@c9up/warden 0.1.3 → 0.1.4

package/dist/bouncer/decorators.js

@@ -0,0 +1,36 @@
+/**
+ * Bouncer policy decorators — `@allowGuest()` / `@action()` mark policy methods
+ * that a guest (null user) may reach. Mirrors the `Guard.ts` idiom (D9):
+ * `reflect-metadata` side-effect import, a `Symbol.for` key, the legacy
+ * `MethodDecorator` signature, and a `getActionMetadata` reader.
+ */
+// Side-effect import: registers `Reflect.defineMetadata` / `getMetadata`. Pulled
+// in here (not transitively) so warden stays self-sufficient when published.
+import "reflect-metadata";
+/** Action metadata key — Symbol.for ensures cross-module accessibility. */
+const ACTION_KEY = Symbol.for("warden:bouncer:action");
+/**
+ * `@action({ allowGuest })` — configure a policy method's evaluation options.
+ */
+export function action(options) {
+    return (target, propertyKey) => {
+        Reflect.defineMetadata(ACTION_KEY, options, target, propertyKey);
+    };
+}
+/**
+ * `@allowGuest()` — let a guest (null user) reach this policy method.
+ * Equivalent to `@action({ allowGuest: true })`.
+ */
+export function allowGuest() {
+    return action({ allowGuest: true });
+}
+/**
+ * Read a policy method's action metadata. Walks the prototype chain
+ * (`Reflect.getMetadata`) so it resolves from a policy INSTANCE — legacy
+ * decorators write metadata onto the class prototype, where the instance
+ * inherits it. Absent ⇒ `{}` (⇒ `allowGuest` falsy ⇒ guest denied).
+ */
+export function getActionMetadata(target, propertyKey) {
+    return Reflect.getMetadata(ACTION_KEY, target, propertyKey) ?? {};
+}
+//# sourceMappingURL=decorators.js.map

package/dist/bouncer/decorators.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decorators.js","sourceRoot":"","sources":["../../src/bouncer/decorators.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,iFAAiF;AACjF,6EAA6E;AAC7E,OAAO,kBAAkB,CAAC;AAG1B,2EAA2E;AAC3E,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;AAEvD;;GAEG;AACH,MAAM,UAAU,MAAM,CAAC,OAAuB;IAC7C,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE;QAC9B,OAAO,CAAC,cAAc,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IAClE,CAAC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU;IACzB,OAAO,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAChC,MAAc,EACd,WAA4B;IAE5B,OAAO,OAAO,CAAC,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC;AACnE,CAAC"}

package/dist/bouncer/evaluate.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Shared evaluation pipeline — the single place that encodes the Adonis Bouncer
+ * evaluation order (D5), used by BOTH standalone abilities (no hooks) and policy
+ * methods (with `before`/`after`). Pinned by `bouncer-parity.test.ts` (AC-E2).
+ *
+ * Order: (1) `before` — a non-`undefined` return short-circuits the action;
+ * (2) guest-deny — `user === null` && !allowGuest ⇒ auto-deny WITHOUT running the
+ * action; (3) run the action; (4) `after` — a non-`undefined` return overrides.
+ */
+import type { UserPayload } from "../AuthManager.js";
+import { AuthorizationResponse } from "./AuthorizationResponse.js";
+import type { AuthorizerResponse, HookResponse } from "./types.js";
+/** A policy action method / ability callback, structurally. */
+export type Action = (user: UserPayload | null, ...args: unknown[]) => AuthorizerResponse;
+/** Boolean sugar → response; an explicit response passes through (D7). */
+export declare function normalizeResponse(value: boolean | AuthorizationResponse): AuthorizationResponse;
+/**
+ * Type guard for a callable action. A function's parameter/return types are not
+ * observable at runtime, so this asserts the structural `Action` shape from a
+ * `typeof === "function"` check — a type guard (not an `as` cast), the standard
+ * escape for dynamic dispatch.
+ */
+export declare function isAction(value: unknown): value is Action;
+/** Throw the canonical authorization failure for a denied response (D2). */
+export declare function throwAuthorizationFailure(response: AuthorizationResponse): never;
+/** Run the D5 evaluation pipeline and resolve to the final response. */
+export declare function evaluate(params: {
+    user: UserPayload | null;
+    action: string;
+    allowGuest: boolean;
+    run: (user: UserPayload | null) => AuthorizerResponse;
+    args: unknown[];
+    before?: (user: UserPayload | null, action: string, ...args: unknown[]) => HookResponse;
+    after?: (user: UserPayload | null, action: string, result: AuthorizationResponse) => HookResponse;
+}): Promise<AuthorizationResponse>;
+//# sourceMappingURL=evaluate.d.ts.map

package/dist/bouncer/evaluate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../../src/bouncer/evaluate.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAEnE,+DAA+D;AAC/D,MAAM,MAAM,MAAM,GAAG,CACpB,IAAI,EAAE,WAAW,GAAG,IAAI,EACxB,GAAG,IAAI,EAAE,OAAO,EAAE,KACd,kBAAkB,CAAC;AAExB,0EAA0E;AAC1E,wBAAgB,iBAAiB,CAChC,KAAK,EAAE,OAAO,GAAG,qBAAqB,GACpC,qBAAqB,CAKvB;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAExD;AAED,4EAA4E;AAC5E,wBAAgB,yBAAyB,CACxC,QAAQ,EAAE,qBAAqB,GAC7B,KAAK,CASP;AAED,wEAAwE;AACxE,wBAAsB,QAAQ,CAAC,MAAM,EAAE;IACtC,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,OAAO,CAAC;IACpB,GAAG,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,KAAK,kBAAkB,CAAC;IACtD,IAAI,EAAE,OAAO,EAAE,CAAC;IAChB,MAAM,CAAC,EAAE,CACR,IAAI,EAAE,WAAW,GAAG,IAAI,EACxB,MAAM,EAAE,MAAM,EACd,GAAG,IAAI,EAAE,OAAO,EAAE,KACd,YAAY,CAAC;IAClB,KAAK,CAAC,EAAE,CACP,IAAI,EAAE,WAAW,GAAG,IAAI,EACxB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,qBAAqB,KACzB,YAAY,CAAC;CAClB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA+BjC"}

package/dist/bouncer/evaluate.js

@@ -0,0 +1,64 @@
+/**
+ * Shared evaluation pipeline — the single place that encodes the Adonis Bouncer
+ * evaluation order (D5), used by BOTH standalone abilities (no hooks) and policy
+ * methods (with `before`/`after`). Pinned by `bouncer-parity.test.ts` (AC-E2).
+ *
+ * Order: (1) `before` — a non-`undefined` return short-circuits the action;
+ * (2) guest-deny — `user === null` && !allowGuest ⇒ auto-deny WITHOUT running the
+ * action; (3) run the action; (4) `after` — a non-`undefined` return overrides.
+ */
+import { WardenError } from "../errors.js";
+import { AuthorizationResponse } from "./AuthorizationResponse.js";
+/** Boolean sugar → response; an explicit response passes through (D7). */
+export function normalizeResponse(value) {
+    if (value instanceof AuthorizationResponse) {
+        return value;
+    }
+    return value ? AuthorizationResponse.allow() : AuthorizationResponse.deny();
+}
+/**
+ * Type guard for a callable action. A function's parameter/return types are not
+ * observable at runtime, so this asserts the structural `Action` shape from a
+ * `typeof === "function"` check — a type guard (not an `as` cast), the standard
+ * escape for dynamic dispatch.
+ */
+export function isAction(value) {
+    return typeof value === "function";
+}
+/** Throw the canonical authorization failure for a denied response (D2). */
+export function throwAuthorizationFailure(response) {
+    throw new WardenError("AUTHORIZATION_FAILURE", response.message ?? "Authorization failed", {
+        hint: "The current user is not authorized for this action.",
+        status: response.status ?? 403,
+    });
+}
+/** Run the D5 evaluation pipeline and resolve to the final response. */
+export async function evaluate(params) {
+    const { user, action, allowGuest, run, args, before, after } = params;
+    let response;
+    // (1) before — non-undefined short-circuits the action.
+    if (before) {
+        const early = await before(user, action, ...args);
+        if (early !== undefined) {
+            response = normalizeResponse(early);
+        }
+    }
+    // (2) guest-deny + (3) action — only if before did not short-circuit.
+    if (response === undefined) {
+        if (user === null && !allowGuest) {
+            response = AuthorizationResponse.deny();
+        }
+        else {
+            response = normalizeResponse(await run(user));
+        }
+    }
+    // (4) after — non-undefined overrides.
+    if (after) {
+        const override = await after(user, action, response);
+        if (override !== undefined) {
+            response = normalizeResponse(override);
+        }
+    }
+    return response;
+}
+//# sourceMappingURL=evaluate.js.map

package/dist/bouncer/evaluate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate.js","sourceRoot":"","sources":["../../src/bouncer/evaluate.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AASnE,0EAA0E;AAC1E,MAAM,UAAU,iBAAiB,CAChC,KAAsC;IAEtC,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,CAAC,qBAAqB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAc;IACtC,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC;AACpC,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,yBAAyB,CACxC,QAA+B;IAE/B,MAAM,IAAI,WAAW,CACpB,uBAAuB,EACvB,QAAQ,CAAC,OAAO,IAAI,sBAAsB,EAC1C;QACC,IAAI,EAAE,qDAAqD;QAC3D,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,GAAG;KAC9B,CACD,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,MAgB9B;IACA,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IAEtE,IAAI,QAA2C,CAAC;IAEhD,wDAAwD;IACxD,IAAI,MAAM,EAAE,CAAC;QACZ,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;QAClD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;IACF,CAAC;IAED,sEAAsE;IACtE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAClC,QAAQ,GAAG,qBAAqB,CAAC,IAAI,EAAE,CAAC;QACzC,CAAC;aAAM,CAAC;YACP,QAAQ,GAAG,iBAAiB,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/C,CAAC;IACF,CAAC;IAED,uCAAuC;IACvC,IAAI,KAAK,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACrD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5B,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACxC,CAAC;IACF,CAAC;IAED,OAAO,QAAQ,CAAC;AACjB,CAAC"}

package/dist/bouncer/policyContext.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Internal policy context attach — Layer-2 ⨯ Layer-1 wiring (Epic 56, story 56.3).
+ *
+ * The active `scope` and the resolved `EffectivePermissions` for the in-flight
+ * `(user, scope)` are attached to a freshly-constructed policy via a package-
+ * internal `WeakMap` (D2) — NOT a public setter on `BasePolicy` and NOT barrelled.
+ * `BasePolicy`'s `this.scope` / `this.permissions` getters read it back; the
+ * `PolicyAuthorizer` writes it before dispatch. A policy used without a Bouncer
+ * has no entry, so the getters fall back to `global` + {@link emptyPermissions}.
+ */
+import type { EffectivePermissions, Scope } from "../rights/types.js";
+import type { BasePolicy } from "./BasePolicy.js";
+/** What the authorizer attaches to a policy instance for one check. */
+export interface PolicyContext {
+    readonly scope: Scope;
+    readonly permissions: EffectivePermissions;
+}
+/** Attach the active scope + resolved permissions to a policy instance (internal). */
+export declare function setPolicyContext(policy: BasePolicy, context: PolicyContext): void;
+/** Read back a policy's attached context, or `undefined` when used standalone. */
+export declare function getPolicyContext(policy: BasePolicy): PolicyContext | undefined;
+/**
+ * The empty `EffectivePermissions` for a guest / no-resolver Bouncer (D9). Built
+ * locally — never a `resolve()` call (the resolver requires a non-null user) and
+ * never importing 56.1's non-exported `ResolvedPermissions`. `has` → false;
+ * `hasAll([])` → true (vacuous); `hasAny` → false; empty sets; `scope` = active.
+ */
+export declare function emptyPermissions(scope: Scope): EffectivePermissions;
+//# sourceMappingURL=policyContext.d.ts.map

package/dist/bouncer/policyContext.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policyContext.d.ts","sourceRoot":"","sources":["../../src/bouncer/policyContext.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,uEAAuE;AACvE,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,oBAAoB,CAAC;CAC3C;AAID,sFAAsF;AACtF,wBAAgB,gBAAgB,CAC/B,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,aAAa,GACpB,IAAI,CAEN;AAED,kFAAkF;AAClF,wBAAgB,gBAAgB,CAC/B,MAAM,EAAE,UAAU,GAChB,aAAa,GAAG,SAAS,CAE3B;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,KAAK,GAAG,oBAAoB,CASnE"}

package/dist/bouncer/policyContext.js

@@ -0,0 +1,36 @@
+/**
+ * Internal policy context attach — Layer-2 ⨯ Layer-1 wiring (Epic 56, story 56.3).
+ *
+ * The active `scope` and the resolved `EffectivePermissions` for the in-flight
+ * `(user, scope)` are attached to a freshly-constructed policy via a package-
+ * internal `WeakMap` (D2) — NOT a public setter on `BasePolicy` and NOT barrelled.
+ * `BasePolicy`'s `this.scope` / `this.permissions` getters read it back; the
+ * `PolicyAuthorizer` writes it before dispatch. A policy used without a Bouncer
+ * has no entry, so the getters fall back to `global` + {@link emptyPermissions}.
+ */
+const contexts = new WeakMap();
+/** Attach the active scope + resolved permissions to a policy instance (internal). */
+export function setPolicyContext(policy, context) {
+    contexts.set(policy, context);
+}
+/** Read back a policy's attached context, or `undefined` when used standalone. */
+export function getPolicyContext(policy) {
+    return contexts.get(policy);
+}
+/**
+ * The empty `EffectivePermissions` for a guest / no-resolver Bouncer (D9). Built
+ * locally — never a `resolve()` call (the resolver requires a non-null user) and
+ * never importing 56.1's non-exported `ResolvedPermissions`. `has` → false;
+ * `hasAll([])` → true (vacuous); `hasAny` → false; empty sets; `scope` = active.
+ */
+export function emptyPermissions(scope) {
+    return {
+        has: () => false,
+        hasAll: (permissions) => permissions.length === 0,
+        hasAny: () => false,
+        permissions: new Set(),
+        roles: new Set(),
+        scope,
+    };
+}
+//# sourceMappingURL=policyContext.js.map

package/dist/bouncer/policyContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policyContext.js","sourceRoot":"","sources":["../../src/bouncer/policyContext.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAWH,MAAM,QAAQ,GAAG,IAAI,OAAO,EAA6B,CAAC;AAE1D,sFAAsF;AACtF,MAAM,UAAU,gBAAgB,CAC/B,MAAkB,EAClB,OAAsB;IAEtB,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,gBAAgB,CAC/B,MAAkB;IAElB,OAAO,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAY;IAC5C,OAAO;QACN,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK;QAChB,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QACjD,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK;QACnB,WAAW,EAAE,IAAI,GAAG,EAAU;QAC9B,KAAK,EAAE,IAAI,GAAG,EAAU;QACxB,KAAK;KACL,CAAC;AACH,CAAC"}

package/dist/bouncer/types.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Bouncer evaluation contract — Layer 2 of Warden's unified authorization.
+ *
+ * The shapes here are faithful to AdonisJS Bouncer (verified context7
+ * `/adonisjs/bouncer`, 2026-06-01): a predicate returns a boolean (sugar for
+ * allow / deny) or an explicit `AuthorizationResponse`, sync or async.
+ */
+import type { UserPayload } from "../AuthManager.js";
+import type { RightsResolver } from "../rights/RightsResolver.js";
+import type { Scope } from "../rights/types.js";
+import type { AuthorizationResponse } from "./AuthorizationResponse.js";
+/**
+ * Optional 4th `Bouncer` ctor argument (56.3, D1) — the scope dimension + the
+ * Layer-1 resolver. Both optional; omitting it ⇒ the implicit `global` scope
+ * with no resolver (single-tenant zero-config, D7). Additive: every 56.2 call
+ * site keeps compiling.
+ */
+export interface BouncerContext {
+    /** Active resolution scope. Defaults to `"global"`. */
+    readonly scope?: Scope;
+    /** Layer-1 resolver consulted for this Bouncer's `(user, scope)`. */
+    readonly resolver?: RightsResolver;
+}
+/** A predicate's return — bool sugar or an explicit response, sync or async (D7). */
+export type AuthorizerResponse = boolean | AuthorizationResponse | Promise<boolean | AuthorizationResponse>;
+/** A `before`/`after` hook return — like {@link AuthorizerResponse} plus `undefined` (fall-through). */
+export type HookResponse = boolean | AuthorizationResponse | undefined | Promise<boolean | AuthorizationResponse | undefined>;
+/** Options accepted by `Bouncer.ability` and the `@action` decorator. */
+export interface AbilityOptions {
+    allowGuest?: boolean;
+}
+/**
+ * An opaque ability reference produced by `Bouncer.ability`. Usable by-reference
+ * (typed call args via the `Args` phantom) AND by-name (registered in the
+ * Bouncer ctor's abilities record).
+ *
+ * `Args` is carried by the contravariant `__args` phantom — never read at
+ * runtime — so a concrete `Ability<[Post]>` is assignable to the universal
+ * `Ability<never[]>` storage type while `execute` stays invokable with the real
+ * args. This is a branding pattern (carry the type parameter in the signature),
+ * not a cast: `execute` itself takes `unknown[]` and the call sites validate
+ * args via the phantom at the verb boundary.
+ */
+export interface Ability<Args extends unknown[] = unknown[]> {
+    /** Whether a guest (null user) may invoke the callback (D5 step 2). */
+    readonly allowGuest: boolean;
+    /** Runs the ability callback. Guest-deny is applied by the evaluator, not here. */
+    readonly execute: (user: UserPayload | null, ...args: unknown[]) => AuthorizerResponse;
+    /** Phantom — ties the by-reference call args to `Args`; never read at runtime. */
+    readonly __args?: (...args: Args) => void;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/bouncer/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/bouncer/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAExE;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC9B,uDAAuD;IACvD,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;CACnC;AAED,qFAAqF;AACrF,MAAM,MAAM,kBAAkB,GAC3B,OAAO,GACP,qBAAqB,GACrB,OAAO,CAAC,OAAO,GAAG,qBAAqB,CAAC,CAAC;AAE5C,wGAAwG;AACxG,MAAM,MAAM,YAAY,GACrB,OAAO,GACP,qBAAqB,GACrB,SAAS,GACT,OAAO,CAAC,OAAO,GAAG,qBAAqB,GAAG,SAAS,CAAC,CAAC;AAExD,yEAAyE;AACzE,MAAM,WAAW,cAAc;IAC9B,UAAU,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,OAAO,CAAC,IAAI,SAAS,OAAO,EAAE,GAAG,OAAO,EAAE;IAC1D,uEAAuE;IACvE,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,mFAAmF;IACnF,QAAQ,CAAC,OAAO,EAAE,CACjB,IAAI,EAAE,WAAW,GAAG,IAAI,EACxB,GAAG,IAAI,EAAE,OAAO,EAAE,KACd,kBAAkB,CAAC;IACxB,kFAAkF;IAClF,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;CAC1C"}

package/dist/bouncer/types.js

@@ -0,0 +1,9 @@
+/**
+ * Bouncer evaluation contract — Layer 2 of Warden's unified authorization.
+ *
+ * The shapes here are faithful to AdonisJS Bouncer (verified context7
+ * `/adonisjs/bouncer`, 2026-06-01): a predicate returns a boolean (sugar for
+ * allow / deny) or an explicit `AuthorizationResponse`, sync or async.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/bouncer/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/bouncer/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}

package/dist/config.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Warden configuration — declared in `config/auth.ts` of the user app.
+ *
+ * @example
+ *   // config/auth.ts
+ *   import { defineConfig } from '@c9up/warden/config'
+ *   export default defineConfig({
+ *     defaultStrategy: 'jwt',
+ *     jwt: {
+ *       secret: env('APP_KEY'),
+ *       expiresInSeconds: 3600,
+ *       findUser: (id) => User.find(id),
+ *       verifyCredentials: (email, password) => User.verifyCredentials(email, password),
+ *     },
+ *   })
+ */
+import type { UserPayload } from "./AuthManager.js";
+import type { RightsStore } from "./rights/types.js";
+export interface JwtConfig {
+    secret: string;
+    expiresInSeconds?: number;
+    findUser: (id: string) => Promise<UserPayload | null>;
+    verifyCredentials: (email: string, password: string) => Promise<UserPayload | null>;
+}
+export interface WardenConfig {
+    /** Default auth strategy (default: 'jwt'). */
+    defaultStrategy?: string;
+    /** JWT strategy configuration. */
+    jwt?: JwtConfig;
+    /**
+     * Rights layer configuration (Epic 56). Supply a custom `store` to back the
+     * unified resolver with a DB-backed driver; when omitted, an in-memory
+     * `MemoryRightsStore` is registered as the default (AD5 — pluggable store,
+     * in-memory shipped).
+     */
+    rights?: {
+        store?: RightsStore;
+    };
+}
+/** Typed config helper — identity function for editor inference. */
+export declare function defineConfig(config: WardenConfig): WardenConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,MAAM,WAAW,SAAS;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACtD,iBAAiB,EAAE,CAClB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,KACZ,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,YAAY;IAC5B,8CAA8C;IAC9C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kCAAkC;IAClC,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB;;;;;OAKG;IACH,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,WAAW,CAAA;KAAE,CAAC;CACjC;AAED,oEAAoE;AACpE,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,YAAY,CAE/D"}

package/dist/config.js

@@ -0,0 +1,21 @@
+/**
+ * Warden configuration — declared in `config/auth.ts` of the user app.
+ *
+ * @example
+ *   // config/auth.ts
+ *   import { defineConfig } from '@c9up/warden/config'
+ *   export default defineConfig({
+ *     defaultStrategy: 'jwt',
+ *     jwt: {
+ *       secret: env('APP_KEY'),
+ *       expiresInSeconds: 3600,
+ *       findUser: (id) => User.find(id),
+ *       verifyCredentials: (email, password) => User.verifyCredentials(email, password),
+ *     },
+ *   })
+ */
+/** Typed config helper — identity function for editor inference. */
+export function defineConfig(config) {
+    return config;
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AA6BH,oEAAoE;AACpE,MAAM,UAAU,YAAY,CAAC,MAAoB;IAChD,OAAO,MAAM,CAAC;AACf,CAAC"}

package/dist/configure.d.ts

@@ -0,0 +1,10 @@
+interface Codemods {
+    addProvider(importPath: string): Promise<void>;
+    addEnvVars(vars: Record<string, string>): Promise<void>;
+    writeFile(filePath: string, content: string, options?: {
+        force?: boolean;
+    }): Promise<void>;
+}
+export declare function configure(codemods: Codemods): Promise<void>;
+export {};
+//# sourceMappingURL=configure.d.ts.map

package/dist/configure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"configure.d.ts","sourceRoot":"","sources":["../src/configure.ts"],"names":[],"mappings":"AAEA,UAAU,QAAQ;IACjB,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,SAAS,CACR,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAC3B,OAAO,CAAC,IAAI,CAAC,CAAC;CACjB;AAED,wBAAsB,SAAS,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CA8CjE"}

package/dist/configure.js

@@ -0,0 +1,44 @@
+import { randomBytes } from "node:crypto";
+export async function configure(codemods) {
+    const jwtSecret = randomBytes(32).toString("hex");
+    await codemods.addProvider("@c9up/warden/provider");
+    await codemods.addEnvVars({
+        JWT_SECRET: jwtSecret,
+        JWT_EXPIRY: "3600",
+    });
+    await codemods.writeFile("config/auth.ts", `import { defineConfig } from '@c9up/warden'
+
+export default defineConfig({
+  defaultStrategy: 'jwt',
+  jwt: {
+    secret: process.env.JWT_SECRET ?? '',
+    expiresInSeconds: Number(process.env.JWT_EXPIRY ?? '3600'),
+    // TODO: wire these to your user model (e.g. via your ORM).
+    // The JWT strategy needs both to issue and verify tokens.
+    findUser: async (_id) => {
+      throw new Error('TODO: implement findUser(id) for the JWT strategy in config/auth.ts')
+    },
+    verifyCredentials: async (_email, _password) => {
+      throw new Error('TODO: implement verifyCredentials(email, password) in config/auth.ts')
+    },
+  },
+})
+`);
+    // Announce the TODOs on stderr so `ream add @c9up/warden` doesn't end
+    // with a quiet success that the user reads as "auth is wired". The
+    // generated config/auth.ts ships with `throw new Error('TODO ...')`
+    // stubs for findUser + verifyCredentials — login and JWT verify will
+    // fail at the first call until the user fills them in. Surfacing the
+    // list here means an operator running the installer sees it
+    // immediately, not at the first request that hits the auth path.
+    process.stderr.write([
+        "",
+        "[@c9up/warden] config/auth.ts written with TODO stubs:",
+        "  - jwt.findUser(id) — wire to your user lookup (ORM)",
+        "  - jwt.verifyCredentials(email, password) — wire to your sign-in flow",
+        "Both throw at runtime until you implement them — login + JWT verify",
+        "will fail with `TODO: implement …` errors otherwise.",
+        "",
+    ].join("\n"));
+}
+//# sourceMappingURL=configure.js.map

package/dist/configure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configure.js","sourceRoot":"","sources":["../src/configure.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAY1C,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,QAAkB;IACjD,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,QAAQ,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC;IACpD,MAAM,QAAQ,CAAC,UAAU,CAAC;QACzB,UAAU,EAAE,SAAS;QACrB,UAAU,EAAE,MAAM;KAClB,CAAC,CAAC;IACH,MAAM,QAAQ,CAAC,SAAS,CACvB,gBAAgB,EAChB;;;;;;;;;;;;;;;;;CAiBD,CACC,CAAC;IACF,sEAAsE;IACtE,mEAAmE;IACnE,oEAAoE;IACpE,qEAAqE;IACrE,qEAAqE;IACrE,4DAA4D;IAC5D,iEAAiE;IACjE,OAAO,CAAC,MAAM,CAAC,KAAK,CACnB;QACC,EAAE;QACF,wDAAwD;QACxD,uDAAuD;QACvD,wEAAwE;QACxE,qEAAqE;QACrE,sDAAsD;QACtD,EAAE;KACF,CAAC,IAAI,CAAC,IAAI,CAAC,CACZ,CAAC;AACH,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,18 @@
+/**
+ * WardenError — structured error for Warden auth.
+ */
+export declare class WardenError extends Error {
+    readonly code: string;
+    readonly hint?: string;
+    /**
+     * Optional HTTP status carried by the error so the HTTP layer can map it
+     * (e.g. an authorization failure carries 403 — Epic 56 / story 56.2, D2).
+     * Additive and optional: callers that omit it behave exactly as before.
+     */
+    readonly status?: number;
+    constructor(code: string, message: string, options?: {
+        hint?: string;
+        status?: number;
+    });
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,qBAAa,WAAY,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAGxB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;CAQ7C"}

package/dist/errors.js

@@ -0,0 +1,21 @@
+/**
+ * WardenError — structured error for Warden auth.
+ */
+export class WardenError extends Error {
+    code;
+    hint;
+    /**
+     * Optional HTTP status carried by the error so the HTTP layer can map it
+     * (e.g. an authorization failure carries 403 — Epic 56 / story 56.2, D2).
+     * Additive and optional: callers that omit it behave exactly as before.
+     */
+    status;
+    constructor(code, message, options) {
+        super(message);
+        this.name = "WardenError";
+        this.code = `WARDEN_${code}`;
+        this.hint = options?.hint;
+        this.status = options?.status;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IAC5B,IAAI,CAAS;IACb,IAAI,CAAU;IACvB;;;;OAIG;IACM,MAAM,CAAU;IAEzB,YACC,IAAY,EACZ,OAAe,EACf,OAA4C;QAE5C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,UAAU,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,OAAO,EAAE,IAAI,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,MAAM,CAAC;IAC/B,CAAC;CACD"}

package/dist/firstcontact/FirstContactManager.d.ts

@@ -0,0 +1,25 @@
+/**
+ * FirstContactManager — OAuth2 social authentication.
+ *
+ * Usage:
+ *   firstContact.use('google').redirectUrl()
+ *   firstContact.use('google').callback(code)
+ */
+import type { FirstContactDriver, OAuthToken, OAuthUser } from "./types.js";
+export declare class FirstContactManager {
+    #private;
+    use(name: string): FirstContactDriver;
+    register(name: string, driver: FirstContactDriver): void;
+    redirect(name: string, state?: string): string;
+    /**
+     * Handle the OAuth callback. Pass `state` (from the query string) and
+     * `expectedState` (from the session, stored at redirect time) for CSRF
+     * protection. Omitting `expectedState` logs a security warning.
+     */
+    callback(name: string, code: string, state?: string, expectedState?: string): Promise<{
+        user: OAuthUser;
+        token: OAuthToken;
+    }>;
+    get registeredDrivers(): string[];
+}
+//# sourceMappingURL=FirstContactManager.d.ts.map

package/dist/firstcontact/FirstContactManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"FirstContactManager.d.ts","sourceRoot":"","sources":["../../src/firstcontact/FirstContactManager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5E,qBAAa,mBAAmB;;IAG/B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB;IASrC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,GAAG,IAAI;IAIxD,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM;IAI9C;;;;OAIG;IACG,QAAQ,CACb,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC;QAAE,IAAI,EAAE,SAAS,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,CAAC;IAUlD,IAAI,iBAAiB,IAAI,MAAM,EAAE,CAEhC;CACD"}

package/dist/firstcontact/FirstContactManager.js

@@ -0,0 +1,38 @@
+/**
+ * FirstContactManager — OAuth2 social authentication.
+ *
+ * Usage:
+ *   firstContact.use('google').redirectUrl()
+ *   firstContact.use('google').callback(code)
+ */
+export class FirstContactManager {
+    #drivers = new Map();
+    use(name) {
+        const driver = this.#drivers.get(name);
+        if (!driver)
+            throw new Error(`OAuth driver '${name}' not registered. Available: ${[...this.#drivers.keys()].join(", ")}`);
+        return driver;
+    }
+    register(name, driver) {
+        this.#drivers.set(name, driver);
+    }
+    redirect(name, state) {
+        return this.use(name).redirectUrl(state);
+    }
+    /**
+     * Handle the OAuth callback. Pass `state` (from the query string) and
+     * `expectedState` (from the session, stored at redirect time) for CSRF
+     * protection. Omitting `expectedState` logs a security warning.
+     */
+    async callback(name, code, state, expectedState) {
+        if (!expectedState) {
+            throw new Error(`[warden] OAuth callback for '${name}' requires expectedState for CSRF protection. ` +
+                `Store the state from redirect() in the session and pass it here.`);
+        }
+        return this.use(name).callback(code, state, expectedState);
+    }
+    get registeredDrivers() {
+        return [...this.#drivers.keys()];
+    }
+}
+//# sourceMappingURL=FirstContactManager.js.map

package/dist/firstcontact/FirstContactManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FirstContactManager.js","sourceRoot":"","sources":["../../src/firstcontact/FirstContactManager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,OAAO,mBAAmB;IAC/B,QAAQ,GAAoC,IAAI,GAAG,EAAE,CAAC;IAEtD,GAAG,CAAC,IAAY;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM;YACV,MAAM,IAAI,KAAK,CACd,iBAAiB,IAAI,gCAAgC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3F,CAAC;QACH,OAAO,MAAM,CAAC;IACf,CAAC;IAED,QAAQ,CAAC,IAAY,EAAE,MAA0B;QAChD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC;IAED,QAAQ,CAAC,IAAY,EAAE,KAAc;QACpC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CACb,IAAY,EACZ,IAAY,EACZ,KAAc,EACd,aAAsB;QAEtB,IAAI,CAAC,aAAa,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACd,gCAAgC,IAAI,gDAAgD;gBACnF,kEAAkE,CACnE,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,iBAAiB;QACpB,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC;CACD"}

package/dist/firstcontact/drivers/GitHubDriver.d.ts

@@ -0,0 +1,14 @@
+/**
+ * GitHub OAuth2 driver for FirstContact.
+ */
+import type { FirstContactDriver, OAuthConfig, OAuthToken, OAuthUser } from "../types.js";
+export declare class GitHubDriver implements FirstContactDriver {
+    private config;
+    constructor(config: OAuthConfig);
+    redirectUrl(state?: string): string;
+    callback(code: string, state?: string, expectedState?: string): Promise<{
+        user: OAuthUser;
+        token: OAuthToken;
+    }>;
+}
+//# sourceMappingURL=GitHubDriver.d.ts.map

package/dist/firstcontact/drivers/GitHubDriver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GitHubDriver.d.ts","sourceRoot":"","sources":["../../../src/firstcontact/drivers/GitHubDriver.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACX,kBAAkB,EAClB,WAAW,EACX,UAAU,EACV,SAAS,EACT,MAAM,aAAa,CAAC;AAErB,qBAAa,YAAa,YAAW,kBAAkB;IAC1C,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,WAAW;IAEvC,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM;IAU7B,QAAQ,CACb,IAAI,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC;QAAE,IAAI,EAAE,SAAS,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,CAAC;CAiDlD"}