Tokenpack

Binary-pack schema-typed objects into compact Base64url tokens.

tokenpack is a wire-format and packing library. It does not authenticate, sign, or encrypt its output. If packed data is used as an authentication or authorization token, the caller must protect it with an appropriate MAC, digital signature, or authenticated-encryption scheme and verify that protection before trusting decoded values. Packed values are not confidential and may be read by anyone who receives the token.

npm install @twometer/tokenpack

Usage

import { Schema, int, string, list } from "@twometer/tokenpack";

const sessions = new Schema({
  userId: int(),
  name: string(),
  roles: list(string()),
});

const token = sessions.encode({userId: 42, name: "test", roles: ["admin"]});
sessions.decode(tokene); // Returns the encoded object

Schemas enforce resource limits during both encoding and decoding. Defaults are 4 KiB per binary token, 512 bytes of UTF-8 per string, and 64 elements per individual list. Override only the limits needed by a schema:

const sessions = new Schema(
  {
    userId: int(),
    name: string(),
    roles: list(string()),
  },
  {
    maxTokenBytes: 8 * 1024,
    maxStringBytes: 256,
    maxListLength: 32,
  },
);

The defaults are exported as DEFAULT_LIMITS, and each schema exposes its resolved, immutable limits property. Lengths must be non-negative safe integers. String limits count encoded UTF-8 bytes; list limits apply separately to every nested list.