@ontrails/permits 1.0.0-beta.15 → 1.0.0-beta.17

package/CHANGELOG.md

@@ -1,5 +1,81 @@
 # @ontrails/permits
 
+## 1.0.0-beta.17
+
+### Patch Changes
+
+- Updated dependencies [3dc8254]
+  - @ontrails/core@1.0.0-beta.17
+
+## 1.0.0-beta.16
+
+### Major Changes
+
+- 200bece: BREAKING: rename auth connector vocabulary to adapter.
+
+  This stays on the current `1.0.0-beta` prerelease line: the package is part of
+  the fixed `@ontrails/*` beta group, so beta-breaking API renames advance the
+  next beta rather than opening a stable-major release line.
+
+  - `AuthConnector` -> `AuthAdapter`
+  - `authConnectorSchema` -> `authAdapterSchema`
+  - `JwtConnectorOptions` -> `JwtAdapterOptions`
+  - `createJwtConnector` -> `createJwtAdapter`
+  - auth resource config discriminant `{ connector: 'jwt' | 'none' }` -> `{ adapter: 'jwt' | 'none' }`
+
+  The `@ontrails/permits/jwt` subpath is unchanged. The internal `connectors/`
+  source directory becomes `adapters/`. See
+  `docs/migration/connector-to-adapter.md` for the full rename map.
+
+  The Trails CLI package updates its generated auth-resource configuration to use
+  the new `adapter` discriminant.
+
+### Minor Changes
+
+- 73622ae: Thread `ResourceSpec.config` through the built-in auth resource. Resource config schemas that accept `undefined` now receive their parsed default when config values are omitted, and `authResource` can materialize the no-op or JWT adapter from typed config while preserving existing mock and override paths.
+- 4b8d13b: **BREAKING:** Remove the deprecated `AuthCredentials` alias from the permits public API.
+
+  Use `PermitExtractionInput` instead. See `docs/migration/trailhead-to-surface.md` for the full migration map.
+
+- 66056ac: **BREAKING:** TRL-475 drops user-facing exports of `authLayer`, `autoIterateLayer`, and `dateShortcutsLayer`. Breaking change for any app still wiring these layers manually.
+
+  Migration:
+
+  - **`autoIterateLayer`** — remove from `blaze`/`run`/`surface` options. The CLI surface now derives the `--all` flag and multi-page collection automatically from any trail whose output matches the pagination pattern (`items`, `hasMore`, `nextCursor`). See TRL-469.
+  - **`dateShortcutsLayer`** — remove from `blaze`/`run`/`surface` options. The CLI surface now expands `since`/`until` shortcut strings (`today`, `yesterday`, `7d`, `30d`, `this-week`, `this-month`) automatically from input schema shape. See TRL-470.
+  - **`authLayer`** — remove from `blaze`/`run`/`surface` options. Permit scope enforcement is intrinsic to `executeTrail` (`enforcePermitRequirement` runs before resource creation and layer composition). The compatibility shim was already a no-op.
+
+  The `Layer` type, `composeLayers`, and canonical per-call `executeTrail({ layers })` option remain available; only the legacy layer exports were removed.
+
+### Patch Changes
+
+- 199304e: Harden JWT permit validation by requiring `exp` by default, validating the
+  header algorithm allowlist before signature verification, and enforcing finite
+  clock skew for `exp` and `nbf` checks.
+- e4beec9: Document `@ontrails/permits/jwt` as the canonical JWT adapter import while keeping root JWT re-exports as intentional convenience exports.
+- Updated dependencies [73622ae]
+- Updated dependencies [6300f70]
+- Updated dependencies [d172013]
+- Updated dependencies [c3fc5c3]
+- Updated dependencies [20d7a5c]
+- Updated dependencies [be5fb46]
+- Updated dependencies [e898cc4]
+- Updated dependencies [3395234]
+- Updated dependencies [bcdc484]
+- Updated dependencies [331e3a9]
+- Updated dependencies [4399fdb]
+- Updated dependencies [4b8d13b]
+- Updated dependencies [112b9f2]
+- Updated dependencies [893025e]
+- Updated dependencies [eec5e9d]
+- Updated dependencies [ebd4434]
+- Updated dependencies [863d473]
+- Updated dependencies [344f2f7]
+- Updated dependencies [26f9ffd]
+- Updated dependencies [10eae9a]
+- Updated dependencies [22c6c06]
+  - @ontrails/core@1.0.0-beta.16
+
 ## 1.0.0-beta.15
 
 ### Patch Changes

package/README.md

@@ -2,7 +2,7 @@
 
 Scope-based authorization for Trails.
 
-The permits package owns the connector-agnostic `authResource` and `authLayer`. Connector packages bind those declarations to concrete auth logic, just like a surface connector binds a topo to CLI, MCP, or HTTP.
+The permits package owns adapter-agnostic auth resources, adapters, and helpers. Core `executeTrail` enforces trail `permit` declarations once a surface has resolved a permit into `ctx.permit`.
 
 ## The core pattern
 
@@ -12,7 +12,7 @@ The permits package owns the connector-agnostic `authResource` and `authLayer`.
 export const create = trail('gist.create', {
   permit: { scopes: ['gist:write'] },
   blaze: async (input, ctx) => {
-    // authLayer enforces scopes before blaze runs
+    // executeTrail enforces scopes before blaze runs
     return Result.ok(newGist);
   },
 });
@@ -26,44 +26,44 @@ export const search = trail('gist.search', {
 });
 ```
 
-### 2. Register the auth layer
+### 2. Resolve a permit at the surface
 
 ```typescript
-import { authLayer } from '@ontrails/permits';
-
 export const graph = topo('my-app', gistModule);
-// Register authLayer with your surface
+// Surface auth verifies credentials and passes { permit } into executeTrail.
 ```
 
-The layer reads each trail's `permit` field:
+The execution pipeline reads each trail's `permit` field:
+
+- `'public'` or `undefined` — execution passes through
+- `{ scopes: [...] }` — execution checks that `ctx.permit` contains all required scopes
 
-- `'public'` or `undefined` — layer passes through
-- `{ scopes: [...] }` — layer checks that `ctx.permit` contains all required scopes
+Permit enforcement is intrinsic to `executeTrail`; there is no opt-in layer to wire. The previously deprecated `authLayer` compatibility wrapper has been removed (TRL-475).
 
-### 3. Bind a connector at bootstrap
+### 3. Bind an adapter at bootstrap
 
 ```typescript
-import { createJwtConnector } from '@ontrails/permits/jwt';
+import { createJwtAdapter } from '@ontrails/permits/jwt';
 
-const connector = createJwtConnector({
+const adapter = createJwtAdapter({
   secret: process.env.JWT_SECRET,
   issuer: 'https://auth.example.com',
   audience: 'api.example.com',
 });
 ```
 
-## Auth connectors
+## Auth adapters
 
-An auth connector authenticates requests and produces permits.
+An auth adapter authenticates requests and produces permits.
 
-### Built-in: JWT connector
+### Built-in: JWT adapter
 
 Verifies HS256-signed JWTs and extracts claims into permits:
 
 ```typescript
-import { createJwtConnector } from '@ontrails/permits/jwt';
+import { createJwtAdapter } from '@ontrails/permits/jwt';
 
-const connector = createJwtConnector({
+const adapter = createJwtAdapter({
   secret: 'your-hmac-secret',
   issuer: 'https://auth.example.com',
   audience: 'api.example.com',
@@ -72,14 +72,19 @@ const connector = createJwtConnector({
 });
 ```
 
-### Custom connectors
+`@ontrails/permits/jwt` is the canonical built-in JWT adapter subpath. The root
+package intentionally keeps convenience re-exports for interactive discovery,
+but generated code, docs, and adapter-specific examples should import JWT names
+from the subpath.
+
+### Custom adapters
 
-Implement the `AuthConnector` interface:
+Implement the `AuthAdapter` interface:
 
 ```typescript
-import type { AuthConnector, PermitExtractionInput, Permit } from '@ontrails/permits';
+import type { AuthAdapter, PermitExtractionInput, Permit } from '@ontrails/permits';
 
-const myConnector: AuthConnector = {
+const myAdapter: AuthAdapter = {
   authenticate: async (input: PermitExtractionInput) => {
     if (!input.bearerToken) return Result.ok(null);
     const permit: Permit = {
@@ -138,7 +143,10 @@ import { authVerify } from '@ontrails/permits';
 Use `createTestPermit()` and `createPermitForTrail()` in tests:
 
 ```typescript
-import { createTestPermit, createPermitForTrail } from '@ontrails/permits';
+import {
+  createTestPermit,
+  createPermitForTrail,
+} from '@ontrails/permits/testing';
 
 const permit = createTestPermit({
   id: 'user-123',

package/package.json

@@ -1,10 +1,19 @@
 {
   "name": "@ontrails/permits",
-  "version": "1.0.0-beta.15",
+  "version": "1.0.0-beta.17",
+  "files": [
+    "src/**/*.ts",
+    "!src/**/__tests__/**",
+    "!src/**/*.test.ts",
+    "!src/**/*.test-d.ts",
+    "README.md",
+    "CHANGELOG.md"
+  ],
   "type": "module",
   "exports": {
     ".": "./src/index.ts",
-    "./jwt": "./src/connectors/jwt.ts",
+    "./jwt": "./src/adapters/jwt.ts",
+    "./testing": "./src/testing.ts",
     "./package.json": "./package.json"
   },
   "scripts": {
@@ -15,7 +24,7 @@
     "clean": "rm -rf dist *.tsbuildinfo"
   },
   "peerDependencies": {
-    "@ontrails/core": "^1.0.0-beta.14",
+    "@ontrails/core": "^1.0.0-beta.16",
     "zod": "^4.3.5"
   }
 }

package/src/adapters/adapter.ts

@@ -0,0 +1,41 @@
+import { z } from 'zod';
+import type { Result } from '@ontrails/core';
+
+import type { PermitExtractionInput } from '../extraction.js';
+import type { Permit } from '../permit.js';
+
+/** Errors from auth adapters. */
+export const authErrorSchema = z
+  .object({
+    code: z.enum([
+      'expired_token',
+      'insufficient_scope',
+      'invalid_token',
+      'missing_credentials',
+    ]),
+    message: z.string(),
+  })
+  .readonly();
+
+export type AuthError = z.infer<typeof authErrorSchema>;
+
+export const authAdapterSchema = z
+  .object({
+    authenticate: z.function(),
+  })
+  .readonly();
+
+/**
+ * Auth adapter port. Given extraction input, produce a permit or an error.
+ *
+ * The adapter receives the full {@link PermitExtractionInput} — surface,
+ * headers, requestId, and credential fields — so it can make richer
+ * decisions (e.g., rate-limit by surface or correlate via requestId).
+ *
+ * Deliberately narrow — no session management, no token refresh.
+ */
+export interface AuthAdapter {
+  readonly authenticate: (
+    input: PermitExtractionInput
+  ) => Promise<Result<Permit | null, AuthError>>;
+}

package/src/{connectors → adapters}/jwt.ts

@@ -1,13 +1,19 @@
 import { Result } from '@ontrails/core';
 
-import type { AuthConnector, AuthError } from './connector.js';
+import type { AuthAdapter, AuthError } from './adapter.js';
 import type { PermitExtractionInput } from '../extraction.js';
 import type { Permit } from '../permit.js';
 
-/** Configuration for the JWT auth connector. */
-export interface JwtConnectorOptions {
+/** Configuration for the JWT auth adapter. */
+export interface JwtAdapterOptions {
+  /** Accepted JWT header algorithms (default: ['HS256']). */
+  readonly allowedAlgorithms?: readonly JwtAlgorithm[];
+  /** Clock skew tolerated for exp/nbf checks, in seconds (default: 60). */
+  readonly clockSkewSeconds?: number;
   /** HMAC secret for HS256 verification. */
   readonly secret?: string;
+  /** Whether accepted tokens must include exp (default: true). */
+  readonly requireExpiration?: boolean;
   /** JWKS endpoint for RS256/ES256 (not yet implemented). */
   readonly jwksUrl?: string;
   /** Expected issuer claim. */
@@ -20,12 +26,22 @@ export interface JwtConnectorOptions {
   readonly rolesClaim?: string;
 }
 
+/** JWT algorithms this adapter can verify today. */
+export type JwtAlgorithm = 'HS256';
+
+interface JwtHeader {
+  readonly alg?: unknown;
+  readonly typ?: unknown;
+  readonly [key: string]: unknown;
+}
+
 /** JWT payload with standard claims. */
 interface JwtPayload {
   readonly sub?: string;
   readonly iss?: string;
   readonly aud?: string | readonly string[];
-  readonly exp?: number;
+  readonly exp?: number | null;
+  readonly nbf?: number;
   readonly [key: string]: unknown;
 }
 
@@ -33,6 +49,14 @@ interface JwtPayload {
 // Helpers (defined before callers)
 // ---------------------------------------------------------------------------
 
+const DEFAULT_ALLOWED_ALGORITHMS = [
+  'HS256',
+] as const satisfies readonly JwtAlgorithm[];
+const SUPPORTED_JWT_ALGORITHMS = [
+  'HS256',
+] as const satisfies readonly JwtAlgorithm[];
+const DEFAULT_CLOCK_SKEW_SECONDS = 60;
+
 const authErr = (
   code: AuthError['code'],
   message: string
@@ -52,20 +76,66 @@ const base64urlDecode = (input: string): Uint8Array => {
   return bytes;
 };
 
-/** Decode a JWT payload without verifying the signature. */
-const decodePayload = (token: string): JwtPayload | undefined => {
+const splitToken = (
+  token: string
+): readonly [string, string, string] | undefined => {
   const parts = token.split('.');
   if (parts.length !== 3) {
     return undefined;
   }
+  return [parts[0] ?? '', parts[1] ?? '', parts[2] ?? ''];
+};
+
+const decodeJsonPart = <T>(part: string): T | undefined => {
   try {
-    const json = new TextDecoder().decode(base64urlDecode(parts[1] ?? ''));
-    return JSON.parse(json) as JwtPayload;
+    const json = new TextDecoder().decode(base64urlDecode(part));
+    return JSON.parse(json) as T;
   } catch {
     return undefined;
   }
 };
 
+const normalizeClockSkewSeconds = (options: JwtAdapterOptions): number => {
+  const raw = options.clockSkewSeconds ?? DEFAULT_CLOCK_SKEW_SECONDS;
+  const value = Math.floor(raw);
+  return Number.isFinite(value)
+    ? Math.max(0, value)
+    : DEFAULT_CLOCK_SKEW_SECONDS;
+};
+
+const allowedAlgorithms = (
+  options: JwtAdapterOptions
+): readonly JwtAlgorithm[] =>
+  options.allowedAlgorithms ?? DEFAULT_ALLOWED_ALGORITHMS;
+
+const isSupportedJwtAlgorithm = (
+  algorithm: string
+): algorithm is JwtAlgorithm =>
+  (SUPPORTED_JWT_ALGORITHMS as readonly string[]).includes(algorithm);
+
+const validateHeader = (
+  header: JwtHeader,
+  options: JwtAdapterOptions
+): Result<JwtAlgorithm, AuthError> => {
+  if (typeof header.alg !== 'string') {
+    return authErr('invalid_token', 'Missing JWT alg header');
+  }
+  if (!isSupportedJwtAlgorithm(header.alg)) {
+    return authErr('invalid_token', 'Unsupported JWT alg header');
+  }
+  const configuredAlgorithms = allowedAlgorithms(options);
+  if (configuredAlgorithms.length === 0) {
+    return authErr(
+      'invalid_token',
+      'JWT allowedAlgorithms must include at least one algorithm'
+    );
+  }
+  if (!configuredAlgorithms.includes(header.alg)) {
+    return authErr('invalid_token', 'Unsupported JWT alg header');
+  }
+  return Result.ok(header.alg);
+};
+
 /** Import a secret as an HMAC CryptoKey. */
 const importHmacKey = (secret: string): Promise<CryptoKey> => {
   const encoder = new TextEncoder();
@@ -98,17 +168,59 @@ const verifyHmacSignature = (
   );
 };
 
+const verifyJwtSignature = async (
+  token: string,
+  secret: string,
+  algorithm: JwtAlgorithm
+): Promise<boolean> => {
+  switch (algorithm) {
+    case 'HS256': {
+      const key = await importHmacKey(secret);
+      return await verifyHmacSignature(token, key);
+    }
+    default: {
+      const exhaustive: never = algorithm;
+      void exhaustive;
+      return false;
+    }
+  }
+};
+
 /** Validate standard claims (exp, iss, aud). */
 const validateClaims = (
   payload: JwtPayload,
-  options: JwtConnectorOptions
+  options: JwtAdapterOptions
 ): AuthError | undefined => {
+  const now = Math.floor(Date.now() / 1000);
+  const skew = normalizeClockSkewSeconds(options);
+  const hasExpirationClaim = payload.exp !== undefined && payload.exp !== null;
+  if (!hasExpirationClaim && options.requireExpiration !== false) {
+    return { code: 'invalid_token', message: 'Missing expiration claim (exp)' };
+  }
   if (
     payload.exp !== undefined &&
-    payload.exp < Math.floor(Date.now() / 1000)
+    (typeof payload.exp !== 'number' || !Number.isFinite(payload.exp))
+  ) {
+    return { code: 'invalid_token', message: 'Invalid expiration claim (exp)' };
+  }
+  if (
+    payload.exp !== undefined &&
+    payload.exp !== null &&
+    payload.exp < now - skew
   ) {
     return { code: 'expired_token', message: 'Token has expired' };
   }
+  if (payload.nbf !== undefined) {
+    if (typeof payload.nbf !== 'number' || !Number.isFinite(payload.nbf)) {
+      return {
+        code: 'invalid_token',
+        message: 'Invalid not-before claim (nbf)',
+      };
+    }
+    if (payload.nbf > now + skew) {
+      return { code: 'invalid_token', message: 'Token is not valid yet' };
+    }
+  }
   if (options.issuer && payload.iss !== options.issuer) {
     return { code: 'invalid_token', message: 'Issuer mismatch' };
   }
@@ -156,7 +268,7 @@ const extractRoles = (
 /** Build a Permit from a validated JWT payload. */
 const buildPermit = (
   payload: JwtPayload,
-  options: JwtConnectorOptions
+  options: JwtAdapterOptions
 ): Result<Permit, AuthError> => {
   if (!payload.sub) {
     return authErr('invalid_token', 'Missing subject claim (sub)');
@@ -172,15 +284,28 @@ const buildPermit = (
 /** Verify the signature and return the decoded payload, or an error. */
 const decodeAndVerify = async (
   token: string,
-  secret: string
+  secret: string,
+  options: JwtAdapterOptions
 ): Promise<Result<JwtPayload, AuthError>> => {
-  const payload = decodePayload(token);
+  const parts = splitToken(token);
+  if (!parts) {
+    return authErr('invalid_token', 'Malformed JWT');
+  }
+  const [rawHeader, rawPayload] = parts;
+  const header = decodeJsonPart<JwtHeader>(rawHeader);
+  if (!header) {
+    return authErr('invalid_token', 'Malformed JWT header');
+  }
+  const headerResult = validateHeader(header, options);
+  if (headerResult.isErr()) {
+    return headerResult;
+  }
+  const payload = decodeJsonPart<JwtPayload>(rawPayload);
   if (!payload) {
     return authErr('invalid_token', 'Malformed JWT');
   }
   try {
-    const key = await importHmacKey(secret);
-    const valid = await verifyHmacSignature(token, key);
+    const valid = await verifyJwtSignature(token, secret, headerResult.value);
     return valid
       ? Result.ok(payload)
       : authErr('invalid_token', 'Invalid signature');
@@ -192,7 +317,7 @@ const decodeAndVerify = async (
 /** Validate claims and build a permit from a verified payload. */
 const payloadToPermit = (
   payload: JwtPayload,
-  options: JwtConnectorOptions
+  options: JwtAdapterOptions
 ): Result<Permit, AuthError> => {
   const claimError = validateClaims(payload, options);
   if (claimError) {
@@ -206,15 +331,13 @@ const payloadToPermit = (
 // ---------------------------------------------------------------------------
 
 /**
- * Create a JWT auth connector using Bun's native crypto.
+ * Create a JWT auth adapter using Bun's native crypto.
  *
  * Verifies HS256-signed JWTs, extracts claims into a Permit, and checks
  * issuer/audience when configured. Returns `Result.ok(null)` when no
  * credentials are provided.
  */
-export const createJwtConnector = (
-  options: JwtConnectorOptions
-): AuthConnector => {
+export const createJwtAdapter = (options: JwtAdapterOptions): AuthAdapter => {
   const authenticate = async (
     input: PermitExtractionInput
   ): Promise<Result<Permit | null, AuthError>> => {
@@ -224,7 +347,11 @@ export const createJwtConnector = (
     if (!options.secret) {
       return authErr('invalid_token', 'No secret configured');
     }
-    const decoded = await decodeAndVerify(input.bearerToken, options.secret);
+    const decoded = await decodeAndVerify(
+      input.bearerToken,
+      options.secret,
+      options
+    );
     return decoded.isErr() ? decoded : payloadToPermit(decoded.value, options);
   };
 

package/src/auth-resource.ts

@@ -1,26 +1,89 @@
 import { Result, resource } from '@ontrails/core';
+import { z } from 'zod';
 
-import type { AuthConnector } from './connectors/connector.js';
+import type { AuthAdapter } from './adapters/adapter.js';
+import { createJwtAdapter } from './adapters/jwt.js';
+import type { JwtAdapterOptions } from './adapters/jwt.js';
+
+const authNoneConfigSchema = z
+  .object({
+    adapter: z.literal('none'),
+  })
+  .readonly();
+
+const authJwtConfigSchema = z
+  .object({
+    adapter: z.literal('jwt'),
+    allowedAlgorithms: z.array(z.literal('HS256')).readonly().optional(),
+    audience: z.string().optional(),
+    clockSkewSeconds: z.number().int().nonnegative().optional(),
+    issuer: z.string().optional(),
+    requireExpiration: z.boolean().optional(),
+    rolesClaim: z.string().min(1).optional(),
+    scopesClaim: z.string().min(1).optional(),
+    secret: z.string().min(1),
+  })
+  .strict()
+  .readonly();
+
+export const authResourceConfigSchema = z
+  .discriminatedUnion('adapter', [authNoneConfigSchema, authJwtConfigSchema])
+  .default({ adapter: 'none' });
+
+export type AuthResourceConfig = z.infer<typeof authResourceConfigSchema>;
+
+const createNoopAdapter = (): AuthAdapter => ({
+  // oxlint-disable-next-line require-await -- no-op adapter satisfies async interface
+  authenticate: async () => Result.ok(null),
+});
+
+const createAdapter = (config: AuthResourceConfig): AuthAdapter => {
+  switch (config.adapter) {
+    case 'none': {
+      return createNoopAdapter();
+    }
+    case 'jwt': {
+      const jwtOptions: JwtAdapterOptions = {
+        ...(config.allowedAlgorithms === undefined
+          ? {}
+          : { allowedAlgorithms: config.allowedAlgorithms }),
+        ...(config.audience === undefined ? {} : { audience: config.audience }),
+        ...(config.clockSkewSeconds === undefined
+          ? {}
+          : { clockSkewSeconds: config.clockSkewSeconds }),
+        ...(config.issuer === undefined ? {} : { issuer: config.issuer }),
+        ...(config.requireExpiration === undefined
+          ? {}
+          : { requireExpiration: config.requireExpiration }),
+        ...(config.rolesClaim === undefined
+          ? {}
+          : { rolesClaim: config.rolesClaim }),
+        ...(config.scopesClaim === undefined
+          ? {}
+          : { scopesClaim: config.scopesClaim }),
+        secret: config.secret,
+      };
+      return createJwtAdapter(jwtOptions);
+    }
+    default: {
+      const exhaustive: never = config;
+      void exhaustive;
+      return createNoopAdapter();
+    }
+  }
+};
 
 /**
- * Auth resource — manages the auth connector lifecycle.
+ * Auth resource — manages the auth adapter lifecycle.
  *
- * The v1 factory returns a no-op connector that always succeeds (null permit).
- * Real connector configuration will come through `ResourceSpec.config`
- * (TRL-91). The mock factory provides a synthetic connector that always
- * succeeds.
+ * Defaults to a no-op adapter that always succeeds with a null permit, and
+ * can be configured through `ResourceSpec.config` to materialize built-in
+ * adapters such as JWT.
  */
-export const authResource = resource<AuthConnector>('auth', {
-  create: (_svc) =>
-    Result.ok({
-      // oxlint-disable-next-line require-await -- stub connector satisfies async interface
-      authenticate: async () => Result.ok(null),
-    } satisfies AuthConnector),
-  description: 'Authentication connector',
+export const authResource = resource<AuthAdapter>('auth', {
+  config: authResourceConfigSchema,
+  create: (svc) => Result.ok(createAdapter(svc.config as AuthResourceConfig)),
+  description: 'Authentication adapter',
   meta: { category: 'infrastructure' },
-  mock: () =>
-    ({
-      // oxlint-disable-next-line require-await -- mock connector satisfies async interface
-      authenticate: async () => Result.ok(null),
-    }) satisfies AuthConnector,
+  mock: createNoopAdapter,
 });