Status
Worker-safe bearer-key generation and hashing primitives
Stability
Section titled “Stability”Ear Tag declares source version 0.1.0. Until 1.0, a minor release can change the public API, so pin the version you test against.
Package qualification does not publish a release. Check the npm registry before choosing a released version.
Limits and errors
Section titled “Limits and errors”A bearer key is a secret: anyone who obtains it can present it to the system that accepts it. Do not log or persist plaintext keys. Retain the digest and give the plaintext only to its intended recipient.
hashKey requires Web Crypto’s crypto.subtle.digest. Key length follows
Cairn’s raw nanoid sizing behavior. Callers should supply a bounded
nonnegative integer rather than untrusted sizing input.
The key store’s rate limit is counted in memory, not persisted; it resets if the
host recreates the store (for example a Durable Object waking from eviction). A
KeyPrincipal returned by verify is a plain, unsealed data object: current
and admitUse accept one back to resume a session cheaply, but they re-read the
live key row and its grant version on every call, so a fabricated or stale
principal is refused rather than trusted.
Contribute and license
Section titled “Contribute and license”Ear Tag is MIT licensed. See LICENSE.