release: WRNexusJS 0.4.0

packages/jwt/test/jwt.test.ts

@@ -1,6 +1,6 @@
 import { test, expect } from "bun:test";
 import { createContext } from "@wrnexus/core";
-import { signJwt, verifyJwt, jwtAuth, JwtError } from "../src/index.ts";
+import { createJwtKeyring, signJwt, verifyJwt, jwtAuth, JwtError } from "../src/index.ts";
 
 const SECRET = "test-secret-key";
 
@@ -63,3 +63,17 @@ test("jwtAuth optional mode passes through anonymously", async () => {
   expect(res.status).toBe(200);
   expect(ctx.user).toBeUndefined();
 });
+
+test("JWT keyrings reject duplicates and return defensive copies", () => {
+  expect(() =>
+    createJwtKeyring([
+      { id: "one", secret: "secret-one" },
+      { id: "one", secret: "secret-two" },
+    ]),
+  ).toThrow("DUPLICATE");
+
+  const keyring = createJwtKeyring([{ id: "one", secret: "secret-one", active: true }]);
+  const key = keyring.active();
+  key.secret = "changed";
+  expect(keyring.active().secret).toBe("secret-one");
+});