@nmbrco/server 0.0.0-stage → 0.0.1

package/CHANGELOG.md

@@ -0,0 +1,7 @@
+# @nmbrco/server
+
+## 0.0.1
+
+### Patch Changes
+
+- Add the `sign` middleware. It creates the JSON Web Token for each Nmbr Components request, and calls a required `authorize` hook before it signs a token for a company.

package/LICENSE.md

@@ -0,0 +1,12 @@
+Copyright 2026, The Nmbr Company Ltd.
+
+This package is licensed for use by Nmbr Partners or employees for the express
+purpose of integrating Nmbr Components with their application(s) and the Nmbr API.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -1,3 +1,75 @@
-# Temporary Holding Version
+# @nmbrco/server
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Server middleware for [Nmbr Components](https://docs.nmbr.co/components/getting-started-v2).
+
+Every request the Component makes to the Nmbr API carries a JSON Web Token signed with your API secret. `sign` is the endpoint that creates those tokens.
+
+## Install
+
+```bash
+npm install @nmbrco/server
+```
+
+Requires Node 22 or later.
+
+## Sign
+
+Mount `sign` behind your own authentication, then pass its path as `signUrl` when you initialize the Component.
+
+```ts
+import express from 'express';
+import type { Request } from 'express';
+import { sign } from '@nmbrco/server';
+
+const app = express();
+
+app.post(
+  '/sign_nmbr_request',
+  requireSession, // your auth
+  sign({
+    apiSecret: process.env.NMBR_API_SECRET!,
+    partnerId: process.env.NMBR_PARTNER_ID!,
+    // Return true only if the signed-in user can have this scope for this company.
+    authorize: (req: Request, { companyId, scope }) =>
+      scope === 'admin:*' && req.user.payrollAdminCompanyIds.includes(companyId),
+  })
+);
+```
+
+### Why `authorize` is required
+
+The Nmbr API checks that the company in a token belongs to your partner account. It cannot know which of your users may act on which of your companies. Without `authorize`, any signed-in user of your app could get a token for any company under your partner account.
+
+`authorize` also gets the `scope` that the Component requests. Today the only scope is `admin:*`, which gives full payroll access to the company. Check the scope as well as the company.
+
+Rate-limit the sign route. The Component calls it once for each API request, and each call runs `authorize`.
+
+### What `sign` sets
+
+The Component sends the claims for each API request. `sign` keeps only the company, scope, HTTP method, path and body hash from that message. It sets `iss` and `exp` itself:
+
+| Claim    | Value                                    |
+| -------- | ---------------------------------------- |
+| `iss`    | `partnerId`                              |
+| `sub`    | the company, after `authorize` allows it |
+| `scope`  | from the Component, after `authorize` allows it |
+| `exp`    | 5 minutes from now                       |
+| `method` | from the Component                       |
+| `uri`    | from the Component (a path only)         |
+| `hash`   | from the Component, when present         |
+
+### Responses
+
+| Status | When                                                     |
+| ------ | -------------------------------------------------------- |
+| `201`  | The token, as `text/plain`                               |
+| `400`  | The body is not valid JSON, or has invalid claims |
+| `403`  | `authorize` returned `false`                             |
+| `413`  | The body is larger than 8 KiB. `sign` stops reading it and closes the connection. |
+| `405`  | The request is not a `POST`                              |
+
+If `authorize` throws, `sign` passes the error to `next` (Express), or responds `500` when there is no `next`.
+
+### Other frameworks
+
+`sign` takes a Node `IncomingMessage` and `ServerResponse`, so it also works with `node:http` and Connect-style servers. It reads the request body itself, or uses `req.body` when a body parser already ran.

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export type { SignOptions } from './sign.js';
+export { sign } from './sign.js';
+export type { SignRequest } from './sign-request.js';

package/dist/index.js

@@ -0,0 +1,113 @@
+import { Buffer } from "node:buffer";
+import { createHash } from "node:crypto";
+import { SignJWT } from "jose";
+//#region src/sign-request.ts
+var METHODS = [
+	"GET",
+	"POST",
+	"PUT",
+	"PATCH",
+	"DELETE"
+];
+var isNonEmptyString = (value) => typeof value === "string" && value.length > 0;
+var parseSignRequest = (body) => {
+	if (typeof body !== "object" || body === null) return void 0;
+	const { sub, method, uri, scope, hash } = body;
+	if (!isNonEmptyString(sub) || !isNonEmptyString(method) || !METHODS.includes(method) || !isNonEmptyString(uri) || !uri.startsWith("/") || uri.startsWith("//") || !isNonEmptyString(scope) || hash !== void 0 && typeof hash !== "string") return;
+	return {
+		companyId: sub,
+		method,
+		uri,
+		scope,
+		...hash && { hash }
+	};
+};
+//#endregion
+//#region src/token.ts
+var TOKEN_TTL = "5m";
+var createSigningKey = (apiSecret) => new TextEncoder().encode(createHash("sha256").update(apiSecret).digest("hex"));
+var signToken = (partnerId, { companyId, method, uri, scope, hash }, key) => new SignJWT({
+	uri,
+	method,
+	scope,
+	...hash && { hash }
+}).setProtectedHeader({
+	alg: "HS256",
+	typ: "JWT"
+}).setIssuer(partnerId).setSubject(companyId).setExpirationTime(TOKEN_TTL).sign(key);
+//#endregion
+//#region src/sign.ts
+var MAX_BODY_BYTES = 8192;
+var LINGER_MS = 1e3;
+var TOO_LARGE = Symbol("TOO_LARGE");
+var parseJson = (text) => {
+	try {
+		return JSON.parse(text);
+	} catch {
+		return;
+	}
+};
+var readText = (req) => new Promise((resolve, reject) => {
+	const chunks = [];
+	let size = 0;
+	const onData = (chunk) => {
+		size += chunk.length;
+		if (size > MAX_BODY_BYTES) {
+			req.off("data", onData);
+			req.pause();
+			resolve(TOO_LARGE);
+			return;
+		}
+		chunks.push(chunk);
+	};
+	req.on("data", onData);
+	req.once("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
+	req.once("error", reject);
+});
+var isSkippedBody = (req) => !req.readableEnded && typeof req.body === "object" && req.body !== null && Object.keys(req.body).length === 0;
+var readBody = async (req) => {
+	if (typeof req.body === "string") return parseJson(req.body);
+	if (Buffer.isBuffer(req.body)) return parseJson(req.body.toString("utf8"));
+	if (req.body !== void 0 && !isSkippedBody(req)) return req.body;
+	if (Number(req.headers["content-length"]) > MAX_BODY_BYTES) return TOO_LARGE;
+	const text = await readText(req);
+	return text === TOO_LARGE ? TOO_LARGE : parseJson(text);
+};
+var send = (res, status, body) => {
+	res.statusCode = status;
+	res.setHeader("Content-Type", "text/plain; charset=utf-8");
+	res.setHeader("Cache-Control", "no-store");
+	res.end(body);
+};
+var sign = ({ apiSecret, partnerId, authorize }) => {
+	if (!apiSecret) throw new Error("@nmbrco/server: `apiSecret` is required");
+	if (!partnerId) throw new Error("@nmbrco/server: `partnerId` is required");
+	if (typeof authorize !== "function") throw new Error("@nmbrco/server: `authorize` is required");
+	const key = createSigningKey(apiSecret);
+	return async (req, res, next) => {
+		try {
+			if (req.method !== "POST") {
+				res.setHeader("Allow", "POST");
+				return send(res, 405, "Method Not Allowed");
+			}
+			const body = await readBody(req);
+			if (body === TOO_LARGE) {
+				res.once("finish", () => {
+					setTimeout(() => req.destroy(), LINGER_MS).unref();
+				});
+				return send(res, 413, "Payload Too Large");
+			}
+			const request = parseSignRequest(body);
+			if (!request) return send(res, 400, "Invalid signing request");
+			if (!await authorize(req, request)) return send(res, 403, "Forbidden");
+			send(res, 201, await signToken(partnerId, request, key));
+		} catch (error) {
+			if (next) return next(error);
+			send(res, 500, "Internal Server Error");
+		}
+	};
+};
+//#endregion
+export { sign };
+
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../src/sign-request.ts","../src/token.ts","../src/sign.ts"],"sourcesContent":["const METHODS = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'];\n\nexport type SignRequest = {\n  companyId: string;\n  method: string;\n  uri: string;\n  scope: string;\n  hash?: string;\n};\n\nconst isNonEmptyString = (value: unknown): value is string =>\n  typeof value === 'string' && value.length > 0;\n\n// The browser can choose only these claims. The server sets `iss` and `exp`.\n// `authorize` decides if the signed-in user can have the requested `scope`.\nexport const parseSignRequest = (body: unknown): SignRequest | undefined => {\n  if (typeof body !== 'object' || body === null) return undefined;\n\n  const { sub, method, uri, scope, hash } = body as Record<string, unknown>;\n\n  if (\n    !isNonEmptyString(sub) ||\n    !isNonEmptyString(method) ||\n    !METHODS.includes(method) ||\n    !isNonEmptyString(uri) ||\n    !uri.startsWith('/') ||\n    uri.startsWith('//') ||\n    !isNonEmptyString(scope) ||\n    (hash !== undefined && typeof hash !== 'string')\n  ) {\n    return undefined;\n  }\n\n  return { companyId: sub, method, uri, scope, ...(hash && { hash }) };\n};\n","import type { SignRequest } from './sign-request.js';\n\nimport { createHash } from 'node:crypto';\n\nimport { SignJWT } from 'jose';\n\nconst TOKEN_TTL = '5m';\n\n// The API stores the SHA-256 hex digest of the API secret, not the secret.\n// The API uses that digest as the HS256 key.\nexport const createSigningKey = (apiSecret: string) =>\n  new TextEncoder().encode(\n    createHash('sha256').update(apiSecret).digest('hex')\n  );\n\nexport const signToken = (\n  partnerId: string,\n  { companyId, method, uri, scope, hash }: SignRequest,\n  key: Uint8Array\n) =>\n  new SignJWT({\n    uri,\n    method,\n    scope,\n    ...(hash && { hash }),\n  })\n    .setProtectedHeader({ alg: 'HS256', typ: 'JWT' })\n    .setIssuer(partnerId)\n    .setSubject(companyId)\n    .setExpirationTime(TOKEN_TTL)\n    .sign(key);\n","import type { SignRequest } from './sign-request.js';\nimport type { IncomingMessage, ServerResponse } from 'node:http';\n\nimport { Buffer } from 'node:buffer';\n\nimport { parseSignRequest } from './sign-request.js';\nimport { createSigningKey, signToken } from './token.js';\n\nexport type SignOptions<Req extends IncomingMessage = IncomingMessage> = {\n  apiSecret: string;\n  partnerId: string;\n  // The API checks that the company belongs to the partner.\n  // It does not check that the signed-in user can access the company.\n  authorize: (req: Req, request: SignRequest) => boolean | Promise<boolean>;\n};\n\nconst MAX_BODY_BYTES = 8 * 1024;\n\nconst LINGER_MS = 1000;\n\nconst TOO_LARGE = Symbol('TOO_LARGE');\n\nconst parseJson = (text: string): unknown => {\n  try {\n    return JSON.parse(text);\n  } catch {\n    return undefined;\n  }\n};\n\n// Pause the stream at the limit. A destroyed stream also closes the socket,\n// and then the client gets no 413 response.\nconst readText = (req: IncomingMessage) =>\n  new Promise<string | typeof TOO_LARGE>((resolve, reject) => {\n    const chunks: Array<Buffer> = [];\n    let size = 0;\n\n    const onData = (chunk: Buffer) => {\n      size += chunk.length;\n\n      if (size > MAX_BODY_BYTES) {\n        req.off('data', onData);\n        req.pause();\n        resolve(TOO_LARGE);\n        return;\n      }\n\n      chunks.push(chunk);\n    };\n\n    req.on('data', onData);\n    req.once('end', () => resolve(Buffer.concat(chunks).toString('utf8')));\n    req.once('error', reject);\n  });\n\n// Express 4 body parsers set `req.body` to `{}` when they skip a request.\n// Then the stream is not read yet, and `readBody` must read it.\nconst isSkippedBody = (req: IncomingMessage & { body?: unknown }) =>\n  !req.readableEnded &&\n  typeof req.body === 'object' &&\n  req.body !== null &&\n  Object.keys(req.body).length === 0;\n\n// Use `req.body` when a parser such as `express.json()` read the stream before.\nconst readBody = async (req: IncomingMessage & { body?: unknown }) => {\n  if (typeof req.body === 'string') return parseJson(req.body);\n  if (Buffer.isBuffer(req.body)) return parseJson(req.body.toString('utf8'));\n  if (req.body !== undefined && !isSkippedBody(req)) return req.body;\n\n  if (Number(req.headers['content-length']) > MAX_BODY_BYTES) return TOO_LARGE;\n\n  const text = await readText(req);\n\n  return text === TOO_LARGE ? TOO_LARGE : parseJson(text);\n};\n\nconst send = (res: ServerResponse, status: number, body: string) => {\n  res.statusCode = status;\n  res.setHeader('Content-Type', 'text/plain; charset=utf-8');\n  res.setHeader('Cache-Control', 'no-store');\n  res.end(body);\n};\n\nexport const sign = <Req extends IncomingMessage = IncomingMessage>({\n  apiSecret,\n  partnerId,\n  authorize,\n}: SignOptions<Req>) => {\n  if (!apiSecret) throw new Error('@nmbrco/server: `apiSecret` is required');\n  if (!partnerId) throw new Error('@nmbrco/server: `partnerId` is required');\n  if (typeof authorize !== 'function') {\n    throw new Error('@nmbrco/server: `authorize` is required');\n  }\n\n  const key = createSigningKey(apiSecret);\n\n  return async (\n    req: Req & { body?: unknown },\n    res: ServerResponse,\n    next?: (error?: unknown) => void\n  ) => {\n    try {\n      if (req.method !== 'POST') {\n        res.setHeader('Allow', 'POST');\n        return send(res, 405, 'Method Not Allowed');\n      }\n\n      const body = await readBody(req);\n\n      // Close the connection a short time after the 413, so the client cannot\n      // send the rest of the body. Node discards the data until then. Do not\n      // close at once: a close with unread data resets the connection, and then\n      // the client loses the 413 response.\n      if (body === TOO_LARGE) {\n        res.once('finish', () => {\n          setTimeout(() => req.destroy(), LINGER_MS).unref();\n        });\n        return send(res, 413, 'Payload Too Large');\n      }\n\n      const request = parseSignRequest(body);\n\n      if (!request) return send(res, 400, 'Invalid signing request');\n\n      if (!(await authorize(req, request))) {\n        return send(res, 403, 'Forbidden');\n      }\n\n      send(res, 201, await signToken(partnerId, request, key));\n    } catch (error) {\n      if (next) return next(error);\n\n      send(res, 500, 'Internal Server Error');\n    }\n  };\n};\n"],"mappings":";;;;AAAA,IAAM,UAAU;CAAC;CAAO;CAAQ;CAAO;CAAS;AAAQ;AAUxD,IAAM,oBAAoB,UACxB,OAAO,UAAU,YAAY,MAAM,SAAS;AAI9C,IAAa,oBAAoB,SAA2C;CAC1E,IAAI,OAAO,SAAS,YAAY,SAAS,MAAM,OAAO,KAAA;CAEtD,MAAM,EAAE,KAAK,QAAQ,KAAK,OAAO,SAAS;CAE1C,IACE,CAAC,iBAAiB,GAAG,KACrB,CAAC,iBAAiB,MAAM,KACxB,CAAC,QAAQ,SAAS,MAAM,KACxB,CAAC,iBAAiB,GAAG,KACrB,CAAC,IAAI,WAAW,GAAG,KACnB,IAAI,WAAW,IAAI,KACnB,CAAC,iBAAiB,KAAK,KACtB,SAAS,KAAA,KAAa,OAAO,SAAS,UAEvC;CAGF,OAAO;EAAE,WAAW;EAAK;EAAQ;EAAK;EAAO,GAAI,QAAQ,EAAE,KAAK;CAAG;AACrE;;;AC5BA,IAAM,YAAY;AAIlB,IAAa,oBAAoB,cAC/B,IAAI,YAAY,CAAC,CAAC,OAChB,WAAW,QAAQ,CAAC,CAAC,OAAO,SAAS,CAAC,CAAC,OAAO,KAAK,CACrD;AAEF,IAAa,aACX,WACA,EAAE,WAAW,QAAQ,KAAK,OAAO,QACjC,QAEA,IAAI,QAAQ;CACV;CACA;CACA;CACA,GAAI,QAAQ,EAAE,KAAK;AACrB,CAAC,CAAC,CACC,mBAAmB;CAAE,KAAK;CAAS,KAAK;AAAM,CAAC,CAAC,CAChD,UAAU,SAAS,CAAC,CACpB,WAAW,SAAS,CAAC,CACrB,kBAAkB,SAAS,CAAC,CAC5B,KAAK,GAAG;;;ACdb,IAAM,iBAAiB;AAEvB,IAAM,YAAY;AAElB,IAAM,YAAY,OAAO,WAAW;AAEpC,IAAM,aAAa,SAA0B;CAC3C,IAAI;EACF,OAAO,KAAK,MAAM,IAAI;CACxB,QAAQ;EACN;CACF;AACF;AAIA,IAAM,YAAY,QAChB,IAAI,SAAoC,SAAS,WAAW;CAC1D,MAAM,SAAwB,CAAC;CAC/B,IAAI,OAAO;CAEX,MAAM,UAAU,UAAkB;EAChC,QAAQ,MAAM;EAEd,IAAI,OAAO,gBAAgB;GACzB,IAAI,IAAI,QAAQ,MAAM;GACtB,IAAI,MAAM;GACV,QAAQ,SAAS;GACjB;EACF;EAEA,OAAO,KAAK,KAAK;CACnB;CAEA,IAAI,GAAG,QAAQ,MAAM;CACrB,IAAI,KAAK,aAAa,QAAQ,OAAO,OAAO,MAAM,CAAC,CAAC,SAAS,MAAM,CAAC,CAAC;CACrE,IAAI,KAAK,SAAS,MAAM;AAC1B,CAAC;AAIH,IAAM,iBAAiB,QACrB,CAAC,IAAI,iBACL,OAAO,IAAI,SAAS,YACpB,IAAI,SAAS,QACb,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,WAAW;AAGnC,IAAM,WAAW,OAAO,QAA8C;CACpE,IAAI,OAAO,IAAI,SAAS,UAAU,OAAO,UAAU,IAAI,IAAI;CAC3D,IAAI,OAAO,SAAS,IAAI,IAAI,GAAG,OAAO,UAAU,IAAI,KAAK,SAAS,MAAM,CAAC;CACzE,IAAI,IAAI,SAAS,KAAA,KAAa,CAAC,cAAc,GAAG,GAAG,OAAO,IAAI;CAE9D,IAAI,OAAO,IAAI,QAAQ,iBAAiB,IAAI,gBAAgB,OAAO;CAEnE,MAAM,OAAO,MAAM,SAAS,GAAG;CAE/B,OAAO,SAAS,YAAY,YAAY,UAAU,IAAI;AACxD;AAEA,IAAM,QAAQ,KAAqB,QAAgB,SAAiB;CAClE,IAAI,aAAa;CACjB,IAAI,UAAU,gBAAgB,2BAA2B;CACzD,IAAI,UAAU,iBAAiB,UAAU;CACzC,IAAI,IAAI,IAAI;AACd;AAEA,IAAa,QAAuD,EAClE,WACA,WACA,gBACsB;CACtB,IAAI,CAAC,WAAW,MAAM,IAAI,MAAM,yCAAyC;CACzE,IAAI,CAAC,WAAW,MAAM,IAAI,MAAM,yCAAyC;CACzE,IAAI,OAAO,cAAc,YACvB,MAAM,IAAI,MAAM,yCAAyC;CAG3D,MAAM,MAAM,iBAAiB,SAAS;CAEtC,OAAO,OACL,KACA,KACA,SACG;EACH,IAAI;GACF,IAAI,IAAI,WAAW,QAAQ;IACzB,IAAI,UAAU,SAAS,MAAM;IAC7B,OAAO,KAAK,KAAK,KAAK,oBAAoB;GAC5C;GAEA,MAAM,OAAO,MAAM,SAAS,GAAG;GAM/B,IAAI,SAAS,WAAW;IACtB,IAAI,KAAK,gBAAgB;KACvB,iBAAiB,IAAI,QAAQ,GAAG,SAAS,CAAC,CAAC,MAAM;IACnD,CAAC;IACD,OAAO,KAAK,KAAK,KAAK,mBAAmB;GAC3C;GAEA,MAAM,UAAU,iBAAiB,IAAI;GAErC,IAAI,CAAC,SAAS,OAAO,KAAK,KAAK,KAAK,yBAAyB;GAE7D,IAAI,CAAE,MAAM,UAAU,KAAK,OAAO,GAChC,OAAO,KAAK,KAAK,KAAK,WAAW;GAGnC,KAAK,KAAK,KAAK,MAAM,UAAU,WAAW,SAAS,GAAG,CAAC;EACzD,SAAS,OAAO;GACd,IAAI,MAAM,OAAO,KAAK,KAAK;GAE3B,KAAK,KAAK,KAAK,uBAAuB;EACxC;CACF;AACF"}

package/dist/sign-request.d.ts

@@ -0,0 +1,8 @@
+export type SignRequest = {
+    companyId: string;
+    method: string;
+    uri: string;
+    scope: string;
+    hash?: string;
+};
+export declare const parseSignRequest: (body: unknown) => SignRequest | undefined;

package/dist/sign.d.ts

@@ -0,0 +1,10 @@
+import { SignRequest } from './sign-request.js';
+import { IncomingMessage, ServerResponse } from 'node:http';
+export type SignOptions<Req extends IncomingMessage = IncomingMessage> = {
+    apiSecret: string;
+    partnerId: string;
+    authorize: (req: Req, request: SignRequest) => boolean | Promise<boolean>;
+};
+export declare const sign: <Req extends IncomingMessage = IncomingMessage>({ apiSecret, partnerId, authorize, }: SignOptions<Req>) => (req: Req & {
+    body?: unknown;
+}, res: ServerResponse, next?: (error?: unknown) => void) => Promise<void>;

package/dist/token.d.ts

@@ -0,0 +1,3 @@
+import { SignRequest } from './sign-request.js';
+export declare const createSigningKey: (apiSecret: string) => NodeJS.NonSharedUint8Array;
+export declare const signToken: (partnerId: string, { companyId, method, uri, scope, hash }: SignRequest, key: Uint8Array) => Promise<string>;

package/package.json

@@ -1,6 +1,54 @@
 {
   "name": "@nmbrco/server",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.0.1",
+  "description": "Server middleware that signs Nmbr Components requests",
+  "type": "module",
+  "author": "The Nmbr Company Ltd. (https://nmbr.co)",
+  "license": "SEE LICENSE IN LICENSE.md",
+  "homepage": "https://docs.nmbr.co/components/getting-started-v2",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/nmbrco/components.git",
+    "directory": "packages/server"
+  },
+  "scripts": {
+    "build": "vite build",
+    "type-check": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "lint": "eslint . --max-warnings 0 --no-warn-ignored",
+    "lint:fix": "eslint . --fix --max-warnings 0 --no-warn-ignored",
+    "format": "prettier --write . --ignore-path=../../.prettierignore",
+    "format:check": "prettier --check . --ignore-path=../../.prettierignore"
+  },
+  "files": [
+    "dist",
+    "CHANGELOG.md"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "sideEffects": false,
+  "engines": {
+    "node": ">=22"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "jose": "^6.2.12"
+  },
+  "devDependencies": {
+    "@types/express": "^5.0.6",
+    "@types/node": "26.5.1",
+    "@typescript/typescript6": "^6.0.2",
+    "express": "^5.2.1",
+    "typescript": "^7.0.2",
+    "unplugin-dts": "^1.1.1",
+    "vite": "^8.3.0",
+    "vitest": "^5.0.0"
+  }
+}