@mulmoclaude/common 1.1.2 → 1.2.0

package/README.md

@@ -37,6 +37,7 @@ helpers below.
 |---|---|---|
 | `errorMessage(v, fallback?)` | `string` | unknown caught value → human-readable string; **isomorphic**, so Vue/browser surfaces use it too |
 | `toUtcIsoDate(timestamp)` | `string` | `Date` → `YYYY-MM-DD` in UTC — for dates that must not shift with the host's local timezone |
+| `splitJwtSegments(token)` | `JwtSegments \| null` | JWS compact serialization → its three segments; `null` for anything that isn't **exactly** three. Pure string work, so the Node bridges and the Workers relay share the guard while decoding differently |
 
 `errorMessage` surfaces a non-empty string `details` (gRPC convention) or
 `message` field of a non-Error object (`details` wins) instead of

package/dist/index.d.ts

@@ -62,5 +62,20 @@ export declare function toUtcIsoDate(timestamp: Date): string;
  *  introduces contain none of the other four characters, so nothing is
  *  double-escaped. Not a sanitiser: it neither strips tags nor validates URLs. */
 export declare function escapeHtml(value: string): string;
+export interface JwtSegments {
+    headerSegment: string;
+    payloadSegment: string;
+    signatureSegment: string;
+}
+/** Split a JWS compact serialization into its three segments, or `null` when the
+ *  token isn't well-formed. Pure string work, so the Node bridges and the
+ *  Cloudflare Workers relay — which decode the segments differently (`Buffer` vs
+ *  `atob`) — can still share this one guard.
+ *
+ *  A JWS compact serialization is EXACTLY three segments. Both a short token and
+ *  a longer one (a five-segment JWE, or an attacker appending `.junk`) are
+ *  rejected outright — never parsed from their first three segments, which would
+ *  let the signed input disagree with the token. */
+export declare function splitJwtSegments(token: string): JwtSegments | null;
 export { scanEnvOptions, snakeToLowerCamel, type ScanEnvOptionsConfig } from "./envScan.js";
 export type { MinimalLogger, StructuredLogger } from "./logger.js";

package/dist/index.js

@@ -116,4 +116,21 @@ const HTML_ESCAPES = new Map([
 export function escapeHtml(value) {
     return value.replace(/[&<>"']/g, (char) => HTML_ESCAPES.get(char) ?? char);
 }
+/** Split a JWS compact serialization into its three segments, or `null` when the
+ *  token isn't well-formed. Pure string work, so the Node bridges and the
+ *  Cloudflare Workers relay — which decode the segments differently (`Buffer` vs
+ *  `atob`) — can still share this one guard.
+ *
+ *  A JWS compact serialization is EXACTLY three segments. Both a short token and
+ *  a longer one (a five-segment JWE, or an attacker appending `.junk`) are
+ *  rejected outright — never parsed from their first three segments, which would
+ *  let the signed input disagree with the token. */
+export function splitJwtSegments(token) {
+    const [headerSegment, payloadSegment, signatureSegment, ...extraSegments] = token.split(".");
+    if (headerSegment === undefined || payloadSegment === undefined || signatureSegment === undefined)
+        return null;
+    if (extraSegments.length > 0)
+        return null;
+    return { headerSegment, payloadSegment, signatureSegment };
+}
 export { scanEnvOptions, snakeToLowerCamel } from "./envScan.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mulmoclaude/common",
-  "version": "1.1.2",
+  "version": "1.2.0",
   "description": "General-purpose pure utilities (type guards, etc.) shared across the MulmoClaude host, bridges, and plugins",
   "type": "module",
   "main": "./dist/index.js",