@gate-forge/pack-auth 0.1.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 UKD
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,113 @@
+# `@gate-forge/pack-auth`
+
+Authorization contract pack. Pure TypeScript detector (no subprocess) that discovers role-guard patterns across four frameworks and emits `auth.resource` entries with role + tenancy attributes.
+
+## Detected frameworks
+
+| Framework | Detection signal                                                                                    |
+| --------- | --------------------------------------------------------------------------------------------------- |
+| NestJS    | `@Controller()` class with `@UseGuards(...)` + `@Roles('admin', ...)` + `@Get/Post/Put/Patch/Delete` |
+| Express   | `app.METHOD(path, mw, ...)` / `router.METHOD(path, mw, ...)` where `mw` reads `req.user.role`       |
+| Fastify   | `fastify.METHOD(path, { preHandler }, handler)` whose `preHandler` reads `request.user.role`        |
+| Hono      | `app.METHOD(path, mw, ...)` where `mw` reads `c.var.user.role` or `c.get('user')`                   |
+
+Each guarded endpoint becomes one resource:
+
+```
+{
+  id: "auth.billing.post-refund",
+  kind: "auth.resource",
+  source: "src/billing.controller.ts",
+  location: { file, line, col },
+  detectorVersion: "0.1.0",
+  attributes: {
+    framework: "nestjs" | "express" | "fastify" | "hono",
+    path: "/billing/refund",
+    httpMethods: ["POST"],
+    roleRequirement: ["admin", "finance"],
+    tenancy: true | false
+  }
+}
+```
+
+Resource ids follow the grammar `auth.<area>.<verb>-<endpoint>`; the area is the first path segment, the verb is the lowercased HTTP method.
+
+## Obligation contract vocabulary
+
+Defined in `src/obligations.ts` and re-exported as `AUTH_OBLIGATION_CONTRACTS`. Obligation ids are `<resourceId>:<contract>` per the engine's id grammar.
+
+| Contract                       | Meaning                                                                                                |
+| ------------------------------ | ------------------------------------------------------------------------------------------------------ |
+| `auth:role-allowed`            | Caller with a role in `roleRequirement` receives a 2xx response                                          |
+| `auth:role-denied`             | Caller without a matching role receives 401/403                                                         |
+| `auth:tenant-isolated`         | Caller with the right role but wrong tenant receives 403 (when `tenancy: true`)                         |
+| `auth:denied-no-side-effect`   | Denied requests do not mutate the resource (post-deny GET shows the row unchanged/missing)             |
+| `auth:forged-token-rejected`   | Forged JWT (bad signature, expired, malformed, missing) returns 401                                    |
+
+## Findings
+
+| Code                  | Meaning                                                                                     |
+| --------------------- | ------------------------------------------------------------------------------------------- |
+| `AMBIGUOUS_GUARD`     | A `@Roles()` decorator uses non-literal arguments (e.g. `@Roles(...ALLOWED)`)               |
+| `DUPLICATE_RESOURCE_ID` | Two declarations produce the same `auth.<area>.<verb>-<endpoint>` id                       |
+| `PARSE_ERROR`         | File could not be read for scanning                                                         |
+
+## Entity adapter schema
+
+The pack ships `src/adapter-schema.ts` (mirror of `@gate-forge/pack-sqlalchemy`'s adapter contract) so billing resources can be witnessed GET-only. The example auth server emits `x-gateforge-env: example-auth-v1` on every response; the adapter's `environmentFingerprint` must equal that value.
+
+```js
+// .gateforge/adapters/auth.billing.refund.mjs
+export default {
+  resourceId: 'auth.billing.refund',
+  read: async (ctx, id) => fetch(`${ctx.baseUrl}/billing/refund/${id}`, { headers: ctx.headers ?? {} }),
+  normalize: (body) => ({ entityId: body.id, fields: { id: body.id, status: body.status, tenant_id: body.tenant_id } }),
+  deletion: 'archive',
+  environmentFingerprint: 'example-auth-v1',
+};
+```
+
+## Example server
+
+`example/auth/server.js` — zero-dependency node:http server on port `3001`:
+
+- `POST /billing/refund` guarded by role (`admin`) AND tenant match; creates an in-memory row.
+- `GET  /billing/refund/:id` returns the row (404 if absent; 403 cross-tenant).
+- All responses carry `x-gateforge-env: example-auth-v1`.
+
+Run it:
+
+```
+node example/auth/server.js
+# → gateforge auth example server listening on http://127.0.0.1:3001
+```
+
+## Tests
+
+```
+cd packages/pack-auth
+npx tsc --noEmit   # typecheck
+npx vitest run     # unit + e2e
+```
+
+The e2e suite boots the server on an OS-assigned free port, exercises all five obligation contracts, and includes two adversarial tests:
+
+1. `fake-green: role-denied with 200` — vitest must reject (server returns 403).
+2. `fake-green: no-side-effect without post-deny GET` — companion assertion in the positive suite proves the GET probe is required.
+
+## Use as a CLI plugin
+
+```yaml
+# .gateforge.yml
+plugins:
+  - id: gateforge.pack-auth
+    version: 0.1.0
+    transport: in-process
+    module: '@gate-forge/pack-auth'
+```
+
+## Limitations
+
+- Python sources are out of scope (TS-only per brief).
+- Dynamic role sets (e.g. `@Roles(...ALLOWED)`) surface as `AMBIGUOUS_GUARD` and never become resources; users must lift them to literals.
+- The regex detector does not run a TS compiler; framework-specific syntax must match the documented signal exactly (decorator order, option-block shape, etc.).

package/dist/adapter-schema.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Entity-adapter schema for the auth pack.
+ *
+ * The auth pack follows the same adapter contract as
+ * `@gate-forge/pack-sqlalchemy` (interface pin #8): adapters are reviewed
+ * engine-side modules whose default export executes GET-only reads
+ * against the target resource. The witness service loads
+ * `.gateforge/adapters/<resourceId>.mjs` and calls `read(ctx, id)` when
+ * a test asks for persistence evidence; the raw adapter response is
+ * never returned to the test process — only the `verdictRelevant`
+ * projection is.
+ *
+ * Why the auth pack needs an adapter at all: `auth:denied-no-side-effect`
+ * is proven by issuing the denied request, then reading the target
+ * entity via this adapter and comparing fields. The adapter gives the
+ * engine a trusted, GET-only read against a real production-shape
+ * surface — never the test process's view of state.
+ *
+ * The pack exports `AuthEntityAdapterSchema` + `validateAuthEntityAdapter`
+ * for fail-closed validation of an adapter module's default export.
+ *
+ * The pack's example adapter targets `example.billing.refund`: a single
+ * resource id bound to the auth example server's billing record.
+ */
+import { z } from 'zod';
+/** The evidence shape `normalize` must return. */
+export interface NormalizedAuthEntity {
+    /** The entity id (column-keyed from the raw body). */
+    entityId: string;
+    /** Projected fields the obligation's `expectFields` can match. */
+    fields: Record<string, unknown>;
+}
+/** Context handed to `read` by the witness service. */
+export interface AuthAdapterContext {
+    /** Base URL of the target environment (loopback, trusted). */
+    baseUrl: string;
+    /** Per-request headers (e.g. the run token for authenticity). */
+    headers?: Record<string, string>;
+}
+/** The frozen adapter module contract (pin #8, mirrored). */
+export interface AuthEntityAdapter {
+    resourceId: string;
+    read(ctx: AuthAdapterContext, id: string): Promise<unknown>;
+    normalize(body: unknown): NormalizedAuthEntity;
+    deletion: 'hard' | 'archive';
+    environmentFingerprint: string;
+}
+/**
+ * Zod schema for the data fields of an adapter module (functions are
+ * checked by {@link validateAuthEntityAdapter} for a single-cause
+ * diagnostic list; zod function schemas would blur the message).
+ */
+export declare const AuthEntityAdapterSchema: z.ZodObject<{
+    resourceId: z.ZodString;
+    deletion: z.ZodEnum<{
+        hard: "hard";
+        archive: "archive";
+    }>;
+    environmentFingerprint: z.ZodString;
+    read: z.ZodUnknown;
+    normalize: z.ZodUnknown;
+}, z.core.$strict>;
+/** Outcome of {@link validateAuthEntityAdapter}. */
+export type AuthEntityAdapterValidation = {
+    ok: true;
+    adapter: AuthEntityAdapter;
+} | {
+    ok: false;
+    issues: string[];
+};
+/**
+ * Validates an adapter module against the frozen contract, failing
+ * closed with one issue per violated field.
+ *
+ * Args:
+ *   value: The default export of an `.mjs` adapter module.
+ *
+ * Returns:
+ *   AuthEntityAdapterValidation: The typed adapter, or every issue found.
+ */
+export declare function validateAuthEntityAdapter(value: unknown): AuthEntityAdapterValidation;
+//# sourceMappingURL=adapter-schema.d.ts.map

package/dist/adapter-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter-schema.d.ts","sourceRoot":"","sources":["../src/adapter-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,kDAAkD;AAClD,MAAM,WAAW,oBAAoB;IACnC,sDAAsD;IACtD,QAAQ,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED,uDAAuD;AACvD,MAAM,WAAW,kBAAkB;IACjC,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,6DAA6D;AAC7D,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,GAAG,EAAE,kBAAkB,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5D,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,oBAAoB,CAAC;IAC/C,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,sBAAsB,EAAE,MAAM,CAAC;CAChC;AAED;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;kBAQzB,CAAC;AAEZ,oDAAoD;AACpD,MAAM,MAAM,2BAA2B,GACnC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,iBAAiB,CAAA;CAAE,GACxC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEpC;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,2BAA2B,CAkBrF"}

package/dist/adapter-schema.js

@@ -0,0 +1,70 @@
+/**
+ * Entity-adapter schema for the auth pack.
+ *
+ * The auth pack follows the same adapter contract as
+ * `@gate-forge/pack-sqlalchemy` (interface pin #8): adapters are reviewed
+ * engine-side modules whose default export executes GET-only reads
+ * against the target resource. The witness service loads
+ * `.gateforge/adapters/<resourceId>.mjs` and calls `read(ctx, id)` when
+ * a test asks for persistence evidence; the raw adapter response is
+ * never returned to the test process — only the `verdictRelevant`
+ * projection is.
+ *
+ * Why the auth pack needs an adapter at all: `auth:denied-no-side-effect`
+ * is proven by issuing the denied request, then reading the target
+ * entity via this adapter and comparing fields. The adapter gives the
+ * engine a trusted, GET-only read against a real production-shape
+ * surface — never the test process's view of state.
+ *
+ * The pack exports `AuthEntityAdapterSchema` + `validateAuthEntityAdapter`
+ * for fail-closed validation of an adapter module's default export.
+ *
+ * The pack's example adapter targets `example.billing.refund`: a single
+ * resource id bound to the auth example server's billing record.
+ */
+import { z } from 'zod';
+/**
+ * Zod schema for the data fields of an adapter module (functions are
+ * checked by {@link validateAuthEntityAdapter} for a single-cause
+ * diagnostic list; zod function schemas would blur the message).
+ */
+export const AuthEntityAdapterSchema = z
+    .object({
+    resourceId: z.string().min(1),
+    deletion: z.enum(['hard', 'archive']),
+    environmentFingerprint: z.string().min(1),
+    read: z.unknown(),
+    normalize: z.unknown(),
+})
+    .strict();
+/**
+ * Validates an adapter module against the frozen contract, failing
+ * closed with one issue per violated field.
+ *
+ * Args:
+ *   value: The default export of an `.mjs` adapter module.
+ *
+ * Returns:
+ *   AuthEntityAdapterValidation: The typed adapter, or every issue found.
+ */
+export function validateAuthEntityAdapter(value) {
+    const parsed = AuthEntityAdapterSchema.safeParse(value);
+    if (!parsed.success) {
+        return {
+            ok: false,
+            issues: parsed.error.issues.map((issue) => `${issue.path.join('.')}: ${issue.message}`),
+        };
+    }
+    const candidate = value;
+    const issues = [];
+    if (typeof candidate.read !== 'function') {
+        issues.push('read: must be a function (ctx, id) => Promise<unknown>');
+    }
+    if (typeof candidate.normalize !== 'function') {
+        issues.push('normalize: must be a function (body) => { entityId, fields }');
+    }
+    if (issues.length > 0)
+        return { ok: false, issues };
+    return { ok: true, adapter: value };
+}
+//# sourceMappingURL=adapter-schema.js.map

package/dist/adapter-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter-schema.js","sourceRoot":"","sources":["../src/adapter-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA2BxB;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACrC,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;CACvB,CAAC;KACD,MAAM,EAAE,CAAC;AAOZ;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;SACxF,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,KAAmC,CAAC;IACtD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAO,SAAS,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,OAAO,SAAS,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACpD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAA0B,EAAE,CAAC;AAC3D,CAAC"}

package/dist/detector.d.ts

@@ -0,0 +1,26 @@
+import type { DiscoveryOutcome } from '@gate-forge/plugin-protocol';
+/** Detector contract: `discover(paths)` is sync (pure over file bytes). */
+export interface AuthDetector {
+    discover(paths: readonly string[]): DiscoveryOutcome;
+}
+/** Options for {@link createAuthDetector}. */
+export interface AuthDetectorOptions {
+    /** Repo root for repo-relative `source` paths (default: `process.cwd()`). */
+    root?: string;
+}
+/** Detected framework for a resource. */
+export type AuthFramework = 'nestjs' | 'express' | 'fastify' | 'hono';
+/** Tenancy classification for one endpoint. */
+export type Tenancy = 'tenant-bound' | 'none';
+/**
+ * Creates the discover-capable detector module. The default export of
+ * the pack is `createAuthDetector()` — the CLI in-process contract.
+ *
+ * Args:
+ *   options: Optional root override for repo-relative `source` paths.
+ *
+ * Returns:
+ *   AuthDetector: the pinned `{ discover(paths) }` module.
+ */
+export declare function createAuthDetector(options?: AuthDetectorOptions): AuthDetector;
+//# sourceMappingURL=detector.d.ts.map

package/dist/detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detector.d.ts","sourceRoot":"","sources":["../src/detector.ts"],"names":[],"mappings":"AAuCA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAQpE,2EAA2E;AAC3E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,gBAAgB,CAAC;CACtD;AAED,8CAA8C;AAC9C,MAAM,WAAW,mBAAmB;IAClC,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,yCAAyC;AACzC,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC;AAEtE,+CAA+C;AAC/C,MAAM,MAAM,OAAO,GAAG,cAAc,GAAG,MAAM,CAAC;AAub9C;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,mBAAwB,GAAG,YAAY,CA+FlF"}