Update export styles for ESM compatibility

[joshkel]

Description

Node.js's ESM-to-CJS interoperability only supports a limited subset of exports. (See cjs-module-lexer for details.) By switching to one of the supported styles, ESM code can use named imports from jsonwebtoken.

References

This issue is further documented as the "Named Exports" error on Are the Types Wrong.

Fixes #963, #875

Testing

To demonstrate, create a test.mjs:

// Within the jsonwebtoken directory:
import { verify } from './index.js';
// Or importing from an installed jsonwebtoken package:
import { verify } from 'jsonwebtoken';
verify('a', 'a');

Without this change:

import { verify } from './index.js';
         ^^^^^^
SyntaxError: Named export 'verify' not found. The requested module './index.js' is a CommonJS module, which may not support all module.exports as named exports.
CommonJS modules can always be imported via the default export, for example using:

With this change: Successful execution (in this case, a "jwt malformed" error).

Tested in Node.js 24.4.1

Checklist

• I have added documentation for new/changed functionality in this PR or in auth0.com/docs
• All active GitHub checks for tests, formatting, and security are passing
• The correct base branch is being used, if not the default branch