nx_jwt.nx

jwt.nx -- JSON Web Token sign + verify (HS256 only). RFC 7519 JWT + RFC 7515 JWS + RFC 7518 algorithms. Compact serialisation: BASE64URL(header) . BASE64URL(payload) . BASE64URL(sig) Header: {\"alg\":\"HS256\",\"typ\":\"JWT\"} Payload: arbitrary JSON -- caller decides claims Sig: HMAC-SHA-256(key, \"header64.payload64\") HS256 only today -- RS256/ES256 require RSA/ECDSA, which we haven't finished. HS256 is fine for single-service auth (web app signs its own tokens, verifies its own tokens). For third-party delegation (OAuth 2) the stack will need RS256 later via rsa.nx (pending). Invariants: J1 Verification uses ct_memcmp for the signature compare -- timing-safe against forgery attempts. J2 Input parse is tolerant of missing trailing padding (base64url variant omits '='). J3 We do NOT validate payload claims (exp / nbf / iss). Caller parses the returned payload JSON and checks.