# @transmute/did-jose-cose

> 🚧 This package is experimental.

Latest version **0.7.0-unstable.82** (published 2023-12-06) · Apache-2.0 license · 0 weekly downloads

## Install

```sh
npm install @transmute/did-jose-cose
pnpm add @transmute/did-jose-cose
yarn add @transmute/did-jose-cose
bun add @transmute/did-jose-cose
```

## Health

**Score 30/100 (F)** — status: abandoned.

Positive: has types; esm support; no vulnerabilities; high quality score.

Warnings: low downloads; pre 1.0.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 0.7.0-unstable.82 |
| Published | 2023-12-06 |
| First published | 2022-03-20 |
| Weekly downloads | 0 |
| License | Apache-2.0 |
| TypeScript types | bundled |
| Module format | ESM + CommonJS |
| Node | >=16 |
| Dependencies | 4 |
| Unpacked size | 236.4 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 55 |
| Author | Orie Steele |
| Maintainers | ipbyrne, or13, transmute-ci |

## Links

- npm: https://www.npmjs.com/package/@transmute/did-jose-cose
- Repository: https://github.com/transmute-industries/verifiable-data
- Homepage: https://github.com/transmute-industries/verifiable-data/tree/main/packages/did-jose-cose
- Issues: https://github.com/transmute-industries/verifiable-data/issues
- npm.io page: https://npm.io/package/@transmute/did-jose-cose

## Dependencies (4)

- [jose](https://npm.io/package/jose.md) ^4.6.0
- [cwt-js](https://npm.io/package/cwt-js.md) ^0.4.0
- [@transmute/did-key-web-crypto](https://npm.io/package/@transmute/did-key-web-crypto.md) ^0.3.0-unstable.7
- [@transmute/jsonld-document-loader](https://npm.io/package/@transmute/jsonld-document-loader.md) ^0.7.0-unstable.82

## Recent versions

- 0.7.0-unstable.82 (latest) — 2023-12-06
- 0.7.0-unstable.81 — 2023-06-10
- 0.7.0-unstable.80 — 2023-01-24
- 0.7.0-unstable.79 — 2023-01-17
- 0.7.0-unstable.78 — 2023-01-17
- 0.7.0-unstable.77 — 2022-12-16
- 0.7.0-unstable.76 — 2022-12-13
- 0.7.0-unstable.75 — 2022-12-09
- 0.7.0-unstable.74 — 2022-12-09
- 0.7.0-unstable.73 — 2022-12-06
- 0.7.0-unstable.72 — 2022-12-06
- 0.7.0-unstable.71 — 2022-11-28
- 0.7.0-unstable.70 — 2022-10-31
- 0.7.0-unstable.69 — 2022-10-31
- 0.7.0-unstable.68 — 2022-10-29
- … 11 more at https://npm.io/package/@transmute/did-jose-cose/versions

## README

### @transmute/did-jose-cose

🚧 This package is experimental.

```
npm i @transmute/did-jose-cose --save
```

Learn more about [Verifable Data](https://github.com/transmute-industries/verifiable-data).

## Usage

### JWT - JSON Web Tokens

```ts
import { jose } from "@transmute/did-jose-cose";
import { jsonWebKey, documentLoader } from "../../../__fixtures__";
it("JWT sign and verify", async () => {
  const { id, privateKeyJwk } = jsonWebKey;
  const header = { kid: id };
  const payload = {
    iss: "coap://as.example.com",
    sub: "erikw",
    aud: "coap://light.example.com",
    exp: 2444064944,
    nbf: 1443944944,
    iat: 1443944944,
    jti: "0b71",
  };
  const jwt = await jose.jwt.sign(header, payload, privateKeyJwk);
  const v = await jose.jwt.verify(jwt, id, documentLoader);
  expect(v.verified).toBe(true);
});
```

### CWT - CBOR Web Tokens

```ts
import { cose } from "@transmute/did-jose-cose";
import { jsonWebKey, documentLoader } from "../../../__fixtures__";
it("CWT sign and verify", async () => {
  const { id, privateKeyJwk } = jsonWebKey;
  const header = { kid: id };
  const payload = {
    iss: "coap://as.example.com",
    sub: "erikw",
    aud: "coap://light.example.com",
    exp: 1444064944,
    nbf: 1443944944,
    iat: 1443944944,
    cti: "0b71",
  };
  const cwt = await cose.cwt.sign(header, payload, privateKeyJwk);
  const v = await cose.cwt.verify(cwt, id, documentLoader);
  expect(v.verified).toBe(true);
});
```

#### What is a documentLoader?

A document loader helps dereference DID URLs, like:

- `did:example:123#key-0`.
- `did:key:zDnaeTMKBwx2iJpata1vSSwfpjjg1npfeYAEwMArBKbDC7iUc#zDnaeTMKBwx2iJpata1vSSwfpjjg1npfeYAEwMArBKbDC7iUc`

Transformaing these DID URLs into json documents that contain a `publicKeyJwk` property.

This key can then be used to verify JWT and CWTs.

```ts
import { resolve } from "@transmute/did-key-web-crypto";
import {
  documentLoaderFactory,
  DidUrl,
  didUrlToDid,
} from "@transmute/jsonld-document-loader";

export const documentLoader = documentLoaderFactory.build({
  ["did:key"]: async (didUrl: DidUrl) => {
    const did = didUrlToDid(didUrl);
    const { didDocument } = await resolve(did, {
      accept: "application/did+json",
    });
    // although this function returns a "DID Document"
    // The documentLoader internals find the correct "sub resource"
    // If the original DID URL contained a fragment.
    return didDocument;
  },
});
```

#### What is a JsonWebKey?

It's a json object with an `id` that becomes a `kid`.

In the case of a verification key, it contains a `publicKeyJwk` property.

In the case of a signing key, it also contains `privateKeyJwk`.

Be careful with private keys.

```ts
import { WebCryptoKey } from "@transmute/did-key-web-crypto";
const k = await WebCryptoKey.generate({
  kty: "EC",
  crvOrSize: "P-256",
});
const jsonWebKey = await k.export({
  type: "JsonWebKey2020",
  privateKey: true,
});
// export const jsonWebKey = {
//   id: "did:key:zDnaeTMKBwx2iJpata1vSSwfpjjg1npfeYAEwMArBKbDC7iUc#zDnaeTMKBwx2iJpata1vSSwfpjjg1npfeYAEwMArBKbDC7iUc",
//   type: "JsonWebKey2020",
//   controller: "did:key:zDnaeTMKBwx2iJpata1vSSwfpjjg1npfeYAEwMArBKbDC7iUc",
//   publicKeyJwk: {
//     kty: "EC",
//     crv: "P-256",
//     x: "K2Hu1HMRBpalJuqpjIyJWY1BhcPwaPoyfjhyAB6ZyqU",
//     y: "SFdiOkC4PcxDLGGatqkKmlVtSYVdhPYMWjyJEmQQqxQ",
//   },
//   privateKeyJwk: {
//     kty: "EC",
//     crv: "P-256",
//     d: "qsNrVHJIT4WLcRfdGqrdKWFp1aSEnNZXDFOLKRi1K1w",
//     x: "K2Hu1HMRBpalJuqpjIyJWY1BhcPwaPoyfjhyAB6ZyqU",
//     y: "SFdiOkC4PcxDLGGatqkKmlVtSYVdhPYMWjyJEmQQqxQ",
//   },
// };
```

---
_Source: https://npm.io/package/@transmute/did-jose-cose · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._