@dudousxd/nestjs-authz 0.8.1 → 0.9.0

package/dist/gate.d.ts

@@ -1,271 +1,136 @@
+import { type Ability, AuthorizationService } from '@nestjs/authorization';
 import { type Type } from '@nestjs/common';
-import { ModuleRef } from '@nestjs/core';
-import type { ContextAccessor } from './context-accessor.js';
-import type { DecisionProvider } from './decision-provider.js';
-import { type AuthzDecisionReason } from './diagnostics.js';
-import type { PermissionProvider } from './permission-provider.js';
-import { PolicyRegistry } from './policy-registry.js';
-import { type RoleProvider } from './role-provider.js';
+import { PolicyIndex } from './policy-index.js';
+import { AuthzRbac } from './rbac.js';
 import { type ScopeConstraint } from './scope.js';
 import type { AuthzModuleOptions, GateFn, Resource, User } from './types.js';
-declare const NO_USER: unique symbol;
-type MaybeUser = User | typeof NO_USER;
-/** A single item in a {@link Gate.allowsMany} batch. */
+/** The arguments after the user of ability `A` on policy `P`. */
+export type AbilityArgsOf<P, A extends keyof P> = P[A] extends (user: never, ...args: infer R) => unknown ? R : never;
+/** A string ability, optionally on a resource (instance, or class for class-level abilities). */
 export interface BatchAbility {
     ability: string;
     resource?: Resource;
 }
-/** A single result from a {@link Gate.allowsMany} batch: the input plus its verdict. */
-export interface BatchResult {
+/** An official policy check: `policy[ability](user, ...args)`. */
+export interface BatchPolicyCheck {
+    policy: Type<unknown>;
     ability: string;
-    resource?: Resource;
-    allowed: boolean;
+    args?: readonly unknown[];
 }
+/** One item of a {@link Gate.allowsMany} batch. */
+export type BatchItem = BatchAbility | BatchPolicyCheck;
+/** One result of a {@link Gate.allowsMany} batch: the item plus its verdict. */
+export type BatchResult = BatchItem & {
+    allowed: boolean;
+};
 /**
- * Laravel-style authorization Gate.
+ * A façade over the official `AuthorizationService` for service-layer checks, with what
+ * the official service does not have:
  *
- * Resolves an ability against either a registered `@Policy` method (by ability
- * name, matched against the resource's policy) or an ad-hoc gate defined via
- * {@link define}. Applies the global `superAdmin` before-hook and the per-policy
- * `before` hook with short-circuit semantics.
+ * - **string abilities**, Laravel-style: `gate.allows('update', post)` finds the policy
+ *   linked to `Post` with `@PolicyFor(Post)`; `gate.allows('access-admin')` runs an
+ *   ad-hoc gate from {@link define}; `gate.allows('posts.publish')` asks the persisted
+ *   permissions. Asks `superAdmin` first, then the external decision point
+ *   (`DECISION_PROVIDER`), then the policy — which has the final word: a persisted
+ *   permission named like the ability does not bypass it — then the persisted
+ *   permissions, then the ad-hoc gate.
+ * - **official policy checks**: `gate.allows(PostPolicy, 'update', post)`, exactly
+ *   `AuthorizationService.can()`.
+ * - **batches** ({@link allowsMany}) sharing one permission fetch, **query scopes**
+ *   ({@link scope}), **roles** ({@link hasRole}), an allow+deny decision event, and an
+ *   ambient user when none is passed ({@link forUser} passes one): `@nestjs/authentication`'s
+ *   `AuthenticationContext.user` when that package is installed, else nestjs-context's.
  *
- * The current user comes from the optional {@link ContextAccessor} (nestjs-context)
- * when present, or is supplied explicitly via {@link forUser}.
+ * Every policy decision is the official service's: the policy's own `before()`, then
+ * the ability, allowed only on a literal `true`.
  */
 export declare class Gate {
-    private readonly policies;
-    private readonly context?;
-    private readonly moduleRef?;
-    private readonly permissionProvider?;
-    private readonly roleProvider?;
-    private readonly decisionProvider?;
+    private readonly index;
+    private readonly rbac;
     private readonly gates;
     private readonly superAdmin;
-    private readonly after;
-    private readonly resolveUser;
-    private readonly roleResolver;
-    private contextResolved;
-    private contextCached;
-    private permissionProviderResolved;
-    private permissionProviderCached;
-    private roleProviderResolved;
-    private roleProviderCached;
-    private decisionProviderResolved;
-    private decisionProviderCached;
-    constructor(policies: PolicyRegistry, options: AuthzModuleOptions | undefined, context?: ContextAccessor | undefined, moduleRef?: ModuleRef | undefined, permissionProvider?: PermissionProvider | undefined, roleProvider?: RoleProvider | undefined, decisionProvider?: DecisionProvider | undefined);
-    /**
-     * Locate the context accessor. Prefers the value injected into this module;
-     * falls back to a non-strict {@link ModuleRef} lookup so an accessor provided
-     * by ANY module (e.g. a global ContextModule, or the app root) is still found.
-     */
-    private resolveContext;
-    /**
-     * Locate the optional {@link PermissionProvider} (the RBAC seam). Prefers the value
-     * injected into this module; falls back to a non-strict {@link ModuleRef} lookup so a
-     * provider registered by ANY module (e.g. the RBAC adapter's global module) is found.
-     */
-    private resolvePermissionProvider;
-    /**
-     * Locate the optional {@link RoleProvider} (the coarse role seam). Prefers the value
-     * injected into this module; falls back to a non-strict {@link ModuleRef} lookup so a
-     * provider registered by ANY module (e.g. the RBAC adapter's global module) is found.
-     */
-    private resolveRoleProvider;
-    /**
-     * Locate the optional {@link DecisionProvider} (the external-PDP seam). Same lookup strategy as
-     * {@link resolvePermissionProvider}: injected value first, then a memoized non-strict scan.
-     */
-    private resolveDecisionProvider;
-    /**
-     * The per-request {@link PermissionCache}, stashed on the nestjs-context store so
-     * every check within one HTTP request shares a single `getPermissions` fetch
-     * (kills the N+1 a list page would otherwise cause). Returns `undefined` when no
-     * context store is available (standalone use), in which case callers fall back to
-     * a transient cache (e.g. one per `allowsMany` batch) or no memoization.
-     */
-    private resolveRequestCache;
-    /** The nestjs-context store for the current request, or `undefined` when there is none. */
-    private requestStore;
+    private readonly authz;
+    constructor(authz: AuthorizationService | undefined, index: PolicyIndex, rbac: AuthzRbac, options?: AuthzModuleOptions);
     /** Register an ad-hoc, model-less gate resolved by `ability` name. */
     define(ability: string, fn: GateFn): this;
     /** True when an ad-hoc gate is registered for `ability`. */
     hasGate(ability: string): boolean;
-    /**
-     * Names of every ad-hoc gate registered via {@link define}. Used by integrations
-     * (e.g. `@dudousxd/nestjs-authz-inertia`) that enumerate the user's class-level
-     * abilities to share them as Inertia props — no network round-trip needed.
-     */
+    /** Names of every ad-hoc gate registered with {@link define}. */
     gateNames(): string[];
     /**
-     * Bind an explicit user, bypassing the context accessor. Use when no
-     * nestjs-context is wired, or to check a user other than the current one.
-     *
-     * A nullish user (`forUser(undefined)` / `forUser(null)`) is an explicit
-     * anonymous request: it maps to the same deny path as an unauthenticated
-     * context (`NO_USER`), so policies/gates are never invoked with `undefined` and
-     * never throw. The `resolveUser` hook is NOT applied to `forUser` — the value
-     * you pass is used verbatim.
+     * Bind an explicit user. `null`/`undefined` is a guest. The usual way to check in a
+     * service: pass the user your handler received.
      */
     forUser(user: User): BoundGate;
     /**
-     * Resolve the current user from the context accessor, or `NO_USER`.
-     * When a `resolveUser` hook is configured, hydrate the full entity from the
-     * context's {@link UserRef}; a hook returning nullish maps to `NO_USER`. The
-     * hydrated user is memoized on the request's context store by `type:id`, so the
-     * hook runs once per request rather than once per check.
+     * The ambient user, for calls without {@link forUser}: `@nestjs/authentication`'s
+     * `AuthenticationContext.user` when that optional peer is installed and has one, else
+     * nestjs-context's user ref (hydrated by `resolveUser` when configured, once per
+     * request). `null` without either.
      */
     private currentUser;
+    allows<P, const A extends Ability<P>>(policy: Type<P>, ability: A, ...args: AbilityArgsOf<P, A>): Promise<boolean>;
     allows(ability: string, resource?: Resource): Promise<boolean>;
+    denies<P, const A extends Ability<P>>(policy: Type<P>, ability: A, ...args: AbilityArgsOf<P, A>): Promise<boolean>;
     denies(ability: string, resource?: Resource): Promise<boolean>;
-    authorize(ability: string, resource?: Resource): Promise<void>;
     /**
-     * Authorize MANY abilities for the current (context) user in a single pass. The
-     * user is resolved ONCE and a single {@link PermissionCache} is shared across all
-     * items, so a list page (N cards) costs one user resolution + at most one
-     * permission fetch instead of N of each. Order is preserved; each result echoes
-     * its input `ability`/`resource` plus the `allowed` verdict.
-     *
-     * Fault-isolating: an item whose ability is unresolved/ambiguous denies just
-     * THAT item (it does not throw and abort the batch) — a batch is a best-effort
-     * verdict list, not an enforcement gate.
+     * Like {@link allows}, but throws the official `AuthorizationError` on a denial, which
+     * the official module turns into a 401/403 (or the transport's error) when it leaves
+     * a handler.
      */
-    allowsMany(items: BatchAbility[]): Promise<BatchResult[]>;
+    authorize<P, const A extends Ability<P>>(policy: Type<P>, ability: A, ...args: AbilityArgsOf<P, A>): Promise<void>;
+    authorize(ability: string, resource?: Resource): Promise<void>;
+    /** Check many abilities at once (one user, one permission fetch). A failing item denies. */
+    allowsMany(items: readonly BatchItem[]): Promise<BatchResult[]>;
     /**
-     * Resolve the QUERY SCOPE constraint for the current (context) user against
-     * `entity` — the `accessibleBy` / Pundit `policy_scope` concept. Returns an
-     * ORM-neutral {@link ScopeConstraint} an adapter (e.g. the TypeORM `applyScope`
-     * helper) turns into a parameterized `WHERE`.
-     *
-     * Consistent with the Gate's single-resource semantics:
-     * - super-admin / before-grant / permission-provider grant → `allow-all`,
-     * - anonymous, or no policy/scope → `deny-all` (default-deny),
-     * - otherwise the policy's `scope` (or `viewAny`-style) constraint.
-     *
-     * `ability` (default `'viewAny'`) names the permission-provider check used for
-     * the allow-all grant and the policy fallback method.
+     * The query scope of `entity` (a resource class linked with `@PolicyFor`, or the
+     * policy class itself) for the current user, from the policy's `scope(user, entity)`
+     * method (else the `ability` method, `viewAny` by default). See {@link ScopeConstraint}.
      */
     scope(entity: Type<unknown>, ability?: string): Promise<ScopeConstraint>;
-    /** True when the current user holds `role`. */
+    /** True when the current user holds `role` (a fact: `superAdmin` does not apply). */
     hasRole(role: string): Promise<boolean>;
-    /** True when the current user holds ANY of `roles`. */
+    /** True when the current user holds any of `roles`. */
     hasAnyRole(roles: string[]): Promise<boolean>;
     /** @internal */
-    allowsForUser(user: MaybeUser, ability: string, resource?: Resource): Promise<boolean>;
-    /** @internal — batch check for an explicit/bound user (see {@link allowsMany}). */
-    allowsManyForUser(user: MaybeUser, items: BatchAbility[]): Promise<BatchResult[]>;
-    /**
-     * Run a batch of checks against one already-resolved user, sharing a single
-     * {@link PermissionCache} so the provider's `getPermissions` runs at most once.
-     * Prefers the per-request cache (so the batch also coalesces with other checks in
-     * the same request); falls back to a transient per-batch cache when standalone.
-     */
-    private checkMany;
+    allowsFor(user: User, first: string | Type<unknown>, rest: unknown[]): Promise<boolean>;
+    /** @internal */
+    authorizeFor(user: User, first: string | Type<unknown>, rest: unknown[]): Promise<void>;
+    /** @internal */
+    allowsManyFor(user: User, items: readonly BatchItem[]): Promise<BatchResult[]>;
     /**
-     * One {@link DecisionProvider.decideMany} round-trip for a whole batch, when the provider
-     * supports it. Returns `undefined` (→ per-item `decide`) otherwise. A batch-call failure makes
-     * every item fall back to its own `decide` call rather than failing the batch.
+     * One `decideMany` round-trip to the external decision point for the string abilities
+     * of a batch, when it supports batching. Empty otherwise, and when the batch call fails
+     * (each item then asks `decide` on its own).
      */
     private prefetchDecisions;
-    /** @internal — used by {@link BoundGate.authorize} to surface the deny reason/message. */
-    decideForUser(user: MaybeUser, ability: string, resource?: Resource): Promise<{
-        allowed: boolean;
-        reason: AuthzDecisionReason;
-        message?: string;
-    }>;
     /** @internal */
-    hasAnyRoleForUser(user: MaybeUser, roles: string[]): Promise<boolean>;
-    /** @internal — used by {@link BoundGate.scope}. */
-    scopeForUser(user: MaybeUser, entity: Type<unknown>, ability?: string): Promise<ScopeConstraint>;
-    /**
-     * Resolve a query-scope constraint for `entity`, mirroring {@link resolveBase}'s
-     * grant order so scoping stays consistent with single-resource decisions:
-     *
-     * 1. super-admin hook grants → `allow-all`;
-     *    1b. decision provider `planScope` → its constraint (unless it abstains);
-     * 2. (authenticated) permission-provider grant for `ability` → `allow-all`;
-     * 3. the policy's `scope` (or `viewAny`-style) method → its constraint;
-     * 4. otherwise (anonymous, no policy, no scope method) → `deny-all`.
-     *
-     * The policy `before` hook is also honored as an allow/deny grant before the
-     * scope method runs, so a policy that broadly allows/denies in `before` scopes
-     * the same way it decides.
-     */
-    private resolveScope;
-    /**
-     * Pick the policy's scope method: the conventional `scope`, else the `ability`
-     * method (e.g. `viewAny`) when it is scope-shaped. Returns `undefined` when the
-     * policy declares neither.
-     */
-    private resolveScopeMethod;
-    /**
-     * Whether the registered {@link PermissionProvider} grants `ability` for an authenticated `user` —
-     * the RBAC "before" grant shared by the single-resource ({@link resolveBase}) and scope
-     * ({@link resolveScope}) paths, single-sourced here so the grant order can't drift between them.
-     *
-     * Grant-only: a `false`/nullish result is "no grant", never a deny. When the provider lists the
-     * user's granted permissions, segment-based wildcard matching runs in the core (a granted
-     * `posts.*` satisfies `posts.update`, `*` satisfies anything) regardless of adapter; a nullish
-     * list defers to the exact-match `hasPermission`. A set the provider marks
-     * {@link PermissionProvider.exhaustivePermissions} answers the check on its own; otherwise an
-     * unsatisfied set still defers to `hasPermission`. The granted set is fetched through `cache`
-     * when one is supplied, else via a direct fetch.
-     */
-    private permissionProviderGrants;
-    /**
-     * Resolve the user's effective roles and test membership against `roles`. Returns
-     * `false` for an anonymous (NO_USER) caller and whenever no source yields a role
-     * (deny-by-default). Roles come from the UNION of the default/overridden
-     * {@link RoleResolver} (reads the user object) and the optional {@link RoleProvider}
-     * seam (a persisted store) — so an app needs neither to opt in.
-     */
-    private checkRoles;
-    /**
-     * The current user's effective role names (resolver ∪ provider). The provider's
-     * roles are fetched through `cache` when one is supplied.
-     */
-    private rolesOf;
-    private check;
-    /**
-     * Resolve a decision AND publish it for observers. Returns the full decision
-     * (verdict + reason + optional deny message) so {@link authorize} can surface the
-     * `reason`/`message` on the thrown `ForbiddenException`. {@link check} discards
-     * everything but the verdict.
-     */
+    hasAnyRoleFor(user: User, roles: string[]): Promise<boolean>;
+    /** @internal */
+    scopeFor(user: User, entity: Type<unknown>, ability: string): Promise<ScopeConstraint>;
+    /** Decide, publish the decision, and (in `authorize` mode) let the official service emit its denial. */
     private decide;
-    /**
-     * Resolve an ability to a final verdict, the path that decided it, and an optional
-     * deny message. Runs the global `after` hook over the base decision (see
-     * {@link AfterHook} for override semantics). Throws
-     * {@link AbilityNotResolvedException}/{@link AmbiguousAbilityException} when no
-     * decision can be reached (those paths emit no decision and skip `after`).
-     */
-    private resolve;
-    /**
-     * The pre-`after` resolution. `allowed` is `undefined` when the deciding path
-     * (policy method / ad-hoc gate) returned a nullish value — "no opinion" — which
-     * lets the {@link AfterHook} supply a verdict before the default-deny finalize.
-     */
-    private resolveBase;
-    private resolvePolicy;
+    private decidePolicy;
+    private decideString;
+    /** The linked policy defining `ability` for `resource` (or for no resource, unambiguously). */
+    private policyFor;
 }
-/**
- * A {@link Gate} bound to an explicit user. Returned by {@link Gate.forUser}.
- */
+/** A {@link Gate} bound to an explicit user. Returned by {@link Gate.forUser}. */
 export declare class BoundGate {
     private readonly gate;
     private readonly user;
-    constructor(gate: Gate, user: MaybeUser);
+    constructor(gate: Gate, user: User);
+    allows<P, const A extends Ability<P>>(policy: Type<P>, ability: A, ...args: AbilityArgsOf<P, A>): Promise<boolean>;
     allows(ability: string, resource?: Resource): Promise<boolean>;
+    denies<P, const A extends Ability<P>>(policy: Type<P>, ability: A, ...args: AbilityArgsOf<P, A>): Promise<boolean>;
     denies(ability: string, resource?: Resource): Promise<boolean>;
-    /** Batch-authorize many abilities for the bound user in one pass (see {@link Gate.allowsMany}). */
-    allowsMany(items: BatchAbility[]): Promise<BatchResult[]>;
-    /** Resolve the query-scope constraint for the bound user (see {@link Gate.scope}). */
-    scope(entity: Type<unknown>, ability?: string): Promise<ScopeConstraint>;
+    authorize<P, const A extends Ability<P>>(policy: Type<P>, ability: A, ...args: AbilityArgsOf<P, A>): Promise<void>;
     authorize(ability: string, resource?: Resource): Promise<void>;
-    /** True when the bound user holds `role`. */
+    /** Batch-check for the bound user (see {@link Gate.allowsMany}). */
+    allowsMany(items: readonly BatchItem[]): Promise<BatchResult[]>;
+    /** The query scope for the bound user (see {@link Gate.scope}). */
+    scope(entity: Type<unknown>, ability?: string): Promise<ScopeConstraint>;
     hasRole(role: string): Promise<boolean>;
-    /** True when the bound user holds ANY of `roles`. */
     hasAnyRole(roles: string[]): Promise<boolean>;
 }
-export {};
 //# sourceMappingURL=gate.d.ts.map

package/dist/gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AACA,OAAO,EAAoD,KAAK,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAC7F,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,KAAK,EAAE,eAAe,EAAyB,MAAM,uBAAuB,CAAC;AACpF,OAAO,KAAK,EAAE,gBAAgB,EAAmB,MAAM,wBAAwB,CAAC;AAChF,OAAO,EAAE,KAAK,mBAAmB,EAAwB,MAAM,kBAAkB,CAAC;AAIlF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,KAAK,YAAY,EAA0C,MAAM,oBAAoB,CAAC;AAC/F,OAAO,EACL,KAAK,eAAe,EAKrB,MAAM,YAAY,CAAC;AAQpB,OAAO,KAAK,EAEV,kBAAkB,EAClB,MAAM,EAIN,QAAQ,EAER,IAAI,EACL,MAAM,YAAY,CAAC;AAwDpB,QAAA,MAAM,OAAO,eAA0B,CAAC;AACxC,KAAK,SAAS,GAAG,IAAI,GAAG,OAAO,OAAO,CAAC;AAYvC,wDAAwD;AACxD,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED,wFAAwF;AACxF,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;;;GAUG;AACH,qBACa,IAAI;IAoBb,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAKzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAEzB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAG3B,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAGpC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAG9B,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAnCpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA6B;IACnD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6B;IACxD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAwB;IAC9C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoC;IAChE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;IAK5C,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,aAAa,CAA8B;IACnD,OAAO,CAAC,0BAA0B,CAAS;IAC3C,OAAO,CAAC,wBAAwB,CAAiC;IACjE,OAAO,CAAC,oBAAoB,CAAS;IACrC,OAAO,CAAC,kBAAkB,CAA2B;IACrD,OAAO,CAAC,wBAAwB,CAAS;IACzC,OAAO,CAAC,sBAAsB,CAA+B;gBAG1C,QAAQ,EAAE,cAAc,EAGzC,OAAO,EAAE,kBAAkB,GAAG,SAAS,EAEtB,OAAO,CAAC,EAAE,eAAe,YAAA,EAEzB,SAAS,CAAC,EAAE,SAAS,YAAA,EAGrB,kBAAkB,CAAC,EAAE,kBAAkB,YAAA,EAGvC,YAAY,CAAC,EAAE,YAAY,YAAA,EAG3B,gBAAgB,CAAC,EAAE,gBAAgB,YAAA;IAQtD;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAatB;;;;OAIG;IACH,OAAO,CAAC,yBAAyB;IAejC;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAa3B;;;OAGG;IACH,OAAO,CAAC,uBAAuB;IAe/B;;;;;;OAMG;IACH,OAAO,CAAC,mBAAmB;IAU3B,2FAA2F;IAC3F,OAAO,CAAC,YAAY;IAepB,sEAAsE;IACtE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI;IAKzC,4DAA4D;IAC5D,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAIjC;;;;OAIG;IACH,SAAS,IAAI,MAAM,EAAE;IAIrB;;;;;;;;;OASG;IACH,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,SAAS;IAI9B;;;;;;OAMG;YACW,WAAW;IA6BnB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAI9D,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAI9D,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAUpE;;;;;;;;;;OAUG;IACG,UAAU,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAI/D;;;;;;;;;;;;;OAaG;IACG,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,SAAY,GAAG,OAAO,CAAC,eAAe,CAAC;IAMjF,+CAA+C;IACzC,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAI7C,uDAAuD;IACjD,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAMnD,gBAAgB;IAChB,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAItF,mFAAmF;IACnF,iBAAiB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAIjF;;;;;OAKG;YACW,SAAS;IAsBvB;;;;OAIG;YACW,iBAAiB;IAyB/B,0FAA0F;IAC1F,aAAa,CACX,IAAI,EAAE,SAAS,EACf,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,QAAQ,GAClB,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,mBAAmB,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAI/E,gBAAgB;IAChB,iBAAiB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAIrE,mDAAmD;IACnD,YAAY,CACV,IAAI,EAAE,SAAS,EACf,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,EACrB,OAAO,SAAY,GAClB,OAAO,CAAC,eAAe,CAAC;IAI3B;;;;;;;;;;;;;OAaG;YACW,YAAY;IAiD1B;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAQ1B;;;;;;;;;;;;OAYG;YACW,wBAAwB;IAqBtC;;;;;;OAMG;YACW,UAAU;IAOxB;;;OAGG;YACW,OAAO;YAgBP,KAAK;IASnB;;;;;OAKG;YACW,MAAM;IAsBpB;;;;;;OAMG;YACW,OAAO;IAyBrB;;;;OAIG;YACW,WAAW;IAmFzB,OAAO,CAAC,aAAa;CAwBtB;AAED;;GAEG;AACH,qBAAa,SAAS;IAElB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBADJ,IAAI,EAAE,IAAI,EACV,IAAI,EAAE,SAAS;IAGlC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAIxD,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAIpE,mGAAmG;IACnG,UAAU,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAIzD,sFAAsF;IACtF,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,SAAY,GAAG,OAAO,CAAC,eAAe,CAAC;IAIrE,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAKpE,6CAA6C;IAC7C,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIvC,qDAAqD;IACrD,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;CAG9C"}
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAsB,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC/F,OAAO,EAAgC,KAAK,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAOzE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EACL,KAAK,eAAe,EAKrB,MAAM,YAAY,CAAC;AAEpB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,QAAQ,EAAkB,IAAI,EAAE,MAAM,YAAY,CAAC;AAE7F,iEAAiE;AACjE,MAAM,MAAM,aAAa,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAC7D,IAAI,EAAE,KAAK,EACX,GAAG,IAAI,EAAE,MAAM,CAAC,KACb,OAAO,GACR,CAAC,GACD,KAAK,CAAC;AAEV,iGAAiG;AACjG,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED,kEAAkE;AAClE,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CAC3B;AAED,mDAAmD;AACnD,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG,gBAAgB,CAAC;AAExD,gFAAgF;AAChF,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC;AAgB3D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBACa,IAAI;IAOb,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAPvB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA6B;IACnD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6B;IACxD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAuB;gBAGD,KAAK,EAAE,oBAAoB,GAAG,SAAS,EAChE,KAAK,EAAE,WAAW,EAClB,IAAI,EAAE,SAAS,EACU,OAAO,CAAC,EAAE,kBAAkB;IAMxE,sEAAsE;IACtE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI;IAKzC,4DAA4D;IAC5D,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAIjC,iEAAiE;IACjE,SAAS,IAAI,MAAM,EAAE;IAIrB;;;OAGG;IACH,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,SAAS;IAI9B;;;;;OAKG;IACH,OAAO,CAAC,WAAW;IAMnB,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,EAClC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EACf,OAAO,EAAE,CAAC,EACV,GAAG,IAAI,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,GAC3B,OAAO,CAAC,OAAO,CAAC;IACnB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAK9D,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,EAClC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EACf,OAAO,EAAE,CAAC,EACV,GAAG,IAAI,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,GAC3B,OAAO,CAAC,OAAO,CAAC;IACnB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAK9D;;;;OAIG;IACH,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,EACrC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EACf,OAAO,EAAE,CAAC,EACV,GAAG,IAAI,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,GAC3B,OAAO,CAAC,IAAI,CAAC;IAChB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAK9D,4FAA4F;IACtF,UAAU,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAIrE;;;;OAIG;IACG,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,SAAY,GAAG,OAAO,CAAC,eAAe,CAAC;IAIjF,qFAAqF;IAC/E,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAI7C,uDAAuD;IACjD,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAMnD,gBAAgB;IACV,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAI7F,gBAAgB;IACV,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAW7F,gBAAgB;IACV,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,SAAS,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAoBpF;;;;OAIG;YACW,iBAAiB;IA6B/B,gBAAgB;IACV,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAIlE,gBAAgB;IACV,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAmC5F,wGAAwG;YAC1F,MAAM;YAuBN,YAAY;YA0BZ,YAAY;IAgD1B,+FAA+F;IAC/F,OAAO,CAAC,SAAS;CAiBlB;AAED,kFAAkF;AAClF,qBAAa,SAAS;IAElB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBADJ,IAAI,EAAE,IAAI,EACV,IAAI,EAAE,IAAI;IAG7B,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,EAClC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EACf,OAAO,EAAE,CAAC,EACV,GAAG,IAAI,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,GAC3B,OAAO,CAAC,OAAO,CAAC;IACnB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAK9D,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,EAClC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EACf,OAAO,EAAE,CAAC,EACV,GAAG,IAAI,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,GAC3B,OAAO,CAAC,OAAO,CAAC;IACnB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAK9D,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,EACrC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EACf,OAAO,EAAE,CAAC,EACV,GAAG,IAAI,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,GAC3B,OAAO,CAAC,IAAI,CAAC;IAChB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAK9D,oEAAoE;IACpE,UAAU,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAI/D,mEAAmE;IACnE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,SAAY,GAAG,OAAO,CAAC,eAAe,CAAC;IAI3E,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIvC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;CAG9C"}