@c9up/warden 0.1.3 → 0.1.5

package/dist/bouncer/Bouncer.js

@@ -0,0 +1,134 @@
+/**
+ * Bouncer — Layer 2 (EVALUATION) of Warden's unified authorization (Epic 56).
+ *
+ * A Bouncer-faithful evaluation core (verified context7 `/adonisjs/bouncer`,
+ * 2026-06-01): standalone abilities via `Bouncer.ability`, class-based policies
+ * via `with(Policy)`, the four verbs `allows`/`denies`/`authorize`/`execute`,
+ * and guest-denied-by-default. The user is `UserPayload | null` (guest = null,
+ * D3); `authorize` throws `WARDEN_AUTHORIZATION_FAILURE` carrying `status: 403`
+ * (D2). 56.2 ships PURE mechanics — it does NOT consult the Layer-1
+ * `RightsResolver` (D4); abilities/policy methods receive `(user, ...args)` and
+ * the developer writes the predicate, exactly as Adonis does.
+ */
+import { WardenError } from "../errors.js";
+import { AuthorizationResponse } from "./AuthorizationResponse.js";
+import { evaluate, isAction, throwAuthorizationFailure } from "./evaluate.js";
+import { PolicyAuthorizer } from "./PolicyAuthorizer.js";
+import { emptyPermissions } from "./policyContext.js";
+export class Bouncer {
+    #user;
+    #abilities;
+    #policies;
+    #scope;
+    #resolver;
+    /** Memoized resolution — a Bouncer is fixed per `(user, scope)`, so resolve once (D3). */
+    #resolved;
+    constructor(user, abilities, policies, context) {
+        this.#user = user;
+        this.#abilities = abilities ?? {};
+        this.#policies = policies ?? {};
+        this.#scope = context?.scope ?? "global";
+        this.#resolver = context?.resolver;
+    }
+    /** The active resolution scope (default `"global"`). */
+    get scope() {
+        return this.#scope;
+    }
+    /**
+     * Resolve this Bouncer's `(user, scope)` to `EffectivePermissions`, memoized
+     * once per instance (D3). Guest (`user === null`) or no resolver ⇒ empty
+     * permissions — `resolve()` is never called for a guest (D9). 56.6 relocates
+     * this cache to the request context without changing the policy-facing API.
+     */
+    #resolvePermissions() {
+        if (this.#resolved === undefined) {
+            this.#resolved =
+                this.#resolver !== undefined && this.#user !== null
+                    ? this.#resolver.resolve(this.#user, this.#scope)
+                    : Promise.resolve(emptyPermissions(this.#scope));
+        }
+        return this.#resolved;
+    }
+    static ability(optionsOrCallback, maybeCallback) {
+        let allowGuest = false;
+        let raw;
+        if (typeof optionsOrCallback === "function") {
+            raw = optionsOrCallback;
+        }
+        else {
+            allowGuest = optionsOrCallback.allowGuest ?? false;
+            raw = maybeCallback;
+        }
+        // The typed overloads above carry the real callback signature for the
+        // caller; the impl param is the universal-function supertype so both
+        // overloads are accepted. `isAction` reinterprets it as the invokable
+        // `Action` shape (a type guard, not a cast — a function's parameter types
+        // are not observable at runtime).
+        if (!isAction(raw)) {
+            throw new WardenError("INVALID_ABILITY", "Bouncer.ability requires a callback alongside the options object.", { hint: "Bouncer.ability({ allowGuest: true }, (user) => ...)" });
+        }
+        const callback = raw;
+        const execute = (user, ...args) => callback(user, ...args);
+        return { allowGuest, execute };
+    }
+    /** Convenience — equivalent to `AuthorizationResponse.deny` (Adonis `bouncer.deny`). */
+    deny(message, status) {
+        return AuthorizationResponse.deny(message, status);
+    }
+    /** Open a policy for checks (D8 — fresh `new PolicyClass()` per check). */
+    with(policy) {
+        const factory = typeof policy === "string"
+            ? this.#resolvePolicyClass(policy)
+            : () => new policy();
+        // The PolicyAuthorizer inherits the Bouncer's scope + the shared memoized
+        // resolve so every policy check sees the active `(user, scope)` (AC1/AC3).
+        return new PolicyAuthorizer(this.#user, factory, this.#scope, () => this.#resolvePermissions());
+    }
+    execute(ability, ...args) {
+        return this.#evaluateAbility(ability, args);
+    }
+    async allows(ability, ...args) {
+        return (await this.#evaluateAbility(ability, args)).authorized;
+    }
+    async denies(ability, ...args) {
+        return !(await this.#evaluateAbility(ability, args)).authorized;
+    }
+    async authorize(ability, ...args) {
+        const response = await this.#evaluateAbility(ability, args);
+        if (!response.authorized) {
+            throwAuthorizationFailure(response);
+        }
+    }
+    async #evaluateAbility(ability, args) {
+        const resolved = typeof ability === "string" ? this.#resolveAbility(ability) : ability;
+        return evaluate({
+            user: this.#user,
+            action: typeof ability === "string" ? ability : "(ability)",
+            allowGuest: resolved.allowGuest,
+            run: (user) => resolved.execute(user, ...args),
+            args,
+        });
+    }
+    #resolveAbility(name) {
+        const found = this.#abilities[name];
+        if (found === undefined) {
+            throw new WardenError("UNKNOWN_ABILITY", `No ability "${name}" is registered on this Bouncer.`, { hint: "Register it via new Bouncer(user, { [name]: ability })." });
+        }
+        return found;
+    }
+    #resolvePolicyClass(name) {
+        // Lazy: the lookup runs when a verb constructs the policy, so an unknown
+        // name surfaces as a promise rejection (like every other verb error),
+        // not a synchronous throw at `with()` time.
+        return () => {
+            const ctor = this.#policies[name];
+            if (ctor === undefined) {
+                throw new WardenError("UNKNOWN_POLICY", `No policy "${name}" is registered on this Bouncer.`, {
+                    hint: "Register it via new Bouncer(user, abilities, { [name]: Policy }).",
+                });
+            }
+            return new ctor();
+        };
+    }
+}
+//# sourceMappingURL=Bouncer.js.map

package/dist/bouncer/Bouncer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Bouncer.js","sourceRoot":"","sources":["../../src/bouncer/Bouncer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAG3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAQtD,MAAM,OAAO,OAAO;IACV,KAAK,CAAqB;IAC1B,UAAU,CAAmC;IAC7C,SAAS,CAAuC;IAChD,MAAM,CAAQ;IACd,SAAS,CAA6B;IAC/C,0FAA0F;IAC1F,SAAS,CAA4C;IAErD,YACC,IAAwB,EACxB,SAA4C,EAC5C,QAA+C,EAC/C,OAAwB;QAExB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,UAAU,GAAG,SAAS,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,QAAQ,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,KAAK,IAAI,QAAQ,CAAC;QACzC,IAAI,CAAC,SAAS,GAAG,OAAO,EAAE,QAAQ,CAAC;IACpC,CAAC;IAED,wDAAwD;IACxD,IAAI,KAAK;QACR,OAAO,IAAI,CAAC,MAAM,CAAC;IACpB,CAAC;IAED;;;;;OAKG;IACH,mBAAmB;QAClB,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC,SAAS;gBACb,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI;oBAClD,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC;oBACjD,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC;IACvB,CAAC;IAaD,MAAM,CAAC,OAAO,CACb,iBAE6C,EAC7C,aAAwD;QAExD,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,IAAI,GAAY,CAAC;QACjB,IAAI,OAAO,iBAAiB,KAAK,UAAU,EAAE,CAAC;YAC7C,GAAG,GAAG,iBAAiB,CAAC;QACzB,CAAC;aAAM,CAAC;YACP,UAAU,GAAG,iBAAiB,CAAC,UAAU,IAAI,KAAK,CAAC;YACnD,GAAG,GAAG,aAAa,CAAC;QACrB,CAAC;QACD,sEAAsE;QACtE,qEAAqE;QACrE,sEAAsE;QACtE,0EAA0E;QAC1E,kCAAkC;QAClC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,WAAW,CACpB,iBAAiB,EACjB,mEAAmE,EACnE,EAAE,IAAI,EAAE,sDAAsD,EAAE,CAChE,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC;QACrB,MAAM,OAAO,GAAG,CACf,IAAwB,EACxB,GAAG,IAAe,EACG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IAChC,CAAC;IAED,wFAAwF;IACxF,IAAI,CAAC,OAAgB,EAAE,MAAe;QACrC,OAAO,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IAED,2EAA2E;IAC3E,IAAI,CAAC,MAAuC;QAC3C,MAAM,OAAO,GACZ,OAAO,MAAM,KAAK,QAAQ;YACzB,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC;YAClC,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,0EAA0E;QAC1E,2EAA2E;QAC3E,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAClE,IAAI,CAAC,mBAAmB,EAAE,CAC1B,CAAC;IACH,CAAC;IAQD,OAAO,CACN,OAAkC,EAClC,GAAG,IAAe;QAElB,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;IAQD,KAAK,CAAC,MAAM,CACX,OAAkC,EAClC,GAAG,IAAe;QAElB,OAAO,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;IAChE,CAAC;IAQD,KAAK,CAAC,MAAM,CACX,OAAkC,EAClC,GAAG,IAAe;QAElB,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;IACjE,CAAC;IAQD,KAAK,CAAC,SAAS,CACd,OAAkC,EAClC,GAAG,IAAe;QAElB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC5D,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC1B,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;IACF,CAAC;IAED,KAAK,CAAC,gBAAgB,CACrB,OAAkC,EAClC,IAAe;QAEf,MAAM,QAAQ,GACb,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACvE,OAAO,QAAQ,CAAC;YACf,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,MAAM,EAAE,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW;YAC3D,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC;YAC9C,IAAI;SACJ,CAAC,CAAC;IACJ,CAAC;IAED,eAAe,CAAC,IAAY;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,WAAW,CACpB,iBAAiB,EACjB,eAAe,IAAI,kCAAkC,EACrD,EAAE,IAAI,EAAE,yDAAyD,EAAE,CACnE,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC;IAED,mBAAmB,CAAC,IAAY;QAC/B,yEAAyE;QACzE,sEAAsE;QACtE,4CAA4C;QAC5C,OAAO,GAAG,EAAE;YACX,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACxB,MAAM,IAAI,WAAW,CACpB,gBAAgB,EAChB,cAAc,IAAI,kCAAkC,EACpD;oBACC,IAAI,EAAE,mEAAmE;iBACzE,CACD,CAAC;YACH,CAAC;YACD,OAAO,IAAI,IAAI,EAAE,CAAC;QACnB,CAAC,CAAC;IACH,CAAC;CACD"}

package/dist/bouncer/PolicyAuthorizer.d.ts

@@ -0,0 +1,24 @@
+/**
+ * PolicyAuthorizer — the object returned by `bouncer.with(Policy)`. Exposes the
+ * same four verbs as the Bouncer, dispatched to a named action method on a
+ * freshly-constructed policy instance (D8 — `new PolicyClass()` per check). The
+ * `before`/`after` hooks and the per-method `@allowGuest` rule run through the
+ * shared D5 pipeline.
+ */
+import type { UserPayload } from "../AuthManager.js";
+import type { EffectivePermissions, Scope } from "../rights/types.js";
+import type { AuthorizationResponse } from "./AuthorizationResponse.js";
+import { BasePolicy } from "./BasePolicy.js";
+export declare class PolicyAuthorizer {
+    #private;
+    constructor(user: UserPayload | null, factory: () => BasePolicy, scope?: Scope, resolvePermissions?: () => Promise<EffectivePermissions>);
+    /** Run a check and resolve to the full response (D8 — fresh policy per check). */
+    execute(action: string, ...args: unknown[]): Promise<AuthorizationResponse>;
+    /** True iff the action is authorized. Never throws on denial. */
+    allows(action: string, ...args: unknown[]): Promise<boolean>;
+    /** Boolean negation of {@link allows}. Never throws on denial. */
+    denies(action: string, ...args: unknown[]): Promise<boolean>;
+    /** Resolves on allow; throws `WARDEN_AUTHORIZATION_FAILURE` on deny (D2). */
+    authorize(action: string, ...args: unknown[]): Promise<void>;
+}
+//# sourceMappingURL=PolicyAuthorizer.d.ts.map

package/dist/bouncer/PolicyAuthorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PolicyAuthorizer.d.ts","sourceRoot":"","sources":["../../src/bouncer/PolicyAuthorizer.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAqD7C,qBAAa,gBAAgB;;gBAO3B,IAAI,EAAE,WAAW,GAAG,IAAI,EACxB,OAAO,EAAE,MAAM,UAAU,EACzB,KAAK,GAAE,KAAgB,EACvB,kBAAkB,GAAE,MAAM,OAAO,CAAC,oBAAoB,CACb;IAQ1C,kFAAkF;IAC5E,OAAO,CACZ,MAAM,EAAE,MAAM,EACd,GAAG,IAAI,EAAE,OAAO,EAAE,GAChB,OAAO,CAAC,qBAAqB,CAAC;IAmBjC,iEAAiE;IAC3D,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAIlE,kEAAkE;IAC5D,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAIlE,6EAA6E;IACvE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAMlE"}

package/dist/bouncer/PolicyAuthorizer.js

@@ -0,0 +1,92 @@
+/**
+ * PolicyAuthorizer — the object returned by `bouncer.with(Policy)`. Exposes the
+ * same four verbs as the Bouncer, dispatched to a named action method on a
+ * freshly-constructed policy instance (D8 — `new PolicyClass()` per check). The
+ * `before`/`after` hooks and the per-method `@allowGuest` rule run through the
+ * shared D5 pipeline.
+ */
+import { WardenError } from "../errors.js";
+import { BasePolicy } from "./BasePolicy.js";
+import { getActionMetadata } from "./decorators.js";
+import { evaluate, isAction, throwAuthorizationFailure, } from "./evaluate.js";
+import { emptyPermissions, setPolicyContext } from "./policyContext.js";
+/**
+ * Resolve a named action method declared anywhere on the policy's own subclass
+ * chain (so an action inherited from an intermediate policy base class still
+ * dispatches). Rejects `constructor`, the `before`/`after` hooks, and any
+ * `BasePolicy`/`Object.prototype` member so a verb call can never dispatch to a
+ * non-action method — a guard the adversarial review specifically probes.
+ */
+function resolveActionMethod(policy, action) {
+    // Reject the hooks + constructor by name, then accept an action declared
+    // anywhere on the policy's own subclass chain — the immediate prototype up to
+    // (but not including) BasePolicy.prototype / Object.prototype — so a method
+    // inherited from an intermediate policy base class (`class A extends B`) still
+    // dispatches, while BasePolicy's own members (scope/permissions getters) and
+    // Object.prototype members stay unreachable.
+    const isHookOrCtor = action === "constructor" || action === "before" || action === "after";
+    let declaredHere = false;
+    for (let proto = Object.getPrototypeOf(policy); proto !== null &&
+        proto !== BasePolicy.prototype &&
+        proto !== Object.prototype; proto = Object.getPrototypeOf(proto)) {
+        if (Object.hasOwn(proto, action)) {
+            declaredHere = true;
+            break;
+        }
+    }
+    const candidate = Reflect.get(policy, action);
+    if (isHookOrCtor) {
+        declaredHere = false;
+    }
+    if (!declaredHere || !isAction(candidate)) {
+        throw new WardenError("UNKNOWN_POLICY_ACTION", `Policy "${policy.constructor.name}" has no action "${action}"`, { hint: "Declare the action as a method on the policy class." });
+    }
+    return candidate.bind(policy);
+}
+export class PolicyAuthorizer {
+    #user;
+    #factory;
+    #scope;
+    #resolvePermissions;
+    constructor(user, factory, scope = "global", resolvePermissions = () => Promise.resolve(emptyPermissions(scope))) {
+        this.#user = user;
+        this.#factory = factory;
+        this.#scope = scope;
+        this.#resolvePermissions = resolvePermissions;
+    }
+    /** Run a check and resolve to the full response (D8 — fresh policy per check). */
+    async execute(action, ...args) {
+        const policy = this.#factory();
+        // Attach the active scope + resolved permissions BEFORE dispatch so the
+        // before/method/after pipeline all read `this.scope` / `this.permissions`.
+        const permissions = await this.#resolvePermissions();
+        setPolicyContext(policy, { scope: this.#scope, permissions });
+        const method = resolveActionMethod(policy, action);
+        const options = getActionMetadata(policy, action);
+        return evaluate({
+            user: this.#user,
+            action,
+            allowGuest: options.allowGuest ?? false,
+            run: (user) => method(user, ...args),
+            args,
+            before: policy.before?.bind(policy),
+            after: policy.after?.bind(policy),
+        });
+    }
+    /** True iff the action is authorized. Never throws on denial. */
+    async allows(action, ...args) {
+        return (await this.execute(action, ...args)).authorized;
+    }
+    /** Boolean negation of {@link allows}. Never throws on denial. */
+    async denies(action, ...args) {
+        return !(await this.execute(action, ...args)).authorized;
+    }
+    /** Resolves on allow; throws `WARDEN_AUTHORIZATION_FAILURE` on deny (D2). */
+    async authorize(action, ...args) {
+        const response = await this.execute(action, ...args);
+        if (!response.authorized) {
+            throwAuthorizationFailure(response);
+        }
+    }
+}
+//# sourceMappingURL=PolicyAuthorizer.js.map

package/dist/bouncer/PolicyAuthorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PolicyAuthorizer.js","sourceRoot":"","sources":["../../src/bouncer/PolicyAuthorizer.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAG3C,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAEN,QAAQ,EACR,QAAQ,EACR,yBAAyB,GACzB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAExE;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,MAAkB,EAAE,MAAc;IAC9D,yEAAyE;IACzE,8EAA8E;IAC9E,4EAA4E;IAC5E,+EAA+E;IAC/E,6EAA6E;IAC7E,6CAA6C;IAC7C,MAAM,YAAY,GACjB,MAAM,KAAK,aAAa,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,OAAO,CAAC;IACvE,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,KACC,IAAI,KAAK,GAAkB,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,EACxD,KAAK,KAAK,IAAI;QACd,KAAK,KAAK,UAAU,CAAC,SAAS;QAC9B,KAAK,KAAK,MAAM,CAAC,SAAS,EAC1B,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,EACnC,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;YAClC,YAAY,GAAG,IAAI,CAAC;YACpB,MAAM;QACP,CAAC;IACF,CAAC;IACD,MAAM,SAAS,GAAY,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvD,IAAI,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,YAAY,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,WAAW,CACpB,uBAAuB,EACvB,WAAW,MAAM,CAAC,WAAW,CAAC,IAAI,oBAAoB,MAAM,GAAG,EAC/D,EAAE,IAAI,EAAE,qDAAqD,EAAE,CAC/D,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,OAAO,gBAAgB;IACnB,KAAK,CAAqB;IAC1B,QAAQ,CAAmB;IAC3B,MAAM,CAAQ;IACd,mBAAmB,CAAsC;IAElE,YACC,IAAwB,EACxB,OAAyB,EACzB,QAAe,QAAQ,EACvB,qBAA0D,GAAG,EAAE,CAC9D,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAEzC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,mBAAmB,GAAG,kBAAkB,CAAC;IAC/C,CAAC;IAED,kFAAkF;IAClF,KAAK,CAAC,OAAO,CACZ,MAAc,EACd,GAAG,IAAe;QAElB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC/B,wEAAwE;QACxE,2EAA2E;QAC3E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACrD,gBAAgB,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAClD,OAAO,QAAQ,CAAC;YACf,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,MAAM;YACN,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,KAAK;YACvC,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC;YACpC,IAAI;YACJ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;YACnC,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC;SACjC,CAAC,CAAC;IACJ,CAAC;IAED,iEAAiE;IACjE,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,GAAG,IAAe;QAC9C,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;IACzD,CAAC;IAED,kEAAkE;IAClE,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,GAAG,IAAe;QAC9C,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;IAC1D,CAAC;IAED,6EAA6E;IAC7E,KAAK,CAAC,SAAS,CAAC,MAAc,EAAE,GAAG,IAAe;QACjD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC1B,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;IACF,CAAC;CACD"}

package/dist/bouncer/decorators.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Bouncer policy decorators — `@allowGuest()` / `@action()` mark policy methods
+ * that a guest (null user) may reach. Mirrors the `Guard.ts` idiom (D9):
+ * `reflect-metadata` side-effect import, a `Symbol.for` key, the legacy
+ * `MethodDecorator` signature, and a `getActionMetadata` reader.
+ */
+import "reflect-metadata";
+import type { AbilityOptions } from "./types.js";
+/**
+ * `@action({ allowGuest })` — configure a policy method's evaluation options.
+ */
+export declare function action(options: AbilityOptions): MethodDecorator;
+/**
+ * `@allowGuest()` — let a guest (null user) reach this policy method.
+ * Equivalent to `@action({ allowGuest: true })`.
+ */
+export declare function allowGuest(): MethodDecorator;
+/**
+ * Read a policy method's action metadata. Walks the prototype chain
+ * (`Reflect.getMetadata`) so it resolves from a policy INSTANCE — legacy
+ * decorators write metadata onto the class prototype, where the instance
+ * inherits it. Absent ⇒ `{}` (⇒ `allowGuest` falsy ⇒ guest denied).
+ */
+export declare function getActionMetadata(target: object, propertyKey: string | symbol): AbilityOptions;
+//# sourceMappingURL=decorators.d.ts.map

package/dist/bouncer/decorators.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decorators.d.ts","sourceRoot":"","sources":["../../src/bouncer/decorators.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAKjD;;GAEG;AACH,wBAAgB,MAAM,CAAC,OAAO,EAAE,cAAc,GAAG,eAAe,CAI/D;AAED;;;GAGG;AACH,wBAAgB,UAAU,IAAI,eAAe,CAE5C;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAChC,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAAG,MAAM,GAC1B,cAAc,CAEhB"}

package/dist/bouncer/decorators.js

@@ -0,0 +1,36 @@
+/**
+ * Bouncer policy decorators — `@allowGuest()` / `@action()` mark policy methods
+ * that a guest (null user) may reach. Mirrors the `Guard.ts` idiom (D9):
+ * `reflect-metadata` side-effect import, a `Symbol.for` key, the legacy
+ * `MethodDecorator` signature, and a `getActionMetadata` reader.
+ */
+// Side-effect import: registers `Reflect.defineMetadata` / `getMetadata`. Pulled
+// in here (not transitively) so warden stays self-sufficient when published.
+import "reflect-metadata";
+/** Action metadata key — Symbol.for ensures cross-module accessibility. */
+const ACTION_KEY = Symbol.for("warden:bouncer:action");
+/**
+ * `@action({ allowGuest })` — configure a policy method's evaluation options.
+ */
+export function action(options) {
+    return (target, propertyKey) => {
+        Reflect.defineMetadata(ACTION_KEY, options, target, propertyKey);
+    };
+}
+/**
+ * `@allowGuest()` — let a guest (null user) reach this policy method.
+ * Equivalent to `@action({ allowGuest: true })`.
+ */
+export function allowGuest() {
+    return action({ allowGuest: true });
+}
+/**
+ * Read a policy method's action metadata. Walks the prototype chain
+ * (`Reflect.getMetadata`) so it resolves from a policy INSTANCE — legacy
+ * decorators write metadata onto the class prototype, where the instance
+ * inherits it. Absent ⇒ `{}` (⇒ `allowGuest` falsy ⇒ guest denied).
+ */
+export function getActionMetadata(target, propertyKey) {
+    return Reflect.getMetadata(ACTION_KEY, target, propertyKey) ?? {};
+}
+//# sourceMappingURL=decorators.js.map

package/dist/bouncer/decorators.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decorators.js","sourceRoot":"","sources":["../../src/bouncer/decorators.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,iFAAiF;AACjF,6EAA6E;AAC7E,OAAO,kBAAkB,CAAC;AAG1B,2EAA2E;AAC3E,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;AAEvD;;GAEG;AACH,MAAM,UAAU,MAAM,CAAC,OAAuB;IAC7C,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE;QAC9B,OAAO,CAAC,cAAc,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IAClE,CAAC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU;IACzB,OAAO,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAChC,MAAc,EACd,WAA4B;IAE5B,OAAO,OAAO,CAAC,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC;AACnE,CAAC"}

package/dist/bouncer/evaluate.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Shared evaluation pipeline — the single place that encodes the Adonis Bouncer
+ * evaluation order (D5), used by BOTH standalone abilities (no hooks) and policy
+ * methods (with `before`/`after`). Pinned by `bouncer-parity.test.ts` (AC-E2).
+ *
+ * Order: (1) `before` — a non-`undefined` return short-circuits the action;
+ * (2) guest-deny — `user === null` && !allowGuest ⇒ auto-deny WITHOUT running the
+ * action; (3) run the action; (4) `after` — a non-`undefined` return overrides.
+ */
+import type { UserPayload } from "../AuthManager.js";
+import { AuthorizationResponse } from "./AuthorizationResponse.js";
+import type { AuthorizerResponse, HookResponse } from "./types.js";
+/** A policy action method / ability callback, structurally. */
+export type Action = (user: UserPayload | null, ...args: unknown[]) => AuthorizerResponse;
+/** Boolean sugar → response; an explicit response passes through (D7). */
+export declare function normalizeResponse(value: boolean | AuthorizationResponse): AuthorizationResponse;
+/**
+ * Type guard for a callable action. A function's parameter/return types are not
+ * observable at runtime, so this asserts the structural `Action` shape from a
+ * `typeof === "function"` check — a type guard (not an `as` cast), the standard
+ * escape for dynamic dispatch.
+ */
+export declare function isAction(value: unknown): value is Action;
+/** Throw the canonical authorization failure for a denied response (D2). */
+export declare function throwAuthorizationFailure(response: AuthorizationResponse): never;
+/** Run the D5 evaluation pipeline and resolve to the final response. */
+export declare function evaluate(params: {
+    user: UserPayload | null;
+    action: string;
+    allowGuest: boolean;
+    run: (user: UserPayload | null) => AuthorizerResponse;
+    args: unknown[];
+    before?: (user: UserPayload | null, action: string, ...args: unknown[]) => HookResponse;
+    after?: (user: UserPayload | null, action: string, result: AuthorizationResponse) => HookResponse;
+}): Promise<AuthorizationResponse>;
+//# sourceMappingURL=evaluate.d.ts.map

package/dist/bouncer/evaluate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../../src/bouncer/evaluate.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAEnE,+DAA+D;AAC/D,MAAM,MAAM,MAAM,GAAG,CACpB,IAAI,EAAE,WAAW,GAAG,IAAI,EACxB,GAAG,IAAI,EAAE,OAAO,EAAE,KACd,kBAAkB,CAAC;AAExB,0EAA0E;AAC1E,wBAAgB,iBAAiB,CAChC,KAAK,EAAE,OAAO,GAAG,qBAAqB,GACpC,qBAAqB,CAKvB;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAExD;AAED,4EAA4E;AAC5E,wBAAgB,yBAAyB,CACxC,QAAQ,EAAE,qBAAqB,GAC7B,KAAK,CASP;AAED,wEAAwE;AACxE,wBAAsB,QAAQ,CAAC,MAAM,EAAE;IACtC,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,OAAO,CAAC;IACpB,GAAG,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,KAAK,kBAAkB,CAAC;IACtD,IAAI,EAAE,OAAO,EAAE,CAAC;IAChB,MAAM,CAAC,EAAE,CACR,IAAI,EAAE,WAAW,GAAG,IAAI,EACxB,MAAM,EAAE,MAAM,EACd,GAAG,IAAI,EAAE,OAAO,EAAE,KACd,YAAY,CAAC;IAClB,KAAK,CAAC,EAAE,CACP,IAAI,EAAE,WAAW,GAAG,IAAI,EACxB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,qBAAqB,KACzB,YAAY,CAAC;CAClB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA+BjC"}

package/dist/bouncer/evaluate.js

@@ -0,0 +1,64 @@
+/**
+ * Shared evaluation pipeline — the single place that encodes the Adonis Bouncer
+ * evaluation order (D5), used by BOTH standalone abilities (no hooks) and policy
+ * methods (with `before`/`after`). Pinned by `bouncer-parity.test.ts` (AC-E2).
+ *
+ * Order: (1) `before` — a non-`undefined` return short-circuits the action;
+ * (2) guest-deny — `user === null` && !allowGuest ⇒ auto-deny WITHOUT running the
+ * action; (3) run the action; (4) `after` — a non-`undefined` return overrides.
+ */
+import { WardenError } from "../errors.js";
+import { AuthorizationResponse } from "./AuthorizationResponse.js";
+/** Boolean sugar → response; an explicit response passes through (D7). */
+export function normalizeResponse(value) {
+    if (value instanceof AuthorizationResponse) {
+        return value;
+    }
+    return value ? AuthorizationResponse.allow() : AuthorizationResponse.deny();
+}
+/**
+ * Type guard for a callable action. A function's parameter/return types are not
+ * observable at runtime, so this asserts the structural `Action` shape from a
+ * `typeof === "function"` check — a type guard (not an `as` cast), the standard
+ * escape for dynamic dispatch.
+ */
+export function isAction(value) {
+    return typeof value === "function";
+}
+/** Throw the canonical authorization failure for a denied response (D2). */
+export function throwAuthorizationFailure(response) {
+    throw new WardenError("AUTHORIZATION_FAILURE", response.message ?? "Authorization failed", {
+        hint: "The current user is not authorized for this action.",
+        status: response.status ?? 403,
+    });
+}
+/** Run the D5 evaluation pipeline and resolve to the final response. */
+export async function evaluate(params) {
+    const { user, action, allowGuest, run, args, before, after } = params;
+    let response;
+    // (1) before — non-undefined short-circuits the action.
+    if (before) {
+        const early = await before(user, action, ...args);
+        if (early !== undefined) {
+            response = normalizeResponse(early);
+        }
+    }
+    // (2) guest-deny + (3) action — only if before did not short-circuit.
+    if (response === undefined) {
+        if (user === null && !allowGuest) {
+            response = AuthorizationResponse.deny();
+        }
+        else {
+            response = normalizeResponse(await run(user));
+        }
+    }
+    // (4) after — non-undefined overrides.
+    if (after) {
+        const override = await after(user, action, response);
+        if (override !== undefined) {
+            response = normalizeResponse(override);
+        }
+    }
+    return response;
+}
+//# sourceMappingURL=evaluate.js.map

package/dist/bouncer/evaluate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate.js","sourceRoot":"","sources":["../../src/bouncer/evaluate.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AASnE,0EAA0E;AAC1E,MAAM,UAAU,iBAAiB,CAChC,KAAsC;IAEtC,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,CAAC,qBAAqB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAc;IACtC,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC;AACpC,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,yBAAyB,CACxC,QAA+B;IAE/B,MAAM,IAAI,WAAW,CACpB,uBAAuB,EACvB,QAAQ,CAAC,OAAO,IAAI,sBAAsB,EAC1C;QACC,IAAI,EAAE,qDAAqD;QAC3D,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,GAAG;KAC9B,CACD,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,MAgB9B;IACA,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IAEtE,IAAI,QAA2C,CAAC;IAEhD,wDAAwD;IACxD,IAAI,MAAM,EAAE,CAAC;QACZ,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;QAClD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;IACF,CAAC;IAED,sEAAsE;IACtE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAClC,QAAQ,GAAG,qBAAqB,CAAC,IAAI,EAAE,CAAC;QACzC,CAAC;aAAM,CAAC;YACP,QAAQ,GAAG,iBAAiB,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/C,CAAC;IACF,CAAC;IAED,uCAAuC;IACvC,IAAI,KAAK,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACrD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5B,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACxC,CAAC;IACF,CAAC;IAED,OAAO,QAAQ,CAAC;AACjB,CAAC"}

package/dist/bouncer/policyContext.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Internal policy context attach — Layer-2 ⨯ Layer-1 wiring (Epic 56, story 56.3).
+ *
+ * The active `scope` and the resolved `EffectivePermissions` for the in-flight
+ * `(user, scope)` are attached to a freshly-constructed policy via a package-
+ * internal `WeakMap` (D2) — NOT a public setter on `BasePolicy` and NOT barrelled.
+ * `BasePolicy`'s `this.scope` / `this.permissions` getters read it back; the
+ * `PolicyAuthorizer` writes it before dispatch. A policy used without a Bouncer
+ * has no entry, so the getters fall back to `global` + {@link emptyPermissions}.
+ */
+import type { EffectivePermissions, Scope } from "../rights/types.js";
+import type { BasePolicy } from "./BasePolicy.js";
+/** What the authorizer attaches to a policy instance for one check. */
+export interface PolicyContext {
+    readonly scope: Scope;
+    readonly permissions: EffectivePermissions;
+}
+/** Attach the active scope + resolved permissions to a policy instance (internal). */
+export declare function setPolicyContext(policy: BasePolicy, context: PolicyContext): void;
+/** Read back a policy's attached context, or `undefined` when used standalone. */
+export declare function getPolicyContext(policy: BasePolicy): PolicyContext | undefined;
+/**
+ * The empty `EffectivePermissions` for a guest / no-resolver Bouncer (D9). Built
+ * locally — never a `resolve()` call (the resolver requires a non-null user) and
+ * never importing 56.1's non-exported `ResolvedPermissions`. `has` → false;
+ * `hasAll([])` → true (vacuous); `hasAny` → false; empty sets; `scope` = active.
+ */
+export declare function emptyPermissions(scope: Scope): EffectivePermissions;
+//# sourceMappingURL=policyContext.d.ts.map

package/dist/bouncer/policyContext.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policyContext.d.ts","sourceRoot":"","sources":["../../src/bouncer/policyContext.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,uEAAuE;AACvE,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,oBAAoB,CAAC;CAC3C;AAID,sFAAsF;AACtF,wBAAgB,gBAAgB,CAC/B,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,aAAa,GACpB,IAAI,CAEN;AAED,kFAAkF;AAClF,wBAAgB,gBAAgB,CAC/B,MAAM,EAAE,UAAU,GAChB,aAAa,GAAG,SAAS,CAE3B;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,KAAK,GAAG,oBAAoB,CASnE"}

package/dist/bouncer/policyContext.js

@@ -0,0 +1,36 @@
+/**
+ * Internal policy context attach — Layer-2 ⨯ Layer-1 wiring (Epic 56, story 56.3).
+ *
+ * The active `scope` and the resolved `EffectivePermissions` for the in-flight
+ * `(user, scope)` are attached to a freshly-constructed policy via a package-
+ * internal `WeakMap` (D2) — NOT a public setter on `BasePolicy` and NOT barrelled.
+ * `BasePolicy`'s `this.scope` / `this.permissions` getters read it back; the
+ * `PolicyAuthorizer` writes it before dispatch. A policy used without a Bouncer
+ * has no entry, so the getters fall back to `global` + {@link emptyPermissions}.
+ */
+const contexts = new WeakMap();
+/** Attach the active scope + resolved permissions to a policy instance (internal). */
+export function setPolicyContext(policy, context) {
+    contexts.set(policy, context);
+}
+/** Read back a policy's attached context, or `undefined` when used standalone. */
+export function getPolicyContext(policy) {
+    return contexts.get(policy);
+}
+/**
+ * The empty `EffectivePermissions` for a guest / no-resolver Bouncer (D9). Built
+ * locally — never a `resolve()` call (the resolver requires a non-null user) and
+ * never importing 56.1's non-exported `ResolvedPermissions`. `has` → false;
+ * `hasAll([])` → true (vacuous); `hasAny` → false; empty sets; `scope` = active.
+ */
+export function emptyPermissions(scope) {
+    return {
+        has: () => false,
+        hasAll: (permissions) => permissions.length === 0,
+        hasAny: () => false,
+        permissions: new Set(),
+        roles: new Set(),
+        scope,
+    };
+}
+//# sourceMappingURL=policyContext.js.map

package/dist/bouncer/policyContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policyContext.js","sourceRoot":"","sources":["../../src/bouncer/policyContext.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAWH,MAAM,QAAQ,GAAG,IAAI,OAAO,EAA6B,CAAC;AAE1D,sFAAsF;AACtF,MAAM,UAAU,gBAAgB,CAC/B,MAAkB,EAClB,OAAsB;IAEtB,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,gBAAgB,CAC/B,MAAkB;IAElB,OAAO,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAY;IAC5C,OAAO;QACN,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK;QAChB,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QACjD,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK;QACnB,WAAW,EAAE,IAAI,GAAG,EAAU;QAC9B,KAAK,EAAE,IAAI,GAAG,EAAU;QACxB,KAAK;KACL,CAAC;AACH,CAAC"}

package/dist/bouncer/types.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Bouncer evaluation contract — Layer 2 of Warden's unified authorization.
+ *
+ * The shapes here are faithful to AdonisJS Bouncer (verified context7
+ * `/adonisjs/bouncer`, 2026-06-01): a predicate returns a boolean (sugar for
+ * allow / deny) or an explicit `AuthorizationResponse`, sync or async.
+ */
+import type { UserPayload } from "../AuthManager.js";
+import type { RightsResolver } from "../rights/RightsResolver.js";
+import type { Scope } from "../rights/types.js";
+import type { AuthorizationResponse } from "./AuthorizationResponse.js";
+/**
+ * Optional 4th `Bouncer` ctor argument (56.3, D1) — the scope dimension + the
+ * Layer-1 resolver. Both optional; omitting it ⇒ the implicit `global` scope
+ * with no resolver (single-tenant zero-config, D7). Additive: every 56.2 call
+ * site keeps compiling.
+ */
+export interface BouncerContext {
+    /** Active resolution scope. Defaults to `"global"`. */
+    readonly scope?: Scope;
+    /** Layer-1 resolver consulted for this Bouncer's `(user, scope)`. */
+    readonly resolver?: RightsResolver;
+}
+/** A predicate's return — bool sugar or an explicit response, sync or async (D7). */
+export type AuthorizerResponse = boolean | AuthorizationResponse | Promise<boolean | AuthorizationResponse>;
+/** A `before`/`after` hook return — like {@link AuthorizerResponse} plus `undefined` (fall-through). */
+export type HookResponse = boolean | AuthorizationResponse | undefined | Promise<boolean | AuthorizationResponse | undefined>;
+/** Options accepted by `Bouncer.ability` and the `@action` decorator. */
+export interface AbilityOptions {
+    allowGuest?: boolean;
+}
+/**
+ * An opaque ability reference produced by `Bouncer.ability`. Usable by-reference
+ * (typed call args via the `Args` phantom) AND by-name (registered in the
+ * Bouncer ctor's abilities record).
+ *
+ * `Args` is carried by the contravariant `__args` phantom — never read at
+ * runtime — so a concrete `Ability<[Post]>` is assignable to the universal
+ * `Ability<never[]>` storage type while `execute` stays invokable with the real
+ * args. This is a branding pattern (carry the type parameter in the signature),
+ * not a cast: `execute` itself takes `unknown[]` and the call sites validate
+ * args via the phantom at the verb boundary.
+ */
+export interface Ability<Args extends unknown[] = unknown[]> {
+    /** Whether a guest (null user) may invoke the callback (D5 step 2). */
+    readonly allowGuest: boolean;
+    /** Runs the ability callback. Guest-deny is applied by the evaluator, not here. */
+    readonly execute: (user: UserPayload | null, ...args: unknown[]) => AuthorizerResponse;
+    /** Phantom — ties the by-reference call args to `Args`; never read at runtime. */
+    readonly __args?: (...args: Args) => void;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/bouncer/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/bouncer/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAExE;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC9B,uDAAuD;IACvD,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;CACnC;AAED,qFAAqF;AACrF,MAAM,MAAM,kBAAkB,GAC3B,OAAO,GACP,qBAAqB,GACrB,OAAO,CAAC,OAAO,GAAG,qBAAqB,CAAC,CAAC;AAE5C,wGAAwG;AACxG,MAAM,MAAM,YAAY,GACrB,OAAO,GACP,qBAAqB,GACrB,SAAS,GACT,OAAO,CAAC,OAAO,GAAG,qBAAqB,GAAG,SAAS,CAAC,CAAC;AAExD,yEAAyE;AACzE,MAAM,WAAW,cAAc;IAC9B,UAAU,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,OAAO,CAAC,IAAI,SAAS,OAAO,EAAE,GAAG,OAAO,EAAE;IAC1D,uEAAuE;IACvE,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,mFAAmF;IACnF,QAAQ,CAAC,OAAO,EAAE,CACjB,IAAI,EAAE,WAAW,GAAG,IAAI,EACxB,GAAG,IAAI,EAAE,OAAO,EAAE,KACd,kBAAkB,CAAC;IACxB,kFAAkF;IAClF,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;CAC1C"}

package/dist/bouncer/types.js

@@ -0,0 +1,9 @@
+/**
+ * Bouncer evaluation contract — Layer 2 of Warden's unified authorization.
+ *
+ * The shapes here are faithful to AdonisJS Bouncer (verified context7
+ * `/adonisjs/bouncer`, 2026-06-01): a predicate returns a boolean (sugar for
+ * allow / deny) or an explicit `AuthorizationResponse`, sync or async.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/bouncer/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/bouncer/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}