micro509/jose

Optional JOSE surface: signed compact JWS and JWT (RS256), JWK Sets, and opt-in remote JWKS resolution. Importing this entrypoint performs no network access.

Start with verifyJwt for tokens, createJwksKeyResolver for a local JWK Set, and createRemoteJwksKeyResolver to read keys from a trusted URL.

Functions

• createJwksKeyResolver — Creates a key resolver over a fixed JWK Set.
• importJwkEntry — Imports a selected entry as a verify-only RS256 CryptoKey.
• parseJwks — Parses a JWK Set document.
• selectJwk — Selects the one key of a set that can verify selector.
• parseCompactJws — Parses a compact JWS without checking its signature.
• signCompactJws — Signs a compact JWS with an existing private CryptoKey.
• verifyCompactJws — Verifies a compact JWS.
• decodeJwtUnverified — Decodes a JWT without checking its signature. Every field of the result is unauthenticated.
• signJwt — Signs a JWT. The header carries typ: "JWT" unless header.typ says otherwise.
• verifyJwt — Verifies a JWT: the signature and tokenType policy as verifyCompactJws applies
• createRemoteJwksKeyResolver — Creates a key resolver that reads a JWK Set from one trusted URL.

Types

• JsonObject — A parsed JSON object.
• JsonValue — A parsed JSON value. Objects are plain records whose members are all own data properties.
• JoseErrorCode — Every code a JOSE API reports.
• JoseErrorDetails — Structured context for a failure. Holds names and short identifiers only, never token
• JoseErrorResult — A flattened failed result carrying a JoseFailure.
• JoseFailure — Failure payload of the JOSE APIs.
• JoseResult — Success-or-failure result of a JOSE API.
• JwsParseErrorCode — Reasons a compact serialization is refused before any signature is checked.
• JwsPolicyErrorCode — Reasons a well-formed token is refused by the verification policy or its signature.
• JwtClaimsErrorCode — Reasons a signature-verified token fails the claims policy.
• KeyResolutionErrorCode — Reasons a signing key cannot be resolved for a token.
• VerifyJwsErrorCode — Failure codes of verifyCompactJws.
• VerifyJwtErrorCode — Failure codes of verifyJwt.
• JwkEntry — One key of a JWK Set.
• JwkEntryBase — Members shared by every parsed entry.
• JwkMetadata — Members every JWK entry carries beside its key material.
• JwkSelector — What selectJwk matches against.
• Jwks — A parsed JWK Set.
• JwksLimits — Bounds applied while parsing a JWK Set.
• ParseJwksErrorCode — Codes parseJwks returns.
• RsaJwkEntry — An RSA public key entry.
• UnsupportedJwkEntry — An entry this module never selects: a kty other than RSA, or an entry with missing or
• JoseLimits — Size and structure bounds enforced before any expensive parsing.
• JwsAlgorithm — Signature algorithms this module signs and verifies.
• JwsHeader — A protected header. Every member the token carried stays reachable through members.
• JwsHeaderInput — Header members signCompactJws sets beside alg.
• JwsKeyRequest — What a key resolver is asked for. The header is unauthenticated.
• JwsKeyResolver — Supplies the verification key for a token.
• SignJoseErrorCode — Codes signCompactJws and signJwt throw.
• SignJwsInput — Input for signCompactJws.
• TokenTypePolicy — Expectation for the typ header (RFC 7515 §4.1.9, RFC 8725 §3.11).
• Unchecked — Marks a policy dimension as deliberately not checked.
• UnverifiedJws — A parsed token whose signature has not been checked. Nothing in it is trustworthy until
• VerifiedJws — A token whose signature verified under the caller's algorithm and key policy.
• VerifyJwsOptions — Options for verifyCompactJws.
• FutureIssuedAtPolicy — Whether an iat later than the clock is accepted.
• JwtClaimsPolicy — Claims policy for verifyJwt. Application authorization stays with the caller.
• RegisteredClaims — The RFC 7519 §4.1 registered claims, each checked against its defined type.
• SignJwtInput — Input for signJwt.
• UnverifiedJwt — A decoded JWT whose signature has not been checked.
• VerifiedJwt — A JWT whose signature and claims both passed the caller's policy.
• VerifyJwtOptions — Options for verifyJwt.
• JwksRequestInit — The request JwksTransport must issue.
• JwksTransport — Performs one HTTP request. fetch satisfies this type. Supply another to route through a proxy,
• RemoteJwksConfig — Configuration of createRemoteJwksKeyResolver.
• RemoteJwksConfigErrorCode — Codes createRemoteJwksKeyResolver throws for unusable configuration.
• RemoteJwksRedirectPolicy — Redirect handling for a remote JWK Set. By default redirects are refused.

Variables

• DEFAULT_JWKS_LIMITS — The limits applied when a caller supplies none.
• DEFAULT_JOSE_LIMITS — The limits applied when a caller supplies none.
• JWS_ALGORITHMS — Every JwsAlgorithm.
• MIN_RS256_MODULUS_BITS — Smallest RSA modulus RS256 accepts (RFC 7518 §3.3).
• MAX_CLOCK_TOLERANCE_SECONDS — Largest clock tolerance JwtClaimsPolicy.clockToleranceSeconds accepts.