refactor(stdlib): remove jsonwebtoken native binding

Cargo.toml

@@ -16,7 +16,6 @@ members = [
     "crates/perry-ext-uuid",
     "crates/perry-ext-bcrypt",
     "crates/perry-ext-argon2",
-    "crates/perry-ext-jsonwebtoken",
     "crates/perry-ext-validator",
     "crates/perry-validation",
     "crates/perry-perex",
@@ -482,7 +481,6 @@ perry-ext-nanoid = { path = "crates/perry-ext-nanoid" }
 perry-ext-uuid = { path = "crates/perry-ext-uuid" }
 perry-ext-bcrypt = { path = "crates/perry-ext-bcrypt" }
 perry-ext-argon2 = { path = "crates/perry-ext-argon2" }
-perry-ext-jsonwebtoken = { path = "crates/perry-ext-jsonwebtoken" }
 perry-ext-validator = { path = "crates/perry-ext-validator" }
 perry-validation = { path = "crates/perry-validation" }
 perry-perex = { path = "crates/perry-perex" }

changelog.d/10687-jsonwebtoken-native-binding-removal.md

@@ -0,0 +1,17 @@
+Removed the native `jsonwebtoken` binding (#10683): `verify()` returned
+`null` instead of throwing on every forgery case (tampered payload, wrong
+secret, `alg:none`, garbage token, tampered signature, expired token), and
+`sign(..., { expiresIn: "1h" })` silently dropped the expiry. `import jwt
+from "jsonwebtoken"` (no `perry.compilePackages` entry) now compiles the
+real npm package from source, matching Node exactly including all six
+thrown error names/messages.
+
+Deleted both duplicate hand-written implementations (`crates/perry-ext-jsonwebtoken`
+and `crates/perry-stdlib/src/jsonwebtoken.rs`, which independently exported
+the same `js_jwt_*` symbols — #10678) plus the dedicated codegen lowering
+path in `crates/perry-codegen/src/lower_call/native/jsonwebtoken.rs` that
+bypassed the well-known-binding registry entirely. Re-wired `dep:rsa`/
+`dep:spki` directly onto perry-stdlib's `crypto` feature, since WebCrypto's
+`key_object.rs`/`keys.rs` need them unconditionally and were only reachable
+through the now-deleted `bundled-jsonwebtoken` feature by historical
+accident.

crates/perry-api-manifest/src/entries.rs

@@ -47,7 +47,6 @@ pub const NATIVE_MODULES: &[&str] = &[
     "crypto",         // (Node builtin) hashing, HMAC, cipher, sign/verify, WebCrypto
     "dotenv",         // .env file loader
     "dotenv/config",  // dotenv's auto-load-on-import subpath
-    "jsonwebtoken",   // JWT sign/verify
     "nanoid",         // compact URL-safe ID generation
     "validator",      // string validators/sanitizers
     "ethers",         // Ethereum library (utils/wallet/ABI)

crates/perry-api-manifest/src/entries/part_1.rs

@@ -1166,71 +1166,6 @@ pub(crate) const API_MANIFEST_PART_1: &[ApiEntry] = &[
         }],
         TypeSpec::Number,
     ),
-    method_sig(
-        "jsonwebtoken",
-        "sign",
-        false,
-        None,
-        &[
-            ParamSpec::Named {
-                name: "payload",
-                ty: TypeSpec::Any,
-                optional: false,
-            },
-            ParamSpec::Named {
-                name: "secret",
-                ty: TypeSpec::String,
-                optional: false,
-            },
-            ParamSpec::Named {
-                name: "options",
-                ty: TypeSpec::Any,
-                optional: true,
-            },
-            // #915: FFI's 4th arg is `kid_ptr: *const StringHeader` — the
-            // dispatch table padding zeroes it when the user doesn't pass
-            // it. Surfacing the slot in the manifest keeps the
-            // #512 arity-drift assertion happy without forcing every
-            // caller to write a 4th positional arg.
-            ParamSpec::Named {
-                name: "kid",
-                ty: TypeSpec::String,
-                optional: true,
-            },
-        ],
-        TypeSpec::String,
-    ),
-    method_sig(
-        "jsonwebtoken",
-        "verify",
-        false,
-        None,
-        &[
-            ParamSpec::Named {
-                name: "token",
-                ty: TypeSpec::String,
-                optional: false,
-            },
-            ParamSpec::Named {
-                name: "secret",
-                ty: TypeSpec::String,
-                optional: false,
-            },
-        ],
-        TypeSpec::Any,
-    ),
-    method_sig(
-        "jsonwebtoken",
-        "decode",
-        false,
-        None,
-        &[ParamSpec::Named {
-            name: "token",
-            ty: TypeSpec::String,
-            optional: false,
-        }],
-        TypeSpec::Any,
-    ),
     method_sig(
         "nodemailer",
         "createTransport",