@ontrails/permits 1.0.0-beta.13 → 1.0.0-beta.15

package/.turbo/turbo-lint.log

@@ -1,3 +1,3 @@
 $ oxlint ./src
 Found 0 warnings and 0 errors.
-Finished in 44ms on 18 files with 93 rules using 24 threads.
+Finished in 73ms on 18 files with 93 rules using 24 threads.

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # @ontrails/permits
 
+## 1.0.0-beta.15
+
+### Patch Changes
+
+- Updated dependencies [4ad6b25]
+  - @ontrails/core@1.0.0-beta.15
+
+## 1.0.0-beta.14
+
+### Minor Changes
+
+- 69057e9: Add hierarchical CLI command trees and structured input, enforce established-only topo exports across trailheads, move developer topo and tracker state onto shared `trails.db` with pins and maintenance flows, and ship schema-derived stores through `@ontrails/store` and its Drizzle runtime.
+
+### Patch Changes
+
+- Updated dependencies [69057e9]
+  - @ontrails/core@1.0.0-beta.14
+
 ## 1.0.0-beta.13
 
 ### Minor Changes

package/README.md

@@ -0,0 +1,175 @@
+# @ontrails/permits
+
+Scope-based authorization for Trails.
+
+The permits package owns the connector-agnostic `authResource` and `authLayer`. Connector packages bind those declarations to concrete auth logic, just like a surface connector binds a topo to CLI, MCP, or HTTP.
+
+## The core pattern
+
+### 1. Declare permit requirements on trails
+
+```typescript
+export const create = trail('gist.create', {
+  permit: { scopes: ['gist:write'] },
+  blaze: async (input, ctx) => {
+    // authLayer enforces scopes before blaze runs
+    return Result.ok(newGist);
+  },
+});
+
+export const search = trail('gist.search', {
+  permit: 'public',
+  blaze: async (input, ctx) => {
+    // No authentication required
+    return Result.ok(results);
+  },
+});
+```
+
+### 2. Register the auth layer
+
+```typescript
+import { authLayer } from '@ontrails/permits';
+
+export const graph = topo('my-app', gistModule);
+// Register authLayer with your surface
+```
+
+The layer reads each trail's `permit` field:
+
+- `'public'` or `undefined` — layer passes through
+- `{ scopes: [...] }` — layer checks that `ctx.permit` contains all required scopes
+
+### 3. Bind a connector at bootstrap
+
+```typescript
+import { createJwtConnector } from '@ontrails/permits/jwt';
+
+const connector = createJwtConnector({
+  secret: process.env.JWT_SECRET,
+  issuer: 'https://auth.example.com',
+  audience: 'api.example.com',
+});
+```
+
+## Auth connectors
+
+An auth connector authenticates requests and produces permits.
+
+### Built-in: JWT connector
+
+Verifies HS256-signed JWTs and extracts claims into permits:
+
+```typescript
+import { createJwtConnector } from '@ontrails/permits/jwt';
+
+const connector = createJwtConnector({
+  secret: 'your-hmac-secret',
+  issuer: 'https://auth.example.com',
+  audience: 'api.example.com',
+  scopesClaim: 'scope',
+  rolesClaim: 'roles',
+});
+```
+
+### Custom connectors
+
+Implement the `AuthConnector` interface:
+
+```typescript
+import type { AuthConnector, PermitExtractionInput, Permit } from '@ontrails/permits';
+
+const myConnector: AuthConnector = {
+  authenticate: async (input: PermitExtractionInput) => {
+    if (!input.bearerToken) return Result.ok(null);
+    const permit: Permit = {
+      id: 'user-42',
+      scopes: ['user:read', 'user:write'],
+      roles: ['admin'],
+    };
+    return Result.ok(permit);
+  },
+};
+```
+
+## Permits and scopes
+
+A `Permit` is the resolved identity and scopes from successful authentication:
+
+```typescript
+interface Permit {
+  readonly id: string;
+  readonly scopes: readonly string[];
+  readonly roles?: readonly string[];
+  readonly tenantId?: string;
+  readonly metadata?: Readonly<Record<string, unknown>>;
+}
+```
+
+Access the permit in your blaze:
+
+```typescript
+import { getPermit } from '@ontrails/permits';
+
+const myTrail = trail('do.something', {
+  blaze: async (_input, ctx) => {
+    const permit = getPermit(ctx);
+    if (!permit) return Result.err(new Error('Not authenticated'));
+    return Result.ok({ userId: permit.id });
+  },
+});
+```
+
+Scopes follow the `entity:action` convention: `user:read`, `gist:write`, etc.
+
+## The auth.verify trail
+
+An infrastructure trail that verifies bearer tokens and returns permits:
+
+```typescript
+import { authVerify } from '@ontrails/permits';
+
+// Returns { valid: true, permit: { id, scopes, roles } }
+// or { valid: false, error: 'Token has expired', errorCode: 'expired_token' }
+```
+
+## Testing with mock permits
+
+Use `createTestPermit()` and `createPermitForTrail()` in tests:
+
+```typescript
+import { createTestPermit, createPermitForTrail } from '@ontrails/permits';
+
+const permit = createTestPermit({
+  id: 'user-123',
+  scopes: ['gist:read', 'gist:write'],
+  roles: ['editor'],
+});
+
+// Create a permit matching a trail's requirements
+const trailPermit = createPermitForTrail(myTrail);
+// { id: 'test-...', scopes: ['gist:write'] }
+```
+
+## Permit governance
+
+Use `validatePermits()` to check trails against governance rules:
+
+```typescript
+import { validatePermits } from '@ontrails/permits';
+
+const diagnostics = validatePermits(app.list());
+```
+
+Built-in rules:
+
+- `destroyWithoutPermit` — error if a destroy trail has no permit
+- `writeWithoutPermit` — warning if a write trail has no permit
+- `scopeNamingConsistency` — warning if a scope doesn't follow `entity:action`
+- `orphanScopeDetection` — warning if a scope appears in only one trail
+
+## Installation
+
+```bash
+bun add @ontrails/permits @ontrails/core zod
+```

package/dist/auth-layer.d.ts

@@ -9,9 +9,9 @@ import type { Layer } from '@ontrails/core';
  *   all required scopes. A superset is fine; missing scopes produce a
  *   `PermitError`.
  *
- * Because `ctx.follow()` re-enters `executeTrail` (which applies layers),
- * this layer automatically re-checks on every invocation in a follow chain.
- * No special follow-chain handling is needed — it is built into the
+ * Because `ctx.cross()` re-enters `executeTrail` (which applies layers),
+ * this layer automatically re-checks on every invocation in a crossing chain.
+ * No special crossing-chain handling is needed — it is built into the
  * architecture.
  */
 export declare const authLayer: Layer;

package/dist/auth-layer.js

@@ -25,9 +25,9 @@ const findMissing = (required, held) => required.filter((s) => !held.includes(s)
  *   all required scopes. A superset is fine; missing scopes produce a
  *   `PermitError`.
  *
- * Because `ctx.follow()` re-enters `executeTrail` (which applies layers),
- * this layer automatically re-checks on every invocation in a follow chain.
- * No special follow-chain handling is needed — it is built into the
+ * Because `ctx.cross()` re-enters `executeTrail` (which applies layers),
+ * this layer automatically re-checks on every invocation in a crossing chain.
+ * No special crossing-chain handling is needed — it is built into the
  * architecture.
  */
 export const authLayer = {

package/dist/auth-resource.d.ts

@@ -0,0 +1,11 @@
+import type { AuthConnector } from './connectors/connector.js';
+/**
+ * Auth resource — manages the auth connector lifecycle.
+ *
+ * The v1 factory returns a no-op connector that always succeeds (null permit).
+ * Real connector configuration will come through `ResourceSpec.config`
+ * (TRL-91). The mock factory provides a synthetic connector that always
+ * succeeds.
+ */
+export declare const authResource: import("@ontrails/core").Resource<AuthConnector>;
+//# sourceMappingURL=auth-resource.d.ts.map

package/dist/auth-resource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-resource.d.ts","sourceRoot":"","sources":["../src/auth-resource.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE/D;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,kDAavB,CAAC"}

package/dist/auth-resource.js

@@ -0,0 +1,22 @@
+import { Result, resource } from '@ontrails/core';
+/**
+ * Auth resource — manages the auth connector lifecycle.
+ *
+ * The v1 factory returns a no-op connector that always succeeds (null permit).
+ * Real connector configuration will come through `ResourceSpec.config`
+ * (TRL-91). The mock factory provides a synthetic connector that always
+ * succeeds.
+ */
+export const authResource = resource('auth', {
+    create: (_svc) => Result.ok({
+        // oxlint-disable-next-line require-await -- stub connector satisfies async interface
+        authenticate: async () => Result.ok(null),
+    }),
+    description: 'Authentication connector',
+    meta: { category: 'infrastructure' },
+    mock: () => ({
+        // oxlint-disable-next-line require-await -- mock connector satisfies async interface
+        authenticate: async () => Result.ok(null),
+    }),
+});
+//# sourceMappingURL=auth-resource.js.map

package/dist/auth-resource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-resource.js","sourceRoot":"","sources":["../src/auth-resource.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAIlD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,QAAQ,CAAgB,MAAM,EAAE;IAC1D,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CACf,MAAM,CAAC,EAAE,CAAC;QACR,qFAAqF;QACrF,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC;KAClB,CAAC;IAC5B,WAAW,EAAE,0BAA0B;IACvC,IAAI,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE;IACpC,IAAI,EAAE,GAAG,EAAE,CACT,CAAC;QACC,qFAAqF;QACrF,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC;KAC1C,CAAyB;CAC7B,CAAC,CAAC"}

package/dist/{adapter.d.ts → connectors/connector.d.ts}

@@ -1,26 +1,26 @@
 import type { Result } from '@ontrails/core';
-import type { PermitExtractionInput } from './extraction.js';
-import type { Permit } from './permit.js';
+import type { PermitExtractionInput } from '../extraction.js';
+import type { Permit } from '../permit.js';
 /**
  * @deprecated Use {@link PermitExtractionInput} instead. Kept as an alias
  * for backward compatibility during migration.
  */
 export type AuthCredentials = PermitExtractionInput;
-/** Errors from auth adapters. */
+/** Errors from auth connectors. */
 export interface AuthError {
     readonly code: 'expired_token' | 'insufficient_scope' | 'invalid_token' | 'missing_credentials';
     readonly message: string;
 }
 /**
- * Auth adapter port. Given extraction input, produce a permit or an error.
+ * Auth connector port. Given extraction input, produce a permit or an error.
  *
- * The adapter receives the full {@link PermitExtractionInput} — surface,
+ * The connector receives the full {@link PermitExtractionInput} — trailhead,
  * headers, requestId, and credential fields — so it can make richer
- * decisions (e.g., rate-limit by surface or correlate via requestId).
+ * decisions (e.g., rate-limit by trailhead or correlate via requestId).
  *
  * Deliberately narrow — no session management, no token refresh.
  */
-export interface AuthAdapter {
+export interface AuthConnector {
     readonly authenticate: (input: PermitExtractionInput) => Promise<Result<Permit | null, AuthError>>;
 }
-//# sourceMappingURL=adapter.d.ts.map
+//# sourceMappingURL=connector.d.ts.map

package/dist/connectors/connector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connector.d.ts","sourceRoot":"","sources":["../../src/connectors/connector.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAE7C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAEpD,mCAAmC;AACnC,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EACT,eAAe,GACf,oBAAoB,GACpB,eAAe,GACf,qBAAqB,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,YAAY,EAAE,CACrB,KAAK,EAAE,qBAAqB,KACzB,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;CAChD"}

package/dist/connectors/connector.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=connector.js.map

package/dist/connectors/connector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connector.js","sourceRoot":"","sources":["../../src/connectors/connector.ts"],"names":[],"mappings":""}

package/dist/{adapters → connectors}/jwt.d.ts

@@ -1,6 +1,6 @@
-import type { AuthAdapter } from '../adapter.js';
-/** Configuration for the JWT auth adapter. */
-export interface JwtAdapterOptions {
+import type { AuthConnector } from './connector.js';
+/** Configuration for the JWT auth connector. */
+export interface JwtConnectorOptions {
     /** HMAC secret for HS256 verification. */
     readonly secret?: string;
     /** JWKS endpoint for RS256/ES256 (not yet implemented). */
@@ -15,11 +15,11 @@ export interface JwtAdapterOptions {
     readonly rolesClaim?: string;
 }
 /**
- * Create a JWT auth adapter using Bun's native crypto.
+ * Create a JWT auth connector using Bun's native crypto.
  *
  * Verifies HS256-signed JWTs, extracts claims into a Permit, and checks
  * issuer/audience when configured. Returns `Result.ok(null)` when no
  * credentials are provided.
  */
-export declare const createJwtAdapter: (options: JwtAdapterOptions) => AuthAdapter;
+export declare const createJwtConnector: (options: JwtConnectorOptions) => AuthConnector;
 //# sourceMappingURL=jwt.d.ts.map

package/dist/connectors/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../src/connectors/jwt.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAa,MAAM,gBAAgB,CAAC;AAI/D,gDAAgD;AAChD,MAAM,WAAW,mBAAmB;IAClC,0CAA0C;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,2DAA2D;IAC3D,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,6BAA6B;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,+BAA+B;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,kDAAkD;IAClD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,iDAAiD;IACjD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AA2LD;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,GAC7B,SAAS,mBAAmB,KAC3B,aAeF,CAAC"}

package/dist/{adapters → connectors}/jwt.js

@@ -126,13 +126,13 @@ const payloadToPermit = (payload, options) => {
 // Factory
 // ---------------------------------------------------------------------------
 /**
- * Create a JWT auth adapter using Bun's native crypto.
+ * Create a JWT auth connector using Bun's native crypto.
  *
  * Verifies HS256-signed JWTs, extracts claims into a Permit, and checks
  * issuer/audience when configured. Returns `Result.ok(null)` when no
  * credentials are provided.
  */
-export const createJwtAdapter = (options) => {
+export const createJwtConnector = (options) => {
     const authenticate = async (input) => {
         if (!input.bearerToken) {
             return Result.ok(null);

package/dist/connectors/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../src/connectors/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AA+BxC,8EAA8E;AAC9E,mCAAmC;AACnC,8EAA8E;AAE9E,MAAM,OAAO,GAAG,CACd,IAAuB,EACvB,OAAe,EACW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AAE7D,0CAA0C;AAC1C,MAAM,eAAe,GAAG,CAAC,KAAa,EAAc,EAAE;IACpD,MAAM,MAAM,GAAG,KAAK;SACjB,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;SACpB,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;SACpB,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,4DAA4D;AAC5D,MAAM,aAAa,GAAG,CAAC,KAAa,EAA0B,EAAE;IAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC,CAAC;AAEF,4CAA4C;AAC5C,MAAM,aAAa,GAAG,CAAC,MAAc,EAAsB,EAAE;IAC3D,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EACtB,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,EACjC,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;AACJ,CAAC,CAAC;AAEF,iDAAiD;AACjD,MAAM,mBAAmB,GAAG,CAC1B,KAAa,EACb,GAAc,EACI,EAAE;IACpB,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;QACnB,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CACzB,MAAM,EACN,GAAG,EACH,SAAS,CAAC,MAAqB,EAC/B,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CACrB,CAAC;AACJ,CAAC,CAAC;AAEF,gDAAgD;AAChD,MAAM,cAAc,GAAG,CACrB,OAAmB,EACnB,OAA4B,EACL,EAAE;IACzB,IACE,OAAO,CAAC,GAAG,KAAK,SAAS;QACzB,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAC3C,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;IACjE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QACrD,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;QACxB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAChC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC;YAChC,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC,QAAQ,CAAC;QAC7B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;QACjE,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,6EAA6E;AAC7E,MAAM,aAAa,GAAG,CACpB,OAAmB,EACnB,KAAa,EACM,EAAE;IACrB,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,MAAM,CACf,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAC1D,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC,CAAC;AAEF,yDAAyD;AACzD,MAAM,YAAY,GAAG,CACnB,OAAmB,EACnB,KAAa,EACkB,EAAE;IACjC,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;AAC/D,CAAC,CAAC;AAEF,mDAAmD;AACnD,MAAM,WAAW,GAAG,CAClB,OAAmB,EACnB,OAA4B,EACD,EAAE;IAC7B,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACjB,OAAO,OAAO,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC,EAAE,CAAC;QACf,EAAE,EAAE,OAAO,CAAC,GAAG;QACf,MAAM,EAAE,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC;QAC9D,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5B,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,wEAAwE;AACxE,MAAM,eAAe,GAAG,KAAK,EAC3B,KAAa,EACb,MAAc,EAC0B,EAAE;IAC1C,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,OAAO,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACpD,OAAO,KAAK;YACV,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC;YACpB,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,eAAe,EAAE,2BAA2B,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC,CAAC;AAEF,kEAAkE;AAClE,MAAM,eAAe,GAAG,CACtB,OAAmB,EACnB,OAA4B,EACD,EAAE;IAC7B,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACpD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AACvC,CAAC,CAAC;AAEF,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,OAA4B,EACb,EAAE;IACjB,MAAM,YAAY,GAAG,KAAK,EACxB,KAA4B,EACe,EAAE;QAC7C,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YACvB,OAAO,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,OAAO,OAAO,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACzE,OAAO,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC7E,CAAC,CAAC;IAEF,OAAO,EAAE,YAAY,EAAE,CAAC;AAC1B,CAAC,CAAC"}

package/dist/extraction.d.ts

@@ -1,18 +1,18 @@
 /**
- * Normalized input for auth adapters.
+ * Normalized input for auth connectors.
  *
- * Each surface extracts raw credentials from its transport and normalizes
- * them into this shape. No surface types (Request, McpSession, etc.) cross
+ * Each trailhead extracts raw credentials from its transport and normalizes
+ * them into this shape. No trailhead types (Request, McpSession, etc.) cross
  * into core — only this interface.
  */
 export interface PermitExtractionInput {
-    /** Which surface produced this extraction */
-    readonly surface: 'http' | 'mcp' | 'cli';
+    /** Which trailhead produced this extraction */
+    readonly trailhead: 'http' | 'mcp' | 'cli';
     /** Bearer token from Authorization header or equivalent */
     readonly bearerToken?: string;
     /** Session identifier from transport handshake */
     readonly sessionId?: string;
-    /** Raw headers (HTTP surface only, typically) */
+    /** Raw headers (HTTP trailhead only, typically) */
     readonly headers?: Headers;
     /** Correlation ID for tracing */
     readonly requestId: string;

package/dist/extraction.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extraction.d.ts","sourceRoot":"","sources":["../src/extraction.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,6CAA6C;IAC7C,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,GAAG,KAAK,CAAC;IACzC,2DAA2D;IAC3D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,kDAAkD;IAClD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,iDAAiD;IACjD,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,iCAAiC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B"}
+{"version":3,"file":"extraction.d.ts","sourceRoot":"","sources":["../src/extraction.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,KAAK,GAAG,KAAK,CAAC;IAC3C,2DAA2D;IAC3D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,kDAAkD;IAClD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,mDAAmD;IACnD,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,iCAAiC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B"}

package/dist/index.d.ts

@@ -1,11 +1,11 @@
-export { type AuthAdapter, type AuthCredentials, type AuthError, } from './adapter.js';
-export { createJwtAdapter, type JwtAdapterOptions } from './adapters/jwt.js';
+export { type AuthConnector, type AuthCredentials, type AuthError, } from './connectors/connector.js';
+export { createJwtConnector, type JwtConnectorOptions, } from './connectors/jwt.js';
 export { authLayer } from './auth-layer.js';
-export { authService } from './auth-service.js';
+export { authResource } from './auth-resource.js';
 export { authVerify } from './trails/auth-verify.js';
 export { PermitError } from './errors.js';
 export { type PermitExtractionInput } from './extraction.js';
 export { type Permit, getPermit } from './permit.js';
 export { validatePermits, type PermitDiagnostic } from './rules.js';
-export { mintTestPermit, mintPermitForTrail } from './testing.js';
+export { createTestPermit, createPermitForTrail } from './testing.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,SAAS,GACf,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,gBAAgB,EAAE,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,KAAK,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,KAAK,MAAM,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,KAAK,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,SAAS,GACf,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,kBAAkB,EAClB,KAAK,mBAAmB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,KAAK,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,KAAK,MAAM,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,KAAK,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -1,11 +1,11 @@
-export {} from './adapter.js';
-export { createJwtAdapter } from './adapters/jwt.js';
+export {} from './connectors/connector.js';
+export { createJwtConnector, } from './connectors/jwt.js';
 export { authLayer } from './auth-layer.js';
-export { authService } from './auth-service.js';
+export { authResource } from './auth-resource.js';
 export { authVerify } from './trails/auth-verify.js';
 export { PermitError } from './errors.js';
 export {} from './extraction.js';
 export { getPermit } from './permit.js';
 export { validatePermits } from './rules.js';
-export { mintTestPermit, mintPermitForTrail } from './testing.js';
+export { createTestPermit, createPermitForTrail } from './testing.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,gBAAgB,EAA0B,MAAM,mBAAmB,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAA8B,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAe,SAAS,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,eAAe,EAAyB,MAAM,YAAY,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,kBAAkB,GAEnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAA8B,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAe,SAAS,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,eAAe,EAAyB,MAAM,YAAY,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC"}

package/dist/rules.d.ts

@@ -6,7 +6,7 @@ export interface PermitDiagnostic {
     readonly severity: 'error' | 'warning';
     readonly message: string;
 }
-type AnyTrail = Trail<unknown, unknown>;
+type AnyTrail = Trail<unknown, unknown, unknown>;
 type Rule = (trails: readonly AnyTrail[]) => readonly PermitDiagnostic[];
 /**
  * Destructive trails without a real permit declaration are a governance failure.
@@ -42,6 +42,6 @@ export declare const orphanScopeDetection: Rule;
  * Returns a flat array of diagnostics from every rule. An empty array
  * means the topo passes all permit governance checks.
  */
-export declare const validatePermits: (trails: readonly Trail<unknown, unknown>[]) => readonly PermitDiagnostic[];
+export declare const validatePermits: (trails: readonly Trail<unknown, unknown, unknown>[]) => readonly PermitDiagnostic[];
 export {};
 //# sourceMappingURL=rules.d.ts.map

package/dist/rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../src/rules.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAM5C,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAMD,KAAK,QAAQ,GAAG,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AACxC,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,SAAS,QAAQ,EAAE,KAAK,SAAS,gBAAgB,EAAE,CAAC;AAiBzE;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,IAU5B,CAAC;AAMR;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,IAU1B,CAAC;AAgBR;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,EAAE,IAUlC,CAAC;AA2CJ;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,IAMlC,CAAC;AAaF;;;;;GAKG;AACH,eAAO,MAAM,eAAe,GAC1B,QAAQ,SAAS,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,KACzC,SAAS,gBAAgB,EAA8C,CAAC"}
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../src/rules.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAM5C,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAMD,KAAK,QAAQ,GAAG,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACjD,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,SAAS,QAAQ,EAAE,KAAK,SAAS,gBAAgB,EAAE,CAAC;AAiBzE;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,IAU5B,CAAC;AAMR;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,IAU1B,CAAC;AAgBR;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,EAAE,IAUlC,CAAC;AA2CJ;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,IAMlC,CAAC;AAaF;;;;;GAKG;AACH,eAAO,MAAM,eAAe,GAC1B,QAAQ,SAAS,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,KAClD,SAAS,gBAAgB,EAA8C,CAAC"}

package/dist/rules.js.map

@@ -1 +1 @@
-{"version":3,"file":"rules.js","sourceRoot":"","sources":["../src/rules.ts"],"names":[],"mappings":"AAqBA,oFAAoF;AACpF,MAAM,SAAS,GAAG,CAAC,CAAW,EAAW,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC;AAEnE,wEAAwE;AACxE,MAAM,SAAS,GAAG,CAAC,CAAW,EAAqB,EAAE;IACnD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACpD,OAAO,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;IACzB,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC,CAAC;AAEF,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAS,CAAC,MAAM,EAAE,EAAE,CACnD,MAAM;KACH,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAC1E;KACA,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACX,OAAO,EAAE,UAAU,CAAC,CAAC,EAAE,kDAAkD;IACzE,IAAI,EAAE,sBAAsB;IAC5B,QAAQ,EAAE,OAAgB;IAC1B,OAAO,EAAE,CAAC,CAAC,EAAE;CACd,CAAC,CAAC,CAAC;AAER,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAS,CAAC,MAAM,EAAE,EAAE,CACjD,MAAM;KACH,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CACzE;KACA,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACX,OAAO,EAAE,UAAU,CAAC,CAAC,EAAE,8CAA8C;IACrE,IAAI,EAAE,oBAAoB;IAC1B,QAAQ,EAAE,SAAkB;IAC5B,OAAO,EAAE,CAAC,CAAC,EAAE;CACd,CAAC,CAAC,CAAC;AAER,8EAA8E;AAC9E,+BAA+B;AAC/B,8EAA8E;AAE9E,wEAAwE;AACxE,MAAM,kBAAkB,GAAG,CAAC,KAAa,EAAW,EAAE;IACpD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,CACL,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;QAC3B,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAC5B,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAS,CAAC,MAAM,EAAE,EAAE,CACrD,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CACnB,SAAS,CAAC,CAAC,CAAC;KACT,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;KAC7C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACf,OAAO,EAAE,UAAU,KAAK,eAAe,CAAC,CAAC,EAAE,4CAA4C;IACvF,IAAI,EAAE,wBAAwB;IAC9B,QAAQ,EAAE,SAAkB;IAC5B,OAAO,EAAE,CAAC,CAAC,EAAE;CACd,CAAC,CAAC,CACN,CAAC;AAEJ,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E,gEAAgE;AAChE,MAAM,aAAa,GAAG,CACpB,MAA2B,EACe,EAAE;IAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,QAAQ,EAAE,CAAC;gBACb,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACrB,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,wEAAwE;AACxE,MAAM,sBAAsB,GAAG,CAC7B,MAA2B,EACN,EAAE,CACvB,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;AAExE,yDAAyD;AACzD,MAAM,iBAAiB,GAAG,CACxB,QAAkD,EACrB,EAAE,CAC/B,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;KACpB,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC;KACnC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;IACtB,OAAO,EAAE,UAAU,KAAK,4BAA4B,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,mBAAmB;IAClF,IAAI,EAAE,sBAAsB;IAC5B,QAAQ,EAAE,SAAkB;IAC5B,OAAO,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;CAC3B,CAAC,CAAC,CAAC;AAER;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAS,CAAC,MAAM,EAAE,EAAE;IACnD,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,iBAAiB,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;AAClD,CAAC,CAAC;AAEF,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E,MAAM,QAAQ,GAAoB;IAChC,oBAAoB;IACpB,kBAAkB;IAClB,sBAAsB;IACtB,oBAAoB;CACrB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,MAA0C,EACb,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC"}
+{"version":3,"file":"rules.js","sourceRoot":"","sources":["../src/rules.ts"],"names":[],"mappings":"AAqBA,oFAAoF;AACpF,MAAM,SAAS,GAAG,CAAC,CAAW,EAAW,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC;AAEnE,wEAAwE;AACxE,MAAM,SAAS,GAAG,CAAC,CAAW,EAAqB,EAAE;IACnD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACpD,OAAO,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;IACzB,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC,CAAC;AAEF,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAS,CAAC,MAAM,EAAE,EAAE,CACnD,MAAM;KACH,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAC1E;KACA,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACX,OAAO,EAAE,UAAU,CAAC,CAAC,EAAE,kDAAkD;IACzE,IAAI,EAAE,sBAAsB;IAC5B,QAAQ,EAAE,OAAgB;IAC1B,OAAO,EAAE,CAAC,CAAC,EAAE;CACd,CAAC,CAAC,CAAC;AAER,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAS,CAAC,MAAM,EAAE,EAAE,CACjD,MAAM;KACH,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CACzE;KACA,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACX,OAAO,EAAE,UAAU,CAAC,CAAC,EAAE,8CAA8C;IACrE,IAAI,EAAE,oBAAoB;IAC1B,QAAQ,EAAE,SAAkB;IAC5B,OAAO,EAAE,CAAC,CAAC,EAAE;CACd,CAAC,CAAC,CAAC;AAER,8EAA8E;AAC9E,+BAA+B;AAC/B,8EAA8E;AAE9E,wEAAwE;AACxE,MAAM,kBAAkB,GAAG,CAAC,KAAa,EAAW,EAAE;IACpD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,CACL,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;QAC3B,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAC5B,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAS,CAAC,MAAM,EAAE,EAAE,CACrD,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CACnB,SAAS,CAAC,CAAC,CAAC;KACT,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;KAC7C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACf,OAAO,EAAE,UAAU,KAAK,eAAe,CAAC,CAAC,EAAE,4CAA4C;IACvF,IAAI,EAAE,wBAAwB;IAC9B,QAAQ,EAAE,SAAkB;IAC5B,OAAO,EAAE,CAAC,CAAC,EAAE;CACd,CAAC,CAAC,CACN,CAAC;AAEJ,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E,gEAAgE;AAChE,MAAM,aAAa,GAAG,CACpB,MAA2B,EACe,EAAE;IAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,QAAQ,EAAE,CAAC;gBACb,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACrB,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,wEAAwE;AACxE,MAAM,sBAAsB,GAAG,CAC7B,MAA2B,EACN,EAAE,CACvB,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;AAExE,yDAAyD;AACzD,MAAM,iBAAiB,GAAG,CACxB,QAAkD,EACrB,EAAE,CAC/B,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;KACpB,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC;KACnC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;IACtB,OAAO,EAAE,UAAU,KAAK,4BAA4B,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,mBAAmB;IAClF,IAAI,EAAE,sBAAsB;IAC5B,QAAQ,EAAE,SAAkB;IAC5B,OAAO,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;CAC3B,CAAC,CAAC,CAAC;AAER;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAS,CAAC,MAAM,EAAE,EAAE;IACnD,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,iBAAiB,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;AAClD,CAAC,CAAC;AAEF,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E,MAAM,QAAQ,GAAoB;IAChC,oBAAoB;IACpB,kBAAkB;IAClB,sBAAsB;IACtB,oBAAoB;CACrB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,MAAmD,EACtB,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC"}

package/dist/testing.d.ts

@@ -1,10 +1,10 @@
 import type { PermitRequirement } from '@ontrails/core';
 import type { Permit } from './permit.js';
 /**
- * Mint a synthetic test permit with exactly the declared scopes.
+ * Create a synthetic test permit with exactly the declared scopes.
  * No admin permit, no wildcard — tests get only what the trail declares.
  */
-export declare const mintTestPermit: (options?: {
+export declare const createTestPermit: (options?: {
     readonly id?: string;
     readonly scopes?: readonly string[];
     readonly roles?: readonly string[];
@@ -12,9 +12,9 @@ export declare const mintTestPermit: (options?: {
 }) => Permit;
 /**
  * Create a test permit matching a trail's permit requirement.
- * Extracts scopes from the requirement and mints a permit with exactly those scopes.
+ * Extracts scopes from the requirement and creates a permit with exactly those scopes.
  */
-export declare const mintPermitForTrail: (trail: {
+export declare const createPermitForTrail: (trail: {
     readonly permit?: PermitRequirement | undefined;
 }) => Permit | undefined;
 //# sourceMappingURL=testing.d.ts.map

package/dist/testing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAExD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C;;;GAGG;AACH,eAAO,MAAM,cAAc,GAAI,UAAU;IACvC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B,KAAG,MAOF,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,kBAAkB,GAAI,OAAO;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;CACjD,KAAG,MAAM,GAAG,SAKZ,CAAC"}
+{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAExD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C;;;GAGG;AACH,eAAO,MAAM,gBAAgB,GAAI,UAAU;IACzC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B,KAAG,MAOF,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,oBAAoB,GAAI,OAAO;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;CACjD,KAAG,MAAM,GAAG,SAKZ,CAAC"}

package/dist/testing.js

@@ -1,8 +1,8 @@
 /**
- * Mint a synthetic test permit with exactly the declared scopes.
+ * Create a synthetic test permit with exactly the declared scopes.
  * No admin permit, no wildcard — tests get only what the trail declares.
  */
-export const mintTestPermit = (options) => ({
+export const createTestPermit = (options) => ({
     id: options?.id ??
         `test-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`,
     scopes: [...(options?.scopes ?? [])],
@@ -11,12 +11,12 @@ export const mintTestPermit = (options) => ({
 });
 /**
  * Create a test permit matching a trail's permit requirement.
- * Extracts scopes from the requirement and mints a permit with exactly those scopes.
+ * Extracts scopes from the requirement and creates a permit with exactly those scopes.
  */
-export const mintPermitForTrail = (trail) => {
+export const createPermitForTrail = (trail) => {
     if (!trail.permit || trail.permit === 'public') {
         return undefined;
     }
-    return mintTestPermit({ scopes: trail.permit.scopes });
+    return createTestPermit({ scopes: trail.permit.scopes });
 };
 //# sourceMappingURL=testing.js.map

package/dist/testing.js.map

@@ -1 +1 @@
-{"version":3,"file":"testing.js","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAIA;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAK9B,EAAU,EAAE,CAAC,CAAC;IACb,EAAE,EACA,OAAO,EAAE,EAAE;QACX,QAAQ,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;IAChE,MAAM,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;IACpC,GAAG,CAAC,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;IACtE,GAAG,CAAC,OAAO,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;CAC3E,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,KAElC,EAAsB,EAAE;IACvB,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,cAAc,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AACzD,CAAC,CAAC"}
+{"version":3,"file":"testing.js","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAIA;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAKhC,EAAU,EAAE,CAAC,CAAC;IACb,EAAE,EACA,OAAO,EAAE,EAAE;QACX,QAAQ,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;IAChE,MAAM,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;IACpC,GAAG,CAAC,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;IACtE,GAAG,CAAC,OAAO,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;CAC3E,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,KAEpC,EAAsB,EAAE;IACvB,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,gBAAgB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AAC3D,CAAC,CAAC"}

package/dist/trails/auth-verify.d.ts

@@ -1,9 +1,9 @@
 /**
  * Infrastructure trail that verifies a bearer token and returns the resolved permit.
  *
- * Reads the auth adapter from `authService` — the adapter is configured at
- * bootstrap (e.g. JWT with HMAC secret). The mock adapter always succeeds with
- * a null permit, so `testAll(app)` works without configuration.
+ * Reads the auth connector from `authResource` — the connector is configured
+ * at bootstrap (e.g. JWT with HMAC secret). The mock connector always
+ * succeeds with a null permit, so `testAll(app)` works without configuration.
  */
 export declare const authVerify: import("@ontrails/core").Trail<{
     token: string;
@@ -18,5 +18,5 @@ export declare const authVerify: import("@ontrails/core").Trail<{
         roles?: string[] | undefined;
         tenantId?: string | undefined;
     } | undefined;
-}>;
+}, never>;
 //# sourceMappingURL=auth-verify.d.ts.map

package/dist/trails/auth-verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-verify.d.ts","sourceRoot":"","sources":["../../src/trails/auth-verify.ts"],"names":[],"mappings":"AAwCA;;;;;;GAMG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;EAiDrB,CAAC"}
+{"version":3,"file":"auth-verify.d.ts","sourceRoot":"","sources":["../../src/trails/auth-verify.ts"],"names":[],"mappings":"AA4CA;;;;;;GAMG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;SAiDrB,CAAC"}