@c9up/warden 0.1.3 → 0.1.5

package/dist/config.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Warden configuration — declared in `config/auth.ts` of the user app.
+ *
+ * @example
+ *   // config/auth.ts
+ *   import { defineConfig } from '@c9up/warden/config'
+ *   export default defineConfig({
+ *     defaultStrategy: 'jwt',
+ *     jwt: {
+ *       secret: env('APP_KEY'),
+ *       expiresInSeconds: 3600,
+ *       findUser: (id) => User.find(id),
+ *       verifyCredentials: (email, password) => User.verifyCredentials(email, password),
+ *     },
+ *   })
+ */
+import type { UserPayload } from "./AuthManager.js";
+import type { MfaManager } from "./mfa/MfaManager.js";
+import type { RightsStore } from "./rights/types.js";
+export interface JwtConfig {
+    secret: string;
+    expiresInSeconds?: number;
+    findUser: (id: string) => Promise<UserPayload | null>;
+    verifyCredentials: (email: string, password: string) => Promise<UserPayload | null>;
+}
+export interface WardenConfig {
+    /** Default auth strategy (default: 'jwt'). */
+    defaultStrategy?: string;
+    /** JWT strategy configuration. */
+    jwt?: JwtConfig;
+    /**
+     * Rights layer configuration (Epic 56). Supply a custom `store` to back the
+     * unified resolver with a DB-backed driver; when omitted, an in-memory
+     * `MemoryRightsStore` is registered as the default (AD5 — pluggable store,
+     * in-memory shipped).
+     */
+    rights?: {
+        store?: RightsStore;
+    };
+    /**
+     * Multi-factor authentication. Supply a configured `MfaManager` (built with
+     * your persistent stores + providers) to register it in the container as
+     * `MfaManager` / `"mfa"`. Required to use `@RequireMfa` step-up flows.
+     */
+    mfa?: {
+        manager: MfaManager;
+    };
+}
+/** Typed config helper — identity function for editor inference. */
+export declare function defineConfig(config: WardenConfig): WardenConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,MAAM,WAAW,SAAS;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACtD,iBAAiB,EAAE,CAClB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,KACZ,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,YAAY;IAC5B,8CAA8C;IAC9C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kCAAkC;IAClC,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB;;;;;OAKG;IACH,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,WAAW,CAAA;KAAE,CAAC;IACjC;;;;OAIG;IACH,GAAG,CAAC,EAAE;QAAE,OAAO,EAAE,UAAU,CAAA;KAAE,CAAC;CAC9B;AAED,oEAAoE;AACpE,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,YAAY,CAE/D"}

package/dist/config.js

@@ -0,0 +1,21 @@
+/**
+ * Warden configuration — declared in `config/auth.ts` of the user app.
+ *
+ * @example
+ *   // config/auth.ts
+ *   import { defineConfig } from '@c9up/warden/config'
+ *   export default defineConfig({
+ *     defaultStrategy: 'jwt',
+ *     jwt: {
+ *       secret: env('APP_KEY'),
+ *       expiresInSeconds: 3600,
+ *       findUser: (id) => User.find(id),
+ *       verifyCredentials: (email, password) => User.verifyCredentials(email, password),
+ *     },
+ *   })
+ */
+/** Typed config helper — identity function for editor inference. */
+export function defineConfig(config) {
+    return config;
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAoCH,oEAAoE;AACpE,MAAM,UAAU,YAAY,CAAC,MAAoB;IAChD,OAAO,MAAM,CAAC;AACf,CAAC"}

package/dist/configure.d.ts

@@ -0,0 +1,10 @@
+interface Codemods {
+    addProvider(importPath: string): Promise<void>;
+    addEnvVars(vars: Record<string, string>): Promise<void>;
+    writeFile(filePath: string, content: string, options?: {
+        force?: boolean;
+    }): Promise<void>;
+}
+export declare function configure(codemods: Codemods): Promise<void>;
+export {};
+//# sourceMappingURL=configure.d.ts.map

package/dist/configure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"configure.d.ts","sourceRoot":"","sources":["../src/configure.ts"],"names":[],"mappings":"AAEA,UAAU,QAAQ;IACjB,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,SAAS,CACR,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAC3B,OAAO,CAAC,IAAI,CAAC,CAAC;CACjB;AAED,wBAAsB,SAAS,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CA8CjE"}

package/dist/configure.js

@@ -0,0 +1,44 @@
+import { randomBytes } from "node:crypto";
+export async function configure(codemods) {
+    const jwtSecret = randomBytes(32).toString("hex");
+    await codemods.addProvider("@c9up/warden/provider");
+    await codemods.addEnvVars({
+        JWT_SECRET: jwtSecret,
+        JWT_EXPIRY: "3600",
+    });
+    await codemods.writeFile("config/auth.ts", `import { defineConfig } from '@c9up/warden'
+
+export default defineConfig({
+  defaultStrategy: 'jwt',
+  jwt: {
+    secret: process.env.JWT_SECRET ?? '',
+    expiresInSeconds: Number(process.env.JWT_EXPIRY ?? '3600'),
+    // TODO: wire these to your user model (e.g. via your ORM).
+    // The JWT strategy needs both to issue and verify tokens.
+    findUser: async (_id) => {
+      throw new Error('TODO: implement findUser(id) for the JWT strategy in config/auth.ts')
+    },
+    verifyCredentials: async (_email, _password) => {
+      throw new Error('TODO: implement verifyCredentials(email, password) in config/auth.ts')
+    },
+  },
+})
+`);
+    // Announce the TODOs on stderr so `ream add @c9up/warden` doesn't end
+    // with a quiet success that the user reads as "auth is wired". The
+    // generated config/auth.ts ships with `throw new Error('TODO ...')`
+    // stubs for findUser + verifyCredentials — login and JWT verify will
+    // fail at the first call until the user fills them in. Surfacing the
+    // list here means an operator running the installer sees it
+    // immediately, not at the first request that hits the auth path.
+    process.stderr.write([
+        "",
+        "[@c9up/warden] config/auth.ts written with TODO stubs:",
+        "  - jwt.findUser(id) — wire to your user lookup (ORM)",
+        "  - jwt.verifyCredentials(email, password) — wire to your sign-in flow",
+        "Both throw at runtime until you implement them — login + JWT verify",
+        "will fail with `TODO: implement …` errors otherwise.",
+        "",
+    ].join("\n"));
+}
+//# sourceMappingURL=configure.js.map

package/dist/configure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configure.js","sourceRoot":"","sources":["../src/configure.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAY1C,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,QAAkB;IACjD,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,QAAQ,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC;IACpD,MAAM,QAAQ,CAAC,UAAU,CAAC;QACzB,UAAU,EAAE,SAAS;QACrB,UAAU,EAAE,MAAM;KAClB,CAAC,CAAC;IACH,MAAM,QAAQ,CAAC,SAAS,CACvB,gBAAgB,EAChB;;;;;;;;;;;;;;;;;CAiBD,CACC,CAAC;IACF,sEAAsE;IACtE,mEAAmE;IACnE,oEAAoE;IACpE,qEAAqE;IACrE,qEAAqE;IACrE,4DAA4D;IAC5D,iEAAiE;IACjE,OAAO,CAAC,MAAM,CAAC,KAAK,CACnB;QACC,EAAE;QACF,wDAAwD;QACxD,uDAAuD;QACvD,wEAAwE;QACxE,qEAAqE;QACrE,sDAAsD;QACtD,EAAE;KACF,CAAC,IAAI,CAAC,IAAI,CAAC,CACZ,CAAC;AACH,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,18 @@
+/**
+ * WardenError — structured error for Warden auth.
+ */
+export declare class WardenError extends Error {
+    readonly code: string;
+    readonly hint?: string;
+    /**
+     * Optional HTTP status carried by the error so the HTTP layer can map it
+     * (e.g. an authorization failure carries 403 — Epic 56 / story 56.2, D2).
+     * Additive and optional: callers that omit it behave exactly as before.
+     */
+    readonly status?: number;
+    constructor(code: string, message: string, options?: {
+        hint?: string;
+        status?: number;
+    });
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,qBAAa,WAAY,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAGxB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;CAQ7C"}

package/dist/errors.js

@@ -0,0 +1,21 @@
+/**
+ * WardenError — structured error for Warden auth.
+ */
+export class WardenError extends Error {
+    code;
+    hint;
+    /**
+     * Optional HTTP status carried by the error so the HTTP layer can map it
+     * (e.g. an authorization failure carries 403 — Epic 56 / story 56.2, D2).
+     * Additive and optional: callers that omit it behave exactly as before.
+     */
+    status;
+    constructor(code, message, options) {
+        super(message);
+        this.name = "WardenError";
+        this.code = `WARDEN_${code}`;
+        this.hint = options?.hint;
+        this.status = options?.status;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IAC5B,IAAI,CAAS;IACb,IAAI,CAAU;IACvB;;;;OAIG;IACM,MAAM,CAAU;IAEzB,YACC,IAAY,EACZ,OAAe,EACf,OAA4C;QAE5C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,UAAU,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,OAAO,EAAE,IAAI,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,MAAM,CAAC;IAC/B,CAAC;CACD"}

package/dist/firstcontact/FirstContactManager.d.ts

@@ -0,0 +1,25 @@
+/**
+ * FirstContactManager — OAuth2 social authentication.
+ *
+ * Usage:
+ *   firstContact.use('google').redirectUrl()
+ *   firstContact.use('google').callback(code)
+ */
+import type { FirstContactDriver, OAuthToken, OAuthUser } from "./types.js";
+export declare class FirstContactManager {
+    #private;
+    use(name: string): FirstContactDriver;
+    register(name: string, driver: FirstContactDriver): void;
+    redirect(name: string, state?: string): string;
+    /**
+     * Handle the OAuth callback. Pass `state` (from the query string) and
+     * `expectedState` (from the session, stored at redirect time) for CSRF
+     * protection. Omitting `expectedState` logs a security warning.
+     */
+    callback(name: string, code: string, state?: string, expectedState?: string): Promise<{
+        user: OAuthUser;
+        token: OAuthToken;
+    }>;
+    get registeredDrivers(): string[];
+}
+//# sourceMappingURL=FirstContactManager.d.ts.map

package/dist/firstcontact/FirstContactManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"FirstContactManager.d.ts","sourceRoot":"","sources":["../../src/firstcontact/FirstContactManager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5E,qBAAa,mBAAmB;;IAG/B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB;IASrC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,GAAG,IAAI;IAIxD,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM;IAI9C;;;;OAIG;IACG,QAAQ,CACb,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC;QAAE,IAAI,EAAE,SAAS,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,CAAC;IAUlD,IAAI,iBAAiB,IAAI,MAAM,EAAE,CAEhC;CACD"}

package/dist/firstcontact/FirstContactManager.js

@@ -0,0 +1,38 @@
+/**
+ * FirstContactManager — OAuth2 social authentication.
+ *
+ * Usage:
+ *   firstContact.use('google').redirectUrl()
+ *   firstContact.use('google').callback(code)
+ */
+export class FirstContactManager {
+    #drivers = new Map();
+    use(name) {
+        const driver = this.#drivers.get(name);
+        if (!driver)
+            throw new Error(`OAuth driver '${name}' not registered. Available: ${[...this.#drivers.keys()].join(", ")}`);
+        return driver;
+    }
+    register(name, driver) {
+        this.#drivers.set(name, driver);
+    }
+    redirect(name, state) {
+        return this.use(name).redirectUrl(state);
+    }
+    /**
+     * Handle the OAuth callback. Pass `state` (from the query string) and
+     * `expectedState` (from the session, stored at redirect time) for CSRF
+     * protection. Omitting `expectedState` logs a security warning.
+     */
+    async callback(name, code, state, expectedState) {
+        if (!expectedState) {
+            throw new Error(`[warden] OAuth callback for '${name}' requires expectedState for CSRF protection. ` +
+                `Store the state from redirect() in the session and pass it here.`);
+        }
+        return this.use(name).callback(code, state, expectedState);
+    }
+    get registeredDrivers() {
+        return [...this.#drivers.keys()];
+    }
+}
+//# sourceMappingURL=FirstContactManager.js.map

package/dist/firstcontact/FirstContactManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FirstContactManager.js","sourceRoot":"","sources":["../../src/firstcontact/FirstContactManager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,OAAO,mBAAmB;IAC/B,QAAQ,GAAoC,IAAI,GAAG,EAAE,CAAC;IAEtD,GAAG,CAAC,IAAY;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM;YACV,MAAM,IAAI,KAAK,CACd,iBAAiB,IAAI,gCAAgC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3F,CAAC;QACH,OAAO,MAAM,CAAC;IACf,CAAC;IAED,QAAQ,CAAC,IAAY,EAAE,MAA0B;QAChD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC;IAED,QAAQ,CAAC,IAAY,EAAE,KAAc;QACpC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CACb,IAAY,EACZ,IAAY,EACZ,KAAc,EACd,aAAsB;QAEtB,IAAI,CAAC,aAAa,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACd,gCAAgC,IAAI,gDAAgD;gBACnF,kEAAkE,CACnE,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,iBAAiB;QACpB,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC;CACD"}

package/dist/firstcontact/drivers/GitHubDriver.d.ts

@@ -0,0 +1,14 @@
+/**
+ * GitHub OAuth2 driver for FirstContact.
+ */
+import type { FirstContactDriver, OAuthConfig, OAuthToken, OAuthUser } from "../types.js";
+export declare class GitHubDriver implements FirstContactDriver {
+    private config;
+    constructor(config: OAuthConfig);
+    redirectUrl(state?: string): string;
+    callback(code: string, state?: string, expectedState?: string): Promise<{
+        user: OAuthUser;
+        token: OAuthToken;
+    }>;
+}
+//# sourceMappingURL=GitHubDriver.d.ts.map

package/dist/firstcontact/drivers/GitHubDriver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GitHubDriver.d.ts","sourceRoot":"","sources":["../../../src/firstcontact/drivers/GitHubDriver.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACX,kBAAkB,EAClB,WAAW,EACX,UAAU,EACV,SAAS,EACT,MAAM,aAAa,CAAC;AAErB,qBAAa,YAAa,YAAW,kBAAkB;IAC1C,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,WAAW;IAEvC,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM;IAU7B,QAAQ,CACb,IAAI,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC;QAAE,IAAI,EAAE,SAAS,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,CAAC;CAiDlD"}

package/dist/firstcontact/drivers/GitHubDriver.js

@@ -0,0 +1,61 @@
+/**
+ * GitHub OAuth2 driver for FirstContact.
+ */
+export class GitHubDriver {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    redirectUrl(state) {
+        const params = new URLSearchParams({
+            client_id: this.config.clientId,
+            redirect_uri: this.config.callbackUrl,
+            scope: (this.config.scopes ?? ["read:user", "user:email"]).join(" "),
+            ...(state ? { state } : {}),
+        });
+        return `https://github.com/login/oauth/authorize?${params}`;
+    }
+    async callback(code, state, expectedState) {
+        if (expectedState && state !== expectedState) {
+            throw new Error("OAuth state mismatch — possible CSRF attack");
+        }
+        const tokenRes = await fetch("https://github.com/login/oauth/access_token", {
+            method: "POST",
+            headers: {
+                Accept: "application/json",
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({
+                client_id: this.config.clientId,
+                client_secret: this.config.clientSecret,
+                code,
+            }),
+        });
+        if (!tokenRes.ok) {
+            throw new Error(`GitHub OAuth token exchange failed (HTTP ${tokenRes.status})`);
+        }
+        const tokens = (await tokenRes.json());
+        if (!tokens.access_token)
+            throw new Error("GitHub OAuth: no access_token in response");
+        const userRes = await fetch("https://api.github.com/user", {
+            headers: {
+                Authorization: `Bearer ${tokens.access_token}`,
+                Accept: "application/json",
+            },
+        });
+        if (!userRes.ok)
+            throw new Error(`GitHub user API failed (${userRes.status})`);
+        const raw = (await userRes.json());
+        return {
+            user: {
+                id: String(raw.id ?? ""),
+                email: String(raw.email ?? ""),
+                name: String(raw.name ?? raw.login ?? ""),
+                avatarUrl: raw.avatar_url,
+                raw,
+            },
+            token: { accessToken: String(tokens.access_token) },
+        };
+    }
+}
+//# sourceMappingURL=GitHubDriver.js.map

package/dist/firstcontact/drivers/GitHubDriver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GitHubDriver.js","sourceRoot":"","sources":["../../../src/firstcontact/drivers/GitHubDriver.ts"],"names":[],"mappings":"AAAA;;GAEG;AASH,MAAM,OAAO,YAAY;IACJ;IAApB,YAAoB,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAE3C,WAAW,CAAC,KAAc;QACzB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YAClC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;YACrC,KAAK,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACpE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3B,CAAC,CAAC;QACH,OAAO,4CAA4C,MAAM,EAAE,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,QAAQ,CACb,IAAY,EACZ,KAAc,EACd,aAAsB;QAEtB,IAAI,aAAa,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC3B,6CAA6C,EAC7C;YACC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACR,MAAM,EAAE,kBAAkB;gBAC1B,cAAc,EAAE,kBAAkB;aAClC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACpB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;gBACvC,IAAI;aACJ,CAAC;SACF,CACD,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACd,4CAA4C,QAAQ,CAAC,MAAM,GAAG,CAC9D,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;QAClE,IAAI,CAAC,MAAM,CAAC,YAAY;YACvB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAE9D,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,6BAA6B,EAAE;YAC1D,OAAO,EAAE;gBACR,aAAa,EAAE,UAAU,MAAM,CAAC,YAAY,EAAE;gBAC9C,MAAM,EAAE,kBAAkB;aAC1B;SACD,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,EAAE;YACd,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAA4B,CAAC;QAE9D,OAAO;YACN,IAAI,EAAE;gBACL,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;gBACxB,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC9B,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;gBACzC,SAAS,EAAE,GAAG,CAAC,UAAgC;gBAC/C,GAAG;aACH;YACD,KAAK,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE;SACnD,CAAC;IACH,CAAC;CACD"}

package/dist/firstcontact/drivers/GoogleDriver.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Google OAuth2 driver for FirstContact.
+ */
+import type { FirstContactDriver, OAuthConfig, OAuthToken, OAuthUser } from "../types.js";
+export declare class GoogleDriver implements FirstContactDriver {
+    private config;
+    constructor(config: OAuthConfig);
+    redirectUrl(state?: string): string;
+    callback(code: string, state?: string, expectedState?: string): Promise<{
+        user: OAuthUser;
+        token: OAuthToken;
+    }>;
+}
+//# sourceMappingURL=GoogleDriver.d.ts.map

package/dist/firstcontact/drivers/GoogleDriver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GoogleDriver.d.ts","sourceRoot":"","sources":["../../../src/firstcontact/drivers/GoogleDriver.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACX,kBAAkB,EAClB,WAAW,EACX,UAAU,EACV,SAAS,EACT,MAAM,aAAa,CAAC;AAErB,qBAAa,YAAa,YAAW,kBAAkB;IAC1C,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,WAAW;IAEvC,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM;IAY7B,QAAQ,CACb,IAAI,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC;QAAE,IAAI,EAAE,SAAS,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,CAAC;CAkDlD"}

package/dist/firstcontact/drivers/GoogleDriver.js

@@ -0,0 +1,64 @@
+/**
+ * Google OAuth2 driver for FirstContact.
+ */
+export class GoogleDriver {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    redirectUrl(state) {
+        const params = new URLSearchParams({
+            client_id: this.config.clientId,
+            redirect_uri: this.config.callbackUrl,
+            response_type: "code",
+            scope: (this.config.scopes ?? ["openid", "email", "profile"]).join(" "),
+            access_type: "offline",
+            ...(state ? { state } : {}),
+        });
+        return `https://accounts.google.com/o/oauth2/v2/auth?${params}`;
+    }
+    async callback(code, state, expectedState) {
+        // CSRF protection: validate state matches what we sent in redirectUrl().
+        if (expectedState && state !== expectedState) {
+            throw new Error("OAuth state mismatch — possible CSRF attack");
+        }
+        const tokenRes = await fetch("https://oauth2.googleapis.com/token", {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({
+                code,
+                client_id: this.config.clientId,
+                client_secret: this.config.clientSecret,
+                redirect_uri: this.config.callbackUrl,
+                grant_type: "authorization_code",
+            }),
+        });
+        if (!tokenRes.ok) {
+            throw new Error(`Google OAuth token exchange failed (HTTP ${tokenRes.status})`);
+        }
+        const tokens = (await tokenRes.json());
+        if (!tokens.access_token)
+            throw new Error("Google OAuth: no access_token in response");
+        const userRes = await fetch("https://www.googleapis.com/oauth2/v2/userinfo", {
+            headers: { Authorization: `Bearer ${tokens.access_token}` },
+        });
+        if (!userRes.ok)
+            throw new Error(`Google userinfo failed (${userRes.status})`);
+        const raw = (await userRes.json());
+        return {
+            user: {
+                id: String(raw.id ?? ""),
+                email: String(raw.email ?? ""),
+                name: String(raw.name ?? ""),
+                avatarUrl: raw.picture,
+                raw,
+            },
+            token: {
+                accessToken: String(tokens.access_token),
+                refreshToken: tokens.refresh_token,
+                expiresIn: tokens.expires_in,
+            },
+        };
+    }
+}
+//# sourceMappingURL=GoogleDriver.js.map

package/dist/firstcontact/drivers/GoogleDriver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GoogleDriver.js","sourceRoot":"","sources":["../../../src/firstcontact/drivers/GoogleDriver.ts"],"names":[],"mappings":"AAAA;;GAEG;AASH,MAAM,OAAO,YAAY;IACJ;IAApB,YAAoB,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAE3C,WAAW,CAAC,KAAc;QACzB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YAClC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;YACrC,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACvE,WAAW,EAAE,SAAS;YACtB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3B,CAAC,CAAC;QACH,OAAO,gDAAgD,MAAM,EAAE,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,QAAQ,CACb,IAAY,EACZ,KAAc,EACd,aAAsB;QAEtB,yEAAyE;QACzE,IAAI,aAAa,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,qCAAqC,EAAE;YACnE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACzB,IAAI;gBACJ,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;gBACvC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;gBACrC,UAAU,EAAE,oBAAoB;aAChC,CAAC;SACF,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACd,4CAA4C,QAAQ,CAAC,MAAM,GAAG,CAC9D,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;QAClE,IAAI,CAAC,MAAM,CAAC,YAAY;YACvB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAE9D,MAAM,OAAO,GAAG,MAAM,KAAK,CAC1B,+CAA+C,EAC/C;YACC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,YAAY,EAAE,EAAE;SAC3D,CACD,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,EAAE;YACd,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAA4B,CAAC;QAE9D,OAAO;YACN,IAAI,EAAE;gBACL,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;gBACxB,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC9B,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;gBAC5B,SAAS,EAAE,GAAG,CAAC,OAA6B;gBAC5C,GAAG;aACH;YACD,KAAK,EAAE;gBACN,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;gBACxC,YAAY,EAAE,MAAM,CAAC,aAAmC;gBACxD,SAAS,EAAE,MAAM,CAAC,UAAgC;aAClD;SACD,CAAC;IACH,CAAC;CACD"}

package/dist/firstcontact/types.d.ts

@@ -0,0 +1,34 @@
+/**
+ * FirstContact — OAuth2 social authentication types.
+ */
+export interface OAuthConfig {
+    clientId: string;
+    clientSecret: string;
+    callbackUrl: string;
+    scopes?: string[];
+}
+export interface OAuthUser {
+    id: string;
+    email: string;
+    name: string;
+    avatarUrl?: string;
+    raw: Record<string, unknown>;
+}
+export interface OAuthToken {
+    accessToken: string;
+    refreshToken?: string;
+    expiresIn?: number;
+}
+export interface FirstContactDriver {
+    redirectUrl(state?: string): string;
+    /**
+     * Handle the OAuth callback. `state` MUST be validated against the value
+     * originally passed to `redirectUrl()` to prevent CSRF login attacks.
+     * Throws if state is missing or mismatched.
+     */
+    callback(code: string, state?: string, expectedState?: string): Promise<{
+        user: OAuthUser;
+        token: OAuthToken;
+    }>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/firstcontact/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/firstcontact/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,WAAW;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,SAAS;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,UAAU;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IAClC,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CACP,IAAI,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC;QAAE,IAAI,EAAE,SAAS,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,CAAC,CAAC;CACnD"}

package/dist/firstcontact/types.js

@@ -0,0 +1,5 @@
+/**
+ * FirstContact — OAuth2 social authentication types.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/firstcontact/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/firstcontact/types.ts"],"names":[],"mappings":"AAAA;;GAEG"}

package/dist/index.d.ts

@@ -0,0 +1,52 @@
+/**
+ * @module @c9up/warden
+ * @description Warden — Authentication & authorization for the Ream framework
+ * @implements FR48, FR49, FR50, FR51, FR52, FR53
+ */
+export type { AuthConfig, AuthResult, AuthStrategy, UserPayload, } from "./AuthManager.js";
+export { AuthManager } from "./AuthManager.js";
+export type { AuthRateLimiterConfig } from "./AuthRateLimiter.js";
+export { AuthRateLimiter } from "./AuthRateLimiter.js";
+export { AuthorizationResponse } from "./bouncer/AuthorizationResponse.js";
+export { BasePolicy } from "./bouncer/BasePolicy.js";
+export { Bouncer } from "./bouncer/Bouncer.js";
+export { action, allowGuest, getActionMetadata, } from "./bouncer/decorators.js";
+export type { PolicyAuthorizer } from "./bouncer/PolicyAuthorizer.js";
+export type { Ability, AbilityOptions, AuthorizerResponse, BouncerContext, } from "./bouncer/types.js";
+export { defineConfig } from "./config.js";
+export { configure } from "./configure.js";
+export { WardenError } from "./errors.js";
+export { GitHubDriver } from "./firstcontact/drivers/GitHubDriver.js";
+export { GoogleDriver } from "./firstcontact/drivers/GoogleDriver.js";
+export { FirstContactManager } from "./firstcontact/FirstContactManager.js";
+export type { FirstContactDriver, OAuthConfig, OAuthToken, OAuthUser, } from "./firstcontact/types.js";
+export { Guard, getGuardMetadata, getPermissionMetadata, getRequireMfaMetadata, getRoleMetadata, Permission, RequireMfa, Role, } from "./Guard.js";
+export type { BackupCodesConfig, BackupCodesResult, BackupCodeVerification, } from "./mfa/BackupCodesProvider.js";
+export { BackupCodesProvider } from "./mfa/BackupCodesProvider.js";
+export type { MfaFactor, MfaFactorKind, MfaFactorStore, MfaFactorSummary, MfaManagerConfig, } from "./mfa/MfaManager.js";
+export { MemoryMfaFactorStore, MfaManager } from "./mfa/MfaManager.js";
+export type { OtpChallenge, OtpChallengeStore, OtpConfig, OtpDeliveryChannel, OtpFailureReason, OtpStartResult, OtpVerification, } from "./mfa/OtpProvider.js";
+export { MemoryOtpChallengeStore, OtpProvider } from "./mfa/OtpProvider.js";
+export type { TotpAlgorithm, TotpConfig, TotpEnrollment, } from "./mfa/TotpProvider.js";
+export { TotpProvider } from "./mfa/TotpProvider.js";
+export type { AuthenticationOptionsJSON, AuthenticationResponseJSON, RegistrationOptionsJSON, RegistrationResponseJSON, StoredPasskey, WebauthnChallengeStore, WebauthnConfig, WebauthnCredentialStore, WebauthnUser, } from "./mfa/WebauthnProvider.js";
+export { MemoryWebauthnChallengeStore, MemoryWebauthnCredentialStore, WebauthnProvider, } from "./mfa/WebauthnProvider.js";
+export type { RedisBlacklistConfig, RedisLikeClient, } from "./RedisBlacklistDriver.js";
+export { RedisBlacklistDriver } from "./RedisBlacklistDriver.js";
+export type { RefreshTokenDriver, StoredRefreshToken, } from "./RefreshTokenStore.js";
+export { generateRefreshToken, MemoryRefreshTokenDriver, } from "./RefreshTokenStore.js";
+export type { BlacklistDegradeEvent, ResilientBlacklistConfig, } from "./ResilientBlacklistDriver.js";
+export { ResilientBlacklistDriver } from "./ResilientBlacklistDriver.js";
+export { MemoryRightsStore } from "./rights/MemoryRightsStore.js";
+export { RightsResolver } from "./rights/RightsResolver.js";
+export type { EffectivePermissions, RightsStore, Scope, } from "./rights/types.js";
+export { scopeKey } from "./rights/types.js";
+export type { ApiKeyConfig } from "./strategies/ApiKeyStrategy.js";
+export { ApiKeyStrategy } from "./strategies/ApiKeyStrategy.js";
+export type { JwtStrategyConfig } from "./strategies/JwtStrategy.js";
+export { generateJwtSecret, JwtStrategy } from "./strategies/JwtStrategy.js";
+export type { SessionStore, SessionStrategyConfig, } from "./strategies/SessionStrategy.js";
+export { SessionStrategy } from "./strategies/SessionStrategy.js";
+export type { BlacklistDriver } from "./TokenBlacklist.js";
+export { MemoryBlacklistDriver, TokenBlacklist } from "./TokenBlacklist.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,YAAY,EACX,UAAU,EACV,UAAU,EACV,YAAY,EACZ,WAAW,GACX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,YAAY,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EACN,MAAM,EACN,UAAU,EACV,iBAAiB,GACjB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtE,YAAY,EACX,OAAO,EACP,cAAc,EACd,kBAAkB,EAClB,cAAc,GACd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,YAAY,EACX,kBAAkB,EAClB,WAAW,EACX,UAAU,EACV,SAAS,GACT,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACN,KAAK,EACL,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,EACf,UAAU,EACV,UAAU,EACV,IAAI,GACJ,MAAM,YAAY,CAAC;AACpB,YAAY,EACX,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,GACtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,YAAY,EACX,SAAS,EACT,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,gBAAgB,GAChB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACvE,YAAY,EACX,YAAY,EACZ,iBAAiB,EACjB,SAAS,EACT,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,eAAe,GACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAC5E,YAAY,EACX,aAAa,EACb,UAAU,EACV,cAAc,GACd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,YAAY,EACX,yBAAyB,EACzB,0BAA0B,EAC1B,uBAAuB,EACvB,wBAAwB,EACxB,aAAa,EACb,sBAAsB,EACtB,cAAc,EACd,uBAAuB,EACvB,YAAY,GACZ,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACN,4BAA4B,EAC5B,6BAA6B,EAC7B,gBAAgB,GAChB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACX,oBAAoB,EACpB,eAAe,GACf,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,YAAY,EACX,kBAAkB,EAClB,kBAAkB,GAClB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACN,oBAAoB,EACpB,wBAAwB,GACxB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACX,qBAAqB,EACrB,wBAAwB,GACxB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,YAAY,EACX,oBAAoB,EACpB,WAAW,EACX,KAAK,GACL,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,YAAY,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,YAAY,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC7E,YAAY,EACX,YAAY,EACZ,qBAAqB,GACrB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/index.js

@@ -0,0 +1,34 @@
+/**
+ * @module @c9up/warden
+ * @description Warden — Authentication & authorization for the Ream framework
+ * @implements FR48, FR49, FR50, FR51, FR52, FR53
+ */
+export { AuthManager } from "./AuthManager.js";
+export { AuthRateLimiter } from "./AuthRateLimiter.js";
+export { AuthorizationResponse } from "./bouncer/AuthorizationResponse.js";
+export { BasePolicy } from "./bouncer/BasePolicy.js";
+export { Bouncer } from "./bouncer/Bouncer.js";
+export { action, allowGuest, getActionMetadata, } from "./bouncer/decorators.js";
+export { defineConfig } from "./config.js";
+export { configure } from "./configure.js";
+export { WardenError } from "./errors.js";
+export { GitHubDriver } from "./firstcontact/drivers/GitHubDriver.js";
+export { GoogleDriver } from "./firstcontact/drivers/GoogleDriver.js";
+export { FirstContactManager } from "./firstcontact/FirstContactManager.js";
+export { Guard, getGuardMetadata, getPermissionMetadata, getRequireMfaMetadata, getRoleMetadata, Permission, RequireMfa, Role, } from "./Guard.js";
+export { BackupCodesProvider } from "./mfa/BackupCodesProvider.js";
+export { MemoryMfaFactorStore, MfaManager } from "./mfa/MfaManager.js";
+export { MemoryOtpChallengeStore, OtpProvider } from "./mfa/OtpProvider.js";
+export { TotpProvider } from "./mfa/TotpProvider.js";
+export { MemoryWebauthnChallengeStore, MemoryWebauthnCredentialStore, WebauthnProvider, } from "./mfa/WebauthnProvider.js";
+export { RedisBlacklistDriver } from "./RedisBlacklistDriver.js";
+export { generateRefreshToken, MemoryRefreshTokenDriver, } from "./RefreshTokenStore.js";
+export { ResilientBlacklistDriver } from "./ResilientBlacklistDriver.js";
+export { MemoryRightsStore } from "./rights/MemoryRightsStore.js";
+export { RightsResolver } from "./rights/RightsResolver.js";
+export { scopeKey } from "./rights/types.js";
+export { ApiKeyStrategy } from "./strategies/ApiKeyStrategy.js";
+export { generateJwtSecret, JwtStrategy } from "./strategies/JwtStrategy.js";
+export { SessionStrategy } from "./strategies/SessionStrategy.js";
+export { MemoryBlacklistDriver, TokenBlacklist } from "./TokenBlacklist.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EACN,MAAM,EACN,UAAU,EACV,iBAAiB,GACjB,MAAM,yBAAyB,CAAC;AAQjC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAO5E,OAAO,EACN,KAAK,EACL,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,EACf,UAAU,EACV,UAAU,EACV,IAAI,GACJ,MAAM,YAAY,CAAC;AAMpB,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAQnE,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAUvE,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAM5E,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAYrD,OAAO,EACN,4BAA4B,EAC5B,6BAA6B,EAC7B,gBAAgB,GAChB,MAAM,2BAA2B,CAAC;AAKnC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAKjE,OAAO,EACN,oBAAoB,EACpB,wBAAwB,GACxB,MAAM,wBAAwB,CAAC;AAKhC,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAM5D,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAEhE,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAK7E,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAElE,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC"}