1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
//
// SPDX-License-Identifier: Apache-2.0
//! JOSE, JWT, and JWS helpers.
//!
//! `reallyme-jose` owns JOSE byte-format mechanics for compact JWS, JWT, and
//! JWE. Cryptographic operations are routed through `reallyme-crypto`; this
//! crate adds JOSE header policy, compact serialization, algorithm/key binding,
//! temporal JWT policy, and JWE content-encryption handling.
//!
//! # Example
//!
//! ```
//! use reallyme_jose::jwt::{decode_unsigned_jwt, encode_unsigned_jwt};
//!
//! let claims = serde_json::json!({
//! "iss": "did:me:issuer",
//! "sub": "alice",
//! });
//! let compact = encode_unsigned_jwt(&claims)?;
//! let decoded: serde_json::Value = decode_unsigned_jwt(&compact)?;
//!
//! assert_eq!(decoded.get("sub"), Some(&serde_json::json!("alice")));
//! # Ok::<(), reallyme_jose::jwt::JwtError>(())
//! ```
//!
//! Unsigned JWT decoding is a parser for profiles that explicitly allow
//! `alg = "none"`; it does not authenticate the sender. Use the signed JWT
//! verification APIs for verifier-grade paths.
compile_error!;
/// Crypto algorithm selector used by JOSE/JWT public APIs.
///
/// Consumers should import this re-export instead of depending directly on
/// `reallyme-crypto`; that keeps the algorithm type identical to the one used
/// by `reallyme-jose`.
pub use ;
/// JSON value type used by claim maps and protected-header values.
pub use Value as JsonValue;
/// Zeroizing owner used for decrypted plaintext and derived CEK bytes.
pub use Zeroizing;