Passport.js local and JWT strategies: verify callback argument consistency

The goal is to clarify whether the verify callback supplied to a Passport.js strategy must always receive three arguments (err, user, info) or may receive only two arguments (err, user) when the strategy does not generate an info object.

Current Passport documentation leaves this behavior unspecified, and individual strategies such as passport-local and passport-jwt exhibit different expectations, leading to potential mismatches when developers write a single verify function intended to work across multiple strategies.

Should Passport.js normalize the callback so that info is always present (possibly undefined) for all strategies? Or should each strategy be allowed to omit info and rely on the developer to handle a two‑argument signature? How can developers write a verify function that remains compatible with both passport-local and passport-jwt without conditional argument checks?