feat(core): named verifiers#111
Merged
Merged
Conversation
Inbound sources' verify slot now accepts a named map (Record<string, Verifier>) alongside the existing Verifier/array forms. The verified result reports matchedVerifier (the matched key) in addition to matchedVerifierIndex, so "which verifier matched" survives config reordering instead of relying on a positional index. Purely additive: existing array/single-verifier configs and result shapes are unchanged.
There was a problem hiding this comment.
Pull request overview
Adds support for named verifier composition for TypeScript inbound verification, allowing configurations like verify: { current: Secret(...), legacy: Secret(...) } and returning a stable matchedVerifier key (in addition to matchedVerifierIndex) when the map form is used.
Changes:
- Extend
InboundSource.verifyto accept aVerifierMap(Record<string, Verifier>) and normalize all verify-shapes through a shared ordered iteration path. - Add
matchedVerifier?: stringtoComposedVerifyResult, present only for the named-map form (absent for array/single forms). - Update the TypeScript API-surface spec and docs to describe the named-map form and
matchedVerifier.
Reviewed changes
Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| typescript/packages/core/test/postel-factory.test.ts | Adds scenarios/tests for named-map verifier composition and result shape behavior. |
| typescript/packages/core/src/index.ts | Re-exports VerifierMap type from inbound types. |
| typescript/packages/core/src/inbound.ts | Implements VerifierMap, verifier-shape normalization, and conditional matchedVerifier reporting. |
| openspec/specs/api-surface-typescript/spec.md | Updates the “Verifier strategy composition” requirement and adds named-map scenarios. |
| openspec/changes/archive/2026-07-09-add-named-verifiers/tasks.md | Archived OpenSpec task checklist for the change. |
| openspec/changes/archive/2026-07-09-add-named-verifiers/specs/api-surface-typescript/spec.md | Archived delta spec capturing the modified requirement/scenarios. |
| openspec/changes/archive/2026-07-09-add-named-verifiers/proposal.md | Archived proposal describing motivation, scope, and impact. |
| openspec/changes/archive/2026-07-09-add-named-verifiers/language-impact.md | Archived per-language impact assessment. |
| openspec/changes/archive/2026-07-09-add-named-verifiers/.openspec.yaml | Archived change metadata. |
| docs/content/docs/inbound/key-rotation.mdx | Documents named-map verifier usage and matchedVerifier for key rotation metrics. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
The test only asserted postel.inbound.api.verify was a function, so it would still pass even if named-map normalization broke mixed-mode composition or stopped setting matchedVerifier. Now performs a real Ed25519/JWKS verification (mirroring verify-keyset.test.ts's fixture pattern) and asserts matchedVerifier === "jwks" and matchedVerifierIndex === 1.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
InboundSource.verifynow accepts a named map —verify: { current: Secret(NEW), legacy: Secret(OLD) }— alongside the existingVerifierandReadonlyArray<Verifier>forms.matchedVerifier: string(the matched key) when the map form is used, in addition to the existingmatchedVerifierIndex. The array and single-Verifierforms are unchanged —matchedVerifieris absent (not merelyundefined) for those.ConfigurationError/TimestampTooOldrethrow-not-swallow, and failure aggregation behave identically across all three forms — the composition loop normalizes them into one ordered list before iterating, so there's no per-form duplication.Closes #96.
Capability
api-surface-typescript: MODIFIED "Verifier strategy composition" — adds the named-map form and thematchedVerifierresult field (4 new scenarios; the 5 existing scenarios are untouched).Test plan
postel-factory.test.ts: named-map reports matched name, named-map composes with cross-scheme migration, array/single forms carry nomatchedVerifierkey, named-mapConfigurationErrorrethrowpnpm typecheck/pnpm test/pnpm lint/pnpm buildgreen across all 27 packagesmise run check:allgreen after archivingdocs/content/docs/inbound/key-rotation.mdxgains a named-map example