@carecard/jwt-read 3.18.0 → 3.19.0

package/lib/jwtLib.js

@@ -26,7 +26,12 @@ function doesJwtUserHasRole(req, userRole) {
 
   const jwtObj = req?.jwt || this;
 
-  if (!userRole || typeof userRole !== 'string' || !jwtObj?.payload?.roles || !Array.isArray(jwtObj.payload.roles)) {
+  if (
+    !userRole ||
+    typeof userRole !== 'string' ||
+    !jwtObj?.payload?.roles ||
+    !Array.isArray(jwtObj.payload.roles)
+  ) {
     throwNotAuthorizedError();
   }
 
@@ -40,7 +45,9 @@ function throwError(customErrorFunction) {
 
   const customError = customErrorFunction();
 
-  if (customError instanceof Error) throw customError;
+  if (customError instanceof Error) {
+    throw customError;
+  }
 
   throw new Error('Custom authentication error function returned without throwing');
 }
@@ -118,13 +125,26 @@ function validateAndExtractWebToken(req, publicKey, headerName, customErrorFunct
 
 // Pattern: Decorator - extends no-throw JWT extraction without changing req.jwt failure semantics.
 function validateAndExtractJwtObjectNoThrow(req, publicKey, options) {
-  _validateAndExtractGenericNoThrow(req, publicKey, _validateJwtNoThrow, _extractJwtObjectNoThrow, 'jwt');
+  _validateAndExtractGenericNoThrow(
+    req,
+    publicKey,
+    _validateJwtNoThrow,
+    _extractJwtObjectNoThrow,
+    'jwt',
+  );
   validateAndExtractOptionalUserAuthorizationObjectNoThrow(req, options);
   return req;
 }
 
 // Pattern: Decorator - keeps service-JWT checks distinct from optional user authorization context.
-function validateAndExtractServiceJwtObject(req, publicKey, expectedIssuer, expectedAudience, customErrorFunction, options) {
+function validateAndExtractServiceJwtObject(
+  req,
+  publicKey,
+  expectedIssuer,
+  expectedAudience,
+  customErrorFunction,
+  options,
+) {
   const jwtString = _validateJwt(req, customErrorFunction);
   const isJwtSignatureValid = jwtVerifySignedToken(jwtString, publicKey);
 
@@ -144,10 +164,21 @@ function validateAndExtractServiceJwtObject(req, publicKey, expectedIssuer, expe
 }
 
 // Pattern: Decorator - normalizes primary auth first, then applies optional scoped authorization.
-async function validateAndExtractJwtOrServerAuthObject(req, publicKey, serverAuthIntrospector, customErrorFunction, options) {
+async function validateAndExtractJwtOrServerAuthObject(
+  req,
+  publicKey,
+  serverAuthIntrospector,
+  customErrorFunction,
+  options,
+) {
   if (!tryValidateAndExtractJwtObject(req, publicKey)) {
     const serverAuthToken = _validateServerAuthToken(req, customErrorFunction);
-    const claims = await introspectServerAuthToken(serverAuthIntrospector, serverAuthToken, req, customErrorFunction);
+    const claims = await introspectServerAuthToken(
+      serverAuthIntrospector,
+      serverAuthToken,
+      req,
+      customErrorFunction,
+    );
     attachServerAuthClaims(req, claims, customErrorFunction);
   }
 
@@ -157,14 +188,26 @@ async function validateAndExtractJwtOrServerAuthObject(req, publicKey, serverAut
 
 // Pattern: Decorator - extends custom-header no-throw extraction with optional user authorization context.
 function validateAndExtractWebTokenObjectNoThrow(req, publicKey, headerName, options) {
-  _validateAndExtractGenericNoThrow(req, publicKey, r => _validateWebTokenNoThrow(r, headerName), _extractJwtObjectNoThrow, 'jwt');
+  _validateAndExtractGenericNoThrow(
+    req,
+    publicKey,
+    r => _validateWebTokenNoThrow(r, headerName),
+    _extractJwtObjectNoThrow,
+    'jwt',
+  );
   validateAndExtractOptionalUserAuthorizationObjectNoThrow(req, options);
   return req;
 }
 
 // Pattern: Decorator - keeps visitor token extraction independent from optional user authorization context.
 function validateAndExtractVisitorObjectNoThrow(req, publicKey, options) {
-  _validateAndExtractGenericNoThrow(req, publicKey, _validateVisitorNoThrow, _extractVisitorObjectNoThrow, 'visitor');
+  _validateAndExtractGenericNoThrow(
+    req,
+    publicKey,
+    _validateVisitorNoThrow,
+    _extractVisitorObjectNoThrow,
+    'visitor',
+  );
   validateAndExtractOptionalUserAuthorizationObjectNoThrow(req, options);
   return req;
 }
@@ -196,10 +239,23 @@ function verifyJwt(publicKey, customErrorFunction, options) {
 }
 
 // Pattern: Middleware - verifies service identity and optionally carries user authorization context.
-function verifyServiceJwt(publicKey, expectedIssuer, expectedAudience, customErrorFunction, options) {
+function verifyServiceJwt(
+  publicKey,
+  expectedIssuer,
+  expectedAudience,
+  customErrorFunction,
+  options,
+) {
   return function (req, res, next) {
     try {
-      validateAndExtractServiceJwtObject(req, publicKey, expectedIssuer, expectedAudience, customErrorFunction, options);
+      validateAndExtractServiceJwtObject(
+        req,
+        publicKey,
+        expectedIssuer,
+        expectedAudience,
+        customErrorFunction,
+        options,
+      );
       next();
     } catch (err) {
       next(err);
@@ -211,7 +267,13 @@ function verifyServiceJwt(publicKey, expectedIssuer, expectedAudience, customErr
 function verifyJwtOrServerAuth(publicKey, serverAuthIntrospector, customErrorFunction, options) {
   return async function (req, res, next) {
     try {
-      await validateAndExtractJwtOrServerAuthObject(req, publicKey, serverAuthIntrospector, customErrorFunction, options);
+      await validateAndExtractJwtOrServerAuthObject(
+        req,
+        publicKey,
+        serverAuthIntrospector,
+        customErrorFunction,
+        options,
+      );
       next();
     } catch (err) {
       next(err);
@@ -220,10 +282,22 @@ function verifyJwtOrServerAuth(publicKey, serverAuthIntrospector, customErrorFun
 }
 
 // Pattern: Middleware - composes flexible auth, optional user authorization, and role checks.
-function verifyJwtOrServerAuthAndHasRole(role, publicKey, serverAuthIntrospector, customErrorFunction, options) {
+function verifyJwtOrServerAuthAndHasRole(
+  role,
+  publicKey,
+  serverAuthIntrospector,
+  customErrorFunction,
+  options,
+) {
   return async function (req, res, next) {
     try {
-      await validateAndExtractJwtOrServerAuthObject(req, publicKey, serverAuthIntrospector, customErrorFunction, options);
+      await validateAndExtractJwtOrServerAuthObject(
+        req,
+        publicKey,
+        serverAuthIntrospector,
+        customErrorFunction,
+        options,
+      );
       const isRoleExist = doesJwtUserHasRole(req, role);
       _isLoginRequired(isRoleExist, customErrorFunction);
       next();
@@ -313,7 +387,9 @@ function validateAndExtractUserAuthorizationObject(req, publicKey, customErrorFu
   if (header.present && isUserAuthorizationTokenAllowed(header.token, config)) {
     _extractUserAuthorizationObjectNoThrow(req, header.token);
   } else {
-    if (req) req.userAuthorization = null;
+    if (req) {
+      req.userAuthorization = null;
+    }
     throwError(customErrorFunction);
   }
 
@@ -337,7 +413,9 @@ function validateAndExtractUserAuthorizationObjectNoThrow(req, publicKey, option
 // Pattern: Guard Clause - skips optional context handling unless a caller explicitly configured it.
 function validateAndExtractOptionalUserAuthorizationObject(req, options, customErrorFunction) {
   const config = createOptionalUserAuthorizationConfig(options);
-  if (!config) return req;
+  if (!config) {
+    return req;
+  }
 
   const header = readUserAuthorizationHeader(req, config);
   if (!header.present) {
@@ -358,7 +436,9 @@ function validateAndExtractOptionalUserAuthorizationObject(req, options, customE
 // Pattern: Guard Clause - optional no-throw context extraction never changes primary auth results.
 function validateAndExtractOptionalUserAuthorizationObjectNoThrow(req, options) {
   const config = createOptionalUserAuthorizationConfig(options);
-  if (!config) return req;
+  if (!config) {
+    return req;
+  }
 
   const header = readUserAuthorizationHeader(req, config);
   if (header.present && isUserAuthorizationTokenAllowed(header.token, config)) {
@@ -385,7 +465,9 @@ function _isLoginRequired(hasRequiredRole, customErrorFunction) {
 
 function tryValidateAndExtractJwtObject(req, publicKey) {
   const jwtString = _validateJwtNoThrow(req);
-  if (!jwtString || !isJwtString(jwtString)) return false;
+  if (!jwtString || !isJwtString(jwtString)) {
+    return false;
+  }
 
   const isJwtSignatureValid = jwtVerifySignedToken(jwtString, publicKey);
   if (!isJwtSignatureValid) {
@@ -400,7 +482,9 @@ function tryValidateAndExtractJwtObject(req, publicKey) {
 function _validateServerAuthToken(req, customErrorFunction) {
   const authorizationHeader = req?.get?.('Authorization') || req?.get?.('authorization');
   const token = _extractJwtNoThrow(authorizationHeader);
-  if (token) return token;
+  if (token) {
+    return token;
+  }
 
   throwError(customErrorFunction);
   return null;
@@ -422,7 +506,9 @@ async function introspectServerAuthToken(serverAuthIntrospector, token, req, cus
 function attachServerAuthClaims(req, claims, customErrorFunction) {
   const payload = createServerAuthPayload(claims);
   if (!payload.sub) {
-    if (req) req.jwt = null;
+    if (req) {
+      req.jwt = null;
+    }
     throwError(customErrorFunction);
   }
 
@@ -439,10 +525,9 @@ function attachServerAuthClaims(req, claims, customErrorFunction) {
 // Pattern: Projection - copies only authoritative verification names and preserves their exact values.
 function pickEmailVerificationClaims(claims) {
   return Object.fromEntries(
-    EMAIL_VERIFICATION_CLAIM_NAMES.filter(claimName => Object.prototype.hasOwnProperty.call(claims, claimName)).map(claimName => [
-      claimName,
-      claims[claimName],
-    ]),
+    EMAIL_VERIFICATION_CLAIM_NAMES.filter(claimName =>
+      Object.prototype.hasOwnProperty.call(claims, claimName),
+    ).map(claimName => [claimName, claims[claimName]]),
   );
 }
 
@@ -462,51 +547,85 @@ function createServerAuthPayload(claims) {
 }
 
 function readEpochSeconds(value) {
-  if (value === undefined || value === null || value === '') return undefined;
-  if (typeof value === 'number') return normalizeSeconds(value);
+  if (value === undefined || value === null || value === '') {
+    return undefined;
+  }
+  if (typeof value === 'number') {
+    return normalizeSeconds(value);
+  }
   const millis = Date.parse(value);
   return Number.isFinite(millis) ? Math.floor(millis / 1000) : undefined;
 }
 
 function normalizeSeconds(value) {
-  if (!Number.isFinite(value)) return null;
+  if (!Number.isFinite(value)) {
+    return null;
+  }
   return value > 1000000000000 ? Math.floor(value / 1000) : Math.floor(value);
 }
 
 function _isServiceJwtFor(payload, expectedIssuer, expectedAudience) {
-  if (!payload) return false;
-  if (payload.iss !== expectedIssuer) return false;
-  if (payload.sub !== expectedIssuer) return false;
-  if (!payloadAudienceMatches(payload.aud, expectedAudience)) return false;
-  if (isJwtPayloadIssuedInFuture(payload)) return false;
-  if (isJwtPayloadExpired(payload)) return false;
-  if (isJwtPayloadNotYetValid(payload)) return false;
+  if (!payload) {
+    return false;
+  }
+  if (payload.iss !== expectedIssuer) {
+    return false;
+  }
+  if (payload.sub !== expectedIssuer) {
+    return false;
+  }
+  if (!payloadAudienceMatches(payload.aud, expectedAudience)) {
+    return false;
+  }
+  if (isJwtPayloadIssuedInFuture(payload)) {
+    return false;
+  }
+  if (isJwtPayloadExpired(payload)) {
+    return false;
+  }
+  if (isJwtPayloadNotYetValid(payload)) {
+    return false;
+  }
   return true;
 }
 
 function payloadAudienceMatches(actualAudience, expectedAudience) {
-  if (Array.isArray(actualAudience)) return actualAudience.includes(expectedAudience);
+  if (Array.isArray(actualAudience)) {
+    return actualAudience.includes(expectedAudience);
+  }
   return actualAudience === expectedAudience;
 }
 
 function isJwtPayloadExpired(payload) {
-  if (!payload.exp) return true;
+  if (!payload.exp) {
+    return true;
+  }
   const exp = normalizeSeconds(payload.exp);
-  if (!Number.isInteger(exp)) return true;
+  if (!Number.isInteger(exp)) {
+    return true;
+  }
   return Math.floor(Date.now() / 1000) >= exp;
 }
 
 function isJwtPayloadIssuedInFuture(payload) {
-  if (!payload.iat) return true;
+  if (!payload.iat) {
+    return true;
+  }
   const iat = normalizeSeconds(payload.iat);
-  if (!Number.isInteger(iat)) return true;
+  if (!Number.isInteger(iat)) {
+    return true;
+  }
   return Math.floor(Date.now() / 1000) < iat;
 }
 
 function isJwtPayloadNotYetValid(payload) {
-  if (!payload.nbf) return false;
+  if (!payload.nbf) {
+    return false;
+  }
   const nbf = normalizeSeconds(payload.nbf);
-  if (!Number.isInteger(nbf)) return true;
+  if (!Number.isInteger(nbf)) {
+    return true;
+  }
   return Math.floor(Date.now() / 1000) < nbf;
 }
 
@@ -520,7 +639,9 @@ function createUserAuthorizationConfig(publicKey, options) {
 
 // Pattern: Factory - detects optional user authorization configuration without affecting legacy callers.
 function createOptionalUserAuthorizationConfig(options) {
-  if (!options || !Object.prototype.hasOwnProperty.call(options, 'userAuthorization')) return null;
+  if (!options || !Object.prototype.hasOwnProperty.call(options, 'userAuthorization')) {
+    return null;
+  }
   return normalizeUserAuthorizationConfig(options.userAuthorization || {});
 }
 
@@ -529,7 +650,10 @@ function normalizeUserAuthorizationConfig(options) {
   return {
     publicKey: options?.publicKey,
     headerName: options?.headerName || DEFAULT_USER_AUTHORIZATION_HEADER_NAME,
-    maxTokenLength: normalizePositiveInteger(options?.maxTokenLength, DEFAULT_USER_AUTHORIZATION_MAX_TOKEN_LENGTH),
+    maxTokenLength: normalizePositiveInteger(
+      options?.maxTokenLength,
+      DEFAULT_USER_AUTHORIZATION_MAX_TOKEN_LENGTH,
+    ),
     expectedType: options?.expectedType,
     expectedIssuer: options?.expectedIssuer,
     expectedAudience: options?.expectedAudience,
@@ -546,35 +670,59 @@ function normalizePositiveInteger(value, defaultValue) {
 function readUserAuthorizationHeader(req, config) {
   const rawToken = getRequestHeader(req, config.headerName);
   const present = rawToken !== undefined && rawToken !== null;
-  if (!present || typeof rawToken !== 'string') return { present, token: null };
+  if (!present || typeof rawToken !== 'string') {
+    return { present, token: null };
+  }
 
   const token = rawToken.trim();
-  if (!token || token.length > config.maxTokenLength || !isJwtString(token)) return { present: true, token: null };
+  if (!token || token.length > config.maxTokenLength || !isJwtString(token)) {
+    return { present: true, token: null };
+  }
   return { present: true, token };
 }
 
 // Pattern: Adapter - supports Express case-insensitive headers and simple test doubles.
 function getRequestHeader(req, headerName) {
   const value = req?.get?.(headerName);
-  if (value !== undefined && value !== null) return value;
+  if (value !== undefined && value !== null) {
+    return value;
+  }
 
   const lowerCaseHeaderName = headerName.toLowerCase();
-  if (lowerCaseHeaderName === headerName) return value;
+  if (lowerCaseHeaderName === headerName) {
+    return value;
+  }
   return req?.get?.(lowerCaseHeaderName);
 }
 
 // Pattern: Single Responsibility - verifies signature and registered JWT time claims for user authorization.
 function isUserAuthorizationTokenAllowed(token, config) {
-  if (!token || !config.publicKey || !jwtVerifySignedToken(token, config.publicKey)) return false;
+  if (!token || !config.publicKey || !jwtVerifySignedToken(token, config.publicKey)) {
+    return false;
+  }
 
   const payload = readVerifiedJwtPayload(token);
-  if (!payload) return false;
-  if (isJwtPayloadIssuedInFuture(payload)) return false;
-  if (isJwtPayloadExpired(payload)) return false;
-  if (isJwtPayloadNotYetValid(payload)) return false;
-  if (config.expectedType && payload.typ !== config.expectedType) return false;
-  if (config.expectedIssuer && payload.iss !== config.expectedIssuer) return false;
-  if (!expectedAudienceMatches(payload.aud, config.expectedAudience)) return false;
+  if (!payload) {
+    return false;
+  }
+  if (isJwtPayloadIssuedInFuture(payload)) {
+    return false;
+  }
+  if (isJwtPayloadExpired(payload)) {
+    return false;
+  }
+  if (isJwtPayloadNotYetValid(payload)) {
+    return false;
+  }
+  if (config.expectedType && payload.typ !== config.expectedType) {
+    return false;
+  }
+  if (config.expectedIssuer && payload.iss !== config.expectedIssuer) {
+    return false;
+  }
+  if (!expectedAudienceMatches(payload.aud, config.expectedAudience)) {
+    return false;
+  }
 
   return true;
 }
@@ -586,14 +734,20 @@ function readVerifiedJwtPayload(token) {
 
 // Pattern: Pure Function - supports either one expected audience or a small allowed set.
 function expectedAudienceMatches(actualAudience, expectedAudience) {
-  if (expectedAudience === undefined || expectedAudience === null || expectedAudience === '') return true;
-  if (Array.isArray(expectedAudience)) return expectedAudience.some(audience => payloadAudienceMatches(actualAudience, audience));
+  if (expectedAudience === undefined || expectedAudience === null || expectedAudience === '') {
+    return true;
+  }
+  if (Array.isArray(expectedAudience)) {
+    return expectedAudience.some(audience => payloadAudienceMatches(actualAudience, audience));
+  }
   return payloadAudienceMatches(actualAudience, expectedAudience);
 }
 
 function _validateGenericNoThrow(req, headerName, extractor) {
   let jwtRaw = req.get(headerName);
-  if (!jwtRaw) return null;
+  if (!jwtRaw) {
+    return null;
+  }
   let jwt = extractor(jwtRaw);
   return isJwtString(jwt) ? jwt : null;
 }
@@ -601,7 +755,9 @@ function _validateGenericNoThrow(req, headerName, extractor) {
 function _validateGeneric(req, headerName, extractor, customErrorFunction) {
   let jwtRaw = req.get(headerName);
   let jwt = extractor(jwtRaw, customErrorFunction);
-  if (isJwtString(jwt)) return jwt;
+  if (isJwtString(jwt)) {
+    return jwt;
+  }
   throwError(customErrorFunction);
   return null;
 }
@@ -617,7 +773,9 @@ function _validateAndExtractGenericNoThrow(req, publicKey, validator, extractor,
       req[propertyName] = null;
     }
   } catch (err) {
-    if (req) req[propertyName] = null;
+    if (req) {
+      req[propertyName] = null;
+    }
     throw err;
   }
   return req;
@@ -629,7 +787,9 @@ function _extractGenericObjectNoThrow(req, jwt, attacher, propertyName) {
     attacher(obj);
     req[propertyName] = obj;
   } else {
-    if (req) req[propertyName] = null;
+    if (req) {
+      req[propertyName] = null;
+    }
   }
 }
 

package/lib/jwtRoles.js

@@ -44,8 +44,12 @@ function getContext(req) {
 
 function getUserAuthorization(req) {
   const userAuthorization = req?.userAuthorization;
-  if (!userAuthorization || typeof userAuthorization !== 'object') return null;
-  if (!userAuthorization.payload || typeof userAuthorization.payload !== 'object') return null;
+  if (!userAuthorization || typeof userAuthorization !== 'object') {
+    return null;
+  }
+  if (!userAuthorization.payload || typeof userAuthorization.payload !== 'object') {
+    return null;
+  }
 
   return userAuthorization;
 }

package/lint-staged.config.mjs

@@ -0,0 +1,36 @@
+import { ESLint } from 'eslint';
+
+const eslint = new ESLint();
+
+// Pattern: Pure Function - builds one deterministic command without shell interpolation.
+const createCommand = (command, filePaths) =>
+  `${command} ${filePaths.map(filePath => JSON.stringify(filePath)).join(' ')}`;
+
+// Pattern: Adapter - derives lint-staged input from ESLint's authoritative ignore rules.
+const removeEslintIgnoredFiles = async filePaths => {
+  const ignoredFileStates = await Promise.all(
+    filePaths.map(filePath => eslint.isPathIgnored(filePath)),
+  );
+
+  return filePaths.flatMap((filePath, index) => (ignoredFileStates[index] ? [] : [filePath]));
+};
+
+// Pattern: Pipeline - preserves ESLint-before-Prettier ordering for staged code.
+const createJavaScriptTasks = async filePaths => {
+  const lintableFilePaths = await removeEslintIgnoredFiles(filePaths);
+  const tasks = [];
+
+  if (lintableFilePaths.length > 0) {
+    tasks.push(createCommand('eslint --fix --max-warnings 0', lintableFilePaths));
+  }
+
+  tasks.push(createCommand('prettier --write', filePaths));
+  return tasks;
+};
+
+const lintStagedConfig = {
+  '*.{js,jsx,mjs,cjs,ts,tsx,mts,cts}': createJavaScriptTasks,
+  '*.{json,jsonc,md,mdx,css,scss,yaml,yml}': ['prettier --write'],
+};
+
+export default lintStagedConfig;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@carecard/jwt-read",
-  "version": "3.18.0",
+  "version": "3.19.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/CareCard-ca/pkg-jwt-read.git"
@@ -10,15 +10,17 @@
   "types": "index.d.ts",
   "scripts": {
     "test": "node scripts/runPackageTask.mjs test",
-    "test:order": "node --test scripts/testOrder/randomizeTestOrder.test.mjs scripts/testOrder/testOrderPolicy.test.mjs scripts/testParallel/runIndexedMochaTests.test.mjs scripts/testParallel/parallelTestPolicy.test.mjs scripts/packageTaskRunner.test.mjs",
+    "test:order": "node --test scripts/testOrder/randomizeTestOrder.test.mjs scripts/testParallel/runIndexedMochaTests.test.mjs scripts/packageTaskRunner.test.mjs scripts/canonicalTestCommand.test.mjs",
     "test:types": "node scripts/runPackageTask.mjs test:types",
     "test:coverage": "node scripts/runPackageTask.mjs test:coverage",
     "test:All": "node scripts/runPackageTask.mjs test:All",
-    "format": "prettier --write .",
-    "format:check": "prettier --check .",
+    "validate:audits": "node scripts/runPackageTask.mjs validate:audits",
+    "format": "prettier --write \"**/*.{js,jsx,mjs,cjs,ts,tsx,mts,cts}\"",
+    "format:check": "prettier --check \"**/*.{js,jsx,mjs,cjs,ts,tsx,mts,cts}\"",
+    "lint-staged": "lint-staged",
     "prepare": "husky",
-    "lint:fix": "eslint --fix",
-    "lint": "eslint"
+    "lint:fix": "eslint . --fix --max-warnings 0",
+    "lint": "eslint . --max-warnings 0"
   },
   "keywords": [
     "auth",
@@ -29,15 +31,18 @@
   "author": "CareCard team",
   "license": "ISC",
   "devDependencies": {
+    "@eslint/js": "9.39.5",
     "@types/express": "5.0.6",
     "@types/mocha": "10.0.10",
     "@types/node": "25.9.3",
-    "eslint": "9.39.4",
+    "@typescript-eslint/parser": "8.67.0",
+    "eslint": "9.39.5",
+    "globals": "17.7.0",
     "husky": "9.1.7",
-    "lint-staged": "17.0.7",
+    "lint-staged": "17.2.0",
     "mocha": "11.7.6",
     "nyc": "18.0.0",
-    "prettier": "3.8.4",
+    "prettier": "3.9.6",
     "ts-node": "10.9.2",
     "typescript": "6.0.3"
   },
@@ -48,8 +53,9 @@
   },
   "overrides": {
     "diff": "8.0.4",
-    "minimatch": "10.2.5",
+    "brace-expansion": "5.0.9",
+    "minimatch": "10.2.6",
     "serialize-javascript": "7.0.5",
-    "js-yaml": "4.3.0"
+    "js-yaml": "4.3.1"
   }
 }

package/readme.md

@@ -14,7 +14,9 @@ introspected by `ms-auth`.
 
 ## Development Rule
 
-Non-negotiable TDD rule: Always write the failing test first, run it to confirm it fails for the intended reason, then implement the code and rerun the test until it passes. Test Driven Development is required for all coding work and must not be skipped. For documentation- or skill-only edits, add or update the relevant validation check before changing the prose.
+Non-negotiable TDD rule: Always write the failing test first, run it to confirm it fails for the intended reason, then implement the code and rerun the test until it passes. Test Driven Development is required for all coding work and must not be skipped. For documentation- or skill-only edits, run the relevant focused non-test
+validation before changing the prose; do not add automated tests that inspect
+prose, files, or repository structure.
 
 Non-negotiable repository isolation rule: Every repository must run its Husky hooks and tests using only files, code, fixtures, dependencies, and services contained within that repository. Tests and Husky scripts must not import, require, read, execute, or otherwise depend on sibling repositories or paths outside the repository root. app-e2e-tests is the only exception because cross-repository end-to-end testing is its explicit responsibility.
 
@@ -249,3 +251,22 @@ immediately when no helper remains, allow only a bounded 250 ms settlement
 window for already-stopping helpers, fail persistent descendants, preserve
 failures and output, use exit code `124` only for a real outer deadline, and
 remain a final guard rather than a substitute for explicit cleanup.
+
+## TDD And Validation
+
+Test Driven Development is a non-negotiable requirement.
+
+The sole purpose of automated tests is to verify observable functionality and externally visible behavior.
+Tests must validate what the system does through its public interfaces and expected outcomes.
+
+Tests must not assert, inspect, or depend on implementation details, including but not limited to:
+
+- The existence of specific lines of code, statements, functions, classes, files, or modules.
+- Specific algorithms, control flow, variable names, method calls, code snippets, or internal implementation choices.
+- Any internal structure that can change without changing externally observable behavior.
+
+A correct implementation may be completely rewritten or refactored without requiring changes to functional tests, provided its externally observable behavior remains unchanged.
+
+Any test that fails solely because the implementation changed while the externally observable behavior remained correct is incorrectly designed and must be rewritten or removed.
+
+This requirement is mandatory for all new tests and must be applied whenever existing tests are modified.