lacewing 1.1.0 → 1.2.0

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to this project will be documented in this file.
 
+## [1.2.0] - 2026-09-26
+
+### Features
+
+- Export parseJsonObject, the strict JSON reading tokens get
+
 ## [1.1.0] - 2026-09-26
 
 ### Bug Fixes

package/README.md

@@ -433,14 +433,15 @@ aliases:
 ### Building on Lacewing: `lacewing/extension`
 
 For packages that add a check on top of a Lacewing profile and must agree with
-Lacewing about what a valid algorithm or duration is. It is covered by semver
-like the root export, and it is read-only:
+Lacewing about what a valid algorithm, duration or JWS segment is. It is
+covered by semver like the root export, and it is read-only:
 
 ```ts
-import { getAlgorithmProperties, parseDuration, readHeaderValue } from "lacewing/extension";
+import { getAlgorithmProperties, parseDuration, parseJsonObject, readHeaderValue } from "lacewing/extension";
 
 getAlgorithmProperties("ES256"); // { name: "ES256", kty: "EC", crv: "P-256", minKeyBits: 256 }, frozen
 parseDuration("15m");            // 900, as DurationSeconds
+parseJsonObject(text, "header"); // a plain object, or JWTInvalid; a member named twice is refused
 readHeaderValue(request, "dpop", "verifyProof"); // same source rules as parseBearer
 ```
 

package/dist/src/extension.js

@@ -9,8 +9,14 @@
  * it refuses an embedded `jwk`, which is right for a token and wrong for
  * any format that carries its own key, so each format owns its header
  * rules.
+ *
+ * `parseJsonObject` is the strict JSON reading a token's header and payload
+ * get: a plain object, and no member name twice at any depth. A format that
+ * reads JSON out of a JWS reads it the same way, so the two cannot disagree
+ * about which of two `alg` or `htu` members counts.
  */
 export { getAlgorithmProperties } from "./lib/algorithms.js";
+export { parseJsonObject } from "./lib/json.js";
 export { parseDuration } from "./lib/duration.js";
 export { readHeaderValue } from "./http/source.js";
 //# sourceMappingURL=extension.js.map

package/dist/src/extension.js.map

@@ -1 +1 @@
-{"version":3,"file":"extension.js","sourceRoot":"","sources":["../../src/extension.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,sBAAsB,EAAsB,MAAM,qBAAqB,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAqB,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"extension.js","sourceRoot":"","sources":["../../src/extension.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,sBAAsB,EAAsB,MAAM,qBAAqB,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAqB,MAAM,kBAAkB,CAAC"}

package/dist/types/src/extension.d.ts

@@ -9,8 +9,14 @@
  * it refuses an embedded `jwk`, which is right for a token and wrong for
  * any format that carries its own key, so each format owns its header
  * rules.
+ *
+ * `parseJsonObject` is the strict JSON reading a token's header and payload
+ * get: a plain object, and no member name twice at any depth. A format that
+ * reads JSON out of a JWS reads it the same way, so the two cannot disagree
+ * about which of two `alg` or `htu` members counts.
  */
 export { getAlgorithmProperties, type AlgorithmInfo } from "./lib/algorithms.js";
+export { parseJsonObject } from "./lib/json.js";
 export { parseDuration } from "./lib/duration.js";
 export { readHeaderValue, type HeaderSource } from "./http/source.js";
 //# sourceMappingURL=extension.d.ts.map

package/dist/types/src/extension.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extension.d.ts","sourceRoot":"","sources":["../../../src/extension.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,sBAAsB,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"extension.d.ts","sourceRoot":"","sources":["../../../src/extension.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,sBAAsB,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "lacewing",
-	"version": "1.1.0",
+	"version": "1.2.0",
 	"description": "An opinionated JWT library that makes RFC 8725 (JWT Best Current Practices) the default behavior, not an optional configuration.",
 	"type": "module",
 	"engines": {