@kohaku-ui/authz-jwt 0.0.0-bootstrap.0 → 0.4.0

package/CHANGELOG.md

@@ -0,0 +1,75 @@
+# @kohaku-ui/authz-jwt
+
+## 0.4.0
+
+### Patch Changes
+
+- Updated dependencies [[`cc17b7b`](https://github.com/yosuque/kohaku/commit/cc17b7bc3c96e49b1b74197ac20cd7a3d8ee0b47), [`730e625`](https://github.com/yosuque/kohaku/commit/730e62584b249056078792f6f646019cb225b049), [`730e625`](https://github.com/yosuque/kohaku/commit/730e62584b249056078792f6f646019cb225b049), [`730e625`](https://github.com/yosuque/kohaku/commit/730e62584b249056078792f6f646019cb225b049), [`5d167cb`](https://github.com/yosuque/kohaku/commit/5d167cb386cc1f91102644f8a99bd5b5c2949ce0)]:
+  - @kohaku-ui/spec-core@0.4.0
+  - @kohaku-ui/authz-hmac@0.4.0
+
+## 0.3.0
+
+### Minor Changes
+
+- [#32](https://github.com/yosuque/kohaku/pull/32) [`244136c`](https://github.com/yosuque/kohaku/commit/244136c70cb1875c084589c7640ee3fbb3880f4c) Thanks [@yosuque](https://github.com/yosuque)! - Hardens capability revocation and JWT identity resolution, and closes a fail-open gap where a revocation-store
+  outage surfaced as an unhandled raw failure instead of a client-safe, observed one.
+  
+  `@kohaku-ui/authz-hmac`'s `verify` now evaluates the requested scope before consulting the revocation store
+  (an out-of-scope request no longer pays for a store round trip), and a store rejection propagates as a thrown
+  error rather than being silently swallowed — per `AuthzPort.verify`'s doc comment (`@kohaku-ui/spec-core`'s
+  `ports.ts`): verify throws only on infrastructure failure, and a thrown verify is fail-closed, mapped by the
+  host to a 5xx. `revokeCapability` now returns `{ ok: true, alreadyExpired: true }` for an already-expired
+  token (idempotent success, not a failure) and a coded `"STORE_ERROR"` (instead of throwing) when the
+  revocation store itself fails. Expiry is now `exp <= now` consistently across `verify`, `revokeCapability`,
+  and the memory store's own sweep (previously `verify`/`revokeCapability` used `exp < now`, off by one second
+  at the boundary from the memory store). New `HmacAuthzOptions.requireJti` (default `false`) rejects a
+  capability token with no `jti` claim once a fleet has fully rolled onto a `jti`-issuing version.
+  
+  `@kohaku-ui/authz-jwt`'s `createJwtIdentityResolver` (and `createJwtAuthzPort`, which constructs one) now
+  validates its configuration at construction: `audience` is required when `key` is `jwks` or `jwksUrl` (stays
+  optional for `secret`); an HS256 `key.secret` must be at least 32 bytes; a `jwksUrl` must use `https:` unless
+  the host is `localhost` / `127.0.0.1` / `::1`. New `requireTenant` option (default `false`) rejects a token
+  with no (or an empty) tenant claim as `JwtIdentityError({ code: "MISSING_TENANT" })` instead of silently
+  widening scope to "no tenant" (only applies to the default claim mapping).
+  
+  `@kohaku-ui/host-core` adds `verifyCapabilitySafely(authz, token, req, onFailure)` (alongside the existing
+  `issueSpecCapabilitySafely`): calls `authz.verify` and returns a discriminated
+  `{ kind: "verdict"; verdict } | { kind: "unavailable"; error }` instead of letting a thrown `verify`
+  propagate, plus the shared `CAPABILITY_VERIFICATION_UNAVAILABLE_MESSAGE` client-safe text constant.
+  `@kohaku-ui/host-rest`'s `/binding/resolve` and `/binding/action`, and `@kohaku-ui/host-mcp-apps`'s
+  `kohaku_resolve_binding` / `kohaku_action` tools, now call it and map `"unavailable"` to a client-safe,
+  observed failure (REST: 503 `INTERNAL` with `"capability verification unavailable"`, reported to `onError`;
+  MCP: a structured tool error with the same message, reported to `onError`) instead of letting a thrown
+  `authz.verify` surface as a raw 500 or an unhandled rejection.
+
+- [#28](https://github.com/yosuque/kohaku/pull/28) [`a26f9be`](https://github.com/yosuque/kohaku/commit/a26f9be35f5702287e79f67f13bd3298bfb73bc5) Thanks [@yosuque](https://github.com/yosuque)! - Capability tokens can now be revoked before they expire. `@kohaku-ui/spec-core` adds the
+  `CapabilityRevocationStore` port type (`ports.ts`, alongside `AuthzPort`, which itself is unchanged).
+  `@kohaku-ui/authz-hmac`'s tokens now carry a `jti`, `createHmacAuthzPort`'s `HmacAuthzOptions` accepts a
+  `revocations` store, and the returned `HmacAuthzPort` exposes `revokeCapability(token)` (signature
+  verified first, so a caller cannot revoke a `jti` it merely guessed) alongside the reference
+  `createMemoryRevocationStore`. A token minted before this change carries no `jti` and verifies as
+  before; it simply cannot be revoked and is left to expire on its own, so a rolling deploy does not break
+  an older instance's already-issued tokens. `@kohaku-ui/authz-jwt`'s `createJwtAuthzPort` passes
+  `revocations` through to the underlying `@kohaku-ui/authz-hmac` port and exposes the same
+  `revokeCapability(token)`, delegating entirely; the JWT identity path is unaffected.
+  
+  `@kohaku-ui/storage-redis` adds `createRedisRevocationStore({ url | client, keyPrefix, connectTimeoutMs,
+  maxRetriesPerRequest })`: a revoked `jti` is a plain key carrying its own `SET … EX` expiry derived from
+  the token's `exp`, so Redis drops it once the token would have expired anyway (`revoke()` is a no-op when
+  that remaining lifetime is already zero or negative); `isRevoked` is an `EXISTS` check. Same fail-fast
+  construction and memoized-and-discarded-on-failure `ready()` gate as `createRedisStoragePort`, awaited by
+  every method. `@kohaku-ui/storage-postgres` adds `createPostgresRevocationStore({ connectionString | pool,
+  schema, migrate })` and a fifth table, `kohaku_capability_revocation` (`jti` primary key, `expires_at`),
+  in the shared idempotent `postgresSchemaSql`; `revoke()` upserts, `isRevoked` filters by `expires_at >
+  now()`, and `sweepExpiredRevocations()` deletes expired rows for a cron, the same treatment as the
+  existing `sweepExpiredSpecCache()`. Both stores are exercised against a real backend via
+  `describeRevocationStoreContract` (`@kohaku-ui/port-contracts`), skipping without Docker.
+
+- [#28](https://github.com/yosuque/kohaku/pull/28) [`50cbb8a`](https://github.com/yosuque/kohaku/commit/50cbb8adec9e01fc7d906ea53528e4cf598e52ea) Thanks [@yosuque](https://github.com/yosuque)! - Production adapters: `@kohaku-ui/storage-redis` and `@kohaku-ui/storage-postgres` implement the whole `StoragePort` (Spec cache, lineage, promotion state, fixation, tenant scoping) so several host instances share one Spec cache and serve the same Intent as `cache: "hit"`; `@kohaku-ui/authz-jwt` resolves principal / roles / tenant from JWT / OIDC claims (shared secret or JWKS) and delegates capability tokens to `@kohaku-ui/authz-hmac`. All three are reference adapters over the unchanged `ports.ts` contract; the sample host selects them via `KOHAKU_STORAGE` / `KOHAKU_AUTHZ`.
+
+### Patch Changes
+
+- Updated dependencies [[`244136c`](https://github.com/yosuque/kohaku/commit/244136c70cb1875c084589c7640ee3fbb3880f4c), [`a26f9be`](https://github.com/yosuque/kohaku/commit/a26f9be35f5702287e79f67f13bd3298bfb73bc5), [`ad51284`](https://github.com/yosuque/kohaku/commit/ad5128464169d389e0c462c59184d411ba359d8e), [`cffc1aa`](https://github.com/yosuque/kohaku/commit/cffc1aac259bfdc8f22c48ae57427a809853924e), [`76103a6`](https://github.com/yosuque/kohaku/commit/76103a60caf2bdac87fec1d4241e3e62cf317b5c)]:
+  - @kohaku-ui/authz-hmac@0.3.0
+  - @kohaku-ui/spec-core@0.3.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -1,3 +1,66 @@
 # @kohaku-ui/authz-jwt
 
-Placeholder. The real package is published from https://github.com/yosuque/kohaku by trusted publishing.
+JWT / OIDC identity resolution for kohaku hosts — verifies a bearer JWT with [`jose`](https://github.com/panva/jose) and maps its claims to kohaku's `Principal` plus a tenant, while delegating capability tokens unchanged to [`@kohaku-ui/authz-hmac`](https://github.com/yosuque/kohaku/tree/main/packages/authz-hmac). The contract stays `@kohaku-ui/spec-core`'s `ports.ts`.
+
+```ts
+import { createJwtAuthzPort } from "@kohaku-ui/authz-jwt";
+
+const authz = createJwtAuthzPort({
+  key: { jwksUrl: "https://issuer.example.com/.well-known/jwks.json" },
+  issuer: "https://issuer.example.com",
+  audience: "kohaku",
+  capabilitySecret: process.env.KOHAKU_CAPABILITY_SECRET!,
+});
+
+// Resolve the caller from the request's Authorization header (a host's principal/tenant hooks):
+const { principal, tenant } = await authz.identity.fromAuthorizationHeader(req.headers.authorization);
+
+// Capability issuance/verification is the unchanged @kohaku-ui/authz-hmac scheme:
+const token = await authz.issueCapability(principal, [{ kind: "read", ref: "query://sales/summary" }]);
+await authz.verify(token, { kind: "read", ref: "query://sales/summary" });
+```
+
+## Identity resolution
+
+`createJwtIdentityResolver` verifies signature, `exp`/`nbf`, and optionally `iss`, then maps claims to a `Principal` (`id`, optional `name`, optional `roles`) and an optional `tenant`. The default claim names are `sub` / `name` / `roles` / `tenant`; override them with `claims` for issuers that namespace custom claims (Auth0-style URLs), or bypass the mapping entirely with `mapClaims`. The `roles` claim accepts either a `string[]` or a whitespace-separated `string` (OIDC `scope`-style).
+
+The key source (`{ secret }`, `{ jwks }`, or `{ jwksUrl }`) also fixes the default algorithm allow-list — `["HS256"]` for a shared secret, `["RS256", "ES256", "EdDSA"]` for a JWK set — which a caller can narrow or replace with `algorithms`. This allow-list is a security boundary: a JWKS-configured resolver rejects an HS256-signed token even if it happens to verify against some key in the set.
+
+**Construction-time validation** (throws synchronously, before any token is ever verified):
+- **`audience` is required** when `key` is `jwks` or `jwksUrl` — a JWKS-configured resolver typically talks to a third-party issuer that mints tokens for other audiences too, so skipping the `aud` check would accept a token never meant for this service. `audience` stays optional in `secret` mode. **`issuer` is not similarly required, but is recommended alongside it** with a third-party JWKS: a JWKS URL is already per-issuer, so the risk is low, but setting `issuer` too makes the `iss` check an explicit, verified assertion rather than an implicit one left to the URL alone.
+- **`key.secret` must be at least 32 bytes** (UTF-8) — a shorter HS256 shared secret is brute-forceable well before the hash itself becomes the weak link.
+- **`jwksUrl` must use `https:`**, unless the host is `localhost` / `127.0.0.1` / `::1` (local development or tests only) — fetching a JWKS over plain HTTP to a real issuer would let a network attacker substitute their own keys and forge tokens this resolver would then accept.
+
+**`requireTenant`** (default `false`): when true, a token with no (or an empty) tenant claim rejects with `JwtIdentityError({ code: "MISSING_TENANT" })` instead of resolving with `{ principal }` (no tenant). Only applies to the default claim mapping — a caller supplying `mapClaims` is responsible for its own tenant requirement, if any.
+
+Failures throw `JwtIdentityError` with a `code` (`MISSING_TOKEN` / `INVALID_TOKEN` / `MISSING_SUBJECT` / `MISSING_TENANT`) and, for `INVALID_TOKEN`, the underlying `jose` error as `cause`, so a host can log the real reason while returning an opaque message to the caller.
+
+## Capability tokens are unchanged, including revocation
+
+`createJwtAuthzPort` delegates `issueCapability` / `verify` to `@kohaku-ui/authz-hmac` untouched — a JWT is never a capability and a capability is never a JWT. This means capability revocation is also the unchanged `@kohaku-ui/authz-hmac` scheme: pass `revocations` (a `CapabilityRevocationStore`, e.g. from `@kohaku-ui/storage-redis` or `@kohaku-ui/storage-postgres`) and the returned port's `revokeCapability(token)` delegates straight through.
+
+```ts
+import { createRedisRevocationStore } from "@kohaku-ui/storage-redis";
+// storage-redis's ioredis peer dependency must be installed alongside it.
+
+const authz = createJwtAuthzPort({
+  key: { jwksUrl: "https://issuer.example.com/.well-known/jwks.json" },
+  audience: "kohaku",
+  capabilitySecret: process.env.KOHAKU_CAPABILITY_SECRET!,
+  revocations: createRedisRevocationStore({ url: process.env.KOHAKU_REDIS_URL! }),
+});
+
+await authz.revokeCapability(token); // signature verified first; a tampered or foreign token is rejected
+```
+
+**A token minted before this change carries no `jti` and therefore still cannot be revoked**: it verifies exactly as before and is left to expire on its own. This is the one thing worth watching operationally, because it is silent — nothing logs a jti-less token being accepted, so the only signal an operator has is knowing when a fleet finished rolling onto a `jti`-issuing version.
+
+Part of [kohaku](https://github.com/yosuque/kohaku), a reference implementation of the
+[Kohaku Protocol](https://github.com/yosuque/kohaku/blob/main/spec/SPEC.md).
+
+The packages in this scope share a single version and are designed to be installed together.
+
+- Documentation: https://github.com/yosuque/kohaku#readme
+- Source: https://github.com/yosuque/kohaku/tree/main/packages/authz-jwt
+
+Licensed under the Apache License, Version 2.0.

package/dist/authz-port.d.ts

@@ -0,0 +1,33 @@
+import { type RevokeCapabilityResult } from "@kohaku-ui/authz-hmac";
+import type { AuthzPort, CapabilityRevocationStore } from "@kohaku-ui/spec-core";
+import { type JwtIdentityOptions, type JwtIdentityResolver } from "./identity.js";
+export interface JwtAuthzOptions extends JwtIdentityOptions {
+    /** Secret for the capability tokens kohaku issues per Spec (HMAC-SHA256, from @kohaku-ui/authz-hmac). */
+    capabilitySecret: string;
+    /** Default capability TTL in seconds (the host may override per issuance). Default 600. */
+    capabilityTtlSeconds?: number;
+    /**
+     * The store consulted for pre-expiry capability revocation, passed straight through to the underlying
+     * HMAC port (see `@kohaku-ui/authz-hmac`'s `HmacAuthzOptions.revocations`). Defaults to a private
+     * in-memory store; a multi-instance deployment should inject a shared store instead.
+     */
+    revocations?: CapabilityRevocationStore;
+}
+export interface JwtAuthzPort extends AuthzPort {
+    /** The resolver a host wires into its principal/tenant hooks (host-rest `auth` / `tenant`, MCP `resolvePrincipal`). */
+    readonly identity: JwtIdentityResolver;
+    /**
+     * Revokes a capability before its `exp`, delegating entirely to the underlying HMAC port
+     * (`@kohaku-ui/authz-hmac`'s `revokeCapability`). Revocation applies only to the capability token; it
+     * has no effect on the bearer JWT the identity resolver handles.
+     */
+    revokeCapability(token: string): Promise<RevokeCapabilityResult>;
+}
+/**
+ * AuthzPort for JWT / OIDC deployments. The two halves of the contract are deliberately separate:
+ * capability tokens (issue / verify) are the existing HMAC scheme, unchanged; the identity resolver only
+ * turns the caller's bearer JWT into a Principal + tenant for the host's own hooks. A capability is never a
+ * JWT and a JWT is never a capability.
+ */
+export declare function createJwtAuthzPort(options: JwtAuthzOptions): JwtAuthzPort;
+//# sourceMappingURL=authz-port.d.ts.map

package/dist/authz-port.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz-port.d.ts","sourceRoot":"","sources":["../src/authz-port.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,KAAK,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACzF,OAAO,KAAK,EAAE,SAAS,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACjF,OAAO,EAA6B,KAAK,kBAAkB,EAAE,KAAK,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAE7G,MAAM,WAAW,eAAgB,SAAQ,kBAAkB;IACzD,yGAAyG;IACzG,gBAAgB,EAAE,MAAM,CAAC;IACzB,2FAA2F;IAC3F,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,WAAW,CAAC,EAAE,yBAAyB,CAAC;CACzC;AAED,MAAM,WAAW,YAAa,SAAQ,SAAS;IAC7C,uHAAuH;IACvH,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC;;;;OAIG;IACH,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;CAClE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,eAAe,GAAG,YAAY,CAazE"}

package/dist/authz-port.js

@@ -0,0 +1,23 @@
+import { createHmacAuthzPort } from "@kohaku-ui/authz-hmac";
+import { createJwtIdentityResolver } from "./identity.js";
+/**
+ * AuthzPort for JWT / OIDC deployments. The two halves of the contract are deliberately separate:
+ * capability tokens (issue / verify) are the existing HMAC scheme, unchanged; the identity resolver only
+ * turns the caller's bearer JWT into a Principal + tenant for the host's own hooks. A capability is never a
+ * JWT and a JWT is never a capability.
+ */
+export function createJwtAuthzPort(options) {
+    const { capabilitySecret, capabilityTtlSeconds, revocations, ...identityOptions } = options;
+    const capabilities = createHmacAuthzPort(capabilitySecret, {
+        ...(capabilityTtlSeconds != null ? { ttlSeconds: capabilityTtlSeconds } : {}),
+        ...(revocations != null ? { revocations } : {}),
+    });
+    const identity = createJwtIdentityResolver(identityOptions);
+    return {
+        identity,
+        issueCapability: (principal, scopes, opts) => capabilities.issueCapability(principal, scopes, opts),
+        verify: (token, req) => capabilities.verify(token, req),
+        revokeCapability: (token) => capabilities.revokeCapability(token),
+    };
+}
+//# sourceMappingURL=authz-port.js.map

package/dist/authz-port.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz-port.js","sourceRoot":"","sources":["../src/authz-port.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAA+B,MAAM,uBAAuB,CAAC;AAEzF,OAAO,EAAE,yBAAyB,EAAqD,MAAM,eAAe,CAAC;AA0B7G;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAwB;IACzD,MAAM,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,WAAW,EAAE,GAAG,eAAe,EAAE,GAAG,OAAO,CAAC;IAC5F,MAAM,YAAY,GAAG,mBAAmB,CAAC,gBAAgB,EAAE;QACzD,GAAG,CAAC,oBAAoB,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,yBAAyB,CAAC,eAAe,CAAC,CAAC;IAC5D,OAAO;QACL,QAAQ;QACR,eAAe,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC;QACnG,MAAM,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC;QACvD,gBAAgB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,gBAAgB,CAAC,KAAK,CAAC;KAClE,CAAC;AACJ,CAAC"}

package/dist/bearer.d.ts

@@ -0,0 +1,3 @@
+/** The token of an `Authorization: Bearer <token>` header (scheme matched case-insensitively), or null. */
+export declare function bearerToken(header: string | null | undefined): string | null;
+//# sourceMappingURL=bearer.d.ts.map

package/dist/bearer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer.d.ts","sourceRoot":"","sources":["../src/bearer.ts"],"names":[],"mappings":"AAAA,2GAA2G;AAC3G,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAI5E"}

package/dist/bearer.js

@@ -0,0 +1,8 @@
+/** The token of an `Authorization: Bearer <token>` header (scheme matched case-insensitively), or null. */
+export function bearerToken(header) {
+    if (header == null)
+        return null;
+    const match = /^\s*bearer\s+(\S+)\s*$/i.exec(header);
+    return match?.[1] ?? null;
+}
+//# sourceMappingURL=bearer.js.map

package/dist/bearer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer.js","sourceRoot":"","sources":["../src/bearer.ts"],"names":[],"mappings":"AAAA,2GAA2G;AAC3G,MAAM,UAAU,WAAW,CAAC,MAAiC;IAC3D,IAAI,MAAM,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,KAAK,GAAG,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrD,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5B,CAAC"}

package/dist/identity.d.ts

@@ -0,0 +1,64 @@
+import type { Principal } from "@kohaku-ui/spec-core";
+import { type JSONWebKeySet, type JWTPayload } from "jose";
+export type JwtKeySource = {
+    secret: string;
+} | {
+    jwks: JSONWebKeySet;
+} | {
+    jwksUrl: string | URL;
+};
+/** Claim names the default mapping reads. Override for issuers that namespace custom claims (Auth0-style URLs). */
+export interface JwtClaimNames {
+    subject?: string;
+    name?: string;
+    roles?: string;
+    tenant?: string;
+}
+export interface ResolvedIdentity {
+    principal: Principal;
+    tenant?: string;
+}
+export interface JwtIdentityOptions {
+    key: JwtKeySource;
+    issuer?: string | string[];
+    /**
+     * The expected `aud` claim. REQUIRED when `key` is `jwksUrl` or `jwks` (a JWKS-configured resolver
+     * typically talks to a third-party issuer that mints tokens for other audiences too, so skipping the
+     * `aud` check there would accept a token never meant for this service) -- the constructor throws if
+     * omitted in either mode. Optional in `secret` mode (a single shared secret is usually already
+     * service-specific, so there is no comparable cross-audience risk).
+     */
+    audience?: string | string[];
+    /** Seconds of leeway on exp / nbf. Default 0. */
+    clockToleranceSeconds?: number;
+    /** Allowed `alg` values. Default: ["HS256"] for a secret, ["RS256", "ES256", "EdDSA"] for a JWK set. */
+    algorithms?: string[];
+    claims?: JwtClaimNames;
+    /** Full override of the claims → identity mapping (the verified payload is passed in). Bypasses the
+     * default mapping entirely, including `requireTenant` below -- a caller supplying `mapClaims` is
+     * responsible for its own tenant requirement, if any. */
+    mapClaims?: (payload: JWTPayload) => ResolvedIdentity;
+    /**
+     * When true, a token with no (or an empty) tenant claim resolves to a `JwtIdentityError` with code
+     * `MISSING_TENANT`, instead of the default `{ principal }` (no tenant). Default false. Only applies to
+     * the default claim mapping (ignored when `mapClaims` is supplied — see its doc comment).
+     */
+    requireTenant?: boolean;
+}
+export type JwtIdentityErrorCode = "MISSING_TOKEN" | "INVALID_TOKEN" | "MISSING_SUBJECT" | "MISSING_TENANT";
+export declare class JwtIdentityError extends Error {
+    readonly code: JwtIdentityErrorCode;
+    constructor(code: JwtIdentityErrorCode, message: string, options?: {
+        cause?: unknown;
+    });
+}
+export interface JwtIdentityResolver {
+    resolve(token: string): Promise<ResolvedIdentity>;
+    fromAuthorizationHeader(header: string | null | undefined): Promise<ResolvedIdentity>;
+}
+/**
+ * Verifies a JWT (signature, exp/nbf, optional iss/aud) with jose and maps its claims to kohaku's
+ * `Principal` (+ tenant). Nothing here touches capability tokens — that stays with the AuthzPort.
+ */
+export declare function createJwtIdentityResolver(options: JwtIdentityOptions): JwtIdentityResolver;
+//# sourceMappingURL=identity.d.ts.map

package/dist/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAGL,KAAK,aAAa,EAClB,KAAK,UAAU,EAGhB,MAAM,MAAM,CAAC;AAGd,MAAM,MAAM,YAAY,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,MAAM,GAAG,GAAG,CAAA;CAAE,CAAC;AAEpG,mHAAmH;AACnH,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,YAAY,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B,iDAAiD;IACjD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,wGAAwG;IACxG,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB;;6DAEyD;IACzD,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,UAAU,KAAK,gBAAgB,CAAC;IACtD;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,MAAM,oBAAoB,GAAG,eAAe,GAAG,eAAe,GAAG,iBAAiB,GAAG,gBAAgB,CAAC;AAW5G,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,YAAY,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAIrF;CACF;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAClD,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACvF;AA2DD;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,kBAAkB,GAAG,mBAAmB,CA6C1F"}

package/dist/identity.js

@@ -0,0 +1,123 @@
+import { createLocalJWKSet, createRemoteJWKSet, jwtVerify, } from "jose";
+import { bearerToken } from "./bearer.js";
+/** Minimum HS256 shared-secret length (bytes, UTF-8), enforced at construction in `secret` mode. 32 bytes
+ * (256 bits) matches HS256's own hash output size -- a shorter secret is brute-forceable well before the
+ * hash itself becomes the weak link. */
+const MIN_HMAC_SECRET_BYTES = 32;
+/** Hostnames `jwksUrl` may use over plain `http:` (never in production; local development / tests only).
+ * `URL.hostname` renders an IPv6 literal with brackets (`new URL("http://[::1]/").hostname === "[::1]"`). */
+const LOCAL_JWKS_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]"]);
+export class JwtIdentityError extends Error {
+    code;
+    constructor(code, message, options) {
+        super(message, options);
+        this.name = "JwtIdentityError";
+        this.code = code;
+    }
+}
+const DEFAULT_CLAIMS = {
+    subject: "sub",
+    name: "name",
+    roles: "roles",
+    tenant: "tenant",
+};
+/**
+ * Rejects an `http:` `jwksUrl` unless it targets a local host (`localhost` / `127.0.0.1` / `::1`) --
+ * fetching a JWKS over plain HTTP to a real issuer would let a network attacker substitute their own keys
+ * and forge tokens this resolver would then accept. `https:` is always allowed. Thrown at construction, so
+ * a misconfiguration is caught before the first token is ever verified.
+ */
+function assertJwksUrlAllowed(jwksUrl) {
+    const url = jwksUrl instanceof URL ? jwksUrl : new URL(jwksUrl);
+    if (url.protocol === "https:")
+        return;
+    if (url.protocol === "http:" && LOCAL_JWKS_HOSTS.has(url.hostname))
+        return;
+    throw new Error(`jwksUrl must use https: (http: is only allowed for localhost/127.0.0.1/::1), got "${url.protocol}//${url.hostname}"`);
+}
+function keyOf(source) {
+    if ("secret" in source)
+        return { key: new TextEncoder().encode(source.secret), defaultAlgorithms: ["HS256"] };
+    const asymmetric = ["RS256", "ES256", "EdDSA"];
+    if ("jwks" in source)
+        return { key: createLocalJWKSet(source.jwks), defaultAlgorithms: asymmetric };
+    assertJwksUrlAllowed(source.jwksUrl);
+    return { key: createRemoteJWKSet(new URL(source.jwksUrl)), defaultAlgorithms: asymmetric };
+}
+function rolesOf(value) {
+    if (Array.isArray(value))
+        return value.filter((v) => typeof v === "string");
+    if (typeof value === "string")
+        return value.split(/\s+/).filter((v) => v !== "");
+    return undefined;
+}
+function defaultMap(names, requireTenant) {
+    return (payload) => {
+        const subject = payload[names.subject];
+        if (typeof subject !== "string" || subject === "") {
+            throw new JwtIdentityError("MISSING_SUBJECT", `token has no "${names.subject}" claim`);
+        }
+        const principal = { id: subject };
+        const name = payload[names.name];
+        if (typeof name === "string")
+            principal.name = name;
+        const roles = rolesOf(payload[names.roles]);
+        if (roles != null)
+            principal.roles = roles;
+        const tenant = payload[names.tenant];
+        if (typeof tenant === "string" && tenant !== "")
+            return { principal, tenant };
+        if (requireTenant) {
+            throw new JwtIdentityError("MISSING_TENANT", `token has no "${names.tenant}" claim`);
+        }
+        return { principal };
+    };
+}
+/**
+ * Verifies a JWT (signature, exp/nbf, optional iss/aud) with jose and maps its claims to kohaku's
+ * `Principal` (+ tenant). Nothing here touches capability tokens — that stays with the AuthzPort.
+ */
+export function createJwtIdentityResolver(options) {
+    if ("secret" in options.key) {
+        if (Buffer.byteLength(options.key.secret, "utf8") < MIN_HMAC_SECRET_BYTES) {
+            throw new Error(`key.secret must be at least ${MIN_HMAC_SECRET_BYTES} bytes (HS256 requires a strong shared secret)`);
+        }
+    }
+    else if (options.audience == null) {
+        // jwks / jwksUrl mode: a JWKS-configured resolver typically talks to a third-party issuer that mints
+        // tokens for other audiences too, so an unset `audience` here would accept a token never meant for
+        // this service.
+        throw new Error("audience is required when key is jwksUrl or jwks");
+    }
+    const { key, defaultAlgorithms } = keyOf(options.key);
+    const algorithms = options.algorithms ?? defaultAlgorithms;
+    const requireTenant = options.requireTenant ?? false;
+    const map = options.mapClaims ?? defaultMap({ ...DEFAULT_CLAIMS, ...options.claims }, requireTenant);
+    const resolve = async (token) => {
+        let payload;
+        try {
+            const verifyOptions = {
+                algorithms,
+                ...(options.issuer != null ? { issuer: options.issuer } : {}),
+                ...(options.audience != null ? { audience: options.audience } : {}),
+                clockTolerance: options.clockToleranceSeconds ?? 0,
+            };
+            const result = await jwtVerify(token, key, verifyOptions);
+            payload = result.payload;
+        }
+        catch (e) {
+            throw new JwtIdentityError("INVALID_TOKEN", "token verification failed", { cause: e });
+        }
+        return map(payload);
+    };
+    return {
+        resolve,
+        async fromAuthorizationHeader(header) {
+            const token = bearerToken(header);
+            if (token == null)
+                throw new JwtIdentityError("MISSING_TOKEN", "no Bearer token in the Authorization header");
+            return resolve(token);
+        },
+    };
+}
+//# sourceMappingURL=identity.js.map

package/dist/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AACA,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAIlB,SAAS,GACV,MAAM,MAAM,CAAC;AACd,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA+C1C;;wCAEwC;AACxC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC;6GAC6G;AAC7G,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAEtE,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChC,IAAI,CAAuB;IACpC,YAAY,IAA0B,EAAE,OAAe,EAAE,OAA6B;QACpF,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAOD,MAAM,cAAc,GAA4B;IAC9C,OAAO,EAAE,KAAK;IACd,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;IACd,MAAM,EAAE,QAAQ;CACjB,CAAC;AAEF;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,OAAqB;IACjD,MAAM,GAAG,GAAG,OAAO,YAAY,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAChE,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO;IACtC,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO;IAC3E,MAAM,IAAI,KAAK,CACb,qFAAqF,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,GAAG,CACtH,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,MAAoB;IACjC,IAAI,QAAQ,IAAI,MAAM;QACpB,OAAO,EAAE,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,iBAAiB,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACxF,MAAM,UAAU,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/C,IAAI,MAAM,IAAI,MAAM;QAAE,OAAO,EAAE,GAAG,EAAE,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,iBAAiB,EAAE,UAAU,EAAE,CAAC;IACpG,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACrC,OAAO,EAAE,GAAG,EAAE,kBAAkB,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,iBAAiB,EAAE,UAAU,EAAE,CAAC;AAC7F,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IACzF,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACjF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,UAAU,CAAC,KAA8B,EAAE,aAAsB;IACxE,OAAO,CAAC,OAAmB,EAAoB,EAAE;QAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;YAClD,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,iBAAiB,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,SAAS,GAAc,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,SAAS,CAAC,IAAI,GAAG,IAAI,CAAC;QACpD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5C,IAAI,KAAK,IAAI,IAAI;YAAE,SAAS,CAAC,KAAK,GAAG,KAAK,CAAC;QAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE;YAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAC9E,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,iBAAiB,KAAK,CAAC,MAAM,SAAS,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,CAAC;IACvB,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAA2B;IACnE,IAAI,QAAQ,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAC5B,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,qBAAqB,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CACb,+BAA+B,qBAAqB,gDAAgD,CACrG,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;QACpC,qGAAqG;QACrG,mGAAmG;QACnG,gBAAgB;QAChB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,EAAE,GAAG,EAAE,iBAAiB,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,iBAAiB,CAAC;IAC3D,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,KAAK,CAAC;IACrD,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC,EAAE,GAAG,cAAc,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC;IAErG,MAAM,OAAO,GAAG,KAAK,EAAE,KAAa,EAA6B,EAAE;QACjE,IAAI,OAAmB,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,aAAa,GAAG;gBACpB,UAAU;gBACV,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7D,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,cAAc,EAAE,OAAO,CAAC,qBAAqB,IAAI,CAAC;aACnD,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;YAC1D,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC3B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,2BAA2B,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,OAAO,GAAG,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC,CAAC;IAEF,OAAO;QACL,OAAO;QACP,KAAK,CAAC,uBAAuB,CAAC,MAAM;YAClC,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,KAAK,IAAI,IAAI;gBACf,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,6CAA6C,CAAC,CAAC;YAC7F,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export { createJwtAuthzPort, type JwtAuthzOptions, type JwtAuthzPort } from "./authz-port.js";
+export { bearerToken } from "./bearer.js";
+export { createJwtIdentityResolver, type JwtClaimNames, JwtIdentityError, type JwtIdentityErrorCode, type JwtIdentityOptions, type JwtIdentityResolver, type JwtKeySource, type ResolvedIdentity, } from "./identity.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,KAAK,eAAe,EAAE,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC9F,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,yBAAyB,EACzB,KAAK,aAAa,EAClB,gBAAgB,EAChB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,YAAY,EACjB,KAAK,gBAAgB,GACtB,MAAM,eAAe,CAAC"}

package/dist/index.js

@@ -0,0 +1,4 @@
+export { createJwtAuthzPort } from "./authz-port.js";
+export { bearerToken } from "./bearer.js";
+export { createJwtIdentityResolver, JwtIdentityError, } from "./identity.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAA2C,MAAM,iBAAiB,CAAC;AAC9F,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,yBAAyB,EAEzB,gBAAgB,GAMjB,MAAM,eAAe,CAAC"}

package/package.json

@@ -1,11 +1,53 @@
 {
   "name": "@kohaku-ui/authz-jwt",
-  "version": "0.0.0-bootstrap.0",
-  "description": "Placeholder that reserves the name before the first real release of @kohaku-ui/authz-jwt. Do not install.",
+  "version": "0.4.0",
+  "description": "JWT / OIDC identity resolution for kohaku hosts (principal, roles, tenant from claims) with capability tokens delegated to @kohaku-ui/authz-hmac — a reference adapter; the contract stays @kohaku-ui/spec-core's ports.ts.",
+  "type": "module",
   "license": "Apache-2.0",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "dependencies": {
+    "@kohaku-ui/spec-core": "^0.4.0",
+    "@kohaku-ui/authz-hmac": "^0.4.0",
+    "jose": "^6.2.12"
+  },
+  "devDependencies": {
+    "@kohaku-ui/port-contracts": "^0.2.0",
+    "@types/node": "^26.6.2",
+    "typescript": "7.0.2",
+    "vitest": "^5.0.1"
+  },
+  "homepage": "https://github.com/yosuque/kohaku/tree/main/packages/authz-jwt#readme",
+  "bugs": {
+    "url": "https://github.com/yosuque/kohaku/issues"
+  },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/yosuque/kohaku.git",
     "directory": "packages/authz-jwt"
-  }
-}
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "sideEffects": false,
+  "files": [
+    "dist",
+    "LICENSE",
+    "README.md",
+    "CHANGELOG.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "typecheck": "tsc --noEmit",
+    "build": "rm -rf dist && tsc -p tsconfig.build.json"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts"
+}