Typed claims, header, and JWKS document decoding for statically compiled verifiers

[quinnj]

Makes every decode on the verification path concretely typed, so a server compiled with juliac --trim=safe verifies with zero JWTs-owned errors (JuliaCon 2026 workshop app; the residual set there is now Base toolchain machinery only). Five commits, each keeping the default dynamic path unchanged:

Verifier{S,F} → parametric on key source and clock (earlier commits): a verifier over a static keyset no longer reaches the remote-JWKS machinery statically, and remote key sets are fetched with HTTP.jl instead of Downloads (the downloader keyword is accepted and ignored; fetcher remains the customization point) — dropping libcurl from every consumer.

Application-declared claims type: Verifier(...; claims=MyClaims) decodes payloads with JSON.parse(payload, MyClaims), and every validation read goes through one accessor seam (claimvalue/hasclaim: dict lookup or struct field), so claim_string/claim_number/claim_audiences never see an Any. VerifiedJWT{C} carries the typed claims; claimstype(verifier) reports it; the default remains Dict{String,Any}. Mirrors the store-side design in JuliaServices/OAuth.jl#46.

Typed JOSE header: JWTHeaderClaims gains the registered typ member and verify decodes headers into it (with the pre-JSON-1 dict fallback the code already used for jwt_header_string_claim). VerifiedJWT.header is now a JWTHeaderClaims — a public field type change.

Typed JWKS documents: fetched key-set documents parse as JWKSDocument{keys::Vector{JWKSKey}}, where JWKSKey is one optional String per RFC 7517/7518 member the refresh reads (unknown members like x5c are skipped). refresh!/default_jwk_alg read members through a two-method seam — the public Vector-of-dicts path keeps its exact KeyError/TypeError behavior; the typed path constant-folds to field accesses. The custom-fetcher arm and pre-JSON-1 fallback stay dynamic by design. Note for reviewers: a first cut typed the keys as Vector{Dict{String,Any}}, which made things far worse under trim (Dict{String,Any} as a typed-parse target drags make(::Type{Any}) and its error-display machinery into the graph) — the member struct is the shape that verifies.

Suite green throughout, including the package's own trim harness; a typed-verifier test covers the declared-claims path end to end.

🤖 Generated with Claude Code

Review follow-up

• Use the type-first Verifier(MyClaims, ...) API for static claim types. No Val API is used.
• Reject unsupported JOSE critical and unencoded-payload headers.
• Preserve missing versus null audience errors and cover remote typed verifiers.
• Raise the Julia floor to 1.10 to match HTTP 2.
• Keep the 32-bit package job, but skip Reseau's unsupported precompile workload on that architecture.

Validation: Julia 1.10 and current suites pass. The current suite has 2,704 checks. The typed verification trim workload builds and runs with zero verifier errors. A clean local coverage run reports 100% coverage for changed source lines.

Co-authored by Codex