Add Node.js polyglot E2E (SIWE + JWT/JWKS)

.github/workflows/ci.yml

@@ -147,3 +147,43 @@ jobs:
         run: |
           echo "::error::Coverage is below the required threshold (line >= ${MIN_LINE_COVERAGE}%, region >= ${MIN_REGION_COVERAGE}%)."
           exit 1
+
+  trust-auth-e2e:
+    name: trust-relay ↔ trust-auth E2E
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          shared-key: ci
+          cache-on-failure: true
+
+      - name: Run live-server trust-auth integration test
+        run: cargo test --test trust_auth_e2e -- --nocapture
+
+  polyglot-nodejs-e2e:
+    name: Polyglot E2E (Node.js / SIWE + jose)
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: npm
+          cache-dependency-path: tests/polyglot/nodejs/package-lock.json
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          shared-key: ci
+          cache-on-failure: true
+
+      - name: Run Node.js polyglot contract test
+        run: ./scripts/run-polyglot-nodejs-e2e.sh

.gitignore

@@ -18,3 +18,6 @@ config/*.local.toml
 .idea/
 .vscode/
 lcov.info
+
+# Node.js polyglot E2E
+tests/polyglot/nodejs/node_modules/

AGENTS.md

@@ -31,8 +31,10 @@ cargo fmt --check               # run before considering a task done
 ## Project Structure
 
 ```text
-trust-relay/
+trust-relay/                      # Cargo workspace root
 ├── Cargo.toml
+├── crates/
+│   └── trust-auth/               # RS JWT verification (JWKS + Axum extractor)
 ├── README.md
 ├── AGENTS.md
 ├── config/
@@ -81,6 +83,15 @@ until the code that needs it exists.
 | HTTP middleware | `tower-http` | 0.6 (trace, cors) |
 | Service trait | `tower` | 0.5 |
 
+### `trust-auth` crate (M3b)
+
+| Purpose | Crate | Version |
+| --- | --- | --- |
+| JWKS fetch | `reqwest` | 0.12 (rustls) |
+
+Rust resource servers (e.g. beacon-relay) depend on `trust-auth` for TOKEN-SPEC
+§7 verification. Revocation/quota remain in the adopting service.
+
 ### Planned (add with the milestone that needs them)
 
 | Purpose | Crate | Notes |