@carecard/jwt-read 3.1.28 → 3.2.0

package/.agents/skills/npm-package-flow/SKILL.md

@@ -0,0 +1,75 @@
+---
+name: npm-package-flow
+description: 'Use in pkg-* repositories when publishable package code changes require a version bump, GitHub development/main squash-merge flow, npm publication, and uncommitted consumer package updates in ms-* and app-dashboard.'
+---
+
+# npm Package Flow
+
+## Purpose
+
+Use this skill in a `pkg-*` repository when package code changes need to be
+published to npm and propagated to CareCard consumers.
+
+The package name is the `name` field in the repository `package.json`.
+
+## Publishable vs Non-Publishable Changes
+
+Publishable package changes include runtime source changes, public exports,
+TypeScript declarations, package metadata that affects consumers, security
+behavior, or dependency behavior that changes the package contract.
+
+The following are not publishable package changes by themselves:
+
+- Skills or `.agents` guidance.
+- Documentation and README updates.
+- Tests, fixtures, mocks, snapshots, or validation-only changes.
+- Formatting-only changes and comments.
+
+For non-publishable changes, do not bump the package version, publish to npm,
+or update `ms-*` and `app-dashboard` package versions.
+
+## Required Flow For Publishable Changes
+
+Run this workflow only when the user explicitly asks for package publication,
+remote GitHub merge work, or the full package-flow completion. Remote Git and
+GitHub operations must not be inferred.
+
+1. Finish package code, tests, documentation, and skill updates inside the
+   current `pkg-*` repository.
+2. Bump the package version in `package.json` and `package-lock.json` according
+   to the user request or the package change scope.
+3. Run the package's required tests, lint, type checks, and every direct Husky
+   script. Fix failures before continuing.
+4. Commit the package changes to the current branch.
+5. Push the current branch, create or reuse the PR into `development`,
+   squash-merge it with administrator privileges, and delete the merged branch.
+6. Create a new merge branch from the updated `development` branch and use that
+   branch to open a PR into `main`.
+7. Squash-merge the merge branch into `main` with administrator privileges and
+   delete the merge branch. This `main` merge publishes the package.
+8. Confirm publication with `npm view <package-name>@<version> version`.
+9. Check out a fresh local branch with the same name as the deleted working
+   branch from the updated `development` branch.
+10. Update the new `@carecard/...` package version in `app-dashboard` and in
+    only the `ms-*` repositories that already declare the package, plus any
+    explicitly intended new consumers.
+11. Run `npm install` and relevant validation in each updated consumer.
+12. Do not commit the `ms-*` or `app-dashboard` consumer updates unless the user
+    explicitly asks.
+
+## Consumer Update Rules
+
+- Discover existing consumers by checking each target repository `package.json`
+  for the published package name.
+- Install exact package versions, for example
+  `npm install <package-name>@<version> --save-exact`.
+- Keep consumer updates local and uncommitted unless the user gives a separate
+  commit or PR instruction.
+- If a consumer should become a new dependency, require explicit user intent for
+  that repository.
+
+## Reporting
+
+Report the package name, published version, development PR, main PR, npm
+publication check, consumer repositories updated, validation commands run, and
+any consumer updates intentionally left uncommitted.

package/.agents/skills/npm-package-flow/agents/openai.yaml

@@ -0,0 +1,5 @@
+interface:
+  display_name: 'npm Package Flow'
+  short_description: 'Use in pkg-* repositories when publishable @carecard package code changes need npm publication and consumer updates.'
+  brand_color: '#0F766E'
+  default_prompt: 'Use $npm-package-flow when this task matches the skill scope.'

package/.agents/skills/pkg-jwt-read-jwt-middleware-library/SKILL.md

@@ -106,6 +106,11 @@ depend on those folders being present.
 - Request attachment behavior for authenticated JWT objects and visitor tokens.
 - Request attachment behavior for compact scoped authorization-context JWTs
   from `X-Authorization-Context` as `req.userAuthorization`.
+- Shared header defaults for scoped authorization context:
+  `DEFAULT_USER_AUTHORIZATION_HEADER_NAME` and
+  `DEFAULT_USER_AUTHORIZATION_MAX_TOKEN_LENGTH`. Token issuers and consuming
+  services should import these constants instead of duplicating the header name
+  or 2048-character limit.
 - Server-auth request attachment behavior that normalizes introspected claims
   into `req.jwt.payload` with `authMode: "server-auth"` and
   `auth_mode: "server-auth"`.

package/index.d.ts

@@ -4,6 +4,9 @@
 
 import { NextFunction, Request, Response } from 'express';
 
+export const DEFAULT_USER_AUTHORIZATION_HEADER_NAME: 'X-Authorization-Context';
+export const DEFAULT_USER_AUTHORIZATION_MAX_TOKEN_LENGTH: 2048;
+
 /**
  * Represents the standard JWT header structure.
  */

package/index.js

@@ -2,6 +2,8 @@ const jwtLib = require('./lib/jwtLib');
 const jwtRoles = require('./lib/jwtRoles');
 
 module.exports = {
+  DEFAULT_USER_AUTHORIZATION_HEADER_NAME: jwtLib.DEFAULT_USER_AUTHORIZATION_HEADER_NAME,
+  DEFAULT_USER_AUTHORIZATION_MAX_TOKEN_LENGTH: jwtLib.DEFAULT_USER_AUTHORIZATION_MAX_TOKEN_LENGTH,
   jwtVerify: jwtLib.verifyJwt,
   jwtVerifyWebToken: jwtLib.verifyWebToken,
   jwtVerifyNoThrow: jwtLib.verifyJwtNoThrow,

package/lib/jwtLib.js

@@ -752,6 +752,8 @@ function _extractWebTokenNoThrow(jwtRaw) {
 }
 
 module.exports = {
+  DEFAULT_USER_AUTHORIZATION_HEADER_NAME,
+  DEFAULT_USER_AUTHORIZATION_MAX_TOKEN_LENGTH,
   _validateJwt,
   _validateJwtNoThrow,
   _isJwtSignatureValid,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@carecard/jwt-read",
-  "version": "3.1.28",
+  "version": "3.2.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/CareCard-ca/pkg-jwt-read.git"
@@ -41,8 +41,8 @@
     "typescript": "6.0.3"
   },
   "dependencies": {
-    "@carecard/auth-util": "3.1.16",
-    "@carecard/common-util": "3.1.15",
-    "@carecard/validate": "3.1.27"
+    "@carecard/auth-util": "3.2.0",
+    "@carecard/common-util": "3.2.0",
+    "@carecard/validate": "3.3.0"
   }
 }

package/readme.md

@@ -141,6 +141,9 @@ database context and role checks.
 Use `jwtVerifyUserAuthorization` when a route needs to verify only the compact
 authorization-context token carried in `X-Authorization-Context`. The token is
 read as a raw JWT header value, not as `Bearer <token>`.
+The exported `DEFAULT_USER_AUTHORIZATION_MAX_TOKEN_LENGTH` is `2048`; token
+issuers and consumers should use that shared constant instead of duplicating a
+local limit.
 
 ```javascript
 const { jwtVerifyUserAuthorization } = require('@carecard/jwt-read');