@t4h.framework/hmac 0.3.7 → 0.3.8

package/.ai/skills/framework-hmac/SKILL.md

@@ -49,8 +49,10 @@ Do **not** assume header parsing, env-variable mapping, or provider-specific pre
 import { App, Workflow } from '@t4h.framework/core'
 import { HMACAuthorization } from '@t4h.framework/hmac'
 
+import { environments } from './constants/environments.js'
+
 const authorization = new HMACAuthorization({
-  secret: '<shared-secret>',
+  secret: environments.HMAC_SECRET,
   signature: '<signature-from-runtime>',
   rawPayload: '<exact-signed-bytes>',
   signaturePrefix: 'sha256=',
@@ -88,19 +90,21 @@ Manifest shape (from tests):
 
 Optional manifest fields are still present as `undefined` when omitted (`toManifest` copies all keys).
 
+Declare the secret in the `EnvDesign` in `src/constants/environments.ts`. The context types `secret` as `string`, so declare the entry with `type: String`, not `type: Secret`. This is an exception to the `type: Secret` rule of **framework-core**.
+
 ---
 
 ## Context: `HMACAuthorizationContext`
 
 | Field | Required | Description |
 |-------|----------|-------------|
-| `secret` | Yes | Shared secret, used as **UTF-8 bytes** for the HMAC key. Empty → **throws**. A secret delivered hex/base64-encoded must be decoded by the caller before it is passed in. |
+| `secret` | Yes | Shared secret, used as **UTF-8 bytes** for the HMAC key. A secret delivered hex/base64-encoded must be decoded by the caller before it is passed in. |
 | `signature` | Yes | Signature the caller presented. Empty string → handler returns `false`. |
 | `rawPayload` | Yes | The **exact** bytes that were signed. Never re-serialize parsed JSON — key order and whitespace change and the digest will not match. |
-| `algorithm` | No | **Enum key** on `HMACAlgorithm` (`SHA1`, `SHA256`, `SHA384`, `SHA512`), not the Node crypto string. Defaults to `SHA256`. |
-| `signatureFormat` | No | Encoding of `signature`: `hex`, `base64`, `base64url`, `binary`. Defaults to `hex`. |
+| `algorithm` | No | `HMACAlgorithm` key: `SHA1`, `SHA256`, `SHA384` or `SHA512` (not `sha256`). Defaults to `SHA256`. Other values throw. |
+| `signatureFormat` | No | Encoding of `signature`: `hex`, `base64`, `base64url` or `binary`. Defaults to `hex`. Other values throw. |
 | `signaturePrefix` | No | Stripped before comparison, e.g. `sha256=`. If set and absent from `signature` → `false`. |
-| `timestamp` | Conditional | Required when `toleranceInSeconds` is set. All-digit string → Unix **seconds**; otherwise `Date.parse` (ISO 8601). |
+| `timestamp` | Conditional | Used with `toleranceInSeconds`. All-digit string → Unix **seconds**; otherwise `Date.parse` (ISO 8601). |
 | `toleranceInSeconds` | No | Enables replay protection. Symmetric window (past **and** future, for clock skew). |
 
 ---
@@ -116,12 +120,10 @@ Default export:
 Behavior, in order (from `hmac-authorize.ts` and tests):
 
 1. Falsy `signature` → **`false`** (no throw).
-2. Falsy `secret` → **throw** `Secret is required for payload verification`.
-3. Resolve `algorithm` via `HMACAlgorithm[key]`; unknown key → **throw** `Unsupported algorithm: <value>`.
-4. Resolve `signatureFormat`; not one of `hex`/`base64`/`base64url`/`binary` → **throw** `Unsupported signature format: <value>`.
-5. If `toleranceInSeconds` is set: missing `timestamp` → **throw** `Timestamp is required when a tolerance is set`; outside the window or unparseable → **`false`**.
-6. If `signaturePrefix` is set and `signature` does not start with it → **`false`**; otherwise strip it.
-7. Compute `crypto.createHmac(algorithm, secret).update(rawPayload).digest()` and compare with `crypto.timingSafeEqual`.
+2. Check the configuration (see **Return values vs errors**).
+3. If `toleranceInSeconds` is set: `timestamp` outside the window or unparseable → **`false`**.
+4. If `signaturePrefix` is set and `signature` does not start with it → **`false`**; otherwise strip it.
+5. Compute `crypto.createHmac(algorithm, secret).update(rawPayload).digest()` and compare with `crypto.timingSafeEqual`.
 
 The candidate is decoded from `signatureFormat` into a Buffer before comparing, so **hex casing and base64 padding never cause a false negative**, and a candidate of a different decoded length short-circuits to `false` (`timingSafeEqual` throws on length mismatch).
 
@@ -134,8 +136,6 @@ export enum HMACAlgorithm {
 }
 ```
 
-Pass `algorithm: 'SHA256'`, not `'sha256'` — the lowercase form is the enum *value* and makes the handler throw.
-
 ---
 
 ## Examples
@@ -144,7 +144,7 @@ Pass `algorithm: 'SHA256'`, not `'sha256'` — the lowercase form is the enum *v
 
 ```typescript
 new HMACAuthorization({
-  secret: env.WEBHOOK_SECRET,
+  secret: environments.HMAC_SECRET,
   signature: request.headers['x-hub-signature-256'], // 'sha256=9f86d0…'
   rawPayload: rawRequestBody,                        // the untouched body string
   signaturePrefix: 'sha256=',
@@ -155,7 +155,7 @@ new HMACAuthorization({
 
 ```typescript
 new HMACAuthorization({
-  secret: env.WEBHOOK_SECRET,
+  secret: environments.HMAC_SECRET,
   signature: parsedSignatureHeader.v1,
   rawPayload: `${timestamp}.${rawRequestBody}`, // timestamp bound INTO the signature
   timestamp,
@@ -169,7 +169,7 @@ new HMACAuthorization({
 
 ```typescript
 new HMACAuthorization({
-  secret: env.WEBHOOK_SECRET,
+  secret: environments.HMAC_SECRET,
   signature: base64Signature,
   rawPayload: canonicalPayloadString,
   algorithm: 'SHA512',
@@ -188,10 +188,7 @@ new HMACAuthorization({
 | Wrong secret / tampered payload / wrong algorithm / garbage signature | `false` |
 | `signaturePrefix` set but missing from `signature` | `false` |
 | Timestamp outside tolerance, or not parseable | `false` |
-| Empty `secret` | **Throw** |
-| `algorithm` not a `HMACAlgorithm` key | **Throw** |
-| Unsupported `signatureFormat` | **Throw** |
-| `toleranceInSeconds` without `timestamp` | **Throw** |
+| Empty `secret`, unknown `algorithm` or `signatureFormat`, `toleranceInSeconds` without `timestamp` | **Throw** (`hmac-authorize.ts`) |
 
 Design callers so manifest context is complete **before** the handler runs; missing or malformed configuration is a programmer error, not a silent denial.
 
@@ -241,8 +238,7 @@ For workflow orchestration and claims use **framework-core**; for JWKS/JWT verif
 3. Attach `new HMACAuthorization(context)` to `Workflow` and/or `App` `authorization` option.
 4. Keep `rawPayload` byte-exact — do not parse and re-stringify JSON.
 5. Set `signaturePrefix` when the provider prefixes the header (`sha256=`).
-6. Set `algorithm` / `signatureFormat` only when they differ from `SHA256` / `hex`; use **enum keys**.
+6. Set `algorithm` / `signatureFormat` only when they differ from `SHA256` / `hex`.
 7. Add `timestamp` + `toleranceInSeconds` for replay protection, and bind the timestamp into `rawPayload`.
-8. Read the secret from `EnvDesign` in `src/constants/environments.ts`, never hard-code it.
+8. `@t4h.framework/core/no-literal-secret-in-authorization` rejects a literal `secret`. Read it from the `EnvDesign` in `src/constants/environments.ts`.
 9. Expect `false` for deny, throws for misconfiguration.
-10. Do not reference APIs absent from `src/` and tests.

package/CHANGELOG.md

@@ -1,5 +1,30 @@
 # @t4h.framework/hmac
 
+## 0.3.8
+
+### Patch Changes
+
+- [#241](https://github.com/tech4humans-brasil/framework/pull/241) [`f6b8454`](https://github.com/tech4humans-brasil/framework/commit/f6b845484d22e7c8e7240fe2e113f1cdea7c8ce3) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - Adds seven rules to `@t4h.framework/core/eslint` and turns them on in `configs.recommended`:
+  - `no-io-in-workflow` reports `fetch` and calls to network, file, database and mail modules in a workflow and in the `constructor`, `toInput` and `toOutput` of an activity. It also reports `zlib` and `stream` calls there, because they work on the content in memory on each replay.
+  - `no-binary-subclass` reports a class that extends `Binary`.
+  - `no-framework-activity-in-app` reports `new` and `extends` on an activity of a framework package other than the core.
+  - `no-testing-import-in-source` reports an import of a `@t4h.framework/<package>/testing` entry out of a test file.
+  - `require-workflow-id` reports a `Workflow` with no `id`.
+  - `no-secret-to-string` reports a `Secret` that becomes a string.
+  - `no-literal-secret-in-authorization` reports a string literal in the `secret` or `clientSecret` field of an `Authorization`.
+
+  The package skills now name these rules in place of the text that the rules enforce. The docs and skills give each `Workflow` an `id`, read the HMAC secret from `EnvDesign`, and do not document a custom HTTP activity.
+
+- [#243](https://github.com/tech4humans-brasil/framework/pull/243) [`0ffd663`](https://github.com/tech4humans-brasil/framework/commit/0ffd663ce8369edd7b54206cb3216568ad1de471) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - The README examples read each value from `environments`, an `EnvDesign` in `src/constants/environments.ts`, and pass each credential as a `Secret`. They no longer use `process.env`, the raw `env` from the core or a literal in a `Secret` field. The jwks README describes the real context fields (`signature`, `rawPayload`) and says that a token that `jwt.verify` rejects throws.
+
+- [#240](https://github.com/tech4humans-brasil/framework/pull/240) [`0606115`](https://github.com/tech4humans-brasil/framework/commit/0606115e2e0baa994e9f0ed3559ee54ecac88e44) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - The skills do not repeat a rule that a lint rule, `tsc` or a runtime error already enforces. Each such rule is now one line that names the gate. The examples that broke a gate (`process.env`, `as any`, an inline secret, an `EnvDesign` in a workflow file, `ref.output` before `wait()`) are correct now.
+
+- [#228](https://github.com/tech4humans-brasil/framework/pull/228) [`d29e1ab`](https://github.com/tech4humans-brasil/framework/commit/d29e1ab29a039b13c3e4b075472bd615566ae75e) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - Uses exact types and `unknown` in place of `any`, and checks external data with guards.
+  - harness: the fix-issues prompt lists each sensor as `- checkTypes: PASS`. Before, it printed `- 0: [object Object]`.
+  - hmac: an algorithm name such as `constructor` throws `Unsupported algorithm`.
+  - oidc: a discovery response with no `introspection_endpoint`, or a null introspection body, throws a clear error.
+  - `HttpRequestActivity.toOutput` takes `HttpRequestActivityOutput` in place of `any`.
+
 ## 0.3.7
 
 ## 0.3.6

package/README.md

@@ -60,8 +60,10 @@ Note that the timestamp is only checked for freshness. If you want it *bound* to
 ```typescript
 import { HMACAuthorization } from '@t4h.framework/hmac'
 
+import { environments } from './constants/environments.js'
+
 const authorization = new HMACAuthorization({
-  secret: '<shared-secret>',
+  secret: environments.HMAC_SECRET,
   signature: '<signature-from-the-request-header>',
   rawPayload: '<the-exact-request-body>',
   signaturePrefix: 'sha256=',
@@ -70,4 +72,15 @@ const authorization = new HMACAuthorization({
 })
 ```
 
+Declare `HMAC_SECRET` in the `EnvDesign` in `src/constants/environments.ts` with `type: String`, because the `secret` field is a string:
+
+```typescript
+// src/constants/environments.ts
+import { EnvDesign } from '@t4h.framework/core'
+
+export const environments = EnvDesign({
+  HMAC_SECRET: { type: String },
+})
+```
+
 Wire `authorization` on an `App` or `Workflow` per the core package. The platform loads `@t4h.framework/hmac/authorize` with the manifest context when a protected workflow runs.

package/dist/hmac-authorize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hmac-authorize.d.ts","sourceRoot":"","sources":["../src/hmac-authorize.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAA;AAE7E,oBAAY,aAAa;IACvB,IAAI,SAAS;IACb,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,MAAM,WAAW;CAClB;AAED,eAAO,MAAM,sBAAsB,WAAW,CAAA;AAE9C,eAAO,MAAM,6BAA6B,QAAQ,CAAA;AASlD,wBAA8B,IAAI,CAChC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,OAAO,CAAC,CAgDlB"}
+{"version":3,"file":"hmac-authorize.d.ts","sourceRoot":"","sources":["../src/hmac-authorize.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAA;AAE7E,oBAAY,aAAa;IACvB,IAAI,SAAS;IACb,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,MAAM,WAAW;CAClB;AAED,eAAO,MAAM,sBAAsB,WAAW,CAAA;AAE9C,eAAO,MAAM,6BAA6B,QAAQ,CAAA;AAgElD,MAAM,CAAC,OAAO,UAAU,IAAI,CAC1B,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,OAAO,CAAC,CAIlB"}

package/dist/hmac-authorize.js

@@ -16,7 +16,13 @@ const SIGNATURE_FORMATS = [
     'base64url',
     'binary',
 ];
-export default async function hmac(options) {
+function isAlgorithmKey(key) {
+    return Object.hasOwn(HMACAlgorithm, key);
+}
+function isSignatureFormat(format) {
+    return SIGNATURE_FORMATS.some(supported => supported === format);
+}
+function verifyHmac(options) {
     const signature = options.signature;
     if (!signature)
         return false;
@@ -24,11 +30,11 @@ export default async function hmac(options) {
     if (!secret)
         throw new Error('Secret is required for payload verification');
     const algorithmKey = options.algorithm ?? HMAC_DEFAULT_ALGORITHM;
-    const algorithm = HMACAlgorithm[algorithmKey];
-    if (!algorithm)
+    if (!isAlgorithmKey(algorithmKey))
         throw new Error(`Unsupported algorithm: ${algorithmKey}`);
+    const algorithm = HMACAlgorithm[algorithmKey];
     const signatureFormat = options.signatureFormat ?? HMAC_DEFAULT_SIGNATURE_FORMAT;
-    if (!SIGNATURE_FORMATS.includes(signatureFormat))
+    if (!isSignatureFormat(signatureFormat))
         throw new Error(`Unsupported signature format: ${signatureFormat}`);
     const toleranceInSeconds = options.toleranceInSeconds;
     if (toleranceInSeconds !== undefined) {
@@ -48,4 +54,9 @@ export default async function hmac(options) {
         .digest();
     return timingSafeCompare(expected, candidate, signatureFormat);
 }
+export default function hmac(options) {
+    return new Promise(resolve => {
+        resolve(verifyHmac(options));
+    });
+}
 //# sourceMappingURL=hmac-authorize.js.map

package/dist/hmac-authorize.js.map

@@ -1 +1 @@
-{"version":3,"file":"hmac-authorize.js","sourceRoot":"","sources":["../src/hmac-authorize.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,EAAE,EAA6B,MAAM,aAAa,CAAA;AAE/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAA;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAA;AAGlE,MAAM,CAAN,IAAY,aAKX;AALD,WAAY,aAAa;IACvB,8BAAa,CAAA;IACb,kCAAiB,CAAA;IACjB,kCAAiB,CAAA;IACjB,kCAAiB,CAAA;AACnB,CAAC,EALW,aAAa,KAAb,aAAa,QAKxB;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,QAAQ,CAAA;AAE9C,MAAM,CAAC,MAAM,6BAA6B,GAAG,KAAK,CAAA;AAElD,MAAM,iBAAiB,GAA2B;IAChD,KAAK;IACL,QAAQ;IACR,WAAW;IACX,QAAQ;CACT,CAAA;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,IAAI,CAChC,OAAiC;IAEjC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;IAEnC,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAA;IAE5B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;IAE7B,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;IAE3E,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,IAAI,sBAAsB,CAAA;IAEhE,MAAM,SAAS,GAAG,aAAa,CAAC,YAA0C,CAAC,CAAA;IAE3E,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,YAAY,EAAE,CAAC,CAAA;IAEzE,MAAM,eAAe,GACnB,OAAO,CAAC,eAAe,IAAI,6BAA6B,CAAA;IAE1D,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,eAAuC,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,iCAAiC,eAAe,EAAE,CAAC,CAAA;IAErE,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAA;IAErD,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;QAEnC,IAAI,CAAC,SAAS;YACZ,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;QAElE,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,kBAAkB,CAAC;YAAE,OAAO,KAAK,CAAA;IACrE,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,eAAe,CAAA;IAEtC,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAA;IAEzD,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAErE,MAAM,QAAQ,GAAG,MAAM;SACpB,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC;SAC7B,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;SAC1B,MAAM,EAAE,CAAA;IAEX,OAAO,iBAAiB,CACtB,QAAQ,EACR,SAAS,EACT,eAAuC,CACxC,CAAA;AACH,CAAC"}
+{"version":3,"file":"hmac-authorize.js","sourceRoot":"","sources":["../src/hmac-authorize.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,EAAE,EAA6B,MAAM,aAAa,CAAA;AAE/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAA;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAA;AAGlE,MAAM,CAAN,IAAY,aAKX;AALD,WAAY,aAAa;IACvB,8BAAa,CAAA;IACb,kCAAiB,CAAA;IACjB,kCAAiB,CAAA;IACjB,kCAAiB,CAAA;AACnB,CAAC,EALW,aAAa,KAAb,aAAa,QAKxB;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,QAAQ,CAAA;AAE9C,MAAM,CAAC,MAAM,6BAA6B,GAAG,KAAK,CAAA;AAElD,MAAM,iBAAiB,GAA2B;IAChD,KAAK;IACL,QAAQ;IACR,WAAW;IACX,QAAQ;CACT,CAAA;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,OAAO,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,CAAA;AAC1C,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc;IACvC,OAAO,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,KAAK,MAAM,CAAC,CAAA;AAClE,CAAC;AAED,SAAS,UAAU,CAAC,OAAiC;IACnD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;IAEnC,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAA;IAE5B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;IAE7B,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;IAE3E,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,IAAI,sBAAsB,CAAA;IAEhE,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,0BAA0B,YAAY,EAAE,CAAC,CAAA;IAE3D,MAAM,SAAS,GAAG,aAAa,CAAC,YAAY,CAAC,CAAA;IAE7C,MAAM,eAAe,GACnB,OAAO,CAAC,eAAe,IAAI,6BAA6B,CAAA;IAE1D,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,iCAAiC,eAAe,EAAE,CAAC,CAAA;IAErE,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAA;IAErD,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;QAEnC,IAAI,CAAC,SAAS;YACZ,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;QAElE,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,kBAAkB,CAAC;YAAE,OAAO,KAAK,CAAA;IACrE,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,eAAe,CAAA;IAEtC,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAA;IAEzD,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAErE,MAAM,QAAQ,GAAG,MAAM;SACpB,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC;SAC7B,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;SAC1B,MAAM,EAAE,CAAA;IAEX,OAAO,iBAAiB,CAAC,QAAQ,EAAE,SAAS,EAAE,eAAe,CAAC,CAAA;AAChE,CAAC;AAED,MAAM,CAAC,OAAO,UAAU,IAAI,CAC1B,OAAiC;IAEjC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;QAC3B,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/models/HMACAuthorization.d.ts

@@ -5,7 +5,7 @@ export type HMACAuthorizationContext = {
     signature: string;
     rawPayload: string;
     algorithm?: string;
-    signatureFormat?: BinaryToTextEncoding | string;
+    signatureFormat?: BinaryToTextEncoding | (string & {});
     signaturePrefix?: string;
     timestamp?: string;
     toleranceInSeconds?: number;

package/dist/models/HMACAuthorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"HMACAuthorization.d.ts","sourceRoot":"","sources":["../../src/models/HMACAuthorization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAEvD,OAAO,EAAE,aAAa,EAAE,KAAK,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAE/E,MAAM,MAAM,wBAAwB,GAAG;IACrC,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,eAAe,CAAC,EAAE,oBAAoB,GAAG,MAAM,CAAA;IAC/C,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAC5B,CAAA;AAED,MAAM,MAAM,yBAAyB,GACnC,qBAAqB,CAAC,wBAAwB,CAAC,CAAA;AAEjD,qBAAa,iBAAkB,SAAQ,aAAa,CAAC,wBAAwB,CAAC;IAChE,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,wBAAwB;IAIvD,UAAU,IAAI,yBAAyB;CAe/C"}
+{"version":3,"file":"HMACAuthorization.d.ts","sourceRoot":"","sources":["../../src/models/HMACAuthorization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAEvD,OAAO,EAAE,aAAa,EAAE,KAAK,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAE/E,MAAM,MAAM,wBAAwB,GAAG;IACrC,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,eAAe,CAAC,EAAE,oBAAoB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;IACtD,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAC5B,CAAA;AAED,MAAM,MAAM,yBAAyB,GACnC,qBAAqB,CAAC,wBAAwB,CAAC,CAAA;AAEjD,qBAAa,iBAAkB,SAAQ,aAAa,CAAC,wBAAwB,CAAC;IAChE,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,wBAAwB;IAIvD,UAAU,IAAI,yBAAyB;CAe/C"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@t4h.framework/hmac",
-  "version": "0.3.7",
+  "version": "0.3.8",
   "description": "HMAC module for the T4H Framework authorization",
   "homepage": "https://github.com/tech4humans-brasil/framework/tree/main/packages/hmac",
   "bugs": "https://github.com/tech4humans-brasil/framework/issues",
@@ -36,12 +36,14 @@
   "scripts": {
     "build": "tsc --project tsconfig.build.json",
     "check-types": "tsc --noEmit",
+    "check-package": "publint --strict && attw --pack . --profile esm-only",
+    "lint": "eslint . --max-warnings 0",
     "prepublishOnly": "yarn build",
     "test": "vitest run",
     "test:watch": "vitest"
   },
   "devDependencies": {
-    "@t4h.framework/core": "^0.19.0",
+    "@t4h.framework/core": "^0.20.0",
     "typescript": "^5.9.3",
     "vitest": "^4.0.18"
   },