Function get

apps/cloud/src/auth/jwks-cache.ts:371–391

(protectedHeader, token)

  };

  const get: JWTVerifyGetKey = async (protectedHeader, token) => {
    const current = await ensureFresh(false);
    // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: jose JWTVerifyGetKey retry path is defined by thrown resolver failures
    try {
      const resolveStartedAt = Date.now();
      const key = await current.resolver(protectedHeader, token);
      lastResolveMs = Date.now() - resolveStartedAt;
      return key;
    } catch (error) {
      // Likely cause: keys rotated upstream after our TTL window started, or
      // we answered from a stale entry. Refetch once and try again. Anything
      // still failing bubbles up so jose can classify it (we do not silently
      // swallow real failures).
      if (!isJwksNoMatchingKey(error)) {
        // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: jose JWTVerifyGetKey requires preserving upstream resolver rejection
        throw error;
      }
      const refreshed = await ensureFresh(true);
      return refreshed.resolver(protectedHeader, token);
    }
  };

  const result = get as CachedRemoteJWKSet;
  Object.defineProperty(result, "forceRefresh", {