@c9up/warden 0.1.3 → 0.1.4

package/dist/firstcontact/drivers/GitHubDriver.js

@@ -0,0 +1,61 @@
+/**
+ * GitHub OAuth2 driver for FirstContact.
+ */
+export class GitHubDriver {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    redirectUrl(state) {
+        const params = new URLSearchParams({
+            client_id: this.config.clientId,
+            redirect_uri: this.config.callbackUrl,
+            scope: (this.config.scopes ?? ["read:user", "user:email"]).join(" "),
+            ...(state ? { state } : {}),
+        });
+        return `https://github.com/login/oauth/authorize?${params}`;
+    }
+    async callback(code, state, expectedState) {
+        if (expectedState && state !== expectedState) {
+            throw new Error("OAuth state mismatch — possible CSRF attack");
+        }
+        const tokenRes = await fetch("https://github.com/login/oauth/access_token", {
+            method: "POST",
+            headers: {
+                Accept: "application/json",
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({
+                client_id: this.config.clientId,
+                client_secret: this.config.clientSecret,
+                code,
+            }),
+        });
+        if (!tokenRes.ok) {
+            throw new Error(`GitHub OAuth token exchange failed (HTTP ${tokenRes.status})`);
+        }
+        const tokens = (await tokenRes.json());
+        if (!tokens.access_token)
+            throw new Error("GitHub OAuth: no access_token in response");
+        const userRes = await fetch("https://api.github.com/user", {
+            headers: {
+                Authorization: `Bearer ${tokens.access_token}`,
+                Accept: "application/json",
+            },
+        });
+        if (!userRes.ok)
+            throw new Error(`GitHub user API failed (${userRes.status})`);
+        const raw = (await userRes.json());
+        return {
+            user: {
+                id: String(raw.id ?? ""),
+                email: String(raw.email ?? ""),
+                name: String(raw.name ?? raw.login ?? ""),
+                avatarUrl: raw.avatar_url,
+                raw,
+            },
+            token: { accessToken: String(tokens.access_token) },
+        };
+    }
+}
+//# sourceMappingURL=GitHubDriver.js.map

package/dist/firstcontact/drivers/GitHubDriver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GitHubDriver.js","sourceRoot":"","sources":["../../../src/firstcontact/drivers/GitHubDriver.ts"],"names":[],"mappings":"AAAA;;GAEG;AASH,MAAM,OAAO,YAAY;IACJ;IAApB,YAAoB,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAE3C,WAAW,CAAC,KAAc;QACzB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YAClC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;YACrC,KAAK,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACpE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3B,CAAC,CAAC;QACH,OAAO,4CAA4C,MAAM,EAAE,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,QAAQ,CACb,IAAY,EACZ,KAAc,EACd,aAAsB;QAEtB,IAAI,aAAa,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC3B,6CAA6C,EAC7C;YACC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACR,MAAM,EAAE,kBAAkB;gBAC1B,cAAc,EAAE,kBAAkB;aAClC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACpB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;gBACvC,IAAI;aACJ,CAAC;SACF,CACD,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACd,4CAA4C,QAAQ,CAAC,MAAM,GAAG,CAC9D,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;QAClE,IAAI,CAAC,MAAM,CAAC,YAAY;YACvB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAE9D,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,6BAA6B,EAAE;YAC1D,OAAO,EAAE;gBACR,aAAa,EAAE,UAAU,MAAM,CAAC,YAAY,EAAE;gBAC9C,MAAM,EAAE,kBAAkB;aAC1B;SACD,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,EAAE;YACd,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAA4B,CAAC;QAE9D,OAAO;YACN,IAAI,EAAE;gBACL,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;gBACxB,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC9B,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;gBACzC,SAAS,EAAE,GAAG,CAAC,UAAgC;gBAC/C,GAAG;aACH;YACD,KAAK,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE;SACnD,CAAC;IACH,CAAC;CACD"}

package/dist/firstcontact/drivers/GoogleDriver.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Google OAuth2 driver for FirstContact.
+ */
+import type { FirstContactDriver, OAuthConfig, OAuthToken, OAuthUser } from "../types.js";
+export declare class GoogleDriver implements FirstContactDriver {
+    private config;
+    constructor(config: OAuthConfig);
+    redirectUrl(state?: string): string;
+    callback(code: string, state?: string, expectedState?: string): Promise<{
+        user: OAuthUser;
+        token: OAuthToken;
+    }>;
+}
+//# sourceMappingURL=GoogleDriver.d.ts.map

package/dist/firstcontact/drivers/GoogleDriver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GoogleDriver.d.ts","sourceRoot":"","sources":["../../../src/firstcontact/drivers/GoogleDriver.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACX,kBAAkB,EAClB,WAAW,EACX,UAAU,EACV,SAAS,EACT,MAAM,aAAa,CAAC;AAErB,qBAAa,YAAa,YAAW,kBAAkB;IAC1C,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,WAAW;IAEvC,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM;IAY7B,QAAQ,CACb,IAAI,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC;QAAE,IAAI,EAAE,SAAS,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,CAAC;CAkDlD"}

package/dist/firstcontact/drivers/GoogleDriver.js

@@ -0,0 +1,64 @@
+/**
+ * Google OAuth2 driver for FirstContact.
+ */
+export class GoogleDriver {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    redirectUrl(state) {
+        const params = new URLSearchParams({
+            client_id: this.config.clientId,
+            redirect_uri: this.config.callbackUrl,
+            response_type: "code",
+            scope: (this.config.scopes ?? ["openid", "email", "profile"]).join(" "),
+            access_type: "offline",
+            ...(state ? { state } : {}),
+        });
+        return `https://accounts.google.com/o/oauth2/v2/auth?${params}`;
+    }
+    async callback(code, state, expectedState) {
+        // CSRF protection: validate state matches what we sent in redirectUrl().
+        if (expectedState && state !== expectedState) {
+            throw new Error("OAuth state mismatch — possible CSRF attack");
+        }
+        const tokenRes = await fetch("https://oauth2.googleapis.com/token", {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({
+                code,
+                client_id: this.config.clientId,
+                client_secret: this.config.clientSecret,
+                redirect_uri: this.config.callbackUrl,
+                grant_type: "authorization_code",
+            }),
+        });
+        if (!tokenRes.ok) {
+            throw new Error(`Google OAuth token exchange failed (HTTP ${tokenRes.status})`);
+        }
+        const tokens = (await tokenRes.json());
+        if (!tokens.access_token)
+            throw new Error("Google OAuth: no access_token in response");
+        const userRes = await fetch("https://www.googleapis.com/oauth2/v2/userinfo", {
+            headers: { Authorization: `Bearer ${tokens.access_token}` },
+        });
+        if (!userRes.ok)
+            throw new Error(`Google userinfo failed (${userRes.status})`);
+        const raw = (await userRes.json());
+        return {
+            user: {
+                id: String(raw.id ?? ""),
+                email: String(raw.email ?? ""),
+                name: String(raw.name ?? ""),
+                avatarUrl: raw.picture,
+                raw,
+            },
+            token: {
+                accessToken: String(tokens.access_token),
+                refreshToken: tokens.refresh_token,
+                expiresIn: tokens.expires_in,
+            },
+        };
+    }
+}
+//# sourceMappingURL=GoogleDriver.js.map

package/dist/firstcontact/drivers/GoogleDriver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GoogleDriver.js","sourceRoot":"","sources":["../../../src/firstcontact/drivers/GoogleDriver.ts"],"names":[],"mappings":"AAAA;;GAEG;AASH,MAAM,OAAO,YAAY;IACJ;IAApB,YAAoB,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAE3C,WAAW,CAAC,KAAc;QACzB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YAClC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;YACrC,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACvE,WAAW,EAAE,SAAS;YACtB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3B,CAAC,CAAC;QACH,OAAO,gDAAgD,MAAM,EAAE,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,QAAQ,CACb,IAAY,EACZ,KAAc,EACd,aAAsB;QAEtB,yEAAyE;QACzE,IAAI,aAAa,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,qCAAqC,EAAE;YACnE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACzB,IAAI;gBACJ,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;gBACvC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;gBACrC,UAAU,EAAE,oBAAoB;aAChC,CAAC;SACF,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACd,4CAA4C,QAAQ,CAAC,MAAM,GAAG,CAC9D,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;QAClE,IAAI,CAAC,MAAM,CAAC,YAAY;YACvB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAE9D,MAAM,OAAO,GAAG,MAAM,KAAK,CAC1B,+CAA+C,EAC/C;YACC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,YAAY,EAAE,EAAE;SAC3D,CACD,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,EAAE;YACd,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAA4B,CAAC;QAE9D,OAAO;YACN,IAAI,EAAE;gBACL,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;gBACxB,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC9B,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;gBAC5B,SAAS,EAAE,GAAG,CAAC,OAA6B;gBAC5C,GAAG;aACH;YACD,KAAK,EAAE;gBACN,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;gBACxC,YAAY,EAAE,MAAM,CAAC,aAAmC;gBACxD,SAAS,EAAE,MAAM,CAAC,UAAgC;aAClD;SACD,CAAC;IACH,CAAC;CACD"}

package/dist/firstcontact/types.d.ts

@@ -0,0 +1,34 @@
+/**
+ * FirstContact — OAuth2 social authentication types.
+ */
+export interface OAuthConfig {
+    clientId: string;
+    clientSecret: string;
+    callbackUrl: string;
+    scopes?: string[];
+}
+export interface OAuthUser {
+    id: string;
+    email: string;
+    name: string;
+    avatarUrl?: string;
+    raw: Record<string, unknown>;
+}
+export interface OAuthToken {
+    accessToken: string;
+    refreshToken?: string;
+    expiresIn?: number;
+}
+export interface FirstContactDriver {
+    redirectUrl(state?: string): string;
+    /**
+     * Handle the OAuth callback. `state` MUST be validated against the value
+     * originally passed to `redirectUrl()` to prevent CSRF login attacks.
+     * Throws if state is missing or mismatched.
+     */
+    callback(code: string, state?: string, expectedState?: string): Promise<{
+        user: OAuthUser;
+        token: OAuthToken;
+    }>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/firstcontact/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/firstcontact/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,WAAW;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,SAAS;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,UAAU;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IAClC,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CACP,IAAI,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC;QAAE,IAAI,EAAE,SAAS,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,CAAC,CAAC;CACnD"}

package/dist/firstcontact/types.js

@@ -0,0 +1,5 @@
+/**
+ * FirstContact — OAuth2 social authentication types.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/firstcontact/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/firstcontact/types.ts"],"names":[],"mappings":"AAAA;;GAEG"}

package/dist/index.d.ts

@@ -0,0 +1,38 @@
+/**
+ * @module @c9up/warden
+ * @description Warden — Authentication & authorization for the Ream framework
+ * @implements FR48, FR49, FR50, FR51, FR52, FR53
+ */
+export type { AuthConfig, AuthResult, AuthStrategy, UserPayload, } from "./AuthManager.js";
+export { AuthManager } from "./AuthManager.js";
+export type { AuthRateLimiterConfig } from "./AuthRateLimiter.js";
+export { AuthRateLimiter } from "./AuthRateLimiter.js";
+export { AuthorizationResponse } from "./bouncer/AuthorizationResponse.js";
+export { BasePolicy } from "./bouncer/BasePolicy.js";
+export { Bouncer } from "./bouncer/Bouncer.js";
+export { action, allowGuest, getActionMetadata, } from "./bouncer/decorators.js";
+export type { PolicyAuthorizer } from "./bouncer/PolicyAuthorizer.js";
+export type { Ability, AbilityOptions, AuthorizerResponse, BouncerContext, } from "./bouncer/types.js";
+export { defineConfig } from "./config.js";
+export { configure } from "./configure.js";
+export { WardenError } from "./errors.js";
+export { GitHubDriver } from "./firstcontact/drivers/GitHubDriver.js";
+export { GoogleDriver } from "./firstcontact/drivers/GoogleDriver.js";
+export { FirstContactManager } from "./firstcontact/FirstContactManager.js";
+export type { FirstContactDriver, OAuthConfig, OAuthToken, OAuthUser, } from "./firstcontact/types.js";
+export { Guard, getGuardMetadata, getPermissionMetadata, getRoleMetadata, Permission, Role, } from "./Guard.js";
+export type { RefreshTokenDriver, StoredRefreshToken, } from "./RefreshTokenStore.js";
+export { generateRefreshToken, MemoryRefreshTokenDriver, } from "./RefreshTokenStore.js";
+export { MemoryRightsStore } from "./rights/MemoryRightsStore.js";
+export { RightsResolver } from "./rights/RightsResolver.js";
+export type { EffectivePermissions, RightsStore, Scope, } from "./rights/types.js";
+export { scopeKey } from "./rights/types.js";
+export type { ApiKeyConfig } from "./strategies/ApiKeyStrategy.js";
+export { ApiKeyStrategy } from "./strategies/ApiKeyStrategy.js";
+export type { JwtStrategyConfig } from "./strategies/JwtStrategy.js";
+export { generateJwtSecret, JwtStrategy } from "./strategies/JwtStrategy.js";
+export type { SessionStore, SessionStrategyConfig, } from "./strategies/SessionStrategy.js";
+export { SessionStrategy } from "./strategies/SessionStrategy.js";
+export type { BlacklistDriver } from "./TokenBlacklist.js";
+export { MemoryBlacklistDriver, TokenBlacklist } from "./TokenBlacklist.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,YAAY,EACX,UAAU,EACV,UAAU,EACV,YAAY,EACZ,WAAW,GACX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,YAAY,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EACN,MAAM,EACN,UAAU,EACV,iBAAiB,GACjB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtE,YAAY,EACX,OAAO,EACP,cAAc,EACd,kBAAkB,EAClB,cAAc,GACd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,YAAY,EACX,kBAAkB,EAClB,WAAW,EACX,UAAU,EACV,SAAS,GACT,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACN,KAAK,EACL,gBAAgB,EAChB,qBAAqB,EACrB,eAAe,EACf,UAAU,EACV,IAAI,GACJ,MAAM,YAAY,CAAC;AACpB,YAAY,EACX,kBAAkB,EAClB,kBAAkB,GAClB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACN,oBAAoB,EACpB,wBAAwB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,YAAY,EACX,oBAAoB,EACpB,WAAW,EACX,KAAK,GACL,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,YAAY,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,YAAY,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC7E,YAAY,EACX,YAAY,EACZ,qBAAqB,GACrB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/index.js

@@ -0,0 +1,27 @@
+/**
+ * @module @c9up/warden
+ * @description Warden — Authentication & authorization for the Ream framework
+ * @implements FR48, FR49, FR50, FR51, FR52, FR53
+ */
+export { AuthManager } from "./AuthManager.js";
+export { AuthRateLimiter } from "./AuthRateLimiter.js";
+export { AuthorizationResponse } from "./bouncer/AuthorizationResponse.js";
+export { BasePolicy } from "./bouncer/BasePolicy.js";
+export { Bouncer } from "./bouncer/Bouncer.js";
+export { action, allowGuest, getActionMetadata, } from "./bouncer/decorators.js";
+export { defineConfig } from "./config.js";
+export { configure } from "./configure.js";
+export { WardenError } from "./errors.js";
+export { GitHubDriver } from "./firstcontact/drivers/GitHubDriver.js";
+export { GoogleDriver } from "./firstcontact/drivers/GoogleDriver.js";
+export { FirstContactManager } from "./firstcontact/FirstContactManager.js";
+export { Guard, getGuardMetadata, getPermissionMetadata, getRoleMetadata, Permission, Role, } from "./Guard.js";
+export { generateRefreshToken, MemoryRefreshTokenDriver, } from "./RefreshTokenStore.js";
+export { MemoryRightsStore } from "./rights/MemoryRightsStore.js";
+export { RightsResolver } from "./rights/RightsResolver.js";
+export { scopeKey } from "./rights/types.js";
+export { ApiKeyStrategy } from "./strategies/ApiKeyStrategy.js";
+export { generateJwtSecret, JwtStrategy } from "./strategies/JwtStrategy.js";
+export { SessionStrategy } from "./strategies/SessionStrategy.js";
+export { MemoryBlacklistDriver, TokenBlacklist } from "./TokenBlacklist.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EACN,MAAM,EACN,UAAU,EACV,iBAAiB,GACjB,MAAM,yBAAyB,CAAC;AAQjC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAO5E,OAAO,EACN,KAAK,EACL,gBAAgB,EAChB,qBAAqB,EACrB,eAAe,EACf,UAAU,EACV,IAAI,GACJ,MAAM,YAAY,CAAC;AAKpB,OAAO,EACN,oBAAoB,EACpB,wBAAwB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAM5D,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAEhE,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAK7E,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAElE,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/middleware.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Warden auth middleware — resolves the AuthManager from the Ream IoC container
+ * and authenticates the request using the configured strategy.
+ *
+ * Same pattern as `@c9up/blackhole/middleware` and AdonisJS `@adonisjs/auth`.
+ *
+ * @example
+ *   // start/kernel.ts
+ *   router.use([() => import('@c9up/warden/middleware')])
+ *
+ *   // On protected routes
+ *   import { Guard } from '@c9up/warden'
+ *   class OrderController {
+ *     @Guard('jwt')
+ *     async index(ctx) { ... }
+ *   }
+ */
+import { type AuthResult } from "./AuthManager.js";
+import type { SessionStore } from "./strategies/SessionStrategy.js";
+export interface WardenContext {
+    request: {
+        method: string;
+        url: string;
+        headers: Record<string, string>;
+    };
+    response: {
+        status: (code: number) => void;
+        json: (data: unknown) => void;
+    };
+    container: {
+        resolve: (key: string | symbol | (abstract new (...args: never[]) => unknown)) => unknown;
+    };
+    /** Session store — set by a session middleware upstream. */
+    session?: SessionStore;
+    /** Set by the middleware after successful auth. */
+    auth?: AuthResult;
+    /** The route handler metadata (decorators). */
+    route?: {
+        controller?: object;
+        action?: string | symbol;
+    };
+}
+type WardenNext = () => Promise<void> | void;
+/**
+ * Ream auth middleware — resolves AuthManager from the container,
+ * reads `@Guard`/`@Permission`/`@Role` metadata from the route handler,
+ * and authenticates + authorizes the request.
+ */
+export declare function wardenMiddleware(ctx: WardenContext, next: WardenNext): Promise<void>;
+export {};
+//# sourceMappingURL=middleware.d.ts.map

package/dist/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAEN,KAAK,UAAU,EAGf,MAAM,kBAAkB,CAAC;AAM1B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAcpE,MAAM,WAAW,aAAa;IAC7B,OAAO,EAAE;QACR,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAChC,CAAC;IACF,QAAQ,EAAE;QACT,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;QAC/B,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;KAC9B,CAAC;IACF,SAAS,EAAE;QACV,OAAO,EAAE,CACR,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,OAAO,CAAC,KAC/D,OAAO,CAAC;KACb,CAAC;IACF,4DAA4D;IAC5D,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,mDAAmD;IACnD,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,+CAA+C;IAC/C,KAAK,CAAC,EAAE;QACP,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;KACzB,CAAC;CACF;AAED,KAAK,UAAU,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAE7C;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,iBAoG1E"}

package/dist/middleware.js

@@ -0,0 +1,201 @@
+/**
+ * Warden auth middleware — resolves the AuthManager from the Ream IoC container
+ * and authenticates the request using the configured strategy.
+ *
+ * Same pattern as `@c9up/blackhole/middleware` and AdonisJS `@adonisjs/auth`.
+ *
+ * @example
+ *   // start/kernel.ts
+ *   router.use([() => import('@c9up/warden/middleware')])
+ *
+ *   // On protected routes
+ *   import { Guard } from '@c9up/warden'
+ *   class OrderController {
+ *     @Guard('jwt')
+ *     async index(ctx) { ... }
+ *   }
+ */
+import { AuthManager, sanitizePayload, } from "./AuthManager.js";
+import { getGuardMetadata, getPermissionMetadata, getRoleMetadata, } from "./Guard.js";
+function hasVerifyWithContext(strategy) {
+    return (typeof strategy.verifyWithContext === "function");
+}
+/**
+ * Ream auth middleware — resolves AuthManager from the container,
+ * reads `@Guard`/`@Permission`/`@Role` metadata from the route handler,
+ * and authenticates + authorizes the request.
+ */
+export async function wardenMiddleware(ctx, next) {
+    const auth = ctx.container.resolve(AuthManager);
+    // Read guard metadata from the route handler (if declared via decorators).
+    const controller = ctx.route?.controller;
+    const action = ctx.route?.action;
+    const strategies = controller && action ? getGuardMetadata(controller, action) : [];
+    // No guard on this route — pass through (public endpoint).
+    if (strategies.length === 0) {
+        await next();
+        return;
+    }
+    // Extract credentials from multiple sources:
+    // 1. Authorization: Bearer <jwt> (JWT strategy)
+    // 2. API key header — reads the header name from the ApiKeyStrategy config
+    //    (defaults to 'x-api-key' if no ApiKeyStrategy is registered)
+    // 3. Cookie/session (Session strategy — handled by the strategy itself via context)
+    const authHeader = ctx.request.headers.authorization ?? "";
+    const bearerToken = authHeader.startsWith("Bearer ")
+        ? authHeader.slice(7)
+        : "";
+    const apiKeyHeader = (() => {
+        try {
+            const s = auth.getStrategy("api-key");
+            return s.headerName ?? "x-api-key";
+        }
+        catch {
+            return "x-api-key";
+        }
+    })();
+    // HTTP header names are case-insensitive. Node + every Ream-side
+    // runtime lowercases incoming header keys, so an `ApiKeyStrategy`
+    // declared with `headerName: "X-Custom-Key"` would never match the
+    // incoming `x-custom-key` key without this normalisation — auth
+    // would silently fail even with the right header on the wire.
+    const apiKey = ctx.request.headers[apiKeyHeader.toLowerCase()] ?? "";
+    const hasSessionStrategy = strategies.some((s) => s === "session");
+    if (!bearerToken && !apiKey && !hasSessionStrategy) {
+        ctx.response.status(401);
+        ctx.response.json({
+            error: {
+                code: "UNAUTHORIZED",
+                message: "Missing authentication token (Bearer or x-api-key)",
+            },
+        });
+        return;
+    }
+    // Try each declared strategy. If every attempted strategy crashed AND none
+    // succeeded, the caller returns 500 instead of 401 — a server-side incident
+    // must stay observably distinct from a credential rejection.
+    const { result, attemptCount, crashCount } = await tryAuthenticate(auth, strategies, { bearerToken, apiKey, session: ctx.session, hasSessionStrategy });
+    if (!result?.authenticated || !result.user) {
+        if (attemptCount > 0 && crashCount === attemptCount) {
+            ctx.response.status(500);
+            ctx.response.json({
+                error: {
+                    code: "AUTH_STRATEGY_ERROR",
+                    message: "Authentication unavailable — one or more strategies failed. Check server logs.",
+                },
+            });
+            return;
+        }
+        ctx.response.status(401);
+        ctx.response.json({
+            error: {
+                code: "UNAUTHORIZED",
+                message: result?.error ?? "Authentication failed",
+            },
+        });
+        return;
+    }
+    const user = result.user;
+    // Permission + role checks are independent AND gates: the user must satisfy
+    // ALL required permissions AND ALL required roles. Having a role does NOT
+    // bypass permission checks. This is the strictest model — callers who want
+    // role-OR-permission semantics should use a custom guard instead.
+    if (controller && action) {
+        const denied = await checkAuthorization(auth, user, controller, action);
+        if (denied) {
+            ctx.response.status(403);
+            ctx.response.json({ error: { code: "FORBIDDEN", message: denied } });
+            return;
+        }
+    }
+    // Auth successful — attach to context and continue.
+    ctx.auth = result;
+    await next();
+}
+/**
+ * Try each declared strategy in order — session strategies via
+ * `verifyWithContext()`, others via `verify(token)` with native-first credential
+ * fallback. Distinguishes crashes (strategy threw / `strategyCrash`) from
+ * credential rejections so the caller can return 500 vs 401.
+ */
+async function tryAuthenticate(auth, strategies, creds) {
+    const { bearerToken, apiKey, session } = creds;
+    let result = null;
+    let attemptCount = 0;
+    let crashCount = 0;
+    for (const strategyName of strategies) {
+        try {
+            let r;
+            if (strategyName === "session") {
+                const strategy = auth.getStrategy(strategyName);
+                const verifyWithContext = strategy && hasVerifyWithContext(strategy)
+                    ? strategy.verifyWithContext
+                    : undefined;
+                if (verifyWithContext) {
+                    attemptCount++;
+                    r = await verifyWithContext.call(strategy, "", { session });
+                    // The session path bypasses AuthManager.verify(), so apply the
+                    // same prototype-pollution guard JWT / api-key users get there.
+                    if (r.user)
+                        sanitizePayload(r.user);
+                }
+                else {
+                    continue;
+                }
+            }
+            else {
+                // Native-first credential, other transport as fallback so a
+                // single-credential client still authenticates (and an invalid
+                // Bearer no longer masks a valid API key for the api-key strategy).
+                const credential = strategyName === "api-key"
+                    ? apiKey || bearerToken
+                    : bearerToken || apiKey;
+                if (!credential)
+                    continue;
+                attemptCount++;
+                r = await auth.verify(credential, strategyName);
+            }
+            if (r.authenticated) {
+                result = r;
+                break;
+            }
+            if (r.strategyCrash === true) {
+                crashCount++;
+                console.error(`[warden] strategy '${strategyName}' threw during verify(): ${r.error ?? "unknown error"}`);
+            }
+        }
+        catch (err) {
+            // AuthManager rethrows structured WardenError sentinels — treat these
+            // as crashes too (config errors, SessionStrategy.USE_LOGIN, etc.).
+            crashCount++;
+            console.error(`[warden] strategy '${strategyName}' threw during verify():`, err);
+        }
+    }
+    return { result, attemptCount, crashCount };
+}
+/**
+ * Gate the authenticated user against the route's @Permission / @Role decorators.
+ * Both are independent AND gates resolved ONCE against the same unified
+ * EffectivePermissions set (Epic 56, D7). Returns the FORBIDDEN message, or null
+ * when authorised (and zero-cost when neither decorator is present).
+ */
+async function checkAuthorization(auth, user, controller, action) {
+    const requiredPermissions = getPermissionMetadata(controller, action);
+    const requiredRoles = getRoleMetadata(controller, action);
+    if (requiredPermissions.length === 0 && requiredRoles.length === 0) {
+        return null;
+    }
+    const effective = await auth.resolvePermissions(user, "global");
+    if (requiredPermissions.length > 0) {
+        const missing = requiredPermissions.filter((p) => !effective.has(p));
+        if (missing.length > 0)
+            return `Missing permissions: ${missing.join(", ")}`;
+    }
+    if (requiredRoles.length > 0) {
+        const missing = requiredRoles.filter((r) => !effective.roles.has(r));
+        if (missing.length > 0)
+            return `Missing roles: ${missing.join(", ")}`;
+    }
+    return null;
+}
+//# sourceMappingURL=middleware.js.map

package/dist/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EACN,WAAW,EAGX,eAAe,GACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACN,gBAAgB,EAChB,qBAAqB,EACrB,eAAe,GACf,MAAM,YAAY,CAAC;AAOpB,SAAS,oBAAoB,CAC5B,QAAsB;IAEtB,OAAO,CACN,OAAQ,QAAgC,CAAC,iBAAiB,KAAK,UAAU,CACzE,CAAC;AACH,CAAC;AA8BD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAkB,EAAE,IAAgB;IAC1E,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,CAAgB,CAAC;IAE/D,2EAA2E;IAC3E,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC;IACzC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC;IACjC,MAAM,UAAU,GACf,UAAU,IAAI,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAElE,2DAA2D;IAC3D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,EAAE,CAAC;QACb,OAAO;IACR,CAAC;IAED,6CAA6C;IAC7C,gDAAgD;IAChD,2EAA2E;IAC3E,kEAAkE;IAClE,oFAAoF;IACpF,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;IAC3D,MAAM,WAAW,GAAG,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC;QACnD,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QACrB,CAAC,CAAC,EAAE,CAAC;IACN,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE;QAC1B,IAAI,CAAC;YACJ,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YACtC,OAAQ,CAA6B,CAAC,UAAU,IAAI,WAAW,CAAC;QACjE,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,WAAW,CAAC;QACpB,CAAC;IACF,CAAC,CAAC,EAAE,CAAC;IACL,iEAAiE;IACjE,kEAAkE;IAClE,mEAAmE;IACnE,gEAAgE;IAChE,8DAA8D;IAC9D,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAErE,MAAM,kBAAkB,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IACnE,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACpD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;YACjB,KAAK,EAAE;gBACN,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,oDAAoD;aAC7D;SACD,CAAC,CAAC;QACH,OAAO;IACR,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,6DAA6D;IAC7D,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,MAAM,eAAe,CACjE,IAAI,EACJ,UAAU,EACV,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,kBAAkB,EAAE,CACjE,CAAC;IAEF,IAAI,CAAC,MAAM,EAAE,aAAa,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,YAAY,GAAG,CAAC,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;YACrD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE;oBACN,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EACN,gFAAgF;iBACjF;aACD,CAAC,CAAC;YACH,OAAO;QACR,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;YACjB,KAAK,EAAE;gBACN,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,MAAM,EAAE,KAAK,IAAI,uBAAuB;aACjD;SACD,CAAC,CAAC;QACH,OAAO;IACR,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IAEzB,4EAA4E;IAC5E,0EAA0E;IAC1E,2EAA2E;IAC3E,kEAAkE;IAClE,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QACxE,IAAI,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YACrE,OAAO;QACR,CAAC;IACF,CAAC;IAED,oDAAoD;IACpD,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;IAClB,MAAM,IAAI,EAAE,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,eAAe,CAC7B,IAAiB,EACjB,UAAoB,EACpB,KAKC;IAMD,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC/C,IAAI,MAAM,GAAsB,IAAI,CAAC;IACrC,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,MAAM,YAAY,IAAI,UAAU,EAAE,CAAC;QACvC,IAAI,CAAC;YACJ,IAAI,CAAa,CAAC;YAClB,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;gBAChD,MAAM,iBAAiB,GACtB,QAAQ,IAAI,oBAAoB,CAAC,QAAQ,CAAC;oBACzC,CAAC,CAAC,QAAQ,CAAC,iBAAiB;oBAC5B,CAAC,CAAC,SAAS,CAAC;gBACd,IAAI,iBAAiB,EAAE,CAAC;oBACvB,YAAY,EAAE,CAAC;oBACf,CAAC,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;oBAC5D,+DAA+D;oBAC/D,gEAAgE;oBAChE,IAAI,CAAC,CAAC,IAAI;wBAAE,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACrC,CAAC;qBAAM,CAAC;oBACP,SAAS;gBACV,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,4DAA4D;gBAC5D,+DAA+D;gBAC/D,oEAAoE;gBACpE,MAAM,UAAU,GACf,YAAY,KAAK,SAAS;oBACzB,CAAC,CAAC,MAAM,IAAI,WAAW;oBACvB,CAAC,CAAC,WAAW,IAAI,MAAM,CAAC;gBAC1B,IAAI,CAAC,UAAU;oBAAE,SAAS;gBAC1B,YAAY,EAAE,CAAC;gBACf,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YACjD,CAAC;YACD,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC;gBACrB,MAAM,GAAG,CAAC,CAAC;gBACX,MAAM;YACP,CAAC;YACD,IAAI,CAAC,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC9B,UAAU,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CACZ,sBAAsB,YAAY,4BAA4B,CAAC,CAAC,KAAK,IAAI,eAAe,EAAE,CAC1F,CAAC;YACH,CAAC;QACF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,sEAAsE;YACtE,mEAAmE;YACnE,UAAU,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACZ,sBAAsB,YAAY,0BAA0B,EAC5D,GAAG,CACH,CAAC;QACH,CAAC;IACF,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,kBAAkB,CAChC,IAAiB,EACjB,IAAqC,EACrC,UAAkB,EAClB,MAAuB;IAEvB,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACtE,MAAM,aAAa,GAAG,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC1D,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAChE,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,wBAAwB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAC7E,CAAC;IACD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,kBAAkB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACvE,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC"}

package/dist/native.d.ts

@@ -0,0 +1,14 @@
+export interface NativeWarden {
+    jwtSign(payload: string, secret: string): string;
+    jwtVerify(token: string, secret: string): string;
+    constantTimeEq(a: string, b: string): boolean;
+    hmacSign(data: string, secret: string): string;
+    hmacVerify(data: string, signature: string, secret: string): boolean;
+    randomBytes(len: number): string;
+    randomHex(len: number): string;
+}
+/** Whether the Rust NAPI engine loaded. */
+export declare function isNativeAvailable(): boolean;
+/** Get the native engine. Returns undefined if not loaded — caller must throw. */
+export declare function nativeWarden(): NativeWarden | undefined;
+//# sourceMappingURL=native.d.ts.map

package/dist/native.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native.d.ts","sourceRoot":"","sources":["../src/native.ts"],"names":[],"mappings":"AAuBA,MAAM,WAAW,YAAY;IAC5B,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACjD,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACjD,cAAc,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/C,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IACrE,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;CAC/B;AAaD,2CAA2C;AAC3C,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAED,kFAAkF;AAClF,wBAAgB,YAAY,IAAI,YAAY,GAAG,SAAS,CAEvD"}

package/dist/native.js

@@ -0,0 +1,39 @@
+/**
+ * Warden NAPI loader — loads the `warden-engine-napi` binary for Rust-native
+ * JWT/HMAC/random operations. There is no TS fallback: when the binary is
+ * absent, `nativeWarden()` returns `undefined` and `JwtStrategy` (and any
+ * other consumer) throws `WARDEN_NAPI_REQUIRED` at use time. Password
+ * hashing is the sole responsibility of `@c9up/sigil` (story 40.1).
+ */
+import { createRequire } from "node:module";
+import { dirname, join } from "node:path";
+import { arch, platform } from "node:process";
+import { fileURLToPath } from "node:url";
+const nodeRequire = createRequire(import.meta.url);
+const currentDir = dirname(fileURLToPath(import.meta.url));
+const platformMap = {
+    "linux-x64": "linux-x64-gnu",
+    "linux-arm64": "linux-arm64-gnu",
+    "darwin-x64": "darwin-x64",
+    "darwin-arm64": "darwin-arm64",
+    "win32-x64": "win32-x64-msvc",
+};
+let native;
+try {
+    const suffix = platformMap[`${platform}-${arch}`];
+    if (suffix) {
+        native = nodeRequire(join(currentDir, `../index.${suffix}.node`));
+    }
+}
+catch {
+    // Binary not available — JwtStrategy will throw WARDEN_NAPI_REQUIRED at use time.
+}
+/** Whether the Rust NAPI engine loaded. */
+export function isNativeAvailable() {
+    return native !== undefined;
+}
+/** Get the native engine. Returns undefined if not loaded — caller must throw. */
+export function nativeWarden() {
+    return native;
+}
+//# sourceMappingURL=native.js.map

package/dist/native.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native.js","sourceRoot":"","sources":["../src/native.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnD,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE3D,MAAM,WAAW,GAA2B;IAC3C,WAAW,EAAE,eAAe;IAC5B,aAAa,EAAE,iBAAiB;IAChC,YAAY,EAAE,YAAY;IAC1B,cAAc,EAAE,cAAc;IAC9B,WAAW,EAAE,gBAAgB;CAC7B,CAAC;AAYF,IAAI,MAAgC,CAAC;AAErC,IAAI,CAAC;IACJ,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC;IAClD,IAAI,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,MAAM,OAAO,CAAC,CAAC,CAAC;IACnE,CAAC;AACF,CAAC;AAAC,MAAM,CAAC;IACR,kFAAkF;AACnF,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,iBAAiB;IAChC,OAAO,MAAM,KAAK,SAAS,CAAC;AAC7B,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,YAAY;IAC3B,OAAO,MAAM,CAAC;AACf,CAAC"}