@claxedo/workspace-relay-protocol 0.1.0 → 0.5.0

package/dist/token-verifier.d.ts

@@ -12,18 +12,52 @@
  *
  * See the boundary READMEs for wiring rules.
  */
-export type TokenClaims = {
+import { type JWTPayload } from "jose";
+export type TokenVerifierBaseClaims = {
+    iss: string;
+    aud: string;
+    sub: string;
+    workspace_id: string;
+    host_id: string;
+    exp: number;
+    iat: number;
+    jti: string;
+} & Record<string, unknown>;
+export type RuntimeAccessVerifierClaims = TokenVerifierBaseClaims & {
+    org_id: string;
+    role: "viewer" | "editor" | "admin" | "owner";
+};
+export type RelayHostVerifierClaims = TokenVerifierBaseClaims & {
+    org_id: string;
+} & ({
+    access: "cloud";
+    backing: "cloud-vm";
+} | {
+    access: "user-hosted";
+    backing: "local-worktree";
+});
+export type TokenClaims<TClaims extends Record<string, unknown> = Record<string, unknown>> = {
     /** Stable subject id. The boundary is responsible for mapping this
      *  to a domain principal (user, workspace, runtime, etc.). */
     subject: string;
     /** Scopes / capabilities asserted by the issuer. May be empty. */
     scopes: string[];
-    /** Full claim payload. Carries audience, issuer, expiry, plus any
+    /** Full claim payload. Carries the common verifier token contract plus
      *  boundary-specific custom claims. */
-    claims: Record<string, unknown>;
+    claims: TClaims;
+};
+export type TokenVerifier<TClaims extends Record<string, unknown> = Record<string, unknown>> = {
+    verify(token: string): Promise<TokenClaims<TClaims>>;
 };
-export type TokenVerifier = {
-    verify(token: string): Promise<TokenClaims>;
+export type ClerkTokenVerifierClaims = JWTPayload & {
+    iss: string;
+    sub: string;
+    exp: number;
+    iat?: number;
+    jti?: string;
+    sid?: string;
+    org_id?: string;
+    orgId?: string;
 };
 export declare class TokenVerifierError extends Error {
     readonly code: string;
@@ -37,7 +71,7 @@ export declare class TokenVerifierError extends Error {
 }
 export type HttpTokenVerifierOptions = {
     /** Verifier endpoint. Must accept POST with `{ token }` JSON body
-     *  and return `{ subject: string; scopes?: string[]; claims?: Record<string, unknown> }`
+     *  and return `{ subject: string; scopes?: string[]; claims: TokenVerifierBaseClaims }`
      *  on success, or HTTP non-2xx on failure. */
     endpoint: string;
     /** Optional fixed headers (e.g., bearer auth on the verifier itself). */
@@ -47,9 +81,17 @@ export type HttpTokenVerifierOptions = {
     /** Request timeout in ms. Default 5000. */
     timeoutMs?: number;
 };
-export declare function createHttpTokenVerifier(options: HttpTokenVerifierOptions): TokenVerifier;
-export type StaticTokenVerifierOptions = {
+export declare function createHttpTokenVerifier(options: HttpTokenVerifierOptions): TokenVerifier<TokenVerifierBaseClaims>;
+export type ClerkTokenVerifierOptions = {
+    issuer: string;
+    jwksUrl: string;
+    audience?: string;
+    scopes?: string[];
+    algorithms?: Array<"ES256" | "EdDSA" | "RS256">;
+};
+export declare function createClerkTokenVerifier(options: ClerkTokenVerifierOptions): TokenVerifier<ClerkTokenVerifierClaims>;
+export type StaticTokenVerifierOptions<TClaims extends Record<string, unknown> = Record<string, unknown>> = {
     /** Map of token string → claims to return. */
-    tokens: Record<string, TokenClaims>;
+    tokens: Record<string, TokenClaims<TClaims>>;
 };
-export declare function createStaticTokenVerifier(options: StaticTokenVerifierOptions): TokenVerifier;
+export declare function createStaticTokenVerifier<TClaims extends Record<string, unknown> = Record<string, unknown>>(options: StaticTokenVerifierOptions<TClaims>): TokenVerifier<TClaims>;

package/package.json

@@ -1,15 +1,28 @@
 {
   "name": "@claxedo/workspace-relay-protocol",
-  "version": "0.1.0",
+  "version": "0.5.0",
   "type": "module",
   "main": "./dist/index.mjs",
   "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "bun": "./dist/index.mjs",
+      "development": "./dist/index.mjs",
+      "import": "./dist/index.mjs",
+      "default": "./dist/index.mjs"
+    }
+  },
   "files": [
+    "README.md",
     "dist"
   ],
   "publishConfig": {
     "access": "public"
   },
+  "dependencies": {
+    "jose": "6.0.11"
+  },
   "scripts": {
     "build": "tsx scripts/build.ts",
     "prepublishOnly": "npm run build",
@@ -17,10 +30,10 @@
     "test": "bun test src"
   },
   "devDependencies": {
-    "@tsconfig/node-lts": "^22.0.0",
-    "@types/bun": "catalog:",
-    "esbuild": "^0.25.0",
-    "tsx": "^4.0.0",
-    "typescript": "catalog:"
+    "@tsconfig/node-lts": "22.0.4",
+    "@types/bun": "1.3.13",
+    "esbuild": "0.25.12",
+    "tsx": "4.22.3",
+    "typescript": "5.8.2"
   }
 }