@tealbrick/portal 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Tealbrick contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/NOTICE

@@ -0,0 +1,6 @@
+@tealbrick/portal is an independent implementation authored for Tealbrick.
+Public wire contracts were inspected in @kybernesis/enterprise 0.8.0 and
+kybernesis-admin source commit 6e1651e538a6b4b5ef4b15927429f6ebb887841b.
+No Kybernesis source is re-exported or imported. Legacy header names are explicit
+protocol compatibility, not a dependency. Eve adapter targets Eve 0.49.0 public
+channels/auth contracts. Third-party dependencies retain their own licenses.

package/README.md

@@ -0,0 +1,59 @@
+# @tealbrick/portal
+
+Independent Tealbrick portal authentication and HTTP client. ESM, Node 24+. Core depends only on `jose`; the explicit `/eve` adapter supports Eve 0.55.x as an optional peer. No extension mounting, Knowledge, Buzz, tools, channels, skills or connections are contributed.
+
+```ts
+import { portalAuth } from '@tealbrick/portal/eve';
+const auth = portalAuth({ issuer: 'https://portal.example', org: 'org-id', agent: 'helper' });
+```
+
+Both organization and registered agent name are required trusted deployment configuration. The adapter uses Eve's actual `ForbiddenError` and `UnauthenticatedError` classes. Authentication failure returns null; authorization denial throws ForbiddenError; key retrieval outage throws UnauthenticatedError with `identity_verification_unavailable`. Eve's error class still represents an authentication HTTP response; core reports outages as status 503 for custom HTTP handlers. No retry or implicit offline access.
+
+Core `createPortalVerifier(options).authenticate(request)` returns an `AuthResult`. ES256 identity and policy signatures, issuer, mandatory expiry/issued-at, user/org matching and use/manage grants are checked. Identity kind/purpose separation excludes refresh, daemon and credential JWTs. A2A requires kind, caller, callee and audience `eve:ORG/AGENT`. Native bundle header is `X-Tealbrick-Bundle`. Legacy `X-Kybernesis-Bundle` is enabled explicitly by the default compatibility option; set `legacyBundleHeader:false` to disable it. Conflicting dual headers are rejected. Existing public identity sessions without a `typ` remain supported; `typ:user` is accepted.
+
+## Future attachment gate
+
+`verifier.verifyAttachment(token, principal, {agentId,audience,capability})` accepts only the exact unexpired principal returned by that verifier instance. An object assembled from labels or JSON is rejected. The required logical agent ID, audience and capability are trusted runtime configuration, never browser request inputs. For human requests the preceding grant authenticates access to this configured deployment; agent callers must also match the required agent ID.
+
+Portal must sign `typ:attachment`, `orgId`, `sub:logicalAgentId`, `aud`, `capabilities:string[]`, `status:active`, `jti`, `iat`, `exp` with ES256. Maximum attachment lifetime is 300 seconds. Verification occurs for each protected operation, rejects inactive/expired/unrelated grants and never consumes unsigned manifests. Refresh must obtain a newly issued attachment: a revoked attachment can remain usable until its signed expiry, at most 300 seconds. Immediate revocation requires an online introspection mechanism, which this package does not provide. This verifies evidence only; it mounts no miniapp.
+
+## HTTP client
+
+`new PortalClient({issuer,token,fetch?,timeoutMs?})` provides startDevice, pollDevice, refresh, registerAgent, mintAgentCredential, startEnrollment, pollEnrollment, peers, mintAgentSession and resolveSpeaker. Generic `request<T>` is restricted to same-origin `/api/` paths. Redirects fail closed and requests time out after 15 seconds. No automatic retry of writes, credential persistence or logging. Keep credentials in trusted runtimes. `PortalHttpError.status/code` distinguishes pending/denied/server failures; response content and credential strings are excluded from its message.
+
+`resolveSpeaker` makes a separate portal request for every provider/externalId pair and turn, with no room-level or durable cache. It returns a discriminated linked/unlinked/refused result for unlinked, suspended, unknown or ungranted senders; transport/server failures throw. Endpoint response shapes are checked at runtime; generic request<T> performs only envelope validation for unknown routes. The response is typed but is not authentication evidence until independently verified by the receiving agent. Enrollment approval and denial are operator-side portal actions, not automated client permissions.
+
+## Evidence and limits
+
+`npm run check --workspace @tealbrick/portal` builds declarations and runs disposable ES256 fixture tests: valid identity, mismatched user/org, same-name foreign org, missing/malformed grants, credential type confusion, invalid/expired signatures, A2A audience, key outage, actual Eve errors, attachment bindings/status, and transport security. No reference service mutations or AVM execution. Live portal lifecycle and desktop UAT, real JWKS outage/rotation, and all portal routes are separate integration evidence; this package does not claim complete enterprise parity. Refresh/enrollment client response structures preserve current wire compatibility and do not independently prove server authorization.
+
+## Eve 0.55 channel and model example
+
+Keep channel authorization in `agent/channels/eve.ts`:
+
+```ts
+import { eveChannel } from 'eve/channels/eve';
+import { portalAuth } from '@tealbrick/portal/eve';
+
+export default eveChannel({
+  auth: [portalAuth({
+    issuer: process.env.TEALBRICK_ISSUER!,
+    org: process.env.TEALBRICK_ORG_ID!,
+    agent: 'helper',
+  })],
+});
+```
+
+Configure the model independently in `agent/agent.ts` using the runtime's own provider setup:
+
+```ts
+import { defineAgent } from 'eve';
+import { chatgpt } from 'eve/models/openai';
+
+export default defineAgent({
+  model: chatgpt(process.env.TEALBRICK_MODEL),
+  reasoning: 'low',
+});
+```
+
+The portal token authenticates incoming requests. It is not a model-provider credential; model login and subscription configuration remain local to the agent runtime. `TEALBRICK_ORG_ID` is the actual portal organization ID, not its display name. Missing org/agent configuration fails during verifier creation.

package/dist/auth.d.ts

@@ -0,0 +1,46 @@
+import { type JWTVerifyGetKey } from "jose";
+export type Grant = {
+    agent: string;
+    level: "use" | "manage";
+};
+export interface Principal {
+    id: string;
+    type: "user" | "agent";
+    org: string;
+    subject: string;
+    level?: Grant["level"];
+    callerAgent?: string;
+    email?: string;
+}
+export type AuthResult = {
+    ok: true;
+    principal: Principal;
+} | {
+    ok: false;
+    status: 401 | 403 | 503;
+    code: string;
+};
+export interface AuthOptions {
+    issuer: string;
+    agent: string;
+    org: string;
+    keys?: JWTVerifyGetKey;
+    /** Explicit legacy wire compatibility, default true. */ legacyBundleHeader?: boolean;
+}
+export declare function createPortalVerifier(options: AuthOptions): {
+    authenticate(request: Request): Promise<AuthResult>;
+    /** Call for each operation. No unsigned object can produce verified attachment evidence. */
+    verifyAttachment(token: string, authenticated: Principal, required: {
+        agentId: string;
+        audience: string;
+        capability: string;
+    }): Promise<{
+        ok: true;
+        expiresAt: number;
+        attachmentId: string;
+    } | {
+        ok: false;
+        status: 401 | 403 | 503;
+        code: string;
+    }>;
+};

package/dist/auth.js

@@ -0,0 +1,136 @@
+import { createRemoteJWKSet, jwtVerify, } from "jose";
+const nonempty = (v) => typeof v === "string" && v.length > 0;
+export function createPortalVerifier(options) {
+    if (!options.org || !options.agent)
+        throw new Error("Portal organization and agent are required");
+    const authenticatedPrincipals = new WeakMap();
+    const accept = (principal, expiresAt) => {
+        Object.freeze(principal);
+        authenticatedPrincipals.set(principal, expiresAt);
+        return { ok: true, principal };
+    };
+    const keys = options.keys ??
+        createRemoteJWKSet(new URL(`${options.issuer.replace(/\/$/, "")}/api/jwks`));
+    async function verify(token, audience) {
+        return (await jwtVerify(token, keys, {
+            issuer: options.issuer,
+            algorithms: ["ES256"],
+            requiredClaims: ["exp", "iat"],
+            ...(audience ? { audience } : {}),
+        })).payload;
+    }
+    function failure(error) {
+        const code = error?.code;
+        const rejected = new Set([
+            "ERR_JWT_EXPIRED",
+            "ERR_JWT_CLAIM_VALIDATION_FAILED",
+            "ERR_JWS_SIGNATURE_VERIFICATION_FAILED",
+            "ERR_JWS_INVALID",
+            "ERR_JWT_INVALID",
+            "ERR_JOSE_ALG_NOT_ALLOWED",
+            "ERR_JWKS_NO_MATCHING_KEY",
+            "ERR_JWKS_MULTIPLE_MATCHING_KEYS",
+        ]);
+        return rejected.has(code ?? "")
+            ? { ok: false, status: 401, code: "invalid_session" }
+            : { ok: false, status: 503, code: "identity_verification_unavailable" };
+    }
+    return {
+        async authenticate(request) {
+            const token = /^Bearer\s+(\S+)$/i.exec(request.headers.get("authorization") ?? "")?.[1];
+            const native = request.headers.get("x-tealbrick-bundle");
+            const legacy = options.legacyBundleHeader === false
+                ? null
+                : request.headers.get("x-kybernesis-bundle");
+            if (!token || (native && legacy && native !== legacy))
+                return {
+                    ok: false,
+                    status: 401,
+                    code: "missing_or_conflicting_credentials",
+                };
+            try {
+                const id = await verify(token);
+                if (!nonempty(id.sub) ||
+                    !nonempty(id.org) ||
+                    (options.org && id.org !== options.org))
+                    return { ok: false, status: 401, code: "invalid_identity" };
+                const bundle = native ?? legacy;
+                if (!bundle) {
+                    if (id.kind !== "a2a" || !nonempty(id.caller))
+                        return { ok: false, status: 401, code: "bundle_required" };
+                    if (id.callee !== options.agent)
+                        return { ok: false, status: 403, code: "wrong_callee" };
+                    await verify(token, `eve:${id.org}/${options.agent}`);
+                    return accept({
+                        id: id.sub,
+                        type: "agent",
+                        org: id.org,
+                        callerAgent: id.caller,
+                        subject: `agent:${id.org}/${id.caller}`,
+                    }, id.exp);
+                }
+                if (id.kind !== undefined ||
+                    id.purpose !== undefined ||
+                    (id.typ !== undefined && id.typ !== "user"))
+                    return { ok: false, status: 401, code: "wrong_identity_type" };
+                const policy = await verify(bundle);
+                if (policy.user !== id.sub ||
+                    policy.org !== id.org ||
+                    !Array.isArray(policy.agentGrants))
+                    return { ok: false, status: 401, code: "bundle_mismatch" };
+                const grant = policy.agentGrants.find((g) => typeof g === "object" &&
+                    g !== null &&
+                    g.agent === options.agent &&
+                    ["use", "manage"].includes(g.level));
+                if (!grant)
+                    return { ok: false, status: 403, code: "agent_not_granted" };
+                return accept({
+                    id: id.sub,
+                    type: "user",
+                    org: id.org,
+                    subject: id.sub,
+                    level: grant.level,
+                    ...(nonempty(id.email) ? { email: id.email } : {}),
+                }, Math.min(id.exp, policy.exp));
+            }
+            catch (error) {
+                return failure(error);
+            }
+        },
+        /** Call for each operation. No unsigned object can produce verified attachment evidence. */
+        async verifyAttachment(token, authenticated, required) {
+            try {
+                if ((authenticatedPrincipals.get(authenticated) ?? 0) <=
+                    Date.now() / 1000)
+                    return { ok: false, status: 403, code: "unverified_principal" };
+                const attachment = await verify(token, required.audience);
+                if (attachment.iat > Date.now() / 1000 ||
+                    attachment.exp <= attachment.iat ||
+                    attachment.exp - attachment.iat > 300 ||
+                    attachment.typ !== "attachment" ||
+                    attachment.orgId !== authenticated.org ||
+                    attachment.sub !== required.agentId ||
+                    attachment.status !== "active" ||
+                    !nonempty(attachment.jti) ||
+                    !Array.isArray(attachment.capabilities) ||
+                    !attachment.capabilities.includes(required.capability))
+                    return { ok: false, status: 403, code: "attachment_not_authorized" };
+                // Agent-authenticated calls cannot substitute a different logical agent ID.
+                if (authenticated.type === "agent" &&
+                    authenticated.id !== required.agentId)
+                    return { ok: false, status: 403, code: "attachment_agent_mismatch" };
+                return {
+                    ok: true,
+                    expiresAt: attachment.exp,
+                    attachmentId: attachment.jti,
+                };
+            }
+            catch (error) {
+                const f = failure(error);
+                if (!f.ok)
+                    return f;
+                throw error;
+            }
+        },
+    };
+}

package/dist/client.d.ts

@@ -0,0 +1,103 @@
+export interface IdentitySession {
+    issuer: string;
+    token: string;
+    bundle: string;
+    jwks: {
+        keys: unknown[];
+    };
+}
+export interface DeviceAuthorization {
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    verification_uri_complete: string;
+    expires_in: number;
+    interval: number;
+}
+export declare class PortalHttpError extends Error {
+    readonly status: number;
+    readonly code: string;
+    readonly link?: string | undefined;
+    constructor(status: number, code: string, link?: string | undefined);
+}
+export interface ClientOptions {
+    issuer: string;
+    fetch?: typeof fetch;
+    token?: string | (() => string | Promise<string>);
+    timeoutMs?: number;
+}
+/** No credential storage or logging; instantiate in a trusted runtime for agent credentials. */
+export declare class PortalClient {
+    private options;
+    private base;
+    constructor(options: ClientOptions);
+    request<T>(path: string, body?: unknown, signal?: AbortSignal): Promise<T>;
+    startDevice(input?: {
+        deviceId?: string;
+        deviceLabel?: string;
+    }): Promise<DeviceAuthorization>;
+    pollDevice(deviceCode: string): Promise<IdentitySession & {
+        refresh_token?: string;
+    }>;
+    refresh(refreshToken: string): Promise<IdentitySession & {
+        refresh_token: string;
+    }>;
+    registerAgent(name: string, url: string): Promise<{
+        ok: true;
+        id: string;
+        name: string;
+        url: string;
+        created: boolean;
+    }>;
+    mintAgentCredential(agent: string): Promise<{
+        credential: string;
+    }>;
+    startEnrollment(input: {
+        daemonId: string;
+        kind?: "desktop" | "server";
+        label?: string;
+        endpoint?: string;
+    }): Promise<DeviceAuthorization>;
+    pollEnrollment(deviceCode: string): Promise<{
+        credential: string;
+        org: string;
+        daemon_id: string;
+    }>;
+    peers(): Promise<{
+        peers: Array<{
+            name: string;
+            url: string;
+            purpose: string;
+        }>;
+    }>;
+    mintAgentSession(callee: string, onBehalfOf?: {
+        id: string;
+        label?: string;
+    }): Promise<{
+        token: string;
+        callee: {
+            name: string;
+            deploymentUrl: string | null;
+        };
+        expiresAt: number;
+    }>;
+    /** Resolve each sender separately. Never substitute a room identity. No caching by design. */
+    resolveSpeaker(provider: string, externalId: string, label?: string): Promise<SpeakerResolution>;
+}
+export type SpeakerResolution = ({
+    linked: true;
+} & Omit<IdentitySession, "jwks"> & {
+    expiresIn: number;
+    user: {
+        id: string;
+        email: string;
+        displayName: string;
+    };
+}) | {
+    linked: false;
+    reason: "not_linked";
+    link: string;
+} | {
+    linked: false;
+    reason: "agent_not_granted" | "user_suspended" | "unknown_user";
+};

package/dist/client.js

@@ -0,0 +1,158 @@
+export class PortalHttpError extends Error {
+    status;
+    code;
+    link;
+    constructor(status, code, link) {
+        super(`Portal request failed (${status}, ${code})`);
+        this.status = status;
+        this.code = code;
+        this.link = link;
+        this.name = "PortalHttpError";
+    }
+}
+/** No credential storage or logging; instantiate in a trusted runtime for agent credentials. */
+export class PortalClient {
+    options;
+    base;
+    constructor(options) {
+        this.options = options;
+        this.base = new URL(options.issuer);
+        if (!["http:", "https:"].includes(this.base.protocol) ||
+            this.base.username ||
+            this.base.password)
+            throw new Error("Invalid portal URL");
+    }
+    async request(path, body, signal) {
+        if (!path.startsWith("/api/") || path.includes("..") || path.includes("\\"))
+            throw new Error("Invalid portal API path");
+        const url = new URL(path, this.base);
+        if (url.origin !== this.base.origin)
+            throw new Error("Cross-origin portal request");
+        const token = typeof this.options.token === "function"
+            ? await this.options.token()
+            : this.options.token;
+        const response = await (this.options.fetch ?? fetch)(url, {
+            method: body === undefined ? "GET" : "POST",
+            headers: {
+                ...(body !== undefined ? { "content-type": "application/json" } : {}),
+                ...(token ? { authorization: `Bearer ${token}` } : {}),
+            },
+            ...(body !== undefined ? { body: JSON.stringify(body) } : {}),
+            redirect: "error",
+            signal: signal
+                ? AbortSignal.any([
+                    signal,
+                    AbortSignal.timeout(this.options.timeoutMs ?? 15000),
+                ])
+                : AbortSignal.timeout(this.options.timeoutMs ?? 15000),
+        });
+        const data = await response.json().catch(() => null);
+        if (!response.ok)
+            throw new PortalHttpError(response.status, typeof data?.error === "string" && /^[a-z_]+$/.test(data.error)
+                ? data.error
+                : "request_failed", typeof data?.link === "string" &&
+                new URL(data.link, this.base).origin === this.base.origin
+                ? data.link
+                : undefined);
+        if (!data || typeof data !== "object")
+            throw new PortalHttpError(502, "invalid_response");
+        validateResponse(path, data);
+        return data;
+    }
+    startDevice(input = {}) {
+        return this.request("/api/oauth/device", input);
+    }
+    pollDevice(deviceCode) {
+        return this.request("/api/oauth/token", { device_code: deviceCode });
+    }
+    refresh(refreshToken) {
+        return this.request("/api/oauth/refresh", { refresh_token: refreshToken });
+    }
+    registerAgent(name, url) {
+        return this.request("/api/agents/register", { name, url });
+    }
+    mintAgentCredential(agent) {
+        return this.request("/api/agents/credential", {
+            agent,
+        });
+    }
+    startEnrollment(input) {
+        return this.request("/api/daemon/enroll", input);
+    }
+    pollEnrollment(deviceCode) {
+        return this.request("/api/daemon/enroll/poll", { device_code: deviceCode });
+    }
+    peers() {
+        return this.request("/api/agent/peers");
+    }
+    mintAgentSession(callee, onBehalfOf) {
+        return this.request("/api/agent/session", { callee, ...(onBehalfOf ? { onBehalfOf } : {}) });
+    }
+    /** Resolve each sender separately. Never substitute a room identity. No caching by design. */
+    async resolveSpeaker(provider, externalId, label) {
+        try {
+            const session = await this.request("/api/agent/identity", {
+                provider,
+                externalId,
+                ...(label ? { label } : {}),
+            });
+            return { linked: true, ...session };
+        }
+        catch (error) {
+            if (error instanceof PortalHttpError) {
+                if (error.status === 404 && error.code === "not_linked" && error.link)
+                    return { linked: false, reason: "not_linked", link: error.link };
+                if (error.status >= 400 &&
+                    error.status < 500 &&
+                    ["agent_not_granted", "user_suspended", "unknown_user"].includes(error.code))
+                    return {
+                        linked: false,
+                        reason: error.code,
+                    };
+            }
+            throw error;
+        }
+    }
+}
+function validateResponse(path, data) {
+    const strings = (...fields) => fields.every((key) => typeof data[key] === "string" && data[key].length > 0);
+    let valid = true;
+    if (["/api/oauth/device", "/api/daemon/enroll"].includes(path))
+        valid =
+            strings("device_code", "user_code", "verification_uri", "verification_uri_complete") &&
+                Number.isFinite(data.expires_in) &&
+                data.expires_in > 0 &&
+                Number.isFinite(data.interval);
+    if (["/api/oauth/token", "/api/oauth/refresh", "/api/agent/identity"].includes(path))
+        valid = strings("issuer", "token", "bundle");
+    if (["/api/oauth/token", "/api/oauth/refresh"].includes(path))
+        valid = valid && Array.isArray(data.jwks?.keys) && strings("refresh_token");
+    if (path === "/api/agents/register")
+        valid = strings("id", "name", "url") && typeof data.created === "boolean";
+    if (path === "/api/agents/credential")
+        valid = strings("credential");
+    if (path === "/api/daemon/enroll/poll")
+        valid = strings("credential", "org", "daemon_id");
+    if (path === "/api/agent/session")
+        valid =
+            strings("token") &&
+                typeof data.callee?.name === "string" &&
+                (data.callee.deploymentUrl === null ||
+                    typeof data.callee.deploymentUrl === "string") &&
+                Number.isFinite(data.expiresAt);
+    if (path === "/api/agent/peers")
+        valid =
+            Array.isArray(data.peers) &&
+                data.peers.every((p) => typeof p.name === "string" &&
+                    typeof p.url === "string" &&
+                    typeof p.purpose === "string");
+    if (path === "/api/agent/identity")
+        valid =
+            valid &&
+                Number.isFinite(data.expiresIn) &&
+                typeof data.user?.id === "string" &&
+                typeof data.user.email === "string" &&
+                typeof data.user.displayName === "string";
+    if (!valid)
+        throw new PortalHttpError(502, "invalid_response");
+}

package/dist/eve.d.ts

@@ -0,0 +1,4 @@
+import { type AuthFn } from "eve/channels/auth";
+import { type AuthOptions } from "./auth.js";
+/** Explicit Eve 0.49 adapter. Mounts no tools, skills, channels, or connections. */
+export declare function portalAuth(options: AuthOptions): AuthFn<Request>;

package/dist/eve.js

@@ -0,0 +1,36 @@
+import { ForbiddenError, UnauthenticatedError, } from "eve/channels/auth";
+import { createPortalVerifier } from "./auth.js";
+/** Explicit Eve 0.49 adapter. Mounts no tools, skills, channels, or connections. */
+export function portalAuth(options) {
+    const verifier = createPortalVerifier(options);
+    return async (request) => {
+        const result = await verifier.authenticate(request);
+        if (!result.ok) {
+            if (result.status === 403)
+                throw new ForbiddenError({
+                    code: result.code,
+                    message: "Portal access denied.",
+                });
+            if (result.status === 503)
+                throw new UnauthenticatedError({
+                    code: result.code,
+                    message: "Portal identity verification is temporarily unavailable.",
+                });
+            return null;
+        }
+        const p = result.principal;
+        return {
+            authenticator: "tealbrick",
+            issuer: options.issuer,
+            principalId: p.id,
+            principalType: p.type,
+            subject: p.subject,
+            attributes: {
+                org: p.org,
+                ...(p.level ? { agentGrantLevel: p.level } : {}),
+                ...(p.email ? { email: p.email } : {}),
+                ...(p.callerAgent ? { callerAgent: p.callerAgent, kind: "a2a" } : {}),
+            },
+        };
+    };
+}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./auth.js";
+export * from "./client.js";

package/dist/index.js

@@ -0,0 +1,2 @@
+export * from "./auth.js";
+export * from "./client.js";

package/package.json

@@ -0,0 +1,54 @@
+{
+  "name": "@tealbrick/portal",
+  "version": "0.1.0",
+  "type": "module",
+  "license": "MIT",
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE",
+    "NOTICE"
+  ],
+  "engines": {
+    "node": ">=24"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./eve": {
+      "types": "./dist/eve.d.ts",
+      "import": "./dist/eve.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "node --test test/*.test.mjs",
+    "check": "npm run build && npm test"
+  },
+  "dependencies": {
+    "jose": "^6.1.0"
+  },
+  "peerDependencies": {
+    "eve": ">=0.55.0 <0.56.0"
+  },
+  "peerDependenciesMeta": {
+    "eve": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "typescript": "^5.9.3",
+    "@types/node": "^24.0.0"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Doppelabs/tealbrick-packages.git",
+    "directory": "packages/portal"
+  }
+}