# System map — auth0/node-jsonwebtoken

> Canonical page: https://codevetter.com/unpack/jsonwebtoken/system-map

# System map — auth0/node-jsonwebtoken

Scanned commit b924272f29192e12926b5414546f7c5bfcc9579d (2026-06-25). Generated by codevetter codevetter 1.12.0 on 2026-09-22.

This is a pure library with no server, no database, and no network I/O of its own — the only runtime boundary is the Node `crypto` module and the `jws` package. `index.js` is the whole public API surface: it re-exports `decode.js`, `verify.js`, `sign.js`, and the three error classes from `lib/`. Support modules in `lib/` are all single-purpose: feature-detection booleans gated on `process.version` via `semver`, a `ms`-backed timespan parser, and the asymmetric key/algorithm compatibility matrix. Build is nonexistent (plain CommonJS, no transpile); test is `mocha`, coverage is `nyc mocha --use_strict`, lint is `eslint .`. Deployment is npm publish driven by `semantic-release` in a two-workflow release dance on `master`.
- `index.js` is the sole entrypoint and exports exactly six symbols: `decode`, `verify`, `sign`, `JsonWebTokenError`, `NotBeforeError`, `TokenExpiredError` — there is no class, no factory, no configuration object. — [index.js#L1-8](https://github.com/auth0/node-jsonwebtoken/blob/b924272f29192e12926b5414546f7c5bfcc9579d/index.js#L1-L8)
- All cryptography is delegated to the `jws` package (`^4.0.1`): `jws.decode` in decode.js, `jws.sign`/`jws.createSign` in sign.js, and `jws.verify` in verify.js. This repo contains no hashing, HMAC, or signature code of its own. — [decode.js#L1-5](https://github.com/auth0/node-jsonwebtoken/blob/b924272f29192e12926b5414546f7c5bfcc9579d/decode.js#L1-L5) [sign.js#L232-251](https://github.com/auth0/node-jsonwebtoken/blob/b924272f29192e12926b5414546f7c5bfcc9579d/sign.js#L232-L251) [verify.js#L165](https://github.com/auth0/node-jsonwebtoken/blob/b924272f29192e12926b5414546f7c5bfcc9579d/verify.js#L165) [package.json#L40-51](https://github.com/auth0/node-jsonwebtoken/blob/b924272f29192e12926b5414546f7c5bfcc9579d/package.json#L40-L51)
- The runtime dependency set is deliberately minimal and old-school: `jws`, `ms`, `semver`, and seven separately-published single-function lodash packages (`lodash.includes`, `lodash.isboolean`, `lodash.isinteger`, `lodash.isnumber`, `lodash.isplainobject`, `lodash.isstring`, `lodash.once`). — [package.json#L40-51](https://github.com/auth0/node-jsonwebtoken/blob/b924272f29192e12926b5414546f7c5bfcc9579d/package.json#L40-L51) [sign.js#L5-11](https://github.com/auth0/node-jsonwebtoken/blob/b924272f29192e12926b5414546f7c5bfcc9579d/sign.js#L5-L11)
- Node version capability is resolved at require-time, not call-time, by three boolean modules that `semver.satisfies(process.version, ...)`: `lib/psSupported.js` (`^6.12.0 || >=8.0.0`), `lib/asymmetricKeyDetailsSupported.js` (`>=15.7.0`), and `lib/rsaPssKeyDetailsSupported.js` (`>=16.9.0`). — [lib/psSupported.js#L1-3](https://github.com/auth0/node-jsonwebtoken/blob/b924272f29192e12926b5414546f7c5bfcc9579d/lib/psSupported.js#L1-L3) [lib/asymmetricKeyDetailsSupported.js#L1-3](https://github.com/auth0/node-jsonwebtoken/blob/b924272f29192e12926b5414546f7c5bfcc9579d/lib/asymmetricKeyDetailsSupported.js#L1-L3) [lib/rsaPssKeyDetailsSupported.js#L1-3](https://github.com/auth0/node-jsonwebtoken/blob/b924272f29192e12926b5414546f7c5bfcc9579d/lib/rsaPssKeyDetailsSupported.js#L1-L3)
- PS256/PS384/PS512 are spliced into the algorithm allow-lists at module load only when `PS_SUPPORTED` — into `SUPPORTED_ALGS` at index 3 in sign.js, and appended to both `PUB_KEY_ALGS` and `RSA_KEY_ALGS` in verify.js. — [sign.js#L14-17](https://github.com/auth0/node-jsonwebtoken/blob/b924272f29192e12926b5414546f7c5bfcc9579d/sign.js#L14-L17) [verify.js#L11-19](https://github.com/auth0/node-jsonwebtoken/blob/b924272f29192e12926b5414546f7c5bfcc9579d/verify.js#L11-L19)
- The error hierarchy is hand-rolled ES5 prototype inheritance, not `class extends Error`: `JsonWebTokenError` calls `Error.call(this, message)` and manually sets `this.message`, and `NotBeforeError`/`TokenExpiredError` do `Object.create(JsonWebTokenError.prototype)` and add a `date`/`expiredAt` field. — [lib/JsonWebTokenError.js#L1-14](https://github.com/auth0/node-jsonwebtoken/blob/b924272f29192e12926b5414546f7c5bfcc9579d/lib/JsonWebTokenError.js#L1-L14) [lib/NotBeforeError.js#L1-13](https://github.com/auth0/node-jsonwebtoken/blob/b924272f29192e12926b5414546f7c5bfcc9579d/lib/NotBeforeError.js#L1-L13) [lib/TokenExpiredError.js#L1-13](https://github.com/auth0/node-jsonwebtoken/blob/b924272f29192e12926b5414546f7c5bfcc9579d/lib/TokenExpiredError.js#L1-L13)
- `lib/validateAsymmetricKey.js` owns the key-type↔algorithm compatibility matrix (`allowedAlgorithmsForKeys` for `ec`/`rsa`/`rsa-pss`) and the ES-curve mapping (`allowedCurves`: ES256→prime256v1, ES384→secp384r1, ES512→secp521r1). It is the single shared gate called by both sign and verify. — [lib/validateAsymmetricKey.js#L4-30](https://github.com/auth0/node-jsonwebtoken/blob/b924272f29192e12926b5414546f7c5bfcc9579d/lib/validateAsymmetricKey.js#L4-L30) [sign.js#L177-183](https://github.com/auth0/node-jsonwebtoken/blob/b924272f29192e12926b5414546f7c5bfcc9579d/sign.js#L177-L183) [verify.js#L154-160](https://github.com/auth0/node-jsonwebtoken/blob/b924272f29192e12926b5414546f7c5bfcc9579d/verify.js#L154-L160)
- `lib/timespan.js` is the only time-arithmetic module; it converts a `ms`-parseable string or a raw number into an absolute epoch-seconds timestamp, and returns `undefined` (not an error) for unparseable input, pushing error construction onto its three callers. — [lib/timespan.js#L1-18](https://github.com/auth0/node-jsonwebtoken/blob/b924272f29192e12926b5414546f7c5bfcc9579d/lib/timespan.js#L1-L18) [sign.js#L193-215](https://github.com/auth0/node-jsonwebtoken/blob/b924272f29192e12926b5414546f7c5bfcc9579d/sign.js#L193-L215) [verify.js#L242-245](https://github.com/auth0/node-jsonwebtoken/blob/b924272f29192e12926b5414546f7c5bfcc9579d/verify.js#L242-L245)
- Developer commands are `npm test` (bare `mocha`), `npm run coverage` (`nyc mocha --use_strict`), `npm run lint` (`eslint .`), and `npm run update-changelog` (`conventional-changelog -p conventionalcommits -i CHANGELOG.md`). `npm run prepare` installs husky hooks. — [package.json#L21-27](https://github.com/auth0/node-jsonwebtoken/blob/b924272f29192e12926b5414546f7c5bfcc9579d/package.json#L21-L27)
- CI is five GitHub Actions workflows: `test.yml` (PR-triggered matrix over Node 16/18/20/22/24), `commitlint.yml` (PR-triggered conventional-commit validation), `prepare-release.yml` and `release.yml` (both on push to master, mutually exclusive via a `chore(release):` head-commit-message guard), and `sca-scan.yml` (Snyk, via a pinned reusable workflow from `auth0/devsecops-tooling`). — [.github/workflows/test.yml#L1-38](https://github.com/auth0/node-jsonwebtoken/blob/b924272f29192e12926b5414546f7c5bfcc9579d/.github/workflows/test.yml#L1-L38) [.github/workflows/commitlint.yml](https://github.com/auth0/node-jsonwebtoken/blob/b924272f29192e12926b5414546f7c5bfcc9579d/.github/workflows/commitlint.yml) [.github/workflows/prepare-release.yml#L1-20](https://github.com/auth0/node-jsonwebtoken/blob/b924272f29192e12926b5414546f7c5bfcc9579d/.github/workflows/prepare-release.yml#L1-L20) [.github/workflows/release.yml#L1-25](https://github.com/auth0/node-jsonwebtoken/blob/b924272f29192e12926b5414546f7c5bfcc9579d/.github/workflows/release.yml#L1-L25) [.github/workflows/sca-scan.yml](https://github.com/auth0/node-jsonwebtoken/blob/b924272f29192e12926b5414546f7c5bfcc9579d/.github/workflows/sca-scan.yml)
- Publishing is `semantic-release` configured in `.releaserc.json` on the `master` branch, with conventional-commits analysis, npm publish from repo root, a `prepareCmd` of `git diff --exit-code`, and a `verifyReleaseCmd` that runs a ReversingLabs `rl-wrapper` scan over the `npm pack` tarball before release. — [.releaserc.json#L1-32](https://github.com/auth0/node-jsonwebtoken/blob/b924272f29192e12926b5414546f7c5bfcc9579d/.releaserc.json#L1-L32) [.github/workflows/release.yml#L58-72](https://github.com/auth0/node-jsonwebtoken/blob/b924272f29192e12926b5414546f7c5bfcc9579d/.github/workflows/release.yml#L58-L72)
- The published npm tarball is narrowed by the `files` allow-list to `lib`, `decode.js`, `sign.js`, `verify.js` — tests, `bin/`, and workflows never ship. `.npmignore` additionally excludes `opslevel.yml`. — [package.json#L72-77](https://github.com/auth0/node-jsonwebtoken/blob/b924272f29192e12926b5414546f7c5bfcc9579d/package.json#L72-L77) [.npmignore](https://github.com/auth0/node-jsonwebtoken/blob/b924272f29192e12926b5414546f7c5bfcc9579d/.npmignore)
- Repo ownership/routing is declared for Auth0 internal tooling: `CODEOWNERS` assigns everything to `@auth0/project-iam-protocols-engineer-codeowner` and `opslevel.yml` tags the repo to the `iam_protocols` owner. — [CODEOWNERS](https://github.com/auth0/node-jsonwebtoken/blob/b924272f29192e12926b5414546f7c5bfcc9579d/CODEOWNERS) [opslevel.yml](https://github.com/auth0/node-jsonwebtoken/blob/b924272f29192e12926b5414546f7c5bfcc9579d/opslevel.yml)
- `package.json` declares `engines.node >= 12`, but the test matrix only exercises Node 16 through 24 — the 12/14 support claim is unverified by CI. — [package.json#L68-71](https://github.com/auth0/node-jsonwebtoken/blob/b924272f29192e12926b5414546f7c5bfcc9579d/package.json#L68-L71) [.github/workflows/test.yml#L16-19](https://github.com/auth0/node-jsonwebtoken/blob/b924272f29192e12926b5414546f7c5bfcc9579d/.github/workflows/test.yml#L16-L19)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)