Slice 8: jotsmith token mint v2 (custom claims: --claim, --claim-json, --claims-file)

[MaxAnderson95]

What to build

Layer custom-claim sources onto jotsmith token mint:

• --claim k=v — string-valued, repeatable
• --claim-json k=<json> — JSON-valued, repeatable; supports numbers, booleans, arrays, objects
• --claims-file <path> — JSON object merged in wholesale

Merge precedence (lowest → highest): --claims-file < --claim-json < --claim. Standard-claim flags from #7 always win, regardless of what any custom source tried to set.

Acceptance criteria

• --claim k=v repeatable; values always strings; invalid key=value syntax → exit 2 with clear stderr error
• --claim-json k=<json> repeatable; value parsed as JSON; supports numbers, booleans, arrays, nested objects; invalid JSON → exit 2
• --claims-file <path> reads a JSON object from the file; non-object root or invalid JSON → exit 2
• Merge order is exactly claims-file < claim-json < claim < standard-claim flags
• Trying to set iss from any custom source is silently ignored (config wins); documented behavior, with a unit test that asserts iss matches config even when --claim iss=evil is passed
• Trying to set any other standard claim from a custom source loses to the matching standard-claim flag; if the standard flag wasn't passed, the custom value is accepted
• --help for token mint spells out the precedence explicitly
• Unit tests cover each merge layer in isolation and the standard-vs-custom override matrix

Blocked by

• Slice 7: jotsmith token mint v1 (standard claims, KV Sign integration) #7 — token mint v1 (standard claims)

Originally created in OpenCode session ID: ses_17ca8efd8ffexLcFSysAMDVNBQ

[MaxAnderson95]

Implemented and merged in #14.

Originally created in OpenCode session ID: ses_17c986ef9ffeHc0S3r1wQcmLDT