@dudousxd/nestjs-authz 0.5.1 → 0.6.1

package/CHANGELOG.md

@@ -1,5 +1,69 @@
 # @dudousxd/nestjs-authz
 
+## 0.6.1
+
+### Patch Changes
+
+- [`61b6b92`](https://github.com/DavideCarvalho/nestjs-authz/commit/61b6b9241438b8f30811fcd17b0c0c98f08af3bf) - Internal refactors (behavior-preserving): single-source the ORM store contract (`UserRef`/`UserRefInput`/`UserAuthz`/`normalizeUserRef`) via a new `@dudousxd/nestjs-authz/store-kit` subpath that the typeorm/prisma/mikro-orm adapters re-export under their public names, so the definition can't drift across them. Also single-source the grant preamble and the SQL identifier guard in the core store path.
+
+## 0.6.0
+
+### Minor Changes
+
+- [#9](https://github.com/DavideCarvalho/nestjs-authz/pull/9) [`07d01de`](https://github.com/DavideCarvalho/nestjs-authz/commit/07d01de286e7dfcae5fbeb10b7e8d48533214087) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Ecosystem improvements across the authz packages.
+
+  ### Permissions
+
+  - **Wildcard / hierarchical permissions.** Permission strings now support wildcard
+    and hierarchical matching (e.g. `posts:*` or `posts:read:*`), so a single granted
+    permission can authorize a family of related actions instead of enumerating each one.
+
+  ### Authorization decisions
+
+  - **Deny reason / message surfaced on `ForbiddenException`.** When a check fails, the
+    reason for the denial is propagated onto the thrown `ForbiddenException`, making it
+    possible to return a meaningful message to the caller and to debug authorization
+    failures.
+  - **Gate `after` hook.** The Gate now exposes an `after` hook that runs once a decision
+    has been made, enabling cross-cutting concerns such as auditing, logging, and metrics.
+
+  ### Batch authorization
+
+  - **`allowsMany`** for evaluating multiple permission checks in a single call.
+  - **Batch `/authz/can` endpoint** so clients can resolve many checks in one round trip.
+  - **`createCanBatch`** client helper that batches `can` calls transparently.
+
+  ### Performance
+
+  - **Request-scoped permission cache.** Permissions resolved during a request are cached
+    for the lifetime of that request, avoiding repeated lookups on the hot path.
+
+  ### RBAC adapters (TypeORM)
+
+  - **Direct user permissions** granted to a user independent of their roles.
+  - **Tenant-scoped roles** so the same role can be assigned per tenant in multi-tenant
+    deployments.
+
+  ### Query scoping / policy filter (ABAC)
+
+  - **ORM-neutral constraint AST.** Policies can produce a portable constraint
+    representation describing which rows a subject may access.
+  - **Per-ORM application.** The constraint AST is translated and applied for
+    **TypeORM**, **MikroORM**, and **Prisma**, giving ABAC-style query scoping that
+    filters data at the database layer regardless of the ORM in use.
+
+  ### Testing
+
+  - **New `@dudousxd/nestjs-authz-testing` package** with fakes and helpers for testing
+    authorization in consumer applications.
+  - **Postgres / MySQL testcontainers + contract tests** so the ORM stores are verified
+    against real database engines, and a shared contract suite keeps the adapters
+    behaviorally consistent.
+
+  ### Housekeeping
+
+  - **Packaging hygiene** across the published packages.
+
 ## 0.5.1
 
 ### Patch Changes

package/dist/can-endpoint.controller.d.ts

@@ -14,6 +14,22 @@ export interface CanRequestBody {
 export interface CanResponseBody {
     allowed: boolean;
 }
+/**
+ * Batch request body: an array of `{ ability, resource? }` items. The endpoint
+ * accepts EITHER a single {@link CanRequestBody} or this array — a list page can
+ * authorize all of its cards in ONE round-trip instead of N. Mirrors the payload
+ * the client's `createCanBatch` emits.
+ */
+export type CanBatchRequestBody = CanRequestBody[];
+/** One batch result: echoes the item's `ability`/`resource` plus the verdict. */
+export interface CanBatchResultItem {
+    ability: string;
+    resource?: {
+        type: string;
+        id?: string | number;
+    } | null;
+    allowed: boolean;
+}
 /**
  * Build the opt-in fallback controller class, mounted at `path`. Kept as a
  * factory so the route path is configurable via `AuthzModule.forRoot({ canEndpoint })`.

package/dist/can-endpoint.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"can-endpoint.controller.d.ts","sourceRoot":"","sources":["../src/can-endpoint.controller.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsC,KAAK,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAM/E;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAC1D;AAED,gDAAgD;AAChD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAgD/D;AAED,qFAAqF;AACrF,eAAO,MAAM,yBAAyB,cAAc,CAAC"}
+{"version":3,"file":"can-endpoint.controller.d.ts","sourceRoot":"","sources":["../src/can-endpoint.controller.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsC,KAAK,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAM/E;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAC1D;AAED,gDAAgD;AAChD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,cAAc,EAAE,CAAC;AAEnD,iFAAiF;AACjF,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACzD,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAiH/D;AAED,qFAAqF;AACrF,eAAO,MAAM,yBAAyB,cAAc,CAAC"}

package/dist/can-endpoint.controller.js

@@ -42,6 +42,10 @@ export function createCanController(path) {
             this.loaders = loaders;
         }
         async can(body) {
+            // Array body → batch path (one user/permission resolution for the whole list).
+            if (Array.isArray(body)) {
+                return this.canBatch(body);
+            }
             const ability = body?.ability;
             if (typeof ability !== 'string' || ability.length === 0) {
                 return { allowed: false };
@@ -60,6 +64,56 @@ export function createCanController(path) {
                 return { allowed: false };
             }
         }
+        /**
+         * Batch verdicts for an array body. Rehydrates each item's resource shim (via
+         * `resourceLoaders`, same as the single path), then resolves the whole list in
+         * ONE pass via `gate.forUser(currentUser).allowsMany(...)` so the user and the
+         * permission set are resolved once. Each result echoes the original
+         * `ability`/`resource` so the client can map verdicts back to its cards. A
+         * not-found loader, an empty ability, or an unresolved ability denies that item
+         * (never fails the whole batch).
+         */
+        async canBatch(items) {
+            // Validate + rehydrate each item up front. `verdicts[i] === false` already
+            // pins the outright-denials (bad ability / not-found resource); `undefined`
+            // means "send to the batch". `batchInput` carries the surviving items plus
+            // their original index so verdicts map back in order.
+            const verdicts = new Array(items.length).fill(undefined);
+            const echo = new Array(items.length);
+            const batchInput = [];
+            for (let i = 0; i < items.length; i++) {
+                const item = items[i];
+                echo[i] = item?.resource ?? undefined;
+                const ability = item?.ability;
+                if (typeof ability !== 'string' || ability.length === 0) {
+                    verdicts[i] = false;
+                    continue;
+                }
+                const target = await this.rehydrate(item?.resource ?? undefined);
+                if (target === null) {
+                    // A registered loader produced nothing → not found → deny this item.
+                    verdicts[i] = false;
+                    continue;
+                }
+                batchInput.push(target === undefined ? { index: i, ability } : { index: i, ability, resource: target });
+            }
+            // ONE pass over the surviving items: user + permission set resolved once.
+            // `allowsMany` is fault-isolating, so an unresolved ability denies just its item.
+            const results = await this.gate.allowsMany(batchInput.map((b) => b.resource === undefined
+                ? { ability: b.ability }
+                : { ability: b.ability, resource: b.resource }));
+            results.forEach((r, k) => {
+                const original = batchInput[k];
+                if (original)
+                    verdicts[original.index] = r.allowed;
+            });
+            return items.map((item, i) => {
+                const ability = typeof item?.ability === 'string' ? item.ability : '';
+                const allowed = verdicts[i] ?? false;
+                const resource = echo[i];
+                return resource == null ? { ability, allowed } : { ability, resource, allowed };
+            });
+        }
         /**
          * Turn the client's `{ type, id }` shim into the resource the gate authorizes.
          * - No resource → `undefined` (class-level ability).

package/dist/can-endpoint.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"can-endpoint.controller.js","sourceRoot":"","sources":["../src/can-endpoint.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAa,MAAM,gBAAgB,CAAC;AAC/E,OAAO,EAAE,IAAI,IAAI,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAiBhD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,IACM,kBAAkB,GADxB,MACM,kBAAkB;QAEH;QAGA;QAJnB,YACmB,IAAU,EAGV,OAA2B;YAH3B,SAAI,GAAJ,IAAI,CAAM;YAGV,YAAO,GAAP,OAAO,CAAoB;QAC3C,CAAC;QAGE,AAAN,KAAK,CAAC,GAAG,CAAS,IAAoB;YACpC,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,CAAC;YAC9B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC5B,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,IAAI,SAAS,CAAC;YAC7C,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;gBAC9C,gEAAgE;gBAChE,IAAI,MAAM,KAAK,IAAI;oBAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;gBAC/C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBACxD,OAAO,EAAE,OAAO,EAAE,CAAC;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,8CAA8C;gBAC9C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC5B,CAAC;QACH,CAAC;QAED;;;;;;WAMG;QACK,KAAK,CAAC,SAAS,CACrB,QAAgD;YAEhD,IAAI,QAAQ,IAAI,IAAI;gBAAE,OAAO,SAAS,CAAC;YACvC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,OAAO,MAAM,KAAK,UAAU;gBAAE,OAAO,QAAkB,CAAC;YAC5D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAqB,CAAC,CAAC;YAC5D,OAAO,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,MAAiB,CAAC;QACpD,CAAC;KACF,CAAA;IAlCO;QADL,QAAQ,EAAE;QACA,WAAA,IAAI,EAAE,CAAA;;;;iDAgBhB;IAzBG,kBAAkB;QADvB,UAAU,CAAC,IAAI,CAAC;QAIZ,WAAA,QAAQ,EAAE,CAAA;QACV,WAAA,MAAM,CAAC,iBAAiB,CAAC,CAAA;yCAFH,IAAI;OAFzB,kBAAkB,CA2CvB;IAED,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,MAAM,yBAAyB,GAAG,WAAW,CAAC"}
+{"version":3,"file":"can-endpoint.controller.js","sourceRoot":"","sources":["../src/can-endpoint.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAa,MAAM,gBAAgB,CAAC;AAC/E,OAAO,EAAE,IAAI,IAAI,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAgChD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,IACM,kBAAkB,GADxB,MACM,kBAAkB;QAEH;QAGA;QAJnB,YACmB,IAAU,EAGV,OAA2B;YAH3B,SAAI,GAAJ,IAAI,CAAM;YAGV,YAAO,GAAP,OAAO,CAAoB;QAC3C,CAAC;QAGE,AAAN,KAAK,CAAC,GAAG,CACC,IAA0C;YAElD,+EAA+E;YAC/E,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,CAAC;YAC9B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC5B,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,IAAI,SAAS,CAAC;YAC7C,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;gBAC9C,gEAAgE;gBAChE,IAAI,MAAM,KAAK,IAAI;oBAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;gBAC/C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBACxD,OAAO,EAAE,OAAO,EAAE,CAAC;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,8CAA8C;gBAC9C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC5B,CAAC;QACH,CAAC;QAED;;;;;;;;WAQG;QACK,KAAK,CAAC,QAAQ,CAAC,KAA0B;YAC/C,2EAA2E;YAC3E,4EAA4E;YAC5E,2EAA2E;YAC3E,sDAAsD;YACtD,MAAM,QAAQ,GAA+B,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACrF,MAAM,IAAI,GAAkD,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACpF,MAAM,UAAU,GAAiE,EAAE,CAAC;YAEpF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACtB,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,QAAQ,IAAI,SAAS,CAAC;gBACtC,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,CAAC;gBAC9B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACxD,QAAQ,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;oBACpB,SAAS;gBACX,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,IAAI,SAAS,CAAC,CAAC;gBACjE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;oBACpB,qEAAqE;oBACrE,QAAQ,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;oBACpB,SAAS;gBACX,CAAC;gBACD,UAAU,CAAC,IAAI,CACb,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CACvF,CAAC;YACJ,CAAC;YAED,0EAA0E;YAC1E,kFAAkF;YAClF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CACxC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACnB,CAAC,CAAC,QAAQ,KAAK,SAAS;gBACtB,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;gBACxB,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CACjD,CACF,CAAC;YACF,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;gBACvB,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;gBAC/B,IAAI,QAAQ;oBAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;YACrD,CAAC,CAAC,CAAC;YAEH,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;gBAC3B,MAAM,OAAO,GAAG,OAAO,IAAI,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtE,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;gBACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBACzB,OAAO,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;YAClF,CAAC,CAAC,CAAC;QACL,CAAC;QAED;;;;;;WAMG;QACK,KAAK,CAAC,SAAS,CACrB,QAAgD;YAEhD,IAAI,QAAQ,IAAI,IAAI;gBAAE,OAAO,SAAS,CAAC;YACvC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,OAAO,MAAM,KAAK,UAAU;gBAAE,OAAO,QAAkB,CAAC;YAC5D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAqB,CAAC,CAAC;YAC5D,OAAO,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,MAAiB,CAAC;QACpD,CAAC;KACF,CAAA;IAnGO;QADL,QAAQ,EAAE;QAER,WAAA,IAAI,EAAE,CAAA;;;;iDAqBR;IA/BG,kBAAkB;QADvB,UAAU,CAAC,IAAI,CAAC;QAIZ,WAAA,QAAQ,EAAE,CAAA;QACV,WAAA,MAAM,CAAC,iBAAiB,CAAC,CAAA;yCAFH,IAAI;OAFzB,kBAAkB,CA4GvB;IAED,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,MAAM,yBAAyB,GAAG,WAAW,CAAC"}

package/dist/diagnostics.d.ts

@@ -30,7 +30,7 @@ export interface AuthzDecisionDiagnostic {
     resourceId: string | number | null;
 }
 /** The resolution path that produced a decision — the "why" behind a 403 (or a grant). */
-export type AuthzDecisionReason = 'super-admin' | 'permission-provider' | 'policy-before' | 'policy' | 'gate' | 'anonymous';
+export type AuthzDecisionReason = 'super-admin' | 'permission-provider' | 'policy-before' | 'policy' | 'gate' | 'after' | 'anonymous';
 /**
  * Publish a decision to the channel, but only when something is listening. Never
  * throws — building the payload or notifying a subscriber must not break a check.

package/dist/diagnostics.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"diagnostics.d.ts","sourceRoot":"","sources":["../src/diagnostics.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAEjD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,yDAAkC,CAAC;AAEpE;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,CAAC,EAAE,CAAC,CAAC;IACL,gEAAgE;IAChE,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,OAAO,EAAE,OAAO,CAAC;IACjB,0EAA0E;IAC1E,MAAM,EAAE,mBAAmB,CAAC;IAC5B,kGAAkG;IAClG,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,wFAAwF;IACxF,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,0EAA0E;IAC1E,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,0FAA0F;AAC1F,MAAM,MAAM,mBAAmB,GAC3B,aAAa,GACb,qBAAqB,GACrB,eAAe,GACf,QAAQ,GACR,MAAM,GACN,WAAW,CAAC;AAEhB;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,mBAAmB,EAC3B,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,QAAQ,GAAG,SAAS,GAC7B,IAAI,CAcN"}
+{"version":3,"file":"diagnostics.d.ts","sourceRoot":"","sources":["../src/diagnostics.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAEjD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,yDAAkC,CAAC;AAEpE;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,CAAC,EAAE,CAAC,CAAC;IACL,gEAAgE;IAChE,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,OAAO,EAAE,OAAO,CAAC;IACjB,0EAA0E;IAC1E,MAAM,EAAE,mBAAmB,CAAC;IAC5B,kGAAkG;IAClG,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,wFAAwF;IACxF,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,0EAA0E;IAC1E,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,0FAA0F;AAC1F,MAAM,MAAM,mBAAmB,GAC3B,aAAa,GACb,qBAAqB,GACrB,eAAe,GACf,QAAQ,GACR,MAAM,GACN,OAAO,GACP,WAAW,CAAC;AAEhB;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,mBAAmB,EAC3B,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,QAAQ,GAAG,SAAS,GAC7B,IAAI,CAcN"}

package/dist/diagnostics.js.map

@@ -1 +1 @@
-{"version":3,"file":"diagnostics.js","sourceRoot":"","sources":["../src/diagnostics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAGhE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAgCpE;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,OAAgB,EAChB,MAA2B,EAC3B,IAAU,EACV,QAA8B;IAE9B,IAAI,CAAC,oBAAoB,CAAC,cAAc;QAAE,OAAO;IACjD,MAAM,OAAO,GAA4B;QACvC,CAAC,EAAE,CAAC;QACJ,OAAO;QACP,OAAO;QACP,MAAM;QACN,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC;QACxB,YAAY,EAAE,YAAY,CAAC,QAAQ,CAAC;QACpC,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC;KACjC,CAAC;IACF,gFAAgF;IAChF,+EAA+E;IAC/E,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,4FAA4F;AAC5F,SAAS,SAAS,CAAC,IAAU;IAC3B,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,IAA+B,CAAC;QAC5C,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,WAAW,EAAE,IAAI,CAAuB,CAAC;QACvE,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC;QAClB,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,CAAC;YAAE,OAAO,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;QACvF,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpF,OAAO,GAAG,CAAC,WAAW,EAAE,IAAI,IAAI,IAAI,CAAC;IACvC,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;AACtB,CAAC;AAED,sGAAsG;AACtG,SAAS,YAAY,CAAC,QAA8B;IAClD,IAAI,QAAQ,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,OAAO,QAAQ,KAAK,UAAU;QAAE,OAAQ,QAA8B,CAAC,IAAI,IAAI,IAAI,CAAC;IACxF,OAAQ,QAAgD,CAAC,WAAW,EAAE,IAAI,IAAI,IAAI,CAAC;AACrF,CAAC;AAED,kFAAkF;AAClF,SAAS,UAAU,CAAC,QAA8B;IAChD,IAAI,QAAQ,IAAI,IAAI,IAAI,OAAO,QAAQ,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IACpE,MAAM,EAAE,GAAI,QAAoC,CAAC,EAAE,CAAC;IACpD,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC"}
+{"version":3,"file":"diagnostics.js","sourceRoot":"","sources":["../src/diagnostics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAGhE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAiCpE;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,OAAgB,EAChB,MAA2B,EAC3B,IAAU,EACV,QAA8B;IAE9B,IAAI,CAAC,oBAAoB,CAAC,cAAc;QAAE,OAAO;IACjD,MAAM,OAAO,GAA4B;QACvC,CAAC,EAAE,CAAC;QACJ,OAAO;QACP,OAAO;QACP,MAAM;QACN,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC;QACxB,YAAY,EAAE,YAAY,CAAC,QAAQ,CAAC;QACpC,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC;KACjC,CAAC;IACF,gFAAgF;IAChF,+EAA+E;IAC/E,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,4FAA4F;AAC5F,SAAS,SAAS,CAAC,IAAU;IAC3B,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,IAA+B,CAAC;QAC5C,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,WAAW,EAAE,IAAI,CAAuB,CAAC;QACvE,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC;QAClB,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,CAAC;YAAE,OAAO,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;QACvF,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpF,OAAO,GAAG,CAAC,WAAW,EAAE,IAAI,IAAI,IAAI,CAAC;IACvC,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;AACtB,CAAC;AAED,sGAAsG;AACtG,SAAS,YAAY,CAAC,QAA8B;IAClD,IAAI,QAAQ,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,OAAO,QAAQ,KAAK,UAAU;QAAE,OAAQ,QAA8B,CAAC,IAAI,IAAI,IAAI,CAAC;IACxF,OAAQ,QAAgD,CAAC,WAAW,EAAE,IAAI,IAAI,IAAI,CAAC;AACrF,CAAC;AAED,kFAAkF;AAClF,SAAS,UAAU,CAAC,QAA8B;IAChD,IAAI,QAAQ,IAAI,IAAI,IAAI,OAAO,QAAQ,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IACpE,MAAM,EAAE,GAAI,QAAoC,CAAC,EAAE,CAAC;IACpD,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC"}

package/dist/gate.d.ts

@@ -1,11 +1,25 @@
+import { type Type } from '@nestjs/common';
 import { ModuleRef } from '@nestjs/core';
 import type { ContextAccessor } from './context-accessor.js';
+import { type AuthzDecisionReason } from './diagnostics.js';
 import type { PermissionProvider } from './permission-provider.js';
 import { PolicyRegistry } from './policy-registry.js';
 import { type RoleProvider } from './role-provider.js';
+import { type ScopeConstraint } from './scope.js';
 import type { AuthzModuleOptions, GateFn, Resource, User } from './types.js';
 declare const NO_USER: unique symbol;
 type MaybeUser = User | typeof NO_USER;
+/** A single item in a {@link Gate.allowsMany} batch. */
+export interface BatchAbility {
+    ability: string;
+    resource?: Resource;
+}
+/** A single result from a {@link Gate.allowsMany} batch: the input plus its verdict. */
+export interface BatchResult {
+    ability: string;
+    resource?: Resource;
+    allowed: boolean;
+}
 /**
  * Laravel-style authorization Gate.
  *
@@ -25,6 +39,7 @@ export declare class Gate {
     private readonly roleProvider?;
     private readonly gates;
     private readonly superAdmin;
+    private readonly after;
     private readonly resolveUser;
     private readonly roleResolver;
     private contextResolved;
@@ -52,6 +67,14 @@ export declare class Gate {
      * provider registered by ANY module (e.g. the RBAC adapter's global module) is found.
      */
     private resolveRoleProvider;
+    /**
+     * The per-request {@link PermissionCache}, stashed on the nestjs-context store so
+     * every check within one HTTP request shares a single `getPermissions` fetch
+     * (kills the N+1 a list page would otherwise cause). Returns `undefined` when no
+     * context store is available (standalone use), in which case callers fall back to
+     * a transient cache (e.g. one per `allowsMany` batch) or no memoization.
+     */
+    private resolveRequestCache;
     /** Register an ad-hoc, model-less gate resolved by `ability` name. */
     define(ability: string, fn: GateFn): this;
     /** True when an ad-hoc gate is registered for `ability`. */
@@ -82,14 +105,90 @@ export declare class Gate {
     allows(ability: string, resource?: Resource): Promise<boolean>;
     denies(ability: string, resource?: Resource): Promise<boolean>;
     authorize(ability: string, resource?: Resource): Promise<void>;
+    /**
+     * Authorize MANY abilities for the current (context) user in a single pass. The
+     * user is resolved ONCE and a single {@link PermissionCache} is shared across all
+     * items, so a list page (N cards) costs one user resolution + at most one
+     * permission fetch instead of N of each. Order is preserved; each result echoes
+     * its input `ability`/`resource` plus the `allowed` verdict.
+     *
+     * Fault-isolating: an item whose ability is unresolved/ambiguous denies just
+     * THAT item (it does not throw and abort the batch) — a batch is a best-effort
+     * verdict list, not an enforcement gate.
+     */
+    allowsMany(items: BatchAbility[]): Promise<BatchResult[]>;
+    /**
+     * Resolve the QUERY SCOPE constraint for the current (context) user against
+     * `entity` — the `accessibleBy` / Pundit `policy_scope` concept. Returns an
+     * ORM-neutral {@link ScopeConstraint} an adapter (e.g. the TypeORM `applyScope`
+     * helper) turns into a parameterized `WHERE`.
+     *
+     * Consistent with the Gate's single-resource semantics:
+     * - super-admin / before-grant / permission-provider grant → `allow-all`,
+     * - anonymous, or no policy/scope → `deny-all` (default-deny),
+     * - otherwise the policy's `scope` (or `viewAny`-style) constraint.
+     *
+     * `ability` (default `'viewAny'`) names the permission-provider check used for
+     * the allow-all grant and the policy fallback method.
+     */
+    scope(entity: Type<unknown>, ability?: string): Promise<ScopeConstraint>;
     /** True when the current user holds `role`. */
     hasRole(role: string): Promise<boolean>;
     /** True when the current user holds ANY of `roles`. */
     hasAnyRole(roles: string[]): Promise<boolean>;
     /** @internal */
     allowsForUser(user: MaybeUser, ability: string, resource?: Resource): Promise<boolean>;
+    /** @internal — batch check for an explicit/bound user (see {@link allowsMany}). */
+    allowsManyForUser(user: MaybeUser, items: BatchAbility[]): Promise<BatchResult[]>;
+    /**
+     * Run a batch of checks against one already-resolved user, sharing a single
+     * {@link PermissionCache} so the provider's `getPermissions` runs at most once.
+     * Prefers the per-request cache (so the batch also coalesces with other checks in
+     * the same request); falls back to a transient per-batch cache when standalone.
+     */
+    private checkMany;
+    /** @internal — used by {@link BoundGate.authorize} to surface the deny reason/message. */
+    decideForUser(user: MaybeUser, ability: string, resource?: Resource): Promise<{
+        allowed: boolean;
+        reason: AuthzDecisionReason;
+        message?: string;
+    }>;
     /** @internal */
     hasAnyRoleForUser(user: MaybeUser, roles: string[]): Promise<boolean>;
+    /** @internal — used by {@link BoundGate.scope}. */
+    scopeForUser(user: MaybeUser, entity: Type<unknown>, ability?: string): Promise<ScopeConstraint>;
+    /**
+     * Resolve a query-scope constraint for `entity`, mirroring {@link resolveBase}'s
+     * grant order so scoping stays consistent with single-resource decisions:
+     *
+     * 1. super-admin hook grants → `allow-all`;
+     * 2. (authenticated) permission-provider grant for `ability` → `allow-all`;
+     * 3. the policy's `scope` (or `viewAny`-style) method → its constraint;
+     * 4. otherwise (anonymous, no policy, no scope method) → `deny-all`.
+     *
+     * The policy `before` hook is also honored as an allow/deny grant before the
+     * scope method runs, so a policy that broadly allows/denies in `before` scopes
+     * the same way it decides.
+     */
+    private resolveScope;
+    /**
+     * Pick the policy's scope method: the conventional `scope`, else the `ability`
+     * method (e.g. `viewAny`) when it is scope-shaped. Returns `undefined` when the
+     * policy declares neither.
+     */
+    private resolveScopeMethod;
+    /**
+     * Whether the registered {@link PermissionProvider} grants `ability` for an authenticated `user` —
+     * the RBAC "before" grant shared by the single-resource ({@link resolveBase}) and scope
+     * ({@link resolveScope}) paths, single-sourced here so the grant order can't drift between them.
+     *
+     * Grant-only: a `false`/nullish result is "no grant", never a deny. When the provider lists the
+     * user's granted permissions, segment-based wildcard matching runs in the core (a granted
+     * `posts.*` satisfies `posts.update`, `*` satisfies anything) regardless of adapter; a nullish
+     * list defers to the exact-match `hasPermission`. The granted set is fetched through `cache` when
+     * one is supplied, else via a direct fetch.
+     */
+    private permissionProviderGrants;
     /**
      * Resolve the user's effective roles and test membership against `roles`. Returns
      * `false` for an anonymous (NO_USER) caller and whenever no source yields a role
@@ -102,11 +201,26 @@ export declare class Gate {
     private rolesOf;
     private check;
     /**
-     * Resolve an ability to a verdict plus the path that decided it. Throws
+     * Resolve a decision AND publish it for observers. Returns the full decision
+     * (verdict + reason + optional deny message) so {@link authorize} can surface the
+     * `reason`/`message` on the thrown `ForbiddenException`. {@link check} discards
+     * everything but the verdict.
+     */
+    private decide;
+    /**
+     * Resolve an ability to a final verdict, the path that decided it, and an optional
+     * deny message. Runs the global `after` hook over the base decision (see
+     * {@link AfterHook} for override semantics). Throws
      * {@link AbilityNotResolvedException}/{@link AmbiguousAbilityException} when no
-     * decision can be reached (those paths emit no decision).
+     * decision can be reached (those paths emit no decision and skip `after`).
      */
     private resolve;
+    /**
+     * The pre-`after` resolution. `allowed` is `undefined` when the deciding path
+     * (policy method / ad-hoc gate) returned a nullish value — "no opinion" — which
+     * lets the {@link AfterHook} supply a verdict before the default-deny finalize.
+     */
+    private resolveBase;
     private resolvePolicy;
 }
 /**
@@ -118,6 +232,10 @@ export declare class BoundGate {
     constructor(gate: Gate, user: MaybeUser);
     allows(ability: string, resource?: Resource): Promise<boolean>;
     denies(ability: string, resource?: Resource): Promise<boolean>;
+    /** Batch-authorize many abilities for the bound user in one pass (see {@link Gate.allowsMany}). */
+    allowsMany(items: BatchAbility[]): Promise<BatchResult[]>;
+    /** Resolve the query-scope constraint for the bound user (see {@link Gate.scope}). */
+    scope(entity: Type<unknown>, ability?: string): Promise<ScopeConstraint>;
     authorize(ability: string, resource?: Resource): Promise<void>;
     /** True when the bound user holds `role`. */
     hasRole(role: string): Promise<boolean>;

package/dist/gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,KAAK,EAAE,eAAe,EAAW,MAAM,uBAAuB,CAAC;AAGtE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,KAAK,YAAY,EAA0C,MAAM,oBAAoB,CAAC;AAO/F,OAAO,KAAK,EACV,kBAAkB,EAClB,MAAM,EAGN,QAAQ,EAER,IAAI,EACL,MAAM,YAAY,CAAC;AAIpB,QAAA,MAAM,OAAO,eAA0B,CAAC;AACxC,KAAK,SAAS,GAAG,IAAI,GAAG,OAAO,OAAO,CAAC;AAEvC;;;;;;;;;;GAUG;AACH,qBACa,IAAI;IAiBb,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAMzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAEzB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAG3B,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAGpC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IA9BhC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA6B;IACnD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6B;IACxD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoC;IAChE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;IAK5C,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,aAAa,CAA8B;IACnD,OAAO,CAAC,0BAA0B,CAAS;IAC3C,OAAO,CAAC,wBAAwB,CAAiC;IACjE,OAAO,CAAC,oBAAoB,CAAS;IACrC,OAAO,CAAC,kBAAkB,CAA2B;gBAGlC,QAAQ,EAAE,cAAc,EAGzC,OAAO,EAAE,kBAAkB,GAAG,SAAS,EAGtB,OAAO,CAAC,EAAE,eAAe,YAAA,EAEzB,SAAS,CAAC,EAAE,SAAS,YAAA,EAGrB,kBAAkB,CAAC,EAAE,kBAAkB,YAAA,EAGvC,YAAY,CAAC,EAAE,YAAY,YAAA;IAO9C;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAatB;;;;OAIG;IACH,OAAO,CAAC,yBAAyB;IAejC;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAa3B,sEAAsE;IACtE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI;IAKzC,4DAA4D;IAC5D,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAIjC;;;;OAIG;IACH,SAAS,IAAI,MAAM,EAAE;IAIrB;;;;;;;;;OASG;IACH,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,SAAS;IAI9B;;;;OAIG;YACW,WAAW;IAcnB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAI9D,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAI9D,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAQpE,+CAA+C;IACzC,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAI7C,uDAAuD;IACjD,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAMnD,gBAAgB;IAChB,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAItF,gBAAgB;IAChB,iBAAiB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAIrE;;;;;;OAMG;YACW,UAAU;IAOxB,qEAAqE;YACvD,OAAO;YAgBP,KAAK;IAoBnB;;;;OAIG;YACW,OAAO;IAyDrB,OAAO,CAAC,aAAa;CAwBtB;AAED;;GAEG;AACH,qBAAa,SAAS;IAElB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBADJ,IAAI,EAAE,IAAI,EACV,IAAI,EAAE,SAAS;IAGlC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAIxD,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAI9D,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAMpE,6CAA6C;IAC7C,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIvC,qDAAqD;IACrD,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;CAG9C"}
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoD,KAAK,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAC7F,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,KAAK,EAAE,eAAe,EAAyB,MAAM,uBAAuB,CAAC;AACpF,OAAO,EAAE,KAAK,mBAAmB,EAAwB,MAAM,kBAAkB,CAAC;AAIlF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,KAAK,YAAY,EAA0C,MAAM,oBAAoB,CAAC;AAC/F,OAAO,EACL,KAAK,eAAe,EAKrB,MAAM,YAAY,CAAC;AAOpB,OAAO,KAAK,EAEV,kBAAkB,EAClB,MAAM,EAIN,QAAQ,EAER,IAAI,EACL,MAAM,YAAY,CAAC;AAwDpB,QAAA,MAAM,OAAO,eAA0B,CAAC;AACxC,KAAK,SAAS,GAAG,IAAI,GAAG,OAAO,OAAO,CAAC;AASvC,wDAAwD;AACxD,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED,wFAAwF;AACxF,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;;;GAUG;AACH,qBACa,IAAI;IAkBb,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAMzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAEzB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAG3B,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAGpC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IA/BhC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA6B;IACnD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6B;IACxD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAwB;IAC9C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoC;IAChE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;IAK5C,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,aAAa,CAA8B;IACnD,OAAO,CAAC,0BAA0B,CAAS;IAC3C,OAAO,CAAC,wBAAwB,CAAiC;IACjE,OAAO,CAAC,oBAAoB,CAAS;IACrC,OAAO,CAAC,kBAAkB,CAA2B;gBAGlC,QAAQ,EAAE,cAAc,EAGzC,OAAO,EAAE,kBAAkB,GAAG,SAAS,EAGtB,OAAO,CAAC,EAAE,eAAe,YAAA,EAEzB,SAAS,CAAC,EAAE,SAAS,YAAA,EAGrB,kBAAkB,CAAC,EAAE,kBAAkB,YAAA,EAGvC,YAAY,CAAC,EAAE,YAAY,YAAA;IAQ9C;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAatB;;;;OAIG;IACH,OAAO,CAAC,yBAAyB;IAejC;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAa3B;;;;;;OAMG;IACH,OAAO,CAAC,mBAAmB;IAoB3B,sEAAsE;IACtE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI;IAKzC,4DAA4D;IAC5D,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAIjC;;;;OAIG;IACH,SAAS,IAAI,MAAM,EAAE;IAIrB;;;;;;;;;OASG;IACH,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,SAAS;IAI9B;;;;OAIG;YACW,WAAW;IAcnB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAI9D,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAI9D,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAUpE;;;;;;;;;;OAUG;IACG,UAAU,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAI/D;;;;;;;;;;;;;OAaG;IACG,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,SAAY,GAAG,OAAO,CAAC,eAAe,CAAC;IAMjF,+CAA+C;IACzC,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAI7C,uDAAuD;IACjD,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAMnD,gBAAgB;IAChB,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAItF,mFAAmF;IACnF,iBAAiB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAIjF;;;;;OAKG;YACW,SAAS;IAoBvB,0FAA0F;IAC1F,aAAa,CACX,IAAI,EAAE,SAAS,EACf,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,QAAQ,GAClB,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,mBAAmB,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAI/E,gBAAgB;IAChB,iBAAiB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAIrE,mDAAmD;IACnD,YAAY,CACV,IAAI,EAAE,SAAS,EACf,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,EACrB,OAAO,SAAY,GAClB,OAAO,CAAC,eAAe,CAAC;IAI3B;;;;;;;;;;;;OAYG;YACW,YAAY;IAyC1B;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAQ1B;;;;;;;;;;OAUG;YACW,wBAAwB;IAoBtC;;;;;;OAMG;YACW,UAAU;IAOxB,qEAAqE;YACvD,OAAO;YAgBP,KAAK;IASnB;;;;;OAKG;YACW,MAAM;IAqBpB;;;;;;OAMG;YACW,OAAO;IAwBrB;;;;OAIG;YACW,WAAW;IAoEzB,OAAO,CAAC,aAAa;CAwBtB;AAED;;GAEG;AACH,qBAAa,SAAS;IAElB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBADJ,IAAI,EAAE,IAAI,EACV,IAAI,EAAE,SAAS;IAGlC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAIxD,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAIpE,mGAAmG;IACnG,UAAU,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAIzD,sFAAsF;IACtF,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,SAAY,GAAG,OAAO,CAAC,eAAe,CAAC;IAIrE,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAKpE,6CAA6C;IAC7C,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIvC,qDAAqD;IACrD,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;CAG9C"}