lacewing 1.0.0 → 1.0.1

package/CHANGELOG.md

@@ -2,6 +2,34 @@
 
 All notable changes to this project will be documented in this file.
 
+## [1.0.1] - 2026-07-29
+
+### Bug Fixes
+
+- Corrected test types
+- Corrected segment decoding behaviour and also added test for regression testing
+- Bound stale key serving, cap response bytes and refuse symmetric keys
+- Stop rejecting valid numeric ids, dotted audiences and token metadata
+- [**breaking**] Refuse a shadowed token cookie instead of guessing which duplicate wins
+- Chunk the password-likeness scan so large key material cannot overflow
+
+### Documentation
+
+- Updated README to also include explanation of how to use custom JWKS
+- Document the JWKS outage window, maxTokenLifetime and cookie shadowing
+
+### Features
+
+- Add optional maxTokenLifetime to cap a token's declared exp
+
+### Miscellaneous Tasks
+
+- Bump typescript-eslint from 8.63.0 to 8.64.0
+- Bump tsx from 4.23.0 to 4.23.1
+- Bump typescript-eslint from 8.64.0 to 8.65.0
+- Bumped various deps
+- Bump @types/node from 26.1.1 to 26.1.2
+
 ## [1.0.0] - 2026-07-12
 
 ### Miscellaneous Tasks

package/README.md

@@ -3,15 +3,15 @@
 
 **Lacewing is an opinionated JWT library that makes common JWT security mistakes impossible by construction.**
 
-Instead of exposing low-level primitives and trusting you to compose them correctly, Lacewing provides secure verification profiles, safe defaults, mandatory claim validation, built-in revocation support, secure cookie helpers, and a curated algorithm set - everything [RFC 8725 (JWT Best Current Practices)](https://datatracker.ietf.org/doc/html/rfc8725) says an application MUST or SHOULD do is enforced by the type system, enforced at runtime, or impossible to express.
+Instead of exposing low-level primitives and trusting you to compose them correctly, Lacewing provides secure verification profiles, safe defaults, mandatory claim validation, built-in revocation support, secure cookie helpers, and a curated algorithm set. Everything [RFC 8725 (JWT Best Current Practices)](https://datatracker.ietf.org/doc/html/rfc8725) says an application MUST or SHOULD do is enforced by the type system, enforced at runtime, or impossible to express.
 
 **Batteries loaded (RFC 8725).** Out of the box:
 
-- **Verification profiles** - the only way to verify; `typ`, issuer, audience, algorithm allowlist and key source are structurally mandatory
-- **Remote JWKS** with caching, rotation handling, and `kid` hygiene
-- **Token revocation** - unique `jti` on every token, pluggable `RevocationStore`, in-memory store included
-- **Secure cookie + bearer helpers** - `HttpOnly; Secure; SameSite` enforced, strict RFC 6750 parsing
-- **Access/refresh token presets** - mutually exclusive by `typ`, shipped rather than left as homework
+- **Verification profiles**: the only way to verify; `typ`, issuer, audience, algorithm allowlist and key source are structurally mandatory
+- **Remote JWKS** with caching, rotation handling, `kid` hygiene, and a *bounded* stale-serving window when the endpoint goes down
+- **Token revocation**: unique `jti` on every token, pluggable `RevocationStore`, in-memory store included
+- **Secure cookie + bearer helpers**: `HttpOnly; Secure; SameSite` enforced, strict RFC 6750 parsing
+- **Access/refresh token presets**: mutually exclusive by `typ`, shipped rather than left as homework
 - **Encrypted JWTs (JWE)** with the same profile discipline
 - **Payload hygiene scanning** at sign time (passwords, card numbers, PEM keys never leave in plaintext)
 - **Typed errors** with machine-readable codes and no attacker-facing oracle
@@ -30,7 +30,7 @@ npm install lacewing
 
 ## Quick start
 
-The complete lifecycle - generate a key, sign, define a profile once, verify everywhere:
+The complete lifecycle (generate a key, sign, define a profile once, verify everywhere):
 
 ```ts
 import { SignJWT, defineProfile, jwtVerify, generateKeyPair } from "lacewing";
@@ -53,16 +53,16 @@ const profile = defineProfile({
 	maxTokenAge: "10m",
 });
 
-const { payload } = await jwtVerify(token, profile); // VerifiedJwt - every check passed
+const { payload } = await jwtVerify(token, profile); // VerifiedJwt: every check passed
 ```
 
 A runnable version of everything in this README ships with the repo: `npm run demo`.
 
 ## Concepts
 
-**Profiles are the central abstraction.** Configuration is something you create once - not something every endpoint reinvents. A profile names the expected `typ`, the trusted issuer, the required audience, an explicit algorithm allowlist, and the key source bound to that issuer. `jwtVerify(token, profile)` is the *only* verify path: there is no `decode()`, no `ignoreExpiration`, no "accept whatever the header says" mode. If any check fails you get a typed error (`JWTExpired`, `AlgorithmNotAllowed`, `JWTClaimValidationFailed`, ...) and no partial result.
+**Profiles are the central abstraction.** Configuration is something you create once, not something every endpoint reinvents. A profile names the expected `typ`, the trusted issuer, the required audience, an explicit algorithm allowlist, and the key source bound to that issuer. `jwtVerify(token, profile)` is the *only* verify path: there is no `decode()`, no `ignoreExpiration`, no "accept whatever the header says" mode. If any check fails you get a typed error (`JWTExpired`, `AlgorithmNotAllowed`, `JWTClaimValidationFailed`, ...) and no partial result.
 
-**Built on jose.** Lacewing does not reimplement cryptography. It is a hardened policy layer over [jose](https://github.com/panva/jose) - the audited, maintained, runtime-portable JOSE implementation - so the novel code is the policy, not the crypto. Tokens Lacewing signs or encrypts are standard JWTs/JWEs that jose (and any other conforming implementation) can consume, and the conformance suite proves it against the RFC 7515/7516/7519 worked examples plus tokens produced by OpenSSL and python-cryptography.
+**Built on jose.** Lacewing does not reimplement cryptography. It is a hardened policy layer over [jose](https://github.com/panva/jose) (the audited, maintained, runtime-portable JOSE implementation), so the novel code is the policy, not the crypto. Tokens Lacewing signs or encrypts are standard JWTs/JWEs that jose (and any other conforming implementation) can consume, and the conformance suite proves it against the RFC 7515/7516/7519 worked examples plus tokens produced by OpenSSL and python-cryptography.
 
 ## Usage
 
@@ -82,16 +82,85 @@ const accessToken = defineProfile({
 	maxTokenAge: "10m",
 });
 
-const { payload } = await jwtVerify(token, accessToken); // VerifiedJwt - every check passed
+const { payload } = await jwtVerify(token, accessToken); // VerifiedJwt: every check passed
 ```
 
+**When the endpoint goes down**, the last good keys keep serving for a bounded
+window (1h by default) and then verification **fails closed**. The bound is the
+whole point: keys that go stale forever mean a key you rotated out *because it
+was compromised* stays trusted for exactly as long as an attacker can keep your
+JWKS unreachable. Trade availability against freshness explicitly:
+
+```ts
+createRemoteJWKSet("https://auth.example.com/jwks", {
+	cacheTtlSeconds: 300,         // fallback when the response sends no Cache-Control
+	cooldownSeconds: 30,          // floor between fetch attempts
+	staleWhileErrorSeconds: 3600, // how long a dead endpoint may coast; 0 = never
+});
+```
+
+Two more things that endpoint does not get to do. The response is read under a
+hard byte budget, checked against `Content-Length` and again on every chunk, so
+a hostile or broken endpoint cannot stream you out of memory. And symmetric
+(`oct`) entries are refused from a *remote* set: a JWKS endpoint is public, so a
+secret published there is one every reader could **mint** with, not merely
+verify with. A local JWKS may still carry them.
+
+### Verify: keys you already have
+
+Not everyone has a JWKS endpoint to point at. If the issuer handed you a raw
+public key, or you're pinning a single known one, the same `keys` field takes it
+directly. No URL, no fetch. `importKey` reads a PEM (SPKI public key), a JWK, or
+a `CryptoKey`, and binds it to exactly one algorithm:
+
+```ts
+import { defineProfile, importKey } from "lacewing";
+
+const publicKey = await importKey(spkiPem, "ES256"); // PEM string, JWK, or CryptoKey
+
+const profile = defineProfile({
+	typ: "at+jwt",
+	issuer: "https://auth.example.com",
+	audience: "https://api.example.com",
+	algorithms: ["ES256"],
+	keys: publicKey, // one pinned key, nothing to fetch
+	maxTokenAge: "10m",
+});
+```
+
+Hand it a private key by mistake and it refuses: profiles verify, they don't
+sign, and the error says exactly that. The key's algorithm has to be one you
+allowlisted too, so a key you imported for `ES256` won't quietly slip into an
+`EdDSA`-only profile.
+
+Got a handful of keys but still no endpoint to serve them from? Pass a JWKS
+document straight in, the same shape a `/jwks` URL would return, just inlined:
+
+```ts
+keys: {
+	keys: [
+		{ kty: "OKP", crv: "Ed25519", x: "...", kid: "2024-key" },
+		{ kty: "EC", crv: "P-256", x: "...", y: "...", kid: "2025-key" },
+	],
+},
+```
+
+Selection is exact: the token's `kid` (and its algorithm's key type and curve)
+has to single out one key. Two keys that both match with no `kid` to tell them
+apart is treated as your mistake, not something to guess at.
+
+And if your keys live somewhere less ordinary (an HSM, a secrets manager, a
+database), anything with a `getVerificationKey(header)` method is a valid `keys`
+value. That's the escape hatch; the two built-in sources are just the ones
+you'll reach for most.
+
 ### Sign
 
 `typ` is a constructor argument, and `.sign()` refuses to run without
 `issuer`, `audience` and `expiresIn` (waivable only via grep-loud
 `unsafeAllowMissing*` calls). Every token gets a unique `jti`, lifetimes are
 capped (default 1h), and a hygiene scanner rejects payloads that contain
-things like passwords, card numbers, PEM keys, or other JWTs - because **a
+things like passwords, card numbers, PEM keys, or other JWTs, because **a
 JWS payload is base64url-encoded plaintext, readable by anyone who holds the
 token**. Never put secrets in it.
 
@@ -112,28 +181,38 @@ const token = await new SignJWT("at+jwt")
 A note on HMAC (`HS256/384/512`): it is supported, but every verifier of an
 HMAC token holds the same secret and can therefore also **mint** them. For
 anything beyond a single service, use asymmetric keys + JWKS. HMAC secrets
-are entropy-checked at import - `"my-secret"` will not import, ever;
-`generateSecret()` gives you a proper one.
+must meet the RFC 7518 length floor and are screened by an entropy
+heuristic, so `"my-secret"` will not import, ever. The heuristic catches
+short and low-entropy secrets, not every bad one a human can invent. PLEASE use
+`generateSecret()` and don't hand-write key material. Symmetric keys are
+also refused from a *remote* JWKS: that endpoint is public, so a secret
+published there is one anyone can mint with.
 
 ### Transport: the paved road
 
-Do **not** put tokens in `localStorage` or `sessionStorage` - both are
+Do **not** put tokens in `localStorage` or `sessionStorage`: both are
 readable by any script on the page, so one XSS means token theft. Use an
 `HttpOnly` cookie (browsers) or an in-memory bearer token (services):
 
 ```ts
 import { setTokenCookie, readTokenCookie, parseBearer } from "lacewing";
 
-setTokenCookie(response.headers, token); // always HttpOnly; Secure; SameSite - weaker is unrepresentable
+setTokenCookie(response.headers, token); // always HttpOnly; Secure; SameSite, weaker is unrepresentable
 const fromCookie = readTokenCookie(request);
 const fromHeader = parseBearer(request); // strict RFC 6750; no query-string tokens, ever
 ```
 
+Both readers refuse ambiguity rather than resolving it. `parseBearer` rejects
+the `", "`-joined value `Headers` produces when a request carried two
+`Authorization` headers, and `readTokenCookie` returns `undefined` when the
+cookie name appears twice, the servers disagree about whether the first or the
+last duplicate wins, and cookie shadowing is built on that disagreement.
+
 ### Access vs refresh (the cookbook)
 
 The single most common token-confusion bug is letting a refresh token buy API
 access, or an access token mint new sessions. Lacewing **ships** the two
-profiles rather than leaving them as homework - they are mutually exclusive by
+profiles rather than leaving them as homework. They are mutually exclusive by
 `typ` (RFC 8725 §3.12), so presenting one where the other is expected fails,
 even with identical keys, claims and audience:
 
@@ -182,10 +261,37 @@ errors fail closed.
 
 ## Advanced
 
+### Age vs lifetime: two different caps
+
+`maxTokenAge` and `maxTokenLifetime` sound alike and do different jobs.
+
+**`maxTokenAge`** (required) bounds how long after issuance a token still works
+*here* (`now - iat`). It is enforced independently of `exp`, so a token minted
+with a decade-long `exp` stops being accepted once it is older than your cap,
+no matter what the issuer wrote.
+
+**`maxTokenLifetime`** (optional) bounds the span the issuer *declared*
+ (`exp - iat`). Note what `maxTokenAge` alone does with that decade-long token:
+it accepts it, right up until the age window closes. That is usually fine, since
+the age window is what actually governs. But an `exp` wildly beyond your own
+policy is a misissuance signal, and this refuses it on sight instead of
+tolerating it for the length of the window:
+
+```ts
+const profile = defineProfile({
+	/* ...as above... */
+	maxTokenAge: "10m",     // unusable 10m after iat, whatever exp claims
+	maxTokenLifetime: "1h", // and refuse anything declaring a span beyond 1h
+});
+```
+
+It is opt-in because plenty of legitimate issuers set a generous `exp` and
+expect the verifier's own window to do the limiting.
+
 ### Revocation is not replay protection
 
 Be precise about what revocation buys you: it lets you kill a
-token you *know about* (logout, compromise). It does **not** stop replay - a
+token you *know about* (logout, compromise). It does **not** stop replay: a
 valid, non-revoked token that leaks can be replayed by anyone who holds it
 until `exp`. That is the deliberate cost of stateless verification, and no
 JWT library can remove it without becoming a session store.
@@ -225,10 +331,10 @@ Your levers, in order of cheapness:
 ### Encrypting (JWE): when the payload really is a secret
 
 A signed JWT is readable plaintext. When you genuinely need the payload
-*hidden* - not just tamper-evident - use an encrypted JWT. Same discipline as
+*hidden*, not just tamper-evident, use an encrypted JWT. Same discipline as
 signing (mandatory `typ`, required `iss`/`aud`/`exp`, unique `jti`, capped
 lifetime), but with a curated set of encryption algorithms and no `none`. The
-sign-time hygiene scanner is deliberately off here - hiding secrets is the
+sign-time hygiene scanner is deliberately off here, since hiding secrets is the
 whole point:
 
 ```ts
@@ -242,7 +348,7 @@ const token = await new EncryptJWT("at+jwt", { contentEncryption: "A256GCM" })
   .issuer("https://auth.example.com")
   .audience("https://api.example.com")
   .subject("user-42")
-  .claim("ssn", "123-45-6789") // fine - it's encrypted, not just encoded
+  .claim("ssn", "123-45-6789") // fine: it's encrypted, not just encoded
   .expiresIn("10m")
   .encrypt(publicKey);
 
@@ -256,24 +362,24 @@ const profile = defineDecryptionProfile({
   maxTokenAge: "10m",
 });
 
-const { payload } = await jwtDecrypt(token, profile); // DecryptedJwt - distinct from VerifiedJwt
+const { payload } = await jwtDecrypt(token, profile); // DecryptedJwt, distinct from VerifiedJwt
 ```
 
 `none`, `RSA1_5`, `RSA-OAEP` (SHA-1) and the password-based `PBES2*` family are
 absent by construction. A JWS handed to `jwtDecrypt` (or a JWE handed to
-`jwtVerify`) is rejected - the two formats never cross over.
+`jwtVerify`) is rejected: the two formats never cross over.
 
-**Portability caveat - 192-bit AES:** the registry includes the `A192*`
+**Portability caveat (192-bit AES):** the registry includes the `A192*`
 algorithms (`A192KW`, `A192GCMKW`, `A192GCM`, `A192CBC-HS384`) for JOSE
 completeness, and they work on Node ≥ 24 (Lacewing's floor). But WebCrypto
 implementations in browsers and some edge runtimes do not implement 192-bit
 AES at all. If tokens must be decrypted outside Node, stick to the `A128*` /
-`A256*` variants - there is no security reason to prefer 192-bit anyway.
+`A256*` variants. There is no security reason to prefer 192-bit anyway.
 
 ### Debugging
 
 `unsafeDecode(token)` parses without verifying and returns an `UntrustedJwt`
-that is type-incompatible with `VerifiedJwt` - useful for inspecting expired
+that is type-incompatible with `VerifiedJwt`: useful for inspecting expired
 tokens, useless (by design) for auth logic.
 
 ### Legacy interop
@@ -304,9 +410,9 @@ The other reason is irritation. Generic JWT libraries are fine, but they leave e
 - No way to revoke stateless JWTs
 - Storing tokens in `localStorage` or `sessionStorage`
 - Not configuring `iss` or `aud`
-- Over-caching a JWKS when an endpoint goes down
+- Over-caching a JWKS when an endpoint goes down (stale keys serve for a bounded window, then verification fails closed)
 
-Insecure usage is still *possible* - but only unmistakably deliberate, through `unsafe*`-prefixed escape hatches that are easy to grep for in code review. Secure usage is the path of least resistance.
+Insecure usage is still *possible*, but only unmistakably deliberate, through `unsafe*`-prefixed escape hatches that are easy to grep for in code review. Secure usage is the path of least resistance.
 
 ## Attribution
 

package/dist/src/http/cookies.js

@@ -82,15 +82,21 @@ export function readTokenCookie(source, name = DEFAULT_COOKIE_NAME) {
     if (typeof cookieHeader !== "string" || cookieHeader.length > 16384) {
         return undefined;
     }
+    let found;
     for (const pair of cookieHeader.split(";")) {
         const eq = pair.indexOf("=");
         if (eq === -1)
             continue;
         if (pair.slice(0, eq).trim() !== name)
             continue;
+        // Cookie shadowing: servers disagree about whether the first or last
+        // duplicate wins, so a header carrying the name twice is ambiguous.
+        // Ambiguous input is refused rather than guessed at.
+        if (found !== undefined)
+            return undefined;
         const value = pair.slice(eq + 1).trim();
-        return COOKIE_VALUE.test(value) && value.length > 0 ? value : undefined;
+        found = COOKIE_VALUE.test(value) && value.length > 0 ? value : "";
     }
-    return undefined;
+    return found === undefined || found === "" ? undefined : found;
 }
 //# sourceMappingURL=cookies.js.map

package/dist/src/http/cookies.js.map

@@ -1 +1 @@
-{"version":3,"file":"cookies.js","sourceRoot":"","sources":["../../../src/http/cookies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,iEAAiE;AACjE,MAAM,WAAW,GAAG,gCAAgC,CAAC;AACrD,MAAM,YAAY,GAAG,uBAAuB,CAAC;AAE7C,MAAM,mBAAmB,GAAG,cAAc,CAAC;AAe3C,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,UAA8B,EAAE;IAC/E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClF,MAAM,IAAI,SAAS,CAAC,6DAA6D,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,mBAAmB,CAAC;IACjD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,SAAS,CAAC,qBAAqB,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAC;IAC3C,IAAI,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjD,MAAM,IAAI,SAAS,CAAC,oEAAoE,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,GAAG,CAAC;IACjC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,SAAS,CAAC,qBAAqB,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClB,MAAM,IAAI,SAAS,CAAC,gCAAgC,CAAC,CAAC;QACvD,CAAC;IACF,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;IACnD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,SAAS,CAAC,uBAAuB,CAAC,CAAC;QAC9C,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,SAAS,CAAC,8CAA8C,CAAC,CAAC;QACrE,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,WAAW,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,kEAAkE;IAClE,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,YAAY,QAAQ,EAAE,CAAC,CAAC;IACzD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,cAAc,CAC7B,OAAgB,EAChB,KAAa,EACb,UAA8B,EAAE;IAEhC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,gBAAgB,CAC/B,OAAgB,EAChB,UAAgE,EAAE;IAElE,OAAO,CAAC,MAAM,CACb,YAAY,EACZ,gBAAgB,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,CACtF,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC9B,MAAkE,EAClE,OAAe,mBAAmB;IAElC,IAAI,YAAuC,CAAC;IAC5C,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAChC,YAAY,GAAG,MAAM,CAAC;IACvB,CAAC;SAAM,IAAI,MAAM,YAAY,OAAO,EAAE,CAAC;QACtC,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;SAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,YAAY,OAAO,EAAE,CAAC;QAC/F,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;QACrE,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,SAAS;QACxB,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI;YAAE,SAAS;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC"}
+{"version":3,"file":"cookies.js","sourceRoot":"","sources":["../../../src/http/cookies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,iEAAiE;AACjE,MAAM,WAAW,GAAG,gCAAgC,CAAC;AACrD,MAAM,YAAY,GAAG,uBAAuB,CAAC;AAE7C,MAAM,mBAAmB,GAAG,cAAc,CAAC;AAe3C,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,UAA8B,EAAE;IAC/E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClF,MAAM,IAAI,SAAS,CAAC,6DAA6D,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,mBAAmB,CAAC;IACjD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,SAAS,CAAC,qBAAqB,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAC;IAC3C,IAAI,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjD,MAAM,IAAI,SAAS,CAAC,oEAAoE,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,GAAG,CAAC;IACjC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,SAAS,CAAC,qBAAqB,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClB,MAAM,IAAI,SAAS,CAAC,gCAAgC,CAAC,CAAC;QACvD,CAAC;IACF,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;IACnD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,SAAS,CAAC,uBAAuB,CAAC,CAAC;QAC9C,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,SAAS,CAAC,8CAA8C,CAAC,CAAC;QACrE,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,WAAW,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,kEAAkE;IAClE,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,YAAY,QAAQ,EAAE,CAAC,CAAC;IACzD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,cAAc,CAC7B,OAAgB,EAChB,KAAa,EACb,UAA8B,EAAE;IAEhC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,gBAAgB,CAC/B,OAAgB,EAChB,UAAgE,EAAE;IAElE,OAAO,CAAC,MAAM,CACb,YAAY,EACZ,gBAAgB,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,CACtF,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC9B,MAAkE,EAClE,OAAe,mBAAmB;IAElC,IAAI,YAAuC,CAAC;IAC5C,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAChC,YAAY,GAAG,MAAM,CAAC;IACvB,CAAC;SAAM,IAAI,MAAM,YAAY,OAAO,EAAE,CAAC;QACtC,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;SAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,YAAY,OAAO,EAAE,CAAC;QAC/F,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;QACrE,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,KAAyB,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,SAAS;QACxB,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI;YAAE,SAAS;QAChD,qEAAqE;QACrE,oEAAoE;QACpE,qDAAqD;QACrD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AAChE,CAAC"}

package/dist/src/jwks/local.js

@@ -26,8 +26,9 @@ function isCandidate(jwk, header) {
     return true;
 }
 /** Shared selection + import used by both local and remote sets. */
-export async function resolveFromJwks(keys, header) {
-    const candidates = keys.filter((jwk) => isCandidate(jwk, header));
+export async function resolveFromJwks(keys, header, options = {}) {
+    const allowSymmetric = options.allowSymmetric ?? true;
+    const candidates = keys.filter((jwk) => isCandidate(jwk, header) && (allowSymmetric || jwk.kty !== "oct"));
     if (candidates.length === 0) {
         throw new JWKSNoMatchingKey("No key in the JWKS matches this token");
     }

package/dist/src/jwks/local.js.map

@@ -1 +1 @@
-{"version":3,"file":"local.js","sourceRoot":"","sources":["../../../src/jwks/local.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EACN,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,GACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AASvD,SAAS,WAAW,CAAC,GAAc,EAAE,MAAiB;IACrD,MAAM,IAAI,GAAG,sBAAsB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAC7D,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAM,MAAM,CAAC,GAAc;QAAE,OAAO,KAAK,CAAC;IAC9E,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACjE,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACrE,OAAO,IAAI,CAAC;AACb,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,IAA0B,EAC1B,MAAiB;IAEjB,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;IAClE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,iBAAiB,CAAC,uCAAuC,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,iBAAiB,CAC1B,sEAAsE,CACtE,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAc,CAAC;IACvC,IAAI,CAAC;QACJ,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;YACvB,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAC/B,MAAM,IAAI,eAAe,CAAC,qCAAqC,CAAC,CAAC;YAClE,CAAC;YACD,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACtC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;YACvC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QACzC,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,SAAS,CAC1B,GAAsC,EACtC,MAAM,CAAC,GAAG,CACV,CAAC;QACF,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,eAAe,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;YAC7E,MAAM,KAAK,CAAC;QACb,CAAC;QACD,MAAM,IAAI,eAAe,CAAC,gCAAgC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACxE,CAAC;AACF,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,iBAAiB,CAAC,IAAa;IAC9C,IACC,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,IAAI;QACb,CAAC,KAAK,CAAC,OAAO,CAAE,IAAmB,CAAC,IAAI,CAAC,EACxC,CAAC;QACF,MAAM,IAAI,SAAS,CAAC,4CAA4C,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,IAAI,GAAI,IAAmB,CAAC,IAAI,CAAC;IACvC,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAC;IAChE,CAAC;IACD,uEAAuE;IACvE,oEAAoE;IACpE,OAAO,IAAI,CAAC,MAAM,CACjB,CAAC,GAAG,EAAE,EAAE,CACP,OAAO,GAAG,KAAK,QAAQ;QACvB,GAAG,KAAK,IAAI;QACZ,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;QAC3B,CAAC,GAAG,CAAC,GAAG,KAAK,SAAS;YACrB,CAAC,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAC7D,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,iBAAiB,CAAC,IAAgB;IACjD,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACrC,OAAO;QACN,kBAAkB,CAAC,MAAiB;YACnC,OAAO,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;KACD,CAAC;AACH,CAAC"}
+{"version":3,"file":"local.js","sourceRoot":"","sources":["../../../src/jwks/local.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EACN,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,GACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AASvD,SAAS,WAAW,CAAC,GAAc,EAAE,MAAiB;IACrD,MAAM,IAAI,GAAG,sBAAsB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAC7D,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAM,MAAM,CAAC,GAAc;QAAE,OAAO,KAAK,CAAC;IAC9E,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACjE,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACrE,OAAO,IAAI,CAAC;AACb,CAAC;AAWD,oEAAoE;AACpE,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,IAA0B,EAC1B,MAAiB,EACjB,UAAkC,EAAE;IAEpC,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC;IACtD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAC7B,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,CAAC,CAC1E,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,iBAAiB,CAAC,uCAAuC,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,iBAAiB,CAC1B,sEAAsE,CACtE,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAc,CAAC;IACvC,IAAI,CAAC;QACJ,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;YACvB,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAC/B,MAAM,IAAI,eAAe,CAAC,qCAAqC,CAAC,CAAC;YAClE,CAAC;YACD,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACtC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;YACvC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QACzC,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,SAAS,CAC1B,GAAsC,EACtC,MAAM,CAAC,GAAG,CACV,CAAC;QACF,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,eAAe,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;YAC7E,MAAM,KAAK,CAAC;QACb,CAAC;QACD,MAAM,IAAI,eAAe,CAAC,gCAAgC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACxE,CAAC;AACF,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,iBAAiB,CAAC,IAAa;IAC9C,IACC,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,IAAI;QACb,CAAC,KAAK,CAAC,OAAO,CAAE,IAAmB,CAAC,IAAI,CAAC,EACxC,CAAC;QACF,MAAM,IAAI,SAAS,CAAC,4CAA4C,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,IAAI,GAAI,IAAmB,CAAC,IAAI,CAAC;IACvC,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAC;IAChE,CAAC;IACD,uEAAuE;IACvE,oEAAoE;IACpE,OAAO,IAAI,CAAC,MAAM,CACjB,CAAC,GAAG,EAAE,EAAE,CACP,OAAO,GAAG,KAAK,QAAQ;QACvB,GAAG,KAAK,IAAI;QACZ,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;QAC3B,CAAC,GAAG,CAAC,GAAG,KAAK,SAAS;YACrB,CAAC,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAC7D,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,iBAAiB,CAAC,IAAgB;IACjD,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACrC,OAAO;QACN,kBAAkB,CAAC,MAAiB;YACnC,OAAO,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/src/jwks/remote.js

@@ -5,13 +5,18 @@
  * - caches with a configurable TTL and honors `Cache-Control: max-age`
  * - cooldown between refetches (no attacker-driven fetch storms)
  * - refetches once on unknown `kid` (key rotation), then fails closed
- * - response size is capped; entries outside the registry are dropped
+ * - stale keys keep serving a *bounded* while after the endpoint starts
+ *   failing, then verification fails closed (LW-jwks.2)
+ * - the response byte budget is enforced while reading, not after
+ * - symmetric (`oct`) entries are refused: a JWKS endpoint is public
+ * - entries outside the registry are dropped
  */
 import { JWKSFetchFailed, JWKSNoMatchingKey } from "../util/errors.js";
 import { resolveFromJwks, validateJwksShape } from "./local.js";
 const DEFAULT_CACHE_TTL_SECONDS = 300;
 const DEFAULT_COOLDOWN_SECONDS = 30;
 const DEFAULT_TIMEOUT_MS = 5000;
+const DEFAULT_STALE_WHILE_ERROR_SECONDS = 3600;
 const MAX_CACHE_TTL_SECONDS = 86400;
 const MAX_RESPONSE_BYTES = 1_048_576;
 function cacheTtlFrom(response, fallbackSeconds) {
@@ -20,6 +25,54 @@ function cacheTtlFrom(response, fallbackSeconds) {
     const ttl = match === null ? fallbackSeconds : Number(match[1]);
     return Math.min(Math.max(ttl, 0), MAX_CACHE_TTL_SECONDS);
 }
+function nonNegativeSeconds(value, fallback, field) {
+    if (value === undefined)
+        return fallback;
+    if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
+        throw new TypeError(`JWKS ${field} must be a non-negative number of seconds`);
+    }
+    return value;
+}
+/**
+ * Read a response body under a hard byte budget. The cap is checked against
+ * `Content-Length` up front and again on every chunk, so an oversized body is
+ * abandoned mid-flight instead of being buffered in full and measured
+ * afterwards.
+ */
+async function readCappedText(response, maxBytes) {
+    const declared = response.headers.get("content-length");
+    if (declared !== null) {
+        const length = Number(declared);
+        if (Number.isFinite(length) && length > maxBytes) {
+            throw new JWKSFetchFailed("JWKS response exceeds the size cap");
+        }
+    }
+    const body = response.body;
+    if (body === null || body === undefined) {
+        return "";
+    }
+    const reader = body.getReader();
+    const decoder = new TextDecoder();
+    let received = 0;
+    let text = "";
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            received += value.byteLength;
+            if (received > maxBytes) {
+                throw new JWKSFetchFailed("JWKS response exceeds the size cap");
+            }
+            text += decoder.decode(value, { stream: true });
+        }
+    }
+    finally {
+        // Abandons the transfer when we bailed out early; a no-op once drained.
+        await reader.cancel().catch(() => undefined);
+    }
+    return text + decoder.decode();
+}
 /** Create a {@link KeySource} that fetches and caches a remote JWKS. */
 export function createRemoteJWKSet(url, options = {}) {
     const jwksUrl = new URL(url);
@@ -30,9 +83,11 @@ export function createRemoteJWKSet(url, options = {}) {
     const fallbackTtl = options.cacheTtlSeconds ?? DEFAULT_CACHE_TTL_SECONDS;
     const cooldownMs = (options.cooldownSeconds ?? DEFAULT_COOLDOWN_SECONDS) * 1000;
     const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const staleWhileErrorMs = nonNegativeSeconds(options.staleWhileErrorSeconds, DEFAULT_STALE_WHILE_ERROR_SECONDS, "staleWhileErrorSeconds") * 1000;
     let cachedKeys;
     let expiresAtMs = 0;
     let lastAttemptMs = 0;
+    let lastSuccessMs = 0;
     let inflight;
     async function fetchJwks() {
         lastAttemptMs = Date.now();
@@ -50,10 +105,7 @@ export function createRemoteJWKSet(url, options = {}) {
         if (!response.ok) {
             throw new JWKSFetchFailed(`JWKS endpoint responded with status ${response.status}`);
         }
-        const body = await response.text();
-        if (body.length > MAX_RESPONSE_BYTES) {
-            throw new JWKSFetchFailed("JWKS response exceeds the size cap");
-        }
+        const body = await readCappedText(response, MAX_RESPONSE_BYTES);
         let parsed;
         try {
             parsed = JSON.parse(body);
@@ -69,7 +121,8 @@ export function createRemoteJWKSet(url, options = {}) {
             throw new JWKSFetchFailed("JWKS response is not a valid key set", { cause });
         }
         cachedKeys = keys;
-        expiresAtMs = Date.now() + cacheTtlFrom(response, fallbackTtl) * 1000;
+        lastSuccessMs = Date.now();
+        expiresAtMs = lastSuccessMs + cacheTtlFrom(response, fallbackTtl) * 1000;
     }
     function refresh() {
         // Concurrent verifications share one fetch.
@@ -78,24 +131,36 @@ export function createRemoteJWKSet(url, options = {}) {
         });
         return inflight;
     }
+    /**
+     * May we still serve the last good keys, given how long ago they were good?
+     * Strict `<` so that `staleWhileErrorSeconds: 0` disables stale serving
+     * outright rather than granting the millisecond the keys were fetched in.
+     */
+    function staleServable() {
+        return cachedKeys !== undefined && Date.now() - lastSuccessMs < staleWhileErrorMs;
+    }
     async function ensureFresh() {
         const now = Date.now();
         if (cachedKeys !== undefined && now < expiresAtMs) {
             return;
         }
         if (now - lastAttemptMs < cooldownMs && inflight === undefined) {
-            // In cooldown: serve stale keys if we have them, else fail.
-            if (cachedKeys !== undefined)
+            // In cooldown: serve stale keys if they are still inside the
+            // stale-while-error window, otherwise fail closed.
+            if (staleServable())
                 return;
-            throw new JWKSFetchFailed("JWKS fetch is cooling down after a recent failure");
+            throw new JWKSFetchFailed(cachedKeys === undefined
+                ? "JWKS fetch is cooling down after a recent failure"
+                : "JWKS keys are stale beyond the stale-while-error window");
         }
         try {
             await refresh();
         }
         catch (error) {
             // Stale-while-error: an unreachable endpoint must not take down
-            // verification while we still hold previously good keys.
-            if (cachedKeys === undefined)
+            // verification immediately - but only for a bounded window, so
+            // rotated-out keys cannot stay trusted indefinitely (LW-jwks.2).
+            if (!staleServable())
                 throw error;
         }
     }
@@ -103,7 +168,9 @@ export function createRemoteJWKSet(url, options = {}) {
         async getVerificationKey(header) {
             await ensureFresh();
             try {
-                return await resolveFromJwks(cachedKeys, header);
+                return await resolveFromJwks(cachedKeys, header, {
+                    allowSymmetric: false,
+                });
             }
             catch (error) {
                 // Unknown kid may mean the signer rotated keys: refetch once
@@ -113,7 +180,9 @@ export function createRemoteJWKSet(url, options = {}) {
                 if (!canRetry)
                     throw error;
                 await refresh();
-                return resolveFromJwks(cachedKeys, header);
+                return resolveFromJwks(cachedKeys, header, {
+                    allowSymmetric: false,
+                });
             }
         },
     };

package/dist/src/jwks/remote.js.map

@@ -1 +1 @@
-{"version":3,"file":"remote.js","sourceRoot":"","sources":["../../../src/jwks/remote.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAQhE,MAAM,yBAAyB,GAAG,GAAG,CAAC;AACtC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AACpC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAChC,MAAM,qBAAqB,GAAG,KAAK,CAAC;AACpC,MAAM,kBAAkB,GAAG,SAAS,CAAC;AAarC,SAAS,YAAY,CAAC,QAAkB,EAAE,eAAuB;IAChE,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,yBAAyB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC1F,MAAM,GAAG,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;AAC1D,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,kBAAkB,CACjC,GAAiB,EACjB,UAA+B,EAAE;IAEjC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,IAAI,SAAS,CAAC,0BAA0B,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACzC,MAAM,WAAW,GAAG,OAAO,CAAC,eAAe,IAAI,yBAAyB,CAAC;IACzE,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,eAAe,IAAI,wBAAwB,CAAC,GAAG,IAAI,CAAC;IAChF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAE1D,IAAI,UAAmC,CAAC;IACxC,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,QAAmC,CAAC;IAExC,KAAK,UAAU,SAAS;QACvB,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACJ,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE;gBACnC,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,EAAE,MAAM,EAAE,4CAA4C,EAAE;gBACjE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;aACtC,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,eAAe,CAAC,oCAAoC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,eAAe,CAAC,uCAAuC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;YACtC,MAAM,IAAI,eAAe,CAAC,oCAAoC,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,eAAe,CAAC,iCAAiC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,IAAiB,CAAC;QACtB,IAAI,CAAC;YACJ,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,eAAe,CAAC,sCAAsC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,UAAU,GAAG,IAAI,CAAC;QAClB,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,IAAI,CAAC;IACvE,CAAC;IAED,SAAS,OAAO;QACf,4CAA4C;QAC5C,QAAQ,KAAK,SAAS,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACrC,QAAQ,GAAG,SAAS,CAAC;QACtB,CAAC,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,KAAK,UAAU,WAAW;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,UAAU,KAAK,SAAS,IAAI,GAAG,GAAG,WAAW,EAAE,CAAC;YACnD,OAAO;QACR,CAAC;QACD,IAAI,GAAG,GAAG,aAAa,GAAG,UAAU,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChE,4DAA4D;YAC5D,IAAI,UAAU,KAAK,SAAS;gBAAE,OAAO;YACrC,MAAM,IAAI,eAAe,CAAC,mDAAmD,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,CAAC;YACJ,MAAM,OAAO,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,gEAAgE;YAChE,yDAAyD;YACzD,IAAI,UAAU,KAAK,SAAS;gBAAE,MAAM,KAAK,CAAC;QAC3C,CAAC;IACF,CAAC;IAED,OAAO;QACN,KAAK,CAAC,kBAAkB,CAAC,MAAiB;YACzC,MAAM,WAAW,EAAE,CAAC;YACpB,IAAI,CAAC;gBACJ,OAAO,MAAM,eAAe,CAAC,UAAyB,EAAE,MAAM,CAAC,CAAC;YACjE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,6DAA6D;gBAC7D,+CAA+C;gBAC/C,MAAM,QAAQ,GACb,KAAK,YAAY,iBAAiB;oBAClC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,IAAI,UAAU,CAAC;gBAC1C,IAAI,CAAC,QAAQ;oBAAE,MAAM,KAAK,CAAC;gBAC3B,MAAM,OAAO,EAAE,CAAC;gBAChB,OAAO,eAAe,CAAC,UAAyB,EAAE,MAAM,CAAC,CAAC;YAC3D,CAAC;QACF,CAAC;KACD,CAAC;AACH,CAAC"}
+{"version":3,"file":"remote.js","sourceRoot":"","sources":["../../../src/jwks/remote.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAQhE,MAAM,yBAAyB,GAAG,GAAG,CAAC;AACtC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AACpC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAChC,MAAM,iCAAiC,GAAG,IAAI,CAAC;AAC/C,MAAM,qBAAqB,GAAG,KAAK,CAAC;AACpC,MAAM,kBAAkB,GAAG,SAAS,CAAC;AAoBrC,SAAS,YAAY,CAAC,QAAkB,EAAE,eAAuB;IAChE,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,yBAAyB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC1F,MAAM,GAAG,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAyB,EAAE,QAAgB,EAAE,KAAa;IACrF,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,SAAS,CAAC,QAAQ,KAAK,2CAA2C,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,cAAc,CAAC,QAAkB,EAAE,QAAgB;IACjE,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACxD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,QAAQ,EAAE,CAAC;YAClD,MAAM,IAAI,eAAe,CAAC,oCAAoC,CAAC,CAAC;QACjE,CAAC;IACF,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACzC,OAAO,EAAE,CAAC;IACX,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,CAAC;QACJ,SAAS,CAAC;YACT,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC;YAC7B,IAAI,QAAQ,GAAG,QAAQ,EAAE,CAAC;gBACzB,MAAM,IAAI,eAAe,CAAC,oCAAoC,CAAC,CAAC;YACjE,CAAC;YACD,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,CAAC;IACF,CAAC;YAAS,CAAC;QACV,wEAAwE;QACxE,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;AAChC,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,kBAAkB,CACjC,GAAiB,EACjB,UAA+B,EAAE;IAEjC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,IAAI,SAAS,CAAC,0BAA0B,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACzC,MAAM,WAAW,GAAG,OAAO,CAAC,eAAe,IAAI,yBAAyB,CAAC;IACzE,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,eAAe,IAAI,wBAAwB,CAAC,GAAG,IAAI,CAAC;IAChF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC1D,MAAM,iBAAiB,GACtB,kBAAkB,CACjB,OAAO,CAAC,sBAAsB,EAC9B,iCAAiC,EACjC,wBAAwB,CACxB,GAAG,IAAI,CAAC;IAEV,IAAI,UAAmC,CAAC;IACxC,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,QAAmC,CAAC;IAExC,KAAK,UAAU,SAAS;QACvB,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACJ,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE;gBACnC,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,EAAE,MAAM,EAAE,4CAA4C,EAAE;gBACjE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;aACtC,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,eAAe,CAAC,oCAAoC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,eAAe,CAAC,uCAAuC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QAChE,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,eAAe,CAAC,iCAAiC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,IAAiB,CAAC;QACtB,IAAI,CAAC;YACJ,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,eAAe,CAAC,sCAAsC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,UAAU,GAAG,IAAI,CAAC;QAClB,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,WAAW,GAAG,aAAa,GAAG,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,IAAI,CAAC;IAC1E,CAAC;IAED,SAAS,OAAO;QACf,4CAA4C;QAC5C,QAAQ,KAAK,SAAS,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACrC,QAAQ,GAAG,SAAS,CAAC;QACtB,CAAC,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACH,SAAS,aAAa;QACrB,OAAO,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,GAAG,iBAAiB,CAAC;IACnF,CAAC;IAED,KAAK,UAAU,WAAW;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,UAAU,KAAK,SAAS,IAAI,GAAG,GAAG,WAAW,EAAE,CAAC;YACnD,OAAO;QACR,CAAC;QACD,IAAI,GAAG,GAAG,aAAa,GAAG,UAAU,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChE,6DAA6D;YAC7D,mDAAmD;YACnD,IAAI,aAAa,EAAE;gBAAE,OAAO;YAC5B,MAAM,IAAI,eAAe,CACxB,UAAU,KAAK,SAAS;gBACvB,CAAC,CAAC,mDAAmD;gBACrD,CAAC,CAAC,yDAAyD,CAC5D,CAAC;QACH,CAAC;QACD,IAAI,CAAC;YACJ,MAAM,OAAO,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,gEAAgE;YAChE,+DAA+D;YAC/D,iEAAiE;YACjE,IAAI,CAAC,aAAa,EAAE;gBAAE,MAAM,KAAK,CAAC;QACnC,CAAC;IACF,CAAC;IAED,OAAO;QACN,KAAK,CAAC,kBAAkB,CAAC,MAAiB;YACzC,MAAM,WAAW,EAAE,CAAC;YACpB,IAAI,CAAC;gBACJ,OAAO,MAAM,eAAe,CAAC,UAAyB,EAAE,MAAM,EAAE;oBAC/D,cAAc,EAAE,KAAK;iBACrB,CAAC,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,6DAA6D;gBAC7D,+CAA+C;gBAC/C,MAAM,QAAQ,GACb,KAAK,YAAY,iBAAiB;oBAClC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,IAAI,UAAU,CAAC;gBAC1C,IAAI,CAAC,QAAQ;oBAAE,MAAM,KAAK,CAAC;gBAC3B,MAAM,OAAO,EAAE,CAAC;gBAChB,OAAO,eAAe,CAAC,UAAyB,EAAE,MAAM,EAAE;oBACzD,cAAc,EAAE,KAAK;iBACrB,CAAC,CAAC;YACJ,CAAC;QACF,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/src/jwt/decrypt.js

@@ -86,6 +86,16 @@ export async function jwtDecrypt(token, profile) {
     if (rawHeader === "")
         throw new JWTInvalid("Token has an empty header segment");
     const header = validateJweHeader(parseJsonObject(decodeUTF8(decodeBase64url(rawHeader)), "header"), profile);
+    // Strict decoding is authoritative for every segment, not just the header:
+    // the AEAD ignores the unused trailing bits of a segment whose length is not
+    // a multiple of four, so a lenient parser accepts several distinct token
+    // strings that decrypt to the same plaintext. Rejecting non-canonical
+    // base64url keeps the token string a stable identity for revocation and
+    // replay caches. The encrypted key is empty under `dir`, which is canonical.
+    // https://github.com/Smiduweorc/lacewing/issues/12
+    for (const segment of segments.slice(1)) {
+        decodeBase64url(segment);
+    }
     if (profile.key.algorithm !== header.alg) {
         throw new AlgorithmNotAllowed("Token key-management algorithm does not match the profile's key");
     }

package/dist/src/jwt/decrypt.js.map

@@ -1 +1 @@
-{"version":3,"file":"decrypt.js","sourceRoot":"","sources":["../../../src/jwt/decrypt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,MAAM,CAAC;AACtC,OAAO,EACN,mBAAmB,EACnB,wBAAwB,EACxB,UAAU,EACV,UAAU,EACV,YAAY,EACZ,qBAAqB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EACN,8BAA8B,EAC9B,0BAA0B,GAC1B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EACN,MAAM,GAKN,MAAM,aAAa,CAAC;AAErB,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAE/B,6EAA6E;AAC7E,8EAA8E;AAC9E,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAU,CAAC;AAErF,SAAS,iBAAiB,CAAC,GAA4B,EAAE,OAAkC;IAC1F,KAAK,MAAM,KAAK,IAAI,gBAAgB,EAAE,CAAC;QACtC,IAAI,KAAK,IAAI,GAAG;YAAE,MAAM,IAAI,UAAU,CAAC,2BAA2B,KAAK,oBAAoB,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;IACpB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;QAC7D,MAAM,IAAI,mBAAmB,CAAC,mEAAmE,CAAC,CAAC;IACpG,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAE,OAAkB,KAAK,GAAG,CAAC,EAAE,CAAC;QACrF,MAAM,IAAI,mBAAmB,CAAC,mEAAmE,CAAC,CAAC;IACpG,CAAC;IACD,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,mBAAmB;IAEpD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;IACpB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;QAC7D,MAAM,IAAI,mBAAmB,CAAC,uEAAuE,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAE,OAAkB,KAAK,GAAG,CAAC,EAAE,CAAC;QACzF,MAAM,IAAI,mBAAmB,CAAC,uEAAuE,CAAC,CAAC;IACxG,CAAC;IACD,8BAA8B,CAAC,GAAG,CAAC,CAAC;IAEpC,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;IACpB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,UAAU,CAAC,8DAA8D,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,wBAAwB,CAAC,KAAK,EAAE,wCAAwC,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,MAAM,GAAc,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC;IACtE,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS;QAAE,MAAM,CAAC,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7D,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;YAAE,MAAM,IAAI,UAAU,CAAC,mCAAmC,CAAC,CAAC;QAC3F,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC/B,KAAa,EACb,OAAkC;IAElC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,UAAU,CAAC,kCAAkC,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QACrC,MAAM,IAAI,UAAU,CAAC,kCAAkC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,oEAAoE;QACpE,MAAM,IAAI,UAAU,CAAC,qDAAqD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAW,CAAC;IACxC,IAAI,SAAS,KAAK,EAAE;QAAE,MAAM,IAAI,UAAU,CAAC,mCAAmC,CAAC,CAAC;IAEhF,MAAM,MAAM,GAAG,iBAAiB,CAC/B,eAAe,CAAC,UAAU,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,EACjE,OAAO,CACP,CAAC;IAEF,IAAK,OAAO,CAAC,GAAG,CAAC,SAAoB,KAAM,MAAM,CAAC,GAAc,EAAE,CAAC;QAClE,MAAM,IAAI,mBAAmB,CAAC,iEAAiE,CAAC,CAAC;IAClG,CAAC;IAED,IAAI,SAAqB,CAAC;IAC1B,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,cAAc,CAClC,KAAK,EACL,OAAO,CAAC,GAAG,CAAC,GAA2C,EACvD;YACC,uBAAuB,EAAE,CAAC,MAAM,CAAC,GAAa,CAAC;YAC/C,2BAA2B,EAAE,CAAC,MAAM,CAAC,GAAa,CAAC;SACnD,CACD,CAAC;QACF,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,UAAU,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,OAAO,GAAG,eAAe,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;IAClE,MAAM,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAEvC,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACtC,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrC,MAAM,IAAI,YAAY,CAAC,KAAK,EAAE,kEAAkE,CAAC,CAAC;QACnG,CAAC;QACD,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACJ,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,OAAO,CAAC,+BAA+B,KAAK,IAAI,EAAE,CAAC;gBACtD,OAAO,GAAG,KAAK,CAAC;YACjB,CAAC;iBAAM,CAAC;gBACP,MAAM,IAAI,qBAAqB,CAAC,sDAAsD,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACpG,CAAC;QACF,CAAC;QACD,IAAI,OAAO;YAAE,MAAM,IAAI,UAAU,CAAC,wBAAwB,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAqB,EAAkB,CAAC;AACnE,CAAC"}
+{"version":3,"file":"decrypt.js","sourceRoot":"","sources":["../../../src/jwt/decrypt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,MAAM,CAAC;AACtC,OAAO,EACN,mBAAmB,EACnB,wBAAwB,EACxB,UAAU,EACV,UAAU,EACV,YAAY,EACZ,qBAAqB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EACN,8BAA8B,EAC9B,0BAA0B,GAC1B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EACN,MAAM,GAKN,MAAM,aAAa,CAAC;AAErB,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAE/B,6EAA6E;AAC7E,8EAA8E;AAC9E,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAU,CAAC;AAErF,SAAS,iBAAiB,CAAC,GAA4B,EAAE,OAAkC;IAC1F,KAAK,MAAM,KAAK,IAAI,gBAAgB,EAAE,CAAC;QACtC,IAAI,KAAK,IAAI,GAAG;YAAE,MAAM,IAAI,UAAU,CAAC,2BAA2B,KAAK,oBAAoB,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;IACpB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;QAC7D,MAAM,IAAI,mBAAmB,CAAC,mEAAmE,CAAC,CAAC;IACpG,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAE,OAAkB,KAAK,GAAG,CAAC,EAAE,CAAC;QACrF,MAAM,IAAI,mBAAmB,CAAC,mEAAmE,CAAC,CAAC;IACpG,CAAC;IACD,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,mBAAmB;IAEpD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;IACpB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;QAC7D,MAAM,IAAI,mBAAmB,CAAC,uEAAuE,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAE,OAAkB,KAAK,GAAG,CAAC,EAAE,CAAC;QACzF,MAAM,IAAI,mBAAmB,CAAC,uEAAuE,CAAC,CAAC;IACxG,CAAC;IACD,8BAA8B,CAAC,GAAG,CAAC,CAAC;IAEpC,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;IACpB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,UAAU,CAAC,8DAA8D,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,wBAAwB,CAAC,KAAK,EAAE,wCAAwC,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,MAAM,GAAc,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC;IACtE,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS;QAAE,MAAM,CAAC,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7D,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;YAAE,MAAM,IAAI,UAAU,CAAC,mCAAmC,CAAC,CAAC;QAC3F,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC/B,KAAa,EACb,OAAkC;IAElC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,UAAU,CAAC,kCAAkC,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QACrC,MAAM,IAAI,UAAU,CAAC,kCAAkC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,oEAAoE;QACpE,MAAM,IAAI,UAAU,CAAC,qDAAqD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAW,CAAC;IACxC,IAAI,SAAS,KAAK,EAAE;QAAE,MAAM,IAAI,UAAU,CAAC,mCAAmC,CAAC,CAAC;IAEhF,MAAM,MAAM,GAAG,iBAAiB,CAC/B,eAAe,CAAC,UAAU,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,EACjE,OAAO,CACP,CAAC;IAEF,2EAA2E;IAC3E,6EAA6E;IAC7E,yEAAyE;IACzE,sEAAsE;IACtE,wEAAwE;IACxE,6EAA6E;IAE7E,mDAAmD;IACnD,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,eAAe,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;IAED,IAAK,OAAO,CAAC,GAAG,CAAC,SAAoB,KAAM,MAAM,CAAC,GAAc,EAAE,CAAC;QAClE,MAAM,IAAI,mBAAmB,CAAC,iEAAiE,CAAC,CAAC;IAClG,CAAC;IAED,IAAI,SAAqB,CAAC;IAC1B,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,cAAc,CAClC,KAAK,EACL,OAAO,CAAC,GAAG,CAAC,GAA2C,EACvD;YACC,uBAAuB,EAAE,CAAC,MAAM,CAAC,GAAa,CAAC;YAC/C,2BAA2B,EAAE,CAAC,MAAM,CAAC,GAAa,CAAC;SACnD,CACD,CAAC;QACF,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,UAAU,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,OAAO,GAAG,eAAe,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;IAClE,MAAM,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAEvC,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACtC,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrC,MAAM,IAAI,YAAY,CAAC,KAAK,EAAE,kEAAkE,CAAC,CAAC;QACnG,CAAC;QACD,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACJ,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,OAAO,CAAC,+BAA+B,KAAK,IAAI,EAAE,CAAC;gBACtD,OAAO,GAAG,KAAK,CAAC;YACjB,CAAC;iBAAM,CAAC;gBACP,MAAM,IAAI,qBAAqB,CAAC,sDAAsD,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACpG,CAAC;QACF,CAAC;QACD,IAAI,OAAO;YAAE,MAAM,IAAI,UAAU,CAAC,wBAAwB,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAqB,EAAkB,CAAC;AACnE,CAAC"}

package/dist/src/jwt/decryption_profile.js

@@ -44,6 +44,10 @@ export function defineDecryptionProfile(options) {
     if (maxClockSkew > MAX_CLOCK_SKEW_SECONDS) {
         throw new TypeError(`Decryption profile maxClockSkew is capped at ${MAX_CLOCK_SKEW_SECONDS} seconds`);
     }
+    const maxTokenLifetime = options.maxTokenLifetime === undefined ? undefined : parseDuration(options.maxTokenLifetime);
+    if (maxTokenLifetime !== undefined && maxTokenLifetime < 1) {
+        throw new TypeError("Decryption profile maxTokenLifetime must be at least one second");
+    }
     if (options.revocation !== undefined && typeof options.revocation.isRevoked !== "function") {
         throw new TypeError("Decryption profile revocation store must implement isRevoked()");
     }
@@ -65,6 +69,8 @@ export function defineDecryptionProfile(options) {
         maxTokenAge: toSeconds(maxTokenAge),
         maxClockSkew: toSeconds(maxClockSkew),
     };
+    if (maxTokenLifetime !== undefined)
+        profile.maxTokenLifetime = toSeconds(maxTokenLifetime);
     if (options.revocation !== undefined)
         profile.revocation = options.revocation;
     if (options.claimValidators !== undefined)

package/dist/src/jwt/decryption_profile.js.map

@@ -1 +1 @@
-{"version":3,"file":"decryption_profile.js","sourceRoot":"","sources":["../../../src/jwt/decryption_profile.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EACN,2BAA2B,EAC3B,uBAAuB,GACvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACN,uBAAuB,EACvB,SAAS,GAKT,MAAM,aAAa,CAAC;AAErB,MAAM,0BAA0B,GAAG,CAAC,CAAC;AACrC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAyBnC,SAAS,qBAAqB,CAAC,KAAc,EAAE,KAAa;IAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,SAAS,CAAC,uBAAuB,KAAK,8BAA8B,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,uBAAuB,CAAC,OAAiC;IACxE,MAAM,GAAG,GAAG,qBAAqB,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,qBAAqB,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,qBAAqB,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAEhE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,uBAAuB,CAAC,IAAI,OAAO,CAAC,uBAAuB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrG,MAAM,IAAI,SAAS,CAAC,2EAA2E,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,2BAA2B,CAAC,IAAI,OAAO,CAAC,2BAA2B,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7G,MAAM,IAAI,SAAS,CAAC,+EAA+E,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,uBAAuB,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAC5G,MAAM,2BAA2B,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,2BAA2B,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC,CAAC;IAExH,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,SAAS,CAAC,iFAAiF,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,SAAS,CAAC,6DAA6D,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAE,OAAkB,KAAK,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/F,MAAM,IAAI,SAAS,CAAC,6EAA6E,CAAC,CAAC;IACpG,CAAC;IAED,MAAM,WAAW,GAAG,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACvD,IAAI,WAAW,GAAG,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,4DAA4D,CAAC,CAAC;IACvG,MAAM,YAAY,GAAG,aAAa,CAAC,OAAO,CAAC,YAAY,IAAI,0BAA0B,CAAC,CAAC;IACvF,IAAI,YAAY,GAAG,sBAAsB,EAAE,CAAC;QAC3C,MAAM,IAAI,SAAS,CAAC,gDAAgD,sBAAsB,UAAU,CAAC,CAAC;IACvG,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,UAAU,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QAC5F,MAAM,IAAI,SAAS,CAAC,gEAAgE,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YAC1E,IAAI,OAAO,SAAS,KAAK,UAAU;gBAAE,MAAM,IAAI,SAAS,CAAC,wBAAwB,KAAK,sBAAsB,CAAC,CAAC;QAC/G,CAAC;IACF,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;QAAE,qBAAqB,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAErF,MAAM,OAAO,GAA8B;QAC1C,GAAG;QACH,GAAG;QACH,GAAG;QACH,uBAAuB;QACvB,2BAA2B;QAC3B,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC;QACnC,YAAY,EAAE,SAAS,CAAC,YAAY,CAAC;KACrC,CAAC;IACF,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAC9E,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,CAAC,eAAe,GAAG,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IACpG,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IACrE,IAAI,OAAO,CAAC,+BAA+B,KAAK,IAAI;QAAE,OAAO,CAAC,+BAA+B,GAAG,IAAI,CAAC;IACrG,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC"}
+{"version":3,"file":"decryption_profile.js","sourceRoot":"","sources":["../../../src/jwt/decryption_profile.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EACN,2BAA2B,EAC3B,uBAAuB,GACvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACN,uBAAuB,EACvB,SAAS,GAKT,MAAM,aAAa,CAAC;AAErB,MAAM,0BAA0B,GAAG,CAAC,CAAC;AACrC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AA2BnC,SAAS,qBAAqB,CAAC,KAAc,EAAE,KAAa;IAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,SAAS,CAAC,uBAAuB,KAAK,8BAA8B,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,uBAAuB,CAAC,OAAiC;IACxE,MAAM,GAAG,GAAG,qBAAqB,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,qBAAqB,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,qBAAqB,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAEhE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,uBAAuB,CAAC,IAAI,OAAO,CAAC,uBAAuB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrG,MAAM,IAAI,SAAS,CAAC,2EAA2E,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,2BAA2B,CAAC,IAAI,OAAO,CAAC,2BAA2B,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7G,MAAM,IAAI,SAAS,CAAC,+EAA+E,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,uBAAuB,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAC5G,MAAM,2BAA2B,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,2BAA2B,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC,CAAC;IAExH,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,SAAS,CAAC,iFAAiF,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,SAAS,CAAC,6DAA6D,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAE,OAAkB,KAAK,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/F,MAAM,IAAI,SAAS,CAAC,6EAA6E,CAAC,CAAC;IACpG,CAAC;IAED,MAAM,WAAW,GAAG,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACvD,IAAI,WAAW,GAAG,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,4DAA4D,CAAC,CAAC;IACvG,MAAM,YAAY,GAAG,aAAa,CAAC,OAAO,CAAC,YAAY,IAAI,0BAA0B,CAAC,CAAC;IACvF,IAAI,YAAY,GAAG,sBAAsB,EAAE,CAAC;QAC3C,MAAM,IAAI,SAAS,CAAC,gDAAgD,sBAAsB,UAAU,CAAC,CAAC;IACvG,CAAC;IACD,MAAM,gBAAgB,GACrB,OAAO,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC9F,IAAI,gBAAgB,KAAK,SAAS,IAAI,gBAAgB,GAAG,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,SAAS,CAAC,iEAAiE,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,UAAU,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QAC5F,MAAM,IAAI,SAAS,CAAC,gEAAgE,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YAC1E,IAAI,OAAO,SAAS,KAAK,UAAU;gBAAE,MAAM,IAAI,SAAS,CAAC,wBAAwB,KAAK,sBAAsB,CAAC,CAAC;QAC/G,CAAC;IACF,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;QAAE,qBAAqB,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAErF,MAAM,OAAO,GAA8B;QAC1C,GAAG;QACH,GAAG;QACH,GAAG;QACH,uBAAuB;QACvB,2BAA2B;QAC3B,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC;QACnC,YAAY,EAAE,SAAS,CAAC,YAAY,CAAC;KACrC,CAAC;IACF,IAAI,gBAAgB,KAAK,SAAS;QAAE,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAC3F,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAC9E,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,CAAC,eAAe,GAAG,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IACpG,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IACrE,IAAI,OAAO,CAAC,+BAA+B,KAAK,IAAI;QAAE,OAAO,CAAC,+BAA+B,GAAG,IAAI,CAAC;IACrG,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC"}

package/dist/src/jwt/profile.js

@@ -43,6 +43,7 @@ function normalizeKeys(keys, algorithms) {
                 cacheTtlSeconds: remote.cacheTtlSeconds,
                 cooldownSeconds: remote.cooldownSeconds,
                 timeoutMs: remote.timeoutMs,
+                staleWhileErrorSeconds: remote.staleWhileErrorSeconds,
             });
         }
     }
@@ -65,6 +66,10 @@ export function defineProfile(options) {
     if (maxClockSkew > MAX_CLOCK_SKEW_SECONDS) {
         throw new TypeError(`Profile maxClockSkew is capped at ${MAX_CLOCK_SKEW_SECONDS} seconds`);
     }
+    const maxTokenLifetime = options.maxTokenLifetime === undefined ? undefined : parseDuration(options.maxTokenLifetime);
+    if (maxTokenLifetime !== undefined && maxTokenLifetime < 1) {
+        throw new TypeError("Profile maxTokenLifetime must be at least one second");
+    }
     if (options.revocation !== undefined && typeof options.revocation.isRevoked !== "function") {
         throw new TypeError("Profile revocation store must implement isRevoked()");
     }
@@ -87,6 +92,8 @@ export function defineProfile(options) {
         maxTokenAge: toSeconds(maxTokenAge),
         maxClockSkew: toSeconds(maxClockSkew),
     };
+    if (maxTokenLifetime !== undefined)
+        profile.maxTokenLifetime = toSeconds(maxTokenLifetime);
     if (options.revocation !== undefined)
         profile.revocation = options.revocation;
     if (options.claimValidators !== undefined) {

package/dist/src/jwt/profile.js.map

@@ -1 +1 @@
-{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../../src/jwt/profile.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EACN,aAAa,EACb,SAAS,GAQT,MAAM,aAAa,CAAC;AAErB,MAAM,0BAA0B,GAAG,CAAC,CAAC;AACrC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AA2BnC,SAAS,qBAAqB,CAAC,KAAc,EAAE,KAAa;IAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,SAAS,CAAC,YAAY,KAAK,8BAA8B,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CACrB,IAA4B,EAC5B,UAA6B;IAE7B,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,SAAS,CAClB,mEAAmE,CACnE,CAAC;QACH,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,SAAS,CAClB,+DAA+D,CAC/D,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAC/C,IAAI,OAAQ,IAAkB,CAAC,kBAAkB,KAAK,UAAU,EAAE,CAAC;YAClE,OAAO,IAAiB,CAAC;QAC1B,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAE,IAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9C,OAAO,iBAAiB,CAAC,IAAkB,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,OAAQ,IAAmB,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,MAAM,GAAG,IAAkB,CAAC;YAClC,OAAO,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE;gBACzC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,SAAS,EAAE,MAAM,CAAC,SAAS;aAC3B,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IACD,MAAM,IAAI,SAAS,CAClB,6FAA6F,CAC7F,CAAC;AACH,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,aAAa,CAAC,OAAuB;IACpD,MAAM,GAAG,GAAG,qBAAqB,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,qBAAqB,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,qBAAqB,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAEhE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAE9E,MAAM,WAAW,GAAG,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACvD,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,SAAS,CAAC,iDAAiD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,YAAY,GAAG,aAAa,CAAC,OAAO,CAAC,YAAY,IAAI,0BAA0B,CAAC,CAAC;IACvF,IAAI,YAAY,GAAG,sBAAsB,EAAE,CAAC;QAC3C,MAAM,IAAI,SAAS,CAAC,qCAAqC,sBAAsB,UAAU,CAAC,CAAC;IAC5F,CAAC;IAED,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,UAAU,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QAC5F,MAAM,IAAI,SAAS,CAAC,qDAAqD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YAC1E,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;gBACrC,MAAM,IAAI,SAAS,CAAC,wBAAwB,KAAK,sBAAsB,CAAC,CAAC;YAC1E,CAAC;QACF,CAAC;IACF,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACnC,qBAAqB,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,OAAO,GAAuB;QACnC,GAAG;QACH,GAAG;QACH,GAAG;QACH,GAAG;QACH,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC;QACrD,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC;QACnC,YAAY,EAAE,SAAS,CAAC,YAAY,CAAC;KACrC,CAAC;IACF,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAC9E,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC3C,OAAO,CAAC,eAAe,GAAG,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAC1D,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IACrE,IAAI,OAAO,CAAC,+BAA+B,KAAK,IAAI,EAAE,CAAC;QACtD,OAAO,CAAC,+BAA+B,GAAG,IAAI,CAAC;IAChD,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC"}
+{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../../src/jwt/profile.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EACN,aAAa,EACb,SAAS,GAQT,MAAM,aAAa,CAAC;AAErB,MAAM,0BAA0B,GAAG,CAAC,CAAC;AACrC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAiCnC,SAAS,qBAAqB,CAAC,KAAc,EAAE,KAAa;IAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,SAAS,CAAC,YAAY,KAAK,8BAA8B,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CACrB,IAA4B,EAC5B,UAA6B;IAE7B,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,SAAS,CAClB,mEAAmE,CACnE,CAAC;QACH,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,SAAS,CAClB,+DAA+D,CAC/D,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAC/C,IAAI,OAAQ,IAAkB,CAAC,kBAAkB,KAAK,UAAU,EAAE,CAAC;YAClE,OAAO,IAAiB,CAAC;QAC1B,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAE,IAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9C,OAAO,iBAAiB,CAAC,IAAkB,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,OAAQ,IAAmB,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,MAAM,GAAG,IAAkB,CAAC;YAClC,OAAO,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE;gBACzC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,sBAAsB,EAAE,MAAM,CAAC,sBAAsB;aACrD,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IACD,MAAM,IAAI,SAAS,CAClB,6FAA6F,CAC7F,CAAC;AACH,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,aAAa,CAAC,OAAuB;IACpD,MAAM,GAAG,GAAG,qBAAqB,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,qBAAqB,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,qBAAqB,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAEhE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAE9E,MAAM,WAAW,GAAG,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACvD,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,SAAS,CAAC,iDAAiD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,YAAY,GAAG,aAAa,CAAC,OAAO,CAAC,YAAY,IAAI,0BAA0B,CAAC,CAAC;IACvF,IAAI,YAAY,GAAG,sBAAsB,EAAE,CAAC;QAC3C,MAAM,IAAI,SAAS,CAAC,qCAAqC,sBAAsB,UAAU,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,gBAAgB,GACrB,OAAO,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC9F,IAAI,gBAAgB,KAAK,SAAS,IAAI,gBAAgB,GAAG,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,SAAS,CAAC,sDAAsD,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,UAAU,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QAC5F,MAAM,IAAI,SAAS,CAAC,qDAAqD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YAC1E,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;gBACrC,MAAM,IAAI,SAAS,CAAC,wBAAwB,KAAK,sBAAsB,CAAC,CAAC;YAC1E,CAAC;QACF,CAAC;IACF,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACnC,qBAAqB,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,OAAO,GAAuB;QACnC,GAAG;QACH,GAAG;QACH,GAAG;QACH,GAAG;QACH,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC;QACrD,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC;QACnC,YAAY,EAAE,SAAS,CAAC,YAAY,CAAC;KACrC,CAAC;IACF,IAAI,gBAAgB,KAAK,SAAS;QAAE,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAC3F,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAC9E,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC3C,OAAO,CAAC,eAAe,GAAG,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAC1D,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IACrE,IAAI,OAAO,CAAC,+BAA+B,KAAK,IAAI,EAAE,CAAC;QACtD,OAAO,CAAC,+BAA+B,GAAG,IAAI,CAAC;IAChD,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC"}

package/dist/src/lib/claims.js

@@ -67,11 +67,21 @@ export async function validateClaims(payload, profile, nowSeconds = Math.floor(D
     if (iat > nowSeconds + skew) {
         throw new JWTClaimValidationFailed("iat", "Token issued-at time is in the future");
     }
-    // maxTokenAge - enforced independently of exp (LW-life.2), so a
-    // compromised signer can't mint decade-long tokens we accept.
+    // maxTokenAge - enforced independently of exp (LW-life.2). This bounds how
+    // long after issuance a token stays usable *here*, whatever `exp` claims:
+    // a token minted with a decade-long exp is still refused once it is older
+    // than maxTokenAge. It does not reject such a token on sight - see
+    // maxTokenLifetime for that.
     if (nowSeconds - iat > profile.maxTokenAge + skew) {
         throw new JWTExpired("Token exceeds the profile's maximum age");
     }
+    // maxTokenLifetime - optional, and about the token's *declared* span
+    // (exp - iat) rather than its current age. An absurd declared lifetime is
+    // a misissuance signal worth refusing outright rather than silently
+    // tolerating for the length of the age window.
+    if (profile.maxTokenLifetime !== undefined && exp - iat > profile.maxTokenLifetime) {
+        throw new JWTClaimValidationFailed("exp", "Token's declared lifetime (exp - iat) exceeds the profile's maximum");
+    }
     // nbf - optional, but honored when present.
     if (payload.nbf !== undefined) {
         const nbf = requireNumber(payload, "nbf");

package/dist/src/lib/claims.js.map

@@ -1 +1 @@
-{"version":3,"file":"claims.js","sourceRoot":"","sources":["../../../src/lib/claims.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACN,wBAAwB,EACxB,UAAU,EACV,YAAY,GACZ,MAAM,mBAAmB,CAAC;AAG3B,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAErC,SAAS,aAAa,CAAC,OAAgC,EAAE,KAAa;IACrE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,wBAAwB,CAAC,KAAK,EAAE,UAAU,KAAK,8BAA8B,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QAC5C,MAAM,IAAI,wBAAwB,CAAC,KAAK,EAAE,UAAU,KAAK,0BAA0B,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,OAAgC,EAAE,KAAa;IACrE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,wBAAwB,CAAC,KAAK,EAAE,UAAU,KAAK,2BAA2B,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,GAAY,EAAE,QAAgB;IACtD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,GAAG,KAAK,QAAQ,CAAC;IACzB,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,QAAQ,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAID;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,OAAgC,EAChC,OAAqB,EACrB,aAAqB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAElD,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC;IAElC,sDAAsD;IACtD,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1C,IAAI,GAAG,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,wBAAwB,CAAC,KAAK,EAAE,6CAA6C,CAAC,CAAC;IAC1F,CAAC;IAED,uDAAuD;IACvD,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,wBAAwB,CAAC,KAAK,EAAE,yDAAyD,CAAC,CAAC;IACtG,CAAC;IAED,2CAA2C;IAC3C,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1C,IAAI,UAAU,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,UAAU,CAAC,mBAAmB,CAAC,CAAC;IAC3C,CAAC;IAED,4CAA4C;IAC5C,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1C,IAAI,GAAG,GAAG,UAAU,GAAG,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,wBAAwB,CAAC,KAAK,EAAE,uCAAuC,CAAC,CAAC;IACpF,CAAC;IAED,gEAAgE;IAChE,8DAA8D;IAC9D,IAAI,UAAU,GAAG,GAAG,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,EAAE,CAAC;QACnD,MAAM,IAAI,UAAU,CAAC,yCAAyC,CAAC,CAAC;IACjE,CAAC;IAED,4CAA4C;IAC5C,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC1C,IAAI,GAAG,GAAG,UAAU,GAAG,IAAI,EAAE,CAAC;YAC7B,MAAM,IAAI,wBAAwB,CAAC,KAAK,EAAE,wBAAwB,CAAC,CAAC;QACrE,CAAC;IACF,CAAC;IAED,yDAAyD;IACzD,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC/B,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,sDAAsD;IACtD,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC/B,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC1C,IAAI,GAAG,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;YAC7B,MAAM,IAAI,wBAAwB,CAAC,KAAK,EAAE,2CAA2C,CAAC,CAAC;QACxF,CAAC;IACF,CAAC;IAED,iEAAiE;IACjE,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YACzE,IAAI,CAAC;gBACJ,MAAM,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,KAAK,YAAY,wBAAwB,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;oBAChF,MAAM,KAAK,CAAC;gBACb,CAAC;gBACD,MAAM,IAAI,wBAAwB,CACjC,KAAK,EACL,gCAAgC,KAAK,UAAU,EAC/C,EAAE,KAAK,EAAE,CACT,CAAC;YACH,CAAC;QACF,CAAC;IACF,CAAC;AACF,CAAC"}
+{"version":3,"file":"claims.js","sourceRoot":"","sources":["../../../src/lib/claims.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACN,wBAAwB,EACxB,UAAU,EACV,YAAY,GACZ,MAAM,mBAAmB,CAAC;AAG3B,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAErC,SAAS,aAAa,CAAC,OAAgC,EAAE,KAAa;IACrE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,wBAAwB,CAAC,KAAK,EAAE,UAAU,KAAK,8BAA8B,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QAC5C,MAAM,IAAI,wBAAwB,CAAC,KAAK,EAAE,UAAU,KAAK,0BAA0B,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,OAAgC,EAAE,KAAa;IACrE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,wBAAwB,CAAC,KAAK,EAAE,UAAU,KAAK,2BAA2B,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,GAAY,EAAE,QAAgB;IACtD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,GAAG,KAAK,QAAQ,CAAC;IACzB,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,QAAQ,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAID;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,OAAgC,EAChC,OAAqB,EACrB,aAAqB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAElD,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC;IAElC,sDAAsD;IACtD,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1C,IAAI,GAAG,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,wBAAwB,CAAC,KAAK,EAAE,6CAA6C,CAAC,CAAC;IAC1F,CAAC;IAED,uDAAuD;IACvD,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,wBAAwB,CAAC,KAAK,EAAE,yDAAyD,CAAC,CAAC;IACtG,CAAC;IAED,2CAA2C;IAC3C,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1C,IAAI,UAAU,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,UAAU,CAAC,mBAAmB,CAAC,CAAC;IAC3C,CAAC;IAED,4CAA4C;IAC5C,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1C,IAAI,GAAG,GAAG,UAAU,GAAG,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,wBAAwB,CAAC,KAAK,EAAE,uCAAuC,CAAC,CAAC;IACpF,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,0EAA0E;IAC1E,mEAAmE;IACnE,6BAA6B;IAC7B,IAAI,UAAU,GAAG,GAAG,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,EAAE,CAAC;QACnD,MAAM,IAAI,UAAU,CAAC,yCAAyC,CAAC,CAAC;IACjE,CAAC;IAED,qEAAqE;IACrE,0EAA0E;IAC1E,oEAAoE;IACpE,+CAA+C;IAC/C,IAAI,OAAO,CAAC,gBAAgB,KAAK,SAAS,IAAI,GAAG,GAAG,GAAG,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;QACpF,MAAM,IAAI,wBAAwB,CACjC,KAAK,EACL,qEAAqE,CACrE,CAAC;IACH,CAAC;IAED,4CAA4C;IAC5C,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC1C,IAAI,GAAG,GAAG,UAAU,GAAG,IAAI,EAAE,CAAC;YAC7B,MAAM,IAAI,wBAAwB,CAAC,KAAK,EAAE,wBAAwB,CAAC,CAAC;QACrE,CAAC;IACF,CAAC;IAED,yDAAyD;IACzD,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC/B,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,sDAAsD;IACtD,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC/B,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC1C,IAAI,GAAG,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;YAC7B,MAAM,IAAI,wBAAwB,CAAC,KAAK,EAAE,2CAA2C,CAAC,CAAC;QACxF,CAAC;IACF,CAAC;IAED,iEAAiE;IACjE,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YACzE,IAAI,CAAC;gBACJ,MAAM,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,KAAK,YAAY,wBAAwB,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;oBAChF,MAAM,KAAK,CAAC;gBACb,CAAC;gBACD,MAAM,IAAI,wBAAwB,CACjC,KAAK,EACL,gCAAgC,KAAK,UAAU,EAC/C,EAAE,KAAK,EAAE,CACT,CAAC;YACH,CAAC;QACF,CAAC;IACF,CAAC;AACF,CAAC"}

package/dist/src/lib/entropy.js

@@ -42,7 +42,13 @@ export function isPasswordLike(bytes) {
     if (!printableAscii) {
         return false;
     }
-    const text = String.fromCharCode(...bytes).toLowerCase();
+    // Chunked rather than spread: `k` can arrive from a JWKS document, and
+    // String.fromCharCode(...megabyte) overflows the call stack.
+    let text = "";
+    for (let i = 0; i < bytes.length; i += 4096) {
+        text += String.fromCharCode(...bytes.subarray(i, i + 4096));
+    }
+    text = text.toLowerCase();
     if (COMMON_WORDS.some((word) => text.includes(word))) {
         return true;
     }

package/dist/src/lib/entropy.js.map

@@ -1 +1 @@
-{"version":3,"file":"entropy.js","sourceRoot":"","sources":["../../../src/lib/entropy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,6DAA6D;AAC7D,MAAM,YAAY,GAAG;IACpB,UAAU;IACV,UAAU;IACV,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,SAAS;CACT,CAAC;AAEF,SAAS,kBAAkB,CAAC,KAAiB;IAC5C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC;QAC/B,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAiB;IAC/C,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;IAClE,IAAI,CAAC,cAAc,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IACzD,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC;IACb,CAAC;IACD,oEAAoE;IACpE,oEAAoE;IACpE,OAAO,kBAAkB,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAkB,EAAE,aAAqB;IAC3E,MAAM,EAAE,UAAU,EAAE,GAAG,sBAAsB,CAAC,aAAa,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,kBAAkB,CAC3B,mBAAmB,aAAa,qBAAqB,QAAQ,SAAS;YACrE,kCAAkC,CACnC,CAAC;IACH,CAAC;IACD,IAAI,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,kBAAkB,CAC3B,sDAAsD;YACrD,wDAAwD,CACzD,CAAC;IACH,CAAC;AACF,CAAC"}
+{"version":3,"file":"entropy.js","sourceRoot":"","sources":["../../../src/lib/entropy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,6DAA6D;AAC7D,MAAM,YAAY,GAAG;IACpB,UAAU;IACV,UAAU;IACV,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,SAAS;CACT,CAAC;AAEF,SAAS,kBAAkB,CAAC,KAAiB;IAC5C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC;QAC/B,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAiB;IAC/C,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;IAClE,IAAI,CAAC,cAAc,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACd,CAAC;IACD,uEAAuE;IACvE,6DAA6D;IAC7D,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;QAC7C,IAAI,IAAI,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC1B,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC;IACb,CAAC;IACD,oEAAoE;IACpE,oEAAoE;IACpE,OAAO,kBAAkB,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAkB,EAAE,aAAqB;IAC3E,MAAM,EAAE,UAAU,EAAE,GAAG,sBAAsB,CAAC,aAAa,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,kBAAkB,CAC3B,mBAAmB,aAAa,qBAAqB,QAAQ,SAAS;YACrE,kCAAkC,CACnC,CAAC;IACH,CAAC;IACD,IAAI,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,kBAAkB,CAC3B,sDAAsD;YACrD,wDAAwD,CACzD,CAAC;IACH,CAAC;AACF,CAAC"}

package/dist/src/lib/payload_hygiene.js

@@ -30,19 +30,45 @@ const SENSITIVE_NAME_FRAGMENTS = [
     "bearer",
 ];
 const PEM_PRIVATE_KEY = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----/;
-const JWT_LIKE = /^[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}$/;
+// A compact JWS/JWE always begins with a base64url-encoded JSON object, and
+// `{"` encodes to `eyJ`. Anchoring on that keeps ordinary dotted identifiers
+// (bare hostnames, reverse-DNS names) from reading as embedded tokens. The
+// last segment may be empty - that is exactly an `alg: none` token.
+const JWT_LIKE = /^eyJ[A-Za-z0-9_-]{7,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]*$/;
+/**
+ * Standard OAuth/OIDC claim names that describe *this* token rather than
+ * carrying one. Without them, `token_use` (AWS Cognito) and `token_type`
+ * trip the `token` fragment and force an `unsafeAllowClaim` waiver onto a
+ * perfectly correct payload - which is exactly how a grep-loud marker stops
+ * being worth grepping for.
+ */
+const BENIGN_NAMES = new Set(["tokenuse", "tokentype"]);
+/**
+ * Issuer Identification Numbers, as `[prefix regex, valid lengths]`. Luhn
+ * alone is a 1-in-10 coin flip on any digit string, which rejects roughly a
+ * tenth of all snowflake-style numeric user ids; requiring a real card prefix
+ * *and* that brand's length makes the check mean something.
+ */
+const CARD_BRANDS = [
+    [/^4/, [13, 16, 19]], // Visa
+    [/^(5[1-5]|2(2[2-9]|[3-6]\d|7[01]|720))/, [16]], // Mastercard
+    [/^3[47]/, [15]], // American Express
+    [/^(6011|65|64[4-9])/, [16, 19]], // Discover
+    [/^3(0[0-5]|095|6|[89])/, [14, 16, 19]], // Diners Club
+    [/^35(2[89]|[3-8]\d)/, [16, 17, 18, 19]], // JCB
+    [/^62/, [16, 17, 18, 19]], // UnionPay
+];
 function normalizeName(name) {
     return name.toLowerCase().replace(/[^a-z0-9]/g, "");
 }
 function sensitiveNameFragment(name) {
     const normalized = normalizeName(name);
+    if (BENIGN_NAMES.has(normalized)) {
+        return undefined;
+    }
     return SENSITIVE_NAME_FRAGMENTS.find((fragment) => normalized.includes(fragment));
 }
-function isLuhnValidCardNumber(value) {
-    const digits = value.replace(/[\s-]/g, "");
-    if (!/^\d{13,19}$/.test(digits)) {
-        return false;
-    }
+function passesLuhn(digits) {
     let sum = 0;
     let double = false;
     for (let i = digits.length - 1; i >= 0; i--) {
@@ -57,6 +83,14 @@ function isLuhnValidCardNumber(value) {
     }
     return sum % 10 === 0;
 }
+function isLuhnValidCardNumber(value) {
+    const digits = value.replace(/[\s-]/g, "");
+    if (!/^\d{13,19}$/.test(digits)) {
+        return false;
+    }
+    const brandMatches = CARD_BRANDS.some(([prefix, lengths]) => prefix.test(digits) && lengths.includes(digits.length));
+    return brandMatches && passesLuhn(digits);
+}
 function checkValue(topLevelClaim, value) {
     if (PEM_PRIVATE_KEY.test(value)) {
         throw new PayloadHygieneViolation(topLevelClaim, `Claim "${topLevelClaim}" contains a PEM private-key block. ` +

package/dist/src/lib/payload_hygiene.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload_hygiene.js","sourceRoot":"","sources":["../../../src/lib/payload_hygiene.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,MAAM,wBAAwB,GAAG;IAChC,UAAU;IACV,QAAQ;IACR,YAAY;IACZ,QAAQ;IACR,QAAQ;IACR,YAAY;IACZ,KAAK;IACL,gBAAgB;IAChB,YAAY;IACZ,YAAY;IACZ,KAAK;IACL,KAAK;IACL,OAAO;IACP,eAAe;IACf,QAAQ;CACC,CAAC;AAEX,MAAM,eAAe,GAAG,uCAAuC,CAAC;AAChE,MAAM,QAAQ,GAAG,8DAA8D,CAAC;AAEhF,SAAS,aAAa,CAAC,IAAY;IAClC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY;IAC1C,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACvC,OAAO,wBAAwB,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC3C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,IAAI,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACtC,IAAI,MAAM,EAAE,CAAC;YACZ,KAAK,IAAI,CAAC,CAAC;YACX,IAAI,KAAK,GAAG,CAAC;gBAAE,KAAK,IAAI,CAAC,CAAC;QAC3B,CAAC;QACD,GAAG,IAAI,KAAK,CAAC;QACb,MAAM,GAAG,CAAC,MAAM,CAAC;IAClB,CAAC;IACD,OAAO,GAAG,GAAG,EAAE,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,UAAU,CAAC,aAAqB,EAAE,KAAa;IACvD,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,uBAAuB,CAChC,aAAa,EACb,UAAU,aAAa,sCAAsC;YAC5D,iEAAiE,CAClE,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,uBAAuB,CAChC,aAAa,EACb,UAAU,aAAa,0CAA0C;YAChE,kFAAkF,CACnF,CAAC;IACH,CAAC;IACD,IAAI,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,uBAAuB,CAChC,aAAa,EACb,UAAU,aAAa,oDAAoD;YAC1E,oEAAoE,CACrE,CAAC;IACH,CAAC;AACF,CAAC;AAED,SAAS,QAAQ,CAAC,aAAqB,EAAE,KAAc;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,UAAU,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QACjC,OAAO;IACR,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;YAC3B,QAAQ,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QAChC,CAAC;QACD,OAAO;IACR,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACjD,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,IAAI,uBAAuB,CAChC,aAAa,EACb,UAAU,aAAa,iDAAiD,QAAQ,KAAK;oBACpF,sEAAsE;oBACtE,gEAAgE,CACjE,CAAC;YACH,CAAC;YACD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACjC,CAAC;IACF,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAC1C,OAAgC,EAChC,gBAAqC,IAAI,GAAG,EAAE;IAE9C,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtD,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,SAAS;QACV,CAAC;QACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,uBAAuB,CAChC,KAAK,EACL,eAAe,KAAK,4CAA4C,QAAQ,MAAM;gBAC7E,sEAAsE;gBACtE,gEAAgE,CACjE,CAAC;QACH,CAAC;QACD,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACxB,CAAC;AACF,CAAC"}
+{"version":3,"file":"payload_hygiene.js","sourceRoot":"","sources":["../../../src/lib/payload_hygiene.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,MAAM,wBAAwB,GAAG;IAChC,UAAU;IACV,QAAQ;IACR,YAAY;IACZ,QAAQ;IACR,QAAQ;IACR,YAAY;IACZ,KAAK;IACL,gBAAgB;IAChB,YAAY;IACZ,YAAY;IACZ,KAAK;IACL,KAAK;IACL,OAAO;IACP,eAAe;IACf,QAAQ;CACC,CAAC;AAEX,MAAM,eAAe,GAAG,uCAAuC,CAAC;AAEhE,4EAA4E;AAC5E,6EAA6E;AAC7E,2EAA2E;AAC3E,oEAAoE;AACpE,MAAM,QAAQ,GAAG,4DAA4D,CAAC;AAE9E;;;;;;GAMG;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;AAExD;;;;;GAKG;AACH,MAAM,WAAW,GAAwD;IACxE,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO;IAC7B,CAAC,uCAAuC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,aAAa;IAC9D,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,mBAAmB;IACrC,CAAC,oBAAoB,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW;IAC7C,CAAC,uBAAuB,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,cAAc;IACvD,CAAC,oBAAoB,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM;IAChD,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW;CACtC,CAAC;AAEF,SAAS,aAAa,CAAC,IAAY;IAClC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY;IAC1C,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QAClC,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,wBAAwB,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IACjC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,IAAI,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACtC,IAAI,MAAM,EAAE,CAAC;YACZ,KAAK,IAAI,CAAC,CAAC;YACX,IAAI,KAAK,GAAG,CAAC;gBAAE,KAAK,IAAI,CAAC,CAAC;QAC3B,CAAC;QACD,GAAG,IAAI,KAAK,CAAC;QACb,MAAM,GAAG,CAAC,MAAM,CAAC;IAClB,CAAC;IACD,OAAO,GAAG,GAAG,EAAE,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC3C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,YAAY,GAAG,WAAW,CAAC,IAAI,CACpC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAC7E,CAAC;IACF,OAAO,YAAY,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,UAAU,CAAC,aAAqB,EAAE,KAAa;IACvD,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,uBAAuB,CAChC,aAAa,EACb,UAAU,aAAa,sCAAsC;YAC5D,iEAAiE,CAClE,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,uBAAuB,CAChC,aAAa,EACb,UAAU,aAAa,0CAA0C;YAChE,kFAAkF,CACnF,CAAC;IACH,CAAC;IACD,IAAI,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,uBAAuB,CAChC,aAAa,EACb,UAAU,aAAa,oDAAoD;YAC1E,oEAAoE,CACrE,CAAC;IACH,CAAC;AACF,CAAC;AAED,SAAS,QAAQ,CAAC,aAAqB,EAAE,KAAc;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,UAAU,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QACjC,OAAO;IACR,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;YAC3B,QAAQ,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QAChC,CAAC;QACD,OAAO;IACR,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACjD,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,IAAI,uBAAuB,CAChC,aAAa,EACb,UAAU,aAAa,iDAAiD,QAAQ,KAAK;oBACpF,sEAAsE;oBACtE,gEAAgE,CACjE,CAAC;YACH,CAAC;YACD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACjC,CAAC;IACF,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAC1C,OAAgC,EAChC,gBAAqC,IAAI,GAAG,EAAE;IAE9C,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtD,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,SAAS;QACV,CAAC;QACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,uBAAuB,CAChC,KAAK,EACL,eAAe,KAAK,4CAA4C,QAAQ,MAAM;gBAC7E,sEAAsE;gBACtE,gEAAgE,CACjE,CAAC;QACH,CAAC;QACD,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACxB,CAAC;AACF,CAAC"}

package/dist/src/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAUH;;;;GAIG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,KAAa,EAAY,EAAE;IACjD,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,KAAiB,CAAC;AAC1B,CAAC,CAAC;AAQF,MAAM,UAAU,SAAS,CAAC,KAAa;IACtC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,SAAS,CAAC,2DAA2D,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,KAAwB,CAAC;AACjC,CAAC;AAiDD,0EAA0E;AAC1E,MAAM,UAAU,iBAAiB,CAChC,SAAyB,EACzB,OAAwC,EACxC,GAAY;IAEZ,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,OAAO,EAAE,aAAa;QACtB,SAAS;QACT,OAAO;QACP,GAAG;KACH,CAAqB,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAc;IAC3C,OAAO,CACN,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACb,KAA+B,CAAC,OAAO,KAAK,aAAa,CAC1D,CAAC;AACH,CAAC;AAqFD,sFAAsF;AACtF,MAAM,UAAU,2BAA2B,CAC1C,SAAyB,EACzB,OAAwC,EACxC,GAAY;IAEZ,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,OAAO,EAAE,uBAAuB;QAChC,SAAS;QACT,OAAO;QACP,GAAG;KACH,CAA+B,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACrD,OAAO,CACN,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACb,KAA+B,CAAC,OAAO,KAAK,uBAAuB,CACpE,CAAC;AACH,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAUH;;;;GAIG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,KAAa,EAAY,EAAE;IACjD,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,KAAiB,CAAC;AAC1B,CAAC,CAAC;AAQF,MAAM,UAAU,SAAS,CAAC,KAAa;IACtC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,SAAS,CAAC,2DAA2D,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,KAAwB,CAAC;AACjC,CAAC;AAiDD,0EAA0E;AAC1E,MAAM,UAAU,iBAAiB,CAChC,SAAyB,EACzB,OAAwC,EACxC,GAAY;IAEZ,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,OAAO,EAAE,aAAa;QACtB,SAAS;QACT,OAAO;QACP,GAAG;KACH,CAAqB,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAc;IAC3C,OAAO,CACN,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACb,KAA+B,CAAC,OAAO,KAAK,aAAa,CAC1D,CAAC;AACH,CAAC;AAyFD,sFAAsF;AACtF,MAAM,UAAU,2BAA2B,CAC1C,SAAyB,EACzB,OAAwC,EACxC,GAAY;IAEZ,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,OAAO,EAAE,uBAAuB;QAChC,SAAS;QACT,OAAO;QACP,GAAG;KACH,CAA+B,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACrD,OAAO,CACN,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACb,KAA+B,CAAC,OAAO,KAAK,uBAAuB,CACpE,CAAC;AACH,CAAC"}

package/dist/types/src/http/cookies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../../../src/http/cookies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAQH,MAAM,WAAW,kBAAkB;IAClC,yEAAyE;IACzE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAC;IAC5B,mDAAmD;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wCAAwC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAuB,GAAG,MAAM,CAwCxF;AAED,8DAA8D;AAC9D,wBAAgB,cAAc,CAC7B,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,kBAAuB,GAC9B,IAAI,CAEN;AAED,4CAA4C;AAC5C,wBAAgB,gBAAgB,CAC/B,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,MAAM,GAAG,QAAQ,CAAM,GAChE,IAAI,CAKN;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC9B,MAAM,EAAE,OAAO,GAAG;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,EAClE,IAAI,GAAE,MAA4B,GAChC,MAAM,GAAG,SAAS,CAoBpB"}
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../../../src/http/cookies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAQH,MAAM,WAAW,kBAAkB;IAClC,yEAAyE;IACzE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAC;IAC5B,mDAAmD;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wCAAwC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAuB,GAAG,MAAM,CAwCxF;AAED,8DAA8D;AAC9D,wBAAgB,cAAc,CAC7B,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,kBAAuB,GAC9B,IAAI,CAEN;AAED,4CAA4C;AAC5C,wBAAgB,gBAAgB,CAC/B,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,MAAM,GAAG,QAAQ,CAAM,GAChE,IAAI,CAKN;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC9B,MAAM,EAAE,OAAO,GAAG;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,EAClE,IAAI,GAAE,MAA4B,GAChC,MAAM,GAAG,SAAS,CAyBpB"}

package/dist/types/src/jwks/local.d.ts

@@ -7,8 +7,16 @@
  * sanitized by header validation (§3.10).
  */
 import type { JwtHeader, KeySource, ResolvedVerificationKey, StaticJWK, StaticJWKS } from "../types.js";
+export interface ResolveFromJwksOptions {
+    /**
+     * Whether symmetric (`oct`) entries may be used. False for remote sets: a
+     * JWKS endpoint is public, so a secret published there is a secret every
+     * reader can *mint* with, not just verify with.
+     */
+    allowSymmetric?: boolean;
+}
 /** Shared selection + import used by both local and remote sets. */
-export declare function resolveFromJwks(keys: readonly StaticJWK[], header: JwtHeader): Promise<ResolvedVerificationKey>;
+export declare function resolveFromJwks(keys: readonly StaticJWK[], header: JwtHeader, options?: ResolveFromJwksOptions): Promise<ResolvedVerificationKey>;
 /** Validate the developer-supplied JWKS document shape (config error -> TypeError). */
 export declare function validateJwksShape(jwks: unknown): StaticJWK[];
 /** Create a {@link KeySource} backed by a static JWKS document. */

package/dist/types/src/jwks/local.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local.d.ts","sourceRoot":"","sources":["../../../../src/jwks/local.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAWH,OAAO,KAAK,EACX,SAAS,EACT,SAAS,EACT,uBAAuB,EACvB,SAAS,EACT,UAAU,EACV,MAAM,aAAa,CAAC;AAYrB,oEAAoE;AACpE,wBAAsB,eAAe,CACpC,IAAI,EAAE,SAAS,SAAS,EAAE,EAC1B,MAAM,EAAE,SAAS,GACf,OAAO,CAAC,uBAAuB,CAAC,CA+BlC;AAED,uFAAuF;AACvF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,GAAG,SAAS,EAAE,CAsB5D;AAED,mEAAmE;AACnE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,UAAU,GAAG,SAAS,CAO7D"}
+{"version":3,"file":"local.d.ts","sourceRoot":"","sources":["../../../../src/jwks/local.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAWH,OAAO,KAAK,EACX,SAAS,EACT,SAAS,EACT,uBAAuB,EACvB,SAAS,EACT,UAAU,EACV,MAAM,aAAa,CAAC;AAYrB,MAAM,WAAW,sBAAsB;IACtC;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,oEAAoE;AACpE,wBAAsB,eAAe,CACpC,IAAI,EAAE,SAAS,SAAS,EAAE,EAC1B,MAAM,EAAE,SAAS,EACjB,OAAO,GAAE,sBAA2B,GAClC,OAAO,CAAC,uBAAuB,CAAC,CAkClC;AAED,uFAAuF;AACvF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,GAAG,SAAS,EAAE,CAsB5D;AAED,mEAAmE;AACnE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,UAAU,GAAG,SAAS,CAO7D"}

package/dist/types/src/jwks/remote.d.ts

@@ -5,7 +5,11 @@
  * - caches with a configurable TTL and honors `Cache-Control: max-age`
  * - cooldown between refetches (no attacker-driven fetch storms)
  * - refetches once on unknown `kid` (key rotation), then fails closed
- * - response size is capped; entries outside the registry are dropped
+ * - stale keys keep serving a *bounded* while after the endpoint starts
+ *   failing, then verification fails closed (LW-jwks.2)
+ * - the response byte budget is enforced while reading, not after
+ * - symmetric (`oct`) entries are refused: a JWKS endpoint is public
+ * - entries outside the registry are dropped
  */
 import type { KeySource } from "../types.js";
 export interface RemoteJWKSetOptions {
@@ -15,6 +19,13 @@ export interface RemoteJWKSetOptions {
     cooldownSeconds?: number;
     /** Fetch timeout (default 5000ms). */
     timeoutMs?: number;
+    /**
+     * How long previously-good keys may keep serving once the endpoint starts
+     * failing (default 3600s). Bounded on purpose: a key rotated out *because
+     * it was compromised* must not stay trusted for as long as an attacker can
+     * keep the endpoint unreachable. `0` disables stale serving entirely.
+     */
+    staleWhileErrorSeconds?: number;
     /** Fetch implementation override - intended for tests. */
     fetch?: typeof fetch;
 }

package/dist/types/src/jwks/remote.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote.d.ts","sourceRoot":"","sources":["../../../../src/jwks/remote.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAEX,SAAS,EAGT,MAAM,aAAa,CAAC;AAQrB,MAAM,WAAW,mBAAmB;IACnC,mFAAmF;IACnF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,sCAAsC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0DAA0D;IAC1D,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACrB;AASD,wEAAwE;AACxE,wBAAgB,kBAAkB,CACjC,GAAG,EAAE,GAAG,GAAG,MAAM,EACjB,OAAO,GAAE,mBAAwB,GAC/B,SAAS,CA8FX"}
+{"version":3,"file":"remote.d.ts","sourceRoot":"","sources":["../../../../src/jwks/remote.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EAEX,SAAS,EAGT,MAAM,aAAa,CAAC;AASrB,MAAM,WAAW,mBAAmB;IACnC,mFAAmF;IACnF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,sCAAsC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,0DAA0D;IAC1D,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACrB;AAwDD,wEAAwE;AACxE,wBAAgB,kBAAkB,CACjC,GAAG,EAAE,GAAG,GAAG,MAAM,EACjB,OAAO,GAAE,mBAAwB,GAC/B,SAAS,CAsHX"}

package/dist/types/src/jwt/decrypt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"decrypt.d.ts","sourceRoot":"","sources":["../../../../src/jwt/decrypt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAqBH,OAAO,EAEN,KAAK,YAAY,EACjB,KAAK,yBAAyB,EAG9B,MAAM,aAAa,CAAC;AAgDrB;;;;GAIG;AACH,wBAAsB,UAAU,CAC/B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,yBAAyB,GAChC,OAAO,CAAC,YAAY,CAAC,CA4DvB"}
+{"version":3,"file":"decrypt.d.ts","sourceRoot":"","sources":["../../../../src/jwt/decrypt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAqBH,OAAO,EAEN,KAAK,YAAY,EACjB,KAAK,yBAAyB,EAG9B,MAAM,aAAa,CAAC;AAgDrB;;;;GAIG;AACH,wBAAsB,UAAU,CAC/B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,yBAAyB,GAChC,OAAO,CAAC,YAAY,CAAC,CAwEvB"}

package/dist/types/src/jwt/decryption_profile.d.ts

@@ -18,8 +18,10 @@ export interface DecryptionProfileOptions {
     contentEncryptionAlgorithms: readonly string[];
     /** The private/secret key that decrypts (bound to one key-management alg). */
     key: LacewingEncryptionKey;
-    /** Maximum accepted token age, independent of `exp`. */
+    /** Maximum accepted token age (`now - iat`), independent of `exp`. */
     maxTokenAge: number | string;
+    /** Optional cap on the token's declared lifetime (`exp - iat`). */
+    maxTokenLifetime?: number | string;
     /** Allowed clock skew, default 5s, capped at 120s. */
     maxClockSkew?: number | string;
     revocation?: RevocationStore;

package/dist/types/src/jwt/decryption_profile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"decryption_profile.d.ts","sourceRoot":"","sources":["../../../../src/jwt/decryption_profile.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,OAAO,EAGN,KAAK,yBAAyB,EAC9B,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,MAAM,aAAa,CAAC;AAKrB,MAAM,WAAW,wBAAwB;IACxC,4CAA4C;IAC5C,GAAG,EAAE,MAAM,CAAC;IACZ,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,uBAAuB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,qDAAqD;IACrD,2BAA2B,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,8EAA8E;IAC9E,GAAG,EAAE,qBAAqB,CAAC;IAC3B,wDAAwD;IACxD,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,sDAAsD;IACtD,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+BAA+B,CAAC,EAAE,OAAO,CAAC;CAC1C;AASD,8DAA8D;AAC9D,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,wBAAwB,GAAG,yBAAyB,CAuDpG"}
+{"version":3,"file":"decryption_profile.d.ts","sourceRoot":"","sources":["../../../../src/jwt/decryption_profile.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,OAAO,EAGN,KAAK,yBAAyB,EAC9B,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,MAAM,aAAa,CAAC;AAKrB,MAAM,WAAW,wBAAwB;IACxC,4CAA4C;IAC5C,GAAG,EAAE,MAAM,CAAC;IACZ,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,uBAAuB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,qDAAqD;IACrD,2BAA2B,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,8EAA8E;IAC9E,GAAG,EAAE,qBAAqB,CAAC;IAC3B,sEAAsE;IACtE,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,mEAAmE;IACnE,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACnC,sDAAsD;IACtD,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+BAA+B,CAAC,EAAE,OAAO,CAAC;CAC1C;AASD,8DAA8D;AAC9D,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,wBAAwB,GAAG,yBAAyB,CA6DpG"}

package/dist/types/src/jwt/profile.d.ts

@@ -19,8 +19,14 @@ export interface ProfileOptions {
     algorithms: readonly string[];
     /** Key source: a JWKS (static or remote config), a KeySource, or a single key. */
     keys: KeySource | LacewingKey | StaticJWKS | RemoteJWKS;
-    /** Maximum accepted token age, independent of `exp`. */
+    /** Maximum accepted token age (`now - iat`), independent of `exp`. */
     maxTokenAge: number | string;
+    /**
+     * Optional cap on the token's *declared* lifetime (`exp - iat`). Where
+     * `maxTokenAge` bounds how long a token stays usable, this refuses a token
+     * whose issuer claimed an implausible span at all - a misissuance signal.
+     */
+    maxTokenLifetime?: number | string;
     /** Allowed clock skew, default 5s, capped at 120s. */
     maxClockSkew?: number | string;
     /** Optional revocation store - its absence is a visible choice. */

package/dist/types/src/jwt/profile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"profile.d.ts","sourceRoot":"","sources":["../../../../src/jwt/profile.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,EAGN,KAAK,kBAAkB,EACvB,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,MAAM,aAAa,CAAC;AAKrB,MAAM,WAAW,cAAc;IAC9B,oDAAoD;IACpD,GAAG,EAAE,MAAM,CAAC;IACZ,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,kFAAkF;IAClF,IAAI,EAAE,SAAS,GAAG,WAAW,GAAG,UAAU,GAAG,UAAU,CAAC;IACxD,wDAAwD;IACxD,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,sDAAsD;IACtD,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,mEAAmE;IACnE,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,iEAAiE;IACjE,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAChD,uCAAuC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kFAAkF;IAClF,+BAA+B,CAAC,EAAE,OAAO,CAAC;CAC1C;AA+CD,6DAA6D;AAC7D,wBAAgB,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,kBAAkB,CAmDzE"}
+{"version":3,"file":"profile.d.ts","sourceRoot":"","sources":["../../../../src/jwt/profile.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,EAGN,KAAK,kBAAkB,EACvB,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,MAAM,aAAa,CAAC;AAKrB,MAAM,WAAW,cAAc;IAC9B,oDAAoD;IACpD,GAAG,EAAE,MAAM,CAAC;IACZ,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,kFAAkF;IAClF,IAAI,EAAE,SAAS,GAAG,WAAW,GAAG,UAAU,GAAG,UAAU,CAAC;IACxD,sEAAsE;IACtE,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACnC,sDAAsD;IACtD,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,mEAAmE;IACnE,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,iEAAiE;IACjE,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAChD,uCAAuC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kFAAkF;IAClF,+BAA+B,CAAC,EAAE,OAAO,CAAC;CAC1C;AAgDD,6DAA6D;AAC7D,wBAAgB,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,kBAAkB,CAyDzE"}

package/dist/types/src/lib/claims.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"claims.d.ts","sourceRoot":"","sources":["../../../../src/lib/claims.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAuChD,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD;;;GAGG;AACH,wBAAsB,cAAc,CACnC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,OAAO,EAAE,YAAY,EACrB,UAAU,GAAE,MAAsC,GAChD,OAAO,CAAC,IAAI,CAAC,CA4Ef"}
+{"version":3,"file":"claims.d.ts","sourceRoot":"","sources":["../../../../src/lib/claims.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAuChD,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD;;;GAGG;AACH,wBAAsB,cAAc,CACnC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,OAAO,EAAE,YAAY,EACrB,UAAU,GAAE,MAAsC,GAChD,OAAO,CAAC,IAAI,CAAC,CA0Ff"}

package/dist/types/src/lib/entropy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entropy.d.ts","sourceRoot":"","sources":["../../../../src/lib/entropy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA+BH;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAYzD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI,CAelF"}
+{"version":3,"file":"entropy.d.ts","sourceRoot":"","sources":["../../../../src/lib/entropy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA+BH;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAkBzD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI,CAelF"}

package/dist/types/src/lib/payload_hygiene.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload_hygiene.d.ts","sourceRoot":"","sources":["../../../../src/lib/payload_hygiene.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAwGH;;;;GAIG;AACH,wBAAgB,2BAA2B,CAC1C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,aAAa,GAAE,WAAW,CAAC,MAAM,CAAa,GAC5C,IAAI,CAgBN"}
+{"version":3,"file":"payload_hygiene.d.ts","sourceRoot":"","sources":["../../../../src/lib/payload_hygiene.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAgJH;;;;GAIG;AACH,wBAAgB,2BAA2B,CAC1C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,aAAa,GAAE,WAAW,CAAC,MAAM,CAAa,GAC5C,IAAI,CAgBN"}

package/dist/types/src/types.d.ts

@@ -82,6 +82,8 @@ export type RemoteJWKS = {
     cacheTtlSeconds?: number;
     cooldownSeconds?: number;
     timeoutMs?: number;
+    /** Bounded stale-serving window once the endpoint starts failing (default 1h). */
+    staleWhileErrorSeconds?: number;
 };
 export type JWKSConfig = StaticJWKS | RemoteJWKS;
 /** A key resolved by a {@link KeySource} for one specific token. */
@@ -117,6 +119,8 @@ export interface ClaimsPolicy {
     iss: string;
     aud: string;
     maxTokenAge: DurationSeconds;
+    /** Optional cap on the token's declared span (`exp - iat`). */
+    maxTokenLifetime?: DurationSeconds;
     maxClockSkew: DurationSeconds;
     subject?: string;
     claimValidators?: Record<string, ValidateClaim>;
@@ -182,6 +186,8 @@ export interface ExpectedJwtProfile {
     alg: readonly ValidAlg[];
     keys: KeySource | LacewingKey;
     maxTokenAge: DurationSeconds;
+    /** Optional cap on the token's declared span (`exp - iat`). */
+    maxTokenLifetime?: DurationSeconds;
     maxClockSkew: DurationSeconds;
     revocation?: RevocationStore;
     claimValidators?: Record<string, ValidateClaim>;

package/dist/types/src/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/types.ts"],"names":[],"mappings":"AAQA;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,MAAM,CAAA;CAAE,CAAC;AAElE;;;;GAIG;AACH,eAAO,MAAM,MAAM,GAAI,OAAO,MAAM,KAAG,QAKtC,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,UAAU,EAAE,OAAO,MAAM,CAAA;CAAE,CAAC;AAE9E,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,CAKxD;AAED,MAAM,WAAW,SAAS;IACzB,GAAG,EAAE,QAAQ,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,UAAU;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;CAC5B;AAED,kFAAkF;AAClF,KAAK,QAAQ,GAAG;IACf,MAAM,EAAE,SAAS,CAAC;IAClB,OAAO,EAAE,UAAU,CAAC;CACpB,CAAC;AAEF,yEAAyE;AACzE,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;CAAE,CAAC;AACzE,+EAA+E;AAC/E,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;CAAE,CAAC;AAE3E,OAAO,CAAC,MAAM,WAAW,EAAE,OAAO,MAAM,CAAC;AACzC,MAAM,MAAM,OAAO,CAAC,CAAC,EAAE,SAAS,SAAS,MAAM,IAAI,CAAC,GAAG;IACtD,QAAQ,CAAC,CAAC,WAAW,CAAC,EAAE,SAAS,CAAC;CAClC,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,WAAW,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM,IAAI;IACtD,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,GAAG,GAAG,QAAQ,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC;IAClD,sEAAsE;IACtE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF,0EAA0E;AAC1E,wBAAgB,iBAAiB,CAAC,KAAK,CAAC,GAAG,SAAS,MAAM,EACzD,SAAS,EAAE,GAAG,GAAG,QAAQ,EACzB,OAAO,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,EACxC,GAAG,EAAE,OAAO,GACV,WAAW,CAAC,GAAG,CAAC,CAOlB;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,WAAW,CAMlE;AAED,MAAM,MAAM,SAAS,GAAG;IACvB,GAAG,EAAE,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,KAAK,CAAC;IAClC,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACxB,IAAI,EAAE,SAAS,EAAE,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,UAAU,CAAC;AAEjD,oEAAoE;AACpE,MAAM,WAAW,uBAAuB;IACvC,GAAG,EAAE,QAAQ,CAAC;IACd,GAAG,EAAE,OAAO,CAAC;CACb;AAED;;;GAGG;AACH,MAAM,WAAW,SAAS;IACzB,kBAAkB,CACjB,MAAM,EAAE,SAAS,EACjB,iBAAiB,EAAE,SAAS,QAAQ,EAAE,GACpC,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,sBAAsB;IACtC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,eAAe;IAC/B,SAAS,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7D,YAAY,CAAC,CAAC,QAAQ,EAAE,sBAAsB,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;CACtE;AAED,MAAM,MAAM,aAAa,GAAG,CAC3B,UAAU,EAAE,OAAO,EACnB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAChC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1B;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,eAAe,CAAC;IAC7B,YAAY,EAAE,eAAe,CAAC;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;CAChD;AAED;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM,IAAI;IAChE,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,GAAG,GAAG,QAAQ,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC;IAClD,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF,sFAAsF;AACtF,wBAAgB,2BAA2B,CAAC,KAAK,CAAC,GAAG,SAAS,MAAM,EACnE,SAAS,EAAE,GAAG,GAAG,QAAQ,EACzB,OAAO,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,EACxC,GAAG,EAAE,OAAO,GACV,qBAAqB,CAAC,GAAG,CAAC,CAO5B;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,qBAAqB,CAMtF;AAED,+EAA+E;AAC/E,MAAM,WAAW,SAAS;IACzB,GAAG,EAAE,QAAQ,CAAC;IACd,GAAG,EAAE,QAAQ,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACb;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG;IAC1B,MAAM,EAAE,SAAS,CAAC;IAClB,OAAO,EAAE,UAAU,CAAC;CACpB,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;CAAE,CAAC;AAEzC;;;;GAIG;AACH,MAAM,WAAW,yBAA0B,SAAQ,YAAY;IAC9D,GAAG,EAAE,MAAM,CAAC;IACZ,gFAAgF;IAChF,uBAAuB,EAAE,SAAS,QAAQ,EAAE,CAAC;IAC7C,0DAA0D;IAC1D,2BAA2B,EAAE,SAAS,QAAQ,EAAE,CAAC;IACjD,8EAA8E;IAC9E,GAAG,EAAE,qBAAqB,CAAC;IAC3B,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,+BAA+B,CAAC,EAAE,OAAO,CAAC;CAC1C;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,SAAS,QAAQ,EAAE,CAAC;IACzB,IAAI,EAAE,SAAS,GAAG,WAAW,CAAC;IAC9B,WAAW,EAAE,eAAe,CAAC;IAC7B,YAAY,EAAE,eAAe,CAAC;IAC9B,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,+BAA+B,CAAC,EAAE,OAAO,CAAC;CAC1C"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/types.ts"],"names":[],"mappings":"AAQA;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,MAAM,CAAA;CAAE,CAAC;AAElE;;;;GAIG;AACH,eAAO,MAAM,MAAM,GAAI,OAAO,MAAM,KAAG,QAKtC,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,UAAU,EAAE,OAAO,MAAM,CAAA;CAAE,CAAC;AAE9E,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,CAKxD;AAED,MAAM,WAAW,SAAS;IACzB,GAAG,EAAE,QAAQ,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,UAAU;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;CAC5B;AAED,kFAAkF;AAClF,KAAK,QAAQ,GAAG;IACf,MAAM,EAAE,SAAS,CAAC;IAClB,OAAO,EAAE,UAAU,CAAC;CACpB,CAAC;AAEF,yEAAyE;AACzE,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;CAAE,CAAC;AACzE,+EAA+E;AAC/E,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;CAAE,CAAC;AAE3E,OAAO,CAAC,MAAM,WAAW,EAAE,OAAO,MAAM,CAAC;AACzC,MAAM,MAAM,OAAO,CAAC,CAAC,EAAE,SAAS,SAAS,MAAM,IAAI,CAAC,GAAG;IACtD,QAAQ,CAAC,CAAC,WAAW,CAAC,EAAE,SAAS,CAAC;CAClC,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,WAAW,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM,IAAI;IACtD,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,GAAG,GAAG,QAAQ,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC;IAClD,sEAAsE;IACtE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF,0EAA0E;AAC1E,wBAAgB,iBAAiB,CAAC,KAAK,CAAC,GAAG,SAAS,MAAM,EACzD,SAAS,EAAE,GAAG,GAAG,QAAQ,EACzB,OAAO,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,EACxC,GAAG,EAAE,OAAO,GACV,WAAW,CAAC,GAAG,CAAC,CAOlB;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,WAAW,CAMlE;AAED,MAAM,MAAM,SAAS,GAAG;IACvB,GAAG,EAAE,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,KAAK,CAAC;IAClC,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACxB,IAAI,EAAE,SAAS,EAAE,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,sBAAsB,CAAC,EAAE,MAAM,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,UAAU,CAAC;AAEjD,oEAAoE;AACpE,MAAM,WAAW,uBAAuB;IACvC,GAAG,EAAE,QAAQ,CAAC;IACd,GAAG,EAAE,OAAO,CAAC;CACb;AAED;;;GAGG;AACH,MAAM,WAAW,SAAS;IACzB,kBAAkB,CACjB,MAAM,EAAE,SAAS,EACjB,iBAAiB,EAAE,SAAS,QAAQ,EAAE,GACpC,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,sBAAsB;IACtC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,eAAe;IAC/B,SAAS,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7D,YAAY,CAAC,CAAC,QAAQ,EAAE,sBAAsB,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;CACtE;AAED,MAAM,MAAM,aAAa,GAAG,CAC3B,UAAU,EAAE,OAAO,EACnB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAChC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1B;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,eAAe,CAAC;IAC7B,+DAA+D;IAC/D,gBAAgB,CAAC,EAAE,eAAe,CAAC;IACnC,YAAY,EAAE,eAAe,CAAC;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;CAChD;AAED;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM,IAAI;IAChE,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,GAAG,GAAG,QAAQ,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC;IAClD,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF,sFAAsF;AACtF,wBAAgB,2BAA2B,CAAC,KAAK,CAAC,GAAG,SAAS,MAAM,EACnE,SAAS,EAAE,GAAG,GAAG,QAAQ,EACzB,OAAO,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,EACxC,GAAG,EAAE,OAAO,GACV,qBAAqB,CAAC,GAAG,CAAC,CAO5B;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,qBAAqB,CAMtF;AAED,+EAA+E;AAC/E,MAAM,WAAW,SAAS;IACzB,GAAG,EAAE,QAAQ,CAAC;IACd,GAAG,EAAE,QAAQ,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACb;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG;IAC1B,MAAM,EAAE,SAAS,CAAC;IAClB,OAAO,EAAE,UAAU,CAAC;CACpB,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;CAAE,CAAC;AAEzC;;;;GAIG;AACH,MAAM,WAAW,yBAA0B,SAAQ,YAAY;IAC9D,GAAG,EAAE,MAAM,CAAC;IACZ,gFAAgF;IAChF,uBAAuB,EAAE,SAAS,QAAQ,EAAE,CAAC;IAC7C,0DAA0D;IAC1D,2BAA2B,EAAE,SAAS,QAAQ,EAAE,CAAC;IACjD,8EAA8E;IAC9E,GAAG,EAAE,qBAAqB,CAAC;IAC3B,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,+BAA+B,CAAC,EAAE,OAAO,CAAC;CAC1C;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,SAAS,QAAQ,EAAE,CAAC;IACzB,IAAI,EAAE,SAAS,GAAG,WAAW,CAAC;IAC9B,WAAW,EAAE,eAAe,CAAC;IAC7B,+DAA+D;IAC/D,gBAAgB,CAAC,EAAE,eAAe,CAAC;IACnC,YAAY,EAAE,eAAe,CAAC;IAC9B,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,+BAA+B,CAAC,EAAE,OAAO,CAAC;CAC1C"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "lacewing",
-	"version": "1.0.0",
+	"version": "1.0.1",
 	"description": "An opinionated JWT library that makes RFC 8725 (JWT Best Current Practices) the default behavior, not an optional configuration.",
 	"type": "module",
 	"engines": {
@@ -55,16 +55,16 @@
 		"@commitlint/config-conventional": "^21.2.0",
 		"@eslint/js": "^10.0.1",
 		"@types/node": "^26.1.1",
-		"eslint": "^10.7.0",
+		"eslint": "^10.8.0",
 		"fast-check": "^4.9.0",
 		"git-cliff": "^2.13.1",
 		"lefthook": "^2.1.10",
-		"tsx": "^4.23.0",
+		"tsx": "^4.23.1",
 		"typedoc": "^0.28.20",
 		"typescript": "^6.0.3",
-		"typescript-eslint": "^8.63.0"
+		"typescript-eslint": "^8.65.0"
 	},
 	"dependencies": {
-		"jose": "^6.2.3"
+		"jose": "^6.2.4"
 	}
 }