@pq-jwt/core - npm Package Compare versions

Comparing version 1.0.5 to 1.0.6

CHANGELOG.md

 # Changelog
 
+## 1.0.6 — 2026-05-16
+
+### Added
+
+- `notBefore` option on `sign()` — sets `nbf` via `parseDuration()` (same format as `expiresIn`)
+- `clockTolerance` option on `verify()` — seconds of allowed clock skew for `exp` and `nbf` (default `0`)
+
 ## 1.0.5 — 2026-05-16
@@ -4,0 +11,0 @@

package.json

 {
   "name": "@pq-jwt/core",
-  "version": "1.0.5",
+  "version": "1.0.6",
   "description": "Post-quantum JWT library using NIST-standardized ML-DSA and SLH-DSA. Drop-in successor to RS256/ES256.",
@@ -5,0 +5,0 @@ "type": "module",

src/index.d.ts

 /**
  * @package     @pq-jwt/core
  * @author      Sachin Ruhil <[e-mail]>
- * @version     1.0.5
+ * @version     1.0.6
  * @license     MIT
  * @description Post-quantum JWT library — NIST FIPS 204 (ML-DSA) + FIPS 205 (SLH-DSA)
- * @copyright   2025 Sachin Ruhil. All rights reserved.
+ * @copyright   2026 Sachin Ruhil. All rights reserved.
  * @see         https://github.com/pq-jwt/PQ-JWT
@@ -24,2 +24,3 @@ */
   expiresIn?: number | string;
+  notBefore?: number | string;
   issuer?: string;
@@ -37,2 +38,3 @@ subject?: string;
   ignoreExpiry?: boolean;
+  clockTolerance?: number;
 }
@@ -39,0 +41,0 @@

src/index.mjs

 /**
  * @package     @pq-jwt/core
  * @author      Sachin Ruhil <[e-mail]>
- * @version     1.0.5
+ * @version     1.0.6
  * @license     MIT
  * @description Post-quantum JWT library — NIST FIPS 204 (ML-DSA) + FIPS 205 (SLH-DSA)
- * @copyright   2025 Sachin Ruhil. All rights reserved.
+ * @copyright   2026 Sachin Ruhil. All rights reserved.
  * @see         https://github.com/pq-jwt/PQ-JWT
@@ -171,2 +171,4 @@ */
   if (options.jwtId) claims.jti = options.jwtId;
+  if (options.notBefore !== undefined)
+    claims.nbf = now + parseDuration(options.notBefore);
 
@@ -246,10 +248,16 @@ const headerEncoded = encodeJSON(header);
 
-  if (!options.ignoreExpiry && payload.exp !== undefined)
-    if (now > payload.exp) throw new TokenExpiredError(payload.exp);
+  if (!options.ignoreExpiry && payload.exp !== undefined) {
+    const tolerance = options.clockTolerance ?? 0;
+    if (now > payload.exp + tolerance)
+      throw new TokenExpiredError(payload.exp);
+  }
 
-  if (payload.nbf !== undefined && now < payload.nbf)
-    throw new PQJWTError(
-      `Token not valid before ${new Date(payload.nbf * 1000).toISOString()}`,
-      "TOKEN_NOT_YET_VALID",
-    );
+  if (payload.nbf !== undefined) {
+    const tolerance = options.clockTolerance ?? 0;
+    if (now < payload.nbf - tolerance)
+      throw new PQJWTError(
+        `Token not valid before ${new Date(payload.nbf * 1000).toISOString()}`,
+        "TOKEN_NOT_YET_VALID",
+      );
+  }
 
@@ -256,0 +264,0 @@ if (options.issuer && payload.iss !== options.issuer)

No alert changes

Improved metrics

Total package byte prevSize

23071

2.47%

Lines of code

353

2.92%

No dependency changes