@ontrails/permits 1.0.0-beta.15 → 1.0.0-beta.16

package/src/boundary.ts

@@ -0,0 +1,200 @@
+import type {
+  AnyResource,
+  BasePermit,
+  ResourceOverrideMap,
+  SurfaceConfigValues,
+  Topo,
+} from '@ontrails/core';
+import {
+  AuthError,
+  Result,
+  ValidationError,
+  basePermitSchema,
+  resolveResourceConfig,
+} from '@ontrails/core';
+
+import type { AuthAdapter } from './adapters/adapter.js';
+import { authAdapterSchema, authErrorSchema } from './adapters/adapter.js';
+import type { PermitExtractionInput } from './extraction.js';
+import { permitExtractionInputSchema } from './extraction.js';
+
+/** Resource id of the auth adapter resource provided by `@ontrails/permits`. */
+export const AUTH_RESOURCE_ID = 'auth';
+
+type LocatedAuthResource =
+  | { readonly kind: 'override'; readonly value: unknown }
+  | { readonly kind: 'declared'; readonly resource: AnyResource };
+
+export interface ResolvePermitFromBearerTokenOptions {
+  readonly bearerToken: string;
+  readonly graph: Topo;
+  readonly requestId: string;
+  readonly surface: PermitExtractionInput['surface'];
+  readonly resources?: ResourceOverrideMap | undefined;
+  readonly configValues?: SurfaceConfigValues | undefined;
+  readonly headers?: Headers | undefined;
+  readonly sessionId?: string | undefined;
+  readonly cwd?: string | undefined;
+  readonly env?: Record<string, string | undefined> | undefined;
+  readonly workspaceRoot?: string | undefined;
+  readonly missingAuthResourceMessage?: string | undefined;
+  readonly nullPermitMessage?: string | undefined;
+}
+
+/** Resolve the auth resource override or registered resource on the topo. */
+const lookupAuthResource = (
+  graph: Topo,
+  resources: ResourceOverrideMap | undefined,
+  missingAuthResourceMessage: string | undefined
+): Result<LocatedAuthResource, ValidationError> => {
+  if (resources !== undefined && Object.hasOwn(resources, AUTH_RESOURCE_ID)) {
+    return Result.ok({
+      kind: 'override',
+      value: resources[AUTH_RESOURCE_ID],
+    });
+  }
+  const declared = graph.getResource(AUTH_RESOURCE_ID);
+  if (declared !== undefined) {
+    return Result.ok({ kind: 'declared', resource: declared });
+  }
+  return Result.err(
+    new ValidationError(
+      missingAuthResourceMessage ??
+        'Bearer token auth requires an auth adapter. Register authResource from @ontrails/permits in your topo.'
+    )
+  );
+};
+
+/**
+ * Materialize the auth adapter from an override or by invoking the declared
+ * resource's `create()` factory.
+ */
+const materializeAuthAdapter = async (
+  resolved: LocatedAuthResource,
+  options: Pick<
+    ResolvePermitFromBearerTokenOptions,
+    'configValues' | 'cwd' | 'env' | 'workspaceRoot'
+  >
+): Promise<Result<AuthAdapter, Error>> => {
+  if (resolved.kind === 'override') {
+    const parsed = authAdapterSchema.safeParse(resolved.value);
+    if (!parsed.success) {
+      return Result.err(
+        new ValidationError(
+          'Override for resource "auth" does not expose an authenticate() function.'
+        )
+      );
+    }
+    return Result.ok(resolved.value as AuthAdapter);
+  }
+
+  const cwd = options.cwd ?? process.cwd();
+  const configResult = resolveResourceConfig(
+    resolved.resource,
+    options.configValues
+  );
+  if (configResult.isErr()) {
+    return configResult;
+  }
+  const created = await resolved.resource.create({
+    config: configResult.value,
+    cwd,
+    env: options.env ?? {},
+    workspaceRoot: options.workspaceRoot ?? cwd,
+  });
+  if (created.isErr()) {
+    return created;
+  }
+  const parsed = authAdapterSchema.safeParse(created.value);
+  if (!parsed.success) {
+    return Result.err(
+      new ValidationError(
+        'Auth resource factory returned a value without an authenticate() function.'
+      )
+    );
+  }
+  return Result.ok(created.value as AuthAdapter);
+};
+
+/**
+ * Resolve a surface-extracted bearer token to a `BasePermit`.
+ *
+ * Surfaces own credential extraction. This helper owns the shared auth
+ * adapter lookup, invocation, error normalization, and BasePermit projection.
+ */
+export const resolvePermitFromBearerToken = async (
+  options: ResolvePermitFromBearerTokenOptions
+): Promise<Result<BasePermit, Error>> => {
+  const located = lookupAuthResource(
+    options.graph,
+    options.resources,
+    options.missingAuthResourceMessage
+  );
+  if (located.isErr()) {
+    return located;
+  }
+  const adapterResult = await materializeAuthAdapter(located.value, options);
+  if (adapterResult.isErr()) {
+    return adapterResult;
+  }
+  const inputResult = permitExtractionInputSchema.safeParse({
+    bearerToken: options.bearerToken,
+    ...(options.headers === undefined ? {} : { headers: options.headers }),
+    requestId: options.requestId,
+    ...(options.sessionId === undefined
+      ? {}
+      : { sessionId: options.sessionId }),
+    surface: options.surface,
+  });
+  if (!inputResult.success) {
+    return Result.err(
+      new ValidationError('Invalid bearer token extraction input.', {
+        context: { issues: inputResult.error.issues },
+      })
+    );
+  }
+  let authResult: Awaited<ReturnType<AuthAdapter['authenticate']>>;
+  try {
+    authResult = await adapterResult.value.authenticate(inputResult.data);
+  } catch (error) {
+    const errorOptions =
+      error instanceof Error
+        ? { cause: error, context: { code: 'invalid_token' } }
+        : { context: { code: 'invalid_token' } };
+    return Result.err(
+      new AuthError('Auth adapter threw while authenticating bearer token', {
+        ...errorOptions,
+      })
+    );
+  }
+  if (authResult.isErr()) {
+    const parsedError = authErrorSchema.safeParse(authResult.error);
+    const { code, message } = parsedError.success
+      ? parsedError.data
+      : {
+          code: 'invalid_token' as const,
+          message: 'Auth adapter returned a malformed error',
+        };
+    return Result.err(new AuthError(message, { context: { code } }));
+  }
+  if (authResult.value === null) {
+    return Result.err(
+      new AuthError(
+        options.nullPermitMessage ??
+          'Auth adapter did not produce a permit for bearer token',
+        {
+          context: { code: 'missing_credentials' },
+        }
+      )
+    );
+  }
+  const permit = basePermitSchema.safeParse(authResult.value);
+  if (!permit.success) {
+    return Result.err(
+      new AuthError('Auth adapter returned a malformed permit', {
+        context: { code: 'invalid_token', issues: permit.error.issues },
+      })
+    );
+  }
+  return Result.ok(permit.data);
+};

package/src/errors.ts

@@ -1,18 +1 @@
-import { PermissionError } from '@ontrails/core';
-
-/**
- * Error returned when permit scope enforcement fails.
- *
- * Extends `PermissionError` (category `'permission'`, HTTP 403) because
- * it represents an *authorization* failure — the caller's identity is known
- * but lacks the required scopes.
- */
-export class PermitError extends PermissionError {
-  constructor(
-    message: string,
-    options?: { cause?: Error; context?: Record<string, unknown> }
-  ) {
-    super(message, options);
-    this.name = 'PermitError';
-  }
-}
+export { PermitError } from '@ontrails/core';

package/src/extraction.ts

@@ -1,19 +1,25 @@
+import { z } from 'zod';
+
+export const permitExtractionInputSchema = z
+  .object({
+    /** Bearer token from Authorization header or equivalent. */
+    bearerToken: z.string().optional(),
+    /** Raw headers (HTTP surface only, typically). */
+    headers: z.instanceof(Headers).optional(),
+    /** Correlation ID for tracing. */
+    requestId: z.string(),
+    /** Session identifier from transport handshake. */
+    sessionId: z.string().optional(),
+    /** Which surface produced this extraction. */
+    surface: z.enum(['http', 'mcp', 'cli']),
+  })
+  .readonly();
+
 /**
- * Normalized input for auth connectors.
+ * Normalized input for auth adapters.
  *
- * Each trailhead extracts raw credentials from its transport and normalizes
- * them into this shape. No trailhead types (Request, McpSession, etc.) cross
- * into core — only this interface.
+ * Each surface extracts raw credentials from its transport and normalizes them
+ * into this shape. No surface types (Request, McpSession, etc.) cross into
+ * core -- only this schema-derived contract.
  */
-export interface PermitExtractionInput {
-  /** Which trailhead produced this extraction */
-  readonly trailhead: 'http' | 'mcp' | 'cli';
-  /** Bearer token from Authorization header or equivalent */
-  readonly bearerToken?: string;
-  /** Session identifier from transport handshake */
-  readonly sessionId?: string;
-  /** Raw headers (HTTP trailhead only, typically) */
-  readonly headers?: Headers;
-  /** Correlation ID for tracing */
-  readonly requestId: string;
-}
+export type PermitExtractionInput = z.infer<typeof permitExtractionInputSchema>;

package/src/index.ts

@@ -1,17 +1,29 @@
 export {
-  type AuthConnector,
-  type AuthCredentials,
+  authAdapterSchema,
+  authErrorSchema,
+  type AuthAdapter,
   type AuthError,
-} from './connectors/connector.js';
+} from './adapters/adapter.js';
 export {
-  createJwtConnector,
-  type JwtConnectorOptions,
-} from './connectors/jwt.js';
-export { authLayer } from './auth-layer.js';
-export { authResource } from './auth-resource.js';
+  createJwtAdapter,
+  type JwtAlgorithm,
+  type JwtAdapterOptions,
+} from './adapters/jwt.js';
+export {
+  authResource,
+  authResourceConfigSchema,
+  type AuthResourceConfig,
+} from './auth-resource.js';
+export {
+  AUTH_RESOURCE_ID,
+  resolvePermitFromBearerToken,
+  type ResolvePermitFromBearerTokenOptions,
+} from './boundary.js';
 export { authVerify } from './trails/auth-verify.js';
 export { PermitError } from './errors.js';
-export { type PermitExtractionInput } from './extraction.js';
+export {
+  permitExtractionInputSchema,
+  type PermitExtractionInput,
+} from './extraction.js';
 export { type Permit, getPermit } from './permit.js';
 export { validatePermits, type PermitDiagnostic } from './rules.js';
-export { createTestPermit, createPermitForTrail } from './testing.js';

package/src/trails/auth-verify.ts

@@ -1,4 +1,4 @@
-import { Result, TRAILHEAD_KEY, trail } from '@ontrails/core';
+import { Result, SURFACE_KEY, trail } from '@ontrails/core';
 import type { TrailContext } from '@ontrails/core';
 import { z } from 'zod';
 
@@ -30,32 +30,30 @@ const toOutputPermit = (permit: Permit) => ({
   scopes: [...permit.scopes],
 });
 
-const isTrailhead = (
+const isSurfaceName = (
   value: unknown
-): value is PermitExtractionInput['trailhead'] =>
+): value is PermitExtractionInput['surface'] =>
   value === 'http' || value === 'mcp' || value === 'cli';
 
-const getTrailhead = (
-  ctx: TrailContext
-): PermitExtractionInput['trailhead'] => {
-  const trailhead = ctx.extensions?.[TRAILHEAD_KEY];
-  return isTrailhead(trailhead) ? trailhead : 'http';
+const getSurface = (ctx: TrailContext): PermitExtractionInput['surface'] => {
+  const surface = ctx.extensions?.[SURFACE_KEY];
+  return isSurfaceName(surface) ? surface : 'http';
 };
 
 /**
  * Infrastructure trail that verifies a bearer token and returns the resolved permit.
  *
- * Reads the auth connector from `authResource` — the connector is configured
- * at bootstrap (e.g. JWT with HMAC secret). The mock connector always
+ * Reads the auth adapter from `authResource` — the adapter is configured
+ * at bootstrap (e.g. JWT with HMAC secret). The mock adapter always
  * succeeds with a null permit, so `testAll(app)` works without configuration.
  */
 export const authVerify = trail('auth.verify', {
   blaze: async (input, ctx) => {
-    const connector = authResource.from(ctx);
-    const result = await connector.authenticate({
+    const adapter = authResource.from(ctx);
+    const result = await adapter.authenticate({
       bearerToken: input.token,
       requestId: ctx.requestId,
-      trailhead: getTrailhead(ctx),
+      surface: getSurface(ctx),
     });
 
     if (result.isErr()) {

package/.turbo/turbo-build.log

@@ -1 +0,0 @@
-$ tsc -b

package/.turbo/turbo-lint.log

@@ -1,3 +0,0 @@
-$ oxlint ./src
-Found 0 warnings and 0 errors.
-Finished in 73ms on 18 files with 93 rules using 24 threads.

package/.turbo/turbo-typecheck.log

@@ -1 +0,0 @@
-$ tsc --noEmit

package/dist/auth-layer.d.ts

@@ -1,18 +0,0 @@
-import type { Layer } from '@ontrails/core';
-/**
- * A {@link Layer} that enforces permit scopes declared on trails.
- *
- * The layer reads the trail's `permit` field (a `PermitRequirement`):
- *
- * - If `permit` is `'public'` or `undefined` the layer passes through.
- * - If `permit` has `scopes`, the layer checks that `ctx.permit` contains
- *   all required scopes. A superset is fine; missing scopes produce a
- *   `PermitError`.
- *
- * Because `ctx.cross()` re-enters `executeTrail` (which applies layers),
- * this layer automatically re-checks on every invocation in a crossing chain.
- * No special crossing-chain handling is needed — it is built into the
- * architecture.
- */
-export declare const authLayer: Layer;
-//# sourceMappingURL=auth-layer.d.ts.map

package/dist/auth-layer.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-layer.d.ts","sourceRoot":"","sources":["../src/auth-layer.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AA6B5C;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,SAAS,EAAE,KAkCvB,CAAC"}

package/dist/auth-layer.js

@@ -1,56 +0,0 @@
-import { Result } from '@ontrails/core';
-import { PermitError } from './errors.js';
-import { getPermit } from './permit.js';
-// ---------------------------------------------------------------------------
-// Helpers (defined before callers — no use-before-define)
-// ---------------------------------------------------------------------------
-/**
- * Returns `true` when the permit requirement means "no enforcement needed."
- * Either the trail hasn't declared a permit posture or has explicitly
- * opted out with `'public'`.
- */
-const isPassThrough = (requirement) => requirement === undefined || requirement === 'public';
-/** Returns scopes present in `required` but absent from `held`. */
-const findMissing = (required, held) => required.filter((s) => !held.includes(s));
-// ---------------------------------------------------------------------------
-// Auth layer
-// ---------------------------------------------------------------------------
-/**
- * A {@link Layer} that enforces permit scopes declared on trails.
- *
- * The layer reads the trail's `permit` field (a `PermitRequirement`):
- *
- * - If `permit` is `'public'` or `undefined` the layer passes through.
- * - If `permit` has `scopes`, the layer checks that `ctx.permit` contains
- *   all required scopes. A superset is fine; missing scopes produce a
- *   `PermitError`.
- *
- * Because `ctx.cross()` re-enters `executeTrail` (which applies layers),
- * this layer automatically re-checks on every invocation in a crossing chain.
- * No special crossing-chain handling is needed — it is built into the
- * architecture.
- */
-export const authLayer = {
-    description: 'Enforces permit scopes declared on trails',
-    name: 'auth',
-    wrap: (_trail, impl) => {
-        const requirement = _trail.permit;
-        if (isPassThrough(requirement)) {
-            return impl;
-        }
-        return (input, ctx) => {
-            const permit = getPermit(ctx);
-            if (!permit) {
-                return Promise.resolve(Result.err(new PermitError('No permit provided')));
-            }
-            const missing = findMissing(requirement.scopes, permit.scopes);
-            if (missing.length > 0) {
-                return Promise.resolve(Result.err(new PermitError(`Missing scopes: ${missing.join(', ')}`, {
-                    context: { missing, required: requirement.scopes },
-                })));
-            }
-            return Promise.resolve(impl(input, ctx));
-        };
-    },
-};
-//# sourceMappingURL=auth-layer.js.map

package/dist/auth-layer.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-layer.js","sourceRoot":"","sources":["../src/auth-layer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAGxC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,8EAA8E;AAC9E,0DAA0D;AAC1D,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,aAAa,GAAG,CACpB,WAAoB,EACiB,EAAE,CACvC,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,QAAQ,CAAC;AAExD,mEAAmE;AACnE,MAAM,WAAW,GAAG,CAClB,QAA2B,EAC3B,IAAuB,EACJ,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAElE,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,SAAS,GAAU;IAC9B,WAAW,EAAE,2CAA2C;IACxD,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC;QAElC,IAAI,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACpB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YAE9B,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,OAAO,CAAC,OAAO,CACpB,MAAM,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,oBAAoB,CAAC,CAAC,CAClD,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YAE/D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,OAAO,OAAO,CAAC,OAAO,CACpB,MAAM,CAAC,GAAG,CACR,IAAI,WAAW,CAAC,mBAAmB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;oBACvD,OAAO,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE;iBACnD,CAAC,CACH,CACF,CAAC;YACJ,CAAC;YAED,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3C,CAAC,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/auth-resource.d.ts

@@ -1,11 +0,0 @@
-import type { AuthConnector } from './connectors/connector.js';
-/**
- * Auth resource — manages the auth connector lifecycle.
- *
- * The v1 factory returns a no-op connector that always succeeds (null permit).
- * Real connector configuration will come through `ResourceSpec.config`
- * (TRL-91). The mock factory provides a synthetic connector that always
- * succeeds.
- */
-export declare const authResource: import("@ontrails/core").Resource<AuthConnector>;
-//# sourceMappingURL=auth-resource.d.ts.map

package/dist/auth-resource.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-resource.d.ts","sourceRoot":"","sources":["../src/auth-resource.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE/D;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,kDAavB,CAAC"}

package/dist/auth-resource.js

@@ -1,22 +0,0 @@
-import { Result, resource } from '@ontrails/core';
-/**
- * Auth resource — manages the auth connector lifecycle.
- *
- * The v1 factory returns a no-op connector that always succeeds (null permit).
- * Real connector configuration will come through `ResourceSpec.config`
- * (TRL-91). The mock factory provides a synthetic connector that always
- * succeeds.
- */
-export const authResource = resource('auth', {
-    create: (_svc) => Result.ok({
-        // oxlint-disable-next-line require-await -- stub connector satisfies async interface
-        authenticate: async () => Result.ok(null),
-    }),
-    description: 'Authentication connector',
-    meta: { category: 'infrastructure' },
-    mock: () => ({
-        // oxlint-disable-next-line require-await -- mock connector satisfies async interface
-        authenticate: async () => Result.ok(null),
-    }),
-});
-//# sourceMappingURL=auth-resource.js.map

package/dist/auth-resource.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-resource.js","sourceRoot":"","sources":["../src/auth-resource.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAIlD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,QAAQ,CAAgB,MAAM,EAAE;IAC1D,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CACf,MAAM,CAAC,EAAE,CAAC;QACR,qFAAqF;QACrF,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC;KAClB,CAAC;IAC5B,WAAW,EAAE,0BAA0B;IACvC,IAAI,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE;IACpC,IAAI,EAAE,GAAG,EAAE,CACT,CAAC;QACC,qFAAqF;QACrF,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC;KAC1C,CAAyB;CAC7B,CAAC,CAAC"}

package/dist/connectors/connector.d.ts

@@ -1,26 +0,0 @@
-import type { Result } from '@ontrails/core';
-import type { PermitExtractionInput } from '../extraction.js';
-import type { Permit } from '../permit.js';
-/**
- * @deprecated Use {@link PermitExtractionInput} instead. Kept as an alias
- * for backward compatibility during migration.
- */
-export type AuthCredentials = PermitExtractionInput;
-/** Errors from auth connectors. */
-export interface AuthError {
-    readonly code: 'expired_token' | 'insufficient_scope' | 'invalid_token' | 'missing_credentials';
-    readonly message: string;
-}
-/**
- * Auth connector port. Given extraction input, produce a permit or an error.
- *
- * The connector receives the full {@link PermitExtractionInput} — trailhead,
- * headers, requestId, and credential fields — so it can make richer
- * decisions (e.g., rate-limit by trailhead or correlate via requestId).
- *
- * Deliberately narrow — no session management, no token refresh.
- */
-export interface AuthConnector {
-    readonly authenticate: (input: PermitExtractionInput) => Promise<Result<Permit | null, AuthError>>;
-}
-//# sourceMappingURL=connector.d.ts.map

package/dist/connectors/connector.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"connector.d.ts","sourceRoot":"","sources":["../../src/connectors/connector.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAE7C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAEpD,mCAAmC;AACnC,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EACT,eAAe,GACf,oBAAoB,GACpB,eAAe,GACf,qBAAqB,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,YAAY,EAAE,CACrB,KAAK,EAAE,qBAAqB,KACzB,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;CAChD"}

package/dist/connectors/connector.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=connector.js.map

package/dist/connectors/connector.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"connector.js","sourceRoot":"","sources":["../../src/connectors/connector.ts"],"names":[],"mappings":""}

package/dist/connectors/jwt.d.ts

@@ -1,25 +0,0 @@
-import type { AuthConnector } from './connector.js';
-/** Configuration for the JWT auth connector. */
-export interface JwtConnectorOptions {
-    /** HMAC secret for HS256 verification. */
-    readonly secret?: string;
-    /** JWKS endpoint for RS256/ES256 (not yet implemented). */
-    readonly jwksUrl?: string;
-    /** Expected issuer claim. */
-    readonly issuer?: string;
-    /** Expected audience claim. */
-    readonly audience?: string;
-    /** Claim containing scopes (default: 'scope'). */
-    readonly scopesClaim?: string;
-    /** Claim containing roles (default: 'roles'). */
-    readonly rolesClaim?: string;
-}
-/**
- * Create a JWT auth connector using Bun's native crypto.
- *
- * Verifies HS256-signed JWTs, extracts claims into a Permit, and checks
- * issuer/audience when configured. Returns `Result.ok(null)` when no
- * credentials are provided.
- */
-export declare const createJwtConnector: (options: JwtConnectorOptions) => AuthConnector;
-//# sourceMappingURL=jwt.d.ts.map

package/dist/connectors/jwt.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../src/connectors/jwt.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAa,MAAM,gBAAgB,CAAC;AAI/D,gDAAgD;AAChD,MAAM,WAAW,mBAAmB;IAClC,0CAA0C;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,2DAA2D;IAC3D,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,6BAA6B;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,+BAA+B;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,kDAAkD;IAClD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,iDAAiD;IACjD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AA2LD;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,GAC7B,SAAS,mBAAmB,KAC3B,aAeF,CAAC"}