@c9up/warden 0.1.13 → 0.1.14

package/dist/bouncer/Bouncer.d.ts

@@ -12,13 +12,20 @@
  */
 import type { UserPayload } from "../AuthManager.js";
 import type { Scope } from "../rights/types.js";
+import { AbilitiesBuilder } from "./AbilitiesBuilder.js";
 import { AuthorizationResponse } from "./AuthorizationResponse.js";
 import type { BasePolicy } from "./BasePolicy.js";
 import { PolicyAuthorizer } from "./PolicyAuthorizer.js";
 import type { Ability, AbilityOptions, AuthorizerResponse, BouncerContext } from "./types.js";
 export declare class Bouncer {
     #private;
-    constructor(user: UserPayload | null, abilities?: Record<string, Ability<never[]>>, policies?: Record<string, new () => BasePolicy>, context?: BouncerContext);
+    constructor(user: UserPayload | (() => UserPayload | null) | null, abilities?: Record<string, Ability<never[]>>, policies?: Record<string, new () => BasePolicy>, context?: BouncerContext);
+    /**
+     * Define an ability and open a chainable {@link AbilitiesBuilder} (Adonis
+     * `Bouncer.define`). Read `.abilities` off the returned builder to pass into a
+     * `new Bouncer(user, abilities)`.
+     */
+    static define<Args extends unknown[]>(name: string, authorizer: (user: UserPayload, ...args: Args) => AuthorizerResponse, options?: AbilityOptions): AbilitiesBuilder;
     /** The active resolution scope (default `"global"`). */
     get scope(): Scope;
     /**
@@ -29,7 +36,7 @@ export declare class Bouncer {
     static ability<Args extends unknown[]>(options: AbilityOptions, callback: (user: UserPayload | null, ...args: Args) => AuthorizerResponse): Ability<Args>;
     /** Convenience — equivalent to `AuthorizationResponse.deny` (Adonis `bouncer.deny`). */
     deny(message?: string, status?: number): AuthorizationResponse;
-    /** Open a policy for checks (D8 — fresh `new PolicyClass()` per check). */
+    /** Open a policy for checks (D8 — fresh policy instance per check). */
     with(policy: (new () => BasePolicy) | string): PolicyAuthorizer;
     /** Run an ability check and resolve to the full response. */
     execute<Args extends unknown[]>(ability: Ability<Args>, ...args: Args): Promise<AuthorizationResponse>;

package/dist/bouncer/Bouncer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Bouncer.d.ts","sourceRoot":"","sources":["../../src/bouncer/Bouncer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGrD,OAAO,KAAK,EAAwB,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,OAAO,KAAK,EACX,OAAO,EACP,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,MAAM,YAAY,CAAC;AAEpB,qBAAa,OAAO;;gBAUlB,IAAI,EAAE,WAAW,GAAG,IAAI,EACxB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,EAC5C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,UAAU,CAAC,EAC/C,OAAO,CAAC,EAAE,cAAc;IASzB,wDAAwD;IACxD,IAAI,KAAK,IAAI,KAAK,CAEjB;IAkBD;;;OAGG;IACH,MAAM,CAAC,OAAO,CAAC,IAAI,SAAS,OAAO,EAAE,EACpC,QAAQ,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,IAAI,KAAK,kBAAkB,GAChE,OAAO,CAAC,IAAI,CAAC;IAChB,MAAM,CAAC,OAAO,CAAC,IAAI,SAAS,OAAO,EAAE,EACpC,OAAO,EAAE,cAAc,EACvB,QAAQ,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,EAAE,GAAG,IAAI,EAAE,IAAI,KAAK,kBAAkB,GACvE,OAAO,CAAC,IAAI,CAAC;IAmChB,wFAAwF;IACxF,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,qBAAqB;IAI9D,2EAA2E;IAC3E,IAAI,CAAC,MAAM,EAAE,CAAC,UAAU,UAAU,CAAC,GAAG,MAAM,GAAG,gBAAgB;IAY/D,6DAA6D;IAC7D,OAAO,CAAC,IAAI,SAAS,OAAO,EAAE,EAC7B,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,EACtB,GAAG,IAAI,EAAE,IAAI,GACX,OAAO,CAAC,qBAAqB,CAAC;IACjC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAQ5E,kEAAkE;IAClE,MAAM,CAAC,IAAI,SAAS,OAAO,EAAE,EAC5B,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,EACtB,GAAG,IAAI,EAAE,IAAI,GACX,OAAO,CAAC,OAAO,CAAC;IACnB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAQ7D,kEAAkE;IAClE,MAAM,CAAC,IAAI,SAAS,OAAO,EAAE,EAC5B,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,EACtB,GAAG,IAAI,EAAE,IAAI,GACX,OAAO,CAAC,OAAO,CAAC;IACnB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAQ7D,6EAA6E;IAC7E,SAAS,CAAC,IAAI,SAAS,OAAO,EAAE,EAC/B,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,EACtB,GAAG,IAAI,EAAE,IAAI,GACX,OAAO,CAAC,IAAI,CAAC;IAChB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAwD7D"}
+{"version":3,"file":"Bouncer.d.ts","sourceRoot":"","sources":["../../src/bouncer/Bouncer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGrD,OAAO,KAAK,EAAwB,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,OAAO,KAAK,EACX,OAAO,EACP,cAAc,EACd,kBAAkB,EAClB,cAAc,EAGd,MAAM,YAAY,CAAC;AAEpB,qBAAa,OAAO;;gBAclB,IAAI,EAAE,WAAW,GAAG,CAAC,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,IAAI,EACrD,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,EAC5C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,UAAU,CAAC,EAC/C,OAAO,CAAC,EAAE,cAAc;IAyBzB;;;;OAIG;IACH,MAAM,CAAC,MAAM,CAAC,IAAI,SAAS,OAAO,EAAE,EACnC,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,IAAI,KAAK,kBAAkB,EACpE,OAAO,CAAC,EAAE,cAAc,GACtB,gBAAgB;IAInB,wDAAwD;IACxD,IAAI,KAAK,IAAI,KAAK,CAEjB;IAmBD;;;OAGG;IACH,MAAM,CAAC,OAAO,CAAC,IAAI,SAAS,OAAO,EAAE,EACpC,QAAQ,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,IAAI,KAAK,kBAAkB,GAChE,OAAO,CAAC,IAAI,CAAC;IAChB,MAAM,CAAC,OAAO,CAAC,IAAI,SAAS,OAAO,EAAE,EACpC,OAAO,EAAE,cAAc,EACvB,QAAQ,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,EAAE,GAAG,IAAI,EAAE,IAAI,KAAK,kBAAkB,GACvE,OAAO,CAAC,IAAI,CAAC;IAmChB,wFAAwF;IACxF,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,qBAAqB;IAI9D,uEAAuE;IACvE,IAAI,CAAC,MAAM,EAAE,CAAC,UAAU,UAAU,CAAC,GAAG,MAAM,GAAG,gBAAgB;IAmC/D,6DAA6D;IAC7D,OAAO,CAAC,IAAI,SAAS,OAAO,EAAE,EAC7B,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,EACtB,GAAG,IAAI,EAAE,IAAI,GACX,OAAO,CAAC,qBAAqB,CAAC;IACjC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAQ5E,kEAAkE;IAClE,MAAM,CAAC,IAAI,SAAS,OAAO,EAAE,EAC5B,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,EACtB,GAAG,IAAI,EAAE,IAAI,GACX,OAAO,CAAC,OAAO,CAAC;IACnB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAQ7D,kEAAkE;IAClE,MAAM,CAAC,IAAI,SAAS,OAAO,EAAE,EAC5B,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,EACtB,GAAG,IAAI,EAAE,IAAI,GACX,OAAO,CAAC,OAAO,CAAC;IACnB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAQ7D,6EAA6E;IAC7E,SAAS,CAAC,IAAI,SAAS,OAAO,EAAE,EAC/B,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,EACtB,GAAG,IAAI,EAAE,IAAI,GACX,OAAO,CAAC,IAAI,CAAC;IAChB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CA2D7D"}

package/dist/bouncer/Bouncer.js

@@ -11,24 +11,52 @@
  * the developer writes the predicate, exactly as Adonis does.
  */
 import { WardenError } from "../errors.js";
+import { AbilitiesBuilder } from "./AbilitiesBuilder.js";
 import { AuthorizationResponse } from "./AuthorizationResponse.js";
 import { evaluate, isAction, throwAuthorizationFailure } from "./evaluate.js";
 import { PolicyAuthorizer } from "./PolicyAuthorizer.js";
 import { emptyPermissions } from "./policyContext.js";
 export class Bouncer {
+    #userOrResolver;
+    /** Lazily-resolved user cache (`undefined` until `#getUser` runs). */
     #user;
     #abilities;
     #policies;
     #scope;
     #resolver;
+    #containerResolver;
+    #emitter;
     /** Memoized resolution — a Bouncer is fixed per `(user, scope)`, so resolve once (D3). */
     #resolved;
     constructor(user, abilities, policies, context) {
-        this.#user = user;
+        this.#userOrResolver = user;
         this.#abilities = abilities ?? {};
         this.#policies = policies ?? {};
         this.#scope = context?.scope ?? "global";
         this.#resolver = context?.resolver;
+        this.#containerResolver = context?.containerResolver;
+        this.#emitter = context?.emitter;
+    }
+    /**
+     * Resolve the user, lazily invoking a resolver callback once and memoizing
+     * the result (Adonis `#getUser`). A plain `UserPayload | null` passes through.
+     */
+    #getUser() {
+        if (this.#user === undefined) {
+            this.#user =
+                typeof this.#userOrResolver === "function"
+                    ? this.#userOrResolver()
+                    : this.#userOrResolver;
+        }
+        return this.#user;
+    }
+    /**
+     * Define an ability and open a chainable {@link AbilitiesBuilder} (Adonis
+     * `Bouncer.define`). Read `.abilities` off the returned builder to pass into a
+     * `new Bouncer(user, abilities)`.
+     */
+    static define(name, authorizer, options) {
+        return new AbilitiesBuilder().define(name, authorizer, options);
     }
     /** The active resolution scope (default `"global"`). */
     get scope() {
@@ -42,9 +70,10 @@ export class Bouncer {
      */
     #resolvePermissions() {
         if (this.#resolved === undefined) {
+            const user = this.#getUser();
             this.#resolved =
-                this.#resolver !== undefined && this.#user !== null
-                    ? this.#resolver.resolve(this.#user, this.#scope)
+                this.#resolver !== undefined && user !== null
+                    ? this.#resolver.resolve(user, this.#scope)
                     : Promise.resolve(emptyPermissions(this.#scope));
         }
         return this.#resolved;
@@ -75,14 +104,31 @@ export class Bouncer {
     deny(message, status) {
         return AuthorizationResponse.deny(message, status);
     }
-    /** Open a policy for checks (D8 — fresh `new PolicyClass()` per check). */
+    /** Open a policy for checks (D8 — fresh policy instance per check). */
     with(policy) {
         const factory = typeof policy === "string"
             ? this.#resolvePolicyClass(policy)
-            : () => new policy();
+            : () => this.#construct(policy);
         // The PolicyAuthorizer inherits the Bouncer's scope + the shared memoized
         // resolve so every policy check sees the active `(user, scope)` (AC1/AC3).
-        return new PolicyAuthorizer(this.#user, factory, this.#scope, () => this.#resolvePermissions());
+        return new PolicyAuthorizer(this.#getUser(), factory, this.#scope, () => this.#resolvePermissions(), this.#emitter);
+    }
+    /**
+     * Construct a policy instance via the container resolver when present (Adonis
+     * DI parity), else a plain `new Policy()` (D8 — a fresh instance per check).
+     */
+    #construct(ctor) {
+        return this.#containerResolver !== undefined
+            ? this.#containerResolver.make(ctor)
+            : Promise.resolve(new ctor());
+    }
+    /** Emit `authorization:finished` when an emitter is wired (no-op otherwise). */
+    #emit(action, response) {
+        this.#emitter?.emit("authorization:finished", {
+            user: this.#getUser(),
+            action,
+            response,
+        });
     }
     execute(ability, ...args) {
         return this.#evaluateAbility(ability, args);
@@ -101,13 +147,16 @@ export class Bouncer {
     }
     async #evaluateAbility(ability, args) {
         const resolved = typeof ability === "string" ? this.#resolveAbility(ability) : ability;
-        return evaluate({
-            user: this.#user,
-            action: typeof ability === "string" ? ability : "(ability)",
+        const action = typeof ability === "string" ? ability : "(ability)";
+        const response = await evaluate({
+            user: this.#getUser(),
+            action,
             allowGuest: resolved.allowGuest,
             run: (user) => resolved.execute(user, ...args),
             args,
         });
+        this.#emit(action, response);
+        return response;
     }
     #resolveAbility(name) {
         const found = this.#abilities[name];
@@ -127,7 +176,7 @@ export class Bouncer {
                     hint: "Register it via new Bouncer(user, abilities, { [name]: Policy }).",
                 });
             }
-            return new ctor();
+            return this.#construct(ctor);
         };
     }
 }

package/dist/bouncer/Bouncer.js.map

@@ -1 +1 @@
-{"version":3,"file":"Bouncer.js","sourceRoot":"","sources":["../../src/bouncer/Bouncer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAG3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAQtD,MAAM,OAAO,OAAO;IACV,KAAK,CAAqB;IAC1B,UAAU,CAAmC;IAC7C,SAAS,CAAuC;IAChD,MAAM,CAAQ;IACd,SAAS,CAA6B;IAC/C,0FAA0F;IAC1F,SAAS,CAA4C;IAErD,YACC,IAAwB,EACxB,SAA4C,EAC5C,QAA+C,EAC/C,OAAwB;QAExB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,UAAU,GAAG,SAAS,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,QAAQ,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,KAAK,IAAI,QAAQ,CAAC;QACzC,IAAI,CAAC,SAAS,GAAG,OAAO,EAAE,QAAQ,CAAC;IACpC,CAAC;IAED,wDAAwD;IACxD,IAAI,KAAK;QACR,OAAO,IAAI,CAAC,MAAM,CAAC;IACpB,CAAC;IAED;;;;;OAKG;IACH,mBAAmB;QAClB,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC,SAAS;gBACb,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI;oBAClD,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC;oBACjD,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC;IACvB,CAAC;IAaD,MAAM,CAAC,OAAO,CACb,iBAE6C,EAC7C,aAAwD;QAExD,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,IAAI,GAAY,CAAC;QACjB,IAAI,OAAO,iBAAiB,KAAK,UAAU,EAAE,CAAC;YAC7C,GAAG,GAAG,iBAAiB,CAAC;QACzB,CAAC;aAAM,CAAC;YACP,UAAU,GAAG,iBAAiB,CAAC,UAAU,IAAI,KAAK,CAAC;YACnD,GAAG,GAAG,aAAa,CAAC;QACrB,CAAC;QACD,sEAAsE;QACtE,qEAAqE;QACrE,sEAAsE;QACtE,0EAA0E;QAC1E,kCAAkC;QAClC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,WAAW,CACpB,iBAAiB,EACjB,mEAAmE,EACnE,EAAE,IAAI,EAAE,sDAAsD,EAAE,CAChE,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC;QACrB,MAAM,OAAO,GAAG,CACf,IAAwB,EACxB,GAAG,IAAe,EACG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IAChC,CAAC;IAED,wFAAwF;IACxF,IAAI,CAAC,OAAgB,EAAE,MAAe;QACrC,OAAO,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IAED,2EAA2E;IAC3E,IAAI,CAAC,MAAuC;QAC3C,MAAM,OAAO,GACZ,OAAO,MAAM,KAAK,QAAQ;YACzB,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC;YAClC,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,0EAA0E;QAC1E,2EAA2E;QAC3E,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAClE,IAAI,CAAC,mBAAmB,EAAE,CAC1B,CAAC;IACH,CAAC;IAQD,OAAO,CACN,OAAkC,EAClC,GAAG,IAAe;QAElB,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;IAQD,KAAK,CAAC,MAAM,CACX,OAAkC,EAClC,GAAG,IAAe;QAElB,OAAO,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;IAChE,CAAC;IAQD,KAAK,CAAC,MAAM,CACX,OAAkC,EAClC,GAAG,IAAe;QAElB,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;IACjE,CAAC;IAQD,KAAK,CAAC,SAAS,CACd,OAAkC,EAClC,GAAG,IAAe;QAElB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC5D,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC1B,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;IACF,CAAC;IAED,KAAK,CAAC,gBAAgB,CACrB,OAAkC,EAClC,IAAe;QAEf,MAAM,QAAQ,GACb,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACvE,OAAO,QAAQ,CAAC;YACf,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,MAAM,EAAE,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW;YAC3D,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC;YAC9C,IAAI;SACJ,CAAC,CAAC;IACJ,CAAC;IAED,eAAe,CAAC,IAAY;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,WAAW,CACpB,iBAAiB,EACjB,eAAe,IAAI,kCAAkC,EACrD,EAAE,IAAI,EAAE,yDAAyD,EAAE,CACnE,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC;IAED,mBAAmB,CAAC,IAAY;QAC/B,yEAAyE;QACzE,sEAAsE;QACtE,4CAA4C;QAC5C,OAAO,GAAG,EAAE;YACX,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACxB,MAAM,IAAI,WAAW,CACpB,gBAAgB,EAChB,cAAc,IAAI,kCAAkC,EACpD;oBACC,IAAI,EAAE,mEAAmE;iBACzE,CACD,CAAC;YACH,CAAC;YACD,OAAO,IAAI,IAAI,EAAE,CAAC;QACnB,CAAC,CAAC;IACH,CAAC;CACD"}
+{"version":3,"file":"Bouncer.js","sourceRoot":"","sources":["../../src/bouncer/Bouncer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAG3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAUtD,MAAM,OAAO,OAAO;IACV,eAAe,CAAkD;IAC1E,sEAAsE;IACtE,KAAK,CAAiC;IAC7B,UAAU,CAAmC;IAC7C,SAAS,CAAuC;IAChD,MAAM,CAAQ;IACd,SAAS,CAA6B;IACtC,kBAAkB,CAAsC;IACxD,QAAQ,CAA6B;IAC9C,0FAA0F;IAC1F,SAAS,CAA4C;IAErD,YACC,IAAqD,EACrD,SAA4C,EAC5C,QAA+C,EAC/C,OAAwB;QAExB,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,SAAS,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,QAAQ,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,KAAK,IAAI,QAAQ,CAAC;QACzC,IAAI,CAAC,SAAS,GAAG,OAAO,EAAE,QAAQ,CAAC;QACnC,IAAI,CAAC,kBAAkB,GAAG,OAAO,EAAE,iBAAiB,CAAC;QACrD,IAAI,CAAC,QAAQ,GAAG,OAAO,EAAE,OAAO,CAAC;IAClC,CAAC;IAED;;;OAGG;IACH,QAAQ;QACP,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,KAAK;gBACT,OAAO,IAAI,CAAC,eAAe,KAAK,UAAU;oBACzC,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE;oBACxB,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;QAC1B,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,MAAM,CACZ,IAAY,EACZ,UAAoE,EACpE,OAAwB;QAExB,OAAO,IAAI,gBAAgB,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IACjE,CAAC;IAED,wDAAwD;IACxD,IAAI,KAAK;QACR,OAAO,IAAI,CAAC,MAAM,CAAC;IACpB,CAAC;IAED;;;;;OAKG;IACH,mBAAmB;QAClB,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC7B,IAAI,CAAC,SAAS;gBACb,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI;oBAC5C,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;oBAC3C,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC;IACvB,CAAC;IAaD,MAAM,CAAC,OAAO,CACb,iBAE6C,EAC7C,aAAwD;QAExD,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,IAAI,GAAY,CAAC;QACjB,IAAI,OAAO,iBAAiB,KAAK,UAAU,EAAE,CAAC;YAC7C,GAAG,GAAG,iBAAiB,CAAC;QACzB,CAAC;aAAM,CAAC;YACP,UAAU,GAAG,iBAAiB,CAAC,UAAU,IAAI,KAAK,CAAC;YACnD,GAAG,GAAG,aAAa,CAAC;QACrB,CAAC;QACD,sEAAsE;QACtE,qEAAqE;QACrE,sEAAsE;QACtE,0EAA0E;QAC1E,kCAAkC;QAClC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,WAAW,CACpB,iBAAiB,EACjB,mEAAmE,EACnE,EAAE,IAAI,EAAE,sDAAsD,EAAE,CAChE,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC;QACrB,MAAM,OAAO,GAAG,CACf,IAAwB,EACxB,GAAG,IAAe,EACG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IAChC,CAAC;IAED,wFAAwF;IACxF,IAAI,CAAC,OAAgB,EAAE,MAAe;QACrC,OAAO,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IAED,uEAAuE;IACvE,IAAI,CAAC,MAAuC;QAC3C,MAAM,OAAO,GACZ,OAAO,MAAM,KAAK,QAAQ;YACzB,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC;YAClC,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAClC,0EAA0E;QAC1E,2EAA2E;QAC3E,OAAO,IAAI,gBAAgB,CAC1B,IAAI,CAAC,QAAQ,EAAE,EACf,OAAO,EACP,IAAI,CAAC,MAAM,EACX,GAAG,EAAE,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAChC,IAAI,CAAC,QAAQ,CACb,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,UAAU,CAAC,IAA0B;QACpC,OAAO,IAAI,CAAC,kBAAkB,KAAK,SAAS;YAC3C,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;YACpC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAChC,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,MAAc,EAAE,QAA+B;QACpD,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,wBAAwB,EAAE;YAC7C,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;YACrB,MAAM;YACN,QAAQ;SACR,CAAC,CAAC;IACJ,CAAC;IAQD,OAAO,CACN,OAAkC,EAClC,GAAG,IAAe;QAElB,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;IAQD,KAAK,CAAC,MAAM,CACX,OAAkC,EAClC,GAAG,IAAe;QAElB,OAAO,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;IAChE,CAAC;IAQD,KAAK,CAAC,MAAM,CACX,OAAkC,EAClC,GAAG,IAAe;QAElB,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;IACjE,CAAC;IAQD,KAAK,CAAC,SAAS,CACd,OAAkC,EAClC,GAAG,IAAe;QAElB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC5D,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC1B,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;IACF,CAAC;IAED,KAAK,CAAC,gBAAgB,CACrB,OAAkC,EAClC,IAAe;QAEf,MAAM,QAAQ,GACb,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACvE,MAAM,MAAM,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;QACnE,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC;YAC/B,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;YACrB,MAAM;YACN,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC;YAC9C,IAAI;SACJ,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC7B,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,eAAe,CAAC,IAAY;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,WAAW,CACpB,iBAAiB,EACjB,eAAe,IAAI,kCAAkC,EACrD,EAAE,IAAI,EAAE,yDAAyD,EAAE,CACnE,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC;IAED,mBAAmB,CAAC,IAAY;QAC/B,yEAAyE;QACzE,sEAAsE;QACtE,4CAA4C;QAC5C,OAAO,GAAG,EAAE;YACX,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACxB,MAAM,IAAI,WAAW,CACpB,gBAAgB,EAChB,cAAc,IAAI,kCAAkC,EACpD;oBACC,IAAI,EAAE,mEAAmE;iBACzE,CACD,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC,CAAC;IACH,CAAC;CACD"}

package/dist/bouncer/PolicyAuthorizer.d.ts

@@ -9,9 +9,10 @@ import type { UserPayload } from "../AuthManager.js";
 import type { EffectivePermissions, Scope } from "../rights/types.js";
 import type { AuthorizationResponse } from "./AuthorizationResponse.js";
 import { BasePolicy } from "./BasePolicy.js";
+import type { BouncerEmitter } from "./types.js";
 export declare class PolicyAuthorizer {
     #private;
-    constructor(user: UserPayload | null, factory: () => BasePolicy, scope?: Scope, resolvePermissions?: () => Promise<EffectivePermissions>);
+    constructor(user: UserPayload | null, factory: () => Promise<BasePolicy>, scope?: Scope, resolvePermissions?: () => Promise<EffectivePermissions>, emitter?: BouncerEmitter);
     /** Run a check and resolve to the full response (D8 — fresh policy per check). */
     execute(action: string, ...args: unknown[]): Promise<AuthorizationResponse>;
     /** True iff the action is authorized. Never throws on denial. */

package/dist/bouncer/PolicyAuthorizer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PolicyAuthorizer.d.ts","sourceRoot":"","sources":["../../src/bouncer/PolicyAuthorizer.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAqD7C,qBAAa,gBAAgB;;gBAO3B,IAAI,EAAE,WAAW,GAAG,IAAI,EACxB,OAAO,EAAE,MAAM,UAAU,EACzB,KAAK,GAAE,KAAgB,EACvB,kBAAkB,GAAE,MAAM,OAAO,CAAC,oBAAoB,CACb;IAQ1C,kFAAkF;IAC5E,OAAO,CACZ,MAAM,EAAE,MAAM,EACd,GAAG,IAAI,EAAE,OAAO,EAAE,GAChB,OAAO,CAAC,qBAAqB,CAAC;IAmBjC,iEAAiE;IAC3D,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAIlE,kEAAkE;IAC5D,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAIlE,6EAA6E;IACvE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAMlE"}
+{"version":3,"file":"PolicyAuthorizer.d.ts","sourceRoot":"","sources":["../../src/bouncer/PolicyAuthorizer.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAS7C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AA6CjD,qBAAa,gBAAgB;;gBAQ3B,IAAI,EAAE,WAAW,GAAG,IAAI,EACxB,OAAO,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,EAClC,KAAK,GAAE,KAAgB,EACvB,kBAAkB,GAAE,MAAM,OAAO,CAAC,oBAAoB,CACb,EACzC,OAAO,CAAC,EAAE,cAAc;IASzB,kFAAkF;IAC5E,OAAO,CACZ,MAAM,EAAE,MAAM,EACd,GAAG,IAAI,EAAE,OAAO,EAAE,GAChB,OAAO,CAAC,qBAAqB,CAAC;IAyBjC,iEAAiE;IAC3D,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAIlE,kEAAkE;IAC5D,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAIlE,6EAA6E;IACvE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAMlE"}

package/dist/bouncer/PolicyAuthorizer.js

@@ -48,22 +48,24 @@ export class PolicyAuthorizer {
     #factory;
     #scope;
     #resolvePermissions;
-    constructor(user, factory, scope = "global", resolvePermissions = () => Promise.resolve(emptyPermissions(scope))) {
+    #emitter;
+    constructor(user, factory, scope = "global", resolvePermissions = () => Promise.resolve(emptyPermissions(scope)), emitter) {
         this.#user = user;
         this.#factory = factory;
         this.#scope = scope;
         this.#resolvePermissions = resolvePermissions;
+        this.#emitter = emitter;
     }
     /** Run a check and resolve to the full response (D8 — fresh policy per check). */
     async execute(action, ...args) {
-        const policy = this.#factory();
+        const policy = await this.#factory();
         // Attach the active scope + resolved permissions BEFORE dispatch so the
         // before/method/after pipeline all read `this.scope` / `this.permissions`.
         const permissions = await this.#resolvePermissions();
         setPolicyContext(policy, { scope: this.#scope, permissions });
         const method = resolveActionMethod(policy, action);
         const options = getActionMetadata(policy, action);
-        return evaluate({
+        const response = await evaluate({
             user: this.#user,
             action,
             allowGuest: options.allowGuest ?? false,
@@ -72,6 +74,12 @@ export class PolicyAuthorizer {
             before: policy.before?.bind(policy),
             after: policy.after?.bind(policy),
         });
+        this.#emitter?.emit("authorization:finished", {
+            user: this.#user,
+            action,
+            response,
+        });
+        return response;
     }
     /** True iff the action is authorized. Never throws on denial. */
     async allows(action, ...args) {

package/dist/bouncer/PolicyAuthorizer.js.map

@@ -1 +1 @@
-{"version":3,"file":"PolicyAuthorizer.js","sourceRoot":"","sources":["../../src/bouncer/PolicyAuthorizer.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAG3C,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAEN,QAAQ,EACR,QAAQ,EACR,yBAAyB,GACzB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAExE;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,MAAkB,EAAE,MAAc;IAC9D,yEAAyE;IACzE,8EAA8E;IAC9E,4EAA4E;IAC5E,+EAA+E;IAC/E,6EAA6E;IAC7E,6CAA6C;IAC7C,MAAM,YAAY,GACjB,MAAM,KAAK,aAAa,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,OAAO,CAAC;IACvE,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,KACC,IAAI,KAAK,GAAkB,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,EACxD,KAAK,KAAK,IAAI;QACd,KAAK,KAAK,UAAU,CAAC,SAAS;QAC9B,KAAK,KAAK,MAAM,CAAC,SAAS,EAC1B,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,EACnC,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;YAClC,YAAY,GAAG,IAAI,CAAC;YACpB,MAAM;QACP,CAAC;IACF,CAAC;IACD,MAAM,SAAS,GAAY,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvD,IAAI,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,YAAY,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,WAAW,CACpB,uBAAuB,EACvB,WAAW,MAAM,CAAC,WAAW,CAAC,IAAI,oBAAoB,MAAM,GAAG,EAC/D,EAAE,IAAI,EAAE,qDAAqD,EAAE,CAC/D,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,OAAO,gBAAgB;IACnB,KAAK,CAAqB;IAC1B,QAAQ,CAAmB;IAC3B,MAAM,CAAQ;IACd,mBAAmB,CAAsC;IAElE,YACC,IAAwB,EACxB,OAAyB,EACzB,QAAe,QAAQ,EACvB,qBAA0D,GAAG,EAAE,CAC9D,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAEzC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,mBAAmB,GAAG,kBAAkB,CAAC;IAC/C,CAAC;IAED,kFAAkF;IAClF,KAAK,CAAC,OAAO,CACZ,MAAc,EACd,GAAG,IAAe;QAElB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC/B,wEAAwE;QACxE,2EAA2E;QAC3E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACrD,gBAAgB,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAClD,OAAO,QAAQ,CAAC;YACf,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,MAAM;YACN,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,KAAK;YACvC,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC;YACpC,IAAI;YACJ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;YACnC,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC;SACjC,CAAC,CAAC;IACJ,CAAC;IAED,iEAAiE;IACjE,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,GAAG,IAAe;QAC9C,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;IACzD,CAAC;IAED,kEAAkE;IAClE,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,GAAG,IAAe;QAC9C,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;IAC1D,CAAC;IAED,6EAA6E;IAC7E,KAAK,CAAC,SAAS,CAAC,MAAc,EAAE,GAAG,IAAe;QACjD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC1B,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;IACF,CAAC;CACD"}
+{"version":3,"file":"PolicyAuthorizer.js","sourceRoot":"","sources":["../../src/bouncer/PolicyAuthorizer.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAG3C,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAEN,QAAQ,EACR,QAAQ,EACR,yBAAyB,GACzB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAGxE;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,MAAkB,EAAE,MAAc;IAC9D,yEAAyE;IACzE,8EAA8E;IAC9E,4EAA4E;IAC5E,+EAA+E;IAC/E,6EAA6E;IAC7E,6CAA6C;IAC7C,MAAM,YAAY,GACjB,MAAM,KAAK,aAAa,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,OAAO,CAAC;IACvE,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,KACC,IAAI,KAAK,GAAkB,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,EACxD,KAAK,KAAK,IAAI;QACd,KAAK,KAAK,UAAU,CAAC,SAAS;QAC9B,KAAK,KAAK,MAAM,CAAC,SAAS,EAC1B,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,EACnC,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;YAClC,YAAY,GAAG,IAAI,CAAC;YACpB,MAAM;QACP,CAAC;IACF,CAAC;IACD,MAAM,SAAS,GAAY,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvD,IAAI,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,YAAY,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,WAAW,CACpB,uBAAuB,EACvB,WAAW,MAAM,CAAC,WAAW,CAAC,IAAI,oBAAoB,MAAM,GAAG,EAC/D,EAAE,IAAI,EAAE,qDAAqD,EAAE,CAC/D,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,OAAO,gBAAgB;IACnB,KAAK,CAAqB;IAC1B,QAAQ,CAA4B;IACpC,MAAM,CAAQ;IACd,mBAAmB,CAAsC;IACzD,QAAQ,CAA6B;IAE9C,YACC,IAAwB,EACxB,OAAkC,EAClC,QAAe,QAAQ,EACvB,qBAA0D,GAAG,EAAE,CAC9D,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,EACzC,OAAwB;QAExB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,mBAAmB,GAAG,kBAAkB,CAAC;QAC9C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,kFAAkF;IAClF,KAAK,CAAC,OAAO,CACZ,MAAc,EACd,GAAG,IAAe;QAElB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACrC,wEAAwE;QACxE,2EAA2E;QAC3E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACrD,gBAAgB,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC;YAC/B,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,MAAM;YACN,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,KAAK;YACvC,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC;YACpC,IAAI;YACJ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;YACnC,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC;SACjC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,wBAAwB,EAAE;YAC7C,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,MAAM;YACN,QAAQ;SACR,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,iEAAiE;IACjE,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,GAAG,IAAe;QAC9C,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;IACzD,CAAC;IAED,kEAAkE;IAClE,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,GAAG,IAAe;QAC9C,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;IAC1D,CAAC;IAED,6EAA6E;IAC7E,KAAK,CAAC,SAAS,CAAC,MAAc,EAAE,GAAG,IAAe;QACjD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC1B,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;IACF,CAAC;CACD"}

package/dist/bouncer/evaluate.d.ts

@@ -31,6 +31,6 @@ export declare function evaluate(params: {
     run: (user: UserPayload | null) => AuthorizerResponse;
     args: unknown[];
     before?: (user: UserPayload | null, action: string, ...args: unknown[]) => HookResponse;
-    after?: (user: UserPayload | null, action: string, result: AuthorizationResponse) => HookResponse;
+    after?: (user: UserPayload | null, action: string, result: AuthorizationResponse, ...args: unknown[]) => HookResponse;
 }): Promise<AuthorizationResponse>;
 //# sourceMappingURL=evaluate.d.ts.map

package/dist/bouncer/evaluate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../../src/bouncer/evaluate.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAEnE,+DAA+D;AAC/D,MAAM,MAAM,MAAM,GAAG,CACpB,IAAI,EAAE,WAAW,GAAG,IAAI,EACxB,GAAG,IAAI,EAAE,OAAO,EAAE,KACd,kBAAkB,CAAC;AAExB,0EAA0E;AAC1E,wBAAgB,iBAAiB,CAChC,KAAK,EAAE,OAAO,GAAG,qBAAqB,GACpC,qBAAqB,CAKvB;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAExD;AAED,4EAA4E;AAC5E,wBAAgB,yBAAyB,CACxC,QAAQ,EAAE,qBAAqB,GAC7B,KAAK,CASP;AAED,wEAAwE;AACxE,wBAAsB,QAAQ,CAAC,MAAM,EAAE;IACtC,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,OAAO,CAAC;IACpB,GAAG,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,KAAK,kBAAkB,CAAC;IACtD,IAAI,EAAE,OAAO,EAAE,CAAC;IAChB,MAAM,CAAC,EAAE,CACR,IAAI,EAAE,WAAW,GAAG,IAAI,EACxB,MAAM,EAAE,MAAM,EACd,GAAG,IAAI,EAAE,OAAO,EAAE,KACd,YAAY,CAAC;IAClB,KAAK,CAAC,EAAE,CACP,IAAI,EAAE,WAAW,GAAG,IAAI,EACxB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,qBAAqB,KACzB,YAAY,CAAC;CAClB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA+BjC"}
+{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../../src/bouncer/evaluate.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAEnE,+DAA+D;AAC/D,MAAM,MAAM,MAAM,GAAG,CACpB,IAAI,EAAE,WAAW,GAAG,IAAI,EACxB,GAAG,IAAI,EAAE,OAAO,EAAE,KACd,kBAAkB,CAAC;AAExB,0EAA0E;AAC1E,wBAAgB,iBAAiB,CAChC,KAAK,EAAE,OAAO,GAAG,qBAAqB,GACpC,qBAAqB,CAKvB;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAExD;AAED,4EAA4E;AAC5E,wBAAgB,yBAAyB,CACxC,QAAQ,EAAE,qBAAqB,GAC7B,KAAK,CASP;AAED,wEAAwE;AACxE,wBAAsB,QAAQ,CAAC,MAAM,EAAE;IACtC,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,OAAO,CAAC;IACpB,GAAG,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,KAAK,kBAAkB,CAAC;IACtD,IAAI,EAAE,OAAO,EAAE,CAAC;IAChB,MAAM,CAAC,EAAE,CACR,IAAI,EAAE,WAAW,GAAG,IAAI,EACxB,MAAM,EAAE,MAAM,EACd,GAAG,IAAI,EAAE,OAAO,EAAE,KACd,YAAY,CAAC;IAClB,KAAK,CAAC,EAAE,CACP,IAAI,EAAE,WAAW,GAAG,IAAI,EACxB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,qBAAqB,EAC7B,GAAG,IAAI,EAAE,OAAO,EAAE,KACd,YAAY,CAAC;CAClB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAgCjC"}

package/dist/bouncer/evaluate.js

@@ -52,9 +52,10 @@ export async function evaluate(params) {
             response = normalizeResponse(await run(user));
         }
     }
-    // (4) after — non-undefined overrides.
+    // (4) after — non-undefined overrides. Receives the resource args (Adonis
+    // `policy.after(user, action, result, ...args)`).
     if (after) {
-        const override = await after(user, action, response);
+        const override = await after(user, action, response, ...args);
         if (override !== undefined) {
             response = normalizeResponse(override);
         }

package/dist/bouncer/evaluate.js.map

@@ -1 +1 @@
-{"version":3,"file":"evaluate.js","sourceRoot":"","sources":["../../src/bouncer/evaluate.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AASnE,0EAA0E;AAC1E,MAAM,UAAU,iBAAiB,CAChC,KAAsC;IAEtC,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,CAAC,qBAAqB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAc;IACtC,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC;AACpC,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,yBAAyB,CACxC,QAA+B;IAE/B,MAAM,IAAI,WAAW,CACpB,uBAAuB,EACvB,QAAQ,CAAC,OAAO,IAAI,sBAAsB,EAC1C;QACC,IAAI,EAAE,qDAAqD;QAC3D,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,GAAG;KAC9B,CACD,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,MAgB9B;IACA,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IAEtE,IAAI,QAA2C,CAAC;IAEhD,wDAAwD;IACxD,IAAI,MAAM,EAAE,CAAC;QACZ,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;QAClD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;IACF,CAAC;IAED,sEAAsE;IACtE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAClC,QAAQ,GAAG,qBAAqB,CAAC,IAAI,EAAE,CAAC;QACzC,CAAC;aAAM,CAAC;YACP,QAAQ,GAAG,iBAAiB,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/C,CAAC;IACF,CAAC;IAED,uCAAuC;IACvC,IAAI,KAAK,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACrD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5B,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACxC,CAAC;IACF,CAAC;IAED,OAAO,QAAQ,CAAC;AACjB,CAAC"}
+{"version":3,"file":"evaluate.js","sourceRoot":"","sources":["../../src/bouncer/evaluate.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AASnE,0EAA0E;AAC1E,MAAM,UAAU,iBAAiB,CAChC,KAAsC;IAEtC,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,CAAC,qBAAqB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAc;IACtC,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC;AACpC,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,yBAAyB,CACxC,QAA+B;IAE/B,MAAM,IAAI,WAAW,CACpB,uBAAuB,EACvB,QAAQ,CAAC,OAAO,IAAI,sBAAsB,EAC1C;QACC,IAAI,EAAE,qDAAqD;QAC3D,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,GAAG;KAC9B,CACD,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,MAiB9B;IACA,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IAEtE,IAAI,QAA2C,CAAC;IAEhD,wDAAwD;IACxD,IAAI,MAAM,EAAE,CAAC;QACZ,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;QAClD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;IACF,CAAC;IAED,sEAAsE;IACtE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAClC,QAAQ,GAAG,qBAAqB,CAAC,IAAI,EAAE,CAAC;QACzC,CAAC;aAAM,CAAC;YACP,QAAQ,GAAG,iBAAiB,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/C,CAAC;IACF,CAAC;IAED,0EAA0E;IAC1E,kDAAkD;IAClD,IAAI,KAAK,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,CAAC;QAC9D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5B,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACxC,CAAC;IACF,CAAC;IAED,OAAO,QAAQ,CAAC;AACjB,CAAC"}

package/dist/bouncer/types.d.ts

@@ -9,9 +9,26 @@ import type { UserPayload } from "../AuthManager.js";
 import type { RightsResolver } from "../rights/RightsResolver.js";
 import type { Scope } from "../rights/types.js";
 import type { AuthorizationResponse } from "./AuthorizationResponse.js";
+/**
+ * Agnostic IoC-container resolver used to construct policy instances (Adonis
+ * `PolicyAuthorizer`'s `#containerResolver`). Same shape as `ctx.containerResolver`
+ * so a Ream request context is passed through directly — warden never imports the
+ * container. Absent ⇒ policies are built with a plain `new Policy()`.
+ */
+export interface PolicyContainerResolver {
+    make<T>(ctor: new (...args: never[]) => T): Promise<T>;
+}
+/**
+ * Agnostic event sink (Adonis `Bouncer.emitter`). When present, an
+ * `authorization:finished` event fires after every ability/policy evaluation with
+ * `{ user, action, response }`. No-op when absent.
+ */
+export interface BouncerEmitter {
+    emit(event: string, payload: unknown): void;
+}
 /**
  * Optional 4th `Bouncer` ctor argument (56.3, D1) — the scope dimension + the
- * Layer-1 resolver. Both optional; omitting it ⇒ the implicit `global` scope
+ * Layer-1 resolver. All optional; omitting it ⇒ the implicit `global` scope
  * with no resolver (single-tenant zero-config, D7). Additive: every 56.2 call
  * site keeps compiling.
  */
@@ -20,6 +37,10 @@ export interface BouncerContext {
     readonly scope?: Scope;
     /** Layer-1 resolver consulted for this Bouncer's `(user, scope)`. */
     readonly resolver?: RightsResolver;
+    /** IoC-container resolver used to construct policies (Adonis DI parity). */
+    readonly containerResolver?: PolicyContainerResolver;
+    /** Event sink for `authorization:finished` (Adonis `Bouncer.emitter`). */
+    readonly emitter?: BouncerEmitter;
 }
 /** A predicate's return — bool sugar or an explicit response, sync or async (D7). */
 export type AuthorizerResponse = boolean | AuthorizationResponse | Promise<boolean | AuthorizationResponse>;

package/dist/bouncer/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/bouncer/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAExE;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC9B,uDAAuD;IACvD,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;CACnC;AAED,qFAAqF;AACrF,MAAM,MAAM,kBAAkB,GAC3B,OAAO,GACP,qBAAqB,GACrB,OAAO,CAAC,OAAO,GAAG,qBAAqB,CAAC,CAAC;AAE5C,wGAAwG;AACxG,MAAM,MAAM,YAAY,GACrB,OAAO,GACP,qBAAqB,GACrB,SAAS,GACT,OAAO,CAAC,OAAO,GAAG,qBAAqB,GAAG,SAAS,CAAC,CAAC;AAExD,yEAAyE;AACzE,MAAM,WAAW,cAAc;IAC9B,UAAU,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,OAAO,CAAC,IAAI,SAAS,OAAO,EAAE,GAAG,OAAO,EAAE;IAC1D,uEAAuE;IACvE,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,mFAAmF;IACnF,QAAQ,CAAC,OAAO,EAAE,CACjB,IAAI,EAAE,WAAW,GAAG,IAAI,EACxB,GAAG,IAAI,EAAE,OAAO,EAAE,KACd,kBAAkB,CAAC;IACxB,kFAAkF;IAClF,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;CAC1C"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/bouncer/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAExE;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACvC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACvD;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC9B,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;CAC5C;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC9B,uDAAuD;IACvD,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;IACnC,4EAA4E;IAC5E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,uBAAuB,CAAC;IACrD,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC;CAClC;AAED,qFAAqF;AACrF,MAAM,MAAM,kBAAkB,GAC3B,OAAO,GACP,qBAAqB,GACrB,OAAO,CAAC,OAAO,GAAG,qBAAqB,CAAC,CAAC;AAE5C,wGAAwG;AACxG,MAAM,MAAM,YAAY,GACrB,OAAO,GACP,qBAAqB,GACrB,SAAS,GACT,OAAO,CAAC,OAAO,GAAG,qBAAqB,GAAG,SAAS,CAAC,CAAC;AAExD,yEAAyE;AACzE,MAAM,WAAW,cAAc;IAC9B,UAAU,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,OAAO,CAAC,IAAI,SAAS,OAAO,EAAE,GAAG,OAAO,EAAE;IAC1D,uEAAuE;IACvE,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,mFAAmF;IACnF,QAAQ,CAAC,OAAO,EAAE,CACjB,IAAI,EAAE,WAAW,GAAG,IAAI,EACxB,GAAG,IAAI,EAAE,OAAO,EAAE,KACd,kBAAkB,CAAC;IACxB,kFAAkF;IAClF,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;CAC1C"}

package/dist/config.d.ts

@@ -14,7 +14,7 @@
  *     },
  *   })
  */
-import type { UserPayload } from "./AuthManager.js";
+import type { AuthStrategy, UserPayload } from "./AuthManager.js";
 import type { BasePolicy } from "./bouncer/BasePolicy.js";
 import type { Ability } from "./bouncer/types.js";
 import type { MfaManager } from "./mfa/MfaManager.js";
@@ -47,10 +47,41 @@ export interface JwtConfig {
      */
     blacklist?: TokenBlacklist;
 }
+/**
+ * A guard entry in the AdonisJS-style config — an {@link AuthStrategy} instance,
+ * built via {@link jwtGuard}/{@link sessionGuard}/{@link apiKeyGuard}. Named a
+ * "factory" for AdonisJS symmetry (`sessionGuard({...})`), though Warden guards
+ * are shared per-app instances (the per-request state lives on the Authenticator).
+ */
+export type GuardFactory = AuthStrategy;
+/** Build a JWT guard from its config (AdonisJS `jwtGuard()` shape). */
+export declare function jwtGuard(config: JwtConfig): GuardFactory;
+/** Build a session guard from its config (AdonisJS `sessionGuard()` shape). */
+export declare function sessionGuard(config: SessionStrategyConfig): GuardFactory;
+/** Build an API-key / access-tokens guard from its config. */
+export declare function apiKeyGuard(config: ApiKeyConfig): GuardFactory;
 export interface WardenConfig {
-    /** Default auth strategy (default: 'jwt'). */
+    /**
+     * AdonisJS-style default guard NAME — the key in {@link WardenConfig.guards}
+     * used when a route/call names none. Preferred over {@link
+     * WardenConfig.defaultStrategy}.
+     */
+    default?: string;
+    /**
+     * AdonisJS-style named guard map, e.g.
+     * `{ web: sessionGuard({...}), api: jwtGuard({...}) }`. Guards are named by
+     * YOU (multiple instances of the same driver are allowed). When supplied,
+     * this takes precedence over the driver-keyed `jwt`/`session`/`apiKey` fields.
+     */
+    guards?: Record<string, GuardFactory>;
+    /**
+     * Login route an HTML client is redirected to when a session-guarded request
+     * is unauthenticated (AdonisJS session renderer parity). Absent ⇒ 401 JSON.
+     */
+    loginRoute?: string;
+    /** Legacy default auth strategy name (default: 'jwt'). Prefer {@link WardenConfig.default}. */
     defaultStrategy?: string;
-    /** JWT strategy configuration. */
+    /** JWT strategy configuration (legacy driver-keyed form). */
     jwt?: JwtConfig;
     /**
      * Session strategy configuration. Supply `findUser` so `@Guard('session')`

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IACnC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;IAC7C,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,WAAW,GAAG,IAAI,CAAA;KAAE,CAAC;CACrC;AAED,MAAM,WAAW,SAAS;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACtD,iBAAiB,EAAE,CAClB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,KACZ,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACjC;;;;OAIG;IACH,SAAS,CAAC,EAAE,cAAc,CAAC;CAC3B;AAED,MAAM,WAAW,YAAY;IAC5B,8CAA8C;IAC9C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kCAAkC;IAClC,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB;;;;OAIG;IACH,OAAO,CAAC,EAAE,qBAAqB,CAAC;IAChC;;;;OAIG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB;;;;;OAKG;IACH,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,WAAW,CAAA;KAAE,CAAC;IACjC;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,UAAU,CAAC,CAAC;IAChD;;;;;OAKG;IACH,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,mBAAmB,KAAK,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACpE;;;;OAIG;IACH,GAAG,CAAC,EAAE;QAAE,OAAO,EAAE,UAAU,CAAA;KAAE,CAAC;CAC9B;AAED,oEAAoE;AACpE,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,YAAY,CAE/D"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAGnE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAE7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IACnC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;IAC7C,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,WAAW,GAAG,IAAI,CAAA;KAAE,CAAC;CACrC;AAED,MAAM,WAAW,SAAS;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACtD,iBAAiB,EAAE,CAClB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,KACZ,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACjC;;;;OAIG;IACH,SAAS,CAAC,EAAE,cAAc,CAAC;CAC3B;AAED;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,YAAY,CAAC;AAExC,uEAAuE;AACvE,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,YAAY,CAExD;AAED,+EAA+E;AAC/E,wBAAgB,YAAY,CAAC,MAAM,EAAE,qBAAqB,GAAG,YAAY,CAExE;AAED,8DAA8D;AAC9D,wBAAgB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,YAAY,CAE9D;AAED,MAAM,WAAW,YAAY;IAC5B;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACtC;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+FAA+F;IAC/F,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB;;;;OAIG;IACH,OAAO,CAAC,EAAE,qBAAqB,CAAC;IAChC;;;;OAIG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB;;;;;OAKG;IACH,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,WAAW,CAAA;KAAE,CAAC;IACjC;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,UAAU,CAAC,CAAC;IAChD;;;;;OAKG;IACH,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,mBAAmB,KAAK,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACpE;;;;OAIG;IACH,GAAG,CAAC,EAAE;QAAE,OAAO,EAAE,UAAU,CAAA;KAAE,CAAC;CAC9B;AAED,oEAAoE;AACpE,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,YAAY,CAE/D"}

package/dist/config.js

@@ -14,6 +14,21 @@
  *     },
  *   })
  */
+import { ApiKeyStrategy } from "./strategies/ApiKeyStrategy.js";
+import { JwtStrategy } from "./strategies/JwtStrategy.js";
+import { SessionStrategy } from "./strategies/SessionStrategy.js";
+/** Build a JWT guard from its config (AdonisJS `jwtGuard()` shape). */
+export function jwtGuard(config) {
+    return new JwtStrategy(config);
+}
+/** Build a session guard from its config (AdonisJS `sessionGuard()` shape). */
+export function sessionGuard(config) {
+    return new SessionStrategy(config);
+}
+/** Build an API-key / access-tokens guard from its config. */
+export function apiKeyGuard(config) {
+    return new ApiKeyStrategy(config);
+}
 /** Typed config helper — identity function for editor inference. */
 export function defineConfig(config) {
     return config;

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAwFH,oEAAoE;AACpE,MAAM,UAAU,YAAY,CAAC,MAAoB;IAChD,OAAO,MAAM,CAAC;AACf,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAQH,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAE1D,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAqClE,uEAAuE;AACvE,MAAM,UAAU,QAAQ,CAAC,MAAiB;IACzC,OAAO,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,YAAY,CAAC,MAA6B;IACzD,OAAO,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,WAAW,CAAC,MAAoB;IAC/C,OAAO,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC;AAuED,oEAAoE;AACpE,MAAM,UAAU,YAAY,CAAC,MAAoB;IAChD,OAAO,MAAM,CAAC;AACf,CAAC"}

package/dist/configure.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"configure.d.ts","sourceRoot":"","sources":["../src/configure.ts"],"names":[],"mappings":"AAEA,UAAU,QAAQ;IACjB,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,SAAS,CACR,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAC3B,OAAO,CAAC,IAAI,CAAC,CAAC;CACjB;AAED,wBAAsB,SAAS,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CA8CjE"}
+{"version":3,"file":"configure.d.ts","sourceRoot":"","sources":["../src/configure.ts"],"names":[],"mappings":"AAEA,UAAU,QAAQ;IACjB,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,SAAS,CACR,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAC3B,OAAO,CAAC,IAAI,CAAC,CAAC;CACjB;AAED,wBAAsB,SAAS,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAgDjE"}

package/dist/configure.js

@@ -6,21 +6,23 @@ export async function configure(codemods) {
         JWT_SECRET: jwtSecret,
         JWT_EXPIRY: "3600",
     });
-    await codemods.writeFile("config/auth.ts", `import { defineConfig } from '@c9up/warden'
+    await codemods.writeFile("config/auth.ts", `import { defineConfig, jwtGuard } from '@c9up/warden'
 
 export default defineConfig({
-  defaultStrategy: 'jwt',
-  jwt: {
-    secret: process.env.JWT_SECRET ?? '',
-    expiresInSeconds: Number(process.env.JWT_EXPIRY ?? '3600'),
-    // TODO: wire these to your user model (e.g. via your ORM).
-    // The JWT strategy needs both to issue and verify tokens.
-    findUser: async (_id) => {
-      throw new Error('TODO: implement findUser(id) for the JWT strategy in config/auth.ts')
-    },
-    verifyCredentials: async (_email, _password) => {
-      throw new Error('TODO: implement verifyCredentials(email, password) in config/auth.ts')
-    },
+  default: 'jwt',
+  guards: {
+    jwt: jwtGuard({
+      secret: process.env.JWT_SECRET ?? '',
+      expiresInSeconds: Number(process.env.JWT_EXPIRY ?? '3600'),
+      // TODO: wire these to your user model (e.g. via your ORM).
+      // The JWT guard needs both to issue and verify tokens.
+      findUser: async (_id) => {
+        throw new Error('TODO: implement findUser(id) for the JWT guard in config/auth.ts')
+      },
+      verifyCredentials: async (_email, _password) => {
+        throw new Error('TODO: implement verifyCredentials(email, password) in config/auth.ts')
+      },
+    }),
   },
 })
 `);

package/dist/configure.js.map

@@ -1 +1 @@
-{"version":3,"file":"configure.js","sourceRoot":"","sources":["../src/configure.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAY1C,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,QAAkB;IACjD,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,QAAQ,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC;IACpD,MAAM,QAAQ,CAAC,UAAU,CAAC;QACzB,UAAU,EAAE,SAAS;QACrB,UAAU,EAAE,MAAM;KAClB,CAAC,CAAC;IACH,MAAM,QAAQ,CAAC,SAAS,CACvB,gBAAgB,EAChB;;;;;;;;;;;;;;;;;CAiBD,CACC,CAAC;IACF,sEAAsE;IACtE,mEAAmE;IACnE,oEAAoE;IACpE,qEAAqE;IACrE,qEAAqE;IACrE,4DAA4D;IAC5D,iEAAiE;IACjE,OAAO,CAAC,MAAM,CAAC,KAAK,CACnB;QACC,EAAE;QACF,wDAAwD;QACxD,uDAAuD;QACvD,wEAAwE;QACxE,qEAAqE;QACrE,sDAAsD;QACtD,EAAE;KACF,CAAC,IAAI,CAAC,IAAI,CAAC,CACZ,CAAC;AACH,CAAC"}
+{"version":3,"file":"configure.js","sourceRoot":"","sources":["../src/configure.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAY1C,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,QAAkB;IACjD,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,QAAQ,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC;IACpD,MAAM,QAAQ,CAAC,UAAU,CAAC;QACzB,UAAU,EAAE,SAAS;QACrB,UAAU,EAAE,MAAM;KAClB,CAAC,CAAC;IACH,MAAM,QAAQ,CAAC,SAAS,CACvB,gBAAgB,EAChB;;;;;;;;;;;;;;;;;;;CAmBD,CACC,CAAC;IACF,sEAAsE;IACtE,mEAAmE;IACnE,oEAAoE;IACpE,qEAAqE;IACrE,qEAAqE;IACrE,4DAA4D;IAC5D,iEAAiE;IACjE,OAAO,CAAC,MAAM,CAAC,KAAK,CACnB;QACC,EAAE;QACF,wDAAwD;QACxD,uDAAuD;QACvD,wEAAwE;QACxE,qEAAqE;QACrE,sDAAsD;QACtD,EAAE;KACF,CAAC,IAAI,CAAC,IAAI,CAAC,CACZ,CAAC;AACH,CAAC"}

package/dist/errors.d.ts

@@ -15,4 +15,31 @@ export declare class WardenError extends Error {
         status?: number;
     });
 }
+/**
+ * `E_UNAUTHORIZED_ACCESS` — raised when an incoming request cannot be
+ * authenticated (AdonisJS `@adonisjs/auth` parity). Carries `guardDriverName`
+ * (the guard that rejected) and, for session-guard flows, an optional
+ * `redirectTo` (the login route an HTML client is redirected to). Status 401.
+ *
+ * Content negotiation (redirect for `Accept: text/html` + session guard, else
+ * 401 JSON) is performed by Warden itself — see `renderAuthError` in
+ * `middleware.ts` — so the package stays agnostic of the host's exception
+ * handler.
+ */
+export declare class E_UNAUTHORIZED_ACCESS extends WardenError {
+    readonly redirectTo?: string;
+    readonly guardDriverName: string;
+    constructor(message: string, options: {
+        guardDriverName: string;
+        redirectTo?: string;
+    });
+}
+/**
+ * `E_INVALID_CREDENTIALS` — raised when a credential check (email/password)
+ * fails (AdonisJS parity). Status 400. Distinct from `E_UNAUTHORIZED_ACCESS`
+ * (a missing/invalid session or token on a protected route → 401).
+ */
+export declare class E_INVALID_CREDENTIALS extends WardenError {
+    constructor(message?: string);
+}
 //# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,qBAAa,WAAY,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAGxB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;CAQ7C"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,qBAAa,WAAY,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAGxB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;CAc7C;AAED;;;;;;;;;;GAUG;AACH,qBAAa,qBAAsB,SAAQ,WAAW;IACrD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;gBAGhC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE;CAM1D;AAED;;;;GAIG;AACH,qBAAa,qBAAsB,SAAQ,WAAW;gBACzC,OAAO,SAA6B;CAGhD"}

package/dist/errors.js

@@ -13,9 +13,45 @@ export class WardenError extends Error {
     constructor(code, message, options) {
         super(message);
         this.name = "WardenError";
-        this.code = `WARDEN_${code}`;
+        // Warden's own codes carry the `WARDEN_` namespace. The AdonisJS auth
+        // identifiers (`E_UNAUTHORIZED_ACCESS`, `E_INVALID_CREDENTIALS`) are
+        // PRESERVED verbatim so the exposed `.code` matches Adonis exactly — a
+        // consumer branching on `error.code === 'E_UNAUTHORIZED_ACCESS'` (or a
+        // framework mapping the Adonis id) sees the same string it would under
+        // `@adonisjs/auth`. Documented deviation from the blanket prefix.
+        this.code = code.startsWith("E_") ? code : `WARDEN_${code}`;
         this.hint = options?.hint;
         this.status = options?.status;
     }
 }
+/**
+ * `E_UNAUTHORIZED_ACCESS` — raised when an incoming request cannot be
+ * authenticated (AdonisJS `@adonisjs/auth` parity). Carries `guardDriverName`
+ * (the guard that rejected) and, for session-guard flows, an optional
+ * `redirectTo` (the login route an HTML client is redirected to). Status 401.
+ *
+ * Content negotiation (redirect for `Accept: text/html` + session guard, else
+ * 401 JSON) is performed by Warden itself — see `renderAuthError` in
+ * `middleware.ts` — so the package stays agnostic of the host's exception
+ * handler.
+ */
+export class E_UNAUTHORIZED_ACCESS extends WardenError {
+    redirectTo;
+    guardDriverName;
+    constructor(message, options) {
+        super("E_UNAUTHORIZED_ACCESS", message, { status: 401 });
+        this.guardDriverName = options.guardDriverName;
+        this.redirectTo = options.redirectTo;
+    }
+}
+/**
+ * `E_INVALID_CREDENTIALS` — raised when a credential check (email/password)
+ * fails (AdonisJS parity). Status 400. Distinct from `E_UNAUTHORIZED_ACCESS`
+ * (a missing/invalid session or token on a protected route → 401).
+ */
+export class E_INVALID_CREDENTIALS extends WardenError {
+    constructor(message = "Invalid user credentials") {
+        super("E_INVALID_CREDENTIALS", message, { status: 400 });
+    }
+}
 //# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IAC5B,IAAI,CAAS;IACb,IAAI,CAAU;IACvB;;;;OAIG;IACM,MAAM,CAAU;IAEzB,YACC,IAAY,EACZ,OAAe,EACf,OAA4C;QAE5C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,UAAU,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,OAAO,EAAE,IAAI,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,MAAM,CAAC;IAC/B,CAAC;CACD"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IAC5B,IAAI,CAAS;IACb,IAAI,CAAU;IACvB;;;;OAIG;IACM,MAAM,CAAU;IAEzB,YACC,IAAY,EACZ,OAAe,EACf,OAA4C;QAE5C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,sEAAsE;QACtE,qEAAqE;QACrE,uEAAuE;QACvE,uEAAuE;QACvE,uEAAuE;QACvE,kEAAkE;QAClE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC;QAC5D,IAAI,CAAC,IAAI,GAAG,OAAO,EAAE,IAAI,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,MAAM,CAAC;IAC/B,CAAC;CACD;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,qBAAsB,SAAQ,WAAW;IAC5C,UAAU,CAAU;IACpB,eAAe,CAAS;IAEjC,YACC,OAAe,EACf,OAAyD;QAEzD,KAAK,CAAC,uBAAuB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;QAC/C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IACtC,CAAC;CACD;AAED;;;;GAIG;AACH,MAAM,OAAO,qBAAsB,SAAQ,WAAW;IACrD,YAAY,OAAO,GAAG,0BAA0B;QAC/C,KAAK,CAAC,uBAAuB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1D,CAAC;CACD"}