Address copilot pass 5 on #4

The comment said the JWT lifetime is "capped at 5 minutes" but
the code only used 5 minutes as a default — callers could pass
arbitrarily large lifetimeSec and produce tokens the JSS verifier
would later reject for exceeding MAX_LIFETIME (3600s).

Now enforces the same 3600s cap at sign time so we don't mint
tokens the server will refuse, and rejects non-numeric / non-positive
input. Comment updated to describe the actual behavior (default
300s, enforced cap 3600s, matches server).

Author: melvincarvalho

lib/lws-cid-client.js

@@ -106,13 +106,19 @@ export function buildEs256kVerificationMethod({ privKey, webId, controller, frag
 
 // --- JWT signing -----------------------------------------------------
 
+// Hard cap on token lifetime (exp − iat) — matches the JSS verifier's
+// MAX_LIFETIME so we never mint a token the server would reject for
+// being too long-lived, regardless of what callers pass.
+const MAX_LIFETIME_SEC = 3600;
+
 /**
  * Sign an LWS10-CID JWT.
  *
  * Per the FPWD §4: sub === iss === client_id (all the WebID URI), aud
- * is the target server origin, exp/iat are required. Lifetime capped
- * at 5 minutes — the verifier rejects > 1h, but short tokens limit
- * the replay window if one leaks anyway.
+ * is the target server origin, exp/iat are required. Default lifetime
+ * is 5 minutes; callers can override but must stay ≤ 1 hour (the
+ * server's MAX_LIFETIME) — anything longer is rejected here at sign
+ * time so we don't produce tokens the verifier will refuse.
  *
  * @param {object} args
  * @param {Uint8Array|string} args.privKey
@@ -123,6 +129,15 @@ export function buildEs256kVerificationMethod({ privKey, webId, controller, frag
  * @returns {Promise<string>} compact JWS
  */
 export async function signLwsCidJwt({ privKey, kid, webId, audience, lifetimeSec = 300 }) {
+  if (typeof lifetimeSec !== 'number' || !Number.isFinite(lifetimeSec) || lifetimeSec <= 0) {
+    throw new Error('lifetimeSec must be a positive number');
+  }
+  if (lifetimeSec > MAX_LIFETIME_SEC) {
+    throw new Error(
+      `lifetimeSec ${lifetimeSec} exceeds MAX_LIFETIME_SEC (${MAX_LIFETIME_SEC}) — ` +
+      `the server would reject this token`,
+    );
+  }
   const priv = privKey instanceof Uint8Array ? privKey : validatePrivKey(privKey);
   const now = Math.floor(Date.now() / 1000);
   const header = { alg: 'ES256K', typ: 'JWT', kid };