@ractive-ch/tab-mcp 0.5.1 → 0.6.0

package/jwt.d.ts

@@ -35,6 +35,7 @@ export interface DecodedJwt {
 }
 /** Split and decode a compact JWS (no signature check). */
 export declare function decodeJwt(token: string): DecodedJwt;
+export declare function isAlgorithm(v: unknown): v is JwtAlgorithm;
 /** A source of verification keys (a JWKS URL in production). */
 export interface KeySource {
     /** Keys for `kid`; may fetch again when the kid is unknown. */
@@ -50,14 +51,21 @@ export declare class HttpJsonError extends Error {
 }
 /**
  * A JWKS URL, cached 10 minutes, fetched again for an unknown kid at most every
- * 30 s. After a failed fetch the last good keys are served for up to an hour
+ * 5 s. After a failed fetch the last good keys are served for up to an hour
  * (an outage must not refuse every token at once), and the next attempt waits
- * the same 30 s, so a dead endpoint is not hit (and waited for) on every check.
+ * 30 s, so a dead endpoint is not hit (and waited for) on every check. An
+ * unknown kid that could not be looked for again throws (the keys are
+ * unavailable) rather than answering "no such key".
  */
 export declare class JwksCache implements KeySource {
     #private;
+    /**
+     * `load` fetches the document; the default suits an operator-configured
+     * URL. A URL a client chose needs the SSRF-guarded fetch (DEC-106).
+     */
     constructor(url: string | (() => Promise<string>), options?: {
         now?: () => number;
+        load?: (url: string) => Promise<unknown>;
     });
     keys(kid: string | undefined): Promise<Jwk[]>;
 }