Summary
Replace the jose npm dependency with the native Web Crypto API to achieve a truly zero-dependency library.
Motivation
- The library advertises itself as "minimal, zero-build" but still pulls in
jose (~45kb)
- Modern browsers ship Web Crypto API with full support for JWT signing, verification, and key generation
- Removing
jose means zero dependencies, smaller bundle, no supply chain risk
Web Crypto equivalents
| jose function |
Web Crypto replacement |
generateKeyPair |
crypto.subtle.generateKey |
SignJWT |
crypto.subtle.sign + manual JWT construction |
jwtVerify |
crypto.subtle.verify |
exportJWK |
crypto.subtle.exportKey('jwk', ...) |
calculateJwkThumbprint |
crypto.subtle.digest('SHA-256', ...) |
createRemoteJWKSet |
fetch + crypto.subtle.importKey |
decodeJwt |
JSON.parse(atob(token.split('.')[1])) |
Acceptance criteria
Summary
Replace the
josenpm dependency with the native Web Crypto API to achieve a truly zero-dependency library.Motivation
jose(~45kb)josemeans zero dependencies, smaller bundle, no supply chain riskWeb Crypto equivalents
generateKeyPaircrypto.subtle.generateKeySignJWTcrypto.subtle.sign+ manual JWT constructionjwtVerifycrypto.subtle.verifyexportJWKcrypto.subtle.exportKey('jwk', ...)calculateJwkThumbprintcrypto.subtle.digest('SHA-256', ...)createRemoteJWKSetfetch+crypto.subtle.importKeydecodeJwtJSON.parse(atob(token.split('.')[1]))Acceptance criteria
joseimports replaced with Web Crypto API callsjoseremoved from package.json dependencies