@ontrails/permits 1.0.0-beta.12 → 1.0.0-beta.14

package/src/extraction.ts

@@ -1,18 +1,18 @@
 /**
- * Normalized input for auth adapters.
+ * Normalized input for auth connectors.
  *
- * Each surface extracts raw credentials from its transport and normalizes
- * them into this shape. No surface types (Request, McpSession, etc.) cross
+ * Each trailhead extracts raw credentials from its transport and normalizes
+ * them into this shape. No trailhead types (Request, McpSession, etc.) cross
  * into core — only this interface.
  */
 export interface PermitExtractionInput {
-  /** Which surface produced this extraction */
-  readonly surface: 'http' | 'mcp' | 'cli';
+  /** Which trailhead produced this extraction */
+  readonly trailhead: 'http' | 'mcp' | 'cli';
   /** Bearer token from Authorization header or equivalent */
   readonly bearerToken?: string;
   /** Session identifier from transport handshake */
   readonly sessionId?: string;
-  /** Raw headers (HTTP surface only, typically) */
+  /** Raw headers (HTTP trailhead only, typically) */
   readonly headers?: Headers;
   /** Correlation ID for tracing */
   readonly requestId: string;

package/src/index.ts

@@ -1,11 +1,14 @@
 export {
-  type AuthAdapter,
+  type AuthConnector,
   type AuthCredentials,
   type AuthError,
-} from './adapter.js';
-export { createJwtAdapter, type JwtAdapterOptions } from './adapters/jwt.js';
-export { authLayer } from './auth-layer.js';
-export { authService } from './auth-service.js';
+} from './connectors/connector.js';
+export {
+  createJwtConnector,
+  type JwtConnectorOptions,
+} from './connectors/jwt.js';
+export { authGate } from './auth-gate.js';
+export { authProvision } from './auth-provision.js';
 export { authVerify } from './trails/auth-verify.js';
 export { PermitError } from './errors.js';
 export { type PermitExtractionInput } from './extraction.js';

package/src/permit.ts

@@ -11,8 +11,8 @@ export interface Permit extends BasePermit {
  * Type-safe accessor for `ctx.permit` with a downcast to `Permit`.
  *
  * `TrailContext.permit` is typed as `BasePermit` (id + scopes). This accessor
- * returns the full `Permit` when the auth layer has set one. Safe because
- * the auth layer is the only writer and always sets a full `Permit`.
+ * returns the full `Permit` when the auth gate has set one. Safe because
+ * the auth gate is the only writer and always sets a full `Permit`.
  *
  * @example
  * ```typescript

package/src/trails/auth-verify.ts

@@ -1,8 +1,8 @@
-import { Result, SURFACE_KEY, trail } from '@ontrails/core';
+import { Result, TRAILHEAD_KEY, trail } from '@ontrails/core';
 import type { TrailContext } from '@ontrails/core';
 import { z } from 'zod';
 
-import { authService } from '../auth-service.js';
+import { authProvision } from '../auth-provision.js';
 import type { PermitExtractionInput } from '../extraction.js';
 import type { Permit } from '../permit.js';
 
@@ -30,45 +30,32 @@ const toOutputPermit = (permit: Permit) => ({
   scopes: [...permit.scopes],
 });
 
-const isSurface = (value: unknown): value is PermitExtractionInput['surface'] =>
+const isTrailhead = (
+  value: unknown
+): value is PermitExtractionInput['trailhead'] =>
   value === 'http' || value === 'mcp' || value === 'cli';
 
-const getSurface = (ctx: TrailContext): PermitExtractionInput['surface'] => {
-  const surface = ctx.extensions?.[SURFACE_KEY];
-  return isSurface(surface) ? surface : 'http';
+const getTrailhead = (
+  ctx: TrailContext
+): PermitExtractionInput['trailhead'] => {
+  const trailhead = ctx.extensions?.[TRAILHEAD_KEY];
+  return isTrailhead(trailhead) ? trailhead : 'http';
 };
 
 /**
  * Infrastructure trail that verifies a bearer token and returns the resolved permit.
  *
- * Reads the auth adapter from `authService` — the adapter is configured at
- * bootstrap (e.g. JWT with HMAC secret). The mock adapter always succeeds with
- * a null permit, so `testAll(app)` works without configuration.
+ * Reads the auth connector from `authProvision` — the connector is configured
+ * at bootstrap (e.g. JWT with HMAC secret). The mock connector always
+ * succeeds with a null permit, so `testAll(app)` works without configuration.
  */
 export const authVerify = trail('auth.verify', {
-  examples: [
-    {
-      input: { token: 'test-token' },
-      name: 'Verify a token',
-    },
-  ],
-  input: z.object({
-    token: z.string().min(1).describe('Bearer token to verify'),
-  }),
-  intent: 'read',
-  metadata: { category: 'infrastructure' },
-  output: z.object({
-    error: z.string().optional(),
-    errorCode: authErrorCodeSchema.optional(),
-    permit: permitSchema.optional(),
-    valid: z.boolean(),
-  }),
-  run: async (input, ctx) => {
-    const adapter = authService.from(ctx);
-    const result = await adapter.authenticate({
+  blaze: async (input, ctx) => {
+    const connector = authProvision.from(ctx);
+    const result = await connector.authenticate({
       bearerToken: input.token,
       requestId: ctx.requestId,
-      surface: getSurface(ctx),
+      trailhead: getTrailhead(ctx),
     });
 
     if (result.isErr()) {
@@ -93,5 +80,22 @@ export const authVerify = trail('auth.verify', {
       valid: true,
     });
   },
-  services: [authService],
+  examples: [
+    {
+      input: { token: 'test-token' },
+      name: 'Verify a token',
+    },
+  ],
+  input: z.object({
+    token: z.string().min(1).describe('Bearer token to verify'),
+  }),
+  intent: 'read',
+  meta: { category: 'infrastructure' },
+  output: z.object({
+    error: z.string().optional(),
+    errorCode: authErrorCodeSchema.optional(),
+    permit: permitSchema.optional(),
+    valid: z.boolean(),
+  }),
+  provisions: [authProvision],
 });

package/tsconfig.tsbuildinfo

@@ -1 +1 @@
-{"root":["./src/adapter.ts","./src/auth-layer.ts","./src/auth-service.ts","./src/errors.ts","./src/extraction.ts","./src/index.ts","./src/permit.ts","./src/rules.ts","./src/testing.ts","./src/adapters/jwt.ts","./src/trails/auth-verify.ts"],"version":"5.9.3"}
+{"root":["./src/auth-gate.ts","./src/auth-provision.ts","./src/errors.ts","./src/extraction.ts","./src/index.ts","./src/permit.ts","./src/rules.ts","./src/testing.ts","./src/connectors/connector.ts","./src/connectors/jwt.ts","./src/trails/auth-verify.ts"],"version":"5.9.3"}

package/src/auth-service.ts

@@ -1,25 +0,0 @@
-import { Result, service } from '@ontrails/core';
-
-import type { AuthAdapter } from './adapter.js';
-
-/**
- * Auth service — manages the auth adapter lifecycle.
- *
- * The v1 factory returns a no-op adapter that always succeeds (null permit).
- * Real adapter configuration will come through `ServiceSpec.config` (TRL-91).
- * The mock factory provides a synthetic adapter that always succeeds.
- */
-export const authService = service<AuthAdapter>('auth', {
-  create: (_svc) =>
-    Result.ok({
-      // oxlint-disable-next-line require-await -- stub adapter satisfies async interface
-      authenticate: async () => Result.ok(null),
-    } satisfies AuthAdapter),
-  description: 'Authentication adapter',
-  metadata: { category: 'infrastructure' },
-  mock: () =>
-    ({
-      // oxlint-disable-next-line require-await -- mock adapter satisfies async interface
-      authenticate: async () => Result.ok(null),
-    }) satisfies AuthAdapter,
-});