@assemble-dev/shared-utils 0.1.0

package/LICENSE

@@ -0,0 +1,93 @@
+Elastic License 2.0
+
+Copyright (c) 2026 Assemble (github.com/smundhra-git/assemble)
+
+## Acceptance
+
+By using the software, you agree to all of the terms and conditions below.
+
+## Copyright License
+
+The licensor grants you a non-exclusive, royalty-free, worldwide,
+non-sublicensable, non-transferable license to use, copy, distribute, make
+available, and prepare derivative works of the software, in each case subject
+to the limitations and conditions below.
+
+## Limitations
+
+You may not provide the software to third parties as a hosted or managed
+service, where the service provides users with access to any substantial set of
+the features or functionality of the software.
+
+You may not move, change, disable, or circumvent the license key functionality
+in the software, and you may not remove or obscure any functionality in the
+software that is protected by the license key.
+
+You may not alter, remove, or obscure any licensing, copyright, or other
+notices of the licensor in the software. Any use of the licensor's trademarks
+is subject to applicable law.
+
+## Patents
+
+The licensor grants you a license, under any patent claims the licensor can
+license, or becomes able to license, to make, have made, use, sell, offer for
+sale, import and have imported the software, in each case subject to the
+limitations and conditions in this license. This license does not cover any
+patent claims that you cause to be infringed by modifications or additions to
+the software. If you or your company make any written claim that the software
+infringes or contributes to infringement of any patent, your patent license for
+the software granted under these terms ends immediately. If your company makes
+such a claim, your patent license ends immediately for work on behalf of your
+company.
+
+## Notices
+
+You must ensure that anyone who gets a copy of any part of the software from
+you also gets a copy of these terms.
+
+If you modify the software, you must include in any modified copies of the
+software prominent notices stating that you have modified the software.
+
+## No Other Rights
+
+These terms do not imply any licenses other than those expressly granted in
+these terms.
+
+## Termination
+
+If you use the software in violation of these terms, such use is not licensed,
+and your licenses will automatically terminate. If the licensor provides you
+with a notice of your violation, and you cease all violation of this license no
+later than 30 days after you receive that notice, your licenses will be
+reinstated retroactively. However, if you violate these terms after such
+reinstatement, any additional violation of these terms will cause your licenses
+to terminate automatically and permanently.
+
+## No Liability
+
+*As far as the law allows, the software comes as is, without any warranty or
+condition, and the licensor will not be liable to you for any damages arising
+out of these terms or the use or nature of the software, under any kind of
+legal claim.*
+
+## Definitions
+
+The **licensor** is the entity offering these terms, and the **software** is
+the software the licensor makes available under these terms, including any
+portion of it.
+
+**you** refers to the individual or entity agreeing to these terms.
+
+**your company** is any legal entity, sole proprietorship, or other kind of
+organization that you work for, plus all organizations that have control over,
+are under the control of, or are under common control with that organization.
+**control** means ownership of substantially all the assets of an entity, or
+the power to direct its management and policies by vote, contract, or
+otherwise. Control can be direct or indirect.
+
+**your licenses** are all the licenses granted to you for the software under
+these terms.
+
+**use** means anything you do with the software requiring one of your licenses.
+
+**trademark** means trademarks, service marks, and similar rights.

package/dist/api-keys/index.cjs

@@ -0,0 +1,90 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/api-keys/index.ts
+var api_keys_exports = {};
+__export(api_keys_exports, {
+  INVALID_API_KEY_MESSAGE: () => INVALID_API_KEY_MESSAGE,
+  createInvalidApiKeyError: () => createInvalidApiKeyError,
+  hashApiKeySecret: () => hashApiKeySecret,
+  parseRawApiKey: () => parseRawApiKey
+});
+module.exports = __toCommonJS(api_keys_exports);
+
+// src/api-keys/hash-api-key-secret.ts
+var import_node_crypto = require("node:crypto");
+function hashApiKeySecret(secret) {
+  return (0, import_node_crypto.createHash)("sha256").update(secret).digest("hex");
+}
+
+// src/api-keys/parse-raw-api-key.ts
+var import_shared_types = require("@assemble-dev/shared-types");
+
+// src/errors/app-error.ts
+var AppError = class extends Error {
+  code;
+  statusCode;
+  details;
+  cause;
+  constructor(input) {
+    super(input.message);
+    this.name = "AppError";
+    this.code = input.code;
+    this.statusCode = input.statusCode;
+    this.details = input.details;
+    this.cause = input.cause;
+  }
+};
+
+// src/api-keys/parse-raw-api-key.ts
+var INVALID_API_KEY_MESSAGE = "invalid API key";
+var KEY_ID_PREFIX = "key_";
+var KEY_ID_BODY_HEX_LENGTH = 32;
+var SECRET_HEX_LENGTH = 64;
+var rawApiKeyPattern = new RegExp(
+  `^asm_(dev|prod|ci)_([0-9a-f]{${KEY_ID_BODY_HEX_LENGTH}})_([0-9a-f]{${SECRET_HEX_LENGTH}})$`
+);
+function createInvalidApiKeyError() {
+  return new AppError({
+    code: import_shared_types.AppErrorCode.Unauthorized,
+    message: INVALID_API_KEY_MESSAGE,
+    statusCode: 401
+  });
+}
+function parseRawApiKey(rawKey) {
+  const match = rawApiKeyPattern.exec(rawKey);
+  if (match === null) {
+    throw createInvalidApiKeyError();
+  }
+  const environment = match[1];
+  const keyIdBody = match[2];
+  const secret = match[3];
+  return {
+    environment,
+    keyId: `${KEY_ID_PREFIX}${keyIdBody}`,
+    secret
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  INVALID_API_KEY_MESSAGE,
+  createInvalidApiKeyError,
+  hashApiKeySecret,
+  parseRawApiKey
+});

package/dist/api-keys/index.d.cts

@@ -0,0 +1,15 @@
+import { ApiKeyEnvironment } from '@assemble-dev/shared-types';
+import { A as AppError } from '../app-error-D7pnDUHg.cjs';
+
+declare function hashApiKeySecret(secret: string): string;
+
+type ParsedRawApiKey = {
+    environment: ApiKeyEnvironment;
+    keyId: string;
+    secret: string;
+};
+declare const INVALID_API_KEY_MESSAGE = "invalid API key";
+declare function createInvalidApiKeyError(): AppError;
+declare function parseRawApiKey(rawKey: string): ParsedRawApiKey;
+
+export { INVALID_API_KEY_MESSAGE, type ParsedRawApiKey, createInvalidApiKeyError, hashApiKeySecret, parseRawApiKey };

package/dist/api-keys/index.d.ts

@@ -0,0 +1,15 @@
+import { ApiKeyEnvironment } from '@assemble-dev/shared-types';
+import { A as AppError } from '../app-error-D7pnDUHg.js';
+
+declare function hashApiKeySecret(secret: string): string;
+
+type ParsedRawApiKey = {
+    environment: ApiKeyEnvironment;
+    keyId: string;
+    secret: string;
+};
+declare const INVALID_API_KEY_MESSAGE = "invalid API key";
+declare function createInvalidApiKeyError(): AppError;
+declare function parseRawApiKey(rawKey: string): ParsedRawApiKey;
+
+export { INVALID_API_KEY_MESSAGE, type ParsedRawApiKey, createInvalidApiKeyError, hashApiKeySecret, parseRawApiKey };

package/dist/api-keys/index.js

@@ -0,0 +1,46 @@
+import {
+  AppError
+} from "../chunk-CP7QDN2K.js";
+
+// src/api-keys/hash-api-key-secret.ts
+import { createHash } from "node:crypto";
+function hashApiKeySecret(secret) {
+  return createHash("sha256").update(secret).digest("hex");
+}
+
+// src/api-keys/parse-raw-api-key.ts
+import { AppErrorCode } from "@assemble-dev/shared-types";
+var INVALID_API_KEY_MESSAGE = "invalid API key";
+var KEY_ID_PREFIX = "key_";
+var KEY_ID_BODY_HEX_LENGTH = 32;
+var SECRET_HEX_LENGTH = 64;
+var rawApiKeyPattern = new RegExp(
+  `^asm_(dev|prod|ci)_([0-9a-f]{${KEY_ID_BODY_HEX_LENGTH}})_([0-9a-f]{${SECRET_HEX_LENGTH}})$`
+);
+function createInvalidApiKeyError() {
+  return new AppError({
+    code: AppErrorCode.Unauthorized,
+    message: INVALID_API_KEY_MESSAGE,
+    statusCode: 401
+  });
+}
+function parseRawApiKey(rawKey) {
+  const match = rawApiKeyPattern.exec(rawKey);
+  if (match === null) {
+    throw createInvalidApiKeyError();
+  }
+  const environment = match[1];
+  const keyIdBody = match[2];
+  const secret = match[3];
+  return {
+    environment,
+    keyId: `${KEY_ID_PREFIX}${keyIdBody}`,
+    secret
+  };
+}
+export {
+  INVALID_API_KEY_MESSAGE,
+  createInvalidApiKeyError,
+  hashApiKeySecret,
+  parseRawApiKey
+};

package/dist/app-error-D7pnDUHg.d.cts

@@ -0,0 +1,11 @@
+import { AppErrorCode, AppErrorDetails, AppErrorInput } from '@assemble-dev/shared-types';
+
+declare class AppError extends Error {
+    readonly code: AppErrorCode;
+    readonly statusCode: number;
+    readonly details?: AppErrorDetails;
+    readonly cause?: Error;
+    constructor(input: AppErrorInput);
+}
+
+export { AppError as A };

package/dist/app-error-D7pnDUHg.d.ts

@@ -0,0 +1,11 @@
+import { AppErrorCode, AppErrorDetails, AppErrorInput } from '@assemble-dev/shared-types';
+
+declare class AppError extends Error {
+    readonly code: AppErrorCode;
+    readonly statusCode: number;
+    readonly details?: AppErrorDetails;
+    readonly cause?: Error;
+    constructor(input: AppErrorInput);
+}
+
+export { AppError as A };

package/dist/auth/index.cjs

@@ -0,0 +1,202 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/auth/index.ts
+var auth_exports = {};
+__export(auth_exports, {
+  SUPABASE_AUTHENTICATED_AUDIENCE: () => SUPABASE_AUTHENTICATED_AUDIENCE,
+  SupabaseJwtClaimsSchema: () => SupabaseJwtClaimsSchema,
+  assertNotTestCredentialInProduction: () => assertNotTestCredentialInProduction,
+  buildAuthSubjectFromClaims: () => buildAuthSubjectFromClaims,
+  computeCredentialFingerprint: () => computeCredentialFingerprint,
+  createAuthMiddleware: () => createAuthMiddleware,
+  createSupabaseLocalKeySet: () => createSupabaseLocalKeySet,
+  createSupabaseRemoteKeySet: () => createSupabaseRemoteKeySet,
+  verifySupabaseJwt: () => verifySupabaseJwt
+});
+module.exports = __toCommonJS(auth_exports);
+
+// src/auth/create-auth-middleware.ts
+var import_shared_types2 = require("@assemble-dev/shared-types");
+
+// src/errors/app-error.ts
+var AppError = class extends Error {
+  code;
+  statusCode;
+  details;
+  cause;
+  constructor(input) {
+    super(input.message);
+    this.name = "AppError";
+    this.code = input.code;
+    this.statusCode = input.statusCode;
+    this.details = input.details;
+    this.cause = input.cause;
+  }
+};
+
+// src/auth/verify-supabase-jwt.ts
+var import_shared_types = require("@assemble-dev/shared-types");
+var import_jose = require("jose");
+var import_zod = require("zod");
+var SUPABASE_AUTHENTICATED_AUDIENCE = "authenticated";
+var SupabaseJwtUserMetadataSchema = import_zod.z.object({
+  name: import_zod.z.string().optional(),
+  full_name: import_zod.z.string().optional()
+});
+var SupabaseJwtClaimsSchema = import_zod.z.object({
+  sub: import_zod.z.string().min(1),
+  exp: import_zod.z.number().int().positive(),
+  iss: import_zod.z.string().min(1),
+  aud: import_zod.z.union([import_zod.z.string(), import_zod.z.array(import_zod.z.string())]),
+  email: import_zod.z.string().email().optional(),
+  user_metadata: SupabaseJwtUserMetadataSchema.optional()
+});
+function createSupabaseRemoteKeySet(jwksUrl) {
+  return (0, import_jose.createRemoteJWKSet)(new URL(jwksUrl));
+}
+function createSupabaseLocalKeySet(jwks) {
+  return (0, import_jose.createLocalJWKSet)(jwks);
+}
+function createUnauthorizedError(message) {
+  return new AppError({
+    code: import_shared_types.AppErrorCode.Unauthorized,
+    message,
+    statusCode: 401
+  });
+}
+async function verifySignedTokenPayload(input) {
+  try {
+    const verification = await (0, import_jose.jwtVerify)(input.token, input.keySet, {
+      issuer: input.issuer,
+      audience: input.audience ?? SUPABASE_AUTHENTICATED_AUDIENCE,
+      algorithms: ["ES256", "RS256"],
+      currentDate: input.now === void 0 ? void 0 : new Date(input.now)
+    });
+    const parsedClaims = SupabaseJwtClaimsSchema.safeParse(verification.payload);
+    if (!parsedClaims.success) {
+      throw createUnauthorizedError("Invalid authentication token claims");
+    }
+    return parsedClaims.data;
+  } catch (error) {
+    if (error instanceof AppError) {
+      throw error;
+    }
+    throw createUnauthorizedError("Invalid authentication token");
+  }
+}
+function ensureAudienceIsAuthenticated(claims, expectedAudience) {
+  const audiences = Array.isArray(claims.aud) ? claims.aud : [claims.aud];
+  if (!audiences.includes(expectedAudience)) {
+    throw createUnauthorizedError("Authentication token audience is not trusted");
+  }
+}
+async function verifySupabaseJwt(input) {
+  const claims = await verifySignedTokenPayload(input);
+  ensureAudienceIsAuthenticated(
+    claims,
+    input.audience ?? SUPABASE_AUTHENTICATED_AUDIENCE
+  );
+  return claims;
+}
+
+// src/auth/create-auth-middleware.ts
+function createUnauthorizedError2(message) {
+  return new AppError({
+    code: import_shared_types2.AppErrorCode.Unauthorized,
+    message,
+    statusCode: 401
+  });
+}
+function extractBearerToken(headerValue) {
+  if (headerValue === void 0) {
+    throw createUnauthorizedError2("Missing Authorization header");
+  }
+  const bearerPrefix = "Bearer ";
+  if (!headerValue.startsWith(bearerPrefix)) {
+    throw createUnauthorizedError2("Invalid Authorization header");
+  }
+  const token = headerValue.slice(bearerPrefix.length).trim();
+  if (token.length === 0) {
+    throw createUnauthorizedError2("Missing bearer token");
+  }
+  return token;
+}
+function buildAuthSubjectFromClaims(claims) {
+  if (claims.email === void 0) {
+    throw createUnauthorizedError2("Authentication token is missing an email");
+  }
+  return {
+    id: claims.sub,
+    email: claims.email,
+    name: claims.user_metadata?.name ?? claims.user_metadata?.full_name ?? null
+  };
+}
+function createAuthMiddleware(config) {
+  return async (c, next) => {
+    const token = extractBearerToken(c.req.header("authorization"));
+    const claims = await verifySupabaseJwt({
+      token,
+      keySet: config.keySet,
+      issuer: config.issuer,
+      audience: config.audience
+    });
+    const subject = buildAuthSubjectFromClaims(claims);
+    const user = await config.resolveAuthUser(subject);
+    c.set("auth", { userId: user.id, authSubjectId: claims.sub });
+    await next();
+  };
+}
+
+// src/auth/known-test-credentials.ts
+var import_node_crypto = require("node:crypto");
+var import_shared_types3 = require("@assemble-dev/shared-types");
+var KNOWN_TEST_CREDENTIAL_FINGERPRINTS = [
+  "56e17db07a352344ec8f8d91b98d65ee78213181872b8a66e41087442bb33f5b",
+  "39377069fcfbfbe509b540b9005998930d1d847a86776b560998a5cf958ba4d6"
+];
+function computeCredentialFingerprint(value) {
+  return (0, import_node_crypto.createHash)("sha256").update(value.trim()).digest("hex");
+}
+function assertNotTestCredentialInProduction(input) {
+  if (input.nodeEnv !== "production") {
+    return;
+  }
+  const fingerprint = computeCredentialFingerprint(input.value);
+  if (KNOWN_TEST_CREDENTIAL_FINGERPRINTS.includes(fingerprint)) {
+    throw new AppError({
+      code: import_shared_types3.AppErrorCode.InternalServerError,
+      message: `${input.label} is set to a committed test credential and must be replaced with a real production value`,
+      statusCode: 500,
+      details: { label: input.label }
+    });
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  SUPABASE_AUTHENTICATED_AUDIENCE,
+  SupabaseJwtClaimsSchema,
+  assertNotTestCredentialInProduction,
+  buildAuthSubjectFromClaims,
+  computeCredentialFingerprint,
+  createAuthMiddleware,
+  createSupabaseLocalKeySet,
+  createSupabaseRemoteKeySet,
+  verifySupabaseJwt
+});

package/dist/auth/index.d.cts

@@ -0,0 +1,66 @@
+import { MiddlewareHandler } from 'hono';
+import { JWTVerifyGetKey, JSONWebKeySet } from 'jose';
+import { z } from 'zod';
+
+declare const SUPABASE_AUTHENTICATED_AUDIENCE = "authenticated";
+declare const SupabaseJwtClaimsSchema: z.ZodObject<{
+    sub: z.ZodString;
+    exp: z.ZodNumber;
+    iss: z.ZodString;
+    aud: z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>;
+    email: z.ZodOptional<z.ZodString>;
+    user_metadata: z.ZodOptional<z.ZodObject<{
+        name: z.ZodOptional<z.ZodString>;
+        full_name: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+type SupabaseJwtClaims = z.infer<typeof SupabaseJwtClaimsSchema>;
+type SupabaseJwtKeySet = JWTVerifyGetKey;
+type SupabaseJwks = JSONWebKeySet;
+type VerifySupabaseJwtInput = {
+    token: string;
+    keySet: SupabaseJwtKeySet;
+    issuer: string;
+    audience?: string;
+    now?: number;
+};
+declare function createSupabaseRemoteKeySet(jwksUrl: string): SupabaseJwtKeySet;
+declare function createSupabaseLocalKeySet(jwks: SupabaseJwks): SupabaseJwtKeySet;
+declare function verifySupabaseJwt(input: VerifySupabaseJwtInput): Promise<SupabaseJwtClaims>;
+
+type AuthContext = {
+    userId: string;
+    authSubjectId: string;
+};
+type AuthSubject = {
+    id: string;
+    email: string;
+    name: string | null;
+};
+type ResolvedAuthUser = {
+    id: string;
+};
+type ResolveAuthUser = (subject: AuthSubject) => Promise<ResolvedAuthUser>;
+type AuthMiddlewareConfig = {
+    keySet: SupabaseJwtKeySet;
+    issuer: string;
+    audience?: string;
+    resolveAuthUser: ResolveAuthUser;
+};
+type AppEnv = {
+    Variables: {
+        auth: AuthContext;
+    };
+};
+declare function buildAuthSubjectFromClaims(claims: SupabaseJwtClaims): AuthSubject;
+declare function createAuthMiddleware(config: AuthMiddlewareConfig): MiddlewareHandler<AppEnv>;
+
+type AssertNotTestCredentialInProductionInput = {
+    nodeEnv: string;
+    label: string;
+    value: string;
+};
+declare function computeCredentialFingerprint(value: string): string;
+declare function assertNotTestCredentialInProduction(input: AssertNotTestCredentialInProductionInput): void;
+
+export { type AppEnv, type AssertNotTestCredentialInProductionInput, type AuthContext, type AuthMiddlewareConfig, type AuthSubject, type ResolveAuthUser, type ResolvedAuthUser, SUPABASE_AUTHENTICATED_AUDIENCE, type SupabaseJwks, type SupabaseJwtClaims, SupabaseJwtClaimsSchema, type SupabaseJwtKeySet, type VerifySupabaseJwtInput, assertNotTestCredentialInProduction, buildAuthSubjectFromClaims, computeCredentialFingerprint, createAuthMiddleware, createSupabaseLocalKeySet, createSupabaseRemoteKeySet, verifySupabaseJwt };

package/dist/auth/index.d.ts

@@ -0,0 +1,66 @@
+import { MiddlewareHandler } from 'hono';
+import { JWTVerifyGetKey, JSONWebKeySet } from 'jose';
+import { z } from 'zod';
+
+declare const SUPABASE_AUTHENTICATED_AUDIENCE = "authenticated";
+declare const SupabaseJwtClaimsSchema: z.ZodObject<{
+    sub: z.ZodString;
+    exp: z.ZodNumber;
+    iss: z.ZodString;
+    aud: z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>;
+    email: z.ZodOptional<z.ZodString>;
+    user_metadata: z.ZodOptional<z.ZodObject<{
+        name: z.ZodOptional<z.ZodString>;
+        full_name: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+type SupabaseJwtClaims = z.infer<typeof SupabaseJwtClaimsSchema>;
+type SupabaseJwtKeySet = JWTVerifyGetKey;
+type SupabaseJwks = JSONWebKeySet;
+type VerifySupabaseJwtInput = {
+    token: string;
+    keySet: SupabaseJwtKeySet;
+    issuer: string;
+    audience?: string;
+    now?: number;
+};
+declare function createSupabaseRemoteKeySet(jwksUrl: string): SupabaseJwtKeySet;
+declare function createSupabaseLocalKeySet(jwks: SupabaseJwks): SupabaseJwtKeySet;
+declare function verifySupabaseJwt(input: VerifySupabaseJwtInput): Promise<SupabaseJwtClaims>;
+
+type AuthContext = {
+    userId: string;
+    authSubjectId: string;
+};
+type AuthSubject = {
+    id: string;
+    email: string;
+    name: string | null;
+};
+type ResolvedAuthUser = {
+    id: string;
+};
+type ResolveAuthUser = (subject: AuthSubject) => Promise<ResolvedAuthUser>;
+type AuthMiddlewareConfig = {
+    keySet: SupabaseJwtKeySet;
+    issuer: string;
+    audience?: string;
+    resolveAuthUser: ResolveAuthUser;
+};
+type AppEnv = {
+    Variables: {
+        auth: AuthContext;
+    };
+};
+declare function buildAuthSubjectFromClaims(claims: SupabaseJwtClaims): AuthSubject;
+declare function createAuthMiddleware(config: AuthMiddlewareConfig): MiddlewareHandler<AppEnv>;
+
+type AssertNotTestCredentialInProductionInput = {
+    nodeEnv: string;
+    label: string;
+    value: string;
+};
+declare function computeCredentialFingerprint(value: string): string;
+declare function assertNotTestCredentialInProduction(input: AssertNotTestCredentialInProductionInput): void;
+
+export { type AppEnv, type AssertNotTestCredentialInProductionInput, type AuthContext, type AuthMiddlewareConfig, type AuthSubject, type ResolveAuthUser, type ResolvedAuthUser, SUPABASE_AUTHENTICATED_AUDIENCE, type SupabaseJwks, type SupabaseJwtClaims, SupabaseJwtClaimsSchema, type SupabaseJwtKeySet, type VerifySupabaseJwtInput, assertNotTestCredentialInProduction, buildAuthSubjectFromClaims, computeCredentialFingerprint, createAuthMiddleware, createSupabaseLocalKeySet, createSupabaseRemoteKeySet, verifySupabaseJwt };