Class JWSProcessor

Handles JWT/JWS signing and verification with ES256 algorithm.

Index

Constructors

Methods

parseUnverified sign verify

Constructors

constructor

new JWSProcessor(): JWSProcessor
Returns JWSProcessor

Methods

parseUnverified

parseUnverified(
jws: string,
): Promise<
{ header: { kid?: string; zip?: string }; payload: SmartHealthCardJWT },
>
Parses a Compact JWS without verifying its signature to extract protected header and payload. If the header indicates zip: 'DEF', the payload will be decompressed. This is safe for metadata discovery (e.g., resolving JWKS by iss/kid) but MUST NOT be used to trust content.
Parameters
- jws: string
Returns Promise<{ header: { kid?: string; zip?: string }; payload: SmartHealthCardJWT }>
- Defined in src/index.ts:1518

sign

sign(
    payload: SmartHealthCardJWT,
    privateKey: string | Uint8Array<ArrayBufferLike> | CryptoKey,
    publicKey: string | Uint8Array<ArrayBufferLike> | CryptoKey,
    config?: { enableCompression?: boolean },
): Promise<string>
Signs a JWT payload using ES256 algorithm.
Parameters
- payload: SmartHealthCardJWT
  JWT payload to sign
- privateKey: string | Uint8Array<ArrayBufferLike> | CryptoKey
  ES256 private key
- publicKey: string | Uint8Array<ArrayBufferLike> | CryptoKey
  ES256 public key (for key ID derivation)
- config: { enableCompression?: boolean } = {}
  - OptionalenableCompression?: boolean
    Whether to compress payload with raw DEFLATE (default: true). When enableCompression is true, compresses payload before signing and sets zip: "DEF".
Returns Promise<string>
Promise resolving to JWS string

Throws
JWSError When signing fails, key import fails, or payload is invalid
- Defined in src/index.ts:1343

verify

verify(
    jws: string,
    publicKey: string | Uint8Array<ArrayBufferLike> | CryptoKey,
    config?: { verifyExpiration?: boolean },
): Promise<SmartHealthCardJWT>
Verifies a JWS and returns the decoded payload.
Parameters
- jws: string
  JWS string to verify
- publicKey: string | Uint8Array<ArrayBufferLike> | CryptoKey
  ES256 public key for verification
- Optionalconfig: { verifyExpiration?: boolean }
  - OptionalverifyExpiration?: boolean
    Whether to verify the JWT exp claim during verification. When true (default), expired health cards will be rejected. Set to false to allow expired cards to be accepted.
Returns Promise<SmartHealthCardJWT>
Promise resolving to decoded JWT payload

Throws
JWSError When verification fails or JWS is invalid

Remarks
To inspect headers without verification, use jose.decodeProtectedHeader(jws) from the jose library.
- Defined in src/index.ts:1426