@c9up/warden 0.1.4 → 0.1.6

package/dist/middleware.d.ts

@@ -16,6 +16,11 @@
  *   }
  */
 import { type AuthResult } from "./AuthManager.js";
+import type { BasePolicy } from "./bouncer/BasePolicy.js";
+import { Bouncer } from "./bouncer/Bouncer.js";
+import type { Ability } from "./bouncer/types.js";
+import type { ScopeRequestContext } from "./config.js";
+import type { Scope } from "./rights/types.js";
 import type { SessionStore } from "./strategies/SessionStrategy.js";
 export interface WardenContext {
     request: {
@@ -34,6 +39,8 @@ export interface WardenContext {
     session?: SessionStore;
     /** Set by the middleware after successful auth. */
     auth?: AuthResult;
+    /** Set by `initializeBouncer` — the per-request authorization entry point. */
+    bouncer?: Bouncer;
     /** The route handler metadata (decorators). */
     route?: {
         controller?: object;
@@ -47,5 +54,29 @@ type WardenNext = () => Promise<void> | void;
  * and authenticates + authorizes the request.
  */
 export declare function wardenMiddleware(ctx: WardenContext, next: WardenNext): Promise<void>;
+/**
+ * The abilities/policies/scope-resolver a per-request Bouncer is built from.
+ * Registered once by `WardenProvider` (from `config.auth`) under the container
+ * token `"bouncer:registry"`; read fresh by `initializeBouncer` per request.
+ */
+export interface BouncerRegistry {
+    abilities: Record<string, Ability<never[]>>;
+    policies: Record<string, new () => BasePolicy>;
+    resolveScope?: (ctx: ScopeRequestContext) => Scope | Promise<Scope>;
+}
+/**
+ * Bouncer initializer (Epic 56.6) — a GLOBAL middleware (register it for every
+ * route, after `wardenMiddleware`). It builds the per-request {@link Bouncer}
+ * from the authenticated user (`ctx.auth?.user`, or `null` for a guest), the
+ * shared `RightsResolver`, and the registered abilities/policies, then attaches
+ * it as `ctx.bouncer`. Handlers authorize via `await ctx.bouncer.authorize(...)`
+ * (throws `WARDEN_AUTHORIZATION_FAILURE` carrying `status: 403`, which the host's
+ * ExceptionHandler maps to a 403 response) or branch on `ctx.bouncer.allows(...)`.
+ *
+ * Unlike `wardenMiddleware` (a per-route GUARD that short-circuits public
+ * routes), this runs on EVERY request so `ctx.bouncer` is always available —
+ * including for guests — matching AdonisJS's `initialize_bouncer_middleware`.
+ */
+export declare function initializeBouncer(ctx: WardenContext, next: WardenNext): Promise<void>;
 export {};
 //# sourceMappingURL=middleware.d.ts.map

package/dist/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAEN,KAAK,UAAU,EAGf,MAAM,kBAAkB,CAAC;AAM1B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAcpE,MAAM,WAAW,aAAa;IAC7B,OAAO,EAAE;QACR,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAChC,CAAC;IACF,QAAQ,EAAE;QACT,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;QAC/B,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;KAC9B,CAAC;IACF,SAAS,EAAE;QACV,OAAO,EAAE,CACR,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,OAAO,CAAC,KAC/D,OAAO,CAAC;KACb,CAAC;IACF,4DAA4D;IAC5D,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,mDAAmD;IACnD,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,+CAA+C;IAC/C,KAAK,CAAC,EAAE;QACP,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;KACzB,CAAC;CACF;AAED,KAAK,UAAU,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAE7C;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,iBAoG1E"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAEN,KAAK,UAAU,EAGf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAQvD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAcpE,MAAM,WAAW,aAAa;IAC7B,OAAO,EAAE;QACR,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAChC,CAAC;IACF,QAAQ,EAAE;QACT,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;QAC/B,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;KAC9B,CAAC;IACF,SAAS,EAAE;QACV,OAAO,EAAE,CACR,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,OAAO,CAAC,KAC/D,OAAO,CAAC;KACb,CAAC;IACF,4DAA4D;IAC5D,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,mDAAmD;IACnD,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,8EAA8E;IAC9E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,+CAA+C;IAC/C,KAAK,CAAC,EAAE;QACP,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;KACzB,CAAC;CACF;AAED,KAAK,UAAU,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAE7C;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,iBAwH1E;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC/B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC5C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,UAAU,CAAC,CAAC;IAC/C,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,mBAAmB,KAAK,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;CACpE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,iBAmB3E"}

package/dist/middleware.js

@@ -16,7 +16,9 @@
  *   }
  */
 import { AuthManager, sanitizePayload, } from "./AuthManager.js";
-import { getGuardMetadata, getPermissionMetadata, getRoleMetadata, } from "./Guard.js";
+import { Bouncer } from "./bouncer/Bouncer.js";
+import { getGuardMetadata, getPermissionMetadata, getRequireMfaMetadata, getRoleMetadata, } from "./Guard.js";
+import { RightsResolver } from "./rights/RightsResolver.js";
 function hasVerifyWithContext(strategy) {
     return (typeof strategy.verifyWithContext === "function");
 }
@@ -101,17 +103,88 @@ export async function wardenMiddleware(ctx, next) {
     // bypass permission checks. This is the strictest model — callers who want
     // role-OR-permission semantics should use a custom guard instead.
     if (controller && action) {
-        const denied = await checkAuthorization(auth, user, controller, action);
+        const scope = await resolveRequestScope(ctx);
+        const denied = await checkAuthorization(auth, user, controller, action, scope);
         if (denied) {
             ctx.response.status(403);
             ctx.response.json({ error: { code: "FORBIDDEN", message: denied } });
             return;
         }
+        // @RequireMfa gate: the user must carry a truthy `mfa` claim, set by the
+        // app's step-up flow once MfaManager.verify() succeeds.
+        if (getRequireMfaMetadata(controller, action) && user.mfa !== true) {
+            ctx.response.status(403);
+            ctx.response.json({
+                error: {
+                    code: "MFA_REQUIRED",
+                    message: "Multi-factor authentication is required for this action.",
+                },
+            });
+            return;
+        }
     }
     // Auth successful — attach to context and continue.
     ctx.auth = result;
     await next();
 }
+/**
+ * Bouncer initializer (Epic 56.6) — a GLOBAL middleware (register it for every
+ * route, after `wardenMiddleware`). It builds the per-request {@link Bouncer}
+ * from the authenticated user (`ctx.auth?.user`, or `null` for a guest), the
+ * shared `RightsResolver`, and the registered abilities/policies, then attaches
+ * it as `ctx.bouncer`. Handlers authorize via `await ctx.bouncer.authorize(...)`
+ * (throws `WARDEN_AUTHORIZATION_FAILURE` carrying `status: 403`, which the host's
+ * ExceptionHandler maps to a 403 response) or branch on `ctx.bouncer.allows(...)`.
+ *
+ * Unlike `wardenMiddleware` (a per-route GUARD that short-circuits public
+ * routes), this runs on EVERY request so `ctx.bouncer` is always available —
+ * including for guests — matching AdonisJS's `initialize_bouncer_middleware`.
+ */
+export async function initializeBouncer(ctx, next) {
+    // Both dependencies are registered by WardenProvider. Resolve defensively:
+    // a host that wired the middleware but not the provider gets an empty Bouncer
+    // (no abilities/resolver) rather than a crash on every request.
+    const resolved = tryResolve(ctx, RightsResolver);
+    const resolver = resolved instanceof RightsResolver ? resolved : undefined;
+    const candidate = tryResolve(ctx, "bouncer:registry");
+    const registry = isBouncerRegistry(candidate) ? candidate : undefined;
+    const user = ctx.auth?.user ?? null;
+    const scope = registry?.resolveScope
+        ? await registry.resolveScope(ctx)
+        : "global";
+    ctx.bouncer = new Bouncer(user, registry?.abilities, registry?.policies, {
+        scope,
+        resolver,
+    });
+    await next();
+}
+/** Resolve a container token, returning undefined instead of throwing when absent. */
+function tryResolve(ctx, token) {
+    try {
+        return ctx.container.resolve(token);
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Structural guard — the registry is a plain object carrying ability/policy tables. */
+function isBouncerRegistry(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        "abilities" in value &&
+        "policies" in value);
+}
+/**
+ * Resolve the request's authorization scope from the registry's `resolveScope`
+ * hook (default `"global"`). Shared so the @Role/@Permission decorator gate and
+ * the Bouncer path evaluate in the SAME scope — without this the decorator path
+ * hardcoded "global" and tenant-scoped roles/grants never satisfied @Role/@Permission.
+ */
+async function resolveRequestScope(ctx) {
+    const candidate = tryResolve(ctx, "bouncer:registry");
+    const registry = isBouncerRegistry(candidate) ? candidate : undefined;
+    return registry?.resolveScope ? await registry.resolveScope(ctx) : "global";
+}
 /**
  * Try each declared strategy in order — session strategies via
  * `verifyWithContext()`, others via `verify(token)` with native-first credential
@@ -179,13 +252,13 @@ async function tryAuthenticate(auth, strategies, creds) {
  * EffectivePermissions set (Epic 56, D7). Returns the FORBIDDEN message, or null
  * when authorised (and zero-cost when neither decorator is present).
  */
-async function checkAuthorization(auth, user, controller, action) {
+async function checkAuthorization(auth, user, controller, action, scope) {
     const requiredPermissions = getPermissionMetadata(controller, action);
     const requiredRoles = getRoleMetadata(controller, action);
     if (requiredPermissions.length === 0 && requiredRoles.length === 0) {
         return null;
     }
-    const effective = await auth.resolvePermissions(user, "global");
+    const effective = await auth.resolvePermissions(user, scope);
     if (requiredPermissions.length > 0) {
         const missing = requiredPermissions.filter((p) => !effective.has(p));
         if (missing.length > 0)

package/dist/middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EACN,WAAW,EAGX,eAAe,GACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACN,gBAAgB,EAChB,qBAAqB,EACrB,eAAe,GACf,MAAM,YAAY,CAAC;AAOpB,SAAS,oBAAoB,CAC5B,QAAsB;IAEtB,OAAO,CACN,OAAQ,QAAgC,CAAC,iBAAiB,KAAK,UAAU,CACzE,CAAC;AACH,CAAC;AA8BD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAkB,EAAE,IAAgB;IAC1E,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,CAAgB,CAAC;IAE/D,2EAA2E;IAC3E,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC;IACzC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC;IACjC,MAAM,UAAU,GACf,UAAU,IAAI,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAElE,2DAA2D;IAC3D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,EAAE,CAAC;QACb,OAAO;IACR,CAAC;IAED,6CAA6C;IAC7C,gDAAgD;IAChD,2EAA2E;IAC3E,kEAAkE;IAClE,oFAAoF;IACpF,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;IAC3D,MAAM,WAAW,GAAG,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC;QACnD,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QACrB,CAAC,CAAC,EAAE,CAAC;IACN,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE;QAC1B,IAAI,CAAC;YACJ,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YACtC,OAAQ,CAA6B,CAAC,UAAU,IAAI,WAAW,CAAC;QACjE,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,WAAW,CAAC;QACpB,CAAC;IACF,CAAC,CAAC,EAAE,CAAC;IACL,iEAAiE;IACjE,kEAAkE;IAClE,mEAAmE;IACnE,gEAAgE;IAChE,8DAA8D;IAC9D,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAErE,MAAM,kBAAkB,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IACnE,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACpD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;YACjB,KAAK,EAAE;gBACN,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,oDAAoD;aAC7D;SACD,CAAC,CAAC;QACH,OAAO;IACR,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,6DAA6D;IAC7D,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,MAAM,eAAe,CACjE,IAAI,EACJ,UAAU,EACV,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,kBAAkB,EAAE,CACjE,CAAC;IAEF,IAAI,CAAC,MAAM,EAAE,aAAa,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,YAAY,GAAG,CAAC,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;YACrD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE;oBACN,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EACN,gFAAgF;iBACjF;aACD,CAAC,CAAC;YACH,OAAO;QACR,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;YACjB,KAAK,EAAE;gBACN,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,MAAM,EAAE,KAAK,IAAI,uBAAuB;aACjD;SACD,CAAC,CAAC;QACH,OAAO;IACR,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IAEzB,4EAA4E;IAC5E,0EAA0E;IAC1E,2EAA2E;IAC3E,kEAAkE;IAClE,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QACxE,IAAI,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YACrE,OAAO;QACR,CAAC;IACF,CAAC;IAED,oDAAoD;IACpD,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;IAClB,MAAM,IAAI,EAAE,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,eAAe,CAC7B,IAAiB,EACjB,UAAoB,EACpB,KAKC;IAMD,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC/C,IAAI,MAAM,GAAsB,IAAI,CAAC;IACrC,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,MAAM,YAAY,IAAI,UAAU,EAAE,CAAC;QACvC,IAAI,CAAC;YACJ,IAAI,CAAa,CAAC;YAClB,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;gBAChD,MAAM,iBAAiB,GACtB,QAAQ,IAAI,oBAAoB,CAAC,QAAQ,CAAC;oBACzC,CAAC,CAAC,QAAQ,CAAC,iBAAiB;oBAC5B,CAAC,CAAC,SAAS,CAAC;gBACd,IAAI,iBAAiB,EAAE,CAAC;oBACvB,YAAY,EAAE,CAAC;oBACf,CAAC,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;oBAC5D,+DAA+D;oBAC/D,gEAAgE;oBAChE,IAAI,CAAC,CAAC,IAAI;wBAAE,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACrC,CAAC;qBAAM,CAAC;oBACP,SAAS;gBACV,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,4DAA4D;gBAC5D,+DAA+D;gBAC/D,oEAAoE;gBACpE,MAAM,UAAU,GACf,YAAY,KAAK,SAAS;oBACzB,CAAC,CAAC,MAAM,IAAI,WAAW;oBACvB,CAAC,CAAC,WAAW,IAAI,MAAM,CAAC;gBAC1B,IAAI,CAAC,UAAU;oBAAE,SAAS;gBAC1B,YAAY,EAAE,CAAC;gBACf,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YACjD,CAAC;YACD,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC;gBACrB,MAAM,GAAG,CAAC,CAAC;gBACX,MAAM;YACP,CAAC;YACD,IAAI,CAAC,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC9B,UAAU,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CACZ,sBAAsB,YAAY,4BAA4B,CAAC,CAAC,KAAK,IAAI,eAAe,EAAE,CAC1F,CAAC;YACH,CAAC;QACF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,sEAAsE;YACtE,mEAAmE;YACnE,UAAU,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACZ,sBAAsB,YAAY,0BAA0B,EAC5D,GAAG,CACH,CAAC;QACH,CAAC;IACF,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,kBAAkB,CAChC,IAAiB,EACjB,IAAqC,EACrC,UAAkB,EAClB,MAAuB;IAEvB,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACtE,MAAM,aAAa,GAAG,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC1D,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAChE,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,wBAAwB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAC7E,CAAC;IACD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,kBAAkB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACvE,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC"}
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EACN,WAAW,EAGX,eAAe,GACf,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAG/C,OAAO,EACN,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAQ5D,SAAS,oBAAoB,CAC5B,QAAsB;IAEtB,OAAO,CACN,OAAQ,QAAgC,CAAC,iBAAiB,KAAK,UAAU,CACzE,CAAC;AACH,CAAC;AAgCD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAkB,EAAE,IAAgB;IAC1E,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,CAAgB,CAAC;IAE/D,2EAA2E;IAC3E,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC;IACzC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC;IACjC,MAAM,UAAU,GACf,UAAU,IAAI,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAElE,2DAA2D;IAC3D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,EAAE,CAAC;QACb,OAAO;IACR,CAAC;IAED,6CAA6C;IAC7C,gDAAgD;IAChD,2EAA2E;IAC3E,kEAAkE;IAClE,oFAAoF;IACpF,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;IAC3D,MAAM,WAAW,GAAG,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC;QACnD,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QACrB,CAAC,CAAC,EAAE,CAAC;IACN,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE;QAC1B,IAAI,CAAC;YACJ,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YACtC,OAAQ,CAA6B,CAAC,UAAU,IAAI,WAAW,CAAC;QACjE,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,WAAW,CAAC;QACpB,CAAC;IACF,CAAC,CAAC,EAAE,CAAC;IACL,iEAAiE;IACjE,kEAAkE;IAClE,mEAAmE;IACnE,gEAAgE;IAChE,8DAA8D;IAC9D,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAErE,MAAM,kBAAkB,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IACnE,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACpD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;YACjB,KAAK,EAAE;gBACN,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,oDAAoD;aAC7D;SACD,CAAC,CAAC;QACH,OAAO;IACR,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,6DAA6D;IAC7D,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,MAAM,eAAe,CACjE,IAAI,EACJ,UAAU,EACV,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,kBAAkB,EAAE,CACjE,CAAC;IAEF,IAAI,CAAC,MAAM,EAAE,aAAa,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,YAAY,GAAG,CAAC,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;YACrD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE;oBACN,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EACN,gFAAgF;iBACjF;aACD,CAAC,CAAC;YACH,OAAO;QACR,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;YACjB,KAAK,EAAE;gBACN,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,MAAM,EAAE,KAAK,IAAI,uBAAuB;aACjD;SACD,CAAC,CAAC;QACH,OAAO;IACR,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IAEzB,4EAA4E;IAC5E,0EAA0E;IAC1E,2EAA2E;IAC3E,kEAAkE;IAClE,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,kBAAkB,CACtC,IAAI,EACJ,IAAI,EACJ,UAAU,EACV,MAAM,EACN,KAAK,CACL,CAAC;QACF,IAAI,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YACrE,OAAO;QACR,CAAC;QAED,yEAAyE;QACzE,wDAAwD;QACxD,IAAI,qBAAqB,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;YACpE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE;oBACN,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,0DAA0D;iBACnE;aACD,CAAC,CAAC;YACH,OAAO;QACR,CAAC;IACF,CAAC;IAED,oDAAoD;IACpD,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;IAClB,MAAM,IAAI,EAAE,CAAC;AACd,CAAC;AAaD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAkB,EAAE,IAAgB;IAC3E,2EAA2E;IAC3E,8EAA8E;IAC9E,gEAAgE;IAChE,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,QAAQ,YAAY,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAEtE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC;IACpC,MAAM,KAAK,GAAU,QAAQ,EAAE,YAAY;QAC1C,CAAC,CAAC,MAAM,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC;QAClC,CAAC,CAAC,QAAQ,CAAC;IAEZ,GAAG,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE;QACxE,KAAK;QACL,QAAQ;KACR,CAAC,CAAC;IACH,MAAM,IAAI,EAAE,CAAC;AACd,CAAC;AAED,sFAAsF;AACtF,SAAS,UAAU,CAClB,GAAkB,EAClB,KAA4D;IAE5D,IAAI,CAAC;QACJ,OAAO,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC;AAED,wFAAwF;AACxF,SAAS,iBAAiB,CAAC,KAAc;IACxC,OAAO,CACN,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,WAAW,IAAI,KAAK;QACpB,UAAU,IAAI,KAAK,CACnB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,mBAAmB,CAAC,GAAkB;IACpD,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACtE,OAAO,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC7E,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,eAAe,CAC7B,IAAiB,EACjB,UAAoB,EACpB,KAKC;IAMD,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC/C,IAAI,MAAM,GAAsB,IAAI,CAAC;IACrC,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,MAAM,YAAY,IAAI,UAAU,EAAE,CAAC;QACvC,IAAI,CAAC;YACJ,IAAI,CAAa,CAAC;YAClB,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;gBAChD,MAAM,iBAAiB,GACtB,QAAQ,IAAI,oBAAoB,CAAC,QAAQ,CAAC;oBACzC,CAAC,CAAC,QAAQ,CAAC,iBAAiB;oBAC5B,CAAC,CAAC,SAAS,CAAC;gBACd,IAAI,iBAAiB,EAAE,CAAC;oBACvB,YAAY,EAAE,CAAC;oBACf,CAAC,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;oBAC5D,+DAA+D;oBAC/D,gEAAgE;oBAChE,IAAI,CAAC,CAAC,IAAI;wBAAE,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACrC,CAAC;qBAAM,CAAC;oBACP,SAAS;gBACV,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,4DAA4D;gBAC5D,+DAA+D;gBAC/D,oEAAoE;gBACpE,MAAM,UAAU,GACf,YAAY,KAAK,SAAS;oBACzB,CAAC,CAAC,MAAM,IAAI,WAAW;oBACvB,CAAC,CAAC,WAAW,IAAI,MAAM,CAAC;gBAC1B,IAAI,CAAC,UAAU;oBAAE,SAAS;gBAC1B,YAAY,EAAE,CAAC;gBACf,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YACjD,CAAC;YACD,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC;gBACrB,MAAM,GAAG,CAAC,CAAC;gBACX,MAAM;YACP,CAAC;YACD,IAAI,CAAC,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC9B,UAAU,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CACZ,sBAAsB,YAAY,4BAA4B,CAAC,CAAC,KAAK,IAAI,eAAe,EAAE,CAC1F,CAAC;YACH,CAAC;QACF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,sEAAsE;YACtE,mEAAmE;YACnE,UAAU,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACZ,sBAAsB,YAAY,0BAA0B,EAC5D,GAAG,CACH,CAAC;QACH,CAAC;IACF,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,kBAAkB,CAChC,IAAiB,EACjB,IAAqC,EACrC,UAAkB,EAClB,MAAuB,EACvB,KAAY;IAEZ,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACtE,MAAM,aAAa,GAAG,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC1D,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC7D,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,wBAAwB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAC7E,CAAC;IACD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,kBAAkB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACvE,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC"}

package/dist/standalone.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"standalone.d.ts","sourceRoot":"","sources":["../src/standalone.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EACN,WAAW,EACX,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAGhD,MAAM,WAAW,MAAM;IACtB,oEAAoE;IACpE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9D,wDAAwD;IACxD,YAAY,CACX,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,QAAQ,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,CAAC,CAAC;IACvB,qDAAqD;IACrD,aAAa,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,mDAAmD;IACnD,OAAO,EAAE,WAAW,CAAC;IACrB,iFAAiF;IACjF,iBAAiB,IAAI,CACpB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,IAAI,EAAE,MAAM,IAAI,KACZ,IAAI,CAAC;CACV;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CA6EzD"}
+{"version":3,"file":"standalone.d.ts","sourceRoot":"","sources":["../src/standalone.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EACN,WAAW,EACX,KAAK,UAAU,EAEf,KAAK,WAAW,EAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAKhD,MAAM,WAAW,MAAM;IACtB,oEAAoE;IACpE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9D,wDAAwD;IACxD,YAAY,CACX,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,QAAQ,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,CAAC,CAAC;IACvB,qDAAqD;IACrD,aAAa,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,mDAAmD;IACnD,OAAO,EAAE,WAAW,CAAC;IACrB,iFAAiF;IACjF,iBAAiB,IAAI,CACpB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,IAAI,EAAE,MAAM,IAAI,KACZ,IAAI,CAAC;CACV;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAuFzD"}

package/dist/standalone.js

@@ -17,15 +17,27 @@
  *   if (!result.authenticated) return res.status(401).json(result)
  */
 import { AuthManager, } from "./AuthManager.js";
+import { ApiKeyStrategy } from "./strategies/ApiKeyStrategy.js";
 import { JwtStrategy } from "./strategies/JwtStrategy.js";
+import { SessionStrategy } from "./strategies/SessionStrategy.js";
 /**
  * Create a standalone Warden instance — no Ream container needed.
  */
 export function createWarden(config) {
+    // Mirror WardenProvider: build EVERY configured strategy, not just jwt —
+    // otherwise config.session / config.apiKey were silently dropped and a
+    // jwt-less config (e.g. { defaultStrategy: 'api-key', apiKey }) threw
+    // INVALID_CONFIG at boot (audit 2026-06-13). Keys match the @Guard names.
     const strategies = {};
     if (config.jwt) {
         strategies.jwt = new JwtStrategy(config.jwt);
     }
+    if (config.session) {
+        strategies.session = new SessionStrategy(config.session);
+    }
+    if (config.apiKey) {
+        strategies["api-key"] = new ApiKeyStrategy(config.apiKey);
+    }
     const manager = new AuthManager({
         defaultStrategy: config.defaultStrategy ?? "jwt",
         strategies,

package/dist/standalone.js.map

@@ -1 +1 @@
-{"version":3,"file":"standalone.js","sourceRoot":"","sources":["../src/standalone.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EACN,WAAW,GAGX,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAsB1D;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,MAAoB;IAChD,MAAM,UAAU,GAAgC,EAAE,CAAC;IAEnD,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;QAChB,UAAU,CAAC,GAAG,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC;QAC/B,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,KAAK;QAChD,UAAU;KACV,CAAC,CAAC;IAEH,OAAO;QACN,MAAM,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC;QAC5D,YAAY,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,EAAE,CACvC,OAAO,CAAC,YAAY,CAAC,WAAW,EAAE,QAAQ,CAAC;QAE5C,KAAK,CAAC,aAAa,CAAC,IAAiB;YACpC,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,CAAgB,CAAC;YACtD,OAAO,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAED,OAAO;QAEP,iBAAiB;YAChB,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;gBACzB,MAAM,OAAO,GAAG,GAAG,CAAC,OAA6C,CAAC;gBAClE,MAAM,UAAU,GAAG,OAAO,EAAE,aAAa,IAAI,EAAE,CAAC;gBAChD,MAAM,KAAK,GACV,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC;oBACjE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;oBACrB,CAAC,CAAC,EAAE,CAAC;gBAEP,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,GAAiE;yBAChE,MAAM,CAAC,GAAG,CAAC;yBACX,IAAI,CAAC;wBACL,KAAK,EAAE;4BACN,IAAI,EAAE,cAAc;4BACpB,OAAO,EAAE,8BAA8B;yBACvC;qBACD,CAAC,CAAC;oBACJ,OAAO;gBACR,CAAC;gBAED,OAAO;qBACL,MAAM,CAAC,KAAK,CAAC;qBACb,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;oBAChB,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;wBAC1C,GAAiE;6BAChE,MAAM,CAAC,GAAG,CAAC;6BACX,IAAI,CAAC;4BACL,KAAK,EAAE;gCACN,IAAI,EAAE,cAAc;gCACpB,OAAO,EAAE,MAAM,CAAC,KAAK,IAAI,uBAAuB;6BAChD;yBACD,CAAC,CAAC;wBACJ,OAAO;oBACR,CAAC;oBACD,iEAAiE;oBACjE,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;oBAClB,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;oBACvB,IAAI,EAAE,CAAC;gBACR,CAAC,CAAC;qBACD,KAAK,CAAC,GAAG,EAAE;oBACV,GAAiE;yBAChE,MAAM,CAAC,GAAG,CAAC;yBACX,IAAI,CAAC;wBACL,KAAK,EAAE;4BACN,IAAI,EAAE,YAAY;4BAClB,OAAO,EAAE,+BAA+B;yBACxC;qBACD,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;YACL,CAAC,CAAC;QACH,CAAC;KACD,CAAC;AACH,CAAC"}
+{"version":3,"file":"standalone.js","sourceRoot":"","sources":["../src/standalone.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EACN,WAAW,GAIX,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAsBlE;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,MAAoB;IAChD,yEAAyE;IACzE,uEAAuE;IACvE,sEAAsE;IACtE,0EAA0E;IAC1E,MAAM,UAAU,GAAiC,EAAE,CAAC;IAEpD,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;QAChB,UAAU,CAAC,GAAG,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,UAAU,CAAC,OAAO,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,UAAU,CAAC,SAAS,CAAC,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC;QAC/B,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,KAAK;QAChD,UAAU;KACV,CAAC,CAAC;IAEH,OAAO;QACN,MAAM,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC;QAC5D,YAAY,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,EAAE,CACvC,OAAO,CAAC,YAAY,CAAC,WAAW,EAAE,QAAQ,CAAC;QAE5C,KAAK,CAAC,aAAa,CAAC,IAAiB;YACpC,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,CAAgB,CAAC;YACtD,OAAO,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAED,OAAO;QAEP,iBAAiB;YAChB,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;gBACzB,MAAM,OAAO,GAAG,GAAG,CAAC,OAA6C,CAAC;gBAClE,MAAM,UAAU,GAAG,OAAO,EAAE,aAAa,IAAI,EAAE,CAAC;gBAChD,MAAM,KAAK,GACV,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC;oBACjE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;oBACrB,CAAC,CAAC,EAAE,CAAC;gBAEP,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,GAAiE;yBAChE,MAAM,CAAC,GAAG,CAAC;yBACX,IAAI,CAAC;wBACL,KAAK,EAAE;4BACN,IAAI,EAAE,cAAc;4BACpB,OAAO,EAAE,8BAA8B;yBACvC;qBACD,CAAC,CAAC;oBACJ,OAAO;gBACR,CAAC;gBAED,OAAO;qBACL,MAAM,CAAC,KAAK,CAAC;qBACb,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;oBAChB,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;wBAC1C,GAAiE;6BAChE,MAAM,CAAC,GAAG,CAAC;6BACX,IAAI,CAAC;4BACL,KAAK,EAAE;gCACN,IAAI,EAAE,cAAc;gCACpB,OAAO,EAAE,MAAM,CAAC,KAAK,IAAI,uBAAuB;6BAChD;yBACD,CAAC,CAAC;wBACJ,OAAO;oBACR,CAAC;oBACD,iEAAiE;oBACjE,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;oBAClB,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;oBACvB,IAAI,EAAE,CAAC;gBACR,CAAC,CAAC;qBACD,KAAK,CAAC,GAAG,EAAE;oBACV,GAAiE;yBAChE,MAAM,CAAC,GAAG,CAAC;yBACX,IAAI,CAAC;wBACL,KAAK,EAAE;4BACN,IAAI,EAAE,YAAY;4BAClB,OAAO,EAAE,+BAA+B;yBACxC;qBACD,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;YACL,CAAC,CAAC;QACH,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/strategies/ApiKeyStrategy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ApiKeyStrategy.d.ts","sourceRoot":"","sources":["../../src/strategies/ApiKeyStrategy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAE/E,MAAM,WAAW,YAAY;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,CACV,GAAG,EAAE,MAAM,KACP,OAAO,CAAC;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CAC9D;AAED,qBAAa,cAAe,YAAW,YAAY;;IAClD,IAAI,SAAa;gBAIL,MAAM,EAAE,YAAY;IAKhC,wDAAwD;IACxD,IAAI,UAAU,IAAI,MAAM,CAEvB;IAEK,YAAY,CAAC,YAAY,EAAE;QAChC,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,UAAU,CAAC;IAMjB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;CAYhD"}
+{"version":3,"file":"ApiKeyStrategy.d.ts","sourceRoot":"","sources":["../../src/strategies/ApiKeyStrategy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAE/E,MAAM,WAAW,YAAY;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,CACV,GAAG,EAAE,MAAM,KACP,OAAO,CAAC;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CAC9D;AAED,qBAAa,cAAe,YAAW,YAAY;;IAClD,IAAI,SAAa;gBAIL,MAAM,EAAE,YAAY;IAKhC,wDAAwD;IACxD,IAAI,UAAU,IAAI,MAAM,CAEvB;IAEK,YAAY,CAAC,YAAY,EAAE;QAChC,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,UAAU,CAAC;IAMjB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;CAyBhD"}

package/dist/strategies/ApiKeyStrategy.js

@@ -26,7 +26,20 @@ export class ApiKeyStrategy {
             return { authenticated: false, error: "Invalid API key" };
         const user = { ...result.user };
         if (result.scopes && result.scopes.length > 0) {
-            // Merge scopes into permissions without mutating source object.
+            // Expose the API key's scopes on `user.permissions` (without mutating
+            // the source object) so APP code can read them via
+            // `ctx.auth.user.permissions`.
+            //
+            // IMPORTANT — these scopes are a SEPARATE axis from the `@Permission`
+            // route gate, by design (Adonis Bouncer parity): the gate flows through
+            // RightsResolver, which resolves grants from the rights STORE and
+            // deliberately ignores payload-carried permissions (see RightsResolver
+            // D1). This mirrors AdonisJS, where token abilities are checked via
+            // `currentAccessToken.allows(scope)` and are NOT consulted by Bouncer
+            // ability/policy checks. So an API key carrying `orders.create` is NOT
+            // auto-granted by `@Permission('orders.create')` — that's intentional,
+            // not a bug. Gate API-key routes on scopes with an explicit app-level
+            // check against `ctx.auth.user.permissions`.
             const merged = new Set([...(user.permissions ?? []), ...result.scopes]);
             user.permissions = [...merged];
         }

package/dist/strategies/ApiKeyStrategy.js.map

@@ -1 +1 @@
-{"version":3,"file":"ApiKeyStrategy.js","sourceRoot":"","sources":["../../src/strategies/ApiKeyStrategy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAWH,MAAM,OAAO,cAAc;IAC1B,IAAI,GAAG,SAAS,CAAC;IACjB,OAAO,CAAe;IACtB,WAAW,CAAS;IAEpB,YAAY,MAAoB;QAC/B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,UAAU,IAAI,WAAW,CAAC;IACrD,CAAC;IAED,wDAAwD;IACxD,IAAI,UAAU;QACb,OAAO,IAAI,CAAC,WAAW,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,YAGlB;QACA,MAAM,IAAI,KAAK,CACd,uFAAuF,CACvF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;QAEvE,MAAM,IAAI,GAAgB,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/C,gEAAgE;YAChE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACxE,IAAI,CAAC,WAAW,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACtC,CAAC;CACD"}
+{"version":3,"file":"ApiKeyStrategy.js","sourceRoot":"","sources":["../../src/strategies/ApiKeyStrategy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAWH,MAAM,OAAO,cAAc;IAC1B,IAAI,GAAG,SAAS,CAAC;IACjB,OAAO,CAAe;IACtB,WAAW,CAAS;IAEpB,YAAY,MAAoB;QAC/B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,UAAU,IAAI,WAAW,CAAC;IACrD,CAAC;IAED,wDAAwD;IACxD,IAAI,UAAU;QACb,OAAO,IAAI,CAAC,WAAW,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,YAGlB;QACA,MAAM,IAAI,KAAK,CACd,uFAAuF,CACvF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;QAEvE,MAAM,IAAI,GAAgB,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/C,sEAAsE;YACtE,mDAAmD;YACnD,+BAA+B;YAC/B,EAAE;YACF,sEAAsE;YACtE,wEAAwE;YACxE,kEAAkE;YAClE,uEAAuE;YACvE,oEAAoE;YACpE,sEAAsE;YACtE,uEAAuE;YACvE,uEAAuE;YACvE,sEAAsE;YACtE,6CAA6C;YAC7C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACxE,IAAI,CAAC,WAAW,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACtC,CAAC;CACD"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@c9up/warden",
-  "version": "0.1.4",
-  "description": "Warden — Authentication for the Ream framework",
+  "version": "0.1.6",
+  "description": "Warden — Authentication & authorization for the Ream framework",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",

package/src/Guard.ts

@@ -13,6 +13,7 @@ import "reflect-metadata";
 const GUARD_KEY = Symbol.for("warden:guard");
 const PERMISSION_KEY = Symbol.for("warden:permission");
 const ROLE_KEY = Symbol.for("warden:role");
+const MFA_KEY = Symbol.for("warden:mfa");
 
 /**
  * @Guard('jwt') — require authentication via the named strategy.
@@ -66,3 +67,23 @@ export function getRoleMetadata(
 ): string[] {
 	return Reflect.getOwnMetadata(ROLE_KEY, target, propertyKey) ?? [];
 }
+
+/**
+ * @RequireMfa() — require the authenticated user to have completed multi-factor
+ * authentication. The auth middleware rejects with 403 `MFA_REQUIRED` when the
+ * user payload lacks a truthy `mfa` claim (set by your MFA step-up flow once
+ * `MfaManager.verify()` succeeds).
+ */
+export function RequireMfa(): MethodDecorator {
+	return (target, propertyKey) => {
+		Reflect.defineMetadata(MFA_KEY, true, target, propertyKey);
+	};
+}
+
+/** Whether the route requires completed MFA. */
+export function getRequireMfaMetadata(
+	target: object,
+	propertyKey: string | symbol,
+): boolean {
+	return Reflect.getOwnMetadata(MFA_KEY, target, propertyKey) ?? false;
+}

package/src/RedisBlacklistDriver.ts

@@ -0,0 +1,60 @@
+/**
+ * RedisBlacklistDriver — a persistent JWT blacklist backed by Redis / KeyDB,
+ * so logout revocation survives a process restart (unlike MemoryBlacklistDriver).
+ *
+ * Agnostic by construction: it depends on no Redis package. The caller injects
+ * any ioredis-compatible client (KeyDB, Redis, a mock…) that exposes `set` with
+ * an `"EX"` ttl and `exists`. Native key expiry does the housekeeping, so
+ * `cleanup()` is a no-op.
+ */
+
+import type { BlacklistDriver } from "./TokenBlacklist.js";
+
+/** The minimal ioredis-shaped surface this driver needs. */
+export interface RedisLikeClient {
+	set(
+		key: string,
+		value: string,
+		mode: "EX",
+		ttlSeconds: number,
+	): Promise<unknown>;
+	exists(key: string): Promise<number>;
+}
+
+export interface RedisBlacklistConfig {
+	/** Key prefix for blacklist entries. Default `warden:blacklist:`. */
+	prefix?: string;
+}
+
+export class RedisBlacklistDriver implements BlacklistDriver {
+	readonly #client: RedisLikeClient;
+	readonly #prefix: string;
+
+	constructor(client: RedisLikeClient, config: RedisBlacklistConfig = {}) {
+		this.#client = client;
+		this.#prefix = config.prefix ?? "warden:blacklist:";
+	}
+
+	/**
+	 * Blacklist a JTI until its natural expiry. Tokens already past `expiresAt`
+	 * are skipped — there is nothing left to revoke.
+	 */
+	async add(jti: string, expiresAt: number): Promise<void> {
+		const ttlSeconds = Math.ceil((expiresAt - Date.now()) / 1000);
+		if (ttlSeconds <= 0) {
+			return;
+		}
+		await this.#client.set(this.#key(jti), "1", "EX", ttlSeconds);
+	}
+
+	async has(jti: string): Promise<boolean> {
+		return (await this.#client.exists(this.#key(jti))) > 0;
+	}
+
+	/** No-op: Redis/KeyDB evicts expired keys on its own. */
+	async cleanup(): Promise<void> {}
+
+	#key(jti: string): string {
+		return `${this.#prefix}${jti}`;
+	}
+}

package/src/ResilientBlacklistDriver.ts

@@ -0,0 +1,84 @@
+/**
+ * ResilientBlacklistDriver — wraps a primary blacklist (e.g. KeyDB-backed
+ * `RedisBlacklistDriver`) with an in-memory fallback so a cache outage never
+ * takes the whole app down.
+ *
+ * Policy (fail-open on reads):
+ *   - `add()`  — if the primary throws, the revocation is recorded in the
+ *                fallback so logout stays effective on this instance.
+ *   - `has()`  — if the primary throws, consult the fallback: a token revoked
+ *                during the outage is still caught here; anything else is
+ *                allowed through (fail-open). Access tokens are short-lived, so
+ *                the window a missed revocation survives is bounded by the token
+ *                TTL — the blacklist is defense-in-depth above expiry, not the
+ *                primary boundary.
+ *
+ * Every degradation invokes `onDegrade` (defaults to a stderr warning) so the
+ * outage is observable.
+ */
+
+import {
+	type BlacklistDriver,
+	MemoryBlacklistDriver,
+} from "./TokenBlacklist.js";
+
+export interface BlacklistDegradeEvent {
+	op: "add" | "has" | "cleanup";
+	error: unknown;
+}
+
+export interface ResilientBlacklistConfig {
+	/** Invoked whenever the primary driver fails and the fallback is used. */
+	onDegrade?: (event: BlacklistDegradeEvent) => void;
+}
+
+function defaultOnDegrade({ op, error }: BlacklistDegradeEvent): void {
+	console.warn(
+		`[warden] blacklist primary failed on ${op}; using in-memory fallback:`,
+		error,
+	);
+}
+
+export class ResilientBlacklistDriver implements BlacklistDriver {
+	readonly #primary: BlacklistDriver;
+	readonly #fallback: BlacklistDriver;
+	readonly #onDegrade: (event: BlacklistDegradeEvent) => void;
+
+	constructor(
+		primary: BlacklistDriver,
+		fallback: BlacklistDriver = new MemoryBlacklistDriver(),
+		config: ResilientBlacklistConfig = {},
+	) {
+		this.#primary = primary;
+		this.#fallback = fallback;
+		this.#onDegrade = config.onDegrade ?? defaultOnDegrade;
+	}
+
+	async add(jti: string, expiresAt: number): Promise<void> {
+		try {
+			await this.#primary.add(jti, expiresAt);
+		} catch (error) {
+			this.#onDegrade({ op: "add", error });
+			await this.#fallback.add(jti, expiresAt);
+		}
+	}
+
+	async has(jti: string): Promise<boolean> {
+		try {
+			return await this.#primary.has(jti);
+		} catch (error) {
+			this.#onDegrade({ op: "has", error });
+			// Fail-open: honour in-outage revocations on this instance, allow rest.
+			return this.#fallback.has(jti);
+		}
+	}
+
+	async cleanup(): Promise<void> {
+		try {
+			await this.#primary.cleanup?.();
+		} catch (error) {
+			this.#onDegrade({ op: "cleanup", error });
+		}
+		await this.#fallback.cleanup?.();
+	}
+}

package/src/TokenBlacklist.ts

@@ -9,7 +9,11 @@
 export interface BlacklistDriver {
 	add(jti: string, expiresAt: number): Promise<void>;
 	has(jti: string): Promise<boolean>;
-	cleanup(): Promise<void>;
+	/**
+	 * Reap expired entries. Optional: TTL-backed stores (Redis/KeyDB) expire keys
+	 * themselves and have nothing to sweep, so they may omit this.
+	 */
+	cleanup?(): Promise<void>;
 }
 
 /** In-memory blacklist for development. */
@@ -51,8 +55,8 @@ export class TokenBlacklist {
 		return this.driver.has(jti);
 	}
 
-	/** Remove expired entries. */
+	/** Remove expired entries (no-op when the driver self-expires via TTL). */
 	async cleanup(): Promise<void> {
-		return this.driver.cleanup();
+		await this.driver.cleanup?.();
 	}
 }

package/src/WardenProvider.ts

@@ -1,10 +1,14 @@
-import { AuthManager } from "./AuthManager.js";
+import { AuthManager, type AuthStrategy } from "./AuthManager.js";
 import type { WardenConfig } from "./config.js";
 import { WardenError } from "./errors.js";
+import { MfaManager } from "./mfa/MfaManager.js";
+import type { BouncerRegistry } from "./middleware.js";
 import { MemoryRightsStore } from "./rights/MemoryRightsStore.js";
 import { RightsResolver } from "./rights/RightsResolver.js";
 import { setAuth } from "./services/main.js";
+import { ApiKeyStrategy } from "./strategies/ApiKeyStrategy.js";
 import { JwtStrategy } from "./strategies/JwtStrategy.js";
+import { SessionStrategy } from "./strategies/SessionStrategy.js";
 
 interface WardenContainer {
 	singleton(token: unknown, factory: () => unknown): void;
@@ -35,15 +39,34 @@ export default class WardenProvider {
 		// AuthManager with `strategies: {}` and `defaultStrategy: 'jwt'`,
 		// passing the (then-permissive) constructor and erroring deep in the
 		// middleware loop.
-		if (!config?.jwt) {
+		if (!config?.jwt && !config?.session && !config?.apiKey) {
 			throw new WardenError(
 				"WARDEN_NO_AUTH_CONFIG",
-				`@c9up/warden: no authentication strategies configured. Set config.warden.auth.jwt (or another strategy) in your reamrc.ts before registering WardenProvider.`,
+				`@c9up/warden: no authentication strategies configured. Set at least one of config.warden.auth.jwt / .session / .apiKey in your reamrc.ts before registering WardenProvider.`,
 			);
 		}
 
-		const jwt = new JwtStrategy(config.jwt);
-		this.app.container.singleton(JwtStrategy, () => jwt);
+		// Build the strategy table from whatever the app configured. Each strategy
+		// is also exposed by its class token (mirrors the jwt convention) so apps
+		// can resolve a specific one. The `revoke()` blacklist flows through
+		// `config.jwt.blacklist` into JwtStrategy.
+		const strategies: Record<string, AuthStrategy> = {};
+
+		if (config.jwt) {
+			const jwt = new JwtStrategy(config.jwt);
+			this.app.container.singleton(JwtStrategy, () => jwt);
+			strategies.jwt = jwt;
+		}
+		if (config.session) {
+			const session = new SessionStrategy(config.session);
+			this.app.container.singleton(SessionStrategy, () => session);
+			strategies.session = session;
+		}
+		if (config.apiKey) {
+			const apiKey = new ApiKeyStrategy(config.apiKey);
+			this.app.container.singleton(ApiKeyStrategy, () => apiKey);
+			strategies["api-key"] = apiKey;
+		}
 
 		// Rights layer (Epic 56): one resolver singleton backs BOTH the coarse
 		// RBAC helpers (injected into AuthManager below) and — once 56.6 lands —
@@ -59,10 +82,23 @@ export default class WardenProvider {
 			this.app.container.singleton(MemoryRightsStore, () => rightsStore);
 		}
 
+		// Bouncer registry (Epic 56.6): the abilities/policies/scope-resolver the
+		// per-request `initializeBouncer` middleware builds each `ctx.bouncer`
+		// from. Registered (even when empty) under a string token so the agnostic
+		// middleware resolves it by name, mirroring the "auth" alias above.
+		const bouncerRegistry: BouncerRegistry = {
+			abilities: config.abilities ?? {},
+			policies: config.policies ?? {},
+			resolveScope: config.resolveScope,
+		};
+		this.app.container.singleton("bouncer:registry", () => bouncerRegistry);
+
+		// Default to the configured strategy, else the first one registered.
+		const defaultStrategy =
+			config.defaultStrategy ?? Object.keys(strategies)[0];
 		this.app.container.singleton(AuthManager, () => {
-			const strategies: Record<string, JwtStrategy> = { jwt };
 			return new AuthManager({
-				defaultStrategy: config.defaultStrategy ?? "jwt",
+				defaultStrategy,
 				strategies,
 				rights: rightsResolver,
 			});
@@ -76,6 +112,16 @@ export default class WardenProvider {
 		this.app.container.singleton("auth", () =>
 			this.app.container.resolve(AuthManager),
 		);
+
+		// MFA (optional): the app builds an MfaManager with its persistent stores
+		// + providers and passes it via config.mfa. Registered by class and under
+		// the "mfa" string alias (same convention as "auth") so controllers and
+		// agnostic consumers can resolve it.
+		const mfa = config.mfa?.manager;
+		if (mfa) {
+			this.app.container.singleton(MfaManager, () => mfa);
+			this.app.container.singleton("mfa", () => mfa);
+		}
 	}
 
 	async boot() {