kid -> HMAC secret. A plain Map lookup by design: a kid must never be
interpreted as a path or URL (kid-injection). With exactly one key, a
token without a kid falls back to it; with several, kid is required.
Optionalnow
now?:()=>number
Epoch-ms clock, injectable for tests. Default Date.now.
kid -> HMAC secret. A plain Map lookup by design: a kid must never be interpreted as a path or URL (kid-injection). With exactly one key, a token without a kid falls back to it; with several, kid is required.