@c9up/warden 0.1.3 → 0.1.4

package/dist/TokenBlacklist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TokenBlacklist.js","sourceRoot":"","sources":["../src/TokenBlacklist.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAQH,2CAA2C;AAC3C,MAAM,OAAO,qBAAqB;IACzB,OAAO,GAAwB,IAAI,GAAG,EAAE,CAAC;IAEjD,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,SAAiB;QACvC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACpB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAC1C,IAAI,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,OAAO,KAAK,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IAED,KAAK,CAAC,OAAO;QACZ,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACvC,IAAI,GAAG,GAAG,GAAG;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzC,CAAC;IACF,CAAC;CACD;AAED,MAAM,OAAO,cAAc;IACN;IAApB,YAAoB,MAAuB;QAAvB,WAAM,GAAN,MAAM,CAAiB;IAAG,CAAC;IAE/C,uCAAuC;IACvC,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,SAAiB;QAC1C,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACvC,CAAC;IAED,2CAA2C;IAC3C,KAAK,CAAC,SAAS,CAAC,GAAW;QAC1B,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,8BAA8B;IAC9B,KAAK,CAAC,OAAO;QACZ,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;IAC9B,CAAC;CACD"}

package/dist/WardenProvider.d.ts

@@ -0,0 +1,19 @@
+interface WardenContainer {
+    singleton(token: unknown, factory: () => unknown): void;
+    resolve(token: unknown): unknown;
+}
+interface WardenConfigStore {
+    get<T = unknown>(key: string): T | undefined;
+}
+export interface WardenAppContext {
+    container: WardenContainer;
+    config: WardenConfigStore;
+}
+export default class WardenProvider {
+    protected app: WardenAppContext;
+    constructor(app: WardenAppContext);
+    register(): void;
+    boot(): Promise<void>;
+}
+export {};
+//# sourceMappingURL=WardenProvider.d.ts.map

package/dist/WardenProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"WardenProvider.d.ts","sourceRoot":"","sources":["../src/WardenProvider.ts"],"names":[],"mappings":"AAQA,UAAU,eAAe;IACxB,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,OAAO,GAAG,IAAI,CAAC;IACxD,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;CACjC;AAED,UAAU,iBAAiB;IAC1B,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC;CAC7C;AAED,MAAM,WAAW,gBAAgB;IAChC,SAAS,EAAE,eAAe,CAAC;IAC3B,MAAM,EAAE,iBAAiB,CAAC;CAC1B;AAED,MAAM,CAAC,OAAO,OAAO,cAAc;IACtB,SAAS,CAAC,GAAG,EAAE,gBAAgB;gBAArB,GAAG,EAAE,gBAAgB;IAE3C,QAAQ;IAuDF,IAAI;CAGV"}

package/dist/WardenProvider.js

@@ -0,0 +1,61 @@
+import { AuthManager } from "./AuthManager.js";
+import { WardenError } from "./errors.js";
+import { MemoryRightsStore } from "./rights/MemoryRightsStore.js";
+import { RightsResolver } from "./rights/RightsResolver.js";
+import { setAuth } from "./services/main.js";
+import { JwtStrategy } from "./strategies/JwtStrategy.js";
+export default class WardenProvider {
+    app;
+    constructor(app) {
+        this.app = app;
+    }
+    register() {
+        // Register JwtStrategy first so it's available before AuthManager resolves.
+        // The previous version nested the JwtStrategy registration inside the
+        // AuthManager factory — that was order-dependent and fragile.
+        const config = this.app.config.get("auth");
+        // Fail-fast at register-time so the operator gets a clear actionable
+        // error during boot instead of an opaque runtime crash on the first
+        // protected request. Previously, missing `config.auth` produced an
+        // AuthManager with `strategies: {}` and `defaultStrategy: 'jwt'`,
+        // passing the (then-permissive) constructor and erroring deep in the
+        // middleware loop.
+        if (!config?.jwt) {
+            throw new WardenError("WARDEN_NO_AUTH_CONFIG", `@c9up/warden: no authentication strategies configured. Set config.warden.auth.jwt (or another strategy) in your reamrc.ts before registering WardenProvider.`);
+        }
+        const jwt = new JwtStrategy(config.jwt);
+        this.app.container.singleton(JwtStrategy, () => jwt);
+        // Rights layer (Epic 56): one resolver singleton backs BOTH the coarse
+        // RBAC helpers (injected into AuthManager below) and — once 56.6 lands —
+        // the Bouncer construction, so a coarse question and a policy question
+        // resolve through the SAME instance (single unification point, AC-E3).
+        // The store defaults to an in-memory driver and is exposed (by class)
+        // so an app can seed roles/grants at boot, or supply its own via
+        // `config.auth.rights.store` (AD5).
+        const rightsStore = config.rights?.store ?? new MemoryRightsStore();
+        const rightsResolver = new RightsResolver(rightsStore);
+        this.app.container.singleton(RightsResolver, () => rightsResolver);
+        if (rightsStore instanceof MemoryRightsStore) {
+            this.app.container.singleton(MemoryRightsStore, () => rightsStore);
+        }
+        this.app.container.singleton(AuthManager, () => {
+            const strategies = { jwt };
+            return new AuthManager({
+                defaultStrategy: config.defaultStrategy ?? "jwt",
+                strategies,
+                rights: rightsResolver,
+            });
+        });
+        // String alias so consumers that can't import the AuthManager class
+        // (e.g. @c9up/station, which stays agnostic of warden) can resolve
+        // it by name. Mirrors the convention other providers follow
+        // (events → "bus", rosetta → "i18n"). Without this, Station's
+        // `container.resolve("auth")` threw and its admin auth gate
+        // silently fell back to open-mode.
+        this.app.container.singleton("auth", () => this.app.container.resolve(AuthManager));
+    }
+    async boot() {
+        setAuth(this.app.container.resolve(AuthManager));
+    }
+}
+//# sourceMappingURL=WardenProvider.js.map

package/dist/WardenProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WardenProvider.js","sourceRoot":"","sources":["../src/WardenProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAgB1D,MAAM,CAAC,OAAO,OAAO,cAAc;IACZ;IAAtB,YAAsB,GAAqB;QAArB,QAAG,GAAH,GAAG,CAAkB;IAAG,CAAC;IAE/C,QAAQ;QACP,4EAA4E;QAC5E,sEAAsE;QACtE,8DAA8D;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAe,MAAM,CAAC,CAAC;QAEzD,qEAAqE;QACrE,oEAAoE;QACpE,mEAAmE;QACnE,kEAAkE;QAClE,qEAAqE;QACrE,mBAAmB;QACnB,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC;YAClB,MAAM,IAAI,WAAW,CACpB,uBAAuB,EACvB,8JAA8J,CAC9J,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QAErD,uEAAuE;QACvE,yEAAyE;QACzE,uEAAuE;QACvE,uEAAuE;QACvE,sEAAsE;QACtE,iEAAiE;QACjE,oCAAoC;QACpC,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACpE,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,WAAW,CAAC,CAAC;QACvD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,CAAC;QACnE,IAAI,WAAW,YAAY,iBAAiB,EAAE,CAAC;YAC9C,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC;QACpE,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,WAAW,EAAE,GAAG,EAAE;YAC9C,MAAM,UAAU,GAAgC,EAAE,GAAG,EAAE,CAAC;YACxD,OAAO,IAAI,WAAW,CAAC;gBACtB,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,KAAK;gBAChD,UAAU;gBACV,MAAM,EAAE,cAAc;aACtB,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,oEAAoE;QACpE,mEAAmE;QACnE,4DAA4D;QAC5D,8DAA8D;QAC9D,4DAA4D;QAC5D,mCAAmC;QACnC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CACzC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,CACvC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI;QACT,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,CAAgB,CAAC,CAAC;IACjE,CAAC;CACD"}

package/dist/bouncer/AuthorizationResponse.d.ts

@@ -0,0 +1,25 @@
+/**
+ * AuthorizationResponse — the value type every Bouncer check resolves to.
+ *
+ * Layer 2 (EVALUATION) of Warden's unified authorization (Epic 56). Faithful
+ * to AdonisJS Bouncer's `AuthorizationResponse`: instances are produced only by
+ * the `allow()` / `deny()` static constructors (the constructor is private), a
+ * denial defaults to HTTP 403, and a `translation` field is carried for shape
+ * parity with Adonis's i18n hook (always `undefined` in 56.2 — D6).
+ */
+export declare class AuthorizationResponse {
+    readonly authorized: boolean;
+    readonly message?: string;
+    readonly status?: number;
+    /** Parity placeholder for an i18n binding (always undefined in 56.2 — D6). */
+    readonly translation?: {
+        identifier: string;
+        data?: Record<string, unknown>;
+    };
+    private constructor();
+    /** Authorized response (no status). */
+    static allow(): AuthorizationResponse;
+    /** Denied response; `status` defaults to 403 (D6). */
+    static deny(message?: string, status?: number): AuthorizationResponse;
+}
+//# sourceMappingURL=AuthorizationResponse.d.ts.map

package/dist/bouncer/AuthorizationResponse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthorizationResponse.d.ts","sourceRoot":"","sources":["../../src/bouncer/AuthorizationResponse.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,qBAAa,qBAAqB;IACjC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,8EAA8E;IAC9E,QAAQ,CAAC,WAAW,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IAE9E,OAAO;IAYP,uCAAuC;IACvC,MAAM,CAAC,KAAK,IAAI,qBAAqB;IAIrC,sDAAsD;IACtD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,SAAM,GAAG,qBAAqB;CAGlE"}

package/dist/bouncer/AuthorizationResponse.js

@@ -0,0 +1,31 @@
+/**
+ * AuthorizationResponse — the value type every Bouncer check resolves to.
+ *
+ * Layer 2 (EVALUATION) of Warden's unified authorization (Epic 56). Faithful
+ * to AdonisJS Bouncer's `AuthorizationResponse`: instances are produced only by
+ * the `allow()` / `deny()` static constructors (the constructor is private), a
+ * denial defaults to HTTP 403, and a `translation` field is carried for shape
+ * parity with Adonis's i18n hook (always `undefined` in 56.2 — D6).
+ */
+export class AuthorizationResponse {
+    authorized;
+    message;
+    status;
+    /** Parity placeholder for an i18n binding (always undefined in 56.2 — D6). */
+    translation;
+    constructor(authorized, message, status, translation) {
+        this.authorized = authorized;
+        this.message = message;
+        this.status = status;
+        this.translation = translation;
+    }
+    /** Authorized response (no status). */
+    static allow() {
+        return new AuthorizationResponse(true);
+    }
+    /** Denied response; `status` defaults to 403 (D6). */
+    static deny(message, status = 403) {
+        return new AuthorizationResponse(false, message, status);
+    }
+}
+//# sourceMappingURL=AuthorizationResponse.js.map

package/dist/bouncer/AuthorizationResponse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthorizationResponse.js","sourceRoot":"","sources":["../../src/bouncer/AuthorizationResponse.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,OAAO,qBAAqB;IACxB,UAAU,CAAU;IACpB,OAAO,CAAU;IACjB,MAAM,CAAU;IACzB,8EAA8E;IACrE,WAAW,CAA0D;IAE9E,YACC,UAAmB,EACnB,OAAgB,EAChB,MAAe,EACf,WAAoE;QAEpE,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IAChC,CAAC;IAED,uCAAuC;IACvC,MAAM,CAAC,KAAK;QACX,OAAO,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IAED,sDAAsD;IACtD,MAAM,CAAC,IAAI,CAAC,OAAgB,EAAE,MAAM,GAAG,GAAG;QACzC,OAAO,IAAI,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1D,CAAC;CACD"}

package/dist/bouncer/BasePolicy.d.ts

@@ -0,0 +1,47 @@
+/**
+ * BasePolicy — extend it to group authorization checks for a resource. Action
+ * methods are positional `(user, resource?) => AuthorizerResponse` (D3); decorate
+ * a method with `@allowGuest()` / `@action({ allowGuest: true })` to let a guest
+ * (null user) reach it. The optional `before` / `after` hooks run around every
+ * action in the Adonis evaluation order (D5 — see PolicyAuthorizer).
+ */
+import type { UserPayload } from "../AuthManager.js";
+import type { EffectivePermissions, Scope } from "../rights/types.js";
+import type { AuthorizationResponse } from "./AuthorizationResponse.js";
+import type { HookResponse } from "./types.js";
+export declare abstract class BasePolicy {
+    /**
+     * Runs before the action. A non-`undefined` return short-circuits the action
+     * (a `boolean`/`AuthorizationResponse` becomes the result) — this is how a
+     * moderator bypass or an early `deny('not found', 404)` works, including for
+     * a guest. `undefined`/`void` falls through to the action.
+     */
+    before?(user: UserPayload | null, action: string, ...args: unknown[]): HookResponse;
+    /**
+     * Runs after the action (or after a `before` short-circuit), receiving the
+     * resolved response. A non-`undefined` return overrides it; `undefined`
+     * keeps it.
+     */
+    after?(user: UserPayload | null, action: string, result: AuthorizationResponse): HookResponse;
+    /**
+     * The Bouncer's active scope for the in-flight check (56.3). Defaults to
+     * `"global"` when the policy is used without a Bouncer context.
+     */
+    protected get scope(): Scope;
+    /**
+     * The resolved `EffectivePermissions` for the Bouncer's `(user, scope)` (56.3):
+     * role-derived ∪ ACL grants with global→tenant inheritance (per 56.1). A guest,
+     * a no-resolver Bouncer, or a standalone policy ⇒ empty permissions.
+     */
+    protected get permissions(): EffectivePermissions;
+    /**
+     * Tenant-isolation helper (D5 — enforceable, not automatic). `true` under the
+     * `global` scope (single-tenant — no boundary); under `{ tenant: T }` it is
+     * `resource.tenantId === T`. A policy enforces explicitly, e.g.
+     * `if (!this.sameTenant(post)) return false`.
+     */
+    protected sameTenant(resource: {
+        tenantId?: string | null;
+    }): boolean;
+}
+//# sourceMappingURL=BasePolicy.d.ts.map

package/dist/bouncer/BasePolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BasePolicy.d.ts","sourceRoot":"","sources":["../../src/bouncer/BasePolicy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAExE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,8BAAsB,UAAU;IAC/B;;;;;OAKG;IACH,MAAM,CAAC,CACN,IAAI,EAAE,WAAW,GAAG,IAAI,EACxB,MAAM,EAAE,MAAM,EACd,GAAG,IAAI,EAAE,OAAO,EAAE,GAChB,YAAY;IAEf;;;;OAIG;IACH,KAAK,CAAC,CACL,IAAI,EAAE,WAAW,GAAG,IAAI,EACxB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,qBAAqB,GAC3B,YAAY;IAEf;;;OAGG;IACH,SAAS,KAAK,KAAK,IAAI,KAAK,CAE3B;IAED;;;;OAIG;IACH,SAAS,KAAK,WAAW,IAAI,oBAAoB,CAEhD;IAED;;;;;OAKG;IACH,SAAS,CAAC,UAAU,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,OAAO;CAIrE"}

package/dist/bouncer/BasePolicy.js

@@ -0,0 +1,36 @@
+/**
+ * BasePolicy — extend it to group authorization checks for a resource. Action
+ * methods are positional `(user, resource?) => AuthorizerResponse` (D3); decorate
+ * a method with `@allowGuest()` / `@action({ allowGuest: true })` to let a guest
+ * (null user) reach it. The optional `before` / `after` hooks run around every
+ * action in the Adonis evaluation order (D5 — see PolicyAuthorizer).
+ */
+import { emptyPermissions, getPolicyContext } from "./policyContext.js";
+export class BasePolicy {
+    /**
+     * The Bouncer's active scope for the in-flight check (56.3). Defaults to
+     * `"global"` when the policy is used without a Bouncer context.
+     */
+    get scope() {
+        return getPolicyContext(this)?.scope ?? "global";
+    }
+    /**
+     * The resolved `EffectivePermissions` for the Bouncer's `(user, scope)` (56.3):
+     * role-derived ∪ ACL grants with global→tenant inheritance (per 56.1). A guest,
+     * a no-resolver Bouncer, or a standalone policy ⇒ empty permissions.
+     */
+    get permissions() {
+        return getPolicyContext(this)?.permissions ?? emptyPermissions("global");
+    }
+    /**
+     * Tenant-isolation helper (D5 — enforceable, not automatic). `true` under the
+     * `global` scope (single-tenant — no boundary); under `{ tenant: T }` it is
+     * `resource.tenantId === T`. A policy enforces explicitly, e.g.
+     * `if (!this.sameTenant(post)) return false`.
+     */
+    sameTenant(resource) {
+        const scope = this.scope;
+        return scope === "global" ? true : resource.tenantId === scope.tenant;
+    }
+}
+//# sourceMappingURL=BasePolicy.js.map

package/dist/bouncer/BasePolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BasePolicy.js","sourceRoot":"","sources":["../../src/bouncer/BasePolicy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAGxE,MAAM,OAAgB,UAAU;IAwB/B;;;OAGG;IACH,IAAc,KAAK;QAClB,OAAO,gBAAgB,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,QAAQ,CAAC;IAClD,CAAC;IAED;;;;OAIG;IACH,IAAc,WAAW;QACxB,OAAO,gBAAgB,CAAC,IAAI,CAAC,EAAE,WAAW,IAAI,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC1E,CAAC;IAED;;;;;OAKG;IACO,UAAU,CAAC,QAAsC;QAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,KAAK,KAAK,CAAC,MAAM,CAAC;IACvE,CAAC;CACD"}

package/dist/bouncer/Bouncer.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Bouncer — Layer 2 (EVALUATION) of Warden's unified authorization (Epic 56).
+ *
+ * A Bouncer-faithful evaluation core (verified context7 `/adonisjs/bouncer`,
+ * 2026-06-01): standalone abilities via `Bouncer.ability`, class-based policies
+ * via `with(Policy)`, the four verbs `allows`/`denies`/`authorize`/`execute`,
+ * and guest-denied-by-default. The user is `UserPayload | null` (guest = null,
+ * D3); `authorize` throws `WARDEN_AUTHORIZATION_FAILURE` carrying `status: 403`
+ * (D2). 56.2 ships PURE mechanics — it does NOT consult the Layer-1
+ * `RightsResolver` (D4); abilities/policy methods receive `(user, ...args)` and
+ * the developer writes the predicate, exactly as Adonis does.
+ */
+import type { UserPayload } from "../AuthManager.js";
+import type { Scope } from "../rights/types.js";
+import { AuthorizationResponse } from "./AuthorizationResponse.js";
+import type { BasePolicy } from "./BasePolicy.js";
+import { PolicyAuthorizer } from "./PolicyAuthorizer.js";
+import type { Ability, AbilityOptions, AuthorizerResponse, BouncerContext } from "./types.js";
+export declare class Bouncer {
+    #private;
+    constructor(user: UserPayload | null, abilities?: Record<string, Ability<never[]>>, policies?: Record<string, new () => BasePolicy>, context?: BouncerContext);
+    /** The active resolution scope (default `"global"`). */
+    get scope(): Scope;
+    /**
+     * Define a standalone ability. Guest (null user) denied by default; pass
+     * `{ allowGuest: true }` to let the callback run for a guest (D5 step 2).
+     */
+    static ability<Args extends unknown[]>(callback: (user: UserPayload, ...args: Args) => AuthorizerResponse): Ability<Args>;
+    static ability<Args extends unknown[]>(options: AbilityOptions, callback: (user: UserPayload | null, ...args: Args) => AuthorizerResponse): Ability<Args>;
+    /** Convenience — equivalent to `AuthorizationResponse.deny` (Adonis `bouncer.deny`). */
+    deny(message?: string, status?: number): AuthorizationResponse;
+    /** Open a policy for checks (D8 — fresh `new PolicyClass()` per check). */
+    with(policy: (new () => BasePolicy) | string): PolicyAuthorizer;
+    /** Run an ability check and resolve to the full response. */
+    execute<Args extends unknown[]>(ability: Ability<Args>, ...args: Args): Promise<AuthorizationResponse>;
+    execute(ability: string, ...args: unknown[]): Promise<AuthorizationResponse>;
+    /** True iff the ability is authorized. Never throws on denial. */
+    allows<Args extends unknown[]>(ability: Ability<Args>, ...args: Args): Promise<boolean>;
+    allows(ability: string, ...args: unknown[]): Promise<boolean>;
+    /** Boolean negation of {@link allows}. Never throws on denial. */
+    denies<Args extends unknown[]>(ability: Ability<Args>, ...args: Args): Promise<boolean>;
+    denies(ability: string, ...args: unknown[]): Promise<boolean>;
+    /** Resolves on allow; throws `WARDEN_AUTHORIZATION_FAILURE` on deny (D2). */
+    authorize<Args extends unknown[]>(ability: Ability<Args>, ...args: Args): Promise<void>;
+    authorize(ability: string, ...args: unknown[]): Promise<void>;
+}
+//# sourceMappingURL=Bouncer.d.ts.map

package/dist/bouncer/Bouncer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Bouncer.d.ts","sourceRoot":"","sources":["../../src/bouncer/Bouncer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGrD,OAAO,KAAK,EAAwB,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,OAAO,KAAK,EACX,OAAO,EACP,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,MAAM,YAAY,CAAC;AAEpB,qBAAa,OAAO;;gBAUlB,IAAI,EAAE,WAAW,GAAG,IAAI,EACxB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,EAC5C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,UAAU,CAAC,EAC/C,OAAO,CAAC,EAAE,cAAc;IASzB,wDAAwD;IACxD,IAAI,KAAK,IAAI,KAAK,CAEjB;IAkBD;;;OAGG;IACH,MAAM,CAAC,OAAO,CAAC,IAAI,SAAS,OAAO,EAAE,EACpC,QAAQ,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,IAAI,KAAK,kBAAkB,GAChE,OAAO,CAAC,IAAI,CAAC;IAChB,MAAM,CAAC,OAAO,CAAC,IAAI,SAAS,OAAO,EAAE,EACpC,OAAO,EAAE,cAAc,EACvB,QAAQ,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,EAAE,GAAG,IAAI,EAAE,IAAI,KAAK,kBAAkB,GACvE,OAAO,CAAC,IAAI,CAAC;IAmChB,wFAAwF;IACxF,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,qBAAqB;IAI9D,2EAA2E;IAC3E,IAAI,CAAC,MAAM,EAAE,CAAC,UAAU,UAAU,CAAC,GAAG,MAAM,GAAG,gBAAgB;IAY/D,6DAA6D;IAC7D,OAAO,CAAC,IAAI,SAAS,OAAO,EAAE,EAC7B,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,EACtB,GAAG,IAAI,EAAE,IAAI,GACX,OAAO,CAAC,qBAAqB,CAAC;IACjC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAQ5E,kEAAkE;IAClE,MAAM,CAAC,IAAI,SAAS,OAAO,EAAE,EAC5B,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,EACtB,GAAG,IAAI,EAAE,IAAI,GACX,OAAO,CAAC,OAAO,CAAC;IACnB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAQ7D,kEAAkE;IAClE,MAAM,CAAC,IAAI,SAAS,OAAO,EAAE,EAC5B,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,EACtB,GAAG,IAAI,EAAE,IAAI,GACX,OAAO,CAAC,OAAO,CAAC;IACnB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAQ7D,6EAA6E;IAC7E,SAAS,CAAC,IAAI,SAAS,OAAO,EAAE,EAC/B,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,EACtB,GAAG,IAAI,EAAE,IAAI,GACX,OAAO,CAAC,IAAI,CAAC;IAChB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAwD7D"}

package/dist/bouncer/Bouncer.js

@@ -0,0 +1,134 @@
+/**
+ * Bouncer — Layer 2 (EVALUATION) of Warden's unified authorization (Epic 56).
+ *
+ * A Bouncer-faithful evaluation core (verified context7 `/adonisjs/bouncer`,
+ * 2026-06-01): standalone abilities via `Bouncer.ability`, class-based policies
+ * via `with(Policy)`, the four verbs `allows`/`denies`/`authorize`/`execute`,
+ * and guest-denied-by-default. The user is `UserPayload | null` (guest = null,
+ * D3); `authorize` throws `WARDEN_AUTHORIZATION_FAILURE` carrying `status: 403`
+ * (D2). 56.2 ships PURE mechanics — it does NOT consult the Layer-1
+ * `RightsResolver` (D4); abilities/policy methods receive `(user, ...args)` and
+ * the developer writes the predicate, exactly as Adonis does.
+ */
+import { WardenError } from "../errors.js";
+import { AuthorizationResponse } from "./AuthorizationResponse.js";
+import { evaluate, isAction, throwAuthorizationFailure } from "./evaluate.js";
+import { PolicyAuthorizer } from "./PolicyAuthorizer.js";
+import { emptyPermissions } from "./policyContext.js";
+export class Bouncer {
+    #user;
+    #abilities;
+    #policies;
+    #scope;
+    #resolver;
+    /** Memoized resolution — a Bouncer is fixed per `(user, scope)`, so resolve once (D3). */
+    #resolved;
+    constructor(user, abilities, policies, context) {
+        this.#user = user;
+        this.#abilities = abilities ?? {};
+        this.#policies = policies ?? {};
+        this.#scope = context?.scope ?? "global";
+        this.#resolver = context?.resolver;
+    }
+    /** The active resolution scope (default `"global"`). */
+    get scope() {
+        return this.#scope;
+    }
+    /**
+     * Resolve this Bouncer's `(user, scope)` to `EffectivePermissions`, memoized
+     * once per instance (D3). Guest (`user === null`) or no resolver ⇒ empty
+     * permissions — `resolve()` is never called for a guest (D9). 56.6 relocates
+     * this cache to the request context without changing the policy-facing API.
+     */
+    #resolvePermissions() {
+        if (this.#resolved === undefined) {
+            this.#resolved =
+                this.#resolver !== undefined && this.#user !== null
+                    ? this.#resolver.resolve(this.#user, this.#scope)
+                    : Promise.resolve(emptyPermissions(this.#scope));
+        }
+        return this.#resolved;
+    }
+    static ability(optionsOrCallback, maybeCallback) {
+        let allowGuest = false;
+        let raw;
+        if (typeof optionsOrCallback === "function") {
+            raw = optionsOrCallback;
+        }
+        else {
+            allowGuest = optionsOrCallback.allowGuest ?? false;
+            raw = maybeCallback;
+        }
+        // The typed overloads above carry the real callback signature for the
+        // caller; the impl param is the universal-function supertype so both
+        // overloads are accepted. `isAction` reinterprets it as the invokable
+        // `Action` shape (a type guard, not a cast — a function's parameter types
+        // are not observable at runtime).
+        if (!isAction(raw)) {
+            throw new WardenError("INVALID_ABILITY", "Bouncer.ability requires a callback alongside the options object.", { hint: "Bouncer.ability({ allowGuest: true }, (user) => ...)" });
+        }
+        const callback = raw;
+        const execute = (user, ...args) => callback(user, ...args);
+        return { allowGuest, execute };
+    }
+    /** Convenience — equivalent to `AuthorizationResponse.deny` (Adonis `bouncer.deny`). */
+    deny(message, status) {
+        return AuthorizationResponse.deny(message, status);
+    }
+    /** Open a policy for checks (D8 — fresh `new PolicyClass()` per check). */
+    with(policy) {
+        const factory = typeof policy === "string"
+            ? this.#resolvePolicyClass(policy)
+            : () => new policy();
+        // The PolicyAuthorizer inherits the Bouncer's scope + the shared memoized
+        // resolve so every policy check sees the active `(user, scope)` (AC1/AC3).
+        return new PolicyAuthorizer(this.#user, factory, this.#scope, () => this.#resolvePermissions());
+    }
+    execute(ability, ...args) {
+        return this.#evaluateAbility(ability, args);
+    }
+    async allows(ability, ...args) {
+        return (await this.#evaluateAbility(ability, args)).authorized;
+    }
+    async denies(ability, ...args) {
+        return !(await this.#evaluateAbility(ability, args)).authorized;
+    }
+    async authorize(ability, ...args) {
+        const response = await this.#evaluateAbility(ability, args);
+        if (!response.authorized) {
+            throwAuthorizationFailure(response);
+        }
+    }
+    async #evaluateAbility(ability, args) {
+        const resolved = typeof ability === "string" ? this.#resolveAbility(ability) : ability;
+        return evaluate({
+            user: this.#user,
+            action: typeof ability === "string" ? ability : "(ability)",
+            allowGuest: resolved.allowGuest,
+            run: (user) => resolved.execute(user, ...args),
+            args,
+        });
+    }
+    #resolveAbility(name) {
+        const found = this.#abilities[name];
+        if (found === undefined) {
+            throw new WardenError("UNKNOWN_ABILITY", `No ability "${name}" is registered on this Bouncer.`, { hint: "Register it via new Bouncer(user, { [name]: ability })." });
+        }
+        return found;
+    }
+    #resolvePolicyClass(name) {
+        // Lazy: the lookup runs when a verb constructs the policy, so an unknown
+        // name surfaces as a promise rejection (like every other verb error),
+        // not a synchronous throw at `with()` time.
+        return () => {
+            const ctor = this.#policies[name];
+            if (ctor === undefined) {
+                throw new WardenError("UNKNOWN_POLICY", `No policy "${name}" is registered on this Bouncer.`, {
+                    hint: "Register it via new Bouncer(user, abilities, { [name]: Policy }).",
+                });
+            }
+            return new ctor();
+        };
+    }
+}
+//# sourceMappingURL=Bouncer.js.map

package/dist/bouncer/Bouncer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Bouncer.js","sourceRoot":"","sources":["../../src/bouncer/Bouncer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAG3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAQtD,MAAM,OAAO,OAAO;IACV,KAAK,CAAqB;IAC1B,UAAU,CAAmC;IAC7C,SAAS,CAAuC;IAChD,MAAM,CAAQ;IACd,SAAS,CAA6B;IAC/C,0FAA0F;IAC1F,SAAS,CAA4C;IAErD,YACC,IAAwB,EACxB,SAA4C,EAC5C,QAA+C,EAC/C,OAAwB;QAExB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,UAAU,GAAG,SAAS,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,QAAQ,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,KAAK,IAAI,QAAQ,CAAC;QACzC,IAAI,CAAC,SAAS,GAAG,OAAO,EAAE,QAAQ,CAAC;IACpC,CAAC;IAED,wDAAwD;IACxD,IAAI,KAAK;QACR,OAAO,IAAI,CAAC,MAAM,CAAC;IACpB,CAAC;IAED;;;;;OAKG;IACH,mBAAmB;QAClB,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC,SAAS;gBACb,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI;oBAClD,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC;oBACjD,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC;IACvB,CAAC;IAaD,MAAM,CAAC,OAAO,CACb,iBAE6C,EAC7C,aAAwD;QAExD,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,IAAI,GAAY,CAAC;QACjB,IAAI,OAAO,iBAAiB,KAAK,UAAU,EAAE,CAAC;YAC7C,GAAG,GAAG,iBAAiB,CAAC;QACzB,CAAC;aAAM,CAAC;YACP,UAAU,GAAG,iBAAiB,CAAC,UAAU,IAAI,KAAK,CAAC;YACnD,GAAG,GAAG,aAAa,CAAC;QACrB,CAAC;QACD,sEAAsE;QACtE,qEAAqE;QACrE,sEAAsE;QACtE,0EAA0E;QAC1E,kCAAkC;QAClC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,WAAW,CACpB,iBAAiB,EACjB,mEAAmE,EACnE,EAAE,IAAI,EAAE,sDAAsD,EAAE,CAChE,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC;QACrB,MAAM,OAAO,GAAG,CACf,IAAwB,EACxB,GAAG,IAAe,EACG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IAChC,CAAC;IAED,wFAAwF;IACxF,IAAI,CAAC,OAAgB,EAAE,MAAe;QACrC,OAAO,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IAED,2EAA2E;IAC3E,IAAI,CAAC,MAAuC;QAC3C,MAAM,OAAO,GACZ,OAAO,MAAM,KAAK,QAAQ;YACzB,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC;YAClC,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,0EAA0E;QAC1E,2EAA2E;QAC3E,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAClE,IAAI,CAAC,mBAAmB,EAAE,CAC1B,CAAC;IACH,CAAC;IAQD,OAAO,CACN,OAAkC,EAClC,GAAG,IAAe;QAElB,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;IAQD,KAAK,CAAC,MAAM,CACX,OAAkC,EAClC,GAAG,IAAe;QAElB,OAAO,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;IAChE,CAAC;IAQD,KAAK,CAAC,MAAM,CACX,OAAkC,EAClC,GAAG,IAAe;QAElB,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;IACjE,CAAC;IAQD,KAAK,CAAC,SAAS,CACd,OAAkC,EAClC,GAAG,IAAe;QAElB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC5D,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC1B,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;IACF,CAAC;IAED,KAAK,CAAC,gBAAgB,CACrB,OAAkC,EAClC,IAAe;QAEf,MAAM,QAAQ,GACb,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACvE,OAAO,QAAQ,CAAC;YACf,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,MAAM,EAAE,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW;YAC3D,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC;YAC9C,IAAI;SACJ,CAAC,CAAC;IACJ,CAAC;IAED,eAAe,CAAC,IAAY;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,WAAW,CACpB,iBAAiB,EACjB,eAAe,IAAI,kCAAkC,EACrD,EAAE,IAAI,EAAE,yDAAyD,EAAE,CACnE,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC;IAED,mBAAmB,CAAC,IAAY;QAC/B,yEAAyE;QACzE,sEAAsE;QACtE,4CAA4C;QAC5C,OAAO,GAAG,EAAE;YACX,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACxB,MAAM,IAAI,WAAW,CACpB,gBAAgB,EAChB,cAAc,IAAI,kCAAkC,EACpD;oBACC,IAAI,EAAE,mEAAmE;iBACzE,CACD,CAAC;YACH,CAAC;YACD,OAAO,IAAI,IAAI,EAAE,CAAC;QACnB,CAAC,CAAC;IACH,CAAC;CACD"}

package/dist/bouncer/PolicyAuthorizer.d.ts

@@ -0,0 +1,24 @@
+/**
+ * PolicyAuthorizer — the object returned by `bouncer.with(Policy)`. Exposes the
+ * same four verbs as the Bouncer, dispatched to a named action method on a
+ * freshly-constructed policy instance (D8 — `new PolicyClass()` per check). The
+ * `before`/`after` hooks and the per-method `@allowGuest` rule run through the
+ * shared D5 pipeline.
+ */
+import type { UserPayload } from "../AuthManager.js";
+import type { EffectivePermissions, Scope } from "../rights/types.js";
+import type { AuthorizationResponse } from "./AuthorizationResponse.js";
+import { BasePolicy } from "./BasePolicy.js";
+export declare class PolicyAuthorizer {
+    #private;
+    constructor(user: UserPayload | null, factory: () => BasePolicy, scope?: Scope, resolvePermissions?: () => Promise<EffectivePermissions>);
+    /** Run a check and resolve to the full response (D8 — fresh policy per check). */
+    execute(action: string, ...args: unknown[]): Promise<AuthorizationResponse>;
+    /** True iff the action is authorized. Never throws on denial. */
+    allows(action: string, ...args: unknown[]): Promise<boolean>;
+    /** Boolean negation of {@link allows}. Never throws on denial. */
+    denies(action: string, ...args: unknown[]): Promise<boolean>;
+    /** Resolves on allow; throws `WARDEN_AUTHORIZATION_FAILURE` on deny (D2). */
+    authorize(action: string, ...args: unknown[]): Promise<void>;
+}
+//# sourceMappingURL=PolicyAuthorizer.d.ts.map

package/dist/bouncer/PolicyAuthorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PolicyAuthorizer.d.ts","sourceRoot":"","sources":["../../src/bouncer/PolicyAuthorizer.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAqD7C,qBAAa,gBAAgB;;gBAO3B,IAAI,EAAE,WAAW,GAAG,IAAI,EACxB,OAAO,EAAE,MAAM,UAAU,EACzB,KAAK,GAAE,KAAgB,EACvB,kBAAkB,GAAE,MAAM,OAAO,CAAC,oBAAoB,CACb;IAQ1C,kFAAkF;IAC5E,OAAO,CACZ,MAAM,EAAE,MAAM,EACd,GAAG,IAAI,EAAE,OAAO,EAAE,GAChB,OAAO,CAAC,qBAAqB,CAAC;IAmBjC,iEAAiE;IAC3D,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAIlE,kEAAkE;IAC5D,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAIlE,6EAA6E;IACvE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAMlE"}

package/dist/bouncer/PolicyAuthorizer.js

@@ -0,0 +1,92 @@
+/**
+ * PolicyAuthorizer — the object returned by `bouncer.with(Policy)`. Exposes the
+ * same four verbs as the Bouncer, dispatched to a named action method on a
+ * freshly-constructed policy instance (D8 — `new PolicyClass()` per check). The
+ * `before`/`after` hooks and the per-method `@allowGuest` rule run through the
+ * shared D5 pipeline.
+ */
+import { WardenError } from "../errors.js";
+import { BasePolicy } from "./BasePolicy.js";
+import { getActionMetadata } from "./decorators.js";
+import { evaluate, isAction, throwAuthorizationFailure, } from "./evaluate.js";
+import { emptyPermissions, setPolicyContext } from "./policyContext.js";
+/**
+ * Resolve a named action method declared anywhere on the policy's own subclass
+ * chain (so an action inherited from an intermediate policy base class still
+ * dispatches). Rejects `constructor`, the `before`/`after` hooks, and any
+ * `BasePolicy`/`Object.prototype` member so a verb call can never dispatch to a
+ * non-action method — a guard the adversarial review specifically probes.
+ */
+function resolveActionMethod(policy, action) {
+    // Reject the hooks + constructor by name, then accept an action declared
+    // anywhere on the policy's own subclass chain — the immediate prototype up to
+    // (but not including) BasePolicy.prototype / Object.prototype — so a method
+    // inherited from an intermediate policy base class (`class A extends B`) still
+    // dispatches, while BasePolicy's own members (scope/permissions getters) and
+    // Object.prototype members stay unreachable.
+    const isHookOrCtor = action === "constructor" || action === "before" || action === "after";
+    let declaredHere = false;
+    for (let proto = Object.getPrototypeOf(policy); proto !== null &&
+        proto !== BasePolicy.prototype &&
+        proto !== Object.prototype; proto = Object.getPrototypeOf(proto)) {
+        if (Object.hasOwn(proto, action)) {
+            declaredHere = true;
+            break;
+        }
+    }
+    const candidate = Reflect.get(policy, action);
+    if (isHookOrCtor) {
+        declaredHere = false;
+    }
+    if (!declaredHere || !isAction(candidate)) {
+        throw new WardenError("UNKNOWN_POLICY_ACTION", `Policy "${policy.constructor.name}" has no action "${action}"`, { hint: "Declare the action as a method on the policy class." });
+    }
+    return candidate.bind(policy);
+}
+export class PolicyAuthorizer {
+    #user;
+    #factory;
+    #scope;
+    #resolvePermissions;
+    constructor(user, factory, scope = "global", resolvePermissions = () => Promise.resolve(emptyPermissions(scope))) {
+        this.#user = user;
+        this.#factory = factory;
+        this.#scope = scope;
+        this.#resolvePermissions = resolvePermissions;
+    }
+    /** Run a check and resolve to the full response (D8 — fresh policy per check). */
+    async execute(action, ...args) {
+        const policy = this.#factory();
+        // Attach the active scope + resolved permissions BEFORE dispatch so the
+        // before/method/after pipeline all read `this.scope` / `this.permissions`.
+        const permissions = await this.#resolvePermissions();
+        setPolicyContext(policy, { scope: this.#scope, permissions });
+        const method = resolveActionMethod(policy, action);
+        const options = getActionMetadata(policy, action);
+        return evaluate({
+            user: this.#user,
+            action,
+            allowGuest: options.allowGuest ?? false,
+            run: (user) => method(user, ...args),
+            args,
+            before: policy.before?.bind(policy),
+            after: policy.after?.bind(policy),
+        });
+    }
+    /** True iff the action is authorized. Never throws on denial. */
+    async allows(action, ...args) {
+        return (await this.execute(action, ...args)).authorized;
+    }
+    /** Boolean negation of {@link allows}. Never throws on denial. */
+    async denies(action, ...args) {
+        return !(await this.execute(action, ...args)).authorized;
+    }
+    /** Resolves on allow; throws `WARDEN_AUTHORIZATION_FAILURE` on deny (D2). */
+    async authorize(action, ...args) {
+        const response = await this.execute(action, ...args);
+        if (!response.authorized) {
+            throwAuthorizationFailure(response);
+        }
+    }
+}
+//# sourceMappingURL=PolicyAuthorizer.js.map

package/dist/bouncer/PolicyAuthorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PolicyAuthorizer.js","sourceRoot":"","sources":["../../src/bouncer/PolicyAuthorizer.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAG3C,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAEN,QAAQ,EACR,QAAQ,EACR,yBAAyB,GACzB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAExE;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,MAAkB,EAAE,MAAc;IAC9D,yEAAyE;IACzE,8EAA8E;IAC9E,4EAA4E;IAC5E,+EAA+E;IAC/E,6EAA6E;IAC7E,6CAA6C;IAC7C,MAAM,YAAY,GACjB,MAAM,KAAK,aAAa,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,OAAO,CAAC;IACvE,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,KACC,IAAI,KAAK,GAAkB,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,EACxD,KAAK,KAAK,IAAI;QACd,KAAK,KAAK,UAAU,CAAC,SAAS;QAC9B,KAAK,KAAK,MAAM,CAAC,SAAS,EAC1B,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,EACnC,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;YAClC,YAAY,GAAG,IAAI,CAAC;YACpB,MAAM;QACP,CAAC;IACF,CAAC;IACD,MAAM,SAAS,GAAY,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvD,IAAI,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,YAAY,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,WAAW,CACpB,uBAAuB,EACvB,WAAW,MAAM,CAAC,WAAW,CAAC,IAAI,oBAAoB,MAAM,GAAG,EAC/D,EAAE,IAAI,EAAE,qDAAqD,EAAE,CAC/D,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,OAAO,gBAAgB;IACnB,KAAK,CAAqB;IAC1B,QAAQ,CAAmB;IAC3B,MAAM,CAAQ;IACd,mBAAmB,CAAsC;IAElE,YACC,IAAwB,EACxB,OAAyB,EACzB,QAAe,QAAQ,EACvB,qBAA0D,GAAG,EAAE,CAC9D,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAEzC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,mBAAmB,GAAG,kBAAkB,CAAC;IAC/C,CAAC;IAED,kFAAkF;IAClF,KAAK,CAAC,OAAO,CACZ,MAAc,EACd,GAAG,IAAe;QAElB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC/B,wEAAwE;QACxE,2EAA2E;QAC3E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACrD,gBAAgB,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAClD,OAAO,QAAQ,CAAC;YACf,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,MAAM;YACN,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,KAAK;YACvC,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC;YACpC,IAAI;YACJ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;YACnC,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC;SACjC,CAAC,CAAC;IACJ,CAAC;IAED,iEAAiE;IACjE,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,GAAG,IAAe;QAC9C,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;IACzD,CAAC;IAED,kEAAkE;IAClE,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,GAAG,IAAe;QAC9C,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;IAC1D,CAAC;IAED,6EAA6E;IAC7E,KAAK,CAAC,SAAS,CAAC,MAAc,EAAE,GAAG,IAAe;QACjD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC1B,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;IACF,CAAC;CACD"}

package/dist/bouncer/decorators.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Bouncer policy decorators — `@allowGuest()` / `@action()` mark policy methods
+ * that a guest (null user) may reach. Mirrors the `Guard.ts` idiom (D9):
+ * `reflect-metadata` side-effect import, a `Symbol.for` key, the legacy
+ * `MethodDecorator` signature, and a `getActionMetadata` reader.
+ */
+import "reflect-metadata";
+import type { AbilityOptions } from "./types.js";
+/**
+ * `@action({ allowGuest })` — configure a policy method's evaluation options.
+ */
+export declare function action(options: AbilityOptions): MethodDecorator;
+/**
+ * `@allowGuest()` — let a guest (null user) reach this policy method.
+ * Equivalent to `@action({ allowGuest: true })`.
+ */
+export declare function allowGuest(): MethodDecorator;
+/**
+ * Read a policy method's action metadata. Walks the prototype chain
+ * (`Reflect.getMetadata`) so it resolves from a policy INSTANCE — legacy
+ * decorators write metadata onto the class prototype, where the instance
+ * inherits it. Absent ⇒ `{}` (⇒ `allowGuest` falsy ⇒ guest denied).
+ */
+export declare function getActionMetadata(target: object, propertyKey: string | symbol): AbilityOptions;
+//# sourceMappingURL=decorators.d.ts.map

package/dist/bouncer/decorators.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decorators.d.ts","sourceRoot":"","sources":["../../src/bouncer/decorators.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAKjD;;GAEG;AACH,wBAAgB,MAAM,CAAC,OAAO,EAAE,cAAc,GAAG,eAAe,CAI/D;AAED;;;GAGG;AACH,wBAAgB,UAAU,IAAI,eAAe,CAE5C;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAChC,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAAG,MAAM,GAC1B,cAAc,CAEhB"}