@sourceregistry/node-jwt 1.4.0 → 1.5.0

package/dist/{index-BmAAEOLC.js → index-BH3QmxZ_.js}

@@ -1,9 +1,9 @@
-import p, { sign as R, createSign as l, createHmac as m, verify as x, createVerify as S, timingSafeEqual as O, createPrivateKey as I, createSecretKey as B, createPublicKey as T, createHash as K } from "crypto";
-const v = {
+import w, { sign as L, createSign as m, createHmac as I, verify as C, createVerify as v, timingSafeEqual as M, createPrivateKey as P, createSecretKey as k, createPublicKey as _, createHash as N } from "crypto";
+const K = {
   encode: (e) => Buffer.from(e).toString("base64url"),
   decode: (e) => Buffer.from(e, "base64url").toString()
-}, b = (e, t) => e.length !== t.length ? !1 : O(Buffer.from(e), Buffer.from(t));
-function P(e) {
+}, B = (e, t) => e.length !== t.length ? !1 : M(Buffer.from(e), Buffer.from(t));
+function R(e) {
   switch (e) {
     case "ES256":
     case "ES256K":
@@ -19,97 +19,97 @@ function P(e) {
       throw new Error(`Unsupported ECDSA alg for JOSE conversion: ${e}`);
   }
 }
-function H(e, t) {
+function G(e, t) {
   let r = 0;
   if (e[r++] !== 48) throw new Error("Invalid DER ECDSA signature");
   let n = e[r++];
   if (n & 128) {
-    const y = n & 127;
+    const g = n & 127;
     n = 0;
-    for (let o = 0; o < y; o++) n = n << 8 | e[r++];
+    for (let o = 0; o < g; o++) n = n << 8 | e[r++];
   }
   if (e[r++] !== 2) throw new Error("Invalid DER ECDSA signature (r)");
   const s = e[r++];
   let a = e.subarray(r, r + s);
   if (r += s, e[r++] !== 2) throw new Error("Invalid DER ECDSA signature (s)");
-  const f = e[r++];
-  let i = e.subarray(r, r + f);
+  const c = e[r++];
+  let i = e.subarray(r, r + c);
   for (; a.length > t / 2 && a[0] === 0; ) a = a.subarray(1);
   for (; i.length > t / 2 && i[0] === 0; ) i = i.subarray(1);
-  const u = Buffer.concat([Buffer.alloc(t / 2 - a.length, 0), a]), c = Buffer.concat([Buffer.alloc(t / 2 - i.length, 0), i]);
-  return Buffer.concat([u, c]);
+  const d = Buffer.concat([Buffer.alloc(t / 2 - a.length, 0), a]), f = Buffer.concat([Buffer.alloc(t / 2 - i.length, 0), i]);
+  return Buffer.concat([d, f]);
 }
-function E(e) {
+function J(e) {
   const t = e.length / 2;
   let r = e.subarray(0, t), n = e.subarray(t);
   for (; r.length > 1 && r[0] === 0 && (r[1] & 128) === 0; ) r = r.subarray(1);
   for (; n.length > 1 && n[0] === 0 && (n[1] & 128) === 0; ) n = n.subarray(1);
   r[0] & 128 && (r = Buffer.concat([Buffer.from([0]), r])), n[0] & 128 && (n = Buffer.concat([Buffer.from([0]), n]));
-  const s = Buffer.concat([Buffer.from([2, r.length]), r]), a = Buffer.concat([Buffer.from([2, n.length]), n]), f = s.length + a.length;
+  const s = Buffer.concat([Buffer.from([2, r.length]), r]), a = Buffer.concat([Buffer.from([2, n.length]), n]), c = s.length + a.length;
   let i;
-  if (f < 128)
-    i = Buffer.from([f]);
+  if (c < 128)
+    i = Buffer.from([c]);
   else {
-    const u = [];
-    let c = f;
-    for (; c > 0; )
-      u.unshift(c & 255), c >>= 8;
-    i = Buffer.from([128 | u.length, ...u]);
+    const d = [];
+    let f = c;
+    for (; f > 0; )
+      d.unshift(f & 255), f >>= 8;
+    i = Buffer.from([128 | d.length, ...d]);
   }
   return Buffer.concat([Buffer.from([48]), i, s, a]);
 }
-function D(e) {
+function $(e) {
   return e === "ES256" || e === "ES384" || e === "ES512" || e === "ES256K";
 }
-const g = {
+const p = {
   // HMAC
   HS256: {
-    sign: (e, t) => m("sha256", t).update(e).digest("base64url"),
+    sign: (e, t) => I("sha256", t).update(e).digest("base64url"),
     verify: (e, t, r) => {
-      const n = m("sha256", t).update(e).digest("base64url");
-      return b(n, r);
+      const n = I("sha256", t).update(e).digest("base64url");
+      return B(n, r);
     }
   },
   HS384: {
-    sign: (e, t) => m("sha384", t).update(e).digest("base64url"),
+    sign: (e, t) => I("sha384", t).update(e).digest("base64url"),
     verify: (e, t, r) => {
-      const n = m("sha384", t).update(e).digest("base64url");
-      return b(n, r);
+      const n = I("sha384", t).update(e).digest("base64url");
+      return B(n, r);
     }
   },
   HS512: {
-    sign: (e, t) => m("sha512", t).update(e).digest("base64url"),
+    sign: (e, t) => I("sha512", t).update(e).digest("base64url"),
     verify: (e, t, r) => {
-      const n = m("sha512", t).update(e).digest("base64url");
-      return b(n, r);
+      const n = I("sha512", t).update(e).digest("base64url");
+      return B(n, r);
     }
   },
   // RSA (DER-encoded signatures, base64url)
   RS256: {
-    sign: (e, t) => l("RSA-SHA256").update(e).end().sign(t).toString("base64url"),
+    sign: (e, t) => m("RSA-SHA256").update(e).end().sign(t).toString("base64url"),
     verify: (e, t, r) => {
       try {
-        return S("RSA-SHA256").update(e).end().verify(t, Buffer.from(r, "base64url"));
+        return v("RSA-SHA256").update(e).end().verify(t, Buffer.from(r, "base64url"));
       } catch {
         return !1;
       }
     }
   },
   RS384: {
-    sign: (e, t) => l("RSA-SHA384").update(e).end().sign(t).toString("base64url"),
+    sign: (e, t) => m("RSA-SHA384").update(e).end().sign(t).toString("base64url"),
     verify: (e, t, r) => {
       try {
-        return S("RSA-SHA384").update(e).end().verify(t, Buffer.from(r, "base64url"));
+        return v("RSA-SHA384").update(e).end().verify(t, Buffer.from(r, "base64url"));
       } catch {
         return !1;
       }
     }
   },
   RS512: {
-    sign: (e, t) => l("RSA-SHA512").update(e).end().sign(t).toString("base64url"),
+    sign: (e, t) => m("RSA-SHA512").update(e).end().sign(t).toString("base64url"),
     verify: (e, t, r) => {
       try {
-        return S("RSA-SHA512").update(e).end().verify(t, Buffer.from(r, "base64url"));
+        return v("RSA-SHA512").update(e).end().verify(t, Buffer.from(r, "base64url"));
       } catch {
         return !1;
       }
@@ -117,58 +117,58 @@ const g = {
   },
   // ECDSA (DER-encoded by default — no dsaEncoding!)
   ES256: {
-    sign: (e, t) => l("SHA256").update(e).end().sign(t).toString("base64url"),
+    sign: (e, t) => m("SHA256").update(e).end().sign(t).toString("base64url"),
     verify: (e, t, r) => {
       try {
-        return S("SHA256").update(e).end().verify(t, Buffer.from(r, "base64url"));
+        return v("SHA256").update(e).end().verify(t, Buffer.from(r, "base64url"));
       } catch {
         return !1;
       }
     }
   },
   ES384: {
-    sign: (e, t) => l("SHA384").update(e).end().sign(t).toString("base64url"),
+    sign: (e, t) => m("SHA384").update(e).end().sign(t).toString("base64url"),
     verify: (e, t, r) => {
       try {
-        return S("SHA384").update(e).end().verify(t, Buffer.from(r, "base64url"));
+        return v("SHA384").update(e).end().verify(t, Buffer.from(r, "base64url"));
       } catch {
         return !1;
       }
     }
   },
   ES512: {
-    sign: (e, t) => l("SHA512").update(e).end().sign(t).toString("base64url"),
+    sign: (e, t) => m("SHA512").update(e).end().sign(t).toString("base64url"),
     verify: (e, t, r) => {
       try {
-        return S("SHA512").update(e).end().verify(t, Buffer.from(r, "base64url"));
+        return v("SHA512").update(e).end().verify(t, Buffer.from(r, "base64url"));
       } catch {
         return !1;
       }
     }
   },
   ES256K: {
-    sign: (e, t) => l("SHA256").update(e).end().sign(t).toString("base64url"),
+    sign: (e, t) => m("SHA256").update(e).end().sign(t).toString("base64url"),
     verify: (e, t, r) => {
       try {
-        return S("SHA256").update(e).end().verify(t, Buffer.from(r, "base64url"));
+        return v("SHA256").update(e).end().verify(t, Buffer.from(r, "base64url"));
       } catch {
         return !1;
       }
     }
   },
   PS256: {
-    sign: (e, t) => l("RSA-SHA256").update(e).end().sign({
+    sign: (e, t) => m("RSA-SHA256").update(e).end().sign({
       //@ts-ignore
       key: t,
-      padding: p.constants.RSA_PKCS1_PSS_PADDING,
+      padding: w.constants.RSA_PKCS1_PSS_PADDING,
       saltLength: 32
     }).toString("base64url"),
     verify: (e, t, r) => {
       try {
-        return S("RSA-SHA256").update(e).end().verify({
+        return v("RSA-SHA256").update(e).end().verify({
           //@ts-ignore
           key: t,
-          padding: p.constants.RSA_PKCS1_PSS_PADDING,
+          padding: w.constants.RSA_PKCS1_PSS_PADDING,
           saltLength: 32
         }, Buffer.from(r, "base64url"));
       } catch {
@@ -177,18 +177,18 @@ const g = {
     }
   },
   PS384: {
-    sign: (e, t) => l("RSA-SHA384").update(e).end().sign({
+    sign: (e, t) => m("RSA-SHA384").update(e).end().sign({
       //@ts-ignore
       key: t,
-      padding: p.constants.RSA_PKCS1_PSS_PADDING,
+      padding: w.constants.RSA_PKCS1_PSS_PADDING,
       saltLength: 48
     }).toString("base64url"),
     verify: (e, t, r) => {
       try {
-        return S("RSA-SHA384").update(e).end().verify({
+        return v("RSA-SHA384").update(e).end().verify({
           //@ts-ignore
           key: t,
-          padding: p.constants.RSA_PKCS1_PSS_PADDING,
+          padding: w.constants.RSA_PKCS1_PSS_PADDING,
           saltLength: 48
         }, Buffer.from(r, "base64url"));
       } catch {
@@ -197,18 +197,18 @@ const g = {
     }
   },
   PS512: {
-    sign: (e, t) => l("RSA-SHA512").update(e).end().sign({
+    sign: (e, t) => m("RSA-SHA512").update(e).end().sign({
       //@ts-ignore
       key: t,
-      padding: p.constants.RSA_PKCS1_PSS_PADDING,
+      padding: w.constants.RSA_PKCS1_PSS_PADDING,
       saltLength: 64
     }).toString("base64url"),
     verify: (e, t, r) => {
       try {
-        return S("RSA-SHA512").update(e).end().verify({
+        return v("RSA-SHA512").update(e).end().verify({
           //@ts-ignore
           key: t,
-          padding: p.constants.RSA_PKCS1_PSS_PADDING,
+          padding: w.constants.RSA_PKCS1_PSS_PADDING,
           saltLength: 64
         }, Buffer.from(r, "base64url"));
       } catch {
@@ -217,10 +217,10 @@ const g = {
     }
   },
   EdDSA: {
-    sign: (e, t) => R(null, typeof e == "string" ? Buffer.from(e, "utf8") : e, t).toString("base64url"),
+    sign: (e, t) => L(null, typeof e == "string" ? Buffer.from(e, "utf8") : e, t).toString("base64url"),
     verify: (e, t, r) => {
       try {
-        return x(
+        return C(
           null,
           typeof e == "string" ? Buffer.from(e, "utf8") : e,
           t,
@@ -231,8 +231,8 @@ const g = {
       }
     }
   }
-}, F = Object.keys(g);
-function $(e) {
+}, re = Object.keys(p);
+function V(e) {
   if (e.type === "secret") return "HS256";
   if (e.type !== "private") throw new Error("Only private or symmetric keys can be used to sign JWTs");
   const t = e.asymmetricKeyType, r = e.asymmetricKeyDetails;
@@ -276,18 +276,18 @@ function $(e) {
       throw new Error(`Unsupported asymmetric key type: ${t}`);
   }
 }
-function k(e) {
+function q(e) {
   if (typeof e == "object" && "type" in e) return e;
   try {
-    return I(e);
+    return P(e);
   } catch {
     const t = typeof e == "string" ? Buffer.from(e, "utf8") : Buffer.isBuffer(e) ? e : (() => {
       throw new Error("Unsupported key type");
     })();
-    return B(t);
+    return k(t);
   }
 }
-const _ = (e) => {
+const x = (e) => {
   const t = e.split(".");
   if (t.length !== 3)
     throw new Error('Invalid JWT: must contain exactly 3 parts separated by "."');
@@ -295,27 +295,27 @@ const _ = (e) => {
   if (!r || !n || !s)
     throw new Error("Invalid JWT: empty part detected");
   try {
-    const a = JSON.parse(v.decode(r)), f = JSON.parse(v.decode(n));
-    return { header: a, payload: f, signature: s };
+    const a = JSON.parse(K.decode(r)), c = JSON.parse(K.decode(n));
+    return { header: a, payload: c, signature: s };
   } catch (a) {
     throw new Error(`Invalid JWT: malformed header or payload (${a.message})`);
   }
-}, W = (e, t, r = {}) => {
-  const n = k(t), s = r.alg ?? $(n), a = r.signatureFormat ?? "der", f = r.typ ?? "JWT";
-  if (!(s in g)) throw new Error(`Unsupported algorithm: ${s}`);
-  const i = { alg: s, typ: f };
+}, F = (e, t, r = {}) => {
+  const n = q(t), s = r.alg ?? V(n), a = r.signatureFormat ?? "der", c = r.typ ?? "JWT";
+  if (!(s in p)) throw new Error(`Unsupported algorithm: ${s}`);
+  const i = { alg: s, typ: c };
   r.kid && (i.kid = r.kid);
-  const u = v.encode(JSON.stringify(i)), c = v.encode(JSON.stringify(e)), y = `${u}.${c}`;
-  let o = g[s].sign(y, t);
-  if (a === "jose" && D(s)) {
-    const d = Buffer.from(o, "base64url");
-    o = H(d, P(s)).toString("base64url");
+  const d = K.encode(JSON.stringify(i)), f = K.encode(JSON.stringify(e)), g = `${d}.${f}`;
+  let o = p[s].sign(g, t);
+  if (a === "jose" && $(s)) {
+    const y = Buffer.from(o, "base64url");
+    o = G(y, R(s)).toString("base64url");
   }
-  return `${u}.${c}.${o}`;
-}, U = (e, t, r = {}) => {
+  return `${d}.${f}.${o}`;
+}, j = (e, t, r = {}) => {
   let n;
   try {
-    n = _(e);
+    n = x(e);
   } catch (o) {
     return {
       valid: !1,
@@ -325,8 +325,8 @@ const _ = (e) => {
       }
     };
   }
-  const { header: s, payload: a, signature: f } = n, i = s.alg;
-  if (!(i in g))
+  const { header: s, payload: a, signature: c } = n, i = s.alg;
+  if (!(i in p))
     return {
       valid: !1,
       error: {
@@ -350,34 +350,34 @@ const _ = (e) => {
         code: "INVALID_TYPE"
       }
     };
-  const u = `${v.encode(JSON.stringify(s))}.${v.encode(JSON.stringify(a))}`;
-  if (D(i)) {
+  const d = `${K.encode(JSON.stringify(s))}.${K.encode(JSON.stringify(a))}`;
+  if ($(i)) {
     const o = r.signatureFormat;
-    let d;
+    let y;
     if (o === "jose")
       try {
-        const h = Buffer.from(f, "base64url"), A = E(h).toString("base64url");
-        d = g[i].verify(u, t, A);
+        const S = Buffer.from(c, "base64url"), l = J(S).toString("base64url");
+        y = p[i].verify(d, t, l);
       } catch {
-        d = !1;
+        y = !1;
       }
     else if (o === "der")
-      d = g[i].verify(u, t, f);
-    else if (d = g[i].verify(u, t, f), !d)
+      y = p[i].verify(d, t, c);
+    else if (y = p[i].verify(d, t, c), !y)
       try {
-        const h = Buffer.from(f, "base64url");
-        if (h.length === P(i)) {
-          const A = E(h).toString("base64url");
-          d = g[i].verify(u, t, A);
+        const S = Buffer.from(c, "base64url");
+        if (S.length === R(i)) {
+          const l = J(S).toString("base64url");
+          y = p[i].verify(d, t, l);
         }
       } catch {
       }
-    if (!d)
+    if (!y)
       return { valid: !1, error: { reason: "Signature verification failed", code: "INVALID_SIGNATURE" } };
-  } else if (!g[i].verify(u, t, f))
+  } else if (!p[i].verify(d, t, c))
     return { valid: !1, error: { reason: "Signature verification failed", code: "INVALID_SIGNATURE" } };
-  const c = Math.floor(Date.now() / 1e3), y = r.clockSkew ?? 0;
-  if (!r.ignoreExpiration && a.exp !== void 0 && c > a.exp + y)
+  const f = Math.floor(Date.now() / 1e3), g = r.clockSkew ?? 0;
+  if (!r.ignoreExpiration && a.exp !== void 0 && f > a.exp + g)
     return {
       valid: !1,
       error: {
@@ -385,7 +385,7 @@ const _ = (e) => {
         code: "TOKEN_EXPIRED"
       }
     };
-  if (a.nbf !== void 0 && c + y < a.nbf)
+  if (a.nbf !== void 0 && f + g < a.nbf)
     return {
       valid: !1,
       error: {
@@ -393,7 +393,7 @@ const _ = (e) => {
         code: "TOKEN_NOT_ACTIVE"
       }
     };
-  if (a.iat !== void 0 && c + y < a.iat)
+  if (a.iat !== void 0 && f + g < a.iat)
     return {
       valid: !1,
       error: {
@@ -402,7 +402,7 @@ const _ = (e) => {
       }
     };
   if (r.maxTokenAge !== void 0 && a.iat !== void 0) {
-    const o = c - a.iat;
+    const o = f - a.iat;
     if (o > r.maxTokenAge)
       return {
         valid: !1,
@@ -458,8 +458,8 @@ const _ = (e) => {
           code: "MISSING_AUDIENCE"
         }
       };
-    const d = Array.isArray(r.audience) ? r.audience : [r.audience], h = Array.isArray(o) ? o : [o];
-    if (!d.some((N) => h.includes(N)))
+    const y = Array.isArray(r.audience) ? r.audience : [r.audience], S = Array.isArray(o) ? o : [o];
+    if (!y.some((u) => S.includes(u)))
       return {
         valid: !1,
         error: {
@@ -486,40 +486,40 @@ const _ = (e) => {
         }
       };
   }
-  return { valid: !0, header: s, payload: a, signature: f };
-}, j = {
-  sign: W,
-  verify: U,
-  decode: _,
-  algorithms: g
+  return { valid: !0, header: s, payload: a, signature: c };
+}, te = {
+  sign: F,
+  verify: j,
+  decode: x,
+  algorithms: p
 };
-function L(e) {
+function z(e) {
   if (!e || typeof e != "object") throw new Error("Invalid KeyObject");
   return e.export({ format: "jwk" });
 }
-function J(e) {
+function O(e) {
   if (!e || typeof e != "object") throw new Error("Invalid JWK");
   switch (e.kty) {
     case "oct": {
       if (!("k" in e) || typeof e.k != "string")
         throw new Error('Invalid oct JWK: missing "k"');
-      return B(Buffer.from(e.k, "base64url"));
+      return k(Buffer.from(e.k, "base64url"));
     }
     case "RSA":
     case "EC":
     case "OKP":
-      return "d" in e && typeof e.d == "string" ? I({ format: "jwk", key: e }) : T({ format: "jwk", key: e });
+      return "d" in e && typeof e.d == "string" ? P({ format: "jwk", key: e }) : _({ format: "jwk", key: e });
     default:
       throw new Error(`Unsupported JWK key type: ${e.kty}`);
   }
 }
-function C(e) {
+function X(e) {
   if (!e || typeof e != "object")
     throw new Error("Invalid KeyObject");
-  const r = (e.type === "private" ? T(e) : e).export({ format: "jwk" });
+  const r = (e.type === "private" ? _(e) : e).export({ format: "jwk" });
   return delete r.d, delete r.p, delete r.q, delete r.dp, delete r.dq, delete r.qi, r;
 }
-function w(e, t = "sha256") {
+function W(e, t = "sha256") {
   if (!e || typeof e != "object")
     throw new Error("Invalid JWK");
   let r;
@@ -542,54 +542,146 @@ function w(e, t = "sha256") {
   const n = JSON.stringify(
     Object.keys(r).sort().reduce((s, a) => (s[a] = r[a], s), {})
   );
-  return K(t).update(n).digest("base64url");
+  return N(t).update(n).digest("base64url");
 }
-function G(e) {
+function Y(e) {
   if (e.x5c?.length)
-    return K("sha1").update(Buffer.from(e.x5c[0], "base64")).digest("base64url");
+    return N("sha1").update(Buffer.from(e.x5c[0], "base64")).digest("base64url");
 }
-const z = {
-  export: L,
-  import: J,
-  toPublic: C,
-  thumbprint: w
+const ne = {
+  export: z,
+  import: O,
+  toPublic: X,
+  thumbprint: W
 };
-function V(e, t) {
+function Q(e, t) {
   if (!e || !Array.isArray(e.keys)) throw new Error("Invalid JWKS");
   let r;
   if (t && (r = e.keys.find((n) => n.kid === t)), !r && e.keys.length === 1 && (r = e.keys[0]), !r) throw new Error("Key not found in JWKS");
-  return J(r);
+  return O(r);
 }
-function q(e) {
+function D(e) {
   return {
     keys: e.keys.map((t) => ({
       ...t,
-      kid: t.kid ?? w(t),
-      x5t: t.x5t ?? G(t)
+      kid: t.kid ?? W(t),
+      x5t: t.x5t ?? Y(t)
     }))
   };
 }
-const X = {
-  toKeyObject: V,
-  normalize: q
+const Z = async (e, t = {}) => {
+  const r = typeof e == "string" ? e : e.toString(), n = t.fetch ?? globalThis.fetch, s = Math.max(0, t.ttl ?? 5 * 6e4), a = Math.max(0, t.timeoutMs ?? 5e3), c = "/.well-known/jwks.json";
+  if (!n)
+    throw new Error("No fetch implementation available");
+  const i = (() => {
+    if (t.endpointOverride) {
+      const l = t.endpointOverride;
+      try {
+        return new URL(l, r).toString();
+      } catch {
+        return l;
+      }
+    }
+    return t.overrideEndpointCheck || r.endsWith(c) ? r : `${r.replace(/\/+$/, "")}${c}`;
+  })(), d = (() => {
+    if (t.cache) return t.cache;
+    let l;
+    return {
+      get: () => l,
+      set: (u, h) => {
+        l = h;
+      }
+    };
+  })();
+  let f, g = 0, o, y = 0;
+  const S = async (l) => {
+    if (o) return o;
+    o = (async () => {
+      const u = new AbortController();
+      let h;
+      a > 0 && (h = setTimeout(() => u.abort(), a));
+      let A;
+      try {
+        A = await n(i, { signal: u.signal });
+      } catch (E) {
+        throw u.signal.aborted ? new Error(`JWKS fetch timed out after ${a}ms`) : E;
+      } finally {
+        h && clearTimeout(h);
+      }
+      if (!A.ok)
+        throw new Error(`Failed to fetch JWKS: ${A.status} ${A.statusText}`);
+      const b = await A.json();
+      if (!b || typeof b != "object" || !Array.isArray(b.keys))
+        throw new Error("Invalid JWKS");
+      return D(b);
+    })();
+    try {
+      const u = await o;
+      return f = u, await d.set(i, u), y = 0, s > 0 && (g = Date.now() + s), u;
+    } catch (u) {
+      if (!l || !f)
+        throw u;
+      if (y += 1, s > 0) {
+        const h = Math.min(
+          Math.max(s, 3e4) * Math.pow(2, y - 1),
+          9e5
+        );
+        g = Date.now() + h;
+      }
+      return console.warn(`JWKS refresh failed for "${i}", using stale cache.`, u), f;
+    } finally {
+      o = void 0;
+    }
+  };
+  return f = await d.get(i), f ? (f = D(f), s > 0 && (g = Date.now() + s)) : f = await S(!1), {
+    async list() {
+      return s > 0 && Date.now() >= g && await S(!0), Promise.resolve(f.keys);
+    },
+    async reload() {
+      return await S(!1), f.keys;
+    },
+    async key(l) {
+      return (await this.list()).find((h) => h.kid === l);
+    },
+    async find(l) {
+      const u = await this.list(), h = Object.entries(l);
+      return h.length === 0 ? u : u.filter(
+        (A) => h.every(([b, E]) => {
+          const T = A[b];
+          return Array.isArray(E) ? Array.isArray(T) && T.length === E.length && T.every((H, U) => H === E[U]) : T === E;
+        })
+      );
+    },
+    async findFirst(l) {
+      return this.find(l).then(([u]) => u);
+    },
+    export() {
+      return f;
+    }
+  };
+}, ae = {
+  toKeyObject: Q,
+  normalize: D,
+  fromWeb: Z
 };
 export {
-  $ as A,
-  j as J,
-  g as S,
-  F as a,
-  v as b,
-  G as c,
-  _ as d,
-  L as e,
-  z as f,
-  w as g,
-  V as h,
-  J as i,
-  X as j,
-  q as n,
-  W as s,
-  C as t,
-  U as v
+  V as A,
+  te as J,
+  p as S,
+  re as a,
+  K as b,
+  Y as c,
+  x as d,
+  z as e,
+  ne as f,
+  W as g,
+  Q as h,
+  O as i,
+  Z as j,
+  ae as k,
+  D as n,
+  F as s,
+  X as t,
+  j as v
 };
-//# sourceMappingURL=index-BmAAEOLC.js.map
+//# sourceMappingURL=index-BH3QmxZ_.js.map