@c9up/warden 0.1.3 → 0.1.5

package/dist/RefreshTokenStore.d.ts

@@ -0,0 +1,34 @@
+/**
+ * RefreshTokenStore — server-side opaque refresh token management.
+ *
+ * AdonisJS opaque token pattern:
+ *   { accessToken, refreshToken, expiresIn }
+ *   POST /auth/refresh → new pair, old token invalidated
+ *
+ * @implements MISS-5
+ */
+export interface StoredRefreshToken {
+    token: string;
+    userId: string | number;
+    expiresAt: number;
+    createdAt: number;
+}
+export interface RefreshTokenDriver {
+    store(token: StoredRefreshToken): Promise<void>;
+    find(token: string): Promise<StoredRefreshToken | null>;
+    revoke(token: string): Promise<void>;
+    revokeAllForUser(userId: string | number): Promise<void>;
+    cleanup(): Promise<void>;
+}
+/** In-memory driver for development. */
+export declare class MemoryRefreshTokenDriver implements RefreshTokenDriver {
+    private tokens;
+    store(token: StoredRefreshToken): Promise<void>;
+    find(token: string): Promise<StoredRefreshToken | null>;
+    revoke(token: string): Promise<void>;
+    revokeAllForUser(userId: string | number): Promise<void>;
+    cleanup(): Promise<void>;
+}
+/** Generate an opaque refresh token. */
+export declare function generateRefreshToken(): string;
+//# sourceMappingURL=RefreshTokenStore.d.ts.map

package/dist/RefreshTokenStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RefreshTokenStore.d.ts","sourceRoot":"","sources":["../src/RefreshTokenStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,MAAM,WAAW,kBAAkB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IAClC,KAAK,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACxD,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AAED,wCAAwC;AACxC,qBAAa,wBAAyB,YAAW,kBAAkB;IAClE,OAAO,CAAC,MAAM,CAA8C;IAEtD,KAAK,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/C,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAUvD,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpC,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMxD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAM9B;AAED,wCAAwC;AACxC,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C"}

package/dist/RefreshTokenStore.js

@@ -0,0 +1,48 @@
+/**
+ * RefreshTokenStore — server-side opaque refresh token management.
+ *
+ * AdonisJS opaque token pattern:
+ *   { accessToken, refreshToken, expiresIn }
+ *   POST /auth/refresh → new pair, old token invalidated
+ *
+ * @implements MISS-5
+ */
+import { randomBytes } from "node:crypto";
+/** In-memory driver for development. */
+export class MemoryRefreshTokenDriver {
+    tokens = new Map();
+    async store(token) {
+        this.tokens.set(token.token, token);
+    }
+    async find(token) {
+        const stored = this.tokens.get(token);
+        if (!stored)
+            return null;
+        if (stored.expiresAt < Date.now()) {
+            this.tokens.delete(token);
+            return null;
+        }
+        return stored;
+    }
+    async revoke(token) {
+        this.tokens.delete(token);
+    }
+    async revokeAllForUser(userId) {
+        for (const [key, val] of this.tokens) {
+            if (val.userId === userId)
+                this.tokens.delete(key);
+        }
+    }
+    async cleanup() {
+        const now = Date.now();
+        for (const [key, val] of this.tokens) {
+            if (val.expiresAt < now)
+                this.tokens.delete(key);
+        }
+    }
+}
+/** Generate an opaque refresh token. */
+export function generateRefreshToken() {
+    return randomBytes(48).toString("base64url");
+}
+//# sourceMappingURL=RefreshTokenStore.js.map

package/dist/RefreshTokenStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RefreshTokenStore.js","sourceRoot":"","sources":["../src/RefreshTokenStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAiB1C,wCAAwC;AACxC,MAAM,OAAO,wBAAwB;IAC5B,MAAM,GAAoC,IAAI,GAAG,EAAE,CAAC;IAE5D,KAAK,CAAC,KAAK,CAAC,KAAyB;QACpC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAa;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,OAAO,IAAI,CAAC;QACb,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACzB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,MAAuB;QAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACtC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACpD,CAAC;IACF,CAAC;IAED,KAAK,CAAC,OAAO;QACZ,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACtC,IAAI,GAAG,CAAC,SAAS,GAAG,GAAG;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClD,CAAC;IACF,CAAC;CACD;AAED,wCAAwC;AACxC,MAAM,UAAU,oBAAoB;IACnC,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC9C,CAAC"}

package/dist/ResilientBlacklistDriver.d.ts

@@ -0,0 +1,35 @@
+/**
+ * ResilientBlacklistDriver — wraps a primary blacklist (e.g. KeyDB-backed
+ * `RedisBlacklistDriver`) with an in-memory fallback so a cache outage never
+ * takes the whole app down.
+ *
+ * Policy (fail-open on reads):
+ *   - `add()`  — if the primary throws, the revocation is recorded in the
+ *                fallback so logout stays effective on this instance.
+ *   - `has()`  — if the primary throws, consult the fallback: a token revoked
+ *                during the outage is still caught here; anything else is
+ *                allowed through (fail-open). Access tokens are short-lived, so
+ *                the window a missed revocation survives is bounded by the token
+ *                TTL — the blacklist is defense-in-depth above expiry, not the
+ *                primary boundary.
+ *
+ * Every degradation invokes `onDegrade` (defaults to a stderr warning) so the
+ * outage is observable.
+ */
+import { type BlacklistDriver } from "./TokenBlacklist.js";
+export interface BlacklistDegradeEvent {
+    op: "add" | "has" | "cleanup";
+    error: unknown;
+}
+export interface ResilientBlacklistConfig {
+    /** Invoked whenever the primary driver fails and the fallback is used. */
+    onDegrade?: (event: BlacklistDegradeEvent) => void;
+}
+export declare class ResilientBlacklistDriver implements BlacklistDriver {
+    #private;
+    constructor(primary: BlacklistDriver, fallback?: BlacklistDriver, config?: ResilientBlacklistConfig);
+    add(jti: string, expiresAt: number): Promise<void>;
+    has(jti: string): Promise<boolean>;
+    cleanup(): Promise<void>;
+}
+//# sourceMappingURL=ResilientBlacklistDriver.d.ts.map

package/dist/ResilientBlacklistDriver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ResilientBlacklistDriver.d.ts","sourceRoot":"","sources":["../src/ResilientBlacklistDriver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EACN,KAAK,eAAe,EAEpB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,WAAW,qBAAqB;IACrC,EAAE,EAAE,KAAK,GAAG,KAAK,GAAG,SAAS,CAAC;IAC9B,KAAK,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,wBAAwB;IACxC,0EAA0E;IAC1E,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,IAAI,CAAC;CACnD;AASD,qBAAa,wBAAyB,YAAW,eAAe;;gBAM9D,OAAO,EAAE,eAAe,EACxB,QAAQ,GAAE,eAA6C,EACvD,MAAM,GAAE,wBAA6B;IAOhC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASlD,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAUlC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAQ9B"}

package/dist/ResilientBlacklistDriver.js

@@ -0,0 +1,61 @@
+/**
+ * ResilientBlacklistDriver — wraps a primary blacklist (e.g. KeyDB-backed
+ * `RedisBlacklistDriver`) with an in-memory fallback so a cache outage never
+ * takes the whole app down.
+ *
+ * Policy (fail-open on reads):
+ *   - `add()`  — if the primary throws, the revocation is recorded in the
+ *                fallback so logout stays effective on this instance.
+ *   - `has()`  — if the primary throws, consult the fallback: a token revoked
+ *                during the outage is still caught here; anything else is
+ *                allowed through (fail-open). Access tokens are short-lived, so
+ *                the window a missed revocation survives is bounded by the token
+ *                TTL — the blacklist is defense-in-depth above expiry, not the
+ *                primary boundary.
+ *
+ * Every degradation invokes `onDegrade` (defaults to a stderr warning) so the
+ * outage is observable.
+ */
+import { MemoryBlacklistDriver, } from "./TokenBlacklist.js";
+function defaultOnDegrade({ op, error }) {
+    console.warn(`[warden] blacklist primary failed on ${op}; using in-memory fallback:`, error);
+}
+export class ResilientBlacklistDriver {
+    #primary;
+    #fallback;
+    #onDegrade;
+    constructor(primary, fallback = new MemoryBlacklistDriver(), config = {}) {
+        this.#primary = primary;
+        this.#fallback = fallback;
+        this.#onDegrade = config.onDegrade ?? defaultOnDegrade;
+    }
+    async add(jti, expiresAt) {
+        try {
+            await this.#primary.add(jti, expiresAt);
+        }
+        catch (error) {
+            this.#onDegrade({ op: "add", error });
+            await this.#fallback.add(jti, expiresAt);
+        }
+    }
+    async has(jti) {
+        try {
+            return await this.#primary.has(jti);
+        }
+        catch (error) {
+            this.#onDegrade({ op: "has", error });
+            // Fail-open: honour in-outage revocations on this instance, allow rest.
+            return this.#fallback.has(jti);
+        }
+    }
+    async cleanup() {
+        try {
+            await this.#primary.cleanup();
+        }
+        catch (error) {
+            this.#onDegrade({ op: "cleanup", error });
+        }
+        await this.#fallback.cleanup();
+    }
+}
+//# sourceMappingURL=ResilientBlacklistDriver.js.map

package/dist/ResilientBlacklistDriver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ResilientBlacklistDriver.js","sourceRoot":"","sources":["../src/ResilientBlacklistDriver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAEN,qBAAqB,GACrB,MAAM,qBAAqB,CAAC;AAY7B,SAAS,gBAAgB,CAAC,EAAE,EAAE,EAAE,KAAK,EAAyB;IAC7D,OAAO,CAAC,IAAI,CACX,wCAAwC,EAAE,6BAA6B,EACvE,KAAK,CACL,CAAC;AACH,CAAC;AAED,MAAM,OAAO,wBAAwB;IAC3B,QAAQ,CAAkB;IAC1B,SAAS,CAAkB;IAC3B,UAAU,CAAyC;IAE5D,YACC,OAAwB,EACxB,WAA4B,IAAI,qBAAqB,EAAE,EACvD,SAAmC,EAAE;QAErC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC1B,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,SAAS,IAAI,gBAAgB,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,SAAiB;QACvC,IAAI,CAAC;YACJ,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YACtC,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC1C,CAAC;IACF,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACpB,IAAI,CAAC;YACJ,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YACtC,wEAAwE;YACxE,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC;IACF,CAAC;IAED,KAAK,CAAC,OAAO;QACZ,IAAI,CAAC;YACJ,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;IAChC,CAAC;CACD"}

package/dist/TokenBlacklist.d.ts

@@ -0,0 +1,30 @@
+/**
+ * TokenBlacklist — revoke JWT tokens before expiry.
+ *
+ * Stores JTI (JWT ID) with expiry. Supports Memory and Redis drivers.
+ *
+ * @implements MISS-6
+ */
+export interface BlacklistDriver {
+    add(jti: string, expiresAt: number): Promise<void>;
+    has(jti: string): Promise<boolean>;
+    cleanup(): Promise<void>;
+}
+/** In-memory blacklist for development. */
+export declare class MemoryBlacklistDriver implements BlacklistDriver {
+    private entries;
+    add(jti: string, expiresAt: number): Promise<void>;
+    has(jti: string): Promise<boolean>;
+    cleanup(): Promise<void>;
+}
+export declare class TokenBlacklist {
+    private driver;
+    constructor(driver: BlacklistDriver);
+    /** Revoke a token by its JTI claim. */
+    revoke(jti: string, expiresAt: number): Promise<void>;
+    /** Check if a token JTI is blacklisted. */
+    isRevoked(jti: string): Promise<boolean>;
+    /** Remove expired entries. */
+    cleanup(): Promise<void>;
+}
+//# sourceMappingURL=TokenBlacklist.d.ts.map

package/dist/TokenBlacklist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TokenBlacklist.d.ts","sourceRoot":"","sources":["../src/TokenBlacklist.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,WAAW,eAAe;IAC/B,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AAED,2CAA2C;AAC3C,qBAAa,qBAAsB,YAAW,eAAe;IAC5D,OAAO,CAAC,OAAO,CAAkC;IAE3C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlD,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAUlC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAM9B;AAED,qBAAa,cAAc;IACd,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,eAAe;IAE3C,uCAAuC;IACjC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI3D,2CAA2C;IACrC,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAI9C,8BAA8B;IACxB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAG9B"}

package/dist/TokenBlacklist.js

@@ -0,0 +1,50 @@
+/**
+ * TokenBlacklist — revoke JWT tokens before expiry.
+ *
+ * Stores JTI (JWT ID) with expiry. Supports Memory and Redis drivers.
+ *
+ * @implements MISS-6
+ */
+/** In-memory blacklist for development. */
+export class MemoryBlacklistDriver {
+    entries = new Map();
+    async add(jti, expiresAt) {
+        this.entries.set(jti, expiresAt);
+    }
+    async has(jti) {
+        const expiresAt = this.entries.get(jti);
+        if (expiresAt === undefined)
+            return false;
+        if (expiresAt < Date.now()) {
+            this.entries.delete(jti);
+            return false;
+        }
+        return true;
+    }
+    async cleanup() {
+        const now = Date.now();
+        for (const [jti, exp] of this.entries) {
+            if (exp < now)
+                this.entries.delete(jti);
+        }
+    }
+}
+export class TokenBlacklist {
+    driver;
+    constructor(driver) {
+        this.driver = driver;
+    }
+    /** Revoke a token by its JTI claim. */
+    async revoke(jti, expiresAt) {
+        await this.driver.add(jti, expiresAt);
+    }
+    /** Check if a token JTI is blacklisted. */
+    async isRevoked(jti) {
+        return this.driver.has(jti);
+    }
+    /** Remove expired entries. */
+    async cleanup() {
+        return this.driver.cleanup();
+    }
+}
+//# sourceMappingURL=TokenBlacklist.js.map

package/dist/TokenBlacklist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TokenBlacklist.js","sourceRoot":"","sources":["../src/TokenBlacklist.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAQH,2CAA2C;AAC3C,MAAM,OAAO,qBAAqB;IACzB,OAAO,GAAwB,IAAI,GAAG,EAAE,CAAC;IAEjD,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,SAAiB;QACvC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACpB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAC1C,IAAI,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,OAAO,KAAK,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IAED,KAAK,CAAC,OAAO;QACZ,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACvC,IAAI,GAAG,GAAG,GAAG;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzC,CAAC;IACF,CAAC;CACD;AAED,MAAM,OAAO,cAAc;IACN;IAApB,YAAoB,MAAuB;QAAvB,WAAM,GAAN,MAAM,CAAiB;IAAG,CAAC;IAE/C,uCAAuC;IACvC,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,SAAiB;QAC1C,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACvC,CAAC;IAED,2CAA2C;IAC3C,KAAK,CAAC,SAAS,CAAC,GAAW;QAC1B,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,8BAA8B;IAC9B,KAAK,CAAC,OAAO;QACZ,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;IAC9B,CAAC;CACD"}

package/dist/WardenProvider.d.ts

@@ -0,0 +1,19 @@
+interface WardenContainer {
+    singleton(token: unknown, factory: () => unknown): void;
+    resolve(token: unknown): unknown;
+}
+interface WardenConfigStore {
+    get<T = unknown>(key: string): T | undefined;
+}
+export interface WardenAppContext {
+    container: WardenContainer;
+    config: WardenConfigStore;
+}
+export default class WardenProvider {
+    protected app: WardenAppContext;
+    constructor(app: WardenAppContext);
+    register(): void;
+    boot(): Promise<void>;
+}
+export {};
+//# sourceMappingURL=WardenProvider.d.ts.map

package/dist/WardenProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"WardenProvider.d.ts","sourceRoot":"","sources":["../src/WardenProvider.ts"],"names":[],"mappings":"AASA,UAAU,eAAe;IACxB,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,OAAO,GAAG,IAAI,CAAC;IACxD,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;CACjC;AAED,UAAU,iBAAiB;IAC1B,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC;CAC7C;AAED,MAAM,WAAW,gBAAgB;IAChC,SAAS,EAAE,eAAe,CAAC;IAC3B,MAAM,EAAE,iBAAiB,CAAC;CAC1B;AAED,MAAM,CAAC,OAAO,OAAO,cAAc;IACtB,SAAS,CAAC,GAAG,EAAE,gBAAgB;gBAArB,GAAG,EAAE,gBAAgB;IAE3C,QAAQ;IAiEF,IAAI;CAGV"}

package/dist/WardenProvider.js

@@ -0,0 +1,71 @@
+import { AuthManager } from "./AuthManager.js";
+import { WardenError } from "./errors.js";
+import { MfaManager } from "./mfa/MfaManager.js";
+import { MemoryRightsStore } from "./rights/MemoryRightsStore.js";
+import { RightsResolver } from "./rights/RightsResolver.js";
+import { setAuth } from "./services/main.js";
+import { JwtStrategy } from "./strategies/JwtStrategy.js";
+export default class WardenProvider {
+    app;
+    constructor(app) {
+        this.app = app;
+    }
+    register() {
+        // Register JwtStrategy first so it's available before AuthManager resolves.
+        // The previous version nested the JwtStrategy registration inside the
+        // AuthManager factory — that was order-dependent and fragile.
+        const config = this.app.config.get("auth");
+        // Fail-fast at register-time so the operator gets a clear actionable
+        // error during boot instead of an opaque runtime crash on the first
+        // protected request. Previously, missing `config.auth` produced an
+        // AuthManager with `strategies: {}` and `defaultStrategy: 'jwt'`,
+        // passing the (then-permissive) constructor and erroring deep in the
+        // middleware loop.
+        if (!config?.jwt) {
+            throw new WardenError("WARDEN_NO_AUTH_CONFIG", `@c9up/warden: no authentication strategies configured. Set config.warden.auth.jwt (or another strategy) in your reamrc.ts before registering WardenProvider.`);
+        }
+        const jwt = new JwtStrategy(config.jwt);
+        this.app.container.singleton(JwtStrategy, () => jwt);
+        // Rights layer (Epic 56): one resolver singleton backs BOTH the coarse
+        // RBAC helpers (injected into AuthManager below) and — once 56.6 lands —
+        // the Bouncer construction, so a coarse question and a policy question
+        // resolve through the SAME instance (single unification point, AC-E3).
+        // The store defaults to an in-memory driver and is exposed (by class)
+        // so an app can seed roles/grants at boot, or supply its own via
+        // `config.auth.rights.store` (AD5).
+        const rightsStore = config.rights?.store ?? new MemoryRightsStore();
+        const rightsResolver = new RightsResolver(rightsStore);
+        this.app.container.singleton(RightsResolver, () => rightsResolver);
+        if (rightsStore instanceof MemoryRightsStore) {
+            this.app.container.singleton(MemoryRightsStore, () => rightsStore);
+        }
+        this.app.container.singleton(AuthManager, () => {
+            const strategies = { jwt };
+            return new AuthManager({
+                defaultStrategy: config.defaultStrategy ?? "jwt",
+                strategies,
+                rights: rightsResolver,
+            });
+        });
+        // String alias so consumers that can't import the AuthManager class
+        // (e.g. @c9up/station, which stays agnostic of warden) can resolve
+        // it by name. Mirrors the convention other providers follow
+        // (events → "bus", rosetta → "i18n"). Without this, Station's
+        // `container.resolve("auth")` threw and its admin auth gate
+        // silently fell back to open-mode.
+        this.app.container.singleton("auth", () => this.app.container.resolve(AuthManager));
+        // MFA (optional): the app builds an MfaManager with its persistent stores
+        // + providers and passes it via config.mfa. Registered by class and under
+        // the "mfa" string alias (same convention as "auth") so controllers and
+        // agnostic consumers can resolve it.
+        const mfa = config.mfa?.manager;
+        if (mfa) {
+            this.app.container.singleton(MfaManager, () => mfa);
+            this.app.container.singleton("mfa", () => mfa);
+        }
+    }
+    async boot() {
+        setAuth(this.app.container.resolve(AuthManager));
+    }
+}
+//# sourceMappingURL=WardenProvider.js.map

package/dist/WardenProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WardenProvider.js","sourceRoot":"","sources":["../src/WardenProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAgB1D,MAAM,CAAC,OAAO,OAAO,cAAc;IACZ;IAAtB,YAAsB,GAAqB;QAArB,QAAG,GAAH,GAAG,CAAkB;IAAG,CAAC;IAE/C,QAAQ;QACP,4EAA4E;QAC5E,sEAAsE;QACtE,8DAA8D;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAe,MAAM,CAAC,CAAC;QAEzD,qEAAqE;QACrE,oEAAoE;QACpE,mEAAmE;QACnE,kEAAkE;QAClE,qEAAqE;QACrE,mBAAmB;QACnB,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC;YAClB,MAAM,IAAI,WAAW,CACpB,uBAAuB,EACvB,8JAA8J,CAC9J,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QAErD,uEAAuE;QACvE,yEAAyE;QACzE,uEAAuE;QACvE,uEAAuE;QACvE,sEAAsE;QACtE,iEAAiE;QACjE,oCAAoC;QACpC,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACpE,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,WAAW,CAAC,CAAC;QACvD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,CAAC;QACnE,IAAI,WAAW,YAAY,iBAAiB,EAAE,CAAC;YAC9C,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC;QACpE,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,WAAW,EAAE,GAAG,EAAE;YAC9C,MAAM,UAAU,GAAgC,EAAE,GAAG,EAAE,CAAC;YACxD,OAAO,IAAI,WAAW,CAAC;gBACtB,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,KAAK;gBAChD,UAAU;gBACV,MAAM,EAAE,cAAc;aACtB,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,oEAAoE;QACpE,mEAAmE;QACnE,4DAA4D;QAC5D,8DAA8D;QAC9D,4DAA4D;QAC5D,mCAAmC;QACnC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CACzC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,CACvC,CAAC;QAEF,0EAA0E;QAC1E,0EAA0E;QAC1E,wEAAwE;QACxE,qCAAqC;QACrC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC;QAChC,IAAI,GAAG,EAAE,CAAC;YACT,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;YACpD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QAChD,CAAC;IACF,CAAC;IAED,KAAK,CAAC,IAAI;QACT,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,CAAgB,CAAC,CAAC;IACjE,CAAC;CACD"}

package/dist/bouncer/AuthorizationResponse.d.ts

@@ -0,0 +1,25 @@
+/**
+ * AuthorizationResponse — the value type every Bouncer check resolves to.
+ *
+ * Layer 2 (EVALUATION) of Warden's unified authorization (Epic 56). Faithful
+ * to AdonisJS Bouncer's `AuthorizationResponse`: instances are produced only by
+ * the `allow()` / `deny()` static constructors (the constructor is private), a
+ * denial defaults to HTTP 403, and a `translation` field is carried for shape
+ * parity with Adonis's i18n hook (always `undefined` in 56.2 — D6).
+ */
+export declare class AuthorizationResponse {
+    readonly authorized: boolean;
+    readonly message?: string;
+    readonly status?: number;
+    /** Parity placeholder for an i18n binding (always undefined in 56.2 — D6). */
+    readonly translation?: {
+        identifier: string;
+        data?: Record<string, unknown>;
+    };
+    private constructor();
+    /** Authorized response (no status). */
+    static allow(): AuthorizationResponse;
+    /** Denied response; `status` defaults to 403 (D6). */
+    static deny(message?: string, status?: number): AuthorizationResponse;
+}
+//# sourceMappingURL=AuthorizationResponse.d.ts.map

package/dist/bouncer/AuthorizationResponse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthorizationResponse.d.ts","sourceRoot":"","sources":["../../src/bouncer/AuthorizationResponse.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,qBAAa,qBAAqB;IACjC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,8EAA8E;IAC9E,QAAQ,CAAC,WAAW,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IAE9E,OAAO;IAYP,uCAAuC;IACvC,MAAM,CAAC,KAAK,IAAI,qBAAqB;IAIrC,sDAAsD;IACtD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,SAAM,GAAG,qBAAqB;CAGlE"}

package/dist/bouncer/AuthorizationResponse.js

@@ -0,0 +1,31 @@
+/**
+ * AuthorizationResponse — the value type every Bouncer check resolves to.
+ *
+ * Layer 2 (EVALUATION) of Warden's unified authorization (Epic 56). Faithful
+ * to AdonisJS Bouncer's `AuthorizationResponse`: instances are produced only by
+ * the `allow()` / `deny()` static constructors (the constructor is private), a
+ * denial defaults to HTTP 403, and a `translation` field is carried for shape
+ * parity with Adonis's i18n hook (always `undefined` in 56.2 — D6).
+ */
+export class AuthorizationResponse {
+    authorized;
+    message;
+    status;
+    /** Parity placeholder for an i18n binding (always undefined in 56.2 — D6). */
+    translation;
+    constructor(authorized, message, status, translation) {
+        this.authorized = authorized;
+        this.message = message;
+        this.status = status;
+        this.translation = translation;
+    }
+    /** Authorized response (no status). */
+    static allow() {
+        return new AuthorizationResponse(true);
+    }
+    /** Denied response; `status` defaults to 403 (D6). */
+    static deny(message, status = 403) {
+        return new AuthorizationResponse(false, message, status);
+    }
+}
+//# sourceMappingURL=AuthorizationResponse.js.map

package/dist/bouncer/AuthorizationResponse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthorizationResponse.js","sourceRoot":"","sources":["../../src/bouncer/AuthorizationResponse.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,OAAO,qBAAqB;IACxB,UAAU,CAAU;IACpB,OAAO,CAAU;IACjB,MAAM,CAAU;IACzB,8EAA8E;IACrE,WAAW,CAA0D;IAE9E,YACC,UAAmB,EACnB,OAAgB,EAChB,MAAe,EACf,WAAoE;QAEpE,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IAChC,CAAC;IAED,uCAAuC;IACvC,MAAM,CAAC,KAAK;QACX,OAAO,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IAED,sDAAsD;IACtD,MAAM,CAAC,IAAI,CAAC,OAAgB,EAAE,MAAM,GAAG,GAAG;QACzC,OAAO,IAAI,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1D,CAAC;CACD"}

package/dist/bouncer/BasePolicy.d.ts

@@ -0,0 +1,47 @@
+/**
+ * BasePolicy — extend it to group authorization checks for a resource. Action
+ * methods are positional `(user, resource?) => AuthorizerResponse` (D3); decorate
+ * a method with `@allowGuest()` / `@action({ allowGuest: true })` to let a guest
+ * (null user) reach it. The optional `before` / `after` hooks run around every
+ * action in the Adonis evaluation order (D5 — see PolicyAuthorizer).
+ */
+import type { UserPayload } from "../AuthManager.js";
+import type { EffectivePermissions, Scope } from "../rights/types.js";
+import type { AuthorizationResponse } from "./AuthorizationResponse.js";
+import type { HookResponse } from "./types.js";
+export declare abstract class BasePolicy {
+    /**
+     * Runs before the action. A non-`undefined` return short-circuits the action
+     * (a `boolean`/`AuthorizationResponse` becomes the result) — this is how a
+     * moderator bypass or an early `deny('not found', 404)` works, including for
+     * a guest. `undefined`/`void` falls through to the action.
+     */
+    before?(user: UserPayload | null, action: string, ...args: unknown[]): HookResponse;
+    /**
+     * Runs after the action (or after a `before` short-circuit), receiving the
+     * resolved response. A non-`undefined` return overrides it; `undefined`
+     * keeps it.
+     */
+    after?(user: UserPayload | null, action: string, result: AuthorizationResponse): HookResponse;
+    /**
+     * The Bouncer's active scope for the in-flight check (56.3). Defaults to
+     * `"global"` when the policy is used without a Bouncer context.
+     */
+    protected get scope(): Scope;
+    /**
+     * The resolved `EffectivePermissions` for the Bouncer's `(user, scope)` (56.3):
+     * role-derived ∪ ACL grants with global→tenant inheritance (per 56.1). A guest,
+     * a no-resolver Bouncer, or a standalone policy ⇒ empty permissions.
+     */
+    protected get permissions(): EffectivePermissions;
+    /**
+     * Tenant-isolation helper (D5 — enforceable, not automatic). `true` under the
+     * `global` scope (single-tenant — no boundary); under `{ tenant: T }` it is
+     * `resource.tenantId === T`. A policy enforces explicitly, e.g.
+     * `if (!this.sameTenant(post)) return false`.
+     */
+    protected sameTenant(resource: {
+        tenantId?: string | null;
+    }): boolean;
+}
+//# sourceMappingURL=BasePolicy.d.ts.map

package/dist/bouncer/BasePolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BasePolicy.d.ts","sourceRoot":"","sources":["../../src/bouncer/BasePolicy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAExE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,8BAAsB,UAAU;IAC/B;;;;;OAKG;IACH,MAAM,CAAC,CACN,IAAI,EAAE,WAAW,GAAG,IAAI,EACxB,MAAM,EAAE,MAAM,EACd,GAAG,IAAI,EAAE,OAAO,EAAE,GAChB,YAAY;IAEf;;;;OAIG;IACH,KAAK,CAAC,CACL,IAAI,EAAE,WAAW,GAAG,IAAI,EACxB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,qBAAqB,GAC3B,YAAY;IAEf;;;OAGG;IACH,SAAS,KAAK,KAAK,IAAI,KAAK,CAE3B;IAED;;;;OAIG;IACH,SAAS,KAAK,WAAW,IAAI,oBAAoB,CAEhD;IAED;;;;;OAKG;IACH,SAAS,CAAC,UAAU,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,OAAO;CAIrE"}

package/dist/bouncer/BasePolicy.js

@@ -0,0 +1,36 @@
+/**
+ * BasePolicy — extend it to group authorization checks for a resource. Action
+ * methods are positional `(user, resource?) => AuthorizerResponse` (D3); decorate
+ * a method with `@allowGuest()` / `@action({ allowGuest: true })` to let a guest
+ * (null user) reach it. The optional `before` / `after` hooks run around every
+ * action in the Adonis evaluation order (D5 — see PolicyAuthorizer).
+ */
+import { emptyPermissions, getPolicyContext } from "./policyContext.js";
+export class BasePolicy {
+    /**
+     * The Bouncer's active scope for the in-flight check (56.3). Defaults to
+     * `"global"` when the policy is used without a Bouncer context.
+     */
+    get scope() {
+        return getPolicyContext(this)?.scope ?? "global";
+    }
+    /**
+     * The resolved `EffectivePermissions` for the Bouncer's `(user, scope)` (56.3):
+     * role-derived ∪ ACL grants with global→tenant inheritance (per 56.1). A guest,
+     * a no-resolver Bouncer, or a standalone policy ⇒ empty permissions.
+     */
+    get permissions() {
+        return getPolicyContext(this)?.permissions ?? emptyPermissions("global");
+    }
+    /**
+     * Tenant-isolation helper (D5 — enforceable, not automatic). `true` under the
+     * `global` scope (single-tenant — no boundary); under `{ tenant: T }` it is
+     * `resource.tenantId === T`. A policy enforces explicitly, e.g.
+     * `if (!this.sameTenant(post)) return false`.
+     */
+    sameTenant(resource) {
+        const scope = this.scope;
+        return scope === "global" ? true : resource.tenantId === scope.tenant;
+    }
+}
+//# sourceMappingURL=BasePolicy.js.map

package/dist/bouncer/BasePolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BasePolicy.js","sourceRoot":"","sources":["../../src/bouncer/BasePolicy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAGxE,MAAM,OAAgB,UAAU;IAwB/B;;;OAGG;IACH,IAAc,KAAK;QAClB,OAAO,gBAAgB,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,QAAQ,CAAC;IAClD,CAAC;IAED;;;;OAIG;IACH,IAAc,WAAW;QACxB,OAAO,gBAAgB,CAAC,IAAI,CAAC,EAAE,WAAW,IAAI,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC1E,CAAC;IAED;;;;;OAKG;IACO,UAAU,CAAC,QAAsC;QAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,KAAK,KAAK,CAAC,MAAM,CAAC;IACvE,CAAC;CACD"}

package/dist/bouncer/Bouncer.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Bouncer — Layer 2 (EVALUATION) of Warden's unified authorization (Epic 56).
+ *
+ * A Bouncer-faithful evaluation core (verified context7 `/adonisjs/bouncer`,
+ * 2026-06-01): standalone abilities via `Bouncer.ability`, class-based policies
+ * via `with(Policy)`, the four verbs `allows`/`denies`/`authorize`/`execute`,
+ * and guest-denied-by-default. The user is `UserPayload | null` (guest = null,
+ * D3); `authorize` throws `WARDEN_AUTHORIZATION_FAILURE` carrying `status: 403`
+ * (D2). 56.2 ships PURE mechanics — it does NOT consult the Layer-1
+ * `RightsResolver` (D4); abilities/policy methods receive `(user, ...args)` and
+ * the developer writes the predicate, exactly as Adonis does.
+ */
+import type { UserPayload } from "../AuthManager.js";
+import type { Scope } from "../rights/types.js";
+import { AuthorizationResponse } from "./AuthorizationResponse.js";
+import type { BasePolicy } from "./BasePolicy.js";
+import { PolicyAuthorizer } from "./PolicyAuthorizer.js";
+import type { Ability, AbilityOptions, AuthorizerResponse, BouncerContext } from "./types.js";
+export declare class Bouncer {
+    #private;
+    constructor(user: UserPayload | null, abilities?: Record<string, Ability<never[]>>, policies?: Record<string, new () => BasePolicy>, context?: BouncerContext);
+    /** The active resolution scope (default `"global"`). */
+    get scope(): Scope;
+    /**
+     * Define a standalone ability. Guest (null user) denied by default; pass
+     * `{ allowGuest: true }` to let the callback run for a guest (D5 step 2).
+     */
+    static ability<Args extends unknown[]>(callback: (user: UserPayload, ...args: Args) => AuthorizerResponse): Ability<Args>;
+    static ability<Args extends unknown[]>(options: AbilityOptions, callback: (user: UserPayload | null, ...args: Args) => AuthorizerResponse): Ability<Args>;
+    /** Convenience — equivalent to `AuthorizationResponse.deny` (Adonis `bouncer.deny`). */
+    deny(message?: string, status?: number): AuthorizationResponse;
+    /** Open a policy for checks (D8 — fresh `new PolicyClass()` per check). */
+    with(policy: (new () => BasePolicy) | string): PolicyAuthorizer;
+    /** Run an ability check and resolve to the full response. */
+    execute<Args extends unknown[]>(ability: Ability<Args>, ...args: Args): Promise<AuthorizationResponse>;
+    execute(ability: string, ...args: unknown[]): Promise<AuthorizationResponse>;
+    /** True iff the ability is authorized. Never throws on denial. */
+    allows<Args extends unknown[]>(ability: Ability<Args>, ...args: Args): Promise<boolean>;
+    allows(ability: string, ...args: unknown[]): Promise<boolean>;
+    /** Boolean negation of {@link allows}. Never throws on denial. */
+    denies<Args extends unknown[]>(ability: Ability<Args>, ...args: Args): Promise<boolean>;
+    denies(ability: string, ...args: unknown[]): Promise<boolean>;
+    /** Resolves on allow; throws `WARDEN_AUTHORIZATION_FAILURE` on deny (D2). */
+    authorize<Args extends unknown[]>(ability: Ability<Args>, ...args: Args): Promise<void>;
+    authorize(ability: string, ...args: unknown[]): Promise<void>;
+}
+//# sourceMappingURL=Bouncer.d.ts.map

package/dist/bouncer/Bouncer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Bouncer.d.ts","sourceRoot":"","sources":["../../src/bouncer/Bouncer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGrD,OAAO,KAAK,EAAwB,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,OAAO,KAAK,EACX,OAAO,EACP,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,MAAM,YAAY,CAAC;AAEpB,qBAAa,OAAO;;gBAUlB,IAAI,EAAE,WAAW,GAAG,IAAI,EACxB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,EAC5C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,UAAU,CAAC,EAC/C,OAAO,CAAC,EAAE,cAAc;IASzB,wDAAwD;IACxD,IAAI,KAAK,IAAI,KAAK,CAEjB;IAkBD;;;OAGG;IACH,MAAM,CAAC,OAAO,CAAC,IAAI,SAAS,OAAO,EAAE,EACpC,QAAQ,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,IAAI,KAAK,kBAAkB,GAChE,OAAO,CAAC,IAAI,CAAC;IAChB,MAAM,CAAC,OAAO,CAAC,IAAI,SAAS,OAAO,EAAE,EACpC,OAAO,EAAE,cAAc,EACvB,QAAQ,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,EAAE,GAAG,IAAI,EAAE,IAAI,KAAK,kBAAkB,GACvE,OAAO,CAAC,IAAI,CAAC;IAmChB,wFAAwF;IACxF,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,qBAAqB;IAI9D,2EAA2E;IAC3E,IAAI,CAAC,MAAM,EAAE,CAAC,UAAU,UAAU,CAAC,GAAG,MAAM,GAAG,gBAAgB;IAY/D,6DAA6D;IAC7D,OAAO,CAAC,IAAI,SAAS,OAAO,EAAE,EAC7B,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,EACtB,GAAG,IAAI,EAAE,IAAI,GACX,OAAO,CAAC,qBAAqB,CAAC;IACjC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAQ5E,kEAAkE;IAClE,MAAM,CAAC,IAAI,SAAS,OAAO,EAAE,EAC5B,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,EACtB,GAAG,IAAI,EAAE,IAAI,GACX,OAAO,CAAC,OAAO,CAAC;IACnB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAQ7D,kEAAkE;IAClE,MAAM,CAAC,IAAI,SAAS,OAAO,EAAE,EAC5B,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,EACtB,GAAG,IAAI,EAAE,IAAI,GACX,OAAO,CAAC,OAAO,CAAC;IACnB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAQ7D,6EAA6E;IAC7E,SAAS,CAAC,IAAI,SAAS,OAAO,EAAE,EAC/B,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,EACtB,GAAG,IAAI,EAAE,IAAI,GACX,OAAO,CAAC,IAAI,CAAC;IAChB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAwD7D"}