@ontrails/permits 1.0.0-beta.13 → 1.0.0-beta.15

package/dist/trails/auth-verify.js

@@ -1,6 +1,6 @@
-import { Result, SURFACE_KEY, trail } from '@ontrails/core';
+import { Result, TRAILHEAD_KEY, trail } from '@ontrails/core';
 import { z } from 'zod';
-import { authService } from '../auth-service.js';
+import { authResource } from '../auth-resource.js';
 const permitSchema = z.object({
     id: z.string(),
     metadata: z.record(z.string(), z.unknown()).optional(),
@@ -23,42 +23,25 @@ const toOutputPermit = (permit) => ({
     id: permit.id,
     scopes: [...permit.scopes],
 });
-const isSurface = (value) => value === 'http' || value === 'mcp' || value === 'cli';
-const getSurface = (ctx) => {
-    const surface = ctx.extensions?.[SURFACE_KEY];
-    return isSurface(surface) ? surface : 'http';
+const isTrailhead = (value) => value === 'http' || value === 'mcp' || value === 'cli';
+const getTrailhead = (ctx) => {
+    const trailhead = ctx.extensions?.[TRAILHEAD_KEY];
+    return isTrailhead(trailhead) ? trailhead : 'http';
 };
 /**
  * Infrastructure trail that verifies a bearer token and returns the resolved permit.
  *
- * Reads the auth adapter from `authService` — the adapter is configured at
- * bootstrap (e.g. JWT with HMAC secret). The mock adapter always succeeds with
- * a null permit, so `testAll(app)` works without configuration.
+ * Reads the auth connector from `authResource` — the connector is configured
+ * at bootstrap (e.g. JWT with HMAC secret). The mock connector always
+ * succeeds with a null permit, so `testAll(app)` works without configuration.
  */
 export const authVerify = trail('auth.verify', {
-    examples: [
-        {
-            input: { token: 'test-token' },
-            name: 'Verify a token',
-        },
-    ],
-    input: z.object({
-        token: z.string().min(1).describe('Bearer token to verify'),
-    }),
-    intent: 'read',
-    metadata: { category: 'infrastructure' },
-    output: z.object({
-        error: z.string().optional(),
-        errorCode: authErrorCodeSchema.optional(),
-        permit: permitSchema.optional(),
-        valid: z.boolean(),
-    }),
-    run: async (input, ctx) => {
-        const adapter = authService.from(ctx);
-        const result = await adapter.authenticate({
+    blaze: async (input, ctx) => {
+        const connector = authResource.from(ctx);
+        const result = await connector.authenticate({
             bearerToken: input.token,
             requestId: ctx.requestId,
-            surface: getSurface(ctx),
+            trailhead: getTrailhead(ctx),
         });
         if (result.isErr()) {
             return Result.ok({
@@ -80,6 +63,23 @@ export const authVerify = trail('auth.verify', {
             valid: true,
         });
     },
-    services: [authService],
+    examples: [
+        {
+            input: { token: 'test-token' },
+            name: 'Verify a token',
+        },
+    ],
+    input: z.object({
+        token: z.string().min(1).describe('Bearer token to verify'),
+    }),
+    intent: 'read',
+    meta: { category: 'infrastructure' },
+    output: z.object({
+        error: z.string().optional(),
+        errorCode: authErrorCodeSchema.optional(),
+        permit: permitSchema.optional(),
+        valid: z.boolean(),
+    }),
+    resources: [authResource],
 });
 //# sourceMappingURL=auth-verify.js.map

package/dist/trails/auth-verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-verify.js","sourceRoot":"","sources":["../../src/trails/auth-verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAE5D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAIjD,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AACH,MAAM,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC;IACjC,eAAe;IACf,oBAAoB;IACpB,eAAe;IACf,qBAAqB;CACtB,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,CAAC;IAC1C,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS;QAC/B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACzC,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACnE,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;IACvE,EAAE,EAAE,MAAM,CAAC,EAAE;IACb,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;CAC3B,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,CAAC,KAAc,EAA6C,EAAE,CAC9E,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,KAAK,CAAC;AAEzD,MAAM,UAAU,GAAG,CAAC,GAAiB,EAAoC,EAAE;IACzE,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC,WAAW,CAAC,CAAC;IAC9C,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AAC/C,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa,EAAE;IAC7C,QAAQ,EAAE;QACR;YACE,KAAK,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE;YAC9B,IAAI,EAAE,gBAAgB;SACvB;KACF;IACD,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC;KAC5D,CAAC;IACF,MAAM,EAAE,MAAM;IACd,QAAQ,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE;IACxC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC5B,SAAS,EAAE,mBAAmB,CAAC,QAAQ,EAAE;QACzC,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE;QAC/B,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;KACnB,CAAC;IACF,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACxB,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC;YACxC,WAAW,EAAE,KAAK,CAAC,KAAK;YACxB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC;SACzB,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;YACnB,OAAO,MAAM,CAAC,EAAE,CAAC;gBACf,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;gBAC3B,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;gBAC5B,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC;QAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,MAAM,CAAC,EAAE,CAAC;gBACf,KAAK,EAAE,gBAAgB;gBACvB,SAAS,EAAE,qBAAqB;gBAChC,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC,EAAE,CAAC;YACf,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC;YAC9B,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;IACL,CAAC;IACD,QAAQ,EAAE,CAAC,WAAW,CAAC;CACxB,CAAC,CAAC"}
+{"version":3,"file":"auth-verify.js","sourceRoot":"","sources":["../../src/trails/auth-verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAE9D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAInD,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AACH,MAAM,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC;IACjC,eAAe;IACf,oBAAoB;IACpB,eAAe;IACf,qBAAqB;CACtB,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,CAAC;IAC1C,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS;QAC/B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACzC,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACnE,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;IACvE,EAAE,EAAE,MAAM,CAAC,EAAE;IACb,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;CAC3B,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG,CAClB,KAAc,EAC+B,EAAE,CAC/C,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,KAAK,CAAC;AAEzD,MAAM,YAAY,GAAG,CACnB,GAAiB,EACmB,EAAE;IACtC,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC,aAAa,CAAC,CAAC;IAClD,OAAO,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;AACrD,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa,EAAE;IAC7C,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1B,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC;YAC1C,WAAW,EAAE,KAAK,CAAC,KAAK;YACxB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,SAAS,EAAE,YAAY,CAAC,GAAG,CAAC;SAC7B,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;YACnB,OAAO,MAAM,CAAC,EAAE,CAAC;gBACf,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;gBAC3B,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;gBAC5B,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC;QAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,MAAM,CAAC,EAAE,CAAC;gBACf,KAAK,EAAE,gBAAgB;gBACvB,SAAS,EAAE,qBAAqB;gBAChC,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC,EAAE,CAAC;YACf,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC;YAC9B,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;IACL,CAAC;IACD,QAAQ,EAAE;QACR;YACE,KAAK,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE;YAC9B,IAAI,EAAE,gBAAgB;SACvB;KACF;IACD,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC;KAC5D,CAAC;IACF,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE;IACpC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC5B,SAAS,EAAE,mBAAmB,CAAC,QAAQ,EAAE;QACzC,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE;QAC/B,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;KACnB,CAAC;IACF,SAAS,EAAE,CAAC,YAAY,CAAC;CAC1B,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ontrails/permits",
-  "version": "1.0.0-beta.13",
+  "version": "1.0.0-beta.15",
   "type": "module",
   "exports": {
     ".": "./src/index.ts",
@@ -15,7 +15,7 @@
     "clean": "rm -rf dist *.tsbuildinfo"
   },
   "peerDependencies": {
-    "@ontrails/core": "^1.0.0-beta.12",
+    "@ontrails/core": "^1.0.0-beta.14",
     "zod": "^4.3.5"
   }
 }

package/src/__tests__/{auth-gate.test.ts → auth-layer.test.ts}

@@ -1,11 +1,11 @@
-/* oxlint-disable require-await -- gate wrappers satisfy async interfaces without awaiting */
+/* oxlint-disable require-await -- layer wrappers satisfy async interfaces without awaiting */
 import { describe, expect, test } from 'bun:test';
 
 import { Result, trail } from '@ontrails/core';
 import type { TrailContext } from '@ontrails/core';
 import { z } from 'zod';
 
-import { authGate } from '../auth-gate';
+import { authLayer } from '../auth-layer';
 import { PermitError } from '../errors';
 
 // ---------------------------------------------------------------------------
@@ -27,10 +27,10 @@ const okImpl = async () => Result.ok({ done: true });
 // Tests
 // ---------------------------------------------------------------------------
 
-describe('authGate', () => {
+describe('authLayer', () => {
   test('has correct name and description', () => {
-    expect(authGate.name).toBe('auth');
-    expect(authGate.description).toBeDefined();
+    expect(authLayer.name).toBe('auth');
+    expect(authLayer.description).toBeDefined();
   });
 
   describe('pass-through cases', () => {
@@ -41,7 +41,7 @@ describe('authGate', () => {
         output: z.object({ done: z.boolean() }),
       });
 
-      const wrapped = authGate.wrap(t, okImpl);
+      const wrapped = authLayer.wrap(t, okImpl);
       const result = await wrapped({}, makeCtx());
 
       expect(result.isOk()).toBe(true);
@@ -56,7 +56,7 @@ describe('authGate', () => {
         permit: 'public',
       });
 
-      const wrapped = authGate.wrap(t, okImpl);
+      const wrapped = authLayer.wrap(t, okImpl);
       const result = await wrapped({}, makeCtx());
 
       expect(result.isOk()).toBe(true);
@@ -73,7 +73,7 @@ describe('authGate', () => {
     });
 
     test('passes when ctx.permit has matching scopes', async () => {
-      const wrapped = authGate.wrap(scopedTrail, okImpl);
+      const wrapped = authLayer.wrap(scopedTrail, okImpl);
       const result = await wrapped(
         {},
         makeCtx({ id: 'usr-1', scopes: ['user:read'] })
@@ -84,7 +84,7 @@ describe('authGate', () => {
     });
 
     test('returns error when ctx has no permit', async () => {
-      const wrapped = authGate.wrap(scopedTrail, okImpl);
+      const wrapped = authLayer.wrap(scopedTrail, okImpl);
       const result = await wrapped({}, makeCtx());
 
       expect(result.isErr()).toBe(true);
@@ -101,7 +101,7 @@ describe('authGate', () => {
         permit: { scopes: ['user:read', 'user:write'] },
       });
 
-      const wrapped = authGate.wrap(multiScopeTrail, okImpl);
+      const wrapped = authLayer.wrap(multiScopeTrail, okImpl);
       const result = await wrapped(
         {},
         makeCtx({ id: 'usr-1', scopes: ['user:read'] })
@@ -114,7 +114,7 @@ describe('authGate', () => {
     });
 
     test('passes when permit has superset of required scopes', async () => {
-      const wrapped = authGate.wrap(scopedTrail, okImpl);
+      const wrapped = authLayer.wrap(scopedTrail, okImpl);
       const result = await wrapped(
         {},
         makeCtx({

package/src/__tests__/{auth-provision.test.ts → auth-resource.test.ts}

@@ -1,9 +1,9 @@
 import { describe, expect, test } from 'bun:test';
 
-import type { ProvisionContext } from '@ontrails/core';
+import type { ResourceContext } from '@ontrails/core';
 
 import type { AuthConnector } from '../connectors/connector.js';
-import { authProvision } from '../auth-provision.js';
+import { authResource } from '../auth-resource.js';
 import type { PermitExtractionInput } from '../extraction.js';
 
 /** Minimal extraction input for tests. */
@@ -19,7 +19,7 @@ const testInput = (
 // Helpers
 // ---------------------------------------------------------------------------
 
-const testSvcCtx: ProvisionContext = {
+const testSvcCtx: ResourceContext = {
   config: undefined,
   cwd: '/tmp',
   env: {},
@@ -30,18 +30,18 @@ const testSvcCtx: ProvisionContext = {
 // Tests
 // ---------------------------------------------------------------------------
 
-describe('authProvision', () => {
+describe('authResource', () => {
   test('has correct id and kind', () => {
-    expect(authProvision.id).toBe('auth');
-    expect(authProvision.kind).toBe('provision');
+    expect(authResource.id).toBe('auth');
+    expect(authResource.kind).toBe('resource');
   });
 
   test('has infrastructure meta', () => {
-    expect(authProvision.meta).toEqual({ category: 'infrastructure' });
+    expect(authResource.meta).toEqual({ category: 'infrastructure' });
   });
 
   test('mock returns an AuthConnector', async () => {
-    const mock = authProvision.mock?.();
+    const mock = authResource.mock?.();
     expect(mock).toBeDefined();
 
     const connector = mock as AuthConnector;
@@ -51,7 +51,7 @@ describe('authProvision', () => {
   });
 
   test('create returns Result.ok with an AuthConnector', async () => {
-    const result = await authProvision.create(testSvcCtx);
+    const result = await authResource.create(testSvcCtx);
     expect(result.isOk()).toBe(true);
 
     const connector = result.unwrap() as AuthConnector;

package/src/__tests__/auth-verify.test.ts

@@ -8,7 +8,7 @@ import {
 } from '@ontrails/core';
 
 import type { AuthConnector } from '../connectors/connector.js';
-import { authProvision } from '../auth-provision.js';
+import { authResource } from '../auth-resource.js';
 import { createJwtConnector } from '../connectors/jwt.js';
 import type { Permit } from '../permit.js';
 import { authVerify } from '../trails/auth-verify.js';
@@ -59,7 +59,7 @@ const TEST_SECRET = 'test-secret-for-hmac-256';
 const jwtConnector = (): AuthConnector =>
   createJwtConnector({ secret: TEST_SECRET });
 
-/** Execute auth.verify with a given connector injected as the auth provision. */
+/** Execute auth.verify with a given connector injected as the auth resource. */
 const runVerify = async (
   token: string,
   connector: AuthConnector,
@@ -95,7 +95,7 @@ const runVerify = async (
         options?.trailhead === undefined
           ? undefined
           : { extensions: { [TRAILHEAD_KEY]: options.trailhead } },
-      provisions: { [authProvision.id]: connector },
+      resources: { [authResource.id]: connector },
     }
   );
   return result as Result<
@@ -134,9 +134,9 @@ describe('auth.verify trail', () => {
       expect(authVerify.examples?.length).toBeGreaterThan(0);
     });
 
-    test('declares authProvision dependency', () => {
-      expect(authVerify.provisions).toHaveLength(1);
-      expect(authVerify.provisions[0]?.id).toBe('auth');
+    test('declares authResource dependency', () => {
+      expect(authVerify.resources).toHaveLength(1);
+      expect(authVerify.resources[0]?.id).toBe('auth');
     });
   });
 
@@ -267,7 +267,7 @@ describe('auth.verify trail', () => {
         authVerify,
         { token: '' },
         {
-          provisions: { [authProvision.id]: jwtConnector() },
+          resources: { [authResource.id]: jwtConnector() },
         }
       );
 

package/src/__tests__/permit.test.ts

@@ -60,7 +60,7 @@ describe('getPermit()', () => {
     expect(result).toBeUndefined();
   });
 
-  test('preserves extended permit fields from the auth gate', () => {
+  test('preserves extended permit fields from the auth layer', () => {
     const ctx = {
       permit: {
         id: 'usr_2',

package/src/__tests__/testing.test.ts

@@ -1,57 +1,57 @@
 import { describe, expect, test } from 'bun:test';
 
-import { mintPermitForTrail, mintTestPermit } from '../testing';
+import { createPermitForTrail, createTestPermit } from '../testing';
 
-describe('mintTestPermit()', () => {
+describe('createTestPermit()', () => {
   test('returns a Permit with the given scopes', () => {
-    const permit = mintTestPermit({ scopes: ['user:read', 'user:write'] });
+    const permit = createTestPermit({ scopes: ['user:read', 'user:write'] });
     expect(permit.scopes).toEqual(['user:read', 'user:write']);
   });
 
   test('generates a unique id when not specified', () => {
-    const a = mintTestPermit();
-    const b = mintTestPermit();
+    const a = createTestPermit();
+    const b = createTestPermit();
     expect(a.id).not.toBe(b.id);
   });
 
   test('uses the provided id when specified', () => {
-    const permit = mintTestPermit({ id: 'custom-id' });
+    const permit = createTestPermit({ id: 'custom-id' });
     expect(permit.id).toBe('custom-id');
   });
 
   test('returns empty scopes when no options provided', () => {
-    const permit = mintTestPermit();
+    const permit = createTestPermit();
     expect(permit.scopes).toEqual([]);
   });
 
   test('includes roles when provided', () => {
-    const permit = mintTestPermit({ roles: ['admin', 'editor'] });
+    const permit = createTestPermit({ roles: ['admin', 'editor'] });
     expect(permit.roles).toEqual(['admin', 'editor']);
   });
 
   test('includes tenantId when provided', () => {
-    const permit = mintTestPermit({ tenantId: 'tenant_abc' });
+    const permit = createTestPermit({ tenantId: 'tenant_abc' });
     expect(permit.tenantId).toBe('tenant_abc');
   });
 });
 
-describe('mintPermitForTrail()', () => {
+describe('createPermitForTrail()', () => {
   test('extracts scopes from trail permit requirement', () => {
     const trail = { permit: { scopes: ['entity:read', 'entity:write'] } };
-    const permit = mintPermitForTrail(trail);
+    const permit = createPermitForTrail(trail);
     expect(permit).toBeDefined();
     expect(permit?.scopes).toEqual(['entity:read', 'entity:write']);
   });
 
   test('returns undefined for public trails', () => {
     const trail = { permit: 'public' as const };
-    const permit = mintPermitForTrail(trail);
+    const permit = createPermitForTrail(trail);
     expect(permit).toBeUndefined();
   });
 
   test('returns undefined when no permit declared', () => {
     const trail = {};
-    const permit = mintPermitForTrail(trail);
+    const permit = createPermitForTrail(trail);
     expect(permit).toBeUndefined();
   });
 });

package/src/{auth-gate.ts → auth-layer.ts}

@@ -1,5 +1,5 @@
 import { Result } from '@ontrails/core';
-import type { Gate } from '@ontrails/core';
+import type { Layer } from '@ontrails/core';
 
 import { PermitError } from './errors.js';
 import { getPermit } from './permit.js';
@@ -25,25 +25,25 @@ const findMissing = (
 ): readonly string[] => required.filter((s) => !held.includes(s));
 
 // ---------------------------------------------------------------------------
-// Auth gate
+// Auth layer
 // ---------------------------------------------------------------------------
 
 /**
- * A {@link Gate} that enforces permit scopes declared on trails.
+ * A {@link Layer} that enforces permit scopes declared on trails.
  *
- * The gate reads the trail's `permit` field (a `PermitRequirement`):
+ * The layer reads the trail's `permit` field (a `PermitRequirement`):
  *
- * - If `permit` is `'public'` or `undefined` the gate passes through.
- * - If `permit` has `scopes`, the gate checks that `ctx.permit` contains
+ * - If `permit` is `'public'` or `undefined` the layer passes through.
+ * - If `permit` has `scopes`, the layer checks that `ctx.permit` contains
  *   all required scopes. A superset is fine; missing scopes produce a
  *   `PermitError`.
  *
- * Because `ctx.cross()` re-enters `executeTrail` (which applies gates),
- * this gate automatically re-checks on every invocation in a crossing chain.
+ * Because `ctx.cross()` re-enters `executeTrail` (which applies layers),
+ * this layer automatically re-checks on every invocation in a crossing chain.
  * No special crossing-chain handling is needed — it is built into the
  * architecture.
  */
-export const authGate: Gate = {
+export const authLayer: Layer = {
   description: 'Enforces permit scopes declared on trails',
   name: 'auth',
   wrap: (_trail, impl) => {

package/src/{auth-provision.ts → auth-resource.ts}

@@ -1,16 +1,16 @@
-import { Result, provision } from '@ontrails/core';
+import { Result, resource } from '@ontrails/core';
 
 import type { AuthConnector } from './connectors/connector.js';
 
 /**
- * Auth provision — manages the auth connector lifecycle.
+ * Auth resource — manages the auth connector lifecycle.
  *
  * The v1 factory returns a no-op connector that always succeeds (null permit).
- * Real connector configuration will come through `ProvisionSpec.config`
+ * Real connector configuration will come through `ResourceSpec.config`
  * (TRL-91). The mock factory provides a synthetic connector that always
  * succeeds.
  */
-export const authProvision = provision<AuthConnector>('auth', {
+export const authResource = resource<AuthConnector>('auth', {
   create: (_svc) =>
     Result.ok({
       // oxlint-disable-next-line require-await -- stub connector satisfies async interface

package/src/index.ts

@@ -7,11 +7,11 @@ export {
   createJwtConnector,
   type JwtConnectorOptions,
 } from './connectors/jwt.js';
-export { authGate } from './auth-gate.js';
-export { authProvision } from './auth-provision.js';
+export { authLayer } from './auth-layer.js';
+export { authResource } from './auth-resource.js';
 export { authVerify } from './trails/auth-verify.js';
 export { PermitError } from './errors.js';
 export { type PermitExtractionInput } from './extraction.js';
 export { type Permit, getPermit } from './permit.js';
 export { validatePermits, type PermitDiagnostic } from './rules.js';
-export { mintTestPermit, mintPermitForTrail } from './testing.js';
+export { createTestPermit, createPermitForTrail } from './testing.js';

package/src/permit.ts

@@ -11,8 +11,8 @@ export interface Permit extends BasePermit {
  * Type-safe accessor for `ctx.permit` with a downcast to `Permit`.
  *
  * `TrailContext.permit` is typed as `BasePermit` (id + scopes). This accessor
- * returns the full `Permit` when the auth gate has set one. Safe because
- * the auth gate is the only writer and always sets a full `Permit`.
+ * returns the full `Permit` when the auth layer has set one. Safe because
+ * the auth layer is the only writer and always sets a full `Permit`.
  *
  * @example
  * ```typescript

package/src/rules.ts

@@ -16,7 +16,7 @@ export interface PermitDiagnostic {
 // Helpers
 // ---------------------------------------------------------------------------
 
-type AnyTrail = Trail<unknown, unknown>;
+type AnyTrail = Trail<unknown, unknown, unknown>;
 type Rule = (trails: readonly AnyTrail[]) => readonly PermitDiagnostic[];
 
 /** Check whether a trail has any permit declaration (scopes object or 'public'). */
@@ -179,5 +179,5 @@ const allRules: readonly Rule[] = [
  * means the topo passes all permit governance checks.
  */
 export const validatePermits = (
-  trails: readonly Trail<unknown, unknown>[]
+  trails: readonly Trail<unknown, unknown, unknown>[]
 ): readonly PermitDiagnostic[] => allRules.flatMap((rule) => rule(trails));

package/src/testing.ts

@@ -3,10 +3,10 @@ import type { PermitRequirement } from '@ontrails/core';
 import type { Permit } from './permit.js';
 
 /**
- * Mint a synthetic test permit with exactly the declared scopes.
+ * Create a synthetic test permit with exactly the declared scopes.
  * No admin permit, no wildcard — tests get only what the trail declares.
  */
-export const mintTestPermit = (options?: {
+export const createTestPermit = (options?: {
   readonly id?: string;
   readonly scopes?: readonly string[];
   readonly roles?: readonly string[];
@@ -22,13 +22,13 @@ export const mintTestPermit = (options?: {
 
 /**
  * Create a test permit matching a trail's permit requirement.
- * Extracts scopes from the requirement and mints a permit with exactly those scopes.
+ * Extracts scopes from the requirement and creates a permit with exactly those scopes.
  */
-export const mintPermitForTrail = (trail: {
+export const createPermitForTrail = (trail: {
   readonly permit?: PermitRequirement | undefined;
 }): Permit | undefined => {
   if (!trail.permit || trail.permit === 'public') {
     return undefined;
   }
-  return mintTestPermit({ scopes: trail.permit.scopes });
+  return createTestPermit({ scopes: trail.permit.scopes });
 };

package/src/trails/auth-verify.ts

@@ -2,7 +2,7 @@ import { Result, TRAILHEAD_KEY, trail } from '@ontrails/core';
 import type { TrailContext } from '@ontrails/core';
 import { z } from 'zod';
 
-import { authProvision } from '../auth-provision.js';
+import { authResource } from '../auth-resource.js';
 import type { PermitExtractionInput } from '../extraction.js';
 import type { Permit } from '../permit.js';
 
@@ -45,13 +45,13 @@ const getTrailhead = (
 /**
  * Infrastructure trail that verifies a bearer token and returns the resolved permit.
  *
- * Reads the auth connector from `authProvision` — the connector is configured
+ * Reads the auth connector from `authResource` — the connector is configured
  * at bootstrap (e.g. JWT with HMAC secret). The mock connector always
  * succeeds with a null permit, so `testAll(app)` works without configuration.
  */
 export const authVerify = trail('auth.verify', {
   blaze: async (input, ctx) => {
-    const connector = authProvision.from(ctx);
+    const connector = authResource.from(ctx);
     const result = await connector.authenticate({
       bearerToken: input.token,
       requestId: ctx.requestId,
@@ -97,5 +97,5 @@ export const authVerify = trail('auth.verify', {
     permit: permitSchema.optional(),
     valid: z.boolean(),
   }),
-  provisions: [authProvision],
+  resources: [authResource],
 });

package/tsconfig.tests.json

@@ -0,0 +1,10 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "noEmit": true,
+    "rootDir": "./src",
+    "types": ["bun"]
+  },
+  "include": ["src/**/*.test.ts", "src/__tests__/**/*.ts"],
+  "exclude": []
+}

package/tsconfig.tsbuildinfo

@@ -1 +1 @@
-{"root":["./src/adapter.ts","./src/auth-layer.ts","./src/auth-service.ts","./src/errors.ts","./src/extraction.ts","./src/index.ts","./src/permit.ts","./src/rules.ts","./src/testing.ts","./src/adapters/jwt.ts","./src/trails/auth-verify.ts"],"version":"5.9.3"}
+{"root":["./src/auth-layer.ts","./src/auth-resource.ts","./src/errors.ts","./src/extraction.ts","./src/index.ts","./src/permit.ts","./src/rules.ts","./src/testing.ts","./src/connectors/connector.ts","./src/connectors/jwt.ts","./src/trails/auth-verify.ts"],"version":"5.9.3"}

package/dist/adapter.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAE7C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAEpD,iCAAiC;AACjC,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EACT,eAAe,GACf,oBAAoB,GACpB,eAAe,GACf,qBAAqB,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,YAAY,EAAE,CACrB,KAAK,EAAE,qBAAqB,KACzB,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;CAChD"}

package/dist/adapter.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=adapter.js.map

package/dist/adapter.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"adapter.js","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":""}

package/dist/adapters/jwt.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../src/adapters/jwt.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAa,MAAM,eAAe,CAAC;AAI5D,8CAA8C;AAC9C,MAAM,WAAW,iBAAiB;IAChC,0CAA0C;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,2DAA2D;IAC3D,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,6BAA6B;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,+BAA+B;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,kDAAkD;IAClD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,iDAAiD;IACjD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AA2LD;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,GAAI,SAAS,iBAAiB,KAAG,WAe7D,CAAC"}

package/dist/adapters/jwt.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../src/adapters/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AA+BxC,8EAA8E;AAC9E,mCAAmC;AACnC,8EAA8E;AAE9E,MAAM,OAAO,GAAG,CACd,IAAuB,EACvB,OAAe,EACW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AAE7D,0CAA0C;AAC1C,MAAM,eAAe,GAAG,CAAC,KAAa,EAAc,EAAE;IACpD,MAAM,MAAM,GAAG,KAAK;SACjB,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;SACpB,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;SACpB,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,4DAA4D;AAC5D,MAAM,aAAa,GAAG,CAAC,KAAa,EAA0B,EAAE;IAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC,CAAC;AAEF,4CAA4C;AAC5C,MAAM,aAAa,GAAG,CAAC,MAAc,EAAsB,EAAE;IAC3D,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EACtB,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,EACjC,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;AACJ,CAAC,CAAC;AAEF,iDAAiD;AACjD,MAAM,mBAAmB,GAAG,CAC1B,KAAa,EACb,GAAc,EACI,EAAE;IACpB,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;QACnB,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CACzB,MAAM,EACN,GAAG,EACH,SAAS,CAAC,MAAqB,EAC/B,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CACrB,CAAC;AACJ,CAAC,CAAC;AAEF,gDAAgD;AAChD,MAAM,cAAc,GAAG,CACrB,OAAmB,EACnB,OAA0B,EACH,EAAE;IACzB,IACE,OAAO,CAAC,GAAG,KAAK,SAAS;QACzB,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAC3C,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;IACjE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QACrD,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;QACxB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAChC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC;YAChC,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC,QAAQ,CAAC;QAC7B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;QACjE,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,6EAA6E;AAC7E,MAAM,aAAa,GAAG,CACpB,OAAmB,EACnB,KAAa,EACM,EAAE;IACrB,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,MAAM,CACf,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAC1D,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC,CAAC;AAEF,yDAAyD;AACzD,MAAM,YAAY,GAAG,CACnB,OAAmB,EACnB,KAAa,EACkB,EAAE;IACjC,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;AAC/D,CAAC,CAAC;AAEF,mDAAmD;AACnD,MAAM,WAAW,GAAG,CAClB,OAAmB,EACnB,OAA0B,EACC,EAAE;IAC7B,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACjB,OAAO,OAAO,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC,EAAE,CAAC;QACf,EAAE,EAAE,OAAO,CAAC,GAAG;QACf,MAAM,EAAE,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC;QAC9D,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5B,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,wEAAwE;AACxE,MAAM,eAAe,GAAG,KAAK,EAC3B,KAAa,EACb,MAAc,EAC0B,EAAE;IAC1C,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,OAAO,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACpD,OAAO,KAAK;YACV,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC;YACpB,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,eAAe,EAAE,2BAA2B,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC,CAAC;AAEF,kEAAkE;AAClE,MAAM,eAAe,GAAG,CACtB,OAAmB,EACnB,OAA0B,EACC,EAAE;IAC7B,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACpD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AACvC,CAAC,CAAC;AAEF,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAA0B,EAAe,EAAE;IAC1E,MAAM,YAAY,GAAG,KAAK,EACxB,KAA4B,EACe,EAAE;QAC7C,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YACvB,OAAO,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,OAAO,OAAO,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACzE,OAAO,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC7E,CAAC,CAAC;IAEF,OAAO,EAAE,YAAY,EAAE,CAAC;AAC1B,CAAC,CAAC"}

package/dist/auth-service.d.ts

@@ -1,10 +0,0 @@
-import type { AuthAdapter } from './adapter.js';
-/**
- * Auth service — manages the auth adapter lifecycle.
- *
- * The v1 factory returns a no-op adapter that always succeeds (null permit).
- * Real adapter configuration will come through `ServiceSpec.config` (TRL-91).
- * The mock factory provides a synthetic adapter that always succeeds.
- */
-export declare const authService: import("@ontrails/core").Service<AuthAdapter>;
-//# sourceMappingURL=auth-service.d.ts.map

package/dist/auth-service.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-service.d.ts","sourceRoot":"","sources":["../src/auth-service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,+CAatB,CAAC"}

package/dist/auth-service.js

@@ -1,21 +0,0 @@
-import { Result, service } from '@ontrails/core';
-/**
- * Auth service — manages the auth adapter lifecycle.
- *
- * The v1 factory returns a no-op adapter that always succeeds (null permit).
- * Real adapter configuration will come through `ServiceSpec.config` (TRL-91).
- * The mock factory provides a synthetic adapter that always succeeds.
- */
-export const authService = service('auth', {
-    create: (_svc) => Result.ok({
-        // oxlint-disable-next-line require-await -- stub adapter satisfies async interface
-        authenticate: async () => Result.ok(null),
-    }),
-    description: 'Authentication adapter',
-    metadata: { category: 'infrastructure' },
-    mock: () => ({
-        // oxlint-disable-next-line require-await -- mock adapter satisfies async interface
-        authenticate: async () => Result.ok(null),
-    }),
-});
-//# sourceMappingURL=auth-service.js.map