBAAA,+BAAA,aAAA,wBAAA;cAKpD,kBAAe,0CAAgB,uBAAA;cAE/B,sBAAgB,iBACP,kBAAkB,8CAAgB,uBAAA;cAE3C,wDAAuB,uBAAA;cAEvB,qBAAkB,+CAAA,uBAAA;cAElB,gDAAe,uBAAA;cAEf,sBAAa,kBAAA,UAAA,GAAA,QAAA,oBAAA,+BAAA,aAAA,wBAAA;iBAMV,WACX,uBAAuB,oBACzB,iBAAiB;cAeP,WAAK,uBACU,sBACzB;cACU,WAAK,uBACU,sBACzB;cACU,cAAe,GAAC,QACnB,UAAU,IAAE,QACZ,GAAC,UACC,uBACT,YAAY;cAyEF,wBAAuB;iBACpB,qBAAqB,UAAU,eAAe,GAAG;WACtD,MAAM;WACN;WACA,UAAU,WAAW,gBAAgB,OAAO;UAC7C;iBAGM,sBACd,cACA;WAAiB;UACV;cA4GI,mBAAoB,UAAU,8BAA4B,QAC7D,aAAa,MAAM,eAAa,UAC9B,gBACT,oBAAoB;cACV,kBAAmB,UAAU,8BAA4B,QAC5D,aAAa,MAAM,eAAa,UAC9B,gBACT,oBAAoB;cAqBV,iBAAkB,UAAU,oBAAkB,QACjD,GAAC,UACC,kBACT,sBAAsB;cAEZ,gBAAiB,UAAU,oBAAkB,QAChD,GAAC,UACC,kBACT,sBAAsB;;;cC3SZ;cACA,sBAAc;cAKd,mBAAW;iBAgBR,iBAAiB,IAAI,aACnC,UAAS,wBAAwB,KAChC,gBAAgB,iBAAiB;cAyLvB,eAAY;EACZ;MACV;EAAc;;cAIJ,sBAAmB;EAC9B;MACE,iBAAiB;;;cC1NR,wBAAyB,UAAU,mBAAiB,QACvD,gBAAgB,OACvB,gBAAgB;cACN,gBAAiB,UAAU,mBAAiB,WAC5C,MACV,gBAAgB;cACN,cAAa;cACb,WAAQ,SAAa,gBAAc;;;;iBCkShC,qBACd,MAAM,UACN,UAAU,qBAEV,4BACA,KAAK,KAAK,cAAc;;;iBC9IV,iBAAiB,aAAa;;;;UCjL7B;EACf,SAAS;;;;;UCIM;EACf,QAAQ,SAAS,UAAU,QAAQ;EACnC;IACE,WAAW;MACT,SAAS;MACT;QAAU;QAA8B;;MACxC;QACE;;EAEN,UAAU;;;UAGK;WACN,UAAU;WACV;;;UAKM;KACL,eAAe;EAAmB,MAAM;;KACxC,iBAAiB;EAAmB,YAAY,UAAU;IAClE,IACA;KACQ,sBAAsB;EAChC,iBAAiB,UAAU,eAAe;IAExC,IACA;KACQ,OAAO,gCAAgC,sBAC/C,iBACA,gBAAgB,sBACd,oBAAoB,KACpB;;KAGD;EACH,+BAA+B;EAC/B,4BAA4B;;KAElB,UAAU,KAAK;EAAY;IAAU,eAAe;;IAC5D,YAAY,KACZ;KACQ,OAAO,KAAK,UAAU;EAAa,YAAY;IAAM;KACrD,YAAY,gCAAgC,UAAU,OAAO;KAC7D,SAAS,gCAAgC,OAAO,OAAO;KACvD,UAAU,KAAK;EAAY;IAAQ;;;KAG1C,OAAO,KAAK,YAAW,WAAW,kBAClC,YAAY;EAAe,aAAa;KACvC,YAAY;KAGb,cAAc,GAAG,oBAAoB;EACxC,QAAQ,KAAK,UAAU;IAErB,OAAO;EAAa,oBAAoB;IACtC,YAAY;KAGN,iBAAiB,gCAC3B,4BACI,cAAc,OAAO,2BACrB;KACM,eAAe,gCACzB,4BACI,cAAc,OAAO,uBACrB;KAID,MAAM,KAAK;EAAY,WAAW;IAAQ;KACnC,aAAa,IAAI,qBAC1B,WAAW,MAAM,KAAK,MAAM,GAAG;EAAa,YAAY;IACrD,mBAEE,MAAM;KACT,WAAW,kBAAkB,IAAI,qBACnC,WAAW,MAAM,KAAK,MAAM,GAAG;EAAa,MAAM;IAAM,MAAM,GAAG,oBAC5D,MAAM;KACT,OAAO,qBAAqB,WAAW,gCAExC,OAAO,WAAW;;;;;KAKV,gBAAgB,MAAM,+BAE9B,+BACc,WAAW,kBAAiB,SAAS;KAE3C,gBAAgB,6BAA6B,2BACjC;EAElB,MAAM;EAAG,qBAAqB,cAAc,gBAAgB,OAAO;;KAC7D,qBAAqB,6BAC/B,gBAAgB;KAIb,UAAU,kCACS;KAEnB,SACH,UAAU,oBACV,iCACE,mBAAmB,gBAAgB,0BAA0B,6CAC7D,YAAY,YAAY,YAAY,QAAQ,IAAI,IAAI;;KAGnD,cAAc,KAAK,mBACpB,OAAO,kBACP,sBACE,UAAU;EAA0B,eAAe;IACjD;KAGH,YAAY,UAAU,sBACzB,mBAAmB,WAAW,OACzB,cAAc,sBACb,uBACA,qBACE,QAAQ,cAAc,MACtB,cAAc,KAClB;;KAEM,iBACV,UAAU,oBACV,4CACE,WAAW,SAAS,GAAG,UAAU,YAAY;;KAErC,mBACV,UAAU,oBACV,iCACE,QAAQ,WAAW,SAAS,GAAG;KACvB,mBACV,UAAU,oBACV,kCAEA,MAAM,iBAAiB,GAAG,KAC1B,2BAA2B,8CACxB,mBAAmB,GAAG,MAAM,QAAQ,mBAAmB,GAAG;;KAGnD,uBAAuB,KAAK;EACtC;IAAW;;;KAID,sBAAsB;KACtB,gBAAgB,eAAe;KAC/B,gBAAgB,UAAU,iBAAiB,eAAe;UACrD,iBAAiB,IAAI,qBAAqB;WAChD;WACA,SAAS;;;;UC7HH;;EAEf,qBAAqB,aAAa;;EAElC,sBAAsB,aAAa;;KAEzB;WACD;WACA;;;UAIM;;EAEf;;EAEA;;;;;EAKA;;;;;;;EAOA;;EAEA,sBAAsB,aAAa;;;KAIzB,yBAAyB,UAAU,WAAW;;EAExD,MAAM;;EAEN;;;;;;;;EAQA,+BAA+B;;EAE/B,OAAO;;EAEP,UAAU;;EAEV,cAAc;;EAEd,SAAS;;EAET,SAAS;;EAET;IACE,cAAc;UAED;;;;;;EAMf;;UAGe;;;;;;;;;EASf;;UAGe;;;;;EAKf;;;;;;;;EAQA;;;KAIU,cAAc,UAAU,YAClC,UAAU,UAAU;EACd,UAAU,wBAAwB,UAAU;;EAE5C,UACK,wBAAwB,UAAU;IACjC,SAAS,GAAG,UAAU;;;UAKnB,wBAAwB;;EAEvC,UAAU,SAAS;;EAEnB;;;;;;;EAOA;;UAGe;;EAEf;;EAEA;;EAEA,kBAAkB;;EAElB;;;;;;EAMA;;EAEA;;KAGU,0BACV;WACW,SAAS;WACT;WACA;GAEX,OAAO,UAAU,YAAY,QAAQ,cAClC,QAAQ;KAED,wBAAwB,UAAU,YAC5C,0BAA0B,yBAAyB;UAEpC,6BAA6B,UAAU,kBAC9C;EACR,UAAU;EACV,mBAAmB,iBAAiB;EACpC,gBACK,gBACA,wBAAwB,KAAK,QAAQ,wBAAwB;;;KAIxD,wBAAwB,UAAU,YAC5C,yBAAyB,QACtB,YAAY,0BACX,yBAAyB,uCAAuC;UAErD,uCAAuC;WAC7C,aAAa;;;KAGZ,qBAAqB,KAAK,4BAClC,UAAU;EAEN,MAAM;;;KAKF,aAAa,KAAK,KAAK,KAAK,IAAI,oBAAoB;UAC/C,oBAAoB;YACzB;WACD;aACM,UAAU,KAAK;;aAEf,gBAAgB,gBAAgB,IAAI,QAAQ;aAC5C,kBAAkB;;aAElB,aAAa,eAAe;;WAClC,qBAAqB;WACrB,UAAU;;WAEV,mBAAmB;;UAGb;WACN;;;;;;;WAOA;;WAEA;;;;;WAKA,uBAAuB;;WAEvB;;;;;;WAMA;;WAEA;;WAEA,SAAS;;WAET;aACE;aACA;;;;;;;WAOF;;WAEA;;WAEA;WACA;;KAKC,oBACR;WACW;;WACA;;;;;;UAME;EACf,QACE,MAAM,eACN,SAAS,oBACR,QAAQ;;UAEI;WACN,MAAM;WACN;;WAEA,SAAS;;WAET;;;;;;WAMA;aAAwB;;;;UAIlB;EACf,OAAO,GACL,QAAQ,oBAAoB,SAC5B,QAAQ,GACR,SAAS,uBACR,QAAQ;;UAGI;WACN;;WAEA,sBAAsB;;WAEtB;;UAGM;;EAEf;;EAEA;;EAEA;;EAEA;;UAEe;EACf;EACA;;KAEU,iBAAiB,KAAK;KACtB,oBAAoB,qBAAqB,GACnD,gBACA,sBACA,YAAY,yBAAyB,KAAK,gBAAgB,OAAO;KAEvD,sBACV,UAAU,oBACV,kCAEA,gBACA,sBACA,YAAY,wBAAwB,mBAAmB,GAAG;KAEhD;UAGK;;EAEf;;UAae;;EAEf,YAAY,KAAK;IAAoB;;;UAGtB;;EAEf,YAAY;IAAW;IAAa,KAAK;;;UAiJ1B;WACN;WACA;;WAEA;;;;;EAKT,OAAO,QAAQ;;;UAIA;WACN;;;KAKC,4BAA4B;UAEvB;EACf,SAAS,cAAc;;;;;EAKvB,GAAG,cAAc,KAAK,sBAAsB;;UAG7B;WACN;;WAEA;WACA;WACA;;UAEM;WACN;WACA,MAAM;;WAEN,SAAS;;WAET;WACA;;WAEA;aACE;aACA;;;WAGF,mBAAmB;WACnB;aACE;aACA;;WAEF,kBAAkB,KACzB;;WAIO,mBAAmB,KAAK;;UAElB;WACN,MAAM;;WAEN;;WAEA;;UAGM;;WAEN;;;;;;WAMA;aACE;aACA;;;EAGX,SAAS,SAAS;;;;;;;;;EASlB,SAAS,KAAK;;;;;;;EAOd,MAAM,KAAK,8BAA8B;;WAEhC,UAAU;;EAEnB,YAAY,SAAS,sBAAsB;;EAE3C,UAAU,SAAS;;;;;EAKnB,mBACE,iBAAiB,8BACjB,mBAAmB;;EAGrB,QACE,KAAK,6BACK,eAAe,iBAAiB;;UAG7B;;WAEN;;WAEA;;WAEA;;WAEA;;UAGM;;;;;;WAMN;WACA;;UAGM;WACN,SAAS;WACT,QAAQ;;EAEjB,MAAM,mBAAmB;;UAGV;WACN,SAAS;WACT,QAAQ;WACR,SAAS;;UAGH;WACN;;WAEA;WACA;;WAEA;;EAET,QAAQ;;;;;EAKR,OAAO,SAAS,qBAAqB,QAAQ;;EAE7C,mBAAmB;;UAGJ;WACN;;WAEA;;WAEA,SAAS;;WAET,MAAM,aAAa,eAAe;;WAElC;;WAEA;;WAEA,SAAS;;UAGH;;;;;;EAMf,UAAU;;;;;;;;EAQV,OAAO;;EAEP,IAAI;;EAEJ,QAAQ,eAAe;;EAEvB,QAAQ;aAA0B;aAAyB;;;EAE3D,SAAS;;EAET,MAAM,cAAc;;EAEpB,WAAW,cAAc,eAAe;;EAExC,aAAa;;UAGE;;EAEf,OAAO;;UAGQ;;WAEN;;;;;EAKT,QAAQ,SAAS;;;;;;EAMjB,SAAS,SAAS,kBAAkB,KAAK,eAAe;;EAExD,YAAY,SAAS,aAAa,SAAS;;;;;;;;EAQ3C,qBACE,OAAO,gCAAgC,8BACvC,SAAS,kBACT;aAAiB;;;;;;EAMnB,UAAU,KAAK,oCAAoC;;;;;;;;EASnD,kBAAkB,QAAQ,UAAU;;;;;;;EAOpC,SAAS,SAAS,mBAAmB;;WAE5B;aAAsB;;;EAE/B,QACE,KAAK,6BACK,eAAe,iBAAiB;;UAG7B;;;;;WAKN;;;;;;;;;;WAUA;;WAEA;;WAEA;;;;;;WAMA,UAAU;;;;;;EAMnB,WAAW;;WAEF;;WAEA,SAAS;;WAET;aAAqB;aAAyB;;;EAEvD,MAAM;;WAEG,UAAU;;UAGJ;;;;;;WAMN;;;;;EAKT,WAAW;;WAEF;;WAEA;;;UAIM;;WAEN;;;;;;;;WAQA;;;;;;;WAOA,YAAY,6BAA6B;;;;;;WAMzC,kBAAkB;;UAGZ;;WAEN,MAAM;;UAGA;WACN,WAAW;WACX,WAAW;WACX,WAAW;WACX;;WAGA,SAAS,QAAQ,UAAU,mBAAmB;;;;;EAKvD,MAEE,QAAQ,UACR,4BACA,OAAO,YACP,SAAS;WAEF,QAAQ;;;;;;;;;KASP;UACK;;WAEN;;WAEA;;WAEA;;WAEA;;;;;WAKA;;UAGM;WACN;;WAEA;;WAEA;;;;;WAKA,aAAa;;UAGP;;EAEf,OAAO,aAAa,SAAS;;WAEpB;;UAGM,gBAAgB,UAAU,oBAAoB;WACpD;;WAEA,gBAAgB;;;;;WAKhB;;;;;WAKA;;WAEA;aACE;aACA;;;;;;;;WAQF;;;;;;WAMA;;;;;WAKA;aACE;aACA;;;EAGX,WAAW,SAAS;;;;;EAKpB,QAAQ,SAAS,mBAAmB,QAAQ,gBAAgB;;EAE5D,QACE,KAAK,6BACK,eAAe,iBAAiB;;KAGlC,gBAAgB,UAAU,oBAAoB;WAC3C;WAAmC,WAAW;;WAC9C;;WACA;WAA8B,SAAS;;UAErC;WACN,SAAS;WACT,SAAS;WACT;WACA;aAAqB;aAAyB;;WAC9C;WACA,MAAM;;EAEf,KAAK,GAAG,+BAA+B,eAAe,QAAQ,KAAK,QAAQ;;;UAI5D,WAAW,UAAU,WAAW;WACtC;WACA,UAAU;WACV,KAAK;EACd,WAAW,QAAQ;EACnB,UAAU,aAAa;;EAEvB,IAAI,GAAG,MAAM,WAAW,UAAU,QAAQ,KAAK,QAAQ;;EAEvD,YACE,SAAS,iBACT,0BACC,QAAQ;;;;;EAKX,mBAAmB;;EAEnB,gBAAgB,gBAAgB,UAAU,UAAU;;UAErC;;WAEN,SAAS;;;;;WAKT;;WAEA,gBAAgB;;WAEhB;;;UAGM;WACN;WACA;WACA;WACA;;WAEA;;WAEA;aAAsB;;WACtB;aACE;aACA;aACA;aACA;;aAEA;eAAuB;;aACvB,uCAEH,UAAU;aACP;eACE;eACA;iBAAmB;;;aAErB;eAAwB;;aACxB;eACE;iBACE;iBACA;;eAEF;eACA;eACA;;;;WAIJ;IACP,aAAa,iBAAiB;eACnB;eACA;eACA;eACA,aAAa;;;WAGjB,aAAa,SACpB;aAGa;aACA;eACE;eACA;;;WAKR;aACE;aACA;aACA;;WAEF;IACP,QAAQ;MACN;MACA;QAAkB;QAAe;;QAC/B;IACJ,WAAW;MACT;MACA;QAAkB;QAAe;;MACjC,QAAQ;QACN;;EAEN,UAAU;EACV,UAAU;EACV,gBACE,aACA;IAAa;;;UAIA,oBACf,kBACA,UAAU,oBAAoB;;WAGrB;WACA;;aAEE;;;;;;;aAOA,sBAAsB;;aAEtB;;aAEA;;aAEA;;;EAGX,SACE,QAAQ,QACR,SAAS,qBAAqB,KAC7B,wBAAwB,QAAQ;;EAEnC,UAAU,QAAQ,QAAQ,MAAM,2BAA2B;;EAE3D,QACE,KAAK,6BACK,eAAe,iBAAiB;;;;;;KAOlC,UAAU,UAClB,oBAAoB,eACpB,KAAK,oBAAoB,gBACzB;UAEa,YAAY;WAClB,QAAQ,UAAU;WAClB,QAAQ;WACR;;WAEA;;WAEA;;KAEC,kBACR;WACW,gBAAgB;;WAChB,gBAAgB;;KAEnB;WACG;;WAEA;WACA;WACA;WACA;WACA;;UAGE,qBACf,UAAU,oBAAoB;WAErB,WAAW;WACX;WACA;WACA,SAAS;WACT,SAAS;WACT;aAAqB;aAAyB;;EACvD,MAAM;WACG;aAAoB,OAAO;aAAe;;WAC1C,MAAM;;;;;EAKf,KAAK,GAAG,+BAA+B,eAAe,QAAQ,KAAK,QAAQ;;EAE3E,QAAQ,cAAc;WACb,WAAW;;UAGL;WACN,MAAM;WACN,SAAS;WACT"}

package/dist/{auth-decorators-B7xasVk_.cjs → auth-decorators-9L-UO_T3.cjs}

@@ -1,7 +1,7 @@
 const require_auth_errors = require("./auth-errors-1EdQ36D8.cjs");
-const require_decorate = require("./decorate-Bvg21vkL.cjs");
-const require_auth_scope_interceptor = require("./auth-scope-interceptor-DU57SvDf.cjs");
-const require_auth_guard = require("./auth-guard-CdV9G47g.cjs");
+const require_decorate = require("./decorate-DdRSPs9e.cjs");
+const require_auth_scope_interceptor = require("./auth-scope-interceptor-DJTO9RVP.cjs");
+const require_auth_guard = require("./auth-guard-Dh9SWsXf.cjs");
 const require_principal_readings = require("./principal-readings-K8zeZbEl.cjs");
 let _nestjs_common = require("@nestjs/common");
 let node_async_hooks = require("node:async_hooks");
@@ -411,4 +411,4 @@ Object.defineProperty(exports, "requirement", {
 	}
 });
 
-//# sourceMappingURL=auth-decorators-B7xasVk_.cjs.map
+//# sourceMappingURL=auth-decorators-9L-UO_T3.cjs.map

package/dist/{auth-decorators-B7xasVk_.cjs.map → auth-decorators-9L-UO_T3.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"auth-decorators-B7xasVk_.cjs","names":["AsyncLocalStorage","AuthFailures","isConfigurationError","SetMetadata","applyDecorators","UseGuards","BetterAuthGuard","UseInterceptors","BetterAuthScopeInterceptor","PrincipalReadings","createParamDecorator","BetterAuthConfigurationError"],"sources":["../src/request-scope.ts","../src/auth-decorators.ts"],"sourcesContent":["import { AsyncLocalStorage } from \"node:async_hooks\";\nimport type {\n  AuthorizationDecision,\n  InvocationLineage,\n  PrincipalReading,\n  PrincipalResult,\n  RoutePlan,\n  TransportCall,\n} from \"./auth-contracts.js\";\nimport {\n  AuthFailures,\n  type AuthFailure,\n  isConfigurationError,\n} from \"./auth-errors.js\";\nimport type { ScopeView } from \"./bridge-protocol.js\";\n\nexport interface ScopeState {\n  readonly view: ScopeView;\n  readonly call?: TransportCall;\n  readonly plan?: RoutePlan;\n  readonly reading?: () => PrincipalReading;\n}\nexport interface RequestState {\n  readonly principal: Map<string, Promise<PrincipalResult>>;\n  readonly policyIo: Map<string, Promise<unknown>>;\n  readonly decisions: Map<string, Promise<AuthorizationDecision>>;\n  readonly values: Map<symbol, unknown>;\n  readonly authorizationCalls: Set<string>;\n  readonly origins: Map<string, Promise<AuthFailure | null>>;\n  readonly surfaced: Set<string>;\n  readonly connections: Map<\n    string,\n    {\n      value: Extract<PrincipalResult, { outcome: \"authenticated\" | \"absent\" }>;\n      expiresAt: number;\n    }\n  >;\n}\n\nconst SURFACED = Symbol.for(\"nestjs-slightly-better-auth:surfaced\");\nexport function memoKey(\n  instance: string,\n  ...inputs: readonly unknown[]\n): string {\n  return JSON.stringify([instance, ...inputs]);\n}\n\n/** Shared by guards and readers that have only the transport's structural lineage. */\nexport function surfacedRecord(\n  key: object,\n  lineage?: InvocationLineage,\n): Set<string> {\n  const carrier = lineage?.carrier ?? key;\n  const partition = lineage ? lineage.position.split(\":\", 1)[0]! : \"\";\n  let records = Reflect.get(carrier, SURFACED) as\n    | Map<string, Set<string>>\n    | undefined;\n  if (!records) {\n    records = new Map();\n    Object.defineProperty(carrier, SURFACED, { value: records });\n  }\n  let record = records.get(partition);\n  if (!record) {\n    record = new Set();\n    records.set(partition, record);\n  }\n  return record;\n}\n\nexport class RequestScope {\n  readonly #storage = new AsyncLocalStorage<ScopeState>();\n  readonly #states = new WeakMap<object, RequestState>();\n  readonly #valueKeys = new Map<string, Map<symbol, symbol>>();\n  readonly #errorIds = new WeakMap<object, number>();\n  #nextError = 0;\n\n  run<T>(state: ScopeState, fn: () => T): T {\n    return this.#storage.run(state, fn);\n  }\n\n  exit<T>(fn: () => T): T {\n    return this.#storage.exit(fn);\n  }\n\n  current(): ScopeState | undefined {\n    return this.#storage.getStore();\n  }\n\n  stateFor(key: object): RequestState {\n    let state = this.#states.get(key);\n    if (!state) {\n      state = {\n        principal: new Map(),\n        policyIo: new Map(),\n        decisions: new Map(),\n        values: new Map(),\n        authorizationCalls: new Set(),\n        origins: new Map(),\n        surfaced: new Set(),\n        connections: new Map(),\n      };\n      this.#states.set(key, state);\n    }\n    return state;\n  }\n\n  memoPrincipal(\n    call: Pick<TransportCall, \"key\" | \"connection\" | \"principalTtlMs\">,\n    input: {\n      instance: string;\n      freshness: \"default\" | \"authoritative\";\n      sourceSet: string;\n    },\n    compute: () => Promise<PrincipalResult>,\n  ): Promise<PrincipalResult> {\n    const key = memoKey(input.instance, input.freshness, input.sourceSet);\n    const state = this.stateFor(call.key);\n    const existing = state.principal.get(key);\n    if (existing) {\n      return existing;\n    }\n    const connection =\n      call.connection &&\n      input.freshness !== \"authoritative\" &&\n      (call.principalTtlMs ?? 0) > 0\n        ? this.stateFor(call.connection).connections\n        : undefined;\n    const cached = connection?.get(key);\n    const promise = Promise.resolve().then(async () => {\n      if (cached && cached.expiresAt > Date.now()) {\n        return cached.value;\n      }\n      connection?.delete(key);\n      try {\n        const value = await compute();\n        if (value.outcome !== \"rejected\") {\n          connection?.set(key, {\n            value,\n            expiresAt: Date.now() + (call.principalTtlMs ?? 0),\n          });\n        }\n        return value;\n      } catch (error) {\n        connection?.delete(key);\n        throw error;\n      }\n    });\n    state.principal.set(key, promise);\n    return promise;\n  }\n\n  memoPolicyIo<T>(\n    request: object,\n    instance: string,\n    concreteKey: string,\n    compute: () => Promise<T>,\n    limit: number | false = 100,\n  ): Promise<T> {\n    const state = this.stateFor(request);\n    const key = memoKey(instance, concreteKey);\n    const existing = state.policyIo.get(key);\n    if (existing) {\n      return existing as Promise<T>;\n    }\n    if (\n      limit !== false &&\n      [...state.authorizationCalls].filter(\n        (entry) => JSON.parse(entry)[0] === instance,\n      ).length >= limit\n    ) {\n      return Promise.reject(\n        AuthFailures.rejected({\n          status: 429,\n          reason: \"TOO_MANY_AUTHORIZATION_CHECKS\",\n        }),\n      );\n    }\n    state.authorizationCalls.add(key);\n    const promise = Promise.resolve().then(compute);\n    state.policyIo.set(key, promise);\n    return promise;\n  }\n\n  memoDecision(\n    invocation: object,\n    instance: string,\n    concreteKey: string,\n    compute: () => Promise<AuthorizationDecision>,\n  ): Promise<AuthorizationDecision> {\n    const decisions = this.stateFor(invocation).decisions;\n    const key = memoKey(instance, concreteKey);\n    let promise = decisions.get(key);\n    if (!promise) {\n      promise = Promise.resolve().then(compute);\n      decisions.set(key, promise);\n    }\n    return promise;\n  }\n\n  valueKey(instance: string, key: symbol): symbol {\n    let keys = this.#valueKeys.get(instance);\n    if (!keys) {\n      keys = new Map();\n      this.#valueKeys.set(instance, keys);\n    }\n    let namespaced = keys.get(key);\n    if (!namespaced) {\n      namespaced = Symbol(key.description);\n      keys.set(key, namespaced);\n    }\n    return namespaced;\n  }\n\n  surfaced(\n    key: object,\n    error: object,\n    context: { instance: string; site: string; lineage?: InvocationLineage },\n  ): boolean {\n    let id = this.#errorIds.get(error);\n    if (!id) {\n      id = ++this.#nextError;\n      this.#errorIds.set(error, id);\n    }\n    const reason = isConfigurationError(error)\n      ? memoKey(context.instance, error.code, context.site)\n      : `error:${id}`;\n    const carrier = surfacedRecord(key, context.lineage);\n    const state =\n      key === context.lineage?.carrier ? carrier : this.stateFor(key).surfaced;\n    const repeated = state.has(reason) || carrier.has(reason);\n    state.add(reason);\n    carrier.add(reason);\n    return repeated;\n  }\n}\n","import {\n  applyDecorators,\n  createParamDecorator,\n  SetMetadata,\n  UseGuards,\n  UseInterceptors,\n  type ExecutionContext,\n} from \"@nestjs/common\";\nimport type {\n  DatabaseHookTarget,\n  DbHookMethodDecorator,\n  DbHookOptions,\n  HookMethodDecorator,\n  HookOptions,\n  HookPredicate,\n  PolicyRef,\n  PrincipalReading,\n  Requirement,\n  RequirementExpr,\n  RequirementOptions,\n} from \"./auth-contracts.js\";\nimport type {\n  EndpointPath,\n  PrincipalKind,\n  PrincipalOfKind,\n} from \"./auth-types.js\";\nimport { BetterAuthConfigurationError } from \"./auth-errors.js\";\nimport * as tokens from \"./auth-tokens.js\";\nimport { BetterAuthGuard } from \"./auth-guard.js\";\nimport { BetterAuthScopeInterceptor } from \"./auth-scope-interceptor.js\";\nimport { PrincipalReadings } from \"./principal-readings.js\";\nimport { RequestScope } from \"./request-scope.js\";\n\nfunction append(target: object, key: symbol, value: unknown): void {\n  Reflect.defineMetadata(\n    key,\n    Object.freeze([...(Reflect.getOwnMetadata(key, target) ?? []), value]),\n    target,\n  );\n}\nexport const Public = () => SetMetadata(tokens.ACCESS_METADATA, \"public\");\nexport const OptionalAuth = () =>\n  SetMetadata(tokens.ACCESS_METADATA, \"optional\");\nexport const RequireAuth = (options?: { authoritative?: boolean }) =>\n  applyDecorators(\n    SetMetadata(tokens.ACCESS_METADATA, \"required\"),\n    SetMetadata(tokens.FRESHNESS_METADATA, options?.authoritative === true),\n  );\nexport const UseAuthInstance = (name: string) =>\n  SetMetadata(tokens.AUTH_INSTANCE_METADATA, name);\nexport const AcceptPrincipals = (\n  ...kinds: readonly [PrincipalKind, ...PrincipalKind[]]\n) => SetMetadata(tokens.ACCEPT_PRINCIPALS_METADATA, Object.freeze([...kinds]));\nexport const SkipDefaultRequirements = () =>\n  SetMetadata(tokens.SKIP_DEFAULT_REQUIREMENTS_METADATA, true);\nexport const ForwardAuthCookies = (enabled = true) =>\n  SetMetadata(tokens.FORWARD_COOKIES_METADATA, enabled);\nexport const SkipOriginCheck = () =>\n  SetMetadata(tokens.SKIP_ORIGIN_CHECK_METADATA, true);\nexport const UseBetterAuth = () =>\n  applyDecorators(\n    SetMetadata(tokens.USE_BETTER_AUTH_METADATA, true),\n    UseGuards(BetterAuthGuard),\n    UseInterceptors(BetterAuthScopeInterceptor),\n  );\nexport function Require(\n  ...requirements: readonly RequirementExpr[]\n): ClassDecorator & MethodDecorator {\n  return (\n    target: object,\n    _key?: string | symbol,\n    descriptor?: PropertyDescriptor,\n  ) => {\n    for (const expression of requirements) {\n      append(\n        descriptor?.value ?? target,\n        tokens.REQUIREMENTS_METADATA,\n        expression,\n      );\n    }\n  };\n}\nexport const anyOf = (\n  ...requirements: readonly RequirementExpr[]\n): RequirementExpr => ({ anyOf: requirements });\nexport const allOf = (\n  ...requirements: readonly RequirementExpr[]\n): RequirementExpr => ({ allOf: requirements });\nexport const requirement = <P>(\n  policy: PolicyRef<P>,\n  params: P,\n  options?: RequirementOptions,\n): Requirement<P> => ({ policy, params, ...options });\n\nexport interface ReaderContext {\n  readonly args: readonly unknown[];\n  readonly readings: PrincipalReadings;\n  readonly scope: RequestScope;\n  readonly reading?: () => PrincipalReading;\n}\nexport function readerContext(context: ExecutionContext): ReaderContext {\n  const args = context.getArgs();\n  for (const arg of [args, ...args]) {\n    if (\n      (typeof arg !== \"object\" || arg === null) &&\n      typeof arg !== \"function\"\n    ) {\n      continue;\n    }\n    const bridge = Reflect.get(arg, tokens.READER_CONTEXT) as\n      | ReaderContext\n      | undefined;\n    if (\n      bridge &&\n      bridge.args.length === args.length &&\n      bridge.args.every((value, index) => value === args[index]) &&\n      bridge.reading !== undefined &&\n      bridge.scope.current()?.reading === bridge.reading\n    ) {\n      return bridge;\n    }\n  }\n  // No application state is created or retained by a DI-free lineage-only reader.\n  const scope = new RequestScope();\n  return { args, scope, readings: new PrincipalReadings(scope) };\n}\nfunction principalParam(spec?: {\n  kind: string;\n  reason: string;\n  project: (p: any) => unknown;\n}): ParameterDecorator {\n  const decorator = createParamDecorator(\n    (_data: unknown, context: ExecutionContext) => {\n      const bridge = readerContext(context);\n      const input = {\n        args: context.getArgs(),\n        site: `${context.getClass().name}.${context.getHandler().name}`,\n      };\n      const reading =\n        bridge.reading !== undefined &&\n        bridge.scope.current()?.reading === bridge.reading\n          ? bridge.readings.current()\n          : bridge.readings.read(input);\n      return bridge.readings.project(\n        reading,\n        { ...spec, site: input.site, project: spec?.project ?? ((p) => p) },\n        input,\n      );\n    },\n  )();\n  return (target, propertyKey, index) => {\n    if (propertyKey === undefined) {\n      throw new BetterAuthConfigurationError(\n        \"PRINCIPAL_PARAM_TARGET\",\n        \"Principal parameters require a handler method\",\n      );\n    }\n    const handler = Reflect.get(target, propertyKey);\n    append(handler, tokens.PRINCIPAL_PARAMS_METADATA, {\n      index,\n      ...(spec ? { kind: spec.kind, reason: spec.reason } : {}),\n    });\n    decorator(target, propertyKey, index);\n  };\n}\nexport const CurrentPrincipal = (): ParameterDecorator => principalParam();\nexport function definePrincipalParam<K extends PrincipalKind, R>(spec: {\n  readonly kind: K;\n  readonly reason: string;\n  readonly project: (principal: PrincipalOfKind<K>) => R;\n}): () => ParameterDecorator {\n  return () => principalParam(spec);\n}\nexport function defineInvocationParam(\n  slot: symbol,\n  spec: { readonly missing: string },\n): () => ParameterDecorator {\n  return () => {\n    const decorator = createParamDecorator(\n      (_data: unknown, context: ExecutionContext) => {\n        const bridge = readerContext(context);\n        const state = bridge.scope.current();\n        const input = {\n          args: context.getArgs(),\n          site: `${context.getClass().name}.${context.getHandler().name}`,\n        };\n        const reading = state?.reading\n          ? bridge.readings.current()\n          : bridge.readings.read(input);\n        const candidates = state?.call\n          ? [state.call.invocation]\n          : [input.args, ...input.args];\n        for (const candidate of candidates) {\n          if (\n            !candidate ||\n            (typeof candidate !== \"object\" && typeof candidate !== \"function\")\n          ) {\n            continue;\n          }\n          const values = Reflect.get(candidate, tokens.INVOCATION_VALUES) as\n            | Map<string, Map<symbol, unknown>>\n            | undefined;\n          if (values?.get(reading.instance)?.has(slot)) {\n            return values.get(reading.instance)!.get(slot);\n          }\n        }\n        throw bridge.readings.deliver(\n          BetterAuthConfigurationError.atRequest(\n            \"NO_INVOCATION_VALUE\",\n            spec.missing,\n            { site: input.site },\n          ),\n          input,\n          reading.instance,\n        );\n      },\n    )();\n    return (target, key, index) => {\n      if (key === undefined) {\n        throw new BetterAuthConfigurationError(\n          \"INVOCATION_PARAM_TARGET\",\n          \"Invocation parameters require a handler method\",\n        );\n      }\n      append(Reflect.get(target, key), tokens.INVOCATION_PARAMS_METADATA, {\n        index,\n        slot,\n        missing: spec.missing,\n      });\n      decorator(target, key, index);\n    };\n  };\n}\nexport interface EndpointHookDeclaration {\n  readonly phase: \"before\" | \"after\";\n  readonly match: string | readonly string[] | HookPredicate | undefined;\n  readonly options: Readonly<HookOptions>;\n  readonly method: string | symbol;\n  // biome-ignore lint/complexity/noBannedTypes: Nest handler metadata preserves the framework function identity.\n  readonly handler: Function;\n  readonly declarationOrder: number;\n}\nexport interface DatabaseHookDeclaration {\n  readonly phase: \"before\" | \"after\";\n  readonly target: DatabaseHookTarget;\n  readonly options: Readonly<DbHookOptions>;\n  readonly method: string | symbol;\n  // biome-ignore lint/complexity/noBannedTypes: Nest handler metadata preserves the framework function identity.\n  readonly handler: Function;\n  readonly declarationOrder: number;\n}\n// biome-ignore lint/complexity/noBannedTypes: Nest handler metadata preserves the framework function identity.\nexport function readHookMetadata(handler: Function): {\n  readonly hooks: readonly EndpointHookDeclaration[];\n  readonly databaseHooks: readonly DatabaseHookDeclaration[];\n} {\n  return {\n    hooks: Reflect.getOwnMetadata(tokens.HOOK_METADATA, handler) ?? [],\n    databaseHooks:\n      Reflect.getOwnMetadata(tokens.DB_HOOK_METADATA, handler) ?? [],\n  };\n}\nfunction hook<P extends string>(\n  phase: \"before\" | \"after\",\n  match?: P | readonly P[] | HookPredicate,\n  options?: HookOptions,\n): HookMethodDecorator<P> {\n  return (_target, method, descriptor) => {\n    const handler = descriptor.value!;\n    const records = readHookMetadata(handler).hooks;\n    append(\n      handler,\n      tokens.HOOK_METADATA,\n      Object.freeze({\n        phase,\n        match: Array.isArray(match) ? Object.freeze([...match]) : match,\n        options: Object.freeze({ ...options }),\n        method,\n        handler,\n        declarationOrder: records.length,\n      }),\n    );\n  };\n}\nexport const BeforeAuth = <const P extends EndpointPath | (string & {})>(\n  match?: P | readonly P[] | HookPredicate,\n  options?: HookOptions,\n): HookMethodDecorator<P> => hook(\"before\", match, options);\nexport const AfterAuth = <const P extends EndpointPath | (string & {})>(\n  match?: P | readonly P[] | HookPredicate,\n  options?: HookOptions,\n): HookMethodDecorator<P> => hook(\"after\", match, options);\nfunction databaseHook<\n  E extends DatabaseHookTarget,\n  Ph extends \"before\" | \"after\",\n>(phase: Ph, target: E, options?: DbHookOptions): DbHookMethodDecorator<E, Ph> {\n  return (_prototype, method, descriptor) => {\n    const handler = descriptor.value!;\n    append(\n      handler,\n      tokens.DB_HOOK_METADATA,\n      Object.freeze({\n        phase,\n        target,\n        options: Object.freeze({ ...options }),\n        method,\n        handler,\n        declarationOrder: readHookMetadata(handler).databaseHooks.length,\n      }),\n    );\n  };\n}\nexport const BeforeDatabase = <E extends DatabaseHookTarget>(\n  target: E,\n  options?: DbHookOptions,\n): DbHookMethodDecorator<E, \"before\"> =>\n  databaseHook(\"before\", target, options);\nexport const AfterDatabase = <E extends DatabaseHookTarget>(\n  target: E,\n  options?: DbHookOptions,\n): DbHookMethodDecorator<E, \"after\"> => databaseHook(\"after\", target, options);\n"],"mappings":";;;;;;;;AAuCA,MAAM,WAAW,OAAO,IAAI,sCAAsC;AAClE,SAAgB,QACd,UACA,GAAG,QACK;CACR,OAAO,KAAK,UAAU,CAAC,UAAU,GAAG,MAAM,CAAC;AAC7C;;AAGA,SAAgB,eACd,KACA,SACa;CACb,MAAM,UAAU,SAAS,WAAW;CACpC,MAAM,YAAY,UAAU,QAAQ,SAAS,MAAM,KAAK,CAAC,CAAC,CAAC,KAAM;CACjE,IAAI,UAAU,QAAQ,IAAI,SAAS,QAAQ;CAG3C,IAAI,CAAC,SAAS;EACZ,0BAAU,IAAI,IAAI;EAClB,OAAO,eAAe,SAAS,UAAU,EAAE,OAAO,QAAQ,CAAC;CAC7D;CACA,IAAI,SAAS,QAAQ,IAAI,SAAS;CAClC,IAAI,CAAC,QAAQ;EACX,yBAAS,IAAI,IAAI;EACjB,QAAQ,IAAI,WAAW,MAAM;CAC/B;CACA,OAAO;AACT;AAEA,IAAa,eAAb,MAA0B;CACxB,WAAoB,IAAIA,iBAAAA,kBAA8B;CACtD,0BAAmB,IAAI,QAA8B;CACrD,6BAAsB,IAAI,IAAiC;CAC3D,4BAAqB,IAAI,QAAwB;CACjD,aAAa;CAEb,IAAO,OAAmB,IAAgB;EACxC,OAAO,KAAK,SAAS,IAAI,OAAO,EAAE;CACpC;CAEA,KAAQ,IAAgB;EACtB,OAAO,KAAK,SAAS,KAAK,EAAE;CAC9B;CAEA,UAAkC;EAChC,OAAO,KAAK,SAAS,SAAS;CAChC;CAEA,SAAS,KAA2B;EAClC,IAAI,QAAQ,KAAK,QAAQ,IAAI,GAAG;EAChC,IAAI,CAAC,OAAO;GACV,QAAQ;IACN,2BAAW,IAAI,IAAI;IACnB,0BAAU,IAAI,IAAI;IAClB,2BAAW,IAAI,IAAI;IACnB,wBAAQ,IAAI,IAAI;IAChB,oCAAoB,IAAI,IAAI;IAC5B,yBAAS,IAAI,IAAI;IACjB,0BAAU,IAAI,IAAI;IAClB,6BAAa,IAAI,IAAI;GACvB;GACA,KAAK,QAAQ,IAAI,KAAK,KAAK;EAC7B;EACA,OAAO;CACT;CAEA,cACE,MACA,OAKA,SAC0B;EAC1B,MAAM,MAAM,QAAQ,MAAM,UAAU,MAAM,WAAW,MAAM,SAAS;EACpE,MAAM,QAAQ,KAAK,SAAS,KAAK,GAAG;EACpC,MAAM,WAAW,MAAM,UAAU,IAAI,GAAG;EACxC,IAAI,UACF,OAAO;EAET,MAAM,aACJ,KAAK,cACL,MAAM,cAAc,oBACnB,KAAK,kBAAkB,KAAK,IACzB,KAAK,SAAS,KAAK,UAAU,CAAC,CAAC,cAC/B,KAAA;EACN,MAAM,SAAS,YAAY,IAAI,GAAG;EAClC,MAAM,UAAU,QAAQ,QAAQ,CAAC,CAAC,KAAK,YAAY;GACjD,IAAI,UAAU,OAAO,YAAY,KAAK,IAAI,GACxC,OAAO,OAAO;GAEhB,YAAY,OAAO,GAAG;GACtB,IAAI;IACF,MAAM,QAAQ,MAAM,QAAQ;IAC5B,IAAI,MAAM,YAAY,YACpB,YAAY,IAAI,KAAK;KACnB;KACA,WAAW,KAAK,IAAI,KAAK,KAAK,kBAAkB;IAClD,CAAC;IAEH,OAAO;GACT,SAAS,OAAO;IACd,YAAY,OAAO,GAAG;IACtB,MAAM;GACR;EACF,CAAC;EACD,MAAM,UAAU,IAAI,KAAK,OAAO;EAChC,OAAO;CACT;CAEA,aACE,SACA,UACA,aACA,SACA,QAAwB,KACZ;EACZ,MAAM,QAAQ,KAAK,SAAS,OAAO;EACnC,MAAM,MAAM,QAAQ,UAAU,WAAW;EACzC,MAAM,WAAW,MAAM,SAAS,IAAI,GAAG;EACvC,IAAI,UACF,OAAO;EAET,IACE,UAAU,SACV,CAAC,GAAG,MAAM,kBAAkB,CAAC,CAAC,QAC3B,UAAU,KAAK,MAAM,KAAK,CAAC,CAAC,OAAO,QACtC,CAAC,CAAC,UAAU,OAEZ,OAAO,QAAQ,OACbC,oBAAAA,aAAa,SAAS;GACpB,QAAQ;GACR,QAAQ;EACV,CAAC,CACH;EAEF,MAAM,mBAAmB,IAAI,GAAG;EAChC,MAAM,UAAU,QAAQ,QAAQ,CAAC,CAAC,KAAK,OAAO;EAC9C,MAAM,SAAS,IAAI,KAAK,OAAO;EAC/B,OAAO;CACT;CAEA,aACE,YACA,UACA,aACA,SACgC;EAChC,MAAM,YAAY,KAAK,SAAS,UAAU,CAAC,CAAC;EAC5C,MAAM,MAAM,QAAQ,UAAU,WAAW;EACzC,IAAI,UAAU,UAAU,IAAI,GAAG;EAC/B,IAAI,CAAC,SAAS;GACZ,UAAU,QAAQ,QAAQ,CAAC,CAAC,KAAK,OAAO;GACxC,UAAU,IAAI,KAAK,OAAO;EAC5B;EACA,OAAO;CACT;CAEA,SAAS,UAAkB,KAAqB;EAC9C,IAAI,OAAO,KAAK,WAAW,IAAI,QAAQ;EACvC,IAAI,CAAC,MAAM;GACT,uBAAO,IAAI,IAAI;GACf,KAAK,WAAW,IAAI,UAAU,IAAI;EACpC;EACA,IAAI,aAAa,KAAK,IAAI,GAAG;EAC7B,IAAI,CAAC,YAAY;GACf,aAAa,OAAO,IAAI,WAAW;GACnC,KAAK,IAAI,KAAK,UAAU;EAC1B;EACA,OAAO;CACT;CAEA,SACE,KACA,OACA,SACS;EACT,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK;EACjC,IAAI,CAAC,IAAI;GACP,KAAK,EAAE,KAAK;GACZ,KAAK,UAAU,IAAI,OAAO,EAAE;EAC9B;EACA,MAAM,SAASC,oBAAAA,qBAAqB,KAAK,IACrC,QAAQ,QAAQ,UAAU,MAAM,MAAM,QAAQ,IAAI,IAClD,SAAS;EACb,MAAM,UAAU,eAAe,KAAK,QAAQ,OAAO;EACnD,MAAM,QACJ,QAAQ,QAAQ,SAAS,UAAU,UAAU,KAAK,SAAS,GAAG,CAAC,CAAC;EAClE,MAAM,WAAW,MAAM,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM;EACxD,MAAM,IAAI,MAAM;EAChB,QAAQ,IAAI,MAAM;EAClB,OAAO;CACT;AACF;;;ACzMA,SAAS,OAAO,QAAgB,KAAa,OAAsB;CACjE,QAAQ,eACN,KACA,OAAO,OAAO,CAAC,GAAI,QAAQ,eAAe,KAAK,MAAM,KAAK,CAAC,GAAI,KAAK,CAAC,GACrE,MACF;AACF;AACA,MAAa,gBAAA,GAAeC,eAAAA,YAAAA,CAAAA,iBAAAA,iBAAoC,QAAQ;AACxE,MAAa,sBAAA,GACXA,eAAAA,YAAAA,CAAAA,iBAAAA,iBAAoC,UAAU;AAChD,MAAa,eAAe,aAAA,GAC1BC,eAAAA,gBAAAA,EAAAA,GACED,eAAAA,YAAAA,CAAAA,iBAAAA,iBAAoC,UAAU,IAAA,GAC9CA,eAAAA,YAAAA,CAAAA,iBAAAA,oBAAuC,SAAS,kBAAkB,IAAI,CACxE;AACF,MAAa,mBAAmB,UAAA,GAC9BA,eAAAA,YAAAA,CAAAA,iBAAAA,wBAA2C,IAAI;AACjD,MAAa,oBACX,GAAG,WAAA,GACAA,eAAAA,YAAAA,CAAAA,iBAAAA,4BAA+C,OAAO,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AAC7E,MAAa,iCAAA,GACXA,eAAAA,YAAAA,CAAAA,iBAAAA,oCAAuD,IAAI;AAC7D,MAAa,sBAAsB,UAAU,UAAA,GAC3CA,eAAAA,YAAAA,CAAAA,iBAAAA,0BAA6C,OAAO;AACtD,MAAa,yBAAA,GACXA,eAAAA,YAAAA,CAAAA,iBAAAA,4BAA+C,IAAI;AACrD,MAAa,uBAAA,GACXC,eAAAA,gBAAAA,EAAAA,GACED,eAAAA,YAAAA,CAAAA,iBAAAA,0BAA6C,IAAI,IAAA,GACjDE,eAAAA,UAAAA,CAAUC,mBAAAA,eAAe,IAAA,GACzBC,eAAAA,gBAAAA,CAAgBC,+BAAAA,0BAA0B,CAC5C;AACF,SAAgB,QACd,GAAG,cAC+B;CAClC,QACE,QACA,MACA,eACG;EACH,KAAK,MAAM,cAAc,cACvB,OACE,YAAY,SAAS,QAAA,iBAAA,uBAErB,UACF;CAEJ;AACF;AACA,MAAa,SACX,GAAG,kBACkB,EAAE,OAAO,aAAa;AAC7C,MAAa,SACX,GAAG,kBACkB,EAAE,OAAO,aAAa;AAC7C,MAAa,eACX,QACA,QACA,aACoB;CAAE;CAAQ;CAAQ,GAAG;AAAQ;AAQnD,SAAgB,cAAc,SAA0C;CACtE,MAAM,OAAO,QAAQ,QAAQ;CAC7B,KAAK,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG;EACjC,KACG,OAAO,QAAQ,YAAY,QAAQ,SACpC,OAAO,QAAQ,YAEf;EAEF,MAAM,SAAS,QAAQ,IAAI,KAAA,iBAAA,cAA0B;EAGrD,IACE,UACA,OAAO,KAAK,WAAW,KAAK,UAC5B,OAAO,KAAK,OAAO,OAAO,UAAU,UAAU,KAAK,MAAM,KACzD,OAAO,YAAY,KAAA,KACnB,OAAO,MAAM,QAAQ,CAAC,EAAE,YAAY,OAAO,SAE3C,OAAO;CAEX;CAEA,MAAM,QAAQ,IAAI,aAAa;CAC/B,OAAO;EAAE;EAAM;EAAO,UAAU,IAAIC,2BAAAA,kBAAkB,KAAK;CAAE;AAC/D;AACA,SAAS,eAAe,MAID;CACrB,MAAM,aAAA,GAAYC,eAAAA,qBAAAA,EACf,OAAgB,YAA8B;EAC7C,MAAM,SAAS,cAAc,OAAO;EACpC,MAAM,QAAQ;GACZ,MAAM,QAAQ,QAAQ;GACtB,MAAM,GAAG,QAAQ,SAAS,CAAC,CAAC,KAAK,GAAG,QAAQ,WAAW,CAAC,CAAC;EAC3D;EACA,MAAM,UACJ,OAAO,YAAY,KAAA,KACnB,OAAO,MAAM,QAAQ,CAAC,EAAE,YAAY,OAAO,UACvC,OAAO,SAAS,QAAQ,IACxB,OAAO,SAAS,KAAK,KAAK;EAChC,OAAO,OAAO,SAAS,QACrB,SACA;GAAE,GAAG;GAAM,MAAM,MAAM;GAAM,SAAS,MAAM,aAAa,MAAM;EAAG,GAClE,KACF;CACF,CACF,CAAC,CAAC;CACF,QAAQ,QAAQ,aAAa,UAAU;EACrC,IAAI,gBAAgB,KAAA,GAClB,MAAM,IAAIC,oBAAAA,6BACR,0BACA,+CACF;EAGF,OADgB,QAAQ,IAAI,QAAQ,WACvB,GAAA,iBAAA,2BAAqC;GAChD;GACA,GAAI,OAAO;IAAE,MAAM,KAAK;IAAM,QAAQ,KAAK;GAAO,IAAI,CAAC;EACzD,CAAC;EACD,UAAU,QAAQ,aAAa,KAAK;CACtC;AACF;AACA,MAAa,yBAA6C,eAAe;AACzE,SAAgB,qBAAiD,MAIpC;CAC3B,aAAa,eAAe,IAAI;AAClC;AACA,SAAgB,sBACd,MACA,MAC0B;CAC1B,aAAa;EACX,MAAM,aAAA,GAAYD,eAAAA,qBAAAA,EACf,OAAgB,YAA8B;GAC7C,MAAM,SAAS,cAAc,OAAO;GACpC,MAAM,QAAQ,OAAO,MAAM,QAAQ;GACnC,MAAM,QAAQ;IACZ,MAAM,QAAQ,QAAQ;IACtB,MAAM,GAAG,QAAQ,SAAS,CAAC,CAAC,KAAK,GAAG,QAAQ,WAAW,CAAC,CAAC;GAC3D;GACA,MAAM,UAAU,OAAO,UACnB,OAAO,SAAS,QAAQ,IACxB,OAAO,SAAS,KAAK,KAAK;GAC9B,MAAM,aAAa,OAAO,OACtB,CAAC,MAAM,KAAK,UAAU,IACtB,CAAC,MAAM,MAAM,GAAG,MAAM,IAAI;GAC9B,KAAK,MAAM,aAAa,YAAY;IAClC,IACE,CAAC,aACA,OAAO,cAAc,YAAY,OAAO,cAAc,YAEvD;IAEF,MAAM,SAAS,QAAQ,IAAI,WAAA,iBAAA,iBAAmC;IAG9D,IAAI,QAAQ,IAAI,QAAQ,QAAQ,CAAC,EAAE,IAAI,IAAI,GACzC,OAAO,OAAO,IAAI,QAAQ,QAAQ,CAAC,CAAE,IAAI,IAAI;GAEjD;GACA,MAAM,OAAO,SAAS,QACpBC,oBAAAA,6BAA6B,UAC3B,uBACA,KAAK,SACL,EAAE,MAAM,MAAM,KAAK,CACrB,GACA,OACA,QAAQ,QACV;EACF,CACF,CAAC,CAAC;EACF,QAAQ,QAAQ,KAAK,UAAU;GAC7B,IAAI,QAAQ,KAAA,GACV,MAAM,IAAIA,oBAAAA,6BACR,2BACA,gDACF;GAEF,OAAO,QAAQ,IAAI,QAAQ,GAAG,GAAA,iBAAA,4BAAsC;IAClE;IACA;IACA,SAAS,KAAK;GAChB,CAAC;GACD,UAAU,QAAQ,KAAK,KAAK;EAC9B;CACF;AACF;AAoBA,SAAgB,iBAAiB,SAG/B;CACA,OAAO;EACL,OAAO,QAAQ,eAAA,iBAAA,eAAqC,OAAO,KAAK,CAAC;EACjE,eACE,QAAQ,eAAA,iBAAA,kBAAwC,OAAO,KAAK,CAAC;CACjE;AACF;AACA,SAAS,KACP,OACA,OACA,SACwB;CACxB,QAAQ,SAAS,QAAQ,eAAe;EACtC,MAAM,UAAU,WAAW;EAC3B,MAAM,UAAU,iBAAiB,OAAO,CAAC,CAAC;EAC1C,OACE,SAAA,iBAAA,eAEA,OAAO,OAAO;GACZ;GACA,OAAO,MAAM,QAAQ,KAAK,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,CAAC,IAAI;GAC1D,SAAS,OAAO,OAAO,EAAE,GAAG,QAAQ,CAAC;GACrC;GACA;GACA,kBAAkB,QAAQ;EAC5B,CAAC,CACH;CACF;AACF;AACA,MAAa,cACX,OACA,YAC2B,KAAK,UAAU,OAAO,OAAO;AAC1D,MAAa,aACX,OACA,YAC2B,KAAK,SAAS,OAAO,OAAO;AACzD,SAAS,aAGP,OAAW,QAAW,SAAuD;CAC7E,QAAQ,YAAY,QAAQ,eAAe;EACzC,MAAM,UAAU,WAAW;EAC3B,OACE,SAAA,iBAAA,kBAEA,OAAO,OAAO;GACZ;GACA;GACA,SAAS,OAAO,OAAO,EAAE,GAAG,QAAQ,CAAC;GACrC;GACA;GACA,kBAAkB,iBAAiB,OAAO,CAAC,CAAC,cAAc;EAC5D,CAAC,CACH;CACF;AACF;AACA,MAAa,kBACX,QACA,YAEA,aAAa,UAAU,QAAQ,OAAO;AACxC,MAAa,iBACX,QACA,YACsC,aAAa,SAAS,QAAQ,OAAO"}
+{"version":3,"file":"auth-decorators-9L-UO_T3.cjs","names":["AsyncLocalStorage","AuthFailures","isConfigurationError","SetMetadata","applyDecorators","UseGuards","BetterAuthGuard","UseInterceptors","BetterAuthScopeInterceptor","PrincipalReadings","createParamDecorator","BetterAuthConfigurationError"],"sources":["../src/request-scope.ts","../src/auth-decorators.ts"],"sourcesContent":["import { AsyncLocalStorage } from \"node:async_hooks\";\nimport type {\n  AuthorizationDecision,\n  InvocationLineage,\n  PrincipalReading,\n  PrincipalResult,\n  RoutePlan,\n  TransportCall,\n} from \"./auth-contracts.js\";\nimport {\n  AuthFailures,\n  type AuthFailure,\n  isConfigurationError,\n} from \"./auth-errors.js\";\nimport type { ScopeView } from \"./bridge-protocol.js\";\n\nexport interface ScopeState {\n  readonly view: ScopeView;\n  readonly call?: TransportCall;\n  readonly plan?: RoutePlan;\n  readonly reading?: () => PrincipalReading;\n}\nexport interface RequestState {\n  readonly principal: Map<string, Promise<PrincipalResult>>;\n  readonly policyIo: Map<string, Promise<unknown>>;\n  readonly decisions: Map<string, Promise<AuthorizationDecision>>;\n  readonly values: Map<symbol, unknown>;\n  readonly authorizationCalls: Set<string>;\n  readonly origins: Map<string, Promise<AuthFailure | null>>;\n  readonly surfaced: Set<string>;\n  readonly connections: Map<\n    string,\n    {\n      value: Extract<PrincipalResult, { outcome: \"authenticated\" | \"absent\" }>;\n      expiresAt: number;\n    }\n  >;\n}\n\nconst SURFACED = Symbol.for(\"nestjs-slightly-better-auth:surfaced\");\nexport function memoKey(\n  instance: string,\n  ...inputs: readonly unknown[]\n): string {\n  return JSON.stringify([instance, ...inputs]);\n}\n\n/** Shared by guards and readers that have only the transport's structural lineage. */\nexport function surfacedRecord(\n  key: object,\n  lineage?: InvocationLineage,\n): Set<string> {\n  const carrier = lineage?.carrier ?? key;\n  const partition = lineage ? lineage.position.split(\":\", 1)[0]! : \"\";\n  let records = Reflect.get(carrier, SURFACED) as\n    | Map<string, Set<string>>\n    | undefined;\n  if (!records) {\n    records = new Map();\n    Object.defineProperty(carrier, SURFACED, { value: records });\n  }\n  let record = records.get(partition);\n  if (!record) {\n    record = new Set();\n    records.set(partition, record);\n  }\n  return record;\n}\n\nexport class RequestScope {\n  readonly #storage = new AsyncLocalStorage<ScopeState>();\n  readonly #states = new WeakMap<object, RequestState>();\n  readonly #valueKeys = new Map<string, Map<symbol, symbol>>();\n  readonly #errorIds = new WeakMap<object, number>();\n  #nextError = 0;\n\n  run<T>(state: ScopeState, fn: () => T): T {\n    return this.#storage.run(state, fn);\n  }\n\n  exit<T>(fn: () => T): T {\n    return this.#storage.exit(fn);\n  }\n\n  current(): ScopeState | undefined {\n    return this.#storage.getStore();\n  }\n\n  stateFor(key: object): RequestState {\n    let state = this.#states.get(key);\n    if (!state) {\n      state = {\n        principal: new Map(),\n        policyIo: new Map(),\n        decisions: new Map(),\n        values: new Map(),\n        authorizationCalls: new Set(),\n        origins: new Map(),\n        surfaced: new Set(),\n        connections: new Map(),\n      };\n      this.#states.set(key, state);\n    }\n    return state;\n  }\n\n  memoPrincipal(\n    call: Pick<TransportCall, \"key\" | \"connection\" | \"principalTtlMs\">,\n    input: {\n      instance: string;\n      freshness: \"default\" | \"authoritative\";\n      sourceSet: string;\n    },\n    compute: () => Promise<PrincipalResult>,\n  ): Promise<PrincipalResult> {\n    const key = memoKey(input.instance, input.freshness, input.sourceSet);\n    const state = this.stateFor(call.key);\n    const existing = state.principal.get(key);\n    if (existing) {\n      return existing;\n    }\n    const connection =\n      call.connection &&\n      input.freshness !== \"authoritative\" &&\n      (call.principalTtlMs ?? 0) > 0\n        ? this.stateFor(call.connection).connections\n        : undefined;\n    const cached = connection?.get(key);\n    const promise = Promise.resolve().then(async () => {\n      if (cached && cached.expiresAt > Date.now()) {\n        return cached.value;\n      }\n      connection?.delete(key);\n      try {\n        const value = await compute();\n        if (value.outcome !== \"rejected\") {\n          connection?.set(key, {\n            value,\n            expiresAt: Date.now() + (call.principalTtlMs ?? 0),\n          });\n        }\n        return value;\n      } catch (error) {\n        connection?.delete(key);\n        throw error;\n      }\n    });\n    state.principal.set(key, promise);\n    return promise;\n  }\n\n  memoPolicyIo<T>(\n    request: object,\n    instance: string,\n    concreteKey: string,\n    compute: () => Promise<T>,\n    limit: number | false = 100,\n  ): Promise<T> {\n    const state = this.stateFor(request);\n    const key = memoKey(instance, concreteKey);\n    const existing = state.policyIo.get(key);\n    if (existing) {\n      return existing as Promise<T>;\n    }\n    if (\n      limit !== false &&\n      [...state.authorizationCalls].filter(\n        (entry) => JSON.parse(entry)[0] === instance,\n      ).length >= limit\n    ) {\n      return Promise.reject(\n        AuthFailures.rejected({\n          status: 429,\n          reason: \"TOO_MANY_AUTHORIZATION_CHECKS\",\n        }),\n      );\n    }\n    state.authorizationCalls.add(key);\n    const promise = Promise.resolve().then(compute);\n    state.policyIo.set(key, promise);\n    return promise;\n  }\n\n  memoDecision(\n    invocation: object,\n    instance: string,\n    concreteKey: string,\n    compute: () => Promise<AuthorizationDecision>,\n  ): Promise<AuthorizationDecision> {\n    const decisions = this.stateFor(invocation).decisions;\n    const key = memoKey(instance, concreteKey);\n    let promise = decisions.get(key);\n    if (!promise) {\n      promise = Promise.resolve().then(compute);\n      decisions.set(key, promise);\n    }\n    return promise;\n  }\n\n  valueKey(instance: string, key: symbol): symbol {\n    let keys = this.#valueKeys.get(instance);\n    if (!keys) {\n      keys = new Map();\n      this.#valueKeys.set(instance, keys);\n    }\n    let namespaced = keys.get(key);\n    if (!namespaced) {\n      namespaced = Symbol(key.description);\n      keys.set(key, namespaced);\n    }\n    return namespaced;\n  }\n\n  surfaced(\n    key: object,\n    error: object,\n    context: { instance: string; site: string; lineage?: InvocationLineage },\n  ): boolean {\n    let id = this.#errorIds.get(error);\n    if (!id) {\n      id = ++this.#nextError;\n      this.#errorIds.set(error, id);\n    }\n    const reason = isConfigurationError(error)\n      ? memoKey(context.instance, error.code, context.site)\n      : `error:${id}`;\n    const carrier = surfacedRecord(key, context.lineage);\n    const state =\n      key === context.lineage?.carrier ? carrier : this.stateFor(key).surfaced;\n    const repeated = state.has(reason) || carrier.has(reason);\n    state.add(reason);\n    carrier.add(reason);\n    return repeated;\n  }\n}\n","import {\n  applyDecorators,\n  createParamDecorator,\n  SetMetadata,\n  UseGuards,\n  UseInterceptors,\n  type ExecutionContext,\n} from \"@nestjs/common\";\nimport type {\n  DatabaseHookTarget,\n  DbHookMethodDecorator,\n  DbHookOptions,\n  HookMethodDecorator,\n  HookOptions,\n  HookPredicate,\n  PolicyRef,\n  PrincipalReading,\n  Requirement,\n  RequirementExpr,\n  RequirementOptions,\n} from \"./auth-contracts.js\";\nimport type {\n  EndpointPath,\n  PrincipalKind,\n  PrincipalOfKind,\n} from \"./auth-types.js\";\nimport { BetterAuthConfigurationError } from \"./auth-errors.js\";\nimport * as tokens from \"./auth-tokens.js\";\nimport { BetterAuthGuard } from \"./auth-guard.js\";\nimport { BetterAuthScopeInterceptor } from \"./auth-scope-interceptor.js\";\nimport { PrincipalReadings } from \"./principal-readings.js\";\nimport { RequestScope } from \"./request-scope.js\";\n\nfunction append(target: object, key: symbol, value: unknown): void {\n  Reflect.defineMetadata(\n    key,\n    Object.freeze([...(Reflect.getOwnMetadata(key, target) ?? []), value]),\n    target,\n  );\n}\nexport const Public = () => SetMetadata(tokens.ACCESS_METADATA, \"public\");\nexport const OptionalAuth = () =>\n  SetMetadata(tokens.ACCESS_METADATA, \"optional\");\nexport const RequireAuth = (options?: { authoritative?: boolean }) =>\n  applyDecorators(\n    SetMetadata(tokens.ACCESS_METADATA, \"required\"),\n    SetMetadata(tokens.FRESHNESS_METADATA, options?.authoritative === true),\n  );\nexport const UseAuthInstance = (name: string) =>\n  SetMetadata(tokens.AUTH_INSTANCE_METADATA, name);\nexport const AcceptPrincipals = (\n  ...kinds: readonly [PrincipalKind, ...PrincipalKind[]]\n) => SetMetadata(tokens.ACCEPT_PRINCIPALS_METADATA, Object.freeze([...kinds]));\nexport const SkipDefaultRequirements = () =>\n  SetMetadata(tokens.SKIP_DEFAULT_REQUIREMENTS_METADATA, true);\nexport const ForwardAuthCookies = (enabled = true) =>\n  SetMetadata(tokens.FORWARD_COOKIES_METADATA, enabled);\nexport const SkipOriginCheck = () =>\n  SetMetadata(tokens.SKIP_ORIGIN_CHECK_METADATA, true);\nexport const UseBetterAuth = () =>\n  applyDecorators(\n    SetMetadata(tokens.USE_BETTER_AUTH_METADATA, true),\n    UseGuards(BetterAuthGuard),\n    UseInterceptors(BetterAuthScopeInterceptor),\n  );\nexport function Require(\n  ...requirements: readonly RequirementExpr[]\n): ClassDecorator & MethodDecorator {\n  return (\n    target: object,\n    _key?: string | symbol,\n    descriptor?: PropertyDescriptor,\n  ) => {\n    for (const expression of requirements) {\n      append(\n        descriptor?.value ?? target,\n        tokens.REQUIREMENTS_METADATA,\n        expression,\n      );\n    }\n  };\n}\nexport const anyOf = (\n  ...requirements: readonly RequirementExpr[]\n): RequirementExpr => ({ anyOf: requirements });\nexport const allOf = (\n  ...requirements: readonly RequirementExpr[]\n): RequirementExpr => ({ allOf: requirements });\nexport const requirement = <P>(\n  policy: PolicyRef<P>,\n  params: P,\n  options?: RequirementOptions,\n): Requirement<P> => ({ policy, params, ...options });\n\nexport interface ReaderContext {\n  readonly args: readonly unknown[];\n  readonly readings: PrincipalReadings;\n  readonly scope: RequestScope;\n  readonly reading?: () => PrincipalReading;\n}\nexport function readerContext(context: ExecutionContext): ReaderContext {\n  const args = context.getArgs();\n  for (const arg of [args, ...args]) {\n    if (\n      (typeof arg !== \"object\" || arg === null) &&\n      typeof arg !== \"function\"\n    ) {\n      continue;\n    }\n    const bridge = Reflect.get(arg, tokens.READER_CONTEXT) as\n      | ReaderContext\n      | undefined;\n    if (\n      bridge &&\n      bridge.args.length === args.length &&\n      bridge.args.every((value, index) => value === args[index]) &&\n      bridge.reading !== undefined &&\n      bridge.scope.current()?.reading === bridge.reading\n    ) {\n      return bridge;\n    }\n  }\n  // No application state is created or retained by a DI-free lineage-only reader.\n  const scope = new RequestScope();\n  return { args, scope, readings: new PrincipalReadings(scope) };\n}\nfunction principalParam(spec?: {\n  kind: string;\n  reason: string;\n  project: (p: any) => unknown;\n}): ParameterDecorator {\n  const decorator = createParamDecorator(\n    (_data: unknown, context: ExecutionContext) => {\n      const bridge = readerContext(context);\n      const input = {\n        args: context.getArgs(),\n        site: `${context.getClass().name}.${context.getHandler().name}`,\n      };\n      const reading =\n        bridge.reading !== undefined &&\n        bridge.scope.current()?.reading === bridge.reading\n          ? bridge.readings.current()\n          : bridge.readings.read(input);\n      return bridge.readings.project(\n        reading,\n        { ...spec, site: input.site, project: spec?.project ?? ((p) => p) },\n        input,\n      );\n    },\n  )();\n  return (target, propertyKey, index) => {\n    if (propertyKey === undefined) {\n      throw new BetterAuthConfigurationError(\n        \"PRINCIPAL_PARAM_TARGET\",\n        \"Principal parameters require a handler method\",\n      );\n    }\n    const handler = Reflect.get(target, propertyKey);\n    append(handler, tokens.PRINCIPAL_PARAMS_METADATA, {\n      index,\n      ...(spec ? { kind: spec.kind, reason: spec.reason } : {}),\n    });\n    decorator(target, propertyKey, index);\n  };\n}\nexport const CurrentPrincipal = (): ParameterDecorator => principalParam();\nexport function definePrincipalParam<K extends PrincipalKind, R>(spec: {\n  readonly kind: K;\n  readonly reason: string;\n  readonly project: (principal: PrincipalOfKind<K>) => R;\n}): () => ParameterDecorator {\n  return () => principalParam(spec);\n}\nexport function defineInvocationParam(\n  slot: symbol,\n  spec: { readonly missing: string },\n): () => ParameterDecorator {\n  return () => {\n    const decorator = createParamDecorator(\n      (_data: unknown, context: ExecutionContext) => {\n        const bridge = readerContext(context);\n        const state = bridge.scope.current();\n        const input = {\n          args: context.getArgs(),\n          site: `${context.getClass().name}.${context.getHandler().name}`,\n        };\n        const reading = state?.reading\n          ? bridge.readings.current()\n          : bridge.readings.read(input);\n        const candidates = state?.call\n          ? [state.call.invocation]\n          : [input.args, ...input.args];\n        for (const candidate of candidates) {\n          if (\n            !candidate ||\n            (typeof candidate !== \"object\" && typeof candidate !== \"function\")\n          ) {\n            continue;\n          }\n          const values = Reflect.get(candidate, tokens.INVOCATION_VALUES) as\n            | Map<string, Map<symbol, unknown>>\n            | undefined;\n          if (values?.get(reading.instance)?.has(slot)) {\n            return values.get(reading.instance)!.get(slot);\n          }\n        }\n        throw bridge.readings.deliver(\n          BetterAuthConfigurationError.atRequest(\n            \"NO_INVOCATION_VALUE\",\n            spec.missing,\n            { site: input.site },\n          ),\n          input,\n          reading.instance,\n        );\n      },\n    )();\n    return (target, key, index) => {\n      if (key === undefined) {\n        throw new BetterAuthConfigurationError(\n          \"INVOCATION_PARAM_TARGET\",\n          \"Invocation parameters require a handler method\",\n        );\n      }\n      append(Reflect.get(target, key), tokens.INVOCATION_PARAMS_METADATA, {\n        index,\n        slot,\n        missing: spec.missing,\n      });\n      decorator(target, key, index);\n    };\n  };\n}\nexport interface EndpointHookDeclaration {\n  readonly phase: \"before\" | \"after\";\n  readonly match: string | readonly string[] | HookPredicate | undefined;\n  readonly options: Readonly<HookOptions>;\n  readonly method: string | symbol;\n  // biome-ignore lint/complexity/noBannedTypes: Nest handler metadata preserves the framework function identity.\n  readonly handler: Function;\n  readonly declarationOrder: number;\n}\nexport interface DatabaseHookDeclaration {\n  readonly phase: \"before\" | \"after\";\n  readonly target: DatabaseHookTarget;\n  readonly options: Readonly<DbHookOptions>;\n  readonly method: string | symbol;\n  // biome-ignore lint/complexity/noBannedTypes: Nest handler metadata preserves the framework function identity.\n  readonly handler: Function;\n  readonly declarationOrder: number;\n}\n// biome-ignore lint/complexity/noBannedTypes: Nest handler metadata preserves the framework function identity.\nexport function readHookMetadata(handler: Function): {\n  readonly hooks: readonly EndpointHookDeclaration[];\n  readonly databaseHooks: readonly DatabaseHookDeclaration[];\n} {\n  return {\n    hooks: Reflect.getOwnMetadata(tokens.HOOK_METADATA, handler) ?? [],\n    databaseHooks:\n      Reflect.getOwnMetadata(tokens.DB_HOOK_METADATA, handler) ?? [],\n  };\n}\nfunction hook<P extends string>(\n  phase: \"before\" | \"after\",\n  match?: P | readonly P[] | HookPredicate,\n  options?: HookOptions,\n): HookMethodDecorator<P> {\n  return (_target, method, descriptor) => {\n    const handler = descriptor.value!;\n    const records = readHookMetadata(handler).hooks;\n    append(\n      handler,\n      tokens.HOOK_METADATA,\n      Object.freeze({\n        phase,\n        match: Array.isArray(match) ? Object.freeze([...match]) : match,\n        options: Object.freeze({ ...options }),\n        method,\n        handler,\n        declarationOrder: records.length,\n      }),\n    );\n  };\n}\nexport const BeforeAuth = <const P extends EndpointPath | (string & {})>(\n  match?: P | readonly P[] | HookPredicate,\n  options?: HookOptions,\n): HookMethodDecorator<P> => hook(\"before\", match, options);\nexport const AfterAuth = <const P extends EndpointPath | (string & {})>(\n  match?: P | readonly P[] | HookPredicate,\n  options?: HookOptions,\n): HookMethodDecorator<P> => hook(\"after\", match, options);\nfunction databaseHook<\n  E extends DatabaseHookTarget,\n  Ph extends \"before\" | \"after\",\n>(phase: Ph, target: E, options?: DbHookOptions): DbHookMethodDecorator<E, Ph> {\n  return (_prototype, method, descriptor) => {\n    const handler = descriptor.value!;\n    append(\n      handler,\n      tokens.DB_HOOK_METADATA,\n      Object.freeze({\n        phase,\n        target,\n        options: Object.freeze({ ...options }),\n        method,\n        handler,\n        declarationOrder: readHookMetadata(handler).databaseHooks.length,\n      }),\n    );\n  };\n}\nexport const BeforeDatabase = <E extends DatabaseHookTarget>(\n  target: E,\n  options?: DbHookOptions,\n): DbHookMethodDecorator<E, \"before\"> =>\n  databaseHook(\"before\", target, options);\nexport const AfterDatabase = <E extends DatabaseHookTarget>(\n  target: E,\n  options?: DbHookOptions,\n): DbHookMethodDecorator<E, \"after\"> => databaseHook(\"after\", target, options);\n"],"mappings":";;;;;;;;AAuCA,MAAM,WAAW,OAAO,IAAI,sCAAsC;AAClE,SAAgB,QACd,UACA,GAAG,QACK;CACR,OAAO,KAAK,UAAU,CAAC,UAAU,GAAG,MAAM,CAAC;AAC7C;;AAGA,SAAgB,eACd,KACA,SACa;CACb,MAAM,UAAU,SAAS,WAAW;CACpC,MAAM,YAAY,UAAU,QAAQ,SAAS,MAAM,KAAK,CAAC,CAAC,CAAC,KAAM;CACjE,IAAI,UAAU,QAAQ,IAAI,SAAS,QAAQ;CAG3C,IAAI,CAAC,SAAS;EACZ,0BAAU,IAAI,IAAI;EAClB,OAAO,eAAe,SAAS,UAAU,EAAE,OAAO,QAAQ,CAAC;CAC7D;CACA,IAAI,SAAS,QAAQ,IAAI,SAAS;CAClC,IAAI,CAAC,QAAQ;EACX,yBAAS,IAAI,IAAI;EACjB,QAAQ,IAAI,WAAW,MAAM;CAC/B;CACA,OAAO;AACT;AAEA,IAAa,eAAb,MAA0B;CACxB,WAAoB,IAAIA,iBAAAA,kBAA8B;CACtD,0BAAmB,IAAI,QAA8B;CACrD,6BAAsB,IAAI,IAAiC;CAC3D,4BAAqB,IAAI,QAAwB;CACjD,aAAa;CAEb,IAAO,OAAmB,IAAgB;EACxC,OAAO,KAAK,SAAS,IAAI,OAAO,EAAE;CACpC;CAEA,KAAQ,IAAgB;EACtB,OAAO,KAAK,SAAS,KAAK,EAAE;CAC9B;CAEA,UAAkC;EAChC,OAAO,KAAK,SAAS,SAAS;CAChC;CAEA,SAAS,KAA2B;EAClC,IAAI,QAAQ,KAAK,QAAQ,IAAI,GAAG;EAChC,IAAI,CAAC,OAAO;GACV,QAAQ;IACN,2BAAW,IAAI,IAAI;IACnB,0BAAU,IAAI,IAAI;IAClB,2BAAW,IAAI,IAAI;IACnB,wBAAQ,IAAI,IAAI;IAChB,oCAAoB,IAAI,IAAI;IAC5B,yBAAS,IAAI,IAAI;IACjB,0BAAU,IAAI,IAAI;IAClB,6BAAa,IAAI,IAAI;GACvB;GACA,KAAK,QAAQ,IAAI,KAAK,KAAK;EAC7B;EACA,OAAO;CACT;CAEA,cACE,MACA,OAKA,SAC0B;EAC1B,MAAM,MAAM,QAAQ,MAAM,UAAU,MAAM,WAAW,MAAM,SAAS;EACpE,MAAM,QAAQ,KAAK,SAAS,KAAK,GAAG;EACpC,MAAM,WAAW,MAAM,UAAU,IAAI,GAAG;EACxC,IAAI,UACF,OAAO;EAET,MAAM,aACJ,KAAK,cACL,MAAM,cAAc,oBACnB,KAAK,kBAAkB,KAAK,IACzB,KAAK,SAAS,KAAK,UAAU,CAAC,CAAC,cAC/B,KAAA;EACN,MAAM,SAAS,YAAY,IAAI,GAAG;EAClC,MAAM,UAAU,QAAQ,QAAQ,CAAC,CAAC,KAAK,YAAY;GACjD,IAAI,UAAU,OAAO,YAAY,KAAK,IAAI,GACxC,OAAO,OAAO;GAEhB,YAAY,OAAO,GAAG;GACtB,IAAI;IACF,MAAM,QAAQ,MAAM,QAAQ;IAC5B,IAAI,MAAM,YAAY,YACpB,YAAY,IAAI,KAAK;KACnB;KACA,WAAW,KAAK,IAAI,KAAK,KAAK,kBAAkB;IAClD,CAAC;IAEH,OAAO;GACT,SAAS,OAAO;IACd,YAAY,OAAO,GAAG;IACtB,MAAM;GACR;EACF,CAAC;EACD,MAAM,UAAU,IAAI,KAAK,OAAO;EAChC,OAAO;CACT;CAEA,aACE,SACA,UACA,aACA,SACA,QAAwB,KACZ;EACZ,MAAM,QAAQ,KAAK,SAAS,OAAO;EACnC,MAAM,MAAM,QAAQ,UAAU,WAAW;EACzC,MAAM,WAAW,MAAM,SAAS,IAAI,GAAG;EACvC,IAAI,UACF,OAAO;EAET,IACE,UAAU,SACV,CAAC,GAAG,MAAM,kBAAkB,CAAC,CAAC,QAC3B,UAAU,KAAK,MAAM,KAAK,CAAC,CAAC,OAAO,QACtC,CAAC,CAAC,UAAU,OAEZ,OAAO,QAAQ,OACbC,oBAAAA,aAAa,SAAS;GACpB,QAAQ;GACR,QAAQ;EACV,CAAC,CACH;EAEF,MAAM,mBAAmB,IAAI,GAAG;EAChC,MAAM,UAAU,QAAQ,QAAQ,CAAC,CAAC,KAAK,OAAO;EAC9C,MAAM,SAAS,IAAI,KAAK,OAAO;EAC/B,OAAO;CACT;CAEA,aACE,YACA,UACA,aACA,SACgC;EAChC,MAAM,YAAY,KAAK,SAAS,UAAU,CAAC,CAAC;EAC5C,MAAM,MAAM,QAAQ,UAAU,WAAW;EACzC,IAAI,UAAU,UAAU,IAAI,GAAG;EAC/B,IAAI,CAAC,SAAS;GACZ,UAAU,QAAQ,QAAQ,CAAC,CAAC,KAAK,OAAO;GACxC,UAAU,IAAI,KAAK,OAAO;EAC5B;EACA,OAAO;CACT;CAEA,SAAS,UAAkB,KAAqB;EAC9C,IAAI,OAAO,KAAK,WAAW,IAAI,QAAQ;EACvC,IAAI,CAAC,MAAM;GACT,uBAAO,IAAI,IAAI;GACf,KAAK,WAAW,IAAI,UAAU,IAAI;EACpC;EACA,IAAI,aAAa,KAAK,IAAI,GAAG;EAC7B,IAAI,CAAC,YAAY;GACf,aAAa,OAAO,IAAI,WAAW;GACnC,KAAK,IAAI,KAAK,UAAU;EAC1B;EACA,OAAO;CACT;CAEA,SACE,KACA,OACA,SACS;EACT,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK;EACjC,IAAI,CAAC,IAAI;GACP,KAAK,EAAE,KAAK;GACZ,KAAK,UAAU,IAAI,OAAO,EAAE;EAC9B;EACA,MAAM,SAASC,oBAAAA,qBAAqB,KAAK,IACrC,QAAQ,QAAQ,UAAU,MAAM,MAAM,QAAQ,IAAI,IAClD,SAAS;EACb,MAAM,UAAU,eAAe,KAAK,QAAQ,OAAO;EACnD,MAAM,QACJ,QAAQ,QAAQ,SAAS,UAAU,UAAU,KAAK,SAAS,GAAG,CAAC,CAAC;EAClE,MAAM,WAAW,MAAM,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM;EACxD,MAAM,IAAI,MAAM;EAChB,QAAQ,IAAI,MAAM;EAClB,OAAO;CACT;AACF;;;ACzMA,SAAS,OAAO,QAAgB,KAAa,OAAsB;CACjE,QAAQ,eACN,KACA,OAAO,OAAO,CAAC,GAAI,QAAQ,eAAe,KAAK,MAAM,KAAK,CAAC,GAAI,KAAK,CAAC,GACrE,MACF;AACF;AACA,MAAa,gBAAA,GAAeC,eAAAA,YAAAA,CAAAA,iBAAAA,iBAAoC,QAAQ;AACxE,MAAa,sBAAA,GACXA,eAAAA,YAAAA,CAAAA,iBAAAA,iBAAoC,UAAU;AAChD,MAAa,eAAe,aAAA,GAC1BC,eAAAA,gBAAAA,EAAAA,GACED,eAAAA,YAAAA,CAAAA,iBAAAA,iBAAoC,UAAU,IAAA,GAC9CA,eAAAA,YAAAA,CAAAA,iBAAAA,oBAAuC,SAAS,kBAAkB,IAAI,CACxE;AACF,MAAa,mBAAmB,UAAA,GAC9BA,eAAAA,YAAAA,CAAAA,iBAAAA,wBAA2C,IAAI;AACjD,MAAa,oBACX,GAAG,WAAA,GACAA,eAAAA,YAAAA,CAAAA,iBAAAA,4BAA+C,OAAO,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AAC7E,MAAa,iCAAA,GACXA,eAAAA,YAAAA,CAAAA,iBAAAA,oCAAuD,IAAI;AAC7D,MAAa,sBAAsB,UAAU,UAAA,GAC3CA,eAAAA,YAAAA,CAAAA,iBAAAA,0BAA6C,OAAO;AACtD,MAAa,yBAAA,GACXA,eAAAA,YAAAA,CAAAA,iBAAAA,4BAA+C,IAAI;AACrD,MAAa,uBAAA,GACXC,eAAAA,gBAAAA,EAAAA,GACED,eAAAA,YAAAA,CAAAA,iBAAAA,0BAA6C,IAAI,IAAA,GACjDE,eAAAA,UAAAA,CAAUC,mBAAAA,eAAe,IAAA,GACzBC,eAAAA,gBAAAA,CAAgBC,+BAAAA,0BAA0B,CAC5C;AACF,SAAgB,QACd,GAAG,cAC+B;CAClC,QACE,QACA,MACA,eACG;EACH,KAAK,MAAM,cAAc,cACvB,OACE,YAAY,SAAS,QAAA,iBAAA,uBAErB,UACF;CAEJ;AACF;AACA,MAAa,SACX,GAAG,kBACkB,EAAE,OAAO,aAAa;AAC7C,MAAa,SACX,GAAG,kBACkB,EAAE,OAAO,aAAa;AAC7C,MAAa,eACX,QACA,QACA,aACoB;CAAE;CAAQ;CAAQ,GAAG;AAAQ;AAQnD,SAAgB,cAAc,SAA0C;CACtE,MAAM,OAAO,QAAQ,QAAQ;CAC7B,KAAK,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG;EACjC,KACG,OAAO,QAAQ,YAAY,QAAQ,SACpC,OAAO,QAAQ,YAEf;EAEF,MAAM,SAAS,QAAQ,IAAI,KAAA,iBAAA,cAA0B;EAGrD,IACE,UACA,OAAO,KAAK,WAAW,KAAK,UAC5B,OAAO,KAAK,OAAO,OAAO,UAAU,UAAU,KAAK,MAAM,KACzD,OAAO,YAAY,KAAA,KACnB,OAAO,MAAM,QAAQ,CAAC,EAAE,YAAY,OAAO,SAE3C,OAAO;CAEX;CAEA,MAAM,QAAQ,IAAI,aAAa;CAC/B,OAAO;EAAE;EAAM;EAAO,UAAU,IAAIC,2BAAAA,kBAAkB,KAAK;CAAE;AAC/D;AACA,SAAS,eAAe,MAID;CACrB,MAAM,aAAA,GAAYC,eAAAA,qBAAAA,EACf,OAAgB,YAA8B;EAC7C,MAAM,SAAS,cAAc,OAAO;EACpC,MAAM,QAAQ;GACZ,MAAM,QAAQ,QAAQ;GACtB,MAAM,GAAG,QAAQ,SAAS,CAAC,CAAC,KAAK,GAAG,QAAQ,WAAW,CAAC,CAAC;EAC3D;EACA,MAAM,UACJ,OAAO,YAAY,KAAA,KACnB,OAAO,MAAM,QAAQ,CAAC,EAAE,YAAY,OAAO,UACvC,OAAO,SAAS,QAAQ,IACxB,OAAO,SAAS,KAAK,KAAK;EAChC,OAAO,OAAO,SAAS,QACrB,SACA;GAAE,GAAG;GAAM,MAAM,MAAM;GAAM,SAAS,MAAM,aAAa,MAAM;EAAG,GAClE,KACF;CACF,CACF,CAAC,CAAC;CACF,QAAQ,QAAQ,aAAa,UAAU;EACrC,IAAI,gBAAgB,KAAA,GAClB,MAAM,IAAIC,oBAAAA,6BACR,0BACA,+CACF;EAGF,OADgB,QAAQ,IAAI,QAAQ,WACvB,GAAA,iBAAA,2BAAqC;GAChD;GACA,GAAI,OAAO;IAAE,MAAM,KAAK;IAAM,QAAQ,KAAK;GAAO,IAAI,CAAC;EACzD,CAAC;EACD,UAAU,QAAQ,aAAa,KAAK;CACtC;AACF;AACA,MAAa,yBAA6C,eAAe;AACzE,SAAgB,qBAAiD,MAIpC;CAC3B,aAAa,eAAe,IAAI;AAClC;AACA,SAAgB,sBACd,MACA,MAC0B;CAC1B,aAAa;EACX,MAAM,aAAA,GAAYD,eAAAA,qBAAAA,EACf,OAAgB,YAA8B;GAC7C,MAAM,SAAS,cAAc,OAAO;GACpC,MAAM,QAAQ,OAAO,MAAM,QAAQ;GACnC,MAAM,QAAQ;IACZ,MAAM,QAAQ,QAAQ;IACtB,MAAM,GAAG,QAAQ,SAAS,CAAC,CAAC,KAAK,GAAG,QAAQ,WAAW,CAAC,CAAC;GAC3D;GACA,MAAM,UAAU,OAAO,UACnB,OAAO,SAAS,QAAQ,IACxB,OAAO,SAAS,KAAK,KAAK;GAC9B,MAAM,aAAa,OAAO,OACtB,CAAC,MAAM,KAAK,UAAU,IACtB,CAAC,MAAM,MAAM,GAAG,MAAM,IAAI;GAC9B,KAAK,MAAM,aAAa,YAAY;IAClC,IACE,CAAC,aACA,OAAO,cAAc,YAAY,OAAO,cAAc,YAEvD;IAEF,MAAM,SAAS,QAAQ,IAAI,WAAA,iBAAA,iBAAmC;IAG9D,IAAI,QAAQ,IAAI,QAAQ,QAAQ,CAAC,EAAE,IAAI,IAAI,GACzC,OAAO,OAAO,IAAI,QAAQ,QAAQ,CAAC,CAAE,IAAI,IAAI;GAEjD;GACA,MAAM,OAAO,SAAS,QACpBC,oBAAAA,6BAA6B,UAC3B,uBACA,KAAK,SACL,EAAE,MAAM,MAAM,KAAK,CACrB,GACA,OACA,QAAQ,QACV;EACF,CACF,CAAC,CAAC;EACF,QAAQ,QAAQ,KAAK,UAAU;GAC7B,IAAI,QAAQ,KAAA,GACV,MAAM,IAAIA,oBAAAA,6BACR,2BACA,gDACF;GAEF,OAAO,QAAQ,IAAI,QAAQ,GAAG,GAAA,iBAAA,4BAAsC;IAClE;IACA;IACA,SAAS,KAAK;GAChB,CAAC;GACD,UAAU,QAAQ,KAAK,KAAK;EAC9B;CACF;AACF;AAoBA,SAAgB,iBAAiB,SAG/B;CACA,OAAO;EACL,OAAO,QAAQ,eAAA,iBAAA,eAAqC,OAAO,KAAK,CAAC;EACjE,eACE,QAAQ,eAAA,iBAAA,kBAAwC,OAAO,KAAK,CAAC;CACjE;AACF;AACA,SAAS,KACP,OACA,OACA,SACwB;CACxB,QAAQ,SAAS,QAAQ,eAAe;EACtC,MAAM,UAAU,WAAW;EAC3B,MAAM,UAAU,iBAAiB,OAAO,CAAC,CAAC;EAC1C,OACE,SAAA,iBAAA,eAEA,OAAO,OAAO;GACZ;GACA,OAAO,MAAM,QAAQ,KAAK,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,CAAC,IAAI;GAC1D,SAAS,OAAO,OAAO,EAAE,GAAG,QAAQ,CAAC;GACrC;GACA;GACA,kBAAkB,QAAQ;EAC5B,CAAC,CACH;CACF;AACF;AACA,MAAa,cACX,OACA,YAC2B,KAAK,UAAU,OAAO,OAAO;AAC1D,MAAa,aACX,OACA,YAC2B,KAAK,SAAS,OAAO,OAAO;AACzD,SAAS,aAGP,OAAW,QAAW,SAAuD;CAC7E,QAAQ,YAAY,QAAQ,eAAe;EACzC,MAAM,UAAU,WAAW;EAC3B,OACE,SAAA,iBAAA,kBAEA,OAAO,OAAO;GACZ;GACA;GACA,SAAS,OAAO,OAAO,EAAE,GAAG,QAAQ,CAAC;GACrC;GACA;GACA,kBAAkB,iBAAiB,OAAO,CAAC,CAAC,cAAc;EAC5D,CAAC,CACH;CACF;AACF;AACA,MAAa,kBACX,QACA,YAEA,aAAa,UAAU,QAAQ,OAAO;AACxC,MAAa,iBACX,QACA,YACsC,aAAa,SAAS,QAAQ,OAAO"}

package/dist/{auth-decorators-DUmQ-n_w.mjs → auth-decorators-CQYu3gaF.mjs}

@@ -1,7 +1,7 @@
 import { c as isConfigurationError, n as BetterAuthConfigurationError, t as AuthFailures } from "./auth-errors-B6jLBpQu.mjs";
-import { C as READER_CONTEXT, M as USE_BETTER_AUTH_METADATA, O as SKIP_DEFAULT_REQUIREMENTS_METADATA, T as REQUIREMENTS_METADATA, a as ACCESS_METADATA, b as PRINCIPAL_PARAMS_METADATA, c as DB_HOOK_METADATA, f as HOOK_METADATA, h as INVOCATION_VALUES, i as ACCEPT_PRINCIPALS_METADATA, k as SKIP_ORIGIN_CHECK_METADATA, l as FORWARD_COOKIES_METADATA, m as INVOCATION_PARAMS_METADATA, s as AUTH_INSTANCE_METADATA, u as FRESHNESS_METADATA } from "./decorate-YZjmlv7t.mjs";
-import { t as BetterAuthScopeInterceptor } from "./auth-scope-interceptor-ctnmljij.mjs";
-import { t as BetterAuthGuard } from "./auth-guard-D4tzhp9u.mjs";
+import { C as READER_CONTEXT, M as USE_BETTER_AUTH_METADATA, O as SKIP_DEFAULT_REQUIREMENTS_METADATA, T as REQUIREMENTS_METADATA, a as ACCESS_METADATA, b as PRINCIPAL_PARAMS_METADATA, c as DB_HOOK_METADATA, f as HOOK_METADATA, h as INVOCATION_VALUES, i as ACCEPT_PRINCIPALS_METADATA, k as SKIP_ORIGIN_CHECK_METADATA, l as FORWARD_COOKIES_METADATA, m as INVOCATION_PARAMS_METADATA, s as AUTH_INSTANCE_METADATA, u as FRESHNESS_METADATA } from "./decorate-DqI1OKmL.mjs";
+import { t as BetterAuthScopeInterceptor } from "./auth-scope-interceptor-C0NRu4uy.mjs";
+import { t as BetterAuthGuard } from "./auth-guard-CXsQR7Zd.mjs";
 import { t as PrincipalReadings } from "./principal-readings-O66hlCdW.mjs";
 import { SetMetadata, UseGuards, UseInterceptors, applyDecorators, createParamDecorator } from "@nestjs/common";
 import { AsyncLocalStorage } from "node:async_hooks";
@@ -274,4 +274,4 @@ const AfterDatabase = (target, options) => databaseHook("after", target, options
 //#endregion
 export { memoKey as C, RequestScope as S, anyOf as _, BeforeDatabase as a, readHookMetadata as b, OptionalAuth as c, RequireAuth as d, SkipDefaultRequirements as f, allOf as g, UseBetterAuth as h, BeforeAuth as i, Public as l, UseAuthInstance as m, AfterAuth as n, CurrentPrincipal as o, SkipOriginCheck as p, AfterDatabase as r, ForwardAuthCookies as s, AcceptPrincipals as t, Require as u, defineInvocationParam as v, requirement as x, definePrincipalParam as y };
 
-//# sourceMappingURL=auth-decorators-DUmQ-n_w.mjs.map
+//# sourceMappingURL=auth-decorators-CQYu3gaF.mjs.map