@sourceregistry/node-jwt 1.0.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,171 @@
+# 🔐 node-jwt
+
+[![npm version](https://img.shields.io/npm/v/@sourceregistry/node-jwt?logo=npm)](https://www.npmjs.com/package/@sourceregistry/node-jwt)
+[![License](https://img.shields.io/npm/l/@sourceregistry/node-jwt)](LICENSE)
+[![Tests](https://github.com/SourceRegistry/node-jwt/actions/workflows/test.yml/badge.svg)](https://github.com/SourceRegistry/node-jwt/actions)
+[![Coverage](https://img.shields.io/codecov/c/github/SourceRegistry/node-jwt)](https://codecov.io/gh/SourceRegistry/node-jwt)
+
+A **minimal**, **secure**, and **production-ready** JWT (JSON Web Token) library for Node.js with **zero dependencies**. Supports all standard signing algorithms (HMAC, RSA, ECDSA) and full claim validation.
+
+> ✨ **Why another JWT library?**  
+> Most JWT libraries are bloated, have security pitfalls, or lack proper TypeScript support. This library is:
+> - **Tiny**
+> - **Secure by default** (correct ECDSA/RSA encoding, time validation)
+> - **TypeScript-first** with full JSDoc
+> - **No external dependencies**
+> - **100% test coverage**
+
+---
+
+## 📦 Installation
+
+```bash
+npm install @sourceregistry/node-jwt
+```
+
+> **Requires Node.js ≥ 16**
+
+---
+
+## 🚀 Quick Start
+
+### Sign a token
+```ts
+import { sign } from '@sourceregistry/node-jwt';
+
+const token = sign(
+  { sub: '1234567890', name: 'John Doe', iat: Math.floor(Date.now() / 1000) },
+  'your-secret-key',
+  { alg: 'HS256' }
+);
+```
+
+### Verify a token
+```ts
+import { verify } from '@sourceregistry/node-jwt';
+
+const result = verify(token, 'your-secret-key');
+
+if (result.valid) {
+  console.log('Payload:', result.payload);
+} else {
+  console.error('JWT Error:', result.error.code, result.error.reason);
+}
+```
+
+### Decode (unsafe — no verification)
+```ts
+import { decode } from '@sourceregistry/node-jwt';
+
+const { header, payload, signature } = decode(token);
+```
+
+---
+
+## 🔑 Supported Algorithms
+
+| Algorithm | Type    | Secret Type                     |
+|-----------|---------|---------------------------------|
+| `HS256`   | HMAC    | `string \| Buffer`              |
+| `HS384`   | HMAC    | `string \| Buffer`              |
+| `HS512`   | HMAC    | `string \| Buffer`              |
+| `RS256`   | RSA     | Private key (signing)<br>Public key (verifying) |
+| `RS384`   | RSA     | Private key (signing)<br>Public key (verifying) |
+| `RS512`   | RSA     | Private key (signing)<br>Public key (verifying) |
+| `ES256`   | ECDSA   | Private key (signing)<br>Public key (verifying) |
+| `ES384`   | ECDSA   | Private key (signing)<br>Public key (verifying) |
+| `ES512`   | ECDSA   | Private key (signing)<br>Public key (verifying) |
+
+> 💡 **Note**: RSA/ECDSA keys must be in **PEM format** or as Node.js `KeyObject`.
+
+---
+
+## 🛡️ Security Features
+
+- ✅ **Correct ECDSA signatures** (DER-encoded, not IEEE P1363)
+- ✅ **Strict algorithm validation** (prevents algorithm confusion attacks)
+- ✅ **Time claim validation** (`exp`, `nbf`, `iat`) with **clock skew tolerance**
+- ✅ **Type header enforcement** (`typ: 'JWT'`)
+- ✅ **No unsafe defaults**
+
+---
+
+## 📚 API Reference
+
+### `sign(payload, secret, options?)`
+Sign a JWT.
+
+- `payload`: `JWTPayload` object
+- `secret`: Key for signing (type depends on algorithm)
+- `options`:
+    - `alg`: Algorithm (default: `'HS256'`)
+    - `kid`: Key ID
+    - `typ`: Token type (default: `'JWT'`)
+
+Returns: `string` (JWT)
+
+---
+
+### `verify(token, secret, options?)`
+Verify and validate a JWT.
+
+- `token`: JWT string
+- `secret`: Key for verification
+- `options`:
+    - `ignoreExpiration`: Skip `exp` check (default: `false`)
+    - `clockSkew`: Tolerance in seconds for time validation (default: `0`)
+
+Returns:
+```ts
+| { valid: true; header: JWTHeader; payload: JWTPayload; signature: string }
+| { valid: false; error: { reason: string; code: string } }
+```
+
+**Error Codes**:
+- `INVALID_TOKEN`: Malformed token structure
+- `INVALID_ALGORITHM`: Unsupported algorithm
+- `INVALID_TYPE`: Invalid `typ` header
+- `INVALID_SIGNATURE`: Signature mismatch
+- `TOKEN_EXPIRED`: `exp` claim exceeded
+- `TOKEN_NOT_ACTIVE`: `nbf` claim not reached
+- `TOKEN_FUTURE_ISSUED`: `iat` claim in future
+
+---
+
+### `decode(token)`
+Decode a JWT without verification (use with caution!).
+
+- `token`: JWT string
+
+Returns: `{ header, payload, signature }`
+
+Throws on malformed tokens.
+
+---
+
+## 🧪 Testing
+
+This library has **100% test coverage** with Vitest:
+
+```bash
+npm test
+npm run test:coverage
+```
+
+Tests include:
+- All algorithms (HMAC, RSA, ECDSA)
+- Time validation edge cases
+- Malformed token handling
+- Signature verification
+- Custom claims
+
+---
+
+## 🙌 Contributing
+
+PRs welcome! Please:
+1. Add tests for new features
+2. Maintain 100% coverage
+3. Follow existing code style
+
+Found a security issue? [Report it responsibly](mailto:a.p.a.slaa@projectsource.nl).

package/dist/index.cjs.js

@@ -0,0 +1,2 @@
+"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const a=require("crypto"),d={encode:e=>Buffer.from(e).toString("base64url"),decode:e=>Buffer.from(e,"base64url").toString()},c={HS256:{sign:(e,r)=>a.createHmac("sha256",r).update(e).digest("base64url"),verify:(e,r,t)=>a.createHmac("sha256",r).update(e).digest("base64url")===t},HS384:{sign:(e,r)=>a.createHmac("sha384",r).update(e).digest("base64url"),verify:(e,r,t)=>a.createHmac("sha384",r).update(e).digest("base64url")===t},HS512:{sign:(e,r)=>a.createHmac("sha512",r).update(e).digest("base64url"),verify:(e,r,t)=>a.createHmac("sha512",r).update(e).digest("base64url")===t},RS256:{sign:(e,r)=>a.createSign("RSA-SHA256").update(e).end().sign(r).toString("base64url"),verify:(e,r,t)=>a.createVerify("RSA-SHA256").update(e).end().verify(r,Buffer.from(t,"base64url"))},RS384:{sign:(e,r)=>a.createSign("RSA-SHA384").update(e).end().sign(r).toString("base64url"),verify:(e,r,t)=>a.createVerify("RSA-SHA384").update(e).end().verify(r,Buffer.from(t,"base64url"))},RS512:{sign:(e,r)=>a.createSign("RSA-SHA512").update(e).end().sign(r).toString("base64url"),verify:(e,r,t)=>a.createVerify("RSA-SHA512").update(e).end().verify(r,Buffer.from(t,"base64url"))},ES256:{sign:(e,r)=>a.createSign("SHA256").update(e).end().sign(r).toString("base64url"),verify:(e,r,t)=>a.createVerify("SHA256").update(e).end().verify(r,Buffer.from(t,"base64url"))},ES384:{sign:(e,r)=>a.createSign("SHA384").update(e).end().sign(r).toString("base64url"),verify:(e,r,t)=>a.createVerify("SHA384").update(e).end().verify(r,Buffer.from(t,"base64url"))},ES512:{sign:(e,r)=>a.createSign("SHA512").update(e).end().sign(r).toString("base64url"),verify:(e,r,t)=>a.createVerify("SHA512").update(e).end().verify(r,Buffer.from(t,"base64url"))}},b=Object.keys(c),S=e=>{const r=e.split(".");if(r.length!==3)throw new Error('Invalid JWT: must contain exactly 3 parts separated by "."');const[t,s,i]=r;if(!t||!s||!i)throw new Error("Invalid JWT: empty part detected");try{const n=JSON.parse(d.decode(t)),o=JSON.parse(d.decode(s));return{header:n,payload:o,signature:i}}catch(n){throw new Error(`Invalid JWT: malformed header or payload (${n.message})`)}},y=(e,r,t={})=>{const s=t.alg??"HS256",i=t.typ??"JWT";if(!(s in c))throw new Error(`Unsupported algorithm: ${s}`);const n={alg:s,typ:i};t.kid&&(n.kid=t.kid);const o=d.encode(JSON.stringify(n)),u=d.encode(JSON.stringify(e)),f=`${o}.${u}`,p=c[s].sign(f,r);return`${o}.${u}.${p}`},v=(e,r,t={})=>{let s;try{s=S(e)}catch(A){return{valid:!1,error:{reason:A.message,code:"INVALID_TOKEN"}}}const{header:i,payload:n,signature:o}=s,u=i.alg;if(!(u in c))return{valid:!1,error:{reason:`Unsupported or unknown algorithm: ${i.alg}`,code:"INVALID_ALGORITHM"}};if(i.typ&&i.typ!=="JWT")return{valid:!1,error:{reason:`Invalid token type: expected 'JWT', got '${i.typ}'`,code:"INVALID_TYPE"}};const f=`${d.encode(JSON.stringify(i))}.${d.encode(JSON.stringify(n))}`;if(!c[u].verify(f,r,o))return{valid:!1,error:{reason:"Signature verification failed",code:"INVALID_SIGNATURE"}};const g=Math.floor(Date.now()/1e3),l=t.clockSkew??0;return!t.ignoreExpiration&&n.exp!==void 0&&g>n.exp+l?{valid:!1,error:{reason:"Token expired",code:"TOKEN_EXPIRED"}}:n.nbf!==void 0&&g+l<n.nbf?{valid:!1,error:{reason:"Token not yet valid",code:"TOKEN_NOT_ACTIVE"}}:n.iat!==void 0&&g+l<n.iat?{valid:!1,error:{reason:"Token issued in the future",code:"TOKEN_FUTURE_ISSUED"}}:{valid:!0,header:i,payload:n,signature:o}},h={sign:y,verify:v,decode:S,algorithms:c};exports.JWT=h;exports.SignatureAlgorithm=c;exports.SupportedAlgorithms=b;exports.base64Url=d;exports.decode=S;exports.sign=y;exports.verify=v;
+//# sourceMappingURL=index.cjs.js.map

package/dist/index.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs.js","sources":["../src/index.ts"],"sourcesContent":["import {\n    createHmac,\n    createSign,\n    createVerify,\n    type BinaryLike,\n    type KeyLike\n} from 'crypto';\n\n// Base64URL helpers (padding-safe)\nexport const base64Url = {\n    encode: (input: string | Buffer): string =>\n        Buffer.from(input).toString('base64url'),\n\n    decode: (input: string): string => {\n        // Node.js Buffer handles unpadded base64url since v16, but we normalize for safety\n        return Buffer.from(input, 'base64url').toString();\n    }\n};\n\n// Standard JWT payload claims\nexport interface JWTPayload {\n    /**\n     * Issuer\n     */\n    iss?: string;\n    /**\n     * Subject\n     */\n    sub?: string;\n    /**\n     * Audience\n     */\n    aud?: string | string[];\n    /**\n     * Expiration Time (as UNIX timestamp)\n     */\n    exp?: number;\n    /**\n     * Not Before (as UNIX timestamp)\n     */\n    nbf?: number;\n    /**\n     * Issued At (as UNIX timestamp)\n     */\n    iat?: number;\n    /**\n     * JWT ID\n     */\n    jti?: string;\n    /**\n     * Session ID\n     */\n    sid?: string;\n    /**\n     * Custom claims\n     */\n    [key: string]: unknown;\n}\n\nexport interface JWTHeader {\n    alg: string; // Allow unknown algs during decode\n    typ?: string;\n    kid?: string;\n}\n\nexport interface JWT {\n    header: JWTHeader;\n    payload: JWTPayload;\n    signature: string;\n}\n\n// Signature algorithms\nexport const SignatureAlgorithm = {\n    // HMAC\n    HS256: {\n        sign: (data: BinaryLike, secret: KeyLike) =>\n            createHmac('sha256', secret).update(data).digest('base64url'),\n        verify: (data: BinaryLike, secret: KeyLike, signature: string) =>\n            createHmac('sha256', secret).update(data).digest('base64url') === signature\n    },\n    HS384: {\n        sign: (data: BinaryLike, secret: KeyLike) =>\n            createHmac('sha384', secret).update(data).digest('base64url'),\n        verify: (data: BinaryLike, secret: KeyLike, signature: string) =>\n            createHmac('sha384', secret).update(data).digest('base64url') === signature\n    },\n    HS512: {\n        sign: (data: BinaryLike, secret: KeyLike) =>\n            createHmac('sha512', secret).update(data).digest('base64url'),\n        verify: (data: BinaryLike, secret: KeyLike, signature: string) =>\n            createHmac('sha512', secret).update(data).digest('base64url') === signature\n    },\n\n    // RSA (DER-encoded signatures, base64url)\n    RS256: {\n        sign: (data: BinaryLike, secret: KeyLike) =>\n            createSign('RSA-SHA256').update(data).end().sign(secret).toString('base64url'),\n        verify: (data: BinaryLike, secret: KeyLike, signature: string) =>\n            createVerify('RSA-SHA256')\n                .update(data)\n                .end()\n                .verify(secret, Buffer.from(signature, 'base64url'))\n    },\n    RS384: {\n        sign: (data: BinaryLike, secret: KeyLike) =>\n            createSign('RSA-SHA384').update(data).end().sign(secret).toString('base64url'),\n        verify: (data: BinaryLike, secret: KeyLike, signature: string) =>\n            createVerify('RSA-SHA384')\n                .update(data)\n                .end()\n                .verify(secret, Buffer.from(signature, 'base64url'))\n    },\n    RS512: {\n        sign: (data: BinaryLike, secret: KeyLike) =>\n            createSign('RSA-SHA512').update(data).end().sign(secret).toString('base64url'),\n        verify: (data: BinaryLike, secret: KeyLike, signature: string) =>\n            createVerify('RSA-SHA512')\n                .update(data)\n                .end()\n                .verify(secret, Buffer.from(signature, 'base64url'))\n    },\n\n    // ECDSA (DER-encoded by default — no dsaEncoding!)\n    ES256: {\n        sign: (data: BinaryLike, secret: KeyLike) =>\n            createSign('SHA256').update(data).end().sign(secret).toString('base64url'),\n        verify: (data: BinaryLike, secret: KeyLike, signature: string) =>\n            createVerify('SHA256')\n                .update(data)\n                .end()\n                .verify(secret, Buffer.from(signature, 'base64url'))\n    },\n    ES384: {\n        sign: (data: BinaryLike, secret: KeyLike) =>\n            createSign('SHA384').update(data).end().sign(secret).toString('base64url'),\n        verify: (data: BinaryLike, secret: KeyLike, signature: string) =>\n            createVerify('SHA384')\n                .update(data)\n                .end()\n                .verify(secret, Buffer.from(signature, 'base64url'))\n    },\n    ES512: {\n        sign: (data: BinaryLike, secret: KeyLike) =>\n            createSign('SHA512').update(data).end().sign(secret).toString('base64url'),\n        verify: (data: BinaryLike, secret: KeyLike, signature: string) =>\n            createVerify('SHA512')\n                .update(data)\n                .end()\n                .verify(secret, Buffer.from(signature, 'base64url'))\n    }\n} as const;\n\nexport type SupportedAlgorithm = keyof typeof SignatureAlgorithm;\n\nexport const SupportedAlgorithms = Object.keys(SignatureAlgorithm) as Array<SupportedAlgorithm>;\n\n/**\n * Decode a JWT string into its parts (without verification)\n */\nexport const decode = (token: string): JWT => {\n    const parts = token.split('.');\n    if (parts.length !== 3) {\n        throw new Error('Invalid JWT: must contain exactly 3 parts separated by \".\"');\n    }\n\n    const [headerPart, payloadPart, signature] = parts;\n\n    if (!headerPart || !payloadPart || !signature) {\n        throw new Error('Invalid JWT: empty part detected');\n    }\n\n    try {\n        const header = JSON.parse(base64Url.decode(headerPart)) as JWTHeader;\n        const payload = JSON.parse(base64Url.decode(payloadPart)) as JWTPayload;\n        return { header, payload, signature };\n    } catch (err) {\n        throw new Error(`Invalid JWT: malformed header or payload (${(err as Error).message})`);\n    }\n};\n\n/**\n * Sign a JWT\n */\nexport const sign = (\n    payload: JWTPayload,\n    secret: KeyLike,\n    options: {\n        alg?: SupportedAlgorithm;\n        kid?: string;\n        typ?: string;\n    } = {}\n): string => {\n    const alg = options.alg ?? 'HS256';\n    const typ = options.typ ?? 'JWT';\n\n    if (!(alg in SignatureAlgorithm)) {\n        throw new Error(`Unsupported algorithm: ${alg}`);\n    }\n\n    const header: JWTHeader = { alg, typ };\n    if (options.kid) header.kid = options.kid;\n\n    const headerEncoded = base64Url.encode(JSON.stringify(header));\n    const payloadEncoded = base64Url.encode(JSON.stringify(payload));\n\n    const signingInput = `${headerEncoded}.${payloadEncoded}`;\n    const signature = SignatureAlgorithm[alg].sign(signingInput, secret);\n\n    return `${headerEncoded}.${payloadEncoded}.${signature}`;\n};\n\n/**\n * Verify and validate a JWT\n */\nexport const verify = (\n    token: string,\n    secret: KeyLike,\n    options: {\n        ignoreExpiration?: boolean;\n        clockSkew?: number; // in seconds, default 0\n    } = {}\n):\n    | { valid: true; header: JWTHeader; payload: JWTPayload; signature: string }\n    | { valid: false; error: { reason: string; code: string } } => {\n    let decoded: JWT;\n    try {\n        decoded = decode(token);\n    } catch (err) {\n        return {\n            valid: false,\n            error: {\n                reason: (err as Error).message,\n                code: 'INVALID_TOKEN'\n            }\n        };\n    }\n\n    const { header, payload, signature } = decoded;\n\n    // Validate algorithm\n    const alg = header.alg as SupportedAlgorithm;\n    if (!(alg in SignatureAlgorithm)) {\n        return {\n            valid: false,\n            error: {\n                reason: `Unsupported or unknown algorithm: ${header.alg}`,\n                code: 'INVALID_ALGORITHM'\n            }\n        };\n    }\n\n    // Optional: validate 'typ' header\n    if (header.typ && header.typ !== 'JWT') {\n        return {\n            valid: false,\n            error: {\n                reason: `Invalid token type: expected 'JWT', got '${header.typ}'`,\n                code: 'INVALID_TYPE'\n            }\n        };\n    }\n\n    // Verify signature\n    const signingInput = `${base64Url.encode(JSON.stringify(header))}.${base64Url.encode(JSON.stringify(payload))}`;\n    const isValidSignature = SignatureAlgorithm[alg].verify(signingInput, secret, signature);\n\n    if (!isValidSignature) {\n        return {\n            valid: false,\n            error: {\n                reason: \"Signature verification failed\",\n                code: 'INVALID_SIGNATURE'\n            }\n        };\n    }\n\n    // Time validation\n    const now = Math.floor(Date.now() / 1000);\n    const skew = options.clockSkew ?? 0;\n\n    if (!options.ignoreExpiration) {\n        if (payload.exp !== undefined && now > payload.exp + skew) {\n            return {\n                valid: false,\n                error: {\n                    reason: 'Token expired',\n                    code: 'TOKEN_EXPIRED'\n                }\n            };\n        }\n    }\n\n    if (payload.nbf !== undefined && now + skew < payload.nbf) {\n        return {\n            valid: false,\n            error: {\n                reason: 'Token not yet valid',\n                code: 'TOKEN_NOT_ACTIVE'\n            }\n        };\n    }\n\n    if (payload.iat !== undefined && now + skew < payload.iat) {\n        return {\n            valid: false,\n            error: {\n                reason: 'Token issued in the future',\n                code: 'TOKEN_FUTURE_ISSUED'\n            }\n        };\n    }\n\n    return { valid: true, header, payload, signature };\n};\n\n// Optional: namespace export (not default)\nexport const JWT = {\n    sign,\n    verify,\n    decode,\n    algorithms: SignatureAlgorithm\n};\n"],"names":["base64Url","input","SignatureAlgorithm","data","secret","createHmac","signature","createSign","createVerify","SupportedAlgorithms","decode","token","parts","headerPart","payloadPart","header","payload","err","sign","options","alg","typ","headerEncoded","payloadEncoded","signingInput","verify","decoded","now","skew","JWT"],"mappings":"0GASaA,EAAY,CACrB,OAASC,GACL,OAAO,KAAKA,CAAK,EAAE,SAAS,WAAW,EAE3C,OAASA,GAEE,OAAO,KAAKA,EAAO,WAAW,EAAE,SAAA,CAE/C,EAuDaC,EAAqB,CAE9B,MAAO,CACH,KAAM,CAACC,EAAkBC,IACrBC,EAAAA,WAAW,SAAUD,CAAM,EAAE,OAAOD,CAAI,EAAE,OAAO,WAAW,EAChE,OAAQ,CAACA,EAAkBC,EAAiBE,IACxCD,EAAAA,WAAW,SAAUD,CAAM,EAAE,OAAOD,CAAI,EAAE,OAAO,WAAW,IAAMG,CAAA,EAE1E,MAAO,CACH,KAAM,CAACH,EAAkBC,IACrBC,EAAAA,WAAW,SAAUD,CAAM,EAAE,OAAOD,CAAI,EAAE,OAAO,WAAW,EAChE,OAAQ,CAACA,EAAkBC,EAAiBE,IACxCD,EAAAA,WAAW,SAAUD,CAAM,EAAE,OAAOD,CAAI,EAAE,OAAO,WAAW,IAAMG,CAAA,EAE1E,MAAO,CACH,KAAM,CAACH,EAAkBC,IACrBC,EAAAA,WAAW,SAAUD,CAAM,EAAE,OAAOD,CAAI,EAAE,OAAO,WAAW,EAChE,OAAQ,CAACA,EAAkBC,EAAiBE,IACxCD,EAAAA,WAAW,SAAUD,CAAM,EAAE,OAAOD,CAAI,EAAE,OAAO,WAAW,IAAMG,CAAA,EAI1E,MAAO,CACH,KAAM,CAACH,EAAkBC,IACrBG,EAAAA,WAAW,YAAY,EAAE,OAAOJ,CAAI,EAAE,MAAM,KAAKC,CAAM,EAAE,SAAS,WAAW,EACjF,OAAQ,CAACD,EAAkBC,EAAiBE,IACxCE,EAAAA,aAAa,YAAY,EACpB,OAAOL,CAAI,EACX,IAAA,EACA,OAAOC,EAAQ,OAAO,KAAKE,EAAW,WAAW,CAAC,CAAA,EAE/D,MAAO,CACH,KAAM,CAACH,EAAkBC,IACrBG,EAAAA,WAAW,YAAY,EAAE,OAAOJ,CAAI,EAAE,MAAM,KAAKC,CAAM,EAAE,SAAS,WAAW,EACjF,OAAQ,CAACD,EAAkBC,EAAiBE,IACxCE,EAAAA,aAAa,YAAY,EACpB,OAAOL,CAAI,EACX,IAAA,EACA,OAAOC,EAAQ,OAAO,KAAKE,EAAW,WAAW,CAAC,CAAA,EAE/D,MAAO,CACH,KAAM,CAACH,EAAkBC,IACrBG,EAAAA,WAAW,YAAY,EAAE,OAAOJ,CAAI,EAAE,MAAM,KAAKC,CAAM,EAAE,SAAS,WAAW,EACjF,OAAQ,CAACD,EAAkBC,EAAiBE,IACxCE,EAAAA,aAAa,YAAY,EACpB,OAAOL,CAAI,EACX,IAAA,EACA,OAAOC,EAAQ,OAAO,KAAKE,EAAW,WAAW,CAAC,CAAA,EAI/D,MAAO,CACH,KAAM,CAACH,EAAkBC,IACrBG,EAAAA,WAAW,QAAQ,EAAE,OAAOJ,CAAI,EAAE,MAAM,KAAKC,CAAM,EAAE,SAAS,WAAW,EAC7E,OAAQ,CAACD,EAAkBC,EAAiBE,IACxCE,EAAAA,aAAa,QAAQ,EAChB,OAAOL,CAAI,EACX,IAAA,EACA,OAAOC,EAAQ,OAAO,KAAKE,EAAW,WAAW,CAAC,CAAA,EAE/D,MAAO,CACH,KAAM,CAACH,EAAkBC,IACrBG,EAAAA,WAAW,QAAQ,EAAE,OAAOJ,CAAI,EAAE,MAAM,KAAKC,CAAM,EAAE,SAAS,WAAW,EAC7E,OAAQ,CAACD,EAAkBC,EAAiBE,IACxCE,EAAAA,aAAa,QAAQ,EAChB,OAAOL,CAAI,EACX,IAAA,EACA,OAAOC,EAAQ,OAAO,KAAKE,EAAW,WAAW,CAAC,CAAA,EAE/D,MAAO,CACH,KAAM,CAACH,EAAkBC,IACrBG,EAAAA,WAAW,QAAQ,EAAE,OAAOJ,CAAI,EAAE,MAAM,KAAKC,CAAM,EAAE,SAAS,WAAW,EAC7E,OAAQ,CAACD,EAAkBC,EAAiBE,IACxCE,EAAAA,aAAa,QAAQ,EAChB,OAAOL,CAAI,EACX,IAAA,EACA,OAAOC,EAAQ,OAAO,KAAKE,EAAW,WAAW,CAAC,CAAA,CAEnE,EAIaG,EAAsB,OAAO,KAAKP,CAAkB,EAKpDQ,EAAUC,GAAuB,CAC1C,MAAMC,EAAQD,EAAM,MAAM,GAAG,EAC7B,GAAIC,EAAM,SAAW,EACjB,MAAM,IAAI,MAAM,4DAA4D,EAGhF,KAAM,CAACC,EAAYC,EAAaR,CAAS,EAAIM,EAE7C,GAAI,CAACC,GAAc,CAACC,GAAe,CAACR,EAChC,MAAM,IAAI,MAAM,kCAAkC,EAGtD,GAAI,CACA,MAAMS,EAAS,KAAK,MAAMf,EAAU,OAAOa,CAAU,CAAC,EAChDG,EAAU,KAAK,MAAMhB,EAAU,OAAOc,CAAW,CAAC,EACxD,MAAO,CAAE,OAAAC,EAAQ,QAAAC,EAAS,UAAAV,CAAA,CAC9B,OAASW,EAAK,CACV,MAAM,IAAI,MAAM,6CAA8CA,EAAc,OAAO,GAAG,CAC1F,CACJ,EAKaC,EAAO,CAChBF,EACAZ,EACAe,EAII,CAAA,IACK,CACT,MAAMC,EAAMD,EAAQ,KAAO,QACrBE,EAAMF,EAAQ,KAAO,MAE3B,GAAI,EAAEC,KAAOlB,GACT,MAAM,IAAI,MAAM,0BAA0BkB,CAAG,EAAE,EAGnD,MAAML,EAAoB,CAAE,IAAAK,EAAK,IAAAC,CAAA,EAC7BF,EAAQ,MAAKJ,EAAO,IAAMI,EAAQ,KAEtC,MAAMG,EAAgBtB,EAAU,OAAO,KAAK,UAAUe,CAAM,CAAC,EACvDQ,EAAiBvB,EAAU,OAAO,KAAK,UAAUgB,CAAO,CAAC,EAEzDQ,EAAe,GAAGF,CAAa,IAAIC,CAAc,GACjDjB,EAAYJ,EAAmBkB,CAAG,EAAE,KAAKI,EAAcpB,CAAM,EAEnE,MAAO,GAAGkB,CAAa,IAAIC,CAAc,IAAIjB,CAAS,EAC1D,EAKamB,EAAS,CAClBd,EACAP,EACAe,EAGI,CAAA,IAG2D,CAC/D,IAAIO,EACJ,GAAI,CACAA,EAAUhB,EAAOC,CAAK,CAC1B,OAASM,EAAK,CACV,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAASA,EAAc,QACvB,KAAM,eAAA,CACV,CAER,CAEA,KAAM,CAAE,OAAAF,EAAQ,QAAAC,EAAS,UAAAV,CAAA,EAAcoB,EAGjCN,EAAML,EAAO,IACnB,GAAI,EAAEK,KAAOlB,GACT,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,qCAAqCa,EAAO,GAAG,GACvD,KAAM,mBAAA,CACV,EAKR,GAAIA,EAAO,KAAOA,EAAO,MAAQ,MAC7B,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,4CAA4CA,EAAO,GAAG,IAC9D,KAAM,cAAA,CACV,EAKR,MAAMS,EAAe,GAAGxB,EAAU,OAAO,KAAK,UAAUe,CAAM,CAAC,CAAC,IAAIf,EAAU,OAAO,KAAK,UAAUgB,CAAO,CAAC,CAAC,GAG7G,GAAI,CAFqBd,EAAmBkB,CAAG,EAAE,OAAOI,EAAcpB,EAAQE,CAAS,EAGnF,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,gCACR,KAAM,mBAAA,CACV,EAKR,MAAMqB,EAAM,KAAK,MAAM,KAAK,IAAA,EAAQ,GAAI,EAClCC,EAAOT,EAAQ,WAAa,EAElC,MAAI,CAACA,EAAQ,kBACLH,EAAQ,MAAQ,QAAaW,EAAMX,EAAQ,IAAMY,EAC1C,CACH,MAAO,GACP,MAAO,CACH,OAAQ,gBACR,KAAM,eAAA,CACV,EAKRZ,EAAQ,MAAQ,QAAaW,EAAMC,EAAOZ,EAAQ,IAC3C,CACH,MAAO,GACP,MAAO,CACH,OAAQ,sBACR,KAAM,kBAAA,CACV,EAIJA,EAAQ,MAAQ,QAAaW,EAAMC,EAAOZ,EAAQ,IAC3C,CACH,MAAO,GACP,MAAO,CACH,OAAQ,6BACR,KAAM,qBAAA,CACV,EAID,CAAE,MAAO,GAAM,OAAAD,EAAQ,QAAAC,EAAS,UAAAV,CAAA,CAC3C,EAGauB,EAAM,CACf,KAAAX,EACA,OAAAO,EACA,OAAAf,EACA,WAAYR,CAChB"}

package/dist/index.d.ts

@@ -0,0 +1,184 @@
+import { BinaryLike, KeyLike } from 'crypto';
+export declare const base64Url: {
+    encode: (input: string | Buffer) => string;
+    decode: (input: string) => string;
+};
+export interface JWTPayload {
+    /**
+     * Issuer
+     */
+    iss?: string;
+    /**
+     * Subject
+     */
+    sub?: string;
+    /**
+     * Audience
+     */
+    aud?: string | string[];
+    /**
+     * Expiration Time (as UNIX timestamp)
+     */
+    exp?: number;
+    /**
+     * Not Before (as UNIX timestamp)
+     */
+    nbf?: number;
+    /**
+     * Issued At (as UNIX timestamp)
+     */
+    iat?: number;
+    /**
+     * JWT ID
+     */
+    jti?: string;
+    /**
+     * Session ID
+     */
+    sid?: string;
+    /**
+     * Custom claims
+     */
+    [key: string]: unknown;
+}
+export interface JWTHeader {
+    alg: string;
+    typ?: string;
+    kid?: string;
+}
+export interface JWT {
+    header: JWTHeader;
+    payload: JWTPayload;
+    signature: string;
+}
+export declare const SignatureAlgorithm: {
+    readonly HS256: {
+        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+    };
+    readonly HS384: {
+        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+    };
+    readonly HS512: {
+        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+    };
+    readonly RS256: {
+        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+    };
+    readonly RS384: {
+        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+    };
+    readonly RS512: {
+        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+    };
+    readonly ES256: {
+        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+    };
+    readonly ES384: {
+        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+    };
+    readonly ES512: {
+        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+    };
+};
+export type SupportedAlgorithm = keyof typeof SignatureAlgorithm;
+export declare const SupportedAlgorithms: Array<SupportedAlgorithm>;
+/**
+ * Decode a JWT string into its parts (without verification)
+ */
+export declare const decode: (token: string) => JWT;
+/**
+ * Sign a JWT
+ */
+export declare const sign: (payload: JWTPayload, secret: KeyLike, options?: {
+    alg?: SupportedAlgorithm;
+    kid?: string;
+    typ?: string;
+}) => string;
+/**
+ * Verify and validate a JWT
+ */
+export declare const verify: (token: string, secret: KeyLike, options?: {
+    ignoreExpiration?: boolean;
+    clockSkew?: number;
+}) => {
+    valid: true;
+    header: JWTHeader;
+    payload: JWTPayload;
+    signature: string;
+} | {
+    valid: false;
+    error: {
+        reason: string;
+        code: string;
+    };
+};
+export declare const JWT: {
+    sign: (payload: JWTPayload, secret: KeyLike, options?: {
+        alg?: SupportedAlgorithm;
+        kid?: string;
+        typ?: string;
+    }) => string;
+    verify: (token: string, secret: KeyLike, options?: {
+        ignoreExpiration?: boolean;
+        clockSkew?: number;
+    }) => {
+        valid: true;
+        header: JWTHeader;
+        payload: JWTPayload;
+        signature: string;
+    } | {
+        valid: false;
+        error: {
+            reason: string;
+            code: string;
+        };
+    };
+    decode: (token: string) => JWT;
+    algorithms: {
+        readonly HS256: {
+            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly HS384: {
+            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly HS512: {
+            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly RS256: {
+            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly RS384: {
+            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly RS512: {
+            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly ES256: {
+            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly ES384: {
+            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly ES512: {
+            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+    };
+};

package/dist/index.es.js

@@ -0,0 +1,140 @@
+import { createVerify as o, createSign as d, createHmac as u } from "crypto";
+const f = {
+  encode: (e) => Buffer.from(e).toString("base64url"),
+  decode: (e) => Buffer.from(e, "base64url").toString()
+}, l = {
+  // HMAC
+  HS256: {
+    sign: (e, r) => u("sha256", r).update(e).digest("base64url"),
+    verify: (e, r, t) => u("sha256", r).update(e).digest("base64url") === t
+  },
+  HS384: {
+    sign: (e, r) => u("sha384", r).update(e).digest("base64url"),
+    verify: (e, r, t) => u("sha384", r).update(e).digest("base64url") === t
+  },
+  HS512: {
+    sign: (e, r) => u("sha512", r).update(e).digest("base64url"),
+    verify: (e, r, t) => u("sha512", r).update(e).digest("base64url") === t
+  },
+  // RSA (DER-encoded signatures, base64url)
+  RS256: {
+    sign: (e, r) => d("RSA-SHA256").update(e).end().sign(r).toString("base64url"),
+    verify: (e, r, t) => o("RSA-SHA256").update(e).end().verify(r, Buffer.from(t, "base64url"))
+  },
+  RS384: {
+    sign: (e, r) => d("RSA-SHA384").update(e).end().sign(r).toString("base64url"),
+    verify: (e, r, t) => o("RSA-SHA384").update(e).end().verify(r, Buffer.from(t, "base64url"))
+  },
+  RS512: {
+    sign: (e, r) => d("RSA-SHA512").update(e).end().sign(r).toString("base64url"),
+    verify: (e, r, t) => o("RSA-SHA512").update(e).end().verify(r, Buffer.from(t, "base64url"))
+  },
+  // ECDSA (DER-encoded by default — no dsaEncoding!)
+  ES256: {
+    sign: (e, r) => d("SHA256").update(e).end().sign(r).toString("base64url"),
+    verify: (e, r, t) => o("SHA256").update(e).end().verify(r, Buffer.from(t, "base64url"))
+  },
+  ES384: {
+    sign: (e, r) => d("SHA384").update(e).end().sign(r).toString("base64url"),
+    verify: (e, r, t) => o("SHA384").update(e).end().verify(r, Buffer.from(t, "base64url"))
+  },
+  ES512: {
+    sign: (e, r) => d("SHA512").update(e).end().sign(r).toString("base64url"),
+    verify: (e, r, t) => o("SHA512").update(e).end().verify(r, Buffer.from(t, "base64url"))
+  }
+}, E = Object.keys(l), v = (e) => {
+  const r = e.split(".");
+  if (r.length !== 3)
+    throw new Error('Invalid JWT: must contain exactly 3 parts separated by "."');
+  const [t, i, n] = r;
+  if (!t || !i || !n)
+    throw new Error("Invalid JWT: empty part detected");
+  try {
+    const a = JSON.parse(f.decode(t)), s = JSON.parse(f.decode(i));
+    return { header: a, payload: s, signature: n };
+  } catch (a) {
+    throw new Error(`Invalid JWT: malformed header or payload (${a.message})`);
+  }
+}, h = (e, r, t = {}) => {
+  const i = t.alg ?? "HS256", n = t.typ ?? "JWT";
+  if (!(i in l))
+    throw new Error(`Unsupported algorithm: ${i}`);
+  const a = { alg: i, typ: n };
+  t.kid && (a.kid = t.kid);
+  const s = f.encode(JSON.stringify(a)), g = f.encode(JSON.stringify(e)), c = `${s}.${g}`, y = l[i].sign(c, r);
+  return `${s}.${g}.${y}`;
+}, b = (e, r, t = {}) => {
+  let i;
+  try {
+    i = v(e);
+  } catch (A) {
+    return {
+      valid: !1,
+      error: {
+        reason: A.message,
+        code: "INVALID_TOKEN"
+      }
+    };
+  }
+  const { header: n, payload: a, signature: s } = i, g = n.alg;
+  if (!(g in l))
+    return {
+      valid: !1,
+      error: {
+        reason: `Unsupported or unknown algorithm: ${n.alg}`,
+        code: "INVALID_ALGORITHM"
+      }
+    };
+  if (n.typ && n.typ !== "JWT")
+    return {
+      valid: !1,
+      error: {
+        reason: `Invalid token type: expected 'JWT', got '${n.typ}'`,
+        code: "INVALID_TYPE"
+      }
+    };
+  const c = `${f.encode(JSON.stringify(n))}.${f.encode(JSON.stringify(a))}`;
+  if (!l[g].verify(c, r, s))
+    return {
+      valid: !1,
+      error: {
+        reason: "Signature verification failed",
+        code: "INVALID_SIGNATURE"
+      }
+    };
+  const S = Math.floor(Date.now() / 1e3), p = t.clockSkew ?? 0;
+  return !t.ignoreExpiration && a.exp !== void 0 && S > a.exp + p ? {
+    valid: !1,
+    error: {
+      reason: "Token expired",
+      code: "TOKEN_EXPIRED"
+    }
+  } : a.nbf !== void 0 && S + p < a.nbf ? {
+    valid: !1,
+    error: {
+      reason: "Token not yet valid",
+      code: "TOKEN_NOT_ACTIVE"
+    }
+  } : a.iat !== void 0 && S + p < a.iat ? {
+    valid: !1,
+    error: {
+      reason: "Token issued in the future",
+      code: "TOKEN_FUTURE_ISSUED"
+    }
+  } : { valid: !0, header: n, payload: a, signature: s };
+}, T = {
+  sign: h,
+  verify: b,
+  decode: v,
+  algorithms: l
+};
+export {
+  T as JWT,
+  l as SignatureAlgorithm,
+  E as SupportedAlgorithms,
+  f as base64Url,
+  v as decode,
+  h as sign,
+  b as verify
+};
+//# sourceMappingURL=index.es.js.map

package/dist/index.es.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.es.js","sources":["../src/index.ts"],"sourcesContent":["import {\n    createHmac,\n    createSign,\n    createVerify,\n    type BinaryLike,\n    type KeyLike\n} from 'crypto';\n\n// Base64URL helpers (padding-safe)\nexport const base64Url = {\n    encode: (input: string | Buffer): string =>\n        Buffer.from(input).toString('base64url'),\n\n    decode: (input: string): string => {\n        // Node.js Buffer handles unpadded base64url since v16, but we normalize for safety\n        return Buffer.from(input, 'base64url').toString();\n    }\n};\n\n// Standard JWT payload claims\nexport interface JWTPayload {\n    /**\n     * Issuer\n     */\n    iss?: string;\n    /**\n     * Subject\n     */\n    sub?: string;\n    /**\n     * Audience\n     */\n    aud?: string | string[];\n    /**\n     * Expiration Time (as UNIX timestamp)\n     */\n    exp?: number;\n    /**\n     * Not Before (as UNIX timestamp)\n     */\n    nbf?: number;\n    /**\n     * Issued At (as UNIX timestamp)\n     */\n    iat?: number;\n    /**\n     * JWT ID\n     */\n    jti?: string;\n    /**\n     * Session ID\n     */\n    sid?: string;\n    /**\n     * Custom claims\n     */\n    [key: string]: unknown;\n}\n\nexport interface JWTHeader {\n    alg: string; // Allow unknown algs during decode\n    typ?: string;\n    kid?: string;\n}\n\nexport interface JWT {\n    header: JWTHeader;\n    payload: JWTPayload;\n    signature: string;\n}\n\n// Signature algorithms\nexport const SignatureAlgorithm = {\n    // HMAC\n    HS256: {\n        sign: (data: BinaryLike, secret: KeyLike) =>\n            createHmac('sha256', secret).update(data).digest('base64url'),\n        verify: (data: BinaryLike, secret: KeyLike, signature: string) =>\n            createHmac('sha256', secret).update(data).digest('base64url') === signature\n    },\n    HS384: {\n        sign: (data: BinaryLike, secret: KeyLike) =>\n            createHmac('sha384', secret).update(data).digest('base64url'),\n        verify: (data: BinaryLike, secret: KeyLike, signature: string) =>\n            createHmac('sha384', secret).update(data).digest('base64url') === signature\n    },\n    HS512: {\n        sign: (data: BinaryLike, secret: KeyLike) =>\n            createHmac('sha512', secret).update(data).digest('base64url'),\n        verify: (data: BinaryLike, secret: KeyLike, signature: string) =>\n            createHmac('sha512', secret).update(data).digest('base64url') === signature\n    },\n\n    // RSA (DER-encoded signatures, base64url)\n    RS256: {\n        sign: (data: BinaryLike, secret: KeyLike) =>\n            createSign('RSA-SHA256').update(data).end().sign(secret).toString('base64url'),\n        verify: (data: BinaryLike, secret: KeyLike, signature: string) =>\n            createVerify('RSA-SHA256')\n                .update(data)\n                .end()\n                .verify(secret, Buffer.from(signature, 'base64url'))\n    },\n    RS384: {\n        sign: (data: BinaryLike, secret: KeyLike) =>\n            createSign('RSA-SHA384').update(data).end().sign(secret).toString('base64url'),\n        verify: (data: BinaryLike, secret: KeyLike, signature: string) =>\n            createVerify('RSA-SHA384')\n                .update(data)\n                .end()\n                .verify(secret, Buffer.from(signature, 'base64url'))\n    },\n    RS512: {\n        sign: (data: BinaryLike, secret: KeyLike) =>\n            createSign('RSA-SHA512').update(data).end().sign(secret).toString('base64url'),\n        verify: (data: BinaryLike, secret: KeyLike, signature: string) =>\n            createVerify('RSA-SHA512')\n                .update(data)\n                .end()\n                .verify(secret, Buffer.from(signature, 'base64url'))\n    },\n\n    // ECDSA (DER-encoded by default — no dsaEncoding!)\n    ES256: {\n        sign: (data: BinaryLike, secret: KeyLike) =>\n            createSign('SHA256').update(data).end().sign(secret).toString('base64url'),\n        verify: (data: BinaryLike, secret: KeyLike, signature: string) =>\n            createVerify('SHA256')\n                .update(data)\n                .end()\n                .verify(secret, Buffer.from(signature, 'base64url'))\n    },\n    ES384: {\n        sign: (data: BinaryLike, secret: KeyLike) =>\n            createSign('SHA384').update(data).end().sign(secret).toString('base64url'),\n        verify: (data: BinaryLike, secret: KeyLike, signature: string) =>\n            createVerify('SHA384')\n                .update(data)\n                .end()\n                .verify(secret, Buffer.from(signature, 'base64url'))\n    },\n    ES512: {\n        sign: (data: BinaryLike, secret: KeyLike) =>\n            createSign('SHA512').update(data).end().sign(secret).toString('base64url'),\n        verify: (data: BinaryLike, secret: KeyLike, signature: string) =>\n            createVerify('SHA512')\n                .update(data)\n                .end()\n                .verify(secret, Buffer.from(signature, 'base64url'))\n    }\n} as const;\n\nexport type SupportedAlgorithm = keyof typeof SignatureAlgorithm;\n\nexport const SupportedAlgorithms = Object.keys(SignatureAlgorithm) as Array<SupportedAlgorithm>;\n\n/**\n * Decode a JWT string into its parts (without verification)\n */\nexport const decode = (token: string): JWT => {\n    const parts = token.split('.');\n    if (parts.length !== 3) {\n        throw new Error('Invalid JWT: must contain exactly 3 parts separated by \".\"');\n    }\n\n    const [headerPart, payloadPart, signature] = parts;\n\n    if (!headerPart || !payloadPart || !signature) {\n        throw new Error('Invalid JWT: empty part detected');\n    }\n\n    try {\n        const header = JSON.parse(base64Url.decode(headerPart)) as JWTHeader;\n        const payload = JSON.parse(base64Url.decode(payloadPart)) as JWTPayload;\n        return { header, payload, signature };\n    } catch (err) {\n        throw new Error(`Invalid JWT: malformed header or payload (${(err as Error).message})`);\n    }\n};\n\n/**\n * Sign a JWT\n */\nexport const sign = (\n    payload: JWTPayload,\n    secret: KeyLike,\n    options: {\n        alg?: SupportedAlgorithm;\n        kid?: string;\n        typ?: string;\n    } = {}\n): string => {\n    const alg = options.alg ?? 'HS256';\n    const typ = options.typ ?? 'JWT';\n\n    if (!(alg in SignatureAlgorithm)) {\n        throw new Error(`Unsupported algorithm: ${alg}`);\n    }\n\n    const header: JWTHeader = { alg, typ };\n    if (options.kid) header.kid = options.kid;\n\n    const headerEncoded = base64Url.encode(JSON.stringify(header));\n    const payloadEncoded = base64Url.encode(JSON.stringify(payload));\n\n    const signingInput = `${headerEncoded}.${payloadEncoded}`;\n    const signature = SignatureAlgorithm[alg].sign(signingInput, secret);\n\n    return `${headerEncoded}.${payloadEncoded}.${signature}`;\n};\n\n/**\n * Verify and validate a JWT\n */\nexport const verify = (\n    token: string,\n    secret: KeyLike,\n    options: {\n        ignoreExpiration?: boolean;\n        clockSkew?: number; // in seconds, default 0\n    } = {}\n):\n    | { valid: true; header: JWTHeader; payload: JWTPayload; signature: string }\n    | { valid: false; error: { reason: string; code: string } } => {\n    let decoded: JWT;\n    try {\n        decoded = decode(token);\n    } catch (err) {\n        return {\n            valid: false,\n            error: {\n                reason: (err as Error).message,\n                code: 'INVALID_TOKEN'\n            }\n        };\n    }\n\n    const { header, payload, signature } = decoded;\n\n    // Validate algorithm\n    const alg = header.alg as SupportedAlgorithm;\n    if (!(alg in SignatureAlgorithm)) {\n        return {\n            valid: false,\n            error: {\n                reason: `Unsupported or unknown algorithm: ${header.alg}`,\n                code: 'INVALID_ALGORITHM'\n            }\n        };\n    }\n\n    // Optional: validate 'typ' header\n    if (header.typ && header.typ !== 'JWT') {\n        return {\n            valid: false,\n            error: {\n                reason: `Invalid token type: expected 'JWT', got '${header.typ}'`,\n                code: 'INVALID_TYPE'\n            }\n        };\n    }\n\n    // Verify signature\n    const signingInput = `${base64Url.encode(JSON.stringify(header))}.${base64Url.encode(JSON.stringify(payload))}`;\n    const isValidSignature = SignatureAlgorithm[alg].verify(signingInput, secret, signature);\n\n    if (!isValidSignature) {\n        return {\n            valid: false,\n            error: {\n                reason: \"Signature verification failed\",\n                code: 'INVALID_SIGNATURE'\n            }\n        };\n    }\n\n    // Time validation\n    const now = Math.floor(Date.now() / 1000);\n    const skew = options.clockSkew ?? 0;\n\n    if (!options.ignoreExpiration) {\n        if (payload.exp !== undefined && now > payload.exp + skew) {\n            return {\n                valid: false,\n                error: {\n                    reason: 'Token expired',\n                    code: 'TOKEN_EXPIRED'\n                }\n            };\n        }\n    }\n\n    if (payload.nbf !== undefined && now + skew < payload.nbf) {\n        return {\n            valid: false,\n            error: {\n                reason: 'Token not yet valid',\n                code: 'TOKEN_NOT_ACTIVE'\n            }\n        };\n    }\n\n    if (payload.iat !== undefined && now + skew < payload.iat) {\n        return {\n            valid: false,\n            error: {\n                reason: 'Token issued in the future',\n                code: 'TOKEN_FUTURE_ISSUED'\n            }\n        };\n    }\n\n    return { valid: true, header, payload, signature };\n};\n\n// Optional: namespace export (not default)\nexport const JWT = {\n    sign,\n    verify,\n    decode,\n    algorithms: SignatureAlgorithm\n};\n"],"names":["base64Url","input","SignatureAlgorithm","data","secret","createHmac","signature","createSign","createVerify","SupportedAlgorithms","decode","token","parts","headerPart","payloadPart","header","payload","err","sign","options","alg","typ","headerEncoded","payloadEncoded","signingInput","verify","decoded","now","skew","JWT"],"mappings":";AASO,MAAMA,IAAY;AAAA,EACrB,QAAQ,CAACC,MACL,OAAO,KAAKA,CAAK,EAAE,SAAS,WAAW;AAAA,EAE3C,QAAQ,CAACA,MAEE,OAAO,KAAKA,GAAO,WAAW,EAAE,SAAA;AAE/C,GAuDaC,IAAqB;AAAA;AAAA,EAE9B,OAAO;AAAA,IACH,MAAM,CAACC,GAAkBC,MACrBC,EAAW,UAAUD,CAAM,EAAE,OAAOD,CAAI,EAAE,OAAO,WAAW;AAAA,IAChE,QAAQ,CAACA,GAAkBC,GAAiBE,MACxCD,EAAW,UAAUD,CAAM,EAAE,OAAOD,CAAI,EAAE,OAAO,WAAW,MAAMG;AAAA,EAAA;AAAA,EAE1E,OAAO;AAAA,IACH,MAAM,CAACH,GAAkBC,MACrBC,EAAW,UAAUD,CAAM,EAAE,OAAOD,CAAI,EAAE,OAAO,WAAW;AAAA,IAChE,QAAQ,CAACA,GAAkBC,GAAiBE,MACxCD,EAAW,UAAUD,CAAM,EAAE,OAAOD,CAAI,EAAE,OAAO,WAAW,MAAMG;AAAA,EAAA;AAAA,EAE1E,OAAO;AAAA,IACH,MAAM,CAACH,GAAkBC,MACrBC,EAAW,UAAUD,CAAM,EAAE,OAAOD,CAAI,EAAE,OAAO,WAAW;AAAA,IAChE,QAAQ,CAACA,GAAkBC,GAAiBE,MACxCD,EAAW,UAAUD,CAAM,EAAE,OAAOD,CAAI,EAAE,OAAO,WAAW,MAAMG;AAAA,EAAA;AAAA;AAAA,EAI1E,OAAO;AAAA,IACH,MAAM,CAACH,GAAkBC,MACrBG,EAAW,YAAY,EAAE,OAAOJ,CAAI,EAAE,MAAM,KAAKC,CAAM,EAAE,SAAS,WAAW;AAAA,IACjF,QAAQ,CAACD,GAAkBC,GAAiBE,MACxCE,EAAa,YAAY,EACpB,OAAOL,CAAI,EACX,IAAA,EACA,OAAOC,GAAQ,OAAO,KAAKE,GAAW,WAAW,CAAC;AAAA,EAAA;AAAA,EAE/D,OAAO;AAAA,IACH,MAAM,CAACH,GAAkBC,MACrBG,EAAW,YAAY,EAAE,OAAOJ,CAAI,EAAE,MAAM,KAAKC,CAAM,EAAE,SAAS,WAAW;AAAA,IACjF,QAAQ,CAACD,GAAkBC,GAAiBE,MACxCE,EAAa,YAAY,EACpB,OAAOL,CAAI,EACX,IAAA,EACA,OAAOC,GAAQ,OAAO,KAAKE,GAAW,WAAW,CAAC;AAAA,EAAA;AAAA,EAE/D,OAAO;AAAA,IACH,MAAM,CAACH,GAAkBC,MACrBG,EAAW,YAAY,EAAE,OAAOJ,CAAI,EAAE,MAAM,KAAKC,CAAM,EAAE,SAAS,WAAW;AAAA,IACjF,QAAQ,CAACD,GAAkBC,GAAiBE,MACxCE,EAAa,YAAY,EACpB,OAAOL,CAAI,EACX,IAAA,EACA,OAAOC,GAAQ,OAAO,KAAKE,GAAW,WAAW,CAAC;AAAA,EAAA;AAAA;AAAA,EAI/D,OAAO;AAAA,IACH,MAAM,CAACH,GAAkBC,MACrBG,EAAW,QAAQ,EAAE,OAAOJ,CAAI,EAAE,MAAM,KAAKC,CAAM,EAAE,SAAS,WAAW;AAAA,IAC7E,QAAQ,CAACD,GAAkBC,GAAiBE,MACxCE,EAAa,QAAQ,EAChB,OAAOL,CAAI,EACX,IAAA,EACA,OAAOC,GAAQ,OAAO,KAAKE,GAAW,WAAW,CAAC;AAAA,EAAA;AAAA,EAE/D,OAAO;AAAA,IACH,MAAM,CAACH,GAAkBC,MACrBG,EAAW,QAAQ,EAAE,OAAOJ,CAAI,EAAE,MAAM,KAAKC,CAAM,EAAE,SAAS,WAAW;AAAA,IAC7E,QAAQ,CAACD,GAAkBC,GAAiBE,MACxCE,EAAa,QAAQ,EAChB,OAAOL,CAAI,EACX,IAAA,EACA,OAAOC,GAAQ,OAAO,KAAKE,GAAW,WAAW,CAAC;AAAA,EAAA;AAAA,EAE/D,OAAO;AAAA,IACH,MAAM,CAACH,GAAkBC,MACrBG,EAAW,QAAQ,EAAE,OAAOJ,CAAI,EAAE,MAAM,KAAKC,CAAM,EAAE,SAAS,WAAW;AAAA,IAC7E,QAAQ,CAACD,GAAkBC,GAAiBE,MACxCE,EAAa,QAAQ,EAChB,OAAOL,CAAI,EACX,IAAA,EACA,OAAOC,GAAQ,OAAO,KAAKE,GAAW,WAAW,CAAC;AAAA,EAAA;AAEnE,GAIaG,IAAsB,OAAO,KAAKP,CAAkB,GAKpDQ,IAAS,CAACC,MAAuB;AAC1C,QAAMC,IAAQD,EAAM,MAAM,GAAG;AAC7B,MAAIC,EAAM,WAAW;AACjB,UAAM,IAAI,MAAM,4DAA4D;AAGhF,QAAM,CAACC,GAAYC,GAAaR,CAAS,IAAIM;AAE7C,MAAI,CAACC,KAAc,CAACC,KAAe,CAACR;AAChC,UAAM,IAAI,MAAM,kCAAkC;AAGtD,MAAI;AACA,UAAMS,IAAS,KAAK,MAAMf,EAAU,OAAOa,CAAU,CAAC,GAChDG,IAAU,KAAK,MAAMhB,EAAU,OAAOc,CAAW,CAAC;AACxD,WAAO,EAAE,QAAAC,GAAQ,SAAAC,GAAS,WAAAV,EAAA;AAAA,EAC9B,SAASW,GAAK;AACV,UAAM,IAAI,MAAM,6CAA8CA,EAAc,OAAO,GAAG;AAAA,EAC1F;AACJ,GAKaC,IAAO,CAChBF,GACAZ,GACAe,IAII,CAAA,MACK;AACT,QAAMC,IAAMD,EAAQ,OAAO,SACrBE,IAAMF,EAAQ,OAAO;AAE3B,MAAI,EAAEC,KAAOlB;AACT,UAAM,IAAI,MAAM,0BAA0BkB,CAAG,EAAE;AAGnD,QAAML,IAAoB,EAAE,KAAAK,GAAK,KAAAC,EAAA;AACjC,EAAIF,EAAQ,QAAKJ,EAAO,MAAMI,EAAQ;AAEtC,QAAMG,IAAgBtB,EAAU,OAAO,KAAK,UAAUe,CAAM,CAAC,GACvDQ,IAAiBvB,EAAU,OAAO,KAAK,UAAUgB,CAAO,CAAC,GAEzDQ,IAAe,GAAGF,CAAa,IAAIC,CAAc,IACjDjB,IAAYJ,EAAmBkB,CAAG,EAAE,KAAKI,GAAcpB,CAAM;AAEnE,SAAO,GAAGkB,CAAa,IAAIC,CAAc,IAAIjB,CAAS;AAC1D,GAKamB,IAAS,CAClBd,GACAP,GACAe,IAGI,CAAA,MAG2D;AAC/D,MAAIO;AACJ,MAAI;AACA,IAAAA,IAAUhB,EAAOC,CAAK;AAAA,EAC1B,SAASM,GAAK;AACV,WAAO;AAAA,MACH,OAAO;AAAA,MACP,OAAO;AAAA,QACH,QAASA,EAAc;AAAA,QACvB,MAAM;AAAA,MAAA;AAAA,IACV;AAAA,EAER;AAEA,QAAM,EAAE,QAAAF,GAAQ,SAAAC,GAAS,WAAAV,EAAA,IAAcoB,GAGjCN,IAAML,EAAO;AACnB,MAAI,EAAEK,KAAOlB;AACT,WAAO;AAAA,MACH,OAAO;AAAA,MACP,OAAO;AAAA,QACH,QAAQ,qCAAqCa,EAAO,GAAG;AAAA,QACvD,MAAM;AAAA,MAAA;AAAA,IACV;AAKR,MAAIA,EAAO,OAAOA,EAAO,QAAQ;AAC7B,WAAO;AAAA,MACH,OAAO;AAAA,MACP,OAAO;AAAA,QACH,QAAQ,4CAA4CA,EAAO,GAAG;AAAA,QAC9D,MAAM;AAAA,MAAA;AAAA,IACV;AAKR,QAAMS,IAAe,GAAGxB,EAAU,OAAO,KAAK,UAAUe,CAAM,CAAC,CAAC,IAAIf,EAAU,OAAO,KAAK,UAAUgB,CAAO,CAAC,CAAC;AAG7G,MAAI,CAFqBd,EAAmBkB,CAAG,EAAE,OAAOI,GAAcpB,GAAQE,CAAS;AAGnF,WAAO;AAAA,MACH,OAAO;AAAA,MACP,OAAO;AAAA,QACH,QAAQ;AAAA,QACR,MAAM;AAAA,MAAA;AAAA,IACV;AAKR,QAAMqB,IAAM,KAAK,MAAM,KAAK,IAAA,IAAQ,GAAI,GAClCC,IAAOT,EAAQ,aAAa;AAElC,SAAI,CAACA,EAAQ,oBACLH,EAAQ,QAAQ,UAAaW,IAAMX,EAAQ,MAAMY,IAC1C;AAAA,IACH,OAAO;AAAA,IACP,OAAO;AAAA,MACH,QAAQ;AAAA,MACR,MAAM;AAAA,IAAA;AAAA,EACV,IAKRZ,EAAQ,QAAQ,UAAaW,IAAMC,IAAOZ,EAAQ,MAC3C;AAAA,IACH,OAAO;AAAA,IACP,OAAO;AAAA,MACH,QAAQ;AAAA,MACR,MAAM;AAAA,IAAA;AAAA,EACV,IAIJA,EAAQ,QAAQ,UAAaW,IAAMC,IAAOZ,EAAQ,MAC3C;AAAA,IACH,OAAO;AAAA,IACP,OAAO;AAAA,MACH,QAAQ;AAAA,MACR,MAAM;AAAA,IAAA;AAAA,EACV,IAID,EAAE,OAAO,IAAM,QAAAD,GAAQ,SAAAC,GAAS,WAAAV,EAAA;AAC3C,GAGauB,IAAM;AAAA,EACf,MAAAX;AAAA,EACA,QAAAO;AAAA,EACA,QAAAf;AAAA,EACA,YAAYR;AAChB;"}

package/package.json

@@ -0,0 +1,85 @@
+{
+  "name": "@sourceregistry/node-jwt",
+  "version": "1.0.0",
+  "description": "A lightweight, zero-dependency TypeScript library for creating, verifying and decoding JSON Web Tokens (JWT).",
+  "main": "./dist/index.cjs.js",
+  "module": "./dist/index.es.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.es.js",
+      "require": "./dist/index.cjs.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc && vite build",
+    "test": "vitest",
+    "test:ui": "vitest --ui",
+    "test:coverage": "vitest run --coverage",
+    "lint": "tsc --noEmit"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/SourceRegistry/node-jwt.git"
+  },
+  "keywords": [
+    "jwt",
+    "json web token",
+    "authentication",
+    "security",
+    "typescript",
+    "zero-dependency"
+  ],
+  "author": "A.P.A. Slaa (a.p.a.slaa@projectsource.nl)",
+  "license": "Apache-2.0",
+  "type": "module",
+  "bugs": {
+    "url": "https://github.com/SourceRegistry/node-jwt/issues"
+  },
+  "homepage": "https://github.com/SourceRegistry/node-jwt#readme",
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=16.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^24.3.0",
+    "@vitest/coverage-v8": "^3.2.4",
+    "@vitest/ui": "^3.2.4",
+    "typescript": "^5.9.3",
+    "vite": "^7.1.3",
+    "vite-plugin-dts": "^4.5.4",
+    "vitest": "^3.2.4",
+    "@semantic-release/commit-analyzer": "^13.0.1",
+    "@semantic-release/release-notes-generator": "^14.0.3",
+    "@semantic-release/changelog": "^6.0.3",
+    "@semantic-release/npm": "^12.0.2",
+    "@semantic-release/git": "^10.0.1"
+  },
+  "release": {
+    "branches": [
+      "main"
+    ],
+    "plugins": [
+      "@semantic-release/commit-analyzer",
+      "@semantic-release/release-notes-generator",
+      "@semantic-release/changelog",
+      "@semantic-release/npm",
+      [
+        "@semantic-release/git",
+        {
+          "assets": [
+            "package.json",
+            "CHANGELOG.md"
+          ],
+          "message": "node-jwt(release): 🚀 v${nextRelease.version}\n\n${nextRelease.notes}"
+        }
+      ]
+    ]
+  }
+}