@ontrails/permits 1.0.0-beta.15 → 1.0.0-beta.16

package/dist/connectors/jwt.js

@@ -1,148 +0,0 @@
-import { Result } from '@ontrails/core';
-// ---------------------------------------------------------------------------
-// Helpers (defined before callers)
-// ---------------------------------------------------------------------------
-const authErr = (code, message) => Result.err({ code, message });
-/** Base64url-decode a string to bytes. */
-const base64urlDecode = (input) => {
-    const padded = input
-        .replaceAll('-', '+')
-        .replaceAll('_', '/')
-        .padEnd(input.length + ((4 - (input.length % 4)) % 4), '=');
-    const binary = atob(padded);
-    const bytes = new Uint8Array(binary.length);
-    for (let i = 0; i < binary.length; i += 1) {
-        bytes[i] = binary.codePointAt(i) ?? 0;
-    }
-    return bytes;
-};
-/** Decode a JWT payload without verifying the signature. */
-const decodePayload = (token) => {
-    const parts = token.split('.');
-    if (parts.length !== 3) {
-        return undefined;
-    }
-    try {
-        const json = new TextDecoder().decode(base64urlDecode(parts[1] ?? ''));
-        return JSON.parse(json);
-    }
-    catch {
-        return undefined;
-    }
-};
-/** Import a secret as an HMAC CryptoKey. */
-const importHmacKey = (secret) => {
-    const encoder = new TextEncoder();
-    return crypto.subtle.importKey('raw', encoder.encode(secret), { hash: 'SHA-256', name: 'HMAC' }, false, ['verify']);
-};
-/** Verify the HMAC-SHA256 signature of a JWT. */
-const verifyHmacSignature = (token, key) => {
-    const lastDot = token.lastIndexOf('.');
-    if (lastDot === -1) {
-        return Promise.resolve(false);
-    }
-    const data = token.slice(0, lastDot);
-    const signature = base64urlDecode(token.slice(lastDot + 1));
-    const encoder = new TextEncoder();
-    return crypto.subtle.verify('HMAC', key, signature.buffer, encoder.encode(data));
-};
-/** Validate standard claims (exp, iss, aud). */
-const validateClaims = (payload, options) => {
-    if (payload.exp !== undefined &&
-        payload.exp < Math.floor(Date.now() / 1000)) {
-        return { code: 'expired_token', message: 'Token has expired' };
-    }
-    if (options.issuer && payload.iss !== options.issuer) {
-        return { code: 'invalid_token', message: 'Issuer mismatch' };
-    }
-    if (options.audience) {
-        const { aud } = payload;
-        const matches = Array.isArray(aud)
-            ? aud.includes(options.audience)
-            : aud === options.audience;
-        if (!matches) {
-            return { code: 'invalid_token', message: 'Audience mismatch' };
-        }
-    }
-    return undefined;
-};
-/** Extract scopes from a payload claim (space-separated string or array). */
-const extractScopes = (payload, claim) => {
-    const raw = payload[claim];
-    if (typeof raw === 'string') {
-        return raw.split(' ').filter(Boolean);
-    }
-    if (Array.isArray(raw)) {
-        return raw.filter((s) => typeof s === 'string' && s.length > 0);
-    }
-    return [];
-};
-/** Extract roles from a payload claim (string array). */
-const extractRoles = (payload, claim) => {
-    const raw = payload[claim];
-    if (!Array.isArray(raw)) {
-        return undefined;
-    }
-    return raw.filter((r) => typeof r === 'string');
-};
-/** Build a Permit from a validated JWT payload. */
-const buildPermit = (payload, options) => {
-    if (!payload.sub) {
-        return authErr('invalid_token', 'Missing subject claim (sub)');
-    }
-    const roles = extractRoles(payload, options.rolesClaim ?? 'roles');
-    return Result.ok({
-        id: payload.sub,
-        scopes: extractScopes(payload, options.scopesClaim ?? 'scope'),
-        ...(roles ? { roles } : {}),
-    });
-};
-/** Verify the signature and return the decoded payload, or an error. */
-const decodeAndVerify = async (token, secret) => {
-    const payload = decodePayload(token);
-    if (!payload) {
-        return authErr('invalid_token', 'Malformed JWT');
-    }
-    try {
-        const key = await importHmacKey(secret);
-        const valid = await verifyHmacSignature(token, key);
-        return valid
-            ? Result.ok(payload)
-            : authErr('invalid_token', 'Invalid signature');
-    }
-    catch {
-        return authErr('invalid_token', 'Malformed token signature');
-    }
-};
-/** Validate claims and build a permit from a verified payload. */
-const payloadToPermit = (payload, options) => {
-    const claimError = validateClaims(payload, options);
-    if (claimError) {
-        return Result.err(claimError);
-    }
-    return buildPermit(payload, options);
-};
-// ---------------------------------------------------------------------------
-// Factory
-// ---------------------------------------------------------------------------
-/**
- * Create a JWT auth connector using Bun's native crypto.
- *
- * Verifies HS256-signed JWTs, extracts claims into a Permit, and checks
- * issuer/audience when configured. Returns `Result.ok(null)` when no
- * credentials are provided.
- */
-export const createJwtConnector = (options) => {
-    const authenticate = async (input) => {
-        if (!input.bearerToken) {
-            return Result.ok(null);
-        }
-        if (!options.secret) {
-            return authErr('invalid_token', 'No secret configured');
-        }
-        const decoded = await decodeAndVerify(input.bearerToken, options.secret);
-        return decoded.isErr() ? decoded : payloadToPermit(decoded.value, options);
-    };
-    return { authenticate };
-};
-//# sourceMappingURL=jwt.js.map

package/dist/connectors/jwt.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../src/connectors/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AA+BxC,8EAA8E;AAC9E,mCAAmC;AACnC,8EAA8E;AAE9E,MAAM,OAAO,GAAG,CACd,IAAuB,EACvB,OAAe,EACW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AAE7D,0CAA0C;AAC1C,MAAM,eAAe,GAAG,CAAC,KAAa,EAAc,EAAE;IACpD,MAAM,MAAM,GAAG,KAAK;SACjB,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;SACpB,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;SACpB,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,4DAA4D;AAC5D,MAAM,aAAa,GAAG,CAAC,KAAa,EAA0B,EAAE;IAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC,CAAC;AAEF,4CAA4C;AAC5C,MAAM,aAAa,GAAG,CAAC,MAAc,EAAsB,EAAE;IAC3D,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EACtB,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,EACjC,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;AACJ,CAAC,CAAC;AAEF,iDAAiD;AACjD,MAAM,mBAAmB,GAAG,CAC1B,KAAa,EACb,GAAc,EACI,EAAE;IACpB,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;QACnB,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CACzB,MAAM,EACN,GAAG,EACH,SAAS,CAAC,MAAqB,EAC/B,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CACrB,CAAC;AACJ,CAAC,CAAC;AAEF,gDAAgD;AAChD,MAAM,cAAc,GAAG,CACrB,OAAmB,EACnB,OAA4B,EACL,EAAE;IACzB,IACE,OAAO,CAAC,GAAG,KAAK,SAAS;QACzB,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAC3C,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;IACjE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QACrD,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;QACxB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAChC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC;YAChC,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC,QAAQ,CAAC;QAC7B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;QACjE,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,6EAA6E;AAC7E,MAAM,aAAa,GAAG,CACpB,OAAmB,EACnB,KAAa,EACM,EAAE;IACrB,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,MAAM,CACf,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAC1D,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC,CAAC;AAEF,yDAAyD;AACzD,MAAM,YAAY,GAAG,CACnB,OAAmB,EACnB,KAAa,EACkB,EAAE;IACjC,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;AAC/D,CAAC,CAAC;AAEF,mDAAmD;AACnD,MAAM,WAAW,GAAG,CAClB,OAAmB,EACnB,OAA4B,EACD,EAAE;IAC7B,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACjB,OAAO,OAAO,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC,EAAE,CAAC;QACf,EAAE,EAAE,OAAO,CAAC,GAAG;QACf,MAAM,EAAE,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC;QAC9D,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5B,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,wEAAwE;AACxE,MAAM,eAAe,GAAG,KAAK,EAC3B,KAAa,EACb,MAAc,EAC0B,EAAE;IAC1C,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,OAAO,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACpD,OAAO,KAAK;YACV,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC;YACpB,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,eAAe,EAAE,2BAA2B,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC,CAAC;AAEF,kEAAkE;AAClE,MAAM,eAAe,GAAG,CACtB,OAAmB,EACnB,OAA4B,EACD,EAAE;IAC7B,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACpD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AACvC,CAAC,CAAC;AAEF,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,OAA4B,EACb,EAAE;IACjB,MAAM,YAAY,GAAG,KAAK,EACxB,KAA4B,EACe,EAAE;QAC7C,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YACvB,OAAO,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,OAAO,OAAO,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACzE,OAAO,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC7E,CAAC,CAAC;IAEF,OAAO,EAAE,YAAY,EAAE,CAAC;AAC1B,CAAC,CAAC"}

package/dist/errors.d.ts

@@ -1,15 +0,0 @@
-import { PermissionError } from '@ontrails/core';
-/**
- * Error returned when permit scope enforcement fails.
- *
- * Extends `PermissionError` (category `'permission'`, HTTP 403) because
- * it represents an *authorization* failure — the caller's identity is known
- * but lacks the required scopes.
- */
-export declare class PermitError extends PermissionError {
-    constructor(message: string, options?: {
-        cause?: Error;
-        context?: Record<string, unknown>;
-    });
-}
-//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD;;;;;;GAMG;AACH,qBAAa,WAAY,SAAQ,eAAe;gBAE5C,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,KAAK,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE;CAKjE"}

package/dist/errors.js

@@ -1,15 +0,0 @@
-import { PermissionError } from '@ontrails/core';
-/**
- * Error returned when permit scope enforcement fails.
- *
- * Extends `PermissionError` (category `'permission'`, HTTP 403) because
- * it represents an *authorization* failure — the caller's identity is known
- * but lacks the required scopes.
- */
-export class PermitError extends PermissionError {
-    constructor(message, options) {
-        super(message, options);
-        this.name = 'PermitError';
-    }
-}
-//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD;;;;;;GAMG;AACH,MAAM,OAAO,WAAY,SAAQ,eAAe;IAC9C,YACE,OAAe,EACf,OAA8D;QAE9D,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF"}

package/dist/extraction.d.ts

@@ -1,20 +0,0 @@
-/**
- * Normalized input for auth connectors.
- *
- * Each trailhead extracts raw credentials from its transport and normalizes
- * them into this shape. No trailhead types (Request, McpSession, etc.) cross
- * into core — only this interface.
- */
-export interface PermitExtractionInput {
-    /** Which trailhead produced this extraction */
-    readonly trailhead: 'http' | 'mcp' | 'cli';
-    /** Bearer token from Authorization header or equivalent */
-    readonly bearerToken?: string;
-    /** Session identifier from transport handshake */
-    readonly sessionId?: string;
-    /** Raw headers (HTTP trailhead only, typically) */
-    readonly headers?: Headers;
-    /** Correlation ID for tracing */
-    readonly requestId: string;
-}
-//# sourceMappingURL=extraction.d.ts.map

package/dist/extraction.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"extraction.d.ts","sourceRoot":"","sources":["../src/extraction.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,KAAK,GAAG,KAAK,CAAC;IAC3C,2DAA2D;IAC3D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,kDAAkD;IAClD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,mDAAmD;IACnD,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,iCAAiC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B"}

package/dist/extraction.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=extraction.js.map

package/dist/extraction.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"extraction.js","sourceRoot":"","sources":["../src/extraction.ts"],"names":[],"mappings":""}

package/dist/index.d.ts

@@ -1,11 +0,0 @@
-export { type AuthConnector, type AuthCredentials, type AuthError, } from './connectors/connector.js';
-export { createJwtConnector, type JwtConnectorOptions, } from './connectors/jwt.js';
-export { authLayer } from './auth-layer.js';
-export { authResource } from './auth-resource.js';
-export { authVerify } from './trails/auth-verify.js';
-export { PermitError } from './errors.js';
-export { type PermitExtractionInput } from './extraction.js';
-export { type Permit, getPermit } from './permit.js';
-export { validatePermits, type PermitDiagnostic } from './rules.js';
-export { createTestPermit, createPermitForTrail } from './testing.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,SAAS,GACf,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,kBAAkB,EAClB,KAAK,mBAAmB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,KAAK,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,KAAK,MAAM,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,KAAK,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -1,11 +0,0 @@
-export {} from './connectors/connector.js';
-export { createJwtConnector, } from './connectors/jwt.js';
-export { authLayer } from './auth-layer.js';
-export { authResource } from './auth-resource.js';
-export { authVerify } from './trails/auth-verify.js';
-export { PermitError } from './errors.js';
-export {} from './extraction.js';
-export { getPermit } from './permit.js';
-export { validatePermits } from './rules.js';
-export { createTestPermit, createPermitForTrail } from './testing.js';
-//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,kBAAkB,GAEnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAA8B,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAe,SAAS,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,eAAe,EAAyB,MAAM,YAAY,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC"}

package/dist/permit.d.ts

@@ -1,26 +0,0 @@
-import type { BasePermit } from '@ontrails/core';
-/** The resolved identity and scopes from a successful authentication. */
-export interface Permit extends BasePermit {
-    readonly roles?: readonly string[];
-    readonly tenantId?: string;
-    readonly metadata?: Readonly<Record<string, unknown>>;
-}
-/**
- * Type-safe accessor for `ctx.permit` with a downcast to `Permit`.
- *
- * `TrailContext.permit` is typed as `BasePermit` (id + scopes). This accessor
- * returns the full `Permit` when the auth layer has set one. Safe because
- * the auth layer is the only writer and always sets a full `Permit`.
- *
- * @example
- * ```typescript
- * const permit = getPermit(ctx);
- * if (permit) {
- *   console.log(permit.roles, permit.tenantId);
- * }
- * ```
- */
-export declare const getPermit: (ctx: {
-    permit?: BasePermit;
-}) => Permit | undefined;
-//# sourceMappingURL=permit.d.ts.map

package/dist/permit.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"permit.d.ts","sourceRoot":"","sources":["../src/permit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,yEAAyE;AACzE,MAAM,WAAW,MAAO,SAAQ,UAAU;IACxC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,SAAS,GAAI,KAAK;IAAE,MAAM,CAAC,EAAE,UAAU,CAAA;CAAE,KAAG,MAAM,GAAG,SACH,CAAC"}

package/dist/permit.js

@@ -1,17 +0,0 @@
-/**
- * Type-safe accessor for `ctx.permit` with a downcast to `Permit`.
- *
- * `TrailContext.permit` is typed as `BasePermit` (id + scopes). This accessor
- * returns the full `Permit` when the auth layer has set one. Safe because
- * the auth layer is the only writer and always sets a full `Permit`.
- *
- * @example
- * ```typescript
- * const permit = getPermit(ctx);
- * if (permit) {
- *   console.log(permit.roles, permit.tenantId);
- * }
- * ```
- */
-export const getPermit = (ctx) => ctx.permit === undefined ? undefined : ctx.permit;
-//# sourceMappingURL=permit.js.map

package/dist/permit.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"permit.js","sourceRoot":"","sources":["../src/permit.ts"],"names":[],"mappings":"AASA;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,GAA4B,EAAsB,EAAE,CAC5E,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,GAAG,CAAC,MAAiB,CAAC"}

package/dist/rules.d.ts

@@ -1,47 +0,0 @@
-import type { Trail } from '@ontrails/core';
-/** A single governance finding from a permit rule. */
-export interface PermitDiagnostic {
-    readonly trailId: string;
-    readonly rule: string;
-    readonly severity: 'error' | 'warning';
-    readonly message: string;
-}
-type AnyTrail = Trail<unknown, unknown, unknown>;
-type Rule = (trails: readonly AnyTrail[]) => readonly PermitDiagnostic[];
-/**
- * Destructive trails without a real permit declaration are a governance failure.
- *
- * Reports an error for every trail with `intent: 'destroy'` that has no
- * `permit` field or explicitly opts out with `permit: 'public'`.
- */
-export declare const destroyWithoutPermit: Rule;
-/**
- * Write trails without a permit declaration get a warning.
- *
- * Trails with `intent: 'write'` (or no intent, which defaults to write) that
- * lack a permit are flagged unless `permit: 'public'` is explicitly set.
- */
-export declare const writeWithoutPermit: Rule;
-/**
- * Warns for scopes that don't follow the `entity:action` convention.
- *
- * A valid scope contains exactly one colon separating a non-empty entity
- * and a non-empty action.
- */
-export declare const scopeNamingConsistency: Rule;
-/**
- * Warns for scopes that appear in only one trail's permit.
- *
- * Catches typos like `user:wirte` by surfacing scopes not shared with any
- * other trail. Only runs when at least 2 trails have permit declarations.
- */
-export declare const orphanScopeDetection: Rule;
-/**
- * Run all permit governance rules against a set of trails.
- *
- * Returns a flat array of diagnostics from every rule. An empty array
- * means the topo passes all permit governance checks.
- */
-export declare const validatePermits: (trails: readonly Trail<unknown, unknown, unknown>[]) => readonly PermitDiagnostic[];
-export {};
-//# sourceMappingURL=rules.d.ts.map

package/dist/rules.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../src/rules.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAM5C,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAMD,KAAK,QAAQ,GAAG,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACjD,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,SAAS,QAAQ,EAAE,KAAK,SAAS,gBAAgB,EAAE,CAAC;AAiBzE;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,IAU5B,CAAC;AAMR;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,IAU1B,CAAC;AAgBR;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,EAAE,IAUlC,CAAC;AA2CJ;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,IAMlC,CAAC;AAaF;;;;;GAKG;AACH,eAAO,MAAM,eAAe,GAC1B,QAAQ,SAAS,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,KAClD,SAAS,gBAAgB,EAA8C,CAAC"}

package/dist/rules.js

@@ -1,127 +0,0 @@
-/** Check whether a trail has any permit declaration (scopes object or 'public'). */
-const hasPermit = (t) => t.permit !== undefined;
-/** Extract scopes from a trail's permit declaration, or empty array. */
-const getScopes = (t) => {
-    if (t.permit !== undefined && t.permit !== 'public') {
-        return t.permit.scopes;
-    }
-    return [];
-};
-// ---------------------------------------------------------------------------
-// Rule: destroyWithoutPermit
-// ---------------------------------------------------------------------------
-/**
- * Destructive trails without a real permit declaration are a governance failure.
- *
- * Reports an error for every trail with `intent: 'destroy'` that has no
- * `permit` field or explicitly opts out with `permit: 'public'`.
- */
-export const destroyWithoutPermit = (trails) => trails
-    .filter((t) => t.intent === 'destroy' && (!hasPermit(t) || t.permit === 'public'))
-    .map((t) => ({
-    message: `Trail "${t.id}" has intent 'destroy' but no permit declaration`,
-    rule: 'destroyWithoutPermit',
-    severity: 'error',
-    trailId: t.id,
-}));
-// ---------------------------------------------------------------------------
-// Rule: writeWithoutPermit
-// ---------------------------------------------------------------------------
-/**
- * Write trails without a permit declaration get a warning.
- *
- * Trails with `intent: 'write'` (or no intent, which defaults to write) that
- * lack a permit are flagged unless `permit: 'public'` is explicitly set.
- */
-export const writeWithoutPermit = (trails) => trails
-    .filter((t) => (t.intent === 'write' || t.intent === undefined) && !hasPermit(t))
-    .map((t) => ({
-    message: `Trail "${t.id}" has write intent but no permit declaration`,
-    rule: 'writeWithoutPermit',
-    severity: 'warning',
-    trailId: t.id,
-}));
-// ---------------------------------------------------------------------------
-// Rule: scopeNamingConsistency
-// ---------------------------------------------------------------------------
-/** Returns true when a scope follows the `entity:action` convention. */
-const isValidScopeFormat = (scope) => {
-    const parts = scope.split(':');
-    return (parts.length === 2 &&
-        (parts[0]?.length ?? 0) > 0 &&
-        (parts[1]?.length ?? 0) > 0);
-};
-/**
- * Warns for scopes that don't follow the `entity:action` convention.
- *
- * A valid scope contains exactly one colon separating a non-empty entity
- * and a non-empty action.
- */
-export const scopeNamingConsistency = (trails) => trails.flatMap((t) => getScopes(t)
-    .filter((scope) => !isValidScopeFormat(scope))
-    .map((scope) => ({
-    message: `Scope "${scope}" on trail "${t.id}" does not follow entity:action convention`,
-    rule: 'scopeNamingConsistency',
-    severity: 'warning',
-    trailId: t.id,
-})));
-// ---------------------------------------------------------------------------
-// Rule: orphanScopeDetection
-// ---------------------------------------------------------------------------
-/** Build a map of scope -> set of trail IDs that declare it. */
-const buildScopeMap = (trails) => {
-    const map = new Map();
-    for (const t of trails) {
-        for (const scope of getScopes(t)) {
-            const existing = map.get(scope);
-            if (existing) {
-                existing.add(t.id);
-            }
-            else {
-                map.set(scope, new Set([t.id]));
-            }
-        }
-    }
-    return map;
-};
-/** Filter trails that have a scoped (non-public) permit declaration. */
-const trailsWithScopedPermit = (trails) => trails.filter((t) => t.permit !== undefined && t.permit !== 'public');
-/** Convert orphan scope map entries into diagnostics. */
-const orphanDiagnostics = (scopeMap) => [...scopeMap.entries()]
-    .filter(([, ids]) => ids.size === 1)
-    .map(([scope, ids]) => ({
-    message: `Scope "${scope}" appears only on trail "${[...ids][0]}" — possible typo`,
-    rule: 'orphanScopeDetection',
-    severity: 'warning',
-    trailId: [...ids][0] ?? '',
-}));
-/**
- * Warns for scopes that appear in only one trail's permit.
- *
- * Catches typos like `user:wirte` by surfacing scopes not shared with any
- * other trail. Only runs when at least 2 trails have permit declarations.
- */
-export const orphanScopeDetection = (trails) => {
-    const scoped = trailsWithScopedPermit(trails);
-    if (scoped.length < 2) {
-        return [];
-    }
-    return orphanDiagnostics(buildScopeMap(scoped));
-};
-// ---------------------------------------------------------------------------
-// Top-level validator
-// ---------------------------------------------------------------------------
-const allRules = [
-    destroyWithoutPermit,
-    writeWithoutPermit,
-    scopeNamingConsistency,
-    orphanScopeDetection,
-];
-/**
- * Run all permit governance rules against a set of trails.
- *
- * Returns a flat array of diagnostics from every rule. An empty array
- * means the topo passes all permit governance checks.
- */
-export const validatePermits = (trails) => allRules.flatMap((rule) => rule(trails));
-//# sourceMappingURL=rules.js.map

package/dist/rules.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"rules.js","sourceRoot":"","sources":["../src/rules.ts"],"names":[],"mappings":"AAqBA,oFAAoF;AACpF,MAAM,SAAS,GAAG,CAAC,CAAW,EAAW,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC;AAEnE,wEAAwE;AACxE,MAAM,SAAS,GAAG,CAAC,CAAW,EAAqB,EAAE;IACnD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACpD,OAAO,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;IACzB,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC,CAAC;AAEF,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAS,CAAC,MAAM,EAAE,EAAE,CACnD,MAAM;KACH,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAC1E;KACA,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACX,OAAO,EAAE,UAAU,CAAC,CAAC,EAAE,kDAAkD;IACzE,IAAI,EAAE,sBAAsB;IAC5B,QAAQ,EAAE,OAAgB;IAC1B,OAAO,EAAE,CAAC,CAAC,EAAE;CACd,CAAC,CAAC,CAAC;AAER,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAS,CAAC,MAAM,EAAE,EAAE,CACjD,MAAM;KACH,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CACzE;KACA,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACX,OAAO,EAAE,UAAU,CAAC,CAAC,EAAE,8CAA8C;IACrE,IAAI,EAAE,oBAAoB;IAC1B,QAAQ,EAAE,SAAkB;IAC5B,OAAO,EAAE,CAAC,CAAC,EAAE;CACd,CAAC,CAAC,CAAC;AAER,8EAA8E;AAC9E,+BAA+B;AAC/B,8EAA8E;AAE9E,wEAAwE;AACxE,MAAM,kBAAkB,GAAG,CAAC,KAAa,EAAW,EAAE;IACpD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,CACL,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;QAC3B,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAC5B,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAS,CAAC,MAAM,EAAE,EAAE,CACrD,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CACnB,SAAS,CAAC,CAAC,CAAC;KACT,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;KAC7C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACf,OAAO,EAAE,UAAU,KAAK,eAAe,CAAC,CAAC,EAAE,4CAA4C;IACvF,IAAI,EAAE,wBAAwB;IAC9B,QAAQ,EAAE,SAAkB;IAC5B,OAAO,EAAE,CAAC,CAAC,EAAE;CACd,CAAC,CAAC,CACN,CAAC;AAEJ,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E,gEAAgE;AAChE,MAAM,aAAa,GAAG,CACpB,MAA2B,EACe,EAAE;IAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,QAAQ,EAAE,CAAC;gBACb,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACrB,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,wEAAwE;AACxE,MAAM,sBAAsB,GAAG,CAC7B,MAA2B,EACN,EAAE,CACvB,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;AAExE,yDAAyD;AACzD,MAAM,iBAAiB,GAAG,CACxB,QAAkD,EACrB,EAAE,CAC/B,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;KACpB,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC;KACnC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;IACtB,OAAO,EAAE,UAAU,KAAK,4BAA4B,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,mBAAmB;IAClF,IAAI,EAAE,sBAAsB;IAC5B,QAAQ,EAAE,SAAkB;IAC5B,OAAO,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;CAC3B,CAAC,CAAC,CAAC;AAER;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAS,CAAC,MAAM,EAAE,EAAE;IACnD,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,iBAAiB,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;AAClD,CAAC,CAAC;AAEF,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E,MAAM,QAAQ,GAAoB;IAChC,oBAAoB;IACpB,kBAAkB;IAClB,sBAAsB;IACtB,oBAAoB;CACrB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,MAAmD,EACtB,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC"}

package/dist/testing.d.ts

@@ -1,20 +0,0 @@
-import type { PermitRequirement } from '@ontrails/core';
-import type { Permit } from './permit.js';
-/**
- * Create a synthetic test permit with exactly the declared scopes.
- * No admin permit, no wildcard — tests get only what the trail declares.
- */
-export declare const createTestPermit: (options?: {
-    readonly id?: string;
-    readonly scopes?: readonly string[];
-    readonly roles?: readonly string[];
-    readonly tenantId?: string;
-}) => Permit;
-/**
- * Create a test permit matching a trail's permit requirement.
- * Extracts scopes from the requirement and creates a permit with exactly those scopes.
- */
-export declare const createPermitForTrail: (trail: {
-    readonly permit?: PermitRequirement | undefined;
-}) => Permit | undefined;
-//# sourceMappingURL=testing.d.ts.map

package/dist/testing.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAExD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C;;;GAGG;AACH,eAAO,MAAM,gBAAgB,GAAI,UAAU;IACzC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B,KAAG,MAOF,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,oBAAoB,GAAI,OAAO;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;CACjD,KAAG,MAAM,GAAG,SAKZ,CAAC"}

package/dist/testing.js

@@ -1,22 +0,0 @@
-/**
- * Create a synthetic test permit with exactly the declared scopes.
- * No admin permit, no wildcard — tests get only what the trail declares.
- */
-export const createTestPermit = (options) => ({
-    id: options?.id ??
-        `test-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`,
-    scopes: [...(options?.scopes ?? [])],
-    ...(options?.roles === undefined ? {} : { roles: [...options.roles] }),
-    ...(options?.tenantId === undefined ? {} : { tenantId: options.tenantId }),
-});
-/**
- * Create a test permit matching a trail's permit requirement.
- * Extracts scopes from the requirement and creates a permit with exactly those scopes.
- */
-export const createPermitForTrail = (trail) => {
-    if (!trail.permit || trail.permit === 'public') {
-        return undefined;
-    }
-    return createTestPermit({ scopes: trail.permit.scopes });
-};
-//# sourceMappingURL=testing.js.map

package/dist/testing.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"testing.js","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAIA;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAKhC,EAAU,EAAE,CAAC,CAAC;IACb,EAAE,EACA,OAAO,EAAE,EAAE;QACX,QAAQ,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;IAChE,MAAM,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;IACpC,GAAG,CAAC,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;IACtE,GAAG,CAAC,OAAO,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;CAC3E,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,KAEpC,EAAsB,EAAE;IACvB,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,gBAAgB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AAC3D,CAAC,CAAC"}

package/dist/trails/auth-verify.d.ts

@@ -1,22 +0,0 @@
-/**
- * Infrastructure trail that verifies a bearer token and returns the resolved permit.
- *
- * Reads the auth connector from `authResource` — the connector is configured
- * at bootstrap (e.g. JWT with HMAC secret). The mock connector always
- * succeeds with a null permit, so `testAll(app)` works without configuration.
- */
-export declare const authVerify: import("@ontrails/core").Trail<{
-    token: string;
-}, {
-    valid: boolean;
-    error?: string | undefined;
-    errorCode?: "expired_token" | "insufficient_scope" | "invalid_token" | "missing_credentials" | undefined;
-    permit?: {
-        id: string;
-        scopes: string[];
-        metadata?: Record<string, unknown> | undefined;
-        roles?: string[] | undefined;
-        tenantId?: string | undefined;
-    } | undefined;
-}, never>;
-//# sourceMappingURL=auth-verify.d.ts.map

package/dist/trails/auth-verify.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-verify.d.ts","sourceRoot":"","sources":["../../src/trails/auth-verify.ts"],"names":[],"mappings":"AA4CA;;;;;;GAMG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;SAiDrB,CAAC"}