@ontrails/permits 1.0.0-beta.12 → 1.0.0-beta.13

package/CHANGELOG.md

@@ -1,17 +1,45 @@
 # @ontrails/permits
 
-## 1.0.0-beta.12
+## 1.0.0-beta.13
 
 ### Minor Changes
 
-- Complete trifecta for config, permits, and crumbs (formerly tracks)
+- 6944147: Complete trifecta for config, permits, and tracker (formerly tracks)
 
-  - **config**: Add `configService`, `config.layer`, `config.trail`, and `config.workspace` trails with full `defineConfig`, `resolve`, `describe`, `explain`, `doctor`, and code generation support
+  - **config**: Add `configProvision`, `configGate`, `config.trail`, and `config.workspace` trails with full `defineConfig`, `resolve`, `describe`, `explain`, `doctor`, and code generation support
   - **permits**: Add `authService` and `auth.verify` trail for runtime authorization checks
-  - **crumbs**: Rename tracks to crumbs; add `crumbsService` and `crumbs.status` trail for structured event tracking
+  - **tracker**: Rename tracks to tracker; add `trackerProvision` and `tracker.status` trail for structured signal tracking
+  - **cli**: Fix build flag handling and improve bootstrap scaffolding
+  - **testing**: Expand test context helpers and example-based testing utilities
+  - **core/mcp/http**: Internal alignment for provision and composition updates
+
+- Trail-native vocabulary cutover. Breaking API field renames across all packages:
+
+  - Trail spec: `run:` → `blaze:`, `follow:` → `crosses:`, `services:` → `provisions:`, `metadata:` → `meta:`, `emits:` → `signals:`
+  - Runtime: `ctx.follow()` → `ctx.cross()`, `ctx.emit()` → `ctx.signal()`, `ctx.signal` (abort) → `ctx.abortSignal`
+  - Entry points: `blaze(app)` → `trailhead(app)`
+  - Package rename: `@ontrails/crumbs` → `@ontrails/tracker`
+  - Wrapper types: `Layer` → `Gate`, `layers`/`middleware` → `gates`
+  - Transport: `surface` → `trailhead`, `adapter` → `connector`
+
+### Patch Changes
+
+- Updated dependencies [6944147]
+- Updated dependencies
+  - @ontrails/core@1.0.0-beta.13
+
+## 1.0.0-beta.12
+
+### Minor Changes
+
+- Complete trifecta for config, permits, and tracker (formerly tracks)
+
+  - **config**: Add `configProvision`, `config.gate`, `config.trail`, and `config.workspace` trails with full `defineConfig`, `resolve`, `describe`, `explain`, `doctor`, and code generation support
+  - **permits**: Add `authProvision` and `auth.verify` trail for runtime authorization checks
+  - **tracker**: Rename tracks to tracker; add `trackerProvision` and `tracker.status` trail for structured event tracking
   - **cli**: Fix build flag handling and improve bootstrap scaffolding
   - **testing**: Expand test context helpers and example-based testing utilities
-  - **core/mcp/http**: Internal alignment for service and composition updates
+  - **core/mcp/http**: Internal alignment for provision and composition updates
 
 ### Patch Changes
 

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@ontrails/permits",
-  "version": "1.0.0-beta.12",
+  "version": "1.0.0-beta.13",
   "type": "module",
   "exports": {
     ".": "./src/index.ts",
-    "./jwt": "./src/adapters/jwt.ts",
+    "./jwt": "./src/connectors/jwt.ts",
     "./package.json": "./package.json"
   },
   "scripts": {

package/src/__tests__/{auth-layer.test.ts → auth-gate.test.ts}

@@ -1,11 +1,11 @@
-/* oxlint-disable require-await -- layer wrappers satisfy async interfaces without awaiting */
+/* oxlint-disable require-await -- gate wrappers satisfy async interfaces without awaiting */
 import { describe, expect, test } from 'bun:test';
 
 import { Result, trail } from '@ontrails/core';
 import type { TrailContext } from '@ontrails/core';
 import { z } from 'zod';
 
-import { authLayer } from '../auth-layer';
+import { authGate } from '../auth-gate';
 import { PermitError } from '../errors';
 
 // ---------------------------------------------------------------------------
@@ -16,9 +16,9 @@ const makeCtx = (permit?: {
   id: string;
   scopes: readonly string[];
 }): TrailContext => ({
+  abortSignal: AbortSignal.timeout(5000),
   permit,
   requestId: 'test-auth',
-  signal: AbortSignal.timeout(5000),
 });
 
 const okImpl = async () => Result.ok({ done: true });
@@ -27,21 +27,21 @@ const okImpl = async () => Result.ok({ done: true });
 // Tests
 // ---------------------------------------------------------------------------
 
-describe('authLayer', () => {
+describe('authGate', () => {
   test('has correct name and description', () => {
-    expect(authLayer.name).toBe('auth');
-    expect(authLayer.description).toBeDefined();
+    expect(authGate.name).toBe('auth');
+    expect(authGate.description).toBeDefined();
   });
 
   describe('pass-through cases', () => {
     test('passes through when trail has no permit field', async () => {
       const t = trail('test.nopermit', {
+        blaze: okImpl,
         input: z.object({}),
         output: z.object({ done: z.boolean() }),
-        run: okImpl,
       });
 
-      const wrapped = authLayer.wrap(t, okImpl);
+      const wrapped = authGate.wrap(t, okImpl);
       const result = await wrapped({}, makeCtx());
 
       expect(result.isOk()).toBe(true);
@@ -50,13 +50,13 @@ describe('authLayer', () => {
 
     test('passes through when trail permit is public', async () => {
       const t = trail('test.public', {
+        blaze: okImpl,
         input: z.object({}),
         output: z.object({ done: z.boolean() }),
         permit: 'public',
-        run: okImpl,
       });
 
-      const wrapped = authLayer.wrap(t, okImpl);
+      const wrapped = authGate.wrap(t, okImpl);
       const result = await wrapped({}, makeCtx());
 
       expect(result.isOk()).toBe(true);
@@ -66,14 +66,14 @@ describe('authLayer', () => {
 
   describe('scope enforcement', () => {
     const scopedTrail = trail('test.scoped', {
+      blaze: okImpl,
       input: z.object({}),
       output: z.object({ done: z.boolean() }),
       permit: { scopes: ['user:read'] },
-      run: okImpl,
     });
 
     test('passes when ctx.permit has matching scopes', async () => {
-      const wrapped = authLayer.wrap(scopedTrail, okImpl);
+      const wrapped = authGate.wrap(scopedTrail, okImpl);
       const result = await wrapped(
         {},
         makeCtx({ id: 'usr-1', scopes: ['user:read'] })
@@ -84,7 +84,7 @@ describe('authLayer', () => {
     });
 
     test('returns error when ctx has no permit', async () => {
-      const wrapped = authLayer.wrap(scopedTrail, okImpl);
+      const wrapped = authGate.wrap(scopedTrail, okImpl);
       const result = await wrapped({}, makeCtx());
 
       expect(result.isErr()).toBe(true);
@@ -95,13 +95,13 @@ describe('authLayer', () => {
 
     test('returns error when permit is missing required scopes', async () => {
       const multiScopeTrail = trail('test.multi', {
+        blaze: okImpl,
         input: z.object({}),
         output: z.object({ done: z.boolean() }),
         permit: { scopes: ['user:read', 'user:write'] },
-        run: okImpl,
       });
 
-      const wrapped = authLayer.wrap(multiScopeTrail, okImpl);
+      const wrapped = authGate.wrap(multiScopeTrail, okImpl);
       const result = await wrapped(
         {},
         makeCtx({ id: 'usr-1', scopes: ['user:read'] })
@@ -114,7 +114,7 @@ describe('authLayer', () => {
     });
 
     test('passes when permit has superset of required scopes', async () => {
-      const wrapped = authLayer.wrap(scopedTrail, okImpl);
+      const wrapped = authGate.wrap(scopedTrail, okImpl);
       const result = await wrapped(
         {},
         makeCtx({

package/src/__tests__/{auth-service.test.ts → auth-provision.test.ts}

@@ -1,9 +1,9 @@
 import { describe, expect, test } from 'bun:test';
 
-import type { ServiceContext } from '@ontrails/core';
+import type { ProvisionContext } from '@ontrails/core';
 
-import type { AuthAdapter } from '../adapter.js';
-import { authService } from '../auth-service.js';
+import type { AuthConnector } from '../connectors/connector.js';
+import { authProvision } from '../auth-provision.js';
 import type { PermitExtractionInput } from '../extraction.js';
 
 /** Minimal extraction input for tests. */
@@ -11,7 +11,7 @@ const testInput = (
   overrides?: Partial<PermitExtractionInput>
 ): PermitExtractionInput => ({
   requestId: 'test-svc-req',
-  surface: 'http',
+  trailhead: 'http',
   ...overrides,
 });
 
@@ -19,7 +19,7 @@ const testInput = (
 // Helpers
 // ---------------------------------------------------------------------------
 
-const testSvcCtx: ServiceContext = {
+const testSvcCtx: ProvisionContext = {
   config: undefined,
   cwd: '/tmp',
   env: {},
@@ -30,32 +30,32 @@ const testSvcCtx: ServiceContext = {
 // Tests
 // ---------------------------------------------------------------------------
 
-describe('authService', () => {
+describe('authProvision', () => {
   test('has correct id and kind', () => {
-    expect(authService.id).toBe('auth');
-    expect(authService.kind).toBe('service');
+    expect(authProvision.id).toBe('auth');
+    expect(authProvision.kind).toBe('provision');
   });
 
-  test('has infrastructure metadata', () => {
-    expect(authService.metadata).toEqual({ category: 'infrastructure' });
+  test('has infrastructure meta', () => {
+    expect(authProvision.meta).toEqual({ category: 'infrastructure' });
   });
 
-  test('mock returns an AuthAdapter', async () => {
-    const mock = authService.mock?.();
+  test('mock returns an AuthConnector', async () => {
+    const mock = authProvision.mock?.();
     expect(mock).toBeDefined();
 
-    const adapter = mock as AuthAdapter;
-    const result = await adapter.authenticate(testInput());
+    const connector = mock as AuthConnector;
+    const result = await connector.authenticate(testInput());
     expect(result.isOk()).toBe(true);
     expect(result.unwrap()).toBeNull();
   });
 
-  test('create returns Result.ok with an AuthAdapter', async () => {
-    const result = await authService.create(testSvcCtx);
+  test('create returns Result.ok with an AuthConnector', async () => {
+    const result = await authProvision.create(testSvcCtx);
     expect(result.isOk()).toBe(true);
 
-    const adapter = result.unwrap() as AuthAdapter;
-    const authResult = await adapter.authenticate(testInput());
+    const connector = result.unwrap() as AuthConnector;
+    const authResult = await connector.authenticate(testInput());
     expect(authResult.isOk()).toBe(true);
     expect(authResult.unwrap()).toBeNull();
   });

package/src/__tests__/auth-verify.test.ts

@@ -2,14 +2,14 @@ import { describe, expect, test } from 'bun:test';
 
 import {
   Result,
-  SURFACE_KEY,
+  TRAILHEAD_KEY,
   ValidationError,
   executeTrail,
 } from '@ontrails/core';
 
-import type { AuthAdapter } from '../adapter.js';
-import { authService } from '../auth-service.js';
-import { createJwtAdapter } from '../adapters/jwt.js';
+import type { AuthConnector } from '../connectors/connector.js';
+import { authProvision } from '../auth-provision.js';
+import { createJwtConnector } from '../connectors/jwt.js';
 import type { Permit } from '../permit.js';
 import { authVerify } from '../trails/auth-verify.js';
 
@@ -55,15 +55,16 @@ const signJwt = async (
 
 const TEST_SECRET = 'test-secret-for-hmac-256';
 
-/** Create an AuthAdapter wired to a JWT secret. */
-const jwtAdapter = (): AuthAdapter => createJwtAdapter({ secret: TEST_SECRET });
+/** Create an AuthConnector wired to a JWT secret. */
+const jwtConnector = (): AuthConnector =>
+  createJwtConnector({ secret: TEST_SECRET });
 
-/** Execute auth.verify with a given adapter injected as the auth service. */
+/** Execute auth.verify with a given connector injected as the auth provision. */
 const runVerify = async (
   token: string,
-  adapter: AuthAdapter,
+  connector: AuthConnector,
   options?: {
-    surface?: 'http' | 'mcp' | 'cli';
+    trailhead?: 'http' | 'mcp' | 'cli';
   }
 ): Promise<
   Result<
@@ -91,10 +92,10 @@ const runVerify = async (
     { token },
     {
       ctx:
-        options?.surface === undefined
+        options?.trailhead === undefined
           ? undefined
-          : { extensions: { [SURFACE_KEY]: options.surface } },
-      services: { [authService.id]: adapter },
+          : { extensions: { [TRAILHEAD_KEY]: options.trailhead } },
+      provisions: { [authProvision.id]: connector },
     }
   );
   return result as Result<
@@ -124,8 +125,8 @@ describe('auth.verify trail', () => {
       expect(authVerify.intent).toBe('read');
     });
 
-    test('has infrastructure metadata', () => {
-      expect(authVerify.metadata).toEqual({ category: 'infrastructure' });
+    test('has infrastructure meta', () => {
+      expect(authVerify.meta).toEqual({ category: 'infrastructure' });
     });
 
     test('has examples', () => {
@@ -133,20 +134,20 @@ describe('auth.verify trail', () => {
       expect(authVerify.examples?.length).toBeGreaterThan(0);
     });
 
-    test('declares authService dependency', () => {
-      expect(authVerify.services).toHaveLength(1);
-      expect(authVerify.services[0]?.id).toBe('auth');
+    test('declares authProvision dependency', () => {
+      expect(authVerify.provisions).toHaveLength(1);
+      expect(authVerify.provisions[0]?.id).toBe('auth');
     });
   });
 
-  describe('with mock adapter (no credentials)', () => {
+  describe('with mock connector (no credentials)', () => {
     test('returns valid: false with error message', async () => {
-      const noopAdapter: AuthAdapter = {
+      const noopConnector: AuthConnector = {
         // oxlint-disable-next-line require-await -- satisfies async interface
         authenticate: async () => Result.ok(null),
       };
 
-      const result = await runVerify('some-token', noopAdapter);
+      const result = await runVerify('some-token', noopConnector);
 
       expect(result.isOk()).toBe(true);
       const value = result.unwrap();
@@ -165,7 +166,7 @@ describe('auth.verify trail', () => {
         TEST_SECRET
       );
 
-      const result = await runVerify(token, jwtAdapter());
+      const result = await runVerify(token, jwtConnector());
 
       expect(result.isOk()).toBe(true);
       const value = result.unwrap();
@@ -177,7 +178,7 @@ describe('auth.verify trail', () => {
       expect(value.error).toBeUndefined();
     });
 
-    test('returns the full permit payload from the adapter', async () => {
+    test('returns the full permit payload from the connector', async () => {
       const permit: Permit = {
         id: 'user-42',
         metadata: { plan: 'pro' },
@@ -185,12 +186,12 @@ describe('auth.verify trail', () => {
         scopes: ['read', 'write'],
         tenantId: 'tenant-1',
       };
-      const adapter: AuthAdapter = {
+      const connector: AuthConnector = {
         // oxlint-disable-next-line require-await -- satisfies async interface
         authenticate: async () => Result.ok(permit),
       };
 
-      const result = await runVerify('full-permit-token', adapter);
+      const result = await runVerify('full-permit-token', connector);
 
       expect(result.isOk()).toBe(true);
       expect(result.unwrap().permit).toEqual({
@@ -202,12 +203,12 @@ describe('auth.verify trail', () => {
       });
     });
 
-    test('forwards the invoking surface from trail context', async () => {
-      let seenSurface: string | undefined;
-      const adapter: AuthAdapter = {
-        // oxlint-disable-next-line require-await -- captures adapter input
+    test('forwards the invoking trailhead from trail context', async () => {
+      let seenTrailhead: string | undefined;
+      const connector: AuthConnector = {
+        // oxlint-disable-next-line require-await -- captures connector input
         authenticate: async (input) => {
-          seenSurface = input.surface;
+          seenTrailhead = input.trailhead;
           return Result.ok({
             id: 'user-42',
             scopes: ['read'],
@@ -215,12 +216,12 @@ describe('auth.verify trail', () => {
         },
       };
 
-      const result = await runVerify('surface-aware-token', adapter, {
-        surface: 'mcp',
+      const result = await runVerify('trailhead-aware-token', connector, {
+        trailhead: 'mcp',
       });
 
       expect(result.isOk()).toBe(true);
-      expect(seenSurface).toBe('mcp');
+      expect(seenTrailhead).toBe('mcp');
     });
   });
 
@@ -232,7 +233,7 @@ describe('auth.verify trail', () => {
         'wrong-secret'
       );
 
-      const result = await runVerify(token, jwtAdapter());
+      const result = await runVerify(token, jwtConnector());
 
       expect(result.isOk()).toBe(true);
       const value = result.unwrap();
@@ -249,7 +250,7 @@ describe('auth.verify trail', () => {
         TEST_SECRET
       );
 
-      const result = await runVerify(token, jwtAdapter());
+      const result = await runVerify(token, jwtConnector());
 
       expect(result.isOk()).toBe(true);
       const value = result.unwrap();
@@ -266,7 +267,7 @@ describe('auth.verify trail', () => {
         authVerify,
         { token: '' },
         {
-          services: { [authService.id]: jwtAdapter() },
+          provisions: { [authProvision.id]: jwtConnector() },
         }
       );
 

package/src/__tests__/{adapter.test.ts → connector.test.ts}

@@ -2,10 +2,10 @@ import { describe, expect, test } from 'bun:test';
 
 import { Result } from '@ontrails/core';
 
-import type { AuthAdapter, AuthError } from '../adapter.js';
+import type { AuthConnector, AuthError } from '../connectors/connector.js';
 import type { PermitExtractionInput } from '../extraction.js';
 import type { Permit } from '../permit.js';
-import { createJwtAdapter } from '../adapters/jwt.js';
+import { createJwtConnector } from '../connectors/jwt.js';
 
 // ---------------------------------------------------------------------------
 // Test helper: sign a JWT with HMAC-SHA256 using crypto.subtle
@@ -58,37 +58,37 @@ const testInput = (
   overrides?: Partial<PermitExtractionInput>
 ): PermitExtractionInput => ({
   requestId: 'test-req',
-  surface: 'http',
+  trailhead: 'http',
   ...overrides,
 });
 
-describe('AuthAdapter interface', () => {
-  test('accepts a valid adapter implementation', async () => {
-    const adapter: AuthAdapter = {
-      // oxlint-disable-next-line require-await -- stub adapter for type test
+describe('AuthConnector interface', () => {
+  test('accepts a valid connector implementation', async () => {
+    const connector: AuthConnector = {
+      // oxlint-disable-next-line require-await -- stub connector for type test
       authenticate: async (_input: PermitExtractionInput) => Result.ok(null),
     };
-    const result = await adapter.authenticate(testInput());
+    const result = await connector.authenticate(testInput());
     expect(result.isOk()).toBe(true);
   });
 });
 
 /* oxlint-disable max-statements -- test suite with multiple concern groups */
-describe('createJwtAdapter', () => {
-  test('returns an AuthAdapter', () => {
-    const adapter = createJwtAdapter({ secret: TEST_SECRET });
-    expect(adapter).toBeDefined();
-    expect(adapter.authenticate).toBeInstanceOf(Function);
+describe('createJwtConnector', () => {
+  test('returns an AuthConnector', () => {
+    const connector = createJwtConnector({ secret: TEST_SECRET });
+    expect(connector).toBeDefined();
+    expect(connector.authenticate).toBeInstanceOf(Function);
   });
 
   test('verifies a valid HS256 token and returns a Permit', async () => {
-    const adapter = createJwtAdapter({ secret: TEST_SECRET });
+    const connector = createJwtConnector({ secret: TEST_SECRET });
     const now = Math.floor(Date.now() / 1000);
     const token = await signJwt(
       { exp: now + 3600, scope: 'read write', sub: 'user-123' },
       TEST_SECRET
     );
-    const result = await adapter.authenticate(
+    const result = await connector.authenticate(
       testInput({ bearerToken: token })
     );
     expect(result.isOk()).toBe(true);
@@ -99,13 +99,13 @@ describe('createJwtAdapter', () => {
   });
 
   test('rejects an expired token', async () => {
-    const adapter = createJwtAdapter({ secret: TEST_SECRET });
+    const connector = createJwtConnector({ secret: TEST_SECRET });
     const past = Math.floor(Date.now() / 1000) - 3600;
     const token = await signJwt(
       { exp: past, sub: 'user-expired' },
       TEST_SECRET
     );
-    const result = await adapter.authenticate(
+    const result = await connector.authenticate(
       testInput({ bearerToken: token })
     );
     expect(result.isErr()).toBe(true);
@@ -114,13 +114,13 @@ describe('createJwtAdapter', () => {
   });
 
   test('rejects an invalid signature', async () => {
-    const adapter = createJwtAdapter({ secret: TEST_SECRET });
+    const connector = createJwtConnector({ secret: TEST_SECRET });
     const now = Math.floor(Date.now() / 1000);
     const token = await signJwt(
       { exp: now + 3600, sub: 'user-bad-sig' },
       'wrong-secret'
     );
-    const result = await adapter.authenticate(
+    const result = await connector.authenticate(
       testInput({ bearerToken: token })
     );
     expect(result.isErr()).toBe(true);
@@ -129,13 +129,13 @@ describe('createJwtAdapter', () => {
   });
 
   test('rejects tokens with a missing subject claim', async () => {
-    const adapter = createJwtAdapter({ secret: TEST_SECRET });
+    const connector = createJwtConnector({ secret: TEST_SECRET });
     const now = Math.floor(Date.now() / 1000);
     const token = await signJwt(
       { exp: now + 3600, scope: 'read' },
       TEST_SECRET
     );
-    const result = await adapter.authenticate(
+    const result = await connector.authenticate(
       testInput({ bearerToken: token })
     );
     expect(result.isErr()).toBe(true);
@@ -145,7 +145,7 @@ describe('createJwtAdapter', () => {
   });
 
   test('extracts scopes from token claims', async () => {
-    const adapter = createJwtAdapter({
+    const connector = createJwtConnector({
       scopesClaim: 'permissions',
       secret: TEST_SECRET,
     });
@@ -158,7 +158,7 @@ describe('createJwtAdapter', () => {
       },
       TEST_SECRET
     );
-    const result = await adapter.authenticate(
+    const result = await connector.authenticate(
       testInput({ bearerToken: token })
     );
     expect(result.isOk()).toBe(true);
@@ -167,13 +167,13 @@ describe('createJwtAdapter', () => {
   });
 
   test('extracts roles from token claims', async () => {
-    const adapter = createJwtAdapter({ secret: TEST_SECRET });
+    const connector = createJwtConnector({ secret: TEST_SECRET });
     const now = Math.floor(Date.now() / 1000);
     const token = await signJwt(
       { exp: now + 3600, roles: ['admin', 'editor'], sub: 'user-roles' },
       TEST_SECRET
     );
-    const result = await adapter.authenticate(
+    const result = await connector.authenticate(
       testInput({ bearerToken: token })
     );
     expect(result.isOk()).toBe(true);
@@ -182,14 +182,14 @@ describe('createJwtAdapter', () => {
   });
 
   test('returns null for missing credentials', async () => {
-    const adapter = createJwtAdapter({ secret: TEST_SECRET });
-    const result = await adapter.authenticate(testInput());
+    const connector = createJwtConnector({ secret: TEST_SECRET });
+    const result = await connector.authenticate(testInput());
     expect(result.isOk()).toBe(true);
     expect(result.unwrap()).toBeNull();
   });
 
   test('checks issuer claim when configured', async () => {
-    const adapter = createJwtAdapter({
+    const connector = createJwtConnector({
       issuer: 'https://auth.example.com',
       secret: TEST_SECRET,
     });
@@ -198,7 +198,7 @@ describe('createJwtAdapter', () => {
       { exp: now + 3600, iss: 'https://evil.example.com', sub: 'user-iss' },
       TEST_SECRET
     );
-    const result = await adapter.authenticate(
+    const result = await connector.authenticate(
       testInput({ bearerToken: token })
     );
     expect(result.isErr()).toBe(true);
@@ -207,7 +207,7 @@ describe('createJwtAdapter', () => {
   });
 
   test('checks audience claim when configured', async () => {
-    const adapter = createJwtAdapter({
+    const connector = createJwtConnector({
       audience: 'my-api',
       secret: TEST_SECRET,
     });
@@ -216,7 +216,7 @@ describe('createJwtAdapter', () => {
       { aud: 'other-api', exp: now + 3600, sub: 'user-aud' },
       TEST_SECRET
     );
-    const result = await adapter.authenticate(
+    const result = await connector.authenticate(
       testInput({ bearerToken: token })
     );
     expect(result.isErr()).toBe(true);
@@ -225,7 +225,7 @@ describe('createJwtAdapter', () => {
   });
 
   test('accepts array-format audience containing configured value', async () => {
-    const adapter = createJwtAdapter({
+    const connector = createJwtConnector({
       audience: 'my-api',
       secret: TEST_SECRET,
     });
@@ -234,7 +234,7 @@ describe('createJwtAdapter', () => {
       { aud: ['my-api', 'account'], exp: now + 3600, sub: 'user-arr-aud' },
       TEST_SECRET
     );
-    const result = await adapter.authenticate(
+    const result = await connector.authenticate(
       testInput({ bearerToken: token })
     );
     expect(result.isOk()).toBe(true);
@@ -243,7 +243,7 @@ describe('createJwtAdapter', () => {
   });
 
   test('rejects array-format audience not containing configured value', async () => {
-    const adapter = createJwtAdapter({
+    const connector = createJwtConnector({
       audience: 'my-api',
       secret: TEST_SECRET,
     });
@@ -252,7 +252,7 @@ describe('createJwtAdapter', () => {
       { aud: ['other-api', 'account'], exp: now + 3600, sub: 'user-no-aud' },
       TEST_SECRET
     );
-    const result = await adapter.authenticate(
+    const result = await connector.authenticate(
       testInput({ bearerToken: token })
     );
     expect(result.isErr()).toBe(true);
@@ -261,13 +261,13 @@ describe('createJwtAdapter', () => {
   });
 
   test('extracts scopes from array-format claim', async () => {
-    const adapter = createJwtAdapter({ secret: TEST_SECRET });
+    const connector = createJwtConnector({ secret: TEST_SECRET });
     const now = Math.floor(Date.now() / 1000);
     const token = await signJwt(
       { exp: now + 3600, scope: ['read', 'write'], sub: 'user-arr-scope' },
       TEST_SECRET
     );
-    const result = await adapter.authenticate(
+    const result = await connector.authenticate(
       testInput({ bearerToken: token })
     );
     expect(result.isOk()).toBe(true);
@@ -276,7 +276,7 @@ describe('createJwtAdapter', () => {
   });
 
   test('filters empty strings from array-format scope claims', async () => {
-    const adapter = createJwtAdapter({ secret: TEST_SECRET });
+    const connector = createJwtConnector({ secret: TEST_SECRET });
     const now = Math.floor(Date.now() / 1000);
     const token = await signJwt(
       {
@@ -286,7 +286,7 @@ describe('createJwtAdapter', () => {
       },
       TEST_SECRET
     );
-    const result = await adapter.authenticate(
+    const result = await connector.authenticate(
       testInput({ bearerToken: token })
     );
     expect(result.isOk()).toBe(true);
@@ -295,7 +295,7 @@ describe('createJwtAdapter', () => {
   });
 
   test('returns error for malformed signature bytes', async () => {
-    const adapter = createJwtAdapter({ secret: TEST_SECRET });
+    const connector = createJwtConnector({ secret: TEST_SECRET });
     const now = Math.floor(Date.now() / 1000);
     const token = await signJwt(
       { exp: now + 3600, sub: 'user-bad' },
@@ -303,7 +303,7 @@ describe('createJwtAdapter', () => {
     );
     const parts = token.split('.');
     const malformed = `${parts[0]}.${parts[1]}.!!!invalid-base64!!!`;
-    const result = await adapter.authenticate(
+    const result = await connector.authenticate(
       testInput({ bearerToken: malformed })
     );
     expect(result.isErr()).toBe(true);
@@ -312,7 +312,7 @@ describe('createJwtAdapter', () => {
   });
 
   test('accepts token with matching issuer and audience', async () => {
-    const adapter = createJwtAdapter({
+    const connector = createJwtConnector({
       audience: 'my-api',
       issuer: 'https://auth.example.com',
       secret: TEST_SECRET,
@@ -328,7 +328,7 @@ describe('createJwtAdapter', () => {
       },
       TEST_SECRET
     );
-    const result = await adapter.authenticate(
+    const result = await connector.authenticate(
       testInput({ bearerToken: token })
     );
     expect(result.isOk()).toBe(true);

package/src/__tests__/permit.test.ts

@@ -60,7 +60,7 @@ describe('getPermit()', () => {
     expect(result).toBeUndefined();
   });
 
-  test('preserves extended permit fields from the auth layer', () => {
+  test('preserves extended permit fields from the auth gate', () => {
     const ctx = {
       permit: {
         id: 'usr_2',
@@ -77,42 +77,42 @@ describe('getPermit()', () => {
 });
 
 describe('PermitExtractionInput', () => {
-  test('accepts HTTP surface extraction', () => {
+  test('accepts HTTP trailhead extraction', () => {
     const input: PermitExtractionInput = {
       bearerToken: 'eyJhbGciOiJSUzI1NiJ9.test',
       headers: new Headers({
         authorization: 'Bearer eyJhbGciOiJSUzI1NiJ9.test',
       }),
       requestId: 'req-http-1',
-      surface: 'http',
+      trailhead: 'http',
     };
-    expect(input.surface).toBe('http');
+    expect(input.trailhead).toBe('http');
     expect(input.bearerToken).toBeDefined();
   });
 
-  test('accepts MCP surface extraction', () => {
+  test('accepts MCP trailhead extraction', () => {
     const input: PermitExtractionInput = {
       requestId: 'req-mcp-1',
       sessionId: 'mcp-session-abc',
-      surface: 'mcp',
+      trailhead: 'mcp',
     };
-    expect(input.surface).toBe('mcp');
+    expect(input.trailhead).toBe('mcp');
     expect(input.sessionId).toBe('mcp-session-abc');
   });
 
-  test('accepts CLI surface extraction', () => {
+  test('accepts CLI trailhead extraction', () => {
     const input: PermitExtractionInput = {
       bearerToken: 'cli-token-from-keyring',
       requestId: 'req-cli-1',
-      surface: 'cli',
+      trailhead: 'cli',
     };
-    expect(input.surface).toBe('cli');
+    expect(input.trailhead).toBe('cli');
   });
 
   test('accepts minimal extraction with only required fields', () => {
     const input: PermitExtractionInput = {
       requestId: 'req-minimal',
-      surface: 'http',
+      trailhead: 'http',
     };
     expect(input.requestId).toBe('req-minimal');
     expect(input.bearerToken).toBeUndefined();

package/src/__tests__/rules.test.ts

@@ -24,9 +24,9 @@ const noopRun = () => Result.ok({});
 describe('destroyWithoutPermit', () => {
   test('error when destroy trail has no permit', () => {
     const t = trail('user.delete', {
+      blaze: noopRun,
       input: emptyInput,
       intent: 'destroy',
-      run: noopRun,
     });
     const diagnostics = destroyWithoutPermit([t]);
     expect(diagnostics).toHaveLength(1);
@@ -40,10 +40,10 @@ describe('destroyWithoutPermit', () => {
 
   test('no diagnostic when destroy trail has a scoped permit', () => {
     const t = trail('user.delete', {
+      blaze: noopRun,
       input: emptyInput,
       intent: 'destroy',
       permit: { scopes: ['user:delete'] },
-      run: noopRun,
     });
     const diagnostics = destroyWithoutPermit([t]);
     expect(diagnostics).toHaveLength(0);
@@ -51,10 +51,10 @@ describe('destroyWithoutPermit', () => {
 
   test('error when destroy trail has permit: public', () => {
     const t = trail('user.delete', {
+      blaze: noopRun,
       input: emptyInput,
       intent: 'destroy',
       permit: 'public',
-      run: noopRun,
     });
     const diagnostics = destroyWithoutPermit([t]);
     expect(diagnostics).toHaveLength(1);
@@ -73,8 +73,8 @@ describe('destroyWithoutPermit', () => {
 describe('writeWithoutPermit', () => {
   test('warning when write trail has no permit', () => {
     const t = trail('user.create', {
+      blaze: noopRun,
       input: emptyInput,
-      run: noopRun,
     });
     const diagnostics = writeWithoutPermit([t]);
     expect(diagnostics).toHaveLength(1);
@@ -87,9 +87,9 @@ describe('writeWithoutPermit', () => {
 
   test('no warning when write trail has permit: public', () => {
     const t = trail('user.create', {
+      blaze: noopRun,
       input: emptyInput,
       permit: 'public',
-      run: noopRun,
     });
     const diagnostics = writeWithoutPermit([t]);
     expect(diagnostics).toHaveLength(0);
@@ -97,8 +97,8 @@ describe('writeWithoutPermit', () => {
 
   test('warning when trail has no intent (defaults to write)', () => {
     const t = trail('user.update', {
+      blaze: noopRun,
       input: emptyInput,
-      run: noopRun,
     });
     // Override intent to undefined to simulate a manually constructed trail
     const noIntent = { ...t, intent: undefined } as unknown as ReturnType<
@@ -115,9 +115,9 @@ describe('writeWithoutPermit', () => {
 
   test('no diagnostic for read trail without permit', () => {
     const t = trail('user.list', {
+      blaze: noopRun,
       input: emptyInput,
       intent: 'read',
-      run: noopRun,
     });
     const diagnostics = writeWithoutPermit([t]);
     expect(diagnostics).toHaveLength(0);
@@ -131,9 +131,9 @@ describe('writeWithoutPermit', () => {
 describe('scopeNamingConsistency', () => {
   test('scope user:write passes naming check', () => {
     const t = trail('user.update', {
+      blaze: noopRun,
       input: emptyInput,
       permit: { scopes: ['user:write'] },
-      run: noopRun,
     });
     const diagnostics = scopeNamingConsistency([t]);
     expect(diagnostics).toHaveLength(0);
@@ -141,9 +141,9 @@ describe('scopeNamingConsistency', () => {
 
   test('warning for scope without colon', () => {
     const t = trail('admin.panel', {
+      blaze: noopRun,
       input: emptyInput,
       permit: { scopes: ['admin'] },
-      run: noopRun,
     });
     const diagnostics = scopeNamingConsistency([t]);
     expect(diagnostics).toHaveLength(1);
@@ -163,14 +163,14 @@ describe('scopeNamingConsistency', () => {
 describe('orphanScopeDetection', () => {
   test('warning for orphan scope (typo)', () => {
     const t1 = trail('user.read', {
+      blaze: noopRun,
       input: emptyInput,
       permit: { scopes: ['user:read'] },
-      run: noopRun,
     });
     const t2 = trail('user.write', {
+      blaze: noopRun,
       input: emptyInput,
       permit: { scopes: ['user:wirte'] },
-      run: noopRun,
     });
     const diagnostics = orphanScopeDetection([t1, t2]);
     // Both scopes are unique (appear in only 1 trail each)
@@ -181,14 +181,14 @@ describe('orphanScopeDetection', () => {
 
   test('no warning for shared scopes', () => {
     const t1 = trail('user.read', {
+      blaze: noopRun,
       input: emptyInput,
       permit: { scopes: ['user:read'] },
-      run: noopRun,
     });
     const t2 = trail('user.profile', {
+      blaze: noopRun,
       input: emptyInput,
       permit: { scopes: ['user:read'] },
-      run: noopRun,
     });
     const diagnostics = orphanScopeDetection([t1, t2]);
     expect(diagnostics).toHaveLength(0);
@@ -203,23 +203,23 @@ describe('orphanScopeDetection', () => {
 describe('validatePermits', () => {
   test('runs all rules and aggregates diagnostics', () => {
     const destroyNoPerm = trail('user.delete', {
+      blaze: noopRun,
       input: emptyInput,
       intent: 'destroy',
-      run: noopRun,
     });
     const writeNoPerm = trail('user.create', {
+      blaze: noopRun,
       input: emptyInput,
-      run: noopRun,
     });
     const badScope = trail('admin.panel', {
+      blaze: noopRun,
       input: emptyInput,
       permit: { scopes: ['admin'] },
-      run: noopRun,
     });
     const orphanScope = trail('analytics.export', {
+      blaze: noopRun,
       input: emptyInput,
       permit: { scopes: ['analytics:exportt'] },
-      run: noopRun,
     });
 
     const diagnostics = validatePermits([

package/src/{auth-layer.ts → auth-gate.ts}

@@ -1,5 +1,5 @@
 import { Result } from '@ontrails/core';
-import type { Layer } from '@ontrails/core';
+import type { Gate } from '@ontrails/core';
 
 import { PermitError } from './errors.js';
 import { getPermit } from './permit.js';
@@ -25,25 +25,25 @@ const findMissing = (
 ): readonly string[] => required.filter((s) => !held.includes(s));
 
 // ---------------------------------------------------------------------------
-// Auth layer
+// Auth gate
 // ---------------------------------------------------------------------------
 
 /**
- * A {@link Layer} that enforces permit scopes declared on trails.
+ * A {@link Gate} that enforces permit scopes declared on trails.
  *
- * The layer reads the trail's `permit` field (a `PermitRequirement`):
+ * The gate reads the trail's `permit` field (a `PermitRequirement`):
  *
- * - If `permit` is `'public'` or `undefined` the layer passes through.
- * - If `permit` has `scopes`, the layer checks that `ctx.permit` contains
+ * - If `permit` is `'public'` or `undefined` the gate passes through.
+ * - If `permit` has `scopes`, the gate checks that `ctx.permit` contains
  *   all required scopes. A superset is fine; missing scopes produce a
  *   `PermitError`.
  *
- * Because `ctx.follow()` re-enters `executeTrail` (which applies layers),
- * this layer automatically re-checks on every invocation in a follow chain.
- * No special follow-chain handling is needed — it is built into the
+ * Because `ctx.cross()` re-enters `executeTrail` (which applies gates),
+ * this gate automatically re-checks on every invocation in a crossing chain.
+ * No special crossing-chain handling is needed — it is built into the
  * architecture.
  */
-export const authLayer: Layer = {
+export const authGate: Gate = {
   description: 'Enforces permit scopes declared on trails',
   name: 'auth',
   wrap: (_trail, impl) => {

package/src/auth-provision.ts

@@ -0,0 +1,26 @@
+import { Result, provision } from '@ontrails/core';
+
+import type { AuthConnector } from './connectors/connector.js';
+
+/**
+ * Auth provision — manages the auth connector lifecycle.
+ *
+ * The v1 factory returns a no-op connector that always succeeds (null permit).
+ * Real connector configuration will come through `ProvisionSpec.config`
+ * (TRL-91). The mock factory provides a synthetic connector that always
+ * succeeds.
+ */
+export const authProvision = provision<AuthConnector>('auth', {
+  create: (_svc) =>
+    Result.ok({
+      // oxlint-disable-next-line require-await -- stub connector satisfies async interface
+      authenticate: async () => Result.ok(null),
+    } satisfies AuthConnector),
+  description: 'Authentication connector',
+  meta: { category: 'infrastructure' },
+  mock: () =>
+    ({
+      // oxlint-disable-next-line require-await -- mock connector satisfies async interface
+      authenticate: async () => Result.ok(null),
+    }) satisfies AuthConnector,
+});

package/src/{adapter.ts → connectors/connector.ts}

@@ -1,7 +1,7 @@
 import type { Result } from '@ontrails/core';
 
-import type { PermitExtractionInput } from './extraction.js';
-import type { Permit } from './permit.js';
+import type { PermitExtractionInput } from '../extraction.js';
+import type { Permit } from '../permit.js';
 
 /**
  * @deprecated Use {@link PermitExtractionInput} instead. Kept as an alias
@@ -9,7 +9,7 @@ import type { Permit } from './permit.js';
  */
 export type AuthCredentials = PermitExtractionInput;
 
-/** Errors from auth adapters. */
+/** Errors from auth connectors. */
 export interface AuthError {
   readonly code:
     | 'expired_token'
@@ -20,15 +20,15 @@ export interface AuthError {
 }
 
 /**
- * Auth adapter port. Given extraction input, produce a permit or an error.
+ * Auth connector port. Given extraction input, produce a permit or an error.
  *
- * The adapter receives the full {@link PermitExtractionInput} — surface,
+ * The connector receives the full {@link PermitExtractionInput} — trailhead,
  * headers, requestId, and credential fields — so it can make richer
- * decisions (e.g., rate-limit by surface or correlate via requestId).
+ * decisions (e.g., rate-limit by trailhead or correlate via requestId).
  *
  * Deliberately narrow — no session management, no token refresh.
  */
-export interface AuthAdapter {
+export interface AuthConnector {
   readonly authenticate: (
     input: PermitExtractionInput
   ) => Promise<Result<Permit | null, AuthError>>;

package/src/{adapters → connectors}/jwt.ts

@@ -1,11 +1,11 @@
 import { Result } from '@ontrails/core';
 
-import type { AuthAdapter, AuthError } from '../adapter.js';
+import type { AuthConnector, AuthError } from './connector.js';
 import type { PermitExtractionInput } from '../extraction.js';
 import type { Permit } from '../permit.js';
 
-/** Configuration for the JWT auth adapter. */
-export interface JwtAdapterOptions {
+/** Configuration for the JWT auth connector. */
+export interface JwtConnectorOptions {
   /** HMAC secret for HS256 verification. */
   readonly secret?: string;
   /** JWKS endpoint for RS256/ES256 (not yet implemented). */
@@ -101,7 +101,7 @@ const verifyHmacSignature = (
 /** Validate standard claims (exp, iss, aud). */
 const validateClaims = (
   payload: JwtPayload,
-  options: JwtAdapterOptions
+  options: JwtConnectorOptions
 ): AuthError | undefined => {
   if (
     payload.exp !== undefined &&
@@ -156,7 +156,7 @@ const extractRoles = (
 /** Build a Permit from a validated JWT payload. */
 const buildPermit = (
   payload: JwtPayload,
-  options: JwtAdapterOptions
+  options: JwtConnectorOptions
 ): Result<Permit, AuthError> => {
   if (!payload.sub) {
     return authErr('invalid_token', 'Missing subject claim (sub)');
@@ -192,7 +192,7 @@ const decodeAndVerify = async (
 /** Validate claims and build a permit from a verified payload. */
 const payloadToPermit = (
   payload: JwtPayload,
-  options: JwtAdapterOptions
+  options: JwtConnectorOptions
 ): Result<Permit, AuthError> => {
   const claimError = validateClaims(payload, options);
   if (claimError) {
@@ -206,13 +206,15 @@ const payloadToPermit = (
 // ---------------------------------------------------------------------------
 
 /**
- * Create a JWT auth adapter using Bun's native crypto.
+ * Create a JWT auth connector using Bun's native crypto.
  *
  * Verifies HS256-signed JWTs, extracts claims into a Permit, and checks
  * issuer/audience when configured. Returns `Result.ok(null)` when no
  * credentials are provided.
  */
-export const createJwtAdapter = (options: JwtAdapterOptions): AuthAdapter => {
+export const createJwtConnector = (
+  options: JwtConnectorOptions
+): AuthConnector => {
   const authenticate = async (
     input: PermitExtractionInput
   ): Promise<Result<Permit | null, AuthError>> => {

package/src/extraction.ts

@@ -1,18 +1,18 @@
 /**
- * Normalized input for auth adapters.
+ * Normalized input for auth connectors.
  *
- * Each surface extracts raw credentials from its transport and normalizes
- * them into this shape. No surface types (Request, McpSession, etc.) cross
+ * Each trailhead extracts raw credentials from its transport and normalizes
+ * them into this shape. No trailhead types (Request, McpSession, etc.) cross
  * into core — only this interface.
  */
 export interface PermitExtractionInput {
-  /** Which surface produced this extraction */
-  readonly surface: 'http' | 'mcp' | 'cli';
+  /** Which trailhead produced this extraction */
+  readonly trailhead: 'http' | 'mcp' | 'cli';
   /** Bearer token from Authorization header or equivalent */
   readonly bearerToken?: string;
   /** Session identifier from transport handshake */
   readonly sessionId?: string;
-  /** Raw headers (HTTP surface only, typically) */
+  /** Raw headers (HTTP trailhead only, typically) */
   readonly headers?: Headers;
   /** Correlation ID for tracing */
   readonly requestId: string;

package/src/index.ts

@@ -1,11 +1,14 @@
 export {
-  type AuthAdapter,
+  type AuthConnector,
   type AuthCredentials,
   type AuthError,
-} from './adapter.js';
-export { createJwtAdapter, type JwtAdapterOptions } from './adapters/jwt.js';
-export { authLayer } from './auth-layer.js';
-export { authService } from './auth-service.js';
+} from './connectors/connector.js';
+export {
+  createJwtConnector,
+  type JwtConnectorOptions,
+} from './connectors/jwt.js';
+export { authGate } from './auth-gate.js';
+export { authProvision } from './auth-provision.js';
 export { authVerify } from './trails/auth-verify.js';
 export { PermitError } from './errors.js';
 export { type PermitExtractionInput } from './extraction.js';

package/src/permit.ts

@@ -11,8 +11,8 @@ export interface Permit extends BasePermit {
  * Type-safe accessor for `ctx.permit` with a downcast to `Permit`.
  *
  * `TrailContext.permit` is typed as `BasePermit` (id + scopes). This accessor
- * returns the full `Permit` when the auth layer has set one. Safe because
- * the auth layer is the only writer and always sets a full `Permit`.
+ * returns the full `Permit` when the auth gate has set one. Safe because
+ * the auth gate is the only writer and always sets a full `Permit`.
  *
  * @example
  * ```typescript

package/src/trails/auth-verify.ts

@@ -1,8 +1,8 @@
-import { Result, SURFACE_KEY, trail } from '@ontrails/core';
+import { Result, TRAILHEAD_KEY, trail } from '@ontrails/core';
 import type { TrailContext } from '@ontrails/core';
 import { z } from 'zod';
 
-import { authService } from '../auth-service.js';
+import { authProvision } from '../auth-provision.js';
 import type { PermitExtractionInput } from '../extraction.js';
 import type { Permit } from '../permit.js';
 
@@ -30,45 +30,32 @@ const toOutputPermit = (permit: Permit) => ({
   scopes: [...permit.scopes],
 });
 
-const isSurface = (value: unknown): value is PermitExtractionInput['surface'] =>
+const isTrailhead = (
+  value: unknown
+): value is PermitExtractionInput['trailhead'] =>
   value === 'http' || value === 'mcp' || value === 'cli';
 
-const getSurface = (ctx: TrailContext): PermitExtractionInput['surface'] => {
-  const surface = ctx.extensions?.[SURFACE_KEY];
-  return isSurface(surface) ? surface : 'http';
+const getTrailhead = (
+  ctx: TrailContext
+): PermitExtractionInput['trailhead'] => {
+  const trailhead = ctx.extensions?.[TRAILHEAD_KEY];
+  return isTrailhead(trailhead) ? trailhead : 'http';
 };
 
 /**
  * Infrastructure trail that verifies a bearer token and returns the resolved permit.
  *
- * Reads the auth adapter from `authService` — the adapter is configured at
- * bootstrap (e.g. JWT with HMAC secret). The mock adapter always succeeds with
- * a null permit, so `testAll(app)` works without configuration.
+ * Reads the auth connector from `authProvision` — the connector is configured
+ * at bootstrap (e.g. JWT with HMAC secret). The mock connector always
+ * succeeds with a null permit, so `testAll(app)` works without configuration.
  */
 export const authVerify = trail('auth.verify', {
-  examples: [
-    {
-      input: { token: 'test-token' },
-      name: 'Verify a token',
-    },
-  ],
-  input: z.object({
-    token: z.string().min(1).describe('Bearer token to verify'),
-  }),
-  intent: 'read',
-  metadata: { category: 'infrastructure' },
-  output: z.object({
-    error: z.string().optional(),
-    errorCode: authErrorCodeSchema.optional(),
-    permit: permitSchema.optional(),
-    valid: z.boolean(),
-  }),
-  run: async (input, ctx) => {
-    const adapter = authService.from(ctx);
-    const result = await adapter.authenticate({
+  blaze: async (input, ctx) => {
+    const connector = authProvision.from(ctx);
+    const result = await connector.authenticate({
       bearerToken: input.token,
       requestId: ctx.requestId,
-      surface: getSurface(ctx),
+      trailhead: getTrailhead(ctx),
     });
 
     if (result.isErr()) {
@@ -93,5 +80,22 @@ export const authVerify = trail('auth.verify', {
       valid: true,
     });
   },
-  services: [authService],
+  examples: [
+    {
+      input: { token: 'test-token' },
+      name: 'Verify a token',
+    },
+  ],
+  input: z.object({
+    token: z.string().min(1).describe('Bearer token to verify'),
+  }),
+  intent: 'read',
+  meta: { category: 'infrastructure' },
+  output: z.object({
+    error: z.string().optional(),
+    errorCode: authErrorCodeSchema.optional(),
+    permit: permitSchema.optional(),
+    valid: z.boolean(),
+  }),
+  provisions: [authProvision],
 });

package/src/auth-service.ts

@@ -1,25 +0,0 @@
-import { Result, service } from '@ontrails/core';
-
-import type { AuthAdapter } from './adapter.js';
-
-/**
- * Auth service — manages the auth adapter lifecycle.
- *
- * The v1 factory returns a no-op adapter that always succeeds (null permit).
- * Real adapter configuration will come through `ServiceSpec.config` (TRL-91).
- * The mock factory provides a synthetic adapter that always succeeds.
- */
-export const authService = service<AuthAdapter>('auth', {
-  create: (_svc) =>
-    Result.ok({
-      // oxlint-disable-next-line require-await -- stub adapter satisfies async interface
-      authenticate: async () => Result.ok(null),
-    } satisfies AuthAdapter),
-  description: 'Authentication adapter',
-  metadata: { category: 'infrastructure' },
-  mock: () =>
-    ({
-      // oxlint-disable-next-line require-await -- mock adapter satisfies async interface
-      authenticate: async () => Result.ok(null),
-    }) satisfies AuthAdapter,
-});