@ontrails/permits 1.0.0-beta.12 → 1.0.0-beta.14

package/dist/index.js

@@ -1,7 +1,7 @@
-export {} from './adapter.js';
-export { createJwtAdapter } from './adapters/jwt.js';
-export { authLayer } from './auth-layer.js';
-export { authService } from './auth-service.js';
+export {} from './connectors/connector.js';
+export { createJwtConnector, } from './connectors/jwt.js';
+export { authGate } from './auth-gate.js';
+export { authProvision } from './auth-provision.js';
 export { authVerify } from './trails/auth-verify.js';
 export { PermitError } from './errors.js';
 export {} from './extraction.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,gBAAgB,EAA0B,MAAM,mBAAmB,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAA8B,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAe,SAAS,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,eAAe,EAAyB,MAAM,YAAY,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,kBAAkB,GAEnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAA8B,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAe,SAAS,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,eAAe,EAAyB,MAAM,YAAY,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC"}

package/dist/permit.d.ts

@@ -9,8 +9,8 @@ export interface Permit extends BasePermit {
  * Type-safe accessor for `ctx.permit` with a downcast to `Permit`.
  *
  * `TrailContext.permit` is typed as `BasePermit` (id + scopes). This accessor
- * returns the full `Permit` when the auth layer has set one. Safe because
- * the auth layer is the only writer and always sets a full `Permit`.
+ * returns the full `Permit` when the auth gate has set one. Safe because
+ * the auth gate is the only writer and always sets a full `Permit`.
  *
  * @example
  * ```typescript

package/dist/permit.js

@@ -2,8 +2,8 @@
  * Type-safe accessor for `ctx.permit` with a downcast to `Permit`.
  *
  * `TrailContext.permit` is typed as `BasePermit` (id + scopes). This accessor
- * returns the full `Permit` when the auth layer has set one. Safe because
- * the auth layer is the only writer and always sets a full `Permit`.
+ * returns the full `Permit` when the auth gate has set one. Safe because
+ * the auth gate is the only writer and always sets a full `Permit`.
  *
  * @example
  * ```typescript

package/dist/trails/auth-verify.d.ts

@@ -1,9 +1,9 @@
 /**
  * Infrastructure trail that verifies a bearer token and returns the resolved permit.
  *
- * Reads the auth adapter from `authService` — the adapter is configured at
- * bootstrap (e.g. JWT with HMAC secret). The mock adapter always succeeds with
- * a null permit, so `testAll(app)` works without configuration.
+ * Reads the auth connector from `authProvision` — the connector is configured
+ * at bootstrap (e.g. JWT with HMAC secret). The mock connector always
+ * succeeds with a null permit, so `testAll(app)` works without configuration.
  */
 export declare const authVerify: import("@ontrails/core").Trail<{
     token: string;

package/dist/trails/auth-verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-verify.d.ts","sourceRoot":"","sources":["../../src/trails/auth-verify.ts"],"names":[],"mappings":"AAwCA;;;;;;GAMG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;EAiDrB,CAAC"}
+{"version":3,"file":"auth-verify.d.ts","sourceRoot":"","sources":["../../src/trails/auth-verify.ts"],"names":[],"mappings":"AA4CA;;;;;;GAMG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;EAiDrB,CAAC"}

package/dist/trails/auth-verify.js

@@ -1,6 +1,6 @@
-import { Result, SURFACE_KEY, trail } from '@ontrails/core';
+import { Result, TRAILHEAD_KEY, trail } from '@ontrails/core';
 import { z } from 'zod';
-import { authService } from '../auth-service.js';
+import { authProvision } from '../auth-provision.js';
 const permitSchema = z.object({
     id: z.string(),
     metadata: z.record(z.string(), z.unknown()).optional(),
@@ -23,42 +23,25 @@ const toOutputPermit = (permit) => ({
     id: permit.id,
     scopes: [...permit.scopes],
 });
-const isSurface = (value) => value === 'http' || value === 'mcp' || value === 'cli';
-const getSurface = (ctx) => {
-    const surface = ctx.extensions?.[SURFACE_KEY];
-    return isSurface(surface) ? surface : 'http';
+const isTrailhead = (value) => value === 'http' || value === 'mcp' || value === 'cli';
+const getTrailhead = (ctx) => {
+    const trailhead = ctx.extensions?.[TRAILHEAD_KEY];
+    return isTrailhead(trailhead) ? trailhead : 'http';
 };
 /**
  * Infrastructure trail that verifies a bearer token and returns the resolved permit.
  *
- * Reads the auth adapter from `authService` — the adapter is configured at
- * bootstrap (e.g. JWT with HMAC secret). The mock adapter always succeeds with
- * a null permit, so `testAll(app)` works without configuration.
+ * Reads the auth connector from `authProvision` — the connector is configured
+ * at bootstrap (e.g. JWT with HMAC secret). The mock connector always
+ * succeeds with a null permit, so `testAll(app)` works without configuration.
  */
 export const authVerify = trail('auth.verify', {
-    examples: [
-        {
-            input: { token: 'test-token' },
-            name: 'Verify a token',
-        },
-    ],
-    input: z.object({
-        token: z.string().min(1).describe('Bearer token to verify'),
-    }),
-    intent: 'read',
-    metadata: { category: 'infrastructure' },
-    output: z.object({
-        error: z.string().optional(),
-        errorCode: authErrorCodeSchema.optional(),
-        permit: permitSchema.optional(),
-        valid: z.boolean(),
-    }),
-    run: async (input, ctx) => {
-        const adapter = authService.from(ctx);
-        const result = await adapter.authenticate({
+    blaze: async (input, ctx) => {
+        const connector = authProvision.from(ctx);
+        const result = await connector.authenticate({
             bearerToken: input.token,
             requestId: ctx.requestId,
-            surface: getSurface(ctx),
+            trailhead: getTrailhead(ctx),
         });
         if (result.isErr()) {
             return Result.ok({
@@ -80,6 +63,23 @@ export const authVerify = trail('auth.verify', {
             valid: true,
         });
     },
-    services: [authService],
+    examples: [
+        {
+            input: { token: 'test-token' },
+            name: 'Verify a token',
+        },
+    ],
+    input: z.object({
+        token: z.string().min(1).describe('Bearer token to verify'),
+    }),
+    intent: 'read',
+    meta: { category: 'infrastructure' },
+    output: z.object({
+        error: z.string().optional(),
+        errorCode: authErrorCodeSchema.optional(),
+        permit: permitSchema.optional(),
+        valid: z.boolean(),
+    }),
+    provisions: [authProvision],
 });
 //# sourceMappingURL=auth-verify.js.map

package/dist/trails/auth-verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-verify.js","sourceRoot":"","sources":["../../src/trails/auth-verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAE5D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAIjD,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AACH,MAAM,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC;IACjC,eAAe;IACf,oBAAoB;IACpB,eAAe;IACf,qBAAqB;CACtB,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,CAAC;IAC1C,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS;QAC/B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACzC,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACnE,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;IACvE,EAAE,EAAE,MAAM,CAAC,EAAE;IACb,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;CAC3B,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,CAAC,KAAc,EAA6C,EAAE,CAC9E,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,KAAK,CAAC;AAEzD,MAAM,UAAU,GAAG,CAAC,GAAiB,EAAoC,EAAE;IACzE,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC,WAAW,CAAC,CAAC;IAC9C,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AAC/C,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa,EAAE;IAC7C,QAAQ,EAAE;QACR;YACE,KAAK,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE;YAC9B,IAAI,EAAE,gBAAgB;SACvB;KACF;IACD,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC;KAC5D,CAAC;IACF,MAAM,EAAE,MAAM;IACd,QAAQ,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE;IACxC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC5B,SAAS,EAAE,mBAAmB,CAAC,QAAQ,EAAE;QACzC,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE;QAC/B,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;KACnB,CAAC;IACF,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACxB,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC;YACxC,WAAW,EAAE,KAAK,CAAC,KAAK;YACxB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC;SACzB,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;YACnB,OAAO,MAAM,CAAC,EAAE,CAAC;gBACf,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;gBAC3B,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;gBAC5B,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC;QAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,MAAM,CAAC,EAAE,CAAC;gBACf,KAAK,EAAE,gBAAgB;gBACvB,SAAS,EAAE,qBAAqB;gBAChC,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC,EAAE,CAAC;YACf,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC;YAC9B,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;IACL,CAAC;IACD,QAAQ,EAAE,CAAC,WAAW,CAAC;CACxB,CAAC,CAAC"}
+{"version":3,"file":"auth-verify.js","sourceRoot":"","sources":["../../src/trails/auth-verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAE9D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAIrD,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AACH,MAAM,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC;IACjC,eAAe;IACf,oBAAoB;IACpB,eAAe;IACf,qBAAqB;CACtB,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,CAAC;IAC1C,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS;QAC/B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACzC,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACnE,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;IACvE,EAAE,EAAE,MAAM,CAAC,EAAE;IACb,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;CAC3B,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG,CAClB,KAAc,EAC+B,EAAE,CAC/C,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,KAAK,CAAC;AAEzD,MAAM,YAAY,GAAG,CACnB,GAAiB,EACmB,EAAE;IACtC,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC,aAAa,CAAC,CAAC;IAClD,OAAO,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;AACrD,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa,EAAE;IAC7C,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1B,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC;YAC1C,WAAW,EAAE,KAAK,CAAC,KAAK;YACxB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,SAAS,EAAE,YAAY,CAAC,GAAG,CAAC;SAC7B,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;YACnB,OAAO,MAAM,CAAC,EAAE,CAAC;gBACf,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;gBAC3B,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;gBAC5B,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC;QAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,MAAM,CAAC,EAAE,CAAC;gBACf,KAAK,EAAE,gBAAgB;gBACvB,SAAS,EAAE,qBAAqB;gBAChC,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC,EAAE,CAAC;YACf,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC;YAC9B,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;IACL,CAAC;IACD,QAAQ,EAAE;QACR;YACE,KAAK,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE;YAC9B,IAAI,EAAE,gBAAgB;SACvB;KACF;IACD,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC;KAC5D,CAAC;IACF,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE;IACpC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC5B,SAAS,EAAE,mBAAmB,CAAC,QAAQ,EAAE;QACzC,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE;QAC/B,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;KACnB,CAAC;IACF,UAAU,EAAE,CAAC,aAAa,CAAC;CAC5B,CAAC,CAAC"}

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@ontrails/permits",
-  "version": "1.0.0-beta.12",
+  "version": "1.0.0-beta.14",
   "type": "module",
   "exports": {
     ".": "./src/index.ts",
-    "./jwt": "./src/adapters/jwt.ts",
+    "./jwt": "./src/connectors/jwt.ts",
     "./package.json": "./package.json"
   },
   "scripts": {
@@ -15,7 +15,7 @@
     "clean": "rm -rf dist *.tsbuildinfo"
   },
   "peerDependencies": {
-    "@ontrails/core": "^1.0.0-beta.12",
+    "@ontrails/core": "^1.0.0-beta.13",
     "zod": "^4.3.5"
   }
 }

package/src/__tests__/{auth-layer.test.ts → auth-gate.test.ts}

@@ -1,11 +1,11 @@
-/* oxlint-disable require-await -- layer wrappers satisfy async interfaces without awaiting */
+/* oxlint-disable require-await -- gate wrappers satisfy async interfaces without awaiting */
 import { describe, expect, test } from 'bun:test';
 
 import { Result, trail } from '@ontrails/core';
 import type { TrailContext } from '@ontrails/core';
 import { z } from 'zod';
 
-import { authLayer } from '../auth-layer';
+import { authGate } from '../auth-gate';
 import { PermitError } from '../errors';
 
 // ---------------------------------------------------------------------------
@@ -16,9 +16,9 @@ const makeCtx = (permit?: {
   id: string;
   scopes: readonly string[];
 }): TrailContext => ({
+  abortSignal: AbortSignal.timeout(5000),
   permit,
   requestId: 'test-auth',
-  signal: AbortSignal.timeout(5000),
 });
 
 const okImpl = async () => Result.ok({ done: true });
@@ -27,21 +27,21 @@ const okImpl = async () => Result.ok({ done: true });
 // Tests
 // ---------------------------------------------------------------------------
 
-describe('authLayer', () => {
+describe('authGate', () => {
   test('has correct name and description', () => {
-    expect(authLayer.name).toBe('auth');
-    expect(authLayer.description).toBeDefined();
+    expect(authGate.name).toBe('auth');
+    expect(authGate.description).toBeDefined();
   });
 
   describe('pass-through cases', () => {
     test('passes through when trail has no permit field', async () => {
       const t = trail('test.nopermit', {
+        blaze: okImpl,
         input: z.object({}),
         output: z.object({ done: z.boolean() }),
-        run: okImpl,
       });
 
-      const wrapped = authLayer.wrap(t, okImpl);
+      const wrapped = authGate.wrap(t, okImpl);
       const result = await wrapped({}, makeCtx());
 
       expect(result.isOk()).toBe(true);
@@ -50,13 +50,13 @@ describe('authLayer', () => {
 
     test('passes through when trail permit is public', async () => {
       const t = trail('test.public', {
+        blaze: okImpl,
         input: z.object({}),
         output: z.object({ done: z.boolean() }),
         permit: 'public',
-        run: okImpl,
       });
 
-      const wrapped = authLayer.wrap(t, okImpl);
+      const wrapped = authGate.wrap(t, okImpl);
       const result = await wrapped({}, makeCtx());
 
       expect(result.isOk()).toBe(true);
@@ -66,14 +66,14 @@ describe('authLayer', () => {
 
   describe('scope enforcement', () => {
     const scopedTrail = trail('test.scoped', {
+      blaze: okImpl,
       input: z.object({}),
       output: z.object({ done: z.boolean() }),
       permit: { scopes: ['user:read'] },
-      run: okImpl,
     });
 
     test('passes when ctx.permit has matching scopes', async () => {
-      const wrapped = authLayer.wrap(scopedTrail, okImpl);
+      const wrapped = authGate.wrap(scopedTrail, okImpl);
       const result = await wrapped(
         {},
         makeCtx({ id: 'usr-1', scopes: ['user:read'] })
@@ -84,7 +84,7 @@ describe('authLayer', () => {
     });
 
     test('returns error when ctx has no permit', async () => {
-      const wrapped = authLayer.wrap(scopedTrail, okImpl);
+      const wrapped = authGate.wrap(scopedTrail, okImpl);
       const result = await wrapped({}, makeCtx());
 
       expect(result.isErr()).toBe(true);
@@ -95,13 +95,13 @@ describe('authLayer', () => {
 
     test('returns error when permit is missing required scopes', async () => {
       const multiScopeTrail = trail('test.multi', {
+        blaze: okImpl,
         input: z.object({}),
         output: z.object({ done: z.boolean() }),
         permit: { scopes: ['user:read', 'user:write'] },
-        run: okImpl,
       });
 
-      const wrapped = authLayer.wrap(multiScopeTrail, okImpl);
+      const wrapped = authGate.wrap(multiScopeTrail, okImpl);
       const result = await wrapped(
         {},
         makeCtx({ id: 'usr-1', scopes: ['user:read'] })
@@ -114,7 +114,7 @@ describe('authLayer', () => {
     });
 
     test('passes when permit has superset of required scopes', async () => {
-      const wrapped = authLayer.wrap(scopedTrail, okImpl);
+      const wrapped = authGate.wrap(scopedTrail, okImpl);
       const result = await wrapped(
         {},
         makeCtx({

package/src/__tests__/{auth-service.test.ts → auth-provision.test.ts}

@@ -1,9 +1,9 @@
 import { describe, expect, test } from 'bun:test';
 
-import type { ServiceContext } from '@ontrails/core';
+import type { ProvisionContext } from '@ontrails/core';
 
-import type { AuthAdapter } from '../adapter.js';
-import { authService } from '../auth-service.js';
+import type { AuthConnector } from '../connectors/connector.js';
+import { authProvision } from '../auth-provision.js';
 import type { PermitExtractionInput } from '../extraction.js';
 
 /** Minimal extraction input for tests. */
@@ -11,7 +11,7 @@ const testInput = (
   overrides?: Partial<PermitExtractionInput>
 ): PermitExtractionInput => ({
   requestId: 'test-svc-req',
-  surface: 'http',
+  trailhead: 'http',
   ...overrides,
 });
 
@@ -19,7 +19,7 @@ const testInput = (
 // Helpers
 // ---------------------------------------------------------------------------
 
-const testSvcCtx: ServiceContext = {
+const testSvcCtx: ProvisionContext = {
   config: undefined,
   cwd: '/tmp',
   env: {},
@@ -30,32 +30,32 @@ const testSvcCtx: ServiceContext = {
 // Tests
 // ---------------------------------------------------------------------------
 
-describe('authService', () => {
+describe('authProvision', () => {
   test('has correct id and kind', () => {
-    expect(authService.id).toBe('auth');
-    expect(authService.kind).toBe('service');
+    expect(authProvision.id).toBe('auth');
+    expect(authProvision.kind).toBe('provision');
   });
 
-  test('has infrastructure metadata', () => {
-    expect(authService.metadata).toEqual({ category: 'infrastructure' });
+  test('has infrastructure meta', () => {
+    expect(authProvision.meta).toEqual({ category: 'infrastructure' });
   });
 
-  test('mock returns an AuthAdapter', async () => {
-    const mock = authService.mock?.();
+  test('mock returns an AuthConnector', async () => {
+    const mock = authProvision.mock?.();
     expect(mock).toBeDefined();
 
-    const adapter = mock as AuthAdapter;
-    const result = await adapter.authenticate(testInput());
+    const connector = mock as AuthConnector;
+    const result = await connector.authenticate(testInput());
     expect(result.isOk()).toBe(true);
     expect(result.unwrap()).toBeNull();
   });
 
-  test('create returns Result.ok with an AuthAdapter', async () => {
-    const result = await authService.create(testSvcCtx);
+  test('create returns Result.ok with an AuthConnector', async () => {
+    const result = await authProvision.create(testSvcCtx);
     expect(result.isOk()).toBe(true);
 
-    const adapter = result.unwrap() as AuthAdapter;
-    const authResult = await adapter.authenticate(testInput());
+    const connector = result.unwrap() as AuthConnector;
+    const authResult = await connector.authenticate(testInput());
     expect(authResult.isOk()).toBe(true);
     expect(authResult.unwrap()).toBeNull();
   });

package/src/__tests__/auth-verify.test.ts

@@ -2,14 +2,14 @@ import { describe, expect, test } from 'bun:test';
 
 import {
   Result,
-  SURFACE_KEY,
+  TRAILHEAD_KEY,
   ValidationError,
   executeTrail,
 } from '@ontrails/core';
 
-import type { AuthAdapter } from '../adapter.js';
-import { authService } from '../auth-service.js';
-import { createJwtAdapter } from '../adapters/jwt.js';
+import type { AuthConnector } from '../connectors/connector.js';
+import { authProvision } from '../auth-provision.js';
+import { createJwtConnector } from '../connectors/jwt.js';
 import type { Permit } from '../permit.js';
 import { authVerify } from '../trails/auth-verify.js';
 
@@ -55,15 +55,16 @@ const signJwt = async (
 
 const TEST_SECRET = 'test-secret-for-hmac-256';
 
-/** Create an AuthAdapter wired to a JWT secret. */
-const jwtAdapter = (): AuthAdapter => createJwtAdapter({ secret: TEST_SECRET });
+/** Create an AuthConnector wired to a JWT secret. */
+const jwtConnector = (): AuthConnector =>
+  createJwtConnector({ secret: TEST_SECRET });
 
-/** Execute auth.verify with a given adapter injected as the auth service. */
+/** Execute auth.verify with a given connector injected as the auth provision. */
 const runVerify = async (
   token: string,
-  adapter: AuthAdapter,
+  connector: AuthConnector,
   options?: {
-    surface?: 'http' | 'mcp' | 'cli';
+    trailhead?: 'http' | 'mcp' | 'cli';
   }
 ): Promise<
   Result<
@@ -91,10 +92,10 @@ const runVerify = async (
     { token },
     {
       ctx:
-        options?.surface === undefined
+        options?.trailhead === undefined
           ? undefined
-          : { extensions: { [SURFACE_KEY]: options.surface } },
-      services: { [authService.id]: adapter },
+          : { extensions: { [TRAILHEAD_KEY]: options.trailhead } },
+      provisions: { [authProvision.id]: connector },
     }
   );
   return result as Result<
@@ -124,8 +125,8 @@ describe('auth.verify trail', () => {
       expect(authVerify.intent).toBe('read');
     });
 
-    test('has infrastructure metadata', () => {
-      expect(authVerify.metadata).toEqual({ category: 'infrastructure' });
+    test('has infrastructure meta', () => {
+      expect(authVerify.meta).toEqual({ category: 'infrastructure' });
     });
 
     test('has examples', () => {
@@ -133,20 +134,20 @@ describe('auth.verify trail', () => {
       expect(authVerify.examples?.length).toBeGreaterThan(0);
     });
 
-    test('declares authService dependency', () => {
-      expect(authVerify.services).toHaveLength(1);
-      expect(authVerify.services[0]?.id).toBe('auth');
+    test('declares authProvision dependency', () => {
+      expect(authVerify.provisions).toHaveLength(1);
+      expect(authVerify.provisions[0]?.id).toBe('auth');
     });
   });
 
-  describe('with mock adapter (no credentials)', () => {
+  describe('with mock connector (no credentials)', () => {
     test('returns valid: false with error message', async () => {
-      const noopAdapter: AuthAdapter = {
+      const noopConnector: AuthConnector = {
         // oxlint-disable-next-line require-await -- satisfies async interface
         authenticate: async () => Result.ok(null),
       };
 
-      const result = await runVerify('some-token', noopAdapter);
+      const result = await runVerify('some-token', noopConnector);
 
       expect(result.isOk()).toBe(true);
       const value = result.unwrap();
@@ -165,7 +166,7 @@ describe('auth.verify trail', () => {
         TEST_SECRET
       );
 
-      const result = await runVerify(token, jwtAdapter());
+      const result = await runVerify(token, jwtConnector());
 
       expect(result.isOk()).toBe(true);
       const value = result.unwrap();
@@ -177,7 +178,7 @@ describe('auth.verify trail', () => {
       expect(value.error).toBeUndefined();
     });
 
-    test('returns the full permit payload from the adapter', async () => {
+    test('returns the full permit payload from the connector', async () => {
       const permit: Permit = {
         id: 'user-42',
         metadata: { plan: 'pro' },
@@ -185,12 +186,12 @@ describe('auth.verify trail', () => {
         scopes: ['read', 'write'],
         tenantId: 'tenant-1',
       };
-      const adapter: AuthAdapter = {
+      const connector: AuthConnector = {
         // oxlint-disable-next-line require-await -- satisfies async interface
         authenticate: async () => Result.ok(permit),
       };
 
-      const result = await runVerify('full-permit-token', adapter);
+      const result = await runVerify('full-permit-token', connector);
 
       expect(result.isOk()).toBe(true);
       expect(result.unwrap().permit).toEqual({
@@ -202,12 +203,12 @@ describe('auth.verify trail', () => {
       });
     });
 
-    test('forwards the invoking surface from trail context', async () => {
-      let seenSurface: string | undefined;
-      const adapter: AuthAdapter = {
-        // oxlint-disable-next-line require-await -- captures adapter input
+    test('forwards the invoking trailhead from trail context', async () => {
+      let seenTrailhead: string | undefined;
+      const connector: AuthConnector = {
+        // oxlint-disable-next-line require-await -- captures connector input
         authenticate: async (input) => {
-          seenSurface = input.surface;
+          seenTrailhead = input.trailhead;
           return Result.ok({
             id: 'user-42',
             scopes: ['read'],
@@ -215,12 +216,12 @@ describe('auth.verify trail', () => {
         },
       };
 
-      const result = await runVerify('surface-aware-token', adapter, {
-        surface: 'mcp',
+      const result = await runVerify('trailhead-aware-token', connector, {
+        trailhead: 'mcp',
       });
 
       expect(result.isOk()).toBe(true);
-      expect(seenSurface).toBe('mcp');
+      expect(seenTrailhead).toBe('mcp');
     });
   });
 
@@ -232,7 +233,7 @@ describe('auth.verify trail', () => {
         'wrong-secret'
       );
 
-      const result = await runVerify(token, jwtAdapter());
+      const result = await runVerify(token, jwtConnector());
 
       expect(result.isOk()).toBe(true);
       const value = result.unwrap();
@@ -249,7 +250,7 @@ describe('auth.verify trail', () => {
         TEST_SECRET
       );
 
-      const result = await runVerify(token, jwtAdapter());
+      const result = await runVerify(token, jwtConnector());
 
       expect(result.isOk()).toBe(true);
       const value = result.unwrap();
@@ -266,7 +267,7 @@ describe('auth.verify trail', () => {
         authVerify,
         { token: '' },
         {
-          services: { [authService.id]: jwtAdapter() },
+          provisions: { [authProvision.id]: jwtConnector() },
         }
       );