@m6d/cortex-cli 0.12.1 → 0.13.0

package/src/contracts/rich-text/index.ts

@@ -1,220 +0,0 @@
-/*
- * The grammar and rendering pipeline for user-authored rich text that reaches
- * the LLM (agent prompts, service descriptions, skill bodies). Both sides of
- * the wire share it: the console edits and validates these strings, the
- * console's runtime API pre-renders them (mentions + heading demotion), and
- * `@m6d/cortex-server` applies per-request variable values. Three token
- * grammars live here:
- *
- * - Tool mentions `@[name](uuid)` and skill mentions `/[name](uuid)` — the
- *   uuid is authoritative; the inline name is only a display cache refreshed
- *   on save ({@link normalizeMentions}) and resolved live when text is
- *   rendered for the LLM ({@link renderMentions}).
- * - Dataset mentions `#[name](name)` — a dataset's name is its identity, so
- *   the token carries it twice and renders to it as is.
- * - Variables `{{name}}` — validated against a known list at authoring time
- *   ({@link analyzeVariables}) and substituted per request on the server
- *   ({@link substituteVariables}).
- */
-
-import { fenceTracker } from "../markdown";
-
-const UUID = String.raw`[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}`;
-
-/** One tool mention token, unanchored and flagless — the editor's tokenizer anchors it, the helpers below add `g`. */
-export const MENTION_PATTERN_SOURCE = String.raw`@\[([^\]\n]*)\]\((${UUID})\)`;
-/** One skill mention token; `/` is the slash-command convention skills already carry elsewhere. */
-export const SKILL_MENTION_PATTERN_SOURCE = String.raw`/\[([^\]\n]*)\]\((${UUID})\)`;
-
-/** One dataset mention token; the id is the dataset's name, which is already its identity. */
-export const DATASET_MENTION_PATTERN_SOURCE = String.raw`#\[([^\]\n]*)\]\(([a-zA-Z][a-zA-Z0-9_]{0,63})\)`;
-
-const MENTION_PATTERN = new RegExp(MENTION_PATTERN_SOURCE, "g");
-const SKILL_MENTION_PATTERN = new RegExp(SKILL_MENTION_PATTERN_SOURCE, "g");
-const DATASET_MENTION_PATTERN = new RegExp(DATASET_MENTION_PATTERN_SOURCE, "g");
-
-/** `{{name}}` or `{{/json/pointer}}` with inner whitespace tolerated: what substitution and analysis match. */
-export const VARIABLE_PATTERN_SOURCE = String.raw`{{\s*([^{}]*?)\s*}}`;
-/** The subset an editor turns into a chip: a non-empty, whitespace-free name. */
-export const VARIABLE_TOKEN_SOURCE = String.raw`{{\s*([^{}\s]+)\s*}}`;
-const VARIABLE_PATTERN = new RegExp(VARIABLE_PATTERN_SOURCE, "g");
-
-/** Entity names by id for the two mention grammars; a missing map leaves that grammar's cached names in place. */
-export type MentionNames = {
-    tools?: ReadonlyMap<string, string>;
-    skills?: ReadonlyMap<string, string>;
-};
-
-const NO_NAMES: ReadonlyMap<string, string> = new Map();
-
-function extractIds(text: string, pattern: RegExp) {
-    const ids: string[] = [];
-    for (const match of text.matchAll(pattern)) {
-        const id = match[2];
-        if (id && !ids.includes(id)) ids.push(id);
-    }
-    return ids;
-}
-
-export function extractMentionedToolIds(text: string) {
-    return extractIds(text, MENTION_PATTERN);
-}
-
-export function extractMentionedSkillIds(text: string) {
-    return extractIds(text, SKILL_MENTION_PATTERN);
-}
-
-/** The dataset names a text mentions, in order of first appearance. */
-export function extractMentionedDatasets(text: string) {
-    return extractIds(text, DATASET_MENTION_PATTERN);
-}
-
-/** Replaces each mention token with the entity's current name (falling back to the cached inline name). */
-export function renderMentions(text: string, names: MentionNames) {
-    const tools = names.tools ?? NO_NAMES;
-    const skills = names.skills ?? NO_NAMES;
-    return text
-        .replace(MENTION_PATTERN, (_, cached: string, id: string) => tools.get(id) ?? cached)
-        .replace(SKILL_MENTION_PATTERN, (_, cached: string, id: string) => skills.get(id) ?? cached)
-        .replace(DATASET_MENTION_PATTERN, (_, _cached: string, name: string) => name);
-}
-
-/** Refreshes stale display names inside stored text, keeping the tokens intact. */
-export function normalizeMentions(text: string, names: MentionNames) {
-    const tools = names.tools ?? NO_NAMES;
-    const skills = names.skills ?? NO_NAMES;
-    return text
-        .replace(MENTION_PATTERN, (token, _cached: string, id: string) => {
-            const name = tools.get(id);
-            return name === undefined ? token : `@[${name}](${id})`;
-        })
-        .replace(SKILL_MENTION_PATTERN, (token, _cached: string, id: string) => {
-            const name = skills.get(id);
-            return name === undefined ? token : `/[${name}](${id})`;
-        });
-}
-
-/** Splits the `{{variables}}` referenced in a text into known and unknown ones. */
-export function analyzeVariables<Variable extends string>(
-    text: string,
-    known: ReadonlyArray<Variable>,
-) {
-    const referenced = new Set(
-        Array.from(text.matchAll(VARIABLE_PATTERN), ([, name]) => name?.trim()),
-    );
-
-    return {
-        variables: known.filter((variable) => referenced.has(variable)),
-        unknownVariables: [...referenced].filter(
-            (variable): variable is string =>
-                variable !== undefined &&
-                !known.some((knownVariable) => knownVariable === variable),
-        ),
-    };
-}
-
-/** Fills `{{variables}}` with per-request values; unknown names stay verbatim. */
-export function substituteVariables(text: string, values: Record<string, string>) {
-    return text.replace(VARIABLE_PATTERN, (match, name: string) => values[name] ?? match);
-}
-
-/** ATX heading, CommonMark-style: up to three leading spaces, `#` run closed by space or line end. */
-const ATX_HEADING = /^( {0,3})(#{1,6})(?=[ \t]|$)/;
-
-/** Setext underline: a run of `=` or `-` alone on its line, up to three leading spaces. */
-const SETEXT_UNDERLINE = /^ {0,3}(=+|-+)[ \t]*$/;
-
-/** The skeleton owns `##` and `###`, so user headings start three levels below it. */
-function demotedHashes(level: number) {
-    return "#".repeat(Math.min(level + 3, 6));
-}
-
-/**
- * Whether a line can be the text of a setext heading — i.e. it is an ordinary
- * paragraph line, not a blank, a fence, another heading, or the start of a
- * different block (quote/list), in which case the underline below it is a
- * thematic break or list content rather than a heading marker.
- */
-function isSetextText(line: string) {
-    return (
-        line.trim() !== "" &&
-        !ATX_HEADING.test(line) &&
-        !SETEXT_UNDERLINE.test(line) &&
-        !/^ {0,3}(`{3,}|~{3,})/.test(line) &&
-        !/^ {0,3}(>|[-*+][ \t]|\d+[.)][ \t])/.test(line)
-    );
-}
-
-/**
- * Shifts user-authored headings down so they can never collide with the prompt
- * skeleton, which owns `##` (sections) and `###` (card titles): `#` becomes
- * `####`, deeper levels cap at `######`. Setext headings are rewritten as the
- * equivalent demoted ATX heading, since two-level setext cannot express the
- * shift. Fenced code is left alone.
- */
-export function demoteHeadings(text: string) {
-    const lineState = fenceTracker();
-    const output: string[] = [];
-    for (const line of text.split("\n")) {
-        if (lineState(line) !== "outside") {
-            output.push(line);
-            continue;
-        }
-
-        const underline = SETEXT_UNDERLINE.exec(line)?.[1];
-        const previous = output[output.length - 1];
-        if (underline !== undefined && previous !== undefined && isSetextText(previous)) {
-            const level = underline.startsWith("=") ? 1 : 2;
-            output[output.length - 1] = `${demotedHashes(level)} ${previous.trim()}`;
-            continue;
-        }
-
-        output.push(
-            line.replace(ATX_HEADING, (_, indent: string, hashes: string) => {
-                return `${indent}${demotedHashes(hashes.length)}`;
-            }),
-        );
-    }
-    return output.join("\n");
-}
-
-/** The one render step for LLM-bound rich text: resolve mentions, then demote headings. */
-export function renderRichText(text: string, names: MentionNames) {
-    return demoteHeadings(renderMentions(text, names));
-}
-
-/**
- * Reduces rich text to plain prose for embeddings: mentions become entity
- * names (cached inline names when no map is given) and markdown syntax is
- * dropped.
- * A regex stripper, not a markdown parser: nested emphasis or exotic
- * constructs may leave residue; swap in a real parser if retrieval quality
- * ever shows it.
- */
-export function stripToPlaintext(text: string, names: MentionNames = {}) {
-    const lineState = fenceTracker();
-    return renderMentions(text, names)
-        .split("\n")
-        .filter((line) => {
-            const state = lineState(line);
-            return state !== "open" && state !== "close";
-        })
-        .map((line) =>
-            line
-                .replace(/^ {0,3}#{1,6}[ \t]+/, "")
-                .replace(SETEXT_UNDERLINE, "")
-                .replace(/^\s{0,3}(>\s?)+/, "")
-                .replace(/^(\s*)([-*+]|\d+[.)])\s+/, "$1")
-                .replace(/^\s*([-*_]\s*){3,}$/, ""),
-        )
-        .join("\n")
-        .replace(/!\[([^\]]*)\]\([^)]*\)/g, "$1")
-        .replace(/\[([^\]]*)\]\([^)]*\)/g, "$1")
-        .replace(/(\*\*|__)([^*_]+)\1/g, "$2")
-        .replace(/(^|\W)[*_]([^*_]+)[*_](?=\W|$)/gm, "$1$2")
-        .replace(/~~([^~]+)~~/g, "$1")
-        .replace(/`([^`]*)`/g, "$1")
-        .replace(/\\([\\*_#[\]()>!`~+.-])/g, "$1")
-        .replace(/\n{3,}/g, "\n\n")
-        .trim();
-}

package/src/contracts/runtime/api.ts

@@ -1,345 +0,0 @@
-import { z } from "zod";
-import {
-    agentRefSchema,
-    boundVariablesSchema,
-    catalogVersionSchema,
-    greetingSchema,
-    IDENTIFIER_PATTERN,
-    localeSchema,
-    localizedTextSchema,
-    mediaFormSchema,
-    mentionedToolSchema,
-    slugSchema,
-    suggestionsSchema,
-    toolSurfaceSchema,
-    variableDeclarationSchema,
-} from "./grammar";
-import { publishedAuthSchema } from "./auth";
-import { runtimeModelsSchema } from "./models";
-import { triggerDeclarationSchema } from "./triggers";
-import { datasetHostDeclarationSchema, datasetIdentifierSchema } from "./datasets";
-
-/*
- * The cc runtime API (`/api/runtime/agents/:agentSlug/*`): the console
- * validates requests against these schemas and `@m6d/cortex-server` validates
- * the responses it gets back. Request types use `z.input` because the callers
- * build payloads the runtime's parser then fills defaults into.
- */
-
-export const RUNTIME_ERROR_KINDS = [
-    "timeout",
-    "upstream_4xx",
-    "upstream_5xx",
-    "schema_mismatch",
-    "rate_limited",
-    "not_found",
-    "unauthorized",
-    "invalid_request",
-    "egress_blocked",
-    "internal",
-] as const;
-export const runtimeErrorKindSchema = z.enum(RUNTIME_ERROR_KINDS);
-export type RuntimeErrorKind = z.infer<typeof runtimeErrorKindSchema>;
-
-/** The HTTP status and default detail each error kind ships with; both sides rely on these exact values. */
-export const RUNTIME_ERRORS = {
-    invalid_request: { status: 400, detail: "invalid request", retryable: false },
-    unauthorized: { status: 401, detail: "unauthorized", retryable: false },
-    egress_blocked: { status: 422, detail: "egress blocked", retryable: false },
-    not_found: { status: 404, detail: "not found", retryable: false },
-    rate_limited: { status: 429, detail: "rate limited", retryable: true },
-    internal: { status: 500, detail: "internal error", retryable: true },
-    upstream_4xx: { status: 502, detail: "upstream request failed", retryable: false },
-    upstream_5xx: { status: 502, detail: "upstream request failed", retryable: true },
-    schema_mismatch: {
-        status: 502,
-        detail: "upstream response did not match the schema",
-        retryable: false,
-    },
-    timeout: { status: 504, detail: "request timed out", retryable: true },
-} as const satisfies Record<
-    RuntimeErrorKind,
-    { status: number; detail: string; retryable: boolean }
->;
-
-export const runtimeErrorSchema = z.object({
-    error: z.object({
-        kind: runtimeErrorKindSchema,
-        detail: z.string().max(512),
-        retryable: z.boolean(),
-        retryAfterSeconds: z.number().int().positive().optional(),
-        upstreamStatus: z.number().int().min(100).max(599).optional(),
-    }),
-});
-
-/** The ways an execute output may disagree with the tool's declared schema. */
-export const JSON_SCHEMA_ISSUE_KINDS = ["missing", "unexpected", "type_mismatch"] as const;
-
-export const sharedShapeSchema = z.object({
-    ref: z.string().regex(/^\$R\d+$/),
-    shape: z.string(),
-});
-
-export const knowledgeChunkSchema = z.object({
-    chunkId: z.uuid(),
-    text: z.string(),
-    score: z.number(),
-    citation: z.object({
-        documentId: z.uuid(),
-        documentTitle: z.string(),
-        page: z.number().int().positive().nullable(),
-        section: z.string().nullable(),
-        uri: z.url().nullable(),
-        service: z.string().nullable(),
-    }),
-});
-
-/**
- * Present on signatures of `embedded` tools: flows the end user completes in
- * an embedded surface inside the chat widget. The tool's endpoint fields act
- * as the *initiate* call (returns the embed URL); the result the page reports
- * back is relayed as-is, verifying it is the integrating backend's job.
- */
-export const toolEmbedSchema = z.object({
-    surface: toolSurfaceSchema,
-    embedOrigin: z.url(),
-});
-export type ToolEmbed = z.infer<typeof toolEmbedSchema>;
-
-const toolSignatureBaseSchema = z.object({
-    toolId: z.uuid(),
-    name: z.string().regex(IDENTIFIER_PATTERN),
-    version: z.number().int().positive(),
-    readOnly: z.boolean(),
-    /**
-     * The call parks the run until the end user approves it. Declared to the
-     * model as a function call like an embedded tool, never as a sandbox
-     * binding, so the schema travels with it.
-     */
-    requiresApproval: z.boolean(),
-    /** The action the widget's approval card names before an approval-gated call runs; only such tools carry one. */
-    approvalMessage: localizedTextSchema.optional(),
-    tags: z.array(z.string()),
-    signature: z.string(),
-    score: z.number().nullable(),
-    pinned: z.boolean(),
-    /** Variables the tool's input reads (`x-source` of kind `variable`); filled server-side, never seen by the model. */
-    variables: boundVariablesSchema,
-});
-
-/**
- * A sandbox tool is described to the model by its rendered `signature`; a
- * client tool is declared to the model as a function call, which needs the
- * published input JSON Schema verbatim.
- */
-export const toolSignatureSchema = z.union([
-    toolSignatureBaseSchema.extend({
-        embed: z.undefined().optional(),
-        inputSchema: z.record(z.string(), z.unknown()).optional(),
-    }),
-    toolSignatureBaseSchema.extend({
-        embed: toolEmbedSchema,
-        inputSchema: z.record(z.string(), z.unknown()),
-    }),
-]);
-export type ToolSignature = z.infer<typeof toolSignatureSchema>;
-
-/**
- * One always-listed skill line. The description is the whole trigger: the
- * model reads it every turn and calls `loadSkill` when it matches the task.
- */
-export const skillLineSchema = z.object({
-    name: slugSchema,
-    description: z.string().max(500),
-});
-export type SkillLine = z.infer<typeof skillLineSchema>;
-
-export const serviceCardSchema = z.object({
-    serviceId: z.uuid(),
-    key: slugSchema,
-    name: z.string(),
-    card: z.string(),
-    score: z.number(),
-    /** Skills scoped to this service; listed only while the card is in context. */
-    skills: z.array(skillLineSchema),
-});
-
-/**
- * A skill body served on `loadSkill`: mentions rendered to current names and
- * headings demoted by the console, `{{variables}}` left for the server to
- * fill per request. `mentionedTools` are the sandbox bindings the body
- * refers to, so the turn can register them before the model acts on it.
- */
-export const skillBodyResponseSchema = z.object({
-    name: z.string(),
-    body: z.string(),
-    mentionedTools: z.array(mentionedToolSchema),
-    /** Datasets the body mentions; the server lists them under the body so the model can query them at once. */
-    mentionedDatasets: z.array(datasetIdentifierSchema),
-    catalogVersion: catalogVersionSchema,
-});
-export type SkillBodyResponse = z.infer<typeof skillBodyResponseSchema>;
-
-export const runtimeAgentConfigSchema = z.object({
-    /**
-     * End-user token verification for this agent, managed by the agent's
-     * owner. Absent = the server's own auth default applies.
-     */
-    auth: publishedAuthSchema.optional(),
-    systemPrompt: z.string(),
-    /** Every declared variable the published prompt, skills, or triggers reference. */
-    promptVariables: z.array(variableDeclarationSchema.shape.name),
-    defaultLocale: localeSchema,
-    /**
-     * Whether end users may upload files to this agent. Operational config
-     * like `auth`: read from the agent row, so toggling applies without
-     * republishing. The runtime rejects new uploads when false; existing
-     * attachments stay downloadable and deletable.
-     */
-    attachmentsEnabled: z.boolean(),
-    /**
-     * The media forms the agent may draw, which its prompt then describes.
-     * Operational like `attachmentsEnabled`: toggling applies without
-     * republishing.
-     */
-    media: z.array(mediaFormSchema),
-    metaTools: z.object({
-        searchKnowledge: z.boolean(),
-        searchTools: z.boolean(),
-        searchServices: z.boolean(),
-    }),
-    limits: z.object({
-        resolveTokenBudget: z.number().int().positive(),
-        executeTimeoutMs: z.number().int().positive(),
-        maxResponseBytes: z.number().int().positive(),
-    }),
-    /** Unscoped published skills; service-scoped ones travel on their card. */
-    skills: z.array(skillLineSchema),
-    triggers: z.array(triggerDeclarationSchema),
-    /** Published dataset hosts with the exposed definitions as of their pinned manifest version. */
-    datasetHosts: z.array(datasetHostDeclarationSchema),
-    /** Whether end users may message this agent; false makes it headless. */
-    messageTrigger: z.boolean(),
-    /** Operational like `messageTrigger`: edited on the agent row without republishing. */
-    suggestions: suggestionsSchema,
-    /** Operational like `suggestions`. */
-    greeting: greetingSchema,
-    /**
-     * The model picks of the agent's server and of the agent, with the
-     * providers they and the agent's triggers name. Operational like
-     * `greeting`: edited without republishing.
-     */
-    models: runtimeModelsSchema,
-    /** The resolved agent's id; reports about it carry this so they attach to it whatever the slug or alias later means. */
-    agentRef: agentRefSchema,
-    catalogVersion: catalogVersionSchema,
-    publishedAt: z.iso.datetime(),
-});
-export type RuntimeAgentConfig = z.infer<typeof runtimeAgentConfigSchema>;
-
-const retrievalQuerySchema = z.string().trim().min(1).max(4000);
-const threadIdSchema = z.string().max(128);
-
-/** How many recent tool names one resolve request may carry. */
-export const RECENT_TOOL_NAMES_MAX = 20;
-
-export const resolveRequestSchema = z.object({
-    query: retrievalQuerySchema,
-    threadId: threadIdSchema,
-    /** Sandbox tools the thread called recently; resolve ranks them ahead of cold ones. */
-    recentToolNames: z.array(z.string()).max(RECENT_TOOL_NAMES_MAX),
-    limits: z
-        .object({
-            knowledge: z.number().int().min(0).max(20),
-            tools: z.number().int().min(0).max(20),
-            services: z.number().int().min(0).max(20),
-            datasets: z.number().int().min(0).max(20).default(6),
-        })
-        .prefault({ knowledge: 6, tools: 8, services: 5, datasets: 6 }),
-});
-export type ResolveRequest = z.input<typeof resolveRequestSchema>;
-
-/** A dataset the turn should list: ranked in by the question, or pinned by the author. */
-export const resolvedDatasetSchema = z.object({
-    name: datasetIdentifierSchema,
-    score: z.number().nullable(),
-    pinned: z.boolean(),
-});
-
-export type ResolvedDataset = z.infer<typeof resolvedDatasetSchema>;
-
-export const resolveResponseSchema = z.object({
-    resolveId: z.uuid(),
-    catalogVersion: catalogVersionSchema,
-    locale: localeSchema,
-    knowledge: z.array(knowledgeChunkSchema),
-    tools: z.array(toolSignatureSchema),
-    services: z.array(serviceCardSchema),
-    /** One line each in the turn context; the definitions come from the config's dataset hosts. */
-    datasets: z.array(resolvedDatasetSchema),
-    sharedShapes: z.array(sharedShapeSchema),
-    budget: z.object({
-        requested: z.number().int(),
-        used: z.number().int(),
-        truncated: z.boolean(),
-    }),
-});
-export type ResolveResponse = z.infer<typeof resolveResponseSchema>;
-
-export const searchRequestSchema = z.object({
-    query: retrievalQuerySchema,
-    limit: z.number().int().min(1).max(20).default(5),
-    locale: localeSchema.optional(),
-    threadId: threadIdSchema.optional(),
-    service: slugSchema.optional(),
-});
-export type SearchRequest = z.input<typeof searchRequestSchema>;
-
-export const searchToolsResponseSchema = z.object({
-    catalogVersion: catalogVersionSchema,
-    tools: z.array(toolSignatureSchema),
-    sharedShapes: z.array(sharedShapeSchema),
-});
-
-export const searchServicesResponseSchema = z.object({
-    catalogVersion: catalogVersionSchema,
-    services: z.array(serviceCardSchema),
-    tools: z.array(toolSignatureSchema),
-    sharedShapes: z.array(sharedShapeSchema),
-});
-
-export const searchKnowledgeResponseSchema = z.object({
-    catalogVersion: catalogVersionSchema,
-    knowledge: z.array(knowledgeChunkSchema),
-});
-
-export const executeRequestSchema = z.object({
-    input: z.record(z.string(), z.unknown()),
-    context: z.object({
-        threadId: threadIdSchema,
-        userId: z.string().max(128),
-        /** Values of the variables the tool's input reads; only those names travel. */
-        variables: z.record(z.string(), z.unknown()),
-    }),
-});
-export type ExecuteRequest = z.input<typeof executeRequestSchema>;
-
-export const executeResponseSchema = z.object({
-    toolId: z.uuid(),
-    name: z.string(),
-    version: z.number().int().positive(),
-    output: z.unknown(),
-    meta: z.object({
-        upstreamStatus: z.number().int().min(100).max(599),
-        durationMs: z.number().int().min(0),
-        replayed: z.boolean(),
-        truncated: z.boolean(),
-        truncatedPaths: z.array(z.string()),
-        drift: z.array(
-            z.object({
-                path: z.string(),
-                kind: z.enum(JSON_SCHEMA_ISSUE_KINDS),
-            }),
-        ),
-    }),
-});

package/src/contracts/runtime/auth.ts

@@ -1,41 +0,0 @@
-import { z } from "zod";
-
-/*
- * How a server, or one agent on it, verifies the end user's token. One union
- * for every reader: a code config, an agent the Control Center created, and
- * the runtime config cc publishes. A `custom` verifier exists in code only,
- * so it is not part of this contract.
- */
-
-export const AUTH_JWT_SECRET_ALGORITHMS = ["HS256", "HS384", "HS512"] as const;
-
-const issuerSchema = z.string().trim().min(1).max(2048);
-/** When set, the token's `aud` must contain it, so a token minted for another audience under the same issuer cannot be replayed here. */
-const audienceSchema = z.string().trim().min(1).max(2048).optional();
-
-/** Asymmetric tokens: the issuer publishes its public keys at the JWKS URI. */
-export const jwksAuthSchema = z.object({
-    kind: z.literal("jwks"),
-    jwksUri: z.url(),
-    issuer: issuerSchema,
-    audience: audienceSchema,
-});
-
-/**
- * Symmetric tokens: the issuer and this server share the secret. At least
- * 32 characters, the JOSE minimum for HMAC keys; the algorithms are pinned
- * so a token signed another way is refused before the key is tried.
- */
-export const jwtSecretAuthSchema = z.object({
-    kind: z.literal("jwt-secret"),
-    secret: z.string().min(32),
-    algorithms: z.array(z.enum(AUTH_JWT_SECRET_ALGORITHMS)).min(1),
-    issuer: issuerSchema,
-    audience: audienceSchema,
-});
-
-export const publishedAuthSchema = z.discriminatedUnion("kind", [
-    jwksAuthSchema,
-    jwtSecretAuthSchema,
-]);
-export type PublishedAuth = z.infer<typeof publishedAuthSchema>;