A CLI tool and SPI extension that maps Keycloak role attributes into OIDC token claims automatically

Keycloak removed its built-in script mapper in version 18 citing security concerns, leaving teams who need role-level attributes surfaced as OIDC token claims with no supported path. The only third-party SPI that fills this gap (nexiles/keycloak-client-role-attribute-mapper) targets Keycloak 21 and has not been updated for Keycloak 25 or 26, which ship breaking SPI API changes. This tool ships as a Keycloak SPI JAR plus a companion CLI that handles installation, configuration, and upgrade across Keycloak versions. Teams can declare which role attributes map to which claim names via a config file or admin-UI mapper panel, and the SPI injects those claims at token issuance time with no custom Java required from the operator. The CLI manages JAR deployment, version compatibility checks, and migration when Keycloak upgrades.