lacewing 1.0.0 → 1.0.2

package/dist/types/src/jwks/local.d.ts

@@ -7,8 +7,16 @@
  * sanitized by header validation (§3.10).
  */
 import type { JwtHeader, KeySource, ResolvedVerificationKey, StaticJWK, StaticJWKS } from "../types.js";
+export interface ResolveFromJwksOptions {
+    /**
+     * Whether symmetric (`oct`) entries may be used. False for remote sets: a
+     * JWKS endpoint is public, so a secret published there is a secret every
+     * reader can *mint* with, not just verify with.
+     */
+    allowSymmetric?: boolean;
+}
 /** Shared selection + import used by both local and remote sets. */
-export declare function resolveFromJwks(keys: readonly StaticJWK[], header: JwtHeader): Promise<ResolvedVerificationKey>;
+export declare function resolveFromJwks(keys: readonly StaticJWK[], header: JwtHeader, options?: ResolveFromJwksOptions): Promise<ResolvedVerificationKey>;
 /** Validate the developer-supplied JWKS document shape (config error -> TypeError). */
 export declare function validateJwksShape(jwks: unknown): StaticJWK[];
 /** Create a {@link KeySource} backed by a static JWKS document. */

package/dist/types/src/jwks/local.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local.d.ts","sourceRoot":"","sources":["../../../../src/jwks/local.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAWH,OAAO,KAAK,EACX,SAAS,EACT,SAAS,EACT,uBAAuB,EACvB,SAAS,EACT,UAAU,EACV,MAAM,aAAa,CAAC;AAYrB,oEAAoE;AACpE,wBAAsB,eAAe,CACpC,IAAI,EAAE,SAAS,SAAS,EAAE,EAC1B,MAAM,EAAE,SAAS,GACf,OAAO,CAAC,uBAAuB,CAAC,CA+BlC;AAED,uFAAuF;AACvF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,GAAG,SAAS,EAAE,CAsB5D;AAED,mEAAmE;AACnE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,UAAU,GAAG,SAAS,CAO7D"}
+{"version":3,"file":"local.d.ts","sourceRoot":"","sources":["../../../../src/jwks/local.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAWH,OAAO,KAAK,EACX,SAAS,EACT,SAAS,EACT,uBAAuB,EACvB,SAAS,EACT,UAAU,EACV,MAAM,aAAa,CAAC;AAYrB,MAAM,WAAW,sBAAsB;IACtC;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,oEAAoE;AACpE,wBAAsB,eAAe,CACpC,IAAI,EAAE,SAAS,SAAS,EAAE,EAC1B,MAAM,EAAE,SAAS,EACjB,OAAO,GAAE,sBAA2B,GAClC,OAAO,CAAC,uBAAuB,CAAC,CAkClC;AAED,uFAAuF;AACvF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,GAAG,SAAS,EAAE,CAsB5D;AAED,mEAAmE;AACnE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,UAAU,GAAG,SAAS,CAO7D"}

package/dist/types/src/jwks/remote.d.ts

@@ -5,7 +5,11 @@
  * - caches with a configurable TTL and honors `Cache-Control: max-age`
  * - cooldown between refetches (no attacker-driven fetch storms)
  * - refetches once on unknown `kid` (key rotation), then fails closed
- * - response size is capped; entries outside the registry are dropped
+ * - stale keys keep serving a *bounded* while after the endpoint starts
+ *   failing, then verification fails closed (LW-jwks.2)
+ * - the response byte budget is enforced while reading, not after
+ * - symmetric (`oct`) entries are refused: a JWKS endpoint is public
+ * - entries outside the registry are dropped
  */
 import type { KeySource } from "../types.js";
 export interface RemoteJWKSetOptions {
@@ -15,6 +19,13 @@ export interface RemoteJWKSetOptions {
     cooldownSeconds?: number;
     /** Fetch timeout (default 5000ms). */
     timeoutMs?: number;
+    /**
+     * How long previously-good keys may keep serving once the endpoint starts
+     * failing (default 3600s). Bounded on purpose: a key rotated out *because
+     * it was compromised* must not stay trusted for as long as an attacker can
+     * keep the endpoint unreachable. `0` disables stale serving entirely.
+     */
+    staleWhileErrorSeconds?: number;
     /** Fetch implementation override - intended for tests. */
     fetch?: typeof fetch;
 }

package/dist/types/src/jwks/remote.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote.d.ts","sourceRoot":"","sources":["../../../../src/jwks/remote.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAEX,SAAS,EAGT,MAAM,aAAa,CAAC;AAQrB,MAAM,WAAW,mBAAmB;IACnC,mFAAmF;IACnF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,sCAAsC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0DAA0D;IAC1D,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACrB;AASD,wEAAwE;AACxE,wBAAgB,kBAAkB,CACjC,GAAG,EAAE,GAAG,GAAG,MAAM,EACjB,OAAO,GAAE,mBAAwB,GAC/B,SAAS,CA8FX"}
+{"version":3,"file":"remote.d.ts","sourceRoot":"","sources":["../../../../src/jwks/remote.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EAEX,SAAS,EAGT,MAAM,aAAa,CAAC;AASrB,MAAM,WAAW,mBAAmB;IACnC,mFAAmF;IACnF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,sCAAsC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,0DAA0D;IAC1D,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACrB;AAwDD,wEAAwE;AACxE,wBAAgB,kBAAkB,CACjC,GAAG,EAAE,GAAG,GAAG,MAAM,EACjB,OAAO,GAAE,mBAAwB,GAC/B,SAAS,CAsHX"}

package/dist/types/src/jwt/decrypt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"decrypt.d.ts","sourceRoot":"","sources":["../../../../src/jwt/decrypt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAqBH,OAAO,EAEN,KAAK,YAAY,EACjB,KAAK,yBAAyB,EAG9B,MAAM,aAAa,CAAC;AAgDrB;;;;GAIG;AACH,wBAAsB,UAAU,CAC/B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,yBAAyB,GAChC,OAAO,CAAC,YAAY,CAAC,CA4DvB"}
+{"version":3,"file":"decrypt.d.ts","sourceRoot":"","sources":["../../../../src/jwt/decrypt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAqBH,OAAO,EAEN,KAAK,YAAY,EACjB,KAAK,yBAAyB,EAG9B,MAAM,aAAa,CAAC;AAgDrB;;;;GAIG;AACH,wBAAsB,UAAU,CAC/B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,yBAAyB,GAChC,OAAO,CAAC,YAAY,CAAC,CAwEvB"}

package/dist/types/src/jwt/decryption_profile.d.ts

@@ -18,8 +18,10 @@ export interface DecryptionProfileOptions {
     contentEncryptionAlgorithms: readonly string[];
     /** The private/secret key that decrypts (bound to one key-management alg). */
     key: LacewingEncryptionKey;
-    /** Maximum accepted token age, independent of `exp`. */
+    /** Maximum accepted token age (`now - iat`), independent of `exp`. */
     maxTokenAge: number | string;
+    /** Optional cap on the token's declared lifetime (`exp - iat`). */
+    maxTokenLifetime?: number | string;
     /** Allowed clock skew, default 5s, capped at 120s. */
     maxClockSkew?: number | string;
     revocation?: RevocationStore;

package/dist/types/src/jwt/decryption_profile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"decryption_profile.d.ts","sourceRoot":"","sources":["../../../../src/jwt/decryption_profile.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,OAAO,EAGN,KAAK,yBAAyB,EAC9B,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,MAAM,aAAa,CAAC;AAKrB,MAAM,WAAW,wBAAwB;IACxC,4CAA4C;IAC5C,GAAG,EAAE,MAAM,CAAC;IACZ,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,uBAAuB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,qDAAqD;IACrD,2BAA2B,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,8EAA8E;IAC9E,GAAG,EAAE,qBAAqB,CAAC;IAC3B,wDAAwD;IACxD,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,sDAAsD;IACtD,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+BAA+B,CAAC,EAAE,OAAO,CAAC;CAC1C;AASD,8DAA8D;AAC9D,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,wBAAwB,GAAG,yBAAyB,CAuDpG"}
+{"version":3,"file":"decryption_profile.d.ts","sourceRoot":"","sources":["../../../../src/jwt/decryption_profile.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,OAAO,EAGN,KAAK,yBAAyB,EAC9B,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,MAAM,aAAa,CAAC;AAKrB,MAAM,WAAW,wBAAwB;IACxC,4CAA4C;IAC5C,GAAG,EAAE,MAAM,CAAC;IACZ,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,uBAAuB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,qDAAqD;IACrD,2BAA2B,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,8EAA8E;IAC9E,GAAG,EAAE,qBAAqB,CAAC;IAC3B,sEAAsE;IACtE,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,mEAAmE;IACnE,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACnC,sDAAsD;IACtD,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+BAA+B,CAAC,EAAE,OAAO,CAAC;CAC1C;AASD,8DAA8D;AAC9D,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,wBAAwB,GAAG,yBAAyB,CA6DpG"}

package/dist/types/src/jwt/profile.d.ts

@@ -19,8 +19,14 @@ export interface ProfileOptions {
     algorithms: readonly string[];
     /** Key source: a JWKS (static or remote config), a KeySource, or a single key. */
     keys: KeySource | LacewingKey | StaticJWKS | RemoteJWKS;
-    /** Maximum accepted token age, independent of `exp`. */
+    /** Maximum accepted token age (`now - iat`), independent of `exp`. */
     maxTokenAge: number | string;
+    /**
+     * Optional cap on the token's *declared* lifetime (`exp - iat`). Where
+     * `maxTokenAge` bounds how long a token stays usable, this refuses a token
+     * whose issuer claimed an implausible span at all - a misissuance signal.
+     */
+    maxTokenLifetime?: number | string;
     /** Allowed clock skew, default 5s, capped at 120s. */
     maxClockSkew?: number | string;
     /** Optional revocation store - its absence is a visible choice. */

package/dist/types/src/jwt/profile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"profile.d.ts","sourceRoot":"","sources":["../../../../src/jwt/profile.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,EAGN,KAAK,kBAAkB,EACvB,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,MAAM,aAAa,CAAC;AAKrB,MAAM,WAAW,cAAc;IAC9B,oDAAoD;IACpD,GAAG,EAAE,MAAM,CAAC;IACZ,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,kFAAkF;IAClF,IAAI,EAAE,SAAS,GAAG,WAAW,GAAG,UAAU,GAAG,UAAU,CAAC;IACxD,wDAAwD;IACxD,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,sDAAsD;IACtD,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,mEAAmE;IACnE,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,iEAAiE;IACjE,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAChD,uCAAuC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kFAAkF;IAClF,+BAA+B,CAAC,EAAE,OAAO,CAAC;CAC1C;AA+CD,6DAA6D;AAC7D,wBAAgB,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,kBAAkB,CAmDzE"}
+{"version":3,"file":"profile.d.ts","sourceRoot":"","sources":["../../../../src/jwt/profile.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,EAGN,KAAK,kBAAkB,EACvB,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,MAAM,aAAa,CAAC;AAKrB,MAAM,WAAW,cAAc;IAC9B,oDAAoD;IACpD,GAAG,EAAE,MAAM,CAAC;IACZ,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,kFAAkF;IAClF,IAAI,EAAE,SAAS,GAAG,WAAW,GAAG,UAAU,GAAG,UAAU,CAAC;IACxD,sEAAsE;IACtE,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACnC,sDAAsD;IACtD,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,mEAAmE;IACnE,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,iEAAiE;IACjE,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAChD,uCAAuC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kFAAkF;IAClF,+BAA+B,CAAC,EAAE,OAAO,CAAC;CAC1C;AAgDD,6DAA6D;AAC7D,wBAAgB,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,kBAAkB,CAyDzE"}

package/dist/types/src/lib/claims.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"claims.d.ts","sourceRoot":"","sources":["../../../../src/lib/claims.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAuChD,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD;;;GAGG;AACH,wBAAsB,cAAc,CACnC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,OAAO,EAAE,YAAY,EACrB,UAAU,GAAE,MAAsC,GAChD,OAAO,CAAC,IAAI,CAAC,CA4Ef"}
+{"version":3,"file":"claims.d.ts","sourceRoot":"","sources":["../../../../src/lib/claims.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAuChD,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD;;;GAGG;AACH,wBAAsB,cAAc,CACnC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,OAAO,EAAE,YAAY,EACrB,UAAU,GAAE,MAAsC,GAChD,OAAO,CAAC,IAAI,CAAC,CA0Ff"}

package/dist/types/src/lib/entropy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entropy.d.ts","sourceRoot":"","sources":["../../../../src/lib/entropy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA+BH;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAYzD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI,CAelF"}
+{"version":3,"file":"entropy.d.ts","sourceRoot":"","sources":["../../../../src/lib/entropy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA+BH;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAkBzD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI,CAelF"}

package/dist/types/src/lib/payload_hygiene.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload_hygiene.d.ts","sourceRoot":"","sources":["../../../../src/lib/payload_hygiene.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAwGH;;;;GAIG;AACH,wBAAgB,2BAA2B,CAC1C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,aAAa,GAAE,WAAW,CAAC,MAAM,CAAa,GAC5C,IAAI,CAgBN"}
+{"version":3,"file":"payload_hygiene.d.ts","sourceRoot":"","sources":["../../../../src/lib/payload_hygiene.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAgJH;;;;GAIG;AACH,wBAAgB,2BAA2B,CAC1C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,aAAa,GAAE,WAAW,CAAC,MAAM,CAAa,GAC5C,IAAI,CAgBN"}

package/dist/types/src/types.d.ts

@@ -82,6 +82,8 @@ export type RemoteJWKS = {
     cacheTtlSeconds?: number;
     cooldownSeconds?: number;
     timeoutMs?: number;
+    /** Bounded stale-serving window once the endpoint starts failing (default 1h). */
+    staleWhileErrorSeconds?: number;
 };
 export type JWKSConfig = StaticJWKS | RemoteJWKS;
 /** A key resolved by a {@link KeySource} for one specific token. */
@@ -117,6 +119,8 @@ export interface ClaimsPolicy {
     iss: string;
     aud: string;
     maxTokenAge: DurationSeconds;
+    /** Optional cap on the token's declared span (`exp - iat`). */
+    maxTokenLifetime?: DurationSeconds;
     maxClockSkew: DurationSeconds;
     subject?: string;
     claimValidators?: Record<string, ValidateClaim>;
@@ -182,6 +186,8 @@ export interface ExpectedJwtProfile {
     alg: readonly ValidAlg[];
     keys: KeySource | LacewingKey;
     maxTokenAge: DurationSeconds;
+    /** Optional cap on the token's declared span (`exp - iat`). */
+    maxTokenLifetime?: DurationSeconds;
     maxClockSkew: DurationSeconds;
     revocation?: RevocationStore;
     claimValidators?: Record<string, ValidateClaim>;

package/dist/types/src/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/types.ts"],"names":[],"mappings":"AAQA;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,MAAM,CAAA;CAAE,CAAC;AAElE;;;;GAIG;AACH,eAAO,MAAM,MAAM,GAAI,OAAO,MAAM,KAAG,QAKtC,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,UAAU,EAAE,OAAO,MAAM,CAAA;CAAE,CAAC;AAE9E,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,CAKxD;AAED,MAAM,WAAW,SAAS;IACzB,GAAG,EAAE,QAAQ,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,UAAU;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;CAC5B;AAED,kFAAkF;AAClF,KAAK,QAAQ,GAAG;IACf,MAAM,EAAE,SAAS,CAAC;IAClB,OAAO,EAAE,UAAU,CAAC;CACpB,CAAC;AAEF,yEAAyE;AACzE,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;CAAE,CAAC;AACzE,+EAA+E;AAC/E,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;CAAE,CAAC;AAE3E,OAAO,CAAC,MAAM,WAAW,EAAE,OAAO,MAAM,CAAC;AACzC,MAAM,MAAM,OAAO,CAAC,CAAC,EAAE,SAAS,SAAS,MAAM,IAAI,CAAC,GAAG;IACtD,QAAQ,CAAC,CAAC,WAAW,CAAC,EAAE,SAAS,CAAC;CAClC,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,WAAW,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM,IAAI;IACtD,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,GAAG,GAAG,QAAQ,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC;IAClD,sEAAsE;IACtE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF,0EAA0E;AAC1E,wBAAgB,iBAAiB,CAAC,KAAK,CAAC,GAAG,SAAS,MAAM,EACzD,SAAS,EAAE,GAAG,GAAG,QAAQ,EACzB,OAAO,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,EACxC,GAAG,EAAE,OAAO,GACV,WAAW,CAAC,GAAG,CAAC,CAOlB;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,WAAW,CAMlE;AAED,MAAM,MAAM,SAAS,GAAG;IACvB,GAAG,EAAE,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,KAAK,CAAC;IAClC,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACxB,IAAI,EAAE,SAAS,EAAE,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,UAAU,CAAC;AAEjD,oEAAoE;AACpE,MAAM,WAAW,uBAAuB;IACvC,GAAG,EAAE,QAAQ,CAAC;IACd,GAAG,EAAE,OAAO,CAAC;CACb;AAED;;;GAGG;AACH,MAAM,WAAW,SAAS;IACzB,kBAAkB,CACjB,MAAM,EAAE,SAAS,EACjB,iBAAiB,EAAE,SAAS,QAAQ,EAAE,GACpC,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,sBAAsB;IACtC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,eAAe;IAC/B,SAAS,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7D,YAAY,CAAC,CAAC,QAAQ,EAAE,sBAAsB,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;CACtE;AAED,MAAM,MAAM,aAAa,GAAG,CAC3B,UAAU,EAAE,OAAO,EACnB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAChC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1B;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,eAAe,CAAC;IAC7B,YAAY,EAAE,eAAe,CAAC;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;CAChD;AAED;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM,IAAI;IAChE,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,GAAG,GAAG,QAAQ,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC;IAClD,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF,sFAAsF;AACtF,wBAAgB,2BAA2B,CAAC,KAAK,CAAC,GAAG,SAAS,MAAM,EACnE,SAAS,EAAE,GAAG,GAAG,QAAQ,EACzB,OAAO,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,EACxC,GAAG,EAAE,OAAO,GACV,qBAAqB,CAAC,GAAG,CAAC,CAO5B;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,qBAAqB,CAMtF;AAED,+EAA+E;AAC/E,MAAM,WAAW,SAAS;IACzB,GAAG,EAAE,QAAQ,CAAC;IACd,GAAG,EAAE,QAAQ,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACb;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG;IAC1B,MAAM,EAAE,SAAS,CAAC;IAClB,OAAO,EAAE,UAAU,CAAC;CACpB,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;CAAE,CAAC;AAEzC;;;;GAIG;AACH,MAAM,WAAW,yBAA0B,SAAQ,YAAY;IAC9D,GAAG,EAAE,MAAM,CAAC;IACZ,gFAAgF;IAChF,uBAAuB,EAAE,SAAS,QAAQ,EAAE,CAAC;IAC7C,0DAA0D;IAC1D,2BAA2B,EAAE,SAAS,QAAQ,EAAE,CAAC;IACjD,8EAA8E;IAC9E,GAAG,EAAE,qBAAqB,CAAC;IAC3B,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,+BAA+B,CAAC,EAAE,OAAO,CAAC;CAC1C;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,SAAS,QAAQ,EAAE,CAAC;IACzB,IAAI,EAAE,SAAS,GAAG,WAAW,CAAC;IAC9B,WAAW,EAAE,eAAe,CAAC;IAC7B,YAAY,EAAE,eAAe,CAAC;IAC9B,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,+BAA+B,CAAC,EAAE,OAAO,CAAC;CAC1C"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/types.ts"],"names":[],"mappings":"AAQA;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,MAAM,CAAA;CAAE,CAAC;AAElE;;;;GAIG;AACH,eAAO,MAAM,MAAM,GAAI,OAAO,MAAM,KAAG,QAKtC,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,UAAU,EAAE,OAAO,MAAM,CAAA;CAAE,CAAC;AAE9E,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,CAKxD;AAED,MAAM,WAAW,SAAS;IACzB,GAAG,EAAE,QAAQ,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,UAAU;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;CAC5B;AAED,kFAAkF;AAClF,KAAK,QAAQ,GAAG;IACf,MAAM,EAAE,SAAS,CAAC;IAClB,OAAO,EAAE,UAAU,CAAC;CACpB,CAAC;AAEF,yEAAyE;AACzE,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;CAAE,CAAC;AACzE,+EAA+E;AAC/E,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;CAAE,CAAC;AAE3E,OAAO,CAAC,MAAM,WAAW,EAAE,OAAO,MAAM,CAAC;AACzC,MAAM,MAAM,OAAO,CAAC,CAAC,EAAE,SAAS,SAAS,MAAM,IAAI,CAAC,GAAG;IACtD,QAAQ,CAAC,CAAC,WAAW,CAAC,EAAE,SAAS,CAAC;CAClC,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,WAAW,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM,IAAI;IACtD,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,GAAG,GAAG,QAAQ,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC;IAClD,sEAAsE;IACtE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF,0EAA0E;AAC1E,wBAAgB,iBAAiB,CAAC,KAAK,CAAC,GAAG,SAAS,MAAM,EACzD,SAAS,EAAE,GAAG,GAAG,QAAQ,EACzB,OAAO,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,EACxC,GAAG,EAAE,OAAO,GACV,WAAW,CAAC,GAAG,CAAC,CAOlB;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,WAAW,CAMlE;AAED,MAAM,MAAM,SAAS,GAAG;IACvB,GAAG,EAAE,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,KAAK,CAAC;IAClC,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACxB,IAAI,EAAE,SAAS,EAAE,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,sBAAsB,CAAC,EAAE,MAAM,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,UAAU,CAAC;AAEjD,oEAAoE;AACpE,MAAM,WAAW,uBAAuB;IACvC,GAAG,EAAE,QAAQ,CAAC;IACd,GAAG,EAAE,OAAO,CAAC;CACb;AAED;;;GAGG;AACH,MAAM,WAAW,SAAS;IACzB,kBAAkB,CACjB,MAAM,EAAE,SAAS,EACjB,iBAAiB,EAAE,SAAS,QAAQ,EAAE,GACpC,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,sBAAsB;IACtC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,eAAe;IAC/B,SAAS,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7D,YAAY,CAAC,CAAC,QAAQ,EAAE,sBAAsB,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;CACtE;AAED,MAAM,MAAM,aAAa,GAAG,CAC3B,UAAU,EAAE,OAAO,EACnB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAChC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1B;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,eAAe,CAAC;IAC7B,+DAA+D;IAC/D,gBAAgB,CAAC,EAAE,eAAe,CAAC;IACnC,YAAY,EAAE,eAAe,CAAC;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;CAChD;AAED;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM,IAAI;IAChE,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,GAAG,GAAG,QAAQ,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC;IAClD,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF,sFAAsF;AACtF,wBAAgB,2BAA2B,CAAC,KAAK,CAAC,GAAG,SAAS,MAAM,EACnE,SAAS,EAAE,GAAG,GAAG,QAAQ,EACzB,OAAO,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,EACxC,GAAG,EAAE,OAAO,GACV,qBAAqB,CAAC,GAAG,CAAC,CAO5B;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,qBAAqB,CAMtF;AAED,+EAA+E;AAC/E,MAAM,WAAW,SAAS;IACzB,GAAG,EAAE,QAAQ,CAAC;IACd,GAAG,EAAE,QAAQ,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACb;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG;IAC1B,MAAM,EAAE,SAAS,CAAC;IAClB,OAAO,EAAE,UAAU,CAAC;CACpB,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;CAAE,CAAC;AAEzC;;;;GAIG;AACH,MAAM,WAAW,yBAA0B,SAAQ,YAAY;IAC9D,GAAG,EAAE,MAAM,CAAC;IACZ,gFAAgF;IAChF,uBAAuB,EAAE,SAAS,QAAQ,EAAE,CAAC;IAC7C,0DAA0D;IAC1D,2BAA2B,EAAE,SAAS,QAAQ,EAAE,CAAC;IACjD,8EAA8E;IAC9E,GAAG,EAAE,qBAAqB,CAAC;IAC3B,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,+BAA+B,CAAC,EAAE,OAAO,CAAC;CAC1C;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,SAAS,QAAQ,EAAE,CAAC;IACzB,IAAI,EAAE,SAAS,GAAG,WAAW,CAAC;IAC9B,WAAW,EAAE,eAAe,CAAC;IAC7B,+DAA+D;IAC/D,gBAAgB,CAAC,EAAE,eAAe,CAAC;IACnC,YAAY,EAAE,eAAe,CAAC;IAC9B,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,+BAA+B,CAAC,EAAE,OAAO,CAAC;CAC1C"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "lacewing",
-	"version": "1.0.0",
+	"version": "1.0.2",
 	"description": "An opinionated JWT library that makes RFC 8725 (JWT Best Current Practices) the default behavior, not an optional configuration.",
 	"type": "module",
 	"engines": {
@@ -55,16 +55,16 @@
 		"@commitlint/config-conventional": "^21.2.0",
 		"@eslint/js": "^10.0.1",
 		"@types/node": "^26.1.1",
-		"eslint": "^10.7.0",
+		"eslint": "^10.8.0",
 		"fast-check": "^4.9.0",
 		"git-cliff": "^2.13.1",
 		"lefthook": "^2.1.10",
-		"tsx": "^4.23.0",
+		"tsx": "^4.23.1",
 		"typedoc": "^0.28.20",
 		"typescript": "^6.0.3",
-		"typescript-eslint": "^8.63.0"
+		"typescript-eslint": "^8.65.0"
 	},
 	"dependencies": {
-		"jose": "^6.2.3"
+		"jose": "^6.2.4"
 	}
 }