@orpc/server 2.0.0-beta.47 → 2.0.0-beta.48

package/dist/helpers/base64url.mjs

@@ -0,0 +1,25 @@
+import { encodeBase64 } from "@orpc/shared";
+
+export function encodeBase64url(data) {
+	return encodeBase64(data).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+
+export function decodeBase64url(base64url) {
+	try {
+		if (typeof base64url !== "string") {
+			return undefined;
+		}
+		let base64 = base64url.replace(/-/g, "+").replace(/_/g, "/");
+		while (base64.length % 4) {
+			base64 += "=";
+		}
+		const binaryString = atob(base64);
+		const bytes = new Uint8Array(binaryString.length);
+		for (let i = 0; i < binaryString.length; i++) {
+			bytes[i] = binaryString.charCodeAt(i);
+		}
+		return encodeBase64url(bytes) === base64url ? bytes : undefined;
+	} catch {
+		return undefined;
+	}
+}

package/dist/helpers/cookie.d.mts

@@ -0,0 +1,50 @@
+import type { ParseOptions, SetCookie, StringifyOptions } from "cookie";
+export interface SetCookieOptions extends Omit<SetCookie, "name" | "value">, StringifyOptions {
+	/**
+	* Specifies the value for the [`Path` `Set-Cookie` attribute](https://tools.ietf.org/html/rfc6265#section-5.2.4).
+	*
+	* @default '/'
+	*/
+	path?: string;
+}
+/**
+* Sets a cookie in the response headers.
+*
+* Does nothing if `headers` is `undefined`.
+*
+* @example
+* ```ts
+* const headers = new Headers()
+*
+* setCookie(headers, 'sessionId', 'abc123', { httpOnly: true, maxAge: 3600 })
+*
+* expect(headers.get('Set-Cookie')).toBe('sessionId=abc123; Max-Age=3600; Path=/; HttpOnly')
+* ```
+*
+* @see {@link https://orpc.dev/docs/helpers/cookie | Cookie Helpers}
+*/
+export declare function setCookie(headers: Headers | undefined, name: string, value: string, options?: SetCookieOptions): void;
+export interface GetCookieOptions extends ParseOptions {}
+/**
+* Gets a cookie value from request headers
+*
+* Returns `undefined` if the cookie is not found or headers are `undefined`.
+*
+* @example
+* ```ts
+* const headers = new Headers({ 'Cookie': 'sessionId=abc123; theme=dark' })
+*
+* const sessionId = getCookie(headers, 'sessionId')
+*
+* expect(sessionId).toEqual('abc123')
+* ```
+*
+* @see {@link https://orpc.dev/docs/helpers/cookie | Cookie Helpers}
+*/
+export declare function getCookie(headers: Headers | undefined, name: string, options?: GetCookieOptions): string | undefined;
+/**
+* Deletes a cookie by marking it expired.
+*
+* @see {@link https://orpc.dev/docs/helpers/cookie | Cookie Helpers}
+*/
+export declare function deleteCookie(headers: Headers | undefined, name: string, options?: Omit<SetCookieOptions, "maxAge">): void;

package/dist/helpers/cookie.mjs

@@ -0,0 +1,35 @@
+import { parseCookie, stringifySetCookie } from "cookie";
+
+export function setCookie(headers, name, value, options = {}) {
+	if (headers === undefined) {
+		return;
+	}
+	const cookieString = stringifySetCookie({
+		
+		
+		
+		path: "/",
+		...options,
+		name,
+		value
+	}, options);
+	headers.append("Set-Cookie", cookieString);
+}
+
+export function getCookie(headers, name, options = {}) {
+	if (headers === undefined) {
+		return undefined;
+	}
+	const cookieHeader = headers.get("cookie");
+	if (cookieHeader === null) {
+		return undefined;
+	}
+	return parseCookie(cookieHeader, options)[name];
+}
+
+export function deleteCookie(headers, name, options = {}) {
+	return setCookie(headers, name, "", {
+		...options,
+		maxAge: 0
+	});
+}

package/dist/helpers/encryption.d.mts

@@ -0,0 +1,28 @@
+/**
+* Encrypts a string using AES-GCM with a secret key.
+* The output is base64url encoded to be URL-safe.
+*
+* @example
+* ```ts
+* const encrypted = await encrypt("Hello, World!", "test-secret-key")
+* const decrypted = await decrypt(encrypted, "test-secret-key")
+* expect(decrypted).toBe("Hello, World!")
+* ```
+*
+* @see {@link https://orpc.dev/docs/helpers/encryption | Encryption Helpers}
+*/
+export declare function encrypt(value: string, secret: string): Promise<string>;
+/**
+* Decrypts a base64url encoded string using AES-GCM with a secret key.
+* Returns the original string if decryption is successful, or undefined if it fails.
+*
+* @example
+* ```ts
+* const encrypted = await encrypt("Hello, World!", "test-secret-key")
+* const decrypted = await decrypt(encrypted, "test-secret-key")
+* expect(decrypted).toBe("Hello, World!")
+* ```
+*
+* @see {@link https://orpc.dev/docs/helpers/encryption | Encryption Helpers}
+*/
+export declare function decrypt(encrypted: string | undefined | null, secret: string): Promise<string | undefined>;

package/dist/helpers/encryption.mjs

@@ -0,0 +1,62 @@
+import { decodeBase64url, encodeBase64url } from "./base64url.mjs";
+const PBKDF2_CONFIG = {
+	name: "PBKDF2",
+	iterations: 6e4,
+	hash: "SHA-256"
+};
+const AES_GCM_CONFIG = {
+	name: "AES-GCM",
+	length: 256
+};
+const CRYPTO_CONSTANTS = {
+	SALT_LENGTH: 16,
+	IV_LENGTH: 12
+};
+
+export async function encrypt(value, secret) {
+	const encoder = new TextEncoder();
+	const data = encoder.encode(value);
+	const salt = crypto.getRandomValues(new Uint8Array(CRYPTO_CONSTANTS.SALT_LENGTH));
+	const keyMaterial = await crypto.subtle.importKey("raw", encoder.encode(secret), PBKDF2_CONFIG.name, false, ["deriveKey"]);
+	const key = await crypto.subtle.deriveKey({
+		...PBKDF2_CONFIG,
+		salt
+	}, keyMaterial, AES_GCM_CONFIG, false, ["encrypt"]);
+	const iv = crypto.getRandomValues(new Uint8Array(CRYPTO_CONSTANTS.IV_LENGTH));
+	const encrypted = await crypto.subtle.encrypt({
+		name: AES_GCM_CONFIG.name,
+		iv
+	}, key, data);
+	const result = new Uint8Array(salt.length + iv.length + encrypted.byteLength);
+	result.set(salt, 0);
+	result.set(iv, salt.length);
+	result.set(new Uint8Array(encrypted), salt.length + iv.length);
+	return encodeBase64url(result);
+}
+
+export async function decrypt(encrypted, secret) {
+	try {
+		const data = decodeBase64url(encrypted);
+		if (data === undefined) {
+			return undefined;
+		}
+		const encoder = new TextEncoder();
+		const decoder = new TextDecoder();
+		const salt = data.slice(0, CRYPTO_CONSTANTS.SALT_LENGTH);
+		const iv = data.slice(CRYPTO_CONSTANTS.SALT_LENGTH, CRYPTO_CONSTANTS.SALT_LENGTH + CRYPTO_CONSTANTS.IV_LENGTH);
+		const encryptedData = data.slice(CRYPTO_CONSTANTS.SALT_LENGTH + CRYPTO_CONSTANTS.IV_LENGTH);
+		const keyMaterial = await crypto.subtle.importKey("raw", encoder.encode(secret), PBKDF2_CONFIG.name, false, ["deriveKey"]);
+		const key = await crypto.subtle.deriveKey({
+			...PBKDF2_CONFIG,
+			salt
+		}, keyMaterial, AES_GCM_CONFIG, false, ["decrypt"]);
+		const decrypted = await crypto.subtle.decrypt({
+			name: AES_GCM_CONFIG.name,
+			iv
+		}, key, encryptedData);
+		return decoder.decode(decrypted);
+	} catch {
+		
+		return undefined;
+	}
+}

package/dist/helpers/index.d.mts

@@ -1,167 +1,4 @@
-import { ParseOptions, SetCookie, StringifyOptions } from 'cookie';
-
-/**
- * Encodes a Uint8Array to base64url format
- * Base64url is URL-safe and doesn't use padding
- *
- * @example
- * ```ts
- * const text = "Hello World"
- * const encoded = encodeBase64url(new TextEncoder().encode(text))
- * const decoded = decodeBase64url(encoded)
- * expect(new TextDecoder().decode(decoded)).toEqual(text)
- * ```
- *
- * @see {@link https://orpc.dev/docs/helpers/base64url | Base64Url Helpers}
- */
-declare function encodeBase64url(data: Uint8Array): string;
-/**
- * Decodes a base64url string to Uint8Array
- * Only accepts canonical, unpadded base64url (the form produced by `encodeBase64url`),
- * returns undefined for anything else, including padded or standard base64 input
- *
- * @example
- * ```ts
- * const text = "Hello World"
- * const encoded = encodeBase64url(new TextEncoder().encode(text))
- * const decoded = decodeBase64url(encoded)
- * expect(new TextDecoder().decode(decoded)).toEqual(text)
- * ```
- *
- * @see {@link https://orpc.dev/docs/helpers/base64url | Base64Url Helpers}
- */
-declare function decodeBase64url(base64url: string | undefined | null): Uint8Array<ArrayBuffer> | undefined;
-
-interface SetCookieOptions extends Omit<SetCookie, 'name' | 'value'>, StringifyOptions {
-    /**
-     * Specifies the value for the [`Path` `Set-Cookie` attribute](https://tools.ietf.org/html/rfc6265#section-5.2.4).
-     *
-     * @default '/'
-     */
-    path?: string;
-}
-/**
- * Sets a cookie in the response headers.
- *
- * Does nothing if `headers` is `undefined`.
- *
- * @example
- * ```ts
- * const headers = new Headers()
- *
- * setCookie(headers, 'sessionId', 'abc123', { httpOnly: true, maxAge: 3600 })
- *
- * expect(headers.get('Set-Cookie')).toBe('sessionId=abc123; Max-Age=3600; Path=/; HttpOnly')
- * ```
- *
- * @see {@link https://orpc.dev/docs/helpers/cookie | Cookie Helpers}
- */
-declare function setCookie(headers: Headers | undefined, name: string, value: string, options?: SetCookieOptions): void;
-interface GetCookieOptions extends ParseOptions {
-}
-/**
- * Gets a cookie value from request headers
- *
- * Returns `undefined` if the cookie is not found or headers are `undefined`.
- *
- * @example
- * ```ts
- * const headers = new Headers({ 'Cookie': 'sessionId=abc123; theme=dark' })
- *
- * const sessionId = getCookie(headers, 'sessionId')
- *
- * expect(sessionId).toEqual('abc123')
- * ```
- *
- * @see {@link https://orpc.dev/docs/helpers/cookie | Cookie Helpers}
- */
-declare function getCookie(headers: Headers | undefined, name: string, options?: GetCookieOptions): string | undefined;
-/**
- * Deletes a cookie by marking it expired.
- *
- * @see {@link https://orpc.dev/docs/helpers/cookie | Cookie Helpers}
- */
-declare function deleteCookie(headers: Headers | undefined, name: string, options?: Omit<SetCookieOptions, 'maxAge'>): void;
-
-/**
- * Encrypts a string using AES-GCM with a secret key.
- * The output is base64url encoded to be URL-safe.
- *
- * @example
- * ```ts
- * const encrypted = await encrypt("Hello, World!", "test-secret-key")
- * const decrypted = await decrypt(encrypted, "test-secret-key")
- * expect(decrypted).toBe("Hello, World!")
- * ```
- *
- * @see {@link https://orpc.dev/docs/helpers/encryption | Encryption Helpers}
- */
-declare function encrypt(value: string, secret: string): Promise<string>;
-/**
- * Decrypts a base64url encoded string using AES-GCM with a secret key.
- * Returns the original string if decryption is successful, or undefined if it fails.
- *
- * @example
- * ```ts
- * const encrypted = await encrypt("Hello, World!", "test-secret-key")
- * const decrypted = await decrypt(encrypted, "test-secret-key")
- * expect(decrypted).toBe("Hello, World!")
- * ```
- *
- * @see {@link https://orpc.dev/docs/helpers/encryption | Encryption Helpers}
- */
-declare function decrypt(encrypted: string | undefined | null, secret: string): Promise<string | undefined>;
-
-/**
- * Signs a string value using HMAC-SHA256 with a secret key.
- *
- * This function creates a cryptographic signature that can be used to verify
- * the integrity and authenticity of the data. The signature is appended to
- * the original value, separated by a dot, using base64url encoding (no padding).
- *
- * @example
- * ```ts
- * const signedValue = await sign("user123", "my-secret-key")
- * expect(signedValue).toEqual("user123.oneQsU0r5dvwQFHFEjjV1uOI_IR3gZfkYHij3TRauVA")
- * ```
- *
- * @see {@link https://orpc.dev/docs/helpers/signing | Signing Helpers}
- */
-declare function sign(value: string, secret: string): Promise<string>;
-/**
- * Verifies and extracts the original value from a signed string.
- *
- * This function validates the signature of a previously signed value using the same
- * secret key. If the signature is valid, it returns the original value. If the
- * signature is invalid or the format is incorrect, it returns undefined.
- *
- * @example
- * ```ts
- * const signedValue = "user123.oneQsU0r5dvwQFHFEjjV1uOI_IR3gZfkYHij3TRauVA"
- * const originalValue = await unsign(signedValue, "my-secret-key")
- * expect(originalValue).toEqual("user123")
- * ```
- *
- * @see {@link https://orpc.dev/docs/helpers/signing | Signing Helpers}
- */
-declare function unsign(signedValue: string | undefined | null, secret: string): Promise<string | undefined>;
-/**
- * Extracts the value part from a signed string without verification.
- *
- * This function simply extracts the original value from a signed string
- * without performing any signature verification. It's useful when you need
- * to access the value quickly without the overhead of cryptographic verification.
- *
- * @example
- * ```ts
- * const signedValue = "user123.oneQsU0r5dvwQFHFEjjV1uOI_IR3gZfkYHij3TRauVA"
- * const value = getSignedValue(signedValue)
- * expect(value).toEqual("user123")
- * ```
- *
- * @see {@link https://orpc.dev/docs/helpers/signing | Signing Helpers}
- */
-declare function getSignedValue(signedValue: string | undefined | null): string | undefined;
-
-export { decodeBase64url, decrypt, deleteCookie, encodeBase64url, encrypt, getCookie, getSignedValue, setCookie, sign, unsign };
-export type { GetCookieOptions, SetCookieOptions };
+export * from "./base64url.mjs";
+export * from "./cookie.mjs";
+export * from "./encryption.mjs";
+export * from "./signing.mjs";

package/dist/helpers/index.mjs

@@ -1,200 +1,4 @@
-import { encodeBase64 } from '@orpc/shared';
-import { parseCookie, stringifySetCookie } from 'cookie';
-
-function encodeBase64url(data) {
-  return encodeBase64(data).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
-}
-function decodeBase64url(base64url) {
-  try {
-    if (typeof base64url !== "string") {
-      return void 0;
-    }
-    let base64 = base64url.replace(/-/g, "+").replace(/_/g, "/");
-    while (base64.length % 4) {
-      base64 += "=";
-    }
-    const binaryString = atob(base64);
-    const bytes = new Uint8Array(binaryString.length);
-    for (let i = 0; i < binaryString.length; i++) {
-      bytes[i] = binaryString.charCodeAt(i);
-    }
-    return encodeBase64url(bytes) === base64url ? bytes : void 0;
-  } catch {
-    return void 0;
-  }
-}
-
-function setCookie(headers, name, value, options = {}) {
-  if (headers === void 0) {
-    return;
-  }
-  const cookieString = stringifySetCookie({
-    // Force path to '/' by default so the cookie is available across the
-    // entire app, not just under the directory of the request that set it
-    // (which is what browsers do per RFC 6265 §5.1.4 when Path is omitted).
-    path: "/",
-    ...options,
-    name,
-    // prioritize
-    value
-    // prioritize
-  }, options);
-  headers.append("Set-Cookie", cookieString);
-}
-function getCookie(headers, name, options = {}) {
-  if (headers === void 0) {
-    return void 0;
-  }
-  const cookieHeader = headers.get("cookie");
-  if (cookieHeader === null) {
-    return void 0;
-  }
-  return parseCookie(cookieHeader, options)[name];
-}
-function deleteCookie(headers, name, options = {}) {
-  return setCookie(headers, name, "", {
-    ...options,
-    maxAge: 0
-    // prioritize
-  });
-}
-
-const PBKDF2_CONFIG = {
-  name: "PBKDF2",
-  iterations: 6e4,
-  // Recommended minimum iterations per current OWASP guidelines
-  hash: "SHA-256"
-};
-const AES_GCM_CONFIG = {
-  name: "AES-GCM",
-  length: 256
-};
-const CRYPTO_CONSTANTS = {
-  SALT_LENGTH: 16,
-  IV_LENGTH: 12
-};
-async function encrypt(value, secret) {
-  const encoder = new TextEncoder();
-  const data = encoder.encode(value);
-  const salt = crypto.getRandomValues(new Uint8Array(CRYPTO_CONSTANTS.SALT_LENGTH));
-  const keyMaterial = await crypto.subtle.importKey(
-    "raw",
-    encoder.encode(secret),
-    PBKDF2_CONFIG.name,
-    false,
-    ["deriveKey"]
-  );
-  const key = await crypto.subtle.deriveKey(
-    { ...PBKDF2_CONFIG, salt },
-    keyMaterial,
-    AES_GCM_CONFIG,
-    false,
-    ["encrypt"]
-  );
-  const iv = crypto.getRandomValues(new Uint8Array(CRYPTO_CONSTANTS.IV_LENGTH));
-  const encrypted = await crypto.subtle.encrypt(
-    { name: AES_GCM_CONFIG.name, iv },
-    key,
-    data
-  );
-  const result = new Uint8Array(salt.length + iv.length + encrypted.byteLength);
-  result.set(salt, 0);
-  result.set(iv, salt.length);
-  result.set(new Uint8Array(encrypted), salt.length + iv.length);
-  return encodeBase64url(result);
-}
-async function decrypt(encrypted, secret) {
-  try {
-    const data = decodeBase64url(encrypted);
-    if (data === void 0) {
-      return void 0;
-    }
-    const encoder = new TextEncoder();
-    const decoder = new TextDecoder();
-    const salt = data.slice(0, CRYPTO_CONSTANTS.SALT_LENGTH);
-    const iv = data.slice(CRYPTO_CONSTANTS.SALT_LENGTH, CRYPTO_CONSTANTS.SALT_LENGTH + CRYPTO_CONSTANTS.IV_LENGTH);
-    const encryptedData = data.slice(CRYPTO_CONSTANTS.SALT_LENGTH + CRYPTO_CONSTANTS.IV_LENGTH);
-    const keyMaterial = await crypto.subtle.importKey(
-      "raw",
-      encoder.encode(secret),
-      PBKDF2_CONFIG.name,
-      false,
-      ["deriveKey"]
-    );
-    const key = await crypto.subtle.deriveKey(
-      { ...PBKDF2_CONFIG, salt },
-      keyMaterial,
-      AES_GCM_CONFIG,
-      false,
-      ["decrypt"]
-    );
-    const decrypted = await crypto.subtle.decrypt(
-      { name: AES_GCM_CONFIG.name, iv },
-      key,
-      encryptedData
-    );
-    return decoder.decode(decrypted);
-  } catch {
-    return void 0;
-  }
-}
-
-const ALGORITHM = { name: "HMAC", hash: "SHA-256" };
-async function sign(value, secret) {
-  const encoder = new TextEncoder();
-  const key = await crypto.subtle.importKey(
-    "raw",
-    encoder.encode(secret),
-    ALGORITHM,
-    false,
-    ["sign"]
-  );
-  const signature = await crypto.subtle.sign(
-    ALGORITHM,
-    key,
-    encoder.encode(value)
-  );
-  return `${value}.${encodeBase64url(new Uint8Array(signature))}`;
-}
-async function unsign(signedValue, secret) {
-  if (typeof signedValue !== "string") {
-    return void 0;
-  }
-  const lastDotIndex = signedValue.lastIndexOf(".");
-  if (lastDotIndex === -1) {
-    return void 0;
-  }
-  const value = signedValue.slice(0, lastDotIndex);
-  const signatureBase64url = signedValue.slice(lastDotIndex + 1);
-  const signature = decodeBase64url(signatureBase64url);
-  if (signature === void 0) {
-    return void 0;
-  }
-  const encoder = new TextEncoder();
-  const key = await crypto.subtle.importKey(
-    "raw",
-    encoder.encode(secret),
-    ALGORITHM,
-    false,
-    ["verify"]
-  );
-  const isValid = await crypto.subtle.verify(
-    ALGORITHM,
-    key,
-    signature,
-    encoder.encode(value)
-  );
-  return isValid ? value : void 0;
-}
-function getSignedValue(signedValue) {
-  if (typeof signedValue !== "string") {
-    return void 0;
-  }
-  const lastDotIndex = signedValue.lastIndexOf(".");
-  if (lastDotIndex === -1) {
-    return void 0;
-  }
-  return signedValue.slice(0, lastDotIndex);
-}
-
-export { decodeBase64url, decrypt, deleteCookie, encodeBase64url, encrypt, getCookie, getSignedValue, setCookie, sign, unsign };
+export * from "./base64url.mjs";
+export * from "./cookie.mjs";
+export * from "./encryption.mjs";
+export * from "./signing.mjs";

package/dist/helpers/signing.d.mts

@@ -0,0 +1,50 @@
+/**
+* Signs a string value using HMAC-SHA256 with a secret key.
+*
+* This function creates a cryptographic signature that can be used to verify
+* the integrity and authenticity of the data. The signature is appended to
+* the original value, separated by a dot, using base64url encoding (no padding).
+*
+* @example
+* ```ts
+* const signedValue = await sign("user123", "my-secret-key")
+* expect(signedValue).toEqual("user123.oneQsU0r5dvwQFHFEjjV1uOI_IR3gZfkYHij3TRauVA")
+* ```
+*
+* @see {@link https://orpc.dev/docs/helpers/signing | Signing Helpers}
+*/
+export declare function sign(value: string, secret: string): Promise<string>;
+/**
+* Verifies and extracts the original value from a signed string.
+*
+* This function validates the signature of a previously signed value using the same
+* secret key. If the signature is valid, it returns the original value. If the
+* signature is invalid or the format is incorrect, it returns undefined.
+*
+* @example
+* ```ts
+* const signedValue = "user123.oneQsU0r5dvwQFHFEjjV1uOI_IR3gZfkYHij3TRauVA"
+* const originalValue = await unsign(signedValue, "my-secret-key")
+* expect(originalValue).toEqual("user123")
+* ```
+*
+* @see {@link https://orpc.dev/docs/helpers/signing | Signing Helpers}
+*/
+export declare function unsign(signedValue: string | undefined | null, secret: string): Promise<string | undefined>;
+/**
+* Extracts the value part from a signed string without verification.
+*
+* This function simply extracts the original value from a signed string
+* without performing any signature verification. It's useful when you need
+* to access the value quickly without the overhead of cryptographic verification.
+*
+* @example
+* ```ts
+* const signedValue = "user123.oneQsU0r5dvwQFHFEjjV1uOI_IR3gZfkYHij3TRauVA"
+* const value = getSignedValue(signedValue)
+* expect(value).toEqual("user123")
+* ```
+*
+* @see {@link https://orpc.dev/docs/helpers/signing | Signing Helpers}
+*/
+export declare function getSignedValue(signedValue: string | undefined | null): string | undefined;

package/dist/helpers/signing.mjs

@@ -0,0 +1,43 @@
+import { decodeBase64url, encodeBase64url } from "./base64url.mjs";
+const ALGORITHM = {
+	name: "HMAC",
+	hash: "SHA-256"
+};
+
+export async function sign(value, secret) {
+	const encoder = new TextEncoder();
+	const key = await crypto.subtle.importKey("raw", encoder.encode(secret), ALGORITHM, false, ["sign"]);
+	const signature = await crypto.subtle.sign(ALGORITHM, key, encoder.encode(value));
+	return `${value}.${encodeBase64url(new Uint8Array(signature))}`;
+}
+
+export async function unsign(signedValue, secret) {
+	if (typeof signedValue !== "string") {
+		return undefined;
+	}
+	const lastDotIndex = signedValue.lastIndexOf(".");
+	if (lastDotIndex === -1) {
+		return undefined;
+	}
+	const value = signedValue.slice(0, lastDotIndex);
+	const signatureBase64url = signedValue.slice(lastDotIndex + 1);
+	const signature = decodeBase64url(signatureBase64url);
+	if (signature === undefined) {
+		return undefined;
+	}
+	const encoder = new TextEncoder();
+	const key = await crypto.subtle.importKey("raw", encoder.encode(secret), ALGORITHM, false, ["verify"]);
+	const isValid = await crypto.subtle.verify(ALGORITHM, key, signature, encoder.encode(value));
+	return isValid ? value : undefined;
+}
+
+export function getSignedValue(signedValue) {
+	if (typeof signedValue !== "string") {
+		return undefined;
+	}
+	const lastDotIndex = signedValue.lastIndexOf(".");
+	if (lastDotIndex === -1) {
+		return undefined;
+	}
+	return signedValue.slice(0, lastDotIndex);
+}