@c9up/warden 0.1.13 → 0.1.14

package/dist/Authenticator.js

@@ -0,0 +1,296 @@
+/**
+ * Authenticator — a PER-REQUEST authentication contract (AdonisJS
+ * `@adonisjs/auth` `Authenticator` parity), attached as `ctx.auth`.
+ *
+ * Why it exists: before this, `ctx.auth` was a plain data object with no
+ * methods, so an INLINE route handler (`router.post('/login', handler)`) had no
+ * way to authenticate on demand — only the `@Guard` decorator path worked, and
+ * that reads `ctx.route.controller/action`, which inline/functional routes don't
+ * expose. This contract makes `await ctx.auth.authenticate()` /
+ * `ctx.auth.use('session').login(user)` work anywhere, exactly like Adonis.
+ *
+ * Warden stays agnostic: the Authenticator is built from the {@link AuthManager}
+ * (resolved via `ctx.containerResolver`) + the request `ctx`; it never imports
+ * `@c9up/ream`.
+ */
+import { sanitizePayload, } from "./AuthManager.js";
+import { E_UNAUTHORIZED_ACCESS, WardenError } from "./errors.js";
+/**
+ * Guard names Warden accepts for the API-key / access-tokens driver. AdonisJS
+ * names the driver `access_tokens`; the legacy `api-key` spelling stays valid so
+ * existing `@Guard('api-key')` routes and configs keep working.
+ */
+export const API_KEY_GUARD_NAMES = [
+    "access_tokens",
+    "api-key",
+];
+function hasVerifyWithContext(strategy) {
+    return (typeof strategy.verifyWithContext === "function");
+}
+/**
+ * Resolve the header the API-key guard reads its key from. Prefers the
+ * registered guard's `headerName` (under either accepted guard name), else the
+ * `x-api-key` default. Never throws.
+ */
+function resolveApiKeyHeader(auth) {
+    for (const name of API_KEY_GUARD_NAMES) {
+        try {
+            const s = auth.getStrategy(name);
+            const header = "headerName" in s ? s.headerName : undefined;
+            if (typeof header === "string" && header.length > 0)
+                return header;
+        }
+        catch {
+            // Guard not registered under this name — try the next.
+        }
+    }
+    return "x-api-key";
+}
+/**
+ * Extract the request's credentials once — a Bearer token, an API key (read from
+ * the configured header, matched case-insensitively), and the session store.
+ * Shared by `wardenMiddleware`, `silentAuth`, and the Authenticator so all three
+ * read credentials identically.
+ */
+export function extractCredentials(ctx, auth) {
+    const headers = ctx.request.headers();
+    const authHeader = headers.authorization ?? "";
+    const bearerToken = authHeader.startsWith("Bearer ")
+        ? authHeader.slice(7)
+        : "";
+    // HTTP header names are case-insensitive; runtimes lowercase incoming keys,
+    // so normalise the configured header name before the lookup.
+    const apiKey = headers[resolveApiKeyHeader(auth).toLowerCase()] ?? "";
+    return { bearerToken, apiKey, session: ctx.session };
+}
+/**
+ * Try each declared guard in order — session guards via `verifyWithContext()`,
+ * others via `verify(token)` with native-first credential fallback.
+ * Distinguishes crashes (strategy threw / `strategyCrash`) from credential
+ * rejections so the caller can return 500 vs 401.
+ */
+export async function tryAuthenticate(auth, strategies, creds) {
+    const { bearerToken, apiKey, session } = creds;
+    let result = null;
+    let viaGuard;
+    let attemptCount = 0;
+    let crashCount = 0;
+    for (const strategyName of strategies) {
+        try {
+            let r;
+            if (strategyName === "session") {
+                const strategy = auth.getStrategy(strategyName);
+                const verifyWithContext = strategy && hasVerifyWithContext(strategy)
+                    ? strategy.verifyWithContext
+                    : undefined;
+                if (verifyWithContext) {
+                    attemptCount++;
+                    r = await verifyWithContext.call(strategy, "", { session });
+                    // The session path bypasses AuthManager.verify(), so apply the
+                    // same prototype-pollution guard JWT / api-key users get there.
+                    if (r.user)
+                        sanitizePayload(r.user);
+                }
+                else {
+                    continue;
+                }
+            }
+            else {
+                // Native-first credential, other transport as fallback so a
+                // single-credential client still authenticates (and an invalid
+                // Bearer no longer masks a valid API key for the api-key guard).
+                const credential = API_KEY_GUARD_NAMES.includes(strategyName)
+                    ? apiKey || bearerToken
+                    : bearerToken || apiKey;
+                if (!credential)
+                    continue;
+                attemptCount++;
+                r = await auth.verify(credential, strategyName);
+            }
+            if (r.authenticated) {
+                result = r;
+                viaGuard = strategyName;
+                break;
+            }
+            if (r.strategyCrash === true) {
+                crashCount++;
+                console.error(`[warden] strategy '${strategyName}' threw during verify(): ${r.error ?? "unknown error"}`);
+            }
+        }
+        catch (err) {
+            // AuthManager rethrows structured WardenError sentinels — treat these
+            // as crashes too (config errors, SessionStrategy.USE_LOGIN, etc.).
+            crashCount++;
+            console.error(`[warden] strategy '${strategyName}' threw during verify():`, err);
+        }
+    }
+    return { result, viaGuard, attemptCount, crashCount };
+}
+/**
+ * A named-guard accessor (AdonisJS `auth.use('web')`). Exposes the stateful
+ * `login()`/`logout()` for session guards plus per-guard `authenticate()`.
+ */
+export class GuardAccessor {
+    #ctx;
+    #auth;
+    #name;
+    #parent;
+    constructor(ctx, auth, name, parent) {
+        this.#ctx = ctx;
+        this.#auth = auth;
+        this.#name = name;
+        this.#parent = parent;
+    }
+    /** The user, only if the request authenticated via THIS guard. */
+    get user() {
+        return this.#parent.authenticatedViaGuard === this.#name
+            ? this.#parent.user
+            : undefined;
+    }
+    get isAuthenticated() {
+        return this.user !== undefined;
+    }
+    /** Authenticate the request using only this guard (throws on failure). */
+    authenticate() {
+        return this.#parent.authenticateUsing([this.#name]);
+    }
+    /** Log a user in through this guard (session guards). */
+    login(user) {
+        return this.#auth.login(user, this.#requireSession(), this.#name);
+    }
+    /** Log the current user out of this guard (session guards). */
+    logout() {
+        return this.#auth.logout(this.#requireSession(), this.#name);
+    }
+    #requireSession() {
+        if (!this.#ctx.session) {
+            throw new WardenError("NO_SESSION", `Guard '${this.#name}'.login()/logout() requires a session, but ctx.session is unset. Register the session middleware upstream.`);
+        }
+        return this.#ctx.session;
+    }
+}
+/**
+ * Per-request Authenticator attached as `ctx.auth`. Mirrors AdonisJS's
+ * `Authenticator` surface: `authenticate` / `check` / `authenticateUsing` /
+ * `getUserOrFail` / `use`, plus the `user` / `isAuthenticated` /
+ * `authenticationAttempted` / `authenticatedViaGuard` getters.
+ */
+export class Authenticator {
+    #ctx;
+    #auth;
+    #user;
+    #viaGuard;
+    #attempted = false;
+    #guardCache = new Map();
+    constructor(ctx, auth) {
+        this.#ctx = ctx;
+        this.#auth = auth;
+    }
+    /** The authenticated user, or `undefined` for a guest. */
+    get user() {
+        return this.#user;
+    }
+    /** Whether the request has an authenticated user (AdonisJS name). */
+    get isAuthenticated() {
+        return this.#user !== undefined;
+    }
+    /** Whether `authenticate`/`check`/`authenticateUsing` ran this request. */
+    get authenticationAttempted() {
+        return this.#attempted;
+    }
+    /** Name of the guard that authenticated the request, if any. */
+    get authenticatedViaGuard() {
+        return this.#viaGuard;
+    }
+    /**
+     * Roles of the authenticated user (Ream reads `ctx.auth.roles ??
+     * ctx.auth.user.roles`). Warden nests them under `user`; this getter mirrors
+     * them at the top level for the host's guard readers.
+     */
+    get roles() {
+        return this.#user?.roles;
+    }
+    /** Permissions of the authenticated user (see {@link Authenticator.roles}). */
+    get permissions() {
+        return this.#user?.permissions;
+    }
+    /** Authenticate via the default guard. Throws `E_UNAUTHORIZED_ACCESS` on failure. */
+    authenticate() {
+        return this.authenticateUsing([this.#auth.defaultStrategyName]);
+    }
+    /**
+     * Like {@link Authenticator.authenticate} but returns a boolean instead of
+     * throwing on a credential rejection. A strategy CRASH / config error still
+     * propagates (a server incident must not be silently swallowed as "guest").
+     */
+    async check() {
+        try {
+            await this.authenticate();
+            return this.isAuthenticated;
+        }
+        catch (err) {
+            if (err instanceof E_UNAUTHORIZED_ACCESS)
+                return false;
+            throw err;
+        }
+    }
+    /**
+     * Authenticate by trying the given guards in order (default: the default
+     * guard). Sets the user on the first success; throws `E_UNAUTHORIZED_ACCESS`
+     * (401, carrying `redirectTo` for session guards) when all reject, or a
+     * `WARDEN_AUTH_STRATEGY_ERROR` (500) when every attempted guard crashed.
+     */
+    async authenticateUsing(guards, options) {
+        this.#attempted = true;
+        const names = guards && guards.length > 0 ? guards : [this.#auth.defaultStrategyName];
+        const creds = extractCredentials(this.#ctx, this.#auth);
+        const hasSessionStrategy = names.includes("session");
+        const { result, viaGuard, attemptCount, crashCount } = await tryAuthenticate(this.#auth, names, {
+            ...creds,
+            hasSessionStrategy,
+        });
+        if (result?.authenticated && result.user) {
+            this.#user = result.user;
+            this.#viaGuard = viaGuard;
+            return;
+        }
+        // Every attempted guard crashed → a server-side incident, not a
+        // credential rejection. Surface distinctly (mapped to 500 by the caller).
+        if (attemptCount > 0 && crashCount === attemptCount) {
+            throw new WardenError("AUTH_STRATEGY_ERROR", "Authentication unavailable — one or more strategies failed. Check server logs.", { status: 500 });
+        }
+        throw new E_UNAUTHORIZED_ACCESS(result?.error ?? "Unauthorized access", {
+            guardDriverName: names[0] ?? this.#auth.defaultStrategyName,
+            redirectTo: hasSessionStrategy ? options?.loginRoute : undefined,
+        });
+    }
+    /** Return the authenticated user or throw `E_UNAUTHORIZED_ACCESS`. */
+    getUserOrFail() {
+        if (!this.#user) {
+            throw new E_UNAUTHORIZED_ACCESS('Cannot access authenticated user. Call "ctx.auth.authenticate()" first.', { guardDriverName: this.#viaGuard ?? this.#auth.defaultStrategyName });
+        }
+        return this.#user;
+    }
+    /** Access a named guard (AdonisJS `auth.use('web')`). Instances are cached per request. */
+    use(name) {
+        let accessor = this.#guardCache.get(name);
+        if (!accessor) {
+            accessor = new GuardAccessor(this.#ctx, this.#auth, name, this);
+            this.#guardCache.set(name, accessor);
+        }
+        return accessor;
+    }
+    /**
+     * @internal Seed the Authenticator from a result the enforcing middleware
+     * already computed, so `ctx.auth` reflects the authenticated user without a
+     * second verify pass.
+     */
+    adopt(result, viaGuard) {
+        this.#attempted = true;
+        if (result?.authenticated && result.user) {
+            this.#user = result.user;
+            this.#viaGuard = viaGuard;
+        }
+    }
+}
+//# sourceMappingURL=Authenticator.js.map

package/dist/Authenticator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Authenticator.js","sourceRoot":"","sources":["../src/Authenticator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAIN,eAAe,GAEf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAIjE;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAsB;IACrD,eAAe;IACf,SAAS;CACT,CAAC;AAMF,SAAS,oBAAoB,CAC5B,QAAsB;IAEtB,OAAO,CACN,OAAQ,QAAgC,CAAC,iBAAiB,KAAK,UAAU,CACzE,CAAC;AACH,CAAC;AASD;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,IAAiB;IAC7C,KAAK,MAAM,IAAI,IAAI,mBAAmB,EAAE,CAAC;QACxC,IAAI,CAAC;YACJ,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,MAAM,GAAG,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,MAAM,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACR,uDAAuD;QACxD,CAAC;IACF,CAAC;IACD,OAAO,WAAW,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CACjC,GAAkB,EAClB,IAAiB;IAEjB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IACtC,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;IAC/C,MAAM,WAAW,GAAG,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC;QACnD,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QACrB,CAAC,CAAC,EAAE,CAAC;IACN,4EAA4E;IAC5E,6DAA6D;IAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IACtE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;AACtD,CAAC;AAWD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,IAAiB,EACjB,UAAoB,EACpB,KAKC;IAED,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC/C,IAAI,MAAM,GAAsB,IAAI,CAAC;IACrC,IAAI,QAA4B,CAAC;IACjC,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,MAAM,YAAY,IAAI,UAAU,EAAE,CAAC;QACvC,IAAI,CAAC;YACJ,IAAI,CAAa,CAAC;YAClB,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;gBAChD,MAAM,iBAAiB,GACtB,QAAQ,IAAI,oBAAoB,CAAC,QAAQ,CAAC;oBACzC,CAAC,CAAC,QAAQ,CAAC,iBAAiB;oBAC5B,CAAC,CAAC,SAAS,CAAC;gBACd,IAAI,iBAAiB,EAAE,CAAC;oBACvB,YAAY,EAAE,CAAC;oBACf,CAAC,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;oBAC5D,+DAA+D;oBAC/D,gEAAgE;oBAChE,IAAI,CAAC,CAAC,IAAI;wBAAE,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACrC,CAAC;qBAAM,CAAC;oBACP,SAAS;gBACV,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,4DAA4D;gBAC5D,+DAA+D;gBAC/D,iEAAiE;gBACjE,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,CAAC,YAAY,CAAC;oBAC5D,CAAC,CAAC,MAAM,IAAI,WAAW;oBACvB,CAAC,CAAC,WAAW,IAAI,MAAM,CAAC;gBACzB,IAAI,CAAC,UAAU;oBAAE,SAAS;gBAC1B,YAAY,EAAE,CAAC;gBACf,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YACjD,CAAC;YACD,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC;gBACrB,MAAM,GAAG,CAAC,CAAC;gBACX,QAAQ,GAAG,YAAY,CAAC;gBACxB,MAAM;YACP,CAAC;YACD,IAAI,CAAC,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC9B,UAAU,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CACZ,sBAAsB,YAAY,4BAA4B,CAAC,CAAC,KAAK,IAAI,eAAe,EAAE,CAC1F,CAAC;YACH,CAAC;QACF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,sEAAsE;YACtE,mEAAmE;YACnE,UAAU,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACZ,sBAAsB,YAAY,0BAA0B,EAC5D,GAAG,CACH,CAAC;QACH,CAAC;IACF,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,aAAa;IAChB,IAAI,CAAgB;IACpB,KAAK,CAAc;IACnB,KAAK,CAAS;IACd,OAAO,CAAgB;IAEhC,YACC,GAAkB,EAClB,IAAiB,EACjB,IAAY,EACZ,MAAqB;QAErB,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;QAChB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,kEAAkE;IAClE,IAAI,IAAI;QACP,OAAO,IAAI,CAAC,OAAO,CAAC,qBAAqB,KAAK,IAAI,CAAC,KAAK;YACvD,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI;YACnB,CAAC,CAAC,SAAS,CAAC;IACd,CAAC;IAED,IAAI,eAAe;QAClB,OAAO,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC;IAChC,CAAC;IAED,0EAA0E;IAC1E,YAAY;QACX,OAAO,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,yDAAyD;IACzD,KAAK,CAAC,IAAiB;QACtB,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACnE,CAAC;IAED,+DAA+D;IAC/D,MAAM;QACL,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC;IAED,eAAe;QACd,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,WAAW,CACpB,YAAY,EACZ,UAAU,IAAI,CAAC,KAAK,4GAA4G,CAChI,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;IAC1B,CAAC;CACD;AAED;;;;;GAKG;AACH,MAAM,OAAO,aAAa;IAChB,IAAI,CAAgB;IACpB,KAAK,CAAc;IAC5B,KAAK,CAAe;IACpB,SAAS,CAAU;IACnB,UAAU,GAAG,KAAK,CAAC;IACV,WAAW,GAAG,IAAI,GAAG,EAAyB,CAAC;IAExD,YAAY,GAAkB,EAAE,IAAiB;QAChD,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;QAChB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,0DAA0D;IAC1D,IAAI,IAAI;QACP,OAAO,IAAI,CAAC,KAAK,CAAC;IACnB,CAAC;IAED,qEAAqE;IACrE,IAAI,eAAe;QAClB,OAAO,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC;IACjC,CAAC;IAED,2EAA2E;IAC3E,IAAI,uBAAuB;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC;IACxB,CAAC;IAED,gEAAgE;IAChE,IAAI,qBAAqB;QACxB,OAAO,IAAI,CAAC,SAAS,CAAC;IACvB,CAAC;IAED;;;;OAIG;IACH,IAAI,KAAK;QACR,OAAO,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC;IAC1B,CAAC;IAED,+EAA+E;IAC/E,IAAI,WAAW;QACd,OAAO,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC;IAChC,CAAC;IAED,qFAAqF;IACrF,YAAY;QACX,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACjE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK;QACV,IAAI,CAAC;YACJ,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,eAAe,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,qBAAqB;gBAAE,OAAO,KAAK,CAAC;YACvD,MAAM,GAAG,CAAC;QACX,CAAC;IACF,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,iBAAiB,CACtB,MAAiB,EACjB,OAAiC;QAEjC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,MAAM,KAAK,GACV,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACzE,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACxD,MAAM,kBAAkB,GAAG,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACrD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,GACnD,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE;YACxC,GAAG,KAAK;YACR,kBAAkB;SAClB,CAAC,CAAC;QAEJ,IAAI,MAAM,EAAE,aAAa,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAC1C,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC;YACzB,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;YAC1B,OAAO;QACR,CAAC;QACD,gEAAgE;QAChE,0EAA0E;QAC1E,IAAI,YAAY,GAAG,CAAC,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;YACrD,MAAM,IAAI,WAAW,CACpB,qBAAqB,EACrB,gFAAgF,EAChF,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;QACH,CAAC;QACD,MAAM,IAAI,qBAAqB,CAAC,MAAM,EAAE,KAAK,IAAI,qBAAqB,EAAE;YACvE,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,mBAAmB;YAC3D,UAAU,EAAE,kBAAkB,CAAC,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,SAAS;SAChE,CAAC,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,aAAa;QACZ,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACjB,MAAM,IAAI,qBAAqB,CAC9B,yEAAyE,EACzE,EAAE,eAAe,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,CACrE,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC;IACnB,CAAC;IAED,2FAA2F;IAC3F,GAAG,CAAC,IAAY;QACf,IAAI,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,QAAQ,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAChE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAyB,EAAE,QAA4B;QAC5D,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,IAAI,MAAM,EAAE,aAAa,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAC1C,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC;YACzB,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC3B,CAAC;IACF,CAAC;CACD"}

package/dist/WardenProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"WardenProvider.d.ts","sourceRoot":"","sources":["../src/WardenProvider.ts"],"names":[],"mappings":"AAYA,UAAU,eAAe;IACxB,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,OAAO,GAAG,IAAI,CAAC;IACxD,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;CACjC;AAED,UAAU,iBAAiB;IAC1B,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC;CAC7C;AAED,MAAM,WAAW,gBAAgB;IAChC,SAAS,EAAE,eAAe,CAAC;IAC3B,MAAM,EAAE,iBAAiB,CAAC;CAC1B;AAED,MAAM,CAAC,OAAO,OAAO,cAAc;IACtB,SAAS,CAAC,GAAG,EAAE,gBAAgB;gBAArB,GAAG,EAAE,gBAAgB;IAE3C,QAAQ;IAiGF,IAAI;CAGV"}
+{"version":3,"file":"WardenProvider.d.ts","sourceRoot":"","sources":["../src/WardenProvider.ts"],"names":[],"mappings":"AAYA,UAAU,eAAe;IACxB,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,OAAO,GAAG,IAAI,CAAC;IACxD,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;CACjC;AAED,UAAU,iBAAiB;IAC1B,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC;CAC7C;AAED,MAAM,WAAW,gBAAgB;IAChC,SAAS,EAAE,eAAe,CAAC;IAC3B,MAAM,EAAE,iBAAiB,CAAC;CAC1B;AAED,MAAM,CAAC,OAAO,OAAO,cAAc;IACtB,SAAS,CAAC,GAAG,EAAE,gBAAgB;gBAArB,GAAG,EAAE,gBAAgB;IAE3C,QAAQ;IA2HF,IAAI;CAGV"}

package/dist/WardenProvider.js

@@ -23,29 +23,56 @@ export default class WardenProvider {
         // AuthManager with `strategies: {}` and `defaultStrategy: 'jwt'`,
         // passing the (then-permissive) constructor and erroring deep in the
         // middleware loop.
-        if (!config?.jwt && !config?.session && !config?.apiKey) {
-            throw new WardenError("WARDEN_NO_AUTH_CONFIG", `@c9up/warden: no authentication strategies configured. Set at least one of config.warden.auth.jwt / .session / .apiKey in your reamrc.ts before registering WardenProvider.`);
+        const hasGuards = config?.guards && Object.keys(config.guards).length > 0;
+        if (!hasGuards && !config?.jwt && !config?.session && !config?.apiKey) {
+            throw new WardenError("WARDEN_NO_AUTH_CONFIG", `@c9up/warden: no authentication guards configured. Set config.warden.auth.guards (AdonisJS form) or at least one of .jwt / .session / .apiKey in your reamrc.ts before registering WardenProvider.`);
         }
-        // Build the strategy table from whatever the app configured. Each strategy
-        // is also exposed by its class token (mirrors the jwt convention) so apps
-        // can resolve a specific one. The `revoke()` blacklist flows through
-        // `config.jwt.blacklist` into JwtStrategy.
+        // Build the guard table. Two accepted forms:
+        //  - AdonisJS: `config.guards` (name → AuthStrategy, via *Guard() factories).
+        //  - Legacy driver-keyed: `config.jwt` / `.session` / `.apiKey`.
+        // Each strategy is also exposed by its class token (so apps can resolve a
+        // specific one). The `revoke()` blacklist flows through `config.jwt.blacklist`.
         const strategies = {};
-        if (config.jwt) {
-            const jwt = new JwtStrategy(config.jwt);
-            this.app.container.singleton(JwtStrategy, () => jwt);
-            strategies.jwt = jwt;
+        if (hasGuards && config.guards) {
+            for (const [name, strategy] of Object.entries(config.guards)) {
+                strategies[name] = strategy;
+                // Expose recognised driver instances by their class token too.
+                if (strategy instanceof JwtStrategy) {
+                    this.app.container.singleton(JwtStrategy, () => strategy);
+                }
+                else if (strategy instanceof SessionStrategy) {
+                    this.app.container.singleton(SessionStrategy, () => strategy);
+                }
+                else if (strategy instanceof ApiKeyStrategy) {
+                    this.app.container.singleton(ApiKeyStrategy, () => strategy);
+                }
+            }
         }
-        if (config.session) {
-            const session = new SessionStrategy(config.session);
-            this.app.container.singleton(SessionStrategy, () => session);
-            strategies.session = session;
-        }
-        if (config.apiKey) {
-            const apiKey = new ApiKeyStrategy(config.apiKey);
-            this.app.container.singleton(ApiKeyStrategy, () => apiKey);
-            strategies["api-key"] = apiKey;
+        else {
+            if (config.jwt) {
+                const jwt = new JwtStrategy(config.jwt);
+                this.app.container.singleton(JwtStrategy, () => jwt);
+                strategies.jwt = jwt;
+            }
+            if (config.session) {
+                const session = new SessionStrategy(config.session);
+                this.app.container.singleton(SessionStrategy, () => session);
+                strategies.session = session;
+            }
+            if (config.apiKey) {
+                const apiKey = new ApiKeyStrategy(config.apiKey);
+                this.app.container.singleton(ApiKeyStrategy, () => apiKey);
+                // AdonisJS names this guard driver "access_tokens"; keep "api-key"
+                // as an accepted alias so existing `@Guard('api-key')` routes work.
+                strategies.access_tokens = apiKey;
+                strategies["api-key"] = apiKey;
+            }
         }
+        // Login route (session-guard HTML redirect target) — resolved by the
+        // enforcing middleware via the "warden:loginRoute" token. Registered even
+        // when undefined so the lookup is a clean resolve, not a throw.
+        const loginRoute = config.loginRoute;
+        this.app.container.singleton("warden:loginRoute", () => loginRoute);
         // Rights layer (Epic 56): one resolver singleton backs BOTH the coarse
         // RBAC helpers (injected into AuthManager below) and — once 56.6 lands —
         // the Bouncer construction, so a coarse question and a policy question
@@ -69,12 +96,13 @@ export default class WardenProvider {
             resolveScope: config.resolveScope,
         };
         this.app.container.singleton("bouncer:registry", () => bouncerRegistry);
-        // Default to the configured strategy, else the first one registered.
-        const defaultStrategy = config.defaultStrategy ?? Object.keys(strategies)[0];
+        // Default to the configured guard (AdonisJS `default`, then legacy
+        // `defaultStrategy`), else the first one registered.
+        const defaultGuard = config.default ?? config.defaultStrategy ?? Object.keys(strategies)[0];
         this.app.container.singleton(AuthManager, () => {
             return new AuthManager({
-                defaultStrategy,
-                strategies,
+                default: defaultGuard,
+                guards: strategies,
                 rights: rightsResolver,
             });
         });

package/dist/WardenProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"WardenProvider.js","sourceRoot":"","sources":["../src/WardenProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAqB,MAAM,kBAAkB,CAAC;AAElE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAgBlE,MAAM,CAAC,OAAO,OAAO,cAAc;IACZ;IAAtB,YAAsB,GAAqB;QAArB,QAAG,GAAH,GAAG,CAAkB;IAAG,CAAC;IAE/C,QAAQ;QACP,4EAA4E;QAC5E,sEAAsE;QACtE,8DAA8D;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAe,MAAM,CAAC,CAAC;QAEzD,qEAAqE;QACrE,oEAAoE;QACpE,mEAAmE;QACnE,kEAAkE;QAClE,qEAAqE;QACrE,mBAAmB;QACnB,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;YACzD,MAAM,IAAI,WAAW,CACpB,uBAAuB,EACvB,6KAA6K,CAC7K,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,0EAA0E;QAC1E,qEAAqE;QACrE,2CAA2C;QAC3C,MAAM,UAAU,GAAiC,EAAE,CAAC;QAEpD,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;YACrD,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC;QACtB,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,OAAO,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACpD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;YAC7D,UAAU,CAAC,OAAO,GAAG,OAAO,CAAC;QAC9B,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACjD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC;YAC3D,UAAU,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC;QAChC,CAAC;QAED,uEAAuE;QACvE,yEAAyE;QACzE,uEAAuE;QACvE,uEAAuE;QACvE,sEAAsE;QACtE,iEAAiE;QACjE,oCAAoC;QACpC,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACpE,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,WAAW,CAAC,CAAC;QACvD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,CAAC;QACnE,IAAI,WAAW,YAAY,iBAAiB,EAAE,CAAC;YAC9C,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC;QACpE,CAAC;QAED,0EAA0E;QAC1E,uEAAuE;QACvE,0EAA0E;QAC1E,oEAAoE;QACpE,MAAM,eAAe,GAAoB;YACxC,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,EAAE;YACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;SACjC,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,CAAC;QAExE,qEAAqE;QACrE,MAAM,eAAe,GACpB,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,WAAW,EAAE,GAAG,EAAE;YAC9C,OAAO,IAAI,WAAW,CAAC;gBACtB,eAAe;gBACf,UAAU;gBACV,MAAM,EAAE,cAAc;aACtB,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,oEAAoE;QACpE,mEAAmE;QACnE,4DAA4D;QAC5D,8DAA8D;QAC9D,4DAA4D;QAC5D,mCAAmC;QACnC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CACzC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,CACvC,CAAC;QAEF,0EAA0E;QAC1E,0EAA0E;QAC1E,wEAAwE;QACxE,qCAAqC;QACrC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC;QAChC,IAAI,GAAG,EAAE,CAAC;YACT,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;YACpD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QAChD,CAAC;IACF,CAAC;IAED,KAAK,CAAC,IAAI;QACT,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,CAAgB,CAAC,CAAC;IACjE,CAAC;CACD"}
+{"version":3,"file":"WardenProvider.js","sourceRoot":"","sources":["../src/WardenProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAqB,MAAM,kBAAkB,CAAC;AAElE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAgBlE,MAAM,CAAC,OAAO,OAAO,cAAc;IACZ;IAAtB,YAAsB,GAAqB;QAArB,QAAG,GAAH,GAAG,CAAkB;IAAG,CAAC;IAE/C,QAAQ;QACP,4EAA4E;QAC5E,sEAAsE;QACtE,8DAA8D;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAe,MAAM,CAAC,CAAC;QAEzD,qEAAqE;QACrE,oEAAoE;QACpE,mEAAmE;QACnE,kEAAkE;QAClE,qEAAqE;QACrE,mBAAmB;QACnB,MAAM,SAAS,GAAG,MAAM,EAAE,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QAC1E,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;YACvE,MAAM,IAAI,WAAW,CACpB,uBAAuB,EACvB,oMAAoM,CACpM,CAAC;QACH,CAAC;QAED,6CAA6C;QAC7C,8EAA8E;QAC9E,iEAAiE;QACjE,0EAA0E;QAC1E,gFAAgF;QAChF,MAAM,UAAU,GAAiC,EAAE,CAAC;QAEpD,IAAI,SAAS,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAChC,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC9D,UAAU,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC;gBAC5B,+DAA+D;gBAC/D,IAAI,QAAQ,YAAY,WAAW,EAAE,CAAC;oBACrC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC;gBAC3D,CAAC;qBAAM,IAAI,QAAQ,YAAY,eAAe,EAAE,CAAC;oBAChD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC;gBAC/D,CAAC;qBAAM,IAAI,QAAQ,YAAY,cAAc,EAAE,CAAC;oBAC/C,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC;gBAC9D,CAAC;YACF,CAAC;QACF,CAAC;aAAM,CAAC;YACP,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;gBAChB,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACxC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;gBACrD,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC;YACtB,CAAC;YACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,OAAO,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBACpD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;gBAC7D,UAAU,CAAC,OAAO,GAAG,OAAO,CAAC;YAC9B,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBACnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACjD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC;gBAC3D,mEAAmE;gBACnE,oEAAoE;gBACpE,UAAU,CAAC,aAAa,GAAG,MAAM,CAAC;gBAClC,UAAU,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC;YAChC,CAAC;QACF,CAAC;QAED,qEAAqE;QACrE,0EAA0E;QAC1E,gEAAgE;QAChE,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC;QAEpE,uEAAuE;QACvE,yEAAyE;QACzE,uEAAuE;QACvE,uEAAuE;QACvE,sEAAsE;QACtE,iEAAiE;QACjE,oCAAoC;QACpC,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACpE,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,WAAW,CAAC,CAAC;QACvD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,CAAC;QACnE,IAAI,WAAW,YAAY,iBAAiB,EAAE,CAAC;YAC9C,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC;QACpE,CAAC;QAED,0EAA0E;QAC1E,uEAAuE;QACvE,0EAA0E;QAC1E,oEAAoE;QACpE,MAAM,eAAe,GAAoB;YACxC,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,EAAE;YACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;SACjC,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,CAAC;QAExE,mEAAmE;QACnE,qDAAqD;QACrD,MAAM,YAAY,GACjB,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,WAAW,EAAE,GAAG,EAAE;YAC9C,OAAO,IAAI,WAAW,CAAC;gBACtB,OAAO,EAAE,YAAY;gBACrB,MAAM,EAAE,UAAU;gBAClB,MAAM,EAAE,cAAc;aACtB,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,oEAAoE;QACpE,mEAAmE;QACnE,4DAA4D;QAC5D,8DAA8D;QAC9D,4DAA4D;QAC5D,mCAAmC;QACnC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CACzC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,CACvC,CAAC;QAEF,0EAA0E;QAC1E,0EAA0E;QAC1E,wEAAwE;QACxE,qCAAqC;QACrC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC;QAChC,IAAI,GAAG,EAAE,CAAC;YACT,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;YACpD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QAChD,CAAC;IACF,CAAC;IAED,KAAK,CAAC,IAAI;QACT,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,CAAgB,CAAC,CAAC;IACjE,CAAC;CACD"}

package/dist/bouncer/AbilitiesBuilder.d.ts

@@ -0,0 +1,20 @@
+/**
+ * AbilitiesBuilder — a chainable builder that fluently assembles an object of
+ * named abilities (Adonis `AbilitiesBuilder`). Each `.define(...)` delegates to
+ * `Bouncer.ability` and stores the result on `.abilities`, returning `this` so
+ * calls chain: `new AbilitiesBuilder().define(a).define(b).abilities`.
+ */
+import type { UserPayload } from "../AuthManager.js";
+import type { Ability, AbilityOptions, AuthorizerResponse } from "./types.js";
+export declare class AbilitiesBuilder {
+    /** The abilities accumulated so far, keyed by name. */
+    readonly abilities: Record<string, Ability<never[]>>;
+    constructor(abilities?: Record<string, Ability<never[]>>);
+    /**
+     * Define a named ability (Adonis `.define(name, authorizer, options?)`). The
+     * callback receives a non-null user (a guest is denied by the evaluator before
+     * it runs); pass `{ allowGuest: true }` to let the callback run for a guest.
+     */
+    define<Args extends unknown[]>(name: string, authorizer: (user: UserPayload, ...args: Args) => AuthorizerResponse, options?: AbilityOptions): this;
+}
+//# sourceMappingURL=AbilitiesBuilder.d.ts.map

package/dist/bouncer/AbilitiesBuilder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AbilitiesBuilder.d.ts","sourceRoot":"","sources":["../../src/bouncer/AbilitiesBuilder.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAE9E,qBAAa,gBAAgB;IAC5B,uDAAuD;IACvD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBAEzC,SAAS,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAM;IAI5D;;;;OAIG;IACH,MAAM,CAAC,IAAI,SAAS,OAAO,EAAE,EAC5B,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,IAAI,KAAK,kBAAkB,EACpE,OAAO,CAAC,EAAE,cAAc,GACtB,IAAI;CAYP"}

package/dist/bouncer/AbilitiesBuilder.js

@@ -0,0 +1,32 @@
+/**
+ * AbilitiesBuilder — a chainable builder that fluently assembles an object of
+ * named abilities (Adonis `AbilitiesBuilder`). Each `.define(...)` delegates to
+ * `Bouncer.ability` and stores the result on `.abilities`, returning `this` so
+ * calls chain: `new AbilitiesBuilder().define(a).define(b).abilities`.
+ */
+import { Bouncer } from "./Bouncer.js";
+export class AbilitiesBuilder {
+    /** The abilities accumulated so far, keyed by name. */
+    abilities;
+    constructor(abilities = {}) {
+        this.abilities = abilities;
+    }
+    /**
+     * Define a named ability (Adonis `.define(name, authorizer, options?)`). The
+     * callback receives a non-null user (a guest is denied by the evaluator before
+     * it runs); pass `{ allowGuest: true }` to let the callback run for a guest.
+     */
+    define(name, authorizer, options) {
+        // Delegate the callback wrapping to `Bouncer.ability` (guest-denied form),
+        // then apply the `allowGuest` option. Store without the `__args` phantom —
+        // its concrete-args brand cannot widen to the `never[]` storage slot, while
+        // `execute` is already non-generic.
+        const built = Bouncer.ability(authorizer);
+        this.abilities[name] = {
+            allowGuest: options?.allowGuest ?? built.allowGuest,
+            execute: built.execute,
+        };
+        return this;
+    }
+}
+//# sourceMappingURL=AbilitiesBuilder.js.map

package/dist/bouncer/AbilitiesBuilder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AbilitiesBuilder.js","sourceRoot":"","sources":["../../src/bouncer/AbilitiesBuilder.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAGvC,MAAM,OAAO,gBAAgB;IAC5B,uDAAuD;IAC9C,SAAS,CAAmC;IAErD,YAAY,YAA8C,EAAE;QAC3D,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC5B,CAAC;IAED;;;;OAIG;IACH,MAAM,CACL,IAAY,EACZ,UAAoE,EACpE,OAAwB;QAExB,2EAA2E;QAC3E,2EAA2E;QAC3E,4EAA4E;QAC5E,oCAAoC;QACpC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG;YACtB,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,KAAK,CAAC,UAAU;YACnD,OAAO,EAAE,KAAK,CAAC,OAAO;SACtB,CAAC;QACF,OAAO,IAAI,CAAC;IACb,CAAC;CACD"}

package/dist/bouncer/AuthorizationResponse.d.ts

@@ -3,23 +3,33 @@
  *
  * Layer 2 (EVALUATION) of Warden's unified authorization (Epic 56). Faithful
  * to AdonisJS Bouncer's `AuthorizationResponse`: instances are produced only by
- * the `allow()` / `deny()` static constructors (the constructor is private), a
- * denial defaults to HTTP 403, and a `translation` field is carried for shape
- * parity with Adonis's i18n hook (always `undefined` in 56.2 — D6).
+ * the `allow()` / `deny()` static constructors (the constructor is private). A
+ * denial carries no `status` unless one is passed — the HTTP 403 default is
+ * applied only at the throw/HTTP boundary (Adonis parity) — and a `translation`
+ * field carries the i18n binding set via {@link t}.
  */
 export declare class AuthorizationResponse {
     readonly authorized: boolean;
-    readonly message?: string;
-    readonly status?: number;
-    /** Parity placeholder for an i18n binding (always undefined in 56.2 — D6). */
-    readonly translation?: {
+    message?: string;
+    status?: number;
+    /** i18n binding set via {@link t} (Adonis `AuthorizationResponse.t`). */
+    translation?: {
         identifier: string;
         data?: Record<string, unknown>;
     };
     private constructor();
     /** Authorized response (no status). */
     static allow(): AuthorizationResponse;
-    /** Denied response; `status` defaults to 403 (D6). */
+    /**
+     * Denied response. `status` is left `undefined` unless passed — the 403
+     * default is applied only when the denial is thrown / mapped to HTTP (Adonis
+     * parity).
+     */
     static deny(message?: string, status?: number): AuthorizationResponse;
+    /**
+     * Set the i18n translation binding and return `this` for chaining (Adonis
+     * `AuthorizationResponse.t`), e.g. `AuthorizationResponse.deny().t('errors.forbidden')`.
+     */
+    t(identifier: string, data?: Record<string, unknown>): this;
 }
 //# sourceMappingURL=AuthorizationResponse.d.ts.map

package/dist/bouncer/AuthorizationResponse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthorizationResponse.d.ts","sourceRoot":"","sources":["../../src/bouncer/AuthorizationResponse.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,qBAAa,qBAAqB;IACjC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,8EAA8E;IAC9E,QAAQ,CAAC,WAAW,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IAE9E,OAAO;IAYP,uCAAuC;IACvC,MAAM,CAAC,KAAK,IAAI,qBAAqB;IAIrC,sDAAsD;IACtD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,SAAM,GAAG,qBAAqB;CAGlE"}
+{"version":3,"file":"AuthorizationResponse.d.ts","sourceRoot":"","sources":["../../src/bouncer/AuthorizationResponse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,qBAAa,qBAAqB;IACjC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,WAAW,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IAErE,OAAO;IAMP,uCAAuC;IACvC,MAAM,CAAC,KAAK,IAAI,qBAAqB;IAIrC;;;;OAIG;IACH,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,qBAAqB;IAIrE;;;OAGG;IACH,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;CAI3D"}

package/dist/bouncer/AuthorizationResponse.js

@@ -3,29 +3,41 @@
  *
  * Layer 2 (EVALUATION) of Warden's unified authorization (Epic 56). Faithful
  * to AdonisJS Bouncer's `AuthorizationResponse`: instances are produced only by
- * the `allow()` / `deny()` static constructors (the constructor is private), a
- * denial defaults to HTTP 403, and a `translation` field is carried for shape
- * parity with Adonis's i18n hook (always `undefined` in 56.2 — D6).
+ * the `allow()` / `deny()` static constructors (the constructor is private). A
+ * denial carries no `status` unless one is passed — the HTTP 403 default is
+ * applied only at the throw/HTTP boundary (Adonis parity) — and a `translation`
+ * field carries the i18n binding set via {@link t}.
  */
 export class AuthorizationResponse {
     authorized;
     message;
     status;
-    /** Parity placeholder for an i18n binding (always undefined in 56.2 — D6). */
+    /** i18n binding set via {@link t} (Adonis `AuthorizationResponse.t`). */
     translation;
-    constructor(authorized, message, status, translation) {
+    constructor(authorized, message, status) {
         this.authorized = authorized;
         this.message = message;
         this.status = status;
-        this.translation = translation;
     }
     /** Authorized response (no status). */
     static allow() {
         return new AuthorizationResponse(true);
     }
-    /** Denied response; `status` defaults to 403 (D6). */
-    static deny(message, status = 403) {
+    /**
+     * Denied response. `status` is left `undefined` unless passed — the 403
+     * default is applied only when the denial is thrown / mapped to HTTP (Adonis
+     * parity).
+     */
+    static deny(message, status) {
         return new AuthorizationResponse(false, message, status);
     }
+    /**
+     * Set the i18n translation binding and return `this` for chaining (Adonis
+     * `AuthorizationResponse.t`), e.g. `AuthorizationResponse.deny().t('errors.forbidden')`.
+     */
+    t(identifier, data) {
+        this.translation = { identifier, data };
+        return this;
+    }
 }
 //# sourceMappingURL=AuthorizationResponse.js.map

package/dist/bouncer/AuthorizationResponse.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthorizationResponse.js","sourceRoot":"","sources":["../../src/bouncer/AuthorizationResponse.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,OAAO,qBAAqB;IACxB,UAAU,CAAU;IACpB,OAAO,CAAU;IACjB,MAAM,CAAU;IACzB,8EAA8E;IACrE,WAAW,CAA0D;IAE9E,YACC,UAAmB,EACnB,OAAgB,EAChB,MAAe,EACf,WAAoE;QAEpE,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IAChC,CAAC;IAED,uCAAuC;IACvC,MAAM,CAAC,KAAK;QACX,OAAO,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IAED,sDAAsD;IACtD,MAAM,CAAC,IAAI,CAAC,OAAgB,EAAE,MAAM,GAAG,GAAG;QACzC,OAAO,IAAI,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1D,CAAC;CACD"}
+{"version":3,"file":"AuthorizationResponse.js","sourceRoot":"","sources":["../../src/bouncer/AuthorizationResponse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,OAAO,qBAAqB;IACxB,UAAU,CAAU;IAC7B,OAAO,CAAU;IACjB,MAAM,CAAU;IAChB,yEAAyE;IACzE,WAAW,CAA0D;IAErE,YAAoB,UAAmB,EAAE,OAAgB,EAAE,MAAe;QACzE,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACtB,CAAC;IAED,uCAAuC;IACvC,MAAM,CAAC,KAAK;QACX,OAAO,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,IAAI,CAAC,OAAgB,EAAE,MAAe;QAC5C,OAAO,IAAI,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1D,CAAC;IAED;;;OAGG;IACH,CAAC,CAAC,UAAkB,EAAE,IAA8B;QACnD,IAAI,CAAC,WAAW,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACb,CAAC;CACD"}

package/dist/bouncer/BasePolicy.d.ts

@@ -19,10 +19,11 @@ export declare abstract class BasePolicy {
     before?(user: UserPayload | null, action: string, ...args: unknown[]): HookResponse;
     /**
      * Runs after the action (or after a `before` short-circuit), receiving the
-     * resolved response. A non-`undefined` return overrides it; `undefined`
-     * keeps it.
+     * resolved response and the same resource args passed to the action (Adonis
+     * `after(user, action, result, ...args)`). A non-`undefined` return overrides
+     * the response; `undefined` keeps it.
      */
-    after?(user: UserPayload | null, action: string, result: AuthorizationResponse): HookResponse;
+    after?(user: UserPayload | null, action: string, result: AuthorizationResponse, ...args: unknown[]): HookResponse;
     /**
      * The Bouncer's active scope for the in-flight check (56.3). Defaults to
      * `"global"` when the policy is used without a Bouncer context.

package/dist/bouncer/BasePolicy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"BasePolicy.d.ts","sourceRoot":"","sources":["../../src/bouncer/BasePolicy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAExE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,8BAAsB,UAAU;IAC/B;;;;;OAKG;IACH,MAAM,CAAC,CACN,IAAI,EAAE,WAAW,GAAG,IAAI,EACxB,MAAM,EAAE,MAAM,EACd,GAAG,IAAI,EAAE,OAAO,EAAE,GAChB,YAAY;IAEf;;;;OAIG;IACH,KAAK,CAAC,CACL,IAAI,EAAE,WAAW,GAAG,IAAI,EACxB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,qBAAqB,GAC3B,YAAY;IAEf;;;OAGG;IACH,SAAS,KAAK,KAAK,IAAI,KAAK,CAE3B;IAED;;;;OAIG;IACH,SAAS,KAAK,WAAW,IAAI,oBAAoB,CAEhD;IAED;;;;;OAKG;IACH,SAAS,CAAC,UAAU,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,OAAO;CAIrE"}
+{"version":3,"file":"BasePolicy.d.ts","sourceRoot":"","sources":["../../src/bouncer/BasePolicy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAExE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,8BAAsB,UAAU;IAC/B;;;;;OAKG;IACH,MAAM,CAAC,CACN,IAAI,EAAE,WAAW,GAAG,IAAI,EACxB,MAAM,EAAE,MAAM,EACd,GAAG,IAAI,EAAE,OAAO,EAAE,GAChB,YAAY;IAEf;;;;;OAKG;IACH,KAAK,CAAC,CACL,IAAI,EAAE,WAAW,GAAG,IAAI,EACxB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,qBAAqB,EAC7B,GAAG,IAAI,EAAE,OAAO,EAAE,GAChB,YAAY;IAEf;;;OAGG;IACH,SAAS,KAAK,KAAK,IAAI,KAAK,CAE3B;IAED;;;;OAIG;IACH,SAAS,KAAK,WAAW,IAAI,oBAAoB,CAEhD;IAED;;;;;OAKG;IACH,SAAS,CAAC,UAAU,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,OAAO;CAIrE"}

package/dist/bouncer/BasePolicy.js.map

@@ -1 +1 @@
-{"version":3,"file":"BasePolicy.js","sourceRoot":"","sources":["../../src/bouncer/BasePolicy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAGxE,MAAM,OAAgB,UAAU;IAwB/B;;;OAGG;IACH,IAAc,KAAK;QAClB,OAAO,gBAAgB,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,QAAQ,CAAC;IAClD,CAAC;IAED;;;;OAIG;IACH,IAAc,WAAW;QACxB,OAAO,gBAAgB,CAAC,IAAI,CAAC,EAAE,WAAW,IAAI,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC1E,CAAC;IAED;;;;;OAKG;IACO,UAAU,CAAC,QAAsC;QAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,KAAK,KAAK,CAAC,MAAM,CAAC;IACvE,CAAC;CACD"}
+{"version":3,"file":"BasePolicy.js","sourceRoot":"","sources":["../../src/bouncer/BasePolicy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAGxE,MAAM,OAAgB,UAAU;IA0B/B;;;OAGG;IACH,IAAc,KAAK;QAClB,OAAO,gBAAgB,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,QAAQ,CAAC;IAClD,CAAC;IAED;;;;OAIG;IACH,IAAc,WAAW;QACxB,OAAO,gBAAgB,CAAC,IAAI,CAAC,EAAE,WAAW,IAAI,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC1E,CAAC;IAED;;;;;OAKG;IACO,UAAU,CAAC,QAAsC;QAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,KAAK,KAAK,CAAC,MAAM,CAAC;IACvE,CAAC;CACD"}