Claude Fable 5
3d1f4fda53
All checks were successful
CI / Build container images (pull_request) Successful in 3m51s
CI / Auth e2e pack (pull_request) Successful in 7m49s
CI / Import/export fidelity gate (pull_request) Successful in 56s
CI / Lint, typecheck, test (pull_request) Successful in 4m43s
CD / Build and push images (push) Successful in 20s
CD / Deploy to Test (push) Successful in 16s
CD / Smoke tests against Test (push) Successful in 1m19s
CD / Promote to Int (push) Successful in 11s
CI / Lint, typecheck, test (push) Successful in 4m54s
CI / Build container images (push) Has been skipped
CI / Auth e2e pack (push) Successful in 7m39s
CI / Import/export fidelity gate (push) Successful in 59s
COLLAB_TOKEN_SECRET becomes a root key: every purpose derives its own HKDF-SHA-256 subkey (deriveTokenKey), and no code path signs with the root key directly. Collaboration tokens are signed and verified by jose with HS256 as an explicit allowlist; the sign/verify API turns async at its three call sites. Unsubscribe tokens move from a purpose-prefix string to the structural subkey, with a documented dual-verify window (legacy derivation accepted until 2026-11-01, covering the 90-day TTL of links in already-sent mail). The cross-runtime property that justified the homegrown implementation is now proven by a test: the built CJS and ESM dist artefacts round-trip tokens in both directions in child processes (jose v6 reaches CJS via Node's require(esm), pinned Node 22 images). Negative tests cover cross-purpose subkeys, root-key-signed tokens, alg:none and RS256. Refs #188 (ADR 0020) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0168Ph5uBmHm8X28CSVpbpnJ
63 lines
1.6 KiB
JSON
63 lines
1.6 KiB
JSON
{
|
|
"name": "@dorfteich/shared",
|
|
"version": "0.0.0",
|
|
"private": true,
|
|
"description": "Types, schemas, and logic shared between web, api, and collab",
|
|
"license": "MIT",
|
|
"main": "./dist/index.js",
|
|
"module": "./dist/index.mjs",
|
|
"types": "./dist/index.d.ts",
|
|
"exports": {
|
|
".": {
|
|
"types": "./dist/index.d.ts",
|
|
"import": "./dist/index.mjs",
|
|
"require": "./dist/index.js"
|
|
},
|
|
"./token-crypto": {
|
|
"types": "./dist/token-crypto.d.ts",
|
|
"import": "./dist/token-crypto.mjs",
|
|
"require": "./dist/token-crypto.js"
|
|
},
|
|
"./webdav": {
|
|
"types": "./dist/webdav.d.ts",
|
|
"import": "./dist/webdav.mjs",
|
|
"require": "./dist/webdav.js"
|
|
},
|
|
"./i18n/*": "./i18n/*"
|
|
},
|
|
"//": "typesVersions maps the server-only subpaths for the api, which uses classic (node10) module resolution that ignores the exports field.",
|
|
"typesVersions": {
|
|
"*": {
|
|
"token-crypto": [
|
|
"./dist/token-crypto.d.ts"
|
|
],
|
|
"webdav": [
|
|
"./dist/webdav.d.ts"
|
|
]
|
|
}
|
|
},
|
|
"files": [
|
|
"dist",
|
|
"i18n"
|
|
],
|
|
"scripts": {
|
|
"build": "tsup src/index.ts src/token-crypto.ts src/webdav.ts --format esm,cjs --dts --clean",
|
|
"typecheck": "tsc --noEmit",
|
|
"test": "vitest run --passWithNoTests"
|
|
},
|
|
"dependencies": {
|
|
"jose": "^6.2.4",
|
|
"markdown-it": "^14.3.0",
|
|
"prosemirror-markdown": "^1.13.4",
|
|
"prosemirror-model": "^1.25.9",
|
|
"prosemirror-tables": "^1.8.5",
|
|
"zod": "^3.24.0"
|
|
},
|
|
"devDependencies": {
|
|
"@types/markdown-it": "^14.1.2",
|
|
"@types/node": "^26.1.0",
|
|
"tsup": "^8.3.0",
|
|
"vitest": "^3.0.0"
|
|
}
|
|
}
|