@dudousxd/nestjs-authz 0.8.1 → 0.9.0

package/dist/can-endpoint.controller.js

@@ -10,16 +10,18 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Body, Controller, Inject, Optional } from '@nestjs/common';
+import { Can } from '@nestjs/authorization';
+import { Body, Controller, Inject, Optional, createParamDecorator, } from '@nestjs/common';
 import { Post as HttpPost } from '@nestjs/common';
 import { Gate } from './gate.js';
+import { currentUserOf } from './runtime.js';
 import { RESOURCE_HYDRATOR } from './tokens.js';
 /**
  * Build the opt-in fallback controller class, mounted at `path`. Kept as a
  * factory so the route path is configurable via `AuthzModule.forRoot({ canEndpoint })`.
  *
- * The endpoint runs `gate.allows(ability, resource?)` for the CURRENT (context)
- * user.
+ * The endpoint runs `gate.allows(ability, resource?)` for the caller, read the way
+ * the official guard reads it.
  *
  * RESOURCE REHYDRATION — how per-instance decisions resolve:
  * the client sends a `{ type, id }` shim whose constructor is `Object`, which never
@@ -33,7 +35,11 @@ import { RESOURCE_HYDRATOR } from './tokens.js';
  * (a deliberate, documented fall-through, not a silent dead-end). An unresolved ability
  * is likewise treated as a deny (never a 500).
  */
+/** The caller, read the way the official guard reads it (`getUser`, else `defaultGetUser`). */
+const Caller = createParamDecorator((_data, ctx) => currentUserOf(ctx));
 export function createCanController(path) {
+    // The endpoint answers for any caller (guests get `false`s); the official guard denies
+    // undeclared handlers, so it is opened explicitly.
     let AuthzCanController = class AuthzCanController {
         gate;
         loaders;
@@ -41,10 +47,11 @@ export function createCanController(path) {
             this.gate = gate;
             this.loaders = loaders;
         }
-        async can(body) {
+        async can(body, caller) {
+            const gate = this.gate.forUser(await caller);
             // Array body → batch path (one user/permission resolution for the whole list).
             if (Array.isArray(body)) {
-                return this.canBatch(body);
+                return this.canBatch(gate, body);
             }
             const ability = body?.ability;
             if (typeof ability !== 'string' || ability.length === 0) {
@@ -56,7 +63,7 @@ export function createCanController(path) {
                 // A registered loader that produced nothing → not found → deny.
                 if (target === null)
                     return { allowed: false };
-                const allowed = await this.gate.allows(ability, target);
+                const allowed = await gate.allows(ability, target);
                 return { allowed };
             }
             catch {
@@ -73,7 +80,7 @@ export function createCanController(path) {
          * not-found loader, an empty ability, or an unresolved ability denies that item
          * (never fails the whole batch).
          */
-        async canBatch(items) {
+        async canBatch(gate, items) {
             // Validate + rehydrate each item up front. `verdicts[i] === false` already
             // pins the outright-denials (bad ability / not-found resource); `undefined`
             // means "send to the batch". `batchInput` carries the surviving items plus
@@ -99,7 +106,7 @@ export function createCanController(path) {
             }
             // ONE pass over the surviving items: user + permission set resolved once.
             // `allowsMany` is fault-isolating, so an unresolved ability denies just its item.
-            const results = await this.gate.allowsMany(batchInput.map((b) => b.resource === undefined
+            const results = await gate.allowsMany(batchInput.map((b) => b.resource === undefined
                 ? { ability: b.ability }
                 : { ability: b.ability, resource: b.resource }));
             results.forEach((r, k) => {
@@ -134,11 +141,13 @@ export function createCanController(path) {
     __decorate([
         HttpPost(),
         __param(0, Body()),
+        __param(1, Caller()),
         __metadata("design:type", Function),
-        __metadata("design:paramtypes", [Object]),
+        __metadata("design:paramtypes", [Object, Promise]),
         __metadata("design:returntype", Promise)
     ], AuthzCanController.prototype, "can", null);
     AuthzCanController = __decorate([
+        Can.Anyone(),
         Controller(path),
         __param(1, Optional()),
         __param(1, Inject(RESOURCE_HYDRATOR)),

package/dist/can-endpoint.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"can-endpoint.controller.js","sourceRoot":"","sources":["../src/can-endpoint.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAa,MAAM,gBAAgB,CAAC;AAC/E,OAAO,EAAE,IAAI,IAAI,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAgChD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,IACM,kBAAkB,GADxB,MACM,kBAAkB;QAEH;QAGA;QAJnB,YACmB,IAAU,EAGV,OAA2B;YAH3B,SAAI,GAAJ,IAAI,CAAM;YAGV,YAAO,GAAP,OAAO,CAAoB;QAC3C,CAAC;QAGE,AAAN,KAAK,CAAC,GAAG,CACC,IAA0C;YAElD,+EAA+E;YAC/E,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,CAAC;YAC9B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC5B,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,IAAI,SAAS,CAAC;YAC7C,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;gBAC9C,gEAAgE;gBAChE,IAAI,MAAM,KAAK,IAAI;oBAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;gBAC/C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBACxD,OAAO,EAAE,OAAO,EAAE,CAAC;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,8CAA8C;gBAC9C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC5B,CAAC;QACH,CAAC;QAED;;;;;;;;WAQG;QACK,KAAK,CAAC,QAAQ,CAAC,KAA0B;YAC/C,2EAA2E;YAC3E,4EAA4E;YAC5E,2EAA2E;YAC3E,sDAAsD;YACtD,MAAM,QAAQ,GAA+B,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACrF,MAAM,IAAI,GAAkD,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACpF,MAAM,UAAU,GAAiE,EAAE,CAAC;YAEpF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACtB,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,QAAQ,IAAI,SAAS,CAAC;gBACtC,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,CAAC;gBAC9B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACxD,QAAQ,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;oBACpB,SAAS;gBACX,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,IAAI,SAAS,CAAC,CAAC;gBACjE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;oBACpB,qEAAqE;oBACrE,QAAQ,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;oBACpB,SAAS;gBACX,CAAC;gBACD,UAAU,CAAC,IAAI,CACb,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CACvF,CAAC;YACJ,CAAC;YAED,0EAA0E;YAC1E,kFAAkF;YAClF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CACxC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACnB,CAAC,CAAC,QAAQ,KAAK,SAAS;gBACtB,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;gBACxB,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CACjD,CACF,CAAC;YACF,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;gBACvB,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;gBAC/B,IAAI,QAAQ;oBAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;YACrD,CAAC,CAAC,CAAC;YAEH,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;gBAC3B,MAAM,OAAO,GAAG,OAAO,IAAI,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtE,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;gBACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBACzB,OAAO,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;YAClF,CAAC,CAAC,CAAC;QACL,CAAC;QAED;;;;;;WAMG;QACK,KAAK,CAAC,SAAS,CACrB,QAAgD;YAEhD,IAAI,QAAQ,IAAI,IAAI;gBAAE,OAAO,SAAS,CAAC;YACvC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,OAAO,MAAM,KAAK,UAAU;gBAAE,OAAO,QAAkB,CAAC;YAC5D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAqB,CAAC,CAAC;YAC5D,OAAO,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,MAAiB,CAAC;QACpD,CAAC;KACF,CAAA;IAnGO;QADL,QAAQ,EAAE;QAER,WAAA,IAAI,EAAE,CAAA;;;;iDAqBR;IA/BG,kBAAkB;QADvB,UAAU,CAAC,IAAI,CAAC;QAIZ,WAAA,QAAQ,EAAE,CAAA;QACV,WAAA,MAAM,CAAC,iBAAiB,CAAC,CAAA;yCAFH,IAAI;OAFzB,kBAAkB,CA4GvB;IAED,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,MAAM,yBAAyB,GAAG,WAAW,CAAC"}
+{"version":3,"file":"can-endpoint.controller.js","sourceRoot":"","sources":["../src/can-endpoint.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,uBAAuB,CAAC;AAC5C,OAAO,EACL,IAAI,EACJ,UAAU,EAEV,MAAM,EACN,QAAQ,EAER,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,IAAI,IAAI,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAkB,IAAI,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAgChD;;;;;;;;;;;;;;;;;;GAkBG;AACH,+FAA+F;AAC/F,MAAM,MAAM,GAAG,oBAAoB,CAAC,CAAC,KAAc,EAAE,GAAqB,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;AAEnG,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,uFAAuF;IACvF,mDAAmD;IACnD,IAEM,kBAAkB,GAFxB,MAEM,kBAAkB;QAEH;QAGA;QAJnB,YACmB,IAAU,EAGV,OAA2B;YAH3B,SAAI,GAAJ,IAAI,CAAM;YAGV,YAAO,GAAP,OAAO,CAAoB;QAC3C,CAAC;QAGE,AAAN,KAAK,CAAC,GAAG,CACC,IAA0C,EACxC,MAAwB;YAElC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,MAAM,CAAC,CAAC;YAC7C,+EAA+E;YAC/E,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACnC,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,CAAC;YAC9B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC5B,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,IAAI,SAAS,CAAC;YAC7C,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;gBAC9C,gEAAgE;gBAChE,IAAI,MAAM,KAAK,IAAI;oBAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;gBAC/C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBACnD,OAAO,EAAE,OAAO,EAAE,CAAC;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,8CAA8C;gBAC9C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC5B,CAAC;QACH,CAAC;QAED;;;;;;;;WAQG;QACK,KAAK,CAAC,QAAQ,CACpB,IAAe,EACf,KAA0B;YAE1B,2EAA2E;YAC3E,4EAA4E;YAC5E,2EAA2E;YAC3E,sDAAsD;YACtD,MAAM,QAAQ,GAA+B,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACrF,MAAM,IAAI,GAAkD,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACpF,MAAM,UAAU,GAAiE,EAAE,CAAC;YAEpF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACtB,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,QAAQ,IAAI,SAAS,CAAC;gBACtC,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,CAAC;gBAC9B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACxD,QAAQ,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;oBACpB,SAAS;gBACX,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,IAAI,SAAS,CAAC,CAAC;gBACjE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;oBACpB,qEAAqE;oBACrE,QAAQ,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;oBACpB,SAAS;gBACX,CAAC;gBACD,UAAU,CAAC,IAAI,CACb,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CACvF,CAAC;YACJ,CAAC;YAED,0EAA0E;YAC1E,kFAAkF;YAClF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CACnC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACnB,CAAC,CAAC,QAAQ,KAAK,SAAS;gBACtB,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;gBACxB,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CACjD,CACF,CAAC;YACF,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;gBACvB,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;gBAC/B,IAAI,QAAQ;oBAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;YACrD,CAAC,CAAC,CAAC;YAEH,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;gBAC3B,MAAM,OAAO,GAAG,OAAO,IAAI,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtE,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;gBACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBACzB,OAAO,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;YAClF,CAAC,CAAC,CAAC;QACL,CAAC;QAED;;;;;;WAMG;QACK,KAAK,CAAC,SAAS,CACrB,QAAgD;YAEhD,IAAI,QAAQ,IAAI,IAAI;gBAAE,OAAO,SAAS,CAAC;YACvC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,OAAO,MAAM,KAAK,UAAU;gBAAE,OAAO,QAAkB,CAAC;YAC5D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAqB,CAAC,CAAC;YAC5D,OAAO,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,MAAiB,CAAC;QACpD,CAAC;KACF,CAAA;IAxGO;QADL,QAAQ,EAAE;QAER,WAAA,IAAI,EAAE,CAAA;QACN,WAAA,MAAM,EAAE,CAAA;;;;iDAsBV;IAjCG,kBAAkB;QAFvB,GAAG,CAAC,MAAM,EAAE;QACZ,UAAU,CAAC,IAAI,CAAC;QAIZ,WAAA,QAAQ,EAAE,CAAA;QACV,WAAA,MAAM,CAAC,iBAAiB,CAAC,CAAA;yCAFH,IAAI;OAFzB,kBAAkB,CAiHvB;IAED,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,MAAM,yBAAyB,GAAG,WAAW,CAAC"}

package/dist/decision-provider.d.ts

@@ -4,12 +4,11 @@ import type { PolicyResult, Resource, User } from './types.js';
 /**
  * What a {@link DecisionProvider} answers for one `(user, ability, resource)`:
  *
- * - `true` / `{ allowed: true }` → **allow** (short-circuits the Gate);
- * - `false` / `{ allowed: false, message? }` → **deny** (short-circuits the Gate — unlike the
+ * - `true` / `{ allowed: true }` → **allow** (short-circuits);
+ * - `false` / `{ allowed: false, message? }` → **deny** (short-circuits — unlike the
  *   grant-only {@link PermissionProvider}, a decision provider CAN deny);
  * - `undefined` / `null` → **abstain**: the provider has no opinion (e.g. the resource kind or
- *   the tenant isn't governed by the external engine) and the Gate continues with its normal
- *   resolution (permission provider → policy → ad-hoc gate).
+ *   the tenant isn't governed by the external engine) and resolution continues as usual.
  */
 export type DecisionVerdict = PolicyResult | undefined;
 /** One `(ability, resource)` pair in a {@link DecisionProvider.decideMany} batch. */
@@ -22,28 +21,33 @@ export interface DecisionRequest {
  * authz service, …) — the authoritative, resource-aware counterpart of the grant-only
  * {@link PermissionProvider}. Register it under the {@link DECISION_PROVIDER} token.
  *
- * ## Precedence (single decision)
+ * ## Where it is asked
  *
- * 1. global `superAdmin` hook (receives the resource as 3rd argument) — allow/deny short-circuit;
- * 2. **decision provider** `decide` — allow/deny short-circuit, `undefined` abstains;
- * 3. permission provider grant (RBAC, grant-only);
- * 4. policy `before` → policy method, else ad-hoc gate;
- * 5. global `after` hook (only when the path above had no opinion).
+ * Right after the global `superAdmin` hook (which receives the resource too), everywhere a
+ * decision is made:
  *
- * The provider is also consulted for anonymous callers (`user` is `undefined`) so an engine can
- * allow public access; abstain to keep the Gate's default anonymous-deny.
+ * - **routes**: the official guard runs each policy's `before()`. Policies extending
+ *   `AuthzPolicy` ask `superAdmin`, then `decide(user, ability, firstArg)`. `RolePolicy` and
+ *   `PermissionPolicy` do not ask it: their abilities (`has`, `hasAll`) name no resource.
+ * - **`gate.allows(ability, resource)`**: before the linked policy, the persisted
+ *   permissions and the ad-hoc gate.
+ * - **`gate.allows(PostPolicy, 'update', post)`**: through the policy's `before()`, as above.
+ *
+ * The provider is also consulted for guests (`user` is `null`) so an engine can allow public
+ * access; abstain to keep the default guest-deny.
  *
  * ## Batching
  *
- * `gate.allowsMany(...)` calls {@link decideMany} ONCE for the whole batch when implemented (a
- * list page with N cards costs one engine round-trip instead of N); otherwise `decide` per item.
+ * `gate.allowsMany(...)` calls {@link decideMany} ONCE for the string abilities of the batch
+ * when implemented (a list page with N cards costs one engine round-trip instead of N);
+ * otherwise `decide` per item.
  *
  * ## Query scopes
  *
  * `gate.scope(Entity, ability)` calls {@link planScope} right after the `superAdmin` hook. A
  * returned {@link ScopeConstraint} is used as-is (e.g. an engine's query plan mapped onto the scope
- * AST — see `@dudousxd/nestjs-authz/cerbos`); `undefined` abstains and the Gate falls back to the
- * permission-provider grant / the policy's `scope` method.
+ * AST — see `@dudousxd/nestjs-authz/cerbos`); `undefined` abstains and the policy's `scope`
+ * method decides.
  *
  * Errors thrown by the provider propagate (the check fails loudly). Providers that talk to a
  * remote engine should decide their own failure mode — the Cerbos adapter fails CLOSED (deny).
@@ -55,4 +59,9 @@ export interface DecisionProvider {
     /** Optional query-plan → scope mapping. `undefined` = abstain. */
     planScope?(user: User, entity: Type<unknown>, ability: string): ScopeConstraint | undefined | Promise<ScopeConstraint | undefined>;
 }
+/** A verdict as `{ allowed, message }`; `allowed` is `undefined` when the provider abstains. */
+export declare function normalizeVerdict(verdict: DecisionVerdict | null): {
+    allowed: boolean | undefined;
+    message?: string;
+};
 //# sourceMappingURL=decision-provider.d.ts.map

package/dist/decision-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"decision-provider.d.ts","sourceRoot":"","sources":["../src/decision-provider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAE/D;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,GAAG,YAAY,GAAG,SAAS,CAAC;AAEvD,qFAAqF;AACrF,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CACJ,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,QAAQ,GAClB,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9C,0EAA0E;IAC1E,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IACjF,kEAAkE;IAClE,SAAS,CAAC,CACR,IAAI,EAAE,IAAI,EACV,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,EACrB,OAAO,EAAE,MAAM,GACd,eAAe,GAAG,SAAS,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAC;CACvE"}
+{"version":3,"file":"decision-provider.d.ts","sourceRoot":"","sources":["../src/decision-provider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAE/D;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GAAG,YAAY,GAAG,SAAS,CAAC;AAEvD,qFAAqF;AACrF,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CACJ,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,QAAQ,GAClB,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9C,0EAA0E;IAC1E,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IACjF,kEAAkE;IAClE,SAAS,CAAC,CACR,IAAI,EAAE,IAAI,EACV,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,EACrB,OAAO,EAAE,MAAM,GACd,eAAe,GAAG,SAAS,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAC;CACvE;AAED,gGAAgG;AAChG,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,GAAG;IACjE,OAAO,EAAE,OAAO,GAAG,SAAS,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAQA"}

package/dist/decision-provider.js

@@ -1,2 +1,12 @@
-export {};
+/** A verdict as `{ allowed, message }`; `allowed` is `undefined` when the provider abstains. */
+export function normalizeVerdict(verdict) {
+    if (verdict === true || verdict === false)
+        return { allowed: verdict };
+    if (verdict && typeof verdict === 'object' && typeof verdict.allowed === 'boolean') {
+        return verdict.message === undefined
+            ? { allowed: verdict.allowed }
+            : { allowed: verdict.allowed, message: verdict.message };
+    }
+    return { allowed: undefined };
+}
 //# sourceMappingURL=decision-provider.js.map

package/dist/decision-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"decision-provider.js","sourceRoot":"","sources":["../src/decision-provider.ts"],"names":[],"mappings":""}
+{"version":3,"file":"decision-provider.js","sourceRoot":"","sources":["../src/decision-provider.ts"],"names":[],"mappings":"AAyEA,gGAAgG;AAChG,MAAM,UAAU,gBAAgB,CAAC,OAA+B;IAI9D,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IACvE,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACnF,OAAO,OAAO,CAAC,OAAO,KAAK,SAAS;YAClC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE;YAC9B,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;IAC7D,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAChC,CAAC"}

package/dist/decisions.d.ts

@@ -0,0 +1,24 @@
+import { AuthorizationEvents } from '@nestjs/authorization';
+import { type CallHandler, type ExecutionContext, type NestInterceptor, type OnModuleDestroy, type OnModuleInit } from '@nestjs/common';
+import type { Observable } from 'rxjs';
+/**
+ * Publishes the official guard's decisions on the `authz:decision` channel, allowed and
+ * denied, for Telescope-style watchers (the official package publishes denials only).
+ *
+ * - Denials: the official `AuthorizationEvents` stream, for events the guard raised
+ *   (those with a `handler`). `authorize()` denials come from the `Gate` itself.
+ * - Allows: an interceptor, which runs only once every guard let the call through,
+ *   publishes one decision per official `@Can()` requirement of the handler.
+ *
+ * Nothing is computed while the channel has no subscriber.
+ */
+export declare class AuthzDecisionPublisher implements NestInterceptor, OnModuleInit, OnModuleDestroy {
+    private readonly events?;
+    private subscription;
+    constructor(events?: AuthorizationEvents | undefined);
+    onModuleInit(): void;
+    onModuleDestroy(): void;
+    intercept(context: ExecutionContext, next: CallHandler): Observable<unknown>;
+    private publishAllows;
+}
+//# sourceMappingURL=decisions.d.ts.map

package/dist/decisions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decisions.d.ts","sourceRoot":"","sources":["../src/decisions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,gBAAgB,EAErB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,YAAY,EAGlB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,UAAU,EAAgB,MAAM,MAAM,CAAC;AAOrD;;;;;;;;;;GAUG;AACH,qBACa,sBAAuB,YAAW,eAAe,EAAE,YAAY,EAAE,eAAe;IAGnE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAFhD,OAAO,CAAC,YAAY,CAA2B;gBAEN,MAAM,CAAC,EAAE,mBAAmB,YAAA;IAErE,YAAY,IAAI,IAAI;IAUpB,eAAe,IAAI,IAAI;IAIvB,SAAS,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC;YAK9D,aAAa;CAmB5B"}

package/dist/decisions.js

@@ -0,0 +1,87 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { AuthorizationEvents } from '@nestjs/authorization';
+import { Injectable, Optional, } from '@nestjs/common';
+import { authzDecisionChannel, publishAuthzDecision } from './diagnostics.js';
+import { authorizedResource } from './helpers.js';
+import { getPolicyResource } from './links.js';
+import { routeRequirements } from './official.js';
+import { currentUserOf } from './runtime.js';
+/**
+ * Publishes the official guard's decisions on the `authz:decision` channel, allowed and
+ * denied, for Telescope-style watchers (the official package publishes denials only).
+ *
+ * - Denials: the official `AuthorizationEvents` stream, for events the guard raised
+ *   (those with a `handler`). `authorize()` denials come from the `Gate` itself.
+ * - Allows: an interceptor, which runs only once every guard let the call through,
+ *   publishes one decision per official `@Can()` requirement of the handler.
+ *
+ * Nothing is computed while the channel has no subscriber.
+ */
+let AuthzDecisionPublisher = class AuthzDecisionPublisher {
+    events;
+    subscription;
+    constructor(events) {
+        this.events = events;
+    }
+    onModuleInit() {
+        this.subscription = this.events?.events$.subscribe((event) => {
+            if (event.handler === undefined || event.ability === null)
+                return;
+            publishAuthzDecision(event.ability, false, 'route', event.user, firstObject(event.args), {
+                policy: event.policy,
+                handler: event.handler,
+            });
+        });
+    }
+    onModuleDestroy() {
+        this.subscription?.unsubscribe();
+    }
+    intercept(context, next) {
+        if (authzDecisionChannel.hasSubscribers)
+            void this.publishAllows(context);
+        return next.handle();
+    }
+    async publishAllows(context) {
+        try {
+            const type = context.getClass();
+            const handler = context.getHandler();
+            const requirements = routeRequirements(type, handler);
+            if (requirements.length === 0)
+                return;
+            const user = await currentUserOf(context);
+            for (const { policy, ability } of requirements) {
+                const linked = getPolicyResource(policy);
+                const resource = linked ? authorizedResource(context, linked) : undefined;
+                publishAuthzDecision(ability, true, 'route', user, resource, {
+                    policy: policy.name,
+                    handler: `${type.name}.${handler.name}`,
+                });
+            }
+        }
+        catch {
+            // Observability never breaks a request.
+        }
+    }
+};
+AuthzDecisionPublisher = __decorate([
+    Injectable(),
+    __param(0, Optional()),
+    __metadata("design:paramtypes", [AuthorizationEvents])
+], AuthzDecisionPublisher);
+export { AuthzDecisionPublisher };
+function firstObject(args) {
+    const first = args[0];
+    return first !== null && typeof first === 'object' ? first : undefined;
+}
+//# sourceMappingURL=decisions.js.map

package/dist/decisions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decisions.js","sourceRoot":"","sources":["../src/decisions.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAGL,UAAU,EAIV,QAAQ,GAET,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C;;;;;;;;;;GAUG;AAEI,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IAGQ;IAFjC,YAAY,CAA2B;IAE/C,YAAyC,MAA4B;QAA5B,WAAM,GAAN,MAAM,CAAsB;IAAG,CAAC;IAEzE,YAAY;QACV,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE;YAC3D,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI;gBAAE,OAAO;YAClE,oBAAoB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE;gBACvF,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,eAAe;QACb,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,CAAC;IACnC,CAAC;IAED,SAAS,CAAC,OAAyB,EAAE,IAAiB;QACpD,IAAI,oBAAoB,CAAC,cAAc;YAAE,KAAK,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC1E,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,OAAyB;QACnD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,EAAmB,CAAC;YACjD,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;YACrC,MAAM,YAAY,GAAG,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACtD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO;YACtC,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;YAC1C,KAAK,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,YAAY,EAAE,CAAC;gBAC/C,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;gBACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC1E,oBAAoB,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAA8B,EAAE;oBACjF,MAAM,EAAE,MAAM,CAAC,IAAI;oBACnB,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE;iBACxC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wCAAwC;QAC1C,CAAC;IACH,CAAC;CACF,CAAA;AA3CY,sBAAsB;IADlC,UAAU,EAAE;IAIE,WAAA,QAAQ,EAAE,CAAA;qCAA2B,mBAAmB;GAH1D,sBAAsB,CA2ClC;;AAED,SAAS,WAAW,CAAC,IAAwB;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACzE,CAAC"}

package/dist/decorator/roles.decorator.d.ts

@@ -1,15 +1,9 @@
-import 'reflect-metadata';
 /**
- * Guard a route by COARSE role membership: the request is allowed when the current
- * user holds ANY of the listed roles. This is the broad "is teacher?" check, as
- * opposed to the granular ability check of `@Can`.
- *
- * Roles come from the user object (`user.roles` / `user.role`) by default, plus the
- * optional `ROLE_PROVIDER` seam (a persisted RBAC store) when registered — see
- * {@link RolesGuard}.
- *
- * @example
- *   `@Roles('admin', 'teacher')`  // allow if the user is an admin OR a teacher
+ * Sugar for the official `@Can(RolePolicy, 'has', roles(...names))`: the user holds any
+ * of the roles. Stacks with other `@Can()`s (all must pass); a class-level `@Roles`
+ * applies to every handler, together with the method's.
  */
-export declare function Roles(...roles: string[]): MethodDecorator & ClassDecorator;
+export declare function Roles(...names: string[]): MethodDecorator & ClassDecorator;
+/** Sugar for the official `@Can(PermissionPolicy, 'has', permission(...names))`: any of the permissions. */
+export declare function Permission(...names: string[]): MethodDecorator & ClassDecorator;
 //# sourceMappingURL=roles.decorator.d.ts.map

package/dist/decorator/roles.decorator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"roles.decorator.d.ts","sourceRoot":"","sources":["../../src/decorator/roles.decorator.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAI1B;;;;;;;;;;;GAWG;AACH,wBAAgB,KAAK,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,eAAe,GAAG,cAAc,CAE1E"}
+{"version":3,"file":"roles.decorator.d.ts","sourceRoot":"","sources":["../../src/decorator/roles.decorator.ts"],"names":[],"mappings":"AAKA;;;;GAIG;AACH,wBAAgB,KAAK,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,eAAe,GAAG,cAAc,CAE1E;AAED,4GAA4G;AAC5G,wBAAgB,UAAU,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,eAAe,GAAG,cAAc,CAE/E"}

package/dist/decorator/roles.decorator.js

@@ -1,19 +1,17 @@
-import 'reflect-metadata';
-import { SetMetadata } from '@nestjs/common';
-import { ROLES_METADATA } from '../tokens.js';
+import { Can } from '@nestjs/authorization';
+import { permission, roles } from '../helpers.js';
+import { PermissionPolicy } from '../policies/permission.policy.js';
+import { RolePolicy } from '../policies/role.policy.js';
 /**
- * Guard a route by COARSE role membership: the request is allowed when the current
- * user holds ANY of the listed roles. This is the broad "is teacher?" check, as
- * opposed to the granular ability check of `@Can`.
- *
- * Roles come from the user object (`user.roles` / `user.role`) by default, plus the
- * optional `ROLE_PROVIDER` seam (a persisted RBAC store) when registered — see
- * {@link RolesGuard}.
- *
- * @example
- *   `@Roles('admin', 'teacher')`  // allow if the user is an admin OR a teacher
+ * Sugar for the official `@Can(RolePolicy, 'has', roles(...names))`: the user holds any
+ * of the roles. Stacks with other `@Can()`s (all must pass); a class-level `@Roles`
+ * applies to every handler, together with the method's.
  */
-export function Roles(...roles) {
-    return SetMetadata(ROLES_METADATA, roles);
+export function Roles(...names) {
+    return Can(RolePolicy, 'has', roles(...names));
+}
+/** Sugar for the official `@Can(PermissionPolicy, 'has', permission(...names))`: any of the permissions. */
+export function Permission(...names) {
+    return Can(PermissionPolicy, 'has', permission(...names));
 }
 //# sourceMappingURL=roles.decorator.js.map

package/dist/decorator/roles.decorator.js.map

@@ -1 +1 @@
-{"version":3,"file":"roles.decorator.js","sourceRoot":"","sources":["../../src/decorator/roles.decorator.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,KAAK,CAAC,GAAG,KAAe;IACtC,OAAO,WAAW,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;AAC5C,CAAC"}
+{"version":3,"file":"roles.decorator.js","sourceRoot":"","sources":["../../src/decorator/roles.decorator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,uBAAuB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAExD;;;;GAIG;AACH,MAAM,UAAU,KAAK,CAAC,GAAG,KAAe;IACtC,OAAO,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,UAAU,CAAC,GAAG,KAAe;IAC3C,OAAO,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,UAAU,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;AAC5D,CAAC"}

package/dist/diagnostics.d.ts

@@ -10,9 +10,10 @@ import type { Resource, User } from './types.js';
  */
 export declare const authzDecisionChannel: import("diagnostics_channel").Channel<unknown, unknown>;
 /**
- * Every authorization decision the {@link Gate} reaches, published once per
- * `allows`/`authorize`/`denies` call. `reason` names which resolution path
- * produced the verdict so a 403 is debuggable.
+ * Every authorization decision, allowed or denied: each `Gate` check, and each official
+ * `@Can()` requirement the guard enforced (`reason: 'route'`). The official package
+ * publishes only denials, on `nestjs:authorization:denied`; this channel carries both,
+ * for Telescope-style watchers.
  */
 export interface AuthzDecisionDiagnostic {
     v: 1;
@@ -22,6 +23,10 @@ export interface AuthzDecisionDiagnostic {
     allowed: boolean;
     /** Which resolution path decided it (see {@link AuthzDecisionReason}). */
     reason: AuthzDecisionReason;
+    /** The official policy class that decided, e.g. `'PostPolicy'`, or `null` when none did. */
+    policy: string | null;
+    /** The handler the official guard checked (`Class.method`), or `null` for a `Gate` call. */
+    handler: string | null;
     /** A label for the resolved user (`<type>#<id>` / constructor name), or `null` when anonymous. */
     userRef: string | null;
     /** The resource class name the ability targeted, or `null` for a model-less ability. */
@@ -30,10 +35,15 @@ export interface AuthzDecisionDiagnostic {
     resourceId: string | number | null;
 }
 /** The resolution path that produced a decision — the "why" behind a 403 (or a grant). */
-export type AuthzDecisionReason = 'super-admin' | 'decision-provider' | 'permission-provider' | 'policy-before' | 'policy' | 'gate' | 'after' | 'anonymous';
+export type AuthzDecisionReason = 'super-admin' | 'decision-provider' | 'permission-provider' | 'policy' | 'gate' | 'anonymous' | 'route';
+/** Where a decision came from, beyond the verdict. */
+export interface AuthzDecisionSource {
+    policy?: string | null;
+    handler?: string | null;
+}
 /**
  * Publish a decision to the channel, but only when something is listening. Never
  * throws — building the payload or notifying a subscriber must not break a check.
  */
-export declare function publishAuthzDecision(ability: string, allowed: boolean, reason: AuthzDecisionReason, user: User, resource: Resource | undefined): void;
+export declare function publishAuthzDecision(ability: string, allowed: boolean, reason: AuthzDecisionReason, user: User, resource: Resource | undefined, source?: AuthzDecisionSource): void;
 //# sourceMappingURL=diagnostics.d.ts.map

package/dist/diagnostics.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"diagnostics.d.ts","sourceRoot":"","sources":["../src/diagnostics.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAEjD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,yDAAkC,CAAC;AAEpE;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,CAAC,EAAE,CAAC,CAAC;IACL,gEAAgE;IAChE,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,OAAO,EAAE,OAAO,CAAC;IACjB,0EAA0E;IAC1E,MAAM,EAAE,mBAAmB,CAAC;IAC5B,kGAAkG;IAClG,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,wFAAwF;IACxF,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,0EAA0E;IAC1E,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,0FAA0F;AAC1F,MAAM,MAAM,mBAAmB,GAC3B,aAAa,GACb,mBAAmB,GACnB,qBAAqB,GACrB,eAAe,GACf,QAAQ,GACR,MAAM,GACN,OAAO,GACP,WAAW,CAAC;AAEhB;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,mBAAmB,EAC3B,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,QAAQ,GAAG,SAAS,GAC7B,IAAI,CAcN"}
+{"version":3,"file":"diagnostics.d.ts","sourceRoot":"","sources":["../src/diagnostics.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAEjD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,yDAAkC,CAAC;AAEpE;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,CAAC,EAAE,CAAC,CAAC;IACL,gEAAgE;IAChE,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,OAAO,EAAE,OAAO,CAAC;IACjB,0EAA0E;IAC1E,MAAM,EAAE,mBAAmB,CAAC;IAC5B,4FAA4F;IAC5F,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,4FAA4F;IAC5F,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,kGAAkG;IAClG,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,wFAAwF;IACxF,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,0EAA0E;IAC1E,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,0FAA0F;AAC1F,MAAM,MAAM,mBAAmB,GAC3B,aAAa,GACb,mBAAmB,GACnB,qBAAqB,GACrB,QAAQ,GACR,MAAM,GACN,WAAW,GACX,OAAO,CAAC;AAEZ,sDAAsD;AACtD,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,mBAAmB,EAC3B,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,QAAQ,GAAG,SAAS,EAC9B,MAAM,GAAE,mBAAwB,GAC/B,IAAI,CAgBN"}

package/dist/diagnostics.js

@@ -13,7 +13,7 @@ export const authzDecisionChannel = getChannel('authz', 'decision');
  * Publish a decision to the channel, but only when something is listening. Never
  * throws — building the payload or notifying a subscriber must not break a check.
  */
-export function publishAuthzDecision(ability, allowed, reason, user, resource) {
+export function publishAuthzDecision(ability, allowed, reason, user, resource, source = {}) {
     if (!authzDecisionChannel.hasSubscribers)
         return;
     const payload = {
@@ -21,6 +21,8 @@ export function publishAuthzDecision(ability, allowed, reason, user, resource) {
         ability,
         allowed,
         reason,
+        policy: source.policy ?? null,
+        handler: source.handler ?? null,
         userRef: labelUser(user),
         resourceType: resourceType(resource),
         resourceId: resourceId(resource),

package/dist/diagnostics.js.map

@@ -1 +1 @@
-{"version":3,"file":"diagnostics.js","sourceRoot":"","sources":["../src/diagnostics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAGhE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAkCpE;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,OAAgB,EAChB,MAA2B,EAC3B,IAAU,EACV,QAA8B;IAE9B,IAAI,CAAC,oBAAoB,CAAC,cAAc;QAAE,OAAO;IACjD,MAAM,OAAO,GAA4B;QACvC,CAAC,EAAE,CAAC;QACJ,OAAO;QACP,OAAO;QACP,MAAM;QACN,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC;QACxB,YAAY,EAAE,YAAY,CAAC,QAAQ,CAAC;QACpC,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC;KACjC,CAAC;IACF,gFAAgF;IAChF,+EAA+E;IAC/E,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,4FAA4F;AAC5F,SAAS,SAAS,CAAC,IAAU;IAC3B,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,IAA+B,CAAC;QAC5C,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,WAAW,EAAE,IAAI,CAAuB,CAAC;QACvE,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC;QAClB,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,CAAC;YAAE,OAAO,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;QACvF,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpF,OAAO,GAAG,CAAC,WAAW,EAAE,IAAI,IAAI,IAAI,CAAC;IACvC,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;AACtB,CAAC;AAED,sGAAsG;AACtG,SAAS,YAAY,CAAC,QAA8B;IAClD,IAAI,QAAQ,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,OAAO,QAAQ,KAAK,UAAU;QAAE,OAAQ,QAA8B,CAAC,IAAI,IAAI,IAAI,CAAC;IACxF,OAAQ,QAAgD,CAAC,WAAW,EAAE,IAAI,IAAI,IAAI,CAAC;AACrF,CAAC;AAED,kFAAkF;AAClF,SAAS,UAAU,CAAC,QAA8B;IAChD,IAAI,QAAQ,IAAI,IAAI,IAAI,OAAO,QAAQ,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IACpE,MAAM,EAAE,GAAI,QAAoC,CAAC,EAAE,CAAC;IACpD,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC"}
+{"version":3,"file":"diagnostics.js","sourceRoot":"","sources":["../src/diagnostics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAGhE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AA4CpE;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,OAAgB,EAChB,MAA2B,EAC3B,IAAU,EACV,QAA8B,EAC9B,SAA8B,EAAE;IAEhC,IAAI,CAAC,oBAAoB,CAAC,cAAc;QAAE,OAAO;IACjD,MAAM,OAAO,GAA4B;QACvC,CAAC,EAAE,CAAC;QACJ,OAAO;QACP,OAAO;QACP,MAAM;QACN,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI;QAC7B,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;QAC/B,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC;QACxB,YAAY,EAAE,YAAY,CAAC,QAAQ,CAAC;QACpC,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC;KACjC,CAAC;IACF,gFAAgF;IAChF,+EAA+E;IAC/E,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,4FAA4F;AAC5F,SAAS,SAAS,CAAC,IAAU;IAC3B,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,IAA+B,CAAC;QAC5C,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,WAAW,EAAE,IAAI,CAAuB,CAAC;QACvE,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC;QAClB,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,CAAC;YAAE,OAAO,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;QACvF,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpF,OAAO,GAAG,CAAC,WAAW,EAAE,IAAI,IAAI,IAAI,CAAC;IACvC,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;AACtB,CAAC;AAED,sGAAsG;AACtG,SAAS,YAAY,CAAC,QAA8B;IAClD,IAAI,QAAQ,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,OAAO,QAAQ,KAAK,UAAU;QAAE,OAAQ,QAA8B,CAAC,IAAI,IAAI,IAAI,CAAC;IACxF,OAAQ,QAAgD,CAAC,WAAW,EAAE,IAAI,IAAI,IAAI,CAAC;AACrF,CAAC;AAED,kFAAkF;AAClF,SAAS,UAAU,CAAC,QAA8B;IAChD,IAAI,QAAQ,IAAI,IAAI,IAAI,OAAO,QAAQ,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IACpE,MAAM,EAAE,GAAI,QAAoC,CAAC,EAAE,CAAC;IACpD,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC"}

package/dist/errors/exceptions.d.ts

@@ -2,10 +2,6 @@ import { BadRequestException } from '@nestjs/common';
 export declare abstract class AuthzException extends Error {
     constructor(message: string);
 }
-export declare class PolicyNotDecoratedException extends AuthzException {
-    readonly policyName: string;
-    constructor(policyName: string);
-}
 /**
  * Thrown when an ability cannot be matched to any policy method or ad-hoc gate.
  *
@@ -30,8 +26,4 @@ export declare class AmbiguousAbilityException extends BadRequestException {
     readonly name = "AmbiguousAbilityException";
     constructor(ability: string, policyNames: string[]);
 }
-export declare class ResourceResolverMissingException extends AuthzException {
-    readonly ability: string;
-    constructor(ability: string);
-}
 //# sourceMappingURL=exceptions.d.ts.map

package/dist/errors/exceptions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"exceptions.d.ts","sourceRoot":"","sources":["../../src/errors/exceptions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD,8BAAsB,cAAe,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,2BAA4B,SAAQ,cAAc;aACjC,UAAU,EAAE,MAAM;gBAAlB,UAAU,EAAE,MAAM;CAG/C;AAED;;;;;;GAMG;AACH,qBAAa,2BAA4B,SAAQ,mBAAmB;aAEtC,OAAO,EAAE,MAAM;IAD3C,SAAkB,IAAI,iCAAiC;gBAC3B,OAAO,EAAE,MAAM;CAK5C;AAED;;;;;GAKG;AACH,qBAAa,yBAA0B,SAAQ,mBAAmB;aAG9C,OAAO,EAAE,MAAM;aACf,WAAW,EAAE,MAAM,EAAE;IAHvC,SAAkB,IAAI,+BAA+B;gBAEnC,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EAAE;CAQxC;AAED,qBAAa,gCAAiC,SAAQ,cAAc;aACtC,OAAO,EAAE,MAAM;gBAAf,OAAO,EAAE,MAAM;CAK5C"}
+{"version":3,"file":"exceptions.d.ts","sourceRoot":"","sources":["../../src/errors/exceptions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD,8BAAsB,cAAe,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;GAMG;AACH,qBAAa,2BAA4B,SAAQ,mBAAmB;aAEtC,OAAO,EAAE,MAAM;IAD3C,SAAkB,IAAI,iCAAiC;gBAC3B,OAAO,EAAE,MAAM;CAK5C;AAED;;;;;GAKG;AACH,qBAAa,yBAA0B,SAAQ,mBAAmB;aAG9C,OAAO,EAAE,MAAM;aACf,WAAW,EAAE,MAAM,EAAE;IAHvC,SAAkB,IAAI,+BAA+B;gBAEnC,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EAAE;CAQxC"}

package/dist/errors/exceptions.js

@@ -5,13 +5,6 @@ export class AuthzException extends Error {
         this.name = new.target.name;
     }
 }
-export class PolicyNotDecoratedException extends AuthzException {
-    policyName;
-    constructor(policyName) {
-        super(`${policyName} is missing @Policy(Resource). Decorate it with the resource class.`);
-        this.policyName = policyName;
-    }
-}
 /**
  * Thrown when an ability cannot be matched to any policy method or ad-hoc gate.
  *
@@ -43,11 +36,4 @@ export class AmbiguousAbilityException extends BadRequestException {
         this.policyNames = policyNames;
     }
 }
-export class ResourceResolverMissingException extends AuthzException {
-    ability;
-    constructor(ability) {
-        super(`@Can('${ability}', Resource) needs an instance but no ResourceResolver is registered. Register one via AuthzModule.forRoot or pass the resource programmatically.`);
-        this.ability = ability;
-    }
-}
 //# sourceMappingURL=exceptions.js.map

package/dist/errors/exceptions.js.map

@@ -1 +1 @@
-{"version":3,"file":"exceptions.js","sourceRoot":"","sources":["../../src/errors/exceptions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD,MAAM,OAAgB,cAAe,SAAQ,KAAK;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;IAC9B,CAAC;CACF;AAED,MAAM,OAAO,2BAA4B,SAAQ,cAAc;IACjC;IAA5B,YAA4B,UAAkB;QAC5C,KAAK,CAAC,GAAG,UAAU,qEAAqE,CAAC,CAAC;QADhE,eAAU,GAAV,UAAU,CAAQ;IAE9C,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,2BAA4B,SAAQ,mBAAmB;IAEtC;IADV,IAAI,GAAG,6BAA6B,CAAC;IACvD,YAA4B,OAAe;QACzC,KAAK,CACH,YAAY,OAAO,sEAAsE,OAAO,UAAU,CAC3G,CAAC;QAHwB,YAAO,GAAP,OAAO,CAAQ;IAI3C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,yBAA0B,SAAQ,mBAAmB;IAG9C;IACA;IAHA,IAAI,GAAG,2BAA2B,CAAC;IACrD,YACkB,OAAe,EACf,WAAqB;QAErC,KAAK,CACH,YAAY,OAAO,uDAAuD,WAAW,CAAC,IAAI,CACxF,IAAI,CACL,4DAA4D,OAAO,eAAe,CACpF,CAAC;QAPc,YAAO,GAAP,OAAO,CAAQ;QACf,gBAAW,GAAX,WAAW,CAAU;IAOvC,CAAC;CACF;AAED,MAAM,OAAO,gCAAiC,SAAQ,cAAc;IACtC;IAA5B,YAA4B,OAAe;QACzC,KAAK,CACH,SAAS,OAAO,mJAAmJ,CACpK,CAAC;QAHwB,YAAO,GAAP,OAAO,CAAQ;IAI3C,CAAC;CACF"}
+{"version":3,"file":"exceptions.js","sourceRoot":"","sources":["../../src/errors/exceptions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD,MAAM,OAAgB,cAAe,SAAQ,KAAK;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;IAC9B,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,2BAA4B,SAAQ,mBAAmB;IAEtC;IADV,IAAI,GAAG,6BAA6B,CAAC;IACvD,YAA4B,OAAe;QACzC,KAAK,CACH,YAAY,OAAO,sEAAsE,OAAO,UAAU,CAC3G,CAAC;QAHwB,YAAO,GAAP,OAAO,CAAQ;IAI3C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,yBAA0B,SAAQ,mBAAmB;IAG9C;IACA;IAHA,IAAI,GAAG,2BAA2B,CAAC;IACrD,YACkB,OAAe,EACf,WAAqB;QAErC,KAAK,CACH,YAAY,OAAO,uDAAuD,WAAW,CAAC,IAAI,CACxF,IAAI,CACL,4DAA4D,OAAO,eAAe,CACpF,CAAC;QAPc,YAAO,GAAP,OAAO,CAAQ;QACf,gBAAW,GAAX,WAAW,CAAU;IAOvC,CAAC;CACF"}