@carecard/jwt-read 3.18.0 → 3.20.0

package/lib/jwtLib.js

@@ -26,7 +26,12 @@ function doesJwtUserHasRole(req, userRole) {
 
   const jwtObj = req?.jwt || this;
 
-  if (!userRole || typeof userRole !== 'string' || !jwtObj?.payload?.roles || !Array.isArray(jwtObj.payload.roles)) {
+  if (
+    !userRole ||
+    typeof userRole !== 'string' ||
+    !jwtObj?.payload?.roles ||
+    !Array.isArray(jwtObj.payload.roles)
+  ) {
     throwNotAuthorizedError();
   }
 
@@ -40,7 +45,9 @@ function throwError(customErrorFunction) {
 
   const customError = customErrorFunction();
 
-  if (customError instanceof Error) throw customError;
+  if (customError instanceof Error) {
+    throw customError;
+  }
 
   throw new Error('Custom authentication error function returned without throwing');
 }
@@ -90,6 +97,7 @@ function validateAndExtractJwtObject(req, publicKey, customErrorFunction, option
 
   if (jwtString && isJwtSignatureValid) {
     _extractJwtObject(req, jwtString, customErrorFunction);
+    requireActiveExtractedToken(req, 'jwt', customErrorFunction);
     validateAndExtractOptionalUserAuthorizationObject(req, options, customErrorFunction);
   } else {
     req['jwt'] = null;
@@ -107,6 +115,7 @@ function validateAndExtractWebToken(req, publicKey, headerName, customErrorFunct
 
   if (webTokenString && isJwtSignatureValid) {
     _extractJwtObject(req, webTokenString, customErrorFunction);
+    requireActiveExtractedToken(req, 'jwt', customErrorFunction);
     validateAndExtractOptionalUserAuthorizationObject(req, options, customErrorFunction);
   } else {
     req['jwt'] = null;
@@ -118,13 +127,26 @@ function validateAndExtractWebToken(req, publicKey, headerName, customErrorFunct
 
 // Pattern: Decorator - extends no-throw JWT extraction without changing req.jwt failure semantics.
 function validateAndExtractJwtObjectNoThrow(req, publicKey, options) {
-  _validateAndExtractGenericNoThrow(req, publicKey, _validateJwtNoThrow, _extractJwtObjectNoThrow, 'jwt');
+  _validateAndExtractGenericNoThrow(
+    req,
+    publicKey,
+    _validateJwtNoThrow,
+    _extractJwtObjectNoThrow,
+    'jwt',
+  );
   validateAndExtractOptionalUserAuthorizationObjectNoThrow(req, options);
   return req;
 }
 
 // Pattern: Decorator - keeps service-JWT checks distinct from optional user authorization context.
-function validateAndExtractServiceJwtObject(req, publicKey, expectedIssuer, expectedAudience, customErrorFunction, options) {
+function validateAndExtractServiceJwtObject(
+  req,
+  publicKey,
+  expectedIssuer,
+  expectedAudience,
+  customErrorFunction,
+  options,
+) {
   const jwtString = _validateJwt(req, customErrorFunction);
   const isJwtSignatureValid = jwtVerifySignedToken(jwtString, publicKey);
 
@@ -144,10 +166,21 @@ function validateAndExtractServiceJwtObject(req, publicKey, expectedIssuer, expe
 }
 
 // Pattern: Decorator - normalizes primary auth first, then applies optional scoped authorization.
-async function validateAndExtractJwtOrServerAuthObject(req, publicKey, serverAuthIntrospector, customErrorFunction, options) {
+async function validateAndExtractJwtOrServerAuthObject(
+  req,
+  publicKey,
+  serverAuthIntrospector,
+  customErrorFunction,
+  options,
+) {
   if (!tryValidateAndExtractJwtObject(req, publicKey)) {
     const serverAuthToken = _validateServerAuthToken(req, customErrorFunction);
-    const claims = await introspectServerAuthToken(serverAuthIntrospector, serverAuthToken, req, customErrorFunction);
+    const claims = await introspectServerAuthToken(
+      serverAuthIntrospector,
+      serverAuthToken,
+      req,
+      customErrorFunction,
+    );
     attachServerAuthClaims(req, claims, customErrorFunction);
   }
 
@@ -157,14 +190,26 @@ async function validateAndExtractJwtOrServerAuthObject(req, publicKey, serverAut
 
 // Pattern: Decorator - extends custom-header no-throw extraction with optional user authorization context.
 function validateAndExtractWebTokenObjectNoThrow(req, publicKey, headerName, options) {
-  _validateAndExtractGenericNoThrow(req, publicKey, r => _validateWebTokenNoThrow(r, headerName), _extractJwtObjectNoThrow, 'jwt');
+  _validateAndExtractGenericNoThrow(
+    req,
+    publicKey,
+    r => _validateWebTokenNoThrow(r, headerName),
+    _extractJwtObjectNoThrow,
+    'jwt',
+  );
   validateAndExtractOptionalUserAuthorizationObjectNoThrow(req, options);
   return req;
 }
 
 // Pattern: Decorator - keeps visitor token extraction independent from optional user authorization context.
 function validateAndExtractVisitorObjectNoThrow(req, publicKey, options) {
-  _validateAndExtractGenericNoThrow(req, publicKey, _validateVisitorNoThrow, _extractVisitorObjectNoThrow, 'visitor');
+  _validateAndExtractGenericNoThrow(
+    req,
+    publicKey,
+    _validateVisitorNoThrow,
+    _extractVisitorObjectNoThrow,
+    'visitor',
+  );
   validateAndExtractOptionalUserAuthorizationObjectNoThrow(req, options);
   return req;
 }
@@ -196,10 +241,23 @@ function verifyJwt(publicKey, customErrorFunction, options) {
 }
 
 // Pattern: Middleware - verifies service identity and optionally carries user authorization context.
-function verifyServiceJwt(publicKey, expectedIssuer, expectedAudience, customErrorFunction, options) {
+function verifyServiceJwt(
+  publicKey,
+  expectedIssuer,
+  expectedAudience,
+  customErrorFunction,
+  options,
+) {
   return function (req, res, next) {
     try {
-      validateAndExtractServiceJwtObject(req, publicKey, expectedIssuer, expectedAudience, customErrorFunction, options);
+      validateAndExtractServiceJwtObject(
+        req,
+        publicKey,
+        expectedIssuer,
+        expectedAudience,
+        customErrorFunction,
+        options,
+      );
       next();
     } catch (err) {
       next(err);
@@ -211,7 +269,13 @@ function verifyServiceJwt(publicKey, expectedIssuer, expectedAudience, customErr
 function verifyJwtOrServerAuth(publicKey, serverAuthIntrospector, customErrorFunction, options) {
   return async function (req, res, next) {
     try {
-      await validateAndExtractJwtOrServerAuthObject(req, publicKey, serverAuthIntrospector, customErrorFunction, options);
+      await validateAndExtractJwtOrServerAuthObject(
+        req,
+        publicKey,
+        serverAuthIntrospector,
+        customErrorFunction,
+        options,
+      );
       next();
     } catch (err) {
       next(err);
@@ -220,10 +284,22 @@ function verifyJwtOrServerAuth(publicKey, serverAuthIntrospector, customErrorFun
 }
 
 // Pattern: Middleware - composes flexible auth, optional user authorization, and role checks.
-function verifyJwtOrServerAuthAndHasRole(role, publicKey, serverAuthIntrospector, customErrorFunction, options) {
+function verifyJwtOrServerAuthAndHasRole(
+  role,
+  publicKey,
+  serverAuthIntrospector,
+  customErrorFunction,
+  options,
+) {
   return async function (req, res, next) {
     try {
-      await validateAndExtractJwtOrServerAuthObject(req, publicKey, serverAuthIntrospector, customErrorFunction, options);
+      await validateAndExtractJwtOrServerAuthObject(
+        req,
+        publicKey,
+        serverAuthIntrospector,
+        customErrorFunction,
+        options,
+      );
       const isRoleExist = doesJwtUserHasRole(req, role);
       _isLoginRequired(isRoleExist, customErrorFunction);
       next();
@@ -313,7 +389,9 @@ function validateAndExtractUserAuthorizationObject(req, publicKey, customErrorFu
   if (header.present && isUserAuthorizationTokenAllowed(header.token, config)) {
     _extractUserAuthorizationObjectNoThrow(req, header.token);
   } else {
-    if (req) req.userAuthorization = null;
+    if (req) {
+      req.userAuthorization = null;
+    }
     throwError(customErrorFunction);
   }
 
@@ -337,7 +415,9 @@ function validateAndExtractUserAuthorizationObjectNoThrow(req, publicKey, option
 // Pattern: Guard Clause - skips optional context handling unless a caller explicitly configured it.
 function validateAndExtractOptionalUserAuthorizationObject(req, options, customErrorFunction) {
   const config = createOptionalUserAuthorizationConfig(options);
-  if (!config) return req;
+  if (!config) {
+    return req;
+  }
 
   const header = readUserAuthorizationHeader(req, config);
   if (!header.present) {
@@ -358,7 +438,9 @@ function validateAndExtractOptionalUserAuthorizationObject(req, options, customE
 // Pattern: Guard Clause - optional no-throw context extraction never changes primary auth results.
 function validateAndExtractOptionalUserAuthorizationObjectNoThrow(req, options) {
   const config = createOptionalUserAuthorizationConfig(options);
-  if (!config) return req;
+  if (!config) {
+    return req;
+  }
 
   const header = readUserAuthorizationHeader(req, config);
   if (header.present && isUserAuthorizationTokenAllowed(header.token, config)) {
@@ -383,9 +465,12 @@ function _isLoginRequired(hasRequiredRole, customErrorFunction) {
   }
 }
 
+// Pattern: Fail-Closed Probe - accepts a bearer JWT only when signature and lifetime are valid.
 function tryValidateAndExtractJwtObject(req, publicKey) {
   const jwtString = _validateJwtNoThrow(req);
-  if (!jwtString || !isJwtString(jwtString)) return false;
+  if (!jwtString || !isJwtString(jwtString)) {
+    return false;
+  }
 
   const isJwtSignatureValid = jwtVerifySignedToken(jwtString, publicKey);
   if (!isJwtSignatureValid) {
@@ -394,13 +479,19 @@ function tryValidateAndExtractJwtObject(req, publicKey) {
   }
 
   _extractJwtObjectNoThrow(req, jwtString);
-  return Boolean(req?.jwt);
+  if (!isJwtPayloadWithinLifetime(req?.jwt?.payload)) {
+    req.jwt = null;
+    return false;
+  }
+  return true;
 }
 
 function _validateServerAuthToken(req, customErrorFunction) {
   const authorizationHeader = req?.get?.('Authorization') || req?.get?.('authorization');
   const token = _extractJwtNoThrow(authorizationHeader);
-  if (token) return token;
+  if (token) {
+    return token;
+  }
 
   throwError(customErrorFunction);
   return null;
@@ -422,7 +513,9 @@ async function introspectServerAuthToken(serverAuthIntrospector, token, req, cus
 function attachServerAuthClaims(req, claims, customErrorFunction) {
   const payload = createServerAuthPayload(claims);
   if (!payload.sub) {
-    if (req) req.jwt = null;
+    if (req) {
+      req.jwt = null;
+    }
     throwError(customErrorFunction);
   }
 
@@ -439,10 +532,9 @@ function attachServerAuthClaims(req, claims, customErrorFunction) {
 // Pattern: Projection - copies only authoritative verification names and preserves their exact values.
 function pickEmailVerificationClaims(claims) {
   return Object.fromEntries(
-    EMAIL_VERIFICATION_CLAIM_NAMES.filter(claimName => Object.prototype.hasOwnProperty.call(claims, claimName)).map(claimName => [
-      claimName,
-      claims[claimName],
-    ]),
+    EMAIL_VERIFICATION_CLAIM_NAMES.filter(claimName =>
+      Object.prototype.hasOwnProperty.call(claims, claimName),
+    ).map(claimName => [claimName, claims[claimName]]),
   );
 }
 
@@ -462,54 +554,101 @@ function createServerAuthPayload(claims) {
 }
 
 function readEpochSeconds(value) {
-  if (value === undefined || value === null || value === '') return undefined;
-  if (typeof value === 'number') return normalizeSeconds(value);
+  if (value === undefined || value === null || value === '') {
+    return undefined;
+  }
+  if (typeof value === 'number') {
+    return normalizeSeconds(value);
+  }
   const millis = Date.parse(value);
   return Number.isFinite(millis) ? Math.floor(millis / 1000) : undefined;
 }
 
 function normalizeSeconds(value) {
-  if (!Number.isFinite(value)) return null;
+  if (!Number.isFinite(value)) {
+    return null;
+  }
   return value > 1000000000000 ? Math.floor(value / 1000) : Math.floor(value);
 }
 
+// Pattern: Policy - validates service identity, audience, and registered token lifetime.
 function _isServiceJwtFor(payload, expectedIssuer, expectedAudience) {
-  if (!payload) return false;
-  if (payload.iss !== expectedIssuer) return false;
-  if (payload.sub !== expectedIssuer) return false;
-  if (!payloadAudienceMatches(payload.aud, expectedAudience)) return false;
-  if (isJwtPayloadIssuedInFuture(payload)) return false;
-  if (isJwtPayloadExpired(payload)) return false;
-  if (isJwtPayloadNotYetValid(payload)) return false;
-  return true;
+  if (!payload) {
+    return false;
+  }
+  if (payload.iss !== expectedIssuer) {
+    return false;
+  }
+  if (payload.sub !== expectedIssuer) {
+    return false;
+  }
+  if (!payloadAudienceMatches(payload.aud, expectedAudience)) {
+    return false;
+  }
+  return isJwtPayloadWithinLifetime(payload);
 }
 
 function payloadAudienceMatches(actualAudience, expectedAudience) {
-  if (Array.isArray(actualAudience)) return actualAudience.includes(expectedAudience);
+  if (Array.isArray(actualAudience)) {
+    return actualAudience.includes(expectedAudience);
+  }
   return actualAudience === expectedAudience;
 }
 
 function isJwtPayloadExpired(payload) {
-  if (!payload.exp) return true;
+  if (!payload.exp) {
+    return true;
+  }
   const exp = normalizeSeconds(payload.exp);
-  if (!Number.isInteger(exp)) return true;
+  if (!Number.isInteger(exp)) {
+    return true;
+  }
   return Math.floor(Date.now() / 1000) >= exp;
 }
 
 function isJwtPayloadIssuedInFuture(payload) {
-  if (!payload.iat) return true;
+  if (!payload.iat) {
+    return true;
+  }
   const iat = normalizeSeconds(payload.iat);
-  if (!Number.isInteger(iat)) return true;
+  if (!Number.isInteger(iat)) {
+    return true;
+  }
   return Math.floor(Date.now() / 1000) < iat;
 }
 
 function isJwtPayloadNotYetValid(payload) {
-  if (!payload.nbf) return false;
+  if (!payload.nbf) {
+    return false;
+  }
   const nbf = normalizeSeconds(payload.nbf);
-  if (!Number.isInteger(nbf)) return true;
+  if (!Number.isInteger(nbf)) {
+    return true;
+  }
   return Math.floor(Date.now() / 1000) < nbf;
 }
 
+// Pattern: Specification - centralizes the registered time-claim policy for signed tokens.
+function isJwtPayloadWithinLifetime(payload) {
+  return (
+    Boolean(payload) &&
+    !isJwtPayloadIssuedInFuture(payload) &&
+    !isJwtPayloadExpired(payload) &&
+    !isJwtPayloadNotYetValid(payload)
+  );
+}
+
+// Pattern: Guard Clause - clears an extracted token before surfacing an authentication failure.
+function requireActiveExtractedToken(req, propertyName, customErrorFunction) {
+  if (isJwtPayloadWithinLifetime(req?.[propertyName]?.payload)) {
+    return;
+  }
+  if (req) {
+    req[propertyName] = null;
+  }
+  throwError(customErrorFunction);
+}
+
 // Pattern: Factory - normalizes direct user authorization options into one config shape.
 function createUserAuthorizationConfig(publicKey, options) {
   return normalizeUserAuthorizationConfig({
@@ -520,7 +659,9 @@ function createUserAuthorizationConfig(publicKey, options) {
 
 // Pattern: Factory - detects optional user authorization configuration without affecting legacy callers.
 function createOptionalUserAuthorizationConfig(options) {
-  if (!options || !Object.prototype.hasOwnProperty.call(options, 'userAuthorization')) return null;
+  if (!options || !Object.prototype.hasOwnProperty.call(options, 'userAuthorization')) {
+    return null;
+  }
   return normalizeUserAuthorizationConfig(options.userAuthorization || {});
 }
 
@@ -529,7 +670,10 @@ function normalizeUserAuthorizationConfig(options) {
   return {
     publicKey: options?.publicKey,
     headerName: options?.headerName || DEFAULT_USER_AUTHORIZATION_HEADER_NAME,
-    maxTokenLength: normalizePositiveInteger(options?.maxTokenLength, DEFAULT_USER_AUTHORIZATION_MAX_TOKEN_LENGTH),
+    maxTokenLength: normalizePositiveInteger(
+      options?.maxTokenLength,
+      DEFAULT_USER_AUTHORIZATION_MAX_TOKEN_LENGTH,
+    ),
     expectedType: options?.expectedType,
     expectedIssuer: options?.expectedIssuer,
     expectedAudience: options?.expectedAudience,
@@ -546,35 +690,53 @@ function normalizePositiveInteger(value, defaultValue) {
 function readUserAuthorizationHeader(req, config) {
   const rawToken = getRequestHeader(req, config.headerName);
   const present = rawToken !== undefined && rawToken !== null;
-  if (!present || typeof rawToken !== 'string') return { present, token: null };
+  if (!present || typeof rawToken !== 'string') {
+    return { present, token: null };
+  }
 
   const token = rawToken.trim();
-  if (!token || token.length > config.maxTokenLength || !isJwtString(token)) return { present: true, token: null };
+  if (!token || token.length > config.maxTokenLength || !isJwtString(token)) {
+    return { present: true, token: null };
+  }
   return { present: true, token };
 }
 
 // Pattern: Adapter - supports Express case-insensitive headers and simple test doubles.
 function getRequestHeader(req, headerName) {
   const value = req?.get?.(headerName);
-  if (value !== undefined && value !== null) return value;
+  if (value !== undefined && value !== null) {
+    return value;
+  }
 
   const lowerCaseHeaderName = headerName.toLowerCase();
-  if (lowerCaseHeaderName === headerName) return value;
+  if (lowerCaseHeaderName === headerName) {
+    return value;
+  }
   return req?.get?.(lowerCaseHeaderName);
 }
 
 // Pattern: Single Responsibility - verifies signature and registered JWT time claims for user authorization.
 function isUserAuthorizationTokenAllowed(token, config) {
-  if (!token || !config.publicKey || !jwtVerifySignedToken(token, config.publicKey)) return false;
+  if (!token || !config.publicKey || !jwtVerifySignedToken(token, config.publicKey)) {
+    return false;
+  }
 
   const payload = readVerifiedJwtPayload(token);
-  if (!payload) return false;
-  if (isJwtPayloadIssuedInFuture(payload)) return false;
-  if (isJwtPayloadExpired(payload)) return false;
-  if (isJwtPayloadNotYetValid(payload)) return false;
-  if (config.expectedType && payload.typ !== config.expectedType) return false;
-  if (config.expectedIssuer && payload.iss !== config.expectedIssuer) return false;
-  if (!expectedAudienceMatches(payload.aud, config.expectedAudience)) return false;
+  if (!payload) {
+    return false;
+  }
+  if (!isJwtPayloadWithinLifetime(payload)) {
+    return false;
+  }
+  if (config.expectedType && payload.typ !== config.expectedType) {
+    return false;
+  }
+  if (config.expectedIssuer && payload.iss !== config.expectedIssuer) {
+    return false;
+  }
+  if (!expectedAudienceMatches(payload.aud, config.expectedAudience)) {
+    return false;
+  }
 
   return true;
 }
@@ -586,14 +748,20 @@ function readVerifiedJwtPayload(token) {
 
 // Pattern: Pure Function - supports either one expected audience or a small allowed set.
 function expectedAudienceMatches(actualAudience, expectedAudience) {
-  if (expectedAudience === undefined || expectedAudience === null || expectedAudience === '') return true;
-  if (Array.isArray(expectedAudience)) return expectedAudience.some(audience => payloadAudienceMatches(actualAudience, audience));
+  if (expectedAudience === undefined || expectedAudience === null || expectedAudience === '') {
+    return true;
+  }
+  if (Array.isArray(expectedAudience)) {
+    return expectedAudience.some(audience => payloadAudienceMatches(actualAudience, audience));
+  }
   return payloadAudienceMatches(actualAudience, expectedAudience);
 }
 
 function _validateGenericNoThrow(req, headerName, extractor) {
   let jwtRaw = req.get(headerName);
-  if (!jwtRaw) return null;
+  if (!jwtRaw) {
+    return null;
+  }
   let jwt = extractor(jwtRaw);
   return isJwtString(jwt) ? jwt : null;
 }
@@ -601,11 +769,14 @@ function _validateGenericNoThrow(req, headerName, extractor) {
 function _validateGeneric(req, headerName, extractor, customErrorFunction) {
   let jwtRaw = req.get(headerName);
   let jwt = extractor(jwtRaw, customErrorFunction);
-  if (isJwtString(jwt)) return jwt;
+  if (isJwtString(jwt)) {
+    return jwt;
+  }
   throwError(customErrorFunction);
   return null;
 }
 
+// Pattern: Fail-Closed Extraction - optional tokens survive only valid signatures and lifetimes.
 function _validateAndExtractGenericNoThrow(req, publicKey, validator, extractor, propertyName) {
   try {
     const jwtString = validator(req);
@@ -613,11 +784,16 @@ function _validateAndExtractGenericNoThrow(req, publicKey, validator, extractor,
 
     if (jwtString && isJwtSignatureValid) {
       extractor(req, jwtString);
+      if (!isJwtPayloadWithinLifetime(req?.[propertyName]?.payload)) {
+        req[propertyName] = null;
+      }
     } else {
       req[propertyName] = null;
     }
   } catch (err) {
-    if (req) req[propertyName] = null;
+    if (req) {
+      req[propertyName] = null;
+    }
     throw err;
   }
   return req;
@@ -629,7 +805,9 @@ function _extractGenericObjectNoThrow(req, jwt, attacher, propertyName) {
     attacher(obj);
     req[propertyName] = obj;
   } else {
-    if (req) req[propertyName] = null;
+    if (req) {
+      req[propertyName] = null;
+    }
   }
 }
 

package/lib/jwtRoles.js

@@ -44,8 +44,12 @@ function getContext(req) {
 
 function getUserAuthorization(req) {
   const userAuthorization = req?.userAuthorization;
-  if (!userAuthorization || typeof userAuthorization !== 'object') return null;
-  if (!userAuthorization.payload || typeof userAuthorization.payload !== 'object') return null;
+  if (!userAuthorization || typeof userAuthorization !== 'object') {
+    return null;
+  }
+  if (!userAuthorization.payload || typeof userAuthorization.payload !== 'object') {
+    return null;
+  }
 
   return userAuthorization;
 }

package/lint-staged.config.mjs

@@ -0,0 +1,36 @@
+import { ESLint } from 'eslint';
+
+const eslint = new ESLint();
+
+// Pattern: Pure Function - builds one deterministic command without shell interpolation.
+const createCommand = (command, filePaths) =>
+  `${command} ${filePaths.map(filePath => JSON.stringify(filePath)).join(' ')}`;
+
+// Pattern: Adapter - derives lint-staged input from ESLint's authoritative ignore rules.
+const removeEslintIgnoredFiles = async filePaths => {
+  const ignoredFileStates = await Promise.all(
+    filePaths.map(filePath => eslint.isPathIgnored(filePath)),
+  );
+
+  return filePaths.flatMap((filePath, index) => (ignoredFileStates[index] ? [] : [filePath]));
+};
+
+// Pattern: Pipeline - preserves ESLint-before-Prettier ordering for staged code.
+const createJavaScriptTasks = async filePaths => {
+  const lintableFilePaths = await removeEslintIgnoredFiles(filePaths);
+  const tasks = [];
+
+  if (lintableFilePaths.length > 0) {
+    tasks.push(createCommand('eslint --fix --max-warnings 0', lintableFilePaths));
+  }
+
+  tasks.push(createCommand('prettier --write', filePaths));
+  return tasks;
+};
+
+const lintStagedConfig = {
+  '*.{js,jsx,mjs,cjs,ts,tsx,mts,cts}': createJavaScriptTasks,
+  '*.{json,jsonc,md,mdx,css,scss,yaml,yml}': ['prettier --write'],
+};
+
+export default lintStagedConfig;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@carecard/jwt-read",
-  "version": "3.18.0",
+  "version": "3.20.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/CareCard-ca/pkg-jwt-read.git"
@@ -10,15 +10,17 @@
   "types": "index.d.ts",
   "scripts": {
     "test": "node scripts/runPackageTask.mjs test",
-    "test:order": "node --test scripts/testOrder/randomizeTestOrder.test.mjs scripts/testOrder/testOrderPolicy.test.mjs scripts/testParallel/runIndexedMochaTests.test.mjs scripts/testParallel/parallelTestPolicy.test.mjs scripts/packageTaskRunner.test.mjs",
+    "test:order": "node --test scripts/testOrder/randomizeTestOrder.test.mjs scripts/testParallel/runIndexedMochaTests.test.mjs scripts/packageTaskRunner.test.mjs scripts/canonicalTestCommand.test.mjs",
     "test:types": "node scripts/runPackageTask.mjs test:types",
     "test:coverage": "node scripts/runPackageTask.mjs test:coverage",
     "test:All": "node scripts/runPackageTask.mjs test:All",
-    "format": "prettier --write .",
-    "format:check": "prettier --check .",
+    "validate:audits": "node scripts/runPackageTask.mjs validate:audits",
+    "format": "prettier --write \"**/*.{js,jsx,mjs,cjs,ts,tsx,mts,cts}\"",
+    "format:check": "prettier --check \"**/*.{js,jsx,mjs,cjs,ts,tsx,mts,cts}\"",
+    "lint-staged": "lint-staged",
     "prepare": "husky",
-    "lint:fix": "eslint --fix",
-    "lint": "eslint"
+    "lint:fix": "eslint . --fix --max-warnings 0",
+    "lint": "eslint . --max-warnings 0"
   },
   "keywords": [
     "auth",
@@ -29,27 +31,31 @@
   "author": "CareCard team",
   "license": "ISC",
   "devDependencies": {
+    "@eslint/js": "9.39.5",
     "@types/express": "5.0.6",
     "@types/mocha": "10.0.10",
     "@types/node": "25.9.3",
-    "eslint": "9.39.4",
+    "@typescript-eslint/parser": "8.67.0",
+    "eslint": "9.39.5",
+    "globals": "17.7.0",
     "husky": "9.1.7",
-    "lint-staged": "17.0.7",
+    "lint-staged": "17.2.0",
     "mocha": "11.7.6",
     "nyc": "18.0.0",
-    "prettier": "3.8.4",
+    "prettier": "3.9.6",
     "ts-node": "10.9.2",
     "typescript": "6.0.3"
   },
   "dependencies": {
-    "@carecard/auth-util": "3.18.0",
-    "@carecard/common-util": "3.18.0",
-    "@carecard/validate": "3.18.0"
+    "@carecard/auth-util": "3.20.0",
+    "@carecard/common-util": "3.20.0",
+    "@carecard/validate": "3.20.0"
   },
   "overrides": {
     "diff": "8.0.4",
-    "minimatch": "10.2.5",
+    "brace-expansion": "5.0.9",
+    "minimatch": "10.2.6",
     "serialize-javascript": "7.0.5",
-    "js-yaml": "4.3.0"
+    "js-yaml": "4.3.1"
   }
 }