Simplify ts-core auth.ts; fix bun-types resolution in monorepo workspace

auth.ts: dropped the legacy HS256-shared-secret verification path, keeping
only the JWKS path Supabase recommends now — one code path instead of two.

Also fixes a real bug: @types/bun's ambient types didn't resolve inside a
bun workspace (its internal 'bun-types' reference can't hoist into a nested
package's node_modules the same way it does in a flat install). Depending on
bun-types directly instead of @types/bun fixes it — verified with a clean
'bun run typecheck'.

packages/ts-core/package.json

@@ -24,7 +24,7 @@
     }
   },
   "devDependencies": {
-    "@types/bun": "^1.1.14",
+    "bun-types": "^1.1.14",
     "typescript": "^5.6.3",
     "elysia": "^1.1.26"
   }

packages/ts-core/src/auth.ts

@@ -4,9 +4,6 @@ export interface SupabaseClaims extends JWTPayload {
   sub: string;
   email?: string;
   role?: string;
-  aud: string | string[];
-  app_metadata?: Record<string, unknown>;
-  user_metadata?: Record<string, unknown>;
 }
 
 export class JwtVerificationError extends Error {
@@ -16,63 +13,28 @@ export class JwtVerificationError extends Error {
   }
 }
 
-export interface VerifierOptions {
-  /** Supabase project URL, e.g. https://xyzcompany.supabase.co */
-  supabaseUrl: string;
-  /**
-   * Legacy HS256 project JWT secret. When provided, verification uses this
-   * shared secret instead of fetching the project's JWKS. Prefer leaving
-   * this unset for projects on Supabase's newer asymmetric (ES256/RS256)
-   * signing keys.
-   */
-  jwtSecret?: string;
-  audience?: string;
-}
-
-export interface SupabaseJwtVerifier {
-  verify(token: string): Promise<SupabaseClaims>;
-}
-
-export function createSupabaseJwtVerifier(options: VerifierOptions): SupabaseJwtVerifier {
-  const audience = options.audience ?? "authenticated";
-
-  if (options.jwtSecret) {
-    const key = new TextEncoder().encode(options.jwtSecret);
-    return {
-      async verify(token: string): Promise<SupabaseClaims> {
-        try {
-          const { payload } = await jwtVerify(token, key, {
-            algorithms: ["HS256"],
-            audience,
-          });
-          return payload as SupabaseClaims;
-        } catch (err) {
-          throw new JwtVerificationError("failed to verify Supabase JWT (HS256)", err);
-        }
-      },
-    };
-  }
-
-  const jwksUrl = new URL("/auth/v1/.well-known/jwks.json", options.supabaseUrl);
-  const jwks = createRemoteJWKSet(jwksUrl);
+/**
+ * Verifies a Supabase-issued access token against the project's public
+ * JWKS (fetched once and cached). `supabaseUrl` is your project URL, e.g.
+ * `https://xyzcompany.supabase.co`.
+ */
+export function createSupabaseJwtVerifier(supabaseUrl: string) {
+  const jwks = createRemoteJWKSet(new URL("/auth/v1/.well-known/jwks.json", supabaseUrl));
 
   return {
     async verify(token: string): Promise<SupabaseClaims> {
       try {
-        const { payload } = await jwtVerify(token, jwks, { audience });
+        const { payload } = await jwtVerify(token, jwks, { audience: "authenticated" });
         return payload as SupabaseClaims;
       } catch (err) {
-        throw new JwtVerificationError("failed to verify Supabase JWT (JWKS)", err);
+        throw new JwtVerificationError("failed to verify Supabase JWT", err);
       }
     },
   };
 }
 
 export function extractBearerToken(authorizationHeader: string | null | undefined): string {
-  if (!authorizationHeader) {
-    throw new JwtVerificationError("missing Authorization header");
-  }
-  const [scheme, token] = authorizationHeader.split(" ");
+  const [scheme, token] = (authorizationHeader ?? "").split(" ");
   if (scheme !== "Bearer" || !token) {
     throw new JwtVerificationError("Authorization header is not a Bearer token");
   }

packages/ts-core/tsconfig.json

@@ -4,6 +4,7 @@
     "module": "ESNext",
     "moduleResolution": "Bundler",
     "lib": ["ES2022"],
+    "types": ["bun-types"],
     "strict": true,
     "declaration": true,
     "declarationMap": true,