@c9up/warden 0.1.0 → 0.1.4

package/dist/rights/MemoryRightsStore.d.ts

@@ -0,0 +1,29 @@
+/**
+ * MemoryRightsStore — the shipped in-memory rights driver.
+ *
+ * Implements the read-only `RightsStore` contract and adds chainable seeding
+ * methods (`defineRole`/`assignRole`/`grant`/`revoke`) for app boot and tests.
+ * DB-backed drivers are a documented copy-in adapter, not a hard dependency —
+ * this driver keeps Warden's agnostic posture with zero new dependencies.
+ *
+ * Storage is Map-based, keyed by `scopeKey(scope)` then by role/userId, so
+ * `global` and `tenant:X` rights stay isolated (inheritance is the resolver's
+ * job, not the store's).
+ */
+import { type RightsStore, type Scope } from "./types.js";
+export declare class MemoryRightsStore implements RightsStore {
+    /** scopeKey → role → permissions */
+    private readonly roleDefs;
+    /** scopeKey → userId → roles */
+    private readonly userRoleMap;
+    /** scopeKey → userId → directly granted permissions */
+    private readonly userGrantMap;
+    rolePermissions(role: string, scope: Scope): Promise<readonly string[]>;
+    userRoles(userId: string, scope: Scope): Promise<readonly string[]>;
+    userGrants(userId: string, scope: Scope): Promise<readonly string[]>;
+    defineRole(role: string, permissions: readonly string[], scope?: Scope): this;
+    assignRole(userId: string, role: string, scope?: Scope): this;
+    grant(userId: string, permission: string, scope?: Scope): this;
+    revoke(userId: string, permission: string, scope?: Scope): this;
+}
+//# sourceMappingURL=MemoryRightsStore.d.ts.map

package/dist/rights/MemoryRightsStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MemoryRightsStore.d.ts","sourceRoot":"","sources":["../../src/rights/MemoryRightsStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,KAAK,WAAW,EAAE,KAAK,KAAK,EAAY,MAAM,YAAY,CAAC;AAEpE,qBAAa,iBAAkB,YAAW,WAAW;IACpD,oCAAoC;IACpC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+C;IACxE,gCAAgC;IAChC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA+C;IAC3E,uDAAuD;IACvD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA+C;IAItE,eAAe,CACpB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,KAAK,GACV,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;IAIvB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;IAInE,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;IAM1E,UAAU,CACT,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,KAAK,GAAE,KAAgB,GACrB,IAAI;IAOP,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,GAAE,KAAgB,GAAG,IAAI;IAKvE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,GAAE,KAAgB,GAAG,IAAI;IAKxE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,GAAE,KAAgB,GAAG,IAAI;CAIzE"}

package/dist/rights/MemoryRightsStore.js

@@ -0,0 +1,70 @@
+/**
+ * MemoryRightsStore — the shipped in-memory rights driver.
+ *
+ * Implements the read-only `RightsStore` contract and adds chainable seeding
+ * methods (`defineRole`/`assignRole`/`grant`/`revoke`) for app boot and tests.
+ * DB-backed drivers are a documented copy-in adapter, not a hard dependency —
+ * this driver keeps Warden's agnostic posture with zero new dependencies.
+ *
+ * Storage is Map-based, keyed by `scopeKey(scope)` then by role/userId, so
+ * `global` and `tenant:X` rights stay isolated (inheritance is the resolver's
+ * job, not the store's).
+ */
+import { scopeKey } from "./types.js";
+export class MemoryRightsStore {
+    /** scopeKey → role → permissions */
+    roleDefs = new Map();
+    /** scopeKey → userId → roles */
+    userRoleMap = new Map();
+    /** scopeKey → userId → directly granted permissions */
+    userGrantMap = new Map();
+    // — read contract —
+    async rolePermissions(role, scope) {
+        return snapshot(this.roleDefs.get(scopeKey(scope))?.get(role));
+    }
+    async userRoles(userId, scope) {
+        return snapshot(this.userRoleMap.get(scopeKey(scope))?.get(userId));
+    }
+    async userGrants(userId, scope) {
+        return snapshot(this.userGrantMap.get(scopeKey(scope))?.get(userId));
+    }
+    // — seeding (in-memory driver only; not part of RightsStore) —
+    defineRole(role, permissions, scope = "global") {
+        const set = bucket(this.roleDefs, scopeKey(scope), role);
+        set.clear();
+        for (const perm of permissions)
+            set.add(perm);
+        return this;
+    }
+    assignRole(userId, role, scope = "global") {
+        bucket(this.userRoleMap, scopeKey(scope), userId).add(role);
+        return this;
+    }
+    grant(userId, permission, scope = "global") {
+        bucket(this.userGrantMap, scopeKey(scope), userId).add(permission);
+        return this;
+    }
+    revoke(userId, permission, scope = "global") {
+        this.userGrantMap.get(scopeKey(scope))?.get(userId)?.delete(permission);
+        return this;
+    }
+}
+/** Defensive array snapshot — never hands back a live reference to internal state. */
+function snapshot(set) {
+    return set ? [...set] : [];
+}
+/** Get-or-create the inner `Set` for `outer[key][inner]`. */
+function bucket(outer, key, inner) {
+    let mid = outer.get(key);
+    if (!mid) {
+        mid = new Map();
+        outer.set(key, mid);
+    }
+    let set = mid.get(inner);
+    if (!set) {
+        set = new Set();
+        mid.set(inner, set);
+    }
+    return set;
+}
+//# sourceMappingURL=MemoryRightsStore.js.map

package/dist/rights/MemoryRightsStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MemoryRightsStore.js","sourceRoot":"","sources":["../../src/rights/MemoryRightsStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAgC,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEpE,MAAM,OAAO,iBAAiB;IAC7B,oCAAoC;IACnB,QAAQ,GAAG,IAAI,GAAG,EAAoC,CAAC;IACxE,gCAAgC;IACf,WAAW,GAAG,IAAI,GAAG,EAAoC,CAAC;IAC3E,uDAAuD;IACtC,YAAY,GAAG,IAAI,GAAG,EAAoC,CAAC;IAE5E,oBAAoB;IAEpB,KAAK,CAAC,eAAe,CACpB,IAAY,EACZ,KAAY;QAEZ,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,MAAc,EAAE,KAAY;QAC3C,OAAO,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,KAAY;QAC5C,OAAO,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,+DAA+D;IAE/D,UAAU,CACT,IAAY,EACZ,WAA8B,EAC9B,QAAe,QAAQ;QAEvB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;QACzD,GAAG,CAAC,KAAK,EAAE,CAAC;QACZ,KAAK,MAAM,IAAI,IAAI,WAAW;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC;IACb,CAAC;IAED,UAAU,CAAC,MAAc,EAAE,IAAY,EAAE,QAAe,QAAQ;QAC/D,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC;IACb,CAAC;IAED,KAAK,CAAC,MAAc,EAAE,UAAkB,EAAE,QAAe,QAAQ;QAChE,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACnE,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,CAAC,MAAc,EAAE,UAAkB,EAAE,QAAe,QAAQ;QACjE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC;IACb,CAAC;CACD;AAED,sFAAsF;AACtF,SAAS,QAAQ,CAAC,GAA4B;IAC7C,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5B,CAAC;AAED,6DAA6D;AAC7D,SAAS,MAAM,CACd,KAA4C,EAC5C,GAAW,EACX,KAAa;IAEb,IAAI,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,GAAG,GAAG,IAAI,GAAG,EAAuB,CAAC;QACrC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACrB,CAAC;IACD,IAAI,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;QACxB,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC"}

package/dist/rights/RightsResolver.d.ts

@@ -0,0 +1,29 @@
+/**
+ * RightsResolver — computes a user's effective permissions for a scope.
+ *
+ * This is the unification point the epic calls `user.permissions`: every later
+ * authorization facet consults `resolve(user, scope)` instead of reading roles
+ * or permissions ad hoc.
+ *
+ * Resolution rules:
+ *   - Scope chain: `["global"]` for global, `["global", { tenant }]` for a
+ *     tenant scope — global rights are inherited into every tenant scope.
+ *   - Roles: token-carried `user.roles` are global identity — they apply at
+ *     the `global` link only; each scope additionally uses `store.userRoles(...)`.
+ *     A global role's global permissions still inherit into tenant scopes via
+ *     the chain, but a payload role never picks up a same-named tenant role's
+ *     permissions (no cross-tenant escalation by name collision).
+ *   - Permissions = (∪ over roles of `store.rolePermissions(...)`) ∪
+ *     `store.userGrants(...)` (the ACL). The payload's `user.permissions` is
+ *     NOT an input — permissions are derived from the rights model only.
+ *   - Fail-closed: absent data contributes nothing and never throws.
+ *   - Exact-match comparison; no wildcard or role-hierarchy expansion.
+ */
+import type { UserPayload } from "../AuthManager.js";
+import type { EffectivePermissions, RightsStore, Scope } from "./types.js";
+export declare class RightsResolver {
+    private readonly store;
+    constructor(store: RightsStore);
+    resolve(user: UserPayload, scope?: Scope): Promise<EffectivePermissions>;
+}
+//# sourceMappingURL=RightsResolver.d.ts.map

package/dist/rights/RightsResolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RightsResolver.d.ts","sourceRoot":"","sources":["../../src/rights/RightsResolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,oBAAoB,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAsB3E,qBAAa,cAAc;IACd,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,WAAW;IAEzC,OAAO,CACZ,IAAI,EAAE,WAAW,EACjB,KAAK,GAAE,KAAgB,GACrB,OAAO,CAAC,oBAAoB,CAAC;CAgChC"}

package/dist/rights/RightsResolver.js

@@ -0,0 +1,73 @@
+/**
+ * RightsResolver — computes a user's effective permissions for a scope.
+ *
+ * This is the unification point the epic calls `user.permissions`: every later
+ * authorization facet consults `resolve(user, scope)` instead of reading roles
+ * or permissions ad hoc.
+ *
+ * Resolution rules:
+ *   - Scope chain: `["global"]` for global, `["global", { tenant }]` for a
+ *     tenant scope — global rights are inherited into every tenant scope.
+ *   - Roles: token-carried `user.roles` are global identity — they apply at
+ *     the `global` link only; each scope additionally uses `store.userRoles(...)`.
+ *     A global role's global permissions still inherit into tenant scopes via
+ *     the chain, but a payload role never picks up a same-named tenant role's
+ *     permissions (no cross-tenant escalation by name collision).
+ *   - Permissions = (∪ over roles of `store.rolePermissions(...)`) ∪
+ *     `store.userGrants(...)` (the ACL). The payload's `user.permissions` is
+ *     NOT an input — permissions are derived from the rights model only.
+ *   - Fail-closed: absent data contributes nothing and never throws.
+ *   - Exact-match comparison; no wildcard or role-hierarchy expansion.
+ */
+class ResolvedPermissions {
+    permissions;
+    roles;
+    scope;
+    constructor(permissions, roles, scope) {
+        this.permissions = permissions;
+        this.roles = roles;
+        this.scope = scope;
+    }
+    has(permission) {
+        return this.permissions.has(permission);
+    }
+    hasAll(permissions) {
+        return permissions.every((p) => this.permissions.has(p));
+    }
+    hasAny(permissions) {
+        return permissions.some((p) => this.permissions.has(p));
+    }
+}
+export class RightsResolver {
+    store;
+    constructor(store) {
+        this.store = store;
+    }
+    async resolve(user, scope = "global") {
+        const chain = scope === "global" ? ["global"] : ["global", scope];
+        const roles = new Set();
+        const permissions = new Set();
+        const payloadRoles = user.roles ?? [];
+        for (const link of chain) {
+            const storeRoles = await this.store.userRoles(user.id, link);
+            // Token-carried roles are global identity: they contribute at the
+            // `global` link only, so a payload role never inherits a same-named
+            // tenant role's permissions. A global role's global permissions still
+            // reach tenant scopes via the chain.
+            const scopeRoles = link === "global"
+                ? new Set([...payloadRoles, ...storeRoles])
+                : new Set(storeRoles);
+            for (const role of scopeRoles) {
+                roles.add(role);
+                for (const perm of await this.store.rolePermissions(role, link)) {
+                    permissions.add(perm);
+                }
+            }
+            for (const grant of await this.store.userGrants(user.id, link)) {
+                permissions.add(grant);
+            }
+        }
+        return new ResolvedPermissions(permissions, roles, scope);
+    }
+}
+//# sourceMappingURL=RightsResolver.js.map

package/dist/rights/RightsResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RightsResolver.js","sourceRoot":"","sources":["../../src/rights/RightsResolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAKH,MAAM,mBAAmB;IAEd;IACA;IACA;IAHV,YACU,WAAgC,EAChC,KAA0B,EAC1B,KAAY;QAFZ,gBAAW,GAAX,WAAW,CAAqB;QAChC,UAAK,GAAL,KAAK,CAAqB;QAC1B,UAAK,GAAL,KAAK,CAAO;IACnB,CAAC;IAEJ,GAAG,CAAC,UAAkB;QACrB,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,CAAC,WAA8B;QACpC,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,CAAC,WAA8B;QACpC,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC;CACD;AAED,MAAM,OAAO,cAAc;IACG;IAA7B,YAA6B,KAAkB;QAAlB,UAAK,GAAL,KAAK,CAAa;IAAG,CAAC;IAEnD,KAAK,CAAC,OAAO,CACZ,IAAiB,EACjB,QAAe,QAAQ;QAEvB,MAAM,KAAK,GAAY,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAE3E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;QACtC,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAEtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC1B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YAC7D,kEAAkE;YAClE,oEAAoE;YACpE,sEAAsE;YACtE,qCAAqC;YACrC,MAAM,UAAU,GACf,IAAI,KAAK,QAAQ;gBAChB,CAAC,CAAC,IAAI,GAAG,CAAS,CAAC,GAAG,YAAY,EAAE,GAAG,UAAU,CAAC,CAAC;gBACnD,CAAC,CAAC,IAAI,GAAG,CAAS,UAAU,CAAC,CAAC;YAEhC,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;gBAC/B,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAChB,KAAK,MAAM,IAAI,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;oBACjE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACvB,CAAC;YACF,CAAC;YAED,KAAK,MAAM,KAAK,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC;gBAChE,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACxB,CAAC;QACF,CAAC;QAED,OAAO,IAAI,mBAAmB,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC3D,CAAC;CACD"}

package/dist/rights/types.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Rights data model — Layer 1 of Warden's unified authorization (Epic 56).
+ *
+ * The single resolution point: `resolve(user, scope) → EffectivePermissions`.
+ * Roles → permissions (RBAC) and direct user → permission grants (ACL) are
+ * both keyed by scope (`global` | `{ tenant }`). The store contract is
+ * read-only; concrete drivers (the shipped in-memory one, or a copy-in DB
+ * adapter) provide seeding/mutation on top.
+ */
+/**
+ * Resolution scope. `"global"` is the implicit single-tenant scope; a tenant
+ * scope is the discriminated object form so it stays type-distinguishable from
+ * the global sentinel at call sites.
+ */
+export type Scope = "global" | {
+    readonly tenant: string;
+};
+/**
+ * The single unification point — a user's effective permissions within a scope.
+ */
+export interface EffectivePermissions {
+    /** True iff the permission is in the resolved set (exact match). */
+    has(permission: string): boolean;
+    /** True iff ALL listed permissions are present (empty list ⇒ vacuously true). */
+    hasAll(permissions: readonly string[]): boolean;
+    /** True iff ANY listed permission is present (empty list ⇒ false). */
+    hasAny(permissions: readonly string[]): boolean;
+    /** The user's effective permissions in this scope (role-derived ∪ direct grants). */
+    readonly permissions: ReadonlySet<string>;
+    /** The roles that contributed (payload ∪ store, within the resolved scope incl. global). */
+    readonly roles: ReadonlySet<string>;
+    /** The scope this was resolved for. */
+    readonly scope: Scope;
+}
+/**
+ * Read contract consulted by the resolver. All methods scoped + async: a
+ * DB-backed adapter is inherently async, and the evaluation layer (56.2) is
+ * async end-to-end. Writes are NOT part of this contract — drivers add their
+ * own seeding API.
+ */
+export interface RightsStore {
+    /** Permissions a role grants in the given scope (unknown role ⇒ []). */
+    rolePermissions(role: string, scope: Scope): Promise<readonly string[]>;
+    /** Roles assigned to a user in the given scope (none ⇒ []). */
+    userRoles(userId: string, scope: Scope): Promise<readonly string[]>;
+    /** Direct per-user permission grants (ACL) in the given scope (none ⇒ []). */
+    userGrants(userId: string, scope: Scope): Promise<readonly string[]>;
+}
+/**
+ * Stable string key for a scope. `"global"` → `"global"`,
+ * `{ tenant: "X" }` → `"tenant:X"`. Used by drivers to key their storage and
+ * by 56.3 when threading scope through the evaluation context.
+ */
+export declare function scopeKey(scope: Scope): string;
+//# sourceMappingURL=types.d.ts.map

package/dist/rights/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/rights/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;;GAIG;AACH,MAAM,MAAM,KAAK,GAAG,QAAQ,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3D;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACpC,oEAAoE;IACpE,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;IACjC,iFAAiF;IACjF,MAAM,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC;IAChD,sEAAsE;IACtE,MAAM,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC;IAChD,qFAAqF;IACrF,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC1C,4FAA4F;IAC5F,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACpC,uCAAuC;IACvC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;CACtB;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC3B,wEAAwE;IACxE,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;IACxE,+DAA+D;IAC/D,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;IACpE,8EAA8E;IAC9E,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;CACrE;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAE7C"}

package/dist/rights/types.js

@@ -0,0 +1,18 @@
+/**
+ * Rights data model — Layer 1 of Warden's unified authorization (Epic 56).
+ *
+ * The single resolution point: `resolve(user, scope) → EffectivePermissions`.
+ * Roles → permissions (RBAC) and direct user → permission grants (ACL) are
+ * both keyed by scope (`global` | `{ tenant }`). The store contract is
+ * read-only; concrete drivers (the shipped in-memory one, or a copy-in DB
+ * adapter) provide seeding/mutation on top.
+ */
+/**
+ * Stable string key for a scope. `"global"` → `"global"`,
+ * `{ tenant: "X" }` → `"tenant:X"`. Used by drivers to key their storage and
+ * by 56.3 when threading scope through the evaluation context.
+ */
+export function scopeKey(scope) {
+    return scope === "global" ? "global" : `tenant:${scope.tenant}`;
+}
+//# sourceMappingURL=types.js.map

package/dist/rights/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/rights/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA0CH;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAY;IACpC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,MAAM,EAAE,CAAC;AACjE,CAAC"}

package/dist/services/main.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Default `AuthManager` singleton — mirror of Adonis's
+ * `import auth from '@adonisjs/auth/services/main'` shape.
+ *
+ *   import auth from '@c9up/warden/services/main'
+ *
+ *   const result = await auth.verify(bearerToken)
+ *   if (result.authenticated) { ... }
+ *
+ * Populated by `WardenProvider.boot()`.
+ */
+import type { AuthManager } from "../AuthManager.js";
+/** @internal Bind the singleton (called by WardenProvider). */
+export declare function setAuth(value: AuthManager): void;
+/** @internal Read the singleton (or `undefined` pre-boot). */
+export declare function getAuth(): AuthManager | undefined;
+declare const auth: AuthManager;
+export default auth;
+//# sourceMappingURL=main.d.ts.map

package/dist/services/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/services/main.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAIrD,+DAA+D;AAC/D,wBAAgB,OAAO,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAEhD;AAED,8DAA8D;AAC9D,wBAAgB,OAAO,IAAI,WAAW,GAAG,SAAS,CAEjD;AAED,QAAA,MAAM,IAAI,EAAE,WAWV,CAAC;AAEH,eAAe,IAAI,CAAC"}

package/dist/services/main.js

@@ -0,0 +1,32 @@
+/**
+ * Default `AuthManager` singleton — mirror of Adonis's
+ * `import auth from '@adonisjs/auth/services/main'` shape.
+ *
+ *   import auth from '@c9up/warden/services/main'
+ *
+ *   const result = await auth.verify(bearerToken)
+ *   if (result.authenticated) { ... }
+ *
+ * Populated by `WardenProvider.boot()`.
+ */
+let instance;
+/** @internal Bind the singleton (called by WardenProvider). */
+export function setAuth(value) {
+    instance = value;
+}
+/** @internal Read the singleton (or `undefined` pre-boot). */
+export function getAuth() {
+    return instance;
+}
+const auth = new Proxy({}, {
+    get(_target, prop) {
+        if (!instance) {
+            throw new Error("[warden] AuthManager singleton accessed before WardenProvider.boot() ran. " +
+                "Check that `@c9up/warden/provider` is listed in your reamrc.ts providers.");
+        }
+        const value = Reflect.get(instance, prop, instance);
+        return typeof value === "function" ? value.bind(instance) : value;
+    },
+});
+export default auth;
+//# sourceMappingURL=main.js.map

package/dist/services/main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../../src/services/main.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,IAAI,QAAiC,CAAC;AAEtC,+DAA+D;AAC/D,MAAM,UAAU,OAAO,CAAC,KAAkB;IACzC,QAAQ,GAAG,KAAK,CAAC;AAClB,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,OAAO;IACtB,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,MAAM,IAAI,GAAgB,IAAI,KAAK,CAAC,EAAiB,EAAE;IACtD,GAAG,CAAC,OAAO,EAAE,IAAI;QAChB,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACd,4EAA4E;gBAC3E,2EAA2E,CAC5E,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QACpD,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACnE,CAAC;CACD,CAAC,CAAC;AAEH,eAAe,IAAI,CAAC"}

package/dist/standalone.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Standalone Warden factory — works without the Ream IoC container.
+ *
+ * Same pattern as `createBlackhole()`: construct the auth manager from a
+ * config object, return a typed handle that Express/Fastify/Hono can use.
+ *
+ * @example Express
+ *   import { createWarden } from '@c9up/warden/standalone'
+ *   const warden = createWarden({
+ *     defaultStrategy: 'jwt',
+ *     jwt: { secret: '...', findUser: ..., verifyCredentials: ... },
+ *   })
+ *   app.use(warden.expressMiddleware())
+ *
+ * @example Manual
+ *   const result = await warden.verify(token)
+ *   if (!result.authenticated) return res.status(401).json(result)
+ */
+import { AuthManager, type AuthResult, type UserPayload } from "./AuthManager.js";
+import type { WardenConfig } from "./config.js";
+export interface Warden {
+    /** Verify a bearer token. Returns auth result with user payload. */
+    verify(token: string, strategy?: string): Promise<AuthResult>;
+    /** Authenticate with credentials (email + password). */
+    authenticate(credentials: Record<string, unknown>, strategy?: string): Promise<AuthResult>;
+    /** Generate a JWT for a user (jwt strategy only). */
+    generateToken(user: UserPayload): Promise<string>;
+    /** The underlying AuthManager for advanced use. */
+    manager: AuthManager;
+    /** Express middleware — extracts Bearer token, verifies, attaches `req.auth`. */
+    expressMiddleware(): (req: Record<string, unknown>, res: Record<string, unknown>, next: () => void) => void;
+}
+/**
+ * Create a standalone Warden instance — no Ream container needed.
+ */
+export declare function createWarden(config: WardenConfig): Warden;
+//# sourceMappingURL=standalone.d.ts.map

package/dist/standalone.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"standalone.d.ts","sourceRoot":"","sources":["../src/standalone.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EACN,WAAW,EACX,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAGhD,MAAM,WAAW,MAAM;IACtB,oEAAoE;IACpE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9D,wDAAwD;IACxD,YAAY,CACX,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,QAAQ,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,CAAC,CAAC;IACvB,qDAAqD;IACrD,aAAa,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,mDAAmD;IACnD,OAAO,EAAE,WAAW,CAAC;IACrB,iFAAiF;IACjF,iBAAiB,IAAI,CACpB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,IAAI,EAAE,MAAM,IAAI,KACZ,IAAI,CAAC;CACV;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CA6EzD"}

package/dist/standalone.js

@@ -0,0 +1,92 @@
+/**
+ * Standalone Warden factory — works without the Ream IoC container.
+ *
+ * Same pattern as `createBlackhole()`: construct the auth manager from a
+ * config object, return a typed handle that Express/Fastify/Hono can use.
+ *
+ * @example Express
+ *   import { createWarden } from '@c9up/warden/standalone'
+ *   const warden = createWarden({
+ *     defaultStrategy: 'jwt',
+ *     jwt: { secret: '...', findUser: ..., verifyCredentials: ... },
+ *   })
+ *   app.use(warden.expressMiddleware())
+ *
+ * @example Manual
+ *   const result = await warden.verify(token)
+ *   if (!result.authenticated) return res.status(401).json(result)
+ */
+import { AuthManager, } from "./AuthManager.js";
+import { JwtStrategy } from "./strategies/JwtStrategy.js";
+/**
+ * Create a standalone Warden instance — no Ream container needed.
+ */
+export function createWarden(config) {
+    const strategies = {};
+    if (config.jwt) {
+        strategies.jwt = new JwtStrategy(config.jwt);
+    }
+    const manager = new AuthManager({
+        defaultStrategy: config.defaultStrategy ?? "jwt",
+        strategies,
+    });
+    return {
+        verify: (token, strategy) => manager.verify(token, strategy),
+        authenticate: (credentials, strategy) => manager.authenticate(credentials, strategy),
+        async generateToken(user) {
+            const jwt = manager.getStrategy("jwt");
+            return jwt.signToken(user);
+        },
+        manager,
+        expressMiddleware() {
+            return (req, res, next) => {
+                const headers = req.headers;
+                const authHeader = headers?.authorization ?? "";
+                const token = typeof authHeader === "string" && authHeader.startsWith("Bearer ")
+                    ? authHeader.slice(7)
+                    : "";
+                if (!token) {
+                    res
+                        .status(401)
+                        .json({
+                        error: {
+                            code: "UNAUTHORIZED",
+                            message: "Missing authentication token",
+                        },
+                    });
+                    return;
+                }
+                manager
+                    .verify(token)
+                    .then((result) => {
+                    if (!result.authenticated || !result.user) {
+                        res
+                            .status(401)
+                            .json({
+                            error: {
+                                code: "UNAUTHORIZED",
+                                message: result.error ?? "Authentication failed",
+                            },
+                        });
+                        return;
+                    }
+                    // Attach auth result to the request object (Express convention).
+                    req.auth = result;
+                    req.user = result.user;
+                    next();
+                })
+                    .catch(() => {
+                    res
+                        .status(500)
+                        .json({
+                        error: {
+                            code: "AUTH_ERROR",
+                            message: "Internal authentication error",
+                        },
+                    });
+                });
+            };
+        },
+    };
+}
+//# sourceMappingURL=standalone.js.map

package/dist/standalone.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"standalone.js","sourceRoot":"","sources":["../src/standalone.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EACN,WAAW,GAGX,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAsB1D;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,MAAoB;IAChD,MAAM,UAAU,GAAgC,EAAE,CAAC;IAEnD,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;QAChB,UAAU,CAAC,GAAG,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC;QAC/B,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,KAAK;QAChD,UAAU;KACV,CAAC,CAAC;IAEH,OAAO;QACN,MAAM,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC;QAC5D,YAAY,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,EAAE,CACvC,OAAO,CAAC,YAAY,CAAC,WAAW,EAAE,QAAQ,CAAC;QAE5C,KAAK,CAAC,aAAa,CAAC,IAAiB;YACpC,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,CAAgB,CAAC;YACtD,OAAO,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAED,OAAO;QAEP,iBAAiB;YAChB,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;gBACzB,MAAM,OAAO,GAAG,GAAG,CAAC,OAA6C,CAAC;gBAClE,MAAM,UAAU,GAAG,OAAO,EAAE,aAAa,IAAI,EAAE,CAAC;gBAChD,MAAM,KAAK,GACV,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC;oBACjE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;oBACrB,CAAC,CAAC,EAAE,CAAC;gBAEP,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,GAAiE;yBAChE,MAAM,CAAC,GAAG,CAAC;yBACX,IAAI,CAAC;wBACL,KAAK,EAAE;4BACN,IAAI,EAAE,cAAc;4BACpB,OAAO,EAAE,8BAA8B;yBACvC;qBACD,CAAC,CAAC;oBACJ,OAAO;gBACR,CAAC;gBAED,OAAO;qBACL,MAAM,CAAC,KAAK,CAAC;qBACb,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;oBAChB,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;wBAC1C,GAAiE;6BAChE,MAAM,CAAC,GAAG,CAAC;6BACX,IAAI,CAAC;4BACL,KAAK,EAAE;gCACN,IAAI,EAAE,cAAc;gCACpB,OAAO,EAAE,MAAM,CAAC,KAAK,IAAI,uBAAuB;6BAChD;yBACD,CAAC,CAAC;wBACJ,OAAO;oBACR,CAAC;oBACD,iEAAiE;oBACjE,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;oBAClB,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;oBACvB,IAAI,EAAE,CAAC;gBACR,CAAC,CAAC;qBACD,KAAK,CAAC,GAAG,EAAE;oBACV,GAAiE;yBAChE,MAAM,CAAC,GAAG,CAAC;yBACX,IAAI,CAAC;wBACL,KAAK,EAAE;4BACN,IAAI,EAAE,YAAY;4BAClB,OAAO,EAAE,+BAA+B;yBACxC;qBACD,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;YACL,CAAC,CAAC;QACH,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/strategies/ApiKeyStrategy.d.ts

@@ -0,0 +1,28 @@
+/**
+ * API Key authentication strategy.
+ *
+ * Supports: Authorization: Bearer <key> or X-API-Key: <key>
+ *
+ * @implements MISS-8
+ */
+import type { AuthResult, AuthStrategy, UserPayload } from "../AuthManager.js";
+export interface ApiKeyConfig {
+    headerName?: string;
+    findByKey: (key: string) => Promise<{
+        user: UserPayload;
+        scopes?: string[];
+    } | null>;
+}
+export declare class ApiKeyStrategy implements AuthStrategy {
+    #private;
+    name: string;
+    constructor(config: ApiKeyConfig);
+    /** The HTTP header name to extract the API key from. */
+    get headerName(): string;
+    authenticate(_credentials: {
+        email: string;
+        password: string;
+    }): Promise<AuthResult>;
+    verify(token: string): Promise<AuthResult>;
+}
+//# sourceMappingURL=ApiKeyStrategy.d.ts.map

package/dist/strategies/ApiKeyStrategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ApiKeyStrategy.d.ts","sourceRoot":"","sources":["../../src/strategies/ApiKeyStrategy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAE/E,MAAM,WAAW,YAAY;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,CACV,GAAG,EAAE,MAAM,KACP,OAAO,CAAC;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CAC9D;AAED,qBAAa,cAAe,YAAW,YAAY;;IAClD,IAAI,SAAa;gBAIL,MAAM,EAAE,YAAY;IAKhC,wDAAwD;IACxD,IAAI,UAAU,IAAI,MAAM,CAEvB;IAEK,YAAY,CAAC,YAAY,EAAE;QAChC,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,UAAU,CAAC;IAMjB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;CAYhD"}

package/dist/strategies/ApiKeyStrategy.js

@@ -0,0 +1,36 @@
+/**
+ * API Key authentication strategy.
+ *
+ * Supports: Authorization: Bearer <key> or X-API-Key: <key>
+ *
+ * @implements MISS-8
+ */
+export class ApiKeyStrategy {
+    name = "api-key";
+    #config;
+    #headerName;
+    constructor(config) {
+        this.#config = config;
+        this.#headerName = config.headerName ?? "x-api-key";
+    }
+    /** The HTTP header name to extract the API key from. */
+    get headerName() {
+        return this.#headerName;
+    }
+    async authenticate(_credentials) {
+        throw new Error("ApiKeyStrategy does not support credential-based auth. Use verify() with the API key.");
+    }
+    async verify(token) {
+        const result = await this.#config.findByKey(token);
+        if (!result)
+            return { authenticated: false, error: "Invalid API key" };
+        const user = { ...result.user };
+        if (result.scopes && result.scopes.length > 0) {
+            // Merge scopes into permissions without mutating source object.
+            const merged = new Set([...(user.permissions ?? []), ...result.scopes]);
+            user.permissions = [...merged];
+        }
+        return { authenticated: true, user };
+    }
+}
+//# sourceMappingURL=ApiKeyStrategy.js.map

package/dist/strategies/ApiKeyStrategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ApiKeyStrategy.js","sourceRoot":"","sources":["../../src/strategies/ApiKeyStrategy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAWH,MAAM,OAAO,cAAc;IAC1B,IAAI,GAAG,SAAS,CAAC;IACjB,OAAO,CAAe;IACtB,WAAW,CAAS;IAEpB,YAAY,MAAoB;QAC/B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,UAAU,IAAI,WAAW,CAAC;IACrD,CAAC;IAED,wDAAwD;IACxD,IAAI,UAAU;QACb,OAAO,IAAI,CAAC,WAAW,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,YAGlB;QACA,MAAM,IAAI,KAAK,CACd,uFAAuF,CACvF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;QAEvE,MAAM,IAAI,GAAgB,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/C,gEAAgE;YAChE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACxE,IAAI,CAAC,WAAW,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACtC,CAAC;CACD"}

package/dist/strategies/JwtStrategy.d.ts

@@ -0,0 +1,51 @@
+/**
+ * JwtStrategy — HMAC-SHA256 JWT authentication strategy.
+ * All signing and verification runs through the Rust warden-engine via NAPI.
+ */
+import type { AuthResult, AuthStrategy, UserPayload } from "../AuthManager.js";
+import type { TokenBlacklist } from "../TokenBlacklist.js";
+export interface JwtStrategyConfig {
+    /**
+     * Active signing secret. New tokens are always signed with this key.
+     * For zero-downtime key rotation, also pass `previousSecrets` — verify
+     * tries each entry until one matches, then `revoke()` the rotated key
+     * by removing it from the config on the next deploy.
+     */
+    secret: string;
+    /**
+     * Older secrets accepted at verify time but never used to sign new
+     * tokens. Empty / omitted by default. Order doesn't matter for
+     * correctness but ordering by recency keeps the common path fast.
+     */
+    previousSecrets?: readonly string[];
+    expiresInSeconds?: number;
+    findUser: (id: string) => Promise<UserPayload | null>;
+    verifyCredentials: (email: string, password: string) => Promise<UserPayload | null>;
+    /**
+     * Optional blacklist for revocation. When supplied, `verify` rejects
+     * tokens whose `jti` is present, and `revoke(token)` adds the token's
+     * `jti` to the blacklist for the remainder of its lifetime. Without a
+     * blacklist, `revoke()` throws — the call would be a no-op silently.
+     */
+    blacklist?: TokenBlacklist;
+}
+export declare class JwtStrategy implements AuthStrategy {
+    #private;
+    name: string;
+    constructor(config: JwtStrategyConfig);
+    authenticate(credentials: Record<string, unknown>): Promise<AuthResult>;
+    verify(token: string): Promise<AuthResult>;
+    signToken(user: UserPayload): string;
+    /**
+     * Revoke a token until its `exp` claim. Requires the strategy to be
+     * constructed with a `blacklist` driver — otherwise throws so that a
+     * caller assuming revocation does not silently succeed against
+     * a no-op implementation.
+     *
+     * Returns `true` when the token was added to the blacklist, `false` when
+     * the token is already expired (revocation is unnecessary) or unparseable.
+     */
+    revoke(token: string): Promise<boolean>;
+}
+export declare function generateJwtSecret(): string;
+//# sourceMappingURL=JwtStrategy.d.ts.map

package/dist/strategies/JwtStrategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"JwtStrategy.d.ts","sourceRoot":"","sources":["../../src/strategies/JwtStrategy.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAE/E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAwC3D,MAAM,WAAW,iBAAiB;IACjC;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACtD,iBAAiB,EAAE,CAClB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,KACZ,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACjC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,cAAc,CAAC;CAC3B;AAED,qBAAa,WAAY,YAAW,YAAY;;IAC/C,IAAI,SAAS;gBAaD,MAAM,EAAE,iBAAiB;IAgC/B,YAAY,CACjB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAClC,OAAO,CAAC,UAAU,CAAC;IAkBhB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAgChD,SAAS,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM;IAepC;;;;;;;;OAQG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAa7C;AAED,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C"}