@assistant-ui/passport

Declarative credential verification for WinterTC runtimes: request in, principal out. Providers are jwt (OIDC discovery, JWKS, static PEM, or HS256 secret), staticToken, and introspect (RFC 7662). Part of harness-sdk, with statewire and pinned.

Install

pnpm add @assistant-ui/passport

Use

import { createPassport, PassportUnauthorized } from "@assistant-ui/passport";

const passport = createPassport({
  providers: [
    {
      type: "jwt",
      id: "auth0",
      issuer: "https://example.auth0.com/",
      audience: ["https://api.example.com"],
    },
    {
      type: "staticToken",
      id: "api-keys",
      keys: [{ name: "ci", token: { env: "CI_TOKEN" }, scopes: ["deploy"] }],
    },
  ],
});

// Principal | null; a failed credential throws PassportUnauthorized.
const principal = await passport.validate(request);

Docs

• Get started: https://github.com/assistant-ui/harness-sdk/blob/main/apps/docs/app/docs/get-started/fleet/page.mdx
• Guide: https://github.com/assistant-ui/harness-sdk/blob/main/apps/docs/app/docs/guides/authenticate/page.mdx
• Reference: https://github.com/assistant-ui/harness-sdk/blob/main/apps/docs/app/docs/reference/passport/page.mdx
• Spec: https://github.com/assistant-ui/harness-sdk/blob/main/apps/docs/app/docs/spec/pinboard-registry/page.mdx