@dudousxd/nestjs-authz 0.5.1 → 0.6.0

package/dist/gate.js

@@ -14,12 +14,56 @@ import { ForbiddenException, Inject, Injectable, Optional } from '@nestjs/common
 import { ModuleRef } from '@nestjs/core';
 import { publishAuthzDecision } from './diagnostics.js';
 import { AbilityNotResolvedException, AmbiguousAbilityException } from './errors/exceptions.js';
+import { PermissionCache } from './permission-cache.js';
+import { permissionSatisfied } from './permission-matcher.js';
 import { PolicyRegistry } from './policy-registry.js';
 import { defaultRoleResolver } from './role-provider.js';
+import { normalizeScope, scopeAll, scopeNone, } from './scope.js';
 import { AUTHZ_MODULE_OPTIONS, CONTEXT_ACCESSOR, PERMISSION_PROVIDER, ROLE_PROVIDER, } from './tokens.js';
+/** Normalize a `boolean | PolicyResponse | null | undefined` into a {@link NormalizedResult}. */
+function normalizeResult(value) {
+    if (value == null)
+        return { allowed: undefined };
+    if (typeof value === 'boolean')
+        return { allowed: value };
+    // `exactOptionalPropertyTypes`: only attach `message` when actually present.
+    return value.message === undefined
+        ? { allowed: Boolean(value.allowed) }
+        : { allowed: Boolean(value.allowed), message: value.message };
+}
+/**
+ * Attach `message` to a decision only when defined (honors `exactOptionalPropertyTypes`,
+ * which forbids an explicit `message: undefined` on an optional property).
+ */
+function withMessage(decision, message) {
+    return message === undefined ? decision : { ...decision, message };
+}
+/**
+ * Build the `ForbiddenException` for a denied `authorize(...)`, surfacing the
+ * decision's `reason` (and the policy/hook `message` when present) instead of
+ * discarding it. The message string defaults to the generic `Unauthorized: <ability>`
+ * for backward compatibility; the structured body carries `ability` + `reason` so a
+ * 403 is debuggable by clients and the diagnostics watcher alike.
+ */
+function forbidden(ability, decision) {
+    const message = decision.message ?? `Unauthorized: ${ability}`;
+    return new ForbiddenException({
+        statusCode: 403,
+        error: 'Forbidden',
+        message,
+        ability,
+        reason: decision.reason,
+    });
+}
 // A sentinel marking "no user resolved" distinct from a legitimately-`undefined`
 // user. `forUser(undefined)` explicitly authorizes an anonymous user.
 const NO_USER = Symbol('authz:no-user');
+/**
+ * Key under which the per-request {@link PermissionCache} is stashed on the
+ * nestjs-context store. `Symbol.for` so the same key resolves across copies of
+ * this module (e.g. multiple installs in a monorepo) sharing one store.
+ */
+const REQUEST_PERMISSION_CACHE = Symbol.for('@dudousxd/nestjs-authz:request-permission-cache');
 /**
  * Laravel-style authorization Gate.
  *
@@ -39,6 +83,7 @@ let Gate = class Gate {
     roleProvider;
     gates = new Map();
     superAdmin;
+    after;
     resolveUser;
     roleResolver;
     // Memoized ModuleRef seam lookups. These tokens are singletons bound once at
@@ -57,6 +102,7 @@ let Gate = class Gate {
         this.permissionProvider = permissionProvider;
         this.roleProvider = roleProvider;
         this.superAdmin = options?.superAdmin;
+        this.after = options?.after;
         this.resolveUser = options?.resolveUser;
         this.roleResolver = options?.resolveRoles ?? defaultRoleResolver;
     }
@@ -125,6 +171,36 @@ let Gate = class Gate {
         }
         return this.roleProviderCached;
     }
+    /**
+     * The per-request {@link PermissionCache}, stashed on the nestjs-context store so
+     * every check within one HTTP request shares a single `getPermissions` fetch
+     * (kills the N+1 a list page would otherwise cause). Returns `undefined` when no
+     * context store is available (standalone use), in which case callers fall back to
+     * a transient cache (e.g. one per `allowsMany` batch) or no memoization.
+     */
+    resolveRequestCache() {
+        const context = this.resolveContext();
+        // `get()` is part of the ContextAccessor contract but a stub/partial accessor
+        // may omit it (or it may throw outside a request scope) — degrade to "no
+        // request cache" rather than failing the check.
+        if (!context || typeof context.get !== 'function')
+            return undefined;
+        let store;
+        try {
+            store = context.get();
+        }
+        catch {
+            store = undefined;
+        }
+        if (!store)
+            return undefined;
+        const existing = store[REQUEST_PERMISSION_CACHE];
+        if (existing instanceof PermissionCache)
+            return existing;
+        const cache = new PermissionCache();
+        store[REQUEST_PERMISSION_CACHE] = cache;
+        return cache;
+    }
     /** Register an ad-hoc, model-less gate resolved by `ability` name. */
     define(ability, fn) {
         this.gates.set(ability, fn);
@@ -175,15 +251,46 @@ let Gate = class Gate {
     }
     // --- public API (operates on the current/context user) ---
     async allows(ability, resource) {
-        return this.check(await this.currentUser(), ability, resource);
+        return this.check(await this.currentUser(), ability, resource, this.resolveRequestCache());
     }
     async denies(ability, resource) {
         return !(await this.allows(ability, resource));
     }
     async authorize(ability, resource) {
-        if (!(await this.allows(ability, resource))) {
-            throw new ForbiddenException(`Unauthorized: ${ability}`);
-        }
+        const decision = await this.decide(await this.currentUser(), ability, resource, this.resolveRequestCache());
+        if (!decision.allowed)
+            throw forbidden(ability, decision);
+    }
+    /**
+     * Authorize MANY abilities for the current (context) user in a single pass. The
+     * user is resolved ONCE and a single {@link PermissionCache} is shared across all
+     * items, so a list page (N cards) costs one user resolution + at most one
+     * permission fetch instead of N of each. Order is preserved; each result echoes
+     * its input `ability`/`resource` plus the `allowed` verdict.
+     *
+     * Fault-isolating: an item whose ability is unresolved/ambiguous denies just
+     * THAT item (it does not throw and abort the batch) — a batch is a best-effort
+     * verdict list, not an enforcement gate.
+     */
+    async allowsMany(items) {
+        return this.checkMany(await this.currentUser(), items);
+    }
+    /**
+     * Resolve the QUERY SCOPE constraint for the current (context) user against
+     * `entity` — the `accessibleBy` / Pundit `policy_scope` concept. Returns an
+     * ORM-neutral {@link ScopeConstraint} an adapter (e.g. the TypeORM `applyScope`
+     * helper) turns into a parameterized `WHERE`.
+     *
+     * Consistent with the Gate's single-resource semantics:
+     * - super-admin / before-grant / permission-provider grant → `allow-all`,
+     * - anonymous, or no policy/scope → `deny-all` (default-deny),
+     * - otherwise the policy's `scope` (or `viewAny`-style) constraint.
+     *
+     * `ability` (default `'viewAny'`) names the permission-provider check used for
+     * the allow-all grant and the policy fallback method.
+     */
+    async scope(entity, ability = 'viewAny') {
+        return this.resolveScope(await this.currentUser(), entity, ability);
     }
     // --- coarse role checks (operate on the current/context user) ---
     /** True when the current user holds `role`. */
@@ -197,12 +304,123 @@ let Gate = class Gate {
     // --- internal: used by BoundGate too ---
     /** @internal */
     allowsForUser(user, ability, resource) {
-        return this.check(user, ability, resource);
+        return this.check(user, ability, resource, this.resolveRequestCache());
+    }
+    /** @internal — batch check for an explicit/bound user (see {@link allowsMany}). */
+    allowsManyForUser(user, items) {
+        return this.checkMany(user, items);
+    }
+    /**
+     * Run a batch of checks against one already-resolved user, sharing a single
+     * {@link PermissionCache} so the provider's `getPermissions` runs at most once.
+     * Prefers the per-request cache (so the batch also coalesces with other checks in
+     * the same request); falls back to a transient per-batch cache when standalone.
+     */
+    async checkMany(user, items) {
+        const cache = this.resolveRequestCache() ?? new PermissionCache();
+        const out = [];
+        for (const item of items) {
+            let allowed;
+            try {
+                allowed = await this.check(user, item.ability, item.resource, cache);
+            }
+            catch {
+                // Unresolved/ambiguous ability → deny just this item (don't abort the batch).
+                allowed = false;
+            }
+            out.push(item.resource === undefined
+                ? { ability: item.ability, allowed }
+                : { ability: item.ability, resource: item.resource, allowed });
+        }
+        return out;
+    }
+    /** @internal — used by {@link BoundGate.authorize} to surface the deny reason/message. */
+    decideForUser(user, ability, resource) {
+        return this.decide(user, ability, resource, this.resolveRequestCache());
     }
     /** @internal */
     hasAnyRoleForUser(user, roles) {
         return this.checkRoles(user, roles);
     }
+    /** @internal — used by {@link BoundGate.scope}. */
+    scopeForUser(user, entity, ability = 'viewAny') {
+        return this.resolveScope(user, entity, ability);
+    }
+    /**
+     * Resolve a query-scope constraint for `entity`, mirroring {@link resolveBase}'s
+     * grant order so scoping stays consistent with single-resource decisions:
+     *
+     * 1. super-admin hook grants → `allow-all`;
+     * 2. (authenticated) permission-provider grant for `ability` → `allow-all`;
+     * 3. the policy's `scope` (or `viewAny`-style) method → its constraint;
+     * 4. otherwise (anonymous, no policy, no scope method) → `deny-all`.
+     *
+     * The policy `before` hook is also honored as an allow/deny grant before the
+     * scope method runs, so a policy that broadly allows/denies in `before` scopes
+     * the same way it decides.
+     */
+    async resolveScope(maybeUser, entity, ability) {
+        const user = maybeUser === NO_USER ? undefined : maybeUser;
+        // 1. Global super-admin hook → allow-all (a `false` does not deny here, it
+        //    just falls through, mirroring resolveBase's grant-or-fall-through).
+        const sa = normalizeResult(await this.superAdmin?.(user, ability));
+        if (sa.allowed === true)
+            return scopeAll;
+        // 2. Permission-provider grant for the scope ability → allow-all.
+        if (maybeUser !== NO_USER) {
+            const provider = this.resolvePermissionProvider();
+            if (provider) {
+                if (typeof provider.getPermissions === 'function') {
+                    const cache = this.resolveRequestCache();
+                    const satisfied = cache
+                        ? await cache.satisfies(provider, user, ability)
+                        : await (async () => {
+                            const granted = await provider.getPermissions?.(user);
+                            return granted == null ? undefined : permissionSatisfied(granted, ability);
+                        })();
+                    if (satisfied === true)
+                        return scopeAll;
+                }
+                if ((await provider.hasPermission(user, ability)) === true)
+                    return scopeAll;
+            }
+        }
+        // 3. Policy scope (or viewAny-style fallback) method.
+        const policy = this.policies.forResource(entity);
+        if (policy) {
+            const scopeMethod = this.resolveScopeMethod(policy, ability);
+            if (scopeMethod) {
+                const before = policy.before;
+                if (typeof before === 'function') {
+                    const result = normalizeResult(await before.call(policy, user, ability));
+                    if (result.allowed === true)
+                        return scopeAll;
+                    if (result.allowed === false)
+                        return scopeNone;
+                }
+                // Anonymous users see no rows (default-deny, like the single-resource path).
+                if (maybeUser === NO_USER)
+                    return scopeNone;
+                return normalizeScope(await scopeMethod.call(policy, user, entity));
+            }
+        }
+        // 4. No way to scope → deny-all.
+        return scopeNone;
+    }
+    /**
+     * Pick the policy's scope method: the conventional `scope`, else the `ability`
+     * method (e.g. `viewAny`) when it is scope-shaped. Returns `undefined` when the
+     * policy declares neither.
+     */
+    resolveScopeMethod(policy, ability) {
+        const scope = policy.scope;
+        if (typeof scope === 'function')
+            return scope;
+        const fallback = policy[ability];
+        if (typeof fallback === 'function')
+            return fallback;
+        return undefined;
+    }
     /**
      * Resolve the user's effective roles and test membership against `roles`. Returns
      * `false` for an anonymous (NO_USER) caller and whenever no source yields a role
@@ -238,28 +456,60 @@ let Gate = class Gate {
         }
         return out;
     }
-    async check(maybeUser, ability, resource) {
-        const { allowed, reason } = await this.resolve(maybeUser, ability, resource);
+    async check(maybeUser, ability, resource, cache) {
+        return (await this.decide(maybeUser, ability, resource, cache)).allowed;
+    }
+    /**
+     * Resolve a decision AND publish it for observers. Returns the full decision
+     * (verdict + reason + optional deny message) so {@link authorize} can surface the
+     * `reason`/`message` on the thrown `ForbiddenException`. {@link check} discards
+     * everything but the verdict.
+     */
+    async decide(maybeUser, ability, resource, cache) {
+        const decision = await this.resolve(maybeUser, ability, resource, cache);
         // Emit the decision for observers (e.g. the generic @dudousxd/nestjs-diagnostics-telescope watcher).
         // Loosely coupled via a diagnostics channel — zero-overhead when no subscriber,
         // and a publish failure can never affect the verdict. Only reached decisions are
         // emitted; an unresolved/ambiguous ability throws above and is intentionally silent.
-        publishAuthzDecision(ability, allowed, reason, maybeUser === NO_USER ? undefined : maybeUser, resource);
-        return allowed;
+        publishAuthzDecision(ability, decision.allowed, decision.reason, maybeUser === NO_USER ? undefined : maybeUser, resource);
+        return decision;
     }
     /**
-     * Resolve an ability to a verdict plus the path that decided it. Throws
+     * Resolve an ability to a final verdict, the path that decided it, and an optional
+     * deny message. Runs the global `after` hook over the base decision (see
+     * {@link AfterHook} for override semantics). Throws
      * {@link AbilityNotResolvedException}/{@link AmbiguousAbilityException} when no
-     * decision can be reached (those paths emit no decision).
+     * decision can be reached (those paths emit no decision and skip `after`).
+     */
+    async resolve(maybeUser, ability, resource, cache) {
+        const user = maybeUser === NO_USER ? undefined : maybeUser;
+        const base = await this.resolveBase(maybeUser, ability, resource, cache);
+        // Global `after` hook (Laravel `Gate::after`). It may OVERRIDE only when the
+        // base path produced no explicit verdict (`base.allowed === undefined`);
+        // otherwise it is observe-only. A nullish/void return never changes anything.
+        if (this.after) {
+            const observed = base.allowed; // undefined ⇒ policy/gate had no opinion
+            const after = normalizeResult(await this.after(user, ability, observed, resource));
+            if (observed === undefined && after.allowed !== undefined) {
+                return withMessage({ allowed: after.allowed, reason: 'after' }, after.message);
+            }
+        }
+        // Finalize: a base with "no opinion" (undefined) denies by default.
+        return withMessage({ allowed: base.allowed === true, reason: base.reason }, base.message);
+    }
+    /**
+     * The pre-`after` resolution. `allowed` is `undefined` when the deciding path
+     * (policy method / ad-hoc gate) returned a nullish value — "no opinion" — which
+     * lets the {@link AfterHook} supply a verdict before the default-deny finalize.
      */
-    async resolve(maybeUser, ability, resource) {
+    async resolveBase(maybeUser, ability, resource, cache) {
         const user = maybeUser === NO_USER ? undefined : maybeUser;
         // Global super-admin hook first.
-        const sa = await this.superAdmin?.(user, ability);
-        if (sa === true)
-            return { allowed: true, reason: 'super-admin' };
-        if (sa === false)
-            return { allowed: false, reason: 'super-admin' };
+        const sa = normalizeResult(await this.superAdmin?.(user, ability));
+        if (sa.allowed === true)
+            return withMessage({ allowed: true, reason: 'super-admin' }, sa.message);
+        if (sa.allowed === false)
+            return withMessage({ allowed: false, reason: 'super-admin' }, sa.message);
         // RBAC seam (Laravel/spatie `Gate::before` grant): if a PermissionProvider is
         // registered and the (authenticated) user holds the named permission, grant it.
         // Grant-only — a `false`/`undefined` result falls through to normal resolution,
@@ -267,6 +517,24 @@ let Gate = class Gate {
         if (maybeUser !== NO_USER) {
             const provider = this.resolvePermissionProvider();
             if (provider) {
+                // Wildcard/hierarchical grants: when the provider lists the user's granted
+                // permissions, apply segment-based wildcard matching in the core so a granted
+                // `posts.*` satisfies `posts.update` (and `*` satisfies anything) regardless
+                // of adapter. A nullish list defers to the exact-match `hasPermission` path.
+                if (typeof provider.getPermissions === 'function') {
+                    // Route through the (request- or batch-scoped) PermissionCache when one is
+                    // supplied so the user's granted set is fetched at most once; without a
+                    // cache, fall back to a direct fetch (behavior unchanged).
+                    const satisfied = cache
+                        ? await cache.satisfies(provider, user, ability)
+                        : await (async () => {
+                            const granted = await provider.getPermissions?.(user);
+                            return granted == null ? undefined : permissionSatisfied(granted, ability);
+                        })();
+                    if (satisfied === true) {
+                        return { allowed: true, reason: 'permission-provider' };
+                    }
+                }
                 const granted = await provider.hasPermission(user, ability, resource);
                 if (granted === true)
                     return { allowed: true, reason: 'permission-provider' };
@@ -282,17 +550,19 @@ let Gate = class Gate {
             if (typeof method === 'function') {
                 const before = policy.before;
                 if (typeof before === 'function') {
-                    const result = await before.call(policy, user, ability);
-                    if (result === true)
-                        return { allowed: true, reason: 'policy-before' };
-                    if (result === false)
-                        return { allowed: false, reason: 'policy-before' };
+                    const result = normalizeResult(await before.call(policy, user, ability));
+                    if (result.allowed === true)
+                        return withMessage({ allowed: true, reason: 'policy-before' }, result.message);
+                    if (result.allowed === false)
+                        return withMessage({ allowed: false, reason: 'policy-before' }, result.message);
                 }
                 // Anonymous users are denied unless a hook granted access above.
                 if (maybeUser === NO_USER)
                     return { allowed: false, reason: 'anonymous' };
-                const allowed = Boolean(await method.call(policy, user, resource));
-                return { allowed, reason: 'policy' };
+                const result = normalizeResult((await method.call(policy, user, resource)));
+                // A nullish policy return is "no opinion" → leave `allowed` undefined so
+                // an `after` hook may decide; otherwise it default-denies in `resolve`.
+                return withMessage({ allowed: result.allowed, reason: 'policy' }, result.message);
             }
         }
         // Fall back to an ad-hoc gate.
@@ -300,7 +570,8 @@ let Gate = class Gate {
         if (gate) {
             if (maybeUser === NO_USER)
                 return { allowed: false, reason: 'anonymous' };
-            return { allowed: Boolean(await gate(user, resource)), reason: 'gate' };
+            const result = normalizeResult((await gate(user, resource)));
+            return withMessage({ allowed: result.allowed, reason: 'gate' }, result.message);
         }
         throw new AbilityNotResolvedException(ability);
     }
@@ -357,10 +628,18 @@ export class BoundGate {
     async denies(ability, resource) {
         return !(await this.allows(ability, resource));
     }
+    /** Batch-authorize many abilities for the bound user in one pass (see {@link Gate.allowsMany}). */
+    allowsMany(items) {
+        return this.gate.allowsManyForUser(this.user, items);
+    }
+    /** Resolve the query-scope constraint for the bound user (see {@link Gate.scope}). */
+    scope(entity, ability = 'viewAny') {
+        return this.gate.scopeForUser(this.user, entity, ability);
+    }
     async authorize(ability, resource) {
-        if (!(await this.allows(ability, resource))) {
-            throw new ForbiddenException(`Unauthorized: ${ability}`);
-        }
+        const decision = await this.gate.decideForUser(this.user, ability, resource);
+        if (!decision.allowed)
+            throw forbidden(ability, decision);
     }
     /** True when the bound user holds `role`. */
     hasRole(role) {

package/dist/gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"gate.js","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAa,MAAM,gBAAgB,CAAC;AAC7F,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAA4B,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAClF,OAAO,EAAE,2BAA2B,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAEhG,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAwC,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC/F,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,GACd,MAAM,aAAa,CAAC;AAWrB,iFAAiF;AACjF,sEAAsE;AACtE,MAAM,OAAO,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;AAGxC;;;;;;;;;;GAUG;AAEI,IAAM,IAAI,GAAV,MAAM,IAAI;IAiBI;IAMA;IAEA;IAGA;IAGA;IA9BF,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IAClC,UAAU,CAA6B;IACvC,WAAW,CAAoC;IAC/C,YAAY,CAAe;IAE5C,6EAA6E;IAC7E,4EAA4E;IAC5E,mEAAmE;IAC3D,eAAe,GAAG,KAAK,CAAC;IACxB,aAAa,CAA8B;IAC3C,0BAA0B,GAAG,KAAK,CAAC;IACnC,wBAAwB,CAAiC;IACzD,oBAAoB,GAAG,KAAK,CAAC;IAC7B,kBAAkB,CAA2B;IAErD,YACmB,QAAwB,EAGzC,OAAuC,EAGtB,OAAyB,EAEzB,SAAqB,EAGrB,kBAAuC,EAGvC,YAA2B;QAd3B,aAAQ,GAAR,QAAQ,CAAgB;QAMxB,YAAO,GAAP,OAAO,CAAkB;QAEzB,cAAS,GAAT,SAAS,CAAY;QAGrB,uBAAkB,GAAlB,kBAAkB,CAAqB;QAGvC,iBAAY,GAAZ,YAAY,CAAe;QAE5C,IAAI,CAAC,UAAU,GAAG,OAAO,EAAE,UAAU,CAAC;QACtC,IAAI,CAAC,WAAW,GAAG,OAAO,EAAE,WAAW,CAAC;QACxC,IAAI,CAAC,YAAY,GAAG,OAAO,EAAE,YAAY,IAAI,mBAAmB,CAAC;IACnE,CAAC;IAED;;;;OAIG;IACK,cAAc;QACpB,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC;QACtC,IAAI,IAAI,CAAC,eAAe;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC;QACpD,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC;QAC/C,IAAI,CAAC;YACH,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAkB,gBAAgB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAChG,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,aAAa,GAAG,SAAS,CAAC;QACjC,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED;;;;OAIG;IACK,yBAAyB;QAC/B,IAAI,IAAI,CAAC,kBAAkB;YAAE,OAAO,IAAI,CAAC,kBAAkB,CAAC;QAC5D,IAAI,IAAI,CAAC,0BAA0B;YAAE,OAAO,IAAI,CAAC,wBAAwB,CAAC;QAC1E,IAAI,CAAC,0BAA0B,GAAG,IAAI,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,wBAAwB,CAAC;QAC1D,IAAI,CAAC;YACH,IAAI,CAAC,wBAAwB,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAqB,mBAAmB,EAAE;gBAC1F,MAAM,EAAE,KAAK;aACd,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,wBAAwB,GAAG,SAAS,CAAC;QAC5C,CAAC;QACD,OAAO,IAAI,CAAC,wBAAwB,CAAC;IACvC,CAAC;IAED;;;;OAIG;IACK,mBAAmB;QACzB,IAAI,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC,YAAY,CAAC;QAChD,IAAI,IAAI,CAAC,oBAAoB;YAAE,OAAO,IAAI,CAAC,kBAAkB,CAAC;QAC9D,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,kBAAkB,CAAC;QACpD,IAAI,CAAC;YACH,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAe,aAAa,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/F,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,kBAAkB,GAAG,SAAS,CAAC;QACtC,CAAC;QACD,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED,sEAAsE;IACtE,MAAM,CAAC,OAAe,EAAE,EAAU;QAChC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4DAA4D;IAC5D,OAAO,CAAC,OAAe;QACrB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAED;;;;OAIG;IACH,SAAS;QACP,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;;;;OASG;IACH,OAAO,CAAC,IAAU;QAChB,OAAO,IAAI,SAAS,CAAC,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5D,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,WAAW;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACtC,IAAI,CAAC,OAAO;YAAE,OAAO,OAAO,CAAC;QAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;QAC9B,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC;QACtC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAc,CAAC,CAAC;YACxD,OAAO,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC/C,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,4DAA4D;IAE5D,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,QAAmB;QAC/C,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,QAAmB;QAC/C,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,QAAmB;QAClD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,OAAO,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,mEAAmE;IAEnE,+CAA+C;IAC/C,KAAK,CAAC,OAAO,CAAC,IAAY;QACxB,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED,uDAAuD;IACvD,KAAK,CAAC,UAAU,CAAC,KAAe;QAC9B,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,CAAC;IAC1D,CAAC;IAED,0CAA0C;IAE1C,gBAAgB;IAChB,aAAa,CAAC,IAAe,EAAE,OAAe,EAAE,QAAmB;QACjE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAED,gBAAgB;IAChB,iBAAiB,CAAC,IAAe,EAAE,KAAe;QAChD,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACtC,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,UAAU,CAAC,SAAoB,EAAE,KAAe;QAC5D,IAAI,SAAS,KAAK,OAAO,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,qEAAqE;IAC7D,KAAK,CAAC,OAAO,CAAC,IAAU;QAC9B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;QAC9B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YAChC,KAAK,MAAM,CAAC,IAAI,YAAY;gBAAE,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC5C,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACnD,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;gBAChC,KAAK,MAAM,CAAC,IAAI,YAAY;oBAAE,IAAI,OAAO,CAAC,KAAK,QAAQ;wBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,KAAK,CAAC,KAAK,CACjB,SAAoB,EACpB,OAAe,EACf,QAAmB;QAEnB,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC7E,qGAAqG;QACrG,gFAAgF;QAChF,iFAAiF;QACjF,qFAAqF;QACrF,oBAAoB,CAClB,OAAO,EACP,OAAO,EACP,MAAM,EACN,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAC7C,QAAQ,CACT,CAAC;QACF,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,OAAO,CACnB,SAAoB,EACpB,OAAe,EACf,QAAmB;QAEnB,MAAM,IAAI,GAAS,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAEjE,iCAAiC;QACjC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,EAAE,KAAK,IAAI;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QACjE,IAAI,EAAE,KAAK,KAAK;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QAEnE,8EAA8E;QAC9E,gFAAgF;QAChF,gFAAgF;QAChF,yEAAyE;QACzE,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,yBAAyB,EAAE,CAAC;YAClD,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;gBACtE,IAAI,OAAO,KAAK,IAAI;oBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;YAChF,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACrD,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,MAAM,GAAI,MAAkC,CAAC,OAAO,CAAC,CAAC;YAC5D,2EAA2E;YAC3E,uEAAuE;YACvE,yEAAyE;YACzE,4DAA4D;YAC5D,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;gBACjC,MAAM,MAAM,GAAI,MAAyB,CAAC,MAAsC,CAAC;gBACjF,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;oBACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;oBACxD,IAAI,MAAM,KAAK,IAAI;wBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;oBACvE,IAAI,MAAM,KAAK,KAAK;wBAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;gBAC3E,CAAC;gBACD,iEAAiE;gBACjE,IAAI,SAAS,KAAK,OAAO;oBAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;gBAC1E,MAAM,OAAO,GAAG,OAAO,CACrB,MAAO,MAAuC,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAC5E,CAAC;gBACF,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;YACvC,CAAC;QACH,CAAC;QAED,+BAA+B;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,SAAS,KAAK,OAAO;gBAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;YAC1E,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC1E,CAAC;QAED,MAAM,IAAI,2BAA2B,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;IAEO,aAAa,CAAC,OAAe,EAAE,QAAmB;QACxD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,yEAAyE;YACzE,uEAAuE;YACvE,0EAA0E;YAC1E,qEAAqE;YACrE,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ;iBAC1B,GAAG,EAAE;iBACL,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAQ,MAAkC,CAAC,OAAO,CAAC,KAAK,UAAU,CAAC,CAAC;YAC1F,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC3C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,yBAAyB,CACjC,OAAO,EACP,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAoB,CAAC,WAAW,EAAE,IAAI,IAAI,QAAQ,CAAC,CACxE,CAAC;YACJ,CAAC;YACD,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;QACD,qFAAqF;QACrF,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAyB,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;CACF,CAAA;AAlUY,IAAI;IADhB,UAAU,EAAE;IAmBR,WAAA,QAAQ,EAAE,CAAA;IACV,WAAA,MAAM,CAAC,oBAAoB,CAAC,CAAA;IAE5B,WAAA,QAAQ,EAAE,CAAA;IACV,WAAA,MAAM,CAAC,gBAAgB,CAAC,CAAA;IAExB,WAAA,QAAQ,EAAE,CAAA;IAEV,WAAA,QAAQ,EAAE,CAAA;IACV,WAAA,MAAM,CAAC,mBAAmB,CAAC,CAAA;IAE3B,WAAA,QAAQ,EAAE,CAAA;IACV,WAAA,MAAM,CAAC,aAAa,CAAC,CAAA;qCAbK,cAAc,kBAQZ,SAAS;GAzB7B,IAAI,CAkUhB;;AAED;;GAEG;AACH,MAAM,OAAO,SAAS;IAED;IACA;IAFnB,YACmB,IAAU,EACV,IAAe;QADf,SAAI,GAAJ,IAAI,CAAM;QACV,SAAI,GAAJ,IAAI,CAAW;IAC/B,CAAC;IAEJ,MAAM,CAAC,OAAe,EAAE,QAAmB;QACzC,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,QAAmB;QAC/C,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,QAAmB;QAClD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,OAAO,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,6CAA6C;IAC7C,OAAO,CAAC,IAAY;QAClB,OAAO,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,qDAAqD;IACrD,UAAU,CAAC,KAAe;QACxB,OAAO,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC;CACF"}
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAa,MAAM,gBAAgB,CAAC;AAC7F,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAA4B,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAClF,OAAO,EAAE,2BAA2B,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAChG,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAwC,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC/F,OAAO,EAGL,cAAc,EACd,QAAQ,EACR,SAAS,GACV,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,GACd,MAAM,aAAa,CAAC;AAuBrB,iGAAiG;AACjG,SAAS,eAAe,CAAC,KAA+B;IACtD,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IACjD,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC1D,6EAA6E;IAC7E,OAAO,KAAK,CAAC,OAAO,KAAK,SAAS;QAChC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE;QACrC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAClB,QAAW,EACX,OAA2B;IAE3B,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,CAAC;AACrE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,SAAS,CAChB,OAAe,EACf,QAA2D;IAE3D,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,IAAI,iBAAiB,OAAO,EAAE,CAAC;IAC/D,OAAO,IAAI,kBAAkB,CAAC;QAC5B,UAAU,EAAE,GAAG;QACf,KAAK,EAAE,WAAW;QAClB,OAAO;QACP,OAAO;QACP,MAAM,EAAE,QAAQ,CAAC,MAAM;KACxB,CAAC,CAAC;AACL,CAAC;AAED,iFAAiF;AACjF,sEAAsE;AACtE,MAAM,OAAO,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;AAGxC;;;;GAIG;AACH,MAAM,wBAAwB,GAAG,MAAM,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;AAe/F;;;;;;;;;;GAUG;AAEI,IAAM,IAAI,GAAV,MAAM,IAAI;IAkBI;IAMA;IAEA;IAGA;IAGA;IA/BF,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IAClC,UAAU,CAA6B;IACvC,KAAK,CAAwB;IAC7B,WAAW,CAAoC;IAC/C,YAAY,CAAe;IAE5C,6EAA6E;IAC7E,4EAA4E;IAC5E,mEAAmE;IAC3D,eAAe,GAAG,KAAK,CAAC;IACxB,aAAa,CAA8B;IAC3C,0BAA0B,GAAG,KAAK,CAAC;IACnC,wBAAwB,CAAiC;IACzD,oBAAoB,GAAG,KAAK,CAAC;IAC7B,kBAAkB,CAA2B;IAErD,YACmB,QAAwB,EAGzC,OAAuC,EAGtB,OAAyB,EAEzB,SAAqB,EAGrB,kBAAuC,EAGvC,YAA2B;QAd3B,aAAQ,GAAR,QAAQ,CAAgB;QAMxB,YAAO,GAAP,OAAO,CAAkB;QAEzB,cAAS,GAAT,SAAS,CAAY;QAGrB,uBAAkB,GAAlB,kBAAkB,CAAqB;QAGvC,iBAAY,GAAZ,YAAY,CAAe;QAE5C,IAAI,CAAC,UAAU,GAAG,OAAO,EAAE,UAAU,CAAC;QACtC,IAAI,CAAC,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC;QAC5B,IAAI,CAAC,WAAW,GAAG,OAAO,EAAE,WAAW,CAAC;QACxC,IAAI,CAAC,YAAY,GAAG,OAAO,EAAE,YAAY,IAAI,mBAAmB,CAAC;IACnE,CAAC;IAED;;;;OAIG;IACK,cAAc;QACpB,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC;QACtC,IAAI,IAAI,CAAC,eAAe;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC;QACpD,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC;QAC/C,IAAI,CAAC;YACH,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAkB,gBAAgB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAChG,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,aAAa,GAAG,SAAS,CAAC;QACjC,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED;;;;OAIG;IACK,yBAAyB;QAC/B,IAAI,IAAI,CAAC,kBAAkB;YAAE,OAAO,IAAI,CAAC,kBAAkB,CAAC;QAC5D,IAAI,IAAI,CAAC,0BAA0B;YAAE,OAAO,IAAI,CAAC,wBAAwB,CAAC;QAC1E,IAAI,CAAC,0BAA0B,GAAG,IAAI,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,wBAAwB,CAAC;QAC1D,IAAI,CAAC;YACH,IAAI,CAAC,wBAAwB,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAqB,mBAAmB,EAAE;gBAC1F,MAAM,EAAE,KAAK;aACd,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,wBAAwB,GAAG,SAAS,CAAC;QAC5C,CAAC;QACD,OAAO,IAAI,CAAC,wBAAwB,CAAC;IACvC,CAAC;IAED;;;;OAIG;IACK,mBAAmB;QACzB,IAAI,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC,YAAY,CAAC;QAChD,IAAI,IAAI,CAAC,oBAAoB;YAAE,OAAO,IAAI,CAAC,kBAAkB,CAAC;QAC9D,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,kBAAkB,CAAC;QACpD,IAAI,CAAC;YACH,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAe,aAAa,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/F,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,kBAAkB,GAAG,SAAS,CAAC;QACtC,CAAC;QACD,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED;;;;;;OAMG;IACK,mBAAmB;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACtC,8EAA8E;QAC9E,yEAAyE;QACzE,gDAAgD;QAChD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,UAAU;YAAE,OAAO,SAAS,CAAC;QACpE,IAAI,KAA+B,CAAC;QACpC,IAAI,CAAC;YACH,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,GAAG,SAAS,CAAC;QACpB,CAAC;QACD,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,MAAM,QAAQ,GAAI,KAAiC,CAAC,wBAAwB,CAAC,CAAC;QAC9E,IAAI,QAAQ,YAAY,eAAe;YAAE,OAAO,QAAQ,CAAC;QACzD,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACnC,KAAiC,CAAC,wBAAwB,CAAC,GAAG,KAAK,CAAC;QACrE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,sEAAsE;IACtE,MAAM,CAAC,OAAe,EAAE,EAAU;QAChC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4DAA4D;IAC5D,OAAO,CAAC,OAAe;QACrB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAED;;;;OAIG;IACH,SAAS;QACP,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;;;;OASG;IACH,OAAO,CAAC,IAAU;QAChB,OAAO,IAAI,SAAS,CAAC,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5D,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,WAAW;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACtC,IAAI,CAAC,OAAO;YAAE,OAAO,OAAO,CAAC;QAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;QAC9B,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC;QACtC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAc,CAAC,CAAC;YACxD,OAAO,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC/C,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,4DAA4D;IAE5D,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,QAAmB;QAC/C,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAC7F,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,QAAmB;QAC/C,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,QAAmB;QAClD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAChC,MAAM,IAAI,CAAC,WAAW,EAAE,EACxB,OAAO,EACP,QAAQ,EACR,IAAI,CAAC,mBAAmB,EAAE,CAC3B,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,OAAO;YAAE,MAAM,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC5D,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,UAAU,CAAC,KAAqB;QACpC,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,CAAC;IACzD,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,KAAK,CAAC,MAAqB,EAAE,OAAO,GAAG,SAAS;QACpD,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACtE,CAAC;IAED,mEAAmE;IAEnE,+CAA+C;IAC/C,KAAK,CAAC,OAAO,CAAC,IAAY;QACxB,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED,uDAAuD;IACvD,KAAK,CAAC,UAAU,CAAC,KAAe;QAC9B,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,CAAC;IAC1D,CAAC;IAED,0CAA0C;IAE1C,gBAAgB;IAChB,aAAa,CAAC,IAAe,EAAE,OAAe,EAAE,QAAmB;QACjE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,mFAAmF;IACnF,iBAAiB,CAAC,IAAe,EAAE,KAAqB;QACtD,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,SAAS,CAAC,IAAe,EAAE,KAAqB;QAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,mBAAmB,EAAE,IAAI,IAAI,eAAe,EAAE,CAAC;QAClE,MAAM,GAAG,GAAkB,EAAE,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,OAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YACvE,CAAC;YAAC,MAAM,CAAC;gBACP,8EAA8E;gBAC9E,OAAO,GAAG,KAAK,CAAC;YAClB,CAAC;YACD,GAAG,CAAC,IAAI,CACN,IAAI,CAAC,QAAQ,KAAK,SAAS;gBACzB,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE;gBACpC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,CAChE,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,0FAA0F;IAC1F,aAAa,CACX,IAAe,EACf,OAAe,EACf,QAAmB;QAEnB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,gBAAgB;IAChB,iBAAiB,CAAC,IAAe,EAAE,KAAe;QAChD,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACtC,CAAC;IAED,mDAAmD;IACnD,YAAY,CACV,IAAe,EACf,MAAqB,EACrB,OAAO,GAAG,SAAS;QAEnB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,KAAK,CAAC,YAAY,CACxB,SAAoB,EACpB,MAAqB,EACrB,OAAe;QAEf,MAAM,IAAI,GAAS,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAEjE,2EAA2E;QAC3E,yEAAyE;QACzE,MAAM,EAAE,GAAG,eAAe,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QACnE,IAAI,EAAE,CAAC,OAAO,KAAK,IAAI;YAAE,OAAO,QAAQ,CAAC;QAEzC,kEAAkE;QAClE,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,yBAAyB,EAAE,CAAC;YAClD,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,OAAO,QAAQ,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;oBAClD,MAAM,KAAK,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;oBACzC,MAAM,SAAS,GAAG,KAAK;wBACrB,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC;wBAChD,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;4BAChB,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,CAAC;4BACtD,OAAO,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;wBAC7E,CAAC,CAAC,EAAE,CAAC;oBACT,IAAI,SAAS,KAAK,IAAI;wBAAE,OAAO,QAAQ,CAAC;gBAC1C,CAAC;gBACD,IAAI,CAAC,MAAM,QAAQ,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,KAAK,IAAI;oBAAE,OAAO,QAAQ,CAAC;YAC9E,CAAC;QACH,CAAC;QAED,sDAAsD;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC7D,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,MAAM,GAAI,MAAyB,CAAC,MAAsC,CAAC;gBACjF,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;oBACjC,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;oBACzE,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI;wBAAE,OAAO,QAAQ,CAAC;oBAC7C,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK;wBAAE,OAAO,SAAS,CAAC;gBACjD,CAAC;gBACD,6EAA6E;gBAC7E,IAAI,SAAS,KAAK,OAAO;oBAAE,OAAO,SAAS,CAAC;gBAC5C,OAAO,cAAc,CAAC,MAAM,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;QAED,iCAAiC;QACjC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACK,kBAAkB,CAAC,MAAsB,EAAE,OAAe;QAChE,MAAM,KAAK,GAAI,MAAkC,CAAC,KAAK,CAAC;QACxD,IAAI,OAAO,KAAK,KAAK,UAAU;YAAE,OAAO,KAAoB,CAAC;QAC7D,MAAM,QAAQ,GAAI,MAAkC,CAAC,OAAO,CAAC,CAAC;QAC9D,IAAI,OAAO,QAAQ,KAAK,UAAU;YAAE,OAAO,QAAuB,CAAC;QACnE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,UAAU,CAAC,SAAoB,EAAE,KAAe;QAC5D,IAAI,SAAS,KAAK,OAAO,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,qEAAqE;IAC7D,KAAK,CAAC,OAAO,CAAC,IAAU;QAC9B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;QAC9B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YAChC,KAAK,MAAM,CAAC,IAAI,YAAY;gBAAE,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC5C,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACnD,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;gBAChC,KAAK,MAAM,CAAC,IAAI,YAAY;oBAAE,IAAI,OAAO,CAAC,KAAK,QAAQ;wBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,KAAK,CAAC,KAAK,CACjB,SAAoB,EACpB,OAAe,EACf,QAAmB,EACnB,KAAuB;QAEvB,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;IAC1E,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,MAAM,CAClB,SAAoB,EACpB,OAAe,EACf,QAAmB,EACnB,KAAuB;QAEvB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QACzE,qGAAqG;QACrG,gFAAgF;QAChF,iFAAiF;QACjF,qFAAqF;QACrF,oBAAoB,CAClB,OAAO,EACP,QAAQ,CAAC,OAAO,EAChB,QAAQ,CAAC,MAAM,EACf,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAC7C,QAAQ,CACT,CAAC;QACF,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,OAAO,CACnB,SAAoB,EACpB,OAAe,EACf,QAAmB,EACnB,KAAuB;QAEvB,MAAM,IAAI,GAAS,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QACjE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QAEzE,6EAA6E;QAC7E,yEAAyE;QACzE,8EAA8E;QAC9E,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,yCAAyC;YACxE,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;YACnF,IAAI,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1D,OAAO,WAAW,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;QAED,oEAAoE;QACpE,OAAO,WAAW,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5F,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,WAAW,CACvB,SAAoB,EACpB,OAAe,EACf,QAAmB,EACnB,KAAuB;QAEvB,MAAM,IAAI,GAAS,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAEjE,iCAAiC;QACjC,MAAM,EAAE,GAAG,eAAe,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QACnE,IAAI,EAAE,CAAC,OAAO,KAAK,IAAI;YACrB,OAAO,WAAW,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;QAC3E,IAAI,EAAE,CAAC,OAAO,KAAK,KAAK;YACtB,OAAO,WAAW,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;QAE5E,8EAA8E;QAC9E,gFAAgF;QAChF,gFAAgF;QAChF,yEAAyE;QACzE,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,yBAAyB,EAAE,CAAC;YAClD,IAAI,QAAQ,EAAE,CAAC;gBACb,2EAA2E;gBAC3E,8EAA8E;gBAC9E,6EAA6E;gBAC7E,6EAA6E;gBAC7E,IAAI,OAAO,QAAQ,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;oBAClD,2EAA2E;oBAC3E,wEAAwE;oBACxE,2DAA2D;oBAC3D,MAAM,SAAS,GAAG,KAAK;wBACrB,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC;wBAChD,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;4BAChB,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,CAAC;4BACtD,OAAO,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;wBAC7E,CAAC,CAAC,EAAE,CAAC;oBACT,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;wBACvB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;oBAC1D,CAAC;gBACH,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;gBACtE,IAAI,OAAO,KAAK,IAAI;oBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;YAChF,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACrD,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,MAAM,GAAI,MAAkC,CAAC,OAAO,CAAC,CAAC;YAC5D,2EAA2E;YAC3E,uEAAuE;YACvE,yEAAyE;YACzE,4DAA4D;YAC5D,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;gBACjC,MAAM,MAAM,GAAI,MAAyB,CAAC,MAAsC,CAAC;gBACjF,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;oBACjC,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;oBACzE,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI;wBACzB,OAAO,WAAW,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;oBACjF,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK;wBAC1B,OAAO,WAAW,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;gBACpF,CAAC;gBACD,iEAAiE;gBACjE,IAAI,SAAS,KAAK,OAAO;oBAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;gBAC1E,MAAM,MAAM,GAAG,eAAe,CAC5B,CAAC,MAAO,MAAuC,CAAC,IAAI,CAClD,MAAM,EACN,IAAI,EACJ,QAAQ,CACT,CAAiB,CACnB,CAAC;gBACF,yEAAyE;gBACzE,wEAAwE;gBACxE,OAAO,WAAW,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;QAED,+BAA+B;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,SAAS,KAAK,OAAO;gBAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;YAC1E,MAAM,MAAM,GAAG,eAAe,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAiB,CAAC,CAAC;YAC7E,OAAO,WAAW,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,IAAI,2BAA2B,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;IAEO,aAAa,CAAC,OAAe,EAAE,QAAmB;QACxD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,yEAAyE;YACzE,uEAAuE;YACvE,0EAA0E;YAC1E,qEAAqE;YACrE,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ;iBAC1B,GAAG,EAAE;iBACL,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAQ,MAAkC,CAAC,OAAO,CAAC,KAAK,UAAU,CAAC,CAAC;YAC1F,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC3C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,yBAAyB,CACjC,OAAO,EACP,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAoB,CAAC,WAAW,EAAE,IAAI,IAAI,QAAQ,CAAC,CACxE,CAAC;YACJ,CAAC;YACD,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;QACD,qFAAqF;QACrF,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAyB,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;CACF,CAAA;AA/kBY,IAAI;IADhB,UAAU,EAAE;IAoBR,WAAA,QAAQ,EAAE,CAAA;IACV,WAAA,MAAM,CAAC,oBAAoB,CAAC,CAAA;IAE5B,WAAA,QAAQ,EAAE,CAAA;IACV,WAAA,MAAM,CAAC,gBAAgB,CAAC,CAAA;IAExB,WAAA,QAAQ,EAAE,CAAA;IAEV,WAAA,QAAQ,EAAE,CAAA;IACV,WAAA,MAAM,CAAC,mBAAmB,CAAC,CAAA;IAE3B,WAAA,QAAQ,EAAE,CAAA;IACV,WAAA,MAAM,CAAC,aAAa,CAAC,CAAA;qCAbK,cAAc,kBAQZ,SAAS;GA1B7B,IAAI,CA+kBhB;;AAED;;GAEG;AACH,MAAM,OAAO,SAAS;IAED;IACA;IAFnB,YACmB,IAAU,EACV,IAAe;QADf,SAAI,GAAJ,IAAI,CAAM;QACV,SAAI,GAAJ,IAAI,CAAW;IAC/B,CAAC;IAEJ,MAAM,CAAC,OAAe,EAAE,QAAmB;QACzC,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,QAAmB;QAC/C,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,mGAAmG;IACnG,UAAU,CAAC,KAAqB;QAC9B,OAAO,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC;IAED,sFAAsF;IACtF,KAAK,CAAC,MAAqB,EAAE,OAAO,GAAG,SAAS;QAC9C,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,QAAmB;QAClD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC7E,IAAI,CAAC,QAAQ,CAAC,OAAO;YAAE,MAAM,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC5D,CAAC;IAED,6CAA6C;IAC7C,OAAO,CAAC,IAAY;QAClB,OAAO,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,qDAAqD;IACrD,UAAU,CAAC,KAAe;QACxB,OAAO,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC;CACF"}

package/dist/index.d.ts

@@ -1,5 +1,7 @@
 export declare const VERSION = "0.0.0";
 export { Gate, BoundGate } from './gate.js';
+export type { BatchAbility, BatchResult } from './gate.js';
+export { PermissionCache } from './permission-cache.js';
 export { authzDecisionChannel, publishAuthzDecision } from './diagnostics.js';
 export type { AuthzDecisionDiagnostic, AuthzDecisionReason } from './diagnostics.js';
 export { PolicyRegistry } from './policy-registry.js';
@@ -11,14 +13,17 @@ export { CanGuard } from './guard/can.guard.js';
 export { RolesGuard } from './guard/roles.guard.js';
 export { AuthzModule } from './module.js';
 export { createCanController, DEFAULT_CAN_ENDPOINT_PATH, } from './can-endpoint.controller.js';
-export type { CanRequestBody, CanResponseBody } from './can-endpoint.controller.js';
+export type { CanRequestBody, CanResponseBody, CanBatchRequestBody, CanBatchResultItem, } from './can-endpoint.controller.js';
 export { IdParamResourceResolver } from './resource-resolver.js';
 export type { ResourceResolver } from './resource-resolver.js';
 export type { ContextAccessor, ContextStore, UserRef } from './context-accessor.js';
 export type { PermissionProvider } from './permission-provider.js';
 export { defaultRoleResolver } from './role-provider.js';
 export type { RoleProvider, RoleResolver } from './role-provider.js';
+export { permissionMatches, permissionSatisfied } from './permission-matcher.js';
+export { and, eq, normalizeScope, or, scopeAll, scopeNone, where, } from './scope.js';
+export type { ScopeAll, ScopeCondition, ScopeConstraint, ScopeGroup, ScopeMethod, ScopeNode, ScopeNone, ScopeOperator, ScopeResult, } from './scope.js';
 export { AUTHZ_MODULE_OPTIONS, RESOURCE_RESOLVER, RESOURCE_HYDRATOR, CONTEXT_ACCESSOR, PERMISSION_PROVIDER, ROLE_PROVIDER, POLICY_RESOURCE_METADATA, CAN_METADATA, ROLES_METADATA, } from './tokens.js';
 export { AuthzException, PolicyNotDecoratedException, AbilityNotResolvedException, AmbiguousAbilityException, ResourceResolverMissingException, } from './errors/exceptions.js';
-export type { AuthzModuleOptions, AuthzModuleAsyncOptions, AuthzModuleOptionsFactory, GateFn, PolicyBeforeHook, PolicyInstance, PolicyMethod, Resource, ResourceLoader, ResourceLoaderMap, SuperAdminHook, User, } from './types.js';
+export type { AfterHook, AuthzModuleOptions, AuthzModuleAsyncOptions, AuthzModuleOptionsFactory, GateFn, PolicyBeforeHook, PolicyInstance, PolicyMethod, PolicyResponse, PolicyResult, Resource, ResourceLoader, ResourceLoaderMap, SuperAdminHook, User, } from './types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,OAAO,UAAU,CAAC;AAE/B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC9E,YAAY,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACrF,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,GAAG,EAAE,MAAM,8BAA8B,CAAC;AACnD,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,EAAE,KAAK,EAAE,MAAM,gCAAgC,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpF,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACpF,YAAY,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,EACb,wBAAwB,EACxB,YAAY,EACZ,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,cAAc,EACd,2BAA2B,EAC3B,2BAA2B,EAC3B,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,kBAAkB,EAClB,uBAAuB,EACvB,yBAAyB,EACzB,MAAM,EACN,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,QAAQ,EACR,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,IAAI,GACL,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,OAAO,UAAU,CAAC;AAE/B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC5C,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC9E,YAAY,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACrF,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,GAAG,EAAE,MAAM,8BAA8B,CAAC;AACnD,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,EAAE,KAAK,EAAE,MAAM,gCAAgC,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,cAAc,EACd,eAAe,EACf,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACpF,YAAY,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,EACL,GAAG,EACH,EAAE,EACF,cAAc,EACd,EAAE,EACF,QAAQ,EACR,SAAS,EACT,KAAK,GACN,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,QAAQ,EACR,cAAc,EACd,eAAe,EACf,UAAU,EACV,WAAW,EACX,SAAS,EACT,SAAS,EACT,aAAa,EACb,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,EACb,wBAAwB,EACxB,YAAY,EACZ,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,cAAc,EACd,2BAA2B,EAC3B,2BAA2B,EAC3B,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,SAAS,EACT,kBAAkB,EAClB,uBAAuB,EACvB,yBAAyB,EACzB,MAAM,EACN,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,cAAc,EACd,YAAY,EACZ,QAAQ,EACR,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,IAAI,GACL,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -1,5 +1,6 @@
 export const VERSION = '0.0.0';
 export { Gate, BoundGate } from './gate.js';
+export { PermissionCache } from './permission-cache.js';
 export { authzDecisionChannel, publishAuthzDecision } from './diagnostics.js';
 export { PolicyRegistry } from './policy-registry.js';
 export { Policy, getPolicyResource } from './decorator/policy.decorator.js';
@@ -11,6 +12,8 @@ export { AuthzModule } from './module.js';
 export { createCanController, DEFAULT_CAN_ENDPOINT_PATH, } from './can-endpoint.controller.js';
 export { IdParamResourceResolver } from './resource-resolver.js';
 export { defaultRoleResolver } from './role-provider.js';
+export { permissionMatches, permissionSatisfied } from './permission-matcher.js';
+export { and, eq, normalizeScope, or, scopeAll, scopeNone, where, } from './scope.js';
 export { AUTHZ_MODULE_OPTIONS, RESOURCE_RESOLVER, RESOURCE_HYDRATOR, CONTEXT_ACCESSOR, PERMISSION_PROVIDER, ROLE_PROVIDER, POLICY_RESOURCE_METADATA, CAN_METADATA, ROLES_METADATA, } from './tokens.js';
 export { AuthzException, PolicyNotDecoratedException, AbilityNotResolvedException, AmbiguousAbilityException, ResourceResolverMissingException, } from './errors/exceptions.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAE/B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAE9E,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,GAAG,EAAE,MAAM,8BAA8B,CAAC;AAEnD,OAAO,EAAE,KAAK,EAAE,MAAM,gCAAgC,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAIjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,EACb,wBAAwB,EACxB,YAAY,EACZ,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,cAAc,EACd,2BAA2B,EAC3B,2BAA2B,EAC3B,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAE/B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAE5C,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAE9E,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,GAAG,EAAE,MAAM,8BAA8B,CAAC;AAEnD,OAAO,EAAE,KAAK,EAAE,MAAM,gCAAgC,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,8BAA8B,CAAC;AAOtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAIjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,EACL,GAAG,EACH,EAAE,EACF,cAAc,EACd,EAAE,EACF,QAAQ,EACR,SAAS,EACT,KAAK,GACN,MAAM,YAAY,CAAC;AAYpB,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,EACb,wBAAwB,EACxB,YAAY,EACZ,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,cAAc,EACd,2BAA2B,EAC3B,2BAA2B,EAC3B,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,wBAAwB,CAAC"}

package/dist/permission-cache.d.ts

@@ -0,0 +1,33 @@
+import type { PermissionProvider } from './permission-provider.js';
+import type { User } from './types.js';
+/**
+ * A memo over a {@link PermissionProvider}'s `getPermissions(user)` so a user's
+ * granted-permission set is fetched AT MOST ONCE per logical scope (a single
+ * `allowsMany` batch, or — when wired to nestjs-context — a single HTTP request).
+ *
+ * Without it, every `gate.allows(...)` re-fetches the set (an N+1 within a list
+ * page, since each card runs its own check). The cache keys by the resolved
+ * `user` identity so two checks for the SAME user share one fetch while a
+ * different user still triggers its own.
+ *
+ * Only the `getPermissions` (full-set, wildcard-matched) path is memoized — the
+ * exact-match `hasPermission` fast path is left to the provider, which is free to
+ * memoize internally. A provider WITHOUT `getPermissions` makes this a no-op.
+ */
+export declare class PermissionCache {
+    private readonly byUser;
+    /**
+     * Resolve the user's granted-permission set via the provider, memoized for the
+     * cache's lifetime. Returns `undefined` when the provider can't list grants
+     * (no `getPermissions`, or it yielded nullish) so the caller falls back to the
+     * exact-match `hasPermission` path.
+     */
+    getPermissions(provider: PermissionProvider, user: User): Promise<ReadonlySet<string> | undefined>;
+    /**
+     * True when the user's (memoized) granted set satisfies `ability` under the
+     * core's wildcard matcher. `undefined` when no set is available (caller should
+     * defer to `hasPermission`).
+     */
+    satisfies(provider: PermissionProvider, user: User, ability: string): Promise<boolean | undefined>;
+}
+//# sourceMappingURL=permission-cache.d.ts.map

package/dist/permission-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-cache.d.ts","sourceRoot":"","sources":["../src/permission-cache.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAEvC;;;;;;;;;;;;;GAaG;AACH,qBAAa,eAAe;IAG1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgE;IAEvF;;;;;OAKG;IACG,cAAc,CAClB,QAAQ,EAAE,kBAAkB,EAC5B,IAAI,EAAE,IAAI,GACT,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;IAW3C;;;;OAIG;IACG,SAAS,CACb,QAAQ,EAAE,kBAAkB,EAC5B,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;CAKhC"}