@c9up/warden 0.1.20 → 0.1.22

package/dist/rights/MemoryRightsStore.d.ts

@@ -12,12 +12,7 @@
  */
 import { type RightsStore, type Scope } from "./types.js";
 export declare class MemoryRightsStore implements RightsStore {
-    /** scopeKey → role → permissions */
-    private readonly roleDefs;
-    /** scopeKey → userId → roles */
-    private readonly userRoleMap;
-    /** scopeKey → userId → directly granted permissions */
-    private readonly userGrantMap;
+    #private;
     rolePermissions(role: string, scope: Scope): Promise<readonly string[]>;
     userRoles(userId: string, scope: Scope): Promise<readonly string[]>;
     userGrants(userId: string, scope: Scope): Promise<readonly string[]>;

package/dist/rights/MemoryRightsStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MemoryRightsStore.d.ts","sourceRoot":"","sources":["../../src/rights/MemoryRightsStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,KAAK,WAAW,EAAE,KAAK,KAAK,EAAY,MAAM,YAAY,CAAC;AAEpE,qBAAa,iBAAkB,YAAW,WAAW;IACpD,oCAAoC;IACpC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+C;IACxE,gCAAgC;IAChC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA+C;IAC3E,uDAAuD;IACvD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA+C;IAItE,eAAe,CACpB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,KAAK,GACV,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;IAIvB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;IAInE,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;IAM1E,UAAU,CACT,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,KAAK,GAAE,KAAgB,GACrB,IAAI;IAOP,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,GAAE,KAAgB,GAAG,IAAI;IAKvE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,GAAE,KAAgB,GAAG,IAAI;IAKxE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,GAAE,KAAgB,GAAG,IAAI;CAIzE"}
+{"version":3,"file":"MemoryRightsStore.d.ts","sourceRoot":"","sources":["../../src/rights/MemoryRightsStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,KAAK,WAAW,EAAE,KAAK,KAAK,EAAY,MAAM,YAAY,CAAC;AAEpE,qBAAa,iBAAkB,YAAW,WAAW;;IAU9C,eAAe,CACpB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,KAAK,GACV,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;IAIvB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;IAInE,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;IAM1E,UAAU,CACT,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,KAAK,GAAE,KAAgB,GACrB,IAAI;IAOP,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,GAAE,KAAgB,GAAG,IAAI;IAKvE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,GAAE,KAAgB,GAAG,IAAI;IAKxE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,GAAE,KAAgB,GAAG,IAAI;CAIzE"}

package/dist/rights/MemoryRightsStore.js

@@ -13,39 +13,39 @@
 import { scopeKey } from "./types.js";
 export class MemoryRightsStore {
     /** scopeKey → role → permissions */
-    roleDefs = new Map();
+    #roleDefs = new Map();
     /** scopeKey → userId → roles */
-    userRoleMap = new Map();
+    #userRoleMap = new Map();
     /** scopeKey → userId → directly granted permissions */
-    userGrantMap = new Map();
+    #userGrantMap = new Map();
     // — read contract —
     async rolePermissions(role, scope) {
-        return snapshot(this.roleDefs.get(scopeKey(scope))?.get(role));
+        return snapshot(this.#roleDefs.get(scopeKey(scope))?.get(role));
     }
     async userRoles(userId, scope) {
-        return snapshot(this.userRoleMap.get(scopeKey(scope))?.get(userId));
+        return snapshot(this.#userRoleMap.get(scopeKey(scope))?.get(userId));
     }
     async userGrants(userId, scope) {
-        return snapshot(this.userGrantMap.get(scopeKey(scope))?.get(userId));
+        return snapshot(this.#userGrantMap.get(scopeKey(scope))?.get(userId));
     }
     // — seeding (in-memory driver only; not part of RightsStore) —
     defineRole(role, permissions, scope = "global") {
-        const set = bucket(this.roleDefs, scopeKey(scope), role);
+        const set = bucket(this.#roleDefs, scopeKey(scope), role);
         set.clear();
         for (const perm of permissions)
             set.add(perm);
         return this;
     }
     assignRole(userId, role, scope = "global") {
-        bucket(this.userRoleMap, scopeKey(scope), userId).add(role);
+        bucket(this.#userRoleMap, scopeKey(scope), userId).add(role);
         return this;
     }
     grant(userId, permission, scope = "global") {
-        bucket(this.userGrantMap, scopeKey(scope), userId).add(permission);
+        bucket(this.#userGrantMap, scopeKey(scope), userId).add(permission);
         return this;
     }
     revoke(userId, permission, scope = "global") {
-        this.userGrantMap.get(scopeKey(scope))?.get(userId)?.delete(permission);
+        this.#userGrantMap.get(scopeKey(scope))?.get(userId)?.delete(permission);
         return this;
     }
 }

package/dist/rights/MemoryRightsStore.js.map

@@ -1 +1 @@
-{"version":3,"file":"MemoryRightsStore.js","sourceRoot":"","sources":["../../src/rights/MemoryRightsStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAgC,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEpE,MAAM,OAAO,iBAAiB;IAC7B,oCAAoC;IACnB,QAAQ,GAAG,IAAI,GAAG,EAAoC,CAAC;IACxE,gCAAgC;IACf,WAAW,GAAG,IAAI,GAAG,EAAoC,CAAC;IAC3E,uDAAuD;IACtC,YAAY,GAAG,IAAI,GAAG,EAAoC,CAAC;IAE5E,oBAAoB;IAEpB,KAAK,CAAC,eAAe,CACpB,IAAY,EACZ,KAAY;QAEZ,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,MAAc,EAAE,KAAY;QAC3C,OAAO,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,KAAY;QAC5C,OAAO,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,+DAA+D;IAE/D,UAAU,CACT,IAAY,EACZ,WAA8B,EAC9B,QAAe,QAAQ;QAEvB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;QACzD,GAAG,CAAC,KAAK,EAAE,CAAC;QACZ,KAAK,MAAM,IAAI,IAAI,WAAW;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC;IACb,CAAC;IAED,UAAU,CAAC,MAAc,EAAE,IAAY,EAAE,QAAe,QAAQ;QAC/D,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC;IACb,CAAC;IAED,KAAK,CAAC,MAAc,EAAE,UAAkB,EAAE,QAAe,QAAQ;QAChE,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACnE,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,CAAC,MAAc,EAAE,UAAkB,EAAE,QAAe,QAAQ;QACjE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC;IACb,CAAC;CACD;AAED,sFAAsF;AACtF,SAAS,QAAQ,CAAC,GAA4B;IAC7C,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5B,CAAC;AAED,6DAA6D;AAC7D,SAAS,MAAM,CACd,KAA4C,EAC5C,GAAW,EACX,KAAa;IAEb,IAAI,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,GAAG,GAAG,IAAI,GAAG,EAAuB,CAAC;QACrC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACrB,CAAC;IACD,IAAI,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;QACxB,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC"}
+{"version":3,"file":"MemoryRightsStore.js","sourceRoot":"","sources":["../../src/rights/MemoryRightsStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAgC,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEpE,MAAM,OAAO,iBAAiB;IAC7B,oCAAoC;IAC3B,SAAS,GAAG,IAAI,GAAG,EAAoC,CAAC;IACjE,gCAAgC;IACvB,YAAY,GAAG,IAAI,GAAG,EAAoC,CAAC;IACpE,uDAAuD;IAC9C,aAAa,GAAG,IAAI,GAAG,EAAoC,CAAC;IAErE,oBAAoB;IAEpB,KAAK,CAAC,eAAe,CACpB,IAAY,EACZ,KAAY;QAEZ,OAAO,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,MAAc,EAAE,KAAY;QAC3C,OAAO,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,KAAY;QAC5C,OAAO,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,+DAA+D;IAE/D,UAAU,CACT,IAAY,EACZ,WAA8B,EAC9B,QAAe,QAAQ;QAEvB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;QAC1D,GAAG,CAAC,KAAK,EAAE,CAAC;QACZ,KAAK,MAAM,IAAI,IAAI,WAAW;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC;IACb,CAAC;IAED,UAAU,CAAC,MAAc,EAAE,IAAY,EAAE,QAAe,QAAQ;QAC/D,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC;IACb,CAAC;IAED,KAAK,CAAC,MAAc,EAAE,UAAkB,EAAE,QAAe,QAAQ;QAChE,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,CAAC,MAAc,EAAE,UAAkB,EAAE,QAAe,QAAQ;QACjE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QACzE,OAAO,IAAI,CAAC;IACb,CAAC;CACD;AAED,sFAAsF;AACtF,SAAS,QAAQ,CAAC,GAA4B;IAC7C,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5B,CAAC;AAED,6DAA6D;AAC7D,SAAS,MAAM,CACd,KAA4C,EAC5C,GAAW,EACX,KAAa;IAEb,IAAI,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,GAAG,GAAG,IAAI,GAAG,EAAuB,CAAC;QACrC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACrB,CAAC;IACD,IAAI,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;QACxB,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@c9up/warden",
-  "version": "0.1.20",
+  "version": "0.1.22",
   "description": "Warden — Authentication & authorization for the Ream framework",
   "license": "MIT",
   "type": "module",
@@ -82,7 +82,8 @@
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
     "build:rust": "cargo build --release -p warden-engine-napi",
-    "build:napi": "pnpm build:rust && node scripts/copy-napi.mjs",
+    "build:napi": "pnpm build:rust && pnpm build:napi-types && node scripts/copy-napi.mjs",
+    "build:napi-types": "node scripts/build-napi-types.mjs",
     "test": "vitest run",
     "test:rust": "cargo test -p warden-engine",
     "lint": "biome check src/",

package/scripts/build-napi-types.mjs

@@ -0,0 +1,68 @@
+#!/usr/bin/env node
+/**
+ * Regenerate `src/native/generated.ts` from the Rust.
+ *
+ * Node rather than a shell script because this runs inside `build:napi`, and
+ * that runs on the Windows prebuild runner too: a bash `mktemp` there hands
+ * cargo a `/tmp/...` path the native proc-macro cannot write to, so the
+ * type-def file comes back empty and the build fails for no visible reason.
+ *
+ * One crate at a time on purpose: napi-derive APPENDS to `TYPE_DEF_TMP_PATH`
+ * while cargo compiles, and a parallel build interleaves the writes —
+ * definitions go missing, silently, and the generated file comes out short.
+ */
+
+import { execFileSync } from 'node:child_process'
+import { createRequire } from 'node:module'
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const CRATES = ['warden-engine-napi']
+
+const packageRoot = join(dirname(fileURLToPath(import.meta.url)), '..')
+const output = join('src', 'native', 'generated.ts')
+const scratch = mkdtempSync(join(tmpdir(), 'napi-types-'))
+
+try {
+  const lines = []
+  for (const crate of CRATES) {
+    const perCrate = join(scratch, `${crate}.jsonl`)
+    writeFileSync(perCrate, '')
+    execFileSync('cargo', ['build', '-p', crate], {
+      cwd: packageRoot,
+      env: { ...process.env, TYPE_DEF_TMP_PATH: perCrate },
+      stdio: ['ignore', 'ignore', 'inherit'],
+    })
+    const emitted = readFileSync(perCrate, 'utf8').split('\n').filter(Boolean)
+    if (emitted.length === 0) {
+      throw new Error(
+        `[napi-types] ${crate} emitted nothing — is napi-derive's "type-def" feature on?`,
+      )
+    }
+    lines.push(...emitted)
+  }
+
+  const combined = join(scratch, 'combined.jsonl')
+  writeFileSync(combined, `${lines.join('\n')}\n`)
+
+  execFileSync(
+    process.execPath,
+    [join('scripts', 'generate-napi-types.mjs'), combined, output],
+    { cwd: packageRoot, stdio: 'inherit' },
+  )
+
+  // Formatted here rather than excluded from the linter: the file is checked
+  // in, so it should read like the rest of the tree — and formatting it at
+  // generation means it never shows up as a diff someone has to fix by hand.
+  // Resolved through the package entry rather than `node_modules/.bin`, whose
+  // shim is a shell script the Windows runner cannot execute directly.
+  const biome = createRequire(import.meta.url).resolve('@biomejs/biome/bin/biome')
+  execFileSync(process.execPath, [biome, 'format', '--write', output], {
+    cwd: packageRoot,
+    stdio: ['ignore', 'ignore', 'inherit'],
+  })
+} finally {
+  rmSync(scratch, { recursive: true, force: true })
+}

package/scripts/generate-napi-types.mjs

@@ -0,0 +1,153 @@
+#!/usr/bin/env node
+/**
+ * Generate the TypeScript surface of the native module FROM the Rust.
+ *
+ * `napi-derive`'s `type-def` feature emits one JSON line per exported item
+ * while cargo compiles. Those lines are the source of truth: they are derived
+ * from the `#[napi]` items themselves, so a signature cannot drift from the
+ * Rust without this file changing.
+ *
+ * Hand-written interfaces are what this replaces, and they do drift — nothing
+ * on the TypeScript side notices when a `pub fn` gains a parameter or stops
+ * being `async`.
+ *
+ * One thing napi-rs cannot infer: the shape of a `JsFunction` callback. It
+ * emits `(...args: any[]) => any`. Any such parameter is refined below, by
+ * name, and the script fails if a refinement no longer matches anything — so
+ * the table cannot rot either.
+ *
+ *   TYPE_DEF_TMP_PATH=<file> cargo build -p <crate>
+ *   node scripts/generate-napi-types.mjs <file> <out.d.ts>
+ */
+
+import { readFileSync, writeFileSync } from 'node:fs'
+
+/**
+ * Callback signatures napi-rs erases to `any`, restored here.
+ *
+ * Keyed by `<owner>.<method>`; the value replaces the whole parameter. Every
+ * entry must match, or the script fails: a stale refinement is how a hand
+ * annotation quietly stops describing the Rust.
+ *
+ * Empty while this crate exposes no `JsFunction` parameter — add an entry the
+ * day one appears, rather than letting an `any` through.
+ */
+const CALLBACK_REFINEMENTS = {}
+
+const [input, output] = process.argv.slice(2)
+if (!input || !output) {
+  console.error('usage: generate-napi-types.mjs <type-def file> <out.d.ts>')
+  process.exit(2)
+}
+
+const entries = readFileSync(input, 'utf8')
+  .split('\n')
+  .map((l) => l.trim())
+  .filter(Boolean)
+  .map((l) => JSON.parse(l))
+
+const used = new Set()
+
+/** Apply the refinements that belong to `owner`, tracking which ones matched. */
+function refine(owner, body) {
+  let out = body
+  for (const [key, { from, to }] of Object.entries(CALLBACK_REFINEMENTS)) {
+    const [entryOwner] = key.split('.')
+    if (entryOwner !== owner) continue
+    if (out.includes(from)) {
+      out = out.replace(from, to)
+      used.add(key)
+    }
+  }
+  return out
+}
+
+/**
+ * JSDoc as emitted by napi-derive, indented to sit above its member.
+ *
+ * `*` followed by `/` inside the text closes the comment early — a Rust doc
+ * example holding a cron expression (`0 *​/5 * * *`) is enough to do it, and
+ * the generated file then fails to parse. Escaped rather than stripped, so the
+ * example still reads correctly.
+ */
+function docBlock(doc, indent = '') {
+  if (!doc) return ''
+  // Escape every `*/` EXCEPT the one that closes the block. A Rust doc example
+  // holding a cron expression (`0 */5 * * *`) closes the comment early
+  // otherwise, and the generated file stops parsing — but escaping the closer
+  // too breaks it just as thoroughly, whether the block spans one line or many.
+  const closer = doc.lastIndexOf('*/')
+  const escaped =
+    closer === -1
+      ? doc
+      : doc.slice(0, closer).replaceAll('*/', '*\\/') + doc.slice(closer)
+  return (
+    escaped
+      .split('\n')
+      .filter((l) => l.length > 0)
+      .map((l) => `${indent}${l}`)
+      .join('\n') + '\n'
+  )
+}
+
+const interfaces = entries.filter((e) => e.kind === 'interface')
+const structs = entries.filter((e) => e.kind === 'struct')
+const impls = new Map(entries.filter((e) => e.kind === 'impl').map((e) => [e.name, e]))
+const fns = entries.filter((e) => e.kind === 'fn')
+
+const out = [
+  '// GENERATED FROM THE RUST — do not edit.',
+  '//',
+  "// Produced by scripts/generate-napi-types.mjs from napi-derive's type-def",
+  '// output. Editing this file by hand puts it back where it started: a',
+  '// description that can disagree with the code it describes.',
+  '',
+]
+
+for (const iface of interfaces) {
+  out.push(docBlock(iface.js_doc))
+  out.push(`export interface ${iface.name} {`)
+  for (const line of iface.def.split('\n')) {
+    out.push(line ? `  ${line.trim()}` : '')
+  }
+  out.push('}', '')
+}
+
+for (const struct of structs) {
+  const impl = impls.get(struct.name)
+  out.push(docBlock(struct.js_doc))
+  out.push(`export declare class ${struct.name} {`)
+  if (impl) {
+    for (const line of refine(struct.name, impl.def).split('\n')) {
+      out.push(line ? `  ${line.trim()}` : '')
+    }
+  }
+  out.push('}', '')
+}
+
+for (const fn of fns) {
+  out.push(docBlock(fn.js_doc))
+  // napi-derive emits the whole declaration for a function, unlike a struct
+  // where `def` holds only the members.
+  const declaration = fn.def.trim()
+  out.push(
+    declaration.startsWith('export declare function')
+      ? `${declaration};`
+      : `export declare function ${fn.name}${declaration};`,
+    '',
+  )
+}
+
+const stale = Object.keys(CALLBACK_REFINEMENTS).filter((k) => !used.has(k))
+if (stale.length > 0) {
+  console.error(
+    `[napi-types] refinement(s) that matched nothing: ${stale.join(', ')}\n` +
+      '[napi-types] the Rust changed under them — update or remove the entry.',
+  )
+  process.exit(1)
+}
+
+writeFileSync(output, out.join('\n'))
+console.log(
+  `[napi-types] ${output} — ${interfaces.length} interface(s), ${structs.length} class(es), ${fns.length} function(s)`,
+)

package/src/AuthManager.ts

@@ -146,9 +146,9 @@ export interface WardenEmitter {
 export class AuthManager {
 	// AdonisJS names: `guards` (name → strategy) and `default` (the guard used
 	// when none is named). Renamed from the previous `strategies`/`defaultStrategy`.
-	private guards: Map<string, AuthStrategy> = new Map();
-	private default: string;
-	private readonly rights: RightsResolver;
+	#guards: Map<string, AuthStrategy> = new Map();
+	#default: string;
+	readonly #rights: RightsResolver;
 
 	/**
 	 * Where auth events go. Structural and optional: warden is a leaf and must
@@ -195,10 +195,10 @@ export class AuthManager {
 				"AuthManager: config must supply `default` + `guards` (or the legacy `defaultStrategy` + `strategies`).",
 			);
 		}
-		this.default = defaultGuard;
-		this.rights = config.rights ?? new RightsResolver(new MemoryRightsStore());
+		this.#default = defaultGuard;
+		this.#rights = config.rights ?? new RightsResolver(new MemoryRightsStore());
 		for (const [name, strategy] of Object.entries(guards)) {
-			this.guards.set(name, strategy);
+			this.#guards.set(name, strategy);
 		}
 		// Fail-fast at construction: an AuthManager with zero guards is a
 		// configuration bug. Previously, an empty `guards: {}` passed the
@@ -206,13 +206,13 @@ export class AuthManager {
 		// runtime when `getStrategy('jwt')` threw — opaque 401 or 500 instead
 		// of a boot-time INVALID_CONFIG that points the operator at the missing
 		// `config.auth.jwt` (or other guard).
-		if (this.guards.size === 0) {
+		if (this.#guards.size === 0) {
 			throw new WardenError(
 				"INVALID_CONFIG",
 				`AuthManager: no authentication guards registered. Configure at least one guard (e.g. config.warden.auth.jwt) before booting WardenProvider.`,
 			);
 		}
-		if (!this.guards.has(defaultGuard)) {
+		if (!this.#guards.has(defaultGuard)) {
 			throw new WardenError(
 				"INVALID_CONFIG",
 				`default guard '${defaultGuard}' is not present in guards`,
@@ -285,7 +285,7 @@ export class AuthManager {
 		if (!isTokenIssuer(strategy)) {
 			throw new WardenError(
 				"STRATEGY_CANNOT_ISSUE",
-				`Auth strategy '${strategyName ?? this.default}' cannot issue tokens.`,
+				`Auth strategy '${strategyName ?? this.#default}' cannot issue tokens.`,
 				{
 					hint: "issueFor() needs a token-minting strategy (e.g. JwtStrategy with signToken). Session / API-key strategies don't mint tokens.",
 				},
@@ -306,7 +306,7 @@ export class AuthManager {
 		user: UserPayload,
 		scope: Scope = "global",
 	): Promise<EffectivePermissions> {
-		return this.rights.resolve(user, scope);
+		return this.#rights.resolve(user, scope);
 	}
 
 	/**
@@ -381,7 +381,7 @@ export class AuthManager {
 				if (!seam) {
 					throw new WardenError(
 						"STRATEGY_HAS_NO_CLIENT",
-						`Auth strategy '${guard ?? this.default}' has no authenticateAsClient() — it cannot forge a client request.`,
+						`Auth strategy '${guard ?? this.#default}' has no authenticateAsClient() — it cannot forge a client request.`,
 						{
 							hint: "Implement authenticateAsClient() on the strategy, or authenticate through a real login in the test.",
 						},
@@ -406,8 +406,8 @@ export class AuthManager {
 	}
 
 	getStrategy(name?: string): AuthStrategy {
-		const strategyName = name ?? this.default;
-		const strategy = this.guards.get(strategyName);
+		const strategyName = name ?? this.#default;
+		const strategy = this.#guards.get(strategyName);
 		if (!strategy) {
 			throw new WardenError(
 				"STRATEGY_NOT_FOUND",
@@ -426,17 +426,17 @@ export class AuthManager {
 	 * declares none.
 	 */
 	get defaultStrategyName(): string {
-		return this.default;
+		return this.#default;
 	}
 
 	/** Register a new strategy at runtime. */
 	registerStrategy(name: string, strategy: AuthStrategy): void {
-		this.guards.set(name, strategy);
+		this.#guards.set(name, strategy);
 	}
 
 	/** Get all registered strategy names. */
 	getStrategyNames(): string[] {
-		return [...this.guards.keys()];
+		return [...this.#guards.keys()];
 	}
 
 	/**
@@ -458,7 +458,7 @@ export class AuthManager {
 		if (!isLoginCapable(strategy)) {
 			throw new WardenError(
 				"STRATEGY_CANNOT_LOGIN",
-				`Auth strategy '${strategyName ?? this.default}' does not support session login.`,
+				`Auth strategy '${strategyName ?? this.#default}' does not support session login.`,
 				{
 					hint: "login()/logout() need a stateful guard (e.g. SessionStrategy). JWT / API-key guards are stateless — mint a token with issueFor() instead.",
 				},
@@ -466,12 +466,12 @@ export class AuthManager {
 		}
 		const prefix = authEventPrefix(strategy.name);
 		this.#emit(`${prefix}:login_attempted`, {
-			guardName: strategyName ?? this.default,
+			guardName: strategyName ?? this.#default,
 			user,
 		});
 		await strategy.login(user, session);
 		this.#emit(`${prefix}:login_succeeded`, {
-			guardName: strategyName ?? this.default,
+			guardName: strategyName ?? this.#default,
 			user,
 			sessionId: undefined,
 		});
@@ -487,12 +487,12 @@ export class AuthManager {
 		if (!isLoginCapable(strategy)) {
 			throw new WardenError(
 				"STRATEGY_CANNOT_LOGIN",
-				`Auth strategy '${strategyName ?? this.default}' does not support session logout.`,
+				`Auth strategy '${strategyName ?? this.#default}' does not support session logout.`,
 			);
 		}
 		await strategy.logout(session);
 		this.#emit(`${authEventPrefix(strategy.name)}:logged_out`, {
-			guardName: strategyName ?? this.default,
+			guardName: strategyName ?? this.#default,
 			user: null,
 			error: null,
 		});

package/src/AuthRateLimiter.ts

@@ -17,16 +17,16 @@ interface AttemptEntry {
 }
 
 export class AuthRateLimiter {
-	private maxAttempts: number;
-	private window: number;
-	private store: Map<string, AttemptEntry> = new Map();
-	private maxStoreSize = 100_000;
+	#maxAttempts: number;
+	#window: number;
+	#store: Map<string, AttemptEntry> = new Map();
+	#maxStoreSize = 100_000;
 
 	constructor(config?: AuthRateLimiterConfig) {
-		this.maxAttempts = config?.maxAttempts ?? 5;
-		if (this.maxAttempts <= 0) this.maxAttempts = 1;
-		this.window = (config?.windowSeconds ?? 900) * 1000;
-		if (this.window <= 0) this.window = 900_000; // prevent bypass via 0/negative
+		this.#maxAttempts = config?.maxAttempts ?? 5;
+		if (this.#maxAttempts <= 0) this.#maxAttempts = 1;
+		this.#window = (config?.windowSeconds ?? 900) * 1000;
+		if (this.#window <= 0) this.#window = 900_000; // prevent bypass via 0/negative
 	}
 
 	/** Check if an attempt is allowed. Returns false if rate limited. */
@@ -38,7 +38,7 @@ export class AuthRateLimiter {
 		const ipKey = `ip:${ipNorm}`;
 		const idKey = `id:${identifierNorm}`;
 
-		return this.checkKey(ipKey, now) && this.checkKey(idKey, now);
+		return this.#checkKey(ipKey, now) && this.#checkKey(idKey, now);
 	}
 
 	/** Record a failed attempt. */
@@ -46,51 +46,51 @@ export class AuthRateLimiter {
 		const now = Date.now();
 		const ipNorm = normalizeIp(ip);
 		const identifierNorm = normalizeIdentifier(identifier);
-		this.increment(`ip:${ipNorm}`, now);
-		this.increment(`id:${identifierNorm}`, now);
+		this.#increment(`ip:${ipNorm}`, now);
+		this.#increment(`id:${identifierNorm}`, now);
 	}
 
 	/** Reset counters on successful login. */
 	recordSuccess(ip: string, identifier: string): void {
 		const ipNorm = normalizeIp(ip);
 		const identifierNorm = normalizeIdentifier(identifier);
-		this.store.delete(`ip:${ipNorm}`);
-		this.store.delete(`id:${identifierNorm}`);
+		this.#store.delete(`ip:${ipNorm}`);
+		this.#store.delete(`id:${identifierNorm}`);
 	}
 
 	/** Get remaining attempts for an identifier. */
 	remaining(ip: string, identifier: string): number {
 		const ipNorm = normalizeIp(ip);
 		const identifierNorm = normalizeIdentifier(identifier);
-		const ipEntry = this.store.get(`ip:${ipNorm}`);
-		const idEntry = this.store.get(`id:${identifierNorm}`);
+		const ipEntry = this.#store.get(`ip:${ipNorm}`);
+		const idEntry = this.#store.get(`id:${identifierNorm}`);
 		const ipRemaining = ipEntry
-			? Math.max(0, this.maxAttempts - ipEntry.count)
-			: this.maxAttempts;
+			? Math.max(0, this.#maxAttempts - ipEntry.count)
+			: this.#maxAttempts;
 		const idRemaining = idEntry
-			? Math.max(0, this.maxAttempts - idEntry.count)
-			: this.maxAttempts;
+			? Math.max(0, this.#maxAttempts - idEntry.count)
+			: this.#maxAttempts;
 		return Math.min(ipRemaining, idRemaining);
 	}
 
-	private checkKey(key: string, now: number): boolean {
-		const entry = this.store.get(key);
+	#checkKey(key: string, now: number): boolean {
+		const entry = this.#store.get(key);
 		if (!entry || entry.resetAt < now) return true;
-		return entry.count < this.maxAttempts;
+		return entry.count < this.#maxAttempts;
 	}
 
-	private increment(key: string, now: number): void {
+	#increment(key: string, now: number): void {
 		// Evict expired entries when store grows too large (prevent OOM)
-		if (this.store.size > this.maxStoreSize) {
-			for (const [k, v] of this.store) {
-				if (v.resetAt < now) this.store.delete(k);
+		if (this.#store.size > this.#maxStoreSize) {
+			for (const [k, v] of this.#store) {
+				if (v.resetAt < now) this.#store.delete(k);
 			}
 		}
 
-		let entry = this.store.get(key);
+		let entry = this.#store.get(key);
 		if (!entry || entry.resetAt < now) {
-			entry = { count: 0, resetAt: now + this.window };
-			this.store.set(key, entry);
+			entry = { count: 0, resetAt: now + this.#window };
+			this.#store.set(key, entry);
 		}
 		entry.count++;
 	}

package/src/RefreshTokenStore.ts

@@ -27,36 +27,36 @@ export interface RefreshTokenDriver {
 
 /** In-memory driver for development. */
 export class MemoryRefreshTokenDriver implements RefreshTokenDriver {
-	private tokens: Map<string, StoredRefreshToken> = new Map();
+	#tokens: Map<string, StoredRefreshToken> = new Map();
 
 	async store(token: StoredRefreshToken): Promise<void> {
-		this.tokens.set(token.token, token);
+		this.#tokens.set(token.token, token);
 	}
 
 	async find(token: string): Promise<StoredRefreshToken | null> {
-		const stored = this.tokens.get(token);
+		const stored = this.#tokens.get(token);
 		if (!stored) return null;
 		if (stored.expiresAt < Date.now()) {
-			this.tokens.delete(token);
+			this.#tokens.delete(token);
 			return null;
 		}
 		return stored;
 	}
 
 	async revoke(token: string): Promise<void> {
-		this.tokens.delete(token);
+		this.#tokens.delete(token);
 	}
 
 	async revokeAllForUser(userId: string | number): Promise<void> {
-		for (const [key, val] of this.tokens) {
-			if (val.userId === userId) this.tokens.delete(key);
+		for (const [key, val] of this.#tokens) {
+			if (val.userId === userId) this.#tokens.delete(key);
 		}
 	}
 
 	async cleanup(): Promise<void> {
 		const now = Date.now();
-		for (const [key, val] of this.tokens) {
-			if (val.expiresAt < now) this.tokens.delete(key);
+		for (const [key, val] of this.#tokens) {
+			if (val.expiresAt < now) this.#tokens.delete(key);
 		}
 	}
 }

package/src/TokenBlacklist.ts

@@ -18,17 +18,17 @@ export interface BlacklistDriver {
 
 /** In-memory blacklist for development. */
 export class MemoryBlacklistDriver implements BlacklistDriver {
-	private entries: Map<string, number> = new Map();
+	#entries: Map<string, number> = new Map();
 
 	async add(jti: string, expiresAt: number): Promise<void> {
-		this.entries.set(jti, expiresAt);
+		this.#entries.set(jti, expiresAt);
 	}
 
 	async has(jti: string): Promise<boolean> {
-		const expiresAt = this.entries.get(jti);
+		const expiresAt = this.#entries.get(jti);
 		if (expiresAt === undefined) return false;
 		if (expiresAt < Date.now()) {
-			this.entries.delete(jti);
+			this.#entries.delete(jti);
 			return false;
 		}
 		return true;
@@ -36,8 +36,8 @@ export class MemoryBlacklistDriver implements BlacklistDriver {
 
 	async cleanup(): Promise<void> {
 		const now = Date.now();
-		for (const [jti, exp] of this.entries) {
-			if (exp < now) this.entries.delete(jti);
+		for (const [jti, exp] of this.#entries) {
+			if (exp < now) this.#entries.delete(jti);
 		}
 	}
 }

package/src/augmentations.ts

@@ -23,5 +23,3 @@ declare module "@c9up/ream/types" {
 		[guardName: string]: GuardAccessor;
 	}
 }
-
-export type {};