@owlmeans/test-auth 0.1.18-rc.1 → 0.1.18-rc.11

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/test-auth",
-  "version": "0.1.18-rc.0",
-  "generatedAt": "2026-08-16T22:20:50.499Z",
+  "version": "0.1.18-rc.11",
+  "generatedAt": "2026-09-01T16:28:56.982Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/testing-auth-unit/SKILL.md

@@ -25,12 +25,12 @@ For background on the protocol you're mocking, read the `auth-protocol` skill.
 ## `tests/context.ts` pattern
 
 ```ts
-import { AppType, Layer, makeBasicContext } from '@owlmeans/context'
+import { AppType, makeBasicContext } from '@owlmeans/context'
 import { makeMemoryTrustedResource, withAuth, USER } from '@owlmeans/test-auth'
 
 export const makeTestCtx = () => {
   const ctx = makeBasicContext({
-    ready: false, service: '<pkg>-tests', layer: Layer.Service, type: AppType.Backend,
+    ready: false, service: '<pkg>-tests', type: AppType.Backend, services: {},
   })
   ctx.registerResource(makeMemoryTrustedResource([
     { id: 'svc', name: 'svc', credential: '<fixture-pubkey>' },
@@ -40,6 +40,15 @@ export const makeTestCtx = () => {
 }
 ```
 
+One factory, one context: the trusted resource and the mock guard are registered inside it, in the
+order a real app's `makeContext` would.
+
+`makeMemoryTrustedResource` implements only `load`, `save` and `create` — enough for the `trust()`
+boundary and for seeding from a spec; every other resource method throws. A read takes an id or a
+single-field criteria over `id` or `name`, and anything wider is refused with
+`UnsupportedArgumentError` rather than scanned: a query the mock cannot answer exactly is a test
+reaching past its seam, and the honest fix is integration coverage.
+
 The trusted resource, mock guard, and any fixture keys are the **only** mocks allowed. Everything else (the service under test, sibling packages it depends on) is the real thing.
 
 ## Spec shape

package/build/envelope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"envelope.d.ts","sourceRoot":"","sources":["../src/envelope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAqB,MAAM,0BAA0B,CAAA;AAC1E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAExD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAA;AAK1C;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAU,CAAC,SAAS,EAAE,GAAG,MAAM,OACrD,CAAC,QACA,MAAM,SACN,YAAY,OACd,YAAY,KACf,OAAO,CAAC,MAAM,CAKhB,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,UAAU,SACf,IAAI,OACL,YAAY,KAChB,OAAO,CAAC,MAAM,CAQhB,CAAA"}
+{"version":3,"file":"envelope.d.ts","sourceRoot":"","sources":["../src/envelope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAqB,MAAM,0BAA0B,CAAA;AAC1E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAExD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAA;AAK1C;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAU,CAAC,SAAS,EAAE,GAAG,MAAM,EAC1D,KAAK,CAAC,EACN,MAAM,MAAM,EACZ,OAAM,YAAiC,EACvC,KAAI,YAAsD,KACzD,OAAO,CAAC,MAAM,CAKhB,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,UAAU,GACrB,MAAM,IAAI,EACV,KAAK,YAAY,KAChB,OAAO,CAAC,MAAM,CAQhB,CAAA"}

package/build/envelope.js.map

@@ -1 +1 @@
-{"version":3,"file":"envelope.js","sourceRoot":"","sources":["../src/envelope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAE1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAElD,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AAE9C,MAAM,kBAAkB,GAAG,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,EAAE,CAAA;AAE5E;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EACnC,GAAM,EACN,IAAY,EACZ,IAAI,GAAiB,YAAY,CAAC,KAAK,EACvC,EAAE,GAAiB,kBAAkB,CAAC,mBAAmB,CAAC,EACzC,EAAE;IACnB,MAAM,QAAQ,GAAG,iBAAiB,CAAI,IAAI,CAAC,CAAA;IAC3C,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAClB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;IAC5C,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAC7B,IAAU,EACV,EAAiB,EACA,EAAE;IACnB,MAAM,OAAO,GAAG,MAAM,gBAAgB,CACpC,IAA0C,EAC1C,iBAAiB,CAAC,iBAAiB,EACnC,YAAY,CAAC,KAAK,EAClB,EAAE,CACH,CAAA;IACD,OAAO,GAAG,kBAAkB,IAAI,OAAO,EAAE,CAAA;AAC3C,CAAC,CAAA"}
+{"version":3,"file":"envelope.js","sourceRoot":"","sources":["../src/envelope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAE1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAElD,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AAE9C,MAAM,kBAAkB,GAAG,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,EAAE,CAAA;AAE5E;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EACnC,GAAM,EACN,IAAY,EACZ,OAAqB,YAAY,CAAC,KAAK,EACvC,KAAmB,kBAAkB,CAAC,mBAAmB,CAAC,EACzC,EAAE;IACnB,MAAM,QAAQ,GAAG,iBAAiB,CAAI,IAAI,CAAC,CAAA;IAC3C,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAClB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;IAC5C,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAC7B,IAAU,EACV,EAAiB,EACA,EAAE;IACnB,MAAM,OAAO,GAAG,MAAM,gBAAgB,CACpC,IAA0C,EAC1C,iBAAiB,CAAC,iBAAiB,EACnC,YAAY,CAAC,KAAK,EAClB,EAAE,CACH,CAAA;IACD,OAAO,GAAG,kBAAkB,IAAI,OAAO,EAAE,CAAA;AAC3C,CAAC,CAAA"}

package/build/guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAElE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAE3F,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,iEAAiE;IACjE,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,iGAAiG;IACjG,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,gBAAgB,CAAC,OAAO,CAAC,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5F,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa,UAAU,gBAAgB,KAAQ,YAsB3D,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,QAAQ,GAAI,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,YAAY,CAAC,CAAC,CAAC,WAC9D,CAAC,QACJ,IAAI,UACH,MAAM,KACZ,CAGF,CAAA"}
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAElE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAE3F,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,iEAAiE;IACjE,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,iGAAiG;IACjG,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,gBAAgB,CAAC,OAAO,CAAC,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5F,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa,GAAI,OAAM,gBAAqB,KAAG,YAsB3D,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,QAAQ,GAAI,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,YAAY,CAAC,CAAC,CAAC,EACvE,SAAS,CAAC,EACV,MAAM,IAAI,EACV,QAAO,MAAsB,KAC5B,CAGF,CAAA"}

package/build/guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"guard.js","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAcrD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAI,GAAqB,EAAE,EAAgB,EAAE;IACzE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,aAAa,CAAA;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IAExC,MAAM,KAAK,GAAG,aAAa,CAAe,KAAK,EAAE;QAC/C,KAAK,EAAE,IAAI,CAAC,KAAK;QAEjB,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACxB,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;QACvC,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;YAC1B,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;gBACtB,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACxB,CAAC;YACD,OAAO,IAAI,CAAC,IAAa,CAAA;QAC3B,CAAC;QAED,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI;KAC9C,CAAC,CAAA;IAEF,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CACtB,OAAU,EACV,IAAU,EACV,KAAK,GAAW,aAAa,EAC1B,EAAE;IACL,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAC5C,OAAO,OAAO,CAAC,eAAe,CAAI,KAAK,CAAC,CAAA;AAC1C,CAAC,CAAA"}
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAcrD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAAyB,EAAE,EAAgB,EAAE;IACzE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,aAAa,CAAA;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IAExC,MAAM,KAAK,GAAG,aAAa,CAAe,KAAK,EAAE;QAC/C,KAAK,EAAE,IAAI,CAAC,KAAK;QAEjB,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACxB,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;QACvC,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;YAC1B,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;gBACtB,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACxB,CAAC;YACD,OAAO,IAAI,CAAC,IAAa,CAAA;QAC3B,CAAC;QAED,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI;KAC9C,CAAC,CAAA;IAEF,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CACtB,OAAU,EACV,IAAU,EACV,QAAgB,aAAa,EAC1B,EAAE;IACL,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAC5C,OAAO,OAAO,CAAC,eAAe,CAAI,KAAK,CAAC,CAAA;AAC1C,CAAC,CAAA"}

package/build/keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAMxD;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,UAAW,MAAM,KAAG,YAMlD,CAAA"}
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAMxD;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,GAAI,OAAO,MAAM,KAAG,YAMlD,CAAA"}

package/build/trusted.d.ts

@@ -9,6 +9,10 @@ import type { Resource } from '@owlmeans/resource';
  * `trust()` boundary plus straightforward seeding from tests. Other
  * operations throw, so tests that need them have to be honest about
  * adding integration coverage instead of leaning on the mock.
+ *
+ * A read takes an id or a single-field criteria over `id` or `name`. Anything
+ * wider is refused rather than scanned: the mock holds a handful of fixtures
+ * and a query it cannot answer exactly is a test reaching past its seam.
  */
 export declare const makeMemoryTrustedResource: (records?: TrustedRecord[], alias?: string) => Resource<TrustedRecord>;
 //# sourceMappingURL=trusted.d.ts.map

package/build/trusted.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"trusted.d.ts","sourceRoot":"","sources":["../src/trusted.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAC1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAWlD;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,aAC3B,aAAa,EAAE,UACjB,MAAM,KACZ,QAAQ,CAAC,aAAa,CAsDxB,CAAA"}
+{"version":3,"file":"trusted.d.ts","sourceRoot":"","sources":["../src/trusted.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAC1D,OAAO,KAAK,EAA0B,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAe1E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,yBAAyB,GACpC,UAAS,aAAa,EAAO,EAC7B,QAAO,MAA8B,KACpC,QAAQ,CAAC,aAAa,CAqExB,CAAA"}

package/build/trusted.js

@@ -1,5 +1,8 @@
 import { appendContextual } from '@owlmeans/context';
+import { UnsupportedArgumentError } from '@owlmeans/resource';
 const TRUSTED_DEFAULT_ALIAS = 'TRUSTED';
+/** The fields a `trust()` lookup keys on — the only index this map has. */
+const SUPPORTED_FIELDS = ['id', 'name'];
 const notImplemented = (op) => {
     throw new Error(`@owlmeans/test-auth: in-memory TRUSTED resource does not implement ${op}()`);
 };
@@ -13,6 +16,10 @@ const getter = (record, field) => record[field];
  * `trust()` boundary plus straightforward seeding from tests. Other
  * operations throw, so tests that need them have to be honest about
  * adding integration coverage instead of leaning on the mock.
+ *
+ * A read takes an id or a single-field criteria over `id` or `name`. Anything
+ * wider is refused rather than scanned: the mock holds a handful of fixtures
+ * and a query it cannot answer exactly is a test reaching past its seam.
  */
 export const makeMemoryTrustedResource = (records = [], alias = TRUSTED_DEFAULT_ALIAS) => {
     const store = new Map();
@@ -29,16 +36,24 @@ export const makeMemoryTrustedResource = (records = [], alias = TRUSTED_DEFAULT_
         }
         return null;
     };
+    /**
+     * @throws {UnsupportedArgumentError} on criteria naming anything but one supported field.
+     */
+    const first = (idOrWhere) => {
+        if (typeof idOrWhere === 'string') {
+            return store.get(idOrWhere) ?? null;
+        }
+        const entries = Object.entries(idOrWhere).filter(([, value]) => value !== undefined);
+        const [entry, ...rest] = entries;
+        if (entry == null || rest.length > 0
+            || !SUPPORTED_FIELDS.includes(entry[0]) || typeof entry[1] !== 'string') {
+            throw new UnsupportedArgumentError('test-auth:trusted:where');
+        }
+        const [field, value] = entry;
+        return field === 'id' ? store.get(value) ?? null : findByField(value, field);
+    };
     const resource = {
-        load: async (id, field) => {
-            const fieldName = typeof field === 'string'
-                ? field
-                : field?.field;
-            if (fieldName != null && fieldName !== 'id') {
-                return findByField(id, fieldName) ?? null;
-            }
-            return store.get(id) ?? null;
-        },
+        load: async (idOrWhere, _opts) => first(idOrWhere),
         save: async (record) => {
             if (record.id == null) {
                 throw new Error('@owlmeans/test-auth: cannot save TRUSTED record without id');
@@ -58,9 +73,11 @@ export const makeMemoryTrustedResource = (records = [], alias = TRUSTED_DEFAULT_
         },
         get: () => notImplemented('get'),
         list: () => notImplemented('list'),
+        count: () => notImplemented('count'),
         update: () => notImplemented('update'),
         delete: () => notImplemented('delete'),
-        pick: () => notImplemented('pick'),
+        take: () => notImplemented('take'),
+        purge: () => notImplemented('purge'),
     };
     return appendContextual(alias, resource);
 };

package/build/trusted.js.map

@@ -1 +1 @@
-{"version":3,"file":"trusted.js","sourceRoot":"","sources":["../src/trusted.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAIpD,MAAM,qBAAqB,GAAG,SAAS,CAAA;AAEvC,MAAM,cAAc,GAAG,CAAC,EAAU,EAAS,EAAE;IAC3C,MAAM,IAAI,KAAK,CAAC,sEAAsE,EAAE,IAAI,CAAC,CAAA;AAC/F,CAAC,CAAA;AAED,MAAM,MAAM,GAAG,CAAC,MAAqB,EAAE,KAAa,EAAW,EAAE,CAC9D,MAA6C,CAAC,KAAK,CAAC,CAAA;AAEvD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,OAAO,GAAoB,EAAE,EAC7B,KAAK,GAAW,qBAAqB,EACZ,EAAE;IAC3B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAyB,CAAA;IAC9C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;QACnE,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;IACpB,CAAC;IAED,MAAM,WAAW,GAAG,CAAC,KAAa,EAAE,KAAa,EAAwB,EAAE;QACzE,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACpC,IAAI,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,KAAK;gBAAE,OAAO,MAAM,CAAA;QACpD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IAED,MAAM,QAAQ,GAAqC;QACjD,IAAI,EAAE,KAAK,EAA8B,EAAU,EAAE,KAAe,EAAE,EAAE;YACtE,MAAM,SAAS,GAAG,OAAO,KAAK,KAAK,QAAQ;gBACzC,CAAC,CAAC,KAAK;gBACP,CAAC,CAAE,KAAwC,EAAE,KAAK,CAAA;YACpD,IAAI,SAAS,IAAI,IAAI,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBAC5C,OAAQ,WAAW,CAAC,EAAE,EAAE,SAAS,CAAiB,IAAI,IAAI,CAAA;YAC5D,CAAC;YACD,OAAQ,KAAK,CAAC,GAAG,CAAC,EAAE,CAAsB,IAAI,IAAI,CAAA;QACpD,CAAC;QAED,IAAI,EAAE,KAAK,EAA8B,MAAqB,EAAE,EAAE;YAChE,IAAI,MAAM,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;YAC/E,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAuB,CAAC,CAAA;YAC7C,OAAO,MAAc,CAAA;QACvB,CAAC;QAED,MAAM,EAAE,KAAK,EAA8B,MAAqB,EAAE,EAAE;YAClE,IAAI,MAAM,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAA;YACjF,CAAC;YACD,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,uCAAuC,MAAM,CAAC,EAAE,iBAAiB,CAAC,CAAA;YACpF,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAuB,CAAC,CAAA;YAC7C,OAAO,MAAc,CAAA;QACvB,CAAC;QAED,GAAG,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC;QAChC,IAAI,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC;QAClC,MAAM,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;QACtC,MAAM,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;QACtC,IAAI,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC;KACnC,CAAA;IAED,OAAO,gBAAgB,CAA0B,KAAK,EAAE,QAAQ,CAAC,CAAA;AACnE,CAAC,CAAA"}
+{"version":3,"file":"trusted.js","sourceRoot":"","sources":["../src/trusted.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAGpD,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAA;AAE7D,MAAM,qBAAqB,GAAG,SAAS,CAAA;AAEvC,2EAA2E;AAC3E,MAAM,gBAAgB,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;AAEvC,MAAM,cAAc,GAAG,CAAC,EAAU,EAAS,EAAE;IAC3C,MAAM,IAAI,KAAK,CAAC,sEAAsE,EAAE,IAAI,CAAC,CAAA;AAC/F,CAAC,CAAA;AAED,MAAM,MAAM,GAAG,CAAC,MAAqB,EAAE,KAAa,EAAW,EAAE,CAC9D,MAA6C,CAAC,KAAK,CAAC,CAAA;AAEvD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,UAA2B,EAAE,EAC7B,QAAgB,qBAAqB,EACZ,EAAE;IAC3B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAyB,CAAA;IAC9C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;QACnE,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;IACpB,CAAC;IAED,MAAM,WAAW,GAAG,CAAC,KAAa,EAAE,KAAa,EAAwB,EAAE;QACzE,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACpC,IAAI,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,KAAK;gBAAE,OAAO,MAAM,CAAA;QACpD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IAED;;OAEG;IACH,MAAM,KAAK,GAAG,CAAC,SAA2C,EAAwB,EAAE;QAClF,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAA;QACrC,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAA;QACpF,MAAM,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAA;QAChC,IAAI,KAAK,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;eAC/B,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1E,MAAM,IAAI,wBAAwB,CAAC,yBAAyB,CAAC,CAAA;QAC/D,CAAC;QACD,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,KAAyB,CAAA;QAEhD,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IAC9E,CAAC,CAAA;IAED,MAAM,QAAQ,GAAqC;QACjD,IAAI,EAAE,KAAK,EACT,SAA2C,EAAE,KAAmC,EACjD,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;QAEpD,IAAI,EAAE,KAAK,EAAE,MAA8B,EAAE,EAAE;YAC7C,IAAI,MAAM,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;YAC/E,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAuB,CAAC,CAAA;YAC7C,OAAO,MAAuB,CAAA;QAChC,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,MAA8B,EAAE,EAAE;YAC/C,IAAI,MAAM,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAA;YACjF,CAAC;YACD,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,uCAAuC,MAAM,CAAC,EAAE,iBAAiB,CAAC,CAAA;YACpF,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAuB,CAAC,CAAA;YAC7C,OAAO,MAAuB,CAAA;QAChC,CAAC;QAED,GAAG,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC;QAChC,IAAI,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC;QAClC,KAAK,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC;QACpC,MAAM,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;QACtC,MAAM,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;QACtC,IAAI,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC;QAClC,KAAK,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC;KACrC,CAAA;IAED,OAAO,gBAAgB,CAA0B,KAAK,EAAE,QAAQ,CAAC,CAAA;AACnE,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/test-auth",
-  "version": "0.1.18-rc.1",
+  "version": "0.1.18-rc.11",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -21,18 +21,18 @@
     }
   },
   "dependencies": {
-    "@owlmeans/auth": "^0.1.18-rc.1",
-    "@owlmeans/auth-common": "^0.1.18-rc.1",
-    "@owlmeans/basic-envelope": "^0.1.18-rc.1",
-    "@owlmeans/basic-keys": "^0.1.18-rc.1",
-    "@owlmeans/context": "^0.1.18-rc.1",
-    "@owlmeans/entrypoint": "^0.1.18-rc.1",
-    "@owlmeans/resource": "^0.1.18-rc.1",
-    "@owlmeans/test": "^0.1.18-rc.1"
+    "@owlmeans/auth": "^0.1.18-rc.8",
+    "@owlmeans/auth-common": "^0.1.18-rc.11",
+    "@owlmeans/basic-envelope": "^0.1.18-rc.10",
+    "@owlmeans/basic-keys": "^0.1.18-rc.10",
+    "@owlmeans/context": "^0.1.18-rc.7",
+    "@owlmeans/entrypoint": "^0.1.18-rc.9",
+    "@owlmeans/resource": "^0.1.18-rc.8",
+    "@owlmeans/test": "^0.1.18-rc.7"
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",
-    "@types/bun": "^1.3.14",
+    "@types/bun": "^1.4.0",
     "nodemon": "^3.1.14",
     "typescript": "^7.0.2"
   },

package/src/trusted.ts

@@ -1,9 +1,13 @@
 import { appendContextual } from '@owlmeans/context'
 import type { TrustedRecord } from '@owlmeans/auth-common'
-import type { Resource } from '@owlmeans/resource'
+import type { Criteria, FirstOptions, Resource } from '@owlmeans/resource'
+import { UnsupportedArgumentError } from '@owlmeans/resource'
 
 const TRUSTED_DEFAULT_ALIAS = 'TRUSTED'
 
+/** The fields a `trust()` lookup keys on — the only index this map has. */
+const SUPPORTED_FIELDS = ['id', 'name']
+
 const notImplemented = (op: string): never => {
   throw new Error(`@owlmeans/test-auth: in-memory TRUSTED resource does not implement ${op}()`)
 }
@@ -20,6 +24,10 @@ const getter = (record: TrustedRecord, field: string): unknown =>
  * `trust()` boundary plus straightforward seeding from tests. Other
  * operations throw, so tests that need them have to be honest about
  * adding integration coverage instead of leaning on the mock.
+ *
+ * A read takes an id or a single-field criteria over `id` or `name`. Anything
+ * wider is refused rather than scanned: the mock holds a handful of fixtures
+ * and a query it cannot answer exactly is a test reaching past its seam.
  */
 export const makeMemoryTrustedResource = (
   records: TrustedRecord[] = [],
@@ -40,26 +48,39 @@ export const makeMemoryTrustedResource = (
     return null
   }
 
+  /**
+   * @throws {UnsupportedArgumentError} on criteria naming anything but one supported field.
+   */
+  const first = (idOrWhere: string | Criteria<TrustedRecord>): TrustedRecord | null => {
+    if (typeof idOrWhere === 'string') {
+      return store.get(idOrWhere) ?? null
+    }
+
+    const entries = Object.entries(idOrWhere).filter(([, value]) => value !== undefined)
+    const [entry, ...rest] = entries
+    if (entry == null || rest.length > 0
+      || !SUPPORTED_FIELDS.includes(entry[0]) || typeof entry[1] !== 'string') {
+      throw new UnsupportedArgumentError('test-auth:trusted:where')
+    }
+    const [field, value] = entry as [string, string]
+
+    return field === 'id' ? store.get(value) ?? null : findByField(value, field)
+  }
+
   const resource: Partial<Resource<TrustedRecord>> = {
-    load: async <Type extends TrustedRecord>(id: string, field?: unknown) => {
-      const fieldName = typeof field === 'string'
-        ? field
-        : (field as { field?: string } | undefined)?.field
-      if (fieldName != null && fieldName !== 'id') {
-        return (findByField(id, fieldName) as Type | null) ?? null
-      }
-      return (store.get(id) as Type | undefined) ?? null
-    },
+    load: async (
+      idOrWhere: string | Criteria<TrustedRecord>, _opts?: FirstOptions<TrustedRecord>
+    ): Promise<TrustedRecord | null> => first(idOrWhere),
 
-    save: async <Type extends TrustedRecord>(record: Partial<Type>) => {
+    save: async (record: Partial<TrustedRecord>) => {
       if (record.id == null) {
         throw new Error('@owlmeans/test-auth: cannot save TRUSTED record without id')
       }
       store.set(record.id, record as TrustedRecord)
-      return record as Type
+      return record as TrustedRecord
     },
 
-    create: async <Type extends TrustedRecord>(record: Partial<Type>) => {
+    create: async (record: Partial<TrustedRecord>) => {
       if (record.id == null) {
         throw new Error('@owlmeans/test-auth: cannot create TRUSTED record without id')
       }
@@ -67,14 +88,16 @@ export const makeMemoryTrustedResource = (
         throw new Error(`@owlmeans/test-auth: TRUSTED record ${record.id} already exists`)
       }
       store.set(record.id, record as TrustedRecord)
-      return record as Type
+      return record as TrustedRecord
     },
 
     get: () => notImplemented('get'),
     list: () => notImplemented('list'),
+    count: () => notImplemented('count'),
     update: () => notImplemented('update'),
     delete: () => notImplemented('delete'),
-    pick: () => notImplemented('pick'),
+    take: () => notImplemented('take'),
+    purge: () => notImplemented('purge'),
   }
 
   return appendContextual<Resource<TrustedRecord>>(alias, resource)