@c9up/warden 0.1.13 → 0.1.14

package/dist/AuthManager.d.ts

@@ -5,6 +5,7 @@
  */
 import { RightsResolver } from "./rights/RightsResolver.js";
 import type { EffectivePermissions, Scope } from "./rights/types.js";
+import type { SessionStore } from "./strategies/SessionStrategy.js";
 export interface UserPayload {
     id: string;
     roles?: string[];
@@ -29,15 +30,32 @@ export interface AuthStrategy {
     authenticate(credentials: Record<string, unknown>): Promise<AuthResult>;
     verify(token: string, context?: Record<string, unknown>): Promise<AuthResult>;
 }
+/**
+ * AuthManager configuration. Two equivalent forms are accepted:
+ *
+ *   - AdonisJS form (preferred): `{ default, guards }` — `default` names the
+ *     guard used when none is specified, `guards` maps guard name → strategy.
+ *   - Legacy form: `{ defaultStrategy, strategies }` — kept working so existing
+ *     call sites and tests need no change.
+ *
+ * Exactly one of each pair must be supplied. Internally normalised to the
+ * AdonisJS names (`default` / `guards`).
+ */
 export interface AuthConfig {
-    defaultStrategy: string;
-    strategies: Record<string, AuthStrategy>;
+    /** AdonisJS name for the default guard. */
+    default?: string;
+    /** AdonisJS name for the guard map (name → strategy). */
+    guards?: Record<string, AuthStrategy>;
+    /** Legacy alias for {@link AuthConfig.default}. */
+    defaultStrategy?: string;
+    /** Legacy alias for {@link AuthConfig.guards}. */
+    strategies?: Record<string, AuthStrategy>;
     /**
      * The rights resolver backing the coarse RBAC helpers (Epic 56). When
      * absent, a default `RightsResolver(new MemoryRightsStore())` is used so
-     * `new AuthManager({ defaultStrategy, strategies })` keeps working — with
-     * an empty store, payload roles still fold in (D2) and permissions are
-     * empty (token `user.permissions` is not an input — D1).
+     * `new AuthManager({ default, guards })` keeps working — with an empty
+     * store, payload roles still fold in (D2) and permissions are empty (token
+     * `user.permissions` is not an input — D1).
      */
     rights?: RightsResolver;
 }
@@ -45,8 +63,8 @@ export interface AuthConfig {
  * Manages authentication strategies and provides guard/permission checks.
  */
 export declare class AuthManager {
-    private strategies;
-    private defaultStrategy;
+    private guards;
+    private default;
     private readonly rights;
     constructor(config: AuthConfig);
     /** Authenticate with credentials using a specific or default strategy. */
@@ -95,14 +113,32 @@ export declare class AuthManager {
     /** Get a registered strategy by name. */
     getStrategy(name?: string): AuthStrategy;
     /**
-     * Name of the default strategy (Adonis's "default guard"). Used by
-     * `silentAuth` to pick which strategy to attempt when a route declares none.
+     * Name of the default guard (Adonis's "default guard"). Used by `silentAuth`
+     * and the {@link Authenticator} to pick which guard to attempt when a route
+     * declares none.
      */
     get defaultStrategyName(): string;
     /** Register a new strategy at runtime. */
     registerStrategy(name: string, strategy: AuthStrategy): void;
     /** Get all registered strategy names. */
     getStrategyNames(): string[];
+    /**
+     * Log a user in through a session-capable guard (AdonisJS
+     * `auth.use('web').login(user)` parity). Delegates to the guard's own
+     * `login()` — for `SessionStrategy` this rotates the session id (session
+     * fixation defence) and stores the user id. Throws if the resolved guard
+     * cannot log in (e.g. JWT / API-key guards, which are stateless).
+     *
+     * Fixes the misleading `SessionStrategy.authenticate()` sentinel that
+     * pointed at a then-nonexistent `authManager.login()` (bug-3261).
+     */
+    login(user: UserPayload, session: SessionStore, strategyName?: string): Promise<void>;
+    /**
+     * Log a user out of a session-capable guard (AdonisJS `auth.use('web').logout()`
+     * parity). Delegates to the guard's `logout()`. Throws if the resolved guard
+     * cannot log out.
+     */
+    logout(session: SessionStore, strategyName?: string): Promise<void>;
 }
 /** Strip dangerous prototype-pollution keys from user payload. */
 /**

package/dist/AuthManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthManager.d.ts","sourceRoot":"","sources":["../src/AuthManager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAErE,MAAM,WAAW,WAAW;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IAC1B,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,IAAI,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACxE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAC9E;AAED,MAAM,WAAW,UAAU;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACzC;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,cAAc,CAAC;CACxB;AAkBD;;GAEG;AACH,qBAAa,WAAW;IACvB,OAAO,CAAC,UAAU,CAAwC;IAC1D,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;gBAE5B,MAAM,EAAE,UAAU;IA0B9B,0EAA0E;IACpE,YAAY,CACjB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,YAAY,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,UAAU,CAAC;IAmBtB,8CAA8C;IACxC,MAAM,CACX,KAAK,EAAE,MAAM,EACb,YAAY,CAAC,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAAC,UAAU,CAAC;IAoBtB;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM;IAc1D;;;;;;;OAOG;IACH,kBAAkB,CACjB,IAAI,EAAE,WAAW,EACjB,KAAK,GAAE,KAAgB,GACrB,OAAO,CAAC,oBAAoB,CAAC;IAIhC;;;;OAIG;IACG,OAAO,CACZ,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,MAAM,EACZ,KAAK,GAAE,KAAgB,GACrB,OAAO,CAAC,OAAO,CAAC;IAInB;;;;OAIG;IACG,aAAa,CAClB,IAAI,EAAE,WAAW,EACjB,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,KAAgB,GACrB,OAAO,CAAC,OAAO,CAAC;IAInB;;;OAGG;IACG,iBAAiB,CACtB,IAAI,EAAE,WAAW,EACjB,WAAW,EAAE,MAAM,EAAE,EACrB,KAAK,GAAE,KAAgB,GACrB,OAAO,CAAC,OAAO,CAAC;IAInB,yCAAyC;IACzC,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,YAAY;IAexC;;;OAGG;IACH,IAAI,mBAAmB,IAAI,MAAM,CAEhC;IAED,0CAA0C;IAC1C,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,GAAG,IAAI;IAI5D,yCAAyC;IACzC,gBAAgB,IAAI,MAAM,EAAE;CAG5B;AAED,kEAAkE;AAClE;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAMvD"}
+{"version":3,"file":"AuthManager.d.ts","sourceRoot":"","sources":["../src/AuthManager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AACrE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAEpE,MAAM,WAAW,WAAW;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IAC1B,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,IAAI,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACxE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAC9E;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,UAAU;IAC1B,2CAA2C;IAC3C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACtC,mDAAmD;IACnD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kDAAkD;IAClD,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC1C;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,cAAc,CAAC;CACxB;AAkBD;;GAEG;AACH,qBAAa,WAAW;IAGvB,OAAO,CAAC,MAAM,CAAwC;IACtD,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;gBAE5B,MAAM,EAAE,UAAU;IAoC9B,0EAA0E;IACpE,YAAY,CACjB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,YAAY,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,UAAU,CAAC;IAmBtB,8CAA8C;IACxC,MAAM,CACX,KAAK,EAAE,MAAM,EACb,YAAY,CAAC,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAAC,UAAU,CAAC;IAoBtB;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM;IAc1D;;;;;;;OAOG;IACH,kBAAkB,CACjB,IAAI,EAAE,WAAW,EACjB,KAAK,GAAE,KAAgB,GACrB,OAAO,CAAC,oBAAoB,CAAC;IAIhC;;;;OAIG;IACG,OAAO,CACZ,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,MAAM,EACZ,KAAK,GAAE,KAAgB,GACrB,OAAO,CAAC,OAAO,CAAC;IAInB;;;;OAIG;IACG,aAAa,CAClB,IAAI,EAAE,WAAW,EACjB,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,KAAgB,GACrB,OAAO,CAAC,OAAO,CAAC;IAInB;;;OAGG;IACG,iBAAiB,CACtB,IAAI,EAAE,WAAW,EACjB,WAAW,EAAE,MAAM,EAAE,EACrB,KAAK,GAAE,KAAgB,GACrB,OAAO,CAAC,OAAO,CAAC;IAInB,yCAAyC;IACzC,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,YAAY;IAexC;;;;OAIG;IACH,IAAI,mBAAmB,IAAI,MAAM,CAEhC;IAED,0CAA0C;IAC1C,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,GAAG,IAAI;IAI5D,yCAAyC;IACzC,gBAAgB,IAAI,MAAM,EAAE;IAI5B;;;;;;;;;OASG;IACG,KAAK,CACV,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,YAAY,EACrB,YAAY,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC;IAchB;;;;OAIG;IACG,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAUzE;AAwBD,kEAAkE;AAClE;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAMvD"}

package/dist/AuthManager.js

@@ -18,26 +18,35 @@ function isTokenIssuer(strategy) {
  * Manages authentication strategies and provides guard/permission checks.
  */
 export class AuthManager {
-    strategies = new Map();
-    defaultStrategy;
+    // AdonisJS names: `guards` (name → strategy) and `default` (the guard used
+    // when none is named). Renamed from the previous `strategies`/`defaultStrategy`.
+    guards = new Map();
+    default;
     rights;
     constructor(config) {
-        this.defaultStrategy = config.defaultStrategy;
+        // Normalise the two accepted forms — AdonisJS `{ default, guards }` and
+        // the legacy `{ defaultStrategy, strategies }` — to the AdonisJS names.
+        const guards = config.guards ?? config.strategies;
+        const defaultGuard = config.default ?? config.defaultStrategy;
+        if (!guards || defaultGuard === undefined) {
+            throw new WardenError("INVALID_CONFIG", "AuthManager: config must supply `default` + `guards` (or the legacy `defaultStrategy` + `strategies`).");
+        }
+        this.default = defaultGuard;
         this.rights = config.rights ?? new RightsResolver(new MemoryRightsStore());
-        for (const [name, strategy] of Object.entries(config.strategies)) {
-            this.strategies.set(name, strategy);
+        for (const [name, strategy] of Object.entries(guards)) {
+            this.guards.set(name, strategy);
         }
-        // Fail-fast at construction: an AuthManager with zero strategies
-        // is a configuration bug. Previously, an empty `strategies: {}`
-        // passed the constructor cleanly and the first protected request
-        // crashed at runtime when `getStrategy('jwt')` threw — opaque 401
-        // or 500 instead of a boot-time INVALID_CONFIG that points the
-        // operator at the missing `config.auth.jwt` (or other strategy).
-        if (Object.keys(config.strategies).length === 0) {
-            throw new WardenError("INVALID_CONFIG", `AuthManager: no authentication strategies registered. Configure at least one strategy (e.g. config.warden.auth.jwt) before booting WardenProvider.`);
+        // Fail-fast at construction: an AuthManager with zero guards is a
+        // configuration bug. Previously, an empty `guards: {}` passed the
+        // constructor cleanly and the first protected request crashed at
+        // runtime when `getStrategy('jwt')` threw — opaque 401 or 500 instead
+        // of a boot-time INVALID_CONFIG that points the operator at the missing
+        // `config.auth.jwt` (or other guard).
+        if (this.guards.size === 0) {
+            throw new WardenError("INVALID_CONFIG", `AuthManager: no authentication guards registered. Configure at least one guard (e.g. config.warden.auth.jwt) before booting WardenProvider.`);
         }
-        if (!this.strategies.has(config.defaultStrategy)) {
-            throw new WardenError("INVALID_CONFIG", `defaultStrategy '${config.defaultStrategy}' is not present in strategies`);
+        if (!this.guards.has(defaultGuard)) {
+            throw new WardenError("INVALID_CONFIG", `default guard '${defaultGuard}' is not present in guards`);
         }
     }
     /** Authenticate with credentials using a specific or default strategy. */
@@ -98,7 +107,7 @@ export class AuthManager {
     issueFor(user, strategyName) {
         const strategy = this.getStrategy(strategyName);
         if (!isTokenIssuer(strategy)) {
-            throw new WardenError("STRATEGY_CANNOT_ISSUE", `Auth strategy '${strategyName ?? this.defaultStrategy}' cannot issue tokens.`, {
+            throw new WardenError("STRATEGY_CANNOT_ISSUE", `Auth strategy '${strategyName ?? this.default}' cannot issue tokens.`, {
                 hint: "issueFor() needs a token-minting strategy (e.g. JwtStrategy with signToken). Session / API-key strategies don't mint tokens.",
             });
         }
@@ -140,8 +149,8 @@ export class AuthManager {
     }
     /** Get a registered strategy by name. */
     getStrategy(name) {
-        const strategyName = name ?? this.defaultStrategy;
-        const strategy = this.strategies.get(strategyName);
+        const strategyName = name ?? this.default;
+        const strategy = this.guards.get(strategyName);
         if (!strategy) {
             throw new WardenError("STRATEGY_NOT_FOUND", `Auth strategy '${strategyName}' not registered`, {
                 hint: "Call registerStrategy() before using this strategy name.",
@@ -150,20 +159,63 @@ export class AuthManager {
         return strategy;
     }
     /**
-     * Name of the default strategy (Adonis's "default guard"). Used by
-     * `silentAuth` to pick which strategy to attempt when a route declares none.
+     * Name of the default guard (Adonis's "default guard"). Used by `silentAuth`
+     * and the {@link Authenticator} to pick which guard to attempt when a route
+     * declares none.
      */
     get defaultStrategyName() {
-        return this.defaultStrategy;
+        return this.default;
     }
     /** Register a new strategy at runtime. */
     registerStrategy(name, strategy) {
-        this.strategies.set(name, strategy);
+        this.guards.set(name, strategy);
     }
     /** Get all registered strategy names. */
     getStrategyNames() {
-        return [...this.strategies.keys()];
+        return [...this.guards.keys()];
+    }
+    /**
+     * Log a user in through a session-capable guard (AdonisJS
+     * `auth.use('web').login(user)` parity). Delegates to the guard's own
+     * `login()` — for `SessionStrategy` this rotates the session id (session
+     * fixation defence) and stores the user id. Throws if the resolved guard
+     * cannot log in (e.g. JWT / API-key guards, which are stateless).
+     *
+     * Fixes the misleading `SessionStrategy.authenticate()` sentinel that
+     * pointed at a then-nonexistent `authManager.login()` (bug-3261).
+     */
+    async login(user, session, strategyName) {
+        const strategy = this.getStrategy(strategyName);
+        if (!isLoginCapable(strategy)) {
+            throw new WardenError("STRATEGY_CANNOT_LOGIN", `Auth strategy '${strategyName ?? this.default}' does not support session login.`, {
+                hint: "login()/logout() need a stateful guard (e.g. SessionStrategy). JWT / API-key guards are stateless — mint a token with issueFor() instead.",
+            });
+        }
+        await strategy.login(user, session);
     }
+    /**
+     * Log a user out of a session-capable guard (AdonisJS `auth.use('web').logout()`
+     * parity). Delegates to the guard's `logout()`. Throws if the resolved guard
+     * cannot log out.
+     */
+    async logout(session, strategyName) {
+        const strategy = this.getStrategy(strategyName);
+        if (!isLoginCapable(strategy)) {
+            throw new WardenError("STRATEGY_CANNOT_LOGIN", `Auth strategy '${strategyName ?? this.default}' does not support session logout.`);
+        }
+        await strategy.logout(session);
+    }
+}
+/**
+ * Capability check for {@link AuthManager.login}/{@link AuthManager.logout}.
+ * `login`/`logout` are not on the base `AuthStrategy` contract (only stateful
+ * guards implement them), so narrow via `in` + `typeof` — no cast.
+ */
+function isLoginCapable(strategy) {
+    return ("login" in strategy &&
+        typeof strategy.login === "function" &&
+        "logout" in strategy &&
+        typeof strategy.logout === "function");
 }
 /** Strip dangerous prototype-pollution keys from user payload. */
 /**

package/dist/AuthManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthManager.js","sourceRoot":"","sources":["../src/AuthManager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAgD5D;;;;GAIG;AACH,SAAS,aAAa,CACrB,QAAsB;IAEtB,OAAO,WAAW,IAAI,QAAQ,IAAI,OAAO,QAAQ,CAAC,SAAS,KAAK,UAAU,CAAC;AAC5E,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,WAAW;IACf,UAAU,GAA8B,IAAI,GAAG,EAAE,CAAC;IAClD,eAAe,CAAS;IACf,MAAM,CAAiB;IAExC,YAAY,MAAkB;QAC7B,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;QAC9C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,cAAc,CAAC,IAAI,iBAAiB,EAAE,CAAC,CAAC;QAC3E,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAClE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACrC,CAAC;QACD,iEAAiE;QACjE,gEAAgE;QAChE,iEAAiE;QACjE,kEAAkE;QAClE,+DAA+D;QAC/D,iEAAiE;QACjE,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,WAAW,CACpB,gBAAgB,EAChB,oJAAoJ,CACpJ,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,WAAW,CACpB,gBAAgB,EAChB,oBAAoB,MAAM,CAAC,eAAe,gCAAgC,CAC1E,CAAC;QACH,CAAC;IACF,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,YAAY,CACjB,WAAoC,EACpC,YAAqB;QAErB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;YACxD,IAAI,MAAM,CAAC,IAAI;gBAAE,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9C,OAAO,MAAM,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,oEAAoE;YACpE,qEAAqE;YACrE,kEAAkE;YAClE,IAAI,GAAG,YAAY,WAAW;gBAAE,MAAM,GAAG,CAAC;YAC1C,OAAO;gBACN,aAAa,EAAE,KAAK;gBACpB,KAAK,EACJ,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B;aACpE,CAAC;QACH,CAAC;IACF,CAAC;IAED,8CAA8C;IAC9C,KAAK,CAAC,MAAM,CACX,KAAa,EACb,YAAqB,EACrB,OAAiC;QAEjC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACrD,IAAI,MAAM,CAAC,IAAI;gBAAE,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9C,OAAO,MAAM,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,mEAAmE;YACnE,mEAAmE;YACnE,sEAAsE;YACtE,IAAI,GAAG,YAAY,WAAW;gBAAE,MAAM,GAAG,CAAC;YAC1C,OAAO;gBACN,aAAa,EAAE,KAAK;gBACpB,KAAK,EACJ,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,4BAA4B;gBAClE,aAAa,EAAE,IAAI;aACnB,CAAC;QACH,CAAC;IACF,CAAC;IAED;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,IAAiB,EAAE,YAAqB;QAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,WAAW,CACpB,uBAAuB,EACvB,kBAAkB,YAAY,IAAI,IAAI,CAAC,eAAe,wBAAwB,EAC9E;gBACC,IAAI,EAAE,8HAA8H;aACpI,CACD,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;;OAOG;IACH,kBAAkB,CACjB,IAAiB,EACjB,QAAe,QAAQ;QAEvB,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CACZ,IAAiB,EACjB,IAAY,EACZ,QAAe,QAAQ;QAEvB,OAAO,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CAClB,IAAiB,EACjB,UAAkB,EAClB,QAAe,QAAQ;QAEvB,OAAO,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACrE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,iBAAiB,CACtB,IAAiB,EACjB,WAAqB,EACrB,QAAe,QAAQ;QAEvB,OAAO,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACzE,CAAC;IAED,yCAAyC;IACzC,WAAW,CAAC,IAAa;QACxB,MAAM,YAAY,GAAG,IAAI,IAAI,IAAI,CAAC,eAAe,CAAC;QAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,MAAM,IAAI,WAAW,CACpB,oBAAoB,EACpB,kBAAkB,YAAY,kBAAkB,EAChD;gBACC,IAAI,EAAE,0DAA0D;aAChE,CACD,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,IAAI,mBAAmB;QACtB,OAAO,IAAI,CAAC,eAAe,CAAC;IAC7B,CAAC;IAED,0CAA0C;IAC1C,gBAAgB,CAAC,IAAY,EAAE,QAAsB;QACpD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED,yCAAyC;IACzC,gBAAgB;QACf,OAAO,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC;CACD;AAED,kEAAkE;AAClE;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAiB;IAChD,KAAK,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,CAAC;QAC7D,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;YACjB,OAAQ,IAAgC,CAAC,GAAG,CAAC,CAAC;QAC/C,CAAC;IACF,CAAC;AACF,CAAC"}
+{"version":3,"file":"AuthManager.js","sourceRoot":"","sources":["../src/AuthManager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAkE5D;;;;GAIG;AACH,SAAS,aAAa,CACrB,QAAsB;IAEtB,OAAO,WAAW,IAAI,QAAQ,IAAI,OAAO,QAAQ,CAAC,SAAS,KAAK,UAAU,CAAC;AAC5E,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,WAAW;IACvB,2EAA2E;IAC3E,iFAAiF;IACzE,MAAM,GAA8B,IAAI,GAAG,EAAE,CAAC;IAC9C,OAAO,CAAS;IACP,MAAM,CAAiB;IAExC,YAAY,MAAkB;QAC7B,wEAAwE;QACxE,wEAAwE;QACxE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC;QAClD,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,eAAe,CAAC;QAC9D,IAAI,CAAC,MAAM,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC3C,MAAM,IAAI,WAAW,CACpB,gBAAgB,EAChB,wGAAwG,CACxG,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,YAAY,CAAC;QAC5B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,cAAc,CAAC,IAAI,iBAAiB,EAAE,CAAC,CAAC;QAC3E,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACvD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACjC,CAAC;QACD,kEAAkE;QAClE,kEAAkE;QAClE,iEAAiE;QACjE,sEAAsE;QACtE,wEAAwE;QACxE,sCAAsC;QACtC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,WAAW,CACpB,gBAAgB,EAChB,6IAA6I,CAC7I,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,WAAW,CACpB,gBAAgB,EAChB,kBAAkB,YAAY,4BAA4B,CAC1D,CAAC;QACH,CAAC;IACF,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,YAAY,CACjB,WAAoC,EACpC,YAAqB;QAErB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;YACxD,IAAI,MAAM,CAAC,IAAI;gBAAE,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9C,OAAO,MAAM,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,oEAAoE;YACpE,qEAAqE;YACrE,kEAAkE;YAClE,IAAI,GAAG,YAAY,WAAW;gBAAE,MAAM,GAAG,CAAC;YAC1C,OAAO;gBACN,aAAa,EAAE,KAAK;gBACpB,KAAK,EACJ,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B;aACpE,CAAC;QACH,CAAC;IACF,CAAC;IAED,8CAA8C;IAC9C,KAAK,CAAC,MAAM,CACX,KAAa,EACb,YAAqB,EACrB,OAAiC;QAEjC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACrD,IAAI,MAAM,CAAC,IAAI;gBAAE,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9C,OAAO,MAAM,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,mEAAmE;YACnE,mEAAmE;YACnE,sEAAsE;YACtE,IAAI,GAAG,YAAY,WAAW;gBAAE,MAAM,GAAG,CAAC;YAC1C,OAAO;gBACN,aAAa,EAAE,KAAK;gBACpB,KAAK,EACJ,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,4BAA4B;gBAClE,aAAa,EAAE,IAAI;aACnB,CAAC;QACH,CAAC;IACF,CAAC;IAED;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,IAAiB,EAAE,YAAqB;QAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,WAAW,CACpB,uBAAuB,EACvB,kBAAkB,YAAY,IAAI,IAAI,CAAC,OAAO,wBAAwB,EACtE;gBACC,IAAI,EAAE,8HAA8H;aACpI,CACD,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;;OAOG;IACH,kBAAkB,CACjB,IAAiB,EACjB,QAAe,QAAQ;QAEvB,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CACZ,IAAiB,EACjB,IAAY,EACZ,QAAe,QAAQ;QAEvB,OAAO,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CAClB,IAAiB,EACjB,UAAkB,EAClB,QAAe,QAAQ;QAEvB,OAAO,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACrE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,iBAAiB,CACtB,IAAiB,EACjB,WAAqB,EACrB,QAAe,QAAQ;QAEvB,OAAO,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACzE,CAAC;IAED,yCAAyC;IACzC,WAAW,CAAC,IAAa;QACxB,MAAM,YAAY,GAAG,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,MAAM,IAAI,WAAW,CACpB,oBAAoB,EACpB,kBAAkB,YAAY,kBAAkB,EAChD;gBACC,IAAI,EAAE,0DAA0D;aAChE,CACD,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACH,IAAI,mBAAmB;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC;IACrB,CAAC;IAED,0CAA0C;IAC1C,gBAAgB,CAAC,IAAY,EAAE,QAAsB;QACpD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACjC,CAAC;IAED,yCAAyC;IACzC,gBAAgB;QACf,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,KAAK,CACV,IAAiB,EACjB,OAAqB,EACrB,YAAqB;QAErB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,WAAW,CACpB,uBAAuB,EACvB,kBAAkB,YAAY,IAAI,IAAI,CAAC,OAAO,mCAAmC,EACjF;gBACC,IAAI,EAAE,2IAA2I;aACjJ,CACD,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,OAAqB,EAAE,YAAqB;QACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,WAAW,CACpB,uBAAuB,EACvB,kBAAkB,YAAY,IAAI,IAAI,CAAC,OAAO,oCAAoC,CAClF,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;CACD;AAQD;;;;GAIG;AACH,SAAS,cAAc,CACtB,QAAsB;IAEtB,OAAO,CACN,OAAO,IAAI,QAAQ;QACnB,OAAO,QAAQ,CAAC,KAAK,KAAK,UAAU;QACpC,QAAQ,IAAI,QAAQ;QACpB,OAAO,QAAQ,CAAC,MAAM,KAAK,UAAU,CACrC,CAAC;AACH,CAAC;AAED,kEAAkE;AAClE;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAiB;IAChD,KAAK,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,CAAC;QAC7D,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;YACjB,OAAQ,IAAgC,CAAC,GAAG,CAAC,CAAC;QAC/C,CAAC;IACF,CAAC;AACF,CAAC"}

package/dist/Authenticator.d.ts

@@ -0,0 +1,128 @@
+/**
+ * Authenticator — a PER-REQUEST authentication contract (AdonisJS
+ * `@adonisjs/auth` `Authenticator` parity), attached as `ctx.auth`.
+ *
+ * Why it exists: before this, `ctx.auth` was a plain data object with no
+ * methods, so an INLINE route handler (`router.post('/login', handler)`) had no
+ * way to authenticate on demand — only the `@Guard` decorator path worked, and
+ * that reads `ctx.route.controller/action`, which inline/functional routes don't
+ * expose. This contract makes `await ctx.auth.authenticate()` /
+ * `ctx.auth.use('session').login(user)` work anywhere, exactly like Adonis.
+ *
+ * Warden stays agnostic: the Authenticator is built from the {@link AuthManager}
+ * (resolved via `ctx.containerResolver`) + the request `ctx`; it never imports
+ * `@c9up/ream`.
+ */
+import { type AuthManager, type AuthResult, type UserPayload } from "./AuthManager.js";
+import type { WardenContext } from "./middleware.js";
+import type { SessionStore } from "./strategies/SessionStrategy.js";
+/**
+ * Guard names Warden accepts for the API-key / access-tokens driver. AdonisJS
+ * names the driver `access_tokens`; the legacy `api-key` spelling stays valid so
+ * existing `@Guard('api-key')` routes and configs keep working.
+ */
+export declare const API_KEY_GUARD_NAMES: readonly string[];
+/** The credentials Warden extracts from a request, independent of guard list. */
+export interface ExtractedCredentials {
+    bearerToken: string;
+    apiKey: string;
+    session: SessionStore | undefined;
+}
+/**
+ * Extract the request's credentials once — a Bearer token, an API key (read from
+ * the configured header, matched case-insensitively), and the session store.
+ * Shared by `wardenMiddleware`, `silentAuth`, and the Authenticator so all three
+ * read credentials identically.
+ */
+export declare function extractCredentials(ctx: WardenContext, auth: AuthManager): ExtractedCredentials;
+/** Outcome of {@link tryAuthenticate}. */
+export interface AuthAttempt {
+    result: AuthResult | null;
+    /** Name of the guard that authenticated (only when `result.authenticated`). */
+    viaGuard?: string;
+    attemptCount: number;
+    crashCount: number;
+}
+/**
+ * Try each declared guard in order — session guards via `verifyWithContext()`,
+ * others via `verify(token)` with native-first credential fallback.
+ * Distinguishes crashes (strategy threw / `strategyCrash`) from credential
+ * rejections so the caller can return 500 vs 401.
+ */
+export declare function tryAuthenticate(auth: AuthManager, strategies: string[], creds: {
+    bearerToken: string;
+    apiKey: string;
+    session: SessionStore | undefined;
+    hasSessionStrategy: boolean;
+}): Promise<AuthAttempt>;
+/**
+ * A named-guard accessor (AdonisJS `auth.use('web')`). Exposes the stateful
+ * `login()`/`logout()` for session guards plus per-guard `authenticate()`.
+ */
+export declare class GuardAccessor {
+    #private;
+    constructor(ctx: WardenContext, auth: AuthManager, name: string, parent: Authenticator);
+    /** The user, only if the request authenticated via THIS guard. */
+    get user(): UserPayload | undefined;
+    get isAuthenticated(): boolean;
+    /** Authenticate the request using only this guard (throws on failure). */
+    authenticate(): Promise<void>;
+    /** Log a user in through this guard (session guards). */
+    login(user: UserPayload): Promise<void>;
+    /** Log the current user out of this guard (session guards). */
+    logout(): Promise<void>;
+}
+/**
+ * Per-request Authenticator attached as `ctx.auth`. Mirrors AdonisJS's
+ * `Authenticator` surface: `authenticate` / `check` / `authenticateUsing` /
+ * `getUserOrFail` / `use`, plus the `user` / `isAuthenticated` /
+ * `authenticationAttempted` / `authenticatedViaGuard` getters.
+ */
+export declare class Authenticator {
+    #private;
+    constructor(ctx: WardenContext, auth: AuthManager);
+    /** The authenticated user, or `undefined` for a guest. */
+    get user(): UserPayload | undefined;
+    /** Whether the request has an authenticated user (AdonisJS name). */
+    get isAuthenticated(): boolean;
+    /** Whether `authenticate`/`check`/`authenticateUsing` ran this request. */
+    get authenticationAttempted(): boolean;
+    /** Name of the guard that authenticated the request, if any. */
+    get authenticatedViaGuard(): string | undefined;
+    /**
+     * Roles of the authenticated user (Ream reads `ctx.auth.roles ??
+     * ctx.auth.user.roles`). Warden nests them under `user`; this getter mirrors
+     * them at the top level for the host's guard readers.
+     */
+    get roles(): string[] | undefined;
+    /** Permissions of the authenticated user (see {@link Authenticator.roles}). */
+    get permissions(): string[] | undefined;
+    /** Authenticate via the default guard. Throws `E_UNAUTHORIZED_ACCESS` on failure. */
+    authenticate(): Promise<void>;
+    /**
+     * Like {@link Authenticator.authenticate} but returns a boolean instead of
+     * throwing on a credential rejection. A strategy CRASH / config error still
+     * propagates (a server incident must not be silently swallowed as "guest").
+     */
+    check(): Promise<boolean>;
+    /**
+     * Authenticate by trying the given guards in order (default: the default
+     * guard). Sets the user on the first success; throws `E_UNAUTHORIZED_ACCESS`
+     * (401, carrying `redirectTo` for session guards) when all reject, or a
+     * `WARDEN_AUTH_STRATEGY_ERROR` (500) when every attempted guard crashed.
+     */
+    authenticateUsing(guards?: string[], options?: {
+        loginRoute?: string;
+    }): Promise<void>;
+    /** Return the authenticated user or throw `E_UNAUTHORIZED_ACCESS`. */
+    getUserOrFail(): UserPayload;
+    /** Access a named guard (AdonisJS `auth.use('web')`). Instances are cached per request. */
+    use(name: string): GuardAccessor;
+    /**
+     * @internal Seed the Authenticator from a result the enforcing middleware
+     * already computed, so `ctx.auth` reflects the authenticated user without a
+     * second verify pass.
+     */
+    adopt(result: AuthResult | null, viaGuard: string | undefined): void;
+}
+//# sourceMappingURL=Authenticator.d.ts.map

package/dist/Authenticator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Authenticator.d.ts","sourceRoot":"","sources":["../src/Authenticator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EACN,KAAK,WAAW,EAChB,KAAK,UAAU,EAGf,KAAK,WAAW,EAChB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAEpE;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAGhD,CAAC;AAcF,iFAAiF;AACjF,MAAM,WAAW,oBAAoB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,YAAY,GAAG,SAAS,CAAC;CAClC;AAoBD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CACjC,GAAG,EAAE,aAAa,EAClB,IAAI,EAAE,WAAW,GACf,oBAAoB,CAUtB;AAED,0CAA0C;AAC1C,MAAM,WAAW,WAAW;IAC3B,MAAM,EAAE,UAAU,GAAG,IAAI,CAAC;IAC1B,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACpC,IAAI,EAAE,WAAW,EACjB,UAAU,EAAE,MAAM,EAAE,EACpB,KAAK,EAAE;IACN,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,YAAY,GAAG,SAAS,CAAC;IAClC,kBAAkB,EAAE,OAAO,CAAC;CAC5B,GACC,OAAO,CAAC,WAAW,CAAC,CAyDtB;AAED;;;GAGG;AACH,qBAAa,aAAa;;gBAOxB,GAAG,EAAE,aAAa,EAClB,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,aAAa;IAQtB,kEAAkE;IAClE,IAAI,IAAI,IAAI,WAAW,GAAG,SAAS,CAIlC;IAED,IAAI,eAAe,IAAI,OAAO,CAE7B;IAED,0EAA0E;IAC1E,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAI7B,yDAAyD;IACzD,KAAK,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvC,+DAA+D;IAC/D,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;CAavB;AAED;;;;;GAKG;AACH,qBAAa,aAAa;;gBAQb,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,WAAW;IAKjD,0DAA0D;IAC1D,IAAI,IAAI,IAAI,WAAW,GAAG,SAAS,CAElC;IAED,qEAAqE;IACrE,IAAI,eAAe,IAAI,OAAO,CAE7B;IAED,2EAA2E;IAC3E,IAAI,uBAAuB,IAAI,OAAO,CAErC;IAED,gEAAgE;IAChE,IAAI,qBAAqB,IAAI,MAAM,GAAG,SAAS,CAE9C;IAED;;;;OAIG;IACH,IAAI,KAAK,IAAI,MAAM,EAAE,GAAG,SAAS,CAEhC;IAED,+EAA+E;IAC/E,IAAI,WAAW,IAAI,MAAM,EAAE,GAAG,SAAS,CAEtC;IAED,qFAAqF;IACrF,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAI7B;;;;OAIG;IACG,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC;IAU/B;;;;;OAKG;IACG,iBAAiB,CACtB,MAAM,CAAC,EAAE,MAAM,EAAE,EACjB,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/B,OAAO,CAAC,IAAI,CAAC;IAgChB,sEAAsE;IACtE,aAAa,IAAI,WAAW;IAU5B,2FAA2F;IAC3F,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa;IAShC;;;;OAIG;IACH,KAAK,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;CAOpE"}