{"_id":"@bluelamp/auth-sdk","_rev":"4-9c3be6d3f4a440b7bc7ae5c0605543d8","name":"@bluelamp/auth-sdk","dist-tags":{"latest":"0.1.3"},"versions":{"0.1.0":{"name":"@bluelamp/auth-sdk","version":"0.1.0","keywords":["bluelamp","jwt","jwks","express","authentication","mcp"],"author":{"name":"BlueLamp","email":"dev@bluelamp.app"},"license":"MIT","_id":"@bluelamp/auth-sdk@0.1.0","maintainers":[{"name":"bluelamp","email":"shiraishi.tatsuya@mikoto.co.jp"}],"dist":{"shasum":"0a7fdbc80aa9414b778eb4764c0d665488e6f92e","tarball":"https://registry.npmjs.org/@bluelamp/auth-sdk/-/auth-sdk-0.1.0.tgz","fileCount":22,"integrity":"sha512-MgVK+Btdh5mkQAFtVh3OeZfwK3ocpINMwWR4/oOPhz+Tr/t+2ziBdEH+eCo2Nj6zQVa+6o3s1mgwUDw97UN+mQ==","signatures":[{"sig":"MEQCIC2QK0oybSx5BCBbPfQGbm5oTdHpq/326NJi3GAk7PfSAiBymV+GszVuh2+BNm8ySK+Mp/sxpji4D0WHppkXVDS6jA==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":25121},"main":"dist/index.js","types":"dist/index.d.ts","engines":{"node":">=18"},"gitHead":"71db76c95f9e8c6c90fd1c17cdfba22ed5d2fa88","scripts":{"build":"tsc","smoke":"tsx scripts/smoke.ts","prepublishOnly":"npm run build"},"_npmUser":{"name":"bluelamp","email":"shiraishi.tatsuya@mikoto.co.jp"},"_npmVersion":"11.6.0","description":"BlueLamp 外部API連携MCP認証SDK: JWKS キャッシュ付き JWT 検証 Express ミドルウェアを提供する","directories":{},"_nodeVersion":"24.10.0","dependencies":{"jwks-rsa":"^3.1.0","jsonwebtoken":"^9.0.2"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.7.0","express":"^4.22.1","typescript":"^5.3.3","@types/node":"^20.11.0","@types/express":"^4.17.21","@types/jsonwebtoken":"^9.0.7"},"peerDependencies":{"express":"^4.17.0 || ^5.0.0"},"peerDependenciesMeta":{"express":{"optional":true}},"_npmOperationalInternal":{"tmp":"tmp/auth-sdk_0.1.0_1776771249749_0.8239089307186616","host":"s3://npm-registry-packages-npm-production"}},"0.1.1":{"name":"@bluelamp/auth-sdk","version":"0.1.1","keywords":["bluelamp","jwt","jwks","express","authentication","mcp"],"author":{"name":"BlueLamp","email":"dev@bluelamp.app"},"license":"MIT","_id":"@bluelamp/auth-sdk@0.1.1","maintainers":[{"name":"bluelamp","email":"shiraishi.tatsuya@mikoto.co.jp"}],"dist":{"shasum":"7ded4dabf0f46f586ac98fd51abdd3f1b40ab91b","tarball":"https://registry.npmjs.org/@bluelamp/auth-sdk/-/auth-sdk-0.1.1.tgz","fileCount":22,"integrity":"sha512-AQsLNty/JXZ6hc/FlqqFNKm0oHxZdEQGPDgUPvosWewROHlMCVX/evQ3QBDNQXTA8MxcfnARcDFn1TKqGuXqmg==","signatures":[{"sig":"MEQCIFqJAfQ3l5sVpxJA65x6n6z9vFQZ9yaFZHvQnWscQErfAiA0Ghl/L/wAqP4tcOBh5jkWqUa3tnFybEwrLW21tf5Y9w==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":25218},"main":"dist/index.js","types":"dist/index.d.ts","engines":{"node":">=18"},"gitHead":"a954d769885f27b67bac10b3127eda0bf9e83b3a","scripts":{"build":"tsc","smoke":"tsx scripts/smoke.ts","prepublishOnly":"npm run build"},"_npmUser":{"name":"bluelamp","email":"shiraishi.tatsuya@mikoto.co.jp"},"_npmVersion":"11.6.0","description":"BlueLamp 外部API連携MCP認証SDK: JWKS キャッシュ付き JWT 検証 Express ミドルウェアを提供する","directories":{},"_nodeVersion":"24.10.0","dependencies":{"jwks-rsa":"^3.1.0","jsonwebtoken":"^9.0.2"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.7.0","express":"^4.22.1","typescript":"^5.3.3","@types/node":"^20.11.0","@types/express":"^4.17.21","@types/jsonwebtoken":"^9.0.7"},"peerDependencies":{"express":"^4.17.0 || ^5.0.0"},"peerDependenciesMeta":{"express":{"optional":true}},"_npmOperationalInternal":{"tmp":"tmp/auth-sdk_0.1.1_1776772511168_0.6738937511491272","host":"s3://npm-registry-packages-npm-production"}},"0.1.2":{"name":"@bluelamp/auth-sdk","version":"0.1.2","keywords":["bluelamp","jwt","jwks","express","authentication","mcp"],"author":{"name":"BlueLamp","email":"dev@bluelamp.app"},"license":"MIT","_id":"@bluelamp/auth-sdk@0.1.2","maintainers":[{"name":"bluelamp","email":"shiraishi.tatsuya@mikoto.co.jp"}],"dist":{"shasum":"92a633c47dfa164c778543fc8613f970448df711","tarball":"https://registry.npmjs.org/@bluelamp/auth-sdk/-/auth-sdk-0.1.2.tgz","fileCount":22,"integrity":"sha512-y76G1ALTuBaqJBHKtvB5T1/+yBW/FBFKLXrOhHfNitcfWZhGbBniZI8sSdLA7xRFaedJIxxQzYPuqmdElEZJ2Q==","signatures":[{"sig":"MEUCIQCV5IhinJczoOMAs74c9Fm0/myC5lP1A9oZP7xajcJ5xQIgXk8/ATetYgWDkAHIc44EQwgIE+YLzx+q+wUSd53n6zo=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":29007},"main":"dist/index.js","types":"dist/index.d.ts","engines":{"node":">=18"},"gitHead":"5de7d02e002deab9945000244904c59737673dca","scripts":{"build":"tsc","smoke":"tsx scripts/smoke.ts","prepublishOnly":"npm run build"},"_npmUser":{"name":"bluelamp","email":"shiraishi.tatsuya@mikoto.co.jp"},"_npmVersion":"11.6.0","description":"BlueLamp 外部API連携MCP認証SDK: JWKS キャッシュ付き JWT 検証 Express ミドルウェアを提供する","directories":{},"_nodeVersion":"24.10.0","dependencies":{"jwks-rsa":"^3.1.0","jsonwebtoken":"^9.0.2"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.7.0","express":"^4.22.1","typescript":"^5.3.3","@types/node":"^20.11.0","@types/express":"^4.17.21","@types/jsonwebtoken":"^9.0.7"},"peerDependencies":{"express":"^4.17.0 || ^5.0.0"},"peerDependenciesMeta":{"express":{"optional":true}},"_npmOperationalInternal":{"tmp":"tmp/auth-sdk_0.1.2_1778910746792_0.20166382302814112","host":"s3://npm-registry-packages-npm-production"}},"0.1.3":{"name":"@bluelamp/auth-sdk","version":"0.1.3","description":"BlueLamp 外部API連携MCP認証SDK: JWKS キャッシュ付き JWT 検証 Express ミドルウェアを提供する","keywords":["bluelamp","jwt","jwks","express","authentication","mcp"],"license":"MIT","author":{"name":"BlueLamp","email":"dev@bluelamp.app"},"main":"dist/index.js","types":"dist/index.d.ts","publishConfig":{"access":"public"},"scripts":{"build":"tsc","tsc":"tsc --noEmit","test":"echo 'no unit tests' && exit 0","prepublishOnly":"npm run build","smoke":"tsx scripts/smoke.ts"},"dependencies":{"jsonwebtoken":"^9.0.2","jwks-rsa":"^3.1.0"},"peerDependencies":{"express":"^4.17.0 || ^5.0.0"},"peerDependenciesMeta":{"express":{"optional":true}},"devDependencies":{"@types/express":"^4.17.21","@types/jsonwebtoken":"^9.0.7","@types/node":"^20.11.0","express":"^4.22.1","tsx":"^4.7.0","typescript":"^5.3.3"},"engines":{"node":">=18"},"_id":"@bluelamp/auth-sdk@0.1.3","gitHead":"60d156e0cf2b8a45807c9b020a8f7d9348eebd9a","_nodeVersion":"24.10.0","_npmVersion":"11.6.0","dist":{"integrity":"sha512-BLexo2y4vag+TlwltthFyA1JlrU01flbX+IwV96D6yBdp2Adc9LCZYX7uLlYymWYyj0fYhnaaNZRe5R1BM+9zQ==","shasum":"4f9ef3d6091ce747cc61423aebf53427ef2ded03","tarball":"https://registry.npmjs.org/@bluelamp/auth-sdk/-/auth-sdk-0.1.3.tgz","fileCount":22,"unpackedSize":31166,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEQCIEkksL04KvIZzqYcR14PUA/Q55OEojqQoFcUWrR8iXVhAiBBbsivUM+sIZZCPx7SlpTGOB5ckoOSJjWi400sqqIIsw=="}]},"_npmUser":{"name":"bluelamp","email":"shiraishi.tatsuya@mikoto.co.jp"},"directories":{},"maintainers":[{"name":"bluelamp","email":"shiraishi.tatsuya@mikoto.co.jp"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/auth-sdk_0.1.3_1779847442472_0.9067644478504442"},"_hasShrinkwrap":false}},"time":{"created":"2026-04-21T11:34:09.648Z","modified":"2026-05-27T02:04:02.827Z","0.1.0":"2026-04-21T11:34:09.885Z","0.1.1":"2026-04-21T11:55:11.306Z","0.1.2":"2026-05-16T05:52:26.937Z","0.1.3":"2026-05-27T02:04:02.717Z"},"author":{"name":"BlueLamp","email":"dev@bluelamp.app"},"license":"MIT","keywords":["bluelamp","jwt","jwks","express","authentication","mcp"],"description":"BlueLamp 外部API連携MCP認証SDK: JWKS キャッシュ付き JWT 検証 Express ミドルウェアを提供する","maintainers":[{"name":"bluelamp","email":"shiraishi.tatsuya@mikoto.co.jp"}],"readme":"# @bluelamp/auth-sdk\n\nBlueLamp 外部API連携 MCP 認証基盤（Phase 31）の検証側 SDK。\n\n- BlueLamp が発行した短命 JWT を JWKS で検証する Express ミドルウェア\n- `aud` / `iss` / `exp` / 署名 / `scope` を自動チェック\n- JWKS は内部で 1 時間キャッシュ（`jwks-rsa`）\n- 起動時に jwksUri / audience の HTTPS 強制（開発時 localhost 例外）\n\n## インストール\n\n```bash\nnpm install @bluelamp/auth-sdk\n```\n\nNode.js 18+ が必要です。\n\n## クイックスタート（Express）\n\n```ts\nimport express from 'express';\nimport { bluelampAuth } from '@bluelamp/auth-sdk';\n\nconst app = express();\n\napp.use('/api/contracts', bluelampAuth({\n  jwksUri: 'https://motohi-api-235426778039.asia-northeast1.run.app/.well-known/jwks.json',\n  audience: 'https://mikoto-company-api-235426778039.asia-northeast1.run.app',\n  requiredScope: 'contract:read',\n}));\n\napp.get('/api/contracts', (req, res) => {\n  // req.user は検証済み BlueLamp JWT payload\n  res.json({\n    customer: req.user?.sub,\n    tenant: req.user?.['bl:tenant_id'],\n    tenant_rank: req.user?.['bl:tenant_rank'],\n  });\n});\n```\n\nJWT が欠落・署名不正・期限切れなら `401`、`requiredScope` 未満なら `403 insufficient_scope`。\n\n## Fastify（`@fastify/express` 経由）\n\nFastify は Express ミドルウェアを `@fastify/express` プラグインでそのまま利用できます。\n\n```ts\nimport Fastify from 'fastify';\nimport expressPlugin from '@fastify/express';\nimport { bluelampAuth } from '@bluelamp/auth-sdk';\n\nconst app = Fastify();\nawait app.register(expressPlugin);\n\napp.use('/api/contracts', bluelampAuth({\n  jwksUri: process.env.BLUELAMP_JWKS_URI!,\n  audience: process.env.API_AUDIENCE!,\n  requiredScope: 'contract:read',\n}));\n\napp.get('/api/contracts', async (req) => ({\n  customer: (req.raw as any).user?.sub,\n}));\n```\n\n## Hono（Node.js アダプタ経由）\n\nHono の Node.js アダプタは Express 互換の middleware を受け取れません。そのため Hono では `jsonwebtoken` + `jwks-rsa` を直接使うか、SDK 内部の `createJwksResolver` を流用してください。将来的に Hono 向けヘルパーを追加予定です。\n\n暫定例:\n\n```ts\nimport { Hono } from 'hono';\nimport { bearerAuth } from 'hono/bearer-auth';\nimport jwt from 'jsonwebtoken';\nimport jwksClient from 'jwks-rsa';\n\nconst keys = jwksClient({\n  jwksUri: process.env.BLUELAMP_JWKS_URI!,\n  cache: true,\n  cacheMaxAge: 60 * 60 * 1000,\n});\n\nconst app = new Hono();\napp.use('/api/contracts/*', async (c, next) => {\n  const token = c.req.header('Authorization')?.replace(/^Bearer\\s+/, '');\n  if (!token) return c.json({ error: 'missing_token' }, 401);\n  try {\n    const payload = await new Promise((resolve, reject) => {\n      jwt.verify(\n        token,\n        (header, cb) => {\n          if (!header.kid) return cb(new Error('missing kid'));\n          keys.getSigningKey(header.kid, (err, key) => {\n            if (err) return cb(err);\n            cb(null, key!.getPublicKey());\n          });\n        },\n        { audience: process.env.API_AUDIENCE, algorithms: ['RS256'] },\n        (err, decoded) => (err ? reject(err) : resolve(decoded)),\n      );\n    });\n    c.set('user', payload);\n  } catch (e) {\n    return c.json({ error: 'invalid_token', message: (e as Error).message }, 401);\n  }\n  await next();\n});\n```\n\n## Options\n\n| フィールド | 型 | 必須 | 説明 |\n|---|---|:-:|---|\n| `jwksUri` | string | ✅ | JWKS エンドポイント URL。https:// 必須（localhost は dev のみ） |\n| `audience` | string | ✅ | 外部 API 自身の audience。JWT `aud` と厳密一致 |\n| `requiredScope` | string | - | このエンドポイントで必須の scope。未指定なら scope チェックをスキップ |\n| `cacheMaxAge` | number | - | JWKS キャッシュ TTL（秒）。default 3600 |\n| `issuer` | string | - | iss 一致検証。未指定なら検証しない |\n\n## エラーレスポンス\n\n| HTTP | body.error | 発生ケース |\n|---|---|---|\n| 401 | `missing_token` | Authorization ヘッダ欠落 |\n| 401 | `invalid_token` | 署名不正 / 形式不正 / aud 不一致 / iss 不一致 |\n| 401 | `token_expired` | exp 経過 |\n| 401 | `token_not_active` | nbf 未到達 |\n| 403 | `insufficient_scope` | `requiredScope` が JWT scope に含まれない |\n\n## 起動時バリデーション（§11.8 HTTPS 強制）\n\n`bluelampAuth()` は呼ばれた時点で以下を検証し、不正なら `BluelampAuthConfigError` を throw してサーバー起動を止めます:\n\n- `jwksUri` が `https://` で始まる（例外: NODE_ENV=development かつ host が `localhost` / `127.0.0.1` / `[::1]`）\n- `audience` が `https://` で始まる（同上）\n\n本番環境で誤って `http://` を設定した場合、アプリ起動時に即エラーになるのでサイレント失敗を防げます。\n\n## 動作確認\n\nBlueLamp portal のリポジトリ内:\n\n```bash\ncd packages/auth-sdk\nnpm run smoke\n```\n\nmotohi-api の live JWKS / Token Exchange と統合確認します（`CLI_TOKEN` 環境変数が必要）。\n\n## ライセンス\n\nMIT\n","readmeFilename":"README.md"}