feat(sdk): add extension auth for middleware E2E

.github/workflows/e2e-test.yml

@@ -59,6 +59,9 @@ jobs:
           - suite: rust-docker
             cmd: "mise run --no-deps --skip-deps e2e:rust"
             apt_packages: "openssh-client"
+          - suite: supervisor-middleware
+            cmd: "mise run --no-deps --skip-deps e2e:supervisor-middleware"
+            apt_packages: "openssh-client"
           - suite: mcp
             cmd: "mise run --no-deps --skip-deps e2e:mcp"
             apt_packages: ""

crates/openshell-sdk/Cargo.toml

@@ -10,17 +10,26 @@ rust-version.workspace = true
 license.workspace = true
 repository.workspace = true
 
+[features]
+default = []
+extension = [
+    "dep:jsonwebtoken",
+    "dep:serde_json",
+]
+
 [dependencies]
 openshell-core = { path = "../openshell-core" }
 async-trait = "0.1"
 futures = { workspace = true }
 hyper = { workspace = true }
 hyper-util = { workspace = true }
+jsonwebtoken = { workspace = true, optional = true }
 miette = { workspace = true }
 oauth2 = { version = "5", default-features = false, features = ["reqwest"] }
 reqwest = { workspace = true }
 rustls = { workspace = true }
 serde = { workspace = true }
+serde_json = { workspace = true, optional = true }
 thiserror = { workspace = true }
 tokio = { workspace = true }
 tokio-rustls = { workspace = true }

crates/openshell-sdk/README.md

@@ -49,6 +49,17 @@ mTLS (client certificates) is not supported.
 SDK-shaped enums rather than raw proto integers. Failures map to a typed
 `SdkError` with a discriminable kind.
 
+Enable the `extension` Cargo feature when building an OpenShell extension
+service:
+
+```toml
+openshell-sdk = { version = "...", features = ["extension"] }
+```
+
+The `extension` module provides common SDK building blocks for extension
+services. It currently handles caller verification; shared service interfaces
+and observability support will follow.
+
 ## Modules
 
 | Module | Purpose |
@@ -60,6 +71,7 @@ SDK-shaped enums rather than raw proto integers. Failures map to a typed
 | `oidc` | OIDC token handling at the transport layer. |
 | `refresh` | `Refresh` trait and single-flight refresh coalescing. |
 | `edge_tunnel` | Cloudflare Access tunnel dialer. |
+| `extension` | Opt-in SDK building blocks for extension services. |
 | `error` | `SdkError` taxonomy. |
 | `types` | Curated request/response types and proto conversions. |
 | `raw` | Escape hatch re-exporting the generated tonic clients. |