pkg-auth-util-auth-crypto-library

To update JWT utilities safely, modify creation, verification, and parsing while preserving existing failure modes like null or false returns. Ensure header and payload timing semantics remain intact and update index exports and TypeScript declarations to prevent consumer breakage.

Password hashing compatibility requires preserving the HMAC-based saved hash string format: $1$base64(algorithm)$base64(hash)$base64(salt)$. When modifying hashing behavior, maintain existing salt handling and strict error handling to avoid security regressions and authentication failures.

Yes, you can change signing, verification, and key pair generation primitives for Ed25519 and RSA. To keep tests deterministic, ensure strict error handling is applied and update Mocha runtime tests alongside TypeScript type tests before final validation.

Preventing secret leaks when modifying cryptography behavior requires avoiding secrets in application logs. Maintain existing string and format contracts for crypto primitives and ensure timing semantics are preserved during validation to prevent security regressions.

Before final validation of authentication and cryptography changes, update index exports, TypeScript declarations, and Mocha runtime tests. Ensure matching type tests are implemented to verify that consumer compatibility is maintained across all modified API surfaces.

Modifying service-to-service token formats can affect timing semantics if not handled carefully. Preserve existing header and payload timing contracts and ensure null or false failure modes are maintained to prevent authentication behavior regressions across consumers.