v0.2.2

Simplified JWT authentication. Cleaner config, less moving parts.

💥 Breaking changes

JWT config structure changed — The nested validation block is gone. Update your config:

# Before
middleware:
  jwt:
    enabled: true
    validation:
      strategy: "local"
      forwarded_header: "X-Validated-JWT"
      local:
        jwks_uri: "https://your-idp.com/.well-known/jwks.json"
        cache_interval: 5m

# After
middleware:
  jwt:
    enabled: true
    jwks_uri: "https://your-idp.com/.well-known/jwks.json"
    cache_interval: 5m

✨ What's new

Local-only JWT validation — The server always validates JWTs itself against the JWKS endpoint. The forwarded strategy has been removed.

Payload in context — The decoded JWT payload is passed through context once and reused by tool policies. No double-decoding.

📝 Notes

If you were using the forwarded strategy, disable the JWT middleware (enabled: false) and handle validation at the infrastructure level.