@optare/node 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Optare
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,40 @@
+# @optare/node
+
+Server-side Optare SDK. Two independent pieces.
+
+## Offline JWT verification
+
+Trust a bearer token from your front end without a network call or shared secret.
+
+```ts
+import { createOptareJwtVerifier } from "@optare/node";
+
+const verifier = createOptareJwtVerifier({
+  baseURL: "https://id.optare.one", // JWKS: ${baseURL}/.well-known/jwks.json
+});
+
+const claims = await verifier.verify(token); // throws OptareJwtError if invalid
+const maybe = await verifier.tryVerify(token); // null instead of throwing
+```
+
+One JWKS fetch, cached for an hour; every `verify()` after that is local
+(signature + `iss` / `exp` / `aud`). Call `verifier.invalidate()` after key
+rotation, or pass a pre-fetched `jwks` to go fully offline.
+
+## `sk_live_` management calls
+
+```ts
+import { createOptareManagementClient } from "@optare/node";
+
+const optare = createOptareManagementClient({
+  secretKey: process.env.OPTARE_SECRET_KEY!, // sk_live_… — never ship to a browser
+  baseURL: "https://id.optare.one",
+});
+
+await optare.organizations.list();
+const org = await optare.organizations.create({ name: "Acme Inc" });
+await optare.organizations.update(org.id, { consumerPlanTemplate: "professional" });
+await optare.organizations.invite(org.id, { email: "user@acme.com", role: "admin" });
+```
+
+Non-2xx responses throw `OptareApiError` with `.status` and the server's message.

package/dist/index.cjs

@@ -0,0 +1,200 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  DEFAULT_OPTARE_ORIGIN: () => DEFAULT_OPTARE_ORIGIN,
+  OptareApiError: () => OptareApiError,
+  OptareJwtError: () => OptareJwtError,
+  createOptareJwtVerifier: () => createOptareJwtVerifier,
+  createOptareManagementClient: () => createOptareManagementClient
+});
+module.exports = __toCommonJS(index_exports);
+var import_jose = require("jose");
+var DEFAULT_OPTARE_ORIGIN = "https://id.optare.one";
+var OptareJwtError = class extends Error {
+  constructor(message, cause) {
+    super(message);
+    this.cause = cause;
+    this.name = "OptareJwtError";
+  }
+  cause;
+};
+function trimSlash(s) {
+  return s.replace(/\/+$/, "");
+}
+function createOptareJwtVerifier(config = {}) {
+  const origin = trimSlash(config.baseURL ?? DEFAULT_OPTARE_ORIGIN);
+  const jwksURL = config.jwksURL ?? `${origin}/.well-known/jwks.json`;
+  const issuer = config.issuer === null ? void 0 : config.issuer ?? config.baseURL ?? origin;
+  const ttl = config.cacheTtlMs ?? 60 * 6e4;
+  let keySet = config.jwks ? (0, import_jose.createLocalJWKSet)(config.jwks) : null;
+  let fetchedAt = config.jwks ? Date.now() : 0;
+  function keys() {
+    const stale = Date.now() - fetchedAt > ttl;
+    if (!keySet || stale && !config.jwks) {
+      keySet = (0, import_jose.createRemoteJWKSet)(new URL(jwksURL), {
+        ...config.fetch ? { [import_jose.customFetch]: config.fetch } : {}
+      });
+      fetchedAt = Date.now();
+    }
+    return keySet;
+  }
+  async function verify(token) {
+    if (!token || token.split(".").length !== 3) {
+      throw new OptareJwtError("Not a JWT");
+    }
+    try {
+      const { payload } = await (0, import_jose.jwtVerify)(token, keys(), {
+        ...issuer ? { issuer } : {},
+        ...config.audience ? { audience: config.audience } : {}
+      });
+      return payload;
+    } catch (cause) {
+      throw new OptareJwtError(
+        `Token verification failed: ${cause.message}`,
+        cause
+      );
+    }
+  }
+  return {
+    verify,
+    async tryVerify(token) {
+      try {
+        return await verify(token);
+      } catch {
+        return null;
+      }
+    },
+    invalidate() {
+      if (!config.jwks) {
+        keySet = null;
+        fetchedAt = 0;
+      }
+    }
+  };
+}
+var OptareApiError = class extends Error {
+  constructor(message, status, body) {
+    super(message);
+    this.status = status;
+    this.body = body;
+    this.name = "OptareApiError";
+  }
+  status;
+  body;
+};
+var SECRET_KEY_PREFIX = "sk_live_";
+function createOptareManagementClient(config) {
+  if (!config.secretKey || !config.secretKey.startsWith(SECRET_KEY_PREFIX)) {
+    throw new OptareApiError(
+      `Invalid secret key \u2014 expected an "${SECRET_KEY_PREFIX}\u2026" string`,
+      0,
+      null
+    );
+  }
+  const origin = trimSlash(config.baseURL ?? DEFAULT_OPTARE_ORIGIN);
+  const doFetch = config.fetch ?? globalThis.fetch;
+  async function call(method, path, body) {
+    let res;
+    try {
+      res = await doFetch(`${origin}${path}`, {
+        method,
+        headers: {
+          authorization: `Bearer ${config.secretKey}`,
+          "content-type": "application/json",
+          accept: "application/json"
+        },
+        ...body !== void 0 ? { body: JSON.stringify(body) } : {}
+      });
+    } catch (cause) {
+      throw new OptareApiError(
+        `Request to ${origin}${path} failed: ${cause.message}`,
+        0,
+        null
+      );
+    }
+    const text = await res.text();
+    const parsed = text ? safeJson(text) : null;
+    if (!res.ok) {
+      const message = (parsed && typeof parsed === "object" && "error" in parsed ? String(parsed.error) : null) ?? `${res.status} ${res.statusText}`;
+      throw new OptareApiError(message, res.status, parsed);
+    }
+    return parsed;
+  }
+  return {
+    organizations: {
+      async list() {
+        const out = await call(
+          "GET",
+          "/api/v1/organizations"
+        );
+        return out.organizations;
+      },
+      async create(input) {
+        const out = await call(
+          "POST",
+          "/api/v1/organizations",
+          input
+        );
+        return out.organization;
+      },
+      async get(id) {
+        const out = await call(
+          "GET",
+          `/api/v1/organizations/${encodeURIComponent(id)}`
+        );
+        return out.organization;
+      },
+      async update(id, patch) {
+        const out = await call(
+          "PATCH",
+          `/api/v1/organizations/${encodeURIComponent(id)}`,
+          patch
+        );
+        return out.organization;
+      },
+      async delete(id) {
+        await call(
+          "DELETE",
+          `/api/v1/organizations/${encodeURIComponent(id)}`
+        );
+      },
+      async invite(id, input) {
+        return call("POST", `/api/v1/organizations/${encodeURIComponent(id)}/invite`, input);
+      }
+    }
+  };
+}
+function safeJson(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  DEFAULT_OPTARE_ORIGIN,
+  OptareApiError,
+  OptareJwtError,
+  createOptareJwtVerifier,
+  createOptareManagementClient
+});

package/dist/index.d.cts

@@ -0,0 +1,120 @@
+import { JWTPayload } from 'jose';
+
+/**
+ * `@optare/node` — E3.
+ *
+ * The server-side counterpart to `@optare/client`. Two independent pieces:
+ *
+ *  1. {@link createOptareJwtVerifier} — **offline** verification of
+ *     Optare-issued JWTs against the published JWKS. One key-set fetch, cached;
+ *     every `verify()` after that is local (signature + `iss`/`exp`/`aud`), no
+ *     network, no shared secret. This is what an SDK-integrated backend uses to
+ *     trust a bearer token from its front end.
+ *
+ *  2. {@link createOptareManagementClient} — thin, typed `fetch` wrappers over
+ *     the `sk_live_`-authenticated `/api/v1/*` surface (the C19 "wedge":
+ *     a developer manages *their customers'* organizations). `sk_live_` is a
+ *     secret — server-side only.
+ */
+declare const DEFAULT_OPTARE_ORIGIN = "https://id.optare.one";
+interface JwtVerifierConfig {
+    /**
+     * Origin the JWKS is published on (`${baseURL}/.well-known/jwks.json`).
+     * Defaults to the hosted Optare API.
+     */
+    baseURL?: string;
+    /** Full JWKS URL — overrides `baseURL`. */
+    jwksURL?: string;
+    /**
+     * Expected `iss` claim. Defaults to `baseURL` (that is what the backend
+     * signs with). Pass `null` to skip the issuer check.
+     */
+    issuer?: string | null;
+    /** Expected `aud` claim, if your tokens carry one. */
+    audience?: string;
+    /** Pre-fetched JWKS (`{ keys: [...] }`) — fully offline, no fetch ever. */
+    jwks?: {
+        keys: Array<Record<string, unknown>>;
+    };
+    /** `fetch` implementation (Node < 18, tests). */
+    fetch?: typeof fetch;
+    /** How long to cache the remote key set, ms. Default 1 hour. */
+    cacheTtlMs?: number;
+}
+interface OptareJwtVerifier {
+    /** Verified claims, or throws `OptareJwtError` if the token is not valid. */
+    verify(token: string): Promise<JWTPayload>;
+    /** Like {@link verify} but returns `null` instead of throwing. */
+    tryVerify(token: string): Promise<JWTPayload | null>;
+    /** Drop the cached key set (call after key rotation). */
+    invalidate(): void;
+}
+declare class OptareJwtError extends Error {
+    readonly cause?: unknown | undefined;
+    constructor(message: string, cause?: unknown | undefined);
+}
+declare function createOptareJwtVerifier(config?: JwtVerifierConfig): OptareJwtVerifier;
+interface ManagementClientConfig {
+    /** `sk_live_…` — secret. Server-side only. */
+    secretKey: string;
+    /** Optare API origin. Defaults to the hosted API. */
+    baseURL?: string;
+    /** `fetch` implementation. */
+    fetch?: typeof fetch;
+}
+declare class OptareApiError extends Error {
+    readonly status: number;
+    readonly body: unknown;
+    constructor(message: string, status: number, body: unknown);
+}
+interface ManagedOrganization {
+    id: string;
+    name: string;
+    slug: string;
+    type: string | null;
+    plan: string | null;
+    logoUrl: string | null;
+    parentTenantId: string | null;
+    metadata: unknown;
+    memberCount: number;
+    createdAt: string | null;
+    consumerPlanTemplate: string | null;
+    consumerEntitlements: Record<string, {
+        value: number | boolean | "unlimited";
+        source: string;
+    }>;
+}
+interface CreateOrganizationInput {
+    name: string;
+    slug?: string;
+    metadata?: Record<string, unknown>;
+}
+interface UpdateOrganizationInput {
+    name?: string;
+    logoUrl?: string;
+    plan?: string;
+    metadata?: Record<string, unknown>;
+    consumerPlanTemplate?: string | null;
+}
+interface InviteInput {
+    email: string;
+    role?: string;
+}
+interface OptareManagementClient {
+    organizations: {
+        list(): Promise<ManagedOrganization[]>;
+        create(input: CreateOrganizationInput): Promise<ManagedOrganization>;
+        get(id: string): Promise<ManagedOrganization>;
+        update(id: string, patch: UpdateOrganizationInput): Promise<ManagedOrganization>;
+        delete(id: string): Promise<void>;
+        invite(id: string, input: InviteInput): Promise<{
+            id: string;
+            email: string;
+            role: string;
+            expiresAt: string;
+        }>;
+    };
+}
+declare function createOptareManagementClient(config: ManagementClientConfig): OptareManagementClient;
+
+export { type CreateOrganizationInput, DEFAULT_OPTARE_ORIGIN, type InviteInput, type JwtVerifierConfig, type ManagedOrganization, type ManagementClientConfig, OptareApiError, OptareJwtError, type OptareJwtVerifier, type OptareManagementClient, type UpdateOrganizationInput, createOptareJwtVerifier, createOptareManagementClient };

package/dist/index.d.ts

@@ -0,0 +1,120 @@
+import { JWTPayload } from 'jose';
+
+/**
+ * `@optare/node` — E3.
+ *
+ * The server-side counterpart to `@optare/client`. Two independent pieces:
+ *
+ *  1. {@link createOptareJwtVerifier} — **offline** verification of
+ *     Optare-issued JWTs against the published JWKS. One key-set fetch, cached;
+ *     every `verify()` after that is local (signature + `iss`/`exp`/`aud`), no
+ *     network, no shared secret. This is what an SDK-integrated backend uses to
+ *     trust a bearer token from its front end.
+ *
+ *  2. {@link createOptareManagementClient} — thin, typed `fetch` wrappers over
+ *     the `sk_live_`-authenticated `/api/v1/*` surface (the C19 "wedge":
+ *     a developer manages *their customers'* organizations). `sk_live_` is a
+ *     secret — server-side only.
+ */
+declare const DEFAULT_OPTARE_ORIGIN = "https://id.optare.one";
+interface JwtVerifierConfig {
+    /**
+     * Origin the JWKS is published on (`${baseURL}/.well-known/jwks.json`).
+     * Defaults to the hosted Optare API.
+     */
+    baseURL?: string;
+    /** Full JWKS URL — overrides `baseURL`. */
+    jwksURL?: string;
+    /**
+     * Expected `iss` claim. Defaults to `baseURL` (that is what the backend
+     * signs with). Pass `null` to skip the issuer check.
+     */
+    issuer?: string | null;
+    /** Expected `aud` claim, if your tokens carry one. */
+    audience?: string;
+    /** Pre-fetched JWKS (`{ keys: [...] }`) — fully offline, no fetch ever. */
+    jwks?: {
+        keys: Array<Record<string, unknown>>;
+    };
+    /** `fetch` implementation (Node < 18, tests). */
+    fetch?: typeof fetch;
+    /** How long to cache the remote key set, ms. Default 1 hour. */
+    cacheTtlMs?: number;
+}
+interface OptareJwtVerifier {
+    /** Verified claims, or throws `OptareJwtError` if the token is not valid. */
+    verify(token: string): Promise<JWTPayload>;
+    /** Like {@link verify} but returns `null` instead of throwing. */
+    tryVerify(token: string): Promise<JWTPayload | null>;
+    /** Drop the cached key set (call after key rotation). */
+    invalidate(): void;
+}
+declare class OptareJwtError extends Error {
+    readonly cause?: unknown | undefined;
+    constructor(message: string, cause?: unknown | undefined);
+}
+declare function createOptareJwtVerifier(config?: JwtVerifierConfig): OptareJwtVerifier;
+interface ManagementClientConfig {
+    /** `sk_live_…` — secret. Server-side only. */
+    secretKey: string;
+    /** Optare API origin. Defaults to the hosted API. */
+    baseURL?: string;
+    /** `fetch` implementation. */
+    fetch?: typeof fetch;
+}
+declare class OptareApiError extends Error {
+    readonly status: number;
+    readonly body: unknown;
+    constructor(message: string, status: number, body: unknown);
+}
+interface ManagedOrganization {
+    id: string;
+    name: string;
+    slug: string;
+    type: string | null;
+    plan: string | null;
+    logoUrl: string | null;
+    parentTenantId: string | null;
+    metadata: unknown;
+    memberCount: number;
+    createdAt: string | null;
+    consumerPlanTemplate: string | null;
+    consumerEntitlements: Record<string, {
+        value: number | boolean | "unlimited";
+        source: string;
+    }>;
+}
+interface CreateOrganizationInput {
+    name: string;
+    slug?: string;
+    metadata?: Record<string, unknown>;
+}
+interface UpdateOrganizationInput {
+    name?: string;
+    logoUrl?: string;
+    plan?: string;
+    metadata?: Record<string, unknown>;
+    consumerPlanTemplate?: string | null;
+}
+interface InviteInput {
+    email: string;
+    role?: string;
+}
+interface OptareManagementClient {
+    organizations: {
+        list(): Promise<ManagedOrganization[]>;
+        create(input: CreateOrganizationInput): Promise<ManagedOrganization>;
+        get(id: string): Promise<ManagedOrganization>;
+        update(id: string, patch: UpdateOrganizationInput): Promise<ManagedOrganization>;
+        delete(id: string): Promise<void>;
+        invite(id: string, input: InviteInput): Promise<{
+            id: string;
+            email: string;
+            role: string;
+            expiresAt: string;
+        }>;
+    };
+}
+declare function createOptareManagementClient(config: ManagementClientConfig): OptareManagementClient;
+
+export { type CreateOrganizationInput, DEFAULT_OPTARE_ORIGIN, type InviteInput, type JwtVerifierConfig, type ManagedOrganization, type ManagementClientConfig, OptareApiError, OptareJwtError, type OptareJwtVerifier, type OptareManagementClient, type UpdateOrganizationInput, createOptareJwtVerifier, createOptareManagementClient };

package/dist/index.js

@@ -0,0 +1,176 @@
+// src/index.ts
+import {
+  createLocalJWKSet,
+  createRemoteJWKSet,
+  customFetch,
+  jwtVerify
+} from "jose";
+var DEFAULT_OPTARE_ORIGIN = "https://id.optare.one";
+var OptareJwtError = class extends Error {
+  constructor(message, cause) {
+    super(message);
+    this.cause = cause;
+    this.name = "OptareJwtError";
+  }
+  cause;
+};
+function trimSlash(s) {
+  return s.replace(/\/+$/, "");
+}
+function createOptareJwtVerifier(config = {}) {
+  const origin = trimSlash(config.baseURL ?? DEFAULT_OPTARE_ORIGIN);
+  const jwksURL = config.jwksURL ?? `${origin}/.well-known/jwks.json`;
+  const issuer = config.issuer === null ? void 0 : config.issuer ?? config.baseURL ?? origin;
+  const ttl = config.cacheTtlMs ?? 60 * 6e4;
+  let keySet = config.jwks ? createLocalJWKSet(config.jwks) : null;
+  let fetchedAt = config.jwks ? Date.now() : 0;
+  function keys() {
+    const stale = Date.now() - fetchedAt > ttl;
+    if (!keySet || stale && !config.jwks) {
+      keySet = createRemoteJWKSet(new URL(jwksURL), {
+        ...config.fetch ? { [customFetch]: config.fetch } : {}
+      });
+      fetchedAt = Date.now();
+    }
+    return keySet;
+  }
+  async function verify(token) {
+    if (!token || token.split(".").length !== 3) {
+      throw new OptareJwtError("Not a JWT");
+    }
+    try {
+      const { payload } = await jwtVerify(token, keys(), {
+        ...issuer ? { issuer } : {},
+        ...config.audience ? { audience: config.audience } : {}
+      });
+      return payload;
+    } catch (cause) {
+      throw new OptareJwtError(
+        `Token verification failed: ${cause.message}`,
+        cause
+      );
+    }
+  }
+  return {
+    verify,
+    async tryVerify(token) {
+      try {
+        return await verify(token);
+      } catch {
+        return null;
+      }
+    },
+    invalidate() {
+      if (!config.jwks) {
+        keySet = null;
+        fetchedAt = 0;
+      }
+    }
+  };
+}
+var OptareApiError = class extends Error {
+  constructor(message, status, body) {
+    super(message);
+    this.status = status;
+    this.body = body;
+    this.name = "OptareApiError";
+  }
+  status;
+  body;
+};
+var SECRET_KEY_PREFIX = "sk_live_";
+function createOptareManagementClient(config) {
+  if (!config.secretKey || !config.secretKey.startsWith(SECRET_KEY_PREFIX)) {
+    throw new OptareApiError(
+      `Invalid secret key \u2014 expected an "${SECRET_KEY_PREFIX}\u2026" string`,
+      0,
+      null
+    );
+  }
+  const origin = trimSlash(config.baseURL ?? DEFAULT_OPTARE_ORIGIN);
+  const doFetch = config.fetch ?? globalThis.fetch;
+  async function call(method, path, body) {
+    let res;
+    try {
+      res = await doFetch(`${origin}${path}`, {
+        method,
+        headers: {
+          authorization: `Bearer ${config.secretKey}`,
+          "content-type": "application/json",
+          accept: "application/json"
+        },
+        ...body !== void 0 ? { body: JSON.stringify(body) } : {}
+      });
+    } catch (cause) {
+      throw new OptareApiError(
+        `Request to ${origin}${path} failed: ${cause.message}`,
+        0,
+        null
+      );
+    }
+    const text = await res.text();
+    const parsed = text ? safeJson(text) : null;
+    if (!res.ok) {
+      const message = (parsed && typeof parsed === "object" && "error" in parsed ? String(parsed.error) : null) ?? `${res.status} ${res.statusText}`;
+      throw new OptareApiError(message, res.status, parsed);
+    }
+    return parsed;
+  }
+  return {
+    organizations: {
+      async list() {
+        const out = await call(
+          "GET",
+          "/api/v1/organizations"
+        );
+        return out.organizations;
+      },
+      async create(input) {
+        const out = await call(
+          "POST",
+          "/api/v1/organizations",
+          input
+        );
+        return out.organization;
+      },
+      async get(id) {
+        const out = await call(
+          "GET",
+          `/api/v1/organizations/${encodeURIComponent(id)}`
+        );
+        return out.organization;
+      },
+      async update(id, patch) {
+        const out = await call(
+          "PATCH",
+          `/api/v1/organizations/${encodeURIComponent(id)}`,
+          patch
+        );
+        return out.organization;
+      },
+      async delete(id) {
+        await call(
+          "DELETE",
+          `/api/v1/organizations/${encodeURIComponent(id)}`
+        );
+      },
+      async invite(id, input) {
+        return call("POST", `/api/v1/organizations/${encodeURIComponent(id)}/invite`, input);
+      }
+    }
+  };
+}
+function safeJson(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+}
+export {
+  DEFAULT_OPTARE_ORIGIN,
+  OptareApiError,
+  OptareJwtError,
+  createOptareJwtVerifier,
+  createOptareManagementClient
+};

package/package.json

@@ -0,0 +1,35 @@
+{
+  "name": "@optare/node",
+  "version": "0.1.0",
+  "description": "Server-side Optare SDK: sk_live_ management calls and offline JWT verification.",
+  "author": "Optare Team <admin@optare.one>",
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "files": [
+    "dist"
+  ],
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    }
+  },
+  "dependencies": {
+    "jose": "^6.1.1"
+  },
+  "devDependencies": {
+    "tsup": "^8.0.0",
+    "typescript": "^5.4.0"
+  },
+  "scripts": {
+    "build": "tsup src/index.ts --format cjs,esm --dts --clean",
+    "dev": "tsup src/index.ts --format cjs,esm --dts --watch"
+  }
+}