@xlt-token/jwt 2.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 xltorg
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/index.cjs

@@ -0,0 +1,111 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+let node_crypto = require("node:crypto");
+let jsonwebtoken = require("jsonwebtoken");
+
+//#region src/jwt-config.ts
+const supportedAlgorithms = new Set([
+	"HS256",
+	"HS384",
+	"HS512",
+	"RS256",
+	"RS384",
+	"RS512",
+	"ES256",
+	"ES384",
+	"ES512"
+]);
+function createJwtStrategyConfig(input) {
+	if (!input.activeKid) throw new Error("JWT activeKid is required");
+	if (!input.keys.length) throw new Error("JWT keys must not be empty");
+	const keys = /* @__PURE__ */ new Map();
+	for (const keyInput of input.keys) {
+		const key = normalizeJwtKey(keyInput);
+		if (keys.has(key.kid)) throw new Error(`JWT key kid "${key.kid}" is duplicated`);
+		keys.set(key.kid, key);
+	}
+	const activeKey = keys.get(input.activeKid);
+	if (!activeKey) throw new Error(`JWT activeKid "${input.activeKid}" does not match any configured key`);
+	return {
+		activeKid: input.activeKid,
+		activeKey,
+		keys,
+		issuer: input.issuer,
+		audience: input.audience
+	};
+}
+function normalizeJwtKey(input) {
+	if (!input.kid) throw new Error("JWT key kid is required");
+	if (!supportedAlgorithms.has(input.algorithm)) throw new Error(`JWT algorithm "${input.algorithm}" is not supported`);
+	const signingKey = input.signingKey ?? input.secret;
+	const verificationKey = input.verificationKey ?? input.secret ?? input.signingKey;
+	if (!signingKey || !verificationKey) throw new Error(`JWT key "${input.kid}" requires signing and verification keys`);
+	if (input.algorithm.startsWith("HS")) assertStrongHmacSecret(input.kid, signingKey);
+	return {
+		kid: input.kid,
+		algorithm: input.algorithm,
+		signingKey,
+		verificationKey
+	};
+}
+function assertStrongHmacSecret(kid, secret) {
+	if ((typeof secret === "string" ? Buffer.byteLength(secret) : Buffer.isBuffer(secret) ? secret.byteLength : 0) < 32) throw new Error(`JWT key "${kid}" uses a weak HMAC secret; use at least 32 bytes`);
+}
+
+//#endregion
+//#region src/jwt-strategy.ts
+var JwtStrategy = class {
+	constructor(jwtConfig) {
+		this.jwtConfig = jwtConfig;
+		this.kind = "jwt";
+	}
+	createToken(loginId, config, options) {
+		const jti = (0, node_crypto.randomUUID)();
+		const expiresIn = resolveExpiresIn(options?.timeout ?? config.timeout);
+		return this.signPayload({
+			sub: loginId,
+			jti
+		}, expiresIn);
+	}
+	generateToken(payload) {
+		return this.signPayload(payload);
+	}
+	verifyToken(token) {
+		const decoded = (0, jsonwebtoken.decode)(token, { complete: true });
+		if (!decoded || typeof decoded === "string") throw new Error("JWT token is malformed");
+		const { kid, alg } = decoded.header;
+		if (!kid) throw new Error("JWT token header is missing kid");
+		const key = this.jwtConfig.keys.get(kid);
+		if (!key) throw new Error(`JWT key "${kid}" is not configured`);
+		if (alg !== key.algorithm) throw new Error(`JWT algorithm "${String(alg)}" does not match configured key algorithm`);
+		const payload = (0, jsonwebtoken.verify)(token, key.verificationKey, {
+			algorithms: [key.algorithm],
+			...this.jwtConfig.issuer && { issuer: this.jwtConfig.issuer },
+			...this.jwtConfig.audience && { audience: this.jwtConfig.audience }
+		});
+		if (typeof payload === "string") throw new Error("JWT payload must be an object");
+		if (typeof payload.sub !== "string" || typeof payload.jti !== "string") throw new Error("JWT payload requires string sub and jti claims");
+		return payload;
+	}
+	signPayload(payload, expiresIn) {
+		const key = this.jwtConfig.activeKey;
+		const options = {
+			algorithm: key.algorithm,
+			keyid: key.kid,
+			...this.jwtConfig.issuer && { issuer: this.jwtConfig.issuer },
+			...this.jwtConfig.audience && { audience: this.jwtConfig.audience },
+			...expiresIn !== void 0 && { expiresIn }
+		};
+		return (0, jsonwebtoken.sign)(payload, signingKeyFor(key), options);
+	}
+};
+function resolveExpiresIn(timeout) {
+	if (typeof timeout === "number" && timeout <= 0) return;
+	return timeout;
+}
+function signingKeyFor(key) {
+	return key.signingKey;
+}
+
+//#endregion
+exports.JwtStrategy = JwtStrategy;
+exports.createJwtStrategyConfig = createJwtStrategyConfig;

package/dist/index.d.cts

@@ -0,0 +1,53 @@
+import { JwtPayload, Secret, SignOptions } from "jsonwebtoken";
+import { DurationInput, TokenStrategy, XltTokenConfig } from "@xlt-token/core";
+
+//#region src/jwt-config.d.ts
+type JwtAlgorithm = Extract<SignOptions["algorithm"], "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512">;
+interface JwtKeyInput {
+  kid: string;
+  algorithm: JwtAlgorithm;
+  secret?: Secret;
+  signingKey?: Secret;
+  verificationKey?: Secret;
+}
+interface JwtKey {
+  kid: string;
+  algorithm: JwtAlgorithm;
+  signingKey: Secret;
+  verificationKey: Secret;
+}
+type JwtAudience = string | [string, ...string[]];
+interface JwtStrategyConfigInput {
+  activeKid: string;
+  keys: JwtKeyInput[];
+  issuer?: string;
+  audience?: JwtAudience;
+}
+interface JwtStrategyConfig {
+  activeKid: string;
+  activeKey: JwtKey;
+  keys: ReadonlyMap<string, JwtKey>;
+  issuer?: string;
+  audience?: JwtAudience;
+}
+declare function createJwtStrategyConfig(input: JwtStrategyConfigInput): JwtStrategyConfig;
+//#endregion
+//#region src/jwt-strategy.d.ts
+type XltJwtPayload = JwtPayload & {
+  sub: string;
+  jti: string;
+};
+declare class JwtStrategy implements TokenStrategy<XltJwtPayload> {
+  private readonly jwtConfig;
+  readonly kind: "jwt";
+  constructor(jwtConfig: JwtStrategyConfig);
+  createToken(loginId: string, config: XltTokenConfig, options?: {
+    timeout?: DurationInput;
+  }): string;
+  generateToken(payload: XltJwtPayload): string;
+  verifyToken(token: string): XltJwtPayload;
+  private signPayload;
+}
+//#endregion
+export { type JwtAlgorithm, type JwtAudience, type JwtKey, type JwtKeyInput, JwtStrategy, type JwtStrategyConfig, type JwtStrategyConfigInput, type XltJwtPayload, createJwtStrategyConfig };
+//# sourceMappingURL=index.d.cts.map

package/dist/index.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.cts","names":[],"sources":["../src/jwt-config.ts","../src/jwt-strategy.ts"],"mappings":";;;;KAEY,YAAA,GAAe,OAAA,CACzB,WAAA;AAAA,UAIe,WAAA;EACf,GAAA;EACA,SAAA,EAAW,YAAA;EACX,MAAA,GAAS,MAAA;EACT,UAAA,GAAa,MAAA;EACb,eAAA,GAAkB,MAAA;AAAA;AAAA,UAGH,MAAA;EACf,GAAA;EACA,SAAA,EAAW,YAAA;EACX,UAAA,EAAY,MAAA;EACZ,eAAA,EAAiB,MAAA;AAAA;AAAA,KAGP,WAAA;AAAA,UAEK,sBAAA;EACf,SAAA;EACA,IAAA,EAAM,WAAA;EACN,MAAA;EACA,QAAA,GAAW,WAAA;AAAA;AAAA,UAGI,iBAAA;EACf,SAAA;EACA,SAAA,EAAW,MAAA;EACX,IAAA,EAAM,WAAA,SAAoB,MAAA;EAC1B,MAAA;EACA,QAAA,GAAW,WAAA;AAAA;AAAA,iBAeG,uBAAA,CAAwB,KAAA,EAAO,sBAAA,GAAyB,iBAAA;;;KC7C5D,aAAA,GAAgB,UAAA;EAAe,GAAA;EAAa,GAAA;AAAA;AAAA,cAE3C,WAAA,YAAuB,aAAA,CAAc,aAAA;EAAA,iBAGnB,SAAA;EAAA,SAFpB,IAAA;cAEoB,SAAA,EAAW,iBAAA;EAExC,WAAA,CACE,OAAA,UACA,MAAA,EAAQ,cAAA,EACR,OAAA;IAAY,OAAA,GAAU,aAAA;EAAA;EAcxB,aAAA,CAAc,OAAA,EAAS,aAAA;EAIvB,WAAA,CAAY,KAAA,WAAgB,aAAA;EAAA,QAkCpB,WAAA;AAAA"}

package/dist/index.d.mts

@@ -0,0 +1,53 @@
+import { JwtPayload, Secret, SignOptions } from "jsonwebtoken";
+import { DurationInput, TokenStrategy, XltTokenConfig } from "@xlt-token/core";
+
+//#region src/jwt-config.d.ts
+type JwtAlgorithm = Extract<SignOptions["algorithm"], "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512">;
+interface JwtKeyInput {
+  kid: string;
+  algorithm: JwtAlgorithm;
+  secret?: Secret;
+  signingKey?: Secret;
+  verificationKey?: Secret;
+}
+interface JwtKey {
+  kid: string;
+  algorithm: JwtAlgorithm;
+  signingKey: Secret;
+  verificationKey: Secret;
+}
+type JwtAudience = string | [string, ...string[]];
+interface JwtStrategyConfigInput {
+  activeKid: string;
+  keys: JwtKeyInput[];
+  issuer?: string;
+  audience?: JwtAudience;
+}
+interface JwtStrategyConfig {
+  activeKid: string;
+  activeKey: JwtKey;
+  keys: ReadonlyMap<string, JwtKey>;
+  issuer?: string;
+  audience?: JwtAudience;
+}
+declare function createJwtStrategyConfig(input: JwtStrategyConfigInput): JwtStrategyConfig;
+//#endregion
+//#region src/jwt-strategy.d.ts
+type XltJwtPayload = JwtPayload & {
+  sub: string;
+  jti: string;
+};
+declare class JwtStrategy implements TokenStrategy<XltJwtPayload> {
+  private readonly jwtConfig;
+  readonly kind: "jwt";
+  constructor(jwtConfig: JwtStrategyConfig);
+  createToken(loginId: string, config: XltTokenConfig, options?: {
+    timeout?: DurationInput;
+  }): string;
+  generateToken(payload: XltJwtPayload): string;
+  verifyToken(token: string): XltJwtPayload;
+  private signPayload;
+}
+//#endregion
+export { type JwtAlgorithm, type JwtAudience, type JwtKey, type JwtKeyInput, JwtStrategy, type JwtStrategyConfig, type JwtStrategyConfigInput, type XltJwtPayload, createJwtStrategyConfig };
+//# sourceMappingURL=index.d.mts.map

package/dist/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/jwt-config.ts","../src/jwt-strategy.ts"],"mappings":";;;;KAEY,YAAA,GAAe,OAAA,CACzB,WAAA;AAAA,UAIe,WAAA;EACf,GAAA;EACA,SAAA,EAAW,YAAA;EACX,MAAA,GAAS,MAAA;EACT,UAAA,GAAa,MAAA;EACb,eAAA,GAAkB,MAAA;AAAA;AAAA,UAGH,MAAA;EACf,GAAA;EACA,SAAA,EAAW,YAAA;EACX,UAAA,EAAY,MAAA;EACZ,eAAA,EAAiB,MAAA;AAAA;AAAA,KAGP,WAAA;AAAA,UAEK,sBAAA;EACf,SAAA;EACA,IAAA,EAAM,WAAA;EACN,MAAA;EACA,QAAA,GAAW,WAAA;AAAA;AAAA,UAGI,iBAAA;EACf,SAAA;EACA,SAAA,EAAW,MAAA;EACX,IAAA,EAAM,WAAA,SAAoB,MAAA;EAC1B,MAAA;EACA,QAAA,GAAW,WAAA;AAAA;AAAA,iBAeG,uBAAA,CAAwB,KAAA,EAAO,sBAAA,GAAyB,iBAAA;;;KC7C5D,aAAA,GAAgB,UAAA;EAAe,GAAA;EAAa,GAAA;AAAA;AAAA,cAE3C,WAAA,YAAuB,aAAA,CAAc,aAAA;EAAA,iBAGnB,SAAA;EAAA,SAFpB,IAAA;cAEoB,SAAA,EAAW,iBAAA;EAExC,WAAA,CACE,OAAA,UACA,MAAA,EAAQ,cAAA,EACR,OAAA;IAAY,OAAA,GAAU,aAAA;EAAA;EAcxB,aAAA,CAAc,OAAA,EAAS,aAAA;EAIvB,WAAA,CAAY,KAAA,WAAgB,aAAA;EAAA,QAkCpB,WAAA;AAAA"}

package/dist/index.mjs

@@ -0,0 +1,110 @@
+import { randomUUID } from "node:crypto";
+import { decode, sign, verify } from "jsonwebtoken";
+
+//#region src/jwt-config.ts
+const supportedAlgorithms = new Set([
+	"HS256",
+	"HS384",
+	"HS512",
+	"RS256",
+	"RS384",
+	"RS512",
+	"ES256",
+	"ES384",
+	"ES512"
+]);
+function createJwtStrategyConfig(input) {
+	if (!input.activeKid) throw new Error("JWT activeKid is required");
+	if (!input.keys.length) throw new Error("JWT keys must not be empty");
+	const keys = /* @__PURE__ */ new Map();
+	for (const keyInput of input.keys) {
+		const key = normalizeJwtKey(keyInput);
+		if (keys.has(key.kid)) throw new Error(`JWT key kid "${key.kid}" is duplicated`);
+		keys.set(key.kid, key);
+	}
+	const activeKey = keys.get(input.activeKid);
+	if (!activeKey) throw new Error(`JWT activeKid "${input.activeKid}" does not match any configured key`);
+	return {
+		activeKid: input.activeKid,
+		activeKey,
+		keys,
+		issuer: input.issuer,
+		audience: input.audience
+	};
+}
+function normalizeJwtKey(input) {
+	if (!input.kid) throw new Error("JWT key kid is required");
+	if (!supportedAlgorithms.has(input.algorithm)) throw new Error(`JWT algorithm "${input.algorithm}" is not supported`);
+	const signingKey = input.signingKey ?? input.secret;
+	const verificationKey = input.verificationKey ?? input.secret ?? input.signingKey;
+	if (!signingKey || !verificationKey) throw new Error(`JWT key "${input.kid}" requires signing and verification keys`);
+	if (input.algorithm.startsWith("HS")) assertStrongHmacSecret(input.kid, signingKey);
+	return {
+		kid: input.kid,
+		algorithm: input.algorithm,
+		signingKey,
+		verificationKey
+	};
+}
+function assertStrongHmacSecret(kid, secret) {
+	if ((typeof secret === "string" ? Buffer.byteLength(secret) : Buffer.isBuffer(secret) ? secret.byteLength : 0) < 32) throw new Error(`JWT key "${kid}" uses a weak HMAC secret; use at least 32 bytes`);
+}
+
+//#endregion
+//#region src/jwt-strategy.ts
+var JwtStrategy = class {
+	constructor(jwtConfig) {
+		this.jwtConfig = jwtConfig;
+		this.kind = "jwt";
+	}
+	createToken(loginId, config, options) {
+		const jti = randomUUID();
+		const expiresIn = resolveExpiresIn(options?.timeout ?? config.timeout);
+		return this.signPayload({
+			sub: loginId,
+			jti
+		}, expiresIn);
+	}
+	generateToken(payload) {
+		return this.signPayload(payload);
+	}
+	verifyToken(token) {
+		const decoded = decode(token, { complete: true });
+		if (!decoded || typeof decoded === "string") throw new Error("JWT token is malformed");
+		const { kid, alg } = decoded.header;
+		if (!kid) throw new Error("JWT token header is missing kid");
+		const key = this.jwtConfig.keys.get(kid);
+		if (!key) throw new Error(`JWT key "${kid}" is not configured`);
+		if (alg !== key.algorithm) throw new Error(`JWT algorithm "${String(alg)}" does not match configured key algorithm`);
+		const payload = verify(token, key.verificationKey, {
+			algorithms: [key.algorithm],
+			...this.jwtConfig.issuer && { issuer: this.jwtConfig.issuer },
+			...this.jwtConfig.audience && { audience: this.jwtConfig.audience }
+		});
+		if (typeof payload === "string") throw new Error("JWT payload must be an object");
+		if (typeof payload.sub !== "string" || typeof payload.jti !== "string") throw new Error("JWT payload requires string sub and jti claims");
+		return payload;
+	}
+	signPayload(payload, expiresIn) {
+		const key = this.jwtConfig.activeKey;
+		const options = {
+			algorithm: key.algorithm,
+			keyid: key.kid,
+			...this.jwtConfig.issuer && { issuer: this.jwtConfig.issuer },
+			...this.jwtConfig.audience && { audience: this.jwtConfig.audience },
+			...expiresIn !== void 0 && { expiresIn }
+		};
+		return sign(payload, signingKeyFor(key), options);
+	}
+};
+function resolveExpiresIn(timeout) {
+	if (typeof timeout === "number" && timeout <= 0) return;
+	return timeout;
+}
+function signingKeyFor(key) {
+	return key.signingKey;
+}
+
+//#endregion
+export { JwtStrategy, createJwtStrategyConfig };
+//# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../src/jwt-config.ts","../src/jwt-strategy.ts"],"sourcesContent":["import type { Secret, SignOptions } from \"jsonwebtoken\";\n\nexport type JwtAlgorithm = Extract<\n  SignOptions[\"algorithm\"],\n  \"HS256\" | \"HS384\" | \"HS512\" | \"RS256\" | \"RS384\" | \"RS512\" | \"ES256\" | \"ES384\" | \"ES512\"\n>;\n\nexport interface JwtKeyInput {\n  kid: string;\n  algorithm: JwtAlgorithm;\n  secret?: Secret;\n  signingKey?: Secret;\n  verificationKey?: Secret;\n}\n\nexport interface JwtKey {\n  kid: string;\n  algorithm: JwtAlgorithm;\n  signingKey: Secret;\n  verificationKey: Secret;\n}\n\nexport type JwtAudience = string | [string, ...string[]];\n\nexport interface JwtStrategyConfigInput {\n  activeKid: string;\n  keys: JwtKeyInput[];\n  issuer?: string;\n  audience?: JwtAudience;\n}\n\nexport interface JwtStrategyConfig {\n  activeKid: string;\n  activeKey: JwtKey;\n  keys: ReadonlyMap<string, JwtKey>;\n  issuer?: string;\n  audience?: JwtAudience;\n}\n\nconst supportedAlgorithms = new Set<JwtAlgorithm>([\n  \"HS256\",\n  \"HS384\",\n  \"HS512\",\n  \"RS256\",\n  \"RS384\",\n  \"RS512\",\n  \"ES256\",\n  \"ES384\",\n  \"ES512\",\n]);\n\nexport function createJwtStrategyConfig(input: JwtStrategyConfigInput): JwtStrategyConfig {\n  if (!input.activeKid) {\n    throw new Error(\"JWT activeKid is required\");\n  }\n  if (!input.keys.length) {\n    throw new Error(\"JWT keys must not be empty\");\n  }\n\n  const keys = new Map<string, JwtKey>();\n  for (const keyInput of input.keys) {\n    const key = normalizeJwtKey(keyInput);\n    if (keys.has(key.kid)) {\n      throw new Error(`JWT key kid \"${key.kid}\" is duplicated`);\n    }\n    keys.set(key.kid, key);\n  }\n\n  const activeKey = keys.get(input.activeKid);\n  if (!activeKey) {\n    throw new Error(`JWT activeKid \"${input.activeKid}\" does not match any configured key`);\n  }\n\n  return {\n    activeKid: input.activeKid,\n    activeKey,\n    keys,\n    issuer: input.issuer,\n    audience: input.audience,\n  };\n}\n\nfunction normalizeJwtKey(input: JwtKeyInput): JwtKey {\n  if (!input.kid) {\n    throw new Error(\"JWT key kid is required\");\n  }\n  if (!supportedAlgorithms.has(input.algorithm)) {\n    throw new Error(`JWT algorithm \"${input.algorithm}\" is not supported`);\n  }\n\n  const signingKey = input.signingKey ?? input.secret;\n  const verificationKey = input.verificationKey ?? input.secret ?? input.signingKey;\n  if (!signingKey || !verificationKey) {\n    throw new Error(`JWT key \"${input.kid}\" requires signing and verification keys`);\n  }\n  if (input.algorithm.startsWith(\"HS\")) {\n    assertStrongHmacSecret(input.kid, signingKey);\n  }\n\n  return {\n    kid: input.kid,\n    algorithm: input.algorithm,\n    signingKey,\n    verificationKey,\n  };\n}\n\nfunction assertStrongHmacSecret(kid: string, secret: Secret): void {\n  const length =\n    typeof secret === \"string\"\n      ? Buffer.byteLength(secret)\n      : Buffer.isBuffer(secret)\n        ? secret.byteLength\n        : 0;\n\n  if (length < 32) {\n    throw new Error(`JWT key \"${kid}\" uses a weak HMAC secret; use at least 32 bytes`);\n  }\n}\n","import { randomUUID } from \"node:crypto\";\nimport { decode, sign, verify } from \"jsonwebtoken\";\nimport type { JwtPayload, SignOptions } from \"jsonwebtoken\";\nimport type { DurationInput, TokenStrategy, XltTokenConfig } from \"@xlt-token/core\";\nimport type { JwtKey, JwtStrategyConfig } from \"./jwt-config.js\";\n\nexport type XltJwtPayload = JwtPayload & { sub: string; jti: string };\n\nexport class JwtStrategy implements TokenStrategy<XltJwtPayload> {\n  readonly kind = \"jwt\" as const;\n\n  constructor(private readonly jwtConfig: JwtStrategyConfig) {}\n\n  createToken(\n    loginId: string,\n    config: XltTokenConfig,\n    options?: { timeout?: DurationInput },\n  ): string {\n    const jti = randomUUID();\n    const expiresIn = resolveExpiresIn(options?.timeout ?? config.timeout);\n\n    return this.signPayload(\n      {\n        sub: loginId,\n        jti,\n      },\n      expiresIn,\n    );\n  }\n\n  generateToken(payload: XltJwtPayload): string {\n    return this.signPayload(payload);\n  }\n\n  verifyToken(token: string): XltJwtPayload {\n    const decoded = decode(token, { complete: true });\n    if (!decoded || typeof decoded === \"string\") {\n      throw new Error(\"JWT token is malformed\");\n    }\n\n    const { kid, alg } = decoded.header;\n    if (!kid) {\n      throw new Error(\"JWT token header is missing kid\");\n    }\n\n    const key = this.jwtConfig.keys.get(kid);\n    if (!key) {\n      throw new Error(`JWT key \"${kid}\" is not configured`);\n    }\n    if (alg !== key.algorithm) {\n      throw new Error(`JWT algorithm \"${String(alg)}\" does not match configured key algorithm`);\n    }\n\n    const payload = verify(token, key.verificationKey, {\n      algorithms: [key.algorithm],\n      ...(this.jwtConfig.issuer && { issuer: this.jwtConfig.issuer }),\n      ...(this.jwtConfig.audience && { audience: this.jwtConfig.audience }),\n    });\n    if (typeof payload === \"string\") {\n      throw new Error(\"JWT payload must be an object\");\n    }\n    if (typeof payload.sub !== \"string\" || typeof payload.jti !== \"string\") {\n      throw new Error(\"JWT payload requires string sub and jti claims\");\n    }\n\n    return payload as XltJwtPayload;\n  }\n\n  private signPayload(payload: object, expiresIn?: DurationInput): string {\n    const key = this.jwtConfig.activeKey;\n    const options: SignOptions = {\n      algorithm: key.algorithm,\n      keyid: key.kid,\n      ...(this.jwtConfig.issuer && { issuer: this.jwtConfig.issuer }),\n      ...(this.jwtConfig.audience && { audience: this.jwtConfig.audience }),\n      ...(expiresIn !== undefined && { expiresIn }),\n    };\n\n    return sign(payload, signingKeyFor(key), options);\n  }\n}\n\nfunction resolveExpiresIn(timeout: DurationInput): DurationInput | undefined {\n  if (typeof timeout === \"number\" && timeout <= 0) {\n    return undefined;\n  }\n  return timeout;\n}\n\nfunction signingKeyFor(key: JwtKey) {\n  return key.signingKey;\n}\n"],"mappings":";;;;AAuCA,MAAM,sBAAsB,IAAI,IAAkB;CAChD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD,CAAC;AAEF,SAAgB,wBAAwB,OAAkD;AACxF,KAAI,CAAC,MAAM,UACT,OAAM,IAAI,MAAM,4BAA4B;AAE9C,KAAI,CAAC,MAAM,KAAK,OACd,OAAM,IAAI,MAAM,6BAA6B;CAG/C,MAAM,uBAAO,IAAI,KAAqB;AACtC,MAAK,MAAM,YAAY,MAAM,MAAM;EACjC,MAAM,MAAM,gBAAgB,SAAS;AACrC,MAAI,KAAK,IAAI,IAAI,IAAI,CACnB,OAAM,IAAI,MAAM,gBAAgB,IAAI,IAAI,iBAAiB;AAE3D,OAAK,IAAI,IAAI,KAAK,IAAI;;CAGxB,MAAM,YAAY,KAAK,IAAI,MAAM,UAAU;AAC3C,KAAI,CAAC,UACH,OAAM,IAAI,MAAM,kBAAkB,MAAM,UAAU,qCAAqC;AAGzF,QAAO;EACL,WAAW,MAAM;EACjB;EACA;EACA,QAAQ,MAAM;EACd,UAAU,MAAM;EACjB;;AAGH,SAAS,gBAAgB,OAA4B;AACnD,KAAI,CAAC,MAAM,IACT,OAAM,IAAI,MAAM,0BAA0B;AAE5C,KAAI,CAAC,oBAAoB,IAAI,MAAM,UAAU,CAC3C,OAAM,IAAI,MAAM,kBAAkB,MAAM,UAAU,oBAAoB;CAGxE,MAAM,aAAa,MAAM,cAAc,MAAM;CAC7C,MAAM,kBAAkB,MAAM,mBAAmB,MAAM,UAAU,MAAM;AACvE,KAAI,CAAC,cAAc,CAAC,gBAClB,OAAM,IAAI,MAAM,YAAY,MAAM,IAAI,0CAA0C;AAElF,KAAI,MAAM,UAAU,WAAW,KAAK,CAClC,wBAAuB,MAAM,KAAK,WAAW;AAG/C,QAAO;EACL,KAAK,MAAM;EACX,WAAW,MAAM;EACjB;EACA;EACD;;AAGH,SAAS,uBAAuB,KAAa,QAAsB;AAQjE,MANE,OAAO,WAAW,WACd,OAAO,WAAW,OAAO,GACzB,OAAO,SAAS,OAAO,GACrB,OAAO,aACP,KAEK,GACX,OAAM,IAAI,MAAM,YAAY,IAAI,kDAAkD;;;;;AC5GtF,IAAa,cAAb,MAAiE;CAG/D,YAAY,AAAiB,WAA8B;EAA9B;cAFb;;CAIhB,YACE,SACA,QACA,SACQ;EACR,MAAM,MAAM,YAAY;EACxB,MAAM,YAAY,iBAAiB,SAAS,WAAW,OAAO,QAAQ;AAEtE,SAAO,KAAK,YACV;GACE,KAAK;GACL;GACD,EACD,UACD;;CAGH,cAAc,SAAgC;AAC5C,SAAO,KAAK,YAAY,QAAQ;;CAGlC,YAAY,OAA8B;EACxC,MAAM,UAAU,OAAO,OAAO,EAAE,UAAU,MAAM,CAAC;AACjD,MAAI,CAAC,WAAW,OAAO,YAAY,SACjC,OAAM,IAAI,MAAM,yBAAyB;EAG3C,MAAM,EAAE,KAAK,QAAQ,QAAQ;AAC7B,MAAI,CAAC,IACH,OAAM,IAAI,MAAM,kCAAkC;EAGpD,MAAM,MAAM,KAAK,UAAU,KAAK,IAAI,IAAI;AACxC,MAAI,CAAC,IACH,OAAM,IAAI,MAAM,YAAY,IAAI,qBAAqB;AAEvD,MAAI,QAAQ,IAAI,UACd,OAAM,IAAI,MAAM,kBAAkB,OAAO,IAAI,CAAC,2CAA2C;EAG3F,MAAM,UAAU,OAAO,OAAO,IAAI,iBAAiB;GACjD,YAAY,CAAC,IAAI,UAAU;GAC3B,GAAI,KAAK,UAAU,UAAU,EAAE,QAAQ,KAAK,UAAU,QAAQ;GAC9D,GAAI,KAAK,UAAU,YAAY,EAAE,UAAU,KAAK,UAAU,UAAU;GACrE,CAAC;AACF,MAAI,OAAO,YAAY,SACrB,OAAM,IAAI,MAAM,gCAAgC;AAElD,MAAI,OAAO,QAAQ,QAAQ,YAAY,OAAO,QAAQ,QAAQ,SAC5D,OAAM,IAAI,MAAM,iDAAiD;AAGnE,SAAO;;CAGT,AAAQ,YAAY,SAAiB,WAAmC;EACtE,MAAM,MAAM,KAAK,UAAU;EAC3B,MAAM,UAAuB;GAC3B,WAAW,IAAI;GACf,OAAO,IAAI;GACX,GAAI,KAAK,UAAU,UAAU,EAAE,QAAQ,KAAK,UAAU,QAAQ;GAC9D,GAAI,KAAK,UAAU,YAAY,EAAE,UAAU,KAAK,UAAU,UAAU;GACpE,GAAI,cAAc,UAAa,EAAE,WAAW;GAC7C;AAED,SAAO,KAAK,SAAS,cAAc,IAAI,EAAE,QAAQ;;;AAIrD,SAAS,iBAAiB,SAAmD;AAC3E,KAAI,OAAO,YAAY,YAAY,WAAW,EAC5C;AAEF,QAAO;;AAGT,SAAS,cAAc,KAAa;AAClC,QAAO,IAAI"}

package/package.json

@@ -0,0 +1,67 @@
+{
+  "name": "@xlt-token/jwt",
+  "version": "2.1.0",
+  "description": "JWT token strategy with key rotation for xlt-token",
+  "keywords": [
+    "auth",
+    "jwt",
+    "token",
+    "xlt-token"
+  ],
+  "homepage": "https://xiaolangtou.github.io/xlt-token/",
+  "bugs": {
+    "url": "https://github.com/xiaoLangtou/xlt-token/issues"
+  },
+  "license": "MIT",
+  "author": "xltorg",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/xiaoLangtou/xlt-token.git",
+    "directory": "packages/jwt"
+  },
+  "files": [
+    "dist",
+    "LICENSE",
+    "README.md"
+  ],
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.cts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.mts",
+        "default": "./dist/index.mjs"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    },
+    "./package.json": "./package.json"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@xlt-token/core": "^2.1.0",
+    "jsonwebtoken": "^9.0.3"
+  },
+  "devDependencies": {
+    "@types/jsonwebtoken": "^9.0.10",
+    "@types/node": "^20.0.0",
+    "@vitest/coverage-v8": "^2.1.9",
+    "tsdown": "^0.20.0",
+    "typescript": "^5.1.0",
+    "vitest": "^2.0.0"
+  },
+  "scripts": {
+    "build": "tsdown",
+    "build:watch": "tsdown --watch",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:cov": "vitest run --coverage"
+  }
+}