@vercel/kms 0.2.1 → 0.3.1

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @vercel/kms
 
+## 0.3.1
+
+### Patch Changes
+
+- @vercel/oidc@3.8.10
+
+## 0.3.0
+
+### Minor Changes
+
+- 53fa954: Add `signJWT`, which returns `{ token, keyId, algorithm, fingerprint }`. Deprecate `signToken` in favor of `signJWT`. `signMessage` now also returns the signing key's `fingerprint`.
+
 ## 0.2.1
 
 ### Patch Changes

package/README.md

@@ -9,13 +9,13 @@ automatically via [`@vercel/oidc`](https://www.npmjs.com/package/@vercel/oidc)).
 
 ## Usage
 
-### Signing a token
+### Signing a JWT
 
 ```typescript
-import { signToken } from '@vercel/kms';
+import { signJWT } from '@vercel/kms';
 
-// Returns a compact JWT string signed by the issuer.
-const token = await signToken({
+// Returns `{ token, keyId, algorithm, fingerprint }`.
+const { token, keyId, algorithm, fingerprint } = await signJWT({
   issuerId: 'issuer_abc123',
   claims: { sub: 'user_123', scope: 'read:data' },
   ttl: 300, // seconds; defaults to 300
@@ -28,8 +28,8 @@ const token = await signToken({
 import { signMessage } from '@vercel/kms';
 
 // `message` is a UTF-8 string or raw bytes (Uint8Array); it is base64-encoded
-// internally. Returns `{ signature, keyId, algorithm }`.
-const { signature, keyId, algorithm } = await signMessage({
+// internally. Returns `{ signature, keyId, algorithm, fingerprint }`.
+const { signature, keyId, algorithm, fingerprint } = await signMessage({
   issuerId: 'issuer_abc123',
   message: 'hello world',
 });
@@ -41,7 +41,7 @@ By default the OIDC token is fetched via `getVercelOidcToken()`. To supply your
 own token, pass `token`:
 
 ```typescript
-const token = await signToken({
+const { token } = await signJWT({
   issuerId: 'issuer_abc123',
   token: myOidcToken,
 });
@@ -49,7 +49,7 @@ const token = await signToken({
 
 ## API
 
-### `signToken(options)`
+### `signJWT(options)`
 
 Signs a JWT for an issuer.
 
@@ -63,6 +63,16 @@ Signs a JWT for an issuer.
 - `region?: string` — Region for the regional KMS API host, e.g. `sfo1`, producing `https://api-<region>.vercel.com/v1`. Defaults to the `VERCEL_REGION` environment variable, falling back to `https://api.vercel.com/v1`. Ignored when `baseUrl` is set.
 - `baseUrl?: string` — Override the API base URL. Takes precedence over `region`.
 
+Returns `Promise<{ token: string, keyId: string, algorithm: string, fingerprint: string }>` — the compact JWT, plus the key id, algorithm, and public-key fingerprint of the signing key.
+
+### `signToken(options)`
+
+Deprecated: use `signJWT` instead.
+
+Signs a JWT for an issuer and returns only the compact JWT string.
+
+**Options:** same as `signJWT`.
+
 Returns `Promise<string>` — the compact JWT.
 
 ### `signMessage(options)`
@@ -77,4 +87,4 @@ Signs a message for an issuer.
 - `region?: string` — Region for the regional KMS API host, e.g. `sfo1`, producing `https://api-<region>.vercel.com/v1`. Defaults to the `VERCEL_REGION` environment variable, falling back to `https://api.vercel.com/v1`. Ignored when `baseUrl` is set.
 - `baseUrl?: string` — Override the API base URL. Takes precedence over `region`.
 
-Returns `Promise<{ signature: Uint8Array, keyId: string, algorithm: string }>` — the raw signature bytes, plus the key id and algorithm of the signing key.
+Returns `Promise<{ signature: Uint8Array, keyId: string, algorithm: string, fingerprint: string }>` — the raw signature bytes, plus the key id, algorithm, and public-key fingerprint of the signing key.

package/dist/index.d.ts

@@ -1,3 +1,4 @@
+export { signJWT, type SignJWTOptions, type SignJWTResult } from './sign-jwt';
 export { signToken, type SignTokenOptions } from './sign-token';
 export { signMessage, type SignMessageOptions, type SignMessageResult, } from './sign-message';
 export { VercelKmsError } from './errors';

package/dist/index.js

@@ -19,16 +19,19 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var src_exports = {};
 __export(src_exports, {
   VercelKmsError: () => import_errors.VercelKmsError,
+  signJWT: () => import_sign_jwt.signJWT,
   signMessage: () => import_sign_message.signMessage,
   signToken: () => import_sign_token.signToken
 });
 module.exports = __toCommonJS(src_exports);
+var import_sign_jwt = require("./sign-jwt");
 var import_sign_token = require("./sign-token");
 var import_sign_message = require("./sign-message");
 var import_errors = require("./errors");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   VercelKmsError,
+  signJWT,
   signMessage,
   signToken
 });

package/dist/sign-jwt.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Options for {@link signJWT}.
+ */
+export interface SignJWTOptions {
+    /** The ID of the issuer whose signing key should sign the token. */
+    issuerId: string;
+    /** The claims to include in the token. */
+    claims?: Record<string, unknown>;
+    /** Additional headers to include in the token. */
+    headers?: Record<string, unknown>;
+    /** The time-to-live for the token, in seconds. Defaults to 300. */
+    ttl?: number | null;
+    /**
+     * An explicit Vercel OIDC token to authenticate with. When omitted, the
+     * function's OIDC token is fetched automatically via `@vercel/oidc`.
+     */
+    token?: string;
+    /**
+     * Region for the regional KMS API host, e.g. `sfo1`, producing
+     * `https://api-<region>.vercel.com/v1`. Defaults to the `VERCEL_REGION`
+     * environment variable, falling back to the global `api.vercel.com` host.
+     * Ignored when `baseUrl` is provided.
+     */
+    region?: string;
+    /**
+     * Override the API base URL. Takes precedence over `region`.
+     * @default "https://api-<region>.vercel.com/v1" or "https://api.vercel.com/v1"
+     */
+    baseUrl?: string;
+}
+/**
+ * Result of {@link signJWT}.
+ */
+export interface SignJWTResult {
+    /** Compact JWT signed by the issuer's active signing key. */
+    token: string;
+    /** Key id of the signing key. Matches the JWKS `kid`. */
+    keyId: string;
+    /** Algorithm of the signing key. */
+    algorithm: string;
+    /**
+     * SHA-256 fingerprint of the signing key's public key (`SHA256:<base64>`).
+     */
+    fingerprint: string;
+}
+/**
+ * Signs a JWT for an issuer using its managed signing key and returns the
+ * compact JWT plus the `keyId`, `algorithm`, and `fingerprint` of the key that
+ * produced it.
+ *
+ * @throws {import('./errors').VercelKmsError} If the sign request fails.
+ */
+export declare function signJWT(options: SignJWTOptions): Promise<SignJWTResult>;

package/dist/sign-jwt.js

@@ -0,0 +1,43 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var sign_jwt_exports = {};
+__export(sign_jwt_exports, {
+  signJWT: () => signJWT
+});
+module.exports = __toCommonJS(sign_jwt_exports);
+var import_request = require("./request");
+var import_resolve_token = require("./resolve-token");
+async function signJWT(options) {
+  const { issuerId, claims = {}, headers = {}, ttl = 300, token } = options;
+  const baseUrl = (0, import_request.resolveBaseUrl)({
+    region: options.region,
+    baseUrl: options.baseUrl
+  });
+  const oidcToken = await (0, import_resolve_token.resolveOidcToken)({ token });
+  return (0, import_request.postJson)({
+    baseUrl,
+    path: `/kms/issuers/${encodeURIComponent(issuerId)}/sign/token`,
+    token: oidcToken,
+    body: { claims, headers, ttl }
+  });
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  signJWT
+});

package/dist/sign-jwt.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/sign-jwt.test.js

@@ -0,0 +1,87 @@
+"use strict";
+var import_vitest = require("vitest");
+var import_oidc = require("@vercel/oidc");
+var import_sign_jwt = require("./sign-jwt");
+var import_errors = require("./errors");
+import_vitest.vi.mock("@vercel/oidc", () => ({
+  getVercelOidcToken: import_vitest.vi.fn()
+}));
+const getVercelOidcTokenMock = import_vitest.vi.mocked(import_oidc.getVercelOidcToken);
+const OIDC_TOKEN = "oidc-token";
+const SIGNED_JWT = {
+  token: "signed.jwt.token",
+  keyId: "key_a",
+  algorithm: "ES256",
+  fingerprint: "SHA256:test"
+};
+function fetchReturning(body, init) {
+  return async () => new Response(JSON.stringify(body), { status: 200, ...init });
+}
+(0, import_vitest.describe)("signJWT", () => {
+  (0, import_vitest.beforeEach)(() => {
+    import_vitest.vi.restoreAllMocks();
+    getVercelOidcTokenMock.mockReset();
+    delete process.env.VERCEL_REGION;
+  });
+  (0, import_vitest.test)("signs a JWT and returns the token plus signing key metadata", async () => {
+    getVercelOidcTokenMock.mockResolvedValue(OIDC_TOKEN);
+    const fetchMock = import_vitest.vi.spyOn(globalThis, "fetch").mockImplementation(fetchReturning(SIGNED_JWT));
+    const result = await (0, import_sign_jwt.signJWT)({
+      issuerId: "issuer_a",
+      claims: { sub: "user" }
+    });
+    (0, import_vitest.expect)(result).toEqual(SIGNED_JWT);
+    (0, import_vitest.expect)(getVercelOidcTokenMock).toHaveBeenCalledWith();
+    (0, import_vitest.expect)(fetchMock).toHaveBeenCalledTimes(1);
+    const [url, init] = fetchMock.mock.calls[0];
+    (0, import_vitest.expect)(url.toString()).toBe(
+      "https://api.vercel.com/v1/kms/issuers/issuer_a/sign/token"
+    );
+    (0, import_vitest.expect)(init?.method).toBe("POST");
+    (0, import_vitest.expect)((init?.headers).authorization).toBe(
+      `Bearer ${OIDC_TOKEN}`
+    );
+    (0, import_vitest.expect)(JSON.parse(init?.body)).toEqual({
+      claims: { sub: "user" },
+      headers: {},
+      ttl: 300
+    });
+  });
+  (0, import_vitest.test)("targets the regional host when a region is provided", async () => {
+    getVercelOidcTokenMock.mockResolvedValue(OIDC_TOKEN);
+    const fetchMock = import_vitest.vi.spyOn(globalThis, "fetch").mockImplementation(fetchReturning(SIGNED_JWT));
+    await (0, import_sign_jwt.signJWT)({ issuerId: "issuer_region", region: "sfo1" });
+    const [url] = fetchMock.mock.calls[0];
+    (0, import_vitest.expect)(url.toString()).toBe(
+      "https://api-sfo1.vercel.com/v1/kms/issuers/issuer_region/sign/token"
+    );
+  });
+  (0, import_vitest.test)("uses an explicit token without fetching an OIDC token", async () => {
+    const fetchMock = import_vitest.vi.spyOn(globalThis, "fetch").mockImplementation(fetchReturning(SIGNED_JWT));
+    await (0, import_sign_jwt.signJWT)({ issuerId: "issuer_explicit", token: "my-token" });
+    (0, import_vitest.expect)(getVercelOidcTokenMock).not.toHaveBeenCalled();
+    const [, init] = fetchMock.mock.calls[0];
+    (0, import_vitest.expect)((init?.headers).authorization).toBe(
+      "Bearer my-token"
+    );
+  });
+  (0, import_vitest.test)("throws a VercelKmsError mapping the API error envelope", async () => {
+    getVercelOidcTokenMock.mockResolvedValue(OIDC_TOKEN);
+    import_vitest.vi.spyOn(globalThis, "fetch").mockImplementation(
+      fetchReturning(
+        { error: { code: "issuer_not_found", message: "nope", issuerId: "x" } },
+        { status: 404, statusText: "Not Found" }
+      )
+    );
+    await (0, import_vitest.expect)((0, import_sign_jwt.signJWT)({ issuerId: "x" })).rejects.toMatchObject({
+      name: "VercelKmsError",
+      status: 404,
+      code: "issuer_not_found",
+      message: "nope",
+      metadata: { issuerId: "x" }
+    });
+    await (0, import_vitest.expect)((0, import_sign_jwt.signJWT)({ issuerId: "x" })).rejects.toBeInstanceOf(
+      import_errors.VercelKmsError
+    );
+  });
+});

package/dist/sign-message.d.ts

@@ -38,12 +38,17 @@ export interface SignMessageResult {
     keyId: string;
     /** Algorithm of the signing key. */
     algorithm: string;
+    /**
+     * SHA-256 fingerprint of the signing key's public key (`SHA256:<base64>`).
+     */
+    fingerprint: string;
 }
 /**
  * Signs a message for an issuer using its managed signing key and returns the
- * raw signature over the message bytes, plus the `keyId` and `algorithm` of
- * the key that produced it. The message may be provided as raw bytes
- * (`Uint8Array`) or a UTF-8 `string`; it is base64-encoded before being sent.
+ * raw signature over the message bytes, plus the `keyId`, `algorithm`, and
+ * `fingerprint` of the key that produced it. The message may be provided as
+ * raw bytes (`Uint8Array`) or a UTF-8 `string`; it is base64-encoded before
+ * being sent.
  *
  * @throws {import('./errors').VercelKmsError} If the sign request fails.
  */

package/dist/sign-message.js

@@ -30,13 +30,13 @@ async function signMessage(options) {
     baseUrl: options.baseUrl
   });
   const oidcToken = await (0, import_resolve_token.resolveOidcToken)({ token });
-  const { signature, keyId, algorithm } = await (0, import_request.postJson)({
+  const { signature, keyId, algorithm, fingerprint } = await (0, import_request.postJson)({
     baseUrl,
     path: `/kms/issuers/${encodeURIComponent(issuerId)}/sign/message`,
     token: oidcToken,
     body: { message: toBase64(message) }
   });
-  return { signature: fromBase64(signature), keyId, algorithm };
+  return { signature: fromBase64(signature), keyId, algorithm, fingerprint };
 }
 function toBase64(message) {
   return (typeof message === "string" ? Buffer.from(message, "utf-8") : Buffer.from(message)).toString("base64");

package/dist/sign-message.test.js

@@ -22,7 +22,8 @@ const SIGNATURE_BYTES = new Uint8Array([
 const SIGNED_MESSAGE = {
   signature: SIGNATURE_B64,
   keyId: "key_a",
-  algorithm: "EdDSA"
+  algorithm: "EdDSA",
+  fingerprint: "SHA256:test"
 };
 function fetchReturning(body, init) {
   return async () => new Response(JSON.stringify(body), { status: 200, ...init });
@@ -43,7 +44,8 @@ function fetchReturning(body, init) {
     (0, import_vitest.expect)(result).toEqual({
       signature: SIGNATURE_BYTES,
       keyId: "key_a",
-      algorithm: "EdDSA"
+      algorithm: "EdDSA",
+      fingerprint: "SHA256:test"
     });
     (0, import_vitest.expect)(getVercelOidcTokenMock).toHaveBeenCalledWith();
     const [url, init] = fetchMock.mock.calls[0];

package/dist/sign-token.d.ts

@@ -1,37 +1,17 @@
+import { type SignJWTOptions } from './sign-jwt';
 /**
  * Options for {@link signToken}.
+ *
+ * @deprecated Use {@link SignJWTOptions} instead.
  */
-export interface SignTokenOptions {
-    /** The ID of the issuer whose signing key should sign the token. */
-    issuerId: string;
-    /** The claims to include in the token. */
-    claims?: Record<string, unknown>;
-    /** Additional headers to include in the token. */
-    headers?: Record<string, unknown>;
-    /** The time-to-live for the token, in seconds. Defaults to 300. */
-    ttl?: number | null;
-    /**
-     * An explicit Vercel OIDC token to authenticate with. When omitted, the
-     * function's OIDC token is fetched automatically via `@vercel/oidc`.
-     */
-    token?: string;
-    /**
-     * Region for the regional KMS API host, e.g. `sfo1`, producing
-     * `https://api-<region>.vercel.com/v1`. Defaults to the `VERCEL_REGION`
-     * environment variable, falling back to the global `api.vercel.com` host.
-     * Ignored when `baseUrl` is provided.
-     */
-    region?: string;
-    /**
-     * Override the API base URL. Takes precedence over `region`.
-     * @default "https://api-<region>.vercel.com/v1" or "https://api.vercel.com/v1"
-     */
-    baseUrl?: string;
-}
+export type SignTokenOptions = SignJWTOptions;
 /**
  * Signs a JWT for an issuer using its managed signing key and returns the
  * compact JWT string.
  *
+ * @deprecated Use {@link signJWT} instead, which returns the signed JWT plus
+ * the signing key's `keyId`, `algorithm`, and `fingerprint`.
+ *
  * @throws {import('./errors').VercelKmsError} If the sign request fails.
  */
 export declare function signToken(options: SignTokenOptions): Promise<string>;

package/dist/sign-token.js

@@ -21,22 +21,10 @@ __export(sign_token_exports, {
   signToken: () => signToken
 });
 module.exports = __toCommonJS(sign_token_exports);
-var import_request = require("./request");
-var import_resolve_token = require("./resolve-token");
+var import_sign_jwt = require("./sign-jwt");
 async function signToken(options) {
-  const { issuerId, claims = {}, headers = {}, ttl = 300, token } = options;
-  const baseUrl = (0, import_request.resolveBaseUrl)({
-    region: options.region,
-    baseUrl: options.baseUrl
-  });
-  const oidcToken = await (0, import_resolve_token.resolveOidcToken)({ token });
-  const { token: signedToken } = await (0, import_request.postJson)({
-    baseUrl,
-    path: `/kms/issuers/${encodeURIComponent(issuerId)}/sign/token`,
-    token: oidcToken,
-    body: { claims, headers, ttl }
-  });
-  return signedToken;
+  const { token } = await (0, import_sign_jwt.signJWT)(options);
+  return token;
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/sign-token.test.js

@@ -2,13 +2,17 @@
 var import_vitest = require("vitest");
 var import_oidc = require("@vercel/oidc");
 var import_sign_token = require("./sign-token");
-var import_errors = require("./errors");
 import_vitest.vi.mock("@vercel/oidc", () => ({
   getVercelOidcToken: import_vitest.vi.fn()
 }));
 const getVercelOidcTokenMock = import_vitest.vi.mocked(import_oidc.getVercelOidcToken);
 const OIDC_TOKEN = "oidc-token";
-const SIGNED_TOKEN = "signed.jwt.token";
+const SIGNED_JWT = {
+  token: "signed.jwt.token",
+  keyId: "key_a",
+  algorithm: "ES256",
+  fingerprint: "SHA256:test"
+};
 function fetchReturning(body, init) {
   return async () => new Response(JSON.stringify(body), { status: 200, ...init });
 }
@@ -18,65 +22,16 @@ function fetchReturning(body, init) {
     getVercelOidcTokenMock.mockReset();
     delete process.env.VERCEL_REGION;
   });
-  (0, import_vitest.test)("signs a token and returns the JWT string", async () => {
-    getVercelOidcTokenMock.mockResolvedValue(OIDC_TOKEN);
-    const fetchMock = import_vitest.vi.spyOn(globalThis, "fetch").mockImplementation(fetchReturning({ token: SIGNED_TOKEN }));
-    const result = await (0, import_sign_token.signToken)({
-      issuerId: "issuer_a",
-      claims: { sub: "user" }
-    });
-    (0, import_vitest.expect)(result).toBe(SIGNED_TOKEN);
-    (0, import_vitest.expect)(getVercelOidcTokenMock).toHaveBeenCalledWith();
-    (0, import_vitest.expect)(fetchMock).toHaveBeenCalledTimes(1);
-    const [url, init] = fetchMock.mock.calls[0];
-    (0, import_vitest.expect)(url.toString()).toBe(
-      "https://api.vercel.com/v1/kms/issuers/issuer_a/sign/token"
-    );
-    (0, import_vitest.expect)(init?.method).toBe("POST");
-    (0, import_vitest.expect)((init?.headers).authorization).toBe(
-      `Bearer ${OIDC_TOKEN}`
-    );
-    (0, import_vitest.expect)(JSON.parse(init?.body)).toEqual({
-      claims: { sub: "user" },
-      headers: {},
-      ttl: 300
-    });
-  });
-  (0, import_vitest.test)("targets the regional host when a region is provided", async () => {
-    getVercelOidcTokenMock.mockResolvedValue(OIDC_TOKEN);
-    const fetchMock = import_vitest.vi.spyOn(globalThis, "fetch").mockImplementation(fetchReturning({ token: SIGNED_TOKEN }));
-    await (0, import_sign_token.signToken)({ issuerId: "issuer_region", region: "sfo1" });
-    const [url] = fetchMock.mock.calls[0];
-    (0, import_vitest.expect)(url.toString()).toBe(
-      "https://api-sfo1.vercel.com/v1/kms/issuers/issuer_region/sign/token"
-    );
-  });
-  (0, import_vitest.test)("uses an explicit token without fetching an OIDC token", async () => {
-    const fetchMock = import_vitest.vi.spyOn(globalThis, "fetch").mockImplementation(fetchReturning({ token: SIGNED_TOKEN }));
-    await (0, import_sign_token.signToken)({ issuerId: "issuer_explicit", token: "my-token" });
-    (0, import_vitest.expect)(getVercelOidcTokenMock).not.toHaveBeenCalled();
-    const [, init] = fetchMock.mock.calls[0];
-    (0, import_vitest.expect)((init?.headers).authorization).toBe(
-      "Bearer my-token"
-    );
-  });
-  (0, import_vitest.test)("throws a VercelKmsError mapping the API error envelope", async () => {
+  (0, import_vitest.test)("returns the compact JWT string from the signJWT response", async () => {
     getVercelOidcTokenMock.mockResolvedValue(OIDC_TOKEN);
     import_vitest.vi.spyOn(globalThis, "fetch").mockImplementation(
-      fetchReturning(
-        { error: { code: "issuer_not_found", message: "nope", issuerId: "x" } },
-        { status: 404, statusText: "Not Found" }
-      )
-    );
-    await (0, import_vitest.expect)((0, import_sign_token.signToken)({ issuerId: "x" })).rejects.toMatchObject({
-      name: "VercelKmsError",
-      status: 404,
-      code: "issuer_not_found",
-      message: "nope",
-      metadata: { issuerId: "x" }
-    });
-    await (0, import_vitest.expect)((0, import_sign_token.signToken)({ issuerId: "x" })).rejects.toBeInstanceOf(
-      import_errors.VercelKmsError
+      fetchReturning(SIGNED_JWT)
     );
+    await (0, import_vitest.expect)(
+      (0, import_sign_token.signToken)({
+        issuerId: "issuer_a",
+        claims: { sub: "user" }
+      })
+    ).resolves.toBe(SIGNED_JWT.token);
   });
 });

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const version = "0.2.1";
+export declare const version = "0.3.1";

package/dist/version.js

@@ -21,7 +21,7 @@ __export(version_exports, {
   version: () => version
 });
 module.exports = __toCommonJS(version_exports);
-const version = "0.2.1";
+const version = "0.3.1";
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   version

package/docs/README.md

@@ -10,11 +10,17 @@
 
 ## Interfaces
 
+- [SignJWTOptions](interfaces/SignJWTOptions.md)
+- [SignJWTResult](interfaces/SignJWTResult.md)
 - [SignMessageOptions](interfaces/SignMessageOptions.md)
 - [SignMessageResult](interfaces/SignMessageResult.md)
-- [SignTokenOptions](interfaces/SignTokenOptions.md)
+
+## Type Aliases
+
+- [~~SignTokenOptions~~](type-aliases/SignTokenOptions.md)
 
 ## Functions
 
+- [signJWT](functions/signJWT.md)
 - [signMessage](functions/signMessage.md)
-- [signToken](functions/signToken.md)
+- [~~signToken~~](functions/signToken.md)

package/docs/functions/signJWT.md

@@ -0,0 +1,27 @@
+[**@vercel/kms**](../README.md)
+
+---
+
+# Function: signJWT()
+
+> **signJWT**(`options`): [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`SignJWTResult`](../interfaces/SignJWTResult.md)\>
+
+Defined in: [packages/kms/src/sign-jwt.ts:58](https://github.com/vercel/vercel-internal/blob/main/packages/kms/src/sign-jwt.ts#L58)
+
+Signs a JWT for an issuer using its managed signing key and returns the
+compact JWT plus the `keyId`, `algorithm`, and `fingerprint` of the key that
+produced it.
+
+## Parameters
+
+### options
+
+[`SignJWTOptions`](../interfaces/SignJWTOptions.md)
+
+## Returns
+
+[`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`SignJWTResult`](../interfaces/SignJWTResult.md)\>
+
+## Throws
+
+If the sign request fails.

package/docs/functions/signMessage.md

@@ -6,12 +6,13 @@
 
 > **signMessage**(`options`): [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`SignMessageResult`](../interfaces/SignMessageResult.md)\>
 
-Defined in: [packages/kms/src/sign-message.ts:55](https://github.com/vercel/vercel-internal/blob/main/packages/kms/src/sign-message.ts#L55)
+Defined in: [packages/kms/src/sign-message.ts:60](https://github.com/vercel/vercel-internal/blob/main/packages/kms/src/sign-message.ts#L60)
 
 Signs a message for an issuer using its managed signing key and returns the
-raw signature over the message bytes, plus the `keyId` and `algorithm` of
-the key that produced it. The message may be provided as raw bytes
-(`Uint8Array`) or a UTF-8 `string`; it is base64-encoded before being sent.
+raw signature over the message bytes, plus the `keyId`, `algorithm`, and
+`fingerprint` of the key that produced it. The message may be provided as
+raw bytes (`Uint8Array`) or a UTF-8 `string`; it is base64-encoded before
+being sent.
 
 ## Parameters
 

package/docs/functions/signToken.md

@@ -2,11 +2,11 @@
 
 ---
 
-# Function: signToken()
+# ~~Function: signToken()~~
 
 > **signToken**(`options`): [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<`string`\>
 
-Defined in: [packages/kms/src/sign-token.ts:41](https://github.com/vercel/vercel-internal/blob/main/packages/kms/src/sign-token.ts#L41)
+Defined in: [packages/kms/src/sign-token.ts:19](https://github.com/vercel/vercel-internal/blob/main/packages/kms/src/sign-token.ts#L19)
 
 Signs a JWT for an issuer using its managed signing key and returns the
 compact JWT string.
@@ -15,12 +15,17 @@ compact JWT string.
 
 ### options
 
-[`SignTokenOptions`](../interfaces/SignTokenOptions.md)
+[`SignJWTOptions`](../interfaces/SignJWTOptions.md)
 
 ## Returns
 
 [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<`string`\>
 
+## Deprecated
+
+Use [signJWT](signJWT.md) instead, which returns the signed JWT plus
+the signing key's `keyId`, `algorithm`, and `fingerprint`.
+
 ## Throws
 
 If the sign request fails.

package/docs/interfaces/{SignTokenOptions.md → SignJWTOptions.md}

@@ -2,11 +2,11 @@
 
 ---
 
-# Interface: SignTokenOptions
+# Interface: SignJWTOptions
 
-Defined in: [packages/kms/src/sign-token.ts:7](https://github.com/vercel/vercel-internal/blob/main/packages/kms/src/sign-token.ts#L7)
+Defined in: [packages/kms/src/sign-jwt.ts:7](https://github.com/vercel/vercel-internal/blob/main/packages/kms/src/sign-jwt.ts#L7)
 
-Options for [signToken](../functions/signToken.md).
+Options for [signJWT](../functions/signJWT.md).
 
 ## Properties
 
@@ -14,7 +14,7 @@ Options for [signToken](../functions/signToken.md).
 
 > `optional` **baseUrl?**: `string`
 
-Defined in: [packages/kms/src/sign-token.ts:32](https://github.com/vercel/vercel-internal/blob/main/packages/kms/src/sign-token.ts#L32)
+Defined in: [packages/kms/src/sign-jwt.ts:32](https://github.com/vercel/vercel-internal/blob/main/packages/kms/src/sign-jwt.ts#L32)
 
 Override the API base URL. Takes precedence over `region`.
 
@@ -30,7 +30,7 @@ Override the API base URL. Takes precedence over `region`.
 
 > `optional` **claims?**: [`Record`](https://www.typescriptlang.org/docs/handbook/utility-types.html#recordkeys-type)\<`string`, `unknown`\>
 
-Defined in: [packages/kms/src/sign-token.ts:11](https://github.com/vercel/vercel-internal/blob/main/packages/kms/src/sign-token.ts#L11)
+Defined in: [packages/kms/src/sign-jwt.ts:11](https://github.com/vercel/vercel-internal/blob/main/packages/kms/src/sign-jwt.ts#L11)
 
 The claims to include in the token.
 
@@ -40,7 +40,7 @@ The claims to include in the token.
 
 > `optional` **headers?**: [`Record`](https://www.typescriptlang.org/docs/handbook/utility-types.html#recordkeys-type)\<`string`, `unknown`\>
 
-Defined in: [packages/kms/src/sign-token.ts:13](https://github.com/vercel/vercel-internal/blob/main/packages/kms/src/sign-token.ts#L13)
+Defined in: [packages/kms/src/sign-jwt.ts:13](https://github.com/vercel/vercel-internal/blob/main/packages/kms/src/sign-jwt.ts#L13)
 
 Additional headers to include in the token.
 
@@ -50,7 +50,7 @@ Additional headers to include in the token.
 
 > **issuerId**: `string`
 
-Defined in: [packages/kms/src/sign-token.ts:9](https://github.com/vercel/vercel-internal/blob/main/packages/kms/src/sign-token.ts#L9)
+Defined in: [packages/kms/src/sign-jwt.ts:9](https://github.com/vercel/vercel-internal/blob/main/packages/kms/src/sign-jwt.ts#L9)
 
 The ID of the issuer whose signing key should sign the token.
 
@@ -60,7 +60,7 @@ The ID of the issuer whose signing key should sign the token.
 
 > `optional` **region?**: `string`
 
-Defined in: [packages/kms/src/sign-token.ts:27](https://github.com/vercel/vercel-internal/blob/main/packages/kms/src/sign-token.ts#L27)
+Defined in: [packages/kms/src/sign-jwt.ts:27](https://github.com/vercel/vercel-internal/blob/main/packages/kms/src/sign-jwt.ts#L27)
 
 Region for the regional KMS API host, e.g. `sfo1`, producing
 `https://api-<region>.vercel.com/v1`. Defaults to the `VERCEL_REGION`
@@ -73,7 +73,7 @@ Ignored when `baseUrl` is provided.
 
 > `optional` **token?**: `string`
 
-Defined in: [packages/kms/src/sign-token.ts:20](https://github.com/vercel/vercel-internal/blob/main/packages/kms/src/sign-token.ts#L20)
+Defined in: [packages/kms/src/sign-jwt.ts:20](https://github.com/vercel/vercel-internal/blob/main/packages/kms/src/sign-jwt.ts#L20)
 
 An explicit Vercel OIDC token to authenticate with. When omitted, the
 function's OIDC token is fetched automatically via `@vercel/oidc`.
@@ -84,6 +84,6 @@ function's OIDC token is fetched automatically via `@vercel/oidc`.
 
 > `optional` **ttl?**: `number` \| `null`
 
-Defined in: [packages/kms/src/sign-token.ts:15](https://github.com/vercel/vercel-internal/blob/main/packages/kms/src/sign-token.ts#L15)
+Defined in: [packages/kms/src/sign-jwt.ts:15](https://github.com/vercel/vercel-internal/blob/main/packages/kms/src/sign-jwt.ts#L15)
 
 The time-to-live for the token, in seconds. Defaults to 300.

package/docs/interfaces/SignJWTResult.md

@@ -0,0 +1,49 @@
+[**@vercel/kms**](../README.md)
+
+---
+
+# Interface: SignJWTResult
+
+Defined in: [packages/kms/src/sign-jwt.ts:38](https://github.com/vercel/vercel-internal/blob/main/packages/kms/src/sign-jwt.ts#L38)
+
+Result of [signJWT](../functions/signJWT.md).
+
+## Properties
+
+### algorithm
+
+> **algorithm**: `string`
+
+Defined in: [packages/kms/src/sign-jwt.ts:44](https://github.com/vercel/vercel-internal/blob/main/packages/kms/src/sign-jwt.ts#L44)
+
+Algorithm of the signing key.
+
+---
+
+### fingerprint
+
+> **fingerprint**: `string`
+
+Defined in: [packages/kms/src/sign-jwt.ts:48](https://github.com/vercel/vercel-internal/blob/main/packages/kms/src/sign-jwt.ts#L48)
+
+SHA-256 fingerprint of the signing key's public key (`SHA256:<base64>`).
+
+---
+
+### keyId
+
+> **keyId**: `string`
+
+Defined in: [packages/kms/src/sign-jwt.ts:42](https://github.com/vercel/vercel-internal/blob/main/packages/kms/src/sign-jwt.ts#L42)
+
+Key id of the signing key. Matches the JWKS `kid`.
+
+---
+
+### token
+
+> **token**: `string`
+
+Defined in: [packages/kms/src/sign-jwt.ts:40](https://github.com/vercel/vercel-internal/blob/main/packages/kms/src/sign-jwt.ts#L40)
+
+Compact JWT signed by the issuer's active signing key.

package/docs/interfaces/SignMessageResult.md

@@ -20,6 +20,16 @@ Algorithm of the signing key.
 
 ---
 
+### fingerprint
+
+> **fingerprint**: `string`
+
+Defined in: [packages/kms/src/sign-message.ts:48](https://github.com/vercel/vercel-internal/blob/main/packages/kms/src/sign-message.ts#L48)
+
+SHA-256 fingerprint of the signing key's public key (`SHA256:<base64>`).
+
+---
+
 ### keyId
 
 > **keyId**: `string`

package/docs/type-aliases/SignTokenOptions.md

@@ -0,0 +1,15 @@
+[**@vercel/kms**](../README.md)
+
+---
+
+# ~~Type Alias: SignTokenOptions~~
+
+> **SignTokenOptions** = [`SignJWTOptions`](../interfaces/SignJWTOptions.md)
+
+Defined in: [packages/kms/src/sign-token.ts:8](https://github.com/vercel/vercel-internal/blob/main/packages/kms/src/sign-token.ts#L8)
+
+Options for [signToken](../functions/signToken.md).
+
+## Deprecated
+
+Use [SignJWTOptions](../interfaces/SignJWTOptions.md) instead.

package/package.json

@@ -14,7 +14,7 @@
       "require": "./dist/index.js"
     }
   },
-  "version": "0.2.1",
+  "version": "0.3.1",
   "repository": {
     "directory": "packages/kms",
     "type": "git",
@@ -24,7 +24,7 @@
     "url": "https://github.com/vercel/vercel/issues"
   },
   "dependencies": {
-    "@vercel/oidc": "3.8.9"
+    "@vercel/oidc": "3.8.10"
   },
   "devDependencies": {
     "prettier": "3.8.3",