@c9up/warden 0.1.13 → 0.1.14

package/dist/index.d.ts

@@ -3,19 +3,23 @@
  * @description Warden — Authentication & authorization for the Ream framework
  * @implements FR48, FR49, FR50, FR51, FR52, FR53
  */
+export type { AuthAttempt, ExtractedCredentials } from "./Authenticator.js";
+export { API_KEY_GUARD_NAMES, Authenticator, extractCredentials, GuardAccessor, } from "./Authenticator.js";
 export type { AuthConfig, AuthResult, AuthStrategy, UserPayload, } from "./AuthManager.js";
 export { AuthManager } from "./AuthManager.js";
 export type { AuthRateLimiterConfig } from "./AuthRateLimiter.js";
 export { AuthRateLimiter } from "./AuthRateLimiter.js";
+export { AbilitiesBuilder } from "./bouncer/AbilitiesBuilder.js";
 export { AuthorizationResponse } from "./bouncer/AuthorizationResponse.js";
 export { BasePolicy } from "./bouncer/BasePolicy.js";
 export { Bouncer } from "./bouncer/Bouncer.js";
 export { action, allowGuest, getActionMetadata, } from "./bouncer/decorators.js";
 export type { PolicyAuthorizer } from "./bouncer/PolicyAuthorizer.js";
-export type { Ability, AbilityOptions, AuthorizerResponse, BouncerContext, } from "./bouncer/types.js";
-export { defineConfig } from "./config.js";
+export type { Ability, AbilityOptions, AuthorizerResponse, BouncerContext, BouncerEmitter, PolicyContainerResolver, } from "./bouncer/types.js";
+export type { GuardFactory, WardenConfig } from "./config.js";
+export { apiKeyGuard, defineConfig, jwtGuard, sessionGuard, } from "./config.js";
 export { configure } from "./configure.js";
-export { WardenError } from "./errors.js";
+export { E_INVALID_CREDENTIALS, E_UNAUTHORIZED_ACCESS, WardenError, } from "./errors.js";
 export { GitHubDriver } from "./firstcontact/drivers/GitHubDriver.js";
 export { GoogleDriver } from "./firstcontact/drivers/GoogleDriver.js";
 export { FirstContactManager } from "./firstcontact/FirstContactManager.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,YAAY,EACX,UAAU,EACV,UAAU,EACV,YAAY,EACZ,WAAW,GACX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,YAAY,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EACN,MAAM,EACN,UAAU,EACV,iBAAiB,GACjB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtE,YAAY,EACX,OAAO,EACP,cAAc,EACd,kBAAkB,EAClB,cAAc,GACd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,YAAY,EACX,kBAAkB,EAClB,WAAW,EACX,UAAU,EACV,SAAS,GACT,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACN,KAAK,EACL,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,EACf,UAAU,EACV,UAAU,EACV,IAAI,GACJ,MAAM,YAAY,CAAC;AACpB,YAAY,EACX,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,GACtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,YAAY,EACX,SAAS,EACT,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,gBAAgB,GAChB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACvE,YAAY,EACX,YAAY,EACZ,iBAAiB,EACjB,SAAS,EACT,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,eAAe,GACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAC5E,YAAY,EACX,aAAa,EACb,UAAU,EACV,cAAc,GACd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,YAAY,EACX,yBAAyB,EACzB,0BAA0B,EAC1B,uBAAuB,EACvB,wBAAwB,EACxB,aAAa,EACb,sBAAsB,EACtB,cAAc,EACd,uBAAuB,EACvB,YAAY,GACZ,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACN,4BAA4B,EAC5B,6BAA6B,EAC7B,gBAAgB,GAChB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACX,oBAAoB,EACpB,eAAe,GACf,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,YAAY,EACX,kBAAkB,EAClB,kBAAkB,GAClB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACN,oBAAoB,EACpB,wBAAwB,GACxB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACX,qBAAqB,EACrB,wBAAwB,GACxB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,YAAY,EACX,oBAAoB,EACpB,WAAW,EACX,KAAK,GACL,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,YAAY,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,YAAY,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC7E,YAAY,EACX,YAAY,EACZ,qBAAqB,GACrB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,YAAY,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EACN,mBAAmB,EACnB,aAAa,EACb,kBAAkB,EAClB,aAAa,GACb,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACX,UAAU,EACV,UAAU,EACV,YAAY,EACZ,WAAW,GACX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,YAAY,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EACN,MAAM,EACN,UAAU,EACV,iBAAiB,GACjB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtE,YAAY,EACX,OAAO,EACP,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,uBAAuB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EACN,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,YAAY,GACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EACN,qBAAqB,EACrB,qBAAqB,EACrB,WAAW,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,YAAY,EACX,kBAAkB,EAClB,WAAW,EACX,UAAU,EACV,SAAS,GACT,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACN,KAAK,EACL,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,EACf,UAAU,EACV,UAAU,EACV,IAAI,GACJ,MAAM,YAAY,CAAC;AACpB,YAAY,EACX,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,GACtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,YAAY,EACX,SAAS,EACT,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,gBAAgB,GAChB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACvE,YAAY,EACX,YAAY,EACZ,iBAAiB,EACjB,SAAS,EACT,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,eAAe,GACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAC5E,YAAY,EACX,aAAa,EACb,UAAU,EACV,cAAc,GACd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,YAAY,EACX,yBAAyB,EACzB,0BAA0B,EAC1B,uBAAuB,EACvB,wBAAwB,EACxB,aAAa,EACb,sBAAsB,EACtB,cAAc,EACd,uBAAuB,EACvB,YAAY,GACZ,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACN,4BAA4B,EAC5B,6BAA6B,EAC7B,gBAAgB,GAChB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACX,oBAAoB,EACpB,eAAe,GACf,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,YAAY,EACX,kBAAkB,EAClB,kBAAkB,GAClB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACN,oBAAoB,EACpB,wBAAwB,GACxB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACX,qBAAqB,EACrB,wBAAwB,GACxB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,YAAY,EACX,oBAAoB,EACpB,WAAW,EACX,KAAK,GACL,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,YAAY,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,YAAY,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC7E,YAAY,EACX,YAAY,EACZ,qBAAqB,GACrB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/index.js

@@ -3,15 +3,17 @@
  * @description Warden — Authentication & authorization for the Ream framework
  * @implements FR48, FR49, FR50, FR51, FR52, FR53
  */
+export { API_KEY_GUARD_NAMES, Authenticator, extractCredentials, GuardAccessor, } from "./Authenticator.js";
 export { AuthManager } from "./AuthManager.js";
 export { AuthRateLimiter } from "./AuthRateLimiter.js";
+export { AbilitiesBuilder } from "./bouncer/AbilitiesBuilder.js";
 export { AuthorizationResponse } from "./bouncer/AuthorizationResponse.js";
 export { BasePolicy } from "./bouncer/BasePolicy.js";
 export { Bouncer } from "./bouncer/Bouncer.js";
 export { action, allowGuest, getActionMetadata, } from "./bouncer/decorators.js";
-export { defineConfig } from "./config.js";
+export { apiKeyGuard, defineConfig, jwtGuard, sessionGuard, } from "./config.js";
 export { configure } from "./configure.js";
-export { WardenError } from "./errors.js";
+export { E_INVALID_CREDENTIALS, E_UNAUTHORIZED_ACCESS, WardenError, } from "./errors.js";
 export { GitHubDriver } from "./firstcontact/drivers/GitHubDriver.js";
 export { GoogleDriver } from "./firstcontact/drivers/GoogleDriver.js";
 export { FirstContactManager } from "./firstcontact/FirstContactManager.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EACN,MAAM,EACN,UAAU,EACV,iBAAiB,GACjB,MAAM,yBAAyB,CAAC;AAQjC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAO5E,OAAO,EACN,KAAK,EACL,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,EACf,UAAU,EACV,UAAU,EACV,IAAI,GACJ,MAAM,YAAY,CAAC;AAMpB,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAQnE,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAUvE,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAM5E,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAYrD,OAAO,EACN,4BAA4B,EAC5B,6BAA6B,EAC7B,gBAAgB,GAChB,MAAM,2BAA2B,CAAC;AAKnC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAKjE,OAAO,EACN,oBAAoB,EACpB,wBAAwB,GACxB,MAAM,wBAAwB,CAAC;AAKhC,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAM5D,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAEhE,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAK7E,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAElE,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACN,mBAAmB,EACnB,aAAa,EACb,kBAAkB,EAClB,aAAa,GACb,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EACN,MAAM,EACN,UAAU,EACV,iBAAiB,GACjB,MAAM,yBAAyB,CAAC;AAWjC,OAAO,EACN,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,YAAY,GACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EACN,qBAAqB,EACrB,qBAAqB,EACrB,WAAW,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAO5E,OAAO,EACN,KAAK,EACL,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,EACf,UAAU,EACV,UAAU,EACV,IAAI,GACJ,MAAM,YAAY,CAAC;AAMpB,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAQnE,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAUvE,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAM5E,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAYrD,OAAO,EACN,4BAA4B,EAC5B,6BAA6B,EAC7B,gBAAgB,GAChB,MAAM,2BAA2B,CAAC;AAKnC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAKjE,OAAO,EACN,oBAAoB,EACpB,wBAAwB,GACxB,MAAM,wBAAwB,CAAC;AAKhC,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAM5D,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAEhE,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAK7E,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAElE,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/mfa/OtpProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OtpProvider.d.ts","sourceRoot":"","sources":["../../src/mfa/OtpProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAUH,gFAAgF;AAChF,MAAM,WAAW,kBAAkB;IAClC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrD;AAED,0CAA0C;AAC1C,MAAM,WAAW,YAAY;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CACjB;AAED,sCAAsC;AACtC,MAAM,WAAW,iBAAiB;IACjC,IAAI,CAAC,SAAS,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAC/C,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClC;AAED,qBAAa,uBAAwB,YAAW,iBAAiB;;IAE1D,IAAI,CAAC,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAGpC,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAG9C,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGvC;AAED,MAAM,WAAW,SAAS;IACzB,OAAO,EAAE,kBAAkB,CAAC;IAC5B,wDAAwD;IACxD,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B,iDAAiD;IACjD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,gBAAgB,GACzB,WAAW,GACX,SAAS,GACT,mBAAmB,GACnB,UAAU,CAAC;AAEd,MAAM,WAAW,eAAe;IAC/B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,gBAAgB,CAAC;CAC1B;AAED,qBAAa,WAAW;;IACvB,QAAQ,CAAC,IAAI,EAAG,KAAK,CAAU;gBAOnB,MAAM,EAAE,SAAS;IAc7B,yEAAyE;IACnE,KAAK,CACV,SAAS,EAAE,MAAM,EACjB,KAAK,GAAE,MAAmB,GACxB,OAAO,CAAC,cAAc,CAAC;IAe1B;;;OAGG;IACG,MAAM,CACX,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,EACZ,KAAK,GAAE,MAAmB,GACxB,OAAO,CAAC,eAAe,CAAC;CA0B3B"}
+{"version":3,"file":"OtpProvider.d.ts","sourceRoot":"","sources":["../../src/mfa/OtpProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAUH,gFAAgF;AAChF,MAAM,WAAW,kBAAkB;IAClC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrD;AAED,0CAA0C;AAC1C,MAAM,WAAW,YAAY;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CACjB;AAED,sCAAsC;AACtC,MAAM,WAAW,iBAAiB;IACjC,IAAI,CAAC,SAAS,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAC/C,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClC;AAED,qBAAa,uBAAwB,YAAW,iBAAiB;;IAE1D,IAAI,CAAC,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAGpC,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAG9C,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGvC;AAED,MAAM,WAAW,SAAS;IACzB,OAAO,EAAE,kBAAkB,CAAC;IAC5B,wDAAwD;IACxD,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B,iDAAiD;IACjD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,gBAAgB,GACzB,WAAW,GACX,SAAS,GACT,mBAAmB,GACnB,UAAU,CAAC;AAEd,MAAM,WAAW,eAAe;IAC/B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,gBAAgB,CAAC;CAC1B;AAED,qBAAa,WAAW;;IACvB,QAAQ,CAAC,IAAI,EAAG,KAAK,CAAU;gBAOnB,MAAM,EAAE,SAAS;IA0C7B,yEAAyE;IACnE,KAAK,CACV,SAAS,EAAE,MAAM,EACjB,KAAK,GAAE,MAAmB,GACxB,OAAO,CAAC,cAAc,CAAC;IAe1B;;;OAGG;IACG,MAAM,CACX,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,EACZ,KAAK,GAAE,MAAmB,GACxB,OAAO,CAAC,eAAe,CAAC;CA0B3B"}

package/dist/mfa/OtpProvider.js

@@ -34,9 +34,27 @@ export class OtpProvider {
         }
         this.#channel = config.channel;
         this.#store = config.store ?? new MemoryOtpChallengeStore();
-        this.#digits = config.digits ?? 6;
-        this.#ttlMs = (config.ttlSeconds ?? 300) * 1000;
-        this.#maxAttempts = config.maxAttempts ?? 5;
+        // Validate the numeric config up-front (mirrors TotpProvider's digit
+        // guard) so a misconfig fails loudly at construction instead of minting
+        // unusable codes: `digits` bounds the code length (also keeps `10**digits`
+        // within `randomInt`'s safe range); a non-positive `ttlSeconds` would make
+        // every code born-expired; a non-positive `maxAttempts` would burn the
+        // challenge on the first guess.
+        const digits = config.digits ?? 6;
+        if (!Number.isInteger(digits) || digits < 4 || digits > 10) {
+            throw new WardenError("INVALID_CONFIG", `OTP digits must be an integer 4-10, got ${digits}`);
+        }
+        const ttlSeconds = config.ttlSeconds ?? 300;
+        if (!Number.isInteger(ttlSeconds) || ttlSeconds < 1) {
+            throw new WardenError("INVALID_CONFIG", `OTP ttlSeconds must be a positive integer, got ${ttlSeconds}`);
+        }
+        const maxAttempts = config.maxAttempts ?? 5;
+        if (!Number.isInteger(maxAttempts) || maxAttempts < 1) {
+            throw new WardenError("INVALID_CONFIG", `OTP maxAttempts must be a positive integer, got ${maxAttempts}`);
+        }
+        this.#digits = digits;
+        this.#ttlMs = ttlSeconds * 1000;
+        this.#maxAttempts = maxAttempts;
     }
     /** Mint a code, persist the challenge, and deliver it to `recipient`. */
     async start(recipient, nowMs = Date.now()) {

package/dist/mfa/OtpProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"OtpProvider.js","sourceRoot":"","sources":["../../src/mfa/OtpProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACN,UAAU,EACV,WAAW,EACX,SAAS,EACT,eAAe,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAwB3C,MAAM,OAAO,uBAAuB;IACnC,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;IACzC,KAAK,CAAC,IAAI,CAAC,CAAe;QACzB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAU;QACpB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;IACpC,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,EAAU;QACtB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACxB,CAAC;CACD;AA8BD,MAAM,OAAO,WAAW;IACd,IAAI,GAAG,KAAc,CAAC;IACtB,QAAQ,CAAqB;IAC7B,MAAM,CAAoB;IAC1B,OAAO,CAAS;IAChB,MAAM,CAAS;IACf,YAAY,CAAS;IAE9B,YAAY,MAAiB;QAC5B,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YACtB,MAAM,IAAI,WAAW,CACpB,gBAAgB,EAChB,qDAAqD,CACrD,CAAC;QACH,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,IAAI,IAAI,uBAAuB,EAAE,CAAC;QAC5D,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC;QAChD,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC;IAC7C,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,KAAK,CACV,SAAiB,EACjB,QAAgB,IAAI,CAAC,GAAG,EAAE;QAE1B,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAChC,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC;QACtC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACtB,EAAE;YACF,SAAS;YACT,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC;YACtB,SAAS;YACT,QAAQ,EAAE,CAAC;SACX,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC1C,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;IACvC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CACX,WAAmB,EACnB,IAAY,EACZ,QAAgB,IAAI,CAAC,GAAG,EAAE;QAE1B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACtD,IAAI,CAAC,SAAS,EAAE,CAAC;YAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAC3C,CAAC;QACD,IAAI,KAAK,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACzC,CAAC;QACD,IAAI,aAAa,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACtC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACrB,CAAC;QACD,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,GAAG,CAAC,CAAC;QACxC,IAAI,QAAQ,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QACnD,CAAC;QACD,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC1C,CAAC;IAED,WAAW;QACV,MAAM,GAAG,GAAG,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC;QAC/B,OAAO,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACjE,CAAC;CACD;AAED,SAAS,UAAU,CAAC,IAAY;IAC/B,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IACvE,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,aAAa,CAAC,MAAc,EAAE,SAAiB;IACvD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;QAChB,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC;IAC5E,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAC1C,CAAC"}
+{"version":3,"file":"OtpProvider.js","sourceRoot":"","sources":["../../src/mfa/OtpProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACN,UAAU,EACV,WAAW,EACX,SAAS,EACT,eAAe,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAwB3C,MAAM,OAAO,uBAAuB;IACnC,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;IACzC,KAAK,CAAC,IAAI,CAAC,CAAe;QACzB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAU;QACpB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;IACpC,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,EAAU;QACtB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACxB,CAAC;CACD;AA8BD,MAAM,OAAO,WAAW;IACd,IAAI,GAAG,KAAc,CAAC;IACtB,QAAQ,CAAqB;IAC7B,MAAM,CAAoB;IAC1B,OAAO,CAAS;IAChB,MAAM,CAAS;IACf,YAAY,CAAS;IAE9B,YAAY,MAAiB;QAC5B,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YACtB,MAAM,IAAI,WAAW,CACpB,gBAAgB,EAChB,qDAAqD,CACrD,CAAC;QACH,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,IAAI,IAAI,uBAAuB,EAAE,CAAC;QAE5D,qEAAqE;QACrE,wEAAwE;QACxE,2EAA2E;QAC3E,2EAA2E;QAC3E,uEAAuE;QACvE,gCAAgC;QAChC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,EAAE,EAAE,CAAC;YAC5D,MAAM,IAAI,WAAW,CACpB,gBAAgB,EAChB,2CAA2C,MAAM,EAAE,CACnD,CAAC;QACH,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,GAAG,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,WAAW,CACpB,gBAAgB,EAChB,kDAAkD,UAAU,EAAE,CAC9D,CAAC;QACH,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,WAAW,CACpB,gBAAgB,EAChB,mDAAmD,WAAW,EAAE,CAChE,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,MAAM,GAAG,UAAU,GAAG,IAAI,CAAC;QAChC,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;IACjC,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,KAAK,CACV,SAAiB,EACjB,QAAgB,IAAI,CAAC,GAAG,EAAE;QAE1B,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAChC,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC;QACtC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACtB,EAAE;YACF,SAAS;YACT,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC;YACtB,SAAS;YACT,QAAQ,EAAE,CAAC;SACX,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC1C,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;IACvC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CACX,WAAmB,EACnB,IAAY,EACZ,QAAgB,IAAI,CAAC,GAAG,EAAE;QAE1B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACtD,IAAI,CAAC,SAAS,EAAE,CAAC;YAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAC3C,CAAC;QACD,IAAI,KAAK,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACzC,CAAC;QACD,IAAI,aAAa,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACtC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACrB,CAAC;QACD,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,GAAG,CAAC,CAAC;QACxC,IAAI,QAAQ,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QACnD,CAAC;QACD,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC1C,CAAC;IAED,WAAW;QACV,MAAM,GAAG,GAAG,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC;QAC/B,OAAO,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACjE,CAAC;CACD;AAED,SAAS,UAAU,CAAC,IAAY;IAC/B,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IACvE,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,aAAa,CAAC,MAAc,EAAE,SAAiB;IACvD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;QAChB,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC;IAC5E,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAC1C,CAAC"}

package/dist/mfa/WebauthnProvider.d.ts

@@ -76,10 +76,21 @@ export interface AuthenticationOptionsJSON {
         transports?: string[];
     }>;
 }
-/** Transient per-ceremony challenge storage. */
+/**
+ * Transient per-ceremony challenge storage.
+ *
+ * Implementations MUST be **time-bound**: a challenge that is never consumed has
+ * to expire server-side (single-use alone is not enough — an unconsumed
+ * challenge left live indefinitely widens the replay/relay window). A DB/Redis
+ * store should use a TTL column / `EXPIRE`; the in-memory default stamps an
+ * `expiresAt` and refuses an expired challenge in `take`.
+ */
 export interface WebauthnChallengeStore {
     save(state: string, challenge: string): Promise<void>;
-    /** Return the challenge for `state` and remove it (single-use). */
+    /**
+     * Return the challenge for `state` and remove it (single-use). MUST return
+     * `null` if the stored challenge has passed its TTL.
+     */
     take(state: string): Promise<string | null>;
 }
 /** A registered passkey, persisted between ceremonies. */
@@ -102,6 +113,8 @@ export interface WebauthnCredentialStore {
 }
 export declare class MemoryWebauthnChallengeStore implements WebauthnChallengeStore {
     #private;
+    /** @param ttlMs Server-side challenge lifetime. Default 5 min. */
+    constructor(ttlMs?: number);
     save(state: string, challenge: string): Promise<void>;
     take(state: string): Promise<string | null>;
 }
@@ -112,6 +125,8 @@ export declare class MemoryWebauthnCredentialStore implements WebauthnCredential
     findByUser(userId: string): Promise<StoredPasskey[]>;
     updateCounter(id: string, counter: number): Promise<void>;
 }
+/** WebAuthn user-verification requirement (PIN / biometric). */
+export type UserVerificationRequirement = "required" | "preferred" | "discouraged";
 export interface WebauthnConfig {
     /** Human-readable relying-party name (your app). */
     rpName: string;
@@ -128,6 +143,13 @@ export interface WebauthnConfig {
      * Default ES256, RS256, EdDSA.
      */
     supportedAlgorithms?: number[];
+    /**
+     * User-verification requirement. Default `"preferred"`. Set `"required"`
+     * for strong MFA / sensitive passkeys — the ceremony then requests UV AND
+     * the server rejects an assertion whose authenticator-data UV flag is unset
+     * (a mere user-presence touch no longer satisfies the check).
+     */
+    userVerification?: UserVerificationRequirement;
 }
 export interface WebauthnUser {
     id: string;

package/dist/mfa/WebauthnProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"WebauthnProvider.d.ts","sourceRoot":"","sources":["../../src/mfa/WebauthnProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAeH,sEAAsE;AACtE,MAAM,WAAW,wBAAwB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,YAAY,CAAC;IACnB,QAAQ,EAAE;QACT,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;KACtB,CAAC;CACF;AAED,mEAAmE;AACnE,MAAM,WAAW,0BAA0B;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,YAAY,CAAC;IACnB,QAAQ,EAAE;QACT,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;CACF;AAED,MAAM,WAAW,uBAAuB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACjC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD,gBAAgB,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,YAAY,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7D,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,KAAK,CAAC;QACzB,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,YAAY,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;KACtB,CAAC,CAAC;IACH,sBAAsB,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1E;AAED,MAAM,WAAW,yBAAyB;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,KAAK,CAAC;QACxB,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,YAAY,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;KACtB,CAAC,CAAC;CACH;AAED,gDAAgD;AAChD,MAAM,WAAW,sBAAsB;IACtC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,mEAAmE;IACnE,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC5C;AAED,0DAA0D;AAC1D,MAAM,WAAW,aAAa;IAC7B,+BAA+B;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,SAAS,EAAE,MAAM,CAAC;IAClB,6CAA6C;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,uBAAuB;IACvC,IAAI,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IACpD,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IACrD,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1D;AAED,qBAAa,4BAA6B,YAAW,sBAAsB;;IAEpE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAGrD,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAKjD;AAED,qBAAa,6BAA8B,YAAW,uBAAuB;;IAEtE,IAAI,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAG3C,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAGnD,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAGpD,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAM/D;AAED,MAAM,WAAW,cAAc;IAC9B,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,qEAAqE;IACrE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC1B,cAAc,CAAC,EAAE,sBAAsB,CAAC;IACxC,eAAe,CAAC,EAAE,uBAAuB,CAAC;IAC1C,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,YAAY;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAID,qBAAa,gBAAgB;;IAC5B,QAAQ,CAAC,IAAI,EAAG,UAAU,CAAU;gBASxB,MAAM,EAAE,cAAc;IAoBlC;;;;OAIG;IACG,iBAAiB,CACtB,IAAI,EAAE,YAAY,GAChB,OAAO,CAAC;QAAE,OAAO,EAAE,uBAAuB,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAgC/D;;;OAGG;IACG,kBAAkB,CACvB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,wBAAwB,GAChC,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC;IA+CjC;;;OAGG;IACG,mBAAmB,CACxB,MAAM,CAAC,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,OAAO,EAAE,yBAAyB,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAqBjE;;;;OAIG;IACG,oBAAoB,CACzB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,0BAA0B,GAClC,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAiFlD"}
+{"version":3,"file":"WebauthnProvider.d.ts","sourceRoot":"","sources":["../../src/mfa/WebauthnProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAeH,sEAAsE;AACtE,MAAM,WAAW,wBAAwB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,YAAY,CAAC;IACnB,QAAQ,EAAE;QACT,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;KACtB,CAAC;CACF;AAED,mEAAmE;AACnE,MAAM,WAAW,0BAA0B;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,YAAY,CAAC;IACnB,QAAQ,EAAE;QACT,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;CACF;AAED,MAAM,WAAW,uBAAuB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACjC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD,gBAAgB,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,YAAY,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7D,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,KAAK,CAAC;QACzB,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,YAAY,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;KACtB,CAAC,CAAC;IACH,sBAAsB,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1E;AAED,MAAM,WAAW,yBAAyB;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,KAAK,CAAC;QACxB,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,YAAY,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;KACtB,CAAC,CAAC;CACH;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,sBAAsB;IACtC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD;;;OAGG;IACH,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC5C;AAED,0DAA0D;AAC1D,MAAM,WAAW,aAAa;IAC7B,+BAA+B;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,SAAS,EAAE,MAAM,CAAC;IAClB,6CAA6C;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,uBAAuB;IACvC,IAAI,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IACpD,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IACrD,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1D;AAED,qBAAa,4BAA6B,YAAW,sBAAsB;;IAI1E,kEAAkE;gBACtD,KAAK,SAAU;IAIrB,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAGrD,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAQjD;AAED,qBAAa,6BAA8B,YAAW,uBAAuB;;IAEtE,IAAI,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAG3C,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAGnD,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAGpD,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAM/D;AAED,gEAAgE;AAChE,MAAM,MAAM,2BAA2B,GACpC,UAAU,GACV,WAAW,GACX,aAAa,CAAC;AAEjB,MAAM,WAAW,cAAc;IAC9B,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,qEAAqE;IACrE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC1B,cAAc,CAAC,EAAE,sBAAsB,CAAC;IACxC,eAAe,CAAC,EAAE,uBAAuB,CAAC;IAC1C,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,2BAA2B,CAAC;CAC/C;AAED,MAAM,WAAW,YAAY;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAID,qBAAa,gBAAgB;;IAC5B,QAAQ,CAAC,IAAI,EAAG,UAAU,CAAU;gBAUxB,MAAM,EAAE,cAAc;IAqBlC;;;;OAIG;IACG,iBAAiB,CACtB,IAAI,EAAE,YAAY,GAChB,OAAO,CAAC;QAAE,OAAO,EAAE,uBAAuB,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAgC/D;;;OAGG;IACG,kBAAkB,CACvB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,wBAAwB,GAChC,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC;IA+CjC;;;OAGG;IACG,mBAAmB,CACxB,MAAM,CAAC,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,OAAO,EAAE,yBAAyB,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAqBjE;;;;OAIG;IACG,oBAAoB,CACzB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,0BAA0B,GAClC,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CA2FlD"}

package/dist/mfa/WebauthnProvider.js

@@ -20,13 +20,21 @@ import { WardenError } from "../errors.js";
 import { base64urlToBuffer, bufferToBase64url, coseToKeyObject, decodeCbor, parseAuthenticatorData, sha256, verifyWebauthnSignature, } from "./webauthn-codec.js";
 export class MemoryWebauthnChallengeStore {
     #store = new Map();
+    #ttlMs;
+    /** @param ttlMs Server-side challenge lifetime. Default 5 min. */
+    constructor(ttlMs = 300_000) {
+        this.#ttlMs = ttlMs;
+    }
     async save(state, challenge) {
-        this.#store.set(state, challenge);
+        this.#store.set(state, { challenge, expiresAt: Date.now() + this.#ttlMs });
     }
     async take(state) {
-        const c = this.#store.get(state) ?? null;
-        this.#store.delete(state);
-        return c;
+        const entry = this.#store.get(state);
+        this.#store.delete(state); // single-use regardless of freshness
+        if (!entry || entry.expiresAt < Date.now()) {
+            return null;
+        }
+        return entry.challenge;
     }
 }
 export class MemoryWebauthnCredentialStore {
@@ -55,6 +63,7 @@ export class WebauthnProvider {
     #origins;
     #timeout;
     #algorithms;
+    #userVerification;
     #challenges;
     #credentials;
     constructor(config) {
@@ -68,6 +77,7 @@ export class WebauthnProvider {
             : [config.origin];
         this.#timeout = config.timeout ?? 60_000;
         this.#algorithms = config.supportedAlgorithms ?? DEFAULT_ALGS;
+        this.#userVerification = config.userVerification ?? "preferred";
         this.#challenges =
             config.challengeStore ?? new MemoryWebauthnChallengeStore();
         this.#credentials =
@@ -102,7 +112,7 @@ export class WebauthnProvider {
             })),
             authenticatorSelection: {
                 residentKey: "preferred",
-                userVerification: "preferred",
+                userVerification: this.#userVerification,
             },
         };
         const state = randomBytes(16).toString("hex");
@@ -158,7 +168,7 @@ export class WebauthnProvider {
             challenge,
             timeout: this.#timeout,
             rpId: this.#rpID,
-            userVerification: "preferred",
+            userVerification: this.#userVerification,
             allowCredentials: userId
                 ? allow.map((c) => ({
                     id: c.id,
@@ -223,10 +233,20 @@ export class WebauthnProvider {
             typeof parsed.origin === "string" &&
             this.#origins.includes(parsed.origin));
     }
-    /** Validate authenticator data: rpIdHash match and user-presence flag. */
+    /**
+     * Validate authenticator data: rpIdHash match, mandatory user-presence, and
+     * — when `userVerification: "required"` is configured — the user-verification
+     * flag (PIN / biometric actually performed, not just a presence touch).
+     */
     #validAuthenticator(authData) {
         const expectedRpIdHash = sha256(Buffer.from(this.#rpID, "utf8"));
-        return authData.flags.up && expectedRpIdHash.equals(authData.rpIdHash);
+        if (!authData.flags.up || !expectedRpIdHash.equals(authData.rpIdHash)) {
+            return false;
+        }
+        if (this.#userVerification === "required" && !authData.flags.uv) {
+            return false;
+        }
+        return true;
     }
 }
 function expectCoseMap(bytes) {

package/dist/mfa/WebauthnProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"WebauthnProvider.js","sourceRoot":"","sources":["../../src/mfa/WebauthnProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EACN,iBAAiB,EACjB,iBAAiB,EAEjB,eAAe,EACf,UAAU,EACV,sBAAsB,EACtB,MAAM,EACN,uBAAuB,GACvB,MAAM,qBAAqB,CAAC;AAiF7B,MAAM,OAAO,4BAA4B;IACxC,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACnC,KAAK,CAAC,IAAI,CAAC,KAAa,EAAE,SAAiB;QAC1C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACnC,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,KAAa;QACvB,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,OAAO,CAAC,CAAC;IACV,CAAC;CACD;AAED,MAAM,OAAO,6BAA6B;IACzC,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC1C,KAAK,CAAC,IAAI,CAAC,OAAsB;QAChC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;IACD,KAAK,CAAC,QAAQ,CAAC,EAAU;QACxB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;IACpC,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,MAAc;QAC9B,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IACrE,CAAC;IACD,KAAK,CAAC,aAAa,CAAC,EAAU,EAAE,OAAe;QAC9C,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,EAAE,CAAC;YACP,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACxC,CAAC;IACF,CAAC;CACD;AA0BD,MAAM,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;AAEpC,MAAM,OAAO,gBAAgB;IACnB,IAAI,GAAG,UAAmB,CAAC;IAC3B,OAAO,CAAS;IAChB,KAAK,CAAS;IACd,QAAQ,CAAW;IACnB,QAAQ,CAAS;IACjB,WAAW,CAAW;IACtB,WAAW,CAAyB;IACpC,YAAY,CAA0B;IAE/C,YAAY,MAAsB;QACjC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;YACzD,MAAM,IAAI,WAAW,CACpB,gBAAgB,EAChB,mDAAmD,CACnD,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;YAC3C,CAAC,CAAC,MAAM,CAAC,MAAM;YACf,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnB,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC;QACzC,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,mBAAmB,IAAI,YAAY,CAAC;QAC9D,IAAI,CAAC,WAAW;YACf,MAAM,CAAC,cAAc,IAAI,IAAI,4BAA4B,EAAE,CAAC;QAC7D,IAAI,CAAC,YAAY;YAChB,MAAM,CAAC,eAAe,IAAI,IAAI,6BAA6B,EAAE,CAAC;IAChE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,iBAAiB,CACtB,IAAkB;QAElB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7D,MAAM,SAAS,GAAG,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;QACrD,MAAM,OAAO,GAA4B;YACxC,SAAS;YACT,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE;YAC1C,IAAI,EAAE;gBACL,EAAE,EAAE,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;gBACnD,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,IAAI;aAC1C;YACD,gBAAgB,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAChD,IAAI,EAAE,YAAY;gBAClB,GAAG;aACH,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,WAAW,EAAE,MAAM;YACnB,kBAAkB,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACxC,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,IAAI,EAAE,YAAY;gBAClB,UAAU,EAAE,CAAC,CAAC,UAAU;aACxB,CAAC,CAAC;YACH,sBAAsB,EAAE;gBACvB,WAAW,EAAE,WAAW;gBACxB,gBAAgB,EAAE,WAAW;aAC7B;SACD,CAAC;QACF,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC9C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,kBAAkB,CACvB,KAAa,EACb,MAAc,EACd,QAAkC;QAElC,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7D,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACxB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QACD,IACC,CAAC,IAAI,CAAC,gBAAgB,CACrB,QAAQ,CAAC,QAAQ,CAAC,cAAc,EAChC,iBAAiB,EACjB,iBAAiB,CACjB,EACA,CAAC;YACF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QAED,MAAM,WAAW,GAAG,UAAU,CAC7B,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CACtD,CAAC,KAAK,CAAC;QACR,IAAI,CAAC,CAAC,WAAW,YAAY,GAAG,CAAC,EAAE,CAAC;YACnC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QACD,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACnC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QACD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,WAAW,CAAC,CAAC;QACrD,IACC,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC;YACnC,CAAC,QAAQ,CAAC,aAAa;YACvB,CAAC,QAAQ,CAAC,kBAAkB;YAC5B,CAAC,QAAQ,CAAC,YAAY,EACrB,CAAC;YACF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QAED,MAAM,EAAE,GAAG,EAAE,GAAG,eAAe,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QACxD,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;YAC5B,EAAE,EAAE,iBAAiB,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC5C,MAAM;YACN,SAAS,EAAE,iBAAiB,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YACzD,GAAG;YACH,OAAO,EAAE,QAAQ,CAAC,SAAS;YAC3B,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,UAAU;SACxC,CAAC,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,mBAAmB,CACxB,MAAe;QAEf,MAAM,SAAS,GAAG,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,MAAM,OAAO,GAA8B;YAC1C,SAAS;YACT,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,gBAAgB,EAAE,WAAW;YAC7B,gBAAgB,EAAE,MAAM;gBACvB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAClB,EAAE,EAAE,CAAC,CAAC,EAAE;oBACR,IAAI,EAAE,YAAY;oBAClB,UAAU,EAAE,CAAC,CAAC,UAAU;iBACxB,CAAC,CAAC;gBACJ,CAAC,CAAC,SAAS;SACZ,CAAC;QACF,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC9C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,oBAAoB,CACzB,KAAa,EACb,QAAoC;QAEpC,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7D,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACxB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QACD,IACC,CAAC,IAAI,CAAC,gBAAgB,CACrB,QAAQ,CAAC,QAAQ,CAAC,cAAc,EAChC,cAAc,EACd,iBAAiB,CACjB,EACA,CAAC;YACF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QAED,MAAM,WAAW,GAAG,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,sBAAsB,CAAC,WAAW,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QAED,gEAAgE;QAChE,MAAM,UAAU,GAAG,MAAM,CACxB,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,CACnD,CAAC;QACF,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;QAC5D,MAAM,EAAE,GAAG,EAAE,GAAG,eAAe,CAC9B,aAAa,CAAC,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAClD,CAAC;QACF,MAAM,EAAE,GAAG,uBAAuB,CACjC,MAAM,CAAC,GAAG,EACV,GAAG,EACH,UAAU,EACV,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAC9C,CAAC;QACF,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QAED,yEAAyE;QACzE,iEAAiE;QACjE,IAAI,QAAQ,CAAC,SAAS,KAAK,CAAC,IAAI,QAAQ,CAAC,SAAS,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACtE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QACD,MAAM,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;QACrE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAClD,CAAC;IAED,6EAA6E;IAC7E,gBAAgB,CACf,aAAqB,EACrB,YAAgD,EAChD,iBAAyB;QAEzB,IAAI,MAA8D,CAAC;QACnE,IAAI,CAAC;YACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,KAAK,CAAC;QACd,CAAC;QACD,OAAO,CACN,MAAM,CAAC,IAAI,KAAK,YAAY;YAC5B,MAAM,CAAC,SAAS,KAAK,iBAAiB;YACtC,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;YACjC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CACrC,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,mBAAmB,CAAC,QAGnB;QACA,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;QACjE,OAAO,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACxE,CAAC;CACD;AAED,SAAS,aAAa,CAAC,KAAa;IACnC,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC;IACxC,IAAI,CAAC,CAAC,OAAO,YAAY,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,8BAA8B,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC"}
+{"version":3,"file":"WebauthnProvider.js","sourceRoot":"","sources":["../../src/mfa/WebauthnProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EACN,iBAAiB,EACjB,iBAAiB,EAEjB,eAAe,EACf,UAAU,EACV,sBAAsB,EACtB,MAAM,EACN,uBAAuB,GACvB,MAAM,qBAAqB,CAAC;AA4F7B,MAAM,OAAO,4BAA4B;IACxC,MAAM,GAAG,IAAI,GAAG,EAAoD,CAAC;IAC5D,MAAM,CAAS;IAExB,kEAAkE;IAClE,YAAY,KAAK,GAAG,OAAO;QAC1B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAa,EAAE,SAAiB;QAC1C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,KAAa;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,qCAAqC;QAChE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC;QACb,CAAC;QACD,OAAO,KAAK,CAAC,SAAS,CAAC;IACxB,CAAC;CACD;AAED,MAAM,OAAO,6BAA6B;IACzC,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC1C,KAAK,CAAC,IAAI,CAAC,OAAsB;QAChC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;IACD,KAAK,CAAC,QAAQ,CAAC,EAAU;QACxB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;IACpC,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,MAAc;QAC9B,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IACrE,CAAC;IACD,KAAK,CAAC,aAAa,CAAC,EAAU,EAAE,OAAe;QAC9C,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,EAAE,CAAC;YACP,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACxC,CAAC;IACF,CAAC;CACD;AAuCD,MAAM,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;AAEpC,MAAM,OAAO,gBAAgB;IACnB,IAAI,GAAG,UAAmB,CAAC;IAC3B,OAAO,CAAS;IAChB,KAAK,CAAS;IACd,QAAQ,CAAW;IACnB,QAAQ,CAAS;IACjB,WAAW,CAAW;IACtB,iBAAiB,CAA8B;IAC/C,WAAW,CAAyB;IACpC,YAAY,CAA0B;IAE/C,YAAY,MAAsB;QACjC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;YACzD,MAAM,IAAI,WAAW,CACpB,gBAAgB,EAChB,mDAAmD,CACnD,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;YAC3C,CAAC,CAAC,MAAM,CAAC,MAAM;YACf,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnB,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC;QACzC,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,mBAAmB,IAAI,YAAY,CAAC;QAC9D,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,gBAAgB,IAAI,WAAW,CAAC;QAChE,IAAI,CAAC,WAAW;YACf,MAAM,CAAC,cAAc,IAAI,IAAI,4BAA4B,EAAE,CAAC;QAC7D,IAAI,CAAC,YAAY;YAChB,MAAM,CAAC,eAAe,IAAI,IAAI,6BAA6B,EAAE,CAAC;IAChE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,iBAAiB,CACtB,IAAkB;QAElB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7D,MAAM,SAAS,GAAG,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;QACrD,MAAM,OAAO,GAA4B;YACxC,SAAS;YACT,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE;YAC1C,IAAI,EAAE;gBACL,EAAE,EAAE,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;gBACnD,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,IAAI;aAC1C;YACD,gBAAgB,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAChD,IAAI,EAAE,YAAY;gBAClB,GAAG;aACH,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,WAAW,EAAE,MAAM;YACnB,kBAAkB,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACxC,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,IAAI,EAAE,YAAY;gBAClB,UAAU,EAAE,CAAC,CAAC,UAAU;aACxB,CAAC,CAAC;YACH,sBAAsB,EAAE;gBACvB,WAAW,EAAE,WAAW;gBACxB,gBAAgB,EAAE,IAAI,CAAC,iBAAiB;aACxC;SACD,CAAC;QACF,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC9C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,kBAAkB,CACvB,KAAa,EACb,MAAc,EACd,QAAkC;QAElC,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7D,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACxB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QACD,IACC,CAAC,IAAI,CAAC,gBAAgB,CACrB,QAAQ,CAAC,QAAQ,CAAC,cAAc,EAChC,iBAAiB,EACjB,iBAAiB,CACjB,EACA,CAAC;YACF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QAED,MAAM,WAAW,GAAG,UAAU,CAC7B,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CACtD,CAAC,KAAK,CAAC;QACR,IAAI,CAAC,CAAC,WAAW,YAAY,GAAG,CAAC,EAAE,CAAC;YACnC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QACD,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACnC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QACD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,WAAW,CAAC,CAAC;QACrD,IACC,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC;YACnC,CAAC,QAAQ,CAAC,aAAa;YACvB,CAAC,QAAQ,CAAC,kBAAkB;YAC5B,CAAC,QAAQ,CAAC,YAAY,EACrB,CAAC;YACF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QAED,MAAM,EAAE,GAAG,EAAE,GAAG,eAAe,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QACxD,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;YAC5B,EAAE,EAAE,iBAAiB,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC5C,MAAM;YACN,SAAS,EAAE,iBAAiB,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YACzD,GAAG;YACH,OAAO,EAAE,QAAQ,CAAC,SAAS;YAC3B,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,UAAU;SACxC,CAAC,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,mBAAmB,CACxB,MAAe;QAEf,MAAM,SAAS,GAAG,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,MAAM,OAAO,GAA8B;YAC1C,SAAS;YACT,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,gBAAgB,EAAE,IAAI,CAAC,iBAAiB;YACxC,gBAAgB,EAAE,MAAM;gBACvB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAClB,EAAE,EAAE,CAAC,CAAC,EAAE;oBACR,IAAI,EAAE,YAAY;oBAClB,UAAU,EAAE,CAAC,CAAC,UAAU;iBACxB,CAAC,CAAC;gBACJ,CAAC,CAAC,SAAS;SACZ,CAAC;QACF,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC9C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,oBAAoB,CACzB,KAAa,EACb,QAAoC;QAEpC,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7D,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACxB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QACD,IACC,CAAC,IAAI,CAAC,gBAAgB,CACrB,QAAQ,CAAC,QAAQ,CAAC,cAAc,EAChC,cAAc,EACd,iBAAiB,CACjB,EACA,CAAC;YACF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QAED,MAAM,WAAW,GAAG,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,sBAAsB,CAAC,WAAW,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QAED,gEAAgE;QAChE,MAAM,UAAU,GAAG,MAAM,CACxB,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,CACnD,CAAC;QACF,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;QAC5D,MAAM,EAAE,GAAG,EAAE,GAAG,eAAe,CAC9B,aAAa,CAAC,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAClD,CAAC;QACF,MAAM,EAAE,GAAG,uBAAuB,CACjC,MAAM,CAAC,GAAG,EACV,GAAG,EACH,UAAU,EACV,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAC9C,CAAC;QACF,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QAED,yEAAyE;QACzE,iEAAiE;QACjE,IAAI,QAAQ,CAAC,SAAS,KAAK,CAAC,IAAI,QAAQ,CAAC,SAAS,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACtE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QACD,MAAM,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;QACrE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAClD,CAAC;IAED,6EAA6E;IAC7E,gBAAgB,CACf,aAAqB,EACrB,YAAgD,EAChD,iBAAyB;QAEzB,IAAI,MAA8D,CAAC;QACnE,IAAI,CAAC;YACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,KAAK,CAAC;QACd,CAAC;QACD,OAAO,CACN,MAAM,CAAC,IAAI,KAAK,YAAY;YAC5B,MAAM,CAAC,SAAS,KAAK,iBAAiB;YACtC,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;YACjC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CACrC,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,mBAAmB,CAAC,QAGnB;QACA,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;QACjE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvE,OAAO,KAAK,CAAC;QACd,CAAC;QACD,IAAI,IAAI,CAAC,iBAAiB,KAAK,UAAU,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACjE,OAAO,KAAK,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;CACD;AAED,SAAS,aAAa,CAAC,KAAa;IACnC,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC;IACxC,IAAI,CAAC,CAAC,OAAO,YAAY,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,8BAA8B,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC"}

package/dist/middleware.d.ts

@@ -15,10 +15,11 @@
  *     async index(ctx) { ... }
  *   }
  */
-import { type AuthResult } from "./AuthManager.js";
+import { Authenticator } from "./Authenticator.js";
 import type { BasePolicy } from "./bouncer/BasePolicy.js";
 import type { Ability } from "./bouncer/types.js";
 import type { ScopeRequestContext } from "./config.js";
+import { E_UNAUTHORIZED_ACCESS } from "./errors.js";
 import type { Scope } from "./rights/types.js";
 import type { SessionStore } from "./strategies/SessionStrategy.js";
 /**
@@ -35,7 +36,7 @@ type ResolvableToken = string | symbol | (abstract new (...args: never[]) => unk
  * misconfigured kernel) yields no resolution: guarded routes fail CLOSED.
  */
 interface ContainerResolver {
-    make(token: ResolvableToken): unknown;
+    make(token: ResolvableToken): Promise<unknown>;
 }
 /**
  * Agnostic authorization slot — structurally Ream's `Authorizer` interface (and
@@ -64,6 +65,13 @@ export interface WardenContext {
     response: {
         status: (code: number) => unknown;
         json: (data: unknown) => void;
+        /**
+         * Redirect the response (Ream's `ctx.response.redirect`). Optional so a
+         * minimal host without it still gets the 401 JSON fallback — Warden does
+         * its own content negotiation (see `renderAuthError`) rather than leaning
+         * on the host's exception handler.
+         */
+        redirect?: (url: string) => unknown;
     };
     /**
      * Matched-route info — Ream (like Adonis) exposes the controller class +
@@ -84,8 +92,12 @@ export interface WardenContext {
     action?: string | symbol;
     /** Session store — set by a session middleware upstream. */
     session?: SessionStore;
-    /** Set by the middleware after successful auth (Ream's `auth` slot). */
-    auth?: AuthResult;
+    /**
+     * The per-request {@link Authenticator} (Ream's `auth` slot). `silentAuth`
+     * (global) or `wardenMiddleware` (per guarded route) sets it; inline handlers
+     * then call `ctx.auth.authenticate()` / `ctx.auth.use('session').login(user)`.
+     */
+    auth?: Authenticator;
     /**
      * Per-request authorization entry point — set by `initializeBouncer`. Typed
      * as the agnostic {@link Authorizer} contract (Ream's `ctx.bouncer` slot),
@@ -118,10 +130,21 @@ export declare function wardenMiddleware(ctx: WardenContext, next: WardenNext):
  * middleware / route guard enforces).
  *
  * Uses the AuthManager's DEFAULT strategy (Adonis's "default guard"). A missing
- * AuthManager, absent credentials, or a failed/crashed verify all leave the
- * request as a guest (`ctx.auth` unset) — silent auth is non-enforcing.
+ * AuthManager leaves the request a guest with `ctx.auth` unset; otherwise
+ * `ctx.auth` is ALWAYS set to an {@link Authenticator} (AdonisJS
+ * `initialize_auth_middleware` parity) — populated when credentials verify,
+ * left as a guest (`isAuthenticated === false`) when they're absent, invalid, or
+ * a guard crashes. Silent auth NEVER surfaces a 401/500.
  */
 export declare function silentAuth(ctx: WardenContext, next: WardenNext): Promise<void>;
+/**
+ * Render an `E_UNAUTHORIZED_ACCESS` to the response — Warden does its OWN content
+ * negotiation (AdonisJS session renderer parity) instead of leaning on the
+ * host's exception handler, so it stays agnostic. An `Accept: text/html` request
+ * against a session guard carrying a `redirectTo` is redirected to the login
+ * route; every other case gets a 401 JSON body. Always fail-closed.
+ */
+export declare function renderAuthError(ctx: WardenContext, error: E_UNAUTHORIZED_ACCESS): void;
 /**
  * The abilities/policies/scope-resolver a per-request Bouncer is built from.
  * Registered once by `WardenProvider` (from `config.auth`) under the container

package/dist/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAEN,KAAK,UAAU,EAGf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAE1D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AASvD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAcpE;;;;GAIG;AACH,KAAK,eAAe,GACjB,MAAM,GACN,MAAM,GACN,CAAC,QAAQ,MACT,GAAG,IAAI,EAAE,KAAK,EAAE,KACX,OAAO,CAAC,CAAC;AAEjB;;;;;;GAMG;AACH,UAAU,iBAAiB;IAC1B,IAAI,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC;CACtC;AAED;;;;;;;GAOG;AACH,UAAU,UAAU;IACnB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9D,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9D,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9D;AAED,MAAM,WAAW,aAAa;IAC7B,OAAO,EAAE;QACR,wEAAwE;QACxE,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAClC,CAAC;IACF;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,QAAQ,EAAE;QACT,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;QAClC,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;KAC9B,CAAC;IACF;;;;;;OAMG;IACH,KAAK,CAAC,EAAE;QACP,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;KACzB,CAAC;IACF;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,4DAA4D;IAC5D,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,wEAAwE;IACxE,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB;;;;OAIG;IACH,OAAO,CAAC,EAAE,UAAU,CAAC;CACrB;AA0BD,KAAK,UAAU,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAE7C;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,iBAuI1E;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,UAAU,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,iBA+CpE;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC/B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC5C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,UAAU,CAAC,CAAC;IAC/C,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,mBAAmB,KAAK,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;CACpE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,iBAmB3E;AA0ID;;;;;;GAMG;AACH,MAAM,CAAC,OAAO,OAAO,gBAAgB;IACpC,MAAM,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAG3D"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAE1D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAe,MAAM,aAAa,CAAC;AAQjE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAEpE;;;;GAIG;AACH,KAAK,eAAe,GACjB,MAAM,GACN,MAAM,GACN,CAAC,QAAQ,MACT,GAAG,IAAI,EAAE,KAAK,EAAE,KACX,OAAO,CAAC,CAAC;AAEjB;;;;;;GAMG;AACH,UAAU,iBAAiB;IAC1B,IAAI,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC/C;AAED;;;;;;;GAOG;AACH,UAAU,UAAU;IACnB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9D,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9D,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9D;AAED,MAAM,WAAW,aAAa;IAC7B,OAAO,EAAE;QACR,wEAAwE;QACxE,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAClC,CAAC;IACF;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,QAAQ,EAAE;QACT,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;QAClC,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;QAC9B;;;;;WAKG;QACH,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;KACpC,CAAC;IACF;;;;;;OAMG;IACH,KAAK,CAAC,EAAE;QACP,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;KACzB,CAAC;IACF;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,4DAA4D;IAC5D,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB;;;;OAIG;IACH,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB;;;;OAIG;IACH,OAAO,CAAC,EAAE,UAAU,CAAC;CACrB;AA6BD,KAAK,UAAU,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAE7C;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,iBA4F1E;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,UAAU,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,iBAkBpE;AA6BD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC9B,GAAG,EAAE,aAAa,EAClB,KAAK,EAAE,qBAAqB,GAC1B,IAAI,CAWN;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC/B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC5C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,UAAU,CAAC,CAAC;IAC/C,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,mBAAmB,KAAK,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;CACpE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,iBAmB3E;AAgED;;;;;;GAMG;AACH,MAAM,CAAC,OAAO,OAAO,gBAAgB;IACpC,MAAM,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAG3D"}