- createJwtUtils() factory with configurable issuer and expiry (jose)
- extractAuth() middleware for Fastify request auth extraction
- requireRole() guard with multi-role support
- hashPassword() / verifyPassword() via bcryptjs
- getCurrentUser() helper for Next.js API routes (generic TUser)
- AuthPayload, TokenPayload, JwtUtils types
- NO dependency on @bytelyst/config (reads JWT_SECRET from process.env directly)
- Peer deps: jose >=5.0.0, bcryptjs >=2.4.0