@meshqljs/integrity (@meshql/integrity)

Request signing, integrity tokens, and authenticated MeshQL routes.

Install

npmJSR

npm install @meshqljs/integrity @meshqljs/core @meshqljs/http

npx jsr add @meshql/integrity @meshql/core @meshql/http

Published on npm as @meshqljs/integrity and JSR as @meshql/integrity.

Example

npmJSR

import { createMesh } from "@meshqljs/core";
import { withIntegrity } from "@meshqljs/integrity";
import { meshIntegrityExpressRouter } from "@meshqljs/integrity/express";
import express from "express";

const mesh = withIntegrity(createMesh({ entities: { /* … */ } }), {
  secret: process.env.MESH_SECRET!,
  authenticate: async (creds) => {
    // return { userId, sessionId, role }
  },
});

const app = express();
app.use(meshIntegrityExpressRouter(mesh, mesh.integrity, "/mesh"));
app.listen(3001);

import { createMesh } from "@meshql/core";
import { withIntegrity } from "@meshql/integrity";
import { meshIntegrityExpressRouter } from "@meshql/integrity/express";
import express from "express";

const mesh = withIntegrity(createMesh({ entities: { /* … */ } }), {
  secret: process.env.MESH_SECRET!,
  authenticate: async (creds) => {
    // return { userId, sessionId, role }
  },
});

const app = express();
app.use(meshIntegrityExpressRouter(mesh, mesh.integrity, "/mesh"));
app.listen(3001);

JSR imports: @meshql/core, @meshql/integrity, @meshql/integrity/express.

See the run example for a full signed-auth walkthrough.

HMAC covers the exact X-Mesh-Query header. A captured signed request can be replayed until token expiry or logout revoke — use a short tokenTTL, TLS, and persisted queries. See the threat model.