@exortek/apikey 1.0.0 → 1.0.2

package/dist/token.d.ts

@@ -30,9 +30,9 @@ export function mint(prefix: string, pepper: Buffer | null): {
 export function hashSecret(secretBytes: Buffer, pepper: Buffer | null): string;
 /**
  * Timing-safe compare of a candidate hash against a stored hash. Both
- * inputs are base64url strings of equal length — a length mismatch is
- * treated as a mismatch after a fixed decode step, so an outside
- * observer cannot learn the stored hash's length via timing.
+ * inputs are base64url strings. A length mismatch early-returns `false`
+ * — all stored hashes are fixed-length (43-char SHA-256 digests), so
+ * the length check leaks no information about the stored value.
  *
  * @param {string} candidate
  * @param {string} stored

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exortek/apikey",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "Stripe-style prefixed API keys for Node.js — 3-segment tokens (prefix_id_secret), HMAC-SHA256 storage hash with pepper rotation, scope allowlists with wildcard match, opt-in lastUsedAt tracking, memory + Redis stores, Express + Fastify middleware. Server-only. Zero non-@exortek runtime dependencies.",
   "type": "module",
   "sideEffects": false,
@@ -32,6 +32,7 @@
   "files": [
     "dist",
     "README.md",
+    "CHANGELOG.md",
     "LICENSE"
   ],
   "scripts": {
@@ -72,8 +73,7 @@
   },
   "peerDependencies": {
     "express": ">=4",
-    "fastify": ">=4",
-    "fastify-plugin": ">=4"
+    "fastify": ">=4"
   },
   "peerDependenciesMeta": {
     "express": {
@@ -81,17 +81,8 @@
     },
     "fastify": {
       "optional": true
-    },
-    "fastify-plugin": {
-      "optional": true
     }
   },
-  "devDependencies": {
-    "@exortek/shared": "0.0.0",
-    "express": "^5.2.1",
-    "fastify": "^5.10.0",
-    "fastify-plugin": "^6.0.0"
-  },
   "publishConfig": {
     "access": "public"
   }