lacewing 1.0.0 → 1.0.2

package/dist/src/jwks/remote.js

@@ -5,13 +5,18 @@
  * - caches with a configurable TTL and honors `Cache-Control: max-age`
  * - cooldown between refetches (no attacker-driven fetch storms)
  * - refetches once on unknown `kid` (key rotation), then fails closed
- * - response size is capped; entries outside the registry are dropped
+ * - stale keys keep serving a *bounded* while after the endpoint starts
+ *   failing, then verification fails closed (LW-jwks.2)
+ * - the response byte budget is enforced while reading, not after
+ * - symmetric (`oct`) entries are refused: a JWKS endpoint is public
+ * - entries outside the registry are dropped
  */
 import { JWKSFetchFailed, JWKSNoMatchingKey } from "../util/errors.js";
 import { resolveFromJwks, validateJwksShape } from "./local.js";
 const DEFAULT_CACHE_TTL_SECONDS = 300;
 const DEFAULT_COOLDOWN_SECONDS = 30;
 const DEFAULT_TIMEOUT_MS = 5000;
+const DEFAULT_STALE_WHILE_ERROR_SECONDS = 3600;
 const MAX_CACHE_TTL_SECONDS = 86400;
 const MAX_RESPONSE_BYTES = 1_048_576;
 function cacheTtlFrom(response, fallbackSeconds) {
@@ -20,6 +25,54 @@ function cacheTtlFrom(response, fallbackSeconds) {
     const ttl = match === null ? fallbackSeconds : Number(match[1]);
     return Math.min(Math.max(ttl, 0), MAX_CACHE_TTL_SECONDS);
 }
+function nonNegativeSeconds(value, fallback, field) {
+    if (value === undefined)
+        return fallback;
+    if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
+        throw new TypeError(`JWKS ${field} must be a non-negative number of seconds`);
+    }
+    return value;
+}
+/**
+ * Read a response body under a hard byte budget. The cap is checked against
+ * `Content-Length` up front and again on every chunk, so an oversized body is
+ * abandoned mid-flight instead of being buffered in full and measured
+ * afterwards.
+ */
+async function readCappedText(response, maxBytes) {
+    const declared = response.headers.get("content-length");
+    if (declared !== null) {
+        const length = Number(declared);
+        if (Number.isFinite(length) && length > maxBytes) {
+            throw new JWKSFetchFailed("JWKS response exceeds the size cap");
+        }
+    }
+    const body = response.body;
+    if (body === null || body === undefined) {
+        return "";
+    }
+    const reader = body.getReader();
+    const decoder = new TextDecoder();
+    let received = 0;
+    let text = "";
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            received += value.byteLength;
+            if (received > maxBytes) {
+                throw new JWKSFetchFailed("JWKS response exceeds the size cap");
+            }
+            text += decoder.decode(value, { stream: true });
+        }
+    }
+    finally {
+        // Abandons the transfer when we bailed out early; a no-op once drained.
+        await reader.cancel().catch(() => undefined);
+    }
+    return text + decoder.decode();
+}
 /** Create a {@link KeySource} that fetches and caches a remote JWKS. */
 export function createRemoteJWKSet(url, options = {}) {
     const jwksUrl = new URL(url);
@@ -30,9 +83,11 @@ export function createRemoteJWKSet(url, options = {}) {
     const fallbackTtl = options.cacheTtlSeconds ?? DEFAULT_CACHE_TTL_SECONDS;
     const cooldownMs = (options.cooldownSeconds ?? DEFAULT_COOLDOWN_SECONDS) * 1000;
     const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const staleWhileErrorMs = nonNegativeSeconds(options.staleWhileErrorSeconds, DEFAULT_STALE_WHILE_ERROR_SECONDS, "staleWhileErrorSeconds") * 1000;
     let cachedKeys;
     let expiresAtMs = 0;
     let lastAttemptMs = 0;
+    let lastSuccessMs = 0;
     let inflight;
     async function fetchJwks() {
         lastAttemptMs = Date.now();
@@ -50,10 +105,7 @@ export function createRemoteJWKSet(url, options = {}) {
         if (!response.ok) {
             throw new JWKSFetchFailed(`JWKS endpoint responded with status ${response.status}`);
         }
-        const body = await response.text();
-        if (body.length > MAX_RESPONSE_BYTES) {
-            throw new JWKSFetchFailed("JWKS response exceeds the size cap");
-        }
+        const body = await readCappedText(response, MAX_RESPONSE_BYTES);
         let parsed;
         try {
             parsed = JSON.parse(body);
@@ -69,7 +121,8 @@ export function createRemoteJWKSet(url, options = {}) {
             throw new JWKSFetchFailed("JWKS response is not a valid key set", { cause });
         }
         cachedKeys = keys;
-        expiresAtMs = Date.now() + cacheTtlFrom(response, fallbackTtl) * 1000;
+        lastSuccessMs = Date.now();
+        expiresAtMs = lastSuccessMs + cacheTtlFrom(response, fallbackTtl) * 1000;
     }
     function refresh() {
         // Concurrent verifications share one fetch.
@@ -78,24 +131,36 @@ export function createRemoteJWKSet(url, options = {}) {
         });
         return inflight;
     }
+    /**
+     * May we still serve the last good keys, given how long ago they were good?
+     * Strict `<` so that `staleWhileErrorSeconds: 0` disables stale serving
+     * outright rather than granting the millisecond the keys were fetched in.
+     */
+    function staleServable() {
+        return cachedKeys !== undefined && Date.now() - lastSuccessMs < staleWhileErrorMs;
+    }
     async function ensureFresh() {
         const now = Date.now();
         if (cachedKeys !== undefined && now < expiresAtMs) {
             return;
         }
         if (now - lastAttemptMs < cooldownMs && inflight === undefined) {
-            // In cooldown: serve stale keys if we have them, else fail.
-            if (cachedKeys !== undefined)
+            // In cooldown: serve stale keys if they are still inside the
+            // stale-while-error window, otherwise fail closed.
+            if (staleServable())
                 return;
-            throw new JWKSFetchFailed("JWKS fetch is cooling down after a recent failure");
+            throw new JWKSFetchFailed(cachedKeys === undefined
+                ? "JWKS fetch is cooling down after a recent failure"
+                : "JWKS keys are stale beyond the stale-while-error window");
         }
         try {
             await refresh();
         }
         catch (error) {
             // Stale-while-error: an unreachable endpoint must not take down
-            // verification while we still hold previously good keys.
-            if (cachedKeys === undefined)
+            // verification immediately - but only for a bounded window, so
+            // rotated-out keys cannot stay trusted indefinitely (LW-jwks.2).
+            if (!staleServable())
                 throw error;
         }
     }
@@ -103,7 +168,9 @@ export function createRemoteJWKSet(url, options = {}) {
         async getVerificationKey(header) {
             await ensureFresh();
             try {
-                return await resolveFromJwks(cachedKeys, header);
+                return await resolveFromJwks(cachedKeys, header, {
+                    allowSymmetric: false,
+                });
             }
             catch (error) {
                 // Unknown kid may mean the signer rotated keys: refetch once
@@ -113,7 +180,9 @@ export function createRemoteJWKSet(url, options = {}) {
                 if (!canRetry)
                     throw error;
                 await refresh();
-                return resolveFromJwks(cachedKeys, header);
+                return resolveFromJwks(cachedKeys, header, {
+                    allowSymmetric: false,
+                });
             }
         },
     };

package/dist/src/jwks/remote.js.map

@@ -1 +1 @@
-{"version":3,"file":"remote.js","sourceRoot":"","sources":["../../../src/jwks/remote.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAQhE,MAAM,yBAAyB,GAAG,GAAG,CAAC;AACtC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AACpC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAChC,MAAM,qBAAqB,GAAG,KAAK,CAAC;AACpC,MAAM,kBAAkB,GAAG,SAAS,CAAC;AAarC,SAAS,YAAY,CAAC,QAAkB,EAAE,eAAuB;IAChE,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,yBAAyB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC1F,MAAM,GAAG,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;AAC1D,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,kBAAkB,CACjC,GAAiB,EACjB,UAA+B,EAAE;IAEjC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,IAAI,SAAS,CAAC,0BAA0B,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACzC,MAAM,WAAW,GAAG,OAAO,CAAC,eAAe,IAAI,yBAAyB,CAAC;IACzE,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,eAAe,IAAI,wBAAwB,CAAC,GAAG,IAAI,CAAC;IAChF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAE1D,IAAI,UAAmC,CAAC;IACxC,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,QAAmC,CAAC;IAExC,KAAK,UAAU,SAAS;QACvB,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACJ,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE;gBACnC,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,EAAE,MAAM,EAAE,4CAA4C,EAAE;gBACjE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;aACtC,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,eAAe,CAAC,oCAAoC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,eAAe,CAAC,uCAAuC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;YACtC,MAAM,IAAI,eAAe,CAAC,oCAAoC,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,eAAe,CAAC,iCAAiC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,IAAiB,CAAC;QACtB,IAAI,CAAC;YACJ,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,eAAe,CAAC,sCAAsC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,UAAU,GAAG,IAAI,CAAC;QAClB,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,IAAI,CAAC;IACvE,CAAC;IAED,SAAS,OAAO;QACf,4CAA4C;QAC5C,QAAQ,KAAK,SAAS,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACrC,QAAQ,GAAG,SAAS,CAAC;QACtB,CAAC,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,KAAK,UAAU,WAAW;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,UAAU,KAAK,SAAS,IAAI,GAAG,GAAG,WAAW,EAAE,CAAC;YACnD,OAAO;QACR,CAAC;QACD,IAAI,GAAG,GAAG,aAAa,GAAG,UAAU,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChE,4DAA4D;YAC5D,IAAI,UAAU,KAAK,SAAS;gBAAE,OAAO;YACrC,MAAM,IAAI,eAAe,CAAC,mDAAmD,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,CAAC;YACJ,MAAM,OAAO,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,gEAAgE;YAChE,yDAAyD;YACzD,IAAI,UAAU,KAAK,SAAS;gBAAE,MAAM,KAAK,CAAC;QAC3C,CAAC;IACF,CAAC;IAED,OAAO;QACN,KAAK,CAAC,kBAAkB,CAAC,MAAiB;YACzC,MAAM,WAAW,EAAE,CAAC;YACpB,IAAI,CAAC;gBACJ,OAAO,MAAM,eAAe,CAAC,UAAyB,EAAE,MAAM,CAAC,CAAC;YACjE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,6DAA6D;gBAC7D,+CAA+C;gBAC/C,MAAM,QAAQ,GACb,KAAK,YAAY,iBAAiB;oBAClC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,IAAI,UAAU,CAAC;gBAC1C,IAAI,CAAC,QAAQ;oBAAE,MAAM,KAAK,CAAC;gBAC3B,MAAM,OAAO,EAAE,CAAC;gBAChB,OAAO,eAAe,CAAC,UAAyB,EAAE,MAAM,CAAC,CAAC;YAC3D,CAAC;QACF,CAAC;KACD,CAAC;AACH,CAAC"}
+{"version":3,"file":"remote.js","sourceRoot":"","sources":["../../../src/jwks/remote.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAQhE,MAAM,yBAAyB,GAAG,GAAG,CAAC;AACtC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AACpC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAChC,MAAM,iCAAiC,GAAG,IAAI,CAAC;AAC/C,MAAM,qBAAqB,GAAG,KAAK,CAAC;AACpC,MAAM,kBAAkB,GAAG,SAAS,CAAC;AAoBrC,SAAS,YAAY,CAAC,QAAkB,EAAE,eAAuB;IAChE,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,yBAAyB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC1F,MAAM,GAAG,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAyB,EAAE,QAAgB,EAAE,KAAa;IACrF,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,SAAS,CAAC,QAAQ,KAAK,2CAA2C,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,cAAc,CAAC,QAAkB,EAAE,QAAgB;IACjE,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACxD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,QAAQ,EAAE,CAAC;YAClD,MAAM,IAAI,eAAe,CAAC,oCAAoC,CAAC,CAAC;QACjE,CAAC;IACF,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACzC,OAAO,EAAE,CAAC;IACX,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,CAAC;QACJ,SAAS,CAAC;YACT,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC;YAC7B,IAAI,QAAQ,GAAG,QAAQ,EAAE,CAAC;gBACzB,MAAM,IAAI,eAAe,CAAC,oCAAoC,CAAC,CAAC;YACjE,CAAC;YACD,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,CAAC;IACF,CAAC;YAAS,CAAC;QACV,wEAAwE;QACxE,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;AAChC,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,kBAAkB,CACjC,GAAiB,EACjB,UAA+B,EAAE;IAEjC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,IAAI,SAAS,CAAC,0BAA0B,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACzC,MAAM,WAAW,GAAG,OAAO,CAAC,eAAe,IAAI,yBAAyB,CAAC;IACzE,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,eAAe,IAAI,wBAAwB,CAAC,GAAG,IAAI,CAAC;IAChF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC1D,MAAM,iBAAiB,GACtB,kBAAkB,CACjB,OAAO,CAAC,sBAAsB,EAC9B,iCAAiC,EACjC,wBAAwB,CACxB,GAAG,IAAI,CAAC;IAEV,IAAI,UAAmC,CAAC;IACxC,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,QAAmC,CAAC;IAExC,KAAK,UAAU,SAAS;QACvB,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACJ,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE;gBACnC,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,EAAE,MAAM,EAAE,4CAA4C,EAAE;gBACjE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;aACtC,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,eAAe,CAAC,oCAAoC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,eAAe,CAAC,uCAAuC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QAChE,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,eAAe,CAAC,iCAAiC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,IAAiB,CAAC;QACtB,IAAI,CAAC;YACJ,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,eAAe,CAAC,sCAAsC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,UAAU,GAAG,IAAI,CAAC;QAClB,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,WAAW,GAAG,aAAa,GAAG,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,IAAI,CAAC;IAC1E,CAAC;IAED,SAAS,OAAO;QACf,4CAA4C;QAC5C,QAAQ,KAAK,SAAS,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACrC,QAAQ,GAAG,SAAS,CAAC;QACtB,CAAC,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACH,SAAS,aAAa;QACrB,OAAO,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,GAAG,iBAAiB,CAAC;IACnF,CAAC;IAED,KAAK,UAAU,WAAW;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,UAAU,KAAK,SAAS,IAAI,GAAG,GAAG,WAAW,EAAE,CAAC;YACnD,OAAO;QACR,CAAC;QACD,IAAI,GAAG,GAAG,aAAa,GAAG,UAAU,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChE,6DAA6D;YAC7D,mDAAmD;YACnD,IAAI,aAAa,EAAE;gBAAE,OAAO;YAC5B,MAAM,IAAI,eAAe,CACxB,UAAU,KAAK,SAAS;gBACvB,CAAC,CAAC,mDAAmD;gBACrD,CAAC,CAAC,yDAAyD,CAC5D,CAAC;QACH,CAAC;QACD,IAAI,CAAC;YACJ,MAAM,OAAO,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,gEAAgE;YAChE,+DAA+D;YAC/D,iEAAiE;YACjE,IAAI,CAAC,aAAa,EAAE;gBAAE,MAAM,KAAK,CAAC;QACnC,CAAC;IACF,CAAC;IAED,OAAO;QACN,KAAK,CAAC,kBAAkB,CAAC,MAAiB;YACzC,MAAM,WAAW,EAAE,CAAC;YACpB,IAAI,CAAC;gBACJ,OAAO,MAAM,eAAe,CAAC,UAAyB,EAAE,MAAM,EAAE;oBAC/D,cAAc,EAAE,KAAK;iBACrB,CAAC,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,6DAA6D;gBAC7D,+CAA+C;gBAC/C,MAAM,QAAQ,GACb,KAAK,YAAY,iBAAiB;oBAClC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,IAAI,UAAU,CAAC;gBAC1C,IAAI,CAAC,QAAQ;oBAAE,MAAM,KAAK,CAAC;gBAC3B,MAAM,OAAO,EAAE,CAAC;gBAChB,OAAO,eAAe,CAAC,UAAyB,EAAE,MAAM,EAAE;oBACzD,cAAc,EAAE,KAAK;iBACrB,CAAC,CAAC;YACJ,CAAC;QACF,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/src/jwt/decrypt.js

@@ -86,6 +86,16 @@ export async function jwtDecrypt(token, profile) {
     if (rawHeader === "")
         throw new JWTInvalid("Token has an empty header segment");
     const header = validateJweHeader(parseJsonObject(decodeUTF8(decodeBase64url(rawHeader)), "header"), profile);
+    // Strict decoding is authoritative for every segment, not just the header:
+    // the AEAD ignores the unused trailing bits of a segment whose length is not
+    // a multiple of four, so a lenient parser accepts several distinct token
+    // strings that decrypt to the same plaintext. Rejecting non-canonical
+    // base64url keeps the token string a stable identity for revocation and
+    // replay caches. The encrypted key is empty under `dir`, which is canonical.
+    // https://github.com/Smiduweorc/lacewing/issues/12
+    for (const segment of segments.slice(1)) {
+        decodeBase64url(segment);
+    }
     if (profile.key.algorithm !== header.alg) {
         throw new AlgorithmNotAllowed("Token key-management algorithm does not match the profile's key");
     }

package/dist/src/jwt/decrypt.js.map

@@ -1 +1 @@
-{"version":3,"file":"decrypt.js","sourceRoot":"","sources":["../../../src/jwt/decrypt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,MAAM,CAAC;AACtC,OAAO,EACN,mBAAmB,EACnB,wBAAwB,EACxB,UAAU,EACV,UAAU,EACV,YAAY,EACZ,qBAAqB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EACN,8BAA8B,EAC9B,0BAA0B,GAC1B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EACN,MAAM,GAKN,MAAM,aAAa,CAAC;AAErB,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAE/B,6EAA6E;AAC7E,8EAA8E;AAC9E,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAU,CAAC;AAErF,SAAS,iBAAiB,CAAC,GAA4B,EAAE,OAAkC;IAC1F,KAAK,MAAM,KAAK,IAAI,gBAAgB,EAAE,CAAC;QACtC,IAAI,KAAK,IAAI,GAAG;YAAE,MAAM,IAAI,UAAU,CAAC,2BAA2B,KAAK,oBAAoB,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;IACpB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;QAC7D,MAAM,IAAI,mBAAmB,CAAC,mEAAmE,CAAC,CAAC;IACpG,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAE,OAAkB,KAAK,GAAG,CAAC,EAAE,CAAC;QACrF,MAAM,IAAI,mBAAmB,CAAC,mEAAmE,CAAC,CAAC;IACpG,CAAC;IACD,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,mBAAmB;IAEpD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;IACpB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;QAC7D,MAAM,IAAI,mBAAmB,CAAC,uEAAuE,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAE,OAAkB,KAAK,GAAG,CAAC,EAAE,CAAC;QACzF,MAAM,IAAI,mBAAmB,CAAC,uEAAuE,CAAC,CAAC;IACxG,CAAC;IACD,8BAA8B,CAAC,GAAG,CAAC,CAAC;IAEpC,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;IACpB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,UAAU,CAAC,8DAA8D,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,wBAAwB,CAAC,KAAK,EAAE,wCAAwC,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,MAAM,GAAc,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC;IACtE,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS;QAAE,MAAM,CAAC,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7D,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;YAAE,MAAM,IAAI,UAAU,CAAC,mCAAmC,CAAC,CAAC;QAC3F,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC/B,KAAa,EACb,OAAkC;IAElC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,UAAU,CAAC,kCAAkC,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QACrC,MAAM,IAAI,UAAU,CAAC,kCAAkC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,oEAAoE;QACpE,MAAM,IAAI,UAAU,CAAC,qDAAqD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAW,CAAC;IACxC,IAAI,SAAS,KAAK,EAAE;QAAE,MAAM,IAAI,UAAU,CAAC,mCAAmC,CAAC,CAAC;IAEhF,MAAM,MAAM,GAAG,iBAAiB,CAC/B,eAAe,CAAC,UAAU,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,EACjE,OAAO,CACP,CAAC;IAEF,IAAK,OAAO,CAAC,GAAG,CAAC,SAAoB,KAAM,MAAM,CAAC,GAAc,EAAE,CAAC;QAClE,MAAM,IAAI,mBAAmB,CAAC,iEAAiE,CAAC,CAAC;IAClG,CAAC;IAED,IAAI,SAAqB,CAAC;IAC1B,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,cAAc,CAClC,KAAK,EACL,OAAO,CAAC,GAAG,CAAC,GAA2C,EACvD;YACC,uBAAuB,EAAE,CAAC,MAAM,CAAC,GAAa,CAAC;YAC/C,2BAA2B,EAAE,CAAC,MAAM,CAAC,GAAa,CAAC;SACnD,CACD,CAAC;QACF,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,UAAU,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,OAAO,GAAG,eAAe,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;IAClE,MAAM,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAEvC,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACtC,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrC,MAAM,IAAI,YAAY,CAAC,KAAK,EAAE,kEAAkE,CAAC,CAAC;QACnG,CAAC;QACD,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACJ,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,OAAO,CAAC,+BAA+B,KAAK,IAAI,EAAE,CAAC;gBACtD,OAAO,GAAG,KAAK,CAAC;YACjB,CAAC;iBAAM,CAAC;gBACP,MAAM,IAAI,qBAAqB,CAAC,sDAAsD,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACpG,CAAC;QACF,CAAC;QACD,IAAI,OAAO;YAAE,MAAM,IAAI,UAAU,CAAC,wBAAwB,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAqB,EAAkB,CAAC;AACnE,CAAC"}
+{"version":3,"file":"decrypt.js","sourceRoot":"","sources":["../../../src/jwt/decrypt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,MAAM,CAAC;AACtC,OAAO,EACN,mBAAmB,EACnB,wBAAwB,EACxB,UAAU,EACV,UAAU,EACV,YAAY,EACZ,qBAAqB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EACN,8BAA8B,EAC9B,0BAA0B,GAC1B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EACN,MAAM,GAKN,MAAM,aAAa,CAAC;AAErB,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAE/B,6EAA6E;AAC7E,8EAA8E;AAC9E,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAU,CAAC;AAErF,SAAS,iBAAiB,CAAC,GAA4B,EAAE,OAAkC;IAC1F,KAAK,MAAM,KAAK,IAAI,gBAAgB,EAAE,CAAC;QACtC,IAAI,KAAK,IAAI,GAAG;YAAE,MAAM,IAAI,UAAU,CAAC,2BAA2B,KAAK,oBAAoB,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;IACpB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;QAC7D,MAAM,IAAI,mBAAmB,CAAC,mEAAmE,CAAC,CAAC;IACpG,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAE,OAAkB,KAAK,GAAG,CAAC,EAAE,CAAC;QACrF,MAAM,IAAI,mBAAmB,CAAC,mEAAmE,CAAC,CAAC;IACpG,CAAC;IACD,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,mBAAmB;IAEpD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;IACpB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;QAC7D,MAAM,IAAI,mBAAmB,CAAC,uEAAuE,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAE,OAAkB,KAAK,GAAG,CAAC,EAAE,CAAC;QACzF,MAAM,IAAI,mBAAmB,CAAC,uEAAuE,CAAC,CAAC;IACxG,CAAC;IACD,8BAA8B,CAAC,GAAG,CAAC,CAAC;IAEpC,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;IACpB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,UAAU,CAAC,8DAA8D,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,wBAAwB,CAAC,KAAK,EAAE,wCAAwC,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,MAAM,GAAc,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC;IACtE,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS;QAAE,MAAM,CAAC,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7D,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;YAAE,MAAM,IAAI,UAAU,CAAC,mCAAmC,CAAC,CAAC;QAC3F,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC/B,KAAa,EACb,OAAkC;IAElC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,UAAU,CAAC,kCAAkC,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QACrC,MAAM,IAAI,UAAU,CAAC,kCAAkC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,oEAAoE;QACpE,MAAM,IAAI,UAAU,CAAC,qDAAqD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAW,CAAC;IACxC,IAAI,SAAS,KAAK,EAAE;QAAE,MAAM,IAAI,UAAU,CAAC,mCAAmC,CAAC,CAAC;IAEhF,MAAM,MAAM,GAAG,iBAAiB,CAC/B,eAAe,CAAC,UAAU,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,EACjE,OAAO,CACP,CAAC;IAEF,2EAA2E;IAC3E,6EAA6E;IAC7E,yEAAyE;IACzE,sEAAsE;IACtE,wEAAwE;IACxE,6EAA6E;IAE7E,mDAAmD;IACnD,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,eAAe,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;IAED,IAAK,OAAO,CAAC,GAAG,CAAC,SAAoB,KAAM,MAAM,CAAC,GAAc,EAAE,CAAC;QAClE,MAAM,IAAI,mBAAmB,CAAC,iEAAiE,CAAC,CAAC;IAClG,CAAC;IAED,IAAI,SAAqB,CAAC;IAC1B,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,cAAc,CAClC,KAAK,EACL,OAAO,CAAC,GAAG,CAAC,GAA2C,EACvD;YACC,uBAAuB,EAAE,CAAC,MAAM,CAAC,GAAa,CAAC;YAC/C,2BAA2B,EAAE,CAAC,MAAM,CAAC,GAAa,CAAC;SACnD,CACD,CAAC;QACF,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,UAAU,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,OAAO,GAAG,eAAe,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;IAClE,MAAM,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAEvC,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACtC,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrC,MAAM,IAAI,YAAY,CAAC,KAAK,EAAE,kEAAkE,CAAC,CAAC;QACnG,CAAC;QACD,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACJ,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,OAAO,CAAC,+BAA+B,KAAK,IAAI,EAAE,CAAC;gBACtD,OAAO,GAAG,KAAK,CAAC;YACjB,CAAC;iBAAM,CAAC;gBACP,MAAM,IAAI,qBAAqB,CAAC,sDAAsD,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACpG,CAAC;QACF,CAAC;QACD,IAAI,OAAO;YAAE,MAAM,IAAI,UAAU,CAAC,wBAAwB,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAqB,EAAkB,CAAC;AACnE,CAAC"}

package/dist/src/jwt/decryption_profile.js

@@ -44,6 +44,10 @@ export function defineDecryptionProfile(options) {
     if (maxClockSkew > MAX_CLOCK_SKEW_SECONDS) {
         throw new TypeError(`Decryption profile maxClockSkew is capped at ${MAX_CLOCK_SKEW_SECONDS} seconds`);
     }
+    const maxTokenLifetime = options.maxTokenLifetime === undefined ? undefined : parseDuration(options.maxTokenLifetime);
+    if (maxTokenLifetime !== undefined && maxTokenLifetime < 1) {
+        throw new TypeError("Decryption profile maxTokenLifetime must be at least one second");
+    }
     if (options.revocation !== undefined && typeof options.revocation.isRevoked !== "function") {
         throw new TypeError("Decryption profile revocation store must implement isRevoked()");
     }
@@ -65,6 +69,8 @@ export function defineDecryptionProfile(options) {
         maxTokenAge: toSeconds(maxTokenAge),
         maxClockSkew: toSeconds(maxClockSkew),
     };
+    if (maxTokenLifetime !== undefined)
+        profile.maxTokenLifetime = toSeconds(maxTokenLifetime);
     if (options.revocation !== undefined)
         profile.revocation = options.revocation;
     if (options.claimValidators !== undefined)

package/dist/src/jwt/decryption_profile.js.map

@@ -1 +1 @@
-{"version":3,"file":"decryption_profile.js","sourceRoot":"","sources":["../../../src/jwt/decryption_profile.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EACN,2BAA2B,EAC3B,uBAAuB,GACvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACN,uBAAuB,EACvB,SAAS,GAKT,MAAM,aAAa,CAAC;AAErB,MAAM,0BAA0B,GAAG,CAAC,CAAC;AACrC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAyBnC,SAAS,qBAAqB,CAAC,KAAc,EAAE,KAAa;IAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,SAAS,CAAC,uBAAuB,KAAK,8BAA8B,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,uBAAuB,CAAC,OAAiC;IACxE,MAAM,GAAG,GAAG,qBAAqB,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,qBAAqB,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,qBAAqB,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAEhE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,uBAAuB,CAAC,IAAI,OAAO,CAAC,uBAAuB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrG,MAAM,IAAI,SAAS,CAAC,2EAA2E,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,2BAA2B,CAAC,IAAI,OAAO,CAAC,2BAA2B,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7G,MAAM,IAAI,SAAS,CAAC,+EAA+E,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,uBAAuB,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAC5G,MAAM,2BAA2B,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,2BAA2B,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC,CAAC;IAExH,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,SAAS,CAAC,iFAAiF,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,SAAS,CAAC,6DAA6D,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAE,OAAkB,KAAK,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/F,MAAM,IAAI,SAAS,CAAC,6EAA6E,CAAC,CAAC;IACpG,CAAC;IAED,MAAM,WAAW,GAAG,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACvD,IAAI,WAAW,GAAG,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,4DAA4D,CAAC,CAAC;IACvG,MAAM,YAAY,GAAG,aAAa,CAAC,OAAO,CAAC,YAAY,IAAI,0BAA0B,CAAC,CAAC;IACvF,IAAI,YAAY,GAAG,sBAAsB,EAAE,CAAC;QAC3C,MAAM,IAAI,SAAS,CAAC,gDAAgD,sBAAsB,UAAU,CAAC,CAAC;IACvG,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,UAAU,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QAC5F,MAAM,IAAI,SAAS,CAAC,gEAAgE,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YAC1E,IAAI,OAAO,SAAS,KAAK,UAAU;gBAAE,MAAM,IAAI,SAAS,CAAC,wBAAwB,KAAK,sBAAsB,CAAC,CAAC;QAC/G,CAAC;IACF,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;QAAE,qBAAqB,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAErF,MAAM,OAAO,GAA8B;QAC1C,GAAG;QACH,GAAG;QACH,GAAG;QACH,uBAAuB;QACvB,2BAA2B;QAC3B,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC;QACnC,YAAY,EAAE,SAAS,CAAC,YAAY,CAAC;KACrC,CAAC;IACF,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAC9E,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,CAAC,eAAe,GAAG,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IACpG,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IACrE,IAAI,OAAO,CAAC,+BAA+B,KAAK,IAAI;QAAE,OAAO,CAAC,+BAA+B,GAAG,IAAI,CAAC;IACrG,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC"}
+{"version":3,"file":"decryption_profile.js","sourceRoot":"","sources":["../../../src/jwt/decryption_profile.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EACN,2BAA2B,EAC3B,uBAAuB,GACvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACN,uBAAuB,EACvB,SAAS,GAKT,MAAM,aAAa,CAAC;AAErB,MAAM,0BAA0B,GAAG,CAAC,CAAC;AACrC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AA2BnC,SAAS,qBAAqB,CAAC,KAAc,EAAE,KAAa;IAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,SAAS,CAAC,uBAAuB,KAAK,8BAA8B,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,uBAAuB,CAAC,OAAiC;IACxE,MAAM,GAAG,GAAG,qBAAqB,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,qBAAqB,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,qBAAqB,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAEhE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,uBAAuB,CAAC,IAAI,OAAO,CAAC,uBAAuB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrG,MAAM,IAAI,SAAS,CAAC,2EAA2E,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,2BAA2B,CAAC,IAAI,OAAO,CAAC,2BAA2B,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7G,MAAM,IAAI,SAAS,CAAC,+EAA+E,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,uBAAuB,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAC5G,MAAM,2BAA2B,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,2BAA2B,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC,CAAC;IAExH,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,SAAS,CAAC,iFAAiF,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,SAAS,CAAC,6DAA6D,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAE,OAAkB,KAAK,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/F,MAAM,IAAI,SAAS,CAAC,6EAA6E,CAAC,CAAC;IACpG,CAAC;IAED,MAAM,WAAW,GAAG,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACvD,IAAI,WAAW,GAAG,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,4DAA4D,CAAC,CAAC;IACvG,MAAM,YAAY,GAAG,aAAa,CAAC,OAAO,CAAC,YAAY,IAAI,0BAA0B,CAAC,CAAC;IACvF,IAAI,YAAY,GAAG,sBAAsB,EAAE,CAAC;QAC3C,MAAM,IAAI,SAAS,CAAC,gDAAgD,sBAAsB,UAAU,CAAC,CAAC;IACvG,CAAC;IACD,MAAM,gBAAgB,GACrB,OAAO,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC9F,IAAI,gBAAgB,KAAK,SAAS,IAAI,gBAAgB,GAAG,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,SAAS,CAAC,iEAAiE,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,UAAU,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QAC5F,MAAM,IAAI,SAAS,CAAC,gEAAgE,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YAC1E,IAAI,OAAO,SAAS,KAAK,UAAU;gBAAE,MAAM,IAAI,SAAS,CAAC,wBAAwB,KAAK,sBAAsB,CAAC,CAAC;QAC/G,CAAC;IACF,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;QAAE,qBAAqB,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAErF,MAAM,OAAO,GAA8B;QAC1C,GAAG;QACH,GAAG;QACH,GAAG;QACH,uBAAuB;QACvB,2BAA2B;QAC3B,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC;QACnC,YAAY,EAAE,SAAS,CAAC,YAAY,CAAC;KACrC,CAAC;IACF,IAAI,gBAAgB,KAAK,SAAS;QAAE,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAC3F,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAC9E,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,CAAC,eAAe,GAAG,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IACpG,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IACrE,IAAI,OAAO,CAAC,+BAA+B,KAAK,IAAI;QAAE,OAAO,CAAC,+BAA+B,GAAG,IAAI,CAAC;IACrG,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC"}

package/dist/src/jwt/profile.js

@@ -43,6 +43,7 @@ function normalizeKeys(keys, algorithms) {
                 cacheTtlSeconds: remote.cacheTtlSeconds,
                 cooldownSeconds: remote.cooldownSeconds,
                 timeoutMs: remote.timeoutMs,
+                staleWhileErrorSeconds: remote.staleWhileErrorSeconds,
             });
         }
     }
@@ -65,6 +66,10 @@ export function defineProfile(options) {
     if (maxClockSkew > MAX_CLOCK_SKEW_SECONDS) {
         throw new TypeError(`Profile maxClockSkew is capped at ${MAX_CLOCK_SKEW_SECONDS} seconds`);
     }
+    const maxTokenLifetime = options.maxTokenLifetime === undefined ? undefined : parseDuration(options.maxTokenLifetime);
+    if (maxTokenLifetime !== undefined && maxTokenLifetime < 1) {
+        throw new TypeError("Profile maxTokenLifetime must be at least one second");
+    }
     if (options.revocation !== undefined && typeof options.revocation.isRevoked !== "function") {
         throw new TypeError("Profile revocation store must implement isRevoked()");
     }
@@ -87,6 +92,8 @@ export function defineProfile(options) {
         maxTokenAge: toSeconds(maxTokenAge),
         maxClockSkew: toSeconds(maxClockSkew),
     };
+    if (maxTokenLifetime !== undefined)
+        profile.maxTokenLifetime = toSeconds(maxTokenLifetime);
     if (options.revocation !== undefined)
         profile.revocation = options.revocation;
     if (options.claimValidators !== undefined) {

package/dist/src/jwt/profile.js.map

@@ -1 +1 @@
-{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../../src/jwt/profile.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EACN,aAAa,EACb,SAAS,GAQT,MAAM,aAAa,CAAC;AAErB,MAAM,0BAA0B,GAAG,CAAC,CAAC;AACrC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AA2BnC,SAAS,qBAAqB,CAAC,KAAc,EAAE,KAAa;IAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,SAAS,CAAC,YAAY,KAAK,8BAA8B,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CACrB,IAA4B,EAC5B,UAA6B;IAE7B,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,SAAS,CAClB,mEAAmE,CACnE,CAAC;QACH,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,SAAS,CAClB,+DAA+D,CAC/D,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAC/C,IAAI,OAAQ,IAAkB,CAAC,kBAAkB,KAAK,UAAU,EAAE,CAAC;YAClE,OAAO,IAAiB,CAAC;QAC1B,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAE,IAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9C,OAAO,iBAAiB,CAAC,IAAkB,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,OAAQ,IAAmB,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,MAAM,GAAG,IAAkB,CAAC;YAClC,OAAO,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE;gBACzC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,SAAS,EAAE,MAAM,CAAC,SAAS;aAC3B,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IACD,MAAM,IAAI,SAAS,CAClB,6FAA6F,CAC7F,CAAC;AACH,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,aAAa,CAAC,OAAuB;IACpD,MAAM,GAAG,GAAG,qBAAqB,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,qBAAqB,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,qBAAqB,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAEhE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAE9E,MAAM,WAAW,GAAG,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACvD,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,SAAS,CAAC,iDAAiD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,YAAY,GAAG,aAAa,CAAC,OAAO,CAAC,YAAY,IAAI,0BAA0B,CAAC,CAAC;IACvF,IAAI,YAAY,GAAG,sBAAsB,EAAE,CAAC;QAC3C,MAAM,IAAI,SAAS,CAAC,qCAAqC,sBAAsB,UAAU,CAAC,CAAC;IAC5F,CAAC;IAED,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,UAAU,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QAC5F,MAAM,IAAI,SAAS,CAAC,qDAAqD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YAC1E,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;gBACrC,MAAM,IAAI,SAAS,CAAC,wBAAwB,KAAK,sBAAsB,CAAC,CAAC;YAC1E,CAAC;QACF,CAAC;IACF,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACnC,qBAAqB,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,OAAO,GAAuB;QACnC,GAAG;QACH,GAAG;QACH,GAAG;QACH,GAAG;QACH,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC;QACrD,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC;QACnC,YAAY,EAAE,SAAS,CAAC,YAAY,CAAC;KACrC,CAAC;IACF,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAC9E,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC3C,OAAO,CAAC,eAAe,GAAG,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAC1D,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IACrE,IAAI,OAAO,CAAC,+BAA+B,KAAK,IAAI,EAAE,CAAC;QACtD,OAAO,CAAC,+BAA+B,GAAG,IAAI,CAAC;IAChD,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC"}
+{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../../src/jwt/profile.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EACN,aAAa,EACb,SAAS,GAQT,MAAM,aAAa,CAAC;AAErB,MAAM,0BAA0B,GAAG,CAAC,CAAC;AACrC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAiCnC,SAAS,qBAAqB,CAAC,KAAc,EAAE,KAAa;IAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,SAAS,CAAC,YAAY,KAAK,8BAA8B,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CACrB,IAA4B,EAC5B,UAA6B;IAE7B,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,SAAS,CAClB,mEAAmE,CACnE,CAAC;QACH,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,SAAS,CAClB,+DAA+D,CAC/D,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAC/C,IAAI,OAAQ,IAAkB,CAAC,kBAAkB,KAAK,UAAU,EAAE,CAAC;YAClE,OAAO,IAAiB,CAAC;QAC1B,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAE,IAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9C,OAAO,iBAAiB,CAAC,IAAkB,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,OAAQ,IAAmB,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,MAAM,GAAG,IAAkB,CAAC;YAClC,OAAO,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE;gBACzC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,sBAAsB,EAAE,MAAM,CAAC,sBAAsB;aACrD,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IACD,MAAM,IAAI,SAAS,CAClB,6FAA6F,CAC7F,CAAC;AACH,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,aAAa,CAAC,OAAuB;IACpD,MAAM,GAAG,GAAG,qBAAqB,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,qBAAqB,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,qBAAqB,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAEhE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAE9E,MAAM,WAAW,GAAG,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACvD,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,SAAS,CAAC,iDAAiD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,YAAY,GAAG,aAAa,CAAC,OAAO,CAAC,YAAY,IAAI,0BAA0B,CAAC,CAAC;IACvF,IAAI,YAAY,GAAG,sBAAsB,EAAE,CAAC;QAC3C,MAAM,IAAI,SAAS,CAAC,qCAAqC,sBAAsB,UAAU,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,gBAAgB,GACrB,OAAO,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC9F,IAAI,gBAAgB,KAAK,SAAS,IAAI,gBAAgB,GAAG,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,SAAS,CAAC,sDAAsD,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,UAAU,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QAC5F,MAAM,IAAI,SAAS,CAAC,qDAAqD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YAC1E,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;gBACrC,MAAM,IAAI,SAAS,CAAC,wBAAwB,KAAK,sBAAsB,CAAC,CAAC;YAC1E,CAAC;QACF,CAAC;IACF,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACnC,qBAAqB,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,OAAO,GAAuB;QACnC,GAAG;QACH,GAAG;QACH,GAAG;QACH,GAAG;QACH,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC;QACrD,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC;QACnC,YAAY,EAAE,SAAS,CAAC,YAAY,CAAC;KACrC,CAAC;IACF,IAAI,gBAAgB,KAAK,SAAS;QAAE,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAC3F,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAC9E,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC3C,OAAO,CAAC,eAAe,GAAG,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAC1D,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IACrE,IAAI,OAAO,CAAC,+BAA+B,KAAK,IAAI,EAAE,CAAC;QACtD,OAAO,CAAC,+BAA+B,GAAG,IAAI,CAAC;IAChD,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC"}

package/dist/src/lib/claims.js

@@ -67,11 +67,21 @@ export async function validateClaims(payload, profile, nowSeconds = Math.floor(D
     if (iat > nowSeconds + skew) {
         throw new JWTClaimValidationFailed("iat", "Token issued-at time is in the future");
     }
-    // maxTokenAge - enforced independently of exp (LW-life.2), so a
-    // compromised signer can't mint decade-long tokens we accept.
+    // maxTokenAge - enforced independently of exp (LW-life.2). This bounds how
+    // long after issuance a token stays usable *here*, whatever `exp` claims:
+    // a token minted with a decade-long exp is still refused once it is older
+    // than maxTokenAge. It does not reject such a token on sight - see
+    // maxTokenLifetime for that.
     if (nowSeconds - iat > profile.maxTokenAge + skew) {
         throw new JWTExpired("Token exceeds the profile's maximum age");
     }
+    // maxTokenLifetime - optional, and about the token's *declared* span
+    // (exp - iat) rather than its current age. An absurd declared lifetime is
+    // a misissuance signal worth refusing outright rather than silently
+    // tolerating for the length of the age window.
+    if (profile.maxTokenLifetime !== undefined && exp - iat > profile.maxTokenLifetime) {
+        throw new JWTClaimValidationFailed("exp", "Token's declared lifetime (exp - iat) exceeds the profile's maximum");
+    }
     // nbf - optional, but honored when present.
     if (payload.nbf !== undefined) {
         const nbf = requireNumber(payload, "nbf");

package/dist/src/lib/claims.js.map

@@ -1 +1 @@
-{"version":3,"file":"claims.js","sourceRoot":"","sources":["../../../src/lib/claims.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACN,wBAAwB,EACxB,UAAU,EACV,YAAY,GACZ,MAAM,mBAAmB,CAAC;AAG3B,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAErC,SAAS,aAAa,CAAC,OAAgC,EAAE,KAAa;IACrE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,wBAAwB,CAAC,KAAK,EAAE,UAAU,KAAK,8BAA8B,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QAC5C,MAAM,IAAI,wBAAwB,CAAC,KAAK,EAAE,UAAU,KAAK,0BAA0B,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,OAAgC,EAAE,KAAa;IACrE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,wBAAwB,CAAC,KAAK,EAAE,UAAU,KAAK,2BAA2B,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,GAAY,EAAE,QAAgB;IACtD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,GAAG,KAAK,QAAQ,CAAC;IACzB,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,QAAQ,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAID;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,OAAgC,EAChC,OAAqB,EACrB,aAAqB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAElD,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC;IAElC,sDAAsD;IACtD,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1C,IAAI,GAAG,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,wBAAwB,CAAC,KAAK,EAAE,6CAA6C,CAAC,CAAC;IAC1F,CAAC;IAED,uDAAuD;IACvD,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,wBAAwB,CAAC,KAAK,EAAE,yDAAyD,CAAC,CAAC;IACtG,CAAC;IAED,2CAA2C;IAC3C,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1C,IAAI,UAAU,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,UAAU,CAAC,mBAAmB,CAAC,CAAC;IAC3C,CAAC;IAED,4CAA4C;IAC5C,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1C,IAAI,GAAG,GAAG,UAAU,GAAG,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,wBAAwB,CAAC,KAAK,EAAE,uCAAuC,CAAC,CAAC;IACpF,CAAC;IAED,gEAAgE;IAChE,8DAA8D;IAC9D,IAAI,UAAU,GAAG,GAAG,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,EAAE,CAAC;QACnD,MAAM,IAAI,UAAU,CAAC,yCAAyC,CAAC,CAAC;IACjE,CAAC;IAED,4CAA4C;IAC5C,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC1C,IAAI,GAAG,GAAG,UAAU,GAAG,IAAI,EAAE,CAAC;YAC7B,MAAM,IAAI,wBAAwB,CAAC,KAAK,EAAE,wBAAwB,CAAC,CAAC;QACrE,CAAC;IACF,CAAC;IAED,yDAAyD;IACzD,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC/B,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,sDAAsD;IACtD,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC/B,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC1C,IAAI,GAAG,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;YAC7B,MAAM,IAAI,wBAAwB,CAAC,KAAK,EAAE,2CAA2C,CAAC,CAAC;QACxF,CAAC;IACF,CAAC;IAED,iEAAiE;IACjE,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YACzE,IAAI,CAAC;gBACJ,MAAM,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,KAAK,YAAY,wBAAwB,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;oBAChF,MAAM,KAAK,CAAC;gBACb,CAAC;gBACD,MAAM,IAAI,wBAAwB,CACjC,KAAK,EACL,gCAAgC,KAAK,UAAU,EAC/C,EAAE,KAAK,EAAE,CACT,CAAC;YACH,CAAC;QACF,CAAC;IACF,CAAC;AACF,CAAC"}
+{"version":3,"file":"claims.js","sourceRoot":"","sources":["../../../src/lib/claims.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACN,wBAAwB,EACxB,UAAU,EACV,YAAY,GACZ,MAAM,mBAAmB,CAAC;AAG3B,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAErC,SAAS,aAAa,CAAC,OAAgC,EAAE,KAAa;IACrE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,wBAAwB,CAAC,KAAK,EAAE,UAAU,KAAK,8BAA8B,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QAC5C,MAAM,IAAI,wBAAwB,CAAC,KAAK,EAAE,UAAU,KAAK,0BAA0B,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,OAAgC,EAAE,KAAa;IACrE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,wBAAwB,CAAC,KAAK,EAAE,UAAU,KAAK,2BAA2B,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,GAAY,EAAE,QAAgB;IACtD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,GAAG,KAAK,QAAQ,CAAC;IACzB,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,QAAQ,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAID;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,OAAgC,EAChC,OAAqB,EACrB,aAAqB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAElD,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC;IAElC,sDAAsD;IACtD,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1C,IAAI,GAAG,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,wBAAwB,CAAC,KAAK,EAAE,6CAA6C,CAAC,CAAC;IAC1F,CAAC;IAED,uDAAuD;IACvD,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,wBAAwB,CAAC,KAAK,EAAE,yDAAyD,CAAC,CAAC;IACtG,CAAC;IAED,2CAA2C;IAC3C,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1C,IAAI,UAAU,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,UAAU,CAAC,mBAAmB,CAAC,CAAC;IAC3C,CAAC;IAED,4CAA4C;IAC5C,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1C,IAAI,GAAG,GAAG,UAAU,GAAG,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,wBAAwB,CAAC,KAAK,EAAE,uCAAuC,CAAC,CAAC;IACpF,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,0EAA0E;IAC1E,mEAAmE;IACnE,6BAA6B;IAC7B,IAAI,UAAU,GAAG,GAAG,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,EAAE,CAAC;QACnD,MAAM,IAAI,UAAU,CAAC,yCAAyC,CAAC,CAAC;IACjE,CAAC;IAED,qEAAqE;IACrE,0EAA0E;IAC1E,oEAAoE;IACpE,+CAA+C;IAC/C,IAAI,OAAO,CAAC,gBAAgB,KAAK,SAAS,IAAI,GAAG,GAAG,GAAG,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;QACpF,MAAM,IAAI,wBAAwB,CACjC,KAAK,EACL,qEAAqE,CACrE,CAAC;IACH,CAAC;IAED,4CAA4C;IAC5C,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC1C,IAAI,GAAG,GAAG,UAAU,GAAG,IAAI,EAAE,CAAC;YAC7B,MAAM,IAAI,wBAAwB,CAAC,KAAK,EAAE,wBAAwB,CAAC,CAAC;QACrE,CAAC;IACF,CAAC;IAED,yDAAyD;IACzD,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC/B,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,sDAAsD;IACtD,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC/B,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC1C,IAAI,GAAG,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;YAC7B,MAAM,IAAI,wBAAwB,CAAC,KAAK,EAAE,2CAA2C,CAAC,CAAC;QACxF,CAAC;IACF,CAAC;IAED,iEAAiE;IACjE,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YACzE,IAAI,CAAC;gBACJ,MAAM,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,KAAK,YAAY,wBAAwB,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;oBAChF,MAAM,KAAK,CAAC;gBACb,CAAC;gBACD,MAAM,IAAI,wBAAwB,CACjC,KAAK,EACL,gCAAgC,KAAK,UAAU,EAC/C,EAAE,KAAK,EAAE,CACT,CAAC;YACH,CAAC;QACF,CAAC;IACF,CAAC;AACF,CAAC"}

package/dist/src/lib/entropy.js

@@ -42,7 +42,13 @@ export function isPasswordLike(bytes) {
     if (!printableAscii) {
         return false;
     }
-    const text = String.fromCharCode(...bytes).toLowerCase();
+    // Chunked rather than spread: `k` can arrive from a JWKS document, and
+    // String.fromCharCode(...megabyte) overflows the call stack.
+    let text = "";
+    for (let i = 0; i < bytes.length; i += 4096) {
+        text += String.fromCharCode(...bytes.subarray(i, i + 4096));
+    }
+    text = text.toLowerCase();
     if (COMMON_WORDS.some((word) => text.includes(word))) {
         return true;
     }

package/dist/src/lib/entropy.js.map

@@ -1 +1 @@
-{"version":3,"file":"entropy.js","sourceRoot":"","sources":["../../../src/lib/entropy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,6DAA6D;AAC7D,MAAM,YAAY,GAAG;IACpB,UAAU;IACV,UAAU;IACV,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,SAAS;CACT,CAAC;AAEF,SAAS,kBAAkB,CAAC,KAAiB;IAC5C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC;QAC/B,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAiB;IAC/C,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;IAClE,IAAI,CAAC,cAAc,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IACzD,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC;IACb,CAAC;IACD,oEAAoE;IACpE,oEAAoE;IACpE,OAAO,kBAAkB,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAkB,EAAE,aAAqB;IAC3E,MAAM,EAAE,UAAU,EAAE,GAAG,sBAAsB,CAAC,aAAa,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,kBAAkB,CAC3B,mBAAmB,aAAa,qBAAqB,QAAQ,SAAS;YACrE,kCAAkC,CACnC,CAAC;IACH,CAAC;IACD,IAAI,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,kBAAkB,CAC3B,sDAAsD;YACrD,wDAAwD,CACzD,CAAC;IACH,CAAC;AACF,CAAC"}
+{"version":3,"file":"entropy.js","sourceRoot":"","sources":["../../../src/lib/entropy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,6DAA6D;AAC7D,MAAM,YAAY,GAAG;IACpB,UAAU;IACV,UAAU;IACV,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,SAAS;CACT,CAAC;AAEF,SAAS,kBAAkB,CAAC,KAAiB;IAC5C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC;QAC/B,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAiB;IAC/C,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;IAClE,IAAI,CAAC,cAAc,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACd,CAAC;IACD,uEAAuE;IACvE,6DAA6D;IAC7D,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;QAC7C,IAAI,IAAI,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC1B,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC;IACb,CAAC;IACD,oEAAoE;IACpE,oEAAoE;IACpE,OAAO,kBAAkB,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAkB,EAAE,aAAqB;IAC3E,MAAM,EAAE,UAAU,EAAE,GAAG,sBAAsB,CAAC,aAAa,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,kBAAkB,CAC3B,mBAAmB,aAAa,qBAAqB,QAAQ,SAAS;YACrE,kCAAkC,CACnC,CAAC;IACH,CAAC;IACD,IAAI,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,kBAAkB,CAC3B,sDAAsD;YACrD,wDAAwD,CACzD,CAAC;IACH,CAAC;AACF,CAAC"}

package/dist/src/lib/payload_hygiene.js

@@ -30,19 +30,45 @@ const SENSITIVE_NAME_FRAGMENTS = [
     "bearer",
 ];
 const PEM_PRIVATE_KEY = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----/;
-const JWT_LIKE = /^[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}$/;
+// A compact JWS/JWE always begins with a base64url-encoded JSON object, and
+// `{"` encodes to `eyJ`. Anchoring on that keeps ordinary dotted identifiers
+// (bare hostnames, reverse-DNS names) from reading as embedded tokens. The
+// last segment may be empty - that is exactly an `alg: none` token.
+const JWT_LIKE = /^eyJ[A-Za-z0-9_-]{7,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]*$/;
+/**
+ * Standard OAuth/OIDC claim names that describe *this* token rather than
+ * carrying one. Without them, `token_use` (AWS Cognito) and `token_type`
+ * trip the `token` fragment and force an `unsafeAllowClaim` waiver onto a
+ * perfectly correct payload - which is exactly how a grep-loud marker stops
+ * being worth grepping for.
+ */
+const BENIGN_NAMES = new Set(["tokenuse", "tokentype"]);
+/**
+ * Issuer Identification Numbers, as `[prefix regex, valid lengths]`. Luhn
+ * alone is a 1-in-10 coin flip on any digit string, which rejects roughly a
+ * tenth of all snowflake-style numeric user ids; requiring a real card prefix
+ * *and* that brand's length makes the check mean something.
+ */
+const CARD_BRANDS = [
+    [/^4/, [13, 16, 19]], // Visa
+    [/^(5[1-5]|2(2[2-9]|[3-6]\d|7[01]|720))/, [16]], // Mastercard
+    [/^3[47]/, [15]], // American Express
+    [/^(6011|65|64[4-9])/, [16, 19]], // Discover
+    [/^3(0[0-5]|095|6|[89])/, [14, 16, 19]], // Diners Club
+    [/^35(2[89]|[3-8]\d)/, [16, 17, 18, 19]], // JCB
+    [/^62/, [16, 17, 18, 19]], // UnionPay
+];
 function normalizeName(name) {
     return name.toLowerCase().replace(/[^a-z0-9]/g, "");
 }
 function sensitiveNameFragment(name) {
     const normalized = normalizeName(name);
+    if (BENIGN_NAMES.has(normalized)) {
+        return undefined;
+    }
     return SENSITIVE_NAME_FRAGMENTS.find((fragment) => normalized.includes(fragment));
 }
-function isLuhnValidCardNumber(value) {
-    const digits = value.replace(/[\s-]/g, "");
-    if (!/^\d{13,19}$/.test(digits)) {
-        return false;
-    }
+function passesLuhn(digits) {
     let sum = 0;
     let double = false;
     for (let i = digits.length - 1; i >= 0; i--) {
@@ -57,6 +83,14 @@ function isLuhnValidCardNumber(value) {
     }
     return sum % 10 === 0;
 }
+function isLuhnValidCardNumber(value) {
+    const digits = value.replace(/[\s-]/g, "");
+    if (!/^\d{13,19}$/.test(digits)) {
+        return false;
+    }
+    const brandMatches = CARD_BRANDS.some(([prefix, lengths]) => prefix.test(digits) && lengths.includes(digits.length));
+    return brandMatches && passesLuhn(digits);
+}
 function checkValue(topLevelClaim, value) {
     if (PEM_PRIVATE_KEY.test(value)) {
         throw new PayloadHygieneViolation(topLevelClaim, `Claim "${topLevelClaim}" contains a PEM private-key block. ` +

package/dist/src/lib/payload_hygiene.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload_hygiene.js","sourceRoot":"","sources":["../../../src/lib/payload_hygiene.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,MAAM,wBAAwB,GAAG;IAChC,UAAU;IACV,QAAQ;IACR,YAAY;IACZ,QAAQ;IACR,QAAQ;IACR,YAAY;IACZ,KAAK;IACL,gBAAgB;IAChB,YAAY;IACZ,YAAY;IACZ,KAAK;IACL,KAAK;IACL,OAAO;IACP,eAAe;IACf,QAAQ;CACC,CAAC;AAEX,MAAM,eAAe,GAAG,uCAAuC,CAAC;AAChE,MAAM,QAAQ,GAAG,8DAA8D,CAAC;AAEhF,SAAS,aAAa,CAAC,IAAY;IAClC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY;IAC1C,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACvC,OAAO,wBAAwB,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC3C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,IAAI,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACtC,IAAI,MAAM,EAAE,CAAC;YACZ,KAAK,IAAI,CAAC,CAAC;YACX,IAAI,KAAK,GAAG,CAAC;gBAAE,KAAK,IAAI,CAAC,CAAC;QAC3B,CAAC;QACD,GAAG,IAAI,KAAK,CAAC;QACb,MAAM,GAAG,CAAC,MAAM,CAAC;IAClB,CAAC;IACD,OAAO,GAAG,GAAG,EAAE,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,UAAU,CAAC,aAAqB,EAAE,KAAa;IACvD,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,uBAAuB,CAChC,aAAa,EACb,UAAU,aAAa,sCAAsC;YAC5D,iEAAiE,CAClE,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,uBAAuB,CAChC,aAAa,EACb,UAAU,aAAa,0CAA0C;YAChE,kFAAkF,CACnF,CAAC;IACH,CAAC;IACD,IAAI,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,uBAAuB,CAChC,aAAa,EACb,UAAU,aAAa,oDAAoD;YAC1E,oEAAoE,CACrE,CAAC;IACH,CAAC;AACF,CAAC;AAED,SAAS,QAAQ,CAAC,aAAqB,EAAE,KAAc;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,UAAU,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QACjC,OAAO;IACR,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;YAC3B,QAAQ,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QAChC,CAAC;QACD,OAAO;IACR,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACjD,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,IAAI,uBAAuB,CAChC,aAAa,EACb,UAAU,aAAa,iDAAiD,QAAQ,KAAK;oBACpF,sEAAsE;oBACtE,gEAAgE,CACjE,CAAC;YACH,CAAC;YACD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACjC,CAAC;IACF,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAC1C,OAAgC,EAChC,gBAAqC,IAAI,GAAG,EAAE;IAE9C,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtD,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,SAAS;QACV,CAAC;QACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,uBAAuB,CAChC,KAAK,EACL,eAAe,KAAK,4CAA4C,QAAQ,MAAM;gBAC7E,sEAAsE;gBACtE,gEAAgE,CACjE,CAAC;QACH,CAAC;QACD,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACxB,CAAC;AACF,CAAC"}
+{"version":3,"file":"payload_hygiene.js","sourceRoot":"","sources":["../../../src/lib/payload_hygiene.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,MAAM,wBAAwB,GAAG;IAChC,UAAU;IACV,QAAQ;IACR,YAAY;IACZ,QAAQ;IACR,QAAQ;IACR,YAAY;IACZ,KAAK;IACL,gBAAgB;IAChB,YAAY;IACZ,YAAY;IACZ,KAAK;IACL,KAAK;IACL,OAAO;IACP,eAAe;IACf,QAAQ;CACC,CAAC;AAEX,MAAM,eAAe,GAAG,uCAAuC,CAAC;AAEhE,4EAA4E;AAC5E,6EAA6E;AAC7E,2EAA2E;AAC3E,oEAAoE;AACpE,MAAM,QAAQ,GAAG,4DAA4D,CAAC;AAE9E;;;;;;GAMG;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;AAExD;;;;;GAKG;AACH,MAAM,WAAW,GAAwD;IACxE,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO;IAC7B,CAAC,uCAAuC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,aAAa;IAC9D,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,mBAAmB;IACrC,CAAC,oBAAoB,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW;IAC7C,CAAC,uBAAuB,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,cAAc;IACvD,CAAC,oBAAoB,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM;IAChD,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW;CACtC,CAAC;AAEF,SAAS,aAAa,CAAC,IAAY;IAClC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY;IAC1C,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QAClC,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,wBAAwB,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IACjC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,IAAI,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACtC,IAAI,MAAM,EAAE,CAAC;YACZ,KAAK,IAAI,CAAC,CAAC;YACX,IAAI,KAAK,GAAG,CAAC;gBAAE,KAAK,IAAI,CAAC,CAAC;QAC3B,CAAC;QACD,GAAG,IAAI,KAAK,CAAC;QACb,MAAM,GAAG,CAAC,MAAM,CAAC;IAClB,CAAC;IACD,OAAO,GAAG,GAAG,EAAE,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC3C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,YAAY,GAAG,WAAW,CAAC,IAAI,CACpC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAC7E,CAAC;IACF,OAAO,YAAY,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,UAAU,CAAC,aAAqB,EAAE,KAAa;IACvD,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,uBAAuB,CAChC,aAAa,EACb,UAAU,aAAa,sCAAsC;YAC5D,iEAAiE,CAClE,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,uBAAuB,CAChC,aAAa,EACb,UAAU,aAAa,0CAA0C;YAChE,kFAAkF,CACnF,CAAC;IACH,CAAC;IACD,IAAI,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,uBAAuB,CAChC,aAAa,EACb,UAAU,aAAa,oDAAoD;YAC1E,oEAAoE,CACrE,CAAC;IACH,CAAC;AACF,CAAC;AAED,SAAS,QAAQ,CAAC,aAAqB,EAAE,KAAc;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,UAAU,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QACjC,OAAO;IACR,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;YAC3B,QAAQ,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QAChC,CAAC;QACD,OAAO;IACR,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACjD,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,IAAI,uBAAuB,CAChC,aAAa,EACb,UAAU,aAAa,iDAAiD,QAAQ,KAAK;oBACpF,sEAAsE;oBACtE,gEAAgE,CACjE,CAAC;YACH,CAAC;YACD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACjC,CAAC;IACF,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAC1C,OAAgC,EAChC,gBAAqC,IAAI,GAAG,EAAE;IAE9C,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtD,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,SAAS;QACV,CAAC;QACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,uBAAuB,CAChC,KAAK,EACL,eAAe,KAAK,4CAA4C,QAAQ,MAAM;gBAC7E,sEAAsE;gBACtE,gEAAgE,CACjE,CAAC;QACH,CAAC;QACD,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACxB,CAAC;AACF,CAAC"}

package/dist/src/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAUH;;;;GAIG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,KAAa,EAAY,EAAE;IACjD,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,KAAiB,CAAC;AAC1B,CAAC,CAAC;AAQF,MAAM,UAAU,SAAS,CAAC,KAAa;IACtC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,SAAS,CAAC,2DAA2D,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,KAAwB,CAAC;AACjC,CAAC;AAiDD,0EAA0E;AAC1E,MAAM,UAAU,iBAAiB,CAChC,SAAyB,EACzB,OAAwC,EACxC,GAAY;IAEZ,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,OAAO,EAAE,aAAa;QACtB,SAAS;QACT,OAAO;QACP,GAAG;KACH,CAAqB,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAc;IAC3C,OAAO,CACN,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACb,KAA+B,CAAC,OAAO,KAAK,aAAa,CAC1D,CAAC;AACH,CAAC;AAqFD,sFAAsF;AACtF,MAAM,UAAU,2BAA2B,CAC1C,SAAyB,EACzB,OAAwC,EACxC,GAAY;IAEZ,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,OAAO,EAAE,uBAAuB;QAChC,SAAS;QACT,OAAO;QACP,GAAG;KACH,CAA+B,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACrD,OAAO,CACN,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACb,KAA+B,CAAC,OAAO,KAAK,uBAAuB,CACpE,CAAC;AACH,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAUH;;;;GAIG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,KAAa,EAAY,EAAE;IACjD,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,KAAiB,CAAC;AAC1B,CAAC,CAAC;AAQF,MAAM,UAAU,SAAS,CAAC,KAAa;IACtC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,SAAS,CAAC,2DAA2D,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,KAAwB,CAAC;AACjC,CAAC;AAiDD,0EAA0E;AAC1E,MAAM,UAAU,iBAAiB,CAChC,SAAyB,EACzB,OAAwC,EACxC,GAAY;IAEZ,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,OAAO,EAAE,aAAa;QACtB,SAAS;QACT,OAAO;QACP,GAAG;KACH,CAAqB,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAc;IAC3C,OAAO,CACN,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACb,KAA+B,CAAC,OAAO,KAAK,aAAa,CAC1D,CAAC;AACH,CAAC;AAyFD,sFAAsF;AACtF,MAAM,UAAU,2BAA2B,CAC1C,SAAyB,EACzB,OAAwC,EACxC,GAAY;IAEZ,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,OAAO,EAAE,uBAAuB;QAChC,SAAS;QACT,OAAO;QACP,GAAG;KACH,CAA+B,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACrD,OAAO,CACN,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACb,KAA+B,CAAC,OAAO,KAAK,uBAAuB,CACpE,CAAC;AACH,CAAC"}

package/dist/types/index.d.ts

@@ -23,6 +23,7 @@ export { buildRevocationContext } from "./src/revocation/store.js";
 export { MemoryRevocationStore } from "./src/revocation/memory.js";
 export { buildTokenCookie, setTokenCookie, clearTokenCookie, readTokenCookie, type TokenCookieOptions, } from "./src/http/cookies.js";
 export { parseBearer } from "./src/http/bearer.js";
+export { type HeaderSource } from "./src/http/source.js";
 export { unsafeDecode } from "./src/util/unsafe-decode.js";
 export { JWTError, JWTInvalid, JWTExpired, JWTClaimValidationFailed, MissingClaim, AlgorithmNotAllowed, KeyImportFailed, KeyExportFailed, KeyTypeMismatch, EntropyCheckFailed, JWKSFetchFailed, JWKSNoMatchingKey, JWTRevoked, RevocationCheckFailed, PayloadHygieneViolation, MaxLifetimeExceeded, BearerParseFailed, } from "./src/util/errors.js";
 export { toSeconds, type ClaimsPolicy, type DecryptedJwt, type DurationSeconds, type ExpectedDecryptionProfile, type ExpectedJwtProfile, type JweHeader, type JwtHeader, type LacewingEncryptionKey, type JwtPayLoad, type JWKSConfig, type KeySource, type LacewingKey, type RemoteJWKS, type ResolvedVerificationKey, type RevocationStore, type StaticJWK, type StaticJWKS, type TokenRevocationContext, type UntrustedJwt, type ValidAlg, type ValidateClaim, type VerifiedJwt, } from "./src/types.js";

package/dist/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,aAAa,EAAE,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGhD,OAAO,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGjE,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EACN,uBAAuB,EACvB,KAAK,wBAAwB,GAC7B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACN,yBAAyB,EACzB,wBAAwB,EACxB,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,qBAAqB,EAC1B,KAAK,gCAAgC,GACrC,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACN,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,KAAK,mBAAmB,GACxB,MAAM,kCAAkC,CAAC;AAG1C,OAAO,EAAE,SAAS,EAAE,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EACN,eAAe,EACf,cAAc,EACd,KAAK,sBAAsB,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,KAAK,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAGpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAGnE,OAAO,EACN,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,KAAK,kBAAkB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAGnD,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAG3D,OAAO,EACN,QAAQ,EACR,UAAU,EACV,UAAU,EACV,wBAAwB,EACxB,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,UAAU,EACV,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,EACnB,iBAAiB,GACjB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACN,SAAS,EACT,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EACvB,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,qBAAqB,EAC1B,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,uBAAuB,EAC5B,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,sBAAsB,EAC3B,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,aAAa,EAClB,KAAK,WAAW,GAChB,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,aAAa,EAAE,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGhD,OAAO,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGjE,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EACN,uBAAuB,EACvB,KAAK,wBAAwB,GAC7B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACN,yBAAyB,EACzB,wBAAwB,EACxB,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,qBAAqB,EAC1B,KAAK,gCAAgC,GACrC,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACN,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,KAAK,mBAAmB,GACxB,MAAM,kCAAkC,CAAC;AAG1C,OAAO,EAAE,SAAS,EAAE,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EACN,eAAe,EACf,cAAc,EACd,KAAK,sBAAsB,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,KAAK,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAGpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAGnE,OAAO,EACN,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,KAAK,kBAAkB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGzD,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAG3D,OAAO,EACN,QAAQ,EACR,UAAU,EACV,UAAU,EACV,wBAAwB,EACxB,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,UAAU,EACV,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,EACnB,iBAAiB,GACjB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACN,SAAS,EACT,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EACvB,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,qBAAqB,EAC1B,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,uBAAuB,EAC5B,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,sBAAsB,EAC3B,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,aAAa,EAClB,KAAK,WAAW,GAChB,MAAM,gBAAgB,CAAC"}

package/dist/types/src/http/bearer.d.ts

@@ -5,6 +5,7 @@
  * logs and the Referer header), multiple tokens, alternate casings and
  * whitespace tricks. One header, one scheme, one token.
  */
+import { type HeaderSource } from "./source.js";
 /**
  * Extract the bearer token from an `Authorization` header. Accepts a
  * `Headers` object, anything with a `.headers` (e.g. `Request`), or the
@@ -13,8 +14,10 @@
  *
  * Note: when multiple `Authorization` headers were sent, `Headers`
  * joins them with `", "` - which this parser rejects, by design.
+ *
+ * A shape this library does not accept - notably a Node/Express
+ * request, whose `headers` is a plain record - throws {@link TypeError}
+ * rather than the misleading "missing header" it used to report.
  */
-export declare function parseBearer(source: Headers | {
-    headers: Headers;
-} | string | null | undefined): string;
+export declare function parseBearer(source: HeaderSource): string;
 //# sourceMappingURL=bearer.d.ts.map

package/dist/types/src/http/bearer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bearer.d.ts","sourceRoot":"","sources":["../../../../src/http/bearer.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAQH;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAC1B,MAAM,EAAE,OAAO,GAAG;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,GAChE,MAAM,CAsBR"}
+{"version":3,"file":"bearer.d.ts","sourceRoot":"","sources":["../../../../src/http/bearer.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAmB,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAMjE;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAexD"}

package/dist/types/src/http/cookies.d.ts

@@ -9,6 +9,7 @@
  * Framework-agnostic: works on WHATWG `Headers` (and anything exposing
  * them, e.g. `Request`/`Response`).
  */
+import { type HeaderSource } from "./source.js";
 export interface TokenCookieOptions {
     /** Cookie name (default `__Host-token`, the most locked-down prefix). */
     name?: string;
@@ -31,8 +32,11 @@ export declare function clearTokenCookie(headers: Headers, options?: Pick<TokenC
  * Read a token cookie from a request. Accepts a `Headers` object,
  * anything with a `.headers` (e.g. `Request`), or the raw `Cookie`
  * header string. Returns `undefined` when absent or malformed.
+ *
+ * Throws {@link TypeError} on a shape it does not accept - notably a
+ * Node/Express request, whose `headers` is a plain record. "I was
+ * handed something I don't understand" must not be indistinguishable
+ * from "this request carried no token".
  */
-export declare function readTokenCookie(source: Headers | {
-    headers: Headers;
-} | string | null | undefined, name?: string): string | undefined;
+export declare function readTokenCookie(source: HeaderSource, name?: string): string | undefined;
 //# sourceMappingURL=cookies.d.ts.map

package/dist/types/src/http/cookies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../../../src/http/cookies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAQH,MAAM,WAAW,kBAAkB;IAClC,yEAAyE;IACzE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAC;IAC5B,mDAAmD;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wCAAwC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAuB,GAAG,MAAM,CAwCxF;AAED,8DAA8D;AAC9D,wBAAgB,cAAc,CAC7B,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,kBAAuB,GAC9B,IAAI,CAEN;AAED,4CAA4C;AAC5C,wBAAgB,gBAAgB,CAC/B,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,MAAM,GAAG,QAAQ,CAAM,GAChE,IAAI,CAKN;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC9B,MAAM,EAAE,OAAO,GAAG;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,EAClE,IAAI,GAAE,MAA4B,GAChC,MAAM,GAAG,SAAS,CAoBpB"}
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../../../src/http/cookies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAmB,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAQjE,MAAM,WAAW,kBAAkB;IAClC,yEAAyE;IACzE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAC;IAC5B,mDAAmD;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wCAAwC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAuB,GAAG,MAAM,CAwCxF;AAED,8DAA8D;AAC9D,wBAAgB,cAAc,CAC7B,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,kBAAuB,GAC9B,IAAI,CAEN;AAED,4CAA4C;AAC5C,wBAAgB,gBAAgB,CAC/B,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,MAAM,GAAG,QAAQ,CAAM,GAChE,IAAI,CAKN;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC9B,MAAM,EAAE,YAAY,EACpB,IAAI,GAAE,MAA4B,GAChC,MAAM,GAAG,SAAS,CAkBpB"}

package/dist/types/src/http/source.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Header-source narrowing shared by the cookie and bearer readers.
+ *
+ * The contract is deliberately narrow: WHATWG `Headers` (or anything
+ * carrying them, e.g. `Request`) or the raw header string. Node's
+ * `IncomingMessage.headers` is a plain record, not `Headers`, and is
+ * *not* accepted - callers on Express/Fastify/Koa convert once at the
+ * edge rather than making every reader here carry a second shape.
+ *
+ * What matters is that an unrecognized shape throws instead of reading
+ * as "header absent". A helper that silently returns nothing for an
+ * argument it never understood is one people route around, and the
+ * hand-rolled replacement has none of the ambiguity refusals below.
+ */
+/** Anything the readers accept. `null`/`undefined` mean "header absent". */
+export type HeaderSource = Headers | {
+    headers: Headers;
+} | string | null | undefined;
+/**
+ * Read one header from an accepted source. Returns `undefined` when the
+ * header is absent; throws {@link TypeError} when `source` is a shape
+ * this library does not accept.
+ *
+ * @param helper - calling helper's name, used in the error message.
+ */
+export declare function readHeaderValue(source: HeaderSource, header: string, helper: string): string | undefined;
+//# sourceMappingURL=source.d.ts.map

package/dist/types/src/http/source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../../../../src/http/source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,4EAA4E;AAC5E,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;AAYtF;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC9B,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACZ,MAAM,GAAG,SAAS,CAmBpB"}