@ontrails/permits 1.0.0-beta.14 → 1.0.0-beta.16

package/dist/permit.js

@@ -1,17 +0,0 @@
-/**
- * Type-safe accessor for `ctx.permit` with a downcast to `Permit`.
- *
- * `TrailContext.permit` is typed as `BasePermit` (id + scopes). This accessor
- * returns the full `Permit` when the auth gate has set one. Safe because
- * the auth gate is the only writer and always sets a full `Permit`.
- *
- * @example
- * ```typescript
- * const permit = getPermit(ctx);
- * if (permit) {
- *   console.log(permit.roles, permit.tenantId);
- * }
- * ```
- */
-export const getPermit = (ctx) => ctx.permit === undefined ? undefined : ctx.permit;
-//# sourceMappingURL=permit.js.map

package/dist/permit.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"permit.js","sourceRoot":"","sources":["../src/permit.ts"],"names":[],"mappings":"AASA;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,GAA4B,EAAsB,EAAE,CAC5E,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,GAAG,CAAC,MAAiB,CAAC"}

package/dist/rules.d.ts

@@ -1,47 +0,0 @@
-import type { Trail } from '@ontrails/core';
-/** A single governance finding from a permit rule. */
-export interface PermitDiagnostic {
-    readonly trailId: string;
-    readonly rule: string;
-    readonly severity: 'error' | 'warning';
-    readonly message: string;
-}
-type AnyTrail = Trail<unknown, unknown>;
-type Rule = (trails: readonly AnyTrail[]) => readonly PermitDiagnostic[];
-/**
- * Destructive trails without a real permit declaration are a governance failure.
- *
- * Reports an error for every trail with `intent: 'destroy'` that has no
- * `permit` field or explicitly opts out with `permit: 'public'`.
- */
-export declare const destroyWithoutPermit: Rule;
-/**
- * Write trails without a permit declaration get a warning.
- *
- * Trails with `intent: 'write'` (or no intent, which defaults to write) that
- * lack a permit are flagged unless `permit: 'public'` is explicitly set.
- */
-export declare const writeWithoutPermit: Rule;
-/**
- * Warns for scopes that don't follow the `entity:action` convention.
- *
- * A valid scope contains exactly one colon separating a non-empty entity
- * and a non-empty action.
- */
-export declare const scopeNamingConsistency: Rule;
-/**
- * Warns for scopes that appear in only one trail's permit.
- *
- * Catches typos like `user:wirte` by surfacing scopes not shared with any
- * other trail. Only runs when at least 2 trails have permit declarations.
- */
-export declare const orphanScopeDetection: Rule;
-/**
- * Run all permit governance rules against a set of trails.
- *
- * Returns a flat array of diagnostics from every rule. An empty array
- * means the topo passes all permit governance checks.
- */
-export declare const validatePermits: (trails: readonly Trail<unknown, unknown>[]) => readonly PermitDiagnostic[];
-export {};
-//# sourceMappingURL=rules.d.ts.map

package/dist/rules.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../src/rules.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAM5C,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAMD,KAAK,QAAQ,GAAG,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AACxC,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,SAAS,QAAQ,EAAE,KAAK,SAAS,gBAAgB,EAAE,CAAC;AAiBzE;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,IAU5B,CAAC;AAMR;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,IAU1B,CAAC;AAgBR;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,EAAE,IAUlC,CAAC;AA2CJ;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,IAMlC,CAAC;AAaF;;;;;GAKG;AACH,eAAO,MAAM,eAAe,GAC1B,QAAQ,SAAS,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,KACzC,SAAS,gBAAgB,EAA8C,CAAC"}

package/dist/rules.js

@@ -1,127 +0,0 @@
-/** Check whether a trail has any permit declaration (scopes object or 'public'). */
-const hasPermit = (t) => t.permit !== undefined;
-/** Extract scopes from a trail's permit declaration, or empty array. */
-const getScopes = (t) => {
-    if (t.permit !== undefined && t.permit !== 'public') {
-        return t.permit.scopes;
-    }
-    return [];
-};
-// ---------------------------------------------------------------------------
-// Rule: destroyWithoutPermit
-// ---------------------------------------------------------------------------
-/**
- * Destructive trails without a real permit declaration are a governance failure.
- *
- * Reports an error for every trail with `intent: 'destroy'` that has no
- * `permit` field or explicitly opts out with `permit: 'public'`.
- */
-export const destroyWithoutPermit = (trails) => trails
-    .filter((t) => t.intent === 'destroy' && (!hasPermit(t) || t.permit === 'public'))
-    .map((t) => ({
-    message: `Trail "${t.id}" has intent 'destroy' but no permit declaration`,
-    rule: 'destroyWithoutPermit',
-    severity: 'error',
-    trailId: t.id,
-}));
-// ---------------------------------------------------------------------------
-// Rule: writeWithoutPermit
-// ---------------------------------------------------------------------------
-/**
- * Write trails without a permit declaration get a warning.
- *
- * Trails with `intent: 'write'` (or no intent, which defaults to write) that
- * lack a permit are flagged unless `permit: 'public'` is explicitly set.
- */
-export const writeWithoutPermit = (trails) => trails
-    .filter((t) => (t.intent === 'write' || t.intent === undefined) && !hasPermit(t))
-    .map((t) => ({
-    message: `Trail "${t.id}" has write intent but no permit declaration`,
-    rule: 'writeWithoutPermit',
-    severity: 'warning',
-    trailId: t.id,
-}));
-// ---------------------------------------------------------------------------
-// Rule: scopeNamingConsistency
-// ---------------------------------------------------------------------------
-/** Returns true when a scope follows the `entity:action` convention. */
-const isValidScopeFormat = (scope) => {
-    const parts = scope.split(':');
-    return (parts.length === 2 &&
-        (parts[0]?.length ?? 0) > 0 &&
-        (parts[1]?.length ?? 0) > 0);
-};
-/**
- * Warns for scopes that don't follow the `entity:action` convention.
- *
- * A valid scope contains exactly one colon separating a non-empty entity
- * and a non-empty action.
- */
-export const scopeNamingConsistency = (trails) => trails.flatMap((t) => getScopes(t)
-    .filter((scope) => !isValidScopeFormat(scope))
-    .map((scope) => ({
-    message: `Scope "${scope}" on trail "${t.id}" does not follow entity:action convention`,
-    rule: 'scopeNamingConsistency',
-    severity: 'warning',
-    trailId: t.id,
-})));
-// ---------------------------------------------------------------------------
-// Rule: orphanScopeDetection
-// ---------------------------------------------------------------------------
-/** Build a map of scope -> set of trail IDs that declare it. */
-const buildScopeMap = (trails) => {
-    const map = new Map();
-    for (const t of trails) {
-        for (const scope of getScopes(t)) {
-            const existing = map.get(scope);
-            if (existing) {
-                existing.add(t.id);
-            }
-            else {
-                map.set(scope, new Set([t.id]));
-            }
-        }
-    }
-    return map;
-};
-/** Filter trails that have a scoped (non-public) permit declaration. */
-const trailsWithScopedPermit = (trails) => trails.filter((t) => t.permit !== undefined && t.permit !== 'public');
-/** Convert orphan scope map entries into diagnostics. */
-const orphanDiagnostics = (scopeMap) => [...scopeMap.entries()]
-    .filter(([, ids]) => ids.size === 1)
-    .map(([scope, ids]) => ({
-    message: `Scope "${scope}" appears only on trail "${[...ids][0]}" — possible typo`,
-    rule: 'orphanScopeDetection',
-    severity: 'warning',
-    trailId: [...ids][0] ?? '',
-}));
-/**
- * Warns for scopes that appear in only one trail's permit.
- *
- * Catches typos like `user:wirte` by surfacing scopes not shared with any
- * other trail. Only runs when at least 2 trails have permit declarations.
- */
-export const orphanScopeDetection = (trails) => {
-    const scoped = trailsWithScopedPermit(trails);
-    if (scoped.length < 2) {
-        return [];
-    }
-    return orphanDiagnostics(buildScopeMap(scoped));
-};
-// ---------------------------------------------------------------------------
-// Top-level validator
-// ---------------------------------------------------------------------------
-const allRules = [
-    destroyWithoutPermit,
-    writeWithoutPermit,
-    scopeNamingConsistency,
-    orphanScopeDetection,
-];
-/**
- * Run all permit governance rules against a set of trails.
- *
- * Returns a flat array of diagnostics from every rule. An empty array
- * means the topo passes all permit governance checks.
- */
-export const validatePermits = (trails) => allRules.flatMap((rule) => rule(trails));
-//# sourceMappingURL=rules.js.map

package/dist/rules.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"rules.js","sourceRoot":"","sources":["../src/rules.ts"],"names":[],"mappings":"AAqBA,oFAAoF;AACpF,MAAM,SAAS,GAAG,CAAC,CAAW,EAAW,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC;AAEnE,wEAAwE;AACxE,MAAM,SAAS,GAAG,CAAC,CAAW,EAAqB,EAAE;IACnD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACpD,OAAO,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;IACzB,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC,CAAC;AAEF,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAS,CAAC,MAAM,EAAE,EAAE,CACnD,MAAM;KACH,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAC1E;KACA,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACX,OAAO,EAAE,UAAU,CAAC,CAAC,EAAE,kDAAkD;IACzE,IAAI,EAAE,sBAAsB;IAC5B,QAAQ,EAAE,OAAgB;IAC1B,OAAO,EAAE,CAAC,CAAC,EAAE;CACd,CAAC,CAAC,CAAC;AAER,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAS,CAAC,MAAM,EAAE,EAAE,CACjD,MAAM;KACH,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CACzE;KACA,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACX,OAAO,EAAE,UAAU,CAAC,CAAC,EAAE,8CAA8C;IACrE,IAAI,EAAE,oBAAoB;IAC1B,QAAQ,EAAE,SAAkB;IAC5B,OAAO,EAAE,CAAC,CAAC,EAAE;CACd,CAAC,CAAC,CAAC;AAER,8EAA8E;AAC9E,+BAA+B;AAC/B,8EAA8E;AAE9E,wEAAwE;AACxE,MAAM,kBAAkB,GAAG,CAAC,KAAa,EAAW,EAAE;IACpD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,CACL,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;QAC3B,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAC5B,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAS,CAAC,MAAM,EAAE,EAAE,CACrD,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CACnB,SAAS,CAAC,CAAC,CAAC;KACT,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;KAC7C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACf,OAAO,EAAE,UAAU,KAAK,eAAe,CAAC,CAAC,EAAE,4CAA4C;IACvF,IAAI,EAAE,wBAAwB;IAC9B,QAAQ,EAAE,SAAkB;IAC5B,OAAO,EAAE,CAAC,CAAC,EAAE;CACd,CAAC,CAAC,CACN,CAAC;AAEJ,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E,gEAAgE;AAChE,MAAM,aAAa,GAAG,CACpB,MAA2B,EACe,EAAE;IAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,QAAQ,EAAE,CAAC;gBACb,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACrB,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,wEAAwE;AACxE,MAAM,sBAAsB,GAAG,CAC7B,MAA2B,EACN,EAAE,CACvB,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;AAExE,yDAAyD;AACzD,MAAM,iBAAiB,GAAG,CACxB,QAAkD,EACrB,EAAE,CAC/B,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;KACpB,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC;KACnC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;IACtB,OAAO,EAAE,UAAU,KAAK,4BAA4B,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,mBAAmB;IAClF,IAAI,EAAE,sBAAsB;IAC5B,QAAQ,EAAE,SAAkB;IAC5B,OAAO,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;CAC3B,CAAC,CAAC,CAAC;AAER;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAS,CAAC,MAAM,EAAE,EAAE;IACnD,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,iBAAiB,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;AAClD,CAAC,CAAC;AAEF,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E,MAAM,QAAQ,GAAoB;IAChC,oBAAoB;IACpB,kBAAkB;IAClB,sBAAsB;IACtB,oBAAoB;CACrB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,MAA0C,EACb,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC"}

package/dist/testing.d.ts

@@ -1,20 +0,0 @@
-import type { PermitRequirement } from '@ontrails/core';
-import type { Permit } from './permit.js';
-/**
- * Mint a synthetic test permit with exactly the declared scopes.
- * No admin permit, no wildcard — tests get only what the trail declares.
- */
-export declare const mintTestPermit: (options?: {
-    readonly id?: string;
-    readonly scopes?: readonly string[];
-    readonly roles?: readonly string[];
-    readonly tenantId?: string;
-}) => Permit;
-/**
- * Create a test permit matching a trail's permit requirement.
- * Extracts scopes from the requirement and mints a permit with exactly those scopes.
- */
-export declare const mintPermitForTrail: (trail: {
-    readonly permit?: PermitRequirement | undefined;
-}) => Permit | undefined;
-//# sourceMappingURL=testing.d.ts.map

package/dist/testing.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAExD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C;;;GAGG;AACH,eAAO,MAAM,cAAc,GAAI,UAAU;IACvC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B,KAAG,MAOF,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,kBAAkB,GAAI,OAAO;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;CACjD,KAAG,MAAM,GAAG,SAKZ,CAAC"}

package/dist/testing.js

@@ -1,22 +0,0 @@
-/**
- * Mint a synthetic test permit with exactly the declared scopes.
- * No admin permit, no wildcard — tests get only what the trail declares.
- */
-export const mintTestPermit = (options) => ({
-    id: options?.id ??
-        `test-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`,
-    scopes: [...(options?.scopes ?? [])],
-    ...(options?.roles === undefined ? {} : { roles: [...options.roles] }),
-    ...(options?.tenantId === undefined ? {} : { tenantId: options.tenantId }),
-});
-/**
- * Create a test permit matching a trail's permit requirement.
- * Extracts scopes from the requirement and mints a permit with exactly those scopes.
- */
-export const mintPermitForTrail = (trail) => {
-    if (!trail.permit || trail.permit === 'public') {
-        return undefined;
-    }
-    return mintTestPermit({ scopes: trail.permit.scopes });
-};
-//# sourceMappingURL=testing.js.map

package/dist/testing.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"testing.js","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAIA;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAK9B,EAAU,EAAE,CAAC,CAAC;IACb,EAAE,EACA,OAAO,EAAE,EAAE;QACX,QAAQ,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;IAChE,MAAM,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;IACpC,GAAG,CAAC,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;IACtE,GAAG,CAAC,OAAO,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;CAC3E,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,KAElC,EAAsB,EAAE;IACvB,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,cAAc,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AACzD,CAAC,CAAC"}

package/dist/trails/auth-verify.d.ts

@@ -1,22 +0,0 @@
-/**
- * Infrastructure trail that verifies a bearer token and returns the resolved permit.
- *
- * Reads the auth connector from `authProvision` — the connector is configured
- * at bootstrap (e.g. JWT with HMAC secret). The mock connector always
- * succeeds with a null permit, so `testAll(app)` works without configuration.
- */
-export declare const authVerify: import("@ontrails/core").Trail<{
-    token: string;
-}, {
-    valid: boolean;
-    error?: string | undefined;
-    errorCode?: "expired_token" | "insufficient_scope" | "invalid_token" | "missing_credentials" | undefined;
-    permit?: {
-        id: string;
-        scopes: string[];
-        metadata?: Record<string, unknown> | undefined;
-        roles?: string[] | undefined;
-        tenantId?: string | undefined;
-    } | undefined;
-}>;
-//# sourceMappingURL=auth-verify.d.ts.map

package/dist/trails/auth-verify.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-verify.d.ts","sourceRoot":"","sources":["../../src/trails/auth-verify.ts"],"names":[],"mappings":"AA4CA;;;;;;GAMG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;EAiDrB,CAAC"}

package/dist/trails/auth-verify.js

@@ -1,85 +0,0 @@
-import { Result, TRAILHEAD_KEY, trail } from '@ontrails/core';
-import { z } from 'zod';
-import { authProvision } from '../auth-provision.js';
-const permitSchema = z.object({
-    id: z.string(),
-    metadata: z.record(z.string(), z.unknown()).optional(),
-    roles: z.array(z.string()).optional(),
-    scopes: z.array(z.string()),
-    tenantId: z.string().optional(),
-});
-const authErrorCodeSchema = z.enum([
-    'expired_token',
-    'insufficient_scope',
-    'invalid_token',
-    'missing_credentials',
-]);
-const toOutputPermit = (permit) => ({
-    ...(permit.metadata === undefined
-        ? {}
-        : { metadata: { ...permit.metadata } }),
-    ...(permit.roles === undefined ? {} : { roles: [...permit.roles] }),
-    ...(permit.tenantId === undefined ? {} : { tenantId: permit.tenantId }),
-    id: permit.id,
-    scopes: [...permit.scopes],
-});
-const isTrailhead = (value) => value === 'http' || value === 'mcp' || value === 'cli';
-const getTrailhead = (ctx) => {
-    const trailhead = ctx.extensions?.[TRAILHEAD_KEY];
-    return isTrailhead(trailhead) ? trailhead : 'http';
-};
-/**
- * Infrastructure trail that verifies a bearer token and returns the resolved permit.
- *
- * Reads the auth connector from `authProvision` — the connector is configured
- * at bootstrap (e.g. JWT with HMAC secret). The mock connector always
- * succeeds with a null permit, so `testAll(app)` works without configuration.
- */
-export const authVerify = trail('auth.verify', {
-    blaze: async (input, ctx) => {
-        const connector = authProvision.from(ctx);
-        const result = await connector.authenticate({
-            bearerToken: input.token,
-            requestId: ctx.requestId,
-            trailhead: getTrailhead(ctx),
-        });
-        if (result.isErr()) {
-            return Result.ok({
-                error: result.error.message,
-                errorCode: result.error.code,
-                valid: false,
-            });
-        }
-        const permit = result.value;
-        if (!permit) {
-            return Result.ok({
-                error: 'No credentials',
-                errorCode: 'missing_credentials',
-                valid: false,
-            });
-        }
-        return Result.ok({
-            permit: toOutputPermit(permit),
-            valid: true,
-        });
-    },
-    examples: [
-        {
-            input: { token: 'test-token' },
-            name: 'Verify a token',
-        },
-    ],
-    input: z.object({
-        token: z.string().min(1).describe('Bearer token to verify'),
-    }),
-    intent: 'read',
-    meta: { category: 'infrastructure' },
-    output: z.object({
-        error: z.string().optional(),
-        errorCode: authErrorCodeSchema.optional(),
-        permit: permitSchema.optional(),
-        valid: z.boolean(),
-    }),
-    provisions: [authProvision],
-});
-//# sourceMappingURL=auth-verify.js.map

package/dist/trails/auth-verify.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-verify.js","sourceRoot":"","sources":["../../src/trails/auth-verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAE9D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAIrD,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AACH,MAAM,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC;IACjC,eAAe;IACf,oBAAoB;IACpB,eAAe;IACf,qBAAqB;CACtB,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,CAAC;IAC1C,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS;QAC/B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACzC,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACnE,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;IACvE,EAAE,EAAE,MAAM,CAAC,EAAE;IACb,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;CAC3B,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG,CAClB,KAAc,EAC+B,EAAE,CAC/C,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,KAAK,CAAC;AAEzD,MAAM,YAAY,GAAG,CACnB,GAAiB,EACmB,EAAE;IACtC,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC,aAAa,CAAC,CAAC;IAClD,OAAO,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;AACrD,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa,EAAE;IAC7C,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1B,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC;YAC1C,WAAW,EAAE,KAAK,CAAC,KAAK;YACxB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,SAAS,EAAE,YAAY,CAAC,GAAG,CAAC;SAC7B,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;YACnB,OAAO,MAAM,CAAC,EAAE,CAAC;gBACf,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;gBAC3B,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;gBAC5B,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC;QAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,MAAM,CAAC,EAAE,CAAC;gBACf,KAAK,EAAE,gBAAgB;gBACvB,SAAS,EAAE,qBAAqB;gBAChC,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC,EAAE,CAAC;YACf,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC;YAC9B,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;IACL,CAAC;IACD,QAAQ,EAAE;QACR;YACE,KAAK,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE;YAC9B,IAAI,EAAE,gBAAgB;SACvB;KACF;IACD,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC;KAC5D,CAAC;IACF,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE;IACpC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC5B,SAAS,EAAE,mBAAmB,CAAC,QAAQ,EAAE;QACzC,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE;QAC/B,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;KACnB,CAAC;IACF,UAAU,EAAE,CAAC,aAAa,CAAC;CAC5B,CAAC,CAAC"}

package/src/__tests__/auth-gate.test.ts

@@ -1,130 +0,0 @@
-/* oxlint-disable require-await -- gate wrappers satisfy async interfaces without awaiting */
-import { describe, expect, test } from 'bun:test';
-
-import { Result, trail } from '@ontrails/core';
-import type { TrailContext } from '@ontrails/core';
-import { z } from 'zod';
-
-import { authGate } from '../auth-gate';
-import { PermitError } from '../errors';
-
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
-
-const makeCtx = (permit?: {
-  id: string;
-  scopes: readonly string[];
-}): TrailContext => ({
-  abortSignal: AbortSignal.timeout(5000),
-  permit,
-  requestId: 'test-auth',
-});
-
-const okImpl = async () => Result.ok({ done: true });
-
-// ---------------------------------------------------------------------------
-// Tests
-// ---------------------------------------------------------------------------
-
-describe('authGate', () => {
-  test('has correct name and description', () => {
-    expect(authGate.name).toBe('auth');
-    expect(authGate.description).toBeDefined();
-  });
-
-  describe('pass-through cases', () => {
-    test('passes through when trail has no permit field', async () => {
-      const t = trail('test.nopermit', {
-        blaze: okImpl,
-        input: z.object({}),
-        output: z.object({ done: z.boolean() }),
-      });
-
-      const wrapped = authGate.wrap(t, okImpl);
-      const result = await wrapped({}, makeCtx());
-
-      expect(result.isOk()).toBe(true);
-      expect(result.unwrap()).toEqual({ done: true });
-    });
-
-    test('passes through when trail permit is public', async () => {
-      const t = trail('test.public', {
-        blaze: okImpl,
-        input: z.object({}),
-        output: z.object({ done: z.boolean() }),
-        permit: 'public',
-      });
-
-      const wrapped = authGate.wrap(t, okImpl);
-      const result = await wrapped({}, makeCtx());
-
-      expect(result.isOk()).toBe(true);
-      expect(result.unwrap()).toEqual({ done: true });
-    });
-  });
-
-  describe('scope enforcement', () => {
-    const scopedTrail = trail('test.scoped', {
-      blaze: okImpl,
-      input: z.object({}),
-      output: z.object({ done: z.boolean() }),
-      permit: { scopes: ['user:read'] },
-    });
-
-    test('passes when ctx.permit has matching scopes', async () => {
-      const wrapped = authGate.wrap(scopedTrail, okImpl);
-      const result = await wrapped(
-        {},
-        makeCtx({ id: 'usr-1', scopes: ['user:read'] })
-      );
-
-      expect(result.isOk()).toBe(true);
-      expect(result.unwrap()).toEqual({ done: true });
-    });
-
-    test('returns error when ctx has no permit', async () => {
-      const wrapped = authGate.wrap(scopedTrail, okImpl);
-      const result = await wrapped({}, makeCtx());
-
-      expect(result.isErr()).toBe(true);
-      const err = (result as unknown as { error: PermitError }).error;
-      expect(err).toBeInstanceOf(PermitError);
-      expect(err.message).toContain('No permit');
-    });
-
-    test('returns error when permit is missing required scopes', async () => {
-      const multiScopeTrail = trail('test.multi', {
-        blaze: okImpl,
-        input: z.object({}),
-        output: z.object({ done: z.boolean() }),
-        permit: { scopes: ['user:read', 'user:write'] },
-      });
-
-      const wrapped = authGate.wrap(multiScopeTrail, okImpl);
-      const result = await wrapped(
-        {},
-        makeCtx({ id: 'usr-1', scopes: ['user:read'] })
-      );
-
-      expect(result.isErr()).toBe(true);
-      const err = (result as unknown as { error: PermitError }).error;
-      expect(err).toBeInstanceOf(PermitError);
-      expect(err.message).toContain('user:write');
-    });
-
-    test('passes when permit has superset of required scopes', async () => {
-      const wrapped = authGate.wrap(scopedTrail, okImpl);
-      const result = await wrapped(
-        {},
-        makeCtx({
-          id: 'usr-1',
-          scopes: ['user:read', 'user:write', 'admin'],
-        })
-      );
-
-      expect(result.isOk()).toBe(true);
-      expect(result.unwrap()).toEqual({ done: true });
-    });
-  });
-});

package/src/__tests__/auth-provision.test.ts

@@ -1,62 +0,0 @@
-import { describe, expect, test } from 'bun:test';
-
-import type { ProvisionContext } from '@ontrails/core';
-
-import type { AuthConnector } from '../connectors/connector.js';
-import { authProvision } from '../auth-provision.js';
-import type { PermitExtractionInput } from '../extraction.js';
-
-/** Minimal extraction input for tests. */
-const testInput = (
-  overrides?: Partial<PermitExtractionInput>
-): PermitExtractionInput => ({
-  requestId: 'test-svc-req',
-  trailhead: 'http',
-  ...overrides,
-});
-
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
-
-const testSvcCtx: ProvisionContext = {
-  config: undefined,
-  cwd: '/tmp',
-  env: {},
-  workspaceRoot: '/tmp',
-};
-
-// ---------------------------------------------------------------------------
-// Tests
-// ---------------------------------------------------------------------------
-
-describe('authProvision', () => {
-  test('has correct id and kind', () => {
-    expect(authProvision.id).toBe('auth');
-    expect(authProvision.kind).toBe('provision');
-  });
-
-  test('has infrastructure meta', () => {
-    expect(authProvision.meta).toEqual({ category: 'infrastructure' });
-  });
-
-  test('mock returns an AuthConnector', async () => {
-    const mock = authProvision.mock?.();
-    expect(mock).toBeDefined();
-
-    const connector = mock as AuthConnector;
-    const result = await connector.authenticate(testInput());
-    expect(result.isOk()).toBe(true);
-    expect(result.unwrap()).toBeNull();
-  });
-
-  test('create returns Result.ok with an AuthConnector', async () => {
-    const result = await authProvision.create(testSvcCtx);
-    expect(result.isOk()).toBe(true);
-
-    const connector = result.unwrap() as AuthConnector;
-    const authResult = await connector.authenticate(testInput());
-    expect(authResult.isOk()).toBe(true);
-    expect(authResult.unwrap()).toBeNull();
-  });
-});