better-supabase 0.11.0 → 0.13.0

package/dist/json-schema-Bu4YCRbZ.js

@@ -0,0 +1,551 @@
+import { t as isList } from "./guards-6F2bCtQR.js";
+import { r as tableJsonSchema, t as forTarget } from "./table-schema-xqSXrjCN.js";
+//#region src/generators/json-schema-target.ts
+function isObject(value) {
+	return typeof value === "object" && value !== null && !isList(value);
+}
+/** Keywords whose value is one subschema. */
+const SINGLE = /* @__PURE__ */ new Set([
+	"additionalProperties",
+	"additionalItems",
+	"contains",
+	"propertyNames",
+	"not",
+	"if",
+	"then",
+	"else"
+]);
+/** Keywords whose value is a list of subschemas. */
+const LISTS = /* @__PURE__ */ new Set([
+	"allOf",
+	"anyOf",
+	"oneOf"
+]);
+/** Keywords whose value maps names to subschemas. */
+const MAPS = /* @__PURE__ */ new Set([
+	"properties",
+	"patternProperties",
+	"definitions"
+]);
+/** 2020-12 keywords draft-07 has no equivalent for; draft-07 would ignore them. */
+const DROPPED = /* @__PURE__ */ new Set([
+	"$dynamicAnchor",
+	"$anchor",
+	"unevaluatedProperties",
+	"unevaluatedItems"
+]);
+function mapValues(value, convert) {
+	if (!isObject(value)) return value;
+	return Object.fromEntries(Object.entries(value).map(([key, child]) => [key, isObject(child) ? convert(child) : child]));
+}
+/**
+* Rewrites a 2020-12 schema into draft-07: `$defs` becomes `definitions` (and
+* `$ref`s into it follow), `prefixItems` becomes the array form of `items`,
+* `dependentRequired` and `dependentSchemas` become `dependencies`, and
+* keywords without a draft-07 form are left out. A draft-07 schema passes
+* through unchanged.
+*/
+function toDraft07(schema) {
+	const out = {};
+	const dependencies = {};
+	for (const [key, value] of Object.entries(schema)) {
+		if (DROPPED.has(key)) continue;
+		if (key === "$schema") continue;
+		if (key === "$defs") out["definitions"] = mapValues(value, toDraft07);
+		else if (key === "$ref" || key === "$dynamicRef") out["$ref"] = typeof value === "string" ? value.replace(/^#\/\$defs\//, "#/definitions/") : value;
+		else if (key === "prefixItems" && isList(value)) out["items"] = value.map((item) => isObject(item) ? toDraft07(item) : item);
+		else if (key === "items") {
+			const converted = isObject(value) ? toDraft07(value) : value;
+			if (schema["prefixItems"] === void 0) out["items"] = converted;
+			else out["additionalItems"] = converted;
+		} else if (key === "dependentRequired" || key === "dependentSchemas") Object.assign(dependencies, mapValues(value, toDraft07));
+		else if (SINGLE.has(key) && isObject(value)) out[key] = toDraft07(value);
+		else if (LISTS.has(key) && isList(value)) out[key] = value.map((item) => isObject(item) ? toDraft07(item) : item);
+		else if (MAPS.has(key)) out[key] = mapValues(value, toDraft07);
+		else out[key] = value;
+	}
+	if (Object.keys(dependencies).length > 0) out["dependencies"] = {
+		...isObject(out["dependencies"]) ? out["dependencies"] : {},
+		...dependencies
+	};
+	return out;
+}
+//#endregion
+//#region src/generators/shared.ts
+const INTEGER = /* @__PURE__ */ new Set([
+	"int2",
+	"int4",
+	"int8"
+]);
+const NUMBER = /* @__PURE__ */ new Set([
+	"float4",
+	"float8",
+	"numeric",
+	"oid",
+	"money"
+]);
+const DATETIME = /* @__PURE__ */ new Set(["timestamptz"]);
+function scalarKind(column) {
+	if (column.enum) return {
+		kind: "enum",
+		values: column.enum
+	};
+	if (column.json) return { kind: "json" };
+	if (column.codec === "instant") return { kind: "instant" };
+	if (column.codec === "plainDateTime") return { kind: "plainDateTime" };
+	if (column.codec === "bigint") return { kind: "bigint" };
+	if (column.codec === "string") return { kind: "string" };
+	if (column.type === "uuid") return { kind: "uuid" };
+	if (INTEGER.has(column.type)) return { kind: "integer" };
+	if (NUMBER.has(column.type)) return { kind: "number" };
+	if (column.type === "bool") return { kind: "boolean" };
+	if (DATETIME.has(column.type)) return { kind: "datetime" };
+	if (column.type === "date") return { kind: "date" };
+	if (column.type === "record" || column.type === "void") return { kind: "unknown" };
+	return { kind: "string" };
+}
+/** App names of the columns that plugins fill from the table's flags. */
+function managedColumns(table) {
+	const { timestamps, actor, softDelete } = table.flags;
+	return new Set([
+		timestamps?.createdAt,
+		timestamps?.updatedAt,
+		actor?.createdBy,
+		actor?.updatedBy,
+		actor?.impersonatedBy,
+		softDelete
+	].filter((name) => name !== void 0));
+}
+/**
+* The generated row type of a field (its element type for arrays). Storage path
+* columns validate as strings and are cast to their `StoragePath` brand.
+*/
+function rowType(table, plan) {
+	const type = `NonNullable<RowOf<'${table}'>['${plan.name}']>`;
+	return plan.column.array ? `${type}[number]` : type;
+}
+/** The fields a variant accepts; read-only columns are left out of writes. */
+function fieldsFor(table, variant, input) {
+	const fields = [];
+	const managed = managedColumns(table);
+	for (const [name, column] of Object.entries(table.columns)) {
+		if (variant === "Insert" && (column.generated || column.insertable === false)) continue;
+		if (variant === "Update" && (column.generated || column.updatable === false)) continue;
+		fields.push({
+			name,
+			column,
+			scalar: scalarKind(column),
+			nullable: column.nullable,
+			optional: variant === "Update" || variant === "Insert" && (column.nullable || column.hasDefault),
+			customJson: Boolean(column.json && (input.config.json[`${table.schema}.${table.name}.${column.db}`] ?? input.config.json[`${table.name}.${column.db}`])),
+			managed: managed.has(name)
+		});
+	}
+	return fields;
+}
+const TEMPORAL_GUARDS = {
+	instant: "isInstant",
+	plainDateTime: "isPlainDateTime"
+};
+/**
+* The `better-supabase` guards the generated validators call. They check
+* `Symbol.toStringTag`, so the module never reads `Temporal` when it loads.
+*/
+function temporalGuardImport(input) {
+	const names = /* @__PURE__ */ new Set();
+	for (const [, table] of tableEntries(input)) for (const plan of fieldsFor(table, "Row", input)) {
+		if (plan.customJson || plan.column.storage !== void 0) continue;
+		const guard = TEMPORAL_GUARDS[plan.scalar.kind];
+		if (guard) names.add(guard);
+	}
+	return names.size === 0 ? void 0 : `import { ${[...names].toSorted().join(", ")} } from ${JSON.stringify(input.runtimeImport ?? "better-supabase")};`;
+}
+const EXAMPLE = /^\s*@example\s+(.+?)\s*$/gm;
+const DEPRECATED = /^\s*@deprecated\b.*$/gm;
+const IS_DEPRECATED = /^\s*@deprecated\b/m;
+/**
+* Splits a comment into its description and `@example` lines. An example is
+* JSON (`@example 42`, `@example "KVK-1"`) or, when it doesn't parse, text. A
+* `@deprecated` line (with or without text) sets `deprecated` and is left out
+* of the description.
+*/
+function parseComment(comment) {
+	if (!comment) return { examples: [] };
+	const deprecated = IS_DEPRECATED.test(comment);
+	const examples = [...comment.matchAll(EXAMPLE)].map((match) => {
+		const raw = match[1] ?? "";
+		try {
+			return JSON.parse(raw);
+		} catch {
+			return raw;
+		}
+	});
+	const description = comment.replaceAll(EXAMPLE, "").replaceAll(DEPRECATED, "").trim();
+	return {
+		...description ? { description } : {},
+		examples,
+		...deprecated ? { deprecated: true } : {}
+	};
+}
+const COMPARISON = /^(?:(char_length|length)\(\(?"?(\w+)"?\)?(?:::[\w ]+)?\)|\(?"?(\w+)"?\)?(?:::[\w ]+)?)\s*(>=|>|<=|<)\s*\(?'?(-?\d+(?:\.\d+)?)'?\)?(?:::[\w ]+)?$/;
+const REVERSED = /^\(?'?(-?\d+(?:\.\d+)?)'?\)?(?:::[\w ]+)?\s*(>=|>|<=|<)\s*(?:(char_length|length)\(\(?"?(\w+)"?\)?(?:::[\w ]+)?\)|\(?"?(\w+)"?\)?(?:::[\w ]+)?)$/;
+const FLIP = {
+	">=": "<=",
+	">": "<",
+	"<=": ">=",
+	"<": ">"
+};
+/** Drops parentheses that wrap the whole expression. */
+function unwrap(expression) {
+	let text = expression.trim().replace(/^CHECK\s*/, "");
+	while (text.startsWith("(") && text.endsWith(")")) {
+		let depth = 0;
+		let wraps = true;
+		for (let i = 0; i < text.length - 1; i += 1) {
+			if (text[i] === "(") depth += 1;
+			else if (text[i] === ")") depth -= 1;
+			if (depth === 0) {
+				wraps = false;
+				break;
+			}
+		}
+		if (!wraps) break;
+		text = text.slice(1, -1).trim();
+	}
+	return text;
+}
+/** Terms of a top-level `AND` chain. */
+function conjuncts(expression) {
+	const terms = [];
+	let depth = 0;
+	let start = 0;
+	for (let i = 0; i < expression.length; i += 1) {
+		const char = expression[i];
+		if (char === "(") depth += 1;
+		else if (char === ")") depth -= 1;
+		else if (depth === 0 && expression.startsWith(" AND ", i)) {
+			terms.push(expression.slice(start, i));
+			start = i + 5;
+		}
+	}
+	terms.push(expression.slice(start));
+	return terms.map(unwrap);
+}
+function comparison(term) {
+	const forward = COMPARISON.exec(term);
+	if (forward) return {
+		column: forward[2] ?? forward[3] ?? "",
+		length: forward[1] !== void 0,
+		operator: forward[4],
+		value: Number(forward[5])
+	};
+	const reversed = REVERSED.exec(term);
+	if (!reversed) return;
+	return {
+		column: reversed[4] ?? reversed[5] ?? "",
+		length: reversed[3] !== void 0,
+		operator: FLIP[reversed[2]],
+		value: Number(reversed[1])
+	};
+}
+/**
+* Bounds from simple CHECK constraints, by column: `price >= 0`, `rating
+* between 1 and 5`, `char_length(name) <= 200`. Terms joined by `OR`, functions
+* other than `length` and `char_length`, and comparisons between columns are
+* left out.
+*/
+function parseCheckBounds(definition) {
+	const bounds = /* @__PURE__ */ new Map();
+	for (const term of conjuncts(unwrap(definition))) {
+		if (/\sOR\s/i.test(term)) continue;
+		const parsed = comparison(term);
+		if (!parsed?.column || Number.isNaN(parsed.value)) continue;
+		const current = bounds.get(parsed.column) ?? {};
+		bounds.set(parsed.column, {
+			...current,
+			...boundOf(parsed)
+		});
+	}
+	return bounds;
+}
+function boundOf({ length, operator, value }) {
+	if (length) switch (operator) {
+		case ">=": return { minLength: value };
+		case ">": return { minLength: value + 1 };
+		case "<=": return { maxLength: value };
+		case "<": return { maxLength: value - 1 };
+		default: return operator;
+	}
+	switch (operator) {
+		case ">=": return { minimum: value };
+		case ">": return { exclusiveMinimum: value };
+		case "<=": return { maximum: value };
+		case "<": return { exclusiveMaximum: value };
+		default: return operator;
+	}
+}
+/** `customer_tags` → `Customer tags`. */
+function titleOf(name) {
+	const words = name.replaceAll("_", " ").trim();
+	return words.charAt(0).toUpperCase() + words.slice(1);
+}
+const docsIndexes = /* @__PURE__ */ new WeakMap();
+const checkIndexes = /* @__PURE__ */ new WeakMap();
+/** CHECK definitions by `schema.name`, built once per extras. */
+function checksIndex(extras) {
+	let index = checkIndexes.get(extras);
+	if (index) return index;
+	const map = /* @__PURE__ */ new Map();
+	for (const table of extras.tables) {
+		const key = `${table.schema}.${table.name}`;
+		map.set(key, [...map.get(key) ?? [], ...table.checks.map((check) => check.definition)]);
+	}
+	index = map;
+	checkIndexes.set(extras, index);
+	return index;
+}
+/** The catalog keyed for `tableDocs`, built once per catalog. */
+function docsIndex(catalog) {
+	let index = docsIndexes.get(catalog);
+	if (index) return index;
+	const entries = /* @__PURE__ */ new Map();
+	for (const item of [
+		...catalog.tables,
+		...catalog.views,
+		...catalog.materializedViews ?? []
+	]) {
+		const key = `${item.schema}.${item.name}`;
+		if (!entries.has(key)) entries.set(key, item);
+	}
+	const columns = /* @__PURE__ */ new Map();
+	for (const column of catalog.columns) {
+		const list = columns.get(column.table_id);
+		if (list) list.push(column);
+		else columns.set(column.table_id, [column]);
+	}
+	index = {
+		entries,
+		columns
+	};
+	docsIndexes.set(catalog, index);
+	return index;
+}
+/** Title, description and per-column docs, or `undefined` without a catalog. */
+function tableDocs(input, table) {
+	const catalog = input.introspection;
+	if (!catalog) return;
+	const index = docsIndex(catalog);
+	const entry = index.entries.get(`${table.schema}.${table.name}`);
+	const checks = /* @__PURE__ */ new Map();
+	const addChecks = (definition) => {
+		for (const [column, bounds] of parseCheckBounds(definition)) checks.set(column, {
+			...checks.get(column),
+			...bounds
+		});
+	};
+	const extras = input.extras;
+	for (const definition of extras ? checksIndex(extras).get(`${table.schema}.${table.name}`) ?? [] : []) addChecks(definition);
+	const fields = /* @__PURE__ */ new Map();
+	for (const column of entry ? index.columns.get(entry.id) ?? [] : []) {
+		if (column.check) addChecks(column.check);
+		const { description, examples } = parseComment(column.comment);
+		fields.set(column.name, {
+			...description === void 0 ? {} : { description },
+			...examples.length > 0 ? { examples } : {}
+		});
+	}
+	for (const [column, bounds] of checks) fields.set(column, {
+		...fields.get(column),
+		...bounds
+	});
+	const { description } = parseComment(entry?.comment ?? null);
+	return {
+		title: titleOf(table.name),
+		...description === void 0 ? {} : { description },
+		fields
+	};
+}
+/** A variant's title: `Customers`, `Customers insert`, `Customers update`. */
+function variantTitle(docs, variant) {
+	return variant === "Row" ? docs.title : `${docs.title} ${variant.toLowerCase()}`;
+}
+function exampleFits(scalar, value) {
+	switch (scalar.kind) {
+		case "uuid":
+		case "string":
+		case "datetime":
+		case "date": return typeof value === "string";
+		case "enum": return typeof value === "string" && scalar.values.includes(value);
+		case "integer": return Number.isInteger(value);
+		case "number": return typeof value === "number";
+		case "boolean": return typeof value === "boolean";
+		case "json":
+		case "unknown": return true;
+		case "instant":
+		case "plainDateTime":
+		case "bigint": return false;
+		default: return scalar;
+	}
+}
+/**
+* The docs a field's validator can carry: value bounds on numbers, length
+* bounds on text, and only examples its type accepts.
+*/
+function fieldDocs(docs, plan) {
+	const found = docs?.fields.get(plan.column.db);
+	if (!found || plan.customJson || plan.column.storage !== void 0) return {};
+	const numeric = !plan.column.array && (plan.scalar.kind === "integer" || plan.scalar.kind === "number");
+	const text = !plan.column.array && plan.scalar.kind === "string";
+	const fits = (value) => value === null && plan.nullable || (plan.column.array ? Array.isArray(value) && value.every((item) => exampleFits(plan.scalar, item)) : exampleFits(plan.scalar, value));
+	const examples = found.examples?.filter(fits) ?? [];
+	return {
+		...found.description === void 0 ? {} : { description: found.description },
+		...examples.length > 0 ? { examples } : {},
+		...numeric ? pick(found, [
+			"minimum",
+			"exclusiveMinimum",
+			"maximum",
+			"exclusiveMaximum"
+		]) : {},
+		...text ? pick(found, ["minLength", "maxLength"]) : {}
+	};
+}
+/**
+* A field as `tableSchema()` and `tableJsonSchema()` read it. A jsonb column
+* with a configured TypeScript type becomes `custom`; set `schema` on the
+* result for one with a validator.
+*/
+function fieldSpec(plan, docs) {
+	return {
+		...plan.customJson ? { kind: "custom" } : plan.scalar,
+		...plan.nullable ? { nullable: true } : {},
+		...plan.optional ? { optional: true } : {},
+		...plan.column.array ? { array: true } : {},
+		...plan.managed ? { readOnly: true } : {},
+		...docs
+	};
+}
+function pick(bounds, keys) {
+	const out = {};
+	for (const key of keys) {
+		const value = bounds[key];
+		if (value !== void 0) out[key] = value;
+	}
+	return out;
+}
+function optionalLine(line) {
+	return line === void 0 ? [] : [line];
+}
+function variantsFor(table) {
+	if (table.kind !== "view") return [
+		"Row",
+		"Insert",
+		"Update"
+	];
+	const columns = Object.values(table.columns).filter((column) => !column.generated);
+	return [
+		"Row",
+		...columns.some((column) => column.insertable !== false) ? ["Insert"] : [],
+		...columns.some((column) => column.updatable !== false) ? ["Update"] : []
+	];
+}
+function tableEntries(input) {
+	return Object.entries(input.meta.tables).toSorted(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+}
+function propertyKey(name) {
+	return /^[A-Za-z_$][\w$]*$/.test(name) ? name : JSON.stringify(name);
+}
+/** `customerTags` + `Insert` → `customerTagsInsert`. */
+function schemaName(table, variant) {
+	return `${table.replace(/^[A-Z]/, (c) => c.toLowerCase())}${variant}`;
+}
+/** Output path next to the main module: `generated.ts` → `generated.zod.ts`. */
+function siblingPath(output, suffix) {
+	return output.replace(/(\.[cm]?ts)?$/, `.${suffix}`);
+}
+const HEADER = "// Generated by better-supabase. Do not edit; run `better-supabase gen`.\n";
+/**
+* `./metadata.ts#metadataSchema` → `{ from: './metadata.ts', name:
+* 'metadataSchema' }`.
+*/
+function parseImport(spec) {
+	const [from, name] = spec.split("#");
+	if (!from || !name) throw new Error(`Expected "path#export", got "${spec}"`);
+	return {
+		from,
+		name
+	};
+}
+//#endregion
+//#region src/generators/json-schema.ts
+/** Marks the deprecated table and columns, which only `meta` knows about. */
+function withDeprecated(schema, deprecated, columns) {
+	if (!deprecated && columns.length === 0) return schema;
+	const properties = schema["properties"];
+	return {
+		...schema,
+		...deprecated ? { deprecated: true } : {},
+		...columns.length > 0 && typeof properties === "object" && properties ? { properties: Object.fromEntries(Object.entries(properties).map(([name, value]) => [name, columns.includes(name) && typeof value === "object" && value ? {
+			...value,
+			deprecated: true
+		} : value])) } : {}
+	};
+}
+/**
+* JSON Schema `$defs` for every table: `customersRow`, `customersInsert`, ...
+* `target` lowers the document to draft-07 or the OpenAPI 3.0 dialect, which
+* keep the schemas under `definitions`.
+*/
+function buildJsonSchema(input, id, target = "draft-2020-12") {
+	const defs = {};
+	for (const [key, table] of tableEntries(input)) {
+		const docs = tableDocs(input, table);
+		const description = docs ? docs.description : table.description;
+		for (const variant of variantsFor(table)) {
+			const plans = fieldsFor(table, variant, input);
+			const schema = tableJsonSchema({
+				...docs ? { title: variantTitle(docs, variant) } : {},
+				...description === void 0 ? {} : { description },
+				fields: Object.fromEntries(plans.map((plan) => {
+					const spec = fieldSpec(plan, fieldDocs(docs, plan));
+					return [plan.name, docs || plan.column.description === void 0 ? spec : {
+						description: plan.column.description,
+						...spec
+					}];
+				}))
+			});
+			defs[`${key}${variant}`] = withDeprecated(schema, table.deprecated === true, plans.filter((plan) => plan.column.deprecated).map((plan) => plan.name));
+		}
+	}
+	switch (target) {
+		case "draft-2020-12": return {
+			$schema: "https://json-schema.org/draft/2020-12/schema",
+			...id ? { $id: id } : {},
+			$defs: defs
+		};
+		case "draft-07": return forTarget({
+			...id ? { $id: id } : {},
+			definitions: Object.fromEntries(Object.entries(defs).map(([name, def]) => [name, toDraft07(def)]))
+		}, "draft-07");
+		case "openapi-3.0": return {
+			...id ? { $id: id } : {},
+			definitions: Object.fromEntries(Object.entries(defs).map(([name, def]) => [name, forTarget(def, "openapi-3.0")]))
+		};
+		default: return target;
+	}
+}
+/** Writes the JSON Schema document; `createOpenApi` reuses the same `$defs`. */
+function jsonSchema(options = {}) {
+	return {
+		apiVersion: 1,
+		name: "json-schema",
+		generate(input) {
+			return [{
+				path: options.output ?? siblingPath(input.config.output, "schema.json"),
+				contents: `${JSON.stringify(buildJsonSchema(input, options.id, options.target), null, 2)}\n`
+			}];
+		}
+	};
+}
+//#endregion
+export { variantsFor as _, fieldSpec as a, parseImport as c, schemaName as d, siblingPath as f, variantTitle as g, temporalGuardImport as h, fieldDocs as i, propertyKey as l, tableEntries as m, jsonSchema as n, fieldsFor as o, tableDocs as p, HEADER as r, optionalLine as s, buildJsonSchema as t, rowType as u, toDraft07 as v };

package/dist/jwks-cache-DbgNmSgV.js

@@ -0,0 +1,49 @@
+import { n as dbError } from "./errors-D7u24ZJH.js";
+import { a as ok, r as err } from "./result-DIT_qp4G.js";
+import { a as jwksOf } from "./jws-DOgHJKHb.js";
+//#region src/core/jwks-cache.ts
+/** The most bytes read from a JWKS response. */
+const MAX_JWKS_BYTES = 262144;
+/**
+* A cached key set. A URL is fetched on first use and again after
+* `cacheSeconds`; a refresh for an unknown `kid` refetches at most once per
+* `refetchSeconds`, so a stream of forged `kid`s can't hammer the issuer.
+* Concurrent callers share one fetch.
+*/
+function jwksSource(input, options = {}) {
+	const parse = (value) => jwksOf(value, options.rsa === void 0 ? {} : { rsa: options.rsa });
+	if (!(input instanceof URL) && typeof input !== "function") {
+		const keys = parse(input);
+		return () => Promise.resolve(ok(keys));
+	}
+	const now = options.now ?? Date.now;
+	const cacheMs = (options.cacheSeconds ?? 300) * 1e3;
+	const refetchMs = (options.refetchSeconds ?? 30) * 1e3;
+	let cached;
+	let pending;
+	const load = async () => {
+		if (typeof input === "function") return ok(parse(await input()));
+		const response = await (options.fetch ?? fetch)(input, { headers: { accept: "application/jwk-set+json, application/json" } });
+		if (!response.ok) return err(dbError("network", `The JWKS answered ${response.status}`, { code: "JWKS_FETCH_FAILED" }));
+		const text = await response.text();
+		if (text.length > MAX_JWKS_BYTES) return err(dbError("network", "The JWKS response is too large", { code: "JWKS_FETCH_FAILED" }));
+		return ok(parse(JSON.parse(text)));
+	};
+	return async (refresh) => {
+		const age = cached ? now() - cached.at : Number.POSITIVE_INFINITY;
+		if (cached && age < (refresh ? refetchMs : cacheMs)) return ok(cached.keys);
+		pending ??= load().catch((cause) => err(dbError("network", `The JWKS could not be loaded: ${cause instanceof Error ? cause.message : String(cause)}`, { code: "JWKS_FETCH_FAILED" }))).then((result) => {
+			if (result.ok) cached = {
+				keys: result.data,
+				at: now()
+			};
+			return result;
+		}).finally(() => {
+			pending = void 0;
+		});
+		const result = await pending;
+		return !result.ok && cached ? ok(cached.keys) : result;
+	};
+}
+//#endregion
+export { jwksSource as t };

package/dist/jws-D0toeQlA.d.ts

@@ -0,0 +1,66 @@
+//#region src/core/jws.d.ts
+/** The key types a signing key can have. */
+type SigningAlgorithm = "Ed25519" | "ES256";
+/**
+ * The JWS `alg` a key signs with: `ES256`, or for an Ed25519 key `EdDSA` (RFC 8037)
+ * or the fully specified `Ed25519` (RFC 9864). `RS256` and `PS256` (RSA, 2048
+ * bits or more) only verify, and only when a caller lists them in
+ * `algorithms`.
+ */
+type JwsAlgorithm = "EdDSA" | "Ed25519" | "ES256" | "PS256" | "RS256";
+/**
+ * A public or private JSON Web Key (RFC 7517): Ed25519, P-256, or a public RSA
+ * key.
+ */
+interface Jwk {
+  readonly kty: string;
+  readonly crv?: string;
+  readonly x?: string;
+  readonly y?: string;
+  readonly n?: string;
+  readonly e?: string;
+  readonly d?: string;
+  readonly kid?: string;
+  readonly alg?: string;
+  readonly use?: string;
+  readonly [member: string]: unknown;
+}
+/** A JWK Set (RFC 7517 section 5). */
+interface Jwks {
+  readonly keys: readonly Jwk[];
+}
+/** The RFC 7638 SHA-256 thumbprint of a key, base64url: a stable `kid`. */
+declare function jwkThumbprint(jwk: Jwk): Promise<string>;
+/** What `verifyCompact` returns for a valid token. */
+interface VerifiedJws {
+  readonly header: Readonly<Record<string, unknown>>;
+  readonly payload: Readonly<Record<string, unknown>>;
+}
+interface VerifyCompactOptions {
+  /** The `alg` values accepted. Default: `EdDSA`, `Ed25519` and `ES256`. */
+  readonly algorithms?: readonly JwsAlgorithm[];
+  /** The `typ` header the token must carry, compared case-insensitively. */
+  readonly typ?: string;
+}
+/** Why a token failed `verifyCompact`. */
+declare class JwsError extends Error {
+  readonly code: string;
+  constructor(code: string, message: string);
+}
+/**
+ * Verifies a compact JWS against `jwks`: the header's `kid` picks the key (or
+ * the only key of the matching type when there is no `kid`). Throws a
+ * `JwsError`; checks no claims, which are the caller's to read.
+ */
+declare function verifyCompact(token: string, jwks: Jwks, options?: VerifyCompactOptions): Promise<VerifiedJws>;
+interface JwksOfOptions {
+  /** Keep RSA keys of 2048 bits or more too, for `RS256` and `PS256`. */
+  readonly rsa?: boolean;
+}
+/**
+ * Parses a JWK Set, keeping only the Ed25519 and P-256 keys (and RSA keys with
+ * `rsa`).
+ */
+declare function jwksOf(value: unknown, options?: JwksOfOptions): Jwks;
+//#endregion
+export { JwsError as a, VerifyCompactOptions as c, verifyCompact as d, JwsAlgorithm as i, jwkThumbprint as l, Jwks as n, SigningAlgorithm as o, JwksOfOptions as r, VerifiedJws as s, Jwk as t, jwksOf as u };