@navios/jwt 0.5.0 → 0.7.0

package/lib/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/options/jwt-service.options.mts","../src/jwt.service.mts","../src/jwt-service.provider.mts","../src/index.mts"],"names":["RequestType","InjectionToken","jwt"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAIO,IAAK,WAAA,qBAAAA,YAAAA,KAAL;AACL,EAAAA,aAAA,MAAA,CAAA,GAAO,MAAA;AACP,EAAAA,aAAA,QAAA,CAAA,GAAS,QAAA;AAFC,EAAA,OAAAA,YAAAA;AAAA,CAAA,EAAA,WAAA,IAAA,EAAA;AAKL,IAAM,aAAA,GAAgB,EAAE,IAAA,CAAK;AAAA,EAClC,OAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA;AACF,CAAC;AAEM,IAAM,eAAA,GAAkB,EAAE,MAAA,CAAO;AAAA,EACtC,GAAA,EAAK,aAAA,CAAc,EAAA,CAAG,CAAA,CAAE,QAAQ,CAAA;AAAA,EAChC,GAAA,EAAK,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACzB,GAAA,EAAK,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACzB,MAAM,CAAA,CAAE,MAAA,EAAO,CAAE,KAAA,GAAQ,QAAA,EAAS;AAAA,EAClC,GAAA,EAAK,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACzB,GAAA,EAAK,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACzB,GAAA,EAAK,CAAA,CAAE,KAAA,CAAM,CAAC,EAAE,MAAA,EAAO,EAAG,CAAA,CAAE,KAAA,CAAM,EAAE,MAAA,EAAQ,CAAC,CAAC,EAAE,QAAA,EAAS;AAAA,EACzD,UAAA,EAAY,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAChC,GAAA,EAAK,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACzB,GAAA,EAAK,CAAA,CAAE,KAAA,CAAM,CAAC,EAAE,MAAA,EAAO,EAAG,CAAA,CAAE,KAAA,CAAM,EAAE,MAAA,EAAQ,CAAC,CAAC,EAAE,QAAA;AAClD,CAAC;AAIM,IAAM,iBAAA,GAAoB,EAAE,MAAA,CAAO;AAAA,EACxC,SAAA,EAAW,cAAc,QAAA,EAAS;AAAA,EAClC,KAAA,EAAO,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC3B,SAAA,EAAW,CAAA,CAAE,KAAA,CAAM,CAAC,CAAA,CAAE,MAAA,EAAO,EAAG,CAAA,CAAE,MAAA,EAAQ,CAAC,CAAA,CAAE,QAAA,EAAS;AAAA,EACtD,SAAA,EAAW,CAAA,CAAE,KAAA,CAAM,CAAC,CAAA,CAAE,MAAA,EAAO,EAAG,CAAA,CAAE,MAAA,EAAQ,CAAC,CAAA,CAAE,QAAA,EAAS;AAAA,EACtD,QAAA,EAAU,EACP,KAAA,CAAM;AAAA,IACL,EAAE,MAAA,EAAO;AAAA,IACT,CAAA,CAAE,WAAW,MAAM,CAAA;AAAA,IACnB,CAAA,CAAE,KAAA,CAAM,CAAA,CAAE,KAAA,CAAM,CAAC,CAAA,CAAE,MAAA,EAAO,EAAG,CAAA,CAAE,UAAA,CAAW,MAAM,CAAC,CAAC,CAAC;AAAA,GACpD,EACA,QAAA,EAAS;AAAA,EACZ,OAAA,EAAS,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC5B,KAAA,EAAO,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC3B,aAAA,EAAe,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EACpC,WAAA,EAAa,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EAClC,MAAA,EAAQ,gBAAgB,QAAA,EAAS;AAAA,EACjC,QAAA,EAAU,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC9B,qBAAA,EAAuB,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EAC5C,8BAAA,EAAgC,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAA;AAC9C,CAAC;AAIM,IAAM,mBAAA,GAAsB,EAAE,MAAA,CAAO;AAAA,EAC1C,UAAA,EAAY,aAAA,CAAc,KAAA,EAAM,CAAE,QAAA,EAAS;AAAA,EAC3C,QAAA,EAAU,EACP,KAAA,CAAM;AAAA,IACL,EAAE,MAAA,EAAO;AAAA,IACT,CAAA,CAAE,WAAW,MAAM,CAAA;AAAA,IACnB,CAAA,CAAE,KAAA,CAAM,CAAA,CAAE,KAAA,CAAM,CAAC,CAAA,CAAE,MAAA,EAAO,EAAG,CAAA,CAAE,UAAA,CAAW,MAAM,CAAC,CAAC,CAAC;AAAA,GACpD,EACA,QAAA,EAAS;AAAA,EACZ,cAAA,EAAgB,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACpC,cAAA,EAAgB,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACpC,QAAA,EAAU,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EAC/B,MAAA,EAAQ,CAAA,CAAE,KAAA,CAAM,CAAC,EAAE,MAAA,EAAO,EAAG,CAAA,CAAE,MAAA,EAAO,CAAE,KAAA,EAAO,CAAC,EAAE,QAAA,EAAS;AAAA,EAC3D,gBAAA,EAAkB,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EACvC,eAAA,EAAiB,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EACtC,KAAA,EAAO,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC3B,KAAA,EAAO,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC3B,OAAA,EAAS,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,MAAA,EAAQ,CAAA,CAAE,KAAA,CAAM,CAAC,CAAA,CAAE,MAAA,EAAO,EAAG,CAAA,CAAE,MAAA,EAAQ,CAAC,CAAA,CAAE,QAAA,EAAS;AAAA,EACnD,8BAAA,EAAgC,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAA;AAC9C,CAAC;AAIM,IAAM,YAAA,GAAe,EAAE,KAAA,CAAM;AAAA,EAClC,EAAE,MAAA,EAAO;AAAA,EACT,CAAA,CAAE,WAAW,MAAM,CAAA;AAAA,EACnB,EACG,MAAA,CAAO;AAAA,IACN,IAAA,EAAM,EAAE,MAAA;AAAO,GAChB,EACA,WAAA,EAAY;AAAA,EACf,EAAE,MAAA,CAAO;AAAA,IACP,GAAA,EAAK,CAAA,CAAE,KAAA,CAAM,CAAC,CAAA,CAAE,MAAA,EAAO,EAAG,CAAA,CAAE,UAAA,CAAW,MAAM,CAAC,CAAC,CAAA;AAAA,IAC/C,UAAA,EAAY,EAAE,MAAA;AAAO,GACtB;AACH,CAAC;AAIM,IAAM,uBAAA,GAA0B,EAAE,MAAA,CAAO;AAAA,EAC9C,WAAA,EAAa,kBAAkB,QAAA,EAAS;AAAA,EACxC,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC5B,SAAA,EAAW,CAAA,CAAE,KAAA,CAAM,CAAC,CAAA,CAAE,MAAA,EAAO,EAAG,CAAA,CAAE,UAAA,CAAW,MAAM,CAAC,CAAC,EAAE,QAAA,EAAS;AAAA,EAChE,UAAA,EAAY,aAAa,QAAA,EAAS;AAAA,EAClC,aAAA,EAAe,oBAAoB,QAAA,EAAS;AAAA,EAC5C,mBAAA,EAAqB,EAClB,QAAA,CAAS;AAAA,IACR,KAAA,EAAO;AAAA,MACL,CAAA,CAAE,KAAK,WAAW,CAAA;AAAA,MAClB,EAAE,GAAA,EAAI;AAAA,MACN,EAAE,KAAA,CAAM,CAAC,mBAAmB,mBAAmB,CAAC,EAAE,QAAA;AAAS,KAC7D;AAAA,IACA,MAAA,EAAQ,EAAE,KAAA,CAAM,CAAC,cAAc,CAAA,CAAE,OAAA,CAAQ,YAAY,CAAC,CAAC;AAAA,GACxD,EACA,QAAA;AACL,CAAC;ACvGM,IAAM,kBAAkB,cAAA,CAAe,MAAA;AAAA,EAC5C,MAAA,CAAO,IAAI,YAAY,CAAA;AAAA,EACvB;AACF;AArBA,IAAA,sBAAA,EAAA,KAAA;AAuBA,sBAAA,GAAA,CAAC,UAAA,CAAW;AAAA,EACV,KAAA,EAAO;AACT,CAAC,CAAA,CAAA;AACM,IAAM,WAAA,GAAN,MAAM,WAAA,CAAW;AAAA,EAKtB,WAAA,CAA6B,OAAA,GAA6B,EAAC,EAAG;AAAjC,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AAAA,EAAkC;AAAA,EAJ/D,MAAA,GAAS,OAAO,MAAA,EAAQ;AAAA,IACtB,SAAS,WAAA,CAAW;AAAA,GACrB,CAAA;AAAA,EASD,IAAA,CACE,OAAA,EACA,OAAA,GAA0B,EAAC,EACnB;AACR,IAAA,MAAM,cAAc,IAAA,CAAK,eAAA;AAAA,MACvB,EAAE,GAAG,OAAA,EAAQ;AAAA,MACb;AAAA,KACF;AACA,IAAA,MAAM,SAAS,IAAA,CAAK,YAAA;AAAA,MAClB,OAAA;AAAA,MACA,OAAA;AAAA,MACA,YAAA;AAAA,MAAA,MAAA;AAAA,KAEF;AAEA,IAAA,IAAI,kBAAkB,OAAA,EAAS;AAC7B,MAAA,MAAA,CAAO,MAAM,MAAM;AAAA,MAAC,CAAC,CAAA;AACrB,MAAA,IAAA,CAAK,MAAA,CAAO,IAAA;AAAA,QACV;AAAA,OACF;AACA,MAAA,MAAM,IAAI,KAAA,EAAM;AAAA,IAClB;AAEA,IAAA,MAAM,kBAAA,GAAqB,CAAC,QAAA,EAAU,YAAY,CAAA;AAClD,IAAA,MAAM,WAAA,GAAc,MAAA,CAAO,IAAA,CAAK,WAAW,CAAA;AAC3C,IAAA,IACE,OAAO,OAAA,KAAY,QAAA,IACnB,WAAA,CAAY,IAAA,CAAK,CAAC,CAAA,KAAM,CAAC,kBAAA,CAAmB,QAAA,CAAS,CAAC,CAAC,CAAA,EACvD;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,oEAAA,GACE,WAAA,CAAY,IAAA,CAAK,IAAI;AAAA,OACzB;AAAA,IACF;AAEA,IAAA,OAAO,GAAA,CAAI,IAAA,CAAK,OAAA,EAAS,MAAA,EAAQ,WAAW,CAAA;AAAA,EAC9C;AAAA,EAOA,SAAA,CACE,OAAA,EACA,OAAA,GAA0B,EAAC,EACV;AACjB,IAAA,MAAM,cAAc,IAAA,CAAK,eAAA;AAAA,MACvB,EAAE,GAAG,OAAA,EAAQ;AAAA,MACb;AAAA,KACF;AACA,IAAA,MAAM,SAAS,IAAA,CAAK,YAAA;AAAA,MAClB,OAAA;AAAA,MACA,OAAA;AAAA,MACA,YAAA;AAAA,MAAA,MAAA;AAAA,KAEF;AAEA,IAAA,MAAM,kBAAA,GAAqB,CAAC,QAAA,EAAU,YAAY,CAAA;AAClD,IAAA,MAAM,WAAA,GAAc,MAAA,CAAO,IAAA,CAAK,WAAW,CAAA;AAC3C,IAAA,IACE,OAAO,OAAA,KAAY,QAAA,IACnB,WAAA,CAAY,IAAA,CAAK,CAAC,CAAA,KAAM,CAAC,kBAAA,CAAmB,QAAA,CAAS,CAAC,CAAC,CAAA,EACvD;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,oEAAA,GACE,WAAA,CAAY,IAAA,CAAK,IAAI;AAAA,OACzB;AAAA,IACF;AAEA,IAAA,OAAO,IAAI,OAAA;AAAA,MAAQ,CAAC,OAAA,EAAS,MAAA,KAC3B,OAAA,CAAQ,OAAA,EAAQ,CACb,IAAA,CAAK,MAAM,MAAM,CAAA,CACjB,IAAA,CAAK,CAAC,IAAA,KAA6B;AAClC,QAAA,GAAA,CAAI,IAAA;AAAA,UAAK,OAAA;AAAA,UAAS,IAAA;AAAA,UAAM,WAAA;AAAA,UAAa,CAAC,KAAK,OAAA,KACzC,GAAA,GAAM,OAAO,GAAG,CAAA,GAAI,QAAQ,OAAiB;AAAA,SAC/C;AAAA,MACF,CAAC;AAAA,KACL;AAAA,EACF;AAAA,EAEA,MAAA,CACE,KAAA,EACA,OAAA,GAA4B,EAAC,EAC1B;AACH,IAAA,MAAM,gBAAgB,IAAA,CAAK,eAAA,CAAgB,EAAE,GAAG,OAAA,IAAW,eAAe,CAAA;AAC1E,IAAA,MAAM,SAAS,IAAA,CAAK,YAAA;AAAA,MAClB,KAAA;AAAA,MACA,OAAA;AAAA,MACA,WAAA;AAAA,MAAA,QAAA;AAAA,KAEF;AAEA,IAAA,IAAI,kBAAkB,OAAA,EAAS;AAC7B,MAAA,MAAA,CAAO,MAAM,MAAM;AAAA,MAAC,CAAC,CAAA;AACrB,MAAA,IAAA,CAAK,MAAA,CAAO,IAAA;AAAA,QACV;AAAA,OACF;AACA,MAAA,MAAM,IAAI,KAAA,EAAM;AAAA,IAClB;AAGA,IAAA,OAAO,GAAA,CAAI,MAAA,CAAO,KAAA,EAAO,MAAA,EAAQ,aAAa,CAAA;AAAA,EAChD;AAAA,EAEA,WAAA,CACE,KAAA,EACA,OAAA,GAA4B,EAAC,EACjB;AACZ,IAAA,MAAM,gBAAgB,IAAA,CAAK,eAAA,CAAgB,EAAE,GAAG,OAAA,IAAW,eAAe,CAAA;AAC1E,IAAA,MAAM,SAAS,IAAA,CAAK,YAAA;AAAA,MAClB,KAAA;AAAA,MACA,OAAA;AAAA,MACA,WAAA;AAAA,MAAA,QAAA;AAAA,KAEF;AAEA,IAAA,OAAO,IAAI,OAAA;AAAA,MAAQ,CAAC,OAAA,EAAS,MAAA,KAC3B,OAAA,CAAQ,OAAA,EAAQ,CACb,IAAA,CAAK,MAAM,MAAM,CAAA,CACjB,IAAA,CAAK,CAAC,IAAA,KAA6B;AAElC,QAAA,GAAA,CAAI,MAAA;AAAA,UAAO,KAAA;AAAA,UAAO,IAAA;AAAA,UAAM,aAAA;AAAA,UAAe,CAAC,KAAK,OAAA,KAC3C,GAAA,GAAM,OAAO,GAAG,CAAA,GAAI,QAAQ,OAAY;AAAA,SAC1C;AAAA,MACF,CAAC,CAAA,CACA,KAAA,CAAM,MAAM;AAAA,KACjB;AAAA,EACF;AAAA,EAEA,MAAA,CAAgB,OAAe,OAAA,EAAgC;AAC7D,IAAA,OAAO,GAAA,CAAI,MAAA,CAAO,KAAA,EAAO,OAAO,CAAA;AAAA,EAClC;AAAA,EAEQ,eAAA,CACN,SACA,GAAA,EAC6B;AAC7B,IAAA,OAAO,OAAA,CAAQ,MAAA;AACf,IAAA,IAAI,QAAQ,aAAA,EAAe;AACzB,MAAA,OAAQ,OAAA,CAA2B,UAAA;AAAA,IACrC,CAAA,MAAO;AACL,MAAA,OAAQ,OAAA,CAA6B,SAAA;AAAA,IACvC;AACA,IAAA,OAAO,OAAA,GACH;AAAA,MACE,GAAG,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAAA,MACnB,GAAG;AAAA,KACL;AAAA;AAAA,MAEA,IAAA,CAAK,QAAQ,GAAG;AAAA,KAAA;AAAA,EACtB;AAAA,EAEQ,YAAA,CACN,KAAA,EACA,OAAA,EACA,GAAA,EACA,iBAAA,EACkD;AAClD,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,mBAAA,GACxB,IAAA,CAAK,OAAA,CAAQ,mBAAA,CAAoB,iBAAA,EAAmB,KAAA,EAAO,OAAO,CAAA,GAClE,OAAA,EAAS,UACT,IAAA,CAAK,OAAA,CAAQ,MAAA,KACZ,GAAA,KAAQ,YAAA,GACJ,OAAA,EAA4B,UAAA,IAAc,IAAA,CAAK,OAAA,CAAQ,UAAA,GACvD,OAAA,EAA8B,SAAA,IAC/B,IAAA,CAAK,OAAA,CAAQ,SAAA,CAAA,IACjB,IAAA,CAAK,QAAQ,GAAG,CAAA;AAEpB,IAAA,OAAO,MAAA;AAAA,EACT;AACF,CAAA;AAvLO,KAAA,GAAA,gBAAA,CAAA,CAAA;AAAM,WAAA,GAAN,0CAHP,sBAAA,EAGa,WAAA,CAAA;AAAN,iBAAA,CAAA,KAAA,EAAA,CAAA,EAAM,WAAA,CAAA;AAAN,IAAM,UAAA,GAAN;ACXA,SAAS,kBACd,MAAA,EAGoE;AACpE,EAAA,IAAI,OAAO,WAAW,UAAA,EAAY;AAChC,IAAA,OAAOC,cAAAA,CAAe,OAAA,CAAQ,eAAA,EAAiB,MAAM,CAAA;AAAA,EACvD;AACA,EAAA,OAAOA,cAAAA,CAAe,KAAA,CAAM,eAAA,EAAiB,MAAM,CAAA;AACrD;;;ACnBO,IAAM,oBAAoBC,GAAAA,CAAI;AAC9B,IAAM,iBAAiBA,GAAAA,CAAI;AAC3B,IAAM,oBAAoBA,GAAAA,CAAI","file":"index.mjs","sourcesContent":["import type { Secret as JwtSecret } from 'jsonwebtoken'\n\nimport { z } from 'zod/v4'\n\nexport enum RequestType {\n  Sign = 'Sign',\n  Verify = 'Verify',\n}\n\nexport const AlgorithmType = z.enum([\n  'HS256',\n  'HS384',\n  'HS512',\n  'RS256',\n  'RS384',\n  'RS512',\n  'ES256',\n  'ES384',\n  'ES512',\n  'PS256',\n  'PS384',\n  'PS512',\n  'none',\n])\n\nexport const JwtHeaderSchema = z.object({\n  alg: AlgorithmType.or(z.string()),\n  typ: z.string().optional(),\n  cty: z.string().optional(),\n  crit: z.string().array().optional(),\n  kid: z.string().optional(),\n  jku: z.string().optional(),\n  x5u: z.union([z.string(), z.array(z.string())]).optional(),\n  'x5t#S256': z.string().optional(),\n  x5t: z.string().optional(),\n  x5c: z.union([z.string(), z.array(z.string())]).optional(),\n})\n\nexport type JwtHeader = z.infer<typeof JwtHeaderSchema>\n\nexport const SignOptionsSchema = z.object({\n  algorithm: AlgorithmType.optional(),\n  keyid: z.string().optional(),\n  expiresIn: z.union([z.string(), z.number()]).optional(),\n  notBefore: z.union([z.string(), z.number()]).optional(),\n  audience: z\n    .union([\n      z.string(),\n      z.instanceof(RegExp),\n      z.array(z.union([z.string(), z.instanceof(RegExp)])),\n    ])\n    .optional(),\n  subject: z.string().optional(),\n  issuer: z.string().optional(),\n  jwtid: z.string().optional(),\n  mutatePayload: z.boolean().optional(),\n  noTimestamp: z.boolean().optional(),\n  header: JwtHeaderSchema.optional(),\n  encoding: z.string().optional(),\n  allowInsecureKeySizes: z.boolean().optional(),\n  allowInvalidAsymmetricKeyTypes: z.boolean().optional(),\n})\n\nexport type SignOptions = z.infer<typeof SignOptionsSchema>\n\nexport const VerifyOptionsSchema = z.object({\n  algorithms: AlgorithmType.array().optional(),\n  audience: z\n    .union([\n      z.string(),\n      z.instanceof(RegExp),\n      z.array(z.union([z.string(), z.instanceof(RegExp)])),\n    ])\n    .optional(),\n  clockTimestamp: z.number().optional(),\n  clockTolerance: z.number().optional(),\n  complete: z.boolean().optional(),\n  issuer: z.union([z.string(), z.string().array()]).optional(),\n  ignoreExpiration: z.boolean().optional(),\n  ignoreNotBefore: z.boolean().optional(),\n  jwtid: z.string().optional(),\n  nonce: z.string().optional(),\n  subject: z.string().optional(),\n  maxAge: z.union([z.string(), z.number()]).optional(),\n  allowInvalidAsymmetricKeyTypes: z.boolean().optional(),\n})\n\nexport type VerifyOptions = z.infer<typeof VerifyOptionsSchema>\n\nexport const SecretSchema = z.union([\n  z.string(),\n  z.instanceof(Buffer),\n  z\n    .object({\n      type: z.string(),\n    })\n    .passthrough(),\n  z.object({\n    key: z.union([z.string(), z.instanceof(Buffer)]),\n    passphrase: z.string(),\n  }),\n])\n\nexport type Secret = z.infer<typeof SecretSchema>\n\nexport const JwtServiceOptionsSchema = z.object({\n  signOptions: SignOptionsSchema.optional(),\n  secret: z.string().optional(),\n  publicKey: z.union([z.string(), z.instanceof(Buffer)]).optional(),\n  privateKey: SecretSchema.optional(),\n  verifyOptions: VerifyOptionsSchema.optional(),\n  secretOrKeyProvider: z\n    .function({\n      input: [\n        z.enum(RequestType),\n        z.any(),\n        z.union([SignOptionsSchema, VerifyOptionsSchema]).optional(),\n      ],\n      output: z.union([SecretSchema, z.promise(SecretSchema)]),\n    })\n    .optional(),\n})\n\nexport type JwtServiceOptions = z.infer<typeof JwtServiceOptionsSchema>\n\nexport interface JwtSignOptions extends SignOptions {\n  secret?: string | Buffer\n  privateKey?: Secret\n}\n\nexport interface JwtVerifyOptions extends VerifyOptions {\n  secret?: string | Buffer\n  publicKey?: string | Buffer\n}\n\nexport type GetSecretKeyResult = string | Buffer | JwtSecret\n","import { inject, Injectable, InjectionToken, Logger } from '@navios/core'\n\nimport jwt from 'jsonwebtoken'\n\nimport type {\n  GetSecretKeyResult,\n  JwtServiceOptions,\n  JwtSignOptions,\n  JwtVerifyOptions,\n  SignOptions,\n  VerifyOptions,\n} from './options/jwt-service.options.mjs'\n\nimport {\n  JwtServiceOptionsSchema,\n  RequestType,\n} from './options/jwt-service.options.mjs'\n\nexport const JwtServiceToken = InjectionToken.create(\n  Symbol.for('JwtService'),\n  JwtServiceOptionsSchema,\n)\n\n@Injectable({\n  token: JwtServiceToken,\n})\nexport class JwtService {\n  logger = inject(Logger, {\n    context: JwtService.name,\n  })\n\n  constructor(private readonly options: JwtServiceOptions = {}) {}\n\n  sign(\n    payload: string,\n    options?: Omit<JwtSignOptions, keyof SignOptions>,\n  ): string\n  sign(payload: Buffer | object, options?: JwtSignOptions): string\n  sign(\n    payload: string | Buffer | object,\n    options: JwtSignOptions = {},\n  ): string {\n    const signOptions = this.mergeJwtOptions(\n      { ...options },\n      'signOptions',\n    ) as jwt.SignOptions\n    const secret = this.getSecretKey(\n      payload,\n      options,\n      'privateKey',\n      RequestType.Sign,\n    )\n\n    if (secret instanceof Promise) {\n      secret.catch(() => {}) // suppress rejection from async provider\n      this.logger.warn(\n        'For async version of \"secretOrKeyProvider\", please use \"signAsync\".',\n      )\n      throw new Error()\n    }\n\n    const allowedSignOptKeys = ['secret', 'privateKey']\n    const signOptKeys = Object.keys(signOptions)\n    if (\n      typeof payload === 'string' &&\n      signOptKeys.some((k) => !allowedSignOptKeys.includes(k))\n    ) {\n      throw new Error(\n        'Payload as string is not allowed with the following sign options: ' +\n          signOptKeys.join(', '),\n      )\n    }\n\n    return jwt.sign(payload, secret, signOptions)\n  }\n\n  signAsync(\n    payload: string,\n    options?: Omit<JwtSignOptions, keyof jwt.SignOptions>,\n  ): Promise<string>\n  signAsync(payload: Buffer | object, options?: JwtSignOptions): Promise<string>\n  signAsync(\n    payload: string | Buffer | object,\n    options: JwtSignOptions = {},\n  ): Promise<string> {\n    const signOptions = this.mergeJwtOptions(\n      { ...options },\n      'signOptions',\n    ) as jwt.SignOptions\n    const secret = this.getSecretKey(\n      payload,\n      options,\n      'privateKey',\n      RequestType.Sign,\n    )\n\n    const allowedSignOptKeys = ['secret', 'privateKey']\n    const signOptKeys = Object.keys(signOptions)\n    if (\n      typeof payload === 'string' &&\n      signOptKeys.some((k) => !allowedSignOptKeys.includes(k))\n    ) {\n      throw new Error(\n        'Payload as string is not allowed with the following sign options: ' +\n          signOptKeys.join(', '),\n      )\n    }\n\n    return new Promise((resolve, reject) =>\n      Promise.resolve()\n        .then(() => secret)\n        .then((scrt: GetSecretKeyResult) => {\n          jwt.sign(payload, scrt, signOptions, (err, encoded) =>\n            err ? reject(err) : resolve(encoded as string),\n          )\n        }),\n    )\n  }\n\n  verify<T extends object = any>(\n    token: string,\n    options: JwtVerifyOptions = {},\n  ): T {\n    const verifyOptions = this.mergeJwtOptions({ ...options }, 'verifyOptions')\n    const secret = this.getSecretKey(\n      token,\n      options,\n      'publicKey',\n      RequestType.Verify,\n    )\n\n    if (secret instanceof Promise) {\n      secret.catch(() => {}) // suppress rejection from async provider\n      this.logger.warn(\n        'For async version of \"secretOrKeyProvider\", please use \"verifyAsync\".',\n      )\n      throw new Error()\n    }\n\n    // @ts-expect-error We check it\n    return jwt.verify(token, secret, verifyOptions) as unknown as T\n  }\n\n  verifyAsync<T extends object = any>(\n    token: string,\n    options: JwtVerifyOptions = {},\n  ): Promise<T> {\n    const verifyOptions = this.mergeJwtOptions({ ...options }, 'verifyOptions')\n    const secret = this.getSecretKey(\n      token,\n      options,\n      'publicKey',\n      RequestType.Verify,\n    )\n\n    return new Promise((resolve, reject) =>\n      Promise.resolve()\n        .then(() => secret)\n        .then((scrt: GetSecretKeyResult) => {\n          // @ts-expect-error We check it\n          jwt.verify(token, scrt, verifyOptions, (err, decoded) =>\n            err ? reject(err) : resolve(decoded as T),\n          )\n        })\n        .catch(reject),\n    )\n  }\n\n  decode<T = any>(token: string, options?: jwt.DecodeOptions): T {\n    return jwt.decode(token, options) as T\n  }\n\n  private mergeJwtOptions(\n    options: JwtVerifyOptions | JwtSignOptions,\n    key: 'verifyOptions' | 'signOptions',\n  ): VerifyOptions | SignOptions {\n    delete options.secret\n    if (key === 'signOptions') {\n      delete (options as JwtSignOptions).privateKey\n    } else {\n      delete (options as JwtVerifyOptions).publicKey\n    }\n    return options\n      ? {\n          ...this.options[key],\n          ...options,\n        }\n      : // @ts-expect-error We check it\n        this.options[key]\n  }\n\n  private getSecretKey(\n    token: string | object | Buffer,\n    options: JwtVerifyOptions | JwtSignOptions,\n    key: 'publicKey' | 'privateKey',\n    secretRequestType: RequestType,\n  ): GetSecretKeyResult | Promise<GetSecretKeyResult> {\n    const secret = this.options.secretOrKeyProvider\n      ? this.options.secretOrKeyProvider(secretRequestType, token, options)\n      : options?.secret ||\n        this.options.secret ||\n        (key === 'privateKey'\n          ? (options as JwtSignOptions)?.privateKey || this.options.privateKey\n          : (options as JwtVerifyOptions)?.publicKey ||\n            this.options.publicKey) ||\n        this.options[key]\n\n    return secret as GetSecretKeyResult\n  }\n}\n","import type { BoundInjectionToken, FactoryInjectionToken } from '@navios/core'\n\nimport { InjectionToken } from '@navios/core'\n\nimport type { JwtServiceOptions } from './options/jwt-service.options.mjs'\n\nimport { JwtService, JwtServiceToken } from './jwt.service.mjs'\nimport { JwtServiceOptionsSchema } from './options/jwt-service.options.mjs'\n\nexport function provideJwtService(\n  config: JwtServiceOptions,\n): BoundInjectionToken<JwtService, typeof JwtServiceOptionsSchema>\nexport function provideJwtService(\n  config: () => Promise<JwtServiceOptions>,\n): FactoryInjectionToken<JwtService, typeof JwtServiceOptionsSchema>\nexport function provideJwtService(\n  config: JwtServiceOptions | (() => Promise<JwtServiceOptions>),\n):\n  | BoundInjectionToken<JwtService, typeof JwtServiceOptionsSchema>\n  | FactoryInjectionToken<JwtService, typeof JwtServiceOptionsSchema> {\n  if (typeof config === 'function') {\n    return InjectionToken.factory(JwtServiceToken, config)\n  }\n  return InjectionToken.bound(JwtServiceToken, config)\n}\n","import jwt from 'jsonwebtoken'\n\nexport * from './options/jwt-service.options.mjs'\nexport * from './jwt.service.mjs'\nexport * from './jwt-service.provider.mjs'\nexport const TokenExpiredError = jwt.TokenExpiredError\nexport const NotBeforeError = jwt.NotBeforeError\nexport const JsonWebTokenError = jwt.JsonWebTokenError\n"]}
+{"version":3,"file":"index.mjs","names":["z","RequestType","AlgorithmType","enum","JwtHeaderSchema","object","alg","or","string","typ","optional","cty","crit","array","kid","jku","x5u","union","x5t","x5c","SignOptionsSchema","algorithm","keyid","expiresIn","number","notBefore","audience","instanceof","RegExp","subject","issuer","jwtid","mutatePayload","boolean","noTimestamp","header","encoding","allowInsecureKeySizes","allowInvalidAsymmetricKeyTypes","VerifyOptionsSchema","algorithms","clockTimestamp","clockTolerance","complete","ignoreExpiration","ignoreNotBefore","nonce","maxAge","SecretSchema","Buffer","type","passthrough","key","passphrase","JwtServiceOptionsSchema","signOptions","secret","publicKey","privateKey","verifyOptions","secretOrKeyProvider","function","input","any","output","promise","inject","Injectable","InjectionToken","Logger","jwt","JwtServiceOptionsSchema","RequestType","JwtServiceToken","create","Symbol","for","token","JwtService","options","logger","context","name","sign","payload","signOptions","mergeJwtOptions","secret","getSecretKey","Sign","Promise","catch","warn","Error","allowedSignOptKeys","signOptKeys","Object","keys","some","k","includes","join","signAsync","resolve","reject","then","scrt","err","encoded","verify","verifyOptions","Verify","verifyAsync","decoded","decode","key","privateKey","publicKey","secretRequestType","secretOrKeyProvider","InjectionToken","JwtServiceToken","provideJwtService","config","factory","bound","jwt","TokenExpiredError","NotBeforeError","JsonWebTokenError"],"sources":["../src/options/jwt-service.options.mts","../src/jwt.service.mts","../src/jwt-service.provider.mts","../src/index.mts"],"sourcesContent":["import type { Secret as JwtSecret } from 'jsonwebtoken'\n\nimport { z } from 'zod/v4'\n\n/**\n * Request type for secret or key provider functions.\n *\n * Used to distinguish between signing and verification operations when\n * dynamically resolving secrets or keys.\n */\nexport enum RequestType {\n  /** Request is for signing a token */\n  Sign = 'Sign',\n  /** Request is for verifying a token */\n  Verify = 'Verify',\n}\n\n/**\n * Supported JWT algorithms.\n *\n * Includes symmetric (HMAC) and asymmetric (RSA, ECDSA, EdDSA) algorithms.\n */\nexport const AlgorithmType = z.enum([\n  'HS256',\n  'HS384',\n  'HS512',\n  'RS256',\n  'RS384',\n  'RS512',\n  'ES256',\n  'ES384',\n  'ES512',\n  'PS256',\n  'PS384',\n  'PS512',\n  'none',\n])\n\n/**\n * JWT header schema.\n *\n * Defines the structure of the JWT header with standard claims.\n */\nexport const JwtHeaderSchema = z.object({\n  alg: AlgorithmType.or(z.string()),\n  typ: z.string().optional(),\n  cty: z.string().optional(),\n  crit: z.string().array().optional(),\n  kid: z.string().optional(),\n  jku: z.string().optional(),\n  x5u: z.union([z.string(), z.array(z.string())]).optional(),\n  'x5t#S256': z.string().optional(),\n  x5t: z.string().optional(),\n  x5c: z.union([z.string(), z.array(z.string())]).optional(),\n})\n\n/**\n * JWT header type.\n *\n * Contains algorithm, type, and optional header claims.\n */\nexport type JwtHeader = z.infer<typeof JwtHeaderSchema>\n\n/**\n * Schema for JWT signing options.\n *\n * Defines all available options for signing tokens including algorithm,\n * expiration, audience, issuer, and other standard JWT claims.\n */\nexport const SignOptionsSchema = z.object({\n  algorithm: AlgorithmType.optional(),\n  keyid: z.string().optional(),\n  expiresIn: z.union([z.string(), z.number()]).optional(),\n  notBefore: z.union([z.string(), z.number()]).optional(),\n  audience: z\n    .union([\n      z.string(),\n      z.instanceof(RegExp),\n      z.array(z.union([z.string(), z.instanceof(RegExp)])),\n    ])\n    .optional(),\n  subject: z.string().optional(),\n  issuer: z.string().optional(),\n  jwtid: z.string().optional(),\n  mutatePayload: z.boolean().optional(),\n  noTimestamp: z.boolean().optional(),\n  header: JwtHeaderSchema.optional(),\n  encoding: z.string().optional(),\n  allowInsecureKeySizes: z.boolean().optional(),\n  allowInvalidAsymmetricKeyTypes: z.boolean().optional(),\n})\n\n/**\n * Options for signing JWT tokens.\n *\n * @see SignOptionsSchema for the complete schema definition\n */\nexport type SignOptions = z.infer<typeof SignOptionsSchema>\n\n/**\n * Schema for JWT verification options.\n *\n * Defines all available options for verifying tokens including allowed\n * algorithms, audience, issuer, expiration handling, and other validation rules.\n */\nexport const VerifyOptionsSchema = z.object({\n  algorithms: AlgorithmType.array().optional(),\n  audience: z\n    .union([\n      z.string(),\n      z.instanceof(RegExp),\n      z.array(z.union([z.string(), z.instanceof(RegExp)])),\n    ])\n    .optional(),\n  clockTimestamp: z.number().optional(),\n  clockTolerance: z.number().optional(),\n  complete: z.boolean().optional(),\n  issuer: z.union([z.string(), z.string().array()]).optional(),\n  ignoreExpiration: z.boolean().optional(),\n  ignoreNotBefore: z.boolean().optional(),\n  jwtid: z.string().optional(),\n  nonce: z.string().optional(),\n  subject: z.string().optional(),\n  maxAge: z.union([z.string(), z.number()]).optional(),\n  allowInvalidAsymmetricKeyTypes: z.boolean().optional(),\n})\n\n/**\n * Options for verifying JWT tokens.\n *\n * @see VerifyOptionsSchema for the complete schema definition\n */\nexport type VerifyOptions = z.infer<typeof VerifyOptionsSchema>\n\n/**\n * Schema for JWT secret/key types.\n *\n * Supports string secrets, Buffer objects, and key objects with passphrases.\n */\nexport const SecretSchema = z.union([\n  z.string(),\n  z.instanceof(Buffer),\n  z\n    .object({\n      type: z.string(),\n    })\n    .passthrough(),\n  z.object({\n    key: z.union([z.string(), z.instanceof(Buffer)]),\n    passphrase: z.string(),\n  }),\n])\n\n/**\n * Secret or key type for JWT operations.\n *\n * Can be a string, Buffer, or an object with key and optional passphrase.\n */\nexport type Secret = z.infer<typeof SecretSchema>\n\nexport const JwtServiceOptionsSchema = z.object({\n  signOptions: SignOptionsSchema.optional(),\n  secret: z.string().optional(),\n  publicKey: z.union([z.string(), z.instanceof(Buffer)]).optional(),\n  privateKey: SecretSchema.optional(),\n  verifyOptions: VerifyOptionsSchema.optional(),\n  secretOrKeyProvider: z\n    .function({\n      input: [\n        z.enum(RequestType),\n        z.any(),\n        z.union([SignOptionsSchema, VerifyOptionsSchema]).optional(),\n      ],\n      output: z.union([SecretSchema, z.promise(SecretSchema)]),\n    })\n    .optional(),\n})\n\n/**\n * Configuration options for the JWT service.\n *\n * @property signOptions - Default options for signing tokens\n * @property secret - Default secret for symmetric algorithms (HS256, HS384, HS512)\n * @property publicKey - Default public key for asymmetric algorithms (RS256, ES256, etc.)\n * @property privateKey - Default private key for asymmetric algorithms\n * @property verifyOptions - Default options for verifying tokens\n * @property secretOrKeyProvider - Optional function to dynamically resolve secrets/keys\n *\n * @example\n * ```ts\n * const options: JwtServiceOptions = {\n *   secret: 'your-secret-key',\n *   signOptions: {\n *     expiresIn: '1h',\n *     algorithm: 'HS256',\n *   },\n *   verifyOptions: {\n *     algorithms: ['HS256'],\n *   },\n * }\n * ```\n */\nexport type JwtServiceOptions = z.infer<typeof JwtServiceOptionsSchema>\n\n/**\n * Options for signing JWT tokens.\n *\n * Extends `SignOptions` with additional properties for specifying\n * the secret or private key to use for signing.\n *\n * @property secret - Secret key for symmetric algorithms (overrides service default)\n * @property privateKey - Private key for asymmetric algorithms (overrides service default)\n */\nexport interface JwtSignOptions extends SignOptions {\n  /** Secret key for symmetric algorithms */\n  secret?: string | Buffer\n  /** Private key for asymmetric algorithms */\n  privateKey?: Secret\n}\n\n/**\n * Options for verifying JWT tokens.\n *\n * Extends `VerifyOptions` with additional properties for specifying\n * the secret or public key to use for verification.\n *\n * @property secret - Secret key for symmetric algorithms (overrides service default)\n * @property publicKey - Public key for asymmetric algorithms (overrides service default)\n */\nexport interface JwtVerifyOptions extends VerifyOptions {\n  /** Secret key for symmetric algorithms */\n  secret?: string | Buffer\n  /** Public key for asymmetric algorithms */\n  publicKey?: string | Buffer\n}\n\n/**\n * Result type for secret/key resolution.\n *\n * Represents the possible return types from secret or key provider functions.\n */\nexport type GetSecretKeyResult = string | Buffer | JwtSecret\n","import { inject, Injectable, InjectionToken, Logger } from '@navios/core'\n\nimport jwt from 'jsonwebtoken'\n\nimport type {\n  GetSecretKeyResult,\n  JwtServiceOptions,\n  JwtSignOptions,\n  JwtVerifyOptions,\n  SignOptions,\n  VerifyOptions,\n} from './options/jwt-service.options.mjs'\n\nimport {\n  JwtServiceOptionsSchema,\n  RequestType,\n} from './options/jwt-service.options.mjs'\n\n/**\n * Injection token for JwtService.\n *\n * Used internally by the dependency injection system to register and resolve JwtService instances.\n */\nexport const JwtServiceToken = InjectionToken.create(\n  Symbol.for('JwtService'),\n  JwtServiceOptionsSchema,\n)\n\n/**\n * Service for signing, verifying, and decoding JSON Web Tokens (JWTs).\n *\n * This service provides a type-safe wrapper around the `jsonwebtoken` library with\n * seamless integration into Navios's dependency injection system. It supports both\n * symmetric (HS256, HS384, HS512) and asymmetric (RS256, ES256, etc.) algorithms.\n *\n * @example\n * ```ts\n * import { provideJwtService } from '@navios/jwt'\n * import { inject } from '@navios/core'\n *\n * const JwtService = provideJwtService({\n *   secret: 'your-secret-key',\n *   signOptions: { expiresIn: '1h' },\n * })\n *\n * @Injectable()\n * class AuthService {\n *   jwtService = inject(JwtService)\n *\n *   async login(userId: string) {\n *     const token = this.jwtService.sign({ userId, role: 'user' })\n *     return token\n *   }\n * }\n * ```\n */\n@Injectable({\n  token: JwtServiceToken,\n})\nexport class JwtService {\n  logger = inject(Logger, {\n    context: JwtService.name,\n  })\n\n  /**\n   * Creates a new JwtService instance.\n   *\n   * @param options - Configuration options for the JWT service\n   */\n  constructor(private readonly options: JwtServiceOptions = {}) {}\n\n  /**\n   * Signs a JWT payload synchronously.\n   *\n   * When the payload is a string, only `secret` and `privateKey` options are allowed.\n   * For object or Buffer payloads, all sign options are available.\n   *\n   * @param payload - The payload to sign. Can be a string, Buffer, or object.\n   * @param options - Signing options. When payload is a string, only `secret` and `privateKey` are allowed.\n   * @returns The signed JWT token as a string\n   * @throws {Error} If `secretOrKeyProvider` returns a Promise (use `signAsync` instead)\n   * @throws {Error} If payload is a string and invalid options are provided\n   *\n   * @example\n   * ```ts\n   * // Sign with object payload\n   * const token = jwtService.sign(\n   *   { userId: '123', role: 'admin' },\n   *   { expiresIn: '1h' }\n   * )\n   *\n   * // Sign with string payload (limited options)\n   * const token = jwtService.sign('payload-string', { secret: 'key' })\n   * ```\n   */\n  sign(\n    payload: string,\n    options?: Omit<JwtSignOptions, keyof SignOptions>,\n  ): string\n  /**\n   * Signs a JWT payload synchronously.\n   *\n   * @param payload - The payload to sign. Can be a Buffer or object.\n   * @param options - Signing options including algorithm, expiration, etc.\n   * @returns The signed JWT token as a string\n   */\n  sign(payload: Buffer | object, options?: JwtSignOptions): string\n  sign(\n    payload: string | Buffer | object,\n    options: JwtSignOptions = {},\n  ): string {\n    const signOptions = this.mergeJwtOptions(\n      { ...options },\n      'signOptions',\n    ) as jwt.SignOptions\n    const secret = this.getSecretKey(\n      payload,\n      options,\n      'privateKey',\n      RequestType.Sign,\n    )\n\n    if (secret instanceof Promise) {\n      secret.catch(() => {}) // suppress rejection from async provider\n      this.logger.warn(\n        'For async version of \"secretOrKeyProvider\", please use \"signAsync\".',\n      )\n      throw new Error()\n    }\n\n    const allowedSignOptKeys = ['secret', 'privateKey']\n    const signOptKeys = Object.keys(signOptions)\n    if (\n      typeof payload === 'string' &&\n      signOptKeys.some((k) => !allowedSignOptKeys.includes(k))\n    ) {\n      throw new Error(\n        'Payload as string is not allowed with the following sign options: ' +\n          signOptKeys.join(', '),\n      )\n    }\n\n    return jwt.sign(payload, secret, signOptions)\n  }\n\n  /**\n   * Signs a JWT payload asynchronously.\n   *\n   * Use this method when `secretOrKeyProvider` returns a Promise or when you need\n   * to handle async key resolution. Supports the same payload types and options as `sign()`.\n   *\n   * @param payload - The payload to sign. Can be a string, Buffer, or object.\n   * @param options - Signing options. When payload is a string, only `secret` and `privateKey` are allowed.\n   * @returns A Promise that resolves to the signed JWT token as a string\n   * @throws {Error} If payload is a string and invalid options are provided\n   *\n   * @example\n   * ```ts\n   * // Sign with async key provider\n   * const token = await jwtService.signAsync(\n   *   { userId: '123' },\n   *   { expiresIn: '1h' }\n   * )\n   * ```\n   */\n  signAsync(\n    payload: string,\n    options?: Omit<JwtSignOptions, keyof jwt.SignOptions>,\n  ): Promise<string>\n  /**\n   * Signs a JWT payload asynchronously.\n   *\n   * @param payload - The payload to sign. Can be a Buffer or object.\n   * @param options - Signing options including algorithm, expiration, etc.\n   * @returns A Promise that resolves to the signed JWT token as a string\n   */\n  signAsync(payload: Buffer | object, options?: JwtSignOptions): Promise<string>\n  signAsync(\n    payload: string | Buffer | object,\n    options: JwtSignOptions = {},\n  ): Promise<string> {\n    const signOptions = this.mergeJwtOptions(\n      { ...options },\n      'signOptions',\n    ) as jwt.SignOptions\n    const secret = this.getSecretKey(\n      payload,\n      options,\n      'privateKey',\n      RequestType.Sign,\n    )\n\n    const allowedSignOptKeys = ['secret', 'privateKey']\n    const signOptKeys = Object.keys(signOptions)\n    if (\n      typeof payload === 'string' &&\n      signOptKeys.some((k) => !allowedSignOptKeys.includes(k))\n    ) {\n      throw new Error(\n        'Payload as string is not allowed with the following sign options: ' +\n          signOptKeys.join(', '),\n      )\n    }\n\n    return new Promise((resolve, reject) =>\n      Promise.resolve()\n        .then(() => secret)\n        .then((scrt: GetSecretKeyResult) => {\n          jwt.sign(payload, scrt, signOptions, (err, encoded) =>\n            err ? reject(err) : resolve(encoded as string),\n          )\n        }),\n    )\n  }\n\n  /**\n   * Verifies and decodes a JWT token synchronously.\n   *\n   * This method validates the token's signature, expiration, and other claims\n   * according to the provided options. If verification fails, an error is thrown.\n   *\n   * @template T - The expected type of the decoded payload\n   * @param token - The JWT token string to verify\n   * @param options - Verification options including algorithms, audience, issuer, etc.\n   * @returns The decoded payload as type T\n   * @throws {TokenExpiredError} If the token has expired\n   * @throws {NotBeforeError} If the token is not yet valid (nbf claim)\n   * @throws {JsonWebTokenError} If the token is invalid or malformed\n   * @throws {Error} If `secretOrKeyProvider` returns a Promise (use `verifyAsync` instead)\n   *\n   * @example\n   * ```ts\n   * try {\n   *   const payload = jwtService.verify<{ userId: string; role: string }>(token)\n   *   console.log(payload.userId) // '123'\n   * } catch (error) {\n   *   if (error instanceof TokenExpiredError) {\n   *     console.error('Token expired')\n   *   }\n   * }\n   * ```\n   */\n  verify<T extends object = any>(\n    token: string,\n    options: JwtVerifyOptions = {},\n  ): T {\n    const verifyOptions = this.mergeJwtOptions({ ...options }, 'verifyOptions')\n    const secret = this.getSecretKey(\n      token,\n      options,\n      'publicKey',\n      RequestType.Verify,\n    )\n\n    if (secret instanceof Promise) {\n      secret.catch(() => {}) // suppress rejection from async provider\n      this.logger.warn(\n        'For async version of \"secretOrKeyProvider\", please use \"verifyAsync\".',\n      )\n      throw new Error()\n    }\n\n    // @ts-expect-error We check it\n    return jwt.verify(token, secret, verifyOptions) as unknown as T\n  }\n\n  /**\n   * Verifies and decodes a JWT token asynchronously.\n   *\n   * Use this method when `secretOrKeyProvider` returns a Promise or when you need\n   * to handle async key resolution. Provides the same validation as `verify()`.\n   *\n   * @template T - The expected type of the decoded payload\n   * @param token - The JWT token string to verify\n   * @param options - Verification options including algorithms, audience, issuer, etc.\n   * @returns A Promise that resolves to the decoded payload as type T\n   * @throws {TokenExpiredError} If the token has expired\n   * @throws {NotBeforeError} If the token is not yet valid (nbf claim)\n   * @throws {JsonWebTokenError} If the token is invalid or malformed\n   *\n   * @example\n   * ```ts\n   * try {\n   *   const payload = await jwtService.verifyAsync<{ userId: string }>(token)\n   *   console.log(payload.userId)\n   * } catch (error) {\n   *   if (error instanceof TokenExpiredError) {\n   *     console.error('Token expired')\n   *   }\n   * }\n   * ```\n   */\n  verifyAsync<T extends object = any>(\n    token: string,\n    options: JwtVerifyOptions = {},\n  ): Promise<T> {\n    const verifyOptions = this.mergeJwtOptions({ ...options }, 'verifyOptions')\n    const secret = this.getSecretKey(\n      token,\n      options,\n      'publicKey',\n      RequestType.Verify,\n    )\n\n    return new Promise((resolve, reject) =>\n      Promise.resolve()\n        .then(() => secret)\n        .then((scrt: GetSecretKeyResult) => {\n          // @ts-expect-error We check it\n          jwt.verify(token, scrt, verifyOptions, (err, decoded) =>\n            err ? reject(err) : resolve(decoded as T),\n          )\n        })\n        .catch(reject),\n    )\n  }\n\n  /**\n   * Decodes a JWT token without verification.\n   *\n   * This method decodes the token without validating its signature or claims.\n   * Use this only when you need to inspect the token contents without verification.\n   * For secure token validation, use `verify()` or `verifyAsync()` instead.\n   *\n   * @template T - The expected type of the decoded payload\n   * @param token - The JWT token string to decode\n   * @param options - Decode options (complete, json, etc.)\n   * @returns The decoded payload as type T, or null if decoding fails\n   *\n   * @example\n   * ```ts\n   * // Decode without verification (not recommended for production)\n   * const payload = jwtService.decode<{ userId: string }>(token)\n   * if (payload) {\n   *   console.log(payload.userId)\n   * }\n   * ```\n   */\n  decode<T = any>(token: string, options?: jwt.DecodeOptions): T {\n    return jwt.decode(token, options) as T\n  }\n\n  private mergeJwtOptions(\n    options: JwtVerifyOptions | JwtSignOptions,\n    key: 'verifyOptions' | 'signOptions',\n  ): VerifyOptions | SignOptions {\n    delete options.secret\n    if (key === 'signOptions') {\n      delete (options as JwtSignOptions).privateKey\n    } else {\n      delete (options as JwtVerifyOptions).publicKey\n    }\n    return options\n      ? {\n          ...this.options[key],\n          ...options,\n        }\n      : // @ts-expect-error We check it\n        this.options[key]\n  }\n\n  private getSecretKey(\n    token: string | object | Buffer,\n    options: JwtVerifyOptions | JwtSignOptions,\n    key: 'publicKey' | 'privateKey',\n    secretRequestType: RequestType,\n  ): GetSecretKeyResult | Promise<GetSecretKeyResult> {\n    const secret = this.options.secretOrKeyProvider\n      ? this.options.secretOrKeyProvider(secretRequestType, token, options)\n      : options?.secret ||\n        this.options.secret ||\n        (key === 'privateKey'\n          ? (options as JwtSignOptions)?.privateKey || this.options.privateKey\n          : (options as JwtVerifyOptions)?.publicKey ||\n            this.options.publicKey) ||\n        this.options[key]\n\n    return secret as GetSecretKeyResult\n  }\n}\n","import type { BoundInjectionToken, FactoryInjectionToken } from '@navios/core'\n\nimport { InjectionToken } from '@navios/core'\n\nimport type { JwtServiceOptions } from './options/jwt-service.options.mjs'\n\nimport { JwtService, JwtServiceToken } from './jwt.service.mjs'\nimport { JwtServiceOptionsSchema } from './options/jwt-service.options.mjs'\n\n/**\n * Creates a JWT service provider for dependency injection.\n *\n * This function creates an injection token that can be used to register and resolve\n * `JwtService` instances in the Navios dependency injection container. It supports\n * both static configuration and async factory functions for dynamic configuration.\n *\n * @param config - Static JWT service configuration options\n * @returns A bound injection token that can be used with `inject()` or `syncInject()`\n *\n * @example\n * ```ts\n * // Static configuration\n * const JwtService = provideJwtService({\n *   secret: 'your-secret-key',\n *   signOptions: { expiresIn: '1h' },\n * })\n *\n * @Injectable()\n * class AuthService {\n *   jwtService = inject(JwtService)\n * }\n * ```\n */\nexport function provideJwtService(\n  config: JwtServiceOptions,\n): BoundInjectionToken<JwtService, typeof JwtServiceOptionsSchema>\n/**\n * Creates a JWT service provider with async configuration factory.\n *\n * Use this overload when you need to load configuration asynchronously, such as\n * fetching secrets from a configuration service or environment variables.\n *\n * @param config - Async factory function that returns JWT service configuration\n * @returns A factory injection token that resolves configuration asynchronously\n *\n * @example\n * ```ts\n * // Async configuration\n * const JwtService = provideJwtService(async () => {\n *   const configService = await inject(ConfigService)\n *   return {\n *     secret: configService.jwt.secret,\n *     signOptions: { expiresIn: configService.jwt.expiresIn },\n *   }\n * })\n *\n * @Injectable()\n * class AuthService {\n *   jwtService = inject(JwtService)\n * }\n * ```\n */\nexport function provideJwtService(\n  config: () => Promise<JwtServiceOptions>,\n): FactoryInjectionToken<JwtService, typeof JwtServiceOptionsSchema>\nexport function provideJwtService(\n  config: JwtServiceOptions | (() => Promise<JwtServiceOptions>),\n):\n  | BoundInjectionToken<JwtService, typeof JwtServiceOptionsSchema>\n  | FactoryInjectionToken<JwtService, typeof JwtServiceOptionsSchema> {\n  if (typeof config === 'function') {\n    return InjectionToken.factory(JwtServiceToken, config)\n  }\n  return InjectionToken.bound(JwtServiceToken, config)\n}\n","import jwt from 'jsonwebtoken'\n\nexport * from './options/jwt-service.options.mjs'\nexport * from './jwt.service.mjs'\nexport * from './jwt-service.provider.mjs'\n\n/**\n * Error thrown when a JWT token has expired.\n *\n * This error is thrown by `verify()` and `verifyAsync()` when the token's\n * expiration time (exp claim) has passed.\n *\n * @example\n * ```ts\n * try {\n *   jwtService.verify(token)\n * } catch (error) {\n *   if (error instanceof TokenExpiredError) {\n *     console.error('Token expired at:', error.expiredAt)\n *   }\n * }\n * ```\n */\nexport const TokenExpiredError = jwt.TokenExpiredError\n\n/**\n * Error thrown when a JWT token is not yet valid.\n *\n * This error is thrown by `verify()` and `verifyAsync()` when the token's\n * \"not before\" time (nbf claim) is in the future.\n *\n * @example\n * ```ts\n * try {\n *   jwtService.verify(token)\n * } catch (error) {\n *   if (error instanceof NotBeforeError) {\n *     console.error('Token not valid until:', error.date)\n *   }\n * }\n * ```\n */\nexport const NotBeforeError = jwt.NotBeforeError\n\n/**\n * Base error class for JWT-related errors.\n *\n * This is the base class for all JWT errors including `TokenExpiredError`\n * and `NotBeforeError`. It's thrown for invalid or malformed tokens.\n *\n * @example\n * ```ts\n * try {\n *   jwtService.verify(token)\n * } catch (error) {\n *   if (error instanceof JsonWebTokenError) {\n *     console.error('JWT error:', error.message)\n *   }\n * }\n * ```\n */\nexport const JsonWebTokenError = jwt.JsonWebTokenError\n"],"mappings":";;;;;;;;;;GAUA,IAAO,cAAKC,yBAAAA,eAAAA;sCACyB,eAAA,UAAA;wCAEE,eAAA,YAAA;QAH3BA;;;;;;GAYZ,MAAaC,gBAAgBF,EAAEG,KAAK;CAClC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD,CAAA;;;;;GAOD,MAAaC,kBAAkBJ,EAAEK,OAAO;CACtCC,KAAKJ,cAAcK,GAAGP,EAAEQ,QAAM,CAAA;CAC9BC,KAAKT,EAAEQ,QAAM,CAAGE,UAAQ;CACxBC,KAAKX,EAAEQ,QAAM,CAAGE,UAAQ;CACxBE,MAAMZ,EAAEQ,QAAM,CAAGK,OAAK,CAAGH,UAAQ;CACjCI,KAAKd,EAAEQ,QAAM,CAAGE,UAAQ;CACxBK,KAAKf,EAAEQ,QAAM,CAAGE,UAAQ;CACxBM,KAAKhB,EAAEiB,MAAM,CAACjB,EAAEQ,QAAM,EAAIR,EAAEa,MAAMb,EAAEQ,QAAM,CAAA,CAAI,CAAA,CAAEE,UAAQ;CACxD,YAAYV,EAAEQ,QAAM,CAAGE,UAAQ;CAC/BQ,KAAKlB,EAAEQ,QAAM,CAAGE,UAAQ;CACxBS,KAAKnB,EAAEiB,MAAM,CAACjB,EAAEQ,QAAM,EAAIR,EAAEa,MAAMb,EAAEQ,QAAM,CAAA,CAAI,CAAA,CAAEE,UAAQ;CAC1D,CAAA;;;;;;GAeA,MAAaU,oBAAoBpB,EAAEK,OAAO;CACxCgB,WAAWnB,cAAcQ,UAAQ;CACjCY,OAAOtB,EAAEQ,QAAM,CAAGE,UAAQ;CAC1Ba,WAAWvB,EAAEiB,MAAM,CAACjB,EAAEQ,QAAM,EAAIR,EAAEwB,QAAM,CAAG,CAAA,CAAEd,UAAQ;CACrDe,WAAWzB,EAAEiB,MAAM,CAACjB,EAAEQ,QAAM,EAAIR,EAAEwB,QAAM,CAAG,CAAA,CAAEd,UAAQ;CACrDgB,UAAU1B,EACPiB,MAAM;EACLjB,EAAEQ,QAAM;EACRR,EAAE2B,WAAWC,OAAAA;EACb5B,EAAEa,MAAMb,EAAEiB,MAAM,CAACjB,EAAEQ,QAAM,EAAIR,EAAE2B,WAAWC,OAAAA,CAAQ,CAAA,CAAA;EACnD,CAAA,CACAlB,UAAQ;CACXmB,SAAS7B,EAAEQ,QAAM,CAAGE,UAAQ;CAC5BoB,QAAQ9B,EAAEQ,QAAM,CAAGE,UAAQ;CAC3BqB,OAAO/B,EAAEQ,QAAM,CAAGE,UAAQ;CAC1BsB,eAAehC,EAAEiC,SAAO,CAAGvB,UAAQ;CACnCwB,aAAalC,EAAEiC,SAAO,CAAGvB,UAAQ;CACjCyB,QAAQ/B,gBAAgBM,UAAQ;CAChC0B,UAAUpC,EAAEQ,QAAM,CAAGE,UAAQ;CAC7B2B,uBAAuBrC,EAAEiC,SAAO,CAAGvB,UAAQ;CAC3C4B,gCAAgCtC,EAAEiC,SAAO,CAAGvB,UAAQ;CACtD,CAAA;;;;;;GAeA,MAAa6B,sBAAsBvC,EAAEK,OAAO;CAC1CmC,YAAYtC,cAAcW,OAAK,CAAGH,UAAQ;CAC1CgB,UAAU1B,EACPiB,MAAM;EACLjB,EAAEQ,QAAM;EACRR,EAAE2B,WAAWC,OAAAA;EACb5B,EAAEa,MAAMb,EAAEiB,MAAM,CAACjB,EAAEQ,QAAM,EAAIR,EAAE2B,WAAWC,OAAAA,CAAQ,CAAA,CAAA;EACnD,CAAA,CACAlB,UAAQ;CACX+B,gBAAgBzC,EAAEwB,QAAM,CAAGd,UAAQ;CACnCgC,gBAAgB1C,EAAEwB,QAAM,CAAGd,UAAQ;CACnCiC,UAAU3C,EAAEiC,SAAO,CAAGvB,UAAQ;CAC9BoB,QAAQ9B,EAAEiB,MAAM,CAACjB,EAAEQ,QAAM,EAAIR,EAAEQ,QAAM,CAAGK,OAAK,CAAG,CAAA,CAAEH,UAAQ;CAC1DkC,kBAAkB5C,EAAEiC,SAAO,CAAGvB,UAAQ;CACtCmC,iBAAiB7C,EAAEiC,SAAO,CAAGvB,UAAQ;CACrCqB,OAAO/B,EAAEQ,QAAM,CAAGE,UAAQ;CAC1BoC,OAAO9C,EAAEQ,QAAM,CAAGE,UAAQ;CAC1BmB,SAAS7B,EAAEQ,QAAM,CAAGE,UAAQ;CAC5BqC,QAAQ/C,EAAEiB,MAAM,CAACjB,EAAEQ,QAAM,EAAIR,EAAEwB,QAAM,CAAG,CAAA,CAAEd,UAAQ;CAClD4B,gCAAgCtC,EAAEiC,SAAO,CAAGvB,UAAQ;CACtD,CAAA;;;;;GAcA,MAAasC,eAAehD,EAAEiB,MAAM;CAClCjB,EAAEQ,QAAM;CACRR,EAAE2B,WAAWsB,OAAAA;CACbjD,EACGK,OAAO,EACN6C,MAAMlD,EAAEQ,QAAM,EAChB,CAAA,CACC2C,aAAW;CACdnD,EAAEK,OAAO;EACP+C,KAAKpD,EAAEiB,MAAM,CAACjB,EAAEQ,QAAM,EAAIR,EAAE2B,WAAWsB,OAAAA,CAAQ,CAAA;EAC/CI,YAAYrD,EAAEQ,QAAM;EACtB,CAAA;CACD,CAAA;AASD,MAAa8C,0BAA0BtD,EAAEK,OAAO;CAC9CkD,aAAanC,kBAAkBV,UAAQ;CACvC8C,QAAQxD,EAAEQ,QAAM,CAAGE,UAAQ;CAC3B+C,WAAWzD,EAAEiB,MAAM,CAACjB,EAAEQ,QAAM,EAAIR,EAAE2B,WAAWsB,OAAAA,CAAQ,CAAA,CAAEvC,UAAQ;CAC/DgD,YAAYV,aAAatC,UAAQ;CACjCiD,eAAepB,oBAAoB7B,UAAQ;CAC3CkD,qBAAqB5D,EAClB6D,SAAS;EACRC,OAAO;GACL9D,EAAEG,KAAKF,YAAAA;GACPD,EAAE+D,KAAG;GACL/D,EAAEiB,MAAM,CAACG,mBAAmBmB,oBAAoB,CAAA,CAAE7B,UAAQ;GAC3D;EACDsD,QAAQhE,EAAEiB,MAAM,CAAC+B,cAAchD,EAAEiE,QAAQjB,aAAAA,CAAc,CAAA;EACzD,CAAA,CACCtC,UAAQ;CACb,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GCzJA,MAAa+D,kBAAkBL,eAAeM,OAC5CC,OAAOC,IAAI,aAAA,EACXL,wBAAAA;;OA+BDJ,WAAW,EACVU,OAAOJ,iBACT,CAAA;AACO,IAAMK,aAAN,MAAMA;;;;;;;;;IAUX,YAAY,UAA8C,EAAE,EAAE;OAAjCC,UAAAA;;CAT7BC,SAASd,OAAOG,QAAQ,EACtBY,SAASH,YAAWI,MACtB,CAAA;CA6CAC,KACEC,SACAL,UAA0B,EAAE,EACpB;EACR,MAAMM,cAAc,KAAKC,gBACvB,EAAE,GAAGP,SAAQ,EACb,cAAA;EAEF,MAAMQ,SAAS,KAAKC,aAClBJ,SACAL,SACA,cACAP,YAAYiB,KAAI;AAGlB,MAAIF,kBAAkBG,SAAS;AAC7BH,UAAOI,YAAM,GAAO;AACpB,QAAKX,OAAOY,KACV,0EAAA;AAEF,SAAM,IAAIC,OAAAA;;EAGZ,MAAMC,qBAAqB,CAAC,UAAU,aAAa;EACnD,MAAMC,cAAcC,OAAOC,KAAKZ,YAAAA;AAChC,MACE,OAAOD,YAAY,YACnBW,YAAYG,MAAMC,MAAM,CAACL,mBAAmBM,SAASD,EAAAA,CAAAA,CAErD,OAAM,IAAIN,MACR,uEACEE,YAAYM,KAAK,KAAA,CAAA;AAIvB,SAAO/B,IAAIa,KAAKC,SAASG,QAAQF,YAAAA;;CAmCnCiB,UACElB,SACAL,UAA0B,EAAE,EACX;EACjB,MAAMM,cAAc,KAAKC,gBACvB,EAAE,GAAGP,SAAQ,EACb,cAAA;EAEF,MAAMQ,SAAS,KAAKC,aAClBJ,SACAL,SACA,cACAP,YAAYiB,KAAI;EAGlB,MAAMK,qBAAqB,CAAC,UAAU,aAAa;EACnD,MAAMC,cAAcC,OAAOC,KAAKZ,YAAAA;AAChC,MACE,OAAOD,YAAY,YACnBW,YAAYG,MAAMC,MAAM,CAACL,mBAAmBM,SAASD,EAAAA,CAAAA,CAErD,OAAM,IAAIN,MACR,uEACEE,YAAYM,KAAK,KAAA,CAAA;AAIvB,SAAO,IAAIX,SAASa,SAASC,WAC3Bd,QAAQa,SAAO,CACZE,WAAWlB,OAAAA,CACXkB,MAAMC,SAAAA;AACLpC,OAAIa,KAAKC,SAASsB,MAAMrB,cAAcsB,KAAKC,YACzCD,MAAMH,OAAOG,IAAAA,GAAOJ,QAAQK,QAAAA,CAAAA;IAEhC,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA+BNC,OACEhC,OACAE,UAA4B,EAAE,EAC3B;EACH,MAAM+B,gBAAgB,KAAKxB,gBAAgB,EAAE,GAAGP,SAAQ,EAAG,gBAAA;EAC3D,MAAMQ,SAAS,KAAKC,aAClBX,OACAE,SACA,aACAP,YAAYuC,OAAM;AAGpB,MAAIxB,kBAAkBG,SAAS;AAC7BH,UAAOI,YAAM,GAAO;AACpB,QAAKX,OAAOY,KACV,4EAAA;AAEF,SAAM,IAAIC,OAAAA;;AAIZ,SAAOvB,IAAIuC,OAAOhC,OAAOU,QAAQuB,cAAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;IA6BnCE,YACEnC,OACAE,UAA4B,EAAE,EAClB;EACZ,MAAM+B,gBAAgB,KAAKxB,gBAAgB,EAAE,GAAGP,SAAQ,EAAG,gBAAA;EAC3D,MAAMQ,SAAS,KAAKC,aAClBX,OACAE,SACA,aACAP,YAAYuC,OAAM;AAGpB,SAAO,IAAIrB,SAASa,SAASC,WAC3Bd,QAAQa,SAAO,CACZE,WAAWlB,OAAAA,CACXkB,MAAMC,SAAAA;AAELpC,OAAIuC,OAAOhC,OAAO6B,MAAMI,gBAAgBH,KAAKM,YAC3CN,MAAMH,OAAOG,IAAAA,GAAOJ,QAAQU,QAAAA,CAAAA;IAEhC,CACCtB,MAAMa,OAAAA,CAAAA;;;;;;;;;;;;;;;;;;;;;;IAyBbU,OAAgBrC,OAAeE,SAAgC;AAC7D,SAAOT,IAAI4C,OAAOrC,OAAOE,QAAAA;;CAGnBO,gBACNP,SACAoC,KAC6B;AAC7B,SAAOpC,QAAQQ;AACf,MAAI4B,QAAQ,cACV,QAAO,QAA4BC;MAEnC,QAAO,QAA8BC;AAEvC,SAAOtC,UACH;GACE,GAAG,KAAKA,QAAQoC;GAChB,GAAGpC;GACL,GAEA,KAAKA,QAAQoC;;CAGX3B,aACNX,OACAE,SACAoC,KACAG,mBACkD;AAWlD,SAVe,KAAKvC,QAAQwC,sBACxB,KAAKxC,QAAQwC,oBAAoBD,mBAAmBzC,OAAOE,QAAAA,GAC3DA,SAASQ,UACT,KAAKR,QAAQQ,WACZ4B,QAAQ,eACL,SAA6BC,cAAc,KAAKrC,QAAQqC,aACxD,SAA+BC,aAC/B,KAAKtC,QAAQsC,cACjB,KAAKtC,QAAQoC;;;;;;;;;ACtTrB,SAAgBO,kBACdC,QAA8D;AAI9D,KAAI,OAAOA,WAAW,WACpB,QAAOH,eAAeI,QAAQH,iBAAiBE,OAAAA;AAEjD,QAAOH,eAAeK,MAAMJ,iBAAiBE,OAAAA;;;;;;;;;;;;;;;;;;;;;GClD/C,MAAaI,oBAAoBD,IAAIC;;;;;;;;;;;;;;;;;GAmBrC,MAAaC,iBAAiBF,IAAIE;;;;;;;;;;;;;;;;;GAmBlC,MAAaC,oBAAoBH,IAAIG"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@navios/jwt",
   "description": "JWT authentication and authorization for Navios",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "author": {
     "name": "Oleksandr Hanzha",
     "email": "alex@granted.name"
@@ -13,7 +13,7 @@
   },
   "license": "MIT",
   "peerDependencies": {
-    "@navios/core": "^0.5.0",
+    "@navios/core": "^0.7.0",
     "zod": "^3.25.0 || ^4.0.0"
   },
   "typings": "./lib/index.d.mts",
@@ -32,11 +32,11 @@
     }
   },
   "devDependencies": {
-    "@navios/core": "^0.5.0",
+    "@navios/core": "^0.7.0",
     "@types/jsonwebtoken": "^9.0.10",
-    "zod": "^4.1.8"
+    "zod": "^4.1.13"
   },
   "dependencies": {
-    "jsonwebtoken": "^9.0.2"
+    "jsonwebtoken": "^9.0.3"
   }
 }

package/project.json

@@ -33,11 +33,11 @@
     },
     "build": {
       "executor": "nx:run-commands",
-      "inputs": ["projectSources"],
+      "inputs": ["projectSources", "{projectRoot}/tsdown.config.mts"],
       "outputs": ["{projectRoot}/lib"],
       "dependsOn": ["check", "lint"],
       "options": {
-        "command": "tsup",
+        "command": "tsdown",
         "cwd": "packages/jwt"
       }
     },

package/src/index.mts

@@ -3,6 +3,60 @@ import jwt from 'jsonwebtoken'
 export * from './options/jwt-service.options.mjs'
 export * from './jwt.service.mjs'
 export * from './jwt-service.provider.mjs'
+
+/**
+ * Error thrown when a JWT token has expired.
+ *
+ * This error is thrown by `verify()` and `verifyAsync()` when the token's
+ * expiration time (exp claim) has passed.
+ *
+ * @example
+ * ```ts
+ * try {
+ *   jwtService.verify(token)
+ * } catch (error) {
+ *   if (error instanceof TokenExpiredError) {
+ *     console.error('Token expired at:', error.expiredAt)
+ *   }
+ * }
+ * ```
+ */
 export const TokenExpiredError = jwt.TokenExpiredError
+
+/**
+ * Error thrown when a JWT token is not yet valid.
+ *
+ * This error is thrown by `verify()` and `verifyAsync()` when the token's
+ * "not before" time (nbf claim) is in the future.
+ *
+ * @example
+ * ```ts
+ * try {
+ *   jwtService.verify(token)
+ * } catch (error) {
+ *   if (error instanceof NotBeforeError) {
+ *     console.error('Token not valid until:', error.date)
+ *   }
+ * }
+ * ```
+ */
 export const NotBeforeError = jwt.NotBeforeError
+
+/**
+ * Base error class for JWT-related errors.
+ *
+ * This is the base class for all JWT errors including `TokenExpiredError`
+ * and `NotBeforeError`. It's thrown for invalid or malformed tokens.
+ *
+ * @example
+ * ```ts
+ * try {
+ *   jwtService.verify(token)
+ * } catch (error) {
+ *   if (error instanceof JsonWebTokenError) {
+ *     console.error('JWT error:', error.message)
+ *   }
+ * }
+ * ```
+ */
 export const JsonWebTokenError = jwt.JsonWebTokenError

package/src/jwt-service.provider.mts

@@ -7,9 +7,59 @@ import type { JwtServiceOptions } from './options/jwt-service.options.mjs'
 import { JwtService, JwtServiceToken } from './jwt.service.mjs'
 import { JwtServiceOptionsSchema } from './options/jwt-service.options.mjs'
 
+/**
+ * Creates a JWT service provider for dependency injection.
+ *
+ * This function creates an injection token that can be used to register and resolve
+ * `JwtService` instances in the Navios dependency injection container. It supports
+ * both static configuration and async factory functions for dynamic configuration.
+ *
+ * @param config - Static JWT service configuration options
+ * @returns A bound injection token that can be used with `inject()` or `syncInject()`
+ *
+ * @example
+ * ```ts
+ * // Static configuration
+ * const JwtService = provideJwtService({
+ *   secret: 'your-secret-key',
+ *   signOptions: { expiresIn: '1h' },
+ * })
+ *
+ * @Injectable()
+ * class AuthService {
+ *   jwtService = inject(JwtService)
+ * }
+ * ```
+ */
 export function provideJwtService(
   config: JwtServiceOptions,
 ): BoundInjectionToken<JwtService, typeof JwtServiceOptionsSchema>
+/**
+ * Creates a JWT service provider with async configuration factory.
+ *
+ * Use this overload when you need to load configuration asynchronously, such as
+ * fetching secrets from a configuration service or environment variables.
+ *
+ * @param config - Async factory function that returns JWT service configuration
+ * @returns A factory injection token that resolves configuration asynchronously
+ *
+ * @example
+ * ```ts
+ * // Async configuration
+ * const JwtService = provideJwtService(async () => {
+ *   const configService = await inject(ConfigService)
+ *   return {
+ *     secret: configService.jwt.secret,
+ *     signOptions: { expiresIn: configService.jwt.expiresIn },
+ *   }
+ * })
+ *
+ * @Injectable()
+ * class AuthService {
+ *   jwtService = inject(JwtService)
+ * }
+ * ```
+ */
 export function provideJwtService(
   config: () => Promise<JwtServiceOptions>,
 ): FactoryInjectionToken<JwtService, typeof JwtServiceOptionsSchema>

package/src/jwt.service.mts

@@ -16,11 +16,44 @@ import {
   RequestType,
 } from './options/jwt-service.options.mjs'
 
+/**
+ * Injection token for JwtService.
+ *
+ * Used internally by the dependency injection system to register and resolve JwtService instances.
+ */
 export const JwtServiceToken = InjectionToken.create(
   Symbol.for('JwtService'),
   JwtServiceOptionsSchema,
 )
 
+/**
+ * Service for signing, verifying, and decoding JSON Web Tokens (JWTs).
+ *
+ * This service provides a type-safe wrapper around the `jsonwebtoken` library with
+ * seamless integration into Navios's dependency injection system. It supports both
+ * symmetric (HS256, HS384, HS512) and asymmetric (RS256, ES256, etc.) algorithms.
+ *
+ * @example
+ * ```ts
+ * import { provideJwtService } from '@navios/jwt'
+ * import { inject } from '@navios/core'
+ *
+ * const JwtService = provideJwtService({
+ *   secret: 'your-secret-key',
+ *   signOptions: { expiresIn: '1h' },
+ * })
+ *
+ * @Injectable()
+ * class AuthService {
+ *   jwtService = inject(JwtService)
+ *
+ *   async login(userId: string) {
+ *     const token = this.jwtService.sign({ userId, role: 'user' })
+ *     return token
+ *   }
+ * }
+ * ```
+ */
 @Injectable({
   token: JwtServiceToken,
 })
@@ -29,12 +62,48 @@ export class JwtService {
     context: JwtService.name,
   })
 
+  /**
+   * Creates a new JwtService instance.
+   *
+   * @param options - Configuration options for the JWT service
+   */
   constructor(private readonly options: JwtServiceOptions = {}) {}
 
+  /**
+   * Signs a JWT payload synchronously.
+   *
+   * When the payload is a string, only `secret` and `privateKey` options are allowed.
+   * For object or Buffer payloads, all sign options are available.
+   *
+   * @param payload - The payload to sign. Can be a string, Buffer, or object.
+   * @param options - Signing options. When payload is a string, only `secret` and `privateKey` are allowed.
+   * @returns The signed JWT token as a string
+   * @throws {Error} If `secretOrKeyProvider` returns a Promise (use `signAsync` instead)
+   * @throws {Error} If payload is a string and invalid options are provided
+   *
+   * @example
+   * ```ts
+   * // Sign with object payload
+   * const token = jwtService.sign(
+   *   { userId: '123', role: 'admin' },
+   *   { expiresIn: '1h' }
+   * )
+   *
+   * // Sign with string payload (limited options)
+   * const token = jwtService.sign('payload-string', { secret: 'key' })
+   * ```
+   */
   sign(
     payload: string,
     options?: Omit<JwtSignOptions, keyof SignOptions>,
   ): string
+  /**
+   * Signs a JWT payload synchronously.
+   *
+   * @param payload - The payload to sign. Can be a Buffer or object.
+   * @param options - Signing options including algorithm, expiration, etc.
+   * @returns The signed JWT token as a string
+   */
   sign(payload: Buffer | object, options?: JwtSignOptions): string
   sign(
     payload: string | Buffer | object,
@@ -74,10 +143,37 @@ export class JwtService {
     return jwt.sign(payload, secret, signOptions)
   }
 
+  /**
+   * Signs a JWT payload asynchronously.
+   *
+   * Use this method when `secretOrKeyProvider` returns a Promise or when you need
+   * to handle async key resolution. Supports the same payload types and options as `sign()`.
+   *
+   * @param payload - The payload to sign. Can be a string, Buffer, or object.
+   * @param options - Signing options. When payload is a string, only `secret` and `privateKey` are allowed.
+   * @returns A Promise that resolves to the signed JWT token as a string
+   * @throws {Error} If payload is a string and invalid options are provided
+   *
+   * @example
+   * ```ts
+   * // Sign with async key provider
+   * const token = await jwtService.signAsync(
+   *   { userId: '123' },
+   *   { expiresIn: '1h' }
+   * )
+   * ```
+   */
   signAsync(
     payload: string,
     options?: Omit<JwtSignOptions, keyof jwt.SignOptions>,
   ): Promise<string>
+  /**
+   * Signs a JWT payload asynchronously.
+   *
+   * @param payload - The payload to sign. Can be a Buffer or object.
+   * @param options - Signing options including algorithm, expiration, etc.
+   * @returns A Promise that resolves to the signed JWT token as a string
+   */
   signAsync(payload: Buffer | object, options?: JwtSignOptions): Promise<string>
   signAsync(
     payload: string | Buffer | object,
@@ -117,6 +213,33 @@ export class JwtService {
     )
   }
 
+  /**
+   * Verifies and decodes a JWT token synchronously.
+   *
+   * This method validates the token's signature, expiration, and other claims
+   * according to the provided options. If verification fails, an error is thrown.
+   *
+   * @template T - The expected type of the decoded payload
+   * @param token - The JWT token string to verify
+   * @param options - Verification options including algorithms, audience, issuer, etc.
+   * @returns The decoded payload as type T
+   * @throws {TokenExpiredError} If the token has expired
+   * @throws {NotBeforeError} If the token is not yet valid (nbf claim)
+   * @throws {JsonWebTokenError} If the token is invalid or malformed
+   * @throws {Error} If `secretOrKeyProvider` returns a Promise (use `verifyAsync` instead)
+   *
+   * @example
+   * ```ts
+   * try {
+   *   const payload = jwtService.verify<{ userId: string; role: string }>(token)
+   *   console.log(payload.userId) // '123'
+   * } catch (error) {
+   *   if (error instanceof TokenExpiredError) {
+   *     console.error('Token expired')
+   *   }
+   * }
+   * ```
+   */
   verify<T extends object = any>(
     token: string,
     options: JwtVerifyOptions = {},
@@ -141,6 +264,32 @@ export class JwtService {
     return jwt.verify(token, secret, verifyOptions) as unknown as T
   }
 
+  /**
+   * Verifies and decodes a JWT token asynchronously.
+   *
+   * Use this method when `secretOrKeyProvider` returns a Promise or when you need
+   * to handle async key resolution. Provides the same validation as `verify()`.
+   *
+   * @template T - The expected type of the decoded payload
+   * @param token - The JWT token string to verify
+   * @param options - Verification options including algorithms, audience, issuer, etc.
+   * @returns A Promise that resolves to the decoded payload as type T
+   * @throws {TokenExpiredError} If the token has expired
+   * @throws {NotBeforeError} If the token is not yet valid (nbf claim)
+   * @throws {JsonWebTokenError} If the token is invalid or malformed
+   *
+   * @example
+   * ```ts
+   * try {
+   *   const payload = await jwtService.verifyAsync<{ userId: string }>(token)
+   *   console.log(payload.userId)
+   * } catch (error) {
+   *   if (error instanceof TokenExpiredError) {
+   *     console.error('Token expired')
+   *   }
+   * }
+   * ```
+   */
   verifyAsync<T extends object = any>(
     token: string,
     options: JwtVerifyOptions = {},
@@ -166,6 +315,27 @@ export class JwtService {
     )
   }
 
+  /**
+   * Decodes a JWT token without verification.
+   *
+   * This method decodes the token without validating its signature or claims.
+   * Use this only when you need to inspect the token contents without verification.
+   * For secure token validation, use `verify()` or `verifyAsync()` instead.
+   *
+   * @template T - The expected type of the decoded payload
+   * @param token - The JWT token string to decode
+   * @param options - Decode options (complete, json, etc.)
+   * @returns The decoded payload as type T, or null if decoding fails
+   *
+   * @example
+   * ```ts
+   * // Decode without verification (not recommended for production)
+   * const payload = jwtService.decode<{ userId: string }>(token)
+   * if (payload) {
+   *   console.log(payload.userId)
+   * }
+   * ```
+   */
   decode<T = any>(token: string, options?: jwt.DecodeOptions): T {
     return jwt.decode(token, options) as T
   }