2.1.4

Think the installation command shouldn't use `-D` as it's used in the production code right, so installing as dev dep would be confusing, right?

Please correct me if I'm wrong 🙏

Also thanks a lot for this package, was just using for a way to sign and verify JWT in Pages ❤️

README.md

@@ -16,7 +16,7 @@ A lightweight JWT implementation with ZERO dependencies for Cloudflare Workers.
 ## Install
 
 ```
-npm i -D @tsndr/cloudflare-worker-jwt
+npm i @tsndr/cloudflare-worker-jwt
 ```
 
 
@@ -84,7 +84,7 @@ Signs a payload and returns the token.
 
 #### Arguments
 
-Argument    | Type     | Satus    | Default | Description
+Argument    | Type     | Status   | Default | Description
 ----------- | -------- | -------- | ------- | -----------
 `payload`   | `object` | required | -       | The payload object. To use `nbf` (Not Before) and/or `exp` (Expiration Time) add `nbf` and/or `exp` to the payload.
 `secret`    | `string` | required | -       | A string which is used to sign the payload.
@@ -100,7 +100,7 @@ Returns token as a `string`.
 
 Verifies the integrity of the token and returns a boolean value.
 
-Argument    | Type     | Satus    | Default | Description
+Argument    | Type     | Status   | Default | Description
 ----------- | -------- | -------- | ------- | -----------
 `token`     | `string` | required | -       | The token string generated by `jwt.sign()`.
 `secret`    | `string` | required | -       | The string which was used to sign the payload.
@@ -119,7 +119,7 @@ Returns `true` if signature, `nbf` (if set) and `exp` (if set) are valid, otherw
 
 Returns the payload **without** verifying the integrity of the token. Please use `jwt.verify()` first to keep your application secure!
 
-Argument    | Type     | Satus    | Default | Description
+Argument    | Type     | Status   | Default | Description
 ----------- | -------- | -------- | ------- | -----------
 `token`     | `string` | required | -       | The token string generated by `jwt.sign()`.
 
@@ -147,4 +147,4 @@ Returns an `object` containing `header` and `payload`:
  - HS512
  - RS256
  - RS384
- - RS512
+ - RS512

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@tsndr/cloudflare-worker-jwt",
-  "version": "2.1.1",
+  "version": "2.1.4",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "@tsndr/cloudflare-worker-jwt",
-      "version": "2.1.1",
+      "version": "2.1.4",
       "license": "MIT",
       "devDependencies": {
         "@cloudflare/workers-types": "^3.13.0",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tsndr/cloudflare-worker-jwt",
-  "version": "2.1.1",
+  "version": "2.1.4",
   "description": "A lightweight JWT implementation with ZERO dependencies for Cloudflare Worker",
   "main": "index.js",
   "types": "index.d.ts",

src/index.ts

@@ -21,7 +21,7 @@ export interface JwtAlgorithms {
 export interface JwtHeader {
     /**
      * Type (default: `"JWT"`)
-     * 
+     *
      * @default "JWT"
      */
     typ?: string
@@ -89,7 +89,7 @@ export interface JwtSignOptions extends JwtOptions {
 export interface JwtVerifyOptions extends JwtOptions {
     /**
      * If `true` throw error if checks fail. (default: `false`)
-     * 
+     *
      * @default false
     */
     throwError?: boolean
@@ -169,7 +169,7 @@ function _decodePayload(raw: string): JwtHeader | JwtPayload | null {
 
 /**
  * Signs a payload and returns the token
- * 
+ *
  * @param {JwtPayload} payload The payload object. To use `nbf` (Not Before) and/or `exp` (Expiration Time) add `nbf` and/or `exp` to the payload.
  * @param {string} secret A string which is used to sign the payload.
  * @param {JwtSignOptions | JwtAlgorithm | string} [options={ algorithm: 'HS256', header: { typ: 'JWT' } }] The options object or the algorithm.
@@ -196,7 +196,8 @@ export async function sign(payload: JwtPayload, secret: string, options: JwtSign
     if (!algorithm)
         throw new Error('algorithm not found')
 
-    payload.iat = Math.floor(Date.now() / 1000)
+    if (!payload.iat)
+        payload.iat = Math.floor(Date.now() / 1000)
 
     const payloadAsJSON = JSON.stringify(payload)
     const partialToken = `${base64UrlStringify(_utf8ToUint8Array(JSON.stringify({ ...options.header, alg: options.algorithm })))}.${base64UrlStringify(_utf8ToUint8Array(payloadAsJSON))}`
@@ -215,12 +216,12 @@ export async function sign(payload: JwtPayload, secret: string, options: JwtSign
 
 /**
  * Verifies the integrity of the token and returns a boolean value.
- * 
+ *
  * @param {string} token The token string generated by `jwt.sign()`.
  * @param {string} secret The string which was used to sign the payload.
  * @param {JWTVerifyOptions | JWTAlgorithm} options The options object or the algorithm.
  * @throws {Error | string} Throws an error `string` if the token is invalid or an `Error-Object` if there's a validation issue.
- * @returns {Promise<boolean>} Returns `true` if signature, `nbf` (if set) and `exp` (if set) are valid, otherwise returns `false`. 
+ * @returns {Promise<boolean>} Returns `true` if signature, `nbf` (if set) and `exp` (if set) are valid, otherwise returns `false`.
  */
 export async function verify(token: string, secret: string, options: JwtVerifyOptions | JwtAlgorithm = { algorithm: 'HS256', throwError: false }): Promise<boolean> {
     if (typeof options === 'string')
@@ -282,7 +283,7 @@ export async function verify(token: string, secret: string, options: JwtVerifyOp
 
 /**
  * Returns the payload **without** verifying the integrity of the token. Please use `jwt.verify()` first to keep your application secure!
- * 
+ *
  * @param {string} token The token string generated by `jwt.sign()`.
  * @returns {JwtData} Returns an `object` containing `header` and `payload`.
  */