@owlmeans/test-auth 0.1.18-rc.5 → 0.1.18-rc.50

package/README.md

@@ -1,16 +1,124 @@
 # @owlmeans/test-auth
 
-The **only** OwlMeans package that ships authentication/authorization mocks. Tests in any other package may import from here when they need a fake authenticated identity, a deterministic Ed25519 keypair, or an in-memory `TRUSTED` resource. No other mocks (database, network, sibling-package services) belong in test code — those packages get integration tests instead. See the `auth-protocol` skill for the protocol this mock implements.
+The **only** OwlMeans package that ships authentication/authorization mocks. Tests in any other package may import from here when they need a fake authenticated identity, a deterministic Ed25519 keypair, or an in-memory `TRUSTED` resource. No other mocks (database, network, sibling-package services) belong in test code — those packages get integration tests instead (`@owlmeans/test-integration`). It is a dev dependency of category-B packages (the auth/authz family); a category-A package that seems to need it is testing behaviour that belongs in an auth-aware sibling. The package's skill is `testing-auth-unit`; the protocol these mocks stand in for is described by the `auth-protocol` skill.
 
-Helpers exported here:
+## Installation
 
-- `makeFixtureKeyPair(seed?)` — deterministic Ed25519 `KeyPairModel`.
-- `makeMemoryTrustedResource(records?)` — `Resource<TrustedRecord>` satisfying `trust()` lookups against the `TRUSTED` config resource.
-- `makeMockGuard({ alias?, auth?, allow? })` — `GuardService` that resolves to a chosen `Auth`. Implements `match`, `handle`, `authenticated`.
-- `withAuth(ctx, auth)` — convenience that registers a mock guard with a chosen `Auth` on the context.
-- `signMockEnvelope(msg, type, kind?, kp?)` — wraps `makeEnvelopeModel` with a fixture keypair to produce a signed envelope.
-- `makeBearer(auth, kp?)` — `ED25519-BASIC-TOKEN <encoded>` header value for unit tests of header parsing.
-- Canonical fixtures: `SUPERUSER`, `USER`, `SERVICE` `Auth` payloads.
+```bash
+bun add -d @owlmeans/test-auth@^0.1.18-rc.50
+```
+
+It depends on `@owlmeans/test`, so the env gates and fixture loader are available alongside.
+
+## Concepts
+
+- **Fixture keypair** — `makeFixtureKeyPair(seed)`: an Ed25519 `KeyPairModel` derived from a seed,
+  so signatures and trusted records are stable run to run. No seed gives a random pair.
+- **Trusted resource** — `makeMemoryTrustedResource(records, alias?)`: a `Resource<TrustedRecord>`
+  registered under `TRUSTED` that answers the `trust()` lookups of `@owlmeans/auth-common`.
+- **Mock guard** — `makeMockGuard(opts)`: a real `GuardService` shape (`match`, `handle`,
+  `authenticated`) that resolves a chosen `Auth` without cryptography or trusted-record lookups.
+  Defaults to the `DEFAULT_GUARD` alias, so it takes the place a real guard would occupy.
+- **Canonical identities** — `SUPERUSER`, `USER`, `SERVICE`: `Auth` payloads with `scopes: ['*']`.
+- **Last registration wins** — `registerService` overwrites an alias, so a mock guard registered
+  before a real one under the same alias is silently replaced.
+
+## Usage
+
+### Build the suite's context
+
+```typescript
+// tests/context.ts
+import { AppType, makeBasicContext } from '@owlmeans/context'
+import type { BasicConfig } from '@owlmeans/context'
+import type { TrustedRecord } from '@owlmeans/auth-common'
+import { USER, appendMockGuard, makeFixtureKeyPair, makeMemoryTrustedResource } from '@owlmeans/test-auth'
+
+export const authKey = makeFixtureKeyPair('auth-service')
+
+export const authRecord: TrustedRecord = {
+  id: authKey.exportAddress(),
+  name: 'auth-service',               // trust() looks up by name by default — seed both fields
+  credential: authKey.exportPublic(), // add `secret: authKey.export()` when the code must sign
+  scopes: ['*'],
+}
+
+export const makeTestCtx = () => {
+  const ctx = makeBasicContext<BasicConfig>({
+    ready: false, service: 'my-pkg-tests', type: AppType.Backend,
+  })
+  ctx.registerResource(makeMemoryTrustedResource([authRecord]))
+  appendMockGuard(ctx, USER)          // after anything that registers a real guard
+
+  return ctx
+}
+```
+
+### Control what the guard matches
+
+```typescript
+import { SERVICE, makeMockGuard } from '@owlmeans/test-auth'
+
+const guard = makeMockGuard({
+  alias: 'service-guard',
+  auth: SERVICE,
+  allow: req => req.headers['x-service'] != null,  // `match` reports this predicate
+  token: 'token-service',                          // what client-side `authenticated()` answers
+})
+ctx.registerService(guard)
+```
+
+### Sign envelopes and bearers
+
+```typescript
+import { EnvelopeKind } from '@owlmeans/basic-envelope'
+import { USER, makeBearer, makeFixtureKeyPair, signMockEnvelope } from '@owlmeans/test-auth'
+
+const key = makeFixtureKeyPair('alice')
+const token = await signMockEnvelope({ userId: 'u-1' }, 'ed25519-basic-token', EnvelopeKind.Token, key)
+
+const header = await makeBearer(USER, key) // 'ED25519-BASIC-TOKEN <encoded>'
+```
+
+## API
+
+| Symbol | Kind | Purpose |
+|---|---|---|
+| `makeFixtureKeyPair(seed?)` | function | Deterministic Ed25519 `KeyPairModel`; random without a seed |
+| `makeMemoryTrustedResource(records?, alias?)` | function | `Resource<TrustedRecord>` satisfying `trust()` lookups against the `TRUSTED` config resource; `alias` defaults to `'TRUSTED'` |
+| `makeMockGuard(opts?)` | function | `GuardService` that resolves to a chosen `Auth`; implements `match`, `handle`, `authenticated` |
+| `appendMockGuard(ctx, auth, alias?)` | function | Registers a mock guard resolving to `auth` on the context and returns it |
+| `signMockEnvelope(msg, type, kind?, kp?)` | function | Wraps `makeEnvelopeModel` with a fixture keypair to produce a signed envelope; `kind` defaults to `EnvelopeKind.Token` |
+| `makeBearer(auth, kp?)` | function | `ED25519-BASIC-TOKEN <encoded>` header value for unit tests of header parsing and guard `match` |
+| `SUPERUSER`, `USER`, `SERVICE` | const | Canonical `Auth` payloads (`Superuser` / `User` / `Service` roles) |
+| `MockGuardOptions` | type | `{ alias?, auth?, allow?, token? }` |
+
+### The in-memory trusted resource
+
+- Implements only `load`, `save` and `create`; every other method throws.
+- A read takes an id, or a criteria over exactly one of `id` / `name` with a string value; anything
+  wider throws `UnsupportedArgumentError('test-auth:trusted:where')`.
+- Every record needs an `id` — a record without one is rejected on construction, and `create` refuses
+  an id already held.
+
+## Common pitfalls
+
+- Registering the mock guard first and a real guard (through an `append*` mixin or a context factory)
+  afterwards under the same alias — the real one wins and the spec fails on a trusted-record lookup.
+- Using random keypairs where a signature or record must be stable — pass a seed.
+- Seeding a trusted record with `id` only — `trust()` looks up by `name`.
+- Adding a new auth mock to a package's own `tests/` — it belongs here, documented in the
+  `testing-auth-unit` skill.
+- Mocking anything other than authentication/authorization — write an integration test instead.
+
+## Related packages
+
+- [`@owlmeans/test`](../test) — env gates and fixture loader this package builds on
+- [`@owlmeans/test-integration`](../test-integration) — the place for tests that would need any other mock
+- [`@owlmeans/auth-common`](../auth-common) — `trust()`, `TrustedRecord`, `DEFAULT_GUARD`
+- [`@owlmeans/basic-keys`](../basic-keys) — `KeyPairModel`
+- [`@owlmeans/basic-envelope`](../basic-envelope) — `makeEnvelopeModel`, `EnvelopeKind`
+- [`@owlmeans/auth`](../auth) — the `Auth` type and roles
 
 <!-- owlmeans:agent-guidance:start -->
 ## Agent guidance
@@ -20,7 +128,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills
+npx @owlmeans/agent-skills@^0.1.18-rc.56
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/test-auth",
-  "version": "0.1.18-rc.0",
-  "generatedAt": "2026-08-16T22:20:50.499Z",
+  "version": "0.1.18-rc.50",
+  "generatedAt": "2026-10-17T00:00:32.697Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/testing-auth-unit/SKILL.md

@@ -1,12 +1,14 @@
 ---
 name: testing-auth-unit
-description: Category-B unit tests for OwlMeans Common — auth/authz packages where the test substitutes a fake authenticated identity via @owlmeans/test-auth. Auto-invoked when writing tests in auth, auth-common, basic-keys, basic-envelope, did, client-auth, client-did, server-auth, oidc, server-oidc-*, web-oidc-*, wled, client-payment.
+description: Category-B unit tests for OwlMeans Common — auth/authz packages where the test substitutes a fake authenticated identity via @owlmeans/test-auth. Auto-invoked when writing tests in auth, auth-common, auth-otp, basic-keys, basic-envelope, did, client-auth, client-did, client-iam, client-payment, mui-oidc-rp, oidc, server-auth, server-auth-otp, server-oidc-*, web-auth, web-oidc-*, wled.
 ---
 <!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
 
 # Auth Unit Tests — Category B
 
-Category B applies to the auth/authz packages: `auth`, `auth-common`, `basic-keys`, `basic-envelope`, `did`, `client-auth`, `client-did`, `server-auth`, `oidc`, `server-oidc-rp`, `server-oidc-provider`, `web-oidc-rp`, `web-oidc-provider`, `wled`, `client-payment`. These tests run under `bun test` (no Playwright even when there are React bits) and are the **only** place mocks are allowed — and only for authentication/authorization, via `@owlmeans/test-auth`.
+**Install:** `"@owlmeans/test-auth": "^0.1.18-rc.50"` in `devDependencies`
+
+Category B applies to the auth/authz packages: `auth`, `auth-common`, `auth-otp`, `basic-envelope`, `basic-keys`, `client-auth`, `client-did`, `client-iam`, `client-payment`, `did`, `mui-oidc-rp`, `oidc`, `server-auth`, `server-auth-otp`, `server-oidc-provider`, `server-oidc-rp`, `web-auth`, `web-oidc-provider`, `web-oidc-rp`, `wled`. These tests run under `bun test` (no Playwright even when there are React bits) and are the **only** place mocks are allowed — and only for authentication/authorization, via `@owlmeans/test-auth`.
 
 For background on the protocol you're mocking, read the `auth-protocol` skill.
 
@@ -14,23 +16,37 @@ For background on the protocol you're mocking, read the `auth-protocol` skill.
 
 | Helper | Purpose |
 |---|---|
-| `makeFixtureKeyPair(seed?)` | Deterministic Ed25519 `KeyPairModel`. Same seed → same keys. |
-| `makeMemoryTrustedResource(records?)` | `Resource<TrustedRecord>` that satisfies `trust()` lookups. |
-| `makeMockGuard({ alias?, auth?, allow? })` | `GuardService` resolving to a chosen `Auth`. |
-| `withAuth(ctx, auth)` | Registers a mock guard on `ctx` that resolves to `auth`. |
-| `signMockEnvelope(msg, type, kind?, kp?)` | Wraps `makeEnvelopeModel` with a fixture keypair. |
-| `makeBearer(auth, kp?)` | Produces an `ED25519-BASIC-TOKEN <encoded>` header. |
-| `SUPERUSER`, `USER`, `SERVICE` | Canonical `Auth` payload fixtures. |
+| `makeFixtureKeyPair(seed?)` | Deterministic Ed25519 `KeyPairModel`. Same seed → same keys; no seed → a fresh random pair. |
+| `makeMemoryTrustedResource(records?, alias?)` | `Resource<TrustedRecord>` that satisfies `trust()` lookups. `alias` defaults to `TRUSTED`. |
+| `makeMockGuard(opts?)` | `GuardService` resolving to a chosen `Auth`, registerable exactly like a real guard. |
+| `MockGuardOptions` | `{ alias?, auth?, allow?, token? }` — see below. |
+| `withAuth(ctx, auth, alias?)` | Registers a mock guard on `ctx` that resolves to `auth`, and returns `ctx`. |
+| `signMockEnvelope(msg, type, kind?, kp?)` | Wraps `makeEnvelopeModel` with a fixture keypair and signs it; `kind` defaults to `EnvelopeKind.Token`. |
+| `makeBearer(auth, kp?)` | Produces an `ED25519-BASIC-TOKEN <encoded>` header value from an `Auth`. |
+| `SUPERUSER`, `USER`, `SERVICE` | Canonical `Auth` payload fixtures (`Superuser` / `User` / `Service` roles, `scopes: ['*']`). |
+
+`MockGuardOptions` carries the whole seam: `auth` is what `handle` resolves into the response,
+`allow` is the predicate `match` reports (default: always match), `token` is what the client-side
+`authenticated()` answers, and `alias` defaults to `DEFAULT_GUARD` so the mock takes the place a
+real guard would occupy. `withAuth` is the shorthand for the common case.
+
+**The last registration for an alias wins.** `registerService` in `@owlmeans/context` assigns
+`services[service.alias]`, so it overwrites silently — there is no "first one keeps the slot".
+Register the mock **after** anything that appends a real guard under the same alias (an
+`append*` mixin the package documents, or a context factory that wires one), or give the mock
+its own alias and point the entrypoint's guard at that. A mock registered first and then
+overwritten leaves the spec exercising real cryptography and failing on a trusted-record
+lookup, which reads as an unrelated failure.
 
 ## `tests/context.ts` pattern
 
 ```ts
-import { AppType, Layer, makeBasicContext } from '@owlmeans/context'
+import { AppType, makeBasicContext } from '@owlmeans/context'
 import { makeMemoryTrustedResource, withAuth, USER } from '@owlmeans/test-auth'
 
 export const makeTestCtx = () => {
   const ctx = makeBasicContext({
-    ready: false, service: '<pkg>-tests', layer: Layer.Service, type: AppType.Backend,
+    ready: false, service: '<pkg>-tests', type: AppType.Backend, services: {},
   })
   ctx.registerResource(makeMemoryTrustedResource([
     { id: 'svc', name: 'svc', credential: '<fixture-pubkey>' },
@@ -40,6 +56,21 @@ export const makeTestCtx = () => {
 }
 ```
 
+One factory, one context: the trusted resource and the mock guard are registered inside it, in the
+order a real app's `makeContext` would.
+
+`makeMemoryTrustedResource` implements only `load`, `save` and `create` — enough for the `trust()`
+boundary and for seeding from a spec; every other resource method throws. A read takes an id or a
+single-field criteria over `id` or `name`, and anything wider is refused with
+`UnsupportedArgumentError` rather than scanned: a query the mock cannot answer exactly is a test
+reaching past its seam, and the honest fix is integration coverage.
+
+Every seeded record needs an `id`; a record without one is rejected on construction, and so is a
+`create` for an id already held. `trust(context, resource, userName)` looks up by `name` by
+default, so seed both fields. Give the record a `credential` (a public key) when the code under
+test only verifies, and a `secret` (a private key) when it must sign as the trusted party —
+`trust()` prefers `secret` and falls back to `credential`.
+
 The trusted resource, mock guard, and any fixture keys are the **only** mocks allowed. Everything else (the service under test, sibling packages it depends on) is the real thing.
 
 ## Spec shape
@@ -65,10 +96,10 @@ describe('@owlmeans/basic-keys — packAuthCredentials', () => {
 - **Mocks only for auth/authz.** No mocks for databases, network, or any sibling package. If you need one, move the spec to category C and write an integration test.
 - **Don't replicate `@owlmeans/test-auth` helpers in your package.** If you need a new mocking primitive (e.g. an OIDC userinfo endpoint stub), add it to `@owlmeans/test-auth` and its skill — never to a per-package `tests/`.
 - **Use deterministic seeds.** `makeFixtureKeyPair('<seed>')` keeps signatures stable run-to-run; random keypairs break snapshot-style assertions.
-- **Cover SKILL.md cases first.** The package's `.agents/skills/<pkg>/SKILL.md` documents the consumer-facing surface — that's the test priority order.
+- **Cover SKILL.md cases first.** The package's own skill (its directory under `.agents/skills/` — named for the skill, which is not always the package name) documents the consumer-facing surface, and that is the test priority order.
 - **Max 3-4 tests per method/function.** Same as category A.
 - **Don't test types or utils.**
 
 ## When you actually want OIDC end-to-end
 
-The current `@owlmeans/test-auth` does not ship a fake JWKS server. Use the real `makeOidcGuard` against the in-memory trusted resource and a fixture keypair. If a future test needs a hostable IdP fake, add it to `@owlmeans/test-auth` and document it here — don't bolt it on per package.
+`@owlmeans/test-auth` ships no fake JWKS server. Use the real `makeOidcGuard` against the in-memory trusted resource and a fixture keypair. If a future test needs a hostable IdP fake, add it to `@owlmeans/test-auth` and document it here — don't bolt it on per package.

package/build/consts.local.d.ts

@@ -0,0 +1,6 @@
+export declare const TRUSTED_DEFAULT_ALIAS = "TRUSTED";
+/** The fields a `trust()` lookup keys on — the only index this map has. */
+export declare const SUPPORTED_FIELDS: string[];
+/** The scheme word of an `Authorization` header carrying an Ed25519 basic token. */
+export declare const AUTH_BEARER_PREFIX: string;
+//# sourceMappingURL=consts.local.d.ts.map

package/build/consts.local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.local.d.ts","sourceRoot":"","sources":["../src/consts.local.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,qBAAqB,YAAY,CAAA;AAE9C,2EAA2E;AAC3E,eAAO,MAAM,gBAAgB,UAAiB,CAAA;AAE9C,oFAAoF;AACpF,eAAO,MAAM,kBAAkB,QAAoD,CAAA"}

package/build/consts.local.js

@@ -0,0 +1,7 @@
+import { AuthroizationType } from '@owlmeans/auth';
+export const TRUSTED_DEFAULT_ALIAS = 'TRUSTED';
+/** The fields a `trust()` lookup keys on — the only index this map has. */
+export const SUPPORTED_FIELDS = ['id', 'name'];
+/** The scheme word of an `Authorization` header carrying an Ed25519 basic token. */
+export const AUTH_BEARER_PREFIX = AuthroizationType.Ed25519BasicToken.toUpperCase();
+//# sourceMappingURL=consts.local.js.map

package/build/consts.local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.local.js","sourceRoot":"","sources":["../src/consts.local.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAElD,MAAM,CAAC,MAAM,qBAAqB,GAAG,SAAS,CAAA;AAE9C,2EAA2E;AAC3E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;AAE9C,oFAAoF;AACpF,MAAM,CAAC,MAAM,kBAAkB,GAAG,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,EAAE,CAAA"}

package/build/envelope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"envelope.d.ts","sourceRoot":"","sources":["../src/envelope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAqB,MAAM,0BAA0B,CAAA;AAC1E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAExD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAA;AAK1C;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAU,CAAC,SAAS,EAAE,GAAG,MAAM,OACrD,CAAC,QACA,MAAM,SACN,YAAY,OACd,YAAY,KACf,OAAO,CAAC,MAAM,CAKhB,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,UAAU,SACf,IAAI,OACL,YAAY,KAChB,OAAO,CAAC,MAAM,CAQhB,CAAA"}
+{"version":3,"file":"envelope.d.ts","sourceRoot":"","sources":["../src/envelope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAqB,MAAM,0BAA0B,CAAA;AAC1E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAExD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAA;AAI1C;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAU,CAAC,SAAS,EAAE,GAAG,MAAM,OACrD,CAAC,QACA,MAAM,SACN,YAAY,OACd,YAAY,KACf,OAAO,CAAC,MAAM,CAKhB,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,UAAU,SACf,IAAI,OACL,YAAY,KAChB,OAAO,CAAC,MAAM,CAQhB,CAAA"}

package/build/envelope.js

@@ -1,7 +1,7 @@
 import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope';
 import { AuthroizationType } from '@owlmeans/auth';
 import { makeFixtureKeyPair } from './keys.js';
-const AUTH_BEARER_PREFIX = AuthroizationType.Ed25519BasicToken.toUpperCase();
+import { AUTH_BEARER_PREFIX } from './consts.local.js';
 /**
  * Wrap a payload in a signed `EnvelopeModel` using a fixture keypair (or one
  * supplied by the caller) and serialize it. Useful in category-B tests that

package/build/envelope.js.map

@@ -1 +1 @@
-{"version":3,"file":"envelope.js","sourceRoot":"","sources":["../src/envelope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAE1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAElD,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AAE9C,MAAM,kBAAkB,GAAG,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,EAAE,CAAA;AAE5E;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EACnC,GAAM,EACN,IAAY,EACZ,IAAI,GAAiB,YAAY,CAAC,KAAK,EACvC,EAAE,GAAiB,kBAAkB,CAAC,mBAAmB,CAAC,EACzC,EAAE;IACnB,MAAM,QAAQ,GAAG,iBAAiB,CAAI,IAAI,CAAC,CAAA;IAC3C,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAClB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;IAC5C,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAC7B,IAAU,EACV,EAAiB,EACA,EAAE;IACnB,MAAM,OAAO,GAAG,MAAM,gBAAgB,CACpC,IAA0C,EAC1C,iBAAiB,CAAC,iBAAiB,EACnC,YAAY,CAAC,KAAK,EAClB,EAAE,CACH,CAAA;IACD,OAAO,GAAG,kBAAkB,IAAI,OAAO,EAAE,CAAA;AAC3C,CAAC,CAAA"}
+{"version":3,"file":"envelope.js","sourceRoot":"","sources":["../src/envelope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAE1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAElD,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAEtD;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EACnC,GAAM,EACN,IAAY,EACZ,IAAI,GAAiB,YAAY,CAAC,KAAK,EACvC,EAAE,GAAiB,kBAAkB,CAAC,mBAAmB,CAAC,EACzC,EAAE;IACnB,MAAM,QAAQ,GAAG,iBAAiB,CAAI,IAAI,CAAC,CAAA;IAC3C,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAClB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;IAC5C,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAC7B,IAAU,EACV,EAAiB,EACA,EAAE;IACnB,MAAM,OAAO,GAAG,MAAM,gBAAgB,CACpC,IAA0C,EAC1C,iBAAiB,CAAC,iBAAiB,EACnC,YAAY,CAAC,KAAK,EAClB,EAAE,CACH,CAAA;IACD,OAAO,GAAG,kBAAkB,IAAI,OAAO,EAAE,CAAA;AAC3C,CAAC,CAAA"}

package/build/guard.d.ts

@@ -1,15 +1,7 @@
-import type { BasicConfig, BasicContext } from '@owlmeans/context';
+import { type BasicConfig, type BasicContext } from '@owlmeans/context';
 import type { Auth } from '@owlmeans/auth';
-import type { AbstractRequest, AbstractResponse, GuardService } from '@owlmeans/entrypoint';
-export interface MockGuardOptions {
-    alias?: string;
-    /** Auth payload that `handle` will resolve into the response. */
-    auth?: Auth;
-    /** Optional predicate that decides whether `match` reports a hit. Defaults to "always match". */
-    allow?: (req: AbstractRequest, res: AbstractResponse<unknown>) => boolean | Promise<boolean>;
-    /** Token returned by the client-side `authenticated()` method. */
-    token?: string;
-}
+import type { GuardService } from '@owlmeans/entrypoint';
+import type { MockGuardOptions } from './types.js';
 /**
  * Build a `GuardService` that resolves to a chosen `Auth` without exercising
  * any real cryptography or trusted-record lookup. Use this in category-B
@@ -26,5 +18,5 @@ export declare const makeMockGuard: (opts?: MockGuardOptions) => GuardService;
  * Returns the same context for chaining. Existing guards under the same
  * alias are not replaced — register before any real guard service.
  */
-export declare const withAuth: <C extends BasicConfig, T extends BasicContext<C>>(context: T, auth: Auth, alias?: string) => T;
+export declare const appendMockGuard: <C extends BasicConfig, T extends BasicContext<C>>(context: T, auth: Auth, alias?: string) => T;
 //# sourceMappingURL=guard.d.ts.map

package/build/guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAElE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAE3F,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,iEAAiE;IACjE,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,iGAAiG;IACjG,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,gBAAgB,CAAC,OAAO,CAAC,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5F,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa,UAAU,gBAAgB,KAAQ,YAsB3D,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,QAAQ,GAAI,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,YAAY,CAAC,CAAC,CAAC,WAC9D,CAAC,QACJ,IAAI,UACH,MAAM,KACZ,CAGF,CAAA"}
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,KAAK,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAEtF,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElD;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa,UAAU,gBAAgB,KAAQ,YAsB3D,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAAI,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,YAAY,CAAC,CAAC,CAAC,WACrE,CAAC,QACJ,IAAI,UACH,MAAM,KACZ,CAGF,CAAA"}

package/build/guard.js

@@ -33,7 +33,7 @@ export const makeMockGuard = (opts = {}) => {
  * Returns the same context for chaining. Existing guards under the same
  * alias are not replaced — register before any real guard service.
  */
-export const withAuth = (context, auth, alias = DEFAULT_GUARD) => {
+export const appendMockGuard = (context, auth, alias = DEFAULT_GUARD) => {
     const guard = makeMockGuard({ alias, auth });
     return context.registerService(guard);
 };

package/build/guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"guard.js","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAcrD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAI,GAAqB,EAAE,EAAgB,EAAE;IACzE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,aAAa,CAAA;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IAExC,MAAM,KAAK,GAAG,aAAa,CAAe,KAAK,EAAE;QAC/C,KAAK,EAAE,IAAI,CAAC,KAAK;QAEjB,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACxB,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;QACvC,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;YAC1B,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;gBACtB,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACxB,CAAC;YACD,OAAO,IAAI,CAAC,IAAa,CAAA;QAC3B,CAAC;QAED,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI;KAC9C,CAAC,CAAA;IAEF,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CACtB,OAAU,EACV,IAAU,EACV,KAAK,GAAW,aAAa,EAC1B,EAAE;IACL,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAC5C,OAAO,OAAO,CAAC,eAAe,CAAI,KAAK,CAAC,CAAA;AAC1C,CAAC,CAAA"}
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAuC,MAAM,mBAAmB,CAAA;AACtF,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAKrD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAI,GAAqB,EAAE,EAAgB,EAAE;IACzE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,aAAa,CAAA;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IAExC,MAAM,KAAK,GAAG,aAAa,CAAe,KAAK,EAAE;QAC/C,KAAK,EAAE,IAAI,CAAC,KAAK;QAEjB,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACxB,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;QACvC,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;YAC1B,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;gBACtB,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACxB,CAAC;YACD,OAAO,IAAI,CAAC,IAAa,CAAA;QAC3B,CAAC;QAED,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI;KAC9C,CAAC,CAAA;IAEF,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,OAAU,EACV,IAAU,EACV,KAAK,GAAW,aAAa,EAC1B,EAAE;IACL,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAC5C,OAAO,OAAO,CAAC,eAAe,CAAI,KAAK,CAAC,CAAA;AAC1C,CAAC,CAAA"}

package/build/index.d.ts

@@ -1,6 +1,7 @@
 export * from './keys.js';
 export * from './trusted.js';
 export * from './guard.js';
+export type * from './types.js';
 export * from './envelope.js';
 export * from './fixtures.js';
 //# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAA;AACzB,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA;AAC1B,cAAc,eAAe,CAAA;AAC7B,cAAc,eAAe,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAA;AACzB,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA;AAC1B,mBAAmB,YAAY,CAAA;AAC/B,cAAc,eAAe,CAAA;AAC7B,cAAc,eAAe,CAAA"}

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAA;AACzB,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA;AAC1B,cAAc,eAAe,CAAA;AAC7B,cAAc,eAAe,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAA;AACzB,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA;AAE1B,cAAc,eAAe,CAAA;AAC7B,cAAc,eAAe,CAAA"}

package/build/trusted.d.ts

@@ -1,5 +1,5 @@
 import type { TrustedRecord } from '@owlmeans/auth-common';
-import type { Resource } from '@owlmeans/resource';
+import { type Resource } from '@owlmeans/resource';
 /**
  * In-memory `Resource<TrustedRecord>` used to satisfy `trust()` lookups
  * (`@owlmeans/auth-common/utils/trusted.ts`). Pre-populate with the
@@ -9,6 +9,10 @@ import type { Resource } from '@owlmeans/resource';
  * `trust()` boundary plus straightforward seeding from tests. Other
  * operations throw, so tests that need them have to be honest about
  * adding integration coverage instead of leaning on the mock.
+ *
+ * A read takes an id or a single-field criteria over `id` or `name`. Anything
+ * wider is refused rather than scanned: the mock holds a handful of fixtures
+ * and a query it cannot answer exactly is a test reaching past its seam.
  */
 export declare const makeMemoryTrustedResource: (records?: TrustedRecord[], alias?: string) => Resource<TrustedRecord>;
 //# sourceMappingURL=trusted.d.ts.map

package/build/trusted.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"trusted.d.ts","sourceRoot":"","sources":["../src/trusted.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAC1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAWlD;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,aAC3B,aAAa,EAAE,UACjB,MAAM,KACZ,QAAQ,CAAC,aAAa,CAsDxB,CAAA"}
+{"version":3,"file":"trusted.d.ts","sourceRoot":"","sources":["../src/trusted.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAC1D,OAAO,EAAoC,KAAK,QAAQ,EAA4B,MAAM,oBAAoB,CAAA;AAU9G;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,yBAAyB,aAC3B,aAAa,EAAE,UACjB,MAAM,KACZ,QAAQ,CAAC,aAAa,CAqExB,CAAA"}

package/build/trusted.js

@@ -1,5 +1,6 @@
 import { appendContextual } from '@owlmeans/context';
-const TRUSTED_DEFAULT_ALIAS = 'TRUSTED';
+import { UnsupportedArgumentError } from '@owlmeans/resource';
+import { SUPPORTED_FIELDS, TRUSTED_DEFAULT_ALIAS } from './consts.local.js';
 const notImplemented = (op) => {
     throw new Error(`@owlmeans/test-auth: in-memory TRUSTED resource does not implement ${op}()`);
 };
@@ -13,6 +14,10 @@ const getter = (record, field) => record[field];
  * `trust()` boundary plus straightforward seeding from tests. Other
  * operations throw, so tests that need them have to be honest about
  * adding integration coverage instead of leaning on the mock.
+ *
+ * A read takes an id or a single-field criteria over `id` or `name`. Anything
+ * wider is refused rather than scanned: the mock holds a handful of fixtures
+ * and a query it cannot answer exactly is a test reaching past its seam.
  */
 export const makeMemoryTrustedResource = (records = [], alias = TRUSTED_DEFAULT_ALIAS) => {
     const store = new Map();
@@ -29,16 +34,24 @@ export const makeMemoryTrustedResource = (records = [], alias = TRUSTED_DEFAULT_
         }
         return null;
     };
+    /**
+     * @throws {UnsupportedArgumentError} on criteria naming anything but one supported field.
+     */
+    const first = (idOrWhere) => {
+        if (typeof idOrWhere === 'string') {
+            return store.get(idOrWhere) ?? null;
+        }
+        const entries = Object.entries(idOrWhere).filter(([, value]) => value !== undefined);
+        const [entry, ...rest] = entries;
+        if (entry == null || rest.length > 0
+            || !SUPPORTED_FIELDS.includes(entry[0]) || typeof entry[1] !== 'string') {
+            throw new UnsupportedArgumentError('test-auth:trusted:where');
+        }
+        const [field, value] = entry;
+        return field === 'id' ? store.get(value) ?? null : findByField(value, field);
+    };
     const resource = {
-        load: async (id, field) => {
-            const fieldName = typeof field === 'string'
-                ? field
-                : field?.field;
-            if (fieldName != null && fieldName !== 'id') {
-                return findByField(id, fieldName) ?? null;
-            }
-            return store.get(id) ?? null;
-        },
+        load: async (idOrWhere, _opts) => first(idOrWhere),
         save: async (record) => {
             if (record.id == null) {
                 throw new Error('@owlmeans/test-auth: cannot save TRUSTED record without id');
@@ -58,9 +71,11 @@ export const makeMemoryTrustedResource = (records = [], alias = TRUSTED_DEFAULT_
         },
         get: () => notImplemented('get'),
         list: () => notImplemented('list'),
+        count: () => notImplemented('count'),
         update: () => notImplemented('update'),
         delete: () => notImplemented('delete'),
-        pick: () => notImplemented('pick'),
+        take: () => notImplemented('take'),
+        purge: () => notImplemented('purge'),
     };
     return appendContextual(alias, resource);
 };

package/build/trusted.js.map

@@ -1 +1 @@
-{"version":3,"file":"trusted.js","sourceRoot":"","sources":["../src/trusted.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAIpD,MAAM,qBAAqB,GAAG,SAAS,CAAA;AAEvC,MAAM,cAAc,GAAG,CAAC,EAAU,EAAS,EAAE;IAC3C,MAAM,IAAI,KAAK,CAAC,sEAAsE,EAAE,IAAI,CAAC,CAAA;AAC/F,CAAC,CAAA;AAED,MAAM,MAAM,GAAG,CAAC,MAAqB,EAAE,KAAa,EAAW,EAAE,CAC9D,MAA6C,CAAC,KAAK,CAAC,CAAA;AAEvD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,OAAO,GAAoB,EAAE,EAC7B,KAAK,GAAW,qBAAqB,EACZ,EAAE;IAC3B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAyB,CAAA;IAC9C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;QACnE,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;IACpB,CAAC;IAED,MAAM,WAAW,GAAG,CAAC,KAAa,EAAE,KAAa,EAAwB,EAAE;QACzE,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACpC,IAAI,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,KAAK;gBAAE,OAAO,MAAM,CAAA;QACpD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IAED,MAAM,QAAQ,GAAqC;QACjD,IAAI,EAAE,KAAK,EAA8B,EAAU,EAAE,KAAe,EAAE,EAAE;YACtE,MAAM,SAAS,GAAG,OAAO,KAAK,KAAK,QAAQ;gBACzC,CAAC,CAAC,KAAK;gBACP,CAAC,CAAE,KAAwC,EAAE,KAAK,CAAA;YACpD,IAAI,SAAS,IAAI,IAAI,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBAC5C,OAAQ,WAAW,CAAC,EAAE,EAAE,SAAS,CAAiB,IAAI,IAAI,CAAA;YAC5D,CAAC;YACD,OAAQ,KAAK,CAAC,GAAG,CAAC,EAAE,CAAsB,IAAI,IAAI,CAAA;QACpD,CAAC;QAED,IAAI,EAAE,KAAK,EAA8B,MAAqB,EAAE,EAAE;YAChE,IAAI,MAAM,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;YAC/E,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAuB,CAAC,CAAA;YAC7C,OAAO,MAAc,CAAA;QACvB,CAAC;QAED,MAAM,EAAE,KAAK,EAA8B,MAAqB,EAAE,EAAE;YAClE,IAAI,MAAM,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAA;YACjF,CAAC;YACD,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,uCAAuC,MAAM,CAAC,EAAE,iBAAiB,CAAC,CAAA;YACpF,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAuB,CAAC,CAAA;YAC7C,OAAO,MAAc,CAAA;QACvB,CAAC;QAED,GAAG,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC;QAChC,IAAI,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC;QAClC,MAAM,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;QACtC,MAAM,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;QACtC,IAAI,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC;KACnC,CAAA;IAED,OAAO,gBAAgB,CAA0B,KAAK,EAAE,QAAQ,CAAC,CAAA;AACnE,CAAC,CAAA"}
+{"version":3,"file":"trusted.js","sourceRoot":"","sources":["../src/trusted.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAEpD,OAAO,EAAmD,wBAAwB,EAAE,MAAM,oBAAoB,CAAA;AAC9G,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AAE3E,MAAM,cAAc,GAAG,CAAC,EAAU,EAAS,EAAE;IAC3C,MAAM,IAAI,KAAK,CAAC,sEAAsE,EAAE,IAAI,CAAC,CAAA;AAC/F,CAAC,CAAA;AAED,MAAM,MAAM,GAAG,CAAC,MAAqB,EAAE,KAAa,EAAW,EAAE,CAC9D,MAA6C,CAAC,KAAK,CAAC,CAAA;AAEvD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,OAAO,GAAoB,EAAE,EAC7B,KAAK,GAAW,qBAAqB,EACZ,EAAE;IAC3B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAyB,CAAA;IAC9C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;QACnE,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;IACpB,CAAC;IAED,MAAM,WAAW,GAAG,CAAC,KAAa,EAAE,KAAa,EAAwB,EAAE;QACzE,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACpC,IAAI,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,KAAK;gBAAE,OAAO,MAAM,CAAA;QACpD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IAED;;OAEG;IACH,MAAM,KAAK,GAAG,CAAC,SAA2C,EAAwB,EAAE;QAClF,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAA;QACrC,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAA;QACpF,MAAM,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAA;QAChC,IAAI,KAAK,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;eAC/B,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1E,MAAM,IAAI,wBAAwB,CAAC,yBAAyB,CAAC,CAAA;QAC/D,CAAC;QACD,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,KAAyB,CAAA;QAEhD,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IAC9E,CAAC,CAAA;IAED,MAAM,QAAQ,GAAqC;QACjD,IAAI,EAAE,KAAK,EACT,SAA2C,EAAE,KAAmC,EACjD,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;QAEpD,IAAI,EAAE,KAAK,EAAE,MAA8B,EAAE,EAAE;YAC7C,IAAI,MAAM,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;YAC/E,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAuB,CAAC,CAAA;YAC7C,OAAO,MAAuB,CAAA;QAChC,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,MAA8B,EAAE,EAAE;YAC/C,IAAI,MAAM,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAA;YACjF,CAAC;YACD,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,uCAAuC,MAAM,CAAC,EAAE,iBAAiB,CAAC,CAAA;YACpF,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAuB,CAAC,CAAA;YAC7C,OAAO,MAAuB,CAAA;QAChC,CAAC;QAED,GAAG,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC;QAChC,IAAI,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC;QAClC,KAAK,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC;QACpC,MAAM,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;QACtC,MAAM,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;QACtC,IAAI,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC;QAClC,KAAK,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC;KACrC,CAAA;IAED,OAAO,gBAAgB,CAA0B,KAAK,EAAE,QAAQ,CAAC,CAAA;AACnE,CAAC,CAAA"}

package/build/types.d.ts

@@ -0,0 +1,12 @@
+import type { Auth } from '@owlmeans/auth';
+import type { AbstractRequest, AbstractResponse } from '@owlmeans/entrypoint';
+export interface MockGuardOptions {
+    alias?: string;
+    /** Auth payload that `handle` will resolve into the response. */
+    auth?: Auth;
+    /** Optional predicate that decides whether `match` reports a hit. Defaults to "always match". */
+    allow?: (req: AbstractRequest, res: AbstractResponse<unknown>) => boolean | Promise<boolean>;
+    /** Token returned by the client-side `authenticated()` method. */
+    token?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAE7E,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,iEAAiE;IACjE,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,iGAAiG;IACjG,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,gBAAgB,CAAC,OAAO,CAAC,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5F,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,CAAA;CACf"}

package/build/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/test-auth",
-  "version": "0.1.18-rc.5",
+  "version": "0.1.18-rc.50",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -21,18 +21,18 @@
     }
   },
   "dependencies": {
-    "@owlmeans/auth": "^0.1.18-rc.5",
-    "@owlmeans/auth-common": "^0.1.18-rc.5",
-    "@owlmeans/basic-envelope": "^0.1.18-rc.5",
-    "@owlmeans/basic-keys": "^0.1.18-rc.5",
-    "@owlmeans/context": "^0.1.18-rc.5",
-    "@owlmeans/entrypoint": "^0.1.18-rc.5",
-    "@owlmeans/resource": "^0.1.18-rc.5",
-    "@owlmeans/test": "^0.1.18-rc.5"
+    "@owlmeans/auth": "^0.1.18-rc.41",
+    "@owlmeans/auth-common": "^0.1.18-rc.51",
+    "@owlmeans/basic-envelope": "^0.1.18-rc.50",
+    "@owlmeans/basic-keys": "^0.1.18-rc.52",
+    "@owlmeans/context": "^0.1.18-rc.34",
+    "@owlmeans/entrypoint": "^0.1.18-rc.41",
+    "@owlmeans/resource": "^0.1.18-rc.40",
+    "@owlmeans/test": "^0.1.18-rc.37"
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",
-    "@types/bun": "^1.3.14",
+    "@types/bun": "^1.4.2",
     "nodemon": "^3.1.14",
     "typescript": "^7.0.2"
   },

package/src/consts.local.ts

@@ -0,0 +1,9 @@
+import { AuthroizationType } from '@owlmeans/auth'
+
+export const TRUSTED_DEFAULT_ALIAS = 'TRUSTED'
+
+/** The fields a `trust()` lookup keys on — the only index this map has. */
+export const SUPPORTED_FIELDS = ['id', 'name']
+
+/** The scheme word of an `Authorization` header carrying an Ed25519 basic token. */
+export const AUTH_BEARER_PREFIX = AuthroizationType.Ed25519BasicToken.toUpperCase()

package/src/envelope.ts

@@ -3,8 +3,7 @@ import type { KeyPairModel } from '@owlmeans/basic-keys'
 import { AuthroizationType } from '@owlmeans/auth'
 import type { Auth } from '@owlmeans/auth'
 import { makeFixtureKeyPair } from './keys.js'
-
-const AUTH_BEARER_PREFIX = AuthroizationType.Ed25519BasicToken.toUpperCase()
+import { AUTH_BEARER_PREFIX } from './consts.local.js'
 
 /**
  * Wrap a payload in a signed `EnvelopeModel` using a fixture keypair (or one

package/src/guard.ts

@@ -1,18 +1,8 @@
-import { createService } from '@owlmeans/context'
-import type { BasicConfig, BasicContext } from '@owlmeans/context'
+import { createService, type BasicConfig, type BasicContext } from '@owlmeans/context'
 import { DEFAULT_GUARD } from '@owlmeans/auth-common'
 import type { Auth } from '@owlmeans/auth'
-import type { AbstractRequest, AbstractResponse, GuardService } from '@owlmeans/entrypoint'
-
-export interface MockGuardOptions {
-  alias?: string
-  /** Auth payload that `handle` will resolve into the response. */
-  auth?: Auth
-  /** Optional predicate that decides whether `match` reports a hit. Defaults to "always match". */
-  allow?: (req: AbstractRequest, res: AbstractResponse<unknown>) => boolean | Promise<boolean>
-  /** Token returned by the client-side `authenticated()` method. */
-  token?: string
-}
+import type { GuardService } from '@owlmeans/entrypoint'
+import type { MockGuardOptions } from './types.js'
 
 /**
  * Build a `GuardService` that resolves to a chosen `Auth` without exercising
@@ -53,7 +43,7 @@ export const makeMockGuard = (opts: MockGuardOptions = {}): GuardService => {
  * Returns the same context for chaining. Existing guards under the same
  * alias are not replaced — register before any real guard service.
  */
-export const withAuth = <C extends BasicConfig, T extends BasicContext<C>>(
+export const appendMockGuard = <C extends BasicConfig, T extends BasicContext<C>>(
   context: T,
   auth: Auth,
   alias: string = DEFAULT_GUARD

package/src/index.ts

@@ -1,5 +1,6 @@
 export * from './keys.js'
 export * from './trusted.js'
 export * from './guard.js'
+export type * from './types.js'
 export * from './envelope.js'
 export * from './fixtures.js'

package/src/trusted.ts

@@ -1,8 +1,7 @@
 import { appendContextual } from '@owlmeans/context'
 import type { TrustedRecord } from '@owlmeans/auth-common'
-import type { Resource } from '@owlmeans/resource'
-
-const TRUSTED_DEFAULT_ALIAS = 'TRUSTED'
+import { type Criteria, type FirstOptions, type Resource, UnsupportedArgumentError } from '@owlmeans/resource'
+import { SUPPORTED_FIELDS, TRUSTED_DEFAULT_ALIAS } from './consts.local.js'
 
 const notImplemented = (op: string): never => {
   throw new Error(`@owlmeans/test-auth: in-memory TRUSTED resource does not implement ${op}()`)
@@ -20,6 +19,10 @@ const getter = (record: TrustedRecord, field: string): unknown =>
  * `trust()` boundary plus straightforward seeding from tests. Other
  * operations throw, so tests that need them have to be honest about
  * adding integration coverage instead of leaning on the mock.
+ *
+ * A read takes an id or a single-field criteria over `id` or `name`. Anything
+ * wider is refused rather than scanned: the mock holds a handful of fixtures
+ * and a query it cannot answer exactly is a test reaching past its seam.
  */
 export const makeMemoryTrustedResource = (
   records: TrustedRecord[] = [],
@@ -40,26 +43,39 @@ export const makeMemoryTrustedResource = (
     return null
   }
 
+  /**
+   * @throws {UnsupportedArgumentError} on criteria naming anything but one supported field.
+   */
+  const first = (idOrWhere: string | Criteria<TrustedRecord>): TrustedRecord | null => {
+    if (typeof idOrWhere === 'string') {
+      return store.get(idOrWhere) ?? null
+    }
+
+    const entries = Object.entries(idOrWhere).filter(([, value]) => value !== undefined)
+    const [entry, ...rest] = entries
+    if (entry == null || rest.length > 0
+      || !SUPPORTED_FIELDS.includes(entry[0]) || typeof entry[1] !== 'string') {
+      throw new UnsupportedArgumentError('test-auth:trusted:where')
+    }
+    const [field, value] = entry as [string, string]
+
+    return field === 'id' ? store.get(value) ?? null : findByField(value, field)
+  }
+
   const resource: Partial<Resource<TrustedRecord>> = {
-    load: async <Type extends TrustedRecord>(id: string, field?: unknown) => {
-      const fieldName = typeof field === 'string'
-        ? field
-        : (field as { field?: string } | undefined)?.field
-      if (fieldName != null && fieldName !== 'id') {
-        return (findByField(id, fieldName) as Type | null) ?? null
-      }
-      return (store.get(id) as Type | undefined) ?? null
-    },
+    load: async (
+      idOrWhere: string | Criteria<TrustedRecord>, _opts?: FirstOptions<TrustedRecord>
+    ): Promise<TrustedRecord | null> => first(idOrWhere),
 
-    save: async <Type extends TrustedRecord>(record: Partial<Type>) => {
+    save: async (record: Partial<TrustedRecord>) => {
       if (record.id == null) {
         throw new Error('@owlmeans/test-auth: cannot save TRUSTED record without id')
       }
       store.set(record.id, record as TrustedRecord)
-      return record as Type
+      return record as TrustedRecord
     },
 
-    create: async <Type extends TrustedRecord>(record: Partial<Type>) => {
+    create: async (record: Partial<TrustedRecord>) => {
       if (record.id == null) {
         throw new Error('@owlmeans/test-auth: cannot create TRUSTED record without id')
       }
@@ -67,14 +83,16 @@ export const makeMemoryTrustedResource = (
         throw new Error(`@owlmeans/test-auth: TRUSTED record ${record.id} already exists`)
       }
       store.set(record.id, record as TrustedRecord)
-      return record as Type
+      return record as TrustedRecord
     },
 
     get: () => notImplemented('get'),
     list: () => notImplemented('list'),
+    count: () => notImplemented('count'),
     update: () => notImplemented('update'),
     delete: () => notImplemented('delete'),
-    pick: () => notImplemented('pick'),
+    take: () => notImplemented('take'),
+    purge: () => notImplemented('purge'),
   }
 
   return appendContextual<Resource<TrustedRecord>>(alias, resource)

package/src/types.ts

@@ -0,0 +1,12 @@
+import type { Auth } from '@owlmeans/auth'
+import type { AbstractRequest, AbstractResponse } from '@owlmeans/entrypoint'
+
+export interface MockGuardOptions {
+  alias?: string
+  /** Auth payload that `handle` will resolve into the response. */
+  auth?: Auth
+  /** Optional predicate that decides whether `match` reports a hit. Defaults to "always match". */
+  allow?: (req: AbstractRequest, res: AbstractResponse<unknown>) => boolean | Promise<boolean>
+  /** Token returned by the client-side `authenticated()` method. */
+  token?: string
+}