ts-packages 2.0.0 → 3.0.0

package/packages/security/dist/types/core/jwt/jwtManager.d.ts

@@ -1,5 +1,5 @@
 import { type JwtPayload, type Secret } from 'jsonwebtoken';
-import type { AccessToken, ITokenManager, JWTConfig, RefreshToken, TokenPair, TokenValidationOptions } from '../../interfaces/jwt.interface';
+import type { AccessToken, ITokenManager, JWTConfig, RefreshToken, TokenPair } from '../../interfaces/jwt.interface';
 export declare class JWTManager implements ITokenManager {
     private accessSecret;
     private refreshSecret;
@@ -8,60 +8,36 @@ export declare class JWTManager implements ITokenManager {
     private cache?;
     private cacheTTL;
     constructor(config: JWTConfig);
-    /**
-     * Generate both access and refresh tokens
-     */
+    /** Generate both access and refresh tokens */
     generateTokens(payload: Record<string, unknown>): Promise<TokenPair>;
-    /**
-     * Generate access token
-     */
+    /** Generate access token */
     generateAccessToken(payload: Record<string, unknown>): Promise<AccessToken>;
-    /**
-     * Generate refresh token
-     */
+    /** Generate refresh token */
     generateRefreshToken(payload: Record<string, unknown>): Promise<RefreshToken>;
-    /**
-     * Verify access token
-     */
-    verifyAccessToken(token: string): Promise<JwtPayload | string>;
-    /**
-     * Verify refresh token
-     */
-    verifyRefreshToken(token: string): Promise<JwtPayload | string>;
-    /**
-     * Decode token without verification
-     */
+    /** Verify access token */
+    verifyAccessToken(token: string): Promise<JwtPayload>;
+    /** Verify refresh token */
+    verifyRefreshToken(token: string): Promise<JwtPayload>;
+    /** Decode token without verification */
     decodeToken(token: string, complete?: boolean): JwtPayload | string | null;
-    /**
-     * Extract token from Authorization header
-     */
+    /** Extract token from Authorization header */
     extractTokenFromHeader(authHeader: string): string | null;
-    /**
-     * Validate token without throwing exceptions
-     */
-    validateToken(token: string, secret: Secret, _options?: TokenValidationOptions): boolean;
-    /**
-     * Rotate refresh token
-     */
+    /** Validate token without throwing exceptions */
+    validateToken(token: string, secret: Secret): boolean;
+    /** Rotate refresh token */
     rotateRefreshToken(oldToken: string): Promise<RefreshToken>;
-    /**
-     * Check if token is expired
-     */
+    /** Check if token is expired */
     isTokenExpired(token: string): boolean;
-    /**
-     * Get token expiration date
-     */
+    /** Get token expiration date */
     getTokenExpiration(token: string): Date | null;
-    /**
-     * Clear token cache
-     */
+    /** Clear token cache */
     clearCache(): void;
-    /**
-     * Get cache statistics
-     */
+    /** Get cache statistics */
     getCacheStats(): {
         size: number;
         maxSize: number;
     } | null;
+    /** Private helper methods */
     private validatePayload;
+    private verifyTokenWithCache;
 }

package/packages/security/dist/types/core/jwt/validateToken.d.ts

@@ -1,13 +1,16 @@
-import type { JwtPayload } from 'node_modules/@types/jsonwebtoken';
+import type { JwtPayload } from 'jsonwebtoken';
 export interface TokenRequirements {
     requiredFields?: string[];
     forbiddenFields?: string[];
     validateTypes?: Record<string, 'string' | 'number' | 'boolean'>;
 }
-export declare function validateTokenPayload(payload: Record<string, unknown>, rules?: TokenRequirements): {
-    valid: true;
-} | {
-    valid: false;
-    error: string;
-};
+/**
+ * Validates a JWT payload according to the provided rules.
+ * Throws ValidationError if validation fails.
+ */
+export declare function validateTokenPayload(payload: Record<string, unknown>, rules?: TokenRequirements): void;
+/**
+ * Checks if a JWT payload is expired.
+ * Returns true if expired or missing 'exp'.
+ */
 export declare function isTokenExpired(payload: JwtPayload): boolean;

package/packages/security/dist/types/core/jwt/verify.d.ts

@@ -1,19 +1,18 @@
-import type jwt from 'jsonwebtoken';
-import { type JwtPayload, type Secret } from 'jsonwebtoken';
+import { type JwtPayload, type Secret, type VerifyOptions } from 'jsonwebtoken';
 import type { VerificationResult } from './types';
 /**
- * Verify token (throws if invalid or expired)
+ * Verify token (throws UnauthorizedError if invalid or expired)
  */
 export declare const verifyToken: (token: string, secret: Secret) => string | JwtPayload;
 /**
- * Safe verify — never throws, returns structured result
+ * Verify token with options
  */
-export declare const safeVerifyToken: (token: string, secret: Secret) => VerificationResult;
+export declare const verifyTokenWithOptions: (token: string, secret: Secret, options?: VerifyOptions) => string | JwtPayload;
 /**
- * Verify token with validation options
+ * Safe verify — never throws, returns structured result with UnauthorizedError on failure
  */
-export declare const verifyTokenWithOptions: (token: string, secret: Secret, options?: jwt.VerifyOptions) => string | JwtPayload;
+export declare const safeVerifyToken: (token: string, secret: Secret) => VerificationResult;
 /**
- * Safe verify with validation options
+ * Safe verify with options — never throws, returns structured result with UnauthorizedError on failure
  */
-export declare const safeVerifyTokenWithOptions: (token: string, secret: Secret, options?: jwt.VerifyOptions) => VerificationResult;
+export declare const safeVerifyTokenWithOptions: (token: string, secret: Secret, options?: VerifyOptions) => VerificationResult;

package/packages/security/dist/types/core/password/passwordManager.d.ts

@@ -23,7 +23,7 @@ export declare class PasswordManager implements IPasswordManager {
      */
     checkStrength(password: string): PasswordStrength;
     /**
-     * Check if password hash needs upgrade (different salt rounds)
+     * Check if password hash needs upgrade (saltRounds change)
      */
     needsUpgrade(_hash: string, _currentConfig: PasswordConfig): boolean;
 }

package/packages/security/dist/types/core/password/utils.d.ts

@@ -1,4 +1,16 @@
+/**
+ * Ensure password is a valid non-empty string
+ */
 export declare function ensureValidPassword(password: string): void;
+/**
+ * Timing-safe comparison between two strings
+ */
 export declare function safeCompare(a: string, b: string): boolean;
+/**
+ * Estimate password entropy based on character pool
+ */
 export declare function estimatePasswordEntropy(password: string): number;
+/**
+ * Normalize password string to a consistent form
+ */
 export declare function normalizePassword(password: string): string;

package/packages/security/dist/types/index.d.ts

@@ -21,16 +21,11 @@ declare const _default: {
     generateTokens: (payload: Record<string, unknown>, accessSecret: import("node_modules/@types/jsonwebtoken").Secret, refreshSecret: import("node_modules/@types/jsonwebtoken").Secret, accessExpiry?: string | number, refreshExpiry?: string | number) => JWTUtils.TokenPair;
     parseDuration(input: string | number): number;
     signToken: (payload: Record<string, unknown>, secret: import("node_modules/@types/jsonwebtoken").Secret, expiresIn?: string | number, options?: import("node_modules/@types/jsonwebtoken").SignOptions) => string;
-    validateTokenPayload(payload: Record<string, unknown>, rules?: JWTUtils.TokenRequirements): {
-        valid: true;
-    } | {
-        valid: false;
-        error: string;
-    };
+    validateTokenPayload(payload: Record<string, unknown>, rules?: JWTUtils.TokenRequirements): void;
     isTokenExpired(payload: import("node_modules/@types/jsonwebtoken").JwtPayload): boolean;
     verifyToken: (token: string, secret: import("node_modules/@types/jsonwebtoken").Secret) => string | import("node_modules/@types/jsonwebtoken").JwtPayload;
-    safeVerifyToken: (token: string, secret: import("node_modules/@types/jsonwebtoken").Secret) => JWTUtils.VerificationResult;
     verifyTokenWithOptions: (token: string, secret: import("node_modules/@types/jsonwebtoken").Secret, options?: import("node_modules/@types/jsonwebtoken").VerifyOptions) => string | import("node_modules/@types/jsonwebtoken").JwtPayload;
+    safeVerifyToken: (token: string, secret: import("node_modules/@types/jsonwebtoken").Secret) => JWTUtils.VerificationResult;
     safeVerifyTokenWithOptions: (token: string, secret: import("node_modules/@types/jsonwebtoken").Secret, options?: import("node_modules/@types/jsonwebtoken").VerifyOptions) => JWTUtils.VerificationResult;
     hashPasswordWithPepper(password: string, pepper: string): Promise<string>;
     hashPasswordWithPepperSync(password: string, pepper: string): string;

package/packages/security/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@naman_deep_singh/security",
-  "version": "1.3.3",
+  "version": "1.5.1",
   "description": "Security utilities for password hashing and JWT token management with TypeScript",
   "type": "module",
   "main": "./dist/cjs/index.js",
@@ -35,8 +35,8 @@
   "license": "ISC",
   "packageManager": "pnpm@10.20.0",
   "dependencies": {
-    "@naman_deep_singh/errors-utils": "^1.1.1",
-    "@naman_deep_singh/js-extensions": "^1.3.2",
+    "@naman_deep_singh/errors-utils": "^1.4.2",
+    "@naman_deep_singh/js-extensions": "^1.4.0",
     "bcryptjs": "^3.0.3",
     "jsonwebtoken": "^9.0.2"
   },

package/packages/security/src/core/crypto/cryptoManager.ts

@@ -1,3 +1,4 @@
+import { CryptoIntegrityError } from '@naman_deep_singh/errors-utils'
 import {
 	decrypt as functionalDecrypt,
 	encrypt as functionalEncrypt,
@@ -61,9 +62,16 @@ export class CryptoManager {
 			iv?: string
 		},
 	): string {
-		// For now, use the basic encrypt function
-		// TODO: Enhance to support different algorithms and options
-		return functionalEncrypt(plaintext, key)
+		try {
+			return functionalEncrypt(plaintext, key)
+		} catch (error) {
+			throw new CryptoIntegrityError(
+				{
+					reason: 'Encryption failed',
+				},
+				error instanceof Error ? error : undefined,
+			)
+		}
 	}
 
 	/**
@@ -78,9 +86,16 @@ export class CryptoManager {
 			iv?: string
 		},
 	): string {
-		// For now, use the basic decrypt function
-		// TODO: Enhance to support different algorithms and options
-		return functionalDecrypt(encryptedData, key)
+		try {
+			return functionalDecrypt(encryptedData, key)
+		} catch (error) {
+			throw new CryptoIntegrityError(
+				{
+					reason: 'Decryption failed',
+				},
+				error instanceof Error ? error : undefined,
+			)
+		}
 	}
 
 	/**
@@ -144,9 +159,16 @@ export class CryptoManager {
 				iterations,
 				keyLength,
 				'sha256',
-				(err: Error, derivedKey: Buffer) => {
-					if (err) {
-						reject(err)
+				(error: Error | null, derivedKey: Buffer) => {
+					if (error) {
+						reject(
+							new CryptoIntegrityError(
+								{
+									reason: 'Key derivation failed',
+								},
+								error instanceof Error ? error : undefined,
+							),
+						)
 					} else {
 						resolve(derivedKey.toString('hex'))
 					}
@@ -237,16 +259,21 @@ export class CryptoManager {
 	): Promise<string> {
 		return new Promise((resolve, reject) => {
 			const crypto = require('crypto')
-
-			const sign = crypto.createSign(algorithm)
-			sign.update(data)
-			sign.end()
-
 			try {
+				const sign = crypto.createSign(algorithm)
+				sign.update(data)
+				sign.end()
 				const signature = sign.sign(privateKey, 'base64')
 				resolve(signature)
 			} catch (error) {
-				reject(error)
+				reject(
+					new CryptoIntegrityError(
+						{
+							reason: 'RSA signing failed',
+						},
+						error instanceof Error ? error : undefined,
+					),
+				)
 			}
 		})
 	}
@@ -262,16 +289,21 @@ export class CryptoManager {
 	): Promise<boolean> {
 		return new Promise((resolve, reject) => {
 			const crypto = require('crypto')
-
-			const verify = crypto.createVerify(algorithm)
-			verify.update(data)
-			verify.end()
-
 			try {
+				const verify = crypto.createVerify(algorithm)
+				verify.update(data)
+				verify.end()
 				const isValid = verify.verify(publicKey, signature, 'base64')
 				resolve(isValid)
 			} catch (error) {
-				reject(error)
+				reject(
+					new CryptoIntegrityError(
+						{
+							reason: 'RSA verification failed',
+						},
+						error instanceof Error ? error : undefined,
+					),
+				)
 			}
 		})
 	}

package/packages/security/src/core/jwt/decode.ts

@@ -1,3 +1,4 @@
+import { BadRequestError } from '@naman_deep_singh/errors-utils'
 // src/jwt/decodeToken.ts
 import { type JwtPayload, decode } from 'jsonwebtoken'
 
@@ -18,7 +19,9 @@ export function decodeTokenStrict(token: string): JwtPayload {
 	const decoded = decode(token)
 
 	if (!decoded || typeof decoded === 'string') {
-		throw new Error('Invalid JWT payload structure')
+		throw new BadRequestError({
+			reason: 'Invalid JWT payload structure',
+		})
 	}
 
 	return decoded

package/packages/security/src/core/jwt/generateTokens.ts

@@ -1,3 +1,4 @@
+import { TokenMalformedError } from '@naman_deep_singh/errors-utils'
 import type { JwtPayload, Secret } from 'jsonwebtoken'
 import { signToken } from './signToken'
 import type { AccessToken, RefreshToken, TokenPair } from './types'
@@ -35,7 +36,9 @@ export function rotateRefreshToken(
 	const decoded = verifyToken(oldToken, secret)
 
 	if (typeof decoded === 'string') {
-		throw new Error('Invalid token payload — expected JWT payload object')
+		throw new TokenMalformedError({
+			reason: 'Invalid token payload — expected JWT payload object',
+		})
 	}
 
 	const payload: JwtPayload = { ...decoded }