@lacspace/jwt 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Lacspace
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,80 @@
+<div align="center">
+
+# @lacspace/jwt
+
+**JSON Web Tokens (HMAC) + secure random tokens — done safely.**
+
+[![npm version](https://img.shields.io/npm/v/@lacspace/jwt?color=%23a855f7&label=npm)](https://www.npmjs.com/package/@lacspace/jwt)
+[![install size](https://packagephobia.com/badge?p=@lacspace/jwt)](https://packagephobia.com/result?p=@lacspace/jwt)
+[![minzipped](https://img.shields.io/bundlephobia/minzip/@lacspace/jwt?label=minzip)](https://bundlephobia.com/package/@lacspace/jwt)
+[![types](https://img.shields.io/badge/types-included-blue)](https://www.npmjs.com/package/@lacspace/jwt)
+[![license](https://img.shields.io/npm/l/@lacspace/jwt?color=green)](https://github.com/lacspace/npm-packages/blob/main/LICENSE)
+
+</div>
+
+> Sign and verify **HS256 / HS384 / HS512** JWTs over Web Crypto with strict expiry / not-before / issuer / audience checks and constant-time signature comparison. Isomorphic — runs on edge and workers where the `jsonwebtoken` package can't. Plus opaque and CSRF tokens.
+
+- 🎟️ `sign` / `verify` / `decode` with typed claims
+- ⏱️ `exp` / `nbf` / `iat`, `issuer`, `audience`, `clockTolerance`
+- 🧯 Typed `JwtError` with a `code` (`expired`, `signature`, `audience`…)
+- 🎲 `randomToken` / `csrfToken`
+- ⚡ Zero deps (bar `@lacspace/crypto`) · 🌍 isomorphic · fully typed
+
+## Install
+
+```bash
+npm install @lacspace/jwt
+```
+
+## Usage
+
+```ts
+import { sign, verify, JwtError } from "@lacspace/jwt";
+
+const token = await sign({ sub: "user_1", role: "admin" }, process.env.JWT_SECRET!, {
+  expiresIn: 3600,           // seconds
+  issuer: "lacspace",
+});
+
+try {
+  const payload = await verify(token, process.env.JWT_SECRET!, { issuer: "lacspace" });
+  payload.sub;  // "user_1"
+} catch (e) {
+  if (e instanceof JwtError) console.log(e.code); // "expired" | "signature" | …
+}
+```
+
+## Opaque & CSRF tokens
+
+```ts
+import { randomToken, csrfToken } from "@lacspace/jwt";
+
+randomToken();   // 43-char URL-safe (32 bytes) — session ids, reset tokens
+csrfToken();     // CSRF token
+```
+
+## API
+
+| Export | Description |
+| --- | --- |
+| `sign(payload, secret, opts?)` | `algorithm`, `expiresIn`, `issuer`, `audience`, `subject` |
+| `verify(token, secret, opts?)` | throws `JwtError`; checks sig + claims |
+| `decode(token)` | header + payload, **no** verification |
+| `randomToken(bytes?)` / `csrfToken()` | secure random tokens |
+
+## The Lacspace Security Kit
+
+| Package | For |
+| --- | --- |
+| [`@lacspace/crypto`](https://www.npmjs.com/package/@lacspace/crypto) | AES encryption & hashing |
+| [`@lacspace/password`](https://www.npmjs.com/package/@lacspace/password) | Password hashing |
+| **`@lacspace/jwt`** | JWTs & tokens (this package) |
+| [`@lacspace/apikey`](https://www.npmjs.com/package/@lacspace/apikey) | API keys |
+| [`@lacspace/otp`](https://www.npmjs.com/package/@lacspace/otp) | TOTP/HOTP 2FA |
+| [`@lacspace/webauthn`](https://www.npmjs.com/package/@lacspace/webauthn) | Passkeys / biometric |
+| [`@lacspace/mfa`](https://www.npmjs.com/package/@lacspace/mfa) | 2FA/3FA orchestration |
+| [`@lacspace/lock`](https://www.npmjs.com/package/@lacspace/lock) | Account lockout |
+| [`@lacspace/headers`](https://www.npmjs.com/package/@lacspace/headers) | Secure headers / CSP |
+| [`@lacspace/redact`](https://www.npmjs.com/package/@lacspace/redact) | Log redaction |
+
+<div align="center"><sub>Built with care by <a href="https://lacspace.com">Lacspace</a> · MIT licensed · <a href="https://github.com/lacspace/npm-packages">source</a></sub></div>

package/dist/index.cjs

@@ -0,0 +1,97 @@
+'use strict';
+
+var crypto = require('@lacspace/crypto');
+
+// src/index.ts
+var ALG_HASH = {
+  HS256: "SHA-256",
+  HS384: "SHA-384",
+  HS512: "SHA-512"
+};
+var JwtError = class extends Error {
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+    this.name = "JwtError";
+  }
+};
+var enc = new TextEncoder();
+var dec = new TextDecoder();
+function b64urlJson(obj) {
+  return crypto.toBase64url(enc.encode(JSON.stringify(obj)));
+}
+function nowSec() {
+  return Math.floor(Date.now() / 1e3);
+}
+async function sign(payload, secret, opts = {}) {
+  const alg = opts.algorithm ?? "HS256";
+  const iat = nowSec();
+  const body = { iat, ...payload };
+  if (opts.expiresIn !== void 0) body.exp = iat + opts.expiresIn;
+  if (opts.issuer) body.iss = opts.issuer;
+  if (opts.audience) body.aud = opts.audience;
+  if (opts.subject) body.sub = opts.subject;
+  const signingInput = `${b64urlJson({ alg, typ: "JWT" })}.${b64urlJson(body)}`;
+  const sig = await crypto.hmac(secret, signingInput, ALG_HASH[alg]);
+  return `${signingInput}.${crypto.toBase64url(sig)}`;
+}
+function decode(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) throw new JwtError("malformed token", "malformed");
+  return {
+    header: JSON.parse(dec.decode(crypto.fromBase64url(parts[0]))),
+    payload: JSON.parse(dec.decode(crypto.fromBase64url(parts[1])))
+  };
+}
+async function verify(token, secret, opts = {}) {
+  const parts = token.split(".");
+  if (parts.length !== 3) throw new JwtError("malformed token", "malformed");
+  const [h, p, s] = parts;
+  let header;
+  try {
+    header = JSON.parse(dec.decode(crypto.fromBase64url(h)));
+  } catch {
+    throw new JwtError("malformed header", "malformed");
+  }
+  const alg = header.alg;
+  if (!alg || !(alg in ALG_HASH)) throw new JwtError(`unsupported algorithm ${alg}`, "algorithm");
+  if (opts.algorithms && !opts.algorithms.includes(alg))
+    throw new JwtError(`algorithm ${alg} not allowed`, "algorithm");
+  const expected = await crypto.hmac(secret, `${h}.${p}`, ALG_HASH[alg]);
+  if (!crypto.constantTimeEqual(expected, crypto.fromBase64url(s)))
+    throw new JwtError("signature verification failed", "signature");
+  let payload;
+  try {
+    payload = JSON.parse(dec.decode(crypto.fromBase64url(p)));
+  } catch {
+    throw new JwtError("malformed payload", "malformed");
+  }
+  const now = nowSec();
+  const skew = opts.clockTolerance ?? 0;
+  if (payload.exp !== void 0 && now > payload.exp + skew)
+    throw new JwtError("token expired", "expired");
+  if (payload.nbf !== void 0 && now + skew < payload.nbf)
+    throw new JwtError("token not yet active", "not_active");
+  if (opts.issuer && payload.iss !== opts.issuer)
+    throw new JwtError("issuer mismatch", "issuer");
+  if (opts.audience) {
+    const aud = Array.isArray(payload.aud) ? payload.aud : payload.aud ? [payload.aud] : [];
+    if (!aud.includes(opts.audience)) throw new JwtError("audience mismatch", "audience");
+  }
+  return payload;
+}
+function randomToken(bytes = 32) {
+  return crypto.toBase64url(crypto.randomBytes(bytes));
+}
+function csrfToken() {
+  return randomToken(32);
+}
+
+exports.JwtError = JwtError;
+exports.csrfToken = csrfToken;
+exports.decode = decode;
+exports.randomToken = randomToken;
+exports.sign = sign;
+exports.verify = verify;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"names":["toBase64url","hmac","fromBase64url","constantTimeEqual","randomBytes"],"mappings":";;;;;AAcA,IAAM,QAAA,GAA6C;AAAA,EACjD,KAAA,EAAO,SAAA;AAAA,EACP,KAAA,EAAO,SAAA;AAAA,EACP,KAAA,EAAO;AACT,CAAA;AAEO,IAAM,QAAA,GAAN,cAAuB,KAAA,CAAM;AAAA,EAClC,WAAA,CACE,SACO,IAAA,EAQP;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AATN,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAUP,IAAA,IAAA,CAAK,IAAA,GAAO,UAAA;AAAA,EACd;AACF;AAsBA,IAAM,GAAA,GAAM,IAAI,WAAA,EAAY;AAC5B,IAAM,GAAA,GAAM,IAAI,WAAA,EAAY;AAE5B,SAAS,WAAW,GAAA,EAAsB;AACxC,EAAA,OAAOA,mBAAY,GAAA,CAAI,MAAA,CAAO,KAAK,SAAA,CAAU,GAAG,CAAC,CAAC,CAAA;AACpD;AAEA,SAAS,MAAA,GAAiB;AACxB,EAAA,OAAO,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACrC;AAGA,eAAsB,IAAA,CACpB,OAAA,EACA,MAAA,EACA,IAAA,GAAoB,EAAC,EACJ;AACjB,EAAA,MAAM,GAAA,GAAM,KAAK,SAAA,IAAa,OAAA;AAC9B,EAAA,MAAM,MAAM,MAAA,EAAO;AACnB,EAAA,MAAM,IAAA,GAAmB,EAAE,GAAA,EAAK,GAAG,OAAA,EAAQ;AAC3C,EAAA,IAAI,KAAK,SAAA,KAAc,MAAA,EAAW,IAAA,CAAK,GAAA,GAAM,MAAM,IAAA,CAAK,SAAA;AACxD,EAAA,IAAI,IAAA,CAAK,MAAA,EAAQ,IAAA,CAAK,GAAA,GAAM,IAAA,CAAK,MAAA;AACjC,EAAA,IAAI,IAAA,CAAK,QAAA,EAAU,IAAA,CAAK,GAAA,GAAM,IAAA,CAAK,QAAA;AACnC,EAAA,IAAI,IAAA,CAAK,OAAA,EAAS,IAAA,CAAK,GAAA,GAAM,IAAA,CAAK,OAAA;AAElC,EAAA,MAAM,YAAA,GAAe,CAAA,EAAG,UAAA,CAAW,EAAE,GAAA,EAAK,GAAA,EAAK,KAAA,EAAO,CAAC,CAAA,CAAA,EAAI,UAAA,CAAW,IAAI,CAAC,CAAA,CAAA;AAC3E,EAAA,MAAM,MAAM,MAAMC,WAAA,CAAK,QAAQ,YAAA,EAAc,QAAA,CAAS,GAAG,CAAC,CAAA;AAC1D,EAAA,OAAO,CAAA,EAAG,YAAY,CAAA,CAAA,EAAID,kBAAA,CAAY,GAAG,CAAC,CAAA,CAAA;AAC5C;AAWO,SAAS,OAAO,KAAA,EAAyE;AAC9F,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,EAAA,IAAI,MAAM,MAAA,KAAW,CAAA,QAAS,IAAI,QAAA,CAAS,mBAAmB,WAAW,CAAA;AACzE,EAAA,OAAO;AAAA,IACL,MAAA,EAAQ,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,MAAA,CAAOE,qBAAc,KAAA,CAAM,CAAC,CAAE,CAAC,CAAC,CAAA;AAAA,IACvD,OAAA,EAAS,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,MAAA,CAAOA,qBAAc,KAAA,CAAM,CAAC,CAAE,CAAC,CAAC;AAAA,GAC1D;AACF;AAGA,eAAsB,MAAA,CACpB,KAAA,EACA,MAAA,EACA,IAAA,GAAsB,EAAC,EACX;AACZ,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,EAAA,IAAI,MAAM,MAAA,KAAW,CAAA,QAAS,IAAI,QAAA,CAAS,mBAAmB,WAAW,CAAA;AACzE,EAAA,MAAM,CAAC,CAAA,EAAG,CAAA,EAAG,CAAC,CAAA,GAAI,KAAA;AAElB,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,KAAK,KAAA,CAAM,GAAA,CAAI,OAAOA,oBAAA,CAAc,CAAC,CAAC,CAAC,CAAA;AAAA,EAClD,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,QAAA,CAAS,kBAAA,EAAoB,WAAW,CAAA;AAAA,EACpD;AACA,EAAA,MAAM,MAAM,MAAA,CAAO,GAAA;AACnB,EAAA,IAAI,CAAC,GAAA,IAAO,EAAE,GAAA,IAAO,QAAA,CAAA,EAAW,MAAM,IAAI,QAAA,CAAS,CAAA,sBAAA,EAAyB,GAAG,CAAA,CAAA,EAAI,WAAW,CAAA;AAC9F,EAAA,IAAI,KAAK,UAAA,IAAc,CAAC,IAAA,CAAK,UAAA,CAAW,SAAS,GAAG,CAAA;AAClD,IAAA,MAAM,IAAI,QAAA,CAAS,CAAA,UAAA,EAAa,GAAG,gBAAgB,WAAW,CAAA;AAEhE,EAAA,MAAM,QAAA,GAAW,MAAMD,WAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,CAAC,CAAA,CAAA,EAAI,CAAC,CAAA,CAAA,EAAI,QAAA,CAAS,GAAG,CAAC,CAAA;AAC9D,EAAA,IAAI,CAACE,wBAAA,CAAkB,QAAA,EAAUD,oBAAA,CAAc,CAAC,CAAC,CAAA;AAC/C,IAAA,MAAM,IAAI,QAAA,CAAS,+BAAA,EAAiC,WAAW,CAAA;AAEjE,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AACF,IAAA,OAAA,GAAU,KAAK,KAAA,CAAM,GAAA,CAAI,OAAOA,oBAAA,CAAc,CAAC,CAAC,CAAC,CAAA;AAAA,EACnD,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,QAAA,CAAS,mBAAA,EAAqB,WAAW,CAAA;AAAA,EACrD;AAEA,EAAA,MAAM,MAAM,MAAA,EAAO;AACnB,EAAA,MAAM,IAAA,GAAO,KAAK,cAAA,IAAkB,CAAA;AACpC,EAAA,IAAI,OAAA,CAAQ,GAAA,KAAQ,MAAA,IAAa,GAAA,GAAM,QAAQ,GAAA,GAAM,IAAA;AACnD,IAAA,MAAM,IAAI,QAAA,CAAS,eAAA,EAAiB,SAAS,CAAA;AAC/C,EAAA,IAAI,OAAA,CAAQ,GAAA,KAAQ,MAAA,IAAa,GAAA,GAAM,OAAO,OAAA,CAAQ,GAAA;AACpD,IAAA,MAAM,IAAI,QAAA,CAAS,sBAAA,EAAwB,YAAY,CAAA;AACzD,EAAA,IAAI,IAAA,CAAK,MAAA,IAAU,OAAA,CAAQ,GAAA,KAAQ,IAAA,CAAK,MAAA;AACtC,IAAA,MAAM,IAAI,QAAA,CAAS,iBAAA,EAAmB,QAAQ,CAAA;AAChD,EAAA,IAAI,KAAK,QAAA,EAAU;AACjB,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,OAAA,CAAQ,OAAA,CAAQ,GAAG,CAAA,GAAI,OAAA,CAAQ,GAAA,GAAM,OAAA,CAAQ,GAAA,GAAM,CAAC,OAAA,CAAQ,GAAG,IAAI,EAAC;AACtF,IAAA,IAAI,CAAC,GAAA,CAAI,QAAA,CAAS,IAAA,CAAK,QAAQ,GAAG,MAAM,IAAI,QAAA,CAAS,mBAAA,EAAqB,UAAU,CAAA;AAAA,EACtF;AACA,EAAA,OAAO,OAAA;AACT;AAKO,SAAS,WAAA,CAAY,QAAQ,EAAA,EAAY;AAC9C,EAAA,OAAOF,kBAAA,CAAYI,kBAAA,CAAY,KAAK,CAAC,CAAA;AACvC;AAGO,SAAS,SAAA,GAAoB;AAClC,EAAA,OAAO,YAAY,EAAE,CAAA;AACvB","file":"index.cjs","sourcesContent":["/**\n * @lacspace/jwt\n * JSON Web Tokens (HMAC) + secure random tokens — done safely.\n *\n * Sign and verify HS256/HS384/HS512 JWTs over Web Crypto (isomorphic), with\n * strict expiry / not-before / issuer / audience checks and constant-time\n * signature comparison. Plus opaque secure tokens and CSRF tokens.\n *\n * Zero dependencies (bar @lacspace/crypto) · isomorphic · fully typed.\n */\n\nimport { hmac, toBase64url, fromBase64url, constantTimeEqual, randomBytes, type HashAlgorithm } from \"@lacspace/crypto\";\n\nexport type Algorithm = \"HS256\" | \"HS384\" | \"HS512\";\nconst ALG_HASH: Record<Algorithm, HashAlgorithm> = {\n  HS256: \"SHA-256\",\n  HS384: \"SHA-384\",\n  HS512: \"SHA-512\",\n};\n\nexport class JwtError extends Error {\n  constructor(\n    message: string,\n    public code:\n      | \"malformed\"\n      | \"signature\"\n      | \"expired\"\n      | \"not_active\"\n      | \"issuer\"\n      | \"audience\"\n      | \"algorithm\",\n  ) {\n    super(message);\n    this.name = \"JwtError\";\n  }\n}\n\nexport interface JwtPayload {\n  iss?: string;\n  sub?: string;\n  aud?: string | string[];\n  exp?: number;\n  nbf?: number;\n  iat?: number;\n  jti?: string;\n  [key: string]: unknown;\n}\n\nexport interface SignOptions {\n  algorithm?: Algorithm;\n  /** Seconds from now until expiry, e.g. 3600. */\n  expiresIn?: number;\n  issuer?: string;\n  audience?: string | string[];\n  subject?: string;\n}\n\nconst enc = new TextEncoder();\nconst dec = new TextDecoder();\n\nfunction b64urlJson(obj: unknown): string {\n  return toBase64url(enc.encode(JSON.stringify(obj)));\n}\n\nfunction nowSec(): number {\n  return Math.floor(Date.now() / 1000);\n}\n\n/** Sign a JWT. */\nexport async function sign(\n  payload: JwtPayload,\n  secret: string | Uint8Array,\n  opts: SignOptions = {},\n): Promise<string> {\n  const alg = opts.algorithm ?? \"HS256\";\n  const iat = nowSec();\n  const body: JwtPayload = { iat, ...payload };\n  if (opts.expiresIn !== undefined) body.exp = iat + opts.expiresIn;\n  if (opts.issuer) body.iss = opts.issuer;\n  if (opts.audience) body.aud = opts.audience;\n  if (opts.subject) body.sub = opts.subject;\n\n  const signingInput = `${b64urlJson({ alg, typ: \"JWT\" })}.${b64urlJson(body)}`;\n  const sig = await hmac(secret, signingInput, ALG_HASH[alg]);\n  return `${signingInput}.${toBase64url(sig)}`;\n}\n\nexport interface VerifyOptions {\n  algorithms?: Algorithm[];\n  issuer?: string;\n  audience?: string;\n  /** Allowed clock skew in seconds. Default 0. */\n  clockTolerance?: number;\n}\n\n/** Decode a JWT without verifying (never trust the result for auth). */\nexport function decode(token: string): { header: Record<string, unknown>; payload: JwtPayload } {\n  const parts = token.split(\".\");\n  if (parts.length !== 3) throw new JwtError(\"malformed token\", \"malformed\");\n  return {\n    header: JSON.parse(dec.decode(fromBase64url(parts[0]!))),\n    payload: JSON.parse(dec.decode(fromBase64url(parts[1]!))),\n  };\n}\n\n/** Verify a JWT's signature and claims. Throws {@link JwtError} on any failure. */\nexport async function verify<T extends JwtPayload = JwtPayload>(\n  token: string,\n  secret: string | Uint8Array,\n  opts: VerifyOptions = {},\n): Promise<T> {\n  const parts = token.split(\".\");\n  if (parts.length !== 3) throw new JwtError(\"malformed token\", \"malformed\");\n  const [h, p, s] = parts as [string, string, string];\n\n  let header: { alg?: Algorithm };\n  try {\n    header = JSON.parse(dec.decode(fromBase64url(h)));\n  } catch {\n    throw new JwtError(\"malformed header\", \"malformed\");\n  }\n  const alg = header.alg;\n  if (!alg || !(alg in ALG_HASH)) throw new JwtError(`unsupported algorithm ${alg}`, \"algorithm\");\n  if (opts.algorithms && !opts.algorithms.includes(alg))\n    throw new JwtError(`algorithm ${alg} not allowed`, \"algorithm\");\n\n  const expected = await hmac(secret, `${h}.${p}`, ALG_HASH[alg]);\n  if (!constantTimeEqual(expected, fromBase64url(s)))\n    throw new JwtError(\"signature verification failed\", \"signature\");\n\n  let payload: T;\n  try {\n    payload = JSON.parse(dec.decode(fromBase64url(p)));\n  } catch {\n    throw new JwtError(\"malformed payload\", \"malformed\");\n  }\n\n  const now = nowSec();\n  const skew = opts.clockTolerance ?? 0;\n  if (payload.exp !== undefined && now > payload.exp + skew)\n    throw new JwtError(\"token expired\", \"expired\");\n  if (payload.nbf !== undefined && now + skew < payload.nbf)\n    throw new JwtError(\"token not yet active\", \"not_active\");\n  if (opts.issuer && payload.iss !== opts.issuer)\n    throw new JwtError(\"issuer mismatch\", \"issuer\");\n  if (opts.audience) {\n    const aud = Array.isArray(payload.aud) ? payload.aud : payload.aud ? [payload.aud] : [];\n    if (!aud.includes(opts.audience)) throw new JwtError(\"audience mismatch\", \"audience\");\n  }\n  return payload;\n}\n\n/* ------------------------------ opaque tokens ------------------------------ */\n\n/** A cryptographically-random URL-safe token (default 32 bytes → 43 chars). */\nexport function randomToken(bytes = 32): string {\n  return toBase64url(randomBytes(bytes));\n}\n\n/** A CSRF token (alias of a 32-byte random token). */\nexport function csrfToken(): string {\n  return randomToken(32);\n}\n"]}

package/dist/index.d.cts

@@ -0,0 +1,55 @@
+/**
+ * @lacspace/jwt
+ * JSON Web Tokens (HMAC) + secure random tokens — done safely.
+ *
+ * Sign and verify HS256/HS384/HS512 JWTs over Web Crypto (isomorphic), with
+ * strict expiry / not-before / issuer / audience checks and constant-time
+ * signature comparison. Plus opaque secure tokens and CSRF tokens.
+ *
+ * Zero dependencies (bar @lacspace/crypto) · isomorphic · fully typed.
+ */
+type Algorithm = "HS256" | "HS384" | "HS512";
+declare class JwtError extends Error {
+    code: "malformed" | "signature" | "expired" | "not_active" | "issuer" | "audience" | "algorithm";
+    constructor(message: string, code: "malformed" | "signature" | "expired" | "not_active" | "issuer" | "audience" | "algorithm");
+}
+interface JwtPayload {
+    iss?: string;
+    sub?: string;
+    aud?: string | string[];
+    exp?: number;
+    nbf?: number;
+    iat?: number;
+    jti?: string;
+    [key: string]: unknown;
+}
+interface SignOptions {
+    algorithm?: Algorithm;
+    /** Seconds from now until expiry, e.g. 3600. */
+    expiresIn?: number;
+    issuer?: string;
+    audience?: string | string[];
+    subject?: string;
+}
+/** Sign a JWT. */
+declare function sign(payload: JwtPayload, secret: string | Uint8Array, opts?: SignOptions): Promise<string>;
+interface VerifyOptions {
+    algorithms?: Algorithm[];
+    issuer?: string;
+    audience?: string;
+    /** Allowed clock skew in seconds. Default 0. */
+    clockTolerance?: number;
+}
+/** Decode a JWT without verifying (never trust the result for auth). */
+declare function decode(token: string): {
+    header: Record<string, unknown>;
+    payload: JwtPayload;
+};
+/** Verify a JWT's signature and claims. Throws {@link JwtError} on any failure. */
+declare function verify<T extends JwtPayload = JwtPayload>(token: string, secret: string | Uint8Array, opts?: VerifyOptions): Promise<T>;
+/** A cryptographically-random URL-safe token (default 32 bytes → 43 chars). */
+declare function randomToken(bytes?: number): string;
+/** A CSRF token (alias of a 32-byte random token). */
+declare function csrfToken(): string;
+
+export { type Algorithm, JwtError, type JwtPayload, type SignOptions, type VerifyOptions, csrfToken, decode, randomToken, sign, verify };

package/dist/index.d.ts

@@ -0,0 +1,55 @@
+/**
+ * @lacspace/jwt
+ * JSON Web Tokens (HMAC) + secure random tokens — done safely.
+ *
+ * Sign and verify HS256/HS384/HS512 JWTs over Web Crypto (isomorphic), with
+ * strict expiry / not-before / issuer / audience checks and constant-time
+ * signature comparison. Plus opaque secure tokens and CSRF tokens.
+ *
+ * Zero dependencies (bar @lacspace/crypto) · isomorphic · fully typed.
+ */
+type Algorithm = "HS256" | "HS384" | "HS512";
+declare class JwtError extends Error {
+    code: "malformed" | "signature" | "expired" | "not_active" | "issuer" | "audience" | "algorithm";
+    constructor(message: string, code: "malformed" | "signature" | "expired" | "not_active" | "issuer" | "audience" | "algorithm");
+}
+interface JwtPayload {
+    iss?: string;
+    sub?: string;
+    aud?: string | string[];
+    exp?: number;
+    nbf?: number;
+    iat?: number;
+    jti?: string;
+    [key: string]: unknown;
+}
+interface SignOptions {
+    algorithm?: Algorithm;
+    /** Seconds from now until expiry, e.g. 3600. */
+    expiresIn?: number;
+    issuer?: string;
+    audience?: string | string[];
+    subject?: string;
+}
+/** Sign a JWT. */
+declare function sign(payload: JwtPayload, secret: string | Uint8Array, opts?: SignOptions): Promise<string>;
+interface VerifyOptions {
+    algorithms?: Algorithm[];
+    issuer?: string;
+    audience?: string;
+    /** Allowed clock skew in seconds. Default 0. */
+    clockTolerance?: number;
+}
+/** Decode a JWT without verifying (never trust the result for auth). */
+declare function decode(token: string): {
+    header: Record<string, unknown>;
+    payload: JwtPayload;
+};
+/** Verify a JWT's signature and claims. Throws {@link JwtError} on any failure. */
+declare function verify<T extends JwtPayload = JwtPayload>(token: string, secret: string | Uint8Array, opts?: VerifyOptions): Promise<T>;
+/** A cryptographically-random URL-safe token (default 32 bytes → 43 chars). */
+declare function randomToken(bytes?: number): string;
+/** A CSRF token (alias of a 32-byte random token). */
+declare function csrfToken(): string;
+
+export { type Algorithm, JwtError, type JwtPayload, type SignOptions, type VerifyOptions, csrfToken, decode, randomToken, sign, verify };

package/dist/index.js

@@ -0,0 +1,90 @@
+import { hmac, toBase64url, fromBase64url, constantTimeEqual, randomBytes } from '@lacspace/crypto';
+
+// src/index.ts
+var ALG_HASH = {
+  HS256: "SHA-256",
+  HS384: "SHA-384",
+  HS512: "SHA-512"
+};
+var JwtError = class extends Error {
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+    this.name = "JwtError";
+  }
+};
+var enc = new TextEncoder();
+var dec = new TextDecoder();
+function b64urlJson(obj) {
+  return toBase64url(enc.encode(JSON.stringify(obj)));
+}
+function nowSec() {
+  return Math.floor(Date.now() / 1e3);
+}
+async function sign(payload, secret, opts = {}) {
+  const alg = opts.algorithm ?? "HS256";
+  const iat = nowSec();
+  const body = { iat, ...payload };
+  if (opts.expiresIn !== void 0) body.exp = iat + opts.expiresIn;
+  if (opts.issuer) body.iss = opts.issuer;
+  if (opts.audience) body.aud = opts.audience;
+  if (opts.subject) body.sub = opts.subject;
+  const signingInput = `${b64urlJson({ alg, typ: "JWT" })}.${b64urlJson(body)}`;
+  const sig = await hmac(secret, signingInput, ALG_HASH[alg]);
+  return `${signingInput}.${toBase64url(sig)}`;
+}
+function decode(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) throw new JwtError("malformed token", "malformed");
+  return {
+    header: JSON.parse(dec.decode(fromBase64url(parts[0]))),
+    payload: JSON.parse(dec.decode(fromBase64url(parts[1])))
+  };
+}
+async function verify(token, secret, opts = {}) {
+  const parts = token.split(".");
+  if (parts.length !== 3) throw new JwtError("malformed token", "malformed");
+  const [h, p, s] = parts;
+  let header;
+  try {
+    header = JSON.parse(dec.decode(fromBase64url(h)));
+  } catch {
+    throw new JwtError("malformed header", "malformed");
+  }
+  const alg = header.alg;
+  if (!alg || !(alg in ALG_HASH)) throw new JwtError(`unsupported algorithm ${alg}`, "algorithm");
+  if (opts.algorithms && !opts.algorithms.includes(alg))
+    throw new JwtError(`algorithm ${alg} not allowed`, "algorithm");
+  const expected = await hmac(secret, `${h}.${p}`, ALG_HASH[alg]);
+  if (!constantTimeEqual(expected, fromBase64url(s)))
+    throw new JwtError("signature verification failed", "signature");
+  let payload;
+  try {
+    payload = JSON.parse(dec.decode(fromBase64url(p)));
+  } catch {
+    throw new JwtError("malformed payload", "malformed");
+  }
+  const now = nowSec();
+  const skew = opts.clockTolerance ?? 0;
+  if (payload.exp !== void 0 && now > payload.exp + skew)
+    throw new JwtError("token expired", "expired");
+  if (payload.nbf !== void 0 && now + skew < payload.nbf)
+    throw new JwtError("token not yet active", "not_active");
+  if (opts.issuer && payload.iss !== opts.issuer)
+    throw new JwtError("issuer mismatch", "issuer");
+  if (opts.audience) {
+    const aud = Array.isArray(payload.aud) ? payload.aud : payload.aud ? [payload.aud] : [];
+    if (!aud.includes(opts.audience)) throw new JwtError("audience mismatch", "audience");
+  }
+  return payload;
+}
+function randomToken(bytes = 32) {
+  return toBase64url(randomBytes(bytes));
+}
+function csrfToken() {
+  return randomToken(32);
+}
+
+export { JwtError, csrfToken, decode, randomToken, sign, verify };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"names":[],"mappings":";;;AAcA,IAAM,QAAA,GAA6C;AAAA,EACjD,KAAA,EAAO,SAAA;AAAA,EACP,KAAA,EAAO,SAAA;AAAA,EACP,KAAA,EAAO;AACT,CAAA;AAEO,IAAM,QAAA,GAAN,cAAuB,KAAA,CAAM;AAAA,EAClC,WAAA,CACE,SACO,IAAA,EAQP;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AATN,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAUP,IAAA,IAAA,CAAK,IAAA,GAAO,UAAA;AAAA,EACd;AACF;AAsBA,IAAM,GAAA,GAAM,IAAI,WAAA,EAAY;AAC5B,IAAM,GAAA,GAAM,IAAI,WAAA,EAAY;AAE5B,SAAS,WAAW,GAAA,EAAsB;AACxC,EAAA,OAAO,YAAY,GAAA,CAAI,MAAA,CAAO,KAAK,SAAA,CAAU,GAAG,CAAC,CAAC,CAAA;AACpD;AAEA,SAAS,MAAA,GAAiB;AACxB,EAAA,OAAO,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACrC;AAGA,eAAsB,IAAA,CACpB,OAAA,EACA,MAAA,EACA,IAAA,GAAoB,EAAC,EACJ;AACjB,EAAA,MAAM,GAAA,GAAM,KAAK,SAAA,IAAa,OAAA;AAC9B,EAAA,MAAM,MAAM,MAAA,EAAO;AACnB,EAAA,MAAM,IAAA,GAAmB,EAAE,GAAA,EAAK,GAAG,OAAA,EAAQ;AAC3C,EAAA,IAAI,KAAK,SAAA,KAAc,MAAA,EAAW,IAAA,CAAK,GAAA,GAAM,MAAM,IAAA,CAAK,SAAA;AACxD,EAAA,IAAI,IAAA,CAAK,MAAA,EAAQ,IAAA,CAAK,GAAA,GAAM,IAAA,CAAK,MAAA;AACjC,EAAA,IAAI,IAAA,CAAK,QAAA,EAAU,IAAA,CAAK,GAAA,GAAM,IAAA,CAAK,QAAA;AACnC,EAAA,IAAI,IAAA,CAAK,OAAA,EAAS,IAAA,CAAK,GAAA,GAAM,IAAA,CAAK,OAAA;AAElC,EAAA,MAAM,YAAA,GAAe,CAAA,EAAG,UAAA,CAAW,EAAE,GAAA,EAAK,GAAA,EAAK,KAAA,EAAO,CAAC,CAAA,CAAA,EAAI,UAAA,CAAW,IAAI,CAAC,CAAA,CAAA;AAC3E,EAAA,MAAM,MAAM,MAAM,IAAA,CAAK,QAAQ,YAAA,EAAc,QAAA,CAAS,GAAG,CAAC,CAAA;AAC1D,EAAA,OAAO,CAAA,EAAG,YAAY,CAAA,CAAA,EAAI,WAAA,CAAY,GAAG,CAAC,CAAA,CAAA;AAC5C;AAWO,SAAS,OAAO,KAAA,EAAyE;AAC9F,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,EAAA,IAAI,MAAM,MAAA,KAAW,CAAA,QAAS,IAAI,QAAA,CAAS,mBAAmB,WAAW,CAAA;AACzE,EAAA,OAAO;AAAA,IACL,MAAA,EAAQ,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,MAAA,CAAO,cAAc,KAAA,CAAM,CAAC,CAAE,CAAC,CAAC,CAAA;AAAA,IACvD,OAAA,EAAS,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,MAAA,CAAO,cAAc,KAAA,CAAM,CAAC,CAAE,CAAC,CAAC;AAAA,GAC1D;AACF;AAGA,eAAsB,MAAA,CACpB,KAAA,EACA,MAAA,EACA,IAAA,GAAsB,EAAC,EACX;AACZ,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,EAAA,IAAI,MAAM,MAAA,KAAW,CAAA,QAAS,IAAI,QAAA,CAAS,mBAAmB,WAAW,CAAA;AACzE,EAAA,MAAM,CAAC,CAAA,EAAG,CAAA,EAAG,CAAC,CAAA,GAAI,KAAA;AAElB,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,KAAK,KAAA,CAAM,GAAA,CAAI,OAAO,aAAA,CAAc,CAAC,CAAC,CAAC,CAAA;AAAA,EAClD,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,QAAA,CAAS,kBAAA,EAAoB,WAAW,CAAA;AAAA,EACpD;AACA,EAAA,MAAM,MAAM,MAAA,CAAO,GAAA;AACnB,EAAA,IAAI,CAAC,GAAA,IAAO,EAAE,GAAA,IAAO,QAAA,CAAA,EAAW,MAAM,IAAI,QAAA,CAAS,CAAA,sBAAA,EAAyB,GAAG,CAAA,CAAA,EAAI,WAAW,CAAA;AAC9F,EAAA,IAAI,KAAK,UAAA,IAAc,CAAC,IAAA,CAAK,UAAA,CAAW,SAAS,GAAG,CAAA;AAClD,IAAA,MAAM,IAAI,QAAA,CAAS,CAAA,UAAA,EAAa,GAAG,gBAAgB,WAAW,CAAA;AAEhE,EAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,CAAC,CAAA,CAAA,EAAI,CAAC,CAAA,CAAA,EAAI,QAAA,CAAS,GAAG,CAAC,CAAA;AAC9D,EAAA,IAAI,CAAC,iBAAA,CAAkB,QAAA,EAAU,aAAA,CAAc,CAAC,CAAC,CAAA;AAC/C,IAAA,MAAM,IAAI,QAAA,CAAS,+BAAA,EAAiC,WAAW,CAAA;AAEjE,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AACF,IAAA,OAAA,GAAU,KAAK,KAAA,CAAM,GAAA,CAAI,OAAO,aAAA,CAAc,CAAC,CAAC,CAAC,CAAA;AAAA,EACnD,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,QAAA,CAAS,mBAAA,EAAqB,WAAW,CAAA;AAAA,EACrD;AAEA,EAAA,MAAM,MAAM,MAAA,EAAO;AACnB,EAAA,MAAM,IAAA,GAAO,KAAK,cAAA,IAAkB,CAAA;AACpC,EAAA,IAAI,OAAA,CAAQ,GAAA,KAAQ,MAAA,IAAa,GAAA,GAAM,QAAQ,GAAA,GAAM,IAAA;AACnD,IAAA,MAAM,IAAI,QAAA,CAAS,eAAA,EAAiB,SAAS,CAAA;AAC/C,EAAA,IAAI,OAAA,CAAQ,GAAA,KAAQ,MAAA,IAAa,GAAA,GAAM,OAAO,OAAA,CAAQ,GAAA;AACpD,IAAA,MAAM,IAAI,QAAA,CAAS,sBAAA,EAAwB,YAAY,CAAA;AACzD,EAAA,IAAI,IAAA,CAAK,MAAA,IAAU,OAAA,CAAQ,GAAA,KAAQ,IAAA,CAAK,MAAA;AACtC,IAAA,MAAM,IAAI,QAAA,CAAS,iBAAA,EAAmB,QAAQ,CAAA;AAChD,EAAA,IAAI,KAAK,QAAA,EAAU;AACjB,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,OAAA,CAAQ,OAAA,CAAQ,GAAG,CAAA,GAAI,OAAA,CAAQ,GAAA,GAAM,OAAA,CAAQ,GAAA,GAAM,CAAC,OAAA,CAAQ,GAAG,IAAI,EAAC;AACtF,IAAA,IAAI,CAAC,GAAA,CAAI,QAAA,CAAS,IAAA,CAAK,QAAQ,GAAG,MAAM,IAAI,QAAA,CAAS,mBAAA,EAAqB,UAAU,CAAA;AAAA,EACtF;AACA,EAAA,OAAO,OAAA;AACT;AAKO,SAAS,WAAA,CAAY,QAAQ,EAAA,EAAY;AAC9C,EAAA,OAAO,WAAA,CAAY,WAAA,CAAY,KAAK,CAAC,CAAA;AACvC;AAGO,SAAS,SAAA,GAAoB;AAClC,EAAA,OAAO,YAAY,EAAE,CAAA;AACvB","file":"index.js","sourcesContent":["/**\n * @lacspace/jwt\n * JSON Web Tokens (HMAC) + secure random tokens — done safely.\n *\n * Sign and verify HS256/HS384/HS512 JWTs over Web Crypto (isomorphic), with\n * strict expiry / not-before / issuer / audience checks and constant-time\n * signature comparison. Plus opaque secure tokens and CSRF tokens.\n *\n * Zero dependencies (bar @lacspace/crypto) · isomorphic · fully typed.\n */\n\nimport { hmac, toBase64url, fromBase64url, constantTimeEqual, randomBytes, type HashAlgorithm } from \"@lacspace/crypto\";\n\nexport type Algorithm = \"HS256\" | \"HS384\" | \"HS512\";\nconst ALG_HASH: Record<Algorithm, HashAlgorithm> = {\n  HS256: \"SHA-256\",\n  HS384: \"SHA-384\",\n  HS512: \"SHA-512\",\n};\n\nexport class JwtError extends Error {\n  constructor(\n    message: string,\n    public code:\n      | \"malformed\"\n      | \"signature\"\n      | \"expired\"\n      | \"not_active\"\n      | \"issuer\"\n      | \"audience\"\n      | \"algorithm\",\n  ) {\n    super(message);\n    this.name = \"JwtError\";\n  }\n}\n\nexport interface JwtPayload {\n  iss?: string;\n  sub?: string;\n  aud?: string | string[];\n  exp?: number;\n  nbf?: number;\n  iat?: number;\n  jti?: string;\n  [key: string]: unknown;\n}\n\nexport interface SignOptions {\n  algorithm?: Algorithm;\n  /** Seconds from now until expiry, e.g. 3600. */\n  expiresIn?: number;\n  issuer?: string;\n  audience?: string | string[];\n  subject?: string;\n}\n\nconst enc = new TextEncoder();\nconst dec = new TextDecoder();\n\nfunction b64urlJson(obj: unknown): string {\n  return toBase64url(enc.encode(JSON.stringify(obj)));\n}\n\nfunction nowSec(): number {\n  return Math.floor(Date.now() / 1000);\n}\n\n/** Sign a JWT. */\nexport async function sign(\n  payload: JwtPayload,\n  secret: string | Uint8Array,\n  opts: SignOptions = {},\n): Promise<string> {\n  const alg = opts.algorithm ?? \"HS256\";\n  const iat = nowSec();\n  const body: JwtPayload = { iat, ...payload };\n  if (opts.expiresIn !== undefined) body.exp = iat + opts.expiresIn;\n  if (opts.issuer) body.iss = opts.issuer;\n  if (opts.audience) body.aud = opts.audience;\n  if (opts.subject) body.sub = opts.subject;\n\n  const signingInput = `${b64urlJson({ alg, typ: \"JWT\" })}.${b64urlJson(body)}`;\n  const sig = await hmac(secret, signingInput, ALG_HASH[alg]);\n  return `${signingInput}.${toBase64url(sig)}`;\n}\n\nexport interface VerifyOptions {\n  algorithms?: Algorithm[];\n  issuer?: string;\n  audience?: string;\n  /** Allowed clock skew in seconds. Default 0. */\n  clockTolerance?: number;\n}\n\n/** Decode a JWT without verifying (never trust the result for auth). */\nexport function decode(token: string): { header: Record<string, unknown>; payload: JwtPayload } {\n  const parts = token.split(\".\");\n  if (parts.length !== 3) throw new JwtError(\"malformed token\", \"malformed\");\n  return {\n    header: JSON.parse(dec.decode(fromBase64url(parts[0]!))),\n    payload: JSON.parse(dec.decode(fromBase64url(parts[1]!))),\n  };\n}\n\n/** Verify a JWT's signature and claims. Throws {@link JwtError} on any failure. */\nexport async function verify<T extends JwtPayload = JwtPayload>(\n  token: string,\n  secret: string | Uint8Array,\n  opts: VerifyOptions = {},\n): Promise<T> {\n  const parts = token.split(\".\");\n  if (parts.length !== 3) throw new JwtError(\"malformed token\", \"malformed\");\n  const [h, p, s] = parts as [string, string, string];\n\n  let header: { alg?: Algorithm };\n  try {\n    header = JSON.parse(dec.decode(fromBase64url(h)));\n  } catch {\n    throw new JwtError(\"malformed header\", \"malformed\");\n  }\n  const alg = header.alg;\n  if (!alg || !(alg in ALG_HASH)) throw new JwtError(`unsupported algorithm ${alg}`, \"algorithm\");\n  if (opts.algorithms && !opts.algorithms.includes(alg))\n    throw new JwtError(`algorithm ${alg} not allowed`, \"algorithm\");\n\n  const expected = await hmac(secret, `${h}.${p}`, ALG_HASH[alg]);\n  if (!constantTimeEqual(expected, fromBase64url(s)))\n    throw new JwtError(\"signature verification failed\", \"signature\");\n\n  let payload: T;\n  try {\n    payload = JSON.parse(dec.decode(fromBase64url(p)));\n  } catch {\n    throw new JwtError(\"malformed payload\", \"malformed\");\n  }\n\n  const now = nowSec();\n  const skew = opts.clockTolerance ?? 0;\n  if (payload.exp !== undefined && now > payload.exp + skew)\n    throw new JwtError(\"token expired\", \"expired\");\n  if (payload.nbf !== undefined && now + skew < payload.nbf)\n    throw new JwtError(\"token not yet active\", \"not_active\");\n  if (opts.issuer && payload.iss !== opts.issuer)\n    throw new JwtError(\"issuer mismatch\", \"issuer\");\n  if (opts.audience) {\n    const aud = Array.isArray(payload.aud) ? payload.aud : payload.aud ? [payload.aud] : [];\n    if (!aud.includes(opts.audience)) throw new JwtError(\"audience mismatch\", \"audience\");\n  }\n  return payload;\n}\n\n/* ------------------------------ opaque tokens ------------------------------ */\n\n/** A cryptographically-random URL-safe token (default 32 bytes → 43 chars). */\nexport function randomToken(bytes = 32): string {\n  return toBase64url(randomBytes(bytes));\n}\n\n/** A CSRF token (alias of a 32-byte random token). */\nexport function csrfToken(): string {\n  return randomToken(32);\n}\n"]}

package/package.json

@@ -0,0 +1,21 @@
+{
+  "name": "@lacspace/jwt",
+  "version": "1.0.0",
+  "description": "JSON Web Tokens (HS256/384/512) with strict expiry/issuer/audience checks + secure random & CSRF tokens. Isomorphic over Web Crypto — Node, edge, browser.",
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": { ".": { "import": { "types": "./dist/index.d.ts", "default": "./dist/index.js" }, "require": { "types": "./dist/index.d.cts", "default": "./dist/index.cjs" } } },
+  "files": ["dist"],
+  "sideEffects": false,
+  "scripts": { "build": "tsup", "prepublishOnly": "npm run build" },
+  "keywords": ["jwt", "jsonwebtoken", "hs256", "token", "auth", "csrf", "web-crypto", "edge", "typescript"],
+  "author": "Lacspace <contact@lacspace.com>",
+  "license": "MIT",
+  "homepage": "https://lacspace.com/packages",
+  "repository": { "type": "git", "url": "git+https://github.com/lacspace/npm-packages.git", "directory": "jwt" },
+  "bugs": { "url": "https://github.com/lacspace/npm-packages/issues" },
+  "engines": { "node": ">=18" },
+  "dependencies": { "@lacspace/crypto": "^1.0.0" }
+}