ecwt 0.3.3 → 0.4.0

package/README.md

@@ -9,7 +9,7 @@ ECWT is module for creating and verifying encrypted CBOR Web Tokens. It is desig
 | --- | --- | --- |
 | Encoding | 🧐 JSON with base64 | ✅ CBOR <br> 2x smaller output |
 | Binary data | 🧐 Double base64 encoding | ✅ Supported out of the box |
-| Security | 📝 Signed <br> Payload is readable by everyone | 🔒 Encrypted <br> Payload is readable only by the private key possessor |
+| Security | 📝 Signed <br> Payload is readable by everyone | 🔒 Encrypted <br> Payload is readable only with private key |
 | Metadata | ➕ Type and algorithm, increases size | ✅ No unnecessary metadata |
 | Revocation | 🧑‍💻 Requires additional implementation | ✅ Included with Redis |
 
@@ -168,10 +168,6 @@ console.log(`Expiration timestamp: ${ecwt.ts_expired}`);
 console.log(`Remaining validity: ${ecwt.getTTL()} seconds`);
 ```
 
-> **Warning regarding non-expiring tokens:**
->
-> When using `ttl: null`, revoked tokens remain in Redis storage indefinitely. This can lead to uncontrolled database growth over time as these tokens are never automatically purged. Consider implementing a periodic cleanup strategy if non-expiring tokens are required.
-
 ### Token Verification
 
 Implement verification with appropriate error handling:
@@ -252,7 +248,7 @@ try {
 
 ### Advanced: Token Size Optimization
 
-To reduce token size, use SenML key mapping that replaces string object keys with numeric identifiers throughout your entire payload structure. This compression works at any nesting depth. When implementing, catalog all potential keys across your schema and assign consistent numeric values to each, as these mappings cannot be changed once tokens are in circulation.
+To reduce token size, use SenML key mapping that replaces string object keys with numeric identifiers throughout your entire payload structure. This compression works at any nesting depth.
 
 > **Important:** The SenML key mapping configuration establishes a permanent relationship between field names and their numeric identifiers. Once deployed, these mappings must remain consistent to maintain compatibility with existing tokens. Adding new fields is acceptable, but changing existing mappings can break previously issued tokens.
 

package/bun.lock

@@ -8,6 +8,7 @@
         "base-x": "5.0.1",
         "cbor-x": "1.5.6",
         "evilcrypt": "0.2.3",
+        "valibot": "1.4.1",
       },
       "devDependencies": {
         "@biomejs/biome": "2.4.10",
@@ -19,7 +20,6 @@
         "tsdown": "0.21.10",
         "typescript": "6.0.2",
         "unplugin-unused": "0.5.7",
-        "valibot": "1.4.0",
         "vitest": "4.1.7",
       },
       "peerDependencies": {
@@ -700,7 +700,7 @@
 
     "util-deprecate": ["util-deprecate@1.0.2", "", {}, "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw=="],
 
-    "valibot": ["valibot@1.4.0", "", { "peerDependencies": { "typescript": ">=5" }, "optionalPeers": ["typescript"] }, "sha512-iC/x7fVcSyOwlm/VSt7RlHnzNGLGvR9GnxdifUeWoCJo0q4ZZvrVkIHC6faTlkxG47I2Y4UrFquPuVHCrOnrLg=="],
+    "valibot": ["valibot@1.4.1", "", { "peerDependencies": { "typescript": ">=5" }, "optionalPeers": ["typescript"] }, "sha512-klCmFTz2jeDluy9RwX+F884TCiogtdBJ/YaxSx1EOBYXa3NXNWj8kR1jjN8rzluwojJVWWaHJ4r1U5LfICnM3g=="],
 
     "vite": ["vite@7.3.3", "", { "dependencies": { "esbuild": "^0.27.0", "fdir": "^6.5.0", "picomatch": "^4.0.3", "postcss": "^8.5.6", "rollup": "^4.43.0", "tinyglobby": "^0.2.15" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "peerDependencies": { "@types/node": "^20.19.0 || >=22.12.0", "jiti": ">=1.21.0", "less": "^4.0.0", "lightningcss": "^1.21.0", "sass": "^1.70.0", "sass-embedded": "^1.70.0", "stylus": ">=0.54.8", "sugarss": "^5.0.0", "terser": "^5.16.0", "tsx": "^4.8.1", "yaml": "^2.4.2" }, "optionalPeers": ["@types/node", "jiti", "less", "lightningcss", "sass", "sass-embedded", "stylus", "sugarss", "terser", "tsx", "yaml"], "bin": { "vite": "bin/vite.js" } }, "sha512-/4XH147Ui7OGTjg3HbdWe5arnZQSbfuRzdr9Ec7TQi5I7R+ir0Rlc9GIvD4v0XZurELqA035KVXJXpR61xhiTA=="],
 

package/dist/main.cjs

@@ -23,6 +23,8 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 //#endregion
 let cbor_x = require("cbor-x");
 let evilcrypt = require("evilcrypt");
+let valibot = require("valibot");
+valibot = __toESM(valibot, 1);
 let base_x = require("base-x");
 base_x = __toESM(base_x, 1);
 //#region src/errors.ts
@@ -66,7 +68,7 @@ var Ecwt = class {
 	* @param options -
 	* @param options.token String representation of token.
 	* @param options.snowflake -
-	* @param options.ttl_initial Time to live in seconds at the moment of token creation.
+	* @param options.ttl_initial Time to live in **seconds** at the moment of token creation.
 	* @param options.data Data stored in token.
 	*/
 	constructor(ecwtFactory, options) {
@@ -78,19 +80,17 @@ var Ecwt = class {
 		this.#ttl_initial = options.ttl_initial;
 	}
 	/**
-	* Unix timestamp of token expiration in seconds.
+	* Unix timestamp of token expiration in **seconds**.
 	* @returns -
 	*/
 	get ts_expired() {
-		if (this.#ttl_initial === null) return null;
 		return Math.floor(this.snowflake.timestamp / 1e3) + this.#ttl_initial;
 	}
 	/**
-	* Actual time to live in seconds.
+	* Actual time to live in **seconds**.
 	* @returns -
 	*/
 	getTTL() {
-		if (this.#ttl_initial === null) return null;
 		return this.#ttl_initial - Math.floor((Date.now() - this.snowflake.timestamp) / 1e3);
 	}
 	/** Revokes token. */
@@ -104,6 +104,11 @@ const base62 = (0, base_x.default)("0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefgh
 //#endregion
 //#region src/factory.ts
 const REDIS_PREFIX = "@ecwt:";
+const tokenSchema = valibot.tuple([
+	valibot.pipe(valibot.unknown(), valibot.check((value) => Buffer.isBuffer(value)), valibot.transform((value) => value)),
+	valibot.number(),
+	valibot.record(valibot.string(), valibot.unknown())
+]);
 var EcwtFactory = class {
 	#redisClient;
 	#lruCache;
@@ -126,16 +131,15 @@ var EcwtFactory = class {
 	* @async
 	* @param data - Data to be stored in token.
 	* @param options -
-	* @param options.ttl - Time to live in seconds. If not defined, token will never expire.
+	* @param options.ttl - Time to live in **seconds**.
 	* @returns -
 	*/
-	async create(data, options = {}) {
+	async create(data, options) {
 		if (typeof this.#validator === "function") data = this.#validator(data);
-		const ttl = options.ttl ?? null;
 		const snowflake = await this.#snowflakeFactory.createSafe();
 		const payload = [
 			snowflake.toBuffer(),
-			ttl,
+			options.ttl,
 			data
 		];
 		const token_raw = this.#cborEncoder ? this.#cborEncoder.encode(payload) : (0, cbor_x.encode)(payload);
@@ -143,13 +147,13 @@ var EcwtFactory = class {
 		const token = base62.encode(token_encrypted);
 		this.setCache(token, {
 			snowflake,
-			ttl_initial: ttl,
+			ttl_initial: options.ttl,
 			data
 		});
 		return new Ecwt(this, {
 			token,
 			snowflake,
-			ttl_initial: ttl,
+			ttl_initial: options.ttl,
 			data
 		});
 	}
@@ -160,7 +164,7 @@ var EcwtFactory = class {
 	*/
 	setCache(token, cache_value) {
 		var _this$lruCache;
-		(_this$lruCache = this.#lruCache) === null || _this$lruCache === void 0 || _this$lruCache.set(token, cache_value, cache_value.ttl_initial === null ? void 0 : { ttl: cache_value.ttl_initial * 1e3 });
+		(_this$lruCache = this.#lruCache) === null || _this$lruCache === void 0 || _this$lruCache.set(token, cache_value, { ttl: cache_value.ttl_initial * 1e3 });
 	}
 	/**
 	* Parses token.
@@ -182,28 +186,34 @@ var EcwtFactory = class {
 			} catch {
 				throw new EcwtParseError();
 			}
-			const payload = this.#cborEncoder ? this.#cborEncoder.decode(token_raw) : (0, cbor_x.decode)(token_raw);
-			const [snowflake_buffer] = payload;
-			[, ttl_initial, data] = payload;
+			const payload = valibot.parse(tokenSchema, this.#cborEncoder ? this.#cborEncoder.decode(token_raw) : (0, cbor_x.decode)(token_raw));
+			const snowflake_buffer = payload[0];
+			ttl_initial = payload[1];
+			const data_raw = payload[2];
 			snowflake = this.#snowflakeFactory.parse(snowflake_buffer);
 			if (typeof this.#validator === "function") try {
-				data = this.#validator(data);
+				data = this.#validator(data_raw);
 			} catch {
 				throw new EcwtParseError();
 			}
+			else data = data_raw;
 			this.setCache(token, {
 				snowflake,
 				ttl_initial,
 				data
 			});
-		} else ({snowflake, ttl_initial, data} = cached_entry.value);
+		} else {
+			snowflake = cached_entry.value.snowflake;
+			ttl_initial = cached_entry.value.ttl_initial;
+			data = cached_entry.value.data;
+		}
 		const ecwt = new Ecwt(this, {
 			token,
 			snowflake,
 			ttl_initial,
 			data
 		});
-		if (typeof ttl_initial === "number" && Number.isNaN(ttl_initial) !== true && snowflake.timestamp + ttl_initial * 1e3 < Date.now()) throw new EcwtExpiredError(ecwt);
+		if (snowflake.timestamp + ttl_initial * 1e3 < Date.now()) throw new EcwtExpiredError(ecwt);
 		if (this.#redisClient) {
 			await this.#migrateExpired();
 			if (await this.#redisClient.HEXISTS(this.#redis_key_revoked, ecwt.id)) throw new EcwtRevokedError(ecwt);
@@ -246,17 +256,14 @@ var EcwtFactory = class {
 	async _revoke(token_id, created_at_ms, ttl_initial) {
 		if (this.#redisClient) {
 			await this.#migrateExpired();
-			if (ttl_initial === null) await this.#redisClient.HSET(this.#redis_key_revoked, token_id, "");
-			else {
-				const expires_in_ms = created_at_ms + ttl_initial * 1e3 - Date.now();
-				if (expires_in_ms > 0) await this.#redisClient.MULTI().HSET(this.#redis_key_revoked, token_id, "").HPEXPIRE(this.#redis_key_revoked, token_id, expires_in_ms).EXEC();
-			}
+			const expires_in_ms = created_at_ms + ttl_initial * 1e3 - Date.now();
+			if (expires_in_ms > 0) await this.#redisClient.MULTI().HSET(this.#redis_key_revoked, token_id, "").HPEXPIRE(this.#redis_key_revoked, token_id, expires_in_ms).EXEC();
 		} else console.warn("[ecwt] Redis client is not provided. Tokens cannot be revoked.");
 	}
 	#migrated = false;
 	async #migrateExpired() {
 		if (this.#redisClient && !this.#migrated) {
-			await this.#redisClient.EVAL("local key = KEYS[1] if redis.call(\"TYPE\", key)[\"ok\"] ~= \"zset\" then return end local key_hash = key .. \":hash\" local ts_now = tonumber(ARGV[1]) local cursor = \"0\" repeat local scan = redis.call(\"ZSCAN\", key, cursor, \"COUNT\", 1000) cursor = scan[1] local items = scan[2] for i = 1, #items, 2 do local field = items[i] local expire_at = tonumber(items[i + 1]) local expire_in = expire_at and expire_at - ts_now if expire_in and expire_in > 0 then redis.call(\"HSET\", key_hash, field, \"\") redis.call(\"HPEXPIRE\", key_hash, expire_in, \"FIELDS\", 1, field) end end until cursor == \"0\" redis.call(\"DEL\", key) redis.call(\"RENAME\", key_hash, key)", {
+			await this.#redisClient.EVAL("local key = KEYS[1] if redis.call(\"TYPE\", key)[\"ok\"] ~= \"zset\" then return end local key_hash = key .. \":hash\" local ts_now = tonumber(ARGV[1]) local cursor = \"0\" repeat local scan = redis.call(\"ZSCAN\", key, cursor, \"COUNT\", 1000) cursor = scan[1] local items = scan[2] for i = 1, #items, 2 do local field = items[i] local expire_at = tonumber(items[i + 1]) local expire_in = expire_at and expire_at - ts_now if expire_in and expire_in > 0 then redis.call(\"HSET\", key_hash, field, \"\") redis.call(\"HPEXPIRE\", key_hash, expire_in, \"FIELDS\", 1, field) end end until cursor == \"0\" redis.call(\"DEL\", key) if redis.call(\"EXISTS\", key_hash) == 1 then redis.call(\"RENAME\", key_hash, key) end", {
 				keys: [this.#redis_key_revoked],
 				arguments: [String(Date.now())]
 			});

package/dist/main.d.cts

@@ -5,7 +5,7 @@ import { RedisClientType, RedisFunctions, RedisModules, RedisScripts } from "red
 //#region src/factory.d.ts
 type LRUCacheValue = {
   snowflake: Snowflake;
-  ttl_initial: number | null;
+  ttl_initial: number;
   data: Record<string, unknown>;
 };
 type RedisClient = RedisClientType<RedisModules, RedisFunctions, RedisScripts>;
@@ -33,11 +33,11 @@ declare class EcwtFactory<const D extends Record<string, unknown> = Record<strin
   * @async
   * @param data - Data to be stored in token.
   * @param options -
-  * @param options.ttl - Time to live in seconds. If not defined, token will never expire.
+  * @param options.ttl - Time to live in **seconds**.
   * @returns -
   */
-  create(data: D, options?: {
-    /** Time to live in seconds. If not defined, token will never expire. */ttl?: number;
+  create(data: D, options: {
+    /** Time to live in **seconds**. */ttl: number;
   }): Promise<Ecwt<D>>;
   /**
   * Sets data to cache.
@@ -81,25 +81,25 @@ declare class Ecwt<const D extends Record<string, unknown> = Record<string, unkn
   * @param options -
   * @param options.token String representation of token.
   * @param options.snowflake -
-  * @param options.ttl_initial Time to live in seconds at the moment of token creation.
+  * @param options.ttl_initial Time to live in **seconds** at the moment of token creation.
   * @param options.data Data stored in token.
   */
-  constructor(ecwtFactory: EcwtFactory, options: {
+  constructor(ecwtFactory: EcwtFactory<D>, options: {
     token: string;
     snowflake: Snowflake;
-    ttl_initial: number | null;
+    ttl_initial: number;
     data: D;
   });
   /**
-  * Unix timestamp of token expiration in seconds.
+  * Unix timestamp of token expiration in **seconds**.
   * @returns -
   */
-  get ts_expired(): number | null;
+  get ts_expired(): number;
   /**
-  * Actual time to live in seconds.
+  * Actual time to live in **seconds**.
   * @returns -
   */
-  getTTL(): number | null;
+  getTTL(): number;
   /** Revokes token. */
   revoke(): Promise<void>;
 }
@@ -110,17 +110,17 @@ declare class EcwtParseError extends Error {
   constructor();
 }
 /** Error thrown when parsed Ecwt is invalid. */
-declare class EcwtInvalidError extends Error {
-  readonly ecwt: Ecwt;
+declare class EcwtInvalidError<D extends Record<string, unknown>> extends Error {
+  readonly ecwt: Ecwt<D>;
   override message: string;
-  constructor(ecwt: Ecwt);
+  constructor(ecwt: Ecwt<D>);
 }
 /** Error thrown when parsed Ecwt is expired. */
-declare class EcwtExpiredError extends EcwtInvalidError {
+declare class EcwtExpiredError<D extends Record<string, unknown>> extends EcwtInvalidError<D> {
   override message: string;
 }
 /** Error thrown when parsed Ecwt is revoked. */
-declare class EcwtRevokedError extends EcwtInvalidError {
+declare class EcwtRevokedError<D extends Record<string, unknown>> extends EcwtInvalidError<D> {
   override message: string;
 }
 //#endregion

package/dist/main.d.mts

@@ -5,7 +5,7 @@ import { RedisClientType, RedisFunctions, RedisModules, RedisScripts } from "red
 //#region src/factory.d.ts
 type LRUCacheValue = {
   snowflake: Snowflake;
-  ttl_initial: number | null;
+  ttl_initial: number;
   data: Record<string, unknown>;
 };
 type RedisClient = RedisClientType<RedisModules, RedisFunctions, RedisScripts>;
@@ -33,11 +33,11 @@ declare class EcwtFactory<const D extends Record<string, unknown> = Record<strin
   * @async
   * @param data - Data to be stored in token.
   * @param options -
-  * @param options.ttl - Time to live in seconds. If not defined, token will never expire.
+  * @param options.ttl - Time to live in **seconds**.
   * @returns -
   */
-  create(data: D, options?: {
-    /** Time to live in seconds. If not defined, token will never expire. */ttl?: number;
+  create(data: D, options: {
+    /** Time to live in **seconds**. */ttl: number;
   }): Promise<Ecwt<D>>;
   /**
   * Sets data to cache.
@@ -81,25 +81,25 @@ declare class Ecwt<const D extends Record<string, unknown> = Record<string, unkn
   * @param options -
   * @param options.token String representation of token.
   * @param options.snowflake -
-  * @param options.ttl_initial Time to live in seconds at the moment of token creation.
+  * @param options.ttl_initial Time to live in **seconds** at the moment of token creation.
   * @param options.data Data stored in token.
   */
-  constructor(ecwtFactory: EcwtFactory, options: {
+  constructor(ecwtFactory: EcwtFactory<D>, options: {
     token: string;
     snowflake: Snowflake;
-    ttl_initial: number | null;
+    ttl_initial: number;
     data: D;
   });
   /**
-  * Unix timestamp of token expiration in seconds.
+  * Unix timestamp of token expiration in **seconds**.
   * @returns -
   */
-  get ts_expired(): number | null;
+  get ts_expired(): number;
   /**
-  * Actual time to live in seconds.
+  * Actual time to live in **seconds**.
   * @returns -
   */
-  getTTL(): number | null;
+  getTTL(): number;
   /** Revokes token. */
   revoke(): Promise<void>;
 }
@@ -110,17 +110,17 @@ declare class EcwtParseError extends Error {
   constructor();
 }
 /** Error thrown when parsed Ecwt is invalid. */
-declare class EcwtInvalidError extends Error {
-  readonly ecwt: Ecwt;
+declare class EcwtInvalidError<D extends Record<string, unknown>> extends Error {
+  readonly ecwt: Ecwt<D>;
   override message: string;
-  constructor(ecwt: Ecwt);
+  constructor(ecwt: Ecwt<D>);
 }
 /** Error thrown when parsed Ecwt is expired. */
-declare class EcwtExpiredError extends EcwtInvalidError {
+declare class EcwtExpiredError<D extends Record<string, unknown>> extends EcwtInvalidError<D> {
   override message: string;
 }
 /** Error thrown when parsed Ecwt is revoked. */
-declare class EcwtRevokedError extends EcwtInvalidError {
+declare class EcwtRevokedError<D extends Record<string, unknown>> extends EcwtInvalidError<D> {
   override message: string;
 }
 //#endregion

package/dist/main.mjs

@@ -1,5 +1,6 @@
 import { Encoder, decode, encode } from "cbor-x";
 import { decrypt, v2 } from "evilcrypt";
+import * as v from "valibot";
 import basex from "base-x";
 //#region src/errors.ts
 /** Error thrown when string token cannot be parsed to Ecwt. */
@@ -42,7 +43,7 @@ var Ecwt = class {
 	* @param options -
 	* @param options.token String representation of token.
 	* @param options.snowflake -
-	* @param options.ttl_initial Time to live in seconds at the moment of token creation.
+	* @param options.ttl_initial Time to live in **seconds** at the moment of token creation.
 	* @param options.data Data stored in token.
 	*/
 	constructor(ecwtFactory, options) {
@@ -54,19 +55,17 @@ var Ecwt = class {
 		this.#ttl_initial = options.ttl_initial;
 	}
 	/**
-	* Unix timestamp of token expiration in seconds.
+	* Unix timestamp of token expiration in **seconds**.
 	* @returns -
 	*/
 	get ts_expired() {
-		if (this.#ttl_initial === null) return null;
 		return Math.floor(this.snowflake.timestamp / 1e3) + this.#ttl_initial;
 	}
 	/**
-	* Actual time to live in seconds.
+	* Actual time to live in **seconds**.
 	* @returns -
 	*/
 	getTTL() {
-		if (this.#ttl_initial === null) return null;
 		return this.#ttl_initial - Math.floor((Date.now() - this.snowflake.timestamp) / 1e3);
 	}
 	/** Revokes token. */
@@ -80,6 +79,11 @@ const base62 = basex("0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuv
 //#endregion
 //#region src/factory.ts
 const REDIS_PREFIX = "@ecwt:";
+const tokenSchema = v.tuple([
+	v.pipe(v.unknown(), v.check((value) => Buffer.isBuffer(value)), v.transform((value) => value)),
+	v.number(),
+	v.record(v.string(), v.unknown())
+]);
 var EcwtFactory = class {
 	#redisClient;
 	#lruCache;
@@ -102,16 +106,15 @@ var EcwtFactory = class {
 	* @async
 	* @param data - Data to be stored in token.
 	* @param options -
-	* @param options.ttl - Time to live in seconds. If not defined, token will never expire.
+	* @param options.ttl - Time to live in **seconds**.
 	* @returns -
 	*/
-	async create(data, options = {}) {
+	async create(data, options) {
 		if (typeof this.#validator === "function") data = this.#validator(data);
-		const ttl = options.ttl ?? null;
 		const snowflake = await this.#snowflakeFactory.createSafe();
 		const payload = [
 			snowflake.toBuffer(),
-			ttl,
+			options.ttl,
 			data
 		];
 		const token_raw = this.#cborEncoder ? this.#cborEncoder.encode(payload) : encode(payload);
@@ -119,13 +122,13 @@ var EcwtFactory = class {
 		const token = base62.encode(token_encrypted);
 		this.setCache(token, {
 			snowflake,
-			ttl_initial: ttl,
+			ttl_initial: options.ttl,
 			data
 		});
 		return new Ecwt(this, {
 			token,
 			snowflake,
-			ttl_initial: ttl,
+			ttl_initial: options.ttl,
 			data
 		});
 	}
@@ -136,7 +139,7 @@ var EcwtFactory = class {
 	*/
 	setCache(token, cache_value) {
 		var _this$lruCache;
-		(_this$lruCache = this.#lruCache) === null || _this$lruCache === void 0 || _this$lruCache.set(token, cache_value, cache_value.ttl_initial === null ? void 0 : { ttl: cache_value.ttl_initial * 1e3 });
+		(_this$lruCache = this.#lruCache) === null || _this$lruCache === void 0 || _this$lruCache.set(token, cache_value, { ttl: cache_value.ttl_initial * 1e3 });
 	}
 	/**
 	* Parses token.
@@ -158,28 +161,34 @@ var EcwtFactory = class {
 			} catch {
 				throw new EcwtParseError();
 			}
-			const payload = this.#cborEncoder ? this.#cborEncoder.decode(token_raw) : decode(token_raw);
-			const [snowflake_buffer] = payload;
-			[, ttl_initial, data] = payload;
+			const payload = v.parse(tokenSchema, this.#cborEncoder ? this.#cborEncoder.decode(token_raw) : decode(token_raw));
+			const snowflake_buffer = payload[0];
+			ttl_initial = payload[1];
+			const data_raw = payload[2];
 			snowflake = this.#snowflakeFactory.parse(snowflake_buffer);
 			if (typeof this.#validator === "function") try {
-				data = this.#validator(data);
+				data = this.#validator(data_raw);
 			} catch {
 				throw new EcwtParseError();
 			}
+			else data = data_raw;
 			this.setCache(token, {
 				snowflake,
 				ttl_initial,
 				data
 			});
-		} else ({snowflake, ttl_initial, data} = cached_entry.value);
+		} else {
+			snowflake = cached_entry.value.snowflake;
+			ttl_initial = cached_entry.value.ttl_initial;
+			data = cached_entry.value.data;
+		}
 		const ecwt = new Ecwt(this, {
 			token,
 			snowflake,
 			ttl_initial,
 			data
 		});
-		if (typeof ttl_initial === "number" && Number.isNaN(ttl_initial) !== true && snowflake.timestamp + ttl_initial * 1e3 < Date.now()) throw new EcwtExpiredError(ecwt);
+		if (snowflake.timestamp + ttl_initial * 1e3 < Date.now()) throw new EcwtExpiredError(ecwt);
 		if (this.#redisClient) {
 			await this.#migrateExpired();
 			if (await this.#redisClient.HEXISTS(this.#redis_key_revoked, ecwt.id)) throw new EcwtRevokedError(ecwt);
@@ -222,17 +231,14 @@ var EcwtFactory = class {
 	async _revoke(token_id, created_at_ms, ttl_initial) {
 		if (this.#redisClient) {
 			await this.#migrateExpired();
-			if (ttl_initial === null) await this.#redisClient.HSET(this.#redis_key_revoked, token_id, "");
-			else {
-				const expires_in_ms = created_at_ms + ttl_initial * 1e3 - Date.now();
-				if (expires_in_ms > 0) await this.#redisClient.MULTI().HSET(this.#redis_key_revoked, token_id, "").HPEXPIRE(this.#redis_key_revoked, token_id, expires_in_ms).EXEC();
-			}
+			const expires_in_ms = created_at_ms + ttl_initial * 1e3 - Date.now();
+			if (expires_in_ms > 0) await this.#redisClient.MULTI().HSET(this.#redis_key_revoked, token_id, "").HPEXPIRE(this.#redis_key_revoked, token_id, expires_in_ms).EXEC();
 		} else console.warn("[ecwt] Redis client is not provided. Tokens cannot be revoked.");
 	}
 	#migrated = false;
 	async #migrateExpired() {
 		if (this.#redisClient && !this.#migrated) {
-			await this.#redisClient.EVAL("local key = KEYS[1] if redis.call(\"TYPE\", key)[\"ok\"] ~= \"zset\" then return end local key_hash = key .. \":hash\" local ts_now = tonumber(ARGV[1]) local cursor = \"0\" repeat local scan = redis.call(\"ZSCAN\", key, cursor, \"COUNT\", 1000) cursor = scan[1] local items = scan[2] for i = 1, #items, 2 do local field = items[i] local expire_at = tonumber(items[i + 1]) local expire_in = expire_at and expire_at - ts_now if expire_in and expire_in > 0 then redis.call(\"HSET\", key_hash, field, \"\") redis.call(\"HPEXPIRE\", key_hash, expire_in, \"FIELDS\", 1, field) end end until cursor == \"0\" redis.call(\"DEL\", key) redis.call(\"RENAME\", key_hash, key)", {
+			await this.#redisClient.EVAL("local key = KEYS[1] if redis.call(\"TYPE\", key)[\"ok\"] ~= \"zset\" then return end local key_hash = key .. \":hash\" local ts_now = tonumber(ARGV[1]) local cursor = \"0\" repeat local scan = redis.call(\"ZSCAN\", key, cursor, \"COUNT\", 1000) cursor = scan[1] local items = scan[2] for i = 1, #items, 2 do local field = items[i] local expire_at = tonumber(items[i + 1]) local expire_in = expire_at and expire_at - ts_now if expire_in and expire_in > 0 then redis.call(\"HSET\", key_hash, field, \"\") redis.call(\"HPEXPIRE\", key_hash, expire_in, \"FIELDS\", 1, field) end end until cursor == \"0\" redis.call(\"DEL\", key) if redis.call(\"EXISTS\", key_hash) == 1 then redis.call(\"RENAME\", key_hash, key) end", {
 				keys: [this.#redis_key_revoked],
 				arguments: [String(Date.now())]
 			});

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "ecwt",
-	"version": "0.3.3",
+	"version": "0.4.0",
 	"description": "Encrypted CBOR Web Token",
 	"publishConfig": {
 		"access": "public"
@@ -24,7 +24,8 @@
 	"dependencies": {
 		"base-x": "5.0.1",
 		"cbor-x": "1.5.6",
-		"evilcrypt": "0.2.3"
+		"evilcrypt": "0.2.3",
+		"valibot": "1.4.1"
 	},
 	"peerDependencies": {
 		"@kirick/snowflake": "^0.3",
@@ -41,7 +42,6 @@
 		"tsdown": "0.21.10",
 		"typescript": "6.0.2",
 		"unplugin-unused": "0.5.7",
-		"valibot": "1.4.0",
 		"vitest": "4.1.7"
 	},
 	"scripts": {