{"id":"security.jwt.jose","compat":{"runtime":"node@>=20"},"schema":"turbineh.component/v0.1","source":{"purl":"pkg:npm/jose@6.2.12","repo":"https://github.com/panva/jose","integrity":"sha512-9NiFmJEex0sy2Dk58j2UGBSHgUs2ypF9eZSu4L6vjOX3Dp96Sw1F3uL+H+D1sx02jZZdzUT0HgvCy59CuvXcWw=="},"status":"approved","effects":{"db":false,"fs":false,"network":false,"external_services":[]},"license":{"declared":"MIT","detected":"MIT","obligations":["preserve-notice"]},"quality":{"tests":{"date":"2026-10-10","passed":true,"command":"contract.test.ts (vitest, sandbox --network none)"}},"version":"0.1.0","category":"security","contract":{"errors":["see contract.test.ts"],"inputs":["see contract.test.ts"],"limits":["see contract.test.ts"],"outputs":["see contract.test.ts"]},"evidence":[{"ref":"npm registry metadata jose@6.2.12","claim":"License MIT","origin":"maintainer"},{"ref":"https://api.osv.dev/v1/query","claim":"0 OSV advisories for jose@6.2.12 on 2026-10-10","origin":"tested"},{"ref":"/Users/alexruiz/TURBINEH/YES-IF-API-PRODUCT/code-api-turbineh/bench/results/2026-10-10-certify-batch-2.json","claim":"Contract tests pass in the sandbox without network","origin":"tested"}],"security":{"scope":"Known advisories for this exact version (OSV). Transitive dependencies are scanned when the component is assembled.","tools":["osv.dev-api"],"findings":[],"scanned_at":"2026-10-10"},"relations":{"provides":["security.jwt"],"requires":[],"conflicts":[],"tested_with":["contract-harness"]},"capability":{"cons":[],"does":"Standards-based JWT/JWS/JWE signing and verification with WebCrypto","pros":[],"does_not":"Does not manage key rotation or storage","use_cases":["saas-crud","internal-tool","landing-waitlist","bookings","client-portal"],"alternatives":[]},"integration":{"config":[],"install":"pnpm add jose@6.2.12","strategy":"dependency","migrations":false}}