nestjs-slightly-better-auth 1.5.0 → 1.5.2

package/README.md

@@ -137,7 +137,7 @@ Field resolvers without access decorators inherit the principal of their actual
 
 Socket operations authenticate each operation independently from the WebSocket upgrade request and never refresh the session. Browser-origin checks always use the original upgrade headers, before any session read, so connection parameters cannot replace the browser's `Origin`. The platform's own request predicate classifies HTTP operations first, and Apollo recognizes a socket operation only through the graphql-ws connection and its WebSocket. A client-sent `Upgrade: websocket` header therefore never selects the socket path: an HTTP operation keeps the platform client IP, response cookie forwarding and the completed-request check, and an unrecognized context still fails closed. Mercurius treats an operation whose context carries the route's own Fastify reply as HTTP before any socket detection, and otherwise identifies sockets only through its subscription context, so neither request headers nor client fields spread into a custom context select the socket path.
 
-By default, `authorization` and `cookie` values in the `connection_init` payload replace the matching upgrade headers. `connectionParamHeaders` replaces that list of keys, matched case-insensitively. A selected value that is not a string or is not a valid header value rejects the operation with `UNAUTHENTICATED` and `reason: "MALFORMED_CREDENTIALS"`, without falling back to another credential and without echoing the value in errors or logs.
+By default, `authorization` and `cookie` values in the `connection_init` payload replace the matching upgrade headers. `connectionParamHeaders` replaces that list of keys, matched case-insensitively. A `connection_init` message without a payload, which a graphql-ws `createClient()` without `connectionParams` sends, carries no connection parameters: the upgrade request's own credential headers apply, and a connection without them is anonymous. A selected value that is not a string or is not a valid header value rejects the operation with `UNAUTHENTICATED` and `reason: "MALFORMED_CREDENTIALS"`, without falling back to another credential and without echoing the value in errors or logs.
 
 `subscriptionCredentials(connectionContext)` replaces this mapping. The `HeadersInit` it returns becomes the operation's credentials, and `host`, `x-forwarded-host` and `x-forwarded-proto` are copied from the upgrade request when absent. Returning `undefined` presents no credentials, and `connectionParamHeaders` is not consulted. Invalid header values reject with `MALFORMED_CREDENTIALS`; errors thrown by the function are application errors, not credential denials.
 
@@ -387,7 +387,7 @@ runConformance(
 
 Every case boots real Nest applications or modules with a real Better Auth instance that includes `conformanceProbePlugin()`. The probe counts and faults every operation of the instance's database adapter, so storage outages reach endpoints that would swallow them, and records the `Set-Cookie` lines each call produces. `createConformanceAuth({ plugins })` builds such an instance: memory adapter, `testUtils()`, `bearer()`, the probe plugin, `nestjs()` last, and `session.updateAge: 0` and origin checks on, whatever `options` says. The principal-source and policy kits take that instance as `auth`; the principal-source kit rejects an instance without `session.updateAge: 0`. The transport kit creates its own instance and passes it to your `createApp` harness together with the kit's API-key source in `principals`, a `logger` to boot with, and the `globalScope`, `appEnhancers`, `fieldResolverEnhancers` and `federation` settings of each boot. Apply every fixture decorator, including the kit's `SetMetadata()` marker, which maps the transport's claims to fixtures. On a connection-shaped browser leg, the kit's cookie credential carries the instance's base URL, `http://localhost:3000`, as `Origin`, as a browser page of that origin does; the `T-ws-origin-*` cases pass their own `Origin`, `Host` and forwarding headers, which the harness sends in the handshake.
 
-This repository runs the platform kit against Express and Fastify; the transport kit against the built-in HTTP transport, an in-process reference transport, Socket.IO and `ws` (each with and without a principal TTL), and the RPC transport over TCP (standalone and hybrid), gRPC, NATS, RabbitMQ, MQTT, Redis and Kafka; the principal-source kit against the session and API-key sources; and the policy kit against the admin, organization, API-key and fresh-session policies. gRPC skips `T-error-shape`, because it delivers only a status and a message. Mutation tests confirm that each of these defects fails the intended case: a platform merging `Set-Cookie`, a transport sharing invocation state across aliases, a transport without a browser leg on safe operations, a `defineExtension()` transport with a lineage or nesting and no helper, a WebSocket transport that enforces its handshake like a safe read, exempts handshakes that carry a token, builds its leg URL from the bare handshake path or from forwarded headers, or answers internal errors with their cause, a source throwing its denial, a source dropping its refresh cookie, a source turning a storage outage into a 401, and a policy widening delegated principals.
+This repository runs the platform kit against Express and Fastify; the transport kit against the built-in HTTP transport, an in-process reference transport, Socket.IO and `ws` (each with and without a principal TTL), the RPC transport over TCP (standalone and hybrid), gRPC, NATS, RabbitMQ, MQTT, Redis and Kafka, and the Apollo (Express and Fastify) and Mercurius transports over HTTP and over graphql-ws (with and without a subscription principal TTL; Mercurius also without `mercuriusSubscriptionContext()`), with federation 2 subgraphs and a federation 1 run of `T-reference-resolver`; the principal-source kit against the session and API-key sources; and the policy kit against the admin, organization, API-key and fresh-session policies. gRPC skips `T-error-shape`, because it delivers only a status and a message. The kit reads each call's browser leg while its invocation runs, because the GraphQL transports reject a completed request. Mutation tests confirm that each of these defects fails the intended case: a platform merging `Set-Cookie`, a transport sharing invocation state across aliases, a transport without a browser leg on safe operations, a `defineExtension()` transport with a lineage or nesting and no helper, a WebSocket transport that enforces its handshake like a safe read, exempts handshakes that carry a token, builds its leg URL from the bare handshake path or from forwarded headers, or answers internal errors with their cause, a GraphQL transport whose aliases share one invocation, whose lineage gives every field of an operation one position, whose field resolvers do not inherit their root's access, or that serves reference resolvers without field guards, a GraphQL harness that omits `invokeGraph`, `invokeEntities` or `invokeConnection`, a source throwing its denial, a source dropping its refresh cookie, a source turning a storage outage into a 401, and a policy widening delegated principals.
 
 ## Develop in this monorepo
 
@@ -410,6 +410,7 @@ The shared toolchain uses Node.js LTS, pnpm, tsdown, TypeScript and Vitest. Buil
 Each example application registers a default and a named instance, reads the signed-in user through the `@CurrentUser()` principal parameter and starts without external services:
 
 - [Express](../../examples/better-auth-express/README.md) and [Fastify](../../examples/better-auth-fastify/README.md) guard HTTP routes on their platforms.
+- [Apollo GraphQL](../../examples/better-auth-graphql/README.md) authenticates queries and mutations over HTTP and every graphql-ws operation, with the named instance bound to its own resolver.
 - [Socket.IO](../../examples/better-auth-websockets/README.md) authenticates gateway connections and every message, with the named instance on its own namespace.
 - [TCP microservice](../../examples/better-auth-rpc/README.md) authenticates the messages of a hybrid application through the payload credential carrier.
 

package/dist/admin.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_auth_errors = require("./auth-errors-1EdQ36D8.cjs");
-const require_auth_decorators = require("./auth-decorators-9L-UO_T3.cjs");
+const require_auth_decorators = require("./auth-decorators-pe3Aou21.cjs");
 let better_auth_api = require("better-auth/api");
 //#region src/admin.ts
 const adminPermissionPolicy = {

package/dist/admin.d.cts

@@ -1,4 +1,4 @@
-import { Ct as AuthPrincipal, Nt as PrincipalKind, f as AuthorizationPolicy, ot as Requirement, vt as AdminPermissions } from "./auth-contracts-mejJfv9d.cjs";
+import { Ct as AuthPrincipal, Nt as PrincipalKind, f as AuthorizationPolicy, ot as Requirement, vt as AdminPermissions } from "./auth-contracts-CzYNjGov.cjs";
 //#region src/admin.d.ts
 export interface PermissionOptions {
   principals?: readonly PrincipalKind[];

package/dist/admin.d.mts

@@ -1,4 +1,4 @@
-import { Ct as AuthPrincipal, Nt as PrincipalKind, f as AuthorizationPolicy, ot as Requirement, vt as AdminPermissions } from "./auth-contracts-B2SAVlKT.mjs";
+import { Ct as AuthPrincipal, Nt as PrincipalKind, f as AuthorizationPolicy, ot as Requirement, vt as AdminPermissions } from "./auth-contracts-bhMN9XB3.mjs";
 //#region src/admin.d.ts
 export interface PermissionOptions {
   principals?: readonly PrincipalKind[];

package/dist/admin.mjs

@@ -1,5 +1,5 @@
 import { n as BetterAuthConfigurationError } from "./auth-errors-B6jLBpQu.mjs";
-import { u as Require } from "./auth-decorators-CQYu3gaF.mjs";
+import { u as Require } from "./auth-decorators-BO9T-1wp.mjs";
 import { isAPIError } from "better-auth/api";
 //#region src/admin.ts
 const adminPermissionPolicy = {

package/dist/api-key.cjs

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_auth_errors = require("./auth-errors-1EdQ36D8.cjs");
 const require_auth_scope_interceptor = require("./auth-scope-interceptor-DJTO9RVP.cjs");
-const require_auth_decorators = require("./auth-decorators-9L-UO_T3.cjs");
+const require_auth_decorators = require("./auth-decorators-pe3Aou21.cjs");
 let better_auth_plugins_access = require("better-auth/plugins/access");
 //#region src/api-key.ts
 const API_KEY_PRINCIPAL_KIND = "api-key";

package/dist/api-key.d.cts

@@ -1,4 +1,4 @@
-import { $ as PrincipalDelegation, it as PrincipalSource, o as AuthPrincipalBase, ot as Requirement } from "./auth-contracts-mejJfv9d.cjs";
+import { $ as PrincipalDelegation, it as PrincipalSource, o as AuthPrincipalBase, ot as Requirement } from "./auth-contracts-CzYNjGov.cjs";
 //#region src/api-key.d.ts
 export declare const API_KEY_PRINCIPAL_KIND: "api-key";
 export interface ApiKeyPrincipal extends AuthPrincipalBase {

package/dist/api-key.d.mts

@@ -1,4 +1,4 @@
-import { $ as PrincipalDelegation, it as PrincipalSource, o as AuthPrincipalBase, ot as Requirement } from "./auth-contracts-B2SAVlKT.mjs";
+import { $ as PrincipalDelegation, it as PrincipalSource, o as AuthPrincipalBase, ot as Requirement } from "./auth-contracts-bhMN9XB3.mjs";
 //#region src/api-key.d.ts
 export declare const API_KEY_PRINCIPAL_KIND: "api-key";
 export interface ApiKeyPrincipal extends AuthPrincipalBase {

package/dist/api-key.mjs

@@ -1,6 +1,6 @@
 import { n as BetterAuthConfigurationError, r as BetterAuthInfrastructureError, t as AuthFailures, u as normalizeThrown } from "./auth-errors-B6jLBpQu.mjs";
 import { a as absent, l as rejected, o as authenticated } from "./auth-scope-interceptor-C0NRu4uy.mjs";
-import { u as Require } from "./auth-decorators-CQYu3gaF.mjs";
+import { u as Require } from "./auth-decorators-BO9T-1wp.mjs";
 import { role } from "better-auth/plugins/access";
 //#region src/api-key.ts
 const API_KEY_PRINCIPAL_KIND = "api-key";

package/dist/{auth-contracts-B2SAVlKT.d.mts → auth-contracts-CzYNjGov.d.cts}

@@ -1,10 +1,8 @@
-import { CallHandler, CanActivate, DynamicModule, ExecutionContext, InjectionToken, Logger, LoggerService, ModuleMetadata, NestInterceptor, OptionalFactoryDependency, Provider, Type } from "@nestjs/common";
-import { AbstractHttpAdapter, DiscoveryService, HttpAdapterHost, ModuleRef, Reflector } from "@nestjs/core";
-import { Observable } from "rxjs";
-import { IntrinsicException } from "@nestjs/common/exceptions/intrinsic.exception.js";
 import { IncomingHttpHeaders, IncomingMessage } from "node:http";
+import { CallHandler, CanActivate, DynamicModule, ExecutionContext, InjectionToken, IntrinsicException, Logger, LoggerService, ModuleMetadata, NestInterceptor, OptionalFactoryDependency, Provider, Type } from "@nestjs/common";
+import { AbstractHttpAdapter, DiscoveryService, HttpAdapterHost, ModuleRef, Reflector } from "@nestjs/core";
 import { HookEndpointContext } from "better-auth";
-import "@nestjs/core/injector/instance-wrapper.js";
+import { Observable } from "rxjs";
 //#endregion
 //#region src/auth-errors.d.ts
 type AuthErrorCode = "UNAUTHENTICATED" | "FORBIDDEN" | "RATE_LIMITED";
@@ -958,8 +956,13 @@ interface DbHookOptions {
   instance?: string;
 }
 type HookPredicate = (ctx: AuthHookContext) => boolean;
-type HookMethodDecorator<P extends string> = <T>(target: object, key: string | symbol, descriptor: TypedPropertyDescriptor<(ctx: AuthHookContext<P>) => T>) => void;
-type DbHookMethodDecorator<E extends DatabaseHookTarget, Ph extends "before" | "after"> = (target: object, key: string | symbol, descriptor: TypedPropertyDescriptor<DatabaseHookMethod<E, Ph>>) => void;
+/**
+ * The decorated method type M is inferred and constrained rather than fixed: TypedPropertyDescriptor is invariant, so a fixed
+ * descriptor type would reject sound methods that declare fewer parameters or return a narrower result.
+ */
+type HookMethodDecorator<P extends string> = <M extends (ctx: AuthHookContext<P>) => unknown>(target: object, key: string | symbol, descriptor: TypedPropertyDescriptor<M>) => void;
+/** Constrains the decorated method like HookMethodDecorator; the SDK's payload, context and result types still apply. */
+type DbHookMethodDecorator<E extends DatabaseHookTarget, Ph extends "before" | "after"> = <M extends DatabaseHookMethod<E, Ph>>(target: object, key: string | symbol, descriptor: TypedPropertyDescriptor<M>) => void;
 type DatabaseHookTarget = `${"user" | "session" | "account" | "verification"}.${"create" | "update" | "delete"}`;
 interface CorsOriginOptions {
   /** Also honor wildcard (`https://*.vercel.app`) and custom-scheme trusted origins for credentialed CORS. Default false: exact origins only. */
@@ -1660,4 +1663,4 @@ interface PolicyBootContext {
 }
 //#endregion
 export { PrincipalDelegation as $, ErrorMappingOptions as $n, SESSION_PRINCIPAL_KIND as $t, DatabaseHookTarget as A, BetterAuthService as An, GetSessionWithHeaders as At, HookOptions as B, WS_CONNECTION_AUTH as Bn, UnvalidatedBody as Bt, ConformanceCase as C, defineHttpPlatform as Cn, AuthPrincipal as Ct, CookieForwardingOptions as D, allow as Dn, DatabaseHookMethod as Dt, ConformanceSkip as E, BetterAuthGuard as En, DatabaseHookData as Et, ExtensionDefinition as F, BetterAuthModule as Fn, Register as Ft, InboundAuthRequest as G, AuthErrorBody as Gn, betterAuthCorsOrigin as Gt, HttpMountOptions as H, getBetterAuthInstanceToken as Hn, WithActiveOrganization as Ht, ExtensionRef as I, GUARD_CORE as In, RegisteredAuth as It, PlatformMountContext as J, AuthFailures as Jn, definePrincipalSource as Jt, InvocationLineage as K, AuthErrorCode as Kn, absent as Kt, FastifyPlatformOptions as L, POLICY_INVOKER as Ln, RegisteredInstances as Lt, DbHookOptions as M, InstanceLookup as Mn, OrgPermissions as Mt, DefaultInstanceCheck as N, EXTENSION_DEFINITION as Nn, PrincipalKind as Nt, CookieSink as O, definePolicy as On, DatabaseHookResult as Ot, ExpressPlatformOptions as P, UPGRADE_REQUEST as Pn, PrincipalOfKind as Pt, PolicyRef as Q, BetterAuthInfrastructureError as Qn, RequireFreshSession as Qt, GuardReach as R, PRINCIPAL_RESOLVER as Rn, SessionOf as Rt, ClaimOptions as S, defineExtension as Sn, AuthOf as St, ConformanceRunner as T, BetterAuthScopeInterceptor as Tn, AuthUser as Tt, HttpPlatform as U, getBetterAuthOptionsToken as Un, PrincipalKinds as Ut, HookPredicate as V, getBetterAuthHandleToken as Vn, UserOf as Vt, HttpRequestAccessor as W, getBetterAuthServiceToken as Wn, httpTransport as Wt, PolicyBootContext as X, AuthTransportErrorPayload as Xn, CurrentSession as Xt, PlatformPrepareContext as Y, AuthGraphqlExtensions as Yn, rejected as Yt, PolicyInvoker as Z, BetterAuthConfigurationError as Zn, CurrentUser as Zt, BetterAuthRuntimeOptions as _, allOf as _n, TransportValidationContext as _t, AuthHandlerInterceptor as a, BeforeAuth as an, ProxyTrust as at, BootAdviceContext as b, definePrincipalParam as bn, AuthHookContext as bt, AuthTransport as c, ForwardAuthCookies as cn, RequirementOptions as ct, AuthorizationLimits as d, Require as dn, ScopeInit as dt, freshSession as en, getRawCause as er, PrincipalReading as et, AuthorizationPolicy as f, RequireAuth as fn, SessionOption as ft, BetterAuthModuleOptions as g, UseBetterAuth as gn, TransportKit as gt, BetterAuthModuleAsyncOptions as h, UseAuthInstance as hn, TransportCall as ht, AuthHandle as i, AfterDatabase as in, PrincipalSource as it, DbHookMethodDecorator as j, TransportRegistry as jn, IsRegistered as jt, CorsOriginOptions as k, deny as kn, EndpointPath as kt, AuthorizationContext as l, OptionalAuth as ln, ResolutionRequest as lt, BetterAuthFactoryResult as m, SkipOriginCheck as mn, StaticOptionMustBePassedToForRootAsync as mt, ApplicationRouteDescriptor as n, AcceptPrincipals as nn, isConfigurationError as nr, PrincipalResolver as nt, AuthPrincipalBase as o, BeforeDatabase as on, Requirement as ot, BetterAuthAppOptions as p, SkipDefaultRequirements as pn, SessionPrincipalOptions as pt, OriginCheckOptions as q, AuthFailure as qn, authenticated as qt, AuthContextView as r, AfterAuth as rn, isInfrastructureError as rr, PrincipalResult as rt, AuthRouteBinding as s, CurrentPrincipal as sn, RequirementExpr as st, AdvisedHandler as t, sessionPrincipal as tn, isAuthFailure as tr, PrincipalRequest as tt, AuthorizationDecision as u, Public as un, RoutePlan as ut, BetterAuthStaticOptions as v, anyOf as vn, AdminPermissions as vt, ConformanceOutcome as w, defineTransport as wn, AuthSession as wt, BrowserExposure as x, requirement as xn, AuthLike as xt, BootAdvice as y, defineInvocationParam as yn, AuthAfterHookContext as yt, HookMethodDecorator as z, SCOPE_CORE as zn, SessionPrincipal as zt };
-//# sourceMappingURL=auth-contracts-B2SAVlKT.d.mts.map
+//# sourceMappingURL=auth-contracts-CzYNjGov.d.cts.map

package/dist/auth-contracts-CzYNjGov.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-contracts-CzYNjGov.d.cts","names":[],"sources":["../src/auth-errors.ts","../src/auth-tokens.ts","../src/auth-module.ts","../src/bridge-protocol.ts","../src/request-scope.ts","../src/origin-check.ts","../src/instance-registry.ts","../src/mount-coordinator.ts","../src/principal-readings.ts","../src/policy-resolver.ts","../src/transport-registry.ts","../src/route-planner.ts","../src/auth-service.ts","../src/authorization-evaluator.ts","../src/auth-guard.ts","../src/auth-scope-interceptor.ts","../src/auth-module-definition.ts","../src/auth-decorators.ts","../src/session-principal.ts","../src/principal-resolver.ts","../src/auth-exchange.ts","../src/http-transport.ts","../src/index.ts","../src/auth-types.ts","../src/auth-contracts.ts"],"mappings":";;;;;;;KAkBY;;UAGK;WACN;WACA,MAAM;WACN;WACA;WACA;WACA,UAAU;;UAGJ;EACf;EACA;EACA,MAAM;EACN;EACA;;UAGe;EACf,MAAM;EACN;EACA;;UAGe;EACf;EACA;EACA,MAAM;EACN;EACA;;UAGe;EACf,OACE,SAAS,aACT,SAAS,kBACT;EAEF;;iBAQc,cAAc,iBAAiB,SAAS;iBAIxC,sBACd,iBACC,SAAS;iBAII,qBACd,iBACC,SAAS;iBAqDH,UAAU;EACjB;EACA;EACA;EACA;EACA;IACE;cA6BS;EACX,gBAAe,mBAAoB;EAGnC,iBAAQ;EACR,UAAS,gBAAe,mBAAqB;EAG7C,aAAY,iBAAkB;;cA4BnB,qCAAqC;WACvC;WACA;WACA;WACA;WACA;WACA;aACP;aACA;aACA;;WAEO,kBAAkB;EAE3B,YAAY,cAAc,gBAAgB;SAUnC,UACL,cACA,gBACA;IAAY;IAAe;MAC1B;;cAeQ,sCAAsC;WACxC,OAAO;WACP;aACP;aACA;aACA;;EAGF,YAAY,gBAAgB;IAAY;;;iBAwB1B,YAAY,OAAO;;;;iBC7QnB,2BAA2B;iBAI3B,0BAA0B;iBAI1B,0BAA0B;iBAI1B,yBAAyB;cAK5B;cAGA;cAGA;cAGA;cAGA;cAGA;cAGA;cAGA;cACA;cACA;cAGA;cAGA;cACA;cACA;cACA;cAGA;cAGA;cAGA;cAGA;cAGA;cAGA;cAGA;cAGA;cAGA;cAGA;cACA;cAGA;;cAEA;iBAIG,yBAAyB;iBAMzB,kBACd,kDACA,kBACA;cAOW;cAGA;;;cCvGA;SACJ,QAAQ,UAAU,WAAW,gBAClC,SAAS,wBAAwB,KAC/B;IAAyB;MAAqB,qBAAqB,KACpE;SACI,QAAQ,UAAU,UACvB,SAAS,wBAAwB;IAAO;MAAiB,eACxD;SAWI,aAAa,UAAU,WAAW,gBACvC,SAAS,6BAA6B,KACpC;IAAyB;MAC1B;SACI,aAAa,UAAU,UAC5B,SAAS,6BAA6B;IAAO;MAAiB,eAC7D;;;;cC/BQ;cAGA;UAII;WACN;WACA;;WAEA;;WAEA;;;;;;;;EAQT,KAAK,SAAS;IAAkB;IAAe;;;EAE/C,mBAAmB;;UAEJ;;WAEN;aAAkB;;;WAElB;;EAET;;EAEA,WAAW;;WAEF;WACA,iBAAiB;WACjB,gBAAgB;WAChB,UAAU,YAChB,KAAK;aACK,iBAAiB,mBAAmB;aACpC,gBAAgB,mBAAmB;;;EAIhD,UAAU;;UAEK;;WAEN,SAAS;WACT;WACA,gBAAgB;WAChB;;;;;;;WAOA,sBAAsB,cAAc;;;WAGpC,uBAAuB;;UAEjB;;;;;;;;EAQf,QAAQ,KAAK,qBAAqB,OAAO;EACzC,IAAI,KAAK,sBAAsB;;;;UC9DhB;WACN,MAAM;WACN,OAAO;WACP,OAAO;WACP,gBAAgB;;UAEV;WACN,WAAW,YAAY,QAAQ;WAC/B,UAAU,YAAY;WACtB,WAAW,YAAY,QAAQ;WAC/B,QAAQ;WACR,oBAAoB;WACpB,SAAS,YAAY,QAAQ;WAC7B,UAAU;WACV,aAAa;IAGlB,OAAO,QAAQ;MAAmB;;IAClC;;;cAmCO;;EAOX,IAAI,GAAG,OAAO,YAAY,UAAU,IAAI;EAIxC,KAAK,GAAG,UAAU,IAAI;EAItB,WAAW;EAIX,SAAS,cAAc;EAkBvB,cACE,MAAM,KAAK,yDACX;IACE;IACA;IACA;KAEF,eAAe,QAAQ,mBACtB,QAAQ;EAqCX,aAAa,GACX,iBACA,kBACA,qBACA,eAAe,QAAQ,IACvB,yBACC,QAAQ;EA0BX,aACE,oBACA,kBACA,qBACA,eAAe,QAAQ,yBACtB,QAAQ;EAWX,SAAS,kBAAkB;EAc3B,SACE,aACA,eACA;IAAW;IAAkB;IAAc,UAAU;;;;;;cCnL5C;;mBAOQ;EADnB,YACmB;IACf,KAAK;IACL,MAAM;;EAIV,OACE,kBACA,SAAS,aACT,SAAS,SACT;EA6BF,gBACE,kBACA,SAAS,SACT;;UAWa;WACN;WACA,SAAS;WACT,UAAU;WACV,cAAc;WACd;WACA;;cAGE;;mBAKQ;mBACA;EAFnB,YACmB,OAAO,cACP,MAAM;EAKzB,MACE,SAAS,iBACT,0BACC,QAAQ;EAiEL,SAAS,SAAS,kBAAkB;EAkB1C,oBACE,SAAS,iBACT,cACA;UAuBM;UAkBM;;;;UCnLC;WACN;WACA,UAAU;WACV,SAAS,yBAAyB;WAClC,eAAe;WACf,kBAAkB;WAClB,QAAQ;WACR,SAAS;WACT,QAAQ;WACR,QAAQ;WACR;;UAEM;EACf,IAAI,eAAe;EACnB,iBAAiB;;UAEF;WACN;WACA,UAAU;WACV,SAAS,yBAAyB;WAClC,eAAe;WACf,YAAY;WACZ,kBAAkB;WAClB,QAAQ;;cAgBN,4BAA4B;;mBASa;WAN3C,QAAM;WACN,aAAW;EACpB;EACA,SAAS;EACT;IAAU;;EAEV,YAAoD,OAAO;EAE3D,SACE,SAAS,yBAAyB,WAClC,eAAe,yBACf,kBAAkB,mBAClB,YAAY,uBACX;EAiBH,0BAA0B;EAI1B,IAAI,eAAe;EAYnB,iBAAiB;EAIjB,MAAM,SAAS;EAmBT,WAAW,QAAQ,iCAAiC;EAyK1D;;;;cClTW;;WAUyB,MAAM;mBACI;WAVrC,QAAM;EAQf,YACoC,MAAM,iBACI,UAAU,kBAC/B,OAAO;EAMhC,kBAAkB,oBAAoB;MAKlC,YAAY;MAIZ,WAAW;UAIP;EAqDR,cAAc,QAAQ;EAmBtB,QAAQ,QAAQ;EAyEhB,MAAM,mBAAmB;EAMzB,QAAQ,eAAe;EAIvB,qBAAqB;EAIrB,0BAA0B;EAO1B,0BACE,iBAAiB,8BACjB,QAAQ;EAkBJ,SAAS;EAwBf;;;;UChQe;WACN;WACA,OAAO;WACP,UAAU;WACV,OAAO,KAAK;WACZ;WACA;;;cAwEE,4BAA4B;EACvC,YAAY,OAAO;;cAMR;mBACkB;EAA7B,YAA6B,OAAO;EAEpC,OACE,MAAM,KAAK,0CACX,SAAS;EAUX,cAAc,SAAS,mBAAmB,SAAS;EAMnD,UACE,SAAS,mBACT,2BACC;EAWH,KAAK,OAAO,eAAe;EA0E3B,WAAW;EAWX,QAAQ,GACN,SAAS,kBACT;IACE;IACA;IACA;IACA,UAAU,WAAW,kBAAkB;KAEzC,QAAQ,eACP;EAqBH,QACE,OAAO,8BACP,QAAQ,cACR,oBACC,+BAA+B;EAmBlC,MACE,0BACA,kBACA,QAAQ;;;;cC5RC;mBAMkB;mBALZ;EAKjB,YAA6B,WAAW;EAExC,QAAQ,GAAG,WAAW,UAAU,KAAK,oBAAoB;;;;cCJ9C;UACH;mBACS;UACT;EAER,SAAS,qBAAqB;EAI9B,OAAO,KAAK;EAIZ,iBAAiB;EAKjB,iBAAiB,QAAQ,UAAU;EAUnC,KAAK,SAAS,mBAAmB;EAIjC,OAAO,SAAS,mBAAmB;EAWnC,KAAK,MAAM;EAIX,SACE,SAAS,kBACT,YAAS,gBACR;;;;cCHQ;mBAKQ;mBACA;mBACA;mBALF;EAEjB,YACmB,WAAW,gBACX,UAAU,gBACV,YAAY;UAGvB;EAiGR,eAAe,QAAQ,MAAM,0BAA0B;EAIvD,WAAW,SAAS,mBAAmB;EAiBvC,KAAK,QAAQ,MAAM,iBAAiB;;;;cCzJzB,kBAAkB,UAAU,WAAW;;mBAQJ;mBACJ;mBACK;mBACL;mBACK;mBACD;WAZrC;WACA,UAAU;WACV,KAAK;EAGd,YACuC,SAAS,yBAAyB,IAC3B,UAAU,kBACd,OAAO,cACF,UAAU,mBACf,SAAS,cACJ,YAAY,mBACb,aAAa;EAiB3D,WAAW,QAAQ,QAAQ;EAI3B;aAEe;aACA;aACA;;EAcf,gBAAgB,QAAQ;EAUxB,cAAc,QAAQ,UAAU;EAIhC,aAAa,SAAS,mBAAmB;EAiBzC,YAAY,2BAA2B;EA0BvC,sBAAsB,GAAG,UAAU,QAAQ,KAAK,QAAQ;EA0BxD,eAAe,GAAG,UAAU,QAAQ,KAAK,QAAQ;EAiBjD,gBAAgB,GAAG,UAAU,QAAQ,KAAK,QAAQ;;;;cCxJvC,aAAY;cACZ,OAAI;EACf;EACA;EACA;EACA;MACE;iBACY,aAAa,GAAG,UAAU,gBAAgB,eACxD,QAAQ,oBAAoB,GAAG,gBAAgB,OAC7C,QAAQ,GAAG,UAAU,uBAAuB,YAAY;cAY/C;mBAIQ;mBACA;mBACA;mBACA;mBANF;EAEjB,YACmB,UAAU,gBACV,SAAS,eACT,UAAU,mBACV,OAAO;EAGpB,SACJ,MAAM,WACN,WAAW,eACX,MAAM,eACN,OAAO,eACP,WAAW,kBACX,oBACC,QAAQ;;;;cCxCA,2BAA2B;mBAKC;mBAJtB;YACP;EAEV,YACuC,MAAM,KAAK;EAGlD,YAAY,SAAS,mBAAmB;;cAI7B,qBAAqB;mBAEb;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;EAPnB,YACmB,WAAW,gBACX,SAAS,cACT,YAAY,mBACZ,UAAU,mBACV,WAAW,wBACX,OAAO,cACP,UAAU;EAGvB,YAAY,SAAS,mBAAmB;;;;cChCnC,sCAAsC;mBAKV;mBAJtB;YACP;EAEV,YACuC,MAAM,KAAK;EAGlD,UAAU,SAAS,kBAAkB,MAAM,cAAc;;cAI9C,qBAAqB;mBAEb;mBACA;mBACA;mBACA;mBACA;EALnB,YACmB,WAAW,gBACX,SAAS,cACT,YAAY,mBACZ,OAAO,cACP,UAAU;EAG7B,UAAU,SAAS,kBAAkB,MAAM,cAAc;;;;iBCc3C,gBAAgB,GAC9B,YAAY,KAAK,oBAAoB,WAAW,wBAC/C,oBAAoB;iBAGP,mBAAmB,UAAU,cAAc,UAAU,IAAI;iBAGzD,gBAAgB,UAAU,eAAe,WAAW,IAAI;;;cCtB3D,uCAAM,uBAAA;cACN,6CAAY,uBAAA;cAEZ,cAAW;EAAgB;OAAyB,kBAAA,UAAA,GAAA,QAAA,oBAAA,+BAAA,aAAA,wBAAA;cAKpD,kBAAe,0CAAgB,uBAAA;cAE/B,sBAAgB,iBACP,kBAAkB,8CAAgB,uBAAA;cAE3C,wDAAuB,uBAAA;cAEvB,qBAAkB,+CAAA,uBAAA;cAElB,gDAAe,uBAAA;cAEf,sBAAa,kBAAA,UAAA,GAAA,QAAA,oBAAA,+BAAA,aAAA,wBAAA;iBAMV,WACX,uBAAuB,oBACzB,iBAAiB;cAeP,WAAK,uBACU,sBACzB;cACU,WAAK,uBACU,sBACzB;cACU,cAAe,GAAC,QACnB,UAAU,IAAE,QACZ,GAAC,UACC,uBACT,YAAY;cAyEF,wBAAuB;iBACpB,qBAAqB,UAAU,eAAe,GAAG;WACtD,MAAM;WACN;WACA,UAAU,WAAW,gBAAgB,OAAO;UAC7C;iBAGM,sBACd,cACA;WAAiB;UACV;cA4GI,mBAAoB,UAAU,8BAA4B,QAC7D,aAAa,MAAM,eAAa,UAC9B,gBACT,oBAAoB;cACV,kBAAmB,UAAU,8BAA4B,QAC5D,aAAa,MAAM,eAAa,UAC9B,gBACT,oBAAoB;cAqBV,iBAAkB,UAAU,oBAAkB,QACjD,GAAC,UACC,kBACT,sBAAsB;cAEZ,gBAAiB,UAAU,oBAAkB,QAChD,GAAC,UACC,kBACT,sBAAsB;;;cC3SZ;cACA,sBAAc;cAKd,mBAAW;iBAgBR,iBAAiB,IAAI,aACnC,UAAS,wBAAwB,KAChC,gBAAgB,iBAAiB;cAyLvB,eAAY;EACZ;MACV;EAAc;;cAIJ,sBAAmB;EAC9B;MACE,iBAAiB;;;cC1NR,wBAAyB,UAAU,mBAAiB,QACvD,gBAAgB,OACvB,gBAAgB;cACN,gBAAiB,UAAU,mBAAiB,WAC5C,MACV,gBAAgB;cACN,cAAa;cACb,WAAQ,SAAa,gBAAc;;;;iBCkShC,qBACd,MAAM,UACN,UAAU,qBAEV,4BACA,KAAK,KAAK,cAAc;;;iBC9IV,iBAAiB,aAAa;;;;UCjL7B;EACf,SAAS;;;;;UCIM;EACf,QAAQ,SAAS,UAAU,QAAQ;EACnC;IACE,WAAW;MACT,SAAS;MACT;QAAU;QAA8B;;MACxC;QACE;;EAEN,UAAU;;;UAGK;WACN,UAAU;WACV;;;UAKM;KACL,eAAe;EAAmB,MAAM;;KACxC,iBAAiB;EAAmB,YAAY,UAAU;IAClE,IACA;KACQ,sBAAsB;EAChC,iBAAiB,UAAU,eAAe;IAExC,IACA;KACQ,OAAO,gCAAgC,sBAC/C,iBACA,gBAAgB,sBACd,oBAAoB,KACpB;;KAGD;EACH,+BAA+B;EAC/B,4BAA4B;;KAElB,UAAU,KAAK;EAAY;IAAU,eAAe;;IAC5D,YAAY,KACZ;KACQ,OAAO,KAAK,UAAU;EAAa,YAAY;IAAM;KACrD,YAAY,gCAAgC,UAAU,OAAO;KAC7D,SAAS,gCAAgC,OAAO,OAAO;KACvD,UAAU,KAAK;EAAY;IAAQ;;;KAG1C,OAAO,KAAK,YAAW,WAAW,kBAClC,YAAY;EAAe,aAAa;KACvC,YAAY;KAGb,cAAc,GAAG,oBAAoB;EACxC,QAAQ,KAAK,UAAU;IAErB,OAAO;EAAa,oBAAoB;IACtC,YAAY;KAGN,iBAAiB,gCAC3B,4BACI,cAAc,OAAO,2BACrB;KACM,eAAe,gCACzB,4BACI,cAAc,OAAO,uBACrB;KAID,MAAM,KAAK;EAAY,WAAW;IAAQ;KACnC,aAAa,IAAI,qBAC1B,WAAW,MAAM,KAAK,MAAM,GAAG;EAAa,YAAY;IACrD,mBAEE,MAAM;KACT,WAAW,kBAAkB,IAAI,qBACnC,WAAW,MAAM,KAAK,MAAM,GAAG;EAAa,MAAM;IAAM,MAAM,GAAG,oBAC5D,MAAM;KACT,OAAO,qBAAqB,WAAW,gCAExC,OAAO,WAAW;;;;;KAKV,gBAAgB,MAAM,+BAE9B,+BACc,WAAW,kBAAiB,SAAS;KAE3C,gBAAgB,6BAA6B,2BACjC;EAElB,MAAM;EAAG,qBAAqB,cAAc,gBAAgB,OAAO;;KAC7D,qBAAqB,6BAC/B,gBAAgB;KAIb,UAAU,kCACS;KAEnB,SACH,UAAU,oBACV,iCACE,mBAAmB,gBAAgB,0BAA0B,6CAC7D,YAAY,YAAY,YAAY,QAAQ,IAAI,IAAI;;KAGnD,cAAc,KAAK,mBACpB,OAAO,kBACP,sBACE,UAAU;EAA0B,eAAe;IACjD;KAGH,YAAY,UAAU,sBACzB,mBAAmB,WAAW,OACzB,cAAc,sBACb,uBACA,qBACE,QAAQ,cAAc,MACtB,cAAc,KAClB;;KAEM,iBACV,UAAU,oBACV,4CACE,WAAW,SAAS,GAAG,UAAU,YAAY;;KAErC,mBACV,UAAU,oBACV,iCACE,QAAQ,WAAW,SAAS,GAAG;KACvB,mBACV,UAAU,oBACV,kCAEA,MAAM,iBAAiB,GAAG,KAC1B,2BAA2B,8CACxB,mBAAmB,GAAG,MAAM,QAAQ,mBAAmB,GAAG;;KAGnD,uBAAuB,KAAK;EACtC;IAAW;;;KAID,sBAAsB;KACtB,gBAAgB,eAAe;KAC/B,gBAAgB,UAAU,iBAAiB,eAAe;UACrD,iBAAiB,IAAI,qBAAqB;WAChD;WACA,SAAS;;;;UC7HH;;EAEf,qBAAqB,aAAa;;EAElC,sBAAsB,aAAa;;KAEzB;WACD;WACA;;;UAIM;;EAEf;;EAEA;;;;;EAKA;;;;;;;EAOA;;EAEA,sBAAsB,aAAa;;;KAIzB,yBAAyB,UAAU,WAAW;;EAExD,MAAM;;EAEN;;;;;;;;EAQA,+BAA+B;;EAE/B,OAAO;;EAEP,UAAU;;EAEV,cAAc;;EAEd,SAAS;;EAET,SAAS;;EAET;IACE,cAAc;UAED;;;;;;EAMf;;UAGe;;;;;;;;;EASf;;UAGe;;;;;EAKf;;;;;;;;EAQA;;;KAIU,cAAc,UAAU,YAClC,UAAU,UAAU;EACd,UAAU,wBAAwB,UAAU;;EAE5C,UACK,wBAAwB,UAAU;IACjC,SAAS,GAAG,UAAU;;;UAKnB,wBAAwB;;EAEvC,UAAU,SAAS;;EAEnB;;;;;;;EAOA;;UAGe;;EAEf;;EAEA;;EAEA,kBAAkB;;EAElB;;;;;;EAMA;;EAEA;;KAGU,0BACV;WACW,SAAS;WACT;WACA;GAEX,OAAO,UAAU,YAAY,QAAQ,cAClC,QAAQ;KAED,wBAAwB,UAAU,YAC5C,0BAA0B,yBAAyB;UAEpC,6BAA6B,UAAU,kBAC9C;EACR,UAAU;EACV,mBAAmB,iBAAiB;EACpC,gBACK,gBACA,wBAAwB,KAAK,QAAQ,wBAAwB;;;KAIxD,wBAAwB,UAAU,YAC5C,yBAAyB,QACtB,YAAY,0BACX,yBAAyB,uCAAuC;UAErD,uCAAuC;WAC7C,aAAa;;;KAGZ,qBAAqB,KAAK,4BAClC,UAAU;EAEN,MAAM;;;KAKF,aAAa,KAAK,KAAK,KAAK,IAAI,oBAAoB;UAC/C,oBAAoB;YACzB;WACD;aACM,UAAU,KAAK;;aAEf,gBAAgB,gBAAgB,IAAI,QAAQ;aAC5C,kBAAkB;;aAElB,aAAa,eAAe;;WAClC,qBAAqB;WACrB,UAAU;;WAEV,mBAAmB;;UAGb;WACN;;;;;;;WAOA;;WAEA;;;;;WAKA,uBAAuB;;WAEvB;;;;;;WAMA;;WAEA;;WAEA,SAAS;;WAET;aACE;aACA;;;;;;;WAOF;;WAEA;;WAEA;WACA;;KAKC,oBACR;WACW;;WACA;;;;;;UAME;EACf,QACE,MAAM,eACN,SAAS,oBACR,QAAQ;;UAEI;WACN,MAAM;WACN;;WAEA,SAAS;;WAET;;;;;;WAMA;aAAwB;;;;UAIlB;EACf,OAAO,GACL,QAAQ,oBAAoB,SAC5B,QAAQ,GACR,SAAS,uBACR,QAAQ;;UAGI;WACN;;WAEA,sBAAsB;;WAEtB;;UAGM;;EAEf;;EAEA;;EAEA;;EAEA;;UAEe;EACf;EACA;;KAEU,iBAAiB,KAAK;;;;;KAKtB,oBAAoB,qBAC9B,WAAW,KAAK,gBAAgB,gBAEhC,gBACA,sBACA,YAAY,wBAAwB;;KAG1B,sBACV,UAAU,oBACV,kCACG,UAAU,mBAAmB,GAAG,KACnC,gBACA,sBACA,YAAY,wBAAwB;KAE1B;UAGK;;EAEf;;UAae;;EAEf,YAAY,KAAK;IAAoB;;;UAGtB;;EAEf,YAAY;IAAW;IAAa,KAAK;;;UAiJ1B;WACN;WACA;;WAEA;;;;;EAKT,OAAO,QAAQ;;;UAIA;WACN;;;KAKC,4BAA4B;UAEvB;EACf,SAAS,cAAc;;;;;EAKvB,GAAG,cAAc,KAAK,sBAAsB;;UAG7B;WACN;;WAEA;WACA;WACA;;UAEM;WACN;WACA,MAAM;;WAEN,SAAS;;WAET;WACA;;WAEA;aACE;aACA;;;WAGF,mBAAmB;WACnB;aACE;aACA;;WAEF,kBAAkB,KACzB;;WAIO,mBAAmB,KAAK;;UAElB;WACN,MAAM;;WAEN;;WAEA;;UAGM;;WAEN;;;;;;WAMA;aACE;aACA;;;EAGX,SAAS,SAAS;;;;;;;;;EASlB,SAAS,KAAK;;;;;;;EAOd,MAAM,KAAK,8BAA8B;;WAEhC,UAAU;;EAEnB,YAAY,SAAS,sBAAsB;;EAE3C,UAAU,SAAS;;;;;EAKnB,mBACE,iBAAiB,8BACjB,mBAAmB;;EAGrB,QACE,KAAK,6BACK,eAAe,iBAAiB;;UAG7B;;WAEN;;WAEA;;WAEA;;WAEA;;UAGM;;;;;;WAMN;WACA;;UAGM;WACN,SAAS;WACT,QAAQ;;EAEjB,MAAM,mBAAmB;;UAGV;WACN,SAAS;WACT,QAAQ;WACR,SAAS;;UAGH;WACN;;WAEA;WACA;;WAEA;;EAET,QAAQ;;;;;EAKR,OAAO,SAAS,qBAAqB,QAAQ;;EAE7C,mBAAmB;;UAGJ;WACN;;WAEA;;WAEA,SAAS;;WAET,MAAM,aAAa,eAAe;;WAElC;;WAEA;;WAEA,SAAS;;UAGH;;;;;;EAMf,UAAU;;;;;;;;EAQV,OAAO;;EAEP,IAAI;;EAEJ,QAAQ,eAAe;;EAEvB,QAAQ;aAA0B;aAAyB;;;EAE3D,SAAS;;EAET,MAAM,cAAc;;EAEpB,WAAW,cAAc,eAAe;;EAExC,aAAa;;UAGE;;EAEf,OAAO;;UAGQ;;WAEN;;;;;EAKT,QAAQ,SAAS;;;;;;EAMjB,SAAS,SAAS,kBAAkB,KAAK,eAAe;;EAExD,YAAY,SAAS,aAAa,SAAS;;;;;;;;EAQ3C,qBACE,OAAO,gCAAgC,8BACvC,SAAS,kBACT;aAAiB;;;;;;EAMnB,UAAU,KAAK,oCAAoC;;;;;;;;EASnD,kBAAkB,QAAQ,UAAU;;;;;;;EAOpC,SAAS,SAAS,mBAAmB;;WAE5B;aAAsB;;;EAE/B,QACE,KAAK,6BACK,eAAe,iBAAiB;;UAG7B;;;;;WAKN;;;;;;;;;;WAUA;;WAEA;;WAEA;;;;;;WAMA,UAAU;;;;;;EAMnB,WAAW;;WAEF;;WAEA,SAAS;;WAET;aAAqB;aAAyB;;;EAEvD,MAAM;;WAEG,UAAU;;UAGJ;;;;;;WAMN;;;;;EAKT,WAAW;;WAEF;;WAEA;;;UAIM;;WAEN;;;;;;;;WAQA;;;;;;;WAOA,YAAY,6BAA6B;;;;;;WAMzC,kBAAkB;;UAGZ;;WAEN,MAAM;;UAGA;WACN,WAAW;WACX,WAAW;WACX,WAAW;WACX;;WAGA,SAAS,QAAQ,UAAU,mBAAmB;;;;;EAKvD,MAEE,QAAQ,UACR,4BACA,OAAO,YACP,SAAS;WAEF,QAAQ;;;;;;;;;KASP;UACK;;WAEN;;WAEA;;WAEA;;WAEA;;;;;WAKA;;UAGM;WACN;;WAEA;;WAEA;;;;;WAKA,aAAa;;UAGP;;EAEf,OAAO,aAAa,SAAS;;WAEpB;;UAGM,gBAAgB,UAAU,oBAAoB;WACpD;;WAEA,gBAAgB;;;;;WAKhB;;;;;WAKA;;WAEA;aACE;aACA;;;;;;;;WAQF;;;;;;WAMA;;;;;WAKA;aACE;aACA;;;EAGX,WAAW,SAAS;;;;;EAKpB,QAAQ,SAAS,mBAAmB,QAAQ,gBAAgB;;EAE5D,QACE,KAAK,6BACK,eAAe,iBAAiB;;KAGlC,gBAAgB,UAAU,oBAAoB;WAC3C;WAAmC,WAAW;;WAC9C;;WACA;WAA8B,SAAS;;UAErC;WACN,SAAS;WACT,SAAS;WACT;WACA;aAAqB;aAAyB;;WAC9C;WACA,MAAM;;EAEf,KAAK,GAAG,+BAA+B,eAAe,QAAQ,KAAK,QAAQ;;;UAI5D,WAAW,UAAU,WAAW;WACtC;WACA,UAAU;WACV,KAAK;EACd,WAAW,QAAQ;EACnB,UAAU,aAAa;;EAEvB,IAAI,GAAG,MAAM,WAAW,UAAU,QAAQ,KAAK,QAAQ;;EAEvD,YACE,SAAS,iBACT,0BACC,QAAQ;;;;;EAKX,mBAAmB;;EAEnB,gBAAgB,gBAAgB,UAAU,UAAU;;UAErC;;WAEN,SAAS;;;;;WAKT;;WAEA,gBAAgB;;WAEhB;;;UAGM;WACN;WACA;WACA;WACA;;WAEA;;WAEA;aAAsB;;WACtB;aACE;aACA;aACA;aACA;;aAEA;eAAuB;;aACvB,uCAEH,UAAU;aACP;eACE;eACA;iBAAmB;;;aAErB;eAAwB;;aACxB;eACE;iBACE;iBACA;;eAEF;eACA;eACA;;;;WAIJ;IACP,aAAa,iBAAiB;eACnB;eACA;eACA;eACA,aAAa;;;WAGjB,aAAa,SACpB;aAGa;aACA;eACE;eACA;;;WAKR;aACE;aACA;aACA;;WAEF;IACP,QAAQ;MACN;MACA;QAAkB;QAAe;;QAC/B;IACJ,WAAW;MACT;MACA;QAAkB;QAAe;;MACjC,QAAQ;QACN;;EAEN,UAAU;EACV,UAAU;EACV,gBACE,aACA;IAAa;;;UAIA,oBACf,kBACA,UAAU,oBAAoB;;WAGrB;WACA;;aAEE;;;;;;;aAOA,sBAAsB;;aAEtB;;aAEA;;aAEA;;;EAGX,SACE,QAAQ,QACR,SAAS,qBAAqB,KAC7B,wBAAwB,QAAQ;;EAEnC,UAAU,QAAQ,QAAQ,MAAM,2BAA2B;;EAE3D,QACE,KAAK,6BACK,eAAe,iBAAiB;;;;;;KAOlC,UAAU,UAClB,oBAAoB,eACpB,KAAK,oBAAoB,gBACzB;UAEa,YAAY;WAClB,QAAQ,UAAU;WAClB,QAAQ;WACR;;WAEA;;WAEA;;KAEC,kBACR;WACW,gBAAgB;;WAChB,gBAAgB;;KAEnB;WACG;;WAEA;WACA;WACA;WACA;WACA;;UAGE,qBACf,UAAU,oBAAoB;WAErB,WAAW;WACX;WACA;WACA,SAAS;WACT,SAAS;WACT;aAAqB;aAAyB;;EACvD,MAAM;WACG;aAAoB,OAAO;aAAe;;WAC1C,MAAM;;;;;EAKf,KAAK,GAAG,+BAA+B,eAAe,QAAQ,KAAK,QAAQ;;EAE3E,QAAQ,cAAc;WACb,WAAW;;UAGL;WACN,MAAM;WACN,SAAS;WACT"}

package/dist/{auth-contracts-mejJfv9d.d.cts → auth-contracts-bhMN9XB3.d.mts}

@@ -1,10 +1,8 @@
-import { IncomingHttpHeaders, IncomingMessage } from "node:http";
-import { CallHandler, CanActivate, DynamicModule, ExecutionContext, InjectionToken, Logger, LoggerService, ModuleMetadata, NestInterceptor, OptionalFactoryDependency, Provider, Type } from "@nestjs/common";
+import { CallHandler, CanActivate, DynamicModule, ExecutionContext, InjectionToken, IntrinsicException, Logger, LoggerService, ModuleMetadata, NestInterceptor, OptionalFactoryDependency, Provider, Type } from "@nestjs/common";
 import { AbstractHttpAdapter, DiscoveryService, HttpAdapterHost, ModuleRef, Reflector } from "@nestjs/core";
-import "@nestjs/core/injector/instance-wrapper.js";
-import { HookEndpointContext } from "better-auth";
-import { IntrinsicException } from "@nestjs/common/exceptions/intrinsic.exception.js";
 import { Observable } from "rxjs";
+import { IncomingHttpHeaders, IncomingMessage } from "node:http";
+import { HookEndpointContext } from "better-auth";
 //#endregion
 //#region src/auth-errors.d.ts
 type AuthErrorCode = "UNAUTHENTICATED" | "FORBIDDEN" | "RATE_LIMITED";
@@ -958,8 +956,13 @@ interface DbHookOptions {
   instance?: string;
 }
 type HookPredicate = (ctx: AuthHookContext) => boolean;
-type HookMethodDecorator<P extends string> = <T>(target: object, key: string | symbol, descriptor: TypedPropertyDescriptor<(ctx: AuthHookContext<P>) => T>) => void;
-type DbHookMethodDecorator<E extends DatabaseHookTarget, Ph extends "before" | "after"> = (target: object, key: string | symbol, descriptor: TypedPropertyDescriptor<DatabaseHookMethod<E, Ph>>) => void;
+/**
+ * The decorated method type M is inferred and constrained rather than fixed: TypedPropertyDescriptor is invariant, so a fixed
+ * descriptor type would reject sound methods that declare fewer parameters or return a narrower result.
+ */
+type HookMethodDecorator<P extends string> = <M extends (ctx: AuthHookContext<P>) => unknown>(target: object, key: string | symbol, descriptor: TypedPropertyDescriptor<M>) => void;
+/** Constrains the decorated method like HookMethodDecorator; the SDK's payload, context and result types still apply. */
+type DbHookMethodDecorator<E extends DatabaseHookTarget, Ph extends "before" | "after"> = <M extends DatabaseHookMethod<E, Ph>>(target: object, key: string | symbol, descriptor: TypedPropertyDescriptor<M>) => void;
 type DatabaseHookTarget = `${"user" | "session" | "account" | "verification"}.${"create" | "update" | "delete"}`;
 interface CorsOriginOptions {
   /** Also honor wildcard (`https://*.vercel.app`) and custom-scheme trusted origins for credentialed CORS. Default false: exact origins only. */
@@ -1660,4 +1663,4 @@ interface PolicyBootContext {
 }
 //#endregion
 export { PrincipalDelegation as $, ErrorMappingOptions as $n, SESSION_PRINCIPAL_KIND as $t, DatabaseHookTarget as A, BetterAuthService as An, GetSessionWithHeaders as At, HookOptions as B, WS_CONNECTION_AUTH as Bn, UnvalidatedBody as Bt, ConformanceCase as C, defineHttpPlatform as Cn, AuthPrincipal as Ct, CookieForwardingOptions as D, allow as Dn, DatabaseHookMethod as Dt, ConformanceSkip as E, BetterAuthGuard as En, DatabaseHookData as Et, ExtensionDefinition as F, BetterAuthModule as Fn, Register as Ft, InboundAuthRequest as G, AuthErrorBody as Gn, betterAuthCorsOrigin as Gt, HttpMountOptions as H, getBetterAuthInstanceToken as Hn, WithActiveOrganization as Ht, ExtensionRef as I, GUARD_CORE as In, RegisteredAuth as It, PlatformMountContext as J, AuthFailures as Jn, definePrincipalSource as Jt, InvocationLineage as K, AuthErrorCode as Kn, absent as Kt, FastifyPlatformOptions as L, POLICY_INVOKER as Ln, RegisteredInstances as Lt, DbHookOptions as M, InstanceLookup as Mn, OrgPermissions as Mt, DefaultInstanceCheck as N, EXTENSION_DEFINITION as Nn, PrincipalKind as Nt, CookieSink as O, definePolicy as On, DatabaseHookResult as Ot, ExpressPlatformOptions as P, UPGRADE_REQUEST as Pn, PrincipalOfKind as Pt, PolicyRef as Q, BetterAuthInfrastructureError as Qn, RequireFreshSession as Qt, GuardReach as R, PRINCIPAL_RESOLVER as Rn, SessionOf as Rt, ClaimOptions as S, defineExtension as Sn, AuthOf as St, ConformanceRunner as T, BetterAuthScopeInterceptor as Tn, AuthUser as Tt, HttpPlatform as U, getBetterAuthOptionsToken as Un, PrincipalKinds as Ut, HookPredicate as V, getBetterAuthHandleToken as Vn, UserOf as Vt, HttpRequestAccessor as W, getBetterAuthServiceToken as Wn, httpTransport as Wt, PolicyBootContext as X, AuthTransportErrorPayload as Xn, CurrentSession as Xt, PlatformPrepareContext as Y, AuthGraphqlExtensions as Yn, rejected as Yt, PolicyInvoker as Z, BetterAuthConfigurationError as Zn, CurrentUser as Zt, BetterAuthRuntimeOptions as _, allOf as _n, TransportValidationContext as _t, AuthHandlerInterceptor as a, BeforeAuth as an, ProxyTrust as at, BootAdviceContext as b, definePrincipalParam as bn, AuthHookContext as bt, AuthTransport as c, ForwardAuthCookies as cn, RequirementOptions as ct, AuthorizationLimits as d, Require as dn, ScopeInit as dt, freshSession as en, getRawCause as er, PrincipalReading as et, AuthorizationPolicy as f, RequireAuth as fn, SessionOption as ft, BetterAuthModuleOptions as g, UseBetterAuth as gn, TransportKit as gt, BetterAuthModuleAsyncOptions as h, UseAuthInstance as hn, TransportCall as ht, AuthHandle as i, AfterDatabase as in, PrincipalSource as it, DbHookMethodDecorator as j, TransportRegistry as jn, IsRegistered as jt, CorsOriginOptions as k, deny as kn, EndpointPath as kt, AuthorizationContext as l, OptionalAuth as ln, ResolutionRequest as lt, BetterAuthFactoryResult as m, SkipOriginCheck as mn, StaticOptionMustBePassedToForRootAsync as mt, ApplicationRouteDescriptor as n, AcceptPrincipals as nn, isConfigurationError as nr, PrincipalResolver as nt, AuthPrincipalBase as o, BeforeDatabase as on, Requirement as ot, BetterAuthAppOptions as p, SkipDefaultRequirements as pn, SessionPrincipalOptions as pt, OriginCheckOptions as q, AuthFailure as qn, authenticated as qt, AuthContextView as r, AfterAuth as rn, isInfrastructureError as rr, PrincipalResult as rt, AuthRouteBinding as s, CurrentPrincipal as sn, RequirementExpr as st, AdvisedHandler as t, sessionPrincipal as tn, isAuthFailure as tr, PrincipalRequest as tt, AuthorizationDecision as u, Public as un, RoutePlan as ut, BetterAuthStaticOptions as v, anyOf as vn, AdminPermissions as vt, ConformanceOutcome as w, defineTransport as wn, AuthSession as wt, BrowserExposure as x, requirement as xn, AuthLike as xt, BootAdvice as y, defineInvocationParam as yn, AuthAfterHookContext as yt, HookMethodDecorator as z, SCOPE_CORE as zn, SessionPrincipal as zt };
-//# sourceMappingURL=auth-contracts-mejJfv9d.d.cts.map
+//# sourceMappingURL=auth-contracts-bhMN9XB3.d.mts.map

package/dist/auth-contracts-bhMN9XB3.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-contracts-bhMN9XB3.d.mts","names":[],"sources":["../src/auth-errors.ts","../src/auth-tokens.ts","../src/auth-module.ts","../src/bridge-protocol.ts","../src/request-scope.ts","../src/origin-check.ts","../src/instance-registry.ts","../src/mount-coordinator.ts","../src/principal-readings.ts","../src/policy-resolver.ts","../src/transport-registry.ts","../src/route-planner.ts","../src/auth-service.ts","../src/authorization-evaluator.ts","../src/auth-guard.ts","../src/auth-scope-interceptor.ts","../src/auth-module-definition.ts","../src/auth-decorators.ts","../src/session-principal.ts","../src/principal-resolver.ts","../src/auth-exchange.ts","../src/http-transport.ts","../src/index.ts","../src/auth-types.ts","../src/auth-contracts.ts"],"mappings":";;;;;;;KAkBY;;UAGK;WACN;WACA,MAAM;WACN;WACA;WACA;WACA,UAAU;;UAGJ;EACf;EACA;EACA,MAAM;EACN;EACA;;UAGe;EACf,MAAM;EACN;EACA;;UAGe;EACf;EACA;EACA,MAAM;EACN;EACA;;UAGe;EACf,OACE,SAAS,aACT,SAAS,kBACT;EAEF;;iBAQc,cAAc,iBAAiB,SAAS;iBAIxC,sBACd,iBACC,SAAS;iBAII,qBACd,iBACC,SAAS;iBAqDH,UAAU;EACjB;EACA;EACA;EACA;EACA;IACE;cA6BS;EACX,gBAAe,mBAAoB;EAGnC,iBAAQ;EACR,UAAS,gBAAe,mBAAqB;EAG7C,aAAY,iBAAkB;;cA4BnB,qCAAqC;WACvC;WACA;WACA;WACA;WACA;WACA;aACP;aACA;aACA;;WAEO,kBAAkB;EAE3B,YAAY,cAAc,gBAAgB;SAUnC,UACL,cACA,gBACA;IAAY;IAAe;MAC1B;;cAeQ,sCAAsC;WACxC,OAAO;WACP;aACP;aACA;aACA;;EAGF,YAAY,gBAAgB;IAAY;;;iBAwB1B,YAAY,OAAO;;;;iBC7QnB,2BAA2B;iBAI3B,0BAA0B;iBAI1B,0BAA0B;iBAI1B,yBAAyB;cAK5B;cAGA;cAGA;cAGA;cAGA;cAGA;cAGA;cAGA;cACA;cACA;cAGA;cAGA;cACA;cACA;cACA;cAGA;cAGA;cAGA;cAGA;cAGA;cAGA;cAGA;cAGA;cAGA;cAGA;cACA;cAGA;;cAEA;iBAIG,yBAAyB;iBAMzB,kBACd,kDACA,kBACA;cAOW;cAGA;;;cCvGA;SACJ,QAAQ,UAAU,WAAW,gBAClC,SAAS,wBAAwB,KAC/B;IAAyB;MAAqB,qBAAqB,KACpE;SACI,QAAQ,UAAU,UACvB,SAAS,wBAAwB;IAAO;MAAiB,eACxD;SAWI,aAAa,UAAU,WAAW,gBACvC,SAAS,6BAA6B,KACpC;IAAyB;MAC1B;SACI,aAAa,UAAU,UAC5B,SAAS,6BAA6B;IAAO;MAAiB,eAC7D;;;;cC/BQ;cAGA;UAII;WACN;WACA;;WAEA;;WAEA;;;;;;;;EAQT,KAAK,SAAS;IAAkB;IAAe;;;EAE/C,mBAAmB;;UAEJ;;WAEN;aAAkB;;;WAElB;;EAET;;EAEA,WAAW;;WAEF;WACA,iBAAiB;WACjB,gBAAgB;WAChB,UAAU,YAChB,KAAK;aACK,iBAAiB,mBAAmB;aACpC,gBAAgB,mBAAmB;;;EAIhD,UAAU;;UAEK;;WAEN,SAAS;WACT;WACA,gBAAgB;WAChB;;;;;;;WAOA,sBAAsB,cAAc;;;WAGpC,uBAAuB;;UAEjB;;;;;;;;EAQf,QAAQ,KAAK,qBAAqB,OAAO;EACzC,IAAI,KAAK,sBAAsB;;;;UC9DhB;WACN,MAAM;WACN,OAAO;WACP,OAAO;WACP,gBAAgB;;UAEV;WACN,WAAW,YAAY,QAAQ;WAC/B,UAAU,YAAY;WACtB,WAAW,YAAY,QAAQ;WAC/B,QAAQ;WACR,oBAAoB;WACpB,SAAS,YAAY,QAAQ;WAC7B,UAAU;WACV,aAAa;IAGlB,OAAO,QAAQ;MAAmB;;IAClC;;;cAmCO;;EAOX,IAAI,GAAG,OAAO,YAAY,UAAU,IAAI;EAIxC,KAAK,GAAG,UAAU,IAAI;EAItB,WAAW;EAIX,SAAS,cAAc;EAkBvB,cACE,MAAM,KAAK,yDACX;IACE;IACA;IACA;KAEF,eAAe,QAAQ,mBACtB,QAAQ;EAqCX,aAAa,GACX,iBACA,kBACA,qBACA,eAAe,QAAQ,IACvB,yBACC,QAAQ;EA0BX,aACE,oBACA,kBACA,qBACA,eAAe,QAAQ,yBACtB,QAAQ;EAWX,SAAS,kBAAkB;EAc3B,SACE,aACA,eACA;IAAW;IAAkB;IAAc,UAAU;;;;;;cCnL5C;;mBAOQ;EADnB,YACmB;IACf,KAAK;IACL,MAAM;;EAIV,OACE,kBACA,SAAS,aACT,SAAS,SACT;EA6BF,gBACE,kBACA,SAAS,SACT;;UAWa;WACN;WACA,SAAS;WACT,UAAU;WACV,cAAc;WACd;WACA;;cAGE;;mBAKQ;mBACA;EAFnB,YACmB,OAAO,cACP,MAAM;EAKzB,MACE,SAAS,iBACT,0BACC,QAAQ;EAiEL,SAAS,SAAS,kBAAkB;EAkB1C,oBACE,SAAS,iBACT,cACA;UAuBM;UAkBM;;;;UCnLC;WACN;WACA,UAAU;WACV,SAAS,yBAAyB;WAClC,eAAe;WACf,kBAAkB;WAClB,QAAQ;WACR,SAAS;WACT,QAAQ;WACR,QAAQ;WACR;;UAEM;EACf,IAAI,eAAe;EACnB,iBAAiB;;UAEF;WACN;WACA,UAAU;WACV,SAAS,yBAAyB;WAClC,eAAe;WACf,YAAY;WACZ,kBAAkB;WAClB,QAAQ;;cAgBN,4BAA4B;;mBASa;WAN3C,QAAM;WACN,aAAW;EACpB;EACA,SAAS;EACT;IAAU;;EAEV,YAAoD,OAAO;EAE3D,SACE,SAAS,yBAAyB,WAClC,eAAe,yBACf,kBAAkB,mBAClB,YAAY,uBACX;EAiBH,0BAA0B;EAI1B,IAAI,eAAe;EAYnB,iBAAiB;EAIjB,MAAM,SAAS;EAmBT,WAAW,QAAQ,iCAAiC;EAyK1D;;;;cClTW;;WAUyB,MAAM;mBACI;WAVrC,QAAM;EAQf,YACoC,MAAM,iBACI,UAAU,kBAC/B,OAAO;EAMhC,kBAAkB,oBAAoB;MAKlC,YAAY;MAIZ,WAAW;UAIP;EAqDR,cAAc,QAAQ;EAmBtB,QAAQ,QAAQ;EAyEhB,MAAM,mBAAmB;EAMzB,QAAQ,eAAe;EAIvB,qBAAqB;EAIrB,0BAA0B;EAO1B,0BACE,iBAAiB,8BACjB,QAAQ;EAkBJ,SAAS;EAwBf;;;;UChQe;WACN;WACA,OAAO;WACP,UAAU;WACV,OAAO,KAAK;WACZ;WACA;;;cAwEE,4BAA4B;EACvC,YAAY,OAAO;;cAMR;mBACkB;EAA7B,YAA6B,OAAO;EAEpC,OACE,MAAM,KAAK,0CACX,SAAS;EAUX,cAAc,SAAS,mBAAmB,SAAS;EAMnD,UACE,SAAS,mBACT,2BACC;EAWH,KAAK,OAAO,eAAe;EA0E3B,WAAW;EAWX,QAAQ,GACN,SAAS,kBACT;IACE;IACA;IACA;IACA,UAAU,WAAW,kBAAkB;KAEzC,QAAQ,eACP;EAqBH,QACE,OAAO,8BACP,QAAQ,cACR,oBACC,+BAA+B;EAmBlC,MACE,0BACA,kBACA,QAAQ;;;;cC5RC;mBAMkB;mBALZ;EAKjB,YAA6B,WAAW;EAExC,QAAQ,GAAG,WAAW,UAAU,KAAK,oBAAoB;;;;cCJ9C;UACH;mBACS;UACT;EAER,SAAS,qBAAqB;EAI9B,OAAO,KAAK;EAIZ,iBAAiB;EAKjB,iBAAiB,QAAQ,UAAU;EAUnC,KAAK,SAAS,mBAAmB;EAIjC,OAAO,SAAS,mBAAmB;EAWnC,KAAK,MAAM;EAIX,SACE,SAAS,kBACT,YAAS,gBACR;;;;cCHQ;mBAKQ;mBACA;mBACA;mBALF;EAEjB,YACmB,WAAW,gBACX,UAAU,gBACV,YAAY;UAGvB;EAiGR,eAAe,QAAQ,MAAM,0BAA0B;EAIvD,WAAW,SAAS,mBAAmB;EAiBvC,KAAK,QAAQ,MAAM,iBAAiB;;;;cCzJzB,kBAAkB,UAAU,WAAW;;mBAQJ;mBACJ;mBACK;mBACL;mBACK;mBACD;WAZrC;WACA,UAAU;WACV,KAAK;EAGd,YACuC,SAAS,yBAAyB,IAC3B,UAAU,kBACd,OAAO,cACF,UAAU,mBACf,SAAS,cACJ,YAAY,mBACb,aAAa;EAiB3D,WAAW,QAAQ,QAAQ;EAI3B;aAEe;aACA;aACA;;EAcf,gBAAgB,QAAQ;EAUxB,cAAc,QAAQ,UAAU;EAIhC,aAAa,SAAS,mBAAmB;EAiBzC,YAAY,2BAA2B;EA0BvC,sBAAsB,GAAG,UAAU,QAAQ,KAAK,QAAQ;EA0BxD,eAAe,GAAG,UAAU,QAAQ,KAAK,QAAQ;EAiBjD,gBAAgB,GAAG,UAAU,QAAQ,KAAK,QAAQ;;;;cCxJvC,aAAY;cACZ,OAAI;EACf;EACA;EACA;EACA;MACE;iBACY,aAAa,GAAG,UAAU,gBAAgB,eACxD,QAAQ,oBAAoB,GAAG,gBAAgB,OAC7C,QAAQ,GAAG,UAAU,uBAAuB,YAAY;cAY/C;mBAIQ;mBACA;mBACA;mBACA;mBANF;EAEjB,YACmB,UAAU,gBACV,SAAS,eACT,UAAU,mBACV,OAAO;EAGpB,SACJ,MAAM,WACN,WAAW,eACX,MAAM,eACN,OAAO,eACP,WAAW,kBACX,oBACC,QAAQ;;;;cCxCA,2BAA2B;mBAKC;mBAJtB;YACP;EAEV,YACuC,MAAM,KAAK;EAGlD,YAAY,SAAS,mBAAmB;;cAI7B,qBAAqB;mBAEb;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;EAPnB,YACmB,WAAW,gBACX,SAAS,cACT,YAAY,mBACZ,UAAU,mBACV,WAAW,wBACX,OAAO,cACP,UAAU;EAGvB,YAAY,SAAS,mBAAmB;;;;cChCnC,sCAAsC;mBAKV;mBAJtB;YACP;EAEV,YACuC,MAAM,KAAK;EAGlD,UAAU,SAAS,kBAAkB,MAAM,cAAc;;cAI9C,qBAAqB;mBAEb;mBACA;mBACA;mBACA;mBACA;EALnB,YACmB,WAAW,gBACX,SAAS,cACT,YAAY,mBACZ,OAAO,cACP,UAAU;EAG7B,UAAU,SAAS,kBAAkB,MAAM,cAAc;;;;iBCc3C,gBAAgB,GAC9B,YAAY,KAAK,oBAAoB,WAAW,wBAC/C,oBAAoB;iBAGP,mBAAmB,UAAU,cAAc,UAAU,IAAI;iBAGzD,gBAAgB,UAAU,eAAe,WAAW,IAAI;;;cCtB3D,uCAAM,uBAAA;cACN,6CAAY,uBAAA;cAEZ,cAAW;EAAgB;OAAyB,kBAAA,UAAA,GAAA,QAAA,oBAAA,+BAAA,aAAA,wBAAA;cAKpD,kBAAe,0CAAgB,uBAAA;cAE/B,sBAAgB,iBACP,kBAAkB,8CAAgB,uBAAA;cAE3C,wDAAuB,uBAAA;cAEvB,qBAAkB,+CAAA,uBAAA;cAElB,gDAAe,uBAAA;cAEf,sBAAa,kBAAA,UAAA,GAAA,QAAA,oBAAA,+BAAA,aAAA,wBAAA;iBAMV,WACX,uBAAuB,oBACzB,iBAAiB;cAeP,WAAK,uBACU,sBACzB;cACU,WAAK,uBACU,sBACzB;cACU,cAAe,GAAC,QACnB,UAAU,IAAE,QACZ,GAAC,UACC,uBACT,YAAY;cAyEF,wBAAuB;iBACpB,qBAAqB,UAAU,eAAe,GAAG;WACtD,MAAM;WACN;WACA,UAAU,WAAW,gBAAgB,OAAO;UAC7C;iBAGM,sBACd,cACA;WAAiB;UACV;cA4GI,mBAAoB,UAAU,8BAA4B,QAC7D,aAAa,MAAM,eAAa,UAC9B,gBACT,oBAAoB;cACV,kBAAmB,UAAU,8BAA4B,QAC5D,aAAa,MAAM,eAAa,UAC9B,gBACT,oBAAoB;cAqBV,iBAAkB,UAAU,oBAAkB,QACjD,GAAC,UACC,kBACT,sBAAsB;cAEZ,gBAAiB,UAAU,oBAAkB,QAChD,GAAC,UACC,kBACT,sBAAsB;;;cC3SZ;cACA,sBAAc;cAKd,mBAAW;iBAgBR,iBAAiB,IAAI,aACnC,UAAS,wBAAwB,KAChC,gBAAgB,iBAAiB;cAyLvB,eAAY;EACZ;MACV;EAAc;;cAIJ,sBAAmB;EAC9B;MACE,iBAAiB;;;cC1NR,wBAAyB,UAAU,mBAAiB,QACvD,gBAAgB,OACvB,gBAAgB;cACN,gBAAiB,UAAU,mBAAiB,WAC5C,MACV,gBAAgB;cACN,cAAa;cACb,WAAQ,SAAa,gBAAc;;;;iBCkShC,qBACd,MAAM,UACN,UAAU,qBAEV,4BACA,KAAK,KAAK,cAAc;;;iBC9IV,iBAAiB,aAAa;;;;UCjL7B;EACf,SAAS;;;;;UCIM;EACf,QAAQ,SAAS,UAAU,QAAQ;EACnC;IACE,WAAW;MACT,SAAS;MACT;QAAU;QAA8B;;MACxC;QACE;;EAEN,UAAU;;;UAGK;WACN,UAAU;WACV;;;UAKM;KACL,eAAe;EAAmB,MAAM;;KACxC,iBAAiB;EAAmB,YAAY,UAAU;IAClE,IACA;KACQ,sBAAsB;EAChC,iBAAiB,UAAU,eAAe;IAExC,IACA;KACQ,OAAO,gCAAgC,sBAC/C,iBACA,gBAAgB,sBACd,oBAAoB,KACpB;;KAGD;EACH,+BAA+B;EAC/B,4BAA4B;;KAElB,UAAU,KAAK;EAAY;IAAU,eAAe;;IAC5D,YAAY,KACZ;KACQ,OAAO,KAAK,UAAU;EAAa,YAAY;IAAM;KACrD,YAAY,gCAAgC,UAAU,OAAO;KAC7D,SAAS,gCAAgC,OAAO,OAAO;KACvD,UAAU,KAAK;EAAY;IAAQ;;;KAG1C,OAAO,KAAK,YAAW,WAAW,kBAClC,YAAY;EAAe,aAAa;KACvC,YAAY;KAGb,cAAc,GAAG,oBAAoB;EACxC,QAAQ,KAAK,UAAU;IAErB,OAAO;EAAa,oBAAoB;IACtC,YAAY;KAGN,iBAAiB,gCAC3B,4BACI,cAAc,OAAO,2BACrB;KACM,eAAe,gCACzB,4BACI,cAAc,OAAO,uBACrB;KAID,MAAM,KAAK;EAAY,WAAW;IAAQ;KACnC,aAAa,IAAI,qBAC1B,WAAW,MAAM,KAAK,MAAM,GAAG;EAAa,YAAY;IACrD,mBAEE,MAAM;KACT,WAAW,kBAAkB,IAAI,qBACnC,WAAW,MAAM,KAAK,MAAM,GAAG;EAAa,MAAM;IAAM,MAAM,GAAG,oBAC5D,MAAM;KACT,OAAO,qBAAqB,WAAW,gCAExC,OAAO,WAAW;;;;;KAKV,gBAAgB,MAAM,+BAE9B,+BACc,WAAW,kBAAiB,SAAS;KAE3C,gBAAgB,6BAA6B,2BACjC;EAElB,MAAM;EAAG,qBAAqB,cAAc,gBAAgB,OAAO;;KAC7D,qBAAqB,6BAC/B,gBAAgB;KAIb,UAAU,kCACS;KAEnB,SACH,UAAU,oBACV,iCACE,mBAAmB,gBAAgB,0BAA0B,6CAC7D,YAAY,YAAY,YAAY,QAAQ,IAAI,IAAI;;KAGnD,cAAc,KAAK,mBACpB,OAAO,kBACP,sBACE,UAAU;EAA0B,eAAe;IACjD;KAGH,YAAY,UAAU,sBACzB,mBAAmB,WAAW,OACzB,cAAc,sBACb,uBACA,qBACE,QAAQ,cAAc,MACtB,cAAc,KAClB;;KAEM,iBACV,UAAU,oBACV,4CACE,WAAW,SAAS,GAAG,UAAU,YAAY;;KAErC,mBACV,UAAU,oBACV,iCACE,QAAQ,WAAW,SAAS,GAAG;KACvB,mBACV,UAAU,oBACV,kCAEA,MAAM,iBAAiB,GAAG,KAC1B,2BAA2B,8CACxB,mBAAmB,GAAG,MAAM,QAAQ,mBAAmB,GAAG;;KAGnD,uBAAuB,KAAK;EACtC;IAAW;;;KAID,sBAAsB;KACtB,gBAAgB,eAAe;KAC/B,gBAAgB,UAAU,iBAAiB,eAAe;UACrD,iBAAiB,IAAI,qBAAqB;WAChD;WACA,SAAS;;;;UC7HH;;EAEf,qBAAqB,aAAa;;EAElC,sBAAsB,aAAa;;KAEzB;WACD;WACA;;;UAIM;;EAEf;;EAEA;;;;;EAKA;;;;;;;EAOA;;EAEA,sBAAsB,aAAa;;;KAIzB,yBAAyB,UAAU,WAAW;;EAExD,MAAM;;EAEN;;;;;;;;EAQA,+BAA+B;;EAE/B,OAAO;;EAEP,UAAU;;EAEV,cAAc;;EAEd,SAAS;;EAET,SAAS;;EAET;IACE,cAAc;UAED;;;;;;EAMf;;UAGe;;;;;;;;;EASf;;UAGe;;;;;EAKf;;;;;;;;EAQA;;;KAIU,cAAc,UAAU,YAClC,UAAU,UAAU;EACd,UAAU,wBAAwB,UAAU;;EAE5C,UACK,wBAAwB,UAAU;IACjC,SAAS,GAAG,UAAU;;;UAKnB,wBAAwB;;EAEvC,UAAU,SAAS;;EAEnB;;;;;;;EAOA;;UAGe;;EAEf;;EAEA;;EAEA,kBAAkB;;EAElB;;;;;;EAMA;;EAEA;;KAGU,0BACV;WACW,SAAS;WACT;WACA;GAEX,OAAO,UAAU,YAAY,QAAQ,cAClC,QAAQ;KAED,wBAAwB,UAAU,YAC5C,0BAA0B,yBAAyB;UAEpC,6BAA6B,UAAU,kBAC9C;EACR,UAAU;EACV,mBAAmB,iBAAiB;EACpC,gBACK,gBACA,wBAAwB,KAAK,QAAQ,wBAAwB;;;KAIxD,wBAAwB,UAAU,YAC5C,yBAAyB,QACtB,YAAY,0BACX,yBAAyB,uCAAuC;UAErD,uCAAuC;WAC7C,aAAa;;;KAGZ,qBAAqB,KAAK,4BAClC,UAAU;EAEN,MAAM;;;KAKF,aAAa,KAAK,KAAK,KAAK,IAAI,oBAAoB;UAC/C,oBAAoB;YACzB;WACD;aACM,UAAU,KAAK;;aAEf,gBAAgB,gBAAgB,IAAI,QAAQ;aAC5C,kBAAkB;;aAElB,aAAa,eAAe;;WAClC,qBAAqB;WACrB,UAAU;;WAEV,mBAAmB;;UAGb;WACN;;;;;;;WAOA;;WAEA;;;;;WAKA,uBAAuB;;WAEvB;;;;;;WAMA;;WAEA;;WAEA,SAAS;;WAET;aACE;aACA;;;;;;;WAOF;;WAEA;;WAEA;WACA;;KAKC,oBACR;WACW;;WACA;;;;;;UAME;EACf,QACE,MAAM,eACN,SAAS,oBACR,QAAQ;;UAEI;WACN,MAAM;WACN;;WAEA,SAAS;;WAET;;;;;;WAMA;aAAwB;;;;UAIlB;EACf,OAAO,GACL,QAAQ,oBAAoB,SAC5B,QAAQ,GACR,SAAS,uBACR,QAAQ;;UAGI;WACN;;WAEA,sBAAsB;;WAEtB;;UAGM;;EAEf;;EAEA;;EAEA;;EAEA;;UAEe;EACf;EACA;;KAEU,iBAAiB,KAAK;;;;;KAKtB,oBAAoB,qBAC9B,WAAW,KAAK,gBAAgB,gBAEhC,gBACA,sBACA,YAAY,wBAAwB;;KAG1B,sBACV,UAAU,oBACV,kCACG,UAAU,mBAAmB,GAAG,KACnC,gBACA,sBACA,YAAY,wBAAwB;KAE1B;UAGK;;EAEf;;UAae;;EAEf,YAAY,KAAK;IAAoB;;;UAGtB;;EAEf,YAAY;IAAW;IAAa,KAAK;;;UAiJ1B;WACN;WACA;;WAEA;;;;;EAKT,OAAO,QAAQ;;;UAIA;WACN;;;KAKC,4BAA4B;UAEvB;EACf,SAAS,cAAc;;;;;EAKvB,GAAG,cAAc,KAAK,sBAAsB;;UAG7B;WACN;;WAEA;WACA;WACA;;UAEM;WACN;WACA,MAAM;;WAEN,SAAS;;WAET;WACA;;WAEA;aACE;aACA;;;WAGF,mBAAmB;WACnB;aACE;aACA;;WAEF,kBAAkB,KACzB;;WAIO,mBAAmB,KAAK;;UAElB;WACN,MAAM;;WAEN;;WAEA;;UAGM;;WAEN;;;;;;WAMA;aACE;aACA;;;EAGX,SAAS,SAAS;;;;;;;;;EASlB,SAAS,KAAK;;;;;;;EAOd,MAAM,KAAK,8BAA8B;;WAEhC,UAAU;;EAEnB,YAAY,SAAS,sBAAsB;;EAE3C,UAAU,SAAS;;;;;EAKnB,mBACE,iBAAiB,8BACjB,mBAAmB;;EAGrB,QACE,KAAK,6BACK,eAAe,iBAAiB;;UAG7B;;WAEN;;WAEA;;WAEA;;WAEA;;UAGM;;;;;;WAMN;WACA;;UAGM;WACN,SAAS;WACT,QAAQ;;EAEjB,MAAM,mBAAmB;;UAGV;WACN,SAAS;WACT,QAAQ;WACR,SAAS;;UAGH;WACN;;WAEA;WACA;;WAEA;;EAET,QAAQ;;;;;EAKR,OAAO,SAAS,qBAAqB,QAAQ;;EAE7C,mBAAmB;;UAGJ;WACN;;WAEA;;WAEA,SAAS;;WAET,MAAM,aAAa,eAAe;;WAElC;;WAEA;;WAEA,SAAS;;UAGH;;;;;;EAMf,UAAU;;;;;;;;EAQV,OAAO;;EAEP,IAAI;;EAEJ,QAAQ,eAAe;;EAEvB,QAAQ;aAA0B;aAAyB;;;EAE3D,SAAS;;EAET,MAAM,cAAc;;EAEpB,WAAW,cAAc,eAAe;;EAExC,aAAa;;UAGE;;EAEf,OAAO;;UAGQ;;WAEN;;;;;EAKT,QAAQ,SAAS;;;;;;EAMjB,SAAS,SAAS,kBAAkB,KAAK,eAAe;;EAExD,YAAY,SAAS,aAAa,SAAS;;;;;;;;EAQ3C,qBACE,OAAO,gCAAgC,8BACvC,SAAS,kBACT;aAAiB;;;;;;EAMnB,UAAU,KAAK,oCAAoC;;;;;;;;EASnD,kBAAkB,QAAQ,UAAU;;;;;;;EAOpC,SAAS,SAAS,mBAAmB;;WAE5B;aAAsB;;;EAE/B,QACE,KAAK,6BACK,eAAe,iBAAiB;;UAG7B;;;;;WAKN;;;;;;;;;;WAUA;;WAEA;;WAEA;;;;;;WAMA,UAAU;;;;;;EAMnB,WAAW;;WAEF;;WAEA,SAAS;;WAET;aAAqB;aAAyB;;;EAEvD,MAAM;;WAEG,UAAU;;UAGJ;;;;;;WAMN;;;;;EAKT,WAAW;;WAEF;;WAEA;;;UAIM;;WAEN;;;;;;;;WAQA;;;;;;;WAOA,YAAY,6BAA6B;;;;;;WAMzC,kBAAkB;;UAGZ;;WAEN,MAAM;;UAGA;WACN,WAAW;WACX,WAAW;WACX,WAAW;WACX;;WAGA,SAAS,QAAQ,UAAU,mBAAmB;;;;;EAKvD,MAEE,QAAQ,UACR,4BACA,OAAO,YACP,SAAS;WAEF,QAAQ;;;;;;;;;KASP;UACK;;WAEN;;WAEA;;WAEA;;WAEA;;;;;WAKA;;UAGM;WACN;;WAEA;;WAEA;;;;;WAKA,aAAa;;UAGP;;EAEf,OAAO,aAAa,SAAS;;WAEpB;;UAGM,gBAAgB,UAAU,oBAAoB;WACpD;;WAEA,gBAAgB;;;;;WAKhB;;;;;WAKA;;WAEA;aACE;aACA;;;;;;;;WAQF;;;;;;WAMA;;;;;WAKA;aACE;aACA;;;EAGX,WAAW,SAAS;;;;;EAKpB,QAAQ,SAAS,mBAAmB,QAAQ,gBAAgB;;EAE5D,QACE,KAAK,6BACK,eAAe,iBAAiB;;KAGlC,gBAAgB,UAAU,oBAAoB;WAC3C;WAAmC,WAAW;;WAC9C;;WACA;WAA8B,SAAS;;UAErC;WACN,SAAS;WACT,SAAS;WACT;WACA;aAAqB;aAAyB;;WAC9C;WACA,MAAM;;EAEf,KAAK,GAAG,+BAA+B,eAAe,QAAQ,KAAK,QAAQ;;;UAI5D,WAAW,UAAU,WAAW;WACtC;WACA,UAAU;WACV,KAAK;EACd,WAAW,QAAQ;EACnB,UAAU,aAAa;;EAEvB,IAAI,GAAG,MAAM,WAAW,UAAU,QAAQ,KAAK,QAAQ;;EAEvD,YACE,SAAS,iBACT,0BACC,QAAQ;;;;;EAKX,mBAAmB;;EAEnB,gBAAgB,gBAAgB,UAAU,UAAU;;UAErC;;WAEN,SAAS;;;;;WAKT;;WAEA,gBAAgB;;WAEhB;;;UAGM;WACN;WACA;WACA;WACA;;WAEA;;WAEA;aAAsB;;WACtB;aACE;aACA;aACA;aACA;;aAEA;eAAuB;;aACvB,uCAEH,UAAU;aACP;eACE;eACA;iBAAmB;;;aAErB;eAAwB;;aACxB;eACE;iBACE;iBACA;;eAEF;eACA;eACA;;;;WAIJ;IACP,aAAa,iBAAiB;eACnB;eACA;eACA;eACA,aAAa;;;WAGjB,aAAa,SACpB;aAGa;aACA;eACE;eACA;;;WAKR;aACE;aACA;aACA;;WAEF;IACP,QAAQ;MACN;MACA;QAAkB;QAAe;;QAC/B;IACJ,WAAW;MACT;MACA;QAAkB;QAAe;;MACjC,QAAQ;QACN;;EAEN,UAAU;EACV,UAAU;EACV,gBACE,aACA;IAAa;;;UAIA,oBACf,kBACA,UAAU,oBAAoB;;WAGrB;WACA;;aAEE;;;;;;;aAOA,sBAAsB;;aAEtB;;aAEA;;aAEA;;;EAGX,SACE,QAAQ,QACR,SAAS,qBAAqB,KAC7B,wBAAwB,QAAQ;;EAEnC,UAAU,QAAQ,QAAQ,MAAM,2BAA2B;;EAE3D,QACE,KAAK,6BACK,eAAe,iBAAiB;;;;;;KAOlC,UAAU,UAClB,oBAAoB,eACpB,KAAK,oBAAoB,gBACzB;UAEa,YAAY;WAClB,QAAQ,UAAU;WAClB,QAAQ;WACR;;WAEA;;WAEA;;KAEC,kBACR;WACW,gBAAgB;;WAChB,gBAAgB;;KAEnB;WACG;;WAEA;WACA;WACA;WACA;WACA;;UAGE,qBACf,UAAU,oBAAoB;WAErB,WAAW;WACX;WACA;WACA,SAAS;WACT,SAAS;WACT;aAAqB;aAAyB;;EACvD,MAAM;WACG;aAAoB,OAAO;aAAe;;WAC1C,MAAM;;;;;EAKf,KAAK,GAAG,+BAA+B,eAAe,QAAQ,KAAK,QAAQ;;EAE3E,QAAQ,cAAc;WACb,WAAW;;UAGL;WACN,MAAM;WACN,SAAS;WACT"}

package/dist/{auth-decorators-CQYu3gaF.mjs → auth-decorators-BO9T-1wp.mjs}

@@ -2,7 +2,7 @@ import { c as isConfigurationError, n as BetterAuthConfigurationError, t as Auth
 import { C as READER_CONTEXT, M as USE_BETTER_AUTH_METADATA, O as SKIP_DEFAULT_REQUIREMENTS_METADATA, T as REQUIREMENTS_METADATA, a as ACCESS_METADATA, b as PRINCIPAL_PARAMS_METADATA, c as DB_HOOK_METADATA, f as HOOK_METADATA, h as INVOCATION_VALUES, i as ACCEPT_PRINCIPALS_METADATA, k as SKIP_ORIGIN_CHECK_METADATA, l as FORWARD_COOKIES_METADATA, m as INVOCATION_PARAMS_METADATA, s as AUTH_INSTANCE_METADATA, u as FRESHNESS_METADATA } from "./decorate-DqI1OKmL.mjs";
 import { t as BetterAuthScopeInterceptor } from "./auth-scope-interceptor-C0NRu4uy.mjs";
 import { t as BetterAuthGuard } from "./auth-guard-CXsQR7Zd.mjs";
-import { t as PrincipalReadings } from "./principal-readings-O66hlCdW.mjs";
+import { t as PrincipalReadings } from "./principal-readings-B2fTGojh.mjs";
 import { SetMetadata, UseGuards, UseInterceptors, applyDecorators, createParamDecorator } from "@nestjs/common";
 import { AsyncLocalStorage } from "node:async_hooks";
 //#region src/request-scope.ts
@@ -274,4 +274,4 @@ const AfterDatabase = (target, options) => databaseHook("after", target, options
 //#endregion
 export { memoKey as C, RequestScope as S, anyOf as _, BeforeDatabase as a, readHookMetadata as b, OptionalAuth as c, RequireAuth as d, SkipDefaultRequirements as f, allOf as g, UseBetterAuth as h, BeforeAuth as i, Public as l, UseAuthInstance as m, AfterAuth as n, CurrentPrincipal as o, SkipOriginCheck as p, AfterDatabase as r, ForwardAuthCookies as s, AcceptPrincipals as t, Require as u, defineInvocationParam as v, requirement as x, definePrincipalParam as y };
 
-//# sourceMappingURL=auth-decorators-CQYu3gaF.mjs.map
+//# sourceMappingURL=auth-decorators-BO9T-1wp.mjs.map

package/dist/{auth-decorators-CQYu3gaF.mjs.map → auth-decorators-BO9T-1wp.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"auth-decorators-CQYu3gaF.mjs","names":["tokens.ACCESS_METADATA","tokens.FRESHNESS_METADATA","tokens.AUTH_INSTANCE_METADATA","tokens.ACCEPT_PRINCIPALS_METADATA","tokens.SKIP_DEFAULT_REQUIREMENTS_METADATA","tokens.FORWARD_COOKIES_METADATA","tokens.SKIP_ORIGIN_CHECK_METADATA","tokens.USE_BETTER_AUTH_METADATA","tokens.REQUIREMENTS_METADATA","tokens.READER_CONTEXT","tokens.PRINCIPAL_PARAMS_METADATA","tokens.INVOCATION_VALUES","tokens.INVOCATION_PARAMS_METADATA","tokens.HOOK_METADATA","tokens.DB_HOOK_METADATA"],"sources":["../src/request-scope.ts","../src/auth-decorators.ts"],"sourcesContent":["import { AsyncLocalStorage } from \"node:async_hooks\";\nimport type {\n  AuthorizationDecision,\n  InvocationLineage,\n  PrincipalReading,\n  PrincipalResult,\n  RoutePlan,\n  TransportCall,\n} from \"./auth-contracts.js\";\nimport {\n  AuthFailures,\n  type AuthFailure,\n  isConfigurationError,\n} from \"./auth-errors.js\";\nimport type { ScopeView } from \"./bridge-protocol.js\";\n\nexport interface ScopeState {\n  readonly view: ScopeView;\n  readonly call?: TransportCall;\n  readonly plan?: RoutePlan;\n  readonly reading?: () => PrincipalReading;\n}\nexport interface RequestState {\n  readonly principal: Map<string, Promise<PrincipalResult>>;\n  readonly policyIo: Map<string, Promise<unknown>>;\n  readonly decisions: Map<string, Promise<AuthorizationDecision>>;\n  readonly values: Map<symbol, unknown>;\n  readonly authorizationCalls: Set<string>;\n  readonly origins: Map<string, Promise<AuthFailure | null>>;\n  readonly surfaced: Set<string>;\n  readonly connections: Map<\n    string,\n    {\n      value: Extract<PrincipalResult, { outcome: \"authenticated\" | \"absent\" }>;\n      expiresAt: number;\n    }\n  >;\n}\n\nconst SURFACED = Symbol.for(\"nestjs-slightly-better-auth:surfaced\");\nexport function memoKey(\n  instance: string,\n  ...inputs: readonly unknown[]\n): string {\n  return JSON.stringify([instance, ...inputs]);\n}\n\n/** Shared by guards and readers that have only the transport's structural lineage. */\nexport function surfacedRecord(\n  key: object,\n  lineage?: InvocationLineage,\n): Set<string> {\n  const carrier = lineage?.carrier ?? key;\n  const partition = lineage ? lineage.position.split(\":\", 1)[0]! : \"\";\n  let records = Reflect.get(carrier, SURFACED) as\n    | Map<string, Set<string>>\n    | undefined;\n  if (!records) {\n    records = new Map();\n    Object.defineProperty(carrier, SURFACED, { value: records });\n  }\n  let record = records.get(partition);\n  if (!record) {\n    record = new Set();\n    records.set(partition, record);\n  }\n  return record;\n}\n\nexport class RequestScope {\n  readonly #storage = new AsyncLocalStorage<ScopeState>();\n  readonly #states = new WeakMap<object, RequestState>();\n  readonly #valueKeys = new Map<string, Map<symbol, symbol>>();\n  readonly #errorIds = new WeakMap<object, number>();\n  #nextError = 0;\n\n  run<T>(state: ScopeState, fn: () => T): T {\n    return this.#storage.run(state, fn);\n  }\n\n  exit<T>(fn: () => T): T {\n    return this.#storage.exit(fn);\n  }\n\n  current(): ScopeState | undefined {\n    return this.#storage.getStore();\n  }\n\n  stateFor(key: object): RequestState {\n    let state = this.#states.get(key);\n    if (!state) {\n      state = {\n        principal: new Map(),\n        policyIo: new Map(),\n        decisions: new Map(),\n        values: new Map(),\n        authorizationCalls: new Set(),\n        origins: new Map(),\n        surfaced: new Set(),\n        connections: new Map(),\n      };\n      this.#states.set(key, state);\n    }\n    return state;\n  }\n\n  memoPrincipal(\n    call: Pick<TransportCall, \"key\" | \"connection\" | \"principalTtlMs\">,\n    input: {\n      instance: string;\n      freshness: \"default\" | \"authoritative\";\n      sourceSet: string;\n    },\n    compute: () => Promise<PrincipalResult>,\n  ): Promise<PrincipalResult> {\n    const key = memoKey(input.instance, input.freshness, input.sourceSet);\n    const state = this.stateFor(call.key);\n    const existing = state.principal.get(key);\n    if (existing) {\n      return existing;\n    }\n    const connection =\n      call.connection &&\n      input.freshness !== \"authoritative\" &&\n      (call.principalTtlMs ?? 0) > 0\n        ? this.stateFor(call.connection).connections\n        : undefined;\n    const cached = connection?.get(key);\n    const promise = Promise.resolve().then(async () => {\n      if (cached && cached.expiresAt > Date.now()) {\n        return cached.value;\n      }\n      connection?.delete(key);\n      try {\n        const value = await compute();\n        if (value.outcome !== \"rejected\") {\n          connection?.set(key, {\n            value,\n            expiresAt: Date.now() + (call.principalTtlMs ?? 0),\n          });\n        }\n        return value;\n      } catch (error) {\n        connection?.delete(key);\n        throw error;\n      }\n    });\n    state.principal.set(key, promise);\n    return promise;\n  }\n\n  memoPolicyIo<T>(\n    request: object,\n    instance: string,\n    concreteKey: string,\n    compute: () => Promise<T>,\n    limit: number | false = 100,\n  ): Promise<T> {\n    const state = this.stateFor(request);\n    const key = memoKey(instance, concreteKey);\n    const existing = state.policyIo.get(key);\n    if (existing) {\n      return existing as Promise<T>;\n    }\n    if (\n      limit !== false &&\n      [...state.authorizationCalls].filter(\n        (entry) => JSON.parse(entry)[0] === instance,\n      ).length >= limit\n    ) {\n      return Promise.reject(\n        AuthFailures.rejected({\n          status: 429,\n          reason: \"TOO_MANY_AUTHORIZATION_CHECKS\",\n        }),\n      );\n    }\n    state.authorizationCalls.add(key);\n    const promise = Promise.resolve().then(compute);\n    state.policyIo.set(key, promise);\n    return promise;\n  }\n\n  memoDecision(\n    invocation: object,\n    instance: string,\n    concreteKey: string,\n    compute: () => Promise<AuthorizationDecision>,\n  ): Promise<AuthorizationDecision> {\n    const decisions = this.stateFor(invocation).decisions;\n    const key = memoKey(instance, concreteKey);\n    let promise = decisions.get(key);\n    if (!promise) {\n      promise = Promise.resolve().then(compute);\n      decisions.set(key, promise);\n    }\n    return promise;\n  }\n\n  valueKey(instance: string, key: symbol): symbol {\n    let keys = this.#valueKeys.get(instance);\n    if (!keys) {\n      keys = new Map();\n      this.#valueKeys.set(instance, keys);\n    }\n    let namespaced = keys.get(key);\n    if (!namespaced) {\n      namespaced = Symbol(key.description);\n      keys.set(key, namespaced);\n    }\n    return namespaced;\n  }\n\n  surfaced(\n    key: object,\n    error: object,\n    context: { instance: string; site: string; lineage?: InvocationLineage },\n  ): boolean {\n    let id = this.#errorIds.get(error);\n    if (!id) {\n      id = ++this.#nextError;\n      this.#errorIds.set(error, id);\n    }\n    const reason = isConfigurationError(error)\n      ? memoKey(context.instance, error.code, context.site)\n      : `error:${id}`;\n    const carrier = surfacedRecord(key, context.lineage);\n    const state =\n      key === context.lineage?.carrier ? carrier : this.stateFor(key).surfaced;\n    const repeated = state.has(reason) || carrier.has(reason);\n    state.add(reason);\n    carrier.add(reason);\n    return repeated;\n  }\n}\n","import {\n  applyDecorators,\n  createParamDecorator,\n  SetMetadata,\n  UseGuards,\n  UseInterceptors,\n  type ExecutionContext,\n} from \"@nestjs/common\";\nimport type {\n  DatabaseHookTarget,\n  DbHookMethodDecorator,\n  DbHookOptions,\n  HookMethodDecorator,\n  HookOptions,\n  HookPredicate,\n  PolicyRef,\n  PrincipalReading,\n  Requirement,\n  RequirementExpr,\n  RequirementOptions,\n} from \"./auth-contracts.js\";\nimport type {\n  EndpointPath,\n  PrincipalKind,\n  PrincipalOfKind,\n} from \"./auth-types.js\";\nimport { BetterAuthConfigurationError } from \"./auth-errors.js\";\nimport * as tokens from \"./auth-tokens.js\";\nimport { BetterAuthGuard } from \"./auth-guard.js\";\nimport { BetterAuthScopeInterceptor } from \"./auth-scope-interceptor.js\";\nimport { PrincipalReadings } from \"./principal-readings.js\";\nimport { RequestScope } from \"./request-scope.js\";\n\nfunction append(target: object, key: symbol, value: unknown): void {\n  Reflect.defineMetadata(\n    key,\n    Object.freeze([...(Reflect.getOwnMetadata(key, target) ?? []), value]),\n    target,\n  );\n}\nexport const Public = () => SetMetadata(tokens.ACCESS_METADATA, \"public\");\nexport const OptionalAuth = () =>\n  SetMetadata(tokens.ACCESS_METADATA, \"optional\");\nexport const RequireAuth = (options?: { authoritative?: boolean }) =>\n  applyDecorators(\n    SetMetadata(tokens.ACCESS_METADATA, \"required\"),\n    SetMetadata(tokens.FRESHNESS_METADATA, options?.authoritative === true),\n  );\nexport const UseAuthInstance = (name: string) =>\n  SetMetadata(tokens.AUTH_INSTANCE_METADATA, name);\nexport const AcceptPrincipals = (\n  ...kinds: readonly [PrincipalKind, ...PrincipalKind[]]\n) => SetMetadata(tokens.ACCEPT_PRINCIPALS_METADATA, Object.freeze([...kinds]));\nexport const SkipDefaultRequirements = () =>\n  SetMetadata(tokens.SKIP_DEFAULT_REQUIREMENTS_METADATA, true);\nexport const ForwardAuthCookies = (enabled = true) =>\n  SetMetadata(tokens.FORWARD_COOKIES_METADATA, enabled);\nexport const SkipOriginCheck = () =>\n  SetMetadata(tokens.SKIP_ORIGIN_CHECK_METADATA, true);\nexport const UseBetterAuth = () =>\n  applyDecorators(\n    SetMetadata(tokens.USE_BETTER_AUTH_METADATA, true),\n    UseGuards(BetterAuthGuard),\n    UseInterceptors(BetterAuthScopeInterceptor),\n  );\nexport function Require(\n  ...requirements: readonly RequirementExpr[]\n): ClassDecorator & MethodDecorator {\n  return (\n    target: object,\n    _key?: string | symbol,\n    descriptor?: PropertyDescriptor,\n  ) => {\n    for (const expression of requirements) {\n      append(\n        descriptor?.value ?? target,\n        tokens.REQUIREMENTS_METADATA,\n        expression,\n      );\n    }\n  };\n}\nexport const anyOf = (\n  ...requirements: readonly RequirementExpr[]\n): RequirementExpr => ({ anyOf: requirements });\nexport const allOf = (\n  ...requirements: readonly RequirementExpr[]\n): RequirementExpr => ({ allOf: requirements });\nexport const requirement = <P>(\n  policy: PolicyRef<P>,\n  params: P,\n  options?: RequirementOptions,\n): Requirement<P> => ({ policy, params, ...options });\n\nexport interface ReaderContext {\n  readonly args: readonly unknown[];\n  readonly readings: PrincipalReadings;\n  readonly scope: RequestScope;\n  readonly reading?: () => PrincipalReading;\n}\nexport function readerContext(context: ExecutionContext): ReaderContext {\n  const args = context.getArgs();\n  for (const arg of [args, ...args]) {\n    if (\n      (typeof arg !== \"object\" || arg === null) &&\n      typeof arg !== \"function\"\n    ) {\n      continue;\n    }\n    const bridge = Reflect.get(arg, tokens.READER_CONTEXT) as\n      | ReaderContext\n      | undefined;\n    if (\n      bridge &&\n      bridge.args.length === args.length &&\n      bridge.args.every((value, index) => value === args[index]) &&\n      bridge.reading !== undefined &&\n      bridge.scope.current()?.reading === bridge.reading\n    ) {\n      return bridge;\n    }\n  }\n  // No application state is created or retained by a DI-free lineage-only reader.\n  const scope = new RequestScope();\n  return { args, scope, readings: new PrincipalReadings(scope) };\n}\nfunction principalParam(spec?: {\n  kind: string;\n  reason: string;\n  project: (p: any) => unknown;\n}): ParameterDecorator {\n  const decorator = createParamDecorator(\n    (_data: unknown, context: ExecutionContext) => {\n      const bridge = readerContext(context);\n      const input = {\n        args: context.getArgs(),\n        site: `${context.getClass().name}.${context.getHandler().name}`,\n      };\n      const reading =\n        bridge.reading !== undefined &&\n        bridge.scope.current()?.reading === bridge.reading\n          ? bridge.readings.current()\n          : bridge.readings.read(input);\n      return bridge.readings.project(\n        reading,\n        { ...spec, site: input.site, project: spec?.project ?? ((p) => p) },\n        input,\n      );\n    },\n  )();\n  return (target, propertyKey, index) => {\n    if (propertyKey === undefined) {\n      throw new BetterAuthConfigurationError(\n        \"PRINCIPAL_PARAM_TARGET\",\n        \"Principal parameters require a handler method\",\n      );\n    }\n    const handler = Reflect.get(target, propertyKey);\n    append(handler, tokens.PRINCIPAL_PARAMS_METADATA, {\n      index,\n      ...(spec ? { kind: spec.kind, reason: spec.reason } : {}),\n    });\n    decorator(target, propertyKey, index);\n  };\n}\nexport const CurrentPrincipal = (): ParameterDecorator => principalParam();\nexport function definePrincipalParam<K extends PrincipalKind, R>(spec: {\n  readonly kind: K;\n  readonly reason: string;\n  readonly project: (principal: PrincipalOfKind<K>) => R;\n}): () => ParameterDecorator {\n  return () => principalParam(spec);\n}\nexport function defineInvocationParam(\n  slot: symbol,\n  spec: { readonly missing: string },\n): () => ParameterDecorator {\n  return () => {\n    const decorator = createParamDecorator(\n      (_data: unknown, context: ExecutionContext) => {\n        const bridge = readerContext(context);\n        const state = bridge.scope.current();\n        const input = {\n          args: context.getArgs(),\n          site: `${context.getClass().name}.${context.getHandler().name}`,\n        };\n        const reading = state?.reading\n          ? bridge.readings.current()\n          : bridge.readings.read(input);\n        const candidates = state?.call\n          ? [state.call.invocation]\n          : [input.args, ...input.args];\n        for (const candidate of candidates) {\n          if (\n            !candidate ||\n            (typeof candidate !== \"object\" && typeof candidate !== \"function\")\n          ) {\n            continue;\n          }\n          const values = Reflect.get(candidate, tokens.INVOCATION_VALUES) as\n            | Map<string, Map<symbol, unknown>>\n            | undefined;\n          if (values?.get(reading.instance)?.has(slot)) {\n            return values.get(reading.instance)!.get(slot);\n          }\n        }\n        throw bridge.readings.deliver(\n          BetterAuthConfigurationError.atRequest(\n            \"NO_INVOCATION_VALUE\",\n            spec.missing,\n            { site: input.site },\n          ),\n          input,\n          reading.instance,\n        );\n      },\n    )();\n    return (target, key, index) => {\n      if (key === undefined) {\n        throw new BetterAuthConfigurationError(\n          \"INVOCATION_PARAM_TARGET\",\n          \"Invocation parameters require a handler method\",\n        );\n      }\n      append(Reflect.get(target, key), tokens.INVOCATION_PARAMS_METADATA, {\n        index,\n        slot,\n        missing: spec.missing,\n      });\n      decorator(target, key, index);\n    };\n  };\n}\nexport interface EndpointHookDeclaration {\n  readonly phase: \"before\" | \"after\";\n  readonly match: string | readonly string[] | HookPredicate | undefined;\n  readonly options: Readonly<HookOptions>;\n  readonly method: string | symbol;\n  // biome-ignore lint/complexity/noBannedTypes: Nest handler metadata preserves the framework function identity.\n  readonly handler: Function;\n  readonly declarationOrder: number;\n}\nexport interface DatabaseHookDeclaration {\n  readonly phase: \"before\" | \"after\";\n  readonly target: DatabaseHookTarget;\n  readonly options: Readonly<DbHookOptions>;\n  readonly method: string | symbol;\n  // biome-ignore lint/complexity/noBannedTypes: Nest handler metadata preserves the framework function identity.\n  readonly handler: Function;\n  readonly declarationOrder: number;\n}\n// biome-ignore lint/complexity/noBannedTypes: Nest handler metadata preserves the framework function identity.\nexport function readHookMetadata(handler: Function): {\n  readonly hooks: readonly EndpointHookDeclaration[];\n  readonly databaseHooks: readonly DatabaseHookDeclaration[];\n} {\n  return {\n    hooks: Reflect.getOwnMetadata(tokens.HOOK_METADATA, handler) ?? [],\n    databaseHooks:\n      Reflect.getOwnMetadata(tokens.DB_HOOK_METADATA, handler) ?? [],\n  };\n}\nfunction hook<P extends string>(\n  phase: \"before\" | \"after\",\n  match?: P | readonly P[] | HookPredicate,\n  options?: HookOptions,\n): HookMethodDecorator<P> {\n  return (_target, method, descriptor) => {\n    const handler = descriptor.value!;\n    const records = readHookMetadata(handler).hooks;\n    append(\n      handler,\n      tokens.HOOK_METADATA,\n      Object.freeze({\n        phase,\n        match: Array.isArray(match) ? Object.freeze([...match]) : match,\n        options: Object.freeze({ ...options }),\n        method,\n        handler,\n        declarationOrder: records.length,\n      }),\n    );\n  };\n}\nexport const BeforeAuth = <const P extends EndpointPath | (string & {})>(\n  match?: P | readonly P[] | HookPredicate,\n  options?: HookOptions,\n): HookMethodDecorator<P> => hook(\"before\", match, options);\nexport const AfterAuth = <const P extends EndpointPath | (string & {})>(\n  match?: P | readonly P[] | HookPredicate,\n  options?: HookOptions,\n): HookMethodDecorator<P> => hook(\"after\", match, options);\nfunction databaseHook<\n  E extends DatabaseHookTarget,\n  Ph extends \"before\" | \"after\",\n>(phase: Ph, target: E, options?: DbHookOptions): DbHookMethodDecorator<E, Ph> {\n  return (_prototype, method, descriptor) => {\n    const handler = descriptor.value!;\n    append(\n      handler,\n      tokens.DB_HOOK_METADATA,\n      Object.freeze({\n        phase,\n        target,\n        options: Object.freeze({ ...options }),\n        method,\n        handler,\n        declarationOrder: readHookMetadata(handler).databaseHooks.length,\n      }),\n    );\n  };\n}\nexport const BeforeDatabase = <E extends DatabaseHookTarget>(\n  target: E,\n  options?: DbHookOptions,\n): DbHookMethodDecorator<E, \"before\"> =>\n  databaseHook(\"before\", target, options);\nexport const AfterDatabase = <E extends DatabaseHookTarget>(\n  target: E,\n  options?: DbHookOptions,\n): DbHookMethodDecorator<E, \"after\"> => databaseHook(\"after\", target, options);\n"],"mappings":";;;;;;;;AAuCA,MAAM,WAAW,OAAO,IAAI,sCAAsC;AAClE,SAAgB,QACd,UACA,GAAG,QACK;CACR,OAAO,KAAK,UAAU,CAAC,UAAU,GAAG,MAAM,CAAC;AAC7C;;AAGA,SAAgB,eACd,KACA,SACa;CACb,MAAM,UAAU,SAAS,WAAW;CACpC,MAAM,YAAY,UAAU,QAAQ,SAAS,MAAM,KAAK,CAAC,CAAC,CAAC,KAAM;CACjE,IAAI,UAAU,QAAQ,IAAI,SAAS,QAAQ;CAG3C,IAAI,CAAC,SAAS;EACZ,0BAAU,IAAI,IAAI;EAClB,OAAO,eAAe,SAAS,UAAU,EAAE,OAAO,QAAQ,CAAC;CAC7D;CACA,IAAI,SAAS,QAAQ,IAAI,SAAS;CAClC,IAAI,CAAC,QAAQ;EACX,yBAAS,IAAI,IAAI;EACjB,QAAQ,IAAI,WAAW,MAAM;CAC/B;CACA,OAAO;AACT;AAEA,IAAa,eAAb,MAA0B;CACxB,WAAoB,IAAI,kBAA8B;CACtD,0BAAmB,IAAI,QAA8B;CACrD,6BAAsB,IAAI,IAAiC;CAC3D,4BAAqB,IAAI,QAAwB;CACjD,aAAa;CAEb,IAAO,OAAmB,IAAgB;EACxC,OAAO,KAAK,SAAS,IAAI,OAAO,EAAE;CACpC;CAEA,KAAQ,IAAgB;EACtB,OAAO,KAAK,SAAS,KAAK,EAAE;CAC9B;CAEA,UAAkC;EAChC,OAAO,KAAK,SAAS,SAAS;CAChC;CAEA,SAAS,KAA2B;EAClC,IAAI,QAAQ,KAAK,QAAQ,IAAI,GAAG;EAChC,IAAI,CAAC,OAAO;GACV,QAAQ;IACN,2BAAW,IAAI,IAAI;IACnB,0BAAU,IAAI,IAAI;IAClB,2BAAW,IAAI,IAAI;IACnB,wBAAQ,IAAI,IAAI;IAChB,oCAAoB,IAAI,IAAI;IAC5B,yBAAS,IAAI,IAAI;IACjB,0BAAU,IAAI,IAAI;IAClB,6BAAa,IAAI,IAAI;GACvB;GACA,KAAK,QAAQ,IAAI,KAAK,KAAK;EAC7B;EACA,OAAO;CACT;CAEA,cACE,MACA,OAKA,SAC0B;EAC1B,MAAM,MAAM,QAAQ,MAAM,UAAU,MAAM,WAAW,MAAM,SAAS;EACpE,MAAM,QAAQ,KAAK,SAAS,KAAK,GAAG;EACpC,MAAM,WAAW,MAAM,UAAU,IAAI,GAAG;EACxC,IAAI,UACF,OAAO;EAET,MAAM,aACJ,KAAK,cACL,MAAM,cAAc,oBACnB,KAAK,kBAAkB,KAAK,IACzB,KAAK,SAAS,KAAK,UAAU,CAAC,CAAC,cAC/B,KAAA;EACN,MAAM,SAAS,YAAY,IAAI,GAAG;EAClC,MAAM,UAAU,QAAQ,QAAQ,CAAC,CAAC,KAAK,YAAY;GACjD,IAAI,UAAU,OAAO,YAAY,KAAK,IAAI,GACxC,OAAO,OAAO;GAEhB,YAAY,OAAO,GAAG;GACtB,IAAI;IACF,MAAM,QAAQ,MAAM,QAAQ;IAC5B,IAAI,MAAM,YAAY,YACpB,YAAY,IAAI,KAAK;KACnB;KACA,WAAW,KAAK,IAAI,KAAK,KAAK,kBAAkB;IAClD,CAAC;IAEH,OAAO;GACT,SAAS,OAAO;IACd,YAAY,OAAO,GAAG;IACtB,MAAM;GACR;EACF,CAAC;EACD,MAAM,UAAU,IAAI,KAAK,OAAO;EAChC,OAAO;CACT;CAEA,aACE,SACA,UACA,aACA,SACA,QAAwB,KACZ;EACZ,MAAM,QAAQ,KAAK,SAAS,OAAO;EACnC,MAAM,MAAM,QAAQ,UAAU,WAAW;EACzC,MAAM,WAAW,MAAM,SAAS,IAAI,GAAG;EACvC,IAAI,UACF,OAAO;EAET,IACE,UAAU,SACV,CAAC,GAAG,MAAM,kBAAkB,CAAC,CAAC,QAC3B,UAAU,KAAK,MAAM,KAAK,CAAC,CAAC,OAAO,QACtC,CAAC,CAAC,UAAU,OAEZ,OAAO,QAAQ,OACb,aAAa,SAAS;GACpB,QAAQ;GACR,QAAQ;EACV,CAAC,CACH;EAEF,MAAM,mBAAmB,IAAI,GAAG;EAChC,MAAM,UAAU,QAAQ,QAAQ,CAAC,CAAC,KAAK,OAAO;EAC9C,MAAM,SAAS,IAAI,KAAK,OAAO;EAC/B,OAAO;CACT;CAEA,aACE,YACA,UACA,aACA,SACgC;EAChC,MAAM,YAAY,KAAK,SAAS,UAAU,CAAC,CAAC;EAC5C,MAAM,MAAM,QAAQ,UAAU,WAAW;EACzC,IAAI,UAAU,UAAU,IAAI,GAAG;EAC/B,IAAI,CAAC,SAAS;GACZ,UAAU,QAAQ,QAAQ,CAAC,CAAC,KAAK,OAAO;GACxC,UAAU,IAAI,KAAK,OAAO;EAC5B;EACA,OAAO;CACT;CAEA,SAAS,UAAkB,KAAqB;EAC9C,IAAI,OAAO,KAAK,WAAW,IAAI,QAAQ;EACvC,IAAI,CAAC,MAAM;GACT,uBAAO,IAAI,IAAI;GACf,KAAK,WAAW,IAAI,UAAU,IAAI;EACpC;EACA,IAAI,aAAa,KAAK,IAAI,GAAG;EAC7B,IAAI,CAAC,YAAY;GACf,aAAa,OAAO,IAAI,WAAW;GACnC,KAAK,IAAI,KAAK,UAAU;EAC1B;EACA,OAAO;CACT;CAEA,SACE,KACA,OACA,SACS;EACT,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK;EACjC,IAAI,CAAC,IAAI;GACP,KAAK,EAAE,KAAK;GACZ,KAAK,UAAU,IAAI,OAAO,EAAE;EAC9B;EACA,MAAM,SAAS,qBAAqB,KAAK,IACrC,QAAQ,QAAQ,UAAU,MAAM,MAAM,QAAQ,IAAI,IAClD,SAAS;EACb,MAAM,UAAU,eAAe,KAAK,QAAQ,OAAO;EACnD,MAAM,QACJ,QAAQ,QAAQ,SAAS,UAAU,UAAU,KAAK,SAAS,GAAG,CAAC,CAAC;EAClE,MAAM,WAAW,MAAM,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM;EACxD,MAAM,IAAI,MAAM;EAChB,QAAQ,IAAI,MAAM;EAClB,OAAO;CACT;AACF;;;ACzMA,SAAS,OAAO,QAAgB,KAAa,OAAsB;CACjE,QAAQ,eACN,KACA,OAAO,OAAO,CAAC,GAAI,QAAQ,eAAe,KAAK,MAAM,KAAK,CAAC,GAAI,KAAK,CAAC,GACrE,MACF;AACF;AACA,MAAa,eAAe,YAAYA,iBAAwB,QAAQ;AACxE,MAAa,qBACX,YAAYA,iBAAwB,UAAU;AAChD,MAAa,eAAe,YAC1B,gBACE,YAAYA,iBAAwB,UAAU,GAC9C,YAAYC,oBAA2B,SAAS,kBAAkB,IAAI,CACxE;AACF,MAAa,mBAAmB,SAC9B,YAAYC,wBAA+B,IAAI;AACjD,MAAa,oBACX,GAAG,UACA,YAAYC,4BAAmC,OAAO,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AAC7E,MAAa,gCACX,YAAYC,oCAA2C,IAAI;AAC7D,MAAa,sBAAsB,UAAU,SAC3C,YAAYC,0BAAiC,OAAO;AACtD,MAAa,wBACX,YAAYC,4BAAmC,IAAI;AACrD,MAAa,sBACX,gBACE,YAAYC,0BAAiC,IAAI,GACjD,UAAU,eAAe,GACzB,gBAAgB,0BAA0B,CAC5C;AACF,SAAgB,QACd,GAAG,cAC+B;CAClC,QACE,QACA,MACA,eACG;EACH,KAAK,MAAM,cAAc,cACvB,OACE,YAAY,SAAS,QACrBC,uBACA,UACF;CAEJ;AACF;AACA,MAAa,SACX,GAAG,kBACkB,EAAE,OAAO,aAAa;AAC7C,MAAa,SACX,GAAG,kBACkB,EAAE,OAAO,aAAa;AAC7C,MAAa,eACX,QACA,QACA,aACoB;CAAE;CAAQ;CAAQ,GAAG;AAAQ;AAQnD,SAAgB,cAAc,SAA0C;CACtE,MAAM,OAAO,QAAQ,QAAQ;CAC7B,KAAK,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG;EACjC,KACG,OAAO,QAAQ,YAAY,QAAQ,SACpC,OAAO,QAAQ,YAEf;EAEF,MAAM,SAAS,QAAQ,IAAI,KAAKC,cAAqB;EAGrD,IACE,UACA,OAAO,KAAK,WAAW,KAAK,UAC5B,OAAO,KAAK,OAAO,OAAO,UAAU,UAAU,KAAK,MAAM,KACzD,OAAO,YAAY,KAAA,KACnB,OAAO,MAAM,QAAQ,CAAC,EAAE,YAAY,OAAO,SAE3C,OAAO;CAEX;CAEA,MAAM,QAAQ,IAAI,aAAa;CAC/B,OAAO;EAAE;EAAM;EAAO,UAAU,IAAI,kBAAkB,KAAK;CAAE;AAC/D;AACA,SAAS,eAAe,MAID;CACrB,MAAM,YAAY,sBACf,OAAgB,YAA8B;EAC7C,MAAM,SAAS,cAAc,OAAO;EACpC,MAAM,QAAQ;GACZ,MAAM,QAAQ,QAAQ;GACtB,MAAM,GAAG,QAAQ,SAAS,CAAC,CAAC,KAAK,GAAG,QAAQ,WAAW,CAAC,CAAC;EAC3D;EACA,MAAM,UACJ,OAAO,YAAY,KAAA,KACnB,OAAO,MAAM,QAAQ,CAAC,EAAE,YAAY,OAAO,UACvC,OAAO,SAAS,QAAQ,IACxB,OAAO,SAAS,KAAK,KAAK;EAChC,OAAO,OAAO,SAAS,QACrB,SACA;GAAE,GAAG;GAAM,MAAM,MAAM;GAAM,SAAS,MAAM,aAAa,MAAM;EAAG,GAClE,KACF;CACF,CACF,CAAC,CAAC;CACF,QAAQ,QAAQ,aAAa,UAAU;EACrC,IAAI,gBAAgB,KAAA,GAClB,MAAM,IAAI,6BACR,0BACA,+CACF;EAGF,OADgB,QAAQ,IAAI,QAAQ,WACvB,GAAGC,2BAAkC;GAChD;GACA,GAAI,OAAO;IAAE,MAAM,KAAK;IAAM,QAAQ,KAAK;GAAO,IAAI,CAAC;EACzD,CAAC;EACD,UAAU,QAAQ,aAAa,KAAK;CACtC;AACF;AACA,MAAa,yBAA6C,eAAe;AACzE,SAAgB,qBAAiD,MAIpC;CAC3B,aAAa,eAAe,IAAI;AAClC;AACA,SAAgB,sBACd,MACA,MAC0B;CAC1B,aAAa;EACX,MAAM,YAAY,sBACf,OAAgB,YAA8B;GAC7C,MAAM,SAAS,cAAc,OAAO;GACpC,MAAM,QAAQ,OAAO,MAAM,QAAQ;GACnC,MAAM,QAAQ;IACZ,MAAM,QAAQ,QAAQ;IACtB,MAAM,GAAG,QAAQ,SAAS,CAAC,CAAC,KAAK,GAAG,QAAQ,WAAW,CAAC,CAAC;GAC3D;GACA,MAAM,UAAU,OAAO,UACnB,OAAO,SAAS,QAAQ,IACxB,OAAO,SAAS,KAAK,KAAK;GAC9B,MAAM,aAAa,OAAO,OACtB,CAAC,MAAM,KAAK,UAAU,IACtB,CAAC,MAAM,MAAM,GAAG,MAAM,IAAI;GAC9B,KAAK,MAAM,aAAa,YAAY;IAClC,IACE,CAAC,aACA,OAAO,cAAc,YAAY,OAAO,cAAc,YAEvD;IAEF,MAAM,SAAS,QAAQ,IAAI,WAAWC,iBAAwB;IAG9D,IAAI,QAAQ,IAAI,QAAQ,QAAQ,CAAC,EAAE,IAAI,IAAI,GACzC,OAAO,OAAO,IAAI,QAAQ,QAAQ,CAAC,CAAE,IAAI,IAAI;GAEjD;GACA,MAAM,OAAO,SAAS,QACpB,6BAA6B,UAC3B,uBACA,KAAK,SACL,EAAE,MAAM,MAAM,KAAK,CACrB,GACA,OACA,QAAQ,QACV;EACF,CACF,CAAC,CAAC;EACF,QAAQ,QAAQ,KAAK,UAAU;GAC7B,IAAI,QAAQ,KAAA,GACV,MAAM,IAAI,6BACR,2BACA,gDACF;GAEF,OAAO,QAAQ,IAAI,QAAQ,GAAG,GAAGC,4BAAmC;IAClE;IACA;IACA,SAAS,KAAK;GAChB,CAAC;GACD,UAAU,QAAQ,KAAK,KAAK;EAC9B;CACF;AACF;AAoBA,SAAgB,iBAAiB,SAG/B;CACA,OAAO;EACL,OAAO,QAAQ,eAAeC,eAAsB,OAAO,KAAK,CAAC;EACjE,eACE,QAAQ,eAAeC,kBAAyB,OAAO,KAAK,CAAC;CACjE;AACF;AACA,SAAS,KACP,OACA,OACA,SACwB;CACxB,QAAQ,SAAS,QAAQ,eAAe;EACtC,MAAM,UAAU,WAAW;EAC3B,MAAM,UAAU,iBAAiB,OAAO,CAAC,CAAC;EAC1C,OACE,SACAD,eACA,OAAO,OAAO;GACZ;GACA,OAAO,MAAM,QAAQ,KAAK,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,CAAC,IAAI;GAC1D,SAAS,OAAO,OAAO,EAAE,GAAG,QAAQ,CAAC;GACrC;GACA;GACA,kBAAkB,QAAQ;EAC5B,CAAC,CACH;CACF;AACF;AACA,MAAa,cACX,OACA,YAC2B,KAAK,UAAU,OAAO,OAAO;AAC1D,MAAa,aACX,OACA,YAC2B,KAAK,SAAS,OAAO,OAAO;AACzD,SAAS,aAGP,OAAW,QAAW,SAAuD;CAC7E,QAAQ,YAAY,QAAQ,eAAe;EACzC,MAAM,UAAU,WAAW;EAC3B,OACE,SACAC,kBACA,OAAO,OAAO;GACZ;GACA;GACA,SAAS,OAAO,OAAO,EAAE,GAAG,QAAQ,CAAC;GACrC;GACA;GACA,kBAAkB,iBAAiB,OAAO,CAAC,CAAC,cAAc;EAC5D,CAAC,CACH;CACF;AACF;AACA,MAAa,kBACX,QACA,YAEA,aAAa,UAAU,QAAQ,OAAO;AACxC,MAAa,iBACX,QACA,YACsC,aAAa,SAAS,QAAQ,OAAO"}
+{"version":3,"file":"auth-decorators-BO9T-1wp.mjs","names":["tokens.ACCESS_METADATA","tokens.FRESHNESS_METADATA","tokens.AUTH_INSTANCE_METADATA","tokens.ACCEPT_PRINCIPALS_METADATA","tokens.SKIP_DEFAULT_REQUIREMENTS_METADATA","tokens.FORWARD_COOKIES_METADATA","tokens.SKIP_ORIGIN_CHECK_METADATA","tokens.USE_BETTER_AUTH_METADATA","tokens.REQUIREMENTS_METADATA","tokens.READER_CONTEXT","tokens.PRINCIPAL_PARAMS_METADATA","tokens.INVOCATION_VALUES","tokens.INVOCATION_PARAMS_METADATA","tokens.HOOK_METADATA","tokens.DB_HOOK_METADATA"],"sources":["../src/request-scope.ts","../src/auth-decorators.ts"],"sourcesContent":["import { AsyncLocalStorage } from \"node:async_hooks\";\nimport type {\n  AuthorizationDecision,\n  InvocationLineage,\n  PrincipalReading,\n  PrincipalResult,\n  RoutePlan,\n  TransportCall,\n} from \"./auth-contracts.js\";\nimport {\n  AuthFailures,\n  type AuthFailure,\n  isConfigurationError,\n} from \"./auth-errors.js\";\nimport type { ScopeView } from \"./bridge-protocol.js\";\n\nexport interface ScopeState {\n  readonly view: ScopeView;\n  readonly call?: TransportCall;\n  readonly plan?: RoutePlan;\n  readonly reading?: () => PrincipalReading;\n}\nexport interface RequestState {\n  readonly principal: Map<string, Promise<PrincipalResult>>;\n  readonly policyIo: Map<string, Promise<unknown>>;\n  readonly decisions: Map<string, Promise<AuthorizationDecision>>;\n  readonly values: Map<symbol, unknown>;\n  readonly authorizationCalls: Set<string>;\n  readonly origins: Map<string, Promise<AuthFailure | null>>;\n  readonly surfaced: Set<string>;\n  readonly connections: Map<\n    string,\n    {\n      value: Extract<PrincipalResult, { outcome: \"authenticated\" | \"absent\" }>;\n      expiresAt: number;\n    }\n  >;\n}\n\nconst SURFACED = Symbol.for(\"nestjs-slightly-better-auth:surfaced\");\nexport function memoKey(\n  instance: string,\n  ...inputs: readonly unknown[]\n): string {\n  return JSON.stringify([instance, ...inputs]);\n}\n\n/** Shared by guards and readers that have only the transport's structural lineage. */\nexport function surfacedRecord(\n  key: object,\n  lineage?: InvocationLineage,\n): Set<string> {\n  const carrier = lineage?.carrier ?? key;\n  const partition = lineage ? lineage.position.split(\":\", 1)[0]! : \"\";\n  let records = Reflect.get(carrier, SURFACED) as\n    | Map<string, Set<string>>\n    | undefined;\n  if (!records) {\n    records = new Map();\n    Object.defineProperty(carrier, SURFACED, { value: records });\n  }\n  let record = records.get(partition);\n  if (!record) {\n    record = new Set();\n    records.set(partition, record);\n  }\n  return record;\n}\n\nexport class RequestScope {\n  readonly #storage = new AsyncLocalStorage<ScopeState>();\n  readonly #states = new WeakMap<object, RequestState>();\n  readonly #valueKeys = new Map<string, Map<symbol, symbol>>();\n  readonly #errorIds = new WeakMap<object, number>();\n  #nextError = 0;\n\n  run<T>(state: ScopeState, fn: () => T): T {\n    return this.#storage.run(state, fn);\n  }\n\n  exit<T>(fn: () => T): T {\n    return this.#storage.exit(fn);\n  }\n\n  current(): ScopeState | undefined {\n    return this.#storage.getStore();\n  }\n\n  stateFor(key: object): RequestState {\n    let state = this.#states.get(key);\n    if (!state) {\n      state = {\n        principal: new Map(),\n        policyIo: new Map(),\n        decisions: new Map(),\n        values: new Map(),\n        authorizationCalls: new Set(),\n        origins: new Map(),\n        surfaced: new Set(),\n        connections: new Map(),\n      };\n      this.#states.set(key, state);\n    }\n    return state;\n  }\n\n  memoPrincipal(\n    call: Pick<TransportCall, \"key\" | \"connection\" | \"principalTtlMs\">,\n    input: {\n      instance: string;\n      freshness: \"default\" | \"authoritative\";\n      sourceSet: string;\n    },\n    compute: () => Promise<PrincipalResult>,\n  ): Promise<PrincipalResult> {\n    const key = memoKey(input.instance, input.freshness, input.sourceSet);\n    const state = this.stateFor(call.key);\n    const existing = state.principal.get(key);\n    if (existing) {\n      return existing;\n    }\n    const connection =\n      call.connection &&\n      input.freshness !== \"authoritative\" &&\n      (call.principalTtlMs ?? 0) > 0\n        ? this.stateFor(call.connection).connections\n        : undefined;\n    const cached = connection?.get(key);\n    const promise = Promise.resolve().then(async () => {\n      if (cached && cached.expiresAt > Date.now()) {\n        return cached.value;\n      }\n      connection?.delete(key);\n      try {\n        const value = await compute();\n        if (value.outcome !== \"rejected\") {\n          connection?.set(key, {\n            value,\n            expiresAt: Date.now() + (call.principalTtlMs ?? 0),\n          });\n        }\n        return value;\n      } catch (error) {\n        connection?.delete(key);\n        throw error;\n      }\n    });\n    state.principal.set(key, promise);\n    return promise;\n  }\n\n  memoPolicyIo<T>(\n    request: object,\n    instance: string,\n    concreteKey: string,\n    compute: () => Promise<T>,\n    limit: number | false = 100,\n  ): Promise<T> {\n    const state = this.stateFor(request);\n    const key = memoKey(instance, concreteKey);\n    const existing = state.policyIo.get(key);\n    if (existing) {\n      return existing as Promise<T>;\n    }\n    if (\n      limit !== false &&\n      [...state.authorizationCalls].filter(\n        (entry) => JSON.parse(entry)[0] === instance,\n      ).length >= limit\n    ) {\n      return Promise.reject(\n        AuthFailures.rejected({\n          status: 429,\n          reason: \"TOO_MANY_AUTHORIZATION_CHECKS\",\n        }),\n      );\n    }\n    state.authorizationCalls.add(key);\n    const promise = Promise.resolve().then(compute);\n    state.policyIo.set(key, promise);\n    return promise;\n  }\n\n  memoDecision(\n    invocation: object,\n    instance: string,\n    concreteKey: string,\n    compute: () => Promise<AuthorizationDecision>,\n  ): Promise<AuthorizationDecision> {\n    const decisions = this.stateFor(invocation).decisions;\n    const key = memoKey(instance, concreteKey);\n    let promise = decisions.get(key);\n    if (!promise) {\n      promise = Promise.resolve().then(compute);\n      decisions.set(key, promise);\n    }\n    return promise;\n  }\n\n  valueKey(instance: string, key: symbol): symbol {\n    let keys = this.#valueKeys.get(instance);\n    if (!keys) {\n      keys = new Map();\n      this.#valueKeys.set(instance, keys);\n    }\n    let namespaced = keys.get(key);\n    if (!namespaced) {\n      namespaced = Symbol(key.description);\n      keys.set(key, namespaced);\n    }\n    return namespaced;\n  }\n\n  surfaced(\n    key: object,\n    error: object,\n    context: { instance: string; site: string; lineage?: InvocationLineage },\n  ): boolean {\n    let id = this.#errorIds.get(error);\n    if (!id) {\n      id = ++this.#nextError;\n      this.#errorIds.set(error, id);\n    }\n    const reason = isConfigurationError(error)\n      ? memoKey(context.instance, error.code, context.site)\n      : `error:${id}`;\n    const carrier = surfacedRecord(key, context.lineage);\n    const state =\n      key === context.lineage?.carrier ? carrier : this.stateFor(key).surfaced;\n    const repeated = state.has(reason) || carrier.has(reason);\n    state.add(reason);\n    carrier.add(reason);\n    return repeated;\n  }\n}\n","import {\n  applyDecorators,\n  createParamDecorator,\n  SetMetadata,\n  UseGuards,\n  UseInterceptors,\n  type ExecutionContext,\n} from \"@nestjs/common\";\nimport type {\n  DatabaseHookTarget,\n  DbHookMethodDecorator,\n  DbHookOptions,\n  HookMethodDecorator,\n  HookOptions,\n  HookPredicate,\n  PolicyRef,\n  PrincipalReading,\n  Requirement,\n  RequirementExpr,\n  RequirementOptions,\n} from \"./auth-contracts.js\";\nimport type {\n  EndpointPath,\n  PrincipalKind,\n  PrincipalOfKind,\n} from \"./auth-types.js\";\nimport { BetterAuthConfigurationError } from \"./auth-errors.js\";\nimport * as tokens from \"./auth-tokens.js\";\nimport { BetterAuthGuard } from \"./auth-guard.js\";\nimport { BetterAuthScopeInterceptor } from \"./auth-scope-interceptor.js\";\nimport { PrincipalReadings } from \"./principal-readings.js\";\nimport { RequestScope } from \"./request-scope.js\";\n\nfunction append(target: object, key: symbol, value: unknown): void {\n  Reflect.defineMetadata(\n    key,\n    Object.freeze([...(Reflect.getOwnMetadata(key, target) ?? []), value]),\n    target,\n  );\n}\nexport const Public = () => SetMetadata(tokens.ACCESS_METADATA, \"public\");\nexport const OptionalAuth = () =>\n  SetMetadata(tokens.ACCESS_METADATA, \"optional\");\nexport const RequireAuth = (options?: { authoritative?: boolean }) =>\n  applyDecorators(\n    SetMetadata(tokens.ACCESS_METADATA, \"required\"),\n    SetMetadata(tokens.FRESHNESS_METADATA, options?.authoritative === true),\n  );\nexport const UseAuthInstance = (name: string) =>\n  SetMetadata(tokens.AUTH_INSTANCE_METADATA, name);\nexport const AcceptPrincipals = (\n  ...kinds: readonly [PrincipalKind, ...PrincipalKind[]]\n) => SetMetadata(tokens.ACCEPT_PRINCIPALS_METADATA, Object.freeze([...kinds]));\nexport const SkipDefaultRequirements = () =>\n  SetMetadata(tokens.SKIP_DEFAULT_REQUIREMENTS_METADATA, true);\nexport const ForwardAuthCookies = (enabled = true) =>\n  SetMetadata(tokens.FORWARD_COOKIES_METADATA, enabled);\nexport const SkipOriginCheck = () =>\n  SetMetadata(tokens.SKIP_ORIGIN_CHECK_METADATA, true);\nexport const UseBetterAuth = () =>\n  applyDecorators(\n    SetMetadata(tokens.USE_BETTER_AUTH_METADATA, true),\n    UseGuards(BetterAuthGuard),\n    UseInterceptors(BetterAuthScopeInterceptor),\n  );\nexport function Require(\n  ...requirements: readonly RequirementExpr[]\n): ClassDecorator & MethodDecorator {\n  return (\n    target: object,\n    _key?: string | symbol,\n    descriptor?: PropertyDescriptor,\n  ) => {\n    for (const expression of requirements) {\n      append(\n        descriptor?.value ?? target,\n        tokens.REQUIREMENTS_METADATA,\n        expression,\n      );\n    }\n  };\n}\nexport const anyOf = (\n  ...requirements: readonly RequirementExpr[]\n): RequirementExpr => ({ anyOf: requirements });\nexport const allOf = (\n  ...requirements: readonly RequirementExpr[]\n): RequirementExpr => ({ allOf: requirements });\nexport const requirement = <P>(\n  policy: PolicyRef<P>,\n  params: P,\n  options?: RequirementOptions,\n): Requirement<P> => ({ policy, params, ...options });\n\nexport interface ReaderContext {\n  readonly args: readonly unknown[];\n  readonly readings: PrincipalReadings;\n  readonly scope: RequestScope;\n  readonly reading?: () => PrincipalReading;\n}\nexport function readerContext(context: ExecutionContext): ReaderContext {\n  const args = context.getArgs();\n  for (const arg of [args, ...args]) {\n    if (\n      (typeof arg !== \"object\" || arg === null) &&\n      typeof arg !== \"function\"\n    ) {\n      continue;\n    }\n    const bridge = Reflect.get(arg, tokens.READER_CONTEXT) as\n      | ReaderContext\n      | undefined;\n    if (\n      bridge &&\n      bridge.args.length === args.length &&\n      bridge.args.every((value, index) => value === args[index]) &&\n      bridge.reading !== undefined &&\n      bridge.scope.current()?.reading === bridge.reading\n    ) {\n      return bridge;\n    }\n  }\n  // No application state is created or retained by a DI-free lineage-only reader.\n  const scope = new RequestScope();\n  return { args, scope, readings: new PrincipalReadings(scope) };\n}\nfunction principalParam(spec?: {\n  kind: string;\n  reason: string;\n  project: (p: any) => unknown;\n}): ParameterDecorator {\n  const decorator = createParamDecorator(\n    (_data: unknown, context: ExecutionContext) => {\n      const bridge = readerContext(context);\n      const input = {\n        args: context.getArgs(),\n        site: `${context.getClass().name}.${context.getHandler().name}`,\n      };\n      const reading =\n        bridge.reading !== undefined &&\n        bridge.scope.current()?.reading === bridge.reading\n          ? bridge.readings.current()\n          : bridge.readings.read(input);\n      return bridge.readings.project(\n        reading,\n        { ...spec, site: input.site, project: spec?.project ?? ((p) => p) },\n        input,\n      );\n    },\n  )();\n  return (target, propertyKey, index) => {\n    if (propertyKey === undefined) {\n      throw new BetterAuthConfigurationError(\n        \"PRINCIPAL_PARAM_TARGET\",\n        \"Principal parameters require a handler method\",\n      );\n    }\n    const handler = Reflect.get(target, propertyKey);\n    append(handler, tokens.PRINCIPAL_PARAMS_METADATA, {\n      index,\n      ...(spec ? { kind: spec.kind, reason: spec.reason } : {}),\n    });\n    decorator(target, propertyKey, index);\n  };\n}\nexport const CurrentPrincipal = (): ParameterDecorator => principalParam();\nexport function definePrincipalParam<K extends PrincipalKind, R>(spec: {\n  readonly kind: K;\n  readonly reason: string;\n  readonly project: (principal: PrincipalOfKind<K>) => R;\n}): () => ParameterDecorator {\n  return () => principalParam(spec);\n}\nexport function defineInvocationParam(\n  slot: symbol,\n  spec: { readonly missing: string },\n): () => ParameterDecorator {\n  return () => {\n    const decorator = createParamDecorator(\n      (_data: unknown, context: ExecutionContext) => {\n        const bridge = readerContext(context);\n        const state = bridge.scope.current();\n        const input = {\n          args: context.getArgs(),\n          site: `${context.getClass().name}.${context.getHandler().name}`,\n        };\n        const reading = state?.reading\n          ? bridge.readings.current()\n          : bridge.readings.read(input);\n        const candidates = state?.call\n          ? [state.call.invocation]\n          : [input.args, ...input.args];\n        for (const candidate of candidates) {\n          if (\n            !candidate ||\n            (typeof candidate !== \"object\" && typeof candidate !== \"function\")\n          ) {\n            continue;\n          }\n          const values = Reflect.get(candidate, tokens.INVOCATION_VALUES) as\n            | Map<string, Map<symbol, unknown>>\n            | undefined;\n          if (values?.get(reading.instance)?.has(slot)) {\n            return values.get(reading.instance)!.get(slot);\n          }\n        }\n        throw bridge.readings.deliver(\n          BetterAuthConfigurationError.atRequest(\n            \"NO_INVOCATION_VALUE\",\n            spec.missing,\n            { site: input.site },\n          ),\n          input,\n          reading.instance,\n        );\n      },\n    )();\n    return (target, key, index) => {\n      if (key === undefined) {\n        throw new BetterAuthConfigurationError(\n          \"INVOCATION_PARAM_TARGET\",\n          \"Invocation parameters require a handler method\",\n        );\n      }\n      append(Reflect.get(target, key), tokens.INVOCATION_PARAMS_METADATA, {\n        index,\n        slot,\n        missing: spec.missing,\n      });\n      decorator(target, key, index);\n    };\n  };\n}\nexport interface EndpointHookDeclaration {\n  readonly phase: \"before\" | \"after\";\n  readonly match: string | readonly string[] | HookPredicate | undefined;\n  readonly options: Readonly<HookOptions>;\n  readonly method: string | symbol;\n  // biome-ignore lint/complexity/noBannedTypes: Nest handler metadata preserves the framework function identity.\n  readonly handler: Function;\n  readonly declarationOrder: number;\n}\nexport interface DatabaseHookDeclaration {\n  readonly phase: \"before\" | \"after\";\n  readonly target: DatabaseHookTarget;\n  readonly options: Readonly<DbHookOptions>;\n  readonly method: string | symbol;\n  // biome-ignore lint/complexity/noBannedTypes: Nest handler metadata preserves the framework function identity.\n  readonly handler: Function;\n  readonly declarationOrder: number;\n}\n// biome-ignore lint/complexity/noBannedTypes: Nest handler metadata preserves the framework function identity.\nexport function readHookMetadata(handler: Function): {\n  readonly hooks: readonly EndpointHookDeclaration[];\n  readonly databaseHooks: readonly DatabaseHookDeclaration[];\n} {\n  return {\n    hooks: Reflect.getOwnMetadata(tokens.HOOK_METADATA, handler) ?? [],\n    databaseHooks:\n      Reflect.getOwnMetadata(tokens.DB_HOOK_METADATA, handler) ?? [],\n  };\n}\nfunction hook<P extends string>(\n  phase: \"before\" | \"after\",\n  match?: P | readonly P[] | HookPredicate,\n  options?: HookOptions,\n): HookMethodDecorator<P> {\n  return (_target, method, descriptor) => {\n    const handler = descriptor.value!;\n    const records = readHookMetadata(handler).hooks;\n    append(\n      handler,\n      tokens.HOOK_METADATA,\n      Object.freeze({\n        phase,\n        match: Array.isArray(match) ? Object.freeze([...match]) : match,\n        options: Object.freeze({ ...options }),\n        method,\n        handler,\n        declarationOrder: records.length,\n      }),\n    );\n  };\n}\nexport const BeforeAuth = <const P extends EndpointPath | (string & {})>(\n  match?: P | readonly P[] | HookPredicate,\n  options?: HookOptions,\n): HookMethodDecorator<P> => hook(\"before\", match, options);\nexport const AfterAuth = <const P extends EndpointPath | (string & {})>(\n  match?: P | readonly P[] | HookPredicate,\n  options?: HookOptions,\n): HookMethodDecorator<P> => hook(\"after\", match, options);\nfunction databaseHook<\n  E extends DatabaseHookTarget,\n  Ph extends \"before\" | \"after\",\n>(phase: Ph, target: E, options?: DbHookOptions): DbHookMethodDecorator<E, Ph> {\n  return (_prototype, method, descriptor) => {\n    const handler = descriptor.value!;\n    append(\n      handler,\n      tokens.DB_HOOK_METADATA,\n      Object.freeze({\n        phase,\n        target,\n        options: Object.freeze({ ...options }),\n        method,\n        handler,\n        declarationOrder: readHookMetadata(handler).databaseHooks.length,\n      }),\n    );\n  };\n}\nexport const BeforeDatabase = <E extends DatabaseHookTarget>(\n  target: E,\n  options?: DbHookOptions,\n): DbHookMethodDecorator<E, \"before\"> =>\n  databaseHook(\"before\", target, options);\nexport const AfterDatabase = <E extends DatabaseHookTarget>(\n  target: E,\n  options?: DbHookOptions,\n): DbHookMethodDecorator<E, \"after\"> => databaseHook(\"after\", target, options);\n"],"mappings":";;;;;;;;AAuCA,MAAM,WAAW,OAAO,IAAI,sCAAsC;AAClE,SAAgB,QACd,UACA,GAAG,QACK;CACR,OAAO,KAAK,UAAU,CAAC,UAAU,GAAG,MAAM,CAAC;AAC7C;;AAGA,SAAgB,eACd,KACA,SACa;CACb,MAAM,UAAU,SAAS,WAAW;CACpC,MAAM,YAAY,UAAU,QAAQ,SAAS,MAAM,KAAK,CAAC,CAAC,CAAC,KAAM;CACjE,IAAI,UAAU,QAAQ,IAAI,SAAS,QAAQ;CAG3C,IAAI,CAAC,SAAS;EACZ,0BAAU,IAAI,IAAI;EAClB,OAAO,eAAe,SAAS,UAAU,EAAE,OAAO,QAAQ,CAAC;CAC7D;CACA,IAAI,SAAS,QAAQ,IAAI,SAAS;CAClC,IAAI,CAAC,QAAQ;EACX,yBAAS,IAAI,IAAI;EACjB,QAAQ,IAAI,WAAW,MAAM;CAC/B;CACA,OAAO;AACT;AAEA,IAAa,eAAb,MAA0B;CACxB,WAAoB,IAAI,kBAA8B;CACtD,0BAAmB,IAAI,QAA8B;CACrD,6BAAsB,IAAI,IAAiC;CAC3D,4BAAqB,IAAI,QAAwB;CACjD,aAAa;CAEb,IAAO,OAAmB,IAAgB;EACxC,OAAO,KAAK,SAAS,IAAI,OAAO,EAAE;CACpC;CAEA,KAAQ,IAAgB;EACtB,OAAO,KAAK,SAAS,KAAK,EAAE;CAC9B;CAEA,UAAkC;EAChC,OAAO,KAAK,SAAS,SAAS;CAChC;CAEA,SAAS,KAA2B;EAClC,IAAI,QAAQ,KAAK,QAAQ,IAAI,GAAG;EAChC,IAAI,CAAC,OAAO;GACV,QAAQ;IACN,2BAAW,IAAI,IAAI;IACnB,0BAAU,IAAI,IAAI;IAClB,2BAAW,IAAI,IAAI;IACnB,wBAAQ,IAAI,IAAI;IAChB,oCAAoB,IAAI,IAAI;IAC5B,yBAAS,IAAI,IAAI;IACjB,0BAAU,IAAI,IAAI;IAClB,6BAAa,IAAI,IAAI;GACvB;GACA,KAAK,QAAQ,IAAI,KAAK,KAAK;EAC7B;EACA,OAAO;CACT;CAEA,cACE,MACA,OAKA,SAC0B;EAC1B,MAAM,MAAM,QAAQ,MAAM,UAAU,MAAM,WAAW,MAAM,SAAS;EACpE,MAAM,QAAQ,KAAK,SAAS,KAAK,GAAG;EACpC,MAAM,WAAW,MAAM,UAAU,IAAI,GAAG;EACxC,IAAI,UACF,OAAO;EAET,MAAM,aACJ,KAAK,cACL,MAAM,cAAc,oBACnB,KAAK,kBAAkB,KAAK,IACzB,KAAK,SAAS,KAAK,UAAU,CAAC,CAAC,cAC/B,KAAA;EACN,MAAM,SAAS,YAAY,IAAI,GAAG;EAClC,MAAM,UAAU,QAAQ,QAAQ,CAAC,CAAC,KAAK,YAAY;GACjD,IAAI,UAAU,OAAO,YAAY,KAAK,IAAI,GACxC,OAAO,OAAO;GAEhB,YAAY,OAAO,GAAG;GACtB,IAAI;IACF,MAAM,QAAQ,MAAM,QAAQ;IAC5B,IAAI,MAAM,YAAY,YACpB,YAAY,IAAI,KAAK;KACnB;KACA,WAAW,KAAK,IAAI,KAAK,KAAK,kBAAkB;IAClD,CAAC;IAEH,OAAO;GACT,SAAS,OAAO;IACd,YAAY,OAAO,GAAG;IACtB,MAAM;GACR;EACF,CAAC;EACD,MAAM,UAAU,IAAI,KAAK,OAAO;EAChC,OAAO;CACT;CAEA,aACE,SACA,UACA,aACA,SACA,QAAwB,KACZ;EACZ,MAAM,QAAQ,KAAK,SAAS,OAAO;EACnC,MAAM,MAAM,QAAQ,UAAU,WAAW;EACzC,MAAM,WAAW,MAAM,SAAS,IAAI,GAAG;EACvC,IAAI,UACF,OAAO;EAET,IACE,UAAU,SACV,CAAC,GAAG,MAAM,kBAAkB,CAAC,CAAC,QAC3B,UAAU,KAAK,MAAM,KAAK,CAAC,CAAC,OAAO,QACtC,CAAC,CAAC,UAAU,OAEZ,OAAO,QAAQ,OACb,aAAa,SAAS;GACpB,QAAQ;GACR,QAAQ;EACV,CAAC,CACH;EAEF,MAAM,mBAAmB,IAAI,GAAG;EAChC,MAAM,UAAU,QAAQ,QAAQ,CAAC,CAAC,KAAK,OAAO;EAC9C,MAAM,SAAS,IAAI,KAAK,OAAO;EAC/B,OAAO;CACT;CAEA,aACE,YACA,UACA,aACA,SACgC;EAChC,MAAM,YAAY,KAAK,SAAS,UAAU,CAAC,CAAC;EAC5C,MAAM,MAAM,QAAQ,UAAU,WAAW;EACzC,IAAI,UAAU,UAAU,IAAI,GAAG;EAC/B,IAAI,CAAC,SAAS;GACZ,UAAU,QAAQ,QAAQ,CAAC,CAAC,KAAK,OAAO;GACxC,UAAU,IAAI,KAAK,OAAO;EAC5B;EACA,OAAO;CACT;CAEA,SAAS,UAAkB,KAAqB;EAC9C,IAAI,OAAO,KAAK,WAAW,IAAI,QAAQ;EACvC,IAAI,CAAC,MAAM;GACT,uBAAO,IAAI,IAAI;GACf,KAAK,WAAW,IAAI,UAAU,IAAI;EACpC;EACA,IAAI,aAAa,KAAK,IAAI,GAAG;EAC7B,IAAI,CAAC,YAAY;GACf,aAAa,OAAO,IAAI,WAAW;GACnC,KAAK,IAAI,KAAK,UAAU;EAC1B;EACA,OAAO;CACT;CAEA,SACE,KACA,OACA,SACS;EACT,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK;EACjC,IAAI,CAAC,IAAI;GACP,KAAK,EAAE,KAAK;GACZ,KAAK,UAAU,IAAI,OAAO,EAAE;EAC9B;EACA,MAAM,SAAS,qBAAqB,KAAK,IACrC,QAAQ,QAAQ,UAAU,MAAM,MAAM,QAAQ,IAAI,IAClD,SAAS;EACb,MAAM,UAAU,eAAe,KAAK,QAAQ,OAAO;EACnD,MAAM,QACJ,QAAQ,QAAQ,SAAS,UAAU,UAAU,KAAK,SAAS,GAAG,CAAC,CAAC;EAClE,MAAM,WAAW,MAAM,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM;EACxD,MAAM,IAAI,MAAM;EAChB,QAAQ,IAAI,MAAM;EAClB,OAAO;CACT;AACF;;;ACzMA,SAAS,OAAO,QAAgB,KAAa,OAAsB;CACjE,QAAQ,eACN,KACA,OAAO,OAAO,CAAC,GAAI,QAAQ,eAAe,KAAK,MAAM,KAAK,CAAC,GAAI,KAAK,CAAC,GACrE,MACF;AACF;AACA,MAAa,eAAe,YAAYA,iBAAwB,QAAQ;AACxE,MAAa,qBACX,YAAYA,iBAAwB,UAAU;AAChD,MAAa,eAAe,YAC1B,gBACE,YAAYA,iBAAwB,UAAU,GAC9C,YAAYC,oBAA2B,SAAS,kBAAkB,IAAI,CACxE;AACF,MAAa,mBAAmB,SAC9B,YAAYC,wBAA+B,IAAI;AACjD,MAAa,oBACX,GAAG,UACA,YAAYC,4BAAmC,OAAO,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AAC7E,MAAa,gCACX,YAAYC,oCAA2C,IAAI;AAC7D,MAAa,sBAAsB,UAAU,SAC3C,YAAYC,0BAAiC,OAAO;AACtD,MAAa,wBACX,YAAYC,4BAAmC,IAAI;AACrD,MAAa,sBACX,gBACE,YAAYC,0BAAiC,IAAI,GACjD,UAAU,eAAe,GACzB,gBAAgB,0BAA0B,CAC5C;AACF,SAAgB,QACd,GAAG,cAC+B;CAClC,QACE,QACA,MACA,eACG;EACH,KAAK,MAAM,cAAc,cACvB,OACE,YAAY,SAAS,QACrBC,uBACA,UACF;CAEJ;AACF;AACA,MAAa,SACX,GAAG,kBACkB,EAAE,OAAO,aAAa;AAC7C,MAAa,SACX,GAAG,kBACkB,EAAE,OAAO,aAAa;AAC7C,MAAa,eACX,QACA,QACA,aACoB;CAAE;CAAQ;CAAQ,GAAG;AAAQ;AAQnD,SAAgB,cAAc,SAA0C;CACtE,MAAM,OAAO,QAAQ,QAAQ;CAC7B,KAAK,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG;EACjC,KACG,OAAO,QAAQ,YAAY,QAAQ,SACpC,OAAO,QAAQ,YAEf;EAEF,MAAM,SAAS,QAAQ,IAAI,KAAKC,cAAqB;EAGrD,IACE,UACA,OAAO,KAAK,WAAW,KAAK,UAC5B,OAAO,KAAK,OAAO,OAAO,UAAU,UAAU,KAAK,MAAM,KACzD,OAAO,YAAY,KAAA,KACnB,OAAO,MAAM,QAAQ,CAAC,EAAE,YAAY,OAAO,SAE3C,OAAO;CAEX;CAEA,MAAM,QAAQ,IAAI,aAAa;CAC/B,OAAO;EAAE;EAAM;EAAO,UAAU,IAAI,kBAAkB,KAAK;CAAE;AAC/D;AACA,SAAS,eAAe,MAID;CACrB,MAAM,YAAY,sBACf,OAAgB,YAA8B;EAC7C,MAAM,SAAS,cAAc,OAAO;EACpC,MAAM,QAAQ;GACZ,MAAM,QAAQ,QAAQ;GACtB,MAAM,GAAG,QAAQ,SAAS,CAAC,CAAC,KAAK,GAAG,QAAQ,WAAW,CAAC,CAAC;EAC3D;EACA,MAAM,UACJ,OAAO,YAAY,KAAA,KACnB,OAAO,MAAM,QAAQ,CAAC,EAAE,YAAY,OAAO,UACvC,OAAO,SAAS,QAAQ,IACxB,OAAO,SAAS,KAAK,KAAK;EAChC,OAAO,OAAO,SAAS,QACrB,SACA;GAAE,GAAG;GAAM,MAAM,MAAM;GAAM,SAAS,MAAM,aAAa,MAAM;EAAG,GAClE,KACF;CACF,CACF,CAAC,CAAC;CACF,QAAQ,QAAQ,aAAa,UAAU;EACrC,IAAI,gBAAgB,KAAA,GAClB,MAAM,IAAI,6BACR,0BACA,+CACF;EAGF,OADgB,QAAQ,IAAI,QAAQ,WACvB,GAAGC,2BAAkC;GAChD;GACA,GAAI,OAAO;IAAE,MAAM,KAAK;IAAM,QAAQ,KAAK;GAAO,IAAI,CAAC;EACzD,CAAC;EACD,UAAU,QAAQ,aAAa,KAAK;CACtC;AACF;AACA,MAAa,yBAA6C,eAAe;AACzE,SAAgB,qBAAiD,MAIpC;CAC3B,aAAa,eAAe,IAAI;AAClC;AACA,SAAgB,sBACd,MACA,MAC0B;CAC1B,aAAa;EACX,MAAM,YAAY,sBACf,OAAgB,YAA8B;GAC7C,MAAM,SAAS,cAAc,OAAO;GACpC,MAAM,QAAQ,OAAO,MAAM,QAAQ;GACnC,MAAM,QAAQ;IACZ,MAAM,QAAQ,QAAQ;IACtB,MAAM,GAAG,QAAQ,SAAS,CAAC,CAAC,KAAK,GAAG,QAAQ,WAAW,CAAC,CAAC;GAC3D;GACA,MAAM,UAAU,OAAO,UACnB,OAAO,SAAS,QAAQ,IACxB,OAAO,SAAS,KAAK,KAAK;GAC9B,MAAM,aAAa,OAAO,OACtB,CAAC,MAAM,KAAK,UAAU,IACtB,CAAC,MAAM,MAAM,GAAG,MAAM,IAAI;GAC9B,KAAK,MAAM,aAAa,YAAY;IAClC,IACE,CAAC,aACA,OAAO,cAAc,YAAY,OAAO,cAAc,YAEvD;IAEF,MAAM,SAAS,QAAQ,IAAI,WAAWC,iBAAwB;IAG9D,IAAI,QAAQ,IAAI,QAAQ,QAAQ,CAAC,EAAE,IAAI,IAAI,GACzC,OAAO,OAAO,IAAI,QAAQ,QAAQ,CAAC,CAAE,IAAI,IAAI;GAEjD;GACA,MAAM,OAAO,SAAS,QACpB,6BAA6B,UAC3B,uBACA,KAAK,SACL,EAAE,MAAM,MAAM,KAAK,CACrB,GACA,OACA,QAAQ,QACV;EACF,CACF,CAAC,CAAC;EACF,QAAQ,QAAQ,KAAK,UAAU;GAC7B,IAAI,QAAQ,KAAA,GACV,MAAM,IAAI,6BACR,2BACA,gDACF;GAEF,OAAO,QAAQ,IAAI,QAAQ,GAAG,GAAGC,4BAAmC;IAClE;IACA;IACA,SAAS,KAAK;GAChB,CAAC;GACD,UAAU,QAAQ,KAAK,KAAK;EAC9B;CACF;AACF;AAoBA,SAAgB,iBAAiB,SAG/B;CACA,OAAO;EACL,OAAO,QAAQ,eAAeC,eAAsB,OAAO,KAAK,CAAC;EACjE,eACE,QAAQ,eAAeC,kBAAyB,OAAO,KAAK,CAAC;CACjE;AACF;AACA,SAAS,KACP,OACA,OACA,SACwB;CACxB,QAAQ,SAAS,QAAQ,eAAe;EACtC,MAAM,UAAU,WAAW;EAC3B,MAAM,UAAU,iBAAiB,OAAO,CAAC,CAAC;EAC1C,OACE,SACAD,eACA,OAAO,OAAO;GACZ;GACA,OAAO,MAAM,QAAQ,KAAK,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,CAAC,IAAI;GAC1D,SAAS,OAAO,OAAO,EAAE,GAAG,QAAQ,CAAC;GACrC;GACA;GACA,kBAAkB,QAAQ;EAC5B,CAAC,CACH;CACF;AACF;AACA,MAAa,cACX,OACA,YAC2B,KAAK,UAAU,OAAO,OAAO;AAC1D,MAAa,aACX,OACA,YAC2B,KAAK,SAAS,OAAO,OAAO;AACzD,SAAS,aAGP,OAAW,QAAW,SAAuD;CAC7E,QAAQ,YAAY,QAAQ,eAAe;EACzC,MAAM,UAAU,WAAW;EAC3B,OACE,SACAC,kBACA,OAAO,OAAO;GACZ;GACA;GACA,SAAS,OAAO,OAAO,EAAE,GAAG,QAAQ,CAAC;GACrC;GACA;GACA,kBAAkB,iBAAiB,OAAO,CAAC,CAAC,cAAc;EAC5D,CAAC,CACH;CACF;AACF;AACA,MAAa,kBACX,QACA,YAEA,aAAa,UAAU,QAAQ,OAAO;AACxC,MAAa,iBACX,QACA,YACsC,aAAa,SAAS,QAAQ,OAAO"}

package/dist/{auth-decorators-9L-UO_T3.cjs → auth-decorators-pe3Aou21.cjs}

@@ -2,7 +2,7 @@ const require_auth_errors = require("./auth-errors-1EdQ36D8.cjs");
 const require_decorate = require("./decorate-DdRSPs9e.cjs");
 const require_auth_scope_interceptor = require("./auth-scope-interceptor-DJTO9RVP.cjs");
 const require_auth_guard = require("./auth-guard-Dh9SWsXf.cjs");
-const require_principal_readings = require("./principal-readings-K8zeZbEl.cjs");
+const require_principal_readings = require("./principal-readings-BGlXSUzj.cjs");
 let _nestjs_common = require("@nestjs/common");
 let node_async_hooks = require("node:async_hooks");
 //#region src/request-scope.ts
@@ -411,4 +411,4 @@ Object.defineProperty(exports, "requirement", {
 	}
 });
 
-//# sourceMappingURL=auth-decorators-9L-UO_T3.cjs.map
+//# sourceMappingURL=auth-decorators-pe3Aou21.cjs.map

package/dist/{auth-decorators-9L-UO_T3.cjs.map → auth-decorators-pe3Aou21.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"auth-decorators-9L-UO_T3.cjs","names":["AsyncLocalStorage","AuthFailures","isConfigurationError","SetMetadata","applyDecorators","UseGuards","BetterAuthGuard","UseInterceptors","BetterAuthScopeInterceptor","PrincipalReadings","createParamDecorator","BetterAuthConfigurationError"],"sources":["../src/request-scope.ts","../src/auth-decorators.ts"],"sourcesContent":["import { AsyncLocalStorage } from \"node:async_hooks\";\nimport type {\n  AuthorizationDecision,\n  InvocationLineage,\n  PrincipalReading,\n  PrincipalResult,\n  RoutePlan,\n  TransportCall,\n} from \"./auth-contracts.js\";\nimport {\n  AuthFailures,\n  type AuthFailure,\n  isConfigurationError,\n} from \"./auth-errors.js\";\nimport type { ScopeView } from \"./bridge-protocol.js\";\n\nexport interface ScopeState {\n  readonly view: ScopeView;\n  readonly call?: TransportCall;\n  readonly plan?: RoutePlan;\n  readonly reading?: () => PrincipalReading;\n}\nexport interface RequestState {\n  readonly principal: Map<string, Promise<PrincipalResult>>;\n  readonly policyIo: Map<string, Promise<unknown>>;\n  readonly decisions: Map<string, Promise<AuthorizationDecision>>;\n  readonly values: Map<symbol, unknown>;\n  readonly authorizationCalls: Set<string>;\n  readonly origins: Map<string, Promise<AuthFailure | null>>;\n  readonly surfaced: Set<string>;\n  readonly connections: Map<\n    string,\n    {\n      value: Extract<PrincipalResult, { outcome: \"authenticated\" | \"absent\" }>;\n      expiresAt: number;\n    }\n  >;\n}\n\nconst SURFACED = Symbol.for(\"nestjs-slightly-better-auth:surfaced\");\nexport function memoKey(\n  instance: string,\n  ...inputs: readonly unknown[]\n): string {\n  return JSON.stringify([instance, ...inputs]);\n}\n\n/** Shared by guards and readers that have only the transport's structural lineage. */\nexport function surfacedRecord(\n  key: object,\n  lineage?: InvocationLineage,\n): Set<string> {\n  const carrier = lineage?.carrier ?? key;\n  const partition = lineage ? lineage.position.split(\":\", 1)[0]! : \"\";\n  let records = Reflect.get(carrier, SURFACED) as\n    | Map<string, Set<string>>\n    | undefined;\n  if (!records) {\n    records = new Map();\n    Object.defineProperty(carrier, SURFACED, { value: records });\n  }\n  let record = records.get(partition);\n  if (!record) {\n    record = new Set();\n    records.set(partition, record);\n  }\n  return record;\n}\n\nexport class RequestScope {\n  readonly #storage = new AsyncLocalStorage<ScopeState>();\n  readonly #states = new WeakMap<object, RequestState>();\n  readonly #valueKeys = new Map<string, Map<symbol, symbol>>();\n  readonly #errorIds = new WeakMap<object, number>();\n  #nextError = 0;\n\n  run<T>(state: ScopeState, fn: () => T): T {\n    return this.#storage.run(state, fn);\n  }\n\n  exit<T>(fn: () => T): T {\n    return this.#storage.exit(fn);\n  }\n\n  current(): ScopeState | undefined {\n    return this.#storage.getStore();\n  }\n\n  stateFor(key: object): RequestState {\n    let state = this.#states.get(key);\n    if (!state) {\n      state = {\n        principal: new Map(),\n        policyIo: new Map(),\n        decisions: new Map(),\n        values: new Map(),\n        authorizationCalls: new Set(),\n        origins: new Map(),\n        surfaced: new Set(),\n        connections: new Map(),\n      };\n      this.#states.set(key, state);\n    }\n    return state;\n  }\n\n  memoPrincipal(\n    call: Pick<TransportCall, \"key\" | \"connection\" | \"principalTtlMs\">,\n    input: {\n      instance: string;\n      freshness: \"default\" | \"authoritative\";\n      sourceSet: string;\n    },\n    compute: () => Promise<PrincipalResult>,\n  ): Promise<PrincipalResult> {\n    const key = memoKey(input.instance, input.freshness, input.sourceSet);\n    const state = this.stateFor(call.key);\n    const existing = state.principal.get(key);\n    if (existing) {\n      return existing;\n    }\n    const connection =\n      call.connection &&\n      input.freshness !== \"authoritative\" &&\n      (call.principalTtlMs ?? 0) > 0\n        ? this.stateFor(call.connection).connections\n        : undefined;\n    const cached = connection?.get(key);\n    const promise = Promise.resolve().then(async () => {\n      if (cached && cached.expiresAt > Date.now()) {\n        return cached.value;\n      }\n      connection?.delete(key);\n      try {\n        const value = await compute();\n        if (value.outcome !== \"rejected\") {\n          connection?.set(key, {\n            value,\n            expiresAt: Date.now() + (call.principalTtlMs ?? 0),\n          });\n        }\n        return value;\n      } catch (error) {\n        connection?.delete(key);\n        throw error;\n      }\n    });\n    state.principal.set(key, promise);\n    return promise;\n  }\n\n  memoPolicyIo<T>(\n    request: object,\n    instance: string,\n    concreteKey: string,\n    compute: () => Promise<T>,\n    limit: number | false = 100,\n  ): Promise<T> {\n    const state = this.stateFor(request);\n    const key = memoKey(instance, concreteKey);\n    const existing = state.policyIo.get(key);\n    if (existing) {\n      return existing as Promise<T>;\n    }\n    if (\n      limit !== false &&\n      [...state.authorizationCalls].filter(\n        (entry) => JSON.parse(entry)[0] === instance,\n      ).length >= limit\n    ) {\n      return Promise.reject(\n        AuthFailures.rejected({\n          status: 429,\n          reason: \"TOO_MANY_AUTHORIZATION_CHECKS\",\n        }),\n      );\n    }\n    state.authorizationCalls.add(key);\n    const promise = Promise.resolve().then(compute);\n    state.policyIo.set(key, promise);\n    return promise;\n  }\n\n  memoDecision(\n    invocation: object,\n    instance: string,\n    concreteKey: string,\n    compute: () => Promise<AuthorizationDecision>,\n  ): Promise<AuthorizationDecision> {\n    const decisions = this.stateFor(invocation).decisions;\n    const key = memoKey(instance, concreteKey);\n    let promise = decisions.get(key);\n    if (!promise) {\n      promise = Promise.resolve().then(compute);\n      decisions.set(key, promise);\n    }\n    return promise;\n  }\n\n  valueKey(instance: string, key: symbol): symbol {\n    let keys = this.#valueKeys.get(instance);\n    if (!keys) {\n      keys = new Map();\n      this.#valueKeys.set(instance, keys);\n    }\n    let namespaced = keys.get(key);\n    if (!namespaced) {\n      namespaced = Symbol(key.description);\n      keys.set(key, namespaced);\n    }\n    return namespaced;\n  }\n\n  surfaced(\n    key: object,\n    error: object,\n    context: { instance: string; site: string; lineage?: InvocationLineage },\n  ): boolean {\n    let id = this.#errorIds.get(error);\n    if (!id) {\n      id = ++this.#nextError;\n      this.#errorIds.set(error, id);\n    }\n    const reason = isConfigurationError(error)\n      ? memoKey(context.instance, error.code, context.site)\n      : `error:${id}`;\n    const carrier = surfacedRecord(key, context.lineage);\n    const state =\n      key === context.lineage?.carrier ? carrier : this.stateFor(key).surfaced;\n    const repeated = state.has(reason) || carrier.has(reason);\n    state.add(reason);\n    carrier.add(reason);\n    return repeated;\n  }\n}\n","import {\n  applyDecorators,\n  createParamDecorator,\n  SetMetadata,\n  UseGuards,\n  UseInterceptors,\n  type ExecutionContext,\n} from \"@nestjs/common\";\nimport type {\n  DatabaseHookTarget,\n  DbHookMethodDecorator,\n  DbHookOptions,\n  HookMethodDecorator,\n  HookOptions,\n  HookPredicate,\n  PolicyRef,\n  PrincipalReading,\n  Requirement,\n  RequirementExpr,\n  RequirementOptions,\n} from \"./auth-contracts.js\";\nimport type {\n  EndpointPath,\n  PrincipalKind,\n  PrincipalOfKind,\n} from \"./auth-types.js\";\nimport { BetterAuthConfigurationError } from \"./auth-errors.js\";\nimport * as tokens from \"./auth-tokens.js\";\nimport { BetterAuthGuard } from \"./auth-guard.js\";\nimport { BetterAuthScopeInterceptor } from \"./auth-scope-interceptor.js\";\nimport { PrincipalReadings } from \"./principal-readings.js\";\nimport { RequestScope } from \"./request-scope.js\";\n\nfunction append(target: object, key: symbol, value: unknown): void {\n  Reflect.defineMetadata(\n    key,\n    Object.freeze([...(Reflect.getOwnMetadata(key, target) ?? []), value]),\n    target,\n  );\n}\nexport const Public = () => SetMetadata(tokens.ACCESS_METADATA, \"public\");\nexport const OptionalAuth = () =>\n  SetMetadata(tokens.ACCESS_METADATA, \"optional\");\nexport const RequireAuth = (options?: { authoritative?: boolean }) =>\n  applyDecorators(\n    SetMetadata(tokens.ACCESS_METADATA, \"required\"),\n    SetMetadata(tokens.FRESHNESS_METADATA, options?.authoritative === true),\n  );\nexport const UseAuthInstance = (name: string) =>\n  SetMetadata(tokens.AUTH_INSTANCE_METADATA, name);\nexport const AcceptPrincipals = (\n  ...kinds: readonly [PrincipalKind, ...PrincipalKind[]]\n) => SetMetadata(tokens.ACCEPT_PRINCIPALS_METADATA, Object.freeze([...kinds]));\nexport const SkipDefaultRequirements = () =>\n  SetMetadata(tokens.SKIP_DEFAULT_REQUIREMENTS_METADATA, true);\nexport const ForwardAuthCookies = (enabled = true) =>\n  SetMetadata(tokens.FORWARD_COOKIES_METADATA, enabled);\nexport const SkipOriginCheck = () =>\n  SetMetadata(tokens.SKIP_ORIGIN_CHECK_METADATA, true);\nexport const UseBetterAuth = () =>\n  applyDecorators(\n    SetMetadata(tokens.USE_BETTER_AUTH_METADATA, true),\n    UseGuards(BetterAuthGuard),\n    UseInterceptors(BetterAuthScopeInterceptor),\n  );\nexport function Require(\n  ...requirements: readonly RequirementExpr[]\n): ClassDecorator & MethodDecorator {\n  return (\n    target: object,\n    _key?: string | symbol,\n    descriptor?: PropertyDescriptor,\n  ) => {\n    for (const expression of requirements) {\n      append(\n        descriptor?.value ?? target,\n        tokens.REQUIREMENTS_METADATA,\n        expression,\n      );\n    }\n  };\n}\nexport const anyOf = (\n  ...requirements: readonly RequirementExpr[]\n): RequirementExpr => ({ anyOf: requirements });\nexport const allOf = (\n  ...requirements: readonly RequirementExpr[]\n): RequirementExpr => ({ allOf: requirements });\nexport const requirement = <P>(\n  policy: PolicyRef<P>,\n  params: P,\n  options?: RequirementOptions,\n): Requirement<P> => ({ policy, params, ...options });\n\nexport interface ReaderContext {\n  readonly args: readonly unknown[];\n  readonly readings: PrincipalReadings;\n  readonly scope: RequestScope;\n  readonly reading?: () => PrincipalReading;\n}\nexport function readerContext(context: ExecutionContext): ReaderContext {\n  const args = context.getArgs();\n  for (const arg of [args, ...args]) {\n    if (\n      (typeof arg !== \"object\" || arg === null) &&\n      typeof arg !== \"function\"\n    ) {\n      continue;\n    }\n    const bridge = Reflect.get(arg, tokens.READER_CONTEXT) as\n      | ReaderContext\n      | undefined;\n    if (\n      bridge &&\n      bridge.args.length === args.length &&\n      bridge.args.every((value, index) => value === args[index]) &&\n      bridge.reading !== undefined &&\n      bridge.scope.current()?.reading === bridge.reading\n    ) {\n      return bridge;\n    }\n  }\n  // No application state is created or retained by a DI-free lineage-only reader.\n  const scope = new RequestScope();\n  return { args, scope, readings: new PrincipalReadings(scope) };\n}\nfunction principalParam(spec?: {\n  kind: string;\n  reason: string;\n  project: (p: any) => unknown;\n}): ParameterDecorator {\n  const decorator = createParamDecorator(\n    (_data: unknown, context: ExecutionContext) => {\n      const bridge = readerContext(context);\n      const input = {\n        args: context.getArgs(),\n        site: `${context.getClass().name}.${context.getHandler().name}`,\n      };\n      const reading =\n        bridge.reading !== undefined &&\n        bridge.scope.current()?.reading === bridge.reading\n          ? bridge.readings.current()\n          : bridge.readings.read(input);\n      return bridge.readings.project(\n        reading,\n        { ...spec, site: input.site, project: spec?.project ?? ((p) => p) },\n        input,\n      );\n    },\n  )();\n  return (target, propertyKey, index) => {\n    if (propertyKey === undefined) {\n      throw new BetterAuthConfigurationError(\n        \"PRINCIPAL_PARAM_TARGET\",\n        \"Principal parameters require a handler method\",\n      );\n    }\n    const handler = Reflect.get(target, propertyKey);\n    append(handler, tokens.PRINCIPAL_PARAMS_METADATA, {\n      index,\n      ...(spec ? { kind: spec.kind, reason: spec.reason } : {}),\n    });\n    decorator(target, propertyKey, index);\n  };\n}\nexport const CurrentPrincipal = (): ParameterDecorator => principalParam();\nexport function definePrincipalParam<K extends PrincipalKind, R>(spec: {\n  readonly kind: K;\n  readonly reason: string;\n  readonly project: (principal: PrincipalOfKind<K>) => R;\n}): () => ParameterDecorator {\n  return () => principalParam(spec);\n}\nexport function defineInvocationParam(\n  slot: symbol,\n  spec: { readonly missing: string },\n): () => ParameterDecorator {\n  return () => {\n    const decorator = createParamDecorator(\n      (_data: unknown, context: ExecutionContext) => {\n        const bridge = readerContext(context);\n        const state = bridge.scope.current();\n        const input = {\n          args: context.getArgs(),\n          site: `${context.getClass().name}.${context.getHandler().name}`,\n        };\n        const reading = state?.reading\n          ? bridge.readings.current()\n          : bridge.readings.read(input);\n        const candidates = state?.call\n          ? [state.call.invocation]\n          : [input.args, ...input.args];\n        for (const candidate of candidates) {\n          if (\n            !candidate ||\n            (typeof candidate !== \"object\" && typeof candidate !== \"function\")\n          ) {\n            continue;\n          }\n          const values = Reflect.get(candidate, tokens.INVOCATION_VALUES) as\n            | Map<string, Map<symbol, unknown>>\n            | undefined;\n          if (values?.get(reading.instance)?.has(slot)) {\n            return values.get(reading.instance)!.get(slot);\n          }\n        }\n        throw bridge.readings.deliver(\n          BetterAuthConfigurationError.atRequest(\n            \"NO_INVOCATION_VALUE\",\n            spec.missing,\n            { site: input.site },\n          ),\n          input,\n          reading.instance,\n        );\n      },\n    )();\n    return (target, key, index) => {\n      if (key === undefined) {\n        throw new BetterAuthConfigurationError(\n          \"INVOCATION_PARAM_TARGET\",\n          \"Invocation parameters require a handler method\",\n        );\n      }\n      append(Reflect.get(target, key), tokens.INVOCATION_PARAMS_METADATA, {\n        index,\n        slot,\n        missing: spec.missing,\n      });\n      decorator(target, key, index);\n    };\n  };\n}\nexport interface EndpointHookDeclaration {\n  readonly phase: \"before\" | \"after\";\n  readonly match: string | readonly string[] | HookPredicate | undefined;\n  readonly options: Readonly<HookOptions>;\n  readonly method: string | symbol;\n  // biome-ignore lint/complexity/noBannedTypes: Nest handler metadata preserves the framework function identity.\n  readonly handler: Function;\n  readonly declarationOrder: number;\n}\nexport interface DatabaseHookDeclaration {\n  readonly phase: \"before\" | \"after\";\n  readonly target: DatabaseHookTarget;\n  readonly options: Readonly<DbHookOptions>;\n  readonly method: string | symbol;\n  // biome-ignore lint/complexity/noBannedTypes: Nest handler metadata preserves the framework function identity.\n  readonly handler: Function;\n  readonly declarationOrder: number;\n}\n// biome-ignore lint/complexity/noBannedTypes: Nest handler metadata preserves the framework function identity.\nexport function readHookMetadata(handler: Function): {\n  readonly hooks: readonly EndpointHookDeclaration[];\n  readonly databaseHooks: readonly DatabaseHookDeclaration[];\n} {\n  return {\n    hooks: Reflect.getOwnMetadata(tokens.HOOK_METADATA, handler) ?? [],\n    databaseHooks:\n      Reflect.getOwnMetadata(tokens.DB_HOOK_METADATA, handler) ?? [],\n  };\n}\nfunction hook<P extends string>(\n  phase: \"before\" | \"after\",\n  match?: P | readonly P[] | HookPredicate,\n  options?: HookOptions,\n): HookMethodDecorator<P> {\n  return (_target, method, descriptor) => {\n    const handler = descriptor.value!;\n    const records = readHookMetadata(handler).hooks;\n    append(\n      handler,\n      tokens.HOOK_METADATA,\n      Object.freeze({\n        phase,\n        match: Array.isArray(match) ? Object.freeze([...match]) : match,\n        options: Object.freeze({ ...options }),\n        method,\n        handler,\n        declarationOrder: records.length,\n      }),\n    );\n  };\n}\nexport const BeforeAuth = <const P extends EndpointPath | (string & {})>(\n  match?: P | readonly P[] | HookPredicate,\n  options?: HookOptions,\n): HookMethodDecorator<P> => hook(\"before\", match, options);\nexport const AfterAuth = <const P extends EndpointPath | (string & {})>(\n  match?: P | readonly P[] | HookPredicate,\n  options?: HookOptions,\n): HookMethodDecorator<P> => hook(\"after\", match, options);\nfunction databaseHook<\n  E extends DatabaseHookTarget,\n  Ph extends \"before\" | \"after\",\n>(phase: Ph, target: E, options?: DbHookOptions): DbHookMethodDecorator<E, Ph> {\n  return (_prototype, method, descriptor) => {\n    const handler = descriptor.value!;\n    append(\n      handler,\n      tokens.DB_HOOK_METADATA,\n      Object.freeze({\n        phase,\n        target,\n        options: Object.freeze({ ...options }),\n        method,\n        handler,\n        declarationOrder: readHookMetadata(handler).databaseHooks.length,\n      }),\n    );\n  };\n}\nexport const BeforeDatabase = <E extends DatabaseHookTarget>(\n  target: E,\n  options?: DbHookOptions,\n): DbHookMethodDecorator<E, \"before\"> =>\n  databaseHook(\"before\", target, options);\nexport const AfterDatabase = <E extends DatabaseHookTarget>(\n  target: E,\n  options?: DbHookOptions,\n): DbHookMethodDecorator<E, \"after\"> => databaseHook(\"after\", target, options);\n"],"mappings":";;;;;;;;AAuCA,MAAM,WAAW,OAAO,IAAI,sCAAsC;AAClE,SAAgB,QACd,UACA,GAAG,QACK;CACR,OAAO,KAAK,UAAU,CAAC,UAAU,GAAG,MAAM,CAAC;AAC7C;;AAGA,SAAgB,eACd,KACA,SACa;CACb,MAAM,UAAU,SAAS,WAAW;CACpC,MAAM,YAAY,UAAU,QAAQ,SAAS,MAAM,KAAK,CAAC,CAAC,CAAC,KAAM;CACjE,IAAI,UAAU,QAAQ,IAAI,SAAS,QAAQ;CAG3C,IAAI,CAAC,SAAS;EACZ,0BAAU,IAAI,IAAI;EAClB,OAAO,eAAe,SAAS,UAAU,EAAE,OAAO,QAAQ,CAAC;CAC7D;CACA,IAAI,SAAS,QAAQ,IAAI,SAAS;CAClC,IAAI,CAAC,QAAQ;EACX,yBAAS,IAAI,IAAI;EACjB,QAAQ,IAAI,WAAW,MAAM;CAC/B;CACA,OAAO;AACT;AAEA,IAAa,eAAb,MAA0B;CACxB,WAAoB,IAAIA,iBAAAA,kBAA8B;CACtD,0BAAmB,IAAI,QAA8B;CACrD,6BAAsB,IAAI,IAAiC;CAC3D,4BAAqB,IAAI,QAAwB;CACjD,aAAa;CAEb,IAAO,OAAmB,IAAgB;EACxC,OAAO,KAAK,SAAS,IAAI,OAAO,EAAE;CACpC;CAEA,KAAQ,IAAgB;EACtB,OAAO,KAAK,SAAS,KAAK,EAAE;CAC9B;CAEA,UAAkC;EAChC,OAAO,KAAK,SAAS,SAAS;CAChC;CAEA,SAAS,KAA2B;EAClC,IAAI,QAAQ,KAAK,QAAQ,IAAI,GAAG;EAChC,IAAI,CAAC,OAAO;GACV,QAAQ;IACN,2BAAW,IAAI,IAAI;IACnB,0BAAU,IAAI,IAAI;IAClB,2BAAW,IAAI,IAAI;IACnB,wBAAQ,IAAI,IAAI;IAChB,oCAAoB,IAAI,IAAI;IAC5B,yBAAS,IAAI,IAAI;IACjB,0BAAU,IAAI,IAAI;IAClB,6BAAa,IAAI,IAAI;GACvB;GACA,KAAK,QAAQ,IAAI,KAAK,KAAK;EAC7B;EACA,OAAO;CACT;CAEA,cACE,MACA,OAKA,SAC0B;EAC1B,MAAM,MAAM,QAAQ,MAAM,UAAU,MAAM,WAAW,MAAM,SAAS;EACpE,MAAM,QAAQ,KAAK,SAAS,KAAK,GAAG;EACpC,MAAM,WAAW,MAAM,UAAU,IAAI,GAAG;EACxC,IAAI,UACF,OAAO;EAET,MAAM,aACJ,KAAK,cACL,MAAM,cAAc,oBACnB,KAAK,kBAAkB,KAAK,IACzB,KAAK,SAAS,KAAK,UAAU,CAAC,CAAC,cAC/B,KAAA;EACN,MAAM,SAAS,YAAY,IAAI,GAAG;EAClC,MAAM,UAAU,QAAQ,QAAQ,CAAC,CAAC,KAAK,YAAY;GACjD,IAAI,UAAU,OAAO,YAAY,KAAK,IAAI,GACxC,OAAO,OAAO;GAEhB,YAAY,OAAO,GAAG;GACtB,IAAI;IACF,MAAM,QAAQ,MAAM,QAAQ;IAC5B,IAAI,MAAM,YAAY,YACpB,YAAY,IAAI,KAAK;KACnB;KACA,WAAW,KAAK,IAAI,KAAK,KAAK,kBAAkB;IAClD,CAAC;IAEH,OAAO;GACT,SAAS,OAAO;IACd,YAAY,OAAO,GAAG;IACtB,MAAM;GACR;EACF,CAAC;EACD,MAAM,UAAU,IAAI,KAAK,OAAO;EAChC,OAAO;CACT;CAEA,aACE,SACA,UACA,aACA,SACA,QAAwB,KACZ;EACZ,MAAM,QAAQ,KAAK,SAAS,OAAO;EACnC,MAAM,MAAM,QAAQ,UAAU,WAAW;EACzC,MAAM,WAAW,MAAM,SAAS,IAAI,GAAG;EACvC,IAAI,UACF,OAAO;EAET,IACE,UAAU,SACV,CAAC,GAAG,MAAM,kBAAkB,CAAC,CAAC,QAC3B,UAAU,KAAK,MAAM,KAAK,CAAC,CAAC,OAAO,QACtC,CAAC,CAAC,UAAU,OAEZ,OAAO,QAAQ,OACbC,oBAAAA,aAAa,SAAS;GACpB,QAAQ;GACR,QAAQ;EACV,CAAC,CACH;EAEF,MAAM,mBAAmB,IAAI,GAAG;EAChC,MAAM,UAAU,QAAQ,QAAQ,CAAC,CAAC,KAAK,OAAO;EAC9C,MAAM,SAAS,IAAI,KAAK,OAAO;EAC/B,OAAO;CACT;CAEA,aACE,YACA,UACA,aACA,SACgC;EAChC,MAAM,YAAY,KAAK,SAAS,UAAU,CAAC,CAAC;EAC5C,MAAM,MAAM,QAAQ,UAAU,WAAW;EACzC,IAAI,UAAU,UAAU,IAAI,GAAG;EAC/B,IAAI,CAAC,SAAS;GACZ,UAAU,QAAQ,QAAQ,CAAC,CAAC,KAAK,OAAO;GACxC,UAAU,IAAI,KAAK,OAAO;EAC5B;EACA,OAAO;CACT;CAEA,SAAS,UAAkB,KAAqB;EAC9C,IAAI,OAAO,KAAK,WAAW,IAAI,QAAQ;EACvC,IAAI,CAAC,MAAM;GACT,uBAAO,IAAI,IAAI;GACf,KAAK,WAAW,IAAI,UAAU,IAAI;EACpC;EACA,IAAI,aAAa,KAAK,IAAI,GAAG;EAC7B,IAAI,CAAC,YAAY;GACf,aAAa,OAAO,IAAI,WAAW;GACnC,KAAK,IAAI,KAAK,UAAU;EAC1B;EACA,OAAO;CACT;CAEA,SACE,KACA,OACA,SACS;EACT,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK;EACjC,IAAI,CAAC,IAAI;GACP,KAAK,EAAE,KAAK;GACZ,KAAK,UAAU,IAAI,OAAO,EAAE;EAC9B;EACA,MAAM,SAASC,oBAAAA,qBAAqB,KAAK,IACrC,QAAQ,QAAQ,UAAU,MAAM,MAAM,QAAQ,IAAI,IAClD,SAAS;EACb,MAAM,UAAU,eAAe,KAAK,QAAQ,OAAO;EACnD,MAAM,QACJ,QAAQ,QAAQ,SAAS,UAAU,UAAU,KAAK,SAAS,GAAG,CAAC,CAAC;EAClE,MAAM,WAAW,MAAM,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM;EACxD,MAAM,IAAI,MAAM;EAChB,QAAQ,IAAI,MAAM;EAClB,OAAO;CACT;AACF;;;ACzMA,SAAS,OAAO,QAAgB,KAAa,OAAsB;CACjE,QAAQ,eACN,KACA,OAAO,OAAO,CAAC,GAAI,QAAQ,eAAe,KAAK,MAAM,KAAK,CAAC,GAAI,KAAK,CAAC,GACrE,MACF;AACF;AACA,MAAa,gBAAA,GAAeC,eAAAA,YAAAA,CAAAA,iBAAAA,iBAAoC,QAAQ;AACxE,MAAa,sBAAA,GACXA,eAAAA,YAAAA,CAAAA,iBAAAA,iBAAoC,UAAU;AAChD,MAAa,eAAe,aAAA,GAC1BC,eAAAA,gBAAAA,EAAAA,GACED,eAAAA,YAAAA,CAAAA,iBAAAA,iBAAoC,UAAU,IAAA,GAC9CA,eAAAA,YAAAA,CAAAA,iBAAAA,oBAAuC,SAAS,kBAAkB,IAAI,CACxE;AACF,MAAa,mBAAmB,UAAA,GAC9BA,eAAAA,YAAAA,CAAAA,iBAAAA,wBAA2C,IAAI;AACjD,MAAa,oBACX,GAAG,WAAA,GACAA,eAAAA,YAAAA,CAAAA,iBAAAA,4BAA+C,OAAO,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AAC7E,MAAa,iCAAA,GACXA,eAAAA,YAAAA,CAAAA,iBAAAA,oCAAuD,IAAI;AAC7D,MAAa,sBAAsB,UAAU,UAAA,GAC3CA,eAAAA,YAAAA,CAAAA,iBAAAA,0BAA6C,OAAO;AACtD,MAAa,yBAAA,GACXA,eAAAA,YAAAA,CAAAA,iBAAAA,4BAA+C,IAAI;AACrD,MAAa,uBAAA,GACXC,eAAAA,gBAAAA,EAAAA,GACED,eAAAA,YAAAA,CAAAA,iBAAAA,0BAA6C,IAAI,IAAA,GACjDE,eAAAA,UAAAA,CAAUC,mBAAAA,eAAe,IAAA,GACzBC,eAAAA,gBAAAA,CAAgBC,+BAAAA,0BAA0B,CAC5C;AACF,SAAgB,QACd,GAAG,cAC+B;CAClC,QACE,QACA,MACA,eACG;EACH,KAAK,MAAM,cAAc,cACvB,OACE,YAAY,SAAS,QAAA,iBAAA,uBAErB,UACF;CAEJ;AACF;AACA,MAAa,SACX,GAAG,kBACkB,EAAE,OAAO,aAAa;AAC7C,MAAa,SACX,GAAG,kBACkB,EAAE,OAAO,aAAa;AAC7C,MAAa,eACX,QACA,QACA,aACoB;CAAE;CAAQ;CAAQ,GAAG;AAAQ;AAQnD,SAAgB,cAAc,SAA0C;CACtE,MAAM,OAAO,QAAQ,QAAQ;CAC7B,KAAK,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG;EACjC,KACG,OAAO,QAAQ,YAAY,QAAQ,SACpC,OAAO,QAAQ,YAEf;EAEF,MAAM,SAAS,QAAQ,IAAI,KAAA,iBAAA,cAA0B;EAGrD,IACE,UACA,OAAO,KAAK,WAAW,KAAK,UAC5B,OAAO,KAAK,OAAO,OAAO,UAAU,UAAU,KAAK,MAAM,KACzD,OAAO,YAAY,KAAA,KACnB,OAAO,MAAM,QAAQ,CAAC,EAAE,YAAY,OAAO,SAE3C,OAAO;CAEX;CAEA,MAAM,QAAQ,IAAI,aAAa;CAC/B,OAAO;EAAE;EAAM;EAAO,UAAU,IAAIC,2BAAAA,kBAAkB,KAAK;CAAE;AAC/D;AACA,SAAS,eAAe,MAID;CACrB,MAAM,aAAA,GAAYC,eAAAA,qBAAAA,EACf,OAAgB,YAA8B;EAC7C,MAAM,SAAS,cAAc,OAAO;EACpC,MAAM,QAAQ;GACZ,MAAM,QAAQ,QAAQ;GACtB,MAAM,GAAG,QAAQ,SAAS,CAAC,CAAC,KAAK,GAAG,QAAQ,WAAW,CAAC,CAAC;EAC3D;EACA,MAAM,UACJ,OAAO,YAAY,KAAA,KACnB,OAAO,MAAM,QAAQ,CAAC,EAAE,YAAY,OAAO,UACvC,OAAO,SAAS,QAAQ,IACxB,OAAO,SAAS,KAAK,KAAK;EAChC,OAAO,OAAO,SAAS,QACrB,SACA;GAAE,GAAG;GAAM,MAAM,MAAM;GAAM,SAAS,MAAM,aAAa,MAAM;EAAG,GAClE,KACF;CACF,CACF,CAAC,CAAC;CACF,QAAQ,QAAQ,aAAa,UAAU;EACrC,IAAI,gBAAgB,KAAA,GAClB,MAAM,IAAIC,oBAAAA,6BACR,0BACA,+CACF;EAGF,OADgB,QAAQ,IAAI,QAAQ,WACvB,GAAA,iBAAA,2BAAqC;GAChD;GACA,GAAI,OAAO;IAAE,MAAM,KAAK;IAAM,QAAQ,KAAK;GAAO,IAAI,CAAC;EACzD,CAAC;EACD,UAAU,QAAQ,aAAa,KAAK;CACtC;AACF;AACA,MAAa,yBAA6C,eAAe;AACzE,SAAgB,qBAAiD,MAIpC;CAC3B,aAAa,eAAe,IAAI;AAClC;AACA,SAAgB,sBACd,MACA,MAC0B;CAC1B,aAAa;EACX,MAAM,aAAA,GAAYD,eAAAA,qBAAAA,EACf,OAAgB,YAA8B;GAC7C,MAAM,SAAS,cAAc,OAAO;GACpC,MAAM,QAAQ,OAAO,MAAM,QAAQ;GACnC,MAAM,QAAQ;IACZ,MAAM,QAAQ,QAAQ;IACtB,MAAM,GAAG,QAAQ,SAAS,CAAC,CAAC,KAAK,GAAG,QAAQ,WAAW,CAAC,CAAC;GAC3D;GACA,MAAM,UAAU,OAAO,UACnB,OAAO,SAAS,QAAQ,IACxB,OAAO,SAAS,KAAK,KAAK;GAC9B,MAAM,aAAa,OAAO,OACtB,CAAC,MAAM,KAAK,UAAU,IACtB,CAAC,MAAM,MAAM,GAAG,MAAM,IAAI;GAC9B,KAAK,MAAM,aAAa,YAAY;IAClC,IACE,CAAC,aACA,OAAO,cAAc,YAAY,OAAO,cAAc,YAEvD;IAEF,MAAM,SAAS,QAAQ,IAAI,WAAA,iBAAA,iBAAmC;IAG9D,IAAI,QAAQ,IAAI,QAAQ,QAAQ,CAAC,EAAE,IAAI,IAAI,GACzC,OAAO,OAAO,IAAI,QAAQ,QAAQ,CAAC,CAAE,IAAI,IAAI;GAEjD;GACA,MAAM,OAAO,SAAS,QACpBC,oBAAAA,6BAA6B,UAC3B,uBACA,KAAK,SACL,EAAE,MAAM,MAAM,KAAK,CACrB,GACA,OACA,QAAQ,QACV;EACF,CACF,CAAC,CAAC;EACF,QAAQ,QAAQ,KAAK,UAAU;GAC7B,IAAI,QAAQ,KAAA,GACV,MAAM,IAAIA,oBAAAA,6BACR,2BACA,gDACF;GAEF,OAAO,QAAQ,IAAI,QAAQ,GAAG,GAAA,iBAAA,4BAAsC;IAClE;IACA;IACA,SAAS,KAAK;GAChB,CAAC;GACD,UAAU,QAAQ,KAAK,KAAK;EAC9B;CACF;AACF;AAoBA,SAAgB,iBAAiB,SAG/B;CACA,OAAO;EACL,OAAO,QAAQ,eAAA,iBAAA,eAAqC,OAAO,KAAK,CAAC;EACjE,eACE,QAAQ,eAAA,iBAAA,kBAAwC,OAAO,KAAK,CAAC;CACjE;AACF;AACA,SAAS,KACP,OACA,OACA,SACwB;CACxB,QAAQ,SAAS,QAAQ,eAAe;EACtC,MAAM,UAAU,WAAW;EAC3B,MAAM,UAAU,iBAAiB,OAAO,CAAC,CAAC;EAC1C,OACE,SAAA,iBAAA,eAEA,OAAO,OAAO;GACZ;GACA,OAAO,MAAM,QAAQ,KAAK,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,CAAC,IAAI;GAC1D,SAAS,OAAO,OAAO,EAAE,GAAG,QAAQ,CAAC;GACrC;GACA;GACA,kBAAkB,QAAQ;EAC5B,CAAC,CACH;CACF;AACF;AACA,MAAa,cACX,OACA,YAC2B,KAAK,UAAU,OAAO,OAAO;AAC1D,MAAa,aACX,OACA,YAC2B,KAAK,SAAS,OAAO,OAAO;AACzD,SAAS,aAGP,OAAW,QAAW,SAAuD;CAC7E,QAAQ,YAAY,QAAQ,eAAe;EACzC,MAAM,UAAU,WAAW;EAC3B,OACE,SAAA,iBAAA,kBAEA,OAAO,OAAO;GACZ;GACA;GACA,SAAS,OAAO,OAAO,EAAE,GAAG,QAAQ,CAAC;GACrC;GACA;GACA,kBAAkB,iBAAiB,OAAO,CAAC,CAAC,cAAc;EAC5D,CAAC,CACH;CACF;AACF;AACA,MAAa,kBACX,QACA,YAEA,aAAa,UAAU,QAAQ,OAAO;AACxC,MAAa,iBACX,QACA,YACsC,aAAa,SAAS,QAAQ,OAAO"}
+{"version":3,"file":"auth-decorators-pe3Aou21.cjs","names":["AsyncLocalStorage","AuthFailures","isConfigurationError","SetMetadata","applyDecorators","UseGuards","BetterAuthGuard","UseInterceptors","BetterAuthScopeInterceptor","PrincipalReadings","createParamDecorator","BetterAuthConfigurationError"],"sources":["../src/request-scope.ts","../src/auth-decorators.ts"],"sourcesContent":["import { AsyncLocalStorage } from \"node:async_hooks\";\nimport type {\n  AuthorizationDecision,\n  InvocationLineage,\n  PrincipalReading,\n  PrincipalResult,\n  RoutePlan,\n  TransportCall,\n} from \"./auth-contracts.js\";\nimport {\n  AuthFailures,\n  type AuthFailure,\n  isConfigurationError,\n} from \"./auth-errors.js\";\nimport type { ScopeView } from \"./bridge-protocol.js\";\n\nexport interface ScopeState {\n  readonly view: ScopeView;\n  readonly call?: TransportCall;\n  readonly plan?: RoutePlan;\n  readonly reading?: () => PrincipalReading;\n}\nexport interface RequestState {\n  readonly principal: Map<string, Promise<PrincipalResult>>;\n  readonly policyIo: Map<string, Promise<unknown>>;\n  readonly decisions: Map<string, Promise<AuthorizationDecision>>;\n  readonly values: Map<symbol, unknown>;\n  readonly authorizationCalls: Set<string>;\n  readonly origins: Map<string, Promise<AuthFailure | null>>;\n  readonly surfaced: Set<string>;\n  readonly connections: Map<\n    string,\n    {\n      value: Extract<PrincipalResult, { outcome: \"authenticated\" | \"absent\" }>;\n      expiresAt: number;\n    }\n  >;\n}\n\nconst SURFACED = Symbol.for(\"nestjs-slightly-better-auth:surfaced\");\nexport function memoKey(\n  instance: string,\n  ...inputs: readonly unknown[]\n): string {\n  return JSON.stringify([instance, ...inputs]);\n}\n\n/** Shared by guards and readers that have only the transport's structural lineage. */\nexport function surfacedRecord(\n  key: object,\n  lineage?: InvocationLineage,\n): Set<string> {\n  const carrier = lineage?.carrier ?? key;\n  const partition = lineage ? lineage.position.split(\":\", 1)[0]! : \"\";\n  let records = Reflect.get(carrier, SURFACED) as\n    | Map<string, Set<string>>\n    | undefined;\n  if (!records) {\n    records = new Map();\n    Object.defineProperty(carrier, SURFACED, { value: records });\n  }\n  let record = records.get(partition);\n  if (!record) {\n    record = new Set();\n    records.set(partition, record);\n  }\n  return record;\n}\n\nexport class RequestScope {\n  readonly #storage = new AsyncLocalStorage<ScopeState>();\n  readonly #states = new WeakMap<object, RequestState>();\n  readonly #valueKeys = new Map<string, Map<symbol, symbol>>();\n  readonly #errorIds = new WeakMap<object, number>();\n  #nextError = 0;\n\n  run<T>(state: ScopeState, fn: () => T): T {\n    return this.#storage.run(state, fn);\n  }\n\n  exit<T>(fn: () => T): T {\n    return this.#storage.exit(fn);\n  }\n\n  current(): ScopeState | undefined {\n    return this.#storage.getStore();\n  }\n\n  stateFor(key: object): RequestState {\n    let state = this.#states.get(key);\n    if (!state) {\n      state = {\n        principal: new Map(),\n        policyIo: new Map(),\n        decisions: new Map(),\n        values: new Map(),\n        authorizationCalls: new Set(),\n        origins: new Map(),\n        surfaced: new Set(),\n        connections: new Map(),\n      };\n      this.#states.set(key, state);\n    }\n    return state;\n  }\n\n  memoPrincipal(\n    call: Pick<TransportCall, \"key\" | \"connection\" | \"principalTtlMs\">,\n    input: {\n      instance: string;\n      freshness: \"default\" | \"authoritative\";\n      sourceSet: string;\n    },\n    compute: () => Promise<PrincipalResult>,\n  ): Promise<PrincipalResult> {\n    const key = memoKey(input.instance, input.freshness, input.sourceSet);\n    const state = this.stateFor(call.key);\n    const existing = state.principal.get(key);\n    if (existing) {\n      return existing;\n    }\n    const connection =\n      call.connection &&\n      input.freshness !== \"authoritative\" &&\n      (call.principalTtlMs ?? 0) > 0\n        ? this.stateFor(call.connection).connections\n        : undefined;\n    const cached = connection?.get(key);\n    const promise = Promise.resolve().then(async () => {\n      if (cached && cached.expiresAt > Date.now()) {\n        return cached.value;\n      }\n      connection?.delete(key);\n      try {\n        const value = await compute();\n        if (value.outcome !== \"rejected\") {\n          connection?.set(key, {\n            value,\n            expiresAt: Date.now() + (call.principalTtlMs ?? 0),\n          });\n        }\n        return value;\n      } catch (error) {\n        connection?.delete(key);\n        throw error;\n      }\n    });\n    state.principal.set(key, promise);\n    return promise;\n  }\n\n  memoPolicyIo<T>(\n    request: object,\n    instance: string,\n    concreteKey: string,\n    compute: () => Promise<T>,\n    limit: number | false = 100,\n  ): Promise<T> {\n    const state = this.stateFor(request);\n    const key = memoKey(instance, concreteKey);\n    const existing = state.policyIo.get(key);\n    if (existing) {\n      return existing as Promise<T>;\n    }\n    if (\n      limit !== false &&\n      [...state.authorizationCalls].filter(\n        (entry) => JSON.parse(entry)[0] === instance,\n      ).length >= limit\n    ) {\n      return Promise.reject(\n        AuthFailures.rejected({\n          status: 429,\n          reason: \"TOO_MANY_AUTHORIZATION_CHECKS\",\n        }),\n      );\n    }\n    state.authorizationCalls.add(key);\n    const promise = Promise.resolve().then(compute);\n    state.policyIo.set(key, promise);\n    return promise;\n  }\n\n  memoDecision(\n    invocation: object,\n    instance: string,\n    concreteKey: string,\n    compute: () => Promise<AuthorizationDecision>,\n  ): Promise<AuthorizationDecision> {\n    const decisions = this.stateFor(invocation).decisions;\n    const key = memoKey(instance, concreteKey);\n    let promise = decisions.get(key);\n    if (!promise) {\n      promise = Promise.resolve().then(compute);\n      decisions.set(key, promise);\n    }\n    return promise;\n  }\n\n  valueKey(instance: string, key: symbol): symbol {\n    let keys = this.#valueKeys.get(instance);\n    if (!keys) {\n      keys = new Map();\n      this.#valueKeys.set(instance, keys);\n    }\n    let namespaced = keys.get(key);\n    if (!namespaced) {\n      namespaced = Symbol(key.description);\n      keys.set(key, namespaced);\n    }\n    return namespaced;\n  }\n\n  surfaced(\n    key: object,\n    error: object,\n    context: { instance: string; site: string; lineage?: InvocationLineage },\n  ): boolean {\n    let id = this.#errorIds.get(error);\n    if (!id) {\n      id = ++this.#nextError;\n      this.#errorIds.set(error, id);\n    }\n    const reason = isConfigurationError(error)\n      ? memoKey(context.instance, error.code, context.site)\n      : `error:${id}`;\n    const carrier = surfacedRecord(key, context.lineage);\n    const state =\n      key === context.lineage?.carrier ? carrier : this.stateFor(key).surfaced;\n    const repeated = state.has(reason) || carrier.has(reason);\n    state.add(reason);\n    carrier.add(reason);\n    return repeated;\n  }\n}\n","import {\n  applyDecorators,\n  createParamDecorator,\n  SetMetadata,\n  UseGuards,\n  UseInterceptors,\n  type ExecutionContext,\n} from \"@nestjs/common\";\nimport type {\n  DatabaseHookTarget,\n  DbHookMethodDecorator,\n  DbHookOptions,\n  HookMethodDecorator,\n  HookOptions,\n  HookPredicate,\n  PolicyRef,\n  PrincipalReading,\n  Requirement,\n  RequirementExpr,\n  RequirementOptions,\n} from \"./auth-contracts.js\";\nimport type {\n  EndpointPath,\n  PrincipalKind,\n  PrincipalOfKind,\n} from \"./auth-types.js\";\nimport { BetterAuthConfigurationError } from \"./auth-errors.js\";\nimport * as tokens from \"./auth-tokens.js\";\nimport { BetterAuthGuard } from \"./auth-guard.js\";\nimport { BetterAuthScopeInterceptor } from \"./auth-scope-interceptor.js\";\nimport { PrincipalReadings } from \"./principal-readings.js\";\nimport { RequestScope } from \"./request-scope.js\";\n\nfunction append(target: object, key: symbol, value: unknown): void {\n  Reflect.defineMetadata(\n    key,\n    Object.freeze([...(Reflect.getOwnMetadata(key, target) ?? []), value]),\n    target,\n  );\n}\nexport const Public = () => SetMetadata(tokens.ACCESS_METADATA, \"public\");\nexport const OptionalAuth = () =>\n  SetMetadata(tokens.ACCESS_METADATA, \"optional\");\nexport const RequireAuth = (options?: { authoritative?: boolean }) =>\n  applyDecorators(\n    SetMetadata(tokens.ACCESS_METADATA, \"required\"),\n    SetMetadata(tokens.FRESHNESS_METADATA, options?.authoritative === true),\n  );\nexport const UseAuthInstance = (name: string) =>\n  SetMetadata(tokens.AUTH_INSTANCE_METADATA, name);\nexport const AcceptPrincipals = (\n  ...kinds: readonly [PrincipalKind, ...PrincipalKind[]]\n) => SetMetadata(tokens.ACCEPT_PRINCIPALS_METADATA, Object.freeze([...kinds]));\nexport const SkipDefaultRequirements = () =>\n  SetMetadata(tokens.SKIP_DEFAULT_REQUIREMENTS_METADATA, true);\nexport const ForwardAuthCookies = (enabled = true) =>\n  SetMetadata(tokens.FORWARD_COOKIES_METADATA, enabled);\nexport const SkipOriginCheck = () =>\n  SetMetadata(tokens.SKIP_ORIGIN_CHECK_METADATA, true);\nexport const UseBetterAuth = () =>\n  applyDecorators(\n    SetMetadata(tokens.USE_BETTER_AUTH_METADATA, true),\n    UseGuards(BetterAuthGuard),\n    UseInterceptors(BetterAuthScopeInterceptor),\n  );\nexport function Require(\n  ...requirements: readonly RequirementExpr[]\n): ClassDecorator & MethodDecorator {\n  return (\n    target: object,\n    _key?: string | symbol,\n    descriptor?: PropertyDescriptor,\n  ) => {\n    for (const expression of requirements) {\n      append(\n        descriptor?.value ?? target,\n        tokens.REQUIREMENTS_METADATA,\n        expression,\n      );\n    }\n  };\n}\nexport const anyOf = (\n  ...requirements: readonly RequirementExpr[]\n): RequirementExpr => ({ anyOf: requirements });\nexport const allOf = (\n  ...requirements: readonly RequirementExpr[]\n): RequirementExpr => ({ allOf: requirements });\nexport const requirement = <P>(\n  policy: PolicyRef<P>,\n  params: P,\n  options?: RequirementOptions,\n): Requirement<P> => ({ policy, params, ...options });\n\nexport interface ReaderContext {\n  readonly args: readonly unknown[];\n  readonly readings: PrincipalReadings;\n  readonly scope: RequestScope;\n  readonly reading?: () => PrincipalReading;\n}\nexport function readerContext(context: ExecutionContext): ReaderContext {\n  const args = context.getArgs();\n  for (const arg of [args, ...args]) {\n    if (\n      (typeof arg !== \"object\" || arg === null) &&\n      typeof arg !== \"function\"\n    ) {\n      continue;\n    }\n    const bridge = Reflect.get(arg, tokens.READER_CONTEXT) as\n      | ReaderContext\n      | undefined;\n    if (\n      bridge &&\n      bridge.args.length === args.length &&\n      bridge.args.every((value, index) => value === args[index]) &&\n      bridge.reading !== undefined &&\n      bridge.scope.current()?.reading === bridge.reading\n    ) {\n      return bridge;\n    }\n  }\n  // No application state is created or retained by a DI-free lineage-only reader.\n  const scope = new RequestScope();\n  return { args, scope, readings: new PrincipalReadings(scope) };\n}\nfunction principalParam(spec?: {\n  kind: string;\n  reason: string;\n  project: (p: any) => unknown;\n}): ParameterDecorator {\n  const decorator = createParamDecorator(\n    (_data: unknown, context: ExecutionContext) => {\n      const bridge = readerContext(context);\n      const input = {\n        args: context.getArgs(),\n        site: `${context.getClass().name}.${context.getHandler().name}`,\n      };\n      const reading =\n        bridge.reading !== undefined &&\n        bridge.scope.current()?.reading === bridge.reading\n          ? bridge.readings.current()\n          : bridge.readings.read(input);\n      return bridge.readings.project(\n        reading,\n        { ...spec, site: input.site, project: spec?.project ?? ((p) => p) },\n        input,\n      );\n    },\n  )();\n  return (target, propertyKey, index) => {\n    if (propertyKey === undefined) {\n      throw new BetterAuthConfigurationError(\n        \"PRINCIPAL_PARAM_TARGET\",\n        \"Principal parameters require a handler method\",\n      );\n    }\n    const handler = Reflect.get(target, propertyKey);\n    append(handler, tokens.PRINCIPAL_PARAMS_METADATA, {\n      index,\n      ...(spec ? { kind: spec.kind, reason: spec.reason } : {}),\n    });\n    decorator(target, propertyKey, index);\n  };\n}\nexport const CurrentPrincipal = (): ParameterDecorator => principalParam();\nexport function definePrincipalParam<K extends PrincipalKind, R>(spec: {\n  readonly kind: K;\n  readonly reason: string;\n  readonly project: (principal: PrincipalOfKind<K>) => R;\n}): () => ParameterDecorator {\n  return () => principalParam(spec);\n}\nexport function defineInvocationParam(\n  slot: symbol,\n  spec: { readonly missing: string },\n): () => ParameterDecorator {\n  return () => {\n    const decorator = createParamDecorator(\n      (_data: unknown, context: ExecutionContext) => {\n        const bridge = readerContext(context);\n        const state = bridge.scope.current();\n        const input = {\n          args: context.getArgs(),\n          site: `${context.getClass().name}.${context.getHandler().name}`,\n        };\n        const reading = state?.reading\n          ? bridge.readings.current()\n          : bridge.readings.read(input);\n        const candidates = state?.call\n          ? [state.call.invocation]\n          : [input.args, ...input.args];\n        for (const candidate of candidates) {\n          if (\n            !candidate ||\n            (typeof candidate !== \"object\" && typeof candidate !== \"function\")\n          ) {\n            continue;\n          }\n          const values = Reflect.get(candidate, tokens.INVOCATION_VALUES) as\n            | Map<string, Map<symbol, unknown>>\n            | undefined;\n          if (values?.get(reading.instance)?.has(slot)) {\n            return values.get(reading.instance)!.get(slot);\n          }\n        }\n        throw bridge.readings.deliver(\n          BetterAuthConfigurationError.atRequest(\n            \"NO_INVOCATION_VALUE\",\n            spec.missing,\n            { site: input.site },\n          ),\n          input,\n          reading.instance,\n        );\n      },\n    )();\n    return (target, key, index) => {\n      if (key === undefined) {\n        throw new BetterAuthConfigurationError(\n          \"INVOCATION_PARAM_TARGET\",\n          \"Invocation parameters require a handler method\",\n        );\n      }\n      append(Reflect.get(target, key), tokens.INVOCATION_PARAMS_METADATA, {\n        index,\n        slot,\n        missing: spec.missing,\n      });\n      decorator(target, key, index);\n    };\n  };\n}\nexport interface EndpointHookDeclaration {\n  readonly phase: \"before\" | \"after\";\n  readonly match: string | readonly string[] | HookPredicate | undefined;\n  readonly options: Readonly<HookOptions>;\n  readonly method: string | symbol;\n  // biome-ignore lint/complexity/noBannedTypes: Nest handler metadata preserves the framework function identity.\n  readonly handler: Function;\n  readonly declarationOrder: number;\n}\nexport interface DatabaseHookDeclaration {\n  readonly phase: \"before\" | \"after\";\n  readonly target: DatabaseHookTarget;\n  readonly options: Readonly<DbHookOptions>;\n  readonly method: string | symbol;\n  // biome-ignore lint/complexity/noBannedTypes: Nest handler metadata preserves the framework function identity.\n  readonly handler: Function;\n  readonly declarationOrder: number;\n}\n// biome-ignore lint/complexity/noBannedTypes: Nest handler metadata preserves the framework function identity.\nexport function readHookMetadata(handler: Function): {\n  readonly hooks: readonly EndpointHookDeclaration[];\n  readonly databaseHooks: readonly DatabaseHookDeclaration[];\n} {\n  return {\n    hooks: Reflect.getOwnMetadata(tokens.HOOK_METADATA, handler) ?? [],\n    databaseHooks:\n      Reflect.getOwnMetadata(tokens.DB_HOOK_METADATA, handler) ?? [],\n  };\n}\nfunction hook<P extends string>(\n  phase: \"before\" | \"after\",\n  match?: P | readonly P[] | HookPredicate,\n  options?: HookOptions,\n): HookMethodDecorator<P> {\n  return (_target, method, descriptor) => {\n    const handler = descriptor.value!;\n    const records = readHookMetadata(handler).hooks;\n    append(\n      handler,\n      tokens.HOOK_METADATA,\n      Object.freeze({\n        phase,\n        match: Array.isArray(match) ? Object.freeze([...match]) : match,\n        options: Object.freeze({ ...options }),\n        method,\n        handler,\n        declarationOrder: records.length,\n      }),\n    );\n  };\n}\nexport const BeforeAuth = <const P extends EndpointPath | (string & {})>(\n  match?: P | readonly P[] | HookPredicate,\n  options?: HookOptions,\n): HookMethodDecorator<P> => hook(\"before\", match, options);\nexport const AfterAuth = <const P extends EndpointPath | (string & {})>(\n  match?: P | readonly P[] | HookPredicate,\n  options?: HookOptions,\n): HookMethodDecorator<P> => hook(\"after\", match, options);\nfunction databaseHook<\n  E extends DatabaseHookTarget,\n  Ph extends \"before\" | \"after\",\n>(phase: Ph, target: E, options?: DbHookOptions): DbHookMethodDecorator<E, Ph> {\n  return (_prototype, method, descriptor) => {\n    const handler = descriptor.value!;\n    append(\n      handler,\n      tokens.DB_HOOK_METADATA,\n      Object.freeze({\n        phase,\n        target,\n        options: Object.freeze({ ...options }),\n        method,\n        handler,\n        declarationOrder: readHookMetadata(handler).databaseHooks.length,\n      }),\n    );\n  };\n}\nexport const BeforeDatabase = <E extends DatabaseHookTarget>(\n  target: E,\n  options?: DbHookOptions,\n): DbHookMethodDecorator<E, \"before\"> =>\n  databaseHook(\"before\", target, options);\nexport const AfterDatabase = <E extends DatabaseHookTarget>(\n  target: E,\n  options?: DbHookOptions,\n): DbHookMethodDecorator<E, \"after\"> => databaseHook(\"after\", target, options);\n"],"mappings":";;;;;;;;AAuCA,MAAM,WAAW,OAAO,IAAI,sCAAsC;AAClE,SAAgB,QACd,UACA,GAAG,QACK;CACR,OAAO,KAAK,UAAU,CAAC,UAAU,GAAG,MAAM,CAAC;AAC7C;;AAGA,SAAgB,eACd,KACA,SACa;CACb,MAAM,UAAU,SAAS,WAAW;CACpC,MAAM,YAAY,UAAU,QAAQ,SAAS,MAAM,KAAK,CAAC,CAAC,CAAC,KAAM;CACjE,IAAI,UAAU,QAAQ,IAAI,SAAS,QAAQ;CAG3C,IAAI,CAAC,SAAS;EACZ,0BAAU,IAAI,IAAI;EAClB,OAAO,eAAe,SAAS,UAAU,EAAE,OAAO,QAAQ,CAAC;CAC7D;CACA,IAAI,SAAS,QAAQ,IAAI,SAAS;CAClC,IAAI,CAAC,QAAQ;EACX,yBAAS,IAAI,IAAI;EACjB,QAAQ,IAAI,WAAW,MAAM;CAC/B;CACA,OAAO;AACT;AAEA,IAAa,eAAb,MAA0B;CACxB,WAAoB,IAAIA,iBAAAA,kBAA8B;CACtD,0BAAmB,IAAI,QAA8B;CACrD,6BAAsB,IAAI,IAAiC;CAC3D,4BAAqB,IAAI,QAAwB;CACjD,aAAa;CAEb,IAAO,OAAmB,IAAgB;EACxC,OAAO,KAAK,SAAS,IAAI,OAAO,EAAE;CACpC;CAEA,KAAQ,IAAgB;EACtB,OAAO,KAAK,SAAS,KAAK,EAAE;CAC9B;CAEA,UAAkC;EAChC,OAAO,KAAK,SAAS,SAAS;CAChC;CAEA,SAAS,KAA2B;EAClC,IAAI,QAAQ,KAAK,QAAQ,IAAI,GAAG;EAChC,IAAI,CAAC,OAAO;GACV,QAAQ;IACN,2BAAW,IAAI,IAAI;IACnB,0BAAU,IAAI,IAAI;IAClB,2BAAW,IAAI,IAAI;IACnB,wBAAQ,IAAI,IAAI;IAChB,oCAAoB,IAAI,IAAI;IAC5B,yBAAS,IAAI,IAAI;IACjB,0BAAU,IAAI,IAAI;IAClB,6BAAa,IAAI,IAAI;GACvB;GACA,KAAK,QAAQ,IAAI,KAAK,KAAK;EAC7B;EACA,OAAO;CACT;CAEA,cACE,MACA,OAKA,SAC0B;EAC1B,MAAM,MAAM,QAAQ,MAAM,UAAU,MAAM,WAAW,MAAM,SAAS;EACpE,MAAM,QAAQ,KAAK,SAAS,KAAK,GAAG;EACpC,MAAM,WAAW,MAAM,UAAU,IAAI,GAAG;EACxC,IAAI,UACF,OAAO;EAET,MAAM,aACJ,KAAK,cACL,MAAM,cAAc,oBACnB,KAAK,kBAAkB,KAAK,IACzB,KAAK,SAAS,KAAK,UAAU,CAAC,CAAC,cAC/B,KAAA;EACN,MAAM,SAAS,YAAY,IAAI,GAAG;EAClC,MAAM,UAAU,QAAQ,QAAQ,CAAC,CAAC,KAAK,YAAY;GACjD,IAAI,UAAU,OAAO,YAAY,KAAK,IAAI,GACxC,OAAO,OAAO;GAEhB,YAAY,OAAO,GAAG;GACtB,IAAI;IACF,MAAM,QAAQ,MAAM,QAAQ;IAC5B,IAAI,MAAM,YAAY,YACpB,YAAY,IAAI,KAAK;KACnB;KACA,WAAW,KAAK,IAAI,KAAK,KAAK,kBAAkB;IAClD,CAAC;IAEH,OAAO;GACT,SAAS,OAAO;IACd,YAAY,OAAO,GAAG;IACtB,MAAM;GACR;EACF,CAAC;EACD,MAAM,UAAU,IAAI,KAAK,OAAO;EAChC,OAAO;CACT;CAEA,aACE,SACA,UACA,aACA,SACA,QAAwB,KACZ;EACZ,MAAM,QAAQ,KAAK,SAAS,OAAO;EACnC,MAAM,MAAM,QAAQ,UAAU,WAAW;EACzC,MAAM,WAAW,MAAM,SAAS,IAAI,GAAG;EACvC,IAAI,UACF,OAAO;EAET,IACE,UAAU,SACV,CAAC,GAAG,MAAM,kBAAkB,CAAC,CAAC,QAC3B,UAAU,KAAK,MAAM,KAAK,CAAC,CAAC,OAAO,QACtC,CAAC,CAAC,UAAU,OAEZ,OAAO,QAAQ,OACbC,oBAAAA,aAAa,SAAS;GACpB,QAAQ;GACR,QAAQ;EACV,CAAC,CACH;EAEF,MAAM,mBAAmB,IAAI,GAAG;EAChC,MAAM,UAAU,QAAQ,QAAQ,CAAC,CAAC,KAAK,OAAO;EAC9C,MAAM,SAAS,IAAI,KAAK,OAAO;EAC/B,OAAO;CACT;CAEA,aACE,YACA,UACA,aACA,SACgC;EAChC,MAAM,YAAY,KAAK,SAAS,UAAU,CAAC,CAAC;EAC5C,MAAM,MAAM,QAAQ,UAAU,WAAW;EACzC,IAAI,UAAU,UAAU,IAAI,GAAG;EAC/B,IAAI,CAAC,SAAS;GACZ,UAAU,QAAQ,QAAQ,CAAC,CAAC,KAAK,OAAO;GACxC,UAAU,IAAI,KAAK,OAAO;EAC5B;EACA,OAAO;CACT;CAEA,SAAS,UAAkB,KAAqB;EAC9C,IAAI,OAAO,KAAK,WAAW,IAAI,QAAQ;EACvC,IAAI,CAAC,MAAM;GACT,uBAAO,IAAI,IAAI;GACf,KAAK,WAAW,IAAI,UAAU,IAAI;EACpC;EACA,IAAI,aAAa,KAAK,IAAI,GAAG;EAC7B,IAAI,CAAC,YAAY;GACf,aAAa,OAAO,IAAI,WAAW;GACnC,KAAK,IAAI,KAAK,UAAU;EAC1B;EACA,OAAO;CACT;CAEA,SACE,KACA,OACA,SACS;EACT,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK;EACjC,IAAI,CAAC,IAAI;GACP,KAAK,EAAE,KAAK;GACZ,KAAK,UAAU,IAAI,OAAO,EAAE;EAC9B;EACA,MAAM,SAASC,oBAAAA,qBAAqB,KAAK,IACrC,QAAQ,QAAQ,UAAU,MAAM,MAAM,QAAQ,IAAI,IAClD,SAAS;EACb,MAAM,UAAU,eAAe,KAAK,QAAQ,OAAO;EACnD,MAAM,QACJ,QAAQ,QAAQ,SAAS,UAAU,UAAU,KAAK,SAAS,GAAG,CAAC,CAAC;EAClE,MAAM,WAAW,MAAM,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM;EACxD,MAAM,IAAI,MAAM;EAChB,QAAQ,IAAI,MAAM;EAClB,OAAO;CACT;AACF;;;ACzMA,SAAS,OAAO,QAAgB,KAAa,OAAsB;CACjE,QAAQ,eACN,KACA,OAAO,OAAO,CAAC,GAAI,QAAQ,eAAe,KAAK,MAAM,KAAK,CAAC,GAAI,KAAK,CAAC,GACrE,MACF;AACF;AACA,MAAa,gBAAA,GAAeC,eAAAA,YAAAA,CAAAA,iBAAAA,iBAAoC,QAAQ;AACxE,MAAa,sBAAA,GACXA,eAAAA,YAAAA,CAAAA,iBAAAA,iBAAoC,UAAU;AAChD,MAAa,eAAe,aAAA,GAC1BC,eAAAA,gBAAAA,EAAAA,GACED,eAAAA,YAAAA,CAAAA,iBAAAA,iBAAoC,UAAU,IAAA,GAC9CA,eAAAA,YAAAA,CAAAA,iBAAAA,oBAAuC,SAAS,kBAAkB,IAAI,CACxE;AACF,MAAa,mBAAmB,UAAA,GAC9BA,eAAAA,YAAAA,CAAAA,iBAAAA,wBAA2C,IAAI;AACjD,MAAa,oBACX,GAAG,WAAA,GACAA,eAAAA,YAAAA,CAAAA,iBAAAA,4BAA+C,OAAO,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AAC7E,MAAa,iCAAA,GACXA,eAAAA,YAAAA,CAAAA,iBAAAA,oCAAuD,IAAI;AAC7D,MAAa,sBAAsB,UAAU,UAAA,GAC3CA,eAAAA,YAAAA,CAAAA,iBAAAA,0BAA6C,OAAO;AACtD,MAAa,yBAAA,GACXA,eAAAA,YAAAA,CAAAA,iBAAAA,4BAA+C,IAAI;AACrD,MAAa,uBAAA,GACXC,eAAAA,gBAAAA,EAAAA,GACED,eAAAA,YAAAA,CAAAA,iBAAAA,0BAA6C,IAAI,IAAA,GACjDE,eAAAA,UAAAA,CAAUC,mBAAAA,eAAe,IAAA,GACzBC,eAAAA,gBAAAA,CAAgBC,+BAAAA,0BAA0B,CAC5C;AACF,SAAgB,QACd,GAAG,cAC+B;CAClC,QACE,QACA,MACA,eACG;EACH,KAAK,MAAM,cAAc,cACvB,OACE,YAAY,SAAS,QAAA,iBAAA,uBAErB,UACF;CAEJ;AACF;AACA,MAAa,SACX,GAAG,kBACkB,EAAE,OAAO,aAAa;AAC7C,MAAa,SACX,GAAG,kBACkB,EAAE,OAAO,aAAa;AAC7C,MAAa,eACX,QACA,QACA,aACoB;CAAE;CAAQ;CAAQ,GAAG;AAAQ;AAQnD,SAAgB,cAAc,SAA0C;CACtE,MAAM,OAAO,QAAQ,QAAQ;CAC7B,KAAK,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG;EACjC,KACG,OAAO,QAAQ,YAAY,QAAQ,SACpC,OAAO,QAAQ,YAEf;EAEF,MAAM,SAAS,QAAQ,IAAI,KAAA,iBAAA,cAA0B;EAGrD,IACE,UACA,OAAO,KAAK,WAAW,KAAK,UAC5B,OAAO,KAAK,OAAO,OAAO,UAAU,UAAU,KAAK,MAAM,KACzD,OAAO,YAAY,KAAA,KACnB,OAAO,MAAM,QAAQ,CAAC,EAAE,YAAY,OAAO,SAE3C,OAAO;CAEX;CAEA,MAAM,QAAQ,IAAI,aAAa;CAC/B,OAAO;EAAE;EAAM;EAAO,UAAU,IAAIC,2BAAAA,kBAAkB,KAAK;CAAE;AAC/D;AACA,SAAS,eAAe,MAID;CACrB,MAAM,aAAA,GAAYC,eAAAA,qBAAAA,EACf,OAAgB,YAA8B;EAC7C,MAAM,SAAS,cAAc,OAAO;EACpC,MAAM,QAAQ;GACZ,MAAM,QAAQ,QAAQ;GACtB,MAAM,GAAG,QAAQ,SAAS,CAAC,CAAC,KAAK,GAAG,QAAQ,WAAW,CAAC,CAAC;EAC3D;EACA,MAAM,UACJ,OAAO,YAAY,KAAA,KACnB,OAAO,MAAM,QAAQ,CAAC,EAAE,YAAY,OAAO,UACvC,OAAO,SAAS,QAAQ,IACxB,OAAO,SAAS,KAAK,KAAK;EAChC,OAAO,OAAO,SAAS,QACrB,SACA;GAAE,GAAG;GAAM,MAAM,MAAM;GAAM,SAAS,MAAM,aAAa,MAAM;EAAG,GAClE,KACF;CACF,CACF,CAAC,CAAC;CACF,QAAQ,QAAQ,aAAa,UAAU;EACrC,IAAI,gBAAgB,KAAA,GAClB,MAAM,IAAIC,oBAAAA,6BACR,0BACA,+CACF;EAGF,OADgB,QAAQ,IAAI,QAAQ,WACvB,GAAA,iBAAA,2BAAqC;GAChD;GACA,GAAI,OAAO;IAAE,MAAM,KAAK;IAAM,QAAQ,KAAK;GAAO,IAAI,CAAC;EACzD,CAAC;EACD,UAAU,QAAQ,aAAa,KAAK;CACtC;AACF;AACA,MAAa,yBAA6C,eAAe;AACzE,SAAgB,qBAAiD,MAIpC;CAC3B,aAAa,eAAe,IAAI;AAClC;AACA,SAAgB,sBACd,MACA,MAC0B;CAC1B,aAAa;EACX,MAAM,aAAA,GAAYD,eAAAA,qBAAAA,EACf,OAAgB,YAA8B;GAC7C,MAAM,SAAS,cAAc,OAAO;GACpC,MAAM,QAAQ,OAAO,MAAM,QAAQ;GACnC,MAAM,QAAQ;IACZ,MAAM,QAAQ,QAAQ;IACtB,MAAM,GAAG,QAAQ,SAAS,CAAC,CAAC,KAAK,GAAG,QAAQ,WAAW,CAAC,CAAC;GAC3D;GACA,MAAM,UAAU,OAAO,UACnB,OAAO,SAAS,QAAQ,IACxB,OAAO,SAAS,KAAK,KAAK;GAC9B,MAAM,aAAa,OAAO,OACtB,CAAC,MAAM,KAAK,UAAU,IACtB,CAAC,MAAM,MAAM,GAAG,MAAM,IAAI;GAC9B,KAAK,MAAM,aAAa,YAAY;IAClC,IACE,CAAC,aACA,OAAO,cAAc,YAAY,OAAO,cAAc,YAEvD;IAEF,MAAM,SAAS,QAAQ,IAAI,WAAA,iBAAA,iBAAmC;IAG9D,IAAI,QAAQ,IAAI,QAAQ,QAAQ,CAAC,EAAE,IAAI,IAAI,GACzC,OAAO,OAAO,IAAI,QAAQ,QAAQ,CAAC,CAAE,IAAI,IAAI;GAEjD;GACA,MAAM,OAAO,SAAS,QACpBC,oBAAAA,6BAA6B,UAC3B,uBACA,KAAK,SACL,EAAE,MAAM,MAAM,KAAK,CACrB,GACA,OACA,QAAQ,QACV;EACF,CACF,CAAC,CAAC;EACF,QAAQ,QAAQ,KAAK,UAAU;GAC7B,IAAI,QAAQ,KAAA,GACV,MAAM,IAAIA,oBAAAA,6BACR,2BACA,gDACF;GAEF,OAAO,QAAQ,IAAI,QAAQ,GAAG,GAAA,iBAAA,4BAAsC;IAClE;IACA;IACA,SAAS,KAAK;GAChB,CAAC;GACD,UAAU,QAAQ,KAAK,KAAK;EAC9B;CACF;AACF;AAoBA,SAAgB,iBAAiB,SAG/B;CACA,OAAO;EACL,OAAO,QAAQ,eAAA,iBAAA,eAAqC,OAAO,KAAK,CAAC;EACjE,eACE,QAAQ,eAAA,iBAAA,kBAAwC,OAAO,KAAK,CAAC;CACjE;AACF;AACA,SAAS,KACP,OACA,OACA,SACwB;CACxB,QAAQ,SAAS,QAAQ,eAAe;EACtC,MAAM,UAAU,WAAW;EAC3B,MAAM,UAAU,iBAAiB,OAAO,CAAC,CAAC;EAC1C,OACE,SAAA,iBAAA,eAEA,OAAO,OAAO;GACZ;GACA,OAAO,MAAM,QAAQ,KAAK,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,CAAC,IAAI;GAC1D,SAAS,OAAO,OAAO,EAAE,GAAG,QAAQ,CAAC;GACrC;GACA;GACA,kBAAkB,QAAQ;EAC5B,CAAC,CACH;CACF;AACF;AACA,MAAa,cACX,OACA,YAC2B,KAAK,UAAU,OAAO,OAAO;AAC1D,MAAa,aACX,OACA,YAC2B,KAAK,SAAS,OAAO,OAAO;AACzD,SAAS,aAGP,OAAW,QAAW,SAAuD;CAC7E,QAAQ,YAAY,QAAQ,eAAe;EACzC,MAAM,UAAU,WAAW;EAC3B,OACE,SAAA,iBAAA,kBAEA,OAAO,OAAO;GACZ;GACA;GACA,SAAS,OAAO,OAAO,EAAE,GAAG,QAAQ,CAAC;GACrC;GACA;GACA,kBAAkB,iBAAiB,OAAO,CAAC,CAAC,cAAc;EAC5D,CAAC,CACH;CACF;AACF;AACA,MAAa,kBACX,QACA,YAEA,aAAa,UAAU,QAAQ,OAAO;AACxC,MAAa,iBACX,QACA,YACsC,aAAa,SAAS,QAAQ,OAAO"}