lacewing 1.0.1 → 1.1.0

package/README.md

@@ -28,6 +28,11 @@ Instead of exposing low-level primitives and trusting you to compose them correc
 npm install lacewing
 ```
 
+[Getting started](./GETTING-STARTED.md) walks through adopting Lacewing in a
+real service: keys, profiles, transport, refresh tokens, revocation, key
+rotation, and a migration path from `jsonwebtoken`. The rest of this README is
+the pitch and the reference.
+
 ## Quick start
 
 The complete lifecycle (generate a key, sign, define a profile once, verify everywhere):
@@ -208,6 +213,18 @@ the `", "`-joined value `Headers` produces when a request carried two
 cookie name appears twice, the servers disagree about whether the first or the
 last duplicate wins, and cookie shadowing is built on that disagreement.
 
+Both readers take WHATWG `Headers` (or anything carrying them, like `Request`),
+or the raw header string. Node-style frameworks - Express, Fastify, Koa - hand
+you a plain object instead, so convert once at the edge; a shape the readers
+don't accept throws rather than reading as "no token":
+
+```ts
+const headers = new Headers(req.headers as Record<string, string>);
+const fromCookie = readTokenCookie(headers);
+
+res.setHeader("Set-Cookie", buildTokenCookie(token)); // the response side is just a string
+```
+
 ### Access vs refresh (the cookbook)
 
 The single most common token-confusion bug is letting a refresh token buy API
@@ -397,6 +414,42 @@ import { enableLegacyRSA } from "lacewing/legacy/rsa"; // RS256 + RS384 + RS512
 
 Prefer `PS256`/`EdDSA` everywhere you control both sides.
 
+### Ed25519 has two names
+
+`EdDSA` and `Ed25519` are the same signature over the same key. `Ed25519` is
+the fully-specified name from [RFC 9864](https://www.rfc-editor.org/rfc/rfc9864),
+and some issuers and clients (oauth4webapi, for one) write only that one. Both
+are in the registry, as two entries, and Lacewing does not treat them as
+aliases:
+
+- A profile accepts the names you list. `algorithms: ["EdDSA"]` refuses a
+  token whose header says `Ed25519`; list both if your issuer might send
+  either.
+- A key is bound to the name it was imported under. A key imported for
+  `EdDSA` does not verify an `Ed25519` token, even with both allowlisted.
+  Import it once per name, or use a JWKS entry with no `alg`, which serves
+  both.
+
+### Building on Lacewing: `lacewing/extension`
+
+For packages that add a check on top of a Lacewing profile and must agree with
+Lacewing about what a valid algorithm or duration is. It is covered by semver
+like the root export, and it is read-only:
+
+```ts
+import { getAlgorithmProperties, parseDuration, readHeaderValue } from "lacewing/extension";
+
+getAlgorithmProperties("ES256"); // { name: "ES256", kty: "EC", crv: "P-256", minKeyBits: 256 }, frozen
+parseDuration("15m");            // 900, as DurationSeconds
+readHeaderValue(request, "dpop", "verifyProof"); // same source rules as parseBearer
+```
+
+Registry entries come back frozen, so nothing that imports them can lower a
+key-size floor for the rest of the process. Adding to the registry stays
+behind the `legacy/` imports, and header validation is not exported: it
+refuses an embedded `jwk`, which is right for a token and wrong for a format
+that carries its own key, so each format owns its own header rules.
+
 ## Why Lacewing exists
 
 Lacewing is not trying to compete with general-purpose JWT libraries. It started as the hardened setup I kept rebuilding for my own projects, packaged so I'd stop rebuilding it.

package/SECURITY.md

@@ -0,0 +1,22 @@
+# Security Policy
+
+
+## Security/Bugfix Versions
+
+Security and bug fixes are generally provided only for the last minor version.
+Fixes are released either as part of the next minor version or as an on-demand patch version.
+
+Security fixes are given priority and might be enough to cause a new version to be released.
+
+## Reporting a Vulnerability
+
+We encourage responsible disclosure of security vulnerabilities.
+If you find something suspicious, we encourage and appreciate your report!
+
+### Ways to report
+
+In order for the vulnerability reports to reach maintainers as soon as possible, the preferred way is to use the "Report a vulnerability" button under the "Security" tab of the associated GitHub project.
+This creates a private communication channel between the reporter and the maintainers.
+
+> This document was left empty for a long time as I didn't really want to expose my identity and most of my projects originate as projects from my personal instance of gitlabs. But I also understand that this is something people expect as a bare minimum from a dep that claims to be more security centric.
+> Credits to [honeycomb](https://raw.githubusercontent.com/honeycombio/examples/refs/heads/main/SECURITY.md) for the security markdown file.

package/dist/index.js

@@ -31,6 +31,7 @@ export { MemoryRevocationStore } from "./src/revocation/memory.js";
 // HTTP transport helpers (the paved road: no localStorage, ever)
 export { buildTokenCookie, setTokenCookie, clearTokenCookie, readTokenCookie, } from "./src/http/cookies.js";
 export { parseBearer } from "./src/http/bearer.js";
+export {} from "./src/http/source.js";
 // Debugging escape hatch - branded untrusted, incompatible with VerifiedJwt
 export { unsafeDecode } from "./src/util/unsafe-decode.js";
 // Typed errors

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,oDAAoD;AACpD,OAAO,EAAE,aAAa,EAAuB,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD,UAAU;AACV,OAAO,EAAE,OAAO,EAAuB,MAAM,mBAAmB,CAAC;AAEjE,4DAA4D;AAC5D,OAAO,EAAE,UAAU,EAA0B,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EACN,uBAAuB,GAEvB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACN,yBAAyB,EACzB,wBAAwB,EACxB,iBAAiB,EACjB,mBAAmB,GAGnB,MAAM,yBAAyB,CAAC;AAEjC,8EAA8E;AAC9E,OAAO,EACN,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,iBAAiB,GAEjB,MAAM,kCAAkC,CAAC;AAE1C,OAAO;AACP,OAAO,EAAE,SAAS,EAAoB,MAAM,qBAAqB,CAAC;AAClE,OAAO,EACN,eAAe,EACf,cAAc,GAEd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEjE,mBAAmB;AACnB,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAA4B,MAAM,sBAAsB,CAAC;AAEpF,aAAa;AACb,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,iEAAiE;AACjE,OAAO,EACN,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,eAAe,GAEf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEnD,4EAA4E;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAE3D,eAAe;AACf,OAAO,EACN,QAAQ,EACR,UAAU,EACV,UAAU,EACV,wBAAwB,EACxB,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,UAAU,EACV,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,EACnB,iBAAiB,GACjB,MAAM,sBAAsB,CAAC;AAE9B,eAAe;AACf,OAAO,EACN,SAAS,GAuBT,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,oDAAoD;AACpD,OAAO,EAAE,aAAa,EAAuB,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD,UAAU;AACV,OAAO,EAAE,OAAO,EAAuB,MAAM,mBAAmB,CAAC;AAEjE,4DAA4D;AAC5D,OAAO,EAAE,UAAU,EAA0B,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EACN,uBAAuB,GAEvB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACN,yBAAyB,EACzB,wBAAwB,EACxB,iBAAiB,EACjB,mBAAmB,GAGnB,MAAM,yBAAyB,CAAC;AAEjC,8EAA8E;AAC9E,OAAO,EACN,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,iBAAiB,GAEjB,MAAM,kCAAkC,CAAC;AAE1C,OAAO;AACP,OAAO,EAAE,SAAS,EAAoB,MAAM,qBAAqB,CAAC;AAClE,OAAO,EACN,eAAe,EACf,cAAc,GAEd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEjE,mBAAmB;AACnB,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAA4B,MAAM,sBAAsB,CAAC;AAEpF,aAAa;AACb,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,iEAAiE;AACjE,OAAO,EACN,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,eAAe,GAEf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAqB,MAAM,sBAAsB,CAAC;AAEzD,4EAA4E;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAE3D,eAAe;AACf,OAAO,EACN,QAAQ,EACR,UAAU,EACV,UAAU,EACV,wBAAwB,EACxB,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,UAAU,EACV,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,EACnB,iBAAiB,GACjB,MAAM,sBAAsB,CAAC;AAE9B,eAAe;AACf,OAAO,EACN,SAAS,GAuBT,MAAM,gBAAgB,CAAC"}

package/dist/src/extension.js

@@ -0,0 +1,16 @@
+/**
+ * `lacewing/extension`: the policy Lacewing already enforces, for packages
+ * that build on it and must not drift from it.
+ *
+ * Covered by semver like the root export. Everything here is read-only:
+ * registry entries are frozen, and nothing that adds to the registry
+ * (`registerLegacyAlgorithm`) or weakens a check is reachable from this
+ * path. Header validation (`validateHeader`) is deliberately absent too:
+ * it refuses an embedded `jwk`, which is right for a token and wrong for
+ * any format that carries its own key, so each format owns its header
+ * rules.
+ */
+export { getAlgorithmProperties } from "./lib/algorithms.js";
+export { parseDuration } from "./lib/duration.js";
+export { readHeaderValue } from "./http/source.js";
+//# sourceMappingURL=extension.js.map

package/dist/src/extension.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extension.js","sourceRoot":"","sources":["../../src/extension.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,sBAAsB,EAAsB,MAAM,qBAAqB,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAqB,MAAM,kBAAkB,CAAC"}

package/dist/src/http/bearer.js

@@ -6,6 +6,7 @@
  * whitespace tricks. One header, one scheme, one token.
  */
 import { BearerParseFailed } from "../util/errors.js";
+import { readHeaderValue } from "./source.js";
 // RFC 6750 credentials: exact-case scheme, a single SP, one token68.
 const BEARER = /^Bearer ([A-Za-z0-9\-._~+/]+=*)$/;
 const MAX_HEADER_LENGTH = 16384;
@@ -17,18 +18,13 @@ const MAX_HEADER_LENGTH = 16384;
  *
  * Note: when multiple `Authorization` headers were sent, `Headers`
  * joins them with `", "` - which this parser rejects, by design.
+ *
+ * A shape this library does not accept - notably a Node/Express
+ * request, whose `headers` is a plain record - throws {@link TypeError}
+ * rather than the misleading "missing header" it used to report.
  */
 export function parseBearer(source) {
-    let value;
-    if (typeof source === "string") {
-        value = source;
-    }
-    else if (source instanceof Headers) {
-        value = source.get("authorization");
-    }
-    else if (typeof source === "object" && source !== null && source.headers instanceof Headers) {
-        value = source.headers.get("authorization");
-    }
+    const value = readHeaderValue(source, "authorization", "parseBearer");
     if (typeof value !== "string" || value.length === 0) {
         throw new BearerParseFailed("Missing Authorization header");
     }

package/dist/src/http/bearer.js.map

@@ -1 +1 @@
-{"version":3,"file":"bearer.js","sourceRoot":"","sources":["../../../src/http/bearer.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,qEAAqE;AACrE,MAAM,MAAM,GAAG,kCAAkC,CAAC;AAClD,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEhC;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAC1B,MAAkE;IAElE,IAAI,KAAgC,CAAC;IACrC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAChC,KAAK,GAAG,MAAM,CAAC;IAChB,CAAC;SAAM,IAAI,MAAM,YAAY,OAAO,EAAE,CAAC;QACtC,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACrC,CAAC;SAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,YAAY,OAAO,EAAE,CAAC;QAC/F,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,iBAAiB,CAAC,8BAA8B,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;QACtC,MAAM,IAAI,iBAAiB,CAAC,iDAAiD,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,iBAAiB,CAC1B,yFAAyF,CACzF,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,CAAW,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"bearer.js","sourceRoot":"","sources":["../../../src/http/bearer.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAqB,MAAM,aAAa,CAAC;AAEjE,qEAAqE;AACrE,MAAM,MAAM,GAAG,kCAAkC,CAAC;AAClD,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEhC;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CAAC,MAAoB;IAC/C,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,EAAE,eAAe,EAAE,aAAa,CAAC,CAAC;IACtE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,iBAAiB,CAAC,8BAA8B,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;QACtC,MAAM,IAAI,iBAAiB,CAAC,iDAAiD,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,iBAAiB,CAC1B,yFAAyF,CACzF,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,CAAW,CAAC;AAC3B,CAAC"}

package/dist/src/http/cookies.js

@@ -9,6 +9,7 @@
  * Framework-agnostic: works on WHATWG `Headers` (and anything exposing
  * them, e.g. `Request`/`Response`).
  */
+import { readHeaderValue } from "./source.js";
 // RFC 6265 cookie-name token; value charset covers compact JWTs.
 const COOKIE_NAME = /^[!#$%&'*+\-.^_`|~A-Za-z0-9]+$/;
 const COOKIE_VALUE = /^[A-Za-z0-9._~+/=-]*$/;
@@ -67,18 +68,14 @@ export function clearTokenCookie(headers, options = {}) {
  * Read a token cookie from a request. Accepts a `Headers` object,
  * anything with a `.headers` (e.g. `Request`), or the raw `Cookie`
  * header string. Returns `undefined` when absent or malformed.
+ *
+ * Throws {@link TypeError} on a shape it does not accept - notably a
+ * Node/Express request, whose `headers` is a plain record. "I was
+ * handed something I don't understand" must not be indistinguishable
+ * from "this request carried no token".
  */
 export function readTokenCookie(source, name = DEFAULT_COOKIE_NAME) {
-    let cookieHeader;
-    if (typeof source === "string") {
-        cookieHeader = source;
-    }
-    else if (source instanceof Headers) {
-        cookieHeader = source.get("cookie");
-    }
-    else if (typeof source === "object" && source !== null && source.headers instanceof Headers) {
-        cookieHeader = source.headers.get("cookie");
-    }
+    const cookieHeader = readHeaderValue(source, "cookie", "readTokenCookie");
     if (typeof cookieHeader !== "string" || cookieHeader.length > 16384) {
         return undefined;
     }

package/dist/src/http/cookies.js.map

@@ -1 +1 @@
-{"version":3,"file":"cookies.js","sourceRoot":"","sources":["../../../src/http/cookies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,iEAAiE;AACjE,MAAM,WAAW,GAAG,gCAAgC,CAAC;AACrD,MAAM,YAAY,GAAG,uBAAuB,CAAC;AAE7C,MAAM,mBAAmB,GAAG,cAAc,CAAC;AAe3C,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,UAA8B,EAAE;IAC/E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClF,MAAM,IAAI,SAAS,CAAC,6DAA6D,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,mBAAmB,CAAC;IACjD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,SAAS,CAAC,qBAAqB,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAC;IAC3C,IAAI,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjD,MAAM,IAAI,SAAS,CAAC,oEAAoE,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,GAAG,CAAC;IACjC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,SAAS,CAAC,qBAAqB,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClB,MAAM,IAAI,SAAS,CAAC,gCAAgC,CAAC,CAAC;QACvD,CAAC;IACF,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;IACnD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,SAAS,CAAC,uBAAuB,CAAC,CAAC;QAC9C,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,SAAS,CAAC,8CAA8C,CAAC,CAAC;QACrE,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,WAAW,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,kEAAkE;IAClE,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,YAAY,QAAQ,EAAE,CAAC,CAAC;IACzD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,cAAc,CAC7B,OAAgB,EAChB,KAAa,EACb,UAA8B,EAAE;IAEhC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,gBAAgB,CAC/B,OAAgB,EAChB,UAAgE,EAAE;IAElE,OAAO,CAAC,MAAM,CACb,YAAY,EACZ,gBAAgB,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,CACtF,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC9B,MAAkE,EAClE,OAAe,mBAAmB;IAElC,IAAI,YAAuC,CAAC;IAC5C,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAChC,YAAY,GAAG,MAAM,CAAC;IACvB,CAAC;SAAM,IAAI,MAAM,YAAY,OAAO,EAAE,CAAC;QACtC,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;SAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,YAAY,OAAO,EAAE,CAAC;QAC/F,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;QACrE,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,KAAyB,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,SAAS;QACxB,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI;YAAE,SAAS;QAChD,qEAAqE;QACrE,oEAAoE;QACpE,qDAAqD;QACrD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AAChE,CAAC"}
+{"version":3,"file":"cookies.js","sourceRoot":"","sources":["../../../src/http/cookies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,eAAe,EAAqB,MAAM,aAAa,CAAC;AAEjE,iEAAiE;AACjE,MAAM,WAAW,GAAG,gCAAgC,CAAC;AACrD,MAAM,YAAY,GAAG,uBAAuB,CAAC;AAE7C,MAAM,mBAAmB,GAAG,cAAc,CAAC;AAe3C,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,UAA8B,EAAE;IAC/E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClF,MAAM,IAAI,SAAS,CAAC,6DAA6D,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,mBAAmB,CAAC;IACjD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,SAAS,CAAC,qBAAqB,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAC;IAC3C,IAAI,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjD,MAAM,IAAI,SAAS,CAAC,oEAAoE,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,GAAG,CAAC;IACjC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,SAAS,CAAC,qBAAqB,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClB,MAAM,IAAI,SAAS,CAAC,gCAAgC,CAAC,CAAC;QACvD,CAAC;IACF,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;IACnD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,SAAS,CAAC,uBAAuB,CAAC,CAAC;QAC9C,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,SAAS,CAAC,8CAA8C,CAAC,CAAC;QACrE,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,WAAW,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,kEAAkE;IAClE,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,YAAY,QAAQ,EAAE,CAAC,CAAC;IACzD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,cAAc,CAC7B,OAAgB,EAChB,KAAa,EACb,UAA8B,EAAE;IAEhC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,gBAAgB,CAC/B,OAAgB,EAChB,UAAgE,EAAE;IAElE,OAAO,CAAC,MAAM,CACb,YAAY,EACZ,gBAAgB,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,CACtF,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAC9B,MAAoB,EACpB,OAAe,mBAAmB;IAElC,MAAM,YAAY,GAAG,eAAe,CAAC,MAAM,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;IAC1E,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;QACrE,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,KAAyB,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,SAAS;QACxB,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI;YAAE,SAAS;QAChD,qEAAqE;QACrE,oEAAoE;QACpE,qDAAqD;QACrD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AAChE,CAAC"}

package/dist/src/http/source.js

@@ -0,0 +1,49 @@
+/**
+ * Header-source narrowing shared by the cookie and bearer readers.
+ *
+ * The contract is deliberately narrow: WHATWG `Headers` (or anything
+ * carrying them, e.g. `Request`) or the raw header string. Node's
+ * `IncomingMessage.headers` is a plain record, not `Headers`, and is
+ * *not* accepted - callers on Express/Fastify/Koa convert once at the
+ * edge rather than making every reader here carry a second shape.
+ *
+ * What matters is that an unrecognized shape throws instead of reading
+ * as "header absent". A helper that silently returns nothing for an
+ * argument it never understood is one people route around, and the
+ * hand-rolled replacement has none of the ambiguity refusals below.
+ */
+// Duck-typed rather than `instanceof`: a `Headers` from another realm
+// (undici's own copy, a vm context, an edge/node boundary) is still a
+// `Headers`, and `instanceof` would reject it. This widens nothing -
+// a plain Node header record has no `.get` and still fails.
+function isHeadersLike(value) {
+    return (typeof value === "object" && value !== null && typeof value.get === "function");
+}
+/**
+ * Read one header from an accepted source. Returns `undefined` when the
+ * header is absent; throws {@link TypeError} when `source` is a shape
+ * this library does not accept.
+ *
+ * @param helper - calling helper's name, used in the error message.
+ */
+export function readHeaderValue(source, header, helper) {
+    // An explicit nothing - including the `null` that `Headers.get` itself
+    // returns - is a legitimate "no such header", not a caller mistake.
+    if (source === null || source === undefined)
+        return undefined;
+    if (typeof source === "string")
+        return source;
+    if (isHeadersLike(source)) {
+        const value = source.get(header);
+        return typeof value === "string" ? value : undefined;
+    }
+    if (typeof source === "object" && isHeadersLike(source.headers)) {
+        const value = source.headers.get(header);
+        return typeof value === "string" ? value : undefined;
+    }
+    throw new TypeError(`${helper}() expects a Headers, an object with a .headers (e.g. Request), a raw ` +
+        "header string, or null/undefined. Node-style requests (Express, Fastify, Koa) " +
+        "expose a plain object instead - convert it first: " +
+        "new Headers(req.headers as Record<string, string>)");
+}
+//# sourceMappingURL=source.js.map

package/dist/src/http/source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source.js","sourceRoot":"","sources":["../../../src/http/source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,sEAAsE;AACtE,sEAAsE;AACtE,qEAAqE;AACrE,4DAA4D;AAC5D,SAAS,aAAa,CAAC,KAAc;IACpC,OAAO,CACN,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,OAAQ,KAAiB,CAAC,GAAG,KAAK,UAAU,CAC3F,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC9B,MAAoB,EACpB,MAAc,EACd,MAAc;IAEd,uEAAuE;IACvE,oEAAoE;IACpE,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC9D,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC9C,IAAI,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACtD,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,aAAa,CAAE,MAAgC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5F,MAAM,KAAK,GAAI,MAA+B,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnE,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACtD,CAAC;IACD,MAAM,IAAI,SAAS,CAClB,GAAG,MAAM,wEAAwE;QAChF,gFAAgF;QAChF,oDAAoD;QACpD,oDAAoD,CACrD,CAAC;AACH,CAAC"}

package/dist/src/key/import.js

@@ -12,7 +12,8 @@ import { validateHMACSecret } from "../lib/entropy.js";
 import { decodeBase64url } from "../lib/base64url.js";
 import { createLacewingKey, SetAlg, } from "../types.js";
 function expectedWebCryptoName(alg, info) {
-    if (alg === "EdDSA")
+    // Both `EdDSA` and `Ed25519` name the one OKP curve in the registry.
+    if (info.kty === "OKP")
         return "Ed25519";
     if (info.kty === "EC")
         return "ECDSA";

package/dist/src/key/import.js.map

@@ -1 +1 @@
-{"version":3,"file":"import.js","sourceRoot":"","sources":["../../../src/key/import.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAC1D,OAAO,EACN,kBAAkB,EAClB,eAAe,EACf,eAAe,GACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,sBAAsB,EAAsB,MAAM,sBAAsB,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EACN,iBAAiB,EACjB,MAAM,GAGN,MAAM,aAAa,CAAC;AAKrB,SAAS,qBAAqB,CAAC,GAAW,EAAE,IAAmB;IAC9D,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IACtC,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IACtC,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK;QAAE,OAAO,MAAM,CAAC;IACtC,sDAAsD;IACtD,OAAO,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC;AAC/D,CAAC;AAED,wEAAwE;AACxE,SAAS,YAAY,CAAC,GAAc;IACnC,OAAO,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;AACzD,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAc,EAAE,GAAW,EAAE,IAAmB;IACzE,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,IAAI,eAAe,CACxB,aAAa,GAAG,CAAC,GAAG,yBAAyB,GAAG,cAAc,IAAI,CAAC,GAAG,GAAG,CACzE,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QACpD,MAAM,IAAI,eAAe,CAAC,GAAG,GAAG,mBAAmB,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;QACpD,MAAM,IAAI,eAAe,CACxB,kEAAkE,CAClE,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACrD,MAAM,WAAW,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACtD,IAAI,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;YACnC,MAAM,IAAI,eAAe,CACxB,GAAG,GAAG,wCAAwC,IAAI,CAAC,UAAU,OAAO,CACpE,CAAC;QACH,CAAC;IACF,CAAC;AACF,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAc,EAAE,GAAW,EAAE,IAAmB;IAC/E,MAAM,SAAS,GAAG,GAAG,CAAC,SAAkD,CAAC;IACzE,IAAI,SAAS,CAAC,IAAI,KAAK,qBAAqB,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,eAAe,CACxB,wBAAwB,SAAS,CAAC,IAAI,yBAAyB,GAAG,EAAE,CACpE,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,SAAS,CAAC,UAAU,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5D,MAAM,IAAI,eAAe,CAAC,GAAG,GAAG,mBAAmB,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAChE,CAAC;AACF,CAAC;AAED,SAAS,YAAY,CAAC,QAAqB,EAAE,GAAW;IACvD,IAAI,MAAkB,CAAC;IACvB,IAAI,QAAQ,YAAY,UAAU,EAAE,CAAC;QACpC,MAAM,GAAG,QAAQ,CAAC;IACnB,CAAC;SAAM,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACzC,oEAAoE;QACpE,sEAAsE;QACtE,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,eAAe,CACxB,mDAAmD,CACnD,CAAC;QACH,CAAC;QACD,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;SAAM,IACN,OAAO,QAAQ,KAAK,QAAQ;QAC5B,QAAQ,KAAK,IAAI;QACjB,CAAC,CAAC,QAAQ,YAAY,SAAS,CAAC;QAChC,QAAQ,CAAC,GAAG,KAAK,KAAK;QACtB,OAAO,QAAQ,CAAC,CAAC,KAAK,QAAQ,EAC7B,CAAC;QACF,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC;SAAM,CAAC;QACP,MAAM,IAAI,eAAe,CACxB,uDAAuD,CACvD,CAAC;IACH,CAAC;IACD,kBAAkB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAChC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC9B,QAAqB,EACrB,GAAW,EACX,IAAmB;IAEnB,IAAI,QAAQ,YAAY,SAAS,EAAE,CAAC;QACnC,sBAAsB,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC;QAC9B,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YACnD,MAAM,IAAI,eAAe,CAAC,oCAAoC,GAAG,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,IAAI,QAAQ,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EAAE,CAAC;YACtD,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QACtE,CAAC;QACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,4BAA4B,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QACpE,CAAC;QACD,MAAM,IAAI,eAAe,CACxB,8EAA8E,CAC9E,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,YAAY,UAAU,EAAE,CAAC;QACpC,MAAM,IAAI,eAAe,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACvD,gBAAgB,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,SAAS,CAC1B,QAA2C,EAC3C,GAAG,CACH,CAAC;QACF,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;IACjD,CAAC;IACD,MAAM,IAAI,eAAe,CAAC,0BAA0B,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC9B,QAAqB,EACrB,SAAc;IAEd,MAAM,IAAI,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAoC,CAAC;IACjE,IAAI,CAAC;QACJ,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;YACxB,MAAM,EAAE,GAAG,EAAE,GAAG,YAAY,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAClD,OAAO,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC3E,OAAO,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IACC,KAAK,YAAY,eAAe;YAChC,KAAK,YAAY,kBAAkB;YACnC,KAAK,YAAY,eAAe,EAC/B,CAAC;YACF,MAAM,KAAK,CAAC;QACb,CAAC;QACD,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,CAAC;AACF,CAAC"}
+{"version":3,"file":"import.js","sourceRoot":"","sources":["../../../src/key/import.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAC1D,OAAO,EACN,kBAAkB,EAClB,eAAe,EACf,eAAe,GACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,sBAAsB,EAAsB,MAAM,sBAAsB,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EACN,iBAAiB,EACjB,MAAM,GAGN,MAAM,aAAa,CAAC;AAKrB,SAAS,qBAAqB,CAAC,GAAW,EAAE,IAAmB;IAC9D,qEAAqE;IACrE,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IACtC,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK;QAAE,OAAO,MAAM,CAAC;IACtC,sDAAsD;IACtD,OAAO,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC;AAC/D,CAAC;AAED,wEAAwE;AACxE,SAAS,YAAY,CAAC,GAAc;IACnC,OAAO,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;AACzD,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAc,EAAE,GAAW,EAAE,IAAmB;IACzE,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,IAAI,eAAe,CACxB,aAAa,GAAG,CAAC,GAAG,yBAAyB,GAAG,cAAc,IAAI,CAAC,GAAG,GAAG,CACzE,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QACpD,MAAM,IAAI,eAAe,CAAC,GAAG,GAAG,mBAAmB,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;QACpD,MAAM,IAAI,eAAe,CACxB,kEAAkE,CAClE,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACrD,MAAM,WAAW,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACtD,IAAI,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;YACnC,MAAM,IAAI,eAAe,CACxB,GAAG,GAAG,wCAAwC,IAAI,CAAC,UAAU,OAAO,CACpE,CAAC;QACH,CAAC;IACF,CAAC;AACF,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAc,EAAE,GAAW,EAAE,IAAmB;IAC/E,MAAM,SAAS,GAAG,GAAG,CAAC,SAAkD,CAAC;IACzE,IAAI,SAAS,CAAC,IAAI,KAAK,qBAAqB,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,eAAe,CACxB,wBAAwB,SAAS,CAAC,IAAI,yBAAyB,GAAG,EAAE,CACpE,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,SAAS,CAAC,UAAU,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5D,MAAM,IAAI,eAAe,CAAC,GAAG,GAAG,mBAAmB,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAChE,CAAC;AACF,CAAC;AAED,SAAS,YAAY,CAAC,QAAqB,EAAE,GAAW;IACvD,IAAI,MAAkB,CAAC;IACvB,IAAI,QAAQ,YAAY,UAAU,EAAE,CAAC;QACpC,MAAM,GAAG,QAAQ,CAAC;IACnB,CAAC;SAAM,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACzC,oEAAoE;QACpE,sEAAsE;QACtE,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,eAAe,CACxB,mDAAmD,CACnD,CAAC;QACH,CAAC;QACD,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;SAAM,IACN,OAAO,QAAQ,KAAK,QAAQ;QAC5B,QAAQ,KAAK,IAAI;QACjB,CAAC,CAAC,QAAQ,YAAY,SAAS,CAAC;QAChC,QAAQ,CAAC,GAAG,KAAK,KAAK;QACtB,OAAO,QAAQ,CAAC,CAAC,KAAK,QAAQ,EAC7B,CAAC;QACF,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC;SAAM,CAAC;QACP,MAAM,IAAI,eAAe,CACxB,uDAAuD,CACvD,CAAC;IACH,CAAC;IACD,kBAAkB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAChC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC9B,QAAqB,EACrB,GAAW,EACX,IAAmB;IAEnB,IAAI,QAAQ,YAAY,SAAS,EAAE,CAAC;QACnC,sBAAsB,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC;QAC9B,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YACnD,MAAM,IAAI,eAAe,CAAC,oCAAoC,GAAG,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,IAAI,QAAQ,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EAAE,CAAC;YACtD,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QACtE,CAAC;QACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,4BAA4B,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QACpE,CAAC;QACD,MAAM,IAAI,eAAe,CACxB,8EAA8E,CAC9E,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,YAAY,UAAU,EAAE,CAAC;QACpC,MAAM,IAAI,eAAe,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACvD,gBAAgB,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,SAAS,CAC1B,QAA2C,EAC3C,GAAG,CACH,CAAC;QACF,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;IACjD,CAAC;IACD,MAAM,IAAI,eAAe,CAAC,0BAA0B,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC9B,QAAqB,EACrB,SAAc;IAEd,MAAM,IAAI,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAoC,CAAC;IACjE,IAAI,CAAC;QACJ,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;YACxB,MAAM,EAAE,GAAG,EAAE,GAAG,YAAY,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAClD,OAAO,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC3E,OAAO,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IACC,KAAK,YAAY,eAAe;YAChC,KAAK,YAAY,kBAAkB;YACnC,KAAK,YAAY,eAAe,EAC/B,CAAC;YACF,MAAM,KAAK,CAAC;QACb,CAAC;QACD,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,CAAC;AACF,CAAC"}

package/dist/src/lib/algorithms.js

@@ -6,11 +6,18 @@
  * one-entry change here (cryptographic agility, §3.2.4). Legacy interop
  * algorithms can only enter through `registerLegacyAlgorithm`, which is
  * reachable exclusively via the explicit `legacy/` imports.
+ *
+ * Entries are frozen because `getAlgorithmProperties` is public through
+ * `lacewing/extension`: a mutable entry handed to another package would let
+ * it lower `minKeyBits` for every key Lacewing imports afterwards.
  */
 import { AlgorithmNotAllowed } from "../util/errors.js";
 import { SetAlg } from "../types.js";
 const CORE_ALGORITHMS = [
     { name: "EdDSA", kty: "OKP", crv: "Ed25519", minKeyBits: 256 },
+    // RFC 9864's fully-specified name for the same Ed25519 signature. Some
+    // clients (oauth4webapi among them) only ever write this one.
+    { name: "Ed25519", kty: "OKP", crv: "Ed25519", minKeyBits: 256 },
     { name: "ES256", kty: "EC", crv: "P-256", minKeyBits: 256 },
     { name: "ES384", kty: "EC", crv: "P-384", minKeyBits: 384 },
     { name: "ES512", kty: "EC", crv: "P-521", minKeyBits: 521 },
@@ -22,7 +29,7 @@ const CORE_ALGORITHMS = [
     { name: "HS384", kty: "oct", minKeyBits: 384 },
     { name: "HS512", kty: "oct", minKeyBits: 512 },
 ];
-const registry = new Map(CORE_ALGORITHMS.map((info) => [info.name, info]));
+const registry = new Map(CORE_ALGORITHMS.map((info) => [info.name, Object.freeze(info)]));
 /** Type guard: is this exact string an allowed algorithm? Case sensitive. */
 export function isValidAlgorithm(alg) {
     return registry.has(alg);
@@ -54,7 +61,7 @@ export function registerLegacyAlgorithm(info) {
         throw new AlgorithmNotAllowed("Algorithm 'none' is not allowed");
     }
     if (!registry.has(info.name)) {
-        registry.set(info.name, info);
+        registry.set(info.name, Object.freeze({ ...info }));
     }
 }
 //# sourceMappingURL=algorithms.js.map

package/dist/src/lib/algorithms.js.map

@@ -1 +1 @@
-{"version":3,"file":"algorithms.js","sourceRoot":"","sources":["../../../src/lib/algorithms.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,MAAM,EAAiB,MAAM,aAAa,CAAC;AAapD,MAAM,eAAe,GAA6B;IACjD,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE;IAC9D,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE;IAC3D,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE;IAC3D,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE;IAC3D,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE;IAC/C,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE;IAC/C,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE;IAC/C,yEAAyE;IACzE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE;IAC9C,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE;IAC9C,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE;CAC9C,CAAC;AAEF,MAAM,QAAQ,GAAG,IAAI,GAAG,CACvB,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAChD,CAAC;AAEF,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC3C,OAAO,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,sBAAsB,CAAC,GAAW;IACjD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxB,mEAAmE;QACnE,MAAM,IAAI,mBAAmB,CAAC,4CAA4C,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,UAAU,CAAC,GAAW;IACrC,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC5B,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;AACpB,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,cAAc;IAC7B,OAAO,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAmB;IAC1D,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;QACxC,MAAM,IAAI,mBAAmB,CAAC,iCAAiC,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;AACF,CAAC"}
+{"version":3,"file":"algorithms.js","sourceRoot":"","sources":["../../../src/lib/algorithms.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,MAAM,EAAiB,MAAM,aAAa,CAAC;AAapD,MAAM,eAAe,GAA6B;IACjD,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE;IAC9D,uEAAuE;IACvE,8DAA8D;IAC9D,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE;IAChE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE;IAC3D,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE;IAC3D,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE;IAC3D,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE;IAC/C,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE;IAC/C,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE;IAC/C,yEAAyE;IACzE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE;IAC9C,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE;IAC9C,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE;CAC9C,CAAC;AAEF,MAAM,QAAQ,GAAG,IAAI,GAAG,CACvB,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAC/D,CAAC;AAEF,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC3C,OAAO,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,sBAAsB,CAAC,GAAW;IACjD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxB,mEAAmE;QACnE,MAAM,IAAI,mBAAmB,CAAC,4CAA4C,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,UAAU,CAAC,GAAW;IACrC,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC5B,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;AACpB,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,cAAc;IAC7B,OAAO,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAmB;IAC1D,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;QACxC,MAAM,IAAI,mBAAmB,CAAC,iCAAiC,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;IACrD,CAAC;AACF,CAAC"}

package/dist/src/lib/duration.js

@@ -14,6 +14,9 @@ export function parseDuration(value) {
     if (typeof value === "number") {
         return toSeconds(value);
     }
+    if (typeof value !== "string") {
+        throw new TypeError("Duration must be a number of seconds or a string like \"15m\"");
+    }
     const match = DURATION.exec(value.trim());
     if (match === null) {
         throw new TypeError(`Invalid duration "${value}" - use seconds or "30s" / "15m" / "1h" / "7d"`);

package/dist/src/lib/duration.js.map

@@ -1 +1 @@
-{"version":3,"file":"duration.js","sourceRoot":"","sources":["../../../src/lib/duration.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,SAAS,EAAwB,MAAM,aAAa,CAAC;AAE9D,MAAM,QAAQ,GAAG,sBAAsB,CAAC;AAExC,MAAM,UAAU,GAA2B;IAC1C,CAAC,EAAE,CAAC;IACJ,CAAC,EAAE,EAAE;IACL,CAAC,EAAE,IAAI;IACP,CAAC,EAAE,KAAK;CACR,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,KAAsB;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,SAAS,CAClB,qBAAqB,KAAK,gDAAgD,CAC1E,CAAC;IACH,CAAC;IACD,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC;IAC/B,OAAO,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,GAAI,UAAU,CAAC,IAAc,CAAY,CAAC,CAAC;AAC3E,CAAC"}
+{"version":3,"file":"duration.js","sourceRoot":"","sources":["../../../src/lib/duration.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,SAAS,EAAwB,MAAM,aAAa,CAAC;AAE9D,MAAM,QAAQ,GAAG,sBAAsB,CAAC;AAExC,MAAM,UAAU,GAA2B;IAC1C,CAAC,EAAE,CAAC;IACJ,CAAC,EAAE,EAAE;IACL,CAAC,EAAE,IAAI;IACP,CAAC,EAAE,KAAK;CACR,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,KAAsB;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,SAAS,CAAC,+DAA+D,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,SAAS,CAClB,qBAAqB,KAAK,gDAAgD,CAC1E,CAAC;IACH,CAAC;IACD,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC;IAC/B,OAAO,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,GAAI,UAAU,CAAC,IAAc,CAAY,CAAC,CAAC;AAC3E,CAAC"}

package/dist/types/index.d.ts

@@ -23,6 +23,7 @@ export { buildRevocationContext } from "./src/revocation/store.js";
 export { MemoryRevocationStore } from "./src/revocation/memory.js";
 export { buildTokenCookie, setTokenCookie, clearTokenCookie, readTokenCookie, type TokenCookieOptions, } from "./src/http/cookies.js";
 export { parseBearer } from "./src/http/bearer.js";
+export { type HeaderSource } from "./src/http/source.js";
 export { unsafeDecode } from "./src/util/unsafe-decode.js";
 export { JWTError, JWTInvalid, JWTExpired, JWTClaimValidationFailed, MissingClaim, AlgorithmNotAllowed, KeyImportFailed, KeyExportFailed, KeyTypeMismatch, EntropyCheckFailed, JWKSFetchFailed, JWKSNoMatchingKey, JWTRevoked, RevocationCheckFailed, PayloadHygieneViolation, MaxLifetimeExceeded, BearerParseFailed, } from "./src/util/errors.js";
 export { toSeconds, type ClaimsPolicy, type DecryptedJwt, type DurationSeconds, type ExpectedDecryptionProfile, type ExpectedJwtProfile, type JweHeader, type JwtHeader, type LacewingEncryptionKey, type JwtPayLoad, type JWKSConfig, type KeySource, type LacewingKey, type RemoteJWKS, type ResolvedVerificationKey, type RevocationStore, type StaticJWK, type StaticJWKS, type TokenRevocationContext, type UntrustedJwt, type ValidAlg, type ValidateClaim, type VerifiedJwt, } from "./src/types.js";

package/dist/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,aAAa,EAAE,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGhD,OAAO,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGjE,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EACN,uBAAuB,EACvB,KAAK,wBAAwB,GAC7B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACN,yBAAyB,EACzB,wBAAwB,EACxB,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,qBAAqB,EAC1B,KAAK,gCAAgC,GACrC,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACN,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,KAAK,mBAAmB,GACxB,MAAM,kCAAkC,CAAC;AAG1C,OAAO,EAAE,SAAS,EAAE,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EACN,eAAe,EACf,cAAc,EACd,KAAK,sBAAsB,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,KAAK,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAGpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAGnE,OAAO,EACN,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,KAAK,kBAAkB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAGnD,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAG3D,OAAO,EACN,QAAQ,EACR,UAAU,EACV,UAAU,EACV,wBAAwB,EACxB,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,UAAU,EACV,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,EACnB,iBAAiB,GACjB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACN,SAAS,EACT,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EACvB,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,qBAAqB,EAC1B,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,uBAAuB,EAC5B,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,sBAAsB,EAC3B,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,aAAa,EAClB,KAAK,WAAW,GAChB,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,aAAa,EAAE,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGhD,OAAO,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGjE,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EACN,uBAAuB,EACvB,KAAK,wBAAwB,GAC7B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACN,yBAAyB,EACzB,wBAAwB,EACxB,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,qBAAqB,EAC1B,KAAK,gCAAgC,GACrC,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACN,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,KAAK,mBAAmB,GACxB,MAAM,kCAAkC,CAAC;AAG1C,OAAO,EAAE,SAAS,EAAE,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EACN,eAAe,EACf,cAAc,EACd,KAAK,sBAAsB,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,KAAK,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAGpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAGnE,OAAO,EACN,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,KAAK,kBAAkB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGzD,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAG3D,OAAO,EACN,QAAQ,EACR,UAAU,EACV,UAAU,EACV,wBAAwB,EACxB,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,UAAU,EACV,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,EACnB,iBAAiB,GACjB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACN,SAAS,EACT,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EACvB,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,qBAAqB,EAC1B,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,uBAAuB,EAC5B,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,sBAAsB,EAC3B,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,aAAa,EAClB,KAAK,WAAW,GAChB,MAAM,gBAAgB,CAAC"}

package/dist/types/src/extension.d.ts

@@ -0,0 +1,16 @@
+/**
+ * `lacewing/extension`: the policy Lacewing already enforces, for packages
+ * that build on it and must not drift from it.
+ *
+ * Covered by semver like the root export. Everything here is read-only:
+ * registry entries are frozen, and nothing that adds to the registry
+ * (`registerLegacyAlgorithm`) or weakens a check is reachable from this
+ * path. Header validation (`validateHeader`) is deliberately absent too:
+ * it refuses an embedded `jwk`, which is right for a token and wrong for
+ * any format that carries its own key, so each format owns its header
+ * rules.
+ */
+export { getAlgorithmProperties, type AlgorithmInfo } from "./lib/algorithms.js";
+export { parseDuration } from "./lib/duration.js";
+export { readHeaderValue, type HeaderSource } from "./http/source.js";
+//# sourceMappingURL=extension.d.ts.map

package/dist/types/src/extension.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extension.d.ts","sourceRoot":"","sources":["../../../src/extension.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,sBAAsB,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/types/src/http/bearer.d.ts

@@ -5,6 +5,7 @@
  * logs and the Referer header), multiple tokens, alternate casings and
  * whitespace tricks. One header, one scheme, one token.
  */
+import { type HeaderSource } from "./source.js";
 /**
  * Extract the bearer token from an `Authorization` header. Accepts a
  * `Headers` object, anything with a `.headers` (e.g. `Request`), or the
@@ -13,8 +14,10 @@
  *
  * Note: when multiple `Authorization` headers were sent, `Headers`
  * joins them with `", "` - which this parser rejects, by design.
+ *
+ * A shape this library does not accept - notably a Node/Express
+ * request, whose `headers` is a plain record - throws {@link TypeError}
+ * rather than the misleading "missing header" it used to report.
  */
-export declare function parseBearer(source: Headers | {
-    headers: Headers;
-} | string | null | undefined): string;
+export declare function parseBearer(source: HeaderSource): string;
 //# sourceMappingURL=bearer.d.ts.map

package/dist/types/src/http/bearer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bearer.d.ts","sourceRoot":"","sources":["../../../../src/http/bearer.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAQH;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAC1B,MAAM,EAAE,OAAO,GAAG;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,GAChE,MAAM,CAsBR"}
+{"version":3,"file":"bearer.d.ts","sourceRoot":"","sources":["../../../../src/http/bearer.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAmB,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAMjE;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAexD"}

package/dist/types/src/http/cookies.d.ts

@@ -9,6 +9,7 @@
  * Framework-agnostic: works on WHATWG `Headers` (and anything exposing
  * them, e.g. `Request`/`Response`).
  */
+import { type HeaderSource } from "./source.js";
 export interface TokenCookieOptions {
     /** Cookie name (default `__Host-token`, the most locked-down prefix). */
     name?: string;
@@ -31,8 +32,11 @@ export declare function clearTokenCookie(headers: Headers, options?: Pick<TokenC
  * Read a token cookie from a request. Accepts a `Headers` object,
  * anything with a `.headers` (e.g. `Request`), or the raw `Cookie`
  * header string. Returns `undefined` when absent or malformed.
+ *
+ * Throws {@link TypeError} on a shape it does not accept - notably a
+ * Node/Express request, whose `headers` is a plain record. "I was
+ * handed something I don't understand" must not be indistinguishable
+ * from "this request carried no token".
  */
-export declare function readTokenCookie(source: Headers | {
-    headers: Headers;
-} | string | null | undefined, name?: string): string | undefined;
+export declare function readTokenCookie(source: HeaderSource, name?: string): string | undefined;
 //# sourceMappingURL=cookies.d.ts.map

package/dist/types/src/http/cookies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../../../src/http/cookies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAQH,MAAM,WAAW,kBAAkB;IAClC,yEAAyE;IACzE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAC;IAC5B,mDAAmD;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wCAAwC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAuB,GAAG,MAAM,CAwCxF;AAED,8DAA8D;AAC9D,wBAAgB,cAAc,CAC7B,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,kBAAuB,GAC9B,IAAI,CAEN;AAED,4CAA4C;AAC5C,wBAAgB,gBAAgB,CAC/B,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,MAAM,GAAG,QAAQ,CAAM,GAChE,IAAI,CAKN;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC9B,MAAM,EAAE,OAAO,GAAG;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,EAClE,IAAI,GAAE,MAA4B,GAChC,MAAM,GAAG,SAAS,CAyBpB"}
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../../../src/http/cookies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAmB,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAQjE,MAAM,WAAW,kBAAkB;IAClC,yEAAyE;IACzE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAC;IAC5B,mDAAmD;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wCAAwC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAuB,GAAG,MAAM,CAwCxF;AAED,8DAA8D;AAC9D,wBAAgB,cAAc,CAC7B,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,kBAAuB,GAC9B,IAAI,CAEN;AAED,4CAA4C;AAC5C,wBAAgB,gBAAgB,CAC/B,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,MAAM,GAAG,QAAQ,CAAM,GAChE,IAAI,CAKN;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC9B,MAAM,EAAE,YAAY,EACpB,IAAI,GAAE,MAA4B,GAChC,MAAM,GAAG,SAAS,CAkBpB"}

package/dist/types/src/http/source.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Header-source narrowing shared by the cookie and bearer readers.
+ *
+ * The contract is deliberately narrow: WHATWG `Headers` (or anything
+ * carrying them, e.g. `Request`) or the raw header string. Node's
+ * `IncomingMessage.headers` is a plain record, not `Headers`, and is
+ * *not* accepted - callers on Express/Fastify/Koa convert once at the
+ * edge rather than making every reader here carry a second shape.
+ *
+ * What matters is that an unrecognized shape throws instead of reading
+ * as "header absent". A helper that silently returns nothing for an
+ * argument it never understood is one people route around, and the
+ * hand-rolled replacement has none of the ambiguity refusals below.
+ */
+/** Anything the readers accept. `null`/`undefined` mean "header absent". */
+export type HeaderSource = Headers | {
+    headers: Headers;
+} | string | null | undefined;
+/**
+ * Read one header from an accepted source. Returns `undefined` when the
+ * header is absent; throws {@link TypeError} when `source` is a shape
+ * this library does not accept.
+ *
+ * @param helper - calling helper's name, used in the error message.
+ */
+export declare function readHeaderValue(source: HeaderSource, header: string, helper: string): string | undefined;
+//# sourceMappingURL=source.d.ts.map

package/dist/types/src/http/source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../../../../src/http/source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,4EAA4E;AAC5E,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;AAYtF;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC9B,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACZ,MAAM,GAAG,SAAS,CAmBpB"}

package/dist/types/src/key/import.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"import.d.ts","sourceRoot":"","sources":["../../../../src/key/import.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAWH,OAAO,EAGN,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,MAAM,aAAa,CAAC;AAErB,0EAA0E;AAC1E,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;AAuHtE;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,KAAK,CAAC,GAAG,SAAS,MAAM,EACvD,QAAQ,EAAE,WAAW,EACrB,SAAS,EAAE,GAAG,GACZ,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAoB3B"}
+{"version":3,"file":"import.d.ts","sourceRoot":"","sources":["../../../../src/key/import.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAWH,OAAO,EAGN,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,MAAM,aAAa,CAAC;AAErB,0EAA0E;AAC1E,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;AAwHtE;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,KAAK,CAAC,GAAG,SAAS,MAAM,EACvD,QAAQ,EAAE,WAAW,EACrB,SAAS,EAAE,GAAG,GACZ,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAoB3B"}

package/dist/types/src/lib/algorithms.d.ts

@@ -6,6 +6,10 @@
  * one-entry change here (cryptographic agility, §3.2.4). Legacy interop
  * algorithms can only enter through `registerLegacyAlgorithm`, which is
  * reachable exclusively via the explicit `legacy/` imports.
+ *
+ * Entries are frozen because `getAlgorithmProperties` is public through
+ * `lacewing/extension`: a mutable entry handed to another package would let
+ * it lower `minKeyBits` for every key Lacewing imports afterwards.
  */
 import { type ValidAlg } from "../types.js";
 export interface AlgorithmInfo {

package/dist/types/src/lib/algorithms.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"algorithms.d.ts","sourceRoot":"","sources":["../../../../src/lib/algorithms.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAU,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEpD,MAAM,WAAW,aAAa;IAC7B,+CAA+C;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8CAA8C;IAC9C,QAAQ,CAAC,GAAG,EAAE,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,KAAK,CAAC;IAC3C,yCAAyC;IACzC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC5B;AAoBD,6EAA6E;AAC7E,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAErD;AAED,+EAA+E;AAC/E,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,CAOjE;AAED,8EAA8E;AAC9E,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ,CAGhD;AAED,wEAAwE;AACxE,wBAAgB,cAAc,IAAI,MAAM,EAAE,CAEzC;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI,CAOjE"}
+{"version":3,"file":"algorithms.d.ts","sourceRoot":"","sources":["../../../../src/lib/algorithms.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAU,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEpD,MAAM,WAAW,aAAa;IAC7B,+CAA+C;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8CAA8C;IAC9C,QAAQ,CAAC,GAAG,EAAE,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,KAAK,CAAC;IAC3C,yCAAyC;IACzC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC5B;AAuBD,6EAA6E;AAC7E,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAErD;AAED,+EAA+E;AAC/E,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,CAOjE;AAED,8EAA8E;AAC9E,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ,CAGhD;AAED,wEAAwE;AACxE,wBAAgB,cAAc,IAAI,MAAM,EAAE,CAEzC;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI,CAOjE"}

package/dist/types/src/lib/duration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"duration.d.ts","sourceRoot":"","sources":["../../../../src/lib/duration.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAa,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAW9D,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,eAAe,CAYrE"}
+{"version":3,"file":"duration.d.ts","sourceRoot":"","sources":["../../../../src/lib/duration.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAa,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAW9D,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,eAAe,CAerE"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "lacewing",
-	"version": "1.0.1",
+	"version": "1.1.0",
 	"description": "An opinionated JWT library that makes RFC 8725 (JWT Best Current Practices) the default behavior, not an optional configuration.",
 	"type": "module",
 	"engines": {
@@ -13,6 +13,10 @@
 			"types": "./dist/types/index.d.ts",
 			"default": "./dist/index.js"
 		},
+		"./extension": {
+			"types": "./dist/types/src/extension.d.ts",
+			"default": "./dist/src/extension.js"
+		},
 		"./legacy/rs256": {
 			"types": "./dist/types/src/legacy/rs256.d.ts",
 			"default": "./dist/src/legacy/rs256.js"
@@ -28,6 +32,7 @@
 		"lint": "eslint .",
 		"lint:fix": "eslint . --fix",
 		"test": "node --import tsx --test \"tests/**/*.test.ts\"",
+		"test:dist": "npm run build && node --test \"tests/dist/*.test.js\"",
 		"test:tap": "node --import tsx --test --test-reporter=tap \"tests/**/*.test.ts\"",
 		"compliance": "node --import tsx tools/run-compliance.ts",
 		"demo": "node --import tsx examples/demo.ts",
@@ -51,20 +56,20 @@
 		"url": "git+https://github.com/grMLEqomlkkU5Eeinz4brIrOVCUCkJuN/lacewing.git"
 	},
 	"devDependencies": {
-		"@commitlint/cli": "^21.2.1",
-		"@commitlint/config-conventional": "^21.2.0",
+		"@commitlint/cli": "^21.2.2",
+		"@commitlint/config-conventional": "^21.2.2",
 		"@eslint/js": "^10.0.1",
-		"@types/node": "^26.1.1",
-		"eslint": "^10.8.0",
+		"@types/node": "^26.2.0",
+		"eslint": "^10.9.0",
 		"fast-check": "^4.9.0",
 		"git-cliff": "^2.13.1",
 		"lefthook": "^2.1.10",
-		"tsx": "^4.23.1",
+		"tsx": "^4.23.12",
 		"typedoc": "^0.28.20",
 		"typescript": "^6.0.3",
-		"typescript-eslint": "^8.65.0"
+		"typescript-eslint": "^8.67.0"
 	},
 	"dependencies": {
-		"jose": "^6.2.4"
+		"jose": "^6.2.10"
 	}
 }