@c9up/warden 0.1.19 → 0.1.21

package/dist/AuthManager.d.ts

@@ -111,9 +111,6 @@ export interface WardenEmitter {
 }
 export declare class AuthManager {
     #private;
-    private guards;
-    private default;
-    private readonly rights;
     /**
      * Publish auth events on `emitter`. AdonisJS emits six of them from its
      * session guard, and an app that audits logins reads exactly those.

package/dist/AuthManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthManager.d.ts","sourceRoot":"","sources":["../src/AuthManager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,EAAE,eAAe,EAAE,CAAC;AAG3B,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AACrE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAEpE,MAAM,WAAW,WAAW;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IAC1B,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,IAAI,CAAC;CACrB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IAClC,qCAAqC;IACrC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,iDAAiD;IACjD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,uBAAuB;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAGtE;AAED,MAAM,WAAW,YAAY;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACxE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9E;;;;OAIG;IACH,oBAAoB,CAAC,CACpB,GAAG,IAAI,EAAE,KAAK,EAAE,GACd,OAAO,CAAC,kBAAkB,CAAC,GAAG,kBAAkB,CAAC;CACpD;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,UAAU;IAC1B,2CAA2C;IAC3C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACtC,mDAAmD;IACnD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kDAAkD;IAClD,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC1C;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,cAAc,CAAC;CACxB;AAkBD;;GAEG;AACH;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC7B,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;CAC5C;AAED,qBAAa,WAAW;;IAGvB,OAAO,CAAC,MAAM,CAAwC;IACtD,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;IASxC;;;OAGG;IACH,UAAU,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI;IAKxC;;;;OAIG;IACH,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;gBAaxD,MAAM,EAAE,UAAU;IAoC9B,0EAA0E;IACpE,YAAY,CACjB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,YAAY,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,UAAU,CAAC;IAmBtB,8CAA8C;IACxC,MAAM,CACX,KAAK,EAAE,MAAM,EACb,YAAY,CAAC,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAAC,UAAU,CAAC;IAoBtB;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM;IAc1D;;;;;;;OAOG;IACH,kBAAkB,CACjB,IAAI,EAAE,WAAW,EACjB,KAAK,GAAE,KAAgB,GACrB,OAAO,CAAC,oBAAoB,CAAC;IAIhC;;;;OAIG;IACG,OAAO,CACZ,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,MAAM,EACZ,KAAK,GAAE,KAAgB,GACrB,OAAO,CAAC,OAAO,CAAC;IAInB;;;;OAIG;IACG,aAAa,CAClB,IAAI,EAAE,WAAW,EACjB,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,KAAgB,GACrB,OAAO,CAAC,OAAO,CAAC;IAInB;;;OAGG;IACG,iBAAiB,CACtB,IAAI,EAAE,WAAW,EACjB,WAAW,EAAE,MAAM,EAAE,EACrB,KAAK,GAAE,KAAgB,GACrB,OAAO,CAAC,OAAO,CAAC;IAInB,yCAAyC;IACzC;;;;;;;OAOG;IACH,mBAAmB,CAAC,GAAG,EAAE,aAAa,GAAG,aAAa;IAItD;;;;;;OAMG;IACH,yBAAyB,IAAI;QAC5B,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG;YACpB,oBAAoB,CACnB,GAAG,IAAI,EAAE,KAAK,EAAE,GACd,OAAO,CAAC,kBAAkB,CAAC,GAAG,kBAAkB,CAAC;SACpD,CAAC;KACF;IAmBD;;;;OAIG;IACH,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM;IAQ1C,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,YAAY;IAexC;;;;OAIG;IACH,IAAI,mBAAmB,IAAI,MAAM,CAEhC;IAED,0CAA0C;IAC1C,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,GAAG,IAAI;IAI5D,yCAAyC;IACzC,gBAAgB,IAAI,MAAM,EAAE;IAI5B;;;;;;;;;OASG;IACG,KAAK,CACV,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,YAAY,EACrB,YAAY,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC;IAwBhB;;;;OAIG;IACG,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAezE;AAwBD,kEAAkE;AAClE;;;;;;GAMG"}
+{"version":3,"file":"AuthManager.d.ts","sourceRoot":"","sources":["../src/AuthManager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,EAAE,eAAe,EAAE,CAAC;AAG3B,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AACrE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAEpE,MAAM,WAAW,WAAW;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IAC1B,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,IAAI,CAAC;CACrB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IAClC,qCAAqC;IACrC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,iDAAiD;IACjD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,uBAAuB;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAGtE;AAED,MAAM,WAAW,YAAY;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACxE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9E;;;;OAIG;IACH,oBAAoB,CAAC,CACpB,GAAG,IAAI,EAAE,KAAK,EAAE,GACd,OAAO,CAAC,kBAAkB,CAAC,GAAG,kBAAkB,CAAC;CACpD;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,UAAU;IAC1B,2CAA2C;IAC3C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACtC,mDAAmD;IACnD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kDAAkD;IAClD,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC1C;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,cAAc,CAAC;CACxB;AAkBD;;GAEG;AACH;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC7B,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;CAC5C;AAED,qBAAa,WAAW;;IAcvB;;;OAGG;IACH,UAAU,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI;IAKxC;;;;OAIG;IACH,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;gBAaxD,MAAM,EAAE,UAAU;IAoC9B,0EAA0E;IACpE,YAAY,CACjB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,YAAY,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,UAAU,CAAC;IAmBtB,8CAA8C;IACxC,MAAM,CACX,KAAK,EAAE,MAAM,EACb,YAAY,CAAC,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAAC,UAAU,CAAC;IAoBtB;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM;IAc1D;;;;;;;OAOG;IACH,kBAAkB,CACjB,IAAI,EAAE,WAAW,EACjB,KAAK,GAAE,KAAgB,GACrB,OAAO,CAAC,oBAAoB,CAAC;IAIhC;;;;OAIG;IACG,OAAO,CACZ,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,MAAM,EACZ,KAAK,GAAE,KAAgB,GACrB,OAAO,CAAC,OAAO,CAAC;IAInB;;;;OAIG;IACG,aAAa,CAClB,IAAI,EAAE,WAAW,EACjB,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,KAAgB,GACrB,OAAO,CAAC,OAAO,CAAC;IAInB;;;OAGG;IACG,iBAAiB,CACtB,IAAI,EAAE,WAAW,EACjB,WAAW,EAAE,MAAM,EAAE,EACrB,KAAK,GAAE,KAAgB,GACrB,OAAO,CAAC,OAAO,CAAC;IAInB,yCAAyC;IACzC;;;;;;;OAOG;IACH,mBAAmB,CAAC,GAAG,EAAE,aAAa,GAAG,aAAa;IAItD;;;;;;OAMG;IACH,yBAAyB,IAAI;QAC5B,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG;YACpB,oBAAoB,CACnB,GAAG,IAAI,EAAE,KAAK,EAAE,GACd,OAAO,CAAC,kBAAkB,CAAC,GAAG,kBAAkB,CAAC;SACpD,CAAC;KACF;IAmBD;;;;OAIG;IACH,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM;IAQ1C,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,YAAY;IAexC;;;;OAIG;IACH,IAAI,mBAAmB,IAAI,MAAM,CAEhC;IAED,0CAA0C;IAC1C,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,GAAG,IAAI;IAI5D,yCAAyC;IACzC,gBAAgB,IAAI,MAAM,EAAE;IAI5B;;;;;;;;;OASG;IACG,KAAK,CACV,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,YAAY,EACrB,YAAY,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC;IAwBhB;;;;OAIG;IACG,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAezE;AAwBD,kEAAkE;AAClE;;;;;;GAMG"}

package/dist/AuthManager.js

@@ -39,9 +39,9 @@ function isTokenIssuer(strategy) {
 export class AuthManager {
     // AdonisJS names: `guards` (name → strategy) and `default` (the guard used
     // when none is named). Renamed from the previous `strategies`/`defaultStrategy`.
-    guards = new Map();
-    default;
-    rights;
+    #guards = new Map();
+    #default;
+    #rights;
     /**
      * Where auth events go. Structural and optional: warden is a leaf and must
      * not import an emitter — a host wires its own through `setEmitter`, and one
@@ -81,10 +81,10 @@ export class AuthManager {
         if (!guards || defaultGuard === undefined) {
             throw new WardenError("INVALID_CONFIG", "AuthManager: config must supply `default` + `guards` (or the legacy `defaultStrategy` + `strategies`).");
         }
-        this.default = defaultGuard;
-        this.rights = config.rights ?? new RightsResolver(new MemoryRightsStore());
+        this.#default = defaultGuard;
+        this.#rights = config.rights ?? new RightsResolver(new MemoryRightsStore());
         for (const [name, strategy] of Object.entries(guards)) {
-            this.guards.set(name, strategy);
+            this.#guards.set(name, strategy);
         }
         // Fail-fast at construction: an AuthManager with zero guards is a
         // configuration bug. Previously, an empty `guards: {}` passed the
@@ -92,10 +92,10 @@ export class AuthManager {
         // runtime when `getStrategy('jwt')` threw — opaque 401 or 500 instead
         // of a boot-time INVALID_CONFIG that points the operator at the missing
         // `config.auth.jwt` (or other guard).
-        if (this.guards.size === 0) {
+        if (this.#guards.size === 0) {
             throw new WardenError("INVALID_CONFIG", `AuthManager: no authentication guards registered. Configure at least one guard (e.g. config.warden.auth.jwt) before booting WardenProvider.`);
         }
-        if (!this.guards.has(defaultGuard)) {
+        if (!this.#guards.has(defaultGuard)) {
             throw new WardenError("INVALID_CONFIG", `default guard '${defaultGuard}' is not present in guards`);
         }
     }
@@ -157,7 +157,7 @@ export class AuthManager {
     issueFor(user, strategyName) {
         const strategy = this.getStrategy(strategyName);
         if (!isTokenIssuer(strategy)) {
-            throw new WardenError("STRATEGY_CANNOT_ISSUE", `Auth strategy '${strategyName ?? this.default}' cannot issue tokens.`, {
+            throw new WardenError("STRATEGY_CANNOT_ISSUE", `Auth strategy '${strategyName ?? this.#default}' cannot issue tokens.`, {
                 hint: "issueFor() needs a token-minting strategy (e.g. JwtStrategy with signToken). Session / API-key strategies don't mint tokens.",
             });
         }
@@ -172,7 +172,7 @@ export class AuthManager {
      * same `(user, scope)` (the single unification point — AC-E3).
      */
     resolvePermissions(user, scope = "global") {
-        return this.rights.resolve(user, scope);
+        return this.#rights.resolve(user, scope);
     }
     /**
      * Check if a user has a specific role within a scope (default `"global"`).
@@ -222,7 +222,7 @@ export class AuthManager {
                 const strategy = this.getStrategy(guard);
                 const seam = strategy.authenticateAsClient?.bind(strategy);
                 if (!seam) {
-                    throw new WardenError("STRATEGY_HAS_NO_CLIENT", `Auth strategy '${guard ?? this.default}' has no authenticateAsClient() — it cannot forge a client request.`, {
+                    throw new WardenError("STRATEGY_HAS_NO_CLIENT", `Auth strategy '${guard ?? this.#default}' has no authenticateAsClient() — it cannot forge a client request.`, {
                         hint: "Implement authenticateAsClient() on the strategy, or authenticate through a real login in the test.",
                     });
                 }
@@ -244,8 +244,8 @@ export class AuthManager {
         }
     }
     getStrategy(name) {
-        const strategyName = name ?? this.default;
-        const strategy = this.guards.get(strategyName);
+        const strategyName = name ?? this.#default;
+        const strategy = this.#guards.get(strategyName);
         if (!strategy) {
             throw new WardenError("STRATEGY_NOT_FOUND", `Auth strategy '${strategyName}' not registered`, {
                 hint: "Call registerStrategy() before using this strategy name.",
@@ -259,15 +259,15 @@ export class AuthManager {
      * declares none.
      */
     get defaultStrategyName() {
-        return this.default;
+        return this.#default;
     }
     /** Register a new strategy at runtime. */
     registerStrategy(name, strategy) {
-        this.guards.set(name, strategy);
+        this.#guards.set(name, strategy);
     }
     /** Get all registered strategy names. */
     getStrategyNames() {
-        return [...this.guards.keys()];
+        return [...this.#guards.keys()];
     }
     /**
      * Log a user in through a session-capable guard (AdonisJS
@@ -282,18 +282,18 @@ export class AuthManager {
     async login(user, session, strategyName) {
         const strategy = this.getStrategy(strategyName);
         if (!isLoginCapable(strategy)) {
-            throw new WardenError("STRATEGY_CANNOT_LOGIN", `Auth strategy '${strategyName ?? this.default}' does not support session login.`, {
+            throw new WardenError("STRATEGY_CANNOT_LOGIN", `Auth strategy '${strategyName ?? this.#default}' does not support session login.`, {
                 hint: "login()/logout() need a stateful guard (e.g. SessionStrategy). JWT / API-key guards are stateless — mint a token with issueFor() instead.",
             });
         }
         const prefix = authEventPrefix(strategy.name);
         this.#emit(`${prefix}:login_attempted`, {
-            guardName: strategyName ?? this.default,
+            guardName: strategyName ?? this.#default,
             user,
         });
         await strategy.login(user, session);
         this.#emit(`${prefix}:login_succeeded`, {
-            guardName: strategyName ?? this.default,
+            guardName: strategyName ?? this.#default,
             user,
             sessionId: undefined,
         });
@@ -306,11 +306,11 @@ export class AuthManager {
     async logout(session, strategyName) {
         const strategy = this.getStrategy(strategyName);
         if (!isLoginCapable(strategy)) {
-            throw new WardenError("STRATEGY_CANNOT_LOGIN", `Auth strategy '${strategyName ?? this.default}' does not support session logout.`);
+            throw new WardenError("STRATEGY_CANNOT_LOGIN", `Auth strategy '${strategyName ?? this.#default}' does not support session logout.`);
         }
         await strategy.logout(session);
         this.#emit(`${authEventPrefix(strategy.name)}:logged_out`, {
-            guardName: strategyName ?? this.default,
+            guardName: strategyName ?? this.#default,
             user: null,
             error: null,
         });

package/dist/AuthManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthManager.js","sourceRoot":"","sources":["../src/AuthManager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,EAAE,eAAe,EAAE,CAAC;AAE3B,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAyC5D;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAAC,UAA8B;IAC7D,IAAI,CAAC,UAAU;QAAE,OAAO,cAAc,CAAC;IACvC,OAAO,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,OAAO,CAAC;AACzE,CAAC;AAmDD;;;;GAIG;AACH,SAAS,aAAa,CACrB,QAAsB;IAEtB,OAAO,WAAW,IAAI,QAAQ,IAAI,OAAO,QAAQ,CAAC,SAAS,KAAK,UAAU,CAAC;AAC5E,CAAC;AAaD,MAAM,OAAO,WAAW;IACvB,2EAA2E;IAC3E,iFAAiF;IACzE,MAAM,GAA8B,IAAI,GAAG,EAAE,CAAC;IAC9C,OAAO,CAAS;IACP,MAAM,CAAiB;IAExC;;;;OAIG;IACH,QAAQ,CAA4B;IAEpC;;;OAGG;IACH,UAAU,CAAC,OAAsB;QAChC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,OAAO,IAAI,CAAC;IACb,CAAC;IAED;;;;OAIG;IACH,aAAa,CAAC,KAAa,EAAE,OAAgC;QAC5D,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC5B,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,KAAa,EAAE,OAAgC;QACpD,IAAI,CAAC;YACJ,KAAK,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACR,kEAAkE;QACnE,CAAC;IACF,CAAC;IAED,YAAY,MAAkB;QAC7B,wEAAwE;QACxE,wEAAwE;QACxE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC;QAClD,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,eAAe,CAAC;QAC9D,IAAI,CAAC,MAAM,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC3C,MAAM,IAAI,WAAW,CACpB,gBAAgB,EAChB,wGAAwG,CACxG,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,YAAY,CAAC;QAC5B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,cAAc,CAAC,IAAI,iBAAiB,EAAE,CAAC,CAAC;QAC3E,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACvD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACjC,CAAC;QACD,kEAAkE;QAClE,kEAAkE;QAClE,iEAAiE;QACjE,sEAAsE;QACtE,wEAAwE;QACxE,sCAAsC;QACtC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,WAAW,CACpB,gBAAgB,EAChB,6IAA6I,CAC7I,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,WAAW,CACpB,gBAAgB,EAChB,kBAAkB,YAAY,4BAA4B,CAC1D,CAAC;QACH,CAAC;IACF,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,YAAY,CACjB,WAAoC,EACpC,YAAqB;QAErB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;YACxD,IAAI,MAAM,CAAC,IAAI;gBAAE,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9C,OAAO,MAAM,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,oEAAoE;YACpE,qEAAqE;YACrE,kEAAkE;YAClE,IAAI,GAAG,YAAY,WAAW;gBAAE,MAAM,GAAG,CAAC;YAC1C,OAAO;gBACN,aAAa,EAAE,KAAK;gBACpB,KAAK,EACJ,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B;aACpE,CAAC;QACH,CAAC;IACF,CAAC;IAED,8CAA8C;IAC9C,KAAK,CAAC,MAAM,CACX,KAAa,EACb,YAAqB,EACrB,OAAiC;QAEjC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACrD,IAAI,MAAM,CAAC,IAAI;gBAAE,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9C,OAAO,MAAM,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,mEAAmE;YACnE,mEAAmE;YACnE,sEAAsE;YACtE,IAAI,GAAG,YAAY,WAAW;gBAAE,MAAM,GAAG,CAAC;YAC1C,OAAO;gBACN,aAAa,EAAE,KAAK;gBACpB,KAAK,EACJ,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,4BAA4B;gBAClE,aAAa,EAAE,IAAI;aACnB,CAAC;QACH,CAAC;IACF,CAAC;IAED;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,IAAiB,EAAE,YAAqB;QAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,WAAW,CACpB,uBAAuB,EACvB,kBAAkB,YAAY,IAAI,IAAI,CAAC,OAAO,wBAAwB,EACtE;gBACC,IAAI,EAAE,8HAA8H;aACpI,CACD,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;;OAOG;IACH,kBAAkB,CACjB,IAAiB,EACjB,QAAe,QAAQ;QAEvB,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CACZ,IAAiB,EACjB,IAAY,EACZ,QAAe,QAAQ;QAEvB,OAAO,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CAClB,IAAiB,EACjB,UAAkB,EAClB,QAAe,QAAQ;QAEvB,OAAO,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACrE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,iBAAiB,CACtB,IAAiB,EACjB,WAAqB,EACrB,QAAe,QAAQ;QAEvB,OAAO,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACzE,CAAC;IAED,yCAAyC;IACzC;;;;;;;OAOG;IACH,mBAAmB,CAAC,GAAkB;QACrC,OAAO,IAAI,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC;IAED;;;;;;OAMG;IACH,yBAAyB;QAOxB,OAAO;YACN,GAAG,EAAE,CAAC,KAAc,EAAE,EAAE;gBACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;gBACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,oBAAoB,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC3D,IAAI,CAAC,IAAI,EAAE,CAAC;oBACX,MAAM,IAAI,WAAW,CACpB,wBAAwB,EACxB,kBAAkB,KAAK,IAAI,IAAI,CAAC,OAAO,qEAAqE,EAC5G;wBACC,IAAI,EAAE,qGAAqG;qBAC3G,CACD,CAAC;gBACH,CAAC;gBACD,OAAO,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC;YACvC,CAAC;SACD,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,cAAc,CAAC,SAAkB;QAChC,IAAI,CAAC;YACJ,OAAO,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,eAAe,CAAC,SAAS,CAAC,CAAC;QACnC,CAAC;IACF,CAAC;IAED,WAAW,CAAC,IAAa;QACxB,MAAM,YAAY,GAAG,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,MAAM,IAAI,WAAW,CACpB,oBAAoB,EACpB,kBAAkB,YAAY,kBAAkB,EAChD;gBACC,IAAI,EAAE,0DAA0D;aAChE,CACD,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACH,IAAI,mBAAmB;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC;IACrB,CAAC;IAED,0CAA0C;IAC1C,gBAAgB,CAAC,IAAY,EAAE,QAAsB;QACpD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACjC,CAAC;IAED,yCAAyC;IACzC,gBAAgB;QACf,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,KAAK,CACV,IAAiB,EACjB,OAAqB,EACrB,YAAqB;QAErB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,WAAW,CACpB,uBAAuB,EACvB,kBAAkB,YAAY,IAAI,IAAI,CAAC,OAAO,mCAAmC,EACjF;gBACC,IAAI,EAAE,2IAA2I;aACjJ,CACD,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK,CAAC,GAAG,MAAM,kBAAkB,EAAE;YACvC,SAAS,EAAE,YAAY,IAAI,IAAI,CAAC,OAAO;YACvC,IAAI;SACJ,CAAC,CAAC;QACH,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,GAAG,MAAM,kBAAkB,EAAE;YACvC,SAAS,EAAE,YAAY,IAAI,IAAI,CAAC,OAAO;YACvC,IAAI;YACJ,SAAS,EAAE,SAAS;SACpB,CAAC,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,OAAqB,EAAE,YAAqB;QACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,WAAW,CACpB,uBAAuB,EACvB,kBAAkB,YAAY,IAAI,IAAI,CAAC,OAAO,oCAAoC,CAClF,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,GAAG,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE;YAC1D,SAAS,EAAE,YAAY,IAAI,IAAI,CAAC,OAAO;YACvC,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,IAAI;SACX,CAAC,CAAC;IACJ,CAAC;CACD;AAQD;;;;GAIG;AACH,SAAS,cAAc,CACtB,QAAsB;IAEtB,OAAO,CACN,OAAO,IAAI,QAAQ;QACnB,OAAO,QAAQ,CAAC,KAAK,KAAK,UAAU;QACpC,QAAQ,IAAI,QAAQ;QACpB,OAAO,QAAQ,CAAC,MAAM,KAAK,UAAU,CACrC,CAAC;AACH,CAAC;AAED,kEAAkE;AAClE;;;;;;GAMG"}
+{"version":3,"file":"AuthManager.js","sourceRoot":"","sources":["../src/AuthManager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,EAAE,eAAe,EAAE,CAAC;AAE3B,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAyC5D;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAAC,UAA8B;IAC7D,IAAI,CAAC,UAAU;QAAE,OAAO,cAAc,CAAC;IACvC,OAAO,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,OAAO,CAAC;AACzE,CAAC;AAmDD;;;;GAIG;AACH,SAAS,aAAa,CACrB,QAAsB;IAEtB,OAAO,WAAW,IAAI,QAAQ,IAAI,OAAO,QAAQ,CAAC,SAAS,KAAK,UAAU,CAAC;AAC5E,CAAC;AAaD,MAAM,OAAO,WAAW;IACvB,2EAA2E;IAC3E,iFAAiF;IACjF,OAAO,GAA8B,IAAI,GAAG,EAAE,CAAC;IAC/C,QAAQ,CAAS;IACR,OAAO,CAAiB;IAEjC;;;;OAIG;IACH,QAAQ,CAA4B;IAEpC;;;OAGG;IACH,UAAU,CAAC,OAAsB;QAChC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,OAAO,IAAI,CAAC;IACb,CAAC;IAED;;;;OAIG;IACH,aAAa,CAAC,KAAa,EAAE,OAAgC;QAC5D,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC5B,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,KAAa,EAAE,OAAgC;QACpD,IAAI,CAAC;YACJ,KAAK,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACR,kEAAkE;QACnE,CAAC;IACF,CAAC;IAED,YAAY,MAAkB;QAC7B,wEAAwE;QACxE,wEAAwE;QACxE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC;QAClD,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,eAAe,CAAC;QAC9D,IAAI,CAAC,MAAM,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC3C,MAAM,IAAI,WAAW,CACpB,gBAAgB,EAChB,wGAAwG,CACxG,CAAC;QACH,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,YAAY,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,cAAc,CAAC,IAAI,iBAAiB,EAAE,CAAC,CAAC;QAC5E,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACvD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAClC,CAAC;QACD,kEAAkE;QAClE,kEAAkE;QAClE,iEAAiE;QACjE,sEAAsE;QACtE,wEAAwE;QACxE,sCAAsC;QACtC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,WAAW,CACpB,gBAAgB,EAChB,6IAA6I,CAC7I,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,WAAW,CACpB,gBAAgB,EAChB,kBAAkB,YAAY,4BAA4B,CAC1D,CAAC;QACH,CAAC;IACF,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,YAAY,CACjB,WAAoC,EACpC,YAAqB;QAErB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;YACxD,IAAI,MAAM,CAAC,IAAI;gBAAE,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9C,OAAO,MAAM,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,oEAAoE;YACpE,qEAAqE;YACrE,kEAAkE;YAClE,IAAI,GAAG,YAAY,WAAW;gBAAE,MAAM,GAAG,CAAC;YAC1C,OAAO;gBACN,aAAa,EAAE,KAAK;gBACpB,KAAK,EACJ,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B;aACpE,CAAC;QACH,CAAC;IACF,CAAC;IAED,8CAA8C;IAC9C,KAAK,CAAC,MAAM,CACX,KAAa,EACb,YAAqB,EACrB,OAAiC;QAEjC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACrD,IAAI,MAAM,CAAC,IAAI;gBAAE,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9C,OAAO,MAAM,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,mEAAmE;YACnE,mEAAmE;YACnE,sEAAsE;YACtE,IAAI,GAAG,YAAY,WAAW;gBAAE,MAAM,GAAG,CAAC;YAC1C,OAAO;gBACN,aAAa,EAAE,KAAK;gBACpB,KAAK,EACJ,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,4BAA4B;gBAClE,aAAa,EAAE,IAAI;aACnB,CAAC;QACH,CAAC;IACF,CAAC;IAED;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,IAAiB,EAAE,YAAqB;QAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,WAAW,CACpB,uBAAuB,EACvB,kBAAkB,YAAY,IAAI,IAAI,CAAC,QAAQ,wBAAwB,EACvE;gBACC,IAAI,EAAE,8HAA8H;aACpI,CACD,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;;OAOG;IACH,kBAAkB,CACjB,IAAiB,EACjB,QAAe,QAAQ;QAEvB,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CACZ,IAAiB,EACjB,IAAY,EACZ,QAAe,QAAQ;QAEvB,OAAO,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CAClB,IAAiB,EACjB,UAAkB,EAClB,QAAe,QAAQ;QAEvB,OAAO,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACrE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,iBAAiB,CACtB,IAAiB,EACjB,WAAqB,EACrB,QAAe,QAAQ;QAEvB,OAAO,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACzE,CAAC;IAED,yCAAyC;IACzC;;;;;;;OAOG;IACH,mBAAmB,CAAC,GAAkB;QACrC,OAAO,IAAI,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC;IAED;;;;;;OAMG;IACH,yBAAyB;QAOxB,OAAO;YACN,GAAG,EAAE,CAAC,KAAc,EAAE,EAAE;gBACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;gBACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,oBAAoB,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC3D,IAAI,CAAC,IAAI,EAAE,CAAC;oBACX,MAAM,IAAI,WAAW,CACpB,wBAAwB,EACxB,kBAAkB,KAAK,IAAI,IAAI,CAAC,QAAQ,qEAAqE,EAC7G;wBACC,IAAI,EAAE,qGAAqG;qBAC3G,CACD,CAAC;gBACH,CAAC;gBACD,OAAO,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC;YACvC,CAAC;SACD,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,cAAc,CAAC,SAAkB;QAChC,IAAI,CAAC;YACJ,OAAO,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,eAAe,CAAC,SAAS,CAAC,CAAC;QACnC,CAAC;IACF,CAAC;IAED,WAAW,CAAC,IAAa;QACxB,MAAM,YAAY,GAAG,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC;QAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,MAAM,IAAI,WAAW,CACpB,oBAAoB,EACpB,kBAAkB,YAAY,kBAAkB,EAChD;gBACC,IAAI,EAAE,0DAA0D;aAChE,CACD,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACH,IAAI,mBAAmB;QACtB,OAAO,IAAI,CAAC,QAAQ,CAAC;IACtB,CAAC;IAED,0CAA0C;IAC1C,gBAAgB,CAAC,IAAY,EAAE,QAAsB;QACpD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAClC,CAAC;IAED,yCAAyC;IACzC,gBAAgB;QACf,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,KAAK,CACV,IAAiB,EACjB,OAAqB,EACrB,YAAqB;QAErB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,WAAW,CACpB,uBAAuB,EACvB,kBAAkB,YAAY,IAAI,IAAI,CAAC,QAAQ,mCAAmC,EAClF;gBACC,IAAI,EAAE,2IAA2I;aACjJ,CACD,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK,CAAC,GAAG,MAAM,kBAAkB,EAAE;YACvC,SAAS,EAAE,YAAY,IAAI,IAAI,CAAC,QAAQ;YACxC,IAAI;SACJ,CAAC,CAAC;QACH,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,GAAG,MAAM,kBAAkB,EAAE;YACvC,SAAS,EAAE,YAAY,IAAI,IAAI,CAAC,QAAQ;YACxC,IAAI;YACJ,SAAS,EAAE,SAAS;SACpB,CAAC,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,OAAqB,EAAE,YAAqB;QACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,WAAW,CACpB,uBAAuB,EACvB,kBAAkB,YAAY,IAAI,IAAI,CAAC,QAAQ,oCAAoC,CACnF,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,GAAG,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE;YAC1D,SAAS,EAAE,YAAY,IAAI,IAAI,CAAC,QAAQ;YACxC,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,IAAI;SACX,CAAC,CAAC;IACJ,CAAC;CACD;AAQD;;;;GAIG;AACH,SAAS,cAAc,CACtB,QAAsB;IAEtB,OAAO,CACN,OAAO,IAAI,QAAQ;QACnB,OAAO,QAAQ,CAAC,KAAK,KAAK,UAAU;QACpC,QAAQ,IAAI,QAAQ;QACpB,OAAO,QAAQ,CAAC,MAAM,KAAK,UAAU,CACrC,CAAC;AACH,CAAC;AAED,kEAAkE;AAClE;;;;;;GAMG"}

package/dist/AuthRateLimiter.d.ts

@@ -10,10 +10,7 @@ export interface AuthRateLimiterConfig {
     windowSeconds?: number;
 }
 export declare class AuthRateLimiter {
-    private maxAttempts;
-    private window;
-    private store;
-    private maxStoreSize;
+    #private;
     constructor(config?: AuthRateLimiterConfig);
     /** Check if an attempt is allowed. Returns false if rate limited. */
     check(ip: string, identifier: string): boolean;
@@ -23,7 +20,5 @@ export declare class AuthRateLimiter {
     recordSuccess(ip: string, identifier: string): void;
     /** Get remaining attempts for an identifier. */
     remaining(ip: string, identifier: string): number;
-    private checkKey;
-    private increment;
 }
 //# sourceMappingURL=AuthRateLimiter.d.ts.map

package/dist/AuthRateLimiter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthRateLimiter.d.ts","sourceRoot":"","sources":["../src/AuthRateLimiter.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,WAAW,qBAAqB;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;CACvB;AAOD,qBAAa,eAAe;IAC3B,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,KAAK,CAAwC;IACrD,OAAO,CAAC,YAAY,CAAW;gBAEnB,MAAM,CAAC,EAAE,qBAAqB;IAO1C,qEAAqE;IACrE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO;IAW9C,+BAA+B;IAC/B,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IAQnD,0CAA0C;IAC1C,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IAOnD,gDAAgD;IAChD,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM;IAcjD,OAAO,CAAC,QAAQ;IAMhB,OAAO,CAAC,SAAS;CAejB"}
+{"version":3,"file":"AuthRateLimiter.d.ts","sourceRoot":"","sources":["../src/AuthRateLimiter.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,WAAW,qBAAqB;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;CACvB;AAOD,qBAAa,eAAe;;gBAMf,MAAM,CAAC,EAAE,qBAAqB;IAO1C,qEAAqE;IACrE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO;IAW9C,+BAA+B;IAC/B,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IAQnD,0CAA0C;IAC1C,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IAOnD,gDAAgD;IAChD,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM;CAmCjD"}

package/dist/AuthRateLimiter.js

@@ -6,17 +6,17 @@
  * @implements MISS-26
  */
 export class AuthRateLimiter {
-    maxAttempts;
-    window;
-    store = new Map();
-    maxStoreSize = 100_000;
+    #maxAttempts;
+    #window;
+    #store = new Map();
+    #maxStoreSize = 100_000;
     constructor(config) {
-        this.maxAttempts = config?.maxAttempts ?? 5;
-        if (this.maxAttempts <= 0)
-            this.maxAttempts = 1;
-        this.window = (config?.windowSeconds ?? 900) * 1000;
-        if (this.window <= 0)
-            this.window = 900_000; // prevent bypass via 0/negative
+        this.#maxAttempts = config?.maxAttempts ?? 5;
+        if (this.#maxAttempts <= 0)
+            this.#maxAttempts = 1;
+        this.#window = (config?.windowSeconds ?? 900) * 1000;
+        if (this.#window <= 0)
+            this.#window = 900_000; // prevent bypass via 0/negative
     }
     /** Check if an attempt is allowed. Returns false if rate limited. */
     check(ip, identifier) {
@@ -26,55 +26,55 @@ export class AuthRateLimiter {
         // Dual key: limit both by IP and by identifier (email)
         const ipKey = `ip:${ipNorm}`;
         const idKey = `id:${identifierNorm}`;
-        return this.checkKey(ipKey, now) && this.checkKey(idKey, now);
+        return this.#checkKey(ipKey, now) && this.#checkKey(idKey, now);
     }
     /** Record a failed attempt. */
     recordFailure(ip, identifier) {
         const now = Date.now();
         const ipNorm = normalizeIp(ip);
         const identifierNorm = normalizeIdentifier(identifier);
-        this.increment(`ip:${ipNorm}`, now);
-        this.increment(`id:${identifierNorm}`, now);
+        this.#increment(`ip:${ipNorm}`, now);
+        this.#increment(`id:${identifierNorm}`, now);
     }
     /** Reset counters on successful login. */
     recordSuccess(ip, identifier) {
         const ipNorm = normalizeIp(ip);
         const identifierNorm = normalizeIdentifier(identifier);
-        this.store.delete(`ip:${ipNorm}`);
-        this.store.delete(`id:${identifierNorm}`);
+        this.#store.delete(`ip:${ipNorm}`);
+        this.#store.delete(`id:${identifierNorm}`);
     }
     /** Get remaining attempts for an identifier. */
     remaining(ip, identifier) {
         const ipNorm = normalizeIp(ip);
         const identifierNorm = normalizeIdentifier(identifier);
-        const ipEntry = this.store.get(`ip:${ipNorm}`);
-        const idEntry = this.store.get(`id:${identifierNorm}`);
+        const ipEntry = this.#store.get(`ip:${ipNorm}`);
+        const idEntry = this.#store.get(`id:${identifierNorm}`);
         const ipRemaining = ipEntry
-            ? Math.max(0, this.maxAttempts - ipEntry.count)
-            : this.maxAttempts;
+            ? Math.max(0, this.#maxAttempts - ipEntry.count)
+            : this.#maxAttempts;
         const idRemaining = idEntry
-            ? Math.max(0, this.maxAttempts - idEntry.count)
-            : this.maxAttempts;
+            ? Math.max(0, this.#maxAttempts - idEntry.count)
+            : this.#maxAttempts;
         return Math.min(ipRemaining, idRemaining);
     }
-    checkKey(key, now) {
-        const entry = this.store.get(key);
+    #checkKey(key, now) {
+        const entry = this.#store.get(key);
         if (!entry || entry.resetAt < now)
             return true;
-        return entry.count < this.maxAttempts;
+        return entry.count < this.#maxAttempts;
     }
-    increment(key, now) {
+    #increment(key, now) {
         // Evict expired entries when store grows too large (prevent OOM)
-        if (this.store.size > this.maxStoreSize) {
-            for (const [k, v] of this.store) {
+        if (this.#store.size > this.#maxStoreSize) {
+            for (const [k, v] of this.#store) {
                 if (v.resetAt < now)
-                    this.store.delete(k);
+                    this.#store.delete(k);
             }
         }
-        let entry = this.store.get(key);
+        let entry = this.#store.get(key);
         if (!entry || entry.resetAt < now) {
-            entry = { count: 0, resetAt: now + this.window };
-            this.store.set(key, entry);
+            entry = { count: 0, resetAt: now + this.#window };
+            this.#store.set(key, entry);
         }
         entry.count++;
     }

package/dist/AuthRateLimiter.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthRateLimiter.js","sourceRoot":"","sources":["../src/AuthRateLimiter.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAYH,MAAM,OAAO,eAAe;IACnB,WAAW,CAAS;IACpB,MAAM,CAAS;IACf,KAAK,GAA8B,IAAI,GAAG,EAAE,CAAC;IAC7C,YAAY,GAAG,OAAO,CAAC;IAE/B,YAAY,MAA8B;QACzC,IAAI,CAAC,WAAW,GAAG,MAAM,EAAE,WAAW,IAAI,CAAC,CAAC;QAC5C,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC;YAAE,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC;QACpD,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC;YAAE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,gCAAgC;IAC9E,CAAC;IAED,qEAAqE;IACrE,KAAK,CAAC,EAAU,EAAE,UAAkB;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,cAAc,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;QACvD,uDAAuD;QACvD,MAAM,KAAK,GAAG,MAAM,MAAM,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,cAAc,EAAE,CAAC;QAErC,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC/D,CAAC;IAED,+BAA+B;IAC/B,aAAa,CAAC,EAAU,EAAE,UAAkB;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,cAAc,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;QACvD,IAAI,CAAC,SAAS,CAAC,MAAM,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,SAAS,CAAC,MAAM,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC;IAED,0CAA0C;IAC1C,aAAa,CAAC,EAAU,EAAE,UAAkB;QAC3C,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,cAAc,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,cAAc,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,gDAAgD;IAChD,SAAS,CAAC,EAAU,EAAE,UAAkB;QACvC,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,cAAc,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,cAAc,EAAE,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,OAAO;YAC1B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC;YAC/C,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;QACpB,MAAM,WAAW,GAAG,OAAO;YAC1B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC;YAC/C,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;QACpB,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IAC3C,CAAC;IAEO,QAAQ,CAAC,GAAW,EAAE,GAAW;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC;QAC/C,OAAO,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC;IACvC,CAAC;IAEO,SAAS,CAAC,GAAW,EAAE,GAAW;QACzC,iEAAiE;QACjE,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YACzC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACjC,IAAI,CAAC,CAAC,OAAO,GAAG,GAAG;oBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC3C,CAAC;QACF,CAAC;QAED,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC;YACnC,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACjD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC5B,CAAC;QACD,KAAK,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;CACD;AAED,SAAS,mBAAmB,CAAC,UAAkB;IAC9C,OAAO,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,WAAW,CAAC,EAAU;IAC9B,OAAO,EAAE,CAAC,IAAI,EAAE,CAAC;AAClB,CAAC"}
+{"version":3,"file":"AuthRateLimiter.js","sourceRoot":"","sources":["../src/AuthRateLimiter.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAYH,MAAM,OAAO,eAAe;IAC3B,YAAY,CAAS;IACrB,OAAO,CAAS;IAChB,MAAM,GAA8B,IAAI,GAAG,EAAE,CAAC;IAC9C,aAAa,GAAG,OAAO,CAAC;IAExB,YAAY,MAA8B;QACzC,IAAI,CAAC,YAAY,GAAG,MAAM,EAAE,WAAW,IAAI,CAAC,CAAC;QAC7C,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC;YAAE,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC;QACrD,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC;YAAE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,CAAC,gCAAgC;IAChF,CAAC;IAED,qEAAqE;IACrE,KAAK,CAAC,EAAU,EAAE,UAAkB;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,cAAc,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;QACvD,uDAAuD;QACvD,MAAM,KAAK,GAAG,MAAM,MAAM,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,cAAc,EAAE,CAAC;QAErC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACjE,CAAC;IAED,+BAA+B;IAC/B,aAAa,CAAC,EAAU,EAAE,UAAkB;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,cAAc,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;QACvD,IAAI,CAAC,UAAU,CAAC,MAAM,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,UAAU,CAAC,MAAM,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC;IAED,0CAA0C;IAC1C,aAAa,CAAC,EAAU,EAAE,UAAkB;QAC3C,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,cAAc,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,cAAc,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,gDAAgD;IAChD,SAAS,CAAC,EAAU,EAAE,UAAkB;QACvC,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,cAAc,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,cAAc,EAAE,CAAC,CAAC;QACxD,MAAM,WAAW,GAAG,OAAO;YAC1B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC;YAChD,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;QACrB,MAAM,WAAW,GAAG,OAAO;YAC1B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC;YAChD,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;QACrB,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IAC3C,CAAC;IAED,SAAS,CAAC,GAAW,EAAE,GAAW;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC;QAC/C,OAAO,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC;IACxC,CAAC;IAED,UAAU,CAAC,GAAW,EAAE,GAAW;QAClC,iEAAiE;QACjE,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;YAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAClC,IAAI,CAAC,CAAC,OAAO,GAAG,GAAG;oBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC5C,CAAC;QACF,CAAC;QAED,IAAI,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC;YACnC,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAClD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7B,CAAC;QACD,KAAK,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;CACD;AAED,SAAS,mBAAmB,CAAC,UAAkB;IAC9C,OAAO,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,WAAW,CAAC,EAAU;IAC9B,OAAO,EAAE,CAAC,IAAI,EAAE,CAAC;AAClB,CAAC"}

package/dist/RefreshTokenStore.d.ts

@@ -22,7 +22,7 @@ export interface RefreshTokenDriver {
 }
 /** In-memory driver for development. */
 export declare class MemoryRefreshTokenDriver implements RefreshTokenDriver {
-    private tokens;
+    #private;
     store(token: StoredRefreshToken): Promise<void>;
     find(token: string): Promise<StoredRefreshToken | null>;
     revoke(token: string): Promise<void>;

package/dist/RefreshTokenStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RefreshTokenStore.d.ts","sourceRoot":"","sources":["../src/RefreshTokenStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,MAAM,WAAW,kBAAkB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IAClC,KAAK,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACxD,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AAED,wCAAwC;AACxC,qBAAa,wBAAyB,YAAW,kBAAkB;IAClE,OAAO,CAAC,MAAM,CAA8C;IAEtD,KAAK,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/C,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAUvD,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpC,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMxD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAM9B;AAED,wCAAwC;AACxC,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C"}
+{"version":3,"file":"RefreshTokenStore.d.ts","sourceRoot":"","sources":["../src/RefreshTokenStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,MAAM,WAAW,kBAAkB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IAClC,KAAK,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACxD,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AAED,wCAAwC;AACxC,qBAAa,wBAAyB,YAAW,kBAAkB;;IAG5D,KAAK,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/C,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAUvD,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpC,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMxD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAM9B;AAED,wCAAwC;AACxC,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C"}

package/dist/RefreshTokenStore.js

@@ -10,34 +10,34 @@
 import { randomBytes } from "node:crypto";
 /** In-memory driver for development. */
 export class MemoryRefreshTokenDriver {
-    tokens = new Map();
+    #tokens = new Map();
     async store(token) {
-        this.tokens.set(token.token, token);
+        this.#tokens.set(token.token, token);
     }
     async find(token) {
-        const stored = this.tokens.get(token);
+        const stored = this.#tokens.get(token);
         if (!stored)
             return null;
         if (stored.expiresAt < Date.now()) {
-            this.tokens.delete(token);
+            this.#tokens.delete(token);
             return null;
         }
         return stored;
     }
     async revoke(token) {
-        this.tokens.delete(token);
+        this.#tokens.delete(token);
     }
     async revokeAllForUser(userId) {
-        for (const [key, val] of this.tokens) {
+        for (const [key, val] of this.#tokens) {
             if (val.userId === userId)
-                this.tokens.delete(key);
+                this.#tokens.delete(key);
         }
     }
     async cleanup() {
         const now = Date.now();
-        for (const [key, val] of this.tokens) {
+        for (const [key, val] of this.#tokens) {
             if (val.expiresAt < now)
-                this.tokens.delete(key);
+                this.#tokens.delete(key);
         }
     }
 }

package/dist/RefreshTokenStore.js.map

@@ -1 +1 @@
-{"version":3,"file":"RefreshTokenStore.js","sourceRoot":"","sources":["../src/RefreshTokenStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAiB1C,wCAAwC;AACxC,MAAM,OAAO,wBAAwB;IAC5B,MAAM,GAAoC,IAAI,GAAG,EAAE,CAAC;IAE5D,KAAK,CAAC,KAAK,CAAC,KAAyB;QACpC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAa;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,OAAO,IAAI,CAAC;QACb,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACzB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,MAAuB;QAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACtC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACpD,CAAC;IACF,CAAC;IAED,KAAK,CAAC,OAAO;QACZ,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACtC,IAAI,GAAG,CAAC,SAAS,GAAG,GAAG;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClD,CAAC;IACF,CAAC;CACD;AAED,wCAAwC;AACxC,MAAM,UAAU,oBAAoB;IACnC,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC9C,CAAC"}
+{"version":3,"file":"RefreshTokenStore.js","sourceRoot":"","sources":["../src/RefreshTokenStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAiB1C,wCAAwC;AACxC,MAAM,OAAO,wBAAwB;IACpC,OAAO,GAAoC,IAAI,GAAG,EAAE,CAAC;IAErD,KAAK,CAAC,KAAK,CAAC,KAAyB;QACpC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAa;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACnC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC3B,OAAO,IAAI,CAAC;QACb,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACzB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,MAAuB;QAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACvC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrD,CAAC;IACF,CAAC;IAED,KAAK,CAAC,OAAO;QACZ,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACvC,IAAI,GAAG,CAAC,SAAS,GAAG,GAAG;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;IACF,CAAC;CACD;AAED,wCAAwC;AACxC,MAAM,UAAU,oBAAoB;IACnC,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC9C,CAAC"}

package/dist/TokenBlacklist.d.ts

@@ -16,7 +16,7 @@ export interface BlacklistDriver {
 }
 /** In-memory blacklist for development. */
 export declare class MemoryBlacklistDriver implements BlacklistDriver {
-    private entries;
+    #private;
     add(jti: string, expiresAt: number): Promise<void>;
     has(jti: string): Promise<boolean>;
     cleanup(): Promise<void>;

package/dist/TokenBlacklist.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TokenBlacklist.d.ts","sourceRoot":"","sources":["../src/TokenBlacklist.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,WAAW,eAAe;IAC/B,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC;;;OAGG;IACH,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,2CAA2C;AAC3C,qBAAa,qBAAsB,YAAW,eAAe;IAC5D,OAAO,CAAC,OAAO,CAAkC;IAE3C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlD,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAUlC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAM9B;AAED,qBAAa,cAAc;IACd,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,eAAe;IAE3C,uCAAuC;IACjC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI3D,2CAA2C;IACrC,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAI9C,2EAA2E;IACrE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAG9B"}
+{"version":3,"file":"TokenBlacklist.d.ts","sourceRoot":"","sources":["../src/TokenBlacklist.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,WAAW,eAAe;IAC/B,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC;;;OAGG;IACH,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,2CAA2C;AAC3C,qBAAa,qBAAsB,YAAW,eAAe;;IAGtD,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlD,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAUlC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAM9B;AAED,qBAAa,cAAc;IACd,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,eAAe;IAE3C,uCAAuC;IACjC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI3D,2CAA2C;IACrC,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAI9C,2EAA2E;IACrE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAG9B"}

package/dist/TokenBlacklist.js

@@ -7,25 +7,25 @@
  */
 /** In-memory blacklist for development. */
 export class MemoryBlacklistDriver {
-    entries = new Map();
+    #entries = new Map();
     async add(jti, expiresAt) {
-        this.entries.set(jti, expiresAt);
+        this.#entries.set(jti, expiresAt);
     }
     async has(jti) {
-        const expiresAt = this.entries.get(jti);
+        const expiresAt = this.#entries.get(jti);
         if (expiresAt === undefined)
             return false;
         if (expiresAt < Date.now()) {
-            this.entries.delete(jti);
+            this.#entries.delete(jti);
             return false;
         }
         return true;
     }
     async cleanup() {
         const now = Date.now();
-        for (const [jti, exp] of this.entries) {
+        for (const [jti, exp] of this.#entries) {
             if (exp < now)
-                this.entries.delete(jti);
+                this.#entries.delete(jti);
         }
     }
 }

package/dist/TokenBlacklist.js.map

@@ -1 +1 @@
-{"version":3,"file":"TokenBlacklist.js","sourceRoot":"","sources":["../src/TokenBlacklist.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAYH,2CAA2C;AAC3C,MAAM,OAAO,qBAAqB;IACzB,OAAO,GAAwB,IAAI,GAAG,EAAE,CAAC;IAEjD,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,SAAiB;QACvC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACpB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAC1C,IAAI,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,OAAO,KAAK,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IAED,KAAK,CAAC,OAAO;QACZ,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACvC,IAAI,GAAG,GAAG,GAAG;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzC,CAAC;IACF,CAAC;CACD;AAED,MAAM,OAAO,cAAc;IACN;IAApB,YAAoB,MAAuB;QAAvB,WAAM,GAAN,MAAM,CAAiB;IAAG,CAAC;IAE/C,uCAAuC;IACvC,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,SAAiB;QAC1C,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACvC,CAAC;IAED,2CAA2C;IAC3C,KAAK,CAAC,SAAS,CAAC,GAAW;QAC1B,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,OAAO;QACZ,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;IAC/B,CAAC;CACD"}
+{"version":3,"file":"TokenBlacklist.js","sourceRoot":"","sources":["../src/TokenBlacklist.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAYH,2CAA2C;AAC3C,MAAM,OAAO,qBAAqB;IACjC,QAAQ,GAAwB,IAAI,GAAG,EAAE,CAAC;IAE1C,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,SAAiB;QACvC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACpB,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAC1C,IAAI,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC5B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1B,OAAO,KAAK,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IAED,KAAK,CAAC,OAAO;QACZ,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxC,IAAI,GAAG,GAAG,GAAG;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1C,CAAC;IACF,CAAC;CACD;AAED,MAAM,OAAO,cAAc;IACN;IAApB,YAAoB,MAAuB;QAAvB,WAAM,GAAN,MAAM,CAAiB;IAAG,CAAC;IAE/C,uCAAuC;IACvC,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,SAAiB;QAC1C,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACvC,CAAC;IAED,2CAA2C;IAC3C,KAAK,CAAC,SAAS,CAAC,GAAW;QAC1B,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,OAAO;QACZ,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;IAC/B,CAAC;CACD"}

package/dist/augmentations.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Teach ream's `Authenticators` interface what `ctx.auth.use(name)` returns.
+ *
+ * ream declares that interface empty on purpose — it owns no auth package, so
+ * it cannot know an application's guards, and `use()` falls back to `unknown`
+ * until something fills it in. Warden is that something.
+ *
+ * An index signature rather than an enumeration of names, because that is the
+ * truth here: `Authenticator.use()` accepts any guard name and always hands
+ * back a `GuardAccessor`. AdonisJS enumerates instead, since each of its
+ * guards has a distinct type; warden's do not.
+ *
+ * Loaded from the package barrel, so importing warden anywhere in the app is
+ * enough — an application writes no `declare module` of its own.
+ */
+import type { GuardAccessor } from "./Authenticator.js";
+declare module "@c9up/ream/types" {
+    interface Authenticators {
+        [guardName: string]: GuardAccessor;
+    }
+}
+//# sourceMappingURL=augmentations.d.ts.map

package/dist/augmentations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"augmentations.d.ts","sourceRoot":"","sources":["../src/augmentations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD,OAAO,QAAQ,kBAAkB,CAAC;IACjC,UAAU,cAAc;QACvB,CAAC,SAAS,EAAE,MAAM,GAAG,aAAa,CAAC;KACnC;CACD"}

package/dist/augmentations.js

@@ -0,0 +1,17 @@
+/**
+ * Teach ream's `Authenticators` interface what `ctx.auth.use(name)` returns.
+ *
+ * ream declares that interface empty on purpose — it owns no auth package, so
+ * it cannot know an application's guards, and `use()` falls back to `unknown`
+ * until something fills it in. Warden is that something.
+ *
+ * An index signature rather than an enumeration of names, because that is the
+ * truth here: `Authenticator.use()` accepts any guard name and always hands
+ * back a `GuardAccessor`. AdonisJS enumerates instead, since each of its
+ * guards has a distinct type; warden's do not.
+ *
+ * Loaded from the package barrel, so importing warden anywhere in the app is
+ * enough — an application writes no `declare module` of its own.
+ */
+export {};
+//# sourceMappingURL=augmentations.js.map

package/dist/augmentations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"augmentations.js","sourceRoot":"","sources":["../src/augmentations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG"}

package/dist/bouncer/AuthorizationResponse.d.ts

@@ -17,6 +17,12 @@ export declare class AuthorizationResponse {
         identifier: string;
         data?: Record<string, unknown>;
     };
+    /**
+     * Private because a response is only ever built through allow() / deny(), so the pair stays consistent.
+     *
+     * `private` and not `#`: a private CONSTRUCTOR has no native form. It is the
+     * one place the keyword expresses something `#` cannot.
+     */
     private constructor();
     /** Authorized response (no status). */
     static allow(): AuthorizationResponse;

package/dist/bouncer/AuthorizationResponse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthorizationResponse.d.ts","sourceRoot":"","sources":["../../src/bouncer/AuthorizationResponse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,qBAAa,qBAAqB;IACjC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,WAAW,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IAErE,OAAO;IAMP,uCAAuC;IACvC,MAAM,CAAC,KAAK,IAAI,qBAAqB;IAIrC;;;;OAIG;IACH,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,qBAAqB;IAIrE;;;OAGG;IACH,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;CAI3D"}
+{"version":3,"file":"AuthorizationResponse.d.ts","sourceRoot":"","sources":["../../src/bouncer/AuthorizationResponse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,qBAAa,qBAAqB;IACjC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,WAAW,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IAErE;;;;;OAKG;IACH,OAAO;IAMP,uCAAuC;IACvC,MAAM,CAAC,KAAK,IAAI,qBAAqB;IAIrC;;;;OAIG;IACH,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,qBAAqB;IAIrE;;;OAGG;IACH,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;CAI3D"}

package/dist/bouncer/AuthorizationResponse.js

@@ -14,6 +14,12 @@ export class AuthorizationResponse {
     status;
     /** i18n binding set via {@link t} (Adonis `AuthorizationResponse.t`). */
     translation;
+    /**
+     * Private because a response is only ever built through allow() / deny(), so the pair stays consistent.
+     *
+     * `private` and not `#`: a private CONSTRUCTOR has no native form. It is the
+     * one place the keyword expresses something `#` cannot.
+     */
     constructor(authorized, message, status) {
         this.authorized = authorized;
         this.message = message;

package/dist/bouncer/AuthorizationResponse.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthorizationResponse.js","sourceRoot":"","sources":["../../src/bouncer/AuthorizationResponse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,OAAO,qBAAqB;IACxB,UAAU,CAAU;IAC7B,OAAO,CAAU;IACjB,MAAM,CAAU;IAChB,yEAAyE;IACzE,WAAW,CAA0D;IAErE,YAAoB,UAAmB,EAAE,OAAgB,EAAE,MAAe;QACzE,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACtB,CAAC;IAED,uCAAuC;IACvC,MAAM,CAAC,KAAK;QACX,OAAO,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,IAAI,CAAC,OAAgB,EAAE,MAAe;QAC5C,OAAO,IAAI,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1D,CAAC;IAED;;;OAGG;IACH,CAAC,CAAC,UAAkB,EAAE,IAA8B;QACnD,IAAI,CAAC,WAAW,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACb,CAAC;CACD"}
+{"version":3,"file":"AuthorizationResponse.js","sourceRoot":"","sources":["../../src/bouncer/AuthorizationResponse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,OAAO,qBAAqB;IACxB,UAAU,CAAU;IAC7B,OAAO,CAAU;IACjB,MAAM,CAAU;IAChB,yEAAyE;IACzE,WAAW,CAA0D;IAErE;;;;;OAKG;IACH,YAAoB,UAAmB,EAAE,OAAgB,EAAE,MAAe;QACzE,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACtB,CAAC;IAED,uCAAuC;IACvC,MAAM,CAAC,KAAK;QACX,OAAO,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,IAAI,CAAC,OAAgB,EAAE,MAAe;QAC5C,OAAO,IAAI,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1D,CAAC;IAED;;;OAGG;IACH,CAAC,CAAC,UAAkB,EAAE,IAA8B;QACnD,IAAI,CAAC,WAAW,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACb,CAAC;CACD"}

package/dist/index.d.ts

@@ -3,6 +3,7 @@
  * @description Warden — Authentication & authorization for the Ream framework
  * @implements FR48, FR49, FR50, FR51, FR52, FR53
  */
+import "./augmentations.js";
 export type { AuthAttempt, ExtractedCredentials } from "./Authenticator.js";
 export { API_KEY_GUARD_NAMES, Authenticator, extractCredentials, GuardAccessor, } from "./Authenticator.js";
 export type { AuthConfig, AuthResult, AuthStrategy, UserPayload, } from "./AuthManager.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,YAAY,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EACN,mBAAmB,EACnB,aAAa,EACb,kBAAkB,EAClB,aAAa,GACb,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACX,UAAU,EACV,UAAU,EACV,YAAY,EACZ,WAAW,GACX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACN,WAAW,EACX,eAAe,EACf,KAAK,aAAa,GAClB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EACN,MAAM,EACN,UAAU,EACV,iBAAiB,GACjB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtE,YAAY,EACX,OAAO,EACP,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,uBAAuB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EACN,WAAW,EACX,cAAc,EACd,YAAY,EACZ,QAAQ,EACR,YAAY,GACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EACN,qBAAqB,EACrB,qBAAqB,EACrB,WAAW,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,YAAY,EACX,kBAAkB,EAClB,WAAW,EACX,UAAU,EACV,SAAS,GACT,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACN,KAAK,EACL,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,EACf,UAAU,EACV,UAAU,EACV,IAAI,GACJ,MAAM,YAAY,CAAC;AACpB,YAAY,EACX,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,GACtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,YAAY,EACX,SAAS,EACT,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,gBAAgB,GAChB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACvE,YAAY,EACX,YAAY,EACZ,iBAAiB,EACjB,SAAS,EACT,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,eAAe,GACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAC5E,YAAY,EACX,aAAa,EACb,UAAU,EACV,cAAc,EACd,eAAe,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC5E,YAAY,EACX,yBAAyB,EACzB,0BAA0B,EAC1B,uBAAuB,EACvB,wBAAwB,EACxB,aAAa,EACb,sBAAsB,EACtB,cAAc,EACd,uBAAuB,EACvB,YAAY,GACZ,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACN,4BAA4B,EAC5B,6BAA6B,EAC7B,gBAAgB,GAChB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,YAAY,EACX,oBAAoB,EACpB,eAAe,GACf,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,YAAY,EACX,kBAAkB,EAClB,kBAAkB,GAClB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACN,oBAAoB,EACpB,wBAAwB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACN,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,2BAA2B,EAC3B,KAAK,qBAAqB,EAC1B,mBAAmB,EACnB,eAAe,EACf,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,iBAAiB,EACjB,+BAA+B,GAC/B,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACX,qBAAqB,EACrB,wBAAwB,GACxB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,YAAY,EACX,oBAAoB,EACpB,WAAW,EACX,KAAK,GACL,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,YAAY,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,YAAY,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EACN,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,WAAW,GACX,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC7E,YAAY,EACX,YAAY,EACZ,qBAAqB,GACrB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,oBAAoB,CAAC;AAE5B,YAAY,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EACN,mBAAmB,EACnB,aAAa,EACb,kBAAkB,EAClB,aAAa,GACb,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACX,UAAU,EACV,UAAU,EACV,YAAY,EACZ,WAAW,GACX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACN,WAAW,EACX,eAAe,EACf,KAAK,aAAa,GAClB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EACN,MAAM,EACN,UAAU,EACV,iBAAiB,GACjB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtE,YAAY,EACX,OAAO,EACP,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,uBAAuB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EACN,WAAW,EACX,cAAc,EACd,YAAY,EACZ,QAAQ,EACR,YAAY,GACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EACN,qBAAqB,EACrB,qBAAqB,EACrB,WAAW,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,YAAY,EACX,kBAAkB,EAClB,WAAW,EACX,UAAU,EACV,SAAS,GACT,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACN,KAAK,EACL,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,EACf,UAAU,EACV,UAAU,EACV,IAAI,GACJ,MAAM,YAAY,CAAC;AACpB,YAAY,EACX,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,GACtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,YAAY,EACX,SAAS,EACT,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,gBAAgB,GAChB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACvE,YAAY,EACX,YAAY,EACZ,iBAAiB,EACjB,SAAS,EACT,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,eAAe,GACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAC5E,YAAY,EACX,aAAa,EACb,UAAU,EACV,cAAc,EACd,eAAe,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC5E,YAAY,EACX,yBAAyB,EACzB,0BAA0B,EAC1B,uBAAuB,EACvB,wBAAwB,EACxB,aAAa,EACb,sBAAsB,EACtB,cAAc,EACd,uBAAuB,EACvB,YAAY,GACZ,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACN,4BAA4B,EAC5B,6BAA6B,EAC7B,gBAAgB,GAChB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,YAAY,EACX,oBAAoB,EACpB,eAAe,GACf,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,YAAY,EACX,kBAAkB,EAClB,kBAAkB,GAClB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACN,oBAAoB,EACpB,wBAAwB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACN,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,2BAA2B,EAC3B,KAAK,qBAAqB,EAC1B,mBAAmB,EACnB,eAAe,EACf,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,iBAAiB,EACjB,+BAA+B,GAC/B,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACX,qBAAqB,EACrB,wBAAwB,GACxB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,YAAY,EACX,oBAAoB,EACpB,WAAW,EACX,KAAK,GACL,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,YAAY,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,YAAY,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EACN,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,WAAW,GACX,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC7E,YAAY,EACX,YAAY,EACZ,qBAAqB,GACrB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/index.js

@@ -3,6 +3,7 @@
  * @description Warden — Authentication & authorization for the Ream framework
  * @implements FR48, FR49, FR50, FR51, FR52, FR53
  */
+import "./augmentations.js";
 export { API_KEY_GUARD_NAMES, Authenticator, extractCredentials, GuardAccessor, } from "./Authenticator.js";
 export { AuthManager, authEventPrefix, } from "./AuthManager.js";
 export { AuthRateLimiter } from "./AuthRateLimiter.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACN,mBAAmB,EACnB,aAAa,EACb,kBAAkB,EAClB,aAAa,GACb,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EACN,WAAW,EACX,eAAe,GAEf,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EACN,MAAM,EACN,UAAU,EACV,iBAAiB,GACjB,MAAM,yBAAyB,CAAC;AAWjC,OAAO,EACN,WAAW,EACX,cAAc,EACd,YAAY,EACZ,QAAQ,EACR,YAAY,GACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EACN,qBAAqB,EACrB,qBAAqB,EACrB,WAAW,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAO5E,OAAO,EACN,KAAK,EACL,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,EACf,UAAU,EACV,UAAU,EACV,IAAI,GACJ,MAAM,YAAY,CAAC;AAMpB,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAQnE,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAUvE,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAO5E,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAY5E,OAAO,EACN,4BAA4B,EAC5B,6BAA6B,EAC7B,gBAAgB,GAChB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAK/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAKjE,OAAO,EACN,oBAAoB,EACpB,wBAAwB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACN,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,2BAA2B,EAE3B,mBAAmB,EACnB,eAAe,EAGf,iBAAiB,EACjB,+BAA+B,GAC/B,MAAM,sBAAsB,CAAC;AAK9B,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAM5D,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAEhE,OAAO,EACN,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,WAAW,GACX,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAK7E,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAElE,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,oBAAoB,CAAC;AAG5B,OAAO,EACN,mBAAmB,EACnB,aAAa,EACb,kBAAkB,EAClB,aAAa,GACb,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EACN,WAAW,EACX,eAAe,GAEf,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EACN,MAAM,EACN,UAAU,EACV,iBAAiB,GACjB,MAAM,yBAAyB,CAAC;AAWjC,OAAO,EACN,WAAW,EACX,cAAc,EACd,YAAY,EACZ,QAAQ,EACR,YAAY,GACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EACN,qBAAqB,EACrB,qBAAqB,EACrB,WAAW,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAO5E,OAAO,EACN,KAAK,EACL,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,EACf,UAAU,EACV,UAAU,EACV,IAAI,GACJ,MAAM,YAAY,CAAC;AAMpB,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAQnE,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAUvE,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAO5E,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAY5E,OAAO,EACN,4BAA4B,EAC5B,6BAA6B,EAC7B,gBAAgB,GAChB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAK/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAKjE,OAAO,EACN,oBAAoB,EACpB,wBAAwB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACN,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,2BAA2B,EAE3B,mBAAmB,EACnB,eAAe,EAGf,iBAAiB,EACjB,+BAA+B,GAC/B,MAAM,sBAAsB,CAAC;AAK9B,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAM5D,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAEhE,OAAO,EACN,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,WAAW,GACX,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAK7E,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAElE,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/rights/MemoryRightsStore.d.ts

@@ -12,12 +12,7 @@
  */
 import { type RightsStore, type Scope } from "./types.js";
 export declare class MemoryRightsStore implements RightsStore {
-    /** scopeKey → role → permissions */
-    private readonly roleDefs;
-    /** scopeKey → userId → roles */
-    private readonly userRoleMap;
-    /** scopeKey → userId → directly granted permissions */
-    private readonly userGrantMap;
+    #private;
     rolePermissions(role: string, scope: Scope): Promise<readonly string[]>;
     userRoles(userId: string, scope: Scope): Promise<readonly string[]>;
     userGrants(userId: string, scope: Scope): Promise<readonly string[]>;

package/dist/rights/MemoryRightsStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MemoryRightsStore.d.ts","sourceRoot":"","sources":["../../src/rights/MemoryRightsStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,KAAK,WAAW,EAAE,KAAK,KAAK,EAAY,MAAM,YAAY,CAAC;AAEpE,qBAAa,iBAAkB,YAAW,WAAW;IACpD,oCAAoC;IACpC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+C;IACxE,gCAAgC;IAChC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA+C;IAC3E,uDAAuD;IACvD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA+C;IAItE,eAAe,CACpB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,KAAK,GACV,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;IAIvB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;IAInE,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;IAM1E,UAAU,CACT,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,KAAK,GAAE,KAAgB,GACrB,IAAI;IAOP,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,GAAE,KAAgB,GAAG,IAAI;IAKvE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,GAAE,KAAgB,GAAG,IAAI;IAKxE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,GAAE,KAAgB,GAAG,IAAI;CAIzE"}
+{"version":3,"file":"MemoryRightsStore.d.ts","sourceRoot":"","sources":["../../src/rights/MemoryRightsStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,KAAK,WAAW,EAAE,KAAK,KAAK,EAAY,MAAM,YAAY,CAAC;AAEpE,qBAAa,iBAAkB,YAAW,WAAW;;IAU9C,eAAe,CACpB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,KAAK,GACV,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;IAIvB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;IAInE,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;IAM1E,UAAU,CACT,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,KAAK,GAAE,KAAgB,GACrB,IAAI;IAOP,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,GAAE,KAAgB,GAAG,IAAI;IAKvE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,GAAE,KAAgB,GAAG,IAAI;IAKxE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,GAAE,KAAgB,GAAG,IAAI;CAIzE"}

package/dist/rights/MemoryRightsStore.js

@@ -13,39 +13,39 @@
 import { scopeKey } from "./types.js";
 export class MemoryRightsStore {
     /** scopeKey → role → permissions */
-    roleDefs = new Map();
+    #roleDefs = new Map();
     /** scopeKey → userId → roles */
-    userRoleMap = new Map();
+    #userRoleMap = new Map();
     /** scopeKey → userId → directly granted permissions */
-    userGrantMap = new Map();
+    #userGrantMap = new Map();
     // — read contract —
     async rolePermissions(role, scope) {
-        return snapshot(this.roleDefs.get(scopeKey(scope))?.get(role));
+        return snapshot(this.#roleDefs.get(scopeKey(scope))?.get(role));
     }
     async userRoles(userId, scope) {
-        return snapshot(this.userRoleMap.get(scopeKey(scope))?.get(userId));
+        return snapshot(this.#userRoleMap.get(scopeKey(scope))?.get(userId));
     }
     async userGrants(userId, scope) {
-        return snapshot(this.userGrantMap.get(scopeKey(scope))?.get(userId));
+        return snapshot(this.#userGrantMap.get(scopeKey(scope))?.get(userId));
     }
     // — seeding (in-memory driver only; not part of RightsStore) —
     defineRole(role, permissions, scope = "global") {
-        const set = bucket(this.roleDefs, scopeKey(scope), role);
+        const set = bucket(this.#roleDefs, scopeKey(scope), role);
         set.clear();
         for (const perm of permissions)
             set.add(perm);
         return this;
     }
     assignRole(userId, role, scope = "global") {
-        bucket(this.userRoleMap, scopeKey(scope), userId).add(role);
+        bucket(this.#userRoleMap, scopeKey(scope), userId).add(role);
         return this;
     }
     grant(userId, permission, scope = "global") {
-        bucket(this.userGrantMap, scopeKey(scope), userId).add(permission);
+        bucket(this.#userGrantMap, scopeKey(scope), userId).add(permission);
         return this;
     }
     revoke(userId, permission, scope = "global") {
-        this.userGrantMap.get(scopeKey(scope))?.get(userId)?.delete(permission);
+        this.#userGrantMap.get(scopeKey(scope))?.get(userId)?.delete(permission);
         return this;
     }
 }

package/dist/rights/MemoryRightsStore.js.map

@@ -1 +1 @@
-{"version":3,"file":"MemoryRightsStore.js","sourceRoot":"","sources":["../../src/rights/MemoryRightsStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAgC,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEpE,MAAM,OAAO,iBAAiB;IAC7B,oCAAoC;IACnB,QAAQ,GAAG,IAAI,GAAG,EAAoC,CAAC;IACxE,gCAAgC;IACf,WAAW,GAAG,IAAI,GAAG,EAAoC,CAAC;IAC3E,uDAAuD;IACtC,YAAY,GAAG,IAAI,GAAG,EAAoC,CAAC;IAE5E,oBAAoB;IAEpB,KAAK,CAAC,eAAe,CACpB,IAAY,EACZ,KAAY;QAEZ,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,MAAc,EAAE,KAAY;QAC3C,OAAO,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,KAAY;QAC5C,OAAO,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,+DAA+D;IAE/D,UAAU,CACT,IAAY,EACZ,WAA8B,EAC9B,QAAe,QAAQ;QAEvB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;QACzD,GAAG,CAAC,KAAK,EAAE,CAAC;QACZ,KAAK,MAAM,IAAI,IAAI,WAAW;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC;IACb,CAAC;IAED,UAAU,CAAC,MAAc,EAAE,IAAY,EAAE,QAAe,QAAQ;QAC/D,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC;IACb,CAAC;IAED,KAAK,CAAC,MAAc,EAAE,UAAkB,EAAE,QAAe,QAAQ;QAChE,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACnE,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,CAAC,MAAc,EAAE,UAAkB,EAAE,QAAe,QAAQ;QACjE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC;IACb,CAAC;CACD;AAED,sFAAsF;AACtF,SAAS,QAAQ,CAAC,GAA4B;IAC7C,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5B,CAAC;AAED,6DAA6D;AAC7D,SAAS,MAAM,CACd,KAA4C,EAC5C,GAAW,EACX,KAAa;IAEb,IAAI,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,GAAG,GAAG,IAAI,GAAG,EAAuB,CAAC;QACrC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACrB,CAAC;IACD,IAAI,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;QACxB,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC"}
+{"version":3,"file":"MemoryRightsStore.js","sourceRoot":"","sources":["../../src/rights/MemoryRightsStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAgC,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEpE,MAAM,OAAO,iBAAiB;IAC7B,oCAAoC;IAC3B,SAAS,GAAG,IAAI,GAAG,EAAoC,CAAC;IACjE,gCAAgC;IACvB,YAAY,GAAG,IAAI,GAAG,EAAoC,CAAC;IACpE,uDAAuD;IAC9C,aAAa,GAAG,IAAI,GAAG,EAAoC,CAAC;IAErE,oBAAoB;IAEpB,KAAK,CAAC,eAAe,CACpB,IAAY,EACZ,KAAY;QAEZ,OAAO,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,MAAc,EAAE,KAAY;QAC3C,OAAO,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,KAAY;QAC5C,OAAO,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,+DAA+D;IAE/D,UAAU,CACT,IAAY,EACZ,WAA8B,EAC9B,QAAe,QAAQ;QAEvB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;QAC1D,GAAG,CAAC,KAAK,EAAE,CAAC;QACZ,KAAK,MAAM,IAAI,IAAI,WAAW;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC;IACb,CAAC;IAED,UAAU,CAAC,MAAc,EAAE,IAAY,EAAE,QAAe,QAAQ;QAC/D,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC;IACb,CAAC;IAED,KAAK,CAAC,MAAc,EAAE,UAAkB,EAAE,QAAe,QAAQ;QAChE,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,CAAC,MAAc,EAAE,UAAkB,EAAE,QAAe,QAAQ;QACjE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QACzE,OAAO,IAAI,CAAC;IACb,CAAC;CACD;AAED,sFAAsF;AACtF,SAAS,QAAQ,CAAC,GAA4B;IAC7C,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5B,CAAC;AAED,6DAA6D;AAC7D,SAAS,MAAM,CACd,KAA4C,EAC5C,GAAW,EACX,KAAa;IAEb,IAAI,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,GAAG,GAAG,IAAI,GAAG,EAAuB,CAAC;QACrC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACrB,CAAC;IACD,IAAI,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;QACxB,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@c9up/warden",
-  "version": "0.1.19",
+  "version": "0.1.21",
   "description": "Warden — Authentication & authorization for the Ream framework",
   "license": "MIT",
   "type": "module",
@@ -49,7 +49,7 @@
     }
   },
   "peerDependencies": {
-    "@c9up/ream": "^0.1.10",
+    "@c9up/ream": "^0.2.0",
     "@c9up/quasar": "^0.1.0"
   },
   "peerDependenciesMeta": {
@@ -61,6 +61,7 @@
     }
   },
   "devDependencies": {
+    "@c9up/ream": "^0.2.0",
     "@biomejs/biome": "^2.4.10",
     "@c9up/quasar": "^0.1.0",
     "@types/node": "^22.19.15",

package/src/AuthManager.ts

@@ -146,9 +146,9 @@ export interface WardenEmitter {
 export class AuthManager {
 	// AdonisJS names: `guards` (name → strategy) and `default` (the guard used
 	// when none is named). Renamed from the previous `strategies`/`defaultStrategy`.
-	private guards: Map<string, AuthStrategy> = new Map();
-	private default: string;
-	private readonly rights: RightsResolver;
+	#guards: Map<string, AuthStrategy> = new Map();
+	#default: string;
+	readonly #rights: RightsResolver;
 
 	/**
 	 * Where auth events go. Structural and optional: warden is a leaf and must
@@ -195,10 +195,10 @@ export class AuthManager {
 				"AuthManager: config must supply `default` + `guards` (or the legacy `defaultStrategy` + `strategies`).",
 			);
 		}
-		this.default = defaultGuard;
-		this.rights = config.rights ?? new RightsResolver(new MemoryRightsStore());
+		this.#default = defaultGuard;
+		this.#rights = config.rights ?? new RightsResolver(new MemoryRightsStore());
 		for (const [name, strategy] of Object.entries(guards)) {
-			this.guards.set(name, strategy);
+			this.#guards.set(name, strategy);
 		}
 		// Fail-fast at construction: an AuthManager with zero guards is a
 		// configuration bug. Previously, an empty `guards: {}` passed the
@@ -206,13 +206,13 @@ export class AuthManager {
 		// runtime when `getStrategy('jwt')` threw — opaque 401 or 500 instead
 		// of a boot-time INVALID_CONFIG that points the operator at the missing
 		// `config.auth.jwt` (or other guard).
-		if (this.guards.size === 0) {
+		if (this.#guards.size === 0) {
 			throw new WardenError(
 				"INVALID_CONFIG",
 				`AuthManager: no authentication guards registered. Configure at least one guard (e.g. config.warden.auth.jwt) before booting WardenProvider.`,
 			);
 		}
-		if (!this.guards.has(defaultGuard)) {
+		if (!this.#guards.has(defaultGuard)) {
 			throw new WardenError(
 				"INVALID_CONFIG",
 				`default guard '${defaultGuard}' is not present in guards`,
@@ -285,7 +285,7 @@ export class AuthManager {
 		if (!isTokenIssuer(strategy)) {
 			throw new WardenError(
 				"STRATEGY_CANNOT_ISSUE",
-				`Auth strategy '${strategyName ?? this.default}' cannot issue tokens.`,
+				`Auth strategy '${strategyName ?? this.#default}' cannot issue tokens.`,
 				{
 					hint: "issueFor() needs a token-minting strategy (e.g. JwtStrategy with signToken). Session / API-key strategies don't mint tokens.",
 				},
@@ -306,7 +306,7 @@ export class AuthManager {
 		user: UserPayload,
 		scope: Scope = "global",
 	): Promise<EffectivePermissions> {
-		return this.rights.resolve(user, scope);
+		return this.#rights.resolve(user, scope);
 	}
 
 	/**
@@ -381,7 +381,7 @@ export class AuthManager {
 				if (!seam) {
 					throw new WardenError(
 						"STRATEGY_HAS_NO_CLIENT",
-						`Auth strategy '${guard ?? this.default}' has no authenticateAsClient() — it cannot forge a client request.`,
+						`Auth strategy '${guard ?? this.#default}' has no authenticateAsClient() — it cannot forge a client request.`,
 						{
 							hint: "Implement authenticateAsClient() on the strategy, or authenticate through a real login in the test.",
 						},
@@ -406,8 +406,8 @@ export class AuthManager {
 	}
 
 	getStrategy(name?: string): AuthStrategy {
-		const strategyName = name ?? this.default;
-		const strategy = this.guards.get(strategyName);
+		const strategyName = name ?? this.#default;
+		const strategy = this.#guards.get(strategyName);
 		if (!strategy) {
 			throw new WardenError(
 				"STRATEGY_NOT_FOUND",
@@ -426,17 +426,17 @@ export class AuthManager {
 	 * declares none.
 	 */
 	get defaultStrategyName(): string {
-		return this.default;
+		return this.#default;
 	}
 
 	/** Register a new strategy at runtime. */
 	registerStrategy(name: string, strategy: AuthStrategy): void {
-		this.guards.set(name, strategy);
+		this.#guards.set(name, strategy);
 	}
 
 	/** Get all registered strategy names. */
 	getStrategyNames(): string[] {
-		return [...this.guards.keys()];
+		return [...this.#guards.keys()];
 	}
 
 	/**
@@ -458,7 +458,7 @@ export class AuthManager {
 		if (!isLoginCapable(strategy)) {
 			throw new WardenError(
 				"STRATEGY_CANNOT_LOGIN",
-				`Auth strategy '${strategyName ?? this.default}' does not support session login.`,
+				`Auth strategy '${strategyName ?? this.#default}' does not support session login.`,
 				{
 					hint: "login()/logout() need a stateful guard (e.g. SessionStrategy). JWT / API-key guards are stateless — mint a token with issueFor() instead.",
 				},
@@ -466,12 +466,12 @@ export class AuthManager {
 		}
 		const prefix = authEventPrefix(strategy.name);
 		this.#emit(`${prefix}:login_attempted`, {
-			guardName: strategyName ?? this.default,
+			guardName: strategyName ?? this.#default,
 			user,
 		});
 		await strategy.login(user, session);
 		this.#emit(`${prefix}:login_succeeded`, {
-			guardName: strategyName ?? this.default,
+			guardName: strategyName ?? this.#default,
 			user,
 			sessionId: undefined,
 		});
@@ -487,12 +487,12 @@ export class AuthManager {
 		if (!isLoginCapable(strategy)) {
 			throw new WardenError(
 				"STRATEGY_CANNOT_LOGIN",
-				`Auth strategy '${strategyName ?? this.default}' does not support session logout.`,
+				`Auth strategy '${strategyName ?? this.#default}' does not support session logout.`,
 			);
 		}
 		await strategy.logout(session);
 		this.#emit(`${authEventPrefix(strategy.name)}:logged_out`, {
-			guardName: strategyName ?? this.default,
+			guardName: strategyName ?? this.#default,
 			user: null,
 			error: null,
 		});

package/src/AuthRateLimiter.ts

@@ -17,16 +17,16 @@ interface AttemptEntry {
 }
 
 export class AuthRateLimiter {
-	private maxAttempts: number;
-	private window: number;
-	private store: Map<string, AttemptEntry> = new Map();
-	private maxStoreSize = 100_000;
+	#maxAttempts: number;
+	#window: number;
+	#store: Map<string, AttemptEntry> = new Map();
+	#maxStoreSize = 100_000;
 
 	constructor(config?: AuthRateLimiterConfig) {
-		this.maxAttempts = config?.maxAttempts ?? 5;
-		if (this.maxAttempts <= 0) this.maxAttempts = 1;
-		this.window = (config?.windowSeconds ?? 900) * 1000;
-		if (this.window <= 0) this.window = 900_000; // prevent bypass via 0/negative
+		this.#maxAttempts = config?.maxAttempts ?? 5;
+		if (this.#maxAttempts <= 0) this.#maxAttempts = 1;
+		this.#window = (config?.windowSeconds ?? 900) * 1000;
+		if (this.#window <= 0) this.#window = 900_000; // prevent bypass via 0/negative
 	}
 
 	/** Check if an attempt is allowed. Returns false if rate limited. */
@@ -38,7 +38,7 @@ export class AuthRateLimiter {
 		const ipKey = `ip:${ipNorm}`;
 		const idKey = `id:${identifierNorm}`;
 
-		return this.checkKey(ipKey, now) && this.checkKey(idKey, now);
+		return this.#checkKey(ipKey, now) && this.#checkKey(idKey, now);
 	}
 
 	/** Record a failed attempt. */
@@ -46,51 +46,51 @@ export class AuthRateLimiter {
 		const now = Date.now();
 		const ipNorm = normalizeIp(ip);
 		const identifierNorm = normalizeIdentifier(identifier);
-		this.increment(`ip:${ipNorm}`, now);
-		this.increment(`id:${identifierNorm}`, now);
+		this.#increment(`ip:${ipNorm}`, now);
+		this.#increment(`id:${identifierNorm}`, now);
 	}
 
 	/** Reset counters on successful login. */
 	recordSuccess(ip: string, identifier: string): void {
 		const ipNorm = normalizeIp(ip);
 		const identifierNorm = normalizeIdentifier(identifier);
-		this.store.delete(`ip:${ipNorm}`);
-		this.store.delete(`id:${identifierNorm}`);
+		this.#store.delete(`ip:${ipNorm}`);
+		this.#store.delete(`id:${identifierNorm}`);
 	}
 
 	/** Get remaining attempts for an identifier. */
 	remaining(ip: string, identifier: string): number {
 		const ipNorm = normalizeIp(ip);
 		const identifierNorm = normalizeIdentifier(identifier);
-		const ipEntry = this.store.get(`ip:${ipNorm}`);
-		const idEntry = this.store.get(`id:${identifierNorm}`);
+		const ipEntry = this.#store.get(`ip:${ipNorm}`);
+		const idEntry = this.#store.get(`id:${identifierNorm}`);
 		const ipRemaining = ipEntry
-			? Math.max(0, this.maxAttempts - ipEntry.count)
-			: this.maxAttempts;
+			? Math.max(0, this.#maxAttempts - ipEntry.count)
+			: this.#maxAttempts;
 		const idRemaining = idEntry
-			? Math.max(0, this.maxAttempts - idEntry.count)
-			: this.maxAttempts;
+			? Math.max(0, this.#maxAttempts - idEntry.count)
+			: this.#maxAttempts;
 		return Math.min(ipRemaining, idRemaining);
 	}
 
-	private checkKey(key: string, now: number): boolean {
-		const entry = this.store.get(key);
+	#checkKey(key: string, now: number): boolean {
+		const entry = this.#store.get(key);
 		if (!entry || entry.resetAt < now) return true;
-		return entry.count < this.maxAttempts;
+		return entry.count < this.#maxAttempts;
 	}
 
-	private increment(key: string, now: number): void {
+	#increment(key: string, now: number): void {
 		// Evict expired entries when store grows too large (prevent OOM)
-		if (this.store.size > this.maxStoreSize) {
-			for (const [k, v] of this.store) {
-				if (v.resetAt < now) this.store.delete(k);
+		if (this.#store.size > this.#maxStoreSize) {
+			for (const [k, v] of this.#store) {
+				if (v.resetAt < now) this.#store.delete(k);
 			}
 		}
 
-		let entry = this.store.get(key);
+		let entry = this.#store.get(key);
 		if (!entry || entry.resetAt < now) {
-			entry = { count: 0, resetAt: now + this.window };
-			this.store.set(key, entry);
+			entry = { count: 0, resetAt: now + this.#window };
+			this.#store.set(key, entry);
 		}
 		entry.count++;
 	}

package/src/RefreshTokenStore.ts

@@ -27,36 +27,36 @@ export interface RefreshTokenDriver {
 
 /** In-memory driver for development. */
 export class MemoryRefreshTokenDriver implements RefreshTokenDriver {
-	private tokens: Map<string, StoredRefreshToken> = new Map();
+	#tokens: Map<string, StoredRefreshToken> = new Map();
 
 	async store(token: StoredRefreshToken): Promise<void> {
-		this.tokens.set(token.token, token);
+		this.#tokens.set(token.token, token);
 	}
 
 	async find(token: string): Promise<StoredRefreshToken | null> {
-		const stored = this.tokens.get(token);
+		const stored = this.#tokens.get(token);
 		if (!stored) return null;
 		if (stored.expiresAt < Date.now()) {
-			this.tokens.delete(token);
+			this.#tokens.delete(token);
 			return null;
 		}
 		return stored;
 	}
 
 	async revoke(token: string): Promise<void> {
-		this.tokens.delete(token);
+		this.#tokens.delete(token);
 	}
 
 	async revokeAllForUser(userId: string | number): Promise<void> {
-		for (const [key, val] of this.tokens) {
-			if (val.userId === userId) this.tokens.delete(key);
+		for (const [key, val] of this.#tokens) {
+			if (val.userId === userId) this.#tokens.delete(key);
 		}
 	}
 
 	async cleanup(): Promise<void> {
 		const now = Date.now();
-		for (const [key, val] of this.tokens) {
-			if (val.expiresAt < now) this.tokens.delete(key);
+		for (const [key, val] of this.#tokens) {
+			if (val.expiresAt < now) this.#tokens.delete(key);
 		}
 	}
 }

package/src/TokenBlacklist.ts

@@ -18,17 +18,17 @@ export interface BlacklistDriver {
 
 /** In-memory blacklist for development. */
 export class MemoryBlacklistDriver implements BlacklistDriver {
-	private entries: Map<string, number> = new Map();
+	#entries: Map<string, number> = new Map();
 
 	async add(jti: string, expiresAt: number): Promise<void> {
-		this.entries.set(jti, expiresAt);
+		this.#entries.set(jti, expiresAt);
 	}
 
 	async has(jti: string): Promise<boolean> {
-		const expiresAt = this.entries.get(jti);
+		const expiresAt = this.#entries.get(jti);
 		if (expiresAt === undefined) return false;
 		if (expiresAt < Date.now()) {
-			this.entries.delete(jti);
+			this.#entries.delete(jti);
 			return false;
 		}
 		return true;
@@ -36,8 +36,8 @@ export class MemoryBlacklistDriver implements BlacklistDriver {
 
 	async cleanup(): Promise<void> {
 		const now = Date.now();
-		for (const [jti, exp] of this.entries) {
-			if (exp < now) this.entries.delete(jti);
+		for (const [jti, exp] of this.#entries) {
+			if (exp < now) this.#entries.delete(jti);
 		}
 	}
 }

package/src/augmentations.ts

@@ -0,0 +1,25 @@
+/**
+ * Teach ream's `Authenticators` interface what `ctx.auth.use(name)` returns.
+ *
+ * ream declares that interface empty on purpose — it owns no auth package, so
+ * it cannot know an application's guards, and `use()` falls back to `unknown`
+ * until something fills it in. Warden is that something.
+ *
+ * An index signature rather than an enumeration of names, because that is the
+ * truth here: `Authenticator.use()` accepts any guard name and always hands
+ * back a `GuardAccessor`. AdonisJS enumerates instead, since each of its
+ * guards has a distinct type; warden's do not.
+ *
+ * Loaded from the package barrel, so importing warden anywhere in the app is
+ * enough — an application writes no `declare module` of its own.
+ */
+
+// Referenced so the augmentation below resolves the module it augments.
+import type {} from "@c9up/ream/types";
+import type { GuardAccessor } from "./Authenticator.js";
+
+declare module "@c9up/ream/types" {
+	interface Authenticators {
+		[guardName: string]: GuardAccessor;
+	}
+}

package/src/bouncer/AuthorizationResponse.ts

@@ -15,6 +15,12 @@ export class AuthorizationResponse {
 	/** i18n binding set via {@link t} (Adonis `AuthorizationResponse.t`). */
 	translation?: { identifier: string; data?: Record<string, unknown> };
 
+	/**
+	 * Private because a response is only ever built through allow() / deny(), so the pair stays consistent.
+	 *
+	 * `private` and not `#`: a private CONSTRUCTOR has no native form. It is the
+	 * one place the keyword expresses something `#` cannot.
+	 */
 	private constructor(authorized: boolean, message?: string, status?: number) {
 		this.authorized = authorized;
 		this.message = message;

package/src/index.ts

@@ -4,6 +4,8 @@
  * @implements FR48, FR49, FR50, FR51, FR52, FR53
  */
 
+import "./augmentations.js";
+
 export type { AuthAttempt, ExtractedCredentials } from "./Authenticator.js";
 export {
 	API_KEY_GUARD_NAMES,

package/src/rights/MemoryRightsStore.ts

@@ -15,11 +15,11 @@ import { type RightsStore, type Scope, scopeKey } from "./types.js";
 
 export class MemoryRightsStore implements RightsStore {
 	/** scopeKey → role → permissions */
-	private readonly roleDefs = new Map<string, Map<string, Set<string>>>();
+	readonly #roleDefs = new Map<string, Map<string, Set<string>>>();
 	/** scopeKey → userId → roles */
-	private readonly userRoleMap = new Map<string, Map<string, Set<string>>>();
+	readonly #userRoleMap = new Map<string, Map<string, Set<string>>>();
 	/** scopeKey → userId → directly granted permissions */
-	private readonly userGrantMap = new Map<string, Map<string, Set<string>>>();
+	readonly #userGrantMap = new Map<string, Map<string, Set<string>>>();
 
 	// — read contract —
 
@@ -27,15 +27,15 @@ export class MemoryRightsStore implements RightsStore {
 		role: string,
 		scope: Scope,
 	): Promise<readonly string[]> {
-		return snapshot(this.roleDefs.get(scopeKey(scope))?.get(role));
+		return snapshot(this.#roleDefs.get(scopeKey(scope))?.get(role));
 	}
 
 	async userRoles(userId: string, scope: Scope): Promise<readonly string[]> {
-		return snapshot(this.userRoleMap.get(scopeKey(scope))?.get(userId));
+		return snapshot(this.#userRoleMap.get(scopeKey(scope))?.get(userId));
 	}
 
 	async userGrants(userId: string, scope: Scope): Promise<readonly string[]> {
-		return snapshot(this.userGrantMap.get(scopeKey(scope))?.get(userId));
+		return snapshot(this.#userGrantMap.get(scopeKey(scope))?.get(userId));
 	}
 
 	// — seeding (in-memory driver only; not part of RightsStore) —
@@ -45,24 +45,24 @@ export class MemoryRightsStore implements RightsStore {
 		permissions: readonly string[],
 		scope: Scope = "global",
 	): this {
-		const set = bucket(this.roleDefs, scopeKey(scope), role);
+		const set = bucket(this.#roleDefs, scopeKey(scope), role);
 		set.clear();
 		for (const perm of permissions) set.add(perm);
 		return this;
 	}
 
 	assignRole(userId: string, role: string, scope: Scope = "global"): this {
-		bucket(this.userRoleMap, scopeKey(scope), userId).add(role);
+		bucket(this.#userRoleMap, scopeKey(scope), userId).add(role);
 		return this;
 	}
 
 	grant(userId: string, permission: string, scope: Scope = "global"): this {
-		bucket(this.userGrantMap, scopeKey(scope), userId).add(permission);
+		bucket(this.#userGrantMap, scopeKey(scope), userId).add(permission);
 		return this;
 	}
 
 	revoke(userId: string, permission: string, scope: Scope = "global"): this {
-		this.userGrantMap.get(scopeKey(scope))?.get(userId)?.delete(permission);
+		this.#userGrantMap.get(scopeKey(scope))?.get(userId)?.delete(permission);
 		return this;
 	}
 }