@aura-stack/jose 0.1.0 → 0.2.0

package/dist/index.cjs

@@ -44,65 +44,155 @@ __export(index_exports, {
 });
 module.exports = __toCommonJS(index_exports);
 
-// src/encrypt.ts
+// src/sign.ts
 var import_node_crypto = __toESM(require("crypto"), 1);
 var import_jose = require("jose");
 
+// src/errors.ts
+var AuraJoseError = class extends Error {
+  static code = "ERR_AURA_JOSE_ERROR";
+  code;
+  constructor(message, options) {
+    super(message, options);
+    this.name = new.target.name;
+    this.code = new.target.code;
+    Error.captureStackTrace(this, new.target);
+  }
+};
+var JWTEncodingError = class extends AuraJoseError {
+  static code = "ERR_JWT_ENCODING";
+};
+var JWTDecodingError = class extends AuraJoseError {
+  static code = "ERR_JWT_DECODING";
+};
+var InvalidPayloadError = class extends AuraJoseError {
+  static code = "ERR_INVALID_PAYLOAD";
+};
+var JWSVerificationError = class extends AuraJoseError {
+  static code = "ERR_JWS_VERIFICATION";
+};
+var JWSSigningError = class extends AuraJoseError {
+  static code = "ERR_JWS_SIGNING";
+};
+var JWEDecryptionError = class extends AuraJoseError {
+  static code = "ERR_JWE_DECRYPTION";
+};
+var JWEEncryptionError = class extends AuraJoseError {
+  static code = "ERR_JWE_ENCRYPTION";
+};
+var InvalidSecretError = class extends AuraJoseError {
+  static code = "ERR_INVALID_SECRET";
+};
+
+// src/assert.ts
+var isAuraJoseError = (error) => {
+  return error instanceof AuraJoseError;
+};
+var isFalsy = (value) => {
+  return value === null || value === void 0 || value === false || value === 0 || value === "" || Number.isNaN(value);
+};
+var isObject = (value) => {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+};
+var isInvalidPayload = (payload) => {
+  return isFalsy(payload) || !isObject(payload) || typeof payload === "object" && payload !== null && !Array.isArray(payload) && Object.keys(payload).length === 0;
+};
+
 // src/secret.ts
 var createSecret = (secret) => {
-  if (secret === void 0) throw new Error("Secret is required");
+  if (secret === void 0) throw new InvalidSecretError("Secret is required");
   if (typeof secret === "string") {
     if (new TextEncoder().encode(secret).byteLength < 32) {
-      throw new Error("Secret string must be at least 32 characters long");
+      throw new InvalidSecretError("Secret string must be at least 32 characters long");
     }
     return new Uint8Array(Buffer.from(secret, "utf-8"));
   }
   return secret;
 };
+var getSecrets = (secret) => {
+  const jwsSecret = isObject(secret) && "jws" in secret ? secret.jws : secret;
+  const jweSecret = isObject(secret) && "jwe" in secret ? secret.jwe : secret;
+  return {
+    jwsSecret,
+    jweSecret
+  };
+};
 
-// src/encrypt.ts
-var encryptJWE = async (payload, secret) => {
-  const secretKey = createSecret(secret);
-  const jti = import_node_crypto.default.randomBytes(32).toString("base64");
-  return new import_jose.EncryptJWT({ token: payload }).setProtectedHeader({ alg: "dir", enc: "A256GCM", typ: "JWT", cty: "JWT" }).setIssuedAt().setNotBefore("0s").setExpirationTime("15d").setJti(jti).encrypt(secretKey);
+// src/sign.ts
+var signJWS = async (payload, secret) => {
+  try {
+    if (isInvalidPayload(payload)) {
+      throw new InvalidPayloadError("The payload must be a non-empty object");
+    }
+    const secretKey = createSecret(secret);
+    const jti = import_node_crypto.default.randomBytes(32).toString("base64url");
+    return new import_jose.SignJWT(payload).setProtectedHeader({ alg: "HS256", typ: "JWT" }).setIssuedAt().setNotBefore(payload.nbf ?? "0s").setExpirationTime(payload.exp ?? "15d").setJti(jti).sign(secretKey);
+  } catch (error) {
+    if (isAuraJoseError(error)) {
+      throw error;
+    }
+    throw new JWSSigningError("JWS signing failed", { cause: error });
+  }
 };
-var decryptJWE = async (token, secret) => {
+var verifyJWS = async (token, secret, options) => {
   try {
+    if (isFalsy(token)) {
+      throw new InvalidPayloadError("The token must be a non-empty string");
+    }
     const secretKey = createSecret(secret);
-    const { payload } = await (0, import_jose.jwtDecrypt)(token, secretKey);
-    return payload.token;
+    const { payload } = await (0, import_jose.jwtVerify)(token, secretKey, options);
+    return payload;
   } catch (error) {
-    throw new Error("Invalid JWE", { cause: error });
+    if (isAuraJoseError(error)) {
+      throw error;
+    }
+    throw new JWSVerificationError("JWS signature verification failed", { cause: error });
   }
 };
-var createJWE = (secret) => {
+var createJWS = (secret) => {
   return {
-    encryptJWE: (payload) => encryptJWE(payload, secret),
-    decryptJWE: (payload) => decryptJWE(payload, secret)
+    signJWS: (payload) => signJWS(payload, secret),
+    verifyJWS: (payload, options) => verifyJWS(payload, secret, options)
   };
 };
 
-// src/sign.ts
+// src/encrypt.ts
 var import_node_crypto2 = __toESM(require("crypto"), 1);
 var import_jose2 = require("jose");
-var signJWS = async (payload, secret) => {
-  const secretKey = createSecret(secret);
-  const jti = import_node_crypto2.default.randomBytes(32).toString("base64");
-  return new import_jose2.SignJWT(payload).setProtectedHeader({ alg: "HS256", typ: "JWT" }).setIssuedAt().setNotBefore("0s").setExpirationTime("15d").setJti(jti).sign(secretKey);
+var encryptJWE = async (payload, secret, options) => {
+  try {
+    if (isFalsy(payload)) {
+      throw new InvalidPayloadError("The payload must be a non-empty string");
+    }
+    const secretKey = createSecret(secret);
+    const jti = import_node_crypto2.default.randomBytes(32).toString("base64url");
+    return new import_jose2.EncryptJWT({ payload }).setProtectedHeader({ alg: "dir", enc: "A256GCM", typ: "JWT", cty: "JWT" }).setIssuedAt().setNotBefore(options?.nbf ?? "0s").setExpirationTime(options?.exp ?? "15d").setJti(jti).encrypt(secretKey);
+  } catch (error) {
+    if (isAuraJoseError(error)) {
+      throw error;
+    }
+    throw new JWEEncryptionError("JWE encryption failed", { cause: error });
+  }
 };
-var verifyJWS = async (token, secret) => {
+var decryptJWE = async (token, secret, options) => {
   try {
+    if (isFalsy(token)) {
+      throw new InvalidPayloadError("The token must be a non-empty string");
+    }
     const secretKey = createSecret(secret);
-    const { payload } = await (0, import_jose2.jwtVerify)(token, secretKey);
-    return payload;
+    const { payload } = await (0, import_jose2.jwtDecrypt)(token, secretKey, options);
+    return payload.payload;
   } catch (error) {
-    throw new Error("Invalid JWS", { cause: error });
+    if (isAuraJoseError(error)) {
+      throw error;
+    }
+    throw new JWEDecryptionError("JWE decryption verification failed", { cause: error });
   }
 };
-var createJWS = (secret) => {
+var createJWE = (secret) => {
   return {
-    signJWS: (payload) => signJWS(payload, secret),
-    verifyJWS: (payload) => verifyJWS(payload, secret)
+    encryptJWE: (payload, options) => encryptJWE(payload, secret, options),
+    decryptJWE: (payload, options) => decryptJWE(payload, secret, options)
   };
 };
 
@@ -128,22 +218,30 @@ var createDeriveKey = (secret, salt, info, length = 32) => {
 // src/index.ts
 var encodeJWT = async (token, secret) => {
   try {
-    const { signJWS: signJWS2 } = createJWS(secret);
-    const { encryptJWE: encryptJWE2 } = createJWE(secret);
+    const { jweSecret, jwsSecret } = getSecrets(secret);
+    const { signJWS: signJWS2 } = createJWS(jwsSecret);
+    const { encryptJWE: encryptJWE2 } = createJWE(jweSecret);
     const signed = await signJWS2(token);
     return await encryptJWE2(signed);
   } catch (error) {
-    throw new Error("Failed to encode JWT", { cause: error });
+    if (isAuraJoseError(error)) {
+      throw error;
+    }
+    throw new JWTEncodingError("JWT encoding failed", { cause: error });
   }
 };
 var decodeJWT = async (token, secret) => {
   try {
-    const { verifyJWS: verifyJWS2 } = createJWS(secret);
-    const { decryptJWE: decryptJWE2 } = createJWE(secret);
+    const { jweSecret, jwsSecret } = getSecrets(secret);
+    const { verifyJWS: verifyJWS2 } = createJWS(jwsSecret);
+    const { decryptJWE: decryptJWE2 } = createJWE(jweSecret);
     const decrypted = await decryptJWE2(token);
     return await verifyJWS2(decrypted);
   } catch (error) {
-    throw new Error("Failed to decode JWT", { cause: error });
+    if (isAuraJoseError(error)) {
+      throw error;
+    }
+    throw new JWTDecodingError("JWT decoding failed", { cause: error });
   }
 };
 var createJWT = (secret) => {

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 import { KeyObject, BinaryLike } from 'node:crypto';
-import { JWTPayload } from 'jose';
+import { JWTPayload, JWTVerifyOptions, JWTDecryptOptions } from 'jose';
+export { JWTDecryptOptions, JWTVerifyOptions } from 'jose';
 
 /**
  * Sign a standard JWT token with the following claims:
@@ -24,7 +25,7 @@ declare const signJWS: (payload: JWTPayload, secret: SecretInput) => Promise<str
  * @param secret - CryptoKey or KeyObject used to verify the JWT
  * @returns verify and return the payload of the JWT
  */
-declare const verifyJWS: (token: string, secret: SecretInput) => Promise<JWTPayload>;
+declare const verifyJWS: (token: string, secret: SecretInput, options?: JWTVerifyOptions) => Promise<JWTPayload>;
 /**
  * Create a JWS (JSON Web Signature) signer and verifier. It implements the `signJWS`
  * and `verifyJWS` functions of the module.
@@ -34,11 +35,15 @@ declare const verifyJWS: (token: string, secret: SecretInput) => Promise<JWTPayl
  */
 declare const createJWS: (secret: SecretInput) => {
     signJWS: (payload: JWTPayload) => Promise<string>;
-    verifyJWS: (payload: string) => Promise<JWTPayload>;
+    verifyJWS: (payload: string, options?: JWTVerifyOptions) => Promise<JWTPayload>;
 };
 
 interface EncryptedPayload {
-    token: string;
+    payload: string;
+}
+interface EncryptOptions {
+    nbf?: string | number | Date;
+    exp?: string | number | Date;
 }
 /**
  * Encrypt a standard JWT token with the following claims:
@@ -51,7 +56,7 @@ interface EncryptedPayload {
  * @param secret - Secret key to encrypt the JWT (CryptoKey, KeyObject, string or Uint8Array)
  * @returns Encrypted JWT string
  */
-declare const encryptJWE: (payload: string, secret: SecretInput) => Promise<string>;
+declare const encryptJWE: (payload: string, secret: SecretInput, options?: EncryptOptions) => Promise<string>;
 /**
  * Decrypt a JWE token and return the payload if valid.
  *
@@ -59,7 +64,7 @@ declare const encryptJWE: (payload: string, secret: SecretInput) => Promise<stri
  * @param secret - Secret key to decrypt the JWT (CryptoKey, KeyObject, string or Uint8Array)
  * @returns Decrypted JWT payload string
  */
-declare const decryptJWE: (token: string, secret: SecretInput) => Promise<string>;
+declare const decryptJWE: (token: string, secret: SecretInput, options?: JWTDecryptOptions) => Promise<string>;
 /**
  * Creates a `JWE (JSON Web Encryption)` encrypter and decrypter. It implements the `encryptJWE`
  * and `decryptJWE` functions of the module.
@@ -68,8 +73,8 @@ declare const decryptJWE: (token: string, secret: SecretInput) => Promise<string
  * @returns encryptJWE and decryptJWE functions
  */
 declare const createJWE: (secret: SecretInput) => {
-    encryptJWE: (payload: string) => Promise<string>;
-    decryptJWE: (payload: string) => Promise<string>;
+    encryptJWE: (payload: string, options?: EncryptOptions) => Promise<string>;
+    decryptJWE: (payload: string, options?: JWTDecryptOptions) => Promise<string>;
 };
 
 /**
@@ -77,6 +82,10 @@ declare const createJWE: (secret: SecretInput) => {
  */
 
 type SecretInput = KeyObject | Uint8Array | string;
+type DerivedKeyInput = {
+    jws: SecretInput;
+    jwe: SecretInput;
+};
 /**
  * Encode a JWT signed and encrypted token. The token first signed using JWS
  * and then encrypted using JWE to ensure both integrity and confidentiality.
@@ -91,7 +100,7 @@ type SecretInput = KeyObject | Uint8Array | string;
  * @param secret - Secret key used for both signing and encrypting the JWT
  * @returns Promise resolving to the signed and encrypted JWT string
  */
-declare const encodeJWT: (token: JWTPayload, secret: SecretInput) => Promise<string>;
+declare const encodeJWT: (token: JWTPayload, secret: SecretInput | DerivedKeyInput) => Promise<string>;
 /**
  * Decode a JWT signed and encrypted token. The token is first decrypted using JWE
  * and then verified using JWS to ensure both confidentiality and integrity. It
@@ -104,7 +113,7 @@ declare const encodeJWT: (token: JWTPayload, secret: SecretInput) => Promise<str
  * @param secret
  * @returns
  */
-declare const decodeJWT: (token: string, secret: SecretInput) => Promise<JWTPayload>;
+declare const decodeJWT: (token: string, secret: SecretInput | DerivedKeyInput) => Promise<JWTPayload>;
 /**
  * Create a JWT handler with encode and decode methods to `signJWS/encryptJWE` and `verifyJWS/decryptJWE`
  * JWT tokens. The JWTs are signed and verified using JWS and encrypted and decrypted using JWE. It
@@ -113,7 +122,7 @@ declare const decodeJWT: (token: string, secret: SecretInput) => Promise<JWTPayl
  * @param secret - Secret key used for signing, verifying, encrypting and decrypting the JWT
  * @returns JWT handler object with `signJWS/encryptJWE` and `verifyJWS/decryptJWE` methods
  */
-declare const createJWT: (secret: SecretInput) => {
+declare const createJWT: (secret: SecretInput | DerivedKeyInput) => {
     encodeJWT: (payload: JWTPayload) => Promise<string>;
     decodeJWT: (token: string) => Promise<JWTPayload>;
 };
@@ -142,4 +151,4 @@ declare const createDeriveKey: (secret: SecretInput, salt?: BinaryLike, info?: s
     derivedKey: Buffer<ArrayBuffer>;
 };
 
-export { type EncryptedPayload, type SecretInput, createDeriveKey, createJWE, createJWS, createJWT, decodeJWT, decryptJWE, deriveKey, encodeJWT, encryptJWE, signJWS, verifyJWS };
+export { type DerivedKeyInput, type EncryptOptions, type EncryptedPayload, type SecretInput, createDeriveKey, createJWE, createJWS, createJWT, decodeJWT, decryptJWE, deriveKey, encodeJWT, encryptJWE, signJWS, verifyJWS };

package/dist/index.js

@@ -1,38 +1,55 @@
 import {
   createDeriveKey,
   deriveKey
-} from "./chunk-ODRHALUH.js";
+} from "./chunk-K5BQTFSO.js";
 import {
   createJWE,
   decryptJWE,
   encryptJWE
-} from "./chunk-T7MMDRY3.js";
+} from "./chunk-VPFE27PW.js";
 import {
   createJWS,
   signJWS,
   verifyJWS
-} from "./chunk-KSVD3YEC.js";
-import "./chunk-M4WAOCIJ.js";
+} from "./chunk-ZHDED44B.js";
+import {
+  getSecrets
+} from "./chunk-GXM4P5MQ.js";
+import {
+  isAuraJoseError
+} from "./chunk-ZHFHDRQH.js";
+import {
+  JWTDecodingError,
+  JWTEncodingError
+} from "./chunk-BMXFAB6Q.js";
 
 // src/index.ts
 var encodeJWT = async (token, secret) => {
   try {
-    const { signJWS: signJWS2 } = createJWS(secret);
-    const { encryptJWE: encryptJWE2 } = createJWE(secret);
+    const { jweSecret, jwsSecret } = getSecrets(secret);
+    const { signJWS: signJWS2 } = createJWS(jwsSecret);
+    const { encryptJWE: encryptJWE2 } = createJWE(jweSecret);
     const signed = await signJWS2(token);
     return await encryptJWE2(signed);
   } catch (error) {
-    throw new Error("Failed to encode JWT", { cause: error });
+    if (isAuraJoseError(error)) {
+      throw error;
+    }
+    throw new JWTEncodingError("JWT encoding failed", { cause: error });
   }
 };
 var decodeJWT = async (token, secret) => {
   try {
-    const { verifyJWS: verifyJWS2 } = createJWS(secret);
-    const { decryptJWE: decryptJWE2 } = createJWE(secret);
+    const { jweSecret, jwsSecret } = getSecrets(secret);
+    const { verifyJWS: verifyJWS2 } = createJWS(jwsSecret);
+    const { decryptJWE: decryptJWE2 } = createJWE(jweSecret);
     const decrypted = await decryptJWE2(token);
     return await verifyJWS2(decrypted);
   } catch (error) {
-    throw new Error("Failed to decode JWT", { cause: error });
+    if (isAuraJoseError(error)) {
+      throw error;
+    }
+    throw new JWTDecodingError("JWT decoding failed", { cause: error });
   }
 };
 var createJWT = (secret) => {

package/dist/secret.cjs

@@ -20,20 +20,52 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/secret.ts
 var secret_exports = {};
 __export(secret_exports, {
-  createSecret: () => createSecret
+  createSecret: () => createSecret,
+  getSecrets: () => getSecrets
 });
 module.exports = __toCommonJS(secret_exports);
+
+// src/errors.ts
+var AuraJoseError = class extends Error {
+  static code = "ERR_AURA_JOSE_ERROR";
+  code;
+  constructor(message, options) {
+    super(message, options);
+    this.name = new.target.name;
+    this.code = new.target.code;
+    Error.captureStackTrace(this, new.target);
+  }
+};
+var InvalidSecretError = class extends AuraJoseError {
+  static code = "ERR_INVALID_SECRET";
+};
+
+// src/assert.ts
+var isObject = (value) => {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+};
+
+// src/secret.ts
 var createSecret = (secret) => {
-  if (secret === void 0) throw new Error("Secret is required");
+  if (secret === void 0) throw new InvalidSecretError("Secret is required");
   if (typeof secret === "string") {
     if (new TextEncoder().encode(secret).byteLength < 32) {
-      throw new Error("Secret string must be at least 32 characters long");
+      throw new InvalidSecretError("Secret string must be at least 32 characters long");
     }
     return new Uint8Array(Buffer.from(secret, "utf-8"));
   }
   return secret;
 };
+var getSecrets = (secret) => {
+  const jwsSecret = isObject(secret) && "jws" in secret ? secret.jws : secret;
+  const jweSecret = isObject(secret) && "jwe" in secret ? secret.jwe : secret;
+  return {
+    jwsSecret,
+    jweSecret
+  };
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  createSecret
+  createSecret,
+  getSecrets
 });

package/dist/secret.d.ts

@@ -1,5 +1,5 @@
 import * as crypto from 'crypto';
-import { SecretInput } from './index.js';
+import { SecretInput, DerivedKeyInput } from './index.js';
 import 'node:crypto';
 import 'jose';
 
@@ -10,5 +10,9 @@ import 'jose';
  * @returns The secret in Uint8Array format
  */
 declare const createSecret: (secret: SecretInput) => crypto.KeyObject | Uint8Array<ArrayBufferLike>;
+declare const getSecrets: (secret: SecretInput | DerivedKeyInput) => {
+    jwsSecret: SecretInput;
+    jweSecret: SecretInput;
+};
 
-export { createSecret };
+export { createSecret, getSecrets };

package/dist/secret.js

@@ -1,6 +1,10 @@
 import {
-  createSecret
-} from "./chunk-M4WAOCIJ.js";
+  createSecret,
+  getSecrets
+} from "./chunk-GXM4P5MQ.js";
+import "./chunk-ZHFHDRQH.js";
+import "./chunk-BMXFAB6Q.js";
 export {
-  createSecret
+  createSecret,
+  getSecrets
 };

package/dist/sign.cjs

@@ -38,12 +38,50 @@ module.exports = __toCommonJS(sign_exports);
 var import_node_crypto = __toESM(require("crypto"), 1);
 var import_jose = require("jose");
 
+// src/errors.ts
+var AuraJoseError = class extends Error {
+  static code = "ERR_AURA_JOSE_ERROR";
+  code;
+  constructor(message, options) {
+    super(message, options);
+    this.name = new.target.name;
+    this.code = new.target.code;
+    Error.captureStackTrace(this, new.target);
+  }
+};
+var InvalidPayloadError = class extends AuraJoseError {
+  static code = "ERR_INVALID_PAYLOAD";
+};
+var JWSVerificationError = class extends AuraJoseError {
+  static code = "ERR_JWS_VERIFICATION";
+};
+var JWSSigningError = class extends AuraJoseError {
+  static code = "ERR_JWS_SIGNING";
+};
+var InvalidSecretError = class extends AuraJoseError {
+  static code = "ERR_INVALID_SECRET";
+};
+
+// src/assert.ts
+var isAuraJoseError = (error) => {
+  return error instanceof AuraJoseError;
+};
+var isFalsy = (value) => {
+  return value === null || value === void 0 || value === false || value === 0 || value === "" || Number.isNaN(value);
+};
+var isObject = (value) => {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+};
+var isInvalidPayload = (payload) => {
+  return isFalsy(payload) || !isObject(payload) || typeof payload === "object" && payload !== null && !Array.isArray(payload) && Object.keys(payload).length === 0;
+};
+
 // src/secret.ts
 var createSecret = (secret) => {
-  if (secret === void 0) throw new Error("Secret is required");
+  if (secret === void 0) throw new InvalidSecretError("Secret is required");
   if (typeof secret === "string") {
     if (new TextEncoder().encode(secret).byteLength < 32) {
-      throw new Error("Secret string must be at least 32 characters long");
+      throw new InvalidSecretError("Secret string must be at least 32 characters long");
     }
     return new Uint8Array(Buffer.from(secret, "utf-8"));
   }
@@ -52,23 +90,39 @@ var createSecret = (secret) => {
 
 // src/sign.ts
 var signJWS = async (payload, secret) => {
-  const secretKey = createSecret(secret);
-  const jti = import_node_crypto.default.randomBytes(32).toString("base64");
-  return new import_jose.SignJWT(payload).setProtectedHeader({ alg: "HS256", typ: "JWT" }).setIssuedAt().setNotBefore("0s").setExpirationTime("15d").setJti(jti).sign(secretKey);
+  try {
+    if (isInvalidPayload(payload)) {
+      throw new InvalidPayloadError("The payload must be a non-empty object");
+    }
+    const secretKey = createSecret(secret);
+    const jti = import_node_crypto.default.randomBytes(32).toString("base64url");
+    return new import_jose.SignJWT(payload).setProtectedHeader({ alg: "HS256", typ: "JWT" }).setIssuedAt().setNotBefore(payload.nbf ?? "0s").setExpirationTime(payload.exp ?? "15d").setJti(jti).sign(secretKey);
+  } catch (error) {
+    if (isAuraJoseError(error)) {
+      throw error;
+    }
+    throw new JWSSigningError("JWS signing failed", { cause: error });
+  }
 };
-var verifyJWS = async (token, secret) => {
+var verifyJWS = async (token, secret, options) => {
   try {
+    if (isFalsy(token)) {
+      throw new InvalidPayloadError("The token must be a non-empty string");
+    }
     const secretKey = createSecret(secret);
-    const { payload } = await (0, import_jose.jwtVerify)(token, secretKey);
+    const { payload } = await (0, import_jose.jwtVerify)(token, secretKey, options);
     return payload;
   } catch (error) {
-    throw new Error("Invalid JWS", { cause: error });
+    if (isAuraJoseError(error)) {
+      throw error;
+    }
+    throw new JWSVerificationError("JWS signature verification failed", { cause: error });
   }
 };
 var createJWS = (secret) => {
   return {
     signJWS: (payload) => signJWS(payload, secret),
-    verifyJWS: (payload) => verifyJWS(payload, secret)
+    verifyJWS: (payload, options) => verifyJWS(payload, secret, options)
   };
 };
 // Annotate the CommonJS export names for ESM import in node:

package/dist/sign.d.ts

@@ -1,3 +1,3 @@
-import 'jose';
+export { JWTVerifyOptions } from 'jose';
 export { createJWS, signJWS, verifyJWS } from './index.js';
 import 'node:crypto';

package/dist/sign.js

@@ -2,8 +2,10 @@ import {
   createJWS,
   signJWS,
   verifyJWS
-} from "./chunk-KSVD3YEC.js";
-import "./chunk-M4WAOCIJ.js";
+} from "./chunk-ZHDED44B.js";
+import "./chunk-GXM4P5MQ.js";
+import "./chunk-ZHFHDRQH.js";
+import "./chunk-BMXFAB6Q.js";
 export {
   createJWS,
   signJWS,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aura-stack/jose",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "private": false,
   "type": "module",
   "description": "JOSE utilities for @aura-stack/auth",

package/dist/chunk-KSVD3YEC.js

@@ -1,33 +0,0 @@
-import {
-  createSecret
-} from "./chunk-M4WAOCIJ.js";
-
-// src/sign.ts
-import crypto from "crypto";
-import { jwtVerify, SignJWT } from "jose";
-var signJWS = async (payload, secret) => {
-  const secretKey = createSecret(secret);
-  const jti = crypto.randomBytes(32).toString("base64");
-  return new SignJWT(payload).setProtectedHeader({ alg: "HS256", typ: "JWT" }).setIssuedAt().setNotBefore("0s").setExpirationTime("15d").setJti(jti).sign(secretKey);
-};
-var verifyJWS = async (token, secret) => {
-  try {
-    const secretKey = createSecret(secret);
-    const { payload } = await jwtVerify(token, secretKey);
-    return payload;
-  } catch (error) {
-    throw new Error("Invalid JWS", { cause: error });
-  }
-};
-var createJWS = (secret) => {
-  return {
-    signJWS: (payload) => signJWS(payload, secret),
-    verifyJWS: (payload) => verifyJWS(payload, secret)
-  };
-};
-
-export {
-  signJWS,
-  verifyJWS,
-  createJWS
-};

package/dist/chunk-M4WAOCIJ.js

@@ -1,15 +0,0 @@
-// src/secret.ts
-var createSecret = (secret) => {
-  if (secret === void 0) throw new Error("Secret is required");
-  if (typeof secret === "string") {
-    if (new TextEncoder().encode(secret).byteLength < 32) {
-      throw new Error("Secret string must be at least 32 characters long");
-    }
-    return new Uint8Array(Buffer.from(secret, "utf-8"));
-  }
-  return secret;
-};
-
-export {
-  createSecret
-};