veryfront 0.1.320 → 0.1.322

package/esm/extensions/ext-tailwind/src/index.d.ts

@@ -0,0 +1,9 @@
+import type { ExtensionFactory } from "../../../src/extensions/index.js";
+import type { CSSCompileOptions, CSSCompiler, CSSProcessor } from "../../../src/extensions/interfaces/index.js";
+declare class TailwindCSSProcessor implements CSSProcessor {
+    compile(stylesheet: string, options: CSSCompileOptions): Promise<CSSCompiler>;
+}
+declare const extTailwind: ExtensionFactory;
+export default extTailwind;
+export { TailwindCSSProcessor };
+//# sourceMappingURL=index.d.ts.map

package/esm/extensions/ext-tailwind/src/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/extensions/ext-tailwind/src/index.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,6CAA6C,CAAC;AAgBhH,cAAM,oBAAqB,YAAW,YAAY;IAC1C,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC;CAgBpF;AAED,QAAA,MAAM,WAAW,EAAE,gBAoBlB,CAAC;AAEF,eAAe,WAAW,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,CAAC"}

package/esm/extensions/ext-tailwind/src/index.js

@@ -0,0 +1,69 @@
+/**
+ * ext-tailwind — CSSProcessor implementation backed by Tailwind CSS v4.
+ *
+ * Provides the `CSSProcessor` contract:
+ *  - `compile(stylesheet, options)` — delegates to tailwindcss `compile()`
+ *    and returns a compiler whose `build(candidates)` emits CSS for the
+ *    class-name candidates discovered at render time.
+ *
+ * The extension also installs three `globalThis` shims on setup so that
+ * Tailwind plugin bundles loaded at runtime from esm.sh can bind their
+ * `tailwindcss/plugin`, `tailwindcss/defaultTheme`, and `tailwindcss/colors`
+ * imports to the same tailwindcss copy this extension ships. Core's
+ * `plugin-loader.ts` rewrites plugin bundle code to reference these shims
+ * by name; without the shims installed, dynamic plugin loading fails.
+ *
+ * @module extensions/ext-tailwind
+ */
+import * as dntShim from "../../../_dnt.shims.js";
+import { compile } from "tailwindcss";
+import plugin from "tailwindcss/plugin";
+import defaultTheme from "tailwindcss/defaultTheme";
+import colors from "tailwindcss/colors";
+function installTailwindPluginShims() {
+    const g = dntShim.dntGlobalThis;
+    g.__tailwindPluginShim = { default: plugin, __esModule: true };
+    g.__tailwindDefaultThemeShim = { default: defaultTheme, __esModule: true };
+    g.__tailwindColorsShim = { default: colors, __esModule: true };
+}
+class TailwindCSSProcessor {
+    async compile(stylesheet, options) {
+        const native = await compile(stylesheet, {
+            base: options.base,
+            loadStylesheet: options.loadStylesheet,
+            loadModule: async (id) => {
+                const loaded = await options.loadModule(id);
+                // deno-lint-ignore no-explicit-any -- loaded plugin modules are opaque to the contract
+                return { module: loaded.module, base: loaded.base, path: loaded.path };
+            },
+        });
+        return {
+            build(candidates) {
+                return native.build(candidates);
+            },
+        };
+    }
+}
+const extTailwind = () => {
+    const impl = new TailwindCSSProcessor();
+    return {
+        name: "ext-tailwind",
+        version: "0.1.0",
+        capabilities: [
+            { type: "contract", name: "CSSProcessor" },
+            { type: "net", hosts: ["esm.sh"] },
+        ],
+        setup(ctx) {
+            installTailwindPluginShims();
+            ctx.provide("CSSProcessor", impl);
+            ctx.logger.info("[ext-tailwind] CSSProcessor registered");
+        },
+        teardown() {
+            // Shims stay installed — removing them could break in-flight plugin
+            // loads. The globalThis pollution is intentional and scoped to keys
+            // with `__tailwind` prefix.
+        },
+    };
+};
+export default extTailwind;
+export { TailwindCSSProcessor };

package/esm/src/embedding/veryfront-cloud/provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../../../src/src/embedding/veryfront-cloud/provider.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAQhE,wBAAgB,kCAAkC,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,CA2BpF"}
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../../../src/src/embedding/veryfront-cloud/provider.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAShE,wBAAgB,kCAAkC,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,CA6BpF"}

package/esm/src/embedding/veryfront-cloud/provider.js

@@ -1,6 +1,7 @@
 import { createError, toError } from "../../errors/veryfront-error.js";
 import { createGoogleEmbeddingRuntime } from "../../provider/runtime-loader.js";
 import { createVeryfrontCloudFetch, getVeryfrontCloudGatewayBaseUrl, parseVeryfrontCloudModelId, requireVeryfrontCloudBootstrap, } from "../../provider/veryfront-cloud/shared.js";
+import { createVeryfrontCloudOpenAIEmbeddingModel } from "../../provider/veryfront-cloud/openai.js";
 export function createVeryfrontCloudEmbeddingModel(modelId) {
     const { provider, modelId: upstreamModelId } = parseVeryfrontCloudModelId(modelId, "embedding");
     const { apiBaseUrl, apiToken } = requireVeryfrontCloudBootstrap();
@@ -8,7 +9,11 @@ export function createVeryfrontCloudEmbeddingModel(modelId) {
     const fetch = createVeryfrontCloudFetch(apiToken);
     switch (provider) {
         case "openai":
-            throw new Error("OpenAI provider not installed. Add @veryfront/ext-openai to use openai embedding models via veryfront-cloud.");
+            return createVeryfrontCloudOpenAIEmbeddingModel(upstreamModelId, {
+                apiToken,
+                baseURL,
+                fetch,
+            });
         case "google":
             return createGoogleEmbeddingRuntime({
                 apiKey: apiToken,

package/esm/src/html/styles-builder/tailwind-compiler-cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tailwind-compiler-cache.d.ts","sourceRoot":"","sources":["../../../../src/src/html/styles-builder/tailwind-compiler-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAgB,MAAM,sCAAsC,CAAC;AA2EtF,wBAAsB,WAAW,CAC/B,UAAU,EAAE,MAAM,EAClB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,WAAW,CAAC,CAgEtB;AAED,wBAAgB,kBAAkB,IAAI,IAAI,CAGzC;AAED;;GAEG;AACH,wBAAgB,qBAAqB,IAAI;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC1E,CAQA;AAED,wBAAgB,gBAAgB,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAalD"}
+{"version":3,"file":"tailwind-compiler-cache.d.ts","sourceRoot":"","sources":["../../../../src/src/html/styles-builder/tailwind-compiler-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAMH,OAAO,KAAK,EAAE,WAAW,EAAgB,MAAM,sCAAsC,CAAC;AA0GtF,wBAAsB,WAAW,CAC/B,UAAU,EAAE,MAAM,EAClB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,WAAW,CAAC,CAgEtB;AAED,wBAAgB,kBAAkB,IAAI,IAAI,CAGzC;AAED;;GAEG;AACH,wBAAgB,qBAAqB,IAAI;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC1E,CAQA;AAED,wBAAgB,gBAAgB,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAalD"}

package/esm/src/html/styles-builder/tailwind-compiler-cache.js

@@ -13,7 +13,7 @@
  *
  * @module html/styles-builder/tailwind-compiler-cache
  */
-import { tryResolve as tryResolveContract } from "../../extensions/contracts.js";
+import { register as registerContract, tryResolve as tryResolveContract, } from "../../extensions/contracts.js";
 import { serverLogger } from "../../utils/index.js";
 import { DEPENDENCY_MISSING, NETWORK_ERROR } from "../../errors/index.js";
 import { getTailwindCSSUrl } from "../../utils/constants/cdn.js";
@@ -51,6 +51,34 @@ async function getTailwindBaseCSS() {
     }
     return tailwindBaseCSS;
 }
+async function resolveCSSProcessor() {
+    const registeredProcessor = tryResolveContract("CSSProcessor");
+    if (registeredProcessor)
+        return registeredProcessor;
+    try {
+        const { default: createTailwindExtension } = await import("../../../extensions/ext-tailwind/src/index.js");
+        const extension = createTailwindExtension();
+        await extension.setup?.({
+            config: {},
+            logger,
+            provide: (name, impl) => registerContract(name, impl),
+            get: () => undefined,
+            require: (name) => {
+                const contract = tryResolveContract(name);
+                if (contract === undefined) {
+                    throw new Error(`Missing required extension contract: ${name}`);
+                }
+                return contract;
+            },
+        });
+    }
+    catch (error) {
+        logger.warn("Failed to register built-in CSSProcessor extension", {
+            error: error instanceof Error ? error.message : String(error),
+        });
+    }
+    return tryResolveContract("CSSProcessor");
+}
 function evictOldestCompiler() {
     if (compilerCache.size < MAX_CACHED_COMPILERS)
         return;
@@ -79,7 +107,7 @@ export async function getCompiler(stylesheet, projectSlug) {
         return cached.compiler;
     }
     logger.debug("Creating new compiler", { hash, projectSlug });
-    const processor = tryResolveContract("CSSProcessor");
+    const processor = await resolveCSSProcessor();
     if (!processor) {
         logger.warn("No CSSProcessor extension registered — CSS output will be empty. Install it with: deno add @veryfront/ext-tailwind");
         const noopCompiler = { build: () => "" };

package/esm/src/provider/shared/index.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Shared plumbing consumed by the `@veryfront/ext-*` provider extensions.
+ *
+ * This barrel is the stable public surface: implementations currently live
+ * in `runtime-loader.ts` and `runtime-loader/` subdirectory. Future PRs
+ * (post ext-anthropic / ext-google extraction) may move the implementations
+ * into this directory; extensions keep importing from here unchanged.
+ *
+ * @module provider/shared
+ */
+export { getAnthropicMessagesUrl, getGoogleEmbeddingUrl, getGoogleGenerateContentUrl, getGoogleStreamGenerateContentUrl, getOpenAIChatCompletionsUrl, getOpenAIEmbeddingUrl, getOpenAIResponsesUrl, } from "../runtime-loader/provider-endpoints.js";
+export { createAnthropicRequestInit, createGoogleRequestInit, createOpenAIRequestInit, } from "../runtime-loader/provider-request-init.js";
+export { TOOL_INPUT_PENDING_THRESHOLD_MS, withToolInputStatusTransitions, } from "../runtime-loader/tool-input-status.js";
+export { buildProviderError, createWarningCollector, isNumberArray, mergeUsage, parseRetryAfterMs, ProviderError, ProviderOverloadedError, ProviderQuotaError, ProviderRateLimitError, ProviderRequestError, readProviderOptions, readRecord, readTextParts, requestJson, requestStream, stringifyJsonValue, toOpenAICompatibleMessages, toOpenAICompatibleTools, } from "../runtime-loader.js";
+export type { OpenAICompatibleChatMessage, OpenAICompatibleChatRequest, RuntimePromptMessage, } from "../runtime-loader.js";
+//# sourceMappingURL=index.d.ts.map

package/esm/src/provider/shared/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/src/provider/shared/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,2BAA2B,EAC3B,iCAAiC,EACjC,2BAA2B,EAC3B,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,yCAAyC,CAAC;AAGjD,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,4CAA4C,CAAC;AAGpD,OAAO,EACL,+BAA+B,EAC/B,8BAA8B,GAC/B,MAAM,wCAAwC,CAAC;AAGhD,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,aAAa,EACb,UAAU,EACV,iBAAiB,EACjB,aAAa,EACb,uBAAuB,EACvB,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,EACpB,mBAAmB,EACnB,UAAU,EACV,aAAa,EACb,WAAW,EACX,aAAa,EACb,kBAAkB,EAClB,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAE9B,YAAY,EACV,2BAA2B,EAC3B,2BAA2B,EAC3B,oBAAoB,GACrB,MAAM,sBAAsB,CAAC"}

package/esm/src/provider/shared/index.js

@@ -0,0 +1,18 @@
+/**
+ * Shared plumbing consumed by the `@veryfront/ext-*` provider extensions.
+ *
+ * This barrel is the stable public surface: implementations currently live
+ * in `runtime-loader.ts` and `runtime-loader/` subdirectory. Future PRs
+ * (post ext-anthropic / ext-google extraction) may move the implementations
+ * into this directory; extensions keep importing from here unchanged.
+ *
+ * @module provider/shared
+ */
+// URL builders
+export { getAnthropicMessagesUrl, getGoogleEmbeddingUrl, getGoogleGenerateContentUrl, getGoogleStreamGenerateContentUrl, getOpenAIChatCompletionsUrl, getOpenAIEmbeddingUrl, getOpenAIResponsesUrl, } from "../runtime-loader/provider-endpoints.js";
+// Request init builders
+export { createAnthropicRequestInit, createGoogleRequestInit, createOpenAIRequestInit, } from "../runtime-loader/provider-request-init.js";
+// Tool-input status transitions
+export { TOOL_INPUT_PENDING_THRESHOLD_MS, withToolInputStatusTransitions, } from "../runtime-loader/tool-input-status.js";
+// Retry / error / HTTP plumbing (currently in runtime-loader.ts).
+export { buildProviderError, createWarningCollector, isNumberArray, mergeUsage, parseRetryAfterMs, ProviderError, ProviderOverloadedError, ProviderQuotaError, ProviderRateLimitError, ProviderRequestError, readProviderOptions, readRecord, readTextParts, requestJson, requestStream, stringifyJsonValue, toOpenAICompatibleMessages, toOpenAICompatibleTools, } from "../runtime-loader.js";

package/esm/src/provider/veryfront-cloud/openai.d.ts

@@ -0,0 +1,10 @@
+import type { EmbeddingRuntime, ModelRuntime } from "../types.js";
+interface VeryfrontCloudOpenAIConfig {
+    apiToken: string;
+    baseURL: string;
+    fetch: typeof globalThis.fetch;
+}
+export declare function createVeryfrontCloudOpenAIModel(modelId: string, config: VeryfrontCloudOpenAIConfig): ModelRuntime;
+export declare function createVeryfrontCloudOpenAIEmbeddingModel(modelId: string, config: VeryfrontCloudOpenAIConfig): EmbeddingRuntime;
+export {};
+//# sourceMappingURL=openai.d.ts.map

package/esm/src/provider/veryfront-cloud/openai.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openai.d.ts","sourceRoot":"","sources":["../../../../src/src/provider/veryfront-cloud/openai.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAKlE,UAAU,0BAA0B;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CAChC;AAED,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,0BAA0B,GACjC,YAAY,CAOd;AAED,wBAAgB,wCAAwC,CACtD,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,0BAA0B,GACjC,gBAAgB,CAOlB"}

package/esm/src/provider/veryfront-cloud/openai.js

@@ -0,0 +1,18 @@
+import { OpenAIProvider } from "../../../extensions/ext-openai/src/openai-provider.js";
+const openAIProvider = new OpenAIProvider();
+export function createVeryfrontCloudOpenAIModel(modelId, config) {
+    return openAIProvider.createModel(modelId, {
+        credential: config.apiToken,
+        baseURL: config.baseURL,
+        name: "veryfront-cloud",
+        fetch: config.fetch,
+    });
+}
+export function createVeryfrontCloudOpenAIEmbeddingModel(modelId, config) {
+    return openAIProvider.createEmbedding(modelId, {
+        credential: config.apiToken,
+        baseURL: config.baseURL,
+        name: "veryfront-cloud",
+        fetch: config.fetch,
+    });
+}

package/esm/src/provider/veryfront-cloud/provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../../../src/src/provider/veryfront-cloud/provider.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAQhD,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAiEvE"}
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../../../src/src/provider/veryfront-cloud/provider.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAShD,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAmEvE"}

package/esm/src/provider/veryfront-cloud/provider.js

@@ -3,6 +3,7 @@ import { createAnthropicModelRuntime, createGoogleModelRuntime } from "../runtim
 import { tryResolve } from "../../extensions/contracts.js";
 import { AIProviderRegistryName } from "../../extensions/interfaces/index.js";
 import { createVeryfrontCloudFetch, getVeryfrontCloudGatewayBaseUrl, parseVeryfrontCloudModelId, requireVeryfrontCloudBootstrap, } from "./shared.js";
+import { createVeryfrontCloudOpenAIModel } from "./openai.js";
 export function createVeryfrontCloudModel(modelId) {
     const { provider, modelId: upstreamModelId } = parseVeryfrontCloudModelId(modelId, "language");
     const { apiBaseUrl, apiToken, projectSlug } = requireVeryfrontCloudBootstrap();
@@ -50,7 +51,11 @@ export function createVeryfrontCloudModel(modelId) {
                     fetch,
                 });
             }
-            throw new Error("OpenAI provider not installed. Add @veryfront/ext-openai to use openai/moonshotai models via veryfront-cloud.");
+            return createVeryfrontCloudOpenAIModel(upstreamModelId, {
+                apiToken,
+                baseURL,
+                fetch,
+            });
         }
         default: {
             const _exhaustive = provider;

package/esm/src/proxy/main.js

@@ -23,6 +23,8 @@ import * as dntShim from "../../_dnt.shims.js";
 import { createProxyHandler, INTERNAL_PROXY_HEADERS } from "./handler.js";
 import { createCacheFromEnv } from "./cache/index.js";
 import { isRetryableConnectionError } from "./retry.js";
+import { register } from "../extensions/contracts.js";
+import { createAuthProvider } from "../../extensions/ext-jwt/src/index.js";
 import { endSpan, extractContext, initializeOTLPWithApis, injectContext, ProxySpanNames, shutdownOTLP, startServerSpan, withContext, withSpan, } from "./tracing.js";
 import { proxyLogger, runWithProxyRequestContext } from "./logger.js";
 import { getProxyFailureLogLevel } from "./log-noise.js";
@@ -80,6 +82,7 @@ const DEFAULT_SERVER_RETRY_COUNT = 1;
 const DEFAULT_SERVER_RETRY_DELAY_MS = 100;
 const VERYFRONT_SERVER_RETRY_COUNT = parseInt(getEnv("VERYFRONT_SERVER_RETRY_COUNT") || String(DEFAULT_SERVER_RETRY_COUNT));
 const VERYFRONT_SERVER_RETRY_DELAY_MS = parseInt(getEnv("VERYFRONT_SERVER_RETRY_DELAY_MS") || String(DEFAULT_SERVER_RETRY_DELAY_MS));
+register("AuthProvider", createAuthProvider({}));
 // Initialize cache and proxy handler
 const cache = await createCacheFromEnv();
 const proxyHandler = createProxyHandler({

package/esm/src/utils/version-constant.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "0.1.320";
+export declare const VERSION = "0.1.322";
 //# sourceMappingURL=version-constant.d.ts.map

package/esm/src/utils/version-constant.js

@@ -1,3 +1,3 @@
 // Keep in sync with deno.json version.
 // scripts/release.ts updates this constant during releases.
-export const VERSION = "0.1.320";
+export const VERSION = "0.1.322";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "veryfront",
-  "version": "0.1.320",
+  "version": "0.1.322",
   "description": "The simplest way to build AI-powered apps",
   "keywords": [
     "react",
@@ -225,6 +225,7 @@
     "esbuild": "0.27.4",
     "github-slugger": "2.0.0",
     "gray-matter": "4.0.3",
+    "jose": "5.9.6",
     "mdast-util-to-string": "4.0.0",
     "react": "19.2.4",
     "react-dom": "19.2.4",
@@ -239,6 +240,7 @@
     "remark-parse": "11.0.0",
     "remark-rehype": "11.1.2",
     "tailwind-merge": "3.5.0",
+    "tailwindcss": "4.2.2",
     "unified": "11.0.5",
     "unist-util-visit": "5.1.0",
     "vfile": "6.0.3",

package/src/deno.js

@@ -1,6 +1,6 @@
 export default {
   "name": "veryfront",
-  "version": "0.1.320",
+  "version": "0.1.322",
   "license": "Apache-2.0",
   "nodeModulesDir": "auto",
   "workspace": [

package/src/extensions/ext-jwt/src/index.ts

@@ -0,0 +1,173 @@
+/**
+ * ext-jwt — AuthProvider implementation backed by `jose`.
+ *
+ * Provides the `AuthProvider` contract: sign / verify (HS256 by default),
+ * verify-with-remote-JWKS, and decode-header.
+ *
+ * @module extensions/ext-jwt
+ */
+import * as dntShim from "../../../_dnt.shims.js";
+
+
+import {
+  createRemoteJWKSet,
+  decodeProtectedHeader,
+  type JWTPayload,
+  jwtVerify,
+  type KeyLike,
+  SignJWT,
+} from "jose";
+
+import type { ExtensionFactory } from "../../../src/extensions/index.js";
+import type {
+  AuthProvider,
+  SignOptions,
+  TokenHeader,
+  TokenPayload,
+  VerifyOptions,
+} from "../../../src/extensions/interfaces/index.js";
+
+/**
+ * Signature used by jose's verify step to resolve a key for a given header.
+ *
+ * Matches the shape returned by `createRemoteJWKSet` / `createLocalJWKSet`
+ * and lets tests inject an in-memory key set without reaching the network.
+ */
+export type JwksResolver = Parameters<typeof jwtVerify>[1] & object;
+
+/**
+ * Factory for building a JWKS resolver from a URL.
+ *
+ * The default uses `createRemoteJWKSet`; tests can inject a stub that returns
+ * a local resolver bound to an in-memory key set.
+ */
+export type JwksResolverFactory = (jwksUrl: string) => JwksResolver;
+
+/**
+ * Optional configuration for the ext-jwt factory.
+ *
+ * - `secret`: HMAC secret for `sign`/`verify`. Falls back to the `JWT_SECRET`
+ *   environment variable. Without one, `sign`/`verify` throw.
+ * - `jwksResolverFactory`: test seam that overrides JWKS resolution.
+ */
+export interface ExtJwtConfig {
+  secret?: string | Uint8Array;
+  jwksResolverFactory?: JwksResolverFactory;
+}
+
+function defaultJwksResolverFactory(jwksUrl: string): JwksResolver {
+  return createRemoteJWKSet(new URL(jwksUrl)) as unknown as JwksResolver;
+}
+
+function toUint8Array(secret: string | Uint8Array): Uint8Array {
+  return typeof secret === "string" ? new TextEncoder().encode(secret) : secret;
+}
+
+function getSecret(configSecret?: string | Uint8Array): Uint8Array {
+  if (configSecret !== undefined) return toUint8Array(configSecret);
+  const env = typeof dntShim.Deno !== "undefined" ? dntShim.Deno.env.get("JWT_SECRET") : undefined;
+  if (!env) {
+    throw new Error(
+      "ext-jwt: no HMAC secret configured. Pass `secret` to the extension " +
+        "factory or set the JWT_SECRET environment variable.",
+    );
+  }
+  return new TextEncoder().encode(env);
+}
+
+function createAuthProvider(config: ExtJwtConfig): AuthProvider {
+  const jwksResolverFactory = config.jwksResolverFactory ??
+    defaultJwksResolverFactory;
+
+  // Cache one resolver per JWKS URL; `createRemoteJWKSet` maintains its own
+  // internal key cache with cooldown/rotation semantics, so reusing the
+  // same resolver is required for the cache to be effective.
+  const jwksResolvers = new Map<string, JwksResolver>();
+
+  function getJwksResolver(jwksUrl: string): JwksResolver {
+    const existing = jwksResolvers.get(jwksUrl);
+    if (existing) return existing;
+    const created = jwksResolverFactory(jwksUrl);
+    jwksResolvers.set(jwksUrl, created);
+    return created;
+  }
+
+  return {
+    async sign(payload: TokenPayload, options?: SignOptions): Promise<string> {
+      const secret = getSecret(config.secret);
+      const algorithm = options?.algorithm ?? "HS256";
+      const { sub, ...rest } = payload;
+      const builder = new SignJWT(rest as JWTPayload)
+        .setProtectedHeader({ alg: algorithm })
+        .setSubject(sub);
+      if (options?.expiresIn !== undefined) {
+        // jose's setExpirationTime accepts `string | number | Date`.
+        builder.setExpirationTime(
+          options.expiresIn as string | number,
+        );
+      }
+      return await builder.sign(secret);
+    },
+
+    async verify(
+      token: string,
+      options?: VerifyOptions,
+    ): Promise<TokenPayload> {
+      const secret = getSecret(config.secret);
+      const algorithms = options?.algorithms ?? ["HS256"];
+      const { payload } = await jwtVerify(token, secret, { algorithms });
+      return payload as TokenPayload;
+    },
+
+    async verifyWithJwks(
+      token: string,
+      jwksUrl: string,
+      options?: VerifyOptions,
+    ): Promise<TokenPayload> {
+      const resolver = getJwksResolver(jwksUrl);
+      const { algorithms, ...rest } = options ?? {};
+      const verifyOpts: Record<string, unknown> = { ...rest };
+      if (algorithms) verifyOpts.algorithms = algorithms;
+      const { payload } = await jwtVerify(
+        token,
+        resolver as unknown as KeyLike,
+        verifyOpts,
+      );
+      return payload as TokenPayload;
+    },
+
+    decode(token: string): TokenHeader | undefined {
+      try {
+        return decodeProtectedHeader(token) as TokenHeader;
+      } catch {
+        return undefined;
+      }
+    },
+  };
+}
+
+/**
+ * Default export — the ext-jwt extension factory.
+ *
+ * Produces an extension that registers an `AuthProvider` contract
+ * implementation backed by `jose`.
+ */
+const extJwt: ExtensionFactory = (config?: unknown) => {
+  const cfg = (config ?? {}) as ExtJwtConfig;
+  const provider = createAuthProvider(cfg);
+
+  return {
+    name: "ext-jwt",
+    version: "0.1.0",
+    capabilities: [
+      { type: "contract", name: "AuthProvider" },
+      { type: "network", host: "*" },
+    ],
+    provides: {
+      AuthProvider: provider,
+    },
+  };
+};
+
+export default extJwt;
+export { createAuthProvider };