@navios/jwt 0.9.0 → 1.0.0-alpha.3

package/lib/index.cjs

@@ -150,7 +150,7 @@ const JwtServiceOptionsSchema = zod_v4.z.object({
 			zod_v4.z.any(),
 			zod_v4.z.union([SignOptionsSchema, VerifyOptionsSchema]).optional()
 		],
-		output: zod_v4.z.union([SecretSchema, zod_v4.z.promise(SecretSchema)])
+		output: SecretSchema
 	}).optional()
 });
 
@@ -455,27 +455,14 @@ var JwtService = class {
 	}
 	logger = (0, _navios_core.inject)(_navios_core.Logger, { context: _JwtService.name });
 	sign(payload, options = {}) {
-		const signOptions = this.mergeJwtOptions({ ...options }, "signOptions");
-		const secret = this.getSecretKey(payload, options, "privateKey", RequestType.Sign);
-		if (secret instanceof Promise) {
-			secret.catch(() => {});
-			this.logger.warn("For async version of \"secretOrKeyProvider\", please use \"signAsync\".");
-			throw new Error();
-		}
-		const allowedSignOptKeys = ["secret", "privateKey"];
-		const signOptKeys = Object.keys(signOptions);
-		if (typeof payload === "string" && signOptKeys.some((k) => !allowedSignOptKeys.includes(k))) throw new Error("Payload as string is not allowed with the following sign options: " + signOptKeys.join(", "));
+		const { signOptions, secret } = this.prepareSign(payload, options);
 		return jsonwebtoken.default.sign(payload, secret, signOptions);
 	}
 	signAsync(payload, options = {}) {
-		const signOptions = this.mergeJwtOptions({ ...options }, "signOptions");
-		const secret = this.getSecretKey(payload, options, "privateKey", RequestType.Sign);
-		const allowedSignOptKeys = ["secret", "privateKey"];
-		const signOptKeys = Object.keys(signOptions);
-		if (typeof payload === "string" && signOptKeys.some((k) => !allowedSignOptKeys.includes(k))) throw new Error("Payload as string is not allowed with the following sign options: " + signOptKeys.join(", "));
-		return new Promise((resolve, reject) => Promise.resolve().then(() => secret).then((scrt) => {
-			jsonwebtoken.default.sign(payload, scrt, signOptions, (err, encoded) => err ? reject(err) : resolve(encoded));
-		}));
+		const { signOptions, secret } = this.prepareSign(payload, options);
+		return new Promise((resolve, reject) => {
+			jsonwebtoken.default.sign(payload, secret, signOptions, (err, encoded) => err ? reject(err) : resolve(encoded));
+		});
 	}
 	/**
 	* Verifies and decodes a JWT token synchronously.
@@ -490,7 +477,6 @@ var JwtService = class {
 	* @throws {TokenExpiredError} If the token has expired
 	* @throws {NotBeforeError} If the token is not yet valid (nbf claim)
 	* @throws {JsonWebTokenError} If the token is invalid or malformed
-	* @throws {Error} If `secretOrKeyProvider` returns a Promise (use `verifyAsync` instead)
 	*
 	* @example
 	* ```ts
@@ -504,20 +490,13 @@ var JwtService = class {
 	* }
 	* ```
 	*/ verify(token, options = {}) {
-		const verifyOptions = this.mergeJwtOptions({ ...options }, "verifyOptions");
-		const secret = this.getSecretKey(token, options, "publicKey", RequestType.Verify);
-		if (secret instanceof Promise) {
-			secret.catch(() => {});
-			this.logger.warn("For async version of \"secretOrKeyProvider\", please use \"verifyAsync\".");
-			throw new Error();
-		}
+		const { verifyOptions, secret } = this.prepareVerify(token, options);
 		return jsonwebtoken.default.verify(token, secret, verifyOptions);
 	}
 	/**
 	* Verifies and decodes a JWT token asynchronously.
 	*
-	* Use this method when `secretOrKeyProvider` returns a Promise or when you need
-	* to handle async key resolution. Provides the same validation as `verify()`.
+	* Provides the same validation as `verify()`.
 	*
 	* @template T - The expected type of the decoded payload
 	* @param token - The JWT token string to verify
@@ -539,11 +518,10 @@ var JwtService = class {
 	* }
 	* ```
 	*/ verifyAsync(token, options = {}) {
-		const verifyOptions = this.mergeJwtOptions({ ...options }, "verifyOptions");
-		const secret = this.getSecretKey(token, options, "publicKey", RequestType.Verify);
-		return new Promise((resolve, reject) => Promise.resolve().then(() => secret).then((scrt) => {
-			jsonwebtoken.default.verify(token, scrt, verifyOptions, (err, decoded) => err ? reject(err) : resolve(decoded));
-		}).catch(reject));
+		const { verifyOptions, secret } = this.prepareVerify(token, options);
+		return new Promise((resolve, reject) => {
+			jsonwebtoken.default.verify(token, secret, verifyOptions, (err, decoded) => err ? reject(err) : resolve(decoded));
+		});
 	}
 	/**
 	* Decodes a JWT token without verification.
@@ -568,6 +546,23 @@ var JwtService = class {
 	*/ decode(token, options) {
 		return jsonwebtoken.default.decode(token, options);
 	}
+	prepareSign(payload, options) {
+		const signOptions = this.mergeJwtOptions({ ...options }, "signOptions");
+		const secret = this.getSecretKey(payload, options, "privateKey", RequestType.Sign);
+		const allowedSignOptKeys = ["secret", "privateKey"];
+		const signOptKeys = Object.keys(signOptions);
+		if (typeof payload === "string" && signOptKeys.some((k) => !allowedSignOptKeys.includes(k))) throw new Error("Payload as string is not allowed with the following sign options: " + signOptKeys.join(", "));
+		return {
+			signOptions,
+			secret
+		};
+	}
+	prepareVerify(token, options) {
+		return {
+			verifyOptions: this.mergeJwtOptions({ ...options }, "verifyOptions"),
+			secret: this.getSecretKey(token, options, "publicKey", RequestType.Verify)
+		};
+	}
 	mergeJwtOptions(options, key) {
 		delete options.secret;
 		if (key === "signOptions") delete options.privateKey;

package/lib/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","names":["z","RequestType","AlgorithmType","enum","JwtHeaderSchema","object","alg","or","string","typ","optional","cty","crit","array","kid","jku","x5u","union","x5t","x5c","SignOptionsSchema","algorithm","keyid","expiresIn","number","notBefore","audience","instanceof","RegExp","subject","issuer","jwtid","mutatePayload","boolean","noTimestamp","header","encoding","allowInsecureKeySizes","allowInvalidAsymmetricKeyTypes","VerifyOptionsSchema","algorithms","clockTimestamp","clockTolerance","complete","ignoreExpiration","ignoreNotBefore","nonce","maxAge","SecretSchema","Buffer","type","passthrough","key","passphrase","JwtServiceOptionsSchema","signOptions","secret","publicKey","privateKey","verifyOptions","secretOrKeyProvider","function","input","any","output","promise","inject","Injectable","InjectionToken","Logger","jwt","JwtServiceOptionsSchema","RequestType","JwtServiceToken","create","Symbol","for","token","JwtService","options","logger","context","name","sign","payload","signOptions","mergeJwtOptions","secret","getSecretKey","Sign","Promise","catch","warn","Error","allowedSignOptKeys","signOptKeys","Object","keys","some","k","includes","join","signAsync","resolve","reject","then","scrt","err","encoded","verify","verifyOptions","Verify","verifyAsync","decoded","decode","key","privateKey","publicKey","secretRequestType","secretOrKeyProvider","InjectionToken","JwtServiceToken","provideJwtService","config","factory","bound","jwt","TokenExpiredError","NotBeforeError","JsonWebTokenError"],"sources":["../src/options/jwt-service.options.mts","../src/jwt.service.mts","../src/jwt-service.provider.mts","../src/index.mts"],"sourcesContent":["import type { Secret as JwtSecret } from 'jsonwebtoken'\n\nimport { z } from 'zod/v4'\n\n/**\n * Request type for secret or key provider functions.\n *\n * Used to distinguish between signing and verification operations when\n * dynamically resolving secrets or keys.\n */\nexport enum RequestType {\n  /** Request is for signing a token */\n  Sign = 'Sign',\n  /** Request is for verifying a token */\n  Verify = 'Verify',\n}\n\n/**\n * Supported JWT algorithms.\n *\n * Includes symmetric (HMAC) and asymmetric (RSA, ECDSA, EdDSA) algorithms.\n */\nexport const AlgorithmType = z.enum([\n  'HS256',\n  'HS384',\n  'HS512',\n  'RS256',\n  'RS384',\n  'RS512',\n  'ES256',\n  'ES384',\n  'ES512',\n  'PS256',\n  'PS384',\n  'PS512',\n  'none',\n])\n\n/**\n * JWT header schema.\n *\n * Defines the structure of the JWT header with standard claims.\n */\nexport const JwtHeaderSchema = z.object({\n  alg: AlgorithmType.or(z.string()),\n  typ: z.string().optional(),\n  cty: z.string().optional(),\n  crit: z.string().array().optional(),\n  kid: z.string().optional(),\n  jku: z.string().optional(),\n  x5u: z.union([z.string(), z.array(z.string())]).optional(),\n  'x5t#S256': z.string().optional(),\n  x5t: z.string().optional(),\n  x5c: z.union([z.string(), z.array(z.string())]).optional(),\n})\n\n/**\n * JWT header type.\n *\n * Contains algorithm, type, and optional header claims.\n */\nexport type JwtHeader = z.infer<typeof JwtHeaderSchema>\n\n/**\n * Schema for JWT signing options.\n *\n * Defines all available options for signing tokens including algorithm,\n * expiration, audience, issuer, and other standard JWT claims.\n */\nexport const SignOptionsSchema = z.object({\n  algorithm: AlgorithmType.optional(),\n  keyid: z.string().optional(),\n  expiresIn: z.union([z.string(), z.number()]).optional(),\n  notBefore: z.union([z.string(), z.number()]).optional(),\n  audience: z\n    .union([\n      z.string(),\n      z.instanceof(RegExp),\n      z.array(z.union([z.string(), z.instanceof(RegExp)])),\n    ])\n    .optional(),\n  subject: z.string().optional(),\n  issuer: z.string().optional(),\n  jwtid: z.string().optional(),\n  mutatePayload: z.boolean().optional(),\n  noTimestamp: z.boolean().optional(),\n  header: JwtHeaderSchema.optional(),\n  encoding: z.string().optional(),\n  allowInsecureKeySizes: z.boolean().optional(),\n  allowInvalidAsymmetricKeyTypes: z.boolean().optional(),\n})\n\n/**\n * Options for signing JWT tokens.\n *\n * @see SignOptionsSchema for the complete schema definition\n */\nexport type SignOptions = z.infer<typeof SignOptionsSchema>\n\n/**\n * Schema for JWT verification options.\n *\n * Defines all available options for verifying tokens including allowed\n * algorithms, audience, issuer, expiration handling, and other validation rules.\n */\nexport const VerifyOptionsSchema = z.object({\n  algorithms: AlgorithmType.array().optional(),\n  audience: z\n    .union([\n      z.string(),\n      z.instanceof(RegExp),\n      z.array(z.union([z.string(), z.instanceof(RegExp)])),\n    ])\n    .optional(),\n  clockTimestamp: z.number().optional(),\n  clockTolerance: z.number().optional(),\n  complete: z.boolean().optional(),\n  issuer: z.union([z.string(), z.string().array()]).optional(),\n  ignoreExpiration: z.boolean().optional(),\n  ignoreNotBefore: z.boolean().optional(),\n  jwtid: z.string().optional(),\n  nonce: z.string().optional(),\n  subject: z.string().optional(),\n  maxAge: z.union([z.string(), z.number()]).optional(),\n  allowInvalidAsymmetricKeyTypes: z.boolean().optional(),\n})\n\n/**\n * Options for verifying JWT tokens.\n *\n * @see VerifyOptionsSchema for the complete schema definition\n */\nexport type VerifyOptions = z.infer<typeof VerifyOptionsSchema>\n\n/**\n * Schema for JWT secret/key types.\n *\n * Supports string secrets, Buffer objects, and key objects with passphrases.\n */\nexport const SecretSchema = z.union([\n  z.string(),\n  z.instanceof(Buffer),\n  z\n    .object({\n      type: z.string(),\n    })\n    .passthrough(),\n  z.object({\n    key: z.union([z.string(), z.instanceof(Buffer)]),\n    passphrase: z.string(),\n  }),\n])\n\n/**\n * Secret or key type for JWT operations.\n *\n * Can be a string, Buffer, or an object with key and optional passphrase.\n */\nexport type Secret = z.infer<typeof SecretSchema>\n\nexport const JwtServiceOptionsSchema = z.object({\n  signOptions: SignOptionsSchema.optional(),\n  secret: z.string().optional(),\n  publicKey: z.union([z.string(), z.instanceof(Buffer)]).optional(),\n  privateKey: SecretSchema.optional(),\n  verifyOptions: VerifyOptionsSchema.optional(),\n  secretOrKeyProvider: z\n    .function({\n      input: [\n        z.enum(RequestType),\n        z.any(),\n        z.union([SignOptionsSchema, VerifyOptionsSchema]).optional(),\n      ],\n      output: z.union([SecretSchema, z.promise(SecretSchema)]),\n    })\n    .optional(),\n})\n\n/**\n * Configuration options for the JWT service.\n *\n * @property signOptions - Default options for signing tokens\n * @property secret - Default secret for symmetric algorithms (HS256, HS384, HS512)\n * @property publicKey - Default public key for asymmetric algorithms (RS256, ES256, etc.)\n * @property privateKey - Default private key for asymmetric algorithms\n * @property verifyOptions - Default options for verifying tokens\n * @property secretOrKeyProvider - Optional function to dynamically resolve secrets/keys\n *\n * @example\n * ```ts\n * const options: JwtServiceOptions = {\n *   secret: 'your-secret-key',\n *   signOptions: {\n *     expiresIn: '1h',\n *     algorithm: 'HS256',\n *   },\n *   verifyOptions: {\n *     algorithms: ['HS256'],\n *   },\n * }\n * ```\n */\nexport type JwtServiceOptions = z.infer<typeof JwtServiceOptionsSchema>\n\n/**\n * Options for signing JWT tokens.\n *\n * Extends `SignOptions` with additional properties for specifying\n * the secret or private key to use for signing.\n *\n * @property secret - Secret key for symmetric algorithms (overrides service default)\n * @property privateKey - Private key for asymmetric algorithms (overrides service default)\n */\nexport interface JwtSignOptions extends SignOptions {\n  /** Secret key for symmetric algorithms */\n  secret?: string | Buffer\n  /** Private key for asymmetric algorithms */\n  privateKey?: Secret\n}\n\n/**\n * Options for verifying JWT tokens.\n *\n * Extends `VerifyOptions` with additional properties for specifying\n * the secret or public key to use for verification.\n *\n * @property secret - Secret key for symmetric algorithms (overrides service default)\n * @property publicKey - Public key for asymmetric algorithms (overrides service default)\n */\nexport interface JwtVerifyOptions extends VerifyOptions {\n  /** Secret key for symmetric algorithms */\n  secret?: string | Buffer\n  /** Public key for asymmetric algorithms */\n  publicKey?: string | Buffer\n}\n\n/**\n * Result type for secret/key resolution.\n *\n * Represents the possible return types from secret or key provider functions.\n */\nexport type GetSecretKeyResult = string | Buffer | JwtSecret\n","import { inject, Injectable, InjectionToken, Logger } from '@navios/core'\n\nimport jwt from 'jsonwebtoken'\n\nimport type {\n  GetSecretKeyResult,\n  JwtServiceOptions,\n  JwtSignOptions,\n  JwtVerifyOptions,\n  SignOptions,\n  VerifyOptions,\n} from './options/jwt-service.options.mjs'\n\nimport {\n  JwtServiceOptionsSchema,\n  RequestType,\n} from './options/jwt-service.options.mjs'\n\n/**\n * Injection token for JwtService.\n *\n * Used internally by the dependency injection system to register and resolve JwtService instances.\n */\nexport const JwtServiceToken = InjectionToken.create(\n  Symbol.for('JwtService'),\n  JwtServiceOptionsSchema,\n)\n\n/**\n * Service for signing, verifying, and decoding JSON Web Tokens (JWTs).\n *\n * This service provides a type-safe wrapper around the `jsonwebtoken` library with\n * seamless integration into Navios's dependency injection system. It supports both\n * symmetric (HS256, HS384, HS512) and asymmetric (RS256, ES256, etc.) algorithms.\n *\n * @example\n * ```ts\n * import { provideJwtService } from '@navios/jwt'\n * import { inject } from '@navios/core'\n *\n * const JwtService = provideJwtService({\n *   secret: 'your-secret-key',\n *   signOptions: { expiresIn: '1h' },\n * })\n *\n * @Injectable()\n * class AuthService {\n *   jwtService = inject(JwtService)\n *\n *   async login(userId: string) {\n *     const token = this.jwtService.sign({ userId, role: 'user' })\n *     return token\n *   }\n * }\n * ```\n */\n@Injectable({\n  token: JwtServiceToken,\n})\nexport class JwtService {\n  logger = inject(Logger, {\n    context: JwtService.name,\n  })\n\n  /**\n   * Creates a new JwtService instance.\n   *\n   * @param options - Configuration options for the JWT service\n   */\n  constructor(private readonly options: JwtServiceOptions = {}) {}\n\n  /**\n   * Signs a JWT payload synchronously.\n   *\n   * When the payload is a string, only `secret` and `privateKey` options are allowed.\n   * For object or Buffer payloads, all sign options are available.\n   *\n   * @param payload - The payload to sign. Can be a string, Buffer, or object.\n   * @param options - Signing options. When payload is a string, only `secret` and `privateKey` are allowed.\n   * @returns The signed JWT token as a string\n   * @throws {Error} If `secretOrKeyProvider` returns a Promise (use `signAsync` instead)\n   * @throws {Error} If payload is a string and invalid options are provided\n   *\n   * @example\n   * ```ts\n   * // Sign with object payload\n   * const token = jwtService.sign(\n   *   { userId: '123', role: 'admin' },\n   *   { expiresIn: '1h' }\n   * )\n   *\n   * // Sign with string payload (limited options)\n   * const token = jwtService.sign('payload-string', { secret: 'key' })\n   * ```\n   */\n  sign(\n    payload: string,\n    options?: Omit<JwtSignOptions, keyof SignOptions>,\n  ): string\n  /**\n   * Signs a JWT payload synchronously.\n   *\n   * @param payload - The payload to sign. Can be a Buffer or object.\n   * @param options - Signing options including algorithm, expiration, etc.\n   * @returns The signed JWT token as a string\n   */\n  sign(payload: Buffer | object, options?: JwtSignOptions): string\n  sign(\n    payload: string | Buffer | object,\n    options: JwtSignOptions = {},\n  ): string {\n    const signOptions = this.mergeJwtOptions(\n      { ...options },\n      'signOptions',\n    ) as jwt.SignOptions\n    const secret = this.getSecretKey(\n      payload,\n      options,\n      'privateKey',\n      RequestType.Sign,\n    )\n\n    if (secret instanceof Promise) {\n      secret.catch(() => {}) // suppress rejection from async provider\n      this.logger.warn(\n        'For async version of \"secretOrKeyProvider\", please use \"signAsync\".',\n      )\n      throw new Error()\n    }\n\n    const allowedSignOptKeys = ['secret', 'privateKey']\n    const signOptKeys = Object.keys(signOptions)\n    if (\n      typeof payload === 'string' &&\n      signOptKeys.some((k) => !allowedSignOptKeys.includes(k))\n    ) {\n      throw new Error(\n        'Payload as string is not allowed with the following sign options: ' +\n          signOptKeys.join(', '),\n      )\n    }\n\n    return jwt.sign(payload, secret, signOptions)\n  }\n\n  /**\n   * Signs a JWT payload asynchronously.\n   *\n   * Use this method when `secretOrKeyProvider` returns a Promise or when you need\n   * to handle async key resolution. Supports the same payload types and options as `sign()`.\n   *\n   * @param payload - The payload to sign. Can be a string, Buffer, or object.\n   * @param options - Signing options. When payload is a string, only `secret` and `privateKey` are allowed.\n   * @returns A Promise that resolves to the signed JWT token as a string\n   * @throws {Error} If payload is a string and invalid options are provided\n   *\n   * @example\n   * ```ts\n   * // Sign with async key provider\n   * const token = await jwtService.signAsync(\n   *   { userId: '123' },\n   *   { expiresIn: '1h' }\n   * )\n   * ```\n   */\n  signAsync(\n    payload: string,\n    options?: Omit<JwtSignOptions, keyof jwt.SignOptions>,\n  ): Promise<string>\n  /**\n   * Signs a JWT payload asynchronously.\n   *\n   * @param payload - The payload to sign. Can be a Buffer or object.\n   * @param options - Signing options including algorithm, expiration, etc.\n   * @returns A Promise that resolves to the signed JWT token as a string\n   */\n  signAsync(payload: Buffer | object, options?: JwtSignOptions): Promise<string>\n  signAsync(\n    payload: string | Buffer | object,\n    options: JwtSignOptions = {},\n  ): Promise<string> {\n    const signOptions = this.mergeJwtOptions(\n      { ...options },\n      'signOptions',\n    ) as jwt.SignOptions\n    const secret = this.getSecretKey(\n      payload,\n      options,\n      'privateKey',\n      RequestType.Sign,\n    )\n\n    const allowedSignOptKeys = ['secret', 'privateKey']\n    const signOptKeys = Object.keys(signOptions)\n    if (\n      typeof payload === 'string' &&\n      signOptKeys.some((k) => !allowedSignOptKeys.includes(k))\n    ) {\n      throw new Error(\n        'Payload as string is not allowed with the following sign options: ' +\n          signOptKeys.join(', '),\n      )\n    }\n\n    return new Promise((resolve, reject) =>\n      Promise.resolve()\n        .then(() => secret)\n        .then((scrt: GetSecretKeyResult) => {\n          jwt.sign(payload, scrt, signOptions, (err, encoded) =>\n            err ? reject(err) : resolve(encoded as string),\n          )\n        }),\n    )\n  }\n\n  /**\n   * Verifies and decodes a JWT token synchronously.\n   *\n   * This method validates the token's signature, expiration, and other claims\n   * according to the provided options. If verification fails, an error is thrown.\n   *\n   * @template T - The expected type of the decoded payload\n   * @param token - The JWT token string to verify\n   * @param options - Verification options including algorithms, audience, issuer, etc.\n   * @returns The decoded payload as type T\n   * @throws {TokenExpiredError} If the token has expired\n   * @throws {NotBeforeError} If the token is not yet valid (nbf claim)\n   * @throws {JsonWebTokenError} If the token is invalid or malformed\n   * @throws {Error} If `secretOrKeyProvider` returns a Promise (use `verifyAsync` instead)\n   *\n   * @example\n   * ```ts\n   * try {\n   *   const payload = jwtService.verify<{ userId: string; role: string }>(token)\n   *   console.log(payload.userId) // '123'\n   * } catch (error) {\n   *   if (error instanceof TokenExpiredError) {\n   *     console.error('Token expired')\n   *   }\n   * }\n   * ```\n   */\n  verify<T extends object = any>(\n    token: string,\n    options: JwtVerifyOptions = {},\n  ): T {\n    const verifyOptions = this.mergeJwtOptions({ ...options }, 'verifyOptions')\n    const secret = this.getSecretKey(\n      token,\n      options,\n      'publicKey',\n      RequestType.Verify,\n    )\n\n    if (secret instanceof Promise) {\n      secret.catch(() => {}) // suppress rejection from async provider\n      this.logger.warn(\n        'For async version of \"secretOrKeyProvider\", please use \"verifyAsync\".',\n      )\n      throw new Error()\n    }\n\n    // @ts-expect-error We check it\n    return jwt.verify(token, secret, verifyOptions) as unknown as T\n  }\n\n  /**\n   * Verifies and decodes a JWT token asynchronously.\n   *\n   * Use this method when `secretOrKeyProvider` returns a Promise or when you need\n   * to handle async key resolution. Provides the same validation as `verify()`.\n   *\n   * @template T - The expected type of the decoded payload\n   * @param token - The JWT token string to verify\n   * @param options - Verification options including algorithms, audience, issuer, etc.\n   * @returns A Promise that resolves to the decoded payload as type T\n   * @throws {TokenExpiredError} If the token has expired\n   * @throws {NotBeforeError} If the token is not yet valid (nbf claim)\n   * @throws {JsonWebTokenError} If the token is invalid or malformed\n   *\n   * @example\n   * ```ts\n   * try {\n   *   const payload = await jwtService.verifyAsync<{ userId: string }>(token)\n   *   console.log(payload.userId)\n   * } catch (error) {\n   *   if (error instanceof TokenExpiredError) {\n   *     console.error('Token expired')\n   *   }\n   * }\n   * ```\n   */\n  verifyAsync<T extends object = any>(\n    token: string,\n    options: JwtVerifyOptions = {},\n  ): Promise<T> {\n    const verifyOptions = this.mergeJwtOptions({ ...options }, 'verifyOptions')\n    const secret = this.getSecretKey(\n      token,\n      options,\n      'publicKey',\n      RequestType.Verify,\n    )\n\n    return new Promise((resolve, reject) =>\n      Promise.resolve()\n        .then(() => secret)\n        .then((scrt: GetSecretKeyResult) => {\n          // @ts-expect-error We check it\n          jwt.verify(token, scrt, verifyOptions, (err, decoded) =>\n            err ? reject(err) : resolve(decoded as T),\n          )\n        })\n        .catch(reject),\n    )\n  }\n\n  /**\n   * Decodes a JWT token without verification.\n   *\n   * This method decodes the token without validating its signature or claims.\n   * Use this only when you need to inspect the token contents without verification.\n   * For secure token validation, use `verify()` or `verifyAsync()` instead.\n   *\n   * @template T - The expected type of the decoded payload\n   * @param token - The JWT token string to decode\n   * @param options - Decode options (complete, json, etc.)\n   * @returns The decoded payload as type T, or null if decoding fails\n   *\n   * @example\n   * ```ts\n   * // Decode without verification (not recommended for production)\n   * const payload = jwtService.decode<{ userId: string }>(token)\n   * if (payload) {\n   *   console.log(payload.userId)\n   * }\n   * ```\n   */\n  decode<T = any>(token: string, options?: jwt.DecodeOptions): T {\n    return jwt.decode(token, options) as T\n  }\n\n  private mergeJwtOptions(\n    options: JwtVerifyOptions | JwtSignOptions,\n    key: 'verifyOptions' | 'signOptions',\n  ): VerifyOptions | SignOptions {\n    delete options.secret\n    if (key === 'signOptions') {\n      delete (options as JwtSignOptions).privateKey\n    } else {\n      delete (options as JwtVerifyOptions).publicKey\n    }\n    return options\n      ? {\n          ...this.options[key],\n          ...options,\n        }\n      : // @ts-expect-error We check it\n        this.options[key]\n  }\n\n  private getSecretKey(\n    token: string | object | Buffer,\n    options: JwtVerifyOptions | JwtSignOptions,\n    key: 'publicKey' | 'privateKey',\n    secretRequestType: RequestType,\n  ): GetSecretKeyResult | Promise<GetSecretKeyResult> {\n    const secret = this.options.secretOrKeyProvider\n      ? this.options.secretOrKeyProvider(secretRequestType, token, options)\n      : options?.secret ||\n        this.options.secret ||\n        (key === 'privateKey'\n          ? (options as JwtSignOptions)?.privateKey || this.options.privateKey\n          : (options as JwtVerifyOptions)?.publicKey ||\n            this.options.publicKey) ||\n        this.options[key]\n\n    return secret as GetSecretKeyResult\n  }\n}\n","import type { BoundInjectionToken, FactoryInjectionToken } from '@navios/core'\n\nimport { InjectionToken } from '@navios/core'\n\nimport type { JwtServiceOptions } from './options/jwt-service.options.mjs'\n\nimport { JwtService, JwtServiceToken } from './jwt.service.mjs'\nimport { JwtServiceOptionsSchema } from './options/jwt-service.options.mjs'\n\n/**\n * Creates a JWT service provider for dependency injection.\n *\n * This function creates an injection token that can be used to register and resolve\n * `JwtService` instances in the Navios dependency injection container. It supports\n * both static configuration and async factory functions for dynamic configuration.\n *\n * @param config - Static JWT service configuration options\n * @returns A bound injection token that can be used with `inject()` or `syncInject()`\n *\n * @example\n * ```ts\n * // Static configuration\n * const JwtService = provideJwtService({\n *   secret: 'your-secret-key',\n *   signOptions: { expiresIn: '1h' },\n * })\n *\n * @Injectable()\n * class AuthService {\n *   jwtService = inject(JwtService)\n * }\n * ```\n */\nexport function provideJwtService(\n  config: JwtServiceOptions,\n): BoundInjectionToken<JwtService, typeof JwtServiceOptionsSchema>\n/**\n * Creates a JWT service provider with async configuration factory.\n *\n * Use this overload when you need to load configuration asynchronously, such as\n * fetching secrets from a configuration service or environment variables.\n *\n * @param config - Async factory function that returns JWT service configuration\n * @returns A factory injection token that resolves configuration asynchronously\n *\n * @example\n * ```ts\n * // Async configuration\n * const JwtService = provideJwtService(async () => {\n *   const configService = await inject(ConfigService)\n *   return {\n *     secret: configService.jwt.secret,\n *     signOptions: { expiresIn: configService.jwt.expiresIn },\n *   }\n * })\n *\n * @Injectable()\n * class AuthService {\n *   jwtService = inject(JwtService)\n * }\n * ```\n */\nexport function provideJwtService(\n  config: () => Promise<JwtServiceOptions>,\n): FactoryInjectionToken<JwtService, typeof JwtServiceOptionsSchema>\nexport function provideJwtService(\n  config: JwtServiceOptions | (() => Promise<JwtServiceOptions>),\n):\n  | BoundInjectionToken<JwtService, typeof JwtServiceOptionsSchema>\n  | FactoryInjectionToken<JwtService, typeof JwtServiceOptionsSchema> {\n  if (typeof config === 'function') {\n    return InjectionToken.factory(JwtServiceToken, config)\n  }\n  return InjectionToken.bound(JwtServiceToken, config)\n}\n","import jwt from 'jsonwebtoken'\n\nexport * from './options/jwt-service.options.mjs'\nexport * from './jwt.service.mjs'\nexport * from './jwt-service.provider.mjs'\n\n/**\n * Error thrown when a JWT token has expired.\n *\n * This error is thrown by `verify()` and `verifyAsync()` when the token's\n * expiration time (exp claim) has passed.\n *\n * @example\n * ```ts\n * try {\n *   jwtService.verify(token)\n * } catch (error) {\n *   if (error instanceof TokenExpiredError) {\n *     console.error('Token expired at:', error.expiredAt)\n *   }\n * }\n * ```\n */\nexport const TokenExpiredError = jwt.TokenExpiredError\n\n/**\n * Error thrown when a JWT token is not yet valid.\n *\n * This error is thrown by `verify()` and `verifyAsync()` when the token's\n * \"not before\" time (nbf claim) is in the future.\n *\n * @example\n * ```ts\n * try {\n *   jwtService.verify(token)\n * } catch (error) {\n *   if (error instanceof NotBeforeError) {\n *     console.error('Token not valid until:', error.date)\n *   }\n * }\n * ```\n */\nexport const NotBeforeError = jwt.NotBeforeError\n\n/**\n * Base error class for JWT-related errors.\n *\n * This is the base class for all JWT errors including `TokenExpiredError`\n * and `NotBeforeError`. It's thrown for invalid or malformed tokens.\n *\n * @example\n * ```ts\n * try {\n *   jwtService.verify(token)\n * } catch (error) {\n *   if (error instanceof JsonWebTokenError) {\n *     console.error('JWT error:', error.message)\n *   }\n * }\n * ```\n */\nexport const JsonWebTokenError = jwt.JsonWebTokenError\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAUA,IAAO,cAAKC,yBAAAA,eAAAA;sCACyB,eAAA,UAAA;wCAEE,eAAA,YAAA;QAH3BA;;;;;;GAYZ,MAAaC,gBAAgBF,SAAEG,KAAK;CAClC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD,CAAA;;;;;GAOD,MAAaC,kBAAkBJ,SAAEK,OAAO;CACtCC,KAAKJ,cAAcK,GAAGP,SAAEQ,QAAM,CAAA;CAC9BC,KAAKT,SAAEQ,QAAM,CAAGE,UAAQ;CACxBC,KAAKX,SAAEQ,QAAM,CAAGE,UAAQ;CACxBE,MAAMZ,SAAEQ,QAAM,CAAGK,OAAK,CAAGH,UAAQ;CACjCI,KAAKd,SAAEQ,QAAM,CAAGE,UAAQ;CACxBK,KAAKf,SAAEQ,QAAM,CAAGE,UAAQ;CACxBM,KAAKhB,SAAEiB,MAAM,CAACjB,SAAEQ,QAAM,EAAIR,SAAEa,MAAMb,SAAEQ,QAAM,CAAA,CAAI,CAAA,CAAEE,UAAQ;CACxD,YAAYV,SAAEQ,QAAM,CAAGE,UAAQ;CAC/BQ,KAAKlB,SAAEQ,QAAM,CAAGE,UAAQ;CACxBS,KAAKnB,SAAEiB,MAAM,CAACjB,SAAEQ,QAAM,EAAIR,SAAEa,MAAMb,SAAEQ,QAAM,CAAA,CAAI,CAAA,CAAEE,UAAQ;CAC1D,CAAA;;;;;;GAeA,MAAaU,oBAAoBpB,SAAEK,OAAO;CACxCgB,WAAWnB,cAAcQ,UAAQ;CACjCY,OAAOtB,SAAEQ,QAAM,CAAGE,UAAQ;CAC1Ba,WAAWvB,SAAEiB,MAAM,CAACjB,SAAEQ,QAAM,EAAIR,SAAEwB,QAAM,CAAG,CAAA,CAAEd,UAAQ;CACrDe,WAAWzB,SAAEiB,MAAM,CAACjB,SAAEQ,QAAM,EAAIR,SAAEwB,QAAM,CAAG,CAAA,CAAEd,UAAQ;CACrDgB,UAAU1B,SACPiB,MAAM;EACLjB,SAAEQ,QAAM;EACRR,SAAE2B,WAAWC,OAAAA;EACb5B,SAAEa,MAAMb,SAAEiB,MAAM,CAACjB,SAAEQ,QAAM,EAAIR,SAAE2B,WAAWC,OAAAA,CAAQ,CAAA,CAAA;EACnD,CAAA,CACAlB,UAAQ;CACXmB,SAAS7B,SAAEQ,QAAM,CAAGE,UAAQ;CAC5BoB,QAAQ9B,SAAEQ,QAAM,CAAGE,UAAQ;CAC3BqB,OAAO/B,SAAEQ,QAAM,CAAGE,UAAQ;CAC1BsB,eAAehC,SAAEiC,SAAO,CAAGvB,UAAQ;CACnCwB,aAAalC,SAAEiC,SAAO,CAAGvB,UAAQ;CACjCyB,QAAQ/B,gBAAgBM,UAAQ;CAChC0B,UAAUpC,SAAEQ,QAAM,CAAGE,UAAQ;CAC7B2B,uBAAuBrC,SAAEiC,SAAO,CAAGvB,UAAQ;CAC3C4B,gCAAgCtC,SAAEiC,SAAO,CAAGvB,UAAQ;CACtD,CAAA;;;;;;GAeA,MAAa6B,sBAAsBvC,SAAEK,OAAO;CAC1CmC,YAAYtC,cAAcW,OAAK,CAAGH,UAAQ;CAC1CgB,UAAU1B,SACPiB,MAAM;EACLjB,SAAEQ,QAAM;EACRR,SAAE2B,WAAWC,OAAAA;EACb5B,SAAEa,MAAMb,SAAEiB,MAAM,CAACjB,SAAEQ,QAAM,EAAIR,SAAE2B,WAAWC,OAAAA,CAAQ,CAAA,CAAA;EACnD,CAAA,CACAlB,UAAQ;CACX+B,gBAAgBzC,SAAEwB,QAAM,CAAGd,UAAQ;CACnCgC,gBAAgB1C,SAAEwB,QAAM,CAAGd,UAAQ;CACnCiC,UAAU3C,SAAEiC,SAAO,CAAGvB,UAAQ;CAC9BoB,QAAQ9B,SAAEiB,MAAM,CAACjB,SAAEQ,QAAM,EAAIR,SAAEQ,QAAM,CAAGK,OAAK,CAAG,CAAA,CAAEH,UAAQ;CAC1DkC,kBAAkB5C,SAAEiC,SAAO,CAAGvB,UAAQ;CACtCmC,iBAAiB7C,SAAEiC,SAAO,CAAGvB,UAAQ;CACrCqB,OAAO/B,SAAEQ,QAAM,CAAGE,UAAQ;CAC1BoC,OAAO9C,SAAEQ,QAAM,CAAGE,UAAQ;CAC1BmB,SAAS7B,SAAEQ,QAAM,CAAGE,UAAQ;CAC5BqC,QAAQ/C,SAAEiB,MAAM,CAACjB,SAAEQ,QAAM,EAAIR,SAAEwB,QAAM,CAAG,CAAA,CAAEd,UAAQ;CAClD4B,gCAAgCtC,SAAEiC,SAAO,CAAGvB,UAAQ;CACtD,CAAA;;;;;GAcA,MAAasC,eAAehD,SAAEiB,MAAM;CAClCjB,SAAEQ,QAAM;CACRR,SAAE2B,WAAWsB,OAAAA;CACbjD,SACGK,OAAO,EACN6C,MAAMlD,SAAEQ,QAAM,EAChB,CAAA,CACC2C,aAAW;CACdnD,SAAEK,OAAO;EACP+C,KAAKpD,SAAEiB,MAAM,CAACjB,SAAEQ,QAAM,EAAIR,SAAE2B,WAAWsB,OAAAA,CAAQ,CAAA;EAC/CI,YAAYrD,SAAEQ,QAAM;EACtB,CAAA;CACD,CAAA;AASD,MAAa8C,0BAA0BtD,SAAEK,OAAO;CAC9CkD,aAAanC,kBAAkBV,UAAQ;CACvC8C,QAAQxD,SAAEQ,QAAM,CAAGE,UAAQ;CAC3B+C,WAAWzD,SAAEiB,MAAM,CAACjB,SAAEQ,QAAM,EAAIR,SAAE2B,WAAWsB,OAAAA,CAAQ,CAAA,CAAEvC,UAAQ;CAC/DgD,YAAYV,aAAatC,UAAQ;CACjCiD,eAAepB,oBAAoB7B,UAAQ;CAC3CkD,qBAAqB5D,SAClB6D,SAAS;EACRC,OAAO;GACL9D,SAAEG,KAAKF,YAAAA;GACPD,SAAE+D,KAAG;GACL/D,SAAEiB,MAAM,CAACG,mBAAmBmB,oBAAoB,CAAA,CAAE7B,UAAQ;GAC3D;EACDsD,QAAQhE,SAAEiB,MAAM,CAAC+B,cAAchD,SAAEiE,QAAQjB,aAAAA,CAAc,CAAA;EACzD,CAAA,CACCtC,UAAQ;CACb,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GCzJA,MAAa+D,kBAAkBL,4BAAeM,OAC5CC,OAAOC,IAAI,aAAA,EACXL,wBAAAA;;oCA+BU,EACVM,OAAOJ,iBACT,CAAA;AACO,IAAMK,aAAN,MAAMA;;;;;;;;;IAUX,YAAY,UAA8C,EAAE,EAAE;OAAjCC,UAAAA;;CAT7BC,kCAAgBX,qBAAQ,EACtBY,SAASH,YAAWI,MACtB,CAAA;CA6CAC,KACEC,SACAL,UAA0B,EAAE,EACpB;EACR,MAAMM,cAAc,KAAKC,gBACvB,EAAE,GAAGP,SAAQ,EACb,cAAA;EAEF,MAAMQ,SAAS,KAAKC,aAClBJ,SACAL,SACA,cACAP,YAAYiB,KAAI;AAGlB,MAAIF,kBAAkBG,SAAS;AAC7BH,UAAOI,YAAM,GAAO;AACpB,QAAKX,OAAOY,KACV,0EAAA;AAEF,SAAM,IAAIC,OAAAA;;EAGZ,MAAMC,qBAAqB,CAAC,UAAU,aAAa;EACnD,MAAMC,cAAcC,OAAOC,KAAKZ,YAAAA;AAChC,MACE,OAAOD,YAAY,YACnBW,YAAYG,MAAMC,MAAM,CAACL,mBAAmBM,SAASD,EAAAA,CAAAA,CAErD,OAAM,IAAIN,MACR,uEACEE,YAAYM,KAAK,KAAA,CAAA;AAIvB,SAAO/B,qBAAIa,KAAKC,SAASG,QAAQF,YAAAA;;CAmCnCiB,UACElB,SACAL,UAA0B,EAAE,EACX;EACjB,MAAMM,cAAc,KAAKC,gBACvB,EAAE,GAAGP,SAAQ,EACb,cAAA;EAEF,MAAMQ,SAAS,KAAKC,aAClBJ,SACAL,SACA,cACAP,YAAYiB,KAAI;EAGlB,MAAMK,qBAAqB,CAAC,UAAU,aAAa;EACnD,MAAMC,cAAcC,OAAOC,KAAKZ,YAAAA;AAChC,MACE,OAAOD,YAAY,YACnBW,YAAYG,MAAMC,MAAM,CAACL,mBAAmBM,SAASD,EAAAA,CAAAA,CAErD,OAAM,IAAIN,MACR,uEACEE,YAAYM,KAAK,KAAA,CAAA;AAIvB,SAAO,IAAIX,SAASa,SAASC,WAC3Bd,QAAQa,SAAO,CACZE,WAAWlB,OAAAA,CACXkB,MAAMC,SAAAA;AACLpC,wBAAIa,KAAKC,SAASsB,MAAMrB,cAAcsB,KAAKC,YACzCD,MAAMH,OAAOG,IAAAA,GAAOJ,QAAQK,QAAAA,CAAAA;IAEhC,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA+BNC,OACEhC,OACAE,UAA4B,EAAE,EAC3B;EACH,MAAM+B,gBAAgB,KAAKxB,gBAAgB,EAAE,GAAGP,SAAQ,EAAG,gBAAA;EAC3D,MAAMQ,SAAS,KAAKC,aAClBX,OACAE,SACA,aACAP,YAAYuC,OAAM;AAGpB,MAAIxB,kBAAkBG,SAAS;AAC7BH,UAAOI,YAAM,GAAO;AACpB,QAAKX,OAAOY,KACV,4EAAA;AAEF,SAAM,IAAIC,OAAAA;;AAIZ,SAAOvB,qBAAIuC,OAAOhC,OAAOU,QAAQuB,cAAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;IA6BnCE,YACEnC,OACAE,UAA4B,EAAE,EAClB;EACZ,MAAM+B,gBAAgB,KAAKxB,gBAAgB,EAAE,GAAGP,SAAQ,EAAG,gBAAA;EAC3D,MAAMQ,SAAS,KAAKC,aAClBX,OACAE,SACA,aACAP,YAAYuC,OAAM;AAGpB,SAAO,IAAIrB,SAASa,SAASC,WAC3Bd,QAAQa,SAAO,CACZE,WAAWlB,OAAAA,CACXkB,MAAMC,SAAAA;AAELpC,wBAAIuC,OAAOhC,OAAO6B,MAAMI,gBAAgBH,KAAKM,YAC3CN,MAAMH,OAAOG,IAAAA,GAAOJ,QAAQU,QAAAA,CAAAA;IAEhC,CACCtB,MAAMa,OAAAA,CAAAA;;;;;;;;;;;;;;;;;;;;;;IAyBbU,OAAgBrC,OAAeE,SAAgC;AAC7D,SAAOT,qBAAI4C,OAAOrC,OAAOE,QAAAA;;CAGnBO,gBACNP,SACAoC,KAC6B;AAC7B,SAAOpC,QAAQQ;AACf,MAAI4B,QAAQ,cACV,QAAO,QAA4BC;MAEnC,QAAO,QAA8BC;AAEvC,SAAOtC,UACH;GACE,GAAG,KAAKA,QAAQoC;GAChB,GAAGpC;GACL,GAEA,KAAKA,QAAQoC;;CAGX3B,aACNX,OACAE,SACAoC,KACAG,mBACkD;AAWlD,SAVe,KAAKvC,QAAQwC,sBACxB,KAAKxC,QAAQwC,oBAAoBD,mBAAmBzC,OAAOE,QAAAA,GAC3DA,SAASQ,UACT,KAAKR,QAAQQ,WACZ4B,QAAQ,eACL,SAA6BC,cAAc,KAAKrC,QAAQqC,aACxD,SAA+BC,aAC/B,KAAKtC,QAAQsC,cACjB,KAAKtC,QAAQoC;;;;;;;;;ACtTrB,SAAgBO,kBACdC,QAA8D;AAI9D,KAAI,OAAOA,WAAW,WACpB,QAAOH,4BAAeI,QAAQH,iBAAiBE,OAAAA;AAEjD,QAAOH,4BAAeK,MAAMJ,iBAAiBE,OAAAA;;;;;;;;;;;;;;;;;;;;;GClD/C,MAAaI,oBAAoBD,qBAAIC;;;;;;;;;;;;;;;;;GAmBrC,MAAaC,iBAAiBF,qBAAIE;;;;;;;;;;;;;;;;;GAmBlC,MAAaC,oBAAoBH,qBAAIG"}
+{"version":3,"file":"index.cjs","names":["z","RequestType","AlgorithmType","enum","JwtHeaderSchema","object","alg","or","string","typ","optional","cty","crit","array","kid","jku","x5u","union","x5t","x5c","SignOptionsSchema","algorithm","keyid","expiresIn","number","notBefore","audience","instanceof","RegExp","subject","issuer","jwtid","mutatePayload","boolean","noTimestamp","header","encoding","allowInsecureKeySizes","allowInvalidAsymmetricKeyTypes","VerifyOptionsSchema","algorithms","clockTimestamp","clockTolerance","complete","ignoreExpiration","ignoreNotBefore","nonce","maxAge","SecretSchema","Buffer","type","passthrough","key","passphrase","JwtServiceOptionsSchema","signOptions","secret","publicKey","privateKey","verifyOptions","secretOrKeyProvider","function","input","any","output","inject","Injectable","InjectionToken","Logger","jwt","JwtServiceOptionsSchema","RequestType","JwtServiceToken","create","Symbol","for","token","JwtService","options","logger","context","name","sign","payload","signOptions","secret","prepareSign","signAsync","Promise","resolve","reject","err","encoded","verify","verifyOptions","prepareVerify","verifyAsync","decoded","decode","mergeJwtOptions","getSecretKey","Sign","allowedSignOptKeys","signOptKeys","Object","keys","some","k","includes","Error","join","Verify","key","privateKey","publicKey","secretRequestType","secretOrKeyProvider","InjectionToken","JwtServiceToken","provideJwtService","config","factory","bound","jwt","TokenExpiredError","NotBeforeError","JsonWebTokenError"],"sources":["../src/options/jwt-service.options.mts","../src/jwt.service.mts","../src/jwt-service.provider.mts","../src/index.mts"],"sourcesContent":["import type { Secret as JwtSecret } from 'jsonwebtoken'\n\nimport { z } from 'zod/v4'\n\n/**\n * Request type for secret or key provider functions.\n *\n * Used to distinguish between signing and verification operations when\n * dynamically resolving secrets or keys.\n */\nexport enum RequestType {\n  /** Request is for signing a token */\n  Sign = 'Sign',\n  /** Request is for verifying a token */\n  Verify = 'Verify',\n}\n\n/**\n * Supported JWT algorithms.\n *\n * Includes symmetric (HMAC) and asymmetric (RSA, ECDSA, EdDSA) algorithms.\n */\nexport const AlgorithmType = z.enum([\n  'HS256',\n  'HS384',\n  'HS512',\n  'RS256',\n  'RS384',\n  'RS512',\n  'ES256',\n  'ES384',\n  'ES512',\n  'PS256',\n  'PS384',\n  'PS512',\n  'none',\n])\n\n/**\n * JWT header schema.\n *\n * Defines the structure of the JWT header with standard claims.\n */\nexport const JwtHeaderSchema = z.object({\n  alg: AlgorithmType.or(z.string()),\n  typ: z.string().optional(),\n  cty: z.string().optional(),\n  crit: z.string().array().optional(),\n  kid: z.string().optional(),\n  jku: z.string().optional(),\n  x5u: z.union([z.string(), z.array(z.string())]).optional(),\n  'x5t#S256': z.string().optional(),\n  x5t: z.string().optional(),\n  x5c: z.union([z.string(), z.array(z.string())]).optional(),\n})\n\n/**\n * JWT header type.\n *\n * Contains algorithm, type, and optional header claims.\n */\nexport type JwtHeader = z.infer<typeof JwtHeaderSchema>\n\n/**\n * Schema for JWT signing options.\n *\n * Defines all available options for signing tokens including algorithm,\n * expiration, audience, issuer, and other standard JWT claims.\n */\nexport const SignOptionsSchema = z.object({\n  algorithm: AlgorithmType.optional(),\n  keyid: z.string().optional(),\n  expiresIn: z.union([z.string(), z.number()]).optional(),\n  notBefore: z.union([z.string(), z.number()]).optional(),\n  audience: z\n    .union([\n      z.string(),\n      z.instanceof(RegExp),\n      z.array(z.union([z.string(), z.instanceof(RegExp)])),\n    ])\n    .optional(),\n  subject: z.string().optional(),\n  issuer: z.string().optional(),\n  jwtid: z.string().optional(),\n  mutatePayload: z.boolean().optional(),\n  noTimestamp: z.boolean().optional(),\n  header: JwtHeaderSchema.optional(),\n  encoding: z.string().optional(),\n  allowInsecureKeySizes: z.boolean().optional(),\n  allowInvalidAsymmetricKeyTypes: z.boolean().optional(),\n})\n\n/**\n * Options for signing JWT tokens.\n *\n * @see SignOptionsSchema for the complete schema definition\n */\nexport type SignOptions = z.infer<typeof SignOptionsSchema>\n\n/**\n * Schema for JWT verification options.\n *\n * Defines all available options for verifying tokens including allowed\n * algorithms, audience, issuer, expiration handling, and other validation rules.\n */\nexport const VerifyOptionsSchema = z.object({\n  algorithms: AlgorithmType.array().optional(),\n  audience: z\n    .union([\n      z.string(),\n      z.instanceof(RegExp),\n      z.array(z.union([z.string(), z.instanceof(RegExp)])),\n    ])\n    .optional(),\n  clockTimestamp: z.number().optional(),\n  clockTolerance: z.number().optional(),\n  complete: z.boolean().optional(),\n  issuer: z.union([z.string(), z.string().array()]).optional(),\n  ignoreExpiration: z.boolean().optional(),\n  ignoreNotBefore: z.boolean().optional(),\n  jwtid: z.string().optional(),\n  nonce: z.string().optional(),\n  subject: z.string().optional(),\n  maxAge: z.union([z.string(), z.number()]).optional(),\n  allowInvalidAsymmetricKeyTypes: z.boolean().optional(),\n})\n\n/**\n * Options for verifying JWT tokens.\n *\n * @see VerifyOptionsSchema for the complete schema definition\n */\nexport type VerifyOptions = z.infer<typeof VerifyOptionsSchema>\n\n/**\n * Schema for JWT secret/key types.\n *\n * Supports string secrets, Buffer objects, and key objects with passphrases.\n */\nexport const SecretSchema = z.union([\n  z.string(),\n  z.instanceof(Buffer),\n  z\n    .object({\n      type: z.string(),\n    })\n    .passthrough(),\n  z.object({\n    key: z.union([z.string(), z.instanceof(Buffer)]),\n    passphrase: z.string(),\n  }),\n])\n\n/**\n * Secret or key type for JWT operations.\n *\n * Can be a string, Buffer, or an object with key and optional passphrase.\n */\nexport type Secret = z.infer<typeof SecretSchema>\n\nexport const JwtServiceOptionsSchema = z.object({\n  signOptions: SignOptionsSchema.optional(),\n  secret: z.string().optional(),\n  publicKey: z.union([z.string(), z.instanceof(Buffer)]).optional(),\n  privateKey: SecretSchema.optional(),\n  verifyOptions: VerifyOptionsSchema.optional(),\n  secretOrKeyProvider: z\n    .function({\n      input: [\n        z.enum(RequestType),\n        z.any(),\n        z.union([SignOptionsSchema, VerifyOptionsSchema]).optional(),\n      ],\n      output: SecretSchema,\n    })\n    .optional(),\n})\n\n/**\n * Configuration options for the JWT service.\n *\n * @property signOptions - Default options for signing tokens\n * @property secret - Default secret for symmetric algorithms (HS256, HS384, HS512)\n * @property publicKey - Default public key for asymmetric algorithms (RS256, ES256, etc.)\n * @property privateKey - Default private key for asymmetric algorithms\n * @property verifyOptions - Default options for verifying tokens\n * @property secretOrKeyProvider - Optional function to dynamically resolve secrets/keys\n *\n * @example\n * ```ts\n * const options: JwtServiceOptions = {\n *   secret: 'your-secret-key',\n *   signOptions: {\n *     expiresIn: '1h',\n *     algorithm: 'HS256',\n *   },\n *   verifyOptions: {\n *     algorithms: ['HS256'],\n *   },\n * }\n * ```\n */\nexport type JwtServiceOptions = z.infer<typeof JwtServiceOptionsSchema>\n\n/**\n * Options for signing JWT tokens.\n *\n * Extends `SignOptions` with additional properties for specifying\n * the secret or private key to use for signing.\n *\n * @property secret - Secret key for symmetric algorithms (overrides service default)\n * @property privateKey - Private key for asymmetric algorithms (overrides service default)\n */\nexport interface JwtSignOptions extends SignOptions {\n  /** Secret key for symmetric algorithms */\n  secret?: string | Buffer\n  /** Private key for asymmetric algorithms */\n  privateKey?: Secret\n}\n\n/**\n * Options for verifying JWT tokens.\n *\n * Extends `VerifyOptions` with additional properties for specifying\n * the secret or public key to use for verification.\n *\n * @property secret - Secret key for symmetric algorithms (overrides service default)\n * @property publicKey - Public key for asymmetric algorithms (overrides service default)\n */\nexport interface JwtVerifyOptions extends VerifyOptions {\n  /** Secret key for symmetric algorithms */\n  secret?: string | Buffer\n  /** Public key for asymmetric algorithms */\n  publicKey?: string | Buffer\n}\n\n/**\n * Result type for secret/key resolution.\n *\n * Represents the possible return types from secret or key provider functions.\n */\nexport type GetSecretKeyResult = string | Buffer | JwtSecret\n","import { inject, Injectable, InjectionToken, Logger } from '@navios/core'\n\nimport jwt from 'jsonwebtoken'\n\nimport type {\n  GetSecretKeyResult,\n  JwtServiceOptions,\n  JwtSignOptions,\n  JwtVerifyOptions,\n  SignOptions,\n  VerifyOptions,\n} from './options/jwt-service.options.mjs'\n\nimport {\n  JwtServiceOptionsSchema,\n  RequestType,\n} from './options/jwt-service.options.mjs'\n\n/**\n * Injection token for JwtService.\n *\n * Used internally by the dependency injection system to register and resolve JwtService instances.\n */\nexport const JwtServiceToken = InjectionToken.create(\n  Symbol.for('JwtService'),\n  JwtServiceOptionsSchema,\n)\n\n/**\n * Service for signing, verifying, and decoding JSON Web Tokens (JWTs).\n *\n * This service provides a type-safe wrapper around the `jsonwebtoken` library with\n * seamless integration into Navios's dependency injection system. It supports both\n * symmetric (HS256, HS384, HS512) and asymmetric (RS256, ES256, etc.) algorithms.\n *\n * @example\n * ```ts\n * import { provideJwtService } from '@navios/jwt'\n * import { inject } from '@navios/core'\n *\n * const JwtService = provideJwtService({\n *   secret: 'your-secret-key',\n *   signOptions: { expiresIn: '1h' },\n * })\n *\n * @Injectable()\n * class AuthService {\n *   jwtService = inject(JwtService)\n *\n *   async login(userId: string) {\n *     const token = this.jwtService.sign({ userId, role: 'user' })\n *     return token\n *   }\n * }\n * ```\n */\n@Injectable({\n  token: JwtServiceToken,\n})\nexport class JwtService {\n  logger = inject(Logger, {\n    context: JwtService.name,\n  })\n\n  /**\n   * Creates a new JwtService instance.\n   *\n   * @param options - Configuration options for the JWT service\n   */\n  constructor(private readonly options: JwtServiceOptions = {}) {}\n\n  /**\n   * Signs a JWT payload synchronously.\n   *\n   * When the payload is a string, only `secret` and `privateKey` options are allowed.\n   * For object or Buffer payloads, all sign options are available.\n   *\n   * @param payload - The payload to sign. Can be a string, Buffer, or object.\n   * @param options - Signing options. When payload is a string, only `secret` and `privateKey` are allowed.\n   * @returns The signed JWT token as a string\n   * @throws {Error} If payload is a string and invalid options are provided\n   *\n   * @example\n   * ```ts\n   * // Sign with object payload\n   * const token = jwtService.sign(\n   *   { userId: '123', role: 'admin' },\n   *   { expiresIn: '1h' }\n   * )\n   *\n   * // Sign with string payload (limited options)\n   * const token = jwtService.sign('payload-string', { secret: 'key' })\n   * ```\n   */\n  sign(\n    payload: string,\n    options?: Omit<JwtSignOptions, keyof SignOptions>,\n  ): string\n  /**\n   * Signs a JWT payload synchronously.\n   *\n   * @param payload - The payload to sign. Can be a Buffer or object.\n   * @param options - Signing options including algorithm, expiration, etc.\n   * @returns The signed JWT token as a string\n   */\n  sign(payload: Buffer | object, options?: JwtSignOptions): string\n  sign(\n    payload: string | Buffer | object,\n    options: JwtSignOptions = {},\n  ): string {\n    const { signOptions, secret } = this.prepareSign(payload, options)\n    return jwt.sign(payload, secret, signOptions)\n  }\n\n  /**\n   * Signs a JWT payload asynchronously.\n   *\n   * Supports the same payload types and options as `sign()`.\n   *\n   * @param payload - The payload to sign. Can be a string, Buffer, or object.\n   * @param options - Signing options. When payload is a string, only `secret` and `privateKey` are allowed.\n   * @returns A Promise that resolves to the signed JWT token as a string\n   * @throws {Error} If payload is a string and invalid options are provided\n   *\n   * @example\n   * ```ts\n   * const token = await jwtService.signAsync(\n   *   { userId: '123' },\n   *   { expiresIn: '1h' }\n   * )\n   * ```\n   */\n  signAsync(\n    payload: string,\n    options?: Omit<JwtSignOptions, keyof jwt.SignOptions>,\n  ): Promise<string>\n  /**\n   * Signs a JWT payload asynchronously.\n   *\n   * @param payload - The payload to sign. Can be a Buffer or object.\n   * @param options - Signing options including algorithm, expiration, etc.\n   * @returns A Promise that resolves to the signed JWT token as a string\n   */\n  signAsync(payload: Buffer | object, options?: JwtSignOptions): Promise<string>\n  signAsync(\n    payload: string | Buffer | object,\n    options: JwtSignOptions = {},\n  ): Promise<string> {\n    const { signOptions, secret } = this.prepareSign(payload, options)\n    return new Promise((resolve, reject) => {\n      jwt.sign(payload, secret, signOptions, (err, encoded) =>\n        err ? reject(err) : resolve(encoded as string),\n      )\n    })\n  }\n\n  /**\n   * Verifies and decodes a JWT token synchronously.\n   *\n   * This method validates the token's signature, expiration, and other claims\n   * according to the provided options. If verification fails, an error is thrown.\n   *\n   * @template T - The expected type of the decoded payload\n   * @param token - The JWT token string to verify\n   * @param options - Verification options including algorithms, audience, issuer, etc.\n   * @returns The decoded payload as type T\n   * @throws {TokenExpiredError} If the token has expired\n   * @throws {NotBeforeError} If the token is not yet valid (nbf claim)\n   * @throws {JsonWebTokenError} If the token is invalid or malformed\n   *\n   * @example\n   * ```ts\n   * try {\n   *   const payload = jwtService.verify<{ userId: string; role: string }>(token)\n   *   console.log(payload.userId) // '123'\n   * } catch (error) {\n   *   if (error instanceof TokenExpiredError) {\n   *     console.error('Token expired')\n   *   }\n   * }\n   * ```\n   */\n  verify<T extends object = any>(\n    token: string,\n    options: JwtVerifyOptions = {},\n  ): T {\n    const { verifyOptions, secret } = this.prepareVerify(token, options)\n    // @ts-expect-error We check it\n    return jwt.verify(token, secret, verifyOptions) as unknown as T\n  }\n\n  /**\n   * Verifies and decodes a JWT token asynchronously.\n   *\n   * Provides the same validation as `verify()`.\n   *\n   * @template T - The expected type of the decoded payload\n   * @param token - The JWT token string to verify\n   * @param options - Verification options including algorithms, audience, issuer, etc.\n   * @returns A Promise that resolves to the decoded payload as type T\n   * @throws {TokenExpiredError} If the token has expired\n   * @throws {NotBeforeError} If the token is not yet valid (nbf claim)\n   * @throws {JsonWebTokenError} If the token is invalid or malformed\n   *\n   * @example\n   * ```ts\n   * try {\n   *   const payload = await jwtService.verifyAsync<{ userId: string }>(token)\n   *   console.log(payload.userId)\n   * } catch (error) {\n   *   if (error instanceof TokenExpiredError) {\n   *     console.error('Token expired')\n   *   }\n   * }\n   * ```\n   */\n  verifyAsync<T extends object = any>(\n    token: string,\n    options: JwtVerifyOptions = {},\n  ): Promise<T> {\n    const { verifyOptions, secret } = this.prepareVerify(token, options)\n    return new Promise((resolve, reject) => {\n      // @ts-expect-error We check it\n      jwt.verify(token, secret, verifyOptions, (err, decoded) =>\n        err ? reject(err) : resolve(decoded as T),\n      )\n    })\n  }\n\n  /**\n   * Decodes a JWT token without verification.\n   *\n   * This method decodes the token without validating its signature or claims.\n   * Use this only when you need to inspect the token contents without verification.\n   * For secure token validation, use `verify()` or `verifyAsync()` instead.\n   *\n   * @template T - The expected type of the decoded payload\n   * @param token - The JWT token string to decode\n   * @param options - Decode options (complete, json, etc.)\n   * @returns The decoded payload as type T, or null if decoding fails\n   *\n   * @example\n   * ```ts\n   * // Decode without verification (not recommended for production)\n   * const payload = jwtService.decode<{ userId: string }>(token)\n   * if (payload) {\n   *   console.log(payload.userId)\n   * }\n   * ```\n   */\n  decode<T = any>(token: string, options?: jwt.DecodeOptions): T {\n    return jwt.decode(token, options) as T\n  }\n\n  private prepareSign(\n    payload: string | Buffer | object,\n    options: JwtSignOptions,\n  ): { signOptions: jwt.SignOptions; secret: GetSecretKeyResult } {\n    const signOptions = this.mergeJwtOptions(\n      { ...options },\n      'signOptions',\n    ) as jwt.SignOptions\n    const secret = this.getSecretKey(\n      payload,\n      options,\n      'privateKey',\n      RequestType.Sign,\n    )\n\n    const allowedSignOptKeys = ['secret', 'privateKey']\n    const signOptKeys = Object.keys(signOptions)\n    if (\n      typeof payload === 'string' &&\n      signOptKeys.some((k) => !allowedSignOptKeys.includes(k))\n    ) {\n      throw new Error(\n        'Payload as string is not allowed with the following sign options: ' +\n          signOptKeys.join(', '),\n      )\n    }\n\n    return { signOptions, secret }\n  }\n\n  private prepareVerify(\n    token: string,\n    options: JwtVerifyOptions,\n  ): {\n    verifyOptions: VerifyOptions | SignOptions\n    secret: GetSecretKeyResult\n  } {\n    const verifyOptions = this.mergeJwtOptions({ ...options }, 'verifyOptions')\n    const secret = this.getSecretKey(\n      token,\n      options,\n      'publicKey',\n      RequestType.Verify,\n    )\n    return { verifyOptions, secret }\n  }\n\n  private mergeJwtOptions(\n    options: JwtVerifyOptions | JwtSignOptions,\n    key: 'verifyOptions' | 'signOptions',\n  ): VerifyOptions | SignOptions {\n    delete options.secret\n    if (key === 'signOptions') {\n      delete (options as JwtSignOptions).privateKey\n    } else {\n      delete (options as JwtVerifyOptions).publicKey\n    }\n    return options\n      ? {\n          ...this.options[key],\n          ...options,\n        }\n      : // @ts-expect-error We check it\n        this.options[key]\n  }\n\n  private getSecretKey(\n    token: string | object | Buffer,\n    options: JwtVerifyOptions | JwtSignOptions,\n    key: 'publicKey' | 'privateKey',\n    secretRequestType: RequestType,\n  ): GetSecretKeyResult {\n    const secret = this.options.secretOrKeyProvider\n      ? this.options.secretOrKeyProvider(secretRequestType, token, options)\n      : options?.secret ||\n        this.options.secret ||\n        (key === 'privateKey'\n          ? (options as JwtSignOptions)?.privateKey || this.options.privateKey\n          : (options as JwtVerifyOptions)?.publicKey ||\n            this.options.publicKey) ||\n        this.options[key]\n\n    return secret as GetSecretKeyResult\n  }\n}\n","import type { BoundInjectionToken, FactoryInjectionToken } from '@navios/core'\n\nimport { InjectionToken } from '@navios/core'\n\nimport type { JwtServiceOptions } from './options/jwt-service.options.mjs'\n\nimport { JwtService, JwtServiceToken } from './jwt.service.mjs'\nimport { JwtServiceOptionsSchema } from './options/jwt-service.options.mjs'\n\n/**\n * Creates a JWT service provider for dependency injection.\n *\n * This function creates an injection token that can be used to register and resolve\n * `JwtService` instances in the Navios dependency injection container. It supports\n * both static configuration and async factory functions for dynamic configuration.\n *\n * @param config - Static JWT service configuration options\n * @returns A bound injection token that can be used with `inject()` or `syncInject()`\n *\n * @example\n * ```ts\n * // Static configuration\n * const JwtService = provideJwtService({\n *   secret: 'your-secret-key',\n *   signOptions: { expiresIn: '1h' },\n * })\n *\n * @Injectable()\n * class AuthService {\n *   jwtService = inject(JwtService)\n * }\n * ```\n */\nexport function provideJwtService(\n  config: JwtServiceOptions,\n): BoundInjectionToken<JwtService, typeof JwtServiceOptionsSchema>\n/**\n * Creates a JWT service provider with async configuration factory.\n *\n * Use this overload when you need to load configuration asynchronously, such as\n * fetching secrets from a configuration service or environment variables.\n *\n * @param config - Async factory function that returns JWT service configuration\n * @returns A factory injection token that resolves configuration asynchronously\n *\n * @example\n * ```ts\n * // Async configuration\n * const JwtService = provideJwtService(async () => {\n *   const configService = await inject(ConfigService)\n *   return {\n *     secret: configService.jwt.secret,\n *     signOptions: { expiresIn: configService.jwt.expiresIn },\n *   }\n * })\n *\n * @Injectable()\n * class AuthService {\n *   jwtService = inject(JwtService)\n * }\n * ```\n */\nexport function provideJwtService(\n  config: () => Promise<JwtServiceOptions>,\n): FactoryInjectionToken<JwtService, typeof JwtServiceOptionsSchema>\nexport function provideJwtService(\n  config: JwtServiceOptions | (() => Promise<JwtServiceOptions>),\n):\n  | BoundInjectionToken<JwtService, typeof JwtServiceOptionsSchema>\n  | FactoryInjectionToken<JwtService, typeof JwtServiceOptionsSchema> {\n  if (typeof config === 'function') {\n    return InjectionToken.factory(JwtServiceToken, config)\n  }\n  return InjectionToken.bound(JwtServiceToken, config)\n}\n","import jwt from 'jsonwebtoken'\n\nexport * from './options/jwt-service.options.mjs'\nexport * from './jwt.service.mjs'\nexport * from './jwt-service.provider.mjs'\n\n/**\n * Error thrown when a JWT token has expired.\n *\n * This error is thrown by `verify()` and `verifyAsync()` when the token's\n * expiration time (exp claim) has passed.\n *\n * @example\n * ```ts\n * try {\n *   jwtService.verify(token)\n * } catch (error) {\n *   if (error instanceof TokenExpiredError) {\n *     console.error('Token expired at:', error.expiredAt)\n *   }\n * }\n * ```\n */\nexport const TokenExpiredError = jwt.TokenExpiredError\n\n/**\n * Error thrown when a JWT token is not yet valid.\n *\n * This error is thrown by `verify()` and `verifyAsync()` when the token's\n * \"not before\" time (nbf claim) is in the future.\n *\n * @example\n * ```ts\n * try {\n *   jwtService.verify(token)\n * } catch (error) {\n *   if (error instanceof NotBeforeError) {\n *     console.error('Token not valid until:', error.date)\n *   }\n * }\n * ```\n */\nexport const NotBeforeError = jwt.NotBeforeError\n\n/**\n * Base error class for JWT-related errors.\n *\n * This is the base class for all JWT errors including `TokenExpiredError`\n * and `NotBeforeError`. It's thrown for invalid or malformed tokens.\n *\n * @example\n * ```ts\n * try {\n *   jwtService.verify(token)\n * } catch (error) {\n *   if (error instanceof JsonWebTokenError) {\n *     console.error('JWT error:', error.message)\n *   }\n * }\n * ```\n */\nexport const JsonWebTokenError = jwt.JsonWebTokenError\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAUA,IAAO,cAAKC,yBAAAA,eAAAA;sCACyB,eAAA,UAAA;wCAEE,eAAA,YAAA;QAH3BA;;;;;;GAYZ,MAAaC,gBAAgBF,SAAEG,KAAK;CAClC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD,CAAA;;;;;GAOD,MAAaC,kBAAkBJ,SAAEK,OAAO;CACtCC,KAAKJ,cAAcK,GAAGP,SAAEQ,QAAM,CAAA;CAC9BC,KAAKT,SAAEQ,QAAM,CAAGE,UAAQ;CACxBC,KAAKX,SAAEQ,QAAM,CAAGE,UAAQ;CACxBE,MAAMZ,SAAEQ,QAAM,CAAGK,OAAK,CAAGH,UAAQ;CACjCI,KAAKd,SAAEQ,QAAM,CAAGE,UAAQ;CACxBK,KAAKf,SAAEQ,QAAM,CAAGE,UAAQ;CACxBM,KAAKhB,SAAEiB,MAAM,CAACjB,SAAEQ,QAAM,EAAIR,SAAEa,MAAMb,SAAEQ,QAAM,CAAA,CAAI,CAAA,CAAEE,UAAQ;CACxD,YAAYV,SAAEQ,QAAM,CAAGE,UAAQ;CAC/BQ,KAAKlB,SAAEQ,QAAM,CAAGE,UAAQ;CACxBS,KAAKnB,SAAEiB,MAAM,CAACjB,SAAEQ,QAAM,EAAIR,SAAEa,MAAMb,SAAEQ,QAAM,CAAA,CAAI,CAAA,CAAEE,UAAQ;CAC1D,CAAA;;;;;;GAeA,MAAaU,oBAAoBpB,SAAEK,OAAO;CACxCgB,WAAWnB,cAAcQ,UAAQ;CACjCY,OAAOtB,SAAEQ,QAAM,CAAGE,UAAQ;CAC1Ba,WAAWvB,SAAEiB,MAAM,CAACjB,SAAEQ,QAAM,EAAIR,SAAEwB,QAAM,CAAG,CAAA,CAAEd,UAAQ;CACrDe,WAAWzB,SAAEiB,MAAM,CAACjB,SAAEQ,QAAM,EAAIR,SAAEwB,QAAM,CAAG,CAAA,CAAEd,UAAQ;CACrDgB,UAAU1B,SACPiB,MAAM;EACLjB,SAAEQ,QAAM;EACRR,SAAE2B,WAAWC,OAAAA;EACb5B,SAAEa,MAAMb,SAAEiB,MAAM,CAACjB,SAAEQ,QAAM,EAAIR,SAAE2B,WAAWC,OAAAA,CAAQ,CAAA,CAAA;EACnD,CAAA,CACAlB,UAAQ;CACXmB,SAAS7B,SAAEQ,QAAM,CAAGE,UAAQ;CAC5BoB,QAAQ9B,SAAEQ,QAAM,CAAGE,UAAQ;CAC3BqB,OAAO/B,SAAEQ,QAAM,CAAGE,UAAQ;CAC1BsB,eAAehC,SAAEiC,SAAO,CAAGvB,UAAQ;CACnCwB,aAAalC,SAAEiC,SAAO,CAAGvB,UAAQ;CACjCyB,QAAQ/B,gBAAgBM,UAAQ;CAChC0B,UAAUpC,SAAEQ,QAAM,CAAGE,UAAQ;CAC7B2B,uBAAuBrC,SAAEiC,SAAO,CAAGvB,UAAQ;CAC3C4B,gCAAgCtC,SAAEiC,SAAO,CAAGvB,UAAQ;CACtD,CAAA;;;;;;GAeA,MAAa6B,sBAAsBvC,SAAEK,OAAO;CAC1CmC,YAAYtC,cAAcW,OAAK,CAAGH,UAAQ;CAC1CgB,UAAU1B,SACPiB,MAAM;EACLjB,SAAEQ,QAAM;EACRR,SAAE2B,WAAWC,OAAAA;EACb5B,SAAEa,MAAMb,SAAEiB,MAAM,CAACjB,SAAEQ,QAAM,EAAIR,SAAE2B,WAAWC,OAAAA,CAAQ,CAAA,CAAA;EACnD,CAAA,CACAlB,UAAQ;CACX+B,gBAAgBzC,SAAEwB,QAAM,CAAGd,UAAQ;CACnCgC,gBAAgB1C,SAAEwB,QAAM,CAAGd,UAAQ;CACnCiC,UAAU3C,SAAEiC,SAAO,CAAGvB,UAAQ;CAC9BoB,QAAQ9B,SAAEiB,MAAM,CAACjB,SAAEQ,QAAM,EAAIR,SAAEQ,QAAM,CAAGK,OAAK,CAAG,CAAA,CAAEH,UAAQ;CAC1DkC,kBAAkB5C,SAAEiC,SAAO,CAAGvB,UAAQ;CACtCmC,iBAAiB7C,SAAEiC,SAAO,CAAGvB,UAAQ;CACrCqB,OAAO/B,SAAEQ,QAAM,CAAGE,UAAQ;CAC1BoC,OAAO9C,SAAEQ,QAAM,CAAGE,UAAQ;CAC1BmB,SAAS7B,SAAEQ,QAAM,CAAGE,UAAQ;CAC5BqC,QAAQ/C,SAAEiB,MAAM,CAACjB,SAAEQ,QAAM,EAAIR,SAAEwB,QAAM,CAAG,CAAA,CAAEd,UAAQ;CAClD4B,gCAAgCtC,SAAEiC,SAAO,CAAGvB,UAAQ;CACtD,CAAA;;;;;GAcA,MAAasC,eAAehD,SAAEiB,MAAM;CAClCjB,SAAEQ,QAAM;CACRR,SAAE2B,WAAWsB,OAAAA;CACbjD,SACGK,OAAO,EACN6C,MAAMlD,SAAEQ,QAAM,EAChB,CAAA,CACC2C,aAAW;CACdnD,SAAEK,OAAO;EACP+C,KAAKpD,SAAEiB,MAAM,CAACjB,SAAEQ,QAAM,EAAIR,SAAE2B,WAAWsB,OAAAA,CAAQ,CAAA;EAC/CI,YAAYrD,SAAEQ,QAAM;EACtB,CAAA;CACD,CAAA;AASD,MAAa8C,0BAA0BtD,SAAEK,OAAO;CAC9CkD,aAAanC,kBAAkBV,UAAQ;CACvC8C,QAAQxD,SAAEQ,QAAM,CAAGE,UAAQ;CAC3B+C,WAAWzD,SAAEiB,MAAM,CAACjB,SAAEQ,QAAM,EAAIR,SAAE2B,WAAWsB,OAAAA,CAAQ,CAAA,CAAEvC,UAAQ;CAC/DgD,YAAYV,aAAatC,UAAQ;CACjCiD,eAAepB,oBAAoB7B,UAAQ;CAC3CkD,qBAAqB5D,SAClB6D,SAAS;EACRC,OAAO;GACL9D,SAAEG,KAAKF,YAAAA;GACPD,SAAE+D,KAAG;GACL/D,SAAEiB,MAAM,CAACG,mBAAmBmB,oBAAoB,CAAA,CAAE7B,UAAQ;GAC3D;EACDsD,QAAQhB;EACV,CAAA,CACCtC,UAAQ;CACb,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GCzJA,MAAa8D,kBAAkBL,4BAAeM,OAC5CC,OAAOC,IAAI,aAAA,EACXL,wBAAAA;;oCA+BU,EACVM,OAAOJ,iBACT,CAAA;AACO,IAAMK,aAAN,MAAMA;;;;;;;;;IAUX,YAAY,UAA8C,EAAE,EAAE;OAAjCC,UAAAA;;CAT7BC,kCAAgBX,qBAAQ,EACtBY,SAASH,YAAWI,MACtB,CAAA;CA4CAC,KACEC,SACAL,UAA0B,EAAE,EACpB;EACR,MAAM,EAAEM,aAAaC,WAAW,KAAKC,YAAYH,SAASL,QAAAA;AAC1D,SAAOT,qBAAIa,KAAKC,SAASE,QAAQD,YAAAA;;CAiCnCG,UACEJ,SACAL,UAA0B,EAAE,EACX;EACjB,MAAM,EAAEM,aAAaC,WAAW,KAAKC,YAAYH,SAASL,QAAAA;AAC1D,SAAO,IAAIU,SAASC,SAASC,WAAAA;AAC3BrB,wBAAIa,KAAKC,SAASE,QAAQD,cAAcO,KAAKC,YAC3CD,MAAMD,OAAOC,IAAAA,GAAOF,QAAQG,QAAAA,CAAAA;IAEhC;;;;;;;;;;;;;;;;;;;;;;;;;;;IA6BFC,OACEjB,OACAE,UAA4B,EAAE,EAC3B;EACH,MAAM,EAAEgB,eAAeT,WAAW,KAAKU,cAAcnB,OAAOE,QAAAA;AAE5D,SAAOT,qBAAIwB,OAAOjB,OAAOS,QAAQS,cAAAA;;;;;;;;;;;;;;;;;;;;;;;;;;IA4BnCE,YACEpB,OACAE,UAA4B,EAAE,EAClB;EACZ,MAAM,EAAEgB,eAAeT,WAAW,KAAKU,cAAcnB,OAAOE,QAAAA;AAC5D,SAAO,IAAIU,SAASC,SAASC,WAAAA;AAE3BrB,wBAAIwB,OAAOjB,OAAOS,QAAQS,gBAAgBH,KAAKM,YAC7CN,MAAMD,OAAOC,IAAAA,GAAOF,QAAQQ,QAAAA,CAAAA;IAEhC;;;;;;;;;;;;;;;;;;;;;;IAwBFC,OAAgBtB,OAAeE,SAAgC;AAC7D,SAAOT,qBAAI6B,OAAOtB,OAAOE,QAAAA;;CAGnBQ,YACNH,SACAL,SAC8D;EAC9D,MAAMM,cAAc,KAAKe,gBACvB,EAAE,GAAGrB,SAAQ,EACb,cAAA;EAEF,MAAMO,SAAS,KAAKe,aAClBjB,SACAL,SACA,cACAP,YAAY8B,KAAI;EAGlB,MAAMC,qBAAqB,CAAC,UAAU,aAAa;EACnD,MAAMC,cAAcC,OAAOC,KAAKrB,YAAAA;AAChC,MACE,OAAOD,YAAY,YACnBoB,YAAYG,MAAMC,MAAM,CAACL,mBAAmBM,SAASD,EAAAA,CAAAA,CAErD,OAAM,IAAIE,MACR,uEACEN,YAAYO,KAAK,KAAA,CAAA;AAIvB,SAAO;GAAE1B;GAAaC;GAAO;;CAGvBU,cACNnB,OACAE,SAIA;AAQA,SAAO;GAAEgB,eAPa,KAAKK,gBAAgB,EAAE,GAAGrB,SAAQ,EAAG,gBAAA;GAOnCO,QANT,KAAKe,aAClBxB,OACAE,SACA,aACAP,YAAYwC,OAAM;GAEW;;CAGzBZ,gBACNrB,SACAkC,KAC6B;AAC7B,SAAOlC,QAAQO;AACf,MAAI2B,QAAQ,cACV,QAAO,QAA4BC;MAEnC,QAAO,QAA8BC;AAEvC,SAAOpC,UACH;GACE,GAAG,KAAKA,QAAQkC;GAChB,GAAGlC;GACL,GAEA,KAAKA,QAAQkC;;CAGXZ,aACNxB,OACAE,SACAkC,KACAG,mBACoB;AAWpB,SAVe,KAAKrC,QAAQsC,sBACxB,KAAKtC,QAAQsC,oBAAoBD,mBAAmBvC,OAAOE,QAAAA,GAC3DA,SAASO,UACT,KAAKP,QAAQO,WACZ2B,QAAQ,eACL,SAA6BC,cAAc,KAAKnC,QAAQmC,aACxD,SAA+BC,aAC/B,KAAKpC,QAAQoC,cACjB,KAAKpC,QAAQkC;;;;;;;;;AC7QrB,SAAgBO,kBACdC,QAA8D;AAI9D,KAAI,OAAOA,WAAW,WACpB,QAAOH,4BAAeI,QAAQH,iBAAiBE,OAAAA;AAEjD,QAAOH,4BAAeK,MAAMJ,iBAAiBE,OAAAA;;;;;;;;;;;;;;;;;;;;;GClD/C,MAAaI,oBAAoBD,qBAAIC;;;;;;;;;;;;;;;;;GAmBrC,MAAaC,iBAAiBF,qBAAIE;;;;;;;;;;;;;;;;;GAmBlC,MAAaC,oBAAoBH,qBAAIG"}

package/lib/index.d.cts

@@ -375,17 +375,12 @@ declare const JwtServiceOptionsSchema: z.ZodObject<{
     subject: z.ZodOptional<z.ZodString>;
     maxAge: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
     allowInvalidAsymmetricKeyTypes: z.ZodOptional<z.ZodBoolean>;
-  }, z.core.$strip>]>>], null>, z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodString, z.ZodCustom<Buffer<ArrayBufferLike>, Buffer<ArrayBufferLike>>, z.ZodObject<{
+  }, z.core.$strip>]>>], null>, z.ZodUnion<readonly [z.ZodString, z.ZodCustom<Buffer<ArrayBufferLike>, Buffer<ArrayBufferLike>>, z.ZodObject<{
     type: z.ZodString;
   }, z.core.$loose>, z.ZodObject<{
     key: z.ZodUnion<readonly [z.ZodString, z.ZodCustom<Buffer<ArrayBufferLike>, Buffer<ArrayBufferLike>>]>;
     passphrase: z.ZodString;
-  }, z.core.$strip>]>, z.ZodPromise<z.ZodUnion<readonly [z.ZodString, z.ZodCustom<Buffer<ArrayBufferLike>, Buffer<ArrayBufferLike>>, z.ZodObject<{
-    type: z.ZodString;
-  }, z.core.$loose>, z.ZodObject<{
-    key: z.ZodUnion<readonly [z.ZodString, z.ZodCustom<Buffer<ArrayBufferLike>, Buffer<ArrayBufferLike>>]>;
-    passphrase: z.ZodString;
-  }, z.core.$strip>]>>]>>>;
+  }, z.core.$strip>]>>>;
 }, z.core.$strip>;
 /**
  * Configuration options for the JWT service.
@@ -630,17 +625,12 @@ declare const JwtServiceToken: InjectionToken<unknown, zod_v40.ZodObject<{
     subject: zod_v40.ZodOptional<zod_v40.ZodString>;
     maxAge: zod_v40.ZodOptional<zod_v40.ZodUnion<readonly [zod_v40.ZodString, zod_v40.ZodNumber]>>;
     allowInvalidAsymmetricKeyTypes: zod_v40.ZodOptional<zod_v40.ZodBoolean>;
-  }, zod_v4_core0.$strip>]>>], null>, zod_v40.ZodUnion<readonly [zod_v40.ZodUnion<readonly [zod_v40.ZodString, zod_v40.ZodCustom<Buffer<ArrayBufferLike>, Buffer<ArrayBufferLike>>, zod_v40.ZodObject<{
-    type: zod_v40.ZodString;
-  }, zod_v4_core0.$loose>, zod_v40.ZodObject<{
-    key: zod_v40.ZodUnion<readonly [zod_v40.ZodString, zod_v40.ZodCustom<Buffer<ArrayBufferLike>, Buffer<ArrayBufferLike>>]>;
-    passphrase: zod_v40.ZodString;
-  }, zod_v4_core0.$strip>]>, zod_v40.ZodPromise<zod_v40.ZodUnion<readonly [zod_v40.ZodString, zod_v40.ZodCustom<Buffer<ArrayBufferLike>, Buffer<ArrayBufferLike>>, zod_v40.ZodObject<{
+  }, zod_v4_core0.$strip>]>>], null>, zod_v40.ZodUnion<readonly [zod_v40.ZodString, zod_v40.ZodCustom<Buffer<ArrayBufferLike>, Buffer<ArrayBufferLike>>, zod_v40.ZodObject<{
     type: zod_v40.ZodString;
   }, zod_v4_core0.$loose>, zod_v40.ZodObject<{
     key: zod_v40.ZodUnion<readonly [zod_v40.ZodString, zod_v40.ZodCustom<Buffer<ArrayBufferLike>, Buffer<ArrayBufferLike>>]>;
     passphrase: zod_v40.ZodString;
-  }, zod_v4_core0.$strip>]>>]>>>;
+  }, zod_v4_core0.$strip>]>>>;
 }, zod_v4_core0.$strip>, true>;
 /**
  * Service for signing, verifying, and decoding JSON Web Tokens (JWTs).
@@ -688,7 +678,6 @@ declare class JwtService {
    * @param payload - The payload to sign. Can be a string, Buffer, or object.
    * @param options - Signing options. When payload is a string, only `secret` and `privateKey` are allowed.
    * @returns The signed JWT token as a string
-   * @throws {Error} If `secretOrKeyProvider` returns a Promise (use `signAsync` instead)
    * @throws {Error} If payload is a string and invalid options are provided
    *
    * @example
@@ -715,8 +704,7 @@ declare class JwtService {
   /**
    * Signs a JWT payload asynchronously.
    *
-   * Use this method when `secretOrKeyProvider` returns a Promise or when you need
-   * to handle async key resolution. Supports the same payload types and options as `sign()`.
+   * Supports the same payload types and options as `sign()`.
    *
    * @param payload - The payload to sign. Can be a string, Buffer, or object.
    * @param options - Signing options. When payload is a string, only `secret` and `privateKey` are allowed.
@@ -725,7 +713,6 @@ declare class JwtService {
    *
    * @example
    * ```ts
-   * // Sign with async key provider
    * const token = await jwtService.signAsync(
    *   { userId: '123' },
    *   { expiresIn: '1h' }
@@ -754,7 +741,6 @@ declare class JwtService {
    * @throws {TokenExpiredError} If the token has expired
    * @throws {NotBeforeError} If the token is not yet valid (nbf claim)
    * @throws {JsonWebTokenError} If the token is invalid or malformed
-   * @throws {Error} If `secretOrKeyProvider` returns a Promise (use `verifyAsync` instead)
    *
    * @example
    * ```ts
@@ -772,8 +758,7 @@ declare class JwtService {
   /**
    * Verifies and decodes a JWT token asynchronously.
    *
-   * Use this method when `secretOrKeyProvider` returns a Promise or when you need
-   * to handle async key resolution. Provides the same validation as `verify()`.
+   * Provides the same validation as `verify()`.
    *
    * @template T - The expected type of the decoded payload
    * @param token - The JWT token string to verify
@@ -818,6 +803,8 @@ declare class JwtService {
    * ```
    */
   decode<T = any>(token: string, options?: jwt.DecodeOptions): T;
+  private prepareSign;
+  private prepareVerify;
   private mergeJwtOptions;
   private getSecretKey;
 }

package/lib/index.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.cts","names":[],"sources":["../src/options/jwt-service.options.mts","../src/jwt.service.mts","../src/jwt-service.provider.mts","../src/index.mts"],"sourcesContent":[],"mappings":";;;;;;;;;;;;;;AAUY,aAAA,WAAA;EAYC;EAqBA,IAAA,GAAA,MAAA;;;;;;;;;cArBA,eAAa,CAAA,CAAA;;;;;;;;;;;;;;;;;;;;cAqBb,iBAAe,CAAA,CAAA;EAAA,GAAA,YAAA,CAAA,UAAA,CAAA;IAAA,KAAA,EAAA,OAAA;IAkBhB,KAAA,EAAA,OAAS;IAQR,KAAA,EAAA,OAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;KARD,SAAA,GAAY,CAAA,CAAE,aAAa;;;;;;;cAQ1B,mBAAiB,CAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAAA,IAAA,EAAA,MAAA;IAAA,CAAA,CAAA,aAAA,CAAA,CAAA;IA4BlB,GAAA,eAAW,YAAkB,CAAA;IAQ5B,GAAA,eAoBX,YAAA,CAAA;;;;;;;;;;;;;;;;;;KA5BU,WAAA,GAAc,CAAA,CAAE,aAAa;;;;;;;cAQ5B,qBAAmB,CAAA,CAAA;;;;;;;;;;;;;;;;;;;EAAA,QAAA,eAAA,aAAA,CAAA;EAAA,MAAA,eAAA,WAAA,CAAA,SAAA,YAAA,YAAA,YAAA,CAAA,CAAA,CAAA,CAAA;EA2BpB,gBAAa,eAAkB,aAAA,CAAA;EAO9B,eAYX,eAAA,aAAA,CAAA;EAZuB,KAAA,eAAA,YAAA,CAAA;EAAA,KAAA,eAAA,YAAA,CAAA;EAAA,OAAA,eAAA,YAAA,CAAA;EAAA,MAAA,eAAA,WAAA,CAAA,SAAA,YAAA,aAAA,CAAA,CAAA,CAAA;EAAA,8BAAA,eAAA,aAAA,CAAA;CAAA,eAAA,CAAA;;;;;;KAPb,aAAA,GAAgB,CAAA,CAAE,aAAa;;;;;;cAO9B,cAAY,CAAA,CAAA,mBAAA,CAAA,CAAA,WAAA,CAAA,CAAA,UAAA,OAAA,kBAAA,OAAA,mBAAA,CAAA,CAAA;;CAAA,eAAA,CAAA,aAAA,CAAA;EAAA,GAAA,YAAA,CAAA,SAAA,YAAA,aAAA,OAAA,gBAAA,CAAA,QAAA,gBAAA,CAAA,CAAA,CAAA,CAAA;EAmBb,UAAM,aAAkB;AAEpC,CAAA,eAAa,CAAA,CAAA,CAAA;;;;;;KAFD,MAAA,GAAS,CAAA,CAAE,aAAa;cAEvB,yBAAuB,CAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA0CxB,iBAAA,GAAoB,CAAA,CAAE,aAAa;;;;;;;;;;UAW9B,cAAA,SAAuB;;oBAEpB;;eAEL;;;;;;;;;;;UAYE,gBAAA,SAAyB;;oBAEtB;;uBAEG;;;;;;;KAQX,kBAAA,YAA8B,SAAS;;;;;;;AAvOnD;AAYa,cCCA,eDDa,ECCE,cDDF,CAAA,OAAA,UCCE,SDDF,CAAA;EAqBb,WAAA,qBAWX,kBAAA,CAAA;mCC5BD,OAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QDiB2B,KAAA,EAAA,OAAA;QAAA,KAAA,EAAA,OAAA;QAkBP,KAAA,EAAA,OAAkB;QAQ1B,KAAA,EAAA,OAqBX;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MArB4B,IAAA,EAAA,MAAA;IAAA,CAAA,CAAA,CAAA;IA4BlB,KAAA,qBAA6B,mBAAR;IAQpB,SAAA,qBAoBX,iBAAA,CAAA,SAAA,sCAAA,CAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MApB8B,KAAA,EAAA,OAAA;MAAA,KAAA,EAAA,OAAA;MA2BpB,KAAA,EAAA,OAAa;MAOZ,KAAA,EAYX,OAAA;MAZuB,KAAA,EAAA,OAAA;MAAA,KAAA,EAAA,OAAA;MAAA,KAAA,EAAA,OAAA;MAAA,IAAA,EAAA,MAAA;IAAA,CAAA,CAAA,CAAA,CAAA;IAAA,QAAA,qBAAA,iBAAA,CAAA,SAAA,qCAAA,OAAA,QAAA,CAAA,kBAAA,iBAAA,CAAA,SAAA,qCAAA,OAAA,QAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA;;;IAAA,QAAA,qBAAA,oBAAA;;;;;;;;;;;EAAA,CAAA,sBAAA,mBAAA,CAAA;IAAA,GAAA,kBAAA,CAAA,SAAA,qCAAA,OAAA,gBAAA,CAAA,QAAA,gBAAA,CAAA,CAAA,CAAA,CAAA;IAmBb,UAAM,mBAAK;EAEV,CAAA,sBAgBX,CAAA,CAAA,oBAAA,iBAAA,CAAA,SAAA,qCAAA,OAAA,gBAAA,CAAA,QAAA,gBAAA,CAAA,CAAA,mBAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cCrHW,UAAA;;UAAU,aAAA,CACf;;;;;;wBASgC;;;;;;;;;;;;;;;;;;;;;;;;;kCA4B1B,KAAK,sBAAsB;;;;;;;;gBASzB,2BAA2B;;;;;;;;;;;;;;;;;;;;;uCA6D7B,KAAK,sBAAsB,GAAA,CAAI,eACxC;;;;;;;;qBAQgB,2BAA2B,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;0DAoEpD,mBACR;;;;;;;;;;;;;;;;;;;;;;;;;;;+DAiDQ,mBACR,QAAQ;;;;;;;;;;;;;;;;;;;;;;2CA2C8B,GAAA,CAAI,gBAAgB;;;;;;;;;;ADxU/D;AAYA;AAqBA;;;;;;;;;;;;;;;;;;iBEVgB,iBAAA,SACN,oBACP,oBAAoB,mBAAmB;;;;;;;;;;;;;;AF0B1C;AAQA;;;;;;;;;;;;iBEPgB,iBAAA,eACA,QAAQ,qBACrB,sBAAsB,mBAAmB;;;;;;;AFtD5C;AAYA;AAqBA;;;;;;;;;;;cGpBa,0BAAiB,GAAA,CAAA;;;;;;;;;;;;;;;;;;cAmBjB,uBAAc,GAAA,CAAA;;;AHmB3B;AAQA;;;;;;;;;;;;;;cGRa,0BAAiB,GAAA,CAAA"}
+{"version":3,"file":"index.d.cts","names":[],"sources":["../src/options/jwt-service.options.mts","../src/jwt.service.mts","../src/jwt-service.provider.mts","../src/index.mts"],"sourcesContent":[],"mappings":";;;;;;;;;;;;;;AAUY,aAAA,WAAA;EAYC;EAqBA,IAAA,GAAA,MAAA;;;;;;;;;cArBA,eAAa,CAAA,CAAA;;;;;;;;;;;;;;;;;;;;cAqBb,iBAAe,CAAA,CAAA;EAAA,GAAA,YAAA,CAAA,UAAA,CAAA;IAAA,KAAA,EAAA,OAAA;IAkBhB,KAAA,EAAA,OAAS;IAQR,KAAA,EAAA,OAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;KARD,SAAA,GAAY,CAAA,CAAE,aAAa;;;;;;;cAQ1B,mBAAiB,CAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAAA,IAAA,EAAA,MAAA;IAAA,CAAA,CAAA,aAAA,CAAA,CAAA;IA4BlB,GAAA,eAAW,YAAkB,CAAA;IAQ5B,GAAA,eAoBX,YAAA,CAAA;;;;;;;;;;;;;;;;;;KA5BU,WAAA,GAAc,CAAA,CAAE,aAAa;;;;;;;cAQ5B,qBAAmB,CAAA,CAAA;;;;;;;;;;;;;;;;;;;EAAA,QAAA,eAAA,aAAA,CAAA;EAAA,MAAA,eAAA,WAAA,CAAA,SAAA,YAAA,YAAA,YAAA,CAAA,CAAA,CAAA,CAAA;EA2BpB,gBAAa,eAAkB,aAAA,CAAA;EAO9B,eAYX,eAAA,aAAA,CAAA;EAZuB,KAAA,eAAA,YAAA,CAAA;EAAA,KAAA,eAAA,YAAA,CAAA;EAAA,OAAA,eAAA,YAAA,CAAA;EAAA,MAAA,eAAA,WAAA,CAAA,SAAA,YAAA,aAAA,CAAA,CAAA,CAAA;EAAA,8BAAA,eAAA,aAAA,CAAA;CAAA,eAAA,CAAA;;;;;;KAPb,aAAA,GAAgB,CAAA,CAAE,aAAa;;;;;;cAO9B,cAAY,CAAA,CAAA,mBAAA,CAAA,CAAA,WAAA,CAAA,CAAA,UAAA,OAAA,kBAAA,OAAA,mBAAA,CAAA,CAAA;;CAAA,eAAA,CAAA,aAAA,CAAA;EAAA,GAAA,YAAA,CAAA,SAAA,YAAA,aAAA,OAAA,gBAAA,CAAA,QAAA,gBAAA,CAAA,CAAA,CAAA,CAAA;EAmBb,UAAM,aAAkB;AAEpC,CAAA,eAAa,CAAA,CAAA,CAAA;;;;;;KAFD,MAAA,GAAS,CAAA,CAAE,aAAa;cAEvB,yBAAuB,CAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA0CxB,iBAAA,GAAoB,CAAA,CAAE,aAAa;;;;;;;;;;UAW9B,cAAA,SAAuB;;oBAEpB;;eAEL;;;;;;;;;;;UAYE,gBAAA,SAAyB;;oBAEtB;;uBAEG;;;;;;;KAQX,kBAAA,YAA8B,SAAS;;;;;;;AAvOnD;AAYa,cCCA,eDDa,ECCE,cDDF,CAAA,OAAA,UCCE,SDDF,CAAA;EAqBb,WAAA,qBAWX,kBAAA,CAAA;mCC5BD,OAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QDiB2B,KAAA,EAAA,OAAA;QAAA,KAAA,EAAA,OAAA;QAkBP,KAAA,EAAA,OAAkB;QAQ1B,KAAA,EAAA,OAqBX;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MArB4B,IAAA,EAAA,MAAA;IAAA,CAAA,CAAA,CAAA;IA4BlB,KAAA,qBAA6B,mBAAR;IAQpB,SAAA,qBAoBX,iBAAA,CAAA,SAAA,sCAAA,CAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MApB8B,KAAA,EAAA,OAAA;MAAA,KAAA,EAAA,OAAA;MA2BpB,KAAA,EAAA,OAAa;MAOZ,KAAA,EAYX,OAAA;MAZuB,KAAA,EAAA,OAAA;MAAA,KAAA,EAAA,OAAA;MAAA,KAAA,EAAA,OAAA;MAAA,IAAA,EAAA,MAAA;IAAA,CAAA,CAAA,CAAA,CAAA;IAAA,QAAA,qBAAA,iBAAA,CAAA,SAAA,qCAAA,OAAA,QAAA,CAAA,kBAAA,iBAAA,CAAA,SAAA,qCAAA,OAAA,QAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA;;;IAAA,QAAA,qBAAA,oBAAA;;;;;;;;;;;EAAA,CAAA,sBAAA,mBAAA,CAAA;IAAA,GAAA,kBAAA,CAAA,SAAA,qCAAA,OAAA,gBAAA,CAAA,QAAA,gBAAA,CAAA,CAAA,CAAA,CAAA;IAmBb,UAAM,mBAAK;EAEV,CAAA,sBAgBX,CAAA,CAAA,CAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cCrHW,UAAA;;UAAU,aAAA,CACf;;;;;;wBASgC;;;;;;;;;;;;;;;;;;;;;;;;kCA2B1B,KAAK,sBAAsB;;;;;;;;gBASzB,2BAA2B;;;;;;;;;;;;;;;;;;;uCA6B7B,KAAK,sBAAsB,GAAA,CAAI,eACxC;;;;;;;;qBAQgB,2BAA2B,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;0DAyCpD,mBACR;;;;;;;;;;;;;;;;;;;;;;;;;;+DAiCQ,mBACR,QAAQ;;;;;;;;;;;;;;;;;;;;;;2CA+B8B,GAAA,CAAI,gBAAgB;;;;;;;;;;;;ADhP/D;AAYA;AAqBA;;;;;;;;;;;;;;;;;;iBEVgB,iBAAA,SACN,oBACP,oBAAoB,mBAAmB;;;;;;;;;;;;;;AF0B1C;AAQA;;;;;;;;;;;;iBEPgB,iBAAA,eACA,QAAQ,qBACrB,sBAAsB,mBAAmB;;;;;;;AFtD5C;AAYA;AAqBA;;;;;;;;;;;cGpBa,0BAAiB,GAAA,CAAA;;;;;;;;;;;;;;;;;;cAmBjB,uBAAc,GAAA,CAAA;;;AHmB3B;AAQA;;;;;;;;;;;;;;cGRa,0BAAiB,GAAA,CAAA"}

package/lib/index.d.mts

@@ -375,17 +375,12 @@ declare const JwtServiceOptionsSchema: z.ZodObject<{
     subject: z.ZodOptional<z.ZodString>;
     maxAge: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
     allowInvalidAsymmetricKeyTypes: z.ZodOptional<z.ZodBoolean>;
-  }, z.core.$strip>]>>], null>, z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodString, z.ZodCustom<Buffer<ArrayBufferLike>, Buffer<ArrayBufferLike>>, z.ZodObject<{
+  }, z.core.$strip>]>>], null>, z.ZodUnion<readonly [z.ZodString, z.ZodCustom<Buffer<ArrayBufferLike>, Buffer<ArrayBufferLike>>, z.ZodObject<{
     type: z.ZodString;
   }, z.core.$loose>, z.ZodObject<{
     key: z.ZodUnion<readonly [z.ZodString, z.ZodCustom<Buffer<ArrayBufferLike>, Buffer<ArrayBufferLike>>]>;
     passphrase: z.ZodString;
-  }, z.core.$strip>]>, z.ZodPromise<z.ZodUnion<readonly [z.ZodString, z.ZodCustom<Buffer<ArrayBufferLike>, Buffer<ArrayBufferLike>>, z.ZodObject<{
-    type: z.ZodString;
-  }, z.core.$loose>, z.ZodObject<{
-    key: z.ZodUnion<readonly [z.ZodString, z.ZodCustom<Buffer<ArrayBufferLike>, Buffer<ArrayBufferLike>>]>;
-    passphrase: z.ZodString;
-  }, z.core.$strip>]>>]>>>;
+  }, z.core.$strip>]>>>;
 }, z.core.$strip>;
 /**
  * Configuration options for the JWT service.
@@ -630,17 +625,12 @@ declare const JwtServiceToken: InjectionToken<unknown, zod_v40.ZodObject<{
     subject: zod_v40.ZodOptional<zod_v40.ZodString>;
     maxAge: zod_v40.ZodOptional<zod_v40.ZodUnion<readonly [zod_v40.ZodString, zod_v40.ZodNumber]>>;
     allowInvalidAsymmetricKeyTypes: zod_v40.ZodOptional<zod_v40.ZodBoolean>;
-  }, zod_v4_core0.$strip>]>>], null>, zod_v40.ZodUnion<readonly [zod_v40.ZodUnion<readonly [zod_v40.ZodString, zod_v40.ZodCustom<Buffer<ArrayBufferLike>, Buffer<ArrayBufferLike>>, zod_v40.ZodObject<{
-    type: zod_v40.ZodString;
-  }, zod_v4_core0.$loose>, zod_v40.ZodObject<{
-    key: zod_v40.ZodUnion<readonly [zod_v40.ZodString, zod_v40.ZodCustom<Buffer<ArrayBufferLike>, Buffer<ArrayBufferLike>>]>;
-    passphrase: zod_v40.ZodString;
-  }, zod_v4_core0.$strip>]>, zod_v40.ZodPromise<zod_v40.ZodUnion<readonly [zod_v40.ZodString, zod_v40.ZodCustom<Buffer<ArrayBufferLike>, Buffer<ArrayBufferLike>>, zod_v40.ZodObject<{
+  }, zod_v4_core0.$strip>]>>], null>, zod_v40.ZodUnion<readonly [zod_v40.ZodString, zod_v40.ZodCustom<Buffer<ArrayBufferLike>, Buffer<ArrayBufferLike>>, zod_v40.ZodObject<{
     type: zod_v40.ZodString;
   }, zod_v4_core0.$loose>, zod_v40.ZodObject<{
     key: zod_v40.ZodUnion<readonly [zod_v40.ZodString, zod_v40.ZodCustom<Buffer<ArrayBufferLike>, Buffer<ArrayBufferLike>>]>;
     passphrase: zod_v40.ZodString;
-  }, zod_v4_core0.$strip>]>>]>>>;
+  }, zod_v4_core0.$strip>]>>>;
 }, zod_v4_core0.$strip>, true>;
 /**
  * Service for signing, verifying, and decoding JSON Web Tokens (JWTs).
@@ -688,7 +678,6 @@ declare class JwtService {
    * @param payload - The payload to sign. Can be a string, Buffer, or object.
    * @param options - Signing options. When payload is a string, only `secret` and `privateKey` are allowed.
    * @returns The signed JWT token as a string
-   * @throws {Error} If `secretOrKeyProvider` returns a Promise (use `signAsync` instead)
    * @throws {Error} If payload is a string and invalid options are provided
    *
    * @example
@@ -715,8 +704,7 @@ declare class JwtService {
   /**
    * Signs a JWT payload asynchronously.
    *
-   * Use this method when `secretOrKeyProvider` returns a Promise or when you need
-   * to handle async key resolution. Supports the same payload types and options as `sign()`.
+   * Supports the same payload types and options as `sign()`.
    *
    * @param payload - The payload to sign. Can be a string, Buffer, or object.
    * @param options - Signing options. When payload is a string, only `secret` and `privateKey` are allowed.
@@ -725,7 +713,6 @@ declare class JwtService {
    *
    * @example
    * ```ts
-   * // Sign with async key provider
    * const token = await jwtService.signAsync(
    *   { userId: '123' },
    *   { expiresIn: '1h' }
@@ -754,7 +741,6 @@ declare class JwtService {
    * @throws {TokenExpiredError} If the token has expired
    * @throws {NotBeforeError} If the token is not yet valid (nbf claim)
    * @throws {JsonWebTokenError} If the token is invalid or malformed
-   * @throws {Error} If `secretOrKeyProvider` returns a Promise (use `verifyAsync` instead)
    *
    * @example
    * ```ts
@@ -772,8 +758,7 @@ declare class JwtService {
   /**
    * Verifies and decodes a JWT token asynchronously.
    *
-   * Use this method when `secretOrKeyProvider` returns a Promise or when you need
-   * to handle async key resolution. Provides the same validation as `verify()`.
+   * Provides the same validation as `verify()`.
    *
    * @template T - The expected type of the decoded payload
    * @param token - The JWT token string to verify
@@ -818,6 +803,8 @@ declare class JwtService {
    * ```
    */
   decode<T = any>(token: string, options?: jwt.DecodeOptions): T;
+  private prepareSign;
+  private prepareVerify;
   private mergeJwtOptions;
   private getSecretKey;
 }

package/lib/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/options/jwt-service.options.mts","../src/jwt.service.mts","../src/jwt-service.provider.mts","../src/index.mts"],"sourcesContent":[],"mappings":";;;;;;;;;;;;;;AAUY,aAAA,WAAA;EAYC;EAqBA,IAAA,GAAA,MAAA;;;;;;;;;cArBA,eAAa,CAAA,CAAA;;;;;;;;;;;;;;;;;;;;cAqBb,iBAAe,CAAA,CAAA;EAAA,GAAA,YAAA,CAAA,UAAA,CAAA;IAAA,KAAA,EAAA,OAAA;IAkBhB,KAAA,EAAA,OAAS;IAQR,KAAA,EAAA,OAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;KARD,SAAA,GAAY,CAAA,CAAE,aAAa;;;;;;;cAQ1B,mBAAiB,CAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAAA,IAAA,EAAA,MAAA;IAAA,CAAA,CAAA,aAAA,CAAA,CAAA;IA4BlB,GAAA,eAAW,YAAkB,CAAA;IAQ5B,GAAA,eAoBX,YAAA,CAAA;;;;;;;;;;;;;;;;;;KA5BU,WAAA,GAAc,CAAA,CAAE,aAAa;;;;;;;cAQ5B,qBAAmB,CAAA,CAAA;;;;;;;;;;;;;;;;;;;EAAA,QAAA,eAAA,aAAA,CAAA;EAAA,MAAA,eAAA,WAAA,CAAA,SAAA,YAAA,YAAA,YAAA,CAAA,CAAA,CAAA,CAAA;EA2BpB,gBAAa,eAAkB,aAAA,CAAA;EAO9B,eAYX,eAAA,aAAA,CAAA;EAZuB,KAAA,eAAA,YAAA,CAAA;EAAA,KAAA,eAAA,YAAA,CAAA;EAAA,OAAA,eAAA,YAAA,CAAA;EAAA,MAAA,eAAA,WAAA,CAAA,SAAA,YAAA,aAAA,CAAA,CAAA,CAAA;EAAA,8BAAA,eAAA,aAAA,CAAA;CAAA,eAAA,CAAA;;;;;;KAPb,aAAA,GAAgB,CAAA,CAAE,aAAa;;;;;;cAO9B,cAAY,CAAA,CAAA,mBAAA,CAAA,CAAA,WAAA,CAAA,CAAA,UAAA,OAAA,kBAAA,OAAA,mBAAA,CAAA,CAAA;;CAAA,eAAA,CAAA,aAAA,CAAA;EAAA,GAAA,YAAA,CAAA,SAAA,YAAA,aAAA,OAAA,gBAAA,CAAA,QAAA,gBAAA,CAAA,CAAA,CAAA,CAAA;EAmBb,UAAM,aAAkB;AAEpC,CAAA,eAAa,CAAA,CAAA,CAAA;;;;;;KAFD,MAAA,GAAS,CAAA,CAAE,aAAa;cAEvB,yBAAuB,CAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA0CxB,iBAAA,GAAoB,CAAA,CAAE,aAAa;;;;;;;;;;UAW9B,cAAA,SAAuB;;oBAEpB;;eAEL;;;;;;;;;;;UAYE,gBAAA,SAAyB;;oBAEtB;;uBAEG;;;;;;;KAQX,kBAAA,YAA8B,SAAS;;;;;;;AAvOnD;AAYa,cCCA,eDDa,ECCE,cDDF,CAAA,OAAA,UCCE,SDDF,CAAA;EAqBb,WAAA,qBAWX,kBAAA,CAAA;mCC5BD,OAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QDiB2B,KAAA,EAAA,OAAA;QAAA,KAAA,EAAA,OAAA;QAkBP,KAAA,EAAA,OAAkB;QAQ1B,KAAA,EAAA,OAqBX;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MArB4B,IAAA,EAAA,MAAA;IAAA,CAAA,CAAA,CAAA;IA4BlB,KAAA,qBAA6B,mBAAR;IAQpB,SAAA,qBAoBX,iBAAA,CAAA,SAAA,sCAAA,CAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MApB8B,KAAA,EAAA,OAAA;MAAA,KAAA,EAAA,OAAA;MA2BpB,KAAA,EAAA,OAAa;MAOZ,KAAA,EAYX,OAAA;MAZuB,KAAA,EAAA,OAAA;MAAA,KAAA,EAAA,OAAA;MAAA,KAAA,EAAA,OAAA;MAAA,IAAA,EAAA,MAAA;IAAA,CAAA,CAAA,CAAA,CAAA;IAAA,QAAA,qBAAA,iBAAA,CAAA,SAAA,qCAAA,OAAA,QAAA,CAAA,kBAAA,iBAAA,CAAA,SAAA,qCAAA,OAAA,QAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA;;;IAAA,QAAA,qBAAA,oBAAA;;;;;;;;;;;EAAA,CAAA,sBAAA,mBAAA,CAAA;IAAA,GAAA,kBAAA,CAAA,SAAA,qCAAA,OAAA,gBAAA,CAAA,QAAA,gBAAA,CAAA,CAAA,CAAA,CAAA;IAmBb,UAAM,mBAAK;EAEV,CAAA,sBAgBX,CAAA,CAAA,oBAAA,iBAAA,CAAA,SAAA,qCAAA,OAAA,gBAAA,CAAA,QAAA,gBAAA,CAAA,CAAA,mBAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cCrHW,UAAA;;UAAU,aAAA,CACf;;;;;;wBASgC;;;;;;;;;;;;;;;;;;;;;;;;;kCA4B1B,KAAK,sBAAsB;;;;;;;;gBASzB,2BAA2B;;;;;;;;;;;;;;;;;;;;;uCA6D7B,KAAK,sBAAsB,GAAA,CAAI,eACxC;;;;;;;;qBAQgB,2BAA2B,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;0DAoEpD,mBACR;;;;;;;;;;;;;;;;;;;;;;;;;;;+DAiDQ,mBACR,QAAQ;;;;;;;;;;;;;;;;;;;;;;2CA2C8B,GAAA,CAAI,gBAAgB;;;;;;;;;;ADxU/D;AAYA;AAqBA;;;;;;;;;;;;;;;;;;iBEVgB,iBAAA,SACN,oBACP,oBAAoB,mBAAmB;;;;;;;;;;;;;;AF0B1C;AAQA;;;;;;;;;;;;iBEPgB,iBAAA,eACA,QAAQ,qBACrB,sBAAsB,mBAAmB;;;;;;;AFtD5C;AAYA;AAqBA;;;;;;;;;;;cGpBa,0BAAiB,GAAA,CAAA;;;;;;;;;;;;;;;;;;cAmBjB,uBAAc,GAAA,CAAA;;;AHmB3B;AAQA;;;;;;;;;;;;;;cGRa,0BAAiB,GAAA,CAAA"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/options/jwt-service.options.mts","../src/jwt.service.mts","../src/jwt-service.provider.mts","../src/index.mts"],"sourcesContent":[],"mappings":";;;;;;;;;;;;;;AAUY,aAAA,WAAA;EAYC;EAqBA,IAAA,GAAA,MAAA;;;;;;;;;cArBA,eAAa,CAAA,CAAA;;;;;;;;;;;;;;;;;;;;cAqBb,iBAAe,CAAA,CAAA;EAAA,GAAA,YAAA,CAAA,UAAA,CAAA;IAAA,KAAA,EAAA,OAAA;IAkBhB,KAAA,EAAA,OAAS;IAQR,KAAA,EAAA,OAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;KARD,SAAA,GAAY,CAAA,CAAE,aAAa;;;;;;;cAQ1B,mBAAiB,CAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAAA,IAAA,EAAA,MAAA;IAAA,CAAA,CAAA,aAAA,CAAA,CAAA;IA4BlB,GAAA,eAAW,YAAkB,CAAA;IAQ5B,GAAA,eAoBX,YAAA,CAAA;;;;;;;;;;;;;;;;;;KA5BU,WAAA,GAAc,CAAA,CAAE,aAAa;;;;;;;cAQ5B,qBAAmB,CAAA,CAAA;;;;;;;;;;;;;;;;;;;EAAA,QAAA,eAAA,aAAA,CAAA;EAAA,MAAA,eAAA,WAAA,CAAA,SAAA,YAAA,YAAA,YAAA,CAAA,CAAA,CAAA,CAAA;EA2BpB,gBAAa,eAAkB,aAAA,CAAA;EAO9B,eAYX,eAAA,aAAA,CAAA;EAZuB,KAAA,eAAA,YAAA,CAAA;EAAA,KAAA,eAAA,YAAA,CAAA;EAAA,OAAA,eAAA,YAAA,CAAA;EAAA,MAAA,eAAA,WAAA,CAAA,SAAA,YAAA,aAAA,CAAA,CAAA,CAAA;EAAA,8BAAA,eAAA,aAAA,CAAA;CAAA,eAAA,CAAA;;;;;;KAPb,aAAA,GAAgB,CAAA,CAAE,aAAa;;;;;;cAO9B,cAAY,CAAA,CAAA,mBAAA,CAAA,CAAA,WAAA,CAAA,CAAA,UAAA,OAAA,kBAAA,OAAA,mBAAA,CAAA,CAAA;;CAAA,eAAA,CAAA,aAAA,CAAA;EAAA,GAAA,YAAA,CAAA,SAAA,YAAA,aAAA,OAAA,gBAAA,CAAA,QAAA,gBAAA,CAAA,CAAA,CAAA,CAAA;EAmBb,UAAM,aAAkB;AAEpC,CAAA,eAAa,CAAA,CAAA,CAAA;;;;;;KAFD,MAAA,GAAS,CAAA,CAAE,aAAa;cAEvB,yBAAuB,CAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA0CxB,iBAAA,GAAoB,CAAA,CAAE,aAAa;;;;;;;;;;UAW9B,cAAA,SAAuB;;oBAEpB;;eAEL;;;;;;;;;;;UAYE,gBAAA,SAAyB;;oBAEtB;;uBAEG;;;;;;;KAQX,kBAAA,YAA8B,SAAS;;;;;;;AAvOnD;AAYa,cCCA,eDDa,ECCE,cDDF,CAAA,OAAA,UCCE,SDDF,CAAA;EAqBb,WAAA,qBAWX,kBAAA,CAAA;mCC5BD,OAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QDiB2B,KAAA,EAAA,OAAA;QAAA,KAAA,EAAA,OAAA;QAkBP,KAAA,EAAA,OAAkB;QAQ1B,KAAA,EAAA,OAqBX;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MArB4B,IAAA,EAAA,MAAA;IAAA,CAAA,CAAA,CAAA;IA4BlB,KAAA,qBAA6B,mBAAR;IAQpB,SAAA,qBAoBX,iBAAA,CAAA,SAAA,sCAAA,CAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MApB8B,KAAA,EAAA,OAAA;MAAA,KAAA,EAAA,OAAA;MA2BpB,KAAA,EAAA,OAAa;MAOZ,KAAA,EAYX,OAAA;MAZuB,KAAA,EAAA,OAAA;MAAA,KAAA,EAAA,OAAA;MAAA,KAAA,EAAA,OAAA;MAAA,IAAA,EAAA,MAAA;IAAA,CAAA,CAAA,CAAA,CAAA;IAAA,QAAA,qBAAA,iBAAA,CAAA,SAAA,qCAAA,OAAA,QAAA,CAAA,kBAAA,iBAAA,CAAA,SAAA,qCAAA,OAAA,QAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA;;;IAAA,QAAA,qBAAA,oBAAA;;;;;;;;;;;EAAA,CAAA,sBAAA,mBAAA,CAAA;IAAA,GAAA,kBAAA,CAAA,SAAA,qCAAA,OAAA,gBAAA,CAAA,QAAA,gBAAA,CAAA,CAAA,CAAA,CAAA;IAmBb,UAAM,mBAAK;EAEV,CAAA,sBAgBX,CAAA,CAAA,CAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cCrHW,UAAA;;UAAU,aAAA,CACf;;;;;;wBASgC;;;;;;;;;;;;;;;;;;;;;;;;kCA2B1B,KAAK,sBAAsB;;;;;;;;gBASzB,2BAA2B;;;;;;;;;;;;;;;;;;;uCA6B7B,KAAK,sBAAsB,GAAA,CAAI,eACxC;;;;;;;;qBAQgB,2BAA2B,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;0DAyCpD,mBACR;;;;;;;;;;;;;;;;;;;;;;;;;;+DAiCQ,mBACR,QAAQ;;;;;;;;;;;;;;;;;;;;;;2CA+B8B,GAAA,CAAI,gBAAgB;;;;;;;;;;;;ADhP/D;AAYA;AAqBA;;;;;;;;;;;;;;;;;;iBEVgB,iBAAA,SACN,oBACP,oBAAoB,mBAAmB;;;;;;;;;;;;;;AF0B1C;AAQA;;;;;;;;;;;;iBEPgB,iBAAA,eACA,QAAQ,qBACrB,sBAAsB,mBAAmB;;;;;;;AFtD5C;AAYA;AAqBA;;;;;;;;;;;cGpBa,0BAAiB,GAAA,CAAA;;;;;;;;;;;;;;;;;;cAmBjB,uBAAc,GAAA,CAAA;;;AHmB3B;AAQA;;;;;;;;;;;;;;cGRa,0BAAiB,GAAA,CAAA"}

package/lib/index.mjs

@@ -122,7 +122,7 @@ const JwtServiceOptionsSchema = z.object({
 			z.any(),
 			z.union([SignOptionsSchema, VerifyOptionsSchema]).optional()
 		],
-		output: z.union([SecretSchema, z.promise(SecretSchema)])
+		output: SecretSchema
 	}).optional()
 });
 
@@ -427,27 +427,14 @@ var JwtService = class {
 	}
 	logger = inject(Logger, { context: _JwtService.name });
 	sign(payload, options = {}) {
-		const signOptions = this.mergeJwtOptions({ ...options }, "signOptions");
-		const secret = this.getSecretKey(payload, options, "privateKey", RequestType.Sign);
-		if (secret instanceof Promise) {
-			secret.catch(() => {});
-			this.logger.warn("For async version of \"secretOrKeyProvider\", please use \"signAsync\".");
-			throw new Error();
-		}
-		const allowedSignOptKeys = ["secret", "privateKey"];
-		const signOptKeys = Object.keys(signOptions);
-		if (typeof payload === "string" && signOptKeys.some((k) => !allowedSignOptKeys.includes(k))) throw new Error("Payload as string is not allowed with the following sign options: " + signOptKeys.join(", "));
+		const { signOptions, secret } = this.prepareSign(payload, options);
 		return jwt.sign(payload, secret, signOptions);
 	}
 	signAsync(payload, options = {}) {
-		const signOptions = this.mergeJwtOptions({ ...options }, "signOptions");
-		const secret = this.getSecretKey(payload, options, "privateKey", RequestType.Sign);
-		const allowedSignOptKeys = ["secret", "privateKey"];
-		const signOptKeys = Object.keys(signOptions);
-		if (typeof payload === "string" && signOptKeys.some((k) => !allowedSignOptKeys.includes(k))) throw new Error("Payload as string is not allowed with the following sign options: " + signOptKeys.join(", "));
-		return new Promise((resolve, reject) => Promise.resolve().then(() => secret).then((scrt) => {
-			jwt.sign(payload, scrt, signOptions, (err, encoded) => err ? reject(err) : resolve(encoded));
-		}));
+		const { signOptions, secret } = this.prepareSign(payload, options);
+		return new Promise((resolve, reject) => {
+			jwt.sign(payload, secret, signOptions, (err, encoded) => err ? reject(err) : resolve(encoded));
+		});
 	}
 	/**
 	* Verifies and decodes a JWT token synchronously.
@@ -462,7 +449,6 @@ var JwtService = class {
 	* @throws {TokenExpiredError} If the token has expired
 	* @throws {NotBeforeError} If the token is not yet valid (nbf claim)
 	* @throws {JsonWebTokenError} If the token is invalid or malformed
-	* @throws {Error} If `secretOrKeyProvider` returns a Promise (use `verifyAsync` instead)
 	*
 	* @example
 	* ```ts
@@ -476,20 +462,13 @@ var JwtService = class {
 	* }
 	* ```
 	*/ verify(token, options = {}) {
-		const verifyOptions = this.mergeJwtOptions({ ...options }, "verifyOptions");
-		const secret = this.getSecretKey(token, options, "publicKey", RequestType.Verify);
-		if (secret instanceof Promise) {
-			secret.catch(() => {});
-			this.logger.warn("For async version of \"secretOrKeyProvider\", please use \"verifyAsync\".");
-			throw new Error();
-		}
+		const { verifyOptions, secret } = this.prepareVerify(token, options);
 		return jwt.verify(token, secret, verifyOptions);
 	}
 	/**
 	* Verifies and decodes a JWT token asynchronously.
 	*
-	* Use this method when `secretOrKeyProvider` returns a Promise or when you need
-	* to handle async key resolution. Provides the same validation as `verify()`.
+	* Provides the same validation as `verify()`.
 	*
 	* @template T - The expected type of the decoded payload
 	* @param token - The JWT token string to verify
@@ -511,11 +490,10 @@ var JwtService = class {
 	* }
 	* ```
 	*/ verifyAsync(token, options = {}) {
-		const verifyOptions = this.mergeJwtOptions({ ...options }, "verifyOptions");
-		const secret = this.getSecretKey(token, options, "publicKey", RequestType.Verify);
-		return new Promise((resolve, reject) => Promise.resolve().then(() => secret).then((scrt) => {
-			jwt.verify(token, scrt, verifyOptions, (err, decoded) => err ? reject(err) : resolve(decoded));
-		}).catch(reject));
+		const { verifyOptions, secret } = this.prepareVerify(token, options);
+		return new Promise((resolve, reject) => {
+			jwt.verify(token, secret, verifyOptions, (err, decoded) => err ? reject(err) : resolve(decoded));
+		});
 	}
 	/**
 	* Decodes a JWT token without verification.
@@ -540,6 +518,23 @@ var JwtService = class {
 	*/ decode(token, options) {
 		return jwt.decode(token, options);
 	}
+	prepareSign(payload, options) {
+		const signOptions = this.mergeJwtOptions({ ...options }, "signOptions");
+		const secret = this.getSecretKey(payload, options, "privateKey", RequestType.Sign);
+		const allowedSignOptKeys = ["secret", "privateKey"];
+		const signOptKeys = Object.keys(signOptions);
+		if (typeof payload === "string" && signOptKeys.some((k) => !allowedSignOptKeys.includes(k))) throw new Error("Payload as string is not allowed with the following sign options: " + signOptKeys.join(", "));
+		return {
+			signOptions,
+			secret
+		};
+	}
+	prepareVerify(token, options) {
+		return {
+			verifyOptions: this.mergeJwtOptions({ ...options }, "verifyOptions"),
+			secret: this.getSecretKey(token, options, "publicKey", RequestType.Verify)
+		};
+	}
 	mergeJwtOptions(options, key) {
 		delete options.secret;
 		if (key === "signOptions") delete options.privateKey;