@ontrails/permits 1.0.0-beta.12

package/.turbo/turbo-build.log

@@ -0,0 +1 @@
+$ tsc -b

package/.turbo/turbo-lint.log

@@ -0,0 +1,3 @@
+$ oxlint ./src
+Found 0 warnings and 0 errors.
+Finished in 44ms on 18 files with 93 rules using 24 threads.

package/.turbo/turbo-typecheck.log

@@ -0,0 +1 @@
+$ tsc --noEmit

package/CHANGELOG.md

@@ -0,0 +1,19 @@
+# @ontrails/permits
+
+## 1.0.0-beta.12
+
+### Minor Changes
+
+- Complete trifecta for config, permits, and crumbs (formerly tracks)
+
+  - **config**: Add `configService`, `config.layer`, `config.trail`, and `config.workspace` trails with full `defineConfig`, `resolve`, `describe`, `explain`, `doctor`, and code generation support
+  - **permits**: Add `authService` and `auth.verify` trail for runtime authorization checks
+  - **crumbs**: Rename tracks to crumbs; add `crumbsService` and `crumbs.status` trail for structured event tracking
+  - **cli**: Fix build flag handling and improve bootstrap scaffolding
+  - **testing**: Expand test context helpers and example-based testing utilities
+  - **core/mcp/http**: Internal alignment for service and composition updates
+
+### Patch Changes
+
+- Updated dependencies
+  - @ontrails/core@1.0.0-beta.12

package/dist/adapter.d.ts

@@ -0,0 +1,26 @@
+import type { Result } from '@ontrails/core';
+import type { PermitExtractionInput } from './extraction.js';
+import type { Permit } from './permit.js';
+/**
+ * @deprecated Use {@link PermitExtractionInput} instead. Kept as an alias
+ * for backward compatibility during migration.
+ */
+export type AuthCredentials = PermitExtractionInput;
+/** Errors from auth adapters. */
+export interface AuthError {
+    readonly code: 'expired_token' | 'insufficient_scope' | 'invalid_token' | 'missing_credentials';
+    readonly message: string;
+}
+/**
+ * Auth adapter port. Given extraction input, produce a permit or an error.
+ *
+ * The adapter receives the full {@link PermitExtractionInput} — surface,
+ * headers, requestId, and credential fields — so it can make richer
+ * decisions (e.g., rate-limit by surface or correlate via requestId).
+ *
+ * Deliberately narrow — no session management, no token refresh.
+ */
+export interface AuthAdapter {
+    readonly authenticate: (input: PermitExtractionInput) => Promise<Result<Permit | null, AuthError>>;
+}
+//# sourceMappingURL=adapter.d.ts.map

package/dist/adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAE7C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAEpD,iCAAiC;AACjC,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EACT,eAAe,GACf,oBAAoB,GACpB,eAAe,GACf,qBAAqB,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,YAAY,EAAE,CACrB,KAAK,EAAE,qBAAqB,KACzB,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;CAChD"}

package/dist/adapter.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=adapter.js.map

package/dist/adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.js","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":""}

package/dist/adapters/jwt.d.ts

@@ -0,0 +1,25 @@
+import type { AuthAdapter } from '../adapter.js';
+/** Configuration for the JWT auth adapter. */
+export interface JwtAdapterOptions {
+    /** HMAC secret for HS256 verification. */
+    readonly secret?: string;
+    /** JWKS endpoint for RS256/ES256 (not yet implemented). */
+    readonly jwksUrl?: string;
+    /** Expected issuer claim. */
+    readonly issuer?: string;
+    /** Expected audience claim. */
+    readonly audience?: string;
+    /** Claim containing scopes (default: 'scope'). */
+    readonly scopesClaim?: string;
+    /** Claim containing roles (default: 'roles'). */
+    readonly rolesClaim?: string;
+}
+/**
+ * Create a JWT auth adapter using Bun's native crypto.
+ *
+ * Verifies HS256-signed JWTs, extracts claims into a Permit, and checks
+ * issuer/audience when configured. Returns `Result.ok(null)` when no
+ * credentials are provided.
+ */
+export declare const createJwtAdapter: (options: JwtAdapterOptions) => AuthAdapter;
+//# sourceMappingURL=jwt.d.ts.map

package/dist/adapters/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../src/adapters/jwt.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAa,MAAM,eAAe,CAAC;AAI5D,8CAA8C;AAC9C,MAAM,WAAW,iBAAiB;IAChC,0CAA0C;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,2DAA2D;IAC3D,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,6BAA6B;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,+BAA+B;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,kDAAkD;IAClD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,iDAAiD;IACjD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AA2LD;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,GAAI,SAAS,iBAAiB,KAAG,WAe7D,CAAC"}

package/dist/adapters/jwt.js

@@ -0,0 +1,148 @@
+import { Result } from '@ontrails/core';
+// ---------------------------------------------------------------------------
+// Helpers (defined before callers)
+// ---------------------------------------------------------------------------
+const authErr = (code, message) => Result.err({ code, message });
+/** Base64url-decode a string to bytes. */
+const base64urlDecode = (input) => {
+    const padded = input
+        .replaceAll('-', '+')
+        .replaceAll('_', '/')
+        .padEnd(input.length + ((4 - (input.length % 4)) % 4), '=');
+    const binary = atob(padded);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i += 1) {
+        bytes[i] = binary.codePointAt(i) ?? 0;
+    }
+    return bytes;
+};
+/** Decode a JWT payload without verifying the signature. */
+const decodePayload = (token) => {
+    const parts = token.split('.');
+    if (parts.length !== 3) {
+        return undefined;
+    }
+    try {
+        const json = new TextDecoder().decode(base64urlDecode(parts[1] ?? ''));
+        return JSON.parse(json);
+    }
+    catch {
+        return undefined;
+    }
+};
+/** Import a secret as an HMAC CryptoKey. */
+const importHmacKey = (secret) => {
+    const encoder = new TextEncoder();
+    return crypto.subtle.importKey('raw', encoder.encode(secret), { hash: 'SHA-256', name: 'HMAC' }, false, ['verify']);
+};
+/** Verify the HMAC-SHA256 signature of a JWT. */
+const verifyHmacSignature = (token, key) => {
+    const lastDot = token.lastIndexOf('.');
+    if (lastDot === -1) {
+        return Promise.resolve(false);
+    }
+    const data = token.slice(0, lastDot);
+    const signature = base64urlDecode(token.slice(lastDot + 1));
+    const encoder = new TextEncoder();
+    return crypto.subtle.verify('HMAC', key, signature.buffer, encoder.encode(data));
+};
+/** Validate standard claims (exp, iss, aud). */
+const validateClaims = (payload, options) => {
+    if (payload.exp !== undefined &&
+        payload.exp < Math.floor(Date.now() / 1000)) {
+        return { code: 'expired_token', message: 'Token has expired' };
+    }
+    if (options.issuer && payload.iss !== options.issuer) {
+        return { code: 'invalid_token', message: 'Issuer mismatch' };
+    }
+    if (options.audience) {
+        const { aud } = payload;
+        const matches = Array.isArray(aud)
+            ? aud.includes(options.audience)
+            : aud === options.audience;
+        if (!matches) {
+            return { code: 'invalid_token', message: 'Audience mismatch' };
+        }
+    }
+    return undefined;
+};
+/** Extract scopes from a payload claim (space-separated string or array). */
+const extractScopes = (payload, claim) => {
+    const raw = payload[claim];
+    if (typeof raw === 'string') {
+        return raw.split(' ').filter(Boolean);
+    }
+    if (Array.isArray(raw)) {
+        return raw.filter((s) => typeof s === 'string' && s.length > 0);
+    }
+    return [];
+};
+/** Extract roles from a payload claim (string array). */
+const extractRoles = (payload, claim) => {
+    const raw = payload[claim];
+    if (!Array.isArray(raw)) {
+        return undefined;
+    }
+    return raw.filter((r) => typeof r === 'string');
+};
+/** Build a Permit from a validated JWT payload. */
+const buildPermit = (payload, options) => {
+    if (!payload.sub) {
+        return authErr('invalid_token', 'Missing subject claim (sub)');
+    }
+    const roles = extractRoles(payload, options.rolesClaim ?? 'roles');
+    return Result.ok({
+        id: payload.sub,
+        scopes: extractScopes(payload, options.scopesClaim ?? 'scope'),
+        ...(roles ? { roles } : {}),
+    });
+};
+/** Verify the signature and return the decoded payload, or an error. */
+const decodeAndVerify = async (token, secret) => {
+    const payload = decodePayload(token);
+    if (!payload) {
+        return authErr('invalid_token', 'Malformed JWT');
+    }
+    try {
+        const key = await importHmacKey(secret);
+        const valid = await verifyHmacSignature(token, key);
+        return valid
+            ? Result.ok(payload)
+            : authErr('invalid_token', 'Invalid signature');
+    }
+    catch {
+        return authErr('invalid_token', 'Malformed token signature');
+    }
+};
+/** Validate claims and build a permit from a verified payload. */
+const payloadToPermit = (payload, options) => {
+    const claimError = validateClaims(payload, options);
+    if (claimError) {
+        return Result.err(claimError);
+    }
+    return buildPermit(payload, options);
+};
+// ---------------------------------------------------------------------------
+// Factory
+// ---------------------------------------------------------------------------
+/**
+ * Create a JWT auth adapter using Bun's native crypto.
+ *
+ * Verifies HS256-signed JWTs, extracts claims into a Permit, and checks
+ * issuer/audience when configured. Returns `Result.ok(null)` when no
+ * credentials are provided.
+ */
+export const createJwtAdapter = (options) => {
+    const authenticate = async (input) => {
+        if (!input.bearerToken) {
+            return Result.ok(null);
+        }
+        if (!options.secret) {
+            return authErr('invalid_token', 'No secret configured');
+        }
+        const decoded = await decodeAndVerify(input.bearerToken, options.secret);
+        return decoded.isErr() ? decoded : payloadToPermit(decoded.value, options);
+    };
+    return { authenticate };
+};
+//# sourceMappingURL=jwt.js.map

package/dist/adapters/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../src/adapters/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AA+BxC,8EAA8E;AAC9E,mCAAmC;AACnC,8EAA8E;AAE9E,MAAM,OAAO,GAAG,CACd,IAAuB,EACvB,OAAe,EACW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AAE7D,0CAA0C;AAC1C,MAAM,eAAe,GAAG,CAAC,KAAa,EAAc,EAAE;IACpD,MAAM,MAAM,GAAG,KAAK;SACjB,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;SACpB,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;SACpB,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,4DAA4D;AAC5D,MAAM,aAAa,GAAG,CAAC,KAAa,EAA0B,EAAE;IAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC,CAAC;AAEF,4CAA4C;AAC5C,MAAM,aAAa,GAAG,CAAC,MAAc,EAAsB,EAAE;IAC3D,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EACtB,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,EACjC,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;AACJ,CAAC,CAAC;AAEF,iDAAiD;AACjD,MAAM,mBAAmB,GAAG,CAC1B,KAAa,EACb,GAAc,EACI,EAAE;IACpB,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;QACnB,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CACzB,MAAM,EACN,GAAG,EACH,SAAS,CAAC,MAAqB,EAC/B,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CACrB,CAAC;AACJ,CAAC,CAAC;AAEF,gDAAgD;AAChD,MAAM,cAAc,GAAG,CACrB,OAAmB,EACnB,OAA0B,EACH,EAAE;IACzB,IACE,OAAO,CAAC,GAAG,KAAK,SAAS;QACzB,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAC3C,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;IACjE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QACrD,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;QACxB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAChC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC;YAChC,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC,QAAQ,CAAC;QAC7B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;QACjE,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,6EAA6E;AAC7E,MAAM,aAAa,GAAG,CACpB,OAAmB,EACnB,KAAa,EACM,EAAE;IACrB,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,MAAM,CACf,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAC1D,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC,CAAC;AAEF,yDAAyD;AACzD,MAAM,YAAY,GAAG,CACnB,OAAmB,EACnB,KAAa,EACkB,EAAE;IACjC,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;AAC/D,CAAC,CAAC;AAEF,mDAAmD;AACnD,MAAM,WAAW,GAAG,CAClB,OAAmB,EACnB,OAA0B,EACC,EAAE;IAC7B,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACjB,OAAO,OAAO,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC,EAAE,CAAC;QACf,EAAE,EAAE,OAAO,CAAC,GAAG;QACf,MAAM,EAAE,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC;QAC9D,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5B,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,wEAAwE;AACxE,MAAM,eAAe,GAAG,KAAK,EAC3B,KAAa,EACb,MAAc,EAC0B,EAAE;IAC1C,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,OAAO,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACpD,OAAO,KAAK;YACV,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC;YACpB,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,eAAe,EAAE,2BAA2B,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC,CAAC;AAEF,kEAAkE;AAClE,MAAM,eAAe,GAAG,CACtB,OAAmB,EACnB,OAA0B,EACC,EAAE;IAC7B,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACpD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AACvC,CAAC,CAAC;AAEF,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAA0B,EAAe,EAAE;IAC1E,MAAM,YAAY,GAAG,KAAK,EACxB,KAA4B,EACe,EAAE;QAC7C,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YACvB,OAAO,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,OAAO,OAAO,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACzE,OAAO,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC7E,CAAC,CAAC;IAEF,OAAO,EAAE,YAAY,EAAE,CAAC;AAC1B,CAAC,CAAC"}

package/dist/auth-layer.d.ts

@@ -0,0 +1,18 @@
+import type { Layer } from '@ontrails/core';
+/**
+ * A {@link Layer} that enforces permit scopes declared on trails.
+ *
+ * The layer reads the trail's `permit` field (a `PermitRequirement`):
+ *
+ * - If `permit` is `'public'` or `undefined` the layer passes through.
+ * - If `permit` has `scopes`, the layer checks that `ctx.permit` contains
+ *   all required scopes. A superset is fine; missing scopes produce a
+ *   `PermitError`.
+ *
+ * Because `ctx.follow()` re-enters `executeTrail` (which applies layers),
+ * this layer automatically re-checks on every invocation in a follow chain.
+ * No special follow-chain handling is needed — it is built into the
+ * architecture.
+ */
+export declare const authLayer: Layer;
+//# sourceMappingURL=auth-layer.d.ts.map

package/dist/auth-layer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-layer.d.ts","sourceRoot":"","sources":["../src/auth-layer.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AA6B5C;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,SAAS,EAAE,KAkCvB,CAAC"}

package/dist/auth-layer.js

@@ -0,0 +1,56 @@
+import { Result } from '@ontrails/core';
+import { PermitError } from './errors.js';
+import { getPermit } from './permit.js';
+// ---------------------------------------------------------------------------
+// Helpers (defined before callers — no use-before-define)
+// ---------------------------------------------------------------------------
+/**
+ * Returns `true` when the permit requirement means "no enforcement needed."
+ * Either the trail hasn't declared a permit posture or has explicitly
+ * opted out with `'public'`.
+ */
+const isPassThrough = (requirement) => requirement === undefined || requirement === 'public';
+/** Returns scopes present in `required` but absent from `held`. */
+const findMissing = (required, held) => required.filter((s) => !held.includes(s));
+// ---------------------------------------------------------------------------
+// Auth layer
+// ---------------------------------------------------------------------------
+/**
+ * A {@link Layer} that enforces permit scopes declared on trails.
+ *
+ * The layer reads the trail's `permit` field (a `PermitRequirement`):
+ *
+ * - If `permit` is `'public'` or `undefined` the layer passes through.
+ * - If `permit` has `scopes`, the layer checks that `ctx.permit` contains
+ *   all required scopes. A superset is fine; missing scopes produce a
+ *   `PermitError`.
+ *
+ * Because `ctx.follow()` re-enters `executeTrail` (which applies layers),
+ * this layer automatically re-checks on every invocation in a follow chain.
+ * No special follow-chain handling is needed — it is built into the
+ * architecture.
+ */
+export const authLayer = {
+    description: 'Enforces permit scopes declared on trails',
+    name: 'auth',
+    wrap: (_trail, impl) => {
+        const requirement = _trail.permit;
+        if (isPassThrough(requirement)) {
+            return impl;
+        }
+        return (input, ctx) => {
+            const permit = getPermit(ctx);
+            if (!permit) {
+                return Promise.resolve(Result.err(new PermitError('No permit provided')));
+            }
+            const missing = findMissing(requirement.scopes, permit.scopes);
+            if (missing.length > 0) {
+                return Promise.resolve(Result.err(new PermitError(`Missing scopes: ${missing.join(', ')}`, {
+                    context: { missing, required: requirement.scopes },
+                })));
+            }
+            return Promise.resolve(impl(input, ctx));
+        };
+    },
+};
+//# sourceMappingURL=auth-layer.js.map

package/dist/auth-layer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-layer.js","sourceRoot":"","sources":["../src/auth-layer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAGxC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,8EAA8E;AAC9E,0DAA0D;AAC1D,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,aAAa,GAAG,CACpB,WAAoB,EACiB,EAAE,CACvC,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,QAAQ,CAAC;AAExD,mEAAmE;AACnE,MAAM,WAAW,GAAG,CAClB,QAA2B,EAC3B,IAAuB,EACJ,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAElE,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,SAAS,GAAU;IAC9B,WAAW,EAAE,2CAA2C;IACxD,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC;QAElC,IAAI,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACpB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YAE9B,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,OAAO,CAAC,OAAO,CACpB,MAAM,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,oBAAoB,CAAC,CAAC,CAClD,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YAE/D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,OAAO,OAAO,CAAC,OAAO,CACpB,MAAM,CAAC,GAAG,CACR,IAAI,WAAW,CAAC,mBAAmB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;oBACvD,OAAO,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE;iBACnD,CAAC,CACH,CACF,CAAC;YACJ,CAAC;YAED,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3C,CAAC,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/auth-service.d.ts

@@ -0,0 +1,10 @@
+import type { AuthAdapter } from './adapter.js';
+/**
+ * Auth service — manages the auth adapter lifecycle.
+ *
+ * The v1 factory returns a no-op adapter that always succeeds (null permit).
+ * Real adapter configuration will come through `ServiceSpec.config` (TRL-91).
+ * The mock factory provides a synthetic adapter that always succeeds.
+ */
+export declare const authService: import("@ontrails/core").Service<AuthAdapter>;
+//# sourceMappingURL=auth-service.d.ts.map

package/dist/auth-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-service.d.ts","sourceRoot":"","sources":["../src/auth-service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,+CAatB,CAAC"}

package/dist/auth-service.js

@@ -0,0 +1,21 @@
+import { Result, service } from '@ontrails/core';
+/**
+ * Auth service — manages the auth adapter lifecycle.
+ *
+ * The v1 factory returns a no-op adapter that always succeeds (null permit).
+ * Real adapter configuration will come through `ServiceSpec.config` (TRL-91).
+ * The mock factory provides a synthetic adapter that always succeeds.
+ */
+export const authService = service('auth', {
+    create: (_svc) => Result.ok({
+        // oxlint-disable-next-line require-await -- stub adapter satisfies async interface
+        authenticate: async () => Result.ok(null),
+    }),
+    description: 'Authentication adapter',
+    metadata: { category: 'infrastructure' },
+    mock: () => ({
+        // oxlint-disable-next-line require-await -- mock adapter satisfies async interface
+        authenticate: async () => Result.ok(null),
+    }),
+});
+//# sourceMappingURL=auth-service.js.map

package/dist/auth-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-service.js","sourceRoot":"","sources":["../src/auth-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAIjD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAc,MAAM,EAAE;IACtD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CACf,MAAM,CAAC,EAAE,CAAC;QACR,mFAAmF;QACnF,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC;KACpB,CAAC;IAC1B,WAAW,EAAE,wBAAwB;IACrC,QAAQ,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE;IACxC,IAAI,EAAE,GAAG,EAAE,CACT,CAAC;QACC,mFAAmF;QACnF,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC;KAC1C,CAAuB;CAC3B,CAAC,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,15 @@
+import { PermissionError } from '@ontrails/core';
+/**
+ * Error returned when permit scope enforcement fails.
+ *
+ * Extends `PermissionError` (category `'permission'`, HTTP 403) because
+ * it represents an *authorization* failure — the caller's identity is known
+ * but lacks the required scopes.
+ */
+export declare class PermitError extends PermissionError {
+    constructor(message: string, options?: {
+        cause?: Error;
+        context?: Record<string, unknown>;
+    });
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD;;;;;;GAMG;AACH,qBAAa,WAAY,SAAQ,eAAe;gBAE5C,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,KAAK,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE;CAKjE"}

package/dist/errors.js

@@ -0,0 +1,15 @@
+import { PermissionError } from '@ontrails/core';
+/**
+ * Error returned when permit scope enforcement fails.
+ *
+ * Extends `PermissionError` (category `'permission'`, HTTP 403) because
+ * it represents an *authorization* failure — the caller's identity is known
+ * but lacks the required scopes.
+ */
+export class PermitError extends PermissionError {
+    constructor(message, options) {
+        super(message, options);
+        this.name = 'PermitError';
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD;;;;;;GAMG;AACH,MAAM,OAAO,WAAY,SAAQ,eAAe;IAC9C,YACE,OAAe,EACf,OAA8D;QAE9D,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF"}

package/dist/extraction.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Normalized input for auth adapters.
+ *
+ * Each surface extracts raw credentials from its transport and normalizes
+ * them into this shape. No surface types (Request, McpSession, etc.) cross
+ * into core — only this interface.
+ */
+export interface PermitExtractionInput {
+    /** Which surface produced this extraction */
+    readonly surface: 'http' | 'mcp' | 'cli';
+    /** Bearer token from Authorization header or equivalent */
+    readonly bearerToken?: string;
+    /** Session identifier from transport handshake */
+    readonly sessionId?: string;
+    /** Raw headers (HTTP surface only, typically) */
+    readonly headers?: Headers;
+    /** Correlation ID for tracing */
+    readonly requestId: string;
+}
+//# sourceMappingURL=extraction.d.ts.map

package/dist/extraction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extraction.d.ts","sourceRoot":"","sources":["../src/extraction.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,6CAA6C;IAC7C,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,GAAG,KAAK,CAAC;IACzC,2DAA2D;IAC3D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,kDAAkD;IAClD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,iDAAiD;IACjD,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,iCAAiC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B"}

package/dist/extraction.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=extraction.js.map

package/dist/extraction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extraction.js","sourceRoot":"","sources":["../src/extraction.ts"],"names":[],"mappings":""}

package/dist/index.d.ts

@@ -0,0 +1,11 @@
+export { type AuthAdapter, type AuthCredentials, type AuthError, } from './adapter.js';
+export { createJwtAdapter, type JwtAdapterOptions } from './adapters/jwt.js';
+export { authLayer } from './auth-layer.js';
+export { authService } from './auth-service.js';
+export { authVerify } from './trails/auth-verify.js';
+export { PermitError } from './errors.js';
+export { type PermitExtractionInput } from './extraction.js';
+export { type Permit, getPermit } from './permit.js';
+export { validatePermits, type PermitDiagnostic } from './rules.js';
+export { mintTestPermit, mintPermitForTrail } from './testing.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,SAAS,GACf,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,gBAAgB,EAAE,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,KAAK,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,KAAK,MAAM,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,KAAK,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -0,0 +1,11 @@
+export {} from './adapter.js';
+export { createJwtAdapter } from './adapters/jwt.js';
+export { authLayer } from './auth-layer.js';
+export { authService } from './auth-service.js';
+export { authVerify } from './trails/auth-verify.js';
+export { PermitError } from './errors.js';
+export {} from './extraction.js';
+export { getPermit } from './permit.js';
+export { validatePermits } from './rules.js';
+export { mintTestPermit, mintPermitForTrail } from './testing.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,gBAAgB,EAA0B,MAAM,mBAAmB,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAA8B,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAe,SAAS,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,eAAe,EAAyB,MAAM,YAAY,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC"}

package/dist/permit.d.ts

@@ -0,0 +1,26 @@
+import type { BasePermit } from '@ontrails/core';
+/** The resolved identity and scopes from a successful authentication. */
+export interface Permit extends BasePermit {
+    readonly roles?: readonly string[];
+    readonly tenantId?: string;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+/**
+ * Type-safe accessor for `ctx.permit` with a downcast to `Permit`.
+ *
+ * `TrailContext.permit` is typed as `BasePermit` (id + scopes). This accessor
+ * returns the full `Permit` when the auth layer has set one. Safe because
+ * the auth layer is the only writer and always sets a full `Permit`.
+ *
+ * @example
+ * ```typescript
+ * const permit = getPermit(ctx);
+ * if (permit) {
+ *   console.log(permit.roles, permit.tenantId);
+ * }
+ * ```
+ */
+export declare const getPermit: (ctx: {
+    permit?: BasePermit;
+}) => Permit | undefined;
+//# sourceMappingURL=permit.d.ts.map

package/dist/permit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permit.d.ts","sourceRoot":"","sources":["../src/permit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,yEAAyE;AACzE,MAAM,WAAW,MAAO,SAAQ,UAAU;IACxC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,SAAS,GAAI,KAAK;IAAE,MAAM,CAAC,EAAE,UAAU,CAAA;CAAE,KAAG,MAAM,GAAG,SACH,CAAC"}

package/dist/permit.js

@@ -0,0 +1,17 @@
+/**
+ * Type-safe accessor for `ctx.permit` with a downcast to `Permit`.
+ *
+ * `TrailContext.permit` is typed as `BasePermit` (id + scopes). This accessor
+ * returns the full `Permit` when the auth layer has set one. Safe because
+ * the auth layer is the only writer and always sets a full `Permit`.
+ *
+ * @example
+ * ```typescript
+ * const permit = getPermit(ctx);
+ * if (permit) {
+ *   console.log(permit.roles, permit.tenantId);
+ * }
+ * ```
+ */
+export const getPermit = (ctx) => ctx.permit === undefined ? undefined : ctx.permit;
+//# sourceMappingURL=permit.js.map

package/dist/permit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permit.js","sourceRoot":"","sources":["../src/permit.ts"],"names":[],"mappings":"AASA;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,GAA4B,EAAsB,EAAE,CAC5E,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,GAAG,CAAC,MAAiB,CAAC"}

package/dist/rules.d.ts

@@ -0,0 +1,47 @@
+import type { Trail } from '@ontrails/core';
+/** A single governance finding from a permit rule. */
+export interface PermitDiagnostic {
+    readonly trailId: string;
+    readonly rule: string;
+    readonly severity: 'error' | 'warning';
+    readonly message: string;
+}
+type AnyTrail = Trail<unknown, unknown>;
+type Rule = (trails: readonly AnyTrail[]) => readonly PermitDiagnostic[];
+/**
+ * Destructive trails without a real permit declaration are a governance failure.
+ *
+ * Reports an error for every trail with `intent: 'destroy'` that has no
+ * `permit` field or explicitly opts out with `permit: 'public'`.
+ */
+export declare const destroyWithoutPermit: Rule;
+/**
+ * Write trails without a permit declaration get a warning.
+ *
+ * Trails with `intent: 'write'` (or no intent, which defaults to write) that
+ * lack a permit are flagged unless `permit: 'public'` is explicitly set.
+ */
+export declare const writeWithoutPermit: Rule;
+/**
+ * Warns for scopes that don't follow the `entity:action` convention.
+ *
+ * A valid scope contains exactly one colon separating a non-empty entity
+ * and a non-empty action.
+ */
+export declare const scopeNamingConsistency: Rule;
+/**
+ * Warns for scopes that appear in only one trail's permit.
+ *
+ * Catches typos like `user:wirte` by surfacing scopes not shared with any
+ * other trail. Only runs when at least 2 trails have permit declarations.
+ */
+export declare const orphanScopeDetection: Rule;
+/**
+ * Run all permit governance rules against a set of trails.
+ *
+ * Returns a flat array of diagnostics from every rule. An empty array
+ * means the topo passes all permit governance checks.
+ */
+export declare const validatePermits: (trails: readonly Trail<unknown, unknown>[]) => readonly PermitDiagnostic[];
+export {};
+//# sourceMappingURL=rules.d.ts.map

package/dist/rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../src/rules.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAM5C,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAMD,KAAK,QAAQ,GAAG,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AACxC,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,SAAS,QAAQ,EAAE,KAAK,SAAS,gBAAgB,EAAE,CAAC;AAiBzE;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,IAU5B,CAAC;AAMR;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,IAU1B,CAAC;AAgBR;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,EAAE,IAUlC,CAAC;AA2CJ;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,IAMlC,CAAC;AAaF;;;;;GAKG;AACH,eAAO,MAAM,eAAe,GAC1B,QAAQ,SAAS,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,KACzC,SAAS,gBAAgB,EAA8C,CAAC"}