nestjs-slightly-better-auth 1.9.0 → 1.9.2

package/README.md

@@ -28,7 +28,7 @@ pnpm add nestjs-slightly-better-auth better-auth
 
 Peer dependencies: `@nestjs/common` and `@nestjs/core` 12, `better-auth` 1.7.5 or newer (below 2), `reflect-metadata` and `rxjs`. The package requires Node.js 24.11 or newer (`engines.node` is `>=24.11.0`). Install the Nest platform adapter your application uses, `@nestjs/platform-express` or `@nestjs/platform-fastify`; the `./express` and `./fastify` entries import neither at runtime.
 
-The `./testing` and `./testing/conformance` entries also need the optional peer `@nestjs/testing` 12; the root entry never loads it or a test runner. API keys use Better Auth's `@better-auth/api-key` plugin, which the application installs and registers itself (`pnpm add @better-auth/api-key`); the `./api-key` entry never imports it.
+The `./testing` and `./testing/conformance` entries also need the optional peer `@nestjs/testing` 12; the root entry never loads it or a test runner. API keys use Better Auth's `@better-auth/api-key` plugin, which the application installs and registers itself (`pnpm add @better-auth/api-key`); the `./api-key` entry never imports it. [Compatibility](#compatibility) lists the tested versions and module systems.
 
 The `./graphql` entry has two optional peer dependencies, `@nestjs/graphql` ^14.0.2 and `graphql` ^16.14.2, plus the Nest driver of your GraphQL server:
 
@@ -54,6 +54,26 @@ pnpm add @nestjs/microservices @nats-io/transport-node
 
 Nest's gRPC transport uses `@grpc/grpc-js` and `@grpc/proto-loader`, Kafka uses `kafkajs`, RabbitMQ uses `amqplib` and `amqp-connection-manager`, MQTT uses `mqtt`, and Redis uses `ioredis`. TCP needs no client library. Applications that do not import `./microservices` do not need any of these packages.
 
+## Compatibility
+
+| Dependency                       | Supported                                         | Tested                                                                           |
+| -------------------------------- | ------------------------------------------------- | -------------------------------------------------------------------------------- |
+| Node.js                          | 24.11.0 or newer                                  | 24.11.0 and the current LTS                                                      |
+| `@nestjs/common`, `@nestjs/core` | `^12.0.3`                                         | 12.0.3 and the newest 12.x release, with the matching `@nestjs/platform-express` |
+| `better-auth`                    | `>=1.7.5 <2`                                      | 1.7.5 and the newest 1.x release                                                 |
+| TypeScript declarations          | `nodenext`, `node16` ESM and `bundler` resolution | TypeScript 7 in each resolution mode                                             |
+
+The packaging tests pack this package, install the tarball with pnpm into temporary applications outside the workspace and run them with the peers installed at their declared floors and at the newest versions inside the peer ranges. The newest versions are those that pnpm's default minimum release age admits, so a new release enters the matrix after that delay. Each application compiles one Nest source as ESM and as CommonJS, signs up users of a default and a named Better Auth instance, calls a guarded route of each with its session cookie, checks that neither instance accepts the other's cookie, and closes. CI runs these tests on the current Node.js LTS and on Node.js 24.11.0.
+
+The declared floors are the supported floors. NestJS 11 and Better Auth releases before 1.7.5 are outside the peer ranges and are not tested.
+
+Module systems:
+
+- Node.js resolves `import` and `require()` to the same ESM build through the `module-sync` export condition, so ESM and CommonJS applications share one copy of every class. The `.cjs` build is the fallback for resolvers without `module-sync`; the tests also run the applications with `require()` routed to it.
+- Better Auth publishes ESM only, so CommonJS applications need `require()` of ES modules, which Node.js 24 enables by default. With `--no-experimental-require-module`, `require()` resolves every entry to its `.cjs` file, but only `./platform` and `./fastify` load; every other entry stops at its first Better Auth import with `ERR_REQUIRE_ESM`.
+- With TypeScript `module: nodenext`, ESM and CommonJS files compile against the published declarations; `module: preserve` with `moduleResolution: bundler` uses the ESM declarations. With `module: node16`, ESM files compile, but CommonJS files cannot import NestJS 12 or Better Auth, whose declarations are ESM only; use `nodenext` for CommonJS applications.
+- Each optional entry loads with only its own optional peers installed, and every other entry loads without any optional peer.
+
 ## Entry points
 
 Every entry ships ESM and CommonJS builds with declarations. The `module-sync` export condition gives Node `import` and `require()` consumers one shared ESM module identity, and optional peers load only through the entry that needs them. The [changelog](CHANGELOG.md) records the version that introduces each entry.
@@ -286,7 +306,7 @@ For Fastify, pass `fastifyPlatform()` from `nestjs-slightly-better-auth/fastify`
 
 **Bodies.** Auth routes receive exactly the bytes the client sent, bounded by `http.bodyLimit` (default 1 MiB; a number of bytes or a string such as `"2mb"`). A larger body receives `413 { code: "PAYLOAD_TOO_LARGE" }` on both platforms, with the host's CORS headers, and an unparsable request URL receives `400 { code: "INVALID_REQUEST_URL" }`. Application routes keep Nest's parsers, `rawBody`, `useBodyParser()` limits and Fastify's secure JSON parser. Express captures auth-route bodies before Nest registers its parsers; global middleware that reads the raw request stream without checking whether it already ended waits on a finished stream for auth routes. When an Express instance passed to `new ExpressAdapter(app)` already parsed the body, the platform recovers it from `req.rawBody` or re-serializes `req.body` and logs `W_BODY_ALREADY_CONSUMED` once, because raw-signature endpoints such as webhooks then receive different bytes. Fastify parses auth routes in its own encapsulated context and never reaches that path.
 
-**Responses and cookies.** Responses are written verbatim, including redirects, streams and arbitrary content types. Every `Set-Cookie` line is appended to any cookies already set, `Vary` values are merged, and host headers such as CORS are kept. Nest interceptors, pipes and serializers never run on auth routes; exception filters receive only failures that reach the host error pipeline, such as `BetterAuthInfrastructureError` or an `APIError` rethrown under Better Auth's `onAPIError: { throw: true }`. `http.around` wraps every auth-route exchange for request contexts or tracing:
+**Responses and cookies.** Responses are written verbatim, including redirects, streams and arbitrary content types. Every `Set-Cookie` line is appended to any cookies already set, except a line identical to the latest line already set for the same cookie, `Vary` values are merged, and host headers such as CORS are kept. Nest interceptors, pipes and serializers never run on auth routes; exception filters receive only failures that reach the host error pipeline, such as `BetterAuthInfrastructureError` or an `APIError` rethrown under Better Auth's `onAPIError: { throw: true }`. `http.around` wraps every auth-route exchange for request contexts or tracing:
 
 ```ts
 BetterAuthModule.forRoot({
@@ -381,7 +401,7 @@ export class ProjectsController {
 
 The method level wins over the class level; `@Public()` or `@OptionalAuth()` on a method is a visible opt-out of class-level requirements. The boot summary counts public, optional and inheriting handlers and handlers that skip default requirements.
 
-Failures answer `401 UNAUTHENTICATED`, `403 FORBIDDEN` or `429 RATE_LIMITED` with a `reason` such as Better Auth's error code. On HTTP the body is `{ statusCode, error, code, reason?, message }`, with `WWW-Authenticate` and `Retry-After` headers where applicable; `errors.map(failure, context, transport)` replaces the thrown object per instance. Infrastructure failures (storage, network, Better Auth 5xx) throw `BetterAuthInfrastructureError` (message `Authentication service unavailable`, redacted cause) and are never reported as 401 or 403. Request-time configuration errors throw `BetterAuthConfigurationError` with the fixed message `Authentication is misconfigured`; its `code`, `detail` and `hint` are logged, not sent. Nest's exception layer answers both with a 500.
+Failures answer `401 UNAUTHENTICATED`, `403 FORBIDDEN` or `429 RATE_LIMITED` with a `reason` such as Better Auth's error code. On HTTP the body is `{ statusCode, error, code, reason?, message }`, with `WWW-Authenticate` and `Retry-After` headers where applicable; `errors.map(failure, context, transport)` replaces the thrown object per instance. Infrastructure failures (storage, network, Better Auth 5xx) throw `BetterAuthInfrastructureError` (message `Authentication service unavailable`, redacted cause) and are never reported as 401 or 403. The cause is redacted of the request's cookie values, `Authorization` value and principal sources' credential headers, including when a principal source or policy threw the error itself; with `errors.exposeRawCause: true`, `getRawCause(error)` returns the unredacted cause for local debugging. Request-time configuration errors throw `BetterAuthConfigurationError` with the fixed message `Authentication is misconfigured`; its `code`, `detail` and `hint` are logged, not sent. Nest's exception layer answers both with a 500.
 
 ### Readers
 
@@ -428,7 +448,7 @@ A guard that reads the principal must run after `BetterAuthGuard`, or `principal
 
 ## Authorization
 
-Requirements are values that carry a policy. `@Require(...requirements)` appends them to the class or method; stacked decorators and base-class requirements accumulate instead of overwriting each other. Every required plan evaluates the instance's `defaultRequirements` first, then class requirements (base class first), then method requirements, and stops at the first denial. `anyOf()` allows when any child allows and `allOf()` groups requirements inside `anyOf()`.
+Requirements are values that carry a policy. `@Require(...requirements)` appends them to the class or method; stacked decorators and base-class requirements accumulate instead of overwriting each other. Every required plan evaluates the instance's `defaultRequirements` first, then class requirements (base class first), then method requirements, and stops at the first denial. `anyOf()` allows when any child allows and `allOf()` groups requirements inside `anyOf()`. An empty `anyOf()` or `allOf()`, for example one built from an empty configured list, fails planning with `EMPTY_REQUIREMENT_GROUP` instead of allowing or denying every caller.
 
 ```ts
 import { Controller, Get, Post } from "@nestjs/common";
@@ -489,7 +509,7 @@ export class MembersController {
 
 Permission maps are typed from the registered instance's access-control statements, so unknown resources and actions are compile errors, and each requirement's plugin (`admin`, `organization`, `api-key`) is checked at startup (`PLUGIN_PREREQUISITE`). Empty permission maps fail boot. Named instances pass the instance name as a type argument, for example `permission<"admin">({ ... })`. The admin policy calls Better Auth without request headers, so an instance with a dynamic `baseURL.allowedHosts` configuration needs a `fallback` (`DYNAMIC_BASE_URL_WITHOUT_FALLBACK`).
 
-**Organization references.** The organization policies always send an explicit organization id. `activeOrganization()` (the default) reads `session.activeOrganizationId`; with Better Auth's `custom-session` plugin and a session shape without it, it asks `getActiveMember`. `fromParam(name)` reads a route parameter, GraphQL argument or WebSocket/RPC payload field, `fromHeader(name)` reads a header, and `organizationRef(fn, { missingReason })` wraps any function. Only a non-empty string counts as an organization id; anything else denies with the reference's `missingReason` (`NO_ACTIVE_ORGANIZATION` for the active organization, `ORGANIZATION_REQUIRED` otherwise) without calling Better Auth. Slugs are not ids: map a slug to an id in your own `organizationRef()`, for example through `auth.api.listOrganizations({ headers })`. Startup warns with `W_ORG_PARAM_IGNORED` when a handler takes an `orgId`-like input while its requirement checks the active organization, and with `W_ORG_PARAM_MISSING` when `fromParam()` names an input the handler does not have. `@ActiveOrganizationId()` and `@ActiveMemberRole()` return the organization id and member role the policy resolved for the current invocation.
+**Organization references.** The organization policies always send an explicit organization id. `activeOrganization()` (the default) reads `session.activeOrganizationId`; with Better Auth's `custom-session` plugin and a session shape without it, it asks `getActiveMember`. `fromParam(name)` reads a route parameter, GraphQL argument or WebSocket/RPC payload field, `fromHeader(name)` reads a header, and `organizationRef(fn, { missingReason })` wraps any function. Only a non-empty string counts as an organization id; anything else denies with the reference's `missingReason` (`NO_ACTIVE_ORGANIZATION` for the active organization, `ORGANIZATION_REQUIRED` otherwise) without calling Better Auth. Slugs are not ids: map a slug to an id in your own `organizationRef()`, for example through `auth.api.listOrganizations({ headers })`. Startup warns with `W_ORG_PARAM_IGNORED` when a handler takes an `orgId`-like input while its requirement checks the active organization, and with `W_ORG_PARAM_MISSING` when `fromParam()` names an input the handler does not have. `@ActiveOrganizationId()` and `@ActiveMemberRole()` return the organization id and member role the policy resolved for the current invocation. Only requirements that contributed to the allow decision publish them. When two of a handler's requirements resolve different organizations, for example `defaultRequirements: [orgMember()]` on the active organization and an `orgPermission()` with `fromParam()`, both decorators throw `AMBIGUOUS_INVOCATION_VALUE` (a generic 500) instead of choosing one; read the organization from the route, or check one organization per handler.
 
 **API keys and delegation.** `apiKeyPrincipal({ header, configId, references, outageProbe, acceptance })` is a principal source for Better Auth's API-key plugin. It reads `x-api-key` by default, calls `verifyApiKey` once per request and only on routes that admit `"api-key"`, and never exposes the raw key. Its acceptance is explicit: a route admits keys through `@AcceptPrincipals("session", "api-key")` or a requirement that names the kind, such as `@RequireApiKeyPermission()`. Each verification counts against the key's usage and rate limit; `RATE_LIMITED` answers 429 with `Retry-After`, `USAGE_EXCEEDED` answers 429, and `KEY_NOT_FOUND`, `KEY_DISABLED`, `KEY_EXPIRED` and `INVALID_API_KEY` answer 401. Keys that belong to an organization need `references: "organization"` (or a function of the key's `configId`), because the plugin object does not expose its configuration.
 
@@ -578,7 +598,7 @@ Security rules belong where every path passes. A `@BeforeAuth("/get-session")` r
 
 A direct `auth.api.*` call in a handler behaves as in plain Better Auth: its `Set-Cookie` does not reach the caller's response. `service.headersFrom(request)` returns the platform request's headers with the client-IP header set and HTTP/2 pseudo-headers removed, for direct calls on the caller's behalf.
 
-**Forwarding cookies.** `@ForwardAuthCookies()` on a handler or controller (and `@ForwardAuthCookies(false)` to opt one handler back out), or `cookies.forwardDirectCalls: true` for a whole instance (`W_FORWARD_DIRECT_CALLS`), forwards the `Set-Cookie` of direct calls that carry no credential, such as a sign-in, or the caller's own credential (session cookie, `Authorization` and the principal sources' credential headers). Calls with another credential have their cookies dropped. `service.forwardForeignCookies(fn)` forwards every call inside `fn`, for deliberate account switching, and throws `FORWARDING_NOT_DECLARED` in a handler without forwarding. Cookies from the library's own calls (principal sources and policies) always reach the caller, so session refreshes during authorization are delivered. A handler that already sent its response through `@Res()` drops them.
+**Forwarding cookies.** `@ForwardAuthCookies()` on a handler or controller (and `@ForwardAuthCookies(false)` to opt one handler back out), or `cookies.forwardDirectCalls: true` for a whole instance (`W_FORWARD_DIRECT_CALLS`), forwards the `Set-Cookie` of direct calls that carry no credential, such as a sign-in, or the caller's own credential (session cookie, `Authorization` and the principal sources' credential headers). Calls with another credential have their cookies dropped. `service.forwardForeignCookies(fn)` forwards every call inside `fn`, for deliberate account switching, and throws `FORWARDING_NOT_DECLARED` in a handler without forwarding. Cookies from the library's own calls (principal sources and policies) always reach the caller, so session refreshes during authorization are delivered. The Express and Fastify cookie sinks skip a line identical to the latest line already set for the same cookie, so a source that also appends a call's cookies itself does not deliver them twice. A handler that already sent its response through `@Res()` drops them.
 
 A forwarding handler is in form mode: the guard enforces Better Auth's form-CSRF rule before the handler runs, on every HTTP method and GraphQL operation kind, with or without an inbound cookie, and for public and optional handlers too. A forwarding handler therefore needs a guard that reaches it, even when it is public; startup reports forwarding handlers that no guard covers.
 
@@ -615,7 +635,7 @@ export class SessionController {
 
 **Rate limits and origin checks on direct calls.** Better Auth applies its rate limiter and its own origin check only to requests routed through `auth.handler`. A direct `signInEmail`, `signUpEmail` or password call from a handler bypasses both. Prefer letting clients call Better Auth's routes through the mount for sign-in, sign-up and password flows, keep direct credential calls for trusted back-office code, and throttle proxy handlers in the application. The form-mode origin rule above protects forwarding handlers against login CSRF; it does not replace the rate limiter.
 
-**Caller-session check.** A direct call that carries the caller's own session cookie on a browser leg must have a passing origin verdict for that leg and instance. Otherwise the call fails before the endpoint runs with `PUBLIC_HANDLER_USED_CALLER_SESSION` (a generic 500 with a logged hint). This covers public handlers, which run no origin check, safe methods such as a `GET /logout` proxy, and handlers the guard never ran for. Calls without the caller's session cookie (a sign-up without headers, bearer or API-key calls), cookie-less transports and `@SkipOriginCheck()` handlers are unaffected. A cross-site state-changing proxy therefore needs a state-changing method, `@OptionalAuth()` or a stricter access mode, `@ForwardAuthCookies()` when it returns auth cookies, and a trusted `Origin`.
+**Caller-session check.** A direct call that carries the caller's own session cookie on a browser leg must have a passing origin verdict for that leg and instance. Otherwise the call fails before the endpoint runs with `PUBLIC_HANDLER_USED_CALLER_SESSION` (a generic 500 with a logged hint). This covers public handlers, which run no origin check, safe methods such as a `GET /logout` proxy, and handlers the guard never ran for. Calls without the caller's session cookie (a sign-up without headers, bearer or API-key calls), calls with a session cookie that the transport mapped in-band rather than the browser leg's own cookie (graphql-ws connection parameters, WebSocket `credentials`), cookie-less transports and `@SkipOriginCheck()` handlers are unaffected. A cross-site state-changing proxy therefore needs a state-changing method, `@OptionalAuth()` or a stricter access mode, `@ForwardAuthCookies()` when it returns auth cookies, and a trusted `Origin`.
 
 **Scopes.** The global scope interceptor opens a scope for every handler a transport recognizes, independently of `globalGuard`. The scope carries the cookie bridge, refresh suppression on cookie-less transports and the caller-session check. `globalScope: false` removes it and logs `W_NO_GLOBAL_SCOPE`. Code outside a handler scope (middleware, guards, policies, background jobs, GraphQL field resolvers without the `"interceptors"` enhancer) gets plain Better Auth semantics. `service.withoutCookies(fn)` runs calls with no cookie capability, which also suppresses session refresh, and `service.runOutsideScope(fn)` runs `fn` as if no scope existed: no forwarding, no refresh suppression and no caller-session check, so an unsafe public handler that uses it is open to cross-site requests.
 
@@ -624,10 +644,10 @@ export class SessionController {
 Better Auth's origin check protects cookie-carrying requests on its own routes only. The guard applies the same rule to application routes, GraphQL operations and WebSocket messages through `originCheck`.
 
 - **Cookie mode** (`originCheck.mode: "cookie"`, the default). An unsafe operation whose browser leg carries a cookie must come from a trusted origin, whatever credential authenticated it: HTTP methods other than GET, HEAD and OPTIONS, GraphQL mutations over HTTP, every WebSocket message and every GraphQL operation over a WebSocket. Denials are `403` with reason `INVALID_ORIGIN` or `MISSING_OR_NULL_ORIGIN`.
-- **Advisory verdict on safe methods.** In cookie mode, a guarded safe request that carries a cookie also computes the origin verdict, without denying the request. An untrusted origin still reads its data; only a later direct call with the caller's session cookie consults the verdict and fails. Public handlers compute no verdict.
+- **Advisory verdict on safe methods.** In cookie mode, a guarded safe request that carries a cookie also computes the origin verdict, without denying the request. An untrusted origin still reads its data; only a later direct call with the caller's session cookie consults the verdict and fails. Browsers send no `Origin` on same-origin GET requests, and `Referrer-Policy: no-referrer` also removes `Referer`; the advisory verdict then takes the leg's own origin from `Sec-Fetch-Site: same-origin` and checks it against the trusted origins, as it does for `Origin: null`. Enforcing checks keep Better Auth's rule. Public handlers compute no verdict.
 - **Form mode** (forwarding handlers). Always enforced, on every method and operation kind, following Better Auth's form-CSRF rule: with a cookie, the cookie-mode rule; without one, a cross-site navigation is denied with `CROSS_SITE_NAVIGATION_LOGIN_BLOCKED`, a present `Origin` or `Referer` must be trusted, and a request without any browser signal is allowed.
 
-Trusted origins are the instance's post-init `trustedOrigins`, including plugin-contributed ones and function-valued `trustedOrigins`, matched with Better Auth's own matcher. The request's own origin counts as trusted only when `baseURL` is unset, never from forwarding headers. A verdict is memoized per browser leg, so a socket evaluates a function-valued `trustedOrigins` once. The first denial per reason and origin within an hour logs a warning with the sanitized origin.
+Trusted origins are the instance's post-init `trustedOrigins`, including plugin-contributed ones and function-valued `trustedOrigins`, matched with Better Auth's own matcher. As on Better Auth's router, a function-valued `trustedOrigins` contributes only its result for the request, never the no-request result Better Auth computes at startup. The request's own origin counts as trusted only when `baseURL` is unset, never from forwarding headers. A verdict is memoized per browser leg, so a socket evaluates a function-valued `trustedOrigins` once. The first denial per reason and origin within an hour logs a warning with the sanitized origin.
 
 **Escapes for non-browser and native clients.**
 
@@ -640,7 +660,7 @@ Better Auth skips its own origin checks under `NODE_ENV=test` or a truthy `TEST`
 
 ## Lifecycle and operational limits
 
-**Binding and shutdown.** At `onModuleInit`, each instance's `nestjs()` plugin binds to the application; the binding records the application's hook tables. One live application binds an instance at a time: a second application initialized while the first is bootstrapped fails with `INSTANCE_ALREADY_BOUND`. An application whose `init()` failed never bootstrapped, and the next application takes its binding over with `W_INSTANCE_TAKEN_OVER`; a closed application's binding is taken over silently. `app.close()` marks the binding closed but keeps its hooks dispatching until another application binds the instance, so work that other modules drain during shutdown, such as queue workers or outbox relays, still runs the application's `@BeforeDatabase()` rules; a hook whose own dependencies already shut down throws, and that Better Auth call fails. Call `app.enableShutdownHooks()` so process signals run this sequence. Better Auth calls and database writes made before the binding, for example seeding in another global module's `onModuleInit`, run without Nest hooks; when the application declares hooks, startup logs `W_CALLS_BEFORE_BIND`. Seed in `onApplicationBootstrap`. Hybrid applications with `deferInitialization: true` initialize the HTTP application (`app.init()` or `app.listen()`) before `app.startAllMicroservices()`.
+**Binding and shutdown.** At `onModuleInit`, each instance's `nestjs()` plugin binds to the application; the binding records the application's hook tables. One live application binds an instance at a time: a second application initialized while the first is bootstrapped fails with `INSTANCE_ALREADY_BOUND`. An application whose `init()` failed never bootstrapped, and the next application takes its binding over with `W_INSTANCE_TAKEN_OVER`; if that application's `init()` was still running, it fails at bootstrap with `INSTANCE_ALREADY_BOUND` instead of serving without its hooks; a closed application's binding is taken over silently. `app.close()` marks the binding closed but keeps its hooks dispatching until another application binds the instance, so work that other modules drain during shutdown, such as queue workers or outbox relays, still runs the application's `@BeforeDatabase()` rules; a hook whose own dependencies already shut down throws, and that Better Auth call fails. Call `app.enableShutdownHooks()` so process signals run this sequence. Better Auth calls and database writes made before the binding, for example seeding in another global module's `onModuleInit`, run without Nest hooks; when the application declares hooks, startup logs `W_CALLS_BEFORE_BIND`. Seed in `onApplicationBootstrap`. Hybrid applications with `deferInitialization: true` initialize the HTTP application (`app.init()` or `app.listen()`) before `app.startAllMicroservices()`.
 
 **Revocation and caching.** Identity reads honor Better Auth's cookie cache: when `session.cookieCache` is enabled, a revoked session keeps working on ordinary routes until the cached cookie expires (`session.cookieCache.maxAge`), as in Better Auth. `@RequireAuth({ authoritative: true })`, `session: { freshness: "authoritative" }` or any admin `permission()` requirement read identity past the cache. WebSocket transports (`principalTtlMs`) and GraphQL socket operations (`subscriptionPrincipalTtlMs`) resolve the principal for every message or operation by default; a positive TTL reuses a connection's principal and delays revocation by up to the TTL, except on authoritative plans. A GraphQL subscription is authorized when it starts; events it delivers afterwards are not re-authorized, so revoking a session does not end an open subscription.
 
@@ -720,7 +740,7 @@ Field resolvers without access decorators inherit the principal of their actual
 
 ### Subscriptions and socket operations
 
-Socket operations authenticate each operation independently from the WebSocket upgrade request and never refresh the session. A subscription is authorized when it starts, and the events it delivers are not re-authorized. Browser-origin checks always use the original upgrade headers, before any session read, so connection parameters cannot replace the browser's `Origin`. The platform's own request predicate classifies HTTP operations first, and Apollo recognizes a socket operation only through the graphql-ws connection and its WebSocket. A client-sent `Upgrade: websocket` header therefore never selects the socket path: an HTTP operation keeps the platform client IP, response cookie forwarding and the completed-request check, and an unrecognized context still fails closed. Mercurius treats an operation whose context carries the route's own Fastify reply as HTTP before any socket detection, and otherwise identifies sockets only through its subscription context, so neither request headers nor client fields spread into a custom context select the socket path.
+Socket operations authenticate each operation independently from the WebSocket upgrade request and never refresh the session. A subscription is authorized when it starts, and the events it delivers are not re-authorized. Browser-origin checks always use the original upgrade headers, before any session read, so connection parameters cannot replace the browser's `Origin`. A session cookie that arrives in connection parameters is not ambient, so a resolver's direct `auth.api` call that carries it needs no origin verdict; a call that carries the upgrade request's own session cookie does. The platform's own request predicate classifies HTTP operations first, and Apollo recognizes a socket operation only through the graphql-ws connection and its WebSocket. A client-sent `Upgrade: websocket` header therefore never selects the socket path: an HTTP operation keeps the platform client IP, response cookie forwarding and the completed-request check, and an unrecognized context still fails closed. Mercurius treats an operation whose context carries the route's own Fastify reply as HTTP before any socket detection, and otherwise identifies sockets only through its subscription context, so neither request headers nor client fields spread into a custom context select the socket path.
 
 By default, `authorization` and `cookie` values in the `connection_init` payload replace the matching upgrade headers. `connectionParamHeaders` replaces that list of keys, matched case-insensitively. A `connection_init` message without a payload, which a graphql-ws `createClient()` without `connectionParams` sends, carries no connection parameters: the upgrade request's own credential headers apply, and a connection without them is anonymous. A selected value that is not a string or is not a valid header value rejects the operation with `UNAUTHENTICATED` and `reason: "MALFORMED_CREDENTIALS"`, without falling back to another credential and without echoing the value in errors or logs.
 
@@ -795,7 +815,7 @@ export class AppModule {}
 
 Socket.IO reads credentials from the handshake headers. When the handshake has no `Authorization` header, a string `auth.token` becomes `Authorization: Bearer <token>`, which Better Auth's `bearer()` plugin accepts. Raw `ws` reads the upgrade request, so wrap Nest's adapter to record it: `app.useWebSocketAdapter(new (withUpgradeRequest(WsAdapter))(app))`. Without that record, public messages still run and protected messages fail with a 500 `WS_UPGRADE_REQUEST_MISSING` configuration error.
 
-A `credentials(client)` option on either transport replaces the default mapping: the entries of the `HeadersInit` it returns override the handshake headers of the same name for authentication. The browser-origin check always uses the original handshake, so mapped credentials cannot bypass it. A non-string `auth.token`, or mapped credentials that are not string pairs or contain CR, LF, NUL or other invalid header characters, fail with a 401 `MALFORMED_CREDENTIALS` before any Better Auth call. Other credentials on the connection are not tried in their place, and the failure does not carry the rejected value. Errors thrown by the mapper itself are not converted into authentication failures.
+A `credentials(client)` option on either transport replaces the default mapping: the entries of the `HeadersInit` it returns override the handshake headers of the same name for authentication. The browser-origin check always uses the original handshake, so mapped credentials cannot bypass it. A mapped session cookie is not ambient, so a handler's direct `auth.api` call that carries it needs no origin verdict; a call that carries the handshake's own session cookie does. A non-string `auth.token`, or mapped credentials that are not string pairs or contain CR, LF, NUL or other invalid header characters, fail with a 401 `MALFORMED_CREDENTIALS` before any Better Auth call. Other credentials on the connection are not tried in their place, and the failure does not carry the rejected value. Errors thrown by the mapper itself are not converted into authentication failures.
 
 Connection authentication runs the same origin check and default credential sources as messages, for the default instance or the one named by `instance`. `socketIoMiddleware({ required, instance })` rejects a Socket.IO handshake with a `connect_error` whose `data` holds `statusCode`, `code` and `reason`; `required: false` admits connections without credentials but still rejects invalid ones. Unexpected errors reach the client as a 500 `Internal server error`, and the server logs a summary that omits foreign error messages because they can quote credentials. For raw `ws`, call `authenticate(client)` in `handleConnection` and close rejected connections with `wsCloseCodeFor(result.failure)`, which maps 401, 403 and 429 failures to close codes 4401, 4403 and 4429.
 
@@ -920,7 +940,7 @@ const app = await initTestApp(
 - `stampPrincipal(ctx, principal, { instance })` records the principal on the invocation's argument array and its object elements. Readers accept it from the same array (WebSocket, RPC and GraphQL guards and interceptors share it) or from another array with the same elements when at least two elements are objects (an HTTP request and its response). A lone shared element, such as a socket beside a primitive payload, never identifies an invocation, so concurrent invocations do not see each other's stamps. A stand-in that stamps nothing makes principal readers fail with the generic `NO_AUTH_RESULT` error.
 - `testPrincipal(principal | (request) => principal | null, { kinds, acceptance, delegates })` is a principal source for composed test modules.
 - `authHeadersFor(auth, userId)` creates real session headers through Better Auth's `testUtils()` plugin.
-- `initTestApp(app, { closeWith })` runs `init()` and Fastify `ready()`. A Better Auth instance binds to one application at a time (a second bound application fails with `INSTANCE_ALREADY_BOUND`), so the helper first closes the previous application that it initialized for the same instance; a failed `init()` leaves its binding to the next application, which takes it over with `W_INSTANCE_TAKEN_OVER`. The helper makes `app.close()` idempotent and passes it to `closeWith`, a per-test cleanup such as Vitest's `onTestFinished` or node:test's `t.after`. Jest cannot register hooks while a test runs, so collect the closes and run them in a suite-level `afterEach`. Without `closeWith`, close the last application yourself. On Express, compile one `TestingModule` per application; a second application from the same module fails with `APP_ADAPTER_CHANGED`.
+- `initTestApp(app, { closeWith })` runs `init()` and Fastify `ready()`. A Better Auth instance binds to one application at a time (a second bound application fails with `INSTANCE_ALREADY_BOUND`), so the helper first closes the previous application that it initialized for the same instance; a failed `init()` leaves its binding to the next application, which takes it over with `W_INSTANCE_TAKEN_OVER`. An application whose `init()` is still running when another application binds the same instance fails at bootstrap with `INSTANCE_ALREADY_BOUND`, so initialize applications that share an instance one after another, including in concurrent tests. The helper makes `app.close()` idempotent and passes it to `closeWith`, a per-test cleanup such as Vitest's `onTestFinished` or node:test's `t.after`. Jest cannot register hooks while a test runs, so collect the closes and run them in a suite-level `afterEach`. Without `closeWith`, close the last application yourself. On Express, compile one `TestingModule` per application; a second application from the same module fails with `APP_ADAPTER_CHANGED`.
 
 Better Auth treats a process with `NODE_ENV=test` or a truthy `TEST` variable (Vitest sets it; Jest sets `NODE_ENV=test`) as a test run and then skips its origin checks, and this library's origin check follows the same flags. Set `advanced.disableOriginCheck: false` on test instances that exercise origin rules.
 
@@ -972,7 +992,7 @@ runConformance(
 
 The principal-source kit passes each credential factory the instance the case runs against: `credentials.valid(auth)` receives `auth`, or for `S-dynamic-base-url` a variant with a dynamic `baseURL` (allowed hosts `localhost:3000` and `public.example`, no fallback) that `variant(overrides)` builds. The default variant is `createConformanceAuth()` with the plugins of `auth`; a call that creates a credential on the variant passes a `host` header. `credentials.apiKey(auth, fields)` creates the keys of the `S-apikey-*` cases (default: `auth.api.createApiKey` for a new user), `credentials.organizationKey(auth)` enables `S-apikey-org-key`, and `http: { platform, createHttpAdapter }` enables the `S-bridge-*` routes. Each case boots its own module, so register a source that keeps state across requests, such as the API-key outage probe or a JWT key cache, as a `defineExtension()` factory.
 
-Every case boots real Nest applications or modules with a real Better Auth instance that includes `conformanceProbePlugin()`. The probe counts and faults every operation of the instance's database adapter, so storage outages reach endpoints that would swallow them, and records the `Set-Cookie` lines each call produces. `createConformanceAuth({ plugins })` builds such an instance: memory adapter, `testUtils()`, `bearer()`, the probe plugin, `nestjs()` last, and `session.updateAge: 0` and origin checks on, whatever `options` says. The principal-source and policy kits take that instance as `auth`; the principal-source kit rejects an instance without `session.updateAge: 0`. The transport kit creates its own instance, with the organization plugin and the organizations its `org` fixture names, and passes it to your `createApp` harness together with the kit's API-key source in `principals`, a `logger` to boot with, and the `globalScope`, `appEnhancers`, `forwardDirectCalls`, `fieldResolverEnhancers`, `fieldResolverCoverage`, `federation` and `graphqlContext` settings of each boot. Apply every fixture decorator, including the kit's `SetMetadata()` marker, which maps the transport's claims to fixtures, and the class decorators of `inherited.subclasses` and `graph.classDecorators`. On a connection-shaped browser leg, the kit's cookie credential carries the instance's base URL, `http://localhost:3000`, as `Origin`, as a browser page of that origin does; the `T-ws-origin-*` cases pass their own `Origin`, `Host` and forwarding headers, which the harness sends in the handshake.
+Every case boots real Nest applications or modules with a real Better Auth instance that includes `conformanceProbePlugin()`. The probe counts and faults every operation of the instance's database adapter, so storage outages reach endpoints that would swallow them, and records the `Set-Cookie` lines each call produces. `createConformanceAuth({ plugins })` builds such an instance: memory adapter, `testUtils()`, `bearer()`, the probe plugin, `nestjs()` last, and `session.updateAge: 0` and origin checks on (`advanced.disableOriginCheck: false` and `advanced.disableCSRFCheck: false`), whatever `options` says. The principal-source and policy kits take that instance as `auth`; the principal-source kit rejects an instance without `session.updateAge: 0`. The transport kit creates its own instance, with the organization plugin and the organizations its `org` fixture names, and passes it to your `createApp` harness together with the kit's API-key source in `principals`, a `logger` to boot with, and the `globalScope`, `appEnhancers`, `forwardDirectCalls`, `fieldResolverEnhancers`, `fieldResolverCoverage`, `federation` and `graphqlContext` settings of each boot. Apply every fixture decorator, including the kit's `SetMetadata()` marker, which maps the transport's claims to fixtures, and the class decorators of `inherited.subclasses` and `graph.classDecorators`. On a connection-shaped browser leg, the kit's cookie credential carries the instance's base URL, `http://localhost:3000`, as `Origin`, as a browser page of that origin does; the `T-ws-origin-*` cases pass their own `Origin`, `Host` and forwarding headers, which the harness sends in the handshake.
 
 The policy kit judges principals through the real evaluator, and cases that need route planning, acceptance or principal resolution send in-process requests through the real `BetterAuthGuard`. Pass the sources of the requirement's other principal kinds in `sources` (for example `apiKeyPrincipal()`). Unit-specific cases run when the requirement contains the built-in admin policy (`Z-admin-*`), an organization policy (`Z-org-ref-types` and the organization row of `Z-apikey-quota-per-request`) or the API-key permission policy (its `Z-apikey-quota-per-request` row), and skip with the reason otherwise. They use the instance's configuration where it matters: `session.cookieCache.enabled` for the warm-cache rows and `apiKey({ enableSessionForAPIKeys: true })` for the API-key session and quota rows. The kit builds the instances that need another configuration (`customSession` role shapes, `adminUserIds`, a dynamic `baseURL`) with `createConformanceAuth()`.
 

package/dist/admin.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_auth_errors = require("./auth-errors-1EdQ36D8.cjs");
-const require_auth_decorators = require("./auth-decorators-pe3Aou21.cjs");
+const require_auth_errors = require("./auth-errors-BB9VnAqx.cjs");
+const require_auth_decorators = require("./auth-decorators-DTyDpP0k.cjs");
 let better_auth_api = require("better-auth/api");
 //#region src/admin.ts
 const adminPermissionPolicy = {

package/dist/admin.d.cts

@@ -1,4 +1,4 @@
-import { Ct as AuthPrincipal, Nt as PrincipalKind, f as AuthorizationPolicy, ot as Requirement, vt as AdminPermissions } from "./auth-contracts-CzYNjGov.cjs";
+import { Ct as AuthPrincipal, Nt as PrincipalKind, f as AuthorizationPolicy, ot as Requirement, vt as AdminPermissions } from "./auth-contracts-D5zQHUn0.cjs";
 //#region src/admin.d.ts
 export interface PermissionOptions {
   principals?: readonly PrincipalKind[];

package/dist/admin.d.mts

@@ -1,4 +1,4 @@
-import { Ct as AuthPrincipal, Nt as PrincipalKind, f as AuthorizationPolicy, ot as Requirement, vt as AdminPermissions } from "./auth-contracts-bhMN9XB3.mjs";
+import { Ct as AuthPrincipal, Nt as PrincipalKind, f as AuthorizationPolicy, ot as Requirement, vt as AdminPermissions } from "./auth-contracts-bfFZoA5e.mjs";
 //#region src/admin.d.ts
 export interface PermissionOptions {
   principals?: readonly PrincipalKind[];

package/dist/admin.mjs

@@ -1,5 +1,5 @@
-import { n as BetterAuthConfigurationError } from "./auth-errors-B6jLBpQu.mjs";
-import { u as Require } from "./auth-decorators-BO9T-1wp.mjs";
+import { n as BetterAuthConfigurationError } from "./auth-errors-DRTJZxR8.mjs";
+import { u as Require } from "./auth-decorators-ChMx4-yk.mjs";
 import { isAPIError } from "better-auth/api";
 //#region src/admin.ts
 const adminPermissionPolicy = {

package/dist/api-key.cjs

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_auth_errors = require("./auth-errors-1EdQ36D8.cjs");
-const require_auth_scope_interceptor = require("./auth-scope-interceptor-DJTO9RVP.cjs");
-const require_auth_decorators = require("./auth-decorators-pe3Aou21.cjs");
+const require_auth_errors = require("./auth-errors-BB9VnAqx.cjs");
+const require_auth_scope_interceptor = require("./auth-scope-interceptor-DNadl_Vw.cjs");
+const require_auth_decorators = require("./auth-decorators-DTyDpP0k.cjs");
 let better_auth_plugins_access = require("better-auth/plugins/access");
 //#region src/api-key.ts
 const API_KEY_PRINCIPAL_KIND = "api-key";

package/dist/api-key.d.cts

@@ -1,4 +1,4 @@
-import { $ as PrincipalDelegation, it as PrincipalSource, o as AuthPrincipalBase, ot as Requirement } from "./auth-contracts-CzYNjGov.cjs";
+import { $ as PrincipalDelegation, it as PrincipalSource, o as AuthPrincipalBase, ot as Requirement } from "./auth-contracts-D5zQHUn0.cjs";
 //#region src/api-key.d.ts
 export declare const API_KEY_PRINCIPAL_KIND: "api-key";
 export interface ApiKeyPrincipal extends AuthPrincipalBase {

package/dist/api-key.d.mts

@@ -1,4 +1,4 @@
-import { $ as PrincipalDelegation, it as PrincipalSource, o as AuthPrincipalBase, ot as Requirement } from "./auth-contracts-bhMN9XB3.mjs";
+import { $ as PrincipalDelegation, it as PrincipalSource, o as AuthPrincipalBase, ot as Requirement } from "./auth-contracts-bfFZoA5e.mjs";
 //#region src/api-key.d.ts
 export declare const API_KEY_PRINCIPAL_KIND: "api-key";
 export interface ApiKeyPrincipal extends AuthPrincipalBase {

package/dist/api-key.mjs

@@ -1,6 +1,6 @@
-import { n as BetterAuthConfigurationError, r as BetterAuthInfrastructureError, t as AuthFailures, u as normalizeThrown } from "./auth-errors-B6jLBpQu.mjs";
-import { a as absent, l as rejected, o as authenticated } from "./auth-scope-interceptor-C0NRu4uy.mjs";
-import { u as Require } from "./auth-decorators-BO9T-1wp.mjs";
+import { n as BetterAuthConfigurationError, r as BetterAuthInfrastructureError, t as AuthFailures, u as normalizeThrown } from "./auth-errors-DRTJZxR8.mjs";
+import { a as absent, l as rejected, o as authenticated } from "./auth-scope-interceptor-A7wq7jBx.mjs";
+import { u as Require } from "./auth-decorators-ChMx4-yk.mjs";
 import { role } from "better-auth/plugins/access";
 //#region src/api-key.ts
 const API_KEY_PRINCIPAL_KIND = "api-key";

package/dist/{auth-contracts-CzYNjGov.d.cts → auth-contracts-D5zQHUn0.d.cts}

@@ -85,7 +85,7 @@ declare class BetterAuthInfrastructureError extends Error {
 }
 declare function getRawCause(error: BetterAuthInfrastructureError): unknown;
 declare namespace auth_tokens_d_exports {
-  export { ACCEPT_PRINCIPALS_METADATA, ACCESS_METADATA, AUTH_ENHANCER, AUTH_INSTANCE_METADATA, DB_HOOK_METADATA, FORWARD_COOKIES_METADATA, FRESHNESS_METADATA, GUARD_CORE, HOOK_METADATA, INSTANCE_REGISTRY, INVOCATION_PARAMS_METADATA, INVOCATION_VALUES, MOUNT_COORDINATOR, PLATFORMS, POLICY_INVOKER, POLICY_RESOLVER, PRINCIPAL_PARAMS_METADATA, PRINCIPAL_READINGS, PRINCIPAL_RESOLVER, READER_CONTEXT, REQUEST_SCOPE, REQUIREMENTS_METADATA, ROUTE_PLANNER, SCOPE_CORE, SKIP_DEFAULT_REQUIREMENTS_METADATA, SKIP_ORIGIN_CHECK_METADATA, TRANSPORTS, TRANSPORT_REGISTRY, USE_BETTER_AUTH_METADATA, WS_CONNECTION_AUTH, getBetterAuthHandleToken, getBetterAuthInstanceToken, getBetterAuthOptionsToken, getBetterAuthServiceToken, getExtensionToken, getPrincipalSourcesToken };
+  export { ACCEPT_PRINCIPALS_METADATA, ACCESS_METADATA, AMBIGUOUS_INVOCATION_VALUE, AUTH_ENHANCER, AUTH_INSTANCE_METADATA, DB_HOOK_METADATA, FORWARD_COOKIES_METADATA, FRESHNESS_METADATA, GUARD_CORE, HOOK_METADATA, INSTANCE_REGISTRY, INVOCATION_PARAMS_METADATA, INVOCATION_VALUES, MOUNT_COORDINATOR, PLATFORMS, POLICY_INVOKER, POLICY_RESOLVER, PRINCIPAL_PARAMS_METADATA, PRINCIPAL_READINGS, PRINCIPAL_RESOLVER, READER_CONTEXT, REQUEST_SCOPE, REQUIREMENTS_METADATA, ROUTE_PLANNER, SCOPE_CORE, SKIP_DEFAULT_REQUIREMENTS_METADATA, SKIP_ORIGIN_CHECK_METADATA, TRANSPORTS, TRANSPORT_REGISTRY, USE_BETTER_AUTH_METADATA, WS_CONNECTION_AUTH, getBetterAuthHandleToken, getBetterAuthInstanceToken, getBetterAuthOptionsToken, getBetterAuthServiceToken, getExtensionToken, getPrincipalSourcesToken };
 }
 declare function getBetterAuthInstanceToken(alias?: string): string;
 declare function getBetterAuthOptionsToken(alias?: string): string;
@@ -124,6 +124,8 @@ declare function getPrincipalSourcesToken(instance: string): symbol;
 declare function getExtensionToken(point: "platforms" | "transports" | "principals", instance: string, index: number): symbol;
 declare const READER_CONTEXT: unique symbol;
 declare const INVOCATION_VALUES: unique symbol;
+/** Stored in place of an invocation value that two contributing policy runs published differently. */
+declare const AMBIGUOUS_INVOCATION_VALUE: unique symbol;
 //#endregion
 //#region src/auth-module.d.ts
 declare class BetterAuthModule {
@@ -156,7 +158,8 @@ interface BridgeHandle {
    * dispatching until another application binds (§10.6). A second bind() from the same owner for the same instance is a no-op that
    * returns the existing registration (NestMicroservice.init() runs lifecycle hooks twice); from the same owner for another instance it
    * throws PLUGIN_SHARED_BETWEEN_INSTANCES (B03). Throws INSTANCE_ALREADY_BOUND if another bootstrapped application is bound; takes over
-   * a never-bootstrapped one (reported, B06) and a closed one (silently).
+   * a never-bootstrapped one (reported, B06) and a closed one (silently). A never-bootstrapped binding it takes over becomes
+   * 'displaced': an application whose init() was still running when another bound fails in onApplicationBootstrap (B06).
    */
   bind(binding: BridgeBinding): {
     close(): void;
@@ -172,8 +175,11 @@ interface BridgeBinding {
   };
   /** The instance this plugin object serves; one plugin object serves one instance (B03). */
   readonly instance: string;
-  /** 'initialized' at bind; the kernel sets 'bootstrapped' in onApplicationBootstrap; close() sets 'closed'. */
-  state: "initialized" | "bootstrapped" | "closed";
+  /**
+   * 'initialized' at bind; the kernel sets 'bootstrapped' in onApplicationBootstrap; close() sets 'closed'; bind() of another
+   * application sets 'displaced' on an 'initialized' binding it takes over.
+   */
+  state: "initialized" | "bootstrapped" | "closed" | "displaced";
   /** View of the kernel's RequestScope; the plugin never owns an AsyncLocalStorage. [C] */
   current(): ScopeView | undefined;
   /** Credential header names declared by the instance's principal sources (credential matching, §7.5). */
@@ -223,10 +229,15 @@ interface ScopeState {
   readonly plan?: RoutePlan;
   readonly reading?: () => PrincipalReading;
 }
+/** A requirement's decision and the invocation values of the policy runs that produced an allow. */
+interface DecisionOutcome {
+  readonly decision: AuthorizationDecision;
+  readonly published: readonly ReadonlyMap<symbol, unknown>[];
+}
 interface RequestState {
   readonly principal: Map<string, Promise<PrincipalResult>>;
   readonly policyIo: Map<string, Promise<unknown>>;
-  readonly decisions: Map<string, Promise<AuthorizationDecision>>;
+  readonly decisions: Map<string, Promise<DecisionOutcome>>;
   readonly values: Map<symbol, unknown>;
   readonly authorizationCalls: Set<string>;
   readonly origins: Map<string, Promise<AuthFailure | null>>;
@@ -250,7 +261,7 @@ declare class RequestScope {
     sourceSet: string;
   }, compute: () => Promise<PrincipalResult>): Promise<PrincipalResult>;
   memoPolicyIo<T>(request: object, instance: string, concreteKey: string, compute: () => Promise<T>, limit?: number | false): Promise<T>;
-  memoDecision(invocation: object, instance: string, concreteKey: string, compute: () => Promise<AuthorizationDecision>): Promise<AuthorizationDecision>;
+  memoDecision(invocation: object, instance: string, concreteKey: string, compute: () => Promise<DecisionOutcome>): Promise<DecisionOutcome>;
   valueKey(instance: string, key: symbol): symbol;
   surfaced(key: object, error: object, context: {
     instance: string;
@@ -663,6 +674,7 @@ type AuthHookContext<P extends string = string> = Omit<import("better-auth").Hoo
 };
 type AuthAfterHookContext<P extends string = string> = AuthHookContext<P>;
 type DbHooks = NonNullable<import("better-auth").BetterAuthOptions["databaseHooks"]>;
+/** The SDK's own hook signature for a target, independent of the registered instance. Internal to the dispatcher. */
 type DbHookFn<E extends DatabaseHookTarget, Ph extends "before" | "after"> = E extends `${infer M extends keyof DbHooks & string}.${infer O extends "create" | "update" | "delete"}` ? NonNullable<NonNullable<NonNullable<DbHooks[M]>[O]>[Ph]> : never;
 /** Best effort: the registered instance's additional user/session fields, Partial for updates; nothing when not derivable. */
 type RegisteredRow<M> = M extends "user" ? UserOf<RegisteredAuth> : M extends "session" ? SessionOf<RegisteredAuth> extends {
@@ -1663,4 +1675,4 @@ interface PolicyBootContext {
 }
 //#endregion
 export { PrincipalDelegation as $, ErrorMappingOptions as $n, SESSION_PRINCIPAL_KIND as $t, DatabaseHookTarget as A, BetterAuthService as An, GetSessionWithHeaders as At, HookOptions as B, WS_CONNECTION_AUTH as Bn, UnvalidatedBody as Bt, ConformanceCase as C, defineHttpPlatform as Cn, AuthPrincipal as Ct, CookieForwardingOptions as D, allow as Dn, DatabaseHookMethod as Dt, ConformanceSkip as E, BetterAuthGuard as En, DatabaseHookData as Et, ExtensionDefinition as F, BetterAuthModule as Fn, Register as Ft, InboundAuthRequest as G, AuthErrorBody as Gn, betterAuthCorsOrigin as Gt, HttpMountOptions as H, getBetterAuthInstanceToken as Hn, WithActiveOrganization as Ht, ExtensionRef as I, GUARD_CORE as In, RegisteredAuth as It, PlatformMountContext as J, AuthFailures as Jn, definePrincipalSource as Jt, InvocationLineage as K, AuthErrorCode as Kn, absent as Kt, FastifyPlatformOptions as L, POLICY_INVOKER as Ln, RegisteredInstances as Lt, DbHookOptions as M, InstanceLookup as Mn, OrgPermissions as Mt, DefaultInstanceCheck as N, EXTENSION_DEFINITION as Nn, PrincipalKind as Nt, CookieSink as O, definePolicy as On, DatabaseHookResult as Ot, ExpressPlatformOptions as P, UPGRADE_REQUEST as Pn, PrincipalOfKind as Pt, PolicyRef as Q, BetterAuthInfrastructureError as Qn, RequireFreshSession as Qt, GuardReach as R, PRINCIPAL_RESOLVER as Rn, SessionOf as Rt, ClaimOptions as S, defineExtension as Sn, AuthOf as St, ConformanceRunner as T, BetterAuthScopeInterceptor as Tn, AuthUser as Tt, HttpPlatform as U, getBetterAuthOptionsToken as Un, PrincipalKinds as Ut, HookPredicate as V, getBetterAuthHandleToken as Vn, UserOf as Vt, HttpRequestAccessor as W, getBetterAuthServiceToken as Wn, httpTransport as Wt, PolicyBootContext as X, AuthTransportErrorPayload as Xn, CurrentSession as Xt, PlatformPrepareContext as Y, AuthGraphqlExtensions as Yn, rejected as Yt, PolicyInvoker as Z, BetterAuthConfigurationError as Zn, CurrentUser as Zt, BetterAuthRuntimeOptions as _, allOf as _n, TransportValidationContext as _t, AuthHandlerInterceptor as a, BeforeAuth as an, ProxyTrust as at, BootAdviceContext as b, definePrincipalParam as bn, AuthHookContext as bt, AuthTransport as c, ForwardAuthCookies as cn, RequirementOptions as ct, AuthorizationLimits as d, Require as dn, ScopeInit as dt, freshSession as en, getRawCause as er, PrincipalReading as et, AuthorizationPolicy as f, RequireAuth as fn, SessionOption as ft, BetterAuthModuleOptions as g, UseBetterAuth as gn, TransportKit as gt, BetterAuthModuleAsyncOptions as h, UseAuthInstance as hn, TransportCall as ht, AuthHandle as i, AfterDatabase as in, PrincipalSource as it, DbHookMethodDecorator as j, TransportRegistry as jn, IsRegistered as jt, CorsOriginOptions as k, deny as kn, EndpointPath as kt, AuthorizationContext as l, OptionalAuth as ln, ResolutionRequest as lt, BetterAuthFactoryResult as m, SkipOriginCheck as mn, StaticOptionMustBePassedToForRootAsync as mt, ApplicationRouteDescriptor as n, AcceptPrincipals as nn, isConfigurationError as nr, PrincipalResolver as nt, AuthPrincipalBase as o, BeforeDatabase as on, Requirement as ot, BetterAuthAppOptions as p, SkipDefaultRequirements as pn, SessionPrincipalOptions as pt, OriginCheckOptions as q, AuthFailure as qn, authenticated as qt, AuthContextView as r, AfterAuth as rn, isInfrastructureError as rr, PrincipalResult as rt, AuthRouteBinding as s, CurrentPrincipal as sn, RequirementExpr as st, AdvisedHandler as t, sessionPrincipal as tn, isAuthFailure as tr, PrincipalRequest as tt, AuthorizationDecision as u, Public as un, RoutePlan as ut, BetterAuthStaticOptions as v, anyOf as vn, AdminPermissions as vt, ConformanceOutcome as w, defineTransport as wn, AuthSession as wt, BrowserExposure as x, requirement as xn, AuthLike as xt, BootAdvice as y, defineInvocationParam as yn, AuthAfterHookContext as yt, HookMethodDecorator as z, SCOPE_CORE as zn, SessionPrincipal as zt };
-//# sourceMappingURL=auth-contracts-CzYNjGov.d.cts.map
+//# sourceMappingURL=auth-contracts-D5zQHUn0.d.cts.map

package/dist/auth-contracts-D5zQHUn0.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-contracts-D5zQHUn0.d.cts","names":[],"sources":["../src/auth-errors.ts","../src/auth-tokens.ts","../src/auth-module.ts","../src/bridge-protocol.ts","../src/request-scope.ts","../src/origin-check.ts","../src/instance-registry.ts","../src/mount-coordinator.ts","../src/principal-readings.ts","../src/policy-resolver.ts","../src/transport-registry.ts","../src/route-planner.ts","../src/auth-service.ts","../src/authorization-evaluator.ts","../src/auth-guard.ts","../src/auth-scope-interceptor.ts","../src/auth-module-definition.ts","../src/auth-decorators.ts","../src/session-principal.ts","../src/principal-resolver.ts","../src/auth-exchange.ts","../src/http-transport.ts","../src/index.ts","../src/auth-types.ts","../src/auth-contracts.ts"],"mappings":";;;;;;;KAoBY;;UAGK;WACN;WACA,MAAM;WACN;WACA;WACA;WACA,UAAU;;UAGJ;EACf;EACA;EACA,MAAM;EACN;EACA;;UAGe;EACf,MAAM;EACN;EACA;;UAGe;EACf;EACA;EACA,MAAM;EACN;EACA;;UAGe;EACf,OACE,SAAS,aACT,SAAS,kBACT;EAEF;;iBAQc,cAAc,iBAAiB,SAAS;iBAIxC,sBACd,iBACC,SAAS;iBAII,qBACd,iBACC,SAAS;iBAqDH,UAAU;EACjB;EACA;EACA;EACA;EACA;IACE;cA6BS;EACX,gBAAe,mBAAoB;EAGnC,iBAAQ;EACR,UAAS,gBAAe,mBAAqB;EAG7C,aAAY,iBAAkB;;cA4BnB,qCAAqC;WACvC;WACA;WACA;WACA;WACA;WACA;aACP;aACA;aACA;;WAEO,kBAAkB;EAE3B,YAAY,cAAc,gBAAgB;SAUnC,UACL,cACA,gBACA;IAAY;IAAe;MAC1B;;cAeQ,sCAAsC;WACxC,OAAO;WACP;aACP;aACA;aACA;;EAGF,YAAY,gBAAgB;IAAY;;;iBAmD1B,YAAY,OAAO;;;;iBC1SnB,2BAA2B;iBAI3B,0BAA0B;iBAI1B,0BAA0B;iBAI1B,yBAAyB;cAK5B;cAGA;cAGA;cAGA;cAGA;cAGA;cAGA;cAGA;cACA;cACA;cAGA;cAGA;cACA;cACA;cACA;cAGA;cAGA;cAGA;cAGA;cAGA;cAGA;cAGA;cAGA;cAGA;cAGA;cACA;cAGA;;cAEA;iBAIG,yBAAyB;iBAMzB,kBACd,kDACA,kBACA;cAOW;cAGA;;cAIA;;;cC3GA;SACJ,QAAQ,UAAU,WAAW,gBAClC,SAAS,wBAAwB,KAC/B;IAAyB;MAAqB,qBAAqB,KACpE;SACI,QAAQ,UAAU,UACvB,SAAS,wBAAwB;IAAO;MAAiB,eACxD;SAWI,aAAa,UAAU,WAAW,gBACvC,SAAS,6BAA6B,KACpC;IAAyB;MAC1B;SACI,aAAa,UAAU,UAC5B,SAAS,6BAA6B;IAAO;MAAiB,eAC7D;;;;cC/BQ;cAGA;UAII;WACN;WACA;;WAEA;;WAEA;;;;;;;;;EAST,KAAK,SAAS;IAAkB;IAAe;;;EAE/C,mBAAmB;;UAEJ;;WAEN;aAAkB;;;WAElB;;;;;EAKT;;EAEA,WAAW;;WAEF;WACA,iBAAiB;WACjB,gBAAgB;WAChB,UAAU,YAChB,KAAK;aACK,iBAAiB,mBAAmB;aACpC,gBAAgB,mBAAmB;;;EAIhD,UAAU;;UAEK;;WAEN,SAAS;WACT;WACA,gBAAgB;WAChB;;;;;;;WAOA,sBAAsB,cAAc;;;WAGpC,uBAAuB;;UAEjB;;;;;;;;EAQf,QAAQ,KAAK,qBAAqB,OAAO;EACzC,IAAI,KAAK,sBAAsB;;;;UClEhB;WACN,MAAM;WACN,OAAO;WACP,OAAO;WACP,gBAAgB;;;UAGV;WACN,UAAU;WACV,oBAAoB;;UAEd;WACN,WAAW,YAAY,QAAQ;WAC/B,UAAU,YAAY;WACtB,WAAW,YAAY,QAAQ;WAC/B,QAAQ;WACR,oBAAoB;WACpB,SAAS,YAAY,QAAQ;WAC7B,UAAU;WACV,aAAa;IAGlB,OAAO,QAAQ;MAAmB;;IAClC;;;cAmCO;;EAOX,IAAI,GAAG,OAAO,YAAY,UAAU,IAAI;EAIxC,KAAK,GAAG,UAAU,IAAI;EAItB,WAAW;EAIX,SAAS,cAAc;EAkBvB,cACE,MAAM,KAAK,yDACX;IACE;IACA;IACA;KAEF,eAAe,QAAQ,mBACtB,QAAQ;EAqCX,aAAa,GACX,iBACA,kBACA,qBACA,eAAe,QAAQ,IACvB,yBACC,QAAQ;EA0BX,aACE,oBACA,kBACA,qBACA,eAAe,QAAQ,mBACtB,QAAQ;EAWX,SAAS,kBAAkB;EAc3B,SACE,aACA,eACA;IAAW;IAAkB;IAAc,UAAU;;;;;;cCxL5C;;mBAOQ;EADnB,YACmB;IACf,KAAK;IACL,MAAM;;EAIV,OACE,kBACA,SAAS,aACT,SAAS,SACT;EA6BF,gBACE,kBACA,SAAS,SACT;;UAWa;WACN;WACA,SAAS;WACT,UAAU;WACV,cAAc;WACd;WACA;;cAGE;;mBAKQ;mBACA;EAFnB,YACmB,OAAO,cACP,MAAM;EAKzB,MACE,SAAS,iBACT,0BACC,QAAQ;EAsEL,SAAS,SAAS,kBAAkB;EAkB1C,oBACE,SAAS,iBACT,cACA;UAuBM;UAkBM;;;;UCxLC;WACN;WACA,UAAU;WACV,SAAS,yBAAyB;WAClC,eAAe;WACf,kBAAkB;WAClB,QAAQ;WACR,SAAS;WACT,QAAQ;WACR,QAAQ;WACR;;UAEM;EACf,IAAI,eAAe;EACnB,iBAAiB;;UAEF;WACN;WACA,UAAU;WACV,SAAS,yBAAyB;WAClC,eAAe;WACf,YAAY;WACZ,kBAAkB;WAClB,QAAQ;;cAgBN,4BAA4B;;mBASa;WAN3C,QAAM;WACN,aAAW;EACpB;EACA,SAAS;EACT;IAAU;;EAEV,YAAoD,OAAO;EAE3D,SACE,SAAS,yBAAyB,WAClC,eAAe,yBACf,kBAAkB,mBAClB,YAAY,uBACX;EAiBH,0BAA0B;EAI1B,IAAI,eAAe;EAYnB,iBAAiB;EAIjB,MAAM,SAAS;EAmBT,WAAW,QAAQ,iCAAiC;EAyK1D;;;;cClTW;;WAUyB,MAAM;mBACI;WAVrC,QAAM;EAQf,YACoC,MAAM,iBACI,UAAU,kBAC/B,OAAO;EAMhC,kBAAkB,oBAAoB;MAKlC,YAAY;MAIZ,WAAW;UAIP;EAqDR,cAAc,QAAQ;EAmBtB,QAAQ,QAAQ;EAyEhB,MAAM,mBAAmB;EAMzB,QAAQ,eAAe;EAIvB,qBAAqB;EAIrB,0BAA0B;EAO1B,0BACE,iBAAiB,8BACjB,QAAQ;EAkBJ,SAAS;EAwBf;;;;UChQe;WACN;WACA,OAAO;WACP,UAAU;WACV,OAAO,KAAK;WACZ;WACA;;;cAwEE,4BAA4B;EACvC,YAAY,OAAO;;cAMR;mBACkB;EAA7B,YAA6B,OAAO;EAEpC,OACE,MAAM,KAAK,0CACX,SAAS;EAUX,cAAc,SAAS,mBAAmB,SAAS;EAMnD,UACE,SAAS,mBACT,2BACC;EAWH,KAAK,OAAO,eAAe;EA0E3B,WAAW;EAWX,QAAQ,GACN,SAAS,kBACT;IACE;IACA;IACA;IACA,UAAU,WAAW,kBAAkB;KAEzC,QAAQ,eACP;EAqBH,QACE,OAAO,8BACP,QAAQ,cACR,oBACC,+BAA+B;EAmBlC,MACE,0BACA,kBACA,QAAQ;;;;cC5RC;mBAMkB;mBALZ;EAKjB,YAA6B,WAAW;EAExC,QAAQ,GAAG,WAAW,UAAU,KAAK,oBAAoB;;;;cCJ9C;UACH;mBACS;UACT;EAER,SAAS,qBAAqB;EAI9B,OAAO,KAAK;EAIZ,iBAAiB;EAKjB,iBAAiB,QAAQ,UAAU;EAUnC,KAAK,SAAS,mBAAmB;EAIjC,OAAO,SAAS,mBAAmB;EAWnC,KAAK,MAAM;EAIX,SACE,SAAS,kBACT,YAAS,gBACR;;;;cCsBQ;mBAKQ;mBACA;mBACA;mBALF;EAEjB,YACmB,WAAW,gBACX,UAAU,gBACV,YAAY;UAGvB;EAoGR,eAAe,QAAQ,MAAM,0BAA0B;EAIvD,WAAW,SAAS,mBAAmB;EAiBvC,KAAK,QAAQ,MAAM,iBAAiB;;;;cCrLzB,kBAAkB,UAAU,WAAW;;mBAQJ;mBACJ;mBACK;mBACL;mBACK;mBACD;WAZrC;WACA,UAAU;WACV,KAAK;EAGd,YACuC,SAAS,yBAAyB,IAC3B,UAAU,kBACd,OAAO,cACF,UAAU,mBACf,SAAS,cACJ,YAAY,mBACb,aAAa;EAiB3D,WAAW,QAAQ,QAAQ;EAI3B;aAEe;aACA;aACA;;EAcf,gBAAgB,QAAQ;EAUxB,cAAc,QAAQ,UAAU;EAIhC,aAAa,SAAS,mBAAmB;EAiBzC,YAAY,2BAA2B;EA0BvC,sBAAsB,GAAG,UAAU,QAAQ,KAAK,QAAQ;EA0BxD,eAAe,GAAG,UAAU,QAAQ,KAAK,QAAQ;EAiBjD,gBAAgB,GAAG,UAAU,QAAQ,KAAK,QAAQ;;;;cCrJvC,aAAY;cACZ,OAAI;EACf;EACA;EACA;EACA;MACE;iBACY,aAAa,GAAG,UAAU,gBAAgB,eACxD,QAAQ,oBAAoB,GAAG,gBAAgB,OAC7C,QAAQ,GAAG,UAAU,uBAAuB,YAAY;cAY/C;mBAIQ;mBACA;mBACA;mBACA;mBANF;EAEjB,YACmB,UAAU,gBACV,SAAS,eACT,UAAU,mBACV,OAAO;EAGpB,SACJ,MAAM,WACN,WAAW,eACX,MAAM,eACN,OAAO,eACP,WAAW,kBACX,oBACC,QAAQ;;;;cC3CA,2BAA2B;mBAKC;mBAJtB;YACP;EAEV,YACuC,MAAM,KAAK;EAGlD,YAAY,SAAS,mBAAmB;;cAI7B,qBAAqB;mBAEb;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;EAPnB,YACmB,WAAW,gBACX,SAAS,cACT,YAAY,mBACZ,UAAU,mBACV,WAAW,wBACX,OAAO,cACP,UAAU;EAGvB,YAAY,SAAS,mBAAmB;;;;cChCnC,sCAAsC;mBAKV;mBAJtB;YACP;EAEV,YACuC,MAAM,KAAK;EAGlD,UAAU,SAAS,kBAAkB,MAAM,cAAc;;cAI9C,qBAAqB;mBAEb;mBACA;mBACA;mBACA;mBACA;EALnB,YACmB,WAAW,gBACX,SAAS,cACT,YAAY,mBACZ,OAAO,cACP,UAAU;EAG7B,UAAU,SAAS,kBAAkB,MAAM,cAAc;;;;iBCc3C,gBAAgB,GAC9B,YAAY,KAAK,oBAAoB,WAAW,wBAC/C,oBAAoB;iBAGP,mBAAmB,UAAU,cAAc,UAAU,IAAI;iBAGzD,gBAAgB,UAAU,eAAe,WAAW,IAAI;;;cCtB3D,uCAAM,uBAAA;cACN,6CAAY,uBAAA;cAEZ,cAAW;EAAgB;OAAyB,kBAAA,UAAA,GAAA,QAAA,oBAAA,+BAAA,aAAA,wBAAA;cAKpD,kBAAe,0CAAgB,uBAAA;cAE/B,sBAAgB,iBACP,kBAAkB,8CAAgB,uBAAA;cAE3C,wDAAuB,uBAAA;cAEvB,qBAAkB,+CAAA,uBAAA;cAElB,gDAAe,uBAAA;cAEf,sBAAa,kBAAA,UAAA,GAAA,QAAA,oBAAA,+BAAA,aAAA,wBAAA;iBAMV,WACX,uBAAuB,oBACzB,iBAAiB;cAeP,WAAK,uBACU,sBACzB;cACU,WAAK,uBACU,sBACzB;cACU,cAAe,GAAC,QACnB,UAAU,IAAE,QACZ,GAAC,UACC,uBACT,YAAY;cAyEF,wBAAuB;iBACpB,qBAAqB,UAAU,eAAe,GAAG;WACtD,MAAM;WACN;WACA,UAAU,WAAW,gBAAgB,OAAO;UAC7C;iBAGM,sBACd,cACA;WAAiB;UACV;cA2HI,mBAAoB,UAAU,8BAA4B,QAC7D,aAAa,MAAM,eAAa,UAC9B,gBACT,oBAAoB;cACV,kBAAmB,UAAU,8BAA4B,QAC5D,aAAa,MAAM,eAAa,UAC9B,gBACT,oBAAoB;cAqBV,iBAAkB,UAAU,oBAAkB,QACjD,GAAC,UACC,kBACT,sBAAsB;cAEZ,gBAAiB,UAAU,oBAAkB,QAChD,GAAC,UACC,kBACT,sBAAsB;;;cC1TZ;cACA,sBAAc;cAKd,mBAAW;iBAgBR,iBAAiB,IAAI,aACnC,UAAS,wBAAwB,KAChC,gBAAgB,iBAAiB;cAuLvB,eAAY;EACZ;MACV;EAAc;;cAIJ,sBAAmB;EAC9B;MACE,iBAAiB;;;cCvNR,wBAAyB,UAAU,mBAAiB,QACvD,gBAAgB,OACvB,gBAAgB;cACN,gBAAiB,UAAU,mBAAiB,WAC5C,MACV,gBAAgB;cACN,cAAa;cACb,WAAQ,SAAa,gBAAc;;;;iBCiShC,qBACd,MAAM,UACN,UAAU,qBAEV,4BACA,KAAK,KAAK,cAAc;;;iBC3IV,iBAAiB,aAAa;;;;UCpL7B;EACf,SAAS;;;;;UCIM;EACf,QAAQ,SAAS,UAAU,QAAQ;EACnC;IACE,WAAW;MACT,SAAS;MACT;QAAU;QAA8B;;MACxC;QACE;;EAEN,UAAU;;;UAGK;WACN,UAAU;WACV;;;UAKM;KACL,eAAe;EAAmB,MAAM;;KACxC,iBAAiB;EAAmB,YAAY,UAAU;IAClE,IACA;KACQ,sBAAsB;EAChC,iBAAiB,UAAU,eAAe;IAExC,IACA;KACQ,OAAO,gCAAgC,sBAC/C,iBACA,gBAAgB,sBACd,oBAAoB,KACpB;;KAGD;EACH,+BAA+B;EAC/B,4BAA4B;;KAElB,UAAU,KAAK;EAAY;IAAU,eAAe;;IAC5D,YAAY,KACZ;KACQ,OAAO,KAAK,UAAU;EAAa,YAAY;IAAM;KACrD,YAAY,gCAAgC,UAAU,OAAO;KAC7D,SAAS,gCAAgC,OAAO,OAAO;KACvD,UAAU,KAAK;EAAY;IAAQ;;;KAG1C,OAAO,KAAK,YAAW,WAAW,kBAClC,YAAY;EAAe,aAAa;KACvC,YAAY;KAGb,cAAc,GAAG,oBAAoB;EACxC,QAAQ,KAAK,UAAU;IAErB,OAAO;EAAa,oBAAoB;IACtC,YAAY;KAGN,iBAAiB,gCAC3B,4BACI,cAAc,OAAO,2BACrB;KACM,eAAe,gCACzB,4BACI,cAAc,OAAO,uBACrB;KAID,MAAM,KAAK;EAAY,WAAW;IAAQ;KACnC,aAAa,IAAI,qBAC1B,WAAW,MAAM,KAAK,MAAM,GAAG;EAAa,YAAY;IACrD,mBAEE,MAAM;KACT,WAAW,kBAAkB,IAAI,qBACnC,WAAW,MAAM,KAAK,MAAM,GAAG;EAAa,MAAM;IAAM,MAAM,GAAG,oBAC5D,MAAM;KACT,OAAO,qBAAqB,WAAW,gCAExC,OAAO,WAAW;;;;;KAKV,gBAAgB,MAAM,+BAE9B,+BACc,WAAW,kBAAiB,SAAS;KAE3C,gBAAgB,6BAA6B,2BACjC;EAElB,MAAM;EAAG,qBAAqB,cAAc,gBAAgB,OAAO;;KAC7D,qBAAqB,6BAC/B,gBAAgB;KAIb,UAAU,kCACS;;KAGZ,SACV,UAAU,oBACV,iCACE,mBAAmB,gBAAgB,0BAA0B,6CAC7D,YAAY,YAAY,YAAY,QAAQ,IAAI,IAAI;;KAGnD,cAAc,KAAK,mBACpB,OAAO,kBACP,sBACE,UAAU;EAA0B,eAAe;IACjD;KAGH,YAAY,UAAU,sBACzB,mBAAmB,WAAW,OACzB,cAAc,sBACb,uBACA,qBACE,QAAQ,cAAc,MACtB,cAAc,KAClB;;KAEM,iBACV,UAAU,oBACV,4CACE,WAAW,SAAS,GAAG,UAAU,YAAY;;KAErC,mBACV,UAAU,oBACV,iCACE,QAAQ,WAAW,SAAS,GAAG;KACvB,mBACV,UAAU,oBACV,kCAEA,MAAM,iBAAiB,GAAG,KAC1B,2BAA2B,8CACxB,mBAAmB,GAAG,MAAM,QAAQ,mBAAmB,GAAG;;KAGnD,uBAAuB,KAAK;EACtC;IAAW;;;KAID,sBAAsB;KACtB,gBAAgB,eAAe;KAC/B,gBAAgB,UAAU,iBAAiB,eAAe;UACrD,iBAAiB,IAAI,qBAAqB;WAChD;WACA,SAAS;;;;UC9HH;;EAEf,qBAAqB,aAAa;;EAElC,sBAAsB,aAAa;;KAEzB;WACD;WACA;;;UAIM;;EAEf;;EAEA;;;;;EAKA;;;;;;;EAOA;;EAEA,sBAAsB,aAAa;;;KAIzB,yBAAyB,UAAU,WAAW;;EAExD,MAAM;;EAEN;;;;;;;;EAQA,+BAA+B;;EAE/B,OAAO;;EAEP,UAAU;;EAEV,cAAc;;EAEd,SAAS;;EAET,SAAS;;EAET;IACE,cAAc;UAED;;;;;;EAMf;;UAGe;;;;;;;;;EASf;;UAGe;;;;;EAKf;;;;;;;;EAQA;;;KAIU,cAAc,UAAU,YAClC,UAAU,UAAU;EACd,UAAU,wBAAwB,UAAU;;EAE5C,UACK,wBAAwB,UAAU;IACjC,SAAS,GAAG,UAAU;;;UAKnB,wBAAwB;;EAEvC,UAAU,SAAS;;EAEnB;;;;;;;EAOA;;UAGe;;EAEf;;EAEA;;EAEA,kBAAkB;;EAElB;;;;;;EAMA;;EAEA;;KAGU,0BACV;WACW,SAAS;WACT;WACA;GAEX,OAAO,UAAU,YAAY,QAAQ,cAClC,QAAQ;KAED,wBAAwB,UAAU,YAC5C,0BAA0B,yBAAyB;UAEpC,6BAA6B,UAAU,kBAC9C;EACR,UAAU;EACV,mBAAmB,iBAAiB;EACpC,gBACK,gBACA,wBAAwB,KAAK,QAAQ,wBAAwB;;;KAIxD,wBAAwB,UAAU,YAC5C,yBAAyB,QACtB,YAAY,0BACX,yBAAyB,uCAAuC;UAErD,uCAAuC;WAC7C,aAAa;;;KAGZ,qBAAqB,KAAK,4BAClC,UAAU;EAEN,MAAM;;;KAKF,aAAa,KAAK,KAAK,KAAK,IAAI,oBAAoB;UAC/C,oBAAoB;YACzB;WACD;aACM,UAAU,KAAK;;aAEf,gBAAgB,gBAAgB,IAAI,QAAQ;aAC5C,kBAAkB;;aAElB,aAAa,eAAe;;WAClC,qBAAqB;WACrB,UAAU;;WAEV,mBAAmB;;UAGb;WACN;;;;;;;WAOA;;WAEA;;;;;WAKA,uBAAuB;;WAEvB;;;;;;WAMA;;WAEA;;WAEA,SAAS;;WAET;aACE;aACA;;;;;;;WAOF;;WAEA;;WAEA;WACA;;KAKC,oBACR;WACW;;WACA;;;;;;UAME;EACf,QACE,MAAM,eACN,SAAS,oBACR,QAAQ;;UAEI;WACN,MAAM;WACN;;WAEA,SAAS;;WAET;;;;;;WAMA;aAAwB;;;;UAIlB;EACf,OAAO,GACL,QAAQ,oBAAoB,SAC5B,QAAQ,GACR,SAAS,uBACR,QAAQ;;UAGI;WACN;;WAEA,sBAAsB;;WAEtB;;UAGM;;EAEf;;EAEA;;EAEA;;EAEA;;UAEe;EACf;EACA;;KAEU,iBAAiB,KAAK;;;;;KAKtB,oBAAoB,qBAC9B,WAAW,KAAK,gBAAgB,gBAEhC,gBACA,sBACA,YAAY,wBAAwB;;KAG1B,sBACV,UAAU,oBACV,kCACG,UAAU,mBAAmB,GAAG,KACnC,gBACA,sBACA,YAAY,wBAAwB;KAE1B;UAGK;;EAEf;;UAae;;EAEf,YAAY,KAAK;IAAoB;;;UAGtB;;EAEf,YAAY;IAAW;IAAa,KAAK;;;UAiJ1B;WACN;WACA;;WAEA;;;;;EAKT,OAAO,QAAQ;;;UAIA;WACN;;;KAKC,4BAA4B;UAEvB;EACf,SAAS,cAAc;;;;;EAKvB,GAAG,cAAc,KAAK,sBAAsB;;UAG7B;WACN;;WAEA;WACA;WACA;;UAEM;WACN;WACA,MAAM;;WAEN,SAAS;;WAET;WACA;;WAEA;aACE;aACA;;;WAGF,mBAAmB;WACnB;aACE;aACA;;WAEF,kBAAkB,KACzB;;WAIO,mBAAmB,KAAK;;UAElB;WACN,MAAM;;WAEN;;WAEA;;UAGM;;WAEN;;;;;;WAMA;aACE;aACA;;;EAGX,SAAS,SAAS;;;;;;;;;EASlB,SAAS,KAAK;;;;;;;EAOd,MAAM,KAAK,8BAA8B;;WAEhC,UAAU;;EAEnB,YAAY,SAAS,sBAAsB;;EAE3C,UAAU,SAAS;;;;;EAKnB,mBACE,iBAAiB,8BACjB,mBAAmB;;EAGrB,QACE,KAAK,6BACK,eAAe,iBAAiB;;UAG7B;;WAEN;;WAEA;;WAEA;;WAEA;;UAGM;;;;;;WAMN;WACA;;UAGM;WACN,SAAS;WACT,QAAQ;;EAEjB,MAAM,mBAAmB;;UAGV;WACN,SAAS;WACT,QAAQ;WACR,SAAS;;UAGH;WACN;;WAEA;WACA;;WAEA;;EAET,QAAQ;;;;;EAKR,OAAO,SAAS,qBAAqB,QAAQ;;EAE7C,mBAAmB;;UAGJ;WACN;;WAEA;;WAEA,SAAS;;WAET,MAAM,aAAa,eAAe;;WAElC;;WAEA;;WAEA,SAAS;;UAGH;;;;;;EAMf,UAAU;;;;;;;;EAQV,OAAO;;EAEP,IAAI;;EAEJ,QAAQ,eAAe;;EAEvB,QAAQ;aAA0B;aAAyB;;;EAE3D,SAAS;;EAET,MAAM,cAAc;;EAEpB,WAAW,cAAc,eAAe;;EAExC,aAAa;;UAGE;;EAEf,OAAO;;UAGQ;;WAEN;;;;;EAKT,QAAQ,SAAS;;;;;;EAMjB,SAAS,SAAS,kBAAkB,KAAK,eAAe;;EAExD,YAAY,SAAS,aAAa,SAAS;;;;;;;;EAQ3C,qBACE,OAAO,gCAAgC,8BACvC,SAAS,kBACT;aAAiB;;;;;;EAMnB,UAAU,KAAK,oCAAoC;;;;;;;;EASnD,kBAAkB,QAAQ,UAAU;;;;;;;EAOpC,SAAS,SAAS,mBAAmB;;WAE5B;aAAsB;;;EAE/B,QACE,KAAK,6BACK,eAAe,iBAAiB;;UAG7B;;;;;WAKN;;;;;;;;;;WAUA;;WAEA;;WAEA;;;;;;WAMA,UAAU;;;;;;EAMnB,WAAW;;WAEF;;WAEA,SAAS;;WAET;aAAqB;aAAyB;;;EAEvD,MAAM;;WAEG,UAAU;;UAGJ;;;;;;WAMN;;;;;EAKT,WAAW;;WAEF;;WAEA;;;UAIM;;WAEN;;;;;;;;WAQA;;;;;;;WAOA,YAAY,6BAA6B;;;;;;WAMzC,kBAAkB;;UAGZ;;WAEN,MAAM;;UAGA;WACN,WAAW;WACX,WAAW;WACX,WAAW;WACX;;WAGA,SAAS,QAAQ,UAAU,mBAAmB;;;;;EAKvD,MAEE,QAAQ,UACR,4BACA,OAAO,YACP,SAAS;WAEF,QAAQ;;;;;;;;;KASP;UACK;;WAEN;;WAEA;;WAEA;;WAEA;;;;;WAKA;;UAGM;WACN;;WAEA;;WAEA;;;;;WAKA,aAAa;;UAGP;;EAEf,OAAO,aAAa,SAAS;;WAEpB;;UAGM,gBAAgB,UAAU,oBAAoB;WACpD;;WAEA,gBAAgB;;;;;WAKhB;;;;;WAKA;;WAEA;aACE;aACA;;;;;;;;WAQF;;;;;;WAMA;;;;;WAKA;aACE;aACA;;;EAGX,WAAW,SAAS;;;;;EAKpB,QAAQ,SAAS,mBAAmB,QAAQ,gBAAgB;;EAE5D,QACE,KAAK,6BACK,eAAe,iBAAiB;;KAGlC,gBAAgB,UAAU,oBAAoB;WAC3C;WAAmC,WAAW;;WAC9C;;WACA;WAA8B,SAAS;;UAErC;WACN,SAAS;WACT,SAAS;WACT;WACA;aAAqB;aAAyB;;WAC9C;WACA,MAAM;;EAEf,KAAK,GAAG,+BAA+B,eAAe,QAAQ,KAAK,QAAQ;;;UAI5D,WAAW,UAAU,WAAW;WACtC;WACA,UAAU;WACV,KAAK;EACd,WAAW,QAAQ;EACnB,UAAU,aAAa;;EAEvB,IAAI,GAAG,MAAM,WAAW,UAAU,QAAQ,KAAK,QAAQ;;EAEvD,YACE,SAAS,iBACT,0BACC,QAAQ;;;;;EAKX,mBAAmB;;EAEnB,gBAAgB,gBAAgB,UAAU,UAAU;;UAErC;;WAEN,SAAS;;;;;WAKT;;WAEA,gBAAgB;;WAEhB;;;UAGM;WACN;WACA;WACA;WACA;;WAEA;;WAEA;aAAsB;;WACtB;aACE;aACA;aACA;aACA;;aAEA;eAAuB;;aACvB,uCAEH,UAAU;aACP;eACE;eACA;iBAAmB;;;aAErB;eAAwB;;aACxB;eACE;iBACE;iBACA;;eAEF;eACA;eACA;;;;WAIJ;IACP,aAAa,iBAAiB;eACnB;eACA;eACA;eACA,aAAa;;;WAGjB,aAAa,SACpB;aAGa;aACA;eACE;eACA;;;WAKR;aACE;aACA;aACA;;WAEF;IACP,QAAQ;MACN;MACA;QAAkB;QAAe;;QAC/B;IACJ,WAAW;MACT;MACA;QAAkB;QAAe;;MACjC,QAAQ;QACN;;EAEN,UAAU;EACV,UAAU;EACV,gBACE,aACA;IAAa;;;UAIA,oBACf,kBACA,UAAU,oBAAoB;;WAGrB;WACA;;aAEE;;;;;;;aAOA,sBAAsB;;aAEtB;;aAEA;;aAEA;;;EAGX,SACE,QAAQ,QACR,SAAS,qBAAqB,KAC7B,wBAAwB,QAAQ;;EAEnC,UAAU,QAAQ,QAAQ,MAAM,2BAA2B;;EAE3D,QACE,KAAK,6BACK,eAAe,iBAAiB;;;;;;KAOlC,UAAU,UAClB,oBAAoB,eACpB,KAAK,oBAAoB,gBACzB;UAEa,YAAY;WAClB,QAAQ,UAAU;WAClB,QAAQ;WACR;;WAEA;;WAEA;;KAEC,kBACR;WACW,gBAAgB;;WAChB,gBAAgB;;KAEnB;WACG;;WAEA;WACA;WACA;WACA;WACA;;UAGE,qBACf,UAAU,oBAAoB;WAErB,WAAW;WACX;WACA;WACA,SAAS;WACT,SAAS;WACT;aAAqB;aAAyB;;EACvD,MAAM;WACG;aAAoB,OAAO;aAAe;;WAC1C,MAAM;;;;;EAKf,KAAK,GAAG,+BAA+B,eAAe,QAAQ,KAAK,QAAQ;;EAE3E,QAAQ,cAAc;WACb,WAAW;;UAGL;WACN,MAAM;WACN,SAAS;WACT"}

package/dist/{auth-contracts-bhMN9XB3.d.mts → auth-contracts-bfFZoA5e.d.mts}

@@ -85,7 +85,7 @@ declare class BetterAuthInfrastructureError extends Error {
 }
 declare function getRawCause(error: BetterAuthInfrastructureError): unknown;
 declare namespace auth_tokens_d_exports {
-  export { ACCEPT_PRINCIPALS_METADATA, ACCESS_METADATA, AUTH_ENHANCER, AUTH_INSTANCE_METADATA, DB_HOOK_METADATA, FORWARD_COOKIES_METADATA, FRESHNESS_METADATA, GUARD_CORE, HOOK_METADATA, INSTANCE_REGISTRY, INVOCATION_PARAMS_METADATA, INVOCATION_VALUES, MOUNT_COORDINATOR, PLATFORMS, POLICY_INVOKER, POLICY_RESOLVER, PRINCIPAL_PARAMS_METADATA, PRINCIPAL_READINGS, PRINCIPAL_RESOLVER, READER_CONTEXT, REQUEST_SCOPE, REQUIREMENTS_METADATA, ROUTE_PLANNER, SCOPE_CORE, SKIP_DEFAULT_REQUIREMENTS_METADATA, SKIP_ORIGIN_CHECK_METADATA, TRANSPORTS, TRANSPORT_REGISTRY, USE_BETTER_AUTH_METADATA, WS_CONNECTION_AUTH, getBetterAuthHandleToken, getBetterAuthInstanceToken, getBetterAuthOptionsToken, getBetterAuthServiceToken, getExtensionToken, getPrincipalSourcesToken };
+  export { ACCEPT_PRINCIPALS_METADATA, ACCESS_METADATA, AMBIGUOUS_INVOCATION_VALUE, AUTH_ENHANCER, AUTH_INSTANCE_METADATA, DB_HOOK_METADATA, FORWARD_COOKIES_METADATA, FRESHNESS_METADATA, GUARD_CORE, HOOK_METADATA, INSTANCE_REGISTRY, INVOCATION_PARAMS_METADATA, INVOCATION_VALUES, MOUNT_COORDINATOR, PLATFORMS, POLICY_INVOKER, POLICY_RESOLVER, PRINCIPAL_PARAMS_METADATA, PRINCIPAL_READINGS, PRINCIPAL_RESOLVER, READER_CONTEXT, REQUEST_SCOPE, REQUIREMENTS_METADATA, ROUTE_PLANNER, SCOPE_CORE, SKIP_DEFAULT_REQUIREMENTS_METADATA, SKIP_ORIGIN_CHECK_METADATA, TRANSPORTS, TRANSPORT_REGISTRY, USE_BETTER_AUTH_METADATA, WS_CONNECTION_AUTH, getBetterAuthHandleToken, getBetterAuthInstanceToken, getBetterAuthOptionsToken, getBetterAuthServiceToken, getExtensionToken, getPrincipalSourcesToken };
 }
 declare function getBetterAuthInstanceToken(alias?: string): string;
 declare function getBetterAuthOptionsToken(alias?: string): string;
@@ -124,6 +124,8 @@ declare function getPrincipalSourcesToken(instance: string): symbol;
 declare function getExtensionToken(point: "platforms" | "transports" | "principals", instance: string, index: number): symbol;
 declare const READER_CONTEXT: unique symbol;
 declare const INVOCATION_VALUES: unique symbol;
+/** Stored in place of an invocation value that two contributing policy runs published differently. */
+declare const AMBIGUOUS_INVOCATION_VALUE: unique symbol;
 //#endregion
 //#region src/auth-module.d.ts
 declare class BetterAuthModule {
@@ -156,7 +158,8 @@ interface BridgeHandle {
    * dispatching until another application binds (§10.6). A second bind() from the same owner for the same instance is a no-op that
    * returns the existing registration (NestMicroservice.init() runs lifecycle hooks twice); from the same owner for another instance it
    * throws PLUGIN_SHARED_BETWEEN_INSTANCES (B03). Throws INSTANCE_ALREADY_BOUND if another bootstrapped application is bound; takes over
-   * a never-bootstrapped one (reported, B06) and a closed one (silently).
+   * a never-bootstrapped one (reported, B06) and a closed one (silently). A never-bootstrapped binding it takes over becomes
+   * 'displaced': an application whose init() was still running when another bound fails in onApplicationBootstrap (B06).
    */
   bind(binding: BridgeBinding): {
     close(): void;
@@ -172,8 +175,11 @@ interface BridgeBinding {
   };
   /** The instance this plugin object serves; one plugin object serves one instance (B03). */
   readonly instance: string;
-  /** 'initialized' at bind; the kernel sets 'bootstrapped' in onApplicationBootstrap; close() sets 'closed'. */
-  state: "initialized" | "bootstrapped" | "closed";
+  /**
+   * 'initialized' at bind; the kernel sets 'bootstrapped' in onApplicationBootstrap; close() sets 'closed'; bind() of another
+   * application sets 'displaced' on an 'initialized' binding it takes over.
+   */
+  state: "initialized" | "bootstrapped" | "closed" | "displaced";
   /** View of the kernel's RequestScope; the plugin never owns an AsyncLocalStorage. [C] */
   current(): ScopeView | undefined;
   /** Credential header names declared by the instance's principal sources (credential matching, §7.5). */
@@ -223,10 +229,15 @@ interface ScopeState {
   readonly plan?: RoutePlan;
   readonly reading?: () => PrincipalReading;
 }
+/** A requirement's decision and the invocation values of the policy runs that produced an allow. */
+interface DecisionOutcome {
+  readonly decision: AuthorizationDecision;
+  readonly published: readonly ReadonlyMap<symbol, unknown>[];
+}
 interface RequestState {
   readonly principal: Map<string, Promise<PrincipalResult>>;
   readonly policyIo: Map<string, Promise<unknown>>;
-  readonly decisions: Map<string, Promise<AuthorizationDecision>>;
+  readonly decisions: Map<string, Promise<DecisionOutcome>>;
   readonly values: Map<symbol, unknown>;
   readonly authorizationCalls: Set<string>;
   readonly origins: Map<string, Promise<AuthFailure | null>>;
@@ -250,7 +261,7 @@ declare class RequestScope {
     sourceSet: string;
   }, compute: () => Promise<PrincipalResult>): Promise<PrincipalResult>;
   memoPolicyIo<T>(request: object, instance: string, concreteKey: string, compute: () => Promise<T>, limit?: number | false): Promise<T>;
-  memoDecision(invocation: object, instance: string, concreteKey: string, compute: () => Promise<AuthorizationDecision>): Promise<AuthorizationDecision>;
+  memoDecision(invocation: object, instance: string, concreteKey: string, compute: () => Promise<DecisionOutcome>): Promise<DecisionOutcome>;
   valueKey(instance: string, key: symbol): symbol;
   surfaced(key: object, error: object, context: {
     instance: string;
@@ -663,6 +674,7 @@ type AuthHookContext<P extends string = string> = Omit<import("better-auth").Hoo
 };
 type AuthAfterHookContext<P extends string = string> = AuthHookContext<P>;
 type DbHooks = NonNullable<import("better-auth").BetterAuthOptions["databaseHooks"]>;
+/** The SDK's own hook signature for a target, independent of the registered instance. Internal to the dispatcher. */
 type DbHookFn<E extends DatabaseHookTarget, Ph extends "before" | "after"> = E extends `${infer M extends keyof DbHooks & string}.${infer O extends "create" | "update" | "delete"}` ? NonNullable<NonNullable<NonNullable<DbHooks[M]>[O]>[Ph]> : never;
 /** Best effort: the registered instance's additional user/session fields, Partial for updates; nothing when not derivable. */
 type RegisteredRow<M> = M extends "user" ? UserOf<RegisteredAuth> : M extends "session" ? SessionOf<RegisteredAuth> extends {
@@ -1663,4 +1675,4 @@ interface PolicyBootContext {
 }
 //#endregion
 export { PrincipalDelegation as $, ErrorMappingOptions as $n, SESSION_PRINCIPAL_KIND as $t, DatabaseHookTarget as A, BetterAuthService as An, GetSessionWithHeaders as At, HookOptions as B, WS_CONNECTION_AUTH as Bn, UnvalidatedBody as Bt, ConformanceCase as C, defineHttpPlatform as Cn, AuthPrincipal as Ct, CookieForwardingOptions as D, allow as Dn, DatabaseHookMethod as Dt, ConformanceSkip as E, BetterAuthGuard as En, DatabaseHookData as Et, ExtensionDefinition as F, BetterAuthModule as Fn, Register as Ft, InboundAuthRequest as G, AuthErrorBody as Gn, betterAuthCorsOrigin as Gt, HttpMountOptions as H, getBetterAuthInstanceToken as Hn, WithActiveOrganization as Ht, ExtensionRef as I, GUARD_CORE as In, RegisteredAuth as It, PlatformMountContext as J, AuthFailures as Jn, definePrincipalSource as Jt, InvocationLineage as K, AuthErrorCode as Kn, absent as Kt, FastifyPlatformOptions as L, POLICY_INVOKER as Ln, RegisteredInstances as Lt, DbHookOptions as M, InstanceLookup as Mn, OrgPermissions as Mt, DefaultInstanceCheck as N, EXTENSION_DEFINITION as Nn, PrincipalKind as Nt, CookieSink as O, definePolicy as On, DatabaseHookResult as Ot, ExpressPlatformOptions as P, UPGRADE_REQUEST as Pn, PrincipalOfKind as Pt, PolicyRef as Q, BetterAuthInfrastructureError as Qn, RequireFreshSession as Qt, GuardReach as R, PRINCIPAL_RESOLVER as Rn, SessionOf as Rt, ClaimOptions as S, defineExtension as Sn, AuthOf as St, ConformanceRunner as T, BetterAuthScopeInterceptor as Tn, AuthUser as Tt, HttpPlatform as U, getBetterAuthOptionsToken as Un, PrincipalKinds as Ut, HookPredicate as V, getBetterAuthHandleToken as Vn, UserOf as Vt, HttpRequestAccessor as W, getBetterAuthServiceToken as Wn, httpTransport as Wt, PolicyBootContext as X, AuthTransportErrorPayload as Xn, CurrentSession as Xt, PlatformPrepareContext as Y, AuthGraphqlExtensions as Yn, rejected as Yt, PolicyInvoker as Z, BetterAuthConfigurationError as Zn, CurrentUser as Zt, BetterAuthRuntimeOptions as _, allOf as _n, TransportValidationContext as _t, AuthHandlerInterceptor as a, BeforeAuth as an, ProxyTrust as at, BootAdviceContext as b, definePrincipalParam as bn, AuthHookContext as bt, AuthTransport as c, ForwardAuthCookies as cn, RequirementOptions as ct, AuthorizationLimits as d, Require as dn, ScopeInit as dt, freshSession as en, getRawCause as er, PrincipalReading as et, AuthorizationPolicy as f, RequireAuth as fn, SessionOption as ft, BetterAuthModuleOptions as g, UseBetterAuth as gn, TransportKit as gt, BetterAuthModuleAsyncOptions as h, UseAuthInstance as hn, TransportCall as ht, AuthHandle as i, AfterDatabase as in, PrincipalSource as it, DbHookMethodDecorator as j, TransportRegistry as jn, IsRegistered as jt, CorsOriginOptions as k, deny as kn, EndpointPath as kt, AuthorizationContext as l, OptionalAuth as ln, ResolutionRequest as lt, BetterAuthFactoryResult as m, SkipOriginCheck as mn, StaticOptionMustBePassedToForRootAsync as mt, ApplicationRouteDescriptor as n, AcceptPrincipals as nn, isConfigurationError as nr, PrincipalResolver as nt, AuthPrincipalBase as o, BeforeDatabase as on, Requirement as ot, BetterAuthAppOptions as p, SkipDefaultRequirements as pn, SessionPrincipalOptions as pt, OriginCheckOptions as q, AuthFailure as qn, authenticated as qt, AuthContextView as r, AfterAuth as rn, isInfrastructureError as rr, PrincipalResult as rt, AuthRouteBinding as s, CurrentPrincipal as sn, RequirementExpr as st, AdvisedHandler as t, sessionPrincipal as tn, isAuthFailure as tr, PrincipalRequest as tt, AuthorizationDecision as u, Public as un, RoutePlan as ut, BetterAuthStaticOptions as v, anyOf as vn, AdminPermissions as vt, ConformanceOutcome as w, defineTransport as wn, AuthSession as wt, BrowserExposure as x, requirement as xn, AuthLike as xt, BootAdvice as y, defineInvocationParam as yn, AuthAfterHookContext as yt, HookMethodDecorator as z, SCOPE_CORE as zn, SessionPrincipal as zt };
-//# sourceMappingURL=auth-contracts-bhMN9XB3.d.mts.map
+//# sourceMappingURL=auth-contracts-bfFZoA5e.d.mts.map

package/dist/auth-contracts-bfFZoA5e.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-contracts-bfFZoA5e.d.mts","names":[],"sources":["../src/auth-errors.ts","../src/auth-tokens.ts","../src/auth-module.ts","../src/bridge-protocol.ts","../src/request-scope.ts","../src/origin-check.ts","../src/instance-registry.ts","../src/mount-coordinator.ts","../src/principal-readings.ts","../src/policy-resolver.ts","../src/transport-registry.ts","../src/route-planner.ts","../src/auth-service.ts","../src/authorization-evaluator.ts","../src/auth-guard.ts","../src/auth-scope-interceptor.ts","../src/auth-module-definition.ts","../src/auth-decorators.ts","../src/session-principal.ts","../src/principal-resolver.ts","../src/auth-exchange.ts","../src/http-transport.ts","../src/index.ts","../src/auth-types.ts","../src/auth-contracts.ts"],"mappings":";;;;;;;KAoBY;;UAGK;WACN;WACA,MAAM;WACN;WACA;WACA;WACA,UAAU;;UAGJ;EACf;EACA;EACA,MAAM;EACN;EACA;;UAGe;EACf,MAAM;EACN;EACA;;UAGe;EACf;EACA;EACA,MAAM;EACN;EACA;;UAGe;EACf,OACE,SAAS,aACT,SAAS,kBACT;EAEF;;iBAQc,cAAc,iBAAiB,SAAS;iBAIxC,sBACd,iBACC,SAAS;iBAII,qBACd,iBACC,SAAS;iBAqDH,UAAU;EACjB;EACA;EACA;EACA;EACA;IACE;cA6BS;EACX,gBAAe,mBAAoB;EAGnC,iBAAQ;EACR,UAAS,gBAAe,mBAAqB;EAG7C,aAAY,iBAAkB;;cA4BnB,qCAAqC;WACvC;WACA;WACA;WACA;WACA;WACA;aACP;aACA;aACA;;WAEO,kBAAkB;EAE3B,YAAY,cAAc,gBAAgB;SAUnC,UACL,cACA,gBACA;IAAY;IAAe;MAC1B;;cAeQ,sCAAsC;WACxC,OAAO;WACP;aACP;aACA;aACA;;EAGF,YAAY,gBAAgB;IAAY;;;iBAmD1B,YAAY,OAAO;;;;iBC1SnB,2BAA2B;iBAI3B,0BAA0B;iBAI1B,0BAA0B;iBAI1B,yBAAyB;cAK5B;cAGA;cAGA;cAGA;cAGA;cAGA;cAGA;cAGA;cACA;cACA;cAGA;cAGA;cACA;cACA;cACA;cAGA;cAGA;cAGA;cAGA;cAGA;cAGA;cAGA;cAGA;cAGA;cAGA;cACA;cAGA;;cAEA;iBAIG,yBAAyB;iBAMzB,kBACd,kDACA,kBACA;cAOW;cAGA;;cAIA;;;cC3GA;SACJ,QAAQ,UAAU,WAAW,gBAClC,SAAS,wBAAwB,KAC/B;IAAyB;MAAqB,qBAAqB,KACpE;SACI,QAAQ,UAAU,UACvB,SAAS,wBAAwB;IAAO;MAAiB,eACxD;SAWI,aAAa,UAAU,WAAW,gBACvC,SAAS,6BAA6B,KACpC;IAAyB;MAC1B;SACI,aAAa,UAAU,UAC5B,SAAS,6BAA6B;IAAO;MAAiB,eAC7D;;;;cC/BQ;cAGA;UAII;WACN;WACA;;WAEA;;WAEA;;;;;;;;;EAST,KAAK,SAAS;IAAkB;IAAe;;;EAE/C,mBAAmB;;UAEJ;;WAEN;aAAkB;;;WAElB;;;;;EAKT;;EAEA,WAAW;;WAEF;WACA,iBAAiB;WACjB,gBAAgB;WAChB,UAAU,YAChB,KAAK;aACK,iBAAiB,mBAAmB;aACpC,gBAAgB,mBAAmB;;;EAIhD,UAAU;;UAEK;;WAEN,SAAS;WACT;WACA,gBAAgB;WAChB;;;;;;;WAOA,sBAAsB,cAAc;;;WAGpC,uBAAuB;;UAEjB;;;;;;;;EAQf,QAAQ,KAAK,qBAAqB,OAAO;EACzC,IAAI,KAAK,sBAAsB;;;;UClEhB;WACN,MAAM;WACN,OAAO;WACP,OAAO;WACP,gBAAgB;;;UAGV;WACN,UAAU;WACV,oBAAoB;;UAEd;WACN,WAAW,YAAY,QAAQ;WAC/B,UAAU,YAAY;WACtB,WAAW,YAAY,QAAQ;WAC/B,QAAQ;WACR,oBAAoB;WACpB,SAAS,YAAY,QAAQ;WAC7B,UAAU;WACV,aAAa;IAGlB,OAAO,QAAQ;MAAmB;;IAClC;;;cAmCO;;EAOX,IAAI,GAAG,OAAO,YAAY,UAAU,IAAI;EAIxC,KAAK,GAAG,UAAU,IAAI;EAItB,WAAW;EAIX,SAAS,cAAc;EAkBvB,cACE,MAAM,KAAK,yDACX;IACE;IACA;IACA;KAEF,eAAe,QAAQ,mBACtB,QAAQ;EAqCX,aAAa,GACX,iBACA,kBACA,qBACA,eAAe,QAAQ,IACvB,yBACC,QAAQ;EA0BX,aACE,oBACA,kBACA,qBACA,eAAe,QAAQ,mBACtB,QAAQ;EAWX,SAAS,kBAAkB;EAc3B,SACE,aACA,eACA;IAAW;IAAkB;IAAc,UAAU;;;;;;cCxL5C;;mBAOQ;EADnB,YACmB;IACf,KAAK;IACL,MAAM;;EAIV,OACE,kBACA,SAAS,aACT,SAAS,SACT;EA6BF,gBACE,kBACA,SAAS,SACT;;UAWa;WACN;WACA,SAAS;WACT,UAAU;WACV,cAAc;WACd;WACA;;cAGE;;mBAKQ;mBACA;EAFnB,YACmB,OAAO,cACP,MAAM;EAKzB,MACE,SAAS,iBACT,0BACC,QAAQ;EAsEL,SAAS,SAAS,kBAAkB;EAkB1C,oBACE,SAAS,iBACT,cACA;UAuBM;UAkBM;;;;UCxLC;WACN;WACA,UAAU;WACV,SAAS,yBAAyB;WAClC,eAAe;WACf,kBAAkB;WAClB,QAAQ;WACR,SAAS;WACT,QAAQ;WACR,QAAQ;WACR;;UAEM;EACf,IAAI,eAAe;EACnB,iBAAiB;;UAEF;WACN;WACA,UAAU;WACV,SAAS,yBAAyB;WAClC,eAAe;WACf,YAAY;WACZ,kBAAkB;WAClB,QAAQ;;cAgBN,4BAA4B;;mBASa;WAN3C,QAAM;WACN,aAAW;EACpB;EACA,SAAS;EACT;IAAU;;EAEV,YAAoD,OAAO;EAE3D,SACE,SAAS,yBAAyB,WAClC,eAAe,yBACf,kBAAkB,mBAClB,YAAY,uBACX;EAiBH,0BAA0B;EAI1B,IAAI,eAAe;EAYnB,iBAAiB;EAIjB,MAAM,SAAS;EAmBT,WAAW,QAAQ,iCAAiC;EAyK1D;;;;cClTW;;WAUyB,MAAM;mBACI;WAVrC,QAAM;EAQf,YACoC,MAAM,iBACI,UAAU,kBAC/B,OAAO;EAMhC,kBAAkB,oBAAoB;MAKlC,YAAY;MAIZ,WAAW;UAIP;EAqDR,cAAc,QAAQ;EAmBtB,QAAQ,QAAQ;EAyEhB,MAAM,mBAAmB;EAMzB,QAAQ,eAAe;EAIvB,qBAAqB;EAIrB,0BAA0B;EAO1B,0BACE,iBAAiB,8BACjB,QAAQ;EAkBJ,SAAS;EAwBf;;;;UChQe;WACN;WACA,OAAO;WACP,UAAU;WACV,OAAO,KAAK;WACZ;WACA;;;cAwEE,4BAA4B;EACvC,YAAY,OAAO;;cAMR;mBACkB;EAA7B,YAA6B,OAAO;EAEpC,OACE,MAAM,KAAK,0CACX,SAAS;EAUX,cAAc,SAAS,mBAAmB,SAAS;EAMnD,UACE,SAAS,mBACT,2BACC;EAWH,KAAK,OAAO,eAAe;EA0E3B,WAAW;EAWX,QAAQ,GACN,SAAS,kBACT;IACE;IACA;IACA;IACA,UAAU,WAAW,kBAAkB;KAEzC,QAAQ,eACP;EAqBH,QACE,OAAO,8BACP,QAAQ,cACR,oBACC,+BAA+B;EAmBlC,MACE,0BACA,kBACA,QAAQ;;;;cC5RC;mBAMkB;mBALZ;EAKjB,YAA6B,WAAW;EAExC,QAAQ,GAAG,WAAW,UAAU,KAAK,oBAAoB;;;;cCJ9C;UACH;mBACS;UACT;EAER,SAAS,qBAAqB;EAI9B,OAAO,KAAK;EAIZ,iBAAiB;EAKjB,iBAAiB,QAAQ,UAAU;EAUnC,KAAK,SAAS,mBAAmB;EAIjC,OAAO,SAAS,mBAAmB;EAWnC,KAAK,MAAM;EAIX,SACE,SAAS,kBACT,YAAS,gBACR;;;;cCsBQ;mBAKQ;mBACA;mBACA;mBALF;EAEjB,YACmB,WAAW,gBACX,UAAU,gBACV,YAAY;UAGvB;EAoGR,eAAe,QAAQ,MAAM,0BAA0B;EAIvD,WAAW,SAAS,mBAAmB;EAiBvC,KAAK,QAAQ,MAAM,iBAAiB;;;;cCrLzB,kBAAkB,UAAU,WAAW;;mBAQJ;mBACJ;mBACK;mBACL;mBACK;mBACD;WAZrC;WACA,UAAU;WACV,KAAK;EAGd,YACuC,SAAS,yBAAyB,IAC3B,UAAU,kBACd,OAAO,cACF,UAAU,mBACf,SAAS,cACJ,YAAY,mBACb,aAAa;EAiB3D,WAAW,QAAQ,QAAQ;EAI3B;aAEe;aACA;aACA;;EAcf,gBAAgB,QAAQ;EAUxB,cAAc,QAAQ,UAAU;EAIhC,aAAa,SAAS,mBAAmB;EAiBzC,YAAY,2BAA2B;EA0BvC,sBAAsB,GAAG,UAAU,QAAQ,KAAK,QAAQ;EA0BxD,eAAe,GAAG,UAAU,QAAQ,KAAK,QAAQ;EAiBjD,gBAAgB,GAAG,UAAU,QAAQ,KAAK,QAAQ;;;;cCrJvC,aAAY;cACZ,OAAI;EACf;EACA;EACA;EACA;MACE;iBACY,aAAa,GAAG,UAAU,gBAAgB,eACxD,QAAQ,oBAAoB,GAAG,gBAAgB,OAC7C,QAAQ,GAAG,UAAU,uBAAuB,YAAY;cAY/C;mBAIQ;mBACA;mBACA;mBACA;mBANF;EAEjB,YACmB,UAAU,gBACV,SAAS,eACT,UAAU,mBACV,OAAO;EAGpB,SACJ,MAAM,WACN,WAAW,eACX,MAAM,eACN,OAAO,eACP,WAAW,kBACX,oBACC,QAAQ;;;;cC3CA,2BAA2B;mBAKC;mBAJtB;YACP;EAEV,YACuC,MAAM,KAAK;EAGlD,YAAY,SAAS,mBAAmB;;cAI7B,qBAAqB;mBAEb;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;EAPnB,YACmB,WAAW,gBACX,SAAS,cACT,YAAY,mBACZ,UAAU,mBACV,WAAW,wBACX,OAAO,cACP,UAAU;EAGvB,YAAY,SAAS,mBAAmB;;;;cChCnC,sCAAsC;mBAKV;mBAJtB;YACP;EAEV,YACuC,MAAM,KAAK;EAGlD,UAAU,SAAS,kBAAkB,MAAM,cAAc;;cAI9C,qBAAqB;mBAEb;mBACA;mBACA;mBACA;mBACA;EALnB,YACmB,WAAW,gBACX,SAAS,cACT,YAAY,mBACZ,OAAO,cACP,UAAU;EAG7B,UAAU,SAAS,kBAAkB,MAAM,cAAc;;;;iBCc3C,gBAAgB,GAC9B,YAAY,KAAK,oBAAoB,WAAW,wBAC/C,oBAAoB;iBAGP,mBAAmB,UAAU,cAAc,UAAU,IAAI;iBAGzD,gBAAgB,UAAU,eAAe,WAAW,IAAI;;;cCtB3D,uCAAM,uBAAA;cACN,6CAAY,uBAAA;cAEZ,cAAW;EAAgB;OAAyB,kBAAA,UAAA,GAAA,QAAA,oBAAA,+BAAA,aAAA,wBAAA;cAKpD,kBAAe,0CAAgB,uBAAA;cAE/B,sBAAgB,iBACP,kBAAkB,8CAAgB,uBAAA;cAE3C,wDAAuB,uBAAA;cAEvB,qBAAkB,+CAAA,uBAAA;cAElB,gDAAe,uBAAA;cAEf,sBAAa,kBAAA,UAAA,GAAA,QAAA,oBAAA,+BAAA,aAAA,wBAAA;iBAMV,WACX,uBAAuB,oBACzB,iBAAiB;cAeP,WAAK,uBACU,sBACzB;cACU,WAAK,uBACU,sBACzB;cACU,cAAe,GAAC,QACnB,UAAU,IAAE,QACZ,GAAC,UACC,uBACT,YAAY;cAyEF,wBAAuB;iBACpB,qBAAqB,UAAU,eAAe,GAAG;WACtD,MAAM;WACN;WACA,UAAU,WAAW,gBAAgB,OAAO;UAC7C;iBAGM,sBACd,cACA;WAAiB;UACV;cA2HI,mBAAoB,UAAU,8BAA4B,QAC7D,aAAa,MAAM,eAAa,UAC9B,gBACT,oBAAoB;cACV,kBAAmB,UAAU,8BAA4B,QAC5D,aAAa,MAAM,eAAa,UAC9B,gBACT,oBAAoB;cAqBV,iBAAkB,UAAU,oBAAkB,QACjD,GAAC,UACC,kBACT,sBAAsB;cAEZ,gBAAiB,UAAU,oBAAkB,QAChD,GAAC,UACC,kBACT,sBAAsB;;;cC1TZ;cACA,sBAAc;cAKd,mBAAW;iBAgBR,iBAAiB,IAAI,aACnC,UAAS,wBAAwB,KAChC,gBAAgB,iBAAiB;cAuLvB,eAAY;EACZ;MACV;EAAc;;cAIJ,sBAAmB;EAC9B;MACE,iBAAiB;;;cCvNR,wBAAyB,UAAU,mBAAiB,QACvD,gBAAgB,OACvB,gBAAgB;cACN,gBAAiB,UAAU,mBAAiB,WAC5C,MACV,gBAAgB;cACN,cAAa;cACb,WAAQ,SAAa,gBAAc;;;;iBCiShC,qBACd,MAAM,UACN,UAAU,qBAEV,4BACA,KAAK,KAAK,cAAc;;;iBC3IV,iBAAiB,aAAa;;;;UCpL7B;EACf,SAAS;;;;;UCIM;EACf,QAAQ,SAAS,UAAU,QAAQ;EACnC;IACE,WAAW;MACT,SAAS;MACT;QAAU;QAA8B;;MACxC;QACE;;EAEN,UAAU;;;UAGK;WACN,UAAU;WACV;;;UAKM;KACL,eAAe;EAAmB,MAAM;;KACxC,iBAAiB;EAAmB,YAAY,UAAU;IAClE,IACA;KACQ,sBAAsB;EAChC,iBAAiB,UAAU,eAAe;IAExC,IACA;KACQ,OAAO,gCAAgC,sBAC/C,iBACA,gBAAgB,sBACd,oBAAoB,KACpB;;KAGD;EACH,+BAA+B;EAC/B,4BAA4B;;KAElB,UAAU,KAAK;EAAY;IAAU,eAAe;;IAC5D,YAAY,KACZ;KACQ,OAAO,KAAK,UAAU;EAAa,YAAY;IAAM;KACrD,YAAY,gCAAgC,UAAU,OAAO;KAC7D,SAAS,gCAAgC,OAAO,OAAO;KACvD,UAAU,KAAK;EAAY;IAAQ;;;KAG1C,OAAO,KAAK,YAAW,WAAW,kBAClC,YAAY;EAAe,aAAa;KACvC,YAAY;KAGb,cAAc,GAAG,oBAAoB;EACxC,QAAQ,KAAK,UAAU;IAErB,OAAO;EAAa,oBAAoB;IACtC,YAAY;KAGN,iBAAiB,gCAC3B,4BACI,cAAc,OAAO,2BACrB;KACM,eAAe,gCACzB,4BACI,cAAc,OAAO,uBACrB;KAID,MAAM,KAAK;EAAY,WAAW;IAAQ;KACnC,aAAa,IAAI,qBAC1B,WAAW,MAAM,KAAK,MAAM,GAAG;EAAa,YAAY;IACrD,mBAEE,MAAM;KACT,WAAW,kBAAkB,IAAI,qBACnC,WAAW,MAAM,KAAK,MAAM,GAAG;EAAa,MAAM;IAAM,MAAM,GAAG,oBAC5D,MAAM;KACT,OAAO,qBAAqB,WAAW,gCAExC,OAAO,WAAW;;;;;KAKV,gBAAgB,MAAM,+BAE9B,+BACc,WAAW,kBAAiB,SAAS;KAE3C,gBAAgB,6BAA6B,2BACjC;EAElB,MAAM;EAAG,qBAAqB,cAAc,gBAAgB,OAAO;;KAC7D,qBAAqB,6BAC/B,gBAAgB;KAIb,UAAU,kCACS;;KAGZ,SACV,UAAU,oBACV,iCACE,mBAAmB,gBAAgB,0BAA0B,6CAC7D,YAAY,YAAY,YAAY,QAAQ,IAAI,IAAI;;KAGnD,cAAc,KAAK,mBACpB,OAAO,kBACP,sBACE,UAAU;EAA0B,eAAe;IACjD;KAGH,YAAY,UAAU,sBACzB,mBAAmB,WAAW,OACzB,cAAc,sBACb,uBACA,qBACE,QAAQ,cAAc,MACtB,cAAc,KAClB;;KAEM,iBACV,UAAU,oBACV,4CACE,WAAW,SAAS,GAAG,UAAU,YAAY;;KAErC,mBACV,UAAU,oBACV,iCACE,QAAQ,WAAW,SAAS,GAAG;KACvB,mBACV,UAAU,oBACV,kCAEA,MAAM,iBAAiB,GAAG,KAC1B,2BAA2B,8CACxB,mBAAmB,GAAG,MAAM,QAAQ,mBAAmB,GAAG;;KAGnD,uBAAuB,KAAK;EACtC;IAAW;;;KAID,sBAAsB;KACtB,gBAAgB,eAAe;KAC/B,gBAAgB,UAAU,iBAAiB,eAAe;UACrD,iBAAiB,IAAI,qBAAqB;WAChD;WACA,SAAS;;;;UC9HH;;EAEf,qBAAqB,aAAa;;EAElC,sBAAsB,aAAa;;KAEzB;WACD;WACA;;;UAIM;;EAEf;;EAEA;;;;;EAKA;;;;;;;EAOA;;EAEA,sBAAsB,aAAa;;;KAIzB,yBAAyB,UAAU,WAAW;;EAExD,MAAM;;EAEN;;;;;;;;EAQA,+BAA+B;;EAE/B,OAAO;;EAEP,UAAU;;EAEV,cAAc;;EAEd,SAAS;;EAET,SAAS;;EAET;IACE,cAAc;UAED;;;;;;EAMf;;UAGe;;;;;;;;;EASf;;UAGe;;;;;EAKf;;;;;;;;EAQA;;;KAIU,cAAc,UAAU,YAClC,UAAU,UAAU;EACd,UAAU,wBAAwB,UAAU;;EAE5C,UACK,wBAAwB,UAAU;IACjC,SAAS,GAAG,UAAU;;;UAKnB,wBAAwB;;EAEvC,UAAU,SAAS;;EAEnB;;;;;;;EAOA;;UAGe;;EAEf;;EAEA;;EAEA,kBAAkB;;EAElB;;;;;;EAMA;;EAEA;;KAGU,0BACV;WACW,SAAS;WACT;WACA;GAEX,OAAO,UAAU,YAAY,QAAQ,cAClC,QAAQ;KAED,wBAAwB,UAAU,YAC5C,0BAA0B,yBAAyB;UAEpC,6BAA6B,UAAU,kBAC9C;EACR,UAAU;EACV,mBAAmB,iBAAiB;EACpC,gBACK,gBACA,wBAAwB,KAAK,QAAQ,wBAAwB;;;KAIxD,wBAAwB,UAAU,YAC5C,yBAAyB,QACtB,YAAY,0BACX,yBAAyB,uCAAuC;UAErD,uCAAuC;WAC7C,aAAa;;;KAGZ,qBAAqB,KAAK,4BAClC,UAAU;EAEN,MAAM;;;KAKF,aAAa,KAAK,KAAK,KAAK,IAAI,oBAAoB;UAC/C,oBAAoB;YACzB;WACD;aACM,UAAU,KAAK;;aAEf,gBAAgB,gBAAgB,IAAI,QAAQ;aAC5C,kBAAkB;;aAElB,aAAa,eAAe;;WAClC,qBAAqB;WACrB,UAAU;;WAEV,mBAAmB;;UAGb;WACN;;;;;;;WAOA;;WAEA;;;;;WAKA,uBAAuB;;WAEvB;;;;;;WAMA;;WAEA;;WAEA,SAAS;;WAET;aACE;aACA;;;;;;;WAOF;;WAEA;;WAEA;WACA;;KAKC,oBACR;WACW;;WACA;;;;;;UAME;EACf,QACE,MAAM,eACN,SAAS,oBACR,QAAQ;;UAEI;WACN,MAAM;WACN;;WAEA,SAAS;;WAET;;;;;;WAMA;aAAwB;;;;UAIlB;EACf,OAAO,GACL,QAAQ,oBAAoB,SAC5B,QAAQ,GACR,SAAS,uBACR,QAAQ;;UAGI;WACN;;WAEA,sBAAsB;;WAEtB;;UAGM;;EAEf;;EAEA;;EAEA;;EAEA;;UAEe;EACf;EACA;;KAEU,iBAAiB,KAAK;;;;;KAKtB,oBAAoB,qBAC9B,WAAW,KAAK,gBAAgB,gBAEhC,gBACA,sBACA,YAAY,wBAAwB;;KAG1B,sBACV,UAAU,oBACV,kCACG,UAAU,mBAAmB,GAAG,KACnC,gBACA,sBACA,YAAY,wBAAwB;KAE1B;UAGK;;EAEf;;UAae;;EAEf,YAAY,KAAK;IAAoB;;;UAGtB;;EAEf,YAAY;IAAW;IAAa,KAAK;;;UAiJ1B;WACN;WACA;;WAEA;;;;;EAKT,OAAO,QAAQ;;;UAIA;WACN;;;KAKC,4BAA4B;UAEvB;EACf,SAAS,cAAc;;;;;EAKvB,GAAG,cAAc,KAAK,sBAAsB;;UAG7B;WACN;;WAEA;WACA;WACA;;UAEM;WACN;WACA,MAAM;;WAEN,SAAS;;WAET;WACA;;WAEA;aACE;aACA;;;WAGF,mBAAmB;WACnB;aACE;aACA;;WAEF,kBAAkB,KACzB;;WAIO,mBAAmB,KAAK;;UAElB;WACN,MAAM;;WAEN;;WAEA;;UAGM;;WAEN;;;;;;WAMA;aACE;aACA;;;EAGX,SAAS,SAAS;;;;;;;;;EASlB,SAAS,KAAK;;;;;;;EAOd,MAAM,KAAK,8BAA8B;;WAEhC,UAAU;;EAEnB,YAAY,SAAS,sBAAsB;;EAE3C,UAAU,SAAS;;;;;EAKnB,mBACE,iBAAiB,8BACjB,mBAAmB;;EAGrB,QACE,KAAK,6BACK,eAAe,iBAAiB;;UAG7B;;WAEN;;WAEA;;WAEA;;WAEA;;UAGM;;;;;;WAMN;WACA;;UAGM;WACN,SAAS;WACT,QAAQ;;EAEjB,MAAM,mBAAmB;;UAGV;WACN,SAAS;WACT,QAAQ;WACR,SAAS;;UAGH;WACN;;WAEA;WACA;;WAEA;;EAET,QAAQ;;;;;EAKR,OAAO,SAAS,qBAAqB,QAAQ;;EAE7C,mBAAmB;;UAGJ;WACN;;WAEA;;WAEA,SAAS;;WAET,MAAM,aAAa,eAAe;;WAElC;;WAEA;;WAEA,SAAS;;UAGH;;;;;;EAMf,UAAU;;;;;;;;EAQV,OAAO;;EAEP,IAAI;;EAEJ,QAAQ,eAAe;;EAEvB,QAAQ;aAA0B;aAAyB;;;EAE3D,SAAS;;EAET,MAAM,cAAc;;EAEpB,WAAW,cAAc,eAAe;;EAExC,aAAa;;UAGE;;EAEf,OAAO;;UAGQ;;WAEN;;;;;EAKT,QAAQ,SAAS;;;;;;EAMjB,SAAS,SAAS,kBAAkB,KAAK,eAAe;;EAExD,YAAY,SAAS,aAAa,SAAS;;;;;;;;EAQ3C,qBACE,OAAO,gCAAgC,8BACvC,SAAS,kBACT;aAAiB;;;;;;EAMnB,UAAU,KAAK,oCAAoC;;;;;;;;EASnD,kBAAkB,QAAQ,UAAU;;;;;;;EAOpC,SAAS,SAAS,mBAAmB;;WAE5B;aAAsB;;;EAE/B,QACE,KAAK,6BACK,eAAe,iBAAiB;;UAG7B;;;;;WAKN;;;;;;;;;;WAUA;;WAEA;;WAEA;;;;;;WAMA,UAAU;;;;;;EAMnB,WAAW;;WAEF;;WAEA,SAAS;;WAET;aAAqB;aAAyB;;;EAEvD,MAAM;;WAEG,UAAU;;UAGJ;;;;;;WAMN;;;;;EAKT,WAAW;;WAEF;;WAEA;;;UAIM;;WAEN;;;;;;;;WAQA;;;;;;;WAOA,YAAY,6BAA6B;;;;;;WAMzC,kBAAkB;;UAGZ;;WAEN,MAAM;;UAGA;WACN,WAAW;WACX,WAAW;WACX,WAAW;WACX;;WAGA,SAAS,QAAQ,UAAU,mBAAmB;;;;;EAKvD,MAEE,QAAQ,UACR,4BACA,OAAO,YACP,SAAS;WAEF,QAAQ;;;;;;;;;KASP;UACK;;WAEN;;WAEA;;WAEA;;WAEA;;;;;WAKA;;UAGM;WACN;;WAEA;;WAEA;;;;;WAKA,aAAa;;UAGP;;EAEf,OAAO,aAAa,SAAS;;WAEpB;;UAGM,gBAAgB,UAAU,oBAAoB;WACpD;;WAEA,gBAAgB;;;;;WAKhB;;;;;WAKA;;WAEA;aACE;aACA;;;;;;;;WAQF;;;;;;WAMA;;;;;WAKA;aACE;aACA;;;EAGX,WAAW,SAAS;;;;;EAKpB,QAAQ,SAAS,mBAAmB,QAAQ,gBAAgB;;EAE5D,QACE,KAAK,6BACK,eAAe,iBAAiB;;KAGlC,gBAAgB,UAAU,oBAAoB;WAC3C;WAAmC,WAAW;;WAC9C;;WACA;WAA8B,SAAS;;UAErC;WACN,SAAS;WACT,SAAS;WACT;WACA;aAAqB;aAAyB;;WAC9C;WACA,MAAM;;EAEf,KAAK,GAAG,+BAA+B,eAAe,QAAQ,KAAK,QAAQ;;;UAI5D,WAAW,UAAU,WAAW;WACtC;WACA,UAAU;WACV,KAAK;EACd,WAAW,QAAQ;EACnB,UAAU,aAAa;;EAEvB,IAAI,GAAG,MAAM,WAAW,UAAU,QAAQ,KAAK,QAAQ;;EAEvD,YACE,SAAS,iBACT,0BACC,QAAQ;;;;;EAKX,mBAAmB;;EAEnB,gBAAgB,gBAAgB,UAAU,UAAU;;UAErC;;WAEN,SAAS;;;;;WAKT;;WAEA,gBAAgB;;WAEhB;;;UAGM;WACN;WACA;WACA;WACA;;WAEA;;WAEA;aAAsB;;WACtB;aACE;aACA;aACA;aACA;;aAEA;eAAuB;;aACvB,uCAEH,UAAU;aACP;eACE;eACA;iBAAmB;;;aAErB;eAAwB;;aACxB;eACE;iBACE;iBACA;;eAEF;eACA;eACA;;;;WAIJ;IACP,aAAa,iBAAiB;eACnB;eACA;eACA;eACA,aAAa;;;WAGjB,aAAa,SACpB;aAGa;aACA;eACE;eACA;;;WAKR;aACE;aACA;aACA;;WAEF;IACP,QAAQ;MACN;MACA;QAAkB;QAAe;;QAC/B;IACJ,WAAW;MACT;MACA;QAAkB;QAAe;;MACjC,QAAQ;QACN;;EAEN,UAAU;EACV,UAAU;EACV,gBACE,aACA;IAAa;;;UAIA,oBACf,kBACA,UAAU,oBAAoB;;WAGrB;WACA;;aAEE;;;;;;;aAOA,sBAAsB;;aAEtB;;aAEA;;aAEA;;;EAGX,SACE,QAAQ,QACR,SAAS,qBAAqB,KAC7B,wBAAwB,QAAQ;;EAEnC,UAAU,QAAQ,QAAQ,MAAM,2BAA2B;;EAE3D,QACE,KAAK,6BACK,eAAe,iBAAiB;;;;;;KAOlC,UAAU,UAClB,oBAAoB,eACpB,KAAK,oBAAoB,gBACzB;UAEa,YAAY;WAClB,QAAQ,UAAU;WAClB,QAAQ;WACR;;WAEA;;WAEA;;KAEC,kBACR;WACW,gBAAgB;;WAChB,gBAAgB;;KAEnB;WACG;;WAEA;WACA;WACA;WACA;WACA;;UAGE,qBACf,UAAU,oBAAoB;WAErB,WAAW;WACX;WACA;WACA,SAAS;WACT,SAAS;WACT;aAAqB;aAAyB;;EACvD,MAAM;WACG;aAAoB,OAAO;aAAe;;WAC1C,MAAM;;;;;EAKf,KAAK,GAAG,+BAA+B,eAAe,QAAQ,KAAK,QAAQ;;EAE3E,QAAQ,cAAc;WACb,WAAW;;UAGL;WACN,MAAM;WACN,SAAS;WACT"}

package/dist/{auth-decorators-BO9T-1wp.mjs → auth-decorators-ChMx4-yk.mjs}

@@ -1,8 +1,8 @@
-import { c as isConfigurationError, n as BetterAuthConfigurationError, t as AuthFailures } from "./auth-errors-B6jLBpQu.mjs";
-import { C as READER_CONTEXT, M as USE_BETTER_AUTH_METADATA, O as SKIP_DEFAULT_REQUIREMENTS_METADATA, T as REQUIREMENTS_METADATA, a as ACCESS_METADATA, b as PRINCIPAL_PARAMS_METADATA, c as DB_HOOK_METADATA, f as HOOK_METADATA, h as INVOCATION_VALUES, i as ACCEPT_PRINCIPALS_METADATA, k as SKIP_ORIGIN_CHECK_METADATA, l as FORWARD_COOKIES_METADATA, m as INVOCATION_PARAMS_METADATA, s as AUTH_INSTANCE_METADATA, u as FRESHNESS_METADATA } from "./decorate-DqI1OKmL.mjs";
-import { t as BetterAuthScopeInterceptor } from "./auth-scope-interceptor-C0NRu4uy.mjs";
-import { t as BetterAuthGuard } from "./auth-guard-CXsQR7Zd.mjs";
-import { t as PrincipalReadings } from "./principal-readings-B2fTGojh.mjs";
+import { c as isConfigurationError, n as BetterAuthConfigurationError, t as AuthFailures } from "./auth-errors-DRTJZxR8.mjs";
+import { A as SKIP_ORIGIN_CHECK_METADATA, E as REQUIREMENTS_METADATA, N as USE_BETTER_AUTH_METADATA, a as ACCESS_METADATA, c as AUTH_INSTANCE_METADATA, d as FRESHNESS_METADATA, g as INVOCATION_VALUES, h as INVOCATION_PARAMS_METADATA, i as ACCEPT_PRINCIPALS_METADATA, k as SKIP_DEFAULT_REQUIREMENTS_METADATA, l as DB_HOOK_METADATA, o as AMBIGUOUS_INVOCATION_VALUE, p as HOOK_METADATA, u as FORWARD_COOKIES_METADATA, w as READER_CONTEXT, x as PRINCIPAL_PARAMS_METADATA } from "./decorate-BNI2A1Ws.mjs";
+import { t as BetterAuthScopeInterceptor } from "./auth-scope-interceptor-A7wq7jBx.mjs";
+import { t as BetterAuthGuard } from "./auth-guard-DUEmz84K.mjs";
+import { t as PrincipalReadings } from "./principal-readings-1hYayp_I.mjs";
 import { SetMetadata, UseGuards, UseInterceptors, applyDecorators, createParamDecorator } from "@nestjs/common";
 import { AsyncLocalStorage } from "node:async_hooks";
 //#region src/request-scope.ts
@@ -219,7 +219,14 @@ function defineInvocationParam(slot, spec) {
 			for (const candidate of candidates) {
 				if (!candidate || typeof candidate !== "object" && typeof candidate !== "function") continue;
 				const values = Reflect.get(candidate, INVOCATION_VALUES);
-				if (values?.get(reading.instance)?.has(slot)) return values.get(reading.instance).get(slot);
+				if (values?.get(reading.instance)?.has(slot)) {
+					const value = values.get(reading.instance).get(slot);
+					if (value === AMBIGUOUS_INVOCATION_VALUE) throw bridge.readings.deliver(BetterAuthConfigurationError.atRequest("AMBIGUOUS_INVOCATION_VALUE", `Requirements of this handler published different values for ${slot.description ?? "an invocation parameter"}`, {
+						site: input.site,
+						hint: "Check one organization per handler, or read the organization from the route instead of the invocation parameter."
+					}), input, reading.instance);
+					return value;
+				}
 			}
 			throw bridge.readings.deliver(BetterAuthConfigurationError.atRequest("NO_INVOCATION_VALUE", spec.missing, { site: input.site }), input, reading.instance);
 		})();
@@ -274,4 +281,4 @@ const AfterDatabase = (target, options) => databaseHook("after", target, options
 //#endregion
 export { memoKey as C, RequestScope as S, anyOf as _, BeforeDatabase as a, readHookMetadata as b, OptionalAuth as c, RequireAuth as d, SkipDefaultRequirements as f, allOf as g, UseBetterAuth as h, BeforeAuth as i, Public as l, UseAuthInstance as m, AfterAuth as n, CurrentPrincipal as o, SkipOriginCheck as p, AfterDatabase as r, ForwardAuthCookies as s, AcceptPrincipals as t, Require as u, defineInvocationParam as v, requirement as x, definePrincipalParam as y };
 
-//# sourceMappingURL=auth-decorators-BO9T-1wp.mjs.map
+//# sourceMappingURL=auth-decorators-ChMx4-yk.mjs.map