@naman_deep_singh/security 1.4.0 → 1.5.0

package/README.md

@@ -1,7 +1,7 @@
 ```bash
 @naman_deep_singh/security
 
-Version: 1.4.0
+Version: 1.5.0
 
 A complete, lightweight security toolkit for Node.js & TypeScript providing:
 

package/dist/cjs/core/crypto/cryptoManager.js

@@ -38,10 +38,10 @@ class CryptoManager {
         try {
             return (0, index_1.encrypt)(plaintext, key);
         }
-        catch (err) {
-            throw new errors_utils_1.InternalServerError(undefined, {
-                message: 'Encryption failed',
-            }, err instanceof Error ? err : undefined);
+        catch (error) {
+            throw new errors_utils_1.CryptoIntegrityError({
+                reason: 'Encryption failed',
+            }, error instanceof Error ? error : undefined);
         }
     }
     /**
@@ -51,10 +51,10 @@ class CryptoManager {
         try {
             return (0, index_1.decrypt)(encryptedData, key);
         }
-        catch (err) {
-            throw new errors_utils_1.InternalServerError(undefined, {
-                message: 'Decryption failed',
-            }, err instanceof Error ? err : undefined);
+        catch (error) {
+            throw new errors_utils_1.CryptoIntegrityError({
+                reason: 'Decryption failed',
+            }, error instanceof Error ? error : undefined);
         }
     }
     /**
@@ -85,11 +85,11 @@ class CryptoManager {
     deriveKey(password, salt, iterations = 100000, keyLength = 32) {
         return new Promise((resolve, reject) => {
             const crypto = require('crypto');
-            crypto.pbkdf2(password, salt, iterations, keyLength, 'sha256', (err, derivedKey) => {
-                if (err) {
-                    reject(new errors_utils_1.InternalServerError(undefined, {
-                        message: 'Key derivation failed',
-                    }, err instanceof Error ? err : undefined));
+            crypto.pbkdf2(password, salt, iterations, keyLength, 'sha256', (error, derivedKey) => {
+                if (error) {
+                    reject(new errors_utils_1.CryptoIntegrityError({
+                        reason: 'Key derivation failed',
+                    }, error instanceof Error ? error : undefined));
                 }
                 else {
                     resolve(derivedKey.toString('hex'));
@@ -166,10 +166,10 @@ class CryptoManager {
                 const signature = sign.sign(privateKey, 'base64');
                 resolve(signature);
             }
-            catch (err) {
-                reject(new errors_utils_1.InternalServerError(undefined, {
-                    message: 'RSA signing failed',
-                }, err instanceof Error ? err : undefined));
+            catch (error) {
+                reject(new errors_utils_1.CryptoIntegrityError({
+                    reason: 'RSA signing failed',
+                }, error instanceof Error ? error : undefined));
             }
         });
     }
@@ -186,10 +186,10 @@ class CryptoManager {
                 const isValid = verify.verify(publicKey, signature, 'base64');
                 resolve(isValid);
             }
-            catch (err) {
-                reject(new errors_utils_1.InternalServerError(undefined, {
-                    message: 'RSA verification failed',
-                }, err instanceof Error ? err : undefined));
+            catch (error) {
+                reject(new errors_utils_1.CryptoIntegrityError({
+                    reason: 'RSA verification failed',
+                }, error instanceof Error ? error : undefined));
             }
         });
     }

package/dist/cjs/core/jwt/decode.js

@@ -2,9 +2,9 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.decodeToken = decodeToken;
 exports.decodeTokenStrict = decodeTokenStrict;
+const errors_utils_1 = require("@naman_deep_singh/errors-utils");
 // src/jwt/decodeToken.ts
 const jsonwebtoken_1 = require("jsonwebtoken");
-const errors_utils_1 = require("@naman_deep_singh/errors-utils");
 /**
  * Flexible decode
  * Returns: null | string | JwtPayload
@@ -21,7 +21,7 @@ function decodeTokenStrict(token) {
     const decoded = (0, jsonwebtoken_1.decode)(token);
     if (!decoded || typeof decoded === 'string') {
         throw new errors_utils_1.BadRequestError({
-            message: 'Invalid JWT payload structure',
+            reason: 'Invalid JWT payload structure',
         });
     }
     return decoded;

package/dist/cjs/core/jwt/generateTokens.js

@@ -2,9 +2,9 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.generateTokens = void 0;
 exports.rotateRefreshToken = rotateRefreshToken;
+const errors_utils_1 = require("@naman_deep_singh/errors-utils");
 const signToken_1 = require("./signToken");
 const verify_1 = require("./verify");
-const errors_utils_1 = require("@naman_deep_singh/errors-utils");
 // Helper function to create branded tokens
 /* const createBrandedToken = <T extends string>(token: string, _brand: T): T => {
     return token as T
@@ -26,7 +26,7 @@ function rotateRefreshToken(oldToken, secret) {
     const decoded = (0, verify_1.verifyToken)(oldToken, secret);
     if (typeof decoded === 'string') {
         throw new errors_utils_1.TokenMalformedError({
-            message: 'Invalid token payload — expected JWT payload object',
+            reason: 'Invalid token payload — expected JWT payload object',
         });
     }
     const payload = { ...decoded };

package/dist/cjs/core/jwt/jwtManager.js

@@ -31,33 +31,37 @@ class JWTManager {
         catch (error) {
             if (error instanceof errors_utils_1.BadRequestError || error instanceof errors_utils_1.ValidationError)
                 throw error;
-            throw new errors_utils_1.BadRequestError({ message: 'Failed to generate tokens' }, error instanceof Error ? error : undefined);
+            throw new errors_utils_1.BadRequestError({ reason: 'Failed to generate tokens' }, error instanceof Error ? error : undefined);
         }
     }
     /** Generate access token */
     async generateAccessToken(payload) {
         try {
             this.validatePayload(payload);
-            const token = (0, signToken_1.signToken)(payload, this.accessSecret, this.accessExpiry, { algorithm: 'HS256' });
+            const token = (0, signToken_1.signToken)(payload, this.accessSecret, this.accessExpiry, {
+                algorithm: 'HS256',
+            });
             return token;
         }
         catch (error) {
             if (error instanceof errors_utils_1.BadRequestError || error instanceof errors_utils_1.ValidationError)
                 throw error;
-            throw new errors_utils_1.BadRequestError({ message: 'Failed to generate access token' }, error instanceof Error ? error : undefined);
+            throw new errors_utils_1.BadRequestError({ reason: 'Failed to generate access token' }, error instanceof Error ? error : undefined);
         }
     }
     /** Generate refresh token */
     async generateRefreshToken(payload) {
         try {
             this.validatePayload(payload);
-            const token = (0, signToken_1.signToken)(payload, this.refreshSecret, this.refreshExpiry, { algorithm: 'HS256' });
+            const token = (0, signToken_1.signToken)(payload, this.refreshSecret, this.refreshExpiry, {
+                algorithm: 'HS256',
+            });
             return token;
         }
         catch (error) {
             if (error instanceof errors_utils_1.BadRequestError || error instanceof errors_utils_1.ValidationError)
                 throw error;
-            throw new errors_utils_1.BadRequestError({ message: 'Failed to generate refresh token' }, error instanceof Error ? error : undefined);
+            throw new errors_utils_1.BadRequestError({ reason: 'Failed to generate refresh token' }, error instanceof Error ? error : undefined);
         }
     }
     /** Verify access token */
@@ -92,7 +96,9 @@ class JWTManager {
     /** Rotate refresh token */
     async rotateRefreshToken(oldToken) {
         if (!oldToken || typeof oldToken !== 'string') {
-            throw new errors_utils_1.ValidationError({ message: 'Old refresh token must be a non-empty string' });
+            throw new errors_utils_1.ValidationError({
+                reason: 'Old refresh token must be a non-empty string',
+            });
         }
         const decoded = await this.verifyRefreshToken(oldToken);
         const payload = { ...decoded };
@@ -138,29 +144,42 @@ class JWTManager {
     /** Private helper methods */
     validatePayload(payload) {
         if (!payload || typeof payload !== 'object') {
-            throw new errors_utils_1.ValidationError({ message: 'Payload must be a non-null object' });
+            throw new errors_utils_1.ValidationError({
+                reason: 'Payload must be a non-null object',
+            });
         }
         if (Object.keys(payload).length === 0) {
-            throw new errors_utils_1.ValidationError({ message: 'Payload cannot be empty' });
+            throw new errors_utils_1.ValidationError({ reason: 'Payload cannot be empty' });
         }
     }
     async verifyTokenWithCache(token, secret, type) {
         if (!token || typeof token !== 'string') {
-            throw new errors_utils_1.ValidationError({ message: `${type} token must be a non-empty string` });
+            throw new errors_utils_1.ValidationError({
+                reason: `${type} token must be a non-empty string`,
+            });
         }
         const cacheKey = `${type}_${token}`;
         if (this.cache) {
             const cached = this.cache.get(cacheKey);
             if (cached && Date.now() - cached.timestamp <= this.cacheTTL) {
                 if (!cached.valid)
-                    throw new errors_utils_1.UnauthorizedError({ message: `${type} token is invalid or expired` });
+                    throw new errors_utils_1.UnauthorizedError({
+                        reason: `${type} token is invalid or expired`,
+                    });
                 return cached.payload;
             }
         }
         const { valid, payload, error } = (0, verify_1.safeVerifyToken)(token, secret);
         if (!valid || !payload || typeof payload === 'string') {
-            this.cache?.set(cacheKey, { valid: false, payload: {}, timestamp: Date.now() });
-            throw new errors_utils_1.UnauthorizedError({ message: `${type} token is invalid or expired`, cause: error });
+            this.cache?.set(cacheKey, {
+                valid: false,
+                payload: {},
+                timestamp: Date.now(),
+            });
+            throw new errors_utils_1.UnauthorizedError({
+                reason: `${type} token is invalid or expired`,
+                cause: error,
+            });
         }
         this.cache?.set(cacheKey, { valid: true, payload, timestamp: Date.now() });
         return payload;

package/dist/cjs/core/jwt/parseDuration.js

@@ -19,12 +19,12 @@ function parseDuration(input) {
         const value = Number.parseInt(match[1], 10);
         const unit = match[2].toLowerCase();
         if (!TIME_UNITS[unit]) {
-            throw new errors_utils_1.ValidationError({ message: `Invalid time unit: ${unit}` });
+            throw new errors_utils_1.ValidationError({ reason: `Invalid time unit: ${unit}` });
         }
         totalSeconds += value * TIME_UNITS[unit];
     }
     if (totalSeconds === 0) {
-        throw new errors_utils_1.ValidationError({ message: `Invalid expiry format: "${input}"` });
+        throw new errors_utils_1.ValidationError({ reason: `Invalid expiry format: "${input}"` });
     }
     return totalSeconds;
 }

package/dist/cjs/core/jwt/signToken.js

@@ -1,16 +1,16 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.signToken = void 0;
+const errors_utils_1 = require("@naman_deep_singh/errors-utils");
 const jsonwebtoken_1 = require("jsonwebtoken");
 const parseDuration_1 = require("./parseDuration");
-const errors_utils_1 = require("@naman_deep_singh/errors-utils");
 function getExpiryTimestamp(seconds) {
     return Math.floor(Date.now() / 1000) + seconds;
 }
 const signToken = (payload, secret, expiresIn = '1h', options = {}) => {
     const seconds = (0, parseDuration_1.parseDuration)(expiresIn);
     if (!seconds || seconds < 10) {
-        throw new errors_utils_1.ValidationError({ message: 'Token expiry too small' });
+        throw new errors_utils_1.ValidationError({ reason: 'Token expiry too small' });
     }
     const tokenPayload = {
         ...payload,

package/dist/cjs/core/jwt/validateToken.js

@@ -8,24 +8,30 @@ const errors_utils_1 = require("@naman_deep_singh/errors-utils");
  * Throws ValidationError if validation fails.
  */
 function validateTokenPayload(payload, rules = { requiredFields: ['exp', 'iat'] }) {
-    const { requiredFields = [], forbiddenFields = [], validateTypes = {} } = rules;
+    const { requiredFields = [], forbiddenFields = [], validateTypes = {}, } = rules;
     // 1. Required fields
     for (const field of requiredFields) {
         if (!(field in payload)) {
-            throw new errors_utils_1.ValidationError(`Missing required field: ${field}`);
+            throw new errors_utils_1.ValidationError({
+                reason: `Missing required field: ${field}`,
+            });
         }
     }
     // 2. Forbidden fields
     for (const field of forbiddenFields) {
         if (field in payload) {
-            throw new errors_utils_1.ValidationError(`Forbidden field in token: ${field}`);
+            throw new errors_utils_1.ValidationError({
+                reason: `Forbidden field in token: ${field}`,
+            });
         }
     }
     // 3. Type validation
     for (const key in validateTypes) {
         const expectedType = validateTypes[key];
         if (key in payload && typeof payload[key] !== expectedType) {
-            throw new errors_utils_1.ValidationError(`Invalid type for ${key}. Expected ${expectedType}, got ${typeof payload[key]}`);
+            throw new errors_utils_1.ValidationError({
+                reason: `Invalid type for ${key}. Expected ${expectedType}, got ${typeof payload[key]}`,
+            });
         }
     }
 }

package/dist/cjs/core/jwt/verify.d.ts

@@ -1,5 +1,5 @@
-import { type JwtPayload, type Secret, VerifyOptions } from 'jsonwebtoken';
-import { VerificationResult } from './types';
+import { type JwtPayload, type Secret, type VerifyOptions } from 'jsonwebtoken';
+import type { VerificationResult } from './types';
 /**
  * Verify token (throws UnauthorizedError if invalid or expired)
  */

package/dist/cjs/core/jwt/verify.js

@@ -1,8 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.safeVerifyTokenWithOptions = exports.safeVerifyToken = exports.verifyTokenWithOptions = exports.verifyToken = void 0;
-const jsonwebtoken_1 = require("jsonwebtoken");
 const errors_utils_1 = require("@naman_deep_singh/errors-utils");
+const jsonwebtoken_1 = require("jsonwebtoken");
 /**
  * Verify token (throws UnauthorizedError if invalid or expired)
  */
@@ -12,12 +12,12 @@ const verifyToken = (token, secret) => {
     }
     catch (error) {
         if (error.name === 'TokenExpiredError') {
-            throw new errors_utils_1.UnauthorizedError({ message: 'Token has expired' }, error);
+            throw new errors_utils_1.UnauthorizedError({ reason: 'Token has expired' }, error);
         }
         if (error.name === 'JsonWebTokenError') {
-            throw new errors_utils_1.UnauthorizedError({ message: 'Invalid token' }, error);
+            throw new errors_utils_1.UnauthorizedError({ reason: 'Invalid token' }, error);
         }
-        throw new errors_utils_1.UnauthorizedError({ message: 'Failed to verify token' }, error);
+        throw new errors_utils_1.UnauthorizedError({ reason: 'Failed to verify token' }, error);
     }
 };
 exports.verifyToken = verifyToken;
@@ -30,12 +30,12 @@ const verifyTokenWithOptions = (token, secret, options = {}) => {
     }
     catch (error) {
         if (error.name === 'TokenExpiredError') {
-            throw new errors_utils_1.UnauthorizedError({ message: 'Token has expired' }, error);
+            throw new errors_utils_1.UnauthorizedError({ reason: 'Token has expired' }, error);
         }
         if (error.name === 'JsonWebTokenError') {
-            throw new errors_utils_1.UnauthorizedError({ message: 'Invalid token' }, error);
+            throw new errors_utils_1.UnauthorizedError({ reason: 'Invalid token' }, error);
         }
-        throw new errors_utils_1.UnauthorizedError({ message: 'Failed to verify token' }, error);
+        throw new errors_utils_1.UnauthorizedError({ reason: 'Failed to verify token' }, error);
     }
 };
 exports.verifyTokenWithOptions = verifyTokenWithOptions;
@@ -50,13 +50,13 @@ const safeVerifyToken = (token, secret) => {
     catch (error) {
         let wrappedError;
         if (error.name === 'TokenExpiredError') {
-            wrappedError = new errors_utils_1.UnauthorizedError({ message: 'Token has expired' }, error);
+            wrappedError = new errors_utils_1.UnauthorizedError({ reason: 'Token has expired' }, error);
         }
         else if (error.name === 'JsonWebTokenError') {
-            wrappedError = new errors_utils_1.UnauthorizedError({ message: 'Invalid token' }, error);
+            wrappedError = new errors_utils_1.UnauthorizedError({ reason: 'Invalid token' }, error);
         }
         else {
-            wrappedError = new errors_utils_1.UnauthorizedError({ message: 'Failed to verify token' }, error);
+            wrappedError = new errors_utils_1.UnauthorizedError({ reason: 'Failed to verify token' }, error);
         }
         return { valid: false, error: wrappedError };
     }
@@ -73,13 +73,15 @@ const safeVerifyTokenWithOptions = (token, secret, options = {}) => {
     catch (error) {
         let wrappedError;
         if (error.name === 'TokenExpiredError') {
-            wrappedError = new errors_utils_1.UnauthorizedError({ message: 'Token has expired' }, error);
+            wrappedError = new errors_utils_1.UnauthorizedError({ reason: 'Token has expired' }, error instanceof Error ? error : undefined);
         }
         else if (error.name === 'JsonWebTokenError') {
-            wrappedError = new errors_utils_1.UnauthorizedError({ message: 'Invalid token' }, error);
+            wrappedError = new errors_utils_1.UnauthorizedError({
+                reason: 'Invalid token',
+            }, error instanceof Error ? error : undefined);
         }
         else {
-            wrappedError = new errors_utils_1.UnauthorizedError({ message: 'Failed to verify token' }, error);
+            wrappedError = new errors_utils_1.UnauthorizedError({ reason: 'Failed to verify token' }, error instanceof Error ? error : undefined);
         }
         return { valid: false, error: wrappedError };
     }

package/dist/cjs/core/password/hash.js

@@ -18,8 +18,8 @@ const hashPassword = async (password, saltRounds = 10) => {
         const salt = await bcryptjs_1.default.genSalt(saltRounds);
         return bcryptjs_1.default.hash(password, salt);
     }
-    catch (_err) {
-        throw new errors_utils_1.InternalServerError({ message: 'Password hashing failed' });
+    catch (error) {
+        throw new errors_utils_1.InternalServerError({ reason: 'Password hashing failed' }, error instanceof Error ? error : undefined);
     }
 };
 exports.hashPassword = hashPassword;
@@ -35,8 +35,8 @@ const hashPasswordSync = (password, saltRounds = 10) => {
         const salt = bcryptjs_1.default.genSaltSync(saltRounds);
         return bcryptjs_1.default.hashSync(password, salt);
     }
-    catch (_error) {
-        throw new errors_utils_1.InternalServerError({ message: 'Password hashing failed' });
+    catch (error) {
+        throw new errors_utils_1.InternalServerError({ reason: 'Password hashing failed' }, error instanceof Error ? error : undefined);
     }
 };
 exports.hashPasswordSync = hashPasswordSync;

package/dist/cjs/core/password/passwordManager.js

@@ -37,10 +37,11 @@ class PasswordManager {
             return { hash, salt: finalSalt };
         }
         catch (error) {
-            if (error instanceof errors_utils_1.BadRequestError || error instanceof errors_utils_1.ValidationError) {
+            if (error instanceof errors_utils_1.BadRequestError ||
+                error instanceof errors_utils_1.ValidationError) {
                 throw error;
             }
-            throw new errors_utils_1.BadRequestError({ message: 'Failed to hash password' }, error instanceof Error ? error : undefined);
+            throw new errors_utils_1.BadRequestError({ reason: 'Failed to hash password' }, error instanceof Error ? error : undefined);
         }
     }
     /**
@@ -63,7 +64,9 @@ class PasswordManager {
     generate(length = 16, options = {}) {
         const config = { ...this.defaultConfig, ...options };
         if (length < config.minLength || length > config.maxLength) {
-            throw new errors_utils_1.ValidationError({ message: `Password length must be between ${config.minLength} and ${config.maxLength}` });
+            throw new errors_utils_1.ValidationError({
+                reason: `Password length must be between ${config.minLength} and ${config.maxLength}`,
+            });
         }
         let charset = 'abcdefghijklmnopqrstuvwxyz';
         if (config.requireUppercase)
@@ -114,7 +117,11 @@ class PasswordManager {
                     errors.push(rule.message);
             });
         }
-        return { isValid: errors.length === 0, errors, strength: this.checkStrength(password) };
+        return {
+            isValid: errors.length === 0,
+            errors,
+            strength: this.checkStrength(password),
+        };
     }
     /**
      * Check password strength
@@ -190,7 +197,8 @@ class PasswordManager {
                 label = 'strong';
                 suggestions.push('Your password is very secure');
                 break;
-            default: label = 'very-weak';
+            default:
+                label = 'very-weak';
         }
         return { score, label, feedback, suggestions };
     }

package/dist/cjs/core/password/strength.js

@@ -4,18 +4,24 @@ exports.isPasswordStrong = void 0;
 const errors_utils_1 = require("@naman_deep_singh/errors-utils");
 const isPasswordStrong = (password, options = {}) => {
     if (!password)
-        throw new errors_utils_1.BadRequestError({ message: 'Invalid password provided' });
+        throw new errors_utils_1.BadRequestError({ reason: 'Invalid password provided' });
     const { minLength = 8, requireUppercase = true, requireLowercase = true, requireNumbers = true, requireSymbols = false, } = options;
     if (password.length < minLength)
-        throw new errors_utils_1.ValidationError(`Password must be at least ${minLength} characters`);
+        throw new errors_utils_1.ValidationError({
+            reason: `Password must be at least ${minLength} characters long`,
+        });
     if (requireUppercase && !/[A-Z]/.test(password))
-        throw new errors_utils_1.ValidationError({ message: 'Password must include uppercase letters' });
+        throw new errors_utils_1.ValidationError({
+            reason: 'Password must include uppercase letters',
+        });
     if (requireLowercase && !/[a-z]/.test(password))
-        throw new errors_utils_1.ValidationError({ message: 'Password must include lowercase letters' });
+        throw new errors_utils_1.ValidationError({
+            reason: 'Password must include lowercase letters',
+        });
     if (requireNumbers && !/[0-9]/.test(password))
-        throw new errors_utils_1.ValidationError({ message: 'Password must include numbers' });
+        throw new errors_utils_1.ValidationError({ reason: 'Password must include numbers' });
     if (requireSymbols && !/[^A-Za-z0-9]/.test(password))
-        throw new errors_utils_1.ValidationError({ message: 'Password must include symbols' });
+        throw new errors_utils_1.ValidationError({ reason: 'Password must include symbols' });
     return true;
 };
 exports.isPasswordStrong = isPasswordStrong;

package/dist/cjs/core/password/utils.js

@@ -14,7 +14,7 @@ const errors_utils_1 = require("@naman_deep_singh/errors-utils");
  */
 function ensureValidPassword(password) {
     if (!password || typeof password !== 'string') {
-        throw new errors_utils_1.BadRequestError({ message: 'Invalid password provided' });
+        throw new errors_utils_1.BadRequestError({ reason: 'Invalid password provided' });
     }
 }
 /**

package/dist/cjs/core/password/verify.js

@@ -15,11 +15,11 @@ const verifyPassword = async (password, hash) => {
     try {
         const result = await bcryptjs_1.default.compare(password, hash);
         if (!result)
-            throw new errors_utils_1.UnauthorizedError({ message: 'Password verification failed' });
+            throw new errors_utils_1.UnauthorizedError({ reason: 'Password verification failed' });
         return result;
     }
     catch {
-        throw new errors_utils_1.UnauthorizedError({ message: 'Password verification failed' });
+        throw new errors_utils_1.UnauthorizedError({ reason: 'Password verification failed' });
     }
 };
 exports.verifyPassword = verifyPassword;
@@ -33,11 +33,11 @@ const verifyPasswordSync = (password, hash) => {
     try {
         const result = bcryptjs_1.default.compareSync(password, hash);
         if (!result)
-            throw new errors_utils_1.UnauthorizedError({ message: 'Password verification failed' });
+            throw new errors_utils_1.UnauthorizedError({ reason: 'Password verification failed' });
         return result;
     }
     catch (_error) {
-        throw new errors_utils_1.UnauthorizedError({ message: 'Password verification failed' });
+        throw new errors_utils_1.UnauthorizedError({ reason: 'Password verification failed' });
     }
 };
 exports.verifyPasswordSync = verifyPasswordSync;

package/dist/esm/core/crypto/cryptoManager.js

@@ -1,4 +1,4 @@
-import { InternalServerError } from '@naman_deep_singh/errors-utils';
+import { CryptoIntegrityError } from '@naman_deep_singh/errors-utils';
 import { decrypt as functionalDecrypt, encrypt as functionalEncrypt, hmacSign as functionalHmacSign, hmacVerify as functionalHmacVerify, randomToken as functionalRandomToken, } from './index';
 /**
  * Default configuration
@@ -35,10 +35,10 @@ export class CryptoManager {
         try {
             return functionalEncrypt(plaintext, key);
         }
-        catch (err) {
-            throw new InternalServerError(undefined, {
-                message: 'Encryption failed',
-            }, err instanceof Error ? err : undefined);
+        catch (error) {
+            throw new CryptoIntegrityError({
+                reason: 'Encryption failed',
+            }, error instanceof Error ? error : undefined);
         }
     }
     /**
@@ -48,10 +48,10 @@ export class CryptoManager {
         try {
             return functionalDecrypt(encryptedData, key);
         }
-        catch (err) {
-            throw new InternalServerError(undefined, {
-                message: 'Decryption failed',
-            }, err instanceof Error ? err : undefined);
+        catch (error) {
+            throw new CryptoIntegrityError({
+                reason: 'Decryption failed',
+            }, error instanceof Error ? error : undefined);
         }
     }
     /**
@@ -82,11 +82,11 @@ export class CryptoManager {
     deriveKey(password, salt, iterations = 100000, keyLength = 32) {
         return new Promise((resolve, reject) => {
             const crypto = require('crypto');
-            crypto.pbkdf2(password, salt, iterations, keyLength, 'sha256', (err, derivedKey) => {
-                if (err) {
-                    reject(new InternalServerError(undefined, {
-                        message: 'Key derivation failed',
-                    }, err instanceof Error ? err : undefined));
+            crypto.pbkdf2(password, salt, iterations, keyLength, 'sha256', (error, derivedKey) => {
+                if (error) {
+                    reject(new CryptoIntegrityError({
+                        reason: 'Key derivation failed',
+                    }, error instanceof Error ? error : undefined));
                 }
                 else {
                     resolve(derivedKey.toString('hex'));
@@ -163,10 +163,10 @@ export class CryptoManager {
                 const signature = sign.sign(privateKey, 'base64');
                 resolve(signature);
             }
-            catch (err) {
-                reject(new InternalServerError(undefined, {
-                    message: 'RSA signing failed',
-                }, err instanceof Error ? err : undefined));
+            catch (error) {
+                reject(new CryptoIntegrityError({
+                    reason: 'RSA signing failed',
+                }, error instanceof Error ? error : undefined));
             }
         });
     }
@@ -183,10 +183,10 @@ export class CryptoManager {
                 const isValid = verify.verify(publicKey, signature, 'base64');
                 resolve(isValid);
             }
-            catch (err) {
-                reject(new InternalServerError(undefined, {
-                    message: 'RSA verification failed',
-                }, err instanceof Error ? err : undefined));
+            catch (error) {
+                reject(new CryptoIntegrityError({
+                    reason: 'RSA verification failed',
+                }, error instanceof Error ? error : undefined));
             }
         });
     }

package/dist/esm/core/jwt/decode.js

@@ -1,6 +1,6 @@
+import { BadRequestError } from '@naman_deep_singh/errors-utils';
 // src/jwt/decodeToken.ts
 import { decode } from 'jsonwebtoken';
-import { BadRequestError } from '@naman_deep_singh/errors-utils';
 /**
  * Flexible decode
  * Returns: null | string | JwtPayload
@@ -17,7 +17,7 @@ export function decodeTokenStrict(token) {
     const decoded = decode(token);
     if (!decoded || typeof decoded === 'string') {
         throw new BadRequestError({
-            message: 'Invalid JWT payload structure',
+            reason: 'Invalid JWT payload structure',
         });
     }
     return decoded;

package/dist/esm/core/jwt/generateTokens.js

@@ -1,6 +1,6 @@
+import { TokenMalformedError } from '@naman_deep_singh/errors-utils';
 import { signToken } from './signToken';
 import { verifyToken } from './verify';
-import { TokenMalformedError } from '@naman_deep_singh/errors-utils';
 // Helper function to create branded tokens
 /* const createBrandedToken = <T extends string>(token: string, _brand: T): T => {
     return token as T
@@ -21,7 +21,7 @@ export function rotateRefreshToken(oldToken, secret) {
     const decoded = verifyToken(oldToken, secret);
     if (typeof decoded === 'string') {
         throw new TokenMalformedError({
-            message: 'Invalid token payload — expected JWT payload object',
+            reason: 'Invalid token payload — expected JWT payload object',
         });
     }
     const payload = { ...decoded };

package/dist/esm/core/jwt/jwtManager.js

@@ -25,33 +25,37 @@ export class JWTManager {
         catch (error) {
             if (error instanceof BadRequestError || error instanceof ValidationError)
                 throw error;
-            throw new BadRequestError({ message: 'Failed to generate tokens' }, error instanceof Error ? error : undefined);
+            throw new BadRequestError({ reason: 'Failed to generate tokens' }, error instanceof Error ? error : undefined);
         }
     }
     /** Generate access token */
     async generateAccessToken(payload) {
         try {
             this.validatePayload(payload);
-            const token = signToken(payload, this.accessSecret, this.accessExpiry, { algorithm: 'HS256' });
+            const token = signToken(payload, this.accessSecret, this.accessExpiry, {
+                algorithm: 'HS256',
+            });
             return token;
         }
         catch (error) {
             if (error instanceof BadRequestError || error instanceof ValidationError)
                 throw error;
-            throw new BadRequestError({ message: 'Failed to generate access token' }, error instanceof Error ? error : undefined);
+            throw new BadRequestError({ reason: 'Failed to generate access token' }, error instanceof Error ? error : undefined);
         }
     }
     /** Generate refresh token */
     async generateRefreshToken(payload) {
         try {
             this.validatePayload(payload);
-            const token = signToken(payload, this.refreshSecret, this.refreshExpiry, { algorithm: 'HS256' });
+            const token = signToken(payload, this.refreshSecret, this.refreshExpiry, {
+                algorithm: 'HS256',
+            });
             return token;
         }
         catch (error) {
             if (error instanceof BadRequestError || error instanceof ValidationError)
                 throw error;
-            throw new BadRequestError({ message: 'Failed to generate refresh token' }, error instanceof Error ? error : undefined);
+            throw new BadRequestError({ reason: 'Failed to generate refresh token' }, error instanceof Error ? error : undefined);
         }
     }
     /** Verify access token */
@@ -86,7 +90,9 @@ export class JWTManager {
     /** Rotate refresh token */
     async rotateRefreshToken(oldToken) {
         if (!oldToken || typeof oldToken !== 'string') {
-            throw new ValidationError({ message: 'Old refresh token must be a non-empty string' });
+            throw new ValidationError({
+                reason: 'Old refresh token must be a non-empty string',
+            });
         }
         const decoded = await this.verifyRefreshToken(oldToken);
         const payload = { ...decoded };
@@ -132,29 +138,42 @@ export class JWTManager {
     /** Private helper methods */
     validatePayload(payload) {
         if (!payload || typeof payload !== 'object') {
-            throw new ValidationError({ message: 'Payload must be a non-null object' });
+            throw new ValidationError({
+                reason: 'Payload must be a non-null object',
+            });
         }
         if (Object.keys(payload).length === 0) {
-            throw new ValidationError({ message: 'Payload cannot be empty' });
+            throw new ValidationError({ reason: 'Payload cannot be empty' });
         }
     }
     async verifyTokenWithCache(token, secret, type) {
         if (!token || typeof token !== 'string') {
-            throw new ValidationError({ message: `${type} token must be a non-empty string` });
+            throw new ValidationError({
+                reason: `${type} token must be a non-empty string`,
+            });
         }
         const cacheKey = `${type}_${token}`;
         if (this.cache) {
             const cached = this.cache.get(cacheKey);
             if (cached && Date.now() - cached.timestamp <= this.cacheTTL) {
                 if (!cached.valid)
-                    throw new UnauthorizedError({ message: `${type} token is invalid or expired` });
+                    throw new UnauthorizedError({
+                        reason: `${type} token is invalid or expired`,
+                    });
                 return cached.payload;
             }
         }
         const { valid, payload, error } = safeVerifyToken(token, secret);
         if (!valid || !payload || typeof payload === 'string') {
-            this.cache?.set(cacheKey, { valid: false, payload: {}, timestamp: Date.now() });
-            throw new UnauthorizedError({ message: `${type} token is invalid or expired`, cause: error });
+            this.cache?.set(cacheKey, {
+                valid: false,
+                payload: {},
+                timestamp: Date.now(),
+            });
+            throw new UnauthorizedError({
+                reason: `${type} token is invalid or expired`,
+                cause: error,
+            });
         }
         this.cache?.set(cacheKey, { valid: true, payload, timestamp: Date.now() });
         return payload;

package/dist/esm/core/jwt/parseDuration.js

@@ -1,4 +1,4 @@
-import { ValidationError } from "@naman_deep_singh/errors-utils";
+import { ValidationError } from '@naman_deep_singh/errors-utils';
 const TIME_UNITS = {
     s: 1,
     m: 60,
@@ -16,12 +16,12 @@ export function parseDuration(input) {
         const value = Number.parseInt(match[1], 10);
         const unit = match[2].toLowerCase();
         if (!TIME_UNITS[unit]) {
-            throw new ValidationError({ message: `Invalid time unit: ${unit}` });
+            throw new ValidationError({ reason: `Invalid time unit: ${unit}` });
         }
         totalSeconds += value * TIME_UNITS[unit];
     }
     if (totalSeconds === 0) {
-        throw new ValidationError({ message: `Invalid expiry format: "${input}"` });
+        throw new ValidationError({ reason: `Invalid expiry format: "${input}"` });
     }
     return totalSeconds;
 }

package/dist/esm/core/jwt/signToken.js

@@ -1,13 +1,13 @@
+import { ValidationError } from '@naman_deep_singh/errors-utils';
 import { sign } from 'jsonwebtoken';
 import { parseDuration } from './parseDuration';
-import { ValidationError } from '@naman_deep_singh/errors-utils';
 function getExpiryTimestamp(seconds) {
     return Math.floor(Date.now() / 1000) + seconds;
 }
 export const signToken = (payload, secret, expiresIn = '1h', options = {}) => {
     const seconds = parseDuration(expiresIn);
     if (!seconds || seconds < 10) {
-        throw new ValidationError({ message: 'Token expiry too small' });
+        throw new ValidationError({ reason: 'Token expiry too small' });
     }
     const tokenPayload = {
         ...payload,

package/dist/esm/core/jwt/validateToken.js

@@ -4,24 +4,30 @@ import { ValidationError } from '@naman_deep_singh/errors-utils';
  * Throws ValidationError if validation fails.
  */
 export function validateTokenPayload(payload, rules = { requiredFields: ['exp', 'iat'] }) {
-    const { requiredFields = [], forbiddenFields = [], validateTypes = {} } = rules;
+    const { requiredFields = [], forbiddenFields = [], validateTypes = {}, } = rules;
     // 1. Required fields
     for (const field of requiredFields) {
         if (!(field in payload)) {
-            throw new ValidationError(`Missing required field: ${field}`);
+            throw new ValidationError({
+                reason: `Missing required field: ${field}`,
+            });
         }
     }
     // 2. Forbidden fields
     for (const field of forbiddenFields) {
         if (field in payload) {
-            throw new ValidationError(`Forbidden field in token: ${field}`);
+            throw new ValidationError({
+                reason: `Forbidden field in token: ${field}`,
+            });
         }
     }
     // 3. Type validation
     for (const key in validateTypes) {
         const expectedType = validateTypes[key];
         if (key in payload && typeof payload[key] !== expectedType) {
-            throw new ValidationError(`Invalid type for ${key}. Expected ${expectedType}, got ${typeof payload[key]}`);
+            throw new ValidationError({
+                reason: `Invalid type for ${key}. Expected ${expectedType}, got ${typeof payload[key]}`,
+            });
         }
     }
 }

package/dist/esm/core/jwt/verify.d.ts

@@ -1,5 +1,5 @@
-import { type JwtPayload, type Secret, VerifyOptions } from 'jsonwebtoken';
-import { VerificationResult } from './types';
+import { type JwtPayload, type Secret, type VerifyOptions } from 'jsonwebtoken';
+import type { VerificationResult } from './types';
 /**
  * Verify token (throws UnauthorizedError if invalid or expired)
  */

package/dist/esm/core/jwt/verify.js

@@ -1,5 +1,5 @@
-import { verify } from 'jsonwebtoken';
 import { UnauthorizedError } from '@naman_deep_singh/errors-utils';
+import { verify, } from 'jsonwebtoken';
 /**
  * Verify token (throws UnauthorizedError if invalid or expired)
  */
@@ -9,12 +9,12 @@ export const verifyToken = (token, secret) => {
     }
     catch (error) {
         if (error.name === 'TokenExpiredError') {
-            throw new UnauthorizedError({ message: 'Token has expired' }, error);
+            throw new UnauthorizedError({ reason: 'Token has expired' }, error);
         }
         if (error.name === 'JsonWebTokenError') {
-            throw new UnauthorizedError({ message: 'Invalid token' }, error);
+            throw new UnauthorizedError({ reason: 'Invalid token' }, error);
         }
-        throw new UnauthorizedError({ message: 'Failed to verify token' }, error);
+        throw new UnauthorizedError({ reason: 'Failed to verify token' }, error);
     }
 };
 /**
@@ -26,12 +26,12 @@ export const verifyTokenWithOptions = (token, secret, options = {}) => {
     }
     catch (error) {
         if (error.name === 'TokenExpiredError') {
-            throw new UnauthorizedError({ message: 'Token has expired' }, error);
+            throw new UnauthorizedError({ reason: 'Token has expired' }, error);
         }
         if (error.name === 'JsonWebTokenError') {
-            throw new UnauthorizedError({ message: 'Invalid token' }, error);
+            throw new UnauthorizedError({ reason: 'Invalid token' }, error);
         }
-        throw new UnauthorizedError({ message: 'Failed to verify token' }, error);
+        throw new UnauthorizedError({ reason: 'Failed to verify token' }, error);
     }
 };
 /**
@@ -45,13 +45,13 @@ export const safeVerifyToken = (token, secret) => {
     catch (error) {
         let wrappedError;
         if (error.name === 'TokenExpiredError') {
-            wrappedError = new UnauthorizedError({ message: 'Token has expired' }, error);
+            wrappedError = new UnauthorizedError({ reason: 'Token has expired' }, error);
         }
         else if (error.name === 'JsonWebTokenError') {
-            wrappedError = new UnauthorizedError({ message: 'Invalid token' }, error);
+            wrappedError = new UnauthorizedError({ reason: 'Invalid token' }, error);
         }
         else {
-            wrappedError = new UnauthorizedError({ message: 'Failed to verify token' }, error);
+            wrappedError = new UnauthorizedError({ reason: 'Failed to verify token' }, error);
         }
         return { valid: false, error: wrappedError };
     }
@@ -67,13 +67,15 @@ export const safeVerifyTokenWithOptions = (token, secret, options = {}) => {
     catch (error) {
         let wrappedError;
         if (error.name === 'TokenExpiredError') {
-            wrappedError = new UnauthorizedError({ message: 'Token has expired' }, error);
+            wrappedError = new UnauthorizedError({ reason: 'Token has expired' }, error instanceof Error ? error : undefined);
         }
         else if (error.name === 'JsonWebTokenError') {
-            wrappedError = new UnauthorizedError({ message: 'Invalid token' }, error);
+            wrappedError = new UnauthorizedError({
+                reason: 'Invalid token',
+            }, error instanceof Error ? error : undefined);
         }
         else {
-            wrappedError = new UnauthorizedError({ message: 'Failed to verify token' }, error);
+            wrappedError = new UnauthorizedError({ reason: 'Failed to verify token' }, error instanceof Error ? error : undefined);
         }
         return { valid: false, error: wrappedError };
     }

package/dist/esm/core/password/hash.js

@@ -10,8 +10,8 @@ export const hashPassword = async (password, saltRounds = 10) => {
         const salt = await bcrypt.genSalt(saltRounds);
         return bcrypt.hash(password, salt);
     }
-    catch (_err) {
-        throw new InternalServerError({ message: 'Password hashing failed' });
+    catch (error) {
+        throw new InternalServerError({ reason: 'Password hashing failed' }, error instanceof Error ? error : undefined);
     }
 };
 export function hashPasswordWithPepper(password, pepper) {
@@ -26,8 +26,8 @@ export const hashPasswordSync = (password, saltRounds = 10) => {
         const salt = bcrypt.genSaltSync(saltRounds);
         return bcrypt.hashSync(password, salt);
     }
-    catch (_error) {
-        throw new InternalServerError({ message: 'Password hashing failed' });
+    catch (error) {
+        throw new InternalServerError({ reason: 'Password hashing failed' }, error instanceof Error ? error : undefined);
     }
 };
 export function hashPasswordWithPepperSync(password, pepper) {

package/dist/esm/core/password/passwordManager.js

@@ -31,10 +31,11 @@ export class PasswordManager {
             return { hash, salt: finalSalt };
         }
         catch (error) {
-            if (error instanceof BadRequestError || error instanceof ValidationError) {
+            if (error instanceof BadRequestError ||
+                error instanceof ValidationError) {
                 throw error;
             }
-            throw new BadRequestError({ message: 'Failed to hash password' }, error instanceof Error ? error : undefined);
+            throw new BadRequestError({ reason: 'Failed to hash password' }, error instanceof Error ? error : undefined);
         }
     }
     /**
@@ -57,7 +58,9 @@ export class PasswordManager {
     generate(length = 16, options = {}) {
         const config = { ...this.defaultConfig, ...options };
         if (length < config.minLength || length > config.maxLength) {
-            throw new ValidationError({ message: `Password length must be between ${config.minLength} and ${config.maxLength}` });
+            throw new ValidationError({
+                reason: `Password length must be between ${config.minLength} and ${config.maxLength}`,
+            });
         }
         let charset = 'abcdefghijklmnopqrstuvwxyz';
         if (config.requireUppercase)
@@ -108,7 +111,11 @@ export class PasswordManager {
                     errors.push(rule.message);
             });
         }
-        return { isValid: errors.length === 0, errors, strength: this.checkStrength(password) };
+        return {
+            isValid: errors.length === 0,
+            errors,
+            strength: this.checkStrength(password),
+        };
     }
     /**
      * Check password strength
@@ -184,7 +191,8 @@ export class PasswordManager {
                 label = 'strong';
                 suggestions.push('Your password is very secure');
                 break;
-            default: label = 'very-weak';
+            default:
+                label = 'very-weak';
         }
         return { score, label, feedback, suggestions };
     }

package/dist/esm/core/password/strength.js

@@ -1,17 +1,23 @@
 import { BadRequestError, ValidationError, } from '@naman_deep_singh/errors-utils';
 export const isPasswordStrong = (password, options = {}) => {
     if (!password)
-        throw new BadRequestError({ message: 'Invalid password provided' });
+        throw new BadRequestError({ reason: 'Invalid password provided' });
     const { minLength = 8, requireUppercase = true, requireLowercase = true, requireNumbers = true, requireSymbols = false, } = options;
     if (password.length < minLength)
-        throw new ValidationError(`Password must be at least ${minLength} characters`);
+        throw new ValidationError({
+            reason: `Password must be at least ${minLength} characters long`,
+        });
     if (requireUppercase && !/[A-Z]/.test(password))
-        throw new ValidationError({ message: 'Password must include uppercase letters' });
+        throw new ValidationError({
+            reason: 'Password must include uppercase letters',
+        });
     if (requireLowercase && !/[a-z]/.test(password))
-        throw new ValidationError({ message: 'Password must include lowercase letters' });
+        throw new ValidationError({
+            reason: 'Password must include lowercase letters',
+        });
     if (requireNumbers && !/[0-9]/.test(password))
-        throw new ValidationError({ message: 'Password must include numbers' });
+        throw new ValidationError({ reason: 'Password must include numbers' });
     if (requireSymbols && !/[^A-Za-z0-9]/.test(password))
-        throw new ValidationError({ message: 'Password must include symbols' });
+        throw new ValidationError({ reason: 'Password must include symbols' });
     return true;
 };

package/dist/esm/core/password/utils.js

@@ -5,7 +5,7 @@ import { BadRequestError } from '@naman_deep_singh/errors-utils';
  */
 export function ensureValidPassword(password) {
     if (!password || typeof password !== 'string') {
-        throw new BadRequestError({ message: 'Invalid password provided' });
+        throw new BadRequestError({ reason: 'Invalid password provided' });
     }
 }
 /**

package/dist/esm/core/password/verify.js

@@ -7,11 +7,11 @@ export const verifyPassword = async (password, hash) => {
     try {
         const result = await bcrypt.compare(password, hash);
         if (!result)
-            throw new UnauthorizedError({ message: 'Password verification failed' });
+            throw new UnauthorizedError({ reason: 'Password verification failed' });
         return result;
     }
     catch {
-        throw new UnauthorizedError({ message: 'Password verification failed' });
+        throw new UnauthorizedError({ reason: 'Password verification failed' });
     }
 };
 export async function verifyPasswordWithPepper(password, pepper, hash) {
@@ -24,11 +24,11 @@ export const verifyPasswordSync = (password, hash) => {
     try {
         const result = bcrypt.compareSync(password, hash);
         if (!result)
-            throw new UnauthorizedError({ message: 'Password verification failed' });
+            throw new UnauthorizedError({ reason: 'Password verification failed' });
         return result;
     }
     catch (_error) {
-        throw new UnauthorizedError({ message: 'Password verification failed' });
+        throw new UnauthorizedError({ reason: 'Password verification failed' });
     }
 };
 export async function verifyPasswordWithPepperSync(password, pepper, hash) {

package/dist/types/core/jwt/verify.d.ts

@@ -1,5 +1,5 @@
-import { type JwtPayload, type Secret, VerifyOptions } from 'jsonwebtoken';
-import { VerificationResult } from './types';
+import { type JwtPayload, type Secret, type VerifyOptions } from 'jsonwebtoken';
+import type { VerificationResult } from './types';
 /**
  * Verify token (throws UnauthorizedError if invalid or expired)
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@naman_deep_singh/security",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "description": "Security utilities for password hashing and JWT token management with TypeScript",
   "type": "module",
   "main": "./dist/cjs/index.js",
@@ -28,7 +28,7 @@
   "author": "Naman Deep Singh",
   "license": "ISC",
   "dependencies": {
-    "@naman_deep_singh/errors-utils": "^1.3.4",
+    "@naman_deep_singh/errors-utils": "^1.4.2",
     "@naman_deep_singh/js-extensions": "^1.3.2",
     "bcryptjs": "^3.0.3",
     "jsonwebtoken": "^9.0.2"