@vercel/kms 0.0.0 → 0.1.1

package/dist/sign-message.js

@@ -0,0 +1,47 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var sign_message_exports = {};
+__export(sign_message_exports, {
+  signMessage: () => signMessage
+});
+module.exports = __toCommonJS(sign_message_exports);
+var import_request = require("./request");
+var import_resolve_token = require("./resolve-token");
+async function signMessage(options) {
+  const { issuerId, message, token } = options;
+  const baseUrl = (0, import_request.resolveBaseUrl)({
+    region: options.region,
+    baseUrl: options.baseUrl
+  });
+  const oidcToken = await (0, import_resolve_token.resolveOidcToken)({ token });
+  const { signature } = await (0, import_request.postJson)({
+    baseUrl,
+    path: `/kms/issuers/${encodeURIComponent(issuerId)}/sign/message`,
+    token: oidcToken,
+    body: { message: toBase64(message) }
+  });
+  return signature;
+}
+function toBase64(message) {
+  return (typeof message === "string" ? Buffer.from(message, "utf-8") : Buffer.from(message)).toString("base64");
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  signMessage
+});

package/dist/sign-message.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/sign-message.test.js

@@ -0,0 +1,97 @@
+"use strict";
+var import_vitest = require("vitest");
+var import_oidc = require("@vercel/oidc");
+var import_sign_message = require("./sign-message");
+import_vitest.vi.mock("@vercel/oidc", () => ({
+  getVercelOidcToken: import_vitest.vi.fn()
+}));
+const getVercelOidcTokenMock = import_vitest.vi.mocked(import_oidc.getVercelOidcToken);
+const OIDC_TOKEN = "oidc-token";
+const SIGNATURE = {
+  payload: "cGF5bG9hZA",
+  signature: "c2ln",
+  protected: "cHJvdGVjdGVk"
+};
+function fetchReturning(body, init) {
+  return async () => new Response(JSON.stringify(body), { status: 200, ...init });
+}
+(0, import_vitest.describe)("signMessage", () => {
+  (0, import_vitest.beforeEach)(() => {
+    import_vitest.vi.restoreAllMocks();
+    getVercelOidcTokenMock.mockReset();
+    delete process.env.VERCEL_REGION;
+  });
+  (0, import_vitest.test)("signs a string message (UTF-8) and returns the flattened JWS", async () => {
+    getVercelOidcTokenMock.mockResolvedValue(OIDC_TOKEN);
+    const fetchMock = import_vitest.vi.spyOn(globalThis, "fetch").mockImplementation(fetchReturning({ signature: SIGNATURE }));
+    const result = await (0, import_sign_message.signMessage)({
+      issuerId: "issuer_a",
+      message: "hello"
+    });
+    (0, import_vitest.expect)(result).toEqual(SIGNATURE);
+    (0, import_vitest.expect)(getVercelOidcTokenMock).toHaveBeenCalledWith();
+    const [url, init] = fetchMock.mock.calls[0];
+    (0, import_vitest.expect)(url.toString()).toBe(
+      "https://api.vercel.com/v1/kms/issuers/issuer_a/sign/message"
+    );
+    (0, import_vitest.expect)(JSON.parse(init?.body)).toEqual({ message: "aGVsbG8=" });
+  });
+  (0, import_vitest.test)("base64-encodes a Uint8Array message before sending", async () => {
+    getVercelOidcTokenMock.mockResolvedValue(OIDC_TOKEN);
+    const fetchMock = import_vitest.vi.spyOn(globalThis, "fetch").mockImplementation(fetchReturning({ signature: SIGNATURE }));
+    await (0, import_sign_message.signMessage)({
+      issuerId: "issuer_bytes",
+      // Raw bytes for "hello".
+      message: new Uint8Array([104, 101, 108, 108, 111])
+    });
+    const [, init] = fetchMock.mock.calls[0];
+    (0, import_vitest.expect)(JSON.parse(init?.body)).toEqual({ message: "aGVsbG8=" });
+  });
+  (0, import_vitest.test)("targets the regional host when a region is provided", async () => {
+    getVercelOidcTokenMock.mockResolvedValue(OIDC_TOKEN);
+    const fetchMock = import_vitest.vi.spyOn(globalThis, "fetch").mockImplementation(fetchReturning({ signature: SIGNATURE }));
+    await (0, import_sign_message.signMessage)({
+      issuerId: "issuer_region",
+      message: "bXNn",
+      region: "sfo1"
+    });
+    const [url] = fetchMock.mock.calls[0];
+    (0, import_vitest.expect)(url.toString()).toBe(
+      "https://api-sfo1.vercel.com/v1/kms/issuers/issuer_region/sign/message"
+    );
+  });
+  (0, import_vitest.test)("uses an explicit token without fetching an OIDC token", async () => {
+    const fetchMock = import_vitest.vi.spyOn(globalThis, "fetch").mockImplementation(fetchReturning({ signature: SIGNATURE }));
+    await (0, import_sign_message.signMessage)({
+      issuerId: "issuer_explicit",
+      message: "bXNn",
+      token: "my-token"
+    });
+    (0, import_vitest.expect)(getVercelOidcTokenMock).not.toHaveBeenCalled();
+    const [, init] = fetchMock.mock.calls[0];
+    (0, import_vitest.expect)((init?.headers).authorization).toBe(
+      "Bearer my-token"
+    );
+  });
+  (0, import_vitest.test)("throws a VercelKmsError when message signing is not allowed", async () => {
+    getVercelOidcTokenMock.mockResolvedValue(OIDC_TOKEN);
+    import_vitest.vi.spyOn(globalThis, "fetch").mockImplementation(
+      fetchReturning(
+        {
+          error: {
+            code: "message_signing_not_allowed",
+            message: "use sign-token"
+          }
+        },
+        { status: 403, statusText: "Forbidden" }
+      )
+    );
+    await (0, import_vitest.expect)(
+      (0, import_sign_message.signMessage)({ issuerId: "x", message: "bXNn" })
+    ).rejects.toMatchObject({
+      name: "VercelKmsError",
+      status: 403,
+      code: "message_signing_not_allowed"
+    });
+  });
+});

package/dist/sign-token.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Options for {@link signToken}.
+ */
+export interface SignTokenOptions {
+    /** The ID of the issuer whose signing key should sign the token. */
+    issuerId: string;
+    /** The claims to include in the token. */
+    claims?: Record<string, unknown>;
+    /** Additional headers to include in the token. */
+    headers?: Record<string, unknown>;
+    /** The time-to-live for the token, in seconds. Defaults to 300. */
+    ttl?: number | null;
+    /**
+     * An explicit Vercel OIDC token to authenticate with. When omitted, the
+     * function's OIDC token is fetched automatically via `@vercel/oidc`.
+     */
+    token?: string;
+    /**
+     * Region for the regional KMS API host, e.g. `sfo1`, producing
+     * `https://api-<region>.vercel.com/v1`. Defaults to the `VERCEL_REGION`
+     * environment variable, falling back to the global `api.vercel.com` host.
+     * Ignored when `baseUrl` is provided.
+     */
+    region?: string;
+    /**
+     * Override the API base URL. Takes precedence over `region`.
+     * @default "https://api-<region>.vercel.com/v1" or "https://api.vercel.com/v1"
+     */
+    baseUrl?: string;
+}
+/**
+ * Signs a JWT for an issuer using its managed signing key and returns the
+ * compact JWT string.
+ *
+ * @throws {import('./errors').VercelKmsError} If the sign request fails.
+ */
+export declare function signToken(options: SignTokenOptions): Promise<string>;

package/dist/sign-token.js

@@ -0,0 +1,44 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var sign_token_exports = {};
+__export(sign_token_exports, {
+  signToken: () => signToken
+});
+module.exports = __toCommonJS(sign_token_exports);
+var import_request = require("./request");
+var import_resolve_token = require("./resolve-token");
+async function signToken(options) {
+  const { issuerId, claims = {}, headers = {}, ttl = 300, token } = options;
+  const baseUrl = (0, import_request.resolveBaseUrl)({
+    region: options.region,
+    baseUrl: options.baseUrl
+  });
+  const oidcToken = await (0, import_resolve_token.resolveOidcToken)({ token });
+  const { token: signedToken } = await (0, import_request.postJson)({
+    baseUrl,
+    path: `/kms/issuers/${encodeURIComponent(issuerId)}/sign/token`,
+    token: oidcToken,
+    body: { claims, headers, ttl }
+  });
+  return signedToken;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  signToken
+});

package/dist/sign-token.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/sign-token.test.js

@@ -0,0 +1,82 @@
+"use strict";
+var import_vitest = require("vitest");
+var import_oidc = require("@vercel/oidc");
+var import_sign_token = require("./sign-token");
+var import_errors = require("./errors");
+import_vitest.vi.mock("@vercel/oidc", () => ({
+  getVercelOidcToken: import_vitest.vi.fn()
+}));
+const getVercelOidcTokenMock = import_vitest.vi.mocked(import_oidc.getVercelOidcToken);
+const OIDC_TOKEN = "oidc-token";
+const SIGNED_TOKEN = "signed.jwt.token";
+function fetchReturning(body, init) {
+  return async () => new Response(JSON.stringify(body), { status: 200, ...init });
+}
+(0, import_vitest.describe)("signToken", () => {
+  (0, import_vitest.beforeEach)(() => {
+    import_vitest.vi.restoreAllMocks();
+    getVercelOidcTokenMock.mockReset();
+    delete process.env.VERCEL_REGION;
+  });
+  (0, import_vitest.test)("signs a token and returns the JWT string", async () => {
+    getVercelOidcTokenMock.mockResolvedValue(OIDC_TOKEN);
+    const fetchMock = import_vitest.vi.spyOn(globalThis, "fetch").mockImplementation(fetchReturning({ token: SIGNED_TOKEN }));
+    const result = await (0, import_sign_token.signToken)({
+      issuerId: "issuer_a",
+      claims: { sub: "user" }
+    });
+    (0, import_vitest.expect)(result).toBe(SIGNED_TOKEN);
+    (0, import_vitest.expect)(getVercelOidcTokenMock).toHaveBeenCalledWith();
+    (0, import_vitest.expect)(fetchMock).toHaveBeenCalledTimes(1);
+    const [url, init] = fetchMock.mock.calls[0];
+    (0, import_vitest.expect)(url.toString()).toBe(
+      "https://api.vercel.com/v1/kms/issuers/issuer_a/sign/token"
+    );
+    (0, import_vitest.expect)(init?.method).toBe("POST");
+    (0, import_vitest.expect)((init?.headers).authorization).toBe(
+      `Bearer ${OIDC_TOKEN}`
+    );
+    (0, import_vitest.expect)(JSON.parse(init?.body)).toEqual({
+      claims: { sub: "user" },
+      headers: {},
+      ttl: 300
+    });
+  });
+  (0, import_vitest.test)("targets the regional host when a region is provided", async () => {
+    getVercelOidcTokenMock.mockResolvedValue(OIDC_TOKEN);
+    const fetchMock = import_vitest.vi.spyOn(globalThis, "fetch").mockImplementation(fetchReturning({ token: SIGNED_TOKEN }));
+    await (0, import_sign_token.signToken)({ issuerId: "issuer_region", region: "sfo1" });
+    const [url] = fetchMock.mock.calls[0];
+    (0, import_vitest.expect)(url.toString()).toBe(
+      "https://api-sfo1.vercel.com/v1/kms/issuers/issuer_region/sign/token"
+    );
+  });
+  (0, import_vitest.test)("uses an explicit token without fetching an OIDC token", async () => {
+    const fetchMock = import_vitest.vi.spyOn(globalThis, "fetch").mockImplementation(fetchReturning({ token: SIGNED_TOKEN }));
+    await (0, import_sign_token.signToken)({ issuerId: "issuer_explicit", token: "my-token" });
+    (0, import_vitest.expect)(getVercelOidcTokenMock).not.toHaveBeenCalled();
+    const [, init] = fetchMock.mock.calls[0];
+    (0, import_vitest.expect)((init?.headers).authorization).toBe(
+      "Bearer my-token"
+    );
+  });
+  (0, import_vitest.test)("throws a VercelKmsError mapping the API error envelope", async () => {
+    getVercelOidcTokenMock.mockResolvedValue(OIDC_TOKEN);
+    import_vitest.vi.spyOn(globalThis, "fetch").mockImplementation(
+      fetchReturning(
+        { error: { code: "issuer_not_found", message: "nope", issuerId: "x" } },
+        { status: 404, statusText: "Not Found" }
+      )
+    );
+    await (0, import_vitest.expect)((0, import_sign_token.signToken)({ issuerId: "x" })).rejects.toMatchObject({
+      name: "VercelKmsError",
+      status: 404,
+      code: "issuer_not_found",
+      message: "nope",
+      metadata: { issuerId: "x" }
+    });
+    await (0, import_vitest.expect)((0, import_sign_token.signToken)({ issuerId: "x" })).rejects.toBeInstanceOf(
+      import_errors.VercelKmsError
+    );
+  });
+});

package/dist/version.d.ts

@@ -0,0 +1 @@
+export declare const version = "0.1.1";

package/dist/version.js

@@ -0,0 +1,28 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var version_exports = {};
+__export(version_exports, {
+  version: () => version
+});
+module.exports = __toCommonJS(version_exports);
+const version = "0.1.1";
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  version
+});

package/docs/README.md

@@ -0,0 +1,20 @@
+**@vercel/kms**
+
+---
+
+# @vercel/kms
+
+## Classes
+
+- [VercelKmsError](classes/VercelKmsError.md)
+
+## Interfaces
+
+- [FlattenedJWS](interfaces/FlattenedJWS.md)
+- [SignMessageOptions](interfaces/SignMessageOptions.md)
+- [SignTokenOptions](interfaces/SignTokenOptions.md)
+
+## Functions
+
+- [signMessage](functions/signMessage.md)
+- [signToken](functions/signToken.md)

package/docs/classes/VercelKmsError.md

@@ -0,0 +1,190 @@
+[**@vercel/kms**](../README.md)
+
+---
+
+# Class: VercelKmsError
+
+Defined in: [packages/kms/src/errors.ts:7](https://github.com/vercel/vercel-internal/blob/main/packages/kms/src/errors.ts#L7)
+
+Error thrown when a Vercel KMS request fails. Mirrors the API error envelope
+`{ error: { code, message, ...meta } }`: `code` and `message` come from the
+response body when present, and any remaining fields are exposed on
+[VercelKmsError.metadata](#metadata).
+
+## Extends
+
+- [`Error`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Error)
+
+## Constructors
+
+### Constructor
+
+> **new VercelKmsError**(`__namedParameters`): `VercelKmsError`
+
+Defined in: [packages/kms/src/errors.ts:15](https://github.com/vercel/vercel-internal/blob/main/packages/kms/src/errors.ts#L15)
+
+#### Parameters
+
+##### \_\_namedParameters
+
+###### code
+
+`string`
+
+###### message
+
+`string`
+
+###### metadata?
+
+[`Record`](https://www.typescriptlang.org/docs/handbook/utility-types.html#recordkeys-type)\<`string`, `unknown`\> = `{}`
+
+###### status
+
+`number`
+
+#### Returns
+
+`VercelKmsError`
+
+#### Overrides
+
+`Error.constructor`
+
+## Properties
+
+### code
+
+> `readonly` **code**: `string`
+
+Defined in: [packages/kms/src/errors.ts:11](https://github.com/vercel/vercel-internal/blob/main/packages/kms/src/errors.ts#L11)
+
+Machine-readable error code from the API (e.g. `issuer_not_found`).
+
+---
+
+### message
+
+> **message**: `string`
+
+Defined in: node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es5.d.ts:1077
+
+#### Inherited from
+
+`Error.message`
+
+---
+
+### metadata
+
+> `readonly` **metadata**: [`Record`](https://www.typescriptlang.org/docs/handbook/utility-types.html#recordkeys-type)\<`string`, `unknown`\>
+
+Defined in: [packages/kms/src/errors.ts:13](https://github.com/vercel/vercel-internal/blob/main/packages/kms/src/errors.ts#L13)
+
+Any additional fields the API attached to the error envelope.
+
+---
+
+### name
+
+> **name**: `string`
+
+Defined in: node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es5.d.ts:1076
+
+#### Inherited from
+
+`Error.name`
+
+---
+
+### stack?
+
+> `optional` **stack?**: `string`
+
+Defined in: node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es5.d.ts:1078
+
+#### Inherited from
+
+`Error.stack`
+
+---
+
+### status
+
+> `readonly` **status**: `number`
+
+Defined in: [packages/kms/src/errors.ts:9](https://github.com/vercel/vercel-internal/blob/main/packages/kms/src/errors.ts#L9)
+
+HTTP status code of the failed response.
+
+---
+
+### prepareStackTrace?
+
+> `static` `optional` **prepareStackTrace?**: (`err`, `stackTraces`) => `any`
+
+Defined in: node_modules/.pnpm/@types+node@20.11.0/node_modules/@types/node/globals.d.ts:28
+
+Optional override for formatting stack traces
+
+#### Parameters
+
+##### err
+
+[`Error`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Error)
+
+##### stackTraces
+
+`CallSite`[]
+
+#### Returns
+
+`any`
+
+#### See
+
+https://v8.dev/docs/stack-trace-api#customizing-stack-traces
+
+#### Inherited from
+
+`Error.prepareStackTrace`
+
+---
+
+### stackTraceLimit
+
+> `static` **stackTraceLimit**: `number`
+
+Defined in: node_modules/.pnpm/@types+node@20.11.0/node_modules/@types/node/globals.d.ts:30
+
+#### Inherited from
+
+`Error.stackTraceLimit`
+
+## Methods
+
+### captureStackTrace()
+
+> `static` **captureStackTrace**(`targetObject`, `constructorOpt?`): `void`
+
+Defined in: node_modules/.pnpm/@types+node@20.11.0/node_modules/@types/node/globals.d.ts:21
+
+Create .stack property on a target object
+
+#### Parameters
+
+##### targetObject
+
+`object`
+
+##### constructorOpt?
+
+[`Function`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Function)
+
+#### Returns
+
+`void`
+
+#### Inherited from
+
+`Error.captureStackTrace`

package/docs/functions/signMessage.md

@@ -0,0 +1,27 @@
+[**@vercel/kms**](../README.md)
+
+---
+
+# Function: signMessage()
+
+> **signMessage**(`options`): [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`FlattenedJWS`](../interfaces/FlattenedJWS.md)\>
+
+Defined in: [packages/kms/src/sign-message.ts:42](https://github.com/vercel/vercel-internal/blob/main/packages/kms/src/sign-message.ts#L42)
+
+Signs a message for an issuer using its managed signing key and returns the
+resulting JOSE Flattened JWS. The message may be provided as raw bytes
+(`Uint8Array`) or a UTF-8 `string`; it is base64-encoded before being sent.
+
+## Parameters
+
+### options
+
+[`SignMessageOptions`](../interfaces/SignMessageOptions.md)
+
+## Returns
+
+[`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`FlattenedJWS`](../interfaces/FlattenedJWS.md)\>
+
+## Throws
+
+If the sign request fails.

package/docs/functions/signToken.md

@@ -0,0 +1,26 @@
+[**@vercel/kms**](../README.md)
+
+---
+
+# Function: signToken()
+
+> **signToken**(`options`): [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<`string`\>
+
+Defined in: [packages/kms/src/sign-token.ts:41](https://github.com/vercel/vercel-internal/blob/main/packages/kms/src/sign-token.ts#L41)
+
+Signs a JWT for an issuer using its managed signing key and returns the
+compact JWT string.
+
+## Parameters
+
+### options
+
+[`SignTokenOptions`](../interfaces/SignTokenOptions.md)
+
+## Returns
+
+[`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<`string`\>
+
+## Throws
+
+If the sign request fails.

package/docs/interfaces/FlattenedJWS.md

@@ -0,0 +1,53 @@
+[**@vercel/kms**](../README.md)
+
+---
+
+# Interface: FlattenedJWS
+
+Defined in: [packages/kms/src/request.ts:36](https://github.com/vercel/vercel-internal/blob/main/packages/kms/src/request.ts#L36)
+
+A JOSE Flattened JWS, as returned by the message-signing endpoint.
+
+## See
+
+https://datatracker.ietf.org/doc/html/rfc7515#section-7.2.2
+
+## Properties
+
+### header?
+
+> `optional` **header?**: [`Record`](https://www.typescriptlang.org/docs/handbook/utility-types.html#recordkeys-type)\<`string`, `unknown`\>
+
+Defined in: [packages/kms/src/request.ts:44](https://github.com/vercel/vercel-internal/blob/main/packages/kms/src/request.ts#L44)
+
+Optional unprotected JWS header.
+
+---
+
+### payload
+
+> **payload**: `string`
+
+Defined in: [packages/kms/src/request.ts:38](https://github.com/vercel/vercel-internal/blob/main/packages/kms/src/request.ts#L38)
+
+Base64url-encoded JWS payload.
+
+---
+
+### protected?
+
+> `optional` **protected?**: `string`
+
+Defined in: [packages/kms/src/request.ts:42](https://github.com/vercel/vercel-internal/blob/main/packages/kms/src/request.ts#L42)
+
+Base64url-encoded protected header.
+
+---
+
+### signature
+
+> **signature**: `string`
+
+Defined in: [packages/kms/src/request.ts:40](https://github.com/vercel/vercel-internal/blob/main/packages/kms/src/request.ts#L40)
+
+Base64url-encoded JWS signature.