@codemation/managed-auth 0.1.0

package/.turbo/turbo-build.log

@@ -0,0 +1,19 @@
+
+> @codemation/managed-auth@0.1.0 build C:\Users\ChrisBlokland\projects\codemation\framework\packages\managed-auth
+> tsdown
+
+ℹ tsdown v0.15.12 powered by rolldown v1.0.0-beta.45
+ℹ Using tsdown config: C:\Users\ChrisBlokland\projects\codemation\framework\packages\managed-auth\tsdown.config.ts
+ℹ entry: src\index.ts
+ℹ tsconfig: tsconfig.json
+ℹ Build start
+ℹ [CJS] dist\index.cjs      5.49 kB │ gzip: 2.15 kB
+ℹ [CJS] dist\index.cjs.map  8.47 kB │ gzip: 2.96 kB
+ℹ [CJS] 2 files, total: 13.96 kB
+ℹ [ESM] dist\index.js      4.45 kB │ gzip: 1.72 kB
+ℹ [ESM] dist\index.js.map  8.46 kB │ gzip: 2.96 kB
+ℹ [ESM] dist\index.d.ts    3.27 kB │ gzip: 1.34 kB
+ℹ [ESM] 3 files, total: 16.17 kB
+ℹ [CJS] dist\index.d.cts  3.27 kB │ gzip: 1.34 kB
+ℹ [CJS] 1 files, total: 3.27 kB
+✔ Build complete in 3258ms

package/.turbo/turbo-lint.log

@@ -0,0 +1,4 @@
+
+> @codemation/managed-auth@0.0.1 lint C:\Users\ChrisBlokland\projects\codemation\framework\packages\managed-auth
+> eslint .
+

package/.turbo/turbo-typecheck.log

@@ -0,0 +1,4 @@
+
+> @codemation/managed-auth@0.0.1 typecheck C:\Users\ChrisBlokland\projects\codemation\framework\packages\managed-auth
+> tsc -p tsconfig.json --noEmit
+

package/CHANGELOG.md

@@ -0,0 +1,11 @@
+# @codemation/managed-auth
+
+## 0.1.0
+
+### Minor Changes
+
+- 8285ec0: Add `@codemation/managed-auth` package and `auth.kind: "managed"` support in `@codemation/host`.
+
+  `@codemation/managed-auth` is a new publishable package containing the JWKS cache and EdDSA JWT verifier used by managed-mode workspaces. It has no dependency on `@codemation/host` or `@codemation/core` and is intentionally self-contained so the closed-source workspace-mcp can install it from the public registry.
+
+  `@codemation/host` gains `auth.kind: "managed"` — a new auth mode where Better Auth is not mounted, the workspace verifies CP-signed JWT bearers, and a single-origin CORS allowlist is enforced via `CP_WEB_ORIGIN`. Boot-time guard ensures all required env vars are present before startup.

package/LICENSE

@@ -0,0 +1,37 @@
+Codemation Pre-Stable License
+
+Copyright (c) Made Relevant B.V. All rights reserved.
+
+1. Definitions
+
+   "Software" means the Codemation source code, documentation, and artifacts in this repository and any published npm packages in the Codemation monorepo.
+
+   "Stable Version" means the first published release of the package `@codemation/core` on the public npm registry with version 1.0.0 or higher.
+
+2. Permitted use (before Stable Version)
+
+   Until a Stable Version exists, you may use, copy, modify, and distribute the Software only for non-commercial purposes, including personal learning, research, evaluation, and internal use within your organization that does not charge third parties for access to the Software or a product or service whose primary value is the Software.
+
+3. Restrictions (before Stable Version)
+
+   Until a Stable Version exists, you must not:
+
+   a) Sell, rent, lease, or sublicense the Software or a derivative work for a fee;
+
+   b) Offer the Software or a derivative work as part of a paid product or service (including hosting, support, or consulting) where the Software is a material part of the offering;
+
+   c) Use the Software or a derivative work primarily to generate revenue or commercial advantage for you or others.
+
+   These restrictions apply to all versions published before a Stable Version, even if a later Stable Version is released under different terms.
+
+4. After Stable Version
+
+   The maintainers may publish a Stable Version under different license terms. If they do, those terms apply only to that Stable Version and subsequent releases they designate; they do not automatically apply to earlier pre-stable versions.
+
+5. No warranty
+
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+6. Third-party components
+
+   The Software may include third-party components under their own licenses. Those licenses govern those components.

package/dist/index.cjs

@@ -0,0 +1,176 @@
+//#region rolldown:runtime
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+
+//#endregion
+let jose = require("jose");
+jose = __toESM(jose);
+
+//#region src/JwksCache.ts
+const DEFAULT_TTL_MS = 900 * 1e3;
+const DEFAULT_JITTER_MS = 60 * 1e3;
+/**
+* Fetches and caches JWKS from a configured URL.
+*
+* On a `kid` cache miss the cache is refreshed once before failing —
+* this handles key rotation without requiring a restart.
+*
+* Refresh-window jitter avoids thundering-herd stampedes when multiple
+* workers share the same process lifetime.
+*/
+var JwksCache = class {
+	cache = null;
+	constructor(config, fetch, clock) {
+		this.config = config;
+		this.fetch = fetch;
+		this.clock = clock;
+	}
+	/** Returns the cached key for `kid`, fetching if needed. Refreshes once on kid miss. */
+	async getKey(kid) {
+		let entry = await this.getValidEntry();
+		const cached = entry.keys.get(kid);
+		if (cached !== void 0) return cached;
+		entry = await this.refresh();
+		return entry.keys.get(kid) ?? null;
+	}
+	async getValidEntry() {
+		if (this.cache !== null && this.clock.now() < this.cache.expiresAt) return this.cache;
+		return this.refresh();
+	}
+	async refresh() {
+		const response = await this.fetch(this.config.jwksUrl);
+		if (!response.ok) throw new Error(`JWKS fetch failed for ${this.config.jwksUrl}`);
+		const body = await response.json();
+		const keys = /* @__PURE__ */ new Map();
+		for (const jwk of body.keys ?? []) {
+			if (!jwk.kid) continue;
+			try {
+				const key = await (0, jose.importJWK)(jwk);
+				keys.set(jwk.kid, key);
+			} catch {}
+		}
+		const ttl = this.config.ttlMs ?? DEFAULT_TTL_MS;
+		const jitter = Math.random() * (this.config.jitterMs ?? DEFAULT_JITTER_MS);
+		const entry = {
+			keys,
+			expiresAt: this.clock.now() + ttl + jitter
+		};
+		this.cache = entry;
+		return entry;
+	}
+};
+
+//#endregion
+//#region src/ManagedJwtVerifier.ts
+/**
+* Validates CP-signed EdDSA JWT bearers.
+*
+* Checks: signature, `iss` matches expected, `aud` matches expected workspaceId,
+* `exp`, `nbf`. Returns a `VerifiedManagedPrincipal` or a structured `JwtVerificationFailure`.
+*
+* Hono-independent — no web framework coupling.
+*/
+var ManagedJwtVerifier = class {
+	constructor(config, jwksCache) {
+		this.config = config;
+		this.jwksCache = jwksCache;
+	}
+	async verify(token) {
+		let kid;
+		try {
+			const header = (0, jose.decodeProtectedHeader)(token);
+			kid = typeof header.kid === "string" ? header.kid : void 0;
+		} catch {
+			return {
+				failure: "malformed",
+				message: "Unable to decode JWT header."
+			};
+		}
+		if (!kid) return {
+			failure: "missing-kid",
+			message: "JWT header is missing the `kid` field."
+		};
+		const key = await this.jwksCache.getKey(kid);
+		if (key === null) return {
+			failure: "unknown-kid",
+			message: `No key found for kid "${kid}" after JWKS refresh.`
+		};
+		try {
+			const { payload } = await (0, jose.jwtVerify)(token, key, {
+				issuer: this.config.expectedIssuer,
+				audience: this.config.expectedAudience,
+				algorithms: ["EdDSA"]
+			});
+			const sub = payload.sub;
+			const aud = payload.aud;
+			const workspaceId = Array.isArray(aud) ? aud[0] : aud;
+			if (!sub || typeof sub !== "string") return {
+				failure: "malformed",
+				message: "JWT is missing the `sub` claim."
+			};
+			if (!workspaceId || typeof workspaceId !== "string") return {
+				failure: "wrong-aud",
+				message: "JWT `aud` claim is absent or not a string."
+			};
+			return {
+				userId: sub,
+				workspaceId
+			};
+		} catch (error) {
+			if (error instanceof jose.errors.JWTExpired) return {
+				failure: "expired",
+				message: "JWT has expired."
+			};
+			if (error instanceof jose.errors.JWTClaimValidationFailed) {
+				const claim = error.claim;
+				if (claim === "iss") return {
+					failure: "wrong-iss",
+					message: "JWT `iss` claim does not match expected issuer."
+				};
+				if (claim === "aud") return {
+					failure: "wrong-aud",
+					message: "JWT `aud` claim does not match expected audience."
+				};
+				if (claim === "nbf") return {
+					failure: "not-yet-valid",
+					message: "JWT is not yet valid (nbf check failed)."
+				};
+				return {
+					failure: "malformed",
+					message: `JWT claim validation failed: ${error.message}`
+				};
+			}
+			if (error instanceof jose.errors.JWSSignatureVerificationFailed || error instanceof jose.errors.JWSInvalid) return {
+				failure: "bad-signature",
+				message: "JWT signature verification failed."
+			};
+			return {
+				failure: "malformed",
+				message: "JWT verification failed."
+			};
+		}
+	}
+};
+
+//#endregion
+exports.JwksCache = JwksCache;
+exports.ManagedJwtVerifier = ManagedJwtVerifier;
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":["config: JwksCacheConfig","fetch: FetchFn","clock: Clock","entry: CacheEntry","config: ManagedJwtVerifierConfig","jwksCache: JwksCache","kid: string | undefined","joseErrors"],"sources":["../src/JwksCache.ts","../src/ManagedJwtVerifier.ts"],"sourcesContent":["import { importJWK } from \"jose\";\nimport type { Clock, FetchFn, JwksCacheConfig } from \"./types\";\n\nconst DEFAULT_TTL_MS = 15 * 60 * 1000; // 15 minutes\nconst DEFAULT_JITTER_MS = 60 * 1000; // 60 seconds\n\ntype JoseKey = Awaited<ReturnType<typeof importJWK>>;\n\ninterface CacheEntry {\n  keys: Map<string, JoseKey>;\n  expiresAt: number;\n}\n\ninterface JwkKey {\n  kid?: string;\n  kty?: string;\n  crv?: string;\n  x?: string;\n  use?: string;\n  alg?: string;\n}\n\ninterface JwksResponse {\n  keys: JwkKey[];\n}\n\n/**\n * Fetches and caches JWKS from a configured URL.\n *\n * On a `kid` cache miss the cache is refreshed once before failing —\n * this handles key rotation without requiring a restart.\n *\n * Refresh-window jitter avoids thundering-herd stampedes when multiple\n * workers share the same process lifetime.\n */\nexport class JwksCache {\n  private cache: CacheEntry | null = null;\n\n  constructor(\n    private readonly config: JwksCacheConfig,\n    private readonly fetch: FetchFn,\n    private readonly clock: Clock,\n  ) {}\n\n  /** Returns the cached key for `kid`, fetching if needed. Refreshes once on kid miss. */\n  async getKey(kid: string): Promise<JoseKey | null> {\n    let entry = await this.getValidEntry();\n    const cached = entry.keys.get(kid);\n    if (cached !== undefined) {\n      return cached;\n    }\n\n    // kid miss — refresh once to handle key rotation\n    entry = await this.refresh();\n    return entry.keys.get(kid) ?? null;\n  }\n\n  private async getValidEntry(): Promise<CacheEntry> {\n    if (this.cache !== null && this.clock.now() < this.cache.expiresAt) {\n      return this.cache;\n    }\n    return this.refresh();\n  }\n\n  private async refresh(): Promise<CacheEntry> {\n    const response = await this.fetch(this.config.jwksUrl);\n    if (!response.ok) {\n      throw new Error(`JWKS fetch failed for ${this.config.jwksUrl}`);\n    }\n    const body = (await response.json()) as JwksResponse;\n    const keys = new Map<string, JoseKey>();\n\n    for (const jwk of body.keys ?? []) {\n      if (!jwk.kid) continue;\n      try {\n        const key = await importJWK(jwk as Parameters<typeof importJWK>[0]);\n        keys.set(jwk.kid, key);\n      } catch {\n        // Skip malformed individual keys — don't fail the whole cache refresh\n      }\n    }\n\n    const ttl = this.config.ttlMs ?? DEFAULT_TTL_MS;\n    const jitter = Math.random() * (this.config.jitterMs ?? DEFAULT_JITTER_MS);\n    const entry: CacheEntry = {\n      keys,\n      expiresAt: this.clock.now() + ttl + jitter,\n    };\n    this.cache = entry;\n    return entry;\n  }\n}\n","import { decodeProtectedHeader, jwtVerify, errors as joseErrors } from \"jose\";\nimport type { JwtVerificationFailure, ManagedJwtVerifierConfig, VerifiedManagedPrincipal } from \"./types\";\nimport type { JwksCache } from \"./JwksCache\";\n\ntype VerifyResult = VerifiedManagedPrincipal | JwtVerificationFailure;\n\n/**\n * Validates CP-signed EdDSA JWT bearers.\n *\n * Checks: signature, `iss` matches expected, `aud` matches expected workspaceId,\n * `exp`, `nbf`. Returns a `VerifiedManagedPrincipal` or a structured `JwtVerificationFailure`.\n *\n * Hono-independent — no web framework coupling.\n */\nexport class ManagedJwtVerifier {\n  constructor(\n    private readonly config: ManagedJwtVerifierConfig,\n    private readonly jwksCache: JwksCache,\n  ) {}\n\n  async verify(token: string): Promise<VerifyResult> {\n    // Decode header to get kid before verifying signature\n    let kid: string | undefined;\n    try {\n      const header = decodeProtectedHeader(token);\n      kid = typeof header.kid === \"string\" ? header.kid : undefined;\n    } catch {\n      return { failure: \"malformed\", message: \"Unable to decode JWT header.\" };\n    }\n\n    if (!kid) {\n      return { failure: \"missing-kid\", message: \"JWT header is missing the `kid` field.\" };\n    }\n\n    const key = await this.jwksCache.getKey(kid);\n    if (key === null) {\n      return { failure: \"unknown-kid\", message: `No key found for kid \"${kid}\" after JWKS refresh.` };\n    }\n\n    try {\n      const { payload } = await jwtVerify(token, key, {\n        issuer: this.config.expectedIssuer,\n        audience: this.config.expectedAudience,\n        algorithms: [\"EdDSA\"],\n      });\n\n      const sub = payload.sub;\n      const aud = payload.aud;\n      const workspaceId = Array.isArray(aud) ? aud[0] : aud;\n\n      if (!sub || typeof sub !== \"string\") {\n        return { failure: \"malformed\", message: \"JWT is missing the `sub` claim.\" };\n      }\n      if (!workspaceId || typeof workspaceId !== \"string\") {\n        return { failure: \"wrong-aud\", message: \"JWT `aud` claim is absent or not a string.\" };\n      }\n\n      return { userId: sub, workspaceId };\n    } catch (error) {\n      if (error instanceof joseErrors.JWTExpired) {\n        return { failure: \"expired\", message: \"JWT has expired.\" };\n      }\n      if (error instanceof joseErrors.JWTClaimValidationFailed) {\n        const claim = error.claim;\n        if (claim === \"iss\") {\n          return { failure: \"wrong-iss\", message: \"JWT `iss` claim does not match expected issuer.\" };\n        }\n        if (claim === \"aud\") {\n          return { failure: \"wrong-aud\", message: \"JWT `aud` claim does not match expected audience.\" };\n        }\n        if (claim === \"nbf\") {\n          return { failure: \"not-yet-valid\", message: \"JWT is not yet valid (nbf check failed).\" };\n        }\n        return { failure: \"malformed\", message: `JWT claim validation failed: ${error.message}` };\n      }\n      if (error instanceof joseErrors.JWSSignatureVerificationFailed || error instanceof joseErrors.JWSInvalid) {\n        return { failure: \"bad-signature\", message: \"JWT signature verification failed.\" };\n      }\n      return { failure: \"malformed\", message: \"JWT verification failed.\" };\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAGA,MAAM,iBAAiB,MAAU;AACjC,MAAM,oBAAoB,KAAK;;;;;;;;;;AA+B/B,IAAa,YAAb,MAAuB;CACrB,AAAQ,QAA2B;CAEnC,YACE,AAAiBA,QACjB,AAAiBC,OACjB,AAAiBC,OACjB;EAHiB;EACA;EACA;;;CAInB,MAAM,OAAO,KAAsC;EACjD,IAAI,QAAQ,MAAM,KAAK,eAAe;EACtC,MAAM,SAAS,MAAM,KAAK,IAAI,IAAI;AAClC,MAAI,WAAW,OACb,QAAO;AAIT,UAAQ,MAAM,KAAK,SAAS;AAC5B,SAAO,MAAM,KAAK,IAAI,IAAI,IAAI;;CAGhC,MAAc,gBAAqC;AACjD,MAAI,KAAK,UAAU,QAAQ,KAAK,MAAM,KAAK,GAAG,KAAK,MAAM,UACvD,QAAO,KAAK;AAEd,SAAO,KAAK,SAAS;;CAGvB,MAAc,UAA+B;EAC3C,MAAM,WAAW,MAAM,KAAK,MAAM,KAAK,OAAO,QAAQ;AACtD,MAAI,CAAC,SAAS,GACZ,OAAM,IAAI,MAAM,yBAAyB,KAAK,OAAO,UAAU;EAEjE,MAAM,OAAQ,MAAM,SAAS,MAAM;EACnC,MAAM,uBAAO,IAAI,KAAsB;AAEvC,OAAK,MAAM,OAAO,KAAK,QAAQ,EAAE,EAAE;AACjC,OAAI,CAAC,IAAI,IAAK;AACd,OAAI;IACF,MAAM,MAAM,0BAAgB,IAAuC;AACnE,SAAK,IAAI,IAAI,KAAK,IAAI;WAChB;;EAKV,MAAM,MAAM,KAAK,OAAO,SAAS;EACjC,MAAM,SAAS,KAAK,QAAQ,IAAI,KAAK,OAAO,YAAY;EACxD,MAAMC,QAAoB;GACxB;GACA,WAAW,KAAK,MAAM,KAAK,GAAG,MAAM;GACrC;AACD,OAAK,QAAQ;AACb,SAAO;;;;;;;;;;;;;;AC3EX,IAAa,qBAAb,MAAgC;CAC9B,YACE,AAAiBC,QACjB,AAAiBC,WACjB;EAFiB;EACA;;CAGnB,MAAM,OAAO,OAAsC;EAEjD,IAAIC;AACJ,MAAI;GACF,MAAM,yCAA+B,MAAM;AAC3C,SAAM,OAAO,OAAO,QAAQ,WAAW,OAAO,MAAM;UAC9C;AACN,UAAO;IAAE,SAAS;IAAa,SAAS;IAAgC;;AAG1E,MAAI,CAAC,IACH,QAAO;GAAE,SAAS;GAAe,SAAS;GAA0C;EAGtF,MAAM,MAAM,MAAM,KAAK,UAAU,OAAO,IAAI;AAC5C,MAAI,QAAQ,KACV,QAAO;GAAE,SAAS;GAAe,SAAS,yBAAyB,IAAI;GAAwB;AAGjG,MAAI;GACF,MAAM,EAAE,YAAY,0BAAgB,OAAO,KAAK;IAC9C,QAAQ,KAAK,OAAO;IACpB,UAAU,KAAK,OAAO;IACtB,YAAY,CAAC,QAAQ;IACtB,CAAC;GAEF,MAAM,MAAM,QAAQ;GACpB,MAAM,MAAM,QAAQ;GACpB,MAAM,cAAc,MAAM,QAAQ,IAAI,GAAG,IAAI,KAAK;AAElD,OAAI,CAAC,OAAO,OAAO,QAAQ,SACzB,QAAO;IAAE,SAAS;IAAa,SAAS;IAAmC;AAE7E,OAAI,CAAC,eAAe,OAAO,gBAAgB,SACzC,QAAO;IAAE,SAAS;IAAa,SAAS;IAA8C;AAGxF,UAAO;IAAE,QAAQ;IAAK;IAAa;WAC5B,OAAO;AACd,OAAI,iBAAiBC,YAAW,WAC9B,QAAO;IAAE,SAAS;IAAW,SAAS;IAAoB;AAE5D,OAAI,iBAAiBA,YAAW,0BAA0B;IACxD,MAAM,QAAQ,MAAM;AACpB,QAAI,UAAU,MACZ,QAAO;KAAE,SAAS;KAAa,SAAS;KAAmD;AAE7F,QAAI,UAAU,MACZ,QAAO;KAAE,SAAS;KAAa,SAAS;KAAqD;AAE/F,QAAI,UAAU,MACZ,QAAO;KAAE,SAAS;KAAiB,SAAS;KAA4C;AAE1F,WAAO;KAAE,SAAS;KAAa,SAAS,gCAAgC,MAAM;KAAW;;AAE3F,OAAI,iBAAiBA,YAAW,kCAAkC,iBAAiBA,YAAW,WAC5F,QAAO;IAAE,SAAS;IAAiB,SAAS;IAAsC;AAEpF,UAAO;IAAE,SAAS;IAAa,SAAS;IAA4B"}

package/dist/index.d.cts

@@ -0,0 +1,85 @@
+import { importJWK } from "jose";
+
+//#region src/types.d.ts
+
+/**
+ * A successfully verified CP-signed JWT principal.
+ * `userId` maps to the JWT `sub` claim; `workspaceId` maps to `aud`.
+ */
+interface VerifiedManagedPrincipal {
+  readonly userId: string;
+  readonly workspaceId: string;
+}
+type JwtVerificationFailureReason = "missing-kid" | "unknown-kid" | "bad-signature" | "wrong-iss" | "wrong-aud" | "expired" | "not-yet-valid" | "malformed";
+/** Structured failure returned instead of throwing, so callers can map to HTTP status codes cleanly. */
+interface JwtVerificationFailure {
+  readonly failure: JwtVerificationFailureReason;
+  readonly message: string;
+}
+interface JwksCacheConfig {
+  /** URL to the JWKS endpoint (e.g. https://cp.example.com/.well-known/jwks.json). */
+  readonly jwksUrl: string;
+  /** TTL in milliseconds before the cache is considered stale. Defaults to 15 minutes. */
+  readonly ttlMs?: number;
+  /** Jitter window in milliseconds applied to TTL to avoid stampedes. Defaults to 60 seconds. */
+  readonly jitterMs?: number;
+}
+interface ManagedJwtVerifierConfig {
+  /** Expected value of the JWT `iss` claim — must exactly match. */
+  readonly expectedIssuer: string;
+  /** Expected `aud` claim — must exactly match the workspace ID. */
+  readonly expectedAudience: string;
+  readonly jwksCache: JwksCacheConfig;
+}
+/** Minimal fetch-compatible function type for injection / testing. */
+type FetchFn = (url: string) => Promise<{
+  ok: boolean;
+  json(): Promise<unknown>;
+}>;
+/** Minimal clock interface for injection / testing. */
+interface Clock {
+  now(): number;
+}
+//#endregion
+//#region src/JwksCache.d.ts
+type JoseKey = Awaited<ReturnType<typeof importJWK>>;
+/**
+ * Fetches and caches JWKS from a configured URL.
+ *
+ * On a `kid` cache miss the cache is refreshed once before failing —
+ * this handles key rotation without requiring a restart.
+ *
+ * Refresh-window jitter avoids thundering-herd stampedes when multiple
+ * workers share the same process lifetime.
+ */
+declare class JwksCache {
+  private readonly config;
+  private readonly fetch;
+  private readonly clock;
+  private cache;
+  constructor(config: JwksCacheConfig, fetch: FetchFn, clock: Clock);
+  /** Returns the cached key for `kid`, fetching if needed. Refreshes once on kid miss. */
+  getKey(kid: string): Promise<JoseKey | null>;
+  private getValidEntry;
+  private refresh;
+}
+//#endregion
+//#region src/ManagedJwtVerifier.d.ts
+type VerifyResult = VerifiedManagedPrincipal | JwtVerificationFailure;
+/**
+ * Validates CP-signed EdDSA JWT bearers.
+ *
+ * Checks: signature, `iss` matches expected, `aud` matches expected workspaceId,
+ * `exp`, `nbf`. Returns a `VerifiedManagedPrincipal` or a structured `JwtVerificationFailure`.
+ *
+ * Hono-independent — no web framework coupling.
+ */
+declare class ManagedJwtVerifier {
+  private readonly config;
+  private readonly jwksCache;
+  constructor(config: ManagedJwtVerifierConfig, jwksCache: JwksCache);
+  verify(token: string): Promise<VerifyResult>;
+}
+//#endregion
+export { type Clock, type FetchFn, JwksCache, type JwksCacheConfig, type JwtVerificationFailure, type JwtVerificationFailureReason, ManagedJwtVerifier, type ManagedJwtVerifierConfig, type VerifiedManagedPrincipal };
+//# sourceMappingURL=index.d.cts.map

package/dist/index.d.ts

@@ -0,0 +1,85 @@
+import { importJWK } from "jose";
+
+//#region src/types.d.ts
+
+/**
+ * A successfully verified CP-signed JWT principal.
+ * `userId` maps to the JWT `sub` claim; `workspaceId` maps to `aud`.
+ */
+interface VerifiedManagedPrincipal {
+  readonly userId: string;
+  readonly workspaceId: string;
+}
+type JwtVerificationFailureReason = "missing-kid" | "unknown-kid" | "bad-signature" | "wrong-iss" | "wrong-aud" | "expired" | "not-yet-valid" | "malformed";
+/** Structured failure returned instead of throwing, so callers can map to HTTP status codes cleanly. */
+interface JwtVerificationFailure {
+  readonly failure: JwtVerificationFailureReason;
+  readonly message: string;
+}
+interface JwksCacheConfig {
+  /** URL to the JWKS endpoint (e.g. https://cp.example.com/.well-known/jwks.json). */
+  readonly jwksUrl: string;
+  /** TTL in milliseconds before the cache is considered stale. Defaults to 15 minutes. */
+  readonly ttlMs?: number;
+  /** Jitter window in milliseconds applied to TTL to avoid stampedes. Defaults to 60 seconds. */
+  readonly jitterMs?: number;
+}
+interface ManagedJwtVerifierConfig {
+  /** Expected value of the JWT `iss` claim — must exactly match. */
+  readonly expectedIssuer: string;
+  /** Expected `aud` claim — must exactly match the workspace ID. */
+  readonly expectedAudience: string;
+  readonly jwksCache: JwksCacheConfig;
+}
+/** Minimal fetch-compatible function type for injection / testing. */
+type FetchFn = (url: string) => Promise<{
+  ok: boolean;
+  json(): Promise<unknown>;
+}>;
+/** Minimal clock interface for injection / testing. */
+interface Clock {
+  now(): number;
+}
+//#endregion
+//#region src/JwksCache.d.ts
+type JoseKey = Awaited<ReturnType<typeof importJWK>>;
+/**
+ * Fetches and caches JWKS from a configured URL.
+ *
+ * On a `kid` cache miss the cache is refreshed once before failing —
+ * this handles key rotation without requiring a restart.
+ *
+ * Refresh-window jitter avoids thundering-herd stampedes when multiple
+ * workers share the same process lifetime.
+ */
+declare class JwksCache {
+  private readonly config;
+  private readonly fetch;
+  private readonly clock;
+  private cache;
+  constructor(config: JwksCacheConfig, fetch: FetchFn, clock: Clock);
+  /** Returns the cached key for `kid`, fetching if needed. Refreshes once on kid miss. */
+  getKey(kid: string): Promise<JoseKey | null>;
+  private getValidEntry;
+  private refresh;
+}
+//#endregion
+//#region src/ManagedJwtVerifier.d.ts
+type VerifyResult = VerifiedManagedPrincipal | JwtVerificationFailure;
+/**
+ * Validates CP-signed EdDSA JWT bearers.
+ *
+ * Checks: signature, `iss` matches expected, `aud` matches expected workspaceId,
+ * `exp`, `nbf`. Returns a `VerifiedManagedPrincipal` or a structured `JwtVerificationFailure`.
+ *
+ * Hono-independent — no web framework coupling.
+ */
+declare class ManagedJwtVerifier {
+  private readonly config;
+  private readonly jwksCache;
+  constructor(config: ManagedJwtVerifierConfig, jwksCache: JwksCache);
+  verify(token: string): Promise<VerifyResult>;
+}
+//#endregion
+export { type Clock, type FetchFn, JwksCache, type JwksCacheConfig, type JwtVerificationFailure, type JwtVerificationFailureReason, ManagedJwtVerifier, type ManagedJwtVerifierConfig, type VerifiedManagedPrincipal };
+//# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -0,0 +1,151 @@
+import { decodeProtectedHeader, errors, importJWK, jwtVerify } from "jose";
+
+//#region src/JwksCache.ts
+const DEFAULT_TTL_MS = 900 * 1e3;
+const DEFAULT_JITTER_MS = 60 * 1e3;
+/**
+* Fetches and caches JWKS from a configured URL.
+*
+* On a `kid` cache miss the cache is refreshed once before failing —
+* this handles key rotation without requiring a restart.
+*
+* Refresh-window jitter avoids thundering-herd stampedes when multiple
+* workers share the same process lifetime.
+*/
+var JwksCache = class {
+	cache = null;
+	constructor(config, fetch, clock) {
+		this.config = config;
+		this.fetch = fetch;
+		this.clock = clock;
+	}
+	/** Returns the cached key for `kid`, fetching if needed. Refreshes once on kid miss. */
+	async getKey(kid) {
+		let entry = await this.getValidEntry();
+		const cached = entry.keys.get(kid);
+		if (cached !== void 0) return cached;
+		entry = await this.refresh();
+		return entry.keys.get(kid) ?? null;
+	}
+	async getValidEntry() {
+		if (this.cache !== null && this.clock.now() < this.cache.expiresAt) return this.cache;
+		return this.refresh();
+	}
+	async refresh() {
+		const response = await this.fetch(this.config.jwksUrl);
+		if (!response.ok) throw new Error(`JWKS fetch failed for ${this.config.jwksUrl}`);
+		const body = await response.json();
+		const keys = /* @__PURE__ */ new Map();
+		for (const jwk of body.keys ?? []) {
+			if (!jwk.kid) continue;
+			try {
+				const key = await importJWK(jwk);
+				keys.set(jwk.kid, key);
+			} catch {}
+		}
+		const ttl = this.config.ttlMs ?? DEFAULT_TTL_MS;
+		const jitter = Math.random() * (this.config.jitterMs ?? DEFAULT_JITTER_MS);
+		const entry = {
+			keys,
+			expiresAt: this.clock.now() + ttl + jitter
+		};
+		this.cache = entry;
+		return entry;
+	}
+};
+
+//#endregion
+//#region src/ManagedJwtVerifier.ts
+/**
+* Validates CP-signed EdDSA JWT bearers.
+*
+* Checks: signature, `iss` matches expected, `aud` matches expected workspaceId,
+* `exp`, `nbf`. Returns a `VerifiedManagedPrincipal` or a structured `JwtVerificationFailure`.
+*
+* Hono-independent — no web framework coupling.
+*/
+var ManagedJwtVerifier = class {
+	constructor(config, jwksCache) {
+		this.config = config;
+		this.jwksCache = jwksCache;
+	}
+	async verify(token) {
+		let kid;
+		try {
+			const header = decodeProtectedHeader(token);
+			kid = typeof header.kid === "string" ? header.kid : void 0;
+		} catch {
+			return {
+				failure: "malformed",
+				message: "Unable to decode JWT header."
+			};
+		}
+		if (!kid) return {
+			failure: "missing-kid",
+			message: "JWT header is missing the `kid` field."
+		};
+		const key = await this.jwksCache.getKey(kid);
+		if (key === null) return {
+			failure: "unknown-kid",
+			message: `No key found for kid "${kid}" after JWKS refresh.`
+		};
+		try {
+			const { payload } = await jwtVerify(token, key, {
+				issuer: this.config.expectedIssuer,
+				audience: this.config.expectedAudience,
+				algorithms: ["EdDSA"]
+			});
+			const sub = payload.sub;
+			const aud = payload.aud;
+			const workspaceId = Array.isArray(aud) ? aud[0] : aud;
+			if (!sub || typeof sub !== "string") return {
+				failure: "malformed",
+				message: "JWT is missing the `sub` claim."
+			};
+			if (!workspaceId || typeof workspaceId !== "string") return {
+				failure: "wrong-aud",
+				message: "JWT `aud` claim is absent or not a string."
+			};
+			return {
+				userId: sub,
+				workspaceId
+			};
+		} catch (error) {
+			if (error instanceof errors.JWTExpired) return {
+				failure: "expired",
+				message: "JWT has expired."
+			};
+			if (error instanceof errors.JWTClaimValidationFailed) {
+				const claim = error.claim;
+				if (claim === "iss") return {
+					failure: "wrong-iss",
+					message: "JWT `iss` claim does not match expected issuer."
+				};
+				if (claim === "aud") return {
+					failure: "wrong-aud",
+					message: "JWT `aud` claim does not match expected audience."
+				};
+				if (claim === "nbf") return {
+					failure: "not-yet-valid",
+					message: "JWT is not yet valid (nbf check failed)."
+				};
+				return {
+					failure: "malformed",
+					message: `JWT claim validation failed: ${error.message}`
+				};
+			}
+			if (error instanceof errors.JWSSignatureVerificationFailed || error instanceof errors.JWSInvalid) return {
+				failure: "bad-signature",
+				message: "JWT signature verification failed."
+			};
+			return {
+				failure: "malformed",
+				message: "JWT verification failed."
+			};
+		}
+	}
+};
+
+//#endregion
+export { JwksCache, ManagedJwtVerifier };
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":["config: JwksCacheConfig","fetch: FetchFn","clock: Clock","entry: CacheEntry","config: ManagedJwtVerifierConfig","jwksCache: JwksCache","kid: string | undefined","joseErrors"],"sources":["../src/JwksCache.ts","../src/ManagedJwtVerifier.ts"],"sourcesContent":["import { importJWK } from \"jose\";\nimport type { Clock, FetchFn, JwksCacheConfig } from \"./types\";\n\nconst DEFAULT_TTL_MS = 15 * 60 * 1000; // 15 minutes\nconst DEFAULT_JITTER_MS = 60 * 1000; // 60 seconds\n\ntype JoseKey = Awaited<ReturnType<typeof importJWK>>;\n\ninterface CacheEntry {\n  keys: Map<string, JoseKey>;\n  expiresAt: number;\n}\n\ninterface JwkKey {\n  kid?: string;\n  kty?: string;\n  crv?: string;\n  x?: string;\n  use?: string;\n  alg?: string;\n}\n\ninterface JwksResponse {\n  keys: JwkKey[];\n}\n\n/**\n * Fetches and caches JWKS from a configured URL.\n *\n * On a `kid` cache miss the cache is refreshed once before failing —\n * this handles key rotation without requiring a restart.\n *\n * Refresh-window jitter avoids thundering-herd stampedes when multiple\n * workers share the same process lifetime.\n */\nexport class JwksCache {\n  private cache: CacheEntry | null = null;\n\n  constructor(\n    private readonly config: JwksCacheConfig,\n    private readonly fetch: FetchFn,\n    private readonly clock: Clock,\n  ) {}\n\n  /** Returns the cached key for `kid`, fetching if needed. Refreshes once on kid miss. */\n  async getKey(kid: string): Promise<JoseKey | null> {\n    let entry = await this.getValidEntry();\n    const cached = entry.keys.get(kid);\n    if (cached !== undefined) {\n      return cached;\n    }\n\n    // kid miss — refresh once to handle key rotation\n    entry = await this.refresh();\n    return entry.keys.get(kid) ?? null;\n  }\n\n  private async getValidEntry(): Promise<CacheEntry> {\n    if (this.cache !== null && this.clock.now() < this.cache.expiresAt) {\n      return this.cache;\n    }\n    return this.refresh();\n  }\n\n  private async refresh(): Promise<CacheEntry> {\n    const response = await this.fetch(this.config.jwksUrl);\n    if (!response.ok) {\n      throw new Error(`JWKS fetch failed for ${this.config.jwksUrl}`);\n    }\n    const body = (await response.json()) as JwksResponse;\n    const keys = new Map<string, JoseKey>();\n\n    for (const jwk of body.keys ?? []) {\n      if (!jwk.kid) continue;\n      try {\n        const key = await importJWK(jwk as Parameters<typeof importJWK>[0]);\n        keys.set(jwk.kid, key);\n      } catch {\n        // Skip malformed individual keys — don't fail the whole cache refresh\n      }\n    }\n\n    const ttl = this.config.ttlMs ?? DEFAULT_TTL_MS;\n    const jitter = Math.random() * (this.config.jitterMs ?? DEFAULT_JITTER_MS);\n    const entry: CacheEntry = {\n      keys,\n      expiresAt: this.clock.now() + ttl + jitter,\n    };\n    this.cache = entry;\n    return entry;\n  }\n}\n","import { decodeProtectedHeader, jwtVerify, errors as joseErrors } from \"jose\";\nimport type { JwtVerificationFailure, ManagedJwtVerifierConfig, VerifiedManagedPrincipal } from \"./types\";\nimport type { JwksCache } from \"./JwksCache\";\n\ntype VerifyResult = VerifiedManagedPrincipal | JwtVerificationFailure;\n\n/**\n * Validates CP-signed EdDSA JWT bearers.\n *\n * Checks: signature, `iss` matches expected, `aud` matches expected workspaceId,\n * `exp`, `nbf`. Returns a `VerifiedManagedPrincipal` or a structured `JwtVerificationFailure`.\n *\n * Hono-independent — no web framework coupling.\n */\nexport class ManagedJwtVerifier {\n  constructor(\n    private readonly config: ManagedJwtVerifierConfig,\n    private readonly jwksCache: JwksCache,\n  ) {}\n\n  async verify(token: string): Promise<VerifyResult> {\n    // Decode header to get kid before verifying signature\n    let kid: string | undefined;\n    try {\n      const header = decodeProtectedHeader(token);\n      kid = typeof header.kid === \"string\" ? header.kid : undefined;\n    } catch {\n      return { failure: \"malformed\", message: \"Unable to decode JWT header.\" };\n    }\n\n    if (!kid) {\n      return { failure: \"missing-kid\", message: \"JWT header is missing the `kid` field.\" };\n    }\n\n    const key = await this.jwksCache.getKey(kid);\n    if (key === null) {\n      return { failure: \"unknown-kid\", message: `No key found for kid \"${kid}\" after JWKS refresh.` };\n    }\n\n    try {\n      const { payload } = await jwtVerify(token, key, {\n        issuer: this.config.expectedIssuer,\n        audience: this.config.expectedAudience,\n        algorithms: [\"EdDSA\"],\n      });\n\n      const sub = payload.sub;\n      const aud = payload.aud;\n      const workspaceId = Array.isArray(aud) ? aud[0] : aud;\n\n      if (!sub || typeof sub !== \"string\") {\n        return { failure: \"malformed\", message: \"JWT is missing the `sub` claim.\" };\n      }\n      if (!workspaceId || typeof workspaceId !== \"string\") {\n        return { failure: \"wrong-aud\", message: \"JWT `aud` claim is absent or not a string.\" };\n      }\n\n      return { userId: sub, workspaceId };\n    } catch (error) {\n      if (error instanceof joseErrors.JWTExpired) {\n        return { failure: \"expired\", message: \"JWT has expired.\" };\n      }\n      if (error instanceof joseErrors.JWTClaimValidationFailed) {\n        const claim = error.claim;\n        if (claim === \"iss\") {\n          return { failure: \"wrong-iss\", message: \"JWT `iss` claim does not match expected issuer.\" };\n        }\n        if (claim === \"aud\") {\n          return { failure: \"wrong-aud\", message: \"JWT `aud` claim does not match expected audience.\" };\n        }\n        if (claim === \"nbf\") {\n          return { failure: \"not-yet-valid\", message: \"JWT is not yet valid (nbf check failed).\" };\n        }\n        return { failure: \"malformed\", message: `JWT claim validation failed: ${error.message}` };\n      }\n      if (error instanceof joseErrors.JWSSignatureVerificationFailed || error instanceof joseErrors.JWSInvalid) {\n        return { failure: \"bad-signature\", message: \"JWT signature verification failed.\" };\n      }\n      return { failure: \"malformed\", message: \"JWT verification failed.\" };\n    }\n  }\n}\n"],"mappings":";;;AAGA,MAAM,iBAAiB,MAAU;AACjC,MAAM,oBAAoB,KAAK;;;;;;;;;;AA+B/B,IAAa,YAAb,MAAuB;CACrB,AAAQ,QAA2B;CAEnC,YACE,AAAiBA,QACjB,AAAiBC,OACjB,AAAiBC,OACjB;EAHiB;EACA;EACA;;;CAInB,MAAM,OAAO,KAAsC;EACjD,IAAI,QAAQ,MAAM,KAAK,eAAe;EACtC,MAAM,SAAS,MAAM,KAAK,IAAI,IAAI;AAClC,MAAI,WAAW,OACb,QAAO;AAIT,UAAQ,MAAM,KAAK,SAAS;AAC5B,SAAO,MAAM,KAAK,IAAI,IAAI,IAAI;;CAGhC,MAAc,gBAAqC;AACjD,MAAI,KAAK,UAAU,QAAQ,KAAK,MAAM,KAAK,GAAG,KAAK,MAAM,UACvD,QAAO,KAAK;AAEd,SAAO,KAAK,SAAS;;CAGvB,MAAc,UAA+B;EAC3C,MAAM,WAAW,MAAM,KAAK,MAAM,KAAK,OAAO,QAAQ;AACtD,MAAI,CAAC,SAAS,GACZ,OAAM,IAAI,MAAM,yBAAyB,KAAK,OAAO,UAAU;EAEjE,MAAM,OAAQ,MAAM,SAAS,MAAM;EACnC,MAAM,uBAAO,IAAI,KAAsB;AAEvC,OAAK,MAAM,OAAO,KAAK,QAAQ,EAAE,EAAE;AACjC,OAAI,CAAC,IAAI,IAAK;AACd,OAAI;IACF,MAAM,MAAM,MAAM,UAAU,IAAuC;AACnE,SAAK,IAAI,IAAI,KAAK,IAAI;WAChB;;EAKV,MAAM,MAAM,KAAK,OAAO,SAAS;EACjC,MAAM,SAAS,KAAK,QAAQ,IAAI,KAAK,OAAO,YAAY;EACxD,MAAMC,QAAoB;GACxB;GACA,WAAW,KAAK,MAAM,KAAK,GAAG,MAAM;GACrC;AACD,OAAK,QAAQ;AACb,SAAO;;;;;;;;;;;;;;AC3EX,IAAa,qBAAb,MAAgC;CAC9B,YACE,AAAiBC,QACjB,AAAiBC,WACjB;EAFiB;EACA;;CAGnB,MAAM,OAAO,OAAsC;EAEjD,IAAIC;AACJ,MAAI;GACF,MAAM,SAAS,sBAAsB,MAAM;AAC3C,SAAM,OAAO,OAAO,QAAQ,WAAW,OAAO,MAAM;UAC9C;AACN,UAAO;IAAE,SAAS;IAAa,SAAS;IAAgC;;AAG1E,MAAI,CAAC,IACH,QAAO;GAAE,SAAS;GAAe,SAAS;GAA0C;EAGtF,MAAM,MAAM,MAAM,KAAK,UAAU,OAAO,IAAI;AAC5C,MAAI,QAAQ,KACV,QAAO;GAAE,SAAS;GAAe,SAAS,yBAAyB,IAAI;GAAwB;AAGjG,MAAI;GACF,MAAM,EAAE,YAAY,MAAM,UAAU,OAAO,KAAK;IAC9C,QAAQ,KAAK,OAAO;IACpB,UAAU,KAAK,OAAO;IACtB,YAAY,CAAC,QAAQ;IACtB,CAAC;GAEF,MAAM,MAAM,QAAQ;GACpB,MAAM,MAAM,QAAQ;GACpB,MAAM,cAAc,MAAM,QAAQ,IAAI,GAAG,IAAI,KAAK;AAElD,OAAI,CAAC,OAAO,OAAO,QAAQ,SACzB,QAAO;IAAE,SAAS;IAAa,SAAS;IAAmC;AAE7E,OAAI,CAAC,eAAe,OAAO,gBAAgB,SACzC,QAAO;IAAE,SAAS;IAAa,SAAS;IAA8C;AAGxF,UAAO;IAAE,QAAQ;IAAK;IAAa;WAC5B,OAAO;AACd,OAAI,iBAAiBC,OAAW,WAC9B,QAAO;IAAE,SAAS;IAAW,SAAS;IAAoB;AAE5D,OAAI,iBAAiBA,OAAW,0BAA0B;IACxD,MAAM,QAAQ,MAAM;AACpB,QAAI,UAAU,MACZ,QAAO;KAAE,SAAS;KAAa,SAAS;KAAmD;AAE7F,QAAI,UAAU,MACZ,QAAO;KAAE,SAAS;KAAa,SAAS;KAAqD;AAE/F,QAAI,UAAU,MACZ,QAAO;KAAE,SAAS;KAAiB,SAAS;KAA4C;AAE1F,WAAO;KAAE,SAAS;KAAa,SAAS,gCAAgC,MAAM;KAAW;;AAE3F,OAAI,iBAAiBA,OAAW,kCAAkC,iBAAiBA,OAAW,WAC5F,QAAO;IAAE,SAAS;IAAiB,SAAS;IAAsC;AAEpF,UAAO;IAAE,SAAS;IAAa,SAAS;IAA4B"}

package/package.json

@@ -0,0 +1,48 @@
+{
+  "name": "@codemation/managed-auth",
+  "version": "0.1.0",
+  "publishConfig": {
+    "access": "public"
+  },
+  "author": "Made Relevant B.V.",
+  "homepage": "https://www.maderelevant.com",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/MadeRelevant/codemation",
+    "directory": "packages/managed-auth"
+  },
+  "license": "SEE LICENSE IN LICENSE",
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "development": {
+        "import": "./src/index.ts",
+        "require": "./dist/index.cjs"
+      },
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    }
+  },
+  "dependencies": {
+    "jose": "^6.0.10"
+  },
+  "devDependencies": {
+    "@types/node": "^25.3.5",
+    "eslint": "^10.0.3",
+    "tsdown": "^0.15.5",
+    "typescript": "^5.9.3",
+    "vitest": "^3.1.4"
+  },
+  "scripts": {
+    "changeset:verify": "pnpm --workspace-root run changeset:verify",
+    "dev": "tsdown --watch",
+    "build": "tsdown",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "lint": "eslint .",
+    "test:unit": "vitest run --passWithNoTests"
+  }
+}

package/src/JwksCache.ts

@@ -0,0 +1,92 @@
+import { importJWK } from "jose";
+import type { Clock, FetchFn, JwksCacheConfig } from "./types";
+
+const DEFAULT_TTL_MS = 15 * 60 * 1000; // 15 minutes
+const DEFAULT_JITTER_MS = 60 * 1000; // 60 seconds
+
+type JoseKey = Awaited<ReturnType<typeof importJWK>>;
+
+interface CacheEntry {
+  keys: Map<string, JoseKey>;
+  expiresAt: number;
+}
+
+interface JwkKey {
+  kid?: string;
+  kty?: string;
+  crv?: string;
+  x?: string;
+  use?: string;
+  alg?: string;
+}
+
+interface JwksResponse {
+  keys: JwkKey[];
+}
+
+/**
+ * Fetches and caches JWKS from a configured URL.
+ *
+ * On a `kid` cache miss the cache is refreshed once before failing —
+ * this handles key rotation without requiring a restart.
+ *
+ * Refresh-window jitter avoids thundering-herd stampedes when multiple
+ * workers share the same process lifetime.
+ */
+export class JwksCache {
+  private cache: CacheEntry | null = null;
+
+  constructor(
+    private readonly config: JwksCacheConfig,
+    private readonly fetch: FetchFn,
+    private readonly clock: Clock,
+  ) {}
+
+  /** Returns the cached key for `kid`, fetching if needed. Refreshes once on kid miss. */
+  async getKey(kid: string): Promise<JoseKey | null> {
+    let entry = await this.getValidEntry();
+    const cached = entry.keys.get(kid);
+    if (cached !== undefined) {
+      return cached;
+    }
+
+    // kid miss — refresh once to handle key rotation
+    entry = await this.refresh();
+    return entry.keys.get(kid) ?? null;
+  }
+
+  private async getValidEntry(): Promise<CacheEntry> {
+    if (this.cache !== null && this.clock.now() < this.cache.expiresAt) {
+      return this.cache;
+    }
+    return this.refresh();
+  }
+
+  private async refresh(): Promise<CacheEntry> {
+    const response = await this.fetch(this.config.jwksUrl);
+    if (!response.ok) {
+      throw new Error(`JWKS fetch failed for ${this.config.jwksUrl}`);
+    }
+    const body = (await response.json()) as JwksResponse;
+    const keys = new Map<string, JoseKey>();
+
+    for (const jwk of body.keys ?? []) {
+      if (!jwk.kid) continue;
+      try {
+        const key = await importJWK(jwk as Parameters<typeof importJWK>[0]);
+        keys.set(jwk.kid, key);
+      } catch {
+        // Skip malformed individual keys — don't fail the whole cache refresh
+      }
+    }
+
+    const ttl = this.config.ttlMs ?? DEFAULT_TTL_MS;
+    const jitter = Math.random() * (this.config.jitterMs ?? DEFAULT_JITTER_MS);
+    const entry: CacheEntry = {
+      keys,
+      expiresAt: this.clock.now() + ttl + jitter,
+    };
+    this.cache = entry;
+    return entry;
+  }
+}

package/src/ManagedJwtVerifier.ts

@@ -0,0 +1,82 @@
+import { decodeProtectedHeader, jwtVerify, errors as joseErrors } from "jose";
+import type { JwtVerificationFailure, ManagedJwtVerifierConfig, VerifiedManagedPrincipal } from "./types";
+import type { JwksCache } from "./JwksCache";
+
+type VerifyResult = VerifiedManagedPrincipal | JwtVerificationFailure;
+
+/**
+ * Validates CP-signed EdDSA JWT bearers.
+ *
+ * Checks: signature, `iss` matches expected, `aud` matches expected workspaceId,
+ * `exp`, `nbf`. Returns a `VerifiedManagedPrincipal` or a structured `JwtVerificationFailure`.
+ *
+ * Hono-independent — no web framework coupling.
+ */
+export class ManagedJwtVerifier {
+  constructor(
+    private readonly config: ManagedJwtVerifierConfig,
+    private readonly jwksCache: JwksCache,
+  ) {}
+
+  async verify(token: string): Promise<VerifyResult> {
+    // Decode header to get kid before verifying signature
+    let kid: string | undefined;
+    try {
+      const header = decodeProtectedHeader(token);
+      kid = typeof header.kid === "string" ? header.kid : undefined;
+    } catch {
+      return { failure: "malformed", message: "Unable to decode JWT header." };
+    }
+
+    if (!kid) {
+      return { failure: "missing-kid", message: "JWT header is missing the `kid` field." };
+    }
+
+    const key = await this.jwksCache.getKey(kid);
+    if (key === null) {
+      return { failure: "unknown-kid", message: `No key found for kid "${kid}" after JWKS refresh.` };
+    }
+
+    try {
+      const { payload } = await jwtVerify(token, key, {
+        issuer: this.config.expectedIssuer,
+        audience: this.config.expectedAudience,
+        algorithms: ["EdDSA"],
+      });
+
+      const sub = payload.sub;
+      const aud = payload.aud;
+      const workspaceId = Array.isArray(aud) ? aud[0] : aud;
+
+      if (!sub || typeof sub !== "string") {
+        return { failure: "malformed", message: "JWT is missing the `sub` claim." };
+      }
+      if (!workspaceId || typeof workspaceId !== "string") {
+        return { failure: "wrong-aud", message: "JWT `aud` claim is absent or not a string." };
+      }
+
+      return { userId: sub, workspaceId };
+    } catch (error) {
+      if (error instanceof joseErrors.JWTExpired) {
+        return { failure: "expired", message: "JWT has expired." };
+      }
+      if (error instanceof joseErrors.JWTClaimValidationFailed) {
+        const claim = error.claim;
+        if (claim === "iss") {
+          return { failure: "wrong-iss", message: "JWT `iss` claim does not match expected issuer." };
+        }
+        if (claim === "aud") {
+          return { failure: "wrong-aud", message: "JWT `aud` claim does not match expected audience." };
+        }
+        if (claim === "nbf") {
+          return { failure: "not-yet-valid", message: "JWT is not yet valid (nbf check failed)." };
+        }
+        return { failure: "malformed", message: `JWT claim validation failed: ${error.message}` };
+      }
+      if (error instanceof joseErrors.JWSSignatureVerificationFailed || error instanceof joseErrors.JWSInvalid) {
+        return { failure: "bad-signature", message: "JWT signature verification failed." };
+      }
+      return { failure: "malformed", message: "JWT verification failed." };
+    }
+  }
+}

package/src/index.ts

@@ -0,0 +1,11 @@
+export { JwksCache } from "./JwksCache";
+export { ManagedJwtVerifier } from "./ManagedJwtVerifier";
+export type {
+  Clock,
+  FetchFn,
+  JwksCacheConfig,
+  JwtVerificationFailure,
+  JwtVerificationFailureReason,
+  ManagedJwtVerifierConfig,
+  VerifiedManagedPrincipal,
+} from "./types";

package/src/types.ts

@@ -0,0 +1,49 @@
+/**
+ * A successfully verified CP-signed JWT principal.
+ * `userId` maps to the JWT `sub` claim; `workspaceId` maps to `aud`.
+ */
+export interface VerifiedManagedPrincipal {
+  readonly userId: string;
+  readonly workspaceId: string;
+}
+
+export type JwtVerificationFailureReason =
+  | "missing-kid"
+  | "unknown-kid"
+  | "bad-signature"
+  | "wrong-iss"
+  | "wrong-aud"
+  | "expired"
+  | "not-yet-valid"
+  | "malformed";
+
+/** Structured failure returned instead of throwing, so callers can map to HTTP status codes cleanly. */
+export interface JwtVerificationFailure {
+  readonly failure: JwtVerificationFailureReason;
+  readonly message: string;
+}
+
+export interface JwksCacheConfig {
+  /** URL to the JWKS endpoint (e.g. https://cp.example.com/.well-known/jwks.json). */
+  readonly jwksUrl: string;
+  /** TTL in milliseconds before the cache is considered stale. Defaults to 15 minutes. */
+  readonly ttlMs?: number;
+  /** Jitter window in milliseconds applied to TTL to avoid stampedes. Defaults to 60 seconds. */
+  readonly jitterMs?: number;
+}
+
+export interface ManagedJwtVerifierConfig {
+  /** Expected value of the JWT `iss` claim — must exactly match. */
+  readonly expectedIssuer: string;
+  /** Expected `aud` claim — must exactly match the workspace ID. */
+  readonly expectedAudience: string;
+  readonly jwksCache: JwksCacheConfig;
+}
+
+/** Minimal fetch-compatible function type for injection / testing. */
+export type FetchFn = (url: string) => Promise<{ ok: boolean; json(): Promise<unknown> }>;
+
+/** Minimal clock interface for injection / testing. */
+export interface Clock {
+  now(): number;
+}

package/test/JwksCache.test.ts

@@ -0,0 +1,137 @@
+import { generateKeyPair, exportJWK } from "jose";
+import { describe, it, expect, beforeAll } from "vitest";
+import { JwksCache } from "../src/JwksCache.js";
+import type { Clock, FetchFn } from "../src/types.js";
+
+interface FakeJwkKey {
+  kid: string;
+  kty: string;
+  crv?: string;
+  x?: string;
+  d?: string;
+  use?: string;
+  alg?: string;
+}
+
+function makeClock(nowMs = 0): Clock {
+  let current = nowMs;
+  return {
+    now: () => current,
+    advance(ms: number) {
+      current += ms;
+    },
+  } as Clock & { advance(ms: number): void };
+}
+
+describe("JwksCache", () => {
+  let edKey1: FakeJwkKey;
+  let edKey2: FakeJwkKey;
+
+  beforeAll(async () => {
+    const kp1 = await generateKeyPair("EdDSA");
+    const pub1 = await exportJWK(kp1.publicKey);
+    edKey1 = { kid: "key-1", kty: pub1.kty!, crv: pub1.crv, x: pub1.x, use: "sig", alg: "EdDSA" };
+
+    const kp2 = await generateKeyPair("EdDSA");
+    const pub2 = await exportJWK(kp2.publicKey);
+    edKey2 = { kid: "key-2", kty: pub2.kty!, crv: pub2.crv, x: pub2.x, use: "sig", alg: "EdDSA" };
+  });
+
+  it("fetches keys on cold start and returns the key for a known kid", async () => {
+    const responses = new Map([["/jwks", [edKey1]]]);
+    let callCount = 0;
+    const fetch: FetchFn = async (url) => {
+      callCount++;
+      return { ok: true, json: async () => ({ keys: responses.get(url) ?? [] }) };
+    };
+    const cache = new JwksCache({ jwksUrl: "/jwks", ttlMs: 60_000, jitterMs: 0 }, fetch, makeClock());
+
+    const key = await cache.getKey("key-1");
+    expect(key).not.toBeNull();
+    expect(callCount).toBe(1);
+  });
+
+  it("returns the cached key on a subsequent hit without re-fetching", async () => {
+    let callCount = 0;
+    const fetch: FetchFn = async () => {
+      callCount++;
+      return { ok: true, json: async () => ({ keys: [edKey1] }) };
+    };
+    const clock = makeClock(0) as ReturnType<typeof makeClock> & { advance(ms: number): void };
+    (clock as unknown as { advance(ms: number): void }).advance = (ms: number) => {
+      (clock as unknown as { _now: number })._now = ((clock as unknown as { _now: number })._now ?? 0) + ms;
+    };
+
+    // Use a simple advancing clock
+    let now = 0;
+    const advancingClock: Clock = { now: () => now };
+
+    const cache = new JwksCache({ jwksUrl: "/jwks", ttlMs: 60_000, jitterMs: 0 }, fetch, advancingClock);
+
+    await cache.getKey("key-1");
+    now += 30_000; // advance 30s — still within TTL
+    await cache.getKey("key-1");
+
+    expect(callCount).toBe(1); // no second fetch
+  });
+
+  it("re-fetches after TTL expires", async () => {
+    let callCount = 0;
+    const fetch: FetchFn = async () => {
+      callCount++;
+      return { ok: true, json: async () => ({ keys: [edKey1] }) };
+    };
+
+    let now = 0;
+    const clock: Clock = { now: () => now };
+
+    const cache = new JwksCache({ jwksUrl: "/jwks", ttlMs: 60_000, jitterMs: 0 }, fetch, clock);
+
+    await cache.getKey("key-1");
+    now += 61_000; // past TTL
+    await cache.getKey("key-1");
+
+    expect(callCount).toBe(2);
+  });
+
+  it("refreshes once on kid miss and returns the new key", async () => {
+    let callCount = 0;
+    // First fetch has only key-1; second has key-1 and key-2
+    const fetch: FetchFn = async () => {
+      callCount++;
+      const keys = callCount === 1 ? [edKey1] : [edKey1, edKey2];
+      return { ok: true, json: async () => ({ keys }) };
+    };
+    const clock: Clock = { now: () => 0 };
+    const cache = new JwksCache({ jwksUrl: "/jwks", ttlMs: 60_000, jitterMs: 0 }, fetch, clock);
+
+    // Populate cache with just key-1
+    await cache.getKey("key-1");
+    expect(callCount).toBe(1);
+
+    // Ask for key-2 — cache miss triggers one refresh
+    const key = await cache.getKey("key-2");
+    expect(key).not.toBeNull();
+    expect(callCount).toBe(2);
+  });
+
+  it("returns null after refresh when kid is still unknown", async () => {
+    const fetch: FetchFn = async () => ({
+      ok: true,
+      json: async () => ({ keys: [edKey1] }),
+    });
+    const clock: Clock = { now: () => 0 };
+    const cache = new JwksCache({ jwksUrl: "/jwks", ttlMs: 60_000, jitterMs: 0 }, fetch, clock);
+
+    const key = await cache.getKey("unknown-kid");
+    expect(key).toBeNull();
+  });
+
+  it("propagates fetch errors", async () => {
+    const fetch: FetchFn = async () => ({ ok: false, json: async () => ({}) });
+    const clock: Clock = { now: () => 0 };
+    const cache = new JwksCache({ jwksUrl: "/jwks" }, fetch, clock);
+
+    await expect(cache.getKey("any")).rejects.toThrow("JWKS fetch failed");
+  });
+});

package/test/ManagedJwtVerifier.test.ts

@@ -0,0 +1,225 @@
+import { generateKeyPair, exportJWK, SignJWT } from "jose";
+import { describe, it, expect, beforeAll } from "vitest";
+import { JwksCache } from "../src/JwksCache.js";
+import { ManagedJwtVerifier } from "../src/ManagedJwtVerifier.js";
+import type { Clock, FetchFn } from "../src/types.js";
+
+const ISSUER = "https://cp.example.com";
+const WORKSPACE_ID = "ws-abc123";
+
+interface JwkPublicKey {
+  kid: string;
+  kty: string;
+  crv?: string;
+  x?: string;
+  use?: string;
+  alg?: string;
+}
+
+interface TestKeyPair {
+  privateKey: Awaited<ReturnType<typeof generateKeyPair>>["privateKey"];
+  publicKey: Awaited<ReturnType<typeof generateKeyPair>>["publicKey"];
+  jwk: JwkPublicKey;
+}
+
+async function generateEd25519Pair(kid: string): Promise<TestKeyPair> {
+  const { privateKey, publicKey } = await generateKeyPair("EdDSA");
+  const pub = await exportJWK(publicKey);
+  return {
+    privateKey,
+    publicKey,
+    jwk: { kid, kty: pub.kty!, crv: pub.crv, x: pub.x, use: "sig", alg: "EdDSA" },
+  };
+}
+
+function makeStaticFetch(keys: JwkPublicKey[]): FetchFn {
+  return async () => ({
+    ok: true,
+    json: async () => ({ keys }),
+  });
+}
+
+function makeFrozenClock(): Clock {
+  return { now: () => 0 };
+}
+
+// Deterministic timestamps: use fixed calendar dates rather than Date.now().
+// exp far in the future (2099) — always valid by the real clock.
+// Expired exp: a date in the past (2000).
+// Future nbf: a date in the distant future (2099).
+const EXP_FUTURE_UNIX = Math.floor(new Date("2099-12-31T00:00:00Z").getTime() / 1000);
+const EXP_PAST_UNIX = Math.floor(new Date("2000-01-01T00:00:00Z").getTime() / 1000);
+const NBF_PAST_UNIX = Math.floor(new Date("2000-01-01T00:00:00Z").getTime() / 1000);
+const NBF_FUTURE_UNIX = Math.floor(new Date("2099-12-31T00:00:00Z").getTime() / 1000);
+
+async function makeToken(
+  privateKey: Awaited<ReturnType<typeof generateKeyPair>>["privateKey"],
+  kid: string,
+  overrides: Partial<{
+    iss: string;
+    aud: string;
+    sub: string;
+    expired: boolean;
+    notYetValid: boolean;
+  }> = {},
+): Promise<string> {
+  const exp = overrides.expired === true ? EXP_PAST_UNIX : EXP_FUTURE_UNIX;
+  const nbf = overrides.notYetValid === true ? NBF_FUTURE_UNIX : NBF_PAST_UNIX;
+
+  return new SignJWT({ sub: overrides.sub ?? "user-42" })
+    .setProtectedHeader({ alg: "EdDSA", kid })
+    .setIssuer(overrides.iss ?? ISSUER)
+    .setAudience(overrides.aud ?? WORKSPACE_ID)
+    .setExpirationTime(exp)
+    .setNotBefore(nbf)
+    .sign(privateKey);
+}
+
+function makeVerifier(keys: JwkPublicKey[]): ManagedJwtVerifier {
+  const cache = new JwksCache(
+    { jwksUrl: "/jwks", ttlMs: 60_000, jitterMs: 0 },
+    makeStaticFetch(keys),
+    makeFrozenClock(),
+  );
+  return new ManagedJwtVerifier(
+    { expectedIssuer: ISSUER, expectedAudience: WORKSPACE_ID, jwksCache: { jwksUrl: "/jwks" } },
+    cache,
+  );
+}
+
+describe("ManagedJwtVerifier", () => {
+  let kp1: TestKeyPair;
+  let kp2: TestKeyPair;
+
+  beforeAll(async () => {
+    kp1 = await generateEd25519Pair("key-1");
+    kp2 = await generateEd25519Pair("key-2");
+  });
+
+  it("returns VerifiedManagedPrincipal for a valid token", async () => {
+    const verifier = makeVerifier([kp1.jwk]);
+    const token = await makeToken(kp1.privateKey, "key-1");
+    const result = await verifier.verify(token);
+    expect("failure" in result).toBe(false);
+    if (!("failure" in result)) {
+      expect(result.userId).toBe("user-42");
+      expect(result.workspaceId).toBe(WORKSPACE_ID);
+    }
+  });
+
+  it("fails with bad-signature for a tampered token", async () => {
+    const verifier = makeVerifier([kp1.jwk]);
+    const token = await makeToken(kp1.privateKey, "key-1");
+    const parts = token.split(".");
+    // Tamper the payload
+    const tampered = `${parts[0]}.${parts[1]}X.${parts[2]}`;
+    const result = await verifier.verify(tampered);
+    expect("failure" in result).toBe(true);
+    if ("failure" in result) {
+      expect(["bad-signature", "malformed"]).toContain(result.failure);
+    }
+  });
+
+  it("fails with wrong-aud for a token targeting a different workspace", async () => {
+    const verifier = makeVerifier([kp1.jwk]);
+    const token = await makeToken(kp1.privateKey, "key-1", { aud: "ws-other" });
+    const result = await verifier.verify(token);
+    expect("failure" in result).toBe(true);
+    if ("failure" in result) {
+      expect(result.failure).toBe("wrong-aud");
+    }
+  });
+
+  it("fails with wrong-iss for a token from a different issuer", async () => {
+    const verifier = makeVerifier([kp1.jwk]);
+    const token = await makeToken(kp1.privateKey, "key-1", { iss: "https://evil.example.com" });
+    const result = await verifier.verify(token);
+    expect("failure" in result).toBe(true);
+    if ("failure" in result) {
+      expect(result.failure).toBe("wrong-iss");
+    }
+  });
+
+  it("fails with expired for an expired token", async () => {
+    const verifier = makeVerifier([kp1.jwk]);
+    const token = await makeToken(kp1.privateKey, "key-1", { expired: true });
+    const result = await verifier.verify(token);
+    expect("failure" in result).toBe(true);
+    if ("failure" in result) {
+      expect(result.failure).toBe("expired");
+    }
+  });
+
+  it("fails with not-yet-valid for a future token", async () => {
+    const verifier = makeVerifier([kp1.jwk]);
+    const token = await makeToken(kp1.privateKey, "key-1", { notYetValid: true });
+    const result = await verifier.verify(token);
+    expect("failure" in result).toBe(true);
+    if ("failure" in result) {
+      expect(result.failure).toBe("not-yet-valid");
+    }
+  });
+
+  it("fails with missing-kid when header has no kid field", async () => {
+    const verifier = makeVerifier([kp1.jwk]);
+    // Build a token without kid in header using deterministic timestamps
+    const token = await new SignJWT({ sub: "user-1" })
+      .setProtectedHeader({ alg: "EdDSA" }) // no kid
+      .setIssuer(ISSUER)
+      .setAudience(WORKSPACE_ID)
+      .setExpirationTime(EXP_FUTURE_UNIX)
+      .setNotBefore(NBF_PAST_UNIX)
+      .sign(kp1.privateKey);
+    const result = await verifier.verify(token);
+    expect("failure" in result).toBe(true);
+    if ("failure" in result) {
+      expect(result.failure).toBe("missing-kid");
+    }
+  });
+
+  it("fails with unknown-kid after refresh when kid is not in JWKS", async () => {
+    const verifier = makeVerifier([kp1.jwk]);
+    // Token signed with key-2 but JWKS only has key-1 (even after refresh)
+    const token = await makeToken(kp2.privateKey, "key-2");
+    const result = await verifier.verify(token);
+    expect("failure" in result).toBe(true);
+    if ("failure" in result) {
+      expect(result.failure).toBe("unknown-kid");
+    }
+  });
+
+  it("accepts a new-key token after CP rotates keys (kid appears on refresh)", async () => {
+    // First JWKS response has only key-1; second response (on kid miss) adds key-2
+    let callCount = 0;
+    const fetch: FetchFn = async () => {
+      callCount++;
+      const keys = callCount === 1 ? [kp1.jwk] : [kp1.jwk, kp2.jwk];
+      return { ok: true, json: async () => ({ keys }) };
+    };
+    const cache = new JwksCache({ jwksUrl: "/jwks", ttlMs: 60_000, jitterMs: 0 }, fetch, { now: () => 0 });
+    const verifier = new ManagedJwtVerifier(
+      { expectedIssuer: ISSUER, expectedAudience: WORKSPACE_ID, jwksCache: { jwksUrl: "/jwks" } },
+      cache,
+    );
+
+    // Warm the cache with key-1 only
+    await cache.getKey("key-1");
+
+    // Now verify a token using key-2 — should trigger refresh and succeed
+    const token = await makeToken(kp2.privateKey, "key-2");
+    const result = await verifier.verify(token);
+    expect("failure" in result).toBe(false);
+    if (!("failure" in result)) {
+      expect(result.userId).toBe("user-42");
+    }
+  });
+
+  it("fails with malformed for a completely invalid token string", async () => {
+    const verifier = makeVerifier([kp1.jwk]);
+    const result = await verifier.verify("not.a.jwt");
+    expect("failure" in result).toBe(true);
+    if ("failure" in result) {
+      expect(["malformed", "missing-kid", "unknown-kid", "bad-signature"]).toContain(result.failure);
+    }
+  });
+});

package/tsconfig.json

@@ -0,0 +1,9 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "lib": ["ES2022"],
+    "types": ["node"],
+    "noEmit": true
+  },
+  "include": ["src/**/*.ts", "test/**/*.ts"]
+}

package/tsdown.config.ts

@@ -0,0 +1,11 @@
+import { defineConfig } from "tsdown";
+
+export default defineConfig({
+  entry: "src/index.ts",
+  outDir: "dist",
+  clean: false,
+  dts: true,
+  format: ["esm", "cjs"],
+  platform: "neutral",
+  sourcemap: true,
+});

package/vitest.config.ts

@@ -0,0 +1,15 @@
+import { defineConfig } from "vitest/config";
+
+export default defineConfig({
+  test: {
+    name: "@codemation/managed-auth",
+    root: import.meta.dirname,
+    environment: "node",
+    include: ["test/**/*.test.ts"],
+    pool: "threads",
+    testTimeout: 30_000,
+  },
+  resolve: {
+    conditions: ["development", "import", "module", "default"],
+  },
+});